src/core/namespace.h

   1 #pragma once
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7   Copyright 2016 Djalal Harouni
   8
   9   systemd is free software; you can redistribute it and/or modify it
  10   under the terms of the GNU Lesser General Public License as published by
  11   the Free Software Foundation; either version 2.1 of the License, or
  12   (at your option) any later version.
  13
  14   systemd is distributed in the hope that it will be useful, but
  15   WITHOUT ANY WARRANTY; without even the implied warranty of
  16   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  17   Lesser General Public License for more details.
  18
  19   You should have received a copy of the GNU Lesser General Public License
  20   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  21 ***/
  22
  23 typedef struct NameSpaceInfo NameSpaceInfo;
  24 typedef struct BindMount BindMount;
  25
  26 #include <stdbool.h>
  27
  28 #include "dissect-image.h"
  29 #include "macro.h"
  30
  31 typedef enum ProtectHome {
  32         PROTECT_HOME_NO,
  33         PROTECT_HOME_YES,
  34         PROTECT_HOME_READ_ONLY,
  35         _PROTECT_HOME_MAX,
  36         _PROTECT_HOME_INVALID = -1
  37 } ProtectHome;
  38
  39 typedef enum ProtectSystem {
  40         PROTECT_SYSTEM_NO,
  41         PROTECT_SYSTEM_YES,
  42         PROTECT_SYSTEM_FULL,
  43         PROTECT_SYSTEM_STRICT,
  44         _PROTECT_SYSTEM_MAX,
  45         _PROTECT_SYSTEM_INVALID = -1
  46 } ProtectSystem;
  47
  48 struct NameSpaceInfo {
  49         bool ignore_protect_paths:1;
  50         bool private_dev:1;
  51         bool protect_control_groups:1;
  52         bool protect_kernel_tunables:1;
  53         bool protect_kernel_modules:1;
  54         bool mount_apivfs:1;
  55 };
  56
  57 struct BindMount {
  58         char *source;
  59         char *destination;
  60         bool read_only:1;
  61         bool recursive:1;
  62         bool ignore_enoent:1;
  63 };
  64
  65 int setup_namespace(
  66                 const char *root_directory,
  67                 const char *root_image,
  68                 const NameSpaceInfo *ns_info,
  69                 char **read_write_paths,
  70                 char **read_only_paths,
  71                 char **inaccessible_paths,
  72                 const BindMount *bind_mounts,
  73                 unsigned n_bind_mounts,
  74                 const char *tmp_dir,
  75                 const char *var_tmp_dir,
  76                 ProtectHome protect_home,
  77                 ProtectSystem protect_system,
  78                 unsigned long mount_flags,
  79                 DissectImageFlags dissected_image_flags);
  80
  81 int setup_tmp_dirs(
  82                 const char *id,
  83                 char **tmp_dir,
  84                 char **var_tmp_dir);
  85
  86 int setup_netns(int netns_storage_socket[2]);
  87
  88 const char* protect_home_to_string(ProtectHome p) _const_;
  89 ProtectHome protect_home_from_string(const char *s) _pure_;
  90
  91 const char* protect_system_to_string(ProtectSystem p) _const_;
  92 ProtectSystem protect_system_from_string(const char *s) _pure_;
  93
  94 void bind_mount_free_many(BindMount *b, unsigned n);
  95 int bind_mount_add(BindMount **b, unsigned *n, const BindMount *item);