#include <signal.h>
#include <sched.h>
#include <unistd.h>
-#include <attr/xattr.h>
#include <sys/types.h>
#include <sys/syscall.h>
#include <sys/mount.h>
#include <sys/signalfd.h>
#include <grp.h>
#include <linux/fs.h>
+#include <linux/netlink.h>
#include <sys/un.h>
#include <sys/socket.h>
+#ifdef HAVE_XATTR
+#include <attr/xattr.h>
+#endif
+
#include <systemd/sd-daemon.h>
#include "log.h"
}
static int save_attributes(const char *cgroup, pid_t pid, const char *uuid, const char *directory) {
+#ifdef HAVE_XATTR
_cleanup_free_ char *path = NULL;
char buf[DECIMAL_STR_MAX(pid_t)];
int r = 0, k;
assert(pid >= 0);
assert(arg_directory);
-#ifdef HAVE_XATTR
assert_se(snprintf(buf, sizeof(buf), "%lu", (unsigned long) pid) < (int) sizeof(buf));
r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, cgroup, NULL, &path);
if (r == 0)
r = k;
}
-#endif
return r;
+#else
+ return 0;
+#endif
}
static int drop_capabilities(void) {
return r;
}
+static bool audit_enabled(void) {
+ int fd;
+
+ fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_AUDIT);
+ if (fd >= 0) {
+ close_nointr_nofail(fd);
+ return true;
+ }
+ return false;
+}
+
int main(int argc, char *argv[]) {
pid_t pid = 0;
int r = EXIT_FAILURE, k;
- _cleanup_free_ char *machine_root = NULL, *name = NULL, *escaped = NULL, *newcg = NULL;
+ _cleanup_free_ char *newcg = NULL;
_cleanup_close_ int master = -1;
int n_fd_passed;
const char *console = NULL;
goto finish;
}
- hostname_cleanup(arg_machine);
+ hostname_cleanup(arg_machine, false);
if (isempty(arg_machine)) {
log_error("Failed to determine machine name automatically, please use -M.");
goto finish;
goto finish;
}
+ if (arg_boot && audit_enabled()) {
+ log_warning("The kernel auditing subsystem is known to be incompatible with containers.\n"
+ "Please make sure to turn off auditing with 'audit=0' on the kernel command\n"
+ "line before using systemd-nspawn. Sleeping for 5s...\n");
+ sleep(5);
+ }
+
if (path_equal(arg_directory, "/")) {
log_error("Spawning container on root directory not supported.");
goto finish;
}
if (path_is_os_tree(arg_directory) <= 0) {
- log_error("Directory %s doesn't look like an OS root directory. Refusing.", arg_directory);
+ log_error("Directory %s doesn't look like an OS root directory (/etc/os-release is missing). Refusing.", arg_directory);
goto finish;
}
fdset_close_others(fds);
log_open();
- k = cg_get_machine_path(&machine_root);
+ k = cg_get_machine_path(arg_machine, &newcg);
if (k < 0) {
log_error("Failed to determine machine cgroup path: %s", strerror(-k));
goto finish;
}
- name = strappend(arg_machine, ".nspawn");
- if (!name) {
- log_oom();
- goto finish;
- }
-
- escaped = cg_escape(name);
- if (!escaped) {
- log_oom();
- goto finish;
- }
-
- newcg = strjoin(machine_root, "/", escaped, NULL);
- if (!newcg) {
- log_oom();
- goto finish;
- }
-
k = cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, newcg, true);
if (k <= 0 && k != -ENOENT) {
log_error("Container already running.");
}
if (status.si_code == CLD_EXITED) {
+ r = status.si_status;
if (status.si_status != 0) {
log_error("Container failed with error code %i.", status.si_status);
- r = status.si_status;
break;
}