summaryrefslogtreecommitdiff
path: root/src/core/namespace.c
Commit message (Collapse)AuthorAge
* core: either ignore or handle mount failuresZbigniew Jędrzejewski-Szmek2015-03-13
| | | | | | | | /dev/pts/ptmx is as important as /dev/pts, so error out if that fails. Others seem less important, since the namespace is usable without them, so ignore failures. CID #123755, #123754.
* Use space after a silencing (void)Zbigniew Jędrzejewski-Szmek2015-03-13
| | | | | We were using a space more often than not, and this way is codified in CODING_STYLE.
* remove unused includesThomas Hindoe Paaboel Andersen2015-02-23
| | | | | | This patch removes includes that are not used. The removals were found with include-what-you-use which checks if any of the symbols from a header is in use.
* util: rework strappenda(), and rename it strjoina()Lennart Poettering2015-02-03
| | | | | | After all it is now much more like strjoin() than strappend(). At the same time, add support for NULL sentinels, even if they are normally not necessary.
* Type of mount(2) flags is unsigned longTopi Miettinen2015-01-01
|
* tmpfiles: add new line type 'v' for creating btrfs subvolumesLennart Poettering2014-12-28
|
* treewide: another round of simplificationsMichal Schmidt2014-11-28
| | | | | Using the same scripts as in f647962d64e "treewide: yet more log_*_errno + return simplifications".
* treewide: use log_*_errno whenever %m is in the format stringMichal Schmidt2014-11-28
| | | | | | | | | | | If the format string contains %m, clearly errno must have a meaningful value, so we might as well use log_*_errno to have ERRNO= logged. Using: find . -name '*.[ch]' | xargs sed -r -i -e \ 's/log_(debug|info|notice|warning|error|emergency)\((".*%m.*")/log_\1_errno(errno, \2/' Plus some whitespace, linewrap, and indent adjustments.
* namespace: unchecked return value from librarySusant Sahani2014-11-17
| | | | | | | | | | | | | | | | | | | fix: CID 1237553 (#1 of 6): Unchecked return value from library (CHECKED_RETURN CID 1237553 (#3 of 6): Unchecked return value from library (CHECKED_RETURN) CID 1237553 (#4 of 6): Unchecked return value from library (CHECKED_RETURN) CID 1237553 (#5 of 6): Unchecked return value from library (CHECKED_RETURN CID 1237553 (#6 of 6): Unchecked return value from library (CHECKED_RETURN)
* sd-bus: sync with kdbus upstream (ABI break)Daniel Mack2014-11-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kdbus has seen a larger update than expected lately, most notably with kdbusfs, a file system to expose the kdbus control files: * Each time a file system of this type is mounted, a new kdbus domain is created. * The layout inside each mount point is the same as before, except that domains are not hierarchically nested anymore. * Domains are therefore also unnamed now. * Unmounting a kdbusfs will automatically also detroy the associated domain. * Hence, the action of creating a kdbus domain is now as privileged as mounting a filesystem. * This way, we can get around creating dev nodes for everything, which is last but not least something that is not limited by 20-bit minor numbers. The kdbus specific bits in nspawn have all been dropped now, as nspawn can rely on the container OS to set up its own kdbus domain, simply by mounting a new instance. A new set of mounts has been added to mount things *after* the kernel modules have been loaded. For now, only kdbus is in this set, which is invoked with mount_setup_late().
* selinux: clean up selinux label function namingLennart Poettering2014-10-23
|
* mac: rename apis with mac_{selinux/smack}_ prefixWaLyong Cho2014-10-23
|
* namespace: add missing 'const' to parametersLennart Poettering2014-10-17
|
* core/namespace: remove invalid checkZbigniew Jędrzejewski-Szmek2014-10-03
| | | | | | dir cannot be NULL here, because it was allocated with alloca. CID #1237768.
* core/namespace: remove invalid checkZbigniew Jędrzejewski-Szmek2014-10-03
| | | | | | root cannot be NULL here, because it was allocated with alloca. CID #1237769.
* namespace: avoid posible use of uninitialized variableThomas Hindoe Paaboel Andersen2014-09-08
|
* namespace: add support for custom kdbus endpointDaniel Mack2014-09-08
| | | | | | | | | | If a path to a previously created custom kdbus endpoint is passed in, bind-mount a new devtmpfs that contains a 'bus' node, which in turn in bind-mounted with the custom endpoint. This tmpfs then mounted over the kdbus subtree that refers to the current bus. This way, we can fake the bus node in order to lock down services with a kdbus custom endpoint policy.
* drop_duplicates: copy full BindMount structAnsgar Burchardt2014-07-27
| | | | | | | | At least t->ignore = f->ignore; is missing here. Just copy the full struct to be sure.
* namespace: make sure /tmp, /var/tmp and /dev are writable in namespaces we ↵Lennart Poettering2014-07-03
| | | | set up
* namespace: fix uninitialized memory accessLennart Poettering2014-07-03
|
* namespace: properly label device nodes we createLennart Poettering2014-06-18
| | | | https://bugzilla.redhat.com/show_bug.cgi?id=1081429
* namespace: cover /boot with ProtectSystem= againLennart Poettering2014-06-06
| | | | | Now that we properly exclude autofs mounts from ProtectSystem= we can include it in the effect of ProtectSystem= again.
* namespace: beef up read-only bind mount logicLennart Poettering2014-06-06
| | | | | | | Instead of blindly creating another bind mount for read-only mounts, check if there's already one we can use, and if so, use it. Also, recursively mark all submounts read-only too. Also, ignore autofs mounts when remounting read-only unless they are already triggered.
* namespace: also include /root in ProtectHome=Lennart Poettering2014-06-05
| | | | | /root can't really be autofs, and is also a home, directory, so cover it with ProtectHome=.
* namespace: when setting up an inaccessible mount point, unmounting ↵Lennart Poettering2014-06-05
| | | | | | | everything below This has the benefit of not triggering any autofs mount points unnecessarily.
* core: don't include /boot in effect of ProtectSystem=Lennart Poettering2014-06-05
| | | | | | | | | | | | | This would otherwise unconditionally trigger any /boot autofs mount, which we probably should avoid. ProtectSystem= will now only cover /usr and (optionally) /etc, both of which cannot be autofs anyway. ProtectHome will continue to cover /run/user and /home. The former cannot be autofs either. /home could be, however is frequently enough used (unlikey /boot) so that it isn't too problematic to simply trigger it unconditionally via ProtectHome=.
* core: rename ReadOnlySystem= to ProtectSystem= and add a third value for ↵Lennart Poettering2014-06-04
| | | | | | | | | | also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.
* core: provide /dev/ptmx as symlink in PrivateDevices= execution environmentsLennart Poettering2014-06-04
|
* core: make sure PrivateDevices= makes /dev/log availableLennart Poettering2014-06-04
| | | | | | | Now that we moved the actual syslog socket to /run/systemd/journal/dev-log we can actually make /dev/log a symlink to it, when PrivateDevices= is used, thus making syslog available to services using PrivateDevices=.
* core: add new ReadOnlySystem= and ProtectedHome= settings for service unitsLennart Poettering2014-06-03
| | | | | | | | | | | | | | ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for a service. ProtectedHome= uses fs namespaces to mount /home and /run/user inaccessible or read-only for a service. This patch also enables these settings for all our long-running services. Together they should be good building block for a minimal service sandbox, removing the ability for services to modify the operating system or access the user's private data.
* unit: turn off mount propagation for udevdLennart Poettering2014-03-20
| | | | | Keep mounts done by udev rules private to udevd. Also, document how MountFlags= may be used for this.
* core: Beef up PrivateDevices=Lennart Poettering2014-03-19
| | | | | Also mount /dev/kdbus, /dev/mqueue and /dev/hugepages into the /dev for namespaced services.
* conf-parser: config_parse_path_strv() is not generic, so let's move it into ↵Lennart Poettering2014-03-03
| | | | | | | load-fragment.c The parse code actually checked for specific lvalue names, which is really wrong for supposedly generic parsers...
* exec: introduce PrivateDevices= switch to provide services with a private /devLennart Poettering2014-01-20
| | | | | | Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that sets up a private /dev with only the API pseudo-devices like /dev/null, /dev/zero, /dev/random, but not any physical devices in them.
* namespace: include boot id in private tmp directoriesLennart Poettering2013-12-13
| | | | | | | | This way it is easy to only exclude directories from the current boot from automatic clean up in /var/tmp. Also, pick a longer name for the directories so that are globs in tmp.conf can be simpler yet equally accurate.
* namespace: comment typo fixLennart Poettering2013-11-27
|
* service: add the ability for units to join other unit's PrivateNetwork= and ↵Lennart Poettering2013-11-27
| | | | PrivateTmp= namespaces
* systemd: use unit name in PrivateTmp directoriesZbigniew Jędrzejewski-Szmek2013-10-22
| | | | | | | Unit name is used whole in the directory name, so that the unit name can be easily extracted from it, e.g. "/tmp/systemd-abcd.service-DEDBIF1". https://bugzilla.redhat.com/show_bug.cgi?id=957439
* Never call qsort on potentially NULL arraysZbigniew Jędrzejewski-Szmek2013-10-13
| | | | | | This extends 62678ded 'efi: never call qsort on potentially NULL arrays' to all other places where qsort is used and it is not obvious that the count is non-zero.
* "-" prefix for InaccessibleDirectories and ReadOnlyDirectoriesMaciej Wereski2013-08-23
|
* core: remove unnecessary goto in setup_namespaceZbigniew Jędrzejewski-Szmek2013-03-20
|
* Make PrivateTmp dirs also inaccessible from the outsideZbigniew Jędrzejewski-Szmek2013-03-20
| | | | | | | | | | | Currently, PrivateTmp=yes means that the service cannot see the /tmp shared by rest of the system and is isolated from other services using PrivateTmp, but users can access and modify /tmp as seen by the service. Move the private /tmp and /var/tmp directories into a 0077-mode directory. This way unpriviledged users on the system cannot see (or modify) /tmp as seen by the service.
* core: reuse the same /tmp, /var/tmp and inaccessible dirMichal Sekletar2013-03-15
| | | | | | | | All Execs within the service, will get mounted the same /tmp and /var/tmp directories, if service is configured with PrivateTmp=yes. Temporary directories are cleaned up by service itself in addition to systemd-tmpfiles. Directory which is mounted as inaccessible is created at runtime in /run/systemd.
* nspawn,namespaces: make sure we recursively bind mount things inLennart Poettering2012-08-13
| | | | | We want to make sure that everything from the host is also visible in the sandbox.
* namespace: rework namespace supportLennart Poettering2012-08-13
| | | | | | | | - don't use pivot_root() anymore, just reuse root hierarchy - first create all mounts, then mark them read-only so that we get the right behaviour when people want writable mounts inside of read-only mounts - don't pass invalid combinations of MS_ constants to the kernel
* fix a couple of issues found with llvm-analyzeLennart Poettering2012-08-08
|
* namespace: make PrivateTmp= apply to both /tmp and /var/tmpLennart Poettering2012-05-14
|
* util: split-out path-util.[ch]Kay Sievers2012-05-08
|
* remove MS_* which can not be combined with current kernel codeKay Sievers2012-04-18
| | | | | | | | | | | | | | | | | | MS_BIND|MS_MOVE can not be combined: do_mount() else if (flags & MS_BIND) do_loopback(&path, dev_name, flags & MS_REC); [...] else if (flags & MS_MOVE) do_move_mount(&path, dev_name); MS_REMOUNT|MS_UNBINDABLE can not be combined: do_mount() if (flags & MS_REMOUNT) do_remount(&path, flags & ~MS_REMOUNT, mnt_flags, data_page); [...] else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) do_change_type(&path, flags);
* relicense to LGPLv2.1 (with exceptions)Lennart Poettering2012-04-12
| | | | | | | | | | | | | | We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-30 12:46:13 +0000