nspawn: always use cg_get_path() to determine fs path for a cgroup

[elogind.git] / src / nspawn / nspawn.c

diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index f57c75ffeeb8f11935086cd398ef34a750705e49..0a5a151202f0a7c652b6464ff93aed82b826ab7c 100644 (file)
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -22,6 +22,7 @@
 #include <signal.h>
 #include <sched.h>
 #include <unistd.h>
+#include <attr/xattr.h>
 #include <sys/types.h>
 #include <sys/syscall.h>
 #include <sys/mount.h>
@@ -492,7 +493,8 @@ static int setup_timezone(const char *dest) {
 }
 
 static int setup_resolv_conf(const char *dest) {
-        char *where;
+        char _cleanup_free_ *where = NULL;
+        _cleanup_close_ int fd = -1;
 
         assert(dest);
 
@@ -504,12 +506,18 @@ static int setup_resolv_conf(const char *dest) {
         if (!where)
                 return log_oom();
 
+        fd = open(where, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0644);
+
         /* We don't really care for the results of this really. If it
          * fails, it fails, but meh... */
-        if (mount("/etc/resolv.conf", where, "bind", MS_BIND, NULL) >= 0)
-                mount("/etc/resolv.conf", where, "bind", MS_BIND|MS_REMOUNT|MS_RDONLY, NULL);
-
-        free(where);
+        if (mount("/etc/resolv.conf", where, "bind", MS_BIND, NULL) < 0)
+                log_warning("Failed to bind mount /etc/resolv.conf: %m");
+        else
+                if (mount("/etc/resolv.conf", where, "bind",
+                          MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0) {
+                        log_error("Failed to remount /etc/resolv.conf readonly: %m");
+                        return -errno;
+                }
 
         return 0;
 }
@@ -914,6 +922,47 @@ static int setup_cgroup(const char *path) {
         return 0;
 }
 
+static int save_attributes(const char *cgroup, pid_t pid, const char *uuid, const char *directory) {
+        _cleanup_free_ char *path = NULL;
+        char buf[DECIMAL_STR_MAX(pid_t)];
+        int r = 0, k;
+
+        assert(cgroup);
+        assert(pid >= 0);
+        assert(arg_directory);
+
+#ifdef HAVE_XATTR
+        assert_se(snprintf(buf, sizeof(buf), "%lu", (unsigned long) pid) < (int) sizeof(buf));
+
+        r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, cgroup, NULL, &path);
+        if (r < 0) {
+                log_error("Failed to get path: %s", strerror(-r));
+                return r;
+        }
+
+        r = setxattr(path, "trusted.init_pid", buf, strlen(buf), XATTR_CREATE);
+        if (r < 0)
+                log_warning("Failed to set %s attribute on %s: %m", "trusted.init_pid", path);
+
+        if (uuid) {
+                k = setxattr(path, "trusted.machine_id", uuid, strlen(uuid), XATTR_CREATE);
+                if (k < 0) {
+                        log_warning("Failed to set %s attribute on %s: %m", "trusted.machine_id", path);
+                        if (r == 0)
+                                r = k;
+                }
+        }
+
+        k = setxattr(path, "trusted.root_directory", directory, strlen(directory), XATTR_CREATE);
+        if (k < 0) {
+                log_warning("Failed to set %s attribute on %s: %m", "trusted.root_directory", path);
+                if (r == 0)
+                        r = k;
+        }
+#endif
+        return r;
+}
+
 static int drop_capabilities(void) {
         return capability_bounding_set_drop(~arg_retain, false);
 }
@@ -1191,7 +1240,7 @@ int main(int argc, char *argv[]) {
                 arg_directory = get_current_dir_name();
 
         if (!arg_directory) {
-                log_error("Failed to determine path");
+                log_error("Failed to determine path, please use -D.");
                 goto finish;
         }
 
@@ -1306,13 +1355,19 @@ int main(int argc, char *argv[]) {
 
         for (;;) {
                 siginfo_t status;
-                int pipefd[2];
+                int pipefd[2], pipefd2[2];
 
                 if (pipe2(pipefd, O_NONBLOCK|O_CLOEXEC) < 0) {
                         log_error("pipe2(): %m");
                         goto finish;
                 }
 
+                if (pipe2(pipefd2, O_NONBLOCK|O_CLOEXEC) < 0) {
+                        log_error("pipe2(): %m");
+                        close_pipe(pipefd);
+                        goto finish;
+                }
+
                 pid = syscall(__NR_clone, SIGCHLD|CLONE_NEWIPC|CLONE_NEWNS|CLONE_NEWPID|CLONE_NEWUTS|(arg_private_network ? CLONE_NEWNET : 0), NULL);
                 if (pid < 0) {
                         if (errno == EINVAL)
@@ -1346,6 +1401,7 @@ int main(int argc, char *argv[]) {
                         if (envp[n_env])
                                 n_env ++;
 
+                        /* Wait for the parent process to log our PID */
                         close_nointr_nofail(pipefd[1]);
                         fd_wait_for_event(pipefd[0], POLLHUP, -1);
                         close_nointr_nofail(pipefd[0]);
@@ -1402,6 +1458,8 @@ int main(int argc, char *argv[]) {
                         if (setup_cgroup(newcg) < 0)
                                 goto child_fail;
 
+                        close_pipe(pipefd2);
+
                         /* Mark everything as slave, so that we still
                          * receive mounts from the real root, but don't
                          * propagate mounts to the real root. */
@@ -1610,6 +1668,13 @@ int main(int argc, char *argv[]) {
                 close_nointr_nofail(pipefd[0]);
                 close_nointr_nofail(pipefd[1]);
 
+                /* Wait for the child process to establish cgroup hierarchy */
+                close_nointr_nofail(pipefd2[1]);
+                fd_wait_for_event(pipefd2[0], POLLHUP, -1);
+                close_nointr_nofail(pipefd2[0]);
+
+                save_attributes(newcg, pid, arg_uuid, arg_directory);
+
                 fdset_free(fds);
                 fds = NULL;