static char **arg_bind_ro = NULL;
static char **arg_setenv = NULL;
static bool arg_quiet = false;
+static bool arg_share_system = false;
+static bool arg_register = true;
+static bool arg_keep_unit = false;
static int help(void) {
" Set the SELinux security context to be used by\n"
" API/tmpfs file systems in the container\n"
" --private-network Disable network in container\n"
+ " --share-system Share system namespaces with host\n"
" --read-only Mount the root directory read-only\n"
" --capability=CAP In addition to the default, retain specified\n"
" capability\n"
" the container\n"
" --bind-ro=PATH[:PATH] Similar, but creates a read-only bind mount\n"
" --setenv=NAME=VALUE Pass an environment variable to PID 1\n"
+ " --register=BOOLEAN Register container as machine\n"
+ " --keep-unit Do not register a scope for the machine, reuse\n"
+ " the service unit nspawn is running in\n"
" -q --quiet Do not show status information\n",
program_invocation_short_name);
ARG_BIND,
ARG_BIND_RO,
ARG_SETENV,
+ ARG_SHARE_SYSTEM,
+ ARG_REGISTER,
+ ARG_KEEP_UNIT
};
static const struct option options[] = {
{ "selinux-context", required_argument, NULL, 'Z' },
{ "selinux-apifs-context", required_argument, NULL, 'L' },
{ "quiet", no_argument, NULL, 'q' },
+ { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM },
+ { "register", required_argument, NULL, ARG_REGISTER },
+ { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
{}
};
break;
case 'M':
- if (!hostname_is_valid(optarg)) {
- log_error("Invalid machine name: %s", optarg);
- return -EINVAL;
- }
+ if (isempty(optarg)) {
+ free(arg_machine);
+ arg_machine = NULL;
+ } else {
- free(arg_machine);
- arg_machine = strdup(optarg);
- if (!arg_machine)
- return log_oom();
+ if (!hostname_is_valid(optarg)) {
+ log_error("Invalid machine name: %s", optarg);
+ return -EINVAL;
+ }
- break;
+ free(arg_machine);
+ arg_machine = strdup(optarg);
+ if (!arg_machine)
+ return log_oom();
+
+ break;
+ }
case 'Z':
arg_selinux_context = optarg;
arg_quiet = true;
break;
+ case ARG_SHARE_SYSTEM:
+ arg_share_system = true;
+ break;
+
+ case ARG_REGISTER:
+ r = parse_boolean(optarg);
+ if (r < 0) {
+ log_error("Failed to parse --register= argument: %s", optarg);
+ return r;
+ }
+
+ arg_register = r;
+ break;
+
+ case ARG_KEEP_UNIT:
+ arg_keep_unit = true;
+ break;
+
case '?':
return -EINVAL;
}
}
+ if (arg_share_system)
+ arg_register = false;
+
+ if (arg_boot && arg_share_system) {
+ log_error("--boot and --share-system may not be combined.");
+ return -EINVAL;
+ }
+
+ if (arg_keep_unit && cg_pid_get_owner_uid(0, NULL) >= 0) {
+ log_error("--keep-unit may not be used when invoked from a user session.");
+ return -EINVAL;
+ }
+
return 1;
}
assert(dest);
+ if (arg_share_system)
+ return 0;
+
/* Generate a new randomized boot ID, so that each boot-up of
* the container gets a new one */
static int setup_hostname(void) {
+ if (arg_share_system)
+ return 0;
+
if (sethostname(arg_machine, strlen(arg_machine)) < 0)
return -errno;
_cleanup_bus_unref_ sd_bus *bus = NULL;
int r;
+ if (!arg_register)
+ return 0;
+
r = sd_bus_default_system(&bus);
if (r < 0) {
log_error("Failed to open system bus: %s", strerror(-r));
return r;
}
- r = sd_bus_call_method(
- bus,
- "org.freedesktop.machine1",
- "/org/freedesktop/machine1",
- "org.freedesktop.machine1.Manager",
- "CreateMachine",
- &error,
- NULL,
- "sayssusa(sv)",
- arg_machine,
- SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
- "nspawn",
- "container",
- (uint32_t) pid,
- strempty(arg_directory),
- !isempty(arg_slice), "Slice", "s", arg_slice);
+ if (arg_keep_unit) {
+ r = sd_bus_call_method(
+ bus,
+ "org.freedesktop.machine1",
+ "/org/freedesktop/machine1",
+ "org.freedesktop.machine1.Manager",
+ "RegisterMachine",
+ &error,
+ NULL,
+ "sayssus",
+ arg_machine,
+ SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
+ "nspawn",
+ "container",
+ (uint32_t) pid,
+ strempty(arg_directory));
+ } else {
+ r = sd_bus_call_method(
+ bus,
+ "org.freedesktop.machine1",
+ "/org/freedesktop/machine1",
+ "org.freedesktop.machine1.Manager",
+ "CreateMachine",
+ &error,
+ NULL,
+ "sayssusa(sv)",
+ arg_machine,
+ SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
+ "nspawn",
+ "container",
+ (uint32_t) pid,
+ strempty(arg_directory),
+ !isempty(arg_slice), "Slice", "s", arg_slice);
+ }
+
if (r < 0) {
log_error("Failed to register machine: %s", bus_error_message(&error, r));
return r;
const char *path;
int r;
+ if (!arg_register)
+ return 0;
+
r = sd_bus_default_system(&bus);
if (r < 0) {
log_error("Failed to open system bus: %s", strerror(-r));
return 0;
}
-static bool audit_enabled(void) {
- int fd;
+static int reset_audit_loginuid(void) {
+ _cleanup_free_ char *p = NULL;
+ int r;
- fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_AUDIT);
- if (fd >= 0) {
- close_nointr_nofail(fd);
- return true;
+ if (arg_share_system)
+ return 0;
+
+ r = read_one_line_file("/proc/self/loginuid", &p);
+ if (r == -EEXIST)
+ return 0;
+ if (r < 0) {
+ log_error("Failed to read /proc/self/loginuid: %s", strerror(-r));
+ return r;
+ }
+
+ /* Already reset? */
+ if (streq(p, "4294967295"))
+ return 0;
+
+ r = write_string_file("/proc/self/loginuid", "4294967295");
+ if (r < 0) {
+ log_error("Failed to reset audit login UID. This probably means that your kernel is too\n"
+ "old and you have audit enabled. Note that the auditing subsystem is known to\n"
+ "be incompatible with containers on old kernels. Please make sure to upgrade\n"
+ "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
+ "using systemd-nspawn. Sleeping for 5s... (%s)\n", strerror(-r));
+
+ sleep(5);
}
- return false;
+
+ return 0;
}
int main(int argc, char *argv[]) {
_cleanup_close_pipe_ int kmsg_socket_pair[2] = { -1, -1 };
_cleanup_fdset_free_ FDSet *fds = NULL;
_cleanup_free_ char *kdbus_domain = NULL;
- const char *ns;
log_parse_environment();
log_open();
goto finish;
}
- if (arg_boot && audit_enabled()) {
- log_warning("The kernel auditing subsystem is known to be incompatible with containers.\n"
- "Please make sure to turn off auditing with 'audit=0' on the kernel command\n"
- "line before using systemd-nspawn. Sleeping for 5s...\n");
- sleep(5);
- }
-
if (path_equal(arg_directory, "/")) {
log_error("Spawning container on root directory not supported.");
goto finish;
goto finish;
}
- ns = strappenda("machine-", arg_machine);
- kdbus_fd = bus_kernel_create_domain(ns, &kdbus_domain);
- if (r < 0)
- log_debug("Failed to create kdbus domain: %s", strerror(-r));
- else
- log_debug("Successfully created kdbus domain as %s", kdbus_domain);
+
+ if (access("/dev/kdbus/control", F_OK) >= 0) {
+
+ if (arg_share_system) {
+ kdbus_domain = strdup("/dev/kdbus");
+ if (!kdbus_domain) {
+ log_oom();
+ goto finish;
+ }
+ } else {
+ const char *ns;
+
+ ns = strappenda("machine-", arg_machine);
+ kdbus_fd = bus_kernel_create_domain(ns, &kdbus_domain);
+ if (r < 0)
+ log_debug("Failed to create kdbus domain: %s", strerror(-r));
+ else
+ log_debug("Successfully created kdbus domain as %s", kdbus_domain);
+ }
+ }
if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0) {
log_error("Failed to create kmsg socket pair: %m");
goto finish;
}
- pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL);
+ pid = syscall(__NR_clone,
+ SIGCHLD|CLONE_NEWNS|
+ (arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS)|
+ (arg_private_network ? CLONE_NEWNET : 0), NULL);
if (pid < 0) {
if (errno == EINVAL)
log_error("clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m");
goto child_fail;
}
+ if (reset_audit_loginuid() < 0)
+ goto child_fail;
+
if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0) {
log_error("PR_SET_PDEATHSIG failed: %m");
goto child_fail;
umask(0022);
- loopback_setup();
+ if (arg_private_network)
+ loopback_setup();
if (drop_capabilities() < 0) {
log_error("drop_capabilities() failed: %m");
} else if (status.si_code == CLD_KILLED ||
status.si_code == CLD_DUMPED) {
- log_error("Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
+ log_error("Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
r = EXIT_FAILURE;
break;
} else {