Add SELinux support to systemd-nspawn

[elogind.git] / man / systemd-nspawn.xml

diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 1f7d74e27322137db1079bb3f146fb0c403e4dbd..08b0457d16298d3395894391de82e60085e0b135 100644 (file)
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -49,7 +49,17 @@
 
         <refsynopsisdiv>
                 <cmdsynopsis>
 
         <refsynopsisdiv>
                 <cmdsynopsis>

-                        <command>systemd-nspawn <arg choice="opt" rep="repeat">OPTIONS</arg> <arg choice="opt">COMMAND</arg> <arg choice="opt" rep="repeat">ARGS</arg></command>
+                        <command>systemd-nspawn</command>
+                        <arg choice="opt" rep="repeat">OPTIONS</arg>
+                        <arg choice="opt"><replaceable>COMMAND</replaceable>
+                        <arg choice="opt" rep="repeat">ARGS</arg>
+                        </arg>
+                </cmdsynopsis>
+                <cmdsynopsis>
+                        <command>systemd-nspawn</command>
+                        <arg choice="plain">-b</arg>
+                        <arg choice="opt" rep="repeat">OPTIONS</arg>
+                        <arg choice="opt" rep="repeat">ARGS</arg>

                 </cmdsynopsis>
         </refsynopsisdiv>
 
                 </cmdsynopsis>
         </refsynopsisdiv>
 


@@ -87,15 +97,15 @@
                 involved with boot and systems management.</para>
 
                 <para>In contrast to
                 involved with boot and systems management.</para>
 
                 <para>In contrast to

-                <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
-                <command>systemd-nspawn</command> may be used to boot
-                full Linux-based operating systems in a
-                container.</para>
+                <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry> <command>systemd-nspawn</command>
+                may be used to boot full Linux-based operating systems
+                in a container.</para>

 
                 <para>Use a tool like
 
                 <para>Use a tool like

-                <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+                <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+                <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,

                 or
                 or

-                <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+                <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>

                 to set up an OS directory tree suitable as file system
                 hierarchy for <command>systemd-nspawn</command>
                 containers.</para>
                 to set up an OS directory tree suitable as file system
                 hierarchy for <command>systemd-nspawn</command>
                 containers.</para>


@@ -113,55 +123,96 @@
                 see each other. The PID namespace separation of the
                 two containers is complete and the containers will
                 share very few runtime objects except for the
                 see each other. The PID namespace separation of the
                 two containers is complete and the containers will
                 share very few runtime objects except for the

-                underlying file system.</para>
+                underlying file system. Use
+                <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
+                <command>login</command> command to request an
+                additional login prompt in a running container.</para>

 
                 <para><command>systemd-nspawn</command> implements the
                 <ulink
                 url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
                 Interface</ulink> specification.</para>
 
                 <para><command>systemd-nspawn</command> implements the
                 <ulink
                 url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
                 Interface</ulink> specification.</para>

+
+                <para>As a safety check
+                <command>systemd-nspawn</command> will verify the
+                existence of <filename>/etc/os-release</filename> in
+                the container tree before starting the container (see
+                <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>). It
+                might be necessary to add this file to the container
+                tree manually if the OS of the container is too old to
+                contain this file out-of-the-box.</para>
+        </refsect1>
+
+        <refsect1>
+                <title>Incompatibility with Auditing</title>
+
+                <para>Note that the kernel auditing subsystem is
+                currently broken when used together with
+                containers. We hence recommend turning it off entirely
+                by booting with <literal>audit=0</literal> on the
+                kernel command line, or by turning it off at kernel
+                build time. If auditing is enabled in the kernel,
+                operating systems booted in an nspawn container might
+                refuse log-in attempts.</para>

         </refsect1>
 
         <refsect1>
                 <title>Options</title>
 
         </refsect1>
 
         <refsect1>
                 <title>Options</title>
 

-                <para>If no arguments are passed the container is set
-                up and a shell started in it, otherwise the passed
-                command and arguments are executed in it. The
-                following options are understood:</para>
+                <para>If option <option>-b</option> is specified, the
+                arguments are used as arguments for the init
+                binary. Otherwise, <replaceable>COMMAND</replaceable>
+                specifies the program to launch in the container, and
+                the remaining arguments are used as arguments for this
+                program. If <option>-b</option> is not used and no
+                arguments are specifed, a shell is launched in the
+                container.</para>
+
+                <para>The following options are understood:</para>

 
                 <variablelist>
                         <varlistentry>
 
                 <variablelist>
                         <varlistentry>

-                                <term><option>--help</option></term>

                                 <term><option>-h</option></term>
                                 <term><option>-h</option></term>

+                                <term><option>--help</option></term>

 
                                 <listitem><para>Prints a short help
                                 text and exits.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>
 
                                 <listitem><para>Prints a short help
                                 text and exits.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>

-                                <term><option>--directory=</option></term>
+                                <term><option>--version</option></term>
+
+                                <listitem><para>Prints a version string
+                                and exits.</para></listitem>
+                        </varlistentry>
+
+                        <varlistentry>

                                 <term><option>-D</option></term>
                                 <term><option>-D</option></term>

+                                <term><option>--directory=</option></term>

 
                                 <listitem><para>Directory to use as
                                 file system root for the namespace
 
                                 <listitem><para>Directory to use as
                                 file system root for the namespace

-                                container. If omitted the current
+                                container. If omitted, the current

                                 directory will be
                                 used.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>
                                 directory will be
                                 used.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>

-                                <term><option>--boot</option></term>

                                 <term><option>-b</option></term>
                                 <term><option>-b</option></term>

+                                <term><option>--boot</option></term>

 
                                 <listitem><para>Automatically search
                                 for an init binary and invoke it
                                 instead of a shell or a user supplied
 
                                 <listitem><para>Automatically search
                                 for an init binary and invoke it
                                 instead of a shell or a user supplied

-                                program.</para></listitem>
+                                program. If this option is used, arguments
+                                specified on the command line are used
+                                as arguments for the init binary.
+                                </para></listitem>

                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>

-                                <term><option>--user=</option></term>

                                 <term><option>-u</option></term>
                                 <term><option>-u</option></term>

+                                <term><option>--user=</option></term>

 
                                 <listitem><para>Run the command
                                 under specified user, create home
 
                                 <listitem><para>Run the command
                                 under specified user, create home


@@ -172,10 +223,56 @@
                                 </para></listitem>
                         </varlistentry>
 
                                 </para></listitem>
                         </varlistentry>
 

+                        <varlistentry>
+                                <term><option>-M</option></term>
+                                <term><option>--machine=</option></term>
+
+                                <listitem><para>Sets the machine name
+                                for this container. This name may be
+                                used to identify this container on the
+                                host, and is used to initialize the
+                                container's hostname (which the
+                                container can choose to override,
+                                however). If not specified, the last
+                                component of the root directory of the
+                                container is used.</para></listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><option>--slice=</option></term>
+
+                                <listitem><para>Make the container
+                                part of the specified slice, instead
+                                of the
+                                <filename>machine.slice</filename>.</para>
+                                </listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><option>-L</option></term>
+                                <term><option>--file-label=</option></term>
+
+                                <listitem><para>Sets the mandatory
+                                access control (MAC) file label to be
+                                used by tmpfs file systems in the
+                                container.</para>
+                                </listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><option>-Z</option></term>
+                                <term><option>--process-label=</option></term>
+
+                                <listitem><para>Sets the mandatory
+                                access control (MAC) label to be used by
+                                processes in the container.</para>
+                                </listitem>
+                        </varlistentry>
+

                         <varlistentry>
                                 <term><option>--uuid=</option></term>
 
                         <varlistentry>
                                 <term><option>--uuid=</option></term>
 

-                                <listitem><para>Set the specified uuid
+                                <listitem><para>Set the specified UUID

                                 for the container. The init system
                                 will initialize
                                 <filename>/etc/machine-id</filename>
                                 for the container. The init system
                                 will initialize
                                 <filename>/etc/machine-id</filename>


@@ -183,16 +280,6 @@
                                 </para></listitem>
                         </varlistentry>
 
                                 </para></listitem>
                         </varlistentry>
 

-                        <varlistentry>
-                                <term><option>--controllers=</option></term>
-                                <term><option>-C</option></term>
-
-                                <listitem><para>Makes the container appear in
-                                other hierarchies that the name=systemd:/ one.
-                                Takes a comma-separated list of controllers.
-                                </para></listitem>
-                        </varlistentry>
-

                         <varlistentry>
                                 <term><option>--private-network</option></term>
 
                         <varlistentry>
                                 <term><option>--private-network</option></term>
 


@@ -207,7 +294,7 @@
                                 <term><option>--read-only</option></term>
 
                                 <listitem><para>Mount the root file
                                 <term><option>--read-only</option></term>
 
                                 <listitem><para>Mount the root file

-                                system read only for the
+                                system read-only for the

                                 container.</para></listitem>
                         </varlistentry>
 
                                 container.</para></listitem>
                         </varlistentry>
 


@@ -216,12 +303,12 @@
 
                                 <listitem><para>List one or more
                                 additional capabilities to grant the
 
                                 <listitem><para>List one or more
                                 additional capabilities to grant the

-                                container. Takes a comma separated
+                                container. Takes a comma-separated

                                 list of capability names, see
                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
                                 for more information. Note that the
                                 list of capability names, see
                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
                                 for more information. Note that the

-                                the following capabilities will be
-                                granted in any way: CAP_CHOWN,
+                                following capabilities will be granted
+                                in any way: CAP_CHOWN,

                                 CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
                                 CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
                                 CAP_KILL, CAP_LEASE,
                                 CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
                                 CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
                                 CAP_KILL, CAP_LEASE,


@@ -232,7 +319,19 @@
                                 CAP_SETUID, CAP_SYS_ADMIN,
                                 CAP_SYS_CHROOT, CAP_SYS_NICE,
                                 CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
                                 CAP_SETUID, CAP_SYS_ADMIN,
                                 CAP_SYS_CHROOT, CAP_SYS_NICE,
                                 CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,

-                                CAP_SYS_RESOURCE, CAP_SYS_BOOT.</para></listitem>
+                                CAP_SYS_RESOURCE, CAP_SYS_BOOT,
+                                CAP_AUDIT_WRITE,
+                                CAP_AUDIT_CONTROL.</para></listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><option>--drop-capability=</option></term>
+
+                                <listitem><para>Specify one or more
+                                additional capabilities to drop for
+                                the container. This allows running the
+                                container with fewer capabilities than
+                                the default (see above).</para></listitem>

                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>


@@ -240,7 +339,7 @@
 
                                 <listitem><para>Control whether the
                                 container's journal shall be made
 
                                 <listitem><para>Control whether the
                                 container's journal shall be made

-                                visible to the host system. If enabled
+                                visible to the host system. If enabled,

                                 allows viewing the container's journal
                                 files from the host (but not vice
                                 versa). Takes one of
                                 allows viewing the container's journal
                                 files from the host (but not vice
                                 versa). Takes one of


@@ -248,31 +347,30 @@
                                 <literal>host</literal>,
                                 <literal>guest</literal>,
                                 <literal>auto</literal>. If
                                 <literal>host</literal>,
                                 <literal>guest</literal>,
                                 <literal>auto</literal>. If

-                                <literal>no</literal> the journal is
-                                not linked. If <literal>host</literal>
+                                <literal>no</literal>, the journal is
+                                not linked. If <literal>host</literal>,

                                 the journal files are stored on the
                                 the journal files are stored on the

-                                host file system (beneath the host's
-                                <filename>/var/log/journal</filename>)
-                                and a per-machine subdirectory of this
-                                directory is created and bind mounted
+                                host file system (beneath
+                                <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
+                                and the subdirectory is bind-mounted

                                 into the container at the same
                                 into the container at the same

-                                location. If <literal>guest</literal>
+                                location. If <literal>guest</literal>,

                                 the journal files are stored on the
                                 the journal files are stored on the

-                                guest file system (beneath the guest's
-                                <filename>/var/log/journal</filename>)
-                                and a per-machine subdirectory of this
-                                directory is symlinked into the host
+                                guest file system (beneath
+                                <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
+                                and the subdirectory is symlinked into the host

                                 at the same location. If
                                 at the same location. If

-                                <literal>auto</literal> (the default)
-                                and the subdirectory of
+                                <literal>auto</literal> (the default),
+                                and the right subdirectory of

                                 <filename>/var/log/journal</filename>
                                 <filename>/var/log/journal</filename>

-                                exists as directory it is bind mounted
-                                into the container, but nothing is
-                                done otherwise. Effectively, booting a
-                                container once with
+                                exists, it will be bind mounted
+                                into the container. If the
+                                subdirectory does not exist, no
+                                linking is performed. Effectively,
+                                booting a container once with

                                 <literal>guest</literal> or
                                 <literal>host</literal> will link the
                                 <literal>guest</literal> or
                                 <literal>host</literal> will link the

-                                journal persistantly if further one
+                                journal persistently if further on

                                 the default of <literal>auto</literal>
                                 is used.</para></listitem>
                         </varlistentry>
                                 the default of <literal>auto</literal>
                                 is used.</para></listitem>
                         </varlistentry>


@@ -283,6 +381,41 @@
                                 <listitem><para>Equivalent to
                                 <option>--link-journal=guest</option>.</para></listitem>
                         </varlistentry>
                                 <listitem><para>Equivalent to
                                 <option>--link-journal=guest</option>.</para></listitem>
                         </varlistentry>

+
+                        <varlistentry>
+                                <term><option>--bind=</option></term>
+                                <term><option>--bind-ro=</option></term>
+
+                                <listitem><para>Bind mount a file or
+                                directory from the host into the
+                                container. Either takes a path
+                                argument -- in which case the
+                                specified path will be mounted from
+                                the host to the same path in the
+                                container --, or a colon-separated
+                                pair of paths -- in which case the
+                                first specified path is the source in
+                                the host, and the second path is the
+                                destination in the container. The
+                                <option>--bind-ro=</option> option
+                                creates read-only bind
+                                mount.</para></listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><option>--setenv=</option></term>
+
+                                <listitem><para>Specifies an
+                                environment variable assignment to
+                                pass to the init process in the
+                                container, in the format
+                                <literal>NAME=VALUE</literal>. This
+                                may be used to override the default
+                                variables or to set additional
+                                variables. This parameter may be used
+                                more than once.</para></listitem>
+                        </varlistentry>
+

                 </variablelist>
 
         </refsect1>
                 </variablelist>
 
         </refsect1>


@@ -290,13 +423,13 @@
         <refsect1>
                 <title>Example 1</title>
 
         <refsect1>
                 <title>Example 1</title>
 

-                <programlisting># yum --releasever=17 --nogpgcheck --installroot ~/fedora-tree/ install yum passwd vim-minimal rootfiles systemd
-# systemd-nspawn -D ~/fedora-tree /usr/lib/systemd/systemd</programlisting>
+                <programlisting># yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
+# systemd-nspawn -bD /srv/mycontainer</programlisting>

 
                 <para>This installs a minimal Fedora distribution into
 
                 <para>This installs a minimal Fedora distribution into

-                the directory <filename>~/fedora-tree/</filename>
-                and then boots an OS in a namespace container in it,
-                with systemd as init system.</para>
+                the directory <filename noindex='true'>/srv/mycontainer/</filename> and
+                then boots an OS in a namespace container in
+                it.</para>

         </refsect1>
 
         <refsect1>
         </refsect1>
 
         <refsect1>


@@ -309,7 +442,48 @@
                 distribution into the directory
                 <filename>~/debian-tree/</filename> and then spawns a
                 shell in a namespace container in it.</para>
                 distribution into the directory
                 <filename>~/debian-tree/</filename> and then spawns a
                 shell in a namespace container in it.</para>

+        </refsect1>
+
+        <refsect1>
+                <title>Example 3</title>
+
+                <programlisting># pacstrap -c -d ~/arch-tree/ base
+# systemd-nspawn -bD ~/arch-tree/</programlisting>
+
+                <para>This installs a mimimal Arch Linux distribution into
+                the directory <filename>~/arch-tree/</filename> and then
+                boots an OS in a namespace container in it.</para>
+        </refsect1>
+
+        <refsect1>
+                <title>Example 4</title>
+
+                <programlisting># mv ~/arch-tree /var/lib/container/arch
+# systemctl enable systemd-nspawn@arch.service
+# systemctl start systemd-nspawn@arch.service</programlisting>
+
+                <para>This makes the Arch Linux container part of the
+                <filename>multi-user.target</filename> on the host.
+                </para>
+        </refsect1>
+
+        <refsect1>
+                <title>Example 5</title>
+
+                <programlisting># btrfs subvolume snapshot / /.tmp
+# systemd-nspawn --private-network -D /.tmp -b</programlisting>
+
+                <para>This runs a copy of the host system in a
+                btrfs snapshot.</para>
+        </refsect1>
+
+        <refsect1>
+                <title>Example 6</title>
+
+                <programlisting># chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
+# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh</programlisting>

 
 

+                <para>This runs a container with SELinux sandbox labels.</para>

         </refsect1>
 
         <refsect1>
         </refsect1>
 
         <refsect1>


@@ -325,7 +499,10 @@
                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,

-                        <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+                        <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+                        <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+                        <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+                        <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>

                 </para>
         </refsect1>
 
                 </para>
         </refsect1>