X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fnspawn%2Fnspawn.c;h=9ce1fa9b49cd72fdcf4b683ba231ccd5fd862488;hb=a42c8b54b1619078c02f5e439bd2564c6d0f901f;hp=d5add4a45ea44fa20a568005a3cbafa19e89ab4b;hpb=db999e0f923ca6c2c1b919d0f1c916472f209e62;p=elogind.git diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index d5add4a45..9ce1fa9b4 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -40,7 +40,10 @@ #include #include #include +#include #include +#include + #ifdef HAVE_SELINUX #include #endif @@ -48,6 +51,7 @@ #include "sd-daemon.h" #include "sd-bus.h" #include "sd-id128.h" +#include "sd-rtnl.h" #include "log.h" #include "util.h" #include "mkdir.h" @@ -68,6 +72,7 @@ #include "bus-kernel.h" #include "env-util.h" #include "def.h" +#include "rtnl-util.h" typedef enum LinkJournal { LINK_NO, @@ -121,6 +126,7 @@ static bool arg_quiet = false; static bool arg_share_system = false; static bool arg_register = true; static bool arg_keep_unit = false; +static char **arg_network_interfaces = NULL; static int help(void) { @@ -141,6 +147,8 @@ static int help(void) { " Set the SELinux security context to be used by\n" " API/tmpfs file systems in the container\n" " --private-network Disable network in container\n" + " --network-interface=INTERFACE\n" + " Assign an existing network interface to the container\n" " --share-system Share system namespaces with host\n" " --read-only Mount the root directory read-only\n" " --capability=CAP In addition to the default, retain specified\n" @@ -176,36 +184,39 @@ static int parse_argv(int argc, char *argv[]) { ARG_SETENV, ARG_SHARE_SYSTEM, ARG_REGISTER, - ARG_KEEP_UNIT + ARG_KEEP_UNIT, + ARG_NETWORK_INTERFACE }; static const struct option options[] = { - { "help", no_argument, NULL, 'h' }, - { "version", no_argument, NULL, ARG_VERSION }, - { "directory", required_argument, NULL, 'D' }, - { "user", required_argument, NULL, 'u' }, - { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK }, - { "boot", no_argument, NULL, 'b' }, - { "uuid", required_argument, NULL, ARG_UUID }, - { "read-only", no_argument, NULL, ARG_READ_ONLY }, - { "capability", required_argument, NULL, ARG_CAPABILITY }, - { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY }, - { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL }, - { "bind", required_argument, NULL, ARG_BIND }, - { "bind-ro", required_argument, NULL, ARG_BIND_RO }, - { "machine", required_argument, NULL, 'M' }, - { "slice", required_argument, NULL, 'S' }, - { "setenv", required_argument, NULL, ARG_SETENV }, - { "selinux-context", required_argument, NULL, 'Z' }, - { "selinux-apifs-context", required_argument, NULL, 'L' }, - { "quiet", no_argument, NULL, 'q' }, - { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, - { "register", required_argument, NULL, ARG_REGISTER }, - { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT }, + { "help", no_argument, NULL, 'h' }, + { "version", no_argument, NULL, ARG_VERSION }, + { "directory", required_argument, NULL, 'D' }, + { "user", required_argument, NULL, 'u' }, + { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK }, + { "boot", no_argument, NULL, 'b' }, + { "uuid", required_argument, NULL, ARG_UUID }, + { "read-only", no_argument, NULL, ARG_READ_ONLY }, + { "capability", required_argument, NULL, ARG_CAPABILITY }, + { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY }, + { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL }, + { "bind", required_argument, NULL, ARG_BIND }, + { "bind-ro", required_argument, NULL, ARG_BIND_RO }, + { "machine", required_argument, NULL, 'M' }, + { "slice", required_argument, NULL, 'S' }, + { "setenv", required_argument, NULL, ARG_SETENV }, + { "selinux-context", required_argument, NULL, 'Z' }, + { "selinux-apifs-context", required_argument, NULL, 'L' }, + { "quiet", no_argument, NULL, 'q' }, + { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM }, + { "register", required_argument, NULL, ARG_REGISTER }, + { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT }, + { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE }, {} }; int c, r; + uint64_t plus = 0, minus = 0; assert(argc >= 0); assert(argv); @@ -240,6 +251,12 @@ static int parse_argv(int argc, char *argv[]) { break; + case ARG_NETWORK_INTERFACE: + if (strv_push(&arg_network_interfaces, optarg) < 0) + return log_oom(); + + /* fall through */ + case ARG_PRIVATE_NETWORK: arg_private_network = true; break; @@ -300,25 +317,29 @@ static int parse_argv(int argc, char *argv[]) { size_t length; FOREACH_WORD_SEPARATOR(word, length, optarg, ",", state) { + _cleanup_free_ char *t; cap_value_t cap; - char *t; t = strndup(word, length); if (!t) return log_oom(); - if (cap_from_name(t, &cap) < 0) { - log_error("Failed to parse capability %s.", t); - free(t); - return -EINVAL; + if (streq(t, "all")) { + if (c == ARG_CAPABILITY) + plus = (uint64_t) -1; + else + minus = (uint64_t) -1; + } else { + if (cap_from_name(t, &cap) < 0) { + log_error("Failed to parse capability %s.", t); + return -EINVAL; + } + + if (c == ARG_CAPABILITY) + plus |= 1ULL << (uint64_t) cap; + else + minus |= 1ULL << (uint64_t) cap; } - - free(t); - - if (c == ARG_CAPABILITY) - arg_retain |= 1ULL << (uint64_t) cap; - else - arg_retain &= ~(1ULL << (uint64_t) cap); } break; @@ -440,6 +461,8 @@ static int parse_argv(int argc, char *argv[]) { return -EINVAL; } + arg_retain = (arg_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus; + return 1; } @@ -1231,6 +1254,55 @@ static int reset_audit_loginuid(void) { return 0; } +static int move_network_interfaces(pid_t pid) { + _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL; + char **i; + int r; + + if (!arg_private_network) + return 0; + + if (strv_isempty(arg_network_interfaces)) + return 0; + + r = sd_rtnl_open(NETLINK_ROUTE, &rtnl); + if (r < 0) { + log_error("Failed to connect to netlink: %s", strerror(-r)); + return r; + } + + STRV_FOREACH(i, arg_network_interfaces) { + _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL; + unsigned ifi; + + ifi = if_nametoindex(*i); + if (ifi == 0) { + log_error("Failed to resolve interface %s: %m", *i); + return -errno; + } + + r = sd_rtnl_message_new_link(RTM_NEWLINK, ifi, &m); + if (r < 0) { + log_error("Failed to allocate netlink message: %s", strerror(-r)); + return r; + } + + r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid); + if (r < 0) { + log_error("Failed to append namespace PID to netlink message: %s", strerror(-r)); + return r; + } + + r = sd_rtnl_call(rtnl, m, 0, NULL); + if (r < 0) { + log_error("Failed to move interface to namespace: %s", strerror(-r)); + return r; + } + } + + return 0; +} + int main(int argc, char *argv[]) { pid_t pid = 0; int r = EXIT_FAILURE, k; @@ -1696,6 +1768,10 @@ int main(int argc, char *argv[]) { if (r < 0) goto finish; + r = move_network_interfaces(pid); + if (r < 0) + goto finish; + eventfd_write(sync_fd, 1); close_nointr_nofail(sync_fd); sync_fd = -1; @@ -1766,6 +1842,7 @@ finish: free(arg_directory); free(arg_machine); free(arg_setenv); + free(arg_network_interfaces); return r; }