X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fnspawn%2Fnspawn.c;h=e5a24dda70c0460ea6fb7931de869f87c3cd9e27;hp=1bfc99d5fcaa37129fcd6e85304caa54e8fa959c;hb=080e78329a742dd95bdee321fee81c305e073491;hpb=ec16945ebfe64d5cd5403ae1a1b16bc05a779a16 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 1bfc99d5f..e5a24dda7 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -31,7 +31,6 @@ #include #include #include -#include #include #include #include @@ -90,8 +89,10 @@ #include "base-filesystem.h" #include "barrier.h" #include "event-util.h" +#include "capability.h" #include "cap-list.h" #include "btrfs-util.h" +#include "machine-image.h" #ifdef HAVE_SECCOMP #include "seccomp-util.h" @@ -477,15 +478,19 @@ static int parse_argv(int argc, char *argv[]) { break; case ARG_LINK_JOURNAL: - if (streq(optarg, "auto")) + if (streq(optarg, "auto")) { arg_link_journal = LINK_AUTO; - else if (streq(optarg, "no")) + arg_link_journal_try = false; + } else if (streq(optarg, "no")) { arg_link_journal = LINK_NO; - else if (streq(optarg, "guest")) + arg_link_journal_try = false; + } else if (streq(optarg, "guest")) { arg_link_journal = LINK_GUEST; - else if (streq(optarg, "host")) + arg_link_journal_try = false; + } else if (streq(optarg, "host")) { arg_link_journal = LINK_HOST; - else if (streq(optarg, "try-guest")) { + arg_link_journal_try = false; + } else if (streq(optarg, "try-guest")) { arg_link_journal = LINK_GUEST; arg_link_journal_try = true; } else if (streq(optarg, "try-host")) { @@ -683,6 +688,11 @@ static int parse_argv(int argc, char *argv[]) { return -EINVAL; } + if (arg_ephemeral && !IN_SET(arg_link_journal, LINK_NO, LINK_AUTO)) { + log_error("--ephemeral and --link-journal= may not be combined."); + return -EINVAL; + } + if (arg_volatile != VOLATILE_NO && arg_read_only) { log_error("Cannot combine --read-only with --volatile. Note that --volatile already implies a read-only base hierarchy."); return -EINVAL; @@ -859,6 +869,112 @@ static int mount_binds(const char *dest, char **l, bool ro) { return 0; } +static int mount_cgroup_hierarchy(const char *dest, const char *controller, const char *hierarchy, bool read_only) { + char *to; + int r; + + to = strappenda(dest, "/sys/fs/cgroup/", hierarchy); + + r = path_is_mount_point(to, false); + if (r < 0) + return log_error_errno(r, "Failed to determine if %s is mounted already: %m", to); + if (r > 0) + return 0; + + mkdir_p(to, 0755); + + if (mount("cgroup", to, "cgroup", MS_NOSUID|MS_NOEXEC|MS_NODEV|(read_only ? MS_RDONLY : 0), controller) < 0) + return log_error_errno(errno, "Failed to mount to %s: %m", to); + + return 1; +} + +static int mount_cgroup(const char *dest) { + _cleanup_set_free_free_ Set *controllers = NULL; + _cleanup_free_ char *own_cgroup_path = NULL; + const char *cgroup_root, *systemd_root, *systemd_own; + int r; + + controllers = set_new(&string_hash_ops); + if (!controllers) + return log_oom(); + + r = cg_kernel_controllers(controllers); + if (r < 0) + return log_error_errno(r, "Failed to determine cgroup controllers: %m"); + + r = cg_pid_get_path(NULL, 0, &own_cgroup_path); + if (r < 0) + return log_error_errno(r, "Failed to determine our own cgroup path: %m"); + + cgroup_root = strappenda(dest, "/sys/fs/cgroup"); + if (mount("tmpfs", cgroup_root, "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, "mode=755") < 0) + return log_error_errno(errno, "Failed to mount tmpfs to /sys/fs/cgroup: %m"); + + for (;;) { + _cleanup_free_ char *controller = NULL, *origin = NULL, *combined = NULL; + + controller = set_steal_first(controllers); + if (!controller) + break; + + origin = strappend("/sys/fs/cgroup/", controller); + if (!origin) + return log_oom(); + + r = readlink_malloc(origin, &combined); + if (r == -EINVAL) { + /* Not a symbolic link, but directly a single cgroup hierarchy */ + + r = mount_cgroup_hierarchy(dest, controller, controller, true); + if (r < 0) + return r; + + } else if (r < 0) + return log_error_errno(r, "Failed to read link %s: %m", origin); + else { + _cleanup_free_ char *target = NULL; + + target = strjoin(dest, "/sys/fs/cgroup/", controller, NULL); + if (!target) + return log_oom(); + + /* A symbolic link, a combination of controllers in one hierarchy */ + + if (!filename_is_valid(combined)) { + log_warning("Ignoring invalid combined hierarchy %s.", combined); + continue; + } + + r = mount_cgroup_hierarchy(dest, combined, combined, true); + if (r < 0) + return r; + + if (symlink(combined, target) < 0) + return log_error_errno(errno, "Failed to create symlink for combined hiearchy: %m"); + } + } + + r = mount_cgroup_hierarchy(dest, "name=systemd", "systemd", false); + if (r < 0) + return r; + + /* Make our own cgroup a (writable) bind mount */ + systemd_own = strappenda(dest, "/sys/fs/cgroup/systemd", own_cgroup_path); + if (mount(systemd_own, systemd_own, NULL, MS_BIND, NULL) < 0) + return log_error_errno(errno, "Failed to turn %s into a bind mount: %m", own_cgroup_path); + + /* And then remount the systemd cgroup root read-only */ + systemd_root = strappenda(dest, "/sys/fs/cgroup/systemd"); + if (mount(NULL, systemd_root, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, NULL) < 0) + return log_error_errno(errno, "Failed to mount cgroup root read-only: %m"); + + if (mount(NULL, cgroup_root, NULL, MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755") < 0) + return log_error_errno(errno, "Failed to remount %s read-only: %m", cgroup_root); + + return 0; +} + static int mount_tmpfs(const char *dest) { char **i, **o; @@ -1175,7 +1291,7 @@ static int copy_devnodes(const char *dest) { } if (mknod(to, st.st_mode, st.st_rdev) < 0) - return log_error_errno(errno, "mknod(%s) failed: %m", dest); + return log_error_errno(errno, "mknod(%s) failed: %m", to); } } @@ -1313,6 +1429,10 @@ static int setup_journal(const char *directory) { char *id; int r; + /* Don't link journals in ephemeral mode */ + if (arg_ephemeral) + return 0; + p = strappend(directory, "/etc/machine-id"); if (!p) return log_oom(); @@ -1341,8 +1461,7 @@ static int setup_journal(const char *directory) { "Host and machine ids are equal (%s): refusing to link journals", id); if (arg_link_journal == LINK_AUTO) return 0; - return - -EEXIST; + return -EEXIST; } if (arg_link_journal == LINK_NO) @@ -2070,6 +2189,27 @@ finish: } +static int setup_propagate(const char *root) { + const char *p, *q; + + (void) mkdir_p("/run/systemd/nspawn/", 0755); + (void) mkdir_p("/run/systemd/nspawn/propagate", 0600); + p = strappenda("/run/systemd/nspawn/propagate/", arg_machine); + (void) mkdir_p(p, 0600); + + q = strappenda(root, "/run/systemd/nspawn/incoming"); + mkdir_parents(q, 0755); + mkdir_p(q, 0600); + + if (mount(p, q, NULL, MS_BIND, NULL) < 0) + return log_error_errno(errno, "Failed to install propagation bind mount."); + + if (mount(NULL, q, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0) + return log_error_errno(errno, "Failed to make propagation mount read-only"); + + return 0; +} + static int setup_image(char **device_path, int *loop_nr) { struct loop_info64 info = { .lo_flags = LO_FLAGS_AUTOCLEAR|LO_FLAGS_PARTSCAN @@ -2849,21 +2989,43 @@ static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo } static int determine_names(void) { + int r; if (!arg_image && !arg_directory) { - if (arg_machine) - arg_directory = strappend("/var/lib/container/", arg_machine); - else + if (arg_machine) { + _cleanup_(image_unrefp) Image *i = NULL; + + r = image_find(arg_machine, &i); + if (r < 0) + return log_error_errno(r, "Failed to find image for machine '%s': %m", arg_machine); + else if (r == 0) { + log_error("No image for machine '%s': %m", arg_machine); + return -ENOENT; + } + + if (i->type == IMAGE_GPT) + r = set_sanitized_path(&arg_image, i->path); + else + r = set_sanitized_path(&arg_directory, i->path); + if (r < 0) + return log_error_errno(r, "Invalid image directory: %m"); + + arg_read_only = arg_read_only || i->read_only; + } else arg_directory = get_current_dir_name(); - if (!arg_directory) { - log_error("Failed to determine path, please use -D."); + if (!arg_directory && !arg_machine) { + log_error("Failed to determine path, please use -D or -i."); return -EINVAL; } } if (!arg_machine) { - arg_machine = strdup(basename(arg_image ?: arg_directory)); + if (arg_directory && path_equal(arg_directory, "/")) + arg_machine = gethostname_malloc(); + else + arg_machine = strdup(basename(arg_image ?: arg_directory)); + if (!arg_machine) return log_oom(); @@ -2872,6 +3034,21 @@ static int determine_names(void) { log_error("Failed to determine machine name automatically, please use -M."); return -EINVAL; } + + if (arg_ephemeral) { + char *b; + + /* Add a random suffix when this is an + * ephemeral machine, so that we can run many + * instances at once without manually having + * to specify -M each time. */ + + if (asprintf(&b, "%s-%016" PRIx64, arg_machine, random_u64()) < 0) + return log_oom(); + + free(arg_machine); + arg_machine = b; + } } return 0; @@ -2879,13 +3056,12 @@ static int determine_names(void) { int main(int argc, char *argv[]) { - _cleanup_free_ char *device_path = NULL, *root_device = NULL, *home_device = NULL, *srv_device = NULL; + _cleanup_free_ char *device_path = NULL, *root_device = NULL, *home_device = NULL, *srv_device = NULL, *console = NULL; bool root_device_rw = true, home_device_rw = true, srv_device_rw = true; _cleanup_close_ int master = -1, image_fd = -1; _cleanup_close_pair_ int kmsg_socket_pair[2] = { -1, -1 }; _cleanup_fdset_free_ FDSet *fds = NULL; int r, n_fd_passed, loop_nr = -1; - const char *console = NULL; char veth_name[IFNAMSIZ]; bool secondary = false, remove_subvol = false; sigset_t mask, mask_chld; @@ -2930,8 +3106,8 @@ int main(int argc, char *argv[]) { if (arg_directory) { assert(!arg_image); - if (path_equal(arg_directory, "/")) { - log_error("Spawning container on root directory not supported."); + if (path_equal(arg_directory, "/") && !arg_ephemeral) { + log_error("Spawning container on root directory is not supported. Consider using --ephemeral."); r = -EINVAL; goto finish; } @@ -2952,7 +3128,21 @@ int main(int argc, char *argv[]) { } else if (arg_ephemeral) { char *np; - r = tempfn_random(arg_directory, &np); + /* If the specified path is a mount point we + * generate the new snapshot immediately + * inside it under a random name. However if + * the specified is not a mount point we + * create the new snapshot in the parent + * directory, just next to it. */ + r = path_is_mount_point(arg_directory, false); + if (r < 0) { + log_error_errno(r, "Failed to determine whether directory %s is mount point: %m", arg_directory); + goto finish; + } + if (r > 0) + r = tempfn_random_child(arg_directory, &np); + else + r = tempfn_random(arg_directory, &np); if (r < 0) { log_error_errno(r, "Failed to generate name for snapshot: %m"); goto finish; @@ -3028,9 +3218,9 @@ int main(int argc, char *argv[]) { goto finish; } - console = ptsname(master); - if (!console) { - r = log_error_errno(errno, "Failed to determine tty name: %m"); + r = ptsname_malloc(master, &console); + if (r < 0) { + r = log_error_errno(r, "Failed to determine tty name: %m"); goto finish; } @@ -3048,10 +3238,6 @@ int main(int argc, char *argv[]) { goto finish; } - sd_notify(false, - "READY=1\n" - "STATUS=Container running."); - assert_se(sigemptyset(&mask) == 0); sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1); assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0); @@ -3088,9 +3274,9 @@ int main(int argc, char *argv[]) { goto finish; } - pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWNS| - (arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS)| - (arg_private_network ? CLONE_NEWNET : 0), NULL); + pid = raw_clone(SIGCHLD|CLONE_NEWNS| + (arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS)| + (arg_private_network ? CLONE_NEWNET : 0), NULL); if (pid < 0) { if (errno == EINVAL) r = log_error_errno(errno, "clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m"); @@ -3215,6 +3401,9 @@ int main(int argc, char *argv[]) { dev_setup(arg_directory); + if (setup_propagate(arg_directory) < 0) + _exit(EXIT_FAILURE); + if (setup_seccomp() < 0) _exit(EXIT_FAILURE); @@ -3226,6 +3415,11 @@ int main(int argc, char *argv[]) { kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]); + /* Tell the parent that we are ready, and that + * it can cgroupify us to that we lack access + * to certain devices and resources. */ + (void) barrier_place(&barrier); + if (setup_boot_id(arg_directory) < 0) _exit(EXIT_FAILURE); @@ -3247,10 +3441,12 @@ int main(int argc, char *argv[]) { if (mount_tmpfs(arg_directory) < 0) _exit(EXIT_FAILURE); - /* Tell the parent that we are ready, and that - * it can cgroupify us to that we lack access - * to certain devices and resources. */ - (void)barrier_place(&barrier); + /* Wait until we are cgroup-ified, so that we + * can mount the right cgroup path writable */ + (void) barrier_sync_next(&barrier); + + if (mount_cgroup(arg_directory) < 0) + _exit(EXIT_FAILURE); if (chdir(arg_directory) < 0) { log_error_errno(errno, "chdir(%s) failed: %m", arg_directory); @@ -3389,10 +3585,13 @@ int main(int argc, char *argv[]) { fdset_free(fds); fds = NULL; - /* wait for child-setup to be done */ - if (barrier_place_and_sync(&barrier)) { + /* Wait for the most basic Child-setup to be done, + * before we add hardware to it, and place it in a + * cgroup. */ + if (barrier_sync_next(&barrier)) { _cleanup_event_unref_ sd_event *event = NULL; _cleanup_(pty_forward_freep) PTYForward *forward = NULL; + char last_char = 0; int ifi = 0; r = move_network_interfaces(pid); @@ -3429,7 +3628,14 @@ int main(int argc, char *argv[]) { /* Notify the child that the parent is ready with all * its setup, and that the child can now hand over * control to the code to run inside the container. */ - (void)barrier_place(&barrier); + (void) barrier_place(&barrier); + + /* And wait that the child is completely ready now. */ + (void) barrier_place_and_sync(&barrier); + + sd_notify(false, + "READY=1\n" + "STATUS=Container running."); r = sd_event_new(&event); if (r < 0) { @@ -3450,7 +3656,7 @@ int main(int argc, char *argv[]) { /* simply exit on sigchld */ sd_event_add_signal(event, NULL, SIGCHLD, NULL, NULL); - r = pty_forward_new(event, master, &forward); + r = pty_forward_new(event, master, true, &forward); if (r < 0) { log_error_errno(r, "Failed to create PTY forwarder: %m"); goto finish; @@ -3462,9 +3668,11 @@ int main(int argc, char *argv[]) { goto finish; } + pty_forward_get_last_char(forward, &last_char); + forward = pty_forward_free(forward); - if (!arg_quiet) + if (!arg_quiet && last_char != '\n') putc('\n', stdout); /* Kill if it is not dead yet anyway */ @@ -3526,6 +3734,13 @@ finish: log_warning_errno(k, "Cannot remove subvolume '%s', ignoring: %m", arg_directory); } + if (arg_machine) { + const char *p; + + p = strappenda("/run/systemd/nspawn/propagate", arg_machine); + (void) rm_rf(p, false, true, false); + } + free(arg_directory); free(arg_template); free(arg_image);