chiark / gitweb /
Make sure that keys are properly removed from hashmap
[elogind.git] / src / core / mount-setup.c
index ce10be9..34d71e5 100644 (file)
 #include "missing.h"
 #include "virt.h"
 #include "efivars.h"
-
-#ifndef TTY_GID
-#define TTY_GID 5
-#endif
+#include "smack-util.h"
+#include "def.h"
 
 typedef enum MountMode {
         MNT_NONE  =        0,
@@ -77,18 +75,30 @@ static const MountPoint mount_table[] = {
           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "securityfs", "/sys/kernel/security",      "securityfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
           NULL,       MNT_NONE },
+#ifdef HAVE_SMACK
         { "smackfs",    "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
-          NULL,       MNT_NONE },
+          use_smack,  MNT_FATAL },
+        { "tmpfs",      "/dev/shm",                  "tmpfs",      "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
+          use_smack,  MNT_FATAL },
+#endif
         { "tmpfs",      "/dev/shm",                  "tmpfs",      "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "devpts",     "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
           NULL,       MNT_IN_CONTAINER },
+#ifdef HAVE_SMACK
+        { "tmpfs",      "/run",                      "tmpfs",      "mode=755,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
+          use_smack,  MNT_FATAL },
+#endif
         { "tmpfs",      "/run",                      "tmpfs",      "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "tmpfs",      "/sys/fs/cgroup",            "tmpfs",      "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
-          NULL,       MNT_IN_CONTAINER },
+          NULL,       MNT_FATAL|MNT_IN_CONTAINER },
+#ifdef HAVE_XATTR
+        { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd,xattr", MS_NOSUID|MS_NOEXEC|MS_NODEV,
+          NULL,       MNT_FATAL|MNT_IN_CONTAINER },
+#endif
         { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV,
-          NULL,       MNT_IN_CONTAINER },
+          NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "pstore",     "/sys/fs/pstore",            "pstore",     NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
           NULL,       MNT_NONE },
 #ifdef ENABLE_EFI
@@ -162,7 +172,10 @@ static int mount_one(const MountPoint *p, bool relabel) {
 
         /* The access mode here doesn't really matter too much, since
          * the mounted file system will take precedence anyway. */
-        mkdir_p_label(p->where, 0755);
+        if (relabel)
+                mkdir_p_label(p->where, 0755);
+        else
+                mkdir_p(p->where, 0755);
 
         log_debug("Mounting %s to %s of type %s with options %s.",
                   p->what,
@@ -175,7 +188,7 @@ static int mount_one(const MountPoint *p, bool relabel) {
                   p->type,
                   p->flags,
                   p->options) < 0) {
-                log_full((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, "Failed to mount %s: %s", p->where, strerror(errno));
+                log_full((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, "Failed to mount %s at %s: %m", p->type, p->where);
                 return (p->mode & MNT_FATAL) ? -errno : 0;
         }
 
@@ -206,10 +219,10 @@ int mount_setup_early(void) {
 }
 
 int mount_cgroup_controllers(char ***join_controllers) {
-        int r;
-        FILE *f;
+        _cleanup_set_free_free_ Set *controllers = NULL;
+        _cleanup_fclose_ FILE *f;
         char buf[LINE_MAX];
-        Set *controllers;
+        int r;
 
         /* Mount all available cgroup controllers that are built into the kernel. */
 
@@ -220,10 +233,8 @@ int mount_cgroup_controllers(char ***join_controllers) {
         }
 
         controllers = set_new(string_hash_func, string_compare_func);
-        if (!controllers) {
-                r = log_oom();
-                goto finish;
-        }
+        if (!controllers)
+                return log_oom();
 
         /* Ignore the header line */
         (void) fgets(buf, sizeof(buf), f);
@@ -238,8 +249,7 @@ int mount_cgroup_controllers(char ***join_controllers) {
                                 break;
 
                         log_error("Failed to parse /proc/cgroups.");
-                        r = -EIO;
-                        goto finish;
+                        return -EIO;
                 }
 
                 if (!enabled) {
@@ -247,17 +257,21 @@ int mount_cgroup_controllers(char ***join_controllers) {
                         continue;
                 }
 
-                r = set_put(controllers, controller);
+                r = set_consume(controllers, controller);
                 if (r < 0) {
                         log_error("Failed to add controller to set.");
-                        free(controller);
-                        goto finish;
+                        return r;
                 }
         }
 
         for (;;) {
-                MountPoint p;
-                char *controller, *where, *options;
+                _cleanup_free_ char *options = NULL, *controller = NULL, *where = NULL;
+                MountPoint p = {
+                        .what = "cgroup",
+                        .type = "cgroup",
+                        .flags = MS_NOSUID|MS_NOEXEC|MS_NODEV,
+                        .mode = MNT_IN_CONTAINER,
+                };
                 char ***k = NULL;
 
                 controller = set_steal_first(controllers);
@@ -275,14 +289,13 @@ int mount_cgroup_controllers(char ***join_controllers) {
                         for (i = *k, j = *k; *i; i++) {
 
                                 if (!streq(*i, controller)) {
-                                        char *t;
+                                        _cleanup_free_ char *t;
 
                                         t = set_remove(controllers, *i);
                                         if (!t) {
                                                 free(*i);
                                                 continue;
                                         }
-                                        free(t);
                                 }
 
                                 *(j++) = *i;
@@ -291,76 +304,48 @@ int mount_cgroup_controllers(char ***join_controllers) {
                         *j = NULL;
 
                         options = strv_join(*k, ",");
-                        if (!options) {
-                                free(controller);
-                                r = log_oom();
-                                goto finish;
-                        }
-
+                        if (!options)
+                                return log_oom();
                 } else {
                         options = controller;
                         controller = NULL;
                 }
 
                 where = strappend("/sys/fs/cgroup/", options);
-                if (!where) {
-                        free(options);
-                        r = log_oom();
-                        goto finish;
-                }
+                if (!where)
+                        return log_oom();
 
-                zero(p);
-                p.what = "cgroup";
                 p.where = where;
-                p.type = "cgroup";
                 p.options = options;
-                p.flags = MS_NOSUID|MS_NOEXEC|MS_NODEV;
 
                 r = mount_one(&p, true);
-                free(controller);
-                free(where);
-
-                if (r < 0) {
-                        free(options);
-                        goto finish;
-                }
+                if (r < 0)
+                        return r;
 
                 if (r > 0 && k && *k) {
                         char **i;
 
                         for (i = *k; *i; i++) {
-                                char *t;
+                                _cleanup_free_ char *t = NULL;
 
                                 t = strappend("/sys/fs/cgroup/", *i);
-                                if (!t) {
-                                        r = log_oom();
-                                        free(options);
-                                        goto finish;
-                                }
+                                if (!t)
+                                        return log_oom();
 
                                 r = symlink(options, t);
-                                free(t);
-
                                 if (r < 0 && errno != EEXIST) {
-                                        log_error("Failed to create symlink: %m");
-                                        r = -errno;
-                                        free(options);
-                                        goto finish;
+                                        log_error("Failed to create symlink %s: %m", t);
+                                        return -errno;
                                 }
                         }
                 }
-
-                free(options);
         }
 
-        r = 0;
-
-finish:
-        set_free_free(controllers);
+        /* Now that we mounted everything, let's make the tmpfs the
+         * cgroup file systems are mounted into read-only. */
+        mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755");
 
-        fclose(f);
-
-        return r;
+        return 0;
 }
 
 static int nftw_cb(
@@ -386,14 +371,8 @@ static int nftw_cb(
 };
 
 int mount_setup(bool loaded_policy) {
-
-        static const char relabel[] =
-                "/run/initramfs/root-fsck\0"
-                "/run/initramfs/shutdown\0";
-
         int r;
         unsigned i;
-        const char *j;
 
         for (i = 0; i < ELEMENTSOF(mount_table); i ++) {
                 r = mount_one(mount_table + i, true);
@@ -415,14 +394,10 @@ int mount_setup(bool loaded_policy) {
                 nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
                 nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
 
-                /* Explicitly relabel these */
-                NULSTR_FOREACH(j, relabel)
-                        label_fix(j, true, false);
-
                 after_relabel = now(CLOCK_MONOTONIC);
 
                 log_info("Relabelled /dev and /run in %s.",
-                         format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel));
+                         format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));
         }
 
         /* Create a few default symlinks, which are normally created
@@ -447,6 +422,7 @@ int mount_setup(bool loaded_policy) {
          * systemd. */
         mkdir_label("/run/systemd", 0755);
         mkdir_label("/run/systemd/system", 0755);
+        mkdir_label("/run/systemd/inaccessible", 0000);
 
         return 0;
 }