src/nspawn/nspawn-mount.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <sys/mount.h>
   4 #include <linux/magic.h>
   5
   6 #include "alloc-util.h"
   7 #include "escape.h"
   8 #include "fd-util.h"
   9 #include "format-util.h"
  10 #include "fs-util.h"
  11 #include "label.h"
  12 #include "mkdir.h"
  13 #include "mount-util.h"
  14 #include "mountpoint-util.h"
  15 #include "nspawn-mount.h"
  16 #include "parse-util.h"
  17 #include "path-util.h"
  18 #include "rm-rf.h"
  19 #include "set.h"
  20 #include "sort-util.h"
  21 #include "stat-util.h"
  22 #include "string-util.h"
  23 #include "strv.h"
  24 #include "tmpfile-util.h"
  25 #include "user-util.h"
  26
  27 CustomMount* custom_mount_add(CustomMount **l, size_t *n, CustomMountType t) {
  28         CustomMount *c, *ret;
  29
  30         assert(l);
  31         assert(n);
  32         assert(t >= 0);
  33         assert(t < _CUSTOM_MOUNT_TYPE_MAX);
  34
  35         c = reallocarray(*l, *n + 1, sizeof(CustomMount));
  36         if (!c)
  37                 return NULL;
  38
  39         *l = c;
  40         ret = *l + *n;
  41         (*n)++;
  42
  43         *ret = (CustomMount) { .type = t };
  44
  45         return ret;
  46 }
  47
  48 void custom_mount_free_all(CustomMount *l, size_t n) {
  49         size_t i;
  50
  51         for (i = 0; i < n; i++) {
  52                 CustomMount *m = l + i;
  53
  54                 free(m->source);
  55                 free(m->destination);
  56                 free(m->options);
  57
  58                 if (m->work_dir) {
  59                         (void) rm_rf(m->work_dir, REMOVE_ROOT|REMOVE_PHYSICAL);
  60                         free(m->work_dir);
  61                 }
  62
  63                 if (m->rm_rf_tmpdir) {
  64                         (void) rm_rf(m->rm_rf_tmpdir, REMOVE_ROOT|REMOVE_PHYSICAL);
  65                         free(m->rm_rf_tmpdir);
  66                 }
  67
  68                 strv_free(m->lower);
  69                 free(m->type_argument);
  70         }
  71
  72         free(l);
  73 }
  74
  75 static int custom_mount_compare(const CustomMount *a, const CustomMount *b) {
  76         int r;
  77
  78         r = path_compare(a->destination, b->destination);
  79         if (r != 0)
  80                 return r;
  81
  82         return CMP(a->type, b->type);
  83 }
  84
  85 static bool source_path_is_valid(const char *p) {
  86         assert(p);
  87
  88         if (*p == '+')
  89                 p++;
  90
  91         return path_is_absolute(p);
  92 }
  93
  94 static char *resolve_source_path(const char *dest, const char *source) {
  95
  96         if (!source)
  97                 return NULL;
  98
  99         if (source[0] == '+')
 100                 return path_join(dest, source + 1);
 101
 102         return strdup(source);
 103 }
 104
 105 static int allocate_temporary_source(CustomMount *m) {
 106         assert(m);
 107         assert(!m->source);
 108         assert(!m->rm_rf_tmpdir);
 109
 110         m->rm_rf_tmpdir = strdup("/var/tmp/nspawn-temp-XXXXXX");
 111         if (!m->rm_rf_tmpdir)
 112                 return log_oom();
 113
 114         if (!mkdtemp(m->rm_rf_tmpdir)) {
 115                 m->rm_rf_tmpdir = mfree(m->rm_rf_tmpdir);
 116                 return log_error_errno(errno, "Failed to acquire temporary directory: %m");
 117         }
 118
 119         m->source = path_join(m->rm_rf_tmpdir, "src");
 120         if (!m->source)
 121                 return log_oom();
 122
 123         if (mkdir(m->source, 0755) < 0)
 124                 return log_error_errno(errno, "Failed to create %s: %m", m->source);
 125
 126         return 0;
 127 }
 128
 129 int custom_mount_prepare_all(const char *dest, CustomMount *l, size_t n) {
 130         size_t i;
 131         int r;
 132
 133         /* Prepare all custom mounts. This will make source we know all temporary directories. This is called in the
 134          * parent process, so that we know the temporary directories to remove on exit before we fork off the
 135          * children. */
 136
 137         assert(l || n == 0);
 138
 139         /* Order the custom mounts, and make sure we have a working directory */
 140         typesafe_qsort(l, n, custom_mount_compare);
 141
 142         for (i = 0; i < n; i++) {
 143                 CustomMount *m = l + i;
 144
 145                 /* /proc we mount in the inner child, i.e. when we acquired CLONE_NEWPID. All other mounts we mount
 146                  * already in the outer child, so that the mounts are already established before CLONE_NEWPID and in
 147                  * particular CLONE_NEWUSER. This also means any custom mounts below /proc also need to be mounted in
 148                  * the inner child, not the outer one. Determine this here. */
 149                 m->in_userns = path_startswith(m->destination, "/proc");
 150
 151                 if (m->type == CUSTOM_MOUNT_BIND) {
 152                         if (m->source) {
 153                                 char *s;
 154
 155                                 s = resolve_source_path(dest, m->source);
 156                                 if (!s)
 157                                         return log_oom();
 158
 159                                 free_and_replace(m->source, s);
 160                         } else {
 161                                 /* No source specified? In that case, use a throw-away temporary directory in /var/tmp */
 162
 163                                 r = allocate_temporary_source(m);
 164                                 if (r < 0)
 165                                         return r;
 166                         }
 167                 }
 168
 169                 if (m->type == CUSTOM_MOUNT_OVERLAY) {
 170                         char **j;
 171
 172                         STRV_FOREACH(j, m->lower) {
 173                                 char *s;
 174
 175                                 s = resolve_source_path(dest, *j);
 176                                 if (!s)
 177                                         return log_oom();
 178
 179                                 free_and_replace(*j, s);
 180                         }
 181
 182                         if (m->source) {
 183                                 char *s;
 184
 185                                 s = resolve_source_path(dest, m->source);
 186                                 if (!s)
 187                                         return log_oom();
 188
 189                                 free_and_replace(m->source, s);
 190                         } else {
 191                                 r = allocate_temporary_source(m);
 192                                 if (r < 0)
 193                                         return r;
 194                         }
 195
 196                         if (m->work_dir) {
 197                                 char *s;
 198
 199                                 s = resolve_source_path(dest, m->work_dir);
 200                                 if (!s)
 201                                         return log_oom();
 202
 203                                 free_and_replace(m->work_dir, s);
 204                         } else {
 205                                 r = tempfn_random(m->source, NULL, &m->work_dir);
 206                                 if (r < 0)
 207                                         return log_error_errno(r, "Failed to acquire working directory: %m");
 208                         }
 209
 210                         (void) mkdir_label(m->work_dir, 0700);
 211                 }
 212         }
 213
 214         return 0;
 215 }
 216
 217 int bind_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) {
 218         _cleanup_free_ char *source = NULL, *destination = NULL, *opts = NULL;
 219         const char *p = s;
 220         CustomMount *m;
 221         int r;
 222
 223         assert(l);
 224         assert(n);
 225
 226         r = extract_many_words(&p, ":", EXTRACT_DONT_COALESCE_SEPARATORS, &source, &destination, NULL);
 227         if (r < 0)
 228                 return r;
 229         if (r == 0)
 230                 return -EINVAL;
 231         if (r == 1) {
 232                 destination = strdup(source[0] == '+' ? source+1 : source);
 233                 if (!destination)
 234                         return -ENOMEM;
 235         }
 236         if (r == 2 && !isempty(p)) {
 237                 opts = strdup(p);
 238                 if (!opts)
 239                         return -ENOMEM;
 240         }
 241
 242         if (isempty(source))
 243                 source = mfree(source);
 244         else if (!source_path_is_valid(source))
 245                 return -EINVAL;
 246
 247         if (!path_is_absolute(destination))
 248                 return -EINVAL;
 249
 250         m = custom_mount_add(l, n, CUSTOM_MOUNT_BIND);
 251         if (!m)
 252                 return -ENOMEM;
 253
 254         m->source = TAKE_PTR(source);
 255         m->destination = TAKE_PTR(destination);
 256         m->read_only = read_only;
 257         m->options = TAKE_PTR(opts);
 258
 259         return 0;
 260 }
 261
 262 int tmpfs_mount_parse(CustomMount **l, size_t *n, const char *s) {
 263         _cleanup_free_ char *path = NULL, *opts = NULL;
 264         const char *p = s;
 265         CustomMount *m;
 266         int r;
 267
 268         assert(l);
 269         assert(n);
 270         assert(s);
 271
 272         r = extract_first_word(&p, &path, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 273         if (r < 0)
 274                 return r;
 275         if (r == 0)
 276                 return -EINVAL;
 277
 278         if (isempty(p))
 279                 opts = strdup("mode=0755");
 280         else
 281                 opts = strdup(p);
 282         if (!opts)
 283                 return -ENOMEM;
 284
 285         if (!path_is_absolute(path))
 286                 return -EINVAL;
 287
 288         m = custom_mount_add(l, n, CUSTOM_MOUNT_TMPFS);
 289         if (!m)
 290                 return -ENOMEM;
 291
 292         m->destination = TAKE_PTR(path);
 293         m->options = TAKE_PTR(opts);
 294
 295         return 0;
 296 }
 297
 298 int overlay_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) {
 299         _cleanup_free_ char *upper = NULL, *destination = NULL;
 300         _cleanup_strv_free_ char **lower = NULL;
 301         CustomMount *m;
 302         int k;
 303
 304         k = strv_split_extract(&lower, s, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 305         if (k < 0)
 306                 return k;
 307         if (k < 2)
 308                 return -EADDRNOTAVAIL;
 309         if (k == 2) {
 310                 /* If two parameters are specified, the first one is the lower, the second one the upper directory. And
 311                  * we'll also define the destination mount point the same as the upper. */
 312
 313                 if (!source_path_is_valid(lower[0]) ||
 314                     !source_path_is_valid(lower[1]))
 315                         return -EINVAL;
 316
 317                 upper = TAKE_PTR(lower[1]);
 318
 319                 destination = strdup(upper[0] == '+' ? upper+1 : upper); /* take the destination without "+" prefix */
 320                 if (!destination)
 321                         return -ENOMEM;
 322         } else {
 323                 char **i;
 324
 325                 /* If more than two parameters are specified, the last one is the destination, the second to last one
 326                  * the "upper", and all before that the "lower" directories. */
 327
 328                 destination = lower[k - 1];
 329                 upper = TAKE_PTR(lower[k - 2]);
 330
 331                 STRV_FOREACH(i, lower)
 332                         if (!source_path_is_valid(*i))
 333                                 return -EINVAL;
 334
 335                 /* If the upper directory is unspecified, then let's create it automatically as a throw-away directory
 336                  * in /var/tmp */
 337                 if (isempty(upper))
 338                         upper = mfree(upper);
 339                 else if (!source_path_is_valid(upper))
 340                         return -EINVAL;
 341
 342                 if (!path_is_absolute(destination))
 343                         return -EINVAL;
 344         }
 345
 346         m = custom_mount_add(l, n, CUSTOM_MOUNT_OVERLAY);
 347         if (!m)
 348                 return -ENOMEM;
 349
 350         m->destination = TAKE_PTR(destination);
 351         m->source = TAKE_PTR(upper);
 352         m->lower = TAKE_PTR(lower);
 353         m->read_only = read_only;
 354
 355         return 0;
 356 }
 357
 358 int inaccessible_mount_parse(CustomMount **l, size_t *n, const char *s) {
 359         _cleanup_free_ char *path = NULL;
 360         CustomMount *m;
 361
 362         assert(l);
 363         assert(n);
 364         assert(s);
 365
 366         if (!path_is_absolute(s))
 367                 return -EINVAL;
 368
 369         path = strdup(s);
 370         if (!path)
 371                 return -ENOMEM;
 372
 373         m = custom_mount_add(l, n, CUSTOM_MOUNT_INACCESSIBLE);
 374         if (!m)
 375                 return -ENOMEM;
 376
 377         m->destination = TAKE_PTR(path);
 378         return 0;
 379 }
 380
 381 int tmpfs_patch_options(
 382                 const char *options,
 383                 uid_t uid_shift,
 384                 const char *selinux_apifs_context,
 385                 char **ret) {
 386
 387         char *buf = NULL;
 388
 389         if (uid_shift != UID_INVALID) {
 390                 if (asprintf(&buf, "%s%suid=" UID_FMT ",gid=" UID_FMT,
 391                              strempty(options), options ? "," : "",
 392                              uid_shift, uid_shift) < 0)
 393                         return -ENOMEM;
 394
 395                 options = buf;
 396         }
 397
 398 #if HAVE_SELINUX
 399         if (selinux_apifs_context) {
 400                 char *t;
 401
 402                 t = strjoin(strempty(options), options ? "," : "",
 403                             "context=\"", selinux_apifs_context, "\"");
 404                 free(buf);
 405                 if (!t)
 406                         return -ENOMEM;
 407
 408                 buf = t;
 409         }
 410 #endif
 411
 412         if (!buf && options) {
 413                 buf = strdup(options);
 414                 if (!buf)
 415                         return -ENOMEM;
 416         }
 417         *ret = buf;
 418
 419         return !!buf;
 420 }
 421
 422 int mount_sysfs(const char *dest, MountSettingsMask mount_settings) {
 423         const char *full, *top, *x;
 424         int r;
 425         unsigned long extra_flags = 0;
 426
 427         top = prefix_roota(dest, "/sys");
 428         r = path_is_fs_type(top, SYSFS_MAGIC);
 429         if (r < 0)
 430                 return log_error_errno(r, "Failed to determine filesystem type of %s: %m", top);
 431         /* /sys might already be mounted as sysfs by the outer child in the
 432          * !netns case. In this case, it's all good. Don't touch it because we
 433          * don't have the right to do so, see https://github.com/systemd/systemd/issues/1555.
 434          */
 435         if (r > 0)
 436                 return 0;
 437
 438         full = prefix_roota(top, "/full");
 439
 440         (void) mkdir(full, 0755);
 441
 442         if (FLAGS_SET(mount_settings, MOUNT_APPLY_APIVFS_RO))
 443                 extra_flags |= MS_RDONLY;
 444
 445         r = mount_verbose(LOG_ERR, "sysfs", full, "sysfs",
 446                           MS_NOSUID|MS_NOEXEC|MS_NODEV|extra_flags, NULL);
 447         if (r < 0)
 448                 return r;
 449
 450         FOREACH_STRING(x, "block", "bus", "class", "dev", "devices", "kernel") {
 451                 _cleanup_free_ char *from = NULL, *to = NULL;
 452
 453                 from = path_join(full, x);
 454                 if (!from)
 455                         return log_oom();
 456
 457                 to = path_join(top, x);
 458                 if (!to)
 459                         return log_oom();
 460
 461                 (void) mkdir(to, 0755);
 462
 463                 r = mount_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
 464                 if (r < 0)
 465                         return r;
 466
 467                 r = mount_verbose(LOG_ERR, NULL, to, NULL,
 468                                   MS_BIND|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT|extra_flags, NULL);
 469                 if (r < 0)
 470                         return r;
 471         }
 472
 473         r = umount_verbose(full);
 474         if (r < 0)
 475                 return r;
 476
 477         if (rmdir(full) < 0)
 478                 return log_error_errno(errno, "Failed to remove %s: %m", full);
 479
 480         /* Create mountpoint for cgroups. Otherwise we are not allowed since we
 481          * remount /sys read-only.
 482          */
 483         x = prefix_roota(top, "/fs/cgroup");
 484         (void) mkdir_p(x, 0755);
 485
 486         return mount_verbose(LOG_ERR, NULL, top, NULL,
 487                              MS_BIND|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT|extra_flags, NULL);
 488 }
 489
 490 int mount_all(const char *dest,
 491               MountSettingsMask mount_settings,
 492               uid_t uid_shift,
 493               const char *selinux_apifs_context) {
 494
 495 #define PROC_INACCESSIBLE_REG(path)                                     \
 496         { "/run/systemd/inaccessible/reg", (path), NULL, NULL, MS_BIND, \
 497           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO }, /* Bind mount first ... */ \
 498         { NULL, (path), NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, \
 499           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO } /* Then, make it r/o */
 500
 501 #define PROC_READ_ONLY(path)                                            \
 502         { (path), (path), NULL, NULL, MS_BIND,                          \
 503           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO }, /* Bind mount first ... */ \
 504         { NULL,   (path), NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, \
 505           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO } /* Then, make it r/o */
 506
 507         typedef struct MountPoint {
 508                 const char *what;
 509                 const char *where;
 510                 const char *type;
 511                 const char *options;
 512                 unsigned long flags;
 513                 MountSettingsMask mount_settings;
 514         } MountPoint;
 515
 516         static const MountPoint mount_table[] = {
 517                 /* First we list inner child mounts (i.e. mounts applied *after* entering user namespacing) */
 518                 { "proc",            "/proc",           "proc",  NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV,
 519                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_MKDIR },
 520
 521                 { "/proc/sys",       "/proc/sys",       NULL,    NULL,        MS_BIND,
 522                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO },                          /* Bind mount first ... */
 523
 524                 { "/proc/sys/net",   "/proc/sys/net",   NULL,    NULL,        MS_BIND,
 525                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS }, /* (except for this) */
 526
 527                 { NULL,              "/proc/sys",       NULL,    NULL,        MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 528                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO },                          /* ... then, make it r/o */
 529
 530                 /* Make these files inaccessible to container payloads: they potentially leak information about kernel
 531                  * internals or the host's execution environment to the container */
 532                 PROC_INACCESSIBLE_REG("/proc/kallsyms"),
 533                 PROC_INACCESSIBLE_REG("/proc/kcore"),
 534                 PROC_INACCESSIBLE_REG("/proc/keys"),
 535                 PROC_INACCESSIBLE_REG("/proc/sysrq-trigger"),
 536                 PROC_INACCESSIBLE_REG("/proc/timer_list"),
 537
 538                 /* Make these directories read-only to container payloads: they show hardware information, and in some
 539                  * cases contain tunables the container really shouldn't have access to. */
 540                 PROC_READ_ONLY("/proc/acpi"),
 541                 PROC_READ_ONLY("/proc/apm"),
 542                 PROC_READ_ONLY("/proc/asound"),
 543                 PROC_READ_ONLY("/proc/bus"),
 544                 PROC_READ_ONLY("/proc/fs"),
 545                 PROC_READ_ONLY("/proc/irq"),
 546                 PROC_READ_ONLY("/proc/scsi"),
 547
 548                 { "mqueue",                 "/dev/mqueue",                  "mqueue", NULL,                            MS_NOSUID|MS_NOEXEC|MS_NODEV,
 549                   MOUNT_IN_USERNS|MOUNT_MKDIR },
 550
 551                 /* Then we list outer child mounts (i.e. mounts applied *before* entering user namespacing) */
 552                 { "tmpfs",                  "/tmp",                         "tmpfs", "mode=1777" NESTED_TMPFS_LIMITS,  MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 553                   MOUNT_FATAL|MOUNT_APPLY_TMPFS_TMP|MOUNT_MKDIR },
 554                 { "tmpfs",                  "/sys",                         "tmpfs", "mode=555" TMPFS_LIMITS_SYS,      MS_NOSUID|MS_NOEXEC|MS_NODEV,
 555                   MOUNT_FATAL|MOUNT_APPLY_APIVFS_NETNS|MOUNT_MKDIR },
 556                 { "sysfs",                  "/sys",                         "sysfs", NULL,                             MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV,
 557                   MOUNT_FATAL|MOUNT_APPLY_APIVFS_RO|MOUNT_MKDIR },    /* skipped if above was mounted */
 558                 { "sysfs",                  "/sys",                         "sysfs", NULL,                             MS_NOSUID|MS_NOEXEC|MS_NODEV,
 559                   MOUNT_FATAL|MOUNT_MKDIR },                          /* skipped if above was mounted */
 560                 { "tmpfs",                  "/dev",                         "tmpfs", "mode=755" TMPFS_LIMITS_DEV,      MS_NOSUID|MS_STRICTATIME,
 561                   MOUNT_FATAL|MOUNT_MKDIR },
 562                 { "tmpfs",                  "/dev/shm",                     "tmpfs", "mode=1777" NESTED_TMPFS_LIMITS,  MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 563                   MOUNT_FATAL|MOUNT_MKDIR },
 564                 { "tmpfs",                  "/run",                         "tmpfs", "mode=755" TMPFS_LIMITS_RUN,      MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 565                   MOUNT_FATAL|MOUNT_MKDIR },
 566                 { "/run/host",              "/run/host",                    NULL,    NULL,                             MS_BIND,
 567                   MOUNT_FATAL|MOUNT_MKDIR|MOUNT_PREFIX_ROOT }, /* Prepare this so that we can make it read-only when we are done */
 568                 { "/etc/os-release",        "/run/host/os-release",         NULL,    NULL,                             MS_BIND,
 569                   MOUNT_TOUCH }, /* As per kernel interface requirements, bind mount first (creating mount points) and make read-only later */
 570                 { "/usr/lib/os-release",    "/run/host/os-release",         NULL,    NULL,                             MS_BIND,
 571                   MOUNT_FATAL }, /* If /etc/os-release doesn't exist use the version in /usr/lib as fallback */
 572                 { NULL,                     "/run/host/os-release",         NULL,    NULL,                             MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 573                   MOUNT_FATAL },
 574                 { NULL,                     "/run/host",                    NULL,    NULL,                             MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 575                   MOUNT_FATAL|MOUNT_IN_USERNS },
 576 #if HAVE_SELINUX
 577                 { "/sys/fs/selinux",        "/sys/fs/selinux",              NULL,    NULL,                             MS_BIND,
 578                   MOUNT_MKDIR },  /* Bind mount first (mkdir/chown the mount point in case /sys/ is mounted as minimal skeleton tmpfs) */
 579                 { NULL,                     "/sys/fs/selinux",              NULL,    NULL,                             MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 580                   0 },            /* Then, make it r/o (don't mkdir/chown the mount point here, the previous entry already did that) */
 581 #endif
 582         };
 583
 584         bool use_userns = FLAGS_SET(mount_settings, MOUNT_USE_USERNS);
 585         bool netns = FLAGS_SET(mount_settings, MOUNT_APPLY_APIVFS_NETNS);
 586         bool ro = FLAGS_SET(mount_settings, MOUNT_APPLY_APIVFS_RO);
 587         bool in_userns = FLAGS_SET(mount_settings, MOUNT_IN_USERNS);
 588         bool tmpfs_tmp = FLAGS_SET(mount_settings, MOUNT_APPLY_TMPFS_TMP);
 589         size_t k;
 590         int r;
 591
 592         for (k = 0; k < ELEMENTSOF(mount_table); k++) {
 593                 _cleanup_free_ char *where = NULL, *options = NULL, *prefixed = NULL;
 594                 bool fatal = FLAGS_SET(mount_table[k].mount_settings, MOUNT_FATAL);
 595                 const char *o;
 596
 597                 if (in_userns != FLAGS_SET(mount_table[k].mount_settings, MOUNT_IN_USERNS))
 598                         continue;
 599
 600                 if (!netns && FLAGS_SET(mount_table[k].mount_settings, MOUNT_APPLY_APIVFS_NETNS))
 601                         continue;
 602
 603                 if (!ro && FLAGS_SET(mount_table[k].mount_settings, MOUNT_APPLY_APIVFS_RO))
 604                         continue;
 605
 606                 if (!tmpfs_tmp && FLAGS_SET(mount_table[k].mount_settings, MOUNT_APPLY_TMPFS_TMP))
 607                         continue;
 608
 609                 r = chase_symlinks(mount_table[k].where, dest, CHASE_NONEXISTENT|CHASE_PREFIX_ROOT, &where, NULL);
 610                 if (r < 0)
 611                         return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, mount_table[k].where);
 612
 613                 /* Skip this entry if it is not a remount. */
 614                 if (mount_table[k].what) {
 615                         r = path_is_mount_point(where, NULL, 0);
 616                         if (r < 0 && r != -ENOENT)
 617                                 return log_error_errno(r, "Failed to detect whether %s is a mount point: %m", where);
 618                         if (r > 0)
 619                                 continue;
 620                 }
 621
 622                 if ((mount_table[k].mount_settings & (MOUNT_MKDIR|MOUNT_TOUCH)) != 0) {
 623                         uid_t u = (use_userns && !in_userns) ? uid_shift : UID_INVALID;
 624
 625                         if (FLAGS_SET(mount_table[k].mount_settings, MOUNT_TOUCH))
 626                                 r = mkdir_parents_safe(dest, where, 0755, u, u, 0);
 627                         else
 628                                 r = mkdir_p_safe(dest, where, 0755, u, u, 0);
 629                         if (r < 0 && r != -EEXIST) {
 630                                 if (fatal && r != -EROFS)
 631                                         return log_error_errno(r, "Failed to create directory %s: %m", where);
 632
 633                                 log_debug_errno(r, "Failed to create directory %s: %m", where);
 634
 635                                 /* If we failed mkdir() or chown() due to the root directory being read only,
 636                                  * attempt to mount this fs anyway and let mount_verbose log any errors */
 637                                 if (r != -EROFS)
 638                                         continue;
 639                         }
 640                 }
 641
 642                 if (FLAGS_SET(mount_table[k].mount_settings, MOUNT_TOUCH)) {
 643                         r = touch(where);
 644                         if (r < 0 && r != -EEXIST) {
 645                                 if (fatal && r != -EROFS)
 646                                         return log_error_errno(r, "Failed to create file %s: %m", where);
 647
 648                                 log_debug_errno(r, "Failed to create file %s: %m", where);
 649                                 if (r != -EROFS)
 650                                         continue;
 651                         }
 652                 }
 653
 654                 o = mount_table[k].options;
 655                 if (streq_ptr(mount_table[k].type, "tmpfs")) {
 656                         r = tmpfs_patch_options(o, in_userns ? 0 : uid_shift, selinux_apifs_context, &options);
 657                         if (r < 0)
 658                                 return log_oom();
 659                         if (r > 0)
 660                                 o = options;
 661                 }
 662
 663                 if (FLAGS_SET(mount_table[k].mount_settings, MOUNT_PREFIX_ROOT)) {
 664                         /* Optionally prefix the mount source with the root dir. This is useful in bind
 665                          * mounts to be created within the container image before we transition into it. Note
 666                          * that MOUNT_IN_USERNS is run after we transitioned hence prefixing is not ncessary
 667                          * for those. */
 668                         r = chase_symlinks(mount_table[k].what, dest, CHASE_PREFIX_ROOT, &prefixed, NULL);
 669                         if (r < 0)
 670                                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, mount_table[k].what);
 671                 }
 672
 673                 r = mount_verbose(fatal ? LOG_ERR : LOG_DEBUG,
 674                                   prefixed ?: mount_table[k].what,
 675                                   where,
 676                                   mount_table[k].type,
 677                                   mount_table[k].flags,
 678                                   o);
 679                 if (r < 0 && fatal)
 680                         return r;
 681         }
 682
 683         return 0;
 684 }
 685
 686 static int parse_mount_bind_options(const char *options, unsigned long *mount_flags, char **mount_opts) {
 687         const char *p = options;
 688         unsigned long flags = *mount_flags;
 689         char *opts = NULL;
 690         int r;
 691
 692         assert(options);
 693
 694         for (;;) {
 695                 _cleanup_free_ char *word = NULL;
 696
 697                 r = extract_first_word(&p, &word, ",", 0);
 698                 if (r < 0)
 699                         return log_error_errno(r, "Failed to extract mount option: %m");
 700                 if (r == 0)
 701                         break;
 702
 703                 if (streq(word, "rbind"))
 704                         flags |= MS_REC;
 705                 else if (streq(word, "norbind"))
 706                         flags &= ~MS_REC;
 707                 else {
 708                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 709                                                "Invalid bind mount option: %s",
 710                                                word);
 711                 }
 712         }
 713
 714         *mount_flags = flags;
 715         /* in the future mount_opts will hold string options for mount(2) */
 716         *mount_opts = opts;
 717
 718         return 0;
 719 }
 720
 721 static int mount_bind(const char *dest, CustomMount *m) {
 722         _cleanup_free_ char *mount_opts = NULL, *where = NULL;
 723         unsigned long mount_flags = MS_BIND | MS_REC;
 724         struct stat source_st, dest_st;
 725         int r;
 726
 727         assert(dest);
 728         assert(m);
 729
 730         if (m->options) {
 731                 r = parse_mount_bind_options(m->options, &mount_flags, &mount_opts);
 732                 if (r < 0)
 733                         return r;
 734         }
 735
 736         if (stat(m->source, &source_st) < 0)
 737                 return log_error_errno(errno, "Failed to stat %s: %m", m->source);
 738
 739         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where, NULL);
 740         if (r < 0)
 741                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 742         if (r > 0) { /* Path exists already? */
 743
 744                 if (stat(where, &dest_st) < 0)
 745                         return log_error_errno(errno, "Failed to stat %s: %m", where);
 746
 747                 if (S_ISDIR(source_st.st_mode) && !S_ISDIR(dest_st.st_mode))
 748                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 749                                                "Cannot bind mount directory %s on file %s.",
 750                                                m->source, where);
 751
 752                 if (!S_ISDIR(source_st.st_mode) && S_ISDIR(dest_st.st_mode))
 753                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 754                                                "Cannot bind mount file %s on directory %s.",
 755                                                m->source, where);
 756
 757         } else { /* Path doesn't exist yet? */
 758                 r = mkdir_parents_label(where, 0755);
 759                 if (r < 0)
 760                         return log_error_errno(r, "Failed to make parents of %s: %m", where);
 761
 762                 /* Create the mount point. Any non-directory file can be
 763                 * mounted on any non-directory file (regular, fifo, socket,
 764                 * char, block).
 765                 */
 766                 if (S_ISDIR(source_st.st_mode))
 767                         r = mkdir_label(where, 0755);
 768                 else
 769                         r = touch(where);
 770                 if (r < 0)
 771                         return log_error_errno(r, "Failed to create mount point %s: %m", where);
 772         }
 773
 774         r = mount_verbose(LOG_ERR, m->source, where, NULL, mount_flags, mount_opts);
 775         if (r < 0)
 776                 return r;
 777
 778         if (m->read_only) {
 779                 r = bind_remount_recursive(where, MS_RDONLY, MS_RDONLY, NULL);
 780                 if (r < 0)
 781                         return log_error_errno(r, "Read-only bind mount failed: %m");
 782         }
 783
 784         return 0;
 785 }
 786
 787 static int mount_tmpfs(const char *dest, CustomMount *m, uid_t uid_shift, const char *selinux_apifs_context) {
 788
 789         const char *options;
 790         _cleanup_free_ char *buf = NULL, *where = NULL;
 791         int r;
 792
 793         assert(dest);
 794         assert(m);
 795
 796         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where, NULL);
 797         if (r < 0)
 798                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 799         if (r == 0) { /* Doesn't exist yet? */
 800                 r = mkdir_p_label(where, 0755);
 801                 if (r < 0)
 802                         return log_error_errno(r, "Creating mount point for tmpfs %s failed: %m", where);
 803         }
 804
 805         r = tmpfs_patch_options(m->options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
 806         if (r < 0)
 807                 return log_oom();
 808         options = r > 0 ? buf : m->options;
 809
 810         return mount_verbose(LOG_ERR, "tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, options);
 811 }
 812
 813 static char *joined_and_escaped_lower_dirs(char **lower) {
 814         _cleanup_strv_free_ char **sv = NULL;
 815
 816         sv = strv_copy(lower);
 817         if (!sv)
 818                 return NULL;
 819
 820         strv_reverse(sv);
 821
 822         if (!strv_shell_escape(sv, ",:"))
 823                 return NULL;
 824
 825         return strv_join(sv, ":");
 826 }
 827
 828 static int mount_overlay(const char *dest, CustomMount *m) {
 829         _cleanup_free_ char *lower = NULL, *where = NULL, *escaped_source = NULL;
 830         const char *options;
 831         int r;
 832
 833         assert(dest);
 834         assert(m);
 835
 836         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where, NULL);
 837         if (r < 0)
 838                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 839         if (r == 0) { /* Doesn't exist yet? */
 840                 r = mkdir_label(where, 0755);
 841                 if (r < 0)
 842                         return log_error_errno(r, "Creating mount point for overlay %s failed: %m", where);
 843         }
 844
 845         (void) mkdir_p_label(m->source, 0755);
 846
 847         lower = joined_and_escaped_lower_dirs(m->lower);
 848         if (!lower)
 849                 return log_oom();
 850
 851         escaped_source = shell_escape(m->source, ",:");
 852         if (!escaped_source)
 853                 return log_oom();
 854
 855         if (m->read_only)
 856                 options = strjoina("lowerdir=", escaped_source, ":", lower);
 857         else {
 858                 _cleanup_free_ char *escaped_work_dir = NULL;
 859
 860                 escaped_work_dir = shell_escape(m->work_dir, ",:");
 861                 if (!escaped_work_dir)
 862                         return log_oom();
 863
 864                 options = strjoina("lowerdir=", lower, ",upperdir=", escaped_source, ",workdir=", escaped_work_dir);
 865         }
 866
 867         return mount_verbose(LOG_ERR, "overlay", where, "overlay", m->read_only ? MS_RDONLY : 0, options);
 868 }
 869
 870 static int mount_inaccessible(const char *dest, CustomMount *m) {
 871         _cleanup_free_ char *where = NULL, *source = NULL;
 872         struct stat st;
 873         int r;
 874
 875         assert(dest);
 876         assert(m);
 877
 878         r = chase_symlinks_and_stat(m->destination, dest, CHASE_PREFIX_ROOT, &where, &st, NULL);
 879         if (r < 0) {
 880                 log_full_errno(m->graceful ? LOG_DEBUG : LOG_ERR, r, "Failed to resolve %s/%s: %m", dest, m->destination);
 881                 return m->graceful ? 0 : r;
 882         }
 883
 884         r = mode_to_inaccessible_node(NULL, st.st_mode, &source);
 885         if (r < 0)
 886                 return m->graceful ? 0 : r;
 887
 888         r = mount_verbose(m->graceful ? LOG_DEBUG : LOG_ERR, source, where, NULL, MS_BIND, NULL);
 889         if (r < 0)
 890                 return m->graceful ? 0 : r;
 891
 892         r = mount_verbose(m->graceful ? LOG_DEBUG : LOG_ERR, NULL, where, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, NULL);
 893         if (r < 0) {
 894                 (void) umount_verbose(where);
 895                 return m->graceful ? 0 : r;
 896         }
 897
 898         return 0;
 899 }
 900
 901 static int mount_arbitrary(const char *dest, CustomMount *m) {
 902         _cleanup_free_ char *where = NULL;
 903         int r;
 904
 905         assert(dest);
 906         assert(m);
 907
 908         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where, NULL);
 909         if (r < 0)
 910                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 911         if (r == 0) { /* Doesn't exist yet? */
 912                 r = mkdir_p_label(where, 0755);
 913                 if (r < 0)
 914                         return log_error_errno(r, "Creating mount point for mount %s failed: %m", where);
 915         }
 916
 917         return mount_verbose(LOG_ERR, m->source, where, m->type_argument, 0, m->options);
 918 }
 919
 920 int mount_custom(
 921                 const char *dest,
 922                 CustomMount *mounts, size_t n,
 923                 uid_t uid_shift,
 924                 const char *selinux_apifs_context,
 925                 MountSettingsMask mount_settings) {
 926
 927         size_t i;
 928         int r;
 929
 930         assert(dest);
 931
 932         for (i = 0; i < n; i++) {
 933                 CustomMount *m = mounts + i;
 934
 935                 if (FLAGS_SET(mount_settings, MOUNT_IN_USERNS) != m->in_userns)
 936                         continue;
 937
 938                 if (FLAGS_SET(mount_settings, MOUNT_ROOT_ONLY) && !path_equal(m->destination, "/"))
 939                         continue;
 940
 941                 if (FLAGS_SET(mount_settings, MOUNT_NON_ROOT_ONLY) && path_equal(m->destination, "/"))
 942                         continue;
 943
 944                 switch (m->type) {
 945
 946                 case CUSTOM_MOUNT_BIND:
 947                         r = mount_bind(dest, m);
 948                         break;
 949
 950                 case CUSTOM_MOUNT_TMPFS:
 951                         r = mount_tmpfs(dest, m, uid_shift, selinux_apifs_context);
 952                         break;
 953
 954                 case CUSTOM_MOUNT_OVERLAY:
 955                         r = mount_overlay(dest, m);
 956                         break;
 957
 958                 case CUSTOM_MOUNT_INACCESSIBLE:
 959                         r = mount_inaccessible(dest, m);
 960                         break;
 961
 962                 case CUSTOM_MOUNT_ARBITRARY:
 963                         r = mount_arbitrary(dest, m);
 964                         break;
 965
 966                 default:
 967                         assert_not_reached("Unknown custom mount type");
 968                 }
 969
 970                 if (r < 0)
 971                         return r;
 972         }
 973
 974         return 0;
 975 }
 976
 977 bool has_custom_root_mount(const CustomMount *mounts, size_t n) {
 978         size_t i;
 979
 980         for (i = 0; i < n; i++) {
 981                 const CustomMount *m = mounts + i;
 982
 983                 if (path_equal(m->destination, "/"))
 984                         return true;
 985         }
 986
 987         return false;
 988 }
 989
 990 static int setup_volatile_state(const char *directory, uid_t uid_shift, const char *selinux_apifs_context) {
 991
 992         _cleanup_free_ char *buf = NULL;
 993         const char *p, *options;
 994         int r;
 995
 996         assert(directory);
 997
 998         /* --volatile=state means we simply overmount /var with a tmpfs, and the rest read-only. */
 999
1000         r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
1001         if (r < 0)
1002                 return log_error_errno(r, "Failed to remount %s read-only: %m", directory);
1003
1004         p = prefix_roota(directory, "/var");
1005         r = mkdir(p, 0755);
1006         if (r < 0 && errno != EEXIST)
1007                 return log_error_errno(errno, "Failed to create %s: %m", directory);
1008
1009         options = "mode=755" TMPFS_LIMITS_VOLATILE_STATE;
1010         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
1011         if (r < 0)
1012                 return log_oom();
1013         if (r > 0)
1014                 options = buf;
1015
1016         return mount_verbose(LOG_ERR, "tmpfs", p, "tmpfs", MS_STRICTATIME, options);
1017 }
1018
1019 static int setup_volatile_yes(const char *directory, uid_t uid_shift, const char *selinux_apifs_context) {
1020
1021         bool tmpfs_mounted = false, bind_mounted = false;
1022         char template[] = "/tmp/nspawn-volatile-XXXXXX";
1023         _cleanup_free_ char *buf = NULL, *bindir = NULL;
1024         const char *f, *t, *options;
1025         struct stat st;
1026         int r;
1027
1028         assert(directory);
1029
1030         /* --volatile=yes means we mount a tmpfs to the root dir, and the original /usr to use inside it, and
1031          * that read-only. Before we start setting this up let's validate if the image has the /usr merge
1032          * implemented, and let's output a friendly log message if it hasn't. */
1033
1034         bindir = path_join(directory, "/bin");
1035         if (!bindir)
1036                 return log_oom();
1037         if (lstat(bindir, &st) < 0) {
1038                 if (errno != ENOENT)
1039                         return log_error_errno(errno, "Failed to stat /bin directory below image: %m");
1040
1041                 /* ENOENT is fine, just means the image is probably just a naked /usr and we can create the
1042                  * rest. */
1043         } else if (S_ISDIR(st.st_mode))
1044                 return log_error_errno(SYNTHETIC_ERRNO(EISDIR),
1045                                        "Sorry, --volatile=yes mode is not supported with OS images that have not merged /bin/, /sbin/, /lib/, /lib64/ into /usr/. "
1046                                        "Please work with your distribution and help them adopt the merged /usr scheme.");
1047         else if (!S_ISLNK(st.st_mode))
1048                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1049                                        "Error starting image: if --volatile=yes is used /bin must be a symlink (for merged /usr support) or non-existent (in which case a symlink is created automatically).");
1050
1051         if (!mkdtemp(template))
1052                 return log_error_errno(errno, "Failed to create temporary directory: %m");
1053
1054         options = "mode=755" TMPFS_LIMITS_ROOTFS;
1055         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
1056         if (r < 0)
1057                 goto fail;
1058         if (r > 0)
1059                 options = buf;
1060
1061         r = mount_verbose(LOG_ERR, "tmpfs", template, "tmpfs", MS_STRICTATIME, options);
1062         if (r < 0)
1063                 goto fail;
1064
1065         tmpfs_mounted = true;
1066
1067         f = prefix_roota(directory, "/usr");
1068         t = prefix_roota(template, "/usr");
1069
1070         r = mkdir(t, 0755);
1071         if (r < 0 && errno != EEXIST) {
1072                 r = log_error_errno(errno, "Failed to create %s: %m", t);
1073                 goto fail;
1074         }
1075
1076         r = mount_verbose(LOG_ERR, f, t, NULL, MS_BIND|MS_REC, NULL);
1077         if (r < 0)
1078                 goto fail;
1079
1080         bind_mounted = true;
1081
1082         r = bind_remount_recursive(t, MS_RDONLY, MS_RDONLY, NULL);
1083         if (r < 0) {
1084                 log_error_errno(r, "Failed to remount %s read-only: %m", t);
1085                 goto fail;
1086         }
1087
1088         r = mount_verbose(LOG_ERR, template, directory, NULL, MS_MOVE, NULL);
1089         if (r < 0)
1090                 goto fail;
1091
1092         (void) rmdir(template);
1093
1094         return 0;
1095
1096 fail:
1097         if (bind_mounted)
1098                 (void) umount_verbose(t);
1099
1100         if (tmpfs_mounted)
1101                 (void) umount_verbose(template);
1102         (void) rmdir(template);
1103         return r;
1104 }
1105
1106 static int setup_volatile_overlay(const char *directory, uid_t uid_shift, const char *selinux_apifs_context) {
1107
1108         _cleanup_free_ char *buf = NULL, *escaped_directory = NULL, *escaped_upper = NULL, *escaped_work = NULL;
1109         char template[] = "/tmp/nspawn-volatile-XXXXXX";
1110         const char *upper, *work, *options;
1111         bool tmpfs_mounted = false;
1112         int r;
1113
1114         assert(directory);
1115
1116         /* --volatile=overlay means we mount an overlayfs to the root dir. */
1117
1118         if (!mkdtemp(template))
1119                 return log_error_errno(errno, "Failed to create temporary directory: %m");
1120
1121         options = "mode=755" TMPFS_LIMITS_ROOTFS;
1122         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
1123         if (r < 0)
1124                 goto finish;
1125         if (r > 0)
1126                 options = buf;
1127
1128         r = mount_verbose(LOG_ERR, "tmpfs", template, "tmpfs", MS_STRICTATIME, options);
1129         if (r < 0)
1130                 goto finish;
1131
1132         tmpfs_mounted = true;
1133
1134         upper = strjoina(template, "/upper");
1135         work = strjoina(template, "/work");
1136
1137         if (mkdir(upper, 0755) < 0) {
1138                 r = log_error_errno(errno, "Failed to create %s: %m", upper);
1139                 goto finish;
1140         }
1141         if (mkdir(work, 0755) < 0) {
1142                 r = log_error_errno(errno, "Failed to create %s: %m", work);
1143                 goto finish;
1144         }
1145
1146         /* And now, let's overmount the root dir with an overlayfs that uses the root dir as lower dir. It's kinda nice
1147          * that the kernel allows us to do that without going through some mount point rearrangements. */
1148
1149         escaped_directory = shell_escape(directory, ",:");
1150         escaped_upper = shell_escape(upper, ",:");
1151         escaped_work = shell_escape(work, ",:");
1152         if (!escaped_directory || !escaped_upper || !escaped_work) {
1153                 r = -ENOMEM;
1154                 goto finish;
1155         }
1156
1157         options = strjoina("lowerdir=", escaped_directory, ",upperdir=", escaped_upper, ",workdir=", escaped_work);
1158         r = mount_verbose(LOG_ERR, "overlay", directory, "overlay", 0, options);
1159
1160 finish:
1161         if (tmpfs_mounted)
1162                 (void) umount_verbose(template);
1163
1164         (void) rmdir(template);
1165         return r;
1166 }
1167
1168 int setup_volatile_mode(
1169                 const char *directory,
1170                 VolatileMode mode,
1171                 uid_t uid_shift,
1172                 const char *selinux_apifs_context) {
1173
1174         switch (mode) {
1175
1176         case VOLATILE_YES:
1177                 return setup_volatile_yes(directory, uid_shift, selinux_apifs_context);
1178
1179         case VOLATILE_STATE:
1180                 return setup_volatile_state(directory, uid_shift, selinux_apifs_context);
1181
1182         case VOLATILE_OVERLAY:
1183                 return setup_volatile_overlay(directory, uid_shift, selinux_apifs_context);
1184
1185         default:
1186                 return 0;
1187         }
1188 }
1189
1190 /* Expects *pivot_root_new and *pivot_root_old to be initialised to allocated memory or NULL. */
1191 int pivot_root_parse(char **pivot_root_new, char **pivot_root_old, const char *s) {
1192         _cleanup_free_ char *root_new = NULL, *root_old = NULL;
1193         const char *p = s;
1194         int r;
1195
1196         assert(pivot_root_new);
1197         assert(pivot_root_old);
1198
1199         r = extract_first_word(&p, &root_new, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1200         if (r < 0)
1201                 return r;
1202         if (r == 0)
1203                 return -EINVAL;
1204
1205         if (isempty(p))
1206                 root_old = NULL;
1207         else {
1208                 root_old = strdup(p);
1209                 if (!root_old)
1210                         return -ENOMEM;
1211         }
1212
1213         if (!path_is_absolute(root_new))
1214                 return -EINVAL;
1215         if (root_old && !path_is_absolute(root_old))
1216                 return -EINVAL;
1217
1218         free_and_replace(*pivot_root_new, root_new);
1219         free_and_replace(*pivot_root_old, root_old);
1220
1221         return 0;
1222 }
1223
1224 int setup_pivot_root(const char *directory, const char *pivot_root_new, const char *pivot_root_old) {
1225         _cleanup_free_ char *directory_pivot_root_new = NULL;
1226         _cleanup_free_ char *pivot_tmp_pivot_root_old = NULL;
1227         char pivot_tmp[] = "/tmp/nspawn-pivot-XXXXXX";
1228         bool remove_pivot_tmp = false;
1229         int r;
1230
1231         assert(directory);
1232
1233         if (!pivot_root_new)
1234                 return 0;
1235
1236         /* Pivot pivot_root_new to / and the existing / to pivot_root_old.
1237          * If pivot_root_old is NULL, the existing / disappears.
1238          * This requires a temporary directory, pivot_tmp, which is
1239          * not a child of either.
1240          *
1241          * This is typically used for OSTree-style containers, where
1242          * the root partition contains several sysroots which could be
1243          * run. Normally, one would be chosen by the bootloader and
1244          * pivoted to / by initramfs.
1245          *
1246          * For example, for an OSTree deployment, pivot_root_new
1247          * would be: /ostree/deploy/$os/deploy/$checksum. Note that this
1248          * code doesn’t do the /var mount which OSTree expects: use
1249          * --bind +/sysroot/ostree/deploy/$os/var:/var for that.
1250          *
1251          * So in the OSTree case, we’ll end up with something like:
1252          *  - directory = /tmp/nspawn-root-123456
1253          *  - pivot_root_new = /ostree/deploy/os/deploy/123abc
1254          *  - pivot_root_old = /sysroot
1255          *  - directory_pivot_root_new =
1256          *       /tmp/nspawn-root-123456/ostree/deploy/os/deploy/123abc
1257          *  - pivot_tmp = /tmp/nspawn-pivot-123456
1258          *  - pivot_tmp_pivot_root_old = /tmp/nspawn-pivot-123456/sysroot
1259          *
1260          * Requires all file systems at directory and below to be mounted
1261          * MS_PRIVATE or MS_SLAVE so they can be moved.
1262          */
1263         directory_pivot_root_new = path_join(directory, pivot_root_new);
1264         if (!directory_pivot_root_new)
1265                 return log_oom();
1266
1267         /* Remount directory_pivot_root_new to make it movable. */
1268         r = mount_verbose(LOG_ERR, directory_pivot_root_new, directory_pivot_root_new, NULL, MS_BIND, NULL);
1269         if (r < 0)
1270                 goto done;
1271
1272         if (pivot_root_old) {
1273                 if (!mkdtemp(pivot_tmp)) {
1274                         r = log_error_errno(errno, "Failed to create temporary directory: %m");
1275                         goto done;
1276                 }
1277
1278                 remove_pivot_tmp = true;
1279                 pivot_tmp_pivot_root_old = path_join(pivot_tmp, pivot_root_old);
1280                 if (!pivot_tmp_pivot_root_old) {
1281                         r = log_oom();
1282                         goto done;
1283                 }
1284
1285                 r = mount_verbose(LOG_ERR, directory_pivot_root_new, pivot_tmp, NULL, MS_MOVE, NULL);
1286                 if (r < 0)
1287                         goto done;
1288
1289                 r = mount_verbose(LOG_ERR, directory, pivot_tmp_pivot_root_old, NULL, MS_MOVE, NULL);
1290                 if (r < 0)
1291                         goto done;
1292
1293                 r = mount_verbose(LOG_ERR, pivot_tmp, directory, NULL, MS_MOVE, NULL);
1294                 if (r < 0)
1295                         goto done;
1296         } else {
1297                 r = mount_verbose(LOG_ERR, directory_pivot_root_new, directory, NULL, MS_MOVE, NULL);
1298                 if (r < 0)
1299                         goto done;
1300         }
1301
1302 done:
1303         if (remove_pivot_tmp)
1304                 (void) rmdir(pivot_tmp);
1305
1306         return r;
1307 }