src/nspawn/nspawn.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <signal.h>
  23 #include <sched.h>
  24 #include <unistd.h>
  25 #include <sys/types.h>
  26 #include <sys/syscall.h>
  27 #include <sys/mount.h>
  28 #include <sys/wait.h>
  29 #include <stdlib.h>
  30 #include <string.h>
  31 #include <stdio.h>
  32 #include <errno.h>
  33 #include <sys/prctl.h>
  34 #include <sys/capability.h>
  35 #include <getopt.h>
  36 #include <termios.h>
  37 #include <sys/signalfd.h>
  38 #include <grp.h>
  39 #include <linux/fs.h>
  40 #include <sys/un.h>
  41 #include <sys/socket.h>
  42 #include <linux/netlink.h>
  43 #include <net/if.h>
  44 #include <linux/veth.h>
  45 #include <sys/personality.h>
  46 #include <linux/loop.h>
  47
  48 #ifdef HAVE_SELINUX
  49 #include <selinux/selinux.h>
  50 #endif
  51
  52 #ifdef HAVE_SECCOMP
  53 #include <seccomp.h>
  54 #endif
  55
  56 #ifdef HAVE_BLKID
  57 #include <blkid/blkid.h>
  58 #endif
  59
  60 #include "sd-daemon.h"
  61 #include "sd-bus.h"
  62 #include "sd-id128.h"
  63 #include "sd-rtnl.h"
  64 #include "log.h"
  65 #include "util.h"
  66 #include "mkdir.h"
  67 #include "macro.h"
  68 #include "audit.h"
  69 #include "missing.h"
  70 #include "cgroup-util.h"
  71 #include "strv.h"
  72 #include "path-util.h"
  73 #include "loopback-setup.h"
  74 #include "dev-setup.h"
  75 #include "fdset.h"
  76 #include "build.h"
  77 #include "fileio.h"
  78 #include "bus-util.h"
  79 #include "bus-error.h"
  80 #include "ptyfwd.h"
  81 #include "bus-kernel.h"
  82 #include "env-util.h"
  83 #include "def.h"
  84 #include "rtnl-util.h"
  85 #include "udev-util.h"
  86 #include "blkid-util.h"
  87 #include "gpt.h"
  88 #include "siphash24.h"
  89 #include "copy.h"
  90 #include "base-filesystem.h"
  91 #include "barrier.h"
  92 #include "event-util.h"
  93
  94 #ifdef HAVE_SECCOMP
  95 #include "seccomp-util.h"
  96 #endif
  97
  98 typedef enum ContainerStatus {
  99         CONTAINER_TERMINATED,
 100         CONTAINER_REBOOTED
 101 } ContainerStatus;
 102
 103 typedef enum LinkJournal {
 104         LINK_NO,
 105         LINK_AUTO,
 106         LINK_HOST,
 107         LINK_GUEST
 108 } LinkJournal;
 109
 110 typedef enum Volatile {
 111         VOLATILE_NO,
 112         VOLATILE_YES,
 113         VOLATILE_STATE,
 114 } Volatile;
 115
 116 static char *arg_directory = NULL;
 117 static char *arg_user = NULL;
 118 static sd_id128_t arg_uuid = {};
 119 static char *arg_machine = NULL;
 120 static const char *arg_selinux_context = NULL;
 121 static const char *arg_selinux_apifs_context = NULL;
 122 static const char *arg_slice = NULL;
 123 static bool arg_private_network = false;
 124 static bool arg_read_only = false;
 125 static bool arg_boot = false;
 126 static LinkJournal arg_link_journal = LINK_AUTO;
 127 static bool arg_link_journal_try = false;
 128 static uint64_t arg_retain =
 129         (1ULL << CAP_CHOWN) |
 130         (1ULL << CAP_DAC_OVERRIDE) |
 131         (1ULL << CAP_DAC_READ_SEARCH) |
 132         (1ULL << CAP_FOWNER) |
 133         (1ULL << CAP_FSETID) |
 134         (1ULL << CAP_IPC_OWNER) |
 135         (1ULL << CAP_KILL) |
 136         (1ULL << CAP_LEASE) |
 137         (1ULL << CAP_LINUX_IMMUTABLE) |
 138         (1ULL << CAP_NET_BIND_SERVICE) |
 139         (1ULL << CAP_NET_BROADCAST) |
 140         (1ULL << CAP_NET_RAW) |
 141         (1ULL << CAP_SETGID) |
 142         (1ULL << CAP_SETFCAP) |
 143         (1ULL << CAP_SETPCAP) |
 144         (1ULL << CAP_SETUID) |
 145         (1ULL << CAP_SYS_ADMIN) |
 146         (1ULL << CAP_SYS_CHROOT) |
 147         (1ULL << CAP_SYS_NICE) |
 148         (1ULL << CAP_SYS_PTRACE) |
 149         (1ULL << CAP_SYS_TTY_CONFIG) |
 150         (1ULL << CAP_SYS_RESOURCE) |
 151         (1ULL << CAP_SYS_BOOT) |
 152         (1ULL << CAP_AUDIT_WRITE) |
 153         (1ULL << CAP_AUDIT_CONTROL) |
 154         (1ULL << CAP_MKNOD);
 155 static char **arg_bind = NULL;
 156 static char **arg_bind_ro = NULL;
 157 static char **arg_tmpfs = NULL;
 158 static char **arg_setenv = NULL;
 159 static bool arg_quiet = false;
 160 static bool arg_share_system = false;
 161 static bool arg_register = true;
 162 static bool arg_keep_unit = false;
 163 static char **arg_network_interfaces = NULL;
 164 static char **arg_network_macvlan = NULL;
 165 static bool arg_network_veth = false;
 166 static const char *arg_network_bridge = NULL;
 167 static unsigned long arg_personality = 0xffffffffLU;
 168 static const char *arg_image = NULL;
 169 static Volatile arg_volatile = VOLATILE_NO;
 170
 171 static void help(void) {
 172         printf("%s [OPTIONS...] [PATH] [ARGUMENTS...]\n\n"
 173                "Spawn a minimal namespace container for debugging, testing and building.\n\n"
 174                "  -h --help                 Show this help\n"
 175                "     --version              Print version string\n"
 176                "  -q --quiet                Do not show status information\n"
 177                "  -D --directory=PATH       Root directory for the container\n"
 178                "  -i --image=PATH           File system device or image for the container\n"
 179                "  -b --boot                 Boot up full system (i.e. invoke init)\n"
 180                "  -u --user=USER            Run the command under specified user or uid\n"
 181                "  -M --machine=NAME         Set the machine name for the container\n"
 182                "     --uuid=UUID            Set a specific machine UUID for the container\n"
 183                "  -S --slice=SLICE          Place the container in the specified slice\n"
 184                "     --private-network      Disable network in container\n"
 185                "     --network-interface=INTERFACE\n"
 186                "                            Assign an existing network interface to the\n"
 187                "                            container\n"
 188                "     --network-macvlan=INTERFACE\n"
 189                "                            Create a macvlan network interface based on an\n"
 190                "                            existing network interface to the container\n"
 191                "     --network-veth         Add a virtual ethernet connection between host\n"
 192                "                            and container\n"
 193                "     --network-bridge=INTERFACE\n"
 194                "                            Add a virtual ethernet connection between host\n"
 195                "                            and container and add it to an existing bridge on\n"
 196                "                            the host\n"
 197                "  -Z --selinux-context=SECLABEL\n"
 198                "                            Set the SELinux security context to be used by\n"
 199                "                            processes in the container\n"
 200                "  -L --selinux-apifs-context=SECLABEL\n"
 201                "                            Set the SELinux security context to be used by\n"
 202                "                            API/tmpfs file systems in the container\n"
 203                "     --capability=CAP       In addition to the default, retain specified\n"
 204                "                            capability\n"
 205                "     --drop-capability=CAP  Drop the specified capability from the default set\n"
 206                "     --link-journal=MODE    Link up guest journal, one of no, auto, guest, host,\n"
 207                "                            try-guest, try-host\n"
 208                "  -j                        Equivalent to --link-journal=try-guest\n"
 209                "     --read-only            Mount the root directory read-only\n"
 210                "     --bind=PATH[:PATH]     Bind mount a file or directory from the host into\n"
 211                "                            the container\n"
 212                "     --bind-ro=PATH[:PATH]  Similar, but creates a read-only bind mount\n"
 213                "     --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory\n"
 214                "     --setenv=NAME=VALUE    Pass an environment variable to PID 1\n"
 215                "     --share-system         Share system namespaces with host\n"
 216                "     --register=BOOLEAN     Register container as machine\n"
 217                "     --keep-unit            Do not register a scope for the machine, reuse\n"
 218                "                            the service unit nspawn is running in\n"
 219                "     --volatile[=MODE]      Run the system in volatile mode\n",
 220                program_invocation_short_name);
 221 }
 222
 223 static int parse_argv(int argc, char *argv[]) {
 224
 225         enum {
 226                 ARG_VERSION = 0x100,
 227                 ARG_PRIVATE_NETWORK,
 228                 ARG_UUID,
 229                 ARG_READ_ONLY,
 230                 ARG_CAPABILITY,
 231                 ARG_DROP_CAPABILITY,
 232                 ARG_LINK_JOURNAL,
 233                 ARG_BIND,
 234                 ARG_BIND_RO,
 235                 ARG_TMPFS,
 236                 ARG_SETENV,
 237                 ARG_SHARE_SYSTEM,
 238                 ARG_REGISTER,
 239                 ARG_KEEP_UNIT,
 240                 ARG_NETWORK_INTERFACE,
 241                 ARG_NETWORK_MACVLAN,
 242                 ARG_NETWORK_VETH,
 243                 ARG_NETWORK_BRIDGE,
 244                 ARG_PERSONALITY,
 245                 ARG_VOLATILE,
 246         };
 247
 248         static const struct option options[] = {
 249                 { "help",                  no_argument,       NULL, 'h'                   },
 250                 { "version",               no_argument,       NULL, ARG_VERSION           },
 251                 { "directory",             required_argument, NULL, 'D'                   },
 252                 { "user",                  required_argument, NULL, 'u'                   },
 253                 { "private-network",       no_argument,       NULL, ARG_PRIVATE_NETWORK   },
 254                 { "boot",                  no_argument,       NULL, 'b'                   },
 255                 { "uuid",                  required_argument, NULL, ARG_UUID              },
 256                 { "read-only",             no_argument,       NULL, ARG_READ_ONLY         },
 257                 { "capability",            required_argument, NULL, ARG_CAPABILITY        },
 258                 { "drop-capability",       required_argument, NULL, ARG_DROP_CAPABILITY   },
 259                 { "link-journal",          required_argument, NULL, ARG_LINK_JOURNAL      },
 260                 { "bind",                  required_argument, NULL, ARG_BIND              },
 261                 { "bind-ro",               required_argument, NULL, ARG_BIND_RO           },
 262                 { "tmpfs",                 required_argument, NULL, ARG_TMPFS             },
 263                 { "machine",               required_argument, NULL, 'M'                   },
 264                 { "slice",                 required_argument, NULL, 'S'                   },
 265                 { "setenv",                required_argument, NULL, ARG_SETENV            },
 266                 { "selinux-context",       required_argument, NULL, 'Z'                   },
 267                 { "selinux-apifs-context", required_argument, NULL, 'L'                   },
 268                 { "quiet",                 no_argument,       NULL, 'q'                   },
 269                 { "share-system",          no_argument,       NULL, ARG_SHARE_SYSTEM      },
 270                 { "register",              required_argument, NULL, ARG_REGISTER          },
 271                 { "keep-unit",             no_argument,       NULL, ARG_KEEP_UNIT         },
 272                 { "network-interface",     required_argument, NULL, ARG_NETWORK_INTERFACE },
 273                 { "network-macvlan",       required_argument, NULL, ARG_NETWORK_MACVLAN   },
 274                 { "network-veth",          no_argument,       NULL, ARG_NETWORK_VETH      },
 275                 { "network-bridge",        required_argument, NULL, ARG_NETWORK_BRIDGE    },
 276                 { "personality",           required_argument, NULL, ARG_PERSONALITY       },
 277                 { "image",                 required_argument, NULL, 'i'                   },
 278                 { "volatile",              optional_argument, NULL, ARG_VOLATILE          },
 279                 {}
 280         };
 281
 282         int c, r;
 283         uint64_t plus = 0, minus = 0;
 284
 285         assert(argc >= 0);
 286         assert(argv);
 287
 288         while ((c = getopt_long(argc, argv, "+hD:u:bL:M:jS:Z:qi:", options, NULL)) >= 0)
 289
 290                 switch (c) {
 291
 292                 case 'h':
 293                         help();
 294                         return 0;
 295
 296                 case ARG_VERSION:
 297                         puts(PACKAGE_STRING);
 298                         puts(SYSTEMD_FEATURES);
 299                         return 0;
 300
 301                 case 'D':
 302                         free(arg_directory);
 303                         arg_directory = canonicalize_file_name(optarg);
 304                         if (!arg_directory) {
 305                                 log_error_errno(errno, "Invalid root directory: %m");
 306                                 return -ENOMEM;
 307                         }
 308
 309                         break;
 310
 311                 case 'i':
 312                         arg_image = optarg;
 313                         break;
 314
 315                 case 'u':
 316                         free(arg_user);
 317                         arg_user = strdup(optarg);
 318                         if (!arg_user)
 319                                 return log_oom();
 320
 321                         break;
 322
 323                 case ARG_NETWORK_BRIDGE:
 324                         arg_network_bridge = optarg;
 325
 326                         /* fall through */
 327
 328                 case ARG_NETWORK_VETH:
 329                         arg_network_veth = true;
 330                         arg_private_network = true;
 331                         break;
 332
 333                 case ARG_NETWORK_INTERFACE:
 334                         if (strv_extend(&arg_network_interfaces, optarg) < 0)
 335                                 return log_oom();
 336
 337                         arg_private_network = true;
 338                         break;
 339
 340                 case ARG_NETWORK_MACVLAN:
 341                         if (strv_extend(&arg_network_macvlan, optarg) < 0)
 342                                 return log_oom();
 343
 344                         /* fall through */
 345
 346                 case ARG_PRIVATE_NETWORK:
 347                         arg_private_network = true;
 348                         break;
 349
 350                 case 'b':
 351                         arg_boot = true;
 352                         break;
 353
 354                 case ARG_UUID:
 355                         r = sd_id128_from_string(optarg, &arg_uuid);
 356                         if (r < 0) {
 357                                 log_error("Invalid UUID: %s", optarg);
 358                                 return r;
 359                         }
 360                         break;
 361
 362                 case 'S':
 363                         arg_slice = optarg;
 364                         break;
 365
 366                 case 'M':
 367                         if (isempty(optarg)) {
 368                                 free(arg_machine);
 369                                 arg_machine = NULL;
 370                         } else {
 371
 372                                 if (!hostname_is_valid(optarg)) {
 373                                         log_error("Invalid machine name: %s", optarg);
 374                                         return -EINVAL;
 375                                 }
 376
 377                                 free(arg_machine);
 378                                 arg_machine = strdup(optarg);
 379                                 if (!arg_machine)
 380                                         return log_oom();
 381
 382                                 break;
 383                         }
 384
 385                 case 'Z':
 386                         arg_selinux_context = optarg;
 387                         break;
 388
 389                 case 'L':
 390                         arg_selinux_apifs_context = optarg;
 391                         break;
 392
 393                 case ARG_READ_ONLY:
 394                         arg_read_only = true;
 395                         break;
 396
 397                 case ARG_CAPABILITY:
 398                 case ARG_DROP_CAPABILITY: {
 399                         const char *state, *word;
 400                         size_t length;
 401
 402                         FOREACH_WORD_SEPARATOR(word, length, optarg, ",", state) {
 403                                 _cleanup_free_ char *t;
 404                                 cap_value_t cap;
 405
 406                                 t = strndup(word, length);
 407                                 if (!t)
 408                                         return log_oom();
 409
 410                                 if (streq(t, "all")) {
 411                                         if (c == ARG_CAPABILITY)
 412                                                 plus = (uint64_t) -1;
 413                                         else
 414                                                 minus = (uint64_t) -1;
 415                                 } else {
 416                                         if (cap_from_name(t, &cap) < 0) {
 417                                                 log_error("Failed to parse capability %s.", t);
 418                                                 return -EINVAL;
 419                                         }
 420
 421                                         if (c == ARG_CAPABILITY)
 422                                                 plus |= 1ULL << (uint64_t) cap;
 423                                         else
 424                                                 minus |= 1ULL << (uint64_t) cap;
 425                                 }
 426                         }
 427
 428                         break;
 429                 }
 430
 431                 case 'j':
 432                         arg_link_journal = LINK_GUEST;
 433                         arg_link_journal_try = true;
 434                         break;
 435
 436                 case ARG_LINK_JOURNAL:
 437                         if (streq(optarg, "auto"))
 438                                 arg_link_journal = LINK_AUTO;
 439                         else if (streq(optarg, "no"))
 440                                 arg_link_journal = LINK_NO;
 441                         else if (streq(optarg, "guest"))
 442                                 arg_link_journal = LINK_GUEST;
 443                         else if (streq(optarg, "host"))
 444                                 arg_link_journal = LINK_HOST;
 445                         else if (streq(optarg, "try-guest")) {
 446                                 arg_link_journal = LINK_GUEST;
 447                                 arg_link_journal_try = true;
 448                         } else if (streq(optarg, "try-host")) {
 449                                 arg_link_journal = LINK_HOST;
 450                                 arg_link_journal_try = true;
 451                         } else {
 452                                 log_error("Failed to parse link journal mode %s", optarg);
 453                                 return -EINVAL;
 454                         }
 455
 456                         break;
 457
 458                 case ARG_BIND:
 459                 case ARG_BIND_RO: {
 460                         _cleanup_free_ char *a = NULL, *b = NULL;
 461                         char *e;
 462                         char ***x;
 463
 464                         x = c == ARG_BIND ? &arg_bind : &arg_bind_ro;
 465
 466                         e = strchr(optarg, ':');
 467                         if (e) {
 468                                 a = strndup(optarg, e - optarg);
 469                                 b = strdup(e + 1);
 470                         } else {
 471                                 a = strdup(optarg);
 472                                 b = strdup(optarg);
 473                         }
 474
 475                         if (!a || !b)
 476                                 return log_oom();
 477
 478                         if (!path_is_absolute(a) || !path_is_absolute(b)) {
 479                                 log_error("Invalid bind mount specification: %s", optarg);
 480                                 return -EINVAL;
 481                         }
 482
 483                         r = strv_extend(x, a);
 484                         if (r < 0)
 485                                 return log_oom();
 486
 487                         r = strv_extend(x, b);
 488                         if (r < 0)
 489                                 return log_oom();
 490
 491                         break;
 492                 }
 493
 494                 case ARG_TMPFS: {
 495                         _cleanup_free_ char *a = NULL, *b = NULL;
 496                         char *e;
 497
 498                         e = strchr(optarg, ':');
 499                         if (e) {
 500                                 a = strndup(optarg, e - optarg);
 501                                 b = strdup(e + 1);
 502                         } else {
 503                                 a = strdup(optarg);
 504                                 b = strdup("mode=0755");
 505                         }
 506
 507                         if (!a || !b)
 508                                 return log_oom();
 509
 510                         if (!path_is_absolute(a)) {
 511                                 log_error("Invalid tmpfs specification: %s", optarg);
 512                                 return -EINVAL;
 513                         }
 514
 515                         r = strv_push(&arg_tmpfs, a);
 516                         if (r < 0)
 517                                 return log_oom();
 518
 519                         a = NULL;
 520
 521                         r = strv_push(&arg_tmpfs, b);
 522                         if (r < 0)
 523                                 return log_oom();
 524
 525                         b = NULL;
 526
 527                         break;
 528                 }
 529
 530                 case ARG_SETENV: {
 531                         char **n;
 532
 533                         if (!env_assignment_is_valid(optarg)) {
 534                                 log_error("Environment variable assignment '%s' is not valid.", optarg);
 535                                 return -EINVAL;
 536                         }
 537
 538                         n = strv_env_set(arg_setenv, optarg);
 539                         if (!n)
 540                                 return log_oom();
 541
 542                         strv_free(arg_setenv);
 543                         arg_setenv = n;
 544                         break;
 545                 }
 546
 547                 case 'q':
 548                         arg_quiet = true;
 549                         break;
 550
 551                 case ARG_SHARE_SYSTEM:
 552                         arg_share_system = true;
 553                         break;
 554
 555                 case ARG_REGISTER:
 556                         r = parse_boolean(optarg);
 557                         if (r < 0) {
 558                                 log_error("Failed to parse --register= argument: %s", optarg);
 559                                 return r;
 560                         }
 561
 562                         arg_register = r;
 563                         break;
 564
 565                 case ARG_KEEP_UNIT:
 566                         arg_keep_unit = true;
 567                         break;
 568
 569                 case ARG_PERSONALITY:
 570
 571                         arg_personality = personality_from_string(optarg);
 572                         if (arg_personality == 0xffffffffLU) {
 573                                 log_error("Unknown or unsupported personality '%s'.", optarg);
 574                                 return -EINVAL;
 575                         }
 576
 577                         break;
 578
 579                 case ARG_VOLATILE:
 580
 581                         if (!optarg)
 582                                 arg_volatile = VOLATILE_YES;
 583                         else {
 584                                 r = parse_boolean(optarg);
 585                                 if (r < 0) {
 586                                         if (streq(optarg, "state"))
 587                                                 arg_volatile = VOLATILE_STATE;
 588                                         else {
 589                                                 log_error("Failed to parse --volatile= argument: %s", optarg);
 590                                                 return r;
 591                                         }
 592                                 } else
 593                                         arg_volatile = r ? VOLATILE_YES : VOLATILE_NO;
 594                         }
 595
 596                         break;
 597
 598                 case '?':
 599                         return -EINVAL;
 600
 601                 default:
 602                         assert_not_reached("Unhandled option");
 603                 }
 604
 605         if (arg_share_system)
 606                 arg_register = false;
 607
 608         if (arg_boot && arg_share_system) {
 609                 log_error("--boot and --share-system may not be combined.");
 610                 return -EINVAL;
 611         }
 612
 613         if (arg_keep_unit && cg_pid_get_owner_uid(0, NULL) >= 0) {
 614                 log_error("--keep-unit may not be used when invoked from a user session.");
 615                 return -EINVAL;
 616         }
 617
 618         if (arg_directory && arg_image) {
 619                 log_error("--directory= and --image= may not be combined.");
 620                 return -EINVAL;
 621         }
 622
 623         if (arg_volatile != VOLATILE_NO && arg_read_only) {
 624                 log_error("Cannot combine --read-only with --volatile. Note that --volatile already implies a read-only base hierarchy.");
 625                 return -EINVAL;
 626         }
 627
 628         arg_retain = (arg_retain | plus | (arg_private_network ? 1ULL << CAP_NET_ADMIN : 0)) & ~minus;
 629
 630         return 1;
 631 }
 632
 633 static int mount_all(const char *dest) {
 634
 635         typedef struct MountPoint {
 636                 const char *what;
 637                 const char *where;
 638                 const char *type;
 639                 const char *options;
 640                 unsigned long flags;
 641                 bool fatal;
 642         } MountPoint;
 643
 644         static const MountPoint mount_table[] = {
 645                 { "proc",      "/proc",     "proc",  NULL,        MS_NOSUID|MS_NOEXEC|MS_NODEV,           true  },
 646                 { "/proc/sys", "/proc/sys", NULL,    NULL,        MS_BIND,                                true  },   /* Bind mount first */
 647                 { NULL,        "/proc/sys", NULL,    NULL,        MS_BIND|MS_RDONLY|MS_REMOUNT,           true  },   /* Then, make it r/o */
 648                 { "sysfs",     "/sys",      "sysfs", NULL,        MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, true  },
 649                 { "tmpfs",     "/dev",      "tmpfs", "mode=755",  MS_NOSUID|MS_STRICTATIME,               true  },
 650                 { "devpts",    "/dev/pts",  "devpts","newinstance,ptmxmode=0666,mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC, true },
 651                 { "tmpfs",     "/dev/shm",  "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,      true  },
 652                 { "tmpfs",     "/run",      "tmpfs", "mode=755",  MS_NOSUID|MS_NODEV|MS_STRICTATIME,      true  },
 653 #ifdef HAVE_SELINUX
 654                 { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND,                              false },  /* Bind mount first */
 655                 { NULL,              "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT,         false },  /* Then, make it r/o */
 656 #endif
 657         };
 658
 659         unsigned k;
 660         int r = 0;
 661
 662         for (k = 0; k < ELEMENTSOF(mount_table); k++) {
 663                 _cleanup_free_ char *where = NULL;
 664 #ifdef HAVE_SELINUX
 665                 _cleanup_free_ char *options = NULL;
 666 #endif
 667                 const char *o;
 668                 int t;
 669
 670                 where = strjoin(dest, "/", mount_table[k].where, NULL);
 671                 if (!where)
 672                         return log_oom();
 673
 674                 t = path_is_mount_point(where, true);
 675                 if (t < 0) {
 676                         log_error_errno(t, "Failed to detect whether %s is a mount point: %m", where);
 677
 678                         if (r == 0)
 679                                 r = t;
 680
 681                         continue;
 682                 }
 683
 684                 /* Skip this entry if it is not a remount. */
 685                 if (mount_table[k].what && t > 0)
 686                         continue;
 687
 688                 t = mkdir_p(where, 0755);
 689                 if (t < 0) {
 690                         if (mount_table[k].fatal) {
 691                                log_error_errno(t, "Failed to create directory %s: %m", where);
 692
 693                                 if (r == 0)
 694                                         r = t;
 695                         } else
 696                                log_warning_errno(t, "Failed to create directory %s: %m", where);
 697
 698                         continue;
 699                 }
 700
 701 #ifdef HAVE_SELINUX
 702                 if (arg_selinux_apifs_context &&
 703                     (streq_ptr(mount_table[k].what, "tmpfs") || streq_ptr(mount_table[k].what, "devpts"))) {
 704                         options = strjoin(mount_table[k].options, ",context=\"", arg_selinux_apifs_context, "\"", NULL);
 705                         if (!options)
 706                                 return log_oom();
 707
 708                         o = options;
 709                 } else
 710 #endif
 711                         o = mount_table[k].options;
 712
 713
 714                 if (mount(mount_table[k].what,
 715                           where,
 716                           mount_table[k].type,
 717                           mount_table[k].flags,
 718                           o) < 0) {
 719
 720                         if (mount_table[k].fatal) {
 721                                 log_error_errno(errno, "mount(%s) failed: %m", where);
 722
 723                                 if (r == 0)
 724                                         r = -errno;
 725                         } else
 726                                 log_warning_errno(errno, "mount(%s) failed: %m", where);
 727                 }
 728         }
 729
 730         return r;
 731 }
 732
 733 static int mount_binds(const char *dest, char **l, bool ro) {
 734         char **x, **y;
 735
 736         STRV_FOREACH_PAIR(x, y, l) {
 737                 _cleanup_free_ char *where = NULL;
 738                 struct stat source_st, dest_st;
 739                 int r;
 740
 741                 if (stat(*x, &source_st) < 0)
 742                         return log_error_errno(errno, "Failed to stat %s: %m", *x);
 743
 744                 where = strappend(dest, *y);
 745                 if (!where)
 746                         return log_oom();
 747
 748                 r = stat(where, &dest_st);
 749                 if (r == 0) {
 750                         if ((source_st.st_mode & S_IFMT) != (dest_st.st_mode & S_IFMT)) {
 751                                 log_error("The file types of %s and %s do not match. Refusing bind mount", *x, where);
 752                                 return -EINVAL;
 753                         }
 754                 } else if (errno == ENOENT) {
 755                         r = mkdir_parents_label(where, 0755);
 756                         if (r < 0)
 757                                 return log_error_errno(r, "Failed to bind mount %s: %m", *x);
 758                 } else {
 759                         log_error_errno(errno, "Failed to bind mount %s: %m", *x);
 760                         return -errno;
 761                 }
 762
 763                 /* Create the mount point, but be conservative -- refuse to create block
 764                  * and char devices. */
 765                 if (S_ISDIR(source_st.st_mode)) {
 766                         r = mkdir_label(where, 0755);
 767                         if (r < 0 && errno != EEXIST)
 768                                 return log_error_errno(r, "Failed to create mount point %s: %m", where);
 769                 } else if (S_ISFIFO(source_st.st_mode)) {
 770                         r = mkfifo(where, 0644);
 771                         if (r < 0 && errno != EEXIST)
 772                                 return log_error_errno(errno, "Failed to create mount point %s: %m", where);
 773                 } else if (S_ISSOCK(source_st.st_mode)) {
 774                         r = mknod(where, 0644 | S_IFSOCK, 0);
 775                         if (r < 0 && errno != EEXIST)
 776                                 return log_error_errno(errno, "Failed to create mount point %s: %m", where);
 777                 } else if (S_ISREG(source_st.st_mode)) {
 778                         r = touch(where);
 779                         if (r < 0)
 780                                 return log_error_errno(r, "Failed to create mount point %s: %m", where);
 781                 } else {
 782                         log_error("Refusing to create mountpoint for file: %s", *x);
 783                         return -ENOTSUP;
 784                 }
 785
 786                 if (mount(*x, where, "bind", MS_BIND, NULL) < 0)
 787                         return log_error_errno(errno, "mount(%s) failed: %m", where);
 788
 789                 if (ro) {
 790                         r = bind_remount_recursive(where, true);
 791                         if (r < 0)
 792                                 return log_error_errno(r, "Read-Only bind mount failed: %m");
 793                 }
 794         }
 795
 796         return 0;
 797 }
 798
 799 static int mount_tmpfs(const char *dest) {
 800         char **i, **o;
 801
 802         STRV_FOREACH_PAIR(i, o, arg_tmpfs) {
 803                 _cleanup_free_ char *where = NULL;
 804                 int r;
 805
 806                 where = strappend(dest, *i);
 807                 if (!where)
 808                         return log_oom();
 809
 810                 r = mkdir_label(where, 0755);
 811                 if (r < 0 && r != -EEXIST)
 812                         return log_error_errno(r, "Creating mount point for tmpfs %s failed: %m", where);
 813
 814                 if (mount("tmpfs", where, "tmpfs", MS_NODEV|MS_STRICTATIME, *o) < 0)
 815                         return log_error_errno(errno, "tmpfs mount to %s failed: %m", where);
 816         }
 817
 818         return 0;
 819 }
 820
 821 static int setup_timezone(const char *dest) {
 822         _cleanup_free_ char *where = NULL, *p = NULL, *q = NULL, *check = NULL, *what = NULL;
 823         char *z, *y;
 824         int r;
 825
 826         assert(dest);
 827
 828         /* Fix the timezone, if possible */
 829         r = readlink_malloc("/etc/localtime", &p);
 830         if (r < 0) {
 831                 log_warning("/etc/localtime is not a symlink, not updating container timezone.");
 832                 return 0;
 833         }
 834
 835         z = path_startswith(p, "../usr/share/zoneinfo/");
 836         if (!z)
 837                 z = path_startswith(p, "/usr/share/zoneinfo/");
 838         if (!z) {
 839                 log_warning("/etc/localtime does not point into /usr/share/zoneinfo/, not updating container timezone.");
 840                 return 0;
 841         }
 842
 843         where = strappend(dest, "/etc/localtime");
 844         if (!where)
 845                 return log_oom();
 846
 847         r = readlink_malloc(where, &q);
 848         if (r >= 0) {
 849                 y = path_startswith(q, "../usr/share/zoneinfo/");
 850                 if (!y)
 851                         y = path_startswith(q, "/usr/share/zoneinfo/");
 852
 853                 /* Already pointing to the right place? Then do nothing .. */
 854                 if (y && streq(y, z))
 855                         return 0;
 856         }
 857
 858         check = strjoin(dest, "/usr/share/zoneinfo/", z, NULL);
 859         if (!check)
 860                 return log_oom();
 861
 862         if (access(check, F_OK) < 0) {
 863                 log_warning("Timezone %s does not exist in container, not updating container timezone.", z);
 864                 return 0;
 865         }
 866
 867         what = strappend("../usr/share/zoneinfo/", z);
 868         if (!what)
 869                 return log_oom();
 870
 871         r = mkdir_parents(where, 0755);
 872         if (r < 0) {
 873                 log_error_errno(r, "Failed to create directory for timezone info %s in container: %m", where);
 874
 875                 return 0;
 876         }
 877
 878         r = unlink(where);
 879         if (r < 0 && errno != ENOENT) {
 880                 log_error_errno(errno, "Failed to remove existing timezone info %s in container: %m", where);
 881
 882                 return 0;
 883         }
 884
 885         if (symlink(what, where) < 0) {
 886                 log_error_errno(errno, "Failed to correct timezone of container: %m");
 887                 return 0;
 888         }
 889
 890         return 0;
 891 }
 892
 893 static int setup_resolv_conf(const char *dest) {
 894         _cleanup_free_ char *where = NULL;
 895         int r;
 896
 897         assert(dest);
 898
 899         if (arg_private_network)
 900                 return 0;
 901
 902         /* Fix resolv.conf, if possible */
 903         where = strappend(dest, "/etc/resolv.conf");
 904         if (!where)
 905                 return log_oom();
 906
 907         /* We don't really care for the results of this really. If it
 908          * fails, it fails, but meh... */
 909         r = mkdir_parents(where, 0755);
 910         if (r < 0) {
 911                 log_warning_errno(r, "Failed to create parent directory for resolv.conf %s: %m", where);
 912
 913                 return 0;
 914         }
 915
 916         r = copy_file("/etc/resolv.conf", where, O_TRUNC|O_NOFOLLOW, 0644);
 917         if (r < 0) {
 918                 log_warning_errno(r, "Failed to copy /etc/resolv.conf to %s: %m", where);
 919
 920                 return 0;
 921         }
 922
 923         return 0;
 924 }
 925
 926 static int setup_volatile_state(const char *directory) {
 927         const char *p;
 928         int r;
 929
 930         assert(directory);
 931
 932         if (arg_volatile != VOLATILE_STATE)
 933                 return 0;
 934
 935         /* --volatile=state means we simply overmount /var
 936            with a tmpfs, and the rest read-only. */
 937
 938         r = bind_remount_recursive(directory, true);
 939         if (r < 0)
 940                 return log_error_errno(r, "Failed to remount %s read-only: %m", directory);
 941
 942         p = strappenda(directory, "/var");
 943         r = mkdir(p, 0755);
 944         if (r < 0 && errno != EEXIST)
 945                 return log_error_errno(errno, "Failed to create %s: %m", directory);
 946
 947         if (mount("tmpfs", p, "tmpfs", MS_STRICTATIME, "mode=755") < 0)
 948                 return log_error_errno(errno, "Failed to mount tmpfs to /var: %m");
 949
 950         return 0;
 951 }
 952
 953 static int setup_volatile(const char *directory) {
 954         bool tmpfs_mounted = false, bind_mounted = false;
 955         char template[] = "/tmp/nspawn-volatile-XXXXXX";
 956         const char *f, *t;
 957         int r;
 958
 959         assert(directory);
 960
 961         if (arg_volatile != VOLATILE_YES)
 962                 return 0;
 963
 964         /* --volatile=yes means we mount a tmpfs to the root dir, and
 965            the original /usr to use inside it, and that read-only. */
 966
 967         if (!mkdtemp(template))
 968                 return log_error_errno(errno, "Failed to create temporary directory: %m");
 969
 970         if (mount("tmpfs", template, "tmpfs", MS_STRICTATIME, "mode=755") < 0) {
 971                 log_error_errno(errno, "Failed to mount tmpfs for root directory: %m");
 972                 r = -errno;
 973                 goto fail;
 974         }
 975
 976         tmpfs_mounted = true;
 977
 978         f = strappenda(directory, "/usr");
 979         t = strappenda(template, "/usr");
 980
 981         r = mkdir(t, 0755);
 982         if (r < 0 && errno != EEXIST) {
 983                 log_error_errno(errno, "Failed to create %s: %m", t);
 984                 r = -errno;
 985                 goto fail;
 986         }
 987
 988         if (mount(f, t, "bind", MS_BIND|MS_REC, NULL) < 0) {
 989                 log_error_errno(errno, "Failed to create /usr bind mount: %m");
 990                 r = -errno;
 991                 goto fail;
 992         }
 993
 994         bind_mounted = true;
 995
 996         r = bind_remount_recursive(t, true);
 997         if (r < 0) {
 998                 log_error_errno(r, "Failed to remount %s read-only: %m", t);
 999                 goto fail;
1000         }
1001
1002         if (mount(template, directory, NULL, MS_MOVE, NULL) < 0) {
1003                 log_error_errno(errno, "Failed to move root mount: %m");
1004                 r = -errno;
1005                 goto fail;
1006         }
1007
1008         rmdir(template);
1009
1010         return 0;
1011
1012 fail:
1013         if (bind_mounted)
1014                 umount(t);
1015         if (tmpfs_mounted)
1016                 umount(template);
1017         rmdir(template);
1018         return r;
1019 }
1020
1021 static char* id128_format_as_uuid(sd_id128_t id, char s[37]) {
1022
1023         snprintf(s, 37,
1024                  "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
1025                  SD_ID128_FORMAT_VAL(id));
1026
1027         return s;
1028 }
1029
1030 static int setup_boot_id(const char *dest) {
1031         _cleanup_free_ char *from = NULL, *to = NULL;
1032         sd_id128_t rnd = {};
1033         char as_uuid[37];
1034         int r;
1035
1036         assert(dest);
1037
1038         if (arg_share_system)
1039                 return 0;
1040
1041         /* Generate a new randomized boot ID, so that each boot-up of
1042          * the container gets a new one */
1043
1044         from = strappend(dest, "/dev/proc-sys-kernel-random-boot-id");
1045         to = strappend(dest, "/proc/sys/kernel/random/boot_id");
1046         if (!from || !to)
1047                 return log_oom();
1048
1049         r = sd_id128_randomize(&rnd);
1050         if (r < 0)
1051                 return log_error_errno(r, "Failed to generate random boot id: %m");
1052
1053         id128_format_as_uuid(rnd, as_uuid);
1054
1055         r = write_string_file(from, as_uuid);
1056         if (r < 0)
1057                 return log_error_errno(r, "Failed to write boot id: %m");
1058
1059         if (mount(from, to, "bind", MS_BIND, NULL) < 0) {
1060                 log_error_errno(errno, "Failed to bind mount boot id: %m");
1061                 r = -errno;
1062         } else if (mount(from, to, "bind", MS_BIND|MS_REMOUNT|MS_RDONLY, NULL))
1063                 log_warning_errno(errno, "Failed to make boot id read-only: %m");
1064
1065         unlink(from);
1066         return r;
1067 }
1068
1069 static int copy_devnodes(const char *dest) {
1070
1071         static const char devnodes[] =
1072                 "null\0"
1073                 "zero\0"
1074                 "full\0"
1075                 "random\0"
1076                 "urandom\0"
1077                 "tty\0"
1078                 "net/tun\0";
1079
1080         const char *d;
1081         int r = 0;
1082         _cleanup_umask_ mode_t u;
1083
1084         assert(dest);
1085
1086         u = umask(0000);
1087
1088         NULSTR_FOREACH(d, devnodes) {
1089                 _cleanup_free_ char *from = NULL, *to = NULL;
1090                 struct stat st;
1091
1092                 from = strappend("/dev/", d);
1093                 to = strjoin(dest, "/dev/", d, NULL);
1094                 if (!from || !to)
1095                         return log_oom();
1096
1097                 if (stat(from, &st) < 0) {
1098
1099                         if (errno != ENOENT)
1100                                 return log_error_errno(errno, "Failed to stat %s: %m", from);
1101
1102                 } else if (!S_ISCHR(st.st_mode) && !S_ISBLK(st.st_mode)) {
1103
1104                         log_error("%s is not a char or block device, cannot copy", from);
1105                         return -EIO;
1106
1107                 } else {
1108                         r = mkdir_parents(to, 0775);
1109                         if (r < 0) {
1110                                 log_error_errno(r, "Failed to create parent directory of %s: %m", to);
1111                                 return -r;
1112                         }
1113
1114                         if (mknod(to, st.st_mode, st.st_rdev) < 0)
1115                                 return log_error_errno(errno, "mknod(%s) failed: %m", dest);
1116                 }
1117         }
1118
1119         return r;
1120 }
1121
1122 static int setup_ptmx(const char *dest) {
1123         _cleanup_free_ char *p = NULL;
1124
1125         p = strappend(dest, "/dev/ptmx");
1126         if (!p)
1127                 return log_oom();
1128
1129         if (symlink("pts/ptmx", p) < 0)
1130                 return log_error_errno(errno, "Failed to create /dev/ptmx symlink: %m");
1131
1132         return 0;
1133 }
1134
1135 static int setup_dev_console(const char *dest, const char *console) {
1136         _cleanup_umask_ mode_t u;
1137         const char *to;
1138         struct stat st;
1139         int r;
1140
1141         assert(dest);
1142         assert(console);
1143
1144         u = umask(0000);
1145
1146         if (stat("/dev/null", &st) < 0)
1147                 return log_error_errno(errno, "Failed to stat /dev/null: %m");
1148
1149         r = chmod_and_chown(console, 0600, 0, 0);
1150         if (r < 0)
1151                 return log_error_errno(r, "Failed to correct access mode for TTY: %m");
1152
1153         /* We need to bind mount the right tty to /dev/console since
1154          * ptys can only exist on pts file systems. To have something
1155          * to bind mount things on we create a device node first, and
1156          * use /dev/null for that since we the cgroups device policy
1157          * allows us to create that freely, while we cannot create
1158          * /dev/console. (Note that the major minor doesn't actually
1159          * matter here, since we mount it over anyway). */
1160
1161         to = strappenda(dest, "/dev/console");
1162         if (mknod(to, (st.st_mode & ~07777) | 0600, st.st_rdev) < 0)
1163                 return log_error_errno(errno, "mknod() for /dev/console failed: %m");
1164
1165         if (mount(console, to, "bind", MS_BIND, NULL) < 0)
1166                 return log_error_errno(errno, "Bind mount for /dev/console failed: %m");
1167
1168         return 0;
1169 }
1170
1171 static int setup_kmsg(const char *dest, int kmsg_socket) {
1172         _cleanup_free_ char *from = NULL, *to = NULL;
1173         int r, fd, k;
1174         _cleanup_umask_ mode_t u;
1175         union {
1176                 struct cmsghdr cmsghdr;
1177                 uint8_t buf[CMSG_SPACE(sizeof(int))];
1178         } control = {};
1179         struct msghdr mh = {
1180                 .msg_control = &control,
1181                 .msg_controllen = sizeof(control),
1182         };
1183         struct cmsghdr *cmsg;
1184
1185         assert(dest);
1186         assert(kmsg_socket >= 0);
1187
1188         u = umask(0000);
1189
1190         /* We create the kmsg FIFO as /dev/kmsg, but immediately
1191          * delete it after bind mounting it to /proc/kmsg. While FIFOs
1192          * on the reading side behave very similar to /proc/kmsg,
1193          * their writing side behaves differently from /dev/kmsg in
1194          * that writing blocks when nothing is reading. In order to
1195          * avoid any problems with containers deadlocking due to this
1196          * we simply make /dev/kmsg unavailable to the container. */
1197         if (asprintf(&from, "%s/dev/kmsg", dest) < 0 ||
1198             asprintf(&to, "%s/proc/kmsg", dest) < 0)
1199                 return log_oom();
1200
1201         if (mkfifo(from, 0600) < 0)
1202                 return log_error_errno(errno, "mkfifo() for /dev/kmsg failed: %m");
1203
1204         r = chmod_and_chown(from, 0600, 0, 0);
1205         if (r < 0)
1206                 return log_error_errno(r, "Failed to correct access mode for /dev/kmsg: %m");
1207
1208         if (mount(from, to, "bind", MS_BIND, NULL) < 0)
1209                 return log_error_errno(errno, "Bind mount for /proc/kmsg failed: %m");
1210
1211         fd = open(from, O_RDWR|O_NDELAY|O_CLOEXEC);
1212         if (fd < 0)
1213                 return log_error_errno(errno, "Failed to open fifo: %m");
1214
1215         cmsg = CMSG_FIRSTHDR(&mh);
1216         cmsg->cmsg_level = SOL_SOCKET;
1217         cmsg->cmsg_type = SCM_RIGHTS;
1218         cmsg->cmsg_len = CMSG_LEN(sizeof(int));
1219         memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));
1220
1221         mh.msg_controllen = cmsg->cmsg_len;
1222
1223         /* Store away the fd in the socket, so that it stays open as
1224          * long as we run the child */
1225         k = sendmsg(kmsg_socket, &mh, MSG_DONTWAIT|MSG_NOSIGNAL);
1226         safe_close(fd);
1227
1228         if (k < 0)
1229                 return log_error_errno(errno, "Failed to send FIFO fd: %m");
1230
1231         /* And now make the FIFO unavailable as /dev/kmsg... */
1232         unlink(from);
1233         return 0;
1234 }
1235
1236 static int setup_hostname(void) {
1237
1238         if (arg_share_system)
1239                 return 0;
1240
1241         if (sethostname_idempotent(arg_machine) < 0)
1242                 return -errno;
1243
1244         return 0;
1245 }
1246
1247 static int setup_journal(const char *directory) {
1248         sd_id128_t machine_id, this_id;
1249         _cleanup_free_ char *p = NULL, *b = NULL, *q = NULL, *d = NULL;
1250         char *id;
1251         int r;
1252
1253         p = strappend(directory, "/etc/machine-id");
1254         if (!p)
1255                 return log_oom();
1256
1257         r = read_one_line_file(p, &b);
1258         if (r == -ENOENT && arg_link_journal == LINK_AUTO)
1259                 return 0;
1260         else if (r < 0)
1261                 return log_error_errno(r, "Failed to read machine ID from %s: %m", p);
1262
1263         id = strstrip(b);
1264         if (isempty(id) && arg_link_journal == LINK_AUTO)
1265                 return 0;
1266
1267         /* Verify validity */
1268         r = sd_id128_from_string(id, &machine_id);
1269         if (r < 0)
1270                 return log_error_errno(r, "Failed to parse machine ID from %s: %m", p);
1271
1272         r = sd_id128_get_machine(&this_id);
1273         if (r < 0)
1274                 return log_error_errno(r, "Failed to retrieve machine ID: %m");
1275
1276         if (sd_id128_equal(machine_id, this_id)) {
1277                 log_full(arg_link_journal == LINK_AUTO ? LOG_WARNING : LOG_ERR,
1278                          "Host and machine ids are equal (%s): refusing to link journals", id);
1279                 if (arg_link_journal == LINK_AUTO)
1280                         return 0;
1281                 return
1282                         -EEXIST;
1283         }
1284
1285         if (arg_link_journal == LINK_NO)
1286                 return 0;
1287
1288         free(p);
1289         p = strappend("/var/log/journal/", id);
1290         q = strjoin(directory, "/var/log/journal/", id, NULL);
1291         if (!p || !q)
1292                 return log_oom();
1293
1294         if (path_is_mount_point(p, false) > 0) {
1295                 if (arg_link_journal != LINK_AUTO) {
1296                         log_error("%s: already a mount point, refusing to use for journal", p);
1297                         return -EEXIST;
1298                 }
1299
1300                 return 0;
1301         }
1302
1303         if (path_is_mount_point(q, false) > 0) {
1304                 if (arg_link_journal != LINK_AUTO) {
1305                         log_error("%s: already a mount point, refusing to use for journal", q);
1306                         return -EEXIST;
1307                 }
1308
1309                 return 0;
1310         }
1311
1312         r = readlink_and_make_absolute(p, &d);
1313         if (r >= 0) {
1314                 if ((arg_link_journal == LINK_GUEST ||
1315                      arg_link_journal == LINK_AUTO) &&
1316                     path_equal(d, q)) {
1317
1318                         r = mkdir_p(q, 0755);
1319                         if (r < 0)
1320                                 log_warning_errno(errno, "Failed to create directory %s: %m", q);
1321                         return 0;
1322                 }
1323
1324                 if (unlink(p) < 0)
1325                         return log_error_errno(errno, "Failed to remove symlink %s: %m", p);
1326         } else if (r == -EINVAL) {
1327
1328                 if (arg_link_journal == LINK_GUEST &&
1329                     rmdir(p) < 0) {
1330
1331                         if (errno == ENOTDIR) {
1332                                 log_error("%s already exists and is neither a symlink nor a directory", p);
1333                                 return r;
1334                         } else {
1335                                 log_error_errno(errno, "Failed to remove %s: %m", p);
1336                                 return -errno;
1337                         }
1338                 }
1339         } else if (r != -ENOENT) {
1340                 log_error_errno(errno, "readlink(%s) failed: %m", p);
1341                 return r;
1342         }
1343
1344         if (arg_link_journal == LINK_GUEST) {
1345
1346                 if (symlink(q, p) < 0) {
1347                         if (arg_link_journal_try) {
1348                                 log_debug_errno(errno, "Failed to symlink %s to %s, skipping journal setup: %m", q, p);
1349                                 return 0;
1350                         } else {
1351                                 log_error_errno(errno, "Failed to symlink %s to %s: %m", q, p);
1352                                 return -errno;
1353                         }
1354                 }
1355
1356                 r = mkdir_p(q, 0755);
1357                 if (r < 0)
1358                         log_warning_errno(errno, "Failed to create directory %s: %m", q);
1359                 return 0;
1360         }
1361
1362         if (arg_link_journal == LINK_HOST) {
1363                 /* don't create parents here -- if the host doesn't have
1364                  * permanent journal set up, don't force it here */
1365                 r = mkdir(p, 0755);
1366                 if (r < 0) {
1367                         if (arg_link_journal_try) {
1368                                 log_debug_errno(errno, "Failed to create %s, skipping journal setup: %m", p);
1369                                 return 0;
1370                         } else {
1371                                 log_error_errno(errno, "Failed to create %s: %m", p);
1372                                 return r;
1373                         }
1374                 }
1375
1376         } else if (access(p, F_OK) < 0)
1377                 return 0;
1378
1379         if (dir_is_empty(q) == 0)
1380                 log_warning("%s is not empty, proceeding anyway.", q);
1381
1382         r = mkdir_p(q, 0755);
1383         if (r < 0) {
1384                 log_error_errno(errno, "Failed to create %s: %m", q);
1385                 return r;
1386         }
1387
1388         if (mount(p, q, "bind", MS_BIND, NULL) < 0)
1389                 return log_error_errno(errno, "Failed to bind mount journal from host into guest: %m");
1390
1391         return 0;
1392 }
1393
1394 static int drop_capabilities(void) {
1395         return capability_bounding_set_drop(~arg_retain, false);
1396 }
1397
1398 static int register_machine(pid_t pid, int local_ifindex) {
1399         _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1400         _cleanup_bus_close_unref_ sd_bus *bus = NULL;
1401         int r;
1402
1403         if (!arg_register)
1404                 return 0;
1405
1406         r = sd_bus_default_system(&bus);
1407         if (r < 0)
1408                 return log_error_errno(r, "Failed to open system bus: %m");
1409
1410         if (arg_keep_unit) {
1411                 r = sd_bus_call_method(
1412                                 bus,
1413                                 "org.freedesktop.machine1",
1414                                 "/org/freedesktop/machine1",
1415                                 "org.freedesktop.machine1.Manager",
1416                                 "RegisterMachineWithNetwork",
1417                                 &error,
1418                                 NULL,
1419                                 "sayssusai",
1420                                 arg_machine,
1421                                 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
1422                                 "nspawn",
1423                                 "container",
1424                                 (uint32_t) pid,
1425                                 strempty(arg_directory),
1426                                 local_ifindex > 0 ? 1 : 0, local_ifindex);
1427         } else {
1428                 _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
1429
1430                 r = sd_bus_message_new_method_call(
1431                                 bus,
1432                                 &m,
1433                                 "org.freedesktop.machine1",
1434                                 "/org/freedesktop/machine1",
1435                                 "org.freedesktop.machine1.Manager",
1436                                 "CreateMachineWithNetwork");
1437                 if (r < 0)
1438                         return log_error_errno(r, "Failed to create message: %m");
1439
1440                 r = sd_bus_message_append(
1441                                 m,
1442                                 "sayssusai",
1443                                 arg_machine,
1444                                 SD_BUS_MESSAGE_APPEND_ID128(arg_uuid),
1445                                 "nspawn",
1446                                 "container",
1447                                 (uint32_t) pid,
1448                                 strempty(arg_directory),
1449                                 local_ifindex > 0 ? 1 : 0, local_ifindex);
1450                 if (r < 0)
1451                         return log_error_errno(r, "Failed to append message arguments: %m");
1452
1453                 r = sd_bus_message_open_container(m, 'a', "(sv)");
1454                 if (r < 0)
1455                         return log_error_errno(r, "Failed to open container: %m");
1456
1457                 if (!isempty(arg_slice)) {
1458                         r = sd_bus_message_append(m, "(sv)", "Slice", "s", arg_slice);
1459                         if (r < 0)
1460                                 return log_error_errno(r, "Failed to append slice: %m");
1461                 }
1462
1463                 r = sd_bus_message_append(m, "(sv)", "DevicePolicy", "s", "strict");
1464                 if (r < 0)
1465                         return log_error_errno(r, "Failed to add device policy: %m");
1466
1467                 r = sd_bus_message_append(m, "(sv)", "DeviceAllow", "a(ss)", 9,
1468                                           /* Allow the container to
1469                                            * access and create the API
1470                                            * device nodes, so that
1471                                            * PrivateDevices= in the
1472                                            * container can work
1473                                            * fine */
1474                                           "/dev/null", "rwm",
1475                                           "/dev/zero", "rwm",
1476                                           "/dev/full", "rwm",
1477                                           "/dev/random", "rwm",
1478                                           "/dev/urandom", "rwm",
1479                                           "/dev/tty", "rwm",
1480                                           "/dev/net/tun", "rwm",
1481                                           /* Allow the container
1482                                            * access to ptys. However,
1483                                            * do not permit the
1484                                            * container to ever create
1485                                            * these device nodes. */
1486                                           "/dev/pts/ptmx", "rw",
1487                                           "char-pts", "rw");
1488                 if (r < 0)
1489                         return log_error_errno(r, "Failed to add device whitelist: %m");
1490
1491                 r = sd_bus_message_close_container(m);
1492                 if (r < 0)
1493                         return log_error_errno(r, "Failed to close container: %m");
1494
1495                 r = sd_bus_call(bus, m, 0, &error, NULL);
1496         }
1497
1498         if (r < 0) {
1499                 log_error("Failed to register machine: %s", bus_error_message(&error, r));
1500                 return r;
1501         }
1502
1503         return 0;
1504 }
1505
1506 static int terminate_machine(pid_t pid) {
1507         _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
1508         _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
1509         _cleanup_bus_close_unref_ sd_bus *bus = NULL;
1510         const char *path;
1511         int r;
1512
1513         if (!arg_register)
1514                 return 0;
1515
1516         r = sd_bus_default_system(&bus);
1517         if (r < 0)
1518                 return log_error_errno(r, "Failed to open system bus: %m");
1519
1520         r = sd_bus_call_method(
1521                         bus,
1522                         "org.freedesktop.machine1",
1523                         "/org/freedesktop/machine1",
1524                         "org.freedesktop.machine1.Manager",
1525                         "GetMachineByPID",
1526                         &error,
1527                         &reply,
1528                         "u",
1529                         (uint32_t) pid);
1530         if (r < 0) {
1531                 /* Note that the machine might already have been
1532                  * cleaned up automatically, hence don't consider it a
1533                  * failure if we cannot get the machine object. */
1534                 log_debug("Failed to get machine: %s", bus_error_message(&error, r));
1535                 return 0;
1536         }
1537
1538         r = sd_bus_message_read(reply, "o", &path);
1539         if (r < 0)
1540                 return bus_log_parse_error(r);
1541
1542         r = sd_bus_call_method(
1543                         bus,
1544                         "org.freedesktop.machine1",
1545                         path,
1546                         "org.freedesktop.machine1.Machine",
1547                         "Terminate",
1548                         &error,
1549                         NULL,
1550                         NULL);
1551         if (r < 0) {
1552                 log_debug("Failed to terminate machine: %s", bus_error_message(&error, r));
1553                 return 0;
1554         }
1555
1556         return 0;
1557 }
1558
1559 static int reset_audit_loginuid(void) {
1560         _cleanup_free_ char *p = NULL;
1561         int r;
1562
1563         if (arg_share_system)
1564                 return 0;
1565
1566         r = read_one_line_file("/proc/self/loginuid", &p);
1567         if (r == -ENOENT)
1568                 return 0;
1569         if (r < 0)
1570                 return log_error_errno(r, "Failed to read /proc/self/loginuid: %m");
1571
1572         /* Already reset? */
1573         if (streq(p, "4294967295"))
1574                 return 0;
1575
1576         r = write_string_file("/proc/self/loginuid", "4294967295");
1577         if (r < 0) {
1578                 log_error("Failed to reset audit login UID. This probably means that your kernel is too\n"
1579                           "old and you have audit enabled. Note that the auditing subsystem is known to\n"
1580                           "be incompatible with containers on old kernels. Please make sure to upgrade\n"
1581                           "your kernel or to off auditing with 'audit=0' on the kernel command line before\n"
1582                           "using systemd-nspawn. Sleeping for 5s... (%s)\n", strerror(-r));
1583
1584                 sleep(5);
1585         }
1586
1587         return 0;
1588 }
1589
1590 #define HOST_HASH_KEY SD_ID128_MAKE(1a,37,6f,c7,46,ec,45,0b,ad,a3,d5,31,06,60,5d,b1)
1591 #define CONTAINER_HASH_KEY SD_ID128_MAKE(c3,c4,f9,19,b5,57,b2,1c,e6,cf,14,27,03,9c,ee,a2)
1592
1593 static int generate_mac(struct ether_addr *mac, sd_id128_t hash_key) {
1594         int r;
1595
1596         uint8_t result[8];
1597         size_t l, sz;
1598         uint8_t *v;
1599
1600         l = strlen(arg_machine);
1601         sz = sizeof(sd_id128_t) + l;
1602         v = alloca(sz);
1603
1604         /* fetch some persistent data unique to the host */
1605         r = sd_id128_get_machine((sd_id128_t*) v);
1606         if (r < 0)
1607                 return r;
1608
1609         /* combine with some data unique (on this host) to this
1610          * container instance */
1611         memcpy(v + sizeof(sd_id128_t), arg_machine, l);
1612
1613         /* Let's hash the host machine ID plus the container name. We
1614          * use a fixed, but originally randomly created hash key here. */
1615         siphash24(result, v, sz, hash_key.bytes);
1616
1617         assert_cc(ETH_ALEN <= sizeof(result));
1618         memcpy(mac->ether_addr_octet, result, ETH_ALEN);
1619
1620         /* see eth_random_addr in the kernel */
1621         mac->ether_addr_octet[0] &= 0xfe;        /* clear multicast bit */
1622         mac->ether_addr_octet[0] |= 0x02;        /* set local assignment bit (IEEE802) */
1623
1624         return 0;
1625 }
1626
1627 static int setup_veth(pid_t pid, char iface_name[IFNAMSIZ], int *ifi) {
1628         _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1629         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1630         struct ether_addr mac_host, mac_container;
1631         int r, i;
1632
1633         if (!arg_private_network)
1634                 return 0;
1635
1636         if (!arg_network_veth)
1637                 return 0;
1638
1639         /* Use two different interface name prefixes depending whether
1640          * we are in bridge mode or not. */
1641         snprintf(iface_name, IFNAMSIZ - 1, "%s-%s",
1642                  arg_network_bridge ? "vb" : "ve", arg_machine);
1643
1644         r = generate_mac(&mac_container, CONTAINER_HASH_KEY);
1645         if (r < 0) {
1646                 log_error("Failed to generate predictable MAC address for container side");
1647                 return r;
1648         }
1649
1650         r = generate_mac(&mac_host, HOST_HASH_KEY);
1651         if (r < 0) {
1652                 log_error("Failed to generate predictable MAC address for host side");
1653                 return r;
1654         }
1655
1656         r = sd_rtnl_open(&rtnl, 0);
1657         if (r < 0)
1658                 return log_error_errno(r, "Failed to connect to netlink: %m");
1659
1660         r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
1661         if (r < 0)
1662                 return log_error_errno(r, "Failed to allocate netlink message: %m");
1663
1664         r = sd_rtnl_message_append_string(m, IFLA_IFNAME, iface_name);
1665         if (r < 0)
1666                 return log_error_errno(r, "Failed to add netlink interface name: %m");
1667
1668         r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac_host);
1669         if (r < 0)
1670                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
1671
1672         r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
1673         if (r < 0)
1674                 return log_error_errno(r, "Failed to open netlink container: %m");
1675
1676         r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "veth");
1677         if (r < 0)
1678                 return log_error_errno(r, "Failed to open netlink container: %m");
1679
1680         r = sd_rtnl_message_open_container(m, VETH_INFO_PEER);
1681         if (r < 0)
1682                 return log_error_errno(r, "Failed to open netlink container: %m");
1683
1684         r = sd_rtnl_message_append_string(m, IFLA_IFNAME, "host0");
1685         if (r < 0)
1686                 return log_error_errno(r, "Failed to add netlink interface name: %m");
1687
1688         r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, &mac_container);
1689         if (r < 0)
1690                 return log_error_errno(r, "Failed to add netlink MAC address: %m");
1691
1692         r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1693         if (r < 0)
1694                 return log_error_errno(r, "Failed to add netlink namespace field: %m");
1695
1696         r = sd_rtnl_message_close_container(m);
1697         if (r < 0)
1698                 return log_error_errno(r, "Failed to close netlink container: %m");
1699
1700         r = sd_rtnl_message_close_container(m);
1701         if (r < 0)
1702                 return log_error_errno(r, "Failed to close netlink container: %m");
1703
1704         r = sd_rtnl_message_close_container(m);
1705         if (r < 0)
1706                 return log_error_errno(r, "Failed to close netlink container: %m");
1707
1708         r = sd_rtnl_call(rtnl, m, 0, NULL);
1709         if (r < 0)
1710                 return log_error_errno(r, "Failed to add new veth interfaces: %m");
1711
1712         i = (int) if_nametoindex(iface_name);
1713         if (i <= 0)
1714                 return log_error_errno(errno, "Failed to resolve interface %s: %m", iface_name);
1715
1716         *ifi = i;
1717
1718         return 0;
1719 }
1720
1721 static int setup_bridge(const char veth_name[], int *ifi) {
1722         _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1723         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1724         int r, bridge;
1725
1726         if (!arg_private_network)
1727                 return 0;
1728
1729         if (!arg_network_veth)
1730                 return 0;
1731
1732         if (!arg_network_bridge)
1733                 return 0;
1734
1735         bridge = (int) if_nametoindex(arg_network_bridge);
1736         if (bridge <= 0)
1737                 return log_error_errno(errno, "Failed to resolve interface %s: %m", arg_network_bridge);
1738
1739         *ifi = bridge;
1740
1741         r = sd_rtnl_open(&rtnl, 0);
1742         if (r < 0)
1743                 return log_error_errno(r, "Failed to connect to netlink: %m");
1744
1745         r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, 0);
1746         if (r < 0)
1747                 return log_error_errno(r, "Failed to allocate netlink message: %m");
1748
1749         r = sd_rtnl_message_link_set_flags(m, IFF_UP, IFF_UP);
1750         if (r < 0)
1751                 return log_error_errno(r, "Failed to set IFF_UP flag: %m");
1752
1753         r = sd_rtnl_message_append_string(m, IFLA_IFNAME, veth_name);
1754         if (r < 0)
1755                 return log_error_errno(r, "Failed to add netlink interface name field: %m");
1756
1757         r = sd_rtnl_message_append_u32(m, IFLA_MASTER, bridge);
1758         if (r < 0)
1759                 return log_error_errno(r, "Failed to add netlink master field: %m");
1760
1761         r = sd_rtnl_call(rtnl, m, 0, NULL);
1762         if (r < 0)
1763                 return log_error_errno(r, "Failed to add veth interface to bridge: %m");
1764
1765         return 0;
1766 }
1767
1768 static int parse_interface(struct udev *udev, const char *name) {
1769         _cleanup_udev_device_unref_ struct udev_device *d = NULL;
1770         char ifi_str[2 + DECIMAL_STR_MAX(int)];
1771         int ifi;
1772
1773         ifi = (int) if_nametoindex(name);
1774         if (ifi <= 0)
1775                 return log_error_errno(errno, "Failed to resolve interface %s: %m", name);
1776
1777         sprintf(ifi_str, "n%i", ifi);
1778         d = udev_device_new_from_device_id(udev, ifi_str);
1779         if (!d)
1780                 return log_error_errno(errno, "Failed to get udev device for interface %s: %m", name);
1781
1782         if (udev_device_get_is_initialized(d) <= 0) {
1783                 log_error("Network interface %s is not initialized yet.", name);
1784                 return -EBUSY;
1785         }
1786
1787         return ifi;
1788 }
1789
1790 static int move_network_interfaces(pid_t pid) {
1791         _cleanup_udev_unref_ struct udev *udev = NULL;
1792         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1793         char **i;
1794         int r;
1795
1796         if (!arg_private_network)
1797                 return 0;
1798
1799         if (strv_isempty(arg_network_interfaces))
1800                 return 0;
1801
1802         r = sd_rtnl_open(&rtnl, 0);
1803         if (r < 0)
1804                 return log_error_errno(r, "Failed to connect to netlink: %m");
1805
1806         udev = udev_new();
1807         if (!udev) {
1808                 log_error("Failed to connect to udev.");
1809                 return -ENOMEM;
1810         }
1811
1812         STRV_FOREACH(i, arg_network_interfaces) {
1813                 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1814                 int ifi;
1815
1816                 ifi = parse_interface(udev, *i);
1817                 if (ifi < 0)
1818                         return ifi;
1819
1820                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_SETLINK, ifi);
1821                 if (r < 0)
1822                         return log_error_errno(r, "Failed to allocate netlink message: %m");
1823
1824                 r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1825                 if (r < 0)
1826                         return log_error_errno(r, "Failed to append namespace PID to netlink message: %m");
1827
1828                 r = sd_rtnl_call(rtnl, m, 0, NULL);
1829                 if (r < 0)
1830                         return log_error_errno(r, "Failed to move interface %s to namespace: %m", *i);
1831         }
1832
1833         return 0;
1834 }
1835
1836 static int setup_macvlan(pid_t pid) {
1837         _cleanup_udev_unref_ struct udev *udev = NULL;
1838         _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL;
1839         char **i;
1840         int r;
1841
1842         if (!arg_private_network)
1843                 return 0;
1844
1845         if (strv_isempty(arg_network_macvlan))
1846                 return 0;
1847
1848         r = sd_rtnl_open(&rtnl, 0);
1849         if (r < 0)
1850                 return log_error_errno(r, "Failed to connect to netlink: %m");
1851
1852         udev = udev_new();
1853         if (!udev) {
1854                 log_error("Failed to connect to udev.");
1855                 return -ENOMEM;
1856         }
1857
1858         STRV_FOREACH(i, arg_network_macvlan) {
1859                 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
1860                 _cleanup_free_ char *n = NULL;
1861                 int ifi;
1862
1863                 ifi = parse_interface(udev, *i);
1864                 if (ifi < 0)
1865                         return ifi;
1866
1867                 r = sd_rtnl_message_new_link(rtnl, &m, RTM_NEWLINK, 0);
1868                 if (r < 0)
1869                         return log_error_errno(r, "Failed to allocate netlink message: %m");
1870
1871                 r = sd_rtnl_message_append_u32(m, IFLA_LINK, ifi);
1872                 if (r < 0)
1873                         return log_error_errno(r, "Failed to add netlink interface index: %m");
1874
1875                 n = strappend("mv-", *i);
1876                 if (!n)
1877                         return log_oom();
1878
1879                 strshorten(n, IFNAMSIZ-1);
1880
1881                 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, n);
1882                 if (r < 0)
1883                         return log_error_errno(r, "Failed to add netlink interface name: %m");
1884
1885                 r = sd_rtnl_message_append_u32(m, IFLA_NET_NS_PID, pid);
1886                 if (r < 0)
1887                         return log_error_errno(r, "Failed to add netlink namespace field: %m");
1888
1889                 r = sd_rtnl_message_open_container(m, IFLA_LINKINFO);
1890                 if (r < 0)
1891                         return log_error_errno(r, "Failed to open netlink container: %m");
1892
1893                 r = sd_rtnl_message_open_container_union(m, IFLA_INFO_DATA, "macvlan");
1894                 if (r < 0)
1895                         return log_error_errno(r, "Failed to open netlink container: %m");
1896
1897                 r = sd_rtnl_message_append_u32(m, IFLA_MACVLAN_MODE, MACVLAN_MODE_BRIDGE);
1898                 if (r < 0)
1899                         return log_error_errno(r, "Failed to append macvlan mode: %m");
1900
1901                 r = sd_rtnl_message_close_container(m);
1902                 if (r < 0)
1903                         return log_error_errno(r, "Failed to close netlink container: %m");
1904
1905                 r = sd_rtnl_message_close_container(m);
1906                 if (r < 0)
1907                         return log_error_errno(r, "Failed to close netlink container: %m");
1908
1909                 r = sd_rtnl_call(rtnl, m, 0, NULL);
1910                 if (r < 0)
1911                         return log_error_errno(r, "Failed to add new macvlan interfaces: %m");
1912         }
1913
1914         return 0;
1915 }
1916
1917 static int setup_seccomp(void) {
1918
1919 #ifdef HAVE_SECCOMP
1920         static const int blacklist[] = {
1921                 SCMP_SYS(kexec_load),
1922                 SCMP_SYS(open_by_handle_at),
1923                 SCMP_SYS(init_module),
1924                 SCMP_SYS(finit_module),
1925                 SCMP_SYS(delete_module),
1926                 SCMP_SYS(iopl),
1927                 SCMP_SYS(ioperm),
1928                 SCMP_SYS(swapon),
1929                 SCMP_SYS(swapoff),
1930         };
1931
1932         scmp_filter_ctx seccomp;
1933         unsigned i;
1934         int r;
1935
1936         seccomp = seccomp_init(SCMP_ACT_ALLOW);
1937         if (!seccomp)
1938                 return log_oom();
1939
1940         r = seccomp_add_secondary_archs(seccomp);
1941         if (r < 0) {
1942                 log_error_errno(r, "Failed to add secondary archs to seccomp filter: %m");
1943                 goto finish;
1944         }
1945
1946         for (i = 0; i < ELEMENTSOF(blacklist); i++) {
1947                 r = seccomp_rule_add(seccomp, SCMP_ACT_ERRNO(EPERM), blacklist[i], 0);
1948                 if (r == -EFAULT)
1949                         continue; /* unknown syscall */
1950                 if (r < 0) {
1951                         log_error_errno(r, "Failed to block syscall: %m");
1952                         goto finish;
1953                 }
1954         }
1955
1956         /*
1957            Audit is broken in containers, much of the userspace audit
1958            hookup will fail if running inside a container. We don't
1959            care and just turn off creation of audit sockets.
1960
1961            This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail
1962            with EAFNOSUPPORT which audit userspace uses as indication
1963            that audit is disabled in the kernel.
1964          */
1965
1966         r = seccomp_rule_add(
1967                         seccomp,
1968                         SCMP_ACT_ERRNO(EAFNOSUPPORT),
1969                         SCMP_SYS(socket),
1970                         2,
1971                         SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
1972                         SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
1973         if (r < 0) {
1974                 log_error_errno(r, "Failed to add audit seccomp rule: %m");
1975                 goto finish;
1976         }
1977
1978         r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1979         if (r < 0) {
1980                 log_error_errno(r, "Failed to unset NO_NEW_PRIVS: %m");
1981                 goto finish;
1982         }
1983
1984         r = seccomp_load(seccomp);
1985         if (r < 0)
1986                 log_error_errno(r, "Failed to install seccomp audit filter: %m");
1987
1988 finish:
1989         seccomp_release(seccomp);
1990         return r;
1991 #else
1992         return 0;
1993 #endif
1994
1995 }
1996
1997 static int setup_image(char **device_path, int *loop_nr) {
1998         struct loop_info64 info = {
1999                 .lo_flags = LO_FLAGS_AUTOCLEAR|LO_FLAGS_PARTSCAN
2000         };
2001         _cleanup_close_ int fd = -1, control = -1, loop = -1;
2002         _cleanup_free_ char* loopdev = NULL;
2003         struct stat st;
2004         int r, nr;
2005
2006         assert(device_path);
2007         assert(loop_nr);
2008
2009         fd = open(arg_image, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
2010         if (fd < 0)
2011                 return log_error_errno(errno, "Failed to open %s: %m", arg_image);
2012
2013         if (fstat(fd, &st) < 0)
2014                 return log_error_errno(errno, "Failed to stat %s: %m", arg_image);
2015
2016         if (S_ISBLK(st.st_mode)) {
2017                 char *p;
2018
2019                 p = strdup(arg_image);
2020                 if (!p)
2021                         return log_oom();
2022
2023                 *device_path = p;
2024
2025                 *loop_nr = -1;
2026
2027                 r = fd;
2028                 fd = -1;
2029
2030                 return r;
2031         }
2032
2033         if (!S_ISREG(st.st_mode)) {
2034                 log_error_errno(errno, "%s is not a regular file or block device: %m", arg_image);
2035                 return -EINVAL;
2036         }
2037
2038         control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2039         if (control < 0)
2040                 return log_error_errno(errno, "Failed to open /dev/loop-control: %m");
2041
2042         nr = ioctl(control, LOOP_CTL_GET_FREE);
2043         if (nr < 0)
2044                 return log_error_errno(errno, "Failed to allocate loop device: %m");
2045
2046         if (asprintf(&loopdev, "/dev/loop%i", nr) < 0)
2047                 return log_oom();
2048
2049         loop = open(loopdev, O_CLOEXEC|(arg_read_only ? O_RDONLY : O_RDWR)|O_NONBLOCK|O_NOCTTY);
2050         if (loop < 0)
2051                 return log_error_errno(errno, "Failed to open loop device %s: %m", loopdev);
2052
2053         if (ioctl(loop, LOOP_SET_FD, fd) < 0)
2054                 return log_error_errno(errno, "Failed to set loopback file descriptor on %s: %m", loopdev);
2055
2056         if (arg_read_only)
2057                 info.lo_flags |= LO_FLAGS_READ_ONLY;
2058
2059         if (ioctl(loop, LOOP_SET_STATUS64, &info) < 0)
2060                 return log_error_errno(errno, "Failed to set loopback settings on %s: %m", loopdev);
2061
2062         *device_path = loopdev;
2063         loopdev = NULL;
2064
2065         *loop_nr = nr;
2066
2067         r = loop;
2068         loop = -1;
2069
2070         return r;
2071 }
2072
2073 static int dissect_image(
2074                 int fd,
2075                 char **root_device, bool *root_device_rw,
2076                 char **home_device, bool *home_device_rw,
2077                 char **srv_device, bool *srv_device_rw,
2078                 bool *secondary) {
2079
2080 #ifdef HAVE_BLKID
2081         int home_nr = -1, srv_nr = -1;
2082 #ifdef GPT_ROOT_NATIVE
2083         int root_nr = -1;
2084 #endif
2085 #ifdef GPT_ROOT_SECONDARY
2086         int secondary_root_nr = -1;
2087 #endif
2088
2089         _cleanup_free_ char *home = NULL, *root = NULL, *secondary_root = NULL, *srv = NULL;
2090         _cleanup_udev_enumerate_unref_ struct udev_enumerate *e = NULL;
2091         _cleanup_udev_device_unref_ struct udev_device *d = NULL;
2092         _cleanup_blkid_free_probe_ blkid_probe b = NULL;
2093         _cleanup_udev_unref_ struct udev *udev = NULL;
2094         struct udev_list_entry *first, *item;
2095         bool home_rw = true, root_rw = true, secondary_root_rw = true, srv_rw = true;
2096         const char *pttype = NULL;
2097         blkid_partlist pl;
2098         struct stat st;
2099         int r;
2100
2101         assert(fd >= 0);
2102         assert(root_device);
2103         assert(home_device);
2104         assert(srv_device);
2105         assert(secondary);
2106
2107         b = blkid_new_probe();
2108         if (!b)
2109                 return log_oom();
2110
2111         errno = 0;
2112         r = blkid_probe_set_device(b, fd, 0, 0);
2113         if (r != 0) {
2114                 if (errno == 0)
2115                         return log_oom();
2116
2117                 log_error_errno(errno, "Failed to set device on blkid probe: %m");
2118                 return -errno;
2119         }
2120
2121         blkid_probe_enable_partitions(b, 1);
2122         blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
2123
2124         errno = 0;
2125         r = blkid_do_safeprobe(b);
2126         if (r == -2 || r == 1) {
2127                 log_error("Failed to identify any partition table on %s.\n"
2128                           "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2129                 return -EINVAL;
2130         } else if (r != 0) {
2131                 if (errno == 0)
2132                         errno = EIO;
2133                 log_error_errno(errno, "Failed to probe: %m");
2134                 return -errno;
2135         }
2136
2137         blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
2138         if (!streq_ptr(pttype, "gpt")) {
2139                 log_error("Image %s does not carry a GUID Partition Table.\n"
2140                           "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2141                 return -EINVAL;
2142         }
2143
2144         errno = 0;
2145         pl = blkid_probe_get_partitions(b);
2146         if (!pl) {
2147                 if (errno == 0)
2148                         return log_oom();
2149
2150                 log_error("Failed to list partitions of %s", arg_image);
2151                 return -errno;
2152         }
2153
2154         udev = udev_new();
2155         if (!udev)
2156                 return log_oom();
2157
2158         if (fstat(fd, &st) < 0)
2159                 return log_error_errno(errno, "Failed to stat block device: %m");
2160
2161         d = udev_device_new_from_devnum(udev, 'b', st.st_rdev);
2162         if (!d)
2163                 return log_oom();
2164
2165         e = udev_enumerate_new(udev);
2166         if (!e)
2167                 return log_oom();
2168
2169         r = udev_enumerate_add_match_parent(e, d);
2170         if (r < 0)
2171                 return log_oom();
2172
2173         r = udev_enumerate_scan_devices(e);
2174         if (r < 0)
2175                 return log_error_errno(r, "Failed to scan for partition devices of %s: %m", arg_image);
2176
2177         first = udev_enumerate_get_list_entry(e);
2178         udev_list_entry_foreach(item, first) {
2179                 _cleanup_udev_device_unref_ struct udev_device *q;
2180                 const char *stype, *node;
2181                 unsigned long long flags;
2182                 sd_id128_t type_id;
2183                 blkid_partition pp;
2184                 dev_t qn;
2185                 int nr;
2186
2187                 errno = 0;
2188                 q = udev_device_new_from_syspath(udev, udev_list_entry_get_name(item));
2189                 if (!q) {
2190                         if (!errno)
2191                                 errno = ENOMEM;
2192
2193                         log_error_errno(errno, "Failed to get partition device of %s: %m", arg_image);
2194                         return -errno;
2195                 }
2196
2197                 qn = udev_device_get_devnum(q);
2198                 if (major(qn) == 0)
2199                         continue;
2200
2201                 if (st.st_rdev == qn)
2202                         continue;
2203
2204                 node = udev_device_get_devnode(q);
2205                 if (!node)
2206                         continue;
2207
2208                 pp = blkid_partlist_devno_to_partition(pl, qn);
2209                 if (!pp)
2210                         continue;
2211
2212                 flags = blkid_partition_get_flags(pp);
2213                 if (flags & GPT_FLAG_NO_AUTO)
2214                         continue;
2215
2216                 nr = blkid_partition_get_partno(pp);
2217                 if (nr < 0)
2218                         continue;
2219
2220                 stype = blkid_partition_get_type_string(pp);
2221                 if (!stype)
2222                         continue;
2223
2224                 if (sd_id128_from_string(stype, &type_id) < 0)
2225                         continue;
2226
2227                 if (sd_id128_equal(type_id, GPT_HOME)) {
2228
2229                         if (home && nr >= home_nr)
2230                                 continue;
2231
2232                         home_nr = nr;
2233                         home_rw = !(flags & GPT_FLAG_READ_ONLY);
2234
2235                         free(home);
2236                         home = strdup(node);
2237                         if (!home)
2238                                 return log_oom();
2239                 } else if (sd_id128_equal(type_id, GPT_SRV)) {
2240
2241                         if (srv && nr >= srv_nr)
2242                                 continue;
2243
2244                         srv_nr = nr;
2245                         srv_rw = !(flags & GPT_FLAG_READ_ONLY);
2246
2247                         free(srv);
2248                         srv = strdup(node);
2249                         if (!srv)
2250                                 return log_oom();
2251                 }
2252 #ifdef GPT_ROOT_NATIVE
2253                 else if (sd_id128_equal(type_id, GPT_ROOT_NATIVE)) {
2254
2255                         if (root && nr >= root_nr)
2256                                 continue;
2257
2258                         root_nr = nr;
2259                         root_rw = !(flags & GPT_FLAG_READ_ONLY);
2260
2261                         free(root);
2262                         root = strdup(node);
2263                         if (!root)
2264                                 return log_oom();
2265                 }
2266 #endif
2267 #ifdef GPT_ROOT_SECONDARY
2268                 else if (sd_id128_equal(type_id, GPT_ROOT_SECONDARY)) {
2269
2270                         if (secondary_root && nr >= secondary_root_nr)
2271                                 continue;
2272
2273                         secondary_root_nr = nr;
2274                         secondary_root_rw = !(flags & GPT_FLAG_READ_ONLY);
2275
2276
2277                         free(secondary_root);
2278                         secondary_root = strdup(node);
2279                         if (!secondary_root)
2280                                 return log_oom();
2281                 }
2282 #endif
2283         }
2284
2285         if (!root && !secondary_root) {
2286                 log_error("Failed to identify root partition in disk image %s.\n"
2287                           "Note that the disk image needs to follow http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/ to be supported by systemd-nspawn.", arg_image);
2288                 return -EINVAL;
2289         }
2290
2291         if (root) {
2292                 *root_device = root;
2293                 root = NULL;
2294
2295                 *root_device_rw = root_rw;
2296                 *secondary = false;
2297         } else if (secondary_root) {
2298                 *root_device = secondary_root;
2299                 secondary_root = NULL;
2300
2301                 *root_device_rw = secondary_root_rw;
2302                 *secondary = true;
2303         }
2304
2305         if (home) {
2306                 *home_device = home;
2307                 home = NULL;
2308
2309                 *home_device_rw = home_rw;
2310         }
2311
2312         if (srv) {
2313                 *srv_device = srv;
2314                 srv = NULL;
2315
2316                 *srv_device_rw = srv_rw;
2317         }
2318
2319         return 0;
2320 #else
2321         log_error("--image= is not supported, compiled without blkid support.");
2322         return -ENOTSUP;
2323 #endif
2324 }
2325
2326 static int mount_device(const char *what, const char *where, const char *directory, bool rw) {
2327 #ifdef HAVE_BLKID
2328         _cleanup_blkid_free_probe_ blkid_probe b = NULL;
2329         const char *fstype, *p;
2330         int r;
2331
2332         assert(what);
2333         assert(where);
2334
2335         if (arg_read_only)
2336                 rw = false;
2337
2338         if (directory)
2339                 p = strappenda(where, directory);
2340         else
2341                 p = where;
2342
2343         errno = 0;
2344         b = blkid_new_probe_from_filename(what);
2345         if (!b) {
2346                 if (errno == 0)
2347                         return log_oom();
2348                 log_error_errno(errno, "Failed to allocate prober for %s: %m", what);
2349                 return -errno;
2350         }
2351
2352         blkid_probe_enable_superblocks(b, 1);
2353         blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
2354
2355         errno = 0;
2356         r = blkid_do_safeprobe(b);
2357         if (r == -1 || r == 1) {
2358                 log_error("Cannot determine file system type of %s", what);
2359                 return -EINVAL;
2360         } else if (r != 0) {
2361                 if (errno == 0)
2362                         errno = EIO;
2363                 log_error_errno(errno, "Failed to probe %s: %m", what);
2364                 return -errno;
2365         }
2366
2367         errno = 0;
2368         if (blkid_probe_lookup_value(b, "TYPE", &fstype, NULL) < 0) {
2369                 if (errno == 0)
2370                         errno = EINVAL;
2371                 log_error("Failed to determine file system type of %s", what);
2372                 return -errno;
2373         }
2374
2375         if (streq(fstype, "crypto_LUKS")) {
2376                 log_error("nspawn currently does not support LUKS disk images.");
2377                 return -ENOTSUP;
2378         }
2379
2380         if (mount(what, p, fstype, MS_NODEV|(rw ? 0 : MS_RDONLY), NULL) < 0)
2381                 return log_error_errno(errno, "Failed to mount %s: %m", what);
2382
2383         return 0;
2384 #else
2385         log_error("--image= is not supported, compiled without blkid support.");
2386         return -ENOTSUP;
2387 #endif
2388 }
2389
2390 static int mount_devices(
2391                 const char *where,
2392                 const char *root_device, bool root_device_rw,
2393                 const char *home_device, bool home_device_rw,
2394                 const char *srv_device, bool srv_device_rw) {
2395         int r;
2396
2397         assert(where);
2398
2399         if (root_device) {
2400                 r = mount_device(root_device, arg_directory, NULL, root_device_rw);
2401                 if (r < 0)
2402                         return log_error_errno(r, "Failed to mount root directory: %m");
2403         }
2404
2405         if (home_device) {
2406                 r = mount_device(home_device, arg_directory, "/home", home_device_rw);
2407                 if (r < 0)
2408                         return log_error_errno(r, "Failed to mount home directory: %m");
2409         }
2410
2411         if (srv_device) {
2412                 r = mount_device(srv_device, arg_directory, "/srv", srv_device_rw);
2413                 if (r < 0)
2414                         return log_error_errno(r, "Failed to mount server data directory: %m");
2415         }
2416
2417         return 0;
2418 }
2419
2420 static void loop_remove(int nr, int *image_fd) {
2421         _cleanup_close_ int control = -1;
2422         int r;
2423
2424         if (nr < 0)
2425                 return;
2426
2427         if (image_fd && *image_fd >= 0) {
2428                 r = ioctl(*image_fd, LOOP_CLR_FD);
2429                 if (r < 0)
2430                         log_warning_errno(errno, "Failed to close loop image: %m");
2431                 *image_fd = safe_close(*image_fd);
2432         }
2433
2434         control = open("/dev/loop-control", O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2435         if (control < 0) {
2436                 log_warning_errno(errno, "Failed to open /dev/loop-control: %m");
2437                 return;
2438         }
2439
2440         r = ioctl(control, LOOP_CTL_REMOVE, nr);
2441         if (r < 0)
2442                 log_warning_errno(errno, "Failed to remove loop %d: %m", nr);
2443 }
2444
2445 static int spawn_getent(const char *database, const char *key, pid_t *rpid) {
2446         int pipe_fds[2];
2447         pid_t pid;
2448
2449         assert(database);
2450         assert(key);
2451         assert(rpid);
2452
2453         if (pipe2(pipe_fds, O_CLOEXEC) < 0)
2454                 return log_error_errno(errno, "Failed to allocate pipe: %m");
2455
2456         pid = fork();
2457         if (pid < 0)
2458                 return log_error_errno(errno, "Failed to fork getent child: %m");
2459         else if (pid == 0) {
2460                 int nullfd;
2461                 char *empty_env = NULL;
2462
2463                 if (dup3(pipe_fds[1], STDOUT_FILENO, 0) < 0)
2464                         _exit(EXIT_FAILURE);
2465
2466                 if (pipe_fds[0] > 2)
2467                         safe_close(pipe_fds[0]);
2468                 if (pipe_fds[1] > 2)
2469                         safe_close(pipe_fds[1]);
2470
2471                 nullfd = open("/dev/null", O_RDWR);
2472                 if (nullfd < 0)
2473                         _exit(EXIT_FAILURE);
2474
2475                 if (dup3(nullfd, STDIN_FILENO, 0) < 0)
2476                         _exit(EXIT_FAILURE);
2477
2478                 if (dup3(nullfd, STDERR_FILENO, 0) < 0)
2479                         _exit(EXIT_FAILURE);
2480
2481                 if (nullfd > 2)
2482                         safe_close(nullfd);
2483
2484                 reset_all_signal_handlers();
2485                 close_all_fds(NULL, 0);
2486
2487                 execle("/usr/bin/getent", "getent", database, key, NULL, &empty_env);
2488                 execle("/bin/getent", "getent", database, key, NULL, &empty_env);
2489                 _exit(EXIT_FAILURE);
2490         }
2491
2492         pipe_fds[1] = safe_close(pipe_fds[1]);
2493
2494         *rpid = pid;
2495
2496         return pipe_fds[0];
2497 }
2498
2499 static int change_uid_gid(char **_home) {
2500         char line[LINE_MAX], *x, *u, *g, *h;
2501         const char *word, *state;
2502         _cleanup_free_ uid_t *uids = NULL;
2503         _cleanup_free_ char *home = NULL;
2504         _cleanup_fclose_ FILE *f = NULL;
2505         _cleanup_close_ int fd = -1;
2506         unsigned n_uids = 0;
2507         size_t sz = 0, l;
2508         uid_t uid;
2509         gid_t gid;
2510         pid_t pid;
2511         int r;
2512
2513         assert(_home);
2514
2515         if (!arg_user || streq(arg_user, "root") || streq(arg_user, "0")) {
2516                 /* Reset everything fully to 0, just in case */
2517
2518                 if (setgroups(0, NULL) < 0)
2519                         return log_error_errno(errno, "setgroups() failed: %m");
2520
2521                 if (setresgid(0, 0, 0) < 0)
2522                         return log_error_errno(errno, "setregid() failed: %m");
2523
2524                 if (setresuid(0, 0, 0) < 0)
2525                         return log_error_errno(errno, "setreuid() failed: %m");
2526
2527                 *_home = NULL;
2528                 return 0;
2529         }
2530
2531         /* First, get user credentials */
2532         fd = spawn_getent("passwd", arg_user, &pid);
2533         if (fd < 0)
2534                 return fd;
2535
2536         f = fdopen(fd, "r");
2537         if (!f)
2538                 return log_oom();
2539         fd = -1;
2540
2541         if (!fgets(line, sizeof(line), f)) {
2542
2543                 if (!ferror(f)) {
2544                         log_error("Failed to resolve user %s.", arg_user);
2545                         return -ESRCH;
2546                 }
2547
2548                 log_error_errno(errno, "Failed to read from getent: %m");
2549                 return -errno;
2550         }
2551
2552         truncate_nl(line);
2553
2554         wait_for_terminate_and_warn("getent passwd", pid, true);
2555
2556         x = strchr(line, ':');
2557         if (!x) {
2558                 log_error("/etc/passwd entry has invalid user field.");
2559                 return -EIO;
2560         }
2561
2562         u = strchr(x+1, ':');
2563         if (!u) {
2564                 log_error("/etc/passwd entry has invalid password field.");
2565                 return -EIO;
2566         }
2567
2568         u++;
2569         g = strchr(u, ':');
2570         if (!g) {
2571                 log_error("/etc/passwd entry has invalid UID field.");
2572                 return -EIO;
2573         }
2574
2575         *g = 0;
2576         g++;
2577         x = strchr(g, ':');
2578         if (!x) {
2579                 log_error("/etc/passwd entry has invalid GID field.");
2580                 return -EIO;
2581         }
2582
2583         *x = 0;
2584         h = strchr(x+1, ':');
2585         if (!h) {
2586                 log_error("/etc/passwd entry has invalid GECOS field.");
2587                 return -EIO;
2588         }
2589
2590         h++;
2591         x = strchr(h, ':');
2592         if (!x) {
2593                 log_error("/etc/passwd entry has invalid home directory field.");
2594                 return -EIO;
2595         }
2596
2597         *x = 0;
2598
2599         r = parse_uid(u, &uid);
2600         if (r < 0) {
2601                 log_error("Failed to parse UID of user.");
2602                 return -EIO;
2603         }
2604
2605         r = parse_gid(g, &gid);
2606         if (r < 0) {
2607                 log_error("Failed to parse GID of user.");
2608                 return -EIO;
2609         }
2610
2611         home = strdup(h);
2612         if (!home)
2613                 return log_oom();
2614
2615         /* Second, get group memberships */
2616         fd = spawn_getent("initgroups", arg_user, &pid);
2617         if (fd < 0)
2618                 return fd;
2619
2620         fclose(f);
2621         f = fdopen(fd, "r");
2622         if (!f)
2623                 return log_oom();
2624         fd = -1;
2625
2626         if (!fgets(line, sizeof(line), f)) {
2627                 if (!ferror(f)) {
2628                         log_error("Failed to resolve user %s.", arg_user);
2629                         return -ESRCH;
2630                 }
2631
2632                 log_error_errno(errno, "Failed to read from getent: %m");
2633                 return -errno;
2634         }
2635
2636         truncate_nl(line);
2637
2638         wait_for_terminate_and_warn("getent initgroups", pid, true);
2639
2640         /* Skip over the username and subsequent separator whitespace */
2641         x = line;
2642         x += strcspn(x, WHITESPACE);
2643         x += strspn(x, WHITESPACE);
2644
2645         FOREACH_WORD(word, l, x, state) {
2646                 char c[l+1];
2647
2648                 memcpy(c, word, l);
2649                 c[l] = 0;
2650
2651                 if (!GREEDY_REALLOC(uids, sz, n_uids+1))
2652                         return log_oom();
2653
2654                 r = parse_uid(c, &uids[n_uids++]);
2655                 if (r < 0) {
2656                         log_error("Failed to parse group data from getent.");
2657                         return -EIO;
2658                 }
2659         }
2660
2661         r = mkdir_parents(home, 0775);
2662         if (r < 0)
2663                 return log_error_errno(r, "Failed to make home root directory: %m");
2664
2665         r = mkdir_safe(home, 0755, uid, gid);
2666         if (r < 0 && r != -EEXIST)
2667                 return log_error_errno(r, "Failed to make home directory: %m");
2668
2669         fchown(STDIN_FILENO, uid, gid);
2670         fchown(STDOUT_FILENO, uid, gid);
2671         fchown(STDERR_FILENO, uid, gid);
2672
2673         if (setgroups(n_uids, uids) < 0)
2674                 return log_error_errno(errno, "Failed to set auxiliary groups: %m");
2675
2676         if (setresgid(gid, gid, gid) < 0)
2677                 return log_error_errno(errno, "setregid() failed: %m");
2678
2679         if (setresuid(uid, uid, uid) < 0)
2680                 return log_error_errno(errno, "setreuid() failed: %m");
2681
2682         if (_home) {
2683                 *_home = home;
2684                 home = NULL;
2685         }
2686
2687         return 0;
2688 }
2689
2690 /*
2691  * Return values:
2692  * < 0 : wait_for_terminate() failed to get the state of the
2693  *       container, the container was terminated by a signal, or
2694  *       failed for an unknown reason.  No change is made to the
2695  *       container argument.
2696  * > 0 : The program executed in the container terminated with an
2697  *       error.  The exit code of the program executed in the
2698  *       container is returned.  The container argument has been set
2699  *       to CONTAINER_TERMINATED.
2700  *   0 : The container is being rebooted, has been shut down or exited
2701  *       successfully.  The container argument has been set to either
2702  *       CONTAINER_TERMINATED or CONTAINER_REBOOTED.
2703  *
2704  * That is, success is indicated by a return value of zero, and an
2705  * error is indicated by a non-zero value.
2706  */
2707 static int wait_for_container(pid_t pid, ContainerStatus *container) {
2708         siginfo_t status;
2709         int r;
2710
2711         r = wait_for_terminate(pid, &status);
2712         if (r < 0)
2713                 return log_warning_errno(r, "Failed to wait for container: %m");
2714
2715         switch (status.si_code) {
2716
2717         case CLD_EXITED:
2718                 if (status.si_status == 0) {
2719                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s exited successfully.", arg_machine);
2720
2721                 } else
2722                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s failed with error code %i.", arg_machine, status.si_status);
2723
2724                 *container = CONTAINER_TERMINATED;
2725                 return status.si_status;
2726
2727         case CLD_KILLED:
2728                 if (status.si_status == SIGINT) {
2729
2730                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s has been shut down.", arg_machine);
2731                         *container = CONTAINER_TERMINATED;
2732                         return 0;
2733
2734                 } else if (status.si_status == SIGHUP) {
2735
2736                         log_full(arg_quiet ? LOG_DEBUG : LOG_INFO, "Container %s is being rebooted.", arg_machine);
2737                         *container = CONTAINER_REBOOTED;
2738                         return 0;
2739                 }
2740
2741                 /* CLD_KILLED fallthrough */
2742
2743         case CLD_DUMPED:
2744                 log_error("Container %s terminated by signal %s.", arg_machine, signal_to_string(status.si_status));
2745                 return -EIO;
2746
2747         default:
2748                 log_error("Container %s failed due to unknown reason.", arg_machine);
2749                 return -EIO;
2750         }
2751
2752         return r;
2753 }
2754
2755 static void nop_handler(int sig) {}
2756
2757 static int on_orderly_shutdown(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
2758         pid_t pid;
2759
2760         pid = PTR_TO_UINT32(userdata);
2761         if (pid > 0) {
2762                 if (kill(pid, SIGRTMIN+3) >= 0) {
2763                         log_info("Trying to halt container. Send SIGTERM again to trigger immediate termination.");
2764                         sd_event_source_set_userdata(s, NULL);
2765                         return 0;
2766                 }
2767         }
2768
2769         sd_event_exit(sd_event_source_get_event(s), 0);
2770         return 0;
2771 }
2772
2773 int main(int argc, char *argv[]) {
2774
2775         _cleanup_free_ char *device_path = NULL, *root_device = NULL, *home_device = NULL, *srv_device = NULL;
2776         bool root_device_rw = true, home_device_rw = true, srv_device_rw = true;
2777         _cleanup_close_ int master = -1, image_fd = -1;
2778         _cleanup_close_pair_ int kmsg_socket_pair[2] = { -1, -1 };
2779         _cleanup_fdset_free_ FDSet *fds = NULL;
2780         int r = EXIT_FAILURE, k, n_fd_passed, loop_nr = -1;
2781         const char *console = NULL;
2782         char veth_name[IFNAMSIZ];
2783         bool secondary = false;
2784         sigset_t mask, mask_chld;
2785         pid_t pid = 0;
2786
2787         log_parse_environment();
2788         log_open();
2789
2790         k = parse_argv(argc, argv);
2791         if (k < 0)
2792                 goto finish;
2793         else if (k == 0) {
2794                 r = EXIT_SUCCESS;
2795                 goto finish;
2796         }
2797
2798         if (!arg_image) {
2799                 if (arg_directory) {
2800                         char *p;
2801
2802                         p = path_make_absolute_cwd(arg_directory);
2803                         free(arg_directory);
2804                         arg_directory = p;
2805                 } else
2806                         arg_directory = get_current_dir_name();
2807
2808                 if (!arg_directory) {
2809                         log_error("Failed to determine path, please use -D.");
2810                         goto finish;
2811                 }
2812                 path_kill_slashes(arg_directory);
2813         }
2814
2815         if (!arg_machine) {
2816                 arg_machine = strdup(basename(arg_image ? arg_image : arg_directory));
2817                 if (!arg_machine) {
2818                         log_oom();
2819                         goto finish;
2820                 }
2821
2822                 hostname_cleanup(arg_machine, false);
2823                 if (isempty(arg_machine)) {
2824                         log_error("Failed to determine machine name automatically, please use -M.");
2825                         goto finish;
2826                 }
2827         }
2828
2829         if (geteuid() != 0) {
2830                 log_error("Need to be root.");
2831                 goto finish;
2832         }
2833
2834         if (sd_booted() <= 0) {
2835                 log_error("Not running on a systemd system.");
2836                 goto finish;
2837         }
2838
2839         log_close();
2840         n_fd_passed = sd_listen_fds(false);
2841         if (n_fd_passed > 0) {
2842                 k = fdset_new_listen_fds(&fds, false);
2843                 if (k < 0) {
2844                         log_error_errno(k, "Failed to collect file descriptors: %m");
2845                         goto finish;
2846                 }
2847         }
2848         fdset_close_others(fds);
2849         log_open();
2850
2851         if (arg_directory) {
2852                 if (path_equal(arg_directory, "/")) {
2853                         log_error("Spawning container on root directory not supported.");
2854                         goto finish;
2855                 }
2856
2857                 if (arg_boot) {
2858                         if (path_is_os_tree(arg_directory) <= 0) {
2859                                 log_error("Directory %s doesn't look like an OS root directory (os-release file is missing). Refusing.", arg_directory);
2860                                 goto finish;
2861                         }
2862                 } else {
2863                         const char *p;
2864
2865                         p = strappenda(arg_directory,
2866                                        argc > optind && path_is_absolute(argv[optind]) ? argv[optind] : "/usr/bin/");
2867                         if (access(p, F_OK) < 0) {
2868                                 log_error("Directory %s lacks the binary to execute or doesn't look like a binary tree. Refusing.", arg_directory);
2869                                 goto finish;
2870
2871                         }
2872                 }
2873         } else {
2874                 char template[] = "/tmp/nspawn-root-XXXXXX";
2875
2876                 if (!mkdtemp(template)) {
2877                         log_error_errno(errno, "Failed to create temporary directory: %m");
2878                         r = -errno;
2879                         goto finish;
2880                 }
2881
2882                 arg_directory = strdup(template);
2883                 if (!arg_directory) {
2884                         r = log_oom();
2885                         goto finish;
2886                 }
2887
2888                 image_fd = setup_image(&device_path, &loop_nr);
2889                 if (image_fd < 0) {
2890                         r = image_fd;
2891                         goto finish;
2892                 }
2893
2894                 r = dissect_image(image_fd,
2895                                   &root_device, &root_device_rw,
2896                                   &home_device, &home_device_rw,
2897                                   &srv_device, &srv_device_rw,
2898                                   &secondary);
2899                 if (r < 0)
2900                         goto finish;
2901         }
2902
2903         master = posix_openpt(O_RDWR|O_NOCTTY|O_CLOEXEC|O_NDELAY);
2904         if (master < 0) {
2905                 log_error_errno(errno, "Failed to acquire pseudo tty: %m");
2906                 goto finish;
2907         }
2908
2909         console = ptsname(master);
2910         if (!console) {
2911                 log_error_errno(errno, "Failed to determine tty name: %m");
2912                 goto finish;
2913         }
2914
2915         if (!arg_quiet)
2916                 log_info("Spawning container %s on %s.\nPress ^] three times within 1s to kill container.",
2917                          arg_machine, arg_image ? arg_image : arg_directory);
2918
2919         if (unlockpt(master) < 0) {
2920                 log_error_errno(errno, "Failed to unlock tty: %m");
2921                 goto finish;
2922         }
2923
2924         if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0, kmsg_socket_pair) < 0) {
2925                 log_error_errno(errno, "Failed to create kmsg socket pair: %m");
2926                 goto finish;
2927         }
2928
2929         sd_notify(false,
2930                   "READY=1\n"
2931                   "STATUS=Container running.");
2932
2933         assert_se(sigemptyset(&mask) == 0);
2934         sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
2935         assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
2936
2937         assert_se(sigemptyset(&mask_chld) == 0);
2938         assert_se(sigaddset(&mask_chld, SIGCHLD) == 0);
2939
2940         for (;;) {
2941                 ContainerStatus container_status;
2942                 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
2943                 struct sigaction sa = {
2944                         .sa_handler = nop_handler,
2945                         .sa_flags = SA_NOCLDSTOP,
2946                 };
2947
2948                 r = barrier_create(&barrier);
2949                 if (r < 0) {
2950                         log_error_errno(r, "Cannot initialize IPC barrier: %m");
2951                         goto finish;
2952                 }
2953
2954                 /* Child can be killed before execv(), so handle SIGCHLD
2955                  * in order to interrupt parent's blocking calls and
2956                  * give it a chance to call wait() and terminate. */
2957                 r = sigprocmask(SIG_UNBLOCK, &mask_chld, NULL);
2958                 if (r < 0) {
2959                         log_error_errno(errno, "Failed to change the signal mask: %m");
2960                         goto finish;
2961                 }
2962
2963                 r = sigaction(SIGCHLD, &sa, NULL);
2964                 if (r < 0) {
2965                         log_error_errno(errno, "Failed to install SIGCHLD handler: %m");
2966                         goto finish;
2967                 }
2968
2969                 pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWNS|
2970                                           (arg_share_system ? 0 : CLONE_NEWIPC|CLONE_NEWPID|CLONE_NEWUTS)|
2971                                           (arg_private_network ? CLONE_NEWNET : 0), NULL);
2972                 if (pid < 0) {
2973                         if (errno == EINVAL)
2974                                 log_error_errno(errno, "clone() failed, do you have namespace support enabled in your kernel? (You need UTS, IPC, PID and NET namespacing built in): %m");
2975                         else
2976                                 log_error_errno(errno, "clone() failed: %m");
2977
2978                         r = pid;
2979                         goto finish;
2980                 }
2981
2982                 if (pid == 0) {
2983                         /* child */
2984                         _cleanup_free_ char *home = NULL;
2985                         unsigned n_env = 2;
2986                         const char *envp[] = {
2987                                 "PATH=" DEFAULT_PATH_SPLIT_USR,
2988                                 "container=systemd-nspawn", /* LXC sets container=lxc, so follow the scheme here */
2989                                 NULL, /* TERM */
2990                                 NULL, /* HOME */
2991                                 NULL, /* USER */
2992                                 NULL, /* LOGNAME */
2993                                 NULL, /* container_uuid */
2994                                 NULL, /* LISTEN_FDS */
2995                                 NULL, /* LISTEN_PID */
2996                                 NULL
2997                         };
2998                         char **env_use;
2999
3000                         barrier_set_role(&barrier, BARRIER_CHILD);
3001
3002                         envp[n_env] = strv_find_prefix(environ, "TERM=");
3003                         if (envp[n_env])
3004                                 n_env ++;
3005
3006                         master = safe_close(master);
3007
3008                         close_nointr(STDIN_FILENO);
3009                         close_nointr(STDOUT_FILENO);
3010                         close_nointr(STDERR_FILENO);
3011
3012                         kmsg_socket_pair[0] = safe_close(kmsg_socket_pair[0]);
3013
3014                         reset_all_signal_handlers();
3015                         reset_signal_mask();
3016
3017                         k = open_terminal(console, O_RDWR);
3018                         if (k != STDIN_FILENO) {
3019                                 if (k >= 0) {
3020                                         safe_close(k);
3021                                         k = -EINVAL;
3022                                 }
3023
3024                                 log_error_errno(k, "Failed to open console: %m");
3025                                 _exit(EXIT_FAILURE);
3026                         }
3027
3028                         if (dup2(STDIN_FILENO, STDOUT_FILENO) != STDOUT_FILENO ||
3029                             dup2(STDIN_FILENO, STDERR_FILENO) != STDERR_FILENO) {
3030                                 log_error_errno(errno, "Failed to duplicate console: %m");
3031                                 _exit(EXIT_FAILURE);
3032                         }
3033
3034                         if (setsid() < 0) {
3035                                 log_error_errno(errno, "setsid() failed: %m");
3036                                 _exit(EXIT_FAILURE);
3037                         }
3038
3039                         if (reset_audit_loginuid() < 0)
3040                                 _exit(EXIT_FAILURE);
3041
3042                         if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0) {
3043                                 log_error_errno(errno, "PR_SET_PDEATHSIG failed: %m");
3044                                 _exit(EXIT_FAILURE);
3045                         }
3046
3047                         /* Mark everything as slave, so that we still
3048                          * receive mounts from the real root, but don't
3049                          * propagate mounts to the real root. */
3050                         if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) {
3051                                 log_error_errno(errno, "MS_SLAVE|MS_REC failed: %m");
3052                                 _exit(EXIT_FAILURE);
3053                         }
3054
3055                         if (mount_devices(arg_directory,
3056                                           root_device, root_device_rw,
3057                                           home_device, home_device_rw,
3058                                           srv_device, srv_device_rw) < 0)
3059                                 _exit(EXIT_FAILURE);
3060
3061                         /* Turn directory into bind mount */
3062                         if (mount(arg_directory, arg_directory, "bind", MS_BIND|MS_REC, NULL) < 0) {
3063                                 log_error_errno(errno, "Failed to make bind mount: %m");
3064                                 _exit(EXIT_FAILURE);
3065                         }
3066
3067                         r = setup_volatile(arg_directory);
3068                         if (r < 0)
3069                                 _exit(EXIT_FAILURE);
3070
3071                         if (setup_volatile_state(arg_directory) < 0)
3072                                 _exit(EXIT_FAILURE);
3073
3074                         r = base_filesystem_create(arg_directory);
3075                         if (r < 0)
3076                                 _exit(EXIT_FAILURE);
3077
3078                         if (arg_read_only) {
3079                                 k = bind_remount_recursive(arg_directory, true);
3080                                 if (k < 0) {
3081                                         log_error_errno(k, "Failed to make tree read-only: %m");
3082                                         _exit(EXIT_FAILURE);
3083                                 }
3084                         }
3085
3086                         if (mount_all(arg_directory) < 0)
3087                                 _exit(EXIT_FAILURE);
3088
3089                         if (copy_devnodes(arg_directory) < 0)
3090                                 _exit(EXIT_FAILURE);
3091
3092                         if (setup_ptmx(arg_directory) < 0)
3093                                 _exit(EXIT_FAILURE);
3094
3095                         dev_setup(arg_directory);
3096
3097                         if (setup_seccomp() < 0)
3098                                 _exit(EXIT_FAILURE);
3099
3100                         if (setup_dev_console(arg_directory, console) < 0)
3101                                 _exit(EXIT_FAILURE);
3102
3103                         if (setup_kmsg(arg_directory, kmsg_socket_pair[1]) < 0)
3104                                 _exit(EXIT_FAILURE);
3105
3106                         kmsg_socket_pair[1] = safe_close(kmsg_socket_pair[1]);
3107
3108                         if (setup_boot_id(arg_directory) < 0)
3109                                 _exit(EXIT_FAILURE);
3110
3111                         if (setup_timezone(arg_directory) < 0)
3112                                 _exit(EXIT_FAILURE);
3113
3114                         if (setup_resolv_conf(arg_directory) < 0)
3115                                 _exit(EXIT_FAILURE);
3116
3117                         if (setup_journal(arg_directory) < 0)
3118                                 _exit(EXIT_FAILURE);
3119
3120                         if (mount_binds(arg_directory, arg_bind, false) < 0)
3121                                 _exit(EXIT_FAILURE);
3122
3123                         if (mount_binds(arg_directory, arg_bind_ro, true) < 0)
3124                                 _exit(EXIT_FAILURE);
3125
3126                         if (mount_tmpfs(arg_directory) < 0)
3127                                 _exit(EXIT_FAILURE);
3128
3129                         /* Tell the parent that we are ready, and that
3130                          * it can cgroupify us to that we lack access
3131                          * to certain devices and resources. */
3132                         (void)barrier_place(&barrier);
3133
3134                         if (chdir(arg_directory) < 0) {
3135                                 log_error_errno(errno, "chdir(%s) failed: %m", arg_directory);
3136                                 _exit(EXIT_FAILURE);
3137                         }
3138
3139                         if (mount(arg_directory, "/", NULL, MS_MOVE, NULL) < 0) {
3140                                 log_error_errno(errno, "mount(MS_MOVE) failed: %m");
3141                                 _exit(EXIT_FAILURE);
3142                         }
3143
3144                         if (chroot(".") < 0) {
3145                                 log_error_errno(errno, "chroot() failed: %m");
3146                                 _exit(EXIT_FAILURE);
3147                         }
3148
3149                         if (chdir("/") < 0) {
3150                                 log_error_errno(errno, "chdir() failed: %m");
3151                                 _exit(EXIT_FAILURE);
3152                         }
3153
3154                         umask(0022);
3155
3156                         if (arg_private_network)
3157                                 loopback_setup();
3158
3159                         if (drop_capabilities() < 0) {
3160                                 log_error_errno(errno, "drop_capabilities() failed: %m");
3161                                 _exit(EXIT_FAILURE);
3162                         }
3163
3164                         r = change_uid_gid(&home);
3165                         if (r < 0)
3166                                 _exit(EXIT_FAILURE);
3167
3168                         if ((asprintf((char**)(envp + n_env++), "HOME=%s", home ? home: "/root") < 0) ||
3169                             (asprintf((char**)(envp + n_env++), "USER=%s", arg_user ? arg_user : "root") < 0) ||
3170                             (asprintf((char**)(envp + n_env++), "LOGNAME=%s", arg_user ? arg_user : "root") < 0)) {
3171                                 log_oom();
3172                                 _exit(EXIT_FAILURE);
3173                         }
3174
3175                         if (!sd_id128_equal(arg_uuid, SD_ID128_NULL)) {
3176                                 char as_uuid[37];
3177
3178                                 if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_format_as_uuid(arg_uuid, as_uuid)) < 0) {
3179                                         log_oom();
3180                                         _exit(EXIT_FAILURE);
3181                                 }
3182                         }
3183
3184                         if (fdset_size(fds) > 0) {
3185                                 k = fdset_cloexec(fds, false);
3186                                 if (k < 0) {
3187                                         log_error("Failed to unset O_CLOEXEC for file descriptors.");
3188                                         _exit(EXIT_FAILURE);
3189                                 }
3190
3191                                 if ((asprintf((char **)(envp + n_env++), "LISTEN_FDS=%u", n_fd_passed) < 0) ||
3192                                     (asprintf((char **)(envp + n_env++), "LISTEN_PID=1") < 0)) {
3193                                         log_oom();
3194                                         _exit(EXIT_FAILURE);
3195                                 }
3196                         }
3197
3198                         setup_hostname();
3199
3200                         if (arg_personality != 0xffffffffLU) {
3201                                 if (personality(arg_personality) < 0) {
3202                                         log_error_errno(errno, "personality() failed: %m");
3203                                         _exit(EXIT_FAILURE);
3204                                 }
3205                         } else if (secondary) {
3206                                 if (personality(PER_LINUX32) < 0) {
3207                                         log_error_errno(errno, "personality() failed: %m");
3208                                         _exit(EXIT_FAILURE);
3209                                 }
3210                         }
3211
3212 #ifdef HAVE_SELINUX
3213                         if (arg_selinux_context)
3214                                 if (setexeccon((security_context_t) arg_selinux_context) < 0) {
3215                                         log_error_errno(errno, "setexeccon(\"%s\") failed: %m", arg_selinux_context);
3216                                         _exit(EXIT_FAILURE);
3217                                 }
3218 #endif
3219
3220                         if (!strv_isempty(arg_setenv)) {
3221                                 char **n;
3222
3223                                 n = strv_env_merge(2, envp, arg_setenv);
3224                                 if (!n) {
3225                                         log_oom();
3226                                         _exit(EXIT_FAILURE);
3227                                 }
3228
3229                                 env_use = n;
3230                         } else
3231                                 env_use = (char**) envp;
3232
3233                         /* Wait until the parent is ready with the setup, too... */
3234                         if (!barrier_place_and_sync(&barrier))
3235                                 _exit(EXIT_FAILURE);
3236
3237                         if (arg_boot) {
3238                                 char **a;
3239                                 size_t l;
3240
3241                                 /* Automatically search for the init system */
3242
3243                                 l = 1 + argc - optind;
3244                                 a = newa(char*, l + 1);
3245                                 memcpy(a + 1, argv + optind, l * sizeof(char*));
3246
3247                                 a[0] = (char*) "/usr/lib/systemd/systemd";
3248                                 execve(a[0], a, env_use);
3249
3250                                 a[0] = (char*) "/lib/systemd/systemd";
3251                                 execve(a[0], a, env_use);
3252
3253                                 a[0] = (char*) "/sbin/init";
3254                                 execve(a[0], a, env_use);
3255                         } else if (argc > optind)
3256                                 execvpe(argv[optind], argv + optind, env_use);
3257                         else {
3258                                 chdir(home ? home : "/root");
3259                                 execle("/bin/bash", "-bash", NULL, env_use);
3260                                 execle("/bin/sh", "-sh", NULL, env_use);
3261                         }
3262
3263                         log_error_errno(errno, "execv() failed: %m");
3264                         _exit(EXIT_FAILURE);
3265                 }
3266
3267                 barrier_set_role(&barrier, BARRIER_PARENT);
3268                 fdset_free(fds);
3269                 fds = NULL;
3270
3271                 /* wait for child-setup to be done */
3272                 if (barrier_place_and_sync(&barrier)) {
3273                         _cleanup_event_unref_ sd_event *event = NULL;
3274                         _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
3275                         int ifi = 0;
3276
3277                         r = move_network_interfaces(pid);
3278                         if (r < 0)
3279                                 goto finish;
3280
3281                         r = setup_veth(pid, veth_name, &ifi);
3282                         if (r < 0)
3283                                 goto finish;
3284
3285                         r = setup_bridge(veth_name, &ifi);
3286                         if (r < 0)
3287                                 goto finish;
3288
3289                         r = setup_macvlan(pid);
3290                         if (r < 0)
3291                                 goto finish;
3292
3293                         r = register_machine(pid, ifi);
3294                         if (r < 0)
3295                                 goto finish;
3296
3297                         /* Block SIGCHLD here, before notifying child.
3298                          * process_pty() will handle it with the other signals. */
3299                         r = sigprocmask(SIG_BLOCK, &mask_chld, NULL);
3300                         if (r < 0)
3301                                 goto finish;
3302
3303                         /* Reset signal to default */
3304                         r = default_signals(SIGCHLD, -1);
3305                         if (r < 0)
3306                                 goto finish;
3307
3308                         /* Notify the child that the parent is ready with all
3309                          * its setup, and that the child can now hand over
3310                          * control to the code to run inside the container. */
3311                         (void)barrier_place(&barrier);
3312
3313                         r = sd_event_new(&event);
3314                         if (r < 0) {
3315                                 log_error_errno(r, "Failed to get default event source: %m");
3316                                 goto finish;
3317                         }
3318
3319                         if (arg_boot) {
3320                                 /* Try to kill the init system on SIGINT or SIGTERM */
3321                                 sd_event_add_signal(event, NULL, SIGINT, on_orderly_shutdown, UINT32_TO_PTR(pid));
3322                                 sd_event_add_signal(event, NULL, SIGTERM, on_orderly_shutdown, UINT32_TO_PTR(pid));
3323                         } else {
3324                                 /* Immediately exit */
3325                                 sd_event_add_signal(event, NULL, SIGINT, NULL, NULL);
3326                                 sd_event_add_signal(event, NULL, SIGTERM, NULL, NULL);
3327                         }
3328
3329                         /* simply exit on sigchld */
3330                         sd_event_add_signal(event, NULL, SIGCHLD, NULL, NULL);
3331
3332                         r = pty_forward_new(event, master, &forward);
3333                         if (r < 0) {
3334                                 log_error_errno(r, "Failed to create PTY forwarder: %m");
3335                                 goto finish;
3336                         }
3337
3338                         r = sd_event_loop(event);
3339                         if (r < 0)
3340                                 return log_error_errno(r, "Failed to run event loop: %m");
3341
3342                         forward = pty_forward_free(forward);
3343
3344                         if (!arg_quiet)
3345                                 putc('\n', stdout);
3346
3347                         /* Kill if it is not dead yet anyway */
3348                         terminate_machine(pid);
3349                 }
3350
3351                 /* Normally redundant, but better safe than sorry */
3352                 kill(pid, SIGKILL);
3353
3354                 r = wait_for_container(pid, &container_status);
3355                 pid = 0;
3356
3357                 if (r < 0) {
3358                         /* We failed to wait for the container, or the
3359                          * container exited abnormally */
3360                         r = EXIT_FAILURE;
3361                         break;
3362                 } else if (r > 0 || container_status == CONTAINER_TERMINATED)
3363                         /* The container exited with a non-zero
3364                          * status, or with zero status and no reboot
3365                          * was requested. */
3366                         break;
3367
3368                 /* CONTAINER_REBOOTED, loop again */
3369
3370                 if (arg_keep_unit) {
3371                         /* Special handling if we are running as a
3372                          * service: instead of simply restarting the
3373                          * machine we want to restart the entire
3374                          * service, so let's inform systemd about this
3375                          * with the special exit code 133. The service
3376                          * file uses RestartForceExitStatus=133 so
3377                          * that this results in a full nspawn
3378                          * restart. This is necessary since we might
3379                          * have cgroup parameters set we want to have
3380                          * flushed out. */
3381                         r = 133;
3382                         break;
3383                 }
3384         }
3385
3386 finish:
3387         sd_notify(false,
3388                   "STOPPING=1\n"
3389                   "STATUS=Terminating...");
3390
3391         loop_remove(loop_nr, &image_fd);
3392
3393         if (pid > 0)
3394                 kill(pid, SIGKILL);
3395
3396         free(arg_directory);
3397         free(arg_machine);
3398         free(arg_user);
3399         strv_free(arg_setenv);
3400         strv_free(arg_network_interfaces);
3401         strv_free(arg_network_macvlan);
3402         strv_free(arg_bind);
3403         strv_free(arg_bind_ro);
3404         strv_free(arg_tmpfs);
3405
3406         return r;
3407 }