src/core/mount-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <sys/mount.h>
  23 #include <errno.h>
  24 #include <stdlib.h>
  25 #include <unistd.h>
  26 #include <ftw.h>
  27
  28 #include "mount-setup.h"
  29 #include "dev-setup.h"
  30 #include "bus-util.h"
  31 #include "log.h"
  32 #include "macro.h"
  33 #include "util.h"
  34 #include "label.h"
  35 #include "set.h"
  36 #include "strv.h"
  37 #include "mkdir.h"
  38 #include "path-util.h"
  39 #include "missing.h"
  40 #include "virt.h"
  41 #include "efivars.h"
  42 #include "smack-util.h"
  43 #include "cgroup-util.h"
  44
  45 typedef enum MountMode {
  46         MNT_NONE  =        0,
  47         MNT_FATAL =        1 <<  0,
  48         MNT_IN_CONTAINER = 1 <<  1,
  49 } MountMode;
  50
  51 typedef struct MountPoint {
  52         const char *what;
  53         const char *where;
  54         const char *type;
  55         const char *options;
  56         unsigned long flags;
  57         bool (*condition_fn)(void);
  58         MountMode mode;
  59 } MountPoint;
  60
  61 /* The first three entries we might need before SELinux is up. The
  62  * fourth (securityfs) is needed by IMA to load a custom policy. The
  63  * other ones we can delay until SELinux and IMA are loaded. When
  64  * SMACK is enabled we need smackfs, too, so it's a fifth one. */
  65 #ifdef HAVE_SMACK
  66 #define N_EARLY_MOUNT 5
  67 #else
  68 #define N_EARLY_MOUNT 4
  69 #endif
  70
  71 static const MountPoint mount_table[] = {
  72         { "sysfs",       "/sys",                      "sysfs",      NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  73           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  74         { "proc",        "/proc",                     "proc",       NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  75           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  76         { "devtmpfs",    "/dev",                      "devtmpfs",   "mode=755",                MS_NOSUID|MS_STRICTATIME,
  77           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  78         { "securityfs",  "/sys/kernel/security",      "securityfs", NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  79           NULL,          MNT_NONE                   },
  80 #ifdef HAVE_SMACK
  81         { "smackfs",     "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*",            MS_NOSUID|MS_NOEXEC|MS_NODEV,
  82           mac_smack_use, MNT_FATAL                  },
  83         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  84           mac_smack_use, MNT_FATAL                  },
  85 #endif
  86         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777",               MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  87           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  88         { "devpts",      "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
  89           NULL,          MNT_IN_CONTAINER           },
  90 #ifdef HAVE_SMACK
  91         { "tmpfs",       "/run",                      "tmpfs",      "mode=755,smackfsroot=*",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  92           mac_smack_use, MNT_FATAL                  },
  93 #endif
  94         { "tmpfs",       "/run",                      "tmpfs",      "mode=755",                MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  95           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  96         { "cgroup",      "/sys/fs/cgroup",            "cgroup",     "__DEVEL__sane_behavior",  MS_NOSUID|MS_NOEXEC|MS_NODEV,
  97           cg_is_unified_wanted, MNT_FATAL|MNT_IN_CONTAINER },
  98         { "tmpfs",       "/sys/fs/cgroup",            "tmpfs",      "mode=755",                MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
  99           cg_is_legacy_wanted, MNT_FATAL|MNT_IN_CONTAINER },
 100         { "cgroup",      "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd,xattr", MS_NOSUID|MS_NOEXEC|MS_NODEV,
 101           cg_is_legacy_wanted, MNT_IN_CONTAINER           },
 102         { "cgroup",      "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd",       MS_NOSUID|MS_NOEXEC|MS_NODEV,
 103           cg_is_legacy_wanted, MNT_FATAL|MNT_IN_CONTAINER },
 104         { "pstore",      "/sys/fs/pstore",            "pstore",     NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 105           NULL,          MNT_NONE                   },
 106 #ifdef ENABLE_EFI
 107         { "efivarfs",    "/sys/firmware/efi/efivars", "efivarfs",   NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 108           is_efi_boot,   MNT_NONE                   },
 109 #endif
 110         { "kdbusfs",    "/sys/fs/kdbus",             "kdbusfs",    NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
 111           is_kdbus_wanted,       MNT_IN_CONTAINER },
 112 };
 113
 114 /* These are API file systems that might be mounted by other software,
 115  * we just list them here so that we know that we should ignore them */
 116
 117 static const char ignore_paths[] =
 118         /* SELinux file systems */
 119         "/sys/fs/selinux\0"
 120         /* Container bind mounts */
 121         "/proc/sys\0"
 122         "/dev/console\0"
 123         "/proc/kmsg\0";
 124
 125 bool mount_point_is_api(const char *path) {
 126         unsigned i;
 127
 128         /* Checks if this mount point is considered "API", and hence
 129          * should be ignored */
 130
 131         for (i = 0; i < ELEMENTSOF(mount_table); i ++)
 132                 if (path_equal(path, mount_table[i].where))
 133                         return true;
 134
 135         return path_startswith(path, "/sys/fs/cgroup/");
 136 }
 137
 138 bool mount_point_ignore(const char *path) {
 139         const char *i;
 140
 141         NULSTR_FOREACH(i, ignore_paths)
 142                 if (path_equal(path, i))
 143                         return true;
 144
 145         return false;
 146 }
 147
 148 static int mount_one(const MountPoint *p, bool relabel) {
 149         int r;
 150
 151         assert(p);
 152
 153         if (p->condition_fn && !p->condition_fn())
 154                 return 0;
 155
 156         /* Relabel first, just in case */
 157         if (relabel)
 158                 label_fix(p->where, true, true);
 159
 160         r = path_is_mount_point(p->where, AT_SYMLINK_FOLLOW);
 161         if (r < 0 && r != -ENOENT)
 162                 return r;
 163         if (r > 0)
 164                 return 0;
 165
 166         /* Skip securityfs in a container */
 167         if (!(p->mode & MNT_IN_CONTAINER) && detect_container(NULL) > 0)
 168                 return 0;
 169
 170         /* The access mode here doesn't really matter too much, since
 171          * the mounted file system will take precedence anyway. */
 172         if (relabel)
 173                 mkdir_p_label(p->where, 0755);
 174         else
 175                 mkdir_p(p->where, 0755);
 176
 177         log_debug("Mounting %s to %s of type %s with options %s.",
 178                   p->what,
 179                   p->where,
 180                   p->type,
 181                   strna(p->options));
 182
 183         if (mount(p->what,
 184                   p->where,
 185                   p->type,
 186                   p->flags,
 187                   p->options) < 0) {
 188                 log_full((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, "Failed to mount %s at %s: %m", p->type, p->where);
 189                 return (p->mode & MNT_FATAL) ? -errno : 0;
 190         }
 191
 192         /* Relabel again, since we now mounted something fresh here */
 193         if (relabel)
 194                 label_fix(p->where, false, false);
 195
 196         return 1;
 197 }
 198
 199 int mount_setup_early(void) {
 200         unsigned i;
 201         int r = 0;
 202
 203         assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table));
 204
 205         /* Do a minimal mount of /proc and friends to enable the most
 206          * basic stuff, such as SELinux */
 207         for (i = 0; i < N_EARLY_MOUNT; i ++)  {
 208                 int j;
 209
 210                 j = mount_one(mount_table + i, false);
 211                 if (r == 0)
 212                         r = j;
 213         }
 214
 215         return r;
 216 }
 217
 218 int mount_cgroup_controllers(char ***join_controllers) {
 219         _cleanup_set_free_free_ Set *controllers = NULL;
 220         int r;
 221
 222         if (!cg_is_legacy_wanted())
 223                 return 0;
 224
 225         /* Mount all available cgroup controllers that are built into the kernel. */
 226
 227         controllers = set_new(&string_hash_ops);
 228         if (!controllers)
 229                 return log_oom();
 230
 231         r = cg_kernel_controllers(controllers);
 232         if (r < 0)
 233                 return log_error_errno(r, "Failed to enumerate cgroup controllers: %m");
 234
 235         for (;;) {
 236                 _cleanup_free_ char *options = NULL, *controller = NULL, *where = NULL;
 237                 MountPoint p = {
 238                         .what = "cgroup",
 239                         .type = "cgroup",
 240                         .flags = MS_NOSUID|MS_NOEXEC|MS_NODEV,
 241                         .mode = MNT_IN_CONTAINER,
 242                 };
 243                 char ***k = NULL;
 244
 245                 controller = set_steal_first(controllers);
 246                 if (!controller)
 247                         break;
 248
 249                 if (join_controllers)
 250                         for (k = join_controllers; *k; k++)
 251                                 if (strv_find(*k, controller))
 252                                         break;
 253
 254                 if (k && *k) {
 255                         char **i, **j;
 256
 257                         for (i = *k, j = *k; *i; i++) {
 258
 259                                 if (!streq(*i, controller)) {
 260                                         _cleanup_free_ char *t;
 261
 262                                         t = set_remove(controllers, *i);
 263                                         if (!t) {
 264                                                 free(*i);
 265                                                 continue;
 266                                         }
 267                                 }
 268
 269                                 *(j++) = *i;
 270                         }
 271
 272                         *j = NULL;
 273
 274                         options = strv_join(*k, ",");
 275                         if (!options)
 276                                 return log_oom();
 277                 } else {
 278                         options = controller;
 279                         controller = NULL;
 280                 }
 281
 282                 where = strappend("/sys/fs/cgroup/", options);
 283                 if (!where)
 284                         return log_oom();
 285
 286                 p.where = where;
 287                 p.options = options;
 288
 289                 r = mount_one(&p, true);
 290                 if (r < 0)
 291                         return r;
 292
 293                 if (r > 0 && k && *k) {
 294                         char **i;
 295
 296                         for (i = *k; *i; i++) {
 297                                 _cleanup_free_ char *t = NULL;
 298
 299                                 t = strappend("/sys/fs/cgroup/", *i);
 300                                 if (!t)
 301                                         return log_oom();
 302
 303                                 r = symlink(options, t);
 304                                 if (r < 0 && errno != EEXIST)
 305                                         return log_error_errno(errno, "Failed to create symlink %s: %m", t);
 306                         }
 307                 }
 308         }
 309
 310         /* Now that we mounted everything, let's make the tmpfs the
 311          * cgroup file systems are mounted into read-only. */
 312         (void) mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755");
 313
 314         return 0;
 315 }
 316
 317 #if defined(HAVE_SELINUX) || defined(HAVE_SMACK)
 318 static int nftw_cb(
 319                 const char *fpath,
 320                 const struct stat *sb,
 321                 int tflag,
 322                 struct FTW *ftwbuf) {
 323
 324         /* No need to label /dev twice in a row... */
 325         if (_unlikely_(ftwbuf->level == 0))
 326                 return FTW_CONTINUE;
 327
 328         label_fix(fpath, false, false);
 329
 330         /* /run/initramfs is static data and big, no need to
 331          * dynamically relabel its contents at boot... */
 332         if (_unlikely_(ftwbuf->level == 1 &&
 333                       tflag == FTW_D &&
 334                       streq(fpath, "/run/initramfs")))
 335                 return FTW_SKIP_SUBTREE;
 336
 337         return FTW_CONTINUE;
 338 };
 339 #endif
 340
 341 int mount_setup(bool loaded_policy) {
 342         unsigned i;
 343         int r = 0;
 344
 345         for (i = 0; i < ELEMENTSOF(mount_table); i ++) {
 346                 int j;
 347
 348                 j = mount_one(mount_table + i, loaded_policy);
 349                 if (r == 0)
 350                         r = j;
 351         }
 352
 353         if (r < 0)
 354                 return r;
 355
 356 #if defined(HAVE_SELINUX) || defined(HAVE_SMACK)
 357         /* Nodes in devtmpfs and /run need to be manually updated for
 358          * the appropriate labels, after mounting. The other virtual
 359          * API file systems like /sys and /proc do not need that, they
 360          * use the same label for all their files. */
 361         if (loaded_policy) {
 362                 usec_t before_relabel, after_relabel;
 363                 char timespan[FORMAT_TIMESPAN_MAX];
 364
 365                 before_relabel = now(CLOCK_MONOTONIC);
 366
 367                 nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 368                 nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 369
 370                 after_relabel = now(CLOCK_MONOTONIC);
 371
 372                 log_info("Relabelled /dev and /run in %s.",
 373                          format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));
 374         }
 375 #endif
 376
 377         /* Create a few default symlinks, which are normally created
 378          * by udevd, but some scripts might need them before we start
 379          * udevd. */
 380         dev_setup(NULL, UID_INVALID, GID_INVALID);
 381
 382         /* Mark the root directory as shared in regards to mount
 383          * propagation. The kernel defaults to "private", but we think
 384          * it makes more sense to have a default of "shared" so that
 385          * nspawn and the container tools work out of the box. If
 386          * specific setups need other settings they can reset the
 387          * propagation mode to private if needed. */
 388         if (detect_container(NULL) <= 0)
 389                 if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)
 390                         log_warning_errno(errno, "Failed to set up the root directory for shared mount propagation: %m");
 391
 392         /* Create a few directories we always want around, Note that
 393          * sd_booted() checks for /run/systemd/system, so this mkdir
 394          * really needs to stay for good, otherwise software that
 395          * copied sd-daemon.c into their sources will misdetect
 396          * systemd. */
 397         mkdir_label("/run/systemd", 0755);
 398         mkdir_label("/run/systemd/system", 0755);
 399         mkdir_label("/run/systemd/inaccessible", 0000);
 400
 401         return 0;
 402 }