src/import/import-common.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2015 Lennart Poettering
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include <sched.h>
  22 #include <sys/prctl.h>
  23 #include <sys/stat.h>
  24 #include <unistd.h>
  25
  26 #include "btrfs-util.h"
  27 #include "capability-util.h"
  28 #include "fd-util.h"
  29 #include "import-common.h"
  30 #include "process-util.h"
  31 #include "signal-util.h"
  32 #include "util.h"
  33
  34 int import_make_read_only_fd(int fd) {
  35         int r;
  36
  37         assert(fd >= 0);
  38
  39         /* First, let's make this a read-only subvolume if it refers
  40          * to a subvolume */
  41         r = btrfs_subvol_set_read_only_fd(fd, true);
  42         if (IN_SET(r, -ENOTTY, -ENOTDIR, -EINVAL)) {
  43                 struct stat st;
  44
  45                 /* This doesn't refer to a subvolume, or the file
  46                  * system isn't even btrfs. In that, case fall back to
  47                  * chmod()ing */
  48
  49                 r = fstat(fd, &st);
  50                 if (r < 0)
  51                         return log_error_errno(errno, "Failed to stat temporary image: %m");
  52
  53                 /* Drop "w" flag */
  54                 if (fchmod(fd, st.st_mode & 07555) < 0)
  55                         return log_error_errno(errno, "Failed to chmod() final image: %m");
  56
  57                 return 0;
  58
  59         } else if (r < 0)
  60                 return log_error_errno(r, "Failed to make subvolume read-only: %m");
  61
  62         return 0;
  63 }
  64
  65 int import_make_read_only(const char *path) {
  66         _cleanup_close_ int fd = 1;
  67
  68         fd = open(path, O_RDONLY|O_NOCTTY|O_CLOEXEC);
  69         if (fd < 0)
  70                 return log_error_errno(errno, "Failed to open %s: %m", path);
  71
  72         return import_make_read_only_fd(fd);
  73 }
  74
  75 int import_fork_tar_x(const char *path, pid_t *ret) {
  76         _cleanup_close_pair_ int pipefd[2] = { -1, -1 };
  77         pid_t pid;
  78         int r;
  79
  80         assert(path);
  81         assert(ret);
  82
  83         if (pipe2(pipefd, O_CLOEXEC) < 0)
  84                 return log_error_errno(errno, "Failed to create pipe for tar: %m");
  85
  86         r = safe_fork("(tar)", FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_LOG, &pid);
  87         if (r < 0)
  88                 return r;
  89         if (r == 0) {
  90                 uint64_t retain =
  91                         (1ULL << CAP_CHOWN) |
  92                         (1ULL << CAP_FOWNER) |
  93                         (1ULL << CAP_FSETID) |
  94                         (1ULL << CAP_MKNOD) |
  95                         (1ULL << CAP_SETFCAP) |
  96                         (1ULL << CAP_DAC_OVERRIDE);
  97
  98                 /* Child */
  99
 100                 pipefd[1] = safe_close(pipefd[1]);
 101
 102                 r = rearrange_stdio(pipefd[0], -1, STDERR_FILENO);
 103                 if (r < 0) {
 104                         log_error_errno(r, "Failed to rearrange stdin/stdout: %m");
 105                         _exit(EXIT_FAILURE);
 106                 }
 107
 108                 if (unshare(CLONE_NEWNET) < 0)
 109                         log_error_errno(errno, "Failed to lock tar into network namespace, ignoring: %m");
 110
 111                 r = capability_bounding_set_drop(retain, true);
 112                 if (r < 0)
 113                         log_error_errno(r, "Failed to drop capabilities, ignoring: %m");
 114
 115                 execlp("tar", "tar", "--numeric-owner", "-C", path, "-px", "--xattrs", "--xattrs-include=*", NULL);
 116                 log_error_errno(errno, "Failed to execute tar: %m");
 117                 _exit(EXIT_FAILURE);
 118         }
 119
 120         pipefd[0] = safe_close(pipefd[0]);
 121         r = pipefd[1];
 122         pipefd[1] = -1;
 123
 124         *ret = pid;
 125
 126         return r;
 127 }
 128
 129 int import_fork_tar_c(const char *path, pid_t *ret) {
 130         _cleanup_close_pair_ int pipefd[2] = { -1, -1 };
 131         pid_t pid;
 132         int r;
 133
 134         assert(path);
 135         assert(ret);
 136
 137         if (pipe2(pipefd, O_CLOEXEC) < 0)
 138                 return log_error_errno(errno, "Failed to create pipe for tar: %m");
 139
 140         r = safe_fork("(tar)", FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_LOG, &pid);
 141         if (r < 0)
 142                 return r;
 143         if (r == 0) {
 144                 uint64_t retain = (1ULL << CAP_DAC_OVERRIDE);
 145
 146                 /* Child */
 147
 148                 pipefd[0] = safe_close(pipefd[0]);
 149
 150                 r = rearrange_stdio(-1, pipefd[1], STDERR_FILENO);
 151                 if (r < 0) {
 152                         log_error_errno(r, "Failed to rearrange stdin/stdout: %m");
 153                         _exit(EXIT_FAILURE);
 154                 }
 155
 156                 if (unshare(CLONE_NEWNET) < 0)
 157                         log_error_errno(errno, "Failed to lock tar into network namespace, ignoring: %m");
 158
 159                 r = capability_bounding_set_drop(retain, true);
 160                 if (r < 0)
 161                         log_error_errno(r, "Failed to drop capabilities, ignoring: %m");
 162
 163                 execlp("tar", "tar", "-C", path, "-c", "--xattrs", "--xattrs-include=*", ".", NULL);
 164                 log_error_errno(errno, "Failed to execute tar: %m");
 165                 _exit(EXIT_FAILURE);
 166         }
 167
 168         pipefd[1] = safe_close(pipefd[1]);
 169         r = pipefd[0];
 170         pipefd[0] = -1;
 171
 172         *ret = pid;
 173
 174         return r;
 175 }