X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fnspawn%2Fnspawn.c;h=7c3d7b89beb03890db7fc73a77f66f7206514c05;hb=f418f31d5042398344740f2d8ac4dc1c2583151c;hp=097d7f779f0d781ba73e6662e48f35265fec4c8b;hpb=0cb9fbcd44517ec90b2a678876194607beab5dec;p=elogind.git diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 097d7f779..7c3d7b89b 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -86,6 +86,7 @@ #include "udev-util.h" #include "blkid-util.h" #include "gpt.h" +#include "siphash24.h" #ifdef HAVE_SECCOMP #include "seccomp-util.h" @@ -1258,7 +1259,7 @@ static int register_machine(pid_t pid) { return r; } - r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 8, + r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 10, /* Allow the container to * access and create the API * device nodes, so that @@ -1277,7 +1278,18 @@ static int register_machine(pid_t pid) { * container to ever create * these device nodes. */ "/dev/pts/ptmx", "rw", - "char-pts", "rw"); + "char-pts", "rw", + /* Allow the container + * access to all kdbus + * devices. Again, the + * container cannot create + * these nodes, only use + * them. We use a pretty + * open match here, so that + * the kernel API can still + * change. */ + "char-kdbus", "rw", + "char-kdbus/*", "rw"); if (r < 0) { log_error("Failed to add device whitelist: %s", strerror(-r)); return r; @@ -1388,9 +1400,46 @@ static int reset_audit_loginuid(void) { return 0; } +#define HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2) + +static int get_mac(struct ether_addr *mac) { + int r; + + uint8_t result[8]; + size_t l, sz; + uint8_t *v; + + l = strlen(arg_machine); + sz = sizeof(sd_id128_t) + l; + v = alloca(sz); + + /* fetch some persistent data unique to the host */ + r = sd_id128_get_machine((sd_id128_t*) v); + if (r < 0) + return r; + + /* combine with some data unique (on this host) to this + * container instance */ + memcpy(v + sizeof(sd_id128_t), arg_machine, l); + + /* Let's hash the host machine ID plus the container name. We + * use a fixed, but originally randomly created hash key here. */ + siphash24(result, v, sz, HASH_KEY.bytes); + + assert_cc(ETH_ALEN <= sizeof(result)); + memcpy(mac->ether_addr_octet, result, ETH_ALEN); + + /* see eth_random_addr in the kernel */ + mac->ether_addr_octet[0] &= 0xfe; /* clear multicast bit */ + mac->ether_addr_octet[0] |= 0x02; /* set local assignment bit (IEEE802) */ + + return 0; +} + static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ]) { _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL; _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL; + struct ether_addr mac; int r; if (!arg_private_network) @@ -1405,9 +1454,14 @@ static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ]) { memcpy(iface_name, "vb-", 3); else memcpy(iface_name, "ve-", 3); - strncpy(iface_name+3, arg_machine, IFNAMSIZ - 3); + r = get_mac(&mac); + if (r < 0) { + log_error("Failed to generate predictable MAC address for host0"); + return r; + } + r = sd_rtnl_open(&rtnl, 0); if (r < 0) { log_error("Failed to connect to netlink: %s", strerror(-r)); @@ -1456,6 +1510,12 @@ static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ]) { return r; } + r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac); + if (r < 0) { + log_error("Failed to add netlink MAC address: %s", strerror(-r)); + return r; + } + r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid); if (r < 0) { log_error("Failed to add netlink namespace field: %s", strerror(-r)); @@ -1880,9 +1940,9 @@ static int setup_image(char **device_path, int *loop_nr) { static int dissect_image( int fd, - char **root_device, - char **home_device, - char **srv_device, + char **root_device, bool *root_device_rw, + char **home_device, bool *home_device_rw, + char **srv_device, bool *srv_device_rw, bool *secondary) { #ifdef HAVE_BLKID @@ -1893,6 +1953,7 @@ static int dissect_image( _cleanup_blkid_free_probe_ blkid_probe b = NULL; _cleanup_udev_unref_ struct udev *udev = NULL; struct udev_list_entry *first, *item; + bool home_rw = true, root_rw = true, secondary_root_rw = true, srv_rw = true; const char *pttype = NULL; blkid_partlist pl; struct stat st; @@ -1982,6 +2043,7 @@ static int dissect_image( udev_list_entry_foreach(item, first) { _cleanup_udev_device_unref_ struct udev_device *q; const char *stype, *node; + unsigned long long flags; sd_id128_t type_id; blkid_partition pp; dev_t qn; @@ -2012,6 +2074,10 @@ static int dissect_image( if (!pp) continue; + flags = blkid_partition_get_flags(pp); + if (flags & GPT_FLAG_NO_AUTO) + continue; + nr = blkid_partition_get_partno(pp); if (nr < 0) continue; @@ -2029,6 +2095,8 @@ static int dissect_image( continue; home_nr = nr; + home_rw = !(flags & GPT_FLAG_READ_ONLY); + free(home); home = strdup(node); if (!home) @@ -2039,6 +2107,8 @@ static int dissect_image( continue; srv_nr = nr; + srv_rw = !(flags & GPT_FLAG_READ_ONLY); + free(srv); srv = strdup(node); if (!srv) @@ -2051,6 +2121,8 @@ static int dissect_image( continue; root_nr = nr; + root_rw = !(flags & GPT_FLAG_READ_ONLY); + free(root); root = strdup(node); if (!root) @@ -2064,6 +2136,9 @@ static int dissect_image( continue; secondary_root_nr = nr; + secondary_root_rw = !(flags & GPT_FLAG_READ_ONLY); + + free(secondary_root); secondary_root = strdup(node); if (!secondary_root) @@ -2081,21 +2156,29 @@ static int dissect_image( if (root) { *root_device = root; root = NULL; + + *root_device_rw = root_rw; *secondary = false; } else if (secondary_root) { *root_device = secondary_root; secondary_root = NULL; + + *root_device_rw = secondary_root_rw; *secondary = true; } if (home) { *home_device = home; home = NULL; + + *home_device_rw = home_rw; } if (srv) { *srv_device = srv; srv = NULL; + + *srv_device_rw = srv_rw; } return 0; @@ -2105,7 +2188,7 @@ static int dissect_image( #endif } -static int mount_device(const char *what, const char *where, const char *directory) { +static int mount_device(const char *what, const char *where, const char *directory, bool rw) { #ifdef HAVE_BLKID _cleanup_blkid_free_probe_ blkid_probe b = NULL; const char *fstype, *p; @@ -2114,6 +2197,9 @@ static int mount_device(const char *what, const char *where, const char *directo assert(what); assert(where); + if (arg_read_only) + rw = false; + if (directory) p = strappenda(where, directory); else @@ -2156,7 +2242,7 @@ static int mount_device(const char *what, const char *where, const char *directo return -ENOTSUP; } - if (mount(what, p, fstype, arg_read_only ? MS_NODEV|MS_RDONLY : 0, NULL) < 0) { + if (mount(what, p, fstype, MS_NODEV|(rw ? 0 : MS_RDONLY), NULL) < 0) { log_error("Failed to mount %s: %m", what); return -errno; } @@ -2168,13 +2254,17 @@ static int mount_device(const char *what, const char *where, const char *directo #endif } -static int mount_devices(const char *where, const char *root_device, const char *home_device, const char *srv_device) { +static int mount_devices( + const char *where, + const char *root_device, bool root_device_rw, + const char *home_device, bool home_device_rw, + const char *srv_device, bool srv_device_rw) { int r; assert(where); if (root_device) { - r = mount_device(root_device, arg_directory, NULL); + r = mount_device(root_device, arg_directory, NULL, root_device_rw); if (r < 0) { log_error("Failed to mount root directory: %s", strerror(-r)); return r; @@ -2182,7 +2272,7 @@ static int mount_devices(const char *where, const char *root_device, const char } if (home_device) { - r = mount_device(home_device, arg_directory, "/home"); + r = mount_device(home_device, arg_directory, "/home", home_device_rw); if (r < 0) { log_error("Failed to mount home directory: %s", strerror(-r)); return r; @@ -2190,7 +2280,7 @@ static int mount_devices(const char *where, const char *root_device, const char } if (srv_device) { - r = mount_device(srv_device, arg_directory, "/srv"); + r = mount_device(srv_device, arg_directory, "/srv", srv_device_rw); if (r < 0) { log_error("Failed to mount server data directory: %s", strerror(-r)); return r; @@ -2264,8 +2354,8 @@ static int spawn_getent(const char *database, const char *key, pid_t *rpid) { reset_all_signal_handlers(); close_all_fds(NULL, 0); - execle("/usr/bin/getent", "getenv", database, key, NULL, &empty_env); - execle("/usr/getent", "getenv", database, key, NULL, &empty_env); + execle("/usr/bin/getent", "getent", database, key, NULL, &empty_env); + execle("/bin/getent", "getent", database, key, NULL, &empty_env); _exit(EXIT_FAILURE); } @@ -2453,7 +2543,7 @@ static int change_uid_gid(char **_home) { } r = mkdir_safe(home, 0755, uid, gid); - if (r < 0) { + if (r < 0 && r != -EEXIST) { log_error("Failed to make home directory: %s", strerror(-r)); return r; } @@ -2488,6 +2578,7 @@ static int change_uid_gid(char **_home) { int main(int argc, char *argv[]) { _cleanup_free_ char *kdbus_domain = NULL, *device_path = NULL, *root_device = NULL, *home_device = NULL, *srv_device = NULL; + bool root_device_rw = true, home_device_rw = true, srv_device_rw = true; _cleanup_close_ int master = -1, kdbus_fd = -1, image_fd = -1; _cleanup_close_pipe_ int kmsg_socket_pair[2] = { -1, -1 }; _cleanup_fdset_free_ FDSet *fds = NULL; @@ -2605,7 +2696,7 @@ int main(int argc, char *argv[]) { goto finish; } - r = dissect_image(image_fd, &root_device, &home_device, &srv_device, &secondary); + r = dissect_image(image_fd, &root_device, &root_device_rw, &home_device, &home_device_rw, &srv_device, &srv_device_rw, &secondary); if (r < 0) goto finish; } @@ -2766,7 +2857,10 @@ int main(int argc, char *argv[]) { goto child_fail; } - if (mount_devices(arg_directory, root_device, home_device, srv_device) < 0) + if (mount_devices(arg_directory, + root_device, root_device_rw, + home_device, home_device_rw, + srv_device, srv_device_rw) < 0) goto child_fail; /* Turn directory into bind mount */