]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Reject invalid quoted strings
[thirdparty/systemd.git] / src / nspawn / nspawn.c
CommitLineData
88213476
LP		 1/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
2
3/***
4 This file is part of systemd.
5
6 Copyright 2010 Lennart Poettering
7
8 systemd is free software; you can redistribute it and/or modify it
5430f7f2
LP		 9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
88213476
LP		 11 (at your option) any later version.
12
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2 16 Lesser General Public License for more details.
88213476 17
5430f7f2 18 You should have received a copy of the GNU Lesser General Public License
88213476
LP		 19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
20***/
21
22#include <signal.h>
23#include <sched.h>
24#include <unistd.h>
25#include <sys/types.h>
26#include <sys/syscall.h>
27#include <sys/mount.h>
28#include <sys/wait.h>
29#include <stdlib.h>
30#include <string.h>
31#include <stdio.h>
32#include <errno.h>
33#include <sys/prctl.h>
34#include <sys/capability.h>
35#include <getopt.h>
a258bf26
LP		 36#include <termios.h>
37#include <sys/signalfd.h>
687d0825 38#include <grp.h>
5ed27dbd 39#include <linux/fs.h>
9537eab0
LP		 40#include <sys/un.h>
41#include <sys/socket.h>
aea38d80 42#include <linux/netlink.h>
aa28aefe 43#include <net/if.h>
69c79d3c 44#include <linux/veth.h>
6afc95b7 45#include <sys/personality.h>
1b9e5b12 46#include <linux/loop.h>
aa28aefe 47
5d63309c 48#ifdef HAVE_SELINUX
a8828ed9
DW		 49#include <selinux/selinux.h>
50#endif
88213476 51
24fb1112
LP		 52#ifdef HAVE_SECCOMP
53#include <seccomp.h>
54#endif
55
1b9e5b12
LP		 56#ifdef HAVE_BLKID
57#include <blkid/blkid.h>
58#endif
59
1f0cd86b
LP		 60#include "sd-daemon.h"
61#include "sd-bus.h"
62#include "sd-id128.h"
aa28aefe 63#include "sd-rtnl.h"
88213476
LP		 64#include "log.h"
65#include "util.h"
49e942b2 66#include "mkdir.h"
6b2d0e85 67#include "macro.h"
d7832d2c 68#include "audit.h"
94d82985 69#include "missing.h"
04d391da 70#include "cgroup-util.h"
a258bf26 71#include "strv.h"
9eb977db 72#include "path-util.h"
a41fe3a2 73#include "loopback-setup.h"
4fc9982c 74#include "dev-setup.h"
842f3b0f 75#include "fdset.h"
acbeb427 76#include "build.h"
a5c32cff 77#include "fileio.h"
40ca29a1 78#include "bus-util.h"
1f0cd86b 79#include "bus-error.h"
4ba93280 80#include "ptyfwd.h"
9bd37b40 81#include "bus-kernel.h"
f4889f65 82#include "env-util.h"
7f112f50 83#include "def.h"
aa28aefe 84#include "rtnl-util.h"
7e227024 85#include "udev-util.h"
1b9e5b12
LP		 86#include "blkid-util.h"
87#include "gpt.h"
01dde061 88#include "siphash24.h"
849958d1 89#include "copy.h"
3577de7a 90#include "base-filesystem.h"
a2da110b 91#include "barrier.h"
f2d88580 92
e9642be2
LP		 93#ifdef HAVE_SECCOMP
94#include "seccomp-util.h"
95#endif
96
113cea80
DH		 97typedef enum ContainerStatus {
98 CONTAINER_TERMINATED,
99 CONTAINER_REBOOTED
100} ContainerStatus;
101
57fb9fb5
LP		 102typedef enum LinkJournal {
103 LINK_NO,
104 LINK_AUTO,
105 LINK_HOST,
106 LINK_GUEST
107} LinkJournal;
88213476 108
4d9f07b4
LP		 109typedef enum Volatile {
110 VOLATILE_NO,
111 VOLATILE_YES,
112 VOLATILE_STATE,
113} Volatile;
114
88213476 115static char *arg_directory = NULL;
687d0825 116static char *arg_user = NULL;
9444b1f2 117static sd_id128_t arg_uuid = {};
7027ff61 118static char *arg_machine = NULL;
c74e630d
LP		 119static const char *arg_selinux_context = NULL;
120static const char *arg_selinux_apifs_context = NULL;
9444b1f2 121static const char *arg_slice = NULL;
ff01d048 122static bool arg_private_network = false;
bc2f673e 123static bool arg_read_only = false;
0f0dbc46 124static bool arg_boot = false;
57fb9fb5 125static LinkJournal arg_link_journal = LINK_AUTO;
5076f0cc
LP		 126static uint64_t arg_retain =
127 (1ULL << CAP_CHOWN) |
128 (1ULL << CAP_DAC_OVERRIDE) |
129 (1ULL << CAP_DAC_READ_SEARCH) |
130 (1ULL << CAP_FOWNER) |
131 (1ULL << CAP_FSETID) |
132 (1ULL << CAP_IPC_OWNER) |
133 (1ULL << CAP_KILL) |
134 (1ULL << CAP_LEASE) |
135 (1ULL << CAP_LINUX_IMMUTABLE) |
136 (1ULL << CAP_NET_BIND_SERVICE) |
137 (1ULL << CAP_NET_BROADCAST) |
138 (1ULL << CAP_NET_RAW) |
139 (1ULL << CAP_SETGID) |
140 (1ULL << CAP_SETFCAP) |
141 (1ULL << CAP_SETPCAP) |
142 (1ULL << CAP_SETUID) |
143 (1ULL << CAP_SYS_ADMIN) |
144 (1ULL << CAP_SYS_CHROOT) |
145 (1ULL << CAP_SYS_NICE) |
146 (1ULL << CAP_SYS_PTRACE) |
147 (1ULL << CAP_SYS_TTY_CONFIG) |
d87be9b0 148 (1ULL << CAP_SYS_RESOURCE) |
88d04e31
LP		 149 (1ULL << CAP_SYS_BOOT) |
150 (1ULL << CAP_AUDIT_WRITE) |
7f112f50
LP		 151 (1ULL << CAP_AUDIT_CONTROL) |
152 (1ULL << CAP_MKNOD);
17fe0523
LP		 153static char **arg_bind = NULL;
154static char **arg_bind_ro = NULL;
06c17c39 155static char **arg_tmpfs = NULL;
f4889f65 156static char **arg_setenv = NULL;
284c0b91 157static bool arg_quiet = false;
8a96d94e 158static bool arg_share_system = false;
eb91eb18 159static bool arg_register = true;
89f7c846 160static bool arg_keep_unit = false;
aa28aefe 161static char **arg_network_interfaces = NULL;
c74e630d 162static char **arg_network_macvlan = NULL;
69c79d3c 163static bool arg_network_veth = false;
c74e630d 164static const char *arg_network_bridge = NULL;
6afc95b7 165static unsigned long arg_personality = 0xffffffffLU;
1b9e5b12 166static const char *arg_image = NULL;
4d9f07b4 167static Volatile arg_volatile = VOLATILE_NO;
88213476
LP		 168
169static int help(void) {
170
171 printf("%s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
172 "Spawn a minimal namespace container for debugging, testing and building.\n\n"
a8828ed9
DW		 173 " -h --help Show this help\n"
174 " --version Print version string\n"
69c79d3c 175 " -q --quiet Do not show status information\n"
1b9e5b12
LP		 176 " -D --directory=PATH Root directory for the container\n"
177 " -i --image=PATH File system device or image for the container\n"
a8828ed9
DW		 178 " -b --boot Boot up full system (i.e. invoke init)\n"
179 " -u --user=USER Run the command under specified user or uid\n"
a8828ed9 180 " -M --machine=NAME Set the machine name for the container\n"
69c79d3c 181 " --uuid=UUID Set a specific machine UUID for the container\n"
a8828ed9 182 " -S --slice=SLICE Place the container in the specified slice\n"
69c79d3c
LP		 183 " --private-network Disable network in container\n"
184 " --network-interface=INTERFACE\n"
185 " Assign an existing network interface to the\n"
186 " container\n"
c74e630d
LP		 187 " --network-macvlan=INTERFACE\n"
188 " Create a macvlan network interface based on an\n"
189 " existing network interface to the container\n"
32457153 190 " --network-veth Add a virtual ethernet connection between host\n"
69c79d3c 191 " and container\n"
ab046dde 192 " --network-bridge=INTERFACE\n"
32457153 193 " Add a virtual ethernet connection between host\n"
ab046dde
TG		 194 " and container and add it to an existing bridge on\n"
195 " the host\n"
82adf6af
LP		 196 " -Z --selinux-context=SECLABEL\n"
197 " Set the SELinux security context to be used by\n"
198 " processes in the container\n"
199 " -L --selinux-apifs-context=SECLABEL\n"
200 " Set the SELinux security context to be used by\n"
201 " API/tmpfs file systems in the container\n"
a8828ed9
DW		 202 " --capability=CAP In addition to the default, retain specified\n"
203 " capability\n"
204 " --drop-capability=CAP Drop the specified capability from the default set\n"
205 " --link-journal=MODE Link up guest journal, one of no, auto, guest, host\n"
206 " -j Equivalent to --link-journal=host\n"
69c79d3c 207 " --read-only Mount the root directory read-only\n"
a8828ed9
DW		 208 " --bind=PATH[:PATH] Bind mount a file or directory from the host into\n"
209 " the container\n"
210 " --bind-ro=PATH[:PATH] Similar, but creates a read-only bind mount\n"
06c17c39 211 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
284c0b91 212 " --setenv=NAME=VALUE Pass an environment variable to PID 1\n"
69c79d3c 213 " --share-system Share system namespaces with host\n"
eb91eb18 214 " --register=BOOLEAN Register container as machine\n"
89f7c846 215 " --keep-unit Do not register a scope for the machine, reuse\n"
4d9f07b4
LP		 216 " the service unit nspawn is running in\n"
217 " --volatile[=MODE] Run the system in volatile mode\n",
88213476
LP		 218 program_invocation_short_name);
219
220 return 0;
221}
222
223static int parse_argv(int argc, char *argv[]) {
224
a41fe3a2 225 enum {
acbeb427
ZJS		 226 ARG_VERSION = 0x100,
227 ARG_PRIVATE_NETWORK,
bc2f673e 228 ARG_UUID,
5076f0cc 229 ARG_READ_ONLY,
57fb9fb5 230 ARG_CAPABILITY,
420c7379 231 ARG_DROP_CAPABILITY,
17fe0523
LP		 232 ARG_LINK_JOURNAL,
233 ARG_BIND,
f4889f65 234 ARG_BIND_RO,
06c17c39 235 ARG_TMPFS,
f4889f65 236 ARG_SETENV,
eb91eb18 237 ARG_SHARE_SYSTEM,
89f7c846 238 ARG_REGISTER,
aa28aefe 239 ARG_KEEP_UNIT,
69c79d3c 240 ARG_NETWORK_INTERFACE,
c74e630d 241 ARG_NETWORK_MACVLAN,
69c79d3c 242 ARG_NETWORK_VETH,
ab046dde 243 ARG_NETWORK_BRIDGE,
6afc95b7 244 ARG_PERSONALITY,
4d9f07b4 245 ARG_VOLATILE,
a41fe3a2
LP		 246 };
247
88213476 248 static const struct option options[] = {
aa28aefe
LP		 249 { "help", no_argument, NULL, 'h' },
250 { "version", no_argument, NULL, ARG_VERSION },
251 { "directory", required_argument, NULL, 'D' },
252 { "user", required_argument, NULL, 'u' },
253 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
254 { "boot", no_argument, NULL, 'b' },
255 { "uuid", required_argument, NULL, ARG_UUID },
256 { "read-only", no_argument, NULL, ARG_READ_ONLY },
257 { "capability", required_argument, NULL, ARG_CAPABILITY },
258 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
259 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
260 { "bind", required_argument, NULL, ARG_BIND },
261 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
06c17c39 262 { "tmpfs", required_argument, NULL, ARG_TMPFS },
aa28aefe
LP		 263 { "machine", required_argument, NULL, 'M' },
264 { "slice", required_argument, NULL, 'S' },
265 { "setenv", required_argument, NULL, ARG_SETENV },
266 { "selinux-context", required_argument, NULL, 'Z' },
267 { "selinux-apifs-context", required_argument, NULL, 'L' },
268 { "quiet", no_argument, NULL, 'q' },
269 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM },
270 { "register", required_argument, NULL, ARG_REGISTER },
271 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
272 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
c74e630d 273 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
ab046dde
TG		 274 { "network-veth", no_argument, NULL, ARG_NETWORK_VETH },
275 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
6afc95b7 276 { "personality", required_argument, NULL, ARG_PERSONALITY },
1b9e5b12 277 { "image", required_argument, NULL, 'i' },
4d9f07b4 278 { "volatile", optional_argument, NULL, ARG_VOLATILE },
eb9da376 279 {}
88213476
LP		 280 };
281
9444b1f2 282 int c, r;
a42c8b54 283 uint64_t plus = 0, minus = 0;
88213476
LP		 284
285 assert(argc >= 0);
286 assert(argv);
287
1b9e5b12 288 while ((c = getopt_long(argc, argv, "+hD:u:bL:M:jS:Z:qi:", options, NULL)) >= 0) {
88213476
LP		 289
290 switch (c) {
291
292 case 'h':
eb9da376 293 return help();
88213476 294
acbeb427
ZJS		 295 case ARG_VERSION:
296 puts(PACKAGE_STRING);
297 puts(SYSTEMD_FEATURES);
298 return 0;
299
88213476
LP		 300 case 'D':
301 free(arg_directory);
3a74cea5
LP		 302 arg_directory = canonicalize_file_name(optarg);
303 if (!arg_directory) {
898d5c91 304 log_error("Invalid root directory: %m");
88213476
LP		 305 return -ENOMEM;
306 }
307
308 break;
309
1b9e5b12
LP		 310 case 'i':
311 arg_image = optarg;
312 break;
313
687d0825
MV		 314 case 'u':
315 free(arg_user);
7027ff61
LP		 316 arg_user = strdup(optarg);
317 if (!arg_user)
318 return log_oom();
687d0825
MV		 319
320 break;
321
ab046dde 322 case ARG_NETWORK_BRIDGE:
c74e630d 323 arg_network_bridge = optarg;
ab046dde
TG		 324
325 /* fall through */
326
69c79d3c
LP		 327 case ARG_NETWORK_VETH:
328 arg_network_veth = true;
329 arg_private_network = true;
330 break;
331
aa28aefe 332 case ARG_NETWORK_INTERFACE:
c74e630d
LP		 333 if (strv_extend(&arg_network_interfaces, optarg) < 0)
334 return log_oom();
335
336 arg_private_network = true;
337 break;
338
339 case ARG_NETWORK_MACVLAN:
340 if (strv_extend(&arg_network_macvlan, optarg) < 0)
aa28aefe
LP		 341 return log_oom();
342
343 /* fall through */
344
ff01d048
LP		 345 case ARG_PRIVATE_NETWORK:
346 arg_private_network = true;
a41fe3a2
LP		 347 break;
348
0f0dbc46
LP		 349 case 'b':
350 arg_boot = true;
351 break;
352
144f0fc0 353 case ARG_UUID:
9444b1f2
LP		 354 r = sd_id128_from_string(optarg, &arg_uuid);
355 if (r < 0) {
aa96c6cb 356 log_error("Invalid UUID: %s", optarg);
9444b1f2 357 return r;
aa96c6cb 358 }
9444b1f2 359 break;
aa96c6cb 360
9444b1f2 361 case 'S':
c74e630d 362 arg_slice = optarg;
144f0fc0
LP		 363 break;
364
7027ff61 365 case 'M':
eb91eb18
LP		 366 if (isempty(optarg)) {
367 free(arg_machine);
368 arg_machine = NULL;
369 } else {
7027ff61 370
eb91eb18
LP		 371 if (!hostname_is_valid(optarg)) {
372 log_error("Invalid machine name: %s", optarg);
373 return -EINVAL;
374 }
7027ff61 375
eb91eb18
LP		 376 free(arg_machine);
377 arg_machine = strdup(optarg);
378 if (!arg_machine)
379 return log_oom();
380
381 break;
382 }
7027ff61 383
82adf6af
LP		 384 case 'Z':
385 arg_selinux_context = optarg;
a8828ed9
DW		 386 break;
387
82adf6af
LP		 388 case 'L':
389 arg_selinux_apifs_context = optarg;
a8828ed9
DW		 390 break;
391
bc2f673e
LP		 392 case ARG_READ_ONLY:
393 arg_read_only = true;
394 break;
395
420c7379
LP		 396 case ARG_CAPABILITY:
397 case ARG_DROP_CAPABILITY: {
a2a5291b 398 const char *state, *word;
5076f0cc
LP		 399 size_t length;
400
401 FOREACH_WORD_SEPARATOR(word, length, optarg, ",", state) {
39ed67d1 402 _cleanup_free_ char *t;
5076f0cc 403 cap_value_t cap;
5076f0cc
LP		 404
405 t = strndup(word, length);
0d0f0c50
SL		 406 if (!t)
407 return log_oom();
5076f0cc 408
39ed67d1
LP		 409 if (streq(t, "all")) {
410 if (c == ARG_CAPABILITY)
a42c8b54 411 plus = (uint64_t) -1;
39ed67d1 412 else
a42c8b54 413 minus = (uint64_t) -1;
39ed67d1
LP		 414 } else {
415 if (cap_from_name(t, &cap) < 0) {
416 log_error("Failed to parse capability %s.", t);
417 return -EINVAL;
418 }
419
420 if (c == ARG_CAPABILITY)
a42c8b54 421 plus |= 1ULL << (uint64_t) cap;
39ed67d1 422 else
a42c8b54 423 minus |= 1ULL << (uint64_t) cap;
5076f0cc 424 }
5076f0cc
LP		 425 }
426
427 break;
428 }
429
57fb9fb5
LP		 430 case 'j':
431 arg_link_journal = LINK_GUEST;
432 break;
433
434 case ARG_LINK_JOURNAL:
435 if (streq(optarg, "auto"))
436 arg_link_journal = LINK_AUTO;
437 else if (streq(optarg, "no"))
438 arg_link_journal = LINK_NO;
439 else if (streq(optarg, "guest"))
440 arg_link_journal = LINK_GUEST;
441 else if (streq(optarg, "host"))
442 arg_link_journal = LINK_HOST;
443 else {
444 log_error("Failed to parse link journal mode %s", optarg);
445 return -EINVAL;
446 }
447
448 break;
449
17fe0523
LP		 450 case ARG_BIND:
451 case ARG_BIND_RO: {
452 _cleanup_free_ char *a = NULL, *b = NULL;
453 char *e;
454 char ***x;
17fe0523
LP		 455
456 x = c == ARG_BIND ? &arg_bind : &arg_bind_ro;
457
458 e = strchr(optarg, ':');
459 if (e) {
460 a = strndup(optarg, e - optarg);
461 b = strdup(e + 1);
462 } else {
463 a = strdup(optarg);
464 b = strdup(optarg);
465 }
466
467 if (!a || !b)
468 return log_oom();
469
470 if (!path_is_absolute(a) || !path_is_absolute(b)) {
471 log_error("Invalid bind mount specification: %s", optarg);
472 return -EINVAL;
473 }
474
475 r = strv_extend(x, a);
476 if (r < 0)
b3451bed 477 return log_oom();
17fe0523
LP		 478
479 r = strv_extend(x, b);
480 if (r < 0)
b3451bed 481 return log_oom();
17fe0523
LP		 482
483 break;
484 }
485
06c17c39
LP		 486 case ARG_TMPFS: {
487 _cleanup_free_ char *a = NULL, *b = NULL;
488 char *e;
489
490 e = strchr(optarg, ':');
491 if (e) {
492 a = strndup(optarg, e - optarg);
493 b = strdup(e + 1);
494 } else {
495 a = strdup(optarg);
496 b = strdup("mode=0755");
497 }
498
499 if (!a || !b)
500 return log_oom();
501
502 if (!path_is_absolute(a)) {
503 log_error("Invalid tmpfs specification: %s", optarg);
504 return -EINVAL;
505 }
506
507 r = strv_push(&arg_tmpfs, a);
508 if (r < 0)
509 return log_oom();
510
511 a = NULL;
512
513 r = strv_push(&arg_tmpfs, b);
514 if (r < 0)
515 return log_oom();
516
517 b = NULL;
518
519 break;
520 }
521
f4889f65
LP		 522 case ARG_SETENV: {
523 char **n;
524
525 if (!env_assignment_is_valid(optarg)) {
526 log_error("Environment variable assignment '%s' is not valid.", optarg);
527 return -EINVAL;
528 }
529
530 n = strv_env_set(arg_setenv, optarg);
531 if (!n)
532 return log_oom();
533
534 strv_free(arg_setenv);
535 arg_setenv = n;
536 break;
537 }
538
284c0b91
LP		 539 case 'q':
540 arg_quiet = true;
541 break;
542
8a96d94e
LP		 543 case ARG_SHARE_SYSTEM:
544 arg_share_system = true;
545 break;
546
eb91eb18
LP		 547 case ARG_REGISTER:
548 r = parse_boolean(optarg);
549 if (r < 0) {
550 log_error("Failed to parse --register= argument: %s", optarg);
551 return r;
552 }
553
554 arg_register = r;
555 break;
556
89f7c846
LP		 557 case ARG_KEEP_UNIT:
558 arg_keep_unit = true;
559 break;
560
6afc95b7
LP		 561 case ARG_PERSONALITY:
562
ac45f971 563 arg_personality = personality_from_string(optarg);
6afc95b7
LP		 564 if (arg_personality == 0xffffffffLU) {
565 log_error("Unknown or unsupported personality '%s'.", optarg);
566 return -EINVAL;
567 }
568
569 break;
570
4d9f07b4
LP		 571 case ARG_VOLATILE:
572
573 if (!optarg)
574 arg_volatile = VOLATILE_YES;
575 else {
576 r = parse_boolean(optarg);
577 if (r < 0) {
578 if (streq(optarg, "state"))
579 arg_volatile = VOLATILE_STATE;
580 else {
581 log_error("Failed to parse --volatile= argument: %s", optarg);
582 return r;
583 }
584 } else
585 arg_volatile = r ? VOLATILE_YES : VOLATILE_NO;
586 }
587
588 break;
589
88213476
LP		 590 case '?':
591 return -EINVAL;
592
593 default:
eb9da376 594 assert_not_reached("Unhandled option");
88213476
LP		 595 }
596 }
597
eb91eb18
LP		 598 if (arg_share_system)
599 arg_register = false;
600
601 if (arg_boot && arg_share_system) {
602 log_error("--boot and --share-system may not be combined.");
603 return -EINVAL;
604 }
605
89f7c846
LP		 606 if (arg_keep_unit && cg_pid_get_owner_uid(0, NULL) >= 0) {
607 log_error("--keep-unit may not be used when invoked from a user session.");
608 return -EINVAL;
609 }
610
1b9e5b12
LP		 611 if (arg_directory && arg_image) {
612 log_error("--directory= and --image= may not be combined.");
613 return -EINVAL;
614 }
615
4d9f07b4
LP		 616 if (arg_volatile != VOLATILE_NO && arg_read_only) {
617 log_error("Cannot combine --read-only with --volatile. Note that --volatile already implies a read-only base hierarchy.");
618 return -EINVAL;
619 }
620
a42c8b54
LP		 621 arg_retain = (arg_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus;
622
88213476
LP		 623 return 1;
624}
625
626static int mount_all(const char *dest) {
627
628 typedef struct MountPoint {
629 const char *what;
630 const char *where;
631 const char *type;
632 const char *options;
633 unsigned long flags;
3bd66c05 634 bool fatal;
88213476
LP		 635 } MountPoint;
636
637 static const MountPoint mount_table[] = {
06c17c39
LP		 638 { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
639 { "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND, true }, /* Bind mount first */
640 { NULL, "/proc/sys", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, true }, /* Then, make it r/o */
641 { "sysfs", "/sys", "sysfs", NULL, MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
642 { "tmpfs", "/dev", "tmpfs", "mode=755", MS_NOSUID|MS_STRICTATIME, true },
f2d88580 643 { "devpts", "/dev/pts", "devpts","newinstance,ptmxmode=0666,mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC, true },
06c17c39
LP		 644 { "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true },
645 { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true },
9b634ea5 646#ifdef HAVE_SELINUX
06c17c39
LP		 647 { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND, false }, /* Bind mount first */
648 { NULL, "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, false }, /* Then, make it r/o */
9b634ea5 649#endif
88213476
LP		 650 };
651
652 unsigned k;
653 int r = 0;
654
655 for (k = 0; k < ELEMENTSOF(mount_table); k++) {
7fd1b19b 656 _cleanup_free_ char *where = NULL;
d002827b 657#ifdef HAVE_SELINUX
a8828ed9 658 _cleanup_free_ char *options = NULL;
d002827b
LP		 659#endif
660 const char *o;
88213476
LP		 661 int t;
662
17fe0523
LP		 663 where = strjoin(dest, "/", mount_table[k].where, NULL);
664 if (!where)
665 return log_oom();
88213476 666
e65aec12 667 t = path_is_mount_point(where, true);
68fb0892 668 if (t < 0) {
88213476 669 log_error("Failed to detect whether %s is a mount point: %s", where, strerror(-t));
88213476
LP		 670
671 if (r == 0)
672 r = t;
673
674 continue;
675 }
676
9c1c7f71
LP		 677 /* Skip this entry if it is not a remount. */
678 if (mount_table[k].what && t > 0)
014a9c77
LP		 679 continue;
680
17fe0523 681 mkdir_p(where, 0755);
88213476 682
a8828ed9 683#ifdef HAVE_SELINUX
82adf6af
LP		 684 if (arg_selinux_apifs_context &&
685 (streq_ptr(mount_table[k].what, "tmpfs") || streq_ptr(mount_table[k].what, "devpts"))) {
686 options = strjoin(mount_table[k].options, ",context=\"", arg_selinux_apifs_context, "\"", NULL);
d002827b
LP		 687 if (!options)
688 return log_oom();
689
690 o = options;
691 } else
a8828ed9 692#endif
d002827b 693 o = mount_table[k].options;
a8828ed9 694
a8828ed9 695
88213476
LP		 696 if (mount(mount_table[k].what,
697 where,
698 mount_table[k].type,
699 mount_table[k].flags,
d002827b 700 o) < 0 &&
3bd66c05 701 mount_table[k].fatal) {
88213476
LP		 702
703 log_error("mount(%s) failed: %m", where);
704
705 if (r == 0)
706 r = -errno;
707 }
88213476
LP		 708 }
709
e58a1277
LP		 710 return r;
711}
f8440af5 712
d6797c92 713static int mount_binds(const char *dest, char **l, bool ro) {
17fe0523
LP		 714 char **x, **y;
715
716 STRV_FOREACH_PAIR(x, y, l) {
06c17c39 717 _cleanup_free_ char *where = NULL;
d2421337 718 struct stat source_st, dest_st;
2ed4e5e0 719 int r;
d2421337
DR		 720
721 if (stat(*x, &source_st) < 0) {
1b9e5b12 722 log_error("Failed to stat %s: %m", *x);
d2421337
DR		 723 return -errno;
724 }
17fe0523 725
06c17c39
LP		 726 where = strappend(dest, *y);
727 if (!where)
728 return log_oom();
729
2ed4e5e0
SL		 730 r = stat(where, &dest_st);
731 if (r == 0) {
d2421337 732 if ((source_st.st_mode & S_IFMT) != (dest_st.st_mode & S_IFMT)) {
06c17c39 733 log_error("The file types of %s and %s do not match. Refusing bind mount", *x, where);
d2421337
DR		 734 return -EINVAL;
735 }
2ed4e5e0
SL		 736 } else if (errno == ENOENT) {
737 r = mkdir_parents_label(where, 0755);
738 if (r < 0) {
739 log_error("Failed to bind mount %s: %s", *x, strerror(-r));
740 return r;
d2421337 741 }
2ed4e5e0 742 } else {
590b6b91 743 log_error("Failed to bind mount %s: %m", *x);
2ed4e5e0
SL		 744 return -errno;
745 }
06c17c39 746
2ed4e5e0 747 /* Create the mount point, but be conservative -- refuse to create block
4d9f07b4 748 * and char devices. */
2ed4e5e0
SL		 749 if (S_ISDIR(source_st.st_mode))
750 mkdir_label(where, 0755);
751 else if (S_ISFIFO(source_st.st_mode))
752 mkfifo(where, 0644);
753 else if (S_ISSOCK(source_st.st_mode))
754 mknod(where, 0644 | S_IFSOCK, 0);
755 else if (S_ISREG(source_st.st_mode))
756 touch(where);
757 else {
758 log_error("Refusing to create mountpoint for file: %s", *x);
759 return -ENOTSUP;
d2421337 760 }
17fe0523
LP		 761
762 if (mount(*x, where, "bind", MS_BIND, NULL) < 0) {
763 log_error("mount(%s) failed: %m", where);
764 return -errno;
765 }
766
d6797c92
LP		 767 if (ro) {
768 r = bind_remount_recursive(where, true);
769 if (r < 0) {
770 log_error("Read-Only bind mount failed: %s", strerror(-r));
771 return r;
772 }
17fe0523
LP		 773 }
774 }
775
776 return 0;
777}
778
06c17c39
LP		 779static int mount_tmpfs(const char *dest) {
780 char **i, **o;
781
782 STRV_FOREACH_PAIR(i, o, arg_tmpfs) {
783 _cleanup_free_ char *where = NULL;
784
785 where = strappend(dest, *i);
786 if (!where)
787 return log_oom();
788
789 mkdir_label(where, 0755);
790
791 if (mount("tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, *o) < 0) {
792 log_error("tmpfs mount to %s failed: %m", where);
793 return -errno;
794 }
795 }
796
797 return 0;
798}
799
e58a1277 800static int setup_timezone(const char *dest) {
d4036145
LP		 801 _cleanup_free_ char *where = NULL, *p = NULL, *q = NULL, *check = NULL, *what = NULL;
802 char *z, *y;
803 int r;
f8440af5 804
e58a1277
LP		 805 assert(dest);
806
807 /* Fix the timezone, if possible */
d4036145
LP		 808 r = readlink_malloc("/etc/localtime", &p);
809 if (r < 0) {
810 log_warning("/etc/localtime is not a symlink, not updating container timezone.");
811 return 0;
812 }
813
814 z = path_startswith(p, "../usr/share/zoneinfo/");
815 if (!z)
816 z = path_startswith(p, "/usr/share/zoneinfo/");
817 if (!z) {
818 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
819 return 0;
820 }
821
04bc4a3f
LP		 822 where = strappend(dest, "/etc/localtime");
823 if (!where)
0d0f0c50 824 return log_oom();
715ac17a 825
d4036145
LP		 826 r = readlink_malloc(where, &q);
827 if (r >= 0) {
828 y = path_startswith(q, "../usr/share/zoneinfo/");
829 if (!y)
830 y = path_startswith(q, "/usr/share/zoneinfo/");
4d1c38b8 831
d4036145
LP		 832 /* Already pointing to the right place? Then do nothing .. */
833 if (y && streq(y, z))
834 return 0;
835 }
836
837 check = strjoin(dest, "/usr/share/zoneinfo/", z, NULL);
838 if (!check)
0d0f0c50 839 return log_oom();
4d1c38b8 840
d4036145
LP		 841 if (access(check, F_OK) < 0) {
842 log_warning("Timezone %s does not exist in container, not updating container timezone.", z);
843 return 0;
844 }
68fb0892 845
d4036145
LP		 846 what = strappend("../usr/share/zoneinfo/", z);
847 if (!what)
848 return log_oom();
849
4d9f07b4 850 mkdir_parents(where, 0755);
d4036145 851 unlink(where);
4d9f07b4 852
d4036145
LP		 853 if (symlink(what, where) < 0) {
854 log_error("Failed to correct timezone of container: %m");
855 return 0;
856 }
e58a1277
LP		 857
858 return 0;
88213476
LP		 859}
860
2547bb41 861static int setup_resolv_conf(const char *dest) {
c8b32e11 862 _cleanup_free_ char *where = NULL;
2547bb41
LP		 863
864 assert(dest);
865
866 if (arg_private_network)
867 return 0;
868
869 /* Fix resolv.conf, if possible */
04bc4a3f
LP		 870 where = strappend(dest, "/etc/resolv.conf");
871 if (!where)
0d0f0c50 872 return log_oom();
2547bb41 873
77e63faf
LP		 874 /* We don't really care for the results of this really. If it
875 * fails, it fails, but meh... */
4d9f07b4 876 mkdir_parents(where, 0755);
849958d1 877 copy_file("/etc/resolv.conf", where, O_TRUNC|O_NOFOLLOW, 0644);
2547bb41
LP		 878
879 return 0;
880}
881
4d9f07b4
LP		 882static int setup_volatile_state(const char *directory) {
883 const char *p;
884 int r;
885
886 assert(directory);
887
888 if (arg_volatile != VOLATILE_STATE)
889 return 0;
890
891 /* --volatile=state means we simply overmount /var
892 with a tmpfs, and the rest read-only. */
893
894 r = bind_remount_recursive(directory, true);
895 if (r < 0) {
896 log_error("Failed to remount %s read-only: %s", directory, strerror(-r));
897 return r;
898 }
899
900 p = strappenda(directory, "/var");
901 mkdir(p, 0755);
902
903 if (mount("tmpfs", p, "tmpfs", MS_STRICTATIME, "mode=755") < 0) {
904 log_error("Failed to mount tmpfs to /var: %m");
905 return -errno;
906 }
907
908 return 0;
909}
910
911static int setup_volatile(const char *directory) {
912 bool tmpfs_mounted = false, bind_mounted = false;
913 char template[] = "/tmp/nspawn-volatile-XXXXXX";
914 const char *f, *t;
915 int r;
916
917 assert(directory);
918
919 if (arg_volatile != VOLATILE_YES)
920 return 0;
921
922 /* --volatile=yes means we mount a tmpfs to the root dir, and
923 the original /usr to use inside it, and that read-only. */
924
925 if (!mkdtemp(template)) {
926 log_error("Failed to create temporary directory: %m");
927 return -errno;
928 }
929
930 if (mount("tmpfs", template, "tmpfs", MS_STRICTATIME, "mode=755") < 0) {
931 log_error("Failed to mount tmpfs for root directory: %m");
932 r = -errno;
933 goto fail;
934 }
935
936 tmpfs_mounted = true;
937
938 f = strappenda(directory, "/usr");
939 t = strappenda(template, "/usr");
940
941 mkdir(t, 0755);
942 if (mount(f, t, "bind", MS_BIND|MS_REC, NULL) < 0) {
943 log_error("Failed to create /usr bind mount: %m");
944 r = -errno;
945 goto fail;
946 }
947
948 bind_mounted = true;
949
950 r = bind_remount_recursive(t, true);
951 if (r < 0) {
952 log_error("Failed to remount %s read-only: %s", t, strerror(-r));
953 goto fail;
954 }
955
956 if (mount(template, directory, NULL, MS_MOVE, NULL) < 0) {
957 log_error("Failed to move root mount: %m");
958 r = -errno;
959 goto fail;
960 }
961
962 rmdir(template);
963
964 return 0;
965
966fail:
967 if (bind_mounted)
968 umount(t);
969 if (tmpfs_mounted)
970 umount(template);
971 rmdir(template);
972 return r;
973}
974
9f24adc2
LP		 975static char* id128_format_as_uuid(sd_id128_t id, char s[37]) {
976
977 snprintf(s, 37,
978 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
979 SD_ID128_FORMAT_VAL(id));
980
981 return s;
982}
983
04bc4a3f 984static int setup_boot_id(const char *dest) {
7fd1b19b 985 _cleanup_free_ char *from = NULL, *to = NULL;
39883f62 986 sd_id128_t rnd = {};
04bc4a3f
LP		 987 char as_uuid[37];
988 int r;
989
990 assert(dest);
991
eb91eb18
LP		 992 if (arg_share_system)
993 return 0;
994
04bc4a3f
LP		 995 /* Generate a new randomized boot ID, so that each boot-up of
996 * the container gets a new one */
997
998 from = strappend(dest, "/dev/proc-sys-kernel-random-boot-id");
04bc4a3f 999 to = strappend(dest, "/proc/sys/kernel/random/boot_id");
ed8b7a3e
ZJS		 1000 if (!from || !to)
1001 return log_oom();
04bc4a3f
LP		 1002
1003 r = sd_id128_randomize(&rnd);
1004 if (r < 0) {
1005 log_error("Failed to generate random boot id: %s", strerror(-r));
ed8b7a3e 1006 return r;
04bc4a3f
LP		 1007 }
1008
9f24adc2 1009 id128_format_as_uuid(rnd, as_uuid);
04bc4a3f 1010
574d5f2d 1011 r = write_string_file(from, as_uuid);
04bc4a3f
LP		 1012 if (r < 0) {
1013 log_error("Failed to write boot id: %s", strerror(-r));
ed8b7a3e 1014 return r;
04bc4a3f
LP		 1015 }
1016
1017 if (mount(from, to, "bind", MS_BIND, NULL) < 0) {
1018 log_error("Failed to bind mount boot id: %m");
1019 r = -errno;
10d18763
ZJS		 1020 } else if (mount(from, to, "bind", MS_BIND|MS_REMOUNT|MS_RDONLY, NULL))
1021 log_warning("Failed to make boot id read-only: %m");
04bc4a3f
LP		 1022
1023 unlink(from);
04bc4a3f
LP		 1024 return r;
1025}
1026
e58a1277 1027static int copy_devnodes(const char *dest) {
88213476
LP		 1028
1029 static const char devnodes[] =
1030 "null\0"
1031 "zero\0"
1032 "full\0"
1033 "random\0"
1034 "urandom\0"
f2d88580 1035 "tty\0";
88213476
LP		 1036
1037 const char *d;
e58a1277 1038 int r = 0;
7fd1b19b 1039 _cleanup_umask_ mode_t u;
a258bf26
LP		 1040
1041 assert(dest);
124640f1
LP		 1042
1043 u = umask(0000);
88213476
LP		 1044
1045 NULSTR_FOREACH(d, devnodes) {
7fd1b19b 1046 _cleanup_free_ char *from = NULL, *to = NULL;
7f112f50 1047 struct stat st;
88213476 1048
7f112f50
LP		 1049 from = strappend("/dev/", d);
1050 to = strjoin(dest, "/dev/", d, NULL);
1051 if (!from || !to)
1052 return log_oom();
88213476
LP		 1053
1054 if (stat(from, &st) < 0) {
1055
1056 if (errno != ENOENT) {
1057 log_error("Failed to stat %s: %m", from);
7f112f50 1058 return -errno;
88213476
LP		 1059 }
1060
a258bf26 1061 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode)) {
88213476 1062
ed8b7a3e 1063 log_error("%s is not a char or block device, cannot copy", from);
7f112f50 1064 return -EIO;
a258bf26
LP		 1065
1066 } else if (mknod(to, st.st_mode, st.st_rdev) < 0) {
1067
1068 log_error("mknod(%s) failed: %m", dest);
7f112f50 1069 return -errno;
88213476 1070 }
88213476
LP		 1071 }
1072
e58a1277
LP		 1073 return r;
1074}
88213476 1075
f2d88580
LP		 1076static int setup_ptmx(const char *dest) {
1077 _cleanup_free_ char *p = NULL;
1078
1079 p = strappend(dest, "/dev/ptmx");
1080 if (!p)
1081 return log_oom();
1082
1083 if (symlink("pts/ptmx", p) < 0) {
1084 log_error("Failed to create /dev/ptmx symlink: %m");
1085 return -errno;
1086 }
1087
1088 return 0;
1089}
1090
e58a1277 1091static int setup_dev_console(const char *dest, const char *console) {
eb0f0863
LP		 1092 _cleanup_umask_ mode_t u;
1093 const char *to;
e58a1277 1094 struct stat st;
e58a1277 1095 int r;
e58a1277
LP		 1096
1097 assert(dest);
1098 assert(console);
1099
1100 u = umask(0000);
1101
eb0f0863
LP		 1102 if (stat("/dev/null", &st) < 0) {
1103 log_error("Failed to stat /dev/null: %m");
25ea79fe 1104 return -errno;
e58a1277 1105 }
88213476 1106
e58a1277
LP		 1107 r = chmod_and_chown(console, 0600, 0, 0);
1108 if (r < 0) {
1109 log_error("Failed to correct access mode for TTY: %s", strerror(-r));
25ea79fe 1110 return r;
a258bf26 1111 }
88213476 1112
a258bf26
LP		 1113 /* We need to bind mount the right tty to /dev/console since
1114 * ptys can only exist on pts file systems. To have something
eb0f0863
LP		 1115 * to bind mount things on we create a device node first, and
1116 * use /dev/null for that since we the cgroups device policy
1117 * allows us to create that freely, while we cannot create
1118 * /dev/console. (Note that the major minor doesn't actually
1119 * matter here, since we mount it over anyway). */
a258bf26 1120
eb0f0863 1121 to = strappenda(dest, "/dev/console");
e58a1277
LP		 1122 if (mknod(to, (st.st_mode & ~07777) | 0600, st.st_rdev) < 0) {
1123 log_error("mknod() for /dev/console failed: %m");
25ea79fe 1124 return -errno;
e58a1277 1125 }
a258bf26
LP		 1126
1127 if (mount(console, to, "bind", MS_BIND, NULL) < 0) {
e58a1277 1128 log_error("Bind mount for /dev/console failed: %m");
25ea79fe 1129 return -errno;
a258bf26
LP		 1130 }
1131
25ea79fe 1132 return 0;
e58a1277
LP		 1133}
1134
1135static int setup_kmsg(const char *dest, int kmsg_socket) {
7fd1b19b 1136 _cleanup_free_ char *from = NULL, *to = NULL;
e58a1277 1137 int r, fd, k;
7fd1b19b 1138 _cleanup_umask_ mode_t u;
e58a1277
LP		 1139 union {
1140 struct cmsghdr cmsghdr;
1141 uint8_t buf[CMSG_SPACE(sizeof(int))];
b92bea5d
ZJS		 1142 } control = {};
1143 struct msghdr mh = {
1144 .msg_control = &control,
1145 .msg_controllen = sizeof(control),
1146 };
e58a1277
LP		 1147 struct cmsghdr *cmsg;
1148
1149 assert(dest);
1150 assert(kmsg_socket >= 0);
a258bf26 1151
e58a1277 1152 u = umask(0000);
a258bf26 1153
f1e5dfe2
LP		 1154 /* We create the kmsg FIFO as /dev/kmsg, but immediately
1155 * delete it after bind mounting it to /proc/kmsg. While FIFOs
1156 * on the reading side behave very similar to /proc/kmsg,
1157 * their writing side behaves differently from /dev/kmsg in
1158 * that writing blocks when nothing is reading. In order to
1159 * avoid any problems with containers deadlocking due to this
1160 * we simply make /dev/kmsg unavailable to the container. */
25ea79fe
ZJS		 1161 if (asprintf(&from, "%s/dev/kmsg", dest) < 0 ||
1162 asprintf(&to, "%s/proc/kmsg", dest) < 0)
1163 return log_oom();
e58a1277
LP		 1164
1165 if (mkfifo(from, 0600) < 0) {
1166 log_error("mkfifo() for /dev/kmsg failed: %m");
25ea79fe 1167 return -errno;
e58a1277
LP		 1168 }
1169
1170 r = chmod_and_chown(from, 0600, 0, 0);
1171 if (r < 0) {
1172 log_error("Failed to correct access mode for /dev/kmsg: %s", strerror(-r));
25ea79fe 1173 return r;
e58a1277
LP		 1174 }
1175
1176 if (mount(from, to, "bind", MS_BIND, NULL) < 0) {
1177 log_error("Bind mount for /proc/kmsg failed: %m");
25ea79fe 1178 return -errno;
e58a1277
LP		 1179 }
1180
1181 fd = open(from, O_RDWR|O_NDELAY|O_CLOEXEC);
1182 if (fd < 0) {
1183 log_error("Failed to open fifo: %m");
25ea79fe 1184 return -errno;
e58a1277
LP		 1185 }
1186
e58a1277
LP		 1187 cmsg = CMSG_FIRSTHDR(&mh);
1188 cmsg->cmsg_level = SOL_SOCKET;
1189 cmsg->cmsg_type = SCM_RIGHTS;
1190 cmsg->cmsg_len = CMSG_LEN(sizeof(int));
1191 memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
1192
1193 mh.msg_controllen = cmsg->cmsg_len;
1194
1195 /* Store away the fd in the socket, so that it stays open as
1196 * long as we run the child */
1197 k = sendmsg(kmsg_socket, &mh, MSG_DONTWAIT|MSG_NOSIGNAL);
03e334a1 1198 safe_close(fd);
e58a1277
LP		 1199
1200 if (k < 0) {
1201 log_error("Failed to send FIFO fd: %m");
25ea79fe 1202 return -errno;
a258bf26
LP		 1203 }
1204
f1e5dfe2
LP		 1205 /* And now make the FIFO unavailable as /dev/kmsg... */
1206 unlink(from);
25ea79fe 1207 return 0;
88213476
LP		 1208}
1209
3a74cea5 1210static int setup_hostname(void) {
3a74cea5 1211
eb91eb18
LP		 1212 if (arg_share_system)
1213 return 0;
1214
7027ff61
LP		 1215 if (sethostname(arg_machine, strlen(arg_machine)) < 0)
1216 return -errno;
3a74cea5 1217
7027ff61 1218 return 0;
3a74cea5
LP		 1219}
1220
57fb9fb5 1221static int setup_journal(const char *directory) {
4d680aee 1222 sd_id128_t machine_id, this_id;
7fd1b19b 1223 _cleanup_free_ char *p = NULL, *b = NULL, *q = NULL, *d = NULL;
27407a01 1224 char *id;
57fb9fb5
LP		 1225 int r;
1226
57fb9fb5 1227 p = strappend(directory, "/etc/machine-id");
27407a01
ZJS		 1228 if (!p)
1229 return log_oom();
57fb9fb5
LP		 1230
1231 r = read_one_line_file(p, &b);
27407a01
ZJS		 1232 if (r == -ENOENT && arg_link_journal == LINK_AUTO)
1233 return 0;
1234 else if (r < 0) {
1235 log_error("Failed to read machine ID from %s: %s", p, strerror(-r));
57fb9fb5
LP		 1236 return r;
1237 }
1238
27407a01
ZJS		 1239 id = strstrip(b);
1240 if (isempty(id) && arg_link_journal == LINK_AUTO)
1241 return 0;
57fb9fb5 1242
27407a01
ZJS		 1243 /* Verify validity */
1244 r = sd_id128_from_string(id, &machine_id);
57fb9fb5 1245 if (r < 0) {
27407a01
ZJS		 1246 log_error("Failed to parse machine ID from %s: %s", p, strerror(-r));
1247 return r;
57fb9fb5
LP		 1248 }
1249
4d680aee
ZJS		 1250 r = sd_id128_get_machine(&this_id);
1251 if (r < 0) {
1252 log_error("Failed to retrieve machine ID: %s", strerror(-r));
1253 return r;
1254 }
1255
1256 if (sd_id128_equal(machine_id, this_id)) {
1257 log_full(arg_link_journal == LINK_AUTO ? LOG_WARNING : LOG_ERR,
1258 "Host and machine ids are equal (%s): refusing to link journals", id);
1259 if (arg_link_journal == LINK_AUTO)
1260 return 0;
1261 return
1262 -EEXIST;
1263 }
1264
1265 if (arg_link_journal == LINK_NO)
1266 return 0;
1267
57fb9fb5 1268 free(p);
27407a01
ZJS		 1269 p = strappend("/var/log/journal/", id);
1270 q = strjoin(directory, "/var/log/journal/", id, NULL);
1271 if (!p || !q)
1272 return log_oom();
1273
1274 if (path_is_mount_point(p, false) > 0) {
1275 if (arg_link_journal != LINK_AUTO) {
1276 log_error("%s: already a mount point, refusing to use for journal", p);
1277 return -EEXIST;
1278 }
1279
1280 return 0;
57fb9fb5
LP		 1281 }
1282
27407a01 1283 if (path_is_mount_point(q, false) > 0) {
57fb9fb5 1284 if (arg_link_journal != LINK_AUTO) {
27407a01
ZJS		 1285 log_error("%s: already a mount point, refusing to use for journal", q);
1286 return -EEXIST;
57fb9fb5
LP		 1287 }
1288
27407a01 1289 return 0;
57fb9fb5
LP		 1290 }
1291
1292 r = readlink_and_make_absolute(p, &d);
1293 if (r >= 0) {
1294 if ((arg_link_journal == LINK_GUEST ||
1295 arg_link_journal == LINK_AUTO) &&
1296 path_equal(d, q)) {
1297
27407a01
ZJS		 1298 r = mkdir_p(q, 0755);
1299 if (r < 0)
1300 log_warning("failed to create directory %s: %m", q);
1301 return 0;
57fb9fb5
LP		 1302 }
1303
1304 if (unlink(p) < 0) {
1305 log_error("Failed to remove symlink %s: %m", p);
27407a01 1306 return -errno;
57fb9fb5
LP		 1307 }
1308 } else if (r == -EINVAL) {
1309
1310 if (arg_link_journal == LINK_GUEST &&
1311 rmdir(p) < 0) {
1312
27407a01
ZJS		 1313 if (errno == ENOTDIR) {
1314 log_error("%s already exists and is neither a symlink nor a directory", p);
1315 return r;
1316 } else {
57fb9fb5 1317 log_error("Failed to remove %s: %m", p);
27407a01 1318 return -errno;
57fb9fb5 1319 }
57fb9fb5
LP		 1320 }
1321 } else if (r != -ENOENT) {
1322 log_error("readlink(%s) failed: %m", p);
27407a01 1323 return r;
57fb9fb5
LP		 1324 }
1325
1326 if (arg_link_journal == LINK_GUEST) {
1327
1328 if (symlink(q, p) < 0) {
1329 log_error("Failed to symlink %s to %s: %m", q, p);
27407a01 1330 return -errno;
57fb9fb5
LP		 1331 }
1332
27407a01
ZJS		 1333 r = mkdir_p(q, 0755);
1334 if (r < 0)
1335 log_warning("failed to create directory %s: %m", q);
1336 return 0;
57fb9fb5
LP		 1337 }
1338
1339 if (arg_link_journal == LINK_HOST) {
1340 r = mkdir_p(p, 0755);
1341 if (r < 0) {
1342 log_error("Failed to create %s: %m", p);
27407a01 1343 return r;
57fb9fb5
LP		 1344 }
1345
27407a01
ZJS		 1346 } else if (access(p, F_OK) < 0)
1347 return 0;
57fb9fb5 1348
cdb2b9d0
LP		 1349 if (dir_is_empty(q) == 0)
1350 log_warning("%s is not empty, proceeding anyway.", q);
1351
57fb9fb5
LP		 1352 r = mkdir_p(q, 0755);
1353 if (r < 0) {
1354 log_error("Failed to create %s: %m", q);
27407a01 1355 return r;
57fb9fb5
LP		 1356 }
1357
1358 if (mount(p, q, "bind", MS_BIND, NULL) < 0) {
1359 log_error("Failed to bind mount journal from host into guest: %m");
27407a01 1360 return -errno;
57fb9fb5
LP		 1361 }
1362
27407a01 1363 return 0;
57fb9fb5
LP		 1364}
1365
9bd37b40
LP		 1366static int setup_kdbus(const char *dest, const char *path) {
1367 const char *p;
1368
1369 if (!path)
1370 return 0;
1371
1372 p = strappenda(dest, "/dev/kdbus");
1373 if (mkdir(p, 0755) < 0) {
1374 log_error("Failed to create kdbus path: %m");
1375 return -errno;
1376 }
1377
1378 if (mount(path, p, "bind", MS_BIND, NULL) < 0) {
486e99a3 1379 log_error("Failed to mount kdbus domain path: %m");
9bd37b40
LP		 1380 return -errno;
1381 }
1382
1383 return 0;
1384}
1385
88213476 1386static int drop_capabilities(void) {
5076f0cc 1387 return capability_bounding_set_drop(~arg_retain, false);
88213476
LP		 1388}
1389
5aa4bb6b 1390static int register_machine(pid_t pid, int local_ifindex) {
9444b1f2
LP		 1391 _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1392 _cleanup_bus_unref_ sd_bus *bus = NULL;
1393 int r;
1394
eb91eb18
LP		 1395 if (!arg_register)
1396 return 0;
1397
1c03020c 1398 r = sd_bus_default_system(&bus);
9444b1f2
LP		 1399 if (r < 0) {
1400 log_error("Failed to open system bus: %s", strerror(-r));
1401 return r;
1402 }
1403
89f7c846
LP		 1404 if (arg_keep_unit) {
1405 r = sd_bus_call_method(
1406 bus,
1407 "org.freedesktop.machine1",
1408 "/org/freedesktop/machine1",
1409 "org.freedesktop.machine1.Manager",
5aa4bb6b 1410 "RegisterMachineWithNetwork",
89f7c846
LP		 1411 &error,
1412 NULL,
5aa4bb6b 1413 "sayssusai",
89f7c846
LP		 1414 arg_machine,
1415 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
1416 "nspawn",
1417 "container",
1418 (uint32_t) pid,
5aa4bb6b
LP		 1419 strempty(arg_directory),
1420 local_ifindex > 0 ? 1 : 0, local_ifindex);
89f7c846 1421 } else {
9457ac5b
LP		 1422 _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
1423
1424 r = sd_bus_message_new_method_call(
89f7c846 1425 bus,
9457ac5b 1426 &m,
89f7c846
LP		 1427 "org.freedesktop.machine1",
1428 "/org/freedesktop/machine1",
1429 "org.freedesktop.machine1.Manager",
5aa4bb6b 1430 "CreateMachineWithNetwork");
9457ac5b
LP		 1431 if (r < 0) {
1432 log_error("Failed to create message: %s", strerror(-r));
1433 return r;
1434 }
1435
1436 r = sd_bus_message_append(
1437 m,
5aa4bb6b 1438 "sayssusai",
89f7c846
LP		 1439 arg_machine,
1440 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
1441 "nspawn",
1442 "container",
1443 (uint32_t) pid,
5aa4bb6b
LP		 1444 strempty(arg_directory),
1445 local_ifindex > 0 ? 1 : 0, local_ifindex);
9457ac5b
LP		 1446 if (r < 0) {
1447 log_error("Failed to append message arguments: %s", strerror(-r));
1448 return r;
1449 }
1450
1451 r = sd_bus_message_open_container(m, 'a', "(sv)");
1452 if (r < 0) {
1453 log_error("Failed to open container: %s", strerror(-r));
1454 return r;
1455 }
1456
1457 if (!isempty(arg_slice)) {
1458 r = sd_bus_message_append(m, "(sv)", "Slice", "s", arg_slice);
1459 if (r < 0) {
1460 log_error("Failed to append slice: %s", strerror(-r));
1461 return r;
1462 }
1463 }
1464
1465 r = sd_bus_message_append(m, "(sv)", "DevicePolicy", "s", "strict");
1466 if (r < 0) {
1467 log_error("Failed to add device policy: %s", strerror(-r));
1468 return r;
1469 }
1470
a07f961e 1471 r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 10,
9457ac5b
LP		 1472 /* Allow the container to
1473 * access and create the API
1474 * device nodes, so that
1475 * PrivateDevices= in the
1476 * container can work
1477 * fine */
1478 "/dev/null", "rwm",
1479 "/dev/zero", "rwm",
1480 "/dev/full", "rwm",
1481 "/dev/random", "rwm",
1482 "/dev/urandom", "rwm",
1483 "/dev/tty", "rwm",
1484 /* Allow the container
1485 * access to ptys. However,
1486 * do not permit the
1487 * container to ever create
1488 * these device nodes. */
1489 "/dev/pts/ptmx", "rw",
a07f961e
LP		 1490 "char-pts", "rw",
1491 /* Allow the container
1492 * access to all kdbus
1493 * devices. Again, the
1494 * container cannot create
1495 * these nodes, only use
1496 * them. We use a pretty
1497 * open match here, so that
1498 * the kernel API can still
1499 * change. */
1500 "char-kdbus", "rw",
1501 "char-kdbus/*", "rw");
9457ac5b
LP		 1502 if (r < 0) {
1503 log_error("Failed to add device whitelist: %s", strerror(-r));
1504 return r;
1505 }
1506
1507 r = sd_bus_message_close_container(m);
1508 if (r < 0) {
1509 log_error("Failed to close container: %s", strerror(-r));
1510 return r;
1511 }
1512
1513 r = sd_bus_call(bus, m, 0, &error, NULL);
89f7c846
LP		 1514 }
1515
9444b1f2 1516 if (r < 0) {
1f0cd86b
LP		 1517 log_error("Failed to register machine: %s", bus_error_message(&error, r));
1518 return r;
1519 }
1520
1521 return 0;
1522}
1523
1524static int terminate_machine(pid_t pid) {
1525 _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1526 _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
1527 _cleanup_bus_unref_ sd_bus *bus = NULL;
1528 const char *path;
1529 int r;
1530
eb91eb18
LP		 1531 if (!arg_register)
1532 return 0;
1533
76b54375 1534 r = sd_bus_default_system(&bus);
1f0cd86b
LP		 1535 if (r < 0) {
1536 log_error("Failed to open system bus: %s", strerror(-r));
1537 return r;
1538 }
1539
1540 r = sd_bus_call_method(
1541 bus,
1542 "org.freedesktop.machine1",
1543 "/org/freedesktop/machine1",
1544 "org.freedesktop.machine1.Manager",
1545 "GetMachineByPID",
1546 &error,
1547 &reply,
1548 "u",
1549 (uint32_t) pid);
1550 if (r < 0) {
1551 /* Note that the machine might already have been
1552 * cleaned up automatically, hence don't consider it a
1553 * failure if we cannot get the machine object. */
1554 log_debug("Failed to get machine: %s", bus_error_message(&error, r));
1555 return 0;
1556 }
1557
1558 r = sd_bus_message_read(reply, "o", &path);
5b30bef8
LP		 1559 if (r < 0)
1560 return bus_log_parse_error(r);
9444b1f2 1561
1f0cd86b
LP		 1562 r = sd_bus_call_method(
1563 bus,
1564 "org.freedesktop.machine1",
1565 path,
1566 "org.freedesktop.machine1.Machine",
1567 "Terminate",
1568 &error,
1569 NULL,
1570 NULL);
1571 if (r < 0) {
1572 log_debug("Failed to terminate machine: %s", bus_error_message(&error, r));
1573 return 0;
1574 }
1575
9444b1f2
LP		 1576 return 0;
1577}
1578
db999e0f
LP		 1579static int reset_audit_loginuid(void) {
1580 _cleanup_free_ char *p = NULL;
1581 int r;
1582
1583 if (arg_share_system)
1584 return 0;
1585
1586 r = read_one_line_file("/proc/self/loginuid", &p);
13e8ceb8 1587 if (r == -ENOENT)
db999e0f
LP		 1588 return 0;
1589 if (r < 0) {
1590 log_error("Failed to read /proc/self/loginuid: %s", strerror(-r));
1591 return r;
1592 }
1593
1594 /* Already reset? */
1595 if (streq(p, "4294967295"))
1596 return 0;
1597
1598 r = write_string_file("/proc/self/loginuid", "4294967295");
1599 if (r < 0) {
1600 log_error("Failed to reset audit login UID. This probably means that your kernel is too\n"
1601 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
1602 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
1603 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
1604 "using systemd-nspawn. Sleeping for 5s... (%s)\n", strerror(-r));
77b6e194 1605
db999e0f 1606 sleep(5);
77b6e194 1607 }
db999e0f
LP		 1608
1609 return 0;
77b6e194
LP		 1610}
1611
01dde061
TG		 1612#define HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
1613
1614static int get_mac(struct ether_addr *mac) {
1615 int r;
1616
1617 uint8_t result[8];
1618 size_t l, sz;
1619 uint8_t *v;
1620
1621 l = strlen(arg_machine);
1622 sz = sizeof(sd_id128_t) + l;
1623 v = alloca(sz);
1624
1625 /* fetch some persistent data unique to the host */
1626 r = sd_id128_get_machine((sd_id128_t*) v);
1627 if (r < 0)
1628 return r;
1629
1630 /* combine with some data unique (on this host) to this
1631 * container instance */
1632 memcpy(v + sizeof(sd_id128_t), arg_machine, l);
1633
1634 /* Let's hash the host machine ID plus the container name. We
1635 * use a fixed, but originally randomly created hash key here. */
1636 siphash24(result, v, sz, HASH_KEY.bytes);
1637
1638 assert_cc(ETH_ALEN <= sizeof(result));
1639 memcpy(mac->ether_addr_octet, result, ETH_ALEN);
1640
1641 /* see eth_random_addr in the kernel */
1642 mac->ether_addr_octet[0] &= 0xfe; /* clear multicast bit */
1643 mac->ether_addr_octet[0] |= 0x02; /* set local assignment bit (IEEE802) */
1644
1645 return 0;
1646}
1647
5aa4bb6b 1648static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ], int *ifi) {
69c79d3c 1649 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
cf6a8911 1650 _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
01dde061 1651 struct ether_addr mac;
5aa4bb6b 1652 int r, i;
69c79d3c
LP		 1653
1654 if (!arg_private_network)
1655 return 0;
1656
1657 if (!arg_network_veth)
1658 return 0;
1659
08af0da2
LP		 1660 /* Use two different interface name prefixes depending whether
1661 * we are in bridge mode or not. */
1662 if (arg_network_bridge)
1663 memcpy(iface_name, "vb-", 3);
1664 else
1665 memcpy(iface_name, "ve-", 3);
ab046dde 1666 strncpy(iface_name+3, arg_machine, IFNAMSIZ - 3);
69c79d3c 1667
01dde061
TG		 1668 r = get_mac(&mac);
1669 if (r < 0) {
1670 log_error("Failed to generate predictable MAC address for host0");
1671 return r;
1672 }
1673
151b9b96 1674 r = sd_rtnl_open(&rtnl, 0);
69c79d3c
LP		 1675 if (r < 0) {
1676 log_error("Failed to connect to netlink: %s", strerror(-r));
1677 return r;
1678 }
1679
151b9b96 1680 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
69c79d3c
LP		 1681 if (r < 0) {
1682 log_error("Failed to allocate netlink message: %s", strerror(-r));
1683 return r;
1684 }
1685
ab046dde 1686 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, iface_name);
69c79d3c 1687 if (r < 0) {
ab046dde 1688 log_error("Failed to add netlink interface name: %s", strerror(-r));
69c79d3c
LP		 1689 return r;
1690 }
1691
ee3a6a51 1692 r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
69c79d3c
LP		 1693 if (r < 0) {
1694 log_error("Failed to open netlink container: %s", strerror(-r));
1695 return r;
1696 }
1697
d8e538ec 1698 r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "veth");
69c79d3c
LP		 1699 if (r < 0) {
1700 log_error("Failed to open netlink container: %s", strerror(-r));
1701 return r;
1702 }
1703
ee3a6a51 1704 r = sd_rtnl_message_open_container(m, VETH_INFO_PEER);
69c79d3c 1705 if (r < 0) {
ab046dde 1706 log_error("Failed to open netlink container: %s", strerror(-r));
69c79d3c
LP		 1707 return r;
1708 }
1709
ab046dde 1710 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, "host0");
69c79d3c 1711 if (r < 0) {
ab046dde 1712 log_error("Failed to add netlink interface name: %s", strerror(-r));
69c79d3c
LP		 1713 return r;
1714 }
01dde061
TG		 1715
1716 r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
1717 if (r < 0) {
1718 log_error("Failed to add netlink MAC address: %s", strerror(-r));
1719 return r;
1720 }
69c79d3c 1721
ab046dde 1722 r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
69c79d3c
LP		 1723 if (r < 0) {
1724 log_error("Failed to add netlink namespace field: %s", strerror(-r));
1725 return r;
1726 }
1727
1728 r = sd_rtnl_message_close_container(m);
1729 if (r < 0) {
1730 log_error("Failed to close netlink container: %s", strerror(-r));
1731 return r;
1732 }
1733
1734 r = sd_rtnl_message_close_container(m);
1735 if (r < 0) {
1736 log_error("Failed to close netlink container: %s", strerror(-r));
1737 return r;
1738 }
1739
1740 r = sd_rtnl_message_close_container(m);
1741 if (r < 0) {
1742 log_error("Failed to close netlink container: %s", strerror(-r));
1743 return r;
1744 }
1745
1746 r = sd_rtnl_call(rtnl, m, 0, NULL);
1747 if (r < 0) {
1748 log_error("Failed to add new veth interfaces: %s", strerror(-r));
1749 return r;
1750 }
1751
5aa4bb6b
LP		 1752 i = (int) if_nametoindex(iface_name);
1753 if (i <= 0) {
1754 log_error("Failed to resolve interface %s: %m", iface_name);
1755 return -errno;
1756 }
1757
1758 *ifi = i;
1759
69c79d3c
LP		 1760 return 0;
1761}
1762
5aa4bb6b 1763static int setup_bridge(const char veth_name[], int *ifi) {
ab046dde
TG		 1764 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1765 _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1766 int r, bridge;
1767
1768 if (!arg_private_network)
1769 return 0;
1770
1771 if (!arg_network_veth)
1772 return 0;
1773
1774 if (!arg_network_bridge)
1775 return 0;
1776
1777 bridge = (int) if_nametoindex(arg_network_bridge);
1778 if (bridge <= 0) {
1779 log_error("Failed to resolve interface %s: %m", arg_network_bridge);
1780 return -errno;
1781 }
1782
5aa4bb6b
LP		 1783 *ifi = bridge;
1784
151b9b96 1785 r = sd_rtnl_open(&rtnl, 0);
ab046dde
TG		 1786 if (r < 0) {
1787 log_error("Failed to connect to netlink: %s", strerror(-r));
1788 return r;
1789 }
1790
151b9b96 1791 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
ab046dde
TG		 1792 if (r < 0) {
1793 log_error("Failed to allocate netlink message: %s", strerror(-r));
1794 return r;
1795 }
1796
039dd4af
TG		 1797 r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
1798 if (r < 0) {
1799 log_error("Failed to set IFF_UP flag: %s", strerror(-r));
1800 return r;
1801 }
1802
ab046dde
TG		 1803 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, veth_name);
1804 if (r < 0) {
1805 log_error("Failed to add netlink interface name field: %s", strerror(-r));
1806 return r;
1807 }
1808
1809 r = sd_rtnl_message_append_u32(m, IFLA_MASTER, bridge);
1810 if (r < 0) {
1811 log_error("Failed to add netlink master field: %s", strerror(-r));
1812 return r;
1813 }
1814
1815 r = sd_rtnl_call(rtnl, m, 0, NULL);
1816 if (r < 0) {
1817 log_error("Failed to add veth interface to bridge: %s", strerror(-r));
1818 return r;
1819 }
1820
1821 return 0;
1822}
1823
c74e630d
LP		 1824static int parse_interface(struct udev *udev, const char *name) {
1825 _cleanup_udev_device_unref_ struct udev_device *d = NULL;
1826 char ifi_str[2 + DECIMAL_STR_MAX(int)];
1827 int ifi;
1828
1829 ifi = (int) if_nametoindex(name);
1830 if (ifi <= 0) {
1831 log_error("Failed to resolve interface %s: %m", name);
1832 return -errno;
1833 }
1834
1835 sprintf(ifi_str, "n%i", ifi);
1836 d = udev_device_new_from_device_id(udev, ifi_str);
1837 if (!d) {
1838 log_error("Failed to get udev device for interface %s: %m", name);
1839 return -errno;
1840 }
1841
1842 if (udev_device_get_is_initialized(d) <= 0) {
1843 log_error("Network interface %s is not initialized yet.", name);
1844 return -EBUSY;
1845 }
1846
1847 return ifi;
1848}
1849
69c79d3c 1850static int move_network_interfaces(pid_t pid) {
7e227024 1851 _cleanup_udev_unref_ struct udev *udev = NULL;
69c79d3c 1852 _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
aa28aefe
LP		 1853 char **i;
1854 int r;
1855
1856 if (!arg_private_network)
1857 return 0;
1858
1859 if (strv_isempty(arg_network_interfaces))
1860 return 0;
1861
151b9b96 1862 r = sd_rtnl_open(&rtnl, 0);
aa28aefe
LP		 1863 if (r < 0) {
1864 log_error("Failed to connect to netlink: %s", strerror(-r));
1865 return r;
1866 }
1867
7e227024
LP		 1868 udev = udev_new();
1869 if (!udev) {
1870 log_error("Failed to connect to udev.");
1871 return -ENOMEM;
1872 }
1873
aa28aefe 1874 STRV_FOREACH(i, arg_network_interfaces) {
cf6a8911 1875 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
b88eb17a 1876 int ifi;
aa28aefe 1877
c74e630d
LP		 1878 ifi = parse_interface(udev, *i);
1879 if (ifi < 0)
1880 return ifi;
1881
1882 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, ifi);
1883 if (r < 0) {
1884 log_error("Failed to allocate netlink message: %s", strerror(-r));
1885 return r;
aa28aefe
LP		 1886 }
1887
c74e630d
LP		 1888 r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1889 if (r < 0) {
1890 log_error("Failed to append namespace PID to netlink message: %s", strerror(-r));
1891 return r;
7e227024
LP		 1892 }
1893
c74e630d
LP		 1894 r = sd_rtnl_call(rtnl, m, 0, NULL);
1895 if (r < 0) {
1896 log_error("Failed to move interface %s to namespace: %s", *i, strerror(-r));
1897 return r;
7e227024 1898 }
c74e630d 1899 }
7e227024 1900
c74e630d
LP		 1901 return 0;
1902}
1903
1904static int setup_macvlan(pid_t pid) {
1905 _cleanup_udev_unref_ struct udev *udev = NULL;
1906 _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1907 char **i;
1908 int r;
1909
1910 if (!arg_private_network)
1911 return 0;
1912
1913 if (strv_isempty(arg_network_macvlan))
1914 return 0;
1915
1916 r = sd_rtnl_open(&rtnl, 0);
1917 if (r < 0) {
1918 log_error("Failed to connect to netlink: %s", strerror(-r));
1919 return r;
1920 }
1921
1922 udev = udev_new();
1923 if (!udev) {
1924 log_error("Failed to connect to udev.");
1925 return -ENOMEM;
1926 }
1927
1928 STRV_FOREACH(i, arg_network_macvlan) {
1929 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1930 _cleanup_free_ char *n = NULL;
1931 int ifi;
1932
1933 ifi = parse_interface(udev, *i);
1934 if (ifi < 0)
1935 return ifi;
1936
1937 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
aa28aefe
LP		 1938 if (r < 0) {
1939 log_error("Failed to allocate netlink message: %s", strerror(-r));
1940 return r;
1941 }
1942
c74e630d
LP		 1943 r = sd_rtnl_message_append_u32(m, IFLA_LINK, ifi);
1944 if (r < 0) {
1945 log_error("Failed to add netlink interface index: %s", strerror(-r));
1946 return r;
1947 }
1948
1949 n = strappend("mv-", *i);
1950 if (!n)
1951 return log_oom();
1952
1953 strshorten(n, IFNAMSIZ-1);
1954
1955 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, n);
1956 if (r < 0) {
1957 log_error("Failed to add netlink interface name: %s", strerror(-r));
1958 return r;
1959 }
1960
aa28aefe
LP		 1961 r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1962 if (r < 0) {
c74e630d
LP		 1963 log_error("Failed to add netlink namespace field: %s", strerror(-r));
1964 return r;
1965 }
1966
1967 r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
1968 if (r < 0) {
1969 log_error("Failed to open netlink container: %s", strerror(-r));
1970 return r;
1971 }
1972
d8e538ec 1973 r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
c74e630d
LP		 1974 if (r < 0) {
1975 log_error("Failed to open netlink container: %s", strerror(-r));
1976 return r;
1977 }
1978
1979 r = sd_rtnl_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
1980 if (r < 0) {
1981 log_error("Failed to append macvlan mode: %s", strerror(-r));
1982 return r;
1983 }
1984
1985 r = sd_rtnl_message_close_container(m);
1986 if (r < 0) {
1987 log_error("Failed to close netlink container: %s", strerror(-r));
1988 return r;
1989 }
1990
1991 r = sd_rtnl_message_close_container(m);
1992 if (r < 0) {
1993 log_error("Failed to close netlink container: %s", strerror(-r));
aa28aefe
LP		 1994 return r;
1995 }
1996
1997 r = sd_rtnl_call(rtnl, m, 0, NULL);
1998 if (r < 0) {
c74e630d 1999 log_error("Failed to add new macvlan interfaces: %s", strerror(-r));
aa28aefe
LP		 2000 return r;
2001 }
2002 }
2003
2004 return 0;
2005}
2006
28650077 2007static int setup_seccomp(void) {
24fb1112
LP		 2008
2009#ifdef HAVE_SECCOMP
28650077
LP		 2010 static const int blacklist[] = {
2011 SCMP_SYS(kexec_load),
2012 SCMP_SYS(open_by_handle_at),
2013 SCMP_SYS(init_module),
2014 SCMP_SYS(finit_module),
2015 SCMP_SYS(delete_module),
2016 SCMP_SYS(iopl),
2017 SCMP_SYS(ioperm),
2018 SCMP_SYS(swapon),
2019 SCMP_SYS(swapoff),
2020 };
2021
24fb1112 2022 scmp_filter_ctx seccomp;
28650077 2023 unsigned i;
24fb1112
LP		 2024 int r;
2025
24fb1112
LP		 2026 seccomp = seccomp_init(SCMP_ACT_ALLOW);
2027 if (!seccomp)
2028 return log_oom();
2029
e9642be2 2030 r = seccomp_add_secondary_archs(seccomp);
9875fd78 2031 if (r < 0) {
e9642be2
LP		 2032 log_error("Failed to add secondary archs to seccomp filter: %s", strerror(-r));
2033 goto finish;
2034 }
2035
28650077
LP		 2036 for (i = 0; i < ELEMENTSOF(blacklist); i++) {
2037 r = seccomp_rule_add(seccomp, SCMP_ACT_ERRNO(EPERM), blacklist[i], 0);
2038 if (r == -EFAULT)
2039 continue; /* unknown syscall */
2040 if (r < 0) {
2041 log_error("Failed to block syscall: %s", strerror(-r));
2042 goto finish;
2043 }
2044 }
2045
2046 /*
2047 Audit is broken in containers, much of the userspace audit
2048 hookup will fail if running inside a container. We don't
2049 care and just turn off creation of audit sockets.
2050
2051 This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail
2052 with EAFNOSUPPORT which audit userspace uses as indication
2053 that audit is disabled in the kernel.
2054 */
2055
3302da46 2056 r = seccomp_rule_add(
24fb1112
LP		 2057 seccomp,
2058 SCMP_ACT_ERRNO(EAFNOSUPPORT),
2059 SCMP_SYS(socket),
2060 2,
2061 SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
2062 SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
2063 if (r < 0) {
2064 log_error("Failed to add audit seccomp rule: %s", strerror(-r));
2065 goto finish;
2066 }
2067
2068 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
2069 if (r < 0) {
2070 log_error("Failed to unset NO_NEW_PRIVS: %s", strerror(-r));
2071 goto finish;
2072 }
2073
2074 r = seccomp_load(seccomp);
2075 if (r < 0)
2076 log_error("Failed to install seccomp audit filter: %s", strerror(-r));
2077
2078finish:
2079 seccomp_release(seccomp);
2080 return r;
2081#else
2082 return 0;
2083#endif
2084
2085}
2086
1b9e5b12
LP		 2087static int setup_image(char **device_path, int *loop_nr) {
2088 struct loop_info64 info = {
2089 .lo_flags = LO_FLAGS_AUTOCLEAR|LO_FLAGS_PARTSCAN
2090 };
2091 _cleanup_close_ int fd = -1, control = -1, loop = -1;
2092 _cleanup_free_ char* loopdev = NULL;
2093 struct stat st;
2094 int r, nr;
2095
2096 assert(device_path);
2097 assert(loop_nr);
2098
2099 fd = open(arg_image, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
2100 if (fd < 0) {
2101 log_error("Failed to open %s: %m", arg_image);
2102 return -errno;
2103 }
2104
2105 if (fstat(fd, &st) < 0) {
2106 log_error("Failed to stat %s: %m", arg_image);
2107 return -errno;
2108 }
2109
2110 if (S_ISBLK(st.st_mode)) {
2111 char *p;
2112
2113 p = strdup(arg_image);
2114 if (!p)
2115 return log_oom();
2116
2117 *device_path = p;
2118
2119 *loop_nr = -1;
2120
2121 r = fd;
2122 fd = -1;
2123
2124 return r;
2125 }
2126
2127 if (!S_ISREG(st.st_mode)) {
2128 log_error("%s is not a regular file or block device: %m", arg_image);
2129 return -EINVAL;
2130 }
2131
2132 control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2133 if (control < 0) {
2134 log_error("Failed to open /dev/loop-control: %m");
2135 return -errno;
2136 }
2137
2138 nr = ioctl(control, LOOP_CTL_GET_FREE);
2139 if (nr < 0) {
2140 log_error("Failed to allocate loop device: %m");
2141 return -errno;
2142 }
2143
2144 if (asprintf(&loopdev, "/dev/loop%i", nr) < 0)
2145 return log_oom();
2146
2147 loop = open(loopdev, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
2148 if (loop < 0) {
2149 log_error("Failed to open loop device %s: %m", loopdev);
2150 return -errno;
2151 }
2152
2153 if (ioctl(loop, LOOP_SET_FD, fd) < 0) {
2154 log_error("Failed to set loopback file descriptor on %s: %m", loopdev);
2155 return -errno;
2156 }
2157
2158 if (arg_read_only)
2159 info.lo_flags |= LO_FLAGS_READ_ONLY;
2160
2161 if (ioctl(loop, LOOP_SET_STATUS64, &info) < 0) {
2162 log_error("Failed to set loopback settings on %s: %m", loopdev);
2163 return -errno;
2164 }
2165
2166 *device_path = loopdev;
2167 loopdev = NULL;
2168
2169 *loop_nr = nr;
2170
2171 r = loop;
2172 loop = -1;
2173
2174 return r;
2175}
2176
2177static int dissect_image(
2178 int fd,
727fd4fd
LP		 2179 char **root_device, bool *root_device_rw,
2180 char **home_device, bool *home_device_rw,
2181 char **srv_device, bool *srv_device_rw,
1b9e5b12
LP		 2182 bool *secondary) {
2183
2184#ifdef HAVE_BLKID
2185 int home_nr = -1, root_nr = -1, secondary_root_nr = -1, srv_nr = -1;
2186 _cleanup_free_ char *home = NULL, *root = NULL, *secondary_root = NULL, *srv = NULL;
2187 _cleanup_udev_enumerate_unref_ struct udev_enumerate *e = NULL;
2188 _cleanup_udev_device_unref_ struct udev_device *d = NULL;
2189 _cleanup_blkid_free_probe_ blkid_probe b = NULL;
2190 _cleanup_udev_unref_ struct udev *udev = NULL;
2191 struct udev_list_entry *first, *item;
727fd4fd 2192 bool home_rw = true, root_rw = true, secondary_root_rw = true, srv_rw = true;
1b9e5b12
LP		 2193 const char *pttype = NULL;
2194 blkid_partlist pl;
2195 struct stat st;
2196 int r;
2197
2198 assert(fd >= 0);
2199 assert(root_device);
2200 assert(home_device);
2201 assert(srv_device);
2202 assert(secondary);
2203
2204 b = blkid_new_probe();
2205 if (!b)
2206 return log_oom();
2207
2208 errno = 0;
2209 r = blkid_probe_set_device(b, fd, 0, 0);
2210 if (r != 0) {
2211 if (errno == 0)
2212 return log_oom();
2213
2214 log_error("Failed to set device on blkid probe: %m");
2215 return -errno;
2216 }
2217
2218 blkid_probe_enable_partitions(b, 1);
2219 blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
2220
2221 errno = 0;
2222 r = blkid_do_safeprobe(b);
2223 if (r == -2 || r == 1) {
2224 log_error("Failed to identify any partition table on %s.\n"
2225 "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2226 return -EINVAL;
2227 } else if (r != 0) {
2228 if (errno == 0)
2229 errno = EIO;
2230 log_error("Failed to probe: %m");
2231 return -errno;
2232 }
2233
2234 blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
2235 if (!streq_ptr(pttype, "gpt")) {
2236 log_error("Image %s does not carry a GUID Partition Table.\n"
2237 "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2238 return -EINVAL;
2239 }
2240
2241 errno = 0;
2242 pl = blkid_probe_get_partitions(b);
2243 if (!pl) {
2244 if (errno == 0)
2245 return log_oom();
2246
2247 log_error("Failed to list partitions of %s", arg_image);
2248 return -errno;
2249 }
2250
2251 udev = udev_new();
2252 if (!udev)
2253 return log_oom();
2254
2255 if (fstat(fd, &st) < 0) {
2256 log_error("Failed to stat block device: %m");
2257 return -errno;
2258 }
2259
2260 d = udev_device_new_from_devnum(udev, 'b', st.st_rdev);
2261 if (!d)
2262 return log_oom();
2263
2264 e = udev_enumerate_new(udev);
2265 if (!e)
2266 return log_oom();
2267
2268 r = udev_enumerate_add_match_parent(e, d);
2269 if (r < 0)
2270 return log_oom();
2271
2272 r = udev_enumerate_scan_devices(e);
2273 if (r < 0) {
2274 log_error("Failed to scan for partition devices of %s: %s", arg_image, strerror(-r));
2275 return r;
2276 }
2277
2278 first = udev_enumerate_get_list_entry(e);
2279 udev_list_entry_foreach(item, first) {
2280 _cleanup_udev_device_unref_ struct udev_device *q;
2281 const char *stype, *node;
727fd4fd 2282 unsigned long long flags;
1b9e5b12
LP		 2283 sd_id128_t type_id;
2284 blkid_partition pp;
2285 dev_t qn;
2286 int nr;
2287
2288 errno = 0;
2289 q = udev_device_new_from_syspath(udev, udev_list_entry_get_name(item));
2290 if (!q) {
2291 if (!errno)
2292 errno = ENOMEM;
2293
2294 log_error("Failed to get partition device of %s: %m", arg_image);
2295 return -errno;
2296 }
2297
2298 qn = udev_device_get_devnum(q);
2299 if (major(qn) == 0)
2300 continue;
2301
2302 if (st.st_rdev == qn)
2303 continue;
2304
2305 node = udev_device_get_devnode(q);
2306 if (!node)
2307 continue;
2308
2309 pp = blkid_partlist_devno_to_partition(pl, qn);
2310 if (!pp)
2311 continue;
2312
727fd4fd
LP		 2313 flags = blkid_partition_get_flags(pp);
2314 if (flags & GPT_FLAG_NO_AUTO)
2315 continue;
2316
1b9e5b12
LP		 2317 nr = blkid_partition_get_partno(pp);
2318 if (nr < 0)
2319 continue;
2320
2321 stype = blkid_partition_get_type_string(pp);
2322 if (!stype)
2323 continue;
2324
2325 if (sd_id128_from_string(stype, &type_id) < 0)
2326 continue;
2327
2328 if (sd_id128_equal(type_id, GPT_HOME)) {
2329
2330 if (home && nr >= home_nr)
2331 continue;
2332
2333 home_nr = nr;
727fd4fd
LP		 2334 home_rw = !(flags & GPT_FLAG_READ_ONLY);
2335
1b9e5b12
LP		 2336 free(home);
2337 home = strdup(node);
2338 if (!home)
2339 return log_oom();
2340 } else if (sd_id128_equal(type_id, GPT_SRV)) {
2341
2342 if (srv && nr >= srv_nr)
2343 continue;
2344
2345 srv_nr = nr;
727fd4fd
LP		 2346 srv_rw = !(flags & GPT_FLAG_READ_ONLY);
2347
1b9e5b12
LP		 2348 free(srv);
2349 srv = strdup(node);
2350 if (!srv)
2351 return log_oom();
2352 }
2353#ifdef GPT_ROOT_NATIVE
2354 else if (sd_id128_equal(type_id, GPT_ROOT_NATIVE)) {
2355
2356 if (root && nr >= root_nr)
2357 continue;
2358
2359 root_nr = nr;
727fd4fd
LP		 2360 root_rw = !(flags & GPT_FLAG_READ_ONLY);
2361
1b9e5b12
LP		 2362 free(root);
2363 root = strdup(node);
2364 if (!root)
2365 return log_oom();
2366 }
2367#endif
2368#ifdef GPT_ROOT_SECONDARY
2369 else if (sd_id128_equal(type_id, GPT_ROOT_SECONDARY)) {
2370
2371 if (secondary_root && nr >= secondary_root_nr)
2372 continue;
2373
2374 secondary_root_nr = nr;
727fd4fd
LP		 2375 secondary_root_rw = !(flags & GPT_FLAG_READ_ONLY);
2376
2377
1b9e5b12
LP		 2378 free(secondary_root);
2379 secondary_root = strdup(node);
2380 if (!secondary_root)
2381 return log_oom();
2382 }
2383#endif
2384 }
2385
2386 if (!root && !secondary_root) {
2387 log_error("Failed to identify root partition in disk image %s.\n"
2388 "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2389 return -EINVAL;
2390 }
2391
2392 if (root) {
2393 *root_device = root;
2394 root = NULL;
727fd4fd
LP		 2395
2396 *root_device_rw = root_rw;
1b9e5b12
LP		 2397 *secondary = false;
2398 } else if (secondary_root) {
2399 *root_device = secondary_root;
2400 secondary_root = NULL;
727fd4fd
LP		 2401
2402 *root_device_rw = secondary_root_rw;
1b9e5b12
LP		 2403 *secondary = true;
2404 }
2405
2406 if (home) {
2407 *home_device = home;
2408 home = NULL;
727fd4fd
LP		 2409
2410 *home_device_rw = home_rw;
1b9e5b12
LP		 2411 }
2412
2413 if (srv) {
2414 *srv_device = srv;
2415 srv = NULL;
727fd4fd
LP		 2416
2417 *srv_device_rw = srv_rw;
1b9e5b12
LP		 2418 }
2419
2420 return 0;
2421#else
2422 log_error("--image= is not supported, compiled without blkid support.");
2423 return -ENOTSUP;
2424#endif
2425}
2426
727fd4fd 2427static int mount_device(const char *what, const char *where, const char *directory, bool rw) {
1b9e5b12
LP		 2428#ifdef HAVE_BLKID
2429 _cleanup_blkid_free_probe_ blkid_probe b = NULL;
2430 const char *fstype, *p;
2431 int r;
2432
2433 assert(what);
2434 assert(where);
2435
727fd4fd
LP		 2436 if (arg_read_only)
2437 rw = false;
2438
1b9e5b12
LP		 2439 if (directory)
2440 p = strappenda(where, directory);
2441 else
2442 p = where;
2443
2444 errno = 0;
2445 b = blkid_new_probe_from_filename(what);
2446 if (!b) {
2447 if (errno == 0)
2448 return log_oom();
2449 log_error("Failed to allocate prober for %s: %m", what);
2450 return -errno;
2451 }
2452
2453 blkid_probe_enable_superblocks(b, 1);
2454 blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
2455
2456 errno = 0;
2457 r = blkid_do_safeprobe(b);
2458 if (r == -1 || r == 1) {
2459 log_error("Cannot determine file system type of %s", what);
2460 return -EINVAL;
2461 } else if (r != 0) {
2462 if (errno == 0)
2463 errno = EIO;
2464 log_error("Failed to probe %s: %m", what);
2465 return -errno;
2466 }
2467
2468 errno = 0;
2469 if (blkid_probe_lookup_value(b, "TYPE", &fstype, NULL) < 0) {
2470 if (errno == 0)
2471 errno = EINVAL;
2472 log_error("Failed to determine file system type of %s", what);
2473 return -errno;
2474 }
2475
2476 if (streq(fstype, "crypto_LUKS")) {
2477 log_error("nspawn currently does not support LUKS disk images.");
2478 return -ENOTSUP;
2479 }
2480
727fd4fd 2481 if (mount(what, p, fstype, MS_NODEV|(rw ? 0 : MS_RDONLY), NULL) < 0) {
1b9e5b12
LP		 2482 log_error("Failed to mount %s: %m", what);
2483 return -errno;
2484 }
2485
2486 return 0;
2487#else
2488 log_error("--image= is not supported, compiled without blkid support.");
2489 return -ENOTSUP;
2490#endif
2491}
2492
727fd4fd
LP		 2493static int mount_devices(
2494 const char *where,
2495 const char *root_device, bool root_device_rw,
2496 const char *home_device, bool home_device_rw,
2497 const char *srv_device, bool srv_device_rw) {
1b9e5b12
LP		 2498 int r;
2499
2500 assert(where);
2501
2502 if (root_device) {
727fd4fd 2503 r = mount_device(root_device, arg_directory, NULL, root_device_rw);
1b9e5b12
LP		 2504 if (r < 0) {
2505 log_error("Failed to mount root directory: %s", strerror(-r));
2506 return r;
2507 }
2508 }
2509
2510 if (home_device) {
727fd4fd 2511 r = mount_device(home_device, arg_directory, "/home", home_device_rw);
1b9e5b12
LP		 2512 if (r < 0) {
2513 log_error("Failed to mount home directory: %s", strerror(-r));
2514 return r;
2515 }
2516 }
2517
2518 if (srv_device) {
727fd4fd 2519 r = mount_device(srv_device, arg_directory, "/srv", srv_device_rw);
1b9e5b12
LP		 2520 if (r < 0) {
2521 log_error("Failed to mount server data directory: %s", strerror(-r));
2522 return r;
2523 }
2524 }
2525
2526 return 0;
2527}
2528
2529static void loop_remove(int nr, int *image_fd) {
2530 _cleanup_close_ int control = -1;
2531
2532 if (nr < 0)
2533 return;
2534
2535 if (image_fd && *image_fd >= 0) {
2536 ioctl(*image_fd, LOOP_CLR_FD);
03e334a1 2537 *image_fd = safe_close(*image_fd);
1b9e5b12
LP		 2538 }
2539
2540 control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2541 if (control < 0)
2542 return;
2543
2544 ioctl(control, LOOP_CTL_REMOVE, nr);
2545}
2546
0cb9fbcd
LP		 2547static int spawn_getent(const char *database, const char *key, pid_t *rpid) {
2548 int pipe_fds[2];
2549 pid_t pid;
2550
2551 assert(database);
2552 assert(key);
2553 assert(rpid);
2554
2555 if (pipe2(pipe_fds, O_CLOEXEC) < 0) {
2556 log_error("Failed to allocate pipe: %m");
2557 return -errno;
2558 }
2559
2560 pid = fork();
2561 if (pid < 0) {
2562 log_error("Failed to fork getent child: %m");
2563 return -errno;
2564 } else if (pid == 0) {
2565 int nullfd;
2566 char *empty_env = NULL;
2567
2568 if (dup3(pipe_fds[1], STDOUT_FILENO, 0) < 0)
2569 _exit(EXIT_FAILURE);
2570
2571 if (pipe_fds[0] > 2)
03e334a1 2572 safe_close(pipe_fds[0]);
0cb9fbcd 2573 if (pipe_fds[1] > 2)
03e334a1 2574 safe_close(pipe_fds[1]);
0cb9fbcd
LP		 2575
2576 nullfd = open("/dev/null", O_RDWR);
2577 if (nullfd < 0)
2578 _exit(EXIT_FAILURE);
2579
2580 if (dup3(nullfd, STDIN_FILENO, 0) < 0)
2581 _exit(EXIT_FAILURE);
2582
2583 if (dup3(nullfd, STDERR_FILENO, 0) < 0)
2584 _exit(EXIT_FAILURE);
2585
2586 if (nullfd > 2)
03e334a1 2587 safe_close(nullfd);
0cb9fbcd
LP		 2588
2589 reset_all_signal_handlers();
2590 close_all_fds(NULL, 0);
2591
4de82926
MM		 2592 execle("/usr/bin/getent", "getent", database, key, NULL, &empty_env);
2593 execle("/bin/getent", "getent", database, key, NULL, &empty_env);
0cb9fbcd
LP		 2594 _exit(EXIT_FAILURE);
2595 }
2596
03e334a1 2597 pipe_fds[1] = safe_close(pipe_fds[1]);
0cb9fbcd
LP		 2598
2599 *rpid = pid;
2600
2601 return pipe_fds[0];
2602}
2603
2604static int change_uid_gid(char **_home) {
a2a5291b
ZJS		 2605 char line[LINE_MAX], *x, *u, *g, *h;
2606 const char *word, *state;
0cb9fbcd
LP		 2607 _cleanup_free_ uid_t *uids = NULL;
2608 _cleanup_free_ char *home = NULL;
2609 _cleanup_fclose_ FILE *f = NULL;
2610 _cleanup_close_ int fd = -1;
2611 unsigned n_uids = 0;
70f539ca 2612 size_t sz = 0, l;
0cb9fbcd
LP		 2613 uid_t uid;
2614 gid_t gid;
2615 pid_t pid;
2616 int r;
2617
2618 assert(_home);
2619
2620 if (!arg_user || streq(arg_user, "root") || streq(arg_user, "0")) {
2621 /* Reset everything fully to 0, just in case */
2622
2623 if (setgroups(0, NULL) < 0) {
2624 log_error("setgroups() failed: %m");
2625 return -errno;
2626 }
2627
2628 if (setresgid(0, 0, 0) < 0) {
2629 log_error("setregid() failed: %m");
2630 return -errno;
2631 }
2632
2633 if (setresuid(0, 0, 0) < 0) {
2634 log_error("setreuid() failed: %m");
2635 return -errno;
2636 }
2637
2638 *_home = NULL;
2639 return 0;
2640 }
2641
2642 /* First, get user credentials */
2643 fd = spawn_getent("passwd", arg_user, &pid);
2644 if (fd < 0)
2645 return fd;
2646
2647 f = fdopen(fd, "r");
2648 if (!f)
2649 return log_oom();
2650 fd = -1;
2651
2652 if (!fgets(line, sizeof(line), f)) {
2653
2654 if (!ferror(f)) {
2655 log_error("Failed to resolve user %s.", arg_user);
2656 return -ESRCH;
2657 }
2658
2659 log_error("Failed to read from getent: %m");
2660 return -errno;
2661 }
2662
2663 truncate_nl(line);
2664
2665 wait_for_terminate_and_warn("getent passwd", pid);
2666
2667 x = strchr(line, ':');
2668 if (!x) {
2669 log_error("/etc/passwd entry has invalid user field.");
2670 return -EIO;
2671 }
2672
2673 u = strchr(x+1, ':');
2674 if (!u) {
2675 log_error("/etc/passwd entry has invalid password field.");
2676 return -EIO;
2677 }
2678
2679 u++;
2680 g = strchr(u, ':');
2681 if (!g) {
2682 log_error("/etc/passwd entry has invalid UID field.");
2683 return -EIO;
2684 }
2685
2686 *g = 0;
2687 g++;
2688 x = strchr(g, ':');
2689 if (!x) {
2690 log_error("/etc/passwd entry has invalid GID field.");
2691 return -EIO;
2692 }
2693
2694 *x = 0;
2695 h = strchr(x+1, ':');
2696 if (!h) {
2697 log_error("/etc/passwd entry has invalid GECOS field.");
2698 return -EIO;
2699 }
2700
2701 h++;
2702 x = strchr(h, ':');
2703 if (!x) {
2704 log_error("/etc/passwd entry has invalid home directory field.");
2705 return -EIO;
2706 }
2707
2708 *x = 0;
2709
2710 r = parse_uid(u, &uid);
2711 if (r < 0) {
2712 log_error("Failed to parse UID of user.");
2713 return -EIO;
2714 }
2715
2716 r = parse_gid(g, &gid);
2717 if (r < 0) {
2718 log_error("Failed to parse GID of user.");
2719 return -EIO;
2720 }
2721
2722 home = strdup(h);
2723 if (!home)
2724 return log_oom();
2725
2726 /* Second, get group memberships */
2727 fd = spawn_getent("initgroups", arg_user, &pid);
2728 if (fd < 0)
2729 return fd;
2730
2731 fclose(f);
2732 f = fdopen(fd, "r");
2733 if (!f)
2734 return log_oom();
2735 fd = -1;
2736
2737 if (!fgets(line, sizeof(line), f)) {
2738 if (!ferror(f)) {
2739 log_error("Failed to resolve user %s.", arg_user);
2740 return -ESRCH;
2741 }
2742
2743 log_error("Failed to read from getent: %m");
2744 return -errno;
2745 }
2746
2747 truncate_nl(line);
2748
2749 wait_for_terminate_and_warn("getent initgroups", pid);
2750
2751 /* Skip over the username and subsequent separator whitespace */
2752 x = line;
2753 x += strcspn(x, WHITESPACE);
2754 x += strspn(x, WHITESPACE);
2755
a2a5291b 2756 FOREACH_WORD(word, l, x, state) {
0cb9fbcd
LP		 2757 char c[l+1];
2758
a2a5291b 2759 memcpy(c, word, l);
0cb9fbcd
LP		 2760 c[l] = 0;
2761
2762 if (!GREEDY_REALLOC(uids, sz, n_uids+1))
2763 return log_oom();
2764
2765 r = parse_uid(c, &uids[n_uids++]);
2766 if (r < 0) {
2767 log_error("Failed to parse group data from getent.");
2768 return -EIO;
2769 }
2770 }
2771
2772 r = mkdir_parents(home, 0775);
2773 if (r < 0) {
2774 log_error("Failed to make home root directory: %s", strerror(-r));
2775 return r;
2776 }
2777
2778 r = mkdir_safe(home, 0755, uid, gid);
f418f31d 2779 if (r < 0 && r != -EEXIST) {
0cb9fbcd
LP		 2780 log_error("Failed to make home directory: %s", strerror(-r));
2781 return r;
2782 }
2783
2784 fchown(STDIN_FILENO, uid, gid);
2785 fchown(STDOUT_FILENO, uid, gid);
2786 fchown(STDERR_FILENO, uid, gid);
2787
2788 if (setgroups(n_uids, uids) < 0) {
2789 log_error("Failed to set auxiliary groups: %m");
2790 return -errno;
2791 }
2792
2793 if (setresgid(gid, gid, gid) < 0) {
2794 log_error("setregid() failed: %m");
2795 return -errno;
2796 }
2797
2798 if (setresuid(uid, uid, uid) < 0) {
2799 log_error("setreuid() failed: %m");
2800 return -errno;
2801 }
2802
2803 if (_home) {
2804 *_home = home;
2805 home = NULL;
2806 }
2807
2808 return 0;
2809}
2810
113cea80 2811/*
6d416b9c
LS		 2812 * Return values:
2813 * < 0 : wait_for_terminate() failed to get the state of the
2814 * container, the container was terminated by a signal, or
2815 * failed for an unknown reason. No change is made to the
2816 * container argument.
2817 * > 0 : The program executed in the container terminated with an
2818 * error. The exit code of the program executed in the
2819 * container is returned. No change is made to the container
2820 * argument.
2821 * 0 : The container is being rebooted, has been shut down or exited
2822 * successfully. The container argument has been set to either
2823 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
113cea80 2824 *
6d416b9c
LS		 2825 * That is, success is indicated by a return value of zero, and an
2826 * error is indicated by a non-zero value.
113cea80
DH		 2827 */
2828static int wait_for_container(pid_t pid, ContainerStatus *container) {
2829 int r;
2830 siginfo_t status;
2831
2832 r = wait_for_terminate(pid, &status);
8baaf7a3
LS		 2833 if (r < 0) {
2834 log_warning("Failed to wait for container: %s", strerror(-r));
113cea80 2835 return r;
8baaf7a3 2836 }
113cea80
DH		 2837
2838 switch (status.si_code) {
2839 case CLD_EXITED:
2840 r = status.si_status;
2841 if (r == 0) {
2842 if (!arg_quiet)
2843 log_debug("Container %s exited successfully.",
2844 arg_machine);
2845
2846 *container = CONTAINER_TERMINATED;
2847 } else {
2848 log_error("Container %s failed with error code %i.",
2849 arg_machine, status.si_status);
113cea80
DH		 2850 }
2851 break;
2852
2853 case CLD_KILLED:
2854 if (status.si_status == SIGINT) {
2855 if (!arg_quiet)
2856 log_info("Container %s has been shut down.",
2857 arg_machine);
2858
2859 *container = CONTAINER_TERMINATED;
2860 r = 0;
2861 break;
2862 } else if (status.si_status == SIGHUP) {
2863 if (!arg_quiet)
2864 log_info("Container %s is being rebooted.",
2865 arg_machine);
2866
2867 *container = CONTAINER_REBOOTED;
2868 r = 0;
2869 break;
2870 }
2871 /* CLD_KILLED fallthrough */
2872
2873 case CLD_DUMPED:
2874 log_error("Container %s terminated by signal %s.",
2875 arg_machine, signal_to_string(status.si_status));
2876 r = -1;
2877 break;
2878
2879 default:
2880 log_error("Container %s failed due to unknown reason.",
2881 arg_machine);
2882 r = -1;
2883 break;
2884 }
2885
2886 return r;
2887}
2888
e866af3a
DH		 2889static void nop_handler(int sig) {}
2890
88213476 2891int main(int argc, char *argv[]) {
69c79d3c 2892
1b9e5b12 2893 _cleanup_free_ char *kdbus_domain = NULL, *device_path = NULL, *root_device = NULL, *home_device = NULL, *srv_device = NULL;
727fd4fd 2894 bool root_device_rw = true, home_device_rw = true, srv_device_rw = true;
d96c1ecf 2895 _cleanup_close_ int master = -1, kdbus_fd = -1, image_fd = -1;
3d94f76c 2896 _cleanup_close_pair_ int kmsg_socket_pair[2] = { -1, -1 };
69c79d3c 2897 _cleanup_fdset_free_ FDSet *fds = NULL;
1b9e5b12 2898 int r = EXIT_FAILURE, k, n_fd_passed, loop_nr = -1;
69c79d3c 2899 const char *console = NULL;
1b9e5b12
LP		 2900 char veth_name[IFNAMSIZ];
2901 bool secondary = false;
e866af3a 2902 sigset_t mask, mask_chld;
69c79d3c 2903 pid_t pid = 0;
88213476
LP		 2904
2905 log_parse_environment();
2906 log_open();
2907
05947bef
LP		 2908 k = parse_argv(argc, argv);
2909 if (k < 0)
88213476 2910 goto finish;
05947bef
LP		 2911 else if (k == 0) {
2912 r = EXIT_SUCCESS;
2913 goto finish;
2914 }
88213476 2915
1b9e5b12
LP		 2916 if (!arg_image) {
2917 if (arg_directory) {
2918 char *p;
88213476 2919
1b9e5b12
LP		 2920 p = path_make_absolute_cwd(arg_directory);
2921 free(arg_directory);
2922 arg_directory = p;
2923 } else
2924 arg_directory = get_current_dir_name();
88213476 2925
1b9e5b12
LP		 2926 if (!arg_directory) {
2927 log_error("Failed to determine path, please use -D.");
2928 goto finish;
2929 }
2930 path_kill_slashes(arg_directory);
88213476
LP		 2931 }
2932
7027ff61 2933 if (!arg_machine) {
1b9e5b12 2934 arg_machine = strdup(basename(arg_image ? arg_image : arg_directory));
7027ff61
LP		 2935 if (!arg_machine) {
2936 log_oom();
2937 goto finish;
2938 }
2939
e724b063 2940 hostname_cleanup(arg_machine, false);
7027ff61
LP		 2941 if (isempty(arg_machine)) {
2942 log_error("Failed to determine machine name automatically, please use -M.");
2943 goto finish;
2944 }
2945 }
2946
88213476
LP		 2947 if (geteuid() != 0) {
2948 log_error("Need to be root.");
2949 goto finish;
2950 }
2951
04d391da
LP		 2952 if (sd_booted() <= 0) {
2953 log_error("Not running on a systemd system.");
2954 goto finish;
2955 }
2956
1b9e5b12
LP		 2957 log_close();
2958 n_fd_passed = sd_listen_fds(false);
2959 if (n_fd_passed > 0) {
2960 k = fdset_new_listen_fds(&fds, false);
2961 if (k < 0) {
2962 log_error("Failed to collect file descriptors: %s", strerror(-k));
2963 goto finish;
2964 }
88213476 2965 }
1b9e5b12
LP		 2966 fdset_close_others(fds);
2967 log_open();
88213476 2968
1b9e5b12
LP		 2969 if (arg_directory) {
2970 if (path_equal(arg_directory, "/")) {
2971 log_error("Spawning container on root directory not supported.");
6b9132a9
LP		 2972 goto finish;
2973 }
1b9e5b12
LP		 2974
2975 if (arg_boot) {
2976 if (path_is_os_tree(arg_directory) <= 0) {
5ae4d543 2977 log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", arg_directory);
1b9e5b12
LP		 2978 goto finish;
2979 }
2980 } else {
2981 const char *p;
2982
2983 p = strappenda(arg_directory,
2984 argc > optind && path_is_absolute(argv[optind]) ? argv[optind] : "/usr/bin/");
2985 if (access(p, F_OK) < 0) {
2986 log_error("Directory %s lacks the binary to execute or doesn't look like a binary tree. Refusing.", arg_directory);
2987 goto finish;
2988
2989 }
2990 }
6b9132a9 2991 } else {
1b9e5b12 2992 char template[] = "/tmp/nspawn-root-XXXXXX";
6b9132a9 2993
1b9e5b12
LP		 2994 if (!mkdtemp(template)) {
2995 log_error("Failed to create temporary directory: %m");
2996 r = -errno;
6b9132a9 2997 goto finish;
1b9e5b12 2998 }
6b9132a9 2999
1b9e5b12
LP		 3000 arg_directory = strdup(template);
3001 if (!arg_directory) {
3002 r = log_oom();
3003 goto finish;
6b9132a9 3004 }
88213476 3005
1b9e5b12
LP		 3006 image_fd = setup_image(&device_path, &loop_nr);
3007 if (image_fd < 0) {
3008 r = image_fd;
842f3b0f
LP		 3009 goto finish;
3010 }
1b9e5b12 3011
4d9f07b4
LP		 3012 r = dissect_image(image_fd,
3013 &root_device, &root_device_rw,
3014 &home_device, &home_device_rw,
3015 &srv_device, &srv_device_rw,
3016 &secondary);
1b9e5b12
LP		 3017 if (r < 0)
3018 goto finish;
842f3b0f 3019 }
842f3b0f 3020
db7feb7e
LP		 3021 master = posix_openpt(O_RDWR|O_NOCTTY|O_CLOEXEC|O_NDELAY);
3022 if (master < 0) {
a258bf26
LP		 3023 log_error("Failed to acquire pseudo tty: %m");
3024 goto finish;
3025 }
3026
db7feb7e
LP		 3027 console = ptsname(master);
3028 if (!console) {
a258bf26
LP		 3029 log_error("Failed to determine tty name: %m");
3030 goto finish;
3031 }
3032
284c0b91 3033 if (!arg_quiet)
45f1386c
ZJS		 3034 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
3035 arg_machine, arg_image ? arg_image : arg_directory);
a258bf26
LP		 3036
3037 if (unlockpt(master) < 0) {
3038 log_error("Failed to unlock tty: %m");
3039 goto finish;
3040 }
3041
eb91eb18
LP		 3042 if (access("/dev/kdbus/control", F_OK) >= 0) {
3043
3044 if (arg_share_system) {
3045 kdbus_domain = strdup("/dev/kdbus");
3046 if (!kdbus_domain) {
3047 log_oom();
3048 goto finish;
3049 }
3050 } else {
3051 const char *ns;
3052
3053 ns = strappenda("machine-", arg_machine);
3054 kdbus_fd = bus_kernel_create_domain(ns, &kdbus_domain);
3055 if (r < 0)
3056 log_debug("Failed to create kdbus domain: %s", strerror(-r));
3057 else
3058 log_debug("Successfully created kdbus domain as %s", kdbus_domain);
3059 }
3060 }
9bd37b40 3061
e58a1277 3062 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0) {
354bfd2b
LP		 3063 log_error("Failed to create kmsg socket pair: %m");
3064 goto finish;
3065 }
3066
05947bef
LP		 3067 sd_notify(0, "READY=1");
3068
a258bf26 3069 assert_se(sigemptyset(&mask) == 0);
e866af3a
DH		 3070 assert_se(sigemptyset(&mask_chld) == 0);
3071 sigaddset(&mask_chld, SIGCHLD);
a258bf26
LP		 3072 sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
3073 assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
3074
d87be9b0 3075 for (;;) {
113cea80 3076 ContainerStatus container_status;
7566e267 3077 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
e866af3a
DH		 3078 struct sigaction sa = {
3079 .sa_handler = nop_handler,
3080 .sa_flags = SA_NOCLDSTOP,
3081 };
3082
7566e267 3083 r = barrier_create(&barrier);
a2da110b
DH		 3084 if (r < 0) {
3085 log_error("Cannot initialize IPC barrier: %s", strerror(-r));
3086 goto finish;
3087 }
3088
e866af3a
DH		 3089 /* Child can be killed before execv(), so handle SIGCHLD
3090 * in order to interrupt parent's blocking calls and
3091 * give it a chance to call wait() and terminate. */
3092 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
3093 if (r < 0) {
3094 log_error("Failed to change the signal mask: %m");
d96c1ecf
LP		 3095 goto finish;
3096 }
3097
e866af3a
DH		 3098 r = sigaction(SIGCHLD, &sa, NULL);
3099 if (r < 0) {
3100 log_error("Failed to install SIGCHLD handler: %m");
40ddbdf8
LP		 3101 goto finish;
3102 }
3103
a2da110b
DH		 3104 pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWNS|
3105 (arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS)|
3106 (arg_private_network ? CLONE_NEWNET : 0), NULL);
d87be9b0
LP		 3107 if (pid < 0) {
3108 if (errno == EINVAL)
3109 log_error("clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m");
3110 else
3111 log_error("clone() failed: %m");
a258bf26 3112
e866af3a 3113 r = pid;
d87be9b0
LP		 3114 goto finish;
3115 }
a258bf26 3116
d87be9b0
LP		 3117 if (pid == 0) {
3118 /* child */
0cb9fbcd 3119 _cleanup_free_ char *home = NULL;
5674767e 3120 unsigned n_env = 2;
d87be9b0 3121 const char *envp[] = {
e10a55fd 3122 "PATH=" DEFAULT_PATH_SPLIT_USR,
d87be9b0
LP		 3123 "container=systemd-nspawn", /* LXC sets container=lxc, so follow the scheme here */
3124 NULL, /* TERM */
3125 NULL, /* HOME */
3126 NULL, /* USER */
3127 NULL, /* LOGNAME */
3128 NULL, /* container_uuid */
842f3b0f
LP		 3129 NULL, /* LISTEN_FDS */
3130 NULL, /* LISTEN_PID */
d87be9b0
LP		 3131 NULL
3132 };
f4889f65 3133 char **env_use;
a258bf26 3134
a2da110b
DH		 3135 barrier_set_role(&barrier, BARRIER_CHILD);
3136
5674767e
ZJS		 3137 envp[n_env] = strv_find_prefix(environ, "TERM=");
3138 if (envp[n_env])
3139 n_env ++;
a258bf26 3140
03e334a1 3141 master = safe_close(master);
a258bf26 3142
d87be9b0
LP		 3143 close_nointr(STDIN_FILENO);
3144 close_nointr(STDOUT_FILENO);
3145 close_nointr(STDERR_FILENO);
db7feb7e 3146
03e334a1 3147 kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
a258bf26 3148
d87be9b0 3149 reset_all_signal_handlers();
88213476 3150
d87be9b0
LP		 3151 assert_se(sigemptyset(&mask) == 0);
3152 assert_se(sigprocmask(SIG_SETMASK, &mask, NULL) == 0);
f5c1b9ee 3153
842f3b0f
LP		 3154 k = open_terminal(console, O_RDWR);
3155 if (k != STDIN_FILENO) {
3156 if (k >= 0) {
03e334a1 3157 safe_close(k);
842f3b0f
LP		 3158 k = -EINVAL;
3159 }
3160
3161 log_error("Failed to open console: %s", strerror(-k));
a2da110b 3162 _exit(EXIT_FAILURE);
842f3b0f
LP		 3163 }
3164
3165 if (dup2(STDIN_FILENO, STDOUT_FILENO) != STDOUT_FILENO ||
3166 dup2(STDIN_FILENO, STDERR_FILENO) != STDERR_FILENO) {
3167 log_error("Failed to duplicate console: %m");
a2da110b 3168 _exit(EXIT_FAILURE);
842f3b0f 3169 }
bc2f673e 3170
d87be9b0
LP		 3171 if (setsid() < 0) {
3172 log_error("setsid() failed: %m");
a2da110b 3173 _exit(EXIT_FAILURE);
bc2f673e
LP		 3174 }
3175
db999e0f 3176 if (reset_audit_loginuid() < 0)
a2da110b 3177 _exit(EXIT_FAILURE);
db999e0f 3178
d87be9b0
LP		 3179 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0) {
3180 log_error("PR_SET_PDEATHSIG failed: %m");
a2da110b 3181 _exit(EXIT_FAILURE);
d87be9b0 3182 }
e58a1277 3183
d87be9b0
LP		 3184 /* Mark everything as slave, so that we still
3185 * receive mounts from the real root, but don't
3186 * propagate mounts to the real root. */
3187 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
3188 log_error("MS_SLAVE|MS_REC failed: %m");
a2da110b 3189 _exit(EXIT_FAILURE);
d87be9b0 3190 }
04bc4a3f 3191
727fd4fd
LP		 3192 if (mount_devices(arg_directory,
3193 root_device, root_device_rw,
3194 home_device, home_device_rw,
3195 srv_device, srv_device_rw) < 0)
a2da110b 3196 _exit(EXIT_FAILURE);
1b9e5b12 3197
d87be9b0
LP		 3198 /* Turn directory into bind mount */
3199 if (mount(arg_directory, arg_directory, "bind", MS_BIND|MS_REC, NULL) < 0) {
d6797c92 3200 log_error("Failed to make bind mount: %m");
a2da110b 3201 _exit(EXIT_FAILURE);
d87be9b0 3202 }
88213476 3203
4d9f07b4
LP		 3204 r = setup_volatile(arg_directory);
3205 if (r < 0)
a2da110b 3206 _exit(EXIT_FAILURE);
4d9f07b4
LP		 3207
3208 if (setup_volatile_state(arg_directory) < 0)
a2da110b 3209 _exit(EXIT_FAILURE);
4d9f07b4
LP		 3210
3211 r = base_filesystem_create(arg_directory);
3212 if (r < 0)
a2da110b 3213 _exit(EXIT_FAILURE);
4d9f07b4 3214
d6797c92
LP		 3215 if (arg_read_only) {
3216 k = bind_remount_recursive(arg_directory, true);
3217 if (k < 0) {
3218 log_error("Failed to make tree read-only: %s", strerror(-k));
a2da110b 3219 _exit(EXIT_FAILURE);
d87be9b0 3220 }
d6797c92 3221 }
2547bb41 3222
d87be9b0 3223 if (mount_all(arg_directory) < 0)
a2da110b 3224 _exit(EXIT_FAILURE);
57fb9fb5 3225
d87be9b0 3226 if (copy_devnodes(arg_directory) < 0)
a2da110b 3227 _exit(EXIT_FAILURE);
a258bf26 3228
f2d88580 3229 if (setup_ptmx(arg_directory) < 0)
a2da110b 3230 _exit(EXIT_FAILURE);
f2d88580 3231
d87be9b0 3232 dev_setup(arg_directory);
88213476 3233
28650077 3234 if (setup_seccomp() < 0)
a2da110b 3235 _exit(EXIT_FAILURE);
24fb1112 3236
d87be9b0 3237 if (setup_dev_console(arg_directory, console) < 0)
a2da110b 3238 _exit(EXIT_FAILURE);
88213476 3239
d87be9b0 3240 if (setup_kmsg(arg_directory, kmsg_socket_pair[1]) < 0)
a2da110b 3241 _exit(EXIT_FAILURE);
88213476 3242
03e334a1 3243 kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
a258bf26 3244
d87be9b0 3245 if (setup_boot_id(arg_directory) < 0)
a2da110b 3246 _exit(EXIT_FAILURE);
a41fe3a2 3247
d87be9b0 3248 if (setup_timezone(arg_directory) < 0)
a2da110b 3249 _exit(EXIT_FAILURE);
88213476 3250
d87be9b0 3251 if (setup_resolv_conf(arg_directory) < 0)
a2da110b 3252 _exit(EXIT_FAILURE);
687d0825 3253
d87be9b0 3254 if (setup_journal(arg_directory) < 0)
a2da110b 3255 _exit(EXIT_FAILURE);
687d0825 3256
d6797c92 3257 if (mount_binds(arg_directory, arg_bind, false) < 0)
a2da110b 3258 _exit(EXIT_FAILURE);
17fe0523 3259
d6797c92 3260 if (mount_binds(arg_directory, arg_bind_ro, true) < 0)
a2da110b 3261 _exit(EXIT_FAILURE);
17fe0523 3262
06c17c39 3263 if (mount_tmpfs(arg_directory) < 0)
a2da110b 3264 _exit(EXIT_FAILURE);
06c17c39 3265
486e99a3 3266 if (setup_kdbus(arg_directory, kdbus_domain) < 0)
a2da110b 3267 _exit(EXIT_FAILURE);
9bd37b40 3268
d96c1ecf
LP		 3269 /* Tell the parent that we are ready, and that
3270 * it can cgroupify us to that we lack access
3271 * to certain devices and resources. */
a2da110b 3272 barrier_place(&barrier);
d96c1ecf 3273
d87be9b0
LP		 3274 if (chdir(arg_directory) < 0) {
3275 log_error("chdir(%s) failed: %m", arg_directory);
a2da110b 3276 _exit(EXIT_FAILURE);
687d0825
MV		 3277 }
3278
d87be9b0
LP		 3279 if (mount(arg_directory, "/", NULL, MS_MOVE, NULL) < 0) {
3280 log_error("mount(MS_MOVE) failed: %m");
a2da110b 3281 _exit(EXIT_FAILURE);
687d0825
MV		 3282 }
3283
d87be9b0
LP		 3284 if (chroot(".") < 0) {
3285 log_error("chroot() failed: %m");
a2da110b 3286 _exit(EXIT_FAILURE);
687d0825
MV		 3287 }
3288
d87be9b0
LP		 3289 if (chdir("/") < 0) {
3290 log_error("chdir() failed: %m");
a2da110b 3291 _exit(EXIT_FAILURE);
687d0825
MV		 3292 }
3293
d87be9b0
LP		 3294 umask(0022);
3295
eb91eb18
LP		 3296 if (arg_private_network)
3297 loopback_setup();
d87be9b0
LP		 3298
3299 if (drop_capabilities() < 0) {
3300 log_error("drop_capabilities() failed: %m");
a2da110b 3301 _exit(EXIT_FAILURE);
687d0825 3302 }
687d0825 3303
0cb9fbcd
LP		 3304 r = change_uid_gid(&home);
3305 if (r < 0)
a2da110b 3306 _exit(EXIT_FAILURE);
d87be9b0 3307
842f3b0f
LP		 3308 if ((asprintf((char**)(envp + n_env++), "HOME=%s", home ? home: "/root") < 0) ||
3309 (asprintf((char**)(envp + n_env++), "USER=%s", arg_user ? arg_user : "root") < 0) ||
3310 (asprintf((char**)(envp + n_env++), "LOGNAME=%s", arg_user ? arg_user : "root") < 0)) {
0d0f0c50 3311 log_oom();
a2da110b 3312 _exit(EXIT_FAILURE);
144f0fc0 3313 }
687d0825 3314
9444b1f2 3315 if (!sd_id128_equal(arg_uuid, SD_ID128_NULL)) {
9f24adc2
LP		 3316 char as_uuid[37];
3317
3318 if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_format_as_uuid(arg_uuid, as_uuid)) < 0) {
842f3b0f 3319 log_oom();
a2da110b 3320 _exit(EXIT_FAILURE);
842f3b0f
LP		 3321 }
3322 }
3323
3324 if (fdset_size(fds) > 0) {
3325 k = fdset_cloexec(fds, false);
3326 if (k < 0) {
3327 log_error("Failed to unset O_CLOEXEC for file descriptors.");
a2da110b 3328 _exit(EXIT_FAILURE);
842f3b0f
LP		 3329 }
3330
3331 if ((asprintf((char **)(envp + n_env++), "LISTEN_FDS=%u", n_fd_passed) < 0) ||
d1826146 3332 (asprintf((char **)(envp + n_env++), "LISTEN_PID=1") < 0)) {
d87be9b0 3333 log_oom();
a2da110b 3334 _exit(EXIT_FAILURE);
d87be9b0
LP		 3335 }
3336 }
3337
3338 setup_hostname();
3339
6afc95b7
LP		 3340 if (arg_personality != 0xffffffffLU) {
3341 if (personality(arg_personality) < 0) {
3342 log_error("personality() failed: %m");
a2da110b 3343 _exit(EXIT_FAILURE);
6afc95b7 3344 }
1b9e5b12
LP		 3345 } else if (secondary) {
3346 if (personality(PER_LINUX32) < 0) {
3347 log_error("personality() failed: %m");
a2da110b 3348 _exit(EXIT_FAILURE);
1b9e5b12 3349 }
6afc95b7
LP		 3350 }
3351
d96c1ecf
LP		 3352#ifdef HAVE_SELINUX
3353 if (arg_selinux_context)
0cb9fbcd 3354 if (setexeccon((security_context_t) arg_selinux_context) < 0) {
d96c1ecf 3355 log_error("setexeccon(\"%s\") failed: %m", arg_selinux_context);
a2da110b 3356 _exit(EXIT_FAILURE);
0cb9fbcd 3357 }
d96c1ecf 3358#endif
354bfd2b 3359
f4889f65
LP		 3360 if (!strv_isempty(arg_setenv)) {
3361 char **n;
3362
3363 n = strv_env_merge(2, envp, arg_setenv);
3364 if (!n) {
3365 log_oom();
a2da110b 3366 _exit(EXIT_FAILURE);
f4889f65
LP		 3367 }
3368
3369 env_use = n;
3370 } else
3371 env_use = (char**) envp;
3372
d96c1ecf 3373 /* Wait until the parent is ready with the setup, too... */
a2da110b
DH		 3374 if (!barrier_place_and_sync(&barrier))
3375 _exit(EXIT_FAILURE);
d96c1ecf 3376
d87be9b0
LP		 3377 if (arg_boot) {
3378 char **a;
3379 size_t l;
88213476 3380
d87be9b0 3381 /* Automatically search for the init system */
0f0dbc46 3382
d87be9b0
LP		 3383 l = 1 + argc - optind;
3384 a = newa(char*, l + 1);
3385 memcpy(a + 1, argv + optind, l * sizeof(char*));
0f0dbc46 3386
d87be9b0 3387 a[0] = (char*) "/usr/lib/systemd/systemd";
f4889f65 3388 execve(a[0], a, env_use);
0f0dbc46 3389
d87be9b0 3390 a[0] = (char*) "/lib/systemd/systemd";
f4889f65 3391 execve(a[0], a, env_use);
0f0dbc46 3392
d87be9b0 3393 a[0] = (char*) "/sbin/init";
f4889f65 3394 execve(a[0], a, env_use);
d87be9b0 3395 } else if (argc > optind)
f4889f65 3396 execvpe(argv[optind], argv + optind, env_use);
d87be9b0
LP		 3397 else {
3398 chdir(home ? home : "/root");
f4889f65 3399 execle("/bin/bash", "-bash", NULL, env_use);
262d10e6 3400 execle("/bin/sh", "-sh", NULL, env_use);
d87be9b0
LP		 3401 }
3402
3403 log_error("execv() failed: %m");
d87be9b0 3404 _exit(EXIT_FAILURE);
da5b3bad 3405 }
88213476 3406
a2da110b 3407 barrier_set_role(&barrier, BARRIER_PARENT);
842f3b0f
LP		 3408 fdset_free(fds);
3409 fds = NULL;
3410
a2da110b
DH		 3411 /* wait for child-setup to be done */
3412 if (barrier_place_and_sync(&barrier)) {
5aa4bb6b 3413 int ifi = 0;
354bfd2b 3414
840295fc
LP		 3415 r = move_network_interfaces(pid);
3416 if (r < 0)
3417 goto finish;
aa28aefe 3418
5aa4bb6b 3419 r = setup_veth(pid, veth_name, &ifi);
840295fc
LP		 3420 if (r < 0)
3421 goto finish;
ab046dde 3422
5aa4bb6b 3423 r = setup_bridge(veth_name, &ifi);
840295fc
LP		 3424 if (r < 0)
3425 goto finish;
ab046dde 3426
840295fc
LP		 3427 r = setup_macvlan(pid);
3428 if (r < 0)
3429 goto finish;
c74e630d 3430
5aa4bb6b
LP		 3431 r = register_machine(pid, ifi);
3432 if (r < 0)
3433 goto finish;
3434
840295fc
LP		 3435 /* Block SIGCHLD here, before notifying child.
3436 * process_pty() will handle it with the other signals. */
3437 r = sigprocmask(SIG_BLOCK, &mask_chld, NULL);
3438 if (r < 0)
3439 goto finish;
e866af3a 3440
840295fc
LP		 3441 /* Reset signal to default */
3442 r = default_signals(SIGCHLD, -1);
3443 if (r < 0)
3444 goto finish;
e866af3a 3445
840295fc
LP		 3446 /* Notify the child that the parent is ready with all
3447 * its setup, and that the child can now hand over
3448 * control to the code to run inside the container. */
a2da110b 3449 barrier_place(&barrier);
354bfd2b 3450
840295fc
LP		 3451 k = process_pty(master, &mask, arg_boot ? pid : 0, SIGRTMIN+3);
3452 if (k < 0) {
3453 r = EXIT_FAILURE;
3454 break;
3455 }
88213476 3456
840295fc
LP		 3457 if (!arg_quiet)
3458 putc('\n', stdout);
04d39279 3459
840295fc
LP		 3460 /* Kill if it is not dead yet anyway */
3461 terminate_machine(pid);
3462 }
1f0cd86b 3463
840295fc 3464 /* Normally redundant, but better safe than sorry */
04d39279 3465 kill(pid, SIGKILL);
a258bf26 3466
113cea80 3467 r = wait_for_container(pid, &container_status);
04d39279
LP		 3468 pid = 0;
3469
ce9f1527
LP		 3470 if (r < 0) {
3471 /* We failed to wait for the container, or the
3472 * container exited abnormally */
3473 r = EXIT_FAILURE;
d87be9b0 3474 break;
ce9f1527
LP		 3475 } else if (r > 0 || container_status == CONTAINER_TERMINATED)
3476 /* The container exited with a non-zero
3477 * status, or with zero status and no reboot
3478 * was requested. */
d87be9b0 3479 break;
88213476 3480
113cea80 3481 /* CONTAINER_REBOOTED, loop again */
ce38dbc8
LP		 3482
3483 if (arg_keep_unit) {
3484 /* Special handling if we are running as a
3485 * service: instead of simply restarting the
3486 * machine we want to restart the entire
3487 * service, so let's inform systemd about this
3488 * with the special exit code 133. The service
3489 * file uses RestartForceExitStatus=133 so
3490 * that this results in a full nspawn
3491 * restart. This is necessary since we might
3492 * have cgroup parameters set we want to have
3493 * flushed out. */
3494 r = 133;
3495 break;
3496 }
d87be9b0 3497 }
88213476
LP		 3498
3499finish:
1b9e5b12
LP		 3500 loop_remove(loop_nr, &image_fd);
3501
9444b1f2
LP		 3502 if (pid > 0)
3503 kill(pid, SIGKILL);
88213476 3504
04d391da 3505 free(arg_directory);
7027ff61 3506 free(arg_machine);
c74e630d
LP		 3507 free(arg_user);
3508 strv_free(arg_setenv);
3509 strv_free(arg_network_interfaces);
3510 strv_free(arg_network_macvlan);
3511 strv_free(arg_bind);
3512 strv_free(arg_bind_ro);
06c17c39 3513 strv_free(arg_tmpfs);
88213476
LP		 3514
3515 return r;
3516}
Unnamed repository; edit this file 'description' to name the repository.