chiark / gitweb /
~ianmdlvl / elogind.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
nspawn: add /dev FD symlinks in container setup
[elogind.git] / src / nspawn / nspawn.c
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 1d7511e2ab690aa4d5c5c5090bab1a3c131e6a97..40b99343d79c4fb2574fe52ba3b0a142b730de0a 100644 (file)
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -53,6 +53,7 @@
 #include "path-util.h"
 #include "loopback-setup.h"
 #include "sd-id128.h"
+#include "dev-setup.h"
 
 typedef enum LinkJournal {
         LINK_NO,
@@ -205,10 +206,8 @@ static int parse_argv(int argc, char *argv[]) {
                                 char *t;
 
                                 t = strndup(word, length);
-                                if (!t) {
-                                        log_error("Out of memory.");
-                                        return -ENOMEM;
-                                }
+                                if (!t)
+                                        return log_oom();
 
                                 if (cap_from_name(t, &cap) < 0) {
                                         log_error("Failed to parse capability %s.", t);
@@ -268,16 +267,16 @@ static int mount_all(const char *dest) {
 
         static const MountPoint mount_table[] = {
                 { "proc",      "/proc",     "proc",  NULL,       MS_NOSUID|MS_NOEXEC|MS_NODEV, true  },
-                { "/proc/sys", "/proc/sys", "bind",  NULL,       MS_BIND, true                       },   /* Bind mount first */
-                { "/proc/sys", "/proc/sys", "bind",  NULL,       MS_BIND|MS_RDONLY|MS_REMOUNT, true  },   /* Then, make it r/o */
-                { "/sys",      "/sys",      "bind",  NULL,       MS_BIND,                      true  },   /* Bind mount first */
-                { "/sys",      "/sys",      "bind",  NULL,       MS_BIND|MS_RDONLY|MS_REMOUNT, true  },   /* Then, make it r/o */
+                { "/proc/sys", "/proc/sys", NULL,    NULL,       MS_BIND, true                       },   /* Bind mount first */
+                { NULL,        "/proc/sys", NULL,    NULL,       MS_BIND|MS_RDONLY|MS_REMOUNT, true  },   /* Then, make it r/o */
+                { "/sys",      "/sys",      NULL,    NULL,       MS_BIND,                      true  },   /* Bind mount first */
+                { NULL,        "/sys",      NULL,    NULL,       MS_BIND|MS_RDONLY|MS_REMOUNT, true  },   /* Then, make it r/o */
                 { "tmpfs",     "/dev",      "tmpfs", "mode=755", MS_NOSUID|MS_STRICTATIME,     true  },
-                { "/dev/pts",  "/dev/pts",  "bind",  NULL,       MS_BIND,                      true  },
+                { "/dev/pts",  "/dev/pts",  NULL,    NULL,       MS_BIND,                      true  },
                 { "tmpfs",     "/run",      "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true  },
 #ifdef HAVE_SELINUX
-                { "/sys/fs/selinux", "/sys/fs/selinux", "bind", NULL, MS_BIND,                      false },  /* Bind mount first */
-                { "/sys/fs/selinux", "/sys/fs/selinux", "bind", NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, false },  /* Then, make it r/o */
+                { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND,                      false },  /* Bind mount first */
+                { NULL,              "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, false },  /* Then, make it r/o */
 #endif
         };
 
@@ -289,7 +288,7 @@ static int mount_all(const char *dest) {
                 int t;
 
                 if (asprintf(&where, "%s/%s", dest, mount_table[k].where) < 0) {
-                        log_error("Out of memory");
+                        log_oom();
 
                         if (r == 0)
                                 r = -ENOMEM;
@@ -335,20 +334,16 @@ static int setup_timezone(const char *dest) {
         assert(dest);
 
         /* Fix the timezone, if possible */
-        if (asprintf(&where, "%s/etc/localtime", dest) < 0) {
-                log_error("Out of memory");
-                return -ENOMEM;
-        }
+        if (asprintf(&where, "%s/etc/localtime", dest) < 0)
+                return log_oom();
 
         if (mount("/etc/localtime", where, "bind", MS_BIND, NULL) >= 0)
                 mount("/etc/localtime", where, "bind", MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
 
         free(where);
 
-        if (asprintf(&where, "%s/etc/timezone", dest) < 0) {
-                log_error("Out of memory");
-                return -ENOMEM;
-        }
+        if (asprintf(&where, "%s/etc/timezone", dest) < 0)
+                return log_oom();
 
         if (mount("/etc/timezone", where, "bind", MS_BIND, NULL) >= 0)
                 mount("/etc/timezone", where, "bind", MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
@@ -368,8 +363,7 @@ static int setup_resolv_conf(const char *dest) {
 
         /* Fix resolv.conf, if possible */
         if (asprintf(&where, "%s/etc/resolv.conf", dest) < 0) {
-                log_error("Out of memory");
-                return -ENOMEM;
+                return log_oom();
         }
 
         if (mount("/etc/resolv.conf", where, "bind", MS_BIND, NULL) >= 0)
@@ -480,8 +474,7 @@ static int setup_dev_console(const char *dest, const char *console) {
         }
 
         if (asprintf(&to, "%s/dev/console", dest) < 0) {
-                log_error("Out of memory");
-                r = -ENOMEM;
+                r = log_oom();
                 goto finish;
         }
 
@@ -535,14 +528,12 @@ static int setup_kmsg(const char *dest, int kmsg_socket) {
          * avoid any problems with containers deadlocking due to this
          * we simply make /dev/kmsg unavailable to the container. */
         if (asprintf(&from, "%s/dev/kmsg", dest) < 0) {
-                log_error("Out of memory");
-                r = -ENOMEM;
+                r = log_oom();
                 goto finish;
         }
 
         if (asprintf(&to, "%s/proc/kmsg", dest) < 0) {
-                log_error("Out of memory");
-                r = -ENOMEM;
+                r = log_oom();
                 goto finish;
         }
 
@@ -639,8 +630,7 @@ static int setup_journal(const char *directory) {
 
         p = strappend(directory, "/etc/machine-id");
         if (!p) {
-                log_error("Out of memory");
-                r = -ENOMEM;
+                r = log_oom();
                 goto finish;
         }
 
@@ -670,8 +660,7 @@ static int setup_journal(const char *directory) {
         p = strappend("/var/log/journal/", l);
         q = strjoin(directory, "/var/log/journal/", l, NULL);
         if (!p || !q) {
-                log_error("Out of memory");
-                r = -ENOMEM;
+                r = log_oom();
                 goto finish;
         }
 
@@ -1190,20 +1179,22 @@ int main(int argc, char *argv[]) {
                         goto child_fail;
                 }
 
-                /* Mark / as private, in case somebody marked it shared */
-                if (mount(NULL, "/", NULL, MS_PRIVATE|MS_REC, NULL) < 0) {
-                        log_error("MS_PRIVATE|MS_REC failed: %m");
+                /* Mark everything as slave, so that we still
+                 * receive mounts from the real root, but don't
+                 * propagate mounts to the real root. */
+                if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
+                        log_error("MS_SLAVE|MS_REC failed: %m");
                         goto child_fail;
                 }
 
                 /* Turn directory into bind mount */
-                if (mount(arg_directory, arg_directory, "bind", MS_BIND, NULL) < 0) {
+                if (mount(arg_directory, arg_directory, "bind", MS_BIND|MS_REC, NULL) < 0) {
                         log_error("Failed to make bind mount.");
                         goto child_fail;
                 }
 
                 if (arg_read_only)
-                        if (mount(arg_directory, arg_directory, "bind", MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0) {
+                        if (mount(arg_directory, arg_directory, "bind", MS_BIND|MS_REMOUNT|MS_RDONLY|MS_REC, NULL) < 0) {
                                 log_error("Failed to make read-only.");
                                 goto child_fail;
                         }
@@ -1214,6 +1205,8 @@ int main(int argc, char *argv[]) {
                 if (copy_devnodes(arg_directory) < 0)
                         goto child_fail;
 
+                dev_setup(arg_directory);
+
                 if (setup_dev_console(arg_directory, console) < 0)
                         goto child_fail;
 
@@ -1236,8 +1229,8 @@ int main(int argc, char *argv[]) {
                         goto child_fail;
                 }
 
-                if (mount(arg_directory, "/", "bind", MS_MOVE, NULL) < 0) {
-                        log_error("mount(MS_BIND) failed: %m");
+                if (mount(arg_directory, "/", NULL, MS_MOVE, NULL) < 0) {
+                        log_error("mount(MS_MOVE) failed: %m");
                         goto child_fail;
                 }
 
@@ -1296,13 +1289,13 @@ int main(int argc, char *argv[]) {
                 if ((asprintf((char**)(envp + 3), "HOME=%s", home ? home: "/root") < 0) ||
                     (asprintf((char**)(envp + 4), "USER=%s", arg_user ? arg_user : "root") < 0) ||
                     (asprintf((char**)(envp + 5), "LOGNAME=%s", arg_user ? arg_user : "root") < 0)) {
-                    log_error("Out of memory");
+                    log_oom();
                     goto child_fail;
                 }
 
                 if (arg_uuid) {
                         if (asprintf((char**)(envp + 6), "container_uuid=%s", arg_uuid) < 0) {
-                                log_error("Out of memory");
+                                log_oom();
                                 goto child_fail;
                         }
                 }
Unnamed repository; edit this file 'description' to name the repository.