chiark / gitweb /
nspawn: make sure macvlan MAC addresses are stable
[elogind.git] / src / nspawn / nspawn.c
1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
2
3 /***
4   This file is part of systemd.
5
6   Copyright 2010 Lennart Poettering
7
8   systemd is free software; you can redistribute it and/or modify it
9   under the terms of the GNU Lesser General Public License as published by
10   the Free Software Foundation; either version 2.1 of the License, or
11   (at your option) any later version.
12
13   systemd is distributed in the hope that it will be useful, but
14   WITHOUT ANY WARRANTY; without even the implied warranty of
15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16   Lesser General Public License for more details.
17
18   You should have received a copy of the GNU Lesser General Public License
19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
20 ***/
21
22 #include <signal.h>
23 #include <sched.h>
24 #include <unistd.h>
25 #include <sys/types.h>
26 #include <sys/syscall.h>
27 #include <sys/mount.h>
28 #include <sys/wait.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <stdio.h>
32 #include <errno.h>
33 #include <sys/prctl.h>
34 #include <sys/capability.h>
35 #include <getopt.h>
36 #include <termios.h>
37 #include <sys/signalfd.h>
38 #include <grp.h>
39 #include <linux/fs.h>
40 #include <sys/un.h>
41 #include <sys/socket.h>
42 #include <linux/netlink.h>
43 #include <net/if.h>
44 #include <linux/veth.h>
45 #include <sys/personality.h>
46 #include <linux/loop.h>
47
48 #ifdef HAVE_SELINUX
49 #include <selinux/selinux.h>
50 #endif
51
52 #ifdef HAVE_SECCOMP
53 #include <seccomp.h>
54 #endif
55
56 #ifdef HAVE_BLKID
57 #include <blkid/blkid.h>
58 #endif
59
60 #include "sd-daemon.h"
61 #include "sd-bus.h"
62 #include "sd-id128.h"
63 #include "sd-rtnl.h"
64 #include "log.h"
65 #include "util.h"
66 #include "mkdir.h"
67 #include "macro.h"
68 #include "audit.h"
69 #include "missing.h"
70 #include "cgroup-util.h"
71 #include "strv.h"
72 #include "path-util.h"
73 #include "loopback-setup.h"
74 #include "dev-setup.h"
75 #include "fdset.h"
76 #include "build.h"
77 #include "fileio.h"
78 #include "bus-util.h"
79 #include "bus-error.h"
80 #include "ptyfwd.h"
81 #include "bus-kernel.h"
82 #include "env-util.h"
83 #include "def.h"
84 #include "rtnl-util.h"
85 #include "udev-util.h"
86 #include "blkid-util.h"
87 #include "gpt.h"
88 #include "siphash24.h"
89 #include "copy.h"
90 #include "base-filesystem.h"
91 #include "barrier.h"
92 #include "event-util.h"
93
94 #ifdef HAVE_SECCOMP
95 #include "seccomp-util.h"
96 #endif
97
98 typedef enum ContainerStatus {
99         CONTAINER_TERMINATED,
100         CONTAINER_REBOOTED
101 } ContainerStatus;
102
103 typedef enum LinkJournal {
104         LINK_NO,
105         LINK_AUTO,
106         LINK_HOST,
107         LINK_GUEST
108 } LinkJournal;
109
110 typedef enum Volatile {
111         VOLATILE_NO,
112         VOLATILE_YES,
113         VOLATILE_STATE,
114 } Volatile;
115
116 static char *arg_directory = NULL;
117 static char *arg_user = NULL;
118 static sd_id128_t arg_uuid = {};
119 static char *arg_machine = NULL;
120 static const char *arg_selinux_context = NULL;
121 static const char *arg_selinux_apifs_context = NULL;
122 static const char *arg_slice = NULL;
123 static bool arg_private_network = false;
124 static bool arg_read_only = false;
125 static bool arg_boot = false;
126 static LinkJournal arg_link_journal = LINK_AUTO;
127 static bool arg_link_journal_try = false;
128 static uint64_t arg_retain =
129         (1ULL << CAP_CHOWN) |
130         (1ULL << CAP_DAC_OVERRIDE) |
131         (1ULL << CAP_DAC_READ_SEARCH) |
132         (1ULL << CAP_FOWNER) |
133         (1ULL << CAP_FSETID) |
134         (1ULL << CAP_IPC_OWNER) |
135         (1ULL << CAP_KILL) |
136         (1ULL << CAP_LEASE) |
137         (1ULL << CAP_LINUX_IMMUTABLE) |
138         (1ULL << CAP_NET_BIND_SERVICE) |
139         (1ULL << CAP_NET_BROADCAST) |
140         (1ULL << CAP_NET_RAW) |
141         (1ULL << CAP_SETGID) |
142         (1ULL << CAP_SETFCAP) |
143         (1ULL << CAP_SETPCAP) |
144         (1ULL << CAP_SETUID) |
145         (1ULL << CAP_SYS_ADMIN) |
146         (1ULL << CAP_SYS_CHROOT) |
147         (1ULL << CAP_SYS_NICE) |
148         (1ULL << CAP_SYS_PTRACE) |
149         (1ULL << CAP_SYS_TTY_CONFIG) |
150         (1ULL << CAP_SYS_RESOURCE) |
151         (1ULL << CAP_SYS_BOOT) |
152         (1ULL << CAP_AUDIT_WRITE) |
153         (1ULL << CAP_AUDIT_CONTROL) |
154         (1ULL << CAP_MKNOD);
155 static char **arg_bind = NULL;
156 static char **arg_bind_ro = NULL;
157 static char **arg_tmpfs = NULL;
158 static char **arg_setenv = NULL;
159 static bool arg_quiet = false;
160 static bool arg_share_system = false;
161 static bool arg_register = true;
162 static bool arg_keep_unit = false;
163 static char **arg_network_interfaces = NULL;
164 static char **arg_network_macvlan = NULL;
165 static bool arg_network_veth = false;
166 static const char *arg_network_bridge = NULL;
167 static unsigned long arg_personality = 0xffffffffLU;
168 static const char *arg_image = NULL;
169 static Volatile arg_volatile = VOLATILE_NO;
170
171 static void help(void) {
172         printf("%s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
173                "Spawn a minimal namespace container for debugging, testing and building.\n\n"
174                "  -h --help                 Show this help\n"
175                "     --version              Print version string\n"
176                "  -q --quiet                Do not show status information\n"
177                "  -D --directory=PATH       Root directory for the container\n"
178                "  -i --image=PATH           File system device or image for the container\n"
179                "  -b --boot                 Boot up full system (i.e. invoke init)\n"
180                "  -u --user=USER            Run the command under specified user or uid\n"
181                "  -M --machine=NAME         Set the machine name for the container\n"
182                "     --uuid=UUID            Set a specific machine UUID for the container\n"
183                "  -S --slice=SLICE          Place the container in the specified slice\n"
184                "     --private-network      Disable network in container\n"
185                "     --network-interface=INTERFACE\n"
186                "                            Assign an existing network interface to the\n"
187                "                            container\n"
188                "     --network-macvlan=INTERFACE\n"
189                "                            Create a macvlan network interface based on an\n"
190                "                            existing network interface to the container\n"
191                "     --network-veth         Add a virtual ethernet connection between host\n"
192                "                            and container\n"
193                "     --network-bridge=INTERFACE\n"
194                "                            Add a virtual ethernet connection between host\n"
195                "                            and container and add it to an existing bridge on\n"
196                "                            the host\n"
197                "  -Z --selinux-context=SECLABEL\n"
198                "                            Set the SELinux security context to be used by\n"
199                "                            processes in the container\n"
200                "  -L --selinux-apifs-context=SECLABEL\n"
201                "                            Set the SELinux security context to be used by\n"
202                "                            API/tmpfs file systems in the container\n"
203                "     --capability=CAP       In addition to the default, retain specified\n"
204                "                            capability\n"
205                "     --drop-capability=CAP  Drop the specified capability from the default set\n"
206                "     --link-journal=MODE    Link up guest journal, one of no, auto, guest, host,\n"
207                "                            try-guest, try-host\n"
208                "  -j                        Equivalent to --link-journal=try-guest\n"
209                "     --read-only            Mount the root directory read-only\n"
210                "     --bind=PATH[:PATH]     Bind mount a file or directory from the host into\n"
211                "                            the container\n"
212                "     --bind-ro=PATH[:PATH]  Similar, but creates a read-only bind mount\n"
213                "     --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
214                "     --setenv=NAME=VALUE    Pass an environment variable to PID 1\n"
215                "     --share-system         Share system namespaces with host\n"
216                "     --register=BOOLEAN     Register container as machine\n"
217                "     --keep-unit            Do not register a scope for the machine, reuse\n"
218                "                            the service unit nspawn is running in\n"
219                "     --volatile[=MODE]      Run the system in volatile mode\n",
220                program_invocation_short_name);
221 }
222
223 static int parse_argv(int argc, char *argv[]) {
224
225         enum {
226                 ARG_VERSION = 0x100,
227                 ARG_PRIVATE_NETWORK,
228                 ARG_UUID,
229                 ARG_READ_ONLY,
230                 ARG_CAPABILITY,
231                 ARG_DROP_CAPABILITY,
232                 ARG_LINK_JOURNAL,
233                 ARG_BIND,
234                 ARG_BIND_RO,
235                 ARG_TMPFS,
236                 ARG_SETENV,
237                 ARG_SHARE_SYSTEM,
238                 ARG_REGISTER,
239                 ARG_KEEP_UNIT,
240                 ARG_NETWORK_INTERFACE,
241                 ARG_NETWORK_MACVLAN,
242                 ARG_NETWORK_VETH,
243                 ARG_NETWORK_BRIDGE,
244                 ARG_PERSONALITY,
245                 ARG_VOLATILE,
246         };
247
248         static const struct option options[] = {
249                 { "help",                  no_argument,       NULL, 'h'                   },
250                 { "version",               no_argument,       NULL, ARG_VERSION           },
251                 { "directory",             required_argument, NULL, 'D'                   },
252                 { "user",                  required_argument, NULL, 'u'                   },
253                 { "private-network",       no_argument,       NULL, ARG_PRIVATE_NETWORK   },
254                 { "boot",                  no_argument,       NULL, 'b'                   },
255                 { "uuid",                  required_argument, NULL, ARG_UUID              },
256                 { "read-only",             no_argument,       NULL, ARG_READ_ONLY         },
257                 { "capability",            required_argument, NULL, ARG_CAPABILITY        },
258                 { "drop-capability",       required_argument, NULL, ARG_DROP_CAPABILITY   },
259                 { "link-journal",          required_argument, NULL, ARG_LINK_JOURNAL      },
260                 { "bind",                  required_argument, NULL, ARG_BIND              },
261                 { "bind-ro",               required_argument, NULL, ARG_BIND_RO           },
262                 { "tmpfs",                 required_argument, NULL, ARG_TMPFS             },
263                 { "machine",               required_argument, NULL, 'M'                   },
264                 { "slice",                 required_argument, NULL, 'S'                   },
265                 { "setenv",                required_argument, NULL, ARG_SETENV            },
266                 { "selinux-context",       required_argument, NULL, 'Z'                   },
267                 { "selinux-apifs-context", required_argument, NULL, 'L'                   },
268                 { "quiet",                 no_argument,       NULL, 'q'                   },
269                 { "share-system",          no_argument,       NULL, ARG_SHARE_SYSTEM      },
270                 { "register",              required_argument, NULL, ARG_REGISTER          },
271                 { "keep-unit",             no_argument,       NULL, ARG_KEEP_UNIT         },
272                 { "network-interface",     required_argument, NULL, ARG_NETWORK_INTERFACE },
273                 { "network-macvlan",       required_argument, NULL, ARG_NETWORK_MACVLAN   },
274                 { "network-veth",          no_argument,       NULL, ARG_NETWORK_VETH      },
275                 { "network-bridge",        required_argument, NULL, ARG_NETWORK_BRIDGE    },
276                 { "personality",           required_argument, NULL, ARG_PERSONALITY       },
277                 { "image",                 required_argument, NULL, 'i'                   },
278                 { "volatile",              optional_argument, NULL, ARG_VOLATILE          },
279                 {}
280         };
281
282         int c, r;
283         uint64_t plus = 0, minus = 0;
284
285         assert(argc >= 0);
286         assert(argv);
287
288         while ((c = getopt_long(argc, argv, "+hD:u:bL:M:jS:Z:qi:", options, NULL)) >= 0)
289
290                 switch (c) {
291
292                 case 'h':
293                         help();
294                         return 0;
295
296                 case ARG_VERSION:
297                         puts(PACKAGE_STRING);
298                         puts(SYSTEMD_FEATURES);
299                         return 0;
300
301                 case 'D':
302                         free(arg_directory);
303                         arg_directory = canonicalize_file_name(optarg);
304                         if (!arg_directory) {
305                                 log_error_errno(errno, "Invalid root directory: %m");
306                                 return -ENOMEM;
307                         }
308
309                         break;
310
311                 case 'i':
312                         arg_image = optarg;
313                         break;
314
315                 case 'u':
316                         free(arg_user);
317                         arg_user = strdup(optarg);
318                         if (!arg_user)
319                                 return log_oom();
320
321                         break;
322
323                 case ARG_NETWORK_BRIDGE:
324                         arg_network_bridge = optarg;
325
326                         /* fall through */
327
328                 case ARG_NETWORK_VETH:
329                         arg_network_veth = true;
330                         arg_private_network = true;
331                         break;
332
333                 case ARG_NETWORK_INTERFACE:
334                         if (strv_extend(&arg_network_interfaces, optarg) < 0)
335                                 return log_oom();
336
337                         arg_private_network = true;
338                         break;
339
340                 case ARG_NETWORK_MACVLAN:
341                         if (strv_extend(&arg_network_macvlan, optarg) < 0)
342                                 return log_oom();
343
344                         /* fall through */
345
346                 case ARG_PRIVATE_NETWORK:
347                         arg_private_network = true;
348                         break;
349
350                 case 'b':
351                         arg_boot = true;
352                         break;
353
354                 case ARG_UUID:
355                         r = sd_id128_from_string(optarg, &arg_uuid);
356                         if (r < 0) {
357                                 log_error("Invalid UUID: %s", optarg);
358                                 return r;
359                         }
360                         break;
361
362                 case 'S':
363                         arg_slice = optarg;
364                         break;
365
366                 case 'M':
367                         if (isempty(optarg)) {
368                                 free(arg_machine);
369                                 arg_machine = NULL;
370                         } else {
371
372                                 if (!hostname_is_valid(optarg)) {
373                                         log_error("Invalid machine name: %s", optarg);
374                                         return -EINVAL;
375                                 }
376
377                                 free(arg_machine);
378                                 arg_machine = strdup(optarg);
379                                 if (!arg_machine)
380                                         return log_oom();
381
382                                 break;
383                         }
384
385                 case 'Z':
386                         arg_selinux_context = optarg;
387                         break;
388
389                 case 'L':
390                         arg_selinux_apifs_context = optarg;
391                         break;
392
393                 case ARG_READ_ONLY:
394                         arg_read_only = true;
395                         break;
396
397                 case ARG_CAPABILITY:
398                 case ARG_DROP_CAPABILITY: {
399                         const char *state, *word;
400                         size_t length;
401
402                         FOREACH_WORD_SEPARATOR(word, length, optarg, ",", state) {
403                                 _cleanup_free_ char *t;
404                                 cap_value_t cap;
405
406                                 t = strndup(word, length);
407                                 if (!t)
408                                         return log_oom();
409
410                                 if (streq(t, "all")) {
411                                         if (c == ARG_CAPABILITY)
412                                                 plus = (uint64_t) -1;
413                                         else
414                                                 minus = (uint64_t) -1;
415                                 } else {
416                                         if (cap_from_name(t, &cap) < 0) {
417                                                 log_error("Failed to parse capability %s.", t);
418                                                 return -EINVAL;
419                                         }
420
421                                         if (c == ARG_CAPABILITY)
422                                                 plus |= 1ULL << (uint64_t) cap;
423                                         else
424                                                 minus |= 1ULL << (uint64_t) cap;
425                                 }
426                         }
427
428                         break;
429                 }
430
431                 case 'j':
432                         arg_link_journal = LINK_GUEST;
433                         arg_link_journal_try = true;
434                         break;
435
436                 case ARG_LINK_JOURNAL:
437                         if (streq(optarg, "auto"))
438                                 arg_link_journal = LINK_AUTO;
439                         else if (streq(optarg, "no"))
440                                 arg_link_journal = LINK_NO;
441                         else if (streq(optarg, "guest"))
442                                 arg_link_journal = LINK_GUEST;
443                         else if (streq(optarg, "host"))
444                                 arg_link_journal = LINK_HOST;
445                         else if (streq(optarg, "try-guest")) {
446                                 arg_link_journal = LINK_GUEST;
447                                 arg_link_journal_try = true;
448                         } else if (streq(optarg, "try-host")) {
449                                 arg_link_journal = LINK_HOST;
450                                 arg_link_journal_try = true;
451                         } else {
452                                 log_error("Failed to parse link journal mode %s", optarg);
453                                 return -EINVAL;
454                         }
455
456                         break;
457
458                 case ARG_BIND:
459                 case ARG_BIND_RO: {
460                         _cleanup_free_ char *a = NULL, *b = NULL;
461                         char *e;
462                         char ***x;
463
464                         x = c == ARG_BIND ? &arg_bind : &arg_bind_ro;
465
466                         e = strchr(optarg, ':');
467                         if (e) {
468                                 a = strndup(optarg, e - optarg);
469                                 b = strdup(e + 1);
470                         } else {
471                                 a = strdup(optarg);
472                                 b = strdup(optarg);
473                         }
474
475                         if (!a || !b)
476                                 return log_oom();
477
478                         if (!path_is_absolute(a) || !path_is_absolute(b)) {
479                                 log_error("Invalid bind mount specification: %s", optarg);
480                                 return -EINVAL;
481                         }
482
483                         r = strv_extend(x, a);
484                         if (r < 0)
485                                 return log_oom();
486
487                         r = strv_extend(x, b);
488                         if (r < 0)
489                                 return log_oom();
490
491                         break;
492                 }
493
494                 case ARG_TMPFS: {
495                         _cleanup_free_ char *a = NULL, *b = NULL;
496                         char *e;
497
498                         e = strchr(optarg, ':');
499                         if (e) {
500                                 a = strndup(optarg, e - optarg);
501                                 b = strdup(e + 1);
502                         } else {
503                                 a = strdup(optarg);
504                                 b = strdup("mode=0755");
505                         }
506
507                         if (!a || !b)
508                                 return log_oom();
509
510                         if (!path_is_absolute(a)) {
511                                 log_error("Invalid tmpfs specification: %s", optarg);
512                                 return -EINVAL;
513                         }
514
515                         r = strv_push(&arg_tmpfs, a);
516                         if (r < 0)
517                                 return log_oom();
518
519                         a = NULL;
520
521                         r = strv_push(&arg_tmpfs, b);
522                         if (r < 0)
523                                 return log_oom();
524
525                         b = NULL;
526
527                         break;
528                 }
529
530                 case ARG_SETENV: {
531                         char **n;
532
533                         if (!env_assignment_is_valid(optarg)) {
534                                 log_error("Environment variable assignment '%s' is not valid.", optarg);
535                                 return -EINVAL;
536                         }
537
538                         n = strv_env_set(arg_setenv, optarg);
539                         if (!n)
540                                 return log_oom();
541
542                         strv_free(arg_setenv);
543                         arg_setenv = n;
544                         break;
545                 }
546
547                 case 'q':
548                         arg_quiet = true;
549                         break;
550
551                 case ARG_SHARE_SYSTEM:
552                         arg_share_system = true;
553                         break;
554
555                 case ARG_REGISTER:
556                         r = parse_boolean(optarg);
557                         if (r < 0) {
558                                 log_error("Failed to parse --register= argument: %s", optarg);
559                                 return r;
560                         }
561
562                         arg_register = r;
563                         break;
564
565                 case ARG_KEEP_UNIT:
566                         arg_keep_unit = true;
567                         break;
568
569                 case ARG_PERSONALITY:
570
571                         arg_personality = personality_from_string(optarg);
572                         if (arg_personality == 0xffffffffLU) {
573                                 log_error("Unknown or unsupported personality '%s'.", optarg);
574                                 return -EINVAL;
575                         }
576
577                         break;
578
579                 case ARG_VOLATILE:
580
581                         if (!optarg)
582                                 arg_volatile = VOLATILE_YES;
583                         else {
584                                 r = parse_boolean(optarg);
585                                 if (r < 0) {
586                                         if (streq(optarg, "state"))
587                                                 arg_volatile = VOLATILE_STATE;
588                                         else {
589                                                 log_error("Failed to parse --volatile= argument: %s", optarg);
590                                                 return r;
591                                         }
592                                 } else
593                                         arg_volatile = r ? VOLATILE_YES : VOLATILE_NO;
594                         }
595
596                         break;
597
598                 case '?':
599                         return -EINVAL;
600
601                 default:
602                         assert_not_reached("Unhandled option");
603                 }
604
605         if (arg_share_system)
606                 arg_register = false;
607
608         if (arg_boot && arg_share_system) {
609                 log_error("--boot and --share-system may not be combined.");
610                 return -EINVAL;
611         }
612
613         if (arg_keep_unit && cg_pid_get_owner_uid(0, NULL) >= 0) {
614                 log_error("--keep-unit may not be used when invoked from a user session.");
615                 return -EINVAL;
616         }
617
618         if (arg_directory && arg_image) {
619                 log_error("--directory= and --image= may not be combined.");
620                 return -EINVAL;
621         }
622
623         if (arg_volatile != VOLATILE_NO && arg_read_only) {
624                 log_error("Cannot combine --read-only with --volatile. Note that --volatile already implies a read-only base hierarchy.");
625                 return -EINVAL;
626         }
627
628         arg_retain = (arg_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus;
629
630         return 1;
631 }
632
633 static int mount_all(const char *dest) {
634
635         typedef struct MountPoint {
636                 const char *what;
637                 const char *where;
638                 const char *type;
639                 const char *options;
640                 unsigned long flags;
641                 bool fatal;
642         } MountPoint;
643
644         static const MountPoint mount_table[] = {
645                 { "proc",      "/proc",     "proc",  NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV,           true  },
646                 { "/proc/sys", "/proc/sys", NULL,    NULL,        MS_BIND,                                true  },   /* Bind mount first */
647                 { NULL,        "/proc/sys", NULL,    NULL,        MS_BIND|MS_RDONLY|MS_REMOUNT,           true  },   /* Then, make it r/o */
648                 { "sysfs",     "/sys",      "sysfs", NULL,        MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, true  },
649                 { "tmpfs",     "/dev",      "tmpfs", "mode=755",  MS_NOSUID|MS_STRICTATIME,               true  },
650                 { "devpts",    "/dev/pts",  "devpts","newinstance,ptmxmode=0666,mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC, true },
651                 { "tmpfs",     "/dev/shm",  "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,      true  },
652                 { "tmpfs",     "/run",      "tmpfs", "mode=755",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,      true  },
653 #ifdef HAVE_SELINUX
654                 { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND,                              false },  /* Bind mount first */
655                 { NULL,              "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT,         false },  /* Then, make it r/o */
656 #endif
657         };
658
659         unsigned k;
660         int r = 0;
661
662         for (k = 0; k < ELEMENTSOF(mount_table); k++) {
663                 _cleanup_free_ char *where = NULL;
664 #ifdef HAVE_SELINUX
665                 _cleanup_free_ char *options = NULL;
666 #endif
667                 const char *o;
668                 int t;
669
670                 where = strjoin(dest, "/", mount_table[k].where, NULL);
671                 if (!where)
672                         return log_oom();
673
674                 t = path_is_mount_point(where, true);
675                 if (t < 0) {
676                         log_error_errno(t, "Failed to detect whether %s is a mount point: %m", where);
677
678                         if (r == 0)
679                                 r = t;
680
681                         continue;
682                 }
683
684                 /* Skip this entry if it is not a remount. */
685                 if (mount_table[k].what && t > 0)
686                         continue;
687
688                 t = mkdir_p(where, 0755);
689                 if (t < 0) {
690                         if (mount_table[k].fatal) {
691                                log_error_errno(t, "Failed to create directory %s: %m", where);
692
693                                 if (r == 0)
694                                         r = t;
695                         } else
696                                log_warning_errno(t, "Failed to create directory %s: %m", where);
697
698                         continue;
699                 }
700
701 #ifdef HAVE_SELINUX
702                 if (arg_selinux_apifs_context &&
703                     (streq_ptr(mount_table[k].what, "tmpfs") || streq_ptr(mount_table[k].what, "devpts"))) {
704                         options = strjoin(mount_table[k].options, ",context=\"", arg_selinux_apifs_context, "\"", NULL);
705                         if (!options)
706                                 return log_oom();
707
708                         o = options;
709                 } else
710 #endif
711                         o = mount_table[k].options;
712
713
714                 if (mount(mount_table[k].what,
715                           where,
716                           mount_table[k].type,
717                           mount_table[k].flags,
718                           o) < 0) {
719
720                         if (mount_table[k].fatal) {
721                                 log_error_errno(errno, "mount(%s) failed: %m", where);
722
723                                 if (r == 0)
724                                         r = -errno;
725                         } else
726                                 log_warning_errno(errno, "mount(%s) failed: %m", where);
727                 }
728         }
729
730         return r;
731 }
732
733 static int mount_binds(const char *dest, char **l, bool ro) {
734         char **x, **y;
735
736         STRV_FOREACH_PAIR(x, y, l) {
737                 _cleanup_free_ char *where = NULL;
738                 struct stat source_st, dest_st;
739                 int r;
740
741                 if (stat(*x, &source_st) < 0)
742                         return log_error_errno(errno, "Failed to stat %s: %m", *x);
743
744                 where = strappend(dest, *y);
745                 if (!where)
746                         return log_oom();
747
748                 r = stat(where, &dest_st);
749                 if (r == 0) {
750                         if ((source_st.st_mode & S_IFMT) != (dest_st.st_mode & S_IFMT)) {
751                                 log_error("The file types of %s and %s do not match. Refusing bind mount", *x, where);
752                                 return -EINVAL;
753                         }
754                 } else if (errno == ENOENT) {
755                         r = mkdir_parents_label(where, 0755);
756                         if (r < 0)
757                                 return log_error_errno(r, "Failed to bind mount %s: %m", *x);
758                 } else {
759                         log_error_errno(errno, "Failed to bind mount %s: %m", *x);
760                         return -errno;
761                 }
762
763                 /* Create the mount point, but be conservative -- refuse to create block
764                  * and char devices. */
765                 if (S_ISDIR(source_st.st_mode)) {
766                         r = mkdir_label(where, 0755);
767                         if (r < 0 && errno != EEXIST)
768                                 return log_error_errno(r, "Failed to create mount point %s: %m", where);
769                 } else if (S_ISFIFO(source_st.st_mode)) {
770                         r = mkfifo(where, 0644);
771                         if (r < 0 && errno != EEXIST)
772                                 return log_error_errno(errno, "Failed to create mount point %s: %m", where);
773                 } else if (S_ISSOCK(source_st.st_mode)) {
774                         r = mknod(where, 0644 | S_IFSOCK, 0);
775                         if (r < 0 && errno != EEXIST)
776                                 return log_error_errno(errno, "Failed to create mount point %s: %m", where);
777                 } else if (S_ISREG(source_st.st_mode)) {
778                         r = touch(where);
779                         if (r < 0)
780                                 return log_error_errno(r, "Failed to create mount point %s: %m", where);
781                 } else {
782                         log_error("Refusing to create mountpoint for file: %s", *x);
783                         return -ENOTSUP;
784                 }
785
786                 if (mount(*x, where, "bind", MS_BIND, NULL) < 0)
787                         return log_error_errno(errno, "mount(%s) failed: %m", where);
788
789                 if (ro) {
790                         r = bind_remount_recursive(where, true);
791                         if (r < 0)
792                                 return log_error_errno(r, "Read-Only bind mount failed: %m");
793                 }
794         }
795
796         return 0;
797 }
798
799 static int mount_tmpfs(const char *dest) {
800         char **i, **o;
801
802         STRV_FOREACH_PAIR(i, o, arg_tmpfs) {
803                 _cleanup_free_ char *where = NULL;
804                 int r;
805
806                 where = strappend(dest, *i);
807                 if (!where)
808                         return log_oom();
809
810                 r = mkdir_label(where, 0755);
811                 if (r < 0 && r != -EEXIST)
812                         return log_error_errno(r, "Creating mount point for tmpfs %s failed: %m", where);
813
814                 if (mount("tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, *o) < 0)
815                         return log_error_errno(errno, "tmpfs mount to %s failed: %m", where);
816         }
817
818         return 0;
819 }
820
821 static int setup_timezone(const char *dest) {
822         _cleanup_free_ char *where = NULL, *p = NULL, *q = NULL, *check = NULL, *what = NULL;
823         char *z, *y;
824         int r;
825
826         assert(dest);
827
828         /* Fix the timezone, if possible */
829         r = readlink_malloc("/etc/localtime", &p);
830         if (r < 0) {
831                 log_warning("/etc/localtime is not a symlink, not updating container timezone.");
832                 return 0;
833         }
834
835         z = path_startswith(p, "../usr/share/zoneinfo/");
836         if (!z)
837                 z = path_startswith(p, "/usr/share/zoneinfo/");
838         if (!z) {
839                 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
840                 return 0;
841         }
842
843         where = strappend(dest, "/etc/localtime");
844         if (!where)
845                 return log_oom();
846
847         r = readlink_malloc(where, &q);
848         if (r >= 0) {
849                 y = path_startswith(q, "../usr/share/zoneinfo/");
850                 if (!y)
851                         y = path_startswith(q, "/usr/share/zoneinfo/");
852
853                 /* Already pointing to the right place? Then do nothing .. */
854                 if (y && streq(y, z))
855                         return 0;
856         }
857
858         check = strjoin(dest, "/usr/share/zoneinfo/", z, NULL);
859         if (!check)
860                 return log_oom();
861
862         if (access(check, F_OK) < 0) {
863                 log_warning("Timezone %s does not exist in container, not updating container timezone.", z);
864                 return 0;
865         }
866
867         what = strappend("../usr/share/zoneinfo/", z);
868         if (!what)
869                 return log_oom();
870
871         r = mkdir_parents(where, 0755);
872         if (r < 0) {
873                 log_error_errno(r, "Failed to create directory for timezone info %s in container: %m", where);
874
875                 return 0;
876         }
877
878         r = unlink(where);
879         if (r < 0 && errno != ENOENT) {
880                 log_error_errno(errno, "Failed to remove existing timezone info %s in container: %m", where);
881
882                 return 0;
883         }
884
885         if (symlink(what, where) < 0) {
886                 log_error_errno(errno, "Failed to correct timezone of container: %m");
887                 return 0;
888         }
889
890         return 0;
891 }
892
893 static int setup_resolv_conf(const char *dest) {
894         _cleanup_free_ char *where = NULL;
895         int r;
896
897         assert(dest);
898
899         if (arg_private_network)
900                 return 0;
901
902         /* Fix resolv.conf, if possible */
903         where = strappend(dest, "/etc/resolv.conf");
904         if (!where)
905                 return log_oom();
906
907         /* We don't really care for the results of this really. If it
908          * fails, it fails, but meh... */
909         r = mkdir_parents(where, 0755);
910         if (r < 0) {
911                 log_warning_errno(r, "Failed to create parent directory for resolv.conf %s: %m", where);
912
913                 return 0;
914         }
915
916         r = copy_file("/etc/resolv.conf", where, O_TRUNC|O_NOFOLLOW, 0644);
917         if (r < 0) {
918                 log_warning_errno(r, "Failed to copy /etc/resolv.conf to %s: %m", where);
919
920                 return 0;
921         }
922
923         return 0;
924 }
925
926 static int setup_volatile_state(const char *directory) {
927         const char *p;
928         int r;
929
930         assert(directory);
931
932         if (arg_volatile != VOLATILE_STATE)
933                 return 0;
934
935         /* --volatile=state means we simply overmount /var
936            with a tmpfs, and the rest read-only. */
937
938         r = bind_remount_recursive(directory, true);
939         if (r < 0)
940                 return log_error_errno(r, "Failed to remount %s read-only: %m", directory);
941
942         p = strappenda(directory, "/var");
943         r = mkdir(p, 0755);
944         if (r < 0 && errno != EEXIST)
945                 return log_error_errno(errno, "Failed to create %s: %m", directory);
946
947         if (mount("tmpfs", p, "tmpfs", MS_STRICTATIME, "mode=755") < 0)
948                 return log_error_errno(errno, "Failed to mount tmpfs to /var: %m");
949
950         return 0;
951 }
952
953 static int setup_volatile(const char *directory) {
954         bool tmpfs_mounted = false, bind_mounted = false;
955         char template[] = "/tmp/nspawn-volatile-XXXXXX";
956         const char *f, *t;
957         int r;
958
959         assert(directory);
960
961         if (arg_volatile != VOLATILE_YES)
962                 return 0;
963
964         /* --volatile=yes means we mount a tmpfs to the root dir, and
965            the original /usr to use inside it, and that read-only. */
966
967         if (!mkdtemp(template))
968                 return log_error_errno(errno, "Failed to create temporary directory: %m");
969
970         if (mount("tmpfs", template, "tmpfs", MS_STRICTATIME, "mode=755") < 0) {
971                 log_error_errno(errno, "Failed to mount tmpfs for root directory: %m");
972                 r = -errno;
973                 goto fail;
974         }
975
976         tmpfs_mounted = true;
977
978         f = strappenda(directory, "/usr");
979         t = strappenda(template, "/usr");
980
981         r = mkdir(t, 0755);
982         if (r < 0 && errno != EEXIST) {
983                 log_error_errno(errno, "Failed to create %s: %m", t);
984                 r = -errno;
985                 goto fail;
986         }
987
988         if (mount(f, t, "bind", MS_BIND|MS_REC, NULL) < 0) {
989                 log_error_errno(errno, "Failed to create /usr bind mount: %m");
990                 r = -errno;
991                 goto fail;
992         }
993
994         bind_mounted = true;
995
996         r = bind_remount_recursive(t, true);
997         if (r < 0) {
998                 log_error_errno(r, "Failed to remount %s read-only: %m", t);
999                 goto fail;
1000         }
1001
1002         if (mount(template, directory, NULL, MS_MOVE, NULL) < 0) {
1003                 log_error_errno(errno, "Failed to move root mount: %m");
1004                 r = -errno;
1005                 goto fail;
1006         }
1007
1008         rmdir(template);
1009
1010         return 0;
1011
1012 fail:
1013         if (bind_mounted)
1014                 umount(t);
1015         if (tmpfs_mounted)
1016                 umount(template);
1017         rmdir(template);
1018         return r;
1019 }
1020
1021 static char* id128_format_as_uuid(sd_id128_t id, char s[37]) {
1022
1023         snprintf(s, 37,
1024                  "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
1025                  SD_ID128_FORMAT_VAL(id));
1026
1027         return s;
1028 }
1029
1030 static int setup_boot_id(const char *dest) {
1031         _cleanup_free_ char *from = NULL, *to = NULL;
1032         sd_id128_t rnd = {};
1033         char as_uuid[37];
1034         int r;
1035
1036         assert(dest);
1037
1038         if (arg_share_system)
1039                 return 0;
1040
1041         /* Generate a new randomized boot ID, so that each boot-up of
1042          * the container gets a new one */
1043
1044         from = strappend(dest, "/dev/proc-sys-kernel-random-boot-id");
1045         to = strappend(dest, "/proc/sys/kernel/random/boot_id");
1046         if (!from || !to)
1047                 return log_oom();
1048
1049         r = sd_id128_randomize(&rnd);
1050         if (r < 0)
1051                 return log_error_errno(r, "Failed to generate random boot id: %m");
1052
1053         id128_format_as_uuid(rnd, as_uuid);
1054
1055         r = write_string_file(from, as_uuid);
1056         if (r < 0)
1057                 return log_error_errno(r, "Failed to write boot id: %m");
1058
1059         if (mount(from, to, "bind", MS_BIND, NULL) < 0) {
1060                 log_error_errno(errno, "Failed to bind mount boot id: %m");
1061                 r = -errno;
1062         } else if (mount(from, to, "bind", MS_BIND|MS_REMOUNT|MS_RDONLY, NULL))
1063                 log_warning_errno(errno, "Failed to make boot id read-only: %m");
1064
1065         unlink(from);
1066         return r;
1067 }
1068
1069 static int copy_devnodes(const char *dest) {
1070
1071         static const char devnodes[] =
1072                 "null\0"
1073                 "zero\0"
1074                 "full\0"
1075                 "random\0"
1076                 "urandom\0"
1077                 "tty\0"
1078                 "net/tun\0";
1079
1080         const char *d;
1081         int r = 0;
1082         _cleanup_umask_ mode_t u;
1083
1084         assert(dest);
1085
1086         u = umask(0000);
1087
1088         NULSTR_FOREACH(d, devnodes) {
1089                 _cleanup_free_ char *from = NULL, *to = NULL;
1090                 struct stat st;
1091
1092                 from = strappend("/dev/", d);
1093                 to = strjoin(dest, "/dev/", d, NULL);
1094                 if (!from || !to)
1095                         return log_oom();
1096
1097                 if (stat(from, &st) < 0) {
1098
1099                         if (errno != ENOENT)
1100                                 return log_error_errno(errno, "Failed to stat %s: %m", from);
1101
1102                 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode)) {
1103
1104                         log_error("%s is not a char or block device, cannot copy", from);
1105                         return -EIO;
1106
1107                 } else {
1108                         r = mkdir_parents(to, 0775);
1109                         if (r < 0) {
1110                                 log_error_errno(r, "Failed to create parent directory of %s: %m", to);
1111                                 return -r;
1112                         }
1113
1114                         if (mknod(to, st.st_mode, st.st_rdev) < 0)
1115                                 return log_error_errno(errno, "mknod(%s) failed: %m", dest);
1116                 }
1117         }
1118
1119         return r;
1120 }
1121
1122 static int setup_ptmx(const char *dest) {
1123         _cleanup_free_ char *p = NULL;
1124
1125         p = strappend(dest, "/dev/ptmx");
1126         if (!p)
1127                 return log_oom();
1128
1129         if (symlink("pts/ptmx", p) < 0)
1130                 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
1131
1132         return 0;
1133 }
1134
1135 static int setup_dev_console(const char *dest, const char *console) {
1136         _cleanup_umask_ mode_t u;
1137         const char *to;
1138         struct stat st;
1139         int r;
1140
1141         assert(dest);
1142         assert(console);
1143
1144         u = umask(0000);
1145
1146         if (stat("/dev/null", &st) < 0)
1147                 return log_error_errno(errno, "Failed to stat /dev/null: %m");
1148
1149         r = chmod_and_chown(console, 0600, 0, 0);
1150         if (r < 0)
1151                 return log_error_errno(r, "Failed to correct access mode for TTY: %m");
1152
1153         /* We need to bind mount the right tty to /dev/console since
1154          * ptys can only exist on pts file systems. To have something
1155          * to bind mount things on we create a device node first, and
1156          * use /dev/null for that since we the cgroups device policy
1157          * allows us to create that freely, while we cannot create
1158          * /dev/console. (Note that the major minor doesn't actually
1159          * matter here, since we mount it over anyway). */
1160
1161         to = strappenda(dest, "/dev/console");
1162         if (mknod(to, (st.st_mode & ~07777) | 0600, st.st_rdev) < 0)
1163                 return log_error_errno(errno, "mknod() for /dev/console failed: %m");
1164
1165         if (mount(console, to, "bind", MS_BIND, NULL) < 0)
1166                 return log_error_errno(errno, "Bind mount for /dev/console failed: %m");
1167
1168         return 0;
1169 }
1170
1171 static int setup_kmsg(const char *dest, int kmsg_socket) {
1172         _cleanup_free_ char *from = NULL, *to = NULL;
1173         int r, fd, k;
1174         _cleanup_umask_ mode_t u;
1175         union {
1176                 struct cmsghdr cmsghdr;
1177                 uint8_t buf[CMSG_SPACE(sizeof(int))];
1178         } control = {};
1179         struct msghdr mh = {
1180                 .msg_control = &control,
1181                 .msg_controllen = sizeof(control),
1182         };
1183         struct cmsghdr *cmsg;
1184
1185         assert(dest);
1186         assert(kmsg_socket >= 0);
1187
1188         u = umask(0000);
1189
1190         /* We create the kmsg FIFO as /dev/kmsg, but immediately
1191          * delete it after bind mounting it to /proc/kmsg. While FIFOs
1192          * on the reading side behave very similar to /proc/kmsg,
1193          * their writing side behaves differently from /dev/kmsg in
1194          * that writing blocks when nothing is reading. In order to
1195          * avoid any problems with containers deadlocking due to this
1196          * we simply make /dev/kmsg unavailable to the container. */
1197         if (asprintf(&from, "%s/dev/kmsg", dest) < 0 ||
1198             asprintf(&to, "%s/proc/kmsg", dest) < 0)
1199                 return log_oom();
1200
1201         if (mkfifo(from, 0600) < 0)
1202                 return log_error_errno(errno, "mkfifo() for /dev/kmsg failed: %m");
1203
1204         r = chmod_and_chown(from, 0600, 0, 0);
1205         if (r < 0)
1206                 return log_error_errno(r, "Failed to correct access mode for /dev/kmsg: %m");
1207
1208         if (mount(from, to, "bind", MS_BIND, NULL) < 0)
1209                 return log_error_errno(errno, "Bind mount for /proc/kmsg failed: %m");
1210
1211         fd = open(from, O_RDWR|O_NDELAY|O_CLOEXEC);
1212         if (fd < 0)
1213                 return log_error_errno(errno, "Failed to open fifo: %m");
1214
1215         cmsg = CMSG_FIRSTHDR(&mh);
1216         cmsg->cmsg_level = SOL_SOCKET;
1217         cmsg->cmsg_type = SCM_RIGHTS;
1218         cmsg->cmsg_len = CMSG_LEN(sizeof(int));
1219         memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
1220
1221         mh.msg_controllen = cmsg->cmsg_len;
1222
1223         /* Store away the fd in the socket, so that it stays open as
1224          * long as we run the child */
1225         k = sendmsg(kmsg_socket, &mh, MSG_DONTWAIT|MSG_NOSIGNAL);
1226         safe_close(fd);
1227
1228         if (k < 0)
1229                 return log_error_errno(errno, "Failed to send FIFO fd: %m");
1230
1231         /* And now make the FIFO unavailable as /dev/kmsg... */
1232         unlink(from);
1233         return 0;
1234 }
1235
1236 static int setup_hostname(void) {
1237
1238         if (arg_share_system)
1239                 return 0;
1240
1241         if (sethostname_idempotent(arg_machine) < 0)
1242                 return -errno;
1243
1244         return 0;
1245 }
1246
1247 static int setup_journal(const char *directory) {
1248         sd_id128_t machine_id, this_id;
1249         _cleanup_free_ char *p = NULL, *b = NULL, *q = NULL, *d = NULL;
1250         char *id;
1251         int r;
1252
1253         p = strappend(directory, "/etc/machine-id");
1254         if (!p)
1255                 return log_oom();
1256
1257         r = read_one_line_file(p, &b);
1258         if (r == -ENOENT && arg_link_journal == LINK_AUTO)
1259                 return 0;
1260         else if (r < 0)
1261                 return log_error_errno(r, "Failed to read machine ID from %s: %m", p);
1262
1263         id = strstrip(b);
1264         if (isempty(id) && arg_link_journal == LINK_AUTO)
1265                 return 0;
1266
1267         /* Verify validity */
1268         r = sd_id128_from_string(id, &machine_id);
1269         if (r < 0)
1270                 return log_error_errno(r, "Failed to parse machine ID from %s: %m", p);
1271
1272         r = sd_id128_get_machine(&this_id);
1273         if (r < 0)
1274                 return log_error_errno(r, "Failed to retrieve machine ID: %m");
1275
1276         if (sd_id128_equal(machine_id, this_id)) {
1277                 log_full(arg_link_journal == LINK_AUTO ? LOG_WARNING : LOG_ERR,
1278                          "Host and machine ids are equal (%s): refusing to link journals", id);
1279                 if (arg_link_journal == LINK_AUTO)
1280                         return 0;
1281                 return
1282                         -EEXIST;
1283         }
1284
1285         if (arg_link_journal == LINK_NO)
1286                 return 0;
1287
1288         free(p);
1289         p = strappend("/var/log/journal/", id);
1290         q = strjoin(directory, "/var/log/journal/", id, NULL);
1291         if (!p || !q)
1292                 return log_oom();
1293
1294         if (path_is_mount_point(p, false) > 0) {
1295                 if (arg_link_journal != LINK_AUTO) {
1296                         log_error("%s: already a mount point, refusing to use for journal", p);
1297                         return -EEXIST;
1298                 }
1299
1300                 return 0;
1301         }
1302
1303         if (path_is_mount_point(q, false) > 0) {
1304                 if (arg_link_journal != LINK_AUTO) {
1305                         log_error("%s: already a mount point, refusing to use for journal", q);
1306                         return -EEXIST;
1307                 }
1308
1309                 return 0;
1310         }
1311
1312         r = readlink_and_make_absolute(p, &d);
1313         if (r >= 0) {
1314                 if ((arg_link_journal == LINK_GUEST ||
1315                      arg_link_journal == LINK_AUTO) &&
1316                     path_equal(d, q)) {
1317
1318                         r = mkdir_p(q, 0755);
1319                         if (r < 0)
1320                                 log_warning_errno(errno, "Failed to create directory %s: %m", q);
1321                         return 0;
1322                 }
1323
1324                 if (unlink(p) < 0)
1325                         return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
1326         } else if (r == -EINVAL) {
1327
1328                 if (arg_link_journal == LINK_GUEST &&
1329                     rmdir(p) < 0) {
1330
1331                         if (errno == ENOTDIR) {
1332                                 log_error("%s already exists and is neither a symlink nor a directory", p);
1333                                 return r;
1334                         } else {
1335                                 log_error_errno(errno, "Failed to remove %s: %m", p);
1336                                 return -errno;
1337                         }
1338                 }
1339         } else if (r != -ENOENT) {
1340                 log_error_errno(errno, "readlink(%s) failed: %m", p);
1341                 return r;
1342         }
1343
1344         if (arg_link_journal == LINK_GUEST) {
1345
1346                 if (symlink(q, p) < 0) {
1347                         if (arg_link_journal_try) {
1348                                 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
1349                                 return 0;
1350                         } else {
1351                                 log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
1352                                 return -errno;
1353                         }
1354                 }
1355
1356                 r = mkdir_p(q, 0755);
1357                 if (r < 0)
1358                         log_warning_errno(errno, "Failed to create directory %s: %m", q);
1359                 return 0;
1360         }
1361
1362         if (arg_link_journal == LINK_HOST) {
1363                 /* don't create parents here -- if the host doesn't have
1364                  * permanent journal set up, don't force it here */
1365                 r = mkdir(p, 0755);
1366                 if (r < 0) {
1367                         if (arg_link_journal_try) {
1368                                 log_debug_errno(errno, "Failed to create %s, skipping journal setup: %m", p);
1369                                 return 0;
1370                         } else {
1371                                 log_error_errno(errno, "Failed to create %s: %m", p);
1372                                 return r;
1373                         }
1374                 }
1375
1376         } else if (access(p, F_OK) < 0)
1377                 return 0;
1378
1379         if (dir_is_empty(q) == 0)
1380                 log_warning("%s is not empty, proceeding anyway.", q);
1381
1382         r = mkdir_p(q, 0755);
1383         if (r < 0) {
1384                 log_error_errno(errno, "Failed to create %s: %m", q);
1385                 return r;
1386         }
1387
1388         if (mount(p, q, "bind", MS_BIND, NULL) < 0)
1389                 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
1390
1391         return 0;
1392 }
1393
1394 static int drop_capabilities(void) {
1395         return capability_bounding_set_drop(~arg_retain, false);
1396 }
1397
1398 static int register_machine(pid_t pid, int local_ifindex) {
1399         _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1400         _cleanup_bus_close_unref_ sd_bus *bus = NULL;
1401         int r;
1402
1403         if (!arg_register)
1404                 return 0;
1405
1406         r = sd_bus_default_system(&bus);
1407         if (r < 0)
1408                 return log_error_errno(r, "Failed to open system bus: %m");
1409
1410         if (arg_keep_unit) {
1411                 r = sd_bus_call_method(
1412                                 bus,
1413                                 "org.freedesktop.machine1",
1414                                 "/org/freedesktop/machine1",
1415                                 "org.freedesktop.machine1.Manager",
1416                                 "RegisterMachineWithNetwork",
1417                                 &error,
1418                                 NULL,
1419                                 "sayssusai",
1420                                 arg_machine,
1421                                 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
1422                                 "nspawn",
1423                                 "container",
1424                                 (uint32_t) pid,
1425                                 strempty(arg_directory),
1426                                 local_ifindex > 0 ? 1 : 0, local_ifindex);
1427         } else {
1428                 _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
1429
1430                 r = sd_bus_message_new_method_call(
1431                                 bus,
1432                                 &m,
1433                                 "org.freedesktop.machine1",
1434                                 "/org/freedesktop/machine1",
1435                                 "org.freedesktop.machine1.Manager",
1436                                 "CreateMachineWithNetwork");
1437                 if (r < 0)
1438                         return log_error_errno(r, "Failed to create message: %m");
1439
1440                 r = sd_bus_message_append(
1441                                 m,
1442                                 "sayssusai",
1443                                 arg_machine,
1444                                 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
1445                                 "nspawn",
1446                                 "container",
1447                                 (uint32_t) pid,
1448                                 strempty(arg_directory),
1449                                 local_ifindex > 0 ? 1 : 0, local_ifindex);
1450                 if (r < 0)
1451                         return log_error_errno(r, "Failed to append message arguments: %m");
1452
1453                 r = sd_bus_message_open_container(m, 'a', "(sv)");
1454                 if (r < 0)
1455                         return log_error_errno(r, "Failed to open container: %m");
1456
1457                 if (!isempty(arg_slice)) {
1458                         r = sd_bus_message_append(m, "(sv)", "Slice", "s", arg_slice);
1459                         if (r < 0)
1460                                 return log_error_errno(r, "Failed to append slice: %m");
1461                 }
1462
1463                 r = sd_bus_message_append(m, "(sv)", "DevicePolicy", "s", "strict");
1464                 if (r < 0)
1465                         return log_error_errno(r, "Failed to add device policy: %m");
1466
1467                 r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 9,
1468                                           /* Allow the container to
1469                                            * access and create the API
1470                                            * device nodes, so that
1471                                            * PrivateDevices= in the
1472                                            * container can work
1473                                            * fine */
1474                                           "/dev/null", "rwm",
1475                                           "/dev/zero", "rwm",
1476                                           "/dev/full", "rwm",
1477                                           "/dev/random", "rwm",
1478                                           "/dev/urandom", "rwm",
1479                                           "/dev/tty", "rwm",
1480                                           "/dev/net/tun", "rwm",
1481                                           /* Allow the container
1482                                            * access to ptys. However,
1483                                            * do not permit the
1484                                            * container to ever create
1485                                            * these device nodes. */
1486                                           "/dev/pts/ptmx", "rw",
1487                                           "char-pts", "rw");
1488                 if (r < 0)
1489                         return log_error_errno(r, "Failed to add device whitelist: %m");
1490
1491                 r = sd_bus_message_close_container(m);
1492                 if (r < 0)
1493                         return log_error_errno(r, "Failed to close container: %m");
1494
1495                 r = sd_bus_call(bus, m, 0, &error, NULL);
1496         }
1497
1498         if (r < 0) {
1499                 log_error("Failed to register machine: %s", bus_error_message(&error, r));
1500                 return r;
1501         }
1502
1503         return 0;
1504 }
1505
1506 static int terminate_machine(pid_t pid) {
1507         _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1508         _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
1509         _cleanup_bus_close_unref_ sd_bus *bus = NULL;
1510         const char *path;
1511         int r;
1512
1513         if (!arg_register)
1514                 return 0;
1515
1516         r = sd_bus_default_system(&bus);
1517         if (r < 0)
1518                 return log_error_errno(r, "Failed to open system bus: %m");
1519
1520         r = sd_bus_call_method(
1521                         bus,
1522                         "org.freedesktop.machine1",
1523                         "/org/freedesktop/machine1",
1524                         "org.freedesktop.machine1.Manager",
1525                         "GetMachineByPID",
1526                         &error,
1527                         &reply,
1528                         "u",
1529                         (uint32_t) pid);
1530         if (r < 0) {
1531                 /* Note that the machine might already have been
1532                  * cleaned up automatically, hence don't consider it a
1533                  * failure if we cannot get the machine object. */
1534                 log_debug("Failed to get machine: %s", bus_error_message(&error, r));
1535                 return 0;
1536         }
1537
1538         r = sd_bus_message_read(reply, "o", &path);
1539         if (r < 0)
1540                 return bus_log_parse_error(r);
1541
1542         r = sd_bus_call_method(
1543                         bus,
1544                         "org.freedesktop.machine1",
1545                         path,
1546                         "org.freedesktop.machine1.Machine",
1547                         "Terminate",
1548                         &error,
1549                         NULL,
1550                         NULL);
1551         if (r < 0) {
1552                 log_debug("Failed to terminate machine: %s", bus_error_message(&error, r));
1553                 return 0;
1554         }
1555
1556         return 0;
1557 }
1558
1559 static int reset_audit_loginuid(void) {
1560         _cleanup_free_ char *p = NULL;
1561         int r;
1562
1563         if (arg_share_system)
1564                 return 0;
1565
1566         r = read_one_line_file("/proc/self/loginuid", &p);
1567         if (r == -ENOENT)
1568                 return 0;
1569         if (r < 0)
1570                 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
1571
1572         /* Already reset? */
1573         if (streq(p, "4294967295"))
1574                 return 0;
1575
1576         r = write_string_file("/proc/self/loginuid", "4294967295");
1577         if (r < 0) {
1578                 log_error("Failed to reset audit login UID. This probably means that your kernel is too\n"
1579                           "old and you have audit enabled. Note that the auditing subsystem is known to\n"
1580                           "be incompatible with containers on old kernels. Please make sure to upgrade\n"
1581                           "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
1582                           "using systemd-nspawn. Sleeping for 5s... (%s)\n", strerror(-r));
1583
1584                 sleep(5);
1585         }
1586
1587         return 0;
1588 }
1589
1590 #define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
1591 #define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
1592 #define MACVLAN_HASH_KEY SD_ID128_MAKE(00,13,6d,bc,66,83,44,81,bb,0c,f9,51,1f,24,a6,6f)
1593
1594 static int generate_mac(struct ether_addr *mac, sd_id128_t hash_key, unsigned idx) {
1595         int r;
1596
1597         uint8_t result[8];
1598         size_t l, sz;
1599         uint8_t *v;
1600
1601         l = strlen(arg_machine);
1602         sz = sizeof(sd_id128_t) + l;
1603         if (idx > 0)
1604                 sz += sizeof(idx);
1605         v = alloca(sz);
1606
1607         /* fetch some persistent data unique to the host */
1608         r = sd_id128_get_machine((sd_id128_t*) v);
1609         if (r < 0)
1610                 return r;
1611
1612         /* combine with some data unique (on this host) to this
1613          * container instance */
1614         memcpy(mempcpy(v + sizeof(sd_id128_t), arg_machine, l), &idx, sizeof(idx));
1615
1616         /* Let's hash the host machine ID plus the container name. We
1617          * use a fixed, but originally randomly created hash key here. */
1618         siphash24(result, v, sz, hash_key.bytes);
1619
1620         assert_cc(ETH_ALEN <= sizeof(result));
1621         memcpy(mac->ether_addr_octet, result, ETH_ALEN);
1622
1623         /* see eth_random_addr in the kernel */
1624         mac->ether_addr_octet[0] &= 0xfe;        /* clear multicast bit */
1625         mac->ether_addr_octet[0] |= 0x02;        /* set local assignment bit (IEEE802) */
1626
1627         return 0;
1628 }
1629
1630 static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ], int *ifi) {
1631         _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1632         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1633         struct ether_addr mac_host, mac_container;
1634         int r, i;
1635
1636         if (!arg_private_network)
1637                 return 0;
1638
1639         if (!arg_network_veth)
1640                 return 0;
1641
1642         /* Use two different interface name prefixes depending whether
1643          * we are in bridge mode or not. */
1644         snprintf(iface_name, IFNAMSIZ - 1, "%s-%s",
1645                  arg_network_bridge ? "vb" : "ve", arg_machine);
1646
1647         r = generate_mac(&mac_container, CONTAINER_HASH_KEY, 0);
1648         if (r < 0)
1649                 return log_error_errno(r, "Failed to generate predictable MAC address for container side: %m");
1650
1651         r = generate_mac(&mac_host, HOST_HASH_KEY, 0);
1652         if (r < 0)
1653                 return log_error_errno(r, "Failed to generate predictable MAC address for host side: %m");
1654
1655         r = sd_rtnl_open(&rtnl, 0);
1656         if (r < 0)
1657                 return log_error_errno(r, "Failed to connect to netlink: %m");
1658
1659         r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
1660         if (r < 0)
1661                 return log_error_errno(r, "Failed to allocate netlink message: %m");
1662
1663         r = sd_rtnl_message_append_string(m, IFLA_IFNAME, iface_name);
1664         if (r < 0)
1665                 return log_error_errno(r, "Failed to add netlink interface name: %m");
1666
1667         r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac_host);
1668         if (r < 0)
1669                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
1670
1671         r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
1672         if (r < 0)
1673                 return log_error_errno(r, "Failed to open netlink container: %m");
1674
1675         r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "veth");
1676         if (r < 0)
1677                 return log_error_errno(r, "Failed to open netlink container: %m");
1678
1679         r = sd_rtnl_message_open_container(m, VETH_INFO_PEER);
1680         if (r < 0)
1681                 return log_error_errno(r, "Failed to open netlink container: %m");
1682
1683         r = sd_rtnl_message_append_string(m, IFLA_IFNAME, "host0");
1684         if (r < 0)
1685                 return log_error_errno(r, "Failed to add netlink interface name: %m");
1686
1687         r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac_container);
1688         if (r < 0)
1689                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
1690
1691         r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1692         if (r < 0)
1693                 return log_error_errno(r, "Failed to add netlink namespace field: %m");
1694
1695         r = sd_rtnl_message_close_container(m);
1696         if (r < 0)
1697                 return log_error_errno(r, "Failed to close netlink container: %m");
1698
1699         r = sd_rtnl_message_close_container(m);
1700         if (r < 0)
1701                 return log_error_errno(r, "Failed to close netlink container: %m");
1702
1703         r = sd_rtnl_message_close_container(m);
1704         if (r < 0)
1705                 return log_error_errno(r, "Failed to close netlink container: %m");
1706
1707         r = sd_rtnl_call(rtnl, m, 0, NULL);
1708         if (r < 0)
1709                 return log_error_errno(r, "Failed to add new veth interfaces: %m");
1710
1711         i = (int) if_nametoindex(iface_name);
1712         if (i <= 0)
1713                 return log_error_errno(errno, "Failed to resolve interface %s: %m", iface_name);
1714
1715         *ifi = i;
1716
1717         return 0;
1718 }
1719
1720 static int setup_bridge(const char veth_name[], int *ifi) {
1721         _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1722         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1723         int r, bridge;
1724
1725         if (!arg_private_network)
1726                 return 0;
1727
1728         if (!arg_network_veth)
1729                 return 0;
1730
1731         if (!arg_network_bridge)
1732                 return 0;
1733
1734         bridge = (int) if_nametoindex(arg_network_bridge);
1735         if (bridge <= 0)
1736                 return log_error_errno(errno, "Failed to resolve interface %s: %m", arg_network_bridge);
1737
1738         *ifi = bridge;
1739
1740         r = sd_rtnl_open(&rtnl, 0);
1741         if (r < 0)
1742                 return log_error_errno(r, "Failed to connect to netlink: %m");
1743
1744         r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
1745         if (r < 0)
1746                 return log_error_errno(r, "Failed to allocate netlink message: %m");
1747
1748         r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
1749         if (r < 0)
1750                 return log_error_errno(r, "Failed to set IFF_UP flag: %m");
1751
1752         r = sd_rtnl_message_append_string(m, IFLA_IFNAME, veth_name);
1753         if (r < 0)
1754                 return log_error_errno(r, "Failed to add netlink interface name field: %m");
1755
1756         r = sd_rtnl_message_append_u32(m, IFLA_MASTER, bridge);
1757         if (r < 0)
1758                 return log_error_errno(r, "Failed to add netlink master field: %m");
1759
1760         r = sd_rtnl_call(rtnl, m, 0, NULL);
1761         if (r < 0)
1762                 return log_error_errno(r, "Failed to add veth interface to bridge: %m");
1763
1764         return 0;
1765 }
1766
1767 static int parse_interface(struct udev *udev, const char *name) {
1768         _cleanup_udev_device_unref_ struct udev_device *d = NULL;
1769         char ifi_str[2 + DECIMAL_STR_MAX(int)];
1770         int ifi;
1771
1772         ifi = (int) if_nametoindex(name);
1773         if (ifi <= 0)
1774                 return log_error_errno(errno, "Failed to resolve interface %s: %m", name);
1775
1776         sprintf(ifi_str, "n%i", ifi);
1777         d = udev_device_new_from_device_id(udev, ifi_str);
1778         if (!d)
1779                 return log_error_errno(errno, "Failed to get udev device for interface %s: %m", name);
1780
1781         if (udev_device_get_is_initialized(d) <= 0) {
1782                 log_error("Network interface %s is not initialized yet.", name);
1783                 return -EBUSY;
1784         }
1785
1786         return ifi;
1787 }
1788
1789 static int move_network_interfaces(pid_t pid) {
1790         _cleanup_udev_unref_ struct udev *udev = NULL;
1791         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1792         char **i;
1793         int r;
1794
1795         if (!arg_private_network)
1796                 return 0;
1797
1798         if (strv_isempty(arg_network_interfaces))
1799                 return 0;
1800
1801         r = sd_rtnl_open(&rtnl, 0);
1802         if (r < 0)
1803                 return log_error_errno(r, "Failed to connect to netlink: %m");
1804
1805         udev = udev_new();
1806         if (!udev) {
1807                 log_error("Failed to connect to udev.");
1808                 return -ENOMEM;
1809         }
1810
1811         STRV_FOREACH(i, arg_network_interfaces) {
1812                 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1813                 int ifi;
1814
1815                 ifi = parse_interface(udev, *i);
1816                 if (ifi < 0)
1817                         return ifi;
1818
1819                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
1820                 if (r < 0)
1821                         return log_error_errno(r, "Failed to allocate netlink message: %m");
1822
1823                 r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1824                 if (r < 0)
1825                         return log_error_errno(r, "Failed to append namespace PID to netlink message: %m");
1826
1827                 r = sd_rtnl_call(rtnl, m, 0, NULL);
1828                 if (r < 0)
1829                         return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
1830         }
1831
1832         return 0;
1833 }
1834
1835 static int setup_macvlan(pid_t pid) {
1836         _cleanup_udev_unref_ struct udev *udev = NULL;
1837         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1838         unsigned idx = 0;
1839         char **i;
1840         int r;
1841
1842         if (!arg_private_network)
1843                 return 0;
1844
1845         if (strv_isempty(arg_network_macvlan))
1846                 return 0;
1847
1848         r = sd_rtnl_open(&rtnl, 0);
1849         if (r < 0)
1850                 return log_error_errno(r, "Failed to connect to netlink: %m");
1851
1852         udev = udev_new();
1853         if (!udev) {
1854                 log_error("Failed to connect to udev.");
1855                 return -ENOMEM;
1856         }
1857
1858         STRV_FOREACH(i, arg_network_macvlan) {
1859                 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1860                 _cleanup_free_ char *n = NULL;
1861                 struct ether_addr mac;
1862                 int ifi;
1863
1864                 ifi = parse_interface(udev, *i);
1865                 if (ifi < 0)
1866                         return ifi;
1867
1868                 r = generate_mac(&mac, MACVLAN_HASH_KEY, idx++);
1869                 if (r < 0)
1870                         return log_error_errno(r, "Failed to create MACVLAN MAC address: %m");
1871
1872                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
1873                 if (r < 0)
1874                         return log_error_errno(r, "Failed to allocate netlink message: %m");
1875
1876                 r = sd_rtnl_message_append_u32(m, IFLA_LINK, ifi);
1877                 if (r < 0)
1878                         return log_error_errno(r, "Failed to add netlink interface index: %m");
1879
1880                 n = strappend("mv-", *i);
1881                 if (!n)
1882                         return log_oom();
1883
1884                 strshorten(n, IFNAMSIZ-1);
1885
1886                 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, n);
1887                 if (r < 0)
1888                         return log_error_errno(r, "Failed to add netlink interface name: %m");
1889
1890                 r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac);
1891                 if (r < 0)
1892                         return log_error_errno(r, "Failed to add netlink MAC address: %m");
1893
1894                 r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1895                 if (r < 0)
1896                         return log_error_errno(r, "Failed to add netlink namespace field: %m");
1897
1898                 r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
1899                 if (r < 0)
1900                         return log_error_errno(r, "Failed to open netlink container: %m");
1901
1902                 r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
1903                 if (r < 0)
1904                         return log_error_errno(r, "Failed to open netlink container: %m");
1905
1906                 r = sd_rtnl_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
1907                 if (r < 0)
1908                         return log_error_errno(r, "Failed to append macvlan mode: %m");
1909
1910                 r = sd_rtnl_message_close_container(m);
1911                 if (r < 0)
1912                         return log_error_errno(r, "Failed to close netlink container: %m");
1913
1914                 r = sd_rtnl_message_close_container(m);
1915                 if (r < 0)
1916                         return log_error_errno(r, "Failed to close netlink container: %m");
1917
1918                 r = sd_rtnl_call(rtnl, m, 0, NULL);
1919                 if (r < 0)
1920                         return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
1921         }
1922
1923         return 0;
1924 }
1925
1926 static int setup_seccomp(void) {
1927
1928 #ifdef HAVE_SECCOMP
1929         static const int blacklist[] = {
1930                 SCMP_SYS(kexec_load),
1931                 SCMP_SYS(open_by_handle_at),
1932                 SCMP_SYS(init_module),
1933                 SCMP_SYS(finit_module),
1934                 SCMP_SYS(delete_module),
1935                 SCMP_SYS(iopl),
1936                 SCMP_SYS(ioperm),
1937                 SCMP_SYS(swapon),
1938                 SCMP_SYS(swapoff),
1939         };
1940
1941         scmp_filter_ctx seccomp;
1942         unsigned i;
1943         int r;
1944
1945         seccomp = seccomp_init(SCMP_ACT_ALLOW);
1946         if (!seccomp)
1947                 return log_oom();
1948
1949         r = seccomp_add_secondary_archs(seccomp);
1950         if (r < 0) {
1951                 log_error_errno(r, "Failed to add secondary archs to seccomp filter: %m");
1952                 goto finish;
1953         }
1954
1955         for (i = 0; i < ELEMENTSOF(blacklist); i++) {
1956                 r = seccomp_rule_add(seccomp, SCMP_ACT_ERRNO(EPERM), blacklist[i], 0);
1957                 if (r == -EFAULT)
1958                         continue; /* unknown syscall */
1959                 if (r < 0) {
1960                         log_error_errno(r, "Failed to block syscall: %m");
1961                         goto finish;
1962                 }
1963         }
1964
1965         /*
1966            Audit is broken in containers, much of the userspace audit
1967            hookup will fail if running inside a container. We don't
1968            care and just turn off creation of audit sockets.
1969
1970            This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail
1971            with EAFNOSUPPORT which audit userspace uses as indication
1972            that audit is disabled in the kernel.
1973          */
1974
1975         r = seccomp_rule_add(
1976                         seccomp,
1977                         SCMP_ACT_ERRNO(EAFNOSUPPORT),
1978                         SCMP_SYS(socket),
1979                         2,
1980                         SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
1981                         SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
1982         if (r < 0) {
1983                 log_error_errno(r, "Failed to add audit seccomp rule: %m");
1984                 goto finish;
1985         }
1986
1987         r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1988         if (r < 0) {
1989                 log_error_errno(r, "Failed to unset NO_NEW_PRIVS: %m");
1990                 goto finish;
1991         }
1992
1993         r = seccomp_load(seccomp);
1994         if (r < 0)
1995                 log_error_errno(r, "Failed to install seccomp audit filter: %m");
1996
1997 finish:
1998         seccomp_release(seccomp);
1999         return r;
2000 #else
2001         return 0;
2002 #endif
2003
2004 }
2005
2006 static int setup_image(char **device_path, int *loop_nr) {
2007         struct loop_info64 info = {
2008                 .lo_flags = LO_FLAGS_AUTOCLEAR|LO_FLAGS_PARTSCAN
2009         };
2010         _cleanup_close_ int fd = -1, control = -1, loop = -1;
2011         _cleanup_free_ char* loopdev = NULL;
2012         struct stat st;
2013         int r, nr;
2014
2015         assert(device_path);
2016         assert(loop_nr);
2017
2018         fd = open(arg_image, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
2019         if (fd < 0)
2020                 return log_error_errno(errno, "Failed to open %s: %m", arg_image);
2021
2022         if (fstat(fd, &st) < 0)
2023                 return log_error_errno(errno, "Failed to stat %s: %m", arg_image);
2024
2025         if (S_ISBLK(st.st_mode)) {
2026                 char *p;
2027
2028                 p = strdup(arg_image);
2029                 if (!p)
2030                         return log_oom();
2031
2032                 *device_path = p;
2033
2034                 *loop_nr = -1;
2035
2036                 r = fd;
2037                 fd = -1;
2038
2039                 return r;
2040         }
2041
2042         if (!S_ISREG(st.st_mode)) {
2043                 log_error_errno(errno, "%s is not a regular file or block device: %m", arg_image);
2044                 return -EINVAL;
2045         }
2046
2047         control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2048         if (control < 0)
2049                 return log_error_errno(errno, "Failed to open /dev/loop-control: %m");
2050
2051         nr = ioctl(control, LOOP_CTL_GET_FREE);
2052         if (nr < 0)
2053                 return log_error_errno(errno, "Failed to allocate loop device: %m");
2054
2055         if (asprintf(&loopdev, "/dev/loop%i", nr) < 0)
2056                 return log_oom();
2057
2058         loop = open(loopdev, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
2059         if (loop < 0)
2060                 return log_error_errno(errno, "Failed to open loop device %s: %m", loopdev);
2061
2062         if (ioctl(loop, LOOP_SET_FD, fd) < 0)
2063                 return log_error_errno(errno, "Failed to set loopback file descriptor on %s: %m", loopdev);
2064
2065         if (arg_read_only)
2066                 info.lo_flags |= LO_FLAGS_READ_ONLY;
2067
2068         if (ioctl(loop, LOOP_SET_STATUS64, &info) < 0)
2069                 return log_error_errno(errno, "Failed to set loopback settings on %s: %m", loopdev);
2070
2071         *device_path = loopdev;
2072         loopdev = NULL;
2073
2074         *loop_nr = nr;
2075
2076         r = loop;
2077         loop = -1;
2078
2079         return r;
2080 }
2081
2082 static int dissect_image(
2083                 int fd,
2084                 char **root_device, bool *root_device_rw,
2085                 char **home_device, bool *home_device_rw,
2086                 char **srv_device, bool *srv_device_rw,
2087                 bool *secondary) {
2088
2089 #ifdef HAVE_BLKID
2090         int home_nr = -1, srv_nr = -1;
2091 #ifdef GPT_ROOT_NATIVE
2092         int root_nr = -1;
2093 #endif
2094 #ifdef GPT_ROOT_SECONDARY
2095         int secondary_root_nr = -1;
2096 #endif
2097
2098         _cleanup_free_ char *home = NULL, *root = NULL, *secondary_root = NULL, *srv = NULL;
2099         _cleanup_udev_enumerate_unref_ struct udev_enumerate *e = NULL;
2100         _cleanup_udev_device_unref_ struct udev_device *d = NULL;
2101         _cleanup_blkid_free_probe_ blkid_probe b = NULL;
2102         _cleanup_udev_unref_ struct udev *udev = NULL;
2103         struct udev_list_entry *first, *item;
2104         bool home_rw = true, root_rw = true, secondary_root_rw = true, srv_rw = true;
2105         const char *pttype = NULL;
2106         blkid_partlist pl;
2107         struct stat st;
2108         int r;
2109
2110         assert(fd >= 0);
2111         assert(root_device);
2112         assert(home_device);
2113         assert(srv_device);
2114         assert(secondary);
2115
2116         b = blkid_new_probe();
2117         if (!b)
2118                 return log_oom();
2119
2120         errno = 0;
2121         r = blkid_probe_set_device(b, fd, 0, 0);
2122         if (r != 0) {
2123                 if (errno == 0)
2124                         return log_oom();
2125
2126                 log_error_errno(errno, "Failed to set device on blkid probe: %m");
2127                 return -errno;
2128         }
2129
2130         blkid_probe_enable_partitions(b, 1);
2131         blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
2132
2133         errno = 0;
2134         r = blkid_do_safeprobe(b);
2135         if (r == -2 || r == 1) {
2136                 log_error("Failed to identify any partition table on %s.\n"
2137                           "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2138                 return -EINVAL;
2139         } else if (r != 0) {
2140                 if (errno == 0)
2141                         errno = EIO;
2142                 log_error_errno(errno, "Failed to probe: %m");
2143                 return -errno;
2144         }
2145
2146         blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
2147         if (!streq_ptr(pttype, "gpt")) {
2148                 log_error("Image %s does not carry a GUID Partition Table.\n"
2149                           "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2150                 return -EINVAL;
2151         }
2152
2153         errno = 0;
2154         pl = blkid_probe_get_partitions(b);
2155         if (!pl) {
2156                 if (errno == 0)
2157                         return log_oom();
2158
2159                 log_error("Failed to list partitions of %s", arg_image);
2160                 return -errno;
2161         }
2162
2163         udev = udev_new();
2164         if (!udev)
2165                 return log_oom();
2166
2167         if (fstat(fd, &st) < 0)
2168                 return log_error_errno(errno, "Failed to stat block device: %m");
2169
2170         d = udev_device_new_from_devnum(udev, 'b', st.st_rdev);
2171         if (!d)
2172                 return log_oom();
2173
2174         e = udev_enumerate_new(udev);
2175         if (!e)
2176                 return log_oom();
2177
2178         r = udev_enumerate_add_match_parent(e, d);
2179         if (r < 0)
2180                 return log_oom();
2181
2182         r = udev_enumerate_scan_devices(e);
2183         if (r < 0)
2184                 return log_error_errno(r, "Failed to scan for partition devices of %s: %m", arg_image);
2185
2186         first = udev_enumerate_get_list_entry(e);
2187         udev_list_entry_foreach(item, first) {
2188                 _cleanup_udev_device_unref_ struct udev_device *q;
2189                 const char *stype, *node;
2190                 unsigned long long flags;
2191                 sd_id128_t type_id;
2192                 blkid_partition pp;
2193                 dev_t qn;
2194                 int nr;
2195
2196                 errno = 0;
2197                 q = udev_device_new_from_syspath(udev, udev_list_entry_get_name(item));
2198                 if (!q) {
2199                         if (!errno)
2200                                 errno = ENOMEM;
2201
2202                         log_error_errno(errno, "Failed to get partition device of %s: %m", arg_image);
2203                         return -errno;
2204                 }
2205
2206                 qn = udev_device_get_devnum(q);
2207                 if (major(qn) == 0)
2208                         continue;
2209
2210                 if (st.st_rdev == qn)
2211                         continue;
2212
2213                 node = udev_device_get_devnode(q);
2214                 if (!node)
2215                         continue;
2216
2217                 pp = blkid_partlist_devno_to_partition(pl, qn);
2218                 if (!pp)
2219                         continue;
2220
2221                 flags = blkid_partition_get_flags(pp);
2222                 if (flags & GPT_FLAG_NO_AUTO)
2223                         continue;
2224
2225                 nr = blkid_partition_get_partno(pp);
2226                 if (nr < 0)
2227                         continue;
2228
2229                 stype = blkid_partition_get_type_string(pp);
2230                 if (!stype)
2231                         continue;
2232
2233                 if (sd_id128_from_string(stype, &type_id) < 0)
2234                         continue;
2235
2236                 if (sd_id128_equal(type_id, GPT_HOME)) {
2237
2238                         if (home && nr >= home_nr)
2239                                 continue;
2240
2241                         home_nr = nr;
2242                         home_rw = !(flags & GPT_FLAG_READ_ONLY);
2243
2244                         free(home);
2245                         home = strdup(node);
2246                         if (!home)
2247                                 return log_oom();
2248                 } else if (sd_id128_equal(type_id, GPT_SRV)) {
2249
2250                         if (srv && nr >= srv_nr)
2251                                 continue;
2252
2253                         srv_nr = nr;
2254                         srv_rw = !(flags & GPT_FLAG_READ_ONLY);
2255
2256                         free(srv);
2257                         srv = strdup(node);
2258                         if (!srv)
2259                                 return log_oom();
2260                 }
2261 #ifdef GPT_ROOT_NATIVE
2262                 else if (sd_id128_equal(type_id, GPT_ROOT_NATIVE)) {
2263
2264                         if (root && nr >= root_nr)
2265                                 continue;
2266
2267                         root_nr = nr;
2268                         root_rw = !(flags & GPT_FLAG_READ_ONLY);
2269
2270                         free(root);
2271                         root = strdup(node);
2272                         if (!root)
2273                                 return log_oom();
2274                 }
2275 #endif
2276 #ifdef GPT_ROOT_SECONDARY
2277                 else if (sd_id128_equal(type_id, GPT_ROOT_SECONDARY)) {
2278
2279                         if (secondary_root && nr >= secondary_root_nr)
2280                                 continue;
2281
2282                         secondary_root_nr = nr;
2283                         secondary_root_rw = !(flags & GPT_FLAG_READ_ONLY);
2284
2285
2286                         free(secondary_root);
2287                         secondary_root = strdup(node);
2288                         if (!secondary_root)
2289                                 return log_oom();
2290                 }
2291 #endif
2292         }
2293
2294         if (!root && !secondary_root) {
2295                 log_error("Failed to identify root partition in disk image %s.\n"
2296                           "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2297                 return -EINVAL;
2298         }
2299
2300         if (root) {
2301                 *root_device = root;
2302                 root = NULL;
2303
2304                 *root_device_rw = root_rw;
2305                 *secondary = false;
2306         } else if (secondary_root) {
2307                 *root_device = secondary_root;
2308                 secondary_root = NULL;
2309
2310                 *root_device_rw = secondary_root_rw;
2311                 *secondary = true;
2312         }
2313
2314         if (home) {
2315                 *home_device = home;
2316                 home = NULL;
2317
2318                 *home_device_rw = home_rw;
2319         }
2320
2321         if (srv) {
2322                 *srv_device = srv;
2323                 srv = NULL;
2324
2325                 *srv_device_rw = srv_rw;
2326         }
2327
2328         return 0;
2329 #else
2330         log_error("--image= is not supported, compiled without blkid support.");
2331         return -ENOTSUP;
2332 #endif
2333 }
2334
2335 static int mount_device(const char *what, const char *where, const char *directory, bool rw) {
2336 #ifdef HAVE_BLKID
2337         _cleanup_blkid_free_probe_ blkid_probe b = NULL;
2338         const char *fstype, *p;
2339         int r;
2340
2341         assert(what);
2342         assert(where);
2343
2344         if (arg_read_only)
2345                 rw = false;
2346
2347         if (directory)
2348                 p = strappenda(where, directory);
2349         else
2350                 p = where;
2351
2352         errno = 0;
2353         b = blkid_new_probe_from_filename(what);
2354         if (!b) {
2355                 if (errno == 0)
2356                         return log_oom();
2357                 log_error_errno(errno, "Failed to allocate prober for %s: %m", what);
2358                 return -errno;
2359         }
2360
2361         blkid_probe_enable_superblocks(b, 1);
2362         blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
2363
2364         errno = 0;
2365         r = blkid_do_safeprobe(b);
2366         if (r == -1 || r == 1) {
2367                 log_error("Cannot determine file system type of %s", what);
2368                 return -EINVAL;
2369         } else if (r != 0) {
2370                 if (errno == 0)
2371                         errno = EIO;
2372                 log_error_errno(errno, "Failed to probe %s: %m", what);
2373                 return -errno;
2374         }
2375
2376         errno = 0;
2377         if (blkid_probe_lookup_value(b, "TYPE", &fstype, NULL) < 0) {
2378                 if (errno == 0)
2379                         errno = EINVAL;
2380                 log_error("Failed to determine file system type of %s", what);
2381                 return -errno;
2382         }
2383
2384         if (streq(fstype, "crypto_LUKS")) {
2385                 log_error("nspawn currently does not support LUKS disk images.");
2386                 return -ENOTSUP;
2387         }
2388
2389         if (mount(what, p, fstype, MS_NODEV|(rw ? 0 : MS_RDONLY), NULL) < 0)
2390                 return log_error_errno(errno, "Failed to mount %s: %m", what);
2391
2392         return 0;
2393 #else
2394         log_error("--image= is not supported, compiled without blkid support.");
2395         return -ENOTSUP;
2396 #endif
2397 }
2398
2399 static int mount_devices(
2400                 const char *where,
2401                 const char *root_device, bool root_device_rw,
2402                 const char *home_device, bool home_device_rw,
2403                 const char *srv_device, bool srv_device_rw) {
2404         int r;
2405
2406         assert(where);
2407
2408         if (root_device) {
2409                 r = mount_device(root_device, arg_directory, NULL, root_device_rw);
2410                 if (r < 0)
2411                         return log_error_errno(r, "Failed to mount root directory: %m");
2412         }
2413
2414         if (home_device) {
2415                 r = mount_device(home_device, arg_directory, "/home", home_device_rw);
2416                 if (r < 0)
2417                         return log_error_errno(r, "Failed to mount home directory: %m");
2418         }
2419
2420         if (srv_device) {
2421                 r = mount_device(srv_device, arg_directory, "/srv", srv_device_rw);
2422                 if (r < 0)
2423                         return log_error_errno(r, "Failed to mount server data directory: %m");
2424         }
2425
2426         return 0;
2427 }
2428
2429 static void loop_remove(int nr, int *image_fd) {
2430         _cleanup_close_ int control = -1;
2431         int r;
2432
2433         if (nr < 0)
2434                 return;
2435
2436         if (image_fd && *image_fd >= 0) {
2437                 r = ioctl(*image_fd, LOOP_CLR_FD);
2438                 if (r < 0)
2439                         log_warning_errno(errno, "Failed to close loop image: %m");
2440                 *image_fd = safe_close(*image_fd);
2441         }
2442
2443         control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2444         if (control < 0) {
2445                 log_warning_errno(errno, "Failed to open /dev/loop-control: %m");
2446                 return;
2447         }
2448
2449         r = ioctl(control, LOOP_CTL_REMOVE, nr);
2450         if (r < 0)
2451                 log_warning_errno(errno, "Failed to remove loop %d: %m", nr);
2452 }
2453
2454 static int spawn_getent(const char *database, const char *key, pid_t *rpid) {
2455         int pipe_fds[2];
2456         pid_t pid;
2457
2458         assert(database);
2459         assert(key);
2460         assert(rpid);
2461
2462         if (pipe2(pipe_fds, O_CLOEXEC) < 0)
2463                 return log_error_errno(errno, "Failed to allocate pipe: %m");
2464
2465         pid = fork();
2466         if (pid < 0)
2467                 return log_error_errno(errno, "Failed to fork getent child: %m");
2468         else if (pid == 0) {
2469                 int nullfd;
2470                 char *empty_env = NULL;
2471
2472                 if (dup3(pipe_fds[1], STDOUT_FILENO, 0) < 0)
2473                         _exit(EXIT_FAILURE);
2474
2475                 if (pipe_fds[0] > 2)
2476                         safe_close(pipe_fds[0]);
2477                 if (pipe_fds[1] > 2)
2478                         safe_close(pipe_fds[1]);
2479
2480                 nullfd = open("/dev/null", O_RDWR);
2481                 if (nullfd < 0)
2482                         _exit(EXIT_FAILURE);
2483
2484                 if (dup3(nullfd, STDIN_FILENO, 0) < 0)
2485                         _exit(EXIT_FAILURE);
2486
2487                 if (dup3(nullfd, STDERR_FILENO, 0) < 0)
2488                         _exit(EXIT_FAILURE);
2489
2490                 if (nullfd > 2)
2491                         safe_close(nullfd);
2492
2493                 reset_all_signal_handlers();
2494                 close_all_fds(NULL, 0);
2495
2496                 execle("/usr/bin/getent", "getent", database, key, NULL, &empty_env);
2497                 execle("/bin/getent", "getent", database, key, NULL, &empty_env);
2498                 _exit(EXIT_FAILURE);
2499         }
2500
2501         pipe_fds[1] = safe_close(pipe_fds[1]);
2502
2503         *rpid = pid;
2504
2505         return pipe_fds[0];
2506 }
2507
2508 static int change_uid_gid(char **_home) {
2509         char line[LINE_MAX], *x, *u, *g, *h;
2510         const char *word, *state;
2511         _cleanup_free_ uid_t *uids = NULL;
2512         _cleanup_free_ char *home = NULL;
2513         _cleanup_fclose_ FILE *f = NULL;
2514         _cleanup_close_ int fd = -1;
2515         unsigned n_uids = 0;
2516         size_t sz = 0, l;
2517         uid_t uid;
2518         gid_t gid;
2519         pid_t pid;
2520         int r;
2521
2522         assert(_home);
2523
2524         if (!arg_user || streq(arg_user, "root") || streq(arg_user, "0")) {
2525                 /* Reset everything fully to 0, just in case */
2526
2527                 if (setgroups(0, NULL) < 0)
2528                         return log_error_errno(errno, "setgroups() failed: %m");
2529
2530                 if (setresgid(0, 0, 0) < 0)
2531                         return log_error_errno(errno, "setregid() failed: %m");
2532
2533                 if (setresuid(0, 0, 0) < 0)
2534                         return log_error_errno(errno, "setreuid() failed: %m");
2535
2536                 *_home = NULL;
2537                 return 0;
2538         }
2539
2540         /* First, get user credentials */
2541         fd = spawn_getent("passwd", arg_user, &pid);
2542         if (fd < 0)
2543                 return fd;
2544
2545         f = fdopen(fd, "r");
2546         if (!f)
2547                 return log_oom();
2548         fd = -1;
2549
2550         if (!fgets(line, sizeof(line), f)) {
2551
2552                 if (!ferror(f)) {
2553                         log_error("Failed to resolve user %s.", arg_user);
2554                         return -ESRCH;
2555                 }
2556
2557                 log_error_errno(errno, "Failed to read from getent: %m");
2558                 return -errno;
2559         }
2560
2561         truncate_nl(line);
2562
2563         wait_for_terminate_and_warn("getent passwd", pid, true);
2564
2565         x = strchr(line, ':');
2566         if (!x) {
2567                 log_error("/etc/passwd entry has invalid user field.");
2568                 return -EIO;
2569         }
2570
2571         u = strchr(x+1, ':');
2572         if (!u) {
2573                 log_error("/etc/passwd entry has invalid password field.");
2574                 return -EIO;
2575         }
2576
2577         u++;
2578         g = strchr(u, ':');
2579         if (!g) {
2580                 log_error("/etc/passwd entry has invalid UID field.");
2581                 return -EIO;
2582         }
2583
2584         *g = 0;
2585         g++;
2586         x = strchr(g, ':');
2587         if (!x) {
2588                 log_error("/etc/passwd entry has invalid GID field.");
2589                 return -EIO;
2590         }
2591
2592         *x = 0;
2593         h = strchr(x+1, ':');
2594         if (!h) {
2595                 log_error("/etc/passwd entry has invalid GECOS field.");
2596                 return -EIO;
2597         }
2598
2599         h++;
2600         x = strchr(h, ':');
2601         if (!x) {
2602                 log_error("/etc/passwd entry has invalid home directory field.");
2603                 return -EIO;
2604         }
2605
2606         *x = 0;
2607
2608         r = parse_uid(u, &uid);
2609         if (r < 0) {
2610                 log_error("Failed to parse UID of user.");
2611                 return -EIO;
2612         }
2613
2614         r = parse_gid(g, &gid);
2615         if (r < 0) {
2616                 log_error("Failed to parse GID of user.");
2617                 return -EIO;
2618         }
2619
2620         home = strdup(h);
2621         if (!home)
2622                 return log_oom();
2623
2624         /* Second, get group memberships */
2625         fd = spawn_getent("initgroups", arg_user, &pid);
2626         if (fd < 0)
2627                 return fd;
2628
2629         fclose(f);
2630         f = fdopen(fd, "r");
2631         if (!f)
2632                 return log_oom();
2633         fd = -1;
2634
2635         if (!fgets(line, sizeof(line), f)) {
2636                 if (!ferror(f)) {
2637                         log_error("Failed to resolve user %s.", arg_user);
2638                         return -ESRCH;
2639                 }
2640
2641                 log_error_errno(errno, "Failed to read from getent: %m");
2642                 return -errno;
2643         }
2644
2645         truncate_nl(line);
2646
2647         wait_for_terminate_and_warn("getent initgroups", pid, true);
2648
2649         /* Skip over the username and subsequent separator whitespace */
2650         x = line;
2651         x += strcspn(x, WHITESPACE);
2652         x += strspn(x, WHITESPACE);
2653
2654         FOREACH_WORD(word, l, x, state) {
2655                 char c[l+1];
2656
2657                 memcpy(c, word, l);
2658                 c[l] = 0;
2659
2660                 if (!GREEDY_REALLOC(uids, sz, n_uids+1))
2661                         return log_oom();
2662
2663                 r = parse_uid(c, &uids[n_uids++]);
2664                 if (r < 0) {
2665                         log_error("Failed to parse group data from getent.");
2666                         return -EIO;
2667                 }
2668         }
2669
2670         r = mkdir_parents(home, 0775);
2671         if (r < 0)
2672                 return log_error_errno(r, "Failed to make home root directory: %m");
2673
2674         r = mkdir_safe(home, 0755, uid, gid);
2675         if (r < 0 && r != -EEXIST)
2676                 return log_error_errno(r, "Failed to make home directory: %m");
2677
2678         fchown(STDIN_FILENO, uid, gid);
2679         fchown(STDOUT_FILENO, uid, gid);
2680         fchown(STDERR_FILENO, uid, gid);
2681
2682         if (setgroups(n_uids, uids) < 0)
2683                 return log_error_errno(errno, "Failed to set auxiliary groups: %m");
2684
2685         if (setresgid(gid, gid, gid) < 0)
2686                 return log_error_errno(errno, "setregid() failed: %m");
2687
2688         if (setresuid(uid, uid, uid) < 0)
2689                 return log_error_errno(errno, "setreuid() failed: %m");
2690
2691         if (_home) {
2692                 *_home = home;
2693                 home = NULL;
2694         }
2695
2696         return 0;
2697 }
2698
2699 /*
2700  * Return values:
2701  * < 0 : wait_for_terminate() failed to get the state of the
2702  *       container, the container was terminated by a signal, or
2703  *       failed for an unknown reason.  No change is made to the
2704  *       container argument.
2705  * > 0 : The program executed in the container terminated with an
2706  *       error.  The exit code of the program executed in the
2707  *       container is returned.  The container argument has been set
2708  *       to CONTAINER_TERMINATED.
2709  *   0 : The container is being rebooted, has been shut down or exited
2710  *       successfully.  The container argument has been set to either
2711  *       CONTAINER_TERMINATED or CONTAINER_REBOOTED.
2712  *
2713  * That is, success is indicated by a return value of zero, and an
2714  * error is indicated by a non-zero value.
2715  */
2716 static int wait_for_container(pid_t pid, ContainerStatus *container) {
2717         siginfo_t status;
2718         int r;
2719
2720         r = wait_for_terminate(pid, &status);
2721         if (r < 0)
2722                 return log_warning_errno(r, "Failed to wait for container: %m");
2723
2724         switch (status.si_code) {
2725
2726         case CLD_EXITED:
2727                 if (status.si_status == 0) {
2728                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
2729
2730                 } else
2731                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
2732
2733                 *container = CONTAINER_TERMINATED;
2734                 return status.si_status;
2735
2736         case CLD_KILLED:
2737                 if (status.si_status == SIGINT) {
2738
2739                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
2740                         *container = CONTAINER_TERMINATED;
2741                         return 0;
2742
2743                 } else if (status.si_status == SIGHUP) {
2744
2745                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
2746                         *container = CONTAINER_REBOOTED;
2747                         return 0;
2748                 }
2749
2750                 /* CLD_KILLED fallthrough */
2751
2752         case CLD_DUMPED:
2753                 log_error("Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
2754                 return -EIO;
2755
2756         default:
2757                 log_error("Container %s failed due to unknown reason.", arg_machine);
2758                 return -EIO;
2759         }
2760
2761         return r;
2762 }
2763
2764 static void nop_handler(int sig) {}
2765
2766 static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2767         pid_t pid;
2768
2769         pid = PTR_TO_UINT32(userdata);
2770         if (pid > 0) {
2771                 if (kill(pid, SIGRTMIN+3) >= 0) {
2772                         log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2773                         sd_event_source_set_userdata(s, NULL);
2774                         return 0;
2775                 }
2776         }
2777
2778         sd_event_exit(sd_event_source_get_event(s), 0);
2779         return 0;
2780 }
2781
2782 int main(int argc, char *argv[]) {
2783
2784         _cleanup_free_ char *device_path = NULL, *root_device = NULL, *home_device = NULL, *srv_device = NULL;
2785         bool root_device_rw = true, home_device_rw = true, srv_device_rw = true;
2786         _cleanup_close_ int master = -1, image_fd = -1;
2787         _cleanup_close_pair_ int kmsg_socket_pair[2] = { -1, -1 };
2788         _cleanup_fdset_free_ FDSet *fds = NULL;
2789         int r = EXIT_FAILURE, k, n_fd_passed, loop_nr = -1;
2790         const char *console = NULL;
2791         char veth_name[IFNAMSIZ];
2792         bool secondary = false;
2793         sigset_t mask, mask_chld;
2794         pid_t pid = 0;
2795
2796         log_parse_environment();
2797         log_open();
2798
2799         k = parse_argv(argc, argv);
2800         if (k < 0)
2801                 goto finish;
2802         else if (k == 0) {
2803                 r = EXIT_SUCCESS;
2804                 goto finish;
2805         }
2806
2807         if (!arg_image) {
2808                 if (arg_directory) {
2809                         char *p;
2810
2811                         p = path_make_absolute_cwd(arg_directory);
2812                         free(arg_directory);
2813                         arg_directory = p;
2814                 } else
2815                         arg_directory = get_current_dir_name();
2816
2817                 if (!arg_directory) {
2818                         log_error("Failed to determine path, please use -D.");
2819                         goto finish;
2820                 }
2821                 path_kill_slashes(arg_directory);
2822         }
2823
2824         if (!arg_machine) {
2825                 arg_machine = strdup(basename(arg_image ? arg_image : arg_directory));
2826                 if (!arg_machine) {
2827                         log_oom();
2828                         goto finish;
2829                 }
2830
2831                 hostname_cleanup(arg_machine, false);
2832                 if (isempty(arg_machine)) {
2833                         log_error("Failed to determine machine name automatically, please use -M.");
2834                         goto finish;
2835                 }
2836         }
2837
2838         if (geteuid() != 0) {
2839                 log_error("Need to be root.");
2840                 goto finish;
2841         }
2842
2843         if (sd_booted() <= 0) {
2844                 log_error("Not running on a systemd system.");
2845                 goto finish;
2846         }
2847
2848         log_close();
2849         n_fd_passed = sd_listen_fds(false);
2850         if (n_fd_passed > 0) {
2851                 k = fdset_new_listen_fds(&fds, false);
2852                 if (k < 0) {
2853                         log_error_errno(k, "Failed to collect file descriptors: %m");
2854                         goto finish;
2855                 }
2856         }
2857         fdset_close_others(fds);
2858         log_open();
2859
2860         if (arg_directory) {
2861                 if (path_equal(arg_directory, "/")) {
2862                         log_error("Spawning container on root directory not supported.");
2863                         goto finish;
2864                 }
2865
2866                 if (arg_boot) {
2867                         if (path_is_os_tree(arg_directory) <= 0) {
2868                                 log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", arg_directory);
2869                                 goto finish;
2870                         }
2871                 } else {
2872                         const char *p;
2873
2874                         p = strappenda(arg_directory,
2875                                        argc > optind && path_is_absolute(argv[optind]) ? argv[optind] : "/usr/bin/");
2876                         if (access(p, F_OK) < 0) {
2877                                 log_error("Directory %s lacks the binary to execute or doesn't look like a binary tree. Refusing.", arg_directory);
2878                                 goto finish;
2879
2880                         }
2881                 }
2882         } else {
2883                 char template[] = "/tmp/nspawn-root-XXXXXX";
2884
2885                 if (!mkdtemp(template)) {
2886                         log_error_errno(errno, "Failed to create temporary directory: %m");
2887                         r = -errno;
2888                         goto finish;
2889                 }
2890
2891                 arg_directory = strdup(template);
2892                 if (!arg_directory) {
2893                         r = log_oom();
2894                         goto finish;
2895                 }
2896
2897                 image_fd = setup_image(&device_path, &loop_nr);
2898                 if (image_fd < 0) {
2899                         r = image_fd;
2900                         goto finish;
2901                 }
2902
2903                 r = dissect_image(image_fd,
2904                                   &root_device, &root_device_rw,
2905                                   &home_device, &home_device_rw,
2906                                   &srv_device, &srv_device_rw,
2907                                   &secondary);
2908                 if (r < 0)
2909                         goto finish;
2910         }
2911
2912         master = posix_openpt(O_RDWR|O_NOCTTY|O_CLOEXEC|O_NDELAY);
2913         if (master < 0) {
2914                 log_error_errno(errno, "Failed to acquire pseudo tty: %m");
2915                 goto finish;
2916         }
2917
2918         console = ptsname(master);
2919         if (!console) {
2920                 log_error_errno(errno, "Failed to determine tty name: %m");
2921                 goto finish;
2922         }
2923
2924         if (!arg_quiet)
2925                 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
2926                          arg_machine, arg_image ? arg_image : arg_directory);
2927
2928         if (unlockpt(master) < 0) {
2929                 log_error_errno(errno, "Failed to unlock tty: %m");
2930                 goto finish;
2931         }
2932
2933         if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0) {
2934                 log_error_errno(errno, "Failed to create kmsg socket pair: %m");
2935                 goto finish;
2936         }
2937
2938         sd_notify(false,
2939                   "READY=1\n"
2940                   "STATUS=Container running.");
2941
2942         assert_se(sigemptyset(&mask) == 0);
2943         sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
2944         assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
2945
2946         assert_se(sigemptyset(&mask_chld) == 0);
2947         assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
2948
2949         for (;;) {
2950                 ContainerStatus container_status;
2951                 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
2952                 struct sigaction sa = {
2953                         .sa_handler = nop_handler,
2954                         .sa_flags = SA_NOCLDSTOP,
2955                 };
2956
2957                 r = barrier_create(&barrier);
2958                 if (r < 0) {
2959                         log_error_errno(r, "Cannot initialize IPC barrier: %m");
2960                         goto finish;
2961                 }
2962
2963                 /* Child can be killed before execv(), so handle SIGCHLD
2964                  * in order to interrupt parent's blocking calls and
2965                  * give it a chance to call wait() and terminate. */
2966                 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
2967                 if (r < 0) {
2968                         log_error_errno(errno, "Failed to change the signal mask: %m");
2969                         goto finish;
2970                 }
2971
2972                 r = sigaction(SIGCHLD, &sa, NULL);
2973                 if (r < 0) {
2974                         log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
2975                         goto finish;
2976                 }
2977
2978                 pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWNS|
2979                                           (arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS)|
2980                                           (arg_private_network ? CLONE_NEWNET : 0), NULL);
2981                 if (pid < 0) {
2982                         if (errno == EINVAL)
2983                                 log_error_errno(errno, "clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m");
2984                         else
2985                                 log_error_errno(errno, "clone() failed: %m");
2986
2987                         r = pid;
2988                         goto finish;
2989                 }
2990
2991                 if (pid == 0) {
2992                         /* child */
2993                         _cleanup_free_ char *home = NULL;
2994                         unsigned n_env = 2;
2995                         const char *envp[] = {
2996                                 "PATH=" DEFAULT_PATH_SPLIT_USR,
2997                                 "container=systemd-nspawn", /* LXC sets container=lxc, so follow the scheme here */
2998                                 NULL, /* TERM */
2999                                 NULL, /* HOME */
3000                                 NULL, /* USER */
3001                                 NULL, /* LOGNAME */
3002                                 NULL, /* container_uuid */
3003                                 NULL, /* LISTEN_FDS */
3004                                 NULL, /* LISTEN_PID */
3005                                 NULL
3006                         };
3007                         char **env_use;
3008
3009                         barrier_set_role(&barrier, BARRIER_CHILD);
3010
3011                         envp[n_env] = strv_find_prefix(environ, "TERM=");
3012                         if (envp[n_env])
3013                                 n_env ++;
3014
3015                         master = safe_close(master);
3016
3017                         close_nointr(STDIN_FILENO);
3018                         close_nointr(STDOUT_FILENO);
3019                         close_nointr(STDERR_FILENO);
3020
3021                         kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
3022
3023                         reset_all_signal_handlers();
3024                         reset_signal_mask();
3025
3026                         k = open_terminal(console, O_RDWR);
3027                         if (k != STDIN_FILENO) {
3028                                 if (k >= 0) {
3029                                         safe_close(k);
3030                                         k = -EINVAL;
3031                                 }
3032
3033                                 log_error_errno(k, "Failed to open console: %m");
3034                                 _exit(EXIT_FAILURE);
3035                         }
3036
3037                         if (dup2(STDIN_FILENO, STDOUT_FILENO) != STDOUT_FILENO ||
3038                             dup2(STDIN_FILENO, STDERR_FILENO) != STDERR_FILENO) {
3039                                 log_error_errno(errno, "Failed to duplicate console: %m");
3040                                 _exit(EXIT_FAILURE);
3041                         }
3042
3043                         if (setsid() < 0) {
3044                                 log_error_errno(errno, "setsid() failed: %m");
3045                                 _exit(EXIT_FAILURE);
3046                         }
3047
3048                         if (reset_audit_loginuid() < 0)
3049                                 _exit(EXIT_FAILURE);
3050
3051                         if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0) {
3052                                 log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3053                                 _exit(EXIT_FAILURE);
3054                         }
3055
3056                         /* Mark everything as slave, so that we still
3057                          * receive mounts from the real root, but don't
3058                          * propagate mounts to the real root. */
3059                         if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
3060                                 log_error_errno(errno, "MS_SLAVE|MS_REC failed: %m");
3061                                 _exit(EXIT_FAILURE);
3062                         }
3063
3064                         if (mount_devices(arg_directory,
3065                                           root_device, root_device_rw,
3066                                           home_device, home_device_rw,
3067                                           srv_device, srv_device_rw) < 0)
3068                                 _exit(EXIT_FAILURE);
3069
3070                         /* Turn directory into bind mount */
3071                         if (mount(arg_directory, arg_directory, "bind", MS_BIND|MS_REC, NULL) < 0) {
3072                                 log_error_errno(errno, "Failed to make bind mount: %m");
3073                                 _exit(EXIT_FAILURE);
3074                         }
3075
3076                         r = setup_volatile(arg_directory);
3077                         if (r < 0)
3078                                 _exit(EXIT_FAILURE);
3079
3080                         if (setup_volatile_state(arg_directory) < 0)
3081                                 _exit(EXIT_FAILURE);
3082
3083                         r = base_filesystem_create(arg_directory);
3084                         if (r < 0)
3085                                 _exit(EXIT_FAILURE);
3086
3087                         if (arg_read_only) {
3088                                 k = bind_remount_recursive(arg_directory, true);
3089                                 if (k < 0) {
3090                                         log_error_errno(k, "Failed to make tree read-only: %m");
3091                                         _exit(EXIT_FAILURE);
3092                                 }
3093                         }
3094
3095                         if (mount_all(arg_directory) < 0)
3096                                 _exit(EXIT_FAILURE);
3097
3098                         if (copy_devnodes(arg_directory) < 0)
3099                                 _exit(EXIT_FAILURE);
3100
3101                         if (setup_ptmx(arg_directory) < 0)
3102                                 _exit(EXIT_FAILURE);
3103
3104                         dev_setup(arg_directory);
3105
3106                         if (setup_seccomp() < 0)
3107           &nbs