src/core/mount-setup.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <sys/mount.h>
  23 #include <errno.h>
  24 #include <sys/stat.h>
  25 #include <stdlib.h>
  26 #include <string.h>
  27 #include <libgen.h>
  28 #include <assert.h>
  29 #include <unistd.h>
  30 #include <ftw.h>
  31
  32 #include "mount-setup.h"
  33 #include "dev-setup.h"
  34 #include "log.h"
  35 #include "macro.h"
  36 #include "util.h"
  37 #include "label.h"
  38 #include "set.h"
  39 #include "strv.h"
  40 #include "mkdir.h"
  41 #include "path-util.h"
  42 #include "missing.h"
  43 #include "virt.h"
  44 #include "efivars.h"
  45 #include "smack-util.h"
  46 #include "def.h"
  47
  48 typedef enum MountMode {
  49         MNT_NONE  =        0,
  50         MNT_FATAL =        1 <<  0,
  51         MNT_IN_CONTAINER = 1 <<  1,
  52 } MountMode;
  53
  54 typedef struct MountPoint {
  55         const char *what;
  56         const char *where;
  57         const char *type;
  58         const char *options;
  59         unsigned long flags;
  60         bool (*condition_fn)(void);
  61         MountMode mode;
  62 } MountPoint;
  63
  64 /* The first three entries we might need before SELinux is up. The
  65  * fourth (securityfs) is needed by IMA to load a custom policy. The
  66  * other ones we can delay until SELinux and IMA are loaded. */
  67 #define N_EARLY_MOUNT 5
  68
  69 static const MountPoint mount_table[] = {
  70         { "proc",       "/proc",                     "proc",       NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  71           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  72         { "sysfs",      "/sys",                      "sysfs",      NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  73           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  74         { "devtmpfs",   "/dev",                      "devtmpfs",   "mode=755", MS_NOSUID|MS_STRICTATIME,
  75           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  76         { "securityfs", "/sys/kernel/security",      "securityfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
  77           NULL,       MNT_NONE },
  78 #ifdef HAVE_SMACK
  79         { "smackfs",    "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
  80           use_smack,  MNT_FATAL },
  81         { "tmpfs",      "/dev/shm",                  "tmpfs",      "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  82           use_smack,  MNT_FATAL },
  83 #endif
  84         { "tmpfs",      "/dev/shm",                  "tmpfs",      "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  85           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  86         { "devpts",     "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
  87           NULL,       MNT_IN_CONTAINER },
  88 #ifdef HAVE_SMACK
  89         { "tmpfs",      "/run",                      "tmpfs",      "mode=755,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  90           use_smack,  MNT_FATAL },
  91 #endif
  92         { "tmpfs",      "/run",                      "tmpfs",      "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
  93           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  94         { "tmpfs",      "/sys/fs/cgroup",            "tmpfs",      "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
  95           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  96 #ifdef HAVE_XATTR
  97         { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd,xattr", MS_NOSUID|MS_NOEXEC|MS_NODEV,
  98           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
  99 #endif
 100         { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV,
 101           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
 102         { "pstore",     "/sys/fs/pstore",            "pstore",     NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
 103           NULL,       MNT_NONE },
 104 #ifdef ENABLE_EFI
 105         { "efivarfs",   "/sys/firmware/efi/efivars", "efivarfs",   NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
 106           is_efi_boot, MNT_NONE },
 107 #endif
 108 };
 109
 110 /* These are API file systems that might be mounted by other software,
 111  * we just list them here so that we know that we should ignore them */
 112
 113 static const char ignore_paths[] =
 114         /* SELinux file systems */
 115         "/sys/fs/selinux\0"
 116         "/selinux\0"
 117         /* Legacy cgroup mount points */
 118         "/dev/cgroup\0"
 119         "/cgroup\0"
 120         /* Legacy kernel file system */
 121         "/proc/bus/usb\0"
 122         /* Container bind mounts */
 123         "/proc/sys\0"
 124         "/dev/console\0"
 125         "/proc/kmsg\0";
 126
 127 bool mount_point_is_api(const char *path) {
 128         unsigned i;
 129
 130         /* Checks if this mount point is considered "API", and hence
 131          * should be ignored */
 132
 133         for (i = 0; i < ELEMENTSOF(mount_table); i ++)
 134                 if (path_equal(path, mount_table[i].where))
 135                         return true;
 136
 137         return path_startswith(path, "/sys/fs/cgroup/");
 138 }
 139
 140 bool mount_point_ignore(const char *path) {
 141         const char *i;
 142
 143         NULSTR_FOREACH(i, ignore_paths)
 144                 if (path_equal(path, i))
 145                         return true;
 146
 147         return false;
 148 }
 149
 150 static int mount_one(const MountPoint *p, bool relabel) {
 151         int r;
 152
 153         assert(p);
 154
 155         if (p->condition_fn && !p->condition_fn())
 156                 return 0;
 157
 158         /* Relabel first, just in case */
 159         if (relabel)
 160                 label_fix(p->where, true, true);
 161
 162         r = path_is_mount_point(p->where, true);
 163         if (r < 0)
 164                 return r;
 165
 166         if (r > 0)
 167                 return 0;
 168
 169         /* Skip securityfs in a container */
 170         if (!(p->mode & MNT_IN_CONTAINER) && detect_container(NULL) > 0)
 171                 return 0;
 172
 173         /* The access mode here doesn't really matter too much, since
 174          * the mounted file system will take precedence anyway. */
 175         if (relabel)
 176                 mkdir_p_label(p->where, 0755);
 177         else
 178                 mkdir_p(p->where, 0755);
 179
 180         log_debug("Mounting %s to %s of type %s with options %s.",
 181                   p->what,
 182                   p->where,
 183                   p->type,
 184                   strna(p->options));
 185
 186         if (mount(p->what,
 187                   p->where,
 188                   p->type,
 189                   p->flags,
 190                   p->options) < 0) {
 191                 log_full((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, "Failed to mount %s at %s: %m", p->type, p->where);
 192                 return (p->mode & MNT_FATAL) ? -errno : 0;
 193         }
 194
 195         /* Relabel again, since we now mounted something fresh here */
 196         if (relabel)
 197                 label_fix(p->where, false, false);
 198
 199         return 1;
 200 }
 201
 202 int mount_setup_early(void) {
 203         unsigned i;
 204         int r = 0;
 205
 206         assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table));
 207
 208         /* Do a minimal mount of /proc and friends to enable the most
 209          * basic stuff, such as SELinux */
 210         for (i = 0; i < N_EARLY_MOUNT; i ++)  {
 211                 int j;
 212
 213                 j = mount_one(mount_table + i, false);
 214                 if (r == 0)
 215                         r = j;
 216         }
 217
 218         return r;
 219 }
 220
 221 int mount_cgroup_controllers(char ***join_controllers) {
 222         _cleanup_set_free_free_ Set *controllers = NULL;
 223         _cleanup_fclose_ FILE *f;
 224         char buf[LINE_MAX];
 225         int r;
 226
 227         /* Mount all available cgroup controllers that are built into the kernel. */
 228
 229         f = fopen("/proc/cgroups", "re");
 230         if (!f) {
 231                 log_error("Failed to enumerate cgroup controllers: %m");
 232                 return 0;
 233         }
 234
 235         controllers = set_new(string_hash_func, string_compare_func);
 236         if (!controllers)
 237                 return log_oom();
 238
 239         /* Ignore the header line */
 240         (void) fgets(buf, sizeof(buf), f);
 241
 242         for (;;) {
 243                 char *controller;
 244                 int enabled = 0;
 245
 246                 if (fscanf(f, "%ms %*i %*i %i", &controller, &enabled) != 2) {
 247
 248                         if (feof(f))
 249                                 break;
 250
 251                         log_error("Failed to parse /proc/cgroups.");
 252                         return -EIO;
 253                 }
 254
 255                 if (!enabled) {
 256                         free(controller);
 257                         continue;
 258                 }
 259
 260                 r = set_consume(controllers, controller);
 261                 if (r < 0) {
 262                         log_error("Failed to add controller to set.");
 263                         return r;
 264                 }
 265         }
 266
 267         for (;;) {
 268                 _cleanup_free_ char *options = NULL, *controller = NULL, *where = NULL;
 269                 MountPoint p = {
 270                         .what = "cgroup",
 271                         .type = "cgroup",
 272                         .flags = MS_NOSUID|MS_NOEXEC|MS_NODEV,
 273                         .mode = MNT_IN_CONTAINER,
 274                 };
 275                 char ***k = NULL;
 276
 277                 controller = set_steal_first(controllers);
 278                 if (!controller)
 279                         break;
 280
 281                 if (join_controllers)
 282                         for (k = join_controllers; *k; k++)
 283                                 if (strv_find(*k, controller))
 284                                         break;
 285
 286                 if (k && *k) {
 287                         char **i, **j;
 288
 289                         for (i = *k, j = *k; *i; i++) {
 290
 291                                 if (!streq(*i, controller)) {
 292                                         _cleanup_free_ char *t;
 293
 294                                         t = set_remove(controllers, *i);
 295                                         if (!t) {
 296                                                 free(*i);
 297                                                 continue;
 298                                         }
 299                                 }
 300
 301                                 *(j++) = *i;
 302                         }
 303
 304                         *j = NULL;
 305
 306                         options = strv_join(*k, ",");
 307                         if (!options)
 308                                 return log_oom();
 309                 } else {
 310                         options = controller;
 311                         controller = NULL;
 312                 }
 313
 314                 where = strappend("/sys/fs/cgroup/", options);
 315                 if (!where)
 316                         return log_oom();
 317
 318                 p.where = where;
 319                 p.options = options;
 320
 321                 r = mount_one(&p, true);
 322                 if (r < 0)
 323                         return r;
 324
 325                 if (r > 0 && k && *k) {
 326                         char **i;
 327
 328                         for (i = *k; *i; i++) {
 329                                 _cleanup_free_ char *t = NULL;
 330
 331                                 t = strappend("/sys/fs/cgroup/", *i);
 332                                 if (!t)
 333                                         return log_oom();
 334
 335                                 r = symlink(options, t);
 336                                 if (r < 0 && errno != EEXIST) {
 337                                         log_error("Failed to create symlink %s: %m", t);
 338                                         return -errno;
 339                                 }
 340                         }
 341                 }
 342         }
 343
 344         /* Now that we mounted everything, let's make the tmpfs the
 345          * cgroup file systems are mounted into read-only. */
 346         mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755");
 347
 348         return 0;
 349 }
 350
 351 static int nftw_cb(
 352                 const char *fpath,
 353                 const struct stat *sb,
 354                 int tflag,
 355                 struct FTW *ftwbuf) {
 356
 357         /* No need to label /dev twice in a row... */
 358         if (_unlikely_(ftwbuf->level == 0))
 359                 return FTW_CONTINUE;
 360
 361         label_fix(fpath, false, false);
 362
 363         /* /run/initramfs is static data and big, no need to
 364          * dynamically relabel its contents at boot... */
 365         if (_unlikely_(ftwbuf->level == 1 &&
 366                       tflag == FTW_D &&
 367                       streq(fpath, "/run/initramfs")))
 368                 return FTW_SKIP_SUBTREE;
 369
 370         return FTW_CONTINUE;
 371 };
 372
 373 int mount_setup(bool loaded_policy) {
 374         int r;
 375         unsigned i;
 376
 377         for (i = 0; i < ELEMENTSOF(mount_table); i ++) {
 378                 r = mount_one(mount_table + i, true);
 379
 380                 if (r < 0)
 381                         return r;
 382         }
 383
 384         /* Nodes in devtmpfs and /run need to be manually updated for
 385          * the appropriate labels, after mounting. The other virtual
 386          * API file systems like /sys and /proc do not need that, they
 387          * use the same label for all their files. */
 388         if (loaded_policy) {
 389                 usec_t before_relabel, after_relabel;
 390                 char timespan[FORMAT_TIMESPAN_MAX];
 391
 392                 before_relabel = now(CLOCK_MONOTONIC);
 393
 394                 nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 395                 nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 396
 397                 after_relabel = now(CLOCK_MONOTONIC);
 398
 399                 log_info("Relabelled /dev and /run in %s.",
 400                          format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));
 401         }
 402
 403         /* Create a few default symlinks, which are normally created
 404          * by udevd, but some scripts might need them before we start
 405          * udevd. */
 406         dev_setup(NULL);
 407
 408         /* Mark the root directory as shared in regards to mount
 409          * propagation. The kernel defaults to "private", but we think
 410          * it makes more sense to have a default of "shared" so that
 411          * nspawn and the container tools work out of the box. If
 412          * specific setups need other settings they can reset the
 413          * propagation mode to private if needed. */
 414         if (detect_container(NULL) <= 0)
 415                 if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)
 416                         log_warning("Failed to set up the root directory for shared mount propagation: %m");
 417
 418         /* Create a few directories we always want around, Note that
 419          * sd_booted() checks for /run/systemd/system, so this mkdir
 420          * really needs to stay for good, otherwise software that
 421          * copied sd-daemon.c into their sources will misdetect
 422          * systemd. */
 423         mkdir_label("/run/systemd", 0755);
 424         mkdir_label("/run/systemd/system", 0755);
 425         mkdir_label("/run/systemd/inaccessible", 0000);
 426
 427         return 0;
 428 }