src/core/namespace.h

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2 #pragma once
   3
   4 /***
   5   Copyright © 2016 Djalal Harouni
   6 ***/
   7
   8 typedef struct NamespaceInfo NamespaceInfo;
   9 typedef struct BindMount BindMount;
  10 typedef struct TemporaryFileSystem TemporaryFileSystem;
  11 typedef struct MountImage MountImage;
  12
  13 #include <stdbool.h>
  14
  15 #include "dissect-image.h"
  16 #include "fs-util.h"
  17 #include "macro.h"
  18 #include "namespace-util.h"
  19 #include "string-util.h"
  20
  21 typedef enum ProtectHome {
  22         PROTECT_HOME_NO,
  23         PROTECT_HOME_YES,
  24         PROTECT_HOME_READ_ONLY,
  25         PROTECT_HOME_TMPFS,
  26         _PROTECT_HOME_MAX,
  27         _PROTECT_HOME_INVALID = -EINVAL,
  28 } ProtectHome;
  29
  30 typedef enum ProtectSystem {
  31         PROTECT_SYSTEM_NO,
  32         PROTECT_SYSTEM_YES,
  33         PROTECT_SYSTEM_FULL,
  34         PROTECT_SYSTEM_STRICT,
  35         _PROTECT_SYSTEM_MAX,
  36         _PROTECT_SYSTEM_INVALID = -EINVAL,
  37 } ProtectSystem;
  38
  39 typedef enum ProtectProc {
  40         PROTECT_PROC_DEFAULT,
  41         PROTECT_PROC_NOACCESS,   /* hidepid=noaccess */
  42         PROTECT_PROC_INVISIBLE,  /* hidepid=invisible */
  43         PROTECT_PROC_PTRACEABLE, /* hidepid=ptraceable */
  44         _PROTECT_PROC_MAX,
  45         _PROTECT_PROC_INVALID = -EINVAL,
  46 } ProtectProc;
  47
  48 typedef enum ProcSubset {
  49         PROC_SUBSET_ALL,
  50         PROC_SUBSET_PID, /* subset=pid */
  51         _PROC_SUBSET_MAX,
  52         _PROC_SUBSET_INVALID = -EINVAL,
  53 } ProcSubset;
  54
  55 struct NamespaceInfo {
  56         bool ignore_protect_paths;
  57         bool private_dev;
  58         bool protect_control_groups;
  59         bool protect_kernel_tunables;
  60         bool protect_kernel_modules;
  61         bool protect_kernel_logs;
  62         bool mount_apivfs;
  63         bool protect_hostname;
  64         bool private_network;
  65         bool private_ipc;
  66         bool mount_nosuid;
  67         ProtectHome protect_home;
  68         ProtectSystem protect_system;
  69         ProtectProc protect_proc;
  70         ProcSubset proc_subset;
  71 };
  72
  73 struct BindMount {
  74         char *source;
  75         char *destination;
  76         bool read_only;
  77         bool nosuid;
  78         bool recursive;
  79         bool ignore_enoent;
  80 };
  81
  82 struct TemporaryFileSystem {
  83         char *path;
  84         char *options;
  85 };
  86
  87 typedef enum MountImageType {
  88         MOUNT_IMAGE_DISCRETE,
  89         MOUNT_IMAGE_EXTENSION,
  90         _MOUNT_IMAGE_TYPE_MAX,
  91         _MOUNT_IMAGE_TYPE_INVALID = -EINVAL,
  92 } MountImageType;
  93
  94 struct MountImage {
  95         char *source;
  96         char *destination; /* Unused if MountImageType == MOUNT_IMAGE_EXTENSION */
  97         LIST_HEAD(MountOptions, mount_options);
  98         bool ignore_enoent;
  99         MountImageType type;
 100 };
 101
 102 int setup_namespace(
 103                 const char *root_directory,
 104                 const char *root_image,
 105                 const MountOptions *root_image_options,
 106                 const ImagePolicy *root_image_policy,
 107                 const NamespaceInfo *ns_info,
 108                 char **read_write_paths,
 109                 char **read_only_paths,
 110                 char **inaccessible_paths,
 111                 char **exec_paths,
 112                 char **no_exec_paths,
 113                 char **empty_directories,
 114                 char **symlinks,
 115                 const BindMount *bind_mounts,
 116                 size_t n_bind_mounts,
 117                 const TemporaryFileSystem *temporary_filesystems,
 118                 size_t n_temporary_filesystems,
 119                 const MountImage *mount_images,
 120                 size_t n_mount_images,
 121                 const ImagePolicy *mount_image_policy,
 122                 const char *tmp_dir,
 123                 const char *var_tmp_dir,
 124                 const char *creds_path,
 125                 const char *log_namespace,
 126                 unsigned long mount_propagation_flag,
 127                 VeritySettings *verity,
 128                 const MountImage *extension_images,
 129                 size_t n_extension_images,
 130                 const ImagePolicy *extension_image_policy,
 131                 char **extension_directories,
 132                 const char *propagate_dir,
 133                 const char *incoming_dir,
 134                 const char *extension_dir,
 135                 const char *notify_socket,
 136                 const char *host_os_release_stage,
 137                 char **error_path);
 138
 139 #define RUN_SYSTEMD_EMPTY "/run/systemd/empty"
 140
 141 static inline char* namespace_cleanup_tmpdir(char *p) {
 142         PROTECT_ERRNO;
 143         if (!streq_ptr(p, RUN_SYSTEMD_EMPTY))
 144                 (void) rmdir(p);
 145         return mfree(p);
 146 }
 147 DEFINE_TRIVIAL_CLEANUP_FUNC(char*, namespace_cleanup_tmpdir);
 148
 149 int setup_tmp_dirs(
 150                 const char *id,
 151                 char **tmp_dir,
 152                 char **var_tmp_dir);
 153
 154 int setup_shareable_ns(int ns_storage_socket[static 2], unsigned long nsflag);
 155 int open_shareable_ns_path(int netns_storage_socket[static 2], const char *path, unsigned long nsflag);
 156
 157 const char* protect_home_to_string(ProtectHome p) _const_;
 158 ProtectHome protect_home_from_string(const char *s) _pure_;
 159
 160 const char* protect_system_to_string(ProtectSystem p) _const_;
 161 ProtectSystem protect_system_from_string(const char *s) _pure_;
 162
 163 const char* protect_proc_to_string(ProtectProc i) _const_;
 164 ProtectProc protect_proc_from_string(const char *s) _pure_;
 165
 166 const char* proc_subset_to_string(ProcSubset i) _const_;
 167 ProcSubset proc_subset_from_string(const char *s) _pure_;
 168
 169 void bind_mount_free_many(BindMount *b, size_t n);
 170 int bind_mount_add(BindMount **b, size_t *n, const BindMount *item);
 171
 172 void temporary_filesystem_free_many(TemporaryFileSystem *t, size_t n);
 173 int temporary_filesystem_add(TemporaryFileSystem **t, size_t *n,
 174                              const char *path, const char *options);
 175
 176 MountImage* mount_image_free_many(MountImage *m, size_t *n);
 177 int mount_image_add(MountImage **m, size_t *n, const MountImage *item);
 178
 179 const char* namespace_type_to_string(NamespaceType t) _const_;
 180 NamespaceType namespace_type_from_string(const char *s) _pure_;
 181
 182 bool ns_type_supported(NamespaceType type);