X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fcore%2Fnamespace.c;h=4b8dbdd0d83d975a2e5f135d280d05f056047f98;hp=5466b7baec2a8cdd96c40ab5619c49b6f8c98e74;hb=615938651d3a4fd9253b08da00db22d451a8cef8;hpb=664064d60c36e1f62c7e9177e4c7498035467e07 diff --git a/src/core/namespace.c b/src/core/namespace.c index 5466b7bae..4b8dbdd0d 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -35,7 +35,6 @@ #include "strv.h" #include "util.h" #include "path-util.h" -#include "namespace.h" #include "missing.h" #include "execute.h" #include "loopback-setup.h" @@ -43,6 +42,8 @@ #include "dev-setup.h" #include "def.h" #include "label.h" +#include "selinux-util.h" +#include "namespace.h" typedef enum MountMode { /* This is ordered by priority! */ @@ -51,6 +52,7 @@ typedef enum MountMode { PRIVATE_TMP, PRIVATE_VAR_TMP, PRIVATE_DEV, + PRIVATE_BUS_ENDPOINT, READWRITE } MountMode; @@ -124,8 +126,7 @@ static void drop_duplicates(BindMount *m, unsigned *n) { if (previous && path_equal(f->path, previous->path)) continue; - t->path = f->path; - t->mode = f->mode; + *t = *f; previous = t; @@ -145,7 +146,7 @@ static int mount_dev(BindMount *m) { "/dev/tty\0"; char temporary_mount[] = "/tmp/namespace-dev-XXXXXX"; - const char *d, *dev = NULL, *devpts = NULL, *devshm = NULL, *devkdbus = NULL, *devhugepages = NULL, *devmqueue = NULL, *devlog = NULL, *devptmx = NULL; + const char *d, *dev = NULL, *devpts = NULL, *devshm = NULL, *devhugepages = NULL, *devmqueue = NULL, *devlog = NULL, *devptmx = NULL; _cleanup_umask_ mode_t u; int r; @@ -157,14 +158,14 @@ static int mount_dev(BindMount *m) { return -errno; dev = strappenda(temporary_mount, "/dev"); - mkdir(dev, 0755); + (void)mkdir(dev, 0755); if (mount("tmpfs", dev, "tmpfs", MS_NOSUID|MS_STRICTATIME, "mode=755") < 0) { r = -errno; goto fail; } devpts = strappenda(temporary_mount, "/dev/pts"); - mkdir(devpts, 0755); + (void)mkdir(devpts, 0755); if (mount("/dev/pts", devpts, NULL, MS_BIND, NULL) < 0) { r = -errno; goto fail; @@ -174,7 +175,7 @@ static int mount_dev(BindMount *m) { symlink("pts/ptmx", devptmx); devshm = strappenda(temporary_mount, "/dev/shm"); - mkdir(devshm, 01777); + (void)mkdir(devshm, 01777); r = mount("/dev/shm", devshm, NULL, MS_BIND, NULL); if (r < 0) { r = -errno; @@ -182,15 +183,11 @@ static int mount_dev(BindMount *m) { } devmqueue = strappenda(temporary_mount, "/dev/mqueue"); - mkdir(devmqueue, 0755); + (void)mkdir(devmqueue, 0755); mount("/dev/mqueue", devmqueue, NULL, MS_BIND, NULL); - devkdbus = strappenda(temporary_mount, "/dev/kdbus"); - mkdir(devkdbus, 0755); - mount("/dev/kdbus", devkdbus, NULL, MS_BIND, NULL); - devhugepages = strappenda(temporary_mount, "/dev/hugepages"); - mkdir(devhugepages, 0755); + (void)mkdir(devhugepages, 0755); mount("/dev/hugepages", devhugepages, NULL, MS_BIND, NULL); devlog = strappenda(temporary_mount, "/dev/log"); @@ -225,9 +222,9 @@ static int mount_dev(BindMount *m) { goto fail; } - label_context_set(d, st.st_mode); + mac_selinux_create_file_prepare(d, st.st_mode); r = mknod(dn, st.st_mode, st.st_rdev); - label_context_clear(); + mac_selinux_create_file_clear(); if (r < 0) { r = -errno; @@ -254,20 +251,87 @@ fail: if (devshm) umount(devshm); - if (devkdbus) - umount(devkdbus); - if (devhugepages) umount(devhugepages); if (devmqueue) umount(devmqueue); - if (dev) { - umount(dev); - rmdir(dev); + umount(dev); + rmdir(dev); + rmdir(temporary_mount); + + return r; +} + +static int mount_kdbus(BindMount *m) { + + char temporary_mount[] = "/tmp/kdbus-dev-XXXXXX"; + _cleanup_free_ char *basepath = NULL; + _cleanup_umask_ mode_t u; + char *busnode = NULL, *root; + struct stat st; + int r; + + assert(m); + + u = umask(0000); + + if (!mkdtemp(temporary_mount)) + return log_error_errno(errno, "Failed create temp dir: %m"); + + root = strappenda(temporary_mount, "/kdbus"); + (void)mkdir(root, 0755); + if (mount("tmpfs", root, "tmpfs", MS_NOSUID|MS_STRICTATIME, "mode=777") < 0) { + r = -errno; + goto fail; + } + + /* create a new /dev/null dev node copy so we have some fodder to + * bind-mount the custom endpoint over. */ + if (stat("/dev/null", &st) < 0) { + log_error_errno(errno, "Failed to stat /dev/null: %m"); + r = -errno; + goto fail; + } + + busnode = strappenda(root, "/bus"); + if (mknod(busnode, (st.st_mode & ~07777) | 0600, st.st_rdev) < 0) { + log_error_errno(errno, "mknod() for %s failed: %m", busnode); + r = -errno; + goto fail; + } + + r = mount(m->path, busnode, "bind", MS_BIND, NULL); + if (r < 0) { + log_error_errno(errno, "bind mount of %s failed: %m", m->path); + r = -errno; + goto fail; + } + + basepath = dirname_malloc(m->path); + if (!basepath) { + r = -ENOMEM; + goto fail; + } + + if (mount(root, basepath, NULL, MS_MOVE, NULL) < 0) { + log_error_errno(errno, "bind mount of %s failed: %m", basepath); + r = -errno; + goto fail; } + rmdir(temporary_mount); + return 0; + +fail: + if (busnode) { + umount(busnode); + unlink(busnode); + } + + umount(root); + rmdir(root); rmdir(temporary_mount); return r; @@ -312,6 +376,9 @@ static int apply_mount( case PRIVATE_DEV: return mount_dev(m); + case PRIVATE_BUS_ENDPOINT: + return mount_kdbus(m); + default: assert_not_reached("Unknown mode"); } @@ -349,12 +416,13 @@ int setup_namespace( char** read_write_dirs, char** read_only_dirs, char** inaccessible_dirs, - char* tmp_dir, - char* var_tmp_dir, + const char* tmp_dir, + const char* var_tmp_dir, + const char* bus_endpoint_path, bool private_dev, ProtectHome protect_home, ProtectSystem protect_system, - unsigned mount_flags) { + unsigned long mount_flags) { BindMount *m, *mounts = NULL; unsigned n; @@ -366,7 +434,7 @@ int setup_namespace( if (unshare(CLONE_NEWNS) < 0) return -errno; - n = !!tmp_dir + !!var_tmp_dir + + n = !!tmp_dir + !!var_tmp_dir + !!bus_endpoint_path + strv_length(read_write_dirs) + strv_length(read_only_dirs) + strv_length(inaccessible_dirs) + @@ -407,6 +475,12 @@ int setup_namespace( m++; } + if (bus_endpoint_path) { + m->path = bus_endpoint_path; + m->mode = PRIVATE_BUS_ENDPOINT; + m++; + } + if (protect_home != PROTECT_HOME_NO) { r = append_mounts(&m, STRV_MAKE("-/home", "-/run/user", "-/root"), protect_home == PROTECT_HOME_READ_ONLY ? READONLY : INACCESSIBLE); if (r < 0)