]>
git.ipfire.org Git - thirdparty/systemd.git/blob - src/import/import-common.c
2 This file is part of systemd.
4 Copyright 2015 Lennart Poettering
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
21 #include <sys/prctl.h>
25 #include "btrfs-util.h"
26 #include "capability-util.h"
28 #include "import-common.h"
29 #include "signal-util.h"
32 int import_make_read_only_fd(int fd
) {
37 /* First, let's make this a read-only subvolume if it refers
39 r
= btrfs_subvol_set_read_only_fd(fd
, true);
40 if (IN_SET(r
, -ENOTTY
, -ENOTDIR
, -EINVAL
)) {
43 /* This doesn't refer to a subvolume, or the file
44 * system isn't even btrfs. In that, case fall back to
49 return log_error_errno(errno
, "Failed to stat temporary image: %m");
52 if (fchmod(fd
, st
.st_mode
& 07555) < 0)
53 return log_error_errno(errno
, "Failed to chmod() final image: %m");
58 return log_error_errno(r
, "Failed to make subvolume read-only: %m");
63 int import_make_read_only(const char *path
) {
64 _cleanup_close_
int fd
= 1;
66 fd
= open(path
, O_RDONLY
|O_NOCTTY
|O_CLOEXEC
);
68 return log_error_errno(errno
, "Failed to open %s: %m", path
);
70 return import_make_read_only_fd(fd
);
73 int import_fork_tar_x(const char *path
, pid_t
*ret
) {
74 _cleanup_close_pair_
int pipefd
[2] = { -1, -1 };
81 if (pipe2(pipefd
, O_CLOEXEC
) < 0)
82 return log_error_errno(errno
, "Failed to create pipe for tar: %m");
86 return log_error_errno(errno
, "Failed to fork off tar: %m");
92 (1ULL << CAP_FOWNER
) |
93 (1ULL << CAP_FSETID
) |
95 (1ULL << CAP_SETFCAP
) |
96 (1ULL << CAP_DAC_OVERRIDE
);
100 (void) reset_all_signal_handlers();
101 (void) reset_signal_mask();
102 assert_se(prctl(PR_SET_PDEATHSIG
, SIGTERM
) == 0);
104 pipefd
[1] = safe_close(pipefd
[1]);
106 if (dup2(pipefd
[0], STDIN_FILENO
) != STDIN_FILENO
) {
107 log_error_errno(errno
, "Failed to dup2() fd: %m");
111 if (pipefd
[0] != STDIN_FILENO
)
112 pipefd
[0] = safe_close(pipefd
[0]);
114 null_fd
= open("/dev/null", O_WRONLY
|O_NOCTTY
);
116 log_error_errno(errno
, "Failed to open /dev/null: %m");
120 if (dup2(null_fd
, STDOUT_FILENO
) != STDOUT_FILENO
) {
121 log_error_errno(errno
, "Failed to dup2() fd: %m");
125 if (null_fd
!= STDOUT_FILENO
)
126 null_fd
= safe_close(null_fd
);
128 stdio_unset_cloexec();
130 if (unshare(CLONE_NEWNET
) < 0)
131 log_error_errno(errno
, "Failed to lock tar into network namespace, ignoring: %m");
133 r
= capability_bounding_set_drop(retain
, true);
135 log_error_errno(r
, "Failed to drop capabilities, ignoring: %m");
137 execlp("tar", "tar", "--numeric-owner", "-C", path
, "-px", "--xattrs", "--xattrs-include=*", NULL
);
138 log_error_errno(errno
, "Failed to execute tar: %m");
142 pipefd
[0] = safe_close(pipefd
[0]);
151 int import_fork_tar_c(const char *path
, pid_t
*ret
) {
152 _cleanup_close_pair_
int pipefd
[2] = { -1, -1 };
159 if (pipe2(pipefd
, O_CLOEXEC
) < 0)
160 return log_error_errno(errno
, "Failed to create pipe for tar: %m");
164 return log_error_errno(errno
, "Failed to fork off tar: %m");
168 uint64_t retain
= (1ULL << CAP_DAC_OVERRIDE
);
172 (void) reset_all_signal_handlers();
173 (void) reset_signal_mask();
174 assert_se(prctl(PR_SET_PDEATHSIG
, SIGTERM
) == 0);
176 pipefd
[0] = safe_close(pipefd
[0]);
178 if (dup2(pipefd
[1], STDOUT_FILENO
) != STDOUT_FILENO
) {
179 log_error_errno(errno
, "Failed to dup2() fd: %m");
183 if (pipefd
[1] != STDOUT_FILENO
)
184 pipefd
[1] = safe_close(pipefd
[1]);
186 null_fd
= open("/dev/null", O_RDONLY
|O_NOCTTY
);
188 log_error_errno(errno
, "Failed to open /dev/null: %m");
192 if (dup2(null_fd
, STDIN_FILENO
) != STDIN_FILENO
) {
193 log_error_errno(errno
, "Failed to dup2() fd: %m");
197 if (null_fd
!= STDIN_FILENO
)
198 null_fd
= safe_close(null_fd
);
200 stdio_unset_cloexec();
202 if (unshare(CLONE_NEWNET
) < 0)
203 log_error_errno(errno
, "Failed to lock tar into network namespace, ignoring: %m");
205 r
= capability_bounding_set_drop(retain
, true);
207 log_error_errno(r
, "Failed to drop capabilities, ignoring: %m");
209 execlp("tar", "tar", "-C", path
, "-c", "--xattrs", "--xattrs-include=*", ".", NULL
);
210 log_error_errno(errno
, "Failed to execute tar: %m");
214 pipefd
[1] = safe_close(pipefd
[1]);