blob: a06cac10fda45708e020148a39034d73e2d7e7bc [file] [log] [blame] [raw]
/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
/***
This file is part of systemd.
Copyright 2010 Lennart Poettering
systemd is free software; you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
systemd is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License
along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/
#include <errno.h>
#include <sys/mount.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sched.h>
#include <sys/syscall.h>
#include <limits.h>
#include <linux/fs.h>
#include "strv.h"
#include "util.h"
#include "namespace.h"
#include "missing.h"
typedef enum PathMode {
/* This is ordered by priority! */
INACCESSIBLE,
READONLY,
PRIVATE,
READWRITE
} PathMode;
typedef struct Path {
const char *path;
PathMode mode;
} Path;
static int append_paths(Path **p, char **strv, PathMode mode) {
char **i;
STRV_FOREACH(i, strv) {
if (!path_is_absolute(*i))
return -EINVAL;
(*p)->path = *i;
(*p)->mode = mode;
(*p)++;
}
return 0;
}
static int path_compare(const void *a, const void *b) {
const Path *p = a, *q = b;
if (path_equal(p->path, q->path)) {
/* If the paths are equal, check the mode */
if (p->mode < q->mode)
return -1;
if (p->mode > q->mode)
return 1;
return 0;
}
/* If the paths are not equal, then order prefixes first */
if (path_startswith(p->path, q->path))
return 1;
if (path_startswith(q->path, p->path))
return -1;
return 0;
}
static void drop_duplicates(Path *p, unsigned *n, bool *need_inaccessible, bool *need_private) {
Path *f, *t, *previous;
assert(p);
assert(n);
assert(need_inaccessible);
assert(need_private);
for (f = p, t = p, previous = NULL; f < p+*n; f++) {
if (previous && path_equal(f->path, previous->path))
continue;
t->path = f->path;
t->mode = f->mode;
if (t->mode == PRIVATE)
*need_private = true;
if (t->mode == INACCESSIBLE)
*need_inaccessible = true;
previous = t;
t++;
}
*n = t - p;
}
static int apply_mount(Path *p, const char *root_dir, const char *inaccessible_dir, const char *private_dir, unsigned long flags) {
const char *what;
char *where;
int r;
assert(p);
assert(root_dir);
assert(inaccessible_dir);
assert(private_dir);
if (!(where = strappend(root_dir, p->path)))
return -ENOMEM;
switch (p->mode) {
case INACCESSIBLE:
what = inaccessible_dir;
flags |= MS_RDONLY;
break;
case READONLY:
flags |= MS_RDONLY;
/* Fall through */
case READWRITE:
what = p->path;
break;
case PRIVATE:
what = private_dir;
break;
default:
assert_not_reached("Unknown mode");
}
if ((r = mount(what, where, NULL, MS_BIND|MS_REC, NULL)) >= 0) {
log_debug("Successfully mounted %s to %s", what, where);
/* The bind mount will always inherit the original
* flags. If we want to set any flag we need
* to do so in a second independent step. */
if (flags)
r = mount(NULL, where, NULL, MS_REMOUNT|MS_BIND|MS_REC|flags, NULL);
/* Avoid exponential growth of trees */
if (r >= 0 && path_equal(p->path, "/"))
r = mount(NULL, where, NULL, MS_REMOUNT|MS_BIND|MS_UNBINDABLE|flags, NULL);
if (r < 0) {
r = -errno;
umount2(where, MNT_DETACH);
}
}
free(where);
return r;
}
int setup_namespace(
char **writable,
char **readable,
char **inaccessible,
bool private_tmp,
unsigned long flags) {
char
tmp_dir[] = "/tmp/systemd-namespace-XXXXXX",
root_dir[] = "/tmp/systemd-namespace-XXXXXX/root",
old_root_dir[] = "/tmp/systemd-namespace-XXXXXX/root/tmp/old-root-XXXXXX",
inaccessible_dir[] = "/tmp/systemd-namespace-XXXXXX/inaccessible",
private_dir[] = "/tmp/systemd-namespace-XXXXXX/private";
Path *paths, *p;
unsigned n;
bool need_private = false, need_inaccessible = false;
bool remove_tmp = false, remove_root = false, remove_old_root = false, remove_inaccessible = false, remove_private = false;
int r;
const char *t;
n =
strv_length(writable) +
strv_length(readable) +
strv_length(inaccessible) +
(private_tmp ? 2 : 1);
if (!(paths = new(Path, n)))
return -ENOMEM;
p = paths;
if ((r = append_paths(&p, writable, READWRITE)) < 0 ||
(r = append_paths(&p, readable, READONLY)) < 0 ||
(r = append_paths(&p, inaccessible, INACCESSIBLE)) < 0)
goto fail;
if (private_tmp) {
p->path = "/tmp";
p->mode = PRIVATE;
p++;
}
p->path = "/";
p->mode = READWRITE;
p++;
assert(paths + n == p);
qsort(paths, n, sizeof(Path), path_compare);
drop_duplicates(paths, &n, &need_inaccessible, &need_private);
if (!mkdtemp(tmp_dir)) {
r = -errno;
goto fail;
}
remove_tmp = true;
memcpy(root_dir, tmp_dir, sizeof(tmp_dir)-1);
if (mkdir(root_dir, 0777) < 0) {
r = -errno;
goto fail;
}
remove_root = true;
if (need_inaccessible) {
memcpy(inaccessible_dir, tmp_dir, sizeof(tmp_dir)-1);
if (mkdir(inaccessible_dir, 0) < 0) {
r = -errno;
goto fail;
}
remove_inaccessible = true;
}
if (need_private) {
memcpy(private_dir, tmp_dir, sizeof(tmp_dir)-1);
if (mkdir(private_dir, 0777 + S_ISVTX) < 0) {
r = -errno;
goto fail;
}
remove_private = true;
}
if (unshare(CLONE_NEWNS) < 0) {
r = -errno;
goto fail;
}
/* Remount / as SLAVE so that nothing mounted in the namespace
shows up in the parent */
if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
r = -errno;
goto fail;
}
for (p = paths; p < paths + n; p++)
if ((r = apply_mount(p, root_dir, inaccessible_dir, private_dir, flags)) < 0)
goto undo_mounts;
memcpy(old_root_dir, tmp_dir, sizeof(tmp_dir)-1);
if (!mkdtemp(old_root_dir)) {
r = -errno;
goto undo_mounts;
}
remove_old_root = true;
if (chdir(root_dir) < 0) {
r = -errno;
goto undo_mounts;
}
if (pivot_root(root_dir, old_root_dir) < 0) {
r = -errno;
goto undo_mounts;
}
t = old_root_dir + sizeof(root_dir) - 1;
if (umount2(t, MNT_DETACH) < 0)
/* At this point it's too late to turn anything back,
* since we are already in the new root. */
return -errno;
if (rmdir(t) < 0)
return -errno;
return 0;
undo_mounts:
for (p--; p >= paths; p--) {
char full_path[PATH_MAX];
snprintf(full_path, sizeof(full_path), "%s%s", root_dir, p->path);
char_array_0(full_path);
umount2(full_path, MNT_DETACH);
}
fail:
if (remove_old_root)
rmdir(old_root_dir);
if (remove_inaccessible)
rmdir(inaccessible_dir);
if (remove_private)
rmdir(private_dir);
if (remove_root)
rmdir(root_dir);
if (remove_tmp)
rmdir(tmp_dir);
free(paths);
return r;
}