]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/nspawn/nspawn.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #286 from jsynacek/fix-edit-v3
[thirdparty/systemd.git] / src / nspawn / nspawn.c
1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
2
3 /***
4 This file is part of systemd.
5
6 Copyright 2010 Lennart Poettering
7
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
11 (at your option) any later version.
12
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Lesser General Public License for more details.
17
18 You should have received a copy of the GNU Lesser General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
20 ***/
21
22 #include <signal.h>
23 #include <sched.h>
24 #include <unistd.h>
25 #include <sys/types.h>
26 #include <sys/mount.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <stdio.h>
30 #include <errno.h>
31 #include <sys/prctl.h>
32 #include <getopt.h>
33 #include <grp.h>
34 #include <linux/fs.h>
35 #include <sys/socket.h>
36 #include <linux/netlink.h>
37 #include <net/if.h>
38 #include <linux/veth.h>
39 #include <sys/personality.h>
40 #include <linux/loop.h>
41 #include <sys/file.h>
42
43 #ifdef HAVE_SELINUX
44 #include <selinux/selinux.h>
45 #endif
46
47 #ifdef HAVE_SECCOMP
48 #include <seccomp.h>
49 #endif
50
51 #ifdef HAVE_BLKID
52 #include <blkid/blkid.h>
53 #endif
54
55 #include "sd-daemon.h"
56 #include "sd-bus.h"
57 #include "sd-id128.h"
58 #include "sd-netlink.h"
59 #include "random-util.h"
60 #include "log.h"
61 #include "util.h"
62 #include "mkdir.h"
63 #include "rm-rf.h"
64 #include "macro.h"
65 #include "missing.h"
66 #include "cgroup-util.h"
67 #include "strv.h"
68 #include "path-util.h"
69 #include "loopback-setup.h"
70 #include "dev-setup.h"
71 #include "fdset.h"
72 #include "build.h"
73 #include "fileio.h"
74 #include "bus-util.h"
75 #include "bus-error.h"
76 #include "ptyfwd.h"
77 #include "env-util.h"
78 #include "netlink-util.h"
79 #include "udev-util.h"
80 #include "blkid-util.h"
81 #include "gpt.h"
82 #include "siphash24.h"
83 #include "copy.h"
84 #include "base-filesystem.h"
85 #include "barrier.h"
86 #include "event-util.h"
87 #include "capability.h"
88 #include "cap-list.h"
89 #include "btrfs-util.h"
90 #include "machine-image.h"
91 #include "list.h"
92 #include "in-addr-util.h"
93 #include "firewall-util.h"
94 #include "local-addresses.h"
95 #include "formats-util.h"
96 #include "process-util.h"
97 #include "terminal-util.h"
98 #include "hostname-util.h"
99 #include "signal-util.h"
100
101 #ifdef HAVE_SECCOMP
102 #include "seccomp-util.h"
103 #endif
104
105 typedef struct ExposePort {
106 int protocol;
107 uint16_t host_port;
108 uint16_t container_port;
109 LIST_FIELDS(struct ExposePort, ports);
110 } ExposePort;
111
112 typedef enum ContainerStatus {
113 CONTAINER_TERMINATED,
114 CONTAINER_REBOOTED
115 } ContainerStatus;
116
117 typedef enum LinkJournal {
118 LINK_NO,
119 LINK_AUTO,
120 LINK_HOST,
121 LINK_GUEST
122 } LinkJournal;
123
124 typedef enum Volatile {
125 VOLATILE_NO,
126 VOLATILE_YES,
127 VOLATILE_STATE,
128 } Volatile;
129
130 typedef enum CustomMountType {
131 CUSTOM_MOUNT_BIND,
132 CUSTOM_MOUNT_TMPFS,
133 CUSTOM_MOUNT_OVERLAY,
134 } CustomMountType;
135
136 typedef struct CustomMount {
137 CustomMountType type;
138 bool read_only;
139 char *source; /* for overlayfs this is the upper directory */
140 char *destination;
141 char *options;
142 char *work_dir;
143 char **lower;
144 } CustomMount;
145
146 static char *arg_directory = NULL;
147 static char *arg_template = NULL;
148 static char *arg_user = NULL;
149 static sd_id128_t arg_uuid = {};
150 static char *arg_machine = NULL;
151 static const char *arg_selinux_context = NULL;
152 static const char *arg_selinux_apifs_context = NULL;
153 static const char *arg_slice = NULL;
154 static bool arg_private_network = false;
155 static bool arg_read_only = false;
156 static bool arg_boot = false;
157 static bool arg_ephemeral = false;
158 static LinkJournal arg_link_journal = LINK_AUTO;
159 static bool arg_link_journal_try = false;
160 static uint64_t arg_retain =
161 (1ULL << CAP_CHOWN) |
162 (1ULL << CAP_DAC_OVERRIDE) |
163 (1ULL << CAP_DAC_READ_SEARCH) |
164 (1ULL << CAP_FOWNER) |
165 (1ULL << CAP_FSETID) |
166 (1ULL << CAP_IPC_OWNER) |
167 (1ULL << CAP_KILL) |
168 (1ULL << CAP_LEASE) |
169 (1ULL << CAP_LINUX_IMMUTABLE) |
170 (1ULL << CAP_NET_BIND_SERVICE) |
171 (1ULL << CAP_NET_BROADCAST) |
172 (1ULL << CAP_NET_RAW) |
173 (1ULL << CAP_SETGID) |
174 (1ULL << CAP_SETFCAP) |
175 (1ULL << CAP_SETPCAP) |
176 (1ULL << CAP_SETUID) |
177 (1ULL << CAP_SYS_ADMIN) |
178 (1ULL << CAP_SYS_CHROOT) |
179 (1ULL << CAP_SYS_NICE) |
180 (1ULL << CAP_SYS_PTRACE) |
181 (1ULL << CAP_SYS_TTY_CONFIG) |
182 (1ULL << CAP_SYS_RESOURCE) |
183 (1ULL << CAP_SYS_BOOT) |
184 (1ULL << CAP_AUDIT_WRITE) |
185 (1ULL << CAP_AUDIT_CONTROL) |
186 (1ULL << CAP_MKNOD);
187 static CustomMount *arg_custom_mounts = NULL;
188 static unsigned arg_n_custom_mounts = 0;
189 static char **arg_setenv = NULL;
190 static bool arg_quiet = false;
191 static bool arg_share_system = false;
192 static bool arg_register = true;
193 static bool arg_keep_unit = false;
194 static char **arg_network_interfaces = NULL;
195 static char **arg_network_macvlan = NULL;
196 static char **arg_network_ipvlan = NULL;
197 static bool arg_network_veth = false;
198 static const char *arg_network_bridge = NULL;
199 static unsigned long arg_personality = PERSONALITY_INVALID;
200 static char *arg_image = NULL;
201 static Volatile arg_volatile = VOLATILE_NO;
202 static ExposePort *arg_expose_ports = NULL;
203 static char **arg_property = NULL;
204 static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
205 static bool arg_userns = false;
206 static int arg_kill_signal = 0;
207
208 static void help(void) {
209 printf("%s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
210 "Spawn a minimal namespace container for debugging, testing and building.\n\n"
211 " -h --help Show this help\n"
212 " --version Print version string\n"
213 " -q --quiet Do not show status information\n"
214 " -D --directory=PATH Root directory for the container\n"
215 " --template=PATH Initialize root directory from template directory,\n"
216 " if missing\n"
217 " -x --ephemeral Run container with snapshot of root directory, and\n"
218 " remove it after exit\n"
219 " -i --image=PATH File system device or disk image for the container\n"
220 " -b --boot Boot up full system (i.e. invoke init)\n"
221 " -u --user=USER Run the command under specified user or uid\n"
222 " -M --machine=NAME Set the machine name for the container\n"
223 " --uuid=UUID Set a specific machine UUID for the container\n"
224 " -S --slice=SLICE Place the container in the specified slice\n"
225 " --property=NAME=VALUE Set scope unit property\n"
226 " --private-users[=UIDBASE[:NUIDS]]\n"
227 " Run within user namespace\n"
228 " --private-network Disable network in container\n"
229 " --network-interface=INTERFACE\n"
230 " Assign an existing network interface to the\n"
231 " container\n"
232 " --network-macvlan=INTERFACE\n"
233 " Create a macvlan network interface based on an\n"
234 " existing network interface to the container\n"
235 " --network-ipvlan=INTERFACE\n"
236 " Create a ipvlan network interface based on an\n"
237 " existing network interface to the container\n"
238 " -n --network-veth Add a virtual ethernet connection between host\n"
239 " and container\n"
240 " --network-bridge=INTERFACE\n"
241 " Add a virtual ethernet connection between host\n"
242 " and container and add it to an existing bridge on\n"
243 " the host\n"
244 " -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
245 " Expose a container IP port on the host\n"
246 " -Z --selinux-context=SECLABEL\n"
247 " Set the SELinux security context to be used by\n"
248 " processes in the container\n"
249 " -L --selinux-apifs-context=SECLABEL\n"
250 " Set the SELinux security context to be used by\n"
251 " API/tmpfs file systems in the container\n"
252 " --capability=CAP In addition to the default, retain specified\n"
253 " capability\n"
254 " --drop-capability=CAP Drop the specified capability from the default set\n"
255 " --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
256 " --link-journal=MODE Link up guest journal, one of no, auto, guest, host,\n"
257 " try-guest, try-host\n"
258 " -j Equivalent to --link-journal=try-guest\n"
259 " --read-only Mount the root directory read-only\n"
260 " --bind=PATH[:PATH] Bind mount a file or directory from the host into\n"
261 " the container\n"
262 " --bind-ro=PATH[:PATH] Similar, but creates a read-only bind mount\n"
263 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
264 " --overlay=PATH[:PATH...]:PATH\n"
265 " Create an overlay mount from the host to \n"
266 " the container\n"
267 " --overlay-ro=PATH[:PATH...]:PATH\n"
268 " Similar, but creates a read-only overlay mount\n"
269 " --setenv=NAME=VALUE Pass an environment variable to PID 1\n"
270 " --share-system Share system namespaces with host\n"
271 " --register=BOOLEAN Register container as machine\n"
272 " --keep-unit Do not register a scope for the machine, reuse\n"
273 " the service unit nspawn is running in\n"
274 " --volatile[=MODE] Run the system in volatile mode\n"
275 , program_invocation_short_name);
276 }
277
278 static CustomMount* custom_mount_add(CustomMountType t) {
279 CustomMount *c, *ret;
280
281 c = realloc(arg_custom_mounts, (arg_n_custom_mounts + 1) * sizeof(CustomMount));
282 if (!c)
283 return NULL;
284
285 arg_custom_mounts = c;
286 ret = arg_custom_mounts + arg_n_custom_mounts;
287 arg_n_custom_mounts++;
288
289 *ret = (CustomMount) { .type = t };
290
291 return ret;
292 }
293
294 static void custom_mount_free_all(void) {
295 unsigned i;
296
297 for (i = 0; i < arg_n_custom_mounts; i++) {
298 CustomMount *m = &arg_custom_mounts[i];
299
300 free(m->source);
301 free(m->destination);
302 free(m->options);
303
304 if (m->work_dir) {
305 (void) rm_rf(m->work_dir, REMOVE_ROOT|REMOVE_PHYSICAL);
306 free(m->work_dir);
307 }
308
309 strv_free(m->lower);
310 }
311
312 free(arg_custom_mounts);
313 arg_custom_mounts = NULL;
314 arg_n_custom_mounts = 0;
315 }
316
317 static int custom_mount_compare(const void *a, const void *b) {
318 const CustomMount *x = a, *y = b;
319 int r;
320
321 r = path_compare(x->destination, y->destination);
322 if (r != 0)
323 return r;
324
325 if (x->type < y->type)
326 return -1;
327 if (x->type > y->type)
328 return 1;
329
330 return 0;
331 }
332
333 static int custom_mounts_prepare(void) {
334 unsigned i;
335 int r;
336
337 /* Ensure the mounts are applied prefix first. */
338 qsort_safe(arg_custom_mounts, arg_n_custom_mounts, sizeof(CustomMount), custom_mount_compare);
339
340 /* Allocate working directories for the overlay file systems that need it */
341 for (i = 0; i < arg_n_custom_mounts; i++) {
342 CustomMount *m = &arg_custom_mounts[i];
343
344 if (m->type != CUSTOM_MOUNT_OVERLAY)
345 continue;
346
347 if (m->work_dir)
348 continue;
349
350 if (m->read_only)
351 continue;
352
353 r = tempfn_random(m->source, NULL, &m->work_dir);
354 if (r < 0)
355 return log_error_errno(r, "Failed to generate work directory from %s: %m", m->source);
356 }
357
358 return 0;
359 }
360
361 static int set_sanitized_path(char **b, const char *path) {
362 char *p;
363
364 assert(b);
365 assert(path);
366
367 p = canonicalize_file_name(path);
368 if (!p) {
369 if (errno != ENOENT)
370 return -errno;
371
372 p = path_make_absolute_cwd(path);
373 if (!p)
374 return -ENOMEM;
375 }
376
377 free(*b);
378 *b = path_kill_slashes(p);
379 return 0;
380 }
381
382 static int parse_argv(int argc, char *argv[]) {
383
384 enum {
385 ARG_VERSION = 0x100,
386 ARG_PRIVATE_NETWORK,
387 ARG_UUID,
388 ARG_READ_ONLY,
389 ARG_CAPABILITY,
390 ARG_DROP_CAPABILITY,
391 ARG_LINK_JOURNAL,
392 ARG_BIND,
393 ARG_BIND_RO,
394 ARG_TMPFS,
395 ARG_OVERLAY,
396 ARG_OVERLAY_RO,
397 ARG_SETENV,
398 ARG_SHARE_SYSTEM,
399 ARG_REGISTER,
400 ARG_KEEP_UNIT,
401 ARG_NETWORK_INTERFACE,
402 ARG_NETWORK_MACVLAN,
403 ARG_NETWORK_IPVLAN,
404 ARG_NETWORK_BRIDGE,
405 ARG_PERSONALITY,
406 ARG_VOLATILE,
407 ARG_TEMPLATE,
408 ARG_PROPERTY,
409 ARG_PRIVATE_USERS,
410 ARG_KILL_SIGNAL,
411 };
412
413 static const struct option options[] = {
414 { "help", no_argument, NULL, 'h' },
415 { "version", no_argument, NULL, ARG_VERSION },
416 { "directory", required_argument, NULL, 'D' },
417 { "template", required_argument, NULL, ARG_TEMPLATE },
418 { "ephemeral", no_argument, NULL, 'x' },
419 { "user", required_argument, NULL, 'u' },
420 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
421 { "boot", no_argument, NULL, 'b' },
422 { "uuid", required_argument, NULL, ARG_UUID },
423 { "read-only", no_argument, NULL, ARG_READ_ONLY },
424 { "capability", required_argument, NULL, ARG_CAPABILITY },
425 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
426 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
427 { "bind", required_argument, NULL, ARG_BIND },
428 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
429 { "tmpfs", required_argument, NULL, ARG_TMPFS },
430 { "overlay", required_argument, NULL, ARG_OVERLAY },
431 { "overlay-ro", required_argument, NULL, ARG_OVERLAY_RO },
432 { "machine", required_argument, NULL, 'M' },
433 { "slice", required_argument, NULL, 'S' },
434 { "setenv", required_argument, NULL, ARG_SETENV },
435 { "selinux-context", required_argument, NULL, 'Z' },
436 { "selinux-apifs-context", required_argument, NULL, 'L' },
437 { "quiet", no_argument, NULL, 'q' },
438 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM },
439 { "register", required_argument, NULL, ARG_REGISTER },
440 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
441 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
442 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
443 { "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
444 { "network-veth", no_argument, NULL, 'n' },
445 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
446 { "personality", required_argument, NULL, ARG_PERSONALITY },
447 { "image", required_argument, NULL, 'i' },
448 { "volatile", optional_argument, NULL, ARG_VOLATILE },
449 { "port", required_argument, NULL, 'p' },
450 { "property", required_argument, NULL, ARG_PROPERTY },
451 { "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
452 { "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
453 {}
454 };
455
456 int c, r;
457 uint64_t plus = 0, minus = 0;
458
459 assert(argc >= 0);
460 assert(argv);
461
462 while ((c = getopt_long(argc, argv, "+hD:u:bL:M:jS:Z:qi:xp:n", options, NULL)) >= 0)
463
464 switch (c) {
465
466 case 'h':
467 help();
468 return 0;
469
470 case ARG_VERSION:
471 puts(PACKAGE_STRING);
472 puts(SYSTEMD_FEATURES);
473 return 0;
474
475 case 'D':
476 r = set_sanitized_path(&arg_directory, optarg);
477 if (r < 0)
478 return log_error_errno(r, "Invalid root directory: %m");
479
480 break;
481
482 case ARG_TEMPLATE:
483 r = set_sanitized_path(&arg_template, optarg);
484 if (r < 0)
485 return log_error_errno(r, "Invalid template directory: %m");
486
487 break;
488
489 case 'i':
490 r = set_sanitized_path(&arg_image, optarg);
491 if (r < 0)
492 return log_error_errno(r, "Invalid image path: %m");
493
494 break;
495
496 case 'x':
497 arg_ephemeral = true;
498 break;
499
500 case 'u':
501 free(arg_user);
502 arg_user = strdup(optarg);
503 if (!arg_user)
504 return log_oom();
505
506 break;
507
508 case ARG_NETWORK_BRIDGE:
509 arg_network_bridge = optarg;
510
511 /* fall through */
512
513 case 'n':
514 arg_network_veth = true;
515 arg_private_network = true;
516 break;
517
518 case ARG_NETWORK_INTERFACE:
519 if (strv_extend(&arg_network_interfaces, optarg) < 0)
520 return log_oom();
521
522 arg_private_network = true;
523 break;
524
525 case ARG_NETWORK_MACVLAN:
526 if (strv_extend(&arg_network_macvlan, optarg) < 0)
527 return log_oom();
528
529 arg_private_network = true;
530 break;
531
532 case ARG_NETWORK_IPVLAN:
533 if (strv_extend(&arg_network_ipvlan, optarg) < 0)
534 return log_oom();
535
536 /* fall through */
537
538 case ARG_PRIVATE_NETWORK:
539 arg_private_network = true;
540 break;
541
542 case 'b':
543 arg_boot = true;
544 break;
545
546 case ARG_UUID:
547 r = sd_id128_from_string(optarg, &arg_uuid);
548 if (r < 0) {
549 log_error("Invalid UUID: %s", optarg);
550 return r;
551 }
552 break;
553
554 case 'S':
555 arg_slice = optarg;
556 break;
557
558 case 'M':
559 if (isempty(optarg)) {
560 free(arg_machine);
561 arg_machine = NULL;
562 } else {
563 if (!machine_name_is_valid(optarg)) {
564 log_error("Invalid machine name: %s", optarg);
565 return -EINVAL;
566 }
567
568 r = free_and_strdup(&arg_machine, optarg);
569 if (r < 0)
570 return log_oom();
571
572 break;
573 }
574
575 case 'Z':
576 arg_selinux_context = optarg;
577 break;
578
579 case 'L':
580 arg_selinux_apifs_context = optarg;
581 break;
582
583 case ARG_READ_ONLY:
584 arg_read_only = true;
585 break;
586
587 case ARG_CAPABILITY:
588 case ARG_DROP_CAPABILITY: {
589 const char *state, *word;
590 size_t length;
591
592 FOREACH_WORD_SEPARATOR(word, length, optarg, ",", state) {
593 _cleanup_free_ char *t;
594
595 t = strndup(word, length);
596 if (!t)
597 return log_oom();
598
599 if (streq(t, "all")) {
600 if (c == ARG_CAPABILITY)
601 plus = (uint64_t) -1;
602 else
603 minus = (uint64_t) -1;
604 } else {
605 int cap;
606
607 cap = capability_from_name(t);
608 if (cap < 0) {
609 log_error("Failed to parse capability %s.", t);
610 return -EINVAL;
611 }
612
613 if (c == ARG_CAPABILITY)
614 plus |= 1ULL << (uint64_t) cap;
615 else
616 minus |= 1ULL << (uint64_t) cap;
617 }
618 }
619
620 break;
621 }
622
623 case 'j':
624 arg_link_journal = LINK_GUEST;
625 arg_link_journal_try = true;
626 break;
627
628 case ARG_LINK_JOURNAL:
629 if (streq(optarg, "auto")) {
630 arg_link_journal = LINK_AUTO;
631 arg_link_journal_try = false;
632 } else if (streq(optarg, "no")) {
633 arg_link_journal = LINK_NO;
634 arg_link_journal_try = false;
635 } else if (streq(optarg, "guest")) {
636 arg_link_journal = LINK_GUEST;
637 arg_link_journal_try = false;
638 } else if (streq(optarg, "host")) {
639 arg_link_journal = LINK_HOST;
640 arg_link_journal_try = false;
641 } else if (streq(optarg, "try-guest")) {
642 arg_link_journal = LINK_GUEST;
643 arg_link_journal_try = true;
644 } else if (streq(optarg, "try-host")) {
645 arg_link_journal = LINK_HOST;
646 arg_link_journal_try = true;
647 } else {
648 log_error("Failed to parse link journal mode %s", optarg);
649 return -EINVAL;
650 }
651
652 break;
653
654 case ARG_BIND:
655 case ARG_BIND_RO: {
656 _cleanup_free_ char *source = NULL, *destination = NULL;
657 CustomMount *m;
658 char *e;
659
660 e = strchr(optarg, ':');
661 if (e) {
662 source = strndup(optarg, e - optarg);
663 destination = strdup(e + 1);
664 } else {
665 source = strdup(optarg);
666 destination = strdup(optarg);
667 }
668
669 if (!source || !destination)
670 return log_oom();
671
672 if (!path_is_absolute(source) || !path_is_absolute(destination)) {
673 log_error("Invalid bind mount specification: %s", optarg);
674 return -EINVAL;
675 }
676
677 m = custom_mount_add(CUSTOM_MOUNT_BIND);
678 if (!m)
679 return log_oom();
680
681 m->source = source;
682 m->destination = destination;
683 m->read_only = c == ARG_BIND_RO;
684
685 source = destination = NULL;
686
687 break;
688 }
689
690 case ARG_TMPFS: {
691 _cleanup_free_ char *path = NULL, *opts = NULL;
692 CustomMount *m;
693 char *e;
694
695 e = strchr(optarg, ':');
696 if (e) {
697 path = strndup(optarg, e - optarg);
698 opts = strdup(e + 1);
699 } else {
700 path = strdup(optarg);
701 opts = strdup("mode=0755");
702 }
703
704 if (!path || !opts)
705 return log_oom();
706
707 if (!path_is_absolute(path)) {
708 log_error("Invalid tmpfs specification: %s", optarg);
709 return -EINVAL;
710 }
711
712 m = custom_mount_add(CUSTOM_MOUNT_TMPFS);
713 if (!m)
714 return log_oom();
715
716 m->destination = path;
717 m->options = opts;
718
719 path = opts = NULL;
720
721 break;
722 }
723
724 case ARG_OVERLAY:
725 case ARG_OVERLAY_RO: {
726 _cleanup_free_ char *upper = NULL, *destination = NULL;
727 _cleanup_strv_free_ char **lower = NULL;
728 CustomMount *m;
729 unsigned n = 0;
730 char **i;
731
732 lower = strv_split(optarg, ":");
733 if (!lower)
734 return log_oom();
735
736 STRV_FOREACH(i, lower) {
737 if (!path_is_absolute(*i)) {
738 log_error("Overlay path %s is not absolute.", *i);
739 return -EINVAL;
740 }
741
742 n++;
743 }
744
745 if (n < 2) {
746 log_error("--overlay= needs at least two colon-separated directories specified.");
747 return -EINVAL;
748 }
749
750 if (n == 2) {
751 /* If two parameters are specified,
752 * the first one is the lower, the
753 * second one the upper directory. And
754 * we'll also define the the
755 * destination mount point the same as
756 * the upper. */
757 upper = lower[1];
758 lower[1] = NULL;
759
760 destination = strdup(upper);
761 if (!destination)
762 return log_oom();
763
764 } else {
765 upper = lower[n - 2];
766 destination = lower[n - 1];
767 lower[n - 2] = NULL;
768 }
769
770 m = custom_mount_add(CUSTOM_MOUNT_OVERLAY);
771 if (!m)
772 return log_oom();
773
774 m->destination = destination;
775 m->source = upper;
776 m->lower = lower;
777 m->read_only = c == ARG_OVERLAY_RO;
778
779 upper = destination = NULL;
780 lower = NULL;
781
782 break;
783 }
784
785 case ARG_SETENV: {
786 char **n;
787
788 if (!env_assignment_is_valid(optarg)) {
789 log_error("Environment variable assignment '%s' is not valid.", optarg);
790 return -EINVAL;
791 }
792
793 n = strv_env_set(arg_setenv, optarg);
794 if (!n)
795 return log_oom();
796
797 strv_free(arg_setenv);
798 arg_setenv = n;
799 break;
800 }
801
802 case 'q':
803 arg_quiet = true;
804 break;
805
806 case ARG_SHARE_SYSTEM:
807 arg_share_system = true;
808 break;
809
810 case ARG_REGISTER:
811 r = parse_boolean(optarg);
812 if (r < 0) {
813 log_error("Failed to parse --register= argument: %s", optarg);
814 return r;
815 }
816
817 arg_register = r;
818 break;
819
820 case ARG_KEEP_UNIT:
821 arg_keep_unit = true;
822 break;
823
824 case ARG_PERSONALITY:
825
826 arg_personality = personality_from_string(optarg);
827 if (arg_personality == PERSONALITY_INVALID) {
828 log_error("Unknown or unsupported personality '%s'.", optarg);
829 return -EINVAL;
830 }
831
832 break;
833
834 case ARG_VOLATILE:
835
836 if (!optarg)
837 arg_volatile = VOLATILE_YES;
838 else {
839 r = parse_boolean(optarg);
840 if (r < 0) {
841 if (streq(optarg, "state"))
842 arg_volatile = VOLATILE_STATE;
843 else {
844 log_error("Failed to parse --volatile= argument: %s", optarg);
845 return r;
846 }
847 } else
848 arg_volatile = r ? VOLATILE_YES : VOLATILE_NO;
849 }
850
851 break;
852
853 case 'p': {
854 const char *split, *e;
855 uint16_t container_port, host_port;
856 int protocol;
857 ExposePort *p;
858
859 if ((e = startswith(optarg, "tcp:")))
860 protocol = IPPROTO_TCP;
861 else if ((e = startswith(optarg, "udp:")))
862 protocol = IPPROTO_UDP;
863 else {
864 e = optarg;
865 protocol = IPPROTO_TCP;
866 }
867
868 split = strchr(e, ':');
869 if (split) {
870 char v[split - e + 1];
871
872 memcpy(v, e, split - e);
873 v[split - e] = 0;
874
875 r = safe_atou16(v, &host_port);
876 if (r < 0 || host_port <= 0) {
877 log_error("Failed to parse host port: %s", optarg);
878 return -EINVAL;
879 }
880
881 r = safe_atou16(split + 1, &container_port);
882 } else {
883 r = safe_atou16(e, &container_port);
884 host_port = container_port;
885 }
886
887 if (r < 0 || container_port <= 0) {
888 log_error("Failed to parse host port: %s", optarg);
889 return -EINVAL;
890 }
891
892 LIST_FOREACH(ports, p, arg_expose_ports) {
893 if (p->protocol == protocol && p->host_port == host_port) {
894 log_error("Duplicate port specification: %s", optarg);
895 return -EINVAL;
896 }
897 }
898
899 p = new(ExposePort, 1);
900 if (!p)
901 return log_oom();
902
903 p->protocol = protocol;
904 p->host_port = host_port;
905 p->container_port = container_port;
906
907 LIST_PREPEND(ports, arg_expose_ports, p);
908
909 break;
910 }
911
912 case ARG_PROPERTY:
913 if (strv_extend(&arg_property, optarg) < 0)
914 return log_oom();
915
916 break;
917
918 case ARG_PRIVATE_USERS:
919 if (optarg) {
920 _cleanup_free_ char *buffer = NULL;
921 const char *range, *shift;
922
923 range = strchr(optarg, ':');
924 if (range) {
925 buffer = strndup(optarg, range - optarg);
926 if (!buffer)
927 return log_oom();
928 shift = buffer;
929
930 range++;
931 if (safe_atou32(range, &arg_uid_range) < 0 || arg_uid_range <= 0) {
932 log_error("Failed to parse UID range: %s", range);
933 return -EINVAL;
934 }
935 } else
936 shift = optarg;
937
938 if (parse_uid(shift, &arg_uid_shift) < 0) {
939 log_error("Failed to parse UID: %s", optarg);
940 return -EINVAL;
941 }
942 }
943
944 arg_userns = true;
945 break;
946
947 case ARG_KILL_SIGNAL:
948 arg_kill_signal = signal_from_string_try_harder(optarg);
949 if (arg_kill_signal < 0) {
950 log_error("Cannot parse signal: %s", optarg);
951 return -EINVAL;
952 }
953
954 break;
955
956 case '?':
957 return -EINVAL;
958
959 default:
960 assert_not_reached("Unhandled option");
961 }
962
963 if (arg_share_system)
964 arg_register = false;
965
966 if (arg_boot && arg_share_system) {
967 log_error("--boot and --share-system may not be combined.");
968 return -EINVAL;
969 }
970
971 if (arg_keep_unit && cg_pid_get_owner_uid(0, NULL) >= 0) {
972 log_error("--keep-unit may not be used when invoked from a user session.");
973 return -EINVAL;
974 }
975
976 if (arg_directory && arg_image) {
977 log_error("--directory= and --image= may not be combined.");
978 return -EINVAL;
979 }
980
981 if (arg_template && arg_image) {
982 log_error("--template= and --image= may not be combined.");
983 return -EINVAL;
984 }
985
986 if (arg_template && !(arg_directory || arg_machine)) {
987 log_error("--template= needs --directory= or --machine=.");
988 return -EINVAL;
989 }
990
991 if (arg_ephemeral && arg_template) {
992 log_error("--ephemeral and --template= may not be combined.");
993 return -EINVAL;
994 }
995
996 if (arg_ephemeral && arg_image) {
997 log_error("--ephemeral and --image= may not be combined.");
998 return -EINVAL;
999 }
1000
1001 if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO)) {
1002 log_error("--ephemeral and --link-journal= may not be combined.");
1003 return -EINVAL;
1004 }
1005
1006 if (arg_volatile != VOLATILE_NO && arg_read_only) {
1007 log_error("Cannot combine --read-only with --volatile. Note that --volatile already implies a read-only base hierarchy.");
1008 return -EINVAL;
1009 }
1010
1011 if (arg_expose_ports && !arg_private_network) {
1012 log_error("Cannot use --port= without private networking.");
1013 return -EINVAL;
1014 }
1015
1016 if (arg_userns && access("/proc/self/uid_map", F_OK) < 0)
1017 return log_error_errno(EOPNOTSUPP, "--private-users= is not supported, kernel compiled without user namespace support.");
1018
1019 arg_retain = (arg_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus;
1020
1021 if (arg_boot && arg_kill_signal <= 0)
1022 arg_kill_signal = SIGRTMIN+3;
1023
1024 return 1;
1025 }
1026
1027 static int tmpfs_patch_options(const char *options, char **ret) {
1028 char *buf = NULL;
1029
1030 if (arg_userns && arg_uid_shift != 0) {
1031
1032 if (options)
1033 (void) asprintf(&buf, "%s,uid=" UID_FMT ",gid=" UID_FMT, options, arg_uid_shift, arg_uid_shift);
1034 else
1035 (void) asprintf(&buf, "uid=" UID_FMT ",gid=" UID_FMT, arg_uid_shift, arg_uid_shift);
1036 if (!buf)
1037 return -ENOMEM;
1038
1039 options = buf;
1040 }
1041
1042 #ifdef HAVE_SELINUX
1043 if (arg_selinux_apifs_context) {
1044 char *t;
1045
1046 if (options)
1047 t = strjoin(options, ",context=\"", arg_selinux_apifs_context, "\"", NULL);
1048 else
1049 t = strjoin("context=\"", arg_selinux_apifs_context, "\"", NULL);
1050 if (!t) {
1051 free(buf);
1052 return -ENOMEM;
1053 }
1054
1055 free(buf);
1056 buf = t;
1057 }
1058 #endif
1059
1060 *ret = buf;
1061 return !!buf;
1062 }
1063
1064 static int mount_all(const char *dest, bool userns) {
1065
1066 typedef struct MountPoint {
1067 const char *what;
1068 const char *where;
1069 const char *type;
1070 const char *options;
1071 unsigned long flags;
1072 bool fatal;
1073 bool userns;
1074 } MountPoint;
1075
1076 static const MountPoint mount_table[] = {
1077 { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true, true },
1078 { "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND, true, true }, /* Bind mount first */
1079 { NULL, "/proc/sys", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, true, true }, /* Then, make it r/o */
1080 { "sysfs", "/sys", "sysfs", NULL, MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, true, false },
1081 { "tmpfs", "/sys/fs/cgroup", "tmpfs", "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, true, false },
1082 { "tmpfs", "/dev", "tmpfs", "mode=755", MS_NOSUID|MS_STRICTATIME, true, false },
1083 { "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true, false },
1084 { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true, false },
1085 { "tmpfs", "/tmp", "tmpfs", "mode=1777", MS_STRICTATIME, true, false },
1086 #ifdef HAVE_SELINUX
1087 { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND, false, false }, /* Bind mount first */
1088 { NULL, "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, false, false }, /* Then, make it r/o */
1089 #endif
1090 };
1091
1092 unsigned k;
1093 int r;
1094
1095 for (k = 0; k < ELEMENTSOF(mount_table); k++) {
1096 _cleanup_free_ char *where = NULL, *options = NULL;
1097 const char *o;
1098
1099 if (userns != mount_table[k].userns)
1100 continue;
1101
1102 where = prefix_root(dest, mount_table[k].where);
1103 if (!where)
1104 return log_oom();
1105
1106 r = path_is_mount_point(where, AT_SYMLINK_FOLLOW);
1107 if (r < 0 && r != -ENOENT)
1108 return log_error_errno(r, "Failed to detect whether %s is a mount point: %m", where);
1109
1110 /* Skip this entry if it is not a remount. */
1111 if (mount_table[k].what && r > 0)
1112 continue;
1113
1114 r = mkdir_p(where, 0755);
1115 if (r < 0) {
1116 if (mount_table[k].fatal)
1117 return log_error_errno(r, "Failed to create directory %s: %m", where);
1118
1119 log_warning_errno(r, "Failed to create directory %s: %m", where);
1120 continue;
1121 }
1122
1123 o = mount_table[k].options;
1124 if (streq_ptr(mount_table[k].type, "tmpfs")) {
1125 r = tmpfs_patch_options(o, &options);
1126 if (r < 0)
1127 return log_oom();
1128 if (r > 0)
1129 o = options;
1130 }
1131
1132 if (mount(mount_table[k].what,
1133 where,
1134 mount_table[k].type,
1135 mount_table[k].flags,
1136 o) < 0) {
1137
1138 if (mount_table[k].fatal)
1139 return log_error_errno(errno, "mount(%s) failed: %m", where);
1140
1141 log_warning_errno(errno, "mount(%s) failed, ignoring: %m", where);
1142 }
1143 }
1144
1145 return 0;
1146 }
1147
1148 static int mount_bind(const char *dest, CustomMount *m) {
1149 struct stat source_st, dest_st;
1150 const char *where;
1151 int r;
1152
1153 assert(m);
1154
1155 if (stat(m->source, &source_st) < 0)
1156 return log_error_errno(errno, "Failed to stat %s: %m", m->source);
1157
1158 where = prefix_roota(dest, m->destination);
1159
1160 if (stat(where, &dest_st) >= 0) {
1161 if (S_ISDIR(source_st.st_mode) && !S_ISDIR(dest_st.st_mode)) {
1162 log_error("Cannot bind mount directory %s on file %s.", m->source, where);
1163 return -EINVAL;
1164 }
1165
1166 if (!S_ISDIR(source_st.st_mode) && S_ISDIR(dest_st.st_mode)) {
1167 log_error("Cannot bind mount file %s on directory %s.", m->source, where);
1168 return -EINVAL;
1169 }
1170
1171 } else if (errno == ENOENT) {
1172 r = mkdir_parents_label(where, 0755);
1173 if (r < 0)
1174 return log_error_errno(r, "Failed to make parents of %s: %m", where);
1175 } else {
1176 log_error_errno(errno, "Failed to stat %s: %m", where);
1177 return -errno;
1178 }
1179
1180 /* Create the mount point. Any non-directory file can be
1181 * mounted on any non-directory file (regular, fifo, socket,
1182 * char, block).
1183 */
1184 if (S_ISDIR(source_st.st_mode))
1185 r = mkdir_label(where, 0755);
1186 else
1187 r = touch(where);
1188 if (r < 0 && r != -EEXIST)
1189 return log_error_errno(r, "Failed to create mount point %s: %m", where);
1190
1191 if (mount(m->source, where, NULL, MS_BIND, NULL) < 0)
1192 return log_error_errno(errno, "mount(%s) failed: %m", where);
1193
1194 if (m->read_only) {
1195 r = bind_remount_recursive(where, true);
1196 if (r < 0)
1197 return log_error_errno(r, "Read-only bind mount failed: %m");
1198 }
1199
1200 return 0;
1201 }
1202
1203 static int mount_tmpfs(const char *dest, CustomMount *m) {
1204 const char *where, *options;
1205 _cleanup_free_ char *buf = NULL;
1206 int r;
1207
1208 assert(dest);
1209 assert(m);
1210
1211 where = prefix_roota(dest, m->destination);
1212
1213 r = mkdir_p_label(where, 0755);
1214 if (r < 0 && r != -EEXIST)
1215 return log_error_errno(r, "Creating mount point for tmpfs %s failed: %m", where);
1216
1217 r = tmpfs_patch_options(m->options, &buf);
1218 if (r < 0)
1219 return log_oom();
1220 options = r > 0 ? buf : m->options;
1221
1222 if (mount("tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, options) < 0)
1223 return log_error_errno(errno, "tmpfs mount to %s failed: %m", where);
1224
1225 return 0;
1226 }
1227
1228 static int mount_overlay(const char *dest, CustomMount *m) {
1229 _cleanup_free_ char *lower = NULL;
1230 const char *where, *options;
1231 int r;
1232
1233 assert(dest);
1234 assert(m);
1235
1236 where = prefix_roota(dest, m->destination);
1237
1238 r = mkdir_label(where, 0755);
1239 if (r < 0 && r != -EEXIST)
1240 return log_error_errno(r, "Creating mount point for overlay %s failed: %m", where);
1241
1242 (void) mkdir_p_label(m->source, 0755);
1243
1244 strv_reverse(m->lower);
1245 lower = strv_join(m->lower, ":");
1246 strv_reverse(m->lower);
1247 if (!lower)
1248 return log_oom();
1249
1250 if (m->read_only)
1251 options = strjoina("lowerdir=", m->source, ":", lower);
1252 else {
1253 assert(m->work_dir);
1254 (void) mkdir_label(m->work_dir, 0700);
1255
1256 options = strjoina("lowerdir=", lower, ",upperdir=", m->source, ",workdir=", m->work_dir);
1257 }
1258
1259 if (mount("overlay", where, "overlay", m->read_only ? MS_RDONLY : 0, options) < 0)
1260 return log_error_errno(errno, "overlay mount to %s failed: %m", where);
1261
1262 return 0;
1263 }
1264
1265 static int mount_custom(const char *dest) {
1266 unsigned i;
1267 int r;
1268
1269 assert(dest);
1270
1271 for (i = 0; i < arg_n_custom_mounts; i++) {
1272 CustomMount *m = &arg_custom_mounts[i];
1273
1274 switch (m->type) {
1275
1276 case CUSTOM_MOUNT_BIND:
1277 r = mount_bind(dest, m);
1278 break;
1279
1280 case CUSTOM_MOUNT_TMPFS:
1281 r = mount_tmpfs(dest, m);
1282 break;
1283
1284 case CUSTOM_MOUNT_OVERLAY:
1285 r = mount_overlay(dest, m);
1286 break;
1287
1288 default:
1289 assert_not_reached("Unknown custom mount type");
1290 }
1291
1292 if (r < 0)
1293 return r;
1294 }
1295
1296 return 0;
1297 }
1298
1299 static int mount_cgroup_hierarchy(const char *dest, const char *controller, const char *hierarchy, bool read_only) {
1300 char *to;
1301 int r;
1302
1303 to = strjoina(dest, "/sys/fs/cgroup/", hierarchy);
1304
1305 r = path_is_mount_point(to, 0);
1306 if (r < 0 && r != -ENOENT)
1307 return log_error_errno(r, "Failed to determine if %s is mounted already: %m", to);
1308 if (r > 0)
1309 return 0;
1310
1311 mkdir_p(to, 0755);
1312
1313 /* The superblock mount options of the mount point need to be
1314 * identical to the hosts', and hence writable... */
1315 if (mount("cgroup", to, "cgroup", MS_NOSUID|MS_NOEXEC|MS_NODEV, controller) < 0)
1316 return log_error_errno(errno, "Failed to mount to %s: %m", to);
1317
1318 /* ... hence let's only make the bind mount read-only, not the
1319 * superblock. */
1320 if (read_only) {
1321 if (mount(NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL) < 0)
1322 return log_error_errno(errno, "Failed to remount %s read-only: %m", to);
1323 }
1324 return 1;
1325 }
1326
1327 static int mount_cgroup(const char *dest) {
1328 _cleanup_set_free_free_ Set *controllers = NULL;
1329 const char *cgroup_root;
1330 int r;
1331
1332 controllers = set_new(&string_hash_ops);
1333 if (!controllers)
1334 return log_oom();
1335
1336 r = cg_kernel_controllers(controllers);
1337 if (r < 0)
1338 return log_error_errno(r, "Failed to determine cgroup controllers: %m");
1339
1340 for (;;) {
1341 _cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL;
1342
1343 controller = set_steal_first(controllers);
1344 if (!controller)
1345 break;
1346
1347 origin = prefix_root("/sys/fs/cgroup/", controller);
1348 if (!origin)
1349 return log_oom();
1350
1351 r = readlink_malloc(origin, &combined);
1352 if (r == -EINVAL) {
1353 /* Not a symbolic link, but directly a single cgroup hierarchy */
1354
1355 r = mount_cgroup_hierarchy(dest, controller, controller, true);
1356 if (r < 0)
1357 return r;
1358
1359 } else if (r < 0)
1360 return log_error_errno(r, "Failed to read link %s: %m", origin);
1361 else {
1362 _cleanup_free_ char *target = NULL;
1363
1364 target = prefix_root(dest, origin);
1365 if (!target)
1366 return log_oom();
1367
1368 /* A symbolic link, a combination of controllers in one hierarchy */
1369
1370 if (!filename_is_valid(combined)) {
1371 log_warning("Ignoring invalid combined hierarchy %s.", combined);
1372 continue;
1373 }
1374
1375 r = mount_cgroup_hierarchy(dest, combined, combined, true);
1376 if (r < 0)
1377 return r;
1378
1379 r = symlink_idempotent(combined, target);
1380 if (r == -EINVAL) {
1381 log_error("Invalid existing symlink for combined hierarchy");
1382 return r;
1383 }
1384 if (r < 0)
1385 return log_error_errno(r, "Failed to create symlink for combined hierarchy: %m");
1386 }
1387 }
1388
1389 r = mount_cgroup_hierarchy(dest, "name=systemd,xattr", "systemd", false);
1390 if (r < 0)
1391 return r;
1392
1393 cgroup_root = prefix_roota(dest, "/sys/fs/cgroup");
1394 if (mount(NULL, cgroup_root, NULL, MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755") < 0)
1395 return log_error_errno(errno, "Failed to remount %s read-only: %m", cgroup_root);
1396
1397 return 0;
1398 }
1399
1400 static int mount_systemd_cgroup_writable(const char *dest) {
1401 _cleanup_free_ char *own_cgroup_path = NULL;
1402 const char *systemd_root, *systemd_own;
1403 int r;
1404
1405 assert(dest);
1406
1407 r = cg_pid_get_path(NULL, 0, &own_cgroup_path);
1408 if (r < 0)
1409 return log_error_errno(r, "Failed to determine our own cgroup path: %m");
1410
1411 /* Make our own cgroup a (writable) bind mount */
1412 systemd_own = strjoina(dest, "/sys/fs/cgroup/systemd", own_cgroup_path);
1413 if (mount(systemd_own, systemd_own, NULL, MS_BIND, NULL) < 0)
1414 return log_error_errno(errno, "Failed to turn %s into a bind mount: %m", own_cgroup_path);
1415
1416 /* And then remount the systemd cgroup root read-only */
1417 systemd_root = prefix_roota(dest, "/sys/fs/cgroup/systemd");
1418 if (mount(NULL, systemd_root, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL) < 0)
1419 return log_error_errno(errno, "Failed to mount cgroup root read-only: %m");
1420
1421 return 0;
1422 }
1423
1424 static int userns_lchown(const char *p, uid_t uid, gid_t gid) {
1425 assert(p);
1426
1427 if (!arg_userns)
1428 return 0;
1429
1430 if (uid == UID_INVALID && gid == GID_INVALID)
1431 return 0;
1432
1433 if (uid != UID_INVALID) {
1434 uid += arg_uid_shift;
1435
1436 if (uid < arg_uid_shift || uid >= arg_uid_shift + arg_uid_range)
1437 return -EOVERFLOW;
1438 }
1439
1440 if (gid != GID_INVALID) {
1441 gid += (gid_t) arg_uid_shift;
1442
1443 if (gid < (gid_t) arg_uid_shift || gid >= (gid_t) (arg_uid_shift + arg_uid_range))
1444 return -EOVERFLOW;
1445 }
1446
1447 if (lchown(p, uid, gid) < 0)
1448 return -errno;
1449
1450 return 0;
1451 }
1452
1453 static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid_t gid) {
1454 const char *q;
1455
1456 q = prefix_roota(root, path);
1457 if (mkdir(q, mode) < 0) {
1458 if (errno == EEXIST)
1459 return 0;
1460 return -errno;
1461 }
1462
1463 return userns_lchown(q, uid, gid);
1464 }
1465
1466 static int setup_timezone(const char *dest) {
1467 _cleanup_free_ char *p = NULL, *q = NULL;
1468 const char *where, *check, *what;
1469 char *z, *y;
1470 int r;
1471
1472 assert(dest);
1473
1474 /* Fix the timezone, if possible */
1475 r = readlink_malloc("/etc/localtime", &p);
1476 if (r < 0) {
1477 log_warning("/etc/localtime is not a symlink, not updating container timezone.");
1478 return 0;
1479 }
1480
1481 z = path_startswith(p, "../usr/share/zoneinfo/");
1482 if (!z)
1483 z = path_startswith(p, "/usr/share/zoneinfo/");
1484 if (!z) {
1485 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
1486 return 0;
1487 }
1488
1489 where = prefix_roota(dest, "/etc/localtime");
1490 r = readlink_malloc(where, &q);
1491 if (r >= 0) {
1492 y = path_startswith(q, "../usr/share/zoneinfo/");
1493 if (!y)
1494 y = path_startswith(q, "/usr/share/zoneinfo/");
1495
1496 /* Already pointing to the right place? Then do nothing .. */
1497 if (y && streq(y, z))
1498 return 0;
1499 }
1500
1501 check = strjoina("/usr/share/zoneinfo/", z);
1502 check = prefix_root(dest, check);
1503 if (laccess(check, F_OK) < 0) {
1504 log_warning("Timezone %s does not exist in container, not updating container timezone.", z);
1505 return 0;
1506 }
1507
1508 r = unlink(where);
1509 if (r < 0 && errno != ENOENT) {
1510 log_error_errno(errno, "Failed to remove existing timezone info %s in container: %m", where);
1511 return 0;
1512 }
1513
1514 what = strjoina("../usr/share/zoneinfo/", z);
1515 if (symlink(what, where) < 0) {
1516 log_error_errno(errno, "Failed to correct timezone of container: %m");
1517 return 0;
1518 }
1519
1520 r = userns_lchown(where, 0, 0);
1521 if (r < 0)
1522 return log_warning_errno(r, "Failed to chown /etc/localtime: %m");
1523
1524 return 0;
1525 }
1526
1527 static int setup_resolv_conf(const char *dest) {
1528 const char *where = NULL;
1529 int r;
1530
1531 assert(dest);
1532
1533 if (arg_private_network)
1534 return 0;
1535
1536 /* Fix resolv.conf, if possible */
1537 where = prefix_roota(dest, "/etc/resolv.conf");
1538
1539 r = copy_file("/etc/resolv.conf", where, O_TRUNC|O_NOFOLLOW, 0644, 0);
1540 if (r < 0) {
1541 log_warning_errno(r, "Failed to copy /etc/resolv.conf to %s: %m", where);
1542 return 0;
1543 }
1544
1545 r = userns_lchown(where, 0, 0);
1546 if (r < 0)
1547 log_warning_errno(r, "Failed to chown /etc/resolv.conf: %m");
1548
1549 return 0;
1550 }
1551
1552 static int setup_volatile_state(const char *directory) {
1553 _cleanup_free_ char *buf = NULL;
1554 const char *p, *options;
1555 int r;
1556
1557 assert(directory);
1558
1559 if (arg_volatile != VOLATILE_STATE)
1560 return 0;
1561
1562 /* --volatile=state means we simply overmount /var
1563 with a tmpfs, and the rest read-only. */
1564
1565 r = bind_remount_recursive(directory, true);
1566 if (r < 0)
1567 return log_error_errno(r, "Failed to remount %s read-only: %m", directory);
1568
1569 p = prefix_roota(directory, "/var");
1570 r = mkdir(p, 0755);
1571 if (r < 0 && errno != EEXIST)
1572 return log_error_errno(errno, "Failed to create %s: %m", directory);
1573
1574 options = "mode=755";
1575 r = tmpfs_patch_options(options, &buf);
1576 if (r < 0)
1577 return log_oom();
1578 if (r > 0)
1579 options = buf;
1580
1581 if (mount("tmpfs", p, "tmpfs", MS_STRICTATIME, options) < 0)
1582 return log_error_errno(errno, "Failed to mount tmpfs to /var: %m");
1583
1584 return 0;
1585 }
1586
1587 static int setup_volatile(const char *directory) {
1588 bool tmpfs_mounted = false, bind_mounted = false;
1589 char template[] = "/tmp/nspawn-volatile-XXXXXX";
1590 _cleanup_free_ char *buf = NULL;
1591 const char *f, *t, *options;
1592 int r;
1593
1594 assert(directory);
1595
1596 if (arg_volatile != VOLATILE_YES)
1597 return 0;
1598
1599 /* --volatile=yes means we mount a tmpfs to the root dir, and
1600 the original /usr to use inside it, and that read-only. */
1601
1602 if (!mkdtemp(template))
1603 return log_error_errno(errno, "Failed to create temporary directory: %m");
1604
1605 options = "mode=755";
1606 r = tmpfs_patch_options(options, &buf);
1607 if (r < 0)
1608 return log_oom();
1609 if (r > 0)
1610 options = buf;
1611
1612 if (mount("tmpfs", template, "tmpfs", MS_STRICTATIME, options) < 0) {
1613 r = log_error_errno(errno, "Failed to mount tmpfs for root directory: %m");
1614 goto fail;
1615 }
1616
1617 tmpfs_mounted = true;
1618
1619 f = prefix_roota(directory, "/usr");
1620 t = prefix_roota(template, "/usr");
1621
1622 r = mkdir(t, 0755);
1623 if (r < 0 && errno != EEXIST) {
1624 r = log_error_errno(errno, "Failed to create %s: %m", t);
1625 goto fail;
1626 }
1627
1628 if (mount(f, t, NULL, MS_BIND|MS_REC, NULL) < 0) {
1629 r = log_error_errno(errno, "Failed to create /usr bind mount: %m");
1630 goto fail;
1631 }
1632
1633 bind_mounted = true;
1634
1635 r = bind_remount_recursive(t, true);
1636 if (r < 0) {
1637 log_error_errno(r, "Failed to remount %s read-only: %m", t);
1638 goto fail;
1639 }
1640
1641 if (mount(template, directory, NULL, MS_MOVE, NULL) < 0) {
1642 r = log_error_errno(errno, "Failed to move root mount: %m");
1643 goto fail;
1644 }
1645
1646 (void) rmdir(template);
1647
1648 return 0;
1649
1650 fail:
1651 if (bind_mounted)
1652 (void) umount(t);
1653
1654 if (tmpfs_mounted)
1655 (void) umount(template);
1656 (void) rmdir(template);
1657 return r;
1658 }
1659
1660 static char* id128_format_as_uuid(sd_id128_t id, char s[37]) {
1661 assert(s);
1662
1663 snprintf(s, 37,
1664 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
1665 SD_ID128_FORMAT_VAL(id));
1666
1667 return s;
1668 }
1669
1670 static int setup_boot_id(const char *dest) {
1671 const char *from, *to;
1672 sd_id128_t rnd = {};
1673 char as_uuid[37];
1674 int r;
1675
1676 if (arg_share_system)
1677 return 0;
1678
1679 /* Generate a new randomized boot ID, so that each boot-up of
1680 * the container gets a new one */
1681
1682 from = prefix_roota(dest, "/run/proc-sys-kernel-random-boot-id");
1683 to = prefix_roota(dest, "/proc/sys/kernel/random/boot_id");
1684
1685 r = sd_id128_randomize(&rnd);
1686 if (r < 0)
1687 return log_error_errno(r, "Failed to generate random boot id: %m");
1688
1689 id128_format_as_uuid(rnd, as_uuid);
1690
1691 r = write_string_file(from, as_uuid);
1692 if (r < 0)
1693 return log_error_errno(r, "Failed to write boot id: %m");
1694
1695 if (mount(from, to, NULL, MS_BIND, NULL) < 0)
1696 r = log_error_errno(errno, "Failed to bind mount boot id: %m");
1697 else if (mount(NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV, NULL) < 0)
1698 log_warning_errno(errno, "Failed to make boot id read-only: %m");
1699
1700 unlink(from);
1701 return r;
1702 }
1703
1704 static int copy_devnodes(const char *dest) {
1705
1706 static const char devnodes[] =
1707 "null\0"
1708 "zero\0"
1709 "full\0"
1710 "random\0"
1711 "urandom\0"
1712 "tty\0"
1713 "net/tun\0";
1714
1715 const char *d;
1716 int r = 0;
1717 _cleanup_umask_ mode_t u;
1718
1719 assert(dest);
1720
1721 u = umask(0000);
1722
1723 /* Create /dev/net, so that we can create /dev/net/tun in it */
1724 if (userns_mkdir(dest, "/dev/net", 0755, 0, 0) < 0)
1725 return log_error_errno(r, "Failed to create /dev/net directory: %m");
1726
1727 NULSTR_FOREACH(d, devnodes) {
1728 _cleanup_free_ char *from = NULL, *to = NULL;
1729 struct stat st;
1730
1731 from = strappend("/dev/", d);
1732 to = prefix_root(dest, from);
1733
1734 if (stat(from, &st) < 0) {
1735
1736 if (errno != ENOENT)
1737 return log_error_errno(errno, "Failed to stat %s: %m", from);
1738
1739 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode)) {
1740
1741 log_error("%s is not a char or block device, cannot copy.", from);
1742 return -EIO;
1743
1744 } else {
1745 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
1746 if (errno != EPERM)
1747 return log_error_errno(errno, "mknod(%s) failed: %m", to);
1748
1749 /* Some systems abusively restrict mknod but
1750 * allow bind mounts. */
1751 r = touch(to);
1752 if (r < 0)
1753 return log_error_errno(r, "touch (%s) failed: %m", to);
1754 if (mount(from, to, NULL, MS_BIND, NULL) < 0)
1755 return log_error_errno(errno, "Both mknod and bind mount (%s) failed: %m", to);
1756 }
1757
1758 r = userns_lchown(to, 0, 0);
1759 if (r < 0)
1760 return log_error_errno(r, "chown() of device node %s failed: %m", to);
1761 }
1762 }
1763
1764 return r;
1765 }
1766
1767 static int setup_pts(const char *dest) {
1768 _cleanup_free_ char *options = NULL;
1769 const char *p;
1770
1771 #ifdef HAVE_SELINUX
1772 if (arg_selinux_apifs_context)
1773 (void) asprintf(&options,
1774 "newinstance,ptmxmode=0666,mode=620,uid=" UID_FMT ",gid=" GID_FMT ",context=\"%s\"",
1775 arg_uid_shift,
1776 arg_uid_shift + TTY_GID,
1777 arg_selinux_apifs_context);
1778 else
1779 #endif
1780 (void) asprintf(&options,
1781 "newinstance,ptmxmode=0666,mode=620,uid=" UID_FMT ",gid=" GID_FMT,
1782 arg_uid_shift,
1783 arg_uid_shift + TTY_GID);
1784
1785 if (!options)
1786 return log_oom();
1787
1788 /* Mount /dev/pts itself */
1789 p = prefix_roota(dest, "/dev/pts");
1790 if (mkdir(p, 0755) < 0)
1791 return log_error_errno(errno, "Failed to create /dev/pts: %m");
1792 if (mount("devpts", p, "devpts", MS_NOSUID|MS_NOEXEC, options) < 0)
1793 return log_error_errno(errno, "Failed to mount /dev/pts: %m");
1794 if (userns_lchown(p, 0, 0) < 0)
1795 return log_error_errno(errno, "Failed to chown /dev/pts: %m");
1796
1797 /* Create /dev/ptmx symlink */
1798 p = prefix_roota(dest, "/dev/ptmx");
1799 if (symlink("pts/ptmx", p) < 0)
1800 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
1801 if (userns_lchown(p, 0, 0) < 0)
1802 return log_error_errno(errno, "Failed to chown /dev/ptmx: %m");
1803
1804 /* And fix /dev/pts/ptmx ownership */
1805 p = prefix_roota(dest, "/dev/pts/ptmx");
1806 if (userns_lchown(p, 0, 0) < 0)
1807 return log_error_errno(errno, "Failed to chown /dev/pts/ptmx: %m");
1808
1809 return 0;
1810 }
1811
1812 static int setup_dev_console(const char *dest, const char *console) {
1813 _cleanup_umask_ mode_t u;
1814 const char *to;
1815 int r;
1816
1817 assert(dest);
1818 assert(console);
1819
1820 u = umask(0000);
1821
1822 r = chmod_and_chown(console, 0600, arg_uid_shift, arg_uid_shift);
1823 if (r < 0)
1824 return log_error_errno(r, "Failed to correct access mode for TTY: %m");
1825
1826 /* We need to bind mount the right tty to /dev/console since
1827 * ptys can only exist on pts file systems. To have something
1828 * to bind mount things on we create a empty regular file. */
1829
1830 to = prefix_roota(dest, "/dev/console");
1831 r = touch(to);
1832 if (r < 0)
1833 return log_error_errno(r, "touch() for /dev/console failed: %m");
1834
1835 if (mount(console, to, NULL, MS_BIND, NULL) < 0)
1836 return log_error_errno(errno, "Bind mount for /dev/console failed: %m");
1837
1838 return 0;
1839 }
1840
1841 static int setup_kmsg(const char *dest, int kmsg_socket) {
1842 const char *from, *to;
1843 _cleanup_umask_ mode_t u;
1844 int fd, k;
1845 union {
1846 struct cmsghdr cmsghdr;
1847 uint8_t buf[CMSG_SPACE(sizeof(int))];
1848 } control = {};
1849 struct msghdr mh = {
1850 .msg_control = &control,
1851 .msg_controllen = sizeof(control),
1852 };
1853 struct cmsghdr *cmsg;
1854
1855 assert(kmsg_socket >= 0);
1856
1857 u = umask(0000);
1858
1859 /* We create the kmsg FIFO as /run/kmsg, but immediately
1860 * delete it after bind mounting it to /proc/kmsg. While FIFOs
1861 * on the reading side behave very similar to /proc/kmsg,
1862 * their writing side behaves differently from /dev/kmsg in
1863 * that writing blocks when nothing is reading. In order to
1864 * avoid any problems with containers deadlocking due to this
1865 * we simply make /dev/kmsg unavailable to the container. */
1866 from = prefix_roota(dest, "/run/kmsg");
1867 to = prefix_roota(dest, "/proc/kmsg");
1868
1869 if (mkfifo(from, 0600) < 0)
1870 return log_error_errno(errno, "mkfifo() for /run/kmsg failed: %m");
1871 if (mount(from, to, NULL, MS_BIND, NULL) < 0)
1872 return log_error_errno(errno, "Bind mount for /proc/kmsg failed: %m");
1873
1874 fd = open(from, O_RDWR|O_NDELAY|O_CLOEXEC);
1875 if (fd < 0)
1876 return log_error_errno(errno, "Failed to open fifo: %m");
1877
1878 cmsg = CMSG_FIRSTHDR(&mh);
1879 cmsg->cmsg_level = SOL_SOCKET;
1880 cmsg->cmsg_type = SCM_RIGHTS;
1881 cmsg->cmsg_len = CMSG_LEN(sizeof(int));
1882 memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
1883
1884 mh.msg_controllen = cmsg->cmsg_len;
1885
1886 /* Store away the fd in the socket, so that it stays open as
1887 * long as we run the child */
1888 k = sendmsg(kmsg_socket, &mh, MSG_NOSIGNAL);
1889 safe_close(fd);
1890
1891 if (k < 0)
1892 return log_error_errno(errno, "Failed to send FIFO fd: %m");
1893
1894 /* And now make the FIFO unavailable as /run/kmsg... */
1895 (void) unlink(from);
1896
1897 return 0;
1898 }
1899
1900 static int send_rtnl(int send_fd) {
1901 union {
1902 struct cmsghdr cmsghdr;
1903 uint8_t buf[CMSG_SPACE(sizeof(int))];
1904 } control = {};
1905 struct msghdr mh = {
1906 .msg_control = &control,
1907 .msg_controllen = sizeof(control),
1908 };
1909 struct cmsghdr *cmsg;
1910 _cleanup_close_ int fd = -1;
1911 ssize_t k;
1912
1913 assert(send_fd >= 0);
1914
1915 if (!arg_expose_ports)
1916 return 0;
1917
1918 fd = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_ROUTE);
1919 if (fd < 0)
1920 return log_error_errno(errno, "Failed to allocate container netlink: %m");
1921
1922 cmsg = CMSG_FIRSTHDR(&mh);
1923 cmsg->cmsg_level = SOL_SOCKET;
1924 cmsg->cmsg_type = SCM_RIGHTS;
1925 cmsg->cmsg_len = CMSG_LEN(sizeof(int));
1926 memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
1927
1928 mh.msg_controllen = cmsg->cmsg_len;
1929
1930 /* Store away the fd in the socket, so that it stays open as
1931 * long as we run the child */
1932 k = sendmsg(send_fd, &mh, MSG_NOSIGNAL);
1933 if (k < 0)
1934 return log_error_errno(errno, "Failed to send netlink fd: %m");
1935
1936 return 0;
1937 }
1938
1939 static int flush_ports(union in_addr_union *exposed) {
1940 ExposePort *p;
1941 int r, af = AF_INET;
1942
1943 assert(exposed);
1944
1945 if (!arg_expose_ports)
1946 return 0;
1947
1948 if (in_addr_is_null(af, exposed))
1949 return 0;
1950
1951 log_debug("Lost IP address.");
1952
1953 LIST_FOREACH(ports, p, arg_expose_ports) {
1954 r = fw_add_local_dnat(false,
1955 af,
1956 p->protocol,
1957 NULL,
1958 NULL, 0,
1959 NULL, 0,
1960 p->host_port,
1961 exposed,
1962 p->container_port,
1963 NULL);
1964 if (r < 0)
1965 log_warning_errno(r, "Failed to modify firewall: %m");
1966 }
1967
1968 *exposed = IN_ADDR_NULL;
1969 return 0;
1970 }
1971
1972 static int expose_ports(sd_netlink *rtnl, union in_addr_union *exposed) {
1973 _cleanup_free_ struct local_address *addresses = NULL;
1974 _cleanup_free_ char *pretty = NULL;
1975 union in_addr_union new_exposed;
1976 ExposePort *p;
1977 bool add;
1978 int af = AF_INET, r;
1979
1980 assert(exposed);
1981
1982 /* Invoked each time an address is added or removed inside the
1983 * container */
1984
1985 if (!arg_expose_ports)
1986 return 0;
1987
1988 r = local_addresses(rtnl, 0, af, &addresses);
1989 if (r < 0)
1990 return log_error_errno(r, "Failed to enumerate local addresses: %m");
1991
1992 add = r > 0 &&
1993 addresses[0].family == af &&
1994 addresses[0].scope < RT_SCOPE_LINK;
1995
1996 if (!add)
1997 return flush_ports(exposed);
1998
1999 new_exposed = addresses[0].address;
2000 if (in_addr_equal(af, exposed, &new_exposed))
2001 return 0;
2002
2003 in_addr_to_string(af, &new_exposed, &pretty);
2004 log_debug("New container IP is %s.", strna(pretty));
2005
2006 LIST_FOREACH(ports, p, arg_expose_ports) {
2007
2008 r = fw_add_local_dnat(true,
2009 af,
2010 p->protocol,
2011 NULL,
2012 NULL, 0,
2013 NULL, 0,
2014 p->host_port,
2015 &new_exposed,
2016 p->container_port,
2017 in_addr_is_null(af, exposed) ? NULL : exposed);
2018 if (r < 0)
2019 log_warning_errno(r, "Failed to modify firewall: %m");
2020 }
2021
2022 *exposed = new_exposed;
2023 return 0;
2024 }
2025
2026 static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
2027 union in_addr_union *exposed = userdata;
2028
2029 assert(rtnl);
2030 assert(m);
2031 assert(exposed);
2032
2033 expose_ports(rtnl, exposed);
2034 return 0;
2035 }
2036
2037 static int watch_rtnl(sd_event *event, int recv_fd, union in_addr_union *exposed, sd_netlink **ret) {
2038 union {
2039 struct cmsghdr cmsghdr;
2040 uint8_t buf[CMSG_SPACE(sizeof(int))];
2041 } control = {};
2042 struct msghdr mh = {
2043 .msg_control = &control,
2044 .msg_controllen = sizeof(control),
2045 };
2046 struct cmsghdr *cmsg;
2047 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
2048 int fd, r;
2049 ssize_t k;
2050
2051 assert(event);
2052 assert(recv_fd >= 0);
2053 assert(ret);
2054
2055 if (!arg_expose_ports)
2056 return 0;
2057
2058 k = recvmsg(recv_fd, &mh, MSG_NOSIGNAL);
2059 if (k < 0)
2060 return log_error_errno(errno, "Failed to recv netlink fd: %m");
2061
2062 cmsg = CMSG_FIRSTHDR(&mh);
2063 assert(cmsg->cmsg_level == SOL_SOCKET);
2064 assert(cmsg->cmsg_type == SCM_RIGHTS);
2065 assert(cmsg->cmsg_len == CMSG_LEN(sizeof(int)));
2066 memcpy(&fd, CMSG_DATA(cmsg), sizeof(int));
2067
2068 r = sd_netlink_open_fd(&rtnl, fd);
2069 if (r < 0) {
2070 safe_close(fd);
2071 return log_error_errno(r, "Failed to create rtnl object: %m");
2072 }
2073
2074 r = sd_netlink_add_match(rtnl, RTM_NEWADDR, on_address_change, exposed);
2075 if (r < 0)
2076 return log_error_errno(r, "Failed to subscribe to RTM_NEWADDR messages: %m");
2077
2078 r = sd_netlink_add_match(rtnl, RTM_DELADDR, on_address_change, exposed);
2079 if (r < 0)
2080 return log_error_errno(r, "Failed to subscribe to RTM_DELADDR messages: %m");
2081
2082 r = sd_netlink_attach_event(rtnl, event, 0);
2083 if (r < 0)
2084 return log_error_errno(r, "Failed to add to even loop: %m");
2085
2086 *ret = rtnl;
2087 rtnl = NULL;
2088
2089 return 0;
2090 }
2091
2092 static int setup_hostname(void) {
2093
2094 if (arg_share_system)
2095 return 0;
2096
2097 if (sethostname_idempotent(arg_machine) < 0)
2098 return -errno;
2099
2100 return 0;
2101 }
2102
2103 static int setup_journal(const char *directory) {
2104 sd_id128_t machine_id, this_id;
2105 _cleanup_free_ char *b = NULL, *d = NULL;
2106 const char *etc_machine_id, *p, *q;
2107 char *id;
2108 int r;
2109
2110 /* Don't link journals in ephemeral mode */
2111 if (arg_ephemeral)
2112 return 0;
2113
2114 etc_machine_id = prefix_roota(directory, "/etc/machine-id");
2115
2116 r = read_one_line_file(etc_machine_id, &b);
2117 if (r == -ENOENT && arg_link_journal == LINK_AUTO)
2118 return 0;
2119 else if (r < 0)
2120 return log_error_errno(r, "Failed to read machine ID from %s: %m", etc_machine_id);
2121
2122 id = strstrip(b);
2123 if (isempty(id) && arg_link_journal == LINK_AUTO)
2124 return 0;
2125
2126 /* Verify validity */
2127 r = sd_id128_from_string(id, &machine_id);
2128 if (r < 0)
2129 return log_error_errno(r, "Failed to parse machine ID from %s: %m", etc_machine_id);
2130
2131 r = sd_id128_get_machine(&this_id);
2132 if (r < 0)
2133 return log_error_errno(r, "Failed to retrieve machine ID: %m");
2134
2135 if (sd_id128_equal(machine_id, this_id)) {
2136 log_full(arg_link_journal == LINK_AUTO ? LOG_WARNING : LOG_ERR,
2137 "Host and machine ids are equal (%s): refusing to link journals", id);
2138 if (arg_link_journal == LINK_AUTO)
2139 return 0;
2140 return -EEXIST;
2141 }
2142
2143 if (arg_link_journal == LINK_NO)
2144 return 0;
2145
2146 r = userns_mkdir(directory, "/var", 0755, 0, 0);
2147 if (r < 0)
2148 return log_error_errno(r, "Failed to create /var: %m");
2149
2150 r = userns_mkdir(directory, "/var/log", 0755, 0, 0);
2151 if (r < 0)
2152 return log_error_errno(r, "Failed to create /var/log: %m");
2153
2154 r = userns_mkdir(directory, "/var/log/journal", 0755, 0, 0);
2155 if (r < 0)
2156 return log_error_errno(r, "Failed to create /var/log/journal: %m");
2157
2158 p = strjoina("/var/log/journal/", id);
2159 q = prefix_roota(directory, p);
2160
2161 if (path_is_mount_point(p, 0) > 0) {
2162 if (arg_link_journal != LINK_AUTO) {
2163 log_error("%s: already a mount point, refusing to use for journal", p);
2164 return -EEXIST;
2165 }
2166
2167 return 0;
2168 }
2169
2170 if (path_is_mount_point(q, 0) > 0) {
2171 if (arg_link_journal != LINK_AUTO) {
2172 log_error("%s: already a mount point, refusing to use for journal", q);
2173 return -EEXIST;
2174 }
2175
2176 return 0;
2177 }
2178
2179 r = readlink_and_make_absolute(p, &d);
2180 if (r >= 0) {
2181 if ((arg_link_journal == LINK_GUEST ||
2182 arg_link_journal == LINK_AUTO) &&
2183 path_equal(d, q)) {
2184
2185 r = userns_mkdir(directory, p, 0755, 0, 0);
2186 if (r < 0)
2187 log_warning_errno(errno, "Failed to create directory %s: %m", q);
2188 return 0;
2189 }
2190
2191 if (unlink(p) < 0)
2192 return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
2193 } else if (r == -EINVAL) {
2194
2195 if (arg_link_journal == LINK_GUEST &&
2196 rmdir(p) < 0) {
2197
2198 if (errno == ENOTDIR) {
2199 log_error("%s already exists and is neither a symlink nor a directory", p);
2200 return r;
2201 } else {
2202 log_error_errno(errno, "Failed to remove %s: %m", p);
2203 return -errno;
2204 }
2205 }
2206 } else if (r != -ENOENT) {
2207 log_error_errno(errno, "readlink(%s) failed: %m", p);
2208 return r;
2209 }
2210
2211 if (arg_link_journal == LINK_GUEST) {
2212
2213 if (symlink(q, p) < 0) {
2214 if (arg_link_journal_try) {
2215 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
2216 return 0;
2217 } else {
2218 log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
2219 return -errno;
2220 }
2221 }
2222
2223 r = userns_mkdir(directory, p, 0755, 0, 0);
2224 if (r < 0)
2225 log_warning_errno(errno, "Failed to create directory %s: %m", q);
2226 return 0;
2227 }
2228
2229 if (arg_link_journal == LINK_HOST) {
2230 /* don't create parents here -- if the host doesn't have
2231 * permanent journal set up, don't force it here */
2232 r = mkdir(p, 0755);
2233 if (r < 0) {
2234 if (arg_link_journal_try) {
2235 log_debug_errno(errno, "Failed to create %s, skipping journal setup: %m", p);
2236 return 0;
2237 } else {
2238 log_error_errno(errno, "Failed to create %s: %m", p);
2239 return r;
2240 }
2241 }
2242
2243 } else if (access(p, F_OK) < 0)
2244 return 0;
2245
2246 if (dir_is_empty(q) == 0)
2247 log_warning("%s is not empty, proceeding anyway.", q);
2248
2249 r = userns_mkdir(directory, p, 0755, 0, 0);
2250 if (r < 0) {
2251 log_error_errno(errno, "Failed to create %s: %m", q);
2252 return r;
2253 }
2254
2255 if (mount(p, q, NULL, MS_BIND, NULL) < 0)
2256 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
2257
2258 return 0;
2259 }
2260
2261 static int drop_capabilities(void) {
2262 return capability_bounding_set_drop(~arg_retain, false);
2263 }
2264
2265 static int register_machine(pid_t pid, int local_ifindex) {
2266 _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
2267 _cleanup_bus_close_unref_ sd_bus *bus = NULL;
2268 int r;
2269
2270 if (!arg_register)
2271 return 0;
2272
2273 r = sd_bus_default_system(&bus);
2274 if (r < 0)
2275 return log_error_errno(r, "Failed to open system bus: %m");
2276
2277 if (arg_keep_unit) {
2278 r = sd_bus_call_method(
2279 bus,
2280 "org.freedesktop.machine1",
2281 "/org/freedesktop/machine1",
2282 "org.freedesktop.machine1.Manager",
2283 "RegisterMachineWithNetwork",
2284 &error,
2285 NULL,
2286 "sayssusai",
2287 arg_machine,
2288 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
2289 "nspawn",
2290 "container",
2291 (uint32_t) pid,
2292 strempty(arg_directory),
2293 local_ifindex > 0 ? 1 : 0, local_ifindex);
2294 } else {
2295 _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
2296 char **i;
2297 unsigned j;
2298
2299 r = sd_bus_message_new_method_call(
2300 bus,
2301 &m,
2302 "org.freedesktop.machine1",
2303 "/org/freedesktop/machine1",
2304 "org.freedesktop.machine1.Manager",
2305 "CreateMachineWithNetwork");
2306 if (r < 0)
2307 return bus_log_create_error(r);
2308
2309 r = sd_bus_message_append(
2310 m,
2311 "sayssusai",
2312 arg_machine,
2313 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
2314 "nspawn",
2315 "container",
2316 (uint32_t) pid,
2317 strempty(arg_directory),
2318 local_ifindex > 0 ? 1 : 0, local_ifindex);
2319 if (r < 0)
2320 return bus_log_create_error(r);
2321
2322 r = sd_bus_message_open_container(m, 'a', "(sv)");
2323 if (r < 0)
2324 return bus_log_create_error(r);
2325
2326 if (!isempty(arg_slice)) {
2327 r = sd_bus_message_append(m, "(sv)", "Slice", "s", arg_slice);
2328 if (r < 0)
2329 return bus_log_create_error(r);
2330 }
2331
2332 r = sd_bus_message_append(m, "(sv)", "DevicePolicy", "s", "strict");
2333 if (r < 0)
2334 return bus_log_create_error(r);
2335
2336 /* If you make changes here, also make sure to update
2337 * systemd-nspawn@.service, to keep the device
2338 * policies in sync regardless if we are run with or
2339 * without the --keep-unit switch. */
2340 r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 9,
2341 /* Allow the container to
2342 * access and create the API
2343 * device nodes, so that
2344 * PrivateDevices= in the
2345 * container can work
2346 * fine */
2347 "/dev/null", "rwm",
2348 "/dev/zero", "rwm",
2349 "/dev/full", "rwm",
2350 "/dev/random", "rwm",
2351 "/dev/urandom", "rwm",
2352 "/dev/tty", "rwm",
2353 "/dev/net/tun", "rwm",
2354 /* Allow the container
2355 * access to ptys. However,
2356 * do not permit the
2357 * container to ever create
2358 * these device nodes. */
2359 "/dev/pts/ptmx", "rw",
2360 "char-pts", "rw");
2361 if (r < 0)
2362 return bus_log_create_error(r);
2363
2364 for (j = 0; j < arg_n_custom_mounts; j++) {
2365 CustomMount *cm = &arg_custom_mounts[j];
2366
2367 if (cm->type != CUSTOM_MOUNT_BIND)
2368 continue;
2369
2370 r = is_device_node(cm->source);
2371 if (r < 0)
2372 return log_error_errno(r, "Failed to stat %s: %m", cm->source);
2373
2374 if (r) {
2375 r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 1,
2376 cm->source, cm->read_only ? "r" : "rw");
2377 if (r < 0)
2378 return log_error_errno(r, "Failed to append message arguments: %m");
2379 }
2380 }
2381
2382 if (arg_kill_signal != 0) {
2383 r = sd_bus_message_append(m, "(sv)", "KillSignal", "i", arg_kill_signal);
2384 if (r < 0)
2385 return bus_log_create_error(r);
2386
2387 r = sd_bus_message_append(m, "(sv)", "KillMode", "s", "mixed");
2388 if (r < 0)
2389 return bus_log_create_error(r);
2390 }
2391
2392 STRV_FOREACH(i, arg_property) {
2393 r = sd_bus_message_open_container(m, 'r', "sv");
2394 if (r < 0)
2395 return bus_log_create_error(r);
2396
2397 r = bus_append_unit_property_assignment(m, *i);
2398 if (r < 0)
2399 return r;
2400
2401 r = sd_bus_message_close_container(m);
2402 if (r < 0)
2403 return bus_log_create_error(r);
2404 }
2405
2406 r = sd_bus_message_close_container(m);
2407 if (r < 0)
2408 return bus_log_create_error(r);
2409
2410 r = sd_bus_call(bus, m, 0, &error, NULL);
2411 }
2412
2413 if (r < 0) {
2414 log_error("Failed to register machine: %s", bus_error_message(&error, r));
2415 return r;
2416 }
2417
2418 return 0;
2419 }
2420
2421 static int terminate_machine(pid_t pid) {
2422 _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
2423 _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
2424 _cleanup_bus_close_unref_ sd_bus *bus = NULL;
2425 const char *path;
2426 int r;
2427
2428 if (!arg_register)
2429 return 0;
2430
2431 /* If we are reusing the unit, then just exit, systemd will do
2432 * the right thing when we exit. */
2433 if (arg_keep_unit)
2434 return 0;
2435
2436 r = sd_bus_default_system(&bus);
2437 if (r < 0)
2438 return log_error_errno(r, "Failed to open system bus: %m");
2439
2440 r = sd_bus_call_method(
2441 bus,
2442 "org.freedesktop.machine1",
2443 "/org/freedesktop/machine1",
2444 "org.freedesktop.machine1.Manager",
2445 "GetMachineByPID",
2446 &error,
2447 &reply,
2448 "u",
2449 (uint32_t) pid);
2450 if (r < 0) {
2451 /* Note that the machine might already have been
2452 * cleaned up automatically, hence don't consider it a
2453 * failure if we cannot get the machine object. */
2454 log_debug("Failed to get machine: %s", bus_error_message(&error, r));
2455 return 0;
2456 }
2457
2458 r = sd_bus_message_read(reply, "o", &path);
2459 if (r < 0)
2460 return bus_log_parse_error(r);
2461
2462 r = sd_bus_call_method(
2463 bus,
2464 "org.freedesktop.machine1",
2465 path,
2466 "org.freedesktop.machine1.Machine",
2467 "Terminate",
2468 &error,
2469 NULL,
2470 NULL);
2471 if (r < 0) {
2472 log_debug("Failed to terminate machine: %s", bus_error_message(&error, r));
2473 return 0;
2474 }
2475
2476 return 0;
2477 }
2478
2479 static int reset_audit_loginuid(void) {
2480 _cleanup_free_ char *p = NULL;
2481 int r;
2482
2483 if (arg_share_system)
2484 return 0;
2485
2486 r = read_one_line_file("/proc/self/loginuid", &p);
2487 if (r == -ENOENT)
2488 return 0;
2489 if (r < 0)
2490 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
2491
2492 /* Already reset? */
2493 if (streq(p, "4294967295"))
2494 return 0;
2495
2496 r = write_string_file("/proc/self/loginuid", "4294967295");
2497 if (r < 0) {
2498 log_error_errno(r,
2499 "Failed to reset audit login UID. This probably means that your kernel is too\n"
2500 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
2501 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
2502 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
2503 "using systemd-nspawn. Sleeping for 5s... (%m)");
2504
2505 sleep(5);
2506 }
2507
2508 return 0;
2509 }
2510
2511 #define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
2512 #define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
2513 #define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)
2514
2515 static int generate_mac(struct ether_addr *mac, sd_id128_t hash_key, uint64_t idx) {
2516 uint8_t result[8];
2517 size_t l, sz;
2518 uint8_t *v, *i;
2519 int r;
2520
2521 l = strlen(arg_machine);
2522 sz = sizeof(sd_id128_t) + l;
2523 if (idx > 0)
2524 sz += sizeof(idx);
2525
2526 v = alloca(sz);
2527
2528 /* fetch some persistent data unique to the host */
2529 r = sd_id128_get_machine((sd_id128_t*) v);
2530 if (r < 0)
2531 return r;
2532
2533 /* combine with some data unique (on this host) to this
2534 * container instance */
2535 i = mempcpy(v + sizeof(sd_id128_t), arg_machine, l);
2536 if (idx > 0) {
2537 idx = htole64(idx);
2538 memcpy(i, &idx, sizeof(idx));
2539 }
2540
2541 /* Let's hash the host machine ID plus the container name. We
2542 * use a fixed, but originally randomly created hash key here. */
2543 siphash24(result, v, sz, hash_key.bytes);
2544
2545 assert_cc(ETH_ALEN <= sizeof(result));
2546 memcpy(mac->ether_addr_octet, result, ETH_ALEN);
2547
2548 /* see eth_random_addr in the kernel */
2549 mac->ether_addr_octet[0] &= 0xfe; /* clear multicast bit */
2550 mac->ether_addr_octet[0] |= 0x02; /* set local assignment bit (IEEE802) */
2551
2552 return 0;
2553 }
2554
2555 static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ], int *ifi) {
2556 _cleanup_netlink_message_unref_ sd_netlink_message *m = NULL;
2557 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
2558 struct ether_addr mac_host, mac_container;
2559 int r, i;
2560
2561 if (!arg_private_network)
2562 return 0;
2563
2564 if (!arg_network_veth)
2565 return 0;
2566
2567 /* Use two different interface name prefixes depending whether
2568 * we are in bridge mode or not. */
2569 snprintf(iface_name, IFNAMSIZ - 1, "%s-%s",
2570 arg_network_bridge ? "vb" : "ve", arg_machine);
2571
2572 r = generate_mac(&mac_container, CONTAINER_HASH_KEY, 0);
2573 if (r < 0)
2574 return log_error_errno(r, "Failed to generate predictable MAC address for container side: %m");
2575
2576 r = generate_mac(&mac_host, HOST_HASH_KEY, 0);
2577 if (r < 0)
2578 return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");
2579
2580 r = sd_netlink_open(&rtnl);
2581 if (r < 0)
2582 return log_error_errno(r, "Failed to connect to netlink: %m");
2583
2584 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
2585 if (r < 0)
2586 return log_error_errno(r, "Failed to allocate netlink message: %m");
2587
2588 r = sd_netlink_message_append_string(m, IFLA_IFNAME, iface_name);
2589 if (r < 0)
2590 return log_error_errno(r, "Failed to add netlink interface name: %m");
2591
2592 r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac_host);
2593 if (r < 0)
2594 return log_error_errno(r, "Failed to add netlink MAC address: %m");
2595
2596 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
2597 if (r < 0)
2598 return log_error_errno(r, "Failed to open netlink container: %m");
2599
2600 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "veth");
2601 if (r < 0)
2602 return log_error_errno(r, "Failed to open netlink container: %m");
2603
2604 r = sd_netlink_message_open_container(m, VETH_INFO_PEER);
2605 if (r < 0)
2606 return log_error_errno(r, "Failed to open netlink container: %m");
2607
2608 r = sd_netlink_message_append_string(m, IFLA_IFNAME, "host0");
2609 if (r < 0)
2610 return log_error_errno(r, "Failed to add netlink interface name: %m");
2611
2612 r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac_container);
2613 if (r < 0)
2614 return log_error_errno(r, "Failed to add netlink MAC address: %m");
2615
2616 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
2617 if (r < 0)
2618 return log_error_errno(r, "Failed to add netlink namespace field: %m");
2619
2620 r = sd_netlink_message_close_container(m);
2621 if (r < 0)
2622 return log_error_errno(r, "Failed to close netlink container: %m");
2623
2624 r = sd_netlink_message_close_container(m);
2625 if (r < 0)
2626 return log_error_errno(r, "Failed to close netlink container: %m");
2627
2628 r = sd_netlink_message_close_container(m);
2629 if (r < 0)
2630 return log_error_errno(r, "Failed to close netlink container: %m");
2631
2632 r = sd_netlink_call(rtnl, m, 0, NULL);
2633 if (r < 0)
2634 return log_error_errno(r, "Failed to add new veth interfaces (host0, %s): %m", iface_name);
2635
2636 i = (int) if_nametoindex(iface_name);
2637 if (i <= 0)
2638 return log_error_errno(errno, "Failed to resolve interface %s: %m", iface_name);
2639
2640 *ifi = i;
2641
2642 return 0;
2643 }
2644
2645 static int setup_bridge(const char veth_name[], int *ifi) {
2646 _cleanup_netlink_message_unref_ sd_netlink_message *m = NULL;
2647 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
2648 int r, bridge;
2649
2650 if (!arg_private_network)
2651 return 0;
2652
2653 if (!arg_network_veth)
2654 return 0;
2655
2656 if (!arg_network_bridge)
2657 return 0;
2658
2659 bridge = (int) if_nametoindex(arg_network_bridge);
2660 if (bridge <= 0)
2661 return log_error_errno(errno, "Failed to resolve interface %s: %m", arg_network_bridge);
2662
2663 *ifi = bridge;
2664
2665 r = sd_netlink_open(&rtnl);
2666 if (r < 0)
2667 return log_error_errno(r, "Failed to connect to netlink: %m");
2668
2669 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
2670 if (r < 0)
2671 return log_error_errno(r, "Failed to allocate netlink message: %m");
2672
2673 r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
2674 if (r < 0)
2675 return log_error_errno(r, "Failed to set IFF_UP flag: %m");
2676
2677 r = sd_netlink_message_append_string(m, IFLA_IFNAME, veth_name);
2678 if (r < 0)
2679 return log_error_errno(r, "Failed to add netlink interface name field: %m");
2680
2681 r = sd_netlink_message_append_u32(m, IFLA_MASTER, bridge);
2682 if (r < 0)
2683 return log_error_errno(r, "Failed to add netlink master field: %m");
2684
2685 r = sd_netlink_call(rtnl, m, 0, NULL);
2686 if (r < 0)
2687 return log_error_errno(r, "Failed to add veth interface to bridge: %m");
2688
2689 return 0;
2690 }
2691
2692 static int parse_interface(struct udev *udev, const char *name) {
2693 _cleanup_udev_device_unref_ struct udev_device *d = NULL;
2694 char ifi_str[2 + DECIMAL_STR_MAX(int)];
2695 int ifi;
2696
2697 ifi = (int) if_nametoindex(name);
2698 if (ifi <= 0)
2699 return log_error_errno(errno, "Failed to resolve interface %s: %m", name);
2700
2701 sprintf(ifi_str, "n%i", ifi);
2702 d = udev_device_new_from_device_id(udev, ifi_str);
2703 if (!d)
2704 return log_error_errno(errno, "Failed to get udev device for interface %s: %m", name);
2705
2706 if (udev_device_get_is_initialized(d) <= 0) {
2707 log_error("Network interface %s is not initialized yet.", name);
2708 return -EBUSY;
2709 }
2710
2711 return ifi;
2712 }
2713
2714 static int move_network_interfaces(pid_t pid) {
2715 _cleanup_udev_unref_ struct udev *udev = NULL;
2716 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
2717 char **i;
2718 int r;
2719
2720 if (!arg_private_network)
2721 return 0;
2722
2723 if (strv_isempty(arg_network_interfaces))
2724 return 0;
2725
2726 r = sd_netlink_open(&rtnl);
2727 if (r < 0)
2728 return log_error_errno(r, "Failed to connect to netlink: %m");
2729
2730 udev = udev_new();
2731 if (!udev) {
2732 log_error("Failed to connect to udev.");
2733 return -ENOMEM;
2734 }
2735
2736 STRV_FOREACH(i, arg_network_interfaces) {
2737 _cleanup_netlink_message_unref_ sd_netlink_message *m = NULL;
2738 int ifi;
2739
2740 ifi = parse_interface(udev, *i);
2741 if (ifi < 0)
2742 return ifi;
2743
2744 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
2745 if (r < 0)
2746 return log_error_errno(r, "Failed to allocate netlink message: %m");
2747
2748 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
2749 if (r < 0)
2750 return log_error_errno(r, "Failed to append namespace PID to netlink message: %m");
2751
2752 r = sd_netlink_call(rtnl, m, 0, NULL);
2753 if (r < 0)
2754 return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
2755 }
2756
2757 return 0;
2758 }
2759
2760 static int setup_macvlan(pid_t pid) {
2761 _cleanup_udev_unref_ struct udev *udev = NULL;
2762 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
2763 unsigned idx = 0;
2764 char **i;
2765 int r;
2766
2767 if (!arg_private_network)
2768 return 0;
2769
2770 if (strv_isempty(arg_network_macvlan))
2771 return 0;
2772
2773 r = sd_netlink_open(&rtnl);
2774 if (r < 0)
2775 return log_error_errno(r, "Failed to connect to netlink: %m");
2776
2777 udev = udev_new();
2778 if (!udev) {
2779 log_error("Failed to connect to udev.");
2780 return -ENOMEM;
2781 }
2782
2783 STRV_FOREACH(i, arg_network_macvlan) {
2784 _cleanup_netlink_message_unref_ sd_netlink_message *m = NULL;
2785 _cleanup_free_ char *n = NULL;
2786 struct ether_addr mac;
2787 int ifi;
2788
2789 ifi = parse_interface(udev, *i);
2790 if (ifi < 0)
2791 return ifi;
2792
2793 r = generate_mac(&mac, MACVLAN_HASH_KEY, idx++);
2794 if (r < 0)
2795 return log_error_errno(r, "Failed to create MACVLAN MAC address: %m");
2796
2797 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
2798 if (r < 0)
2799 return log_error_errno(r, "Failed to allocate netlink message: %m");
2800
2801 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
2802 if (r < 0)
2803 return log_error_errno(r, "Failed to add netlink interface index: %m");
2804
2805 n = strappend("mv-", *i);
2806 if (!n)
2807 return log_oom();
2808
2809 strshorten(n, IFNAMSIZ-1);
2810
2811 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
2812 if (r < 0)
2813 return log_error_errno(r, "Failed to add netlink interface name: %m");
2814
2815 r = sd_netlink_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
2816 if (r < 0)
2817 return log_error_errno(r, "Failed to add netlink MAC address: %m");
2818
2819 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
2820 if (r < 0)
2821 return log_error_errno(r, "Failed to add netlink namespace field: %m");
2822
2823 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
2824 if (r < 0)
2825 return log_error_errno(r, "Failed to open netlink container: %m");
2826
2827 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
2828 if (r < 0)
2829 return log_error_errno(r, "Failed to open netlink container: %m");
2830
2831 r = sd_netlink_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
2832 if (r < 0)
2833 return log_error_errno(r, "Failed to append macvlan mode: %m");
2834
2835 r = sd_netlink_message_close_container(m);
2836 if (r < 0)
2837 return log_error_errno(r, "Failed to close netlink container: %m");
2838
2839 r = sd_netlink_message_close_container(m);
2840 if (r < 0)
2841 return log_error_errno(r, "Failed to close netlink container: %m");
2842
2843 r = sd_netlink_call(rtnl, m, 0, NULL);
2844 if (r < 0)
2845 return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
2846 }
2847
2848 return 0;
2849 }
2850
2851 static int setup_ipvlan(pid_t pid) {
2852 _cleanup_udev_unref_ struct udev *udev = NULL;
2853 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
2854 char **i;
2855 int r;
2856
2857 if (!arg_private_network)
2858 return 0;
2859
2860 if (strv_isempty(arg_network_ipvlan))
2861 return 0;
2862
2863 r = sd_netlink_open(&rtnl);
2864 if (r < 0)
2865 return log_error_errno(r, "Failed to connect to netlink: %m");
2866
2867 udev = udev_new();
2868 if (!udev) {
2869 log_error("Failed to connect to udev.");
2870 return -ENOMEM;
2871 }
2872
2873 STRV_FOREACH(i, arg_network_ipvlan) {
2874 _cleanup_netlink_message_unref_ sd_netlink_message *m = NULL;
2875 _cleanup_free_ char *n = NULL;
2876 int ifi;
2877
2878 ifi = parse_interface(udev, *i);
2879 if (ifi < 0)
2880 return ifi;
2881
2882 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
2883 if (r < 0)
2884 return log_error_errno(r, "Failed to allocate netlink message: %m");
2885
2886 r = sd_netlink_message_append_u32(m, IFLA_LINK, ifi);
2887 if (r < 0)
2888 return log_error_errno(r, "Failed to add netlink interface index: %m");
2889
2890 n = strappend("iv-", *i);
2891 if (!n)
2892 return log_oom();
2893
2894 strshorten(n, IFNAMSIZ-1);
2895
2896 r = sd_netlink_message_append_string(m, IFLA_IFNAME, n);
2897 if (r < 0)
2898 return log_error_errno(r, "Failed to add netlink interface name: %m");
2899
2900 r = sd_netlink_message_append_u32(m, IFLA_NET_NS_PID, pid);
2901 if (r < 0)
2902 return log_error_errno(r, "Failed to add netlink namespace field: %m");
2903
2904 r = sd_netlink_message_open_container(m, IFLA_LINKINFO);
2905 if (r < 0)
2906 return log_error_errno(r, "Failed to open netlink container: %m");
2907
2908 r = sd_netlink_message_open_container_union(m, IFLA_INFO_DATA, "ipvlan");
2909 if (r < 0)
2910 return log_error_errno(r, "Failed to open netlink container: %m");
2911
2912 r = sd_netlink_message_append_u16(m, IFLA_IPVLAN_MODE, IPVLAN_MODE_L2);
2913 if (r < 0)
2914 return log_error_errno(r, "Failed to add ipvlan mode: %m");
2915
2916 r = sd_netlink_message_close_container(m);
2917 if (r < 0)
2918 return log_error_errno(r, "Failed to close netlink container: %m");
2919
2920 r = sd_netlink_message_close_container(m);
2921 if (r < 0)
2922 return log_error_errno(r, "Failed to close netlink container: %m");
2923
2924 r = sd_netlink_call(rtnl, m, 0, NULL);
2925 if (r < 0)
2926 return log_error_errno(r, "Failed to add new ipvlan interfaces: %m");
2927 }
2928
2929 return 0;
2930 }
2931
2932 static int setup_seccomp(void) {
2933
2934 #ifdef HAVE_SECCOMP
2935 static const struct {
2936 uint64_t capability;
2937 int syscall_num;
2938 } blacklist[] = {
2939 { CAP_SYS_RAWIO, SCMP_SYS(iopl) },
2940 { CAP_SYS_RAWIO, SCMP_SYS(ioperm) },
2941 { CAP_SYS_BOOT, SCMP_SYS(kexec_load) },
2942 { CAP_SYS_ADMIN, SCMP_SYS(swapon) },
2943 { CAP_SYS_ADMIN, SCMP_SYS(swapoff) },
2944 { CAP_SYS_ADMIN, SCMP_SYS(open_by_handle_at) },
2945 { CAP_SYS_MODULE, SCMP_SYS(init_module) },
2946 { CAP_SYS_MODULE, SCMP_SYS(finit_module) },
2947 { CAP_SYS_MODULE, SCMP_SYS(delete_module) },
2948 { CAP_SYSLOG, SCMP_SYS(syslog) },
2949 };
2950
2951 scmp_filter_ctx seccomp;
2952 unsigned i;
2953 int r;
2954
2955 seccomp = seccomp_init(SCMP_ACT_ALLOW);
2956 if (!seccomp)
2957 return log_oom();
2958
2959 r = seccomp_add_secondary_archs(seccomp);
2960 if (r < 0) {
2961 log_error_errno(r, "Failed to add secondary archs to seccomp filter: %m");
2962 goto finish;
2963 }
2964
2965 for (i = 0; i < ELEMENTSOF(blacklist); i++) {
2966 if (arg_retain & (1ULL << blacklist[i].capability))
2967 continue;
2968
2969 r = seccomp_rule_add(seccomp, SCMP_ACT_ERRNO(EPERM), blacklist[i].syscall_num, 0);
2970 if (r == -EFAULT)
2971 continue; /* unknown syscall */
2972 if (r < 0) {
2973 log_error_errno(r, "Failed to block syscall: %m");
2974 goto finish;
2975 }
2976 }
2977
2978
2979 /*
2980 Audit is broken in containers, much of the userspace audit
2981 hookup will fail if running inside a container. We don't
2982 care and just turn off creation of audit sockets.
2983
2984 This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail
2985 with EAFNOSUPPORT which audit userspace uses as indication
2986 that audit is disabled in the kernel.
2987 */
2988
2989 r = seccomp_rule_add(
2990 seccomp,
2991 SCMP_ACT_ERRNO(EAFNOSUPPORT),
2992 SCMP_SYS(socket),
2993 2,
2994 SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
2995 SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
2996 if (r < 0) {
2997 log_error_errno(r, "Failed to add audit seccomp rule: %m");
2998 goto finish;
2999 }
3000
3001 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
3002 if (r < 0) {
3003 log_error_errno(r, "Failed to unset NO_NEW_PRIVS: %m");
3004 goto finish;
3005 }
3006
3007 r = seccomp_load(seccomp);
3008 if (r == -EINVAL) {
3009 log_debug_errno(r, "Kernel is probably not configured with CONFIG_SECCOMP. Disabling seccomp audit filter: %m");
3010 r = 0;
3011 goto finish;
3012 }
3013 if (r < 0) {
3014 log_error_errno(r, "Failed to install seccomp audit filter: %m");
3015 goto finish;
3016 }
3017
3018 finish:
3019 seccomp_release(seccomp);
3020 return r;
3021 #else
3022 return 0;
3023 #endif
3024
3025 }
3026
3027 static int setup_propagate(const char *root) {
3028 const char *p, *q;
3029
3030 (void) mkdir_p("/run/systemd/nspawn/", 0755);
3031 (void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
3032 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
3033 (void) mkdir_p(p, 0600);
3034
3035 if (userns_mkdir(root, "/run/systemd", 0755, 0, 0) < 0)
3036 return log_error_errno(errno, "Failed to create /run/systemd: %m");
3037
3038 if (userns_mkdir(root, "/run/systemd/nspawn", 0755, 0, 0) < 0)
3039 return log_error_errno(errno, "Failed to create /run/systemd/nspawn: %m");
3040
3041 if (userns_mkdir(root, "/run/systemd/nspawn/incoming", 0600, 0, 0) < 0)
3042 return log_error_errno(errno, "Failed to create /run/systemd/nspawn/incoming: %m");
3043
3044 q = prefix_roota(root, "/run/systemd/nspawn/incoming");
3045 if (mount(p, q, NULL, MS_BIND, NULL) < 0)
3046 return log_error_errno(errno, "Failed to install propagation bind mount.");
3047
3048 if (mount(NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0)
3049 return log_error_errno(errno, "Failed to make propagation mount read-only");
3050
3051 return 0;
3052 }
3053
3054 static int setup_image(char **device_path, int *loop_nr) {
3055 struct loop_info64 info = {
3056 .lo_flags = LO_FLAGS_AUTOCLEAR|LO_FLAGS_PARTSCAN
3057 };
3058 _cleanup_close_ int fd = -1, control = -1, loop = -1;
3059 _cleanup_free_ char* loopdev = NULL;
3060 struct stat st;
3061 int r, nr;
3062
3063 assert(device_path);
3064 assert(loop_nr);
3065 assert(arg_image);
3066
3067 fd = open(arg_image, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
3068 if (fd < 0)
3069 return log_error_errno(errno, "Failed to open %s: %m", arg_image);
3070
3071 if (fstat(fd, &st) < 0)
3072 return log_error_errno(errno, "Failed to stat %s: %m", arg_image);
3073
3074 if (S_ISBLK(st.st_mode)) {
3075 char *p;
3076
3077 p = strdup(arg_image);
3078 if (!p)
3079 return log_oom();
3080
3081 *device_path = p;
3082
3083 *loop_nr = -1;
3084
3085 r = fd;
3086 fd = -1;
3087
3088 return r;
3089 }
3090
3091 if (!S_ISREG(st.st_mode)) {
3092 log_error_errno(errno, "%s is not a regular file or block device: %m", arg_image);
3093 return -EINVAL;
3094 }
3095
3096 control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
3097 if (control < 0)
3098 return log_error_errno(errno, "Failed to open /dev/loop-control: %m");
3099
3100 nr = ioctl(control, LOOP_CTL_GET_FREE);
3101 if (nr < 0)
3102 return log_error_errno(errno, "Failed to allocate loop device: %m");
3103
3104 if (asprintf(&loopdev, "/dev/loop%i", nr) < 0)
3105 return log_oom();
3106
3107 loop = open(loopdev, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
3108 if (loop < 0)
3109 return log_error_errno(errno, "Failed to open loop device %s: %m", loopdev);
3110
3111 if (ioctl(loop, LOOP_SET_FD, fd) < 0)
3112 return log_error_errno(errno, "Failed to set loopback file descriptor on %s: %m", loopdev);
3113
3114 if (arg_read_only)
3115 info.lo_flags |= LO_FLAGS_READ_ONLY;
3116
3117 if (ioctl(loop, LOOP_SET_STATUS64, &info) < 0)
3118 return log_error_errno(errno, "Failed to set loopback settings on %s: %m", loopdev);
3119
3120 *device_path = loopdev;
3121 loopdev = NULL;
3122
3123 *loop_nr = nr;
3124
3125 r = loop;
3126 loop = -1;
3127
3128 return r;
3129 }
3130
3131 #define PARTITION_TABLE_BLURB \
3132 "Note that the disk image needs to either contain only a single MBR partition of\n" \
3133 "type 0x83 that is marked bootable, or a single GPT partition of type " \
3134 "0FC63DAF-8483-4772-8E79-3D69D8477DE4 or follow\n" \
3135 " http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/\n" \
3136 "to be bootable with systemd-nspawn."
3137
3138 static int dissect_image(
3139 int fd,
3140 char **root_device, bool *root_device_rw,
3141 char **home_device, bool *home_device_rw,
3142 char **srv_device, bool *srv_device_rw,
3143 bool *secondary) {
3144
3145 #ifdef HAVE_BLKID
3146 int home_nr = -1, srv_nr = -1;
3147 #ifdef GPT_ROOT_NATIVE
3148 int root_nr = -1;
3149 #endif
3150 #ifdef GPT_ROOT_SECONDARY
3151 int secondary_root_nr = -1;
3152 #endif
3153 _cleanup_free_ char *home = NULL, *root = NULL, *secondary_root = NULL, *srv = NULL, *generic = NULL;
3154 _cleanup_udev_enumerate_unref_ struct udev_enumerate *e = NULL;
3155 _cleanup_udev_device_unref_ struct udev_device *d = NULL;
3156 _cleanup_blkid_free_probe_ blkid_probe b = NULL;
3157 _cleanup_udev_unref_ struct udev *udev = NULL;
3158 struct udev_list_entry *first, *item;
3159 bool home_rw = true, root_rw = true, secondary_root_rw = true, srv_rw = true, generic_rw = true;
3160 bool is_gpt, is_mbr, multiple_generic = false;
3161 const char *pttype = NULL;
3162 blkid_partlist pl;
3163 struct stat st;
3164 unsigned i;
3165 int r;
3166
3167 assert(fd >= 0);
3168 assert(root_device);
3169 assert(home_device);
3170 assert(srv_device);
3171 assert(secondary);
3172 assert(arg_image);
3173
3174 b = blkid_new_probe();
3175 if (!b)
3176 return log_oom();
3177
3178 errno = 0;
3179 r = blkid_probe_set_device(b, fd, 0, 0);
3180 if (r != 0) {
3181 if (errno == 0)
3182 return log_oom();
3183
3184 log_error_errno(errno, "Failed to set device on blkid probe: %m");
3185 return -errno;
3186 }
3187
3188 blkid_probe_enable_partitions(b, 1);
3189 blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
3190
3191 errno = 0;
3192 r = blkid_do_safeprobe(b);
3193 if (r == -2 || r == 1) {
3194 log_error("Failed to identify any partition table on\n"
3195 " %s\n"
3196 PARTITION_TABLE_BLURB, arg_image);
3197 return -EINVAL;
3198 } else if (r != 0) {
3199 if (errno == 0)
3200 errno = EIO;
3201 log_error_errno(errno, "Failed to probe: %m");
3202 return -errno;
3203 }
3204
3205 (void) blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
3206
3207 is_gpt = streq_ptr(pttype, "gpt");
3208 is_mbr = streq_ptr(pttype, "dos");
3209
3210 if (!is_gpt && !is_mbr) {
3211 log_error("No GPT or MBR partition table discovered on\n"
3212 " %s\n"
3213 PARTITION_TABLE_BLURB, arg_image);
3214 return -EINVAL;
3215 }
3216
3217 errno = 0;
3218 pl = blkid_probe_get_partitions(b);
3219 if (!pl) {
3220 if (errno == 0)
3221 return log_oom();
3222
3223 log_error("Failed to list partitions of %s", arg_image);
3224 return -errno;
3225 }
3226
3227 udev = udev_new();
3228 if (!udev)
3229 return log_oom();
3230
3231 if (fstat(fd, &st) < 0)
3232 return log_error_errno(errno, "Failed to stat block device: %m");
3233
3234 d = udev_device_new_from_devnum(udev, 'b', st.st_rdev);
3235 if (!d)
3236 return log_oom();
3237
3238 for (i = 0;; i++) {
3239 int n, m;
3240
3241 if (i >= 10) {
3242 log_error("Kernel partitions never appeared.");
3243 return -ENXIO;
3244 }
3245
3246 e = udev_enumerate_new(udev);
3247 if (!e)
3248 return log_oom();
3249
3250 r = udev_enumerate_add_match_parent(e, d);
3251 if (r < 0)
3252 return log_oom();
3253
3254 r = udev_enumerate_scan_devices(e);
3255 if (r < 0)
3256 return log_error_errno(r, "Failed to scan for partition devices of %s: %m", arg_image);
3257
3258 /* Count the partitions enumerated by the kernel */
3259 n = 0;
3260 first = udev_enumerate_get_list_entry(e);
3261 udev_list_entry_foreach(item, first)
3262 n++;
3263
3264 /* Count the partitions enumerated by blkid */
3265 m = blkid_partlist_numof_partitions(pl);
3266 if (n == m + 1)
3267 break;
3268 if (n > m + 1) {
3269 log_error("blkid and kernel partition list do not match.");
3270 return -EIO;
3271 }
3272 if (n < m + 1) {
3273 unsigned j;
3274
3275 /* The kernel has probed fewer partitions than
3276 * blkid? Maybe the kernel prober is still
3277 * running or it got EBUSY because udev
3278 * already opened the device. Let's reprobe
3279 * the device, which is a synchronous call
3280 * that waits until probing is complete. */
3281
3282 for (j = 0; j < 20; j++) {
3283
3284 r = ioctl(fd, BLKRRPART, 0);
3285 if (r < 0)
3286 r = -errno;
3287 if (r >= 0 || r != -EBUSY)
3288 break;
3289
3290 /* If something else has the device
3291 * open, such as an udev rule, the
3292 * ioctl will return EBUSY. Since
3293 * there's no way to wait until it
3294 * isn't busy anymore, let's just wait
3295 * a bit, and try again.
3296 *
3297 * This is really something they
3298 * should fix in the kernel! */
3299
3300 usleep(50 * USEC_PER_MSEC);
3301 }
3302
3303 if (r < 0)
3304 return log_error_errno(r, "Failed to reread partition table: %m");
3305 }
3306
3307 e = udev_enumerate_unref(e);
3308 }
3309
3310 first = udev_enumerate_get_list_entry(e);
3311 udev_list_entry_foreach(item, first) {
3312 _cleanup_udev_device_unref_ struct udev_device *q;
3313 const char *node;
3314 unsigned long long flags;
3315 blkid_partition pp;
3316 dev_t qn;
3317 int nr;
3318
3319 errno = 0;
3320 q = udev_device_new_from_syspath(udev, udev_list_entry_get_name(item));
3321 if (!q) {
3322 if (!errno)
3323 errno = ENOMEM;
3324
3325 log_error_errno(errno, "Failed to get partition device of %s: %m", arg_image);
3326 return -errno;
3327 }
3328
3329 qn = udev_device_get_devnum(q);
3330 if (major(qn) == 0)
3331 continue;
3332
3333 if (st.st_rdev == qn)
3334 continue;
3335
3336 node = udev_device_get_devnode(q);
3337 if (!node)
3338 continue;
3339
3340 pp = blkid_partlist_devno_to_partition(pl, qn);
3341 if (!pp)
3342 continue;
3343
3344 flags = blkid_partition_get_flags(pp);
3345
3346 nr = blkid_partition_get_partno(pp);
3347 if (nr < 0)
3348 continue;
3349
3350 if (is_gpt) {
3351 sd_id128_t type_id;
3352 const char *stype;
3353
3354 if (flags & GPT_FLAG_NO_AUTO)
3355 continue;
3356
3357 stype = blkid_partition_get_type_string(pp);
3358 if (!stype)
3359 continue;
3360
3361 if (sd_id128_from_string(stype, &type_id) < 0)
3362 continue;
3363
3364 if (sd_id128_equal(type_id, GPT_HOME)) {
3365
3366 if (home && nr >= home_nr)
3367 continue;
3368
3369 home_nr = nr;
3370 home_rw = !(flags & GPT_FLAG_READ_ONLY);
3371
3372 r = free_and_strdup(&home, node);
3373 if (r < 0)
3374 return log_oom();
3375
3376 } else if (sd_id128_equal(type_id, GPT_SRV)) {
3377
3378 if (srv && nr >= srv_nr)
3379 continue;
3380
3381 srv_nr = nr;
3382 srv_rw = !(flags & GPT_FLAG_READ_ONLY);
3383
3384 r = free_and_strdup(&srv, node);
3385 if (r < 0)
3386 return log_oom();
3387 }
3388 #ifdef GPT_ROOT_NATIVE
3389 else if (sd_id128_equal(type_id, GPT_ROOT_NATIVE)) {
3390
3391 if (root && nr >= root_nr)
3392 continue;
3393
3394 root_nr = nr;
3395 root_rw = !(flags & GPT_FLAG_READ_ONLY);
3396
3397 r = free_and_strdup(&root, node);
3398 if (r < 0)
3399 return log_oom();
3400 }
3401 #endif
3402 #ifdef GPT_ROOT_SECONDARY
3403 else if (sd_id128_equal(type_id, GPT_ROOT_SECONDARY)) {
3404
3405 if (secondary_root && nr >= secondary_root_nr)
3406 continue;
3407
3408 secondary_root_nr = nr;
3409 secondary_root_rw = !(flags & GPT_FLAG_READ_ONLY);
3410
3411 r = free_and_strdup(&secondary_root, node);
3412 if (r < 0)
3413 return log_oom();
3414 }
3415 #endif
3416 else if (sd_id128_equal(type_id, GPT_LINUX_GENERIC)) {
3417
3418 if (generic)
3419 multiple_generic = true;
3420 else {
3421 generic_rw = !(flags & GPT_FLAG_READ_ONLY);
3422
3423 r = free_and_strdup(&generic, node);
3424 if (r < 0)
3425 return log_oom();
3426 }
3427 }
3428
3429 } else if (is_mbr) {
3430 int type;
3431
3432 if (flags != 0x80) /* Bootable flag */
3433 continue;
3434
3435 type = blkid_partition_get_type(pp);
3436 if (type != 0x83) /* Linux partition */
3437 continue;
3438
3439 if (generic)
3440 multiple_generic = true;
3441 else {
3442 generic_rw = true;
3443
3444 r = free_and_strdup(&root, node);
3445 if (r < 0)
3446 return log_oom();
3447 }
3448 }
3449 }
3450
3451 if (root) {
3452 *root_device = root;
3453 root = NULL;
3454
3455 *root_device_rw = root_rw;
3456 *secondary = false;
3457 } else if (secondary_root) {
3458 *root_device = secondary_root;
3459 secondary_root = NULL;
3460
3461 *root_device_rw = secondary_root_rw;
3462 *secondary = true;
3463 } else if (generic) {
3464
3465 /* There were no partitions with precise meanings
3466 * around, but we found generic partitions. In this
3467 * case, if there's only one, we can go ahead and boot
3468 * it, otherwise we bail out, because we really cannot
3469 * make any sense of it. */
3470
3471 if (multiple_generic) {
3472 log_error("Identified multiple bootable Linux partitions on\n"
3473 " %s\n"
3474 PARTITION_TABLE_BLURB, arg_image);
3475 return -EINVAL;
3476 }
3477
3478 *root_device = generic;
3479 generic = NULL;
3480
3481 *root_device_rw = generic_rw;
3482 *secondary = false;
3483 } else {
3484 log_error("Failed to identify root partition in disk image\n"
3485 " %s\n"
3486 PARTITION_TABLE_BLURB, arg_image);
3487 return -EINVAL;
3488 }
3489
3490 if (home) {
3491 *home_device = home;
3492 home = NULL;
3493
3494 *home_device_rw = home_rw;
3495 }
3496
3497 if (srv) {
3498 *srv_device = srv;
3499 srv = NULL;
3500
3501 *srv_device_rw = srv_rw;
3502 }
3503
3504 return 0;
3505 #else
3506 log_error("--image= is not supported, compiled without blkid support.");
3507 return -EOPNOTSUPP;
3508 #endif
3509 }
3510
3511 static int mount_device(const char *what, const char *where, const char *directory, bool rw) {
3512 #ifdef HAVE_BLKID
3513 _cleanup_blkid_free_probe_ blkid_probe b = NULL;
3514 const char *fstype, *p;
3515 int r;
3516
3517 assert(what);
3518 assert(where);
3519
3520 if (arg_read_only)
3521 rw = false;
3522
3523 if (directory)
3524 p = strjoina(where, directory);
3525 else
3526 p = where;
3527
3528 errno = 0;
3529 b = blkid_new_probe_from_filename(what);
3530 if (!b) {
3531 if (errno == 0)
3532 return log_oom();
3533 log_error_errno(errno, "Failed to allocate prober for %s: %m", what);
3534 return -errno;
3535 }
3536
3537 blkid_probe_enable_superblocks(b, 1);
3538 blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
3539
3540 errno = 0;
3541 r = blkid_do_safeprobe(b);
3542 if (r == -1 || r == 1) {
3543 log_error("Cannot determine file system type of %s", what);
3544 return -EINVAL;
3545 } else if (r != 0) {
3546 if (errno == 0)
3547 errno = EIO;
3548 log_error_errno(errno, "Failed to probe %s: %m", what);
3549 return -errno;
3550 }
3551
3552 errno = 0;
3553 if (blkid_probe_lookup_value(b, "TYPE", &fstype, NULL) < 0) {
3554 if (errno == 0)
3555 errno = EINVAL;
3556 log_error("Failed to determine file system type of %s", what);
3557 return -errno;
3558 }
3559
3560 if (streq(fstype, "crypto_LUKS")) {
3561 log_error("nspawn currently does not support LUKS disk images.");
3562 return -EOPNOTSUPP;
3563 }
3564
3565 if (mount(what, p, fstype, MS_NODEV|(rw ? 0 : MS_RDONLY), NULL) < 0)
3566 return log_error_errno(errno, "Failed to mount %s: %m", what);
3567
3568 return 0;
3569 #else
3570 log_error("--image= is not supported, compiled without blkid support.");
3571 return -EOPNOTSUPP;
3572 #endif
3573 }
3574
3575 static int mount_devices(
3576 const char *where,
3577 const char *root_device, bool root_device_rw,
3578 const char *home_device, bool home_device_rw,
3579 const char *srv_device, bool srv_device_rw) {
3580 int r;
3581
3582 assert(where);
3583
3584 if (root_device) {
3585 r = mount_device(root_device, arg_directory, NULL, root_device_rw);
3586 if (r < 0)
3587 return log_error_errno(r, "Failed to mount root directory: %m");
3588 }
3589
3590 if (home_device) {
3591 r = mount_device(home_device, arg_directory, "/home", home_device_rw);
3592 if (r < 0)
3593 return log_error_errno(r, "Failed to mount home directory: %m");
3594 }
3595
3596 if (srv_device) {
3597 r = mount_device(srv_device, arg_directory, "/srv", srv_device_rw);
3598 if (r < 0)
3599 return log_error_errno(r, "Failed to mount server data directory: %m");
3600 }
3601
3602 return 0;
3603 }
3604
3605 static void loop_remove(int nr, int *image_fd) {
3606 _cleanup_close_ int control = -1;
3607 int r;
3608
3609 if (nr < 0)
3610 return;
3611
3612 if (image_fd && *image_fd >= 0) {
3613 r = ioctl(*image_fd, LOOP_CLR_FD);
3614 if (r < 0)
3615 log_debug_errno(errno, "Failed to close loop image: %m");
3616 *image_fd = safe_close(*image_fd);
3617 }
3618
3619 control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
3620 if (control < 0) {
3621 log_warning_errno(errno, "Failed to open /dev/loop-control: %m");
3622 return;
3623 }
3624
3625 r = ioctl(control, LOOP_CTL_REMOVE, nr);
3626 if (r < 0)
3627 log_debug_errno(errno, "Failed to remove loop %d: %m", nr);
3628 }
3629
3630 static int spawn_getent(const char *database, const char *key, pid_t *rpid) {
3631 int pipe_fds[2];
3632 pid_t pid;
3633
3634 assert(database);
3635 assert(key);
3636 assert(rpid);
3637
3638 if (pipe2(pipe_fds, O_CLOEXEC) < 0)
3639 return log_error_errno(errno, "Failed to allocate pipe: %m");
3640
3641 pid = fork();
3642 if (pid < 0)
3643 return log_error_errno(errno, "Failed to fork getent child: %m");
3644 else if (pid == 0) {
3645 int nullfd;
3646 char *empty_env = NULL;
3647
3648 if (dup3(pipe_fds[1], STDOUT_FILENO, 0) < 0)
3649 _exit(EXIT_FAILURE);
3650
3651 if (pipe_fds[0] > 2)
3652 safe_close(pipe_fds[0]);
3653 if (pipe_fds[1] > 2)
3654 safe_close(pipe_fds[1]);
3655
3656 nullfd = open("/dev/null", O_RDWR);
3657 if (nullfd < 0)
3658 _exit(EXIT_FAILURE);
3659
3660 if (dup3(nullfd, STDIN_FILENO, 0) < 0)
3661 _exit(EXIT_FAILURE);
3662
3663 if (dup3(nullfd, STDERR_FILENO, 0) < 0)
3664 _exit(EXIT_FAILURE);
3665
3666 if (nullfd > 2)
3667 safe_close(nullfd);
3668
3669 (void) reset_all_signal_handlers();
3670 (void) reset_signal_mask();
3671 close_all_fds(NULL, 0);
3672
3673 execle("/usr/bin/getent", "getent", database, key, NULL, &empty_env);
3674 execle("/bin/getent", "getent", database, key, NULL, &empty_env);
3675 _exit(EXIT_FAILURE);
3676 }
3677
3678 pipe_fds[1] = safe_close(pipe_fds[1]);
3679
3680 *rpid = pid;
3681
3682 return pipe_fds[0];
3683 }
3684
3685 static int change_uid_gid(char **_home) {
3686 char line[LINE_MAX], *x, *u, *g, *h;
3687 const char *word, *state;
3688 _cleanup_free_ uid_t *uids = NULL;
3689 _cleanup_free_ char *home = NULL;
3690 _cleanup_fclose_ FILE *f = NULL;
3691 _cleanup_close_ int fd = -1;
3692 unsigned n_uids = 0;
3693 size_t sz = 0, l;
3694 uid_t uid;
3695 gid_t gid;
3696 pid_t pid;
3697 int r;
3698
3699 assert(_home);
3700
3701 if (!arg_user || streq(arg_user, "root") || streq(arg_user, "0")) {
3702 /* Reset everything fully to 0, just in case */
3703
3704 r = reset_uid_gid();
3705 if (r < 0)
3706 return log_error_errno(r, "Failed to become root: %m");
3707
3708 *_home = NULL;
3709 return 0;
3710 }
3711
3712 /* First, get user credentials */
3713 fd = spawn_getent("passwd", arg_user, &pid);
3714 if (fd < 0)
3715 return fd;
3716
3717 f = fdopen(fd, "r");
3718 if (!f)
3719 return log_oom();
3720 fd = -1;
3721
3722 if (!fgets(line, sizeof(line), f)) {
3723
3724 if (!ferror(f)) {
3725 log_error("Failed to resolve user %s.", arg_user);
3726 return -ESRCH;
3727 }
3728
3729 log_error_errno(errno, "Failed to read from getent: %m");
3730 return -errno;
3731 }
3732
3733 truncate_nl(line);
3734
3735 wait_for_terminate_and_warn("getent passwd", pid, true);
3736
3737 x = strchr(line, ':');
3738 if (!x) {
3739 log_error("/etc/passwd entry has invalid user field.");
3740 return -EIO;
3741 }
3742
3743 u = strchr(x+1, ':');
3744 if (!u) {
3745 log_error("/etc/passwd entry has invalid password field.");
3746 return -EIO;
3747 }
3748
3749 u++;
3750 g = strchr(u, ':');
3751 if (!g) {
3752 log_error("/etc/passwd entry has invalid UID field.");
3753 return -EIO;
3754 }
3755
3756 *g = 0;
3757 g++;
3758 x = strchr(g, ':');
3759 if (!x) {
3760 log_error("/etc/passwd entry has invalid GID field.");
3761 return -EIO;
3762 }
3763
3764 *x = 0;
3765 h = strchr(x+1, ':');
3766 if (!h) {
3767 log_error("/etc/passwd entry has invalid GECOS field.");
3768 return -EIO;
3769 }
3770
3771 h++;
3772 x = strchr(h, ':');
3773 if (!x) {
3774 log_error("/etc/passwd entry has invalid home directory field.");
3775 return -EIO;
3776 }
3777
3778 *x = 0;
3779
3780 r = parse_uid(u, &uid);
3781 if (r < 0) {
3782 log_error("Failed to parse UID of user.");
3783 return -EIO;
3784 }
3785
3786 r = parse_gid(g, &gid);
3787 if (r < 0) {
3788 log_error("Failed to parse GID of user.");
3789 return -EIO;
3790 }
3791
3792 home = strdup(h);
3793 if (!home)
3794 return log_oom();
3795
3796 /* Second, get group memberships */
3797 fd = spawn_getent("initgroups", arg_user, &pid);
3798 if (fd < 0)
3799 return fd;
3800
3801 fclose(f);
3802 f = fdopen(fd, "r");
3803 if (!f)
3804 return log_oom();
3805 fd = -1;
3806
3807 if (!fgets(line, sizeof(line), f)) {
3808 if (!ferror(f)) {
3809 log_error("Failed to resolve user %s.", arg_user);
3810 return -ESRCH;
3811 }
3812
3813 log_error_errno(errno, "Failed to read from getent: %m");
3814 return -errno;
3815 }
3816
3817 truncate_nl(line);
3818
3819 wait_for_terminate_and_warn("getent initgroups", pid, true);
3820
3821 /* Skip over the username and subsequent separator whitespace */
3822 x = line;
3823 x += strcspn(x, WHITESPACE);
3824 x += strspn(x, WHITESPACE);
3825
3826 FOREACH_WORD(word, l, x, state) {
3827 char c[l+1];
3828
3829 memcpy(c, word, l);
3830 c[l] = 0;
3831
3832 if (!GREEDY_REALLOC(uids, sz, n_uids+1))
3833 return log_oom();
3834
3835 r = parse_uid(c, &uids[n_uids++]);
3836 if (r < 0) {
3837 log_error("Failed to parse group data from getent.");
3838 return -EIO;
3839 }
3840 }
3841
3842 r = mkdir_parents(home, 0775);
3843 if (r < 0)
3844 return log_error_errno(r, "Failed to make home root directory: %m");
3845
3846 r = mkdir_safe(home, 0755, uid, gid);
3847 if (r < 0 && r != -EEXIST)
3848 return log_error_errno(r, "Failed to make home directory: %m");
3849
3850 (void) fchown(STDIN_FILENO, uid, gid);
3851 (void) fchown(STDOUT_FILENO, uid, gid);
3852 (void) fchown(STDERR_FILENO, uid, gid);
3853
3854 if (setgroups(n_uids, uids) < 0)
3855 return log_error_errno(errno, "Failed to set auxiliary groups: %m");
3856
3857 if (setresgid(gid, gid, gid) < 0)
3858 return log_error_errno(errno, "setregid() failed: %m");
3859
3860 if (setresuid(uid, uid, uid) < 0)
3861 return log_error_errno(errno, "setreuid() failed: %m");
3862
3863 if (_home) {
3864 *_home = home;
3865 home = NULL;
3866 }
3867
3868 return 0;
3869 }
3870
3871 /*
3872 * Return values:
3873 * < 0 : wait_for_terminate() failed to get the state of the
3874 * container, the container was terminated by a signal, or
3875 * failed for an unknown reason. No change is made to the
3876 * container argument.
3877 * > 0 : The program executed in the container terminated with an
3878 * error. The exit code of the program executed in the
3879 * container is returned. The container argument has been set
3880 * to CONTAINER_TERMINATED.
3881 * 0 : The container is being rebooted, has been shut down or exited
3882 * successfully. The container argument has been set to either
3883 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
3884 *
3885 * That is, success is indicated by a return value of zero, and an
3886 * error is indicated by a non-zero value.
3887 */
3888 static int wait_for_container(pid_t pid, ContainerStatus *container) {
3889 siginfo_t status;
3890 int r;
3891
3892 r = wait_for_terminate(pid, &status);
3893 if (r < 0)
3894 return log_warning_errno(r, "Failed to wait for container: %m");
3895
3896 switch (status.si_code) {
3897
3898 case CLD_EXITED:
3899 if (status.si_status == 0) {
3900 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
3901
3902 } else
3903 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
3904
3905 *container = CONTAINER_TERMINATED;
3906 return status.si_status;
3907
3908 case CLD_KILLED:
3909 if (status.si_status == SIGINT) {
3910
3911 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
3912 *container = CONTAINER_TERMINATED;
3913 return 0;
3914
3915 } else if (status.si_status == SIGHUP) {
3916
3917 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
3918 *container = CONTAINER_REBOOTED;
3919 return 0;
3920 }
3921
3922 /* CLD_KILLED fallthrough */
3923
3924 case CLD_DUMPED:
3925 log_error("Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
3926 return -EIO;
3927
3928 default:
3929 log_error("Container %s failed due to unknown reason.", arg_machine);
3930 return -EIO;
3931 }
3932
3933 return r;
3934 }
3935
3936 static void nop_handler(int sig) {}
3937
3938 static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
3939 pid_t pid;
3940
3941 pid = PTR_TO_UINT32(userdata);
3942 if (pid > 0) {
3943 if (kill(pid, arg_kill_signal) >= 0) {
3944 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
3945 sd_event_source_set_userdata(s, NULL);
3946 return 0;
3947 }
3948 }
3949
3950 sd_event_exit(sd_event_source_get_event(s), 0);
3951 return 0;
3952 }
3953
3954 static int determine_names(void) {
3955 int r;
3956
3957 if (!arg_image && !arg_directory) {
3958 if (arg_machine) {
3959 _cleanup_(image_unrefp) Image *i = NULL;
3960
3961 r = image_find(arg_machine, &i);
3962 if (r < 0)
3963 return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
3964 else if (r == 0) {
3965 log_error("No image for machine '%s': %m", arg_machine);
3966 return -ENOENT;
3967 }
3968
3969 if (i->type == IMAGE_RAW)
3970 r = set_sanitized_path(&arg_image, i->path);
3971 else
3972 r = set_sanitized_path(&arg_directory, i->path);
3973 if (r < 0)
3974 return log_error_errno(r, "Invalid image directory: %m");
3975
3976 if (!arg_ephemeral)
3977 arg_read_only = arg_read_only || i->read_only;
3978 } else
3979 arg_directory = get_current_dir_name();
3980
3981 if (!arg_directory && !arg_machine) {
3982 log_error("Failed to determine path, please use -D or -i.");
3983 return -EINVAL;
3984 }
3985 }
3986
3987 if (!arg_machine) {
3988 if (arg_directory && path_equal(arg_directory, "/"))
3989 arg_machine = gethostname_malloc();
3990 else
3991 arg_machine = strdup(basename(arg_image ?: arg_directory));
3992
3993 if (!arg_machine)
3994 return log_oom();
3995
3996 hostname_cleanup(arg_machine, false);
3997 if (!machine_name_is_valid(arg_machine)) {
3998 log_error("Failed to determine machine name automatically, please use -M.");
3999 return -EINVAL;
4000 }
4001
4002 if (arg_ephemeral) {
4003 char *b;
4004
4005 /* Add a random suffix when this is an
4006 * ephemeral machine, so that we can run many
4007 * instances at once without manually having
4008 * to specify -M each time. */
4009
4010 if (asprintf(&b, "%s-%016" PRIx64, arg_machine, random_u64()) < 0)
4011 return log_oom();
4012
4013 free(arg_machine);
4014 arg_machine = b;
4015 }
4016 }
4017
4018 return 0;
4019 }
4020
4021 static int determine_uid_shift(const char *directory) {
4022 int r;
4023
4024 if (!arg_userns) {
4025 arg_uid_shift = 0;
4026 return 0;
4027 }
4028
4029 if (arg_uid_shift == UID_INVALID) {
4030 struct stat st;
4031
4032 r = stat(directory, &st);
4033 if (r < 0)
4034 return log_error_errno(errno, "Failed to determine UID base of %s: %m", directory);
4035
4036 arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
4037
4038 if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000))) {
4039 log_error("UID and GID base of %s don't match.", directory);
4040 return -EINVAL;
4041 }
4042
4043 arg_uid_range = UINT32_C(0x10000);
4044 }
4045
4046 if (arg_uid_shift > (uid_t) -1 - arg_uid_range) {
4047 log_error("UID base too high for UID range.");
4048 return -EINVAL;
4049 }
4050
4051 log_info("Using user namespaces with base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
4052 return 0;
4053 }
4054
4055 static int inner_child(
4056 Barrier *barrier,
4057 const char *directory,
4058 bool secondary,
4059 int kmsg_socket,
4060 int rtnl_socket,
4061 FDSet *fds,
4062 int argc,
4063 char *argv[]) {
4064
4065 _cleanup_free_ char *home = NULL;
4066 unsigned n_env = 2;
4067 const char *envp[] = {
4068 "PATH=" DEFAULT_PATH_SPLIT_USR,
4069 "container=systemd-nspawn", /* LXC sets container=lxc, so follow the scheme here */
4070 NULL, /* TERM */
4071 NULL, /* HOME */
4072 NULL, /* USER */
4073 NULL, /* LOGNAME */
4074 NULL, /* container_uuid */
4075 NULL, /* LISTEN_FDS */
4076 NULL, /* LISTEN_PID */
4077 NULL
4078 };
4079
4080 _cleanup_strv_free_ char **env_use = NULL;
4081 int r;
4082
4083 assert(barrier);
4084 assert(directory);
4085 assert(kmsg_socket >= 0);
4086
4087 if (arg_userns) {
4088 /* Tell the parent, that it now can write the UID map. */
4089 (void) barrier_place(barrier); /* #1 */
4090
4091 /* Wait until the parent wrote the UID map */
4092 if (!barrier_place_and_sync(barrier)) { /* #2 */
4093 log_error("Parent died too early");
4094 return -ESRCH;
4095 }
4096 }
4097
4098 r = mount_all(NULL, true);
4099 if (r < 0)
4100 return r;
4101
4102 /* Wait until we are cgroup-ified, so that we
4103 * can mount the right cgroup path writable */
4104 if (!barrier_place_and_sync(barrier)) { /* #3 */
4105 log_error("Parent died too early");
4106 return -ESRCH;
4107 }
4108
4109 r = mount_systemd_cgroup_writable("");
4110 if (r < 0)
4111 return r;
4112
4113 r = reset_uid_gid();
4114 if (r < 0)
4115 return log_error_errno(r, "Couldn't become new root: %m");
4116
4117 r = setup_boot_id(NULL);
4118 if (r < 0)
4119 return r;
4120
4121 r = setup_kmsg(NULL, kmsg_socket);
4122 if (r < 0)
4123 return r;
4124 kmsg_socket = safe_close(kmsg_socket);
4125
4126 umask(0022);
4127
4128 if (setsid() < 0)
4129 return log_error_errno(errno, "setsid() failed: %m");
4130
4131 if (arg_private_network)
4132 loopback_setup();
4133
4134 r = send_rtnl(rtnl_socket);
4135 if (r < 0)
4136 return r;
4137 rtnl_socket = safe_close(rtnl_socket);
4138
4139 if (drop_capabilities() < 0)
4140 return log_error_errno(errno, "drop_capabilities() failed: %m");
4141
4142 setup_hostname();
4143
4144 if (arg_personality != PERSONALITY_INVALID) {
4145 if (personality(arg_personality) < 0)
4146 return log_error_errno(errno, "personality() failed: %m");
4147 } else if (secondary) {
4148 if (personality(PER_LINUX32) < 0)
4149 return log_error_errno(errno, "personality() failed: %m");
4150 }
4151
4152 #ifdef HAVE_SELINUX
4153 if (arg_selinux_context)
4154 if (setexeccon((security_context_t) arg_selinux_context) < 0)
4155 return log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
4156 #endif
4157
4158 r = change_uid_gid(&home);
4159 if (r < 0)
4160 return r;
4161
4162 envp[n_env] = strv_find_prefix(environ, "TERM=");
4163 if (envp[n_env])
4164 n_env ++;
4165
4166 if ((asprintf((char**)(envp + n_env++), "HOME=%s", home ? home: "/root") < 0) ||
4167 (asprintf((char**)(envp + n_env++), "USER=%s", arg_user ? arg_user : "root") < 0) ||
4168 (asprintf((char**)(envp + n_env++), "LOGNAME=%s", arg_user ? arg_user : "root") < 0))
4169 return log_oom();
4170
4171 if (!sd_id128_equal(arg_uuid, SD_ID128_NULL)) {
4172 char as_uuid[37];
4173
4174 if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_format_as_uuid(arg_uuid, as_uuid)) < 0)
4175 return log_oom();
4176 }
4177
4178 if (fdset_size(fds) > 0) {
4179 r = fdset_cloexec(fds, false);
4180 if (r < 0)
4181 return log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
4182
4183 if ((asprintf((char **)(envp + n_env++), "LISTEN_FDS=%u", fdset_size(fds)) < 0) ||
4184 (asprintf((char **)(envp + n_env++), "LISTEN_PID=1") < 0))
4185 return log_oom();
4186 }
4187
4188 env_use = strv_env_merge(2, envp, arg_setenv);
4189 if (!env_use)
4190 return log_oom();
4191
4192 /* Let the parent know that we are ready and
4193 * wait until the parent is ready with the
4194 * setup, too... */
4195 if (!barrier_place_and_sync(barrier)) { /* #4 */
4196 log_error("Parent died too early");
4197 return -ESRCH;
4198 }
4199
4200 /* Now, explicitly close the log, so that we
4201 * then can close all remaining fds. Closing
4202 * the log explicitly first has the benefit
4203 * that the logging subsystem knows about it,
4204 * and is thus ready to be reopened should we
4205 * need it again. Note that the other fds
4206 * closed here are at least the locking and
4207 * barrier fds. */
4208 log_close();
4209 (void) fdset_close_others(fds);
4210
4211 if (arg_boot) {
4212 char **a;
4213 size_t m;
4214
4215 /* Automatically search for the init system */
4216
4217 m = 1 + argc - optind;
4218 a = newa(char*, m + 1);
4219 memcpy(a + 1, argv + optind, m * sizeof(char*));
4220
4221 a[0] = (char*) "/usr/lib/systemd/systemd";
4222 execve(a[0], a, env_use);
4223
4224 a[0] = (char*) "/lib/systemd/systemd";
4225 execve(a[0], a, env_use);
4226
4227 a[0] = (char*) "/sbin/init";
4228 execve(a[0], a, env_use);
4229 } else if (argc > optind)
4230 execvpe(argv[optind], argv + optind, env_use);
4231 else {
4232 chdir(home ? home : "/root");
4233 execle("/bin/bash", "-bash", NULL, env_use);
4234 execle("/bin/sh", "-sh", NULL, env_use);
4235 }
4236
4237 (void) log_open();
4238 return log_error_errno(errno, "execv() failed: %m");
4239 }
4240
4241 static int outer_child(
4242 Barrier *barrier,
4243 const char *directory,
4244 const char *console,
4245 const char *root_device, bool root_device_rw,
4246 const char *home_device, bool home_device_rw,
4247 const char *srv_device, bool srv_device_rw,
4248 bool interactive,
4249 bool secondary,
4250 int pid_socket,
4251 int kmsg_socket,
4252 int rtnl_socket,
4253 FDSet *fds,
4254 int argc,
4255 char *argv[]) {
4256
4257 pid_t pid;
4258 ssize_t l;
4259 int r;
4260
4261 assert(barrier);
4262 assert(directory);
4263 assert(console);
4264 assert(pid_socket >= 0);
4265 assert(kmsg_socket >= 0);
4266
4267 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
4268 return log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
4269
4270 if (interactive) {
4271 close_nointr(STDIN_FILENO);
4272 close_nointr(STDOUT_FILENO);
4273 close_nointr(STDERR_FILENO);
4274
4275 r = open_terminal(console, O_RDWR);
4276 if (r != STDIN_FILENO) {
4277 if (r >= 0) {
4278 safe_close(r);
4279 r = -EINVAL;
4280 }
4281
4282 return log_error_errno(r, "Failed to open console: %m");
4283 }
4284
4285 if (dup2(STDIN_FILENO, STDOUT_FILENO) != STDOUT_FILENO ||
4286 dup2(STDIN_FILENO, STDERR_FILENO) != STDERR_FILENO)
4287 return log_error_errno(errno, "Failed to duplicate console: %m");
4288 }
4289
4290 r = reset_audit_loginuid();
4291 if (r < 0)
4292 return r;
4293
4294 /* Mark everything as slave, so that we still
4295 * receive mounts from the real root, but don't
4296 * propagate mounts to the real root. */
4297 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0)
4298 return log_error_errno(errno, "MS_SLAVE|MS_REC failed: %m");
4299
4300 r = mount_devices(directory,
4301 root_device, root_device_rw,
4302 home_device, home_device_rw,
4303 srv_device, srv_device_rw);
4304 if (r < 0)
4305 return r;
4306
4307 r = determine_uid_shift(directory);
4308 if (r < 0)
4309 return r;
4310
4311 /* Turn directory into bind mount */
4312 if (mount(directory, directory, NULL, MS_BIND|MS_REC, NULL) < 0)
4313 return log_error_errno(errno, "Failed to make bind mount: %m");
4314
4315 r = setup_volatile(directory);
4316 if (r < 0)
4317 return r;
4318
4319 r = setup_volatile_state(directory);
4320 if (r < 0)
4321 return r;
4322
4323 r = base_filesystem_create(directory, arg_uid_shift, (gid_t) arg_uid_shift);
4324 if (r < 0)
4325 return r;
4326
4327 if (arg_read_only) {
4328 r = bind_remount_recursive(directory, true);
4329 if (r < 0)
4330 return log_error_errno(r, "Failed to make tree read-only: %m");
4331 }
4332
4333 r = mount_all(directory, false);
4334 if (r < 0)
4335 return r;
4336
4337 if (copy_devnodes(directory) < 0)
4338 return r;
4339
4340 dev_setup(directory, arg_uid_shift, arg_uid_shift);
4341
4342 if (setup_pts(directory) < 0)
4343 return r;
4344
4345 r = setup_propagate(directory);
4346 if (r < 0)
4347 return r;
4348
4349 r = setup_dev_console(directory, console);
4350 if (r < 0)
4351 return r;
4352
4353 r = setup_seccomp();
4354 if (r < 0)
4355 return r;
4356
4357 r = setup_timezone(directory);
4358 if (r < 0)
4359 return r;
4360
4361 r = setup_resolv_conf(directory);
4362 if (r < 0)
4363 return r;
4364
4365 r = setup_journal(directory);
4366 if (r < 0)
4367 return r;
4368
4369 r = mount_custom(directory);
4370 if (r < 0)
4371 return r;
4372
4373 r = mount_cgroup(directory);
4374 if (r < 0)
4375 return r;
4376
4377 r = mount_move_root(directory);
4378 if (r < 0)
4379 return log_error_errno(r, "Failed to move root directory: %m");
4380
4381 pid = raw_clone(SIGCHLD|CLONE_NEWNS|
4382 (arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS) |
4383 (arg_private_network ? CLONE_NEWNET : 0) |
4384 (arg_userns ? CLONE_NEWUSER : 0),
4385 NULL);
4386 if (pid < 0)
4387 return log_error_errno(errno, "Failed to fork inner child: %m");
4388
4389 if (pid == 0) {
4390 pid_socket = safe_close(pid_socket);
4391
4392 /* The inner child has all namespaces that are
4393 * requested, so that we all are owned by the user if
4394 * user namespaces are turned on. */
4395
4396 r = inner_child(barrier, directory, secondary, kmsg_socket, rtnl_socket, fds, argc, argv);
4397 if (r < 0)
4398 _exit(EXIT_FAILURE);
4399
4400 _exit(EXIT_SUCCESS);
4401 }
4402
4403 l = send(pid_socket, &pid, sizeof(pid), MSG_NOSIGNAL);
4404 if (l < 0)
4405 return log_error_errno(errno, "Failed to send PID: %m");
4406 if (l != sizeof(pid)) {
4407 log_error("Short write while sending PID.");
4408 return -EIO;
4409 }
4410
4411 pid_socket = safe_close(pid_socket);
4412
4413 return 0;
4414 }
4415
4416 static int setup_uid_map(pid_t pid) {
4417 char uid_map[strlen("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1], line[DECIMAL_STR_MAX(uid_t)*3+3+1];
4418 int r;
4419
4420 assert(pid > 1);
4421
4422 xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
4423 xsprintf(line, UID_FMT " " UID_FMT " " UID_FMT "\n", 0, arg_uid_shift, arg_uid_range);
4424 r = write_string_file(uid_map, line);
4425 if (r < 0)
4426 return log_error_errno(r, "Failed to write UID map: %m");
4427
4428 /* We always assign the same UID and GID ranges */
4429 xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
4430 r = write_string_file(uid_map, line);
4431 if (r < 0)
4432 return log_error_errno(r, "Failed to write GID map: %m");
4433
4434 return 0;
4435 }
4436
4437 static int chown_cgroup(pid_t pid) {
4438 _cleanup_free_ char *path = NULL, *fs = NULL;
4439 _cleanup_close_ int fd = -1;
4440 const char *fn;
4441 int r;
4442
4443 r = cg_pid_get_path(NULL, pid, &path);
4444 if (r < 0)
4445 return log_error_errno(r, "Failed to get container cgroup path: %m");
4446
4447 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, path, NULL, &fs);
4448 if (r < 0)
4449 return log_error_errno(r, "Failed to get file system path for container cgroup: %m");
4450
4451 fd = open(fs, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
4452 if (fd < 0)
4453 return log_error_errno(errno, "Failed to open %s: %m", fs);
4454
4455 FOREACH_STRING(fn, ".", "tasks", "notify_on_release", "cgroup.procs", "cgroup.clone_children")
4456 if (fchownat(fd, fn, arg_uid_shift, arg_uid_shift, 0) < 0)
4457 log_warning_errno(errno, "Failed to chown() cgroup file %s, ignoring: %m", fn);
4458
4459 return 0;
4460 }
4461
4462 int main(int argc, char *argv[]) {
4463
4464 _cleanup_free_ char *device_path = NULL, *root_device = NULL, *home_device = NULL, *srv_device = NULL, *console = NULL;
4465 bool root_device_rw = true, home_device_rw = true, srv_device_rw = true;
4466 _cleanup_close_ int master = -1, image_fd = -1;
4467 _cleanup_fdset_free_ FDSet *fds = NULL;
4468 int r, n_fd_passed, loop_nr = -1;
4469 char veth_name[IFNAMSIZ];
4470 bool secondary = false, remove_subvol = false;
4471 sigset_t mask_chld;
4472 pid_t pid = 0;
4473 int ret = EXIT_SUCCESS;
4474 union in_addr_union exposed = {};
4475 _cleanup_release_lock_file_ LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
4476 bool interactive;
4477
4478 log_parse_environment();
4479 log_open();
4480
4481 r = parse_argv(argc, argv);
4482 if (r <= 0)
4483 goto finish;
4484
4485 r = determine_names();
4486 if (r < 0)
4487 goto finish;
4488
4489 if (geteuid() != 0) {
4490 log_error("Need to be root.");
4491 r = -EPERM;
4492 goto finish;
4493 }
4494
4495 n_fd_passed = sd_listen_fds(false);
4496 if (n_fd_passed > 0) {
4497 r = fdset_new_listen_fds(&fds, false);
4498 if (r < 0) {
4499 log_error_errno(r, "Failed to collect file descriptors: %m");
4500 goto finish;
4501 }
4502 }
4503
4504 if (arg_directory) {
4505 assert(!arg_image);
4506
4507 if (path_equal(arg_directory, "/") && !arg_ephemeral) {
4508 log_error("Spawning container on root directory is not supported. Consider using --ephemeral.");
4509 r = -EINVAL;
4510 goto finish;
4511 }
4512
4513 if (arg_ephemeral) {
4514 _cleanup_free_ char *np = NULL;
4515
4516 /* If the specified path is a mount point we
4517 * generate the new snapshot immediately
4518 * inside it under a random name. However if
4519 * the specified is not a mount point we
4520 * create the new snapshot in the parent
4521 * directory, just next to it. */
4522 r = path_is_mount_point(arg_directory, 0);
4523 if (r < 0) {
4524 log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
4525 goto finish;
4526 }
4527 if (r > 0)
4528 r = tempfn_random_child(arg_directory, "machine.", &np);
4529 else
4530 r = tempfn_random(arg_directory, "machine.", &np);
4531 if (r < 0) {
4532 log_error_errno(r, "Failed to generate name for snapshot: %m");
4533 goto finish;
4534 }
4535
4536 r = image_path_lock(np, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
4537 if (r < 0) {
4538 log_error_errno(r, "Failed to lock %s: %m", np);
4539 goto finish;
4540 }
4541
4542 r = btrfs_subvol_snapshot(arg_directory, np, (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) | BTRFS_SNAPSHOT_FALLBACK_COPY | BTRFS_SNAPSHOT_RECURSIVE);
4543 if (r < 0) {
4544 log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
4545 goto finish;
4546 }
4547
4548 free(arg_directory);
4549 arg_directory = np;
4550 np = NULL;
4551
4552 remove_subvol = true;
4553
4554 } else {
4555 r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
4556 if (r == -EBUSY) {
4557 log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
4558 goto finish;
4559 }
4560 if (r < 0) {
4561 log_error_errno(r, "Failed to lock %s: %m", arg_directory);
4562 return r;
4563 }
4564
4565 if (arg_template) {
4566 r = btrfs_subvol_snapshot(arg_template, arg_directory, (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) | BTRFS_SNAPSHOT_FALLBACK_COPY | BTRFS_SNAPSHOT_RECURSIVE);
4567 if (r == -EEXIST) {
4568 if (!arg_quiet)
4569 log_info("Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
4570 } else if (r < 0) {
4571 log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
4572 goto finish;
4573 } else {
4574 if (!arg_quiet)
4575 log_info("Populated %s from template %s.", arg_directory, arg_template);
4576 }
4577 }
4578 }
4579
4580 if (arg_boot) {
4581 if (path_is_os_tree(arg_directory) <= 0) {
4582 log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", arg_directory);
4583 r = -EINVAL;
4584 goto finish;
4585 }
4586 } else {
4587 const char *p;
4588
4589 p = strjoina(arg_directory,
4590 argc > optind && path_is_absolute(argv[optind]) ? argv[optind] : "/usr/bin/");
4591 if (access(p, F_OK) < 0) {
4592 log_error("Directory %s lacks the binary to execute or doesn't look like a binary tree. Refusing.", arg_directory);
4593 r = -EINVAL;
4594 goto finish;
4595 }
4596 }
4597
4598 } else {
4599 char template[] = "/tmp/nspawn-root-XXXXXX";
4600
4601 assert(arg_image);
4602 assert(!arg_template);
4603
4604 r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
4605 if (r == -EBUSY) {
4606 r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
4607 goto finish;
4608 }
4609 if (r < 0) {
4610 r = log_error_errno(r, "Failed to create image lock: %m");
4611 goto finish;
4612 }
4613
4614 if (!mkdtemp(template)) {
4615 log_error_errno(errno, "Failed to create temporary directory: %m");
4616 r = -errno;
4617 goto finish;
4618 }
4619
4620 arg_directory = strdup(template);
4621 if (!arg_directory) {
4622 r = log_oom();
4623 goto finish;
4624 }
4625
4626 image_fd = setup_image(&device_path, &loop_nr);
4627 if (image_fd < 0) {
4628 r = image_fd;
4629 goto finish;
4630 }
4631
4632 r = dissect_image(image_fd,
4633 &root_device, &root_device_rw,
4634 &home_device, &home_device_rw,
4635 &srv_device, &srv_device_rw,
4636 &secondary);
4637 if (r < 0)
4638 goto finish;
4639 }
4640
4641 r = custom_mounts_prepare();
4642 if (r < 0)
4643 goto finish;
4644
4645 interactive =
4646 isatty(STDIN_FILENO) > 0 &&
4647 isatty(STDOUT_FILENO) > 0;
4648
4649 master = posix_openpt(O_RDWR|O_NOCTTY|O_CLOEXEC|O_NDELAY);
4650 if (master < 0) {
4651 r = log_error_errno(errno, "Failed to acquire pseudo tty: %m");
4652 goto finish;
4653 }
4654
4655 r = ptsname_malloc(master, &console);
4656 if (r < 0) {
4657 r = log_error_errno(r, "Failed to determine tty name: %m");
4658 goto finish;
4659 }
4660
4661 if (unlockpt(master) < 0) {
4662 r = log_error_errno(errno, "Failed to unlock tty: %m");
4663 goto finish;
4664 }
4665
4666 if (!arg_quiet)
4667 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
4668 arg_machine, arg_image ?: arg_directory);
4669
4670 assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1) >= 0);
4671
4672 assert_se(sigemptyset(&mask_chld) == 0);
4673 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
4674
4675 if (prctl(PR_SET_CHILD_SUBREAPER, 1) < 0) {
4676 r = log_error_errno(errno, "Failed to become subreaper: %m");
4677 goto finish;
4678 }
4679
4680 for (;;) {
4681 _cleanup_close_pair_ int kmsg_socket_pair[2] = { -1, -1 }, rtnl_socket_pair[2] = { -1, -1 }, pid_socket_pair[2] = { -1, -1 };
4682 ContainerStatus container_status;
4683 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
4684 static const struct sigaction sa = {
4685 .sa_handler = nop_handler,
4686 .sa_flags = SA_NOCLDSTOP,
4687 };
4688 int ifi = 0;
4689 ssize_t l;
4690 _cleanup_event_unref_ sd_event *event = NULL;
4691 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
4692 _cleanup_netlink_unref_ sd_netlink *rtnl = NULL;
4693 char last_char = 0;
4694
4695 r = barrier_create(&barrier);
4696 if (r < 0) {
4697 log_error_errno(r, "Cannot initialize IPC barrier: %m");
4698 goto finish;
4699 }
4700
4701 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0) {
4702 r = log_error_errno(errno, "Failed to create kmsg socket pair: %m");
4703 goto finish;
4704 }
4705
4706 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, rtnl_socket_pair) < 0) {
4707 r = log_error_errno(errno, "Failed to create rtnl socket pair: %m");
4708 goto finish;
4709 }
4710
4711 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, pid_socket_pair) < 0) {
4712 r = log_error_errno(errno, "Failed to create pid socket pair: %m");
4713 goto finish;
4714 }
4715
4716 /* Child can be killed before execv(), so handle SIGCHLD
4717 * in order to interrupt parent's blocking calls and
4718 * give it a chance to call wait() and terminate. */
4719 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
4720 if (r < 0) {
4721 r = log_error_errno(errno, "Failed to change the signal mask: %m");
4722 goto finish;
4723 }
4724
4725 r = sigaction(SIGCHLD, &sa, NULL);
4726 if (r < 0) {
4727 r = log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
4728 goto finish;
4729 }
4730
4731 pid = raw_clone(SIGCHLD|CLONE_NEWNS, NULL);
4732 if (pid < 0) {
4733 if (errno == EINVAL)
4734 r = log_error_errno(errno, "clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m");
4735 else
4736 r = log_error_errno(errno, "clone() failed: %m");
4737
4738 goto finish;
4739 }
4740
4741 if (pid == 0) {
4742 /* The outer child only has a file system namespace. */
4743 barrier_set_role(&barrier, BARRIER_CHILD);
4744
4745 master = safe_close(master);
4746
4747 kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
4748 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
4749 pid_socket_pair[0] = safe_close(pid_socket_pair[0]);
4750
4751 (void) reset_all_signal_handlers();
4752 (void) reset_signal_mask();
4753
4754 r = outer_child(&barrier,
4755 arg_directory,
4756 console,
4757 root_device, root_device_rw,
4758 home_device, home_device_rw,
4759 srv_device, srv_device_rw,
4760 interactive,
4761 secondary,
4762 pid_socket_pair[1],
4763 kmsg_socket_pair[1],
4764 rtnl_socket_pair[1],
4765 fds,
4766 argc, argv);
4767 if (r < 0)
4768 _exit(EXIT_FAILURE);
4769
4770 _exit(EXIT_SUCCESS);
4771 }
4772
4773 barrier_set_role(&barrier, BARRIER_PARENT);
4774
4775 fdset_free(fds);
4776 fds = NULL;
4777
4778 kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
4779 rtnl_socket_pair[1] = safe_close(rtnl_socket_pair[1]);
4780 pid_socket_pair[1] = safe_close(pid_socket_pair[1]);
4781
4782 /* Wait for the outer child. */
4783 r = wait_for_terminate_and_warn("namespace helper", pid, NULL);
4784 if (r < 0)
4785 goto finish;
4786 if (r != 0) {
4787 r = -EIO;
4788 goto finish;
4789 }
4790 pid = 0;
4791
4792 /* And now retrieve the PID of the inner child. */
4793 l = recv(pid_socket_pair[0], &pid, sizeof(pid), 0);
4794 if (l < 0) {
4795 r = log_error_errno(errno, "Failed to read inner child PID: %m");
4796 goto finish;
4797 }
4798 if (l != sizeof(pid)) {
4799 log_error("Short read while reading inner child PID: %m");
4800 r = EIO;
4801 goto finish;
4802 }
4803
4804 log_debug("Init process invoked as PID " PID_FMT, pid);
4805
4806 if (arg_userns) {
4807 if (!barrier_place_and_sync(&barrier)) { /* #1 */
4808 log_error("Child died too early.");
4809 r = -ESRCH;
4810 goto finish;
4811 }
4812
4813 r = setup_uid_map(pid);
4814 if (r < 0)
4815 goto finish;
4816
4817 (void) barrier_place(&barrier); /* #2 */
4818 }
4819
4820 r = move_network_interfaces(pid);
4821 if (r < 0)
4822 goto finish;
4823
4824 r = setup_veth(pid, veth_name, &ifi);
4825 if (r < 0)
4826 goto finish;
4827
4828 r = setup_bridge(veth_name, &ifi);
4829 if (r < 0)
4830 goto finish;
4831
4832 r = setup_macvlan(pid);
4833 if (r < 0)
4834 goto finish;
4835
4836 r = setup_ipvlan(pid);
4837 if (r < 0)
4838 goto finish;
4839
4840 r = register_machine(pid, ifi);
4841 if (r < 0)
4842 goto finish;
4843
4844 r = chown_cgroup(pid);
4845 if (r < 0)
4846 goto finish;
4847
4848 /* Notify the child that the parent is ready with all
4849 * its setup (including cgroup-ification), and that
4850 * the child can now hand over control to the code to
4851 * run inside the container. */
4852 (void) barrier_place(&barrier); /* #3 */
4853
4854 /* Block SIGCHLD here, before notifying child.
4855 * process_pty() will handle it with the other signals. */
4856 assert_se(sigprocmask(SIG_BLOCK, &mask_chld, NULL) >= 0);
4857
4858 /* Reset signal to default */
4859 r = default_signals(SIGCHLD, -1);
4860 if (r < 0) {
4861 log_error_errno(r, "Failed to reset SIGCHLD: %m");
4862 goto finish;
4863 }
4864
4865 /* Let the child know that we are ready and wait that the child is completely ready now. */
4866 if (!barrier_place_and_sync(&barrier)) { /* #5 */
4867 log_error("Client died too early.");
4868 r = -ESRCH;
4869 goto finish;
4870 }
4871
4872 sd_notifyf(false,
4873 "READY=1\n"
4874 "STATUS=Container running.\n"
4875 "X_NSPAWN_LEADER_PID=" PID_FMT, pid);
4876
4877 r = sd_event_new(&event);
4878 if (r < 0) {
4879 log_error_errno(r, "Failed to get default event source: %m");
4880 goto finish;
4881 }
4882
4883 if (arg_kill_signal > 0) {
4884 /* Try to kill the init system on SIGINT or SIGTERM */
4885 sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, UINT32_TO_PTR(pid));
4886 sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, UINT32_TO_PTR(pid));
4887 } else {
4888 /* Immediately exit */
4889 sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
4890 sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
4891 }
4892
4893 /* simply exit on sigchld */
4894 sd_event_add_signal(event, NULL, SIGCHLD, NULL, NULL);
4895
4896 if (arg_expose_ports) {
4897 r = watch_rtnl(event, rtnl_socket_pair[0], &exposed, &rtnl);
4898 if (r < 0)
4899 goto finish;
4900
4901 (void) expose_ports(rtnl, &exposed);
4902 }
4903
4904 rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
4905
4906 r = pty_forward_new(event, master, true, !interactive, &forward);
4907 if (r < 0) {
4908 log_error_errno(r, "Failed to create PTY forwarder: %m");
4909 goto finish;
4910 }
4911
4912 r = sd_event_loop(event);
4913 if (r < 0) {
4914 log_error_errno(r, "Failed to run event loop: %m");
4915 goto finish;
4916 }
4917
4918 pty_forward_get_last_char(forward, &last_char);
4919
4920 forward = pty_forward_free(forward);
4921
4922 if (!arg_quiet && last_char != '\n')
4923 putc('\n', stdout);
4924
4925 /* Kill if it is not dead yet anyway */
4926 terminate_machine(pid);
4927
4928 /* Normally redundant, but better safe than sorry */
4929 kill(pid, SIGKILL);
4930
4931 r = wait_for_container(pid, &container_status);
4932 pid = 0;
4933
4934 if (r < 0)
4935 /* We failed to wait for the container, or the
4936 * container exited abnormally */
4937 goto finish;
4938 else if (r > 0 || container_status == CONTAINER_TERMINATED){
4939 /* The container exited with a non-zero
4940 * status, or with zero status and no reboot
4941 * was requested. */
4942 ret = r;
4943 break;
4944 }
4945
4946 /* CONTAINER_REBOOTED, loop again */
4947
4948 if (arg_keep_unit) {
4949 /* Special handling if we are running as a
4950 * service: instead of simply restarting the
4951 * machine we want to restart the entire
4952 * service, so let's inform systemd about this
4953 * with the special exit code 133. The service
4954 * file uses RestartForceExitStatus=133 so
4955 * that this results in a full nspawn
4956 * restart. This is necessary since we might
4957 * have cgroup parameters set we want to have
4958 * flushed out. */
4959 ret = 133;
4960 r = 0;
4961 break;
4962 }
4963
4964 flush_ports(&exposed);
4965 }
4966
4967 finish:
4968 sd_notify(false,
4969 "STOPPING=1\n"
4970 "STATUS=Terminating...");
4971
4972 if (pid > 0)
4973 kill(pid, SIGKILL);
4974
4975 /* Try to flush whatever is still queued in the pty */
4976 if (master >= 0)
4977 (void) copy_bytes(master, STDOUT_FILENO, (off_t) -1, false);
4978
4979 loop_remove(loop_nr, &image_fd);
4980
4981 if (remove_subvol && arg_directory) {
4982 int k;
4983
4984 k = btrfs_subvol_remove(arg_directory, true);
4985 if (k < 0)
4986 log_warning_errno(k, "Cannot remove subvolume '%s', ignoring: %m", arg_directory);
4987 }
4988
4989 if (arg_machine) {
4990 const char *p;
4991
4992 p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
4993 (void) rm_rf(p, REMOVE_ROOT);
4994 }
4995
4996 free(arg_directory);
4997 free(arg_template);
4998 free(arg_image);
4999 free(arg_machine);
5000 free(arg_user);
5001 strv_free(arg_setenv);
5002 strv_free(arg_network_interfaces);
5003 strv_free(arg_network_macvlan);
5004 strv_free(arg_network_ipvlan);
5005 custom_mount_free_all();
5006
5007 flush_ports(&exposed);
5008
5009 while (arg_expose_ports) {
5010 ExposePort *p = arg_expose_ports;
5011 LIST_REMOVE(ports, arg_expose_ports, p);
5012 free(p);
5013 }
5014
5015 return r < 0 ? EXIT_FAILURE : ret;
5016 }
Unnamed repository; edit this file 'description' to name the repository.