1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
4 This file is part of systemd.
6 Copyright 2010 Lennart Poettering
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
11 (at your option) any later version.
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Lesser General Public License for more details.
18 You should have received a copy of the GNU Lesser General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
25 #include <sys/types.h>
26 #include <sys/mount.h>
31 #include <sys/prctl.h>
35 #include <sys/socket.h>
36 #include <linux/netlink.h>
38 #include <linux/veth.h>
39 #include <sys/personality.h>
40 #include <linux/loop.h>
44 #include <selinux/selinux.h>
52 #include <blkid/blkid.h>
55 #include "sd-daemon.h"
58 #include "sd-netlink.h"
59 #include "random-util.h"
66 #include "cgroup-util.h"
68 #include "path-util.h"
69 #include "loopback-setup.h"
70 #include "dev-setup.h"
75 #include "bus-error.h"
78 #include "netlink-util.h"
79 #include "udev-util.h"
80 #include "blkid-util.h"
82 #include "siphash24.h"
84 #include "base-filesystem.h"
86 #include "event-util.h"
87 #include "capability.h"
89 #include "btrfs-util.h"
90 #include "machine-image.h"
92 #include "in-addr-util.h"
93 #include "firewall-util.h"
94 #include "local-addresses.h"
95 #include "formats-util.h"
96 #include "process-util.h"
97 #include "terminal-util.h"
98 #include "hostname-util.h"
99 #include "signal-util.h"
102 #include "seccomp-util.h"
105 typedef struct ExposePort
{
108 uint16_t container_port
;
109 LIST_FIELDS(struct ExposePort
, ports
);
112 typedef enum ContainerStatus
{
113 CONTAINER_TERMINATED
,
117 typedef enum LinkJournal
{
124 typedef enum Volatile
{
130 typedef enum CustomMountType
{
133 CUSTOM_MOUNT_OVERLAY
,
136 typedef struct CustomMount
{
137 CustomMountType type
;
139 char *source
; /* for overlayfs this is the upper directory */
146 static char *arg_directory
= NULL
;
147 static char *arg_template
= NULL
;
148 static char *arg_user
= NULL
;
149 static sd_id128_t arg_uuid
= {};
150 static char *arg_machine
= NULL
;
151 static const char *arg_selinux_context
= NULL
;
152 static const char *arg_selinux_apifs_context
= NULL
;
153 static const char *arg_slice
= NULL
;
154 static bool arg_private_network
= false;
155 static bool arg_read_only
= false;
156 static bool arg_boot
= false;
157 static bool arg_ephemeral
= false;
158 static LinkJournal arg_link_journal
= LINK_AUTO
;
159 static bool arg_link_journal_try
= false;
160 static uint64_t arg_retain
=
161 (1ULL << CAP_CHOWN
) |
162 (1ULL << CAP_DAC_OVERRIDE
) |
163 (1ULL << CAP_DAC_READ_SEARCH
) |
164 (1ULL << CAP_FOWNER
) |
165 (1ULL << CAP_FSETID
) |
166 (1ULL << CAP_IPC_OWNER
) |
168 (1ULL << CAP_LEASE
) |
169 (1ULL << CAP_LINUX_IMMUTABLE
) |
170 (1ULL << CAP_NET_BIND_SERVICE
) |
171 (1ULL << CAP_NET_BROADCAST
) |
172 (1ULL << CAP_NET_RAW
) |
173 (1ULL << CAP_SETGID
) |
174 (1ULL << CAP_SETFCAP
) |
175 (1ULL << CAP_SETPCAP
) |
176 (1ULL << CAP_SETUID
) |
177 (1ULL << CAP_SYS_ADMIN
) |
178 (1ULL << CAP_SYS_CHROOT
) |
179 (1ULL << CAP_SYS_NICE
) |
180 (1ULL << CAP_SYS_PTRACE
) |
181 (1ULL << CAP_SYS_TTY_CONFIG
) |
182 (1ULL << CAP_SYS_RESOURCE
) |
183 (1ULL << CAP_SYS_BOOT
) |
184 (1ULL << CAP_AUDIT_WRITE
) |
185 (1ULL << CAP_AUDIT_CONTROL
) |
187 static CustomMount
*arg_custom_mounts
= NULL
;
188 static unsigned arg_n_custom_mounts
= 0;
189 static char **arg_setenv
= NULL
;
190 static bool arg_quiet
= false;
191 static bool arg_share_system
= false;
192 static bool arg_register
= true;
193 static bool arg_keep_unit
= false;
194 static char **arg_network_interfaces
= NULL
;
195 static char **arg_network_macvlan
= NULL
;
196 static char **arg_network_ipvlan
= NULL
;
197 static bool arg_network_veth
= false;
198 static const char *arg_network_bridge
= NULL
;
199 static unsigned long arg_personality
= PERSONALITY_INVALID
;
200 static char *arg_image
= NULL
;
201 static Volatile arg_volatile
= VOLATILE_NO
;
202 static ExposePort
*arg_expose_ports
= NULL
;
203 static char **arg_property
= NULL
;
204 static uid_t arg_uid_shift
= UID_INVALID
, arg_uid_range
= 0x10000U
;
205 static bool arg_userns
= false;
206 static int arg_kill_signal
= 0;
207 static bool arg_unified_cgroup_hierarchy
= false;
209 static void help(void) {
210 printf("%s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
211 "Spawn a minimal namespace container for debugging, testing and building.\n\n"
212 " -h --help Show this help\n"
213 " --version Print version string\n"
214 " -q --quiet Do not show status information\n"
215 " -D --directory=PATH Root directory for the container\n"
216 " --template=PATH Initialize root directory from template directory,\n"
218 " -x --ephemeral Run container with snapshot of root directory, and\n"
219 " remove it after exit\n"
220 " -i --image=PATH File system device or disk image for the container\n"
221 " -b --boot Boot up full system (i.e. invoke init)\n"
222 " -u --user=USER Run the command under specified user or uid\n"
223 " -M --machine=NAME Set the machine name for the container\n"
224 " --uuid=UUID Set a specific machine UUID for the container\n"
225 " -S --slice=SLICE Place the container in the specified slice\n"
226 " --property=NAME=VALUE Set scope unit property\n"
227 " --private-users[=UIDBASE[:NUIDS]]\n"
228 " Run within user namespace\n"
229 " --private-network Disable network in container\n"
230 " --network-interface=INTERFACE\n"
231 " Assign an existing network interface to the\n"
233 " --network-macvlan=INTERFACE\n"
234 " Create a macvlan network interface based on an\n"
235 " existing network interface to the container\n"
236 " --network-ipvlan=INTERFACE\n"
237 " Create a ipvlan network interface based on an\n"
238 " existing network interface to the container\n"
239 " -n --network-veth Add a virtual ethernet connection between host\n"
241 " --network-bridge=INTERFACE\n"
242 " Add a virtual ethernet connection between host\n"
243 " and container and add it to an existing bridge on\n"
245 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
246 " Expose a container IP port on the host\n"
247 " -Z --selinux-context=SECLABEL\n"
248 " Set the SELinux security context to be used by\n"
249 " processes in the container\n"
250 " -L --selinux-apifs-context=SECLABEL\n"
251 " Set the SELinux security context to be used by\n"
252 " API/tmpfs file systems in the container\n"
253 " --capability=CAP In addition to the default, retain specified\n"
255 " --drop-capability=CAP Drop the specified capability from the default set\n"
256 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
257 " --link-journal=MODE Link up guest journal, one of no, auto, guest, host,\n"
258 " try-guest, try-host\n"
259 " -j Equivalent to --link-journal=try-guest\n"
260 " --read-only Mount the root directory read-only\n"
261 " --bind=PATH[:PATH[:OPTIONS]]\n"
262 " Bind mount a file or directory from the host into\n"
264 " --bind-ro=PATH[:PATH[:OPTIONS]\n"
265 " Similar, but creates a read-only bind mount\n"
266 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
267 " --overlay=PATH[:PATH...]:PATH\n"
268 " Create an overlay mount from the host to \n"
270 " --overlay-ro=PATH[:PATH...]:PATH\n"
271 " Similar, but creates a read-only overlay mount\n"
272 " --setenv=NAME=VALUE Pass an environment variable to PID 1\n"
273 " --share-system Share system namespaces with host\n"
274 " --register=BOOLEAN Register container as machine\n"
275 " --keep-unit Do not register a scope for the machine, reuse\n"
276 " the service unit nspawn is running in\n"
277 " --volatile[=MODE] Run the system in volatile mode\n"
278 , program_invocation_short_name
);
281 static CustomMount
* custom_mount_add(CustomMountType t
) {
282 CustomMount
*c
, *ret
;
284 c
= realloc(arg_custom_mounts
, (arg_n_custom_mounts
+ 1) * sizeof(CustomMount
));
288 arg_custom_mounts
= c
;
289 ret
= arg_custom_mounts
+ arg_n_custom_mounts
;
290 arg_n_custom_mounts
++;
292 *ret
= (CustomMount
) { .type
= t
};
297 static void custom_mount_free_all(void) {
300 for (i
= 0; i
< arg_n_custom_mounts
; i
++) {
301 CustomMount
*m
= &arg_custom_mounts
[i
];
304 free(m
->destination
);
308 (void) rm_rf(m
->work_dir
, REMOVE_ROOT
|REMOVE_PHYSICAL
);
315 arg_custom_mounts
= mfree(arg_custom_mounts
);
316 arg_n_custom_mounts
= 0;
319 static int custom_mount_compare(const void *a
, const void *b
) {
320 const CustomMount
*x
= a
, *y
= b
;
323 r
= path_compare(x
->destination
, y
->destination
);
327 if (x
->type
< y
->type
)
329 if (x
->type
> y
->type
)
335 static int custom_mounts_prepare(void) {
339 /* Ensure the mounts are applied prefix first. */
340 qsort_safe(arg_custom_mounts
, arg_n_custom_mounts
, sizeof(CustomMount
), custom_mount_compare
);
342 /* Allocate working directories for the overlay file systems that need it */
343 for (i
= 0; i
< arg_n_custom_mounts
; i
++) {
344 CustomMount
*m
= &arg_custom_mounts
[i
];
346 if (arg_userns
&& arg_uid_shift
== UID_INVALID
&& path_equal(m
->destination
, "/")) {
347 log_error("--private-users with automatic UID shift may not be combined with custom root mounts.");
351 if (m
->type
!= CUSTOM_MOUNT_OVERLAY
)
360 r
= tempfn_random(m
->source
, NULL
, &m
->work_dir
);
362 return log_error_errno(r
, "Failed to generate work directory from %s: %m", m
->source
);
368 static int set_sanitized_path(char **b
, const char *path
) {
374 p
= canonicalize_file_name(path
);
379 p
= path_make_absolute_cwd(path
);
385 *b
= path_kill_slashes(p
);
389 static int detect_unified_cgroup_hierarchy(void) {
393 /* Allow the user to control whether the unified hierarchy is used */
394 e
= getenv("UNIFIED_CGROUP_HIERARCHY");
396 r
= parse_boolean(e
);
398 return log_error_errno(r
, "Failed to parse $UNIFIED_CGROUP_HIERARCHY.");
400 arg_unified_cgroup_hierarchy
= r
;
404 /* Otherwise inherit the default from the host system */
407 return log_error_errno(r
, "Failed to determine whether the unified cgroups hierarchy is used: %m");
409 arg_unified_cgroup_hierarchy
= r
;
413 static int parse_argv(int argc
, char *argv
[]) {
432 ARG_NETWORK_INTERFACE
,
444 static const struct option options
[] = {
445 { "help", no_argument
, NULL
, 'h' },
446 { "version", no_argument
, NULL
, ARG_VERSION
},
447 { "directory", required_argument
, NULL
, 'D' },
448 { "template", required_argument
, NULL
, ARG_TEMPLATE
},
449 { "ephemeral", no_argument
, NULL
, 'x' },
450 { "user", required_argument
, NULL
, 'u' },
451 { "private-network", no_argument
, NULL
, ARG_PRIVATE_NETWORK
},
452 { "boot", no_argument
, NULL
, 'b' },
453 { "uuid", required_argument
, NULL
, ARG_UUID
},
454 { "read-only", no_argument
, NULL
, ARG_READ_ONLY
},
455 { "capability", required_argument
, NULL
, ARG_CAPABILITY
},
456 { "drop-capability", required_argument
, NULL
, ARG_DROP_CAPABILITY
},
457 { "link-journal", required_argument
, NULL
, ARG_LINK_JOURNAL
},
458 { "bind", required_argument
, NULL
, ARG_BIND
},
459 { "bind-ro", required_argument
, NULL
, ARG_BIND_RO
},
460 { "tmpfs", required_argument
, NULL
, ARG_TMPFS
},
461 { "overlay", required_argument
, NULL
, ARG_OVERLAY
},
462 { "overlay-ro", required_argument
, NULL
, ARG_OVERLAY_RO
},
463 { "machine", required_argument
, NULL
, 'M' },
464 { "slice", required_argument
, NULL
, 'S' },
465 { "setenv", required_argument
, NULL
, ARG_SETENV
},
466 { "selinux-context", required_argument
, NULL
, 'Z' },
467 { "selinux-apifs-context", required_argument
, NULL
, 'L' },
468 { "quiet", no_argument
, NULL
, 'q' },
469 { "share-system", no_argument
, NULL
, ARG_SHARE_SYSTEM
},
470 { "register", required_argument
, NULL
, ARG_REGISTER
},
471 { "keep-unit", no_argument
, NULL
, ARG_KEEP_UNIT
},
472 { "network-interface", required_argument
, NULL
, ARG_NETWORK_INTERFACE
},
473 { "network-macvlan", required_argument
, NULL
, ARG_NETWORK_MACVLAN
},
474 { "network-ipvlan", required_argument
, NULL
, ARG_NETWORK_IPVLAN
},
475 { "network-veth", no_argument
, NULL
, 'n' },
476 { "network-bridge", required_argument
, NULL
, ARG_NETWORK_BRIDGE
},
477 { "personality", required_argument
, NULL
, ARG_PERSONALITY
},
478 { "image", required_argument
, NULL
, 'i' },
479 { "volatile", optional_argument
, NULL
, ARG_VOLATILE
},
480 { "port", required_argument
, NULL
, 'p' },
481 { "property", required_argument
, NULL
, ARG_PROPERTY
},
482 { "private-users", optional_argument
, NULL
, ARG_PRIVATE_USERS
},
483 { "kill-signal", required_argument
, NULL
, ARG_KILL_SIGNAL
},
488 uint64_t plus
= 0, minus
= 0;
493 while ((c
= getopt_long(argc
, argv
, "+hD:u:bL:M:jS:Z:qi:xp:n", options
, NULL
)) >= 0)
502 puts(PACKAGE_STRING
);
503 puts(SYSTEMD_FEATURES
);
507 r
= set_sanitized_path(&arg_directory
, optarg
);
509 return log_error_errno(r
, "Invalid root directory: %m");
514 r
= set_sanitized_path(&arg_template
, optarg
);
516 return log_error_errno(r
, "Invalid template directory: %m");
521 r
= set_sanitized_path(&arg_image
, optarg
);
523 return log_error_errno(r
, "Invalid image path: %m");
528 arg_ephemeral
= true;
532 r
= free_and_strdup(&arg_user
, optarg
);
538 case ARG_NETWORK_BRIDGE
:
539 arg_network_bridge
= optarg
;
544 arg_network_veth
= true;
545 arg_private_network
= true;
548 case ARG_NETWORK_INTERFACE
:
549 if (strv_extend(&arg_network_interfaces
, optarg
) < 0)
552 arg_private_network
= true;
555 case ARG_NETWORK_MACVLAN
:
556 if (strv_extend(&arg_network_macvlan
, optarg
) < 0)
559 arg_private_network
= true;
562 case ARG_NETWORK_IPVLAN
:
563 if (strv_extend(&arg_network_ipvlan
, optarg
) < 0)
568 case ARG_PRIVATE_NETWORK
:
569 arg_private_network
= true;
577 r
= sd_id128_from_string(optarg
, &arg_uuid
);
579 log_error("Invalid UUID: %s", optarg
);
590 arg_machine
= mfree(arg_machine
);
592 if (!machine_name_is_valid(optarg
)) {
593 log_error("Invalid machine name: %s", optarg
);
597 r
= free_and_strdup(&arg_machine
, optarg
);
605 arg_selinux_context
= optarg
;
609 arg_selinux_apifs_context
= optarg
;
613 arg_read_only
= true;
617 case ARG_DROP_CAPABILITY
: {
618 const char *state
, *word
;
621 FOREACH_WORD_SEPARATOR(word
, length
, optarg
, ",", state
) {
622 _cleanup_free_
char *t
;
624 t
= strndup(word
, length
);
628 if (streq(t
, "all")) {
629 if (c
== ARG_CAPABILITY
)
630 plus
= (uint64_t) -1;
632 minus
= (uint64_t) -1;
636 cap
= capability_from_name(t
);
638 log_error("Failed to parse capability %s.", t
);
642 if (c
== ARG_CAPABILITY
)
643 plus
|= 1ULL << (uint64_t) cap
;
645 minus
|= 1ULL << (uint64_t) cap
;
653 arg_link_journal
= LINK_GUEST
;
654 arg_link_journal_try
= true;
657 case ARG_LINK_JOURNAL
:
658 if (streq(optarg
, "auto")) {
659 arg_link_journal
= LINK_AUTO
;
660 arg_link_journal_try
= false;
661 } else if (streq(optarg
, "no")) {
662 arg_link_journal
= LINK_NO
;
663 arg_link_journal_try
= false;
664 } else if (streq(optarg
, "guest")) {
665 arg_link_journal
= LINK_GUEST
;
666 arg_link_journal_try
= false;
667 } else if (streq(optarg
, "host")) {
668 arg_link_journal
= LINK_HOST
;
669 arg_link_journal_try
= false;
670 } else if (streq(optarg
, "try-guest")) {
671 arg_link_journal
= LINK_GUEST
;
672 arg_link_journal_try
= true;
673 } else if (streq(optarg
, "try-host")) {
674 arg_link_journal
= LINK_HOST
;
675 arg_link_journal_try
= true;
677 log_error("Failed to parse link journal mode %s", optarg
);
685 const char *current
= optarg
;
686 _cleanup_free_
char *source
= NULL
, *destination
= NULL
, *opts
= NULL
;
689 r
= extract_many_words(¤t
, ":", EXTRACT_DONT_COALESCE_SEPARATORS
, &source
, &destination
, &opts
, NULL
);
692 destination
= strdup(source
);
699 log_error("Invalid bind mount specification: %s", optarg
);
703 if (!source
|| !destination
)
706 if (!path_is_absolute(source
) || !path_is_absolute(destination
)) {
707 log_error("Invalid bind mount specification: %s", optarg
);
711 m
= custom_mount_add(CUSTOM_MOUNT_BIND
);
716 m
->destination
= destination
;
717 m
->read_only
= c
== ARG_BIND_RO
;
720 source
= destination
= opts
= NULL
;
726 const char *current
= optarg
;
727 _cleanup_free_
char *path
= NULL
, *opts
= NULL
;
730 r
= extract_first_word(¤t
, &path
, ":", EXTRACT_DONT_COALESCE_SEPARATORS
);
734 log_error("Invalid tmpfs specification: %s", optarg
);
738 opts
= strdup(current
);
740 opts
= strdup("mode=0755");
745 if (!path_is_absolute(path
)) {
746 log_error("Invalid tmpfs specification: %s", optarg
);
750 m
= custom_mount_add(CUSTOM_MOUNT_TMPFS
);
754 m
->destination
= path
;
763 case ARG_OVERLAY_RO
: {
764 _cleanup_free_
char *upper
= NULL
, *destination
= NULL
;
765 _cleanup_strv_free_
char **lower
= NULL
;
770 r
= strv_split_extract(&lower
, optarg
, ":", EXTRACT_DONT_COALESCE_SEPARATORS
);
774 log_error("Invalid overlay specification: %s", optarg
);
778 STRV_FOREACH(i
, lower
) {
779 if (!path_is_absolute(*i
)) {
780 log_error("Overlay path %s is not absolute.", *i
);
788 log_error("--overlay= needs at least two colon-separated directories specified.");
793 /* If two parameters are specified,
794 * the first one is the lower, the
795 * second one the upper directory. And
796 * we'll also define the destination
797 * mount point the same as the upper. */
801 destination
= strdup(upper
);
806 upper
= lower
[n
- 2];
807 destination
= lower
[n
- 1];
811 m
= custom_mount_add(CUSTOM_MOUNT_OVERLAY
);
815 m
->destination
= destination
;
818 m
->read_only
= c
== ARG_OVERLAY_RO
;
820 upper
= destination
= NULL
;
829 if (!env_assignment_is_valid(optarg
)) {
830 log_error("Environment variable assignment '%s' is not valid.", optarg
);
834 n
= strv_env_set(arg_setenv
, optarg
);
838 strv_free(arg_setenv
);
847 case ARG_SHARE_SYSTEM
:
848 arg_share_system
= true;
852 r
= parse_boolean(optarg
);
854 log_error("Failed to parse --register= argument: %s", optarg
);
862 arg_keep_unit
= true;
865 case ARG_PERSONALITY
:
867 arg_personality
= personality_from_string(optarg
);
868 if (arg_personality
== PERSONALITY_INVALID
) {
869 log_error("Unknown or unsupported personality '%s'.", optarg
);
878 arg_volatile
= VOLATILE_YES
;
880 r
= parse_boolean(optarg
);
882 if (streq(optarg
, "state"))
883 arg_volatile
= VOLATILE_STATE
;
885 log_error("Failed to parse --volatile= argument: %s", optarg
);
889 arg_volatile
= r
? VOLATILE_YES
: VOLATILE_NO
;
895 const char *split
, *e
;
896 uint16_t container_port
, host_port
;
900 if ((e
= startswith(optarg
, "tcp:")))
901 protocol
= IPPROTO_TCP
;
902 else if ((e
= startswith(optarg
, "udp:")))
903 protocol
= IPPROTO_UDP
;
906 protocol
= IPPROTO_TCP
;
909 split
= strchr(e
, ':');
911 char v
[split
- e
+ 1];
913 memcpy(v
, e
, split
- e
);
916 r
= safe_atou16(v
, &host_port
);
917 if (r
< 0 || host_port
<= 0) {
918 log_error("Failed to parse host port: %s", optarg
);
922 r
= safe_atou16(split
+ 1, &container_port
);
924 r
= safe_atou16(e
, &container_port
);
925 host_port
= container_port
;
928 if (r
< 0 || container_port
<= 0) {
929 log_error("Failed to parse host port: %s", optarg
);
933 LIST_FOREACH(ports
, p
, arg_expose_ports
) {
934 if (p
->protocol
== protocol
&& p
->host_port
== host_port
) {
935 log_error("Duplicate port specification: %s", optarg
);
940 p
= new(ExposePort
, 1);
944 p
->protocol
= protocol
;
945 p
->host_port
= host_port
;
946 p
->container_port
= container_port
;
948 LIST_PREPEND(ports
, arg_expose_ports
, p
);
954 if (strv_extend(&arg_property
, optarg
) < 0)
959 case ARG_PRIVATE_USERS
:
961 _cleanup_free_
char *buffer
= NULL
;
962 const char *range
, *shift
;
964 range
= strchr(optarg
, ':');
966 buffer
= strndup(optarg
, range
- optarg
);
972 if (safe_atou32(range
, &arg_uid_range
) < 0 || arg_uid_range
<= 0) {
973 log_error("Failed to parse UID range: %s", range
);
979 if (parse_uid(shift
, &arg_uid_shift
) < 0) {
980 log_error("Failed to parse UID: %s", optarg
);
988 case ARG_KILL_SIGNAL
:
989 arg_kill_signal
= signal_from_string_try_harder(optarg
);
990 if (arg_kill_signal
< 0) {
991 log_error("Cannot parse signal: %s", optarg
);
1001 assert_not_reached("Unhandled option");
1004 if (arg_share_system
)
1005 arg_register
= false;
1007 if (arg_boot
&& arg_share_system
) {
1008 log_error("--boot and --share-system may not be combined.");
1012 if (arg_keep_unit
&& cg_pid_get_owner_uid(0, NULL
) >= 0) {
1013 log_error("--keep-unit may not be used when invoked from a user session.");
1017 if (arg_directory
&& arg_image
) {
1018 log_error("--directory= and --image= may not be combined.");
1022 if (arg_template
&& arg_image
) {
1023 log_error("--template= and --image= may not be combined.");
1027 if (arg_template
&& !(arg_directory
|| arg_machine
)) {
1028 log_error("--template= needs --directory= or --machine=.");
1032 if (arg_ephemeral
&& arg_template
) {
1033 log_error("--ephemeral and --template= may not be combined.");
1037 if (arg_ephemeral
&& arg_image
) {
1038 log_error("--ephemeral and --image= may not be combined.");
1042 if (arg_ephemeral
&& !IN_SET(arg_link_journal
, LINK_NO
, LINK_AUTO
)) {
1043 log_error("--ephemeral and --link-journal= may not be combined.");
1047 if (arg_volatile
!= VOLATILE_NO
&& arg_read_only
) {
1048 log_error("Cannot combine --read-only with --volatile. Note that --volatile already implies a read-only base hierarchy.");
1052 if (arg_expose_ports
&& !arg_private_network
) {
1053 log_error("Cannot use --port= without private networking.");
1057 if (arg_userns
&& access("/proc/self/uid_map", F_OK
) < 0)
1058 return log_error_errno(EOPNOTSUPP
, "--private-users= is not supported, kernel compiled without user namespace support.");
1060 arg_retain
= (arg_retain
| plus
| (arg_private_network
? 1ULL << CAP_NET_ADMIN
: 0)) & ~minus
;
1062 if (arg_boot
&& arg_kill_signal
<= 0)
1063 arg_kill_signal
= SIGRTMIN
+3;
1065 r
= detect_unified_cgroup_hierarchy();
1072 static int tmpfs_patch_options(const char *options
, char **ret
) {
1075 if (arg_userns
&& arg_uid_shift
!= 0) {
1076 assert(arg_uid_shift
!= UID_INVALID
);
1079 (void) asprintf(&buf
, "%s,uid=" UID_FMT
",gid=" UID_FMT
, options
, arg_uid_shift
, arg_uid_shift
);
1081 (void) asprintf(&buf
, "uid=" UID_FMT
",gid=" UID_FMT
, arg_uid_shift
, arg_uid_shift
);
1089 if (arg_selinux_apifs_context
) {
1093 t
= strjoin(options
, ",context=\"", arg_selinux_apifs_context
, "\"", NULL
);
1095 t
= strjoin("context=\"", arg_selinux_apifs_context
, "\"", NULL
);
1110 static int mount_all(const char *dest
, bool userns
) {
1112 typedef struct MountPoint
{
1116 const char *options
;
1117 unsigned long flags
;
1122 static const MountPoint mount_table
[] = {
1123 { "proc", "/proc", "proc", NULL
, MS_NOSUID
|MS_NOEXEC
|MS_NODEV
, true, true },
1124 { "/proc/sys", "/proc/sys", NULL
, NULL
, MS_BIND
, true, true }, /* Bind mount first */
1125 { NULL
, "/proc/sys", NULL
, NULL
, MS_BIND
|MS_RDONLY
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_REMOUNT
, true, true }, /* Then, make it r/o */
1126 { "sysfs", "/sys", "sysfs", NULL
, MS_RDONLY
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
, true, false },
1127 { "tmpfs", "/dev", "tmpfs", "mode=755", MS_NOSUID
|MS_STRICTATIME
, true, false },
1128 { "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID
|MS_NODEV
|MS_STRICTATIME
, true, false },
1129 { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID
|MS_NODEV
|MS_STRICTATIME
, true, false },
1130 { "tmpfs", "/tmp", "tmpfs", "mode=1777", MS_STRICTATIME
, true, false },
1132 { "/sys/fs/selinux", "/sys/fs/selinux", NULL
, NULL
, MS_BIND
, false, false }, /* Bind mount first */
1133 { NULL
, "/sys/fs/selinux", NULL
, NULL
, MS_BIND
|MS_RDONLY
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_REMOUNT
, false, false }, /* Then, make it r/o */
1140 for (k
= 0; k
< ELEMENTSOF(mount_table
); k
++) {
1141 _cleanup_free_
char *where
= NULL
, *options
= NULL
;
1144 if (userns
!= mount_table
[k
].userns
)
1147 where
= prefix_root(dest
, mount_table
[k
].where
);
1151 r
= path_is_mount_point(where
, AT_SYMLINK_FOLLOW
);
1152 if (r
< 0 && r
!= -ENOENT
)
1153 return log_error_errno(r
, "Failed to detect whether %s is a mount point: %m", where
);
1155 /* Skip this entry if it is not a remount. */
1156 if (mount_table
[k
].what
&& r
> 0)
1159 r
= mkdir_p(where
, 0755);
1161 if (mount_table
[k
].fatal
)
1162 return log_error_errno(r
, "Failed to create directory %s: %m", where
);
1164 log_warning_errno(r
, "Failed to create directory %s: %m", where
);
1168 o
= mount_table
[k
].options
;
1169 if (streq_ptr(mount_table
[k
].type
, "tmpfs")) {
1170 r
= tmpfs_patch_options(o
, &options
);
1177 if (mount(mount_table
[k
].what
,
1179 mount_table
[k
].type
,
1180 mount_table
[k
].flags
,
1183 if (mount_table
[k
].fatal
)
1184 return log_error_errno(errno
, "mount(%s) failed: %m", where
);
1186 log_warning_errno(errno
, "mount(%s) failed, ignoring: %m", where
);
1193 static int parse_mount_bind_options(const char *options
, unsigned long *mount_flags
, char **mount_opts
) {
1194 const char *p
= options
;
1195 unsigned long flags
= *mount_flags
;
1201 _cleanup_free_
char *word
= NULL
;
1202 int r
= extract_first_word(&p
, &word
, ",", 0);
1204 return log_error_errno(r
, "Failed to extract mount option: %m");
1208 if (streq(word
, "rbind"))
1210 else if (streq(word
, "norbind"))
1213 log_error("Invalid bind mount option: %s", word
);
1218 *mount_flags
= flags
;
1219 /* in the future mount_opts will hold string options for mount(2) */
1225 static int mount_bind(const char *dest
, CustomMount
*m
) {
1226 struct stat source_st
, dest_st
;
1228 unsigned long mount_flags
= MS_BIND
| MS_REC
;
1229 _cleanup_free_
char *mount_opts
= NULL
;
1235 r
= parse_mount_bind_options(m
->options
, &mount_flags
, &mount_opts
);
1240 if (stat(m
->source
, &source_st
) < 0)
1241 return log_error_errno(errno
, "Failed to stat %s: %m", m
->source
);
1243 where
= prefix_roota(dest
, m
->destination
);
1245 if (stat(where
, &dest_st
) >= 0) {
1246 if (S_ISDIR(source_st
.st_mode
) && !S_ISDIR(dest_st
.st_mode
)) {
1247 log_error("Cannot bind mount directory %s on file %s.", m
->source
, where
);
1251 if (!S_ISDIR(source_st
.st_mode
) && S_ISDIR(dest_st
.st_mode
)) {
1252 log_error("Cannot bind mount file %s on directory %s.", m
->source
, where
);
1256 } else if (errno
== ENOENT
) {
1257 r
= mkdir_parents_label(where
, 0755);
1259 return log_error_errno(r
, "Failed to make parents of %s: %m", where
);
1261 log_error_errno(errno
, "Failed to stat %s: %m", where
);
1265 /* Create the mount point. Any non-directory file can be
1266 * mounted on any non-directory file (regular, fifo, socket,
1269 if (S_ISDIR(source_st
.st_mode
))
1270 r
= mkdir_label(where
, 0755);
1273 if (r
< 0 && r
!= -EEXIST
)
1274 return log_error_errno(r
, "Failed to create mount point %s: %m", where
);
1276 if (mount(m
->source
, where
, NULL
, mount_flags
, mount_opts
) < 0)
1277 return log_error_errno(errno
, "mount(%s) failed: %m", where
);
1280 r
= bind_remount_recursive(where
, true);
1282 return log_error_errno(r
, "Read-only bind mount failed: %m");
1288 static int mount_tmpfs(const char *dest
, CustomMount
*m
) {
1289 const char *where
, *options
;
1290 _cleanup_free_
char *buf
= NULL
;
1296 where
= prefix_roota(dest
, m
->destination
);
1298 r
= mkdir_p_label(where
, 0755);
1299 if (r
< 0 && r
!= -EEXIST
)
1300 return log_error_errno(r
, "Creating mount point for tmpfs %s failed: %m", where
);
1302 r
= tmpfs_patch_options(m
->options
, &buf
);
1305 options
= r
> 0 ? buf
: m
->options
;
1307 if (mount("tmpfs", where
, "tmpfs", MS_NODEV
|MS_STRICTATIME
, options
) < 0)
1308 return log_error_errno(errno
, "tmpfs mount to %s failed: %m", where
);
1313 static char *joined_and_escaped_lower_dirs(char * const *lower
) {
1314 _cleanup_strv_free_
char **sv
= NULL
;
1316 sv
= strv_copy(lower
);
1322 if (!strv_shell_escape(sv
, ",:"))
1325 return strv_join(sv
, ":");
1328 static int mount_overlay(const char *dest
, CustomMount
*m
) {
1329 _cleanup_free_
char *lower
= NULL
;
1330 const char *where
, *options
;
1336 where
= prefix_roota(dest
, m
->destination
);
1338 r
= mkdir_label(where
, 0755);
1339 if (r
< 0 && r
!= -EEXIST
)
1340 return log_error_errno(r
, "Creating mount point for overlay %s failed: %m", where
);
1342 (void) mkdir_p_label(m
->source
, 0755);
1344 lower
= joined_and_escaped_lower_dirs(m
->lower
);
1349 _cleanup_free_
char *escaped_source
= NULL
;
1351 escaped_source
= shell_escape(m
->source
, ",:");
1352 if (!escaped_source
)
1355 options
= strjoina("lowerdir=", escaped_source
, ":", lower
);
1357 _cleanup_free_
char *escaped_source
= NULL
, *escaped_work_dir
= NULL
;
1359 assert(m
->work_dir
);
1360 (void) mkdir_label(m
->work_dir
, 0700);
1362 escaped_source
= shell_escape(m
->source
, ",:");
1363 if (!escaped_source
)
1365 escaped_work_dir
= shell_escape(m
->work_dir
, ",:");
1366 if (!escaped_work_dir
)
1369 options
= strjoina("lowerdir=", lower
, ",upperdir=", escaped_source
, ",workdir=", escaped_work_dir
);
1372 if (mount("overlay", where
, "overlay", m
->read_only
? MS_RDONLY
: 0, options
) < 0)
1373 return log_error_errno(errno
, "overlay mount to %s failed: %m", where
);
1378 static int mount_custom(const char *dest
) {
1384 for (i
= 0; i
< arg_n_custom_mounts
; i
++) {
1385 CustomMount
*m
= &arg_custom_mounts
[i
];
1389 case CUSTOM_MOUNT_BIND
:
1390 r
= mount_bind(dest
, m
);
1393 case CUSTOM_MOUNT_TMPFS
:
1394 r
= mount_tmpfs(dest
, m
);
1397 case CUSTOM_MOUNT_OVERLAY
:
1398 r
= mount_overlay(dest
, m
);
1402 assert_not_reached("Unknown custom mount type");
1412 static int mount_legacy_cgroup_hierarchy(const char *dest
, const char *controller
, const char *hierarchy
, bool read_only
) {
1416 to
= strjoina(dest
, "/sys/fs/cgroup/", hierarchy
);
1418 r
= path_is_mount_point(to
, 0);
1419 if (r
< 0 && r
!= -ENOENT
)
1420 return log_error_errno(r
, "Failed to determine if %s is mounted already: %m", to
);
1426 /* The superblock mount options of the mount point need to be
1427 * identical to the hosts', and hence writable... */
1428 if (mount("cgroup", to
, "cgroup", MS_NOSUID
|MS_NOEXEC
|MS_NODEV
, controller
) < 0)
1429 return log_error_errno(errno
, "Failed to mount to %s: %m", to
);
1431 /* ... hence let's only make the bind mount read-only, not the
1434 if (mount(NULL
, to
, NULL
, MS_BIND
|MS_REMOUNT
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_RDONLY
, NULL
) < 0)
1435 return log_error_errno(errno
, "Failed to remount %s read-only: %m", to
);
1440 static int mount_legacy_cgroups(const char *dest
) {
1441 _cleanup_set_free_free_ Set
*controllers
= NULL
;
1442 const char *cgroup_root
;
1445 cgroup_root
= prefix_roota(dest
, "/sys/fs/cgroup");
1447 /* Mount a tmpfs to /sys/fs/cgroup if it's not mounted there yet. */
1448 r
= path_is_mount_point(cgroup_root
, AT_SYMLINK_FOLLOW
);
1450 return log_error_errno(r
, "Failed to determine if /sys/fs/cgroup is already mounted: %m");
1452 _cleanup_free_
char *options
= NULL
;
1454 r
= tmpfs_patch_options("mode=755", &options
);
1458 if (mount("tmpfs", cgroup_root
, "tmpfs", MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_STRICTATIME
, options
) < 0)
1459 return log_error_errno(errno
, "Failed to mount /sys/fs/cgroup: %m");
1462 if (cg_unified() > 0)
1463 goto skip_controllers
;
1465 controllers
= set_new(&string_hash_ops
);
1469 r
= cg_kernel_controllers(controllers
);
1471 return log_error_errno(r
, "Failed to determine cgroup controllers: %m");
1474 _cleanup_free_
char *controller
= NULL
, *origin
= NULL
, *combined
= NULL
;
1476 controller
= set_steal_first(controllers
);
1480 origin
= prefix_root("/sys/fs/cgroup/", controller
);
1484 r
= readlink_malloc(origin
, &combined
);
1486 /* Not a symbolic link, but directly a single cgroup hierarchy */
1488 r
= mount_legacy_cgroup_hierarchy(dest
, controller
, controller
, true);
1493 return log_error_errno(r
, "Failed to read link %s: %m", origin
);
1495 _cleanup_free_
char *target
= NULL
;
1497 target
= prefix_root(dest
, origin
);
1501 /* A symbolic link, a combination of controllers in one hierarchy */
1503 if (!filename_is_valid(combined
)) {
1504 log_warning("Ignoring invalid combined hierarchy %s.", combined
);
1508 r
= mount_legacy_cgroup_hierarchy(dest
, combined
, combined
, true);
1512 r
= symlink_idempotent(combined
, target
);
1514 log_error("Invalid existing symlink for combined hierarchy");
1518 return log_error_errno(r
, "Failed to create symlink for combined hierarchy: %m");
1523 r
= mount_legacy_cgroup_hierarchy(dest
, "none,name=systemd,xattr", "systemd", false);
1527 if (mount(NULL
, cgroup_root
, NULL
, MS_REMOUNT
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_STRICTATIME
|MS_RDONLY
, "mode=755") < 0)
1528 return log_error_errno(errno
, "Failed to remount %s read-only: %m", cgroup_root
);
1533 static int mount_unified_cgroups(const char *dest
) {
1539 p
= strjoina(dest
, "/sys/fs/cgroup");
1541 r
= path_is_mount_point(p
, AT_SYMLINK_FOLLOW
);
1543 return log_error_errno(r
, "Failed to determine if %s is mounted already: %m", p
);
1545 p
= strjoina(dest
, "/sys/fs/cgroup/cgroup.procs");
1546 if (access(p
, F_OK
) >= 0)
1548 if (errno
!= ENOENT
)
1549 return log_error_errno(errno
, "Failed to determine if mount point %s contains the unified cgroup hierarchy: %m", p
);
1551 log_error("%s is already mounted but not a unified cgroup hierarchy. Refusing.", p
);
1555 if (mount("cgroup", p
, "cgroup", MS_NOSUID
|MS_NOEXEC
|MS_NODEV
, "__DEVEL__sane_behavior") < 0)
1556 return log_error_errno(errno
, "Failed to mount unified cgroup hierarchy to %s: %m", p
);
1561 static int mount_cgroups(const char *dest
) {
1562 if (arg_unified_cgroup_hierarchy
)
1563 return mount_unified_cgroups(dest
);
1565 return mount_legacy_cgroups(dest
);
1568 static int mount_systemd_cgroup_writable(const char *dest
) {
1569 _cleanup_free_
char *own_cgroup_path
= NULL
;
1570 const char *systemd_root
, *systemd_own
;
1575 r
= cg_pid_get_path(NULL
, 0, &own_cgroup_path
);
1577 return log_error_errno(r
, "Failed to determine our own cgroup path: %m");
1579 /* If we are living in the top-level, then there's nothing to do... */
1580 if (path_equal(own_cgroup_path
, "/"))
1583 if (arg_unified_cgroup_hierarchy
) {
1584 systemd_own
= strjoina(dest
, "/sys/fs/cgroup", own_cgroup_path
);
1585 systemd_root
= prefix_roota(dest
, "/sys/fs/cgroup");
1587 systemd_own
= strjoina(dest
, "/sys/fs/cgroup/systemd", own_cgroup_path
);
1588 systemd_root
= prefix_roota(dest
, "/sys/fs/cgroup/systemd");
1591 /* Make our own cgroup a (writable) bind mount */
1592 if (mount(systemd_own
, systemd_own
, NULL
, MS_BIND
, NULL
) < 0)
1593 return log_error_errno(errno
, "Failed to turn %s into a bind mount: %m", own_cgroup_path
);
1595 /* And then remount the systemd cgroup root read-only */
1596 if (mount(NULL
, systemd_root
, NULL
, MS_BIND
|MS_REMOUNT
|MS_NOSUID
|MS_NOEXEC
|MS_NODEV
|MS_RDONLY
, NULL
) < 0)
1597 return log_error_errno(errno
, "Failed to mount cgroup root read-only: %m");
1602 static int userns_lchown(const char *p
, uid_t uid
, gid_t gid
) {
1608 if (uid
== UID_INVALID
&& gid
== GID_INVALID
)
1611 if (uid
!= UID_INVALID
) {
1612 uid
+= arg_uid_shift
;
1614 if (uid
< arg_uid_shift
|| uid
>= arg_uid_shift
+ arg_uid_range
)
1618 if (gid
!= GID_INVALID
) {
1619 gid
+= (gid_t
) arg_uid_shift
;
1621 if (gid
< (gid_t
) arg_uid_shift
|| gid
>= (gid_t
) (arg_uid_shift
+ arg_uid_range
))
1625 if (lchown(p
, uid
, gid
) < 0)
1631 static int userns_mkdir(const char *root
, const char *path
, mode_t mode
, uid_t uid
, gid_t gid
) {
1634 q
= prefix_roota(root
, path
);
1635 if (mkdir(q
, mode
) < 0) {
1636 if (errno
== EEXIST
)
1641 return userns_lchown(q
, uid
, gid
);
1644 static int setup_timezone(const char *dest
) {
1645 _cleanup_free_
char *p
= NULL
, *q
= NULL
;
1646 const char *where
, *check
, *what
;
1652 /* Fix the timezone, if possible */
1653 r
= readlink_malloc("/etc/localtime", &p
);
1655 log_warning("/etc/localtime is not a symlink, not updating container timezone.");
1659 z
= path_startswith(p
, "../usr/share/zoneinfo/");
1661 z
= path_startswith(p
, "/usr/share/zoneinfo/");
1663 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
1667 where
= prefix_roota(dest
, "/etc/localtime");
1668 r
= readlink_malloc(where
, &q
);
1670 y
= path_startswith(q
, "../usr/share/zoneinfo/");
1672 y
= path_startswith(q
, "/usr/share/zoneinfo/");
1674 /* Already pointing to the right place? Then do nothing .. */
1675 if (y
&& streq(y
, z
))
1679 check
= strjoina("/usr/share/zoneinfo/", z
);
1680 check
= prefix_root(dest
, check
);
1681 if (laccess(check
, F_OK
) < 0) {
1682 log_warning("Timezone %s does not exist in container, not updating container timezone.", z
);
1687 if (r
< 0 && errno
!= ENOENT
) {
1688 log_error_errno(errno
, "Failed to remove existing timezone info %s in container: %m", where
);
1692 what
= strjoina("../usr/share/zoneinfo/", z
);
1693 if (symlink(what
, where
) < 0) {
1694 log_error_errno(errno
, "Failed to correct timezone of container: %m");
1698 r
= userns_lchown(where
, 0, 0);
1700 return log_warning_errno(r
, "Failed to chown /etc/localtime: %m");
1705 static int setup_resolv_conf(const char *dest
) {
1706 const char *where
= NULL
;
1711 if (arg_private_network
)
1714 /* Fix resolv.conf, if possible */
1715 where
= prefix_roota(dest
, "/etc/resolv.conf");
1717 r
= copy_file("/etc/resolv.conf", where
, O_TRUNC
|O_NOFOLLOW
, 0644, 0);
1719 /* If the file already exists as symlink, let's
1720 * suppress the warning, under the assumption that
1721 * resolved or something similar runs inside and the
1722 * symlink points there.
1724 * If the disk image is read-only, there's also no
1725 * point in complaining.
1727 log_full_errno(IN_SET(r
, -ELOOP
, -EROFS
) ? LOG_DEBUG
: LOG_WARNING
, r
,
1728 "Failed to copy /etc/resolv.conf to %s: %m", where
);
1732 r
= userns_lchown(where
, 0, 0);
1734 log_warning_errno(r
, "Failed to chown /etc/resolv.conf: %m");
1739 static int setup_volatile_state(const char *directory
) {
1740 _cleanup_free_
char *buf
= NULL
;
1741 const char *p
, *options
;
1746 if (arg_volatile
!= VOLATILE_STATE
)
1749 /* --volatile=state means we simply overmount /var
1750 with a tmpfs, and the rest read-only. */
1752 r
= bind_remount_recursive(directory
, true);
1754 return log_error_errno(r
, "Failed to remount %s read-only: %m", directory
);
1756 p
= prefix_roota(directory
, "/var");
1758 if (r
< 0 && errno
!= EEXIST
)
1759 return log_error_errno(errno
, "Failed to create %s: %m", directory
);
1761 options
= "mode=755";
1762 r
= tmpfs_patch_options(options
, &buf
);
1768 if (mount("tmpfs", p
, "tmpfs", MS_STRICTATIME
, options
) < 0)
1769 return log_error_errno(errno
, "Failed to mount tmpfs to /var: %m");
1774 static int setup_volatile(const char *directory
) {
1775 bool tmpfs_mounted
= false, bind_mounted
= false;
1776 char template[] = "/tmp/nspawn-volatile-XXXXXX";
1777 _cleanup_free_
char *buf
= NULL
;
1778 const char *f
, *t
, *options
;
1783 if (arg_volatile
!= VOLATILE_YES
)
1786 /* --volatile=yes means we mount a tmpfs to the root dir, and
1787 the original /usr to use inside it, and that read-only. */
1789 if (!mkdtemp(template))
1790 return log_error_errno(errno
, "Failed to create temporary directory: %m");
1792 options
= "mode=755";
1793 r
= tmpfs_patch_options(options
, &buf
);
1799 if (mount("tmpfs", template, "tmpfs", MS_STRICTATIME
, options
) < 0) {
1800 r
= log_error_errno(errno
, "Failed to mount tmpfs for root directory: %m");
1804 tmpfs_mounted
= true;
1806 f
= prefix_roota(directory
, "/usr");
1807 t
= prefix_roota(template, "/usr");
1810 if (r
< 0 && errno
!= EEXIST
) {
1811 r
= log_error_errno(errno
, "Failed to create %s: %m", t
);
1815 if (mount(f
, t
, NULL
, MS_BIND
|MS_REC
, NULL
) < 0) {
1816 r
= log_error_errno(errno
, "Failed to create /usr bind mount: %m");
1820 bind_mounted
= true;
1822 r
= bind_remount_recursive(t
, true);
1824 log_error_errno(r
, "Failed to remount %s read-only: %m", t
);
1828 if (mount(template, directory
, NULL
, MS_MOVE
, NULL
) < 0) {
1829 r
= log_error_errno(errno
, "Failed to move root mount: %m");
1833 (void) rmdir(template);
1842 (void) umount(template);
1843 (void) rmdir(template);
1847 static char* id128_format_as_uuid(sd_id128_t id
, char s
[37]) {
1851 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
1852 SD_ID128_FORMAT_VAL(id
));
1857 static int setup_boot_id(const char *dest
) {
1858 const char *from
, *to
;
1859 sd_id128_t rnd
= {};
1863 if (arg_share_system
)
1866 /* Generate a new randomized boot ID, so that each boot-up of
1867 * the container gets a new one */
1869 from
= prefix_roota(dest
, "/run/proc-sys-kernel-random-boot-id");
1870 to
= prefix_roota(dest
, "/proc/sys/kernel/random/boot_id");
1872 r
= sd_id128_randomize(&rnd
);
1874 return log_error_errno(r
, "Failed to generate random boot id: %m");
1876 id128_format_as_uuid(rnd
, as_uuid
);
1878 r
= write_string_file(from
, as_uuid
, WRITE_STRING_FILE_CREATE
);
1880 return log_error_errno(r
, "Failed to write boot id: %m");
1882 if (mount(from
, to
, NULL
, MS_BIND
, NULL
) < 0)
1883 r
= log_error_errno(errno
, "Failed to bind mount boot id: %m");
1884 else if (mount(NULL
, to
, NULL
, MS_BIND
|MS_REMOUNT
|MS_RDONLY
|MS_NOSUID
|MS_NODEV
, NULL
) < 0)
1885 log_warning_errno(errno
, "Failed to make boot id read-only: %m");
1891 static int copy_devnodes(const char *dest
) {
1893 static const char devnodes
[] =
1904 _cleanup_umask_ mode_t u
;
1910 /* Create /dev/net, so that we can create /dev/net/tun in it */
1911 if (userns_mkdir(dest
, "/dev/net", 0755, 0, 0) < 0)
1912 return log_error_errno(r
, "Failed to create /dev/net directory: %m");
1914 NULSTR_FOREACH(d
, devnodes
) {
1915 _cleanup_free_
char *from
= NULL
, *to
= NULL
;
1918 from
= strappend("/dev/", d
);
1919 to
= prefix_root(dest
, from
);
1921 if (stat(from
, &st
) < 0) {
1923 if (errno
!= ENOENT
)
1924 return log_error_errno(errno
, "Failed to stat %s: %m", from
);
1926 } else if (!S_ISCHR(st
.st_mode
) && !S_ISBLK(st
.st_mode
)) {
1928 log_error("%s is not a char or block device, cannot copy.", from
);
1932 if (mknod(to
, st
.st_mode
, st
.st_rdev
) < 0) {
1934 return log_error_errno(errno
, "mknod(%s) failed: %m", to
);
1936 /* Some systems abusively restrict mknod but
1937 * allow bind mounts. */
1940 return log_error_errno(r
, "touch (%s) failed: %m", to
);
1941 if (mount(from
, to
, NULL
, MS_BIND
, NULL
) < 0)
1942 return log_error_errno(errno
, "Both mknod and bind mount (%s) failed: %m", to
);
1945 r
= userns_lchown(to
, 0, 0);
1947 return log_error_errno(r
, "chown() of device node %s failed: %m", to
);
1954 static int setup_pts(const char *dest
) {
1955 _cleanup_free_
char *options
= NULL
;
1959 if (arg_selinux_apifs_context
)
1960 (void) asprintf(&options
,
1961 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT
",context=\"%s\"",
1962 arg_uid_shift
+ TTY_GID
,
1963 arg_selinux_apifs_context
);
1966 (void) asprintf(&options
,
1967 "newinstance,ptmxmode=0666,mode=620,gid=" GID_FMT
,
1968 arg_uid_shift
+ TTY_GID
);
1973 /* Mount /dev/pts itself */
1974 p
= prefix_roota(dest
, "/dev/pts");
1975 if (mkdir(p
, 0755) < 0)
1976 return log_error_errno(errno
, "Failed to create /dev/pts: %m");
1977 if (mount("devpts", p
, "devpts", MS_NOSUID
|MS_NOEXEC
, options
) < 0)
1978 return log_error_errno(errno
, "Failed to mount /dev/pts: %m");
1979 if (userns_lchown(p
, 0, 0) < 0)
1980 return log_error_errno(errno
, "Failed to chown /dev/pts: %m");
1982 /* Create /dev/ptmx symlink */
1983 p
= prefix_roota(dest
, "/dev/ptmx");
1984 if (symlink("pts/ptmx", p
) < 0)
1985 return log_error_errno(errno
, "Failed to create /dev/ptmx symlink: %m");
1986 if (userns_lchown(p
, 0, 0) < 0)
1987 return log_error_errno(errno
, "Failed to chown /dev/ptmx: %m");
1989 /* And fix /dev/pts/ptmx ownership */
1990 p
= prefix_roota(dest
, "/dev/pts/ptmx");
1991 if (userns_lchown(p
, 0, 0) < 0)
1992 return log_error_errno(errno
, "Failed to chown /dev/pts/ptmx: %m");
1997 static int setup_dev_console(const char *dest
, const char *console
) {
1998 _cleanup_umask_ mode_t u
;
2007 r
= chmod_and_chown(console
, 0600, arg_uid_shift
, arg_uid_shift
);
2009 return log_error_errno(r
, "Failed to correct access mode for TTY: %m");
2011 /* We need to bind mount the right tty to /dev/console since
2012 * ptys can only exist on pts file systems. To have something
2013 * to bind mount things on we create a empty regular file. */
2015 to
= prefix_roota(dest
, "/dev/console");
2018 return log_error_errno(r
, "touch() for /dev/console failed: %m");
2020 if (mount(console
, to
, NULL
, MS_BIND
, NULL
) < 0)
2021 return log_error_errno(errno
, "Bind mount for /dev/console failed: %m");
2026 static int setup_kmsg(const char *dest
, int kmsg_socket
) {
2027 const char *from
, *to
;
2028 _cleanup_umask_ mode_t u
;
2031 struct cmsghdr cmsghdr
;
2032 uint8_t buf
[CMSG_SPACE(sizeof(int))];
2034 struct msghdr mh
= {
2035 .msg_control
= &control
,
2036 .msg_controllen
= sizeof(control
),
2038 struct cmsghdr
*cmsg
;
2040 assert(kmsg_socket
>= 0);
2044 /* We create the kmsg FIFO as /run/kmsg, but immediately
2045 * delete it after bind mounting it to /proc/kmsg. While FIFOs
2046 * on the reading side behave very similar to /proc/kmsg,
2047 * their writing side behaves differently from /dev/kmsg in
2048 * that writing blocks when nothing is reading. In order to
2049 * avoid any problems with containers deadlocking due to this
2050 * we simply make /dev/kmsg unavailable to the container. */
2051 from
= prefix_roota(dest
, "/run/kmsg");
2052 to
= prefix_roota(dest
, "/proc/kmsg");
2054 if (mkfifo(from
, 0600) < 0)
2055 return log_error_errno(errno
, "mkfifo() for /run/kmsg failed: %m");
2056 if (mount(from
, to
, NULL
, MS_BIND
, NULL
) < 0)
2057 return log_error_errno(errno
, "Bind mount for /proc/kmsg failed: %m");
2059 fd
= open(from
, O_RDWR
|O_NDELAY
|O_CLOEXEC
);
2061 return log_error_errno(errno
, "Failed to open fifo: %m");
2063 cmsg
= CMSG_FIRSTHDR(&mh
);
2064 cmsg
->cmsg_level
= SOL_SOCKET
;
2065 cmsg
->cmsg_type
= SCM_RIGHTS
;
2066 cmsg
->cmsg_len
= CMSG_LEN(sizeof(int));
2067 memcpy(CMSG_DATA(cmsg
), &fd
, sizeof(int));
2069 mh
.msg_controllen
= cmsg
->cmsg_len
;
2071 /* Store away the fd in the socket, so that it stays open as
2072 * long as we run the child */
2073 k
= sendmsg(kmsg_socket
, &mh
, MSG_NOSIGNAL
);
2077 return log_error_errno(errno
, "Failed to send FIFO fd: %m");
2079 /* And now make the FIFO unavailable as /run/kmsg... */
2080 (void) unlink(from
);
2085 static int send_rtnl(int send_fd
) {
2087 struct cmsghdr cmsghdr
;
2088 uint8_t buf
[CMSG_SPACE(sizeof(int))];
2090 struct msghdr mh
= {
2091 .msg_control
= &control
,
2092 .msg_controllen
= sizeof(control
),
2094 struct cmsghdr
*cmsg
;
2095 _cleanup_close_
int fd
= -1;
2098 assert(send_fd
>= 0);
2100 if (!arg_expose_ports
)
2103 fd
= socket(PF_NETLINK
, SOCK_RAW
|SOCK_CLOEXEC
|SOCK_NONBLOCK
, NETLINK_ROUTE
);
2105 return log_error_errno(errno
, "Failed to allocate container netlink: %m");
2107 cmsg
= CMSG_FIRSTHDR(&mh
);
2108 cmsg
->cmsg_level
= SOL_SOCKET
;
2109 cmsg
->cmsg_type
= SCM_RIGHTS
;
2110 cmsg
->cmsg_len
= CMSG_LEN(sizeof(int));
2111 memcpy(CMSG_DATA(cmsg
), &fd
, sizeof(int));
2113 mh
.msg_controllen
= cmsg
->cmsg_len
;
2115 /* Store away the fd in the socket, so that it stays open as
2116 * long as we run the child */
2117 k
= sendmsg(send_fd
, &mh
, MSG_NOSIGNAL
);
2119 return log_error_errno(errno
, "Failed to send netlink fd: %m");
2124 static int flush_ports(union in_addr_union
*exposed
) {
2126 int r
, af
= AF_INET
;
2130 if (!arg_expose_ports
)
2133 if (in_addr_is_null(af
, exposed
))
2136 log_debug("Lost IP address.");
2138 LIST_FOREACH(ports
, p
, arg_expose_ports
) {
2139 r
= fw_add_local_dnat(false,
2150 log_warning_errno(r
, "Failed to modify firewall: %m");
2153 *exposed
= IN_ADDR_NULL
;
2157 static int expose_ports(sd_netlink
*rtnl
, union in_addr_union
*exposed
) {
2158 _cleanup_free_
struct local_address
*addresses
= NULL
;
2159 _cleanup_free_
char *pretty
= NULL
;
2160 union in_addr_union new_exposed
;
2163 int af
= AF_INET
, r
;
2167 /* Invoked each time an address is added or removed inside the
2170 if (!arg_expose_ports
)
2173 r
= local_addresses(rtnl
, 0, af
, &addresses
);
2175 return log_error_errno(r
, "Failed to enumerate local addresses: %m");
2178 addresses
[0].family
== af
&&
2179 addresses
[0].scope
< RT_SCOPE_LINK
;
2182 return flush_ports(exposed
);
2184 new_exposed
= addresses
[0].address
;
2185 if (in_addr_equal(af
, exposed
, &new_exposed
))
2188 in_addr_to_string(af
, &new_exposed
, &pretty
);
2189 log_debug("New container IP is %s.", strna(pretty
));
2191 LIST_FOREACH(ports
, p
, arg_expose_ports
) {
2193 r
= fw_add_local_dnat(true,
2202 in_addr_is_null(af
, exposed
) ? NULL
: exposed
);
2204 log_warning_errno(r
, "Failed to modify firewall: %m");
2207 *exposed
= new_exposed
;
2211 static int on_address_change(sd_netlink
*rtnl
, sd_netlink_message
*m
, void *userdata
) {
2212 union in_addr_union
*exposed
= userdata
;
2218 expose_ports(rtnl
, exposed
);
2222 static int watch_rtnl(sd_event
*event
, int recv_fd
, union in_addr_union
*exposed
, sd_netlink
**ret
) {
2224 struct cmsghdr cmsghdr
;
2225 uint8_t buf
[CMSG_SPACE(sizeof(int))];
2227 struct msghdr mh
= {
2228 .msg_control
= &control
,
2229 .msg_controllen
= sizeof(control
),
2231 struct cmsghdr
*cmsg
;
2232 _cleanup_netlink_unref_ sd_netlink
*rtnl
= NULL
;
2237 assert(recv_fd
>= 0);
2240 if (!arg_expose_ports
)
2243 k
= recvmsg(recv_fd
, &mh
, MSG_NOSIGNAL
);
2245 return log_error_errno(errno
, "Failed to recv netlink fd: %m");
2247 cmsg
= CMSG_FIRSTHDR(&mh
);
2248 assert(cmsg
->cmsg_level
== SOL_SOCKET
);
2249 assert(cmsg
->cmsg_type
== SCM_RIGHTS
);
2250 assert(cmsg
->cmsg_len
== CMSG_LEN(sizeof(int)));
2251 memcpy(&fd
, CMSG_DATA(cmsg
), sizeof(int));
2253 r
= sd_netlink_open_fd(&rtnl
, fd
);
2256 return log_error_errno(r
, "Failed to create rtnl object: %m");
2259 r
= sd_netlink_add_match(rtnl
, RTM_NEWADDR
, on_address_change
, exposed
);
2261 return log_error_errno(r
, "Failed to subscribe to RTM_NEWADDR messages: %m");
2263 r
= sd_netlink_add_match(rtnl
, RTM_DELADDR
, on_address_change
, exposed
);
2265 return log_error_errno(r
, "Failed to subscribe to RTM_DELADDR messages: %m");
2267 r
= sd_netlink_attach_event(rtnl
, event
, 0);
2269 return log_error_errno(r
, "Failed to add to even loop: %m");
2277 static int setup_hostname(void) {
2279 if (arg_share_system
)
2282 if (sethostname_idempotent(arg_machine
) < 0)
2288 static int setup_journal(const char *directory
) {
2289 sd_id128_t machine_id
, this_id
;
2290 _cleanup_free_
char *b
= NULL
, *d
= NULL
;
2291 const char *etc_machine_id
, *p
, *q
;
2295 /* Don't link journals in ephemeral mode */
2299 etc_machine_id
= prefix_roota(directory
, "/etc/machine-id");
2301 r
= read_one_line_file(etc_machine_id
, &b
);
2302 if (r
== -ENOENT
&& arg_link_journal
== LINK_AUTO
)
2305 return log_error_errno(r
, "Failed to read machine ID from %s: %m", etc_machine_id
);
2308 if (isempty(id
) && arg_link_journal
== LINK_AUTO
)
2311 /* Verify validity */
2312 r
= sd_id128_from_string(id
, &machine_id
);
2314 return log_error_errno(r
, "Failed to parse machine ID from %s: %m", etc_machine_id
);
2316 r
= sd_id128_get_machine(&this_id
);
2318 return log_error_errno(r
, "Failed to retrieve machine ID: %m");
2320 if (sd_id128_equal(machine_id
, this_id
)) {
2321 log_full(arg_link_journal
== LINK_AUTO
? LOG_WARNING
: LOG_ERR
,
2322 "Host and machine ids are equal (%s): refusing to link journals", id
);
2323 if (arg_link_journal
== LINK_AUTO
)
2328 if (arg_link_journal
== LINK_NO
)
2331 r
= userns_mkdir(directory
, "/var", 0755, 0, 0);
2333 return log_error_errno(r
, "Failed to create /var: %m");
2335 r
= userns_mkdir(directory
, "/var/log", 0755, 0, 0);
2337 return log_error_errno(r
, "Failed to create /var/log: %m");
2339 r
= userns_mkdir(directory
, "/var/log/journal", 0755, 0, 0);
2341 return log_error_errno(r
, "Failed to create /var/log/journal: %m");
2343 p
= strjoina("/var/log/journal/", id
);
2344 q
= prefix_roota(directory
, p
);
2346 if (path_is_mount_point(p
, 0) > 0) {
2347 if (arg_link_journal
!= LINK_AUTO
) {
2348 log_error("%s: already a mount point, refusing to use for journal", p
);
2355 if (path_is_mount_point(q
, 0) > 0) {
2356 if (arg_link_journal
!= LINK_AUTO
) {
2357 log_error("%s: already a mount point, refusing to use for journal", q
);
2364 r
= readlink_and_make_absolute(p
, &d
);
2366 if ((arg_link_journal
== LINK_GUEST
||
2367 arg_link_journal
== LINK_AUTO
) &&
2370 r
= userns_mkdir(directory
, p
, 0755, 0, 0);
2372 log_warning_errno(errno
, "Failed to create directory %s: %m", q
);
2377 return log_error_errno(errno
, "Failed to remove symlink %s: %m", p
);
2378 } else if (r
== -EINVAL
) {
2380 if (arg_link_journal
== LINK_GUEST
&&
2383 if (errno
== ENOTDIR
) {
2384 log_error("%s already exists and is neither a symlink nor a directory", p
);
2387 log_error_errno(errno
, "Failed to remove %s: %m", p
);
2391 } else if (r
!= -ENOENT
) {
2392 log_error_errno(errno
, "readlink(%s) failed: %m", p
);
2396 if (arg_link_journal
== LINK_GUEST
) {
2398 if (symlink(q
, p
) < 0) {
2399 if (arg_link_journal_try
) {
2400 log_debug_errno(errno
, "Failed to symlink %s to %s, skipping journal setup: %m", q
, p
);
2403 log_error_errno(errno
, "Failed to symlink %s to %s: %m", q
, p
);
2408 r
= userns_mkdir(directory
, p
, 0755, 0, 0);
2410 log_warning_errno(errno
, "Failed to create directory %s: %m", q
);
2414 if (arg_link_journal
== LINK_HOST
) {
2415 /* don't create parents here -- if the host doesn't have
2416 * permanent journal set up, don't force it here */
2419 if (arg_link_journal_try
) {
2420 log_debug_errno(errno
, "Failed to create %s, skipping journal setup: %m", p
);
2423 log_error_errno(errno
, "Failed to create %s: %m", p
);
2428 } else if (access(p
, F_OK
) < 0)
2431 if (dir_is_empty(q
) == 0)
2432 log_warning("%s is not empty, proceeding anyway.", q
);
2434 r
= userns_mkdir(directory
, p
, 0755, 0, 0);
2436 log_error_errno(errno
, "Failed to create %s: %m", q
);
2440 if (mount(p
, q
, NULL
, MS_BIND
, NULL
) < 0)
2441 return log_error_errno(errno
, "Failed to bind mount journal from host into guest: %m");
2446 static int drop_capabilities(void) {
2447 return capability_bounding_set_drop(~arg_retain
, false);
2450 static int register_machine(pid_t pid
, int local_ifindex
) {
2451 _cleanup_bus_error_free_ sd_bus_error error
= SD_BUS_ERROR_NULL
;
2452 _cleanup_bus_flush_close_unref_ sd_bus
*bus
= NULL
;
2458 r
= sd_bus_default_system(&bus
);
2460 return log_error_errno(r
, "Failed to open system bus: %m");
2462 if (arg_keep_unit
) {
2463 r
= sd_bus_call_method(
2465 "org.freedesktop.machine1",
2466 "/org/freedesktop/machine1",
2467 "org.freedesktop.machine1.Manager",
2468 "RegisterMachineWithNetwork",
2473 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid
),
2477 strempty(arg_directory
),
2478 local_ifindex
> 0 ? 1 : 0, local_ifindex
);
2480 _cleanup_bus_message_unref_ sd_bus_message
*m
= NULL
;
2484 r
= sd_bus_message_new_method_call(
2487 "org.freedesktop.machine1",
2488 "/org/freedesktop/machine1",
2489 "org.freedesktop.machine1.Manager",
2490 "CreateMachineWithNetwork");
2492 return bus_log_create_error(r
);
2494 r
= sd_bus_message_append(
2498 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid
),
2502 strempty(arg_directory
),
2503 local_ifindex
> 0 ? 1 : 0, local_ifindex
);
2505 return bus_log_create_error(r
);
2507 r
= sd_bus_message_open_container(m
, 'a', "(sv)");
2509 return bus_log_create_error(r
);
2511 if (!isempty(arg_slice
)) {
2512 r
= sd_bus_message_append(m
, "(sv)", "Slice", "s", arg_slice
);
2514 return bus_log_create_error(r
);
2517 r
= sd_bus_message_append(m
, "(sv)", "DevicePolicy", "s", "strict");
2519 return bus_log_create_error(r
);
2521 /* If you make changes here, also make sure to update
2522 * systemd-nspawn@.service, to keep the device
2523 * policies in sync regardless if we are run with or
2524 * without the --keep-unit switch. */
2525 r
= sd_bus_message_append(m
, "(sv)", "DeviceAllow", "a(ss)", 9,
2526 /* Allow the container to
2527 * access and create the API
2528 * device nodes, so that
2529 * PrivateDevices= in the
2530 * container can work
2535 "/dev/random", "rwm",
2536 "/dev/urandom", "rwm",
2538 "/dev/net/tun", "rwm",
2539 /* Allow the container
2540 * access to ptys. However,
2542 * container to ever create
2543 * these device nodes. */
2544 "/dev/pts/ptmx", "rw",
2547 return bus_log_create_error(r
);
2549 for (j
= 0; j
< arg_n_custom_mounts
; j
++) {
2550 CustomMount
*cm
= &arg_custom_mounts
[j
];
2552 if (cm
->type
!= CUSTOM_MOUNT_BIND
)
2555 r
= is_device_node(cm
->source
);
2557 return log_error_errno(r
, "Failed to stat %s: %m", cm
->source
);
2560 r
= sd_bus_message_append(m
, "(sv)", "DeviceAllow", "a(ss)", 1,
2561 cm
->source
, cm
->read_only
? "r" : "rw");
2563 return log_error_errno(r
, "Failed to append message arguments: %m");
2567 if (arg_kill_signal
!= 0) {
2568 r
= sd_bus_message_append(m
, "(sv)", "KillSignal", "i", arg_kill_signal
);
2570 return bus_log_create_error(r
);
2572 r
= sd_bus_message_append(m
, "(sv)", "KillMode", "s", "mixed");
2574 return bus_log_create_error(r
);
2577 STRV_FOREACH(i
, arg_property
) {
2578 r
= sd_bus_message_open_container(m
, 'r', "sv");
2580 return bus_log_create_error(r
);
2582 r
= bus_append_unit_property_assignment(m
, *i
);
2586 r
= sd_bus_message_close_container(m
);
2588 return bus_log_create_error(r
);
2591 r
= sd_bus_message_close_container(m
);
2593 return bus_log_create_error(r
);
2595 r
= sd_bus_call(bus
, m
, 0, &error
, NULL
);
2599 log_error("Failed to register machine: %s", bus_error_message(&error
, r
));
2606 static int terminate_machine(pid_t pid
) {
2607 _cleanup_bus_error_free_ sd_bus_error error
= SD_BUS_ERROR_NULL
;
2608 _cleanup_bus_message_unref_ sd_bus_message
*reply
= NULL
;
2609 _cleanup_bus_flush_close_unref_ sd_bus
*bus
= NULL
;
2616 /* If we are reusing the unit, then just exit, systemd will do
2617 * the right thing when we exit. */
2621 r
= sd_bus_default_system(&bus
);
2623 return log_error_errno(r
, "Failed to open system bus: %m");
2625 r
= sd_bus_call_method(
2627 "org.freedesktop.machine1",
2628 "/org/freedesktop/machine1",
2629 "org.freedesktop.machine1.Manager",
2636 /* Note that the machine might already have been
2637 * cleaned up automatically, hence don't consider it a
2638 * failure if we cannot get the machine object. */
2639 log_debug("Failed to get machine: %s", bus_error_message(&error
, r
));
2643 r
= sd_bus_message_read(reply
, "o", &path
);
2645 return bus_log_parse_error(r
);
2647 r
= sd_bus_call_method(
2649 "org.freedesktop.machine1",
2651 "org.freedesktop.machine1.Machine",
2657 log_debug("Failed to terminate machine: %s", bus_error_message(&error
, r
));
2664 static int reset_audit_loginuid(void) {
2665 _cleanup_free_
char *p
= NULL
;
2668 if (arg_share_system
)
2671 r
= read_one_line_file("/proc/self/loginuid", &p
);
2675 return log_error_errno(r
, "Failed to read /proc/self/loginuid: %m");
2677 /* Already reset? */
2678 if (streq(p
, "4294967295"))
2681 r
= write_string_file("/proc/self/loginuid", "4294967295", 0);
2684 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2685 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2686 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2687 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2688 "using systemd-nspawn. Sleeping for 5s... (%m)");
2696 #define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
2697 #define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
2698 #define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)
2700 static int generate_mac(struct ether_addr
*mac
, sd_id128_t hash_key
, uint64_t idx
) {
2706 l
= strlen(arg_machine
);
2707 sz
= sizeof(sd_id128_t
) + l
;
2713 /* fetch some persistent data unique to the host */
2714 r
= sd_id128_get_machine((sd_id128_t
*) v
);
2718 /* combine with some data unique (on this host) to this
2719 * container instance */
2720 i
= mempcpy(v
+ sizeof(sd_id128_t
), arg_machine
, l
);
2723 memcpy(i
, &idx
, sizeof(idx
));
2726 /* Let's hash the host machine ID plus the container name. We
2727 * use a fixed, but originally randomly created hash key here. */
2728 siphash24(result
, v
, sz
, hash_key
.bytes
);
2730 assert_cc(ETH_ALEN
<= sizeof(result
));
2731 memcpy(mac
->ether_addr_octet
, result
, ETH_ALEN
);
2733 /* see eth_random_addr in the kernel */
2734 mac
->ether_addr_octet
[0] &= 0xfe; /* clear multicast bit */
2735 mac
->ether_addr_octet
[0] |= 0x02; /* set local assignment bit (IEEE802) */
2740 static int setup_veth(pid_t pid
, char iface_name
[IFNAMSIZ
], int *ifi
) {
2741 _cleanup_netlink_message_unref_ sd_netlink_message
*m
= NULL
;
2742 _cleanup_netlink_unref_ sd_netlink
*rtnl
= NULL
;
2743 struct ether_addr mac_host
, mac_container
;
2746 if (!arg_private_network
)
2749 if (!arg_network_veth
)
2752 /* Use two different interface name prefixes depending whether
2753 * we are in bridge mode or not. */
2754 snprintf(iface_name
, IFNAMSIZ
- 1, "%s-%s",
2755 arg_network_bridge
? "vb" : "ve", arg_machine
);
2757 r
= generate_mac(&mac_container
, CONTAINER_HASH_KEY
, 0);
2759 return log_error_errno(r
, "Failed to generate predictable MAC address for container side: %m");
2761 r
= generate_mac(&mac_host
, HOST_HASH_KEY
, 0);
2763 return log_error_errno(r
, "Failed to generate predictable MAC address for host side: %m");
2765 r
= sd_netlink_open(&rtnl
);
2767 return log_error_errno(r
, "Failed to connect to netlink: %m");
2769 r
= sd_rtnl_message_new_link(rtnl
, &m
, RTM_NEWLINK
, 0);
2771 return log_error_errno(r
, "Failed to allocate netlink message: %m");
2773 r
= sd_netlink_message_append_string(m
, IFLA_IFNAME
, iface_name
);
2775 return log_error_errno(r
, "Failed to add netlink interface name: %m");
2777 r
= sd_netlink_message_append_ether_addr(m
, IFLA_ADDRESS
, &mac_host
);
2779 return log_error_errno(r
, "Failed to add netlink MAC address: %m");
2781 r
= sd_netlink_message_open_container(m
, IFLA_LINKINFO
);
2783 return log_error_errno(r
, "Failed to open netlink container: %m");
2785 r
= sd_netlink_message_open_container_union(m
, IFLA_INFO_DATA
, "veth");
2787 return log_error_errno(r
, "Failed to open netlink container: %m");
2789 r
= sd_netlink_message_open_container(m
, VETH_INFO_PEER
);
2791 return log_error_errno(r
, "Failed to open netlink container: %m");
2793 r
= sd_netlink_message_append_string(m
, IFLA_IFNAME
, "host0");
2795 return log_error_errno(r
, "Failed to add netlink interface name: %m");
2797 r
= sd_netlink_message_append_ether_addr(m
, IFLA_ADDRESS
, &mac_container
);
2799 return log_error_errno(r
, "Failed to add netlink MAC address: %m");
2801 r
= sd_netlink_message_append_u32(m
, IFLA_NET_NS_PID
, pid
);
2803 return log_error_errno(r
, "Failed to add netlink namespace field: %m");
2805 r
= sd_netlink_message_close_container(m
);
2807 return log_error_errno(r
, "Failed to close netlink container: %m");
2809 r
= sd_netlink_message_close_container(m
);
2811 return log_error_errno(r
, "Failed to close netlink container: %m");
2813 r
= sd_netlink_message_close_container(m
);
2815 return log_error_errno(r
, "Failed to close netlink container: %m");
2817 r
= sd_netlink_call(rtnl
, m
, 0, NULL
);
2819 return log_error_errno(r
, "Failed to add new veth interfaces (host0, %s): %m", iface_name
);
2821 i
= (int) if_nametoindex(iface_name
);
2823 return log_error_errno(errno
, "Failed to resolve interface %s: %m", iface_name
);
2830 static int setup_bridge(const char veth_name
[], int *ifi
) {
2831 _cleanup_netlink_message_unref_ sd_netlink_message
*m
= NULL
;
2832 _cleanup_netlink_unref_ sd_netlink
*rtnl
= NULL
;
2835 if (!arg_private_network
)
2838 if (!arg_network_veth
)
2841 if (!arg_network_bridge
)
2844 bridge
= (int) if_nametoindex(arg_network_bridge
);
2846 return log_error_errno(errno
, "Failed to resolve interface %s: %m", arg_network_bridge
);
2850 r
= sd_netlink_open(&rtnl
);
2852 return log_error_errno(r
, "Failed to connect to netlink: %m");
2854 r
= sd_rtnl_message_new_link(rtnl
, &m
, RTM_SETLINK
, 0);
2856 return log_error_errno(r
, "Failed to allocate netlink message: %m");
2858 r
= sd_rtnl_message_link_set_flags(m
, IFF_UP
, IFF_UP
);
2860 return log_error_errno(r
, "Failed to set IFF_UP flag: %m");
2862 r
= sd_netlink_message_append_string(m
, IFLA_IFNAME
, veth_name
);
2864 return log_error_errno(r
, "Failed to add netlink interface name field: %m");
2866 r
= sd_netlink_message_append_u32(m
, IFLA_MASTER
, bridge
);
2868 return log_error_errno(r
, "Failed to add netlink master field: %m");
2870 r
= sd_netlink_call(rtnl
, m
, 0, NULL
);
2872 return log_error_errno(r
, "Failed to add veth interface to bridge: %m");
2877 static int parse_interface(struct udev
*udev
, const char *name
) {
2878 _cleanup_udev_device_unref_
struct udev_device
*d
= NULL
;
2879 char ifi_str
[2 + DECIMAL_STR_MAX(int)];
2882 ifi
= (int) if_nametoindex(name
);
2884 return log_error_errno(errno
, "Failed to resolve interface %s: %m", name
);
2886 sprintf(ifi_str
, "n%i", ifi
);
2887 d
= udev_device_new_from_device_id(udev
, ifi_str
);
2889 return log_error_errno(errno
, "Failed to get udev device for interface %s: %m", name
);
2891 if (udev_device_get_is_initialized(d
) <= 0) {
2892 log_error("Network interface %s is not initialized yet.", name
);
2899 static int move_network_interfaces(pid_t pid
) {
2900 _cleanup_udev_unref_
struct udev
*udev
= NULL
;
2901 _cleanup_netlink_unref_ sd_netlink
*rtnl
= NULL
;
2905 if (!arg_private_network
)
2908 if (strv_isempty(arg_network_interfaces
))
2911 r
= sd_netlink_open(&rtnl
);
2913 return log_error_errno(r
, "Failed to connect to netlink: %m");
2917 log_error("Failed to connect to udev.");
2921 STRV_FOREACH(i
, arg_network_interfaces
) {
2922 _cleanup_netlink_message_unref_ sd_netlink_message
*m
= NULL
;
2925 ifi
= parse_interface(udev
, *i
);
2929 r
= sd_rtnl_message_new_link(rtnl
, &m
, RTM_SETLINK
, ifi
);
2931 return log_error_errno(r
, "Failed to allocate netlink message: %m");
2933 r
= sd_netlink_message_append_u32(m
, IFLA_NET_NS_PID
, pid
);
2935 return log_error_errno(r
, "Failed to append namespace PID to netlink message: %m");
2937 r
= sd_netlink_call(rtnl
, m
, 0, NULL
);
2939 return log_error_errno(r
, "Failed to move interface %s to namespace: %m", *i
);
2945 static int setup_macvlan(pid_t pid
) {
2946 _cleanup_udev_unref_
struct udev
*udev
= NULL
;
2947 _cleanup_netlink_unref_ sd_netlink
*rtnl
= NULL
;
2952 if (!arg_private_network
)
2955 if (strv_isempty(arg_network_macvlan
))
2958 r
= sd_netlink_open(&rtnl
);
2960 return log_error_errno(r
, "Failed to connect to netlink: %m");
2964 log_error("Failed to connect to udev.");
2968 STRV_FOREACH(i
, arg_network_macvlan
) {
2969 _cleanup_netlink_message_unref_ sd_netlink_message
*m
= NULL
;
2970 _cleanup_free_
char *n
= NULL
;
2971 struct ether_addr mac
;
2974 ifi
= parse_interface(udev
, *i
);
2978 r
= generate_mac(&mac
, MACVLAN_HASH_KEY
, idx
++);
2980 return log_error_errno(r
, "Failed to create MACVLAN MAC address: %m");
2982 r
= sd_rtnl_message_new_link(rtnl
, &m
, RTM_NEWLINK
, 0);
2984 return log_error_errno(r
, "Failed to allocate netlink message: %m");
2986 r
= sd_netlink_message_append_u32(m
, IFLA_LINK
, ifi
);
2988 return log_error_errno(r
, "Failed to add netlink interface index: %m");
2990 n
= strappend("mv-", *i
);
2994 strshorten(n
, IFNAMSIZ
-1);
2996 r
= sd_netlink_message_append_string(m
, IFLA_IFNAME
, n
);
2998 return log_error_errno(r
, "Failed to add netlink interface name: %m");
3000 r
= sd_netlink_message_append_ether_addr(m
, IFLA_ADDRESS
, &mac
);
3002 return log_error_errno(r
, "Failed to add netlink MAC address: %m");
3004 r
= sd_netlink_message_append_u32(m
, IFLA_NET_NS_PID
, pid
);
3006 return log_error_errno(r
, "Failed to add netlink namespace field: %m");
3008 r
= sd_netlink_message_open_container(m
, IFLA_LINKINFO
);
3010 return log_error_errno(r
, "Failed to open netlink container: %m");
3012 r
= sd_netlink_message_open_container_union(m
, IFLA_INFO_DATA
, "macvlan");
3014 return log_error_errno(r
, "Failed to open netlink container: %m");
3016 r
= sd_netlink_message_append_u32(m
, IFLA_MACVLAN_MODE
, MACVLAN_MODE_BRIDGE
);
3018 return log_error_errno(r
, "Failed to append macvlan mode: %m");
3020 r
= sd_netlink_message_close_container(m
);
3022 return log_error_errno(r
, "Failed to close netlink container: %m");
3024 r
= sd_netlink_message_close_container(m
);
3026 return log_error_errno(r
, "Failed to close netlink container: %m");
3028 r
= sd_netlink_call(rtnl
, m
, 0, NULL
);
3030 return log_error_errno(r
, "Failed to add new macvlan interfaces: %m");
3036 static int setup_ipvlan(pid_t pid
) {
3037 _cleanup_udev_unref_
struct udev
*udev
= NULL
;
3038 _cleanup_netlink_unref_ sd_netlink
*rtnl
= NULL
;
3042 if (!arg_private_network
)
3045 if (strv_isempty(arg_network_ipvlan
))
3048 r
= sd_netlink_open(&rtnl
);
3050 return log_error_errno(r
, "Failed to connect to netlink: %m");
3054 log_error("Failed to connect to udev.");
3058 STRV_FOREACH(i
, arg_network_ipvlan
) {
3059 _cleanup_netlink_message_unref_ sd_netlink_message
*m
= NULL
;
3060 _cleanup_free_
char *n
= NULL
;
3063 ifi
= parse_interface(udev
, *i
);
3067 r
= sd_rtnl_message_new_link(rtnl
, &m
, RTM_NEWLINK
, 0);
3069 return log_error_errno(r
, "Failed to allocate netlink message: %m");
3071 r
= sd_netlink_message_append_u32(m
, IFLA_LINK
, ifi
);
3073 return log_error_errno(r
, "Failed to add netlink interface index: %m");
3075 n
= strappend("iv-", *i
);
3079 strshorten(n
, IFNAMSIZ
-1);
3081 r
= sd_netlink_message_append_string(m
, IFLA_IFNAME
, n
);
3083 return log_error_errno(r
, "Failed to add netlink interface name: %m");
3085 r
= sd_netlink_message_append_u32(m
, IFLA_NET_NS_PID
, pid
);
3087 return log_error_errno(r
, "Failed to add netlink namespace field: %m");
3089 r
= sd_netlink_message_open_container(m
, IFLA_LINKINFO
);
3091 return log_error_errno(r
, "Failed to open netlink container: %m");
3093 r
= sd_netlink_message_open_container_union(m
, IFLA_INFO_DATA
, "ipvlan");
3095 return log_error_errno(r
, "Failed to open netlink container: %m");
3097 r
= sd_netlink_message_append_u16(m
, IFLA_IPVLAN_MODE
, IPVLAN_MODE_L2
);
3099 return log_error_errno(r
, "Failed to add ipvlan mode: %m");
3101 r
= sd_netlink_message_close_container(m
);
3103 return log_error_errno(r
, "Failed to close netlink container: %m");
3105 r
= sd_netlink_message_close_container(m
);
3107 return log_error_errno(r
, "Failed to close netlink container: %m");
3109 r
= sd_netlink_call(rtnl
, m
, 0, NULL
);
3111 return log_error_errno(r
, "Failed to add new ipvlan interfaces: %m");
3117 static int setup_seccomp(void) {
3120 static const struct {
3121 uint64_t capability
;
3124 { CAP_SYS_RAWIO
, SCMP_SYS(iopl
) },
3125 { CAP_SYS_RAWIO
, SCMP_SYS(ioperm
) },
3126 { CAP_SYS_BOOT
, SCMP_SYS(kexec_load
) },
3127 { CAP_SYS_ADMIN
, SCMP_SYS(swapon
) },
3128 { CAP_SYS_ADMIN
, SCMP_SYS(swapoff
) },
3129 { CAP_SYS_ADMIN
, SCMP_SYS(open_by_handle_at
) },
3130 { CAP_SYS_MODULE
, SCMP_SYS(init_module
) },
3131 { CAP_SYS_MODULE
, SCMP_SYS(finit_module
) },
3132 { CAP_SYS_MODULE
, SCMP_SYS(delete_module
) },
3133 { CAP_SYSLOG
, SCMP_SYS(syslog
) },
3136 scmp_filter_ctx seccomp
;
3140 seccomp
= seccomp_init(SCMP_ACT_ALLOW
);
3144 r
= seccomp_add_secondary_archs(seccomp
);
3146 log_error_errno(r
, "Failed to add secondary archs to seccomp filter: %m");
3150 for (i
= 0; i
< ELEMENTSOF(blacklist
); i
++) {
3151 if (arg_retain
& (1ULL << blacklist
[i
].capability
))
3154 r
= seccomp_rule_add(seccomp
, SCMP_ACT_ERRNO(EPERM
), blacklist
[i
].syscall_num
, 0);
3156 continue; /* unknown syscall */
3158 log_error_errno(r
, "Failed to block syscall: %m");
3165 Audit is broken in containers, much of the userspace audit
3166 hookup will fail if running inside a container. We don't
3167 care and just turn off creation of audit sockets.
3169 This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail
3170 with EAFNOSUPPORT which audit userspace uses as indication
3171 that audit is disabled in the kernel.
3174 r
= seccomp_rule_add(
3176 SCMP_ACT_ERRNO(EAFNOSUPPORT
),
3179 SCMP_A0(SCMP_CMP_EQ
, AF_NETLINK
),
3180 SCMP_A2(SCMP_CMP_EQ
, NETLINK_AUDIT
));
3182 log_error_errno(r
, "Failed to add audit seccomp rule: %m");
3186 r
= seccomp_attr_set(seccomp
, SCMP_FLTATR_CTL_NNP
, 0);
3188 log_error_errno(r
, "Failed to unset NO_NEW_PRIVS: %m");
3192 r
= seccomp_load(seccomp
);
3194 log_debug_errno(r
, "Kernel is probably not configured with CONFIG_SECCOMP. Disabling seccomp audit filter: %m");
3199 log_error_errno(r
, "Failed to install seccomp audit filter: %m");
3204 seccomp_release(seccomp
);
3212 static int setup_propagate(const char *root
) {
3215 (void) mkdir_p("/run/systemd/nspawn/", 0755);
3216 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
3217 p
= strjoina("/run/systemd/nspawn/propagate/", arg_machine
);
3218 (void) mkdir_p(p
, 0600);
3220 if (userns_mkdir(root
, "/run/systemd", 0755, 0, 0) < 0)
3221 return log_error_errno(errno
, "Failed to create /run/systemd: %m");
3223 if (userns_mkdir(root
, "/run/systemd/nspawn", 0755, 0, 0) < 0)
3224 return log_error_errno(errno
, "Failed to create /run/systemd/nspawn: %m");
3226 if (userns_mkdir(root
, "/run/systemd/nspawn/incoming", 0600, 0, 0) < 0)
3227 return log_error_errno(errno
, "Failed to create /run/systemd/nspawn/incoming: %m");
3229 q
= prefix_roota(root
, "/run/systemd/nspawn/incoming");
3230 if (mount(p
, q
, NULL
, MS_BIND
, NULL
) < 0)
3231 return log_error_errno(errno
, "Failed to install propagation bind mount.");
3233 if (mount(NULL
, q
, NULL
, MS_BIND
|MS_REMOUNT
|MS_RDONLY
, NULL
) < 0)
3234 return log_error_errno(errno
, "Failed to make propagation mount read-only");
3239 static int setup_image(char **device_path
, int *loop_nr
) {
3240 struct loop_info64 info
= {
3241 .lo_flags
= LO_FLAGS_AUTOCLEAR
|LO_FLAGS_PARTSCAN
3243 _cleanup_close_
int fd
= -1, control
= -1, loop
= -1;
3244 _cleanup_free_
char* loopdev
= NULL
;
3248 assert(device_path
);
3252 fd
= open(arg_image
, O_CLOEXEC
|(arg_read_only
? O_RDONLY
: O_RDWR
)|O_NONBLOCK
|O_NOCTTY
);
3254 return log_error_errno(errno
, "Failed to open %s: %m", arg_image
);
3256 if (fstat(fd
, &st
) < 0)
3257 return log_error_errno(errno
, "Failed to stat %s: %m", arg_image
);
3259 if (S_ISBLK(st
.st_mode
)) {
3262 p
= strdup(arg_image
);
3276 if (!S_ISREG(st
.st_mode
)) {
3277 log_error_errno(errno
, "%s is not a regular file or block device: %m", arg_image
);
3281 control
= open("/dev/loop-control", O_RDWR
|O_CLOEXEC
|O_NOCTTY
|O_NONBLOCK
);
3283 return log_error_errno(errno
, "Failed to open /dev/loop-control: %m");
3285 nr
= ioctl(control
, LOOP_CTL_GET_FREE
);
3287 return log_error_errno(errno
, "Failed to allocate loop device: %m");
3289 if (asprintf(&loopdev
, "/dev/loop%i", nr
) < 0)
3292 loop
= open(loopdev
, O_CLOEXEC
|(arg_read_only
? O_RDONLY
: O_RDWR
)|O_NONBLOCK
|O_NOCTTY
);
3294 return log_error_errno(errno
, "Failed to open loop device %s: %m", loopdev
);
3296 if (ioctl(loop
, LOOP_SET_FD
, fd
) < 0)
3297 return log_error_errno(errno
, "Failed to set loopback file descriptor on %s: %m", loopdev
);
3300 info
.lo_flags
|= LO_FLAGS_READ_ONLY
;
3302 if (ioctl(loop
, LOOP_SET_STATUS64
, &info
) < 0)
3303 return log_error_errno(errno
, "Failed to set loopback settings on %s: %m", loopdev
);
3305 *device_path
= loopdev
;
3316 #define PARTITION_TABLE_BLURB \
3317 "Note that the disk image needs to either contain only a single MBR partition of\n" \
3318 "type 0x83 that is marked bootable, or a single GPT partition of type " \
3319 "0FC63DAF-8483-4772-8E79-3D69D8477DE4 or follow\n" \
3320 " http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/\n" \
3321 "to be bootable with systemd-nspawn."
3323 static int dissect_image(
3325 char **root_device
, bool *root_device_rw
,
3326 char **home_device
, bool *home_device_rw
,
3327 char **srv_device
, bool *srv_device_rw
,
3331 int home_nr
= -1, srv_nr
= -1;
3332 #ifdef GPT_ROOT_NATIVE
3335 #ifdef GPT_ROOT_SECONDARY
3336 int secondary_root_nr
= -1;
3338 _cleanup_free_
char *home
= NULL
, *root
= NULL
, *secondary_root
= NULL
, *srv
= NULL
, *generic
= NULL
;
3339 _cleanup_udev_enumerate_unref_
struct udev_enumerate
*e
= NULL
;
3340 _cleanup_udev_device_unref_
struct udev_device
*d
= NULL
;
3341 _cleanup_blkid_free_probe_ blkid_probe b
= NULL
;
3342 _cleanup_udev_unref_
struct udev
*udev
= NULL
;
3343 struct udev_list_entry
*first
, *item
;
3344 bool home_rw
= true, root_rw
= true, secondary_root_rw
= true, srv_rw
= true, generic_rw
= true;
3345 bool is_gpt
, is_mbr
, multiple_generic
= false;
3346 const char *pttype
= NULL
;
3353 assert(root_device
);
3354 assert(home_device
);
3359 b
= blkid_new_probe();
3364 r
= blkid_probe_set_device(b
, fd
, 0, 0);
3369 log_error_errno(errno
, "Failed to set device on blkid probe: %m");
3373 blkid_probe_enable_partitions(b
, 1);
3374 blkid_probe_set_partitions_flags(b
, BLKID_PARTS_ENTRY_DETAILS
);
3377 r
= blkid_do_safeprobe(b
);
3378 if (r
== -2 || r
== 1) {
3379 log_error("Failed to identify any partition table on\n"
3381 PARTITION_TABLE_BLURB
, arg_image
);
3383 } else if (r
!= 0) {
3386 log_error_errno(errno
, "Failed to probe: %m");
3390 (void) blkid_probe_lookup_value(b
, "PTTYPE", &pttype
, NULL
);
3392 is_gpt
= streq_ptr(pttype
, "gpt");
3393 is_mbr
= streq_ptr(pttype
, "dos");
3395 if (!is_gpt
&& !is_mbr
) {
3396 log_error("No GPT or MBR partition table discovered on\n"
3398 PARTITION_TABLE_BLURB
, arg_image
);
3403 pl
= blkid_probe_get_partitions(b
);
3408 log_error("Failed to list partitions of %s", arg_image
);
3416 if (fstat(fd
, &st
) < 0)
3417 return log_error_errno(errno
, "Failed to stat block device: %m");
3419 d
= udev_device_new_from_devnum(udev
, 'b', st
.st_rdev
);
3427 log_error("Kernel partitions never appeared.");
3431 e
= udev_enumerate_new(udev
);
3435 r
= udev_enumerate_add_match_parent(e
, d
);
3439 r
= udev_enumerate_scan_devices(e
);
3441 return log_error_errno(r
, "Failed to scan for partition devices of %s: %m", arg_image
);
3443 /* Count the partitions enumerated by the kernel */
3445 first
= udev_enumerate_get_list_entry(e
);
3446 udev_list_entry_foreach(item
, first
)
3449 /* Count the partitions enumerated by blkid */
3450 m
= blkid_partlist_numof_partitions(pl
);
3454 log_error("blkid and kernel partition list do not match.");
3460 /* The kernel has probed fewer partitions than
3461 * blkid? Maybe the kernel prober is still
3462 * running or it got EBUSY because udev
3463 * already opened the device. Let's reprobe
3464 * the device, which is a synchronous call
3465 * that waits until probing is complete. */
3467 for (j
= 0; j
< 20; j
++) {
3469 r
= ioctl(fd
, BLKRRPART
, 0);
3472 if (r
>= 0 || r
!= -EBUSY
)
3475 /* If something else has the device
3476 * open, such as an udev rule, the
3477 * ioctl will return EBUSY. Since
3478 * there's no way to wait until it
3479 * isn't busy anymore, let's just wait
3480 * a bit, and try again.
3482 * This is really something they
3483 * should fix in the kernel! */
3485 usleep(50 * USEC_PER_MSEC
);
3489 return log_error_errno(r
, "Failed to reread partition table: %m");
3492 e
= udev_enumerate_unref(e
);
3495 first
= udev_enumerate_get_list_entry(e
);
3496 udev_list_entry_foreach(item
, first
) {
3497 _cleanup_udev_device_unref_
struct udev_device
*q
;
3499 unsigned long long flags
;
3505 q
= udev_device_new_from_syspath(udev
, udev_list_entry_get_name(item
));
3510 log_error_errno(errno
, "Failed to get partition device of %s: %m", arg_image
);
3514 qn
= udev_device_get_devnum(q
);
3518 if (st
.st_rdev
== qn
)
3521 node
= udev_device_get_devnode(q
);
3525 pp
= blkid_partlist_devno_to_partition(pl
, qn
);
3529 flags
= blkid_partition_get_flags(pp
);
3531 nr
= blkid_partition_get_partno(pp
);
3539 if (flags
& GPT_FLAG_NO_AUTO
)
3542 stype
= blkid_partition_get_type_string(pp
);
3546 if (sd_id128_from_string(stype
, &type_id
) < 0)
3549 if (sd_id128_equal(type_id
, GPT_HOME
)) {
3551 if (home
&& nr
>= home_nr
)
3555 home_rw
= !(flags
& GPT_FLAG_READ_ONLY
);
3557 r
= free_and_strdup(&home
, node
);
3561 } else if (sd_id128_equal(type_id
, GPT_SRV
)) {
3563 if (srv
&& nr
>= srv_nr
)
3567 srv_rw
= !(flags
& GPT_FLAG_READ_ONLY
);
3569 r
= free_and_strdup(&srv
, node
);
3573 #ifdef GPT_ROOT_NATIVE
3574 else if (sd_id128_equal(type_id
, GPT_ROOT_NATIVE
)) {
3576 if (root
&& nr
>= root_nr
)
3580 root_rw
= !(flags
& GPT_FLAG_READ_ONLY
);
3582 r
= free_and_strdup(&root
, node
);
3587 #ifdef GPT_ROOT_SECONDARY
3588 else if (sd_id128_equal(type_id
, GPT_ROOT_SECONDARY
)) {
3590 if (secondary_root
&& nr
>= secondary_root_nr
)
3593 secondary_root_nr
= nr
;
3594 secondary_root_rw
= !(flags
& GPT_FLAG_READ_ONLY
);
3596 r
= free_and_strdup(&secondary_root
, node
);
3601 else if (sd_id128_equal(type_id
, GPT_LINUX_GENERIC
)) {
3604 multiple_generic
= true;
3606 generic_rw
= !(flags
& GPT_FLAG_READ_ONLY
);
3608 r
= free_and_strdup(&generic
, node
);
3614 } else if (is_mbr
) {
3617 if (flags
!= 0x80) /* Bootable flag */
3620 type
= blkid_partition_get_type(pp
);
3621 if (type
!= 0x83) /* Linux partition */
3625 multiple_generic
= true;
3629 r
= free_and_strdup(&root
, node
);
3637 *root_device
= root
;
3640 *root_device_rw
= root_rw
;
3642 } else if (secondary_root
) {
3643 *root_device
= secondary_root
;
3644 secondary_root
= NULL
;
3646 *root_device_rw
= secondary_root_rw
;
3648 } else if (generic
) {
3650 /* There were no partitions with precise meanings
3651 * around, but we found generic partitions. In this
3652 * case, if there's only one, we can go ahead and boot
3653 * it, otherwise we bail out, because we really cannot
3654 * make any sense of it. */
3656 if (multiple_generic
) {
3657 log_error("Identified multiple bootable Linux partitions on\n"
3659 PARTITION_TABLE_BLURB
, arg_image
);
3663 *root_device
= generic
;
3666 *root_device_rw
= generic_rw
;
3669 log_error("Failed to identify root partition in disk image\n"
3671 PARTITION_TABLE_BLURB
, arg_image
);
3676 *home_device
= home
;
3679 *home_device_rw
= home_rw
;
3686 *srv_device_rw
= srv_rw
;
3691 log_error("--image= is not supported, compiled without blkid support.");
3696 static int mount_device(const char *what
, const char *where
, const char *directory
, bool rw
) {
3698 _cleanup_blkid_free_probe_ blkid_probe b
= NULL
;
3699 const char *fstype
, *p
;
3709 p
= strjoina(where
, directory
);
3714 b
= blkid_new_probe_from_filename(what
);
3718 log_error_errno(errno
, "Failed to allocate prober for %s: %m", what
);
3722 blkid_probe_enable_superblocks(b
, 1);
3723 blkid_probe_set_superblocks_flags(b
, BLKID_SUBLKS_TYPE
);
3726 r
= blkid_do_safeprobe(b
);
3727 if (r
== -1 || r
== 1) {
3728 log_error("Cannot determine file system type of %s", what
);
3730 } else if (r
!= 0) {
3733 log_error_errno(errno
, "Failed to probe %s: %m", what
);
3738 if (blkid_probe_lookup_value(b
, "TYPE", &fstype
, NULL
) < 0) {
3741 log_error("Failed to determine file system type of %s", what
);
3745 if (streq(fstype
, "crypto_LUKS")) {
3746 log_error("nspawn currently does not support LUKS disk images.");
3750 if (mount(what
, p
, fstype
, MS_NODEV
|(rw
? 0 : MS_RDONLY
), NULL
) < 0)
3751 return log_error_errno(errno
, "Failed to mount %s: %m", what
);
3755 log_error("--image= is not supported, compiled without blkid support.");
3760 static int mount_devices(
3762 const char *root_device
, bool root_device_rw
,
3763 const char *home_device
, bool home_device_rw
,
3764 const char *srv_device
, bool srv_device_rw
) {
3770 r
= mount_device(root_device
, arg_directory
, NULL
, root_device_rw
);
3772 return log_error_errno(r
, "Failed to mount root directory: %m");
3776 r
= mount_device(home_device
, arg_directory
, "/home", home_device_rw
);
3778 return log_error_errno(r
, "Failed to mount home directory: %m");
3782 r
= mount_device(srv_device
, arg_directory
, "/srv", srv_device_rw
);
3784 return log_error_errno(r
, "Failed to mount server data directory: %m");
3790 static void loop_remove(int nr
, int *image_fd
) {
3791 _cleanup_close_
int control
= -1;
3797 if (image_fd
&& *image_fd
>= 0) {
3798 r
= ioctl(*image_fd
, LOOP_CLR_FD
);
3800 log_debug_errno(errno
, "Failed to close loop image: %m");
3801 *image_fd
= safe_close(*image_fd
);
3804 control
= open("/dev/loop-control", O_RDWR
|O_CLOEXEC
|O_NOCTTY
|O_NONBLOCK
);
3806 log_warning_errno(errno
, "Failed to open /dev/loop-control: %m");
3810 r
= ioctl(control
, LOOP_CTL_REMOVE
, nr
);
3812 log_debug_errno(errno
, "Failed to remove loop %d: %m", nr
);
3815 static int spawn_getent(const char *database
, const char *key
, pid_t
*rpid
) {
3823 if (pipe2(pipe_fds
, O_CLOEXEC
) < 0)
3824 return log_error_errno(errno
, "Failed to allocate pipe: %m");
3828 return log_error_errno(errno
, "Failed to fork getent child: %m");
3829 else if (pid
== 0) {
3831 char *empty_env
= NULL
;
3833 if (dup3(pipe_fds
[1], STDOUT_FILENO
, 0) < 0)
3834 _exit(EXIT_FAILURE
);
3836 if (pipe_fds
[0] > 2)
3837 safe_close(pipe_fds
[0]);
3838 if (pipe_fds
[1] > 2)
3839 safe_close(pipe_fds
[1]);
3841 nullfd
= open("/dev/null", O_RDWR
);
3843 _exit(EXIT_FAILURE
);
3845 if (dup3(nullfd
, STDIN_FILENO
, 0) < 0)
3846 _exit(EXIT_FAILURE
);
3848 if (dup3(nullfd
, STDERR_FILENO
, 0) < 0)
3849 _exit(EXIT_FAILURE
);
3854 (void) reset_all_signal_handlers();
3855 (void) reset_signal_mask();
3856 close_all_fds(NULL
, 0);
3858 execle("/usr/bin/getent", "getent", database
, key
, NULL
, &empty_env
);
3859 execle("/bin/getent", "getent", database
, key
, NULL
, &empty_env
);
3860 _exit(EXIT_FAILURE
);
3863 pipe_fds
[1] = safe_close(pipe_fds
[1]);
3870 static int change_uid_gid(char **_home
) {
3871 char line
[LINE_MAX
], *x
, *u
, *g
, *h
;
3872 const char *word
, *state
;
3873 _cleanup_free_ uid_t
*uids
= NULL
;
3874 _cleanup_free_
char *home
= NULL
;
3875 _cleanup_fclose_
FILE *f
= NULL
;
3876 _cleanup_close_
int fd
= -1;
3877 unsigned n_uids
= 0;
3886 if (!arg_user
|| streq(arg_user
, "root") || streq(arg_user
, "0")) {
3887 /* Reset everything fully to 0, just in case */
3889 r
= reset_uid_gid();
3891 return log_error_errno(r
, "Failed to become root: %m");
3897 /* First, get user credentials */
3898 fd
= spawn_getent("passwd", arg_user
, &pid
);
3902 f
= fdopen(fd
, "r");
3907 if (!fgets(line
, sizeof(line
), f
)) {
3910 log_error("Failed to resolve user %s.", arg_user
);
3914 log_error_errno(errno
, "Failed to read from getent: %m");
3920 wait_for_terminate_and_warn("getent passwd", pid
, true);
3922 x
= strchr(line
, ':');
3924 log_error("/etc/passwd entry has invalid user field.");
3928 u
= strchr(x
+1, ':');
3930 log_error("/etc/passwd entry has invalid password field.");
3937 log_error("/etc/passwd entry has invalid UID field.");
3945 log_error("/etc/passwd entry has invalid GID field.");
3950 h
= strchr(x
+1, ':');
3952 log_error("/etc/passwd entry has invalid GECOS field.");
3959 log_error("/etc/passwd entry has invalid home directory field.");
3965 r
= parse_uid(u
, &uid
);
3967 log_error("Failed to parse UID of user.");
3971 r
= parse_gid(g
, &gid
);
3973 log_error("Failed to parse GID of user.");
3981 /* Second, get group memberships */
3982 fd
= spawn_getent("initgroups", arg_user
, &pid
);
3987 f
= fdopen(fd
, "r");
3992 if (!fgets(line
, sizeof(line
), f
)) {
3994 log_error("Failed to resolve user %s.", arg_user
);
3998 log_error_errno(errno
, "Failed to read from getent: %m");
4004 wait_for_terminate_and_warn("getent initgroups", pid
, true);
4006 /* Skip over the username and subsequent separator whitespace */
4008 x
+= strcspn(x
, WHITESPACE
);
4009 x
+= strspn(x
, WHITESPACE
);
4011 FOREACH_WORD(word
, l
, x
, state
) {
4017 if (!GREEDY_REALLOC(uids
, sz
, n_uids
+1))
4020 r
= parse_uid(c
, &uids
[n_uids
++]);
4022 log_error("Failed to parse group data from getent.");
4027 r
= mkdir_parents(home
, 0775);
4029 return log_error_errno(r
, "Failed to make home root directory: %m");
4031 r
= mkdir_safe(home
, 0755, uid
, gid
);
4032 if (r
< 0 && r
!= -EEXIST
)
4033 return log_error_errno(r
, "Failed to make home directory: %m");
4035 (void) fchown(STDIN_FILENO
, uid
, gid
);
4036 (void) fchown(STDOUT_FILENO
, uid
, gid
);
4037 (void) fchown(STDERR_FILENO
, uid
, gid
);
4039 if (setgroups(n_uids
, uids
) < 0)
4040 return log_error_errno(errno
, "Failed to set auxiliary groups: %m");
4042 if (setresgid(gid
, gid
, gid
) < 0)
4043 return log_error_errno(errno
, "setregid() failed: %m");
4045 if (setresuid(uid
, uid
, uid
) < 0)
4046 return log_error_errno(errno
, "setreuid() failed: %m");
4058 * < 0 : wait_for_terminate() failed to get the state of the
4059 * container, the container was terminated by a signal, or
4060 * failed for an unknown reason. No change is made to the
4061 * container argument.
4062 * > 0 : The program executed in the container terminated with an
4063 * error. The exit code of the program executed in the
4064 * container is returned. The container argument has been set
4065 * to CONTAINER_TERMINATED.
4066 * 0 : The container is being rebooted, has been shut down or exited
4067 * successfully. The container argument has been set to either
4068 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
4070 * That is, success is indicated by a return value of zero, and an
4071 * error is indicated by a non-zero value.
4073 static int wait_for_container(pid_t pid
, ContainerStatus
*container
) {
4077 r
= wait_for_terminate(pid
, &status
);
4079 return log_warning_errno(r
, "Failed to wait for container: %m");
4081 switch (status
.si_code
) {
4084 if (status
.si_status
== 0) {
4085 log_full(arg_quiet
? LOG_DEBUG
: LOG_INFO
, "Container %s exited successfully.", arg_machine
);
4088 log_full(arg_quiet
? LOG_DEBUG
: LOG_INFO
, "Container %s failed with error code %i.", arg_machine
, status
.si_status
);
4090 *container
= CONTAINER_TERMINATED
;
4091 return status
.si_status
;
4094 if (status
.si_status
== SIGINT
) {
4096 log_full(arg_quiet
? LOG_DEBUG
: LOG_INFO
, "Container %s has been shut down.", arg_machine
);
4097 *container
= CONTAINER_TERMINATED
;
4100 } else if (status
.si_status
== SIGHUP
) {
4102 log_full(arg_quiet
? LOG_DEBUG
: LOG_INFO
, "Container %s is being rebooted.", arg_machine
);
4103 *container
= CONTAINER_REBOOTED
;
4107 /* CLD_KILLED fallthrough */
4110 log_error("Container %s terminated by signal %s.", arg_machine
, signal_to_string(status
.si_status
));
4114 log_error("Container %s failed due to unknown reason.", arg_machine
);
4121 static void nop_handler(int sig
) {}
4123 static int on_orderly_shutdown(sd_event_source
*s
, const struct signalfd_siginfo
*si
, void *userdata
) {
4126 pid
= PTR_TO_UINT32(userdata
);
4128 if (kill(pid
, arg_kill_signal
) >= 0) {
4129 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
4130 sd_event_source_set_userdata(s
, NULL
);
4135 sd_event_exit(sd_event_source_get_event(s
), 0);
4139 static int determine_names(void) {
4142 if (arg_template
&& !arg_directory
&& arg_machine
) {
4144 /* If --template= was specified then we should not
4145 * search for a machine, but instead create a new one
4146 * in /var/lib/machine. */
4148 arg_directory
= strjoin("/var/lib/machines/", arg_machine
, NULL
);
4153 if (!arg_image
&& !arg_directory
) {
4155 _cleanup_(image_unrefp
) Image
*i
= NULL
;
4157 r
= image_find(arg_machine
, &i
);
4159 return log_error_errno(r
, "Failed to find image for machine '%s': %m", arg_machine
);
4161 log_error("No image for machine '%s': %m", arg_machine
);
4165 if (i
->type
== IMAGE_RAW
)
4166 r
= set_sanitized_path(&arg_image
, i
->path
);
4168 r
= set_sanitized_path(&arg_directory
, i
->path
);
4170 return log_error_errno(r
, "Invalid image directory: %m");
4173 arg_read_only
= arg_read_only
|| i
->read_only
;
4175 arg_directory
= get_current_dir_name();
4177 if (!arg_directory
&& !arg_machine
) {
4178 log_error("Failed to determine path, please use -D or -i.");
4184 if (arg_directory
&& path_equal(arg_directory
, "/"))
4185 arg_machine
= gethostname_malloc();
4187 arg_machine
= strdup(basename(arg_image
?: arg_directory
));
4192 hostname_cleanup(arg_machine
);
4193 if (!machine_name_is_valid(arg_machine
)) {
4194 log_error("Failed to determine machine name automatically, please use -M.");
4198 if (arg_ephemeral
) {
4201 /* Add a random suffix when this is an
4202 * ephemeral machine, so that we can run many
4203 * instances at once without manually having
4204 * to specify -M each time. */
4206 if (asprintf(&b
, "%s-%016" PRIx64
, arg_machine
, random_u64()) < 0)
4217 static int determine_uid_shift(const char *directory
) {
4225 if (arg_uid_shift
== UID_INVALID
) {
4228 r
= stat(directory
, &st
);
4230 return log_error_errno(errno
, "Failed to determine UID base of %s: %m", directory
);
4232 arg_uid_shift
= st
.st_uid
& UINT32_C(0xffff0000);
4234 if (arg_uid_shift
!= (st
.st_gid
& UINT32_C(0xffff0000))) {
4235 log_error("UID and GID base of %s don't match.", directory
);
4239 arg_uid_range
= UINT32_C(0x10000);
4242 if (arg_uid_shift
> (uid_t
) -1 - arg_uid_range
) {
4243 log_error("UID base too high for UID range.");
4247 log_info("Using user namespaces with base " UID_FMT
" and range " UID_FMT
".", arg_uid_shift
, arg_uid_range
);
4251 static int inner_child(
4253 const char *directory
,
4261 _cleanup_free_
char *home
= NULL
;
4263 const char *envp
[] = {
4264 "PATH=" DEFAULT_PATH_SPLIT_USR
,
4265 "container=systemd-nspawn", /* LXC sets container=lxc, so follow the scheme here */
4270 NULL
, /* container_uuid */
4271 NULL
, /* LISTEN_FDS */
4272 NULL
, /* LISTEN_PID */
4276 _cleanup_strv_free_
char **env_use
= NULL
;
4281 assert(kmsg_socket
>= 0);
4286 /* Tell the parent, that it now can write the UID map. */
4287 (void) barrier_place(barrier
); /* #1 */
4289 /* Wait until the parent wrote the UID map */
4290 if (!barrier_place_and_sync(barrier
)) { /* #2 */
4291 log_error("Parent died too early");
4296 r
= mount_all(NULL
, true);
4300 /* Wait until we are cgroup-ified, so that we
4301 * can mount the right cgroup path writable */
4302 if (!barrier_place_and_sync(barrier
)) { /* #3 */
4303 log_error("Parent died too early");
4307 r
= mount_systemd_cgroup_writable("");
4311 r
= reset_uid_gid();
4313 return log_error_errno(r
, "Couldn't become new root: %m");
4315 r
= setup_boot_id(NULL
);
4319 r
= setup_kmsg(NULL
, kmsg_socket
);
4322 kmsg_socket
= safe_close(kmsg_socket
);
4327 return log_error_errno(errno
, "setsid() failed: %m");
4329 if (arg_private_network
)
4332 r
= send_rtnl(rtnl_socket
);
4335 rtnl_socket
= safe_close(rtnl_socket
);
4337 if (drop_capabilities() < 0)
4338 return log_error_errno(errno
, "drop_capabilities() failed: %m");
4342 if (arg_personality
!= PERSONALITY_INVALID
) {
4343 if (personality(arg_personality
) < 0)
4344 return log_error_errno(errno
, "personality() failed: %m");
4345 } else if (secondary
) {
4346 if (personality(PER_LINUX32
) < 0)
4347 return log_error_errno(errno
, "personality() failed: %m");
4351 if (arg_selinux_context
)
4352 if (setexeccon((security_context_t
) arg_selinux_context
) < 0)
4353 return log_error_errno(errno
, "setexeccon(\"%s\") failed: %m", arg_selinux_context
);
4356 r
= change_uid_gid(&home
);
4360 envp
[n_env
] = strv_find_prefix(environ
, "TERM=");
4364 if ((asprintf((char**)(envp
+ n_env
++), "HOME=%s", home
? home
: "/root") < 0) ||
4365 (asprintf((char**)(envp
+ n_env
++), "USER=%s", arg_user
? arg_user
: "root") < 0) ||
4366 (asprintf((char**)(envp
+ n_env
++), "LOGNAME=%s", arg_user
? arg_user
: "root") < 0))
4369 if (!sd_id128_equal(arg_uuid
, SD_ID128_NULL
)) {
4372 if (asprintf((char**)(envp
+ n_env
++), "container_uuid=%s", id128_format_as_uuid(arg_uuid
, as_uuid
)) < 0)
4376 if (fdset_size(fds
) > 0) {
4377 r
= fdset_cloexec(fds
, false);
4379 return log_error_errno(r
, "Failed to unset O_CLOEXEC for file descriptors.");
4381 if ((asprintf((char **)(envp
+ n_env
++), "LISTEN_FDS=%u", fdset_size(fds
)) < 0) ||
4382 (asprintf((char **)(envp
+ n_env
++), "LISTEN_PID=1") < 0))
4386 env_use
= strv_env_merge(2, envp
, arg_setenv
);
4390 /* Let the parent know that we are ready and
4391 * wait until the parent is ready with the
4393 if (!barrier_place_and_sync(barrier
)) { /* #4 */
4394 log_error("Parent died too early");
4398 /* Now, explicitly close the log, so that we
4399 * then can close all remaining fds. Closing
4400 * the log explicitly first has the benefit
4401 * that the logging subsystem knows about it,
4402 * and is thus ready to be reopened should we
4403 * need it again. Note that the other fds
4404 * closed here are at least the locking and
4407 (void) fdset_close_others(fds
);
4413 /* Automatically search for the init system */
4415 m
= 1 + argc
- optind
;
4416 a
= newa(char*, m
+ 1);
4417 memcpy(a
+ 1, argv
+ optind
, m
* sizeof(char*));
4419 a
[0] = (char*) "/usr/lib/systemd/systemd";
4420 execve(a
[0], a
, env_use
);
4422 a
[0] = (char*) "/lib/systemd/systemd";
4423 execve(a
[0], a
, env_use
);
4425 a
[0] = (char*) "/sbin/init";
4426 execve(a
[0], a
, env_use
);
4427 } else if (argc
> optind
)
4428 execvpe(argv
[optind
], argv
+ optind
, env_use
);
4430 chdir(home
? home
: "/root");
4431 execle("/bin/bash", "-bash", NULL
, env_use
);
4432 execle("/bin/sh", "-sh", NULL
, env_use
);
4436 return log_error_errno(errno
, "execv() failed: %m");
4439 static int outer_child(
4441 const char *directory
,
4442 const char *console
,
4443 const char *root_device
, bool root_device_rw
,
4444 const char *home_device
, bool home_device_rw
,
4445 const char *srv_device
, bool srv_device_rw
,
4451 int uid_shift_socket
,
4463 assert(pid_socket
>= 0);
4464 assert(kmsg_socket
>= 0);
4468 if (prctl(PR_SET_PDEATHSIG
, SIGKILL
) < 0)
4469 return log_error_errno(errno
, "PR_SET_PDEATHSIG failed: %m");
4472 close_nointr(STDIN_FILENO
);
4473 close_nointr(STDOUT_FILENO
);
4474 close_nointr(STDERR_FILENO
);
4476 r
= open_terminal(console
, O_RDWR
);
4477 if (r
!= STDIN_FILENO
) {
4483 return log_error_errno(r
, "Failed to open console: %m");
4486 if (dup2(STDIN_FILENO
, STDOUT_FILENO
) != STDOUT_FILENO
||
4487 dup2(STDIN_FILENO
, STDERR_FILENO
) != STDERR_FILENO
)
4488 return log_error_errno(errno
, "Failed to duplicate console: %m");
4491 r
= reset_audit_loginuid();
4495 /* Mark everything as slave, so that we still
4496 * receive mounts from the real root, but don't
4497 * propagate mounts to the real root. */
4498 if (mount(NULL
, "/", NULL
, MS_SLAVE
|MS_REC
, NULL
) < 0)
4499 return log_error_errno(errno
, "MS_SLAVE|MS_REC failed: %m");
4501 r
= mount_devices(directory
,
4502 root_device
, root_device_rw
,
4503 home_device
, home_device_rw
,
4504 srv_device
, srv_device_rw
);
4508 r
= determine_uid_shift(directory
);
4513 l
= send(uid_shift_socket
, &arg_uid_shift
, sizeof(arg_uid_shift
), MSG_NOSIGNAL
);
4515 return log_error_errno(errno
, "Failed to send UID shift: %m");
4516 if (l
!= sizeof(arg_uid_shift
)) {
4517 log_error("Short write while sending UID shift.");
4522 /* Turn directory into bind mount */
4523 if (mount(directory
, directory
, NULL
, MS_BIND
|MS_REC
, NULL
) < 0)
4524 return log_error_errno(errno
, "Failed to make bind mount: %m");
4526 r
= setup_volatile(directory
);
4530 r
= setup_volatile_state(directory
);
4534 r
= base_filesystem_create(directory
, arg_uid_shift
, (gid_t
) arg_uid_shift
);
4538 if (arg_read_only
) {
4539 r
= bind_remount_recursive(directory
, true);
4541 return log_error_errno(r
, "Failed to make tree read-only: %m");
4544 r
= mount_all(directory
, false);
4548 if (copy_devnodes(directory
) < 0)
4551 dev_setup(directory
, arg_uid_shift
, arg_uid_shift
);
4553 if (setup_pts(directory
) < 0)
4556 r
= setup_propagate(directory
);
4560 r
= setup_dev_console(directory
, console
);
4564 r
= setup_seccomp();
4568 r
= setup_timezone(directory
);
4572 r
= setup_resolv_conf(directory
);
4576 r
= setup_journal(directory
);
4580 r
= mount_custom(directory
);
4584 r
= mount_cgroups(directory
);
4588 r
= mount_move_root(directory
);
4590 return log_error_errno(r
, "Failed to move root directory: %m");
4592 pid
= raw_clone(SIGCHLD
|CLONE_NEWNS
|
4593 (arg_share_system
? 0 : CLONE_NEWIPC
|CLONE_NEWPID
|CLONE_NEWUTS
) |
4594 (arg_private_network
? CLONE_NEWNET
: 0) |
4595 (arg_userns
? CLONE_NEWUSER
: 0),
4598 return log_error_errno(errno
, "Failed to fork inner child: %m");
4600 pid_socket
= safe_close(pid_socket
);
4601 uid_shift_socket
= safe_close(uid_shift_socket
);
4603 /* The inner child has all namespaces that are
4604 * requested, so that we all are owned by the user if
4605 * user namespaces are turned on. */
4607 r
= inner_child(barrier
, directory
, secondary
, kmsg_socket
, rtnl_socket
, fds
, argc
, argv
);
4609 _exit(EXIT_FAILURE
);
4611 _exit(EXIT_SUCCESS
);
4614 l
= send(pid_socket
, &pid
, sizeof(pid
), MSG_NOSIGNAL
);
4616 return log_error_errno(errno
, "Failed to send PID: %m");
4617 if (l
!= sizeof(pid
)) {
4618 log_error("Short write while sending PID.");
4622 pid_socket
= safe_close(pid_socket
);
4627 static int setup_uid_map(pid_t pid
) {
4628 char uid_map
[strlen("/proc//uid_map") + DECIMAL_STR_MAX(uid_t
) + 1], line
[DECIMAL_STR_MAX(uid_t
)*3+3+1];
4633 xsprintf(uid_map
, "/proc/" PID_FMT
"/uid_map", pid
);
4634 xsprintf(line
, UID_FMT
" " UID_FMT
" " UID_FMT
"\n", 0, arg_uid_shift
, arg_uid_range
);
4635 r
= write_string_file(uid_map
, line
, 0);
4637 return log_error_errno(r
, "Failed to write UID map: %m");
4639 /* We always assign the same UID and GID ranges */
4640 xsprintf(uid_map
, "/proc/" PID_FMT
"/gid_map", pid
);
4641 r
= write_string_file(uid_map
, line
, 0);
4643 return log_error_errno(r
, "Failed to write GID map: %m");
4648 static int chown_cgroup(pid_t pid
) {
4649 _cleanup_free_
char *path
= NULL
, *fs
= NULL
;
4650 _cleanup_close_
int fd
= -1;
4654 r
= cg_pid_get_path(NULL
, pid
, &path
);
4656 return log_error_errno(r
, "Failed to get container cgroup path: %m");
4658 r
= cg_get_path(SYSTEMD_CGROUP_CONTROLLER
, path
, NULL
, &fs
);
4660 return log_error_errno(r
, "Failed to get file system path for container cgroup: %m");
4662 fd
= open(fs
, O_RDONLY
|O_CLOEXEC
|O_DIRECTORY
);
4664 return log_error_errno(errno
, "Failed to open %s: %m", fs
);
4669 "notify_on_release",
4671 "cgroup.clone_children",
4672 "cgroup.controllers",
4673 "cgroup.subtree_control",
4675 if (fchownat(fd
, fn
, arg_uid_shift
, arg_uid_shift
, 0) < 0)
4676 log_full_errno(errno
== ENOENT
? LOG_DEBUG
: LOG_WARNING
, errno
,
4677 "Failed to chown() cgroup file %s, ignoring: %m", fn
);
4682 static int sync_cgroup(pid_t pid
) {
4683 _cleanup_free_
char *cgroup
= NULL
;
4684 char tree
[] = "/tmp/unifiedXXXXXX", pid_string
[DECIMAL_STR_MAX(pid
) + 1];
4685 bool undo_mount
= false;
4689 unified
= cg_unified();
4691 return log_error_errno(unified
, "Failed to determine whether the unified hierachy is used: %m");
4693 if ((unified
> 0) == arg_unified_cgroup_hierarchy
)
4696 /* When the host uses the legacy cgroup setup, but the
4697 * container shall use the unified hierarchy, let's make sure
4698 * we copy the path from the name=systemd hierarchy into the
4699 * unified hierarchy. Similar for the reverse situation. */
4701 r
= cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER
, pid
, &cgroup
);
4703 return log_error_errno(r
, "Failed to get control group of " PID_FMT
": %m", pid
);
4705 /* In order to access the unified hierarchy we need to mount it */
4707 return log_error_errno(errno
, "Failed to generate temporary mount point for unified hierarchy: %m");
4710 r
= mount("cgroup", tree
, "cgroup", MS_NOSUID
|MS_NOEXEC
|MS_NODEV
, "none,name=systemd,xattr");
4712 r
= mount("cgroup", tree
, "cgroup", MS_NOSUID
|MS_NOEXEC
|MS_NODEV
, "__DEVEL__sane_behavior");
4714 r
= log_error_errno(errno
, "Failed to mount unified hierarchy: %m");
4720 fn
= strjoina(tree
, cgroup
, "/cgroup.procs");
4721 (void) mkdir_parents(fn
, 0755);
4723 sprintf(pid_string
, PID_FMT
, pid
);
4724 r
= write_string_file(fn
, pid_string
, 0);
4726 log_error_errno(r
, "Failed to move process: %m");
4730 (void) umount(tree
);
4736 static int create_subcgroup(pid_t pid
) {
4737 _cleanup_free_
char *cgroup
= NULL
;
4741 /* In the unified hierarchy inner nodes may only only contain
4742 * subgroups, but not processes. Hence, if we running in the
4743 * unified hierarchy and the container does the same, and we
4744 * did not create a scope unit for the container move us and
4745 * the container into two separate subcgroups. */
4750 if (!arg_unified_cgroup_hierarchy
)
4753 unified
= cg_unified();
4755 return log_error_errno(unified
, "Failed to determine whether the unified hierachy is used: %m");
4759 r
= cg_pid_get_path(SYSTEMD_CGROUP_CONTROLLER
, 0, &cgroup
);
4761 return log_error_errno(r
, "Failed to get our control group: %m");
4763 child
= strjoina(cgroup
, "/payload");
4764 r
= cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER
, child
, pid
);
4766 return log_error_errno(r
, "Failed to create %s subcgroup: %m", child
);
4768 child
= strjoina(cgroup
, "/supervisor");
4769 r
= cg_create_and_attach(SYSTEMD_CGROUP_CONTROLLER
, child
, 0);
4771 return log_error_errno(r
, "Failed to create %s subcgroup: %m", child
);
4776 int main(int argc
, char *argv
[]) {
4778 _cleanup_free_
char *device_path
= NULL
, *root_device
= NULL
, *home_device
= NULL
, *srv_device
= NULL
, *console
= NULL
;
4779 bool root_device_rw
= true, home_device_rw
= true, srv_device_rw
= true;
4780 _cleanup_close_
int master
= -1, image_fd
= -1;
4781 _cleanup_fdset_free_ FDSet
*fds
= NULL
;
4782 int r
, n_fd_passed
, loop_nr
= -1;
4783 char veth_name
[IFNAMSIZ
];
4784 bool secondary
= false, remove_subvol
= false;
4787 int ret
= EXIT_SUCCESS
;
4788 union in_addr_union exposed
= {};
4789 _cleanup_release_lock_file_ LockFile tree_global_lock
= LOCK_FILE_INIT
, tree_local_lock
= LOCK_FILE_INIT
;
4792 log_parse_environment();
4795 r
= parse_argv(argc
, argv
);
4799 r
= determine_names();
4803 if (geteuid() != 0) {
4804 log_error("Need to be root.");
4809 n_fd_passed
= sd_listen_fds(false);
4810 if (n_fd_passed
> 0) {
4811 r
= fdset_new_listen_fds(&fds
, false);
4813 log_error_errno(r
, "Failed to collect file descriptors: %m");
4818 if (arg_directory
) {
4821 if (path_equal(arg_directory
, "/") && !arg_ephemeral
) {
4822 log_error("Spawning container on root directory is not supported. Consider using --ephemeral.");
4827 if (arg_ephemeral
) {
4828 _cleanup_free_
char *np
= NULL
;
4830 /* If the specified path is a mount point we
4831 * generate the new snapshot immediately
4832 * inside it under a random name. However if
4833 * the specified is not a mount point we
4834 * create the new snapshot in the parent
4835 * directory, just next to it. */
4836 r
= path_is_mount_point(arg_directory
, 0);
4838 log_error_errno(r
, "Failed to determine whether directory %s is mount point: %m", arg_directory
);
4842 r
= tempfn_random_child(arg_directory
, "machine.", &np
);
4844 r
= tempfn_random(arg_directory
, "machine.", &np
);
4846 log_error_errno(r
, "Failed to generate name for snapshot: %m");
4850 r
= image_path_lock(np
, (arg_read_only
? LOCK_SH
: LOCK_EX
) | LOCK_NB
, &tree_global_lock
, &tree_local_lock
);
4852 log_error_errno(r
, "Failed to lock %s: %m", np
);
4856 r
= btrfs_subvol_snapshot(arg_directory
, np
, (arg_read_only
? BTRFS_SNAPSHOT_READ_ONLY
: 0) | BTRFS_SNAPSHOT_FALLBACK_COPY
| BTRFS_SNAPSHOT_RECURSIVE
);
4858 log_error_errno(r
, "Failed to create snapshot %s from %s: %m", np
, arg_directory
);
4862 free(arg_directory
);
4866 remove_subvol
= true;
4869 r
= image_path_lock(arg_directory
, (arg_read_only
? LOCK_SH
: LOCK_EX
) | LOCK_NB
, &tree_global_lock
, &tree_local_lock
);
4871 log_error_errno(r
, "Directory tree %s is currently busy.", arg_directory
);
4875 log_error_errno(r
, "Failed to lock %s: %m", arg_directory
);
4880 r
= btrfs_subvol_snapshot(arg_template
, arg_directory
, (arg_read_only
? BTRFS_SNAPSHOT_READ_ONLY
: 0) | BTRFS_SNAPSHOT_FALLBACK_COPY
| BTRFS_SNAPSHOT_RECURSIVE
);
4883 log_info("Directory %s already exists, not populating from template %s.", arg_directory
, arg_template
);
4885 log_error_errno(r
, "Couldn't create snapshot %s from %s: %m", arg_directory
, arg_template
);
4889 log_info("Populated %s from template %s.", arg_directory
, arg_template
);
4895 if (path_is_os_tree(arg_directory
) <= 0) {
4896 log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", arg_directory
);
4903 p
= strjoina(arg_directory
,
4904 argc
> optind
&& path_is_absolute(argv
[optind
]) ? argv
[optind
] : "/usr/bin/");
4905 if (access(p
, F_OK
) < 0) {
4906 log_error("Directory %s lacks the binary to execute or doesn't look like a binary tree. Refusing.", arg_directory
);
4913 char template[] = "/tmp/nspawn-root-XXXXXX";
4916 assert(!arg_template
);
4918 r
= image_path_lock(arg_image
, (arg_read_only
? LOCK_SH
: LOCK_EX
) | LOCK_NB
, &tree_global_lock
, &tree_local_lock
);
4920 r
= log_error_errno(r
, "Disk image %s is currently busy.", arg_image
);
4924 r
= log_error_errno(r
, "Failed to create image lock: %m");
4928 if (!mkdtemp(template)) {
4929 log_error_errno(errno
, "Failed to create temporary directory: %m");
4934 arg_directory
= strdup(template);
4935 if (!arg_directory
) {
4940 image_fd
= setup_image(&device_path
, &loop_nr
);
4946 r
= dissect_image(image_fd
,
4947 &root_device
, &root_device_rw
,
4948 &home_device
, &home_device_rw
,
4949 &srv_device
, &srv_device_rw
,
4955 r
= custom_mounts_prepare();
4960 isatty(STDIN_FILENO
) > 0 &&
4961 isatty(STDOUT_FILENO
) > 0;
4963 master
= posix_openpt(O_RDWR
|O_NOCTTY
|O_CLOEXEC
|O_NDELAY
);
4965 r
= log_error_errno(errno
, "Failed to acquire pseudo tty: %m");
4969 r
= ptsname_malloc(master
, &console
);
4971 r
= log_error_errno(r
, "Failed to determine tty name: %m");
4975 if (unlockpt(master
) < 0) {
4976 r
= log_error_errno(errno
, "Failed to unlock tty: %m");
4981 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
4982 arg_machine
, arg_image
?: arg_directory
);
4984 assert_se(sigprocmask_many(SIG_BLOCK
, NULL
, SIGCHLD
, SIGWINCH
, SIGTERM
, SIGINT
, -1) >= 0);
4986 assert_se(sigemptyset(&mask_chld
) == 0);
4987 assert_se(sigaddset(&mask_chld
, SIGCHLD
) == 0);
4989 if (prctl(PR_SET_CHILD_SUBREAPER
, 1) < 0) {
4990 r
= log_error_errno(errno
, "Failed to become subreaper: %m");
4995 _cleanup_close_pair_
int kmsg_socket_pair
[2] = { -1, -1 }, rtnl_socket_pair
[2] = { -1, -1 }, pid_socket_pair
[2] = { -1, -1 },
4996 uid_shift_socket_pair
[2] = { -1, -1 };
4997 ContainerStatus container_status
;
4998 _cleanup_(barrier_destroy
) Barrier barrier
= BARRIER_NULL
;
4999 static const struct sigaction sa
= {
5000 .sa_handler
= nop_handler
,
5001 .sa_flags
= SA_NOCLDSTOP
,
5005 _cleanup_event_unref_ sd_event
*event
= NULL
;
5006 _cleanup_(pty_forward_freep
) PTYForward
*forward
= NULL
;
5007 _cleanup_netlink_unref_ sd_netlink
*rtnl
= NULL
;
5010 r
= barrier_create(&barrier
);
5012 log_error_errno(r
, "Cannot initialize IPC barrier: %m");
5016 if (socketpair(AF_UNIX
, SOCK_DGRAM
|SOCK_CLOEXEC
, 0, kmsg_socket_pair
) < 0) {
5017 r
= log_error_errno(errno
, "Failed to create kmsg socket pair: %m");
5021 if (socketpair(AF_UNIX
, SOCK_DGRAM
|SOCK_CLOEXEC
, 0, rtnl_socket_pair
) < 0) {
5022 r
= log_error_errno(errno
, "Failed to create rtnl socket pair: %m");
5026 if (socketpair(AF_UNIX
, SOCK_DGRAM
|SOCK_CLOEXEC
, 0, pid_socket_pair
) < 0) {
5027 r
= log_error_errno(errno
, "Failed to create pid socket pair: %m");
5032 if (socketpair(AF_UNIX
, SOCK_DGRAM
|SOCK_CLOEXEC
, 0, uid_shift_socket_pair
) < 0) {
5033 r
= log_error_errno(errno
, "Failed to create uid shift socket pair: %m");
5037 /* Child can be killed before execv(), so handle SIGCHLD
5038 * in order to interrupt parent's blocking calls and
5039 * give it a chance to call wait() and terminate. */
5040 r
= sigprocmask(SIG_UNBLOCK
, &mask_chld
, NULL
);
5042 r
= log_error_errno(errno
, "Failed to change the signal mask: %m");
5046 r
= sigaction(SIGCHLD
, &sa
, NULL
);
5048 r
= log_error_errno(errno
, "Failed to install SIGCHLD handler: %m");
5052 pid
= raw_clone(SIGCHLD
|CLONE_NEWNS
, NULL
);
5054 if (errno
== EINVAL
)
5055 r
= log_error_errno(errno
, "clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m");
5057 r
= log_error_errno(errno
, "clone() failed: %m");
5063 /* The outer child only has a file system namespace. */
5064 barrier_set_role(&barrier
, BARRIER_CHILD
);
5066 master
= safe_close(master
);
5068 kmsg_socket_pair
[0] = safe_close(kmsg_socket_pair
[0]);
5069 rtnl_socket_pair
[0] = safe_close(rtnl_socket_pair
[0]);
5070 pid_socket_pair
[0] = safe_close(pid_socket_pair
[0]);
5071 uid_shift_socket_pair
[0] = safe_close(uid_shift_socket_pair
[0]);
5073 (void) reset_all_signal_handlers();
5074 (void) reset_signal_mask();
5076 r
= outer_child(&barrier
,
5079 root_device
, root_device_rw
,
5080 home_device
, home_device_rw
,
5081 srv_device
, srv_device_rw
,
5085 kmsg_socket_pair
[1],
5086 rtnl_socket_pair
[1],
5087 uid_shift_socket_pair
[1],
5091 _exit(EXIT_FAILURE
);
5093 _exit(EXIT_SUCCESS
);
5096 barrier_set_role(&barrier
, BARRIER_PARENT
);
5101 kmsg_socket_pair
[1] = safe_close(kmsg_socket_pair
[1]);
5102 rtnl_socket_pair
[1] = safe_close(rtnl_socket_pair
[1]);
5103 pid_socket_pair
[1] = safe_close(pid_socket_pair
[1]);
5105 /* Wait for the outer child. */
5106 r
= wait_for_terminate_and_warn("namespace helper", pid
, NULL
);
5115 /* And now retrieve the PID of the inner child. */
5116 l
= recv(pid_socket_pair
[0], &pid
, sizeof(pid
), 0);
5118 r
= log_error_errno(errno
, "Failed to read inner child PID: %m");
5121 if (l
!= sizeof(pid
)) {
5122 log_error("Short read while reading inner child PID: %m");
5127 log_debug("Init process invoked as PID " PID_FMT
, pid
);
5130 if (!barrier_place_and_sync(&barrier
)) { /* #1 */
5131 log_error("Child died too early.");
5136 l
= recv(uid_shift_socket_pair
[0], &arg_uid_shift
, sizeof(arg_uid_shift
), 0);
5138 r
= log_error_errno(errno
, "Failed to read UID shift: %m");
5141 if (l
!= sizeof(arg_uid_shift
)) {
5142 log_error("Short read while reading UID shift: %m");
5147 r
= setup_uid_map(pid
);
5151 (void) barrier_place(&barrier
); /* #2 */
5154 r
= move_network_interfaces(pid
);
5158 r
= setup_veth(pid
, veth_name
, &ifi
);
5162 r
= setup_bridge(veth_name
, &ifi
);
5166 r
= setup_macvlan(pid
);
5170 r
= setup_ipvlan(pid
);
5174 r
= register_machine(pid
, ifi
);
5178 r
= sync_cgroup(pid
);
5182 r
= create_subcgroup(pid
);
5186 r
= chown_cgroup(pid
);
5190 /* Notify the child that the parent is ready with all
5191 * its setup (including cgroup-ification), and that
5192 * the child can now hand over control to the code to
5193 * run inside the container. */
5194 (void) barrier_place(&barrier
); /* #3 */
5196 /* Block SIGCHLD here, before notifying child.
5197 * process_pty() will handle it with the other signals. */
5198 assert_se(sigprocmask(SIG_BLOCK
, &mask_chld
, NULL
) >= 0);
5200 /* Reset signal to default */
5201 r
= default_signals(SIGCHLD
, -1);
5203 log_error_errno(r
, "Failed to reset SIGCHLD: %m");
5207 /* Let the child know that we are ready and wait that the child is completely ready now. */
5208 if (!barrier_place_and_sync(&barrier
)) { /* #5 */
5209 log_error("Client died too early.");
5216 "STATUS=Container running.\n"
5217 "X_NSPAWN_LEADER_PID=" PID_FMT
, pid
);
5219 r
= sd_event_new(&event
);
5221 log_error_errno(r
, "Failed to get default event source: %m");
5225 if (arg_kill_signal
> 0) {
5226 /* Try to kill the init system on SIGINT or SIGTERM */
5227 sd_event_add_signal(event
, NULL
, SIGINT
, on_orderly_shutdown
, UINT32_TO_PTR(pid
));
5228 sd_event_add_signal(event
, NULL
, SIGTERM
, on_orderly_shutdown
, UINT32_TO_PTR(pid
));
5230 /* Immediately exit */
5231 sd_event_add_signal(event
, NULL
, SIGINT
, NULL
, NULL
);
5232 sd_event_add_signal(event
, NULL
, SIGTERM
, NULL
, NULL
);
5235 /* simply exit on sigchld */
5236 sd_event_add_signal(event
, NULL
, SIGCHLD
, NULL
, NULL
);
5238 if (arg_expose_ports
) {
5239 r
= watch_rtnl(event
, rtnl_socket_pair
[0], &exposed
, &rtnl
);
5243 (void) expose_ports(rtnl
, &exposed
);
5246 rtnl_socket_pair
[0] = safe_close(rtnl_socket_pair
[0]);
5248 r
= pty_forward_new(event
, master
, true, !interactive
, &forward
);
5250 log_error_errno(r
, "Failed to create PTY forwarder: %m");
5254 r
= sd_event_loop(event
);
5256 log_error_errno(r
, "Failed to run event loop: %m");
5260 pty_forward_get_last_char(forward
, &last_char
);
5262 forward
= pty_forward_free(forward
);
5264 if (!arg_quiet
&& last_char
!= '\n')
5267 /* Kill if it is not dead yet anyway */
5268 terminate_machine(pid
);
5270 /* Normally redundant, but better safe than sorry */
5273 r
= wait_for_container(pid
, &container_status
);
5277 /* We failed to wait for the container, or the
5278 * container exited abnormally */
5280 else if (r
> 0 || container_status
== CONTAINER_TERMINATED
){
5281 /* The container exited with a non-zero
5282 * status, or with zero status and no reboot
5288 /* CONTAINER_REBOOTED, loop again */
5290 if (arg_keep_unit
) {
5291 /* Special handling if we are running as a
5292 * service: instead of simply restarting the
5293 * machine we want to restart the entire
5294 * service, so let's inform systemd about this
5295 * with the special exit code 133. The service
5296 * file uses RestartForceExitStatus=133 so
5297 * that this results in a full nspawn
5298 * restart. This is necessary since we might
5299 * have cgroup parameters set we want to have
5306 flush_ports(&exposed
);
5312 "STATUS=Terminating...");
5317 /* Try to flush whatever is still queued in the pty */
5319 (void) copy_bytes(master
, STDOUT_FILENO
, (off_t
) -1, false);
5321 loop_remove(loop_nr
, &image_fd
);
5323 if (remove_subvol
&& arg_directory
) {
5326 k
= btrfs_subvol_remove(arg_directory
, true);
5328 log_warning_errno(k
, "Cannot remove subvolume '%s', ignoring: %m", arg_directory
);
5334 p
= strjoina("/run/systemd/nspawn/propagate/", arg_machine
);
5335 (void) rm_rf(p
, REMOVE_ROOT
);
5338 free(arg_directory
);
5343 strv_free(arg_setenv
);
5344 strv_free(arg_network_interfaces
);
5345 strv_free(arg_network_macvlan
);
5346 strv_free(arg_network_ipvlan
);
5347 custom_mount_free_all();
5349 flush_ports(&exposed
);
5351 while (arg_expose_ports
) {
5352 ExposePort
*p
= arg_expose_ports
;
5353 LIST_REMOVE(ports
, arg_expose_ports
, p
);
5357 return r
< 0 ? EXIT_FAILURE
: ret
;