X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fmachine%2Fmachinectl.c;h=a62ffe30ac385f0ea70e3c7be8ff67248de1e8c2;hb=6573ef05a3cbe15949acfbbf1ad03726068907bd;hp=cc3be98b530d36101675d86c0519e99ff57902ca;hpb=0dd25fb9f005d8ab7ac4bc10a609d00569f8c56a;p=elogind.git diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c index cc3be98b5..a62ffe30a 100644 --- a/src/machine/machinectl.c +++ b/src/machine/machinectl.c @@ -30,6 +30,8 @@ #include #include #include +#include +#include #include "sd-bus.h" #include "log.h" @@ -44,6 +46,10 @@ #include "cgroup-show.h" #include "cgroup-util.h" #include "ptyfwd.h" +#include "event-util.h" +#include "path-util.h" +#include "mkdir.h" +#include "copy.h" static char **arg_property = NULL; static bool arg_all = false; @@ -54,6 +60,8 @@ static const char *arg_kill_who = NULL; static int arg_signal = SIGTERM; static BusTransport arg_transport = BUS_TRANSPORT_LOCAL; static char *arg_host = NULL; +static bool arg_read_only = false; +static bool arg_mkdir = false; static void pager_open_if_enabled(void) { @@ -376,6 +384,8 @@ static int map_netif(sd_bus *bus, const char *member, sd_bus_message *m, sd_bus_ r = sd_bus_message_read_array(m, SD_BUS_TYPE_INT32, &v, &l); if (r < 0) return r; + if (r == 0) + return -EBADMSG; i->n_netif = l / sizeof(int32_t); i->netif = memdup(v, l); @@ -411,10 +421,8 @@ static int show_info(const char *verb, sd_bus *bus, const char *path, bool *new_ path, map, &info); - if (r < 0) { - log_error("Could not get properties: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Could not get properties: %m"); if (*new_line) printf("\n"); @@ -442,7 +450,7 @@ static int show_properties(sd_bus *bus, const char *path, bool *new_line) { r = bus_print_all_properties(bus, "org.freedesktop.machine1", path, arg_property, arg_all); if (r < 0) - log_error("Could not get properties: %s", strerror(-r)); + log_error_errno(r, "Could not get properties: %m"); return r; } @@ -571,6 +579,332 @@ static int terminate_machine(sd_bus *bus, char **args, unsigned n) { return 0; } +static int machine_get_leader(sd_bus *bus, const char *name, pid_t *ret) { + _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL; + _cleanup_bus_message_unref_ sd_bus_message *reply = NULL, *reply2 = NULL; + const char *object; + uint32_t leader; + int r; + + assert(bus); + assert(name); + assert(ret); + + r = sd_bus_call_method( + bus, + "org.freedesktop.machine1", + "/org/freedesktop/machine1", + "org.freedesktop.machine1.Manager", + "GetMachine", + &error, + &reply, + "s", name); + if (r < 0) { + log_error("Could not get path to machine: %s", bus_error_message(&error, -r)); + return r; + } + + r = sd_bus_message_read(reply, "o", &object); + if (r < 0) + return bus_log_parse_error(r); + + r = sd_bus_get_property( + bus, + "org.freedesktop.machine1", + object, + "org.freedesktop.machine1.Machine", + "Leader", + &error, + &reply2, + "u"); + if (r < 0) + return log_error_errno(r, "Failed to retrieve PID of leader: %m"); + + r = sd_bus_message_read(reply2, "u", &leader); + if (r < 0) + return bus_log_parse_error(r); + + *ret = leader; + return 0; +} + +static int copy_files(sd_bus *bus, char **args, unsigned n) { + char *dest, *host_path, *container_path, *host_dirname, *host_basename, *container_dirname, *container_basename, *t; + _cleanup_close_ int hostfd = -1; + pid_t child, leader; + bool copy_from; + siginfo_t si; + int r; + + if (n > 4) { + log_error("Too many arguments."); + return -EINVAL; + } + + copy_from = streq(args[0], "copy-from"); + dest = args[3] ?: args[2]; + host_path = strdupa(copy_from ? dest : args[2]); + container_path = strdupa(copy_from ? args[2] : dest); + + if (!path_is_absolute(container_path)) { + log_error("Container path not absolute."); + return -EINVAL; + } + + t = strdup(host_path); + host_basename = basename(t); + host_dirname = dirname(host_path); + + t = strdup(container_path); + container_basename = basename(t); + container_dirname = dirname(container_path); + + r = machine_get_leader(bus, args[1], &leader); + if (r < 0) + return r; + + hostfd = open(host_dirname, O_CLOEXEC|O_RDONLY|O_NOCTTY|O_DIRECTORY); + if (r < 0) + return log_error_errno(errno, "Failed to open source directory: %m"); + + child = fork(); + if (child < 0) + return log_error_errno(errno, "Failed to fork(): %m"); + + if (child == 0) { + int containerfd; + const char *q; + int mntfd; + + q = procfs_file_alloca(leader, "ns/mnt"); + mntfd = open(q, O_RDONLY|O_NOCTTY|O_CLOEXEC); + if (mntfd < 0) { + log_error_errno(errno, "Failed to open mount namespace of leader: %m"); + _exit(EXIT_FAILURE); + } + + if (setns(mntfd, CLONE_NEWNS) < 0) { + log_error_errno(errno, "Failed to join namespace of leader: %m"); + _exit(EXIT_FAILURE); + } + + containerfd = open(container_dirname, O_CLOEXEC|O_RDONLY|O_NOCTTY|O_DIRECTORY); + if (containerfd < 0) { + log_error_errno(errno, "Failed top open destination directory: %m"); + _exit(EXIT_FAILURE); + } + + if (copy_from) + r = copy_tree_at(containerfd, container_basename, hostfd, host_basename, true); + else + r = copy_tree_at(hostfd, host_basename, containerfd, container_basename, true); + if (r < 0) { + log_error_errno(errno, "Failed to copy tree: %m"); + _exit(EXIT_FAILURE); + } + + _exit(EXIT_SUCCESS); + } + + r = wait_for_terminate(child, &si); + if (r < 0) + return log_error_errno(r, "Failed to wait for client: %m"); + if (si.si_code != CLD_EXITED) { + log_error("Client died abnormally."); + return -EIO; + } + if (si.si_status != EXIT_SUCCESS) + return -EIO; + + return 0; +} + +static int bind_mount(sd_bus *bus, char **args, unsigned n) { + char mount_slave[] = "/tmp/propagate.XXXXXX", *mount_tmp, *mount_outside, *p; + pid_t child, leader; + const char *dest; + siginfo_t si; + bool mount_slave_created = false, mount_slave_mounted = false, + mount_tmp_created = false, mount_tmp_mounted = false, + mount_outside_created = false, mount_outside_mounted = false; + int r; + + /* One day, when bind mounting /proc/self/fd/n works across + * namespace boundaries we should rework this logic to make + * use of it... */ + + if (n > 4) { + log_error("Too many arguments."); + return -EINVAL; + } + + dest = args[3] ?: args[2]; + if (!path_is_absolute(dest)) { + log_error("Destination path not absolute."); + return -EINVAL; + } + + p = strappenda("/run/systemd/nspawn/propagate/", args[1], "/"); + if (access(p, F_OK) < 0) { + log_error("Container does not allow propagation of mount points."); + return -ENOTSUP; + } + + r = machine_get_leader(bus, args[1], &leader); + if (r < 0) + return r; + + /* Our goal is to install a new bind mount into the container, + possibly read-only. This is irritatingly complex + unfortunately, currently. + + First, we start by creating a private playground in /tmp, + that we can mount MS_SLAVE. (Which is necessary, since + MS_MOUNT cannot be applied to mounts with MS_SHARED parent + mounts.) */ + + if (!mkdtemp(mount_slave)) + return log_error_errno(errno, "Failed to create playground: %m"); + + mount_slave_created = true; + + if (mount(mount_slave, mount_slave, NULL, MS_BIND, NULL) < 0) { + r = log_error_errno(errno, "Failed to make bind mount: %m"); + goto finish; + } + + mount_slave_mounted = true; + + if (mount(NULL, mount_slave, NULL, MS_SLAVE, NULL) < 0) { + r = log_error_errno(errno, "Failed to remount slave: %m"); + goto finish; + } + + /* Second, we mount the source directory to a directory inside + of our MS_SLAVE playground. */ + mount_tmp = strappenda(mount_slave, "/mount"); + if (mkdir(mount_tmp, 0700) < 0) { + r = log_error_errno(errno, "Failed to create temporary mount: %m"); + goto finish; + } + + mount_tmp_created = true; + + if (mount(args[2], mount_tmp, NULL, MS_BIND, NULL) < 0) { + r = log_error_errno(errno, "Failed to overmount: %m"); + goto finish; + } + + mount_tmp_mounted = true; + + /* Third, we remount the new bind mount read-only if requested. */ + if (arg_read_only) + if (mount(NULL, mount_tmp, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0) { + r = log_error_errno(errno, "Failed to mark read-only: %m"); + goto finish; + } + + /* Fourth, we move the new bind mount into the propagation + * directory. This way it will appear there read-only + * right-away. */ + + mount_outside = strappenda("/run/systemd/nspawn/propagate/", args[1], "/XXXXXX"); + if (!mkdtemp(mount_outside)) { + r = log_error_errno(errno, "Cannot create propagation directory: %m"); + goto finish; + } + + mount_outside_created = true; + + if (mount(mount_tmp, mount_outside, NULL, MS_MOVE, NULL) < 0) { + r = log_error_errno(errno, "Failed to move: %m"); + goto finish; + } + + mount_outside_mounted = true; + mount_tmp_mounted = false; + + (void) rmdir(mount_tmp); + mount_tmp_created = false; + + (void) umount(mount_slave); + mount_slave_mounted = false; + + (void) rmdir(mount_slave); + mount_slave_created = false; + + child = fork(); + if (child < 0) { + r = log_error_errno(errno, "Failed to fork(): %m"); + goto finish; + } + + if (child == 0) { + const char *mount_inside; + int mntfd; + const char *q; + + q = procfs_file_alloca(leader, "ns/mnt"); + mntfd = open(q, O_RDONLY|O_NOCTTY|O_CLOEXEC); + if (mntfd < 0) { + log_error_errno(errno, "Failed to open mount namespace of leader: %m"); + _exit(EXIT_FAILURE); + } + + if (setns(mntfd, CLONE_NEWNS) < 0) { + log_error_errno(errno, "Failed to join namespace of leader: %m"); + _exit(EXIT_FAILURE); + } + + if (arg_mkdir) + mkdir_p(dest, 0755); + + /* Fifth, move the mount to the right place inside */ + mount_inside = strappenda("/run/systemd/nspawn/incoming/", basename(mount_outside)); + if (mount(mount_inside, dest, NULL, MS_MOVE, NULL) < 0) { + log_error_errno(errno, "Failed to mount: %m"); + _exit(EXIT_FAILURE); + } + + _exit(EXIT_SUCCESS); + } + + r = wait_for_terminate(child, &si); + if (r < 0) { + log_error_errno(r, "Failed to wait for client: %m"); + goto finish; + } + if (si.si_code != CLD_EXITED) { + log_error("Client died abnormally."); + r = -EIO; + goto finish; + } + if (si.si_status != EXIT_SUCCESS) { + r = -EIO; + goto finish; + } + + r = 0; + +finish: + if (mount_outside_mounted) + umount(mount_outside); + if (mount_outside_created) + rmdir(mount_outside); + + if (mount_tmp_mounted) + umount(mount_tmp); + if (mount_tmp_created) + umount(mount_tmp); + + if (mount_slave_mounted) + umount(mount_slave); + if (mount_slave_created) + umount(mount_slave); + + return r; +} + static int openpt_in_namespace(pid_t pid, int flags) { _cleanup_close_pair_ int pair[2] = { -1, -1 }; _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, rootfd = -1; @@ -657,15 +991,17 @@ static int openpt_in_namespace(pid_t pid, int flags) { } static int login_machine(sd_bus *bus, char **args, unsigned n) { - _cleanup_bus_message_unref_ sd_bus_message *reply = NULL, *reply2 = NULL, *reply3 = NULL; _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL; - _cleanup_bus_unref_ sd_bus *container_bus = NULL; + _cleanup_bus_message_unref_ sd_bus_message *reply = NULL; + _cleanup_bus_close_unref_ sd_bus *container_bus = NULL; + _cleanup_(pty_forward_freep) PTYForward *forward = NULL; + _cleanup_event_unref_ sd_event *event = NULL; _cleanup_close_ int master = -1; _cleanup_free_ char *getty = NULL; - const char *path, *pty, *p; - uint32_t leader; + const char *pty, *p; + pid_t leader; sigset_t mask; - int r; + int r, ret = 0; assert(bus); assert(args); @@ -675,53 +1011,25 @@ static int login_machine(sd_bus *bus, char **args, unsigned n) { return -ENOTSUP; } - r = sd_bus_call_method( - bus, - "org.freedesktop.machine1", - "/org/freedesktop/machine1", - "org.freedesktop.machine1.Manager", - "GetMachine", - &error, - &reply, - "s", args[1]); - if (r < 0) { - log_error("Could not get path to machine: %s", bus_error_message(&error, -r)); - return r; - } - - r = sd_bus_message_read(reply, "o", &path); + r = sd_event_default(&event); if (r < 0) - return bus_log_parse_error(r); + return log_error_errno(r, "Failed to get event loop: %m"); - r = sd_bus_get_property( - bus, - "org.freedesktop.machine1", - path, - "org.freedesktop.machine1.Machine", - "Leader", - &error, - &reply2, - "u"); - if (r < 0) { - log_error("Failed to retrieve PID of leader: %s", strerror(-r)); - return r; - } + r = sd_bus_attach_event(bus, event, 0); + if (r < 0) + return log_error_errno(r, "Failed to attach bus to event loop: %m"); - r = sd_bus_message_read(reply2, "u", &leader); + r = machine_get_leader(bus, args[1], &leader); if (r < 0) - return bus_log_parse_error(r); + return r; master = openpt_in_namespace(leader, O_RDWR|O_NOCTTY|O_CLOEXEC|O_NDELAY); - if (master < 0) { - log_error("Failed to acquire pseudo tty: %s", strerror(-master)); - return master; - } + if (master < 0) + return log_error_errno(master, "Failed to acquire pseudo tty: %m"); pty = ptsname(master); - if (!pty) { - log_error("Failed to get pty name: %m"); - return -errno; - } + if (!pty) + return log_error_errno(errno, "Failed to get pty name: %m"); p = startswith(pty, "/dev/pts/"); if (!p) { @@ -730,26 +1038,22 @@ static int login_machine(sd_bus *bus, char **args, unsigned n) { } r = sd_bus_open_system_container(&container_bus, args[1]); - if (r < 0) { - log_error("Failed to get container bus: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to get container bus: %m"); getty = strjoin("container-getty@", p, ".service", NULL); if (!getty) return log_oom(); - if (unlockpt(master) < 0) { - log_error("Failed to unlock tty: %m"); - return -errno; - } + if (unlockpt(master) < 0) + return log_error_errno(errno, "Failed to unlock tty: %m"); r = sd_bus_call_method(container_bus, "org.freedesktop.systemd1", "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", "StartUnit", - &error, &reply3, + &error, &reply, "ss", getty, "replace"); if (r < 0) { log_error("Failed to start getty service: %s", bus_error_message(&error, r)); @@ -764,46 +1068,57 @@ static int login_machine(sd_bus *bus, char **args, unsigned n) { log_info("Connected to container %s. Press ^] three times within 1s to exit session.", args[1]); - r = process_pty(master, &mask, 0, 0); - if (r < 0) { - log_error("Failed to process pseudo tty: %s", strerror(-r)); - return r; - } + sd_event_add_signal(event, NULL, SIGINT, NULL, NULL); + sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL); + + r = pty_forward_new(event, master, &forward); + if (r < 0) + return log_error_errno(r, "Failed to create PTY forwarder: %m"); + + r = sd_event_loop(event); + if (r < 0) + return log_error_errno(r, "Failed to run event loop: %m"); + + forward = pty_forward_free(forward); fputc('\n', stdout); log_info("Connection to container %s terminated.", args[1]); - return 0; + sd_event_get_exit_code(event, &ret); + return ret; } -static int help(void) { - +static void help(void) { printf("%s [OPTIONS...] {COMMAND} ...\n\n" - "Send control commands to or query the virtual machine and container registration manager.\n\n" - " -h --help Show this help\n" - " --version Show package version\n" - " --no-pager Do not pipe output into a pager\n" - " --no-legend Do not show the headers and footers\n" - " -H --host=[USER@]HOST Operate on remote host\n" - " -M --machine=CONTAINER Operate on local container\n" - " -p --property=NAME Show only properties by this name\n" - " -a --all Show all properties, including empty ones\n" - " -l --full Do not ellipsize output\n" - " --kill-who=WHO Who to send signal to\n" - " -s --signal=SIGNAL Which signal to send\n\n" + "Send control commands to or query the virtual machine and container\n" + "registration manager.\n\n" + " -h --help Show this help\n" + " --version Show package version\n" + " --no-pager Do not pipe output into a pager\n" + " --no-legend Do not show the headers and footers\n" + " -H --host=[USER@]HOST Operate on remote host\n" + " -M --machine=CONTAINER Operate on local container\n" + " -p --property=NAME Show only properties by this name\n" + " -a --all Show all properties, including empty ones\n" + " -l --full Do not ellipsize output\n" + " --kill-who=WHO Who to send signal to\n" + " -s --signal=SIGNAL Which signal to send\n" + " --read-only Create read-only bind mount\n" + " --mkdir Create directory before bind mounting, if missing\n\n" "Commands:\n" - " list List running VMs and containers\n" - " status NAME... Show VM/container status\n" - " show NAME... Show properties of one or more VMs/containers\n" - " login NAME Get a login prompt on a container\n" - " poweroff NAME... Power off one or more containers\n" - " reboot NAME... Reboot one or more containers\n" - " kill NAME... Send signal to processes of a VM/container\n" - " terminate NAME... Terminate one or more VMs/containers\n", + " list List running VMs and containers\n" + " status NAME... Show VM/container status\n" + " show NAME... Show properties of one or more VMs/containers\n" + " login NAME Get a login prompt on a container\n" + " poweroff NAME... Power off one or more containers\n" + " reboot NAME... Reboot one or more containers\n" + " kill NAME... Send signal to processes of a VM/container\n" + " terminate NAME... Terminate one or more VMs/containers\n" + " bind NAME PATH [PATH] Bind mount a path from the host into a container\n" + " copy-to NAME PATH [PATH] Copy files from the host to a container\n" + " copy-from NAME PATH [PATH] Copy files from a container to the host\n", program_invocation_short_name); - - return 0; } static int parse_argv(int argc, char *argv[]) { @@ -813,6 +1128,8 @@ static int parse_argv(int argc, char *argv[]) { ARG_NO_PAGER, ARG_NO_LEGEND, ARG_KILL_WHO, + ARG_READ_ONLY, + ARG_MKDIR, }; static const struct option options[] = { @@ -827,6 +1144,8 @@ static int parse_argv(int argc, char *argv[]) { { "signal", required_argument, NULL, 's' }, { "host", required_argument, NULL, 'H' }, { "machine", required_argument, NULL, 'M' }, + { "read-only", no_argument, NULL, ARG_READ_ONLY }, + { "mkdir", no_argument, NULL, ARG_MKDIR }, {} }; @@ -835,12 +1154,13 @@ static int parse_argv(int argc, char *argv[]) { assert(argc >= 0); assert(argv); - while ((c = getopt_long(argc, argv, "hp:als:H:M:", options, NULL)) >= 0) { + while ((c = getopt_long(argc, argv, "hp:als:H:M:", options, NULL)) >= 0) switch (c) { case 'h': - return help(); + help(); + return 0; case ARG_VERSION: puts(PACKAGE_STRING); @@ -896,13 +1216,20 @@ static int parse_argv(int argc, char *argv[]) { arg_host = optarg; break; + case ARG_READ_ONLY: + arg_read_only = true; + break; + + case ARG_MKDIR: + arg_mkdir = true; + break; + case '?': return -EINVAL; default: assert_not_reached("Unhandled option"); } - } return 1; } @@ -927,6 +1254,9 @@ static int machinectl_main(sd_bus *bus, int argc, char *argv[]) { { "poweroff", MORE, 2, poweroff_machine }, { "kill", MORE, 2, kill_machine }, { "login", MORE, 2, login_machine }, + { "bind", MORE, 3, bind_mount }, + { "copy-to", MORE, 3, copy_files }, + { "copy-from", MORE, 3, copy_files }, }; int left; @@ -990,7 +1320,7 @@ static int machinectl_main(sd_bus *bus, int argc, char *argv[]) { } int main(int argc, char*argv[]) { - _cleanup_bus_unref_ sd_bus *bus = NULL; + _cleanup_bus_close_unref_ sd_bus *bus = NULL; int r; setlocale(LC_ALL, ""); @@ -1003,7 +1333,7 @@ int main(int argc, char*argv[]) { r = bus_open_transport(arg_transport, arg_host, false, &bus); if (r < 0) { - log_error("Failed to create bus connection: %s", strerror(-r)); + log_error_errno(r, "Failed to create bus connection: %m"); goto finish; }