From e2ec9c4d3abf49e95565574214f8979d819e3f48 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sun, 2 Feb 2020 18:56:12 +0100 Subject: [PATCH 1/7] namespace-util: introduce helper for combining unshare() + MS_SLAVE remount We have multiple places we do these two non-trivial operations together, let's introduce a unified helper for doing both at once. --- src/basic/namespace-util.c | 14 ++++++++++++++ src/basic/namespace-util.h | 2 ++ src/core/machine-id-setup.c | 8 +++----- src/shared/tests.c | 6 ++---- src/test/test-udev.c | 13 ++++++------- 5 files changed, 27 insertions(+), 16 deletions(-) diff --git a/src/basic/namespace-util.c b/src/basic/namespace-util.c index b0168ae227c..b34c532604a 100644 --- a/src/basic/namespace-util.c +++ b/src/basic/namespace-util.c @@ -2,6 +2,7 @@ #include #include +#include #include "fd-util.h" #include "missing_fs.h" @@ -169,3 +170,16 @@ int fd_is_network_ns(int fd) { return r == CLONE_NEWNET; } + +int detach_mount_namespace(void) { + + /* Detaches the mount namespace, disabling propagation from our namespace to the host */ + + if (unshare(CLONE_NEWNS) < 0) + return -errno; + + if (mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL) < 0) + return -errno; + + return 0; +} diff --git a/src/basic/namespace-util.h b/src/basic/namespace-util.h index 8c17ce91b21..99d9b977edf 100644 --- a/src/basic/namespace-util.h +++ b/src/basic/namespace-util.h @@ -7,3 +7,5 @@ int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *netns_fd, int * int namespace_enter(int pidns_fd, int mntns_fd, int netns_fd, int userns_fd, int root_fd); int fd_is_network_ns(int fd); + +int detach_mount_namespace(void); diff --git a/src/core/machine-id-setup.c b/src/core/machine-id-setup.c index 284b77c1fcc..f76b82a8a45 100644 --- a/src/core/machine-id-setup.c +++ b/src/core/machine-id-setup.c @@ -223,11 +223,9 @@ int machine_id_commit(const char *root) { return log_error_errno(r, "Can't fetch current mount namespace: %m"); /* Switch to a new mount namespace, isolate ourself and unmount etc_machine_id in our new namespace */ - if (unshare(CLONE_NEWNS) < 0) - return log_error_errno(errno, "Failed to enter new namespace: %m"); - - if (mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL) < 0) - return log_error_errno(errno, "Couldn't make-rslave / mountpoint in our private namespace: %m"); + r = detach_mount_namespace(); + if (r < 0) + return log_error_errno(r, "Failed to set up new mount namespace: %m"); if (umount(etc_machine_id) < 0) return log_error_errno(errno, "Failed to unmount transient %s file in our private namespace: %m", etc_machine_id); diff --git a/src/shared/tests.c b/src/shared/tests.c index ecf8e8f6237..ff662ecfe0c 100644 --- a/src/shared/tests.c +++ b/src/shared/tests.c @@ -21,6 +21,7 @@ #include "env-util.h" #include "fs-util.h" #include "log.h" +#include "namespace-util.h" #include "path-util.h" #include "random-util.h" #include "strv.h" @@ -137,10 +138,7 @@ bool have_namespaces(void) { if (pid == 0) { /* child */ - if (unshare(CLONE_NEWNS) < 0) - _exit(EXIT_FAILURE); - - if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) + if (detach_mount_namespace() < 0) _exit(EXIT_FAILURE); _exit(EXIT_SUCCESS); diff --git a/src/test/test-udev.c b/src/test/test-udev.c index 208e7a0e96a..c0b215dadc4 100644 --- a/src/test/test-udev.c +++ b/src/test/test-udev.c @@ -17,6 +17,7 @@ #include "log.h" #include "main-func.h" #include "mkdir.h" +#include "namespace-util.h" #include "selinux-util.h" #include "signal-util.h" #include "string-util.h" @@ -36,15 +37,13 @@ static int fake_filesystems(void) { { "test/run", "/etc/udev/rules.d", "Failed to mount empty /etc/udev/rules.d", true }, { "test/run", UDEVLIBEXECDIR "/rules.d", "Failed to mount empty " UDEVLIBEXECDIR "/rules.d", true }, }; - unsigned i; + int r; - if (unshare(CLONE_NEWNS) < 0) - return log_error_errno(errno, "Failed to call unshare(): %m"); + r = detach_mount_namespace(); + if (r < 0) + return log_error_errno(r, "Failed to detach mount namespace: %m"); - if (mount(NULL, "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) - return log_error_errno(errno, "Failed to mount / as private: %m"); - - for (i = 0; i < ELEMENTSOF(fakefss); i++) + for (size_t i = 0; i < ELEMENTSOF(fakefss); i++) if (mount(fakefss[i].src, fakefss[i].target, NULL, MS_BIND, NULL) < 0) { log_full_errno(fakefss[i].ignore_mount_error ? LOG_DEBUG : LOG_ERR, errno, "%s: %m", fakefss[i].error); if (!fakefss[i].ignore_mount_error) From e49ee28522d4cf24b03359ba30eb2a3a0054e085 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sat, 27 Jun 2020 10:38:07 +0200 Subject: [PATCH 2/7] mount-util: add destructor helper that umounts + rmdirs a path --- src/shared/mount-util.h | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/shared/mount-util.h b/src/shared/mount-util.h index bcbd32c8404..5934d716786 100644 --- a/src/shared/mount-util.h +++ b/src/shared/mount-util.h @@ -3,7 +3,9 @@ #include #include +#include +#include "errno-util.h" #include "macro.h" /* 4MB for contents of regular files, 64k inodes for directories, symbolic links and device specials, @@ -53,3 +55,12 @@ int mount_option_mangle( char **ret_remaining_options); int mode_to_inaccessible_node(const char *runtime_dir, mode_t mode, char **dest); + +/* Useful for usage with _cleanup_(), unmounts, removes a directory and frees the pointer */ +static inline void umount_and_rmdir_and_free(char *p) { + PROTECT_ERRNO; + (void) umount_recursive(p, 0); + (void) rmdir(p); + free(p); +} +DEFINE_TRIVIAL_CLEANUP_FUNC(char*, umount_and_rmdir_and_free); From 827ea5212507c3833b6ae14cdf65e446b36b5e05 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sat, 27 Jun 2020 11:13:01 +0200 Subject: [PATCH 3/7] mount-util: use UMOUNT_NOFOLLOW in recursive umounter When we only want to unmount mount points below some path then it is against our interest to follow symlinks. Hence don't. --- src/shared/mount-util.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/shared/mount-util.c b/src/shared/mount-util.c index 45fdd3b2da7..b3fac13f7ee 100644 --- a/src/shared/mount-util.c +++ b/src/shared/mount-util.c @@ -58,8 +58,8 @@ int umount_recursive(const char *prefix, int flags) { if (!path_startswith(path, prefix)) continue; - if (umount2(path, flags) < 0) { - r = log_debug_errno(errno, "Failed to umount %s: %m", path); + if (umount2(path, flags | UMOUNT_NOFOLLOW) < 0) { + log_debug_errno(errno, "Failed to umount %s, ignoring: %m", path); continue; } @@ -70,7 +70,6 @@ int umount_recursive(const char *prefix, int flags) { break; } - } while (again); return n; From 3ff9fa591e885b0517336d52bdd6e653dbb765f9 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 30 Mar 2020 15:39:43 +0200 Subject: [PATCH 4/7] firstboot: add --image= switch This is like --root=, but takes an image file path or device node path and dissects the image directly, mounting it internally. --- src/firstboot/firstboot.c | 114 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 108 insertions(+), 6 deletions(-) diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c index 0c3ef3e2a7e..6d22fbc081b 100644 --- a/src/firstboot/firstboot.c +++ b/src/firstboot/firstboot.c @@ -2,6 +2,7 @@ #include #include +#include #include #include "sd-id128.h" @@ -9,6 +10,7 @@ #include "alloc-util.h" #include "ask-password-api.h" #include "copy.h" +#include "dissect-image.h" #include "env-file.h" #include "fd-util.h" #include "fileio.h" @@ -17,9 +19,12 @@ #include "kbd-util.h" #include "libcrypt-util.h" #include "locale-util.h" +#include "loop-util.h" #include "main-func.h" #include "memory-util.h" #include "mkdir.h" +#include "mount-util.h" +#include "namespace-util.h" #include "os-util.h" #include "parse-util.h" #include "path-util.h" @@ -31,10 +36,12 @@ #include "terminal-util.h" #include "time-util.h" #include "tmpfile-util-label.h" +#include "tmpfile-util.h" #include "umask-util.h" #include "user-util.h" static char *arg_root = NULL; +static char *arg_image = NULL; static char *arg_locale = NULL; /* $LANG */ static char *arg_keymap = NULL; static char *arg_locale_messages = NULL; /* $LC_MESSAGES */ @@ -57,6 +64,7 @@ static bool arg_delete_root_password = false; static bool arg_root_password_is_hashed = false; STATIC_DESTRUCTOR_REGISTER(arg_root, freep); +STATIC_DESTRUCTOR_REGISTER(arg_image, freep); STATIC_DESTRUCTOR_REGISTER(arg_locale, freep); STATIC_DESTRUCTOR_REGISTER(arg_locale_messages, freep); STATIC_DESTRUCTOR_REGISTER(arg_keymap, freep); @@ -826,6 +834,75 @@ static int process_kernel_cmdline(void) { return 0; } +static int setup_image(char **ret_mount_dir, LoopDevice **ret_loop_device, DecryptedImage **ret_decrypted_image) { + DissectImageFlags f = DISSECT_IMAGE_REQUIRE_ROOT|DISSECT_IMAGE_VALIDATE_OS|DISSECT_IMAGE_RELAX_VAR_CHECK|DISSECT_IMAGE_FSCK; + _cleanup_(loop_device_unrefp) LoopDevice *d = NULL; + _cleanup_(decrypted_image_unrefp) DecryptedImage *decrypted_image = NULL; + _cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL; + _cleanup_(rmdir_and_freep) char *mount_dir = NULL; + _cleanup_free_ char *temp = NULL; + int r; + + if (!arg_image) { + *ret_mount_dir = NULL; + *ret_decrypted_image = NULL; + *ret_loop_device = NULL; + return 0; + } + + assert(!arg_root); + + r = tempfn_random_child(NULL, "firstboot", &temp); + if (r < 0) + return log_error_errno(r, "Failed to generate temporary mount directory: %m"); + + r = loop_device_make_by_path(arg_image, O_RDWR, LO_FLAGS_PARTSCAN, &d); + if (r < 0) + return log_error_errno(r, "Failed to set up loopback device: %m"); + + r = dissect_image_and_warn(d->fd, arg_image, NULL, 0, NULL, f, &dissected_image); + if (r < 0) + return r; + + r = dissected_image_decrypt_interactively(dissected_image, NULL, NULL, 0, NULL, NULL, NULL, 0, f, &decrypted_image); + if (r < 0) + return r; + + r = detach_mount_namespace(); + if (r < 0) + return log_error_errno(r, "Failed to detach mount namespace: %m"); + + mount_dir = strdup(temp); + if (!mount_dir) + return log_oom(); + + r = mkdir_p(mount_dir, 0700); + if (r < 0) { + mount_dir = mfree(mount_dir); + return log_error_errno(r, "Failed to create mount point: %m"); + } + + r = dissected_image_mount(dissected_image, mount_dir, UID_INVALID, f); + if (r < 0) + return log_error_errno(r, "Failed to mount image: %m"); + + if (decrypted_image) { + r = decrypted_image_relinquish(decrypted_image); + if (r < 0) + return log_error_errno(r, "Failed to relinquish DM devices: %m"); + } + + loop_device_relinquish(d); + + arg_root = TAKE_PTR(temp); + + *ret_mount_dir = TAKE_PTR(mount_dir); + *ret_decrypted_image = TAKE_PTR(decrypted_image); + *ret_loop_device = TAKE_PTR(d); + + return 1; +} + static int help(void) { _cleanup_free_ char *link = NULL; int r; @@ -839,6 +916,7 @@ static int help(void) { " -h --help Show this help\n" " --version Show package version\n" " --root=PATH Operate on an alternate filesystem root\n" + " --image=PATH Operate on an alternate filesystem image\n" " --locale=LOCALE Set primary locale (LANG=)\n" " --locale-messages=LOCALE Set message locale (LC_MESSAGES=)\n" " --keymap=KEYMAP Set keymap\n" @@ -875,6 +953,7 @@ static int parse_argv(int argc, char *argv[]) { enum { ARG_VERSION = 0x100, ARG_ROOT, + ARG_IMAGE, ARG_LOCALE, ARG_LOCALE_MESSAGES, ARG_KEYMAP, @@ -905,6 +984,7 @@ static int parse_argv(int argc, char *argv[]) { { "help", no_argument, NULL, 'h' }, { "version", no_argument, NULL, ARG_VERSION }, { "root", required_argument, NULL, ARG_ROOT }, + { "image", required_argument, NULL, ARG_IMAGE }, { "locale", required_argument, NULL, ARG_LOCALE }, { "locale-messages", required_argument, NULL, ARG_LOCALE_MESSAGES }, { "keymap", required_argument, NULL, ARG_KEYMAP }, @@ -953,6 +1033,12 @@ static int parse_argv(int argc, char *argv[]) { return r; break; + case ARG_IMAGE: + r = parse_path_argument_and_warn(optarg, false, &arg_image); + if (r < 0) + return r; + break; + case ARG_LOCALE: r = free_and_strdup(&arg_locale, optarg); if (r < 0) @@ -1086,7 +1172,6 @@ static int parse_argv(int argc, char *argv[]) { break; case ARG_SETUP_MACHINE_ID: - r = sd_id128_randomize(&arg_machine_id); if (r < 0) return log_error_errno(r, "Failed to generate randomized machine ID: %m"); @@ -1120,11 +1205,16 @@ static int parse_argv(int argc, char *argv[]) { return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--delete-root-password cannot be combined with other root password options"); + if (arg_image && arg_root) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Please specify either --root= or --image=, the combination of both is not supported."); + return 1; } static int run(int argc, char *argv[]) { - bool enabled; + _cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL; + _cleanup_(decrypted_image_unrefp) DecryptedImage *decrypted_image = NULL; + _cleanup_(umount_and_rmdir_and_freep) char *unlink_dir = NULL; int r; r = parse_argv(argc, argv); @@ -1135,11 +1225,23 @@ static int run(int argc, char *argv[]) { umask(0022); - r = proc_cmdline_get_bool("systemd.firstboot", &enabled); + if (!arg_root && !arg_image) { + bool enabled; + + /* If we are called without --root=/--image= let's honour the systemd.firstboot kernel + * command line option, because we are called to provision the host with basic settings (as + * opposed to some other file system tree/image) */ + + r = proc_cmdline_get_bool("systemd.firstboot", &enabled); + if (r < 0) + return log_error_errno(r, "Failed to parse systemd.firstboot= kernel command line argument, ignoring: %m"); + if (r > 0 && !enabled) + return 0; /* disabled */ + } + + r = setup_image(&unlink_dir, &loop_device, &decrypted_image); if (r < 0) - return log_error_errno(r, "Failed to parse systemd.firstboot= kernel command line argument, ignoring: %m"); - if (r > 0 && !enabled) - return 0; /* disabled */ + return r; r = process_locale(); if (r < 0) From dcfdd6218469ab2b116712980a875c8b4c963c8f Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sat, 27 Jun 2020 11:09:41 +0200 Subject: [PATCH 5/7] man: document the new --image= switch of systemd-firstboot --- man/systemd-firstboot.xml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/man/systemd-firstboot.xml b/man/systemd-firstboot.xml index 81e62484fdb..d6bfd855c10 100644 --- a/man/systemd-firstboot.xml +++ b/man/systemd-firstboot.xml @@ -98,6 +98,18 @@ + + + Takes a path to a disk image file or block device node. If specified all operations + are applied to file system in the indicated disk image. This is similar to + but operates on file systems stored in disk images or block devices. The disk image should either + contain just a file system or a set of file systems within a GPT partition table, following the + Discoverable Partitions + Specification. For further information on supported disk images, see + systemd-nspawn1's + switch of the same name. + + From a122502077357cab66fed19b32a9b3be4320c064 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sun, 28 Jun 2020 11:59:00 +0200 Subject: [PATCH 6/7] firstboot: add option to turn off welcome text display --- man/systemd-firstboot.xml | 8 ++++++++ src/firstboot/firstboot.c | 15 +++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/man/systemd-firstboot.xml b/man/systemd-firstboot.xml index d6bfd855c10..491ca6e9bf1 100644 --- a/man/systemd-firstboot.xml +++ b/man/systemd-firstboot.xml @@ -259,6 +259,14 @@ option should not be used lightly. + + + + Takes a boolean argument. By default when prompting the user for configuration + options a brief welcome text is shown before the first question is asked. Pass false to this option + to turn off the welcome text. + + diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c index 6d22fbc081b..5c9ee779ca9 100644 --- a/src/firstboot/firstboot.c +++ b/src/firstboot/firstboot.c @@ -62,6 +62,7 @@ static bool arg_copy_root_password = false; static bool arg_force = false; static bool arg_delete_root_password = false; static bool arg_root_password_is_hashed = false; +static bool arg_welcome = true; STATIC_DESTRUCTOR_REGISTER(arg_root, freep); STATIC_DESTRUCTOR_REGISTER(arg_image, freep); @@ -93,6 +94,9 @@ static void print_welcome(void) { const char *pn; int r; + if (!arg_welcome) + return; + if (done) return; @@ -940,6 +944,7 @@ static int help(void) { " --setup-machine-id Generate a new random machine ID\n" " --force Overwrite existing files\n" " --delete-root-password Delete root password\n" + " --welcome=no Disable the welcome text\n" "\nSee the %s for details.\n" , program_invocation_short_name , link @@ -978,6 +983,7 @@ static int parse_argv(int argc, char *argv[]) { ARG_SETUP_MACHINE_ID, ARG_FORCE, ARG_DELETE_ROOT_PASSWORD, + ARG_WELCOME, }; static const struct option options[] = { @@ -1009,6 +1015,7 @@ static int parse_argv(int argc, char *argv[]) { { "setup-machine-id", no_argument, NULL, ARG_SETUP_MACHINE_ID }, { "force", no_argument, NULL, ARG_FORCE }, { "delete-root-password", no_argument, NULL, ARG_DELETE_ROOT_PASSWORD }, + { "welcome", required_argument, NULL, ARG_WELCOME }, {} }; @@ -1186,6 +1193,14 @@ static int parse_argv(int argc, char *argv[]) { arg_delete_root_password = true; break; + case ARG_WELCOME: + r = parse_boolean(optarg); + if (r < 0) + return log_error_errno(r, "Failed to parse --welcome= argument: %s", optarg); + + arg_welcome = r; + break; + case '?': return -EINVAL; From 737ec51444c5e6fa94b6ef83893f5f4455f53f4a Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sat, 27 Jun 2020 11:15:19 +0200 Subject: [PATCH 7/7] TODO --- TODO | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/TODO b/TODO index 2ef80350997..0cd9bc114fc 100644 --- a/TODO +++ b/TODO @@ -49,6 +49,9 @@ Features: * nspawn: support time namespaces +* systemd-firstboot: make sure to always use chase_symlinks() before + reading/writing files + * add ConditionSecurity=tpm2 * Remove any support for booting without /usr pre-mounted in the initrd entirely. @@ -94,8 +97,9 @@ Features: this, it's useful to have one that can dump contents of them, too. * All tools that support --root= should also learn --image= so that they can - operate on disk images directly. Specifically: bootctl, firstboot, tmpfiles, - sysusers, systemctl, repart, journalctl, coredumpctl. + operate on disk images directly. Specifically: bootctl, tmpfiles, sysusers, + systemctl, repart, journalctl, coredumpctl. (Already done: systemd-nspawn, + systemd-firstboot) * seccomp: by default mask x32 ABI system wide on x86-64. it's on its way out