]>
git.ipfire.org Git - thirdparty/systemd.git/blob - src/import/import-common.c
2 This file is part of systemd.
4 Copyright 2015 Lennart Poettering
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
21 #include <sys/prctl.h>
25 #include "btrfs-util.h"
26 #include "capability-util.h"
28 #include "import-common.h"
29 #include "signal-util.h"
32 int import_make_read_only_fd(int fd
) {
37 /* First, let's make this a read-only subvolume if it refers
39 r
= btrfs_subvol_set_read_only_fd(fd
, true);
40 if (IN_SET(r
, -ENOTTY
, -ENOTDIR
, -EINVAL
)) {
43 /* This doesn't refer to a subvolume, or the file
44 * system isn't even btrfs. In that, case fall back to
49 return log_error_errno(errno
, "Failed to stat temporary image: %m");
52 if (fchmod(fd
, st
.st_mode
& 07555) < 0)
53 return log_error_errno(errno
, "Failed to chmod() final image: %m");
58 return log_error_errno(r
, "Failed to make subvolume read-only: %m");
63 int import_make_read_only(const char *path
) {
64 _cleanup_close_
int fd
= 1;
66 fd
= open(path
, O_RDONLY
|O_NOCTTY
|O_CLOEXEC
);
68 return log_error_errno(errno
, "Failed to open %s: %m", path
);
70 return import_make_read_only_fd(fd
);
73 int import_fork_tar_x(const char *path
, pid_t
*ret
) {
74 _cleanup_close_pair_
int pipefd
[2] = { -1, -1 };
81 if (pipe2(pipefd
, O_CLOEXEC
) < 0)
82 return log_error_errno(errno
, "Failed to create pipe for tar: %m");
86 return log_error_errno(errno
, "Failed to fork off tar: %m");
92 (1ULL << CAP_FOWNER
) |
93 (1ULL << CAP_FSETID
) |
95 (1ULL << CAP_SETFCAP
) |
96 (1ULL << CAP_DAC_OVERRIDE
);
100 (void) reset_all_signal_handlers();
101 (void) reset_signal_mask();
102 assert_se(prctl(PR_SET_PDEATHSIG
, SIGTERM
) == 0);
104 pipefd
[1] = safe_close(pipefd
[1]);
106 r
= move_fd(pipefd
[0], STDIN_FILENO
, false);
108 log_error_errno(r
, "Failed to move fd: %m");
112 null_fd
= open("/dev/null", O_WRONLY
|O_NOCTTY
);
114 log_error_errno(errno
, "Failed to open /dev/null: %m");
118 r
= move_fd(null_fd
, STDOUT_FILENO
, false);
120 log_error_errno(r
, "Failed to move fd: %m");
124 stdio_unset_cloexec();
126 if (unshare(CLONE_NEWNET
) < 0)
127 log_error_errno(errno
, "Failed to lock tar into network namespace, ignoring: %m");
129 r
= capability_bounding_set_drop(retain
, true);
131 log_error_errno(r
, "Failed to drop capabilities, ignoring: %m");
133 execlp("tar", "tar", "--numeric-owner", "-C", path
, "-px", "--xattrs", "--xattrs-include=*", NULL
);
134 log_error_errno(errno
, "Failed to execute tar: %m");
138 pipefd
[0] = safe_close(pipefd
[0]);
147 int import_fork_tar_c(const char *path
, pid_t
*ret
) {
148 _cleanup_close_pair_
int pipefd
[2] = { -1, -1 };
155 if (pipe2(pipefd
, O_CLOEXEC
) < 0)
156 return log_error_errno(errno
, "Failed to create pipe for tar: %m");
160 return log_error_errno(errno
, "Failed to fork off tar: %m");
164 uint64_t retain
= (1ULL << CAP_DAC_OVERRIDE
);
168 (void) reset_all_signal_handlers();
169 (void) reset_signal_mask();
170 assert_se(prctl(PR_SET_PDEATHSIG
, SIGTERM
) == 0);
172 pipefd
[0] = safe_close(pipefd
[0]);
174 r
= move_fd(pipefd
[1], STDOUT_FILENO
, false);
176 log_error_errno(r
, "Failed to move fd: %m");
180 null_fd
= open("/dev/null", O_RDONLY
|O_NOCTTY
);
182 log_error_errno(errno
, "Failed to open /dev/null: %m");
186 r
= move_fd(null_fd
, STDIN_FILENO
, false);
188 log_error_errno(errno
, "Failed to move fd: %m");
192 stdio_unset_cloexec();
194 if (unshare(CLONE_NEWNET
) < 0)
195 log_error_errno(errno
, "Failed to lock tar into network namespace, ignoring: %m");
197 r
= capability_bounding_set_drop(retain
, true);
199 log_error_errno(r
, "Failed to drop capabilities, ignoring: %m");
201 execlp("tar", "tar", "-C", path
, "-c", "--xattrs", "--xattrs-include=*", ".", NULL
);
202 log_error_errno(errno
, "Failed to execute tar: %m");
206 pipefd
[1] = safe_close(pipefd
[1]);