src/core/mount-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <errno.h>
  23 #include <ftw.h>
  24 #include <stdlib.h>
  25 #include <sys/mount.h>
  26 #include <unistd.h>
  27
  28 #include "alloc-util.h"
  29 #include "bus-util.h"
  30 #include "cgroup-util.h"
  31 #include "dev-setup.h"
  32 #include "efivars.h"
  33 #include "label.h"
  34 #include "log.h"
  35 #include "macro.h"
  36 #include "missing.h"
  37 #include "mkdir.h"
  38 #include "mount-setup.h"
  39 #include "mount-util.h"
  40 #include "path-util.h"
  41 #include "set.h"
  42 #include "smack-util.h"
  43 #include "strv.h"
  44 #include "user-util.h"
  45 #include "util.h"
  46 #include "virt.h"
  47
  48 typedef enum MountMode {
  49         MNT_NONE  =        0,
  50         MNT_FATAL =        1 <<  0,
  51         MNT_IN_CONTAINER = 1 <<  1,
  52 } MountMode;
  53
  54 typedef struct MountPoint {
  55         const char *what;
  56         const char *where;
  57         const char *type;
  58         const char *options;
  59         unsigned long flags;
  60         bool (*condition_fn)(void);
  61         MountMode mode;
  62 } MountPoint;
  63
  64 /* The first three entries we might need before SELinux is up. The
  65  * fourth (securityfs) is needed by IMA to load a custom policy. The
  66  * other ones we can delay until SELinux and IMA are loaded. When
  67  * SMACK is enabled we need smackfs, too, so it's a fifth one. */
  68 #ifdef HAVE_SMACK
  69 #define N_EARLY_MOUNT 5
  70 #else
  71 #define N_EARLY_MOUNT 4
  72 #endif
  73
  74 static const MountPoint mount_table[] = {
  75         { "sysfs",       "/sys",                      "sysfs",      NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  76           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  77         { "proc",        "/proc",                     "proc",       NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  78           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  79         { "devtmpfs",    "/dev",                      "devtmpfs",   "mode=755",                MS_NOSUID|MS_STRICTATIME,
  80           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  81         { "securityfs",  "/sys/kernel/security",      "securityfs", NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
  82           NULL,          MNT_NONE                   },
  83 #ifdef HAVE_SMACK
  84         { "smackfs",     "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*",            MS_NOSUID|MS_NOEXEC|MS_NODEV,
  85           mac_smack_use, MNT_FATAL                  },
  86         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  87           mac_smack_use, MNT_FATAL                  },
  88 #endif
  89         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777",               MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  90           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  91         { "devpts",      "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
  92           NULL,          MNT_IN_CONTAINER           },
  93 #ifdef HAVE_SMACK
  94         { "tmpfs",       "/run",                      "tmpfs",      "mode=755,smackfsroot=*",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  95           mac_smack_use, MNT_FATAL                  },
  96 #endif
  97         { "tmpfs",       "/run",                      "tmpfs",      "mode=755",                MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  98           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
  99         { "cgroup",      "/sys/fs/cgroup",            "cgroup",     "__DEVEL__sane_behavior",  MS_NOSUID|MS_NOEXEC|MS_NODEV,
 100           cg_is_unified_wanted, MNT_FATAL|MNT_IN_CONTAINER },
 101         { "tmpfs",       "/sys/fs/cgroup",            "tmpfs",      "mode=755",                MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
 102           cg_is_legacy_wanted, MNT_FATAL|MNT_IN_CONTAINER },
 103         { "cgroup",      "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd,xattr", MS_NOSUID|MS_NOEXEC|MS_NODEV,
 104           cg_is_legacy_wanted, MNT_IN_CONTAINER           },
 105         { "cgroup",      "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd",       MS_NOSUID|MS_NOEXEC|MS_NODEV,
 106           cg_is_legacy_wanted, MNT_FATAL|MNT_IN_CONTAINER },
 107         { "pstore",      "/sys/fs/pstore",            "pstore",     NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 108           NULL,          MNT_NONE                   },
 109 #ifdef ENABLE_EFI
 110         { "efivarfs",    "/sys/firmware/efi/efivars", "efivarfs",   NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 111           is_efi_boot,   MNT_NONE                   },
 112 #endif
 113         { "kdbusfs",    "/sys/fs/kdbus",             "kdbusfs",    NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
 114           is_kdbus_wanted,       MNT_IN_CONTAINER },
 115 };
 116
 117 /* These are API file systems that might be mounted by other software,
 118  * we just list them here so that we know that we should ignore them */
 119
 120 static const char ignore_paths[] =
 121         /* SELinux file systems */
 122         "/sys/fs/selinux\0"
 123         /* Container bind mounts */
 124         "/proc/sys\0"
 125         "/dev/console\0"
 126         "/proc/kmsg\0";
 127
 128 bool mount_point_is_api(const char *path) {
 129         unsigned i;
 130
 131         /* Checks if this mount point is considered "API", and hence
 132          * should be ignored */
 133
 134         for (i = 0; i < ELEMENTSOF(mount_table); i ++)
 135                 if (path_equal(path, mount_table[i].where))
 136                         return true;
 137
 138         return path_startswith(path, "/sys/fs/cgroup/");
 139 }
 140
 141 bool mount_point_ignore(const char *path) {
 142         const char *i;
 143
 144         NULSTR_FOREACH(i, ignore_paths)
 145                 if (path_equal(path, i))
 146                         return true;
 147
 148         return false;
 149 }
 150
 151 static int mount_one(const MountPoint *p, bool relabel) {
 152         int r;
 153
 154         assert(p);
 155
 156         if (p->condition_fn && !p->condition_fn())
 157                 return 0;
 158
 159         /* Relabel first, just in case */
 160         if (relabel)
 161                 label_fix(p->where, true, true);
 162
 163         r = path_is_mount_point(p->where, AT_SYMLINK_FOLLOW);
 164         if (r < 0 && r != -ENOENT)
 165                 return r;
 166         if (r > 0)
 167                 return 0;
 168
 169         /* Skip securityfs in a container */
 170         if (!(p->mode & MNT_IN_CONTAINER) && detect_container() > 0)
 171                 return 0;
 172
 173         /* The access mode here doesn't really matter too much, since
 174          * the mounted file system will take precedence anyway. */
 175         if (relabel)
 176                 mkdir_p_label(p->where, 0755);
 177         else
 178                 mkdir_p(p->where, 0755);
 179
 180         log_debug("Mounting %s to %s of type %s with options %s.",
 181                   p->what,
 182                   p->where,
 183                   p->type,
 184                   strna(p->options));
 185
 186         if (mount(p->what,
 187                   p->where,
 188                   p->type,
 189                   p->flags,
 190                   p->options) < 0) {
 191                 log_full((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, "Failed to mount %s at %s: %m", p->type, p->where);
 192                 return (p->mode & MNT_FATAL) ? -errno : 0;
 193         }
 194
 195         /* Relabel again, since we now mounted something fresh here */
 196         if (relabel)
 197                 label_fix(p->where, false, false);
 198
 199         return 1;
 200 }
 201
 202 int mount_setup_early(void) {
 203         unsigned i;
 204         int r = 0;
 205
 206         assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table));
 207
 208         /* Do a minimal mount of /proc and friends to enable the most
 209          * basic stuff, such as SELinux */
 210         for (i = 0; i < N_EARLY_MOUNT; i ++)  {
 211                 int j;
 212
 213                 j = mount_one(mount_table + i, false);
 214                 if (j != 0 && r >= 0)
 215                         r = j;
 216         }
 217
 218         return r;
 219 }
 220
 221 int mount_cgroup_controllers(char ***join_controllers) {
 222         _cleanup_set_free_free_ Set *controllers = NULL;
 223         int r;
 224
 225         if (!cg_is_legacy_wanted())
 226                 return 0;
 227
 228         /* Mount all available cgroup controllers that are built into the kernel. */
 229
 230         controllers = set_new(&string_hash_ops);
 231         if (!controllers)
 232                 return log_oom();
 233
 234         r = cg_kernel_controllers(controllers);
 235         if (r < 0)
 236                 return log_error_errno(r, "Failed to enumerate cgroup controllers: %m");
 237
 238         for (;;) {
 239                 _cleanup_free_ char *options = NULL, *controller = NULL, *where = NULL;
 240                 MountPoint p = {
 241                         .what = "cgroup",
 242                         .type = "cgroup",
 243                         .flags = MS_NOSUID|MS_NOEXEC|MS_NODEV,
 244                         .mode = MNT_IN_CONTAINER,
 245                 };
 246                 char ***k = NULL;
 247
 248                 controller = set_steal_first(controllers);
 249                 if (!controller)
 250                         break;
 251
 252                 if (join_controllers)
 253                         for (k = join_controllers; *k; k++)
 254                                 if (strv_find(*k, controller))
 255                                         break;
 256
 257                 if (k && *k) {
 258                         char **i, **j;
 259
 260                         for (i = *k, j = *k; *i; i++) {
 261
 262                                 if (!streq(*i, controller)) {
 263                                         _cleanup_free_ char *t;
 264
 265                                         t = set_remove(controllers, *i);
 266                                         if (!t) {
 267                                                 free(*i);
 268                                                 continue;
 269                                         }
 270                                 }
 271
 272                                 *(j++) = *i;
 273                         }
 274
 275                         *j = NULL;
 276
 277                         options = strv_join(*k, ",");
 278                         if (!options)
 279                                 return log_oom();
 280                 } else {
 281                         options = controller;
 282                         controller = NULL;
 283                 }
 284
 285                 where = strappend("/sys/fs/cgroup/", options);
 286                 if (!where)
 287                         return log_oom();
 288
 289                 p.where = where;
 290                 p.options = options;
 291
 292                 r = mount_one(&p, true);
 293                 if (r < 0)
 294                         return r;
 295
 296                 if (r > 0 && k && *k) {
 297                         char **i;
 298
 299                         for (i = *k; *i; i++) {
 300                                 _cleanup_free_ char *t = NULL;
 301
 302                                 t = strappend("/sys/fs/cgroup/", *i);
 303                                 if (!t)
 304                                         return log_oom();
 305
 306                                 r = symlink(options, t);
 307                                 if (r >= 0) {
 308 #ifdef SMACK_RUN_LABEL
 309                                         _cleanup_free_ char *src;
 310                                         src = strappend("/sys/fs/cgroup/", options);
 311                                         if (!src)
 312                                                 return log_oom();
 313                                         r = mac_smack_copy(t, src);
 314                                         if (r < 0 && r != -EOPNOTSUPP)
 315                                                 return log_error_errno(r, "Failed to copy smack label from %s to %s: %m", src, t);
 316 #endif
 317                                 } else if (errno != EEXIST)
 318                                         return log_error_errno(errno, "Failed to create symlink %s: %m", t);
 319                         }
 320                 }
 321         }
 322
 323         /* Now that we mounted everything, let's make the tmpfs the
 324          * cgroup file systems are mounted into read-only. */
 325         (void) mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755");
 326
 327         return 0;
 328 }
 329
 330 #if defined(HAVE_SELINUX) || defined(HAVE_SMACK)
 331 static int nftw_cb(
 332                 const char *fpath,
 333                 const struct stat *sb,
 334                 int tflag,
 335                 struct FTW *ftwbuf) {
 336
 337         /* No need to label /dev twice in a row... */
 338         if (_unlikely_(ftwbuf->level == 0))
 339                 return FTW_CONTINUE;
 340
 341         label_fix(fpath, false, false);
 342
 343         /* /run/initramfs is static data and big, no need to
 344          * dynamically relabel its contents at boot... */
 345         if (_unlikely_(ftwbuf->level == 1 &&
 346                       tflag == FTW_D &&
 347                       streq(fpath, "/run/initramfs")))
 348                 return FTW_SKIP_SUBTREE;
 349
 350         return FTW_CONTINUE;
 351 };
 352 #endif
 353
 354 int mount_setup(bool loaded_policy) {
 355         unsigned i;
 356         int r = 0;
 357
 358         for (i = 0; i < ELEMENTSOF(mount_table); i ++) {
 359                 int j;
 360
 361                 j = mount_one(mount_table + i, loaded_policy);
 362                 if (j != 0 && r >= 0)
 363                         r = j;
 364         }
 365
 366         if (r < 0)
 367                 return r;
 368
 369 #if defined(HAVE_SELINUX) || defined(HAVE_SMACK)
 370         /* Nodes in devtmpfs and /run need to be manually updated for
 371          * the appropriate labels, after mounting. The other virtual
 372          * API file systems like /sys and /proc do not need that, they
 373          * use the same label for all their files. */
 374         if (loaded_policy) {
 375                 usec_t before_relabel, after_relabel;
 376                 char timespan[FORMAT_TIMESPAN_MAX];
 377
 378                 before_relabel = now(CLOCK_MONOTONIC);
 379
 380                 nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 381                 nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 382
 383                 after_relabel = now(CLOCK_MONOTONIC);
 384
 385                 log_info("Relabelled /dev and /run in %s.",
 386                          format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));
 387         }
 388 #endif
 389
 390         /* Create a few default symlinks, which are normally created
 391          * by udevd, but some scripts might need them before we start
 392          * udevd. */
 393         dev_setup(NULL, UID_INVALID, GID_INVALID);
 394
 395         /* Mark the root directory as shared in regards to mount
 396          * propagation. The kernel defaults to "private", but we think
 397          * it makes more sense to have a default of "shared" so that
 398          * nspawn and the container tools work out of the box. If
 399          * specific setups need other settings they can reset the
 400          * propagation mode to private if needed. */
 401         if (detect_container() <= 0)
 402                 if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)
 403                         log_warning_errno(errno, "Failed to set up the root directory for shared mount propagation: %m");
 404
 405         /* Create a few directories we always want around, Note that
 406          * sd_booted() checks for /run/systemd/system, so this mkdir
 407          * really needs to stay for good, otherwise software that
 408          * copied sd-daemon.c into their sources will misdetect
 409          * systemd. */
 410         mkdir_label("/run/systemd", 0755);
 411         mkdir_label("/run/systemd/system", 0755);
 412         mkdir_label("/run/systemd/inaccessible", 0000);
 413
 414         return 0;
 415 }