src/nspawn/nspawn-mount.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <sys/mount.h>
   4 #include <linux/magic.h>
   5
   6 #include "alloc-util.h"
   7 #include "escape.h"
   8 #include "fd-util.h"
   9 #include "fileio.h"
  10 #include "fs-util.h"
  11 #include "label.h"
  12 #include "mkdir.h"
  13 #include "mount-util.h"
  14 #include "nspawn-mount.h"
  15 #include "parse-util.h"
  16 #include "path-util.h"
  17 #include "rm-rf.h"
  18 #include "set.h"
  19 #include "stat-util.h"
  20 #include "string-util.h"
  21 #include "strv.h"
  22 #include "user-util.h"
  23 #include "util.h"
  24
  25 CustomMount* custom_mount_add(CustomMount **l, size_t *n, CustomMountType t) {
  26         CustomMount *c, *ret;
  27
  28         assert(l);
  29         assert(n);
  30         assert(t >= 0);
  31         assert(t < _CUSTOM_MOUNT_TYPE_MAX);
  32
  33         c = reallocarray(*l, *n + 1, sizeof(CustomMount));
  34         if (!c)
  35                 return NULL;
  36
  37         *l = c;
  38         ret = *l + *n;
  39         (*n)++;
  40
  41         *ret = (CustomMount) { .type = t };
  42
  43         return ret;
  44 }
  45
  46 void custom_mount_free_all(CustomMount *l, size_t n) {
  47         size_t i;
  48
  49         for (i = 0; i < n; i++) {
  50                 CustomMount *m = l + i;
  51
  52                 free(m->source);
  53                 free(m->destination);
  54                 free(m->options);
  55
  56                 if (m->work_dir) {
  57                         (void) rm_rf(m->work_dir, REMOVE_ROOT|REMOVE_PHYSICAL);
  58                         free(m->work_dir);
  59                 }
  60
  61                 if (m->rm_rf_tmpdir) {
  62                         (void) rm_rf(m->rm_rf_tmpdir, REMOVE_ROOT|REMOVE_PHYSICAL);
  63                         free(m->rm_rf_tmpdir);
  64                 }
  65
  66                 strv_free(m->lower);
  67         }
  68
  69         free(l);
  70 }
  71
  72 static int custom_mount_compare(const CustomMount *a, const CustomMount *b) {
  73         int r;
  74
  75         r = path_compare(a->destination, b->destination);
  76         if (r != 0)
  77                 return r;
  78
  79         return CMP(a->type, b->type);
  80 }
  81
  82 static bool source_path_is_valid(const char *p) {
  83         assert(p);
  84
  85         if (*p == '+')
  86                 p++;
  87
  88         return path_is_absolute(p);
  89 }
  90
  91 static char *resolve_source_path(const char *dest, const char *source) {
  92
  93         if (!source)
  94                 return NULL;
  95
  96         if (source[0] == '+')
  97                 return prefix_root(dest, source + 1);
  98
  99         return strdup(source);
 100 }
 101
 102 int custom_mount_prepare_all(const char *dest, CustomMount *l, size_t n) {
 103         size_t i;
 104         int r;
 105
 106         /* Prepare all custom mounts. This will make source we know all temporary directories. This is called in the
 107          * parent process, so that we know the temporary directories to remove on exit before we fork off the
 108          * children. */
 109
 110         assert(l || n == 0);
 111
 112         /* Order the custom mounts, and make sure we have a working directory */
 113         typesafe_qsort(l, n, custom_mount_compare);
 114
 115         for (i = 0; i < n; i++) {
 116                 CustomMount *m = l + i;
 117
 118                 if (m->source) {
 119                         char *s;
 120
 121                         s = resolve_source_path(dest, m->source);
 122                         if (!s)
 123                                 return log_oom();
 124
 125                         free_and_replace(m->source, s);
 126                 } else {
 127                         /* No source specified? In that case, use a throw-away temporary directory in /var/tmp */
 128
 129                         m->rm_rf_tmpdir = strdup("/var/tmp/nspawn-temp-XXXXXX");
 130                         if (!m->rm_rf_tmpdir)
 131                                 return log_oom();
 132
 133                         if (!mkdtemp(m->rm_rf_tmpdir)) {
 134                                 m->rm_rf_tmpdir = mfree(m->rm_rf_tmpdir);
 135                                 return log_error_errno(errno, "Failed to acquire temporary directory: %m");
 136                         }
 137
 138                         m->source = strjoin(m->rm_rf_tmpdir, "/src");
 139                         if (!m->source)
 140                                 return log_oom();
 141
 142                         if (mkdir(m->source, 0755) < 0)
 143                                 return log_error_errno(errno, "Failed to create %s: %m", m->source);
 144                 }
 145
 146                 if (m->type == CUSTOM_MOUNT_OVERLAY) {
 147                         char **j;
 148
 149                         STRV_FOREACH(j, m->lower) {
 150                                 char *s;
 151
 152                                 s = resolve_source_path(dest, *j);
 153                                 if (!s)
 154                                         return log_oom();
 155
 156                                 free_and_replace(*j, s);
 157                         }
 158
 159                         if (m->work_dir) {
 160                                 char *s;
 161
 162                                 s = resolve_source_path(dest, m->work_dir);
 163                                 if (!s)
 164                                         return log_oom();
 165
 166                                 free_and_replace(m->work_dir, s);
 167                         } else {
 168                                 assert(m->source);
 169
 170                                 r = tempfn_random(m->source, NULL, &m->work_dir);
 171                                 if (r < 0)
 172                                         return log_error_errno(r, "Failed to acquire working directory: %m");
 173                         }
 174
 175                         (void) mkdir_label(m->work_dir, 0700);
 176                 }
 177         }
 178
 179         return 0;
 180 }
 181
 182 int bind_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) {
 183         _cleanup_free_ char *source = NULL, *destination = NULL, *opts = NULL;
 184         const char *p = s;
 185         CustomMount *m;
 186         int r;
 187
 188         assert(l);
 189         assert(n);
 190
 191         r = extract_many_words(&p, ":", EXTRACT_DONT_COALESCE_SEPARATORS, &source, &destination, NULL);
 192         if (r < 0)
 193                 return r;
 194         if (r == 0)
 195                 return -EINVAL;
 196         if (r == 1) {
 197                 destination = strdup(source[0] == '+' ? source+1 : source);
 198                 if (!destination)
 199                         return -ENOMEM;
 200         }
 201         if (r == 2 && !isempty(p)) {
 202                 opts = strdup(p);
 203                 if (!opts)
 204                         return -ENOMEM;
 205         }
 206
 207         if (isempty(source))
 208                 source = NULL;
 209         else if (!source_path_is_valid(source))
 210                 return -EINVAL;
 211
 212         if (!path_is_absolute(destination))
 213                 return -EINVAL;
 214
 215         m = custom_mount_add(l, n, CUSTOM_MOUNT_BIND);
 216         if (!m)
 217                 return -ENOMEM;
 218
 219         m->source = source;
 220         m->destination = destination;
 221         m->read_only = read_only;
 222         m->options = opts;
 223
 224         source = destination = opts = NULL;
 225         return 0;
 226 }
 227
 228 int tmpfs_mount_parse(CustomMount **l, size_t *n, const char *s) {
 229         _cleanup_free_ char *path = NULL, *opts = NULL;
 230         const char *p = s;
 231         CustomMount *m;
 232         int r;
 233
 234         assert(l);
 235         assert(n);
 236         assert(s);
 237
 238         r = extract_first_word(&p, &path, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 239         if (r < 0)
 240                 return r;
 241         if (r == 0)
 242                 return -EINVAL;
 243
 244         if (isempty(p))
 245                 opts = strdup("mode=0755");
 246         else
 247                 opts = strdup(p);
 248         if (!opts)
 249                 return -ENOMEM;
 250
 251         if (!path_is_absolute(path))
 252                 return -EINVAL;
 253
 254         m = custom_mount_add(l, n, CUSTOM_MOUNT_TMPFS);
 255         if (!m)
 256                 return -ENOMEM;
 257
 258         m->destination = TAKE_PTR(path);
 259         m->options = TAKE_PTR(opts);
 260
 261         return 0;
 262 }
 263
 264 int overlay_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) {
 265         _cleanup_free_ char *upper = NULL, *destination = NULL;
 266         _cleanup_strv_free_ char **lower = NULL;
 267         CustomMount *m;
 268         int k;
 269
 270         k = strv_split_extract(&lower, s, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 271         if (k < 0)
 272                 return k;
 273         if (k < 2)
 274                 return -EADDRNOTAVAIL;
 275         if (k == 2) {
 276                 /* If two parameters are specified, the first one is the lower, the second one the upper directory. And
 277                  * we'll also define the destination mount point the same as the upper. */
 278
 279                 if (!source_path_is_valid(lower[0]) ||
 280                     !source_path_is_valid(lower[1]))
 281                         return -EINVAL;
 282
 283                 upper = TAKE_PTR(lower[1]);
 284
 285                 destination = strdup(upper[0] == '+' ? upper+1 : upper); /* take the destination without "+" prefix */
 286                 if (!destination)
 287                         return -ENOMEM;
 288         } else {
 289                 char **i;
 290
 291                 /* If more than two parameters are specified, the last one is the destination, the second to last one
 292                  * the "upper", and all before that the "lower" directories. */
 293
 294                 destination = lower[k - 1];
 295                 upper = TAKE_PTR(lower[k - 2]);
 296
 297                 STRV_FOREACH(i, lower)
 298                         if (!source_path_is_valid(*i))
 299                                 return -EINVAL;
 300
 301                 /* If the upper directory is unspecified, then let's create it automatically as a throw-away directory
 302                  * in /var/tmp */
 303                 if (isempty(upper))
 304                         upper = NULL;
 305                 else if (!source_path_is_valid(upper))
 306                         return -EINVAL;
 307
 308                 if (!path_is_absolute(destination))
 309                         return -EINVAL;
 310         }
 311
 312         m = custom_mount_add(l, n, CUSTOM_MOUNT_OVERLAY);
 313         if (!m)
 314                 return -ENOMEM;
 315
 316         m->destination = TAKE_PTR(destination);
 317         m->source = TAKE_PTR(upper);
 318         m->lower = TAKE_PTR(lower);
 319         m->read_only = read_only;
 320
 321         return 0;
 322 }
 323
 324 int tmpfs_patch_options(
 325                 const char *options,
 326                 uid_t uid_shift,
 327                 const char *selinux_apifs_context,
 328                 char **ret) {
 329
 330         char *buf = NULL;
 331
 332         if (uid_shift != UID_INVALID) {
 333                 if (asprintf(&buf, "%s%suid=" UID_FMT ",gid=" UID_FMT,
 334                              strempty(options), options ? "," : "",
 335                              uid_shift, uid_shift) < 0)
 336                         return -ENOMEM;
 337
 338                 options = buf;
 339         }
 340
 341 #if HAVE_SELINUX
 342         if (selinux_apifs_context) {
 343                 char *t;
 344
 345                 t = strjoin(strempty(options), options ? "," : "",
 346                             "context=\"", selinux_apifs_context, "\"");
 347                 free(buf);
 348                 if (!t)
 349                         return -ENOMEM;
 350
 351                 buf = t;
 352         }
 353 #endif
 354
 355         if (!buf && options) {
 356                 buf = strdup(options);
 357                 if (!buf)
 358                         return -ENOMEM;
 359         }
 360         *ret = buf;
 361
 362         return !!buf;
 363 }
 364
 365 int mount_sysfs(const char *dest, MountSettingsMask mount_settings) {
 366         const char *full, *top, *x;
 367         int r;
 368         unsigned long extra_flags = 0;
 369
 370         top = prefix_roota(dest, "/sys");
 371         r = path_is_fs_type(top, SYSFS_MAGIC);
 372         if (r < 0)
 373                 return log_error_errno(r, "Failed to determine filesystem type of %s: %m", top);
 374         /* /sys might already be mounted as sysfs by the outer child in the
 375          * !netns case. In this case, it's all good. Don't touch it because we
 376          * don't have the right to do so, see https://github.com/systemd/systemd/issues/1555.
 377          */
 378         if (r > 0)
 379                 return 0;
 380
 381         full = prefix_roota(top, "/full");
 382
 383         (void) mkdir(full, 0755);
 384
 385         if (mount_settings & MOUNT_APPLY_APIVFS_RO)
 386                 extra_flags |= MS_RDONLY;
 387
 388         r = mount_verbose(LOG_ERR, "sysfs", full, "sysfs",
 389                           MS_NOSUID|MS_NOEXEC|MS_NODEV|extra_flags, NULL);
 390         if (r < 0)
 391                 return r;
 392
 393         FOREACH_STRING(x, "block", "bus", "class", "dev", "devices", "kernel") {
 394                 _cleanup_free_ char *from = NULL, *to = NULL;
 395
 396                 from = prefix_root(full, x);
 397                 if (!from)
 398                         return log_oom();
 399
 400                 to = prefix_root(top, x);
 401                 if (!to)
 402                         return log_oom();
 403
 404                 (void) mkdir(to, 0755);
 405
 406                 r = mount_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
 407                 if (r < 0)
 408                         return r;
 409
 410                 r = mount_verbose(LOG_ERR, NULL, to, NULL,
 411                                   MS_BIND|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT|extra_flags, NULL);
 412                 if (r < 0)
 413                         return r;
 414         }
 415
 416         r = umount_verbose(full);
 417         if (r < 0)
 418                 return r;
 419
 420         if (rmdir(full) < 0)
 421                 return log_error_errno(errno, "Failed to remove %s: %m", full);
 422
 423         /* Create mountpoint for cgroups. Otherwise we are not allowed since we
 424          * remount /sys read-only.
 425          */
 426         x = prefix_roota(top, "/fs/cgroup");
 427         (void) mkdir_p(x, 0755);
 428
 429         return mount_verbose(LOG_ERR, NULL, top, NULL,
 430                              MS_BIND|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT|extra_flags, NULL);
 431 }
 432
 433 static int mkdir_userns(const char *path, mode_t mode, uid_t uid_shift) {
 434         int r;
 435
 436         assert(path);
 437
 438         r = mkdir_errno_wrapper(path, mode);
 439         if (r < 0 && r != -EEXIST)
 440                 return r;
 441
 442         if (uid_shift == UID_INVALID)
 443                 return 0;
 444
 445         if (lchown(path, uid_shift, uid_shift) < 0)
 446                 return -errno;
 447
 448         return 0;
 449 }
 450
 451 static int mkdir_userns_p(const char *prefix, const char *path, mode_t mode, uid_t uid_shift) {
 452         const char *p, *e;
 453         int r;
 454
 455         assert(path);
 456
 457         if (prefix && !path_startswith(path, prefix))
 458                 return -ENOTDIR;
 459
 460         /* create every parent directory in the path, except the last component */
 461         p = path + strspn(path, "/");
 462         for (;;) {
 463                 char t[strlen(path) + 1];
 464
 465                 e = p + strcspn(p, "/");
 466                 p = e + strspn(e, "/");
 467
 468                 /* Is this the last component? If so, then we're done */
 469                 if (*p == 0)
 470                         break;
 471
 472                 memcpy(t, path, e - path);
 473                 t[e-path] = 0;
 474
 475                 if (prefix && path_startswith(prefix, t))
 476                         continue;
 477
 478                 r = mkdir_userns(t, mode, uid_shift);
 479                 if (r < 0)
 480                         return r;
 481         }
 482
 483         return mkdir_userns(path, mode, uid_shift);
 484 }
 485
 486 int mount_all(const char *dest,
 487               MountSettingsMask mount_settings,
 488               uid_t uid_shift,
 489               const char *selinux_apifs_context) {
 490
 491 #define PROC_INACCESSIBLE(path)                                         \
 492         { NULL, (path), NULL, NULL, MS_BIND,                            \
 493           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO|MOUNT_INACCESSIBLE_REG }, /* Bind mount first ... */ \
 494         { NULL, (path), NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, \
 495           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO } /* Then, make it r/o */
 496
 497 #define PROC_READ_ONLY(path)                                            \
 498         { (path), (path), NULL, NULL, MS_BIND,                          \
 499           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO }, /* Bind mount first ... */ \
 500         { NULL,   (path), NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, \
 501           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO } /* Then, make it r/o */
 502
 503         typedef struct MountPoint {
 504                 const char *what;
 505                 const char *where;
 506                 const char *type;
 507                 const char *options;
 508                 unsigned long flags;
 509                 MountSettingsMask mount_settings;
 510         } MountPoint;
 511
 512         static const MountPoint mount_table[] = {
 513                 /* First we list inner child mounts (i.e. mounts applied *after* entering user namespacing) */
 514                 { "proc",            "/proc",           "proc",  NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV,
 515                   MOUNT_FATAL|MOUNT_IN_USERNS },
 516
 517                 { "/proc/sys",       "/proc/sys",       NULL,    NULL,        MS_BIND,
 518                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO },                          /* Bind mount first ... */
 519
 520                 { "/proc/sys/net",   "/proc/sys/net",   NULL,    NULL,        MS_BIND,
 521                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS }, /* (except for this) */
 522
 523                 { NULL,              "/proc/sys",       NULL,    NULL,        MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 524                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO },                          /* ... then, make it r/o */
 525
 526                 /* Make these files inaccessible to container payloads: they potentially leak information about kernel
 527                  * internals or the host's execution environment to the container */
 528                 PROC_INACCESSIBLE("/proc/kallsyms"),
 529                 PROC_INACCESSIBLE("/proc/kcore"),
 530                 PROC_INACCESSIBLE("/proc/keys"),
 531                 PROC_INACCESSIBLE("/proc/sysrq-trigger"),
 532                 PROC_INACCESSIBLE("/proc/timer_list"),
 533
 534                 /* Make these directories read-only to container payloads: they show hardware information, and in some
 535                  * cases contain tunables the container really shouldn't have access to. */
 536                 PROC_READ_ONLY("/proc/acpi"),
 537                 PROC_READ_ONLY("/proc/apm"),
 538                 PROC_READ_ONLY("/proc/asound"),
 539                 PROC_READ_ONLY("/proc/bus"),
 540                 PROC_READ_ONLY("/proc/fs"),
 541                 PROC_READ_ONLY("/proc/irq"),
 542                 PROC_READ_ONLY("/proc/scsi"),
 543
 544                 /* Then we list outer child mounts (i.e. mounts applied *before* entering user namespacing) */
 545                 { "tmpfs",           "/tmp",            "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 546                   MOUNT_FATAL },
 547                 { "tmpfs",           "/sys",            "tmpfs", "mode=555",  MS_NOSUID|MS_NOEXEC|MS_NODEV,
 548                   MOUNT_FATAL|MOUNT_APPLY_APIVFS_NETNS },
 549                 { "sysfs",           "/sys",            "sysfs", NULL,        MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV,
 550                   MOUNT_FATAL|MOUNT_APPLY_APIVFS_RO },    /* skipped if above was mounted */
 551                 { "sysfs",           "/sys",            "sysfs", NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV,
 552                   MOUNT_FATAL },                          /* skipped if above was mounted */
 553                 { "tmpfs",           "/dev",            "tmpfs", "mode=755",  MS_NOSUID|MS_STRICTATIME,
 554                   MOUNT_FATAL },
 555                 { "tmpfs",           "/dev/shm",        "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 556                   MOUNT_FATAL },
 557                 { "tmpfs",           "/run",            "tmpfs", "mode=755",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 558                   MOUNT_FATAL },
 559
 560 #if HAVE_SELINUX
 561                 { "/sys/fs/selinux", "/sys/fs/selinux", NULL,    NULL,        MS_BIND,
 562                   0 },  /* Bind mount first */
 563                 { NULL,              "/sys/fs/selinux", NULL,    NULL,        MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 564                   0 },  /* Then, make it r/o */
 565 #endif
 566         };
 567
 568         _cleanup_(unlink_and_freep) char *inaccessible = NULL;
 569         bool use_userns = (mount_settings & MOUNT_USE_USERNS);
 570         bool netns = (mount_settings & MOUNT_APPLY_APIVFS_NETNS);
 571         bool ro = (mount_settings & MOUNT_APPLY_APIVFS_RO);
 572         bool in_userns = (mount_settings & MOUNT_IN_USERNS);
 573         size_t k;
 574         int r;
 575
 576         for (k = 0; k < ELEMENTSOF(mount_table); k++) {
 577                 _cleanup_free_ char *where = NULL, *options = NULL;
 578                 const char *o, *what;
 579                 bool fatal = (mount_table[k].mount_settings & MOUNT_FATAL);
 580
 581                 if (in_userns != (bool)(mount_table[k].mount_settings & MOUNT_IN_USERNS))
 582                         continue;
 583
 584                 if (!netns && (bool)(mount_table[k].mount_settings & MOUNT_APPLY_APIVFS_NETNS))
 585                         continue;
 586
 587                 if (!ro && (bool)(mount_table[k].mount_settings & MOUNT_APPLY_APIVFS_RO))
 588                         continue;
 589
 590                 r = chase_symlinks(mount_table[k].where, dest, CHASE_NONEXISTENT|CHASE_PREFIX_ROOT, &where);
 591                 if (r < 0)
 592                         return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, mount_table[k].where);
 593
 594                 if (mount_table[k].mount_settings & MOUNT_INACCESSIBLE_REG) {
 595
 596                         if (!inaccessible) {
 597                                 _cleanup_free_ char *np = NULL;
 598
 599                                 r = tempfn_random_child(NULL, "inaccessible", &np);
 600                                 if (r < 0)
 601                                         return log_error_errno(r, "Failed to generate inaccessible file node path: %m");
 602
 603                                 r = touch_file(np, false, USEC_INFINITY, UID_INVALID, GID_INVALID, 0000);
 604                                 if (r < 0)
 605                                         return log_error_errno(r, "Failed to create inaccessible file node '%s': %m", np);
 606
 607                                 inaccessible = TAKE_PTR(np);
 608                         }
 609
 610                         what = inaccessible;
 611                 } else
 612                         what = mount_table[k].what;
 613
 614                 r = path_is_mount_point(where, NULL, 0);
 615                 if (r < 0 && r != -ENOENT)
 616                         return log_error_errno(r, "Failed to detect whether %s is a mount point: %m", where);
 617
 618                 /* Skip this entry if it is not a remount. */
 619                 if (what && r > 0)
 620                         continue;
 621
 622                 r = mkdir_userns_p(dest, where, 0755, (use_userns && !in_userns) ? uid_shift : UID_INVALID);
 623                 if (r < 0 && r != -EEXIST) {
 624                         if (fatal && r != -EROFS)
 625                                 return log_error_errno(r, "Failed to create directory %s: %m", where);
 626
 627                         log_debug_errno(r, "Failed to create directory %s: %m", where);
 628                         /* If we failed mkdir() or chown() due to the root
 629                          * directory being read only, attempt to mount this fs
 630                          * anyway and let mount_verbose log any errors */
 631                         if (r != -EROFS)
 632                                 continue;
 633                 }
 634
 635                 o = mount_table[k].options;
 636                 if (streq_ptr(mount_table[k].type, "tmpfs")) {
 637                         r = tmpfs_patch_options(o, in_userns ? 0 : uid_shift, selinux_apifs_context, &options);
 638                         if (r < 0)
 639                                 return log_oom();
 640                         if (r > 0)
 641                                 o = options;
 642                 }
 643
 644                 r = mount_verbose(fatal ? LOG_ERR : LOG_DEBUG,
 645                                   what,
 646                                   where,
 647                                   mount_table[k].type,
 648                                   mount_table[k].flags,
 649                                   o);
 650                 if (r < 0 && fatal)
 651                         return r;
 652         }
 653
 654         return 0;
 655 }
 656
 657 static int mount_bind(const char *dest, CustomMount *m) {
 658
 659         _cleanup_free_ char *where = NULL;
 660         struct stat source_st, dest_st;
 661         int r;
 662
 663         assert(dest);
 664         assert(m);
 665
 666         if (stat(m->source, &source_st) < 0)
 667                 return log_error_errno(errno, "Failed to stat %s: %m", m->source);
 668
 669         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where);
 670         if (r < 0)
 671                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 672         if (r > 0) { /* Path exists already? */
 673
 674                 if (stat(where, &dest_st) < 0)
 675                         return log_error_errno(errno, "Failed to stat %s: %m", where);
 676
 677                 if (S_ISDIR(source_st.st_mode) && !S_ISDIR(dest_st.st_mode)) {
 678                         log_error("Cannot bind mount directory %s on file %s.", m->source, where);
 679                         return -EINVAL;
 680                 }
 681
 682                 if (!S_ISDIR(source_st.st_mode) && S_ISDIR(dest_st.st_mode)) {
 683                         log_error("Cannot bind mount file %s on directory %s.", m->source, where);
 684                         return -EINVAL;
 685                 }
 686
 687         } else { /* Path doesn't exist yet? */
 688                 r = mkdir_parents_label(where, 0755);
 689                 if (r < 0)
 690                         return log_error_errno(r, "Failed to make parents of %s: %m", where);
 691
 692                 /* Create the mount point. Any non-directory file can be
 693                 * mounted on any non-directory file (regular, fifo, socket,
 694                 * char, block).
 695                 */
 696                 if (S_ISDIR(source_st.st_mode))
 697                         r = mkdir_label(where, 0755);
 698                 else
 699                         r = touch(where);
 700                 if (r < 0)
 701                         return log_error_errno(r, "Failed to create mount point %s: %m", where);
 702
 703         }
 704
 705         r = mount_verbose(LOG_ERR, m->source, where, NULL, MS_BIND | MS_REC, m->options);
 706         if (r < 0)
 707                 return r;
 708
 709         if (m->read_only) {
 710                 r = bind_remount_recursive(where, true, NULL);
 711                 if (r < 0)
 712                         return log_error_errno(r, "Read-only bind mount failed: %m");
 713         }
 714
 715         return 0;
 716 }
 717
 718 static int mount_tmpfs(
 719                 const char *dest,
 720                 CustomMount *m,
 721                 bool userns, uid_t uid_shift, uid_t uid_range,
 722                 const char *selinux_apifs_context) {
 723
 724         const char *options;
 725         _cleanup_free_ char *buf = NULL, *where = NULL;
 726         int r;
 727
 728         assert(dest);
 729         assert(m);
 730
 731         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where);
 732         if (r < 0)
 733                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 734         if (r == 0) { /* Doesn't exist yet? */
 735                 r = mkdir_p_label(where, 0755);
 736                 if (r < 0)
 737                         return log_error_errno(r, "Creating mount point for tmpfs %s failed: %m", where);
 738         }
 739
 740         r = tmpfs_patch_options(m->options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
 741         if (r < 0)
 742                 return log_oom();
 743         options = r > 0 ? buf : m->options;
 744
 745         return mount_verbose(LOG_ERR, "tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, options);
 746 }
 747
 748 static char *joined_and_escaped_lower_dirs(char **lower) {
 749         _cleanup_strv_free_ char **sv = NULL;
 750
 751         sv = strv_copy(lower);
 752         if (!sv)
 753                 return NULL;
 754
 755         strv_reverse(sv);
 756
 757         if (!strv_shell_escape(sv, ",:"))
 758                 return NULL;
 759
 760         return strv_join(sv, ":");
 761 }
 762
 763 static int mount_overlay(const char *dest, CustomMount *m) {
 764
 765         _cleanup_free_ char *lower = NULL, *where = NULL, *escaped_source = NULL;
 766         const char *options;
 767         int r;
 768
 769         assert(dest);
 770         assert(m);
 771
 772         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where);
 773         if (r < 0)
 774                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 775         if (r == 0) { /* Doesn't exist yet? */
 776                 r = mkdir_label(where, 0755);
 777                 if (r < 0)
 778                         return log_error_errno(r, "Creating mount point for overlay %s failed: %m", where);
 779         }
 780
 781         (void) mkdir_p_label(m->source, 0755);
 782
 783         lower = joined_and_escaped_lower_dirs(m->lower);
 784         if (!lower)
 785                 return log_oom();
 786
 787         escaped_source = shell_escape(m->source, ",:");
 788         if (!escaped_source)
 789                 return log_oom();
 790
 791         if (m->read_only)
 792                 options = strjoina("lowerdir=", escaped_source, ":", lower);
 793         else {
 794                 _cleanup_free_ char *escaped_work_dir = NULL;
 795
 796                 escaped_work_dir = shell_escape(m->work_dir, ",:");
 797                 if (!escaped_work_dir)
 798                         return log_oom();
 799
 800                 options = strjoina("lowerdir=", lower, ",upperdir=", escaped_source, ",workdir=", escaped_work_dir);
 801         }
 802
 803         return mount_verbose(LOG_ERR, "overlay", where, "overlay", m->read_only ? MS_RDONLY : 0, options);
 804 }
 805
 806 int mount_custom(
 807                 const char *dest,
 808                 CustomMount *mounts, size_t n,
 809                 bool userns, uid_t uid_shift, uid_t uid_range,
 810                 const char *selinux_apifs_context) {
 811
 812         size_t i;
 813         int r;
 814
 815         assert(dest);
 816
 817         for (i = 0; i < n; i++) {
 818                 CustomMount *m = mounts + i;
 819
 820                 switch (m->type) {
 821
 822                 case CUSTOM_MOUNT_BIND:
 823                         r = mount_bind(dest, m);
 824                         break;
 825
 826                 case CUSTOM_MOUNT_TMPFS:
 827                         r = mount_tmpfs(dest, m, userns, uid_shift, uid_range, selinux_apifs_context);
 828                         break;
 829
 830                 case CUSTOM_MOUNT_OVERLAY:
 831                         r = mount_overlay(dest, m);
 832                         break;
 833
 834                 default:
 835                         assert_not_reached("Unknown custom mount type");
 836                 }
 837
 838                 if (r < 0)
 839                         return r;
 840         }
 841
 842         return 0;
 843 }
 844
 845 int setup_volatile_state(
 846                 const char *directory,
 847                 VolatileMode mode,
 848                 bool userns, uid_t uid_shift, uid_t uid_range,
 849                 const char *selinux_apifs_context) {
 850
 851         _cleanup_free_ char *buf = NULL;
 852         const char *p, *options;
 853         int r;
 854
 855         assert(directory);
 856
 857         if (mode != VOLATILE_STATE)
 858                 return 0;
 859
 860         /* --volatile=state means we simply overmount /var
 861            with a tmpfs, and the rest read-only. */
 862
 863         r = bind_remount_recursive(directory, true, NULL);
 864         if (r < 0)
 865                 return log_error_errno(r, "Failed to remount %s read-only: %m", directory);
 866
 867         p = prefix_roota(directory, "/var");
 868         r = mkdir(p, 0755);
 869         if (r < 0 && errno != EEXIST)
 870                 return log_error_errno(errno, "Failed to create %s: %m", directory);
 871
 872         options = "mode=755";
 873         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
 874         if (r < 0)
 875                 return log_oom();
 876         if (r > 0)
 877                 options = buf;
 878
 879         return mount_verbose(LOG_ERR, "tmpfs", p, "tmpfs", MS_STRICTATIME, options);
 880 }
 881
 882 int setup_volatile(
 883                 const char *directory,
 884                 VolatileMode mode,
 885                 bool userns, uid_t uid_shift, uid_t uid_range,
 886                 const char *selinux_apifs_context) {
 887
 888         bool tmpfs_mounted = false, bind_mounted = false;
 889         char template[] = "/tmp/nspawn-volatile-XXXXXX";
 890         _cleanup_free_ char *buf = NULL;
 891         const char *f, *t, *options;
 892         int r;
 893
 894         assert(directory);
 895
 896         if (mode != VOLATILE_YES)
 897                 return 0;
 898
 899         /* --volatile=yes means we mount a tmpfs to the root dir, and
 900            the original /usr to use inside it, and that read-only. */
 901
 902         if (!mkdtemp(template))
 903                 return log_error_errno(errno, "Failed to create temporary directory: %m");
 904
 905         options = "mode=755";
 906         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
 907         if (r < 0)
 908                 return log_oom();
 909         if (r > 0)
 910                 options = buf;
 911
 912         r = mount_verbose(LOG_ERR, "tmpfs", template, "tmpfs", MS_STRICTATIME, options);
 913         if (r < 0)
 914                 goto fail;
 915
 916         tmpfs_mounted = true;
 917
 918         f = prefix_roota(directory, "/usr");
 919         t = prefix_roota(template, "/usr");
 920
 921         r = mkdir(t, 0755);
 922         if (r < 0 && errno != EEXIST) {
 923                 r = log_error_errno(errno, "Failed to create %s: %m", t);
 924                 goto fail;
 925         }
 926
 927         r = mount_verbose(LOG_ERR, f, t, NULL, MS_BIND|MS_REC, NULL);
 928         if (r < 0)
 929                 goto fail;
 930
 931         bind_mounted = true;
 932
 933         r = bind_remount_recursive(t, true, NULL);
 934         if (r < 0) {
 935                 log_error_errno(r, "Failed to remount %s read-only: %m", t);
 936                 goto fail;
 937         }
 938
 939         r = mount_verbose(LOG_ERR, template, directory, NULL, MS_MOVE, NULL);
 940         if (r < 0)
 941                 goto fail;
 942
 943         (void) rmdir(template);
 944
 945         return 0;
 946
 947 fail:
 948         if (bind_mounted)
 949                 (void) umount_verbose(t);
 950
 951         if (tmpfs_mounted)
 952                 (void) umount_verbose(template);
 953         (void) rmdir(template);
 954         return r;
 955 }
 956
 957 /* Expects *pivot_root_new and *pivot_root_old to be initialised to allocated memory or NULL. */
 958 int pivot_root_parse(char **pivot_root_new, char **pivot_root_old, const char *s) {
 959         _cleanup_free_ char *root_new = NULL, *root_old = NULL;
 960         const char *p = s;
 961         int r;
 962
 963         assert(pivot_root_new);
 964         assert(pivot_root_old);
 965
 966         r = extract_first_word(&p, &root_new, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 967         if (r < 0)
 968                 return r;
 969         if (r == 0)
 970                 return -EINVAL;
 971
 972         if (isempty(p))
 973                 root_old = NULL;
 974         else {
 975                 root_old = strdup(p);
 976                 if (!root_old)
 977                         return -ENOMEM;
 978         }
 979
 980         if (!path_is_absolute(root_new))
 981                 return -EINVAL;
 982         if (root_old && !path_is_absolute(root_old))
 983                 return -EINVAL;
 984
 985         free_and_replace(*pivot_root_new, root_new);
 986         free_and_replace(*pivot_root_old, root_old);
 987
 988         return 0;
 989 }
 990
 991 int setup_pivot_root(const char *directory, const char *pivot_root_new, const char *pivot_root_old) {
 992         _cleanup_free_ char *directory_pivot_root_new = NULL;
 993         _cleanup_free_ char *pivot_tmp_pivot_root_old = NULL;
 994         char pivot_tmp[] = "/tmp/nspawn-pivot-XXXXXX";
 995         bool remove_pivot_tmp = false;
 996         int r;
 997
 998         assert(directory);
 999
1000         if (!pivot_root_new)
1001                 return 0;
1002
1003         /* Pivot pivot_root_new to / and the existing / to pivot_root_old.
1004          * If pivot_root_old is NULL, the existing / disappears.
1005          * This requires a temporary directory, pivot_tmp, which is
1006          * not a child of either.
1007          *
1008          * This is typically used for OSTree-style containers, where
1009          * the root partition contains several sysroots which could be
1010          * run. Normally, one would be chosen by the bootloader and
1011          * pivoted to / by initramfs.
1012          *
1013          * For example, for an OSTree deployment, pivot_root_new
1014          * would be: /ostree/deploy/$os/deploy/$checksum. Note that this
1015          * code doesn’t do the /var mount which OSTree expects: use
1016          * --bind +/sysroot/ostree/deploy/$os/var:/var for that.
1017          *
1018          * So in the OSTree case, we’ll end up with something like:
1019          *  - directory = /tmp/nspawn-root-123456
1020          *  - pivot_root_new = /ostree/deploy/os/deploy/123abc
1021          *  - pivot_root_old = /sysroot
1022          *  - directory_pivot_root_new =
1023          *       /tmp/nspawn-root-123456/ostree/deploy/os/deploy/123abc
1024          *  - pivot_tmp = /tmp/nspawn-pivot-123456
1025          *  - pivot_tmp_pivot_root_old = /tmp/nspawn-pivot-123456/sysroot
1026          *
1027          * Requires all file systems at directory and below to be mounted
1028          * MS_PRIVATE or MS_SLAVE so they can be moved.
1029          */
1030         directory_pivot_root_new = prefix_root(directory, pivot_root_new);
1031
1032         /* Remount directory_pivot_root_new to make it movable. */
1033         r = mount_verbose(LOG_ERR, directory_pivot_root_new, directory_pivot_root_new, NULL, MS_BIND, NULL);
1034         if (r < 0)
1035                 goto done;
1036
1037         if (pivot_root_old) {
1038                 if (!mkdtemp(pivot_tmp)) {
1039                         r = log_error_errno(errno, "Failed to create temporary directory: %m");
1040                         goto done;
1041                 }
1042
1043                 remove_pivot_tmp = true;
1044                 pivot_tmp_pivot_root_old = prefix_root(pivot_tmp, pivot_root_old);
1045
1046                 r = mount_verbose(LOG_ERR, directory_pivot_root_new, pivot_tmp, NULL, MS_MOVE, NULL);
1047                 if (r < 0)
1048                         goto done;
1049
1050                 r = mount_verbose(LOG_ERR, directory, pivot_tmp_pivot_root_old, NULL, MS_MOVE, NULL);
1051                 if (r < 0)
1052                         goto done;
1053
1054                 r = mount_verbose(LOG_ERR, pivot_tmp, directory, NULL, MS_MOVE, NULL);
1055                 if (r < 0)
1056                         goto done;
1057         } else {
1058                 r = mount_verbose(LOG_ERR, directory_pivot_root_new, directory, NULL, MS_MOVE, NULL);
1059                 if (r < 0)
1060                         goto done;
1061         }
1062
1063 done:
1064         if (remove_pivot_tmp)
1065                 (void) rmdir(pivot_tmp);
1066
1067         return r;
1068 }