diff options
| -rw-r--r-- | src/core/namespace.c | 890 |
1 files changed, 455 insertions, 435 deletions
diff --git a/src/core/namespace.c b/src/core/namespace.c index 9165a481f5..dede603bdd 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -100,6 +100,11 @@ typedef struct MountEntry { LIST_HEAD(MountOptions, image_options); } MountEntry; +typedef struct MountList { + MountEntry *mounts; + size_t n_mounts; +} MountList; + /* If MountAPIVFS= is used, let's mount /sys, /proc, /dev and /run into the it, but only as a fallback if the user hasn't mounted * something there already. These mounts are hence overridden by any other explicitly configured mounts. */ static const MountEntry apivfs_table[] = { @@ -322,8 +327,27 @@ static void mount_entry_done(MountEntry *p) { p->image_options = mount_options_free_all(p->image_options); } -static int append_access_mounts(MountEntry **p, char **strv, MountMode mode, bool forcibly_require_prefix) { - assert(p); +static void mount_list_done(MountList *ml) { + assert(ml); + + FOREACH_ARRAY(m, ml->mounts, ml->n_mounts) + mount_entry_done(m); + + ml->mounts = mfree(ml->mounts); + ml->n_mounts = 0; +} + +static MountEntry *mount_list_extend(MountList *ml) { + assert(ml); + + if (!GREEDY_REALLOC0(ml->mounts, ml->n_mounts+1)) + return NULL; + + return ml->mounts + ml->n_mounts++; +} + +static int append_access_mounts(MountList *ml, char **strv, MountMode mode, bool forcibly_require_prefix) { + assert(ml); /* Adds a list of user-supplied READWRITE/READWRITE_IMPLICIT/READONLY/INACCESSIBLE entries */ @@ -342,10 +366,13 @@ static int append_access_mounts(MountEntry **p, char **strv, MountMode mode, boo } if (!path_is_absolute(e)) - return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), - "Path is not absolute: %s", e); + return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Path is not absolute: %s", e); - *((*p)++) = (MountEntry) { + MountEntry *me = mount_list_extend(ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { .path_const = e, .mode = mode, .ignore = ignore, @@ -356,15 +383,18 @@ static int append_access_mounts(MountEntry **p, char **strv, MountMode mode, boo return 0; } -static int append_empty_dir_mounts(MountEntry **p, char **strv) { - assert(p); +static int append_empty_dir_mounts(MountList *ml, char **strv) { + assert(ml); /* Adds tmpfs mounts to provide readable but empty directories. This is primarily used to implement the * "/private/" boundary directories for DynamicUser=1. */ STRV_FOREACH(i, strv) { + MountEntry *me = mount_list_extend(ml); + if (!me) + return log_oom_debug(); - *((*p)++) = (MountEntry) { + *me = (MountEntry) { .path_const = *i, .mode = EMPTY_DIR, .ignore = false, @@ -377,13 +407,16 @@ static int append_empty_dir_mounts(MountEntry **p, char **strv) { return 0; } -static int append_bind_mounts(MountEntry **p, const BindMount *binds, size_t n) { - assert(p); +static int append_bind_mounts(MountList *ml, const BindMount *binds, size_t n) { + assert(ml); + assert(binds || n == 0); - for (size_t i = 0; i < n; i++) { - const BindMount *b = binds + i; + FOREACH_ARRAY(b, binds, n) { + MountEntry *me = mount_list_extend(ml); + if (!me) + return log_oom_debug(); - *((*p)++) = (MountEntry) { + *me = (MountEntry) { .path_const = b->destination, .mode = b->recursive ? BIND_MOUNT_RECURSIVE : BIND_MOUNT, .read_only = b->read_only, @@ -396,13 +429,16 @@ static int append_bind_mounts(MountEntry **p, const BindMount *binds, size_t n) return 0; } -static int append_mount_images(MountEntry **p, const MountImage *mount_images, size_t n) { - assert(p); +static int append_mount_images(MountList *ml, const MountImage *mount_images, size_t n) { + assert(ml); + assert(mount_images || n == 0); - for (size_t i = 0; i < n; i++) { - const MountImage *m = mount_images + i; + FOREACH_ARRAY(m, mount_images, n) { + MountEntry *me = mount_list_extend(ml); + if (!me) + return log_oom_debug(); - *((*p)++) = (MountEntry) { + *me = (MountEntry) { .path_const = m->destination, .mode = MOUNT_IMAGES, .source_const = m->source, @@ -415,7 +451,7 @@ static int append_mount_images(MountEntry **p, const MountImage *mount_images, s } static int append_extensions( - MountEntry **p, + MountList *ml, const char *root, const char *extension_dir, char **hierarchies, @@ -426,10 +462,11 @@ static int append_extensions( _cleanup_strv_free_ char **overlays = NULL; int r; + assert(ml); + if (n == 0 && strv_isempty(extension_directories)) return 0; - assert(p); assert(extension_dir); /* Prepare a list of overlays, that will have as each element a string suitable for being @@ -454,8 +491,7 @@ static int append_extensions( _cleanup_free_ char *mount_point = NULL; const MountImage *m = mount_images + i; - r = asprintf(&mount_point, "%s/%zu", extension_dir, i); - if (r < 0) + if (asprintf(&mount_point, "%s/%zu", extension_dir, i) < 0) return -ENOMEM; for (size_t j = 0; hierarchies && hierarchies[j]; ++j) { @@ -478,7 +514,11 @@ static int append_extensions( free_and_replace(overlays[j], lowerdir); } - *((*p)++) = (MountEntry) { + MountEntry *me = mount_list_extend(ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { .path_malloc = TAKE_PTR(mount_point), .image_options = m->mount_options, .ignore = m->ignore_enoent, @@ -497,8 +537,7 @@ static int append_extensions( bool ignore_enoent = false; /* Pick up the counter where the ExtensionImages left it. */ - r = asprintf(&mount_point, "%s/%zu", extension_dir, n++); - if (r < 0) + if (asprintf(&mount_point, "%s/%zu", extension_dir, n++) < 0) return -ENOMEM; /* Look for any prefixes */ @@ -534,7 +573,11 @@ static int append_extensions( free_and_replace(overlays[j], lowerdir); } - *((*p)++) = (MountEntry) { + MountEntry *me = mount_list_extend(ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { .path_malloc = TAKE_PTR(mount_point), .source_malloc = TAKE_PTR(source), .mode = EXTENSION_DIRECTORIES, @@ -553,7 +596,11 @@ static int append_extensions( if (!prefixed_hierarchy) return -ENOMEM; - *((*p)++) = (MountEntry) { + MountEntry *me = mount_list_extend(ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { .path_malloc = TAKE_PTR(prefixed_hierarchy), .options_malloc = TAKE_PTR(overlays[i]), .mode = OVERLAY_MOUNT, @@ -565,20 +612,18 @@ static int append_extensions( return 0; } -static int append_tmpfs_mounts(MountEntry **p, const TemporaryFileSystem *tmpfs, size_t n) { - assert(p); +static int append_tmpfs_mounts(MountList *ml, const TemporaryFileSystem *tmpfs, size_t n) { + assert(ml); + assert(tmpfs || n == 0); - for (size_t i = 0; i < n; i++) { - const TemporaryFileSystem *t = tmpfs + i; + FOREACH_ARRAY(t, tmpfs, n) { _cleanup_free_ char *o = NULL, *str = NULL; unsigned long flags; bool ro = false; int r; if (!path_is_absolute(t->path)) - return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), - "Path is not absolute: %s", - t->path); + return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Path is not absolute: %s", t->path); str = strjoin("mode=0755" NESTED_TMPFS_LIMITS ",", t->options); if (!str) @@ -592,7 +637,11 @@ static int append_tmpfs_mounts(MountEntry **p, const TemporaryFileSystem *tmpfs, if (ro) flags ^= MS_RDONLY; - *((*p)++) = (MountEntry) { + MountEntry *me = mount_list_extend(ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { .path_const = t->path, .mode = TMPFS, .read_only = ro, @@ -604,24 +653,29 @@ static int append_tmpfs_mounts(MountEntry **p, const TemporaryFileSystem *tmpfs, return 0; } -static int append_static_mounts(MountEntry **p, const MountEntry *mounts, size_t n, bool ignore_protect) { - assert(p); - assert(mounts); +static int append_static_mounts(MountList *ml, const MountEntry *mounts, size_t n, bool ignore_protect) { + assert(ml); + assert(mounts || n == 0); /* Adds a list of static pre-defined entries */ - for (size_t i = 0; i < n; i++) - *((*p)++) = (MountEntry) { - .path_const = mount_entry_path(mounts+i), - .mode = mounts[i].mode, - .ignore = mounts[i].ignore || ignore_protect, + FOREACH_ARRAY(m, mounts, n) { + MountEntry *me = mount_list_extend(ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { + .path_const = mount_entry_path(m), + .mode = m->mode, + .ignore = m->ignore || ignore_protect, }; + } return 0; } -static int append_protect_home(MountEntry **p, ProtectHome protect_home, bool ignore_protect) { - assert(p); +static int append_protect_home(MountList *ml, ProtectHome protect_home, bool ignore_protect) { + assert(ml); switch (protect_home) { @@ -629,21 +683,21 @@ static int append_protect_home(MountEntry **p, ProtectHome protect_home, bool ig return 0; case PROTECT_HOME_READ_ONLY: - return append_static_mounts(p, protect_home_read_only_table, ELEMENTSOF(protect_home_read_only_table), ignore_protect); + return append_static_mounts(ml, protect_home_read_only_table, ELEMENTSOF(protect_home_read_only_table), ignore_protect); case PROTECT_HOME_TMPFS: - return append_static_mounts(p, protect_home_tmpfs_table, ELEMENTSOF(protect_home_tmpfs_table), ignore_protect); + return append_static_mounts(ml, protect_home_tmpfs_table, ELEMENTSOF(protect_home_tmpfs_table), ignore_protect); case PROTECT_HOME_YES: - return append_static_mounts(p, protect_home_yes_table, ELEMENTSOF(protect_home_yes_table), ignore_protect); + return append_static_mounts(ml, protect_home_yes_table, ELEMENTSOF(protect_home_yes_table), ignore_protect); default: assert_not_reached(); } } -static int append_protect_system(MountEntry **p, ProtectSystem protect_system, bool ignore_protect) { - assert(p); +static int append_protect_system(MountList *ml, ProtectSystem protect_system, bool ignore_protect) { + assert(ml); switch (protect_system) { @@ -651,13 +705,13 @@ static int append_protect_system(MountEntry **p, ProtectSystem protect_system, b return 0; case PROTECT_SYSTEM_STRICT: - return append_static_mounts(p, protect_system_strict_table, ELEMENTSOF(protect_system_strict_table), ignore_protect); + return append_static_mounts(ml, protect_system_strict_table, ELEMENTSOF(protect_system_strict_table), ignore_protect); case PROTECT_SYSTEM_YES: - return append_static_mounts(p, protect_system_yes_table, ELEMENTSOF(protect_system_yes_table), ignore_protect); + return append_static_mounts(ml, protect_system_yes_table, ELEMENTSOF(protect_system_yes_table), ignore_protect); case PROTECT_SYSTEM_FULL: - return append_static_mounts(p, protect_system_full_table, ELEMENTSOF(protect_system_full_table), ignore_protect); + return append_static_mounts(ml, protect_system_full_table, ELEMENTSOF(protect_system_full_table), ignore_protect); default: assert_not_reached(); @@ -685,36 +739,35 @@ static int mount_path_compare(const MountEntry *a, const MountEntry *b) { return CMP((int) a->mode, (int) b->mode); } -static int prefix_where_needed(MountEntry *m, size_t n, const char *root_directory) { +static int prefix_where_needed(MountList *ml, const char *root_directory) { /* Prefixes all paths in the bind mount table with the root directory if the entry needs that. */ - assert(m || n == 0); + assert(ml); - for (size_t i = 0; i < n; i++) { + FOREACH_ARRAY(me, ml->mounts, ml->n_mounts) { char *s; - if (m[i].has_prefix) + if (me->has_prefix) continue; - s = path_join(root_directory, mount_entry_path(m+i)); + s = path_join(root_directory, mount_entry_path(me)); if (!s) return -ENOMEM; - mount_entry_consume_prefix(&m[i], s); + mount_entry_consume_prefix(me, s); } return 0; } -static void drop_duplicates(MountEntry *m, size_t *n) { +static void drop_duplicates(MountList *ml) { MountEntry *f, *t, *previous; - assert(m); - assert(n); + assert(ml); /* Drops duplicate entries. Expects that the array is properly ordered already. */ - for (f = m, t = m, previous = NULL; f < m + *n; f++) { + for (f = ml->mounts, t = ml->mounts, previous = NULL; f < ml->mounts + ml->n_mounts; f++) { /* The first one wins (which is the one with the more restrictive mode), see mount_path_compare() * above. Note that we only drop duplicates that haven't been mounted yet. */ @@ -735,20 +788,19 @@ static void drop_duplicates(MountEntry *m, size_t *n) { t++; } - *n = t - m; + ml->n_mounts = t - ml->mounts; } -static void drop_inaccessible(MountEntry *m, size_t *n) { +static void drop_inaccessible(MountList *ml) { MountEntry *f, *t; const char *clear = NULL; - assert(m); - assert(n); + assert(ml); /* Drops all entries obstructed by another entry further up the tree. Expects that the array is properly * ordered already. */ - for (f = m, t = m; f < m + *n; f++) { + for (f = ml->mounts, t = ml->mounts; f < ml->mounts + ml->n_mounts; f++) { /* If we found a path set for INACCESSIBLE earlier, and this entry has it as prefix we should drop * it, as inaccessible paths really should drop the entire subtree. */ @@ -764,26 +816,25 @@ static void drop_inaccessible(MountEntry *m, size_t *n) { t++; } - *n = t - m; + ml->n_mounts = t - ml->mounts; } -static void drop_nop(MountEntry *m, size_t *n) { +static void drop_nop(MountList *ml) { MountEntry *f, *t; - assert(m); - assert(n); + assert(ml); /* Drops all entries which have an immediate parent that has the same type, as they are redundant. Assumes the * list is ordered by prefixes. */ - for (f = m, t = m; f < m + *n; f++) { + for (f = ml->mounts, t = ml->mounts; f < ml->mounts + ml->n_mounts; f++) { /* Only suppress such subtrees for READONLY, READWRITE and READWRITE_IMPLICIT entries */ if (IN_SET(f->mode, READONLY, READWRITE, READWRITE_IMPLICIT)) { MountEntry *found = NULL; /* Now let's find the first parent of the entry we are looking at. */ - for (MountEntry *p = PTR_SUB1(t, m); p; p = PTR_SUB1(p, m)) + for (MountEntry *p = PTR_SUB1(t, ml->mounts); p; p = PTR_SUB1(p, ml->mounts)) if (path_startswith(mount_entry_path(f), mount_entry_path(p))) { found = p; break; @@ -803,14 +854,13 @@ static void drop_nop(MountEntry *m, size_t *n) { t++; } - *n = t - m; + ml->n_mounts = t - ml->mounts; } -static void drop_outside_root(const char *root_directory, MountEntry *m, size_t *n) { +static void drop_outside_root(MountList *ml, const char *root_directory) { MountEntry *f, *t; - assert(m); - assert(n); + assert(ml); /* Nothing to do */ if (!root_directory) @@ -818,7 +868,7 @@ static void drop_outside_root(const char *root_directory, MountEntry *m, size_t /* Drops all mounts that are outside of the root directory. */ - for (f = m, t = m; f < m + *n; f++) { + for (f = ml->mounts, t = ml->mounts; f < ml->mounts + ml->n_mounts; f++) { /* ExtensionImages/Directories bases are opened in /run/systemd/unit-extensions on the host */ if (!IN_SET(f->mode, EXTENSION_IMAGES, EXTENSION_DIRECTORIES) && !path_startswith(mount_entry_path(f), root_directory)) { @@ -831,7 +881,7 @@ static void drop_outside_root(const char *root_directory, MountEntry *m, size_t t++; } - *n = t - m; + ml->n_mounts = t - ml->mounts; } static int clone_device_node( @@ -1716,59 +1766,6 @@ static bool namespace_parameters_mount_apivfs(const NamespaceParameters *p) { p->proc_subset != PROC_SUBSET_ALL; } -static size_t namespace_calculate_mounts( - const NamespaceParameters *p, - char **hierarchies, - bool setup_propagate) { - - size_t protect_home_cnt; - size_t protect_system_cnt = - (p->protect_system == PROTECT_SYSTEM_STRICT ? - ELEMENTSOF(protect_system_strict_table) : - ((p->protect_system == PROTECT_SYSTEM_FULL) ? - ELEMENTSOF(protect_system_full_table) : - ((p->protect_system == PROTECT_SYSTEM_YES) ? - ELEMENTSOF(protect_system_yes_table) : 0))); - - protect_home_cnt = - (p->protect_home == PROTECT_HOME_YES ? - ELEMENTSOF(protect_home_yes_table) : - ((p->protect_home == PROTECT_HOME_READ_ONLY) ? - ELEMENTSOF(protect_home_read_only_table) : - ((p->protect_home == PROTECT_HOME_TMPFS) ? - ELEMENTSOF(protect_home_tmpfs_table) : 0))); - - return !!p->tmp_dir + !!p->var_tmp_dir + - strv_length(p->read_write_paths) + - strv_length(p->read_only_paths) + - strv_length(p->inaccessible_paths) + - strv_length(p->exec_paths) + - strv_length(p->no_exec_paths) + - strv_length(p->empty_directories) + - p->n_bind_mounts + - p->n_mount_images + - (p->n_extension_images > 0 || !strv_isempty(p->extension_directories) ? /* Mount each image and directory plus an overlay per hierarchy */ - strv_length(hierarchies) + p->n_extension_images + strv_length(p->extension_directories) : 0) + - p->n_temporary_filesystems + - p->private_dev + - (p->protect_kernel_tunables ? - ELEMENTSOF(protect_kernel_tunables_proc_table) + ELEMENTSOF(protect_kernel_tunables_sys_table) : 0) + - (p->protect_kernel_modules ? ELEMENTSOF(protect_kernel_modules_table) : 0) + - (p->protect_kernel_logs ? - ELEMENTSOF(protect_kernel_logs_proc_table) + ELEMENTSOF(protect_kernel_logs_dev_table) : 0) + - (p->protect_control_groups ? 1 : 0) + - protect_home_cnt + protect_system_cnt + - (p->protect_hostname ? 2 : 0) + - (namespace_parameters_mount_apivfs(p) ? ELEMENTSOF(apivfs_table) : 0) + - (p->creds_path ? 2 : 1) + - !!p->log_namespace + - setup_propagate + /* /run/systemd/incoming */ - !!p->notify_socket + - !!p->host_os_release_stage + - p->private_network + /* /sys */ - p->private_ipc; /* /dev/mqueue */ -} - /* Walk all mount entries and dropping any unused mounts. This affects all * mounts: * - that are implicitly protected by a path that has been rendered inaccessible @@ -1776,17 +1773,18 @@ static size_t namespace_calculate_mounts( * - that are outside of the relevant root directory * - which are duplicates */ -static void drop_unused_mounts(const char *root_directory, MountEntry *mounts, size_t *n_mounts) { +static void drop_unused_mounts(MountList *ml, const char *root_directory) { + assert(ml); assert(root_directory); - assert(n_mounts); - assert(mounts || *n_mounts == 0); - typesafe_qsort(mounts, *n_mounts, mount_path_compare); + assert(ml->mounts || ml->n_mounts == 0); + + typesafe_qsort(ml->mounts, ml->n_mounts, mount_path_compare); - drop_duplicates(mounts, n_mounts); - drop_outside_root(root_directory, mounts, n_mounts); - drop_inaccessible(mounts, n_mounts); - drop_nop(mounts, n_mounts); + drop_duplicates(ml); + drop_outside_root(ml, root_directory); + drop_inaccessible(ml); + drop_nop(ml); } static int create_symlinks_from_tuples(const char *root, char **strv_symlinks) { @@ -1853,22 +1851,21 @@ static void mount_entry_path_debug_string(const char *root, MountEntry *m, char } static int apply_mounts( + MountList *ml, const char *root, const NamespaceParameters *p, - MountEntry *mounts, - size_t *n_mounts, char **error_path) { _cleanup_fclose_ FILE *proc_self_mountinfo = NULL; _cleanup_free_ char **deny_list = NULL; int r; - if (n_mounts == 0) /* Shortcut: nothing to do */ - return 0; - + assert(ml); assert(root); - assert(mounts); - assert(n_mounts); + assert(p); + + if (ml->n_mounts == 0) /* Shortcut: nothing to do */ + return 0; /* Open /proc/self/mountinfo now as it may become unavailable if we mount anything on top of * /proc. For example, this is the case with the option: 'InaccessiblePaths=/proc'. */ @@ -1886,7 +1883,7 @@ static int apply_mounts( for (;;) { bool again = false; - for (MountEntry *m = mounts; m < mounts + *n_mounts; ++m) { + FOREACH_ARRAY(m, ml->mounts, ml->n_mounts) { if (m->applied) continue; @@ -1918,7 +1915,7 @@ static int apply_mounts( if (!again) break; - drop_unused_mounts(root, mounts, n_mounts); + drop_unused_mounts(ml, root); } /* Now that all filesystems have been set up, but before the @@ -1930,15 +1927,15 @@ static int apply_mounts( return log_debug_errno(r, "Failed to set up symlinks inside mount namespace: %m"); /* Create a deny list we can pass to bind_mount_recursive() */ - deny_list = new(char*, (*n_mounts)+1); + deny_list = new(char*, ml->n_mounts+1); if (!deny_list) return -ENOMEM; - for (size_t j = 0; j < *n_mounts; j++) - deny_list[j] = (char*) mount_entry_path(mounts+j); - deny_list[*n_mounts] = NULL; + for (size_t j = 0; j < ml->n_mounts; j++) + deny_list[j] = (char*) mount_entry_path(ml->mounts+j); + deny_list[ml->n_mounts] = NULL; /* Second round, flip the ro bits if necessary. */ - for (MountEntry *m = mounts; m < mounts + *n_mounts; ++m) { + FOREACH_ARRAY(m, ml->mounts, ml->n_mounts) { r = make_read_only(m, deny_list, proc_self_mountinfo); if (r < 0) { mount_entry_path_debug_string(root, m, error_path); @@ -1947,12 +1944,12 @@ static int apply_mounts( } /* Third round, flip the noexec bits with a simplified deny list. */ - for (size_t j = 0; j < *n_mounts; j++) - if (IN_SET((mounts+j)->mode, EXEC, NOEXEC)) - deny_list[j] = (char*) mount_entry_path(mounts+j); - deny_list[*n_mounts] = NULL; + for (size_t j = 0; j < ml->n_mounts; j++) + if (IN_SET((ml->mounts+j)->mode, EXEC, NOEXEC)) + deny_list[j] = (char*) mount_entry_path(ml->mounts+j); + deny_list[ml->n_mounts] = NULL; - for (MountEntry *m = mounts; m < mounts + *n_mounts; ++m) { + FOREACH_ARRAY(m, ml->mounts, ml->n_mounts) { r = make_noexec(m, deny_list, proc_self_mountinfo); if (r < 0) { mount_entry_path_debug_string(root, m, error_path); @@ -1962,7 +1959,7 @@ static int apply_mounts( /* Fourth round, flip the nosuid bits without a deny list. */ if (p->mount_nosuid) - for (MountEntry *m = mounts; m < mounts + *n_mounts; ++m) { + FOREACH_ARRAY(m, ml->mounts, ml->n_mounts) { r = make_nosuid(m, proc_self_mountinfo); if (r < 0) { mount_entry_path_debug_string(root, m, error_path); @@ -2027,7 +2024,7 @@ int setup_namespace(const NamespaceParameters *p, char **error_path) { _cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL; _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL; _cleanup_strv_free_ char **hierarchies = NULL; - MountEntry *m = NULL, *mounts = NULL; + _cleanup_(mount_list_done) MountList ml = {}; bool require_prefix = false; const char *root; DissectImageFlags dissect_image_flags = @@ -2040,7 +2037,6 @@ int setup_namespace(const NamespaceParameters *p, char **error_path) { DISSECT_IMAGE_GROWFS | DISSECT_IMAGE_ADD_PARTITION_DEVICES | DISSECT_IMAGE_PIN_PARTITION_DEVICES; - size_t n_mounts; int r; assert(p); @@ -2127,276 +2123,329 @@ int setup_namespace(const NamespaceParameters *p, char **error_path) { return r; } - n_mounts = namespace_calculate_mounts( - p, - hierarchies, - setup_propagate); + r = append_access_mounts(&ml, p->read_write_paths, READWRITE, require_prefix); + if (r < 0) + return r; - if (n_mounts > 0) { - m = mounts = new0(MountEntry, n_mounts); - if (!mounts) - return -ENOMEM; + r = append_access_mounts(&ml, p->read_only_paths, READONLY, require_prefix); + if (r < 0) + return r; - r = append_access_mounts(&m, p->read_write_paths, READWRITE, require_prefix); - if (r < 0) - goto finish; + r = append_access_mounts(&ml, p->inaccessible_paths, INACCESSIBLE, require_prefix); + if (r < 0) + return r; - r = append_access_mounts(&m, p->read_only_paths, READONLY, require_prefix); - if (r < 0) - goto finish; + r = append_access_mounts(&ml, p->exec_paths, EXEC, require_prefix); + if (r < 0) + return r; - r = append_access_mounts(&m, p->inaccessible_paths, INACCESSIBLE, require_prefix); - if (r < 0) - goto finish; + r = append_access_mounts(&ml, p->no_exec_paths, NOEXEC, require_prefix); + if (r < 0) + return r; + + r = append_empty_dir_mounts(&ml, p->empty_directories); + if (r < 0) + return r; + + r = append_bind_mounts(&ml, p->bind_mounts, p->n_bind_mounts); + if (r < 0) + return r; + + r = append_tmpfs_mounts(&ml, p->temporary_filesystems, p->n_temporary_filesystems); + if (r < 0) + return r; - r = append_access_mounts(&m, p->exec_paths, EXEC, require_prefix); + if (p->tmp_dir) { + bool ro = streq(p->tmp_dir, RUN_SYSTEMD_EMPTY); + + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { + .path_const = "/tmp", + .mode = ro ? PRIVATE_TMP_READONLY : PRIVATE_TMP, + .source_const = p->tmp_dir, + }; + } + + if (p->var_tmp_dir) { + bool ro = streq(p->var_tmp_dir, RUN_SYSTEMD_EMPTY); + + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { + .path_const = "/var/tmp", + .mode = ro ? PRIVATE_TMP_READONLY : PRIVATE_TMP, + .source_const = p->var_tmp_dir, + }; + } + + r = append_mount_images(&ml, p->mount_images, p->n_mount_images); + if (r < 0) + return r; + + r = append_extensions(&ml, root, p->extension_dir, hierarchies, p->extension_images, p->n_extension_images, p->extension_directories); + if (r < 0) + return r; + + if (p->private_dev) { + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { + .path_const = "/dev", + .mode = PRIVATE_DEV, + .flags = DEV_MOUNT_OPTIONS, + }; + } + + /* In case /proc is successfully mounted with pid tree subset only (ProcSubset=pid), the protective + mounts to non-pid /proc paths would fail. But the pid only option may have failed gracefully, so + let's try the mounts but it's not fatal if they don't succeed. */ + bool ignore_protect_proc = p->ignore_protect_paths || p->proc_subset == PROC_SUBSET_PID; + if (p->protect_kernel_tunables) { + r = append_static_mounts(&ml, + protect_kernel_tunables_proc_table, + ELEMENTSOF(protect_kernel_tunables_proc_table), + ignore_protect_proc); if (r < 0) - goto finish; + return r; - r = append_access_mounts(&m, p->no_exec_paths, NOEXEC, require_prefix); + r = append_static_mounts(&ml, + protect_kernel_tunables_sys_table, + ELEMENTSOF(protect_kernel_tunables_sys_table), + p->ignore_protect_paths); if (r < 0) - goto finish; + return r; + } - r = append_empty_dir_mounts(&m, p->empty_directories); + if (p->protect_kernel_modules) { + r = append_static_mounts(&ml, + protect_kernel_modules_table, + ELEMENTSOF(protect_kernel_modules_table), + p->ignore_protect_paths); if (r < 0) - goto finish; + return r; + } - r = append_bind_mounts(&m, p->bind_mounts, p->n_bind_mounts); + if (p->protect_kernel_logs) { + r = append_static_mounts(&ml, + protect_kernel_logs_proc_table, + ELEMENTSOF(protect_kernel_logs_proc_table), + ignore_protect_proc); if (r < 0) - goto finish; + return r; - r = append_tmpfs_mounts(&m, p->temporary_filesystems, p->n_temporary_filesystems); + r = append_static_mounts(&ml, + protect_kernel_logs_dev_table, + ELEMENTSOF(protect_kernel_logs_dev_table), + p->ignore_protect_paths); if (r < 0) - goto finish; + return r; + } - if (p->tmp_dir) { - bool ro = streq(p->tmp_dir, RUN_SYSTEMD_EMPTY); + if (p->protect_control_groups) { + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); - *(m++) = (MountEntry) { - .path_const = "/tmp", - .mode = ro ? PRIVATE_TMP_READONLY : PRIVATE_TMP, - .source_const = p->tmp_dir, - }; - } + *me = (MountEntry) { + .path_const = "/sys/fs/cgroup", + .mode = READONLY, + }; + } - if (p->var_tmp_dir) { - bool ro = streq(p->var_tmp_dir, RUN_SYSTEMD_EMPTY); + r = append_protect_home(&ml, p->protect_home, p->ignore_protect_paths); + if (r < 0) + return r; - *(m++) = (MountEntry) { - .path_const = "/var/tmp", - .mode = ro ? PRIVATE_TMP_READONLY : PRIVATE_TMP, - .source_const = p->var_tmp_dir, - }; - } + r = append_protect_system(&ml, p->protect_system, false); + if (r < 0) + return r; - r = append_mount_images(&m, p->mount_images, p->n_mount_images); + if (namespace_parameters_mount_apivfs(p)) { + r = append_static_mounts(&ml, + apivfs_table, + ELEMENTSOF(apivfs_table), + p->ignore_protect_paths); if (r < 0) - goto finish; + return r; + } - r = append_extensions(&m, root, p->extension_dir, hierarchies, p->extension_images, p->n_extension_images, p->extension_directories); - if (r < 0) - goto finish; - - if (p->private_dev) - *(m++) = (MountEntry) { - .path_const = "/dev", - .mode = PRIVATE_DEV, - .flags = DEV_MOUNT_OPTIONS, - }; - - /* In case /proc is successfully mounted with pid tree subset only (ProcSubset=pid), the - protective mounts to non-pid /proc paths would fail. But the pid only option may have - failed gracefully, so let's try the mounts but it's not fatal if they don't succeed. */ - bool ignore_protect_proc = p->ignore_protect_paths || p->proc_subset == PROC_SUBSET_PID; - if (p->protect_kernel_tunables) { - r = append_static_mounts(&m, - protect_kernel_tunables_proc_table, - ELEMENTSOF(protect_kernel_tunables_proc_table), - ignore_protect_proc); - if (r < 0) - goto finish; + /* Note, if proc is mounted with subset=pid then neither of the two paths will exist, i.e. they are + * implicitly protected by the mount option. */ + if (p->protect_hostname) { + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); - r = append_static_mounts(&m, - protect_kernel_tunables_sys_table, - ELEMENTSOF(protect_kernel_tunables_sys_table), - p->ignore_protect_paths); - if (r < 0) - goto finish; - } + *me = (MountEntry) { + .path_const = "/proc/sys/kernel/hostname", + .mode = READONLY, + .ignore = ignore_protect_proc, + }; - if (p->protect_kernel_modules) { - r = append_static_mounts(&m, - protect_kernel_modules_table, - ELEMENTSOF(protect_kernel_modules_table), - p->ignore_protect_paths); - if (r < 0) - goto finish; - } + me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); - if (p->protect_kernel_logs) { - r = append_static_mounts(&m, - protect_kernel_logs_proc_table, - ELEMENTSOF(protect_kernel_logs_proc_table), - ignore_protect_proc); - if (r < 0) - goto finish; + *me = (MountEntry) { + .path_const = "/proc/sys/kernel/domainname", + .mode = READONLY, + .ignore = ignore_protect_proc, + }; + } - r = append_static_mounts(&m, - protect_kernel_logs_dev_table, - ELEMENTSOF(protect_kernel_logs_dev_table), - p->ignore_protect_paths); - if (r < 0) - goto finish; - } + if (p->private_network) { + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); - if (p->protect_control_groups) - *(m++) = (MountEntry) { - .path_const = "/sys/fs/cgroup", - .mode = READONLY, - }; + *me = (MountEntry) { + .path_const = "/sys", + .mode = PRIVATE_SYSFS, + }; + } - r = append_protect_home(&m, p->protect_home, p->ignore_protect_paths); - if (r < 0) - goto finish; + if (p->private_ipc) { + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); - r = append_protect_system(&m, p->protect_system, false); - if (r < 0) - goto finish; + *me = (MountEntry) { + .path_const = "/dev/mqueue", + .mode = MQUEUEFS, + .flags = MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_RELATIME, + }; + } - if (namespace_parameters_mount_apivfs(p)) { - r = append_static_mounts(&m, - apivfs_table, - ELEMENTSOF(apivfs_table), - p->ignore_protect_paths); - if (r < 0) - goto finish; - } + if (p->creds_path) { + /* If our service has a credentials store configured, then bind that one in, but hide + * everything else. */ - /* Note, if proc is mounted with subset=pid then neither of the - * two paths will exist, i.e. they are implicitly protected by - * the mount option. */ - if (p->protect_hostname) { - *(m++) = (MountEntry) { - .path_const = "/proc/sys/kernel/hostname", - .mode = READONLY, - .ignore = ignore_protect_proc, - }; - *(m++) = (MountEntry) { - .path_const = "/proc/sys/kernel/domainname", - .mode = READONLY, - .ignore = ignore_protect_proc, - }; - } + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); - if (p->private_network) - *(m++) = (MountEntry) { - .path_const = "/sys", - .mode = PRIVATE_SYSFS, - }; - - if (p->private_ipc) - *(m++) = (MountEntry) { - .path_const = "/dev/mqueue", - .mode = MQUEUEFS, - .flags = MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_RELATIME, - }; - - if (p->creds_path) { - /* If our service has a credentials store configured, then bind that one in, but hide - * everything else. */ - - *(m++) = (MountEntry) { - .path_const = "/run/credentials", - .mode = TMPFS, - .read_only = true, - .options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST, - .flags = MS_NODEV|MS_STRICTATIME|MS_NOSUID|MS_NOEXEC, - }; - - *(m++) = (MountEntry) { - .path_const = p->creds_path, - .mode = BIND_MOUNT, - .read_only = true, - .source_const = p->creds_path, - .ignore = true, - }; - } else { - /* If our service has no credentials store configured, then make the whole - * credentials tree inaccessible wholesale. */ - - *(m++) = (MountEntry) { - .path_const = "/run/credentials", - .mode = INACCESSIBLE, - .ignore = true, - }; - } + *me = (MountEntry) { + .path_const = "/run/credentials", + .mode = TMPFS, + .read_only = true, + .options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST, + .flags = MS_NODEV|MS_STRICTATIME|MS_NOSUID|MS_NOEXEC, + }; - if (p->log_namespace) { - _cleanup_free_ char *q = NULL; + me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); - q = strjoin("/run/systemd/journal.", p->log_namespace); - if (!q) { - r = -ENOMEM; - goto finish; - } + *me = (MountEntry) { + .path_const = p->creds_path, + .mode = BIND_MOUNT, + .read_only = true, + .source_const = p->creds_path, + .ignore = true, + }; + } else { + /* If our service has no credentials store configured, then make the whole credentials tree + * inaccessible wholesale. */ - *(m++) = (MountEntry) { - .path_const = "/run/systemd/journal", - .mode = BIND_MOUNT_RECURSIVE, - .read_only = true, - .source_malloc = TAKE_PTR(q), - }; - } + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); - /* Will be used to add bind mounts at runtime */ - if (setup_propagate) - *(m++) = (MountEntry) { - .source_const = p->propagate_dir, - .path_const = p->incoming_dir, - .mode = BIND_MOUNT, - .read_only = true, - }; - - if (p->notify_socket) - *(m++) = (MountEntry) { - .path_const = p->notify_socket, - .source_const = p->notify_socket, - .mode = BIND_MOUNT, - .read_only = true, - }; - - if (p->host_os_release_stage) - *(m++) = (MountEntry) { - .path_const = "/run/host/.os-release-stage/", - .source_const = p->host_os_release_stage, - .mode = BIND_MOUNT, - .read_only = true, - .ignore = true, /* Live copy, don't hard-fail if it goes missing */ - }; - - assert(mounts + n_mounts == m); - - /* Prepend the root directory where that's necessary */ - r = prefix_where_needed(mounts, n_mounts, root); - if (r < 0) - goto finish; + *me = (MountEntry) { + .path_const = "/run/credentials", + .mode = INACCESSIBLE, + .ignore = true, + }; + } + + if (p->log_namespace) { + _cleanup_free_ char *q = NULL; + + q = strjoin("/run/systemd/journal.", p->log_namespace); + if (!q) + return log_oom(); - drop_unused_mounts(root, mounts, &n_mounts); + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { + .path_const = "/run/systemd/journal", + .mode = BIND_MOUNT_RECURSIVE, + .read_only = true, + .source_malloc = TAKE_PTR(q), + }; } + /* Will be used to add bind mounts at runtime */ + if (setup_propagate) { + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { + .source_const = p->propagate_dir, + .path_const = p->incoming_dir, + .mode = BIND_MOUNT, + .read_only = true, + }; + } + + if (p->notify_socket) { + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { + .path_const = p->notify_socket, + .source_const = p->notify_socket, + .mode = BIND_MOUNT, + .read_only = true, + }; + } + + if (p->host_os_release_stage) { + MountEntry *me = mount_list_extend(&ml); + if (!me) + return log_oom_debug(); + + *me = (MountEntry) { + .path_const = "/run/host/.os-release-stage/", + .source_const = p->host_os_release_stage, + .mode = BIND_MOUNT, + .read_only = true, + .ignore = true, /* Live copy, don't hard-fail if it goes missing */ + }; + } + + /* Prepend the root directory where that's necessary */ + r = prefix_where_needed(&ml, root); + if (r < 0) + return r; + + drop_unused_mounts(&ml, root); + /* All above is just preparation, figuring out what to do. Let's now actually start doing something. */ if (unshare(CLONE_NEWNS) < 0) { r = log_debug_errno(errno, "Failed to unshare the mount namespace: %m"); + if (ERRNO_IS_PRIVILEGE(r) || ERRNO_IS_NOT_SUPPORTED(r)) /* If the kernel doesn't support namespaces, or when there's a MAC or seccomp filter * in place that doesn't allow us to create namespaces (or a missing cap), then * propagate a recognizable error back, which the caller can use to detect this case * (and only this) and optionally continue without namespacing applied. */ - r = -ENOANO; + return -ENOANO; - goto finish; + return r; } /* Create the source directory to allow runtime propagation of mounts */ @@ -2410,10 +2459,8 @@ int setup_namespace(const NamespaceParameters *p, char **error_path) { /* Remount / as SLAVE so that nothing now mounted in the namespace * shows up in the parent */ - if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) { - r = log_debug_errno(errno, "Failed to remount '/' as SLAVE: %m"); - goto finish; - } + if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) + return log_debug_errno(errno, "Failed to remount '/' as SLAVE: %m"); if (p->root_image) { /* A root image is specified, mount it to the right place */ @@ -2424,44 +2471,36 @@ int setup_namespace(const NamespaceParameters *p, char **error_path) { /* uid_range= */ UID_INVALID, /* userns_fd= */ -EBADF, dissect_image_flags); - if (r < 0) { - log_debug_errno(r, "Failed to mount root image: %m"); - goto finish; - } + if (r < 0) + return log_debug_errno(r, "Failed to mount root image: %m"); /* Now release the block device lock, so that udevd is free to call BLKRRPART on the device * if it likes. */ r = loop_device_flock(loop_device, LOCK_UN); - if (r < 0) { - log_debug_errno(r, "Failed to release lock on loopback block device: %m"); - goto finish; - } + if (r < 0) + return log_debug_errno(r, "Failed to release lock on loopback block device: %m"); r = dissected_image_relinquish(dissected_image); - if (r < 0) { - log_debug_errno(r, "Failed to relinquish dissected image: %m"); - goto finish; - } + if (r < 0) + return log_debug_errno(r, "Failed to relinquish dissected image: %m"); } else if (p->root_directory) { /* A root directory is specified. Turn its directory into bind mount, if it isn't one yet. */ r = path_is_mount_point(root, NULL, AT_SYMLINK_FOLLOW); - if (r < 0) { - log_debug_errno(r, "Failed to detect that %s is a mount point or not: %m", root); - goto finish; - } + if (r < 0) + return log_debug_errno(r, "Failed to detect that %s is a mount point or not: %m", root); if (r == 0) { r = mount_nofollow_verbose(LOG_DEBUG, root, root, NULL, MS_BIND|MS_REC, NULL); if (r < 0) - goto finish; + return r; } } else { /* Let's mount the main root directory to the root directory to use */ r = mount_nofollow_verbose(LOG_DEBUG, "/", root, NULL, MS_BIND|MS_REC, NULL); if (r < 0) - goto finish; + return r; } /* Try to set up the new root directory before mounting anything else there. */ @@ -2469,12 +2508,9 @@ int setup_namespace(const NamespaceParameters *p, char **error_path) { (void) base_filesystem_create(root, UID_INVALID, GID_INVALID); /* Now make the magic happen */ - r = apply_mounts(root, - p, - mounts, &n_mounts, - error_path); + r = apply_mounts(&ml, root, p, error_path); if (r < 0) - goto finish; + return r; /* MS_MOVE does not work on MS_SHARED so the remount MS_SHARED will be done later */ r = mount_switch_root(root, /* mount_propagation_flag = */ 0); @@ -2486,41 +2522,25 @@ int setup_namespace(const NamespaceParameters *p, char **error_path) { * mount point) and try again. */ r = mount_nofollow_verbose(LOG_DEBUG, root, root, NULL, MS_BIND|MS_REC, NULL); if (r < 0) - goto finish; + return r; r = mount_switch_root(root, /* mount_propagation_flag = */ 0); } - if (r < 0) { - log_debug_errno(r, "Failed to mount root with MS_MOVE: %m"); - goto finish; - } + if (r < 0) + return log_debug_errno(r, "Failed to mount root with MS_MOVE: %m"); /* Remount / as the desired mode. Note that this will not reestablish propagation from our side to * the host, since what's disconnected is disconnected. */ - if (mount(NULL, "/", NULL, mount_propagation_flag | MS_REC, NULL) < 0) { - r = log_debug_errno(errno, "Failed to remount '/' with desired mount flags: %m"); - goto finish; - } + if (mount(NULL, "/", NULL, mount_propagation_flag | MS_REC, NULL) < 0) + return log_debug_errno(errno, "Failed to remount '/' with desired mount flags: %m"); /* bind_mount_in_namespace() will MS_MOVE into that directory, and that's only * supported for non-shared mounts. This needs to happen after remounting / or it will fail. */ if (setup_propagate) { - r = mount(NULL, p->incoming_dir, NULL, MS_SLAVE, NULL); - if (r < 0) { - log_error_errno(r, "Failed to remount %s with MS_SLAVE: %m", p->incoming_dir); - goto finish; - } + if (mount(NULL, p->incoming_dir, NULL, MS_SLAVE, NULL) < 0) + return log_debug_errno(errno, "Failed to remount %s with MS_SLAVE: %m", p->incoming_dir); } - r = 0; - -finish: - if (n_mounts > 0) - for (m = mounts; m < mounts + n_mounts; m++) - mount_entry_done(m); - - free(mounts); - - return r; + return 0; } void bind_mount_free_many(BindMount *b, size_t n) { |