mount-setup: mount /dev/pts with mode=620,gid=5 by default and make GID overridable...

[elogind.git] / src / mount-setup.c

diff --git a/src/mount-setup.c b/src/mount-setup.c
index 6b0539bf97cf8f6041d46044889e8b6065bf842c..64fb4765f613d9929e956e753673ca813544a28c 100644 (file)
--- a/src/mount-setup.c
+++ b/src/mount-setup.c
@@ -1,4 +1,4 @@
-/*-*- Mode: C; c-basic-offset: 8 -*-*/
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
 
 /***
   This file is part of systemd.
@@ -26,11 +26,18 @@
 #include <string.h>
 #include <libgen.h>
 #include <assert.h>
+#include <unistd.h>
+#include <ftw.h>
 
 #include "mount-setup.h"
 #include "log.h"
 #include "macro.h"
 #include "util.h"
+#include "label.h"
+
+#ifndef TTY_GID
+#define TTY_GID 5
+#endif
 
 typedef struct MountPoint {
         const char *what;
@@ -42,17 +49,17 @@ typedef struct MountPoint {
 } MountPoint;
 
 static const MountPoint mount_table[] = {
-        { "proc",     "/proc",           "proc",     NULL,                MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
-        { "sysfs",    "/sys",            "sysfs",    NULL,                MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
-        { "devtmpfs", "/dev",            "devtmpfs", "mode=755",          MS_NOSUID,                    true },
-        { "tmpfs",    "/dev/shm",        "tmpfs",    "mode=1777",         MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
-        { "devpts",   "/dev/pts",        "devpts",   NULL,                MS_NOSUID|MS_NOEXEC|MS_NODEV, false },
-        { "tmpfs",    "/cgroup",         "tmpfs",    "mode=755",          MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
-        { "cgroup",   "/cgroup/systemd", "cgroup",   "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
+        { "proc",     "/proc",                  "proc",     NULL,                MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
+        { "sysfs",    "/sys",                   "sysfs",    NULL,                MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
+        { "devtmpfs", "/dev",                   "devtmpfs", "mode=755",          MS_NOSUID,                    true },
+        { "tmpfs",    "/dev/shm",               "tmpfs",    "mode=1777",         MS_NOSUID|MS_NODEV,           true },
+        { "devpts",   "/dev/pts",               "devpts",   "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC, false },
+        { "tmpfs",    "/sys/fs/cgroup",         "tmpfs",    "mode=755",          MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
+        { "cgroup",   "/sys/fs/cgroup/systemd", "cgroup",   "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
 };
 
 /* These are API file systems that might be mounted by other software,
- * we just list them here so that we know that we should igore them */
+ * we just list them here so that we know that we should ignore them */
 
 static const char * const ignore_paths[] = {
         "/selinux",
@@ -68,14 +75,20 @@ bool mount_point_is_api(const char *path) {
          * should be ignored */
 
         for (i = 0; i < ELEMENTSOF(mount_table); i ++)
-                if (path_startswith(path, mount_table[i].where))
+                if (path_equal(path, mount_table[i].where))
                         return true;
 
+        return path_startswith(path, "/sys/fs/cgroup/");
+}
+
+bool mount_point_ignore(const char *path) {
+        unsigned i;
+
         for (i = 0; i < ELEMENTSOF(ignore_paths); i++)
-                if (path_startswith(path, ignore_paths[i]))
+                if (path_equal(path, ignore_paths[i]))
                         return true;
 
-        return path_startswith(path, "/cgroup/");
+        return false;
 }
 
 static int mount_one(const MountPoint *p) {
@@ -108,6 +121,8 @@ static int mount_one(const MountPoint *p) {
                 return p->fatal ? -errno : 0;
         }
 
+        label_fix(p->where);
+
         return 0;
 }
 
@@ -127,8 +142,9 @@ static int mount_cgroup_controllers(void) {
         for (;;) {
                 MountPoint p;
                 char *controller, *where;
+                int enabled = false;
 
-                if (fscanf(f, "%ms %*i %*i %*i", &controller) != 1) {
+                if (fscanf(f, "%ms %*i %*i %i", &controller, &enabled) != 2) {
 
                         if (feof(f))
                                 break;
@@ -138,7 +154,12 @@ static int mount_cgroup_controllers(void) {
                         goto finish;
                 }
 
-                if (asprintf(&where, "/cgroup/%s", controller) < 0) {
+                if (!enabled) {
+                        free(controller);
+                        continue;
+                }
+
+                if (asprintf(&where, "/sys/fs/cgroup/%s", controller) < 0) {
                         free(controller);
                         r = -ENOMEM;
                         goto finish;
@@ -168,13 +189,68 @@ finish:
         return r;
 }
 
+static int symlink_and_label(const char *old_path, const char *new_path) {
+        int r;
+
+        assert(old_path);
+        assert(new_path);
+
+        if ((r = label_symlinkfile_set(new_path)) < 0)
+                return r;
+
+        if (symlink(old_path, new_path) < 0)
+                r = -errno;
+
+        label_file_clear();
+
+        return r;
+}
+
+static int nftw_cb(
+                const char *fpath,
+                const struct stat *sb,
+                int tflag,
+                struct FTW *ftwbuf) {
+
+        /* No need to label /dev twice in a row... */
+        if (ftwbuf->level == 0)
+                return 0;
+
+        label_fix(fpath);
+        return 0;
+};
+
 int mount_setup(void) {
+
+        const char symlinks[] =
+                "/proc/kcore\0"      "/dev/core\0"
+                "/proc/self/fd\0"    "/dev/fd\0"
+                "/proc/self/fd/0\0"  "/dev/stdin\0"
+                "/proc/self/fd/1\0"  "/dev/stdout\0"
+                "/proc/self/fd/2\0"  "/dev/stderr\0"
+                "\0";
+
         int r;
         unsigned i;
+        const char *j, *k;
 
         for (i = 0; i < ELEMENTSOF(mount_table); i ++)
                 if ((r = mount_one(mount_table+i)) < 0)
                         return r;
 
+        /* Nodes in devtmpfs need to be manually updated for the
+         * appropriate labels, after mounting. The other virtual API
+         * file systems do not need. */
+
+        if (unlink("/dev/.systemd/relabel-devtmpfs") >= 0)
+                nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS);
+
+        /* Create a few default symlinks, which are normally created
+         * bei udevd, but some scripts might need them before we start
+         * udevd. */
+
+        NULSTR_FOREACH_PAIR(j, k, symlinks)
+                symlink_and_label(j, k);
+
         return mount_cgroup_controllers();
 }