src/shared/machine-image.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <dirent.h>
   4 #include <errno.h>
   5 #include <fcntl.h>
   6 #include <stdio.h>
   7 #include <stdlib.h>
   8 #include <string.h>
   9 #include <sys/file.h>
  10 #include <sys/ioctl.h>
  11 #include <sys/stat.h>
  12 #include <unistd.h>
  13 #include <linux/fs.h>
  14
  15 #include "alloc-util.h"
  16 #include "btrfs-util.h"
  17 #include "chattr-util.h"
  18 #include "copy.h"
  19 #include "dirent-util.h"
  20 #include "dissect-image.h"
  21 #include "env-file.h"
  22 #include "env-util.h"
  23 #include "fd-util.h"
  24 #include "fs-util.h"
  25 #include "hashmap.h"
  26 #include "hostname-util.h"
  27 #include "id128-util.h"
  28 #include "lockfile-util.h"
  29 #include "log.h"
  30 #include "loop-util.h"
  31 #include "machine-image.h"
  32 #include "macro.h"
  33 #include "mkdir.h"
  34 #include "nulstr-util.h"
  35 #include "os-util.h"
  36 #include "path-util.h"
  37 #include "rm-rf.h"
  38 #include "string-table.h"
  39 #include "string-util.h"
  40 #include "strv.h"
  41 #include "time-util.h"
  42 #include "utf8.h"
  43 #include "xattr-util.h"
  44
  45 static const char* const image_search_path[_IMAGE_CLASS_MAX] = {
  46         [IMAGE_MACHINE] =  "/etc/machines\0"              /* only place symlinks here */
  47                            "/run/machines\0"              /* and here too */
  48                            "/var/lib/machines\0"          /* the main place for images */
  49                            "/var/lib/container\0"         /* legacy */
  50                            "/usr/local/lib/machines\0"
  51                            "/usr/lib/machines\0",
  52
  53         [IMAGE_PORTABLE] = "/etc/portables\0"             /* only place symlinks here */
  54                            "/run/portables\0"             /* and here too */
  55                            "/var/lib/portables\0"         /* the main place for images */
  56                            "/usr/local/lib/portables\0"
  57                            "/usr/lib/portables\0",
  58 };
  59
  60 static Image *image_free(Image *i) {
  61         assert(i);
  62
  63         free(i->name);
  64         free(i->path);
  65
  66         free(i->hostname);
  67         strv_free(i->machine_info);
  68         strv_free(i->os_release);
  69
  70         return mfree(i);
  71 }
  72
  73 DEFINE_TRIVIAL_REF_UNREF_FUNC(Image, image, image_free);
  74 DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(image_hash_ops, char, string_hash_func, string_compare_func,
  75                                       Image, image_unref);
  76
  77 static char **image_settings_path(Image *image) {
  78         _cleanup_strv_free_ char **l = NULL;
  79         const char *fn, *s;
  80         unsigned i = 0;
  81
  82         assert(image);
  83
  84         l = new0(char*, 4);
  85         if (!l)
  86                 return NULL;
  87
  88         fn = strjoina(image->name, ".nspawn");
  89
  90         FOREACH_STRING(s, "/etc/systemd/nspawn", "/run/systemd/nspawn") {
  91                 l[i] = path_join(s, fn);
  92                 if (!l[i])
  93                         return NULL;
  94
  95                 i++;
  96         }
  97
  98         l[i] = file_in_same_dir(image->path, fn);
  99         if (!l[i])
 100                 return NULL;
 101
 102         return TAKE_PTR(l);
 103 }
 104
 105 static char *image_roothash_path(Image *image) {
 106         const char *fn;
 107
 108         assert(image);
 109
 110         fn = strjoina(image->name, ".roothash");
 111
 112         return file_in_same_dir(image->path, fn);
 113 }
 114
 115 static int image_new(
 116                 ImageType t,
 117                 const char *pretty,
 118                 const char *path,
 119                 const char *filename,
 120                 bool read_only,
 121                 usec_t crtime,
 122                 usec_t mtime,
 123                 Image **ret) {
 124
 125         _cleanup_(image_unrefp) Image *i = NULL;
 126
 127         assert(t >= 0);
 128         assert(t < _IMAGE_TYPE_MAX);
 129         assert(pretty);
 130         assert(filename);
 131         assert(ret);
 132
 133         i = new0(Image, 1);
 134         if (!i)
 135                 return -ENOMEM;
 136
 137         i->n_ref = 1;
 138         i->type = t;
 139         i->read_only = read_only;
 140         i->crtime = crtime;
 141         i->mtime = mtime;
 142         i->usage = i->usage_exclusive = (uint64_t) -1;
 143         i->limit = i->limit_exclusive = (uint64_t) -1;
 144
 145         i->name = strdup(pretty);
 146         if (!i->name)
 147                 return -ENOMEM;
 148
 149         i->path = path_join(path, filename);
 150         if (!i->path)
 151                 return -ENOMEM;
 152
 153         path_simplify(i->path, false);
 154
 155         *ret = TAKE_PTR(i);
 156
 157         return 0;
 158 }
 159
 160 static int extract_pretty(const char *path, const char *suffix, char **ret) {
 161         _cleanup_free_ char *name = NULL;
 162         const char *p;
 163         size_t n;
 164
 165         assert(path);
 166         assert(ret);
 167
 168         p = last_path_component(path);
 169         n = strcspn(p, "/");
 170
 171         name = strndup(p, n);
 172         if (!name)
 173                 return -ENOMEM;
 174
 175         if (suffix) {
 176                 char *e;
 177
 178                 e = endswith(name, suffix);
 179                 if (!e)
 180                         return -EINVAL;
 181
 182                 *e = 0;
 183         }
 184
 185         if (!image_name_is_valid(name))
 186                 return -EINVAL;
 187
 188         *ret = TAKE_PTR(name);
 189         return 0;
 190 }
 191
 192 static int image_make(
 193                 const char *pretty,
 194                 int dfd,
 195                 const char *path,
 196                 const char *filename,
 197                 const struct stat *st,
 198                 Image **ret) {
 199
 200         _cleanup_free_ char *pretty_buffer = NULL, *parent = NULL;
 201         struct stat stbuf;
 202         bool read_only;
 203         int r;
 204
 205         assert(dfd >= 0 || dfd == AT_FDCWD);
 206         assert(path || dfd == AT_FDCWD);
 207         assert(filename);
 208
 209         /* We explicitly *do* follow symlinks here, since we want to allow symlinking trees, raw files and block
 210          * devices into /var/lib/machines/, and treat them normally.
 211          *
 212          * This function returns -ENOENT if we can't find the image after all, and -EMEDIUMTYPE if it's not a file we
 213          * recognize. */
 214
 215         if (!st) {
 216                 if (fstatat(dfd, filename, &stbuf, 0) < 0)
 217                         return -errno;
 218
 219                 st = &stbuf;
 220         }
 221
 222         if (!path) {
 223                 if (dfd == AT_FDCWD)
 224                         (void) safe_getcwd(&parent);
 225                 else
 226                         (void) fd_get_path(dfd, &parent);
 227         }
 228
 229         read_only =
 230                 (path && path_startswith(path, "/usr")) ||
 231                 (faccessat(dfd, filename, W_OK, AT_EACCESS) < 0 && errno == EROFS);
 232
 233         if (S_ISDIR(st->st_mode)) {
 234                 _cleanup_close_ int fd = -1;
 235                 unsigned file_attr = 0;
 236
 237                 if (!ret)
 238                         return 0;
 239
 240                 if (!pretty) {
 241                         r = extract_pretty(filename, NULL, &pretty_buffer);
 242                         if (r < 0)
 243                                 return r;
 244
 245                         pretty = pretty_buffer;
 246                 }
 247
 248                 fd = openat(dfd, filename, O_CLOEXEC|O_NOCTTY|O_DIRECTORY);
 249                 if (fd < 0)
 250                         return -errno;
 251
 252                 /* btrfs subvolumes have inode 256 */
 253                 if (st->st_ino == 256) {
 254
 255                         r = btrfs_is_filesystem(fd);
 256                         if (r < 0)
 257                                 return r;
 258                         if (r) {
 259                                 BtrfsSubvolInfo info;
 260
 261                                 /* It's a btrfs subvolume */
 262
 263                                 r = btrfs_subvol_get_info_fd(fd, 0, &info);
 264                                 if (r < 0)
 265                                         return r;
 266
 267                                 r = image_new(IMAGE_SUBVOLUME,
 268                                               pretty,
 269                                               path,
 270                                               filename,
 271                                               info.read_only || read_only,
 272                                               info.otime,
 273                                               0,
 274                                               ret);
 275                                 if (r < 0)
 276                                         return r;
 277
 278                                 if (btrfs_quota_scan_ongoing(fd) == 0) {
 279                                         BtrfsQuotaInfo quota;
 280
 281                                         r = btrfs_subvol_get_subtree_quota_fd(fd, 0, &quota);
 282                                         if (r >= 0) {
 283                                                 (*ret)->usage = quota.referenced;
 284                                                 (*ret)->usage_exclusive = quota.exclusive;
 285
 286                                                 (*ret)->limit = quota.referenced_max;
 287                                                 (*ret)->limit_exclusive = quota.exclusive_max;
 288                                         }
 289                                 }
 290
 291                                 return 0;
 292                         }
 293                 }
 294
 295                 /* If the IMMUTABLE bit is set, we consider the
 296                  * directory read-only. Since the ioctl is not
 297                  * supported everywhere we ignore failures. */
 298                 (void) read_attr_fd(fd, &file_attr);
 299
 300                 /* It's just a normal directory. */
 301                 r = image_new(IMAGE_DIRECTORY,
 302                               pretty,
 303                               path,
 304                               filename,
 305                               read_only || (file_attr & FS_IMMUTABLE_FL),
 306                               0,
 307                               0,
 308                               ret);
 309                 if (r < 0)
 310                         return r;
 311
 312                 return 0;
 313
 314         } else if (S_ISREG(st->st_mode) && endswith(filename, ".raw")) {
 315                 usec_t crtime = 0;
 316
 317                 /* It's a RAW disk image */
 318
 319                 if (!ret)
 320                         return 0;
 321
 322                 (void) fd_getcrtime_at(dfd, filename, &crtime, 0);
 323
 324                 if (!pretty) {
 325                         r = extract_pretty(filename, ".raw", &pretty_buffer);
 326                         if (r < 0)
 327                                 return r;
 328
 329                         pretty = pretty_buffer;
 330                 }
 331
 332                 r = image_new(IMAGE_RAW,
 333                               pretty,
 334                               path,
 335                               filename,
 336                               !(st->st_mode & 0222) || read_only,
 337                               crtime,
 338                               timespec_load(&st->st_mtim),
 339                               ret);
 340                 if (r < 0)
 341                         return r;
 342
 343                 (*ret)->usage = (*ret)->usage_exclusive = st->st_blocks * 512;
 344                 (*ret)->limit = (*ret)->limit_exclusive = st->st_size;
 345
 346                 return 0;
 347
 348         } else if (S_ISBLK(st->st_mode)) {
 349                 _cleanup_close_ int block_fd = -1;
 350                 uint64_t size = UINT64_MAX;
 351
 352                 /* A block device */
 353
 354                 if (!ret)
 355                         return 0;
 356
 357                 if (!pretty) {
 358                         r = extract_pretty(filename, NULL, &pretty_buffer);
 359                         if (r < 0)
 360                                 return r;
 361
 362                         pretty = pretty_buffer;
 363                 }
 364
 365                 block_fd = openat(dfd, filename, O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_NOCTTY);
 366                 if (block_fd < 0)
 367                         log_debug_errno(errno, "Failed to open block device %s/%s, ignoring: %m", path ?: strnull(parent), filename);
 368                 else {
 369                         /* Refresh stat data after opening the node */
 370                         if (fstat(block_fd, &stbuf) < 0)
 371                                 return -errno;
 372                         st = &stbuf;
 373
 374                         if (!S_ISBLK(st->st_mode)) /* Verify that what we opened is actually what we think it is */
 375                                 return -ENOTTY;
 376
 377                         if (!read_only) {
 378                                 int state = 0;
 379
 380                                 if (ioctl(block_fd, BLKROGET, &state) < 0)
 381                                         log_debug_errno(errno, "Failed to issue BLKROGET on device %s/%s, ignoring: %m", path ?: strnull(parent), filename);
 382                                 else if (state)
 383                                         read_only = true;
 384                         }
 385
 386                         if (ioctl(block_fd, BLKGETSIZE64, &size) < 0)
 387                                 log_debug_errno(errno, "Failed to issue BLKGETSIZE64 on device %s/%s, ignoring: %m", path ?: strnull(parent), filename);
 388
 389                         block_fd = safe_close(block_fd);
 390                 }
 391
 392                 r = image_new(IMAGE_BLOCK,
 393                               pretty,
 394                               path,
 395                               filename,
 396                               !(st->st_mode & 0222) || read_only,
 397                               0,
 398                               0,
 399                               ret);
 400                 if (r < 0)
 401                         return r;
 402
 403                 if (!IN_SET(size, 0, UINT64_MAX))
 404                         (*ret)->usage = (*ret)->usage_exclusive = (*ret)->limit = (*ret)->limit_exclusive = size;
 405
 406                 return 0;
 407         }
 408
 409         return -EMEDIUMTYPE;
 410 }
 411
 412 int image_find(ImageClass class, const char *name, Image **ret) {
 413         const char *path;
 414         int r;
 415
 416         assert(class >= 0);
 417         assert(class < _IMAGE_CLASS_MAX);
 418         assert(name);
 419
 420         /* There are no images with invalid names */
 421         if (!image_name_is_valid(name))
 422                 return -ENOENT;
 423
 424         NULSTR_FOREACH(path, image_search_path[class]) {
 425                 _cleanup_closedir_ DIR *d = NULL;
 426                 struct stat st;
 427
 428                 d = opendir(path);
 429                 if (!d) {
 430                         if (errno == ENOENT)
 431                                 continue;
 432
 433                         return -errno;
 434                 }
 435
 436                 /* As mentioned above, we follow symlinks on this fstatat(), because we want to permit people to
 437                  * symlink block devices into the search path */
 438                 if (fstatat(dirfd(d), name, &st, 0) < 0) {
 439                         _cleanup_free_ char *raw = NULL;
 440
 441                         if (errno != ENOENT)
 442                                 return -errno;
 443
 444                         raw = strjoin(name, ".raw");
 445                         if (!raw)
 446                                 return -ENOMEM;
 447
 448                         if (fstatat(dirfd(d), raw, &st, 0) < 0) {
 449
 450                                 if (errno == ENOENT)
 451                                         continue;
 452
 453                                 return -errno;
 454                         }
 455
 456                         if (!S_ISREG(st.st_mode))
 457                                 continue;
 458
 459                         r = image_make(name, dirfd(d), path, raw, &st, ret);
 460
 461                 } else {
 462                         if (!S_ISDIR(st.st_mode) && !S_ISBLK(st.st_mode))
 463                                 continue;
 464
 465                         r = image_make(name, dirfd(d), path, name, &st, ret);
 466                 }
 467                 if (IN_SET(r, -ENOENT, -EMEDIUMTYPE))
 468                         continue;
 469                 if (r < 0)
 470                         return r;
 471
 472                 if (ret)
 473                         (*ret)->discoverable = true;
 474
 475                 return 1;
 476         }
 477
 478         if (class == IMAGE_MACHINE && streq(name, ".host")) {
 479                 r = image_make(".host", AT_FDCWD, NULL, "/", NULL, ret);
 480                 if (r < 0)
 481                         return r;
 482
 483                 if (ret)
 484                         (*ret)->discoverable = true;
 485
 486                 return r;
 487         }
 488
 489         return -ENOENT;
 490 };
 491
 492 int image_from_path(const char *path, Image **ret) {
 493
 494         /* Note that we don't set the 'discoverable' field of the returned object, because we don't check here whether
 495          * the image is in the image search path. And if it is we don't know if the path we used is actually not
 496          * overridden by another, different image earlier in the search path */
 497
 498         if (path_equal(path, "/"))
 499                 return image_make(".host", AT_FDCWD, NULL, "/", NULL, ret);
 500
 501         return image_make(NULL, AT_FDCWD, NULL, path, NULL, ret);
 502 }
 503
 504 int image_find_harder(ImageClass class, const char *name_or_path, Image **ret) {
 505         if (image_name_is_valid(name_or_path))
 506                 return image_find(class, name_or_path, ret);
 507
 508         return image_from_path(name_or_path, ret);
 509 }
 510
 511 int image_discover(ImageClass class, Hashmap *h) {
 512         const char *path;
 513         int r;
 514
 515         assert(class >= 0);
 516         assert(class < _IMAGE_CLASS_MAX);
 517         assert(h);
 518
 519         NULSTR_FOREACH(path, image_search_path[class]) {
 520                 _cleanup_closedir_ DIR *d = NULL;
 521                 struct dirent *de;
 522
 523                 d = opendir(path);
 524                 if (!d) {
 525                         if (errno == ENOENT)
 526                                 continue;
 527
 528                         return -errno;
 529                 }
 530
 531                 FOREACH_DIRENT_ALL(de, d, return -errno) {
 532                         _cleanup_(image_unrefp) Image *image = NULL;
 533                         _cleanup_free_ char *truncated = NULL;
 534                         const char *pretty;
 535                         struct stat st;
 536
 537                         if (dot_or_dot_dot(de->d_name))
 538                                 continue;
 539
 540                         /* As mentioned above, we follow symlinks on this fstatat(), because we want to permit people
 541                          * to symlink block devices into the search path */
 542                         if (fstatat(dirfd(d), de->d_name, &st, 0) < 0) {
 543                                 if (errno == ENOENT)
 544                                         continue;
 545
 546                                 return -errno;
 547                         }
 548
 549                         if (S_ISREG(st.st_mode)) {
 550                                 const char *e;
 551
 552                                 e = endswith(de->d_name, ".raw");
 553                                 if (!e)
 554                                         continue;
 555
 556                                 truncated = strndup(de->d_name, e - de->d_name);
 557                                 if (!truncated)
 558                                         return -ENOMEM;
 559
 560                                 pretty = truncated;
 561                         } else if (S_ISDIR(st.st_mode) || S_ISBLK(st.st_mode))
 562                                 pretty = de->d_name;
 563                         else
 564                                 continue;
 565
 566                         if (!image_name_is_valid(pretty))
 567                                 continue;
 568
 569                         if (hashmap_contains(h, pretty))
 570                                 continue;
 571
 572                         r = image_make(pretty, dirfd(d), path, de->d_name, &st, &image);
 573                         if (IN_SET(r, -ENOENT, -EMEDIUMTYPE))
 574                                 continue;
 575                         if (r < 0)
 576                                 return r;
 577
 578                         image->discoverable = true;
 579
 580                         r = hashmap_put(h, image->name, image);
 581                         if (r < 0)
 582                                 return r;
 583
 584                         image = NULL;
 585                 }
 586         }
 587
 588         if (class == IMAGE_MACHINE && !hashmap_contains(h, ".host")) {
 589                 _cleanup_(image_unrefp) Image *image = NULL;
 590
 591                 r = image_make(".host", AT_FDCWD, NULL, "/", NULL, &image);
 592                 if (r < 0)
 593                         return r;
 594
 595                 image->discoverable = true;
 596
 597                 r = hashmap_put(h, image->name, image);
 598                 if (r < 0)
 599                         return r;
 600
 601                 image = NULL;
 602         }
 603
 604         return 0;
 605 }
 606
 607 int image_remove(Image *i) {
 608         _cleanup_(release_lock_file) LockFile global_lock = LOCK_FILE_INIT, local_lock = LOCK_FILE_INIT;
 609         _cleanup_strv_free_ char **settings = NULL;
 610         _cleanup_free_ char *roothash = NULL;
 611         char **j;
 612         int r;
 613
 614         assert(i);
 615
 616         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 617                 return -EROFS;
 618
 619         settings = image_settings_path(i);
 620         if (!settings)
 621                 return -ENOMEM;
 622
 623         roothash = image_roothash_path(i);
 624         if (!roothash)
 625                 return -ENOMEM;
 626
 627         /* Make sure we don't interfere with a running nspawn */
 628         r = image_path_lock(i->path, LOCK_EX|LOCK_NB, &global_lock, &local_lock);
 629         if (r < 0)
 630                 return r;
 631
 632         switch (i->type) {
 633
 634         case IMAGE_SUBVOLUME:
 635
 636                 /* Let's unlink first, maybe it is a symlink? If that works we are happy. Otherwise, let's get out the
 637                  * big guns */
 638                 if (unlink(i->path) < 0) {
 639                         r = btrfs_subvol_remove(i->path, BTRFS_REMOVE_RECURSIVE|BTRFS_REMOVE_QUOTA);
 640                         if (r < 0)
 641                                 return r;
 642                 }
 643
 644                 break;
 645
 646         case IMAGE_DIRECTORY:
 647                 /* Allow deletion of read-only directories */
 648                 (void) chattr_path(i->path, 0, FS_IMMUTABLE_FL, NULL);
 649                 r = rm_rf(i->path, REMOVE_ROOT|REMOVE_PHYSICAL|REMOVE_SUBVOLUME);
 650                 if (r < 0)
 651                         return r;
 652
 653                 break;
 654
 655         case IMAGE_BLOCK:
 656
 657                 /* If this is inside of /dev, then it's a real block device, hence let's not touch the device node
 658                  * itself (but let's remove the stuff stored alongside it). If it's anywhere else, let's try to unlink
 659                  * the thing (it's most likely a symlink after all). */
 660
 661                 if (path_startswith(i->path, "/dev"))
 662                         break;
 663
 664                 _fallthrough_;
 665         case IMAGE_RAW:
 666                 if (unlink(i->path) < 0)
 667                         return -errno;
 668                 break;
 669
 670         default:
 671                 return -EOPNOTSUPP;
 672         }
 673
 674         STRV_FOREACH(j, settings) {
 675                 if (unlink(*j) < 0 && errno != ENOENT)
 676                         log_debug_errno(errno, "Failed to unlink %s, ignoring: %m", *j);
 677         }
 678
 679         if (unlink(roothash) < 0 && errno != ENOENT)
 680                 log_debug_errno(errno, "Failed to unlink %s, ignoring: %m", roothash);
 681
 682         return 0;
 683 }
 684
 685 static int rename_auxiliary_file(const char *path, const char *new_name, const char *suffix) {
 686         _cleanup_free_ char *rs = NULL;
 687         const char *fn;
 688
 689         fn = strjoina(new_name, suffix);
 690
 691         rs = file_in_same_dir(path, fn);
 692         if (!rs)
 693                 return -ENOMEM;
 694
 695         return rename_noreplace(AT_FDCWD, path, AT_FDCWD, rs);
 696 }
 697
 698 int image_rename(Image *i, const char *new_name) {
 699         _cleanup_(release_lock_file) LockFile global_lock = LOCK_FILE_INIT, local_lock = LOCK_FILE_INIT, name_lock = LOCK_FILE_INIT;
 700         _cleanup_free_ char *new_path = NULL, *nn = NULL, *roothash = NULL;
 701         _cleanup_strv_free_ char **settings = NULL;
 702         unsigned file_attr = 0;
 703         char **j;
 704         int r;
 705
 706         assert(i);
 707
 708         if (!image_name_is_valid(new_name))
 709                 return -EINVAL;
 710
 711         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 712                 return -EROFS;
 713
 714         settings = image_settings_path(i);
 715         if (!settings)
 716                 return -ENOMEM;
 717
 718         roothash = image_roothash_path(i);
 719         if (!roothash)
 720                 return -ENOMEM;
 721
 722         /* Make sure we don't interfere with a running nspawn */
 723         r = image_path_lock(i->path, LOCK_EX|LOCK_NB, &global_lock, &local_lock);
 724         if (r < 0)
 725                 return r;
 726
 727         /* Make sure nobody takes the new name, between the time we
 728          * checked it is currently unused in all search paths, and the
 729          * time we take possession of it */
 730         r = image_name_lock(new_name, LOCK_EX|LOCK_NB, &name_lock);
 731         if (r < 0)
 732                 return r;
 733
 734         r = image_find(IMAGE_MACHINE, new_name, NULL);
 735         if (r >= 0)
 736                 return -EEXIST;
 737         if (r != -ENOENT)
 738                 return r;
 739
 740         switch (i->type) {
 741
 742         case IMAGE_DIRECTORY:
 743                 /* Turn of the immutable bit while we rename the image, so that we can rename it */
 744                 (void) read_attr_path(i->path, &file_attr);
 745
 746                 if (file_attr & FS_IMMUTABLE_FL)
 747                         (void) chattr_path(i->path, 0, FS_IMMUTABLE_FL, NULL);
 748
 749                 _fallthrough_;
 750         case IMAGE_SUBVOLUME:
 751                 new_path = file_in_same_dir(i->path, new_name);
 752                 break;
 753
 754         case IMAGE_BLOCK:
 755
 756                 /* Refuse renaming raw block devices in /dev, the names are picked by udev after all. */
 757                 if (path_startswith(i->path, "/dev"))
 758                         return -EROFS;
 759
 760                 new_path = file_in_same_dir(i->path, new_name);
 761                 break;
 762
 763         case IMAGE_RAW: {
 764                 const char *fn;
 765
 766                 fn = strjoina(new_name, ".raw");
 767                 new_path = file_in_same_dir(i->path, fn);
 768                 break;
 769         }
 770
 771         default:
 772                 return -EOPNOTSUPP;
 773         }
 774
 775         if (!new_path)
 776                 return -ENOMEM;
 777
 778         nn = strdup(new_name);
 779         if (!nn)
 780                 return -ENOMEM;
 781
 782         r = rename_noreplace(AT_FDCWD, i->path, AT_FDCWD, new_path);
 783         if (r < 0)
 784                 return r;
 785
 786         /* Restore the immutable bit, if it was set before */
 787         if (file_attr & FS_IMMUTABLE_FL)
 788                 (void) chattr_path(new_path, FS_IMMUTABLE_FL, FS_IMMUTABLE_FL, NULL);
 789
 790         free_and_replace(i->path, new_path);
 791         free_and_replace(i->name, nn);
 792
 793         STRV_FOREACH(j, settings) {
 794                 r = rename_auxiliary_file(*j, new_name, ".nspawn");
 795                 if (r < 0 && r != -ENOENT)
 796                         log_debug_errno(r, "Failed to rename settings file %s, ignoring: %m", *j);
 797         }
 798
 799         r = rename_auxiliary_file(roothash, new_name, ".roothash");
 800         if (r < 0 && r != -ENOENT)
 801                 log_debug_errno(r, "Failed to rename roothash file %s, ignoring: %m", roothash);
 802
 803         return 0;
 804 }
 805
 806 static int clone_auxiliary_file(const char *path, const char *new_name, const char *suffix) {
 807         _cleanup_free_ char *rs = NULL;
 808         const char *fn;
 809
 810         fn = strjoina(new_name, suffix);
 811
 812         rs = file_in_same_dir(path, fn);
 813         if (!rs)
 814                 return -ENOMEM;
 815
 816         return copy_file_atomic(path, rs, 0664, 0, 0, COPY_REFLINK);
 817 }
 818
 819 int image_clone(Image *i, const char *new_name, bool read_only) {
 820         _cleanup_(release_lock_file) LockFile name_lock = LOCK_FILE_INIT;
 821         _cleanup_strv_free_ char **settings = NULL;
 822         _cleanup_free_ char *roothash = NULL;
 823         const char *new_path;
 824         char **j;
 825         int r;
 826
 827         assert(i);
 828
 829         if (!image_name_is_valid(new_name))
 830                 return -EINVAL;
 831
 832         settings = image_settings_path(i);
 833         if (!settings)
 834                 return -ENOMEM;
 835
 836         roothash = image_roothash_path(i);
 837         if (!roothash)
 838                 return -ENOMEM;
 839
 840         /* Make sure nobody takes the new name, between the time we
 841          * checked it is currently unused in all search paths, and the
 842          * time we take possession of it */
 843         r = image_name_lock(new_name, LOCK_EX|LOCK_NB, &name_lock);
 844         if (r < 0)
 845                 return r;
 846
 847         r = image_find(IMAGE_MACHINE, new_name, NULL);
 848         if (r >= 0)
 849                 return -EEXIST;
 850         if (r != -ENOENT)
 851                 return r;
 852
 853         switch (i->type) {
 854
 855         case IMAGE_SUBVOLUME:
 856         case IMAGE_DIRECTORY:
 857                 /* If we can we'll always try to create a new btrfs subvolume here, even if the source is a plain
 858                  * directory. */
 859
 860                 new_path = strjoina("/var/lib/machines/", new_name);
 861
 862                 r = btrfs_subvol_snapshot(i->path, new_path,
 863                                           (read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) |
 864                                           BTRFS_SNAPSHOT_FALLBACK_COPY |
 865                                           BTRFS_SNAPSHOT_FALLBACK_DIRECTORY |
 866                                           BTRFS_SNAPSHOT_FALLBACK_IMMUTABLE |
 867                                           BTRFS_SNAPSHOT_RECURSIVE |
 868                                           BTRFS_SNAPSHOT_QUOTA);
 869                 if (r >= 0)
 870                         /* Enable "subtree" quotas for the copy, if we didn't copy any quota from the source. */
 871                         (void) btrfs_subvol_auto_qgroup(new_path, 0, true);
 872
 873                 break;
 874
 875         case IMAGE_RAW:
 876                 new_path = strjoina("/var/lib/machines/", new_name, ".raw");
 877
 878                 r = copy_file_atomic(i->path, new_path, read_only ? 0444 : 0644, FS_NOCOW_FL, FS_NOCOW_FL, COPY_REFLINK|COPY_CRTIME);
 879                 break;
 880
 881         case IMAGE_BLOCK:
 882         default:
 883                 return -EOPNOTSUPP;
 884         }
 885
 886         if (r < 0)
 887                 return r;
 888
 889         STRV_FOREACH(j, settings) {
 890                 r = clone_auxiliary_file(*j, new_name, ".nspawn");
 891                 if (r < 0 && r != -ENOENT)
 892                         log_debug_errno(r, "Failed to clone settings %s, ignoring: %m", *j);
 893         }
 894
 895         r = clone_auxiliary_file(roothash, new_name, ".roothash");
 896         if (r < 0 && r != -ENOENT)
 897                 log_debug_errno(r, "Failed to clone root hash file %s, ignoring: %m", roothash);
 898
 899         return 0;
 900 }
 901
 902 int image_read_only(Image *i, bool b) {
 903         _cleanup_(release_lock_file) LockFile global_lock = LOCK_FILE_INIT, local_lock = LOCK_FILE_INIT;
 904         int r;
 905
 906         assert(i);
 907
 908         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
 909                 return -EROFS;
 910
 911         /* Make sure we don't interfere with a running nspawn */
 912         r = image_path_lock(i->path, LOCK_EX|LOCK_NB, &global_lock, &local_lock);
 913         if (r < 0)
 914                 return r;
 915
 916         switch (i->type) {
 917
 918         case IMAGE_SUBVOLUME:
 919
 920                 /* Note that we set the flag only on the top-level
 921                  * subvolume of the image. */
 922
 923                 r = btrfs_subvol_set_read_only(i->path, b);
 924                 if (r < 0)
 925                         return r;
 926
 927                 break;
 928
 929         case IMAGE_DIRECTORY:
 930                 /* For simple directory trees we cannot use the access
 931                    mode of the top-level directory, since it has an
 932                    effect on the container itself.  However, we can
 933                    use the "immutable" flag, to at least make the
 934                    top-level directory read-only. It's not as good as
 935                    a read-only subvolume, but at least something, and
 936                    we can read the value back. */
 937
 938                 r = chattr_path(i->path, b ? FS_IMMUTABLE_FL : 0, FS_IMMUTABLE_FL, NULL);
 939                 if (r < 0)
 940                         return r;
 941
 942                 break;
 943
 944         case IMAGE_RAW: {
 945                 struct stat st;
 946
 947                 if (stat(i->path, &st) < 0)
 948                         return -errno;
 949
 950                 if (chmod(i->path, (st.st_mode & 0444) | (b ? 0000 : 0200)) < 0)
 951                         return -errno;
 952
 953                 /* If the images is now read-only, it's a good time to
 954                  * defrag it, given that no write patterns will
 955                  * fragment it again. */
 956                 if (b)
 957                         (void) btrfs_defrag(i->path);
 958                 break;
 959         }
 960
 961         case IMAGE_BLOCK: {
 962                 _cleanup_close_ int fd = -1;
 963                 struct stat st;
 964                 int state = b;
 965
 966                 fd = open(i->path, O_CLOEXEC|O_RDONLY|O_NONBLOCK|O_NOCTTY);
 967                 if (fd < 0)
 968                         return -errno;
 969
 970                 if (fstat(fd, &st) < 0)
 971                         return -errno;
 972                 if (!S_ISBLK(st.st_mode))
 973                         return -ENOTTY;
 974
 975                 if (ioctl(fd, BLKROSET, &state) < 0)
 976                         return -errno;
 977
 978                 break;
 979         }
 980
 981         default:
 982                 return -EOPNOTSUPP;
 983         }
 984
 985         return 0;
 986 }
 987
 988 int image_path_lock(const char *path, int operation, LockFile *global, LockFile *local) {
 989         _cleanup_free_ char *p = NULL;
 990         LockFile t = LOCK_FILE_INIT;
 991         struct stat st;
 992         bool exclusive;
 993         int r;
 994
 995         assert(path);
 996         assert(global);
 997         assert(local);
 998
 999         /* Locks an image path. This actually creates two locks: one "local" one, next to the image path
1000          * itself, which might be shared via NFS. And another "global" one, in /run, that uses the
1001          * device/inode number. This has the benefit that we can even lock a tree that is a mount point,
1002          * correctly. */
1003
1004         if (!path_is_absolute(path))
1005                 return -EINVAL;
1006
1007         switch (operation & (LOCK_SH|LOCK_EX)) {
1008         case LOCK_SH:
1009                 exclusive = false;
1010                 break;
1011         case LOCK_EX:
1012                 exclusive = true;
1013                 break;
1014         default:
1015                 return -EINVAL;
1016         }
1017
1018         if (getenv_bool("SYSTEMD_NSPAWN_LOCK") == 0) {
1019                 *local = *global = (LockFile) LOCK_FILE_INIT;
1020                 return 0;
1021         }
1022
1023         /* Prohibit taking exclusive locks on the host image. We can't allow this, since we ourselves are
1024          * running off it after all, and we don't want any images to manipulate the host image. We make an
1025          * exception for shared locks however: we allow those (and make them NOPs since there's no point in
1026          * taking them if there can't be exclusive locks). Strictly speaking these are questionable as well,
1027          * since it means changes made to the host might propagate to the container as they happen (and a
1028          * shared lock kinda suggests that no changes happen at all while it is in place), but it's too
1029          * useful not to allow read-only containers off the host root, hence let's support this, and trust
1030          * the user to do the right thing with this. */
1031         if (path_equal(path, "/")) {
1032                 if (exclusive)
1033                         return -EBUSY;
1034
1035                 *local = *global = (LockFile) LOCK_FILE_INIT;
1036                 return 0;
1037         }
1038
1039         if (stat(path, &st) >= 0) {
1040                 if (S_ISBLK(st.st_mode))
1041                         r = asprintf(&p, "/run/systemd/nspawn/locks/block-%u:%u", major(st.st_rdev), minor(st.st_rdev));
1042                 else if (S_ISDIR(st.st_mode) || S_ISREG(st.st_mode))
1043                         r = asprintf(&p, "/run/systemd/nspawn/locks/inode-%lu:%lu", (unsigned long) st.st_dev, (unsigned long) st.st_ino);
1044                 else
1045                         return -ENOTTY;
1046
1047                 if (r < 0)
1048                         return -ENOMEM;
1049         }
1050
1051         /* For block devices we don't need the "local" lock, as the major/minor lock above should be
1052          * sufficient, since block devices are host local anyway. */
1053         if (!path_startswith(path, "/dev/")) {
1054                 r = make_lock_file_for(path, operation, &t);
1055                 if (r < 0) {
1056                         if (!exclusive && r == -EROFS)
1057                                 log_debug_errno(r, "Failed to create shared lock for '%s', ignoring: %m", path);
1058                         else
1059                                 return r;
1060                 }
1061         }
1062
1063         if (p) {
1064                 (void) mkdir_p("/run/systemd/nspawn/locks", 0700);
1065
1066                 r = make_lock_file(p, operation, global);
1067                 if (r < 0) {
1068                         release_lock_file(&t);
1069                         return r;
1070                 }
1071         } else
1072                 *global = (LockFile) LOCK_FILE_INIT;
1073
1074         *local = t;
1075         return 0;
1076 }
1077
1078 int image_set_limit(Image *i, uint64_t referenced_max) {
1079         assert(i);
1080
1081         if (IMAGE_IS_VENDOR(i) || IMAGE_IS_HOST(i))
1082                 return -EROFS;
1083
1084         if (i->type != IMAGE_SUBVOLUME)
1085                 return -EOPNOTSUPP;
1086
1087         /* We set the quota both for the subvolume as well as for the
1088          * subtree. The latter is mostly for historical reasons, since
1089          * we didn't use to have a concept of subtree quota, and hence
1090          * only modified the subvolume quota. */
1091
1092         (void) btrfs_qgroup_set_limit(i->path, 0, referenced_max);
1093         (void) btrfs_subvol_auto_qgroup(i->path, 0, true);
1094         return btrfs_subvol_set_subtree_quota_limit(i->path, 0, referenced_max);
1095 }
1096
1097 int image_read_metadata(Image *i) {
1098         _cleanup_(release_lock_file) LockFile global_lock = LOCK_FILE_INIT, local_lock = LOCK_FILE_INIT;
1099         int r;
1100
1101         assert(i);
1102
1103         r = image_path_lock(i->path, LOCK_SH|LOCK_NB, &global_lock, &local_lock);
1104         if (r < 0)
1105                 return r;
1106
1107         switch (i->type) {
1108
1109         case IMAGE_SUBVOLUME:
1110         case IMAGE_DIRECTORY: {
1111                 _cleanup_strv_free_ char **machine_info = NULL, **os_release = NULL;
1112                 sd_id128_t machine_id = SD_ID128_NULL;
1113                 _cleanup_free_ char *hostname = NULL;
1114                 _cleanup_free_ char *path = NULL;
1115
1116                 r = chase_symlinks("/etc/hostname", i->path, CHASE_PREFIX_ROOT|CHASE_TRAIL_SLASH, &path);
1117                 if (r < 0 && r != -ENOENT)
1118                         log_debug_errno(r, "Failed to chase /etc/hostname in image %s: %m", i->name);
1119                 else if (r >= 0) {
1120                         r = read_etc_hostname(path, &hostname);
1121                         if (r < 0)
1122                                 log_debug_errno(errno, "Failed to read /etc/hostname of image %s: %m", i->name);
1123                 }
1124
1125                 path = mfree(path);
1126
1127                 r = chase_symlinks("/etc/machine-id", i->path, CHASE_PREFIX_ROOT|CHASE_TRAIL_SLASH, &path);
1128                 if (r < 0 && r != -ENOENT)
1129                         log_debug_errno(r, "Failed to chase /etc/machine-id in image %s: %m", i->name);
1130                 else if (r >= 0) {
1131                         _cleanup_close_ int fd = -1;
1132
1133                         fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY);
1134                         if (fd < 0)
1135                                 log_debug_errno(errno, "Failed to open %s: %m", path);
1136                         else {
1137                                 r = id128_read_fd(fd, ID128_PLAIN, &machine_id);
1138                                 if (r < 0)
1139                                         log_debug_errno(r, "Image %s contains invalid machine ID.", i->name);
1140                         }
1141                 }
1142
1143                 path = mfree(path);
1144
1145                 r = chase_symlinks("/etc/machine-info", i->path, CHASE_PREFIX_ROOT|CHASE_TRAIL_SLASH, &path);
1146                 if (r < 0 && r != -ENOENT)
1147                         log_debug_errno(r, "Failed to chase /etc/machine-info in image %s: %m", i->name);
1148                 else if (r >= 0) {
1149                         r = load_env_file_pairs(NULL, path, &machine_info);
1150                         if (r < 0)
1151                                 log_debug_errno(r, "Failed to parse machine-info data of %s: %m", i->name);
1152                 }
1153
1154                 r = load_os_release_pairs(i->path, &os_release);
1155                 if (r < 0)
1156                         log_debug_errno(r, "Failed to read os-release in image, ignoring: %m");
1157
1158                 free_and_replace(i->hostname, hostname);
1159                 i->machine_id = machine_id;
1160                 strv_free_and_replace(i->machine_info, machine_info);
1161                 strv_free_and_replace(i->os_release, os_release);
1162
1163                 break;
1164         }
1165
1166         case IMAGE_RAW:
1167         case IMAGE_BLOCK: {
1168                 _cleanup_(loop_device_unrefp) LoopDevice *d = NULL;
1169                 _cleanup_(dissected_image_unrefp) DissectedImage *m = NULL;
1170
1171                 r = loop_device_make_by_path(i->path, O_RDONLY, &d);
1172                 if (r < 0)
1173                         return r;
1174
1175                 r = dissect_image(d->fd, NULL, 0, DISSECT_IMAGE_REQUIRE_ROOT, &m);
1176                 if (r < 0)
1177                         return r;
1178
1179                 r = dissected_image_acquire_metadata(m);
1180                 if (r < 0)
1181                         return r;
1182
1183                 free_and_replace(i->hostname, m->hostname);
1184                 i->machine_id = m->machine_id;
1185                 strv_free_and_replace(i->machine_info, m->machine_info);
1186                 strv_free_and_replace(i->os_release, m->os_release);
1187
1188                 break;
1189         }
1190
1191         default:
1192                 return -EOPNOTSUPP;
1193         }
1194
1195         i->metadata_valid = true;
1196
1197         return 0;
1198 }
1199
1200 int image_name_lock(const char *name, int operation, LockFile *ret) {
1201         assert(name);
1202         assert(ret);
1203
1204         /* Locks an image name, regardless of the precise path used. */
1205
1206         if (!image_name_is_valid(name))
1207                 return -EINVAL;
1208
1209         if (getenv_bool("SYSTEMD_NSPAWN_LOCK") == 0) {
1210                 *ret = (LockFile) LOCK_FILE_INIT;
1211                 return 0;
1212         }
1213
1214         if (streq(name, ".host"))
1215                 return -EBUSY;
1216
1217         const char *p = strjoina("/run/systemd/nspawn/locks/name-", name);
1218         (void) mkdir_p("/run/systemd/nspawn/locks", 0700);
1219         return make_lock_file(p, operation, ret);
1220 }
1221
1222 bool image_name_is_valid(const char *s) {
1223         if (!filename_is_valid(s))
1224                 return false;
1225
1226         if (string_has_cc(s, NULL))
1227                 return false;
1228
1229         if (!utf8_is_valid(s))
1230                 return false;
1231
1232         /* Temporary files for atomically creating new files */
1233         if (startswith(s, ".#"))
1234                 return false;
1235
1236         return true;
1237 }
1238
1239 bool image_in_search_path(ImageClass class, const char *image) {
1240         const char *path;
1241
1242         assert(image);
1243
1244         NULSTR_FOREACH(path, image_search_path[class]) {
1245                 const char *p;
1246                 size_t k;
1247
1248                 p = path_startswith(image, path);
1249                 if (!p)
1250                         continue;
1251
1252                 /* Make sure there's a filename following */
1253                 k = strcspn(p, "/");
1254                 if (k == 0)
1255                         continue;
1256
1257                 p += k;
1258
1259                 /* Accept trailing slashes */
1260                 if (p[strspn(p, "/")] == 0)
1261                         return true;
1262
1263         }
1264
1265         return false;
1266 }
1267
1268 static const char* const image_type_table[_IMAGE_TYPE_MAX] = {
1269         [IMAGE_DIRECTORY] = "directory",
1270         [IMAGE_SUBVOLUME] = "subvolume",
1271         [IMAGE_RAW] = "raw",
1272         [IMAGE_BLOCK] = "block",
1273 };
1274
1275 DEFINE_STRING_TABLE_LOOKUP(image_type, ImageType);