src/nspawn/nspawn-mount.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <sys/mount.h>
   4 #include <linux/magic.h>
   5
   6 #include "alloc-util.h"
   7 #include "escape.h"
   8 #include "fd-util.h"
   9 #include "format-util.h"
  10 #include "fs-util.h"
  11 #include "label.h"
  12 #include "mkdir.h"
  13 #include "mount-util.h"
  14 #include "mountpoint-util.h"
  15 #include "nspawn-mount.h"
  16 #include "parse-util.h"
  17 #include "path-util.h"
  18 #include "rm-rf.h"
  19 #include "set.h"
  20 #include "sort-util.h"
  21 #include "stat-util.h"
  22 #include "string-util.h"
  23 #include "strv.h"
  24 #include "tmpfile-util.h"
  25 #include "user-util.h"
  26
  27 CustomMount* custom_mount_add(CustomMount **l, size_t *n, CustomMountType t) {
  28         CustomMount *c, *ret;
  29
  30         assert(l);
  31         assert(n);
  32         assert(t >= 0);
  33         assert(t < _CUSTOM_MOUNT_TYPE_MAX);
  34
  35         c = reallocarray(*l, *n + 1, sizeof(CustomMount));
  36         if (!c)
  37                 return NULL;
  38
  39         *l = c;
  40         ret = *l + *n;
  41         (*n)++;
  42
  43         *ret = (CustomMount) { .type = t };
  44
  45         return ret;
  46 }
  47
  48 void custom_mount_free_all(CustomMount *l, size_t n) {
  49         size_t i;
  50
  51         for (i = 0; i < n; i++) {
  52                 CustomMount *m = l + i;
  53
  54                 free(m->source);
  55                 free(m->destination);
  56                 free(m->options);
  57
  58                 if (m->work_dir) {
  59                         (void) rm_rf(m->work_dir, REMOVE_ROOT|REMOVE_PHYSICAL);
  60                         free(m->work_dir);
  61                 }
  62
  63                 if (m->rm_rf_tmpdir) {
  64                         (void) rm_rf(m->rm_rf_tmpdir, REMOVE_ROOT|REMOVE_PHYSICAL);
  65                         free(m->rm_rf_tmpdir);
  66                 }
  67
  68                 strv_free(m->lower);
  69                 free(m->type_argument);
  70         }
  71
  72         free(l);
  73 }
  74
  75 static int custom_mount_compare(const CustomMount *a, const CustomMount *b) {
  76         int r;
  77
  78         r = path_compare(a->destination, b->destination);
  79         if (r != 0)
  80                 return r;
  81
  82         return CMP(a->type, b->type);
  83 }
  84
  85 static bool source_path_is_valid(const char *p) {
  86         assert(p);
  87
  88         if (*p == '+')
  89                 p++;
  90
  91         return path_is_absolute(p);
  92 }
  93
  94 static char *resolve_source_path(const char *dest, const char *source) {
  95
  96         if (!source)
  97                 return NULL;
  98
  99         if (source[0] == '+')
 100                 return path_join(dest, source + 1);
 101
 102         return strdup(source);
 103 }
 104
 105 int custom_mount_prepare_all(const char *dest, CustomMount *l, size_t n) {
 106         size_t i;
 107         int r;
 108
 109         /* Prepare all custom mounts. This will make source we know all temporary directories. This is called in the
 110          * parent process, so that we know the temporary directories to remove on exit before we fork off the
 111          * children. */
 112
 113         assert(l || n == 0);
 114
 115         /* Order the custom mounts, and make sure we have a working directory */
 116         typesafe_qsort(l, n, custom_mount_compare);
 117
 118         for (i = 0; i < n; i++) {
 119                 CustomMount *m = l + i;
 120
 121                 /* /proc we mount in the inner child, i.e. when we acquired CLONE_NEWPID. All other mounts we mount
 122                  * already in the outer child, so that the mounts are already established before CLONE_NEWPID and in
 123                  * particular CLONE_NEWUSER. This also means any custom mounts below /proc also need to be mounted in
 124                  * the inner child, not the outer one. Determine this here. */
 125                 m->in_userns = path_startswith(m->destination, "/proc");
 126
 127                 if (m->type == CUSTOM_MOUNT_BIND) {
 128                         if (m->source) {
 129                                 char *s;
 130
 131                                 s = resolve_source_path(dest, m->source);
 132                                 if (!s)
 133                                         return log_oom();
 134
 135                                 free_and_replace(m->source, s);
 136                         } else {
 137                                 /* No source specified? In that case, use a throw-away temporary directory in /var/tmp */
 138
 139                                 m->rm_rf_tmpdir = strdup("/var/tmp/nspawn-temp-XXXXXX");
 140                                 if (!m->rm_rf_tmpdir)
 141                                         return log_oom();
 142
 143                                 if (!mkdtemp(m->rm_rf_tmpdir)) {
 144                                         m->rm_rf_tmpdir = mfree(m->rm_rf_tmpdir);
 145                                         return log_error_errno(errno, "Failed to acquire temporary directory: %m");
 146                                 }
 147
 148                                 m->source = path_join(m->rm_rf_tmpdir, "src");
 149                                 if (!m->source)
 150                                         return log_oom();
 151
 152                                 if (mkdir(m->source, 0755) < 0)
 153                                         return log_error_errno(errno, "Failed to create %s: %m", m->source);
 154                         }
 155                 }
 156
 157                 if (m->type == CUSTOM_MOUNT_OVERLAY) {
 158                         char **j;
 159
 160                         STRV_FOREACH(j, m->lower) {
 161                                 char *s;
 162
 163                                 s = resolve_source_path(dest, *j);
 164                                 if (!s)
 165                                         return log_oom();
 166
 167                                 free_and_replace(*j, s);
 168                         }
 169
 170                         if (m->work_dir) {
 171                                 char *s;
 172
 173                                 s = resolve_source_path(dest, m->work_dir);
 174                                 if (!s)
 175                                         return log_oom();
 176
 177                                 free_and_replace(m->work_dir, s);
 178                         } else {
 179                                 assert(m->source);
 180
 181                                 r = tempfn_random(m->source, NULL, &m->work_dir);
 182                                 if (r < 0)
 183                                         return log_error_errno(r, "Failed to acquire working directory: %m");
 184                         }
 185
 186                         (void) mkdir_label(m->work_dir, 0700);
 187                 }
 188         }
 189
 190         return 0;
 191 }
 192
 193 int bind_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) {
 194         _cleanup_free_ char *source = NULL, *destination = NULL, *opts = NULL;
 195         const char *p = s;
 196         CustomMount *m;
 197         int r;
 198
 199         assert(l);
 200         assert(n);
 201
 202         r = extract_many_words(&p, ":", EXTRACT_DONT_COALESCE_SEPARATORS, &source, &destination, NULL);
 203         if (r < 0)
 204                 return r;
 205         if (r == 0)
 206                 return -EINVAL;
 207         if (r == 1) {
 208                 destination = strdup(source[0] == '+' ? source+1 : source);
 209                 if (!destination)
 210                         return -ENOMEM;
 211         }
 212         if (r == 2 && !isempty(p)) {
 213                 opts = strdup(p);
 214                 if (!opts)
 215                         return -ENOMEM;
 216         }
 217
 218         if (isempty(source))
 219                 source = mfree(source);
 220         else if (!source_path_is_valid(source))
 221                 return -EINVAL;
 222
 223         if (!path_is_absolute(destination))
 224                 return -EINVAL;
 225         if (empty_or_root(destination))
 226                 return -EINVAL;
 227
 228         m = custom_mount_add(l, n, CUSTOM_MOUNT_BIND);
 229         if (!m)
 230                 return -ENOMEM;
 231
 232         m->source = TAKE_PTR(source);
 233         m->destination = TAKE_PTR(destination);
 234         m->read_only = read_only;
 235         m->options = TAKE_PTR(opts);
 236
 237         return 0;
 238 }
 239
 240 int tmpfs_mount_parse(CustomMount **l, size_t *n, const char *s) {
 241         _cleanup_free_ char *path = NULL, *opts = NULL;
 242         const char *p = s;
 243         CustomMount *m;
 244         int r;
 245
 246         assert(l);
 247         assert(n);
 248         assert(s);
 249
 250         r = extract_first_word(&p, &path, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 251         if (r < 0)
 252                 return r;
 253         if (r == 0)
 254                 return -EINVAL;
 255
 256         if (isempty(p))
 257                 opts = strdup("mode=0755");
 258         else
 259                 opts = strdup(p);
 260         if (!opts)
 261                 return -ENOMEM;
 262
 263         if (!path_is_absolute(path))
 264                 return -EINVAL;
 265         if (empty_or_root(path))
 266                 return -EINVAL;
 267
 268         m = custom_mount_add(l, n, CUSTOM_MOUNT_TMPFS);
 269         if (!m)
 270                 return -ENOMEM;
 271
 272         m->destination = TAKE_PTR(path);
 273         m->options = TAKE_PTR(opts);
 274
 275         return 0;
 276 }
 277
 278 int overlay_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) {
 279         _cleanup_free_ char *upper = NULL, *destination = NULL;
 280         _cleanup_strv_free_ char **lower = NULL;
 281         CustomMount *m;
 282         int k;
 283
 284         k = strv_split_extract(&lower, s, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
 285         if (k < 0)
 286                 return k;
 287         if (k < 2)
 288                 return -EADDRNOTAVAIL;
 289         if (k == 2) {
 290                 /* If two parameters are specified, the first one is the lower, the second one the upper directory. And
 291                  * we'll also define the destination mount point the same as the upper. */
 292
 293                 if (!source_path_is_valid(lower[0]) ||
 294                     !source_path_is_valid(lower[1]))
 295                         return -EINVAL;
 296
 297                 upper = TAKE_PTR(lower[1]);
 298
 299                 destination = strdup(upper[0] == '+' ? upper+1 : upper); /* take the destination without "+" prefix */
 300                 if (!destination)
 301                         return -ENOMEM;
 302         } else {
 303                 char **i;
 304
 305                 /* If more than two parameters are specified, the last one is the destination, the second to last one
 306                  * the "upper", and all before that the "lower" directories. */
 307
 308                 destination = lower[k - 1];
 309                 upper = TAKE_PTR(lower[k - 2]);
 310
 311                 STRV_FOREACH(i, lower)
 312                         if (!source_path_is_valid(*i))
 313                                 return -EINVAL;
 314
 315                 /* If the upper directory is unspecified, then let's create it automatically as a throw-away directory
 316                  * in /var/tmp */
 317                 if (isempty(upper))
 318                         upper = mfree(upper);
 319                 else if (!source_path_is_valid(upper))
 320                         return -EINVAL;
 321
 322                 if (!path_is_absolute(destination))
 323                         return -EINVAL;
 324         }
 325
 326         if (empty_or_root(destination))
 327                 return -EINVAL;
 328
 329         m = custom_mount_add(l, n, CUSTOM_MOUNT_OVERLAY);
 330         if (!m)
 331                 return -ENOMEM;
 332
 333         m->destination = TAKE_PTR(destination);
 334         m->source = TAKE_PTR(upper);
 335         m->lower = TAKE_PTR(lower);
 336         m->read_only = read_only;
 337
 338         return 0;
 339 }
 340
 341 int inaccessible_mount_parse(CustomMount **l, size_t *n, const char *s) {
 342         _cleanup_free_ char *path = NULL;
 343         CustomMount *m;
 344
 345         assert(l);
 346         assert(n);
 347         assert(s);
 348
 349         if (!path_is_absolute(s))
 350                 return -EINVAL;
 351
 352         path = strdup(s);
 353         if (!path)
 354                 return -ENOMEM;
 355
 356         m = custom_mount_add(l, n, CUSTOM_MOUNT_INACCESSIBLE);
 357         if (!m)
 358                 return -ENOMEM;
 359
 360         m->destination = TAKE_PTR(path);
 361         return 0;
 362 }
 363
 364 int tmpfs_patch_options(
 365                 const char *options,
 366                 uid_t uid_shift,
 367                 const char *selinux_apifs_context,
 368                 char **ret) {
 369
 370         char *buf = NULL;
 371
 372         if (uid_shift != UID_INVALID) {
 373                 if (asprintf(&buf, "%s%suid=" UID_FMT ",gid=" UID_FMT,
 374                              strempty(options), options ? "," : "",
 375                              uid_shift, uid_shift) < 0)
 376                         return -ENOMEM;
 377
 378                 options = buf;
 379         }
 380
 381 #if HAVE_SELINUX
 382         if (selinux_apifs_context) {
 383                 char *t;
 384
 385                 t = strjoin(strempty(options), options ? "," : "",
 386                             "context=\"", selinux_apifs_context, "\"");
 387                 free(buf);
 388                 if (!t)
 389                         return -ENOMEM;
 390
 391                 buf = t;
 392         }
 393 #endif
 394
 395         if (!buf && options) {
 396                 buf = strdup(options);
 397                 if (!buf)
 398                         return -ENOMEM;
 399         }
 400         *ret = buf;
 401
 402         return !!buf;
 403 }
 404
 405 int mount_sysfs(const char *dest, MountSettingsMask mount_settings) {
 406         const char *full, *top, *x;
 407         int r;
 408         unsigned long extra_flags = 0;
 409
 410         top = prefix_roota(dest, "/sys");
 411         r = path_is_fs_type(top, SYSFS_MAGIC);
 412         if (r < 0)
 413                 return log_error_errno(r, "Failed to determine filesystem type of %s: %m", top);
 414         /* /sys might already be mounted as sysfs by the outer child in the
 415          * !netns case. In this case, it's all good. Don't touch it because we
 416          * don't have the right to do so, see https://github.com/systemd/systemd/issues/1555.
 417          */
 418         if (r > 0)
 419                 return 0;
 420
 421         full = prefix_roota(top, "/full");
 422
 423         (void) mkdir(full, 0755);
 424
 425         if (mount_settings & MOUNT_APPLY_APIVFS_RO)
 426                 extra_flags |= MS_RDONLY;
 427
 428         r = mount_verbose(LOG_ERR, "sysfs", full, "sysfs",
 429                           MS_NOSUID|MS_NOEXEC|MS_NODEV|extra_flags, NULL);
 430         if (r < 0)
 431                 return r;
 432
 433         FOREACH_STRING(x, "block", "bus", "class", "dev", "devices", "kernel") {
 434                 _cleanup_free_ char *from = NULL, *to = NULL;
 435
 436                 from = path_join(full, x);
 437                 if (!from)
 438                         return log_oom();
 439
 440                 to = path_join(top, x);
 441                 if (!to)
 442                         return log_oom();
 443
 444                 (void) mkdir(to, 0755);
 445
 446                 r = mount_verbose(LOG_ERR, from, to, NULL, MS_BIND, NULL);
 447                 if (r < 0)
 448                         return r;
 449
 450                 r = mount_verbose(LOG_ERR, NULL, to, NULL,
 451                                   MS_BIND|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT|extra_flags, NULL);
 452                 if (r < 0)
 453                         return r;
 454         }
 455
 456         r = umount_verbose(full);
 457         if (r < 0)
 458                 return r;
 459
 460         if (rmdir(full) < 0)
 461                 return log_error_errno(errno, "Failed to remove %s: %m", full);
 462
 463         /* Create mountpoint for cgroups. Otherwise we are not allowed since we
 464          * remount /sys read-only.
 465          */
 466         x = prefix_roota(top, "/fs/cgroup");
 467         (void) mkdir_p(x, 0755);
 468
 469         return mount_verbose(LOG_ERR, NULL, top, NULL,
 470                              MS_BIND|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT|extra_flags, NULL);
 471 }
 472
 473 static int mkdir_userns(const char *path, mode_t mode, uid_t uid_shift) {
 474         int r;
 475
 476         assert(path);
 477
 478         r = mkdir_errno_wrapper(path, mode);
 479         if (r < 0 && r != -EEXIST)
 480                 return r;
 481
 482         if (uid_shift == UID_INVALID)
 483                 return 0;
 484
 485         if (lchown(path, uid_shift, uid_shift) < 0)
 486                 return -errno;
 487
 488         return 0;
 489 }
 490
 491 static int mkdir_userns_p(const char *prefix, const char *path, mode_t mode, uid_t uid_shift) {
 492         const char *p, *e;
 493         int r;
 494
 495         assert(path);
 496
 497         if (prefix && !path_startswith(path, prefix))
 498                 return -ENOTDIR;
 499
 500         /* create every parent directory in the path, except the last component */
 501         p = path + strspn(path, "/");
 502         for (;;) {
 503                 char t[strlen(path) + 1];
 504
 505                 e = p + strcspn(p, "/");
 506                 p = e + strspn(e, "/");
 507
 508                 /* Is this the last component? If so, then we're done */
 509                 if (*p == 0)
 510                         break;
 511
 512                 memcpy(t, path, e - path);
 513                 t[e-path] = 0;
 514
 515                 if (prefix && path_startswith(prefix, t))
 516                         continue;
 517
 518                 r = mkdir_userns(t, mode, uid_shift);
 519                 if (r < 0)
 520                         return r;
 521         }
 522
 523         return mkdir_userns(path, mode, uid_shift);
 524 }
 525
 526 int mount_all(const char *dest,
 527               MountSettingsMask mount_settings,
 528               uid_t uid_shift,
 529               const char *selinux_apifs_context) {
 530
 531 #define PROC_INACCESSIBLE_REG(path)                                     \
 532         { "/run/systemd/inaccessible/reg", (path), NULL, NULL, MS_BIND, \
 533           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO }, /* Bind mount first ... */ \
 534         { NULL, (path), NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, \
 535           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO } /* Then, make it r/o */
 536
 537 #define PROC_READ_ONLY(path)                                            \
 538         { (path), (path), NULL, NULL, MS_BIND,                          \
 539           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO }, /* Bind mount first ... */ \
 540         { NULL,   (path), NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, \
 541           MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO } /* Then, make it r/o */
 542
 543         typedef struct MountPoint {
 544                 const char *what;
 545                 const char *where;
 546                 const char *type;
 547                 const char *options;
 548                 unsigned long flags;
 549                 MountSettingsMask mount_settings;
 550         } MountPoint;
 551
 552         static const MountPoint mount_table[] = {
 553                 /* First we list inner child mounts (i.e. mounts applied *after* entering user namespacing) */
 554                 { "proc",            "/proc",           "proc",  NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV,
 555                   MOUNT_FATAL|MOUNT_IN_USERNS },
 556
 557                 { "/proc/sys",       "/proc/sys",       NULL,    NULL,        MS_BIND,
 558                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO },                          /* Bind mount first ... */
 559
 560                 { "/proc/sys/net",   "/proc/sys/net",   NULL,    NULL,        MS_BIND,
 561                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO|MOUNT_APPLY_APIVFS_NETNS }, /* (except for this) */
 562
 563                 { NULL,              "/proc/sys",       NULL,    NULL,        MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 564                   MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_APPLY_APIVFS_RO },                          /* ... then, make it r/o */
 565
 566                 /* Make these files inaccessible to container payloads: they potentially leak information about kernel
 567                  * internals or the host's execution environment to the container */
 568                 PROC_INACCESSIBLE_REG("/proc/kallsyms"),
 569                 PROC_INACCESSIBLE_REG("/proc/kcore"),
 570                 PROC_INACCESSIBLE_REG("/proc/keys"),
 571                 PROC_INACCESSIBLE_REG("/proc/sysrq-trigger"),
 572                 PROC_INACCESSIBLE_REG("/proc/timer_list"),
 573
 574                 /* Make these directories read-only to container payloads: they show hardware information, and in some
 575                  * cases contain tunables the container really shouldn't have access to. */
 576                 PROC_READ_ONLY("/proc/acpi"),
 577                 PROC_READ_ONLY("/proc/apm"),
 578                 PROC_READ_ONLY("/proc/asound"),
 579                 PROC_READ_ONLY("/proc/bus"),
 580                 PROC_READ_ONLY("/proc/fs"),
 581                 PROC_READ_ONLY("/proc/irq"),
 582                 PROC_READ_ONLY("/proc/scsi"),
 583
 584                 { "mqueue",          "/dev/mqueue",     "mqueue", NULL,       MS_NOSUID|MS_NOEXEC|MS_NODEV,
 585                   MOUNT_IN_USERNS },
 586
 587                 /* Then we list outer child mounts (i.e. mounts applied *before* entering user namespacing) */
 588                 { "tmpfs",           "/tmp",            "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 589                   MOUNT_FATAL|MOUNT_APPLY_TMPFS_TMP },
 590                 { "tmpfs",           "/sys",            "tmpfs", "mode=555",  MS_NOSUID|MS_NOEXEC|MS_NODEV,
 591                   MOUNT_FATAL|MOUNT_APPLY_APIVFS_NETNS },
 592                 { "sysfs",           "/sys",            "sysfs", NULL,        MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV,
 593                   MOUNT_FATAL|MOUNT_APPLY_APIVFS_RO },    /* skipped if above was mounted */
 594                 { "sysfs",           "/sys",            "sysfs", NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV,
 595                   MOUNT_FATAL },                          /* skipped if above was mounted */
 596                 { "tmpfs",           "/dev",            "tmpfs", "mode=755",  MS_NOSUID|MS_STRICTATIME,
 597                   MOUNT_FATAL },
 598                 { "tmpfs",           "/dev/shm",        "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 599                   MOUNT_FATAL },
 600                 { "tmpfs",           "/run",            "tmpfs", "mode=755",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,
 601                   MOUNT_FATAL },
 602
 603 #if HAVE_SELINUX
 604                 { "/sys/fs/selinux", "/sys/fs/selinux", NULL,    NULL,        MS_BIND,
 605                   0 },  /* Bind mount first */
 606                 { NULL,              "/sys/fs/selinux", NULL,    NULL,        MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
 607                   0 },  /* Then, make it r/o */
 608 #endif
 609         };
 610
 611         bool use_userns = (mount_settings & MOUNT_USE_USERNS);
 612         bool netns = (mount_settings & MOUNT_APPLY_APIVFS_NETNS);
 613         bool ro = (mount_settings & MOUNT_APPLY_APIVFS_RO);
 614         bool in_userns = (mount_settings & MOUNT_IN_USERNS);
 615         bool tmpfs_tmp = (mount_settings & MOUNT_APPLY_TMPFS_TMP);
 616         size_t k;
 617         int r;
 618
 619         for (k = 0; k < ELEMENTSOF(mount_table); k++) {
 620                 _cleanup_free_ char *where = NULL, *options = NULL;
 621                 const char *o;
 622                 bool fatal = (mount_table[k].mount_settings & MOUNT_FATAL);
 623
 624                 if (in_userns != (bool)(mount_table[k].mount_settings & MOUNT_IN_USERNS))
 625                         continue;
 626
 627                 if (!netns && (bool)(mount_table[k].mount_settings & MOUNT_APPLY_APIVFS_NETNS))
 628                         continue;
 629
 630                 if (!ro && (bool)(mount_table[k].mount_settings & MOUNT_APPLY_APIVFS_RO))
 631                         continue;
 632
 633                 if (!tmpfs_tmp && (bool)(mount_table[k].mount_settings & MOUNT_APPLY_TMPFS_TMP))
 634                         continue;
 635
 636                 r = chase_symlinks(mount_table[k].where, dest, CHASE_NONEXISTENT|CHASE_PREFIX_ROOT, &where);
 637                 if (r < 0)
 638                         return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, mount_table[k].where);
 639
 640                 /* Skip this entry if it is not a remount. */
 641                 if (mount_table[k].what) {
 642                         r = path_is_mount_point(where, NULL, 0);
 643                         if (r < 0 && r != -ENOENT)
 644                                 return log_error_errno(r, "Failed to detect whether %s is a mount point: %m", where);
 645                         if (r > 0)
 646                                 continue;
 647                 }
 648
 649                 r = mkdir_userns_p(dest, where, 0755, (use_userns && !in_userns) ? uid_shift : UID_INVALID);
 650                 if (r < 0 && r != -EEXIST) {
 651                         if (fatal && r != -EROFS)
 652                                 return log_error_errno(r, "Failed to create directory %s: %m", where);
 653
 654                         log_debug_errno(r, "Failed to create directory %s: %m", where);
 655                         /* If we failed mkdir() or chown() due to the root
 656                          * directory being read only, attempt to mount this fs
 657                          * anyway and let mount_verbose log any errors */
 658                         if (r != -EROFS)
 659                                 continue;
 660                 }
 661
 662                 o = mount_table[k].options;
 663                 if (streq_ptr(mount_table[k].type, "tmpfs")) {
 664                         r = tmpfs_patch_options(o, in_userns ? 0 : uid_shift, selinux_apifs_context, &options);
 665                         if (r < 0)
 666                                 return log_oom();
 667                         if (r > 0)
 668                                 o = options;
 669                 }
 670
 671                 r = mount_verbose(fatal ? LOG_ERR : LOG_DEBUG,
 672                                   mount_table[k].what,
 673                                   where,
 674                                   mount_table[k].type,
 675                                   mount_table[k].flags,
 676                                   o);
 677                 if (r < 0 && fatal)
 678                         return r;
 679         }
 680
 681         return 0;
 682 }
 683
 684 static int parse_mount_bind_options(const char *options, unsigned long *mount_flags, char **mount_opts) {
 685         const char *p = options;
 686         unsigned long flags = *mount_flags;
 687         char *opts = NULL;
 688         int r;
 689
 690         assert(options);
 691
 692         for (;;) {
 693                 _cleanup_free_ char *word = NULL;
 694
 695                 r = extract_first_word(&p, &word, ",", 0);
 696                 if (r < 0)
 697                         return log_error_errno(r, "Failed to extract mount option: %m");
 698                 if (r == 0)
 699                         break;
 700
 701                 if (streq(word, "rbind"))
 702                         flags |= MS_REC;
 703                 else if (streq(word, "norbind"))
 704                         flags &= ~MS_REC;
 705                 else {
 706                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 707                                                "Invalid bind mount option: %s",
 708                                                word);
 709                 }
 710         }
 711
 712         *mount_flags = flags;
 713         /* in the future mount_opts will hold string options for mount(2) */
 714         *mount_opts = opts;
 715
 716         return 0;
 717 }
 718
 719 static int mount_bind(const char *dest, CustomMount *m) {
 720         _cleanup_free_ char *mount_opts = NULL, *where = NULL;
 721         unsigned long mount_flags = MS_BIND | MS_REC;
 722         struct stat source_st, dest_st;
 723         int r;
 724
 725         assert(dest);
 726         assert(m);
 727
 728         if (m->options) {
 729                 r = parse_mount_bind_options(m->options, &mount_flags, &mount_opts);
 730                 if (r < 0)
 731                         return r;
 732         }
 733
 734         if (stat(m->source, &source_st) < 0)
 735                 return log_error_errno(errno, "Failed to stat %s: %m", m->source);
 736
 737         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where);
 738         if (r < 0)
 739                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 740         if (r > 0) { /* Path exists already? */
 741
 742                 if (stat(where, &dest_st) < 0)
 743                         return log_error_errno(errno, "Failed to stat %s: %m", where);
 744
 745                 if (S_ISDIR(source_st.st_mode) && !S_ISDIR(dest_st.st_mode))
 746                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 747                                                "Cannot bind mount directory %s on file %s.",
 748                                                m->source, where);
 749
 750                 if (!S_ISDIR(source_st.st_mode) && S_ISDIR(dest_st.st_mode))
 751                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 752                                                "Cannot bind mount file %s on directory %s.",
 753                                                m->source, where);
 754
 755         } else { /* Path doesn't exist yet? */
 756                 r = mkdir_parents_label(where, 0755);
 757                 if (r < 0)
 758                         return log_error_errno(r, "Failed to make parents of %s: %m", where);
 759
 760                 /* Create the mount point. Any non-directory file can be
 761                 * mounted on any non-directory file (regular, fifo, socket,
 762                 * char, block).
 763                 */
 764                 if (S_ISDIR(source_st.st_mode))
 765                         r = mkdir_label(where, 0755);
 766                 else
 767                         r = touch(where);
 768                 if (r < 0)
 769                         return log_error_errno(r, "Failed to create mount point %s: %m", where);
 770         }
 771
 772         r = mount_verbose(LOG_ERR, m->source, where, NULL, mount_flags, mount_opts);
 773         if (r < 0)
 774                 return r;
 775
 776         if (m->read_only) {
 777                 r = bind_remount_recursive(where, MS_RDONLY, MS_RDONLY, NULL);
 778                 if (r < 0)
 779                         return log_error_errno(r, "Read-only bind mount failed: %m");
 780         }
 781
 782         return 0;
 783 }
 784
 785 static int mount_tmpfs(
 786                 const char *dest,
 787                 CustomMount *m,
 788                 bool userns, uid_t uid_shift, uid_t uid_range,
 789                 const char *selinux_apifs_context) {
 790
 791         const char *options;
 792         _cleanup_free_ char *buf = NULL, *where = NULL;
 793         int r;
 794
 795         assert(dest);
 796         assert(m);
 797
 798         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where);
 799         if (r < 0)
 800                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 801         if (r == 0) { /* Doesn't exist yet? */
 802                 r = mkdir_p_label(where, 0755);
 803                 if (r < 0)
 804                         return log_error_errno(r, "Creating mount point for tmpfs %s failed: %m", where);
 805         }
 806
 807         r = tmpfs_patch_options(m->options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
 808         if (r < 0)
 809                 return log_oom();
 810         options = r > 0 ? buf : m->options;
 811
 812         return mount_verbose(LOG_ERR, "tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, options);
 813 }
 814
 815 static char *joined_and_escaped_lower_dirs(char **lower) {
 816         _cleanup_strv_free_ char **sv = NULL;
 817
 818         sv = strv_copy(lower);
 819         if (!sv)
 820                 return NULL;
 821
 822         strv_reverse(sv);
 823
 824         if (!strv_shell_escape(sv, ",:"))
 825                 return NULL;
 826
 827         return strv_join(sv, ":");
 828 }
 829
 830 static int mount_overlay(const char *dest, CustomMount *m) {
 831         _cleanup_free_ char *lower = NULL, *where = NULL, *escaped_source = NULL;
 832         const char *options;
 833         int r;
 834
 835         assert(dest);
 836         assert(m);
 837
 838         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where);
 839         if (r < 0)
 840                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 841         if (r == 0) { /* Doesn't exist yet? */
 842                 r = mkdir_label(where, 0755);
 843                 if (r < 0)
 844                         return log_error_errno(r, "Creating mount point for overlay %s failed: %m", where);
 845         }
 846
 847         (void) mkdir_p_label(m->source, 0755);
 848
 849         lower = joined_and_escaped_lower_dirs(m->lower);
 850         if (!lower)
 851                 return log_oom();
 852
 853         escaped_source = shell_escape(m->source, ",:");
 854         if (!escaped_source)
 855                 return log_oom();
 856
 857         if (m->read_only)
 858                 options = strjoina("lowerdir=", escaped_source, ":", lower);
 859         else {
 860                 _cleanup_free_ char *escaped_work_dir = NULL;
 861
 862                 escaped_work_dir = shell_escape(m->work_dir, ",:");
 863                 if (!escaped_work_dir)
 864                         return log_oom();
 865
 866                 options = strjoina("lowerdir=", lower, ",upperdir=", escaped_source, ",workdir=", escaped_work_dir);
 867         }
 868
 869         return mount_verbose(LOG_ERR, "overlay", where, "overlay", m->read_only ? MS_RDONLY : 0, options);
 870 }
 871
 872 static int mount_inaccessible(const char *dest, CustomMount *m) {
 873         _cleanup_free_ char *where = NULL;
 874         const char *source;
 875         struct stat st;
 876         int r;
 877
 878         assert(dest);
 879         assert(m);
 880
 881         r = chase_symlinks_and_stat(m->destination, dest, CHASE_PREFIX_ROOT, &where, &st);
 882         if (r < 0) {
 883                 log_full_errno(m->graceful ? LOG_DEBUG : LOG_ERR, r, "Failed to resolve %s/%s: %m", dest, m->destination);
 884                 return m->graceful ? 0 : r;
 885         }
 886
 887         assert_se(source = mode_to_inaccessible_node(st.st_mode));
 888
 889         r = mount_verbose(m->graceful ? LOG_DEBUG : LOG_ERR, source, where, NULL, MS_BIND, NULL);
 890         if (r < 0)
 891                 return m->graceful ? 0 : r;
 892
 893         r = mount_verbose(m->graceful ? LOG_DEBUG : LOG_ERR, NULL, where, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, NULL);
 894         if (r < 0) {
 895                 umount_verbose(where);
 896                 return m->graceful ? 0 : r;
 897         }
 898
 899         return 0;
 900 }
 901
 902 static int mount_arbitrary(const char *dest, CustomMount *m) {
 903         _cleanup_free_ char *where = NULL;
 904         int r;
 905
 906         assert(dest);
 907         assert(m);
 908
 909         r = chase_symlinks(m->destination, dest, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &where);
 910         if (r < 0)
 911                 return log_error_errno(r, "Failed to resolve %s/%s: %m", dest, m->destination);
 912         if (r == 0) { /* Doesn't exist yet? */
 913                 r = mkdir_p_label(where, 0755);
 914                 if (r < 0)
 915                         return log_error_errno(r, "Creating mount point for mount %s failed: %m", where);
 916         }
 917
 918         return mount_verbose(LOG_ERR, m->source, where, m->type_argument, 0, m->options);
 919 }
 920
 921 int mount_custom(
 922                 const char *dest,
 923                 CustomMount *mounts, size_t n,
 924                 bool userns, uid_t uid_shift, uid_t uid_range,
 925                 const char *selinux_apifs_context,
 926                 bool in_userns) {
 927
 928         size_t i;
 929         int r;
 930
 931         assert(dest);
 932
 933         for (i = 0; i < n; i++) {
 934                 CustomMount *m = mounts + i;
 935
 936                 if (m->in_userns != in_userns)
 937                         continue;
 938
 939                 switch (m->type) {
 940
 941                 case CUSTOM_MOUNT_BIND:
 942                         r = mount_bind(dest, m);
 943                         break;
 944
 945                 case CUSTOM_MOUNT_TMPFS:
 946                         r = mount_tmpfs(dest, m, userns, uid_shift, uid_range, selinux_apifs_context);
 947                         break;
 948
 949                 case CUSTOM_MOUNT_OVERLAY:
 950                         r = mount_overlay(dest, m);
 951                         break;
 952
 953                 case CUSTOM_MOUNT_INACCESSIBLE:
 954                         r = mount_inaccessible(dest, m);
 955                         break;
 956
 957                 case CUSTOM_MOUNT_ARBITRARY:
 958                         r = mount_arbitrary(dest, m);
 959                         break;
 960
 961                 default:
 962                         assert_not_reached("Unknown custom mount type");
 963                 }
 964
 965                 if (r < 0)
 966                         return r;
 967         }
 968
 969         return 0;
 970 }
 971
 972 static int setup_volatile_state(
 973                 const char *directory,
 974                 bool userns, uid_t uid_shift, uid_t uid_range,
 975                 const char *selinux_apifs_context) {
 976
 977         _cleanup_free_ char *buf = NULL;
 978         const char *p, *options;
 979         int r;
 980
 981         assert(directory);
 982
 983         /* --volatile=state means we simply overmount /var with a tmpfs, and the rest read-only. */
 984
 985         r = bind_remount_recursive(directory, MS_RDONLY, MS_RDONLY, NULL);
 986         if (r < 0)
 987                 return log_error_errno(r, "Failed to remount %s read-only: %m", directory);
 988
 989         p = prefix_roota(directory, "/var");
 990         r = mkdir(p, 0755);
 991         if (r < 0 && errno != EEXIST)
 992                 return log_error_errno(errno, "Failed to create %s: %m", directory);
 993
 994         options = "mode=755";
 995         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
 996         if (r < 0)
 997                 return log_oom();
 998         if (r > 0)
 999                 options = buf;
1000
1001         return mount_verbose(LOG_ERR, "tmpfs", p, "tmpfs", MS_STRICTATIME, options);
1002 }
1003
1004 static int setup_volatile_yes(
1005                 const char *directory,
1006                 bool userns, uid_t uid_shift, uid_t uid_range,
1007                 const char *selinux_apifs_context) {
1008
1009         bool tmpfs_mounted = false, bind_mounted = false;
1010         char template[] = "/tmp/nspawn-volatile-XXXXXX";
1011         _cleanup_free_ char *buf = NULL, *bindir = NULL;
1012         const char *f, *t, *options;
1013         struct stat st;
1014         int r;
1015
1016         assert(directory);
1017
1018         /* --volatile=yes means we mount a tmpfs to the root dir, and the original /usr to use inside it, and
1019          * that read-only. Before we start setting this up let's validate if the image has the /usr merge
1020          * implemented, and let's output a friendly log message if it hasn't. */
1021
1022         bindir = path_join(directory, "/bin");
1023         if (!bindir)
1024                 return log_oom();
1025         if (lstat(bindir, &st) < 0) {
1026                 if (errno != ENOENT)
1027                         return log_error_errno(errno, "Failed to stat /bin directory below image: %m");
1028
1029                 /* ENOENT is fine, just means the image is probably just a naked /usr and we can create the
1030                  * rest. */
1031         } else if (S_ISDIR(st.st_mode))
1032                 return log_error_errno(SYNTHETIC_ERRNO(EISDIR),
1033                                        "Sorry, --volatile=yes mode is not supported with OS images that have not merged /bin/, /sbin/, /lib/, /lib64/ into /usr/. "
1034                                        "Please work with your distribution and help them adopt the merged /usr scheme.");
1035         else if (!S_ISLNK(st.st_mode))
1036                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1037                                        "Error starting image: if --volatile=yes is used /bin must be a symlink (for merged /usr support) or non-existent (in which case a symlink is created automatically).");
1038
1039         if (!mkdtemp(template))
1040                 return log_error_errno(errno, "Failed to create temporary directory: %m");
1041
1042         options = "mode=755";
1043         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
1044         if (r < 0)
1045                 goto fail;
1046         if (r > 0)
1047                 options = buf;
1048
1049         r = mount_verbose(LOG_ERR, "tmpfs", template, "tmpfs", MS_STRICTATIME, options);
1050         if (r < 0)
1051                 goto fail;
1052
1053         tmpfs_mounted = true;
1054
1055         f = prefix_roota(directory, "/usr");
1056         t = prefix_roota(template, "/usr");
1057
1058         r = mkdir(t, 0755);
1059         if (r < 0 && errno != EEXIST) {
1060                 r = log_error_errno(errno, "Failed to create %s: %m", t);
1061                 goto fail;
1062         }
1063
1064         r = mount_verbose(LOG_ERR, f, t, NULL, MS_BIND|MS_REC, NULL);
1065         if (r < 0)
1066                 goto fail;
1067
1068         bind_mounted = true;
1069
1070         r = bind_remount_recursive(t, MS_RDONLY, MS_RDONLY, NULL);
1071         if (r < 0) {
1072                 log_error_errno(r, "Failed to remount %s read-only: %m", t);
1073                 goto fail;
1074         }
1075
1076         r = mount_verbose(LOG_ERR, template, directory, NULL, MS_MOVE, NULL);
1077         if (r < 0)
1078                 goto fail;
1079
1080         (void) rmdir(template);
1081
1082         return 0;
1083
1084 fail:
1085         if (bind_mounted)
1086                 (void) umount_verbose(t);
1087
1088         if (tmpfs_mounted)
1089                 (void) umount_verbose(template);
1090         (void) rmdir(template);
1091         return r;
1092 }
1093
1094 static int setup_volatile_overlay(
1095                 const char *directory,
1096                 bool userns, uid_t uid_shift, uid_t uid_range,
1097                 const char *selinux_apifs_context) {
1098
1099         _cleanup_free_ char *buf = NULL, *escaped_directory = NULL, *escaped_upper = NULL, *escaped_work = NULL;
1100         char template[] = "/tmp/nspawn-volatile-XXXXXX";
1101         const char *upper, *work, *options;
1102         bool tmpfs_mounted = false;
1103         int r;
1104
1105         assert(directory);
1106
1107         /* --volatile=overlay means we mount an overlayfs to the root dir. */
1108
1109         if (!mkdtemp(template))
1110                 return log_error_errno(errno, "Failed to create temporary directory: %m");
1111
1112         options = "mode=755";
1113         r = tmpfs_patch_options(options, uid_shift == 0 ? UID_INVALID : uid_shift, selinux_apifs_context, &buf);
1114         if (r < 0)
1115                 goto finish;
1116         if (r > 0)
1117                 options = buf;
1118
1119         r = mount_verbose(LOG_ERR, "tmpfs", template, "tmpfs", MS_STRICTATIME, options);
1120         if (r < 0)
1121                 goto finish;
1122
1123         tmpfs_mounted = true;
1124
1125         upper = strjoina(template, "/upper");
1126         work = strjoina(template, "/work");
1127
1128         if (mkdir(upper, 0755) < 0) {
1129                 r = log_error_errno(errno, "Failed to create %s: %m", upper);
1130                 goto finish;
1131         }
1132         if (mkdir(work, 0755) < 0) {
1133                 r = log_error_errno(errno, "Failed to create %s: %m", work);
1134                 goto finish;
1135         }
1136
1137         /* And now, let's overmount the root dir with an overlayfs that uses the root dir as lower dir. It's kinda nice
1138          * that the kernel allows us to do that without going through some mount point rearrangements. */
1139
1140         escaped_directory = shell_escape(directory, ",:");
1141         escaped_upper = shell_escape(upper, ",:");
1142         escaped_work = shell_escape(work, ",:");
1143         if (!escaped_directory || !escaped_upper || !escaped_work) {
1144                 r = -ENOMEM;
1145                 goto finish;
1146         }
1147
1148         options = strjoina("lowerdir=", escaped_directory, ",upperdir=", escaped_upper, ",workdir=", escaped_work);
1149         r = mount_verbose(LOG_ERR, "overlay", directory, "overlay", 0, options);
1150
1151 finish:
1152         if (tmpfs_mounted)
1153                 (void) umount_verbose(template);
1154
1155         (void) rmdir(template);
1156         return r;
1157 }
1158
1159 int setup_volatile_mode(
1160                 const char *directory,
1161                 VolatileMode mode,
1162                 bool userns, uid_t uid_shift, uid_t uid_range,
1163                 const char *selinux_apifs_context) {
1164
1165         switch (mode) {
1166
1167         case VOLATILE_YES:
1168                 return setup_volatile_yes(directory, userns, uid_shift, uid_range, selinux_apifs_context);
1169
1170         case VOLATILE_STATE:
1171                 return setup_volatile_state(directory, userns, uid_shift, uid_range, selinux_apifs_context);
1172
1173         case VOLATILE_OVERLAY:
1174                 return setup_volatile_overlay(directory, userns, uid_shift, uid_range, selinux_apifs_context);
1175
1176         default:
1177                 return 0;
1178         }
1179 }
1180
1181 /* Expects *pivot_root_new and *pivot_root_old to be initialised to allocated memory or NULL. */
1182 int pivot_root_parse(char **pivot_root_new, char **pivot_root_old, const char *s) {
1183         _cleanup_free_ char *root_new = NULL, *root_old = NULL;
1184         const char *p = s;
1185         int r;
1186
1187         assert(pivot_root_new);
1188         assert(pivot_root_old);
1189
1190         r = extract_first_word(&p, &root_new, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
1191         if (r < 0)
1192                 return r;
1193         if (r == 0)
1194                 return -EINVAL;
1195
1196         if (isempty(p))
1197                 root_old = NULL;
1198         else {
1199                 root_old = strdup(p);
1200                 if (!root_old)
1201                         return -ENOMEM;
1202         }
1203
1204         if (!path_is_absolute(root_new))
1205                 return -EINVAL;
1206         if (root_old && !path_is_absolute(root_old))
1207                 return -EINVAL;
1208
1209         free_and_replace(*pivot_root_new, root_new);
1210         free_and_replace(*pivot_root_old, root_old);
1211
1212         return 0;
1213 }
1214
1215 int setup_pivot_root(const char *directory, const char *pivot_root_new, const char *pivot_root_old) {
1216         _cleanup_free_ char *directory_pivot_root_new = NULL;
1217         _cleanup_free_ char *pivot_tmp_pivot_root_old = NULL;
1218         char pivot_tmp[] = "/tmp/nspawn-pivot-XXXXXX";
1219         bool remove_pivot_tmp = false;
1220         int r;
1221
1222         assert(directory);
1223
1224         if (!pivot_root_new)
1225                 return 0;
1226
1227         /* Pivot pivot_root_new to / and the existing / to pivot_root_old.
1228          * If pivot_root_old is NULL, the existing / disappears.
1229          * This requires a temporary directory, pivot_tmp, which is
1230          * not a child of either.
1231          *
1232          * This is typically used for OSTree-style containers, where
1233          * the root partition contains several sysroots which could be
1234          * run. Normally, one would be chosen by the bootloader and
1235          * pivoted to / by initramfs.
1236          *
1237          * For example, for an OSTree deployment, pivot_root_new
1238          * would be: /ostree/deploy/$os/deploy/$checksum. Note that this
1239          * code doesn’t do the /var mount which OSTree expects: use
1240          * --bind +/sysroot/ostree/deploy/$os/var:/var for that.
1241          *
1242          * So in the OSTree case, we’ll end up with something like:
1243          *  - directory = /tmp/nspawn-root-123456
1244          *  - pivot_root_new = /ostree/deploy/os/deploy/123abc
1245          *  - pivot_root_old = /sysroot
1246          *  - directory_pivot_root_new =
1247          *       /tmp/nspawn-root-123456/ostree/deploy/os/deploy/123abc
1248          *  - pivot_tmp = /tmp/nspawn-pivot-123456
1249          *  - pivot_tmp_pivot_root_old = /tmp/nspawn-pivot-123456/sysroot
1250          *
1251          * Requires all file systems at directory and below to be mounted
1252          * MS_PRIVATE or MS_SLAVE so they can be moved.
1253          */
1254         directory_pivot_root_new = path_join(directory, pivot_root_new);
1255         if (!directory_pivot_root_new)
1256                 return log_oom();
1257
1258         /* Remount directory_pivot_root_new to make it movable. */
1259         r = mount_verbose(LOG_ERR, directory_pivot_root_new, directory_pivot_root_new, NULL, MS_BIND, NULL);
1260         if (r < 0)
1261                 goto done;
1262
1263         if (pivot_root_old) {
1264                 if (!mkdtemp(pivot_tmp)) {
1265                         r = log_error_errno(errno, "Failed to create temporary directory: %m");
1266                         goto done;
1267                 }
1268
1269                 remove_pivot_tmp = true;
1270                 pivot_tmp_pivot_root_old = path_join(pivot_tmp, pivot_root_old);
1271                 if (!pivot_tmp_pivot_root_old) {
1272                         r = log_oom();
1273                         goto done;
1274                 }
1275
1276                 r = mount_verbose(LOG_ERR, directory_pivot_root_new, pivot_tmp, NULL, MS_MOVE, NULL);
1277                 if (r < 0)
1278                         goto done;
1279
1280                 r = mount_verbose(LOG_ERR, directory, pivot_tmp_pivot_root_old, NULL, MS_MOVE, NULL);
1281                 if (r < 0)
1282                         goto done;
1283
1284                 r = mount_verbose(LOG_ERR, pivot_tmp, directory, NULL, MS_MOVE, NULL);
1285                 if (r < 0)
1286                         goto done;
1287         } else {
1288                 r = mount_verbose(LOG_ERR, directory_pivot_root_new, directory, NULL, MS_MOVE, NULL);
1289                 if (r < 0)
1290                         goto done;
1291         }
1292
1293 done:
1294         if (remove_pivot_tmp)
1295                 (void) rmdir(pivot_tmp);
1296
1297         return r;
1298 }