picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Systemd/src/nspawn/nspawn.c

4501 lines
166 KiB
C
Raw Normal View History

nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
/***
This file is part of systemd.
Copyright 2010 Lennart Poettering
systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 00:20:58 +02:00
under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation; either version 2.1 of the License, or
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
(at your option) any later version.
systemd is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 00:20:58 +02:00
Lesser General Public License for more details.
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 00:20:58 +02:00
You should have received a copy of the GNU Lesser General Public License
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/
#include <signal.h>
#include <sched.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <errno.h>
#include <sys/prctl.h>
#include <getopt.h>
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
#include <grp.h>
PATCH: add missing header include Hi, MS_REC is not always defined in sys/mount.h. linux/fs.h should be included, since it is always defined there. -- Frederic Crozat <fcrozat@suse.com> SUSE >From 9f8a50decf45aaa4436b9fb3a0ab360f238b7d96 Mon Sep 17 00:00:00 2001 From: Frederic Crozat <fcrozat@suse.com> Date: Thu, 18 Aug 2011 15:42:29 +0200 Subject: [PATCH] nspawn: add missing include header for MS_REC.
2011-08-18 15:50:43 +02:00
#include <linux/fs.h>
nspawn: add missing include lines
2012-04-13 21:33:45 +02:00
#include <sys/socket.h>
nspawn: Reorder includes to fix compilation Commit 2e996f4d4b642c5682c608c9692ad2ffae398ab2 added an include of linux/netlink.h This kernel header is not self contained in the linux 2.6 kernel which breaks compilation with an unknown type sa_family_t A workaround is to include linux/netlink.h after sys/socket.h
2013-07-19 11:40:44 +02:00
#include <linux/netlink.h>
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
#include <net/if.h>
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
#include <linux/veth.h>
nspawn: add new --personality= switch to make it easier to run 32bit containers on a 64bit host
2014-02-18 23:35:19 +01:00
#include <sys/personality.h>
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
#include <linux/loop.h>
inspawn: wait until udev has probed a loopback device before making us of it
2015-01-19 20:21:57 +01:00
#include <sys/file.h>
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
nspawn: fix HAVE_SELINUX ifdef
2014-02-05 17:07:20 +01:00
#ifdef HAVE_SELINUX
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
#include <selinux/selinux.h>
#endif
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOTSUPPORT in containers The kernel still doesn't support audit in containers, so let's make use of seccomp and simply turn it off entirely. We can get rid of this big as soon as the kernel is fixed again.
2014-02-13 20:30:02 +01:00
#ifdef HAVE_SECCOMP
#include <seccomp.h>
#endif
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
#ifdef HAVE_BLKID
#include <blkid/blkid.h>
#endif
shared: add random-util.[ch]
2015-04-10 22:27:10 +02:00
#include "random-util.h"
nspawn: explicitly terminate machines when we exit nspawn https://bugs.freedesktop.org/show_bug.cgi?id=68370 https://bugzilla.redhat.com/show_bug.cgi?id=988883
2013-11-06 02:05:06 +01:00
#include "sd-daemon.h"
#include "sd-bus.h"
#include "sd-id128.h"
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
#include "sd-rtnl.h"
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
#include "log.h"
#include "util.h"
rename basic.la to shared.la and put selinux deps in shared-selinx.la Only 34 of 74 tools need libselinux linked, and libselinux is a pain with its unconditional library constructor.
2012-04-10 21:54:31 +02:00
#include "mkdir.h"
util: rework rm_rf() logic - Move to its own file rm-rf.c - Change parameters into a single flags parameter - Remove "honour sticky" logic, it's unused these days
2015-04-04 11:52:57 +02:00
#include "rm-rf.h"
nspawn: use automatic cleanup This one actually clears up a (totally harmless) memleak.
2012-09-16 15:09:47 +02:00
#include "macro.h"
nspawn: define MS_MOVE manually if needed
2011-03-14 03:27:28 +01:00
#include "missing.h"
nspawn: move container into its own name=systemd cgroup
2011-03-14 22:33:31 +01:00
#include "cgroup-util.h"
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
#include "strv.h"
util: split-out path-util.[ch]
2012-05-07 21:36:12 +02:00
#include "path-util.h"
nspawn: add new --no-net switch to turn off networking in the container
2011-08-02 04:49:37 +02:00
#include "loopback-setup.h"
nspawn: add /dev FD symlinks in container setup This creates /dev/fd, /dev/stdin, /dev/stdout, /dev/stderr, and /dev/core as symlinks to /proc on container creation. Except for /dev/core, these are needed for shells like bash to be fully functional.
2012-08-15 02:00:31 +02:00
#include "dev-setup.h"
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
#include "fdset.h"
nspawn: add --version
2013-01-11 22:03:49 +01:00
#include "build.h"
honor SELinux labels, when creating and writing config files Also split out some fileio functions to fileio.c and provide a SELinux aware pendant in fileio-label.c see https://bugzilla.redhat.com/show_bug.cgi?id=881577
2013-02-14 12:26:13 +01:00
#include "fileio.h"
timedated: use libsystemd-bus instead of libdbus for bus communication Among other things this also adds a few things necessary for the change: - Considerably more powerful error returning APIs in libsystemd-bus - Adapter for connecting an sd_bus to an sd_event - As I reworked the PolicyKit logic to the new library I also made it asynchronous, so that PolicyKit requests of one user cannot block out another user anymore. - We always use the macro names for common bus error. That way it is harder to mistype them since the compiler will notice
2013-10-16 06:10:04 +02:00
#include "bus-util.h"
nspawn: explicitly terminate machines when we exit nspawn https://bugs.freedesktop.org/show_bug.cgi?id=68370 https://bugzilla.redhat.com/show_bug.cgi?id=988883
2013-11-06 02:05:06 +01:00
#include "bus-error.h"
nspawn: split out pty forwaring logic into ptyfwd.c
2013-10-30 18:58:59 +01:00
#include "ptyfwd.h"
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
#include "env-util.h"
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
#include "rtnl-util.h"
nspawn: check with udev before we take possession of an interface
2014-02-13 14:38:02 +01:00
#include "udev-util.h"
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
#include "blkid-util.h"
#include "gpt.h"
nspawn: make host0's MAC address persistent We still need to make sure that no two MAC addresses are the same, so we use a logic similar to what is used in udev to generate MAC addresses, and base it on a hash of the host's machine ID and thecontainer's name.
2014-03-13 17:47:30 +01:00
#include "siphash24.h"
tmpfiles: add new "C" line for copying files or directories
2014-06-10 23:02:40 +02:00
#include "copy.h"
nspawn: create essential base directories at system bootup This allows us to bootup a rootfs with a /usr directory only.
2014-06-24 13:30:11 +02:00
#include "base-filesystem.h"
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
#include "barrier.h"
ptyforward: rework PTY forwarder logic used by nspawn to utilize the normal event loop We really should not run manual event loops anymore, but standardize on sd_event, so that we can run sd_bus connections from it eventually.
2014-10-31 16:54:11 +01:00
#include "event-util.h"
nspawn: remove spurious include of <sys/capability.h> It does not use any functions from libcap directly. The CAP_* constants in use through this file come from "missing.h" which will import <linux/capability.h> and complement it with CAP_* constants not defined by the current kernel headers. Add an explicit import of our "capability.h" since it does use the function capability_bounding_set_drop from that header file. Previously, that header was implicitly imported through through "cap-list.h". Tested that "systemd-nspawn" builds cleanly and works after this change.
2014-12-23 19:38:42 +01:00
#include "capability.h"
util: introduce our own gperf based capability list This way, we can ensure we have a more complete, up-to-date list of capabilities around, always.
2014-12-10 03:16:14 +01:00
#include "cap-list.h"
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
#include "btrfs-util.h"
nspawn: use the same image discovery logic in nspawn as in machined
2014-12-27 02:07:29 +01:00
#include "machine-image.h"
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
#include "list.h"
#include "in-addr-util.h"
#include "fw-util.h"
#include "local-addresses.h"
shared: add formats-util.h
2015-04-10 20:43:52 +02:00
#include "formats-util.h"
shared: add process-util.[ch]
2015-04-10 19:10:00 +02:00
#include "process-util.h"
shared: add terminal-util.[ch]
2015-04-10 23:15:59 +02:00
#include "terminal-util.h"
nspawn: create a separate devpts namespace for nspawn containers
2013-03-07 13:34:07 +01:00
seccomp: add helper call to add all secondary archs to a seccomp filter And make use of it where appropriate for executing services and for nspawn.
2014-02-18 22:14:00 +01:00
#ifdef HAVE_SECCOMP
#include "seccomp-util.h"
#endif
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
typedef struct ExposePort {
int protocol;
uint16_t host_port;
uint16_t container_port;
LIST_FIELDS(struct ExposePort, ports);
} ExposePort;
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
typedef enum ContainerStatus {
CONTAINER_TERMINATED,
CONTAINER_REBOOTED
} ContainerStatus;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
typedef enum LinkJournal {
LINK_NO,
LINK_AUTO,
LINK_HOST,
LINK_GUEST
} LinkJournal;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
typedef enum Volatile {
VOLATILE_NO,
VOLATILE_YES,
VOLATILE_STATE,
} Volatile;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
static char *arg_directory = NULL;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
static char *arg_template = NULL;
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
static char *arg_user = NULL;
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
static sd_id128_t arg_uuid = {};
nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.
2013-04-16 04:36:06 +02:00
static char *arg_machine = NULL;
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
static const char *arg_selinux_context = NULL;
static const char *arg_selinux_apifs_context = NULL;
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
static const char *arg_slice = NULL;
exec: introduce PrivateNetwork= process option to turn off network access to specific services
2011-08-02 05:24:58 +02:00
static bool arg_private_network = false;
nspawn: add --read-only switch
2012-04-25 15:11:20 +02:00
static bool arg_read_only = false;
nspawn: add -b switch to automatically look for an init binary
2012-04-22 13:37:24 +02:00
static bool arg_boot = false;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
static bool arg_ephemeral = false;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
static LinkJournal arg_link_journal = LINK_AUTO;
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
static bool arg_link_journal_try = false;
nspawn: introduce new --capabilities= flag and make use of it in the nspawn test case
2012-06-28 13:44:39 +02:00
static uint64_t arg_retain =
(1ULL << CAP_CHOWN) |
(1ULL << CAP_DAC_OVERRIDE) |
(1ULL << CAP_DAC_READ_SEARCH) |
(1ULL << CAP_FOWNER) |
(1ULL << CAP_FSETID) |
(1ULL << CAP_IPC_OWNER) |
(1ULL << CAP_KILL) |
(1ULL << CAP_LEASE) |
(1ULL << CAP_LINUX_IMMUTABLE) |
(1ULL << CAP_NET_BIND_SERVICE) |
(1ULL << CAP_NET_BROADCAST) |
(1ULL << CAP_NET_RAW) |
(1ULL << CAP_SETGID) |
(1ULL << CAP_SETFCAP) |
(1ULL << CAP_SETPCAP) |
(1ULL << CAP_SETUID) |
(1ULL << CAP_SYS_ADMIN) |
(1ULL << CAP_SYS_CHROOT) |
(1ULL << CAP_SYS_NICE) |
(1ULL << CAP_SYS_PTRACE) |
(1ULL << CAP_SYS_TTY_CONFIG) |
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
(1ULL << CAP_SYS_RESOURCE) |
nspawn: add audit caps to default set to keep Due to the brokeness of much of the userspace audit code we cannot really start too many systems without the audit caps set. To make nspawn easier to use just add the audit caps by default. To boot up containers successfully the kernel's auditing needs to be turned off still (use "audit=0" on the kernel command line), but at least no manual caps have to be passed anymore. In the long run auditing will be fixed for containers and ve virtualized properly at which time it should be safe to enable these caps anyway.
2013-01-18 18:13:01 +01:00
(1ULL << CAP_SYS_BOOT) |
(1ULL << CAP_AUDIT_WRITE) |
exec: introduce PrivateDevices= switch to provide services with a private /dev Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that sets up a private /dev with only the API pseudo-devices like /dev/null, /dev/zero, /dev/random, but not any physical devices in them.
2014-01-20 19:54:51 +01:00
(1ULL << CAP_AUDIT_CONTROL) |
(1ULL << CAP_MKNOD);
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
static char **arg_bind = NULL;
static char **arg_bind_ro = NULL;
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
static char **arg_tmpfs = NULL;
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
static char **arg_setenv = NULL;
nspawn: add --quiet switch for turning off any output noise
2014-02-06 00:43:14 +01:00
static bool arg_quiet = false;
nspawn: add new --share-system switch to run a container without PID/UTS/IPC namespacing
2014-02-10 13:15:42 +01:00
static bool arg_share_system = false;
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
static bool arg_register = true;
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
static bool arg_keep_unit = false;
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
static char **arg_network_interfaces = NULL;
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
static char **arg_network_macvlan = NULL;
nspawn: add ipvlan support
2015-01-20 00:18:28 +01:00
static char **arg_network_ipvlan = NULL;
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
static bool arg_network_veth = false;
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
static const char *arg_network_bridge = NULL;
nspawn: add new --personality= switch to make it easier to run 32bit containers on a 64bit host
2014-02-18 23:35:19 +01:00
static unsigned long arg_personality = 0xffffffffLU;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
static char *arg_image = NULL;
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
static Volatile arg_volatile = VOLATILE_NO;
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
static ExposePort *arg_expose_ports = NULL;
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
static char **arg_property = NULL;
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
static bool arg_userns = false;
nspawn: make kill signal to use for PID 1 configurable
2015-02-25 22:04:48 +01:00
static int arg_kill_signal = 0;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
Unify parse_argv style getopt is usually good at printing out a nice error message when commandline options are invalid. It distinguishes between an unknown option and a known option with a missing arg. It is better to let it do its job and not use opterr=0 unless we actually want to suppress messages. So remove opterr=0 in the few places where it wasn't really useful. When an error in options is encountered, we should not print a lengthy help() and overwhelm the user, when we know precisely what is wrong with the commandline. In addition, since help() prints to stdout, it should not be used except when requested with -h or --help. Also, simplify things here and there.
2014-08-02 17:12:21 +02:00
static void help(void) {
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
printf("%s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
"Spawn a minimal namespace container for debugging, testing and building.\n\n"
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
" -h --help Show this help\n"
" --version Print version string\n"
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
" -q --quiet Do not show status information\n"
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
" -D --directory=PATH Root directory for the container\n"
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
" --template=PATH Initialize root directory from template directory,\n"
" if missing\n"
" -x --ephemeral Run container with snapshot of root directory, and\n"
" remove it after exit\n"
" -i --image=PATH File system device or disk image for the container\n"
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
" -b --boot Boot up full system (i.e. invoke init)\n"
" -u --user=USER Run the command under specified user or uid\n"
" -M --machine=NAME Set the machine name for the container\n"
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
" --uuid=UUID Set a specific machine UUID for the container\n"
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
" -S --slice=SLICE Place the container in the specified slice\n"
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
" --property=NAME=VALUE Set scope unit property\n"
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
" --private-network Disable network in container\n"
" --network-interface=INTERFACE\n"
" Assign an existing network interface to the\n"
" container\n"
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
" --network-macvlan=INTERFACE\n"
" Create a macvlan network interface based on an\n"
" existing network interface to the container\n"
nspawn: add ipvlan support
2015-01-20 00:18:28 +01:00
" --network-ipvlan=INTERFACE\n"
" Create a ipvlan network interface based on an\n"
" existing network interface to the container\n"
nspawn: add "-n" shortcut for "--network-veth" Now that networkd's IP masquerading support means that running containers with "--network-veth" will provide network access out of the box for the container, let's add a shortcut "-n" for it, to make it easily accessible.
2015-01-13 19:42:02 +01:00
" -n --network-veth Add a virtual ethernet connection between host\n"
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
" and container\n"
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
" --network-bridge=INTERFACE\n"
nspawn: typo fix in help
2014-02-16 22:15:24 +01:00
" Add a virtual ethernet connection between host\n"
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
" and container and add it to an existing bridge on\n"
" the host\n"
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
" --private-users[=UIDBASE[:NUIDS]]\n"
" Run within user namespace\n"
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
" -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]\n"
nspawn: --help typo fix
2015-01-13 20:59:07 +01:00
" Expose a container IP port on the host\n"
nspawn,man: use a common vocabulary when referring to selinux security contexts Let's always call the security labels the same way: SMACK: "Smack Label" SELINUX: "SELinux Security Context" And the low-level encapsulation is called "seclabel". Now let's hope we stick to this vocabulary in future, too, and don't mix "label"s and "security contexts" and so on wildly.
2014-02-10 12:32:03 +01:00
" -Z --selinux-context=SECLABEL\n"
" Set the SELinux security context to be used by\n"
" processes in the container\n"
" -L --selinux-apifs-context=SECLABEL\n"
" Set the SELinux security context to be used by\n"
" API/tmpfs file systems in the container\n"
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
" --capability=CAP In addition to the default, retain specified\n"
" capability\n"
" --drop-capability=CAP Drop the specified capability from the default set\n"
nspawn: make kill signal to use for PID 1 configurable
2015-02-25 22:04:48 +01:00
" --kill-signal=SIGNAL Select signal to use for shutting down PID 1\n"
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
" --link-journal=MODE Link up guest journal, one of no, auto, guest, host,\n"
" try-guest, try-host\n"
" -j Equivalent to --link-journal=try-guest\n"
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
" --read-only Mount the root directory read-only\n"
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
" --bind=PATH[:PATH] Bind mount a file or directory from the host into\n"
" the container\n"
" --bind-ro=PATH[:PATH] Similar, but creates a read-only bind mount\n"
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
" --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
nspawn: add --quiet switch for turning off any output noise
2014-02-06 00:43:14 +01:00
" --setenv=NAME=VALUE Pass an environment variable to PID 1\n"
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
" --share-system Share system namespaces with host\n"
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
" --register=BOOLEAN Register container as machine\n"
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
" --keep-unit Do not register a scope for the machine, reuse\n"
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
" the service unit nspawn is running in\n"
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
" --volatile[=MODE] Run the system in volatile mode\n"
, program_invocation_short_name);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
}
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
static int set_sanitized_path(char **b, const char *path) {
char *p;
assert(b);
assert(path);
p = canonicalize_file_name(path);
if (!p) {
if (errno != ENOENT)
return -errno;
p = path_make_absolute_cwd(path);
if (!p)
return -ENOMEM;
}
free(*b);
*b = path_kill_slashes(p);
return 0;
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
static int parse_argv(int argc, char *argv[]) {
nspawn: add new --no-net switch to turn off networking in the container
2011-08-02 04:49:37 +02:00
enum {
nspawn: add --version
2013-01-11 22:03:49 +01:00
ARG_VERSION = 0x100,
ARG_PRIVATE_NETWORK,
nspawn: add --read-only switch
2012-04-25 15:11:20 +02:00
ARG_UUID,
nspawn: introduce new --capabilities= flag and make use of it in the nspawn test case
2012-06-28 13:44:39 +02:00
ARG_READ_ONLY,
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
ARG_CAPABILITY,
nspawn: add new --drop-capability= switch
2013-11-20 22:10:42 +01:00
ARG_DROP_CAPABILITY,
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
ARG_LINK_JOURNAL,
ARG_BIND,
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
ARG_BIND_RO,
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
ARG_TMPFS,
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
ARG_SETENV,
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
ARG_SHARE_SYSTEM,
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
ARG_REGISTER,
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
ARG_KEEP_UNIT,
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
ARG_NETWORK_INTERFACE,
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
ARG_NETWORK_MACVLAN,
nspawn: add ipvlan support
2015-01-20 00:18:28 +01:00
ARG_NETWORK_IPVLAN,
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
ARG_NETWORK_BRIDGE,
nspawn: add new --personality= switch to make it easier to run 32bit containers on a 64bit host
2014-02-18 23:35:19 +01:00
ARG_PERSONALITY,
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
ARG_VOLATILE,
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
ARG_TEMPLATE,
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
ARG_PROPERTY,
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
ARG_PRIVATE_USERS,
nspawn: make kill signal to use for PID 1 configurable
2015-02-25 22:04:48 +01:00
ARG_KILL_SIGNAL,
nspawn: add new --no-net switch to turn off networking in the container
2011-08-02 04:49:37 +02:00
};
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
static const struct option options[] = {
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
{ "help", no_argument, NULL, 'h' },
{ "version", no_argument, NULL, ARG_VERSION },
{ "directory", required_argument, NULL, 'D' },
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
{ "template", required_argument, NULL, ARG_TEMPLATE },
{ "ephemeral", no_argument, NULL, 'x' },
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
{ "user", required_argument, NULL, 'u' },
{ "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
{ "boot", no_argument, NULL, 'b' },
{ "uuid", required_argument, NULL, ARG_UUID },
{ "read-only", no_argument, NULL, ARG_READ_ONLY },
{ "capability", required_argument, NULL, ARG_CAPABILITY },
{ "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
{ "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
{ "bind", required_argument, NULL, ARG_BIND },
{ "bind-ro", required_argument, NULL, ARG_BIND_RO },
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
{ "tmpfs", required_argument, NULL, ARG_TMPFS },
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
{ "machine", required_argument, NULL, 'M' },
{ "slice", required_argument, NULL, 'S' },
{ "setenv", required_argument, NULL, ARG_SETENV },
{ "selinux-context", required_argument, NULL, 'Z' },
{ "selinux-apifs-context", required_argument, NULL, 'L' },
{ "quiet", no_argument, NULL, 'q' },
{ "share-system", no_argument, NULL, ARG_SHARE_SYSTEM },
{ "register", required_argument, NULL, ARG_REGISTER },
{ "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
{ "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
{ "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
nspawn: add ipvlan support
2015-01-20 00:18:28 +01:00
{ "network-ipvlan", required_argument, NULL, ARG_NETWORK_IPVLAN },
nspawn: add "-n" shortcut for "--network-veth" Now that networkd's IP masquerading support means that running containers with "--network-veth" will provide network access out of the box for the container, let's add a shortcut "-n" for it, to make it easily accessible.
2015-01-13 19:42:02 +01:00
{ "network-veth", no_argument, NULL, 'n' },
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
{ "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
nspawn: add new --personality= switch to make it easier to run 32bit containers on a 64bit host
2014-02-18 23:35:19 +01:00
{ "personality", required_argument, NULL, ARG_PERSONALITY },
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
{ "image", required_argument, NULL, 'i' },
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
{ "volatile", optional_argument, NULL, ARG_VOLATILE },
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
{ "port", required_argument, NULL, 'p' },
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
{ "property", required_argument, NULL, ARG_PROPERTY },
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
{ "private-users", optional_argument, NULL, ARG_PRIVATE_USERS },
nspawn: make kill signal to use for PID 1 configurable
2015-02-25 22:04:48 +01:00
{ "kill-signal", required_argument, NULL, ARG_KILL_SIGNAL },
clients: unify how we invoke getopt_long() Among other things this makes sure we always expose a --version command and show it in the help texts.
2013-11-06 18:28:39 +01:00
{}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
};
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
int c, r;
nspawn: --private-network should imply CAP_NET_ADMIN
2014-02-13 14:07:59 +01:00
uint64_t plus = 0, minus = 0;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
assert(argc >= 0);
assert(argv);
nspawn: add "-n" shortcut for "--network-veth" Now that networkd's IP masquerading support means that running containers with "--network-veth" will provide network access out of the box for the container, let's add a shortcut "-n" for it, to make it easily accessible.
2015-01-13 19:42:02 +01:00
while ((c = getopt_long(argc, argv, "+hD:u:bL:M:jS:Z:qi:xp:n", options, NULL)) >= 0)
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
switch (c) {
case 'h':
Unify parse_argv style getopt is usually good at printing out a nice error message when commandline options are invalid. It distinguishes between an unknown option and a known option with a missing arg. It is better to let it do its job and not use opterr=0 unless we actually want to suppress messages. So remove opterr=0 in the few places where it wasn't really useful. When an error in options is encountered, we should not print a lengthy help() and overwhelm the user, when we know precisely what is wrong with the commandline. In addition, since help() prints to stdout, it should not be used except when requested with -h or --help. Also, simplify things here and there.
2014-08-02 17:12:21 +02:00
help();
return 0;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: add --version
2013-01-11 22:03:49 +01:00
case ARG_VERSION:
puts(PACKAGE_STRING);
puts(SYSTEMD_FEATURES);
return 0;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
case 'D':
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = set_sanitized_path(&arg_directory, optarg);
if (r < 0)
return log_error_errno(r, "Invalid root directory: %m");
break;
case ARG_TEMPLATE:
r = set_sanitized_path(&arg_template, optarg);
if (r < 0)
return log_error_errno(r, "Invalid template directory: %m");
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
break;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
case 'i':
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = set_sanitized_path(&arg_image, optarg);
if (r < 0)
return log_error_errno(r, "Invalid image path: %m");
break;
case 'x':
arg_ephemeral = true;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
break;
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
case 'u':
free(arg_user);
nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.
2013-04-16 04:36:06 +02:00
arg_user = strdup(optarg);
if (!arg_user)
return log_oom();
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
break;
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
case ARG_NETWORK_BRIDGE:
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
arg_network_bridge = optarg;
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
/* fall through */
nspawn: add "-n" shortcut for "--network-veth" Now that networkd's IP masquerading support means that running containers with "--network-veth" will provide network access out of the box for the container, let's add a shortcut "-n" for it, to make it easily accessible.
2015-01-13 19:42:02 +01:00
case 'n':
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
arg_network_veth = true;
arg_private_network = true;
break;
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
case ARG_NETWORK_INTERFACE:
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
if (strv_extend(&arg_network_interfaces, optarg) < 0)
return log_oom();
arg_private_network = true;
break;
case ARG_NETWORK_MACVLAN:
if (strv_extend(&arg_network_macvlan, optarg) < 0)
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
return log_oom();
nspawn: add ipvlan support
2015-01-20 00:18:28 +01:00
arg_private_network = true;
break;
case ARG_NETWORK_IPVLAN:
if (strv_extend(&arg_network_ipvlan, optarg) < 0)
return log_oom();
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
/* fall through */
exec: introduce PrivateNetwork= process option to turn off network access to specific services
2011-08-02 05:24:58 +02:00
case ARG_PRIVATE_NETWORK:
arg_private_network = true;
nspawn: add new --no-net switch to turn off networking in the container
2011-08-02 04:49:37 +02:00
break;
nspawn: add -b switch to automatically look for an init binary
2012-04-22 13:37:24 +02:00
case 'b':
arg_boot = true;
break;
nspawn: add --uuid= switch to allow setting the machine id for the container
2012-04-22 14:48:21 +02:00
case ARG_UUID:
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
r = sd_id128_from_string(optarg, &arg_uuid);
if (r < 0) {
id128: when taking user input for a 128bit ID, validate syntax Also, always accept both our simple hexdump syntax and UUID syntax.
2013-04-29 23:39:12 +02:00
log_error("Invalid UUID: %s", optarg);
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
return r;
id128: when taking user input for a 128bit ID, validate syntax Also, always accept both our simple hexdump syntax and UUID syntax.
2013-04-29 23:39:12 +02:00
}
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
break;
id128: when taking user input for a 128bit ID, validate syntax Also, always accept both our simple hexdump syntax and UUID syntax.
2013-04-29 23:39:12 +02:00
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
case 'S':
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
arg_slice = optarg;
nspawn: add --uuid= switch to allow setting the machine id for the container
2012-04-22 14:48:21 +02:00
break;
nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.
2013-04-16 04:36:06 +02:00
case 'M':
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
if (isempty(optarg)) {
free(arg_machine);
arg_machine = NULL;
} else {
nspawn: properly validate machine names
2014-12-12 02:49:40 +01:00
if (!machine_name_is_valid(optarg)) {
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
log_error("Invalid machine name: %s", optarg);
return -EINVAL;
}
nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.
2013-04-16 04:36:06 +02:00
nspawn: properly validate machine names
2014-12-12 02:49:40 +01:00
r = free_and_strdup(&arg_machine, optarg);
if (r < 0)
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
return log_oom();
break;
}
nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.
2013-04-16 04:36:06 +02:00
nspawn,man: use a common vocabulary when referring to selinux security contexts Let's always call the security labels the same way: SMACK: "Smack Label" SELINUX: "SELinux Security Context" And the low-level encapsulation is called "seclabel". Now let's hope we stick to this vocabulary in future, too, and don't mix "label"s and "security contexts" and so on wildly.
2014-02-10 12:32:03 +01:00
case 'Z':
arg_selinux_context = optarg;
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
break;
nspawn,man: use a common vocabulary when referring to selinux security contexts Let's always call the security labels the same way: SMACK: "Smack Label" SELINUX: "SELinux Security Context" And the low-level encapsulation is called "seclabel". Now let's hope we stick to this vocabulary in future, too, and don't mix "label"s and "security contexts" and so on wildly.
2014-02-10 12:32:03 +01:00
case 'L':
arg_selinux_apifs_context = optarg;
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
break;
nspawn: add --read-only switch
2012-04-25 15:11:20 +02:00
case ARG_READ_ONLY:
arg_read_only = true;
break;
nspawn: add new --drop-capability= switch
2013-11-20 22:10:42 +01:00
case ARG_CAPABILITY:
case ARG_DROP_CAPABILITY: {
Reject invalid quoted strings String which ended in an unfinished quote were accepted, potentially with bad memory accesses. Reject anything which ends in a unfished quote, or contains non-whitespace characters right after the closing quote. _FOREACH_WORD now returns the invalid character in *state. But this return value is not checked anywhere yet. Also, make 'word' and 'state' variables const pointers, and rename 'w' to 'word' in various places. Things are easier to read if the same name is used consistently. mbiebl_> am I correct that something like this doesn't work mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-passwd "Unlock EncFS"' mbiebl_> systemd seems to strip of the quotes mbiebl_> systemctl status shows mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-password Unlock EncFS $RootDir $MountPoint mbiebl_> which is pretty weird
2014-07-30 04:01:36 +02:00
const char *state, *word;
nspawn: introduce new --capabilities= flag and make use of it in the nspawn test case
2012-06-28 13:44:39 +02:00
size_t length;
FOREACH_WORD_SEPARATOR(word, length, optarg, ",", state) {
nspawn: introduce --capability=all for retaining all capabilities
2014-02-13 02:45:11 +01:00
_cleanup_free_ char *t;
nspawn: introduce new --capabilities= flag and make use of it in the nspawn test case
2012-06-28 13:44:39 +02:00
t = strndup(word, length);
log.h: new log_oom() -> int -ENOMEM, use it also a number of minor fixups and bug fixes: spelling, oom errors that didn't print errors, not properly forwarding error codes, few more consistency issues, et cetera
2012-07-25 23:55:59 +02:00
if (!t)
return log_oom();
nspawn: introduce new --capabilities= flag and make use of it in the nspawn test case
2012-06-28 13:44:39 +02:00
nspawn: introduce --capability=all for retaining all capabilities
2014-02-13 02:45:11 +01:00
if (streq(t, "all")) {
if (c == ARG_CAPABILITY)
nspawn: --private-network should imply CAP_NET_ADMIN
2014-02-13 14:07:59 +01:00
plus = (uint64_t) -1;
nspawn: introduce --capability=all for retaining all capabilities
2014-02-13 02:45:11 +01:00
else
nspawn: --private-network should imply CAP_NET_ADMIN
2014-02-13 14:07:59 +01:00
minus = (uint64_t) -1;
nspawn: introduce --capability=all for retaining all capabilities
2014-02-13 02:45:11 +01:00
} else {
util: introduce our own gperf based capability list This way, we can ensure we have a more complete, up-to-date list of capabilities around, always.
2014-12-10 03:16:14 +01:00
int cap;
cap = capability_from_name(t);
if (cap < 0) {
nspawn: introduce --capability=all for retaining all capabilities
2014-02-13 02:45:11 +01:00
log_error("Failed to parse capability %s.", t);
return -EINVAL;
}
if (c == ARG_CAPABILITY)
nspawn: --private-network should imply CAP_NET_ADMIN
2014-02-13 14:07:59 +01:00
plus |= 1ULL << (uint64_t) cap;
nspawn: introduce --capability=all for retaining all capabilities
2014-02-13 02:45:11 +01:00
else
nspawn: --private-network should imply CAP_NET_ADMIN
2014-02-13 14:07:59 +01:00
minus |= 1ULL << (uint64_t) cap;
nspawn: introduce new --capabilities= flag and make use of it in the nspawn test case
2012-06-28 13:44:39 +02:00
}
}
break;
}
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
case 'j':
arg_link_journal = LINK_GUEST;
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
arg_link_journal_try = true;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
break;
case ARG_LINK_JOURNAL:
nspawn: properly unset arg_link_journal_try, when --link-journal= is specified
2014-12-12 16:58:30 +01:00
if (streq(optarg, "auto")) {
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
arg_link_journal = LINK_AUTO;
nspawn: properly unset arg_link_journal_try, when --link-journal= is specified
2014-12-12 16:58:30 +01:00
arg_link_journal_try = false;
} else if (streq(optarg, "no")) {
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
arg_link_journal = LINK_NO;
nspawn: properly unset arg_link_journal_try, when --link-journal= is specified
2014-12-12 16:58:30 +01:00
arg_link_journal_try = false;
} else if (streq(optarg, "guest")) {
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
arg_link_journal = LINK_GUEST;
nspawn: properly unset arg_link_journal_try, when --link-journal= is specified
2014-12-12 16:58:30 +01:00
arg_link_journal_try = false;
} else if (streq(optarg, "host")) {
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
arg_link_journal = LINK_HOST;
nspawn: properly unset arg_link_journal_try, when --link-journal= is specified
2014-12-12 16:58:30 +01:00
arg_link_journal_try = false;
} else if (streq(optarg, "try-guest")) {
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
arg_link_journal = LINK_GUEST;
arg_link_journal_try = true;
} else if (streq(optarg, "try-host")) {
arg_link_journal = LINK_HOST;
arg_link_journal_try = true;
} else {
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
log_error("Failed to parse link journal mode %s", optarg);
return -EINVAL;
}
break;
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
case ARG_BIND:
case ARG_BIND_RO: {
_cleanup_free_ char *a = NULL, *b = NULL;
char *e;
char ***x;
x = c == ARG_BIND ? &arg_bind : &arg_bind_ro;
e = strchr(optarg, ':');
if (e) {
a = strndup(optarg, e - optarg);
b = strdup(e + 1);
} else {
a = strdup(optarg);
b = strdup(optarg);
}
if (!a || !b)
return log_oom();
if (!path_is_absolute(a) || !path_is_absolute(b)) {
log_error("Invalid bind mount specification: %s", optarg);
return -EINVAL;
}
r = strv_extend(x, a);
if (r < 0)
nspawn: log out of memory errors
2013-11-05 15:26:37 +01:00
return log_oom();
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
r = strv_extend(x, b);
if (r < 0)
nspawn: log out of memory errors
2013-11-05 15:26:37 +01:00
return log_oom();
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
break;
}
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
case ARG_TMPFS: {
_cleanup_free_ char *a = NULL, *b = NULL;
char *e;
e = strchr(optarg, ':');
if (e) {
a = strndup(optarg, e - optarg);
b = strdup(e + 1);
} else {
a = strdup(optarg);
b = strdup("mode=0755");
}
if (!a || !b)
return log_oom();
if (!path_is_absolute(a)) {
log_error("Invalid tmpfs specification: %s", optarg);
return -EINVAL;
}
r = strv_push(&arg_tmpfs, a);
if (r < 0)
return log_oom();
a = NULL;
r = strv_push(&arg_tmpfs, b);
if (r < 0)
return log_oom();
b = NULL;
break;
}
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
case ARG_SETENV: {
char **n;
if (!env_assignment_is_valid(optarg)) {
log_error("Environment variable assignment '%s' is not valid.", optarg);
return -EINVAL;
}
n = strv_env_set(arg_setenv, optarg);
if (!n)
return log_oom();
strv_free(arg_setenv);
arg_setenv = n;
break;
}
nspawn: add --quiet switch for turning off any output noise
2014-02-06 00:43:14 +01:00
case 'q':
arg_quiet = true;
break;
nspawn: add new --share-system switch to run a container without PID/UTS/IPC namespacing
2014-02-10 13:15:42 +01:00
case ARG_SHARE_SYSTEM:
arg_share_system = true;
break;
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
case ARG_REGISTER:
r = parse_boolean(optarg);
if (r < 0) {
log_error("Failed to parse --register= argument: %s", optarg);
return r;
}
arg_register = r;
break;
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
case ARG_KEEP_UNIT:
arg_keep_unit = true;
break;
nspawn: add new --personality= switch to make it easier to run 32bit containers on a 64bit host
2014-02-18 23:35:19 +01:00
case ARG_PERSONALITY:
core: add Personality= option for units to set the personality for spawned processes
2014-02-19 02:15:24 +01:00
arg_personality = personality_from_string(optarg);
nspawn: add new --personality= switch to make it easier to run 32bit containers on a 64bit host
2014-02-18 23:35:19 +01:00
if (arg_personality == 0xffffffffLU) {
log_error("Unknown or unsupported personality '%s'.", optarg);
return -EINVAL;
}
break;
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
case ARG_VOLATILE:
if (!optarg)
arg_volatile = VOLATILE_YES;
else {
r = parse_boolean(optarg);
if (r < 0) {
if (streq(optarg, "state"))
arg_volatile = VOLATILE_STATE;
else {
log_error("Failed to parse --volatile= argument: %s", optarg);
return r;
}
} else
arg_volatile = r ? VOLATILE_YES : VOLATILE_NO;
}
break;
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
case 'p': {
const char *split, *e;
uint16_t container_port, host_port;
int protocol;
ExposePort *p;
if ((e = startswith(optarg, "tcp:")))
protocol = IPPROTO_TCP;
else if ((e = startswith(optarg, "udp:")))
protocol = IPPROTO_UDP;
else {
e = optarg;
protocol = IPPROTO_TCP;
}
split = strchr(e, ':');
if (split) {
char v[split - e + 1];
memcpy(v, e, split - e);
v[split - e] = 0;
r = safe_atou16(v, &host_port);
if (r < 0 || host_port <= 0) {
log_error("Failed to parse host port: %s", optarg);
return -EINVAL;
}
r = safe_atou16(split + 1, &container_port);
} else {
r = safe_atou16(e, &container_port);
host_port = container_port;
}
if (r < 0 || container_port <= 0) {
log_error("Failed to parse host port: %s", optarg);
return -EINVAL;
}
LIST_FOREACH(ports, p, arg_expose_ports) {
if (p->protocol == protocol && p->host_port == host_port) {
log_error("Duplicate port specification: %s", optarg);
return -EINVAL;
}
}
p = new(ExposePort, 1);
if (!p)
return log_oom();
p->protocol = protocol;
p->host_port = host_port;
p->container_port = container_port;
LIST_PREPEND(ports, arg_expose_ports, p);
break;
}
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
case ARG_PROPERTY:
if (strv_extend(&arg_property, optarg) < 0)
return log_oom();
break;
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
case ARG_PRIVATE_USERS:
if (optarg) {
_cleanup_free_ char *buffer = NULL;
const char *range, *shift;
range = strchr(optarg, ':');
if (range) {
buffer = strndup(optarg, range - optarg);
if (!buffer)
return log_oom();
shift = buffer;
range++;
if (safe_atou32(range, &arg_uid_range) < 0 || arg_uid_range <= 0) {
log_error("Failed to parse UID range: %s", range);
return -EINVAL;
}
} else
shift = optarg;
if (parse_uid(shift, &arg_uid_shift) < 0) {
log_error("Failed to parse UID: %s", optarg);
return -EINVAL;
}
}
arg_userns = true;
break;
nspawn: make kill signal to use for PID 1 configurable
2015-02-25 22:04:48 +01:00
case ARG_KILL_SIGNAL:
arg_kill_signal = signal_from_string_try_harder(optarg);
if (arg_kill_signal < 0) {
log_error("Cannot parse signal: %s", optarg);
return -EINVAL;
}
break;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
case '?':
return -EINVAL;
default:
clients: unify how we invoke getopt_long() Among other things this makes sure we always expose a --version command and show it in the help texts.
2013-11-06 18:28:39 +01:00
assert_not_reached("Unhandled option");
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
}
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
if (arg_share_system)
arg_register = false;
if (arg_boot && arg_share_system) {
log_error("--boot and --share-system may not be combined.");
return -EINVAL;
}
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
if (arg_keep_unit && cg_pid_get_owner_uid(0, NULL) >= 0) {
log_error("--keep-unit may not be used when invoked from a user session.");
return -EINVAL;
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
if (arg_directory && arg_image) {
log_error("--directory= and --image= may not be combined.");
return -EINVAL;
}
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
if (arg_template && arg_image) {
log_error("--template= and --image= may not be combined.");
return -EINVAL;
}
if (arg_template && !(arg_directory || arg_machine)) {
log_error("--template= needs --directory= or --machine=.");
return -EINVAL;
}
if (arg_ephemeral && arg_template) {
log_error("--ephemeral and --template= may not be combined.");
return -EINVAL;
}
if (arg_ephemeral && arg_image) {
log_error("--ephemeral and --image= may not be combined.");
return -EINVAL;
}
nspawn: don't link journals in ephemeral mode
2014-12-12 16:58:57 +01:00
if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO)) {
log_error("--ephemeral and --link-journal= may not be combined.");
return -EINVAL;
}
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
if (arg_volatile != VOLATILE_NO && arg_read_only) {
log_error("Cannot combine --read-only with --volatile. Note that --volatile already implies a read-only base hierarchy.");
return -EINVAL;
}
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
if (arg_expose_ports && !arg_private_network) {
log_error("Cannot use --port= without private networking.");
return -EINVAL;
}
nspawn: --private-network should imply CAP_NET_ADMIN
2014-02-13 14:07:59 +01:00
arg_retain = (arg_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus;
nspawn: make kill signal to use for PID 1 configurable
2015-02-25 22:04:48 +01:00
if (arg_boot && arg_kill_signal <= 0)
arg_kill_signal = SIGRTMIN+3;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
return 1;
}
static int mount_all(const char *dest) {
typedef struct MountPoint {
const char *what;
const char *where;
const char *type;
const char *options;
unsigned long flags;
nspawn: don't require selinux on if it is compiled in
2011-03-14 17:44:03 +01:00
bool fatal;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
} MountPoint;
static const MountPoint mount_table[] = {
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
{ "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
{ "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND, true }, /* Bind mount first */
{ NULL, "/proc/sys", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, true }, /* Then, make it r/o */
{ "sysfs", "/sys", "sysfs", NULL, MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
{ "tmpfs", "/dev", "tmpfs", "mode=755", MS_NOSUID|MS_STRICTATIME, true },
nspawn: create a separate devpts namespace for nspawn containers
2013-03-07 13:34:07 +01:00
{ "devpts", "/dev/pts", "devpts","newinstance,ptmxmode=0666,mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC, true },
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
{ "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true },
{ "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true },
nspawn: mount /tmp in the container, don't leave this to the container's init We really want /tmp to be properly mounted, especially in containers that lack CAP_SYS_ADMIN or that are not fully booted up and only get a shell, hence let's do so in nspawn already.
2015-01-23 01:27:06 +01:00
{ "tmpfs", "/tmp", "tmpfs", "mode=1777", MS_STRICTATIME, true },
nspawn: mount /selinux if needed
2011-03-14 15:33:23 +01:00
#ifdef HAVE_SELINUX
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
{ "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND, false }, /* Bind mount first */
{ NULL, "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, false }, /* Then, make it r/o */
nspawn: mount /selinux if needed
2011-03-14 15:33:23 +01:00
#endif
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
};
unsigned k;
int r = 0;
for (k = 0; k < ELEMENTSOF(mount_table); k++) {
nspawn: fix build on non-selinux systems
2015-02-19 12:03:12 +01:00
_cleanup_free_ char *where = NULL, *options = NULL;
nspawn: various fixes in selinux hookup - As suggested, prefix argument variables with "arg_" how we do this usually. - As suggested, don't involve memory allocations when storing command line arguments. - Break --help text at 80 chars - man: explain that this is about SELinux - don't do unnecessary memory allocations when putting together mount option string
2014-02-04 22:56:07 +01:00
const char *o;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
int t;
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
where = strjoin(dest, "/", mount_table[k].where, NULL);
if (!where)
return log_oom();
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: mount a clean instance of sysfs
2012-09-05 01:32:43 +02:00
t = path_is_mount_point(where, true);
path-util: fix more path_is_mount e792e890f fallout
2015-04-07 16:03:45 +02:00
if (t < 0 && t != -ENOENT) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(t, "Failed to detect whether %s is a mount point: %m", where);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
if (r == 0)
r = t;
continue;
}
nspawn: if a file system comes pre-mounted, still do the read-only remounts
2012-09-05 23:16:41 +02:00
/* Skip this entry if it is not a remount. */
if (mount_table[k].what && t > 0)
nspawn: skip mounts if already mounted
2012-09-05 01:33:13 +02:00
continue;
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
t = mkdir_p(where, 0755);
if (t < 0) {
if (mount_table[k].fatal) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(t, "Failed to create directory %s: %m", where);
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
if (r == 0)
r = t;
} else
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_warning_errno(t, "Failed to create directory %s: %m", where);
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
continue;
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
#ifdef HAVE_SELINUX
nspawn,man: use a common vocabulary when referring to selinux security contexts Let's always call the security labels the same way: SMACK: "Smack Label" SELINUX: "SELinux Security Context" And the low-level encapsulation is called "seclabel". Now let's hope we stick to this vocabulary in future, too, and don't mix "label"s and "security contexts" and so on wildly.
2014-02-10 12:32:03 +01:00
if (arg_selinux_apifs_context &&
(streq_ptr(mount_table[k].what, "tmpfs") || streq_ptr(mount_table[k].what, "devpts"))) {
options = strjoin(mount_table[k].options, ",context=\"", arg_selinux_apifs_context, "\"", NULL);
nspawn: various fixes in selinux hookup - As suggested, prefix argument variables with "arg_" how we do this usually. - As suggested, don't involve memory allocations when storing command line arguments. - Break --help text at 80 chars - man: explain that this is about SELinux - don't do unnecessary memory allocations when putting together mount option string
2014-02-04 22:56:07 +01:00
if (!options)
return log_oom();
o = options;
} else
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
#endif
nspawn: various fixes in selinux hookup - As suggested, prefix argument variables with "arg_" how we do this usually. - As suggested, don't involve memory allocations when storing command line arguments. - Break --help text at 80 chars - man: explain that this is about SELinux - don't do unnecessary memory allocations when putting together mount option string
2014-02-04 22:56:07 +01:00
o = mount_table[k].options;
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
if (arg_userns && arg_uid_shift != UID_INVALID && streq_ptr(mount_table[k].type, "tmpfs")) {
char *uid_options = NULL;
if (o)
asprintf(&uid_options, "%s,uid=" UID_FMT ",gid=" UID_FMT, o, arg_uid_shift, arg_uid_shift);
else
asprintf(&uid_options, "uid=" UID_FMT ",gid=" UID_FMT, arg_uid_shift, arg_uid_shift);
if (!uid_options)
return log_oom();
free(options);
o = options = uid_options;
}
Add SELinux support to systemd-nspawn This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
2014-01-30 22:28:02 +01:00
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
if (mount(mount_table[k].what,
where,
mount_table[k].type,
mount_table[k].flags,
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
o) < 0) {
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
if (mount_table[k].fatal) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "mount(%s) failed: %m", where);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
if (r == 0)
r = -errno;
} else
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_warning_errno(errno, "mount(%s) failed: %m", where);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
}
}
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
return r;
}
coverity: change a few things so that coverity doesn't show so many false positives
2011-09-23 01:44:36 +02:00
namespace: beef up read-only bind mount logic Instead of blindly creating another bind mount for read-only mounts, check if there's already one we can use, and if so, use it. Also, recursively mark all submounts read-only too. Also, ignore autofs mounts when remounting read-only unless they are already triggered.
2014-06-06 11:42:25 +02:00
static int mount_binds(const char *dest, char **l, bool ro) {
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
char **x, **y;
STRV_FOREACH_PAIR(x, y, l) {
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
_cleanup_free_ char *where = NULL;
nspawn: be less liberal about creating bind mount destinations Previously, if a file's bind mount destination didn't exist, nspawn would blindly create a directory, and the subsequent bind mount would fail. Examine the filetype of the source and ensure that, if the destination does not exist, that it is created appropriately. Also go one step further and ensure that the filetypes of the source and destination match.
2013-09-19 20:30:07 +02:00
struct stat source_st, dest_st;
nspawn: fix buggy mount_binds, now works for bind-mounted files
2013-12-05 15:20:08 +01:00
int r;
nspawn: be less liberal about creating bind mount destinations Previously, if a file's bind mount destination didn't exist, nspawn would blindly create a directory, and the subsequent bind mount would fail. Examine the filetype of the source and ensure that, if the destination does not exist, that it is created appropriately. Also go one step further and ensure that the filetypes of the source and destination match.
2013-09-19 20:30:07 +02:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (stat(*x, &source_st) < 0)
return log_error_errno(errno, "Failed to stat %s: %m", *x);
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
where = strappend(dest, *y);
if (!where)
return log_oom();
nspawn: fix buggy mount_binds, now works for bind-mounted files
2013-12-05 15:20:08 +01:00
r = stat(where, &dest_st);
if (r == 0) {
nspawn: allow bind-mounting char and block files
2015-01-22 16:47:07 +01:00
if (S_ISDIR(source_st.st_mode) && !S_ISDIR(dest_st.st_mode)) {
log_error("Cannot bind mount directory %s on file %s.", *x, where);
return -EINVAL;
}
if (!S_ISDIR(source_st.st_mode) && S_ISDIR(dest_st.st_mode)) {
log_error("Cannot bind mount file %s on directory %s.", *x, where);
nspawn: be less liberal about creating bind mount destinations Previously, if a file's bind mount destination didn't exist, nspawn would blindly create a directory, and the subsequent bind mount would fail. Examine the filetype of the source and ensure that, if the destination does not exist, that it is created appropriately. Also go one step further and ensure that the filetypes of the source and destination match.
2013-09-19 20:30:07 +02:00
return -EINVAL;
}
nspawn: fix buggy mount_binds, now works for bind-mounted files
2013-12-05 15:20:08 +01:00
} else if (errno == ENOENT) {
r = mkdir_parents_label(where, 0755);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to bind mount %s: %m", *x);
nspawn: fix buggy mount_binds, now works for bind-mounted files
2013-12-05 15:20:08 +01:00
} else {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to bind mount %s: %m", *x);
nspawn: fix buggy mount_binds, now works for bind-mounted files
2013-12-05 15:20:08 +01:00
return -errno;
}
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
nspawn: allow bind-mounting char and block files
2015-01-22 16:47:07 +01:00
/* Create the mount point. Any non-directory file can be
* mounted on any non-directory file (regular, fifo, socket,
* char, block).
*/
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
if (S_ISDIR(source_st.st_mode)) {
r = mkdir_label(where, 0755);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0 && errno != EEXIST)
return log_error_errno(r, "Failed to create mount point %s: %m", where);
nspawn: allow bind-mounting char and block files
2015-01-22 16:47:07 +01:00
} else {
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
r = touch(where);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to create mount point %s: %m", where);
nspawn: be less liberal about creating bind mount destinations Previously, if a file's bind mount destination didn't exist, nspawn would blindly create a directory, and the subsequent bind mount would fail. Examine the filetype of the source and ensure that, if the destination does not exist, that it is created appropriately. Also go one step further and ensure that the filetypes of the source and destination match.
2013-09-19 20:30:07 +02:00
}
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
nspawn: change filesystem type from "bind" to NULL in mount() syscalls Try to keep syscalls as minimal as possible.
2015-03-31 11:50:29 +02:00
if (mount(*x, where, NULL, MS_BIND, NULL) < 0)
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
return log_error_errno(errno, "mount(%s) failed: %m", where);
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
namespace: beef up read-only bind mount logic Instead of blindly creating another bind mount for read-only mounts, check if there's already one we can use, and if so, use it. Also, recursively mark all submounts read-only too. Also, ignore autofs mounts when remounting read-only unless they are already triggered.
2014-06-06 11:42:25 +02:00
if (ro) {
r = bind_remount_recursive(where, true);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Read-Only bind mount failed: %m");
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
}
}
return 0;
}
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
static int mount_cgroup_hierarchy(const char *dest, const char *controller, const char *hierarchy, bool read_only) {
char *to;
int r;
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
to = strjoina(dest, "/sys/fs/cgroup/", hierarchy);
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
r = path_is_mount_point(to, false);
path-util: fix more path_is_mount e792e890f fallout
2015-04-07 16:03:45 +02:00
if (r < 0 && r != -ENOENT)
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
return log_error_errno(r, "Failed to determine if %s is mounted already: %m", to);
if (r > 0)
return 0;
mkdir_p(to, 0755);
nspawn: when mounting the cgroup hierarchies, use the exact same mount options for the superblock as the host Otherwise we'll generate kernel runtime warnings about non-matching mount options.
2015-01-23 01:43:16 +01:00
/* The superblock mount options of the mount point need to be
* identical to the hosts', and hence writable... */
if (mount("cgroup", to, "cgroup", MS_NOSUID|MS_NOEXEC|MS_NODEV, controller) < 0)
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
return log_error_errno(errno, "Failed to mount to %s: %m", to);
nspawn: when mounting the cgroup hierarchies, use the exact same mount options for the superblock as the host Otherwise we'll generate kernel runtime warnings about non-matching mount options.
2015-01-23 01:43:16 +01:00
/* ... hence let's only make the bind mount read-only, not the
* superblock. */
if (read_only) {
if (mount(NULL, to, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL) < 0)
return log_error_errno(errno, "Failed to remount %s read-only: %m", to);
}
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
return 1;
}
static int mount_cgroup(const char *dest) {
_cleanup_set_free_free_ Set *controllers = NULL;
_cleanup_free_ char *own_cgroup_path = NULL;
const char *cgroup_root, *systemd_root, *systemd_own;
int r;
controllers = set_new(&string_hash_ops);
if (!controllers)
return log_oom();
r = cg_kernel_controllers(controllers);
if (r < 0)
return log_error_errno(r, "Failed to determine cgroup controllers: %m");
r = cg_pid_get_path(NULL, 0, &own_cgroup_path);
if (r < 0)
return log_error_errno(r, "Failed to determine our own cgroup path: %m");
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
cgroup_root = strjoina(dest, "/sys/fs/cgroup");
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
if (mount("tmpfs", cgroup_root, "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, "mode=755") < 0)
return log_error_errno(errno, "Failed to mount tmpfs to /sys/fs/cgroup: %m");
for (;;) {
_cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL;
controller = set_steal_first(controllers);
if (!controller)
break;
origin = strappend("/sys/fs/cgroup/", controller);
if (!origin)
return log_oom();
r = readlink_malloc(origin, &combined);
if (r == -EINVAL) {
/* Not a symbolic link, but directly a single cgroup hierarchy */
r = mount_cgroup_hierarchy(dest, controller, controller, true);
if (r < 0)
return r;
} else if (r < 0)
return log_error_errno(r, "Failed to read link %s: %m", origin);
else {
_cleanup_free_ char *target = NULL;
target = strjoin(dest, "/sys/fs/cgroup/", controller, NULL);
if (!target)
return log_oom();
/* A symbolic link, a combination of controllers in one hierarchy */
if (!filename_is_valid(combined)) {
log_warning("Ignoring invalid combined hierarchy %s.", combined);
continue;
}
r = mount_cgroup_hierarchy(dest, combined, combined, true);
if (r < 0)
return r;
if (symlink(combined, target) < 0)
nspawn: fix log typos
2015-01-15 08:19:30 +01:00
return log_error_errno(errno, "Failed to create symlink for combined hierarchy: %m");
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
}
}
nspawn: when mounting the cgroup hierarchies, use the exact same mount options for the superblock as the host Otherwise we'll generate kernel runtime warnings about non-matching mount options.
2015-01-23 01:43:16 +01:00
r = mount_cgroup_hierarchy(dest, "name=systemd,xattr", "systemd", false);
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
if (r < 0)
return r;
/* Make our own cgroup a (writable) bind mount */
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
systemd_own = strjoina(dest, "/sys/fs/cgroup/systemd", own_cgroup_path);
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
if (mount(systemd_own, systemd_own, NULL, MS_BIND, NULL) < 0)
return log_error_errno(errno, "Failed to turn %s into a bind mount: %m", own_cgroup_path);
/* And then remount the systemd cgroup root read-only */
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
systemd_root = strjoina(dest, "/sys/fs/cgroup/systemd");
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
if (mount(NULL, systemd_root, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL) < 0)
return log_error_errno(errno, "Failed to mount cgroup root read-only: %m");
if (mount(NULL, cgroup_root, NULL, MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755") < 0)
return log_error_errno(errno, "Failed to remount %s read-only: %m", cgroup_root);
return 0;
}
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
static int mount_tmpfs(const char *dest) {
char **i, **o;
STRV_FOREACH_PAIR(i, o, arg_tmpfs) {
_cleanup_free_ char *where = NULL;
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
int r;
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
where = strappend(dest, *i);
if (!where)
return log_oom();
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
r = mkdir_label(where, 0755);
nspawn: correct EEXIST check when creating directory to mount /tmp in https://bugs.freedesktop.org/show_bug.cgi?id=86309
2014-12-03 17:52:51 +01:00
if (r < 0 && r != -EEXIST)
return log_error_errno(r, "Creating mount point for tmpfs %s failed: %m", where);
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (mount("tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, *o) < 0)
return log_error_errno(errno, "tmpfs mount to %s failed: %m", where);
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
}
return 0;
}
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
static int setup_timezone(const char *dest) {
nspawn: we can't overmount /etc/localtime anymore since it's usually a symlink now Create the right symlink if possible for /etc/localtime
2012-09-21 16:54:54 +02:00
_cleanup_free_ char *where = NULL, *p = NULL, *q = NULL, *check = NULL, *what = NULL;
char *z, *y;
int r;
coverity: change a few things so that coverity doesn't show so many false positives
2011-09-23 01:44:36 +02:00
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
assert(dest);
/* Fix the timezone, if possible */
nspawn: we can't overmount /etc/localtime anymore since it's usually a symlink now Create the right symlink if possible for /etc/localtime
2012-09-21 16:54:54 +02:00
r = readlink_malloc("/etc/localtime", &p);
if (r < 0) {
log_warning("/etc/localtime is not a symlink, not updating container timezone.");
return 0;
}
z = path_startswith(p, "../usr/share/zoneinfo/");
if (!z)
z = path_startswith(p, "/usr/share/zoneinfo/");
if (!z) {
log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
return 0;
}
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
where = strappend(dest, "/etc/localtime");
if (!where)
log.h: new log_oom() -> int -ENOMEM, use it also a number of minor fixups and bug fixes: spelling, oom errors that didn't print errors, not properly forwarding error codes, few more consistency issues, et cetera
2012-07-25 23:55:59 +02:00
return log_oom();
nspawn: bind mount /etc/localtime
2011-03-16 03:27:02 +01:00
nspawn: we can't overmount /etc/localtime anymore since it's usually a symlink now Create the right symlink if possible for /etc/localtime
2012-09-21 16:54:54 +02:00
r = readlink_malloc(where, &q);
if (r >= 0) {
y = path_startswith(q, "../usr/share/zoneinfo/");
if (!y)
y = path_startswith(q, "/usr/share/zoneinfo/");
nspawn: mount /etc/timezone into nspawn environment too
2012-03-15 00:45:02 +01:00
nspawn: we can't overmount /etc/localtime anymore since it's usually a symlink now Create the right symlink if possible for /etc/localtime
2012-09-21 16:54:54 +02:00
/* Already pointing to the right place? Then do nothing .. */
if (y && streq(y, z))
return 0;
}
check = strjoin(dest, "/usr/share/zoneinfo/", z, NULL);
if (!check)
log.h: new log_oom() -> int -ENOMEM, use it also a number of minor fixups and bug fixes: spelling, oom errors that didn't print errors, not properly forwarding error codes, few more consistency issues, et cetera
2012-07-25 23:55:59 +02:00
return log_oom();
nspawn: mount /etc/timezone into nspawn environment too
2012-03-15 00:45:02 +01:00
nspawn: we can't overmount /etc/localtime anymore since it's usually a symlink now Create the right symlink if possible for /etc/localtime
2012-09-21 16:54:54 +02:00
if (access(check, F_OK) < 0) {
log_warning("Timezone %s does not exist in container, not updating container timezone.", z);
return 0;
}
nspawn: bind mount /dev/nul to /proc/kmsg, so that the container can't muck with the host kmsg
2012-04-12 12:58:08 +02:00
nspawn: we can't overmount /etc/localtime anymore since it's usually a symlink now Create the right symlink if possible for /etc/localtime
2012-09-21 16:54:54 +02:00
what = strappend("../usr/share/zoneinfo/", z);
if (!what)
return log_oom();
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
r = mkdir_parents(where, 0755);
if (r < 0) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(r, "Failed to create directory for timezone info %s in container: %m", where);
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
return 0;
}
r = unlink(where);
if (r < 0 && errno != ENOENT) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to remove existing timezone info %s in container: %m", where);
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
return 0;
}
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
nspawn: we can't overmount /etc/localtime anymore since it's usually a symlink now Create the right symlink if possible for /etc/localtime
2012-09-21 16:54:54 +02:00
if (symlink(what, where) < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to correct timezone of container: %m");
nspawn: we can't overmount /etc/localtime anymore since it's usually a symlink now Create the right symlink if possible for /etc/localtime
2012-09-21 16:54:54 +02:00
return 0;
}
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
return 0;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
}
nspawn: bind mount /etc/resolv.conf from the host by default
2012-04-25 15:08:00 +02:00
static int setup_resolv_conf(const char *dest) {
consistently order cleanup attribute before type
2014-06-21 05:55:17 +02:00
_cleanup_free_ char *where = NULL;
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
int r;
nspawn: bind mount /etc/resolv.conf from the host by default
2012-04-25 15:08:00 +02:00
assert(dest);
if (arg_private_network)
return 0;
/* Fix resolv.conf, if possible */
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
where = strappend(dest, "/etc/resolv.conf");
if (!where)
log.h: new log_oom() -> int -ENOMEM, use it also a number of minor fixups and bug fixes: spelling, oom errors that didn't print errors, not properly forwarding error codes, few more consistency issues, et cetera
2012-07-25 23:55:59 +02:00
return log_oom();
nspawn: bind mount /etc/resolv.conf from the host by default
2012-04-25 15:08:00 +02:00
nspawn: document why we don't check resolv.conf mount errors
2012-09-21 16:55:56 +02:00
/* We don't really care for the results of this really. If it
* fails, it fails, but meh... */
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
r = mkdir_parents(where, 0755);
if (r < 0) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_warning_errno(r, "Failed to create parent directory for resolv.conf %s: %m", where);
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
return 0;
}
machined: when cloning a raw disk image, also set the NOCOW flag
2015-01-08 19:15:49 +01:00
r = copy_file("/etc/resolv.conf", where, O_TRUNC|O_NOFOLLOW, 0644, 0);
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
if (r < 0) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_warning_errno(r, "Failed to copy /etc/resolv.conf to %s: %m", where);
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
return 0;
}
nspawn: bind mount /etc/resolv.conf from the host by default
2012-04-25 15:08:00 +02:00
return 0;
}
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
static int setup_volatile_state(const char *directory) {
const char *p;
int r;
assert(directory);
if (arg_volatile != VOLATILE_STATE)
return 0;
/* --volatile=state means we simply overmount /var
with a tmpfs, and the rest read-only. */
r = bind_remount_recursive(directory, true);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to remount %s read-only: %m", directory);
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
p = strjoina(directory, "/var");
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
r = mkdir(p, 0755);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (r < 0 && errno != EEXIST)
return log_error_errno(errno, "Failed to create %s: %m", directory);
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (mount("tmpfs", p, "tmpfs", MS_STRICTATIME, "mode=755") < 0)
return log_error_errno(errno, "Failed to mount tmpfs to /var: %m");
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
return 0;
}
static int setup_volatile(const char *directory) {
bool tmpfs_mounted = false, bind_mounted = false;
char template[] = "/tmp/nspawn-volatile-XXXXXX";
const char *f, *t;
int r;
assert(directory);
if (arg_volatile != VOLATILE_YES)
return 0;
/* --volatile=yes means we mount a tmpfs to the root dir, and
the original /usr to use inside it, and that read-only. */
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (!mkdtemp(template))
return log_error_errno(errno, "Failed to create temporary directory: %m");
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
if (mount("tmpfs", template, "tmpfs", MS_STRICTATIME, "mode=755") < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to mount tmpfs for root directory: %m");
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
r = -errno;
goto fail;
}
tmpfs_mounted = true;
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
f = strjoina(directory, "/usr");
t = strjoina(template, "/usr");
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
r = mkdir(t, 0755);
if (r < 0 && errno != EEXIST) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to create %s: %m", t);
nspawn: check some more return values Most of these failures would anyway get caught later on, but now the error messages are a bit more specific.
2014-09-25 18:49:56 +02:00
r = -errno;
goto fail;
}
nspawn: change filesystem type from "bind" to NULL in mount() syscalls Try to keep syscalls as minimal as possible.
2015-03-31 11:50:29 +02:00
if (mount(f, t, NULL, MS_BIND|MS_REC, NULL) < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to create /usr bind mount: %m");
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
r = -errno;
goto fail;
}
bind_mounted = true;
r = bind_remount_recursive(t, true);
if (r < 0) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(r, "Failed to remount %s read-only: %m", t);
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
goto fail;
}
if (mount(template, directory, NULL, MS_MOVE, NULL) < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to move root mount: %m");
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
r = -errno;
goto fail;
}
rmdir(template);
return 0;
fail:
if (bind_mounted)
umount(t);
if (tmpfs_mounted)
umount(template);
rmdir(template);
return r;
}
nspawn: properly format container_uuid in UUID format http://lists.freedesktop.org/archives/systemd-devel/2014-April/018971.html
2014-05-16 19:37:19 +02:00
static char* id128_format_as_uuid(sd_id128_t id, char s[37]) {
snprintf(s, 37,
"%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
SD_ID128_FORMAT_VAL(id));
return s;
}
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
static int setup_boot_id(const char *dest) {
move _cleanup_ attribute in front of the type http://lists.freedesktop.org/archives/systemd-devel/2013-April/010510.html
2013-04-18 09:11:22 +02:00
_cleanup_free_ char *from = NULL, *to = NULL;
make gcc shut up If -flto is used then gcc will generate a lot more warnings than before, among them a number of use-without-initialization warnings. Most of them without are false positives, but let's make them go away, because it doesn't really matter.
2014-02-19 17:47:11 +01:00
sd_id128_t rnd = {};
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
char as_uuid[37];
int r;
assert(dest);
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
if (arg_share_system)
return 0;
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
/* Generate a new randomized boot ID, so that each boot-up of
* the container gets a new one */
from = strappend(dest, "/dev/proc-sys-kernel-random-boot-id");
to = strappend(dest, "/proc/sys/kernel/random/boot_id");
nspawn: _cleanup_free_ more
2012-09-16 15:21:48 +02:00
if (!from || !to)
return log_oom();
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
r = sd_id128_randomize(&rnd);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to generate random boot id: %m");
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
nspawn: properly format container_uuid in UUID format http://lists.freedesktop.org/archives/systemd-devel/2014-April/018971.html
2014-05-16 19:37:19 +02:00
id128_format_as_uuid(rnd, as_uuid);
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
util: rename write_one_line_file() to write_string_file() You can write much more than just one line with this call (and we frequently do), so let's correct the naming.
2013-04-02 20:31:42 +02:00
r = write_string_file(from, as_uuid);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to write boot id: %m");
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
nspawn: change filesystem type from "bind" to NULL in mount() syscalls Try to keep syscalls as minimal as possible.
2015-03-31 11:50:29 +02:00
if (mount(from, to, NULL, MS_BIND, NULL) < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to bind mount boot id: %m");
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
r = -errno;
nspawn: change filesystem type from "bind" to NULL in mount() syscalls Try to keep syscalls as minimal as possible.
2015-03-31 11:50:29 +02:00
} else if (mount(from, to, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL))
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_warning_errno(errno, "Failed to make boot id read-only: %m");
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
unlink(from);
return r;
}
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
static int copy_devnodes(const char *dest) {
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
static const char devnodes[] =
"null\0"
"zero\0"
"full\0"
"random\0"
"urandom\0"
nspawn: copy /dev/net/tun from host This enables tuntap support in the container (assumning the necessary capabilities are in place).
2014-10-08 15:01:07 +02:00
"tty\0"
"net/tun\0";
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
const char *d;
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
int r = 0;
move _cleanup_ attribute in front of the type http://lists.freedesktop.org/archives/systemd-devel/2013-April/010510.html
2013-04-18 09:11:22 +02:00
_cleanup_umask_ mode_t u;
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
assert(dest);
nspawn: reset umask if needed
2011-03-14 03:28:00 +01:00
u = umask(0000);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
NULSTR_FOREACH(d, devnodes) {
move _cleanup_ attribute in front of the type http://lists.freedesktop.org/archives/systemd-devel/2013-April/010510.html
2013-04-18 09:11:22 +02:00
_cleanup_free_ char *from = NULL, *to = NULL;
exec: introduce PrivateDevices= switch to provide services with a private /dev Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that sets up a private /dev with only the API pseudo-devices like /dev/null, /dev/zero, /dev/random, but not any physical devices in them.
2014-01-20 19:54:51 +01:00
struct stat st;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
exec: introduce PrivateDevices= switch to provide services with a private /dev Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that sets up a private /dev with only the API pseudo-devices like /dev/null, /dev/zero, /dev/random, but not any physical devices in them.
2014-01-20 19:54:51 +01:00
from = strappend("/dev/", d);
to = strjoin(dest, "/dev/", d, NULL);
if (!from || !to)
return log_oom();
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
if (stat(from, &st) < 0) {
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (errno != ENOENT)
return log_error_errno(errno, "Failed to stat %s: %m", from);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
} else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode)) {
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: _cleanup_free_ more
2012-09-16 15:21:48 +02:00
log_error("%s is not a char or block device, cannot copy", from);
exec: introduce PrivateDevices= switch to provide services with a private /dev Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that sets up a private /dev with only the API pseudo-devices like /dev/null, /dev/zero, /dev/random, but not any physical devices in them.
2014-01-20 19:54:51 +01:00
return -EIO;
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: copy /dev/net/tun from host This enables tuntap support in the container (assumning the necessary capabilities are in place).
2014-10-08 15:01:07 +02:00
} else {
r = mkdir_parents(to, 0775);
if (r < 0) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(r, "Failed to create parent directory of %s: %m", to);
nspawn: copy /dev/net/tun from host This enables tuntap support in the container (assumning the necessary capabilities are in place).
2014-10-08 15:01:07 +02:00
return -r;
}
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: fallback on bind mount when mknod fails Some systems abusively restrict mknod, even when the device node already exists in /dev. This is unfortunate because it prevents systemd-nspawn from creating the basic devices in /dev in the container. This patch implements a workaround: when mknod fails, fallback on bind mounts. Additionally, /dev/console was created with a mknod with the same major/minor as /dev/null before bind mounting a pts on it. This patch removes the mknod and creates an empty regular file instead. In order to test this patch, I used the following configuration, which I think should replicate the system with the abusive restriction on mknod: # grep devices /proc/self/cgroup 4:devices:/user.slice/restrict # cat /sys/fs/cgroup/devices/user.slice/restrict/devices.list c 1:9 r c 5:2 rw c 136:* rw # systemd-nspawn --register=false -D . v2: - remove "bind", it is not needed since there is already MS_BIND v3: - fix error management when calling touch() - fix lowercase in error message
2015-03-31 17:14:48 +02:00
if (mknod(to, st.st_mode, st.st_rdev) < 0) {
if (errno != EPERM)
return log_error_errno(errno, "mknod(%s) failed: %m", to);
/* Some systems abusively restrict mknod but
* allow bind mounts. */
r = touch(to);
if (r < 0)
return log_error_errno(r, "touch (%s) failed: %m", to);
if (mount(from, to, NULL, MS_BIND, NULL) < 0)
return log_error_errno(errno, "Both mknod and bind mount (%s) failed: %m", to);
}
nspawn: chown basic device nodes to userns root
2015-02-19 12:03:39 +01:00
if (arg_userns && arg_uid_shift != UID_INVALID)
if (lchown(to, arg_uid_shift, arg_uid_shift) < 0)
return log_error_errno(errno, "chown() of device node %s failed: %m", to);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
}
}
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
return r;
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: create a separate devpts namespace for nspawn containers
2013-03-07 13:34:07 +01:00
static int setup_ptmx(const char *dest) {
_cleanup_free_ char *p = NULL;
p = strappend(dest, "/dev/ptmx");
if (!p)
return log_oom();
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (symlink("pts/ptmx", p) < 0)
return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
nspawn: create a separate devpts namespace for nspawn containers
2013-03-07 13:34:07 +01:00
nspawn: chown basic device nodes to userns root
2015-02-19 12:03:39 +01:00
if (arg_userns && arg_uid_shift != UID_INVALID)
if (lchown(p, arg_uid_shift, arg_uid_shift) < 0)
return log_error_errno(errno, "lchown() of symlink %s failed: %m", p);
nspawn: create a separate devpts namespace for nspawn containers
2013-03-07 13:34:07 +01:00
return 0;
}
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
static int setup_dev_console(const char *dest, const char *console) {
nspawn: don't try mknod() of /dev/console with the correct major/minor We overmount /dev/console with an external pty anyway, hence there's no point in using the real major/minor when we create the node to overmount. Instead, use the one of /dev/null now. This fixes a race against the cgroup device controller setup we are using. In case /dev/console was create before the cgroup policy was applied all was good, but if created in the opposite order the mknod() would fail, since creating /dev/console is not allowed by it. Creating /dev/null instances is however permitted, and hence use it.
2014-03-10 21:36:01 +01:00
_cleanup_umask_ mode_t u;
const char *to;
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
int r;
assert(dest);
assert(console);
u = umask(0000);
r = chmod_and_chown(console, 0600, 0, 0);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to correct access mode for TTY: %m");
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
/* We need to bind mount the right tty to /dev/console since
* ptys can only exist on pts file systems. To have something
nspawn: fallback on bind mount when mknod fails Some systems abusively restrict mknod, even when the device node already exists in /dev. This is unfortunate because it prevents systemd-nspawn from creating the basic devices in /dev in the container. This patch implements a workaround: when mknod fails, fallback on bind mounts. Additionally, /dev/console was created with a mknod with the same major/minor as /dev/null before bind mounting a pts on it. This patch removes the mknod and creates an empty regular file instead. In order to test this patch, I used the following configuration, which I think should replicate the system with the abusive restriction on mknod: # grep devices /proc/self/cgroup 4:devices:/user.slice/restrict # cat /sys/fs/cgroup/devices/user.slice/restrict/devices.list c 1:9 r c 5:2 rw c 136:* rw # systemd-nspawn --register=false -D . v2: - remove "bind", it is not needed since there is already MS_BIND v3: - fix error management when calling touch() - fix lowercase in error message
2015-03-31 17:14:48 +02:00
* to bind mount things on we create a empty regular file. */
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
to = strjoina(dest, "/dev/console");
nspawn: fallback on bind mount when mknod fails Some systems abusively restrict mknod, even when the device node already exists in /dev. This is unfortunate because it prevents systemd-nspawn from creating the basic devices in /dev in the container. This patch implements a workaround: when mknod fails, fallback on bind mounts. Additionally, /dev/console was created with a mknod with the same major/minor as /dev/null before bind mounting a pts on it. This patch removes the mknod and creates an empty regular file instead. In order to test this patch, I used the following configuration, which I think should replicate the system with the abusive restriction on mknod: # grep devices /proc/self/cgroup 4:devices:/user.slice/restrict # cat /sys/fs/cgroup/devices/user.slice/restrict/devices.list c 1:9 r c 5:2 rw c 136:* rw # systemd-nspawn --register=false -D . v2: - remove "bind", it is not needed since there is already MS_BIND v3: - fix error management when calling touch() - fix lowercase in error message
2015-03-31 17:14:48 +02:00
r = touch(to);
if (r < 0)
return log_error_errno(r, "touch() for /dev/console failed: %m");
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: change filesystem type from "bind" to NULL in mount() syscalls Try to keep syscalls as minimal as possible.
2015-03-31 11:50:29 +02:00
if (mount(console, to, NULL, MS_BIND, NULL) < 0)
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
return log_error_errno(errno, "Bind mount for /dev/console failed: %m");
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: use automatic cleanup for umask
2012-09-16 16:14:11 +02:00
return 0;
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
}
static int setup_kmsg(const char *dest, int kmsg_socket) {
move _cleanup_ attribute in front of the type http://lists.freedesktop.org/archives/systemd-devel/2013-April/010510.html
2013-04-18 09:11:22 +02:00
_cleanup_free_ char *from = NULL, *to = NULL;
_cleanup_umask_ mode_t u;
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
int r, fd, k;
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
union {
struct cmsghdr cmsghdr;
uint8_t buf[CMSG_SPACE(sizeof(int))];
Use initalization instead of explicit zeroing Before, we would initialize many fields twice: first by filling the structure with zeros, and then a second time with the real values. We can let the compiler do the job for us, avoiding one copy. A downside of this patch is that text gets slightly bigger. This is because all zero() calls are effectively inlined: $ size build/.libs/systemd text data bss dec hex filename before 897737 107300 2560 1007597 f5fed build/.libs/systemd after 897873 107300 2560 1007733 f6075 build/.libs/systemd … actually less than 1‰. A few asserts that the parameter is not null had to be removed. I don't think this changes much, because first, it is quite unlikely for the assert to fail, and second, an immediate SEGV is almost as good as an assert.
2013-03-25 00:59:00 +01:00
} control = {};
struct msghdr mh = {
.msg_control = &control,
.msg_controllen = sizeof(control),
};
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
struct cmsghdr *cmsg;
assert(dest);
assert(kmsg_socket >= 0);
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
u = umask(0000);
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: make /dev/kmsg unavailable in the container, but allow access to /proc/kmsg
2012-04-22 00:32:13 +02:00
/* We create the kmsg FIFO as /dev/kmsg, but immediately
* delete it after bind mounting it to /proc/kmsg. While FIFOs
* on the reading side behave very similar to /proc/kmsg,
* their writing side behaves differently from /dev/kmsg in
* that writing blocks when nothing is reading. In order to
* avoid any problems with containers deadlocking due to this
* we simply make /dev/kmsg unavailable to the container. */
nspawn: use automatic cleanup for umask
2012-09-16 16:14:11 +02:00
if (asprintf(&from, "%s/dev/kmsg", dest) < 0 ||
asprintf(&to, "%s/proc/kmsg", dest) < 0)
return log_oom();
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (mkfifo(from, 0600) < 0)
return log_error_errno(errno, "mkfifo() for /dev/kmsg failed: %m");
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
r = chmod_and_chown(from, 0600, 0, 0);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to correct access mode for /dev/kmsg: %m");
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
nspawn: change filesystem type from "bind" to NULL in mount() syscalls Try to keep syscalls as minimal as possible.
2015-03-31 11:50:29 +02:00
if (mount(from, to, NULL, MS_BIND, NULL) < 0)
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
return log_error_errno(errno, "Bind mount for /proc/kmsg failed: %m");
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
fd = open(from, O_RDWR|O_NDELAY|O_CLOEXEC);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (fd < 0)
return log_error_errno(errno, "Failed to open fifo: %m");
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
cmsg = CMSG_FIRSTHDR(&mh);
cmsg->cmsg_level = SOL_SOCKET;
cmsg->cmsg_type = SCM_RIGHTS;
cmsg->cmsg_len = CMSG_LEN(sizeof(int));
memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
mh.msg_controllen = cmsg->cmsg_len;
/* Store away the fd in the socket, so that it stays open as
* long as we run the child */
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
k = sendmsg(kmsg_socket, &mh, MSG_NOSIGNAL);
util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
2014-03-18 19:22:43 +01:00
safe_close(fd);
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (k < 0)
return log_error_errno(errno, "Failed to send FIFO fd: %m");
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: make /dev/kmsg unavailable in the container, but allow access to /proc/kmsg
2012-04-22 00:32:13 +02:00
/* And now make the FIFO unavailable as /dev/kmsg... */
unlink(from);
nspawn: use automatic cleanup for umask
2012-09-16 16:14:11 +02:00
return 0;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
}
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
static int send_rtnl(int send_fd) {
union {
struct cmsghdr cmsghdr;
uint8_t buf[CMSG_SPACE(sizeof(int))];
} control = {};
struct msghdr mh = {
.msg_control = &control,
.msg_controllen = sizeof(control),
};
struct cmsghdr *cmsg;
_cleanup_close_ int fd = -1;
ssize_t k;
assert(send_fd >= 0);
if (!arg_expose_ports)
return 0;
fd = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC|SOCK_NONBLOCK, NETLINK_ROUTE);
if (fd < 0)
return log_error_errno(errno, "failed to allocate container netlink: %m");
cmsg = CMSG_FIRSTHDR(&mh);
cmsg->cmsg_level = SOL_SOCKET;
cmsg->cmsg_type = SCM_RIGHTS;
cmsg->cmsg_len = CMSG_LEN(sizeof(int));
memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
mh.msg_controllen = cmsg->cmsg_len;
/* Store away the fd in the socket, so that it stays open as
* long as we run the child */
k = sendmsg(send_fd, &mh, MSG_NOSIGNAL);
if (k < 0)
return log_error_errno(errno, "Failed to send netlink fd: %m");
return 0;
}
static int flush_ports(union in_addr_union *exposed) {
ExposePort *p;
int r, af = AF_INET;
assert(exposed);
if (!arg_expose_ports)
return 0;
if (in_addr_is_null(af, exposed))
return 0;
log_debug("Lost IP address.");
LIST_FOREACH(ports, p, arg_expose_ports) {
r = fw_add_local_dnat(false,
af,
p->protocol,
NULL,
NULL, 0,
NULL, 0,
p->host_port,
exposed,
p->container_port,
NULL);
if (r < 0)
log_warning_errno(r, "Failed to modify firewall: %m");
}
*exposed = IN_ADDR_NULL;
return 0;
}
static int expose_ports(sd_rtnl *rtnl, union in_addr_union *exposed) {
_cleanup_free_ struct local_address *addresses = NULL;
_cleanup_free_ char *pretty = NULL;
union in_addr_union new_exposed;
ExposePort *p;
bool add;
int af = AF_INET, r;
assert(exposed);
/* Invoked each time an address is added or removed inside the
* container */
if (!arg_expose_ports)
return 0;
r = local_addresses(rtnl, 0, af, &addresses);
if (r < 0)
return log_error_errno(r, "Failed to enumerate local addresses: %m");
add = r > 0 &&
addresses[0].family == af &&
addresses[0].scope < RT_SCOPE_LINK;
if (!add)
return flush_ports(exposed);
new_exposed = addresses[0].address;
if (in_addr_equal(af, exposed, &new_exposed))
return 0;
in_addr_to_string(af, &new_exposed, &pretty);
log_debug("New container IP is %s.", strna(pretty));
LIST_FOREACH(ports, p, arg_expose_ports) {
r = fw_add_local_dnat(true,
af,
p->protocol,
NULL,
NULL, 0,
NULL, 0,
p->host_port,
&new_exposed,
p->container_port,
in_addr_is_null(af, exposed) ? NULL : exposed);
if (r < 0)
log_warning_errno(r, "Failed to modify firewall: %m");
}
*exposed = new_exposed;
return 0;
}
static int on_address_change(sd_rtnl *rtnl, sd_rtnl_message *m, void *userdata) {
union in_addr_union *exposed = userdata;
assert(rtnl);
assert(m);
assert(exposed);
expose_ports(rtnl, exposed);
return 0;
}
static int watch_rtnl(sd_event *event, int recv_fd, union in_addr_union *exposed, sd_rtnl **ret) {
union {
struct cmsghdr cmsghdr;
uint8_t buf[CMSG_SPACE(sizeof(int))];
} control = {};
struct msghdr mh = {
.msg_control = &control,
.msg_controllen = sizeof(control),
};
struct cmsghdr *cmsg;
_cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
int fd, r;
ssize_t k;
assert(event);
assert(recv_fd >= 0);
assert(ret);
if (!arg_expose_ports)
return 0;
k = recvmsg(recv_fd, &mh, MSG_NOSIGNAL);
if (k < 0)
return log_error_errno(errno, "Failed to recv netlink fd: %m");
cmsg = CMSG_FIRSTHDR(&mh);
assert(cmsg->cmsg_level == SOL_SOCKET);
assert(cmsg->cmsg_type == SCM_RIGHTS);
nspawn: fix an incorrect assert comparison
2015-01-14 23:17:07 +01:00
assert(cmsg->cmsg_len == CMSG_LEN(sizeof(int)));
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
memcpy(&fd, CMSG_DATA(cmsg), sizeof(int));
r = sd_rtnl_open_fd(&rtnl, fd, 1, RTNLGRP_IPV4_IFADDR);
if (r < 0) {
safe_close(fd);
return log_error_errno(r, "Failed to create rtnl object: %m");
}
r = sd_rtnl_add_match(rtnl, RTM_NEWADDR, on_address_change, exposed);
if (r < 0)
return log_error_errno(r, "Failed to subscribe to RTM_NEWADDR messages: %m");
r = sd_rtnl_add_match(rtnl, RTM_DELADDR, on_address_change, exposed);
if (r < 0)
return log_error_errno(r, "Failed to subscribe to RTM_DELADDR messages: %m");
r = sd_rtnl_attach_event(rtnl, event, 0);
if (r < 0)
return log_error_errno(r, "Failed to add to even loop: %m");
*ret = rtnl;
rtnl = NULL;
return 0;
}
nspawn: be more careful when initializing the hostname from the directory name
2012-04-22 01:01:22 +02:00
static int setup_hostname(void) {
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
if (arg_share_system)
return 0;
util: introduce sethostname_idempotent Function queries system hostname and applies changes only when necessary. Also, migrate all client of sethostname to sethostname_idempotent while at it.
2014-10-21 18:17:54 +02:00
if (sethostname_idempotent(arg_machine) < 0)
nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.
2013-04-16 04:36:06 +02:00
return -errno;
nspawn: be more careful when initializing the hostname from the directory name
2012-04-22 01:01:22 +02:00
nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.
2013-04-16 04:36:06 +02:00
return 0;
nspawn: be more careful when initializing the hostname from the directory name
2012-04-22 01:01:22 +02:00
}
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
static int setup_journal(const char *directory) {
nspawn: complain and continue if machine has same id If --link-journal=host or --link-journal=guest is used, this totally cannot work and we exit with an error. If however --link-journal=auto or --link-journal=no is used, just display a warning. Having the same machine id can happen if booting from the same filesystem as the host. Since other things mostly function correctly, let's allow that. https://bugs.freedesktop.org/show_bug.cgi?id=68369
2013-12-12 04:00:33 +01:00
sd_id128_t machine_id, this_id;
move _cleanup_ attribute in front of the type http://lists.freedesktop.org/archives/systemd-devel/2013-April/010510.html
2013-04-18 09:11:22 +02:00
_cleanup_free_ char *p = NULL, *b = NULL, *q = NULL, *d = NULL;
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
char *id;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
int r;
nspawn: don't link journals in ephemeral mode
2014-12-12 16:58:57 +01:00
/* Don't link journals in ephemeral mode */
if (arg_ephemeral)
return 0;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
p = strappend(directory, "/etc/machine-id");
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
if (!p)
return log_oom();
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
r = read_one_line_file(p, &b);
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
if (r == -ENOENT && arg_link_journal == LINK_AUTO)
return 0;
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
else if (r < 0)
return log_error_errno(r, "Failed to read machine ID from %s: %m", p);
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
id = strstrip(b);
if (isempty(id) && arg_link_journal == LINK_AUTO)
return 0;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
/* Verify validity */
r = sd_id128_from_string(id, &machine_id);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to parse machine ID from %s: %m", p);
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
nspawn: complain and continue if machine has same id If --link-journal=host or --link-journal=guest is used, this totally cannot work and we exit with an error. If however --link-journal=auto or --link-journal=no is used, just display a warning. Having the same machine id can happen if booting from the same filesystem as the host. Since other things mostly function correctly, let's allow that. https://bugs.freedesktop.org/show_bug.cgi?id=68369
2013-12-12 04:00:33 +01:00
r = sd_id128_get_machine(&this_id);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to retrieve machine ID: %m");
nspawn: complain and continue if machine has same id If --link-journal=host or --link-journal=guest is used, this totally cannot work and we exit with an error. If however --link-journal=auto or --link-journal=no is used, just display a warning. Having the same machine id can happen if booting from the same filesystem as the host. Since other things mostly function correctly, let's allow that. https://bugs.freedesktop.org/show_bug.cgi?id=68369
2013-12-12 04:00:33 +01:00
if (sd_id128_equal(machine_id, this_id)) {
log_full(arg_link_journal == LINK_AUTO ? LOG_WARNING : LOG_ERR,
"Host and machine ids are equal (%s): refusing to link journals", id);
if (arg_link_journal == LINK_AUTO)
return 0;
nspawn: don't link journals in ephemeral mode
2014-12-12 16:58:57 +01:00
return -EEXIST;
nspawn: complain and continue if machine has same id If --link-journal=host or --link-journal=guest is used, this totally cannot work and we exit with an error. If however --link-journal=auto or --link-journal=no is used, just display a warning. Having the same machine id can happen if booting from the same filesystem as the host. Since other things mostly function correctly, let's allow that. https://bugs.freedesktop.org/show_bug.cgi?id=68369
2013-12-12 04:00:33 +01:00
}
if (arg_link_journal == LINK_NO)
return 0;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
free(p);
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
p = strappend("/var/log/journal/", id);
q = strjoin(directory, "/var/log/journal/", id, NULL);
if (!p || !q)
return log_oom();
if (path_is_mount_point(p, false) > 0) {
if (arg_link_journal != LINK_AUTO) {
log_error("%s: already a mount point, refusing to use for journal", p);
return -EEXIST;
}
return 0;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
if (path_is_mount_point(q, false) > 0) {
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
if (arg_link_journal != LINK_AUTO) {
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
log_error("%s: already a mount point, refusing to use for journal", q);
return -EEXIST;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
return 0;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
r = readlink_and_make_absolute(p, &d);
if (r >= 0) {
if ((arg_link_journal == LINK_GUEST ||
arg_link_journal == LINK_AUTO) &&
path_equal(d, q)) {
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
r = mkdir_p(q, 0755);
if (r < 0)
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_warning_errno(errno, "Failed to create directory %s: %m", q);
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
return 0;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (unlink(p) < 0)
return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
} else if (r == -EINVAL) {
if (arg_link_journal == LINK_GUEST &&
rmdir(p) < 0) {
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
if (errno == ENOTDIR) {
log_error("%s already exists and is neither a symlink nor a directory", p);
return r;
} else {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to remove %s: %m", p);
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
return -errno;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
}
} else if (r != -ENOENT) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "readlink(%s) failed: %m", p);
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
return r;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
if (arg_link_journal == LINK_GUEST) {
if (symlink(q, p) < 0) {
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
if (arg_link_journal_try) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
return 0;
} else {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
return -errno;
}
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
r = mkdir_p(q, 0755);
if (r < 0)
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_warning_errno(errno, "Failed to create directory %s: %m", q);
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
return 0;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
if (arg_link_journal == LINK_HOST) {
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
/* don't create parents here -- if the host doesn't have
* permanent journal set up, don't force it here */
r = mkdir(p, 0755);
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
if (r < 0) {
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
if (arg_link_journal_try) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_debug_errno(errno, "Failed to create %s, skipping journal setup: %m", p);
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
return 0;
} else {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to create %s: %m", p);
nspawn: Add try-{host,guest} journal link modes --link-journal={host,guest} fail if the host does not have persistent journalling enabled and /var/log/journal/ does not exist. Even worse, as there is no stdout/err any more, there is no error message to point that out. Introduce two new modes "try-host" and "try-guest" which don't fail in this case, and instead just silently skip the guest journal setup. Change -j to mean "try-guest" instead of "guest", and fix the wrong --help output for it (it said "host" before). Change systemd-nspawn@.service.in to use "try-guest" so that this unit works with both persistent and non-persistent journals on the host without failing. https://bugs.debian.org/770275
2014-11-20 14:30:52 +01:00
return r;
}
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
} else if (access(p, F_OK) < 0)
return 0;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
nspawn: restore journal directory is empty check This undoes part of commit e6a4a517befe559adf6d1dbbadf425c3538849c9. Instead of removing the error message about non-empty journal bind mount directories, simply downgrade the message to a warning and proceed.
2014-05-22 08:19:46 +02:00
if (dir_is_empty(q) == 0)
log_warning("%s is not empty, proceeding anyway.", q);
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
r = mkdir_p(q, 0755);
if (r < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to create %s: %m", q);
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
return r;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
nspawn: change filesystem type from "bind" to NULL in mount() syscalls Try to keep syscalls as minimal as possible.
2015-03-31 11:50:29 +02:00
if (mount(p, q, NULL, MS_BIND, NULL) < 0)
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
nspawn: use automatic cleanup and provide debug info The documentation for --link-journal is also reworded.
2012-10-02 10:58:31 +02:00
return 0;
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
static int drop_capabilities(void) {
nspawn: introduce new --capabilities= flag and make use of it in the nspawn test case
2012-06-28 13:44:39 +02:00
return capability_bounding_set_drop(~arg_retain, false);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
}
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
static int register_machine(pid_t pid, int local_ifindex) {
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
_cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
bus: always explicitly close bus from main programs Since b5eca3a2059f9399d1dc52cbcf9698674c4b1cf0 we don't attempt to GC busses anymore when unsent messages remain that keep their reference, when they otherwise are not referenced anymore. This means that if we explicitly want connections to go away, we need to close them. With this change we will no do so explicitly wherver we connect to the bus from a main program (and thus know when the bus connection should go away), or when we create a private bus connection, that really should go away after our use. This fixes connection leaks in the NSS and PAM modules.
2014-08-04 16:22:09 +02:00
_cleanup_bus_close_unref_ sd_bus *bus = NULL;
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
int r;
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
if (!arg_register)
return 0;
nspawn: always use default bus
2014-02-05 23:06:34 +01:00
r = sd_bus_default_system(&bus);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to open system bus: %m");
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
if (arg_keep_unit) {
r = sd_bus_call_method(
bus,
"org.freedesktop.machine1",
"/org/freedesktop/machine1",
"org.freedesktop.machine1.Manager",
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
"RegisterMachineWithNetwork",
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
&error,
NULL,
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
"sayssusai",
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
arg_machine,
SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
"nspawn",
"container",
(uint32_t) pid,
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
strempty(arg_directory),
local_ifindex > 0 ? 1 : 0, local_ifindex);
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
} else {
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
_cleanup_bus_message_unref_ sd_bus_message *m = NULL;
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
char **i;
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
r = sd_bus_message_new_method_call(
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
bus,
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
&m,
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
"org.freedesktop.machine1",
"/org/freedesktop/machine1",
"org.freedesktop.machine1.Manager",
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
"CreateMachineWithNetwork");
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
return bus_log_create_error(r);
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
r = sd_bus_message_append(
m,
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
"sayssusai",
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
arg_machine,
SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
"nspawn",
"container",
(uint32_t) pid,
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
strempty(arg_directory),
local_ifindex > 0 ? 1 : 0, local_ifindex);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
return bus_log_create_error(r);
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
r = sd_bus_message_open_container(m, 'a', "(sv)");
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
return bus_log_create_error(r);
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
if (!isempty(arg_slice)) {
r = sd_bus_message_append(m, "(sv)", "Slice", "s", arg_slice);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
return bus_log_create_error(r);
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
}
r = sd_bus_message_append(m, "(sv)", "DevicePolicy", "s", "strict");
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
return bus_log_create_error(r);
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
sd-bus: sync with kdbus upstream (ABI break) kdbus has seen a larger update than expected lately, most notably with kdbusfs, a file system to expose the kdbus control files: * Each time a file system of this type is mounted, a new kdbus domain is created. * The layout inside each mount point is the same as before, except that domains are not hierarchically nested anymore. * Domains are therefore also unnamed now. * Unmounting a kdbusfs will automatically also detroy the associated domain. * Hence, the action of creating a kdbus domain is now as privileged as mounting a filesystem. * This way, we can get around creating dev nodes for everything, which is last but not least something that is not limited by 20-bit minor numbers. The kdbus specific bits in nspawn have all been dropped now, as nspawn can rely on the container OS to set up its own kdbus domain, simply by mounting a new instance. A new set of mounts has been added to mount things *after* the kernel modules have been loaded. For now, only kdbus is in this set, which is invoked with mount_setup_late().
2014-11-13 20:33:03 +01:00
r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 9,
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
/* Allow the container to
* access and create the API
* device nodes, so that
* PrivateDevices= in the
* container can work
* fine */
"/dev/null", "rwm",
"/dev/zero", "rwm",
"/dev/full", "rwm",
"/dev/random", "rwm",
"/dev/urandom", "rwm",
"/dev/tty", "rwm",
nspawn: actually allow access to /dev/net/tun in the container It's not sufficient to just copy the device node over, we need to update the policy for it too.
2014-10-10 11:11:25 +02:00
"/dev/net/tun", "rwm",
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
/* Allow the container
* access to ptys. However,
* do not permit the
* container to ever create
* these device nodes. */
"/dev/pts/ptmx", "rw",
sd-bus: sync with kdbus upstream (ABI break) kdbus has seen a larger update than expected lately, most notably with kdbusfs, a file system to expose the kdbus control files: * Each time a file system of this type is mounted, a new kdbus domain is created. * The layout inside each mount point is the same as before, except that domains are not hierarchically nested anymore. * Domains are therefore also unnamed now. * Unmounting a kdbusfs will automatically also detroy the associated domain. * Hence, the action of creating a kdbus domain is now as privileged as mounting a filesystem. * This way, we can get around creating dev nodes for everything, which is last but not least something that is not limited by 20-bit minor numbers. The kdbus specific bits in nspawn have all been dropped now, as nspawn can rely on the container OS to set up its own kdbus domain, simply by mounting a new instance. A new set of mounts has been added to mount things *after* the kernel modules have been loaded. For now, only kdbus is in this set, which is invoked with mount_setup_late().
2014-11-13 20:33:03 +01:00
"char-pts", "rw");
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add device whitelist: %m");
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
STRV_FOREACH(i, arg_property) {
r = sd_bus_message_open_container(m, 'r', "sv");
if (r < 0)
return bus_log_create_error(r);
r = bus_append_unit_property_assignment(m, *i);
if (r < 0)
return r;
r = sd_bus_message_close_container(m);
if (r < 0)
return bus_log_create_error(r);
}
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
r = sd_bus_message_close_container(m);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
nspawn: add support for --property= to set scope properties This is similar to systemd-run's --property= setting.
2015-02-18 19:38:55 +01:00
return bus_log_create_error(r);
nspawn: make use of the devices cgroup controller by default
2014-02-24 03:00:38 +01:00
r = sd_bus_call(bus, m, 0, &error, NULL);
machined: optionally, allow registration of pre-existing units (scopes or services) as machine with machined
2014-02-11 17:15:38 +01:00
}
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
if (r < 0) {
nspawn: explicitly terminate machines when we exit nspawn https://bugs.freedesktop.org/show_bug.cgi?id=68370 https://bugzilla.redhat.com/show_bug.cgi?id=988883
2013-11-06 02:05:06 +01:00
log_error("Failed to register machine: %s", bus_error_message(&error, r));
return r;
}
return 0;
}
static int terminate_machine(pid_t pid) {
_cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
_cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
bus: always explicitly close bus from main programs Since b5eca3a2059f9399d1dc52cbcf9698674c4b1cf0 we don't attempt to GC busses anymore when unsent messages remain that keep their reference, when they otherwise are not referenced anymore. This means that if we explicitly want connections to go away, we need to close them. With this change we will no do so explicitly wherver we connect to the bus from a main program (and thus know when the bus connection should go away), or when we create a private bus connection, that really should go away after our use. This fixes connection leaks in the NSS and PAM modules.
2014-08-04 16:22:09 +02:00
_cleanup_bus_close_unref_ sd_bus *bus = NULL;
nspawn: explicitly terminate machines when we exit nspawn https://bugs.freedesktop.org/show_bug.cgi?id=68370 https://bugzilla.redhat.com/show_bug.cgi?id=988883
2013-11-06 02:05:06 +01:00
const char *path;
int r;
nspawn: add --register=yes|no switch to optionally disable registration of the container with machined
2014-02-10 15:36:32 +01:00
if (!arg_register)
return 0;
bus: introduce concept of a default bus for each thread and make use of it everywhere We want to emphasize bus connections as per-thread communication primitives, hence introduce a concept of a per-thread default bus, and make use of it everywhere.
2013-11-11 22:00:48 +01:00
r = sd_bus_default_system(&bus);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to open system bus: %m");
nspawn: explicitly terminate machines when we exit nspawn https://bugs.freedesktop.org/show_bug.cgi?id=68370 https://bugzilla.redhat.com/show_bug.cgi?id=988883
2013-11-06 02:05:06 +01:00
r = sd_bus_call_method(
bus,
"org.freedesktop.machine1",
"/org/freedesktop/machine1",
"org.freedesktop.machine1.Manager",
"GetMachineByPID",
&error,
&reply,
"u",
(uint32_t) pid);
if (r < 0) {
/* Note that the machine might already have been
* cleaned up automatically, hence don't consider it a
* failure if we cannot get the machine object. */
log_debug("Failed to get machine: %s", bus_error_message(&error, r));
return 0;
}
r = sd_bus_message_read(reply, "o", &path);
bus: log message parsing errors everywhere with a generalized bus_log_parse_error()
2013-11-07 21:26:31 +01:00
if (r < 0)
return bus_log_parse_error(r);
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
nspawn: explicitly terminate machines when we exit nspawn https://bugs.freedesktop.org/show_bug.cgi?id=68370 https://bugzilla.redhat.com/show_bug.cgi?id=988883
2013-11-06 02:05:06 +01:00
r = sd_bus_call_method(
bus,
"org.freedesktop.machine1",
path,
"org.freedesktop.machine1.Machine",
"Terminate",
&error,
NULL,
NULL);
if (r < 0) {
log_debug("Failed to terminate machine: %s", bus_error_message(&error, r));
return 0;
}
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
return 0;
}
nspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use of this
2014-02-12 02:52:39 +01:00
static int reset_audit_loginuid(void) {
_cleanup_free_ char *p = NULL;
int r;
if (arg_share_system)
return 0;
r = read_one_line_file("/proc/self/loginuid", &p);
nspawn: fix detection of missing /proc/self/loginuid Running 'systemd-nspawn -D /srv/Fedora/' gave me this error: Failed to read /proc/self/loginuid: No such file or directory Container Fedora failed with error code 1. This patch fixes the problem.
2014-02-25 16:19:35 +01:00
if (r == -ENOENT)
nspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use of this
2014-02-12 02:52:39 +01:00
return 0;
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
nspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use of this
2014-02-12 02:52:39 +01:00
/* Already reset? */
if (streq(p, "4294967295"))
return 0;
r = write_string_file("/proc/self/loginuid", "4294967295");
if (r < 0) {
log_error("Failed to reset audit login UID. This probably means that your kernel is too\n"
"old and you have audit enabled. Note that the auditing subsystem is known to\n"
"be incompatible with containers on old kernels. Please make sure to upgrade\n"
"your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
"using systemd-nspawn. Sleeping for 5s... (%s)\n", strerror(-r));
audit: since audit is apparently never going to be fixed for containers tell the user what's going on Let's try to be helpful to the user and give him a hint what he can do to make nspawn work with normal OS containers. https://bugzilla.redhat.com/show_bug.cgi?id=893751
2013-05-10 00:14:12 +02:00
nspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use of this
2014-02-12 02:52:39 +01:00
sleep(5);
audit: since audit is apparently never going to be fixed for containers tell the user what's going on Let's try to be helpful to the user and give him a hint what he can do to make nspawn work with normal OS containers. https://bugzilla.redhat.com/show_bug.cgi?id=893751
2013-05-10 00:14:12 +02:00
}
nspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use of this
2014-02-12 02:52:39 +01:00
return 0;
audit: since audit is apparently never going to be fixed for containers tell the user what's going on Let's try to be helpful to the user and give him a hint what he can do to make nspawn work with normal OS containers. https://bugzilla.redhat.com/show_bug.cgi?id=893751
2013-05-10 00:14:12 +02:00
}
nspawn: make sure that when --network-veth is used both the host and the container side get fixed MAC addresses
2014-08-04 19:15:07 +02:00
#define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
#define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
nspawn: make sure macvlan MAC addresses are stable https://bugs.freedesktop.org/show_bug.cgi?id=85527
2014-12-09 01:20:09 +01:00
#define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)
nspawn: make host0's MAC address persistent We still need to make sure that no two MAC addresses are the same, so we use a logic similar to what is used in udev to generate MAC addresses, and base it on a hash of the host's machine ID and thecontainer's name.
2014-03-13 17:47:30 +01:00
nspawn: create the macvlan MAC addresses in an arch independent stable way
2014-12-10 00:26:16 +01:00
static int generate_mac(struct ether_addr *mac, sd_id128_t hash_key, uint64_t idx) {
nspawn: make host0's MAC address persistent We still need to make sure that no two MAC addresses are the same, so we use a logic similar to what is used in udev to generate MAC addresses, and base it on a hash of the host's machine ID and thecontainer's name.
2014-03-13 17:47:30 +01:00
uint8_t result[8];
size_t l, sz;
nspawn: create the macvlan MAC addresses in an arch independent stable way
2014-12-10 00:26:16 +01:00
uint8_t *v, *i;
int r;
nspawn: make host0's MAC address persistent We still need to make sure that no two MAC addresses are the same, so we use a logic similar to what is used in udev to generate MAC addresses, and base it on a hash of the host's machine ID and thecontainer's name.
2014-03-13 17:47:30 +01:00
l = strlen(arg_machine);
sz = sizeof(sd_id128_t) + l;
nspawn: make sure macvlan MAC addresses are stable https://bugs.freedesktop.org/show_bug.cgi?id=85527
2014-12-09 01:20:09 +01:00
if (idx > 0)
sz += sizeof(idx);
nspawn: create the macvlan MAC addresses in an arch independent stable way
2014-12-10 00:26:16 +01:00
nspawn: make host0's MAC address persistent We still need to make sure that no two MAC addresses are the same, so we use a logic similar to what is used in udev to generate MAC addresses, and base it on a hash of the host's machine ID and thecontainer's name.
2014-03-13 17:47:30 +01:00
v = alloca(sz);
/* fetch some persistent data unique to the host */
r = sd_id128_get_machine((sd_id128_t*) v);
if (r < 0)
return r;
/* combine with some data unique (on this host) to this
* container instance */
nspawn: create the macvlan MAC addresses in an arch independent stable way
2014-12-10 00:26:16 +01:00
i = mempcpy(v + sizeof(sd_id128_t), arg_machine, l);
if (idx > 0) {
idx = htole64(idx);
memcpy(i, &idx, sizeof(idx));
}
nspawn: make host0's MAC address persistent We still need to make sure that no two MAC addresses are the same, so we use a logic similar to what is used in udev to generate MAC addresses, and base it on a hash of the host's machine ID and thecontainer's name.
2014-03-13 17:47:30 +01:00
/* Let's hash the host machine ID plus the container name. We
* use a fixed, but originally randomly created hash key here. */
nspawn: make sure that when --network-veth is used both the host and the container side get fixed MAC addresses
2014-08-04 19:15:07 +02:00
siphash24(result, v, sz, hash_key.bytes);
nspawn: make host0's MAC address persistent We still need to make sure that no two MAC addresses are the same, so we use a logic similar to what is used in udev to generate MAC addresses, and base it on a hash of the host's machine ID and thecontainer's name.
2014-03-13 17:47:30 +01:00
assert_cc(ETH_ALEN <= sizeof(result));
memcpy(mac->ether_addr_octet, result, ETH_ALEN);
/* see eth_random_addr in the kernel */
mac->ether_addr_octet[0] &= 0xfe; /* clear multicast bit */
mac->ether_addr_octet[0] |= 0x02; /* set local assignment bit (IEEE802) */
return 0;
}
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ], int *ifi) {
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
_cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
rtnl: drop "sd_" prefix from cleanup macros The "sd_" prefix is supposed to be used on exported symbols only, and not in the middle of names. Let's drop it from the cleanup macros hence, to make things simpler. The bus cleanup macros don't carry the "sd_" either, so this brings the APIs a bit nearer.
2014-02-13 03:44:14 +01:00
_cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
nspawn: make sure that when --network-veth is used both the host and the container side get fixed MAC addresses
2014-08-04 19:15:07 +02:00
struct ether_addr mac_host, mac_container;
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
int r, i;
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
if (!arg_private_network)
return 0;
if (!arg_network_veth)
return 0;
nspawn: when adding a veth interface to a bridge, use the "vb-" rather than "ve-" interface name prefix This way we can recognize the interfaces later on to apply different host-side configuration to them.
2014-02-21 04:02:12 +01:00
/* Use two different interface name prefixes depending whether
* we are in bridge mode or not. */
nspawn: don't try to create veth link with too long ifname Reported by: James Lott <james@lottspot.com>
2014-09-19 23:02:00 +02:00
snprintf(iface_name, IFNAMSIZ - 1, "%s-%s",
nspawn: fix truncation of machine names in interface names Based on patch by Michael Marineau <michael.marineau@coreos.com>: When deriving the network interface name from machine name strncpy was not properly null terminating the string and the maximum string size as returned by strlen() is actually IFNAMSIZ-1, not IFNAMSIZ.
2014-08-03 07:28:21 +02:00
arg_network_bridge ? "vb" : "ve", arg_machine);
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
nspawn: make sure macvlan MAC addresses are stable https://bugs.freedesktop.org/show_bug.cgi?id=85527
2014-12-09 01:20:09 +01:00
r = generate_mac(&mac_container, CONTAINER_HASH_KEY, 0);
if (r < 0)
return log_error_errno(r, "Failed to generate predictable MAC address for container side: %m");
nspawn: make sure that when --network-veth is used both the host and the container side get fixed MAC addresses
2014-08-04 19:15:07 +02:00
nspawn: make sure macvlan MAC addresses are stable https://bugs.freedesktop.org/show_bug.cgi?id=85527
2014-12-09 01:20:09 +01:00
r = generate_mac(&mac_host, HOST_HASH_KEY, 0);
if (r < 0)
return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");
nspawn: make host0's MAC address persistent We still need to make sure that no two MAC addresses are the same, so we use a logic similar to what is used in udev to generate MAC addresses, and base it on a hash of the host's machine ID and thecontainer's name.
2014-03-13 17:47:30 +01:00
api: in constructor function calls, always put the returned object pointer first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.
2014-02-19 23:54:58 +01:00
r = sd_rtnl_open(&rtnl, 0);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to connect to netlink: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
api: in constructor function calls, always put the returned object pointer first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.
2014-02-19 23:54:58 +01:00
r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to allocate netlink message: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
r = sd_rtnl_message_append_string(m, IFLA_IFNAME, iface_name);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add netlink interface name: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
nspawn: make sure that when --network-veth is used both the host and the container side get fixed MAC addresses
2014-08-04 19:15:07 +02:00
r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac_host);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add netlink MAC address: %m");
nspawn: make sure that when --network-veth is used both the host and the container side get fixed MAC addresses
2014-08-04 19:15:07 +02:00
sd-rtnl: message_open_container - don't take a 'size' argument We can always know the size based on the type, so let's do this inside the library.
2014-02-14 22:39:48 +01:00
r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to open netlink container: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
sd-rtnl: rework rtnl type system Use a static table with all the typing information, rather than repeated switch statements. This should make it a lot simpler to add new types. We need to keep all the type info to be able to create containers without exposing their implementation details to the users of the library. As a freebee we verify the types of appended/read attributes. The API is extended to nicely deal with unions of container types.
2014-03-26 19:25:01 +01:00
r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "veth");
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to open netlink container: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
sd-rtnl: message_open_container - don't take a 'size' argument We can always know the size based on the type, so let's do this inside the library.
2014-02-14 22:39:48 +01:00
r = sd_rtnl_message_open_container(m, VETH_INFO_PEER);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to open netlink container: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
r = sd_rtnl_message_append_string(m, IFLA_IFNAME, "host0");
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add netlink interface name: %m");
nspawn: make host0's MAC address persistent We still need to make sure that no two MAC addresses are the same, so we use a logic similar to what is used in udev to generate MAC addresses, and base it on a hash of the host's machine ID and thecontainer's name.
2014-03-13 17:47:30 +01:00
nspawn: make sure that when --network-veth is used both the host and the container side get fixed MAC addresses
2014-08-04 19:15:07 +02:00
r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac_container);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add netlink MAC address: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add netlink namespace field: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
r = sd_rtnl_message_close_container(m);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to close netlink container: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
r = sd_rtnl_message_close_container(m);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to close netlink container: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
r = sd_rtnl_message_close_container(m);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to close netlink container: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
r = sd_rtnl_call(rtnl, m, 0, NULL);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add new veth interfaces: %m");
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
i = (int) if_nametoindex(iface_name);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (i <= 0)
return log_error_errno(errno, "Failed to resolve interface %s: %m", iface_name);
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
*ifi = i;
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
return 0;
}
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
static int setup_bridge(const char veth_name[], int *ifi) {
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
_cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
_cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
int r, bridge;
if (!arg_private_network)
return 0;
if (!arg_network_veth)
return 0;
if (!arg_network_bridge)
return 0;
bridge = (int) if_nametoindex(arg_network_bridge);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (bridge <= 0)
return log_error_errno(errno, "Failed to resolve interface %s: %m", arg_network_bridge);
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
*ifi = bridge;
api: in constructor function calls, always put the returned object pointer first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.
2014-02-19 23:54:58 +01:00
r = sd_rtnl_open(&rtnl, 0);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to connect to netlink: %m");
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
api: in constructor function calls, always put the returned object pointer first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.
2014-02-19 23:54:58 +01:00
r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to allocate netlink message: %m");
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
nspawn: UP the host side of the veth pair after adding it to a bridge
2014-03-16 13:55:41 +01:00
r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to set IFF_UP flag: %m");
nspawn: UP the host side of the veth pair after adding it to a bridge
2014-03-16 13:55:41 +01:00
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
r = sd_rtnl_message_append_string(m, IFLA_IFNAME, veth_name);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add netlink interface name field: %m");
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
r = sd_rtnl_message_append_u32(m, IFLA_MASTER, bridge);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add netlink master field: %m");
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
r = sd_rtnl_call(rtnl, m, 0, NULL);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add veth interface to bridge: %m");
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
return 0;
}
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
static int parse_interface(struct udev *udev, const char *name) {
_cleanup_udev_device_unref_ struct udev_device *d = NULL;
char ifi_str[2 + DECIMAL_STR_MAX(int)];
int ifi;
ifi = (int) if_nametoindex(name);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (ifi <= 0)
return log_error_errno(errno, "Failed to resolve interface %s: %m", name);
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
sprintf(ifi_str, "n%i", ifi);
d = udev_device_new_from_device_id(udev, ifi_str);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (!d)
return log_error_errno(errno, "Failed to get udev device for interface %s: %m", name);
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
if (udev_device_get_is_initialized(d) <= 0) {
log_error("Network interface %s is not initialized yet.", name);
return -EBUSY;
}
return ifi;
}
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
static int move_network_interfaces(pid_t pid) {
nspawn: check with udev before we take possession of an interface
2014-02-13 14:38:02 +01:00
_cleanup_udev_unref_ struct udev *udev = NULL;
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
_cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
char **i;
int r;
if (!arg_private_network)
return 0;
if (strv_isempty(arg_network_interfaces))
return 0;
api: in constructor function calls, always put the returned object pointer first (or second) Previously the returned object of constructor functions where sometimes returned as last, sometimes as first and sometimes as second parameter. Let's clean this up a bit. Here are the new rules: 1. The object the new object is derived from is put first, if there is any 2. The object we are creating will be returned in the next arguments 3. This is followed by any additional arguments Rationale: For functions that operate on an object we always put that object first. Constructors should probably not be too different in this regard. Also, if the additional parameters might want to use varargs which suggests to put them last. Note that this new scheme only applies to constructor functions, not to all other functions. We do give a lot of freedom for those. Note that this commit only changes the order of the new functions we added, for old ones we accept the wrong order and leave it like that.
2014-02-19 23:54:58 +01:00
r = sd_rtnl_open(&rtnl, 0);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to connect to netlink: %m");
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
nspawn: check with udev before we take possession of an interface
2014-02-13 14:38:02 +01:00
udev = udev_new();
if (!udev) {
log_error("Failed to connect to udev.");
return -ENOMEM;
}
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
STRV_FOREACH(i, arg_network_interfaces) {
rtnl: drop "sd_" prefix from cleanup macros The "sd_" prefix is supposed to be used on exported symbols only, and not in the middle of names. Let's drop it from the cleanup macros hence, to make things simpler. The bus cleanup macros don't carry the "sd_" either, so this brings the APIs a bit nearer.
2014-02-13 03:44:14 +01:00
_cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
nspawn: no need to subscribe to netlink messages if we just want to execute one operation
2014-02-13 14:08:16 +01:00
int ifi;
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
ifi = parse_interface(udev, *i);
if (ifi < 0)
return ifi;
nspawn: fix --network-interface Use SETLINK when modifying an existing link.
2014-08-28 12:15:51 +02:00
r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to allocate netlink message: %m");
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to append namespace PID to netlink message: %m");
nspawn: check with udev before we take possession of an interface
2014-02-13 14:38:02 +01:00
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
r = sd_rtnl_call(rtnl, m, 0, NULL);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
}
nspawn: check with udev before we take possession of an interface
2014-02-13 14:38:02 +01:00
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
return 0;
}
static int setup_macvlan(pid_t pid) {
_cleanup_udev_unref_ struct udev *udev = NULL;
_cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
nspawn: make sure macvlan MAC addresses are stable https://bugs.freedesktop.org/show_bug.cgi?id=85527
2014-12-09 01:20:09 +01:00
unsigned idx = 0;
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
char **i;
int r;
if (!arg_private_network)
return 0;
if (strv_isempty(arg_network_macvlan))
return 0;
r = sd_rtnl_open(&rtnl, 0);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to connect to netlink: %m");
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
udev = udev_new();
if (!udev) {
log_error("Failed to connect to udev.");
return -ENOMEM;
}
STRV_FOREACH(i, arg_network_macvlan) {
_cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
_cleanup_free_ char *n = NULL;
nspawn: make sure macvlan MAC addresses are stable https://bugs.freedesktop.org/show_bug.cgi?id=85527
2014-12-09 01:20:09 +01:00
struct ether_addr mac;
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
int ifi;
ifi = parse_interface(udev, *i);
if (ifi < 0)
return ifi;
nspawn: make sure macvlan MAC addresses are stable https://bugs.freedesktop.org/show_bug.cgi?id=85527
2014-12-09 01:20:09 +01:00
r = generate_mac(&mac, MACVLAN_HASH_KEY, idx++);
if (r < 0)
return log_error_errno(r, "Failed to create MACVLAN MAC address: %m");
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to allocate netlink message: %m");
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
r = sd_rtnl_message_append_u32(m, IFLA_LINK, ifi);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add netlink interface index: %m");
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
n = strappend("mv-", *i);
if (!n)
return log_oom();
strshorten(n, IFNAMSIZ-1);
r = sd_rtnl_message_append_string(m, IFLA_IFNAME, n);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add netlink interface name: %m");
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
nspawn: make sure macvlan MAC addresses are stable https://bugs.freedesktop.org/show_bug.cgi?id=85527
2014-12-09 01:20:09 +01:00
r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
if (r < 0)
return log_error_errno(r, "Failed to add netlink MAC address: %m");
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add netlink namespace field: %m");
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to open netlink container: %m");
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
sd-rtnl: rework rtnl type system Use a static table with all the typing information, rather than repeated switch statements. This should make it a lot simpler to add new types. We need to keep all the type info to be able to create containers without exposing their implementation details to the users of the library. As a freebee we verify the types of appended/read attributes. The API is extended to nicely deal with unions of container types.
2014-03-26 19:25:01 +01:00
r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to open netlink container: %m");
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
r = sd_rtnl_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to append macvlan mode: %m");
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
r = sd_rtnl_message_close_container(m);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to close netlink container: %m");
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
r = sd_rtnl_message_close_container(m);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to close netlink container: %m");
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
r = sd_rtnl_call(rtnl, m, 0, NULL);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
}
return 0;
}
nspawn: add ipvlan support
2015-01-20 00:18:28 +01:00
static int setup_ipvlan(pid_t pid) {
_cleanup_udev_unref_ struct udev *udev = NULL;
_cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
char **i;
int r;
if (!arg_private_network)
return 0;
if (strv_isempty(arg_network_ipvlan))
return 0;
r = sd_rtnl_open(&rtnl, 0);
if (r < 0)
return log_error_errno(r, "Failed to connect to netlink: %m");
udev = udev_new();
if (!udev) {
log_error("Failed to connect to udev.");
return -ENOMEM;
}
STRV_FOREACH(i, arg_network_ipvlan) {
_cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
_cleanup_free_ char *n = NULL;
int ifi;
ifi = parse_interface(udev, *i);
if (ifi < 0)
return ifi;
r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
if (r < 0)
return log_error_errno(r, "Failed to allocate netlink message: %m");
r = sd_rtnl_message_append_u32(m, IFLA_LINK, ifi);
if (r < 0)
return log_error_errno(r, "Failed to add netlink interface index: %m");
n = strappend("iv-", *i);
if (!n)
return log_oom();
strshorten(n, IFNAMSIZ-1);
r = sd_rtnl_message_append_string(m, IFLA_IFNAME, n);
if (r < 0)
return log_error_errno(r, "Failed to add netlink interface name: %m");
r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
if (r < 0)
return log_error_errno(r, "Failed to add netlink namespace field: %m");
r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
if (r < 0)
return log_error_errno(r, "Failed to open netlink container: %m");
r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "ipvlan");
if (r < 0)
return log_error_errno(r, "Failed to open netlink container: %m");
r = sd_rtnl_message_append_u16(m, IFLA_IPVLAN_MODE, IPVLAN_MODE_L2);
if (r < 0)
return log_error_errno(r, "Failed to add ipvlan mode: %m");
r = sd_rtnl_message_close_container(m);
if (r < 0)
return log_error_errno(r, "Failed to close netlink container: %m");
r = sd_rtnl_message_close_container(m);
if (r < 0)
return log_error_errno(r, "Failed to close netlink container: %m");
r = sd_rtnl_call(rtnl, m, 0, NULL);
if (r < 0)
return log_error_errno(r, "Failed to add new ipvlan interfaces: %m");
}
return 0;
}
nspawn: block open_by_handle_at() and others via seccomp Let's protect ourselves against the recently reported docker security issue. Our man page makes clear that we do not make any security promises anyway, but well, this one is easy to mitigate, so let's do it. While we are at it block a couple of more syscalls that are no good in containers, too.
2014-06-30 16:22:12 +02:00
static int setup_seccomp(void) {
nspawn: make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOTSUPPORT in containers The kernel still doesn't support audit in containers, so let's make use of seccomp and simply turn it off entirely. We can get rid of this big as soon as the kernel is fixed again.
2014-02-13 20:30:02 +01:00
#ifdef HAVE_SECCOMP
nspawn: Map all seccomp filters to capabilities This change makes it so all seccomp filters are mapped to the appropriate capability and are only added if that capability was not requested when running the container. This unbreaks the remaining use cases broken by the addition of seccomp filters without respecting requested capabilities. Co-Authored-By: Clif Houck <me@clifhouck.com> [zj: - adapt to our coding style, make struct anonymous]
2015-02-20 22:59:47 +01:00
static const struct {
uint64_t capability;
int syscall_num;
} blacklist[] = {
{ CAP_SYS_RAWIO, SCMP_SYS(iopl)},
{ CAP_SYS_RAWIO, SCMP_SYS(ioperm)},
{ CAP_SYS_BOOT, SCMP_SYS(kexec_load)},
{ CAP_SYS_ADMIN, SCMP_SYS(swapon)},
{ CAP_SYS_ADMIN, SCMP_SYS(swapoff)},
{ CAP_SYS_ADMIN, SCMP_SYS(open_by_handle_at)},
{ CAP_SYS_MODULE, SCMP_SYS(init_module)},
{ CAP_SYS_MODULE, SCMP_SYS(finit_module)},
{ CAP_SYS_MODULE, SCMP_SYS(delete_module)},
nspawn: Allow module loading if CAP_SYS_MODULE is requested nspawn containers currently block module loading in all cases, with no option to disable it. This allows an admin, specifically setting capability=CAP_SYS_MODULE or capability=all to load modules.
2015-02-04 02:45:50 +01:00
};
nspawn: make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOTSUPPORT in containers The kernel still doesn't support audit in containers, so let's make use of seccomp and simply turn it off entirely. We can get rid of this big as soon as the kernel is fixed again.
2014-02-13 20:30:02 +01:00
scmp_filter_ctx seccomp;
nspawn: block open_by_handle_at() and others via seccomp Let's protect ourselves against the recently reported docker security issue. Our man page makes clear that we do not make any security promises anyway, but well, this one is easy to mitigate, so let's do it. While we are at it block a couple of more syscalls that are no good in containers, too.
2014-06-30 16:22:12 +02:00
unsigned i;
nspawn: make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOTSUPPORT in containers The kernel still doesn't support audit in containers, so let's make use of seccomp and simply turn it off entirely. We can get rid of this big as soon as the kernel is fixed again.
2014-02-13 20:30:02 +01:00
int r;
seccomp = seccomp_init(SCMP_ACT_ALLOW);
if (!seccomp)
return log_oom();
seccomp: add helper call to add all secondary archs to a seccomp filter And make use of it where appropriate for executing services and for nspawn.
2014-02-18 22:14:00 +01:00
r = seccomp_add_secondary_archs(seccomp);
nspawn: no need for duplicate checks against EEXIST
2014-02-25 20:33:17 +01:00
if (r < 0) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(r, "Failed to add secondary archs to seccomp filter: %m");
seccomp: add helper call to add all secondary archs to a seccomp filter And make use of it where appropriate for executing services and for nspawn.
2014-02-18 22:14:00 +01:00
goto finish;
}
nspawn: block open_by_handle_at() and others via seccomp Let's protect ourselves against the recently reported docker security issue. Our man page makes clear that we do not make any security promises anyway, but well, this one is easy to mitigate, so let's do it. While we are at it block a couple of more syscalls that are no good in containers, too.
2014-06-30 16:22:12 +02:00
for (i = 0; i < ELEMENTSOF(blacklist); i++) {
nspawn: Map all seccomp filters to capabilities This change makes it so all seccomp filters are mapped to the appropriate capability and are only added if that capability was not requested when running the container. This unbreaks the remaining use cases broken by the addition of seccomp filters without respecting requested capabilities. Co-Authored-By: Clif Houck <me@clifhouck.com> [zj: - adapt to our coding style, make struct anonymous]
2015-02-20 22:59:47 +01:00
if (arg_retain & (1ULL << blacklist[i].capability))
continue;
r = seccomp_rule_add(seccomp, SCMP_ACT_ERRNO(EPERM), blacklist[i].syscall_num, 0);
nspawn: block open_by_handle_at() and others via seccomp Let's protect ourselves against the recently reported docker security issue. Our man page makes clear that we do not make any security promises anyway, but well, this one is easy to mitigate, so let's do it. While we are at it block a couple of more syscalls that are no good in containers, too.
2014-06-30 16:22:12 +02:00
if (r == -EFAULT)
continue; /* unknown syscall */
if (r < 0) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(r, "Failed to block syscall: %m");
nspawn: block open_by_handle_at() and others via seccomp Let's protect ourselves against the recently reported docker security issue. Our man page makes clear that we do not make any security promises anyway, but well, this one is easy to mitigate, so let's do it. While we are at it block a couple of more syscalls that are no good in containers, too.
2014-06-30 16:22:12 +02:00
goto finish;
}
}
nspawn: Allow module loading if CAP_SYS_MODULE is requested nspawn containers currently block module loading in all cases, with no option to disable it. This allows an admin, specifically setting capability=CAP_SYS_MODULE or capability=all to load modules.
2015-02-04 02:45:50 +01:00
nspawn: block open_by_handle_at() and others via seccomp Let's protect ourselves against the recently reported docker security issue. Our man page makes clear that we do not make any security promises anyway, but well, this one is easy to mitigate, so let's do it. While we are at it block a couple of more syscalls that are no good in containers, too.
2014-06-30 16:22:12 +02:00
/*
Audit is broken in containers, much of the userspace audit
hookup will fail if running inside a container. We don't
care and just turn off creation of audit sockets.
This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail
with EAFNOSUPPORT which audit userspace uses as indication
that audit is disabled in the kernel.
*/
nspawn: x86 is special with its socketcall() semantics, be permissive in the seccomp setup
2014-02-18 22:27:46 +01:00
r = seccomp_rule_add(
nspawn: make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOTSUPPORT in containers The kernel still doesn't support audit in containers, so let's make use of seccomp and simply turn it off entirely. We can get rid of this big as soon as the kernel is fixed again.
2014-02-13 20:30:02 +01:00
seccomp,
SCMP_ACT_ERRNO(EAFNOSUPPORT),
SCMP_SYS(socket),
2,
SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
if (r < 0) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(r, "Failed to add audit seccomp rule: %m");
nspawn: make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOTSUPPORT in containers The kernel still doesn't support audit in containers, so let's make use of seccomp and simply turn it off entirely. We can get rid of this big as soon as the kernel is fixed again.
2014-02-13 20:30:02 +01:00
goto finish;
}
r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
if (r < 0) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(r, "Failed to unset NO_NEW_PRIVS: %m");
nspawn: make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOTSUPPORT in containers The kernel still doesn't support audit in containers, so let's make use of seccomp and simply turn it off entirely. We can get rid of this big as soon as the kernel is fixed again.
2014-02-13 20:30:02 +01:00
goto finish;
}
r = seccomp_load(seccomp);
if (r < 0)
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(r, "Failed to install seccomp audit filter: %m");
nspawn: make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOTSUPPORT in containers The kernel still doesn't support audit in containers, so let's make use of seccomp and simply turn it off entirely. We can get rid of this big as soon as the kernel is fixed again.
2014-02-13 20:30:02 +01:00
finish:
seccomp_release(seccomp);
return r;
#else
return 0;
#endif
}
machinectl: implement "bind" command to create additional bind mounts from host to container during runtime
2014-12-17 21:51:45 +01:00
static int setup_propagate(const char *root) {
const char *p, *q;
(void) mkdir_p("/run/systemd/nspawn/", 0755);
(void) mkdir_p("/run/systemd/nspawn/propagate", 0600);
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
machinectl: implement "bind" command to create additional bind mounts from host to container during runtime
2014-12-17 21:51:45 +01:00
(void) mkdir_p(p, 0600);
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
q = strjoina(root, "/run/systemd/nspawn/incoming");
machinectl: implement "bind" command to create additional bind mounts from host to container during runtime
2014-12-17 21:51:45 +01:00
mkdir_parents(q, 0755);
mkdir_p(q, 0600);
if (mount(p, q, NULL, MS_BIND, NULL) < 0)
return log_error_errno(errno, "Failed to install propagation bind mount.");
if (mount(NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0)
return log_error_errno(errno, "Failed to make propagation mount read-only");
return 0;
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
static int setup_image(char **device_path, int *loop_nr) {
struct loop_info64 info = {
.lo_flags = LO_FLAGS_AUTOCLEAR|LO_FLAGS_PARTSCAN
};
_cleanup_close_ int fd = -1, control = -1, loop = -1;
_cleanup_free_ char* loopdev = NULL;
struct stat st;
int r, nr;
assert(device_path);
assert(loop_nr);
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
assert(arg_image);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
fd = open(arg_image, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (fd < 0)
return log_error_errno(errno, "Failed to open %s: %m", arg_image);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (fstat(fd, &st) < 0)
return log_error_errno(errno, "Failed to stat %s: %m", arg_image);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
if (S_ISBLK(st.st_mode)) {
char *p;
p = strdup(arg_image);
if (!p)
return log_oom();
*device_path = p;
*loop_nr = -1;
r = fd;
fd = -1;
return r;
}
if (!S_ISREG(st.st_mode)) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "%s is not a regular file or block device: %m", arg_image);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return -EINVAL;
}
control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (control < 0)
return log_error_errno(errno, "Failed to open /dev/loop-control: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nr = ioctl(control, LOOP_CTL_GET_FREE);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (nr < 0)
return log_error_errno(errno, "Failed to allocate loop device: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
if (asprintf(&loopdev, "/dev/loop%i", nr) < 0)
return log_oom();
loop = open(loopdev, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (loop < 0)
return log_error_errno(errno, "Failed to open loop device %s: %m", loopdev);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (ioctl(loop, LOOP_SET_FD, fd) < 0)
return log_error_errno(errno, "Failed to set loopback file descriptor on %s: %m", loopdev);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
if (arg_read_only)
info.lo_flags |= LO_FLAGS_READ_ONLY;
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (ioctl(loop, LOOP_SET_STATUS64, &info) < 0)
return log_error_errno(errno, "Failed to set loopback settings on %s: %m", loopdev);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
*device_path = loopdev;
loopdev = NULL;
*loop_nr = nr;
r = loop;
loop = -1;
return r;
}
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
#define PARTITION_TABLE_BLURB \
"Note that the disk image needs to either contain only a single MBR partition of\n" \
nspawn: fix whitespace and typo in partition table blurb
2015-02-23 15:22:40 +01:00
"type 0x83 that is marked bootable, or a single GPT partition of type " \
nspawn: support dissecting GPT images that contain only a single generic linux partition This should allow running Ubuntu UEFI GPT Images with nspawn, unmodified.
2015-01-19 20:22:58 +01:00
"0FC63DAF-8483-4772-8E79-3D69D8477DE4 or follow\n" \
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
" http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/\n" \
"to be bootable with systemd-nspawn."
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
static int dissect_image(
int fd,
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
char **root_device, bool *root_device_rw,
char **home_device, bool *home_device_rw,
char **srv_device, bool *srv_device_rw,
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
bool *secondary) {
#ifdef HAVE_BLKID
nspawn: fix unused variable warning
2014-11-29 17:06:05 +01:00
int home_nr = -1, srv_nr = -1;
#ifdef GPT_ROOT_NATIVE
int root_nr = -1;
#endif
#ifdef GPT_ROOT_SECONDARY
int secondary_root_nr = -1;
#endif
nspawn: support dissecting GPT images that contain only a single generic linux partition This should allow running Ubuntu UEFI GPT Images with nspawn, unmodified.
2015-01-19 20:22:58 +01:00
_cleanup_free_ char *home = NULL, *root = NULL, *secondary_root = NULL, *srv = NULL, *generic = NULL;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
_cleanup_udev_enumerate_unref_ struct udev_enumerate *e = NULL;
_cleanup_udev_device_unref_ struct udev_device *d = NULL;
_cleanup_blkid_free_probe_ blkid_probe b = NULL;
_cleanup_udev_unref_ struct udev *udev = NULL;
struct udev_list_entry *first, *item;
nspawn: support dissecting GPT images that contain only a single generic linux partition This should allow running Ubuntu UEFI GPT Images with nspawn, unmodified.
2015-01-19 20:22:58 +01:00
bool home_rw = true, root_rw = true, secondary_root_rw = true, srv_rw = true, generic_rw = true;
nspawn: work around kernel bug with partition table probing on loopback devices When we set up a loopback device with partition probing, the udev "change" event about the configured device is first passed on to userspace, only the the in-kernel partition prober is started. Since partition probing fails with EBUSY when somebody has the device open, the probing frequently fails since udev starts probing/opening the device as soon as it gets the notification about it, and it might do so earlier than the kernel probing. This patch adds a (hopefully temporary) work-around for this, that compares the number of probed partitions of the kernel with those of blkid and synchronously asks for reprobing until the numebrs are in sync. This really deserves a proper kernel fix.
2015-01-20 20:36:19 +01:00
bool is_gpt, is_mbr, multiple_generic = false;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
const char *pttype = NULL;
blkid_partlist pl;
struct stat st;
nspawn: work around kernel bug with partition table probing on loopback devices When we set up a loopback device with partition probing, the udev "change" event about the configured device is first passed on to userspace, only the the in-kernel partition prober is started. Since partition probing fails with EBUSY when somebody has the device open, the probing frequently fails since udev starts probing/opening the device as soon as it gets the notification about it, and it might do so earlier than the kernel probing. This patch adds a (hopefully temporary) work-around for this, that compares the number of probed partitions of the kernel with those of blkid and synchronously asks for reprobing until the numebrs are in sync. This really deserves a proper kernel fix.
2015-01-20 20:36:19 +01:00
unsigned i;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
int r;
assert(fd >= 0);
assert(root_device);
assert(home_device);
assert(srv_device);
assert(secondary);
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
assert(arg_image);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
b = blkid_new_probe();
if (!b)
return log_oom();
errno = 0;
r = blkid_probe_set_device(b, fd, 0, 0);
if (r != 0) {
if (errno == 0)
return log_oom();
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to set device on blkid probe: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return -errno;
}
blkid_probe_enable_partitions(b, 1);
blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
errno = 0;
r = blkid_do_safeprobe(b);
if (r == -2 || r == 1) {
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
log_error("Failed to identify any partition table on\n"
" %s\n"
PARTITION_TABLE_BLURB, arg_image);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return -EINVAL;
} else if (r != 0) {
if (errno == 0)
errno = EIO;
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to probe: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return -errno;
}
nspawn: tell coverity that we ignore return value CID #1271353.
2015-03-14 03:10:15 +01:00
(void) blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
is_gpt = streq_ptr(pttype, "gpt");
is_mbr = streq_ptr(pttype, "dos");
if (!is_gpt && !is_mbr) {
log_error("No GPT or MBR partition table discovered on\n"
" %s\n"
PARTITION_TABLE_BLURB, arg_image);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return -EINVAL;
}
errno = 0;
pl = blkid_probe_get_partitions(b);
if (!pl) {
if (errno == 0)
return log_oom();
log_error("Failed to list partitions of %s", arg_image);
return -errno;
}
udev = udev_new();
if (!udev)
return log_oom();
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (fstat(fd, &st) < 0)
return log_error_errno(errno, "Failed to stat block device: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: work around kernel bug with partition table probing on loopback devices When we set up a loopback device with partition probing, the udev "change" event about the configured device is first passed on to userspace, only the the in-kernel partition prober is started. Since partition probing fails with EBUSY when somebody has the device open, the probing frequently fails since udev starts probing/opening the device as soon as it gets the notification about it, and it might do so earlier than the kernel probing. This patch adds a (hopefully temporary) work-around for this, that compares the number of probed partitions of the kernel with those of blkid and synchronously asks for reprobing until the numebrs are in sync. This really deserves a proper kernel fix.
2015-01-20 20:36:19 +01:00
d = udev_device_new_from_devnum(udev, 'b', st.st_rdev);
if (!d)
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return log_oom();
nspawn: work around kernel bug with partition table probing on loopback devices When we set up a loopback device with partition probing, the udev "change" event about the configured device is first passed on to userspace, only the the in-kernel partition prober is started. Since partition probing fails with EBUSY when somebody has the device open, the probing frequently fails since udev starts probing/opening the device as soon as it gets the notification about it, and it might do so earlier than the kernel probing. This patch adds a (hopefully temporary) work-around for this, that compares the number of probed partitions of the kernel with those of blkid and synchronously asks for reprobing until the numebrs are in sync. This really deserves a proper kernel fix.
2015-01-20 20:36:19 +01:00
for (i = 0;; i++) {
int n, m;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: work around kernel bug with partition table probing on loopback devices When we set up a loopback device with partition probing, the udev "change" event about the configured device is first passed on to userspace, only the the in-kernel partition prober is started. Since partition probing fails with EBUSY when somebody has the device open, the probing frequently fails since udev starts probing/opening the device as soon as it gets the notification about it, and it might do so earlier than the kernel probing. This patch adds a (hopefully temporary) work-around for this, that compares the number of probed partitions of the kernel with those of blkid and synchronously asks for reprobing until the numebrs are in sync. This really deserves a proper kernel fix.
2015-01-20 20:36:19 +01:00
if (i >= 10) {
log_error("Kernel partitions never appeared.");
return -ENXIO;
}
e = udev_enumerate_new(udev);
if (!e)
return log_oom();
r = udev_enumerate_add_match_parent(e, d);
if (r < 0)
return log_oom();
r = udev_enumerate_scan_devices(e);
if (r < 0)
return log_error_errno(r, "Failed to scan for partition devices of %s: %m", arg_image);
/* Count the partitions enumerated by the kernel */
n = 0;
first = udev_enumerate_get_list_entry(e);
udev_list_entry_foreach(item, first)
n++;
/* Count the partitions enumerated by blkid */
m = blkid_partlist_numof_partitions(pl);
if (n == m + 1)
break;
if (n > m + 1) {
log_error("blkid and kernel partition list do not match.");
return -EIO;
}
if (n < m + 1) {
unsigned j;
/* The kernel has probed fewer partitions than
* blkid? Maybe the kernel prober is still
* running or it got EBUSY because udev
* already opened the device. Let's reprobe
* the device, which is a synchronous call
* that waits until probing is complete. */
for (j = 0; j < 20; j++) {
r = ioctl(fd, BLKRRPART, 0);
if (r < 0)
r = -errno;
if (r >= 0 || r != -EBUSY)
break;
/* If something else has the device
* open, such as an udev rule, the
* ioctl will return EBUSY. Since
* there's no way to wait until it
* isn't busy anymore, let's just wait
* a bit, and try again.
*
* This is really something they
* should fix in the kernel! */
usleep(50 * USEC_PER_MSEC);
}
if (r < 0)
return log_error_errno(r, "Failed to reread partition table: %m");
}
e = udev_enumerate_unref(e);
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
first = udev_enumerate_get_list_entry(e);
udev_list_entry_foreach(item, first) {
_cleanup_udev_device_unref_ struct udev_device *q;
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
const char *node;
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
unsigned long long flags;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
blkid_partition pp;
dev_t qn;
int nr;
errno = 0;
q = udev_device_new_from_syspath(udev, udev_list_entry_get_name(item));
if (!q) {
if (!errno)
errno = ENOMEM;
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to get partition device of %s: %m", arg_image);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return -errno;
}
qn = udev_device_get_devnum(q);
if (major(qn) == 0)
continue;
if (st.st_rdev == qn)
continue;
node = udev_device_get_devnode(q);
if (!node)
continue;
pp = blkid_partlist_devno_to_partition(pl, qn);
if (!pp)
continue;
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
flags = blkid_partition_get_flags(pp);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nr = blkid_partition_get_partno(pp);
if (nr < 0)
continue;
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
if (is_gpt) {
sd_id128_t type_id;
const char *stype;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: support dissecting GPT images that contain only a single generic linux partition This should allow running Ubuntu UEFI GPT Images with nspawn, unmodified.
2015-01-19 20:22:58 +01:00
if (flags & GPT_FLAG_NO_AUTO)
continue;
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
stype = blkid_partition_get_type_string(pp);
if (!stype)
continue;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
if (sd_id128_from_string(stype, &type_id) < 0)
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
continue;
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
if (sd_id128_equal(type_id, GPT_HOME)) {
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
if (home && nr >= home_nr)
continue;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
home_nr = nr;
home_rw = !(flags & GPT_FLAG_READ_ONLY);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
r = free_and_strdup(&home, node);
if (r < 0)
return log_oom();
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
} else if (sd_id128_equal(type_id, GPT_SRV)) {
if (srv && nr >= srv_nr)
continue;
srv_nr = nr;
srv_rw = !(flags & GPT_FLAG_READ_ONLY);
r = free_and_strdup(&srv, node);
if (r < 0)
return log_oom();
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
#ifdef GPT_ROOT_NATIVE
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
else if (sd_id128_equal(type_id, GPT_ROOT_NATIVE)) {
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
if (root && nr >= root_nr)
continue;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
root_nr = nr;
root_rw = !(flags & GPT_FLAG_READ_ONLY);
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
r = free_and_strdup(&root, node);
if (r < 0)
return log_oom();
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
#endif
#ifdef GPT_ROOT_SECONDARY
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
else if (sd_id128_equal(type_id, GPT_ROOT_SECONDARY)) {
if (secondary_root && nr >= secondary_root_nr)
continue;
secondary_root_nr = nr;
secondary_root_rw = !(flags & GPT_FLAG_READ_ONLY);
r = free_and_strdup(&secondary_root, node);
if (r < 0)
return log_oom();
}
#endif
nspawn: support dissecting GPT images that contain only a single generic linux partition This should allow running Ubuntu UEFI GPT Images with nspawn, unmodified.
2015-01-19 20:22:58 +01:00
else if (sd_id128_equal(type_id, GPT_LINUX_GENERIC)) {
if (generic)
multiple_generic = true;
else {
generic_rw = !(flags & GPT_FLAG_READ_ONLY);
r = free_and_strdup(&generic, node);
if (r < 0)
return log_oom();
}
}
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
} else if (is_mbr) {
int type;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: support dissecting GPT images that contain only a single generic linux partition This should allow running Ubuntu UEFI GPT Images with nspawn, unmodified.
2015-01-19 20:22:58 +01:00
if (flags != 0x80) /* Bootable flag */
continue;
nspawn: add support for limited dissecting of MBR disk images with nspawn With this change nspawn's -i switch now can now make sense of MBR disk images too - however only if there's only a single, bootable partition of type 0x83 on the image. For all other cases we cannot really make sense from the partition table alone. The big benefit of this change is that upstream Fedora Cloud Images can now be booted unmodified with systemd-nspawn: # wget http://download.fedoraproject.org/pub/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # unxz Fedora-Cloud-Base-20141203-21.x86_64.raw.xz # systemd-nspawn -i Fedora-Cloud-Base-20141203-21.x86_64.raw -b Next stop: teach the import logic to automatically download these images, uncompress and verify them.
2015-01-15 00:47:10 +01:00
type = blkid_partition_get_type(pp);
if (type != 0x83) /* Linux partition */
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
continue;
nspawn: support dissecting GPT images that contain only a single generic linux partition This should allow running Ubuntu UEFI GPT Images with nspawn, unmodified.
2015-01-19 20:22:58 +01:00
if (generic)
multiple_generic = true;
else {
generic_rw = true;
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
nspawn: support dissecting GPT images that contain only a single generic linux partition This should allow running Ubuntu UEFI GPT Images with nspawn, unmodified.
2015-01-19 20:22:58 +01:00
r = free_and_strdup(&root, node);
if (r < 0)
return log_oom();
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
}
if (root) {
*root_device = root;
root = NULL;
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
*root_device_rw = root_rw;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
*secondary = false;
} else if (secondary_root) {
*root_device = secondary_root;
secondary_root = NULL;
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
*root_device_rw = secondary_root_rw;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
*secondary = true;
nspawn: support dissecting GPT images that contain only a single generic linux partition This should allow running Ubuntu UEFI GPT Images with nspawn, unmodified.
2015-01-19 20:22:58 +01:00
} else if (generic) {
/* There were no partitions with precise meanings
* around, but we found generic partitions. In this
* case, if there's only one, we can go ahead and boot
* it, otherwise we bail out, because we really cannot
* make any sense of it. */
if (multiple_generic) {
log_error("Identified multiple bootable Linux partitions on\n"
" %s\n"
PARTITION_TABLE_BLURB, arg_image);
return -EINVAL;
}
*root_device = generic;
generic = NULL;
*root_device_rw = generic_rw;
*secondary = false;
} else {
log_error("Failed to identify root partition in disk image\n"
" %s\n"
PARTITION_TABLE_BLURB, arg_image);
return -EINVAL;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
if (home) {
*home_device = home;
home = NULL;
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
*home_device_rw = home_rw;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
if (srv) {
*srv_device = srv;
srv = NULL;
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
*srv_device_rw = srv_rw;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
return 0;
#else
log_error("--image= is not supported, compiled without blkid support.");
tree-wide: there is no ENOTSUP on linux Replace ENOTSUP by EOPNOTSUPP as this is what linux actually uses.
2015-03-13 14:08:00 +01:00
return -EOPNOTSUPP;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
#endif
}
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
static int mount_device(const char *what, const char *where, const char *directory, bool rw) {
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
#ifdef HAVE_BLKID
_cleanup_blkid_free_probe_ blkid_probe b = NULL;
const char *fstype, *p;
int r;
assert(what);
assert(where);
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
if (arg_read_only)
rw = false;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
if (directory)
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
p = strjoina(where, directory);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
else
p = where;
errno = 0;
b = blkid_new_probe_from_filename(what);
if (!b) {
if (errno == 0)
return log_oom();
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to allocate prober for %s: %m", what);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return -errno;
}
blkid_probe_enable_superblocks(b, 1);
blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
errno = 0;
r = blkid_do_safeprobe(b);
if (r == -1 || r == 1) {
log_error("Cannot determine file system type of %s", what);
return -EINVAL;
} else if (r != 0) {
if (errno == 0)
errno = EIO;
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to probe %s: %m", what);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return -errno;
}
errno = 0;
if (blkid_probe_lookup_value(b, "TYPE", &fstype, NULL) < 0) {
if (errno == 0)
errno = EINVAL;
log_error("Failed to determine file system type of %s", what);
return -errno;
}
if (streq(fstype, "crypto_LUKS")) {
log_error("nspawn currently does not support LUKS disk images.");
tree-wide: there is no ENOTSUP on linux Replace ENOTSUP by EOPNOTSUPP as this is what linux actually uses.
2015-03-13 14:08:00 +01:00
return -EOPNOTSUPP;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (mount(what, p, fstype, MS_NODEV|(rw ? 0 : MS_RDONLY), NULL) < 0)
return log_error_errno(errno, "Failed to mount %s: %m", what);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return 0;
#else
log_error("--image= is not supported, compiled without blkid support.");
tree-wide: there is no ENOTSUP on linux Replace ENOTSUP by EOPNOTSUPP as this is what linux actually uses.
2015-03-13 14:08:00 +01:00
return -EOPNOTSUPP;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
#endif
}
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
static int mount_devices(
const char *where,
const char *root_device, bool root_device_rw,
const char *home_device, bool home_device_rw,
const char *srv_device, bool srv_device_rw) {
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
int r;
assert(where);
if (root_device) {
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
r = mount_device(root_device, arg_directory, NULL, root_device_rw);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to mount root directory: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
if (home_device) {
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
r = mount_device(home_device, arg_directory, "/home", home_device_rw);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to mount home directory: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
if (srv_device) {
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
r = mount_device(srv_device, arg_directory, "/srv", srv_device_rw);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to mount server data directory: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
return 0;
}
static void loop_remove(int nr, int *image_fd) {
_cleanup_close_ int control = -1;
nspawn: log when tearing down of loop device fails
2014-09-29 13:20:54 +02:00
int r;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
if (nr < 0)
return;
if (image_fd && *image_fd >= 0) {
nspawn: log when tearing down of loop device fails
2014-09-29 13:20:54 +02:00
r = ioctl(*image_fd, LOOP_CLR_FD);
if (r < 0)
spawn: downgrade loopback detach errors to debug Sometimes udev or some other background daemon might keep the loopback devices busy while we already want to detach them. Downgrade the warning about it. Given that we use autodetach downgrading these messages should be with little risk.
2015-01-15 00:51:54 +01:00
log_debug_errno(errno, "Failed to close loop image: %m");
util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
2014-03-18 19:22:43 +01:00
*image_fd = safe_close(*image_fd);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
nspawn: log when tearing down of loop device fails
2014-09-29 13:20:54 +02:00
if (control < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_warning_errno(errno, "Failed to open /dev/loop-control: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
return;
nspawn: log when tearing down of loop device fails
2014-09-29 13:20:54 +02:00
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: log when tearing down of loop device fails
2014-09-29 13:20:54 +02:00
r = ioctl(control, LOOP_CTL_REMOVE, nr);
if (r < 0)
spawn: downgrade loopback detach errors to debug Sometimes udev or some other background daemon might keep the loopback devices busy while we already want to detach them. Downgrade the warning about it. Given that we use autodetach downgrading these messages should be with little risk.
2015-01-15 00:51:54 +01:00
log_debug_errno(errno, "Failed to remove loop %d: %m", nr);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
static int spawn_getent(const char *database, const char *key, pid_t *rpid) {
int pipe_fds[2];
pid_t pid;
assert(database);
assert(key);
assert(rpid);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (pipe2(pipe_fds, O_CLOEXEC) < 0)
return log_error_errno(errno, "Failed to allocate pipe: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
pid = fork();
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (pid < 0)
return log_error_errno(errno, "Failed to fork getent child: %m");
else if (pid == 0) {
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
int nullfd;
char *empty_env = NULL;
if (dup3(pipe_fds[1], STDOUT_FILENO, 0) < 0)
_exit(EXIT_FAILURE);
if (pipe_fds[0] > 2)
util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
2014-03-18 19:22:43 +01:00
safe_close(pipe_fds[0]);
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
if (pipe_fds[1] > 2)
util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
2014-03-18 19:22:43 +01:00
safe_close(pipe_fds[1]);
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
nullfd = open("/dev/null", O_RDWR);
if (nullfd < 0)
_exit(EXIT_FAILURE);
if (dup3(nullfd, STDIN_FILENO, 0) < 0)
_exit(EXIT_FAILURE);
if (dup3(nullfd, STDERR_FILENO, 0) < 0)
_exit(EXIT_FAILURE);
if (nullfd > 2)
util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
2014-03-18 19:22:43 +01:00
safe_close(nullfd);
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
reset_all_signal_handlers();
close_all_fds(NULL, 0);
nspawn: fix argv[0] for getent
2014-03-11 17:00:13 +01:00
execle("/usr/bin/getent", "getent", database, key, NULL, &empty_env);
execle("/bin/getent", "getent", database, key, NULL, &empty_env);
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
_exit(EXIT_FAILURE);
}
util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
2014-03-18 19:22:43 +01:00
pipe_fds[1] = safe_close(pipe_fds[1]);
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
*rpid = pid;
return pipe_fds[0];
}
static int change_uid_gid(char **_home) {
Reject invalid quoted strings String which ended in an unfinished quote were accepted, potentially with bad memory accesses. Reject anything which ends in a unfished quote, or contains non-whitespace characters right after the closing quote. _FOREACH_WORD now returns the invalid character in *state. But this return value is not checked anywhere yet. Also, make 'word' and 'state' variables const pointers, and rename 'w' to 'word' in various places. Things are easier to read if the same name is used consistently. mbiebl_> am I correct that something like this doesn't work mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-passwd "Unlock EncFS"' mbiebl_> systemd seems to strip of the quotes mbiebl_> systemctl status shows mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-password Unlock EncFS $RootDir $MountPoint mbiebl_> which is pretty weird
2014-07-30 04:01:36 +02:00
char line[LINE_MAX], *x, *u, *g, *h;
const char *word, *state;
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
_cleanup_free_ uid_t *uids = NULL;
_cleanup_free_ char *home = NULL;
_cleanup_fclose_ FILE *f = NULL;
_cleanup_close_ int fd = -1;
unsigned n_uids = 0;
nspawn: Fix erroneous OOM when building group list change_uid_gid() never initialises sz which may cause greedy_realloc to skip the initial buffer allocation.
2014-04-09 19:08:45 +02:00
size_t sz = 0, l;
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
uid_t uid;
gid_t gid;
pid_t pid;
int r;
assert(_home);
if (!arg_user || streq(arg_user, "root") || streq(arg_user, "0")) {
/* Reset everything fully to 0, just in case */
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (setgroups(0, NULL) < 0)
return log_error_errno(errno, "setgroups() failed: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (setresgid(0, 0, 0) < 0)
return log_error_errno(errno, "setregid() failed: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (setresuid(0, 0, 0) < 0)
return log_error_errno(errno, "setreuid() failed: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
*_home = NULL;
return 0;
}
/* First, get user credentials */
fd = spawn_getent("passwd", arg_user, &pid);
if (fd < 0)
return fd;
f = fdopen(fd, "r");
if (!f)
return log_oom();
fd = -1;
if (!fgets(line, sizeof(line), f)) {
if (!ferror(f)) {
log_error("Failed to resolve user %s.", arg_user);
return -ESRCH;
}
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to read from getent: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
return -errno;
}
truncate_nl(line);
delta: diff returns 1 when files differ, ignore this https://bugs.debian/org/771397
2014-11-29 16:28:01 +01:00
wait_for_terminate_and_warn("getent passwd", pid, true);
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
x = strchr(line, ':');
if (!x) {
log_error("/etc/passwd entry has invalid user field.");
return -EIO;
}
u = strchr(x+1, ':');
if (!u) {
log_error("/etc/passwd entry has invalid password field.");
return -EIO;
}
u++;
g = strchr(u, ':');
if (!g) {
log_error("/etc/passwd entry has invalid UID field.");
return -EIO;
}
*g = 0;
g++;
x = strchr(g, ':');
if (!x) {
log_error("/etc/passwd entry has invalid GID field.");
return -EIO;
}
*x = 0;
h = strchr(x+1, ':');
if (!h) {
log_error("/etc/passwd entry has invalid GECOS field.");
return -EIO;
}
h++;
x = strchr(h, ':');
if (!x) {
log_error("/etc/passwd entry has invalid home directory field.");
return -EIO;
}
*x = 0;
r = parse_uid(u, &uid);
if (r < 0) {
log_error("Failed to parse UID of user.");
return -EIO;
}
r = parse_gid(g, &gid);
if (r < 0) {
log_error("Failed to parse GID of user.");
return -EIO;
}
home = strdup(h);
if (!home)
return log_oom();
/* Second, get group memberships */
fd = spawn_getent("initgroups", arg_user, &pid);
if (fd < 0)
return fd;
fclose(f);
f = fdopen(fd, "r");
if (!f)
return log_oom();
fd = -1;
if (!fgets(line, sizeof(line), f)) {
if (!ferror(f)) {
log_error("Failed to resolve user %s.", arg_user);
return -ESRCH;
}
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to read from getent: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
return -errno;
}
truncate_nl(line);
delta: diff returns 1 when files differ, ignore this https://bugs.debian/org/771397
2014-11-29 16:28:01 +01:00
wait_for_terminate_and_warn("getent initgroups", pid, true);
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
/* Skip over the username and subsequent separator whitespace */
x = line;
x += strcspn(x, WHITESPACE);
x += strspn(x, WHITESPACE);
Reject invalid quoted strings String which ended in an unfinished quote were accepted, potentially with bad memory accesses. Reject anything which ends in a unfished quote, or contains non-whitespace characters right after the closing quote. _FOREACH_WORD now returns the invalid character in *state. But this return value is not checked anywhere yet. Also, make 'word' and 'state' variables const pointers, and rename 'w' to 'word' in various places. Things are easier to read if the same name is used consistently. mbiebl_> am I correct that something like this doesn't work mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-passwd "Unlock EncFS"' mbiebl_> systemd seems to strip of the quotes mbiebl_> systemctl status shows mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-password Unlock EncFS $RootDir $MountPoint mbiebl_> which is pretty weird
2014-07-30 04:01:36 +02:00
FOREACH_WORD(word, l, x, state) {
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
char c[l+1];
Reject invalid quoted strings String which ended in an unfinished quote were accepted, potentially with bad memory accesses. Reject anything which ends in a unfished quote, or contains non-whitespace characters right after the closing quote. _FOREACH_WORD now returns the invalid character in *state. But this return value is not checked anywhere yet. Also, make 'word' and 'state' variables const pointers, and rename 'w' to 'word' in various places. Things are easier to read if the same name is used consistently. mbiebl_> am I correct that something like this doesn't work mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-passwd "Unlock EncFS"' mbiebl_> systemd seems to strip of the quotes mbiebl_> systemctl status shows mbiebl_> ExecStart=/usr/bin/encfs --extpass='/bin/systemd-ask-password Unlock EncFS $RootDir $MountPoint mbiebl_> which is pretty weird
2014-07-30 04:01:36 +02:00
memcpy(c, word, l);
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
c[l] = 0;
if (!GREEDY_REALLOC(uids, sz, n_uids+1))
return log_oom();
r = parse_uid(c, &uids[n_uids++]);
if (r < 0) {
log_error("Failed to parse group data from getent.");
return -EIO;
}
}
r = mkdir_parents(home, 0775);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_error_errno(r, "Failed to make home root directory: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
r = mkdir_safe(home, 0755, uid, gid);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0 && r != -EEXIST)
return log_error_errno(r, "Failed to make home directory: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
fchown(STDIN_FILENO, uid, gid);
fchown(STDOUT_FILENO, uid, gid);
fchown(STDERR_FILENO, uid, gid);
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (setgroups(n_uids, uids) < 0)
return log_error_errno(errno, "Failed to set auxiliary groups: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (setresgid(gid, gid, gid) < 0)
return log_error_errno(errno, "setregid() failed: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
treewide: another round of simplifications Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
2014-11-28 19:57:32 +01:00
if (setresuid(uid, uid, uid) < 0)
return log_error_errno(errno, "setreuid() failed: %m");
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
if (_home) {
*_home = home;
home = NULL;
}
return 0;
}
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
/*
nspawn: Fix regression with exit status Commit 113cea8 introduced a bug that caused the exit code of systemd-nspawn to not reflect the exit code of the program executed in the container.
2014-06-30 02:18:02 +02:00
* Return values:
* < 0 : wait_for_terminate() failed to get the state of the
* container, the container was terminated by a signal, or
* failed for an unknown reason. No change is made to the
* container argument.
* > 0 : The program executed in the container terminated with an
* error. The exit code of the program executed in the
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
* container is returned. The container argument has been set
* to CONTAINER_TERMINATED.
nspawn: Fix regression with exit status Commit 113cea8 introduced a bug that caused the exit code of systemd-nspawn to not reflect the exit code of the program executed in the container.
2014-06-30 02:18:02 +02:00
* 0 : The container is being rebooted, has been shut down or exited
* successfully. The container argument has been set to either
* CONTAINER_TERMINATED or CONTAINER_REBOOTED.
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
*
nspawn: Fix regression with exit status Commit 113cea8 introduced a bug that caused the exit code of systemd-nspawn to not reflect the exit code of the program executed in the container.
2014-06-30 02:18:02 +02:00
* That is, success is indicated by a return value of zero, and an
* error is indicated by a non-zero value.
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
*/
static int wait_for_container(pid_t pid, ContainerStatus *container) {
siginfo_t status;
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
int r;
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
r = wait_for_terminate(pid, &status);
treewide: yet more log_*_errno + return simplifications Using: find . -name '*.[ch]' | while read f; do perl -i.mmm -e \ 'local $/; local $_=<>; s/(if\s*\([^\n]+\))\s*{\n(\s*)(log_[a-z_]*_errno\(\s*([->a-zA-Z_]+)\s*,[^;]+);\s*return\s+\g4;\s+}/\1\n\2return \3;/msg; print;' $f done And a couple of manual whitespace fixups.
2014-11-28 18:50:43 +01:00
if (r < 0)
return log_warning_errno(r, "Failed to wait for container: %m");
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
switch (status.si_code) {
nspawn: don't make up -1 as error code
2014-10-30 20:53:23 +01:00
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
case CLD_EXITED:
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
if (status.si_status == 0) {
log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
nspawn: don't make up -1 as error code
2014-10-30 20:53:23 +01:00
} else
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
nspawn: don't make up -1 as error code
2014-10-30 20:53:23 +01:00
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
*container = CONTAINER_TERMINATED;
return status.si_status;
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
case CLD_KILLED:
if (status.si_status == SIGINT) {
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
*container = CONTAINER_TERMINATED;
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
return 0;
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
} else if (status.si_status == SIGHUP) {
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
*container = CONTAINER_REBOOTED;
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
return 0;
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
}
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
/* CLD_KILLED fallthrough */
case CLD_DUMPED:
nspawn: don't make up -1 as error code
2014-10-30 20:53:23 +01:00
log_error("Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
return -EIO;
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
default:
nspawn: don't make up -1 as error code
2014-10-30 20:53:23 +01:00
log_error("Container %s failed due to unknown reason.", arg_machine);
units: don't order journal flushing afte remote-fs.target Instead, only depend on the actual file systems we need. This should solve dep loops on setups where remote-fs.target is moved into late boot.
2014-10-31 16:22:36 +01:00
return -EIO;
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
}
return r;
}
nspawn: make nspawn robust to container failure nspawn and the container child use eventfd to wait and notify each other that they are ready so the container setup can be completed. However in its current form the wait/notify event ignore errors that may especially affect the child (container). On errors the child will jump to the "child_fail" label and terminate with _exit(EXIT_FAILURE) without notifying the parent. Since the eventfd is created without the "EFD_NONBLOCK" flag, this leaves the parent blocking on the eventfd_read() call. The container can also be killed at any moment before execv() and the parent will not receive notifications. We can fix this by using cheap mechanisms, the new high level eventfd API and handle SIGCHLD signals: * Keep the cheap eventfd and EFD_NONBLOCK flag. * Introduce eventfd states for parent and child to sync. Child notifies parent with EVENTFD_CHILD_SUCCEEDED on success or EVENTFD_CHILD_FAILED on failure and before _exit(). This prevents the parent from waiting on an event that will never come. * If the child is killed before execv() or before notifying the parent, we install a NOP handler for SIGCHLD which will interrupt blocking calls with EINTR. This gives a chance to the parent to call wait() and terminate in main(). * If there are no errors, parent will block SIGCHLD, restore default handler and notify child which will do execv(), then parent will pass control to process_pty() to do its magic. This was exposed in part by: https://bugs.freedesktop.org/show_bug.cgi?id=76193 Reported-by: Tobias Hunger tobias.hunger@gmail.com
2014-05-24 15:58:55 +02:00
static void nop_handler(int sig) {}
ptyforward: rework PTY forwarder logic used by nspawn to utilize the normal event loop We really should not run manual event loops anymore, but standardize on sd_event, so that we can run sd_bus connections from it eventually.
2014-10-31 16:54:11 +01:00
static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
pid_t pid;
pid = PTR_TO_UINT32(userdata);
if (pid > 0) {
nspawn: make kill signal to use for PID 1 configurable
2015-02-25 22:04:48 +01:00
if (kill(pid, arg_kill_signal) >= 0) {
ptyforward: rework PTY forwarder logic used by nspawn to utilize the normal event loop We really should not run manual event loops anymore, but standardize on sd_event, so that we can run sd_bus connections from it eventually.
2014-10-31 16:54:11 +01:00
log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
sd_event_source_set_userdata(s, NULL);
return 0;
}
}
sd_event_exit(sd_event_source_get_event(s), 0);
return 0;
}
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
static int determine_names(void) {
nspawn: use the same image discovery logic in nspawn as in machined
2014-12-27 02:07:29 +01:00
int r;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
if (!arg_image && !arg_directory) {
nspawn: use the same image discovery logic in nspawn as in machined
2014-12-27 02:07:29 +01:00
if (arg_machine) {
_cleanup_(image_unrefp) Image *i = NULL;
r = image_find(arg_machine, &i);
if (r < 0)
return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine);
else if (r == 0) {
log_error("No image for machine '%s': %m", arg_machine);
return -ENOENT;
}
import: rename "gpt" disk image type to "raw" After all, nspawn can now dissect MBR partition levels, too, hence ".gpt" appears a misnomer. Moreover, the the .raw suffix for these files is already pretty popular (the Fedora disk images use it for example), hence sounds like an OK scheme to adopt.
2015-01-15 01:03:33 +01:00
if (i->type == IMAGE_RAW)
nspawn: use the same image discovery logic in nspawn as in machined
2014-12-27 02:07:29 +01:00
r = set_sanitized_path(&arg_image, i->path);
else
r = set_sanitized_path(&arg_directory, i->path);
if (r < 0)
return log_error_errno(r, "Invalid image directory: %m");
arg_read_only = arg_read_only || i->read_only;
} else
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
arg_directory = get_current_dir_name();
nspawn: use the same image discovery logic in nspawn as in machined
2014-12-27 02:07:29 +01:00
if (!arg_directory && !arg_machine) {
log_error("Failed to determine path, please use -D or -i.");
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
return -EINVAL;
}
}
if (!arg_machine) {
nspawn: when booting in ephemeral mode, append random token to machine name Also, when booting up an ephemeral container of / use the system hostname as default machine name. This way specifiyng -M is unnecessary when booting up an ephemeral container, while allowing any number of ephemeral containers to run from the same tree.
2014-12-12 17:26:31 +01:00
if (arg_directory && path_equal(arg_directory, "/"))
arg_machine = gethostname_malloc();
else
arg_machine = strdup(basename(arg_image ?: arg_directory));
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
if (!arg_machine)
return log_oom();
hostname_cleanup(arg_machine, false);
if (!machine_name_is_valid(arg_machine)) {
log_error("Failed to determine machine name automatically, please use -M.");
return -EINVAL;
}
nspawn: when booting in ephemeral mode, append random token to machine name Also, when booting up an ephemeral container of / use the system hostname as default machine name. This way specifiyng -M is unnecessary when booting up an ephemeral container, while allowing any number of ephemeral containers to run from the same tree.
2014-12-12 17:26:31 +01:00
if (arg_ephemeral) {
char *b;
/* Add a random suffix when this is an
* ephemeral machine, so that we can run many
* instances at once without manually having
* to specify -M each time. */
if (asprintf(&b, "%s-%016" PRIx64, arg_machine, random_u64()) < 0)
return log_oom();
free(arg_machine);
arg_machine = b;
}
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
}
return 0;
}
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
static int determine_uid_shift(void) {
int r;
if (!arg_userns)
return 0;
if (arg_uid_shift == UID_INVALID) {
struct stat st;
r = stat(arg_directory, &st);
if (r < 0)
return log_error_errno(errno, "Failed to determine UID base of %s: %m", arg_directory);
arg_uid_shift = st.st_uid & UINT32_C(0xffff0000);
if (arg_uid_shift != (st.st_gid & UINT32_C(0xffff0000))) {
log_error("UID and GID base of %s don't match.", arg_directory);
return -EINVAL;
}
arg_uid_range = UINT32_C(0x10000);
}
if (arg_uid_shift > (uid_t) -1 - arg_uid_range) {
log_error("UID base too high for UID range.");
return -EINVAL;
}
log_info("Using user namespaces with base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
return 0;
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
int main(int argc, char *argv[]) {
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
nspawn,pty: port over to new ptsname_malloc() helper
2014-12-23 02:02:08 +01:00
_cleanup_free_ char *device_path = NULL, *root_device = NULL, *home_device = NULL, *srv_device = NULL, *console = NULL;
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
bool root_device_rw = true, home_device_rw = true, srv_device_rw = true;
sd-bus: sync with kdbus upstream (ABI break) kdbus has seen a larger update than expected lately, most notably with kdbusfs, a file system to expose the kdbus control files: * Each time a file system of this type is mounted, a new kdbus domain is created. * The layout inside each mount point is the same as before, except that domains are not hierarchically nested anymore. * Domains are therefore also unnamed now. * Unmounting a kdbusfs will automatically also detroy the associated domain. * Hence, the action of creating a kdbus domain is now as privileged as mounting a filesystem. * This way, we can get around creating dev nodes for everything, which is last but not least something that is not limited by 20-bit minor numbers. The kdbus specific bits in nspawn have all been dropped now, as nspawn can rely on the container OS to set up its own kdbus domain, simply by mounting a new instance. A new set of mounts has been added to mount things *after* the kernel modules have been loaded. For now, only kdbus is in this set, which is invoked with mount_setup_late().
2014-11-13 20:33:03 +01:00
_cleanup_close_ int master = -1, image_fd = -1;
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
_cleanup_fdset_free_ FDSet *fds = NULL;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
int r, n_fd_passed, loop_nr = -1;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
char veth_name[IFNAMSIZ];
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
bool secondary = false, remove_subvol = false;
nspawn: make nspawn robust to container failure nspawn and the container child use eventfd to wait and notify each other that they are ready so the container setup can be completed. However in its current form the wait/notify event ignore errors that may especially affect the child (container). On errors the child will jump to the "child_fail" label and terminate with _exit(EXIT_FAILURE) without notifying the parent. Since the eventfd is created without the "EFD_NONBLOCK" flag, this leaves the parent blocking on the eventfd_read() call. The container can also be killed at any moment before execv() and the parent will not receive notifications. We can fix this by using cheap mechanisms, the new high level eventfd API and handle SIGCHLD signals: * Keep the cheap eventfd and EFD_NONBLOCK flag. * Introduce eventfd states for parent and child to sync. Child notifies parent with EVENTFD_CHILD_SUCCEEDED on success or EVENTFD_CHILD_FAILED on failure and before _exit(). This prevents the parent from waiting on an event that will never come. * If the child is killed before execv() or before notifying the parent, we install a NOP handler for SIGCHLD which will interrupt blocking calls with EINTR. This gives a chance to the parent to call wait() and terminate in main(). * If there are no errors, parent will block SIGCHLD, restore default handler and notify child which will do execv(), then parent will pass control to process_pty() to do its magic. This was exposed in part by: https://bugs.freedesktop.org/show_bug.cgi?id=76193 Reported-by: Tobias Hunger tobias.hunger@gmail.com
2014-05-24 15:58:55 +02:00
sigset_t mask, mask_chld;
nspawn: add new --network-veth switch to add a virtual ethernet link to the host
2014-02-13 18:47:20 +01:00
pid_t pid = 0;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
int ret = EXIT_SUCCESS;
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
union in_addr_union exposed = {};
nspawn: add file system locks for controlling access to container images This adds three kinds of file system locks for container images: a) a file system lock next to the actual image, in a .lck file in the same directory the image is located. This lock has the benefit of usually being located on the same NFS share as the image itself, and thus allows locking container images across NFS shares. b) a file system lock in /run, named after st_dev and st_ino of the root of the image. This lock has the advantage that it is unique even if the same image is bind mounted to two different places at the same time, as the ino/dev stays constant for them. c) a file system lock that is only taken when a new disk image is about to be created, that ensures that checking whether the name is already used across the search path, and actually placing the image is not interrupted by other code taking the name. a + b are read-write locks. When a container is booted in read-only mode a read lock is taken, otherwise a write lock. Lock b is always taken after a, to avoid ABBA problems. Lock c is mostly relevant when renaming or cloning images.
2015-01-14 23:09:02 +01:00
_cleanup_release_lock_file_ LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 Previously we always invoked the container PID 1 on /dev/console of the container. With this change we do so only if nspawn was invoked interactively (i.e. its stdin/stdout was connected to a TTY). In all other cases we directly pass through the fds unmodified. This has the benefit that nspawn can be added into shell pipelines. https://bugs.freedesktop.org/show_bug.cgi?id=87732
2015-02-18 23:32:55 +01:00
bool interactive;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
log_parse_environment();
log_open();
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = parse_argv(argc, argv);
if (r <= 0)
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
goto finish;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = determine_names();
if (r < 0)
goto finish;
nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.
2013-04-16 04:36:06 +02:00
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
if (geteuid() != 0) {
log_error("Need to be root.");
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = -EPERM;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
goto finish;
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
log_close();
n_fd_passed = sd_listen_fds(false);
if (n_fd_passed > 0) {
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = fdset_new_listen_fds(&fds, false);
if (r < 0) {
log_error_errno(r, "Failed to collect file descriptors: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
goto finish;
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
fdset_close_others(fds);
log_open();
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
if (arg_directory) {
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
assert(!arg_image);
nspawn: allow spawning ephemeral nspawn containers based on the root file system of the OS This works now: # systemd-nspawn -xb -D / -M foobar Which boots up an ephemeral container, based on the host's root file system. Or in other words: you can now run the very same host OS you booted your system with also in a container, on top of it, without having it interfere. Great for testing whether the init system you are hacking on still boots without reboot the system!
2014-12-12 16:59:15 +01:00
if (path_equal(arg_directory, "/") && !arg_ephemeral) {
log_error("Spawning container on root directory is not supported. Consider using --ephemeral.");
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = -EINVAL;
nspawn: don't accept just any tree to execute When invoked without -D in an arbitrary directory we should not try to execute anything, make some validity checks first.
2014-02-14 16:35:18 +01:00
goto finish;
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: add file system locks for controlling access to container images This adds three kinds of file system locks for container images: a) a file system lock next to the actual image, in a .lck file in the same directory the image is located. This lock has the benefit of usually being located on the same NFS share as the image itself, and thus allows locking container images across NFS shares. b) a file system lock in /run, named after st_dev and st_ino of the root of the image. This lock has the advantage that it is unique even if the same image is bind mounted to two different places at the same time, as the ino/dev stays constant for them. c) a file system lock that is only taken when a new disk image is about to be created, that ensures that checking whether the name is already used across the search path, and actually placing the image is not interrupted by other code taking the name. a + b are read-write locks. When a container is booted in read-only mode a read lock is taken, otherwise a write lock. Lock b is always taken after a, to avoid ABBA problems. Lock c is mostly relevant when renaming or cloning images.
2015-01-14 23:09:02 +01:00
if (arg_ephemeral) {
nspawn: fix use-after-free and leak in error paths CID #1257765.
2015-03-07 20:19:20 +01:00
_cleanup_free_ char *np = NULL;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
nspawn: allow spawning ephemeral nspawn containers based on the root file system of the OS This works now: # systemd-nspawn -xb -D / -M foobar Which boots up an ephemeral container, based on the host's root file system. Or in other words: you can now run the very same host OS you booted your system with also in a container, on top of it, without having it interfere. Great for testing whether the init system you are hacking on still boots without reboot the system!
2014-12-12 16:59:15 +01:00
/* If the specified path is a mount point we
* generate the new snapshot immediately
* inside it under a random name. However if
* the specified is not a mount point we
* create the new snapshot in the parent
* directory, just next to it. */
r = path_is_mount_point(arg_directory, false);
if (r < 0) {
log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory);
goto finish;
}
if (r > 0)
r = tempfn_random_child(arg_directory, &np);
else
r = tempfn_random(arg_directory, &np);
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
if (r < 0) {
log_error_errno(r, "Failed to generate name for snapshot: %m");
goto finish;
}
nspawn: add file system locks for controlling access to container images This adds three kinds of file system locks for container images: a) a file system lock next to the actual image, in a .lck file in the same directory the image is located. This lock has the benefit of usually being located on the same NFS share as the image itself, and thus allows locking container images across NFS shares. b) a file system lock in /run, named after st_dev and st_ino of the root of the image. This lock has the advantage that it is unique even if the same image is bind mounted to two different places at the same time, as the ino/dev stays constant for them. c) a file system lock that is only taken when a new disk image is about to be created, that ensures that checking whether the name is already used across the search path, and actually placing the image is not interrupted by other code taking the name. a + b are read-write locks. When a container is booted in read-only mode a read lock is taken, otherwise a write lock. Lock b is always taken after a, to avoid ABBA problems. Lock c is mostly relevant when renaming or cloning images.
2015-01-14 23:09:02 +01:00
r = image_path_lock(np, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
if (r < 0) {
log_error_errno(r, "Failed to lock %s: %m", np);
goto finish;
}
btrfs: add support for recursive btrfs snapshotting
2015-04-06 15:26:59 +02:00
r = btrfs_subvol_snapshot(arg_directory, np, (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) | BTRFS_SNAPSHOT_FALLBACK_COPY | BTRFS_SNAPSHOT_RECURSIVE);
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
if (r < 0) {
log_error_errno(r, "Failed to create snapshot %s from %s: %m", np, arg_directory);
goto finish;
}
free(arg_directory);
arg_directory = np;
nspawn: fix use-after-free and leak in error paths CID #1257765.
2015-03-07 20:19:20 +01:00
np = NULL;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
remove_subvol = true;
nspawn: add file system locks for controlling access to container images This adds three kinds of file system locks for container images: a) a file system lock next to the actual image, in a .lck file in the same directory the image is located. This lock has the benefit of usually being located on the same NFS share as the image itself, and thus allows locking container images across NFS shares. b) a file system lock in /run, named after st_dev and st_ino of the root of the image. This lock has the advantage that it is unique even if the same image is bind mounted to two different places at the same time, as the ino/dev stays constant for them. c) a file system lock that is only taken when a new disk image is about to be created, that ensures that checking whether the name is already used across the search path, and actually placing the image is not interrupted by other code taking the name. a + b are read-write locks. When a container is booted in read-only mode a read lock is taken, otherwise a write lock. Lock b is always taken after a, to avoid ABBA problems. Lock c is mostly relevant when renaming or cloning images.
2015-01-14 23:09:02 +01:00
} else {
r = image_path_lock(arg_directory, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
if (r == -EBUSY) {
log_error_errno(r, "Directory tree %s is currently busy.", arg_directory);
goto finish;
}
if (r < 0) {
log_error_errno(r, "Failed to lock %s: %m", arg_directory);
return r;
}
if (arg_template) {
btrfs: add support for recursive btrfs snapshotting
2015-04-06 15:26:59 +02:00
r = btrfs_subvol_snapshot(arg_template, arg_directory, (arg_read_only ? BTRFS_SNAPSHOT_READ_ONLY : 0) | BTRFS_SNAPSHOT_FALLBACK_COPY | BTRFS_SNAPSHOT_RECURSIVE);
nspawn: add file system locks for controlling access to container images This adds three kinds of file system locks for container images: a) a file system lock next to the actual image, in a .lck file in the same directory the image is located. This lock has the benefit of usually being located on the same NFS share as the image itself, and thus allows locking container images across NFS shares. b) a file system lock in /run, named after st_dev and st_ino of the root of the image. This lock has the advantage that it is unique even if the same image is bind mounted to two different places at the same time, as the ino/dev stays constant for them. c) a file system lock that is only taken when a new disk image is about to be created, that ensures that checking whether the name is already used across the search path, and actually placing the image is not interrupted by other code taking the name. a + b are read-write locks. When a container is booted in read-only mode a read lock is taken, otherwise a write lock. Lock b is always taken after a, to avoid ABBA problems. Lock c is mostly relevant when renaming or cloning images.
2015-01-14 23:09:02 +01:00
if (r == -EEXIST) {
if (!arg_quiet)
log_info("Directory %s already exists, not populating from template %s.", arg_directory, arg_template);
} else if (r < 0) {
nspawn: fix log typos
2015-01-15 08:19:30 +01:00
log_error_errno(r, "Couldn't create snapshot %s from %s: %m", arg_directory, arg_template);
nspawn: add file system locks for controlling access to container images This adds three kinds of file system locks for container images: a) a file system lock next to the actual image, in a .lck file in the same directory the image is located. This lock has the benefit of usually being located on the same NFS share as the image itself, and thus allows locking container images across NFS shares. b) a file system lock in /run, named after st_dev and st_ino of the root of the image. This lock has the advantage that it is unique even if the same image is bind mounted to two different places at the same time, as the ino/dev stays constant for them. c) a file system lock that is only taken when a new disk image is about to be created, that ensures that checking whether the name is already used across the search path, and actually placing the image is not interrupted by other code taking the name. a + b are read-write locks. When a container is booted in read-only mode a read lock is taken, otherwise a write lock. Lock b is always taken after a, to avoid ABBA problems. Lock c is mostly relevant when renaming or cloning images.
2015-01-14 23:09:02 +01:00
goto finish;
} else {
if (!arg_quiet)
log_info("Populated %s from template %s.", arg_directory, arg_template);
}
}
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
if (arg_boot) {
if (path_is_os_tree(arg_directory) <= 0) {
os-release: define /usr/lib/os-release as fallback for /etc/os-release The file should have been in /usr/lib/ in the first place, since it describes the OS container in /usr (and not the configuration in /etc), hence, let's support os-release files in /usr/lib as fallback if no version in /etc exists, following the usual override logic. A prior commit already enabled tmpfiles to create /etc/os-release as a symlink to /usr/lib/os-release should it be missing, thus providing nice compatibility with applications only checking in /etc. While it's probably a good idea if all apps check both locations via a fallback logic, it is only necessary in the early boot process, as long as the /etc/os-release symlink has not been restored, in case we boot with an empty /etc.
2014-06-13 19:45:52 +02:00
log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", arg_directory);
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = -EINVAL;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
goto finish;
}
} else {
const char *p;
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
p = strjoina(arg_directory,
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
argc > optind && path_is_absolute(argv[optind]) ? argv[optind] : "/usr/bin/");
if (access(p, F_OK) < 0) {
log_error("Directory %s lacks the binary to execute or doesn't look like a binary tree. Refusing.", arg_directory);
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = -EINVAL;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
goto finish;
}
}
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
nspawn: don't accept just any tree to execute When invoked without -D in an arbitrary directory we should not try to execute anything, make some validity checks first.
2014-02-14 16:35:18 +01:00
} else {
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
char template[] = "/tmp/nspawn-root-XXXXXX";
nspawn: don't accept just any tree to execute When invoked without -D in an arbitrary directory we should not try to execute anything, make some validity checks first.
2014-02-14 16:35:18 +01:00
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
assert(arg_image);
assert(!arg_template);
nspawn: add file system locks for controlling access to container images This adds three kinds of file system locks for container images: a) a file system lock next to the actual image, in a .lck file in the same directory the image is located. This lock has the benefit of usually being located on the same NFS share as the image itself, and thus allows locking container images across NFS shares. b) a file system lock in /run, named after st_dev and st_ino of the root of the image. This lock has the advantage that it is unique even if the same image is bind mounted to two different places at the same time, as the ino/dev stays constant for them. c) a file system lock that is only taken when a new disk image is about to be created, that ensures that checking whether the name is already used across the search path, and actually placing the image is not interrupted by other code taking the name. a + b are read-write locks. When a container is booted in read-only mode a read lock is taken, otherwise a write lock. Lock b is always taken after a, to avoid ABBA problems. Lock c is mostly relevant when renaming or cloning images.
2015-01-14 23:09:02 +01:00
r = image_path_lock(arg_image, (arg_read_only ? LOCK_SH : LOCK_EX) | LOCK_NB, &tree_global_lock, &tree_local_lock);
if (r == -EBUSY) {
r = log_error_errno(r, "Disk image %s is currently busy.", arg_image);
goto finish;
}
if (r < 0) {
r = log_error_errno(r, "Failed to create image lock: %m");
goto finish;
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
if (!mkdtemp(template)) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to create temporary directory: %m");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
r = -errno;
nspawn: don't accept just any tree to execute When invoked without -D in an arbitrary directory we should not try to execute anything, make some validity checks first.
2014-02-14 16:35:18 +01:00
goto finish;
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
}
nspawn: don't accept just any tree to execute When invoked without -D in an arbitrary directory we should not try to execute anything, make some validity checks first.
2014-02-14 16:35:18 +01:00
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
arg_directory = strdup(template);
if (!arg_directory) {
r = log_oom();
goto finish;
nspawn: don't accept just any tree to execute When invoked without -D in an arbitrary directory we should not try to execute anything, make some validity checks first.
2014-02-14 16:35:18 +01:00
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
image_fd = setup_image(&device_path, &loop_nr);
if (image_fd < 0) {
r = image_fd;
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
goto finish;
}
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
r = dissect_image(image_fd,
&root_device, &root_device_rw,
&home_device, &home_device_rw,
&srv_device, &srv_device_rw,
&secondary);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
if (r < 0)
goto finish;
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
}
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
r = determine_uid_shift();
if (r < 0)
goto finish;
nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 Previously we always invoked the container PID 1 on /dev/console of the container. With this change we do so only if nspawn was invoked interactively (i.e. its stdin/stdout was connected to a TTY). In all other cases we directly pass through the fds unmodified. This has the benefit that nspawn can be added into shell pipelines. https://bugs.freedesktop.org/show_bug.cgi?id=87732
2015-02-18 23:32:55 +01:00
interactive = isatty(STDIN_FILENO) > 0 && isatty(STDOUT_FILENO) > 0;
nspawn: generate proper error messages in the child
2012-07-19 02:03:42 +02:00
master = posix_openpt(O_RDWR|O_NOCTTY|O_CLOEXEC|O_NDELAY);
if (master < 0) {
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = log_error_errno(errno, "Failed to acquire pseudo tty: %m");
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
goto finish;
}
nspawn,pty: port over to new ptsname_malloc() helper
2014-12-23 02:02:08 +01:00
r = ptsname_malloc(master, &console);
if (r < 0) {
r = log_error_errno(r, "Failed to determine tty name: %m");
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
goto finish;
}
if (unlockpt(master) < 0) {
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = log_error_errno(errno, "Failed to unlock tty: %m");
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
goto finish;
}
nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 Previously we always invoked the container PID 1 on /dev/console of the container. With this change we do so only if nspawn was invoked interactively (i.e. its stdin/stdout was connected to a TTY). In all other cases we directly pass through the fds unmodified. This has the benefit that nspawn can be added into shell pipelines. https://bugs.freedesktop.org/show_bug.cgi?id=87732
2015-02-18 23:32:55 +01:00
if (!arg_quiet)
log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
arg_machine, arg_image ?: arg_directory);
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
assert_se(sigemptyset(&mask) == 0);
sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
ptyforward: rework PTY forwarder logic used by nspawn to utilize the normal event loop We really should not run manual event loops anymore, but standardize on sd_event, so that we can run sd_bus connections from it eventually.
2014-10-31 16:54:11 +01:00
assert_se(sigemptyset(&mask_chld) == 0);
assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
for (;;) {
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
_cleanup_close_pair_ int kmsg_socket_pair[2] = { -1, -1 }, rtnl_socket_pair[2] = { -1, -1 };
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
ContainerStatus container_status;
barrier: initalize file descriptors with -1 Explicitly initalize descriptors using explicit assignment like bus_error. This makes barriers follow the same conventions as everything else and makes things a bit simpler too. Rename barier_init to barier_create so it is obvious that it is not about initialization. Remove some parens, etc.
2014-07-19 02:12:13 +02:00
_cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
nspawn: make nspawn robust to container failure nspawn and the container child use eventfd to wait and notify each other that they are ready so the container setup can be completed. However in its current form the wait/notify event ignore errors that may especially affect the child (container). On errors the child will jump to the "child_fail" label and terminate with _exit(EXIT_FAILURE) without notifying the parent. Since the eventfd is created without the "EFD_NONBLOCK" flag, this leaves the parent blocking on the eventfd_read() call. The container can also be killed at any moment before execv() and the parent will not receive notifications. We can fix this by using cheap mechanisms, the new high level eventfd API and handle SIGCHLD signals: * Keep the cheap eventfd and EFD_NONBLOCK flag. * Introduce eventfd states for parent and child to sync. Child notifies parent with EVENTFD_CHILD_SUCCEEDED on success or EVENTFD_CHILD_FAILED on failure and before _exit(). This prevents the parent from waiting on an event that will never come. * If the child is killed before execv() or before notifying the parent, we install a NOP handler for SIGCHLD which will interrupt blocking calls with EINTR. This gives a chance to the parent to call wait() and terminate in main(). * If there are no errors, parent will block SIGCHLD, restore default handler and notify child which will do execv(), then parent will pass control to process_pty() to do its magic. This was exposed in part by: https://bugs.freedesktop.org/show_bug.cgi?id=76193 Reported-by: Tobias Hunger tobias.hunger@gmail.com
2014-05-24 15:58:55 +02:00
struct sigaction sa = {
.sa_handler = nop_handler,
.sa_flags = SA_NOCLDSTOP,
};
barrier: initalize file descriptors with -1 Explicitly initalize descriptors using explicit assignment like bus_error. This makes barriers follow the same conventions as everything else and makes things a bit simpler too. Rename barier_init to barier_create so it is obvious that it is not about initialization. Remove some parens, etc.
2014-07-19 02:12:13 +02:00
r = barrier_create(&barrier);
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
if (r < 0) {
treewide: no need to negate errno for log_*_errno() It corrrectly handles both positive and negative errno values.
2014-11-28 13:19:16 +01:00
log_error_errno(r, "Cannot initialize IPC barrier: %m");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
goto finish;
}
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0) {
r = log_error_errno(errno, "Failed to create kmsg socket pair: %m");
goto finish;
}
if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, rtnl_socket_pair) < 0) {
r = log_error_errno(errno, "Failed to create rtnl socket pair: %m");
goto finish;
}
nspawn: make nspawn robust to container failure nspawn and the container child use eventfd to wait and notify each other that they are ready so the container setup can be completed. However in its current form the wait/notify event ignore errors that may especially affect the child (container). On errors the child will jump to the "child_fail" label and terminate with _exit(EXIT_FAILURE) without notifying the parent. Since the eventfd is created without the "EFD_NONBLOCK" flag, this leaves the parent blocking on the eventfd_read() call. The container can also be killed at any moment before execv() and the parent will not receive notifications. We can fix this by using cheap mechanisms, the new high level eventfd API and handle SIGCHLD signals: * Keep the cheap eventfd and EFD_NONBLOCK flag. * Introduce eventfd states for parent and child to sync. Child notifies parent with EVENTFD_CHILD_SUCCEEDED on success or EVENTFD_CHILD_FAILED on failure and before _exit(). This prevents the parent from waiting on an event that will never come. * If the child is killed before execv() or before notifying the parent, we install a NOP handler for SIGCHLD which will interrupt blocking calls with EINTR. This gives a chance to the parent to call wait() and terminate in main(). * If there are no errors, parent will block SIGCHLD, restore default handler and notify child which will do execv(), then parent will pass control to process_pty() to do its magic. This was exposed in part by: https://bugs.freedesktop.org/show_bug.cgi?id=76193 Reported-by: Tobias Hunger tobias.hunger@gmail.com
2014-05-24 15:58:55 +02:00
/* Child can be killed before execv(), so handle SIGCHLD
* in order to interrupt parent's blocking calls and
* give it a chance to call wait() and terminate. */
r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
if (r < 0) {
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = log_error_errno(errno, "Failed to change the signal mask: %m");
nspawn: make sure we don't try to mount the container block device in the child after the parent added us to the device cgroup
2014-03-11 01:01:38 +01:00
goto finish;
}
nspawn: make nspawn robust to container failure nspawn and the container child use eventfd to wait and notify each other that they are ready so the container setup can be completed. However in its current form the wait/notify event ignore errors that may especially affect the child (container). On errors the child will jump to the "child_fail" label and terminate with _exit(EXIT_FAILURE) without notifying the parent. Since the eventfd is created without the "EFD_NONBLOCK" flag, this leaves the parent blocking on the eventfd_read() call. The container can also be killed at any moment before execv() and the parent will not receive notifications. We can fix this by using cheap mechanisms, the new high level eventfd API and handle SIGCHLD signals: * Keep the cheap eventfd and EFD_NONBLOCK flag. * Introduce eventfd states for parent and child to sync. Child notifies parent with EVENTFD_CHILD_SUCCEEDED on success or EVENTFD_CHILD_FAILED on failure and before _exit(). This prevents the parent from waiting on an event that will never come. * If the child is killed before execv() or before notifying the parent, we install a NOP handler for SIGCHLD which will interrupt blocking calls with EINTR. This gives a chance to the parent to call wait() and terminate in main(). * If there are no errors, parent will block SIGCHLD, restore default handler and notify child which will do execv(), then parent will pass control to process_pty() to do its magic. This was exposed in part by: https://bugs.freedesktop.org/show_bug.cgi?id=76193 Reported-by: Tobias Hunger tobias.hunger@gmail.com
2014-05-24 15:58:55 +02:00
r = sigaction(SIGCHLD, &sa, NULL);
if (r < 0) {
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
nspawn: fix reboot event fd reuse
2014-01-29 20:58:50 +01:00
goto finish;
}
nspawn: fix invocation of the raw clone() system call on s390 and cris Since the order of the first and second arguments of the raw clone() system call is reversed on s390 and cris it needs to be invoked differently.
2014-12-16 18:06:41 +01:00
pid = raw_clone(SIGCHLD|CLONE_NEWNS|
(arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS)|
(arg_private_network ? CLONE_NEWNET : 0), NULL);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (pid < 0) {
if (errno == EINVAL)
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = log_error_errno(errno, "clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m");
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
else
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = log_error_errno(errno, "clone() failed: %m");
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
goto finish;
}
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (pid == 0) {
/* child */
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
_cleanup_free_ char *home = NULL;
nspawn: environment would be truncated with TERM unset
2013-02-23 14:44:16 +01:00
unsigned n_env = 2;
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
const char *envp[] = {
DEFAULT_PATH_SPLIT_USR macro
2013-12-21 00:35:38 +01:00
"PATH=" DEFAULT_PATH_SPLIT_USR,
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
"container=systemd-nspawn", /* LXC sets container=lxc, so follow the scheme here */
NULL, /* TERM */
NULL, /* HOME */
NULL, /* USER */
NULL, /* LOGNAME */
NULL, /* container_uuid */
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
NULL, /* LISTEN_FDS */
NULL, /* LISTEN_PID */
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
NULL
};
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
char **env_use;
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
barrier_set_role(&barrier, BARRIER_CHILD);
nspawn: environment would be truncated with TERM unset
2013-02-23 14:44:16 +01:00
envp[n_env] = strv_find_prefix(environ, "TERM=");
if (envp[n_env])
n_env ++;
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
2014-03-18 19:22:43 +01:00
master = safe_close(master);
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
2014-03-18 19:22:43 +01:00
kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
reset_all_signal_handlers();
util: make use of newly added reset_signal_mask() call wherever appropriate
2014-08-26 21:11:35 +02:00
reset_signal_mask();
nspawn: always use bind mounts to make API file systems available in the container This ensures that read-only flags are never passed from the container to the host OS.
2011-07-13 21:57:56 +02:00
nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 Previously we always invoked the container PID 1 on /dev/console of the container. With this change we do so only if nspawn was invoked interactively (i.e. its stdin/stdout was connected to a TTY). In all other cases we directly pass through the fds unmodified. This has the benefit that nspawn can be added into shell pipelines. https://bugs.freedesktop.org/show_bug.cgi?id=87732
2015-02-18 23:32:55 +01:00
if (interactive) {
close_nointr(STDIN_FILENO);
close_nointr(STDOUT_FILENO);
close_nointr(STDERR_FILENO);
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 Previously we always invoked the container PID 1 on /dev/console of the container. With this change we do so only if nspawn was invoked interactively (i.e. its stdin/stdout was connected to a TTY). In all other cases we directly pass through the fds unmodified. This has the benefit that nspawn can be added into shell pipelines. https://bugs.freedesktop.org/show_bug.cgi?id=87732
2015-02-18 23:32:55 +01:00
r = open_terminal(console, O_RDWR);
if (r != STDIN_FILENO) {
if (r >= 0) {
safe_close(r);
r = -EINVAL;
}
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 Previously we always invoked the container PID 1 on /dev/console of the container. With this change we do so only if nspawn was invoked interactively (i.e. its stdin/stdout was connected to a TTY). In all other cases we directly pass through the fds unmodified. This has the benefit that nspawn can be added into shell pipelines. https://bugs.freedesktop.org/show_bug.cgi?id=87732
2015-02-18 23:32:55 +01:00
log_error_errno(r, "Failed to open console: %m");
_exit(EXIT_FAILURE);
}
if (dup2(STDIN_FILENO, STDOUT_FILENO) != STDOUT_FILENO ||
dup2(STDIN_FILENO, STDERR_FILENO) != STDERR_FILENO) {
log_error_errno(errno, "Failed to duplicate console: %m");
_exit(EXIT_FAILURE);
}
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
}
nspawn: add --read-only switch
2012-04-25 15:11:20 +02:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (setsid() < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "setsid() failed: %m");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add --read-only switch
2012-04-25 15:11:20 +02:00
}
nspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use of this
2014-02-12 02:52:39 +01:00
if (reset_audit_loginuid() < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: newer kernels (>= 3.14) allow resetting the audit loginuid, make use of this
2014-02-12 02:52:39 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
}
nspawn: fake /dev/kmsg and /proc/kmsg as fifo
2012-04-13 16:51:33 +02:00
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
if (arg_private_network)
loopback_setup();
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
/* Mark everything as slave, so that we still
* receive mounts from the real root, but don't
* propagate mounts to the real root. */
if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "MS_SLAVE|MS_REC failed: %m");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
}
nspawn: generate a new randomized boot ID for each container
2012-09-05 23:39:16 +02:00
nspawn: honour GPT partition flags when mounting file systems following the discoverable partitions spec
2014-03-13 01:33:33 +01:00
if (mount_devices(arg_directory,
root_device, root_device_rw,
home_device, home_device_rw,
srv_device, srv_device_rw) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
/* Turn directory into bind mount */
nspawn: change filesystem type from "bind" to NULL in mount() syscalls Try to keep syscalls as minimal as possible.
2015-03-31 11:50:29 +02:00
if (mount(arg_directory, arg_directory, NULL, MS_BIND|MS_REC, NULL) < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "Failed to make bind mount: %m");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
r = setup_volatile(arg_directory);
if (r < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
if (setup_volatile_state(arg_directory) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
r = base_filesystem_create(arg_directory);
if (r < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add new --volatile switch for booting containers in volatile (ephemeral) mode Two modes are supported: --volatile=yes mounts only /usr into the container, and a tmpfs as root directory. --volatile=state mounts the full OS tree in, but overmounts /var with a tmpfs. --volatile=yes hence boots with an unpopulated /etc and /var, starting with pristine configuration and state. --volatile=state hence boots with an unpopulated /var, only starting with pristine state.
2014-07-04 03:22:33 +02:00
namespace: beef up read-only bind mount logic Instead of blindly creating another bind mount for read-only mounts, check if there's already one we can use, and if so, use it. Also, recursively mark all submounts read-only too. Also, ignore autofs mounts when remounting read-only unless they are already triggered.
2014-06-06 11:42:25 +02:00
if (arg_read_only) {
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = bind_remount_recursive(arg_directory, true);
if (r < 0) {
log_error_errno(r, "Failed to make tree read-only: %m");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
}
namespace: beef up read-only bind mount logic Instead of blindly creating another bind mount for read-only mounts, check if there's already one we can use, and if so, use it. Also, recursively mark all submounts read-only too. Also, ignore autofs mounts when remounting read-only unless they are already triggered.
2014-06-06 11:42:25 +02:00
}
nspawn: bind mount /etc/resolv.conf from the host by default
2012-04-25 15:08:00 +02:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (mount_all(arg_directory) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: introduce new --link-journal= switch to link container journals into host
2012-07-19 02:02:39 +02:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (copy_devnodes(arg_directory) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: create a separate devpts namespace for nspawn containers
2013-03-07 13:34:07 +01:00
if (setup_ptmx(arg_directory) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: create a separate devpts namespace for nspawn containers
2013-03-07 13:34:07 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
dev_setup(arg_directory);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
machinectl: implement "bind" command to create additional bind mounts from host to container during runtime
2014-12-17 21:51:45 +01:00
if (setup_propagate(arg_directory) < 0)
_exit(EXIT_FAILURE);
nspawn: block open_by_handle_at() and others via seccomp Let's protect ourselves against the recently reported docker security issue. Our man page makes clear that we do not make any security promises anyway, but well, this one is easy to mitigate, so let's do it. While we are at it block a couple of more syscalls that are no good in containers, too.
2014-06-30 16:22:12 +02:00
if (setup_seccomp() < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOTSUPPORT in containers The kernel still doesn't support audit in containers, so let's make use of seccomp and simply turn it off entirely. We can get rid of this big as soon as the kernel is fixed again.
2014-02-13 20:30:02 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (setup_dev_console(arg_directory, console) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (setup_kmsg(arg_directory, kmsg_socket_pair[1]) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
util: replace close_nointr_nofail() by a more useful safe_close() safe_close() automatically becomes a NOP when a negative fd is passed, and returns -1 unconditionally. This makes it easy to write lines like this: fd = safe_close(fd); Which will close an fd if it is open, and reset the fd variable correctly. By making use of this new scheme we can drop a > 200 lines of code that was required to test for non-negative fds or to reset the closed fd variable afterwards.
2014-03-18 19:22:43 +01:00
kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
if (send_rtnl(rtnl_socket_pair[1]) < 0)
_exit(EXIT_FAILURE);
rtnl_socket_pair[1] = safe_close(rtnl_socket_pair[1]);
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
/* Tell the parent that we are ready, and that
* it can cgroupify us to that we lack access
* to certain devices and resources. */
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
(void) barrier_place(&barrier); /* #1 */
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (setup_boot_id(arg_directory) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add new --no-net switch to turn off networking in the container
2011-08-02 04:49:37 +02:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (setup_timezone(arg_directory) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (setup_resolv_conf(arg_directory) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (setup_journal(arg_directory) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
namespace: beef up read-only bind mount logic Instead of blindly creating another bind mount for read-only mounts, check if there's already one we can use, and if so, use it. Also, recursively mark all submounts read-only too. Also, ignore autofs mounts when remounting read-only unless they are already triggered.
2014-06-06 11:42:25 +02:00
if (mount_binds(arg_directory, arg_bind, false) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
namespace: beef up read-only bind mount logic Instead of blindly creating another bind mount for read-only mounts, check if there's already one we can use, and if so, use it. Also, recursively mark all submounts read-only too. Also, ignore autofs mounts when remounting read-only unless they are already triggered.
2014-06-06 11:42:25 +02:00
if (mount_binds(arg_directory, arg_bind_ro, true) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add --bind= and --bind-ro= to bind mount host paths into the container
2013-02-25 18:21:13 +01:00
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
if (mount_tmpfs(arg_directory) < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
/* Wait until we are cgroup-ified, so that we
* can mount the right cgroup path writable */
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
(void) barrier_place_and_sync(&barrier); /* #2 */
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
if (mount_cgroup(arg_directory) < 0)
_exit(EXIT_FAILURE);
nspawn: make sure we don't try to mount the container block device in the child after the parent added us to the device cgroup
2014-03-11 01:01:38 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (chdir(arg_directory) < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "chdir(%s) failed: %m", arg_directory);
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
}
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (mount(arg_directory, "/", NULL, MS_MOVE, NULL) < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "mount(MS_MOVE) failed: %m");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
}
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (chroot(".") < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "chroot() failed: %m");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
}
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (chdir("/") < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "chdir() failed: %m");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
}
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
if (arg_userns) {
if (unshare(CLONE_NEWUSER) < 0) {
log_error_errno(errno, "unshare(CLONE_NEWUSER) failed: %m");
_exit(EXIT_FAILURE);
}
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
/* Tell the parent, that it now can
* write the UID map. */
(void) barrier_place(&barrier); /* #3 */
/* Wait until the parent wrote the UID
* map */
(void) barrier_place_and_sync(&barrier); /* #4 */
}
umask(0022);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (drop_capabilities() < 0) {
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "drop_capabilities() failed: %m");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
}
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
setup_hostname();
if (arg_personality != 0xffffffffLU) {
if (personality(arg_personality) < 0) {
log_error_errno(errno, "personality() failed: %m");
_exit(EXIT_FAILURE);
}
} else if (secondary) {
if (personality(PER_LINUX32) < 0) {
log_error_errno(errno, "personality() failed: %m");
_exit(EXIT_FAILURE);
}
}
#ifdef HAVE_SELINUX
if (arg_selinux_context)
if (setexeccon((security_context_t) arg_selinux_context) < 0) {
log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
_exit(EXIT_FAILURE);
}
#endif
nspawn: when resoliving UIDs/GIDs for "-u", do so in forked off /usr/bin/getent instead of in-process When the container runs a different native architecture than the host we shouldn't attempt to load the container's NSS modules with the host's libc. Instead, resolve UID/GID by invoking /usr/bin/getent in the container. The tool should be fairly universally available and allows us to do resolving of the UID/GID with the container's libc in a parsable format. https://bugs.freedesktop.org/show_bug.cgi?id=75733
2014-03-11 02:41:13 +01:00
r = change_uid_gid(&home);
if (r < 0)
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
if ((asprintf((char**)(envp + n_env++), "HOME=%s", home ? home: "/root") < 0) ||
(asprintf((char**)(envp + n_env++), "USER=%s", arg_user ? arg_user : "root") < 0) ||
(asprintf((char**)(envp + n_env++), "LOGNAME=%s", arg_user ? arg_user : "root") < 0)) {
log.h: new log_oom() -> int -ENOMEM, use it also a number of minor fixups and bug fixes: spelling, oom errors that didn't print errors, not properly forwarding error codes, few more consistency issues, et cetera
2012-07-25 23:55:59 +02:00
log_oom();
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add --uuid= switch to allow setting the machine id for the container
2012-04-22 14:48:21 +02:00
}
nspawn: spawn shell under specified --user Add -u/--user option, which changes the effective and real user and group id to the new value. The user must exists in the chroot, otherwise it will fail. Both username and user id are accepted. The user home is created as well. It also setup HOME, USER, LOGNAME and SHELL variables .
2011-06-29 14:22:46 +02:00
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
if (!sd_id128_equal(arg_uuid, SD_ID128_NULL)) {
nspawn: properly format container_uuid in UUID format http://lists.freedesktop.org/archives/systemd-devel/2014-April/018971.html
2014-05-16 19:37:19 +02:00
char as_uuid[37];
if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_format_as_uuid(arg_uuid, as_uuid)) < 0) {
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
log_oom();
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
}
}
if (fdset_size(fds) > 0) {
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
r = fdset_cloexec(fds, false);
if (r < 0) {
log_error_errno(r, "Failed to unset O_CLOEXEC for file descriptors.");
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
}
if ((asprintf((char **)(envp + n_env++), "LISTEN_FDS=%u", n_fd_passed) < 0) ||
nspawn: trivial simplification
2013-08-22 01:35:32 +02:00
(asprintf((char **)(envp + n_env++), "LISTEN_PID=1") < 0)) {
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
log_oom();
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
}
}
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
if (!strv_isempty(arg_setenv)) {
char **n;
n = strv_env_merge(2, envp, arg_setenv);
if (!n) {
log_oom();
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
_exit(EXIT_FAILURE);
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
}
env_use = n;
} else
env_use = (char**) envp;
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
/* Let the parent know that we are ready and
* wait until the parent is ready with the
* setup, too... */
(void) barrier_place_and_sync(&barrier); /* #5 */
nspawn: make sure we don't try to mount the container block device in the child after the parent added us to the device cgroup
2014-03-11 01:01:38 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
if (arg_boot) {
char **a;
size_t l;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
/* Automatically search for the init system */
nspawn: add -b switch to automatically look for an init binary
2012-04-22 13:37:24 +02:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
l = 1 + argc - optind;
a = newa(char*, l + 1);
memcpy(a + 1, argv + optind, l * sizeof(char*));
nspawn: add -b switch to automatically look for an init binary
2012-04-22 13:37:24 +02:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
a[0] = (char*) "/usr/lib/systemd/systemd";
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
execve(a[0], a, env_use);
nspawn: add -b switch to automatically look for an init binary
2012-04-22 13:37:24 +02:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
a[0] = (char*) "/lib/systemd/systemd";
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
execve(a[0], a, env_use);
nspawn: add -b switch to automatically look for an init binary
2012-04-22 13:37:24 +02:00
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
a[0] = (char*) "/sbin/init";
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
execve(a[0], a, env_use);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
} else if (argc > optind)
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
execvpe(argv[optind], argv + optind, env_use);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
else {
chdir(home ? home : "/root");
nspawn: add new --setenv= switch to set an environment variable for the container to spawn
2013-12-13 16:37:16 +01:00
execle("/bin/bash", "-bash", NULL, env_use);
nspawn: if we don't find bash, try sh
2014-02-14 16:41:03 +01:00
execle("/bin/sh", "-sh", NULL, env_use);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
}
treewide: use log_*_errno whenever %m is in the format string If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
2014-11-28 19:29:59 +01:00
log_error_errno(errno, "execv() failed: %m");
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
_exit(EXIT_FAILURE);
nspawn: reset environment and load login shell
2011-03-14 03:28:16 +01:00
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: use Barrier API instead of eventfd-util The Barrier-API simplifies cross-fork() synchronization a lot. Replace the hard-coded eventfd-util implementation and drop it. Compared to the old API, Barriers also handle exit() of the remote side as abortion. This way, segfaults will not cause the parent to deadlock. EINTR handling is currently ignored for any barrier-waits. This can easily be added, but it isn't needed so far so I dropped it. EINTR handling in general is ugly, anyway. You need to deal with pselect/ppoll/... variants and make sure not to unblock signals at the wrong times. So genrally, there's little use in adding it.
2014-07-13 12:14:45 +02:00
barrier_set_role(&barrier, BARRIER_PARENT);
nspawn: allow passing socket activation fds through nspawn
2012-12-22 19:29:04 +01:00
fdset_free(fds);
fds = NULL;
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
rtnl_socket_pair[1] = safe_close(rtnl_socket_pair[1]);
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
(void) barrier_place(&barrier); /* #1 */
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
/* Wait for the most basic Child-setup to be done,
* before we add hardware to it, and place it in a
* cgroup. */
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
if (barrier_sync(&barrier)) { /* #1 */
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
int ifi = 0;
nspawn: do not invoke RegisterMachine on machined from inside the new PID namespace On kdbus user credentials are not translated across PID namespaces, but simply invalidated if sender and receiver namespaces don't match. This makes it impossible to properly authenticate requests from different PID namespaces (which is probably a good thing). Hence, register the machine in the parent and not the client and properly synchronize this.
2014-01-09 01:42:57 +01:00
nspawn: let's avoid using goto to wildly for non-cleanup purposes
2014-06-30 15:20:59 +02:00
r = move_network_interfaces(pid);
if (r < 0)
goto finish;
nspawn: add new --network-interface= switch to move an existing interface into the container
2014-02-13 03:27:39 +01:00
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
r = setup_veth(pid, veth_name, &ifi);
nspawn: let's avoid using goto to wildly for non-cleanup purposes
2014-06-30 15:20:59 +02:00
if (r < 0)
goto finish;
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
r = setup_bridge(veth_name, &ifi);
nspawn: let's avoid using goto to wildly for non-cleanup purposes
2014-06-30 15:20:59 +02:00
if (r < 0)
goto finish;
nspawn: add new --network-bridge= switch This adds the host side of the veth link to the given bridge. Also refactor the creation of the veth interfaces a bit to set it up from the host rather than the container. This simplifies the addition to the bridge, but otherwise the behavior is unchanged.
2014-02-16 21:12:47 +01:00
nspawn: let's avoid using goto to wildly for non-cleanup purposes
2014-06-30 15:20:59 +02:00
r = setup_macvlan(pid);
if (r < 0)
goto finish;
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
nspawn: add ipvlan support
2015-01-20 00:18:28 +01:00
r = setup_ipvlan(pid);
if (r < 0)
goto finish;
nspawn: register external network interface with machined
2014-07-10 22:48:30 +02:00
r = register_machine(pid, ifi);
if (r < 0)
goto finish;
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
/* Notify the child that the parent is ready with all
* its setup, and that the child can now hand over
* control to the code to run inside the container. */
(void) barrier_place(&barrier); /* #2 */
if (arg_userns) {
char uid_map[strlen("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1], line[DECIMAL_STR_MAX(uid_t)*3+3+1];
(void) barrier_place_and_sync(&barrier); /* #3 */
xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
xsprintf(line, UID_FMT " " UID_FMT " " UID_FMT "\n", 0, arg_uid_shift, arg_uid_range);
r = write_string_file(uid_map, line);
if (r < 0) {
log_error_errno(r, "Failed to write UID map: %m");
goto finish;
}
/* We always assign the same UID and GID ranges */
xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
r = write_string_file(uid_map, line);
if (r < 0) {
log_error_errno(r, "Failed to write GID map: %m");
goto finish;
}
(void) barrier_place(&barrier); /* #4 */
}
nspawn: let's avoid using goto to wildly for non-cleanup purposes
2014-06-30 15:20:59 +02:00
/* Block SIGCHLD here, before notifying child.
* process_pty() will handle it with the other signals. */
r = sigprocmask(SIG_BLOCK, &mask_chld, NULL);
if (r < 0)
goto finish;
nspawn: make nspawn robust to container failure nspawn and the container child use eventfd to wait and notify each other that they are ready so the container setup can be completed. However in its current form the wait/notify event ignore errors that may especially affect the child (container). On errors the child will jump to the "child_fail" label and terminate with _exit(EXIT_FAILURE) without notifying the parent. Since the eventfd is created without the "EFD_NONBLOCK" flag, this leaves the parent blocking on the eventfd_read() call. The container can also be killed at any moment before execv() and the parent will not receive notifications. We can fix this by using cheap mechanisms, the new high level eventfd API and handle SIGCHLD signals: * Keep the cheap eventfd and EFD_NONBLOCK flag. * Introduce eventfd states for parent and child to sync. Child notifies parent with EVENTFD_CHILD_SUCCEEDED on success or EVENTFD_CHILD_FAILED on failure and before _exit(). This prevents the parent from waiting on an event that will never come. * If the child is killed before execv() or before notifying the parent, we install a NOP handler for SIGCHLD which will interrupt blocking calls with EINTR. This gives a chance to the parent to call wait() and terminate in main(). * If there are no errors, parent will block SIGCHLD, restore default handler and notify child which will do execv(), then parent will pass control to process_pty() to do its magic. This was exposed in part by: https://bugs.freedesktop.org/show_bug.cgi?id=76193 Reported-by: Tobias Hunger tobias.hunger@gmail.com
2014-05-24 15:58:55 +02:00
nspawn: let's avoid using goto to wildly for non-cleanup purposes
2014-06-30 15:20:59 +02:00
/* Reset signal to default */
r = default_signals(SIGCHLD, -1);
if (r < 0)
goto finish;
nspawn: make nspawn robust to container failure nspawn and the container child use eventfd to wait and notify each other that they are ready so the container setup can be completed. However in its current form the wait/notify event ignore errors that may especially affect the child (container). On errors the child will jump to the "child_fail" label and terminate with _exit(EXIT_FAILURE) without notifying the parent. Since the eventfd is created without the "EFD_NONBLOCK" flag, this leaves the parent blocking on the eventfd_read() call. The container can also be killed at any moment before execv() and the parent will not receive notifications. We can fix this by using cheap mechanisms, the new high level eventfd API and handle SIGCHLD signals: * Keep the cheap eventfd and EFD_NONBLOCK flag. * Introduce eventfd states for parent and child to sync. Child notifies parent with EVENTFD_CHILD_SUCCEEDED on success or EVENTFD_CHILD_FAILED on failure and before _exit(). This prevents the parent from waiting on an event that will never come. * If the child is killed before execv() or before notifying the parent, we install a NOP handler for SIGCHLD which will interrupt blocking calls with EINTR. This gives a chance to the parent to call wait() and terminate in main(). * If there are no errors, parent will block SIGCHLD, restore default handler and notify child which will do execv(), then parent will pass control to process_pty() to do its magic. This was exposed in part by: https://bugs.freedesktop.org/show_bug.cgi?id=76193 Reported-by: Tobias Hunger tobias.hunger@gmail.com
2014-05-24 15:58:55 +02:00
nspawn: add basic user namespacing support (This is incomplete, /proc and /sys are still owned by root from outside the container, not inside)
2015-02-19 11:30:18 +01:00
/* Let the child know that we are ready and wait that the child is completely ready now. */
if (barrier_place_and_sync(&barrier)) { /* #5 */
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
_cleanup_event_unref_ sd_event *event = NULL;
_cleanup_(pty_forward_freep) PTYForward *forward = NULL;
_cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
char last_char = 0;
nspawn: mount most of the cgroup tree read-only in nspawn containers except for the container's own subtree in the name=systemd hierarchy More specifically mount all other hierarchies in their entirety and the name=systemd above the container's subtree read-only.
2014-12-30 01:57:23 +01:00
nspawn: pass the container's init PID out via sd_notify() This is useful for nspawn managers that want to learn when nspawn is finished with initialiuzation, as well what the PID of the init system in the container is.
2015-01-14 23:29:01 +01:00
sd_notifyf(false,
"READY=1\n"
"STATUS=Container running.\n"
"X_NSPAWN_LEADER_PID=" PID_FMT, pid);
nspawn: do not invoke RegisterMachine on machined from inside the new PID namespace On kdbus user credentials are not translated across PID namespaces, but simply invalidated if sender and receiver namespaces don't match. This makes it impossible to properly authenticate requests from different PID namespaces (which is probably a good thing). Hence, register the machine in the parent and not the client and properly synchronize this.
2014-01-09 01:42:57 +01:00
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
r = sd_event_new(&event);
if (r < 0) {
log_error_errno(r, "Failed to get default event source: %m");
goto finish;
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: make kill signal to use for PID 1 configurable
2015-02-25 22:04:48 +01:00
if (arg_kill_signal > 0) {
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
/* Try to kill the init system on SIGINT or SIGTERM */
sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, UINT32_TO_PTR(pid));
sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, UINT32_TO_PTR(pid));
} else {
/* Immediately exit */
sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
}
ptyforward: rework PTY forwarder logic used by nspawn to utilize the normal event loop We really should not run manual event loops anymore, but standardize on sd_event, so that we can run sd_bus connections from it eventually.
2014-10-31 16:54:11 +01:00
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
/* simply exit on sigchld */
sd_event_add_signal(event, NULL, SIGCHLD, NULL, NULL);
ptyforward: rework PTY forwarder logic used by nspawn to utilize the normal event loop We really should not run manual event loops anymore, but standardize on sd_event, so that we can run sd_bus connections from it eventually.
2014-10-31 16:54:11 +01:00
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
if (arg_expose_ports) {
r = watch_rtnl(event, rtnl_socket_pair[0], &exposed, &rtnl);
if (r < 0)
goto finish;
ptyforward: rework PTY forwarder logic used by nspawn to utilize the normal event loop We really should not run manual event loops anymore, but standardize on sd_event, so that we can run sd_bus connections from it eventually.
2014-10-31 16:54:11 +01:00
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
(void) expose_ports(rtnl, &exposed);
}
ptyforward: rework PTY forwarder logic used by nspawn to utilize the normal event loop We really should not run manual event loops anymore, but standardize on sd_event, so that we can run sd_bus connections from it eventually.
2014-10-31 16:54:11 +01:00
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
machinectl,nspawn: don't print extra final newline if pty terminal output was newline-terinated anyway
2014-12-22 20:33:45 +01:00
nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 Previously we always invoked the container PID 1 on /dev/console of the container. With this change we do so only if nspawn was invoked interactively (i.e. its stdin/stdout was connected to a TTY). In all other cases we directly pass through the fds unmodified. This has the benefit that nspawn can be added into shell pipelines. https://bugs.freedesktop.org/show_bug.cgi?id=87732
2015-02-18 23:32:55 +01:00
r = pty_forward_new(event, master, true, !interactive, &forward);
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
if (r < 0) {
log_error_errno(r, "Failed to create PTY forwarder: %m");
goto finish;
}
ptyforward: rework PTY forwarder logic used by nspawn to utilize the normal event loop We really should not run manual event loops anymore, but standardize on sd_event, so that we can run sd_bus connections from it eventually.
2014-10-31 16:54:11 +01:00
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
r = sd_event_loop(event);
if (r < 0) {
log_error_errno(r, "Failed to run event loop: %m");
goto finish;
}
pty_forward_get_last_char(forward, &last_char);
forward = pty_forward_free(forward);
if (!arg_quiet && last_char != '\n')
putc('\n', stdout);
machinectl: add new command to spawn a getty inside a container
2013-10-31 01:25:44 +01:00
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
/* Kill if it is not dead yet anyway */
terminate_machine(pid);
}
nspawn: let's avoid using goto to wildly for non-cleanup purposes
2014-06-30 15:20:59 +02:00
}
nspawn: explicitly terminate machines when we exit nspawn https://bugs.freedesktop.org/show_bug.cgi?id=68370 https://bugzilla.redhat.com/show_bug.cgi?id=988883
2013-11-06 02:05:06 +01:00
nspawn: let's avoid using goto to wildly for non-cleanup purposes
2014-06-30 15:20:59 +02:00
/* Normally redundant, but better safe than sorry */
machinectl: add new command to spawn a getty inside a container
2013-10-31 01:25:44 +01:00
kill(pid, SIGKILL);
nspawn: allocate a new pty instead of passing ours through to avoid terminal settings chaos
2011-03-16 02:57:52 +01:00
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
r = wait_for_container(pid, &container_status);
machinectl: add new command to spawn a getty inside a container
2013-10-31 01:25:44 +01:00
pid = 0;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
if (r < 0)
nspawn: simplify exit condition check
2014-06-30 15:19:00 +02:00
/* We failed to wait for the container, or the
* container exited abnormally */
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
goto finish;
else if (r > 0 || container_status == CONTAINER_TERMINATED){
nspawn: simplify exit condition check
2014-06-30 15:19:00 +02:00
/* The container exited with a non-zero
* status, or with zero status and no reboot
* was requested. */
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
ret = r;
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
break;
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: move container wait logic into wait_for_container() Move the container wait logic into its own wait_for_container() function and add two status codes: CONTAINER_TERMINATED or CONTAINER_REBOOTED. The status will be stored in its argument, this way we handle: a) Return negative on failures. b) Return zero on success and set the status to either CONTAINER_REBOOTED or CONTAINER_TERMINATED. These status codes are used to terminate nspawn or loop again in case of CONTAINER_REBOOTED.
2014-05-24 15:58:54 +02:00
/* CONTAINER_REBOOTED, loop again */
nspawn: when running in a service unit, use systemd for restarts THis way we can remove cgroup priviliges after setup, but get them back for the next restart, as we need it.
2014-07-03 12:50:11 +02:00
if (arg_keep_unit) {
/* Special handling if we are running as a
* service: instead of simply restarting the
* machine we want to restart the entire
* service, so let's inform systemd about this
* with the special exit code 133. The service
* file uses RestartForceExitStatus=133 so
* that this results in a full nspawn
* restart. This is necessary since we might
* have cgroup parameters set we want to have
* flushed out. */
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
ret = 133;
r = 0;
nspawn: when running in a service unit, use systemd for restarts THis way we can remove cgroup priviliges after setup, but get them back for the next restart, as we need it.
2014-07-03 12:50:11 +02:00
break;
}
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
flush_ports(&exposed);
nspawn: handle poweroff/reboot nicely in containers
2012-09-06 01:23:41 +02:00
}
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
finish:
notify: send STOPPING=1 from our daemons
2014-08-21 17:19:28 +02:00
sd_notify(false,
"STOPPING=1\n"
"STATUS=Terminating...");
nspawn: add --image= switch to boot GPT disk images that follow the Discoverable Partitions Specification
2014-03-10 20:35:52 +01:00
loop_remove(loop_nr, &image_fd);
logind: add infrastructure to keep track of machines, and move to slices - This changes all logind cgroup objects to use slice objects rather than fixed croup locations. - logind can now collect minimal information about running VMs/containers. As fixed cgroup locations can no longer be used we need an entity that keeps track of machine cgroups in whatever slice they might be located. Since logind already keeps track of users, sessions and seats this is a trivial addition. - nspawn will now register with logind and pass various bits of metadata along. A new option "--slice=" has been added to place the container in a specific slice. - loginctl gained commands to list, introspect and terminate machines. - user.slice and machine.slice will now be pulled in by logind.service, since only logind.service requires this slice.
2013-06-20 03:45:08 +02:00
if (pid > 0)
kill(pid, SIGKILL);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
if (remove_subvol && arg_directory) {
int k;
btrfs: support recursively removing btrfs snapshots
2015-04-06 10:57:17 +02:00
k = btrfs_subvol_remove(arg_directory, true);
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
if (k < 0)
log_warning_errno(k, "Cannot remove subvolume '%s', ignoring: %m", arg_directory);
}
machinectl: implement "bind" command to create additional bind mounts from host to container during runtime
2014-12-17 21:51:45 +01:00
if (arg_machine) {
const char *p;
util: rework strappenda(), and rename it strjoina() After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
2015-02-03 02:05:59 +01:00
p = strjoina("/run/systemd/nspawn/propagate/", arg_machine);
util: rework rm_rf() logic - Move to its own file rm-rf.c - Change parameters into a single flags parameter - Remove "honour sticky" logic, it's unused these days
2015-04-04 11:52:57 +02:00
(void) rm_rf(p, REMOVE_ROOT);
machinectl: implement "bind" command to create additional bind mounts from host to container during runtime
2014-12-17 21:51:45 +01:00
}
nspawn: move container into its own name=systemd cgroup
2011-03-14 22:33:31 +01:00
free(arg_directory);
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
free(arg_template);
free(arg_image);
nspawn: introduce the new /machine/ tree in the cgroup tree and move containers there Containers will now carry a label (normally derived from the root directory name, but configurable by the user), and the container's root cgroup is /machine/<label>. This label is called "machine name", and can cover both containers and VMs (as soon as libvirt also makes use of /machine/). libsystemd-login can be used to query the machine name from a process. This patch also includes numerous clean-ups for the cgroup code.
2013-04-16 04:36:06 +02:00
free(arg_machine);
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
free(arg_user);
strv_free(arg_setenv);
strv_free(arg_network_interfaces);
strv_free(arg_network_macvlan);
nspawn: add ipvlan support
2015-01-20 00:18:28 +01:00
strv_free(arg_network_ipvlan);
nspawn: add new switch --network-macvlan= to add a macvlan device to the container
2014-02-25 02:27:39 +01:00
strv_free(arg_bind);
strv_free(arg_bind_ro);
nspawn: add new --tmpfs= option to mount a tmpfs on specific directories, such as /var
2014-06-11 00:44:30 +02:00
strv_free(arg_tmpfs);
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
nspawn: add new option "--port=" for exposing container ports on the local host This exposes an IP port on the container as local port using DNAT.
2015-01-13 13:51:51 +01:00
flush_ports(&exposed);
while (arg_expose_ports) {
ExposePort *p = arg_expose_ports;
LIST_REMOVE(ports, arg_expose_ports, p);
free(p);
}
nspawn: beef up nspawn with some btrfs magic This adds --template= to duplicate an OS tree as btrfs snpashot and run it This also adds --ephemeral or -x to create a snapshot of an OS tree and boot that, removing it after exit.
2014-12-12 03:50:59 +01:00
return r < 0 ? EXIT_FAILURE : ret;
nspawn: add simple chroot(1) like tool to execute commands in a namespace container
2011-03-14 02:40:36 +01:00
}