src/core/mount-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <sys/mount.h>
  23 #include <errno.h>
  24 #include <sys/stat.h>
  25 #include <stdlib.h>
  26 #include <string.h>
  27 #include <libgen.h>
  28 #include <assert.h>
  29 #include <unistd.h>
  30 #include <ftw.h>
  31
  32 #include "mount-setup.h"
  33 #include "dev-setup.h"
  34 #include "log.h"
  35 #include "macro.h"
  36 #include "util.h"
  37 #include "label.h"
  38 #include "set.h"
  39 #include "strv.h"
  40 #include "mkdir.h"
  41 #include "path-util.h"
  42 #include "missing.h"
  43 #include "virt.h"
  44 #include "efivars.h"
  45 #include "smack-util.h"
  46 #include "def.h"
  47
  48 typedef enum MountMode {
  49         MNT_NONE  =        0,
  50         MNT_FATAL =        1 <<  0,
  51         MNT_IN_CONTAINER = 1 <<  1,
  52 } MountMode;
  53
  54 typedef struct MountPoint {
  55         const char *what;
  56         const char *where;
  57         const char *type;
  58         const char *options;
  59         unsigned long flags;
  60         bool (*condition_fn)(void);
  61         MountMode mode;
  62 } MountPoint;
  63
  64 /* The first three entries we might need before SELinux is up. The
  65  * fourth (securityfs) is needed by IMA to load a custom policy. The
  66  * other ones we can delay until SELinux and IMA are loaded. */
  67 #define N_EARLY_MOUNT 5
  68
  69 static const MountPoint mount_table[] = {
  70         { "proc",       "/proc",                     "proc",       NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  71           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  72         { "sysfs",      "/sys",                      "sysfs",      NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  73           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  74         { "devtmpfs",   "/dev",                      "devtmpfs",   "mode=755", MS_NOSUID|MS_STRICTATIME,
  75           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  76         { "securityfs", "/sys/kernel/security",      "securityfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  77           NULL,       MNT_NONE },
  78 #ifdef HAVE_SMACK
  79         { "smackfs",    "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
  80           use_smack,  MNT_FATAL },
  81         { "tmpfs",      "/dev/shm",                  "tmpfs",      "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  82           use_smack,  MNT_FATAL },
  83 #endif
  84         { "tmpfs",      "/dev/shm",                  "tmpfs",      "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  85           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  86         { "devpts",     "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
  87           NULL,       MNT_IN_CONTAINER },
  88 #ifdef HAVE_SMACK
  89         { "tmpfs",      "/run",                      "tmpfs",      "mode=755,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  90           use_smack,  MNT_FATAL },
  91 #endif
  92         { "tmpfs",      "/run",                      "tmpfs",      "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  93           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  94         { "tmpfs",      "/sys/fs/cgroup",            "tmpfs",      "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
  95           NULL,       MNT_IN_CONTAINER },
  96 #ifdef HAVE_XATTR
  97         { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd,xattr", MS_NOSUID|MS_NOEXEC|MS_NODEV,
  98           NULL,       MNT_IN_CONTAINER },
  99 #endif
 100         { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV,
 101           NULL,       MNT_IN_CONTAINER },
 102         { "pstore",     "/sys/fs/pstore",            "pstore",     NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
 103           NULL,       MNT_NONE },
 104 #ifdef ENABLE_EFI
 105         { "efivarfs",   "/sys/firmware/efi/efivars", "efivarfs",   NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
 106           is_efi_boot, MNT_NONE },
 107 #endif
 108 };
 109
 110 /* These are API file systems that might be mounted by other software,
 111  * we just list them here so that we know that we should ignore them */
 112
 113 static const char ignore_paths[] =
 114         /* SELinux file systems */
 115         "/sys/fs/selinux\0"
 116         "/selinux\0"
 117         /* Legacy cgroup mount points */
 118         "/dev/cgroup\0"
 119         "/cgroup\0"
 120         /* Legacy kernel file system */
 121         "/proc/bus/usb\0"
 122         /* Container bind mounts */
 123         "/proc/sys\0"
 124         "/dev/console\0"
 125         "/proc/kmsg\0";
 126
 127 bool mount_point_is_api(const char *path) {
 128         unsigned i;
 129
 130         /* Checks if this mount point is considered "API", and hence
 131          * should be ignored */
 132
 133         for (i = 0; i < ELEMENTSOF(mount_table); i ++)
 134                 if (path_equal(path, mount_table[i].where))
 135                         return true;
 136
 137         return path_startswith(path, "/sys/fs/cgroup/");
 138 }
 139
 140 bool mount_point_ignore(const char *path) {
 141         const char *i;
 142
 143         NULSTR_FOREACH(i, ignore_paths)
 144                 if (path_equal(path, i))
 145                         return true;
 146
 147         return false;
 148 }
 149
 150 static int mount_one(const MountPoint *p, bool relabel) {
 151         int r;
 152
 153         assert(p);
 154
 155         if (p->condition_fn && !p->condition_fn())
 156                 return 0;
 157
 158         /* Relabel first, just in case */
 159         if (relabel)
 160                 label_fix(p->where, true, true);
 161
 162         r = path_is_mount_point(p->where, true);
 163         if (r < 0)
 164                 return r;
 165
 166         if (r > 0)
 167                 return 0;
 168
 169         /* Skip securityfs in a container */
 170         if (!(p->mode & MNT_IN_CONTAINER) && detect_container(NULL) > 0)
 171                 return 0;
 172
 173         /* The access mode here doesn't really matter too much, since
 174          * the mounted file system will take precedence anyway. */
 175         mkdir_p_label(p->where, 0755);
 176
 177         log_debug("Mounting %s to %s of type %s with options %s.",
 178                   p->what,
 179                   p->where,
 180                   p->type,
 181                   strna(p->options));
 182
 183         if (mount(p->what,
 184                   p->where,
 185                   p->type,
 186                   p->flags,
 187                   p->options) < 0) {
 188                 log_full((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, "Failed to mount %s: %m", p->where);
 189                 return (p->mode & MNT_FATAL) ? -errno : 0;
 190         }
 191
 192         /* Relabel again, since we now mounted something fresh here */
 193         if (relabel)
 194                 label_fix(p->where, false, false);
 195
 196         return 1;
 197 }
 198
 199 int mount_setup_early(void) {
 200         unsigned i;
 201         int r = 0;
 202
 203         assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table));
 204
 205         /* Do a minimal mount of /proc and friends to enable the most
 206          * basic stuff, such as SELinux */
 207         for (i = 0; i < N_EARLY_MOUNT; i ++)  {
 208                 int j;
 209
 210                 j = mount_one(mount_table + i, false);
 211                 if (r == 0)
 212                         r = j;
 213         }
 214
 215         return r;
 216 }
 217
 218 int mount_cgroup_controllers(char ***join_controllers) {
 219         int r;
 220         char buf[LINE_MAX];
 221         _cleanup_set_free_free_ Set *controllers = NULL;
 222         _cleanup_fclose_ FILE *f;
 223
 224         /* Mount all available cgroup controllers that are built into the kernel. */
 225
 226         f = fopen("/proc/cgroups", "re");
 227         if (!f) {
 228                 log_error("Failed to enumerate cgroup controllers: %m");
 229                 return 0;
 230         }
 231
 232         controllers = set_new(string_hash_func, string_compare_func);
 233         if (!controllers)
 234                 return log_oom();
 235
 236         /* Ignore the header line */
 237         (void) fgets(buf, sizeof(buf), f);
 238
 239         for (;;) {
 240                 char *controller;
 241                 int enabled = 0;
 242
 243                 if (fscanf(f, "%ms %*i %*i %i", &controller, &enabled) != 2) {
 244
 245                         if (feof(f))
 246                                 break;
 247
 248                         log_error("Failed to parse /proc/cgroups.");
 249                         return -EIO;
 250                 }
 251
 252                 if (!enabled) {
 253                         free(controller);
 254                         continue;
 255                 }
 256
 257                 r = set_consume(controllers, controller);
 258                 if (r < 0) {
 259                         log_error("Failed to add controller to set.");
 260                         return r;
 261                 }
 262         }
 263
 264         for (;;) {
 265                 MountPoint p = {
 266                         .what = "cgroup",
 267                         .type = "cgroup",
 268                         .flags = MS_NOSUID|MS_NOEXEC|MS_NODEV,
 269                         .mode = MNT_IN_CONTAINER,
 270                 };
 271                 char ***k = NULL;
 272                 _cleanup_free_ char *options = NULL, *controller;
 273
 274                 controller = set_steal_first(controllers);
 275                 if (!controller)
 276                         break;
 277
 278                 if (join_controllers)
 279                         for (k = join_controllers; *k; k++)
 280                                 if (strv_find(*k, controller))
 281                                         break;
 282
 283                 if (k && *k) {
 284                         char **i, **j;
 285
 286                         for (i = *k, j = *k; *i; i++) {
 287
 288                                 if (!streq(*i, controller)) {
 289                                         char _cleanup_free_ *t;
 290
 291                                         t = set_remove(controllers, *i);
 292                                         if (!t) {
 293                                                 free(*i);
 294                                                 continue;
 295                                         }
 296                                 }
 297
 298                                 *(j++) = *i;
 299                         }
 300
 301                         *j = NULL;
 302
 303                         options = strv_join(*k, ",");
 304                         if (!options)
 305                                 return log_oom();
 306                 } else {
 307                         options = controller;
 308                         controller = NULL;
 309                 }
 310
 311                 p.where = strappenda("/sys/fs/cgroup/", options);
 312                 p.options = options;
 313
 314                 r = mount_one(&p, true);
 315                 if (r < 0)
 316                         return r;
 317
 318                 if (r > 0 && k && *k) {
 319                         char **i;
 320
 321                         for (i = *k; *i; i++) {
 322                                 char *t = strappenda("/sys/fs/cgroup/", *i);
 323
 324                                 r = symlink(options, t);
 325                                 if (r < 0 && errno != EEXIST) {
 326                                         log_error("Failed to create symlink %s: %m", t);
 327                                         return -errno;
 328                                 }
 329                         }
 330                 }
 331         }
 332
 333         return 0;
 334 }
 335
 336 static int nftw_cb(
 337                 const char *fpath,
 338                 const struct stat *sb,
 339                 int tflag,
 340                 struct FTW *ftwbuf) {
 341
 342         /* No need to label /dev twice in a row... */
 343         if (_unlikely_(ftwbuf->level == 0))
 344                 return FTW_CONTINUE;
 345
 346         label_fix(fpath, false, false);
 347
 348         /* /run/initramfs is static data and big, no need to
 349          * dynamically relabel its contents at boot... */
 350         if (_unlikely_(ftwbuf->level == 1 &&
 351                       tflag == FTW_D &&
 352                       streq(fpath, "/run/initramfs")))
 353                 return FTW_SKIP_SUBTREE;
 354
 355         return FTW_CONTINUE;
 356 };
 357
 358 int mount_setup(bool loaded_policy) {
 359         int r;
 360         unsigned i;
 361
 362         for (i = 0; i < ELEMENTSOF(mount_table); i ++) {
 363                 r = mount_one(mount_table + i, true);
 364
 365                 if (r < 0)
 366                         return r;
 367         }
 368
 369         /* Nodes in devtmpfs and /run need to be manually updated for
 370          * the appropriate labels, after mounting. The other virtual
 371          * API file systems like /sys and /proc do not need that, they
 372          * use the same label for all their files. */
 373         if (loaded_policy) {
 374                 usec_t before_relabel, after_relabel;
 375                 char timespan[FORMAT_TIMESPAN_MAX];
 376
 377                 before_relabel = now(CLOCK_MONOTONIC);
 378
 379                 nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 380                 nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 381
 382                 after_relabel = now(CLOCK_MONOTONIC);
 383
 384                 log_info("Relabelled /dev and /run in %s.",
 385                          format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));
 386         }
 387
 388         /* Create a few default symlinks, which are normally created
 389          * by udevd, but some scripts might need them before we start
 390          * udevd. */
 391         dev_setup(NULL);
 392
 393         /* Mark the root directory as shared in regards to mount
 394          * propagation. The kernel defaults to "private", but we think
 395          * it makes more sense to have a default of "shared" so that
 396          * nspawn and the container tools work out of the box. If
 397          * specific setups need other settings they can reset the
 398          * propagation mode to private if needed. */
 399         if (detect_container(NULL) <= 0)
 400                 if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)
 401                         log_warning("Failed to set up the root directory for shared mount propagation: %m");
 402
 403         /* Create a few directories we always want around, Note that
 404          * sd_booted() checks for /run/systemd/system, so this mkdir
 405          * really needs to stay for good, otherwise software that
 406          * copied sd-daemon.c into their sources will misdetect
 407          * systemd. */
 408         mkdir_label("/run/systemd", 0755);
 409         mkdir_label("/run/systemd/system", 0755);
 410         mkdir_label("/run/systemd/inaccessible", 0000);
 411
 412         return 0;
 413 }