1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
4 This file is part of systemd.
6 Copyright 2010 Lennart Poettering
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
11 (at your option) any later version.
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Lesser General Public License for more details.
18 You should have received a copy of the GNU Lesser General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
25 #include <sys/types.h>
26 #include <sys/syscall.h>
27 #include <sys/mount.h>
33 #include <sys/prctl.h>
34 #include <sys/capability.h>
37 #include <sys/signalfd.h>
41 #include <sys/socket.h>
42 #include <linux/netlink.h>
44 #include <linux/veth.h>
45 #include <sys/personality.h>
46 #include <linux/loop.h>
49 #include <selinux/selinux.h>
57 #include <blkid/blkid.h>
60 #include "sd-daemon.h"
70 #include "cgroup-util.h"
72 #include "path-util.h"
73 #include "loopback-setup.h"
74 #include "dev-setup.h"
79 #include "bus-error.h"
81 #include "bus-kernel.h"
84 #include "rtnl-util.h"
85 #include "udev-util.h"
86 #include "blkid-util.h"
88 #include "siphash24.h"
90 #include "base-filesystem.h"
92 #include "event-util.h"
95 #include "seccomp-util.h"
98 typedef enum ContainerStatus {
103 typedef enum LinkJournal {
110 typedef enum Volatile {
116 static char *arg_directory = NULL;
117 static char *arg_user = NULL;
118 static sd_id128_t arg_uuid = {};
119 static char *arg_machine = NULL;
120 static const char *arg_selinux_context = NULL;
121 static const char *arg_selinux_apifs_context = NULL;
122 static const char *arg_slice = NULL;
123 static bool arg_private_network = false;
124 static bool arg_read_only = false;
125 static bool arg_boot = false;
126 static LinkJournal arg_link_journal = LINK_AUTO;
127 static bool arg_link_journal_try = false;
128 static uint64_t arg_retain =
129 (1ULL << CAP_CHOWN) |
130 (1ULL << CAP_DAC_OVERRIDE) |
131 (1ULL << CAP_DAC_READ_SEARCH) |
132 (1ULL << CAP_FOWNER) |
133 (1ULL << CAP_FSETID) |
134 (1ULL << CAP_IPC_OWNER) |
136 (1ULL << CAP_LEASE) |
137 (1ULL << CAP_LINUX_IMMUTABLE) |
138 (1ULL << CAP_NET_BIND_SERVICE) |
139 (1ULL << CAP_NET_BROADCAST) |
140 (1ULL << CAP_NET_RAW) |
141 (1ULL << CAP_SETGID) |
142 (1ULL << CAP_SETFCAP) |
143 (1ULL << CAP_SETPCAP) |
144 (1ULL << CAP_SETUID) |
145 (1ULL << CAP_SYS_ADMIN) |
146 (1ULL << CAP_SYS_CHROOT) |
147 (1ULL << CAP_SYS_NICE) |
148 (1ULL << CAP_SYS_PTRACE) |
149 (1ULL << CAP_SYS_TTY_CONFIG) |
150 (1ULL << CAP_SYS_RESOURCE) |
151 (1ULL << CAP_SYS_BOOT) |
152 (1ULL << CAP_AUDIT_WRITE) |
153 (1ULL << CAP_AUDIT_CONTROL) |
155 static char **arg_bind = NULL;
156 static char **arg_bind_ro = NULL;
157 static char **arg_tmpfs = NULL;
158 static char **arg_setenv = NULL;
159 static bool arg_quiet = false;
160 static bool arg_share_system = false;
161 static bool arg_register = true;
162 static bool arg_keep_unit = false;
163 static char **arg_network_interfaces = NULL;
164 static char **arg_network_macvlan = NULL;
165 static bool arg_network_veth = false;
166 static const char *arg_network_bridge = NULL;
167 static unsigned long arg_personality = 0xffffffffLU;
168 static const char *arg_image = NULL;
169 static Volatile arg_volatile = VOLATILE_NO;
171 static void help(void) {
172 printf("%s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
173 "Spawn a minimal namespace container for debugging, testing and building.\n\n"
174 " -h --help Show this help\n"
175 " --version Print version string\n"
176 " -q --quiet Do not show status information\n"
177 " -D --directory=PATH Root directory for the container\n"
178 " -i --image=PATH File system device or image for the container\n"
179 " -b --boot Boot up full system (i.e. invoke init)\n"
180 " -u --user=USER Run the command under specified user or uid\n"
181 " -M --machine=NAME Set the machine name for the container\n"
182 " --uuid=UUID Set a specific machine UUID for the container\n"
183 " -S --slice=SLICE Place the container in the specified slice\n"
184 " --private-network Disable network in container\n"
185 " --network-interface=INTERFACE\n"
186 " Assign an existing network interface to the\n"
188 " --network-macvlan=INTERFACE\n"
189 " Create a macvlan network interface based on an\n"
190 " existing network interface to the container\n"
191 " --network-veth Add a virtual ethernet connection between host\n"
193 " --network-bridge=INTERFACE\n"
194 " Add a virtual ethernet connection between host\n"
195 " and container and add it to an existing bridge on\n"
197 " -Z --selinux-context=SECLABEL\n"
198 " Set the SELinux security context to be used by\n"
199 " processes in the container\n"
200 " -L --selinux-apifs-context=SECLABEL\n"
201 " Set the SELinux security context to be used by\n"
202 " API/tmpfs file systems in the container\n"
203 " --capability=CAP In addition to the default, retain specified\n"
205 " --drop-capability=CAP Drop the specified capability from the default set\n"
206 " --link-journal=MODE Link up guest journal, one of no, auto, guest, host,\n"
207 " try-guest, try-host\n"
208 " -j Equivalent to --link-journal=try-guest\n"
209 " --read-only Mount the root directory read-only\n"
210 " --bind=PATH[:PATH] Bind mount a file or directory from the host into\n"
212 " --bind-ro=PATH[:PATH] Similar, but creates a read-only bind mount\n"
213 " --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
214 " --setenv=NAME=VALUE Pass an environment variable to PID 1\n"
215 " --share-system Share system namespaces with host\n"
216 " --register=BOOLEAN Register container as machine\n"
217 " --keep-unit Do not register a scope for the machine, reuse\n"
218 " the service unit nspawn is running in\n"
219 " --volatile[=MODE] Run the system in volatile mode\n",
220 program_invocation_short_name);
223 static int parse_argv(int argc, char *argv[]) {
240 ARG_NETWORK_INTERFACE,
248 static const struct option options[] = {
249 { "help", no_argument, NULL, 'h' },
250 { "version", no_argument, NULL, ARG_VERSION },
251 { "directory", required_argument, NULL, 'D' },
252 { "user", required_argument, NULL, 'u' },
253 { "private-network", no_argument, NULL, ARG_PRIVATE_NETWORK },
254 { "boot", no_argument, NULL, 'b' },
255 { "uuid", required_argument, NULL, ARG_UUID },
256 { "read-only", no_argument, NULL, ARG_READ_ONLY },
257 { "capability", required_argument, NULL, ARG_CAPABILITY },
258 { "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
259 { "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
260 { "bind", required_argument, NULL, ARG_BIND },
261 { "bind-ro", required_argument, NULL, ARG_BIND_RO },
262 { "tmpfs", required_argument, NULL, ARG_TMPFS },
263 { "machine", required_argument, NULL, 'M' },
264 { "slice", required_argument, NULL, 'S' },
265 { "setenv", required_argument, NULL, ARG_SETENV },
266 { "selinux-context", required_argument, NULL, 'Z' },
267 { "selinux-apifs-context", required_argument, NULL, 'L' },
268 { "quiet", no_argument, NULL, 'q' },
269 { "share-system", no_argument, NULL, ARG_SHARE_SYSTEM },
270 { "register", required_argument, NULL, ARG_REGISTER },
271 { "keep-unit", no_argument, NULL, ARG_KEEP_UNIT },
272 { "network-interface", required_argument, NULL, ARG_NETWORK_INTERFACE },
273 { "network-macvlan", required_argument, NULL, ARG_NETWORK_MACVLAN },
274 { "network-veth", no_argument, NULL, ARG_NETWORK_VETH },
275 { "network-bridge", required_argument, NULL, ARG_NETWORK_BRIDGE },
276 { "personality", required_argument, NULL, ARG_PERSONALITY },
277 { "image", required_argument, NULL, 'i' },
278 { "volatile", optional_argument, NULL, ARG_VOLATILE },
283 uint64_t plus = 0, minus = 0;
288 while ((c = getopt_long(argc, argv, "+hD:u:bL:M:jS:Z:qi:", options, NULL)) >= 0)
297 puts(PACKAGE_STRING);
298 puts(SYSTEMD_FEATURES);
303 arg_directory = canonicalize_file_name(optarg);
304 if (!arg_directory) {
305 log_error("Invalid root directory: %m");
317 arg_user = strdup(optarg);
323 case ARG_NETWORK_BRIDGE:
324 arg_network_bridge = optarg;
328 case ARG_NETWORK_VETH:
329 arg_network_veth = true;
330 arg_private_network = true;
333 case ARG_NETWORK_INTERFACE:
334 if (strv_extend(&arg_network_interfaces, optarg) < 0)
337 arg_private_network = true;
340 case ARG_NETWORK_MACVLAN:
341 if (strv_extend(&arg_network_macvlan, optarg) < 0)
346 case ARG_PRIVATE_NETWORK:
347 arg_private_network = true;
355 r = sd_id128_from_string(optarg, &arg_uuid);
357 log_error("Invalid UUID: %s", optarg);
367 if (isempty(optarg)) {
372 if (!hostname_is_valid(optarg)) {
373 log_error("Invalid machine name: %s", optarg);
378 arg_machine = strdup(optarg);
386 arg_selinux_context = optarg;
390 arg_selinux_apifs_context = optarg;
394 arg_read_only = true;
398 case ARG_DROP_CAPABILITY: {
399 const char *state, *word;
402 FOREACH_WORD_SEPARATOR(word, length, optarg, ",", state) {
403 _cleanup_free_ char *t;
406 t = strndup(word, length);
410 if (streq(t, "all")) {
411 if (c == ARG_CAPABILITY)
412 plus = (uint64_t) -1;
414 minus = (uint64_t) -1;
416 if (cap_from_name(t, &cap) < 0) {
417 log_error("Failed to parse capability %s.", t);
421 if (c == ARG_CAPABILITY)
422 plus |= 1ULL << (uint64_t) cap;
424 minus |= 1ULL << (uint64_t) cap;
432 arg_link_journal = LINK_GUEST;
433 arg_link_journal_try = true;
436 case ARG_LINK_JOURNAL:
437 if (streq(optarg, "auto"))
438 arg_link_journal = LINK_AUTO;
439 else if (streq(optarg, "no"))
440 arg_link_journal = LINK_NO;
441 else if (streq(optarg, "guest"))
442 arg_link_journal = LINK_GUEST;
443 else if (streq(optarg, "host"))
444 arg_link_journal = LINK_HOST;
445 else if (streq(optarg, "try-guest")) {
446 arg_link_journal = LINK_GUEST;
447 arg_link_journal_try = true;
448 } else if (streq(optarg, "try-host")) {
449 arg_link_journal = LINK_HOST;
450 arg_link_journal_try = true;
452 log_error("Failed to parse link journal mode %s", optarg);
460 _cleanup_free_ char *a = NULL, *b = NULL;
464 x = c == ARG_BIND ? &arg_bind : &arg_bind_ro;
466 e = strchr(optarg, ':');
468 a = strndup(optarg, e - optarg);
478 if (!path_is_absolute(a) || !path_is_absolute(b)) {
479 log_error("Invalid bind mount specification: %s", optarg);
483 r = strv_extend(x, a);
487 r = strv_extend(x, b);
495 _cleanup_free_ char *a = NULL, *b = NULL;
498 e = strchr(optarg, ':');
500 a = strndup(optarg, e - optarg);
504 b = strdup("mode=0755");
510 if (!path_is_absolute(a)) {
511 log_error("Invalid tmpfs specification: %s", optarg);
515 r = strv_push(&arg_tmpfs, a);
521 r = strv_push(&arg_tmpfs, b);
533 if (!env_assignment_is_valid(optarg)) {
534 log_error("Environment variable assignment '%s' is not valid.", optarg);
538 n = strv_env_set(arg_setenv, optarg);
542 strv_free(arg_setenv);
551 case ARG_SHARE_SYSTEM:
552 arg_share_system = true;
556 r = parse_boolean(optarg);
558 log_error("Failed to parse --register= argument: %s", optarg);
566 arg_keep_unit = true;
569 case ARG_PERSONALITY:
571 arg_personality = personality_from_string(optarg);
572 if (arg_personality == 0xffffffffLU) {
573 log_error("Unknown or unsupported personality '%s'.", optarg);
582 arg_volatile = VOLATILE_YES;
584 r = parse_boolean(optarg);
586 if (streq(optarg, "state"))
587 arg_volatile = VOLATILE_STATE;
589 log_error("Failed to parse --volatile= argument: %s", optarg);
593 arg_volatile = r ? VOLATILE_YES : VOLATILE_NO;
602 assert_not_reached("Unhandled option");
605 if (arg_share_system)
606 arg_register = false;
608 if (arg_boot && arg_share_system) {
609 log_error("--boot and --share-system may not be combined.");
613 if (arg_keep_unit && cg_pid_get_owner_uid(0, NULL) >= 0) {
614 log_error("--keep-unit may not be used when invoked from a user session.");
618 if (arg_directory && arg_image) {
619 log_error("--directory= and --image= may not be combined.");
623 if (arg_volatile != VOLATILE_NO && arg_read_only) {
624 log_error("Cannot combine --read-only with --volatile. Note that --volatile already implies a read-only base hierarchy.");
628 arg_retain = (arg_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus;
633 static int mount_all(const char *dest) {
635 typedef struct MountPoint {
644 static const MountPoint mount_table[] = {
645 { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
646 { "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND, true }, /* Bind mount first */
647 { NULL, "/proc/sys", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, true }, /* Then, make it r/o */
648 { "sysfs", "/sys", "sysfs", NULL, MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
649 { "tmpfs", "/dev", "tmpfs", "mode=755", MS_NOSUID|MS_STRICTATIME, true },
650 { "devpts", "/dev/pts", "devpts","newinstance,ptmxmode=0666,mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC, true },
651 { "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true },
652 { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, true },
654 { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND, false }, /* Bind mount first */
655 { NULL, "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, false }, /* Then, make it r/o */
662 for (k = 0; k < ELEMENTSOF(mount_table); k++) {
663 _cleanup_free_ char *where = NULL;
665 _cleanup_free_ char *options = NULL;
670 where = strjoin(dest, "/", mount_table[k].where, NULL);
674 t = path_is_mount_point(where, true);
676 log_error_errno(t, "Failed to detect whether %s is a mount point: %m", where);
684 /* Skip this entry if it is not a remount. */
685 if (mount_table[k].what && t > 0)
688 t = mkdir_p(where, 0755);
690 if (mount_table[k].fatal) {
691 log_error_errno(t, "Failed to create directory %s: %m", where);
696 log_warning_errno(t, "Failed to create directory %s: %m", where);
702 if (arg_selinux_apifs_context &&
703 (streq_ptr(mount_table[k].what, "tmpfs") || streq_ptr(mount_table[k].what, "devpts"))) {
704 options = strjoin(mount_table[k].options, ",context=\"", arg_selinux_apifs_context, "\"", NULL);
711 o = mount_table[k].options;
714 if (mount(mount_table[k].what,
717 mount_table[k].flags,
720 if (mount_table[k].fatal) {
721 log_error("mount(%s) failed: %m", where);
726 log_warning("mount(%s) failed: %m", where);
733 static int mount_binds(const char *dest, char **l, bool ro) {
736 STRV_FOREACH_PAIR(x, y, l) {
737 _cleanup_free_ char *where = NULL;
738 struct stat source_st, dest_st;
741 if (stat(*x, &source_st) < 0) {
742 log_error("Failed to stat %s: %m", *x);
746 where = strappend(dest, *y);
750 r = stat(where, &dest_st);
752 if ((source_st.st_mode & S_IFMT) != (dest_st.st_mode & S_IFMT)) {
753 log_error("The file types of %s and %s do not match. Refusing bind mount", *x, where);
756 } else if (errno == ENOENT) {
757 r = mkdir_parents_label(where, 0755);
759 return log_error_errno(r, "Failed to bind mount %s: %m", *x);
761 log_error("Failed to bind mount %s: %m", *x);
765 /* Create the mount point, but be conservative -- refuse to create block
766 * and char devices. */
767 if (S_ISDIR(source_st.st_mode)) {
768 r = mkdir_label(where, 0755);
769 if (r < 0 && errno != EEXIST)
770 return log_error_errno(r, "Failed to create mount point %s: %m", where);
771 } else if (S_ISFIFO(source_st.st_mode)) {
772 r = mkfifo(where, 0644);
773 if (r < 0 && errno != EEXIST) {
774 log_error("Failed to create mount point %s: %m", where);
778 } else if (S_ISSOCK(source_st.st_mode)) {
779 r = mknod(where, 0644 | S_IFSOCK, 0);
780 if (r < 0 && errno != EEXIST) {
781 log_error("Failed to create mount point %s: %m", where);
785 } else if (S_ISREG(source_st.st_mode)) {
788 return log_error_errno(r, "Failed to create mount point %s: %m", where);
790 log_error("Refusing to create mountpoint for file: %s", *x);
794 if (mount(*x, where, "bind", MS_BIND, NULL) < 0) {
795 log_error("mount(%s) failed: %m", where);
800 r = bind_remount_recursive(where, true);
802 return log_error_errno(r, "Read-Only bind mount failed: %m");
809 static int mount_tmpfs(const char *dest) {
812 STRV_FOREACH_PAIR(i, o, arg_tmpfs) {
813 _cleanup_free_ char *where = NULL;
816 where = strappend(dest, *i);
820 r = mkdir_label(where, 0755);
821 if (r < 0 && errno != EEXIST)
822 return log_error_errno(r, "creating mount point for tmpfs %s failed: %m", where);
824 if (mount("tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, *o) < 0) {
825 log_error("tmpfs mount to %s failed: %m", where);
833 static int setup_timezone(const char *dest) {
834 _cleanup_free_ char *where = NULL, *p = NULL, *q = NULL, *check = NULL, *what = NULL;
840 /* Fix the timezone, if possible */
841 r = readlink_malloc("/etc/localtime", &p);
843 log_warning("/etc/localtime is not a symlink, not updating container timezone.");
847 z = path_startswith(p, "../usr/share/zoneinfo/");
849 z = path_startswith(p, "/usr/share/zoneinfo/");
851 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
855 where = strappend(dest, "/etc/localtime");
859 r = readlink_malloc(where, &q);
861 y = path_startswith(q, "../usr/share/zoneinfo/");
863 y = path_startswith(q, "/usr/share/zoneinfo/");
865 /* Already pointing to the right place? Then do nothing .. */
866 if (y && streq(y, z))
870 check = strjoin(dest, "/usr/share/zoneinfo/", z, NULL);
874 if (access(check, F_OK) < 0) {
875 log_warning("Timezone %s does not exist in container, not updating container timezone.", z);
879 what = strappend("../usr/share/zoneinfo/", z);
883 r = mkdir_parents(where, 0755);
885 log_error_errno(r, "Failed to create directory for timezone info %s in container: %m", where);
891 if (r < 0 && errno != ENOENT) {
892 log_error("Failed to remove existing timezone info %s in container: %m", where);
897 if (symlink(what, where) < 0) {
898 log_error("Failed to correct timezone of container: %m");
905 static int setup_resolv_conf(const char *dest) {
906 _cleanup_free_ char *where = NULL;
911 if (arg_private_network)
914 /* Fix resolv.conf, if possible */
915 where = strappend(dest, "/etc/resolv.conf");
919 /* We don't really care for the results of this really. If it
920 * fails, it fails, but meh... */
921 r = mkdir_parents(where, 0755);
923 log_warning_errno(r, "Failed to create parent directory for resolv.conf %s: %m", where);
928 r = copy_file("/etc/resolv.conf", where, O_TRUNC|O_NOFOLLOW, 0644);
930 log_warning_errno(r, "Failed to copy /etc/resolv.conf to %s: %m", where);
938 static int setup_volatile_state(const char *directory) {
944 if (arg_volatile != VOLATILE_STATE)
947 /* --volatile=state means we simply overmount /var
948 with a tmpfs, and the rest read-only. */
950 r = bind_remount_recursive(directory, true);
952 return log_error_errno(r, "Failed to remount %s read-only: %m", directory);
954 p = strappenda(directory, "/var");
956 if (r < 0 && errno != EEXIST) {
957 log_error("Failed to create %s: %m", directory);
961 if (mount("tmpfs", p, "tmpfs", MS_STRICTATIME, "mode=755") < 0) {
962 log_error("Failed to mount tmpfs to /var: %m");
969 static int setup_volatile(const char *directory) {
970 bool tmpfs_mounted = false, bind_mounted = false;
971 char template[] = "/tmp/nspawn-volatile-XXXXXX";
977 if (arg_volatile != VOLATILE_YES)
980 /* --volatile=yes means we mount a tmpfs to the root dir, and
981 the original /usr to use inside it, and that read-only. */
983 if (!mkdtemp(template)) {
984 log_error("Failed to create temporary directory: %m");
988 if (mount("tmpfs", template, "tmpfs", MS_STRICTATIME, "mode=755") < 0) {
989 log_error("Failed to mount tmpfs for root directory: %m");
994 tmpfs_mounted = true;
996 f = strappenda(directory, "/usr");
997 t = strappenda(template, "/usr");
1000 if (r < 0 && errno != EEXIST) {
1001 log_error("Failed to create %s: %m", t);
1006 if (mount(f, t, "bind", MS_BIND|MS_REC, NULL) < 0) {
1007 log_error("Failed to create /usr bind mount: %m");
1012 bind_mounted = true;
1014 r = bind_remount_recursive(t, true);
1016 log_error_errno(r, "Failed to remount %s read-only: %m", t);
1020 if (mount(template, directory, NULL, MS_MOVE, NULL) < 0) {
1021 log_error("Failed to move root mount: %m");
1039 static char* id128_format_as_uuid(sd_id128_t id, char s[37]) {
1042 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
1043 SD_ID128_FORMAT_VAL(id));
1048 static int setup_boot_id(const char *dest) {
1049 _cleanup_free_ char *from = NULL, *to = NULL;
1050 sd_id128_t rnd = {};
1056 if (arg_share_system)
1059 /* Generate a new randomized boot ID, so that each boot-up of
1060 * the container gets a new one */
1062 from = strappend(dest, "/dev/proc-sys-kernel-random-boot-id");
1063 to = strappend(dest, "/proc/sys/kernel/random/boot_id");
1067 r = sd_id128_randomize(&rnd);
1069 return log_error_errno(r, "Failed to generate random boot id: %m");
1071 id128_format_as_uuid(rnd, as_uuid);
1073 r = write_string_file(from, as_uuid);
1075 return log_error_errno(r, "Failed to write boot id: %m");
1077 if (mount(from, to, "bind", MS_BIND, NULL) < 0) {
1078 log_error("Failed to bind mount boot id: %m");
1080 } else if (mount(from, to, "bind", MS_BIND|MS_REMOUNT|MS_RDONLY, NULL))
1081 log_warning("Failed to make boot id read-only: %m");
1087 static int copy_devnodes(const char *dest) {
1089 static const char devnodes[] =
1100 _cleanup_umask_ mode_t u;
1106 NULSTR_FOREACH(d, devnodes) {
1107 _cleanup_free_ char *from = NULL, *to = NULL;
1110 from = strappend("/dev/", d);
1111 to = strjoin(dest, "/dev/", d, NULL);
1115 if (stat(from, &st) < 0) {
1117 if (errno != ENOENT) {
1118 log_error("Failed to stat %s: %m", from);
1122 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode)) {
1124 log_error("%s is not a char or block device, cannot copy", from);
1128 r = mkdir_parents(to, 0775);
1130 log_error_errno(r, "Failed to create parent directory of %s: %m", to);
1134 if (mknod(to, st.st_mode, st.st_rdev) < 0) {
1135 log_error("mknod(%s) failed: %m", dest);
1144 static int setup_ptmx(const char *dest) {
1145 _cleanup_free_ char *p = NULL;
1147 p = strappend(dest, "/dev/ptmx");
1151 if (symlink("pts/ptmx", p) < 0) {
1152 log_error("Failed to create /dev/ptmx symlink: %m");
1159 static int setup_dev_console(const char *dest, const char *console) {
1160 _cleanup_umask_ mode_t u;
1170 if (stat("/dev/null", &st) < 0) {
1171 log_error("Failed to stat /dev/null: %m");
1175 r = chmod_and_chown(console, 0600, 0, 0);
1177 return log_error_errno(r, "Failed to correct access mode for TTY: %m");
1179 /* We need to bind mount the right tty to /dev/console since
1180 * ptys can only exist on pts file systems. To have something
1181 * to bind mount things on we create a device node first, and
1182 * use /dev/null for that since we the cgroups device policy
1183 * allows us to create that freely, while we cannot create
1184 * /dev/console. (Note that the major minor doesn't actually
1185 * matter here, since we mount it over anyway). */
1187 to = strappenda(dest, "/dev/console");
1188 if (mknod(to, (st.st_mode & ~07777) | 0600, st.st_rdev) < 0) {
1189 log_error("mknod() for /dev/console failed: %m");
1193 if (mount(console, to, "bind", MS_BIND, NULL) < 0) {
1194 log_error("Bind mount for /dev/console failed: %m");
1201 static int setup_kmsg(const char *dest, int kmsg_socket) {
1202 _cleanup_free_ char *from = NULL, *to = NULL;
1204 _cleanup_umask_ mode_t u;
1206 struct cmsghdr cmsghdr;
1207 uint8_t buf[CMSG_SPACE(sizeof(int))];
1209 struct msghdr mh = {
1210 .msg_control = &control,
1211 .msg_controllen = sizeof(control),
1213 struct cmsghdr *cmsg;
1216 assert(kmsg_socket >= 0);
1220 /* We create the kmsg FIFO as /dev/kmsg, but immediately
1221 * delete it after bind mounting it to /proc/kmsg. While FIFOs
1222 * on the reading side behave very similar to /proc/kmsg,
1223 * their writing side behaves differently from /dev/kmsg in
1224 * that writing blocks when nothing is reading. In order to
1225 * avoid any problems with containers deadlocking due to this
1226 * we simply make /dev/kmsg unavailable to the container. */
1227 if (asprintf(&from, "%s/dev/kmsg", dest) < 0 ||
1228 asprintf(&to, "%s/proc/kmsg", dest) < 0)
1231 if (mkfifo(from, 0600) < 0) {
1232 log_error("mkfifo() for /dev/kmsg failed: %m");
1236 r = chmod_and_chown(from, 0600, 0, 0);
1238 return log_error_errno(r, "Failed to correct access mode for /dev/kmsg: %m");
1240 if (mount(from, to, "bind", MS_BIND, NULL) < 0) {
1241 log_error("Bind mount for /proc/kmsg failed: %m");
1245 fd = open(from, O_RDWR|O_NDELAY|O_CLOEXEC);
1247 log_error("Failed to open fifo: %m");
1251 cmsg = CMSG_FIRSTHDR(&mh);
1252 cmsg->cmsg_level = SOL_SOCKET;
1253 cmsg->cmsg_type = SCM_RIGHTS;
1254 cmsg->cmsg_len = CMSG_LEN(sizeof(int));
1255 memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
1257 mh.msg_controllen = cmsg->cmsg_len;
1259 /* Store away the fd in the socket, so that it stays open as
1260 * long as we run the child */
1261 k = sendmsg(kmsg_socket, &mh, MSG_DONTWAIT|MSG_NOSIGNAL);
1265 log_error("Failed to send FIFO fd: %m");
1269 /* And now make the FIFO unavailable as /dev/kmsg... */
1274 static int setup_hostname(void) {
1276 if (arg_share_system)
1279 if (sethostname_idempotent(arg_machine) < 0)
1285 static int setup_journal(const char *directory) {
1286 sd_id128_t machine_id, this_id;
1287 _cleanup_free_ char *p = NULL, *b = NULL, *q = NULL, *d = NULL;
1291 p = strappend(directory, "/etc/machine-id");
1295 r = read_one_line_file(p, &b);
1296 if (r == -ENOENT && arg_link_journal == LINK_AUTO)
1299 return log_error_errno(r, "Failed to read machine ID from %s: %m", p);
1302 if (isempty(id) && arg_link_journal == LINK_AUTO)
1305 /* Verify validity */
1306 r = sd_id128_from_string(id, &machine_id);
1308 return log_error_errno(r, "Failed to parse machine ID from %s: %m", p);
1310 r = sd_id128_get_machine(&this_id);
1312 return log_error_errno(r, "Failed to retrieve machine ID: %m");
1314 if (sd_id128_equal(machine_id, this_id)) {
1315 log_full(arg_link_journal == LINK_AUTO ? LOG_WARNING : LOG_ERR,
1316 "Host and machine ids are equal (%s): refusing to link journals", id);
1317 if (arg_link_journal == LINK_AUTO)
1323 if (arg_link_journal == LINK_NO)
1327 p = strappend("/var/log/journal/", id);
1328 q = strjoin(directory, "/var/log/journal/", id, NULL);
1332 if (path_is_mount_point(p, false) > 0) {
1333 if (arg_link_journal != LINK_AUTO) {
1334 log_error("%s: already a mount point, refusing to use for journal", p);
1341 if (path_is_mount_point(q, false) > 0) {
1342 if (arg_link_journal != LINK_AUTO) {
1343 log_error("%s: already a mount point, refusing to use for journal", q);
1350 r = readlink_and_make_absolute(p, &d);
1352 if ((arg_link_journal == LINK_GUEST ||
1353 arg_link_journal == LINK_AUTO) &&
1356 r = mkdir_p(q, 0755);
1358 log_warning("Failed to create directory %s: %m", q);
1362 if (unlink(p) < 0) {
1363 log_error("Failed to remove symlink %s: %m", p);
1366 } else if (r == -EINVAL) {
1368 if (arg_link_journal == LINK_GUEST &&
1371 if (errno == ENOTDIR) {
1372 log_error("%s already exists and is neither a symlink nor a directory", p);
1375 log_error("Failed to remove %s: %m", p);
1379 } else if (r != -ENOENT) {
1380 log_error("readlink(%s) failed: %m", p);
1384 if (arg_link_journal == LINK_GUEST) {
1386 if (symlink(q, p) < 0) {
1387 if (arg_link_journal_try) {
1388 log_debug("Failed to symlink %s to %s, skipping journal setup: %m", q, p);
1391 log_error("Failed to symlink %s to %s: %m", q, p);
1396 r = mkdir_p(q, 0755);
1398 log_warning("Failed to create directory %s: %m", q);
1402 if (arg_link_journal == LINK_HOST) {
1403 /* don't create parents here -- if the host doesn't have
1404 * permanent journal set up, don't force it here */
1407 if (arg_link_journal_try) {
1408 log_debug("Failed to create %s, skipping journal setup: %m", p);
1411 log_error("Failed to create %s: %m", p);
1416 } else if (access(p, F_OK) < 0)
1419 if (dir_is_empty(q) == 0)
1420 log_warning("%s is not empty, proceeding anyway.", q);
1422 r = mkdir_p(q, 0755);
1424 log_error("Failed to create %s: %m", q);
1428 if (mount(p, q, "bind", MS_BIND, NULL) < 0) {
1429 log_error("Failed to bind mount journal from host into guest: %m");
1436 static int drop_capabilities(void) {
1437 return capability_bounding_set_drop(~arg_retain, false);
1440 static int register_machine(pid_t pid, int local_ifindex) {
1441 _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1442 _cleanup_bus_close_unref_ sd_bus *bus = NULL;
1448 r = sd_bus_default_system(&bus);
1450 return log_error_errno(r, "Failed to open system bus: %m");
1452 if (arg_keep_unit) {
1453 r = sd_bus_call_method(
1455 "org.freedesktop.machine1",
1456 "/org/freedesktop/machine1",
1457 "org.freedesktop.machine1.Manager",
1458 "RegisterMachineWithNetwork",
1463 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
1467 strempty(arg_directory),
1468 local_ifindex > 0 ? 1 : 0, local_ifindex);
1470 _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
1472 r = sd_bus_message_new_method_call(
1475 "org.freedesktop.machine1",
1476 "/org/freedesktop/machine1",
1477 "org.freedesktop.machine1.Manager",
1478 "CreateMachineWithNetwork");
1480 return log_error_errno(r, "Failed to create message: %m");
1482 r = sd_bus_message_append(
1486 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
1490 strempty(arg_directory),
1491 local_ifindex > 0 ? 1 : 0, local_ifindex);
1493 return log_error_errno(r, "Failed to append message arguments: %m");
1495 r = sd_bus_message_open_container(m, 'a', "(sv)");
1497 return log_error_errno(r, "Failed to open container: %m");
1499 if (!isempty(arg_slice)) {
1500 r = sd_bus_message_append(m, "(sv)", "Slice", "s", arg_slice);
1502 return log_error_errno(r, "Failed to append slice: %m");
1505 r = sd_bus_message_append(m, "(sv)", "DevicePolicy", "s", "strict");
1507 return log_error_errno(r, "Failed to add device policy: %m");
1509 r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 9,
1510 /* Allow the container to
1511 * access and create the API
1512 * device nodes, so that
1513 * PrivateDevices= in the
1514 * container can work
1519 "/dev/random", "rwm",
1520 "/dev/urandom", "rwm",
1522 "/dev/net/tun", "rwm",
1523 /* Allow the container
1524 * access to ptys. However,
1526 * container to ever create
1527 * these device nodes. */
1528 "/dev/pts/ptmx", "rw",
1531 return log_error_errno(r, "Failed to add device whitelist: %m");
1533 r = sd_bus_message_close_container(m);
1535 return log_error_errno(r, "Failed to close container: %m");
1537 r = sd_bus_call(bus, m, 0, &error, NULL);
1541 log_error("Failed to register machine: %s", bus_error_message(&error, r));
1548 static int terminate_machine(pid_t pid) {
1549 _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1550 _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
1551 _cleanup_bus_close_unref_ sd_bus *bus = NULL;
1558 r = sd_bus_default_system(&bus);
1560 return log_error_errno(r, "Failed to open system bus: %m");
1562 r = sd_bus_call_method(
1564 "org.freedesktop.machine1",
1565 "/org/freedesktop/machine1",
1566 "org.freedesktop.machine1.Manager",
1573 /* Note that the machine might already have been
1574 * cleaned up automatically, hence don't consider it a
1575 * failure if we cannot get the machine object. */
1576 log_debug("Failed to get machine: %s", bus_error_message(&error, r));
1580 r = sd_bus_message_read(reply, "o", &path);
1582 return bus_log_parse_error(r);
1584 r = sd_bus_call_method(
1586 "org.freedesktop.machine1",
1588 "org.freedesktop.machine1.Machine",
1594 log_debug("Failed to terminate machine: %s", bus_error_message(&error, r));
1601 static int reset_audit_loginuid(void) {
1602 _cleanup_free_ char *p = NULL;
1605 if (arg_share_system)
1608 r = read_one_line_file("/proc/self/loginuid", &p);
1612 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
1614 /* Already reset? */
1615 if (streq(p, "4294967295"))
1618 r = write_string_file("/proc/self/loginuid", "4294967295");
1620 log_error("Failed to reset audit login UID. This probably means that your kernel is too\n"
1621 "old and you have audit enabled. Note that the auditing subsystem is known to\n"
1622 "be incompatible with containers on old kernels. Please make sure to upgrade\n"
1623 "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
1624 "using systemd-nspawn. Sleeping for 5s... (%s)\n", strerror(-r));
1632 #define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
1633 #define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
1635 static int generate_mac(struct ether_addr *mac, sd_id128_t hash_key) {
1642 l = strlen(arg_machine);
1643 sz = sizeof(sd_id128_t) + l;
1646 /* fetch some persistent data unique to the host */
1647 r = sd_id128_get_machine((sd_id128_t*) v);
1651 /* combine with some data unique (on this host) to this
1652 * container instance */
1653 memcpy(v + sizeof(sd_id128_t), arg_machine, l);
1655 /* Let's hash the host machine ID plus the container name. We
1656 * use a fixed, but originally randomly created hash key here. */
1657 siphash24(result, v, sz, hash_key.bytes);
1659 assert_cc(ETH_ALEN <= sizeof(result));
1660 memcpy(mac->ether_addr_octet, result, ETH_ALEN);
1662 /* see eth_random_addr in the kernel */
1663 mac->ether_addr_octet[0] &= 0xfe; /* clear multicast bit */
1664 mac->ether_addr_octet[0] |= 0x02; /* set local assignment bit (IEEE802) */
1669 static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ], int *ifi) {
1670 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1671 _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1672 struct ether_addr mac_host, mac_container;
1675 if (!arg_private_network)
1678 if (!arg_network_veth)
1681 /* Use two different interface name prefixes depending whether
1682 * we are in bridge mode or not. */
1683 snprintf(iface_name, IFNAMSIZ - 1, "%s-%s",
1684 arg_network_bridge ? "vb" : "ve", arg_machine);
1686 r = generate_mac(&mac_container, CONTAINER_HASH_KEY);
1688 log_error("Failed to generate predictable MAC address for container side");
1692 r = generate_mac(&mac_host, HOST_HASH_KEY);
1694 log_error("Failed to generate predictable MAC address for host side");
1698 r = sd_rtnl_open(&rtnl, 0);
1700 return log_error_errno(r, "Failed to connect to netlink: %m");
1702 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
1704 return log_error_errno(r, "Failed to allocate netlink message: %m");
1706 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, iface_name);
1708 return log_error_errno(r, "Failed to add netlink interface name: %m");
1710 r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac_host);
1712 return log_error_errno(r, "Failed to add netlink MAC address: %m");
1714 r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
1716 return log_error_errno(r, "Failed to open netlink container: %m");
1718 r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "veth");
1720 return log_error_errno(r, "Failed to open netlink container: %m");
1722 r = sd_rtnl_message_open_container(m, VETH_INFO_PEER);
1724 return log_error_errno(r, "Failed to open netlink container: %m");
1726 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, "host0");
1728 return log_error_errno(r, "Failed to add netlink interface name: %m");
1730 r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac_container);
1732 return log_error_errno(r, "Failed to add netlink MAC address: %m");
1734 r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1736 return log_error_errno(r, "Failed to add netlink namespace field: %m");
1738 r = sd_rtnl_message_close_container(m);
1740 return log_error_errno(r, "Failed to close netlink container: %m");
1742 r = sd_rtnl_message_close_container(m);
1744 return log_error_errno(r, "Failed to close netlink container: %m");
1746 r = sd_rtnl_message_close_container(m);
1748 return log_error_errno(r, "Failed to close netlink container: %m");
1750 r = sd_rtnl_call(rtnl, m, 0, NULL);
1752 return log_error_errno(r, "Failed to add new veth interfaces: %m");
1754 i = (int) if_nametoindex(iface_name);
1756 log_error("Failed to resolve interface %s: %m", iface_name);
1765 static int setup_bridge(const char veth_name[], int *ifi) {
1766 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1767 _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1770 if (!arg_private_network)
1773 if (!arg_network_veth)
1776 if (!arg_network_bridge)
1779 bridge = (int) if_nametoindex(arg_network_bridge);
1781 log_error("Failed to resolve interface %s: %m", arg_network_bridge);
1787 r = sd_rtnl_open(&rtnl, 0);
1789 return log_error_errno(r, "Failed to connect to netlink: %m");
1791 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
1793 return log_error_errno(r, "Failed to allocate netlink message: %m");
1795 r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
1797 return log_error_errno(r, "Failed to set IFF_UP flag: %m");
1799 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, veth_name);
1801 return log_error_errno(r, "Failed to add netlink interface name field: %m");
1803 r = sd_rtnl_message_append_u32(m, IFLA_MASTER, bridge);
1805 return log_error_errno(r, "Failed to add netlink master field: %m");
1807 r = sd_rtnl_call(rtnl, m, 0, NULL);
1809 return log_error_errno(r, "Failed to add veth interface to bridge: %m");
1814 static int parse_interface(struct udev *udev, const char *name) {
1815 _cleanup_udev_device_unref_ struct udev_device *d = NULL;
1816 char ifi_str[2 + DECIMAL_STR_MAX(int)];
1819 ifi = (int) if_nametoindex(name);
1821 log_error("Failed to resolve interface %s: %m", name);
1825 sprintf(ifi_str, "n%i", ifi);
1826 d = udev_device_new_from_device_id(udev, ifi_str);
1828 log_error("Failed to get udev device for interface %s: %m", name);
1832 if (udev_device_get_is_initialized(d) <= 0) {
1833 log_error("Network interface %s is not initialized yet.", name);
1840 static int move_network_interfaces(pid_t pid) {
1841 _cleanup_udev_unref_ struct udev *udev = NULL;
1842 _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1846 if (!arg_private_network)
1849 if (strv_isempty(arg_network_interfaces))
1852 r = sd_rtnl_open(&rtnl, 0);
1854 return log_error_errno(r, "Failed to connect to netlink: %m");
1858 log_error("Failed to connect to udev.");
1862 STRV_FOREACH(i, arg_network_interfaces) {
1863 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1866 ifi = parse_interface(udev, *i);
1870 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
1872 return log_error_errno(r, "Failed to allocate netlink message: %m");
1874 r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1876 return log_error_errno(r, "Failed to append namespace PID to netlink message: %m");
1878 r = sd_rtnl_call(rtnl, m, 0, NULL);
1880 return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
1886 static int setup_macvlan(pid_t pid) {
1887 _cleanup_udev_unref_ struct udev *udev = NULL;
1888 _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1892 if (!arg_private_network)
1895 if (strv_isempty(arg_network_macvlan))
1898 r = sd_rtnl_open(&rtnl, 0);
1900 return log_error_errno(r, "Failed to connect to netlink: %m");
1904 log_error("Failed to connect to udev.");
1908 STRV_FOREACH(i, arg_network_macvlan) {
1909 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1910 _cleanup_free_ char *n = NULL;
1913 ifi = parse_interface(udev, *i);
1917 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
1919 return log_error_errno(r, "Failed to allocate netlink message: %m");
1921 r = sd_rtnl_message_append_u32(m, IFLA_LINK, ifi);
1923 return log_error_errno(r, "Failed to add netlink interface index: %m");
1925 n = strappend("mv-", *i);
1929 strshorten(n, IFNAMSIZ-1);
1931 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, n);
1933 return log_error_errno(r, "Failed to add netlink interface name: %m");
1935 r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1937 return log_error_errno(r, "Failed to add netlink namespace field: %m");
1939 r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
1941 return log_error_errno(r, "Failed to open netlink container: %m");
1943 r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
1945 return log_error_errno(r, "Failed to open netlink container: %m");
1947 r = sd_rtnl_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
1949 return log_error_errno(r, "Failed to append macvlan mode: %m");
1951 r = sd_rtnl_message_close_container(m);
1953 return log_error_errno(r, "Failed to close netlink container: %m");
1955 r = sd_rtnl_message_close_container(m);
1957 return log_error_errno(r, "Failed to close netlink container: %m");
1959 r = sd_rtnl_call(rtnl, m, 0, NULL);
1961 return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
1967 static int setup_seccomp(void) {
1970 static const int blacklist[] = {
1971 SCMP_SYS(kexec_load),
1972 SCMP_SYS(open_by_handle_at),
1973 SCMP_SYS(init_module),
1974 SCMP_SYS(finit_module),
1975 SCMP_SYS(delete_module),
1982 scmp_filter_ctx seccomp;
1986 seccomp = seccomp_init(SCMP_ACT_ALLOW);
1990 r = seccomp_add_secondary_archs(seccomp);
1992 log_error_errno(r, "Failed to add secondary archs to seccomp filter: %m");
1996 for (i = 0; i < ELEMENTSOF(blacklist); i++) {
1997 r = seccomp_rule_add(seccomp, SCMP_ACT_ERRNO(EPERM), blacklist[i], 0);
1999 continue; /* unknown syscall */
2001 log_error_errno(r, "Failed to block syscall: %m");
2007 Audit is broken in containers, much of the userspace audit
2008 hookup will fail if running inside a container. We don't
2009 care and just turn off creation of audit sockets.
2011 This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail
2012 with EAFNOSUPPORT which audit userspace uses as indication
2013 that audit is disabled in the kernel.
2016 r = seccomp_rule_add(
2018 SCMP_ACT_ERRNO(EAFNOSUPPORT),
2021 SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
2022 SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
2024 log_error_errno(r, "Failed to add audit seccomp rule: %m");
2028 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
2030 log_error_errno(r, "Failed to unset NO_NEW_PRIVS: %m");
2034 r = seccomp_load(seccomp);
2036 log_error_errno(r, "Failed to install seccomp audit filter: %m");
2039 seccomp_release(seccomp);
2047 static int setup_image(char **device_path, int *loop_nr) {
2048 struct loop_info64 info = {
2049 .lo_flags = LO_FLAGS_AUTOCLEAR|LO_FLAGS_PARTSCAN
2051 _cleanup_close_ int fd = -1, control = -1, loop = -1;
2052 _cleanup_free_ char* loopdev = NULL;
2056 assert(device_path);
2059 fd = open(arg_image, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
2061 log_error("Failed to open %s: %m", arg_image);
2065 if (fstat(fd, &st) < 0) {
2066 log_error("Failed to stat %s: %m", arg_image);
2070 if (S_ISBLK(st.st_mode)) {
2073 p = strdup(arg_image);
2087 if (!S_ISREG(st.st_mode)) {
2088 log_error("%s is not a regular file or block device: %m", arg_image);
2092 control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2094 log_error("Failed to open /dev/loop-control: %m");
2098 nr = ioctl(control, LOOP_CTL_GET_FREE);
2100 log_error("Failed to allocate loop device: %m");
2104 if (asprintf(&loopdev, "/dev/loop%i", nr) < 0)
2107 loop = open(loopdev, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
2109 log_error("Failed to open loop device %s: %m", loopdev);
2113 if (ioctl(loop, LOOP_SET_FD, fd) < 0) {
2114 log_error("Failed to set loopback file descriptor on %s: %m", loopdev);
2119 info.lo_flags |= LO_FLAGS_READ_ONLY;
2121 if (ioctl(loop, LOOP_SET_STATUS64, &info) < 0) {
2122 log_error("Failed to set loopback settings on %s: %m", loopdev);
2126 *device_path = loopdev;
2137 static int dissect_image(
2139 char **root_device, bool *root_device_rw,
2140 char **home_device, bool *home_device_rw,
2141 char **srv_device, bool *srv_device_rw,
2145 int home_nr = -1, root_nr = -1, secondary_root_nr = -1, srv_nr = -1;
2146 _cleanup_free_ char *home = NULL, *root = NULL, *secondary_root = NULL, *srv = NULL;
2147 _cleanup_udev_enumerate_unref_ struct udev_enumerate *e = NULL;
2148 _cleanup_udev_device_unref_ struct udev_device *d = NULL;
2149 _cleanup_blkid_free_probe_ blkid_probe b = NULL;
2150 _cleanup_udev_unref_ struct udev *udev = NULL;
2151 struct udev_list_entry *first, *item;
2152 bool home_rw = true, root_rw = true, secondary_root_rw = true, srv_rw = true;
2153 const char *pttype = NULL;
2159 assert(root_device);
2160 assert(home_device);
2164 b = blkid_new_probe();
2169 r = blkid_probe_set_device(b, fd, 0, 0);
2174 log_error("Failed to set device on blkid probe: %m");
2178 blkid_probe_enable_partitions(b, 1);
2179 blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
2182 r = blkid_do_safeprobe(b);
2183 if (r == -2 || r == 1) {
2184 log_error("Failed to identify any partition table on %s.\n"
2185 "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2187 } else if (r != 0) {
2190 log_error("Failed to probe: %m");
2194 blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
2195 if (!streq_ptr(pttype, "gpt")) {
2196 log_error("Image %s does not carry a GUID Partition Table.\n"
2197 "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2202 pl = blkid_probe_get_partitions(b);
2207 log_error("Failed to list partitions of %s", arg_image);
2215 if (fstat(fd, &st) < 0) {
2216 log_error("Failed to stat block device: %m");
2220 d = udev_device_new_from_devnum(udev, 'b', st.st_rdev);
2224 e = udev_enumerate_new(udev);
2228 r = udev_enumerate_add_match_parent(e, d);
2232 r = udev_enumerate_scan_devices(e);
2234 return log_error_errno(r, "Failed to scan for partition devices of %s: %m", arg_image);
2236 first = udev_enumerate_get_list_entry(e);
2237 udev_list_entry_foreach(item, first) {
2238 _cleanup_udev_device_unref_ struct udev_device *q;
2239 const char *stype, *node;
2240 unsigned long long flags;
2247 q = udev_device_new_from_syspath(udev, udev_list_entry_get_name(item));
2252 log_error("Failed to get partition device of %s: %m", arg_image);
2256 qn = udev_device_get_devnum(q);
2260 if (st.st_rdev == qn)
2263 node = udev_device_get_devnode(q);
2267 pp = blkid_partlist_devno_to_partition(pl, qn);
2271 flags = blkid_partition_get_flags(pp);
2272 if (flags & GPT_FLAG_NO_AUTO)
2275 nr = blkid_partition_get_partno(pp);
2279 stype = blkid_partition_get_type_string(pp);
2283 if (sd_id128_from_string(stype, &type_id) < 0)
2286 if (sd_id128_equal(type_id, GPT_HOME)) {
2288 if (home && nr >= home_nr)
2292 home_rw = !(flags & GPT_FLAG_READ_ONLY);
2295 home = strdup(node);
2298 } else if (sd_id128_equal(type_id, GPT_SRV)) {
2300 if (srv && nr >= srv_nr)
2304 srv_rw = !(flags & GPT_FLAG_READ_ONLY);
2311 #ifdef GPT_ROOT_NATIVE
2312 else if (sd_id128_equal(type_id, GPT_ROOT_NATIVE)) {
2314 if (root && nr >= root_nr)
2318 root_rw = !(flags & GPT_FLAG_READ_ONLY);
2321 root = strdup(node);
2326 #ifdef GPT_ROOT_SECONDARY
2327 else if (sd_id128_equal(type_id, GPT_ROOT_SECONDARY)) {
2329 if (secondary_root && nr >= secondary_root_nr)
2332 secondary_root_nr = nr;
2333 secondary_root_rw = !(flags & GPT_FLAG_READ_ONLY);
2336 free(secondary_root);
2337 secondary_root = strdup(node);
2338 if (!secondary_root)
2344 if (!root && !secondary_root) {
2345 log_error("Failed to identify root partition in disk image %s.\n"
2346 "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2351 *root_device = root;
2354 *root_device_rw = root_rw;
2356 } else if (secondary_root) {
2357 *root_device = secondary_root;
2358 secondary_root = NULL;
2360 *root_device_rw = secondary_root_rw;
2365 *home_device = home;
2368 *home_device_rw = home_rw;
2375 *srv_device_rw = srv_rw;
2380 log_error("--image= is not supported, compiled without blkid support.");
2385 static int mount_device(const char *what, const char *where, const char *directory, bool rw) {
2387 _cleanup_blkid_free_probe_ blkid_probe b = NULL;
2388 const char *fstype, *p;
2398 p = strappenda(where, directory);
2403 b = blkid_new_probe_from_filename(what);
2407 log_error("Failed to allocate prober for %s: %m", what);
2411 blkid_probe_enable_superblocks(b, 1);
2412 blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
2415 r = blkid_do_safeprobe(b);
2416 if (r == -1 || r == 1) {
2417 log_error("Cannot determine file system type of %s", what);
2419 } else if (r != 0) {
2422 log_error("Failed to probe %s: %m", what);
2427 if (blkid_probe_lookup_value(b, "TYPE", &fstype, NULL) < 0) {
2430 log_error("Failed to determine file system type of %s", what);
2434 if (streq(fstype, "crypto_LUKS")) {
2435 log_error("nspawn currently does not support LUKS disk images.");
2439 if (mount(what, p, fstype, MS_NODEV|(rw ? 0 : MS_RDONLY), NULL) < 0) {
2440 log_error("Failed to mount %s: %m", what);
2446 log_error("--image= is not supported, compiled without blkid support.");
2451 static int mount_devices(
2453 const char *root_device, bool root_device_rw,
2454 const char *home_device, bool home_device_rw,
2455 const char *srv_device, bool srv_device_rw) {
2461 r = mount_device(root_device, arg_directory, NULL, root_device_rw);
2463 return log_error_errno(r, "Failed to mount root directory: %m");
2467 r = mount_device(home_device, arg_directory, "/home", home_device_rw);
2469 return log_error_errno(r, "Failed to mount home directory: %m");
2473 r = mount_device(srv_device, arg_directory, "/srv", srv_device_rw);
2475 return log_error_errno(r, "Failed to mount server data directory: %m");
2481 static void loop_remove(int nr, int *image_fd) {
2482 _cleanup_close_ int control = -1;
2488 if (image_fd && *image_fd >= 0) {
2489 r = ioctl(*image_fd, LOOP_CLR_FD);
2491 log_warning("Failed to close loop image: %m");
2492 *image_fd = safe_close(*image_fd);
2495 control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2497 log_warning("Failed to open /dev/loop-control: %m");
2501 r = ioctl(control, LOOP_CTL_REMOVE, nr);
2503 log_warning("Failed to remove loop %d: %m", nr);
2506 static int spawn_getent(const char *database, const char *key, pid_t *rpid) {
2514 if (pipe2(pipe_fds, O_CLOEXEC) < 0) {
2515 log_error("Failed to allocate pipe: %m");
2521 log_error("Failed to fork getent child: %m");
2523 } else if (pid == 0) {
2525 char *empty_env = NULL;
2527 if (dup3(pipe_fds[1], STDOUT_FILENO, 0) < 0)
2528 _exit(EXIT_FAILURE);
2530 if (pipe_fds[0] > 2)
2531 safe_close(pipe_fds[0]);
2532 if (pipe_fds[1] > 2)
2533 safe_close(pipe_fds[1]);
2535 nullfd = open("/dev/null", O_RDWR);
2537 _exit(EXIT_FAILURE);
2539 if (dup3(nullfd, STDIN_FILENO, 0) < 0)
2540 _exit(EXIT_FAILURE);
2542 if (dup3(nullfd, STDERR_FILENO, 0) < 0)
2543 _exit(EXIT_FAILURE);
2548 reset_all_signal_handlers();
2549 close_all_fds(NULL, 0);
2551 execle("/usr/bin/getent", "getent", database, key, NULL, &empty_env);
2552 execle("/bin/getent", "getent", database, key, NULL, &empty_env);
2553 _exit(EXIT_FAILURE);
2556 pipe_fds[1] = safe_close(pipe_fds[1]);
2563 static int change_uid_gid(char **_home) {
2564 char line[LINE_MAX], *x, *u, *g, *h;
2565 const char *word, *state;
2566 _cleanup_free_ uid_t *uids = NULL;
2567 _cleanup_free_ char *home = NULL;
2568 _cleanup_fclose_ FILE *f = NULL;
2569 _cleanup_close_ int fd = -1;
2570 unsigned n_uids = 0;
2579 if (!arg_user || streq(arg_user, "root") || streq(arg_user, "0")) {
2580 /* Reset everything fully to 0, just in case */
2582 if (setgroups(0, NULL) < 0) {
2583 log_error("setgroups() failed: %m");
2587 if (setresgid(0, 0, 0) < 0) {
2588 log_error("setregid() failed: %m");
2592 if (setresuid(0, 0, 0) < 0) {
2593 log_error("setreuid() failed: %m");
2601 /* First, get user credentials */
2602 fd = spawn_getent("passwd", arg_user, &pid);
2606 f = fdopen(fd, "r");
2611 if (!fgets(line, sizeof(line), f)) {
2614 log_error("Failed to resolve user %s.", arg_user);
2618 log_error("Failed to read from getent: %m");
2624 wait_for_terminate_and_warn("getent passwd", pid);
2626 x = strchr(line, ':');
2628 log_error("/etc/passwd entry has invalid user field.");
2632 u = strchr(x+1, ':');
2634 log_error("/etc/passwd entry has invalid password field.");
2641 log_error("/etc/passwd entry has invalid UID field.");
2649 log_error("/etc/passwd entry has invalid GID field.");
2654 h = strchr(x+1, ':');
2656 log_error("/etc/passwd entry has invalid GECOS field.");
2663 log_error("/etc/passwd entry has invalid home directory field.");
2669 r = parse_uid(u, &uid);
2671 log_error("Failed to parse UID of user.");
2675 r = parse_gid(g, &gid);
2677 log_error("Failed to parse GID of user.");
2685 /* Second, get group memberships */
2686 fd = spawn_getent("initgroups", arg_user, &pid);
2691 f = fdopen(fd, "r");
2696 if (!fgets(line, sizeof(line), f)) {
2698 log_error("Failed to resolve user %s.", arg_user);
2702 log_error("Failed to read from getent: %m");
2708 wait_for_terminate_and_warn("getent initgroups", pid);
2710 /* Skip over the username and subsequent separator whitespace */
2712 x += strcspn(x, WHITESPACE);
2713 x += strspn(x, WHITESPACE);
2715 FOREACH_WORD(word, l, x, state) {
2721 if (!GREEDY_REALLOC(uids, sz, n_uids+1))
2724 r = parse_uid(c, &uids[n_uids++]);
2726 log_error("Failed to parse group data from getent.");
2731 r = mkdir_parents(home, 0775);
2733 return log_error_errno(r, "Failed to make home root directory: %m");
2735 r = mkdir_safe(home, 0755, uid, gid);
2736 if (r < 0 && r != -EEXIST)
2737 return log_error_errno(r, "Failed to make home directory: %m");
2739 fchown(STDIN_FILENO, uid, gid);
2740 fchown(STDOUT_FILENO, uid, gid);
2741 fchown(STDERR_FILENO, uid, gid);
2743 if (setgroups(n_uids, uids) < 0) {
2744 log_error("Failed to set auxiliary groups: %m");
2748 if (setresgid(gid, gid, gid) < 0) {
2749 log_error("setregid() failed: %m");
2753 if (setresuid(uid, uid, uid) < 0) {
2754 log_error("setreuid() failed: %m");
2768 * < 0 : wait_for_terminate() failed to get the state of the
2769 * container, the container was terminated by a signal, or
2770 * failed for an unknown reason. No change is made to the
2771 * container argument.
2772 * > 0 : The program executed in the container terminated with an
2773 * error. The exit code of the program executed in the
2774 * container is returned. The container argument has been set
2775 * to CONTAINER_TERMINATED.
2776 * 0 : The container is being rebooted, has been shut down or exited
2777 * successfully. The container argument has been set to either
2778 * CONTAINER_TERMINATED or CONTAINER_REBOOTED.
2780 * That is, success is indicated by a return value of zero, and an
2781 * error is indicated by a non-zero value.
2783 static int wait_for_container(pid_t pid, ContainerStatus *container) {
2787 r = wait_for_terminate(pid, &status);
2789 return log_warning_errno(r, "Failed to wait for container: %m");
2791 switch (status.si_code) {
2794 if (status.si_status == 0) {
2795 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
2798 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
2800 *container = CONTAINER_TERMINATED;
2801 return status.si_status;
2804 if (status.si_status == SIGINT) {
2806 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
2807 *container = CONTAINER_TERMINATED;
2810 } else if (status.si_status == SIGHUP) {
2812 log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
2813 *container = CONTAINER_REBOOTED;
2817 /* CLD_KILLED fallthrough */
2820 log_error("Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
2824 log_error("Container %s failed due to unknown reason.", arg_machine);
2831 static void nop_handler(int sig) {}
2833 static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2836 pid = PTR_TO_UINT32(userdata);
2838 if (kill(pid, SIGRTMIN+3) >= 0) {
2839 log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2840 sd_event_source_set_userdata(s, NULL);
2845 sd_event_exit(sd_event_source_get_event(s), 0);
2849 int main(int argc, char *argv[]) {
2851 _cleanup_free_ char *device_path = NULL, *root_device = NULL, *home_device = NULL, *srv_device = NULL;
2852 bool root_device_rw = true, home_device_rw = true, srv_device_rw = true;
2853 _cleanup_close_ int master = -1, image_fd = -1;
2854 _cleanup_close_pair_ int kmsg_socket_pair[2] = { -1, -1 };
2855 _cleanup_fdset_free_ FDSet *fds = NULL;
2856 int r = EXIT_FAILURE, k, n_fd_passed, loop_nr = -1;
2857 const char *console = NULL;
2858 char veth_name[IFNAMSIZ];
2859 bool secondary = false;
2860 sigset_t mask, mask_chld;
2863 log_parse_environment();
2866 k = parse_argv(argc, argv);
2875 if (arg_directory) {
2878 p = path_make_absolute_cwd(arg_directory);
2879 free(arg_directory);
2882 arg_directory = get_current_dir_name();
2884 if (!arg_directory) {
2885 log_error("Failed to determine path, please use -D.");
2888 path_kill_slashes(arg_directory);
2892 arg_machine = strdup(basename(arg_image ? arg_image : arg_directory));
2898 hostname_cleanup(arg_machine, false);
2899 if (isempty(arg_machine)) {
2900 log_error("Failed to determine machine name automatically, please use -M.");
2905 if (geteuid() != 0) {
2906 log_error("Need to be root.");
2910 if (sd_booted() <= 0) {
2911 log_error("Not running on a systemd system.");
2916 n_fd_passed = sd_listen_fds(false);
2917 if (n_fd_passed > 0) {
2918 k = fdset_new_listen_fds(&fds, false);
2920 log_error_errno(k, "Failed to collect file descriptors: %m");
2924 fdset_close_others(fds);
2927 if (arg_directory) {
2928 if (path_equal(arg_directory, "/")) {
2929 log_error("Spawning container on root directory not supported.");
2934 if (path_is_os_tree(arg_directory) <= 0) {
2935 log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", arg_directory);
2941 p = strappenda(arg_directory,
2942 argc > optind && path_is_absolute(argv[optind]) ? argv[optind] : "/usr/bin/");
2943 if (access(p, F_OK) < 0) {
2944 log_error("Directory %s lacks the binary to execute or doesn't look like a binary tree. Refusing.", arg_directory);
2950 char template[] = "/tmp/nspawn-root-XXXXXX";
2952 if (!mkdtemp(template)) {
2953 log_error("Failed to create temporary directory: %m");
2958 arg_directory = strdup(template);
2959 if (!arg_directory) {
2964 image_fd = setup_image(&device_path, &loop_nr);
2970 r = dissect_image(image_fd,
2971 &root_device, &root_device_rw,
2972 &home_device, &home_device_rw,
2973 &srv_device, &srv_device_rw,
2979 master = posix_openpt(O_RDWR|O_NOCTTY|O_CLOEXEC|O_NDELAY);
2981 log_error("Failed to acquire pseudo tty: %m");
2985 console = ptsname(master);
2987 log_error("Failed to determine tty name: %m");
2992 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
2993 arg_machine, arg_image ? arg_image : arg_directory);
2995 if (unlockpt(master) < 0) {
2996 log_error("Failed to unlock tty: %m");
3000 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0) {
3001 log_error("Failed to create kmsg socket pair: %m");
3007 "STATUS=Container running.");
3009 assert_se(sigemptyset(&mask) == 0);
3010 sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
3011 assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
3013 assert_se(sigemptyset(&mask_chld) == 0);
3014 assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
3017 ContainerStatus container_status;
3018 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
3019 struct sigaction sa = {
3020 .sa_handler = nop_handler,
3021 .sa_flags = SA_NOCLDSTOP,
3024 r = barrier_create(&barrier);
3026 log_error_errno(r, "Cannot initialize IPC barrier: %m");
3030 /* Child can be killed before execv(), so handle SIGCHLD
3031 * in order to interrupt parent's blocking calls and
3032 * give it a chance to call wait() and terminate. */
3033 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
3035 log_error("Failed to change the signal mask: %m");
3039 r = sigaction(SIGCHLD, &sa, NULL);
3041 log_error("Failed to install SIGCHLD handler: %m");
3045 pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWNS|
3046 (arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS)|
3047 (arg_private_network ? CLONE_NEWNET : 0), NULL);
3049 if (errno == EINVAL)
3050 log_error("clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m");
3052 log_error("clone() failed: %m");
3060 _cleanup_free_ char *home = NULL;
3062 const char *envp[] = {
3063 "PATH=" DEFAULT_PATH_SPLIT_USR,
3064 "container=systemd-nspawn", /* LXC sets container=lxc, so follow the scheme here */
3069 NULL, /* container_uuid */
3070 NULL, /* LISTEN_FDS */
3071 NULL, /* LISTEN_PID */
3076 barrier_set_role(&barrier, BARRIER_CHILD);
3078 envp[n_env] = strv_find_prefix(environ, "TERM=");
3082 master = safe_close(master);
3084 close_nointr(STDIN_FILENO);
3085 close_nointr(STDOUT_FILENO);
3086 close_nointr(STDERR_FILENO);
3088 kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
3090 reset_all_signal_handlers();
3091 reset_signal_mask();
3093 k = open_terminal(console, O_RDWR);
3094 if (k != STDIN_FILENO) {
3100 log_error_errno(k, "Failed to open console: %m");
3101 _exit(EXIT_FAILURE);
3104 if (dup2(STDIN_FILENO, STDOUT_FILENO) != STDOUT_FILENO ||
3105 dup2(STDIN_FILENO, STDERR_FILENO) != STDERR_FILENO) {
3106 log_error("Failed to duplicate console: %m");
3107 _exit(EXIT_FAILURE);
3111 log_error("setsid() failed: %m");
3112 _exit(EXIT_FAILURE);
3115 if (reset_audit_loginuid() < 0)
3116 _exit(EXIT_FAILURE);
3118 if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0) {
3119 log_error("PR_SET_PDEATHSIG failed: %m");
3120 _exit(EXIT_FAILURE);
3123 /* Mark everything as slave, so that we still
3124 * receive mounts from the real root, but don't
3125 * propagate mounts to the real root. */
3126 if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
3127 log_error("MS_SLAVE|MS_REC failed: %m");
3128 _exit(EXIT_FAILURE);
3131 if (mount_devices(arg_directory,
3132 root_device, root_device_rw,
3133 home_device, home_device_rw,
3134 srv_device, srv_device_rw) < 0)
3135 _exit(EXIT_FAILURE);
3137 /* Turn directory into bind mount */
3138 if (mount(arg_directory, arg_directory, "bind", MS_BIND|MS_REC, NULL) < 0) {
3139 log_error("Failed to make bind mount: %m");
3140 _exit(EXIT_FAILURE);
3143 r = setup_volatile(arg_directory);
3145 _exit(EXIT_FAILURE);
3147 if (setup_volatile_state(arg_directory) < 0)
3148 _exit(EXIT_FAILURE);
3150 r = base_filesystem_create(arg_directory);
3152 _exit(EXIT_FAILURE);
3154 if (arg_read_only) {
3155 k = bind_remount_recursive(arg_directory, true);
3157 log_error_errno(k, "Failed to make tree read-only: %m");
3158 _exit(EXIT_FAILURE);
3162 if (mount_all(arg_directory) < 0)
3163 _exit(EXIT_FAILURE);
3165 if (copy_devnodes(arg_directory) < 0)
3166 _exit(EXIT_FAILURE);
3168 if (setup_ptmx(arg_directory) < 0)
3169 _exit(EXIT_FAILURE);
3171 dev_setup(arg_directory);
3173 if (setup_seccomp() < 0)
3174 _exit(EXIT_FAILURE);
3176 if (setup_dev_console(arg_directory, console) < 0)
3177 _exit(EXIT_FAILURE);
3179 if (setup_kmsg(arg_directory, kmsg_socket_pair[1]) < 0)
3180 _exit(EXIT_FAILURE);
3182 kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
3184 if (setup_boot_id(arg_directory) < 0)
3185 _exit(EXIT_FAILURE);
3187 if (setup_timezone(arg_directory) < 0)
3188 _exit(EXIT_FAILURE);
3190 if (setup_resolv_conf(arg_directory) < 0)
3191 _exit(EXIT_FAILURE);
3193 if (setup_journal(arg_directory) < 0)
3194 _exit(EXIT_FAILURE);
3196 if (mount_binds(arg_directory, arg_bind, false) < 0)
3197 _exit(EXIT_FAILURE);
3199 if (mount_binds(arg_directory, arg_bind_ro, true) < 0)
3200 _exit(EXIT_FAILURE);
3202 if (mount_tmpfs(arg_directory) < 0)
3203 _exit(EXIT_FAILURE);
3205 /* Tell the parent that we are ready, and that
3206 * it can cgroupify us to that we lack access
3207 * to certain devices and resources. */
3208 (void)barrier_place(&barrier);
3210 if (chdir(arg_directory) < 0) {
3211 log_error("chdir(%s) failed: %m", arg_directory);
3212 _exit(EXIT_FAILURE);
3215 if (mount(arg_directory, "/", NULL, MS_MOVE, NULL) < 0) {
3216 log_error("mount(MS_MOVE) failed: %m");
3217 _exit(EXIT_FAILURE);
3220 if (chroot(".") < 0) {
3221 log_error("chroot() failed: %m");
3222 _exit(EXIT_FAILURE);
3225 if (chdir("/") < 0) {
3226 log_error("chdir() failed: %m");
3227 _exit(EXIT_FAILURE);
3232 if (arg_private_network)
3235 if (drop_capabilities() < 0) {
3236 log_error("drop_capabilities() failed: %m");
3237 _exit(EXIT_FAILURE);
3240 r = change_uid_gid(&home);
3242 _exit(EXIT_FAILURE);
3244 if ((asprintf((char**)(envp + n_env++), "HOME=%s", home ? home: "/root") < 0) ||
3245 (asprintf((char**)(envp + n_env++), "USER=%s", arg_user ? arg_user : "root") < 0) ||
3246 (asprintf((char**)(envp + n_env++), "LOGNAME=%s", arg_user ? arg_user : "root") < 0)) {
3248 _exit(EXIT_FAILURE);
3251 if (!sd_id128_equal(arg_uuid, SD_ID128_NULL)) {
3254 if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_format_as_uuid(arg_uuid, as_uuid)) < 0) {
3256 _exit(EXIT_FAILURE);
3260 if (fdset_size(fds) > 0) {
3261 k = fdset_cloexec(fds, false);
3263 log_error("Failed to unset O_CLOEXEC for file descriptors.");
3264 _exit(EXIT_FAILURE);
3267 if ((asprintf((char **)(envp + n_env++), "LISTEN_FDS=%u", n_fd_passed) < 0) ||
3268 (asprintf((char **)(envp + n_env++), "LISTEN_PID=1") < 0)) {
3270 _exit(EXIT_FAILURE);
3276 if (arg_personality != 0xffffffffLU) {
3277 if (personality(arg_personality) < 0) {
3278 log_error("personality() failed: %m");
3279 _exit(EXIT_FAILURE);
3281 } else if (secondary) {
3282 if (personality(PER_LINUX32) < 0) {
3283 log_error("personality() failed: %m");
3284 _exit(EXIT_FAILURE);
3289 if (arg_selinux_context)
3290 if (setexeccon((security_context_t) arg_selinux_context) < 0) {
3291 log_error("setexeccon(\"%s\") failed: %m", arg_selinux_context);
3292 _exit(EXIT_FAILURE);
3296 if (!strv_isempty(arg_setenv)) {
3299 n = strv_env_merge(2, envp, arg_setenv);
3302 _exit(EXIT_FAILURE);
3307 env_use = (char**) envp;
3309 /* Wait until the parent is ready with the setup, too... */
3310 if (!barrier_place_and_sync(&barrier))
3311 _exit(EXIT_FAILURE);
3317 /* Automatically search for the init system */
3319 l = 1 + argc - optind;
3320 a = newa(char*, l + 1);
3321 memcpy(a + 1, argv + optind, l * sizeof(char*));
3323 a[0] = (char*) "/usr/lib/systemd/systemd";
3324 execve(a[0], a, env_use);
3326 a[0] = (char*) "/lib/systemd/systemd";
3327 execve(a[0], a, env_use);
3329 a[0] = (char*) "/sbin/init";
3330 execve(a[0], a, env_use);
3331 } else if (argc > optind)
3332 execvpe(argv[optind], argv + optind, env_use);
3334 chdir(home ? home : "/root");
3335 execle("/bin/bash", "-bash", NULL, env_use);
3336 execle("/bin/sh", "-sh", NULL, env_use);
3339 log_error("execv() failed: %m");
3340 _exit(EXIT_FAILURE);
3343 barrier_set_role(&barrier, BARRIER_PARENT);
3347 /* wait for child-setup to be done */
3348 if (barrier_place_and_sync(&barrier)) {
3349 _cleanup_event_unref_ sd_event *event = NULL;
3350 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
3353 r = move_network_interfaces(pid);
3357 r = setup_veth(pid, veth_name, &ifi);
3361 r = setup_bridge(veth_name, &ifi);
3365 r = setup_macvlan(pid);
3369 r = register_machine(pid, ifi);
3373 /* Block SIGCHLD here, before notifying child.
3374 * process_pty() will handle it with the other signals. */
3375 r = sigprocmask(SIG_BLOCK, &mask_chld, NULL);
3379 /* Reset signal to default */
3380 r = default_signals(SIGCHLD, -1);
3384 /* Notify the child that the parent is ready with all
3385 * its setup, and that the child can now hand over
3386 * control to the code to run inside the container. */
3387 (void)barrier_place(&barrier);
3389 r = sd_event_new(&event);
3391 log_error_errno(r, "Failed to get default event source: %m");
3396 /* Try to kill the init system on SIGINT or SIGTERM */
3397 sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, UINT32_TO_PTR(pid));
3398 sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, UINT32_TO_PTR(pid));
3400 /* Immediately exit */
3401 sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
3402 sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
3405 /* simply exit on sigchld */
3406 sd_event_add_signal(event, NULL, SIGCHLD, NULL, NULL);
3408 r = pty_forward_new(event, master, &forward);
3410 log_error_errno(r, "Failed to create PTY forwarder: %m");
3414 r = sd_event_loop(event);
3416 return log_error_errno(r, "Failed to run event loop: %m");
3418 forward = pty_forward_free(forward);
3423 /* Kill if it is not dead yet anyway */
3424 terminate_machine(pid);
3427 /* Normally redundant, but better safe than sorry */
3430 r = wait_for_container(pid, &container_status);
3434 /* We failed to wait for the container, or the
3435 * container exited abnormally */
3438 } else if (r > 0 || container_status == CONTAINER_TERMINATED)
3439 /* The container exited with a non-zero
3440 * status, or with zero status and no reboot
3444 /* CONTAINER_REBOOTED, loop again */
3446 if (arg_keep_unit) {
3447 /* Special handling if we are running as a
3448 * service: instead of simply restarting the
3449 * machine we want to restart the entire
3450 * service, so let's inform systemd about this
3451 * with the special exit code 133. The service
3452 * file uses RestartForceExitStatus=133 so
3453 * that this results in a full nspawn
3454 * restart. This is necessary since we might
3455 * have cgroup parameters set we want to have
3465 "STATUS=Terminating...");
3467 loop_remove(loop_nr, &image_fd);
3472 free(arg_directory);
3475 strv_free(arg_setenv);
3476 strv_free(arg_network_interfaces);
3477 strv_free(arg_network_macvlan);
3478 strv_free(arg_bind);
3479 strv_free(arg_bind_ro);
3480 strv_free(arg_tmpfs);