X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fmount-setup.c;h=ec4184de5843611c4f494e0a3bc8452ae28da9b3;hp=6efc48e4dce8c493e669442ff1ee479b4ffd1d99;hb=ff01d048b4c1455241c894cf7982662c9d28fd34;hpb=9fe117ea5ac7e8fc36312324c7fdc851adff59f3 diff --git a/src/mount-setup.c b/src/mount-setup.c index 6efc48e4d..ec4184de5 100644 --- a/src/mount-setup.c +++ b/src/mount-setup.c @@ -35,6 +35,10 @@ #include "util.h" #include "label.h" +#ifndef TTY_GID +#define TTY_GID 5 +#endif + typedef struct MountPoint { const char *what; const char *where; @@ -44,24 +48,28 @@ typedef struct MountPoint { bool fatal; } MountPoint; +/* The first three entries we might need before SELinux is up. The + * other ones we can delay until SELinux is loaded. */ +#define N_EARLY_MOUNT 3 + static const MountPoint mount_table[] = { { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true }, { "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true }, { "devtmpfs", "/dev", "devtmpfs", "mode=755", MS_NOSUID, true }, - { "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NOEXEC|MS_NODEV, true }, - { "devpts", "/dev/pts", "devpts", NULL, MS_NOSUID|MS_NOEXEC, false }, - { "tmpfs", "/sys/fs/cgroup", "tmpfs", "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV, true }, - { "cgroup", "/sys/fs/cgroup/systemd", "cgroup", "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV, true }, + { "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV, true }, + { "devpts", "/dev/pts", "devpts", "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC, false }, + { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV, true }, + { "tmpfs", "/sys/fs/cgroup", "tmpfs", "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV, false }, + { "cgroup", "/sys/fs/cgroup/systemd", "cgroup", "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV, false }, }; /* These are API file systems that might be mounted by other software, - * we just list them here so that we know that we should igore them */ + * we just list them here so that we know that we should ignore them */ static const char * const ignore_paths[] = { + "/sys/fs/selinux", "/selinux", - "/proc/bus/usb", - "/var/lib/nfs/rpc_pipefs", - "/proc/fs/nfsd" + "/proc/bus/usb" }; bool mount_point_is_api(const char *path) { @@ -78,7 +86,7 @@ bool mount_point_is_api(const char *path) { } bool mount_point_ignore(const char *path) { - unsigned i; + unsigned i; for (i = 0; i < ELEMENTSOF(ignore_paths); i++) if (path_equal(path, ignore_paths[i])) @@ -87,11 +95,15 @@ bool mount_point_ignore(const char *path) { return false; } -static int mount_one(const MountPoint *p) { +static int mount_one(const MountPoint *p, bool relabel) { int r; assert(p); + /* Relabel first, just in case */ + if (relabel) + label_fix(p->where, true); + if ((r = path_is_mount_point(p->where)) < 0) return r; @@ -117,20 +129,43 @@ static int mount_one(const MountPoint *p) { return p->fatal ? -errno : 0; } - label_fix(p->where); + /* Relabel again, since we now mounted something fresh here */ + if (relabel) + label_fix(p->where, false); return 0; } +int mount_setup_early(void) { + unsigned i; + int r = 0; + + assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table)); + + /* Do a minimal mount of /proc and friends to enable the most + * basic stuff, such as SELinux */ + for (i = 0; i < N_EARLY_MOUNT; i ++) { + int j; + + j = mount_one(mount_table + i, false); + if (r == 0) + r = j; + } + + return r; +} + static int mount_cgroup_controllers(void) { int r; FILE *f; - char buf [256]; + char buf[LINE_MAX]; /* Mount all available cgroup controllers that are built into the kernel. */ - if (!(f = fopen("/proc/cgroups", "re"))) - return -ENOENT; + if (!(f = fopen("/proc/cgroups", "re"))) { + log_error("Failed to enumerate cgroup controllers: %m"); + return 0; + } /* Ignore the header line */ (void) fgets(buf, sizeof(buf), f); @@ -138,8 +173,9 @@ static int mount_cgroup_controllers(void) { for (;;) { MountPoint p; char *controller, *where; + int enabled = false; - if (fscanf(f, "%ms %*i %*i %*i", &controller) != 1) { + if (fscanf(f, "%ms %*i %*i %i", &controller, &enabled) != 2) { if (feof(f)) break; @@ -149,6 +185,11 @@ static int mount_cgroup_controllers(void) { goto finish; } + if (!enabled) { + free(controller); + continue; + } + if (asprintf(&where, "/sys/fs/cgroup/%s", controller) < 0) { free(controller); r = -ENOMEM; @@ -163,7 +204,7 @@ static int mount_cgroup_controllers(void) { p.flags = MS_NOSUID|MS_NOEXEC|MS_NODEV; p.fatal = false; - r = mount_one(&p); + r = mount_one(&p, true); free(controller); free(where); @@ -206,41 +247,59 @@ static int nftw_cb( if (ftwbuf->level == 0) return 0; - label_fix(fpath); + label_fix(fpath, true); return 0; }; -int mount_setup(void) { +int mount_setup(bool loaded_policy) { - const char *symlinks = + const char symlinks[] = "/proc/kcore\0" "/dev/core\0" "/proc/self/fd\0" "/dev/fd\0" "/proc/self/fd/0\0" "/dev/stdin\0" "/proc/self/fd/1\0" "/dev/stdout\0" - "/proc/self/fd/2\0" "/dev/stderr\0" - "\0"; + "/proc/self/fd/2\0" "/dev/stderr\0"; int r; unsigned i; const char *j, *k; - for (i = 0; i < ELEMENTSOF(mount_table); i ++) - if ((r = mount_one(mount_table+i)) < 0) + for (i = 0; i < ELEMENTSOF(mount_table); i ++) { + r = mount_one(mount_table + i, true); + + if (r < 0) return r; + } - /* Nodes in devtmpfs need to be manually updated for the - * appropriate labels, after mounting. The other virtual API - * file systems do not need. */ + /* Nodes in devtmpfs and /run need to be manually updated for + * the appropriate labels, after mounting. The other virtual + * API file systems like /sys and /proc do not need that, they + * use the same label for all their files. */ + if (loaded_policy) { + usec_t before_relabel, after_relabel; + char timespan[FORMAT_TIMESPAN_MAX]; + + before_relabel = now(CLOCK_MONOTONIC); - if (unlink("/dev/.systemd/relabel-devtmpfs") >= 0) nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS); + nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS); + + after_relabel = now(CLOCK_MONOTONIC); + + log_info("Relabelled /dev and /run in %s.", + format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel)); + + } /* Create a few default symlinks, which are normally created - * bei udevd, but some scripts might need them before we start + * by udevd, but some scripts might need them before we start * udevd. */ - NULSTR_FOREACH_PAIR(j, k, symlinks) symlink_and_label(j, k); + /* Create a few directories we always want around */ + mkdir("/run/systemd", 0755); + mkdir("/run/systemd/system", 0755); + return mount_cgroup_controllers(); }