]>
git.ipfire.org Git - thirdparty/systemd.git/blob - src/libsystemd/sd-bus/bus-container.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
8 #include "bus-container.h"
9 #include "bus-internal.h"
10 #include "bus-socket.h"
12 #include "process-util.h"
15 int bus_container_connect_socket(sd_bus
*b
) {
16 _cleanup_close_pair_
int pair
[2] = { -1, -1 };
17 _cleanup_close_
int pidnsfd
= -1, mntnsfd
= -1, usernsfd
= -1, rootfd
= -1;
23 assert(b
->input_fd
< 0);
24 assert(b
->output_fd
< 0);
25 assert(b
->nspid
> 0 || b
->machine
);
28 r
= container_get_leader(b
->machine
, &b
->nspid
);
33 r
= namespace_open(b
->nspid
, &pidnsfd
, &mntnsfd
, NULL
, &usernsfd
, &rootfd
);
37 b
->input_fd
= socket(b
->sockaddr
.sa
.sa_family
, SOCK_STREAM
|SOCK_CLOEXEC
|SOCK_NONBLOCK
, 0);
41 b
->input_fd
= fd_move_above_stdio(b
->input_fd
);
43 b
->output_fd
= b
->input_fd
;
47 if (socketpair(AF_UNIX
, SOCK_SEQPACKET
, 0, pair
) < 0)
50 r
= safe_fork("(sd-buscntr)", FORK_RESET_SIGNALS
|FORK_DEATHSIG
, &child
);
56 pair
[0] = safe_close(pair
[0]);
58 r
= namespace_enter(pidnsfd
, mntnsfd
, -1, usernsfd
, rootfd
);
62 /* We just changed PID namespace, however it will only
63 * take effect on the children we now fork. Hence,
64 * let's fork another time, and connect from this
65 * grandchild, so that SO_PEERCRED of our connection
66 * comes from a process from within the container, and
67 * not outside of it */
69 r
= safe_fork("(sd-buscntr2)", FORK_RESET_SIGNALS
|FORK_DEATHSIG
, &grandchild
);
74 r
= connect(b
->input_fd
, &b
->sockaddr
.sa
, b
->sockaddr_size
);
76 /* Try to send error up */
78 (void) write(pair
[1], &error_buf
, sizeof(error_buf
));
85 r
= wait_for_terminate_and_check("(sd-buscntr2)", grandchild
, 0);
92 pair
[1] = safe_close(pair
[1]);
94 r
= wait_for_terminate_and_check("(sd-buscntr)", child
, 0);
97 if (r
!= EXIT_SUCCESS
)
100 n
= read(pair
[0], &error_buf
, sizeof(error_buf
));
105 if (n
!= sizeof(error_buf
))
111 if (error_buf
== EINPROGRESS
)
118 return bus_socket_start_auth(b
);