src/core/namespace.h

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 #pragma once
   3
   4 /***
   5   This file is part of systemd.
   6
   7   Copyright 2010 Lennart Poettering
   8   Copyright 2016 Djalal Harouni
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 ***/
  23
  24 typedef struct NamespaceInfo NamespaceInfo;
  25 typedef struct BindMount BindMount;
  26
  27 #include <stdbool.h>
  28
  29 #include "dissect-image.h"
  30 #include "macro.h"
  31
  32 typedef enum ProtectHome {
  33         PROTECT_HOME_NO,
  34         PROTECT_HOME_YES,
  35         PROTECT_HOME_READ_ONLY,
  36         _PROTECT_HOME_MAX,
  37         _PROTECT_HOME_INVALID = -1
  38 } ProtectHome;
  39
  40 typedef enum NamespaceType {
  41         NAMESPACE_MOUNT,
  42         NAMESPACE_CGROUP,
  43         NAMESPACE_UTS,
  44         NAMESPACE_IPC,
  45         NAMESPACE_USER,
  46         NAMESPACE_PID,
  47         NAMESPACE_NET,
  48         _NAMESPACE_TYPE_MAX,
  49         _NAMESPACE_TYPE_INVALID = -1,
  50 } NamespaceType;
  51
  52 typedef enum ProtectSystem {
  53         PROTECT_SYSTEM_NO,
  54         PROTECT_SYSTEM_YES,
  55         PROTECT_SYSTEM_FULL,
  56         PROTECT_SYSTEM_STRICT,
  57         _PROTECT_SYSTEM_MAX,
  58         _PROTECT_SYSTEM_INVALID = -1
  59 } ProtectSystem;
  60
  61 struct NamespaceInfo {
  62         bool ignore_protect_paths:1;
  63         bool private_dev:1;
  64         bool protect_control_groups:1;
  65         bool protect_kernel_tunables:1;
  66         bool protect_kernel_modules:1;
  67         bool mount_apivfs:1;
  68 };
  69
  70 struct BindMount {
  71         char *source;
  72         char *destination;
  73         bool read_only:1;
  74         bool recursive:1;
  75         bool ignore_enoent:1;
  76 };
  77
  78 int setup_namespace(
  79                 const char *root_directory,
  80                 const char *root_image,
  81                 const NamespaceInfo *ns_info,
  82                 char **read_write_paths,
  83                 char **read_only_paths,
  84                 char **inaccessible_paths,
  85                 char **empty_directories,
  86                 const BindMount *bind_mounts,
  87                 unsigned n_bind_mounts,
  88                 const char *tmp_dir,
  89                 const char *var_tmp_dir,
  90                 ProtectHome protect_home,
  91                 ProtectSystem protect_system,
  92                 unsigned long mount_flags,
  93                 DissectImageFlags dissected_image_flags);
  94
  95 int setup_tmp_dirs(
  96                 const char *id,
  97                 char **tmp_dir,
  98                 char **var_tmp_dir);
  99
 100 int setup_netns(int netns_storage_socket[2]);
 101
 102 const char* protect_home_to_string(ProtectHome p) _const_;
 103 ProtectHome protect_home_from_string(const char *s) _pure_;
 104
 105 const char* protect_system_to_string(ProtectSystem p) _const_;
 106 ProtectSystem protect_system_from_string(const char *s) _pure_;
 107
 108 void bind_mount_free_many(BindMount *b, unsigned n);
 109 int bind_mount_add(BindMount **b, unsigned *n, const BindMount *item);
 110
 111 const char* namespace_type_to_string(NamespaceType t) _const_;
 112 NamespaceType namespace_type_from_string(const char *s) _pure_;
 113
 114 bool ns_type_supported(NamespaceType type);