src/shared/machine-image.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2013 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <dirent.h>
  21 #include <errno.h>
  22 #include <fcntl.h>
  23 #include <stdio.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/file.h>
  27 #include <sys/stat.h>
  28 #include <unistd.h>
  29 #include <linux/fs.h>
  30
  31 #include "alloc-util.h"
  32 #include "btrfs-util.h"
  33 #include "chattr-util.h"
  34 #include "copy.h"
  35 #include "dirent-util.h"
  36 #include "env-util.h"
  37 #include "fd-util.h"
  38 #include "fs-util.h"
  39 #include "hashmap.h"
  40 #include "lockfile-util.h"
  41 #include "log.h"
  42 #include "machine-image.h"
  43 #include "macro.h"
  44 #include "mkdir.h"
  45 #include "path-util.h"
  46 #include "rm-rf.h"
  47 #include "string-table.h"
  48 #include "string-util.h"
  49 #include "strv.h"
  50 #include "time-util.h"
  51 #include "utf8.h"
  52 #include "util.h"
  53 #include "xattr-util.h"
  54
  55 static const char image_search_path[] =
  56         "/var/lib/machines\0"
  57         "/var/lib/container\0" /* legacy */
  58         "/usr/local/lib/machines\0"
  59         "/usr/lib/machines\0";
  60
  61 Image *image_unref(Image *i) {
  62         if (!i)
  63                 return NULL;
  64
  65         free(i->name);
  66         free(i->path);
  67         return mfree(i);
  68 }
  69
  70 static char **image_settings_path(Image *image) {
  71         _cleanup_strv_free_ char **l = NULL;
  72         char **ret;
  73         const char *fn, *s;
  74         unsigned i = 0;
  75
  76         assert(image);
  77
  78         l = new0(char*, 4);
  79         if (!l)
  80                 return NULL;
  81
  82         fn = strjoina(image->name, ".nspawn");
  83
  84         FOREACH_STRING(s, "/etc/systemd/nspawn/", "/run/systemd/nspawn/") {
  85                 l[i] = strappend(s, fn);
  86                 if (!l[i])
  87                         return NULL;
  88
  89                 i++;
  90         }
  91
  92         l[i] = file_in_same_dir(image->path, fn);
  93         if (!l[i])
  94                 return NULL;
  95
  96         ret = l;
  97         l = NULL;
  98
  99         return ret;
 100 }
 101
 102 static char *image_roothash_path(Image *image) {
 103         const char *fn;
 104
 105         assert(image);
 106
 107         fn = strjoina(image->name, ".roothash");
 108
 109         return file_in_same_dir(image->path, fn);
 110 }
 111
 112 static int image_new(
 113                 ImageType t,
 114                 const char *pretty,
 115                 const char *path,
 116                 const char *filename,
 117                 bool read_only,
 118                 usec_t crtime,
 119                 usec_t mtime,
 120                 Image **ret) {
 121
 122         _cleanup_(image_unrefp) Image *i = NULL;
 123
 124         assert(t >= 0);
 125         assert(t < _IMAGE_TYPE_MAX);
 126         assert(pretty);
 127         assert(filename);
 128         assert(ret);
 129
 130         i = new0(Image, 1);
 131         if (!i)
 132                 return -ENOMEM;
 133
 134         i->type = t;
 135         i->read_only = read_only;
 136         i->crtime = crtime;
 137         i->mtime = mtime;
 138         i->usage = i->usage_exclusive = (uint64_t) -1;
 139         i->limit = i->limit_exclusive = (uint64_t) -1;
 140
 141         i->name = strdup(pretty);
 142         if (!i->name)
 143                 return -ENOMEM;
 144
 145         if (path)
 146                 i->path = strjoin(path, "/", filename);
 147         else
 148                 i->path = strdup(filename);
 149
 150         if (!i->path)
 151                 return -ENOMEM;
 152
 153         path_kill_slashes(i->path);
 154
 155         *ret = i;
 156         i = NULL;
 157
 158         return 0;
 159 }
 160
 161 static int image_make(
 162                 const char *pretty,
 163                 int dfd,
 164                 const char *path,
 165                 const char *filename,
 166                 Image **ret) {
 167
 168         struct stat st;
 169         bool read_only;
 170         int r;
 171
 172         assert(filename);
 173
 174         /* We explicitly *do* follow symlinks here, since we want to allow symlinking trees, raw files and block
 175          * devices into /var/lib/machines/, and treat them normally. */
 176
 177         if (fstatat(dfd, filename, &st, 0) < 0)
 178                 return -errno;
 179
 180         read_only =
 181                 (path && path_startswith(path, "/usr")) ||
 182                 (faccessat(dfd, filename, W_OK, AT_EACCESS) < 0 && errno == EROFS);
 183
 184         if (S_ISDIR(st.st_mode)) {
 185                 _cleanup_close_ int fd = -1;
 186                 unsigned file_attr = 0;
 187
 188                 if (!ret)
 189                         return 1;
 190
 191                 if (!pretty)
 192                         pretty = filename;
 193
 194                 fd = openat(dfd, filename, O_CLOEXEC|O_NOCTTY|O_DIRECTORY);
 195                 if (fd < 0)
 196                         return -errno;
 197
 198                 /* btrfs subvolumes have inode 256 */
 199                 if (st.st_ino == 256) {
 200
 201                         r = btrfs_is_filesystem(fd);
 202                         if (r < 0)
 203                                 return r;
 204                         if (r) {
 205                                 BtrfsSubvolInfo info;
 206
 207                                 /* It's a btrfs subvolume */
 208
 209                                 r = btrfs_subvol_get_info_fd(fd, 0, &info);
 210                                 if (r < 0)
 211                                         return r;
 212
 213                                 r = image_new(IMAGE_SUBVOLUME,
 214                                               pretty,
 215                                               path,
 216                                               filename,
 217                                               info.read_only || read_only,
 218                                               info.otime,
 219                                               0,
 220                                               ret);
 221                                 if (r < 0)
 222                                         return r;
 223
 224                                 if (btrfs_quota_scan_ongoing(fd) == 0) {
 225                                         BtrfsQuotaInfo quota;
 226
 227                                         r = btrfs_subvol_get_subtree_quota_fd(fd, 0, &quota);
 228                                         if (r >= 0) {
 229                                                 (*ret)->usage = quota.referenced;
 230                                                 (*ret)->usage_exclusive = quota.exclusive;
 231
 232                                                 (*ret)->limit = quota.referenced_max;
 233                                                 (*ret)->limit_exclusive = quota.exclusive_max;
 234                                         }
 235                                 }
 236
 237                                 return 1;
 238                         }
 239                 }
 240
 241                 /* If the IMMUTABLE bit is set, we consider the
 242                  * directory read-only. Since the ioctl is not
 243                  * supported everywhere we ignore failures. */
 244                 (void) read_attr_fd(fd, &file_attr);
 245
 246                 /* It's just a normal directory. */
 247                 r = image_new(IMAGE_DIRECTORY,
 248                               pretty,
 249                               path,
 250                               filename,
 251                               read_only || (file_attr & FS_IMMUTABLE_FL),
 252                               0,
 253                               0,
 254                               ret);
 255                 if (r < 0)
 256                         return r;
 257
 258                 return 1;
 259
 260         } else if (S_ISREG(st.st_mode) && endswith(filename, ".raw")) {
 261                 usec_t crtime = 0;
 262
 263                 /* It's a RAW disk image */
 264
 265                 if (!ret)
 266                         return 1;
 267
 268                 fd_getcrtime_at(dfd, filename, &crtime, 0);
 269
 270                 if (!pretty)
 271                         pretty = strndupa(filename, strlen(filename) - 4);
 272
 273                 r = image_new(IMAGE_RAW,
 274                               pretty,
 275                               path,
 276                               filename,
 277                               !(st.st_mode & 0222) || read_only,
 278                               crtime,
 279                               timespec_load(&st.st_mtim),
 280                               ret);
 281                 if (r < 0)
 282                         return r;
 283
 284                 (*ret)->usage = (*ret)->usage_exclusive = st.st_blocks * 512;
 285                 (*ret)->limit = (*ret)->limit_exclusive = st.st_size;
 286
 287                 return 1;
 288
 289         } else if (S_ISBLK(st.st_mode)) {
 290                 _cleanup_close_ int block_fd = -1;
 291                 uint64_t size = UINT64_MAX;
 292
 293                 /* A block device */
 294
 295                 if (!ret)
 296                         return 1;
 297
 298                 if (!pretty)
 299                         pretty = filename;
 300
 301                 block_fd = openat(dfd, filename, O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_NOCTTY);
 302                 if (block_fd < 0)
 303                         log_debug_errno(errno, "Failed to open block device %s/%s, ignoring: %m", path, filename);
 304                 else {
 305                         if (fstat(block_fd, &st) < 0)
 306                                 return -errno;
 307                         if (!S_ISBLK(st.st_mode)) /* Verify that what we opened is actually what we think it is */
 308                                 return -ENOTTY;
 309
 310                         if (!read_only) {
 311                                 int state = 0;
 312
 313                                 if (ioctl(block_fd, BLKROGET, &state) < 0)
 314                                         log_debug_errno(errno, "Failed to issue BLKROGET on device %s/%s, ignoring: %m", path, filename);
 315                                 else if (state)
 316                                         read_only = true;
 317                         }
 318
 319                         if (ioctl(block_fd, BLKGETSIZE64, &size) < 0)
 320                                 log_debug_errno(errno, "Failed to issue BLKFLSBUF on device %s/%s, ignoring: %m", path, filename);
 321
 322                         block_fd = safe_close(block_fd);
 323                 }
 324
 325                 r = image_new(IMAGE_BLOCK,
 326                               pretty,
 327                               path,
 328                               filename,
 329                               !(st.st_mode & 0222) || read_only,
 330                               0,
 331                               0,
 332                               ret);
 333                 if (r < 0)
 334                         return r;
 335
 336                 if (size != 0 && size != UINT64_MAX)
 337                         (*ret)->usage = (*ret)->usage_exclusive = (*ret)->limit = (*ret)->limit_exclusive = size;
 338
 339                 return 1;
 340         }
 341
 342         return 0;
 343 }
 344
 345 int image_find(const char *name, Image **ret) {
 346         const char *path;
 347         int r;
 348
 349         assert(name);
 350
 351         /* There are no images with invalid names */
 352         if (!image_name_is_valid(name))
 353                 return 0;
 354
 355         NULSTR_FOREACH(path, image_search_path) {
 356                 _cleanup_closedir_ DIR *d = NULL;
 357
 358                 d = opendir(path);
 359                 if (!d) {
 360                         if (errno == ENOENT)
 361                                 continue;
 362
 363                         return -errno;
 364                 }
 365
 366                 r = image_make(NULL, dirfd(d), path, name, ret);
 367                 if (IN_SET(r, 0, -ENOENT)) {
 368                         _cleanup_free_ char *raw = NULL;
 369
 370                         raw = strappend(name, ".raw");
 371                         if (!raw)
 372                                 return -ENOMEM;
 373
 374                         r = image_make(NULL, dirfd(d), path, raw, ret);
 375                         if (IN_SET(r, 0, -ENOENT))
 376                                 continue;
 377                 }
 378                 if (r < 0)
 379                         return r;
 380
 381                 return 1;
 382         }
 383
 384         if (streq(name, ".host"))
 385                 return image_make(".host", AT_FDCWD, NULL, "/", ret);
 386
 387         return 0;
 388 };
 389
 390 int image_discover(Hashmap *h) {
 391         const char *path;
 392         int r;
 393
 394         assert(h);
 395
 396         NULSTR_FOREACH(path, image_search_path) {
 397                 _cleanup_closedir_ DIR *d = NULL;
 398                 struct dirent *de;
 399
 400                 d = opendir(path);
 401                 if (!d) {
 402                         if (errno == ENOENT)
 403                                 continue;
 404
 405                         return -errno;
 406                 }
 407
 408                 FOREACH_DIRENT_ALL(de, d, return -errno) {
 409                         _cleanup_(image_unrefp) Image *image = NULL;
 410
 411                         if (!image_name_is_valid(de->d_name))
 412                                 continue;
 413
 414                         if (hashmap_contains(h, de->d_name))
 415                                 continue;
 416
 417                         r = image_make(NULL, dirfd(d), path, de->d_name, &image);
 418                         if (IN_SET(r, 0, -ENOENT))
 419                                 continue;
 420                         if (r < 0)
 421                                 return r;
 422
 423                         r = hashmap_put(h, image->name, image);
 424                         if (r < 0)
 425                                 return r;
 426
 427                         image = NULL;
 428                 }
 429         }
 430
 431         if (!hashmap_contains(h, ".host")) {
 432                 _cleanup_(image_unrefp) Image *image = NULL;
 433
 434                 r = image_make(".host", AT_FDCWD, NULL, "/", &image);
 435                 if (r < 0)
 436                         return r;
 437
 438                 r = hashmap_put(h, image->name, image);
 439                 if (r < 0)
 440                         return r;
 441
 442                 image = NULL;
 443
 444         }
 445
 446         return 0;
 447 }
 448
 449 void image_hashmap_free(Hashmap *map) {
 450         Image *i;
 451
 452         while ((i = hashmap_steal_first(map)))
 453                 image_unref(i);
 454
 455         hashmap_free(map);
 456 }
 457
 458 int image_remove(Image *i) {
 459         _cleanup_release_lock_file_ LockFile global_lock = LOCK_FILE_INIT, local_lock = LOCK_FILE_INIT;
 460         _cleanup_strv_free_ char **settings = NULL;
 461         _cleanup_free_ char *roothash = NULL;
 462         char **j;
 463         int r;
 464
 465         assert(i);
 466
 467         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 468                 return -EROFS;
 469
 470         settings = image_settings_path(i);
 471         if (!settings)
 472                 return -ENOMEM;
 473
 474         roothash = image_roothash_path(i);
 475         if (!roothash)
 476                 return -ENOMEM;
 477
 478         /* Make sure we don't interfere with a running nspawn */
 479         r = image_path_lock(i->path, LOCK_EX|LOCK_NB, &global_lock, &local_lock);
 480         if (r < 0)
 481                 return r;
 482
 483         switch (i->type) {
 484
 485         case IMAGE_SUBVOLUME:
 486
 487                 /* Let's unlink first, maybe it is a symlink? If that works we are happy. Otherwise, let's get out the
 488                  * big guns */
 489                 if (unlink(i->path) < 0) {
 490                         r = btrfs_subvol_remove(i->path, BTRFS_REMOVE_RECURSIVE|BTRFS_REMOVE_QUOTA);
 491                         if (r < 0)
 492                                 return r;
 493                 }
 494
 495                 break;
 496
 497         case IMAGE_DIRECTORY:
 498                 /* Allow deletion of read-only directories */
 499                 (void) chattr_path(i->path, 0, FS_IMMUTABLE_FL);
 500                 r = rm_rf(i->path, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
 501                 if (r < 0)
 502                         return r;
 503
 504                 break;
 505
 506         case IMAGE_BLOCK:
 507
 508                 /* If this is inside of /dev, then it's a real block device, hence let's not touch the device node
 509                  * itself (but let's remove the stuff stored alongside it). If it's anywhere else, let's try to unlink
 510                  * the thing (it's most likely a symlink after all). */
 511
 512                 if (path_startswith(i->path, "/dev"))
 513                         break;
 514
 515                 /* fallthrough */
 516
 517         case IMAGE_RAW:
 518                 if (unlink(i->path) < 0)
 519                         return -errno;
 520                 break;
 521
 522         default:
 523                 return -EOPNOTSUPP;
 524         }
 525
 526         STRV_FOREACH(j, settings) {
 527                 if (unlink(*j) < 0 && errno != ENOENT)
 528                         log_debug_errno(errno, "Failed to unlink %s, ignoring: %m", *j);
 529         }
 530
 531         if (unlink(roothash) < 0 && errno != ENOENT)
 532                 log_debug_errno(errno, "Failed to unlink %s, ignoring: %m", roothash);
 533
 534         return 0;
 535 }
 536
 537 static int rename_auxiliary_file(const char *path, const char *new_name, const char *suffix) {
 538         _cleanup_free_ char *rs = NULL;
 539         const char *fn;
 540
 541         fn = strjoina(new_name, suffix);
 542
 543         rs = file_in_same_dir(path, fn);
 544         if (!rs)
 545                 return -ENOMEM;
 546
 547         return rename_noreplace(AT_FDCWD, path, AT_FDCWD, rs);
 548 }
 549
 550 int image_rename(Image *i, const char *new_name) {
 551         _cleanup_release_lock_file_ LockFile global_lock = LOCK_FILE_INIT, local_lock = LOCK_FILE_INIT, name_lock = LOCK_FILE_INIT;
 552         _cleanup_free_ char *new_path = NULL, *nn = NULL, *roothash = NULL;
 553         _cleanup_strv_free_ char **settings = NULL;
 554         unsigned file_attr = 0;
 555         char **j;
 556         int r;
 557
 558         assert(i);
 559
 560         if (!image_name_is_valid(new_name))
 561                 return -EINVAL;
 562
 563         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 564                 return -EROFS;
 565
 566         settings = image_settings_path(i);
 567         if (!settings)
 568                 return -ENOMEM;
 569
 570         roothash = image_roothash_path(i);
 571         if (!roothash)
 572                 return -ENOMEM;
 573
 574         /* Make sure we don't interfere with a running nspawn */
 575         r = image_path_lock(i->path, LOCK_EX|LOCK_NB, &global_lock, &local_lock);
 576         if (r < 0)
 577                 return r;
 578
 579         /* Make sure nobody takes the new name, between the time we
 580          * checked it is currently unused in all search paths, and the
 581          * time we take possession of it */
 582         r = image_name_lock(new_name, LOCK_EX|LOCK_NB, &name_lock);
 583         if (r < 0)
 584                 return r;
 585
 586         r = image_find(new_name, NULL);
 587         if (r < 0)
 588                 return r;
 589         if (r > 0)
 590                 return -EEXIST;
 591
 592         switch (i->type) {
 593
 594         case IMAGE_DIRECTORY:
 595                 /* Turn of the immutable bit while we rename the image, so that we can rename it */
 596                 (void) read_attr_path(i->path, &file_attr);
 597
 598                 if (file_attr & FS_IMMUTABLE_FL)
 599                         (void) chattr_path(i->path, 0, FS_IMMUTABLE_FL);
 600
 601                 /* fall through */
 602
 603         case IMAGE_SUBVOLUME:
 604                 new_path = file_in_same_dir(i->path, new_name);
 605                 break;
 606
 607         case IMAGE_BLOCK:
 608
 609                 /* Refuse renaming raw block devices in /dev, the names are picked by udev after all. */
 610                 if (path_startswith(i->path, "/dev"))
 611                         return -EROFS;
 612
 613                 new_path = file_in_same_dir(i->path, new_name);
 614                 break;
 615
 616         case IMAGE_RAW: {
 617                 const char *fn;
 618
 619                 fn = strjoina(new_name, ".raw");
 620                 new_path = file_in_same_dir(i->path, fn);
 621                 break;
 622         }
 623
 624         default:
 625                 return -EOPNOTSUPP;
 626         }
 627
 628         if (!new_path)
 629                 return -ENOMEM;
 630
 631         nn = strdup(new_name);
 632         if (!nn)
 633                 return -ENOMEM;
 634
 635         r = rename_noreplace(AT_FDCWD, i->path, AT_FDCWD, new_path);
 636         if (r < 0)
 637                 return r;
 638
 639         /* Restore the immutable bit, if it was set before */
 640         if (file_attr & FS_IMMUTABLE_FL)
 641                 (void) chattr_path(new_path, FS_IMMUTABLE_FL, FS_IMMUTABLE_FL);
 642
 643         free(i->path);
 644         i->path = new_path;
 645         new_path = NULL;
 646
 647         free(i->name);
 648         i->name = nn;
 649         nn = NULL;
 650
 651         STRV_FOREACH(j, settings) {
 652                 r = rename_auxiliary_file(*j, new_name, ".nspawn");
 653                 if (r < 0 && r != -ENOENT)
 654                         log_debug_errno(r, "Failed to rename settings file %s, ignoring: %m", *j);
 655         }
 656
 657         r = rename_auxiliary_file(roothash, new_name, ".roothash");
 658         if (r < 0 && r != -ENOENT)
 659                 log_debug_errno(r, "Failed to rename roothash file %s, ignoring: %m", roothash);
 660
 661         return 0;
 662 }
 663
 664 static int clone_auxiliary_file(const char *path, const char *new_name, const char *suffix) {
 665         _cleanup_free_ char *rs = NULL;
 666         const char *fn;
 667
 668         fn = strjoina(new_name, suffix);
 669
 670         rs = file_in_same_dir(path, fn);
 671         if (!rs)
 672                 return -ENOMEM;
 673
 674         return copy_file_atomic(path, rs, 0664, 0, COPY_REFLINK);
 675 }
 676
 677 int image_clone(Image *i, const char *new_name, bool read_only) {
 678         _cleanup_release_lock_file_ LockFile name_lock = LOCK_FILE_INIT;
 679         _cleanup_strv_free_ char **settings = NULL;
 680         _cleanup_free_ char *roothash = NULL;
 681         const char *new_path;
 682         char **j;
 683         int r;
 684
 685         assert(i);
 686
 687         if (!image_name_is_valid(new_name))
 688                 return -EINVAL;
 689
 690         settings = image_settings_path(i);
 691         if (!settings)
 692                 return -ENOMEM;
 693
 694         roothash = image_roothash_path(i);
 695         if (!roothash)
 696                 return -ENOMEM;
 697
 698         /* Make sure nobody takes the new name, between the time we
 699          * checked it is currently unused in all search paths, and the
 700          * time we take possession of it */
 701         r = image_name_lock(new_name, LOCK_EX|LOCK_NB, &name_lock);
 702         if (r < 0)
 703                 return r;
 704
 705         r = image_find(new_name, NULL);
 706         if (r < 0)
 707                 return r;
 708         if (r > 0)
 709                 return -EEXIST;
 710
 711         switch (i->type) {
 712
 713         case IMAGE_SUBVOLUME:
 714         case IMAGE_DIRECTORY:
 715                 /* If we can we'll always try to create a new btrfs subvolume here, even if the source is a plain
 716                  * directory. */
 717
 718                 new_path = strjoina("/var/lib/machines/", new_name);
 719
 720                 r = btrfs_subvol_snapshot(i->path, new_path,
 721                                           (read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
 722                                           BTRFS_SNAPSHOT_FALLBACK_COPY |
 723                                           BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
 724                                           BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
 725                                           BTRFS_SNAPSHOT_RECURSIVE |
 726                                           BTRFS_SNAPSHOT_QUOTA);
 727                 if (r >= 0)
 728                         /* Enable "subtree" quotas for the copy, if we didn't copy any quota from the source. */
 729                         (void) btrfs_subvol_auto_qgroup(new_path, 0, true);
 730
 731                 break;
 732
 733         case IMAGE_RAW:
 734                 new_path = strjoina("/var/lib/machines/", new_name, ".raw");
 735
 736                 r = copy_file_atomic(i->path, new_path, read_only ? 0444 : 0644, FS_NOCOW_FL, COPY_REFLINK);
 737                 break;
 738
 739         case IMAGE_BLOCK:
 740         default:
 741                 return -EOPNOTSUPP;
 742         }
 743
 744         if (r < 0)
 745                 return r;
 746
 747         STRV_FOREACH(j, settings) {
 748                 r = clone_auxiliary_file(*j, new_name, ".nspawn");
 749                 if (r < 0 && r != -ENOENT)
 750                         log_debug_errno(r, "Failed to clone settings %s, ignoring: %m", *j);
 751         }
 752
 753         r = clone_auxiliary_file(roothash, new_name, ".roothash");
 754         if (r < 0 && r != -ENOENT)
 755                 log_debug_errno(r, "Failed to clone root hash file %s, ignoring: %m", roothash);
 756
 757         return 0;
 758 }
 759
 760 int image_read_only(Image *i, bool b) {
 761         _cleanup_release_lock_file_ LockFile global_lock = LOCK_FILE_INIT, local_lock = LOCK_FILE_INIT;
 762         int r;
 763         assert(i);
 764
 765         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 766                 return -EROFS;
 767
 768         /* Make sure we don't interfere with a running nspawn */
 769         r = image_path_lock(i->path, LOCK_EX|LOCK_NB, &global_lock, &local_lock);
 770         if (r < 0)
 771                 return r;
 772
 773         switch (i->type) {
 774
 775         case IMAGE_SUBVOLUME:
 776
 777                 /* Note that we set the flag only on the top-level
 778                  * subvolume of the image. */
 779
 780                 r = btrfs_subvol_set_read_only(i->path, b);
 781                 if (r < 0)
 782                         return r;
 783
 784                 break;
 785
 786         case IMAGE_DIRECTORY:
 787                 /* For simple directory trees we cannot use the access
 788                    mode of the top-level directory, since it has an
 789                    effect on the container itself.  However, we can
 790                    use the "immutable" flag, to at least make the
 791                    top-level directory read-only. It's not as good as
 792                    a read-only subvolume, but at least something, and
 793                    we can read the value back. */
 794
 795                 r = chattr_path(i->path, b ? FS_IMMUTABLE_FL : 0, FS_IMMUTABLE_FL);
 796                 if (r < 0)
 797                         return r;
 798
 799                 break;
 800
 801         case IMAGE_RAW: {
 802                 struct stat st;
 803
 804                 if (stat(i->path, &st) < 0)
 805                         return -errno;
 806
 807                 if (chmod(i->path, (st.st_mode & 0444) | (b ? 0000 : 0200)) < 0)
 808                         return -errno;
 809
 810                 /* If the images is now read-only, it's a good time to
 811                  * defrag it, given that no write patterns will
 812                  * fragment it again. */
 813                 if (b)
 814                         (void) btrfs_defrag(i->path);
 815                 break;
 816         }
 817
 818         case IMAGE_BLOCK: {
 819                 _cleanup_close_ int fd = -1;
 820                 struct stat st;
 821                 int state = b;
 822
 823                 fd = open(i->path, O_CLOEXEC|O_RDONLY|O_NONBLOCK|O_NOCTTY);
 824                 if (fd < 0)
 825                         return -errno;
 826
 827                 if (fstat(fd, &st) < 0)
 828                         return -errno;
 829                 if (!S_ISBLK(st.st_mode))
 830                         return -ENOTTY;
 831
 832                 if (ioctl(fd, BLKROSET, &state) < 0)
 833                         return -errno;
 834
 835                 break;
 836         }
 837
 838         default:
 839                 return -EOPNOTSUPP;
 840         }
 841
 842         return 0;
 843 }
 844
 845 int image_path_lock(const char *path, int operation, LockFile *global, LockFile *local) {
 846         _cleanup_free_ char *p = NULL;
 847         LockFile t = LOCK_FILE_INIT;
 848         struct stat st;
 849         int r;
 850
 851         assert(path);
 852         assert(global);
 853         assert(local);
 854
 855         /* Locks an image path. This actually creates two locks: one
 856          * "local" one, next to the image path itself, which might be
 857          * shared via NFS. And another "global" one, in /run, that
 858          * uses the device/inode number. This has the benefit that we
 859          * can even lock a tree that is a mount point, correctly. */
 860
 861         if (!path_is_absolute(path))
 862                 return -EINVAL;
 863
 864         if (getenv_bool("SYSTEMD_NSPAWN_LOCK") == 0) {
 865                 *local = *global = (LockFile) LOCK_FILE_INIT;
 866                 return 0;
 867         }
 868
 869         if (path_equal(path, "/"))
 870                 return -EBUSY;
 871
 872         if (stat(path, &st) >= 0) {
 873                 if (S_ISBLK(st.st_mode))
 874                         r = asprintf(&p, "/run/systemd/nspawn/locks/block-%u:%u", major(st.st_rdev), minor(st.st_rdev));
 875                 else if (S_ISDIR(st.st_mode) || S_ISREG(st.st_mode))
 876                         r = asprintf(&p, "/run/systemd/nspawn/locks/inode-%lu:%lu", (unsigned long) st.st_dev, (unsigned long) st.st_ino);
 877                 else
 878                         return -ENOTTY;
 879
 880                 if (r < 0)
 881                         return -ENOMEM;
 882         }
 883
 884         /* For block devices we don't need the "local" lock, as the major/minor lock above should be sufficient, since
 885          * block devices are device local anyway. */
 886         if (!path_startswith(path, "/dev")) {
 887                 r = make_lock_file_for(path, operation, &t);
 888                 if (r < 0)
 889                         return r;
 890         }
 891
 892         if (p) {
 893                 mkdir_p("/run/systemd/nspawn/locks", 0700);
 894
 895                 r = make_lock_file(p, operation, global);
 896                 if (r < 0) {
 897                         release_lock_file(&t);
 898                         return r;
 899                 }
 900         } else
 901                 *global = (LockFile) LOCK_FILE_INIT;
 902
 903         *local = t;
 904         return 0;
 905 }
 906
 907 int image_set_limit(Image *i, uint64_t referenced_max) {
 908         assert(i);
 909
 910         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 911                 return -EROFS;
 912
 913         if (i->type != IMAGE_SUBVOLUME)
 914                 return -EOPNOTSUPP;
 915
 916         /* We set the quota both for the subvolume as well as for the
 917          * subtree. The latter is mostly for historical reasons, since
 918          * we didn't use to have a concept of subtree quota, and hence
 919          * only modified the subvolume quota. */
 920
 921         (void) btrfs_qgroup_set_limit(i->path, 0, referenced_max);
 922         (void) btrfs_subvol_auto_qgroup(i->path, 0, true);
 923         return btrfs_subvol_set_subtree_quota_limit(i->path, 0, referenced_max);
 924 }
 925
 926 int image_name_lock(const char *name, int operation, LockFile *ret) {
 927         const char *p;
 928
 929         assert(name);
 930         assert(ret);
 931
 932         /* Locks an image name, regardless of the precise path used. */
 933
 934         if (!image_name_is_valid(name))
 935                 return -EINVAL;
 936
 937         if (getenv_bool("SYSTEMD_NSPAWN_LOCK") == 0) {
 938                 *ret = (LockFile) LOCK_FILE_INIT;
 939                 return 0;
 940         }
 941
 942         if (streq(name, ".host"))
 943                 return -EBUSY;
 944
 945         mkdir_p("/run/systemd/nspawn/locks", 0700);
 946         p = strjoina("/run/systemd/nspawn/locks/name-", name);
 947
 948         return make_lock_file(p, operation, ret);
 949 }
 950
 951 bool image_name_is_valid(const char *s) {
 952         if (!filename_is_valid(s))
 953                 return false;
 954
 955         if (string_has_cc(s, NULL))
 956                 return false;
 957
 958         if (!utf8_is_valid(s))
 959                 return false;
 960
 961         /* Temporary files for atomically creating new files */
 962         if (startswith(s, ".#"))
 963                 return false;
 964
 965         return true;
 966 }
 967
 968 static const char* const image_type_table[_IMAGE_TYPE_MAX] = {
 969         [IMAGE_DIRECTORY] = "directory",
 970         [IMAGE_SUBVOLUME] = "subvolume",
 971         [IMAGE_RAW] = "raw",
 972         [IMAGE_BLOCK] = "block",
 973 };
 974
 975 DEFINE_STRING_TABLE_LOOKUP(image_type, ImageType);