config_parse_set_status: put signals in the correct set

[elogind.git] / src / core / namespace.c

diff --git a/src/core/namespace.c b/src/core/namespace.c
index fe9537787185c6755f9778593ae5aa393d760e7a..4b8dbdd0d83d975a2e5f135d280d05f056047f98 100644 (file)
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -35,7 +35,6 @@
 #include "strv.h"
 #include "util.h"
 #include "path-util.h"
-#include "namespace.h"
 #include "missing.h"
 #include "execute.h"
 #include "loopback-setup.h"
@@ -43,6 +42,8 @@
 #include "dev-setup.h"
 #include "def.h"
 #include "label.h"
+#include "selinux-util.h"
+#include "namespace.h"
 
 typedef enum MountMode {
         /* This is ordered by priority! */
@@ -51,6 +52,7 @@ typedef enum MountMode {
         PRIVATE_TMP,
         PRIVATE_VAR_TMP,
         PRIVATE_DEV,
+        PRIVATE_BUS_ENDPOINT,
         READWRITE
 } MountMode;
 
@@ -144,7 +146,7 @@ static int mount_dev(BindMount *m) {
                 "/dev/tty\0";
 
         char temporary_mount[] = "/tmp/namespace-dev-XXXXXX";
-        const char *d, *dev = NULL, *devpts = NULL, *devshm = NULL, *devkdbus = NULL, *devhugepages = NULL, *devmqueue = NULL, *devlog = NULL, *devptmx = NULL;
+        const char *d, *dev = NULL, *devpts = NULL, *devshm = NULL, *devhugepages = NULL, *devmqueue = NULL, *devlog = NULL, *devptmx = NULL;
         _cleanup_umask_ mode_t u;
         int r;
 
@@ -156,14 +158,14 @@ static int mount_dev(BindMount *m) {
                 return -errno;
 
         dev = strappenda(temporary_mount, "/dev");
-        mkdir(dev, 0755);
+        (void)mkdir(dev, 0755);
         if (mount("tmpfs", dev, "tmpfs", MS_NOSUID|MS_STRICTATIME, "mode=755") < 0) {
                 r = -errno;
                 goto fail;
         }
 
         devpts = strappenda(temporary_mount, "/dev/pts");
-        mkdir(devpts, 0755);
+        (void)mkdir(devpts, 0755);
         if (mount("/dev/pts", devpts, NULL, MS_BIND, NULL) < 0) {
                 r = -errno;
                 goto fail;
@@ -173,7 +175,7 @@ static int mount_dev(BindMount *m) {
         symlink("pts/ptmx", devptmx);
 
         devshm = strappenda(temporary_mount, "/dev/shm");
-        mkdir(devshm, 01777);
+        (void)mkdir(devshm, 01777);
         r = mount("/dev/shm", devshm, NULL, MS_BIND, NULL);
         if (r < 0) {
                 r = -errno;
@@ -181,15 +183,11 @@ static int mount_dev(BindMount *m) {
         }
 
         devmqueue = strappenda(temporary_mount, "/dev/mqueue");
-        mkdir(devmqueue, 0755);
+        (void)mkdir(devmqueue, 0755);
         mount("/dev/mqueue", devmqueue, NULL, MS_BIND, NULL);
 
-        devkdbus = strappenda(temporary_mount, "/dev/kdbus");
-        mkdir(devkdbus, 0755);
-        mount("/dev/kdbus", devkdbus, NULL, MS_BIND, NULL);
-
         devhugepages = strappenda(temporary_mount, "/dev/hugepages");
-        mkdir(devhugepages, 0755);
+        (void)mkdir(devhugepages, 0755);
         mount("/dev/hugepages", devhugepages, NULL, MS_BIND, NULL);
 
         devlog = strappenda(temporary_mount, "/dev/log");
@@ -224,9 +222,9 @@ static int mount_dev(BindMount *m) {
                         goto fail;
                 }
 
-                label_context_set(d, st.st_mode);
+                mac_selinux_create_file_prepare(d, st.st_mode);
                 r = mknod(dn, st.st_mode, st.st_rdev);
-                label_context_clear();
+                mac_selinux_create_file_clear();
 
                 if (r < 0) {
                         r = -errno;
@@ -253,20 +251,87 @@ fail:
         if (devshm)
                 umount(devshm);
 
-        if (devkdbus)
-                umount(devkdbus);
-
         if (devhugepages)
                 umount(devhugepages);
 
         if (devmqueue)
                 umount(devmqueue);
 
-        if (dev) {
-                umount(dev);
-                rmdir(dev);
+        umount(dev);
+        rmdir(dev);
+        rmdir(temporary_mount);
+
+        return r;
+}
+
+static int mount_kdbus(BindMount *m) {
+
+        char temporary_mount[] = "/tmp/kdbus-dev-XXXXXX";
+        _cleanup_free_ char *basepath = NULL;
+        _cleanup_umask_ mode_t u;
+        char *busnode = NULL, *root;
+        struct stat st;
+        int r;
+
+        assert(m);
+
+        u = umask(0000);
+
+        if (!mkdtemp(temporary_mount))
+                return log_error_errno(errno, "Failed create temp dir: %m");
+
+        root = strappenda(temporary_mount, "/kdbus");
+        (void)mkdir(root, 0755);
+        if (mount("tmpfs", root, "tmpfs", MS_NOSUID|MS_STRICTATIME, "mode=777") < 0) {
+                r = -errno;
+                goto fail;
+        }
+
+        /* create a new /dev/null dev node copy so we have some fodder to
+         * bind-mount the custom endpoint over. */
+        if (stat("/dev/null", &st) < 0) {
+                log_error_errno(errno, "Failed to stat /dev/null: %m");
+                r = -errno;
+                goto fail;
+        }
+
+        busnode = strappenda(root, "/bus");
+        if (mknod(busnode, (st.st_mode & ~07777) | 0600, st.st_rdev) < 0) {
+                log_error_errno(errno, "mknod() for %s failed: %m", busnode);
+                r = -errno;
+                goto fail;
+        }
+
+        r = mount(m->path, busnode, "bind", MS_BIND, NULL);
+        if (r < 0) {
+                log_error_errno(errno, "bind mount of %s failed: %m", m->path);
+                r = -errno;
+                goto fail;
+        }
+
+        basepath = dirname_malloc(m->path);
+        if (!basepath) {
+                r = -ENOMEM;
+                goto fail;
+        }
+
+        if (mount(root, basepath, NULL, MS_MOVE, NULL) < 0) {
+                log_error_errno(errno, "bind mount of %s failed: %m", basepath);
+                r = -errno;
+                goto fail;
         }
 
+        rmdir(temporary_mount);
+        return 0;
+
+fail:
+        if (busnode) {
+                umount(busnode);
+                unlink(busnode);
+        }
+
+        umount(root);
+        rmdir(root);
         rmdir(temporary_mount);
 
         return r;
@@ -311,6 +376,9 @@ static int apply_mount(
         case PRIVATE_DEV:
                 return mount_dev(m);
 
+        case PRIVATE_BUS_ENDPOINT:
+                return mount_kdbus(m);
+
         default:
                 assert_not_reached("Unknown mode");
         }
@@ -348,12 +416,13 @@ int setup_namespace(
                 char** read_write_dirs,
                 char** read_only_dirs,
                 char** inaccessible_dirs,
-                char* tmp_dir,
-                char* var_tmp_dir,
+                const char* tmp_dir,
+                const char* var_tmp_dir,
+                const char* bus_endpoint_path,
                 bool private_dev,
                 ProtectHome protect_home,
                 ProtectSystem protect_system,
-                unsigned mount_flags) {
+                unsigned long mount_flags) {
 
         BindMount *m, *mounts = NULL;
         unsigned n;
@@ -365,7 +434,7 @@ int setup_namespace(
         if (unshare(CLONE_NEWNS) < 0)
                 return -errno;
 
-        n = !!tmp_dir + !!var_tmp_dir +
+        n = !!tmp_dir + !!var_tmp_dir + !!bus_endpoint_path +
                 strv_length(read_write_dirs) +
                 strv_length(read_only_dirs) +
                 strv_length(inaccessible_dirs) +
@@ -406,6 +475,12 @@ int setup_namespace(
                         m++;
                 }
 
+                if (bus_endpoint_path) {
+                        m->path = bus_endpoint_path;
+                        m->mode = PRIVATE_BUS_ENDPOINT;
+                        m++;
+                }
+
                 if (protect_home != PROTECT_HOME_NO) {
                         r = append_mounts(&m, STRV_MAKE("-/home", "-/run/user", "-/root"), protect_home == PROTECT_HOME_READ_ONLY ? READONLY : INACCESSIBLE);
                         if (r < 0)