bus: restore selinux access control to PID 1 for properties

[elogind.git] / src / core / namespace.c

diff --git a/src/core/namespace.c b/src/core/namespace.c
index 972380abc03c4662de1c3b73b6cfcc159744ae48..b453f8dc09f7efd3c0d4e7ff9d244acfe4008666 100644 (file)
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -51,6 +51,7 @@ typedef struct BindMount {
         const char *path;
         MountMode mode;
         bool done;
+        bool ignore;
 } BindMount;
 
 static int append_mounts(BindMount **p, char **strv, MountMode mode) {
@@ -58,6 +59,13 @@ static int append_mounts(BindMount **p, char **strv, MountMode mode) {
 
         STRV_FOREACH(i, strv) {
 
+                (*p)->ignore = false;
+
+                if ((mode == INACCESSIBLE || mode == READONLY) && (*i)[0] == '-') {
+                        (*p)->ignore = true;
+                        (*i)++;
+                }
+
                 if (!path_is_absolute(*i))
                         return -EINVAL;
 
@@ -155,6 +163,8 @@ static int apply_mount(
         r = mount(what, m->path, NULL, MS_BIND|MS_REC, NULL);
         if (r >= 0)
                 log_debug("Successfully mounted %s to %s", what, m->path);
+        else if (m->ignore && errno == ENOENT)
+                r = 0;
 
         return r;
 }
@@ -168,32 +178,35 @@ static int make_read_only(BindMount *m) {
                 return 0;
 
         r = mount(NULL, m->path, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_REC, NULL);
-        if (r < 0)
+        if (r < 0 && !(m->ignore && errno == ENOENT))
                 return -errno;
 
         return 0;
 }
 
-int setup_tmpdirs(char **tmp_dir,
+int setup_tmpdirs(const char *unit_id,
+                  char **tmp_dir,
                   char **var_tmp_dir) {
         int r = 0;
-        char tmp_dir_template[] = "/tmp/systemd-private-XXXXXX",
-             var_tmp_dir_template[] = "/var/tmp/systemd-private-XXXXXX";
+        _cleanup_free_ char *tmp = NULL, *var = NULL;
 
         assert(tmp_dir);
         assert(var_tmp_dir);
 
-        r = create_tmp_dir(tmp_dir_template, tmp_dir);
+        tmp = strjoin("/tmp/systemd-", unit_id, "-XXXXXXX", NULL);
+        var = strjoin("/var/tmp/systemd-", unit_id, "-XXXXXXX", NULL);
+
+        r = create_tmp_dir(tmp, tmp_dir);
         if (r < 0)
                 return r;
 
-        r = create_tmp_dir(var_tmp_dir_template, var_tmp_dir);
+        r = create_tmp_dir(var, var_tmp_dir);
         if (r == 0)
                 return 0;
 
         /* failure */
         rmdir(*tmp_dir);
-        rmdir(tmp_dir_template);
+        rmdir(tmp);
         free(*tmp_dir);
         *tmp_dir = NULL;
 
@@ -212,44 +225,42 @@ int setup_namespace(char** read_write_dirs,
                      strv_length(read_only_dirs) +
                      strv_length(inaccessible_dirs) +
                      (private_tmp ? 2 : 0);
-        BindMount *m, *mounts;
+        BindMount *m, *mounts = NULL;
         int r = 0;
 
         if (!mount_flags)
                 mount_flags = MS_SHARED;
 
-        if (unshare(CLONE_NEWNS) < 0) {
-                r = -errno;
-                goto fail;
-        }
+        if (unshare(CLONE_NEWNS) < 0)
+                return -errno;
 
-        m = mounts = (BindMount *) alloca(n * sizeof(BindMount));
-        if ((r = append_mounts(&m, read_write_dirs, READWRITE)) < 0 ||
-                (r = append_mounts(&m, read_only_dirs, READONLY)) < 0 ||
-                (r = append_mounts(&m, inaccessible_dirs, INACCESSIBLE)) < 0)
-                goto fail;
+        if (n) {
+                m = mounts = (BindMount *) alloca(n * sizeof(BindMount));
+                if ((r = append_mounts(&m, read_write_dirs, READWRITE)) < 0 ||
+                    (r = append_mounts(&m, read_only_dirs, READONLY)) < 0 ||
+                    (r = append_mounts(&m, inaccessible_dirs, INACCESSIBLE)) < 0)
+                        return r;
 
-        if (private_tmp) {
-                m->path = "/tmp";
-                m->mode = PRIVATE_TMP;
-                m++;
+                if (private_tmp) {
+                        m->path = "/tmp";
+                        m->mode = PRIVATE_TMP;
+                        m++;
 
-                m->path = "/var/tmp";
-                m->mode = PRIVATE_VAR_TMP;
-                m++;
-        }
+                        m->path = "/var/tmp";
+                        m->mode = PRIVATE_VAR_TMP;
+                        m++;
+                }
 
-        assert(mounts + n == m);
+                assert(mounts + n == m);
 
-        qsort(mounts, n, sizeof(BindMount), mount_path_compare);
-        drop_duplicates(mounts, &n);
+                qsort(mounts, n, sizeof(BindMount), mount_path_compare);
+                drop_duplicates(mounts, &n);
+        }
 
         /* Remount / as SLAVE so that nothing now mounted in the namespace
            shows up in the parent */
-        if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
-                r = -errno;
-                goto fail;
-        }
+        if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0)
+                return -errno;
 
         for (m = mounts; m < mounts + n; ++m) {
                 r = apply_mount(m, tmp_dir, var_tmp_dir);
@@ -277,6 +288,5 @@ undo_mounts:
                         umount2(m->path, MNT_DETACH);
         }
 
-fail:
         return r;
 }