bus: connect directly via kdbus in sd_bus_open_system_container()

kdbus fortunately exposes the container's busses in the host fs, hence
we can access it directly instead of doing the namespacing dance.

diff --git a/src/libsystemd-bus/sd-bus.c b/src/libsystemd-bus/sd-bus.c
index f991a09279eb7efef10ca18834c3dd84ef3fce96..edd917e30375786811727fd44590625e99ce3df1 100644 (file)
--- a/src/libsystemd-bus/sd-bus.c
+++ b/src/libsystemd-bus/sd-bus.c
@@ -1142,12 +1142,17 @@ _public_ int sd_bus_open_system_container(const char *machine, sd_bus **ret) {
 
         assert_return(machine, -EINVAL);
         assert_return(ret, -EINVAL);
+        assert_return(filename_is_safe(machine), -EINVAL);
 
         e = bus_address_escape(machine);
         if (!e)
                 return -ENOMEM;
 
+#ifdef ENABLE_KDBUS
+        p = strjoin("kernel:path=/dev/kdbus/ns/machine-", e, "/0-system/bus;x-container:machine=", e, NULL);
+#else
         p = strjoin("x-container:machine=", e, NULL);
+#endif
         if (!p)
                 return -ENOMEM;
 

diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 583912f57c51bb3c0b40c7646896c69c5e374ffb..b3ca10ea9116c67168e904592f55e532d194e1a3 100644 (file)
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -1067,6 +1067,7 @@ int main(int argc, char *argv[]) {
         _cleanup_close_pipe_ int kmsg_socket_pair[2] = { -1, -1 };
         _cleanup_fdset_free_ FDSet *fds = NULL;
         _cleanup_free_ char *kdbus_namespace = NULL;
+        const char *ns;
 
         log_parse_environment();
         log_open();
@@ -1167,7 +1168,8 @@ int main(int argc, char *argv[]) {
                 goto finish;
         }
 
-        kdbus_fd = bus_kernel_create_namespace(arg_machine, &kdbus_namespace);
+        ns = strappenda("machine-", arg_machine);
+        kdbus_fd = bus_kernel_create_namespace(ns, &kdbus_namespace);
         if (r < 0)
                 log_debug("Failed to create kdbus namespace: %s", strerror(-r));
         else