9fac502920
Let's make /run/host the sole place we pass stuff from host to container in and place the "inaccessible" nodes in /run/host too. In contrast to the previous two commits this is a minor compat break, but not a relevant one I think. Previously the container manager would place these nodes in /run/systemd/inaccessible/ and that's where PID 1 in the container would try to add them too when missing. Container manager and PID 1 in the container would thus manage the same dir together. With this change the container manager now passes an immutable directory to the container and leaves /run/systemd entirely untouched, and managed exclusively by PID 1 inside the container, which is nice to have clear separation on who manages what. In order to make sure systemd then usses the /run/host/inaccesible/ nodes this commit changes PID 1 to look for that dir and if it exists will symlink it to /run/systemd/inaccessible. Now, this will work fine if new nspawn and new pid 1 in the container work together. as then the symlink is created and the difference between the two dirs won't matter. For the case where an old nspawn invokes a new PID 1: in this case things work as they always worked: the dir is managed together. For the case where different container manager invokes a new PID 1: in this case the nodes aren't typically passed in, and PID 1 in the container will try to create them and will likely fail partially (though gracefully) when trying to create char/block device nodes. THis is fine though as there are fallbacks in place for that case. For the case where a new nspawn invokes an old PID1: this is were the (minor) incompatibily happens: in this case new nspawn will place the nodes in the /run/host/inaccessible/ subdir, but the PID 1 in the container won't look for them there. Since the nodes are also not pre-created in /run/systed/inaccessible/ PID 1 will try to create them there as if a different container manager sets them up. This is of course not sexy, but is not a total loss, since as mentioned fallbacks are in place anyway. Hence I think it's OK to accept this minor incompatibility.
64 lines
1.9 KiB
C
64 lines
1.9 KiB
C
/* SPDX-License-Identifier: LGPL-2.1+ */
|
|
|
|
#include "capability-util.h"
|
|
#include "dev-setup.h"
|
|
#include "fs-util.h"
|
|
#include "mkdir.h"
|
|
#include "path-util.h"
|
|
#include "rm-rf.h"
|
|
#include "tmpfile-util.h"
|
|
|
|
int main(int argc, char *argv[]) {
|
|
_cleanup_(rm_rf_physical_and_freep) char *p = NULL;
|
|
const char *f;
|
|
struct stat st;
|
|
|
|
if (have_effective_cap(CAP_DAC_OVERRIDE) <= 0)
|
|
return EXIT_TEST_SKIP;
|
|
|
|
assert_se(mkdtemp_malloc("/tmp/test-dev-setupXXXXXX", &p) >= 0);
|
|
|
|
f = prefix_roota(p, "/run/systemd");
|
|
assert_se(mkdir_p(f, 0755) >= 0);
|
|
|
|
assert_se(make_inaccessible_nodes(f, 1, 1) >= 0);
|
|
|
|
f = prefix_roota(p, "/run/systemd/inaccessible/reg");
|
|
assert_se(stat(f, &st) >= 0);
|
|
assert_se(S_ISREG(st.st_mode));
|
|
assert_se((st.st_mode & 07777) == 0000);
|
|
|
|
f = prefix_roota(p, "/run/systemd/inaccessible/dir");
|
|
assert_se(stat(f, &st) >= 0);
|
|
assert_se(S_ISDIR(st.st_mode));
|
|
assert_se((st.st_mode & 07777) == 0000);
|
|
|
|
f = prefix_roota(p, "/run/systemd/inaccessible/fifo");
|
|
assert_se(stat(f, &st) >= 0);
|
|
assert_se(S_ISFIFO(st.st_mode));
|
|
assert_se((st.st_mode & 07777) == 0000);
|
|
|
|
f = prefix_roota(p, "/run/systemd/inaccessible/sock");
|
|
assert_se(stat(f, &st) >= 0);
|
|
assert_se(S_ISSOCK(st.st_mode));
|
|
assert_se((st.st_mode & 07777) == 0000);
|
|
|
|
f = prefix_roota(p, "/run/systemd/inaccessible/chr");
|
|
if (stat(f, &st) < 0)
|
|
assert_se(errno == ENOENT);
|
|
else {
|
|
assert_se(S_ISCHR(st.st_mode));
|
|
assert_se((st.st_mode & 07777) == 0000);
|
|
}
|
|
|
|
f = prefix_roota(p, "/run/systemd/inaccessible/blk");
|
|
if (stat(f, &st) < 0)
|
|
assert_se(errno == ENOENT);
|
|
else {
|
|
assert_se(S_ISBLK(st.st_mode));
|
|
assert_se((st.st_mode & 07777) == 0000);
|
|
}
|
|
|
|
return EXIT_SUCCESS;
|
|
}
|