]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
copy: change the various copy_xyz() calls to take a unified flags parameter
[thirdparty/systemd.git] / src / nspawn / nspawn.c
CommitLineData
88213476
LP		 1/***
2 This file is part of systemd.
3
4 Copyright 2010 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
5430f7f2
LP		 7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
88213476
LP		 9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2 14 Lesser General Public License for more details.
88213476 15
5430f7f2 16 You should have received a copy of the GNU Lesser General Public License
88213476
LP		 17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18***/
19
8fe0087e
LP		 20#ifdef HAVE_BLKID
21#include <blkid/blkid.h>
22#endif
88213476 23#include <errno.h>
88213476 24#include <getopt.h>
0e7ac751 25#include <grp.h>
1b9e5b12 26#include <linux/loop.h>
0e7ac751 27#include <pwd.h>
8fe0087e 28#include <sched.h>
8fe0087e
LP		 29#ifdef HAVE_SELINUX
30#include <selinux/selinux.h>
1b9e5b12 31#endif
8fe0087e
LP		 32#include <signal.h>
33#include <stdio.h>
34#include <stdlib.h>
35#include <string.h>
36#include <sys/file.h>
37#include <sys/mount.h>
38#include <sys/personality.h>
39#include <sys/prctl.h>
40#include <sys/types.h>
6916b164 41#include <sys/wait.h>
8fe0087e 42#include <unistd.h>
1b9e5b12 43
1f0cd86b 44#include "sd-daemon.h"
1f0cd86b 45#include "sd-id128.h"
8fe0087e 46
b5efdb8a 47#include "alloc-util.h"
8fe0087e
LP		 48#include "barrier.h"
49#include "base-filesystem.h"
50#include "blkid-util.h"
51#include "btrfs-util.h"
8fe0087e 52#include "cap-list.h"
430f0182 53#include "capability-util.h"
04d391da 54#include "cgroup-util.h"
8fe0087e 55#include "copy.h"
4fc9982c 56#include "dev-setup.h"
2d845785 57#include "dissect-image.h"
8fe0087e 58#include "env-util.h"
3ffd4af2 59#include "fd-util.h"
842f3b0f 60#include "fdset.h"
a5c32cff 61#include "fileio.h"
f97b34a6 62#include "format-util.h"
f4f15635 63#include "fs-util.h"
1b9e5b12 64#include "gpt.h"
4623e8e6 65#include "hexdecoct.h"
8fe0087e 66#include "hostname-util.h"
910fd145 67#include "id128-util.h"
8fe0087e 68#include "log.h"
2d845785 69#include "loop-util.h"
8fe0087e 70#include "loopback-setup.h"
1b9cebf6 71#include "machine-image.h"
8fe0087e
LP		 72#include "macro.h"
73#include "missing.h"
74#include "mkdir.h"
4349cd7c 75#include "mount-util.h"
8fe0087e 76#include "netlink-util.h"
07630cea
LP		 77#include "nspawn-cgroup.h"
78#include "nspawn-expose-ports.h"
79#include "nspawn-mount.h"
80#include "nspawn-network.h"
7336138e 81#include "nspawn-patch-uid.h"
07630cea 82#include "nspawn-register.h"
910fd145 83#include "nspawn-seccomp.h"
07630cea
LP		 84#include "nspawn-settings.h"
85#include "nspawn-setuid.h"
7732f92b 86#include "nspawn-stub-pid1.h"
6bedfcbb 87#include "parse-util.h"
8fe0087e 88#include "path-util.h"
0b452006 89#include "process-util.h"
8fe0087e
LP		 90#include "ptyfwd.h"
91#include "random-util.h"
8869a0b4 92#include "raw-clone.h"
8fe0087e 93#include "rm-rf.h"
68b02049 94#include "selinux-util.h"
8fe0087e 95#include "signal-util.h"
2583fbea 96#include "socket-util.h"
8fcde012 97#include "stat-util.h"
15a5e950 98#include "stdio-util.h"
07630cea 99#include "string-util.h"
8fe0087e
LP		 100#include "strv.h"
101#include "terminal-util.h"
102#include "udev-util.h"
affb60b1 103#include "umask-util.h"
b1d4f8e1 104#include "user-util.h"
8fe0087e 105#include "util.h"
e9642be2 106
0e7ac751 107/* Note that devpts's gid= parameter parses GIDs as signed values, hence we stay away from the upper half of the 32bit
065d31c3
LP		 108 * UID range here. We leave a bit of room at the lower end and a lot of room at the upper end, so that other subsystems
109 * may have their own allocation ranges too. */
0e7ac751
LP		 110#define UID_SHIFT_PICK_MIN ((uid_t) UINT32_C(0x00080000))
111#define UID_SHIFT_PICK_MAX ((uid_t) UINT32_C(0x6FFF0000))
065d31c3 112
9c1e04d0
AP		 113/* nspawn is listening on the socket at the path in the constant nspawn_notify_socket_path
114 * nspawn_notify_socket_path is relative to the container
115 * the init process in the container pid can send messages to nspawn following the sd_notify(3) protocol */
116#define NSPAWN_NOTIFY_SOCKET_PATH "/run/systemd/nspawn/notify"
0e7ac751 117
2a49b612
ZJS		 118#define EXIT_FORCE_RESTART 133
119
113cea80
DH		 120typedef enum ContainerStatus {
121 CONTAINER_TERMINATED,
122 CONTAINER_REBOOTED
123} ContainerStatus;
124
57fb9fb5
LP		 125typedef enum LinkJournal {
126 LINK_NO,
127 LINK_AUTO,
128 LINK_HOST,
129 LINK_GUEST
130} LinkJournal;
88213476
LP		 131
132static char *arg_directory = NULL;
ec16945e 133static char *arg_template = NULL;
5f932eb9 134static char *arg_chdir = NULL;
b53ede69
PW		 135static char *arg_pivot_root_new = NULL;
136static char *arg_pivot_root_old = NULL;
687d0825 137static char *arg_user = NULL;
9444b1f2 138static sd_id128_t arg_uuid = {};
7027ff61 139static char *arg_machine = NULL;
c74e630d
LP		 140static const char *arg_selinux_context = NULL;
141static const char *arg_selinux_apifs_context = NULL;
9444b1f2 142static const char *arg_slice = NULL;
ff01d048 143static bool arg_private_network = false;
bc2f673e 144static bool arg_read_only = false;
7732f92b 145static StartMode arg_start_mode = START_PID1;
ec16945e 146static bool arg_ephemeral = false;
57fb9fb5 147static LinkJournal arg_link_journal = LINK_AUTO;
574edc90 148static bool arg_link_journal_try = false;
520e0d54 149static uint64_t arg_caps_retain =
50b52222
LP		 150 (1ULL << CAP_AUDIT_CONTROL) |
151 (1ULL << CAP_AUDIT_WRITE) |
5076f0cc
LP		 152 (1ULL << CAP_CHOWN) |
153 (1ULL << CAP_DAC_OVERRIDE) |
154 (1ULL << CAP_DAC_READ_SEARCH) |
155 (1ULL << CAP_FOWNER) |
156 (1ULL << CAP_FSETID) |
157 (1ULL << CAP_IPC_OWNER) |
158 (1ULL << CAP_KILL) |
159 (1ULL << CAP_LEASE) |
160 (1ULL << CAP_LINUX_IMMUTABLE) |
50b52222 161 (1ULL << CAP_MKNOD) |
5076f0cc
LP		 162 (1ULL << CAP_NET_BIND_SERVICE) |
163 (1ULL << CAP_NET_BROADCAST) |
164 (1ULL << CAP_NET_RAW) |
5076f0cc 165 (1ULL << CAP_SETFCAP) |
50b52222 166 (1ULL << CAP_SETGID) |
5076f0cc
LP		 167 (1ULL << CAP_SETPCAP) |
168 (1ULL << CAP_SETUID) |
169 (1ULL << CAP_SYS_ADMIN) |
50b52222 170 (1ULL << CAP_SYS_BOOT) |
5076f0cc
LP		 171 (1ULL << CAP_SYS_CHROOT) |
172 (1ULL << CAP_SYS_NICE) |
173 (1ULL << CAP_SYS_PTRACE) |
d87be9b0 174 (1ULL << CAP_SYS_RESOURCE) |
50b52222 175 (1ULL << CAP_SYS_TTY_CONFIG);
5a8af538
LP		 176static CustomMount *arg_custom_mounts = NULL;
177static unsigned arg_n_custom_mounts = 0;
f4889f65 178static char **arg_setenv = NULL;
284c0b91 179static bool arg_quiet = false;
eb91eb18 180static bool arg_register = true;
89f7c846 181static bool arg_keep_unit = false;
aa28aefe 182static char **arg_network_interfaces = NULL;
c74e630d 183static char **arg_network_macvlan = NULL;
4bbfe7ad 184static char **arg_network_ipvlan = NULL;
69c79d3c 185static bool arg_network_veth = false;
f6d6bad1 186static char **arg_network_veth_extra = NULL;
f757855e 187static char *arg_network_bridge = NULL;
22b28dfd 188static char *arg_network_zone = NULL;
050f7277 189static unsigned long arg_personality = PERSONALITY_INVALID;
ec16945e 190static char *arg_image = NULL;
f757855e 191static VolatileMode arg_volatile_mode = VOLATILE_NO;
6d0b55c2 192static ExposePort *arg_expose_ports = NULL;
f36933fe 193static char **arg_property = NULL;
0de7acce 194static UserNamespaceMode arg_userns_mode = USER_NAMESPACE_NO;
6dac160c 195static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
0de7acce 196static bool arg_userns_chown = false;
c6c8f6e2 197static int arg_kill_signal = 0;
5da38d07 198static CGroupUnified arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_UNKNOWN;
f757855e
LP		 199static SettingsMask arg_settings_mask = 0;
200static int arg_settings_trusted = -1;
201static char **arg_parameters = NULL;
6aadfa4c 202static const char *arg_container_service_name = "systemd-nspawn";
9c1e04d0 203static bool arg_notify_ready = false;
5a8ff0e6 204static bool arg_use_cgns = true;
0c582db0 205static unsigned long arg_clone_ns_flags = CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS;
4f086aab 206static MountSettingsMask arg_mount_settings = MOUNT_APPLY_APIVFS_RO;
4623e8e6
LP		 207static void *arg_root_hash = NULL;
208static size_t arg_root_hash_size = 0;
88213476 209
601185b4 210static void help(void) {
88213476
LP		 211 printf("%s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
212 "Spawn a minimal namespace container for debugging, testing and building.\n\n"
a8828ed9
DW		 213 " -h --help Show this help\n"
214 " --version Print version string\n"
69c79d3c 215 " -q --quiet Do not show status information\n"
1b9e5b12 216 " -D --directory=PATH Root directory for the container\n"
ec16945e
LP		 217 " --template=PATH Initialize root directory from template directory,\n"
218 " if missing\n"
219 " -x --ephemeral Run container with snapshot of root directory, and\n"
220 " remove it after exit\n"
221 " -i --image=PATH File system device or disk image for the container\n"
4623e8e6 222 " --root-hash=HASH Specify verity root hash\n"
7732f92b 223 " -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2\n"
a8828ed9 224 " -b --boot Boot up full system (i.e. invoke init)\n"
5f932eb9 225 " --chdir=PATH Set working directory in the container\n"
b53ede69
PW		 226 " --pivot-root=PATH[:PATH]\n"
227 " Pivot root to given directory in the container\n"
a8828ed9 228 " -u --user=USER Run the command under specified user or uid\n"
a8828ed9 229 " -M --machine=NAME Set the machine name for the container\n"
69c79d3c 230 " --uuid=UUID Set a specific machine UUID for the container\n"
a8828ed9 231 " -S --slice=SLICE Place the container in the specified slice\n"
f36933fe 232 " --property=NAME=VALUE Set scope unit property\n"
90b4a64d 233 " -U --private-users=pick Run within user namespace, autoselect UID/GID range\n"
03cfe0d5 234 " --private-users[=UIDBASE[:NUIDS]]\n"
90b4a64d 235 " Similar, but with user configured UID/GID range\n"
24597ee0 236 " --private-users-chown Adjust OS tree ownership to private UID/GID range\n"
69c79d3c
LP		 237 " --private-network Disable network in container\n"
238 " --network-interface=INTERFACE\n"
239 " Assign an existing network interface to the\n"
240 " container\n"
c74e630d
LP		 241 " --network-macvlan=INTERFACE\n"
242 " Create a macvlan network interface based on an\n"
243 " existing network interface to the container\n"
4bbfe7ad
TG		 244 " --network-ipvlan=INTERFACE\n"
245 " Create a ipvlan network interface based on an\n"
246 " existing network interface to the container\n"
a8eaaee7 247 " -n --network-veth Add a virtual Ethernet connection between host\n"
69c79d3c 248 " and container\n"
f6d6bad1
LP		 249 " --network-veth-extra=HOSTIF[:CONTAINERIF]\n"
250 " Add an additional virtual Ethernet link between\n"
251 " host and container\n"
ab046dde 252 " --network-bridge=INTERFACE\n"
90b4a64d
ZJS		 253 " Add a virtual Ethernet connection to the container\n"
254 " and attach it to an existing bridge on the host\n"
255 " --network-zone=NAME Similar, but attach the new interface to an\n"
256 " an automatically managed bridge interface\n"
6d0b55c2 257 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
ab5e3a1b 258 " Expose a container IP port on the host\n"
82adf6af
LP		 259 " -Z --selinux-context=SECLABEL\n"
260 " Set the SELinux security context to be used by\n"
261 " processes in the container\n"
262 " -L --selinux-apifs-context=SECLABEL\n"
263 " Set the SELinux security context to be used by\n"
264 " API/tmpfs file systems in the container\n"
a8828ed9
DW		 265 " --capability=CAP In addition to the default, retain specified\n"
266 " capability\n"
267 " --drop-capability=CAP Drop the specified capability from the default set\n"
c6c8f6e2 268 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
2b26a728
LP		 269 " --link-journal=MODE Link up guest journal, one of no, auto, guest, \n"
270 " host, try-guest, try-host\n"
574edc90 271 " -j Equivalent to --link-journal=try-guest\n"
69c79d3c 272 " --read-only Mount the root directory read-only\n"
5e5bfa6e
EY		 273 " --bind=PATH[:PATH[:OPTIONS]]\n"
274 " Bind mount a file or directory from the host into\n"
a8828ed9 275 " the container\n"
5e5bfa6e
EY		 276 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
277 " Similar, but creates a read-only bind mount\n"
06c17c39 278 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
5a8af538
LP		 279 " --overlay=PATH[:PATH...]:PATH\n"
280 " Create an overlay mount from the host to \n"
281 " the container\n"
282 " --overlay-ro=PATH[:PATH...]:PATH\n"
283 " Similar, but creates a read-only overlay mount\n"
a5f1cb3b 284 " -E --setenv=NAME=VALUE Pass an environment variable to PID 1\n"
eb91eb18 285 " --register=BOOLEAN Register container as machine\n"
89f7c846 286 " --keep-unit Do not register a scope for the machine, reuse\n"
4d9f07b4 287 " the service unit nspawn is running in\n"
6d0b55c2 288 " --volatile[=MODE] Run the system in volatile mode\n"
f757855e 289 " --settings=BOOLEAN Load additional settings from .nspawn file\n"
90b4a64d 290 " --notify-ready=BOOLEAN Receive notifications from the child init process\n"
6d0b55c2 291 , program_invocation_short_name);
88213476
LP		 292}
293
86c0dd4a 294static int custom_mount_check_all(void) {
5a8af538 295 unsigned i;
5a8af538 296
5a8af538
LP		 297 for (i = 0; i < arg_n_custom_mounts; i++) {
298 CustomMount *m = &arg_custom_mounts[i];
299
0de7acce 300 if (path_equal(m->destination, "/") && arg_userns_mode != USER_NAMESPACE_NO) {
0e7ac751
LP		 301
302 if (arg_userns_chown) {
303 log_error("--private-users-chown may not be combined with custom root mounts.");
304 return -EINVAL;
305 } else if (arg_uid_shift == UID_INVALID) {
306 log_error("--private-users with automatic UID shift may not be combined with custom root mounts.");
307 return -EINVAL;
308 }
825d5287 309 }
5a8af538
LP		 310 }
311
312 return 0;
313}
314
0fd9563f 315static int detect_unified_cgroup_hierarchy(const char *directory) {
efdb0237 316 const char *e;
5da38d07
TH		 317 int r, all_unified, systemd_unified;
318
efdb0237
LP		 319 /* Allow the user to control whether the unified hierarchy is used */
320 e = getenv("UNIFIED_CGROUP_HIERARCHY");
321 if (e) {
322 r = parse_boolean(e);
323 if (r < 0)
324 return log_error_errno(r, "Failed to parse $UNIFIED_CGROUP_HIERARCHY.");
5da38d07
TH		 325 if (r > 0)
326 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
327 else
328 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237 329
efdb0237
LP		 330 return 0;
331 }
332
98afd6af
ZJS		 333 all_unified = cg_all_unified();
334 systemd_unified = cg_unified(SYSTEMD_CGROUP_CONTROLLER);
335
336 if (all_unified < 0 || systemd_unified < 0)
337 return log_error_errno(all_unified < 0 ? all_unified : systemd_unified,
338 "Failed to determine whether the unified cgroups hierarchy is used: %m");
339
efdb0237 340 /* Otherwise inherit the default from the host system */
a8725a06
ZJS		 341 if (all_unified > 0) {
342 /* Unified cgroup hierarchy support was added in 230. Unfortunately the detection
343 * routine only detects 231, so we'll have a false negative here for 230. */
344 r = systemd_installation_has_version(directory, 230);
345 if (r < 0)
346 return log_error_errno(r, "Failed to determine systemd version in container: %m");
347 if (r > 0)
348 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_ALL;
349 else
350 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
351 } else if (systemd_unified > 0) {
352 /* Mixed cgroup hierarchy support was added in 232 */
0fd9563f
ZJS		 353 r = systemd_installation_has_version(directory, 232);
354 if (r < 0)
355 return log_error_errno(r, "Failed to determine systemd version in container: %m");
356 if (r > 0)
357 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_SYSTEMD;
358 else
359 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
360 } else
5da38d07 361 arg_unified_cgroup_hierarchy = CGROUP_UNIFIED_NONE;
efdb0237 362
efdb0237
LP		 363 return 0;
364}
365
0c582db0
LB		 366static void parse_share_ns_env(const char *name, unsigned long ns_flag) {
367 int r;
368
369 r = getenv_bool(name);
370 if (r == -ENXIO)
371 return;
372 if (r < 0)
373 log_warning_errno(r, "Failed to parse %s from environment, defaulting to false.", name);
374 arg_clone_ns_flags = (arg_clone_ns_flags & ~ns_flag) | (r > 0 ? 0 : ns_flag);
375}
376
4f086aab
SU		 377static void parse_mount_settings_env(void) {
378 int r;
379 const char *e;
380
381 e = getenv("SYSTEMD_NSPAWN_API_VFS_WRITABLE");
382 if (!e)
383 return;
384
385 if (streq(e, "network")) {
386 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS;
387 return;
388 }
389
390 r = parse_boolean(e);
391 if (r < 0) {
392 log_warning_errno(r, "Failed to parse SYSTEMD_NSPAWN_API_VFS_WRITABLE from environment, ignoring.");
393 return;
394 } else if (r > 0)
395 arg_mount_settings &= ~MOUNT_APPLY_APIVFS_RO;
396 else
397 arg_mount_settings |= MOUNT_APPLY_APIVFS_RO;
398
399 arg_mount_settings &= ~MOUNT_APPLY_APIVFS_NETNS;
400}
401
88213476
LP		 402static int parse_argv(int argc, char *argv[]) {
403
a41fe3a2 404 enum {
acbeb427
ZJS		 405 ARG_VERSION = 0x100,
406 ARG_PRIVATE_NETWORK,
bc2f673e 407 ARG_UUID,
5076f0cc 408 ARG_READ_ONLY,
57fb9fb5 409 ARG_CAPABILITY,
420c7379 410 ARG_DROP_CAPABILITY,
17fe0523
LP		 411 ARG_LINK_JOURNAL,
412 ARG_BIND,
f4889f65 413 ARG_BIND_RO,
06c17c39 414 ARG_TMPFS,
5a8af538
LP		 415 ARG_OVERLAY,
416 ARG_OVERLAY_RO,
eb91eb18 417 ARG_SHARE_SYSTEM,
89f7c846 418 ARG_REGISTER,
aa28aefe 419 ARG_KEEP_UNIT,
69c79d3c 420 ARG_NETWORK_INTERFACE,
c74e630d 421 ARG_NETWORK_MACVLAN,
4bbfe7ad 422 ARG_NETWORK_IPVLAN,
ab046dde 423 ARG_NETWORK_BRIDGE,
22b28dfd 424 ARG_NETWORK_ZONE,
f6d6bad1 425 ARG_NETWORK_VETH_EXTRA,
6afc95b7 426 ARG_PERSONALITY,
4d9f07b4 427 ARG_VOLATILE,
ec16945e 428 ARG_TEMPLATE,
f36933fe 429 ARG_PROPERTY,
6dac160c 430 ARG_PRIVATE_USERS,
c6c8f6e2 431 ARG_KILL_SIGNAL,
f757855e 432 ARG_SETTINGS,
5f932eb9 433 ARG_CHDIR,
b53ede69 434 ARG_PIVOT_ROOT,
7336138e 435 ARG_PRIVATE_USERS_CHOWN,
9c1e04d0 436 ARG_NOTIFY_READY,
4623e8e6 437 ARG_ROOT_HASH,
a41fe3a2
LP		 438 };
439
88213476 440 static const struct option options[] = {
27eb8e90
ZJS		 441 { "help", no_argument, NULL, 'h' },
442 { "version", no_argument, NULL, ARG_VERSION },
443 { "directory", required_argument, NULL, 'D' },
444 { "template", required_argument, NULL, ARG_TEMPLATE },
445 { "ephemeral", no_argument, NULL, 'x' },
446 { "user", required_argument, NULL, 'u' },
447 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
448 { "as-pid2", no_argument, NULL, 'a' },
449 { "boot", no_argument, NULL, 'b' },
450 { "uuid", required_argument, NULL, ARG_UUID },
451 { "read-only", no_argument, NULL, ARG_READ_ONLY },
452 { "capability", required_argument, NULL, ARG_CAPABILITY },
453 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
454 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
455 { "bind", required_argument, NULL, ARG_BIND },
456 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
457 { "tmpfs", required_argument, NULL, ARG_TMPFS },
458 { "overlay", required_argument, NULL, ARG_OVERLAY },
459 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
460 { "machine", required_argument, NULL, 'M' },
461 { "slice", required_argument, NULL, 'S' },
462 { "setenv", required_argument, NULL, 'E' },
463 { "selinux-context", required_argument, NULL, 'Z' },
464 { "selinux-apifs-context", required_argument, NULL, 'L' },
465 { "quiet", no_argument, NULL, 'q' },
466 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, /* not documented */
467 { "register", required_argument, NULL, ARG_REGISTER },
468 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
469 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
470 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
471 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
472 { "network-veth", no_argument, NULL, 'n' },
473 { "network-veth-extra", required_argument, NULL, ARG_NETWORK_VETH_EXTRA },
474 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
475 { "network-zone", required_argument, NULL, ARG_NETWORK_ZONE },
476 { "personality", required_argument, NULL, ARG_PERSONALITY },
477 { "image", required_argument, NULL, 'i' },
478 { "volatile", optional_argument, NULL, ARG_VOLATILE },
479 { "port", required_argument, NULL, 'p' },
480 { "property", required_argument, NULL, ARG_PROPERTY },
481 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
482 { "private-users-chown", optional_argument, NULL, ARG_PRIVATE_USERS_CHOWN },
483 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
484 { "settings", required_argument, NULL, ARG_SETTINGS },
485 { "chdir", required_argument, NULL, ARG_CHDIR },
b53ede69 486 { "pivot-root", required_argument, NULL, ARG_PIVOT_ROOT },
27eb8e90 487 { "notify-ready", required_argument, NULL, ARG_NOTIFY_READY },
4623e8e6 488 { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
eb9da376 489 {}
88213476
LP		 490 };
491
9444b1f2 492 int c, r;
6aadfa4c 493 const char *p, *e;
a42c8b54 494 uint64_t plus = 0, minus = 0;
f757855e 495 bool mask_all_settings = false, mask_no_settings = false;
88213476
LP		 496
497 assert(argc >= 0);
498 assert(argv);
499
2e1f244e 500 while ((c = getopt_long(argc, argv, "+hD:u:abL:M:jS:Z:qi:xp:nUE:", options, NULL)) >= 0)
88213476
LP		 501
502 switch (c) {
503
504 case 'h':
601185b4
ZJS		 505 help();
506 return 0;
88213476 507
acbeb427 508 case ARG_VERSION:
3f6fd1ba 509 return version();
acbeb427 510
88213476 511 case 'D':
0f03c2a4 512 r = parse_path_argument_and_warn(optarg, false, &arg_directory);
ec16945e 513 if (r < 0)
0f03c2a4 514 return r;
ec16945e
LP		 515 break;
516
517 case ARG_TEMPLATE:
0f03c2a4 518 r = parse_path_argument_and_warn(optarg, false, &arg_template);
ec16945e 519 if (r < 0)
0f03c2a4 520 return r;
88213476
LP		 521 break;
522
1b9e5b12 523 case 'i':
0f03c2a4 524 r = parse_path_argument_and_warn(optarg, false, &arg_image);
ec16945e 525 if (r < 0)
0f03c2a4 526 return r;
ec16945e
LP		 527 break;
528
529 case 'x':
530 arg_ephemeral = true;
1b9e5b12
LP		 531 break;
532
687d0825 533 case 'u':
2fc09a9c
DM		 534 r = free_and_strdup(&arg_user, optarg);
535 if (r < 0)
7027ff61 536 return log_oom();
687d0825 537
f757855e 538 arg_settings_mask |= SETTING_USER;
687d0825
MV		 539 break;
540
22b28dfd
LP		 541 case ARG_NETWORK_ZONE: {
542 char *j;
543
544 j = strappend("vz-", optarg);
545 if (!j)
546 return log_oom();
547
548 if (!ifname_valid(j)) {
549 log_error("Network zone name not valid: %s", j);
550 free(j);
551 return -EINVAL;
552 }
553
554 free(arg_network_zone);
555 arg_network_zone = j;
556
557 arg_network_veth = true;
558 arg_private_network = true;
559 arg_settings_mask |= SETTING_NETWORK;
560 break;
561 }
562
ab046dde 563 case ARG_NETWORK_BRIDGE:
ef76dff2
LP		 564
565 if (!ifname_valid(optarg)) {
566 log_error("Bridge interface name not valid: %s", optarg);
567 return -EINVAL;
568 }
569
f757855e
LP		 570 r = free_and_strdup(&arg_network_bridge, optarg);
571 if (r < 0)
572 return log_oom();
ab046dde
TG		 573
574 /* fall through */
575
0dfaa006 576 case 'n':
69c79d3c
LP		 577 arg_network_veth = true;
578 arg_private_network = true;
f757855e 579 arg_settings_mask |= SETTING_NETWORK;
69c79d3c
LP		 580 break;
581
f6d6bad1
LP		 582 case ARG_NETWORK_VETH_EXTRA:
583 r = veth_extra_parse(&arg_network_veth_extra, optarg);
584 if (r < 0)
585 return log_error_errno(r, "Failed to parse --network-veth-extra= parameter: %s", optarg);
586
587 arg_private_network = true;
588 arg_settings_mask |= SETTING_NETWORK;
589 break;
590
aa28aefe 591 case ARG_NETWORK_INTERFACE:
ef76dff2
LP		 592
593 if (!ifname_valid(optarg)) {
594 log_error("Network interface name not valid: %s", optarg);
595 return -EINVAL;
596 }
597
c74e630d
LP		 598 if (strv_extend(&arg_network_interfaces, optarg) < 0)
599 return log_oom();
600
601 arg_private_network = true;
f757855e 602 arg_settings_mask |= SETTING_NETWORK;
c74e630d
LP		 603 break;
604
605 case ARG_NETWORK_MACVLAN:
ef76dff2
LP		 606
607 if (!ifname_valid(optarg)) {
608 log_error("MACVLAN network interface name not valid: %s", optarg);
609 return -EINVAL;
610 }
611
c74e630d 612 if (strv_extend(&arg_network_macvlan, optarg) < 0)
aa28aefe
LP		 613 return log_oom();
614
4bbfe7ad 615 arg_private_network = true;
f757855e 616 arg_settings_mask |= SETTING_NETWORK;
4bbfe7ad
TG		 617 break;
618
619 case ARG_NETWORK_IPVLAN:
ef76dff2
LP		 620
621 if (!ifname_valid(optarg)) {
622 log_error("IPVLAN network interface name not valid: %s", optarg);
623 return -EINVAL;
624 }
625
4bbfe7ad
TG		 626 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
627 return log_oom();
628
aa28aefe
LP		 629 /* fall through */
630
ff01d048
LP		 631 case ARG_PRIVATE_NETWORK:
632 arg_private_network = true;
f757855e 633 arg_settings_mask |= SETTING_NETWORK;
a41fe3a2
LP		 634 break;
635
0f0dbc46 636 case 'b':
7732f92b
LP		 637 if (arg_start_mode == START_PID2) {
638 log_error("--boot and --as-pid2 may not be combined.");
639 return -EINVAL;
640 }
641
642 arg_start_mode = START_BOOT;
643 arg_settings_mask |= SETTING_START_MODE;
644 break;
645
646 case 'a':
647 if (arg_start_mode == START_BOOT) {
648 log_error("--boot and --as-pid2 may not be combined.");
649 return -EINVAL;
650 }
651
652 arg_start_mode = START_PID2;
653 arg_settings_mask |= SETTING_START_MODE;
0f0dbc46
LP		 654 break;
655
144f0fc0 656 case ARG_UUID:
9444b1f2 657 r = sd_id128_from_string(optarg, &arg_uuid);
317feb4d
LP		 658 if (r < 0)
659 return log_error_errno(r, "Invalid UUID: %s", optarg);
660
661 if (sd_id128_is_null(arg_uuid)) {
662 log_error("Machine UUID may not be all zeroes.");
663 return -EINVAL;
aa96c6cb 664 }
f757855e
LP		 665
666 arg_settings_mask |= SETTING_MACHINE_ID;
9444b1f2 667 break;
aa96c6cb 668
9444b1f2 669 case 'S':
c74e630d 670 arg_slice = optarg;
144f0fc0
LP		 671 break;
672
7027ff61 673 case 'M':
c1521918 674 if (isempty(optarg))
97b11eed 675 arg_machine = mfree(arg_machine);
c1521918 676 else {
0c3c4284 677 if (!machine_name_is_valid(optarg)) {
eb91eb18
LP		 678 log_error("Invalid machine name: %s", optarg);
679 return -EINVAL;
680 }
7027ff61 681
0c3c4284
LP		 682 r = free_and_strdup(&arg_machine, optarg);
683 if (r < 0)
eb91eb18 684 return log_oom();
eb91eb18 685 }
9ce6d1b3 686 break;
7027ff61 687
82adf6af
LP		 688 case 'Z':
689 arg_selinux_context = optarg;
a8828ed9
DW		 690 break;
691
82adf6af
LP		 692 case 'L':
693 arg_selinux_apifs_context = optarg;
a8828ed9
DW		 694 break;
695
bc2f673e
LP		 696 case ARG_READ_ONLY:
697 arg_read_only = true;
f757855e 698 arg_settings_mask |= SETTING_READ_ONLY;
bc2f673e
LP		 699 break;
700
420c7379
LP		 701 case ARG_CAPABILITY:
702 case ARG_DROP_CAPABILITY: {
6cbe4ed1 703 p = optarg;
9ed794a3 704 for (;;) {
6cbe4ed1 705 _cleanup_free_ char *t = NULL;
5076f0cc 706
6cbe4ed1
SS		 707 r = extract_first_word(&p, &t, ",", 0);
708 if (r < 0)
709 return log_error_errno(r, "Failed to parse capability %s.", t);
5076f0cc 710
6cbe4ed1
SS		 711 if (r == 0)
712 break;
5076f0cc 713
39ed67d1
LP		 714 if (streq(t, "all")) {
715 if (c == ARG_CAPABILITY)
a42c8b54 716 plus = (uint64_t) -1;
39ed67d1 717 else
a42c8b54 718 minus = (uint64_t) -1;
39ed67d1 719 } else {
2822da4f
LP		 720 int cap;
721
722 cap = capability_from_name(t);
723 if (cap < 0) {
39ed67d1
LP		 724 log_error("Failed to parse capability %s.", t);
725 return -EINVAL;
726 }
727
728 if (c == ARG_CAPABILITY)
a42c8b54 729 plus |= 1ULL << (uint64_t) cap;
39ed67d1 730 else
a42c8b54 731 minus |= 1ULL << (uint64_t) cap;
5076f0cc 732 }
5076f0cc
LP		 733 }
734
f757855e 735 arg_settings_mask |= SETTING_CAPABILITY;
5076f0cc
LP		 736 break;
737 }
738
57fb9fb5
LP		 739 case 'j':
740 arg_link_journal = LINK_GUEST;
574edc90 741 arg_link_journal_try = true;
57fb9fb5
LP		 742 break;
743
744 case ARG_LINK_JOURNAL:
53e438e3 745 if (streq(optarg, "auto")) {
57fb9fb5 746 arg_link_journal = LINK_AUTO;
53e438e3
LP		 747 arg_link_journal_try = false;
748 } else if (streq(optarg, "no")) {
57fb9fb5 749 arg_link_journal = LINK_NO;
53e438e3
LP		 750 arg_link_journal_try = false;
751 } else if (streq(optarg, "guest")) {
57fb9fb5 752 arg_link_journal = LINK_GUEST;
53e438e3
LP		 753 arg_link_journal_try = false;
754 } else if (streq(optarg, "host")) {
57fb9fb5 755 arg_link_journal = LINK_HOST;
53e438e3
LP		 756 arg_link_journal_try = false;
757 } else if (streq(optarg, "try-guest")) {
574edc90
MP		 758 arg_link_journal = LINK_GUEST;
759 arg_link_journal_try = true;
760 } else if (streq(optarg, "try-host")) {
761 arg_link_journal = LINK_HOST;
762 arg_link_journal_try = true;
763 } else {
57fb9fb5
LP		 764 log_error("Failed to parse link journal mode %s", optarg);
765 return -EINVAL;
766 }
767
768 break;
769
17fe0523 770 case ARG_BIND:
f757855e
LP		 771 case ARG_BIND_RO:
772 r = bind_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_BIND_RO);
773 if (r < 0)
774 return log_error_errno(r, "Failed to parse --bind(-ro)= argument %s: %m", optarg);
17fe0523 775
f757855e 776 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
17fe0523 777 break;
06c17c39 778
f757855e
LP		 779 case ARG_TMPFS:
780 r = tmpfs_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg);
781 if (r < 0)
782 return log_error_errno(r, "Failed to parse --tmpfs= argument %s: %m", optarg);
5a8af538 783
f757855e 784 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
5a8af538 785 break;
5a8af538
LP		 786
787 case ARG_OVERLAY:
ad85779a
LP		 788 case ARG_OVERLAY_RO:
789 r = overlay_mount_parse(&arg_custom_mounts, &arg_n_custom_mounts, optarg, c == ARG_OVERLAY_RO);
790 if (r == -EADDRNOTAVAIL)
791 return log_error_errno(r, "--overlay(-ro)= needs at least two colon-separated directories specified.");
792 if (r < 0)
793 return log_error_errno(r, "Failed to parse --overlay(-ro)= argument %s: %m", optarg);
06c17c39 794
f757855e 795 arg_settings_mask |= SETTING_CUSTOM_MOUNTS;
06c17c39 796 break;
06c17c39 797
a5f1cb3b 798 case 'E': {
f4889f65
LP		 799 char **n;
800
801 if (!env_assignment_is_valid(optarg)) {
802 log_error("Environment variable assignment '%s' is not valid.", optarg);
803 return -EINVAL;
804 }
805
806 n = strv_env_set(arg_setenv, optarg);
807 if (!n)
808 return log_oom();
809
810 strv_free(arg_setenv);
811 arg_setenv = n;
f757855e
LP		 812
813 arg_settings_mask |= SETTING_ENVIRONMENT;
f4889f65
LP		 814 break;
815 }
816
284c0b91
LP		 817 case 'q':
818 arg_quiet = true;
819 break;
820
8a96d94e 821 case ARG_SHARE_SYSTEM:
a6b5216c 822 /* We don't officially support this anymore, except for compat reasons. People should use the
0c582db0
LB		 823 * $SYSTEMD_NSPAWN_SHARE_* environment variables instead. */
824 arg_clone_ns_flags = 0;
8a96d94e
LP		 825 break;
826
eb91eb18
LP		 827 case ARG_REGISTER:
828 r = parse_boolean(optarg);
829 if (r < 0) {
830 log_error("Failed to parse --register= argument: %s", optarg);
831 return r;
832 }
833
834 arg_register = r;
835 break;
836
89f7c846
LP		 837 case ARG_KEEP_UNIT:
838 arg_keep_unit = true;
839 break;
840
6afc95b7
LP		 841 case ARG_PERSONALITY:
842
ac45f971 843 arg_personality = personality_from_string(optarg);
050f7277 844 if (arg_personality == PERSONALITY_INVALID) {
6afc95b7
LP		 845 log_error("Unknown or unsupported personality '%s'.", optarg);
846 return -EINVAL;
847 }
848
f757855e 849 arg_settings_mask |= SETTING_PERSONALITY;
6afc95b7
LP		 850 break;
851
4d9f07b4
LP		 852 case ARG_VOLATILE:
853
854 if (!optarg)
f757855e 855 arg_volatile_mode = VOLATILE_YES;
4d9f07b4 856 else {
f757855e 857 VolatileMode m;
4d9f07b4 858
f757855e
LP		 859 m = volatile_mode_from_string(optarg);
860 if (m < 0) {
861 log_error("Failed to parse --volatile= argument: %s", optarg);
6d0b55c2 862 return -EINVAL;
f757855e
LP		 863 } else
864 arg_volatile_mode = m;
6d0b55c2
LP		 865 }
866
f757855e
LP		 867 arg_settings_mask |= SETTING_VOLATILE_MODE;
868 break;
6d0b55c2 869
f757855e
LP		 870 case 'p':
871 r = expose_port_parse(&arg_expose_ports, optarg);
872 if (r == -EEXIST)
873 return log_error_errno(r, "Duplicate port specification: %s", optarg);
874 if (r < 0)
875 return log_error_errno(r, "Failed to parse host port %s: %m", optarg);
6d0b55c2 876
f757855e 877 arg_settings_mask |= SETTING_EXPOSE_PORTS;
6d0b55c2 878 break;
6d0b55c2 879
f36933fe
LP		 880 case ARG_PROPERTY:
881 if (strv_extend(&arg_property, optarg) < 0)
882 return log_oom();
883
884 break;
885
ae209204
ZJS		 886 case ARG_PRIVATE_USERS: {
887 int boolean = -1;
0de7acce 888
ae209204
ZJS		 889 if (!optarg)
890 boolean = true;
891 else if (!in_charset(optarg, DIGITS))
892 /* do *not* parse numbers as booleans */
893 boolean = parse_boolean(optarg);
894
895 if (boolean == false) {
0de7acce
LP		 896 /* no: User namespacing off */
897 arg_userns_mode = USER_NAMESPACE_NO;
898 arg_uid_shift = UID_INVALID;
899 arg_uid_range = UINT32_C(0x10000);
ae209204 900 } else if (boolean == true) {
0de7acce
LP		 901 /* yes: User namespacing on, UID range is read from root dir */
902 arg_userns_mode = USER_NAMESPACE_FIXED;
903 arg_uid_shift = UID_INVALID;
904 arg_uid_range = UINT32_C(0x10000);
905 } else if (streq(optarg, "pick")) {
906 /* pick: User namespacing on, UID range is picked randomly */
907 arg_userns_mode = USER_NAMESPACE_PICK;
908 arg_uid_shift = UID_INVALID;
909 arg_uid_range = UINT32_C(0x10000);
910 } else {
6c2058b3 911 _cleanup_free_ char *buffer = NULL;
6dac160c
LP		 912 const char *range, *shift;
913
0de7acce
LP		 914 /* anything else: User namespacing on, UID range is explicitly configured */
915
6dac160c
LP		 916 range = strchr(optarg, ':');
917 if (range) {
6c2058b3
ZJS		 918 buffer = strndup(optarg, range - optarg);
919 if (!buffer)
920 return log_oom();
921 shift = buffer;
6dac160c
LP		 922
923 range++;
bfd292ec
ZJS		 924 r = safe_atou32(range, &arg_uid_range);
925 if (r < 0)
be715731 926 return log_error_errno(r, "Failed to parse UID range \"%s\": %m", range);
6dac160c
LP		 927 } else
928 shift = optarg;
929
be715731
ZJS		 930 r = parse_uid(shift, &arg_uid_shift);
931 if (r < 0)
932 return log_error_errno(r, "Failed to parse UID \"%s\": %m", optarg);
0de7acce
LP		 933
934 arg_userns_mode = USER_NAMESPACE_FIXED;
6dac160c
LP		 935 }
936
be715731
ZJS		 937 if (arg_uid_range <= 0) {
938 log_error("UID range cannot be 0.");
939 return -EINVAL;
940 }
941
0de7acce 942 arg_settings_mask |= SETTING_USERNS;
6dac160c 943 break;
ae209204 944 }
6dac160c 945
0de7acce 946 case 'U':
ccabee0d
LP		 947 if (userns_supported()) {
948 arg_userns_mode = USER_NAMESPACE_PICK;
949 arg_uid_shift = UID_INVALID;
950 arg_uid_range = UINT32_C(0x10000);
951
952 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 953 }
954
7336138e
LP		 955 break;
956
0de7acce 957 case ARG_PRIVATE_USERS_CHOWN:
19aac838 958 arg_userns_chown = true;
0de7acce
LP		 959
960 arg_settings_mask |= SETTING_USERNS;
6dac160c
LP		 961 break;
962
c6c8f6e2
LP		 963 case ARG_KILL_SIGNAL:
964 arg_kill_signal = signal_from_string_try_harder(optarg);
965 if (arg_kill_signal < 0) {
966 log_error("Cannot parse signal: %s", optarg);
967 return -EINVAL;
968 }
969
f757855e
LP		 970 arg_settings_mask |= SETTING_KILL_SIGNAL;
971 break;
972
973 case ARG_SETTINGS:
974
975 /* no → do not read files
976 * yes → read files, do not override cmdline, trust only subset
977 * override → read files, override cmdline, trust only subset
978 * trusted → read files, do not override cmdline, trust all
979 */
980
981 r = parse_boolean(optarg);
982 if (r < 0) {
983 if (streq(optarg, "trusted")) {
984 mask_all_settings = false;
985 mask_no_settings = false;
986 arg_settings_trusted = true;
987
988 } else if (streq(optarg, "override")) {
989 mask_all_settings = false;
990 mask_no_settings = true;
991 arg_settings_trusted = -1;
992 } else
993 return log_error_errno(r, "Failed to parse --settings= argument: %s", optarg);
994 } else if (r > 0) {
995 /* yes */
996 mask_all_settings = false;
997 mask_no_settings = false;
998 arg_settings_trusted = -1;
999 } else {
1000 /* no */
1001 mask_all_settings = true;
1002 mask_no_settings = false;
1003 arg_settings_trusted = false;
1004 }
1005
c6c8f6e2
LP		 1006 break;
1007
5f932eb9
LP		 1008 case ARG_CHDIR:
1009 if (!path_is_absolute(optarg)) {
1010 log_error("Working directory %s is not an absolute path.", optarg);
1011 return -EINVAL;
1012 }
1013
1014 r = free_and_strdup(&arg_chdir, optarg);
1015 if (r < 0)
1016 return log_oom();
1017
1018 arg_settings_mask |= SETTING_WORKING_DIRECTORY;
1019 break;
1020
b53ede69
PW		 1021 case ARG_PIVOT_ROOT:
1022 r = pivot_root_parse(&arg_pivot_root_new, &arg_pivot_root_old, optarg);
1023 if (r < 0)
1024 return log_error_errno(r, "Failed to parse --pivot-root= argument %s: %m", optarg);
1025
1026 arg_settings_mask |= SETTING_PIVOT_ROOT;
1027 break;
1028
9c1e04d0
AP		 1029 case ARG_NOTIFY_READY:
1030 r = parse_boolean(optarg);
1031 if (r < 0) {
1032 log_error("%s is not a valid notify mode. Valid modes are: yes, no, and ready.", optarg);
1033 return -EINVAL;
1034 }
1035 arg_notify_ready = r;
1036 arg_settings_mask |= SETTING_NOTIFY_READY;
1037 break;
1038
4623e8e6
LP		 1039 case ARG_ROOT_HASH: {
1040 void *k;
1041 size_t l;
1042
1043 r = unhexmem(optarg, strlen(optarg), &k, &l);
1044 if (r < 0)
1045 return log_error_errno(r, "Failed to parse root hash: %s", optarg);
1046 if (l < sizeof(sd_id128_t)) {
1047 log_error("Root hash must be at least 128bit long: %s", optarg);
1048 free(k);
1049 return -EINVAL;
1050 }
1051
1052 free(arg_root_hash);
1053 arg_root_hash = k;
1054 arg_root_hash_size = l;
1055 break;
1056 }
1057
88213476
LP		 1058 case '?':
1059 return -EINVAL;
1060
1061 default:
eb9da376 1062 assert_not_reached("Unhandled option");
88213476 1063 }
88213476 1064
0c582db0
LB		 1065 parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_IPC", CLONE_NEWIPC);
1066 parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_PID", CLONE_NEWPID);
1067 parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_NS_UTS", CLONE_NEWUTS);
1068 parse_share_ns_env("SYSTEMD_NSPAWN_SHARE_SYSTEM", CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS);
a6b5216c 1069
4f086aab
SU		 1070 if (arg_userns_mode != USER_NAMESPACE_NO)
1071 arg_mount_settings |= MOUNT_USE_USERNS;
1072
1073 if (arg_private_network)
1074 arg_mount_settings |= MOUNT_APPLY_APIVFS_NETNS;
1075
1076 parse_mount_settings_env();
1077
48a8d337
LB		 1078 if (!(arg_clone_ns_flags & CLONE_NEWPID) ||
1079 !(arg_clone_ns_flags & CLONE_NEWUTS)) {
eb91eb18 1080 arg_register = false;
0c582db0
LB		 1081 if (arg_start_mode != START_PID1) {
1082 log_error("--boot cannot be used without namespacing.");
1083 return -EINVAL;
1084 }
1085 }
eb91eb18 1086
0de7acce 1087 if (arg_userns_mode == USER_NAMESPACE_PICK)
0e7ac751
LP		 1088 arg_userns_chown = true;
1089
89f7c846
LP		 1090 if (arg_keep_unit && cg_pid_get_owner_uid(0, NULL) >= 0) {
1091 log_error("--keep-unit may not be used when invoked from a user session.");
1092 return -EINVAL;
1093 }
1094
1b9e5b12
LP		 1095 if (arg_directory && arg_image) {
1096 log_error("--directory= and --image= may not be combined.");
1097 return -EINVAL;
1098 }
1099
ec16945e
LP		 1100 if (arg_template && arg_image) {
1101 log_error("--template= and --image= may not be combined.");
1102 return -EINVAL;
1103 }
1104
8cd328d8
LP		 1105 if (arg_ephemeral && arg_template && !arg_directory) {
1106 /* User asked for ephemeral execution but specified --template= instead of --directory=. Semantically
1107 * such an invocation makes some sense, see https://github.com/systemd/systemd/issues/3667. Let's
1108 * accept this here, and silently make "--ephemeral --template=" equivalent to "--ephemeral
1109 * --directory=". */
1110
1111 arg_directory = arg_template;
1112 arg_template = NULL;
1113 }
1114
ec16945e
LP		 1115 if (arg_template && !(arg_directory || arg_machine)) {
1116 log_error("--template= needs --directory= or --machine=.");
1117 return -EINVAL;
1118 }
1119
1120 if (arg_ephemeral && arg_template) {
1121 log_error("--ephemeral and --template= may not be combined.");
1122 return -EINVAL;
1123 }
1124
df9a75e4
LP		 1125 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO)) {
1126 log_error("--ephemeral and --link-journal= may not be combined.");
1127 return -EINVAL;
1128 }
1129
ccabee0d 1130 if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported()) {
7336138e
LP		 1131 log_error("--private-users= is not supported, kernel compiled without user namespace support.");
1132 return -EOPNOTSUPP;
1133 }
1134
1135 if (arg_userns_chown && arg_read_only) {
1136 log_error("--read-only and --private-users-chown may not be combined.");
1137 return -EINVAL;
1138 }
f757855e 1139
22b28dfd
LP		 1140 if (arg_network_bridge && arg_network_zone) {
1141 log_error("--network-bridge= and --network-zone= may not be combined.");
1142 return -EINVAL;
1143 }
1144
f757855e
LP		 1145 if (argc > optind) {
1146 arg_parameters = strv_copy(argv + optind);
1147 if (!arg_parameters)
1148 return log_oom();
1149
7732f92b 1150 arg_settings_mask |= SETTING_START_MODE;
f757855e
LP		 1151 }
1152
1153 /* Load all settings from .nspawn files */
1154 if (mask_no_settings)
1155 arg_settings_mask = 0;
1156
1157 /* Don't load any settings from .nspawn files */
1158 if (mask_all_settings)
1159 arg_settings_mask = _SETTINGS_MASK_ALL;
1160
520e0d54 1161 arg_caps_retain = (arg_caps_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus;
f757855e 1162
6aadfa4c
ILG		 1163 e = getenv("SYSTEMD_NSPAWN_CONTAINER_SERVICE");
1164 if (e)
1165 arg_container_service_name = e;
1166
5a8ff0e6
CB		 1167 r = getenv_bool("SYSTEMD_NSPAWN_USE_CGNS");
1168 if (r < 0)
1169 arg_use_cgns = cg_ns_supported();
1170 else
1171 arg_use_cgns = r;
1172
86c0dd4a
LP		 1173 r = custom_mount_check_all();
1174 if (r < 0)
1175 return r;
1176
f757855e
LP		 1177 return 1;
1178}
1179
1180static int verify_arguments(void) {
4f086aab
SU		 1181 if (arg_userns_mode != USER_NAMESPACE_NO && (arg_mount_settings & MOUNT_APPLY_APIVFS_NETNS) && !arg_private_network) {
1182 log_error("Invalid namespacing settings. Mounting sysfs with --private-users requires --private-network.");
1183 return -EINVAL;
1184 }
1185
1186 if (arg_userns_mode != USER_NAMESPACE_NO && !(arg_mount_settings & MOUNT_APPLY_APIVFS_RO)) {
1187 log_error("Cannot combine --private-users with read-write mounts.");
1188 return -EINVAL;
1189 }
f757855e
LP		 1190
1191 if (arg_volatile_mode != VOLATILE_NO && arg_read_only) {
4d9f07b4
LP		 1192 log_error("Cannot combine --read-only with --volatile. Note that --volatile already implies a read-only base hierarchy.");
1193 return -EINVAL;
1194 }
1195
6d0b55c2
LP		 1196 if (arg_expose_ports && !arg_private_network) {
1197 log_error("Cannot use --port= without private networking.");
1198 return -EINVAL;
1199 }
1200
1c1ea217
EV		 1201#ifndef HAVE_LIBIPTC
1202 if (arg_expose_ports) {
1203 log_error("--port= is not supported, compiled without libiptc support.");
1204 return -EOPNOTSUPP;
1205 }
1206#endif
1207
7732f92b 1208 if (arg_start_mode == START_BOOT && arg_kill_signal <= 0)
c6c8f6e2
LP		 1209 arg_kill_signal = SIGRTMIN+3;
1210
f757855e 1211 return 0;
88213476
LP		 1212}
1213
03cfe0d5
LP		 1214static int userns_lchown(const char *p, uid_t uid, gid_t gid) {
1215 assert(p);
1216
0de7acce 1217 if (arg_userns_mode == USER_NAMESPACE_NO)
03cfe0d5
LP		 1218 return 0;
1219
1220 if (uid == UID_INVALID && gid == GID_INVALID)
1221 return 0;
1222
1223 if (uid != UID_INVALID) {
1224 uid += arg_uid_shift;
1225
1226 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1227 return -EOVERFLOW;
1228 }
1229
1230 if (gid != GID_INVALID) {
1231 gid += (gid_t) arg_uid_shift;
1232
1233 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1234 return -EOVERFLOW;
1235 }
1236
1237 if (lchown(p, uid, gid) < 0)
1238 return -errno;
b12afc8c
LP		 1239
1240 return 0;
1241}
1242
03cfe0d5
LP		 1243static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
1244 const char *q;
1245
1246 q = prefix_roota(root, path);
1247 if (mkdir(q, mode) < 0) {
1248 if (errno == EEXIST)
1249 return 0;
1250 return -errno;
1251 }
1252
1253 return userns_lchown(q, uid, gid);
1254}
1255
e58a1277 1256static int setup_timezone(const char *dest) {
03cfe0d5
LP		 1257 _cleanup_free_ char *p = NULL, *q = NULL;
1258 const char *where, *check, *what;
d4036145
LP		 1259 char *z, *y;
1260 int r;
f8440af5 1261
e58a1277
LP		 1262 assert(dest);
1263
1264 /* Fix the timezone, if possible */
d4036145
LP		 1265 r = readlink_malloc("/etc/localtime", &p);
1266 if (r < 0) {
0b493a02
MP		 1267 log_warning("host's /etc/localtime is not a symlink, not updating container timezone.");
1268 /* to handle warning, delete /etc/localtime and replace it
d23a0044 1269 * with a symbolic link to a time zone data file.
0b493a02
MP		 1270 *
1271 * Example:
21dc0227 1272 * ln -s /usr/share/zoneinfo/UTC /etc/localtime
0b493a02 1273 */
d4036145
LP		 1274 return 0;
1275 }
1276
1277 z = path_startswith(p, "../usr/share/zoneinfo/");
1278 if (!z)
1279 z = path_startswith(p, "/usr/share/zoneinfo/");
1280 if (!z) {
1281 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
1282 return 0;
1283 }
1284
03cfe0d5 1285 where = prefix_roota(dest, "/etc/localtime");
d4036145
LP		 1286 r = readlink_malloc(where, &q);
1287 if (r >= 0) {
1288 y = path_startswith(q, "../usr/share/zoneinfo/");
1289 if (!y)
1290 y = path_startswith(q, "/usr/share/zoneinfo/");
4d1c38b8 1291
d4036145
LP		 1292 /* Already pointing to the right place? Then do nothing .. */
1293 if (y && streq(y, z))
1294 return 0;
1295 }
1296
03cfe0d5 1297 check = strjoina("/usr/share/zoneinfo/", z);
61e741ed 1298 check = prefix_roota(dest, check);
03cfe0d5 1299 if (laccess(check, F_OK) < 0) {
d4036145
LP		 1300 log_warning("Timezone %s does not exist in container, not updating container timezone.", z);
1301 return 0;
1302 }
68fb0892 1303
8ccf7e9e
LP		 1304 if (unlink(where) < 0 && errno != ENOENT) {
1305 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING, /* Don't complain on read-only images */
1306 errno,
1307 "Failed to remove existing timezone info %s in container, ignoring: %m", where);
79d80fc1
TG		 1308 return 0;
1309 }
4d9f07b4 1310
03cfe0d5 1311 what = strjoina("../usr/share/zoneinfo/", z);
d4036145 1312 if (symlink(what, where) < 0) {
8ccf7e9e
LP		 1313 log_full_errno(IN_SET(errno, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING,
1314 errno,
1315 "Failed to correct timezone of container, ignoring: %m");
d4036145
LP		 1316 return 0;
1317 }
e58a1277 1318
03cfe0d5
LP		 1319 r = userns_lchown(where, 0, 0);
1320 if (r < 0)
1321 return log_warning_errno(r, "Failed to chown /etc/localtime: %m");
1322
e58a1277 1323 return 0;
88213476
LP		 1324}
1325
2547bb41 1326static int setup_resolv_conf(const char *dest) {
87447ae4
LP		 1327 _cleanup_free_ char *resolved = NULL, *etc = NULL;
1328 const char *where;
1329 int r, found;
2547bb41
LP		 1330
1331 assert(dest);
1332
1333 if (arg_private_network)
1334 return 0;
1335
87447ae4
LP		 1336 r = chase_symlinks("/etc", dest, CHASE_PREFIX_ROOT, &etc);
1337 if (r < 0) {
1338 log_warning_errno(r, "Failed to resolve /etc path in container, ignoring: %m");
1339 return 0;
1340 }
1341
1342 where = strjoina(etc, "/resolv.conf");
1343 found = chase_symlinks(where, dest, CHASE_NONEXISTENT, &resolved);
1344 if (found < 0) {
1345 log_warning_errno(found, "Failed to resolve /etc/resolv.conf path in container, ignoring: %m");
1346 return 0;
1347 }
79d80fc1 1348
7debb05d 1349 if (access("/run/systemd/resolve/resolv.conf", F_OK) >= 0 &&
87447ae4
LP		 1350 access("/usr/lib/systemd/resolv.conf", F_OK) >= 0) {
1351
3539724c
LP		 1352 /* resolved is enabled on the host. In this, case bind mount its static resolv.conf file into the
1353 * container, so that the container can use the host's resolver. Given that network namespacing is
1354 * disabled it's only natural of the container also uses the host's resolver. It also has the big
1355 * advantage that the container will be able to follow the host's DNS server configuration changes
1356 * transparently. */
1357
87447ae4
LP		 1358 if (found == 0) /* missing? */
1359 (void) touch(resolved);
5367354d 1360
87447ae4 1361 r = mount_verbose(LOG_DEBUG, "/usr/lib/systemd/resolv.conf", resolved, NULL, MS_BIND, NULL);
60e76d48 1362 if (r >= 0)
87447ae4 1363 return mount_verbose(LOG_ERR, NULL, resolved, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
3539724c
LP		 1364 }
1365
1366 /* If that didn't work, let's copy the file */
1c876927 1367 r = copy_file("/etc/resolv.conf", where, O_TRUNC|O_NOFOLLOW, 0644, 0, COPY_REFLINK);
79d80fc1 1368 if (r < 0) {
3539724c
LP		 1369 /* If the file already exists as symlink, let's suppress the warning, under the assumption that
1370 * resolved or something similar runs inside and the symlink points there.
68a313c5 1371 *
3539724c 1372 * If the disk image is read-only, there's also no point in complaining.
68a313c5 1373 */
87447ae4 1374 log_full_errno(IN_SET(r, -ELOOP, -EROFS, -EACCES, -EPERM) ? LOG_DEBUG : LOG_WARNING, r,
3539724c 1375 "Failed to copy /etc/resolv.conf to %s, ignoring: %m", where);
79d80fc1
TG		 1376 return 0;
1377 }
2547bb41 1378
03cfe0d5
LP		 1379 r = userns_lchown(where, 0, 0);
1380 if (r < 0)
3539724c 1381 log_warning_errno(r, "Failed to chown /etc/resolv.conf, ignoring: %m");
03cfe0d5 1382
2547bb41
LP		 1383 return 0;
1384}
1385
04bc4a3f 1386static int setup_boot_id(const char *dest) {
3bbaff3e 1387 sd_id128_t rnd = SD_ID128_NULL;
03cfe0d5 1388 const char *from, *to;
04bc4a3f
LP		 1389 int r;
1390
04bc4a3f
LP		 1391 /* Generate a new randomized boot ID, so that each boot-up of
1392 * the container gets a new one */
1393
03cfe0d5
LP		 1394 from = prefix_roota(dest, "/run/proc-sys-kernel-random-boot-id");
1395 to = prefix_roota(dest, "/proc/sys/kernel/random/boot_id");
04bc4a3f
LP		 1396
1397 r = sd_id128_randomize(&rnd);
f647962d
MS		 1398 if (r < 0)
1399 return log_error_errno(r, "Failed to generate random boot id: %m");
04bc4a3f 1400
15b1248a 1401 r = id128_write(from, ID128_UUID, rnd, false);
f647962d
MS		 1402 if (r < 0)
1403 return log_error_errno(r, "Failed to write boot id: %m");
04bc4a3f 1404
60e76d48
ZJS		 1405 r = mount_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
1406 if (r >= 0)
1407 r = mount_verbose(LOG_ERR, NULL, to, NULL,
1408 MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL);
04bc4a3f 1409
3bbaff3e 1410 (void) unlink(from);
04bc4a3f
LP		 1411 return r;
1412}
1413
e58a1277 1414static int copy_devnodes(const char *dest) {
88213476
LP		 1415
1416 static const char devnodes[] =
1417 "null\0"
1418 "zero\0"
1419 "full\0"
1420 "random\0"
1421 "urandom\0"
85614d66
TG		 1422 "tty\0"
1423 "net/tun\0";
88213476
LP		 1424
1425 const char *d;
e58a1277 1426 int r = 0;
7fd1b19b 1427 _cleanup_umask_ mode_t u;
a258bf26
LP		 1428
1429 assert(dest);
124640f1
LP		 1430
1431 u = umask(0000);
88213476 1432
03cfe0d5
LP		 1433 /* Create /dev/net, so that we can create /dev/net/tun in it */
1434 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
1435 return log_error_errno(r, "Failed to create /dev/net directory: %m");
1436
88213476 1437 NULSTR_FOREACH(d, devnodes) {
7fd1b19b 1438 _cleanup_free_ char *from = NULL, *to = NULL;
7f112f50 1439 struct stat st;
88213476 1440
7f112f50 1441 from = strappend("/dev/", d);
03cfe0d5 1442 to = prefix_root(dest, from);
88213476
LP		 1443
1444 if (stat(from, &st) < 0) {
1445
4a62c710
MS		 1446 if (errno != ENOENT)
1447 return log_error_errno(errno, "Failed to stat %s: %m", from);
88213476 1448
a258bf26 1449 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode)) {
88213476 1450
03cfe0d5 1451 log_error("%s is not a char or block device, cannot copy.", from);
7f112f50 1452 return -EIO;
a258bf26 1453
85614d66 1454 } else {
81f5049b 1455 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
8dbf71ec 1456 /* Explicitly warn the user when /dev is already populated. */
41eb4362 1457 if (errno == EEXIST)
8dbf71ec 1458 log_notice("%s/dev is pre-mounted and pre-populated. If a pre-mounted /dev is provided it needs to be an unpopulated file system.", dest);
81f5049b
AC		 1459 if (errno != EPERM)
1460 return log_error_errno(errno, "mknod(%s) failed: %m", to);
1461
1462 /* Some systems abusively restrict mknod but
1463 * allow bind mounts. */
1464 r = touch(to);
1465 if (r < 0)
1466 return log_error_errno(r, "touch (%s) failed: %m", to);
60e76d48
ZJS		 1467 r = mount_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
1468 if (r < 0)
1469 return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
81f5049b 1470 }
6278cf60 1471
03cfe0d5
LP		 1472 r = userns_lchown(to, 0, 0);
1473 if (r < 0)
1474 return log_error_errno(r, "chown() of device node %s failed: %m", to);
88213476 1475 }
88213476
LP		 1476 }
1477
e58a1277
LP		 1478 return r;
1479}
88213476 1480
03cfe0d5
LP		 1481static int setup_pts(const char *dest) {
1482 _cleanup_free_ char *options = NULL;
1483 const char *p;
709f6e46 1484 int r;
03cfe0d5
LP		 1485
1486#ifdef HAVE_SELINUX
1487 if (arg_selinux_apifs_context)
1488 (void) asprintf(&options,
3dce8915 1489 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT ",context=\"%s\"",
03cfe0d5
LP		 1490 arg_uid_shift + TTY_GID,
1491 arg_selinux_apifs_context);
1492 else
1493#endif
1494 (void) asprintf(&options,
3dce8915 1495 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT,
03cfe0d5 1496 arg_uid_shift + TTY_GID);
f2d88580 1497
03cfe0d5 1498 if (!options)
f2d88580
LP		 1499 return log_oom();
1500
03cfe0d5 1501 /* Mount /dev/pts itself */
cc9fce65 1502 p = prefix_roota(dest, "/dev/pts");
03cfe0d5
LP		 1503 if (mkdir(p, 0755) < 0)
1504 return log_error_errno(errno, "Failed to create /dev/pts: %m");
60e76d48
ZJS		 1505 r = mount_verbose(LOG_ERR, "devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options);
1506 if (r < 0)
1507 return r;
709f6e46
MS		 1508 r = userns_lchown(p, 0, 0);
1509 if (r < 0)
1510 return log_error_errno(r, "Failed to chown /dev/pts: %m");
03cfe0d5
LP		 1511
1512 /* Create /dev/ptmx symlink */
1513 p = prefix_roota(dest, "/dev/ptmx");
4a62c710
MS		 1514 if (symlink("pts/ptmx", p) < 0)
1515 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
709f6e46
MS		 1516 r = userns_lchown(p, 0, 0);
1517 if (r < 0)
1518 return log_error_errno(r, "Failed to chown /dev/ptmx: %m");
f2d88580 1519
03cfe0d5
LP		 1520 /* And fix /dev/pts/ptmx ownership */
1521 p = prefix_roota(dest, "/dev/pts/ptmx");
709f6e46
MS		 1522 r = userns_lchown(p, 0, 0);
1523 if (r < 0)
1524 return log_error_errno(r, "Failed to chown /dev/pts/ptmx: %m");
6278cf60 1525
f2d88580
LP		 1526 return 0;
1527}
1528
e58a1277 1529static int setup_dev_console(const char *dest, const char *console) {
eb0f0863
LP		 1530 _cleanup_umask_ mode_t u;
1531 const char *to;
e58a1277 1532 int r;
e58a1277
LP		 1533
1534 assert(dest);
1535 assert(console);
1536
1537 u = umask(0000);
1538
03cfe0d5 1539 r = chmod_and_chown(console, 0600, arg_uid_shift, arg_uid_shift);
f647962d
MS		 1540 if (r < 0)
1541 return log_error_errno(r, "Failed to correct access mode for TTY: %m");
88213476 1542
a258bf26
LP		 1543 /* We need to bind mount the right tty to /dev/console since
1544 * ptys can only exist on pts file systems. To have something
81f5049b 1545 * to bind mount things on we create a empty regular file. */
a258bf26 1546
03cfe0d5 1547 to = prefix_roota(dest, "/dev/console");
81f5049b
AC		 1548 r = touch(to);
1549 if (r < 0)
1550 return log_error_errno(r, "touch() for /dev/console failed: %m");
a258bf26 1551
60e76d48 1552 return mount_verbose(LOG_ERR, console, to, NULL, MS_BIND, NULL);
e58a1277
LP		 1553}
1554
1555static int setup_kmsg(const char *dest, int kmsg_socket) {
03cfe0d5 1556 const char *from, *to;
7fd1b19b 1557 _cleanup_umask_ mode_t u;
d9603714 1558 int fd, r;
e58a1277 1559
e58a1277 1560 assert(kmsg_socket >= 0);
a258bf26 1561
e58a1277 1562 u = umask(0000);
a258bf26 1563
03cfe0d5 1564 /* We create the kmsg FIFO as /run/kmsg, but immediately
f1e5dfe2
LP		 1565 * delete it after bind mounting it to /proc/kmsg. While FIFOs
1566 * on the reading side behave very similar to /proc/kmsg,
1567 * their writing side behaves differently from /dev/kmsg in
1568 * that writing blocks when nothing is reading. In order to
1569 * avoid any problems with containers deadlocking due to this
1570 * we simply make /dev/kmsg unavailable to the container. */
03cfe0d5
LP		 1571 from = prefix_roota(dest, "/run/kmsg");
1572 to = prefix_roota(dest, "/proc/kmsg");
e58a1277 1573
4a62c710 1574 if (mkfifo(from, 0600) < 0)
03cfe0d5 1575 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
60e76d48
ZJS		 1576 r = mount_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
1577 if (r < 0)
1578 return r;
e58a1277
LP		 1579
1580 fd = open(from, O_RDWR|O_NDELAY|O_CLOEXEC);
4a62c710
MS		 1581 if (fd < 0)
1582 return log_error_errno(errno, "Failed to open fifo: %m");
e58a1277 1583
e58a1277
LP		 1584 /* Store away the fd in the socket, so that it stays open as
1585 * long as we run the child */
3ee897d6 1586 r = send_one_fd(kmsg_socket, fd, 0);
03e334a1 1587 safe_close(fd);
e58a1277 1588
d9603714
DH		 1589 if (r < 0)
1590 return log_error_errno(r, "Failed to send FIFO fd: %m");
a258bf26 1591
03cfe0d5
LP		 1592 /* And now make the FIFO unavailable as /run/kmsg... */
1593 (void) unlink(from);
1594
25ea79fe 1595 return 0;
88213476
LP		 1596}
1597
1c4baffc 1598static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
6d0b55c2
LP		 1599 union in_addr_union *exposed = userdata;
1600
1601 assert(rtnl);
1602 assert(m);
1603 assert(exposed);
1604
7a8f6325 1605 expose_port_execute(rtnl, arg_expose_ports, exposed);
6d0b55c2
LP		 1606 return 0;
1607}
1608
3a74cea5 1609static int setup_hostname(void) {
3a74cea5 1610
0c582db0 1611 if ((arg_clone_ns_flags & CLONE_NEWUTS) == 0)
eb91eb18
LP		 1612 return 0;
1613
605f81a8 1614 if (sethostname_idempotent(arg_machine) < 0)
7027ff61 1615 return -errno;
3a74cea5 1616
7027ff61 1617 return 0;
3a74cea5
LP		 1618}
1619
57fb9fb5 1620static int setup_journal(const char *directory) {
e01ff70a 1621 sd_id128_t this_id;
0f5e1382 1622 _cleanup_free_ char *d = NULL;
e01ff70a 1623 const char *p, *q;
8054d749 1624 bool try;
e01ff70a 1625 char id[33];
57fb9fb5
LP		 1626 int r;
1627
df9a75e4
LP		 1628 /* Don't link journals in ephemeral mode */
1629 if (arg_ephemeral)
1630 return 0;
1631
8054d749
LP		 1632 if (arg_link_journal == LINK_NO)
1633 return 0;
1634
1635 try = arg_link_journal_try || arg_link_journal == LINK_AUTO;
1636
4d680aee 1637 r = sd_id128_get_machine(&this_id);
f647962d
MS		 1638 if (r < 0)
1639 return log_error_errno(r, "Failed to retrieve machine ID: %m");
4d680aee 1640
e01ff70a 1641 if (sd_id128_equal(arg_uuid, this_id)) {
8054d749 1642 log_full(try ? LOG_WARNING : LOG_ERR,
e192a281 1643 "Host and machine ids are equal (%s): refusing to link journals", sd_id128_to_string(arg_uuid, id));
8054d749 1644 if (try)
4d680aee 1645 return 0;
df9a75e4 1646 return -EEXIST;
4d680aee
ZJS		 1647 }
1648
03cfe0d5
LP		 1649 r = userns_mkdir(directory, "/var", 0755, 0, 0);
1650 if (r < 0)
1651 return log_error_errno(r, "Failed to create /var: %m");
1652
1653 r = userns_mkdir(directory, "/var/log", 0755, 0, 0);
1654 if (r < 0)
1655 return log_error_errno(r, "Failed to create /var/log: %m");
1656
1657 r = userns_mkdir(directory, "/var/log/journal", 0755, 0, 0);
1658 if (r < 0)
1659 return log_error_errno(r, "Failed to create /var/log/journal: %m");
1660
e01ff70a
MS		 1661 (void) sd_id128_to_string(arg_uuid, id);
1662
03cfe0d5
LP		 1663 p = strjoina("/var/log/journal/", id);
1664 q = prefix_roota(directory, p);
27407a01 1665
e1873695 1666 if (path_is_mount_point(p, NULL, 0) > 0) {
8054d749
LP		 1667 if (try)
1668 return 0;
27407a01 1669
8054d749
LP		 1670 log_error("%s: already a mount point, refusing to use for journal", p);
1671 return -EEXIST;
57fb9fb5
LP		 1672 }
1673
e1873695 1674 if (path_is_mount_point(q, NULL, 0) > 0) {
8054d749
LP		 1675 if (try)
1676 return 0;
57fb9fb5 1677
8054d749
LP		 1678 log_error("%s: already a mount point, refusing to use for journal", q);
1679 return -EEXIST;
57fb9fb5
LP		 1680 }
1681
1682 r = readlink_and_make_absolute(p, &d);
1683 if (r >= 0) {
1684 if ((arg_link_journal == LINK_GUEST ||
1685 arg_link_journal == LINK_AUTO) &&
1686 path_equal(d, q)) {
1687
03cfe0d5 1688 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 1689 if (r < 0)
709f6e46 1690 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 1691 return 0;
57fb9fb5
LP		 1692 }
1693
4a62c710
MS		 1694 if (unlink(p) < 0)
1695 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
57fb9fb5
LP		 1696 } else if (r == -EINVAL) {
1697
1698 if (arg_link_journal == LINK_GUEST &&
1699 rmdir(p) < 0) {
1700
27407a01
ZJS		 1701 if (errno == ENOTDIR) {
1702 log_error("%s already exists and is neither a symlink nor a directory", p);
1703 return r;
4314d33f
MS		 1704 } else
1705 return log_error_errno(errno, "Failed to remove %s: %m", p);
57fb9fb5 1706 }
4314d33f
MS		 1707 } else if (r != -ENOENT)
1708 return log_error_errno(r, "readlink(%s) failed: %m", p);
57fb9fb5
LP		 1709
1710 if (arg_link_journal == LINK_GUEST) {
1711
1712 if (symlink(q, p) < 0) {
8054d749 1713 if (try) {
56f64d95 1714 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
574edc90 1715 return 0;
4314d33f
MS		 1716 } else
1717 return log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
57fb9fb5
LP		 1718 }
1719
03cfe0d5 1720 r = userns_mkdir(directory, p, 0755, 0, 0);
27407a01 1721 if (r < 0)
709f6e46 1722 log_warning_errno(r, "Failed to create directory %s: %m", q);
27407a01 1723 return 0;
57fb9fb5
LP		 1724 }
1725
1726 if (arg_link_journal == LINK_HOST) {
ccddd104 1727 /* don't create parents here — if the host doesn't have
574edc90 1728 * permanent journal set up, don't force it here */
ba8e6c4d
LP		 1729
1730 if (mkdir(p, 0755) < 0 && errno != EEXIST) {
8054d749 1731 if (try) {
56f64d95 1732 log_debug_errno(errno, "Failed to create %s, skipping journal setup: %m", p);
574edc90 1733 return 0;
4314d33f
MS		 1734 } else
1735 return log_error_errno(errno, "Failed to create %s: %m", p);
57fb9fb5
LP		 1736 }
1737
27407a01
ZJS		 1738 } else if (access(p, F_OK) < 0)
1739 return 0;
57fb9fb5 1740
cdb2b9d0
LP		 1741 if (dir_is_empty(q) == 0)
1742 log_warning("%s is not empty, proceeding anyway.", q);
1743
03cfe0d5 1744 r = userns_mkdir(directory, p, 0755, 0, 0);
709f6e46
MS		 1745 if (r < 0)
1746 return log_error_errno(r, "Failed to create %s: %m", q);
57fb9fb5 1747
60e76d48
ZJS		 1748 r = mount_verbose(LOG_DEBUG, p, q, NULL, MS_BIND, NULL);
1749 if (r < 0)
4a62c710 1750 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
57fb9fb5 1751
27407a01 1752 return 0;
57fb9fb5
LP		 1753}
1754
88213476 1755static int drop_capabilities(void) {
520e0d54 1756 return capability_bounding_set_drop(arg_caps_retain, false);
88213476
LP		 1757}
1758
db999e0f
LP		 1759static int reset_audit_loginuid(void) {
1760 _cleanup_free_ char *p = NULL;
1761 int r;
1762
0c582db0 1763 if ((arg_clone_ns_flags & CLONE_NEWPID) == 0)
db999e0f
LP		 1764 return 0;
1765
1766 r = read_one_line_file("/proc/self/loginuid", &p);
13e8ceb8 1767 if (r == -ENOENT)
db999e0f 1768 return 0;
f647962d
MS		 1769 if (r < 0)
1770 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
db999e0f
LP		 1771
1772 /* Already reset? */
1773 if (streq(p, "4294967295"))
1774 return 0;
1775
ad118bda 1776 r = write_string_file("/proc/self/loginuid", "4294967295", 0);
db999e0f 1777 if (r < 0) {
10a87006
LP		 1778 log_error_errno(r,
1779 "Failed to reset audit login UID. This probably means that your kernel is too\n"
1780 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
1781 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
1782 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
1783 "using systemd-nspawn. Sleeping for 5s... (%m)");
77b6e194 1784
db999e0f 1785 sleep(5);
77b6e194 1786 }
db999e0f
LP		 1787
1788 return 0;
77b6e194
LP		 1789}
1790
24fb1112 1791
785890ac
LP		 1792static int setup_propagate(const char *root) {
1793 const char *p, *q;
709f6e46 1794 int r;
785890ac
LP		 1795
1796 (void) mkdir_p("/run/systemd/nspawn/", 0755);
1797 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
63c372cb 1798 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
785890ac
LP		 1799 (void) mkdir_p(p, 0600);
1800
709f6e46
MS		 1801 r = userns_mkdir(root, "/run/systemd", 0755, 0, 0);
1802 if (r < 0)
1803 return log_error_errno(r, "Failed to create /run/systemd: %m");
03cfe0d5 1804
709f6e46
MS		 1805 r = userns_mkdir(root, "/run/systemd/nspawn", 0755, 0, 0);
1806 if (r < 0)
1807 return log_error_errno(r, "Failed to create /run/systemd/nspawn: %m");
03cfe0d5 1808
709f6e46
MS		 1809 r = userns_mkdir(root, "/run/systemd/nspawn/incoming", 0600, 0, 0);
1810 if (r < 0)
1811 return log_error_errno(r, "Failed to create /run/systemd/nspawn/incoming: %m");
785890ac 1812
03cfe0d5 1813 q = prefix_roota(root, "/run/systemd/nspawn/incoming");
60e76d48
ZJS		 1814 r = mount_verbose(LOG_ERR, p, q, NULL, MS_BIND, NULL);
1815 if (r < 0)
1816 return r;
785890ac 1817
60e76d48
ZJS		 1818 r = mount_verbose(LOG_ERR, NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
1819 if (r < 0)
1820 return r;
785890ac 1821
19caffac
AC		 1822 /* machined will MS_MOVE into that directory, and that's only
1823 * supported for non-shared mounts. */
60e76d48 1824 return mount_verbose(LOG_ERR, NULL, q, NULL, MS_SLAVE, NULL);
785890ac
LP		 1825}
1826
317feb4d 1827static int setup_machine_id(const char *directory) {
691675ba
LP		 1828 const char *etc_machine_id;
1829 sd_id128_t id;
3bbaff3e 1830 int r;
e01ff70a 1831
317feb4d
LP		 1832 /* If the UUID in the container is already set, then that's what counts, and we use. If it isn't set, and the
1833 * caller passed --uuid=, then we'll pass it in the $container_uuid env var to PID 1 of the container. The
1834 * assumption is that PID 1 will then write it to /etc/machine-id to make it persistent. If --uuid= is not
1835 * passed we generate a random UUID, and pass it via $container_uuid. In effect this means that /etc/machine-id
1836 * in the container and our idea of the container UUID will always be in sync (at least if PID 1 in the
1837 * container behaves nicely). */
1838
e01ff70a
MS		 1839 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
1840
691675ba 1841 r = id128_read(etc_machine_id, ID128_PLAIN, &id);
317feb4d
LP		 1842 if (r < 0) {
1843 if (!IN_SET(r, -ENOENT, -ENOMEDIUM)) /* If the file is missing or empty, we don't mind */
1844 return log_error_errno(r, "Failed to read machine ID from container image: %m");
691675ba 1845
317feb4d
LP		 1846 if (sd_id128_is_null(arg_uuid)) {
1847 r = sd_id128_randomize(&arg_uuid);
1848 if (r < 0)
1849 return log_error_errno(r, "Failed to acquire randomized machine UUID: %m");
1850 }
1851 } else {
1852 if (sd_id128_is_null(id)) {
1853 log_error("Machine ID in container image is zero, refusing.");
1854 return -EINVAL;
1855 }
e01ff70a 1856
317feb4d
LP		 1857 arg_uuid = id;
1858 }
691675ba 1859
e01ff70a
MS		 1860 return 0;
1861}
1862
7336138e
LP		 1863static int recursive_chown(const char *directory, uid_t shift, uid_t range) {
1864 int r;
1865
1866 assert(directory);
1867
0de7acce 1868 if (arg_userns_mode == USER_NAMESPACE_NO || !arg_userns_chown)
7336138e
LP		 1869 return 0;
1870
1871 r = path_patch_uid(directory, arg_uid_shift, arg_uid_range);
1872 if (r == -EOPNOTSUPP)
1873 return log_error_errno(r, "Automatic UID/GID adjusting is only supported for UID/GID ranges starting at multiples of 2^16 with a range of 2^16.");
1874 if (r == -EBADE)
1875 return log_error_errno(r, "Upper 16 bits of root directory UID and GID do not match.");
1876 if (r < 0)
1877 return log_error_errno(r, "Failed to adjust UID/GID shift of OS tree: %m");
1878 if (r == 0)
1879 log_debug("Root directory of image is already owned by the right UID/GID range, skipping recursive chown operation.");
1880 else
1881 log_debug("Patched directory tree to match UID/GID range.");
1882
1883 return r;
1884}
1885
113cea80 1886/*
6d416b9c
LS		 1887 * Return values:
1888 * < 0 : wait_for_terminate() failed to get the state of the
1889 * container, the container was terminated by a signal, or
1890 * failed for an unknown reason. No change is made to the
1891 * container argument.
1892 * > 0 : The program executed in the container terminated with an
1893 * error. The exit code of the program executed in the
919699ec
LP		 1894 * container is returned. The container argument has been set
1895 * to CONTAINER_TERMINATED.
6d416b9c
LS		 1896 * 0 : The container is being rebooted, has been shut down or exited
1897 * successfully. The container argument has been set to either
1898 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
113cea80 1899 *
6d416b9c
LS		 1900 * That is, success is indicated by a return value of zero, and an
1901 * error is indicated by a non-zero value.
113cea80
DH		 1902 */
1903static int wait_for_container(pid_t pid, ContainerStatus *container) {
113cea80 1904 siginfo_t status;
919699ec 1905 int r;
113cea80
DH		 1906
1907 r = wait_for_terminate(pid, &status);
f647962d
MS		 1908 if (r < 0)
1909 return log_warning_errno(r, "Failed to wait for container: %m");
113cea80
DH		 1910
1911 switch (status.si_code) {
fddbb89c 1912
113cea80 1913 case CLD_EXITED:
b5a2179b 1914 if (status.si_status == 0)
919699ec 1915 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
b5a2179b 1916 else
919699ec 1917 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
fddbb89c 1918
919699ec
LP		 1919 *container = CONTAINER_TERMINATED;
1920 return status.si_status;
113cea80
DH		 1921
1922 case CLD_KILLED:
1923 if (status.si_status == SIGINT) {
919699ec 1924 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
113cea80 1925 *container = CONTAINER_TERMINATED;
919699ec
LP		 1926 return 0;
1927
113cea80 1928 } else if (status.si_status == SIGHUP) {
919699ec 1929 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
113cea80 1930 *container = CONTAINER_REBOOTED;
919699ec 1931 return 0;
113cea80 1932 }
919699ec 1933
ec251fe7 1934 /* fall through */
113cea80
DH		 1935
1936 case CLD_DUMPED:
fddbb89c 1937 log_error("Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
919699ec 1938 return -EIO;
113cea80
DH		 1939
1940 default:
fddbb89c 1941 log_error("Container %s failed due to unknown reason.", arg_machine);
919699ec 1942 return -EIO;
113cea80 1943 }
113cea80
DH		 1944}
1945
023fb90b
LP		 1946static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
1947 pid_t pid;
1948
4a0b58c4 1949 pid = PTR_TO_PID(userdata);
023fb90b 1950 if (pid > 0) {
c6c8f6e2 1951 if (kill(pid, arg_kill_signal) >= 0) {
023fb90b
LP		 1952 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
1953 sd_event_source_set_userdata(s, NULL);
1954 return 0;
1955 }
1956 }
1957
1958 sd_event_exit(sd_event_source_get_event(s), 0);
1959 return 0;
1960}
1961
6916b164
AU		 1962static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *ssi, void *userdata) {
1963 for (;;) {
1964 siginfo_t si = {};
1965 if (waitid(P_ALL, 0, &si, WNOHANG|WNOWAIT|WEXITED) < 0)
1966 return log_error_errno(errno, "Failed to waitid(): %m");
1967 if (si.si_pid == 0) /* No pending children. */
1968 break;
1969 if (si.si_pid == PTR_TO_PID(userdata)) {
1970 /* The main process we care for has exited. Return from
1971 * signal handler but leave the zombie. */
1972 sd_event_exit(sd_event_source_get_event(s), 0);
1973 break;
1974 }
1975 /* Reap all other children. */
1976 (void) waitid(P_PID, si.si_pid, &si, WNOHANG|WEXITED);
1977 }
1978
1979 return 0;
1980}
1981
ec16945e 1982static int determine_names(void) {
1b9cebf6 1983 int r;
ec16945e 1984
c1521918
LP		 1985 if (arg_template && !arg_directory && arg_machine) {
1986
1987 /* If --template= was specified then we should not
1988 * search for a machine, but instead create a new one
1989 * in /var/lib/machine. */
1990
605405c6 1991 arg_directory = strjoin("/var/lib/machines/", arg_machine);
c1521918
LP		 1992 if (!arg_directory)
1993 return log_oom();
1994 }
1995
ec16945e 1996 if (!arg_image && !arg_directory) {
1b9cebf6
LP		 1997 if (arg_machine) {
1998 _cleanup_(image_unrefp) Image *i = NULL;
1999
2000 r = image_find(arg_machine, &i);
2001 if (r < 0)
2002 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
0f3be6ca 2003 if (r == 0) {
1b9cebf6
LP		 2004 log_error("No image for machine '%s': %m", arg_machine);
2005 return -ENOENT;
2006 }
2007
aceac2f0 2008 if (i->type == IMAGE_RAW)
0f03c2a4 2009 r = free_and_strdup(&arg_image, i->path);
1b9cebf6 2010 else
0f03c2a4 2011 r = free_and_strdup(&arg_directory, i->path);
1b9cebf6 2012 if (r < 0)
0f3be6ca 2013 return log_oom();
1b9cebf6 2014
aee327b8
LP		 2015 if (!arg_ephemeral)
2016 arg_read_only = arg_read_only || i->read_only;
1b9cebf6 2017 } else
ec16945e
LP		 2018 arg_directory = get_current_dir_name();
2019
0f3be6ca 2020 if (!arg_directory && !arg_image) {
1b9cebf6 2021 log_error("Failed to determine path, please use -D or -i.");
ec16945e
LP		 2022 return -EINVAL;
2023 }
2024 }
2025
2026 if (!arg_machine) {
4827ab48 2027
b9ba4dab
LP		 2028 if (arg_directory && path_equal(arg_directory, "/"))
2029 arg_machine = gethostname_malloc();
4827ab48
LP		 2030 else {
2031 if (arg_image) {
2032 char *e;
2033
2034 arg_machine = strdup(basename(arg_image));
2035
2036 /* Truncate suffix if there is one */
2037 e = endswith(arg_machine, ".raw");
2038 if (e)
2039 *e = 0;
2040 } else
2041 arg_machine = strdup(basename(arg_directory));
2042 }
ec16945e
LP		 2043 if (!arg_machine)
2044 return log_oom();
2045
ae691c1d 2046 hostname_cleanup(arg_machine);
ec16945e
LP		 2047 if (!machine_name_is_valid(arg_machine)) {
2048 log_error("Failed to determine machine name automatically, please use -M.");
2049 return -EINVAL;
2050 }
b9ba4dab
LP		 2051
2052 if (arg_ephemeral) {
2053 char *b;
2054
2055 /* Add a random suffix when this is an
2056 * ephemeral machine, so that we can run many
2057 * instances at once without manually having
2058 * to specify -M each time. */
2059
2060 if (asprintf(&b, "%s-%016" PRIx64, arg_machine, random_u64()) < 0)
2061 return log_oom();
2062
2063 free(arg_machine);
2064 arg_machine = b;
2065 }
ec16945e
LP		 2066 }
2067
2068 return 0;
2069}
2070
8d4aa2bb 2071static int chase_symlinks_and_update(char **p, unsigned flags) {
3f342ec4
LP		 2072 char *chased;
2073 int r;
2074
2075 assert(p);
2076
2077 if (!*p)
2078 return 0;
2079
8d4aa2bb 2080 r = chase_symlinks(*p, NULL, flags, &chased);
3f342ec4
LP		 2081 if (r < 0)
2082 return log_error_errno(r, "Failed to resolve path %s: %m", *p);
2083
2084 free(*p);
2085 *p = chased;
2086
2087 return 0;
2088}
2089
03cfe0d5 2090static int determine_uid_shift(const char *directory) {
6dac160c
LP		 2091 int r;
2092
0de7acce 2093 if (arg_userns_mode == USER_NAMESPACE_NO) {
03cfe0d5 2094 arg_uid_shift = 0;
6dac160c 2095 return 0;
03cfe0d5 2096 }
6dac160c
LP		 2097
2098 if (arg_uid_shift == UID_INVALID) {
2099 struct stat st;
2100
03cfe0d5 2101 r = stat(directory, &st);
6dac160c 2102 if (r < 0)
03cfe0d5 2103 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
6dac160c
LP		 2104
2105 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
2106
2107 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000))) {
03cfe0d5 2108 log_error("UID and GID base of %s don't match.", directory);
6dac160c
LP		 2109 return -EINVAL;
2110 }
2111
2112 arg_uid_range = UINT32_C(0x10000);
2113 }
2114
2115 if (arg_uid_shift > (uid_t) -1 - arg_uid_range) {
2116 log_error("UID base too high for UID range.");
2117 return -EINVAL;
2118 }
2119
6dac160c
LP		 2120 return 0;
2121}
2122
03cfe0d5
LP		 2123static int inner_child(
2124 Barrier *barrier,
2125 const char *directory,
2126 bool secondary,
2127 int kmsg_socket,
2128 int rtnl_socket,
f757855e 2129 FDSet *fds) {
69c79d3c 2130
03cfe0d5 2131 _cleanup_free_ char *home = NULL;
e01ff70a 2132 char as_uuid[37];
6aadfa4c 2133 unsigned n_env = 1;
03cfe0d5
LP		 2134 const char *envp[] = {
2135 "PATH=" DEFAULT_PATH_SPLIT_USR,
6aadfa4c 2136 NULL, /* container */
03cfe0d5
LP		 2137 NULL, /* TERM */
2138 NULL, /* HOME */
2139 NULL, /* USER */
2140 NULL, /* LOGNAME */
2141 NULL, /* container_uuid */
2142 NULL, /* LISTEN_FDS */
2143 NULL, /* LISTEN_PID */
9c1e04d0 2144 NULL, /* NOTIFY_SOCKET */
03cfe0d5
LP		 2145 NULL
2146 };
1a68e1e5 2147 const char *exec_target;
88213476 2148
2371271c 2149 _cleanup_strv_free_ char **env_use = NULL;
03cfe0d5 2150 int r;
88213476 2151
03cfe0d5
LP		 2152 assert(barrier);
2153 assert(directory);
2154 assert(kmsg_socket >= 0);
88213476 2155
efdb0237
LP		 2156 cg_unified_flush();
2157
0de7acce 2158 if (arg_userns_mode != USER_NAMESPACE_NO) {
03cfe0d5
LP		 2159 /* Tell the parent, that it now can write the UID map. */
2160 (void) barrier_place(barrier); /* #1 */
7027ff61 2161
03cfe0d5
LP		 2162 /* Wait until the parent wrote the UID map */
2163 if (!barrier_place_and_sync(barrier)) { /* #2 */
2164 log_error("Parent died too early");
2165 return -ESRCH;
2166 }
88213476
LP		 2167 }
2168
6d66bd3b
EV		 2169 r = reset_uid_gid();
2170 if (r < 0)
2171 return log_error_errno(r, "Couldn't become new root: %m");
2172
0de7acce 2173 r = mount_all(NULL,
4f086aab 2174 arg_mount_settings | MOUNT_IN_USERNS,
0de7acce
LP		 2175 arg_uid_shift,
2176 arg_uid_range,
2177 arg_selinux_apifs_context);
2178
03cfe0d5
LP		 2179 if (r < 0)
2180 return r;
2181
4f086aab 2182 r = mount_sysfs(NULL, arg_mount_settings);
d8fc6a00
LP		 2183 if (r < 0)
2184 return r;
2185
03cfe0d5
LP		 2186 /* Wait until we are cgroup-ified, so that we
2187 * can mount the right cgroup path writable */
2188 if (!barrier_place_and_sync(barrier)) { /* #3 */
2189 log_error("Parent died too early");
2190 return -ESRCH;
88213476
LP		 2191 }
2192
5a8ff0e6 2193 if (arg_use_cgns && cg_ns_supported()) {
0996ef00
CB		 2194 r = unshare(CLONE_NEWCGROUP);
2195 if (r < 0)
2196 return log_error_errno(errno, "Failed to unshare cgroup namespace");
2197 r = mount_cgroups(
2198 "",
2199 arg_unified_cgroup_hierarchy,
2200 arg_userns_mode != USER_NAMESPACE_NO,
2201 arg_uid_shift,
2202 arg_uid_range,
5a8ff0e6 2203 arg_selinux_apifs_context,
ada54120 2204 true);
0996ef00
CB		 2205 if (r < 0)
2206 return r;
2207 } else {
2208 r = mount_systemd_cgroup_writable("", arg_unified_cgroup_hierarchy);
2209 if (r < 0)
2210 return r;
2211 }
ec16945e 2212
03cfe0d5
LP		 2213 r = setup_boot_id(NULL);
2214 if (r < 0)
2215 return r;
ec16945e 2216
03cfe0d5
LP		 2217 r = setup_kmsg(NULL, kmsg_socket);
2218 if (r < 0)
2219 return r;
2220 kmsg_socket = safe_close(kmsg_socket);
ec16945e 2221
03cfe0d5 2222 umask(0022);
30535c16 2223
03cfe0d5
LP		 2224 if (setsid() < 0)
2225 return log_error_errno(errno, "setsid() failed: %m");
2226
2227 if (arg_private_network)
2228 loopback_setup();
2229
7a8f6325
LP		 2230 if (arg_expose_ports) {
2231 r = expose_port_send_rtnl(rtnl_socket);
2232 if (r < 0)
2233 return r;
2234 rtnl_socket = safe_close(rtnl_socket);
2235 }
03cfe0d5 2236
709f6e46
MS		 2237 r = drop_capabilities();
2238 if (r < 0)
2239 return log_error_errno(r, "drop_capabilities() failed: %m");
03cfe0d5
LP		 2240
2241 setup_hostname();
2242
050f7277 2243 if (arg_personality != PERSONALITY_INVALID) {
03cfe0d5
LP		 2244 if (personality(arg_personality) < 0)
2245 return log_error_errno(errno, "personality() failed: %m");
2246 } else if (secondary) {
2247 if (personality(PER_LINUX32) < 0)
2248 return log_error_errno(errno, "personality() failed: %m");
2249 }
2250
2251#ifdef HAVE_SELINUX
2252 if (arg_selinux_context)
2ed96880 2253 if (setexeccon(arg_selinux_context) < 0)
03cfe0d5
LP		 2254 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
2255#endif
2256
ee645080 2257 r = change_uid_gid(arg_user, &home);
03cfe0d5
LP		 2258 if (r < 0)
2259 return r;
2260
6aadfa4c
ILG		 2261 /* LXC sets container=lxc, so follow the scheme here */
2262 envp[n_env++] = strjoina("container=", arg_container_service_name);
2263
03cfe0d5
LP		 2264 envp[n_env] = strv_find_prefix(environ, "TERM=");
2265 if (envp[n_env])
313cefa1 2266 n_env++;
03cfe0d5
LP		 2267
2268 if ((asprintf((char**)(envp + n_env++), "HOME=%s", home ? home: "/root") < 0) ||
2269 (asprintf((char**)(envp + n_env++), "USER=%s", arg_user ? arg_user : "root") < 0) ||
2270 (asprintf((char**)(envp + n_env++), "LOGNAME=%s", arg_user ? arg_user : "root") < 0))
2271 return log_oom();
2272
3bbaff3e 2273 assert(!sd_id128_is_null(arg_uuid));
03cfe0d5 2274
691675ba 2275 if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_to_uuid_string(arg_uuid, as_uuid)) < 0)
e01ff70a 2276 return log_oom();
03cfe0d5
LP		 2277
2278 if (fdset_size(fds) > 0) {
2279 r = fdset_cloexec(fds, false);
2280 if (r < 0)
2281 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
2282
2283 if ((asprintf((char **)(envp + n_env++), "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
2284 (asprintf((char **)(envp + n_env++), "LISTEN_PID=1") < 0))
2285 return log_oom();
2286 }
9c1e04d0
AP		 2287 if (asprintf((char **)(envp + n_env++), "NOTIFY_SOCKET=%s", NSPAWN_NOTIFY_SOCKET_PATH) < 0)
2288 return log_oom();
03cfe0d5 2289
2371271c
TG		 2290 env_use = strv_env_merge(2, envp, arg_setenv);
2291 if (!env_use)
2292 return log_oom();
03cfe0d5
LP		 2293
2294 /* Let the parent know that we are ready and
2295 * wait until the parent is ready with the
2296 * setup, too... */
2297 if (!barrier_place_and_sync(barrier)) { /* #4 */
2298 log_error("Parent died too early");
2299 return -ESRCH;
2300 }
2301
5f932eb9
LP		 2302 if (arg_chdir)
2303 if (chdir(arg_chdir) < 0)
2304 return log_error_errno(errno, "Failed to change to specified working directory %s: %m", arg_chdir);
2305
7732f92b 2306 if (arg_start_mode == START_PID2) {
75bf701f 2307 r = stub_pid1(arg_uuid);
7732f92b
LP		 2308 if (r < 0)
2309 return r;
2310 }
2311
03cfe0d5
LP		 2312 /* Now, explicitly close the log, so that we
2313 * then can close all remaining fds. Closing
2314 * the log explicitly first has the benefit
2315 * that the logging subsystem knows about it,
2316 * and is thus ready to be reopened should we
2317 * need it again. Note that the other fds
2318 * closed here are at least the locking and
2319 * barrier fds. */
2320 log_close();
2321 (void) fdset_close_others(fds);
2322
7732f92b 2323 if (arg_start_mode == START_BOOT) {
03cfe0d5
LP		 2324 char **a;
2325 size_t m;
2326
2327 /* Automatically search for the init system */
2328
75f32f04
ZJS		 2329 m = strv_length(arg_parameters);
2330 a = newa(char*, m + 2);
2331 memcpy_safe(a + 1, arg_parameters, m * sizeof(char*));
2332 a[1 + m] = NULL;
03cfe0d5 2333
ced58da7 2334 a[0] = (char*) "/usr/lib/systemd/systemd";
03cfe0d5
LP		 2335 execve(a[0], a, env_use);
2336
ced58da7 2337 a[0] = (char*) "/lib/systemd/systemd";
03cfe0d5
LP		 2338 execve(a[0], a, env_use);
2339
ced58da7 2340 a[0] = (char*) "/sbin/init";
03cfe0d5 2341 execve(a[0], a, env_use);
ced58da7
LP		 2342
2343 exec_target = "/usr/lib/systemd/systemd, /lib/systemd/systemd, /sbin/init";
1a68e1e5
PW		 2344 } else if (!strv_isempty(arg_parameters)) {
2345 exec_target = arg_parameters[0];
f757855e 2346 execvpe(arg_parameters[0], arg_parameters, env_use);
1a68e1e5 2347 } else {
5f932eb9 2348 if (!arg_chdir)
d929b0f9
ZJS		 2349 /* If we cannot change the directory, we'll end up in /, that is expected. */
2350 (void) chdir(home ?: "/root");
5f932eb9 2351
03cfe0d5
LP		 2352 execle("/bin/bash", "-bash", NULL, env_use);
2353 execle("/bin/sh", "-sh", NULL, env_use);
ced58da7
LP		 2354
2355 exec_target = "/bin/bash, /bin/sh";
03cfe0d5
LP		 2356 }
2357
35607a8d 2358 r = -errno;
03cfe0d5 2359 (void) log_open();
1a68e1e5 2360 return log_error_errno(r, "execv(%s) failed: %m", exec_target);
03cfe0d5
LP		 2361}
2362
9c1e04d0
AP		 2363static int setup_sd_notify_child(void) {
2364 static const int one = 1;
2365 int fd = -1;
2366 union sockaddr_union sa = {
2367 .sa.sa_family = AF_UNIX,
2368 };
2369 int r;
2370
2371 fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
2372 if (fd < 0)
2373 return log_error_errno(errno, "Failed to allocate notification socket: %m");
2374
2375 (void) mkdir_parents(NSPAWN_NOTIFY_SOCKET_PATH, 0755);
2376 (void) unlink(NSPAWN_NOTIFY_SOCKET_PATH);
2377
2378 strncpy(sa.un.sun_path, NSPAWN_NOTIFY_SOCKET_PATH, sizeof(sa.un.sun_path)-1);
2379 r = bind(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
2380 if (r < 0) {
2381 safe_close(fd);
2382 return log_error_errno(errno, "bind(%s) failed: %m", sa.un.sun_path);
2383 }
2384
adc7d9f0
EV		 2385 r = userns_lchown(NSPAWN_NOTIFY_SOCKET_PATH, 0, 0);
2386 if (r < 0) {
2387 safe_close(fd);
2388 return log_error_errno(r, "Failed to chown " NSPAWN_NOTIFY_SOCKET_PATH ": %m");
2389 }
2390
9c1e04d0
AP		 2391 r = setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one));
2392 if (r < 0) {
2393 safe_close(fd);
2394 return log_error_errno(errno, "SO_PASSCRED failed: %m");
2395 }
2396
2397 return fd;
2398}
2399
03cfe0d5
LP		 2400static int outer_child(
2401 Barrier *barrier,
2402 const char *directory,
2403 const char *console,
2d845785 2404 DissectedImage *dissected_image,
03cfe0d5
LP		 2405 bool interactive,
2406 bool secondary,
2407 int pid_socket,
e01ff70a 2408 int uuid_socket,
9c1e04d0 2409 int notify_socket,
03cfe0d5
LP		 2410 int kmsg_socket,
2411 int rtnl_socket,
825d5287 2412 int uid_shift_socket,
f757855e 2413 FDSet *fds) {
03cfe0d5
LP		 2414
2415 pid_t pid;
2416 ssize_t l;
2417 int r;
9c1e04d0 2418 _cleanup_close_ int fd = -1;
03cfe0d5
LP		 2419
2420 assert(barrier);
2421 assert(directory);
2422 assert(console);
2423 assert(pid_socket >= 0);
e01ff70a 2424 assert(uuid_socket >= 0);
9c1e04d0 2425 assert(notify_socket >= 0);
03cfe0d5
LP		 2426 assert(kmsg_socket >= 0);
2427
efdb0237
LP		 2428 cg_unified_flush();
2429
03cfe0d5
LP		 2430 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
2431 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
2432
2433 if (interactive) {
2434 close_nointr(STDIN_FILENO);
2435 close_nointr(STDOUT_FILENO);
2436 close_nointr(STDERR_FILENO);
2437
2438 r = open_terminal(console, O_RDWR);
2439 if (r != STDIN_FILENO) {
2440 if (r >= 0) {
2441 safe_close(r);
2442 r = -EINVAL;
2443 }
2444
2445 return log_error_errno(r, "Failed to open console: %m");
2446 }
2447
2448 if (dup2(STDIN_FILENO, STDOUT_FILENO) != STDOUT_FILENO ||
2449 dup2(STDIN_FILENO, STDERR_FILENO) != STDERR_FILENO)
2450 return log_error_errno(errno, "Failed to duplicate console: %m");
2451 }
2452
2453 r = reset_audit_loginuid();
2454 if (r < 0)
2455 return r;
2456
2457 /* Mark everything as slave, so that we still
2458 * receive mounts from the real root, but don't
2459 * propagate mounts to the real root. */
60e76d48
ZJS		 2460 r = mount_verbose(LOG_ERR, NULL, "/", NULL, MS_SLAVE|MS_REC, NULL);
2461 if (r < 0)
2462 return r;
03cfe0d5 2463
2d845785 2464 if (dissected_image) {
18b5886e 2465 r = dissected_image_mount(dissected_image, directory, DISSECT_IMAGE_DISCARD_ON_LOOP|(arg_read_only ? DISSECT_IMAGE_READ_ONLY : 0));
2d845785
LP		 2466 if (r < 0)
2467 return r;
2468 }
03cfe0d5 2469
391567f4
LP		 2470 r = determine_uid_shift(directory);
2471 if (r < 0)
2472 return r;
2473
0fd9563f
ZJS		 2474 r = detect_unified_cgroup_hierarchy(directory);
2475 if (r < 0)
2476 return r;
2477
0de7acce 2478 if (arg_userns_mode != USER_NAMESPACE_NO) {
0e7ac751 2479 /* Let the parent know which UID shift we read from the image */
825d5287
RM		 2480 l = send(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
2481 if (l < 0)
2482 return log_error_errno(errno, "Failed to send UID shift: %m");
2483 if (l != sizeof(arg_uid_shift)) {
2484 log_error("Short write while sending UID shift.");
2485 return -EIO;
2486 }
0e7ac751 2487
0de7acce 2488 if (arg_userns_mode == USER_NAMESPACE_PICK) {
0e7ac751
LP		 2489 /* When we are supposed to pick the UID shift, the parent will check now whether the UID shift
2490 * we just read from the image is available. If yes, it will send the UID shift back to us, if
2491 * not it will pick a different one, and send it back to us. */
2492
2493 l = recv(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
2494 if (l < 0)
2495 return log_error_errno(errno, "Failed to recv UID shift: %m");
2496 if (l != sizeof(arg_uid_shift)) {
595bfe7d 2497 log_error("Short read while receiving UID shift.");
0e7ac751
LP		 2498 return -EIO;
2499 }
2500 }
2501
2502 log_info("Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
825d5287
RM		 2503 }
2504
03cfe0d5 2505 /* Turn directory into bind mount */
60e76d48
ZJS		 2506 r = mount_verbose(LOG_ERR, directory, directory, NULL, MS_BIND|MS_REC, NULL);
2507 if (r < 0)
2508 return r;
03cfe0d5 2509
b53ede69
PW		 2510 r = setup_pivot_root(
2511 directory,
2512 arg_pivot_root_new,
2513 arg_pivot_root_old);
2514 if (r < 0)
2515 return r;
2516
0de7acce
LP		 2517 r = setup_volatile(
2518 directory,
2519 arg_volatile_mode,
2520 arg_userns_mode != USER_NAMESPACE_NO,
2521 arg_uid_shift,
2522 arg_uid_range,
2523 arg_selinux_context);
03cfe0d5
LP		 2524 if (r < 0)
2525 return r;
2526
0de7acce
LP		 2527 r = setup_volatile_state(
2528 directory,
2529 arg_volatile_mode,
2530 arg_userns_mode != USER_NAMESPACE_NO,
2531 arg_uid_shift,
2532 arg_uid_range,
2533 arg_selinux_context);
03cfe0d5
LP		 2534 if (r < 0)
2535 return r;
2536
4ad14eff
LP		 2537 /* Mark everything as shared so our mounts get propagated down. This is
2538 * required to make new bind mounts available in systemd services
2539 * inside the containter that create a new mount namespace.
2540 * See https://github.com/systemd/systemd/issues/3860
2541 * Further submounts (such as /dev) done after this will inherit the
2542 * shared propagation mode.*/
2543 r = mount_verbose(LOG_ERR, NULL, directory, NULL, MS_SHARED|MS_REC, NULL);
2544 if (r < 0)
2545 return r;
2546
2547 r = recursive_chown(directory, arg_uid_shift, arg_uid_range);
2548 if (r < 0)
2549 return r;
2550
03cfe0d5
LP		 2551 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
2552 if (r < 0)
2553 return r;
2554
03cfe0d5 2555 if (arg_read_only) {
6b7c9f8b 2556 r = bind_remount_recursive(directory, true, NULL);
03cfe0d5
LP		 2557 if (r < 0)
2558 return log_error_errno(r, "Failed to make tree read-only: %m");
2559 }
2560
0de7acce 2561 r = mount_all(directory,
4f086aab 2562 arg_mount_settings,
0de7acce
LP		 2563 arg_uid_shift,
2564 arg_uid_range,
2565 arg_selinux_apifs_context);
03cfe0d5
LP		 2566 if (r < 0)
2567 return r;
2568
07fa00f9
LP		 2569 r = copy_devnodes(directory);
2570 if (r < 0)
03cfe0d5
LP		 2571 return r;
2572
2573 dev_setup(directory, arg_uid_shift, arg_uid_shift);
2574
07fa00f9
LP		 2575 r = setup_pts(directory);
2576 if (r < 0)
03cfe0d5
LP		 2577 return r;
2578
2579 r = setup_propagate(directory);
2580 if (r < 0)
2581 return r;
2582
2583 r = setup_dev_console(directory, console);
2584 if (r < 0)
2585 return r;
2586
520e0d54 2587 r = setup_seccomp(arg_caps_retain);
03cfe0d5
LP		 2588 if (r < 0)
2589 return r;
2590
2591 r = setup_timezone(directory);
2592 if (r < 0)
2593 return r;
2594
2595 r = setup_resolv_conf(directory);
2596 if (r < 0)
2597 return r;
2598
e01ff70a
MS		 2599 r = setup_machine_id(directory);
2600 if (r < 0)
2601 return r;
2602
03cfe0d5
LP		 2603 r = setup_journal(directory);
2604 if (r < 0)
2605 return r;
2606
0de7acce
LP		 2607 r = mount_custom(
2608 directory,
2609 arg_custom_mounts,
2610 arg_n_custom_mounts,
2611 arg_userns_mode != USER_NAMESPACE_NO,
2612 arg_uid_shift,
2613 arg_uid_range,
2614 arg_selinux_apifs_context);
03cfe0d5
LP		 2615 if (r < 0)
2616 return r;
2617
5a8ff0e6 2618 if (!arg_use_cgns || !cg_ns_supported()) {
0996ef00
CB		 2619 r = mount_cgroups(
2620 directory,
2621 arg_unified_cgroup_hierarchy,
2622 arg_userns_mode != USER_NAMESPACE_NO,
2623 arg_uid_shift,
2624 arg_uid_range,
5a8ff0e6 2625 arg_selinux_apifs_context,
ada54120 2626 false);
0996ef00
CB		 2627 if (r < 0)
2628 return r;
2629 }
03cfe0d5
LP		 2630
2631 r = mount_move_root(directory);
2632 if (r < 0)
2633 return log_error_errno(r, "Failed to move root directory: %m");
2634
9c1e04d0
AP		 2635 fd = setup_sd_notify_child();
2636 if (fd < 0)
2637 return fd;
2638
03cfe0d5 2639 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
0c582db0 2640 arg_clone_ns_flags |
03cfe0d5 2641 (arg_private_network ? CLONE_NEWNET : 0) |
8869a0b4 2642 (arg_userns_mode != USER_NAMESPACE_NO ? CLONE_NEWUSER : 0));
03cfe0d5
LP		 2643 if (pid < 0)
2644 return log_error_errno(errno, "Failed to fork inner child: %m");
03cfe0d5
LP		 2645 if (pid == 0) {
2646 pid_socket = safe_close(pid_socket);
e01ff70a 2647 uuid_socket = safe_close(uuid_socket);
9c1e04d0 2648 notify_socket = safe_close(notify_socket);
825d5287 2649 uid_shift_socket = safe_close(uid_shift_socket);
03cfe0d5
LP		 2650
2651 /* The inner child has all namespaces that are
2652 * requested, so that we all are owned by the user if
2653 * user namespaces are turned on. */
2654
f757855e 2655 r = inner_child(barrier, directory, secondary, kmsg_socket, rtnl_socket, fds);
03cfe0d5
LP		 2656 if (r < 0)
2657 _exit(EXIT_FAILURE);
2658
2659 _exit(EXIT_SUCCESS);
2660 }
2661
2662 l = send(pid_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
2663 if (l < 0)
2664 return log_error_errno(errno, "Failed to send PID: %m");
2665 if (l != sizeof(pid)) {
2666 log_error("Short write while sending PID.");
2667 return -EIO;
2668 }
2669
e01ff70a
MS		 2670 l = send(uuid_socket, &arg_uuid, sizeof(arg_uuid), MSG_NOSIGNAL);
2671 if (l < 0)
2672 return log_error_errno(errno, "Failed to send machine ID: %m");
2673 if (l != sizeof(arg_uuid)) {
2674 log_error("Short write while sending machine ID.");
2675 return -EIO;
2676 }
2677
9c1e04d0
AP		 2678 l = send_one_fd(notify_socket, fd, 0);
2679 if (l < 0)
2680 return log_error_errno(errno, "Failed to send notify fd: %m");
2681
03cfe0d5 2682 pid_socket = safe_close(pid_socket);
e01ff70a 2683 uuid_socket = safe_close(uuid_socket);
9c1e04d0 2684 notify_socket = safe_close(notify_socket);
327e26d6
KN		 2685 kmsg_socket = safe_close(kmsg_socket);
2686 rtnl_socket = safe_close(rtnl_socket);
03cfe0d5
LP		 2687
2688 return 0;
2689}
2690
0e7ac751
LP		 2691static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
2692 unsigned n_tries = 100;
2693 uid_t candidate;
2694 int r;
2695
2696 assert(shift);
2697 assert(ret_lock_file);
0de7acce 2698 assert(arg_userns_mode == USER_NAMESPACE_PICK);
0e7ac751
LP		 2699 assert(arg_uid_range == 0x10000U);
2700
2701 candidate = *shift;
2702
2703 (void) mkdir("/run/systemd/nspawn-uid", 0755);
2704
2705 for (;;) {
2706 char lock_path[strlen("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
2707 _cleanup_release_lock_file_ LockFile lf = LOCK_FILE_INIT;
2708
2709 if (--n_tries <= 0)
2710 return -EBUSY;
2711
2712 if (candidate < UID_SHIFT_PICK_MIN || candidate > UID_SHIFT_PICK_MAX)
2713 goto next;
2714 if ((candidate & UINT32_C(0xFFFF)) != 0)
2715 goto next;
2716
2717 xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
2718 r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
2719 if (r == -EBUSY) /* Range already taken by another nspawn instance */
2720 goto next;
2721 if (r < 0)
2722 return r;
2723
2724 /* Make some superficial checks whether the range is currently known in the user database */
2725 if (getpwuid(candidate))
2726 goto next;
2727 if (getpwuid(candidate + UINT32_C(0xFFFE)))
2728 goto next;
2729 if (getgrgid(candidate))
2730 goto next;
2731 if (getgrgid(candidate + UINT32_C(0xFFFE)))
2732 goto next;
2733
2734 *ret_lock_file = lf;
2735 lf = (struct LockFile) LOCK_FILE_INIT;
2736 *shift = candidate;
2737 return 0;
2738
2739 next:
2740 random_bytes(&candidate, sizeof(candidate));
2741 candidate = (candidate % (UID_SHIFT_PICK_MAX - UID_SHIFT_PICK_MIN)) + UID_SHIFT_PICK_MIN;
2742 candidate &= (uid_t) UINT32_C(0xFFFF0000);
2743 }
2744}
2745
03cfe0d5
LP		 2746static int setup_uid_map(pid_t pid) {
2747 char uid_map[strlen("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1], line[DECIMAL_STR_MAX(uid_t)*3+3+1];
2748 int r;
2749
2750 assert(pid > 1);
2751
2752 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
2753 xsprintf(line, UID_FMT " " UID_FMT " " UID_FMT "\n", 0, arg_uid_shift, arg_uid_range);
ad118bda 2754 r = write_string_file(uid_map, line, 0);
03cfe0d5
LP		 2755 if (r < 0)
2756 return log_error_errno(r, "Failed to write UID map: %m");
2757
2758 /* We always assign the same UID and GID ranges */
2759 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
ad118bda 2760 r = write_string_file(uid_map, line, 0);
03cfe0d5
LP		 2761 if (r < 0)
2762 return log_error_errno(r, "Failed to write GID map: %m");
2763
2764 return 0;
2765}
2766
9c1e04d0 2767static int nspawn_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
9c1e04d0
AP		 2768 char buf[NOTIFY_BUFFER_MAX+1];
2769 char *p = NULL;
2770 struct iovec iovec = {
2771 .iov_base = buf,
2772 .iov_len = sizeof(buf)-1,
2773 };
2774 union {
2775 struct cmsghdr cmsghdr;
2776 uint8_t buf[CMSG_SPACE(sizeof(struct ucred)) +
2777 CMSG_SPACE(sizeof(int) * NOTIFY_FD_MAX)];
2778 } control = {};
2779 struct msghdr msghdr = {
2780 .msg_iov = &iovec,
2781 .msg_iovlen = 1,
2782 .msg_control = &control,
2783 .msg_controllen = sizeof(control),
2784 };
2785 struct cmsghdr *cmsg;
2786 struct ucred *ucred = NULL;
2787 ssize_t n;
2788 pid_t inner_child_pid;
2789 _cleanup_strv_free_ char **tags = NULL;
2790
2791 assert(userdata);
2792
2793 inner_child_pid = PTR_TO_PID(userdata);
2794
2795 if (revents != EPOLLIN) {
2796 log_warning("Got unexpected poll event for notify fd.");
2797 return 0;
2798 }
2799
2800 n = recvmsg(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
2801 if (n < 0) {
2802 if (errno == EAGAIN || errno == EINTR)
2803 return 0;
2804
2805 return log_warning_errno(errno, "Couldn't read notification socket: %m");
2806 }
2807 cmsg_close_all(&msghdr);
2808
2809 CMSG_FOREACH(cmsg, &msghdr) {
2810 if (cmsg->cmsg_level == SOL_SOCKET &&
2811 cmsg->cmsg_type == SCM_CREDENTIALS &&
2812 cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) {
2813
2814 ucred = (struct ucred*) CMSG_DATA(cmsg);
2815 }
2816 }
2817
2818 if (!ucred || ucred->pid != inner_child_pid) {
2819 log_warning("Received notify message without valid credentials. Ignoring.");
2820 return 0;
2821 }
2822
2823 if ((size_t) n >= sizeof(buf)) {
2824 log_warning("Received notify message exceeded maximum size. Ignoring.");
2825 return 0;
2826 }
2827
2828 buf[n] = 0;
2829 tags = strv_split(buf, "\n\r");
2830 if (!tags)
2831 return log_oom();
2832
2833 if (strv_find(tags, "READY=1"))
2834 sd_notifyf(false, "READY=1\n");
2835
2836 p = strv_find_startswith(tags, "STATUS=");
2837 if (p)
2838 sd_notifyf(false, "STATUS=Container running: %s", p);
2839
2840 return 0;
2841}
2842
5773024d 2843static int setup_sd_notify_parent(sd_event *event, int fd, pid_t *inner_child_pid, sd_event_source **notify_event_source) {
9c1e04d0 2844 int r;
9c1e04d0 2845
5773024d 2846 r = sd_event_add_io(event, notify_event_source, fd, EPOLLIN, nspawn_dispatch_notify_fd, inner_child_pid);
9c1e04d0
AP		 2847 if (r < 0)
2848 return log_error_errno(r, "Failed to allocate notify event source: %m");
2849
5773024d 2850 (void) sd_event_source_set_description(*notify_event_source, "nspawn-notify");
9c1e04d0
AP		 2851
2852 return 0;
2853}
2854
f757855e
LP		 2855static int load_settings(void) {
2856 _cleanup_(settings_freep) Settings *settings = NULL;
2857 _cleanup_fclose_ FILE *f = NULL;
2858 _cleanup_free_ char *p = NULL;
2859 const char *fn, *i;
2860 int r;
2861
2862 /* If all settings are masked, there's no point in looking for
2863 * the settings file */
2864 if ((arg_settings_mask & _SETTINGS_MASK_ALL) == _SETTINGS_MASK_ALL)
2865 return 0;
2866
2867 fn = strjoina(arg_machine, ".nspawn");
2868
2869 /* We first look in the admin's directories in /etc and /run */
2870 FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
2871 _cleanup_free_ char *j = NULL;
2872
605405c6 2873 j = strjoin(i, "/", fn);
f757855e
LP		 2874 if (!j)
2875 return log_oom();
2876
2877 f = fopen(j, "re");
2878 if (f) {
2879 p = j;
2880 j = NULL;
2881
b938cb90 2882 /* By default, we trust configuration from /etc and /run */
f757855e
LP		 2883 if (arg_settings_trusted < 0)
2884 arg_settings_trusted = true;
2885
2886 break;
2887 }
2888
2889 if (errno != ENOENT)
2890 return log_error_errno(errno, "Failed to open %s: %m", j);
2891 }
2892
2893 if (!f) {
2894 /* After that, let's look for a file next to the
2895 * actual image we shall boot. */
2896
2897 if (arg_image) {
2898 p = file_in_same_dir(arg_image, fn);
2899 if (!p)
2900 return log_oom();
2901 } else if (arg_directory) {
2902 p = file_in_same_dir(arg_directory, fn);
2903 if (!p)
2904 return log_oom();
2905 }
2906
2907 if (p) {
2908 f = fopen(p, "re");
2909 if (!f && errno != ENOENT)
2910 return log_error_errno(errno, "Failed to open %s: %m", p);
2911
b938cb90 2912 /* By default, we do not trust configuration from /var/lib/machines */
f757855e
LP		 2913 if (arg_settings_trusted < 0)
2914 arg_settings_trusted = false;
2915 }
2916 }
2917
2918 if (!f)
2919 return 0;
2920
2921 log_debug("Settings are trusted: %s", yes_no(arg_settings_trusted));
2922
2923 r = settings_load(f, p, &settings);
2924 if (r < 0)
2925 return r;
2926
2927 /* Copy over bits from the settings, unless they have been
2928 * explicitly masked by command line switches. */
2929
7732f92b
LP		 2930 if ((arg_settings_mask & SETTING_START_MODE) == 0 &&
2931 settings->start_mode >= 0) {
2932 arg_start_mode = settings->start_mode;
f757855e
LP		 2933
2934 strv_free(arg_parameters);
2935 arg_parameters = settings->parameters;
2936 settings->parameters = NULL;
2937 }
2938
b53ede69
PW		 2939 if ((arg_settings_mask & SETTING_PIVOT_ROOT) == 0 &&
2940 settings->pivot_root_new) {
2941 free_and_replace(arg_pivot_root_new, settings->pivot_root_new);
2942 free_and_replace(arg_pivot_root_old, settings->pivot_root_old);
2943 }
2944
5f932eb9
LP		 2945 if ((arg_settings_mask & SETTING_WORKING_DIRECTORY) == 0 &&
2946 settings->working_directory) {
2947 free(arg_chdir);
2948 arg_chdir = settings->working_directory;
2949 settings->working_directory = NULL;
2950 }
2951
f757855e
LP		 2952 if ((arg_settings_mask & SETTING_ENVIRONMENT) == 0 &&
2953 settings->environment) {
2954 strv_free(arg_setenv);
2955 arg_setenv = settings->environment;
2956 settings->environment = NULL;
2957 }
2958
2959 if ((arg_settings_mask & SETTING_USER) == 0 &&
2960 settings->user) {
2961 free(arg_user);
2962 arg_user = settings->user;
2963 settings->user = NULL;
2964 }
2965
2966 if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
0e265674 2967 uint64_t plus;
f757855e 2968
0e265674
LP		 2969 plus = settings->capability;
2970 if (settings_private_network(settings))
2971 plus |= (1ULL << CAP_NET_ADMIN);
2972
2973 if (!arg_settings_trusted && plus != 0) {
2974 if (settings->capability != 0)
2975 log_warning("Ignoring Capability= setting, file %s is not trusted.", p);
2976 } else
520e0d54 2977 arg_caps_retain |= plus;
f757855e 2978
520e0d54 2979 arg_caps_retain &= ~settings->drop_capability;
f757855e
LP		 2980 }
2981
2982 if ((arg_settings_mask & SETTING_KILL_SIGNAL) == 0 &&
2983 settings->kill_signal > 0)
2984 arg_kill_signal = settings->kill_signal;
2985
2986 if ((arg_settings_mask & SETTING_PERSONALITY) == 0 &&
2987 settings->personality != PERSONALITY_INVALID)
2988 arg_personality = settings->personality;
2989
2990 if ((arg_settings_mask & SETTING_MACHINE_ID) == 0 &&
2991 !sd_id128_is_null(settings->machine_id)) {
2992
2993 if (!arg_settings_trusted)
2994 log_warning("Ignoring MachineID= setting, file %s is not trusted.", p);
2995 else
2996 arg_uuid = settings->machine_id;
2997 }
2998
2999 if ((arg_settings_mask & SETTING_READ_ONLY) == 0 &&
3000 settings->read_only >= 0)
3001 arg_read_only = settings->read_only;
3002
3003 if ((arg_settings_mask & SETTING_VOLATILE_MODE) == 0 &&
3004 settings->volatile_mode != _VOLATILE_MODE_INVALID)
3005 arg_volatile_mode = settings->volatile_mode;
3006
3007 if ((arg_settings_mask & SETTING_CUSTOM_MOUNTS) == 0 &&
3008 settings->n_custom_mounts > 0) {
3009
3010 if (!arg_settings_trusted)
3011 log_warning("Ignoring TemporaryFileSystem=, Bind= and BindReadOnly= settings, file %s is not trusted.", p);
3012 else {
3013 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
3014 arg_custom_mounts = settings->custom_mounts;
3015 arg_n_custom_mounts = settings->n_custom_mounts;
3016
3017 settings->custom_mounts = NULL;
3018 settings->n_custom_mounts = 0;
3019 }
3020 }
3021
3022 if ((arg_settings_mask & SETTING_NETWORK) == 0 &&
3023 (settings->private_network >= 0 ||
3024 settings->network_veth >= 0 ||
3025 settings->network_bridge ||
22b28dfd 3026 settings->network_zone ||
f757855e
LP		 3027 settings->network_interfaces ||
3028 settings->network_macvlan ||
f6d6bad1
LP		 3029 settings->network_ipvlan ||
3030 settings->network_veth_extra)) {
f757855e
LP		 3031
3032 if (!arg_settings_trusted)
3033 log_warning("Ignoring network settings, file %s is not trusted.", p);
3034 else {
f6d6bad1 3035 arg_network_veth = settings_network_veth(settings);
0e265674
LP		 3036 arg_private_network = settings_private_network(settings);
3037
f757855e
LP		 3038 strv_free(arg_network_interfaces);
3039 arg_network_interfaces = settings->network_interfaces;
3040 settings->network_interfaces = NULL;
3041
3042 strv_free(arg_network_macvlan);
3043 arg_network_macvlan = settings->network_macvlan;
3044 settings->network_macvlan = NULL;
3045
3046 strv_free(arg_network_ipvlan);
3047 arg_network_ipvlan = settings->network_ipvlan;
3048 settings->network_ipvlan = NULL;
3049
f6d6bad1
LP		 3050 strv_free(arg_network_veth_extra);
3051 arg_network_veth_extra = settings->network_veth_extra;
3052 settings->network_veth_extra = NULL;
3053
f757855e
LP		 3054 free(arg_network_bridge);
3055 arg_network_bridge = settings->network_bridge;
3056 settings->network_bridge = NULL;
22b28dfd
LP		 3057
3058 free(arg_network_zone);
3059 arg_network_zone = settings->network_zone;
3060 settings->network_zone = NULL;
f757855e
LP		 3061 }
3062 }
3063
3064 if ((arg_settings_mask & SETTING_EXPOSE_PORTS) == 0 &&
3065 settings->expose_ports) {
3066
3067 if (!arg_settings_trusted)
3068 log_warning("Ignoring Port= setting, file %s is not trusted.", p);
3069 else {
3070 expose_port_free_all(arg_expose_ports);
3071 arg_expose_ports = settings->expose_ports;
3072 settings->expose_ports = NULL;
3073 }
3074 }
3075
0de7acce
LP		 3076 if ((arg_settings_mask & SETTING_USERNS) == 0 &&
3077 settings->userns_mode != _USER_NAMESPACE_MODE_INVALID) {
3078
3079 if (!arg_settings_trusted)
3080 log_warning("Ignoring PrivateUsers= and PrivateUsersChown= settings, file %s is not trusted.", p);
3081 else {
3082 arg_userns_mode = settings->userns_mode;
3083 arg_uid_shift = settings->uid_shift;
3084 arg_uid_range = settings->uid_range;
3085 arg_userns_chown = settings->userns_chown;
3086 }
3087 }
3088
9c1e04d0
AP		 3089 if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0)
3090 arg_notify_ready = settings->notify_ready;
3091
f757855e
LP		 3092 return 0;
3093}
3094
b0067625
ZJS		 3095static int run(int master,
3096 const char* console,
2d845785 3097 DissectedImage *dissected_image,
b0067625
ZJS		 3098 bool interactive,
3099 bool secondary,
3100 FDSet *fds,
3101 char veth_name[IFNAMSIZ], bool *veth_created,
3102 union in_addr_union *exposed,
3103 pid_t *pid, int *ret) {
3104
3105 static const struct sigaction sa = {
3106 .sa_handler = nop_signal_handler,
e28c7cd0 3107 .sa_flags = SA_NOCLDSTOP|SA_RESTART,
b0067625
ZJS		 3108 };
3109
3110 _cleanup_release_lock_file_ LockFile uid_shift_lock = LOCK_FILE_INIT;
3111 _cleanup_close_ int etc_passwd_lock = -1;
3112 _cleanup_close_pair_ int
3113 kmsg_socket_pair[2] = { -1, -1 },
3114 rtnl_socket_pair[2] = { -1, -1 },
3115 pid_socket_pair[2] = { -1, -1 },
3116 uuid_socket_pair[2] = { -1, -1 },
3117 notify_socket_pair[2] = { -1, -1 },
3118 uid_shift_socket_pair[2] = { -1, -1 };
3119 _cleanup_close_ int notify_socket= -1;
3120 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
5773024d 3121 _cleanup_(sd_event_source_unrefp) sd_event_source *notify_event_source = NULL;
b0067625
ZJS		 3122 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
3123 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
3124 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
3125 ContainerStatus container_status = 0;
3126 char last_char = 0;
3127 int ifi = 0, r;
3128 ssize_t l;
3129 sigset_t mask_chld;
3130
3131 assert_se(sigemptyset(&mask_chld) == 0);
3132 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
3133
3134 if (arg_userns_mode == USER_NAMESPACE_PICK) {
3135 /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
3136 * check with getpwuid() if the specific user already exists. Note that /etc might be
3137 * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
3138 * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
3139 * really just an extra safety net. We kinda assume that the UID range we allocate from is
3140 * really ours. */
3141
3142 etc_passwd_lock = take_etc_passwd_lock(NULL);
3143 if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS)
3144 return log_error_errno(etc_passwd_lock, "Failed to take /etc/passwd lock: %m");
3145 }
3146
3147 r = barrier_create(&barrier);
3148 if (r < 0)
3149 return log_error_errno(r, "Cannot initialize IPC barrier: %m");
3150
3151 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0)
3152 return log_error_errno(errno, "Failed to create kmsg socket pair: %m");
3153
3154 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, rtnl_socket_pair) < 0)
3155 return log_error_errno(errno, "Failed to create rtnl socket pair: %m");
3156
3157 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, pid_socket_pair) < 0)
3158 return log_error_errno(errno, "Failed to create pid socket pair: %m");
3159
3160 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uuid_socket_pair) < 0)
3161 return log_error_errno(errno, "Failed to create id socket pair: %m");
3162
3163 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, notify_socket_pair) < 0)
3164 return log_error_errno(errno, "Failed to create notify socket pair: %m");
3165
3166 if (arg_userns_mode != USER_NAMESPACE_NO)
3167 if (socketpair(AF_UNIX, SOCK_SEQPACKET|SOCK_CLOEXEC, 0, uid_shift_socket_pair) < 0)
3168 return log_error_errno(errno, "Failed to create uid shift socket pair: %m");
3169
3170 /* Child can be killed before execv(), so handle SIGCHLD in order to interrupt
3171 * parent's blocking calls and give it a chance to call wait() and terminate. */
3172 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
3173 if (r < 0)
3174 return log_error_errno(errno, "Failed to change the signal mask: %m");
3175
3176 r = sigaction(SIGCHLD, &sa, NULL);
3177 if (r < 0)
3178 return log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
3179
3180 *pid = raw_clone(SIGCHLD|CLONE_NEWNS);
3181 if (*pid < 0)
3182 return log_error_errno(errno, "clone() failed%s: %m",
3183 errno == EINVAL ?
3184 ", do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in)" : "");
3185
3186 if (*pid == 0) {
3187 /* The outer child only has a file system namespace. */
3188 barrier_set_role(&barrier, BARRIER_CHILD);
3189
3190 master = safe_close(master);
3191
3192 kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
3193 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
3194 pid_socket_pair[0] = safe_close(pid_socket_pair[0]);
3195 uuid_socket_pair[0] = safe_close(uuid_socket_pair[0]);
3196 notify_socket_pair[0] = safe_close(notify_socket_pair[0]);
3197 uid_shift_socket_pair[0] = safe_close(uid_shift_socket_pair[0]);
3198
3199 (void) reset_all_signal_handlers();
3200 (void) reset_signal_mask();
3201
3202 r = outer_child(&barrier,
3203 arg_directory,
3204 console,
2d845785 3205 dissected_image,
b0067625
ZJS		 3206 interactive,
3207 secondary,
3208 pid_socket_pair[1],
3209 uuid_socket_pair[1],
3210 notify_socket_pair[1],
3211 kmsg_socket_pair[1],
3212 rtnl_socket_pair[1],
3213 uid_shift_socket_pair[1],
3214 fds);
3215 if (r < 0)
3216 _exit(EXIT_FAILURE);
3217
3218 _exit(EXIT_SUCCESS);
3219 }
3220
3221 barrier_set_role(&barrier, BARRIER_PARENT);
3222
3223 fds = fdset_free(fds);
3224
3225 kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
3226 rtnl_socket_pair[1] = safe_close(rtnl_socket_pair[1]);
3227 pid_socket_pair[1] = safe_close(pid_socket_pair[1]);
3228 uuid_socket_pair[1] = safe_close(uuid_socket_pair[1]);
3229 notify_socket_pair[1] = safe_close(notify_socket_pair[1]);
3230 uid_shift_socket_pair[1] = safe_close(uid_shift_socket_pair[1]);
3231
3232 if (arg_userns_mode != USER_NAMESPACE_NO) {
3233 /* The child just let us know the UID shift it might have read from the image. */
3234 l = recv(uid_shift_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, 0);
3235 if (l < 0)
3236 return log_error_errno(errno, "Failed to read UID shift: %m");
b0067625
ZJS		 3237 if (l != sizeof arg_uid_shift) {
3238 log_error("Short read while reading UID shift.");
3239 return -EIO;
3240 }
3241
3242 if (arg_userns_mode == USER_NAMESPACE_PICK) {
3243 /* If we are supposed to pick the UID shift, let's try to use the shift read from the
3244 * image, but if that's already in use, pick a new one, and report back to the child,
3245 * which one we now picked. */
3246
3247 r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
3248 if (r < 0)
3249 return log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
3250
3251 l = send(uid_shift_socket_pair[0], &arg_uid_shift, sizeof arg_uid_shift, MSG_NOSIGNAL);
3252 if (l < 0)
3253 return log_error_errno(errno, "Failed to send UID shift: %m");
3254 if (l != sizeof arg_uid_shift) {
3255 log_error("Short write while writing UID shift.");
3256 return -EIO;
3257 }
3258 }
3259 }
3260
3261 /* Wait for the outer child. */
3262 r = wait_for_terminate_and_warn("namespace helper", *pid, NULL);
3263 if (r != 0)
3264 return r < 0 ? r : -EIO;
3265
3266 /* And now retrieve the PID of the inner child. */
3267 l = recv(pid_socket_pair[0], pid, sizeof *pid, 0);
3268 if (l < 0)
3269 return log_error_errno(errno, "Failed to read inner child PID: %m");
3270 if (l != sizeof *pid) {
3271 log_error("Short read while reading inner child PID.");
3272 return -EIO;
3273 }
3274
3275 /* We also retrieve container UUID in case it was generated by outer child */
3276 l = recv(uuid_socket_pair[0], &arg_uuid, sizeof arg_uuid, 0);
3277 if (l < 0)
3278 return log_error_errno(errno, "Failed to read container machine ID: %m");
3279 if (l != sizeof(arg_uuid)) {
3280 log_error("Short read while reading container machined ID.");
3281 return -EIO;
3282 }
3283
3284 /* We also retrieve the socket used for notifications generated by outer child */
3285 notify_socket = receive_one_fd(notify_socket_pair[0], 0);
3286 if (notify_socket < 0)
3287 return log_error_errno(notify_socket,
3288 "Failed to receive notification socket from the outer child: %m");
3289
3290 log_debug("Init process invoked as PID "PID_FMT, *pid);
3291
3292 if (arg_userns_mode != USER_NAMESPACE_NO) {
3293 if (!barrier_place_and_sync(&barrier)) { /* #1 */
3294 log_error("Child died too early.");
3295 return -ESRCH;
3296 }
3297
3298 r = setup_uid_map(*pid);
3299 if (r < 0)
3300 return r;
3301
3302 (void) barrier_place(&barrier); /* #2 */
3303 }
3304
3305 if (arg_private_network) {
3306
3307 r = move_network_interfaces(*pid, arg_network_interfaces);
3308 if (r < 0)
3309 return r;
3310
3311 if (arg_network_veth) {
3312 r = setup_veth(arg_machine, *pid, veth_name,
3313 arg_network_bridge || arg_network_zone);
3314 if (r < 0)
3315 return r;
3316 else if (r > 0)
3317 ifi = r;
3318
3319 if (arg_network_bridge) {
3320 /* Add the interface to a bridge */
3321 r = setup_bridge(veth_name, arg_network_bridge, false);
3322 if (r < 0)
3323 return r;
3324 if (r > 0)
3325 ifi = r;
3326 } else if (arg_network_zone) {
3327 /* Add the interface to a bridge, possibly creating it */
3328 r = setup_bridge(veth_name, arg_network_zone, true);
3329 if (r < 0)
3330 return r;
3331 if (r > 0)
3332 ifi = r;
3333 }
3334 }
3335
3336 r = setup_veth_extra(arg_machine, *pid, arg_network_veth_extra);
3337 if (r < 0)
3338 return r;
3339
3340 /* We created the primary and extra veth links now; let's remember this, so that we know to
3341 remove them later on. Note that we don't bother with removing veth links that were created
3342 here when their setup failed half-way, because in that case the kernel should be able to
3343 remove them on its own, since they cannot be referenced by anything yet. */
3344 *veth_created = true;
3345
3346 r = setup_macvlan(arg_machine, *pid, arg_network_macvlan);
3347 if (r < 0)
3348 return r;
3349
3350 r = setup_ipvlan(arg_machine, *pid, arg_network_ipvlan);
3351 if (r < 0)
3352 return r;
3353 }
3354
3355 if (arg_register) {
3356 r = register_machine(
3357 arg_machine,
3358 *pid,
3359 arg_directory,
3360 arg_uuid,
3361 ifi,
3362 arg_slice,
3363 arg_custom_mounts, arg_n_custom_mounts,
3364 arg_kill_signal,
3365 arg_property,
3366 arg_keep_unit,
3367 arg_container_service_name);
3368 if (r < 0)
3369 return r;
3370 }
3371
f0bef277 3372 r = sync_cgroup(*pid, arg_unified_cgroup_hierarchy, arg_uid_shift);
b0067625
ZJS		 3373 if (r < 0)
3374 return r;
3375
3376 if (arg_keep_unit) {
3377 r = create_subcgroup(*pid, arg_unified_cgroup_hierarchy);
3378 if (r < 0)
3379 return r;
3380 }
3381
3382 r = chown_cgroup(*pid, arg_uid_shift);
3383 if (r < 0)
3384 return r;
3385
3386 /* Notify the child that the parent is ready with all
3387 * its setup (including cgroup-ification), and that
3388 * the child can now hand over control to the code to
3389 * run inside the container. */
3390 (void) barrier_place(&barrier); /* #3 */
3391
3392 /* Block SIGCHLD here, before notifying child.
3393 * process_pty() will handle it with the other signals. */
3394 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
3395
3396 /* Reset signal to default */
3397 r = default_signals(SIGCHLD, -1);
3398 if (r < 0)
3399 return log_error_errno(r, "Failed to reset SIGCHLD: %m");
3400
3401 r = sd_event_new(&event);
3402 if (r < 0)
3403 return log_error_errno(r, "Failed to get default event source: %m");
3404
5773024d 3405 r = setup_sd_notify_parent(event, notify_socket, PID_TO_PTR(*pid), &notify_event_source);
b0067625
ZJS		 3406 if (r < 0)
3407 return r;
3408
3409 /* Let the child know that we are ready and wait that the child is completely ready now. */
3410 if (!barrier_place_and_sync(&barrier)) { /* #4 */
3411 log_error("Child died too early.");
3412 return -ESRCH;
3413 }
3414
3415 /* At this point we have made use of the UID we picked, and thus nss-mymachines
3416 * will make them appear in getpwuid(), thus we can release the /etc/passwd lock. */
3417 etc_passwd_lock = safe_close(etc_passwd_lock);
3418
3419 sd_notifyf(false,
3420 "STATUS=Container running.\n"
3421 "X_NSPAWN_LEADER_PID=" PID_FMT, *pid);
3422 if (!arg_notify_ready)
3423 sd_notify(false, "READY=1\n");
3424
3425 if (arg_kill_signal > 0) {
3426 /* Try to kill the init system on SIGINT or SIGTERM */
3427 sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, PID_TO_PTR(*pid));
3428 sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, PID_TO_PTR(*pid));
3429 } else {
3430 /* Immediately exit */
3431 sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
3432 sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
3433 }
3434
6916b164
AU		 3435 /* Exit when the child exits */
3436 sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
b0067625
ZJS		 3437
3438 if (arg_expose_ports) {
3439 r = expose_port_watch_rtnl(event, rtnl_socket_pair[0], on_address_change, exposed, &rtnl);
3440 if (r < 0)
3441 return r;
3442
3443 (void) expose_port_execute(rtnl, arg_expose_ports, exposed);
3444 }
3445
3446 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
3447
3448 r = pty_forward_new(event, master,
3449 PTY_FORWARD_IGNORE_VHANGUP | (interactive ? 0 : PTY_FORWARD_READ_ONLY),
3450 &forward);
3451 if (r < 0)
3452 return log_error_errno(r, "Failed to create PTY forwarder: %m");
3453
3454 r = sd_event_loop(event);
3455 if (r < 0)
3456 return log_error_errno(r, "Failed to run event loop: %m");
3457
3458 pty_forward_get_last_char(forward, &last_char);
3459
3460 forward = pty_forward_free(forward);
3461
3462 if (!arg_quiet && last_char != '\n')
3463 putc('\n', stdout);
3464
3465 /* Kill if it is not dead yet anyway */
3466 if (arg_register && !arg_keep_unit)
3467 terminate_machine(*pid);
3468
3469 /* Normally redundant, but better safe than sorry */
c67b0082 3470 (void) kill(*pid, SIGKILL);
b0067625
ZJS		 3471
3472 r = wait_for_container(*pid, &container_status);
3473 *pid = 0;
3474
3475 if (r < 0)
3476 /* We failed to wait for the container, or the container exited abnormally. */
3477 return r;
3478 if (r > 0 || container_status == CONTAINER_TERMINATED) {
27e29a1e
ZJS		 3479 /* r > 0 → The container exited with a non-zero status.
3480 * As a special case, we need to replace 133 with a different value,
3481 * because 133 is special-cased in the service file to reboot the container.
3482 * otherwise → The container exited with zero status and a reboot was not requested.
3483 */
2a49b612 3484 if (r == EXIT_FORCE_RESTART)
27e29a1e 3485 r = EXIT_FAILURE; /* replace 133 with the general failure code */
b0067625 3486 *ret = r;
b0067625
ZJS		 3487 return 0; /* finito */
3488 }
3489
3490 /* CONTAINER_REBOOTED, loop again */
3491
3492 if (arg_keep_unit) {
3493 /* Special handling if we are running as a service: instead of simply
3494 * restarting the machine we want to restart the entire service, so let's
3495 * inform systemd about this with the special exit code 133. The service
3496 * file uses RestartForceExitStatus=133 so that this results in a full
3497 * nspawn restart. This is necessary since we might have cgroup parameters
3498 * set we want to have flushed out. */
2a49b612
ZJS		 3499 *ret = EXIT_FORCE_RESTART;
3500 return 0; /* finito */
b0067625
ZJS		 3501 }
3502
3503 expose_port_flush(arg_expose_ports, exposed);
3504
3505 (void) remove_veth_links(veth_name, arg_network_veth_extra);
3506 *veth_created = false;
3507 return 1; /* loop again */
3508}
3509
03cfe0d5
LP		 3510int main(int argc, char *argv[]) {
3511
2d845785
LP		 3512 _cleanup_free_ char *console = NULL;
3513 _cleanup_close_ int master = -1;
03cfe0d5 3514 _cleanup_fdset_free_ FDSet *fds = NULL;
2d845785 3515 int r, n_fd_passed, ret = EXIT_SUCCESS;
5aa3eba5 3516 char veth_name[IFNAMSIZ] = "";
17cbb288 3517 bool secondary = false, remove_directory = false, remove_image = false;
03cfe0d5 3518 pid_t pid = 0;
03cfe0d5
LP		 3519 union in_addr_union exposed = {};
3520 _cleanup_release_lock_file_ LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
c67b0082
LP		 3521 bool interactive, veth_created = false, remove_tmprootdir = false;
3522 char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
2d845785 3523 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
18b5886e
LP		 3524 _cleanup_(decrypted_image_unrefp) DecryptedImage *decrypted_image = NULL;
3525 _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
03cfe0d5
LP		 3526
3527 log_parse_environment();
3528 log_open();
3529
7732f92b
LP		 3530 /* Make sure rename_process() in the stub init process can work */
3531 saved_argv = argv;
3532 saved_argc = argc;
3533
03cfe0d5
LP		 3534 r = parse_argv(argc, argv);
3535 if (r <= 0)
3536 goto finish;
3537
03cfe0d5
LP		 3538 if (geteuid() != 0) {
3539 log_error("Need to be root.");
3540 r = -EPERM;
3541 goto finish;
3542 }
f757855e
LP		 3543 r = determine_names();
3544 if (r < 0)
3545 goto finish;
3546
3547 r = load_settings();
3548 if (r < 0)
3549 goto finish;
3550
3551 r = verify_arguments();
3552 if (r < 0)
3553 goto finish;
03cfe0d5
LP		 3554
3555 n_fd_passed = sd_listen_fds(false);
3556 if (n_fd_passed > 0) {
3557 r = fdset_new_listen_fds(&fds, false);
3558 if (r < 0) {
3559 log_error_errno(r, "Failed to collect file descriptors: %m");
3560 goto finish;
3561 }
3562 }
3563
3564 if (arg_directory) {
3565 assert(!arg_image);
3566
3567 if (path_equal(arg_directory, "/") && !arg_ephemeral) {
3568 log_error("Spawning container on root directory is not supported. Consider using --ephemeral.");
3569 r = -EINVAL;
3570 goto finish;
3571 }
3572
3573 if (arg_ephemeral) {
3574 _cleanup_free_ char *np = NULL;
3575
8d4aa2bb 3576 r = chase_symlinks_and_update(&arg_directory, 0);
3f342ec4
LP		 3577 if (r < 0)
3578 goto finish;
3579
03cfe0d5
LP		 3580 /* If the specified path is a mount point we
3581 * generate the new snapshot immediately
3582 * inside it under a random name. However if
3583 * the specified is not a mount point we
3584 * create the new snapshot in the parent
3585 * directory, just next to it. */
e1873695 3586 r = path_is_mount_point(arg_directory, NULL, 0);
03cfe0d5
LP		 3587 if (r < 0) {
3588 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
3589 goto finish;
3590 }
3591 if (r > 0)
770b5ce4 3592 r = tempfn_random_child(arg_directory, "machine.", &np);
03cfe0d5 3593 else
770b5ce4 3594 r = tempfn_random(arg_directory, "machine.", &np);
03cfe0d5 3595 if (r < 0) {
0f3be6ca 3596 log_error_errno(r, "Failed to generate name for directory snapshot: %m");
03cfe0d5
LP		 3597 goto finish;
3598 }
3599
3600 r = image_path_lock(np, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
3601 if (r < 0) {
3602 log_error_errno(r, "Failed to lock %s: %m", np);
3603 goto finish;
3604 }
3605
17cbb288
LP		 3606 r = btrfs_subvol_snapshot(arg_directory, np,
3607 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
3608 BTRFS_SNAPSHOT_FALLBACK_COPY |
3609 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
3610 BTRFS_SNAPSHOT_RECURSIVE |
3611 BTRFS_SNAPSHOT_QUOTA);
03cfe0d5
LP		 3612 if (r < 0) {
3613 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
3614 goto finish;
ec16945e
LP		 3615 }
3616
3617 free(arg_directory);
3618 arg_directory = np;
8a16a7b4 3619 np = NULL;
ec16945e 3620
17cbb288 3621 remove_directory = true;
30535c16
LP		 3622
3623 } else {
cb638b5e 3624 r = chase_symlinks_and_update(&arg_directory, arg_template ? CHASE_NONEXISTENT : 0);
8d4aa2bb
LP		 3625 if (r < 0)
3626 goto finish;
3627
30535c16
LP		 3628 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
3629 if (r == -EBUSY) {
3630 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
3631 goto finish;
3632 }
3633 if (r < 0) {
3634 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
476b8254 3635 goto finish;
30535c16
LP		 3636 }
3637
3638 if (arg_template) {
8d4aa2bb 3639 r = chase_symlinks_and_update(&arg_template, 0);
3f342ec4
LP		 3640 if (r < 0)
3641 goto finish;
3642
17cbb288
LP		 3643 r = btrfs_subvol_snapshot(arg_template, arg_directory,
3644 (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
3645 BTRFS_SNAPSHOT_FALLBACK_COPY |
3646 BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
3647 BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
3648 BTRFS_SNAPSHOT_RECURSIVE |
3649 BTRFS_SNAPSHOT_QUOTA);
30535c16
LP		 3650 if (r == -EEXIST) {
3651 if (!arg_quiet)
3652 log_info("Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
3653 } else if (r < 0) {
83521414 3654 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
30535c16
LP		 3655 goto finish;
3656 } else {
3657 if (!arg_quiet)
3658 log_info("Populated %s from template %s.", arg_directory, arg_template);
3659 }
3660 }
ec16945e
LP		 3661 }
3662
7732f92b 3663 if (arg_start_mode == START_BOOT) {
1b9e5b12 3664 if (path_is_os_tree(arg_directory) <= 0) {
5ae4d543 3665 log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", arg_directory);
ec16945e 3666 r = -EINVAL;
1b9e5b12
LP		 3667 goto finish;
3668 }
3669 } else {
3670 const char *p;
3671
16fb773e
LP		 3672 p = strjoina(arg_directory, "/usr/");
3673 if (laccess(p, F_OK) < 0) {
3674 log_error("Directory %s doesn't look like it has an OS tree. Refusing.", arg_directory);
ec16945e 3675 r = -EINVAL;
1b9e5b12 3676 goto finish;
1b9e5b12
LP		 3677 }
3678 }
ec16945e 3679
6b9132a9 3680 } else {
ec16945e
LP		 3681 assert(arg_image);
3682 assert(!arg_template);
3683
8d4aa2bb 3684 r = chase_symlinks_and_update(&arg_image, 0);
3f342ec4
LP		 3685 if (r < 0)
3686 goto finish;
3687
0f3be6ca
LP		 3688 if (arg_ephemeral) {
3689 _cleanup_free_ char *np = NULL;
3690
3691 r = tempfn_random(arg_image, "machine.", &np);
3692 if (r < 0) {
3693 log_error_errno(r, "Failed to generate name for image snapshot: %m");
3694 goto finish;
3695 }
3696
3697 r = image_path_lock(np, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
3698 if (r < 0) {
3699 r = log_error_errno(r, "Failed to create image lock: %m");
3700 goto finish;
3701 }
3702
1c876927 3703 r = copy_file(arg_image, np, O_EXCL, arg_read_only ? 0400 : 0600, FS_NOCOW_FL, COPY_REFLINK);
0f3be6ca
LP		 3704 if (r < 0) {
3705 r = log_error_errno(r, "Failed to copy image file: %m");
3706 goto finish;
3707 }
3708
3709 free(arg_image);
3710 arg_image = np;
3711 np = NULL;
3712
3713 remove_image = true;
3714 } else {
3715 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
3716 if (r == -EBUSY) {
3717 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
3718 goto finish;
3719 }
3720 if (r < 0) {
3721 r = log_error_errno(r, "Failed to create image lock: %m");
3722 goto finish;
3723 }
4623e8e6 3724
78ebe980
LP		 3725 if (!arg_root_hash) {
3726 r = root_hash_load(arg_image, &arg_root_hash, &arg_root_hash_size);
3727 if (r < 0) {
3728 log_error_errno(r, "Failed to load root hash file for %s: %m", arg_image);
3729 goto finish;
3730 }
3731 }
30535c16
LP		 3732 }
3733
c67b0082 3734 if (!mkdtemp(tmprootdir)) {
0f3be6ca 3735 r = log_error_errno(errno, "Failed to create temporary directory: %m");
6b9132a9 3736 goto finish;
1b9e5b12 3737 }
6b9132a9 3738
c67b0082
LP		 3739 remove_tmprootdir = true;
3740
3741 arg_directory = strdup(tmprootdir);
1b9e5b12
LP		 3742 if (!arg_directory) {
3743 r = log_oom();
3744 goto finish;
6b9132a9 3745 }
88213476 3746
2d845785
LP		 3747 r = loop_device_make_by_path(arg_image, arg_read_only ? O_RDONLY : O_RDWR, &loop);
3748 if (r < 0) {
3749 log_error_errno(r, "Failed to set up loopback block device: %m");
842f3b0f
LP		 3750 goto finish;
3751 }
1b9e5b12 3752
e0f9e7bd
LP		 3753 r = dissect_image(
3754 loop->fd,
3755 arg_root_hash, arg_root_hash_size,
3756 DISSECT_IMAGE_REQUIRE_ROOT,
3757 &dissected_image);
2d845785
LP		 3758 if (r == -ENOPKG) {
3759 log_error_errno(r, "Could not find a suitable file system or partition table in image: %s", arg_image);
3760
3761 log_notice("Note that the disk image needs to\n"
3762 " a) either contain only a single MBR partition of type 0x83 that is marked bootable\n"
3763 " b) or contain a single GPT partition of type 0FC63DAF-8483-4772-8E79-3D69D8477DE4\n"
3764 " c) or follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/\n"
3765 " d) or contain a file system without a partition table\n"
3766 "in order to be bootable with systemd-nspawn.");
1b9e5b12 3767 goto finish;
2d845785 3768 }
4623e8e6
LP		 3769 if (r == -EADDRNOTAVAIL) {
3770 log_error_errno(r, "No root partition for specified root hash found.");
3771 goto finish;
3772 }
2d845785
LP		 3773 if (r == -EOPNOTSUPP) {
3774 log_error_errno(r, "--image= is not supported, compiled without blkid support.");
3775 goto finish;
3776 }
3777 if (r < 0) {
3778 log_error_errno(r, "Failed to dissect image: %m");
842f3b0f
LP		 3779 goto finish;
3780 }
1b9e5b12 3781
4623e8e6
LP		 3782 if (!arg_root_hash && dissected_image->can_verity)
3783 log_notice("Note: image %s contains verity information, but no root hash specified! Proceeding without integrity checking.", arg_image);
3784
3785 r = dissected_image_decrypt_interactively(dissected_image, NULL, arg_root_hash, arg_root_hash_size, 0, &decrypted_image);
1b9e5b12
LP		 3786 if (r < 0)
3787 goto finish;
0f3be6ca
LP		 3788
3789 /* Now that we mounted the image, let's try to remove it again, if it is ephemeral */
3790 if (remove_image && unlink(arg_image) >= 0)
3791 remove_image = false;
842f3b0f 3792 }
842f3b0f 3793
86c0dd4a 3794 r = custom_mount_prepare_all(arg_directory, arg_custom_mounts, arg_n_custom_mounts);
5a8af538
LP		 3795 if (r < 0)
3796 goto finish;
3797
03cfe0d5
LP		 3798 interactive =
3799 isatty(STDIN_FILENO) > 0 &&
3800 isatty(STDOUT_FILENO) > 0;
9c857b9d 3801
db7feb7e
LP		 3802 master = posix_openpt(O_RDWR|O_NOCTTY|O_CLOEXEC|O_NDELAY);
3803 if (master < 0) {
ec16945e 3804 r = log_error_errno(errno, "Failed to acquire pseudo tty: %m");
a258bf26
LP		 3805 goto finish;
3806 }
3807
611b312b
LP		 3808 r = ptsname_malloc(master, &console);
3809 if (r < 0) {
3810 r = log_error_errno(r, "Failed to determine tty name: %m");
a258bf26 3811 goto finish;
68b02049
DW		 3812 }
3813
3814 if (arg_selinux_apifs_context) {
3815 r = mac_selinux_apply(console, arg_selinux_apifs_context);
3816 if (r < 0)
3817 goto finish;
a258bf26
LP		 3818 }
3819
a258bf26 3820 if (unlockpt(master) < 0) {
ec16945e 3821 r = log_error_errno(errno, "Failed to unlock tty: %m");
a258bf26
LP		 3822 goto finish;
3823 }
3824
9c857b9d
LP		 3825 if (!arg_quiet)
3826 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
3827 arg_machine, arg_image ?: arg_directory);
3828
72c0a2c2 3829 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
a258bf26 3830
03cfe0d5
LP		 3831 if (prctl(PR_SET_CHILD_SUBREAPER, 1) < 0) {
3832 r = log_error_errno(errno, "Failed to become subreaper: %m");
3833 goto finish;
3834 }
3835
d87be9b0 3836 for (;;) {
b0067625
ZJS		 3837 r = run(master,
3838 console,
2d845785 3839 dissected_image,
b0067625
ZJS		 3840 interactive, secondary,
3841 fds,
3842 veth_name, &veth_created,
3843 &exposed,
3844 &pid, &ret);
3845 if (r <= 0)
d87be9b0 3846 break;
d87be9b0 3847 }
88213476
LP		 3848
3849finish:
af4ec430 3850 sd_notify(false,
2a49b612
ZJS		 3851 r == 0 && ret == EXIT_FORCE_RESTART ? "STOPPING=1\nSTATUS=Restarting..." :
3852 "STOPPING=1\nSTATUS=Terminating...");
af4ec430 3853
9444b1f2 3854 if (pid > 0)
c67b0082 3855 (void) kill(pid, SIGKILL);
88213476 3856
503546da 3857 /* Try to flush whatever is still queued in the pty */
6a0f896b 3858 if (master >= 0) {
1c876927 3859 (void) copy_bytes(master, STDOUT_FILENO, (uint64_t) -1, 0);
6a0f896b
LP		 3860 master = safe_close(master);
3861 }
3862
3863 if (pid > 0)
3864 (void) wait_for_terminate(pid, NULL);
503546da 3865
17cbb288 3866 if (remove_directory && arg_directory) {
ec16945e
LP		 3867 int k;
3868
17cbb288 3869 k = rm_rf(arg_directory, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
ec16945e 3870 if (k < 0)
17cbb288 3871 log_warning_errno(k, "Cannot remove '%s', ignoring: %m", arg_directory);
ec16945e
LP		 3872 }
3873
0f3be6ca
LP		 3874 if (remove_image && arg_image) {
3875 if (unlink(arg_image) < 0)
3876 log_warning_errno(errno, "Can't remove image file '%s', ignoring: %m", arg_image);
3877 }
3878
c67b0082
LP		 3879 if (remove_tmprootdir) {
3880 if (rmdir(tmprootdir) < 0)
3881 log_debug_errno(errno, "Can't remove temporary root directory '%s', ignoring: %m", tmprootdir);
3882 }
3883
785890ac
LP		 3884 if (arg_machine) {
3885 const char *p;
3886
63c372cb 3887 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
c6878637 3888 (void) rm_rf(p, REMOVE_ROOT);
785890ac
LP		 3889 }
3890
7a8f6325 3891 expose_port_flush(arg_expose_ports, &exposed);
7513c5b8
LP		 3892
3893 if (veth_created)
3894 (void) remove_veth_links(veth_name, arg_network_veth_extra);
22b28dfd 3895 (void) remove_bridge(arg_network_zone);
f757855e 3896
04d391da 3897 free(arg_directory);
ec16945e
LP		 3898 free(arg_template);
3899 free(arg_image);
7027ff61 3900 free(arg_machine);
c74e630d 3901 free(arg_user);
b53ede69
PW		 3902 free(arg_pivot_root_new);
3903 free(arg_pivot_root_old);
5f932eb9 3904 free(arg_chdir);
c74e630d 3905 strv_free(arg_setenv);
f757855e 3906 free(arg_network_bridge);
c74e630d
LP		 3907 strv_free(arg_network_interfaces);
3908 strv_free(arg_network_macvlan);
4bbfe7ad 3909 strv_free(arg_network_ipvlan);
f6d6bad1 3910 strv_free(arg_network_veth_extra);
f757855e
LP		 3911 strv_free(arg_parameters);
3912 custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
3913 expose_port_free_all(arg_expose_ports);
4623e8e6 3914 free(arg_root_hash);
6d0b55c2 3915
ec16945e 3916 return r < 0 ? EXIT_FAILURE : ret;
88213476 3917}
Unnamed repository; edit this file 'description' to name the repository.