1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
4 #include <linux/magic.h>
6 #include "alloc-util.h"
10 #include "format-util.h"
12 #include "label-util.h"
13 #include "mkdir-label.h"
14 #include "mount-util.h"
15 #include "mountpoint-util.h"
16 #include "namespace-util.h"
17 #include "nspawn-mount.h"
18 #include "parse-util.h"
19 #include "path-util.h"
22 #include "sort-util.h"
23 #include "stat-util.h"
24 #include "string-util.h"
26 #include "tmpfile-util.h"
27 #include "user-util.h"
29 CustomMount
* custom_mount_add(CustomMount
**l
, size_t *n
, CustomMountType t
) {
35 assert(t
< _CUSTOM_MOUNT_TYPE_MAX
);
37 c
= reallocarray(*l
, *n
+ 1, sizeof(CustomMount
));
45 *ret
= (CustomMount
) {
52 void custom_mount_free_all(CustomMount
*l
, size_t n
) {
53 for (size_t i
= 0; i
< n
; i
++) {
54 CustomMount
*m
= l
+ i
;
61 (void) rm_rf(m
->work_dir
, REMOVE_ROOT
|REMOVE_PHYSICAL
);
65 if (m
->rm_rf_tmpdir
) {
66 (void) rm_rf(m
->rm_rf_tmpdir
, REMOVE_ROOT
|REMOVE_PHYSICAL
);
67 free(m
->rm_rf_tmpdir
);
71 free(m
->type_argument
);
77 static int custom_mount_compare(const CustomMount
*a
, const CustomMount
*b
) {
80 r
= path_compare(a
->destination
, b
->destination
);
84 return CMP(a
->type
, b
->type
);
87 static int source_path_parse(const char *p
, char **ret
) {
95 if (!path_is_absolute(p
+ 1))
106 return path_make_absolute_cwd(p
, ret
);
109 static int source_path_parse_nullable(const char *p
, char **ret
) {
118 return source_path_parse(p
, ret
);
121 static char *resolve_source_path(const char *dest
, const char *source
) {
125 if (source
[0] == '+')
126 return path_join(dest
, source
+ 1);
128 return strdup(source
);
131 static int allocate_temporary_source(CustomMount
*m
) {
134 assert(!m
->rm_rf_tmpdir
);
136 m
->rm_rf_tmpdir
= strdup("/var/tmp/nspawn-temp-XXXXXX");
137 if (!m
->rm_rf_tmpdir
)
140 if (!mkdtemp(m
->rm_rf_tmpdir
)) {
141 m
->rm_rf_tmpdir
= mfree(m
->rm_rf_tmpdir
);
142 return log_error_errno(errno
, "Failed to acquire temporary directory: %m");
145 m
->source
= path_join(m
->rm_rf_tmpdir
, "src");
149 if (mkdir(m
->source
, 0755) < 0)
150 return log_error_errno(errno
, "Failed to create %s: %m", m
->source
);
155 int custom_mount_prepare_all(const char *dest
, CustomMount
*l
, size_t n
) {
158 /* Prepare all custom mounts. This will make source we know all temporary directories. This is called in the
159 * parent process, so that we know the temporary directories to remove on exit before we fork off the
164 /* Order the custom mounts, and make sure we have a working directory */
165 typesafe_qsort(l
, n
, custom_mount_compare
);
167 for (size_t i
= 0; i
< n
; i
++) {
168 CustomMount
*m
= l
+ i
;
170 /* /proc we mount in the inner child, i.e. when we acquired CLONE_NEWPID. All other mounts we mount
171 * already in the outer child, so that the mounts are already established before CLONE_NEWPID and in
172 * particular CLONE_NEWUSER. This also means any custom mounts below /proc also need to be mounted in
173 * the inner child, not the outer one. Determine this here. */
174 m
->in_userns
= path_startswith(m
->destination
, "/proc");
176 if (m
->type
== CUSTOM_MOUNT_BIND
) {
180 s
= resolve_source_path(dest
, m
->source
);
184 free_and_replace(m
->source
, s
);
186 /* No source specified? In that case, use a throw-away temporary directory in /var/tmp */
188 r
= allocate_temporary_source(m
);
194 if (m
->type
== CUSTOM_MOUNT_OVERLAY
) {
195 STRV_FOREACH(j
, m
->lower
) {
198 s
= resolve_source_path(dest
, *j
);
202 free_and_replace(*j
, s
);
208 s
= resolve_source_path(dest
, m
->source
);
212 free_and_replace(m
->source
, s
);
214 r
= allocate_temporary_source(m
);
222 s
= resolve_source_path(dest
, m
->work_dir
);
226 free_and_replace(m
->work_dir
, s
);
228 r
= tempfn_random(m
->source
, NULL
, &m
->work_dir
);
230 return log_error_errno(r
, "Failed to acquire working directory: %m");
233 (void) mkdir_label(m
->work_dir
, 0700);
240 int bind_mount_parse(CustomMount
**l
, size_t *n
, const char *s
, bool read_only
) {
241 _cleanup_free_
char *source
= NULL
, *destination
= NULL
, *opts
= NULL
, *p
= NULL
;
248 r
= extract_many_words(&s
, ":", EXTRACT_DONT_COALESCE_SEPARATORS
, &source
, &destination
);
254 destination
= strdup(source
[0] == '+' ? source
+1 : source
);
258 if (r
== 2 && !isempty(s
)) {
264 r
= source_path_parse_nullable(source
, &p
);
268 if (!path_is_absolute(destination
))
271 m
= custom_mount_add(l
, n
, CUSTOM_MOUNT_BIND
);
275 m
->source
= TAKE_PTR(p
);
276 m
->destination
= TAKE_PTR(destination
);
277 m
->read_only
= read_only
;
278 m
->options
= TAKE_PTR(opts
);
283 int tmpfs_mount_parse(CustomMount
**l
, size_t *n
, const char *s
) {
284 _cleanup_free_
char *path
= NULL
, *opts
= NULL
;
285 const char *p
= ASSERT_PTR(s
);
292 r
= extract_first_word(&p
, &path
, ":", EXTRACT_DONT_COALESCE_SEPARATORS
);
299 opts
= strdup("mode=0755");
305 if (!path_is_absolute(path
))
308 m
= custom_mount_add(l
, n
, CUSTOM_MOUNT_TMPFS
);
312 m
->destination
= TAKE_PTR(path
);
313 m
->options
= TAKE_PTR(opts
);
318 int overlay_mount_parse(CustomMount
**l
, size_t *n
, const char *s
, bool read_only
) {
319 _cleanup_free_
char *upper
= NULL
, *destination
= NULL
;
320 _cleanup_strv_free_
char **lower
= NULL
;
324 k
= strv_split_full(&lower
, s
, ":", EXTRACT_DONT_COALESCE_SEPARATORS
);
328 return -EADDRNOTAVAIL
;
330 _cleanup_free_
char *p
= NULL
;
332 /* If two parameters are specified, the first one is the lower, the second one the upper directory. And
333 * we'll also define the destination mount point the same as the upper. */
335 r
= source_path_parse(lower
[0], &p
);
339 free_and_replace(lower
[0], p
);
341 r
= source_path_parse(lower
[1], &p
);
345 free_and_replace(lower
[1], p
);
347 upper
= TAKE_PTR(lower
[1]);
349 destination
= strdup(upper
[0] == '+' ? upper
+1 : upper
); /* take the destination without "+" prefix */
353 _cleanup_free_
char *p
= NULL
;
355 /* If more than two parameters are specified, the last one is the destination, the second to last one
356 * the "upper", and all before that the "lower" directories. */
358 destination
= lower
[k
- 1];
359 upper
= TAKE_PTR(lower
[k
- 2]);
361 STRV_FOREACH(i
, lower
) {
362 r
= source_path_parse(*i
, &p
);
366 free_and_replace(*i
, p
);
369 /* If the upper directory is unspecified, then let's create it automatically as a throw-away directory
371 r
= source_path_parse_nullable(upper
, &p
);
375 free_and_replace(upper
, p
);
377 if (!path_is_absolute(destination
))
381 m
= custom_mount_add(l
, n
, CUSTOM_MOUNT_OVERLAY
);
385 m
->destination
= TAKE_PTR(destination
);
386 m
->source
= TAKE_PTR(upper
);
387 m
->lower
= TAKE_PTR(lower
);
388 m
->read_only
= read_only
;
393 int inaccessible_mount_parse(CustomMount
**l
, size_t *n
, const char *s
) {
394 _cleanup_free_
char *path
= NULL
;
401 if (!path_is_absolute(s
))
408 m
= custom_mount_add(l
, n
, CUSTOM_MOUNT_INACCESSIBLE
);
412 m
->destination
= TAKE_PTR(path
);
416 int tmpfs_patch_options(
419 const char *selinux_apifs_context
,
422 _cleanup_free_
char *buf
= NULL
;
427 buf
= strdup(options
);
432 if (uid_shift
!= UID_INVALID
)
433 if (strextendf_with_separator(&buf
, ",", "uid=" UID_FMT
",gid=" UID_FMT
, uid_shift
, uid_shift
) < 0)
437 if (selinux_apifs_context
)
438 if (strextendf_with_separator(&buf
, ",", "context=\"%s\"", selinux_apifs_context
) < 0)
442 *ret
= TAKE_PTR(buf
);
446 int mount_sysfs(const char *dest
, MountSettingsMask mount_settings
) {
447 const char *full
, *top
;
449 unsigned long extra_flags
= 0;
451 top
= prefix_roota(dest
, "/sys");
452 r
= path_is_fs_type(top
, SYSFS_MAGIC
);
454 return log_error_errno(r
, "Failed to determine filesystem type of %s: %m", top
);
455 /* /sys might already be mounted as sysfs by the outer child in the
456 * !netns case. In this case, it's all good. Don't touch it because we
457 * don't have the right to do so, see https://github.com/systemd/systemd/issues/1555.
462 full
= prefix_roota(top
, "/full");
464 (void) mkdir(full
, 0755);
466 if (FLAGS_SET(mount_settings
, MOUNT_APPLY_APIVFS_RO
))
467 extra_flags
|= MS_RDONLY
;
469 r
= mount_nofollow_verbose(LOG_ERR
, "sysfs", full
, "sysfs",
470 MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|extra_flags
, NULL
);
474 FOREACH_STRING(x
, "block", "bus", "class", "dev", "devices", "kernel") {
475 _cleanup_free_
char *from
= NULL
, *to
= NULL
;
477 from
= path_join(full
, x
);
481 to
= path_join(top
, x
);
485 (void) mkdir(to
, 0755);
487 r
= mount_nofollow_verbose(LOG_ERR
, from
, to
, NULL
, MS_BIND
, NULL
);
491 r
= mount_nofollow_verbose(LOG_ERR
, NULL
, to
, NULL
,
492 MS_BIND
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_REMOUNT
|extra_flags
, NULL
);
497 r
= umount_verbose(LOG_ERR
, full
, UMOUNT_NOFOLLOW
);
502 return log_error_errno(errno
, "Failed to remove %s: %m", full
);
504 /* Create mountpoint for cgroups. Otherwise we are not allowed since we
505 * remount /sys read-only.
507 const char *x
= prefix_roota(top
, "/fs/cgroup");
508 (void) mkdir_p(x
, 0755);
510 return mount_nofollow_verbose(LOG_ERR
, NULL
, top
, NULL
,
511 MS_BIND
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_REMOUNT
|extra_flags
, NULL
);
514 #define PROC_DEFAULT_MOUNT_FLAGS (MS_NOSUID|MS_NOEXEC|MS_NODEV)
515 #define SYS_DEFAULT_MOUNT_FLAGS (MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV)
517 int mount_all(const char *dest
,
518 MountSettingsMask mount_settings
,
520 const char *selinux_apifs_context
) {
522 #define PROC_INACCESSIBLE_REG(path) \
523 { "/run/systemd/inaccessible/reg", (path), NULL, NULL, MS_BIND, \
524 MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO }, /* Bind mount first ... */ \
525 { NULL, (path), NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, \
526 MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO } /* Then, make it r/o */
528 #define PROC_READ_ONLY(path) \
529 { (path), (path), NULL, NULL, MS_BIND, \
530 MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO }, /* Bind mount first ... */ \
531 { NULL, (path), NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, \
532 MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO } /* Then, make it r/o */
534 typedef struct MountPoint
{
540 MountSettingsMask mount_settings
;
543 static const MountPoint mount_table
[] = {
544 /* First we list inner child mounts (i.e. mounts applied *after* entering user namespacing) */
545 { "proc", "/proc", "proc", NULL
, PROC_DEFAULT_MOUNT_FLAGS
,
546 MOUNT_FATAL
|MOUNT_IN_USERNS
|MOUNT_MKDIR
|MOUNT_FOLLOW_SYMLINKS
}, /* we follow symlinks here since not following them requires /proc/ already being mounted, which we don't have here. */
548 { "/proc/sys", "/proc/sys", NULL
, NULL
, MS_BIND
,
549 MOUNT_FATAL
|MOUNT_IN_USERNS
|MOUNT_APPLY_APIVFS_RO
}, /* Bind mount first ... */
551 { "/proc/sys/net", "/proc/sys/net", NULL
, NULL
, MS_BIND
,
552 MOUNT_FATAL
|MOUNT_IN_USERNS
|MOUNT_APPLY_APIVFS_RO
|MOUNT_APPLY_APIVFS_NETNS
}, /* (except for this) */
554 { NULL
, "/proc/sys", NULL
, NULL
, MS_BIND
|MS_RDONLY
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_REMOUNT
,
555 MOUNT_FATAL
|MOUNT_IN_USERNS
|MOUNT_APPLY_APIVFS_RO
}, /* ... then, make it r/o */
557 /* Make these files inaccessible to container payloads: they potentially leak information about kernel
558 * internals or the host's execution environment to the container */
559 PROC_INACCESSIBLE_REG("/proc/kallsyms"),
560 PROC_INACCESSIBLE_REG("/proc/kcore"),
561 PROC_INACCESSIBLE_REG("/proc/keys"),
562 PROC_INACCESSIBLE_REG("/proc/sysrq-trigger"),
563 PROC_INACCESSIBLE_REG("/proc/timer_list"),
565 /* Make these directories read-only to container payloads: they show hardware information, and in some
566 * cases contain tunables the container really shouldn't have access to. */
567 PROC_READ_ONLY("/proc/acpi"),
568 PROC_READ_ONLY("/proc/apm"),
569 PROC_READ_ONLY("/proc/asound"),
570 PROC_READ_ONLY("/proc/bus"),
571 PROC_READ_ONLY("/proc/fs"),
572 PROC_READ_ONLY("/proc/irq"),
573 PROC_READ_ONLY("/proc/scsi"),
575 { "mqueue", "/dev/mqueue", "mqueue", NULL
, MS_NOSUID
|MS_NOEXEC
|MS_NODEV
,
576 MOUNT_IN_USERNS
|MOUNT_MKDIR
},
578 /* Then we list outer child mounts (i.e. mounts applied *before* entering user namespacing) */
579 { "tmpfs", "/tmp", "tmpfs", "mode=01777" NESTED_TMPFS_LIMITS
, MS_NOSUID
|MS_NODEV
|MS_STRICTATIME
,
580 MOUNT_FATAL
|MOUNT_APPLY_TMPFS_TMP
|MOUNT_MKDIR
},
581 { "tmpfs", "/sys", "tmpfs", "mode=0555" TMPFS_LIMITS_SYS
, MS_NOSUID
|MS_NOEXEC
|MS_NODEV
,
582 MOUNT_FATAL
|MOUNT_APPLY_APIVFS_NETNS
|MOUNT_MKDIR
},
583 { "sysfs", "/sys", "sysfs", NULL
, SYS_DEFAULT_MOUNT_FLAGS
,
584 MOUNT_FATAL
|MOUNT_APPLY_APIVFS_RO
|MOUNT_MKDIR
}, /* skipped if above was mounted */
585 { "sysfs", "/sys", "sysfs", NULL
, MS_NOSUID
|MS_NOEXEC
|MS_NODEV
,
586 MOUNT_FATAL
|MOUNT_MKDIR
}, /* skipped if above was mounted */
587 { "tmpfs", "/dev", "tmpfs", "mode=0755" TMPFS_LIMITS_PRIVATE_DEV
, MS_NOSUID
|MS_STRICTATIME
,
588 MOUNT_FATAL
|MOUNT_MKDIR
},
589 { "tmpfs", "/dev/shm", "tmpfs", "mode=01777" NESTED_TMPFS_LIMITS
, MS_NOSUID
|MS_NODEV
|MS_STRICTATIME
,
590 MOUNT_FATAL
|MOUNT_MKDIR
},
591 { "tmpfs", "/run", "tmpfs", "mode=0755" TMPFS_LIMITS_RUN
, MS_NOSUID
|MS_NODEV
|MS_STRICTATIME
,
592 MOUNT_FATAL
|MOUNT_MKDIR
},
593 { "/run/host", "/run/host", NULL
, NULL
, MS_BIND
,
594 MOUNT_FATAL
|MOUNT_MKDIR
|MOUNT_PREFIX_ROOT
}, /* Prepare this so that we can make it read-only when we are done */
595 { "/etc/os-release", "/run/host/os-release", NULL
, NULL
, MS_BIND
,
596 MOUNT_TOUCH
}, /* As per kernel interface requirements, bind mount first (creating mount points) and make read-only later */
597 { "/usr/lib/os-release", "/run/host/os-release", NULL
, NULL
, MS_BIND
,
598 MOUNT_FATAL
}, /* If /etc/os-release doesn't exist use the version in /usr/lib as fallback */
599 { NULL
, "/run/host/os-release", NULL
, NULL
, MS_BIND
|MS_RDONLY
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_REMOUNT
,
601 { NULL
, "/run/host/os-release", NULL
, NULL
, MS_PRIVATE
,
602 MOUNT_FATAL
}, /* Turn off propagation (we only want that for the mount propagation tunnel dir) */
603 { NULL
, "/run/host", NULL
, NULL
, MS_BIND
|MS_RDONLY
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_REMOUNT
,
604 MOUNT_FATAL
|MOUNT_IN_USERNS
},
606 { "/sys/fs/selinux", "/sys/fs/selinux", NULL
, NULL
, MS_BIND
,
607 MOUNT_MKDIR
}, /* Bind mount first (mkdir/chown the mount point in case /sys/ is mounted as minimal skeleton tmpfs) */
608 { NULL
, "/sys/fs/selinux", NULL
, NULL
, MS_BIND
|MS_RDONLY
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_REMOUNT
,
609 0 }, /* Then, make it r/o (don't mkdir/chown the mount point here, the previous entry already did that) */
610 { NULL
, "/sys/fs/selinux", NULL
, NULL
, MS_PRIVATE
,
611 0 }, /* Turn off propagation (we only want that for the mount propagation tunnel dir) */
615 bool use_userns
= FLAGS_SET(mount_settings
, MOUNT_USE_USERNS
);
616 bool netns
= FLAGS_SET(mount_settings
, MOUNT_APPLY_APIVFS_NETNS
);
617 bool ro
= FLAGS_SET(mount_settings
, MOUNT_APPLY_APIVFS_RO
);
618 bool in_userns
= FLAGS_SET(mount_settings
, MOUNT_IN_USERNS
);
619 bool tmpfs_tmp
= FLAGS_SET(mount_settings
, MOUNT_APPLY_TMPFS_TMP
);
622 for (size_t k
= 0; k
< ELEMENTSOF(mount_table
); k
++) {
623 _cleanup_free_
char *where
= NULL
, *options
= NULL
, *prefixed
= NULL
;
624 bool fatal
= FLAGS_SET(mount_table
[k
].mount_settings
, MOUNT_FATAL
);
627 if (in_userns
!= FLAGS_SET(mount_table
[k
].mount_settings
, MOUNT_IN_USERNS
))
630 if (!netns
&& FLAGS_SET(mount_table
[k
].mount_settings
, MOUNT_APPLY_APIVFS_NETNS
))
633 if (!ro
&& FLAGS_SET(mount_table
[k
].mount_settings
, MOUNT_APPLY_APIVFS_RO
))
636 if (!tmpfs_tmp
&& FLAGS_SET(mount_table
[k
].mount_settings
, MOUNT_APPLY_TMPFS_TMP
))
639 r
= chase(mount_table
[k
].where
, dest
, CHASE_NONEXISTENT
|CHASE_PREFIX_ROOT
, &where
, NULL
);
641 return log_error_errno(r
, "Failed to resolve %s%s: %m", strempty(dest
), mount_table
[k
].where
);
643 /* Skip this entry if it is not a remount. */
644 if (mount_table
[k
].what
) {
645 r
= path_is_mount_point(where
);
646 if (r
< 0 && r
!= -ENOENT
)
647 return log_error_errno(r
, "Failed to detect whether %s is a mount point: %m", where
);
652 if ((mount_table
[k
].mount_settings
& (MOUNT_MKDIR
|MOUNT_TOUCH
)) != 0) {
653 uid_t u
= (use_userns
&& !in_userns
) ? uid_shift
: UID_INVALID
;
655 if (FLAGS_SET(mount_table
[k
].mount_settings
, MOUNT_TOUCH
))
656 r
= mkdir_parents_safe(dest
, where
, 0755, u
, u
, 0);
658 r
= mkdir_p_safe(dest
, where
, 0755, u
, u
, 0);
659 if (r
< 0 && r
!= -EEXIST
) {
660 if (fatal
&& r
!= -EROFS
)
661 return log_error_errno(r
, "Failed to create directory %s: %m", where
);
663 log_debug_errno(r
, "Failed to create directory %s: %m", where
);
665 /* If we failed mkdir() or chown() due to the root directory being read only,
666 * attempt to mount this fs anyway and let mount_verbose log any errors */
672 if (FLAGS_SET(mount_table
[k
].mount_settings
, MOUNT_TOUCH
)) {
674 if (r
< 0 && r
!= -EEXIST
) {
675 if (fatal
&& r
!= -EROFS
)
676 return log_error_errno(r
, "Failed to create file %s: %m", where
);
678 log_debug_errno(r
, "Failed to create file %s: %m", where
);
684 o
= mount_table
[k
].options
;
685 if (streq_ptr(mount_table
[k
].type
, "tmpfs")) {
686 r
= tmpfs_patch_options(o
, in_userns
? 0 : uid_shift
, selinux_apifs_context
, &options
);
693 if (FLAGS_SET(mount_table
[k
].mount_settings
, MOUNT_PREFIX_ROOT
)) {
694 /* Optionally prefix the mount source with the root dir. This is useful in bind
695 * mounts to be created within the container image before we transition into it. Note
696 * that MOUNT_IN_USERNS is run after we transitioned hence prefixing is not necessary
698 r
= chase(mount_table
[k
].what
, dest
, CHASE_PREFIX_ROOT
, &prefixed
, NULL
);
700 return log_error_errno(r
, "Failed to resolve %s%s: %m", strempty(dest
), mount_table
[k
].what
);
703 r
= mount_verbose_full(
704 fatal
? LOG_ERR
: LOG_DEBUG
,
705 prefixed
?: mount_table
[k
].what
,
708 mount_table
[k
].flags
,
710 FLAGS_SET(mount_table
[k
].mount_settings
, MOUNT_FOLLOW_SYMLINKS
));
718 static int parse_mount_bind_options(const char *options
, unsigned long *mount_flags
, char **mount_opts
, RemountIdmapping
*idmapping
) {
719 unsigned long flags
= *mount_flags
;
721 RemountIdmapping new_idmapping
= *idmapping
;
727 _cleanup_free_
char *word
= NULL
;
729 r
= extract_first_word(&options
, &word
, ",", 0);
731 return log_error_errno(r
, "Failed to extract mount option: %m");
735 if (streq(word
, "rbind"))
737 else if (streq(word
, "norbind"))
739 else if (streq(word
, "idmap"))
740 new_idmapping
= REMOUNT_IDMAPPING_HOST_ROOT
;
741 else if (streq(word
, "noidmap"))
742 new_idmapping
= REMOUNT_IDMAPPING_NONE
;
743 else if (streq(word
, "rootidmap"))
744 new_idmapping
= REMOUNT_IDMAPPING_HOST_OWNER
;
745 else if (streq(word
, "owneridmap"))
746 new_idmapping
= REMOUNT_IDMAPPING_HOST_OWNER_TO_TARGET_OWNER
;
748 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
749 "Invalid bind mount option: %s", word
);
752 *mount_flags
= flags
;
753 *idmapping
= new_idmapping
;
754 /* in the future mount_opts will hold string options for mount(2) */
760 static int mount_bind(const char *dest
, CustomMount
*m
, uid_t uid_shift
, uid_t uid_range
) {
761 _cleanup_free_
char *mount_opts
= NULL
, *where
= NULL
;
762 unsigned long mount_flags
= MS_BIND
| MS_REC
;
763 struct stat source_st
, dest_st
;
764 uid_t dest_uid
= UID_INVALID
;
766 RemountIdmapping idmapping
= REMOUNT_IDMAPPING_NONE
;
772 r
= parse_mount_bind_options(m
->options
, &mount_flags
, &mount_opts
, &idmapping
);
777 /* If this is a bind mount from a temporary sources change ownership of the source to the container's
778 * root UID. Otherwise it would always show up as "nobody" if user namespacing is used. */
779 if (m
->rm_rf_tmpdir
&& chown(m
->source
, uid_shift
, uid_shift
) < 0)
780 return log_error_errno(errno
, "Failed to chown %s: %m", m
->source
);
782 if (stat(m
->source
, &source_st
) < 0)
783 return log_error_errno(errno
, "Failed to stat %s: %m", m
->source
);
785 r
= chase(m
->destination
, dest
, CHASE_PREFIX_ROOT
|CHASE_NONEXISTENT
, &where
, NULL
);
787 return log_error_errno(r
, "Failed to resolve %s/%s: %m", dest
, m
->destination
);
788 if (r
> 0) { /* Path exists already? */
790 if (stat(where
, &dest_st
) < 0)
791 return log_error_errno(errno
, "Failed to stat %s: %m", where
);
793 dest_uid
= dest_st
.st_uid
;
795 if (S_ISDIR(source_st
.st_mode
) && !S_ISDIR(dest_st
.st_mode
))
796 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
797 "Cannot bind mount directory %s on file %s.",
800 if (!S_ISDIR(source_st
.st_mode
) && S_ISDIR(dest_st
.st_mode
))
801 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
802 "Cannot bind mount file %s on directory %s.",
805 } else { /* Path doesn't exist yet? */
806 r
= mkdir_parents_safe_label(dest
, where
, 0755, uid_shift
, uid_shift
, MKDIR_IGNORE_EXISTING
);
808 return log_error_errno(r
, "Failed to make parents of %s: %m", where
);
810 /* Create the mount point. Any non-directory file can be
811 * mounted on any non-directory file (regular, fifo, socket,
814 if (S_ISDIR(source_st
.st_mode
))
815 r
= mkdir_label(where
, 0755);
819 return log_error_errno(r
, "Failed to create mount point %s: %m", where
);
821 if (chown(where
, uid_shift
, uid_shift
) < 0)
822 return log_error_errno(errno
, "Failed to chown %s: %m", where
);
824 dest_uid
= uid_shift
;
827 r
= mount_nofollow_verbose(LOG_ERR
, m
->source
, where
, NULL
, mount_flags
, mount_opts
);
832 r
= bind_remount_recursive(where
, MS_RDONLY
, MS_RDONLY
, NULL
);
834 return log_error_errno(r
, "Read-only bind mount failed: %m");
837 if (idmapping
!= REMOUNT_IDMAPPING_NONE
) {
838 r
= remount_idmap(STRV_MAKE(where
), uid_shift
, uid_range
, source_st
.st_uid
, dest_uid
, idmapping
);
840 return log_error_errno(r
, "Failed to map ids for bind mount %s: %m", where
);
846 static int mount_tmpfs(const char *dest
, CustomMount
*m
, uid_t uid_shift
, const char *selinux_apifs_context
) {
848 _cleanup_free_
char *buf
= NULL
, *where
= NULL
;
854 r
= chase(m
->destination
, dest
, CHASE_PREFIX_ROOT
|CHASE_NONEXISTENT
, &where
, NULL
);
856 return log_error_errno(r
, "Failed to resolve %s/%s: %m", dest
, m
->destination
);
857 if (r
== 0) { /* Doesn't exist yet? */
858 r
= mkdir_p_label(where
, 0755);
860 return log_error_errno(r
, "Creating mount point for tmpfs %s failed: %m", where
);
863 r
= tmpfs_patch_options(m
->options
, uid_shift
== 0 ? UID_INVALID
: uid_shift
, selinux_apifs_context
, &buf
);
866 options
= r
> 0 ? buf
: m
->options
;
868 return mount_nofollow_verbose(LOG_ERR
, "tmpfs", where
, "tmpfs", MS_NODEV
|MS_STRICTATIME
, options
);
871 static char *joined_and_escaped_lower_dirs(char **lower
) {
872 _cleanup_strv_free_
char **sv
= NULL
;
874 sv
= strv_copy(lower
);
880 if (!strv_shell_escape(sv
, ",:"))
883 return strv_join(sv
, ":");
886 static int mount_overlay(const char *dest
, CustomMount
*m
) {
887 _cleanup_free_
char *lower
= NULL
, *where
= NULL
, *escaped_source
= NULL
;
894 r
= chase(m
->destination
, dest
, CHASE_PREFIX_ROOT
|CHASE_NONEXISTENT
, &where
, NULL
);
896 return log_error_errno(r
, "Failed to resolve %s/%s: %m", dest
, m
->destination
);
897 if (r
== 0) { /* Doesn't exist yet? */
898 r
= mkdir_label(where
, 0755);
900 return log_error_errno(r
, "Creating mount point for overlay %s failed: %m", where
);
903 (void) mkdir_p_label(m
->source
, 0755);
905 lower
= joined_and_escaped_lower_dirs(m
->lower
);
909 escaped_source
= shell_escape(m
->source
, ",:");
914 options
= strjoina("lowerdir=", escaped_source
, ":", lower
);
916 _cleanup_free_
char *escaped_work_dir
= NULL
;
918 escaped_work_dir
= shell_escape(m
->work_dir
, ",:");
919 if (!escaped_work_dir
)
922 options
= strjoina("lowerdir=", lower
, ",upperdir=", escaped_source
, ",workdir=", escaped_work_dir
);
925 return mount_nofollow_verbose(LOG_ERR
, "overlay", where
, "overlay", m
->read_only
? MS_RDONLY
: 0, options
);
928 static int mount_inaccessible(const char *dest
, CustomMount
*m
) {
929 _cleanup_free_
char *where
= NULL
, *source
= NULL
;
936 r
= chase_and_stat(m
->destination
, dest
, CHASE_PREFIX_ROOT
, &where
, &st
);
938 log_full_errno(m
->graceful
? LOG_DEBUG
: LOG_ERR
, r
, "Failed to resolve %s/%s: %m", dest
, m
->destination
);
939 return m
->graceful
? 0 : r
;
942 r
= mode_to_inaccessible_node(NULL
, st
.st_mode
, &source
);
944 return m
->graceful
? 0 : r
;
946 r
= mount_nofollow_verbose(m
->graceful
? LOG_DEBUG
: LOG_ERR
, source
, where
, NULL
, MS_BIND
, NULL
);
948 return m
->graceful
? 0 : r
;
950 r
= mount_nofollow_verbose(m
->graceful
? LOG_DEBUG
: LOG_ERR
, NULL
, where
, NULL
, MS_BIND
|MS_RDONLY
|MS_REMOUNT
, NULL
);
952 (void) umount_verbose(m
->graceful
? LOG_DEBUG
: LOG_ERR
, where
, UMOUNT_NOFOLLOW
);
953 return m
->graceful
? 0 : r
;
959 static int mount_arbitrary(const char *dest
, CustomMount
*m
) {
960 _cleanup_free_
char *where
= NULL
;
966 r
= chase(m
->destination
, dest
, CHASE_PREFIX_ROOT
|CHASE_NONEXISTENT
, &where
, NULL
);
968 return log_error_errno(r
, "Failed to resolve %s/%s: %m", dest
, m
->destination
);
969 if (r
== 0) { /* Doesn't exist yet? */
970 r
= mkdir_p_label(where
, 0755);
972 return log_error_errno(r
, "Creating mount point for mount %s failed: %m", where
);
975 return mount_nofollow_verbose(LOG_ERR
, m
->source
, where
, m
->type_argument
, 0, m
->options
);
980 CustomMount
*mounts
, size_t n
,
983 const char *selinux_apifs_context
,
984 MountSettingsMask mount_settings
) {
989 for (size_t i
= 0; i
< n
; i
++) {
990 CustomMount
*m
= mounts
+ i
;
992 if (FLAGS_SET(mount_settings
, MOUNT_IN_USERNS
) != m
->in_userns
)
995 if (FLAGS_SET(mount_settings
, MOUNT_ROOT_ONLY
) && !path_equal(m
->destination
, "/"))
998 if (FLAGS_SET(mount_settings
, MOUNT_NON_ROOT_ONLY
) && path_equal(m
->destination
, "/"))
1003 case CUSTOM_MOUNT_BIND
:
1004 r
= mount_bind(dest
, m
, uid_shift
, uid_range
);
1007 case CUSTOM_MOUNT_TMPFS
:
1008 r
= mount_tmpfs(dest
, m
, uid_shift
, selinux_apifs_context
);
1011 case CUSTOM_MOUNT_OVERLAY
:
1012 r
= mount_overlay(dest
, m
);
1015 case CUSTOM_MOUNT_INACCESSIBLE
:
1016 r
= mount_inaccessible(dest
, m
);
1019 case CUSTOM_MOUNT_ARBITRARY
:
1020 r
= mount_arbitrary(dest
, m
);
1024 assert_not_reached();
1034 bool has_custom_root_mount(const CustomMount
*mounts
, size_t n
) {
1035 for (size_t i
= 0; i
< n
; i
++)
1036 if (path_equal(mounts
[i
].destination
, "/"))
1042 static int setup_volatile_state(const char *directory
, uid_t uid_shift
, const char *selinux_apifs_context
) {
1043 _cleanup_free_
char *buf
= NULL
;
1044 const char *p
, *options
;
1049 /* --volatile=state means we simply overmount /var with a tmpfs, and the rest read-only. */
1051 r
= bind_remount_recursive(directory
, MS_RDONLY
, MS_RDONLY
, NULL
);
1053 return log_error_errno(r
, "Failed to remount %s read-only: %m", directory
);
1055 p
= prefix_roota(directory
, "/var");
1057 if (r
< 0 && errno
!= EEXIST
)
1058 return log_error_errno(errno
, "Failed to create %s: %m", directory
);
1060 options
= "mode=0755" TMPFS_LIMITS_VOLATILE_STATE
;
1061 r
= tmpfs_patch_options(options
, uid_shift
== 0 ? UID_INVALID
: uid_shift
, selinux_apifs_context
, &buf
);
1067 return mount_nofollow_verbose(LOG_ERR
, "tmpfs", p
, "tmpfs", MS_STRICTATIME
, options
);
1070 static int setup_volatile_yes(const char *directory
, uid_t uid_shift
, const char *selinux_apifs_context
) {
1071 bool tmpfs_mounted
= false, bind_mounted
= false;
1072 char template[] = "/tmp/nspawn-volatile-XXXXXX";
1073 _cleanup_free_
char *buf
= NULL
, *bindir
= NULL
;
1074 const char *f
, *t
, *options
;
1080 /* --volatile=yes means we mount a tmpfs to the root dir, and the original /usr to use inside it, and
1081 * that read-only. Before we start setting this up let's validate if the image has the /usr merge
1082 * implemented, and let's output a friendly log message if it hasn't. */
1084 bindir
= path_join(directory
, "/bin");
1087 if (lstat(bindir
, &st
) < 0) {
1088 if (errno
!= ENOENT
)
1089 return log_error_errno(errno
, "Failed to stat /bin directory below image: %m");
1091 /* ENOENT is fine, just means the image is probably just a naked /usr and we can create the
1093 } else if (S_ISDIR(st
.st_mode
))
1094 return log_error_errno(SYNTHETIC_ERRNO(EISDIR
),
1095 "Sorry, --volatile=yes mode is not supported with OS images that have not merged /bin/, /sbin/, /lib/, /lib64/ into /usr/. "
1096 "Please work with your distribution and help them adopt the merged /usr scheme.");
1097 else if (!S_ISLNK(st
.st_mode
))
1098 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
1099 "Error starting image: if --volatile=yes is used /bin must be a symlink (for merged /usr support) or non-existent (in which case a symlink is created automatically).");
1101 if (!mkdtemp(template))
1102 return log_error_errno(errno
, "Failed to create temporary directory: %m");
1104 options
= "mode=0755" TMPFS_LIMITS_ROOTFS
;
1105 r
= tmpfs_patch_options(options
, uid_shift
== 0 ? UID_INVALID
: uid_shift
, selinux_apifs_context
, &buf
);
1111 r
= mount_nofollow_verbose(LOG_ERR
, "tmpfs", template, "tmpfs", MS_STRICTATIME
, options
);
1115 tmpfs_mounted
= true;
1117 f
= prefix_roota(directory
, "/usr");
1118 t
= prefix_roota(template, "/usr");
1121 if (r
< 0 && errno
!= EEXIST
) {
1122 r
= log_error_errno(errno
, "Failed to create %s: %m", t
);
1126 r
= mount_nofollow_verbose(LOG_ERR
, f
, t
, NULL
, MS_BIND
|MS_REC
, NULL
);
1130 bind_mounted
= true;
1132 r
= bind_remount_recursive(t
, MS_RDONLY
, MS_RDONLY
, NULL
);
1134 log_error_errno(r
, "Failed to remount %s read-only: %m", t
);
1138 r
= mount_nofollow_verbose(LOG_ERR
, template, directory
, NULL
, MS_MOVE
, NULL
);
1142 (void) rmdir(template);
1148 (void) umount_verbose(LOG_ERR
, t
, UMOUNT_NOFOLLOW
);
1151 (void) umount_verbose(LOG_ERR
, template, UMOUNT_NOFOLLOW
);
1153 (void) rmdir(template);
1157 static int setup_volatile_overlay(const char *directory
, uid_t uid_shift
, const char *selinux_apifs_context
) {
1158 _cleanup_free_
char *buf
= NULL
, *escaped_directory
= NULL
, *escaped_upper
= NULL
, *escaped_work
= NULL
;
1159 char template[] = "/tmp/nspawn-volatile-XXXXXX";
1160 const char *upper
, *work
, *options
;
1161 bool tmpfs_mounted
= false;
1166 /* --volatile=overlay means we mount an overlayfs to the root dir. */
1168 if (!mkdtemp(template))
1169 return log_error_errno(errno
, "Failed to create temporary directory: %m");
1171 options
= "mode=0755" TMPFS_LIMITS_ROOTFS
;
1172 r
= tmpfs_patch_options(options
, uid_shift
== 0 ? UID_INVALID
: uid_shift
, selinux_apifs_context
, &buf
);
1178 r
= mount_nofollow_verbose(LOG_ERR
, "tmpfs", template, "tmpfs", MS_STRICTATIME
, options
);
1182 tmpfs_mounted
= true;
1184 upper
= strjoina(template, "/upper");
1185 work
= strjoina(template, "/work");
1187 if (mkdir(upper
, 0755) < 0) {
1188 r
= log_error_errno(errno
, "Failed to create %s: %m", upper
);
1191 if (mkdir(work
, 0755) < 0) {
1192 r
= log_error_errno(errno
, "Failed to create %s: %m", work
);
1196 /* And now, let's overmount the root dir with an overlayfs that uses the root dir as lower dir. It's kinda nice
1197 * that the kernel allows us to do that without going through some mount point rearrangements. */
1199 escaped_directory
= shell_escape(directory
, ",:");
1200 escaped_upper
= shell_escape(upper
, ",:");
1201 escaped_work
= shell_escape(work
, ",:");
1202 if (!escaped_directory
|| !escaped_upper
|| !escaped_work
) {
1207 options
= strjoina("lowerdir=", escaped_directory
, ",upperdir=", escaped_upper
, ",workdir=", escaped_work
);
1208 r
= mount_nofollow_verbose(LOG_ERR
, "overlay", directory
, "overlay", 0, options
);
1212 (void) umount_verbose(LOG_ERR
, template, UMOUNT_NOFOLLOW
);
1214 (void) rmdir(template);
1218 int setup_volatile_mode(
1219 const char *directory
,
1222 const char *selinux_apifs_context
) {
1227 return setup_volatile_yes(directory
, uid_shift
, selinux_apifs_context
);
1229 case VOLATILE_STATE
:
1230 return setup_volatile_state(directory
, uid_shift
, selinux_apifs_context
);
1232 case VOLATILE_OVERLAY
:
1233 return setup_volatile_overlay(directory
, uid_shift
, selinux_apifs_context
);
1240 /* Expects *pivot_root_new and *pivot_root_old to be initialised to allocated memory or NULL. */
1241 int pivot_root_parse(char **pivot_root_new
, char **pivot_root_old
, const char *s
) {
1242 _cleanup_free_
char *root_new
= NULL
, *root_old
= NULL
;
1246 assert(pivot_root_new
);
1247 assert(pivot_root_old
);
1249 r
= extract_first_word(&p
, &root_new
, ":", EXTRACT_DONT_COALESCE_SEPARATORS
);
1258 root_old
= strdup(p
);
1263 if (!path_is_absolute(root_new
))
1265 if (root_old
&& !path_is_absolute(root_old
))
1268 free_and_replace(*pivot_root_new
, root_new
);
1269 free_and_replace(*pivot_root_old
, root_old
);
1274 int setup_pivot_root(const char *directory
, const char *pivot_root_new
, const char *pivot_root_old
) {
1275 _cleanup_free_
char *directory_pivot_root_new
= NULL
;
1276 _cleanup_free_
char *pivot_tmp_pivot_root_old
= NULL
;
1277 char pivot_tmp
[] = "/tmp/nspawn-pivot-XXXXXX";
1278 bool remove_pivot_tmp
= false;
1283 if (!pivot_root_new
)
1286 /* Pivot pivot_root_new to / and the existing / to pivot_root_old.
1287 * If pivot_root_old is NULL, the existing / disappears.
1288 * This requires a temporary directory, pivot_tmp, which is
1289 * not a child of either.
1291 * This is typically used for OSTree-style containers, where the root partition contains several
1292 * sysroots which could be run. Normally, one would be chosen by the bootloader and pivoted to / by
1295 * For example, for an OSTree deployment, pivot_root_new
1296 * would be: /ostree/deploy/$os/deploy/$checksum. Note that this
1297 * code doesn’t do the /var mount which OSTree expects: use
1298 * --bind +/sysroot/ostree/deploy/$os/var:/var for that.
1300 * So in the OSTree case, we’ll end up with something like:
1301 * - directory = /tmp/nspawn-root-123456
1302 * - pivot_root_new = /ostree/deploy/os/deploy/123abc
1303 * - pivot_root_old = /sysroot
1304 * - directory_pivot_root_new =
1305 * /tmp/nspawn-root-123456/ostree/deploy/os/deploy/123abc
1306 * - pivot_tmp = /tmp/nspawn-pivot-123456
1307 * - pivot_tmp_pivot_root_old = /tmp/nspawn-pivot-123456/sysroot
1309 * Requires all file systems at directory and below to be mounted
1310 * MS_PRIVATE or MS_SLAVE so they can be moved.
1312 directory_pivot_root_new
= path_join(directory
, pivot_root_new
);
1313 if (!directory_pivot_root_new
)
1316 /* Remount directory_pivot_root_new to make it movable. */
1317 r
= mount_nofollow_verbose(LOG_ERR
, directory_pivot_root_new
, directory_pivot_root_new
, NULL
, MS_BIND
, NULL
);
1321 if (pivot_root_old
) {
1322 if (!mkdtemp(pivot_tmp
)) {
1323 r
= log_error_errno(errno
, "Failed to create temporary directory: %m");
1327 remove_pivot_tmp
= true;
1328 pivot_tmp_pivot_root_old
= path_join(pivot_tmp
, pivot_root_old
);
1329 if (!pivot_tmp_pivot_root_old
) {
1334 r
= mount_nofollow_verbose(LOG_ERR
, directory_pivot_root_new
, pivot_tmp
, NULL
, MS_MOVE
, NULL
);
1338 r
= mount_nofollow_verbose(LOG_ERR
, directory
, pivot_tmp_pivot_root_old
, NULL
, MS_MOVE
, NULL
);
1342 r
= mount_nofollow_verbose(LOG_ERR
, pivot_tmp
, directory
, NULL
, MS_MOVE
, NULL
);
1346 r
= mount_nofollow_verbose(LOG_ERR
, directory_pivot_root_new
, directory
, NULL
, MS_MOVE
, NULL
);
1352 if (remove_pivot_tmp
)
1353 (void) rmdir(pivot_tmp
);
1358 #define NSPAWN_PRIVATE_FULLY_VISIBLE_PROCFS "/run/host/proc"
1359 #define NSPAWN_PRIVATE_FULLY_VISIBLE_SYSFS "/run/host/sys"
1361 int pin_fully_visible_fs(void) {
1364 (void) mkdir_p(NSPAWN_PRIVATE_FULLY_VISIBLE_PROCFS
, 0755);
1365 (void) mkdir_p(NSPAWN_PRIVATE_FULLY_VISIBLE_SYSFS
, 0755);
1367 r
= mount_follow_verbose(LOG_ERR
, "proc", NSPAWN_PRIVATE_FULLY_VISIBLE_PROCFS
, "proc", PROC_DEFAULT_MOUNT_FLAGS
, NULL
);
1371 r
= mount_follow_verbose(LOG_ERR
, "sysfs", NSPAWN_PRIVATE_FULLY_VISIBLE_SYSFS
, "sysfs", SYS_DEFAULT_MOUNT_FLAGS
, NULL
);
1378 static int do_wipe_fully_visible_fs(void) {
1379 if (umount2(NSPAWN_PRIVATE_FULLY_VISIBLE_PROCFS
, MNT_DETACH
) < 0)
1380 return log_error_errno(errno
, "Failed to unmount temporary proc: %m");
1382 if (rmdir(NSPAWN_PRIVATE_FULLY_VISIBLE_PROCFS
) < 0)
1383 return log_error_errno(errno
, "Failed to remove temporary proc mountpoint: %m");
1385 if (umount2(NSPAWN_PRIVATE_FULLY_VISIBLE_SYSFS
, MNT_DETACH
) < 0)
1386 return log_error_errno(errno
, "Failed to unmount temporary sys: %m");
1388 if (rmdir(NSPAWN_PRIVATE_FULLY_VISIBLE_SYSFS
) < 0)
1389 return log_error_errno(errno
, "Failed to remove temporary sys mountpoint: %m");
1394 int wipe_fully_visible_fs(int mntns_fd
) {
1395 _cleanup_close_
int orig_mntns_fd
= -EBADF
;
1398 r
= namespace_open(0,
1399 /* ret_pidns_fd = */ NULL
,
1401 /* ret_netns_fd = */ NULL
,
1402 /* ret_userns_fd = */ NULL
,
1403 /* ret_root_fd = */ NULL
);
1405 return log_error_errno(r
, "Failed to pin originating mount namespace: %m");
1407 r
= namespace_enter(/* pidns_fd = */ -EBADF
,
1409 /* netns_fd = */ -EBADF
,
1410 /* userns_fd = */ -EBADF
,
1411 /* root_fd = */ -EBADF
);
1413 return log_error_errno(r
, "Failed to enter mount namespace: %m");
1415 rr
= do_wipe_fully_visible_fs();
1417 r
= namespace_enter(/* pidns_fd = */ -EBADF
,
1419 /* netns_fd = */ -EBADF
,
1420 /* userns_fd = */ -EBADF
,
1421 /* root_fd = */ -EBADF
);
1423 return log_error_errno(r
, "Failed to enter original mount namespace: %m");