Systemd/src/shared/dev-setup.h

/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once

#include <sys/types.h>

int dev_setup(const char *prefix, uid_t uid, gid_t gid);

int make_inaccessible_nodes(const char *parent_dir, uid_t uid, gid_t gid);
license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 05:23:58 +01:00			`/* SPDX-License-Identifier: LGPL-2.1-or-later */`
dev-setup: allow a path prefix for use in chroots With this adjustment, we can reuse this code elsewhere, such as in nspawn. 2012-08-15 02:00:30 +02:00			`#pragma once`
udev: unify /dev static symlink setup 2012-04-17 22:25:24 +02:00
nspawn: finish user namespace support 2015-05-21 16:30:58 +02:00			`#include <sys/types.h>`

			`int dev_setup(const char *prefix, uid_t uid, gid_t gid);`
dev-setup: generalize logic we use to create "inaccessible" device nodes Let's generalize this, so that we can use this in nspawn later on, which is pretty useful as we need to be able to mask files from the inner child of nspawn too, where the host's /run/systemd/inaccessible directory is not visible anymore. Moreover, if nspawn can create these nodes on its own before the payload this means the payload can run with fewer privileges. 2018-07-27 18:04:11 +02:00
nspawn,pid1: pass "inaccessible" nodes from cntr mgr to pid1 payload via /run/host Let's make /run/host the sole place we pass stuff from host to container in and place the "inaccessible" nodes in /run/host too. In contrast to the previous two commits this is a minor compat break, but not a relevant one I think. Previously the container manager would place these nodes in /run/systemd/inaccessible/ and that's where PID 1 in the container would try to add them too when missing. Container manager and PID 1 in the container would thus manage the same dir together. With this change the container manager now passes an immutable directory to the container and leaves /run/systemd entirely untouched, and managed exclusively by PID 1 inside the container, which is nice to have clear separation on who manages what. In order to make sure systemd then usses the /run/host/inaccesible/ nodes this commit changes PID 1 to look for that dir and if it exists will symlink it to /run/systemd/inaccessible. Now, this will work fine if new nspawn and new pid 1 in the container work together. as then the symlink is created and the difference between the two dirs won't matter. For the case where an old nspawn invokes a new PID 1: in this case things work as they always worked: the dir is managed together. For the case where different container manager invokes a new PID 1: in this case the nodes aren't typically passed in, and PID 1 in the container will try to create them and will likely fail partially (though gracefully) when trying to create char/block device nodes. THis is fine though as there are fallbacks in place for that case. For the case where a new nspawn invokes an old PID1: this is were the (minor) incompatibily happens: in this case new nspawn will place the nodes in the /run/host/inaccessible/ subdir, but the PID 1 in the container won't look for them there. Since the nodes are also not pre-created in /run/systed/inaccessible/ PID 1 will try to create them there as if a different container manager sets them up. This is of course not sexy, but is not a total loss, since as mentioned fallbacks are in place anyway. Hence I think it's OK to accept this minor incompatibility. 2020-08-14 18:56:54 +02:00			`int make_inaccessible_nodes(const char *parent_dir, uid_t uid, gid_t gid);`