[systemd.git] / src / core / namespace.c

/***
  This file is part of systemd.

  Copyright 2010 Lennart Poettering

  systemd is free software; you can redistribute it and/or modify it
  under the terms of the GNU Lesser General Public License as published by
  the Free Software Foundation; either version 2.1 of the License, or
  (at your option) any later version.

  systemd is distributed in the hope that it will be useful, but
  WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  Lesser General Public License for more details.

  You should have received a copy of the GNU Lesser General Public License
  along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/

#include <errno.h>
#include <sched.h>
#include <stdio.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <unistd.h>
#include <linux/fs.h>

#include "alloc-util.h"
#include "dev-setup.h"
#include "fd-util.h"
#include "loopback-setup.h"
#include "missing.h"
#include "mkdir.h"
#include "mount-util.h"
#include "namespace.h"
#include "path-util.h"
#include "selinux-util.h"
#include "socket-util.h"
#include "string-table.h"
#include "string-util.h"
#include "strv.h"
#include "umask-util.h"
#include "user-util.h"
#include "util.h"

#define DEV_MOUNT_OPTIONS (MS_NOSUID|MS_STRICTATIME|MS_NOEXEC)

typedef enum MountMode {
        /* This is ordered by priority! */
        INACCESSIBLE,
        READONLY,
        PRIVATE_TMP,
        PRIVATE_VAR_TMP,
        PRIVATE_DEV,
        READWRITE
} MountMode;

typedef struct BindMount {
        const char *path;
        MountMode mode;
        bool done;
        bool ignore;
} BindMount;

static int append_mounts(BindMount **p, char **strv, MountMode mode) {
        char **i;

        assert(p);

        STRV_FOREACH(i, strv) {

                (*p)->ignore = false;
                (*p)->done = false;

                if ((mode == INACCESSIBLE || mode == READONLY || mode == READWRITE) && (*i)[0] == '-') {
                        (*p)->ignore = true;
                        (*i)++;
                }

                if (!path_is_absolute(*i))
                        return -EINVAL;

                (*p)->path = *i;
                (*p)->mode = mode;
                (*p)++;
        }

        return 0;
}

static int mount_path_compare(const void *a, const void *b) {
        const BindMount *p = a, *q = b;
        int d;

        d = path_compare(p->path, q->path);

        if (d == 0) {
                /* If the paths are equal, check the mode */
                if (p->mode < q->mode)
                        return -1;

                if (p->mode > q->mode)
                        return 1;

                return 0;
        }

        /* If the paths are not equal, then order prefixes first */
        return d;
}

static void drop_duplicates(BindMount *m, unsigned *n) {
        BindMount *f, *t, *previous;

        assert(m);
        assert(n);

        for (f = m, t = m, previous = NULL; f < m+*n; f++) {

                /* The first one wins */
                if (previous && path_equal(f->path, previous->path))
                        continue;

                *t = *f;

                previous = t;

                t++;
        }

        *n = t - m;
}

static int mount_dev(BindMount *m) {
        static const char devnodes[] =
                "/dev/null\0"
                "/dev/zero\0"
                "/dev/full\0"
                "/dev/random\0"
                "/dev/urandom\0"
                "/dev/tty\0";

        char temporary_mount[] = "/tmp/namespace-dev-XXXXXX";
        const char *d, *dev = NULL, *devpts = NULL, *devshm = NULL, *devhugepages = NULL, *devmqueue = NULL, *devlog = NULL, *devptmx = NULL;
        _cleanup_umask_ mode_t u;
        int r;

        assert(m);

        u = umask(0000);

        if (!mkdtemp(temporary_mount))
                return -errno;

        dev = strjoina(temporary_mount, "/dev");
        (void) mkdir(dev, 0755);
        if (mount("tmpfs", dev, "tmpfs", DEV_MOUNT_OPTIONS, "mode=755") < 0) {
                r = -errno;
                goto fail;
        }

        devpts = strjoina(temporary_mount, "/dev/pts");
        (void) mkdir(devpts, 0755);
        if (mount("/dev/pts", devpts, NULL, MS_BIND, NULL) < 0) {
                r = -errno;
                goto fail;
        }

        devptmx = strjoina(temporary_mount, "/dev/ptmx");
        if (symlink("pts/ptmx", devptmx) < 0) {
                r = -errno;
                goto fail;
        }

        devshm = strjoina(temporary_mount, "/dev/shm");
        (void) mkdir(devshm, 01777);
        r = mount("/dev/shm", devshm, NULL, MS_BIND, NULL);
        if (r < 0) {
                r = -errno;
                goto fail;
        }

        devmqueue = strjoina(temporary_mount, "/dev/mqueue");
        (void) mkdir(devmqueue, 0755);
        (void) mount("/dev/mqueue", devmqueue, NULL, MS_BIND, NULL);

        devhugepages = strjoina(temporary_mount, "/dev/hugepages");
        (void) mkdir(devhugepages, 0755);
        (void) mount("/dev/hugepages", devhugepages, NULL, MS_BIND, NULL);

        devlog = strjoina(temporary_mount, "/dev/log");
        (void) symlink("/run/systemd/journal/dev-log", devlog);

        NULSTR_FOREACH(d, devnodes) {
                _cleanup_free_ char *dn = NULL;
                struct stat st;

                r = stat(d, &st);
                if (r < 0) {

                        if (errno == ENOENT)
                                continue;

                        r = -errno;
                        goto fail;
                }

                if (!S_ISBLK(st.st_mode) &&
                    !S_ISCHR(st.st_mode)) {
                        r = -EINVAL;
                        goto fail;
                }

                if (st.st_rdev == 0)
                        continue;

                dn = strappend(temporary_mount, d);
                if (!dn) {
                        r = -ENOMEM;
                        goto fail;
                }

                mac_selinux_create_file_prepare(d, st.st_mode);
                r = mknod(dn, st.st_mode, st.st_rdev);
                mac_selinux_create_file_clear();

                if (r < 0) {
                        r = -errno;
                        goto fail;
                }
        }

        dev_setup(temporary_mount, UID_INVALID, GID_INVALID);

        /* Create the /dev directory if missing. It is more likely to be
         * missing when the service is started with RootDirectory. This is
         * consistent with mount units creating the mount points when missing.
         */
        (void) mkdir_p_label(m->path, 0755);

        /* Unmount everything in old /dev */
        umount_recursive(m->path, 0);
        if (mount(dev, m->path, NULL, MS_MOVE, NULL) < 0) {
                r = -errno;
                goto fail;
        }

        rmdir(dev);
        rmdir(temporary_mount);

        return 0;

fail:
        if (devpts)
                umount(devpts);

        if (devshm)
                umount(devshm);

        if (devhugepages)
                umount(devhugepages);

        if (devmqueue)
                umount(devmqueue);

        umount(dev);
        rmdir(dev);
        rmdir(temporary_mount);

        return r;
}

static int apply_mount(
                BindMount *m,
                const char *tmp_dir,
                const char *var_tmp_dir) {

        const char *what;
        int r;
        struct stat target;

        assert(m);

        switch (m->mode) {

        case INACCESSIBLE:

                /* First, get rid of everything that is below if there
                 * is anything... Then, overmount it with an
                 * inaccessible path. */
                umount_recursive(m->path, 0);

                if (lstat(m->path, &target) < 0) {
                        if (m->ignore && errno == ENOENT)
                                return 0;
                        return -errno;
                }

                what = mode_to_inaccessible_node(target.st_mode);
                if (!what) {
                        log_debug("File type not supported for inaccessible mounts. Note that symlinks are not allowed");
                        return -ELOOP;
                }
                break;
        case READONLY:
        case READWRITE:
                /* Nothing to mount here, we just later toggle the
                 * MS_RDONLY bit for the mount point */
                return 0;

        case PRIVATE_TMP:
                what = tmp_dir;
                break;

        case PRIVATE_VAR_TMP:
                what = var_tmp_dir;
                break;

        case PRIVATE_DEV:
                return mount_dev(m);

        default:
                assert_not_reached("Unknown mode");
        }

        assert(what);

        r = mount(what, m->path, NULL, MS_BIND|MS_REC, NULL);
        if (r >= 0) {
                log_debug("Successfully mounted %s to %s", what, m->path);
                return r;
        } else {
                if (m->ignore && errno == ENOENT)
                        return 0;
                return log_debug_errno(errno, "Failed to mount %s to %s: %m", what, m->path);
        }
}

static int make_read_only(BindMount *m) {
        int r;

        assert(m);

        if (IN_SET(m->mode, INACCESSIBLE, READONLY))
                r = bind_remount_recursive(m->path, true);
        else if (IN_SET(m->mode, READWRITE, PRIVATE_TMP, PRIVATE_VAR_TMP, PRIVATE_DEV)) {
                r = bind_remount_recursive(m->path, false);
                if (r == 0 && m->mode == PRIVATE_DEV) /* can be readonly but the submounts can't*/
                        if (mount(NULL, m->path, NULL, MS_REMOUNT|DEV_MOUNT_OPTIONS|MS_RDONLY, NULL) < 0)
                                r = -errno;
        } else
                r = 0;

        if (m->ignore && r == -ENOENT)
                return 0;

        return r;
}

int setup_namespace(
                const char* root_directory,
                char** read_write_paths,
                char** read_only_paths,
                char** inaccessible_paths,
                const char* tmp_dir,
                const char* var_tmp_dir,
                bool private_dev,
                ProtectHome protect_home,
                ProtectSystem protect_system,
                unsigned long mount_flags) {

        BindMount *m, *mounts = NULL;
        unsigned n;
        int r = 0;

        if (mount_flags == 0)
                mount_flags = MS_SHARED;

        if (unshare(CLONE_NEWNS) < 0)
                return -errno;

        n = !!tmp_dir + !!var_tmp_dir +
                strv_length(read_write_paths) +
                strv_length(read_only_paths) +
                strv_length(inaccessible_paths) +
                private_dev +
                (protect_home != PROTECT_HOME_NO ? 3 : 0) +
                (protect_system != PROTECT_SYSTEM_NO ? 2 : 0) +
                (protect_system == PROTECT_SYSTEM_FULL ? 1 : 0);

        if (n > 0) {
                m = mounts = (BindMount *) alloca0(n * sizeof(BindMount));
                r = append_mounts(&m, read_write_paths, READWRITE);
                if (r < 0)
                        return r;

                r = append_mounts(&m, read_only_paths, READONLY);
                if (r < 0)
                        return r;

                r = append_mounts(&m, inaccessible_paths, INACCESSIBLE);
                if (r < 0)
                        return r;

                if (tmp_dir) {
                        m->path = prefix_roota(root_directory, "/tmp");
                        m->mode = PRIVATE_TMP;
                        m++;
                }

                if (var_tmp_dir) {
                        m->path = prefix_roota(root_directory, "/var/tmp");
                        m->mode = PRIVATE_VAR_TMP;
                        m++;
                }

                if (private_dev) {
                        m->path = prefix_roota(root_directory, "/dev");
                        m->mode = PRIVATE_DEV;
                        m++;
                }

                if (protect_home != PROTECT_HOME_NO) {
                        const char *home_dir, *run_user_dir, *root_dir;

                        home_dir = prefix_roota(root_directory, "/home");
                        home_dir = strjoina("-", home_dir);
                        run_user_dir = prefix_roota(root_directory, "/run/user");
                        run_user_dir = strjoina("-", run_user_dir);
                        root_dir = prefix_roota(root_directory, "/root");
                        root_dir = strjoina("-", root_dir);

                        r = append_mounts(&m, STRV_MAKE(home_dir, run_user_dir, root_dir),
                                protect_home == PROTECT_HOME_READ_ONLY ? READONLY : INACCESSIBLE);
                        if (r < 0)
                                return r;
                }

                if (protect_system != PROTECT_SYSTEM_NO) {
                        const char *usr_dir, *boot_dir, *etc_dir;

                        usr_dir = prefix_roota(root_directory, "/usr");
                        boot_dir = prefix_roota(root_directory, "/boot");
                        boot_dir = strjoina("-", boot_dir);
                        etc_dir = prefix_roota(root_directory, "/etc");

                        r = append_mounts(&m, protect_system == PROTECT_SYSTEM_FULL
                                ? STRV_MAKE(usr_dir, boot_dir, etc_dir)
                                : STRV_MAKE(usr_dir, boot_dir), READONLY);
                        if (r < 0)
                                return r;
                }

                assert(mounts + n == m);

                qsort(mounts, n, sizeof(BindMount), mount_path_compare);
                drop_duplicates(mounts, &n);
        }

        if (n > 0 || root_directory) {
                /* Remount / as SLAVE so that nothing now mounted in the namespace
                   shows up in the parent */
                if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0)
                        return -errno;
        }

        if (root_directory) {
                /* Turn directory into bind mount */
                if (mount(root_directory, root_directory, NULL, MS_BIND|MS_REC, NULL) < 0)
                        return -errno;
        }

        if (n > 0) {
                for (m = mounts; m < mounts + n; ++m) {
                        r = apply_mount(m, tmp_dir, var_tmp_dir);
                        if (r < 0)
                                goto fail;
                }

                for (m = mounts; m < mounts + n; ++m) {
                        r = make_read_only(m);
                        if (r < 0)
                                goto fail;
                }
        }

        if (root_directory) {
                /* MS_MOVE does not work on MS_SHARED so the remount MS_SHARED will be done later */
                r = mount_move_root(root_directory);

                /* at this point, we cannot rollback */
                if (r < 0)
                        return r;
        }

        /* Remount / as the desired mode. Not that this will not
         * reestablish propagation from our side to the host, since
         * what's disconnected is disconnected. */
        if (mount(NULL, "/", NULL, mount_flags | MS_REC, NULL) < 0)
                /* at this point, we cannot rollback */
                return -errno;

        return 0;

fail:
        if (n > 0) {
                for (m = mounts; m < mounts + n; ++m)
                        if (m->done)
                                (void) umount2(m->path, MNT_DETACH);
        }

        return r;
}

static int setup_one_tmp_dir(const char *id, const char *prefix, char **path) {
        _cleanup_free_ char *x = NULL;
        char bid[SD_ID128_STRING_MAX];
        sd_id128_t boot_id;
        int r;

        assert(id);
        assert(prefix);
        assert(path);

        /* We include the boot id in the directory so that after a
         * reboot we can easily identify obsolete directories. */

        r = sd_id128_get_boot(&boot_id);
        if (r < 0)
                return r;

        x = strjoin(prefix, "/systemd-private-", sd_id128_to_string(boot_id, bid), "-", id, "-XXXXXX", NULL);
        if (!x)
                return -ENOMEM;

        RUN_WITH_UMASK(0077)
                if (!mkdtemp(x))
                        return -errno;

        RUN_WITH_UMASK(0000) {
                char *y;

                y = strjoina(x, "/tmp");

                if (mkdir(y, 0777 | S_ISVTX) < 0)
                        return -errno;
        }

        *path = x;
        x = NULL;

        return 0;
}

int setup_tmp_dirs(const char *id, char **tmp_dir, char **var_tmp_dir) {
        char *a, *b;
        int r;

        assert(id);
        assert(tmp_dir);
        assert(var_tmp_dir);

        r = setup_one_tmp_dir(id, "/tmp", &a);
        if (r < 0)
                return r;

        r = setup_one_tmp_dir(id, "/var/tmp", &b);
        if (r < 0) {
                char *t;

                t = strjoina(a, "/tmp");
                rmdir(t);
                rmdir(a);

                free(a);
                return r;
        }

        *tmp_dir = a;
        *var_tmp_dir = b;

        return 0;
}

int setup_netns(int netns_storage_socket[2]) {
        _cleanup_close_ int netns = -1;
        int r, q;

        assert(netns_storage_socket);
        assert(netns_storage_socket[0] >= 0);
        assert(netns_storage_socket[1] >= 0);

        /* We use the passed socketpair as a storage buffer for our
         * namespace reference fd. Whatever process runs this first
         * shall create a new namespace, all others should just join
         * it. To serialize that we use a file lock on the socket
         * pair.
         *
         * It's a bit crazy, but hey, works great! */

        if (lockf(netns_storage_socket[0], F_LOCK, 0) < 0)
                return -errno;

        netns = receive_one_fd(netns_storage_socket[0], MSG_DONTWAIT);
        if (netns == -EAGAIN) {
                /* Nothing stored yet, so let's create a new namespace */

                if (unshare(CLONE_NEWNET) < 0) {
                        r = -errno;
                        goto fail;
                }

                loopback_setup();

                netns = open("/proc/self/ns/net", O_RDONLY|O_CLOEXEC|O_NOCTTY);
                if (netns < 0) {
                        r = -errno;
                        goto fail;
                }

                r = 1;

        } else if (netns < 0) {
                r = netns;
                goto fail;

        } else {
                /* Yay, found something, so let's join the namespace */
                if (setns(netns, CLONE_NEWNET) < 0) {
                        r = -errno;
                        goto fail;
                }

                r = 0;
        }

        q = send_one_fd(netns_storage_socket[1], netns, MSG_DONTWAIT);
        if (q < 0) {
                r = q;
                goto fail;
        }

fail:
        (void) lockf(netns_storage_socket[0], F_ULOCK, 0);
        return r;
}

static const char *const protect_home_table[_PROTECT_HOME_MAX] = {
        [PROTECT_HOME_NO] = "no",
        [PROTECT_HOME_YES] = "yes",
        [PROTECT_HOME_READ_ONLY] = "read-only",
};

DEFINE_STRING_TABLE_LOOKUP(protect_home, ProtectHome);

static const char *const protect_system_table[_PROTECT_SYSTEM_MAX] = {
        [PROTECT_SYSTEM_NO] = "no",
        [PROTECT_SYSTEM_YES] = "yes",
        [PROTECT_SYSTEM_FULL] = "full",
};

DEFINE_STRING_TABLE_LOOKUP(protect_system, ProtectSystem);
Commit	Line	Data
663996b3 MS	1	/***
	2	This file is part of systemd.
	3
	4	Copyright 2010 Lennart Poettering
	5
	6	systemd is free software; you can redistribute it and/or modify it
	7	under the terms of the GNU Lesser General Public License as published by
	8	the Free Software Foundation; either version 2.1 of the License, or
	9	(at your option) any later version.
	10
	11	systemd is distributed in the hope that it will be useful, but
	12	WITHOUT ANY WARRANTY; without even the implied warranty of
	13	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	14	Lesser General Public License for more details.
	15
	16	You should have received a copy of the GNU Lesser General Public License
	17	along with systemd; If not, see <http://www.gnu.org/licenses/>.
	18	***/
	19
	20	#include <errno.h>
db2df898	21	#include <sched.h>
663996b3	22	#include <stdio.h>
db2df898 MP	23	#include <string.h>
db2df898 MP	24	#include <sys/mount.h>
663996b3	25	#include <sys/stat.h>
db2df898	26	#include <unistd.h>
663996b3 MS	27	#include <linux/fs.h>
663996b3 MS	28
db2df898	29	#include "alloc-util.h"
60f067b4	30	#include "dev-setup.h"
db2df898 MP	31	#include "fd-util.h"
	32	#include "loopback-setup.h"
	33	#include "missing.h"
e3bff60a	34	#include "mkdir.h"
db2df898 MP	35	#include "mount-util.h"
	36	#include "namespace.h"
	37	#include "path-util.h"
	38	#include "selinux-util.h"
	39	#include "socket-util.h"
	40	#include "string-table.h"
	41	#include "string-util.h"
	42	#include "strv.h"
	43	#include "umask-util.h"
	44	#include "user-util.h"
	45	#include "util.h"
663996b3	46
aa27b158 MP	47	#define DEV_MOUNT_OPTIONS (MS_NOSUID\|MS_STRICTATIME\|MS_NOEXEC)
aa27b158 MP	48
663996b3 MS	49	typedef enum MountMode {
	50	/* This is ordered by priority! */
	51	INACCESSIBLE,
	52	READONLY,
	53	PRIVATE_TMP,
	54	PRIVATE_VAR_TMP,
60f067b4	55	PRIVATE_DEV,
663996b3 MS	56	READWRITE
	57	} MountMode;
	58
	59	typedef struct BindMount {
	60	const char *path;
	61	MountMode mode;
	62	bool done;
14228c0d	63	bool ignore;
663996b3 MS	64	} BindMount;
	65
	66	static int append_mounts(BindMount p, char strv, MountMode mode) {
	67	char **i;
	68
60f067b4 JS	69	assert(p);
60f067b4 JS	70
663996b3 MS	71	STRV_FOREACH(i, strv) {
663996b3 MS	72
14228c0d	73	(*p)->ignore = false;
e842803a	74	(*p)->done = false;
14228c0d	75
60f067b4	76	if ((mode == INACCESSIBLE \|\| mode == READONLY \|\| mode == READWRITE) && (*i)[0] == '-') {
14228c0d MB	77	(*p)->ignore = true;
	78	(*i)++;
	79	}
	80
663996b3 MS	81	if (!path_is_absolute(*i))
	82	return -EINVAL;
	83
	84	(p)->path = i;
	85	(*p)->mode = mode;
	86	(*p)++;
	87	}
	88
	89	return 0;
	90	}
	91
	92	static int mount_path_compare(const void a, const void b) {
	93	const BindMount p = a, q = b;
e3bff60a	94	int d;
663996b3	95
e3bff60a	96	d = path_compare(p->path, q->path);
663996b3	97
e3bff60a	98	if (d == 0) {
663996b3 MS	99	/* If the paths are equal, check the mode */
	100	if (p->mode < q->mode)
	101	return -1;
	102
	103	if (p->mode > q->mode)
	104	return 1;
	105
	106	return 0;
	107	}
	108
	109	/* If the paths are not equal, then order prefixes first */
e3bff60a	110	return d;
663996b3 MS	111	}
	112
	113	static void drop_duplicates(BindMount m, unsigned n) {
	114	BindMount f, t, *previous;
	115
	116	assert(m);
	117	assert(n);
	118
	119	for (f = m, t = m, previous = NULL; f < m+*n; f++) {
	120
	121	/* The first one wins */
	122	if (previous && path_equal(f->path, previous->path))
	123	continue;
	124
5eef597e	125	t = f;
663996b3 MS	126
	127	previous = t;
	128
	129	t++;
	130	}
	131
	132	*n = t - m;
	133	}
	134
60f067b4 JS	135	static int mount_dev(BindMount *m) {
	136	static const char devnodes[] =
	137	"/dev/null\0"
	138	"/dev/zero\0"
	139	"/dev/full\0"
	140	"/dev/random\0"
	141	"/dev/urandom\0"
	142	"/dev/tty\0";
	143
	144	char temporary_mount[] = "/tmp/namespace-dev-XXXXXX";
f47781d8	145	const char d, dev = NULL, devpts = NULL, devshm = NULL, devhugepages = NULL, devmqueue = NULL, devlog = NULL, devptmx = NULL;
60f067b4 JS	146	_cleanup_umask_ mode_t u;
	147	int r;
	148
	149	assert(m);
	150
	151	u = umask(0000);
	152
	153	if (!mkdtemp(temporary_mount))
	154	return -errno;
	155
e735f4d4	156	dev = strjoina(temporary_mount, "/dev");
e3bff60a	157	(void) mkdir(dev, 0755);
aa27b158	158	if (mount("tmpfs", dev, "tmpfs", DEV_MOUNT_OPTIONS, "mode=755") < 0) {
60f067b4 JS	159	r = -errno;
	160	goto fail;
	161	}
	162
e735f4d4	163	devpts = strjoina(temporary_mount, "/dev/pts");
e3bff60a	164	(void) mkdir(devpts, 0755);
60f067b4 JS	165	if (mount("/dev/pts", devpts, NULL, MS_BIND, NULL) < 0) {
	166	r = -errno;
	167	goto fail;
	168	}
	169
e735f4d4	170	devptmx = strjoina(temporary_mount, "/dev/ptmx");
e3bff60a MP	171	if (symlink("pts/ptmx", devptmx) < 0) {
	172	r = -errno;
	173	goto fail;
	174	}
60f067b4	175
e735f4d4	176	devshm = strjoina(temporary_mount, "/dev/shm");
e3bff60a	177	(void) mkdir(devshm, 01777);
60f067b4 JS	178	r = mount("/dev/shm", devshm, NULL, MS_BIND, NULL);
	179	if (r < 0) {
	180	r = -errno;
	181	goto fail;
	182	}
	183
e735f4d4	184	devmqueue = strjoina(temporary_mount, "/dev/mqueue");
e3bff60a MP	185	(void) mkdir(devmqueue, 0755);
e3bff60a MP	186	(void) mount("/dev/mqueue", devmqueue, NULL, MS_BIND, NULL);
60f067b4	187
e735f4d4	188	devhugepages = strjoina(temporary_mount, "/dev/hugepages");
e3bff60a MP	189	(void) mkdir(devhugepages, 0755);
e3bff60a MP	190	(void) mount("/dev/hugepages", devhugepages, NULL, MS_BIND, NULL);
60f067b4	191
e735f4d4	192	devlog = strjoina(temporary_mount, "/dev/log");
e3bff60a	193	(void) symlink("/run/systemd/journal/dev-log", devlog);
60f067b4 JS	194
	195	NULSTR_FOREACH(d, devnodes) {
	196	_cleanup_free_ char *dn = NULL;
	197	struct stat st;
	198
	199	r = stat(d, &st);
	200	if (r < 0) {
	201
	202	if (errno == ENOENT)
	203	continue;
	204
	205	r = -errno;
	206	goto fail;
	207	}
	208
	209	if (!S_ISBLK(st.st_mode) &&
	210	!S_ISCHR(st.st_mode)) {
	211	r = -EINVAL;
	212	goto fail;
	213	}
	214
	215	if (st.st_rdev == 0)
	216	continue;
	217
	218	dn = strappend(temporary_mount, d);
	219	if (!dn) {
	220	r = -ENOMEM;
	221	goto fail;
	222	}
	223
5eef597e	224	mac_selinux_create_file_prepare(d, st.st_mode);
60f067b4	225	r = mknod(dn, st.st_mode, st.st_rdev);
5eef597e	226	mac_selinux_create_file_clear();
e842803a	227
60f067b4 JS	228	if (r < 0) {
	229	r = -errno;
	230	goto fail;
	231	}
	232	}
	233
e3bff60a MP	234	dev_setup(temporary_mount, UID_INVALID, GID_INVALID);
	235
	236	/* Create the /dev directory if missing. It is more likely to be
	237	* missing when the service is started with RootDirectory. This is
	238	* consistent with mount units creating the mount points when missing.
	239	*/
	240	(void) mkdir_p_label(m->path, 0755);
60f067b4	241
aa27b158 MP	242	/* Unmount everything in old /dev */
aa27b158 MP	243	umount_recursive(m->path, 0);
e3bff60a	244	if (mount(dev, m->path, NULL, MS_MOVE, NULL) < 0) {
60f067b4 JS	245	r = -errno;
	246	goto fail;
	247	}
	248
	249	rmdir(dev);
	250	rmdir(temporary_mount);
	251
	252	return 0;
	253
	254	fail:
	255	if (devpts)
	256	umount(devpts);
	257
	258	if (devshm)
	259	umount(devshm);
	260
60f067b4 JS	261	if (devhugepages)
	262	umount(devhugepages);
	263
	264	if (devmqueue)
	265	umount(devmqueue);
	266
5eef597e MP	267	umount(dev);
	268	rmdir(dev);
	269	rmdir(temporary_mount);
	270
	271	return r;
	272	}
	273
663996b3 MS	274	static int apply_mount(
	275	BindMount *m,
	276	const char *tmp_dir,
	277	const char *var_tmp_dir) {
	278
	279	const char *what;
	280	int r;
5a920b42	281	struct stat target;
663996b3 MS	282
	283	assert(m);
	284
	285	switch (m->mode) {
	286
	287	case INACCESSIBLE:
60f067b4 JS	288
	289	/* First, get rid of everything that is below if there
	290	* is anything... Then, overmount it with an
5a920b42	291	* inaccessible path. */
60f067b4 JS	292	umount_recursive(m->path, 0);
60f067b4 JS	293
5a920b42 MP	294	if (lstat(m->path, &target) < 0) {
	295	if (m->ignore && errno == ENOENT)
	296	return 0;
	297	return -errno;
	298	}
663996b3	299
5a920b42 MP	300	what = mode_to_inaccessible_node(target.st_mode);
	301	if (!what) {
	302	log_debug("File type not supported for inaccessible mounts. Note that symlinks are not allowed");
	303	return -ELOOP;
	304	}
	305	break;
663996b3 MS	306	case READONLY:
663996b3 MS	307	case READWRITE:
60f067b4 JS	308	/* Nothing to mount here, we just later toggle the
	309	* MS_RDONLY bit for the mount point */
	310	return 0;
663996b3 MS	311
	312	case PRIVATE_TMP:
	313	what = tmp_dir;
	314	break;
	315
	316	case PRIVATE_VAR_TMP:
	317	what = var_tmp_dir;
	318	break;
	319
60f067b4 JS	320	case PRIVATE_DEV:
	321	return mount_dev(m);
	322
663996b3 MS	323	default:
	324	assert_not_reached("Unknown mode");
	325	}
	326
	327	assert(what);
	328
	329	r = mount(what, m->path, NULL, MS_BIND\|MS_REC, NULL);
5a920b42	330	if (r >= 0) {
663996b3	331	log_debug("Successfully mounted %s to %s", what, m->path);
5a920b42 MP	332	return r;
	333	} else {
	334	if (m->ignore && errno == ENOENT)
	335	return 0;
	336	return log_debug_errno(errno, "Failed to mount %s to %s: %m", what, m->path);
	337	}
663996b3 MS	338	}
	339
	340	static int make_read_only(BindMount *m) {
	341	int r;
	342
	343	assert(m);
	344
60f067b4 JS	345	if (IN_SET(m->mode, INACCESSIBLE, READONLY))
60f067b4 JS	346	r = bind_remount_recursive(m->path, true);
aa27b158	347	else if (IN_SET(m->mode, READWRITE, PRIVATE_TMP, PRIVATE_VAR_TMP, PRIVATE_DEV)) {
60f067b4	348	r = bind_remount_recursive(m->path, false);
aa27b158	349	if (r == 0 && m->mode == PRIVATE_DEV) /* can be readonly but the submounts can't*/
5a920b42 MP	350	if (mount(NULL, m->path, NULL, MS_REMOUNT\|DEV_MOUNT_OPTIONS\|MS_RDONLY, NULL) < 0)
5a920b42 MP	351	r = -errno;
aa27b158	352	} else
60f067b4 JS	353	r = 0;
	354
	355	if (m->ignore && r == -ENOENT)
663996b3 MS	356	return 0;
663996b3 MS	357
60f067b4 JS	358	return r;
	359	}
	360
	361	int setup_namespace(
e3bff60a	362	const char* root_directory,
5a920b42 MP	363	char** read_write_paths,
	364	char** read_only_paths,
	365	char** inaccessible_paths,
5eef597e MP	366	const char* tmp_dir,
5eef597e MP	367	const char* var_tmp_dir,
60f067b4 JS	368	bool private_dev,
	369	ProtectHome protect_home,
	370	ProtectSystem protect_system,
e735f4d4	371	unsigned long mount_flags) {
60f067b4 JS	372
	373	BindMount m, mounts = NULL;
	374	unsigned n;
	375	int r = 0;
	376
	377	if (mount_flags == 0)
	378	mount_flags = MS_SHARED;
	379
	380	if (unshare(CLONE_NEWNS) < 0)
663996b3 MS	381	return -errno;
663996b3 MS	382
aa27b158	383	n = !!tmp_dir + !!var_tmp_dir +
5a920b42 MP	384	strv_length(read_write_paths) +
	385	strv_length(read_only_paths) +
	386	strv_length(inaccessible_paths) +
60f067b4 JS	387	private_dev +
	388	(protect_home != PROTECT_HOME_NO ? 3 : 0) +
	389	(protect_system != PROTECT_SYSTEM_NO ? 2 : 0) +
	390	(protect_system == PROTECT_SYSTEM_FULL ? 1 : 0);
	391
	392	if (n > 0) {
e842803a	393	m = mounts = (BindMount ) alloca0(n sizeof(BindMount));
5a920b42	394	r = append_mounts(&m, read_write_paths, READWRITE);
60f067b4 JS	395	if (r < 0)
	396	return r;
	397
5a920b42	398	r = append_mounts(&m, read_only_paths, READONLY);
60f067b4 JS	399	if (r < 0)
	400	return r;
	401
5a920b42	402	r = append_mounts(&m, inaccessible_paths, INACCESSIBLE);
60f067b4 JS	403	if (r < 0)
	404	return r;
	405
	406	if (tmp_dir) {
e3bff60a	407	m->path = prefix_roota(root_directory, "/tmp");
60f067b4 JS	408	m->mode = PRIVATE_TMP;
	409	m++;
	410	}
	411
	412	if (var_tmp_dir) {
e3bff60a	413	m->path = prefix_roota(root_directory, "/var/tmp");
60f067b4 JS	414	m->mode = PRIVATE_VAR_TMP;
	415	m++;
	416	}
	417
	418	if (private_dev) {
e3bff60a	419	m->path = prefix_roota(root_directory, "/dev");
60f067b4 JS	420	m->mode = PRIVATE_DEV;
	421	m++;
	422	}
	423
	424	if (protect_home != PROTECT_HOME_NO) {
e3bff60a MP	425	const char home_dir, run_user_dir, *root_dir;
	426
	427	home_dir = prefix_roota(root_directory, "/home");
	428	home_dir = strjoina("-", home_dir);
	429	run_user_dir = prefix_roota(root_directory, "/run/user");
	430	run_user_dir = strjoina("-", run_user_dir);
	431	root_dir = prefix_roota(root_directory, "/root");
	432	root_dir = strjoina("-", root_dir);
	433
	434	r = append_mounts(&m, STRV_MAKE(home_dir, run_user_dir, root_dir),
	435	protect_home == PROTECT_HOME_READ_ONLY ? READONLY : INACCESSIBLE);
60f067b4 JS	436	if (r < 0)
	437	return r;
	438	}
	439
	440	if (protect_system != PROTECT_SYSTEM_NO) {
e3bff60a MP	441	const char usr_dir, boot_dir, *etc_dir;
e3bff60a MP	442
86f210e9	443	usr_dir = prefix_roota(root_directory, "/usr");
e3bff60a MP	444	boot_dir = prefix_roota(root_directory, "/boot");
	445	boot_dir = strjoina("-", boot_dir);
	446	etc_dir = prefix_roota(root_directory, "/etc");
	447
	448	r = append_mounts(&m, protect_system == PROTECT_SYSTEM_FULL
	449	? STRV_MAKE(usr_dir, boot_dir, etc_dir)
	450	: STRV_MAKE(usr_dir, boot_dir), READONLY);
60f067b4 JS	451	if (r < 0)
	452	return r;
	453	}
	454
	455	assert(mounts + n == m);
	456
	457	qsort(mounts, n, sizeof(BindMount), mount_path_compare);
	458	drop_duplicates(mounts, &n);
	459	}
	460
e3bff60a	461	if (n > 0 \|\| root_directory) {
60f067b4 JS	462	/* Remount / as SLAVE so that nothing now mounted in the namespace
	463	shows up in the parent */
	464	if (mount(NULL, "/", NULL, MS_SLAVE\|MS_REC, NULL) < 0)
	465	return -errno;
e3bff60a MP	466	}
	467
	468	if (root_directory) {
	469	/* Turn directory into bind mount */
	470	if (mount(root_directory, root_directory, NULL, MS_BIND\|MS_REC, NULL) < 0)
	471	return -errno;
	472	}
60f067b4	473
e3bff60a	474	if (n > 0) {
60f067b4 JS	475	for (m = mounts; m < mounts + n; ++m) {
	476	r = apply_mount(m, tmp_dir, var_tmp_dir);
	477	if (r < 0)
	478	goto fail;
	479	}
	480
	481	for (m = mounts; m < mounts + n; ++m) {
	482	r = make_read_only(m);
	483	if (r < 0)
	484	goto fail;
	485	}
	486	}
	487
e3bff60a MP	488	if (root_directory) {
	489	/* MS_MOVE does not work on MS_SHARED so the remount MS_SHARED will be done later */
	490	r = mount_move_root(root_directory);
	491
	492	/* at this point, we cannot rollback */
	493	if (r < 0)
	494	return r;
	495	}
	496
60f067b4 JS	497	/* Remount / as the desired mode. Not that this will not
	498	* reestablish propagation from our side to the host, since
	499	* what's disconnected is disconnected. */
6300502b	500	if (mount(NULL, "/", NULL, mount_flags \| MS_REC, NULL) < 0)
e3bff60a MP	501	/* at this point, we cannot rollback */
e3bff60a MP	502	return -errno;
60f067b4	503
663996b3	504	return 0;
60f067b4 JS	505
	506	fail:
	507	if (n > 0) {
	508	for (m = mounts; m < mounts + n; ++m)
	509	if (m->done)
e3bff60a	510	(void) umount2(m->path, MNT_DETACH);
60f067b4 JS	511	}
	512
	513	return r;
663996b3 MS	514	}
663996b3 MS	515
60f067b4 JS	516	static int setup_one_tmp_dir(const char id, const char prefix, char **path) {
	517	_cleanup_free_ char *x = NULL;
	518	char bid[SD_ID128_STRING_MAX];
	519	sd_id128_t boot_id;
	520	int r;
	521
	522	assert(id);
	523	assert(prefix);
	524	assert(path);
	525
	526	/* We include the boot id in the directory so that after a
	527	* reboot we can easily identify obsolete directories. */
	528
	529	r = sd_id128_get_boot(&boot_id);
	530	if (r < 0)
	531	return r;
	532
	533	x = strjoin(prefix, "/systemd-private-", sd_id128_to_string(boot_id, bid), "-", id, "-XXXXXX", NULL);
	534	if (!x)
	535	return -ENOMEM;
	536
	537	RUN_WITH_UMASK(0077)
	538	if (!mkdtemp(x))
	539	return -errno;
	540
	541	RUN_WITH_UMASK(0000) {
	542	char *y;
	543
e735f4d4	544	y = strjoina(x, "/tmp");
60f067b4 JS	545
	546	if (mkdir(y, 0777 \| S_ISVTX) < 0)
	547	return -errno;
	548	}
	549
	550	*path = x;
	551	x = NULL;
663996b3	552
60f067b4 JS	553	return 0;
	554	}
	555
	556	int setup_tmp_dirs(const char id, char tmp_dir, char *var_tmp_dir) {
	557	char a, b;
	558	int r;
	559
	560	assert(id);
663996b3 MS	561	assert(tmp_dir);
	562	assert(var_tmp_dir);
	563
60f067b4	564	r = setup_one_tmp_dir(id, "/tmp", &a);
663996b3 MS	565	if (r < 0)
	566	return r;
	567
60f067b4 JS	568	r = setup_one_tmp_dir(id, "/var/tmp", &b);
	569	if (r < 0) {
	570	char *t;
663996b3	571
e735f4d4	572	t = strjoina(a, "/tmp");
60f067b4 JS	573	rmdir(t);
60f067b4 JS	574	rmdir(a);
663996b3	575
60f067b4 JS	576	free(a);
	577	return r;
	578	}
	579
	580	*tmp_dir = a;
	581	*var_tmp_dir = b;
	582
	583	return 0;
663996b3 MS	584	}
663996b3 MS	585
60f067b4 JS	586	int setup_netns(int netns_storage_socket[2]) {
60f067b4 JS	587	_cleanup_close_ int netns = -1;
6300502b	588	int r, q;
663996b3	589
60f067b4 JS	590	assert(netns_storage_socket);
	591	assert(netns_storage_socket[0] >= 0);
	592	assert(netns_storage_socket[1] >= 0);
663996b3	593
60f067b4 JS	594	/* We use the passed socketpair as a storage buffer for our
	595	* namespace reference fd. Whatever process runs this first
	596	* shall create a new namespace, all others should just join
	597	* it. To serialize that we use a file lock on the socket
	598	* pair.
	599	*
	600	* It's a bit crazy, but hey, works great! */
	601
	602	if (lockf(netns_storage_socket[0], F_LOCK, 0) < 0)
663996b3 MS	603	return -errno;
663996b3 MS	604
6300502b MP	605	netns = receive_one_fd(netns_storage_socket[0], MSG_DONTWAIT);
6300502b MP	606	if (netns == -EAGAIN) {
60f067b4	607	/* Nothing stored yet, so let's create a new namespace */
663996b3	608
60f067b4 JS	609	if (unshare(CLONE_NEWNET) < 0) {
	610	r = -errno;
	611	goto fail;
	612	}
663996b3	613
60f067b4	614	loopback_setup();
663996b3	615
60f067b4 JS	616	netns = open("/proc/self/ns/net", O_RDONLY\|O_CLOEXEC\|O_NOCTTY);
	617	if (netns < 0) {
	618	r = -errno;
	619	goto fail;
	620	}
663996b3	621
60f067b4	622	r = 1;
663996b3	623
6300502b MP	624	} else if (netns < 0) {
	625	r = netns;
	626	goto fail;
663996b3	627
6300502b MP	628	} else {
6300502b MP	629	/* Yay, found something, so let's join the namespace */
60f067b4 JS	630	if (setns(netns, CLONE_NEWNET) < 0) {
	631	r = -errno;
	632	goto fail;
	633	}
663996b3	634
60f067b4	635	r = 0;
663996b3 MS	636	}
663996b3 MS	637
6300502b MP	638	q = send_one_fd(netns_storage_socket[1], netns, MSG_DONTWAIT);
	639	if (q < 0) {
	640	r = q;
60f067b4	641	goto fail;
663996b3 MS	642	}
663996b3 MS	643
60f067b4	644	fail:
5a920b42	645	(void) lockf(netns_storage_socket[0], F_ULOCK, 0);
663996b3 MS	646	return r;
663996b3 MS	647	}
60f067b4 JS	648
	649	static const char *const protect_home_table[_PROTECT_HOME_MAX] = {
	650	[PROTECT_HOME_NO] = "no",
	651	[PROTECT_HOME_YES] = "yes",
	652	[PROTECT_HOME_READ_ONLY] = "read-only",
	653	};
	654
	655	DEFINE_STRING_TABLE_LOOKUP(protect_home, ProtectHome);
	656
	657	static const char *const protect_system_table[_PROTECT_SYSTEM_MAX] = {
	658	[PROTECT_SYSTEM_NO] = "no",
	659	[PROTECT_SYSTEM_YES] = "yes",
	660	[PROTECT_SYSTEM_FULL] = "full",
	661	};
	662
	663	DEFINE_STRING_TABLE_LOOKUP(protect_system, ProtectSystem);