src/core/namespace.h

   1 #pragma once
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7   Copyright 2016 Djalal Harouni
   8
   9   systemd is free software; you can redistribute it and/or modify it
  10   under the terms of the GNU Lesser General Public License as published by
  11   the Free Software Foundation; either version 2.1 of the License, or
  12   (at your option) any later version.
  13
  14   systemd is distributed in the hope that it will be useful, but
  15   WITHOUT ANY WARRANTY; without even the implied warranty of
  16   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  17   Lesser General Public License for more details.
  18
  19   You should have received a copy of the GNU Lesser General Public License
  20   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  21 ***/
  22
  23 typedef struct NamespaceInfo NamespaceInfo;
  24 typedef struct BindMount BindMount;
  25
  26 #include <stdbool.h>
  27
  28 #include "dissect-image.h"
  29 #include "macro.h"
  30
  31 typedef enum ProtectHome {
  32         PROTECT_HOME_NO,
  33         PROTECT_HOME_YES,
  34         PROTECT_HOME_READ_ONLY,
  35         _PROTECT_HOME_MAX,
  36         _PROTECT_HOME_INVALID = -1
  37 } ProtectHome;
  38
  39 typedef enum NamespaceType {
  40         NAMESPACE_MOUNT,
  41         NAMESPACE_CGROUP,
  42         NAMESPACE_UTS,
  43         NAMESPACE_IPC,
  44         NAMESPACE_USER,
  45         NAMESPACE_PID,
  46         NAMESPACE_NET,
  47         _NAMESPACE_TYPE_MAX,
  48         _NAMESPACE_TYPE_INVALID = -1,
  49 } NamespaceType;
  50
  51 typedef enum ProtectSystem {
  52         PROTECT_SYSTEM_NO,
  53         PROTECT_SYSTEM_YES,
  54         PROTECT_SYSTEM_FULL,
  55         PROTECT_SYSTEM_STRICT,
  56         _PROTECT_SYSTEM_MAX,
  57         _PROTECT_SYSTEM_INVALID = -1
  58 } ProtectSystem;
  59
  60 struct NamespaceInfo {
  61         bool ignore_protect_paths:1;
  62         bool private_dev:1;
  63         bool protect_control_groups:1;
  64         bool protect_kernel_tunables:1;
  65         bool protect_kernel_modules:1;
  66         bool mount_apivfs:1;
  67 };
  68
  69 struct BindMount {
  70         char *source;
  71         char *destination;
  72         bool read_only:1;
  73         bool recursive:1;
  74         bool ignore_enoent:1;
  75 };
  76
  77 int setup_namespace(
  78                 const char *root_directory,
  79                 const char *root_image,
  80                 const NamespaceInfo *ns_info,
  81                 char **read_write_paths,
  82                 char **read_only_paths,
  83                 char **inaccessible_paths,
  84                 char **empty_directories,
  85                 const BindMount *bind_mounts,
  86                 unsigned n_bind_mounts,
  87                 const char *tmp_dir,
  88                 const char *var_tmp_dir,
  89                 ProtectHome protect_home,
  90                 ProtectSystem protect_system,
  91                 unsigned long mount_flags,
  92                 DissectImageFlags dissected_image_flags);
  93
  94 int setup_tmp_dirs(
  95                 const char *id,
  96                 char **tmp_dir,
  97                 char **var_tmp_dir);
  98
  99 int setup_netns(int netns_storage_socket[2]);
 100
 101 const char* protect_home_to_string(ProtectHome p) _const_;
 102 ProtectHome protect_home_from_string(const char *s) _pure_;
 103
 104 const char* protect_system_to_string(ProtectSystem p) _const_;
 105 ProtectSystem protect_system_from_string(const char *s) _pure_;
 106
 107 void bind_mount_free_many(BindMount *b, unsigned n);
 108 int bind_mount_add(BindMount **b, unsigned *n, const BindMount *item);
 109
 110 const char* namespace_type_to_string(NamespaceType t) _const_;
 111 NamespaceType namespace_type_from_string(const char *s) _pure_;
 112
 113 bool ns_type_supported(NamespaceType type);