nspawn: fix locating config files with --ephemeral

When --ephemeral is used, a random 16 characters suffix is added to the image
name, so matching on .nspawn files based on the image name no longer works.

Fixes https://github.com/systemd/systemd/issues/13297

diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 807c6669807d299f3c41e1bd122ba4f716dad67b..158966574e235c18731710eab134ac71c6a2de59 100644 (file)
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -4604,8 +4604,7 @@ static int merge_settings(Settings *settings, const char *path) {
 static int load_settings(void) {
         _cleanup_(settings_freep) Settings *settings = NULL;
         _cleanup_fclose_ FILE *f = NULL;
-        _cleanup_free_ char *p = NULL;
-        const char *fn;
+        _cleanup_free_ char *p = NULL, *fn = NULL;
         int r;
 
         if (arg_oci_bundle)
@@ -4616,7 +4615,19 @@ static int load_settings(void) {
         if (FLAGS_SET(arg_settings_mask, _SETTINGS_MASK_ALL))
                 return 0;
 
-        fn = strjoina(arg_machine, ".nspawn");
+        /* In ephemeral mode we append '-' and a random 16 characters string to the image name, so fixed
+         * config files are no longer matched. Ignore the random suffix for the purpose of finding files. */
+        if (arg_ephemeral) {
+                fn = strdup(arg_machine);
+                if (!fn)
+                        return log_oom();
+                assert(strlen(fn) > 17); /* Should end with -XXXXXXXXXXXXXXXX */
+                strcpy(fn + strlen(fn) - 17, ".nspawn");
+        } else {
+                fn = strjoin(arg_machine, ".nspawn");
+                if (!fn)
+                        return log_oom();
+        }
 
         /* We first look in the admin's directories in /etc and /run */
         FOREACH_STRING(i, "/etc/systemd/nspawn", "/run/systemd/nspawn") {

diff --git a/test/units/testsuite-13.sh b/test/units/testsuite-13.sh
index 554d098ef56bbb4c28371c3852a5f7716f72348e..38b6feae78ebfa452828cc8d0c162dab98c13f2a 100755 (executable)
--- a/test/units/testsuite-13.sh
+++ b/test/units/testsuite-13.sh
@@ -120,6 +120,23 @@ function check_selinux {
     systemd-nspawn "${SUSE_OPTS[@]}" --register=no -b -D /testsuite-13.nc-container --selinux-apifs-context=system_u:object_r:container_file_t:s0:c0,c1 --selinux-context=system_u:system_r:container_t:s0:c0,c1
 }
 
+function check_ephemeral_config {
+    # https://github.com/systemd/systemd/issues/13297
+    local _cmd='test -f /tmp/ephemeral-config'
+
+    mkdir -p /run/systemd/nspawn/
+    cat >/run/systemd/nspawn/testsuite-13.nc-container.nspawn <<EOF
+[Files]
+BindReadOnly=/tmp/ephemeral-config
+EOF
+    touch /tmp/ephemeral-config
+
+    # /testsuite-13.nc-container is prepared by test.sh
+    systemd-nspawn --register=no -D /testsuite-13.nc-container --ephemeral /bin/sh -x -c "$_cmd"
+
+    rm -f /run/systemd/nspawn/testsuite-13.nc-container.nspawn
+}
+
 function run {
     if [[ "$1" = "yes" && "$is_v2_supported" = "no" ]]; then
         printf "Unified cgroup hierarchy is not supported. Skipping.\n" >&2
@@ -206,4 +223,6 @@ check_machinectl_bind
 
 check_selinux
 
+check_ephemeral_config
+
 touch /testok