1 /* SPDX-License-Identifier: LGPL-2.1+ */
10 #include "cpu-set-util.h"
12 #include "format-util.h"
14 #include "hostname-util.h"
16 #include "missing_sched.h"
17 #include "nspawn-oci.h"
18 #include "path-util.h"
19 #include "rlimit-util.h"
21 #include "seccomp-util.h"
23 #include "stat-util.h"
24 #include "stdio-util.h"
25 #include "string-util.h"
27 #include "user-util.h"
30 * OCI runtime tool implementation
35 * How is RLIM_INFINITY supposed to be encoded?
36 * configured effective caps is bullshit, as execv() corrupts it anyway
37 * pipes bind mounted is *very* different from pipes newly created, comments regarding bind mount or not are bogus
38 * annotation values structured? or string?
39 * configurable file system namespace path, but then also root path? wtf?
40 * apply sysctl inside of the container? or outside?
41 * how is unlimited pids tasks limit to be encoded?
42 * what are the defaults for caps if not specified?
43 * what are the default uid/gid mappings if one is missing but the other set, or when user ns is on but no namespace configured
44 * the source field of "mounts" is really weird, as it cannot realistically be relative to the bundle, since we never know if that's what the fs wants
45 * spec contradicts itself on the mount "type" field, as the example uses "bind" as type, but it's not listed in /proc/filesystem, and is something made up by /bin/mount
46 * if type of mount is left out, what shall be assumed? "bind"?
47 * readonly mounts is entirely redundant?
48 * should escaping be applied when joining mount options with ","?
49 * devices cgroup support is bogus, "allow" and "deny" on the kernel level is about adding/removing entries, not about access
50 * spec needs to say that "rwm" devices cgroup combination can't be the empty string
51 * cgrouspv1 crap: kernel, kernelTCP, swapiness, disableOOMKiller, swap, devices, leafWeight
52 * general: it shouldn't leak lower level abstractions this obviously
53 * unmanagable cgroups stuff: realtimeRuntime/realtimePeriod
54 * needs to say what happense when some option is not specified, i.e. which defaults apply
55 * no architecture? no personality?
56 * seccomp example and logic is simply broken: there's no constant "SCMP_ACT_ERRNO".
57 * spec should say what to do with unknown props
58 * /bin/mount regarding NFS and FUSE required?
59 * what does terminal=false mean?
60 * sysctl inside or outside? whitelisting?
61 * swapiness typo -> swappiness
66 * selinuxLabel + mountLabel
71 * swappiness, disableOOMKiller, kernel, kernelTCP, leafWeight (because it's dead, cgroupsv2 can't do it and hence systemd neither)
73 * Non-slice cgroup paths
74 * Propagation that is not slave + shared
75 * more than one uid/gid mapping, mappings with a container base != 0, or non-matching uid/gid mappings
76 * device cgroups access = false items that are not catchall
77 * device cgroups matches where minor is specified, but major isn't. similar where major is specified but char/block is not. also, any match that only has a type set that has less than "rwm" set. also, any entry that has none of rwm set.
81 static int oci_unexpected(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
82 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
83 "Unexpected OCI element '%s' of type '%s'.", name
, json_variant_type_to_string(json_variant_type(v
)));
86 static int oci_unsupported(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
87 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
88 "Unsupported OCI element '%s' of type '%s'.", name
, json_variant_type_to_string(json_variant_type(v
)));
91 static int oci_terminal(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
92 Settings
*s
= userdata
;
94 /* If not specified, or set to true, we'll default to either an interactive or a read-only
95 * console. If specified as false, we'll forcibly move to "pipe" mode though. */
96 s
->console_mode
= json_variant_boolean(v
) ? _CONSOLE_MODE_INVALID
: CONSOLE_PIPE
;
100 static int oci_console_dimension(const char *name
, JsonVariant
*variant
, JsonDispatchFlags flags
, void *userdata
) {
101 unsigned *u
= userdata
;
106 k
= json_variant_unsigned(variant
);
108 return json_log(variant
, flags
, SYNTHETIC_ERRNO(ERANGE
),
109 "Console size field '%s' is too small.", strna(name
));
110 if (k
> USHRT_MAX
) /* TIOCSWINSZ's struct winsize uses "unsigned short" for width and height */
111 return json_log(variant
, flags
, SYNTHETIC_ERRNO(ERANGE
),
112 "Console size field '%s' is too large.", strna(name
));
118 static int oci_console_size(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
120 static const JsonDispatch table
[] = {
121 { "height", JSON_VARIANT_UNSIGNED
, oci_console_dimension
, offsetof(Settings
, console_height
), JSON_MANDATORY
},
122 { "width", JSON_VARIANT_UNSIGNED
, oci_console_dimension
, offsetof(Settings
, console_width
), JSON_MANDATORY
},
126 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
129 static int oci_absolute_path(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
135 n
= json_variant_string(v
);
137 if (!path_is_absolute(n
))
138 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
139 "Path in JSON field '%s' is not absolute: %s", strna(name
), n
);
141 return free_and_strdup_warn(p
, n
);
144 static int oci_env(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
145 char ***l
= userdata
;
151 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
154 if (!json_variant_is_string(e
))
155 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
156 "Environment array contains non-string.");
158 assert_se(n
= json_variant_string(e
));
160 if (!env_assignment_is_valid(n
))
161 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
162 "Environment assignment not valid: %s", n
);
164 r
= strv_extend(l
, n
);
172 static int oci_args(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
173 _cleanup_strv_free_
char **l
= NULL
;
174 char ***value
= userdata
;
179 r
= json_variant_strv(v
, &l
);
181 return json_log(v
, flags
, r
, "Cannot parse arguments as list of strings: %m");
184 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
185 "Argument list empty, refusing.");
188 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
189 "Executable name is empty, refusing.");
191 return strv_free_and_replace(*value
, l
);
194 static int oci_rlimit_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
196 int t
, *type
= userdata
;
200 z
= startswith(json_variant_string(v
), "RLIMIT_");
202 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
203 "rlimit entry's name does not begin with 'RLIMIT_', refusing: %s",
204 json_variant_string(v
));
206 t
= rlimit_from_string(z
);
208 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
209 "rlimit name unknown: %s", json_variant_string(v
));
215 static int oci_rlimit_value(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
216 rlim_t z
, *value
= userdata
;
220 if (json_variant_is_negative(v
))
223 if (!json_variant_is_unsigned(v
))
224 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
225 "rlimits limit not unsigned, refusing.");
227 z
= (rlim_t
) json_variant_unsigned(v
);
229 if ((uintmax_t) z
!= json_variant_unsigned(v
))
230 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
231 "rlimits limit out of range, refusing.");
238 static int oci_rlimits(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
240 Settings
*s
= userdata
;
246 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
254 .soft
= RLIM_INFINITY
,
255 .hard
= RLIM_INFINITY
,
258 static const JsonDispatch table
[] = {
259 { "soft", JSON_VARIANT_NUMBER
, oci_rlimit_value
, offsetof(struct rlimit_data
, soft
), JSON_MANDATORY
},
260 { "hard", JSON_VARIANT_NUMBER
, oci_rlimit_value
, offsetof(struct rlimit_data
, hard
), JSON_MANDATORY
},
261 { "type", JSON_VARIANT_STRING
, oci_rlimit_type
, offsetof(struct rlimit_data
, type
), JSON_MANDATORY
},
265 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
269 assert(data
.type
>= 0);
270 assert(data
.type
< _RLIMIT_MAX
);
272 if (s
->rlimit
[data
.type
])
273 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
274 "rlimits array contains duplicate entry, refusing.");
276 s
->rlimit
[data
.type
] = new(struct rlimit
, 1);
277 if (!s
->rlimit
[data
.type
])
280 *s
->rlimit
[data
.type
] = (struct rlimit
) {
281 .rlim_cur
= data
.soft
,
282 .rlim_max
= data
.hard
,
289 static int oci_capability_array(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
290 uint64_t *mask
= userdata
, m
= 0;
293 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
297 if (!json_variant_is_string(e
))
298 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
299 "Entry in capabilities array is not a string.");
301 assert_se(n
= json_variant_string(e
));
303 cap
= capability_from_name(n
);
305 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
306 "Unknown capability: %s", n
);
308 m
|= UINT64_C(1) << cap
;
311 if (*mask
== (uint64_t) -1)
319 static int oci_capabilities(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
321 static const JsonDispatch table
[] = {
322 { "effective", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, effective
) },
323 { "bounding", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, bounding
) },
324 { "inheritable", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, inheritable
) },
325 { "permitted", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, permitted
) },
326 { "ambient", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, ambient
) },
330 Settings
*s
= userdata
;
335 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &s
->full_capabilities
);
339 if (s
->full_capabilities
.bounding
!= (uint64_t) -1) {
340 s
->capability
= s
->full_capabilities
.bounding
;
341 s
->drop_capability
= ~s
->full_capabilities
.bounding
;
347 static int oci_oom_score_adj(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
348 Settings
*s
= userdata
;
353 k
= json_variant_integer(v
);
354 if (k
< OOM_SCORE_ADJ_MIN
|| k
> OOM_SCORE_ADJ_MAX
)
355 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
356 "oomScoreAdj value out of range: %ji", k
);
358 s
->oom_score_adjust
= (int) k
;
359 s
->oom_score_adjust_set
= true;
364 static int oci_uid_gid(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
365 uid_t
*uid
= userdata
, u
;
369 assert_cc(sizeof(uid_t
) == sizeof(gid_t
));
371 k
= json_variant_unsigned(v
);
373 if ((uintmax_t) u
!= k
)
374 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
375 "UID/GID out of range: %ji", k
);
377 if (!uid_is_valid(u
))
378 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
379 "UID/GID is not valid: " UID_FMT
, u
);
385 static int oci_supplementary_gids(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
386 Settings
*s
= userdata
;
392 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
395 if (!json_variant_is_unsigned(e
))
396 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
397 "Supplementary GID entry is not a UID.");
399 r
= oci_uid_gid(name
, e
, flags
, &gid
);
403 a
= reallocarray(s
->supplementary_gids
, s
->n_supplementary_gids
+ 1, sizeof(gid_t
));
407 s
->supplementary_gids
= a
;
408 s
->supplementary_gids
[s
->n_supplementary_gids
++] = gid
;
414 static int oci_user(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
415 static const JsonDispatch table
[] = {
416 { "uid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(Settings
, uid
), JSON_MANDATORY
},
417 { "gid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(Settings
, gid
), JSON_MANDATORY
},
418 { "additionalGids", JSON_VARIANT_ARRAY
, oci_supplementary_gids
, 0, 0 },
422 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
425 static int oci_process(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
427 static const JsonDispatch table
[] = {
428 { "terminal", JSON_VARIANT_BOOLEAN
, oci_terminal
, 0, 0 },
429 { "consoleSize", JSON_VARIANT_OBJECT
, oci_console_size
, 0, 0 },
430 { "cwd", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(Settings
, working_directory
), 0 },
431 { "env", JSON_VARIANT_ARRAY
, oci_env
, offsetof(Settings
, environment
), 0 },
432 { "args", JSON_VARIANT_ARRAY
, oci_args
, offsetof(Settings
, parameters
), 0 },
433 { "rlimits", JSON_VARIANT_ARRAY
, oci_rlimits
, 0, 0 },
434 { "apparmorProfile", JSON_VARIANT_STRING
, oci_unsupported
, 0, JSON_PERMISSIVE
},
435 { "capabilities", JSON_VARIANT_OBJECT
, oci_capabilities
, 0, 0 },
436 { "noNewPrivileges", JSON_VARIANT_BOOLEAN
, json_dispatch_boolean
, offsetof(Settings
, no_new_privileges
), 0 },
437 { "oomScoreAdj", JSON_VARIANT_INTEGER
, oci_oom_score_adj
, 0, 0 },
438 { "selinuxLabel", JSON_VARIANT_STRING
, oci_unsupported
, 0, JSON_PERMISSIVE
},
439 { "user", JSON_VARIANT_OBJECT
, oci_user
, 0, 0 },
443 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
446 static int oci_root(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
448 static const JsonDispatch table
[] = {
449 { "path", JSON_VARIANT_STRING
, json_dispatch_string
, offsetof(Settings
, root
) },
450 { "readonly", JSON_VARIANT_BOOLEAN
, json_dispatch_boolean
, offsetof(Settings
, read_only
) },
454 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
457 static int oci_hostname(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
458 Settings
*s
= userdata
;
463 assert_se(n
= json_variant_string(v
));
465 if (!hostname_is_valid(n
, false))
466 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
467 "Hostname string is not a valid hostname: %s", n
);
469 return free_and_strdup_warn(&s
->hostname
, n
);
472 static bool oci_exclude_mount(const char *path
) {
474 /* Returns "true" for all mounts we insist to mount on our own, and hence ignore the OCI data. */
476 if (PATH_IN_SET(path
,
494 "/proc/sysrq-trigger",
503 /* Similar, skip the whole /sys/fs/cgroups subtree */
504 if (path_startswith(path
, "/sys/fs/cgroup"))
510 typedef struct oci_mount_data
{
517 static void cleanup_oci_mount_data(oci_mount_data
*data
) {
518 free(data
->destination
);
520 strv_free(data
->options
);
524 static int oci_mounts(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
525 Settings
*s
= userdata
;
531 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
532 static const JsonDispatch table
[] = {
533 { "destination", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(oci_mount_data
, destination
), JSON_MANDATORY
},
534 { "source", JSON_VARIANT_STRING
, json_dispatch_string
, offsetof(oci_mount_data
, source
), 0 },
535 { "options", JSON_VARIANT_ARRAY
, json_dispatch_strv
, offsetof(oci_mount_data
, options
), 0, },
536 { "type", JSON_VARIANT_STRING
, json_dispatch_string
, offsetof(oci_mount_data
, type
), 0 },
540 _cleanup_free_
char *joined_options
= NULL
;
542 _cleanup_(cleanup_oci_mount_data
) oci_mount_data data
= {};
544 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
548 if (!path_is_absolute(data
.destination
))
549 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
550 "Mount destination not an absolute path: %s", data
.destination
);
552 if (oci_exclude_mount(data
.destination
))
556 joined_options
= strv_join(data
.options
, ",");
561 if (!data
.type
|| streq(data
.type
, "bind")) {
562 if (data
.source
&& !path_is_absolute(data
.source
)) {
565 joined
= path_join(s
->bundle
, data
.source
);
569 free_and_replace(data
.source
, joined
);
572 data
.type
= mfree(data
.type
);
574 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_BIND
);
576 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_ARBITRARY
);
580 m
->destination
= TAKE_PTR(data
.destination
);
581 m
->source
= TAKE_PTR(data
.source
);
582 m
->options
= TAKE_PTR(joined_options
);
583 m
->type_argument
= TAKE_PTR(data
.type
);
589 static int oci_namespace_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
590 unsigned long *nsflags
= userdata
;
594 assert_se(n
= json_variant_string(v
));
596 /* We don't use namespace_flags_from_string() here, as the OCI spec uses slightly different names than the
599 *nsflags
= CLONE_NEWPID
;
600 else if (streq(n
, "network"))
601 *nsflags
= CLONE_NEWNET
;
602 else if (streq(n
, "mount"))
603 *nsflags
= CLONE_NEWNS
;
604 else if (streq(n
, "ipc"))
605 *nsflags
= CLONE_NEWIPC
;
606 else if (streq(n
, "uts"))
607 *nsflags
= CLONE_NEWUTS
;
608 else if (streq(n
, "user"))
609 *nsflags
= CLONE_NEWUSER
;
610 else if (streq(n
, "cgroup"))
611 *nsflags
= CLONE_NEWCGROUP
;
613 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
614 "Unknown cgroup type, refusing: %s", n
);
619 static int oci_namespaces(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
620 Settings
*s
= userdata
;
627 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
629 struct namespace_data
{
634 static const JsonDispatch table
[] = {
635 { "type", JSON_VARIANT_STRING
, oci_namespace_type
, offsetof(struct namespace_data
, type
), JSON_MANDATORY
},
636 { "path", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(struct namespace_data
, path
), 0 },
640 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
647 if (data
.type
!= CLONE_NEWNET
) {
649 return json_log(e
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
650 "Specifying namespace path for non-network namespace is not supported.");
653 if (s
->network_namespace_path
) {
655 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
656 "Network namespace path specified more than once, refusing.");
659 free(s
->network_namespace_path
);
660 s
->network_namespace_path
= data
.path
;
663 if (FLAGS_SET(n
, data
.type
)) {
664 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
665 "Duplicate namespace specification, refusing.");
671 if (!FLAGS_SET(n
, CLONE_NEWNS
))
672 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
673 "Containers without file system namespace aren't supported.");
675 s
->private_network
= FLAGS_SET(n
, CLONE_NEWNET
);
676 s
->userns_mode
= FLAGS_SET(n
, CLONE_NEWUSER
) ? USER_NAMESPACE_FIXED
: USER_NAMESPACE_NO
;
677 s
->use_cgns
= FLAGS_SET(n
, CLONE_NEWCGROUP
);
679 s
->clone_ns_flags
= n
& (CLONE_NEWIPC
|CLONE_NEWPID
|CLONE_NEWUTS
);
684 static int oci_uid_gid_range(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
685 uid_t
*uid
= userdata
, u
;
689 assert_cc(sizeof(uid_t
) == sizeof(gid_t
));
691 /* This is very much like oci_uid_gid(), except the checks are a bit different, as this is a UID range rather
692 * than a specific UID, and hence (uid_t) -1 has no special significance. OTOH a range of zero makes no
695 k
= json_variant_unsigned(v
);
697 if ((uintmax_t) u
!= k
)
698 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
699 "UID/GID out of range: %ji", k
);
701 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
702 "UID/GID range can't be zero.");
708 static int oci_uid_gid_mappings(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
709 struct mapping_data
{
714 .host_id
= UID_INVALID
,
715 .container_id
= UID_INVALID
,
719 static const JsonDispatch table
[] = {
720 { "containerID", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(struct mapping_data
, container_id
), JSON_MANDATORY
},
721 { "hostID", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(struct mapping_data
, host_id
), JSON_MANDATORY
},
722 { "size", JSON_VARIANT_UNSIGNED
, oci_uid_gid_range
, offsetof(struct mapping_data
, range
), JSON_MANDATORY
},
726 Settings
*s
= userdata
;
732 if (json_variant_elements(v
) == 0)
735 if (json_variant_elements(v
) > 1)
736 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
737 "UID/GID mappings with more than one entry are not supported.");
739 assert_se(e
= json_variant_by_index(v
, 0));
741 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
745 if (data
.host_id
+ data
.range
< data
.host_id
||
746 data
.container_id
+ data
.range
< data
.container_id
)
747 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
748 "UID/GID range goes beyond UID/GID validity range, refusing.");
750 if (data
.container_id
!= 0)
751 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
752 "UID/GID mappings with a non-zero container base are not supported.");
754 if (data
.range
< 0x10000)
755 json_log(v
, flags
|JSON_WARNING
, 0,
756 "UID/GID mapping with less than 65536 UID/GIDS set up, you are looking for trouble.");
758 if (s
->uid_range
!= UID_INVALID
&&
759 (s
->uid_shift
!= data
.host_id
|| s
->uid_range
!= data
.range
))
760 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
761 "Non-matching UID and GID mappings are not supported.");
763 s
->uid_shift
= data
.host_id
;
764 s
->uid_range
= data
.range
;
769 static int oci_device_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
770 mode_t
*mode
= userdata
;
774 assert_se(t
= json_variant_string(v
));
776 if (STR_IN_SET(t
, "c", "u"))
777 *mode
= (*mode
& ~S_IFMT
) | S_IFCHR
;
778 else if (streq(t
, "b"))
779 *mode
= (*mode
& ~S_IFMT
) | S_IFBLK
;
780 else if (streq(t
, "p"))
781 *mode
= (*mode
& ~S_IFMT
) | S_IFIFO
;
783 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
784 "Unknown device type: %s", t
);
789 static int oci_device_major(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
790 unsigned *u
= userdata
;
795 k
= json_variant_unsigned(v
);
796 if (!DEVICE_MAJOR_VALID(k
))
797 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
798 "Device major %ji out of range.", k
);
804 static int oci_device_minor(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
805 unsigned *u
= userdata
;
810 k
= json_variant_unsigned(v
);
811 if (!DEVICE_MINOR_VALID(k
))
812 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
813 "Device minor %ji out of range.", k
);
819 static int oci_device_file_mode(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
820 mode_t
*mode
= userdata
, m
;
825 k
= json_variant_unsigned(v
);
828 if ((m
& ~07777) != 0 || (uintmax_t) m
!= k
)
829 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
830 "fileMode out of range, refusing.");
836 static int oci_devices(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
837 Settings
*s
= userdata
;
843 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
845 static const JsonDispatch table
[] = {
846 { "type", JSON_VARIANT_STRING
, oci_device_type
, offsetof(DeviceNode
, mode
), JSON_MANDATORY
},
847 { "path", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(DeviceNode
, path
), JSON_MANDATORY
},
848 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(DeviceNode
, major
), 0 },
849 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(DeviceNode
, minor
), 0 },
850 { "fileMode", JSON_VARIANT_UNSIGNED
, oci_device_file_mode
, offsetof(DeviceNode
, mode
), 0 },
851 { "uid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(DeviceNode
, uid
), 0 },
852 { "gid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(DeviceNode
, gid
), 0 },
856 DeviceNode
*node
, *nodes
;
858 nodes
= reallocarray(s
->extra_nodes
, s
->n_extra_nodes
+ 1, sizeof(DeviceNode
));
862 s
->extra_nodes
= nodes
;
864 node
= nodes
+ s
->n_extra_nodes
;
865 *node
= (DeviceNode
) {
868 .major
= (unsigned) -1,
869 .minor
= (unsigned) -1,
873 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, node
);
877 if (S_ISCHR(node
->mode
) || S_ISBLK(node
->mode
)) {
878 _cleanup_free_
char *path
= NULL
;
880 if (node
->major
== (unsigned) -1 || node
->minor
== (unsigned) -1) {
881 r
= json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
882 "Major/minor required when device node is device node");
886 /* Suppress a couple of implicit device nodes */
887 r
= device_path_make_canonical(node
->mode
, makedev(node
->major
, node
->minor
), &path
);
889 json_log(e
, flags
|JSON_DEBUG
, 0, "Failed to resolve device node %u:%u, ignoring: %m", node
->major
, node
->minor
);
891 if (PATH_IN_SET(path
,
903 json_log(e
, flags
|JSON_DEBUG
, 0, "Ignoring devices item for device '%s', as it is implicitly created anyway.", path
);
921 static int oci_cgroups_path(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
922 _cleanup_free_
char *slice
= NULL
, *backwards
= NULL
;
923 Settings
*s
= userdata
;
929 assert_se(p
= json_variant_string(v
));
931 r
= cg_path_get_slice(p
, &slice
);
933 return json_log(v
, flags
, r
, "Couldn't derive slice unit name from path '%s': %m", p
);
935 r
= cg_slice_to_path(slice
, &backwards
);
937 return json_log(v
, flags
, r
, "Couldn't convert slice unit name '%s' back to path: %m", slice
);
939 if (!path_equal(backwards
, p
))
940 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
941 "Control group path '%s' does not refer to slice unit, refusing.", p
);
943 free_and_replace(s
->slice
, slice
);
947 static int oci_cgroup_device_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
948 mode_t
*mode
= userdata
;
951 assert_se(n
= json_variant_string(v
));
955 else if (streq(n
, "b"))
958 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
959 "Control group device type unknown: %s", n
);
974 static int oci_cgroup_device_access(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
975 struct device_data
*d
= userdata
;
976 bool r
= false, w
= false, m
= false;
980 assert_se(s
= json_variant_string(v
));
982 for (i
= 0; s
[i
]; i
++)
985 else if (s
[i
] == 'w')
987 else if (s
[i
] == 'm')
990 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
991 "Unknown device access character '%c'.", s
[i
]);
1000 static int oci_cgroup_devices(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1002 _cleanup_free_
struct device_data
*list
= NULL
;
1003 Settings
*s
= userdata
;
1004 size_t n_list
= 0, i
;
1011 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1013 struct device_data data
= {
1014 .major
= (unsigned) -1,
1015 .minor
= (unsigned) -1,
1018 static const JsonDispatch table
[] = {
1019 { "allow", JSON_VARIANT_BOOLEAN
, json_dispatch_boolean
, offsetof(struct device_data
, allow
), JSON_MANDATORY
},
1020 { "type", JSON_VARIANT_STRING
, oci_cgroup_device_type
, offsetof(struct device_data
, type
), 0 },
1021 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(struct device_data
, major
), 0 },
1022 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(struct device_data
, minor
), 0 },
1023 { "access", JSON_VARIANT_STRING
, oci_cgroup_device_access
, 0, 0 },
1027 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
1032 /* The fact that OCI allows 'deny' entries makes really no sense, as 'allow' vs. 'deny' for the
1033 * devices cgroup controller is really not about whitelisting and blacklisting but about adding
1034 * and removing entries from the whitelist. Since we always start out with an empty whitelist
1035 * we hence ignore the whole thing, as removing entries which don't exist make no sense. We'll
1036 * log about this, since this is really borked in the spec, with one exception: the entry
1037 * that's supposed to drop the kernel's default we ignore silently */
1039 if (!data
.r
|| !data
.w
|| !data
.m
|| data
.type
!= 0 || data
.major
!= (unsigned) -1 || data
.minor
!= (unsigned) -1)
1040 json_log(v
, flags
|JSON_WARNING
, 0, "Devices cgroup whitelist with arbitrary 'allow' entries not supported, ignoring.");
1042 /* We ignore the 'deny' entry as for us that's implied */
1046 if (!data
.r
&& !data
.w
&& !data
.m
) {
1047 json_log(v
, flags
|LOG_WARNING
, 0, "Device cgroup whitelist entry with no effect found, ignoring.");
1051 if (data
.minor
!= (unsigned) -1 && data
.major
== (unsigned) -1)
1052 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
1053 "Device cgroup whitelist entries with minors but no majors not supported.");
1055 if (data
.major
!= (unsigned) -1 && data
.type
== 0)
1056 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
1057 "Device cgroup whitelist entries with majors but no device node type not supported.");
1059 if (data
.type
== 0) {
1060 if (data
.r
&& data
.w
&& data
.m
) /* a catchall whitelist entry means we are looking at a noop */
1063 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
1064 "Device cgroup whitelist entries with no type not supported.");
1067 a
= reallocarray(list
, n_list
+ 1, sizeof(struct device_data
));
1072 list
[n_list
++] = data
;
1078 r
= settings_allocate_properties(s
);
1082 r
= sd_bus_message_open_container(s
->properties
, 'r', "sv");
1084 return bus_log_create_error(r
);
1086 r
= sd_bus_message_append(s
->properties
, "s", "DeviceAllow");
1088 return bus_log_create_error(r
);
1090 r
= sd_bus_message_open_container(s
->properties
, 'v', "a(ss)");
1092 return bus_log_create_error(r
);
1094 r
= sd_bus_message_open_container(s
->properties
, 'a', "(ss)");
1096 return bus_log_create_error(r
);
1098 for (i
= 0; i
< n_list
; i
++) {
1099 _cleanup_free_
char *pattern
= NULL
;
1103 if (list
[i
].minor
== (unsigned) -1) {
1106 if (list
[i
].type
== S_IFBLK
)
1109 assert(list
[i
].type
== S_IFCHR
);
1113 if (list
[i
].major
== (unsigned) -1) {
1114 pattern
= strjoin(t
, "-*");
1118 if (asprintf(&pattern
, "%s-%u", t
, list
[i
].major
) < 0)
1123 assert(list
[i
].major
!= (unsigned) -1); /* If a minor is specified, then a major also needs to be specified */
1125 r
= device_path_make_major_minor(list
[i
].type
, makedev(list
[i
].major
, list
[i
].minor
), &pattern
);
1140 r
= sd_bus_message_append(s
->properties
, "(ss)", pattern
, access
);
1142 return bus_log_create_error(r
);
1145 r
= sd_bus_message_close_container(s
->properties
);
1147 return bus_log_create_error(r
);
1149 r
= sd_bus_message_close_container(s
->properties
);
1151 return bus_log_create_error(r
);
1153 r
= sd_bus_message_close_container(s
->properties
);
1155 return bus_log_create_error(r
);
1160 static int oci_cgroup_memory_limit(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1161 uint64_t *m
= userdata
;
1166 if (json_variant_is_negative(v
)) {
1171 if (!json_variant_is_unsigned(v
))
1172 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1173 "Memory limit is not an unsigned integer");
1175 k
= json_variant_unsigned(v
);
1176 if (k
>= UINT64_MAX
)
1177 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1178 "Memory limit too large: %ji", k
);
1184 static int oci_cgroup_memory(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1186 struct memory_data
{
1188 uint64_t reservation
;
1191 .limit
= UINT64_MAX
,
1192 .reservation
= UINT64_MAX
,
1196 static const JsonDispatch table
[] = {
1197 { "limit", JSON_VARIANT_NUMBER
, oci_cgroup_memory_limit
, offsetof(struct memory_data
, limit
), 0 },
1198 { "reservation", JSON_VARIANT_NUMBER
, oci_cgroup_memory_limit
, offsetof(struct memory_data
, reservation
), 0 },
1199 { "swap", JSON_VARIANT_NUMBER
, oci_cgroup_memory_limit
, offsetof(struct memory_data
, swap
), 0 },
1200 { "kernel", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1201 { "kernelTCP", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1202 { "swapiness", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1203 { "disableOOMKiller", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1207 Settings
*s
= userdata
;
1210 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &data
);
1214 if (data
.swap
!= UINT64_MAX
) {
1215 if (data
.limit
== UINT64_MAX
)
1216 json_log(v
, flags
|LOG_WARNING
, 0, "swap limit without memory limit is not supported, ignoring.");
1217 else if (data
.swap
< data
.limit
)
1218 json_log(v
, flags
|LOG_WARNING
, 0, "swap limit is below memory limit, ignoring.");
1220 r
= settings_allocate_properties(s
);
1224 r
= sd_bus_message_append(s
->properties
, "(sv)", "MemorySwapMax", "t", data
.swap
- data
.limit
);
1226 return bus_log_create_error(r
);
1230 if (data
.limit
!= UINT64_MAX
) {
1231 r
= settings_allocate_properties(s
);
1235 r
= sd_bus_message_append(s
->properties
, "(sv)", "MemoryMax", "t", data
.limit
);
1237 return bus_log_create_error(r
);
1240 if (data
.reservation
!= UINT64_MAX
) {
1241 r
= settings_allocate_properties(s
);
1245 r
= sd_bus_message_append(s
->properties
, "(sv)", "MemoryLow", "t", data
.reservation
);
1247 return bus_log_create_error(r
);
1260 static int oci_cgroup_cpu_shares(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1261 uint64_t *u
= userdata
;
1266 k
= json_variant_unsigned(v
);
1267 if (k
< CGROUP_CPU_SHARES_MIN
|| k
> CGROUP_CPU_SHARES_MAX
)
1268 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1269 "shares value out of range.");
1275 static int oci_cgroup_cpu_quota(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1276 uint64_t *u
= userdata
;
1281 k
= json_variant_unsigned(v
);
1282 if (k
<= 0 || k
>= UINT64_MAX
)
1283 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1284 "period/quota value out of range.");
1290 static int oci_cgroup_cpu_cpus(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1291 struct cpu_data
*data
= userdata
;
1298 assert_se(n
= json_variant_string(v
));
1300 r
= parse_cpu_set(n
, &set
);
1302 return json_log(v
, flags
, r
, "Failed to parse CPU set specification: %s", n
);
1304 cpu_set_reset(&data
->cpu_set
);
1305 data
->cpu_set
= set
;
1310 static int oci_cgroup_cpu(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1312 static const JsonDispatch table
[] = {
1313 { "shares", JSON_VARIANT_UNSIGNED
, oci_cgroup_cpu_shares
, offsetof(struct cpu_data
, shares
), 0 },
1314 { "quota", JSON_VARIANT_UNSIGNED
, oci_cgroup_cpu_quota
, offsetof(struct cpu_data
, quota
), 0 },
1315 { "period", JSON_VARIANT_UNSIGNED
, oci_cgroup_cpu_quota
, offsetof(struct cpu_data
, period
), 0 },
1316 { "realtimeRuntime", JSON_VARIANT_UNSIGNED
, oci_unsupported
, 0, 0 },
1317 { "realtimePeriod", JSON_VARIANT_UNSIGNED
, oci_unsupported
, 0, 0 },
1318 { "cpus", JSON_VARIANT_STRING
, oci_cgroup_cpu_cpus
, 0, 0 },
1319 { "mems", JSON_VARIANT_STRING
, oci_unsupported
, 0, 0 },
1323 struct cpu_data data
= {
1324 .shares
= UINT64_MAX
,
1325 .quota
= UINT64_MAX
,
1326 .period
= UINT64_MAX
,
1329 Settings
*s
= userdata
;
1332 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &data
);
1334 cpu_set_reset(&data
.cpu_set
);
1338 cpu_set_reset(&s
->cpu_set
);
1339 s
->cpu_set
= data
.cpu_set
;
1341 if (data
.shares
!= UINT64_MAX
) {
1342 r
= settings_allocate_properties(s
);
1346 r
= sd_bus_message_append(s
->properties
, "(sv)", "CPUShares", "t", data
.shares
);
1348 return bus_log_create_error(r
);
1351 if (data
.quota
!= UINT64_MAX
&& data
.period
!= UINT64_MAX
) {
1352 r
= settings_allocate_properties(s
);
1356 r
= sd_bus_message_append(s
->properties
, "(sv)", "CPUQuotaPerSecUSec", "t", (uint64_t) (data
.quota
* USEC_PER_SEC
/ data
.period
));
1358 return bus_log_create_error(r
);
1360 } else if ((data
.quota
!= UINT64_MAX
) != (data
.period
!= UINT64_MAX
))
1361 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1362 "CPU quota and period not used together.");
1367 static int oci_cgroup_block_io_weight(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1368 Settings
*s
= userdata
;
1374 k
= json_variant_unsigned(v
);
1375 if (k
< CGROUP_BLKIO_WEIGHT_MIN
|| k
> CGROUP_BLKIO_WEIGHT_MAX
)
1376 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1377 "Block I/O weight out of range.");
1379 r
= settings_allocate_properties(s
);
1383 r
= sd_bus_message_append(s
->properties
, "(sv)", "BlockIOWeight", "t", (uint64_t) k
);
1385 return bus_log_create_error(r
);
1390 static int oci_cgroup_block_io_weight_device(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1391 Settings
*s
= userdata
;
1397 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1398 struct device_data
{
1403 .major
= (unsigned) -1,
1404 .minor
= (unsigned) -1,
1405 .weight
= UINTMAX_MAX
,
1408 static const JsonDispatch table
[] = {
1409 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(struct device_data
, major
), JSON_MANDATORY
},
1410 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(struct device_data
, minor
), JSON_MANDATORY
},
1411 { "weight", JSON_VARIANT_UNSIGNED
, json_dispatch_unsigned
, offsetof(struct device_data
, weight
), 0 },
1412 { "leafWeight", JSON_VARIANT_INTEGER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1416 _cleanup_free_
char *path
= NULL
;
1418 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
1422 if (data
.weight
== UINTMAX_MAX
)
1425 if (data
.weight
< CGROUP_BLKIO_WEIGHT_MIN
|| data
.weight
> CGROUP_BLKIO_WEIGHT_MAX
)
1426 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1427 "Block I/O device weight out of range.");
1429 r
= device_path_make_major_minor(S_IFBLK
, makedev(data
.major
, data
.minor
), &path
);
1431 return json_log(v
, flags
, r
, "Failed to build device path: %m");
1433 r
= settings_allocate_properties(s
);
1437 r
= sd_bus_message_append(s
->properties
, "(sv)", "BlockIODeviceWeight", "a(st)", 1, path
, (uint64_t) data
.weight
);
1439 return bus_log_create_error(r
);
1445 static int oci_cgroup_block_io_throttle(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1446 Settings
*s
= userdata
;
1453 pname
= streq(name
, "throttleReadBpsDevice") ? "IOReadBandwidthMax" :
1454 streq(name
, "throttleWriteBpsDevice") ? "IOWriteBandwidthMax" :
1455 streq(name
, "throttleReadIOPSDevice") ? "IOReadIOPSMax" :
1458 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1459 struct device_data
{
1464 .major
= (unsigned) -1,
1465 .minor
= (unsigned) -1,
1468 static const JsonDispatch table
[] = {
1469 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(struct device_data
, major
), JSON_MANDATORY
},
1470 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(struct device_data
, minor
), JSON_MANDATORY
},
1471 { "rate", JSON_VARIANT_UNSIGNED
, json_dispatch_unsigned
, offsetof(struct device_data
, rate
), JSON_MANDATORY
},
1475 _cleanup_free_
char *path
= NULL
;
1477 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
1481 if (data
.rate
>= UINT64_MAX
)
1482 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1483 "Block I/O device rate out of range.");
1485 r
= device_path_make_major_minor(S_IFBLK
, makedev(data
.major
, data
.minor
), &path
);
1487 return json_log(v
, flags
, r
, "Failed to build device path: %m");
1489 r
= settings_allocate_properties(s
);
1493 r
= sd_bus_message_append(s
->properties
, "(sv)", pname
, "a(st)", 1, path
, (uint64_t) data
.rate
);
1495 return bus_log_create_error(r
);
1501 static int oci_cgroup_block_io(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1503 static const JsonDispatch table
[] = {
1504 { "weight", JSON_VARIANT_UNSIGNED
, oci_cgroup_block_io_weight
, 0, 0 },
1505 { "leafWeight", JSON_VARIANT_UNSIGNED
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1506 { "weightDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_weight_device
, 0, 0 },
1507 { "throttleReadBpsDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1508 { "throttleWriteBpsDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1509 { "throttleReadIOPSDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1510 { "throttleWriteIOPSDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1514 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
1517 static int oci_cgroup_pids(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1519 static const JsonDispatch table
[] = {
1520 { "limit", JSON_VARIANT_NUMBER
, json_dispatch_variant
, 0, JSON_MANDATORY
},
1524 _cleanup_(json_variant_unrefp
) JsonVariant
*k
= NULL
;
1525 Settings
*s
= userdata
;
1531 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &k
);
1535 if (json_variant_is_negative(k
))
1538 if (!json_variant_is_unsigned(k
))
1539 return json_log(k
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1540 "pids limit not unsigned integer, refusing.");
1542 m
= (uint64_t) json_variant_unsigned(k
);
1544 if ((uintmax_t) m
!= json_variant_unsigned(k
))
1545 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1546 "pids limit out of range, refusing.");
1549 r
= settings_allocate_properties(s
);
1553 r
= sd_bus_message_append(s
->properties
, "(sv)", "TasksMax", "t", m
);
1555 return bus_log_create_error(r
);
1560 static int oci_resources(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1562 static const JsonDispatch table
[] = {
1563 { "devices", JSON_VARIANT_ARRAY
, oci_cgroup_devices
, 0, 0 },
1564 { "memory", JSON_VARIANT_OBJECT
, oci_cgroup_memory
, 0, 0 },
1565 { "cpu", JSON_VARIANT_OBJECT
, oci_cgroup_cpu
, 0, 0 },
1566 { "blockIO", JSON_VARIANT_OBJECT
, oci_cgroup_block_io
, 0, 0 },
1567 { "hugepageLimits", JSON_VARIANT_ARRAY
, oci_unsupported
, 0, 0 },
1568 { "network", JSON_VARIANT_OBJECT
, oci_unsupported
, 0, 0 },
1569 { "pids", JSON_VARIANT_OBJECT
, oci_cgroup_pids
, 0, 0 },
1570 { "rdma", JSON_VARIANT_OBJECT
, oci_unsupported
, 0, 0 },
1574 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
1577 static bool sysctl_key_valid(const char *s
) {
1580 /* Note that we are a bit stricter here than in systemd-sysctl, as that inherited semantics from the old sysctl
1581 * tool, which were really weird (as it swaps / and . in both ways) */
1588 if (*s
<= ' ' || *s
>= 127)
1594 if (dot
) /* Don't allow two dots next to each other (or at the beginning) */
1602 if (dot
) /* don't allow a dot at the end */
1608 static int oci_sysctl(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1609 Settings
*s
= userdata
;
1616 JSON_VARIANT_OBJECT_FOREACH(k
, w
, v
) {
1619 if (!json_variant_is_string(w
))
1620 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1621 "sysctl parameter is not a string, refusing.");
1623 assert_se(m
= json_variant_string(w
));
1625 if (sysctl_key_valid(k
))
1626 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1627 "sysctl key invalid, refusing: %s", k
);
1629 r
= strv_extend_strv(&s
->sysctl
, STRV_MAKE(k
, m
), false);
1638 static int oci_seccomp_action_from_string(const char *name
, uint32_t *ret
) {
1640 static const struct {
1644 { "SCMP_ACT_ALLOW", SCMP_ACT_ALLOW
},
1645 { "SCMP_ACT_ERRNO", SCMP_ACT_ERRNO(EPERM
) }, /* the OCI spec doesn't document the error, but it appears EPERM is supposed to be used */
1646 { "SCMP_ACT_KILL", SCMP_ACT_KILL
},
1647 #ifdef SCMP_ACT_KILL_PROCESS
1648 { "SCMP_ACT_KILL_PROCESS", SCMP_ACT_KILL_PROCESS
},
1650 #ifdef SCMP_ACT_KILL_THREAD
1651 { "SCMP_ACT_KILL_THREAD", SCMP_ACT_KILL_THREAD
},
1654 { "SCMP_ACT_LOG", SCMP_ACT_LOG
},
1656 { "SCMP_ACT_TRAP", SCMP_ACT_TRAP
},
1658 /* We don't support SCMP_ACT_TRACE because that requires a tracer, and that doesn't really make sense
1664 for (i
= 0; i
< ELEMENTSOF(table
); i
++)
1665 if (streq_ptr(name
, table
[i
].name
)) {
1666 *ret
= table
[i
].action
;
1673 static int oci_seccomp_arch_from_string(const char *name
, uint32_t *ret
) {
1675 static const struct {
1679 { "SCMP_ARCH_AARCH64", SCMP_ARCH_AARCH64
},
1680 { "SCMP_ARCH_ARM", SCMP_ARCH_ARM
},
1681 { "SCMP_ARCH_MIPS", SCMP_ARCH_MIPS
},
1682 { "SCMP_ARCH_MIPS64", SCMP_ARCH_MIPS64
},
1683 { "SCMP_ARCH_MIPS64N32", SCMP_ARCH_MIPS64N32
},
1684 { "SCMP_ARCH_MIPSEL", SCMP_ARCH_MIPSEL
},
1685 { "SCMP_ARCH_MIPSEL64", SCMP_ARCH_MIPSEL64
},
1686 { "SCMP_ARCH_MIPSEL64N32", SCMP_ARCH_MIPSEL64N32
},
1687 { "SCMP_ARCH_NATIVE", SCMP_ARCH_NATIVE
},
1688 #ifdef SCMP_ARCH_PARISC
1689 { "SCMP_ARCH_PARISC", SCMP_ARCH_PARISC
},
1691 #ifdef SCMP_ARCH_PARISC64
1692 { "SCMP_ARCH_PARISC64", SCMP_ARCH_PARISC64
},
1694 { "SCMP_ARCH_PPC", SCMP_ARCH_PPC
},
1695 { "SCMP_ARCH_PPC64", SCMP_ARCH_PPC64
},
1696 { "SCMP_ARCH_PPC64LE", SCMP_ARCH_PPC64LE
},
1697 { "SCMP_ARCH_S390", SCMP_ARCH_S390
},
1698 { "SCMP_ARCH_S390X", SCMP_ARCH_S390X
},
1699 { "SCMP_ARCH_X32", SCMP_ARCH_X32
},
1700 { "SCMP_ARCH_X86", SCMP_ARCH_X86
},
1701 { "SCMP_ARCH_X86_64", SCMP_ARCH_X86_64
},
1706 for (i
= 0; i
< ELEMENTSOF(table
); i
++)
1707 if (streq_ptr(table
[i
].name
, name
)) {
1708 *ret
= table
[i
].arch
;
1715 static int oci_seccomp_compare_from_string(const char *name
, enum scmp_compare
*ret
) {
1717 static const struct {
1719 enum scmp_compare op
;
1721 { "SCMP_CMP_NE", SCMP_CMP_NE
},
1722 { "SCMP_CMP_LT", SCMP_CMP_LT
},
1723 { "SCMP_CMP_LE", SCMP_CMP_LE
},
1724 { "SCMP_CMP_EQ", SCMP_CMP_EQ
},
1725 { "SCMP_CMP_GE", SCMP_CMP_GE
},
1726 { "SCMP_CMP_GT", SCMP_CMP_GT
},
1727 { "SCMP_CMP_MASKED_EQ", SCMP_CMP_MASKED_EQ
},
1732 for (i
= 0; i
< ELEMENTSOF(table
); i
++)
1733 if (streq_ptr(table
[i
].name
, name
)) {
1741 static int oci_seccomp_archs(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1742 scmp_filter_ctx
*sc
= userdata
;
1748 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1751 if (!json_variant_is_string(e
))
1752 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1753 "Architecture entry is not a string");
1755 r
= oci_seccomp_arch_from_string(json_variant_string(e
), &a
);
1757 return json_log(e
, flags
, r
, "Unknown architecture: %s", json_variant_string(e
));
1759 r
= seccomp_arch_add(sc
, a
);
1763 return json_log(e
, flags
, r
, "Failed to add architecture to seccomp filter: %m");
1769 struct syscall_rule
{
1772 struct scmp_arg_cmp
*arguments
;
1776 static void syscall_rule_free(struct syscall_rule
*rule
) {
1779 strv_free(rule
->names
);
1780 free(rule
->arguments
);
1783 static int oci_seccomp_action(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1784 uint32_t *action
= userdata
;
1789 r
= oci_seccomp_action_from_string(json_variant_string(v
), action
);
1791 return json_log(v
, flags
, r
, "Unknown system call action '%s': %m", json_variant_string(v
));
1796 static int oci_seccomp_op(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1797 enum scmp_compare
*op
= userdata
;
1802 r
= oci_seccomp_compare_from_string(json_variant_string(v
), op
);
1804 return json_log(v
, flags
, r
, "Unknown seccomp operator '%s': %m", json_variant_string(v
));
1809 static int oci_seccomp_args(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1810 struct syscall_rule
*rule
= userdata
;
1816 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1817 static const struct JsonDispatch table
[] = {
1818 { "index", JSON_VARIANT_UNSIGNED
, json_dispatch_uint32
, offsetof(struct scmp_arg_cmp
, arg
), JSON_MANDATORY
},
1819 { "value", JSON_VARIANT_UNSIGNED
, json_dispatch_uint64
, offsetof(struct scmp_arg_cmp
, datum_a
), JSON_MANDATORY
},
1820 { "valueTwo", JSON_VARIANT_UNSIGNED
, json_dispatch_uint64
, offsetof(struct scmp_arg_cmp
, datum_b
), 0 },
1821 { "op", JSON_VARIANT_STRING
, oci_seccomp_op
, offsetof(struct scmp_arg_cmp
, op
), JSON_MANDATORY
},
1825 struct scmp_arg_cmp
*a
, *p
;
1828 a
= reallocarray(rule
->arguments
, rule
->n_arguments
+ 1, sizeof(struct syscall_rule
));
1832 rule
->arguments
= a
;
1833 p
= rule
->arguments
+ rule
->n_arguments
;
1835 *p
= (struct scmp_arg_cmp
) {
1842 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, p
);
1846 expected
= p
->op
== SCMP_CMP_MASKED_EQ
? 4 : 3;
1848 json_log(e
, flags
|JSON_WARNING
, 0, "Wrong number of system call arguments for JSON data data, ignoring.");
1850 /* Note that we are a bit sloppy here and do not insist that SCMP_CMP_MASKED_EQ gets two datum values,
1851 * and the other only one. That's because buildah for example by default calls things with
1852 * SCMP_CMP_MASKED_EQ but only one argument. We use 0 when the value is not specified. */
1854 rule
->n_arguments
++;
1860 static int oci_seccomp_syscalls(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1861 scmp_filter_ctx
*sc
= userdata
;
1867 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1868 static const JsonDispatch table
[] = {
1869 { "names", JSON_VARIANT_ARRAY
, json_dispatch_strv
, offsetof(struct syscall_rule
, names
), JSON_MANDATORY
},
1870 { "action", JSON_VARIANT_STRING
, oci_seccomp_action
, offsetof(struct syscall_rule
, action
), JSON_MANDATORY
},
1871 { "args", JSON_VARIANT_ARRAY
, oci_seccomp_args
, 0, 0 },
1873 struct syscall_rule rule
= {
1874 .action
= (uint32_t) -1,
1878 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &rule
);
1882 if (strv_isempty(rule
.names
)) {
1883 json_log(e
, flags
, 0, "System call name list is empty.");
1888 STRV_FOREACH(i
, rule
.names
) {
1891 nr
= seccomp_syscall_resolve_name(*i
);
1892 if (nr
== __NR_SCMP_ERROR
) {
1893 log_debug("Unknown syscall %s, skipping.", *i
);
1897 r
= seccomp_rule_add_array(sc
, rule
.action
, nr
, rule
.n_arguments
, rule
.arguments
);
1902 syscall_rule_free(&rule
);
1906 syscall_rule_free(&rule
);
1914 static int oci_seccomp(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1917 static const JsonDispatch table
[] = {
1918 { "defaultAction", JSON_VARIANT_STRING
, NULL
, 0, JSON_MANDATORY
},
1919 { "architectures", JSON_VARIANT_ARRAY
, oci_seccomp_archs
, 0, 0 },
1920 { "syscalls", JSON_VARIANT_ARRAY
, oci_seccomp_syscalls
, 0, 0 },
1924 _cleanup_(seccomp_releasep
) scmp_filter_ctx sc
= NULL
;
1925 Settings
*s
= userdata
;
1932 def
= json_variant_by_key(v
, "defaultAction");
1934 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
), "defaultAction element missing.");
1936 if (!json_variant_is_string(def
))
1937 return json_log(def
, flags
, SYNTHETIC_ERRNO(EINVAL
), "defaultAction is not a string.");
1939 r
= oci_seccomp_action_from_string(json_variant_string(def
), &d
);
1941 return json_log(def
, flags
, r
, "Unknown default action: %s", json_variant_string(def
));
1943 sc
= seccomp_init(d
);
1945 return json_log(v
, flags
, SYNTHETIC_ERRNO(ENOMEM
), "Couldn't allocate seccomp object.");
1947 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, sc
);
1951 seccomp_release(s
->seccomp
);
1952 s
->seccomp
= TAKE_PTR(sc
);
1955 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
), "libseccomp support not enabled, can't parse seccomp object.");
1959 static int oci_rootfs_propagation(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1962 s
= json_variant_string(v
);
1964 if (streq(s
, "shared"))
1967 json_log(v
, flags
|JSON_DEBUG
, 0, "Ignoring rootfsPropagation setting '%s'.", s
);
1971 static int oci_masked_paths(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1972 Settings
*s
= userdata
;
1977 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1978 _cleanup_free_
char *destination
= NULL
;
1982 if (!json_variant_is_string(e
))
1983 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1984 "Path is not a string, refusing.");
1986 assert_se(p
= json_variant_string(e
));
1988 if (!path_is_absolute(p
))
1989 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1990 "Path is not not absolute, refusing: %s", p
);
1992 if (oci_exclude_mount(p
))
1995 destination
= strdup(p
);
1999 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_INACCESSIBLE
);
2003 m
->destination
= TAKE_PTR(destination
);
2005 /* The spec doesn't say this, but apparently pre-existing implementations are lenient towards
2006 * non-existing paths to mask. Let's hence be too. */
2013 static int oci_readonly_paths(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2014 Settings
*s
= userdata
;
2019 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
2020 _cleanup_free_
char *source
= NULL
, *destination
= NULL
;
2024 if (!json_variant_is_string(e
))
2025 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2026 "Path is not a string, refusing.");
2028 assert_se(p
= json_variant_string(e
));
2030 if (!path_is_absolute(p
))
2031 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2032 "Path is not not absolute, refusing: %s", p
);
2034 if (oci_exclude_mount(p
))
2037 source
= strjoin("+", p
);
2041 destination
= strdup(p
);
2045 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_BIND
);
2049 m
->source
= TAKE_PTR(source
);
2050 m
->destination
= TAKE_PTR(destination
);
2051 m
->read_only
= true;
2057 static int oci_linux(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2059 static const JsonDispatch table
[] = {
2060 { "namespaces", JSON_VARIANT_ARRAY
, oci_namespaces
, 0, 0 },
2061 { "uidMappings", JSON_VARIANT_ARRAY
, oci_uid_gid_mappings
, 0, 0 },
2062 { "gidMappings", JSON_VARIANT_ARRAY
, oci_uid_gid_mappings
, 0, 0 },
2063 { "devices", JSON_VARIANT_ARRAY
, oci_devices
, 0, 0 },
2064 { "cgroupsPath", JSON_VARIANT_STRING
, oci_cgroups_path
, 0, 0 },
2065 { "resources", JSON_VARIANT_OBJECT
, oci_resources
, 0, 0 },
2066 { "intelRdt", JSON_VARIANT_OBJECT
, oci_unsupported
, 0, JSON_PERMISSIVE
},
2067 { "sysctl", JSON_VARIANT_OBJECT
, oci_sysctl
, 0, 0 },
2068 { "seccomp", JSON_VARIANT_OBJECT
, oci_seccomp
, 0, 0 },
2069 { "rootfsPropagation", JSON_VARIANT_STRING
, oci_rootfs_propagation
, 0, 0 },
2070 { "maskedPaths", JSON_VARIANT_ARRAY
, oci_masked_paths
, 0, 0 },
2071 { "readonlyPaths", JSON_VARIANT_ARRAY
, oci_readonly_paths
, 0, 0 },
2072 { "mountLabel", JSON_VARIANT_STRING
, oci_unsupported
, 0, JSON_PERMISSIVE
},
2076 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
2079 static int oci_hook_timeout(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2080 usec_t
*u
= userdata
;
2083 k
= json_variant_unsigned(v
);
2084 if (k
== 0 || k
> (UINT64_MAX
-1)/USEC_PER_SEC
)
2085 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
2086 "Hook timeout value out of range.");
2088 *u
= k
* USEC_PER_SEC
;
2092 static int oci_hooks_array(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2093 Settings
*s
= userdata
;
2099 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
2101 static const JsonDispatch table
[] = {
2102 { "path", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(OciHook
, path
), JSON_MANDATORY
},
2103 { "args", JSON_VARIANT_ARRAY
, oci_args
, offsetof(OciHook
, args
), 0 },
2104 { "env", JSON_VARIANT_ARRAY
, oci_env
, offsetof(OciHook
, env
), 0 },
2105 { "timeout", JSON_VARIANT_UNSIGNED
, oci_hook_timeout
, offsetof(OciHook
, timeout
), 0 },
2109 OciHook
*a
, **array
, *new_item
;
2112 if (streq(name
, "prestart")) {
2113 array
= &s
->oci_hooks_prestart
;
2114 n_array
= &s
->n_oci_hooks_prestart
;
2115 } else if (streq(name
, "poststart")) {
2116 array
= &s
->oci_hooks_poststart
;
2117 n_array
= &s
->n_oci_hooks_poststart
;
2119 assert(streq(name
, "poststop"));
2120 array
= &s
->oci_hooks_poststop
;
2121 n_array
= &s
->n_oci_hooks_poststop
;
2124 a
= reallocarray(*array
, *n_array
+ 1, sizeof(OciHook
));
2129 new_item
= a
+ *n_array
;
2131 *new_item
= (OciHook
) {
2132 .timeout
= USEC_INFINITY
,
2135 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, userdata
);
2137 free(new_item
->path
);
2138 strv_free(new_item
->args
);
2139 strv_free(new_item
->env
);
2149 static int oci_hooks(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2151 static const JsonDispatch table
[] = {
2152 { "prestart", JSON_VARIANT_OBJECT
, oci_hooks_array
, 0, 0 },
2153 { "poststart", JSON_VARIANT_OBJECT
, oci_hooks_array
, 0, 0 },
2154 { "poststop", JSON_VARIANT_OBJECT
, oci_hooks_array
, 0, 0 },
2158 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
2161 static int oci_annotations(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2165 JSON_VARIANT_OBJECT_FOREACH(k
, w
, v
) {
2168 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2169 "Annotation with empty key, refusing.");
2171 if (!json_variant_is_string(w
))
2172 return json_log(w
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2173 "Annotation has non-string value, refusing.");
2175 json_log(w
, flags
|JSON_DEBUG
, 0, "Ignoring annotation '%s' with value '%s'.", k
, json_variant_string(w
));
2181 int oci_load(FILE *f
, const char *bundle
, Settings
**ret
) {
2183 static const JsonDispatch table
[] = {
2184 { "ociVersion", JSON_VARIANT_STRING
, NULL
, 0, JSON_MANDATORY
},
2185 { "process", JSON_VARIANT_OBJECT
, oci_process
, 0, 0 },
2186 { "root", JSON_VARIANT_OBJECT
, oci_root
, 0, 0 },
2187 { "hostname", JSON_VARIANT_STRING
, oci_hostname
, 0, 0 },
2188 { "mounts", JSON_VARIANT_ARRAY
, oci_mounts
, 0, 0 },
2189 { "linux", JSON_VARIANT_OBJECT
, oci_linux
, 0, 0 },
2190 { "hooks", JSON_VARIANT_OBJECT
, oci_hooks
, 0, 0 },
2191 { "annotations", JSON_VARIANT_OBJECT
, oci_annotations
, 0, 0 },
2195 _cleanup_(json_variant_unrefp
) JsonVariant
*oci
= NULL
;
2196 _cleanup_(settings_freep
) Settings
*s
= NULL
;
2197 unsigned line
= 0, column
= 0;
2204 path
= strjoina(bundle
, "/config.json");
2206 r
= json_parse_file(f
, path
, 0, &oci
, &line
, &column
);
2208 if (line
!= 0 && column
!= 0)
2209 return log_error_errno(r
, "Failed to parse '%s' at %u:%u: %m", path
, line
, column
);
2211 return log_error_errno(r
, "Failed to parse '%s': %m", path
);
2214 v
= json_variant_by_key(oci
, "ociVersion");
2216 log_error("JSON file '%s' is not an OCI bundle configuration file. Refusing.", path
);
2219 if (!streq_ptr(json_variant_string(v
), "1.0.0")) {
2220 log_error("OCI bundle version not supported: %s", strna(json_variant_string(v
)));
2225 // _cleanup_free_ char *formatted = NULL;
2226 // assert_se(json_variant_format(oci, JSON_FORMAT_PRETTY|JSON_FORMAT_COLOR, &formatted) >= 0);
2227 // fputs(formatted, stdout);
2234 s
->start_mode
= START_PID1
;
2235 s
->resolv_conf
= RESOLV_CONF_OFF
;
2236 s
->link_journal
= LINK_NO
;
2237 s
->timezone
= TIMEZONE_OFF
;
2239 s
->bundle
= strdup(bundle
);
2243 r
= json_dispatch(oci
, table
, oci_unexpected
, 0, s
);
2247 if (s
->properties
) {
2248 r
= sd_bus_message_seal(s
->properties
, 0, 0);
2250 return log_error_errno(r
, "Cannot seal properties bus message: %m");