Add set_consume which always takes ownership

[elogind.git] / src / core / mount-setup.c

diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c
index dab36014675223dcb4bb9c0c353f406e24b9de10..b841f478c3fbc4bc30bb0071a776c4ed39963b7e 100644 (file)
--- a/src/core/mount-setup.c
+++ b/src/core/mount-setup.c
@@ -66,7 +66,7 @@ typedef struct MountPoint {
 /* The first three entries we might need before SELinux is up. The
  * fourth (securityfs) is needed by IMA to load a custom policy. The
  * other ones we can delay until SELinux and IMA are loaded. */
-#define N_EARLY_MOUNT 4
+#define N_EARLY_MOUNT 5
 
 static const MountPoint mount_table[] = {
         { "proc",       "/proc",                     "proc",       NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
@@ -77,6 +77,8 @@ static const MountPoint mount_table[] = {
           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "securityfs", "/sys/kernel/security",      "securityfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
           NULL,       MNT_NONE },
+        { "smackfs",    "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
+          NULL,       MNT_NONE },
         { "tmpfs",      "/dev/shm",                  "tmpfs",      "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "devpts",     "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
@@ -85,6 +87,10 @@ static const MountPoint mount_table[] = {
           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "tmpfs",      "/sys/fs/cgroup",            "tmpfs",      "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
           NULL,       MNT_IN_CONTAINER },
+#ifdef HAVE_XATTR
+        { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd,xattr", MS_NOSUID|MS_NOEXEC|MS_NODEV,
+          NULL,       MNT_IN_CONTAINER },
+#endif
         { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV,
           NULL,       MNT_IN_CONTAINER },
         { "pstore",     "/sys/fs/pstore",            "pstore",     NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
@@ -245,10 +251,9 @@ int mount_cgroup_controllers(char ***join_controllers) {
                         continue;
                 }
 
-                r = set_put(controllers, controller);
+                r = set_consume(controllers, controller);
                 if (r < 0) {
                         log_error("Failed to add controller to set.");
-                        free(controller);
                         goto finish;
                 }
         }
@@ -313,6 +318,7 @@ int mount_cgroup_controllers(char ***join_controllers) {
                 p.type = "cgroup";
                 p.options = options;
                 p.flags = MS_NOSUID|MS_NOEXEC|MS_NODEV;
+                p.mode = MNT_IN_CONTAINER;
 
                 r = mount_one(&p, true);
                 free(controller);
@@ -327,7 +333,7 @@ int mount_cgroup_controllers(char ***join_controllers) {
                         char **i;
 
                         for (i = *k; *i; i++) {
-                                char *t;
+                                _cleanup_free_ char *t;
 
                                 t = strappend("/sys/fs/cgroup/", *i);
                                 if (!t) {
@@ -337,10 +343,8 @@ int mount_cgroup_controllers(char ***join_controllers) {
                                 }
 
                                 r = symlink(options, t);
-                                free(t);
-
                                 if (r < 0 && errno != EEXIST) {
-                                        log_error("Failed to create symlink: %m");
+                                        log_error("Failed to create symlink %s: %m", t);
                                         r = -errno;
                                         free(options);
                                         goto finish;
@@ -420,7 +424,7 @@ int mount_setup(bool loaded_policy) {
                 after_relabel = now(CLOCK_MONOTONIC);
 
                 log_info("Relabelled /dev and /run in %s.",
-                         format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel));
+                         format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));
         }
 
         /* Create a few default symlinks, which are normally created
@@ -438,9 +442,14 @@ int mount_setup(bool loaded_policy) {
                 if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)
                         log_warning("Failed to set up the root directory for shared mount propagation: %m");
 
-        /* Create a few directories we always want around */
+        /* Create a few directories we always want around, Note that
+         * sd_booted() checks for /run/systemd/system, so this mkdir
+         * really needs to stay for good, otherwise software that
+         * copied sd-daemon.c into their sources will misdetect
+         * systemd. */
         mkdir_label("/run/systemd", 0755);
         mkdir_label("/run/systemd/system", 0755);
+        mkdir_label("/run/systemd/inaccessible", 0000);
 
         return 0;
 }