X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fnspawn.c;h=451d539625eba6a170872122fb94580e1a11c90a;hb=e03ae6615a1fe9a2aee854d00c3fc7397a06983d;hp=4e4d40ea6f5c7f85e1fae4e3baaf69f267507327;hpb=88213476187cafc86bea2276199891873000588d;p=elogind.git

diff --git a/src/nspawn.c b/src/nspawn.c
index 4e4d40ea6..451d53962 100644
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -36,6 +36,7 @@
 
 #include "log.h"
 #include "util.h"
+#include "missing.h"
 
 static char *arg_directory = NULL;
 
@@ -100,16 +101,20 @@ static int mount_all(const char *dest) {
                 const char *type;
                 const char *options;
                 unsigned long flags;
+                bool fatal;
         } MountPoint;
 
         static const MountPoint mount_table[] = {
-                { "proc",      "/proc",     "proc",   NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV },
-                { "/proc/sys", "/proc/sys", "bind",   NULL,        MS_BIND },                      /* Bind mount first */
-                { "/proc/sys", "/proc/sys", "bind",   NULL,        MS_BIND|MS_RDONLY|MS_REMOUNT }, /* Then, make it r/o */
-                { "sysfs",     "/sys",      "sysfs",  NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY },
-                { "tmpfs",     "/dev",      "tmpfs",  "mode=755",  MS_NOSUID },
-                { "/dev/pts",  "/dev/pts",  "bind",   NULL,        MS_BIND },
-                { "tmpfs",     "/dev/.run", "tmpfs",  "mode=755",  MS_NOSUID|MS_NOEXEC|MS_NODEV },
+                { "proc",      "/proc",     "proc",      NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
+                { "/proc/sys", "/proc/sys", "bind",      NULL,        MS_BIND, true },                      /* Bind mount first */
+                { "/proc/sys", "/proc/sys", "bind",      NULL,        MS_BIND|MS_RDONLY|MS_REMOUNT, true }, /* Then, make it r/o */
+                { "sysfs",     "/sys",      "sysfs",     NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true },
+                { "tmpfs",     "/dev",      "tmpfs",     "mode=755",  MS_NOSUID, true },
+                { "/dev/pts",  "/dev/pts",  "bind",      NULL,        MS_BIND, true },
+                { "tmpfs",     "/dev/.run", "tmpfs",     "mode=755",  MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
+#ifdef HAVE_SELINUX
+                { "selinux",   "/selinux",  "selinuxfs", NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, false },
+#endif
         };
 
         unsigned k;
@@ -144,7 +149,8 @@ static int mount_all(const char *dest) {
                           where,
                           mount_table[k].type,
                           mount_table[k].flags,
-                          mount_table[k].options) < 0) {
+                          mount_table[k].options) < 0 &&
+                    mount_table[k].fatal) {
 
                         log_error("mount(%s) failed: %m", where);
 
@@ -175,6 +181,9 @@ static int copy_devnodes(const char *dest) {
         int r = 0, k;
         char *tty = NULL;
         dev_t tty_devnum;
+        mode_t u;
+
+        u = umask(0000);
 
         NULSTR_FOREACH(d, devnodes) {
                 char *from = NULL, *to = NULL;
@@ -250,7 +259,7 @@ static int copy_devnodes(const char *dest) {
                                         r = -errno;
                         }
 
-                        if (mount(from, to, "bind", MS_BIND, NULL) < 0) {
+                        if (mount(from, to, "bind", MS_BIND|MS_RDONLY, NULL) < 0) {
                                 log_error("bind mount for /dev/console failed: %m");
 
                                 if (r == 0)
@@ -264,6 +273,8 @@ static int copy_devnodes(const char *dest) {
 
         free(tty);
 
+        umask(u);
+
         return r;
 }
 
@@ -366,7 +377,7 @@ int main(int argc, char *argv[]) {
         }
 
         if (path_equal(arg_directory, "/")) {
-                log_error("Spawning constainer on root directory not supported.");
+                log_error("Spawning container on root directory not supported.");
                 goto finish;
         }
 
@@ -377,13 +388,18 @@ int main(int argc, char *argv[]) {
 
         log_info("Spawning namespace container on %s.", arg_directory);
 
-        if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|CLONE_NEWNET, NULL)) < 0) {
+        if ((pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS, NULL)) < 0) {
                 log_error("clone() failed: %m");
                 goto finish;
         }
 
         if (pid == 0) {
                 const char *hn;
+                const char *envp[] = {
+                        "HOME=/root",
+                        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                        NULL
+                };
 
                 /* child */
 
@@ -419,9 +435,11 @@ int main(int argc, char *argv[]) {
                         sethostname(hn, strlen(hn));
 
                 if (argc > optind)
-                        execvp(argv[optind], argv + optind);
-                else
-                        execl("/bin/bash", "/bin/bash", NULL);
+                        execvpe(argv[optind], argv + optind, (char**) envp);
+                else {
+                        chdir("/root");
+                        execle("/bin/bash", "-bash", NULL, (char**) envp);
+                }
 
                 log_error("execv() failed: %m");
 
@@ -429,7 +447,7 @@ int main(int argc, char *argv[]) {
                 _exit(EXIT_FAILURE);
         }
 
-        r = wait_for_terminate_and_warn("container", pid);
+        r = wait_for_terminate_and_warn(argc > optind ? argv[optind] : "bash", pid);
 
         if (r < 0)
                 r = EXIT_FAILURE;