359 lines
9.4 KiB
C
359 lines
9.4 KiB
C
/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
|
|
|
|
/***
|
|
This file is part of systemd.
|
|
|
|
Copyright 2010 Lennart Poettering
|
|
|
|
systemd is free software; you can redistribute it and/or modify it
|
|
under the terms of the GNU Lesser General Public License as published by
|
|
the Free Software Foundation; either version 2.1 of the License, or
|
|
(at your option) any later version.
|
|
|
|
systemd is distributed in the hope that it will be useful, but
|
|
WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public License
|
|
along with systemd; If not, see <http://www.gnu.org/licenses/>.
|
|
***/
|
|
|
|
#include <errno.h>
|
|
#include <sys/mount.h>
|
|
#include <string.h>
|
|
#include <stdio.h>
|
|
#include <unistd.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/types.h>
|
|
#include <sched.h>
|
|
#include <sys/syscall.h>
|
|
#include <limits.h>
|
|
#include <linux/fs.h>
|
|
|
|
#include "strv.h"
|
|
#include "util.h"
|
|
#include "path-util.h"
|
|
#include "namespace.h"
|
|
#include "missing.h"
|
|
|
|
typedef enum PathMode {
|
|
/* This is ordered by priority! */
|
|
INACCESSIBLE,
|
|
READONLY,
|
|
PRIVATE,
|
|
READWRITE
|
|
} PathMode;
|
|
|
|
typedef struct Path {
|
|
const char *path;
|
|
PathMode mode;
|
|
} Path;
|
|
|
|
static int append_paths(Path **p, char **strv, PathMode mode) {
|
|
char **i;
|
|
|
|
STRV_FOREACH(i, strv) {
|
|
|
|
if (!path_is_absolute(*i))
|
|
return -EINVAL;
|
|
|
|
(*p)->path = *i;
|
|
(*p)->mode = mode;
|
|
(*p)++;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int path_compare(const void *a, const void *b) {
|
|
const Path *p = a, *q = b;
|
|
|
|
if (path_equal(p->path, q->path)) {
|
|
|
|
/* If the paths are equal, check the mode */
|
|
if (p->mode < q->mode)
|
|
return -1;
|
|
|
|
if (p->mode > q->mode)
|
|
return 1;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* If the paths are not equal, then order prefixes first */
|
|
if (path_startswith(p->path, q->path))
|
|
return 1;
|
|
|
|
if (path_startswith(q->path, p->path))
|
|
return -1;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void drop_duplicates(Path *p, unsigned *n, bool *need_inaccessible, bool *need_private) {
|
|
Path *f, *t, *previous;
|
|
|
|
assert(p);
|
|
assert(n);
|
|
assert(need_inaccessible);
|
|
assert(need_private);
|
|
|
|
for (f = p, t = p, previous = NULL; f < p+*n; f++) {
|
|
|
|
if (previous && path_equal(f->path, previous->path))
|
|
continue;
|
|
|
|
t->path = f->path;
|
|
t->mode = f->mode;
|
|
|
|
if (t->mode == PRIVATE)
|
|
*need_private = true;
|
|
|
|
if (t->mode == INACCESSIBLE)
|
|
*need_inaccessible = true;
|
|
|
|
previous = t;
|
|
|
|
t++;
|
|
}
|
|
|
|
*n = t - p;
|
|
}
|
|
|
|
static int apply_mount(Path *p, const char *root_dir, const char *inaccessible_dir, const char *private_dir, unsigned long flags) {
|
|
const char *what;
|
|
char *where;
|
|
int r;
|
|
|
|
assert(p);
|
|
assert(root_dir);
|
|
assert(inaccessible_dir);
|
|
assert(private_dir);
|
|
|
|
where = strappend(root_dir, p->path);
|
|
if (!where)
|
|
return -ENOMEM;
|
|
|
|
switch (p->mode) {
|
|
|
|
case INACCESSIBLE:
|
|
what = inaccessible_dir;
|
|
flags |= MS_RDONLY;
|
|
break;
|
|
|
|
case READONLY:
|
|
flags |= MS_RDONLY;
|
|
/* Fall through */
|
|
|
|
case READWRITE:
|
|
what = p->path;
|
|
break;
|
|
|
|
case PRIVATE:
|
|
what = private_dir;
|
|
break;
|
|
|
|
default:
|
|
assert_not_reached("Unknown mode");
|
|
}
|
|
|
|
r = mount(what, where, NULL, MS_BIND|MS_REC, NULL);
|
|
if (r >= 0) {
|
|
log_debug("Successfully mounted %s to %s", what, where);
|
|
|
|
/* The bind mount will always inherit the original
|
|
* flags. If we want to set any flag we need
|
|
* to do so in a second independent step. */
|
|
if (flags)
|
|
r = mount(NULL, where, NULL, MS_REMOUNT|MS_BIND|MS_REC|flags, NULL);
|
|
|
|
/* Avoid exponential growth of trees */
|
|
if (r >= 0 && path_equal(p->path, "/"))
|
|
r = mount(NULL, where, NULL, MS_REMOUNT|MS_BIND|flags, NULL);
|
|
|
|
if (r < 0) {
|
|
r = -errno;
|
|
umount2(where, MNT_DETACH);
|
|
}
|
|
}
|
|
|
|
free(where);
|
|
return r;
|
|
}
|
|
|
|
int setup_namespace(
|
|
char **writable,
|
|
char **readable,
|
|
char **inaccessible,
|
|
bool private_tmp,
|
|
unsigned long flags) {
|
|
|
|
char
|
|
tmp_dir[] = "/tmp/systemd-namespace-XXXXXX",
|
|
root_dir[] = "/tmp/systemd-namespace-XXXXXX/root",
|
|
old_root_dir[] = "/tmp/systemd-namespace-XXXXXX/root/tmp/old-root-XXXXXX",
|
|
inaccessible_dir[] = "/tmp/systemd-namespace-XXXXXX/inaccessible",
|
|
private_dir[] = "/tmp/systemd-namespace-XXXXXX/private";
|
|
|
|
Path *paths, *p;
|
|
unsigned n;
|
|
bool need_private = false, need_inaccessible = false;
|
|
bool remove_tmp = false, remove_root = false, remove_old_root = false, remove_inaccessible = false, remove_private = false;
|
|
int r;
|
|
const char *t;
|
|
|
|
n =
|
|
strv_length(writable) +
|
|
strv_length(readable) +
|
|
strv_length(inaccessible) +
|
|
(private_tmp ? 3 : 1);
|
|
|
|
paths = new(Path, n);
|
|
if (!paths)
|
|
return -ENOMEM;
|
|
|
|
p = paths;
|
|
if ((r = append_paths(&p, writable, READWRITE)) < 0 ||
|
|
(r = append_paths(&p, readable, READONLY)) < 0 ||
|
|
(r = append_paths(&p, inaccessible, INACCESSIBLE)) < 0)
|
|
goto fail;
|
|
|
|
if (private_tmp) {
|
|
p->path = "/tmp";
|
|
p->mode = PRIVATE;
|
|
p++;
|
|
|
|
p->path = "/var/tmp";
|
|
p->mode = PRIVATE;
|
|
p++;
|
|
}
|
|
|
|
p->path = "/";
|
|
p->mode = READWRITE;
|
|
p++;
|
|
|
|
assert(paths + n == p);
|
|
|
|
qsort(paths, n, sizeof(Path), path_compare);
|
|
drop_duplicates(paths, &n, &need_inaccessible, &need_private);
|
|
|
|
if (!mkdtemp(tmp_dir)) {
|
|
r = -errno;
|
|
goto fail;
|
|
}
|
|
remove_tmp = true;
|
|
|
|
memcpy(root_dir, tmp_dir, sizeof(tmp_dir)-1);
|
|
if (mkdir(root_dir, 0777) < 0) {
|
|
r = -errno;
|
|
goto fail;
|
|
}
|
|
remove_root = true;
|
|
|
|
if (need_inaccessible) {
|
|
memcpy(inaccessible_dir, tmp_dir, sizeof(tmp_dir)-1);
|
|
if (mkdir(inaccessible_dir, 0) < 0) {
|
|
r = -errno;
|
|
goto fail;
|
|
}
|
|
remove_inaccessible = true;
|
|
}
|
|
|
|
if (need_private) {
|
|
mode_t u;
|
|
|
|
memcpy(private_dir, tmp_dir, sizeof(tmp_dir)-1);
|
|
|
|
u = umask(0000);
|
|
if (mkdir(private_dir, 0777 + S_ISVTX) < 0) {
|
|
umask(u);
|
|
|
|
r = -errno;
|
|
goto fail;
|
|
}
|
|
|
|
umask(u);
|
|
remove_private = true;
|
|
}
|
|
|
|
if (unshare(CLONE_NEWNS) < 0) {
|
|
r = -errno;
|
|
goto fail;
|
|
}
|
|
|
|
/* Remount / as SLAVE so that nothing mounted in the namespace
|
|
shows up in the parent */
|
|
if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
|
|
r = -errno;
|
|
goto fail;
|
|
}
|
|
|
|
for (p = paths; p < paths + n; p++) {
|
|
r = apply_mount(p, root_dir, inaccessible_dir, private_dir, flags);
|
|
if (r < 0)
|
|
goto undo_mounts;
|
|
}
|
|
|
|
memcpy(old_root_dir, tmp_dir, sizeof(tmp_dir)-1);
|
|
if (!mkdtemp(old_root_dir)) {
|
|
r = -errno;
|
|
goto undo_mounts;
|
|
}
|
|
remove_old_root = true;
|
|
|
|
if (chdir(root_dir) < 0) {
|
|
r = -errno;
|
|
goto undo_mounts;
|
|
}
|
|
|
|
if (pivot_root(root_dir, old_root_dir) < 0) {
|
|
r = -errno;
|
|
goto undo_mounts;
|
|
}
|
|
|
|
free(paths);
|
|
|
|
t = old_root_dir + sizeof(root_dir) - 1;
|
|
if (umount2(t, MNT_DETACH) < 0)
|
|
/* At this point it's too late to turn anything back,
|
|
* since we are already in the new root. */
|
|
return -errno;
|
|
|
|
if (rmdir(t) < 0)
|
|
return -errno;
|
|
|
|
return 0;
|
|
|
|
undo_mounts:
|
|
|
|
for (p--; p >= paths; p--) {
|
|
char full_path[PATH_MAX];
|
|
|
|
snprintf(full_path, sizeof(full_path), "%s%s", root_dir, p->path);
|
|
char_array_0(full_path);
|
|
|
|
umount2(full_path, MNT_DETACH);
|
|
}
|
|
|
|
fail:
|
|
if (remove_old_root)
|
|
rmdir(old_root_dir);
|
|
|
|
if (remove_inaccessible)
|
|
rmdir(inaccessible_dir);
|
|
|
|
if (remove_private)
|
|
rmdir(private_dir);
|
|
|
|
if (remove_root)
|
|
rmdir(root_dir);
|
|
|
|
if (remove_tmp)
|
|
rmdir(tmp_dir);
|
|
|
|
free(paths);
|
|
|
|
return r;
|
|
}
|