src/core/mount-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <sys/mount.h>
  23 #include <errno.h>
  24 #include <sys/stat.h>
  25 #include <stdlib.h>
  26 #include <string.h>
  27 #include <libgen.h>
  28 #include <assert.h>
  29 #include <unistd.h>
  30 #include <ftw.h>
  31
  32 #include "mount-setup.h"
  33 #include "dev-setup.h"
  34 #include "log.h"
  35 #include "macro.h"
  36 #include "util.h"
  37 #include "label.h"
  38 #include "set.h"
  39 #include "strv.h"
  40 #include "mkdir.h"
  41 #include "path-util.h"
  42 #include "missing.h"
  43 #include "virt.h"
  44 #include "efivars.h"
  45
  46 #ifndef TTY_GID
  47 #define TTY_GID 5
  48 #endif
  49
  50 typedef enum MountMode {
  51         MNT_NONE  =        0,
  52         MNT_FATAL =        1 <<  0,
  53         MNT_IN_CONTAINER = 1 <<  1,
  54 } MountMode;
  55
  56 typedef struct MountPoint {
  57         const char *what;
  58         const char *where;
  59         const char *type;
  60         const char *options;
  61         unsigned long flags;
  62         bool (*condition_fn)(void);
  63         MountMode mode;
  64 } MountPoint;
  65
  66 /* The first three entries we might need before SELinux is up. The
  67  * fourth (securityfs) is needed by IMA to load a custom policy. The
  68  * other ones we can delay until SELinux and IMA are loaded. */
  69 #define N_EARLY_MOUNT 5
  70
  71 static const MountPoint mount_table[] = {
  72         { "proc",       "/proc",                     "proc",       NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  73           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  74         { "sysfs",      "/sys",                      "sysfs",      NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  75           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  76         { "devtmpfs",   "/dev",                      "devtmpfs",   "mode=755", MS_NOSUID|MS_STRICTATIME,
  77           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  78         { "securityfs", "/sys/kernel/security",      "securityfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  79           NULL,       MNT_NONE },
  80         { "smackfs",    "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
  81           NULL,       MNT_NONE },
  82         { "tmpfs",      "/dev/shm",                  "tmpfs",      "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  83           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  84         { "devpts",     "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
  85           NULL,       MNT_IN_CONTAINER },
  86         { "tmpfs",      "/run",                      "tmpfs",      "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  87           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  88         { "tmpfs",      "/sys/fs/cgroup",            "tmpfs",      "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
  89           NULL,       MNT_IN_CONTAINER },
  90         { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV,
  91           NULL,       MNT_IN_CONTAINER },
  92         { "pstore",     "/sys/fs/pstore",            "pstore",     NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  93           NULL,       MNT_NONE },
  94 #ifdef ENABLE_EFI
  95         { "efivarfs",   "/sys/firmware/efi/efivars", "efivarfs",   NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  96           is_efi_boot, MNT_NONE },
  97 #endif
  98 };
  99
 100 /* These are API file systems that might be mounted by other software,
 101  * we just list them here so that we know that we should ignore them */
 102
 103 static const char ignore_paths[] =
 104         /* SELinux file systems */
 105         "/sys/fs/selinux\0"
 106         "/selinux\0"
 107         /* Legacy cgroup mount points */
 108         "/dev/cgroup\0"
 109         "/cgroup\0"
 110         /* Legacy kernel file system */
 111         "/proc/bus/usb\0"
 112         /* Container bind mounts */
 113         "/proc/sys\0"
 114         "/dev/console\0"
 115         "/proc/kmsg\0";
 116
 117 bool mount_point_is_api(const char *path) {
 118         unsigned i;
 119
 120         /* Checks if this mount point is considered "API", and hence
 121          * should be ignored */
 122
 123         for (i = 0; i < ELEMENTSOF(mount_table); i ++)
 124                 if (path_equal(path, mount_table[i].where))
 125                         return true;
 126
 127         return path_startswith(path, "/sys/fs/cgroup/");
 128 }
 129
 130 bool mount_point_ignore(const char *path) {
 131         const char *i;
 132
 133         NULSTR_FOREACH(i, ignore_paths)
 134                 if (path_equal(path, i))
 135                         return true;
 136
 137         return false;
 138 }
 139
 140 static int mount_one(const MountPoint *p, bool relabel) {
 141         int r;
 142
 143         assert(p);
 144
 145         if (p->condition_fn && !p->condition_fn())
 146                 return 0;
 147
 148         /* Relabel first, just in case */
 149         if (relabel)
 150                 label_fix(p->where, true, true);
 151
 152         r = path_is_mount_point(p->where, true);
 153         if (r < 0)
 154                 return r;
 155
 156         if (r > 0)
 157                 return 0;
 158
 159         /* Skip securityfs in a container */
 160         if (!(p->mode & MNT_IN_CONTAINER) && detect_container(NULL) > 0)
 161                 return 0;
 162
 163         /* The access mode here doesn't really matter too much, since
 164          * the mounted file system will take precedence anyway. */
 165         mkdir_p_label(p->where, 0755);
 166
 167         log_debug("Mounting %s to %s of type %s with options %s.",
 168                   p->what,
 169                   p->where,
 170                   p->type,
 171                   strna(p->options));
 172
 173         if (mount(p->what,
 174                   p->where,
 175                   p->type,
 176                   p->flags,
 177                   p->options) < 0) {
 178                 log_full((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, "Failed to mount %s: %s", p->where, strerror(errno));
 179                 return (p->mode & MNT_FATAL) ? -errno : 0;
 180         }
 181
 182         /* Relabel again, since we now mounted something fresh here */
 183         if (relabel)
 184                 label_fix(p->where, false, false);
 185
 186         return 1;
 187 }
 188
 189 int mount_setup_early(void) {
 190         unsigned i;
 191         int r = 0;
 192
 193         assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table));
 194
 195         /* Do a minimal mount of /proc and friends to enable the most
 196          * basic stuff, such as SELinux */
 197         for (i = 0; i < N_EARLY_MOUNT; i ++)  {
 198                 int j;
 199
 200                 j = mount_one(mount_table + i, false);
 201                 if (r == 0)
 202                         r = j;
 203         }
 204
 205         return r;
 206 }
 207
 208 int mount_cgroup_controllers(char ***join_controllers) {
 209         int r;
 210         FILE *f;
 211         char buf[LINE_MAX];
 212         Set *controllers;
 213
 214         /* Mount all available cgroup controllers that are built into the kernel. */
 215
 216         f = fopen("/proc/cgroups", "re");
 217         if (!f) {
 218                 log_error("Failed to enumerate cgroup controllers: %m");
 219                 return 0;
 220         }
 221
 222         controllers = set_new(string_hash_func, string_compare_func);
 223         if (!controllers) {
 224                 r = log_oom();
 225                 goto finish;
 226         }
 227
 228         /* Ignore the header line */
 229         (void) fgets(buf, sizeof(buf), f);
 230
 231         for (;;) {
 232                 char *controller;
 233                 int enabled = 0;
 234
 235                 if (fscanf(f, "%ms %*i %*i %i", &controller, &enabled) != 2) {
 236
 237                         if (feof(f))
 238                                 break;
 239
 240                         log_error("Failed to parse /proc/cgroups.");
 241                         r = -EIO;
 242                         goto finish;
 243                 }
 244
 245                 if (!enabled) {
 246                         free(controller);
 247                         continue;
 248                 }
 249
 250                 r = set_put(controllers, controller);
 251                 if (r < 0) {
 252                         log_error("Failed to add controller to set.");
 253                         free(controller);
 254                         goto finish;
 255                 }
 256         }
 257
 258         for (;;) {
 259                 MountPoint p;
 260                 char *controller, *where, *options;
 261                 char ***k = NULL;
 262
 263                 controller = set_steal_first(controllers);
 264                 if (!controller)
 265                         break;
 266
 267                 if (join_controllers)
 268                         for (k = join_controllers; *k; k++)
 269                                 if (strv_find(*k, controller))
 270                                         break;
 271
 272                 if (k && *k) {
 273                         char **i, **j;
 274
 275                         for (i = *k, j = *k; *i; i++) {
 276
 277                                 if (!streq(*i, controller)) {
 278                                         char *t;
 279
 280                                         t = set_remove(controllers, *i);
 281                                         if (!t) {
 282                                                 free(*i);
 283                                                 continue;
 284                                         }
 285                                         free(t);
 286                                 }
 287
 288                                 *(j++) = *i;
 289                         }
 290
 291                         *j = NULL;
 292
 293                         options = strv_join(*k, ",");
 294                         if (!options) {
 295                                 free(controller);
 296                                 r = log_oom();
 297                                 goto finish;
 298                         }
 299
 300                 } else {
 301                         options = controller;
 302                         controller = NULL;
 303                 }
 304
 305                 where = strappend("/sys/fs/cgroup/", options);
 306                 if (!where) {
 307                         free(options);
 308                         r = log_oom();
 309                         goto finish;
 310                 }
 311
 312                 zero(p);
 313                 p.what = "cgroup";
 314                 p.where = where;
 315                 p.type = "cgroup";
 316                 p.options = options;
 317                 p.flags = MS_NOSUID|MS_NOEXEC|MS_NODEV;
 318                 p.mode = MNT_IN_CONTAINER;
 319
 320                 r = mount_one(&p, true);
 321                 free(controller);
 322                 free(where);
 323
 324                 if (r < 0) {
 325                         free(options);
 326                         goto finish;
 327                 }
 328
 329                 if (r > 0 && k && *k) {
 330                         char **i;
 331
 332                         for (i = *k; *i; i++) {
 333                                 char *t;
 334
 335                                 t = strappend("/sys/fs/cgroup/", *i);
 336                                 if (!t) {
 337                                         r = log_oom();
 338                                         free(options);
 339                                         goto finish;
 340                                 }
 341
 342                                 r = symlink(options, t);
 343                                 free(t);
 344
 345                                 if (r < 0 && errno != EEXIST) {
 346                                         log_error("Failed to create symlink: %m");
 347                                         r = -errno;
 348                                         free(options);
 349                                         goto finish;
 350                                 }
 351                         }
 352                 }
 353
 354                 free(options);
 355         }
 356
 357         r = 0;
 358
 359 finish:
 360         set_free_free(controllers);
 361
 362         fclose(f);
 363
 364         return r;
 365 }
 366
 367 static int nftw_cb(
 368                 const char *fpath,
 369                 const struct stat *sb,
 370                 int tflag,
 371                 struct FTW *ftwbuf) {
 372
 373         /* No need to label /dev twice in a row... */
 374         if (_unlikely_(ftwbuf->level == 0))
 375                 return FTW_CONTINUE;
 376
 377         label_fix(fpath, false, false);
 378
 379         /* /run/initramfs is static data and big, no need to
 380          * dynamically relabel its contents at boot... */
 381         if (_unlikely_(ftwbuf->level == 1 &&
 382                       tflag == FTW_D &&
 383                       streq(fpath, "/run/initramfs")))
 384                 return FTW_SKIP_SUBTREE;
 385
 386         return FTW_CONTINUE;
 387 };
 388
 389 int mount_setup(bool loaded_policy) {
 390
 391         static const char relabel[] =
 392                 "/run/initramfs/root-fsck\0"
 393                 "/run/initramfs/shutdown\0";
 394
 395         int r;
 396         unsigned i;
 397         const char *j;
 398
 399         for (i = 0; i < ELEMENTSOF(mount_table); i ++) {
 400                 r = mount_one(mount_table + i, true);
 401
 402                 if (r < 0)
 403                         return r;
 404         }
 405
 406         /* Nodes in devtmpfs and /run need to be manually updated for
 407          * the appropriate labels, after mounting. The other virtual
 408          * API file systems like /sys and /proc do not need that, they
 409          * use the same label for all their files. */
 410         if (loaded_policy) {
 411                 usec_t before_relabel, after_relabel;
 412                 char timespan[FORMAT_TIMESPAN_MAX];
 413
 414                 before_relabel = now(CLOCK_MONOTONIC);
 415
 416                 nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 417                 nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 418
 419                 /* Explicitly relabel these */
 420                 NULSTR_FOREACH(j, relabel)
 421                         label_fix(j, true, false);
 422
 423                 after_relabel = now(CLOCK_MONOTONIC);
 424
 425                 log_info("Relabelled /dev and /run in %s.",
 426                          format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));
 427         }
 428
 429         /* Create a few default symlinks, which are normally created
 430          * by udevd, but some scripts might need them before we start
 431          * udevd. */
 432         dev_setup(NULL);
 433
 434         /* Mark the root directory as shared in regards to mount
 435          * propagation. The kernel defaults to "private", but we think
 436          * it makes more sense to have a default of "shared" so that
 437          * nspawn and the container tools work out of the box. If
 438          * specific setups need other settings they can reset the
 439          * propagation mode to private if needed. */
 440         if (detect_container(NULL) <= 0)
 441                 if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)
 442                         log_warning("Failed to set up the root directory for shared mount propagation: %m");
 443
 444         /* Create a few directories we always want around, Note that
 445          * sd_booted() checks for /run/systemd/system, so this mkdir
 446          * really needs to stay for good, otherwise software that
 447          * copied sd-daemon.c into their sources will misdetect
 448          * systemd. */
 449         mkdir_label("/run/systemd", 0755);
 450         mkdir_label("/run/systemd/system", 0755);
 451         mkdir_label("/run/systemd/inaccessible", 0000);
 452
 453         return 0;
 454 }