src/core/machine-id-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <unistd.h>
  23 #include <stdio.h>
  24 #include <errno.h>
  25 #include <string.h>
  26 #include <stdlib.h>
  27 #include <fcntl.h>
  28 #include <sys/mount.h>
  29
  30 #include "systemd/sd-id128.h"
  31
  32 #include "machine-id-setup.h"
  33 #include "macro.h"
  34 #include "util.h"
  35 #include "mkdir.h"
  36 #include "log.h"
  37 #include "virt.h"
  38 #include "fileio.h"
  39 #include "path-util.h"
  40
  41 static int shorten_uuid(char destination[34], const char source[36]) {
  42         unsigned i, j;
  43
  44         for (i = 0, j = 0; i < 36 && j < 32; i++) {
  45                 int t;
  46
  47                 t = unhexchar(source[i]);
  48                 if (t < 0)
  49                         continue;
  50
  51                 destination[j++] = hexchar(t);
  52         }
  53
  54         if (i == 36 && j == 32) {
  55                 destination[32] = '\n';
  56                 destination[33] = 0;
  57                 return 0;
  58         }
  59
  60         return -EINVAL;
  61 }
  62
  63 static int generate(char id[34], const char *root) {
  64         int fd, r;
  65         unsigned char *p;
  66         sd_id128_t buf;
  67         char  *q;
  68         ssize_t k;
  69         const char *vm_id, *dbus_machine_id;
  70
  71         assert(id);
  72
  73         if (isempty(root))
  74                 dbus_machine_id = "/var/lib/dbus/machine-id";
  75         else
  76                 dbus_machine_id = strjoina(root, "/var/lib/dbus/machine-id");
  77
  78         /* First, try reading the D-Bus machine id, unless it is a symlink */
  79         fd = open(dbus_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
  80         if (fd >= 0) {
  81                 k = loop_read(fd, id, 33, false);
  82                 safe_close(fd);
  83
  84                 if (k == 33 && id[32] == '\n') {
  85
  86                         id[32] = 0;
  87                         if (id128_is_valid(id)) {
  88                                 id[32] = '\n';
  89                                 id[33] = 0;
  90
  91                                 log_info("Initializing machine ID from D-Bus machine ID.");
  92                                 return 0;
  93                         }
  94                 }
  95         }
  96
  97         if (isempty(root)) {
  98                 /* If that didn't work, see if we are running in a container,
  99                  * and a machine ID was passed in via $container_uuid the way
 100                  * libvirt/LXC does it */
 101                 r = detect_container(NULL);
 102                 if (r > 0) {
 103                         _cleanup_free_ char *e = NULL;
 104
 105                         r = getenv_for_pid(1, "container_uuid", &e);
 106                         if (r > 0) {
 107                                 if (strlen(e) >= 36) {
 108                                         r = shorten_uuid(id, e);
 109                                         if (r >= 0) {
 110                                                 log_info("Initializing machine ID from container UUID.");
 111                                                 return 0;
 112                                         }
 113                                 }
 114                         }
 115
 116                 } else {
 117                         /* If we are not running in a container, see if we are
 118                          * running in qemu/kvm and a machine ID was passed in
 119                          * via -uuid on the qemu/kvm command line */
 120
 121                         r = detect_vm(&vm_id);
 122                         if (r > 0 && streq(vm_id, "kvm")) {
 123                                 char uuid[37];
 124
 125                                 fd = open("/sys/class/dmi/id/product_uuid", O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
 126                                 if (fd >= 0) {
 127                                         k = loop_read(fd, uuid, 36, false);
 128                                         safe_close(fd);
 129
 130                                         if (k >= 36) {
 131                                                 r = shorten_uuid(id, uuid);
 132                                                 if (r >= 0) {
 133                                                         log_info("Initializing machine ID from KVM UUID.");
 134                                                         return 0;
 135                                                 }
 136                                         }
 137                                 }
 138                         }
 139                 }
 140         }
 141
 142         /* If that didn't work, generate a random machine id */
 143         r = sd_id128_randomize(&buf);
 144         if (r < 0)
 145                 return log_error_errno(r, "Failed to open /dev/urandom: %m");
 146
 147         for (p = buf.bytes, q = id; p < buf.bytes + sizeof(buf); p++, q += 2) {
 148                 q[0] = hexchar(*p >> 4);
 149                 q[1] = hexchar(*p & 15);
 150         }
 151
 152         id[32] = '\n';
 153         id[33] = 0;
 154
 155         log_info("Initializing machine ID from random generator.");
 156
 157         return 0;
 158 }
 159
 160 static int get_valid_machine_id(int fd, char id[34]) {
 161         char id_to_validate[34];
 162
 163         assert(fd >= 0);
 164         assert(id);
 165
 166         if (loop_read(fd, id_to_validate, 33, false) == 33 && id_to_validate[32] == '\n') {
 167                 id_to_validate[32] = 0;
 168
 169                 if (id128_is_valid(id_to_validate)) {
 170                         memcpy(id, id_to_validate, 32);
 171                         id[32] = '\n';
 172                         id[33] = 0;
 173                         return 0;
 174                 }
 175         }
 176
 177         return -EINVAL;
 178 }
 179
 180 static int write_machine_id(int fd, char id[34]) {
 181         assert(fd >= 0);
 182         assert(id);
 183         lseek(fd, 0, SEEK_SET);
 184
 185         if (loop_write(fd, id, 33, false) == 0)
 186                 return 0;
 187
 188         return -errno;
 189 }
 190
 191 int machine_id_commit(const char *root) {
 192         _cleanup_close_ int fd = -1, initial_mntns_fd = -1;
 193         const char *etc_machine_id;
 194         char id[34]; /* 32 + \n + \0 */
 195         int r;
 196
 197         if (isempty(root))
 198                 etc_machine_id = "/etc/machine-id";
 199         else {
 200                 char *x;
 201
 202                 x = strjoina(root, "/etc/machine-id");
 203                 etc_machine_id = path_kill_slashes(x);
 204         }
 205
 206         r = path_is_mount_point(etc_machine_id, false);
 207         if (r < 0)
 208                 return log_error_errno(r, "Failed to determine whether %s is a mount point: %m", etc_machine_id);
 209         if (r == 0) {
 210                 log_debug("%s is is not a mount point. Nothing to do.", etc_machine_id);
 211                 return 0;
 212         }
 213
 214         /* Read existing machine-id */
 215         fd = open(etc_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY);
 216         if (fd < 0)
 217                 return log_error_errno(errno, "Cannot open %s: %m", etc_machine_id);
 218
 219         r = get_valid_machine_id(fd, id);
 220         if (r < 0)
 221                 return log_error_errno(r, "We didn't find a valid machine ID in %s.", etc_machine_id);
 222
 223         r = is_fd_on_temporary_fs(fd);
 224         if (r < 0)
 225                 return log_error_errno(r, "Failed to determine whether %s is on a temporary file system: %m", etc_machine_id);
 226         if (r == 0) {
 227                 log_error("%s is not on a temporary file system.", etc_machine_id);
 228                 return -EROFS;
 229         }
 230
 231         fd = safe_close(fd);
 232
 233         /* Store current mount namespace */
 234         r = namespace_open(0, NULL, &initial_mntns_fd, NULL, NULL);
 235         if (r < 0)
 236                 return log_error_errno(r, "Can't fetch current mount namespace: %m");
 237
 238         /* Switch to a new mount namespace, isolate ourself and unmount etc_machine_id in our new namespace */
 239         if (unshare(CLONE_NEWNS) < 0)
 240                 return log_error_errno(errno, "Failed to enter new namespace: %m");
 241
 242         if (mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL) < 0)
 243                 return log_error_errno(errno, "Couldn't make-rslave / mountpoint in our private namespace: %m");
 244
 245         if (umount(etc_machine_id) < 0)
 246                 return log_error_errno(errno, "Failed to unmount transient %s file in our private namespace: %m", etc_machine_id);
 247
 248         /* Update a persistent version of etc_machine_id */
 249         fd = open(etc_machine_id, O_RDWR|O_CREAT|O_CLOEXEC|O_NOCTTY, 0444);
 250         if (fd < 0)
 251                 return log_error_errno(errno, "Cannot open for writing %s. This is mandatory to get a persistent machine-id: %m", etc_machine_id);
 252
 253         r = write_machine_id(fd, id);
 254         if (r < 0)
 255                 return log_error_errno(r, "Cannot write %s: %m", etc_machine_id);
 256
 257         fd = safe_close(fd);
 258
 259         /* Return to initial namespace and proceed a lazy tmpfs unmount */
 260         r = namespace_enter(-1, initial_mntns_fd, -1, -1);
 261         if (r < 0)
 262                 return log_warning_errno(r, "Failed to switch back to initial mount namespace: %m.\nWe'll keep transient %s file until next reboot.", etc_machine_id);
 263
 264         if (umount2(etc_machine_id, MNT_DETACH) < 0)
 265                 return log_warning_errno(errno, "Failed to unmount transient %s file: %m.\nWe keep that mount until next reboot.", etc_machine_id);
 266
 267         return 0;
 268 }
 269
 270 int machine_id_setup(const char *root) {
 271         const char *etc_machine_id, *run_machine_id;
 272         _cleanup_close_ int fd = -1;
 273         bool writable = true;
 274         struct stat st;
 275         char id[34]; /* 32 + \n + \0 */
 276         int r;
 277
 278         if (isempty(root))  {
 279                 etc_machine_id = "/etc/machine-id";
 280                 run_machine_id = "/run/machine-id";
 281         } else {
 282                 char *x;
 283
 284                 x = strjoina(root, "/etc/machine-id");
 285                 etc_machine_id = path_kill_slashes(x);
 286
 287                 x = strjoina(root, "/run/machine-id");
 288                 run_machine_id = path_kill_slashes(x);
 289         }
 290
 291         RUN_WITH_UMASK(0000) {
 292                 /* We create this 0444, to indicate that this isn't really
 293                  * something you should ever modify. Of course, since the file
 294                  * will be owned by root it doesn't matter much, but maybe
 295                  * people look. */
 296
 297                 mkdir_parents(etc_machine_id, 0755);
 298                 fd = open(etc_machine_id, O_RDWR|O_CREAT|O_CLOEXEC|O_NOCTTY, 0444);
 299                 if (fd < 0) {
 300                         int old_errno = errno;
 301
 302                         fd = open(etc_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY);
 303                         if (fd < 0) {
 304                                 if (old_errno == EROFS && errno == ENOENT)
 305                                         log_error("System cannot boot: Missing /etc/machine-id and /etc is mounted read-only.\n"
 306                                                   "Booting up is supported only when:\n"
 307                                                   "1) /etc/machine-id exists and is populated.\n"
 308                                                   "2) /etc/machine-id exists and is empty.\n"
 309                                                   "3) /etc/machine-id is missing and /etc is writable.\n");
 310                                 else
 311                                         log_error_errno(errno, "Cannot open %s: %m", etc_machine_id);
 312                                 return -errno;
 313                         }
 314
 315                         writable = false;
 316                 }
 317         }
 318
 319         if (fstat(fd, &st) < 0)
 320                 return log_error_errno(errno, "fstat() failed: %m");
 321
 322         if (S_ISREG(st.st_mode) && get_valid_machine_id(fd, id) == 0)
 323                 return 0;
 324
 325         /* Hmm, so, the id currently stored is not useful, then let's
 326          * generate one */
 327
 328         r = generate(id, root);
 329         if (r < 0)
 330                 return r;
 331
 332         if (S_ISREG(st.st_mode) && writable)
 333                 if (write_machine_id(fd, id) == 0)
 334                         return 0;
 335
 336         fd = safe_close(fd);
 337
 338         /* Hmm, we couldn't write it? So let's write it to
 339          * /run/machine-id as a replacement */
 340
 341         RUN_WITH_UMASK(0022) {
 342                 r = write_string_file(run_machine_id, id);
 343         }
 344         if (r < 0) {
 345                 log_error_errno(r, "Cannot write %s: %m", run_machine_id);
 346                 unlink(run_machine_id);
 347                 return r;
 348         }
 349
 350         /* And now, let's mount it over */
 351         r = mount(run_machine_id, etc_machine_id, NULL, MS_BIND, NULL);
 352         if (r < 0) {
 353                 log_error_errno(errno, "Failed to mount %s: %m", etc_machine_id);
 354                 unlink_noerrno(run_machine_id);
 355                 return -errno;
 356         }
 357
 358         log_info("Installed transient %s file.", etc_machine_id);
 359
 360         /* Mark the mount read-only */
 361         if (mount(NULL, etc_machine_id, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, NULL) < 0)
 362                 log_warning_errno(errno, "Failed to make transient %s read-only: %m", etc_machine_id);
 363
 364         return 0;
 365 }