X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fnspawn%2Fnspawn.c;h=de74a431700a3fc05bbe7229fb271b3bddeee5a1;hb=9457ac5b4e755e9019ead2f564124df5d35ee7cf;hp=379ea92355e6f512c15b06ad04fcf3b66fd63f7e;hpb=3302da4667640ac130956d8d90be7c39fb39222f;p=elogind.git diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 379ea9235..de74a4317 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -43,6 +43,7 @@ #include #include #include +#include #ifdef HAVE_SELINUX #include @@ -138,6 +139,7 @@ static bool arg_keep_unit = false; static char **arg_network_interfaces = NULL; static bool arg_network_veth = false; static char *arg_network_bridge = NULL; +static unsigned long arg_personality = 0xffffffffLU; static int help(void) { @@ -206,6 +208,7 @@ static int parse_argv(int argc, char *argv[]) { ARG_NETWORK_INTERFACE, ARG_NETWORK_VETH, ARG_NETWORK_BRIDGE, + ARG_PERSONALITY, }; static const struct option options[] = { @@ -234,6 +237,7 @@ static int parse_argv(int argc, char *argv[]) { { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE }, { "network-veth", no_argument, NULL, ARG_NETWORK_VETH }, { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE }, + { "personality", required_argument, NULL, ARG_PERSONALITY }, {} }; @@ -474,6 +478,16 @@ static int parse_argv(int argc, char *argv[]) { arg_keep_unit = true; break; + case ARG_PERSONALITY: + + arg_personality = personality_from_string(optarg); + if (arg_personality == 0xffffffffLU) { + log_error("Unknown or unsupported personality '%s'.", optarg); + return -EINVAL; + } + + break; + case '?': return -EINVAL; @@ -729,7 +743,7 @@ static int setup_resolv_conf(const char *dest) { static int setup_boot_id(const char *dest) { _cleanup_free_ char *from = NULL, *to = NULL; - sd_id128_t rnd; + sd_id128_t rnd = {}; char as_uuid[37]; int r; @@ -1174,22 +1188,86 @@ static int register_machine(pid_t pid) { (uint32_t) pid, strempty(arg_directory)); } else { - r = sd_bus_call_method( + _cleanup_bus_message_unref_ sd_bus_message *m = NULL; + + r = sd_bus_message_new_method_call( bus, + &m, "org.freedesktop.machine1", "/org/freedesktop/machine1", "org.freedesktop.machine1.Manager", - "CreateMachine", - &error, - NULL, - "sayssusa(sv)", + "CreateMachine"); + if (r < 0) { + log_error("Failed to create message: %s", strerror(-r)); + return r; + } + + r = sd_bus_message_append( + m, + "sayssus", arg_machine, SD_BUS_MESSAGE_APPEND_ID128(arg_uuid), "nspawn", "container", (uint32_t) pid, - strempty(arg_directory), - !isempty(arg_slice), "Slice", "s", arg_slice); + strempty(arg_directory)); + if (r < 0) { + log_error("Failed to append message arguments: %s", strerror(-r)); + return r; + } + + r = sd_bus_message_open_container(m, 'a', "(sv)"); + if (r < 0) { + log_error("Failed to open container: %s", strerror(-r)); + return r; + } + + if (!isempty(arg_slice)) { + r = sd_bus_message_append(m, "(sv)", "Slice", "s", arg_slice); + if (r < 0) { + log_error("Failed to append slice: %s", strerror(-r)); + return r; + } + } + + r = sd_bus_message_append(m, "(sv)", "DevicePolicy", "s", "strict"); + if (r < 0) { + log_error("Failed to add device policy: %s", strerror(-r)); + return r; + } + + r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 8, + /* Allow the container to + * access and create the API + * device nodes, so that + * PrivateDevices= in the + * container can work + * fine */ + "/dev/null", "rwm", + "/dev/zero", "rwm", + "/dev/full", "rwm", + "/dev/random", "rwm", + "/dev/urandom", "rwm", + "/dev/tty", "rwm", + /* Allow the container + * access to ptys. However, + * do not permit the + * container to ever create + * these device nodes. */ + "/dev/pts/ptmx", "rw", + "char-pts", "rw"); + if (r < 0) { + log_error("Failed to add device whitelist: %s", strerror(-r)); + return r; + } + + r = sd_bus_message_close_container(m); + if (r < 0) { + log_error("Failed to close container: %s", strerror(-r)); + return r; + } + + r = sd_bus_call(bus, m, 0, &error, NULL); } if (r < 0) { @@ -1288,7 +1366,7 @@ static int reset_audit_loginuid(void) { return 0; } -static int setup_veth(pid_t pid, char iface_name[]) { +static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ]) { _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL; _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL; int r; @@ -1299,15 +1377,22 @@ static int setup_veth(pid_t pid, char iface_name[]) { if (!arg_network_veth) return 0; + /* Use two different interface name prefixes depending whether + * we are in bridge mode or not. */ + if (arg_network_bridge) + memcpy(iface_name, "vb-", 3); + else + memcpy(iface_name, "ve-", 3); + strncpy(iface_name+3, arg_machine, IFNAMSIZ - 3); - r = sd_rtnl_open(0, &rtnl); + r = sd_rtnl_open(&rtnl, 0); if (r < 0) { log_error("Failed to connect to netlink: %s", strerror(-r)); return r; } - r = sd_rtnl_message_new_link(rtnl, RTM_NEWLINK, 0, &m); + r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0); if (r < 0) { log_error("Failed to allocate netlink message: %s", strerror(-r)); return r; @@ -1402,13 +1487,13 @@ static int setup_bridge(const char veth_name[]) { return -errno; } - r = sd_rtnl_open(0, &rtnl); + r = sd_rtnl_open(&rtnl, 0); if (r < 0) { log_error("Failed to connect to netlink: %s", strerror(-r)); return r; } - r = sd_rtnl_message_new_link(rtnl, RTM_SETLINK, 0, &m); + r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0); if (r < 0) { log_error("Failed to allocate netlink message: %s", strerror(-r)); return r; @@ -1447,7 +1532,7 @@ static int move_network_interfaces(pid_t pid) { if (strv_isempty(arg_network_interfaces)) return 0; - r = sd_rtnl_open(0, &rtnl); + r = sd_rtnl_open(&rtnl, 0); if (r < 0) { log_error("Failed to connect to netlink: %s", strerror(-r)); return r; @@ -1483,7 +1568,7 @@ static int move_network_interfaces(pid_t pid) { return -EBUSY; } - r = sd_rtnl_message_new_link(rtnl, RTM_NEWLINK, ifi, &m); + r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, ifi); if (r < 0) { log_error("Failed to allocate netlink message: %s", strerror(-r)); return r; @@ -1573,7 +1658,7 @@ int main(int argc, char *argv[]) { int n_fd_passed; pid_t pid = 0; sigset_t mask; - char veth_name[IFNAMSIZ] = "ve-"; + char veth_name[IFNAMSIZ]; log_parse_environment(); log_open(); @@ -1983,6 +2068,13 @@ int main(int argc, char *argv[]) { setup_hostname(); + if (arg_personality != 0xffffffffLU) { + if (personality(arg_personality) < 0) { + log_error("personality() failed: %m"); + goto child_fail; + } + } + eventfd_read(sync_fd, &x); close_nointr_nofail(sync_fd); sync_fd = -1;