shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-03-21 02:50:18 +03:00
Code

Merge pull request from poettering/notify-chroot

Browse Source 
chroot/sd_notify() fixes
This commit is contained in:
Yu Watanabe 2021-01-21 13:16:59 +09:00 committed by GitHub
commit 33f7b61ca5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
12 changed files with 40 additions and 12 deletions

14
man/systemd.exec.xml

@ -117,6 +117,20 @@
<para>The <varname>MountAPIVFS=</varname> and <varname>PrivateUsers=</varname> settings are particularly useful
in conjunction with <varname>RootDirectory=</varname>. For details, see below.</para>
<para>If <varname>RootDirectory=</varname>/<varname>RootImage=</varname> are used together with
<varname>NotifyAccess=</varname> the notification socket is automatically mounted from the host into
the root environment, to ensure the notification interface can work correctly.</para>
<para>Note that services using <varname>RootDirectory=</varname>/<varname>RootImage=</varname> will
not be able to log via the syslog or journal protocols to the host logging infrastructure, unless the
relevant sockets are mounted from the host, specifically:</para>
<example>
<title>Mounting logging sockets into root environment</title>
<programlisting>BindReadOnlyPaths=/dev/log /run/systemd/journal/socket /run/systemd/journal/stdout</programlisting>
</example>
<xi:include href="system-only.xml" xpointer="singular"/></listitem>
</varlistentry>

1
src/core/execute.c

@ -3223,6 +3223,7 @@ static int apply_mount_namespace(
context->root_verity,
propagate_dir,
incoming_dir,
root_dir || root_image ? params->notify_socket : NULL,
DISSECT_IMAGE_DISCARD_ON_LOOP|DISSECT_IMAGE_RELAX_VAR_CHECK|DISSECT_IMAGE_FSCK,
error_path);

2
src/core/execute.h

@ -384,6 +384,8 @@ struct ExecParameters {
/* An fd that is closed by the execve(), and thus will result in EOF when the execve() is done */
int exec_fd;
const char *notify_socket;
};
#include "unit.h"

20
src/core/namespace.c

@ -1302,7 +1302,8 @@ static size_t namespace_calculate_mounts(
const char* var_tmp_dir,
const char *creds_path,
const char* log_namespace,
bool setup_propagate) {
bool setup_propagate,
const char* notify_socket) {
size_t protect_home_cnt;
size_t protect_system_cnt =
@ -1329,7 +1330,6 @@ static size_t namespace_calculate_mounts(
n_bind_mounts +
n_mount_images +
n_temporary_filesystems +
(setup_propagate ? 1 : 0) + /* /run/systemd/incoming */
ns_info->private_dev +
(ns_info->protect_kernel_tunables ? ELEMENTSOF(protect_kernel_tunables_table) : 0) +
(ns_info->protect_kernel_modules ? ELEMENTSOF(protect_kernel_modules_table) : 0) +
@ -1339,7 +1339,9 @@ static size_t namespace_calculate_mounts(
(ns_info->protect_hostname ? 2 : 0) +
(namespace_info_mount_apivfs(ns_info) ? ELEMENTSOF(apivfs_table) : 0) +
(creds_path ? 2 : 1) +
!!log_namespace;
!!log_namespace +
setup_propagate + /* /run/systemd/incoming */
!!notify_socket;
}
static void normalize_mounts(const char *root_directory, MountEntry *mounts, size_t *n_mounts) {
@ -1491,6 +1493,7 @@ int setup_namespace(
const char *verity_data_path,
const char *propagate_dir,
const char *incoming_dir,
const char *notify_socket,
DissectImageFlags dissect_image_flags,
char **error_path) {
@ -1593,7 +1596,8 @@ int setup_namespace(
tmp_dir, var_tmp_dir,
creds_path,
log_namespace,
setup_propagate);
setup_propagate,
notify_socket);
if (n_mounts > 0) {
m = mounts = new0(MountEntry, n_mounts);
@ -1771,6 +1775,14 @@ int setup_namespace(
.read_only = true,
};
if (notify_socket)
*(m++) = (MountEntry) {
.path_const = notify_socket,
.source_const = notify_socket,
.mode = BIND_MOUNT,
.read_only = true,
};
assert(mounts + n_mounts == m);
/* Prepend the root directory where that's necessary */

1
src/core/namespace.h

@ -129,6 +129,7 @@ int setup_namespace(
const char *root_verity,
const char *propagate_dir,
const char *incoming_dir,
const char *notify_socket,
DissectImageFlags dissected_image_flags,
char **error_path);

5
src/core/service.c

@ -1474,10 +1474,13 @@ static int service_spawn(
if (!our_env)
return -ENOMEM;
if (service_exec_needs_notify_socket(s, flags))
if (service_exec_needs_notify_socket(s, flags)) {
if (asprintf(our_env + n_env++, "NOTIFY_SOCKET=%s", UNIT(s)->manager->notify_socket) < 0)
return -ENOMEM;
exec_params.notify_socket = UNIT(s)->manager->notify_socket;
}
if (s->main_pid > 0)
if (asprintf(our_env + n_env++, "MAINPID="PID_FMT, s->main_pid) < 0)
return -ENOMEM;

2
src/portable/profile/default/service.conf

@ -2,8 +2,6 @@
[Service]
MountAPIVFS=yes
TemporaryFileSystem=/run
BindReadOnlyPaths=/run/systemd/notify
BindReadOnlyPaths=/dev/log /run/systemd/journal/socket /run/systemd/journal/stdout
BindReadOnlyPaths=/etc/machine-id
BindReadOnlyPaths=/etc/resolv.conf

2
src/portable/profile/nonetwork/service.conf

@ -2,8 +2,6 @@
[Service]
MountAPIVFS=yes
TemporaryFileSystem=/run
BindReadOnlyPaths=/run/systemd/notify
BindReadOnlyPaths=/dev/log /run/systemd/journal/socket /run/systemd/journal/stdout
BindReadOnlyPaths=/etc/machine-id
BindReadOnlyPaths=/run/dbus/system_bus_socket

2
src/portable/profile/strict/service.conf

@ -2,8 +2,6 @@
[Service]
MountAPIVFS=yes
TemporaryFileSystem=/run
BindReadOnlyPaths=/run/systemd/notify
BindReadOnlyPaths=/dev/log /run/systemd/journal/socket /run/systemd/journal/stdout
BindReadOnlyPaths=/etc/machine-id
DynamicUser=yes

1
src/portable/profile/trusted/service.conf

@ -2,6 +2,5 @@
[Service]
MountAPIVFS=yes
BindPaths=/run
BindReadOnlyPaths=/etc/machine-id
BindReadOnlyPaths=/etc/resolv.conf

1
src/test/test-namespace.c

@ -174,6 +174,7 @@ static void test_protect_kernel_logs(void) {
NULL,
NULL,
NULL,
NULL,
0,
NULL);
assert_se(r == 0);

1
src/test/test-ns.c

@ -89,6 +89,7 @@ int main(int argc, char *argv[]) {
NULL,
NULL,
NULL,
NULL,
0,
NULL);
if (r < 0) {