typedef enum MountMode {
/* This is ordered by priority! */
- INACCESSIBLE,
- OVERLAY_MOUNT,
- MOUNT_IMAGES,
- BIND_MOUNT,
- BIND_MOUNT_RECURSIVE,
- PRIVATE_TMP,
- PRIVATE_TMP_READONLY,
- PRIVATE_DEV,
- BIND_DEV,
- EMPTY_DIR,
- PRIVATE_SYSFS,
- BIND_SYSFS,
- PROCFS,
- READONLY,
- READWRITE,
- NOEXEC,
- EXEC,
- TMPFS,
- RUN,
- EXTENSION_DIRECTORIES, /* Bind-mounted outside the root directory, and used by subsequent mounts */
- EXTENSION_IMAGES, /* Mounted outside the root directory, and used by subsequent mounts */
- MQUEUEFS,
- READWRITE_IMPLICIT, /* Should have the lowest priority. */
+ MOUNT_INACCESSIBLE,
+ MOUNT_OVERLAY,
+ MOUNT_IMAGE,
+ MOUNT_BIND,
+ MOUNT_BIND_RECURSIVE,
+ MOUNT_PRIVATE_TMP,
+ MOUNT_PRIVATE_TMP_READ_ONLY,
+ MOUNT_PRIVATE_DEV,
+ MOUNT_BIND_DEV,
+ MOUNT_EMPTY_DIR,
+ MOUNT_PRIVATE_SYSFS,
+ MOUNT_BIND_SYSFS,
+ MOUNT_PROCFS,
+ MOUNT_READ_ONLY,
+ MOUNT_READ_WRITE,
+ MOUNT_NOEXEC,
+ MOUNT_EXEC,
+ MOUNT_TMPFS,
+ MOUNT_RUN,
+ MOUNT_EXTENSION_DIRECTORY, /* Bind-mounted outside the root directory, and used by subsequent mounts */
+ MOUNT_EXTENSION_IMAGE, /* Mounted outside the root directory, and used by subsequent mounts */
+ MOUNT_MQUEUEFS,
+ MOUNT_READ_WRITE_IMPLICIT, /* Should have the lowest priority. */
_MOUNT_MODE_MAX,
+ _MOUNT_MODE_INVALID = -EINVAL,
} MountMode;
typedef enum MountEntryState {
typedef struct MountEntry {
const char *path_const; /* Memory allocated on stack or static */
- MountMode mode:5;
+ MountMode mode;
bool ignore:1; /* Ignore if path does not exist? */
bool has_prefix:1; /* Already is prefixed by the root dir? */
bool read_only:1; /* Shall this mount point be read-only? */
/* If MountAPIVFS= is used, let's mount /sys, /proc, /dev and /run into the it, but only as a fallback if the user hasn't mounted
* something there already. These mounts are hence overridden by any other explicitly configured mounts. */
static const MountEntry apivfs_table[] = {
- { "/proc", PROCFS, false },
- { "/dev", BIND_DEV, false },
- { "/sys", BIND_SYSFS, false },
- { "/run", RUN, false, .options_const = "mode=0755" TMPFS_LIMITS_RUN, .flags = MS_NOSUID|MS_NODEV|MS_STRICTATIME },
+ { "/proc", MOUNT_PROCFS, false },
+ { "/dev", MOUNT_BIND_DEV, false },
+ { "/sys", MOUNT_BIND_SYSFS, false },
+ { "/run", MOUNT_RUN, false, .options_const = "mode=0755" TMPFS_LIMITS_RUN, .flags = MS_NOSUID|MS_NODEV|MS_STRICTATIME },
};
/* ProtectKernelTunables= option and the related filesystem APIs */
static const MountEntry protect_kernel_tunables_proc_table[] = {
- { "/proc/acpi", READONLY, true },
- { "/proc/apm", READONLY, true }, /* Obsolete API, there's no point in permitting access to this, ever */
- { "/proc/asound", READONLY, true },
- { "/proc/bus", READONLY, true },
- { "/proc/fs", READONLY, true },
- { "/proc/irq", READONLY, true },
- { "/proc/kallsyms", INACCESSIBLE, true },
- { "/proc/kcore", INACCESSIBLE, true },
- { "/proc/latency_stats", READONLY, true },
- { "/proc/mtrr", READONLY, true },
- { "/proc/scsi", READONLY, true },
- { "/proc/sys", READONLY, true },
- { "/proc/sysrq-trigger", READONLY, true },
- { "/proc/timer_stats", READONLY, true },
+ { "/proc/acpi", MOUNT_READ_ONLY, true },
+ { "/proc/apm", MOUNT_READ_ONLY, true }, /* Obsolete API, there's no point in permitting access to this, ever */
+ { "/proc/asound", MOUNT_READ_ONLY, true },
+ { "/proc/bus", MOUNT_READ_ONLY, true },
+ { "/proc/fs", MOUNT_READ_ONLY, true },
+ { "/proc/irq", MOUNT_READ_ONLY, true },
+ { "/proc/kallsyms", MOUNT_INACCESSIBLE, true },
+ { "/proc/kcore", MOUNT_INACCESSIBLE, true },
+ { "/proc/latency_stats", MOUNT_READ_ONLY, true },
+ { "/proc/mtrr", MOUNT_READ_ONLY, true },
+ { "/proc/scsi", MOUNT_READ_ONLY, true },
+ { "/proc/sys", MOUNT_READ_ONLY, true },
+ { "/proc/sysrq-trigger", MOUNT_READ_ONLY, true },
+ { "/proc/timer_stats", MOUNT_READ_ONLY, true },
};
static const MountEntry protect_kernel_tunables_sys_table[] = {
- { "/sys", READONLY, false },
- { "/sys/fs/bpf", READONLY, true },
- { "/sys/fs/cgroup", READWRITE_IMPLICIT, false }, /* READONLY is set by ProtectControlGroups= option */
- { "/sys/fs/selinux", READWRITE_IMPLICIT, true },
- { "/sys/kernel/debug", READONLY, true },
- { "/sys/kernel/tracing", READONLY, true },
+ { "/sys", MOUNT_READ_ONLY, false },
+ { "/sys/fs/bpf", MOUNT_READ_ONLY, true },
+ { "/sys/fs/cgroup", MOUNT_READ_WRITE_IMPLICIT, false }, /* READ_ONLY is set by ProtectControlGroups= option */
+ { "/sys/fs/selinux", MOUNT_READ_WRITE_IMPLICIT, true },
+ { "/sys/kernel/debug", MOUNT_READ_ONLY, true },
+ { "/sys/kernel/tracing", MOUNT_READ_ONLY, true },
};
/* ProtectKernelModules= option */
static const MountEntry protect_kernel_modules_table[] = {
- { "/usr/lib/modules", INACCESSIBLE, true },
+ { "/usr/lib/modules", MOUNT_INACCESSIBLE, true },
};
/* ProtectKernelLogs= option */
static const MountEntry protect_kernel_logs_proc_table[] = {
- { "/proc/kmsg", INACCESSIBLE, true },
+ { "/proc/kmsg", MOUNT_INACCESSIBLE, true },
};
static const MountEntry protect_kernel_logs_dev_table[] = {
- { "/dev/kmsg", INACCESSIBLE, true },
+ { "/dev/kmsg", MOUNT_INACCESSIBLE, true },
};
/*
* system should be protected by ProtectSystem=
*/
static const MountEntry protect_home_read_only_table[] = {
- { "/home", READONLY, true },
- { "/run/user", READONLY, true },
- { "/root", READONLY, true },
+ { "/home", MOUNT_READ_ONLY, true },
+ { "/run/user", MOUNT_READ_ONLY, true },
+ { "/root", MOUNT_READ_ONLY, true },
};
/* ProtectHome=tmpfs table */
static const MountEntry protect_home_tmpfs_table[] = {
- { "/home", TMPFS, true, .read_only = true, .options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },
- { "/run/user", TMPFS, true, .read_only = true, .options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },
- { "/root", TMPFS, true, .read_only = true, .options_const = "mode=0700" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },
+ { "/home", MOUNT_TMPFS, true, .read_only = true, .options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },
+ { "/run/user", MOUNT_TMPFS, true, .read_only = true, .options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },
+ { "/root", MOUNT_TMPFS, true, .read_only = true, .options_const = "mode=0700" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },
};
/* ProtectHome=yes table */
static const MountEntry protect_home_yes_table[] = {
- { "/home", INACCESSIBLE, true },
- { "/run/user", INACCESSIBLE, true },
- { "/root", INACCESSIBLE, true },
+ { "/home", MOUNT_INACCESSIBLE, true },
+ { "/run/user", MOUNT_INACCESSIBLE, true },
+ { "/root", MOUNT_INACCESSIBLE, true },
};
/* ProtectSystem=yes table */
static const MountEntry protect_system_yes_table[] = {
- { "/usr", READONLY, false },
- { "/boot", READONLY, true },
- { "/efi", READONLY, true },
+ { "/usr", MOUNT_READ_ONLY, false },
+ { "/boot", MOUNT_READ_ONLY, true },
+ { "/efi", MOUNT_READ_ONLY, true },
};
/* ProtectSystem=full includes ProtectSystem=yes */
static const MountEntry protect_system_full_table[] = {
- { "/usr", READONLY, false },
- { "/boot", READONLY, true },
- { "/efi", READONLY, true },
- { "/etc", READONLY, false },
+ { "/usr", MOUNT_READ_ONLY, false },
+ { "/boot", MOUNT_READ_ONLY, true },
+ { "/efi", MOUNT_READ_ONLY, true },
+ { "/etc", MOUNT_READ_ONLY, false },
};
/* ProtectSystem=strict table. In this strict mode, we mount everything read-only, except for /proc, /dev,
* left writable, as ProtectHome= shall manage those, orthogonally).
*/
static const MountEntry protect_system_strict_table[] = {
- { "/", READONLY, false },
- { "/proc", READWRITE_IMPLICIT, false }, /* ProtectKernelTunables= */
- { "/sys", READWRITE_IMPLICIT, false }, /* ProtectKernelTunables= */
- { "/dev", READWRITE_IMPLICIT, false }, /* PrivateDevices= */
- { "/home", READWRITE_IMPLICIT, true }, /* ProtectHome= */
- { "/run/user", READWRITE_IMPLICIT, true }, /* ProtectHome= */
- { "/root", READWRITE_IMPLICIT, true }, /* ProtectHome= */
+ { "/", MOUNT_READ_ONLY, false },
+ { "/proc", MOUNT_READ_WRITE_IMPLICIT, false }, /* ProtectKernelTunables= */
+ { "/sys", MOUNT_READ_WRITE_IMPLICIT, false }, /* ProtectKernelTunables= */
+ { "/dev", MOUNT_READ_WRITE_IMPLICIT, false }, /* PrivateDevices= */
+ { "/home", MOUNT_READ_WRITE_IMPLICIT, true }, /* ProtectHome= */
+ { "/run/user", MOUNT_READ_WRITE_IMPLICIT, true }, /* ProtectHome= */
+ { "/root", MOUNT_READ_WRITE_IMPLICIT, true }, /* ProtectHome= */
};
/* ProtectHostname=yes able */
static const MountEntry protect_hostname_table[] = {
- { "/proc/sys/kernel/hostname", READONLY, false },
- { "/proc/sys/kernel/domainname", READONLY, false },
+ { "/proc/sys/kernel/hostname", MOUNT_READ_ONLY, false },
+ { "/proc/sys/kernel/domainname", MOUNT_READ_ONLY, false },
};
static const char * const mount_mode_table[_MOUNT_MODE_MAX] = {
- [INACCESSIBLE] = "inaccessible",
- [OVERLAY_MOUNT] = "overlay",
- [MOUNT_IMAGES] = "mount-images",
- [BIND_MOUNT] = "bind",
- [BIND_MOUNT_RECURSIVE] = "rbind",
- [PRIVATE_TMP] = "private-tmp",
- [PRIVATE_TMP_READONLY] = "private-tmp-read-only",
- [PRIVATE_DEV] = "private-dev",
- [BIND_DEV] = "bind-dev",
- [EMPTY_DIR] = "empty",
- [PRIVATE_SYSFS] = "private-sysfs",
- [BIND_SYSFS] = "bind-sysfs",
- [PROCFS] = "procfs",
- [READONLY] = "read-only",
- [READWRITE] = "read-write",
- [NOEXEC] = "noexec",
- [EXEC] = "exec",
- [TMPFS] = "tmpfs",
- [RUN] = "run",
- [EXTENSION_DIRECTORIES] = "extension-directories",
- [EXTENSION_IMAGES] = "extension-images",
- [MQUEUEFS] = "mqueuefs",
- [READWRITE_IMPLICIT] = "read-write-implicit",
+ [MOUNT_INACCESSIBLE] = "inaccessible",
+ [MOUNT_OVERLAY] = "overlay",
+ [MOUNT_IMAGE] = "image",
+ [MOUNT_BIND] = "bind",
+ [MOUNT_BIND_RECURSIVE] = "bind-recursive",
+ [MOUNT_PRIVATE_TMP] = "private-tmp",
+ [MOUNT_PRIVATE_TMP_READ_ONLY] = "private-tmp-read-only",
+ [MOUNT_PRIVATE_DEV] = "private-dev",
+ [MOUNT_BIND_DEV] = "bind-dev",
+ [MOUNT_EMPTY_DIR] = "empty-dir",
+ [MOUNT_PRIVATE_SYSFS] = "private-sysfs",
+ [MOUNT_BIND_SYSFS] = "bind-sysfs",
+ [MOUNT_PROCFS] = "procfs",
+ [MOUNT_READ_ONLY] = "read-only",
+ [MOUNT_READ_WRITE] = "read-write",
+ [MOUNT_NOEXEC] = "noexec",
+ [MOUNT_EXEC] = "exec",
+ [MOUNT_TMPFS] = "tmpfs",
+ [MOUNT_RUN] = "run",
+ [MOUNT_EXTENSION_DIRECTORY] = "extension-directory",
+ [MOUNT_EXTENSION_IMAGE] = "extension-image",
+ [MOUNT_MQUEUEFS] = "mqueuefs",
+ [MOUNT_READ_WRITE_IMPLICIT] = "read-write-implicit",
};
/* Helper struct for naming simplicity and reusability */
static bool mount_entry_read_only(const MountEntry *p) {
assert(p);
- return p->read_only || IN_SET(p->mode, READONLY, INACCESSIBLE, PRIVATE_TMP_READONLY);
+ return p->read_only || IN_SET(p->mode, MOUNT_READ_ONLY, MOUNT_INACCESSIBLE, MOUNT_PRIVATE_TMP_READ_ONLY);
}
static bool mount_entry_noexec(const MountEntry *p) {
assert(p);
- return p->noexec || IN_SET(p->mode, NOEXEC, INACCESSIBLE, PRIVATE_SYSFS, BIND_SYSFS, PROCFS);
+ return p->noexec || IN_SET(p->mode, MOUNT_NOEXEC, MOUNT_INACCESSIBLE, MOUNT_PRIVATE_SYSFS, MOUNT_BIND_SYSFS, MOUNT_PROCFS);
}
static bool mount_entry_exec(const MountEntry *p) {
assert(p);
- return p->exec || p->mode == EXEC;
+ return p->exec || p->mode == MOUNT_EXEC;
}
static const char *mount_entry_source(const MountEntry *p) {
static int append_access_mounts(MountList *ml, char **strv, MountMode mode, bool forcibly_require_prefix) {
assert(ml);
- /* Adds a list of user-supplied READWRITE/READWRITE_IMPLICIT/READONLY/INACCESSIBLE entries */
+ /* Adds a list of user-supplied READ_WRITE/READ_WRITE_IMPLICIT/READ_ONLY/INACCESSIBLE entries */
STRV_FOREACH(i, strv) {
bool ignore = false, needs_prefix = false;
*me = (MountEntry) {
.path_const = *i,
- .mode = EMPTY_DIR,
+ .mode = MOUNT_EMPTY_DIR,
.ignore = false,
.read_only = true,
.options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST,
*me = (MountEntry) {
.path_const = b->destination,
- .mode = b->recursive ? BIND_MOUNT_RECURSIVE : BIND_MOUNT,
+ .mode = b->recursive ? MOUNT_BIND_RECURSIVE : MOUNT_BIND,
.read_only = b->read_only,
.nosuid = b->nosuid,
.source_const = b->source,
*me = (MountEntry) {
.path_const = m->destination,
- .mode = MOUNT_IMAGES,
+ .mode = MOUNT_IMAGE,
.source_const = m->source,
.image_options_const = m->mount_options,
.ignore = m->ignore_enoent,
.image_options_const = m->mount_options,
.ignore = m->ignore_enoent,
.source_const = m->source,
- .mode = EXTENSION_IMAGES,
+ .mode = MOUNT_EXTENSION_IMAGE,
.has_prefix = true,
};
}
*me = (MountEntry) {
.path_malloc = TAKE_PTR(mount_point),
.source_malloc = TAKE_PTR(source),
- .mode = EXTENSION_DIRECTORIES,
+ .mode = MOUNT_EXTENSION_DIRECTORY,
.ignore = ignore_enoent,
.has_prefix = true,
.read_only = true,
*me = (MountEntry) {
.path_malloc = TAKE_PTR(prefixed_hierarchy),
.options_malloc = TAKE_PTR(overlays[i]),
- .mode = OVERLAY_MOUNT,
+ .mode = MOUNT_OVERLAY,
.has_prefix = true,
.ignore = true, /* If the source image doesn't set the ignore bit it will fail earlier. */
};
*me = (MountEntry) {
.path_const = t->path,
- .mode = TMPFS,
+ .mode = MOUNT_TMPFS,
.read_only = ro,
.options_malloc = TAKE_PTR(o),
.flags = flags,
/* ExtensionImages/Directories will be used by other mounts as a base, so sort them first
* regardless of the prefix - they are set up in the propagate directory anyway */
- d = -CMP(a->mode == EXTENSION_IMAGES, b->mode == EXTENSION_IMAGES);
+ d = -CMP(a->mode == MOUNT_EXTENSION_IMAGE, b->mode == MOUNT_EXTENSION_IMAGE);
if (d != 0)
return d;
- d = -CMP(a->mode == EXTENSION_DIRECTORIES, b->mode == EXTENSION_DIRECTORIES);
+ d = -CMP(a->mode == MOUNT_EXTENSION_DIRECTORY, b->mode == MOUNT_EXTENSION_DIRECTORY);
if (d != 0)
return d;
continue;
}
- clear = f->mode == INACCESSIBLE ? mount_entry_path(f) : NULL;
+ clear = f->mode == MOUNT_INACCESSIBLE ? mount_entry_path(f) : NULL;
*t = *f;
t++;
for (f = ml->mounts, t = ml->mounts; f < ml->mounts + ml->n_mounts; f++) {
- /* Only suppress such subtrees for READONLY, READWRITE and READWRITE_IMPLICIT entries */
- if (IN_SET(f->mode, READONLY, READWRITE, READWRITE_IMPLICIT)) {
+ /* Only suppress such subtrees for READ_ONLY, READ_WRITE and READ_WRITE_IMPLICIT entries */
+ if (IN_SET(f->mode, MOUNT_READ_ONLY, MOUNT_READ_WRITE, MOUNT_READ_WRITE_IMPLICIT)) {
MountEntry *found = NULL;
/* Now let's find the first parent of the entry we are looking at. */
for (f = ml->mounts, t = ml->mounts; f < ml->mounts + ml->n_mounts; f++) {
/* ExtensionImages/Directories bases are opened in /run/systemd/unit-extensions on the host */
- if (!IN_SET(f->mode, EXTENSION_IMAGES, EXTENSION_DIRECTORIES) && !path_startswith(mount_entry_path(f), root_directory)) {
+ if (!IN_SET(f->mode, MOUNT_EXTENSION_IMAGE, MOUNT_EXTENSION_DIRECTORY) && !path_startswith(mount_entry_path(f), root_directory)) {
log_debug("%s is outside of root directory.", mount_entry_path(f));
mount_entry_done(f);
continue;
if (r < 0)
return log_debug_errno(r, "Failed to extract extension name from %s: %m", mount_entry_source(m));
- if (m->mode == EXTENSION_IMAGES) {
+ if (m->mode == MOUNT_EXTENSION_IMAGE) {
r = parse_os_release(
empty_to_root(root_directory),
"ID", &host_os_release_id,
switch (m->mode) {
- case INACCESSIBLE: {
+ case MOUNT_INACCESSIBLE: {
_cleanup_free_ char *runtime_dir = NULL;
struct stat target;
break;
}
- case READONLY:
- case READWRITE:
- case READWRITE_IMPLICIT:
- case EXEC:
- case NOEXEC:
+ case MOUNT_READ_ONLY:
+ case MOUNT_READ_WRITE:
+ case MOUNT_READ_WRITE_IMPLICIT:
+ case MOUNT_EXEC:
+ case MOUNT_NOEXEC:
r = path_is_mount_point(mount_entry_path(m), root_directory, 0);
if (r == -ENOENT && m->ignore)
return 0;
what = mount_entry_path(m);
break;
- case EXTENSION_DIRECTORIES: {
+ case MOUNT_EXTENSION_DIRECTORY: {
_cleanup_free_ char *host_os_release_id = NULL, *host_os_release_version_id = NULL,
*host_os_release_level = NULL, *extension_name = NULL;
_cleanup_strv_free_ char **extension_release = NULL;
_fallthrough_;
}
- case BIND_MOUNT:
+ case MOUNT_BIND:
rbind = false;
_fallthrough_;
- case BIND_MOUNT_RECURSIVE: {
+ case MOUNT_BIND_RECURSIVE: {
_cleanup_free_ char *chased = NULL;
/* Since mount() will always follow symlinks we chase the symlinks on our own first. Note
break;
}
- case EMPTY_DIR:
- case TMPFS:
+ case MOUNT_EMPTY_DIR:
+ case MOUNT_TMPFS:
return mount_tmpfs(m);
- case PRIVATE_TMP:
- case PRIVATE_TMP_READONLY:
+ case MOUNT_PRIVATE_TMP:
+ case MOUNT_PRIVATE_TMP_READ_ONLY:
what = mount_entry_source(m);
make = true;
break;
- case PRIVATE_DEV:
+ case MOUNT_PRIVATE_DEV:
return mount_private_dev(m, p->runtime_scope);
- case BIND_DEV:
+ case MOUNT_BIND_DEV:
return mount_bind_dev(m);
- case PRIVATE_SYSFS:
+ case MOUNT_PRIVATE_SYSFS:
return mount_private_sysfs(m, p);
- case BIND_SYSFS:
+ case MOUNT_BIND_SYSFS:
return mount_bind_sysfs(m);
- case PROCFS:
+ case MOUNT_PROCFS:
return mount_procfs(m, p);
- case RUN:
+ case MOUNT_RUN:
return mount_run(m);
- case MQUEUEFS:
+ case MOUNT_MQUEUEFS:
return mount_mqueuefs(m);
- case MOUNT_IMAGES:
+ case MOUNT_IMAGE:
return mount_image(m, NULL, p->mount_image_policy);
- case EXTENSION_IMAGES:
+ case MOUNT_EXTENSION_IMAGE:
return mount_image(m, root_directory, p->extension_image_policy);
- case OVERLAY_MOUNT:
+ case MOUNT_OVERLAY:
return mount_overlay(m);
default:
if (m->state != MOUNT_APPLIED)
return 0;
- if (mount_entry_read_only(m) || m->mode == PRIVATE_DEV) {
+ if (mount_entry_read_only(m) || m->mode == MOUNT_PRIVATE_DEV) {
new_flags |= MS_RDONLY;
flags_mask |= MS_RDONLY;
}
* and running Linux <= 4.17. */
submounts =
mount_entry_read_only(m) &&
- !IN_SET(m->mode, EMPTY_DIR, TMPFS);
+ !IN_SET(m->mode, MOUNT_EMPTY_DIR, MOUNT_TMPFS);
if (submounts)
r = bind_remount_recursive_with_mountinfo(mount_entry_path(m), new_flags, flags_mask, deny_list, proc_self_mountinfo);
else
if (flags_mask == 0) /* No Change? */
return 0;
- submounts = !IN_SET(m->mode, EMPTY_DIR, TMPFS);
+ submounts = !IN_SET(m->mode, MOUNT_EMPTY_DIR, MOUNT_TMPFS);
if (submounts)
r = bind_remount_recursive_with_mountinfo(mount_entry_path(m), new_flags, flags_mask, deny_list, proc_self_mountinfo);
if (m->state != MOUNT_APPLIED)
return 0;
- submounts = !IN_SET(m->mode, EMPTY_DIR, TMPFS);
-
+ submounts = !IN_SET(m->mode, MOUNT_EMPTY_DIR, MOUNT_TMPFS);
if (submounts)
r = bind_remount_recursive_with_mountinfo(mount_entry_path(m), MS_NOSUID, MS_NOSUID, NULL, proc_self_mountinfo);
else
continue;
/* ExtensionImages/Directories are first opened in the propagate directory, not in the root_directory */
- r = follow_symlink(!IN_SET(m->mode, EXTENSION_IMAGES, EXTENSION_DIRECTORIES) ? root : NULL, m);
+ r = follow_symlink(!IN_SET(m->mode, MOUNT_EXTENSION_IMAGE, MOUNT_EXTENSION_DIRECTORY) ? root : NULL, m);
if (r < 0) {
mount_entry_path_debug_string(root, m, error_path);
return r;
/* Third round, flip the noexec bits with a simplified deny list. */
for (size_t j = 0; j < ml->n_mounts; j++)
- if (IN_SET((ml->mounts+j)->mode, EXEC, NOEXEC))
+ if (IN_SET((ml->mounts+j)->mode, MOUNT_EXEC, MOUNT_NOEXEC))
deny_list[j] = (char*) mount_entry_path(ml->mounts+j);
deny_list[ml->n_mounts] = NULL;
return r;
}
- r = append_access_mounts(&ml, p->read_write_paths, READWRITE, require_prefix);
+ r = append_access_mounts(&ml, p->read_write_paths, MOUNT_READ_WRITE, require_prefix);
if (r < 0)
return r;
- r = append_access_mounts(&ml, p->read_only_paths, READONLY, require_prefix);
+ r = append_access_mounts(&ml, p->read_only_paths, MOUNT_READ_ONLY, require_prefix);
if (r < 0)
return r;
- r = append_access_mounts(&ml, p->inaccessible_paths, INACCESSIBLE, require_prefix);
+ r = append_access_mounts(&ml, p->inaccessible_paths, MOUNT_INACCESSIBLE, require_prefix);
if (r < 0)
return r;
- r = append_access_mounts(&ml, p->exec_paths, EXEC, require_prefix);
+ r = append_access_mounts(&ml, p->exec_paths, MOUNT_EXEC, require_prefix);
if (r < 0)
return r;
- r = append_access_mounts(&ml, p->no_exec_paths, NOEXEC, require_prefix);
+ r = append_access_mounts(&ml, p->no_exec_paths, MOUNT_NOEXEC, require_prefix);
if (r < 0)
return r;
*me = (MountEntry) {
.path_const = "/tmp",
- .mode = ro ? PRIVATE_TMP_READONLY : PRIVATE_TMP,
+ .mode = ro ? MOUNT_PRIVATE_TMP_READ_ONLY : MOUNT_PRIVATE_TMP,
.source_const = p->tmp_dir,
};
}
*me = (MountEntry) {
.path_const = "/var/tmp",
- .mode = ro ? PRIVATE_TMP_READONLY : PRIVATE_TMP,
+ .mode = ro ? MOUNT_PRIVATE_TMP_READ_ONLY : MOUNT_PRIVATE_TMP,
.source_const = p->var_tmp_dir,
};
}
*me = (MountEntry) {
.path_const = "/dev",
- .mode = PRIVATE_DEV,
+ .mode = MOUNT_PRIVATE_DEV,
.flags = DEV_MOUNT_OPTIONS,
};
}
*me = (MountEntry) {
.path_const = "/sys/fs/cgroup",
- .mode = READONLY,
+ .mode = MOUNT_READ_ONLY,
};
}
*me = (MountEntry) {
.path_const = "/sys",
- .mode = PRIVATE_SYSFS,
+ .mode = MOUNT_PRIVATE_SYSFS,
};
}
*me = (MountEntry) {
.path_const = "/dev/mqueue",
- .mode = MQUEUEFS,
+ .mode = MOUNT_MQUEUEFS,
.flags = MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_RELATIME,
};
}
*me = (MountEntry) {
.path_const = "/run/credentials",
- .mode = TMPFS,
+ .mode = MOUNT_TMPFS,
.read_only = true,
.options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST,
.flags = MS_NODEV|MS_STRICTATIME|MS_NOSUID|MS_NOEXEC,
*me = (MountEntry) {
.path_const = p->creds_path,
- .mode = BIND_MOUNT,
+ .mode = MOUNT_BIND,
.read_only = true,
.source_const = p->creds_path,
.ignore = true,
*me = (MountEntry) {
.path_const = "/run/credentials",
- .mode = INACCESSIBLE,
+ .mode = MOUNT_INACCESSIBLE,
.ignore = true,
};
}
*me = (MountEntry) {
.path_const = "/run/systemd/journal",
- .mode = BIND_MOUNT_RECURSIVE,
+ .mode = MOUNT_BIND_RECURSIVE,
.read_only = true,
.source_malloc = TAKE_PTR(q),
};
*me = (MountEntry) {
.source_const = p->propagate_dir,
.path_const = p->incoming_dir,
- .mode = BIND_MOUNT,
+ .mode = MOUNT_BIND,
.read_only = true,
};
}
*me = (MountEntry) {
.path_const = p->notify_socket,
.source_const = p->notify_socket,
- .mode = BIND_MOUNT,
+ .mode = MOUNT_BIND,
.read_only = true,
};
}
*me = (MountEntry) {
.path_const = "/run/host/.os-release-stage/",
.source_const = p->host_os_release_stage,
- .mode = BIND_MOUNT,
+ .mode = MOUNT_BIND,
.read_only = true,
.ignore = true, /* Live copy, don't hard-fail if it goes missing */
};
projects / thirdparty / systemd.git / commitdiff
