#include <errno.h>

#include <ftw.h>

#include <stdlib.h>

#include <sys/mount.h>

#include <unistd.h>

#include "alloc-util.h"

#include "bus-util.h"

#include "cgroup-util.h"

#include "dev-setup.h"

#include "efivars.h"

#include "label.h"

#include "log.h"

#include "macro.h"

#include "missing.h"

#include "mkdir.h"

#include "mount-setup.h"

#include "mount-util.h"

#include "path-util.h"

#include "set.h"

#include "smack-util.h"

#include "strv.h"

#include "user-util.h"

#include "util.h"

#include "virt.h"

typedef enum MountMode {

MNT_NONE = 0,

MNT_FATAL = 1 << 0,

MNT_IN_CONTAINER = 1 << 1,

} MountMode;

typedef struct MountPoint {

const char *what;

const char *where;

const char *type;

const char *options;

unsigned long flags;

bool (*condition_fn)(void);

MountMode mode;

} MountPoint;

#ifdef HAVE_SMACK

#define N_EARLY_MOUNT 5

#else

#define N_EARLY_MOUNT 4

#endif

static const MountPoint mount_table[] = {

{ "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,

NULL, MNT_FATAL|MNT_IN_CONTAINER },

{ "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,

NULL, MNT_FATAL|MNT_IN_CONTAINER },

{ "devtmpfs", "/dev", "devtmpfs", "mode=755", MS_NOSUID|MS_STRICTATIME,

NULL, MNT_FATAL|MNT_IN_CONTAINER },

{ "securityfs", "/sys/kernel/security", "securityfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,

NULL, MNT_NONE },

#ifdef HAVE_SMACK

{ "smackfs", "/sys/fs/smackfs", "smackfs", "smackfsdef=*", MS_NOSUID|MS_NOEXEC|MS_NODEV,

mac_smack_use, MNT_FATAL },

{ "tmpfs", "/dev/shm", "tmpfs", "mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,

mac_smack_use, MNT_FATAL },

#endif

{ "tmpfs", "/dev/shm", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,

NULL, MNT_FATAL|MNT_IN_CONTAINER },

{ "devpts", "/dev/pts", "devpts", "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,

NULL, MNT_IN_CONTAINER },

#ifdef HAVE_SMACK

{ "tmpfs", "/run", "tmpfs", "mode=755,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,

mac_smack_use, MNT_FATAL },

#endif

{ "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME,

NULL, MNT_FATAL|MNT_IN_CONTAINER },

{ "cgroup", "/sys/fs/cgroup", "cgroup", "__DEVEL__sane_behavior", MS_NOSUID|MS_NOEXEC|MS_NODEV,

cg_is_unified_wanted, MNT_FATAL|MNT_IN_CONTAINER },

{ "tmpfs", "/sys/fs/cgroup", "tmpfs", "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,

cg_is_legacy_wanted, MNT_FATAL|MNT_IN_CONTAINER },

{ "cgroup", "/sys/fs/cgroup/systemd", "cgroup", "none,name=systemd,xattr", MS_NOSUID|MS_NOEXEC|MS_NODEV,

cg_is_legacy_wanted, MNT_IN_CONTAINER },

{ "cgroup", "/sys/fs/cgroup/systemd", "cgroup", "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV,

cg_is_legacy_wanted, MNT_FATAL|MNT_IN_CONTAINER },

{ "pstore", "/sys/fs/pstore", "pstore", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,

NULL, MNT_NONE },

#ifdef ENABLE_EFI

{ "efivarfs", "/sys/firmware/efi/efivars", "efivarfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,

is_efi_boot, MNT_NONE },

#endif

{ "kdbusfs", "/sys/fs/kdbus", "kdbusfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,

is_kdbus_wanted, MNT_IN_CONTAINER },

};

static const char ignore_paths[] =

/* SELinux file systems */

"/sys/fs/selinux\0"

/* Container bind mounts */

"/proc/sys\0"

"/dev/console\0"

"/proc/kmsg\0";

bool mount_point_is_api(const char *path) {

unsigned i;

/* Checks if this mount point is considered "API", and hence

for (i = 0; i < ELEMENTSOF(mount_table); i ++)

if (path_equal(path, mount_table[i].where))

return true;

return path_startswith(path, "/sys/fs/cgroup/");

}

bool mount_point_ignore(const char *path) {

const char *i;

NULSTR_FOREACH(i, ignore_paths)

if (path_equal(path, i))

return true;

return false;

}

static int mount_one(const MountPoint *p, bool relabel) {

int r;

assert(p);

if (p->condition_fn && !p->condition_fn())

return 0;

/* Relabel first, just in case */

if (relabel)

(void) label_fix(p->where, true, true);

r = path_is_mount_point(p->where, AT_SYMLINK_FOLLOW);

if (r < 0 && r != -ENOENT) {

log_full_errno((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, r, "Failed to determine whether %s is a mount point: %m", p->where);

return (p->mode & MNT_FATAL) ? r : 0;

}

if (r > 0)

return 0;

/* Skip securityfs in a container */

if (!(p->mode & MNT_IN_CONTAINER) && detect_container() > 0)

return 0;

/* The access mode here doesn't really matter too much, since

if (relabel)

(void) mkdir_p_label(p->where, 0755);

else

(void) mkdir_p(p->where, 0755);

log_debug("Mounting %s to %s of type %s with options %s.",

p->what,

p->where,

p->type,

strna(p->options));

if (mount(p->what,

p->where,

p->type,

p->flags,

p->options) < 0) {

log_full_errno((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, errno, "Failed to mount %s at %s: %m", p->type, p->where);

return (p->mode & MNT_FATAL) ? -errno : 0;

}

/* Relabel again, since we now mounted something fresh here */

if (relabel)

(void) label_fix(p->where, false, false);

return 1;

}

static int mount_points_setup(unsigned n, bool loaded_policy) {

unsigned i;

int r = 0;

for (i = 0; i < n; i ++) {

int j;

j = mount_one(mount_table + i, loaded_policy);

if (j != 0 && r >= 0)

r = j;

}

return r;

}

int mount_setup_early(void) {

assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table));

/* Do a minimal mount of /proc and friends to enable the most

return mount_points_setup(N_EARLY_MOUNT, false);

}

int mount_cgroup_controllers(char ***join_controllers) {

_cleanup_set_free_free_ Set *controllers = NULL;

int r;

if (!cg_is_legacy_wanted())

return 0;

/* Mount all available cgroup controllers that are built into the kernel. */

controllers = set_new(&string_hash_ops);

if (!controllers)

return log_oom();

r = cg_kernel_controllers(controllers);

if (r < 0)

return log_error_errno(r, "Failed to enumerate cgroup controllers: %m");

for (;;) {

_cleanup_free_ char *options = NULL, *controller = NULL, *where = NULL;

MountPoint p = {

.what = "cgroup",

.type = "cgroup",

.flags = MS_NOSUID|MS_NOEXEC|MS_NODEV,

.mode = MNT_IN_CONTAINER,

};

char ***k = NULL;

controller = set_steal_first(controllers);

if (!controller)

break;

if (join_controllers)

for (k = join_controllers; *k; k++)

if (strv_find(*k, controller))

break;

if (k && *k) {

char **i, **j;

for (i = *k, j = *k; *i; i++) {

if (!streq(*i, controller)) {

_cleanup_free_ char *t;

t = set_remove(controllers, *i);

if (!t) {

free(*i);

continue;

}

}

*(j++) = *i;

}

*j = NULL;

options = strv_join(*k, ",");

if (!options)

return log_oom();

} else {

options = controller;

controller = NULL;

}

where = strappend("/sys/fs/cgroup/", options);

if (!where)

return log_oom();

p.where = where;

p.options = options;

r = mount_one(&p, true);

if (r < 0)

return r;

if (r > 0 && k && *k) {

char **i;

for (i = *k; *i; i++) {

_cleanup_free_ char *t = NULL;

t = strappend("/sys/fs/cgroup/", *i);

if (!t)

return log_oom();

r = symlink(options, t);

if (r >= 0) {

#ifdef SMACK_RUN_LABEL

_cleanup_free_ char *src;

src = strappend("/sys/fs/cgroup/", options);

if (!src)

return log_oom();

r = mac_smack_copy(t, src);

if (r < 0 && r != -EOPNOTSUPP)

return log_error_errno(r, "Failed to copy smack label from %s to %s: %m", src, t);

#endif

} else if (errno != EEXIST)

return log_error_errno(errno, "Failed to create symlink %s: %m", t);

}

}

}

/* Now that we mounted everything, let's make the tmpfs the

(void) mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755");

return 0;

}

#if defined(HAVE_SELINUX) || defined(HAVE_SMACK)

static int nftw_cb(

const char *fpath,

const struct stat *sb,

int tflag,

struct FTW *ftwbuf) {

/* No need to label /dev twice in a row... */

if (_unlikely_(ftwbuf->level == 0))

return FTW_CONTINUE;

label_fix(fpath, false, false);

/* /run/initramfs is static data and big, no need to

if (_unlikely_(ftwbuf->level == 1 &&

tflag == FTW_D &&

streq(fpath, "/run/initramfs")))

return FTW_SKIP_SUBTREE;

return FTW_CONTINUE;

};

#endif

int mount_setup(bool loaded_policy) {

int r = 0;

r = mount_points_setup(ELEMENTSOF(mount_table), loaded_policy);

if (r < 0)

return r;

#if defined(HAVE_SELINUX) || defined(HAVE_SMACK)

/* Nodes in devtmpfs and /run need to be manually updated for

if (loaded_policy) {

usec_t before_relabel, after_relabel;

char timespan[FORMAT_TIMESPAN_MAX];

before_relabel = now(CLOCK_MONOTONIC);

nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);

nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);

after_relabel = now(CLOCK_MONOTONIC);

log_info("Relabelled /dev and /run in %s.",

format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));

}

#endif

/* Create a few default symlinks, which are normally created

dev_setup(NULL, UID_INVALID, GID_INVALID);

/* Mark the root directory as shared in regards to mount

if (detect_container() <= 0)

if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)

log_warning_errno(errno, "Failed to set up the root directory for shared mount propagation: %m");

/* Create a few directories we always want around, Note that

mkdir_label("/run/systemd", 0755);

mkdir_label("/run/systemd/system", 0755);

mkdir_label("/run/systemd/inaccessible", 0000);

return 0;

}