1 /* SPDX-License-Identifier: LGPL-2.1+ */
10 #include "cpu-set-util.h"
12 #include "format-util.h"
14 #include "hostname-util.h"
16 #include "missing_sched.h"
17 #include "nspawn-oci.h"
18 #include "path-util.h"
19 #include "rlimit-util.h"
21 #include "seccomp-util.h"
23 #include "stat-util.h"
24 #include "stdio-util.h"
25 #include "string-util.h"
27 #include "user-util.h"
30 * OCI runtime tool implementation
35 * How is RLIM_INFINITY supposed to be encoded?
36 * configured effective caps is bullshit, as execv() corrupts it anyway
37 * pipes bind mounted is *very* different from pipes newly created, comments regarding bind mount or not are bogus
38 * annotation values structured? or string?
39 * configurable file system namespace path, but then also root path? wtf?
40 * apply sysctl inside of the container? or outside?
41 * how is unlimited pids tasks limit to be encoded?
42 * what are the defaults for caps if not specified?
43 * what are the default uid/gid mappings if one is missing but the other set, or when user ns is on but no namespace configured
44 * the source field of "mounts" is really weird, as it cannot realistically be relative to the bundle, since we never know if that's what the fs wants
45 * spec contradicts itself on the mount "type" field, as the example uses "bind" as type, but it's not listed in /proc/filesystem, and is something made up by /bin/mount
46 * if type of mount is left out, what shall be assumed? "bind"?
47 * readonly mounts is entirely redundant?
48 * should escaping be applied when joining mount options with ","?
49 * devices cgroup support is bogus, "allow" and "deny" on the kernel level is about adding/removing entries, not about access
50 * spec needs to say that "rwm" devices cgroup combination can't be the empty string
51 * cgrouspv1 crap: kernel, kernelTCP, swapiness, disableOOMKiller, swap, devices, leafWeight
52 * general: it shouldn't leak lower level abstractions this obviously
53 * unmanagable cgroups stuff: realtimeRuntime/realtimePeriod
54 * needs to say what happense when some option is not specified, i.e. which defautls apply
55 * no architecture? no personality?
56 * seccomp example and logic is simply broken: there's no constant "SCMP_ACT_ERRNO".
57 * spec should say what to do with unknown props
58 * /bin/mount regarding NFS and FUSE required?
59 * what does terminal=false mean?
60 * sysctl inside or outside? whitelisting?
61 * swapiness typo -> swappiness
66 * selinuxLabel + mountLabel
71 * swappiness, disableOOMKiller, kernel, kernelTCP, leafWeight (because it's dead, cgroupsv2 can't do it and hence systemd neither)
73 * Non-slice cgroup paths
74 * Propagation that is not slave + shared
75 * more than one uid/gid mapping, mappings with a container base != 0, or non-matching uid/gid mappings
76 * device cgroups access = false items that are not catchall
77 * device cgroups matches where minor is specified, but major isn't. similar where major is specified but char/block is not. also, any match that only has a type set that has less than "rwm" set. also, any entry that has none of rwm set.
81 static int oci_unexpected(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
82 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
83 "Unexpected OCI element '%s' of type '%s'.", name
, json_variant_type_to_string(json_variant_type(v
)));
86 static int oci_unsupported(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
87 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
88 "Unsupported OCI element '%s' of type '%s'.", name
, json_variant_type_to_string(json_variant_type(v
)));
91 static int oci_terminal(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
92 Settings
*s
= userdata
;
94 /* If not specified, or set to true, we'll default to either an interactive or a read-only
95 * console. If specified as false, we'll forcibly move to "pipe" mode though. */
96 s
->console_mode
= json_variant_boolean(v
) ? _CONSOLE_MODE_INVALID
: CONSOLE_PIPE
;
100 static int oci_console_dimension(const char *name
, JsonVariant
*variant
, JsonDispatchFlags flags
, void *userdata
) {
101 unsigned *u
= userdata
;
106 k
= json_variant_unsigned(variant
);
108 return json_log(variant
, flags
, SYNTHETIC_ERRNO(ERANGE
),
109 "Console size field '%s' is too small.", strna(name
));
110 if (k
> USHRT_MAX
) /* TIOCSWINSZ's struct winsize uses "unsigned short" for width and height */
111 return json_log(variant
, flags
, SYNTHETIC_ERRNO(ERANGE
),
112 "Console size field '%s' is too large.", strna(name
));
118 static int oci_console_size(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
120 static const JsonDispatch table
[] = {
121 { "height", JSON_VARIANT_UNSIGNED
, oci_console_dimension
, offsetof(Settings
, console_height
), JSON_MANDATORY
},
122 { "width", JSON_VARIANT_UNSIGNED
, oci_console_dimension
, offsetof(Settings
, console_width
), JSON_MANDATORY
},
126 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
129 static int oci_absolute_path(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
135 n
= json_variant_string(v
);
137 if (!path_is_absolute(n
))
138 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
139 "Path in JSON field '%s' is not absolute: %s", strna(name
), n
);
141 return free_and_strdup_warn(p
, n
);
144 static int oci_env(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
145 char ***l
= userdata
;
151 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
154 if (!json_variant_is_string(e
))
155 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
156 "Environment array contains non-string.");
158 assert_se(n
= json_variant_string(e
));
160 if (!env_assignment_is_valid(n
))
161 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
162 "Environment assignment not valid: %s", n
);
164 r
= strv_extend(l
, n
);
172 static int oci_args(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
173 _cleanup_strv_free_
char **l
= NULL
;
174 char ***value
= userdata
;
180 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
183 if (!json_variant_is_string(e
))
184 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
185 "Argument is not a string.");
187 assert_se(n
= json_variant_string(e
));
189 r
= strv_extend(&l
, n
);
195 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
196 "Argument list empty, refusing.");
199 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
200 "Executable name is empty, refusing.");
202 return strv_free_and_replace(*value
, l
);
205 static int oci_rlimit_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
207 int t
, *type
= userdata
;
211 z
= startswith(json_variant_string(v
), "RLIMIT_");
213 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
214 "rlimit entry's name does not begin with 'RLIMIT_', refusing: %s",
215 json_variant_string(v
));
217 t
= rlimit_from_string(z
);
219 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
220 "rlimit name unknown: %s", json_variant_string(v
));
226 static int oci_rlimit_value(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
227 rlim_t z
, *value
= userdata
;
231 if (json_variant_is_negative(v
))
234 if (!json_variant_is_unsigned(v
))
235 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
236 "rlimits limit not unsigned, refusing.");
238 z
= (rlim_t
) json_variant_unsigned(v
);
240 if ((uintmax_t) z
!= json_variant_unsigned(v
))
241 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
242 "rlimits limit out of range, refusing.");
249 static int oci_rlimits(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
251 Settings
*s
= userdata
;
257 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
265 .soft
= RLIM_INFINITY
,
266 .hard
= RLIM_INFINITY
,
269 static const JsonDispatch table
[] = {
270 { "soft", JSON_VARIANT_NUMBER
, oci_rlimit_value
, offsetof(struct rlimit_data
, soft
), JSON_MANDATORY
},
271 { "hard", JSON_VARIANT_NUMBER
, oci_rlimit_value
, offsetof(struct rlimit_data
, hard
), JSON_MANDATORY
},
272 { "type", JSON_VARIANT_STRING
, oci_rlimit_type
, offsetof(struct rlimit_data
, type
), JSON_MANDATORY
},
277 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
281 assert(data
.type
>= 0);
282 assert(data
.type
< _RLIMIT_MAX
);
284 if (s
->rlimit
[data
.type
])
285 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
286 "rlimits array contains duplicate entry, refusing.");
288 s
->rlimit
[data
.type
] = new(struct rlimit
, 1);
289 if (!s
->rlimit
[data
.type
])
292 *s
->rlimit
[data
.type
] = (struct rlimit
) {
293 .rlim_cur
= data
.soft
,
294 .rlim_max
= data
.hard
,
301 static int oci_capability_array(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
302 uint64_t *mask
= userdata
, m
= 0;
305 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
309 if (!json_variant_is_string(e
))
310 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
311 "Entry in capabilities array is not a string.");
313 assert_se(n
= json_variant_string(e
));
315 cap
= capability_from_name(n
);
317 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
318 "Unknown capability: %s", n
);
320 m
|= UINT64_C(1) << cap
;
323 if (*mask
== (uint64_t) -1)
331 static int oci_capabilities(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
333 static const JsonDispatch table
[] = {
334 { "effective", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, effective
) },
335 { "bounding", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, bounding
) },
336 { "inheritable", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, inheritable
) },
337 { "permitted", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, permitted
) },
338 { "ambient", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, ambient
) },
342 Settings
*s
= userdata
;
347 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &s
->full_capabilities
);
351 if (s
->full_capabilities
.bounding
!= (uint64_t) -1) {
352 s
->capability
= s
->full_capabilities
.bounding
;
353 s
->drop_capability
= ~s
->full_capabilities
.bounding
;
359 static int oci_oom_score_adj(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
360 Settings
*s
= userdata
;
365 k
= json_variant_integer(v
);
366 if (k
< OOM_SCORE_ADJ_MIN
|| k
> OOM_SCORE_ADJ_MAX
)
367 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
368 "oomScoreAdj value out of range: %ji", k
);
370 s
->oom_score_adjust
= (int) k
;
371 s
->oom_score_adjust_set
= true;
376 static int oci_uid_gid(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
377 uid_t
*uid
= userdata
, u
;
381 assert_cc(sizeof(uid_t
) == sizeof(gid_t
));
383 k
= json_variant_unsigned(v
);
385 if ((uintmax_t) u
!= k
)
386 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
387 "UID/GID out of range: %ji", k
);
389 if (!uid_is_valid(u
))
390 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
391 "UID/GID is not valid: " UID_FMT
, u
);
397 static int oci_supplementary_gids(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
398 Settings
*s
= userdata
;
404 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
407 if (!json_variant_is_unsigned(e
))
408 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
409 "Supplementary GID entry is not a UID.");
411 r
= oci_uid_gid(name
, e
, flags
, &gid
);
415 a
= reallocarray(s
->supplementary_gids
, s
->n_supplementary_gids
+ 1, sizeof(gid_t
));
419 s
->supplementary_gids
= a
;
420 s
->supplementary_gids
[s
->n_supplementary_gids
++] = gid
;
426 static int oci_user(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
427 static const JsonDispatch table
[] = {
428 { "uid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(Settings
, uid
), JSON_MANDATORY
},
429 { "gid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(Settings
, gid
), JSON_MANDATORY
},
430 { "additionalGids", JSON_VARIANT_ARRAY
, oci_supplementary_gids
, 0, 0 },
434 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
437 static int oci_process(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
439 static const JsonDispatch table
[] = {
440 { "terminal", JSON_VARIANT_BOOLEAN
, oci_terminal
, 0, 0 },
441 { "consoleSize", JSON_VARIANT_OBJECT
, oci_console_size
, 0, 0 },
442 { "cwd", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(Settings
, working_directory
), 0 },
443 { "env", JSON_VARIANT_ARRAY
, oci_env
, offsetof(Settings
, environment
), 0 },
444 { "args", JSON_VARIANT_ARRAY
, oci_args
, offsetof(Settings
, parameters
), 0 },
445 { "rlimits", JSON_VARIANT_ARRAY
, oci_rlimits
, 0, 0 },
446 { "apparmorProfile", JSON_VARIANT_STRING
, oci_unsupported
, 0, JSON_PERMISSIVE
},
447 { "capabilities", JSON_VARIANT_OBJECT
, oci_capabilities
, 0, 0 },
448 { "noNewPrivileges", JSON_VARIANT_BOOLEAN
, json_dispatch_boolean
, offsetof(Settings
, no_new_privileges
), 0 },
449 { "oomScoreAdj", JSON_VARIANT_INTEGER
, oci_oom_score_adj
, 0, 0 },
450 { "selinuxLabel", JSON_VARIANT_STRING
, oci_unsupported
, 0, JSON_PERMISSIVE
},
451 { "user", JSON_VARIANT_OBJECT
, oci_user
, 0, 0 },
455 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
458 static int oci_root(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
460 static const JsonDispatch table
[] = {
461 { "path", JSON_VARIANT_STRING
, json_dispatch_string
, offsetof(Settings
, root
) },
462 { "readonly", JSON_VARIANT_BOOLEAN
, json_dispatch_boolean
, offsetof(Settings
, read_only
) },
466 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
469 static int oci_hostname(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
470 Settings
*s
= userdata
;
475 assert_se(n
= json_variant_string(v
));
477 if (!hostname_is_valid(n
, false))
478 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
479 "Hostname string is not a valid hostname: %s", n
);
481 return free_and_strdup_warn(&s
->hostname
, n
);
484 static bool oci_exclude_mount(const char *path
) {
486 /* Returns "true" for all mounts we insist to mount on our own, and hence ignore the OCI data. */
488 if (PATH_IN_SET(path
,
506 "/proc/sysrq-trigger",
515 /* Similar, skip the whole /sys/fs/cgroups subtree */
516 if (path_startswith(path
, "/sys/fs/cgroup"))
522 typedef struct oci_mount_data
{
529 static void cleanup_oci_mount_data(oci_mount_data
*data
) {
530 free(data
->destination
);
532 strv_free(data
->options
);
536 static int oci_mounts(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
537 Settings
*s
= userdata
;
543 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
544 static const JsonDispatch table
[] = {
545 { "destination", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(oci_mount_data
, destination
), JSON_MANDATORY
},
546 { "source", JSON_VARIANT_STRING
, json_dispatch_string
, offsetof(oci_mount_data
, source
), 0 },
547 { "options", JSON_VARIANT_ARRAY
, json_dispatch_strv
, offsetof(oci_mount_data
, options
), 0, },
548 { "type", JSON_VARIANT_STRING
, json_dispatch_string
, offsetof(oci_mount_data
, type
), 0 },
552 _cleanup_free_
char *joined_options
= NULL
;
554 _cleanup_(cleanup_oci_mount_data
) oci_mount_data data
= {};
556 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
560 if (!path_is_absolute(data
.destination
))
561 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
562 "Mount destination not an absolute path: %s", data
.destination
);
564 if (oci_exclude_mount(data
.destination
))
568 joined_options
= strv_join(data
.options
, ",");
573 if (!data
.type
|| streq(data
.type
, "bind")) {
574 if (data
.source
&& !path_is_absolute(data
.source
)) {
577 joined
= path_join(s
->bundle
, data
.source
);
581 free_and_replace(data
.source
, joined
);
584 data
.type
= mfree(data
.type
);
586 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_BIND
);
588 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_ARBITRARY
);
592 m
->destination
= TAKE_PTR(data
.destination
);
593 m
->source
= TAKE_PTR(data
.source
);
594 m
->options
= TAKE_PTR(joined_options
);
595 m
->type_argument
= TAKE_PTR(data
.type
);
601 static int oci_namespace_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
602 unsigned long *nsflags
= userdata
;
606 assert_se(n
= json_variant_string(v
));
608 /* We don't use namespace_flags_from_string() here, as the OCI spec uses slightly different names than the
611 *nsflags
= CLONE_NEWPID
;
612 else if (streq(n
, "network"))
613 *nsflags
= CLONE_NEWNET
;
614 else if (streq(n
, "mount"))
615 *nsflags
= CLONE_NEWNS
;
616 else if (streq(n
, "ipc"))
617 *nsflags
= CLONE_NEWIPC
;
618 else if (streq(n
, "uts"))
619 *nsflags
= CLONE_NEWUTS
;
620 else if (streq(n
, "user"))
621 *nsflags
= CLONE_NEWUSER
;
622 else if (streq(n
, "cgroup"))
623 *nsflags
= CLONE_NEWCGROUP
;
625 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
626 "Unknown cgroup type, refusing: %s", n
);
631 static int oci_namespaces(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
632 Settings
*s
= userdata
;
639 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
641 struct namespace_data
{
646 static const JsonDispatch table
[] = {
647 { "type", JSON_VARIANT_STRING
, oci_namespace_type
, offsetof(struct namespace_data
, type
), JSON_MANDATORY
},
648 { "path", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(struct namespace_data
, path
), 0 },
652 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
659 if (data
.type
!= CLONE_NEWNET
) {
661 return json_log(e
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
662 "Specifying namespace path for non-network namespace is not supported.");
665 if (s
->network_namespace_path
) {
667 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
668 "Network namespace path specified more than once, refusing.");
671 free(s
->network_namespace_path
);
672 s
->network_namespace_path
= data
.path
;
675 if (FLAGS_SET(n
, data
.type
)) {
676 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
677 "Duplicate namespace specification, refusing.");
683 if (!FLAGS_SET(n
, CLONE_NEWNS
))
684 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
685 "Containers without file system namespace aren't supported.");
687 s
->private_network
= FLAGS_SET(n
, CLONE_NEWNET
);
688 s
->userns_mode
= FLAGS_SET(n
, CLONE_NEWUSER
) ? USER_NAMESPACE_FIXED
: USER_NAMESPACE_NO
;
689 s
->use_cgns
= FLAGS_SET(n
, CLONE_NEWCGROUP
);
691 s
->clone_ns_flags
= n
& (CLONE_NEWIPC
|CLONE_NEWPID
|CLONE_NEWUTS
);
696 static int oci_uid_gid_range(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
697 uid_t
*uid
= userdata
, u
;
701 assert_cc(sizeof(uid_t
) == sizeof(gid_t
));
703 /* This is very much like oci_uid_gid(), except the checks are a bit different, as this is a UID range rather
704 * than a specific UID, and hence (uid_t) -1 has no special significance. OTOH a range of zero makes no
707 k
= json_variant_unsigned(v
);
709 if ((uintmax_t) u
!= k
)
710 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
711 "UID/GID out of range: %ji", k
);
713 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
714 "UID/GID range can't be zero.");
720 static int oci_uid_gid_mappings(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
721 struct mapping_data
{
726 .host_id
= UID_INVALID
,
727 .container_id
= UID_INVALID
,
731 static const JsonDispatch table
[] = {
732 { "containerID", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(struct mapping_data
, container_id
), JSON_MANDATORY
},
733 { "hostID", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(struct mapping_data
, host_id
), JSON_MANDATORY
},
734 { "size", JSON_VARIANT_UNSIGNED
, oci_uid_gid_range
, offsetof(struct mapping_data
, range
), JSON_MANDATORY
},
738 Settings
*s
= userdata
;
744 if (json_variant_elements(v
) == 0)
747 if (json_variant_elements(v
) > 1)
748 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
749 "UID/GID mappings with more than one entry are not supported.");
751 assert_se(e
= json_variant_by_index(v
, 0));
753 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
757 if (data
.host_id
+ data
.range
< data
.host_id
||
758 data
.container_id
+ data
.range
< data
.container_id
)
759 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
760 "UID/GID range goes beyond UID/GID validity range, refusing.");
762 if (data
.container_id
!= 0)
763 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
764 "UID/GID mappings with a non-zero container base are not supported.");
766 if (data
.range
< 0x10000)
767 json_log(v
, flags
|JSON_WARNING
, 0,
768 "UID/GID mapping with less than 65536 UID/GIDS set up, you are looking for trouble.");
770 if (s
->uid_range
!= UID_INVALID
&&
771 (s
->uid_shift
!= data
.host_id
|| s
->uid_range
!= data
.range
))
772 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
773 "Non-matching UID and GID mappings are not supported.");
775 s
->uid_shift
= data
.host_id
;
776 s
->uid_range
= data
.range
;
781 static int oci_device_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
782 mode_t
*mode
= userdata
;
786 assert_se(t
= json_variant_string(v
));
788 if (STR_IN_SET(t
, "c", "u"))
789 *mode
= (*mode
& ~S_IFMT
) | S_IFCHR
;
790 else if (streq(t
, "b"))
791 *mode
= (*mode
& ~S_IFMT
) | S_IFBLK
;
792 else if (streq(t
, "p"))
793 *mode
= (*mode
& ~S_IFMT
) | S_IFIFO
;
795 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
796 "Unknown device type: %s", t
);
801 static int oci_device_major(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
802 unsigned *u
= userdata
;
807 k
= json_variant_unsigned(v
);
808 if (!DEVICE_MAJOR_VALID(k
))
809 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
810 "Device major %ji out of range.", k
);
816 static int oci_device_minor(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
817 unsigned *u
= userdata
;
822 k
= json_variant_unsigned(v
);
823 if (!DEVICE_MINOR_VALID(k
))
824 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
825 "Device minor %ji out of range.", k
);
831 static int oci_device_file_mode(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
832 mode_t
*mode
= userdata
, m
;
837 k
= json_variant_unsigned(v
);
840 if ((m
& ~07777) != 0 || (uintmax_t) m
!= k
)
841 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
842 "fileMode out of range, refusing.");
848 static int oci_devices(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
849 Settings
*s
= userdata
;
855 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
857 static const JsonDispatch table
[] = {
858 { "type", JSON_VARIANT_STRING
, oci_device_type
, offsetof(DeviceNode
, mode
), JSON_MANDATORY
},
859 { "path", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(DeviceNode
, path
), JSON_MANDATORY
},
860 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(DeviceNode
, major
), 0 },
861 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(DeviceNode
, minor
), 0 },
862 { "fileMode", JSON_VARIANT_UNSIGNED
, oci_device_file_mode
, offsetof(DeviceNode
, mode
), 0 },
863 { "uid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(DeviceNode
, uid
), 0 },
864 { "gid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(DeviceNode
, gid
), 0 },
868 DeviceNode
*node
, *nodes
;
870 nodes
= reallocarray(s
->extra_nodes
, s
->n_extra_nodes
+ 1, sizeof(DeviceNode
));
874 s
->extra_nodes
= nodes
;
876 node
= nodes
+ s
->n_extra_nodes
;
877 *node
= (DeviceNode
) {
880 .major
= (unsigned) -1,
881 .minor
= (unsigned) -1,
885 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, node
);
889 if (S_ISCHR(node
->mode
) || S_ISBLK(node
->mode
)) {
890 _cleanup_free_
char *path
= NULL
;
892 if (node
->major
== (unsigned) -1 || node
->minor
== (unsigned) -1) {
893 r
= json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
894 "Major/minor required when device node is device node");
898 /* Suppress a couple of implicit device nodes */
899 r
= device_path_make_canonical(node
->mode
, makedev(node
->major
, node
->minor
), &path
);
901 json_log(e
, flags
|JSON_DEBUG
, 0, "Failed to resolve device node %u:%u, ignoring: %m", node
->major
, node
->minor
);
903 if (PATH_IN_SET(path
,
915 json_log(e
, flags
|JSON_DEBUG
, 0, "Ignoring devices item for device '%s', as it is implicitly created anyway.", path
);
933 static int oci_cgroups_path(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
934 _cleanup_free_
char *slice
= NULL
, *backwards
= NULL
;
935 Settings
*s
= userdata
;
941 assert_se(p
= json_variant_string(v
));
943 r
= cg_path_get_slice(p
, &slice
);
945 return json_log(v
, flags
, r
, "Couldn't derive slice unit name from path '%s': %m", p
);
947 r
= cg_slice_to_path(slice
, &backwards
);
949 return json_log(v
, flags
, r
, "Couldn't convert slice unit name '%s' back to path: %m", slice
);
951 if (!path_equal(backwards
, p
))
952 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
953 "Control group path '%s' does not refer to slice unit, refusing.", p
);
955 free_and_replace(s
->slice
, slice
);
959 static int oci_cgroup_device_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
960 mode_t
*mode
= userdata
;
963 assert_se(n
= json_variant_string(v
));
967 else if (streq(n
, "b"))
970 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
971 "Control group device type unknown: %s", n
);
986 static int oci_cgroup_device_access(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
987 struct device_data
*d
= userdata
;
988 bool r
= false, w
= false, m
= false;
992 assert_se(s
= json_variant_string(v
));
994 for (i
= 0; s
[i
]; i
++)
997 else if (s
[i
] == 'w')
999 else if (s
[i
] == 'm')
1002 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1003 "Unknown device access character '%c'.", s
[i
]);
1012 static int oci_cgroup_devices(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1014 _cleanup_free_
struct device_data
*list
= NULL
;
1015 Settings
*s
= userdata
;
1016 size_t n_list
= 0, i
;
1023 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1025 struct device_data data
= {
1026 .major
= (unsigned) -1,
1027 .minor
= (unsigned) -1,
1030 static const JsonDispatch table
[] = {
1031 { "allow", JSON_VARIANT_BOOLEAN
, json_dispatch_boolean
, offsetof(struct device_data
, allow
), JSON_MANDATORY
},
1032 { "type", JSON_VARIANT_STRING
, oci_cgroup_device_type
, offsetof(struct device_data
, type
), 0 },
1033 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(struct device_data
, major
), 0 },
1034 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(struct device_data
, minor
), 0 },
1035 { "access", JSON_VARIANT_STRING
, oci_cgroup_device_access
, 0, 0 },
1039 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
1044 /* The fact that OCI allows 'deny' entries makes really no sense, as 'allow' vs. 'deny' for the
1045 * devices cgroup controller is really not about whitelisting and blacklisting but about adding
1046 * and removing entries from the whitelist. Since we always start out with an empty whitelist
1047 * we hence ignore the whole thing, as removing entries which don't exist make no sense. We'll
1048 * log about this, since this is really borked in the spec, with one exception: the entry
1049 * that's supposed to drop the kernel's default we ignore silently */
1051 if (!data
.r
|| !data
.w
|| !data
.m
|| data
.type
!= 0 || data
.major
!= (unsigned) -1 || data
.minor
!= (unsigned) -1)
1052 json_log(v
, flags
|JSON_WARNING
, 0, "Devices cgroup whitelist with arbitrary 'allow' entries not supported, ignoring.");
1054 /* We ignore the 'deny' entry as for us that's implied */
1058 if (!data
.r
&& !data
.w
&& !data
.m
) {
1059 json_log(v
, flags
|LOG_WARNING
, 0, "Device cgroup whitelist entry with no effect found, ignoring.");
1063 if (data
.minor
!= (unsigned) -1 && data
.major
== (unsigned) -1)
1064 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
1065 "Device cgroup whitelist entries with minors but no majors not supported.");
1067 if (data
.major
!= (unsigned) -1 && data
.type
== 0)
1068 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
1069 "Device cgroup whitelist entries with majors but no device node type not supported.");
1071 if (data
.type
== 0) {
1072 if (data
.r
&& data
.w
&& data
.m
) /* a catchall whitelist entry means we are looking at a noop */
1075 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
1076 "Device cgroup whitelist entries with no type not supported.");
1079 a
= reallocarray(list
, n_list
+ 1, sizeof(struct device_data
));
1084 list
[n_list
++] = data
;
1090 r
= settings_allocate_properties(s
);
1094 r
= sd_bus_message_open_container(s
->properties
, 'r', "sv");
1096 return bus_log_create_error(r
);
1098 r
= sd_bus_message_append(s
->properties
, "s", "DeviceAllow");
1100 return bus_log_create_error(r
);
1102 r
= sd_bus_message_open_container(s
->properties
, 'v', "a(ss)");
1104 return bus_log_create_error(r
);
1106 r
= sd_bus_message_open_container(s
->properties
, 'a', "(ss)");
1108 return bus_log_create_error(r
);
1110 for (i
= 0; i
< n_list
; i
++) {
1111 _cleanup_free_
char *pattern
= NULL
;
1115 if (list
[i
].minor
== (unsigned) -1) {
1118 if (list
[i
].type
== S_IFBLK
)
1121 assert(list
[i
].type
== S_IFCHR
);
1125 if (list
[i
].major
== (unsigned) -1) {
1126 pattern
= strjoin(t
, "-*");
1130 if (asprintf(&pattern
, "%s-%u", t
, list
[i
].major
) < 0)
1135 assert(list
[i
].major
!= (unsigned) -1); /* If a minor is specified, then a major also needs to be specified */
1137 r
= device_path_make_major_minor(list
[i
].type
, makedev(list
[i
].major
, list
[i
].minor
), &pattern
);
1152 r
= sd_bus_message_append(s
->properties
, "(ss)", pattern
, access
);
1154 return bus_log_create_error(r
);
1157 r
= sd_bus_message_close_container(s
->properties
);
1159 return bus_log_create_error(r
);
1161 r
= sd_bus_message_close_container(s
->properties
);
1163 return bus_log_create_error(r
);
1165 r
= sd_bus_message_close_container(s
->properties
);
1167 return bus_log_create_error(r
);
1172 static int oci_cgroup_memory_limit(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1173 uint64_t *m
= userdata
;
1178 if (json_variant_is_negative(v
)) {
1183 if (!json_variant_is_unsigned(v
))
1184 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1185 "Memory limit is not an unsigned integer");
1187 k
= json_variant_unsigned(v
);
1188 if (k
>= UINT64_MAX
)
1189 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1190 "Memory limit too large: %ji", k
);
1196 static int oci_cgroup_memory(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1198 struct memory_data
{
1200 uint64_t reservation
;
1203 .limit
= UINT64_MAX
,
1204 .reservation
= UINT64_MAX
,
1208 static const JsonDispatch table
[] = {
1209 { "limit", JSON_VARIANT_NUMBER
, oci_cgroup_memory_limit
, offsetof(struct memory_data
, limit
), 0 },
1210 { "reservation", JSON_VARIANT_NUMBER
, oci_cgroup_memory_limit
, offsetof(struct memory_data
, reservation
), 0 },
1211 { "swap", JSON_VARIANT_NUMBER
, oci_cgroup_memory_limit
, offsetof(struct memory_data
, swap
), 0 },
1212 { "kernel", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1213 { "kernelTCP", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1214 { "swapiness", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1215 { "disableOOMKiller", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1219 Settings
*s
= userdata
;
1222 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &data
);
1226 if (data
.swap
!= UINT64_MAX
) {
1227 if (data
.limit
== UINT64_MAX
)
1228 json_log(v
, flags
|LOG_WARNING
, 0, "swap limit without memory limit is not supported, ignoring.");
1229 else if (data
.swap
< data
.limit
)
1230 json_log(v
, flags
|LOG_WARNING
, 0, "swap limit is below memory limit, ignoring.");
1232 r
= settings_allocate_properties(s
);
1236 r
= sd_bus_message_append(s
->properties
, "(sv)", "MemorySwapMax", "t", data
.swap
- data
.limit
);
1238 return bus_log_create_error(r
);
1242 if (data
.limit
!= UINT64_MAX
) {
1243 r
= settings_allocate_properties(s
);
1247 r
= sd_bus_message_append(s
->properties
, "(sv)", "MemoryMax", "t", data
.limit
);
1249 return bus_log_create_error(r
);
1252 if (data
.reservation
!= UINT64_MAX
) {
1253 r
= settings_allocate_properties(s
);
1257 r
= sd_bus_message_append(s
->properties
, "(sv)", "MemoryLow", "t", data
.reservation
);
1259 return bus_log_create_error(r
);
1272 static int oci_cgroup_cpu_shares(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1273 uint64_t *u
= userdata
;
1278 k
= json_variant_unsigned(v
);
1279 if (k
< CGROUP_CPU_SHARES_MIN
|| k
> CGROUP_CPU_SHARES_MAX
)
1280 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1281 "shares value out of range.");
1287 static int oci_cgroup_cpu_quota(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1288 uint64_t *u
= userdata
;
1293 k
= json_variant_unsigned(v
);
1294 if (k
<= 0 || k
>= UINT64_MAX
)
1295 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1296 "period/quota value out of range.");
1302 static int oci_cgroup_cpu_cpus(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1303 struct cpu_data
*data
= userdata
;
1310 assert_se(n
= json_variant_string(v
));
1312 r
= parse_cpu_set(n
, &set
);
1314 return json_log(v
, flags
, r
, "Failed to parse CPU set specification: %s", n
);
1316 cpu_set_reset(&data
->cpu_set
);
1317 data
->cpu_set
= set
;
1322 static int oci_cgroup_cpu(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1324 static const JsonDispatch table
[] = {
1325 { "shares", JSON_VARIANT_UNSIGNED
, oci_cgroup_cpu_shares
, offsetof(struct cpu_data
, shares
), 0 },
1326 { "quota", JSON_VARIANT_UNSIGNED
, oci_cgroup_cpu_quota
, offsetof(struct cpu_data
, quota
), 0 },
1327 { "period", JSON_VARIANT_UNSIGNED
, oci_cgroup_cpu_quota
, offsetof(struct cpu_data
, period
), 0 },
1328 { "realtimeRuntime", JSON_VARIANT_UNSIGNED
, oci_unsupported
, 0, 0 },
1329 { "realtimePeriod", JSON_VARIANT_UNSIGNED
, oci_unsupported
, 0, 0 },
1330 { "cpus", JSON_VARIANT_STRING
, oci_cgroup_cpu_cpus
, 0, 0 },
1331 { "mems", JSON_VARIANT_STRING
, oci_unsupported
, 0, 0 },
1335 struct cpu_data data
= {
1336 .shares
= UINT64_MAX
,
1337 .quota
= UINT64_MAX
,
1338 .period
= UINT64_MAX
,
1341 Settings
*s
= userdata
;
1344 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &data
);
1346 cpu_set_reset(&data
.cpu_set
);
1350 cpu_set_reset(&s
->cpu_set
);
1351 s
->cpu_set
= data
.cpu_set
;
1353 if (data
.shares
!= UINT64_MAX
) {
1354 r
= settings_allocate_properties(s
);
1358 r
= sd_bus_message_append(s
->properties
, "(sv)", "CPUShares", "t", data
.shares
);
1360 return bus_log_create_error(r
);
1363 if (data
.quota
!= UINT64_MAX
&& data
.period
!= UINT64_MAX
) {
1364 r
= settings_allocate_properties(s
);
1368 r
= sd_bus_message_append(s
->properties
, "(sv)", "CPUQuotaPerSecUSec", "t", (uint64_t) (data
.quota
* USEC_PER_SEC
/ data
.period
));
1370 return bus_log_create_error(r
);
1372 } else if ((data
.quota
!= UINT64_MAX
) != (data
.period
!= UINT64_MAX
))
1373 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1374 "CPU quota and period not used together.");
1379 static int oci_cgroup_block_io_weight(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1380 Settings
*s
= userdata
;
1386 k
= json_variant_unsigned(v
);
1387 if (k
< CGROUP_BLKIO_WEIGHT_MIN
|| k
> CGROUP_BLKIO_WEIGHT_MAX
)
1388 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1389 "Block I/O weight out of range.");
1391 r
= settings_allocate_properties(s
);
1395 r
= sd_bus_message_append(s
->properties
, "(sv)", "BlockIOWeight", "t", (uint64_t) k
);
1397 return bus_log_create_error(r
);
1402 static int oci_cgroup_block_io_weight_device(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1403 Settings
*s
= userdata
;
1409 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1410 struct device_data
{
1415 .major
= (unsigned) -1,
1416 .minor
= (unsigned) -1,
1417 .weight
= UINTMAX_MAX
,
1420 static const JsonDispatch table
[] = {
1421 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(struct device_data
, major
), JSON_MANDATORY
},
1422 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(struct device_data
, minor
), JSON_MANDATORY
},
1423 { "weight", JSON_VARIANT_UNSIGNED
, json_dispatch_unsigned
, offsetof(struct device_data
, weight
), 0 },
1424 { "leafWeight", JSON_VARIANT_INTEGER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1428 _cleanup_free_
char *path
= NULL
;
1430 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
1434 if (data
.weight
== UINTMAX_MAX
)
1437 if (data
.weight
< CGROUP_BLKIO_WEIGHT_MIN
|| data
.weight
> CGROUP_BLKIO_WEIGHT_MAX
)
1438 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1439 "Block I/O device weight out of range.");
1441 r
= device_path_make_major_minor(S_IFBLK
, makedev(data
.major
, data
.minor
), &path
);
1443 return json_log(v
, flags
, r
, "Failed to build device path: %m");
1445 r
= settings_allocate_properties(s
);
1449 r
= sd_bus_message_append(s
->properties
, "(sv)", "BlockIODeviceWeight", "a(st)", 1, path
, (uint64_t) data
.weight
);
1451 return bus_log_create_error(r
);
1457 static int oci_cgroup_block_io_throttle(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1458 Settings
*s
= userdata
;
1465 pname
= streq(name
, "throttleReadBpsDevice") ? "IOReadBandwidthMax" :
1466 streq(name
, "throttleWriteBpsDevice") ? "IOWriteBandwidthMax" :
1467 streq(name
, "throttleReadIOPSDevice") ? "IOReadIOPSMax" :
1470 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1471 struct device_data
{
1476 .major
= (unsigned) -1,
1477 .minor
= (unsigned) -1,
1480 static const JsonDispatch table
[] = {
1481 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(struct device_data
, major
), JSON_MANDATORY
},
1482 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(struct device_data
, minor
), JSON_MANDATORY
},
1483 { "rate", JSON_VARIANT_UNSIGNED
, json_dispatch_unsigned
, offsetof(struct device_data
, rate
), JSON_MANDATORY
},
1487 _cleanup_free_
char *path
= NULL
;
1489 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
1493 if (data
.rate
>= UINT64_MAX
)
1494 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1495 "Block I/O device rate out of range.");
1497 r
= device_path_make_major_minor(S_IFBLK
, makedev(data
.major
, data
.minor
), &path
);
1499 return json_log(v
, flags
, r
, "Failed to build device path: %m");
1501 r
= settings_allocate_properties(s
);
1505 r
= sd_bus_message_append(s
->properties
, "(sv)", pname
, "a(st)", 1, path
, (uint64_t) data
.rate
);
1507 return bus_log_create_error(r
);
1513 static int oci_cgroup_block_io(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1515 static const JsonDispatch table
[] = {
1516 { "weight", JSON_VARIANT_UNSIGNED
, oci_cgroup_block_io_weight
, 0, 0 },
1517 { "leafWeight", JSON_VARIANT_UNSIGNED
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1518 { "weightDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_weight_device
, 0, 0 },
1519 { "throttleReadBpsDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1520 { "throttleWriteBpsDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1521 { "throttleReadIOPSDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1522 { "throttleWriteIOPSDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1526 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
1529 static int oci_cgroup_pids(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1531 static const JsonDispatch table
[] = {
1532 { "limit", JSON_VARIANT_NUMBER
, json_dispatch_variant
, 0, JSON_MANDATORY
},
1536 _cleanup_(json_variant_unrefp
) JsonVariant
*k
= NULL
;
1537 Settings
*s
= userdata
;
1543 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &k
);
1547 if (json_variant_is_negative(k
))
1550 if (!json_variant_is_unsigned(k
))
1551 return json_log(k
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1552 "pids limit not unsigned integer, refusing.");
1554 m
= (uint64_t) json_variant_unsigned(k
);
1556 if ((uintmax_t) m
!= json_variant_unsigned(k
))
1557 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1558 "pids limit out of range, refusing.");
1561 r
= settings_allocate_properties(s
);
1565 r
= sd_bus_message_append(s
->properties
, "(sv)", "TasksMax", "t", m
);
1567 return bus_log_create_error(r
);
1572 static int oci_resources(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1574 static const JsonDispatch table
[] = {
1575 { "devices", JSON_VARIANT_ARRAY
, oci_cgroup_devices
, 0, 0 },
1576 { "memory", JSON_VARIANT_OBJECT
, oci_cgroup_memory
, 0, 0 },
1577 { "cpu", JSON_VARIANT_OBJECT
, oci_cgroup_cpu
, 0, 0 },
1578 { "blockIO", JSON_VARIANT_OBJECT
, oci_cgroup_block_io
, 0, 0 },
1579 { "hugepageLimits", JSON_VARIANT_ARRAY
, oci_unsupported
, 0, 0 },
1580 { "network", JSON_VARIANT_OBJECT
, oci_unsupported
, 0, 0 },
1581 { "pids", JSON_VARIANT_OBJECT
, oci_cgroup_pids
, 0, 0 },
1582 { "rdma", JSON_VARIANT_OBJECT
, oci_unsupported
, 0, 0 },
1586 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
1589 static bool sysctl_key_valid(const char *s
) {
1592 /* Note that we are a bit stricter here than in systemd-sysctl, as that inherited semantics from the old sysctl
1593 * tool, which were really weird (as it swaps / and . in both ways) */
1600 if (*s
<= ' ' || *s
>= 127)
1606 if (dot
) /* Don't allow two dots next to each other (or at the beginning) */
1614 if (dot
) /* don't allow a dot at the end */
1620 static int oci_sysctl(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1621 Settings
*s
= userdata
;
1628 JSON_VARIANT_OBJECT_FOREACH(k
, w
, v
) {
1631 if (!json_variant_is_string(w
))
1632 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1633 "sysctl parameter is not a string, refusing.");
1635 assert_se(m
= json_variant_string(w
));
1637 if (sysctl_key_valid(k
))
1638 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1639 "sysctl key invalid, refusing: %s", k
);
1641 r
= strv_extend_strv(&s
->sysctl
, STRV_MAKE(k
, m
), false);
1650 static int oci_seccomp_action_from_string(const char *name
, uint32_t *ret
) {
1652 static const struct {
1656 { "SCMP_ACT_ALLOW", SCMP_ACT_ALLOW
},
1657 { "SCMP_ACT_ERRNO", SCMP_ACT_ERRNO(EPERM
) }, /* the OCI spec doesn't document the error, but it appears EPERM is supposed to be used */
1658 { "SCMP_ACT_KILL", SCMP_ACT_KILL
},
1659 #ifdef SCMP_ACT_KILL_PROCESS
1660 { "SCMP_ACT_KILL_PROCESS", SCMP_ACT_KILL_PROCESS
},
1662 #ifdef SCMP_ACT_KILL_THREAD
1663 { "SCMP_ACT_KILL_THREAD", SCMP_ACT_KILL_THREAD
},
1666 { "SCMP_ACT_LOG", SCMP_ACT_LOG
},
1668 { "SCMP_ACT_TRAP", SCMP_ACT_TRAP
},
1670 /* We don't support SCMP_ACT_TRACE because that requires a tracer, and that doesn't really make sense
1676 for (i
= 0; i
< ELEMENTSOF(table
); i
++)
1677 if (streq_ptr(name
, table
[i
].name
)) {
1678 *ret
= table
[i
].action
;
1685 static int oci_seccomp_arch_from_string(const char *name
, uint32_t *ret
) {
1687 static const struct {
1691 { "SCMP_ARCH_AARCH64", SCMP_ARCH_AARCH64
},
1692 { "SCMP_ARCH_ARM", SCMP_ARCH_ARM
},
1693 { "SCMP_ARCH_MIPS", SCMP_ARCH_MIPS
},
1694 { "SCMP_ARCH_MIPS64", SCMP_ARCH_MIPS64
},
1695 { "SCMP_ARCH_MIPS64N32", SCMP_ARCH_MIPS64N32
},
1696 { "SCMP_ARCH_MIPSEL", SCMP_ARCH_MIPSEL
},
1697 { "SCMP_ARCH_MIPSEL64", SCMP_ARCH_MIPSEL64
},
1698 { "SCMP_ARCH_MIPSEL64N32", SCMP_ARCH_MIPSEL64N32
},
1699 { "SCMP_ARCH_NATIVE", SCMP_ARCH_NATIVE
},
1700 #ifdef SCMP_ARCH_PARISC
1701 { "SCMP_ARCH_PARISC", SCMP_ARCH_PARISC
},
1703 #ifdef SCMP_ARCH_PARISC64
1704 { "SCMP_ARCH_PARISC64", SCMP_ARCH_PARISC64
},
1706 { "SCMP_ARCH_PPC", SCMP_ARCH_PPC
},
1707 { "SCMP_ARCH_PPC64", SCMP_ARCH_PPC64
},
1708 { "SCMP_ARCH_PPC64LE", SCMP_ARCH_PPC64LE
},
1709 { "SCMP_ARCH_S390", SCMP_ARCH_S390
},
1710 { "SCMP_ARCH_S390X", SCMP_ARCH_S390X
},
1711 { "SCMP_ARCH_X32", SCMP_ARCH_X32
},
1712 { "SCMP_ARCH_X86", SCMP_ARCH_X86
},
1713 { "SCMP_ARCH_X86_64", SCMP_ARCH_X86_64
},
1718 for (i
= 0; i
< ELEMENTSOF(table
); i
++)
1719 if (streq_ptr(table
[i
].name
, name
)) {
1720 *ret
= table
[i
].arch
;
1727 static int oci_seccomp_compare_from_string(const char *name
, enum scmp_compare
*ret
) {
1729 static const struct {
1731 enum scmp_compare op
;
1733 { "SCMP_CMP_NE", SCMP_CMP_NE
},
1734 { "SCMP_CMP_LT", SCMP_CMP_LT
},
1735 { "SCMP_CMP_LE", SCMP_CMP_LE
},
1736 { "SCMP_CMP_EQ", SCMP_CMP_EQ
},
1737 { "SCMP_CMP_GE", SCMP_CMP_GE
},
1738 { "SCMP_CMP_GT", SCMP_CMP_GT
},
1739 { "SCMP_CMP_MASKED_EQ", SCMP_CMP_MASKED_EQ
},
1744 for (i
= 0; i
< ELEMENTSOF(table
); i
++)
1745 if (streq_ptr(table
[i
].name
, name
)) {
1753 static int oci_seccomp_archs(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1754 scmp_filter_ctx
*sc
= userdata
;
1760 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1763 if (!json_variant_is_string(e
))
1764 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1765 "Architecture entry is not a string");
1767 r
= oci_seccomp_arch_from_string(json_variant_string(e
), &a
);
1769 return json_log(e
, flags
, r
, "Unknown architecture: %s", json_variant_string(e
));
1771 r
= seccomp_arch_add(sc
, a
);
1775 return json_log(e
, flags
, r
, "Failed to add architecture to seccomp filter: %m");
1781 struct syscall_rule
{
1784 struct scmp_arg_cmp
*arguments
;
1788 static void syscall_rule_free(struct syscall_rule
*rule
) {
1791 strv_free(rule
->names
);
1792 free(rule
->arguments
);
1795 static int oci_seccomp_action(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1796 uint32_t *action
= userdata
;
1801 r
= oci_seccomp_action_from_string(json_variant_string(v
), action
);
1803 return json_log(v
, flags
, r
, "Unknown system call action '%s': %m", json_variant_string(v
));
1808 static int oci_seccomp_op(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1809 enum scmp_compare
*op
= userdata
;
1814 r
= oci_seccomp_compare_from_string(json_variant_string(v
), op
);
1816 return json_log(v
, flags
, r
, "Unknown seccomp operator '%s': %m", json_variant_string(v
));
1821 static int oci_seccomp_args(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1822 struct syscall_rule
*rule
= userdata
;
1828 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1829 static const struct JsonDispatch table
[] = {
1830 { "index", JSON_VARIANT_UNSIGNED
, json_dispatch_uint32
, offsetof(struct scmp_arg_cmp
, arg
), JSON_MANDATORY
},
1831 { "value", JSON_VARIANT_UNSIGNED
, json_dispatch_uint64
, offsetof(struct scmp_arg_cmp
, datum_a
), JSON_MANDATORY
},
1832 { "valueTwo", JSON_VARIANT_UNSIGNED
, json_dispatch_uint64
, offsetof(struct scmp_arg_cmp
, datum_b
), 0 },
1833 { "op", JSON_VARIANT_STRING
, oci_seccomp_op
, offsetof(struct scmp_arg_cmp
, op
), JSON_MANDATORY
},
1837 struct scmp_arg_cmp
*a
, *p
;
1840 a
= reallocarray(rule
->arguments
, rule
->n_arguments
+ 1, sizeof(struct syscall_rule
));
1844 rule
->arguments
= a
;
1845 p
= rule
->arguments
+ rule
->n_arguments
;
1847 *p
= (struct scmp_arg_cmp
) {
1854 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, p
);
1858 expected
= p
->op
== SCMP_CMP_MASKED_EQ
? 4 : 3;
1860 json_log(e
, flags
|JSON_WARNING
, 0, "Wrong number of system call arguments for JSON data data, ignoring.");
1862 /* Note that we are a bit sloppy here and do not insist that SCMP_CMP_MASKED_EQ gets two datum values,
1863 * and the other only one. That's because buildah for example by default calls things with
1864 * SCMP_CMP_MASKED_EQ but only one argument. We use 0 when the value is not specified. */
1866 rule
->n_arguments
++;
1872 static int oci_seccomp_syscalls(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1873 scmp_filter_ctx
*sc
= userdata
;
1879 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1880 static const JsonDispatch table
[] = {
1881 { "names", JSON_VARIANT_ARRAY
, json_dispatch_strv
, offsetof(struct syscall_rule
, names
), JSON_MANDATORY
},
1882 { "action", JSON_VARIANT_STRING
, oci_seccomp_action
, offsetof(struct syscall_rule
, action
), JSON_MANDATORY
},
1883 { "args", JSON_VARIANT_ARRAY
, oci_seccomp_args
, 0, 0 },
1885 struct syscall_rule rule
= {
1886 .action
= (uint32_t) -1,
1890 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &rule
);
1894 if (strv_isempty(rule
.names
)) {
1895 json_log(e
, flags
, 0, "System call name list is empty.");
1900 STRV_FOREACH(i
, rule
.names
) {
1903 nr
= seccomp_syscall_resolve_name(*i
);
1904 if (nr
== __NR_SCMP_ERROR
) {
1905 log_debug("Unknown syscall %s, skipping.", *i
);
1909 r
= seccomp_rule_add_array(sc
, rule
.action
, nr
, rule
.n_arguments
, rule
.arguments
);
1914 syscall_rule_free(&rule
);
1918 syscall_rule_free(&rule
);
1926 static int oci_seccomp(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1929 static const JsonDispatch table
[] = {
1930 { "defaultAction", JSON_VARIANT_STRING
, NULL
, 0, JSON_MANDATORY
},
1931 { "architectures", JSON_VARIANT_ARRAY
, oci_seccomp_archs
, 0, 0 },
1932 { "syscalls", JSON_VARIANT_ARRAY
, oci_seccomp_syscalls
, 0, 0 },
1936 _cleanup_(seccomp_releasep
) scmp_filter_ctx sc
= NULL
;
1937 Settings
*s
= userdata
;
1944 def
= json_variant_by_key(v
, "defaultAction");
1946 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
), "defaultAction element missing.");
1948 if (!json_variant_is_string(def
))
1949 return json_log(def
, flags
, SYNTHETIC_ERRNO(EINVAL
), "defaultAction is not a string.");
1951 r
= oci_seccomp_action_from_string(json_variant_string(def
), &d
);
1953 return json_log(def
, flags
, r
, "Unknown default action: %s", json_variant_string(def
));
1955 sc
= seccomp_init(d
);
1957 return json_log(v
, flags
, SYNTHETIC_ERRNO(ENOMEM
), "Couldn't allocate seccomp object.");
1959 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, sc
);
1963 seccomp_release(s
->seccomp
);
1964 s
->seccomp
= TAKE_PTR(sc
);
1967 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
), "libseccomp support not enabled, can't parse seccomp object.");
1971 static int oci_rootfs_propagation(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1974 s
= json_variant_string(v
);
1976 if (streq(s
, "shared"))
1979 json_log(v
, flags
|JSON_DEBUG
, 0, "Ignoring rootfsPropagation setting '%s'.", s
);
1983 static int oci_masked_paths(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1984 Settings
*s
= userdata
;
1989 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1990 _cleanup_free_
char *destination
= NULL
;
1994 if (!json_variant_is_string(e
))
1995 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1996 "Path is not a string, refusing.");
1998 assert_se(p
= json_variant_string(e
));
2000 if (!path_is_absolute(p
))
2001 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2002 "Path is not not absolute, refusing: %s", p
);
2004 if (oci_exclude_mount(p
))
2007 destination
= strdup(p
);
2011 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_INACCESSIBLE
);
2015 m
->destination
= TAKE_PTR(destination
);
2017 /* The spec doesn't say this, but apparently pre-existing implementations are lenient towards
2018 * non-existing paths to mask. Let's hence be too. */
2025 static int oci_readonly_paths(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2026 Settings
*s
= userdata
;
2031 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
2032 _cleanup_free_
char *source
= NULL
, *destination
= NULL
;
2036 if (!json_variant_is_string(e
))
2037 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2038 "Path is not a string, refusing.");
2040 assert_se(p
= json_variant_string(e
));
2042 if (!path_is_absolute(p
))
2043 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2044 "Path is not not absolute, refusing: %s", p
);
2046 if (oci_exclude_mount(p
))
2049 source
= strjoin("+", p
);
2053 destination
= strdup(p
);
2057 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_BIND
);
2061 m
->source
= TAKE_PTR(source
);
2062 m
->destination
= TAKE_PTR(destination
);
2063 m
->read_only
= true;
2069 static int oci_linux(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2071 static const JsonDispatch table
[] = {
2072 { "namespaces", JSON_VARIANT_ARRAY
, oci_namespaces
, 0, 0 },
2073 { "uidMappings", JSON_VARIANT_ARRAY
, oci_uid_gid_mappings
, 0, 0 },
2074 { "gidMappings", JSON_VARIANT_ARRAY
, oci_uid_gid_mappings
, 0, 0 },
2075 { "devices", JSON_VARIANT_ARRAY
, oci_devices
, 0, 0 },
2076 { "cgroupsPath", JSON_VARIANT_STRING
, oci_cgroups_path
, 0, 0 },
2077 { "resources", JSON_VARIANT_OBJECT
, oci_resources
, 0, 0 },
2078 { "intelRdt", JSON_VARIANT_OBJECT
, oci_unsupported
, 0, JSON_PERMISSIVE
},
2079 { "sysctl", JSON_VARIANT_OBJECT
, oci_sysctl
, 0, 0 },
2080 { "seccomp", JSON_VARIANT_OBJECT
, oci_seccomp
, 0, 0 },
2081 { "rootfsPropagation", JSON_VARIANT_STRING
, oci_rootfs_propagation
, 0, 0 },
2082 { "maskedPaths", JSON_VARIANT_ARRAY
, oci_masked_paths
, 0, 0 },
2083 { "readonlyPaths", JSON_VARIANT_ARRAY
, oci_readonly_paths
, 0, 0 },
2084 { "mountLabel", JSON_VARIANT_STRING
, oci_unsupported
, 0, JSON_PERMISSIVE
},
2088 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
2091 static int oci_hook_timeout(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2092 usec_t
*u
= userdata
;
2095 k
= json_variant_unsigned(v
);
2097 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2098 "Hook timeout cannot be zero.");
2100 if (k
> (UINT64_MAX
-1/USEC_PER_SEC
))
2101 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2102 "Hook timeout too large.");
2104 *u
= k
* USEC_PER_SEC
;
2108 static int oci_hooks_array(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2109 Settings
*s
= userdata
;
2115 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
2117 static const JsonDispatch table
[] = {
2118 { "path", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(OciHook
, path
), JSON_MANDATORY
},
2119 { "args", JSON_VARIANT_ARRAY
, oci_args
, offsetof(OciHook
, args
), 0 },
2120 { "env", JSON_VARIANT_ARRAY
, oci_env
, offsetof(OciHook
, env
), 0 },
2121 { "timeout", JSON_VARIANT_UNSIGNED
, oci_hook_timeout
, offsetof(OciHook
, timeout
), 0 },
2125 OciHook
*a
, **array
, *new_item
;
2128 if (streq(name
, "prestart")) {
2129 array
= &s
->oci_hooks_prestart
;
2130 n_array
= &s
->n_oci_hooks_prestart
;
2131 } else if (streq(name
, "poststart")) {
2132 array
= &s
->oci_hooks_poststart
;
2133 n_array
= &s
->n_oci_hooks_poststart
;
2135 assert(streq(name
, "poststop"));
2136 array
= &s
->oci_hooks_poststop
;
2137 n_array
= &s
->n_oci_hooks_poststop
;
2140 a
= reallocarray(*array
, *n_array
+ 1, sizeof(OciHook
));
2145 new_item
= a
+ *n_array
;
2147 *new_item
= (OciHook
) {
2148 .timeout
= USEC_INFINITY
,
2151 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, userdata
);
2153 free(new_item
->path
);
2154 strv_free(new_item
->args
);
2155 strv_free(new_item
->env
);
2165 static int oci_hooks(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2167 static const JsonDispatch table
[] = {
2168 { "prestart", JSON_VARIANT_OBJECT
, oci_hooks_array
, 0, 0 },
2169 { "poststart", JSON_VARIANT_OBJECT
, oci_hooks_array
, 0, 0 },
2170 { "poststop", JSON_VARIANT_OBJECT
, oci_hooks_array
, 0, 0 },
2174 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
2177 static int oci_annotations(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2181 JSON_VARIANT_OBJECT_FOREACH(k
, w
, v
) {
2184 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2185 "Annotation with empty key, refusing.");
2187 if (!json_variant_is_string(w
))
2188 return json_log(w
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2189 "Annotation has non-string value, refusing.");
2191 json_log(w
, flags
|JSON_DEBUG
, 0, "Ignoring annotation '%s' with value '%s'.", k
, json_variant_string(w
));
2197 int oci_load(FILE *f
, const char *bundle
, Settings
**ret
) {
2199 static const JsonDispatch table
[] = {
2200 { "ociVersion", JSON_VARIANT_STRING
, NULL
, 0, JSON_MANDATORY
},
2201 { "process", JSON_VARIANT_OBJECT
, oci_process
, 0, 0 },
2202 { "root", JSON_VARIANT_OBJECT
, oci_root
, 0, 0 },
2203 { "hostname", JSON_VARIANT_STRING
, oci_hostname
, 0, 0 },
2204 { "mounts", JSON_VARIANT_ARRAY
, oci_mounts
, 0, 0 },
2205 { "linux", JSON_VARIANT_OBJECT
, oci_linux
, 0, 0 },
2206 { "hooks", JSON_VARIANT_OBJECT
, oci_hooks
, 0, 0 },
2207 { "annotations", JSON_VARIANT_OBJECT
, oci_annotations
, 0, 0 },
2211 _cleanup_(json_variant_unrefp
) JsonVariant
*oci
= NULL
;
2212 _cleanup_(settings_freep
) Settings
*s
= NULL
;
2213 unsigned line
= 0, column
= 0;
2220 path
= strjoina(bundle
, "/config.json");
2222 r
= json_parse_file(f
, path
, &oci
, &line
, &column
);
2224 if (line
!= 0 && column
!= 0)
2225 return log_error_errno(r
, "Failed to parse '%s' at %u:%u: %m", path
, line
, column
);
2227 return log_error_errno(r
, "Failed to parse '%s': %m", path
);
2230 v
= json_variant_by_key(oci
, "ociVersion");
2232 log_error("JSON file '%s' is not an OCI bundle configuration file. Refusing.", path
);
2235 if (!streq_ptr(json_variant_string(v
), "1.0.0")) {
2236 log_error("OCI bundle version not supported: %s", strna(json_variant_string(v
)));
2241 // _cleanup_free_ char *formatted = NULL;
2242 // assert_se(json_variant_format(oci, JSON_FORMAT_PRETTY|JSON_FORMAT_COLOR, &formatted) >= 0);
2243 // fputs(formatted, stdout);
2250 s
->start_mode
= START_PID1
;
2251 s
->resolv_conf
= RESOLV_CONF_OFF
;
2252 s
->link_journal
= LINK_NO
;
2253 s
->timezone
= TIMEZONE_OFF
;
2255 s
->bundle
= strdup(bundle
);
2259 r
= json_dispatch(oci
, table
, oci_unexpected
, 0, s
);
2263 if (s
->properties
) {
2264 r
= sd_bus_message_seal(s
->properties
, 0, 0);
2266 return log_error_errno(r
, "Cannot seal properties bus message: %m");