#include <errno.h>

#include <linux/loop.h>

#include <sched.h>

#include <stdio.h>

#include <sys/mount.h>

#include <unistd.h>

#include <linux/fs.h>

#include "alloc-util.h"

#include "base-filesystem.h"

#include "dev-setup.h"

#include "env-util.h"

#include "escape.h"

#include "extension-release.h"

#include "fd-util.h"

#include "format-util.h"

#include "fs-util.h"

#include "label.h"

#include "list.h"

#include "loop-util.h"

#include "loopback-setup.h"

#include "mkdir.h"

#include "mount-util.h"

#include "mountpoint-util.h"

#include "namespace-util.h"

#include "namespace.h"

#include "nsflags.h"

#include "nulstr-util.h"

#include "os-util.h"

#include "path-util.h"

#include "selinux-util.h"

#include "socket-util.h"

#include "sort-util.h"

#include "stat-util.h"

#include "string-table.h"

#include "string-util.h"

#include "strv.h"

#include "tmpfile-util.h"

#include "umask-util.h"

#include "user-util.h"

#define DEV_MOUNT_OPTIONS (MS_NOSUID|MS_STRICTATIME|MS_NOEXEC)

typedef enum MountMode {

} MountMode;

typedef struct MountEntry {

} MountEntry;

static const MountEntry apivfs_table[] = {

{ "/proc", PROCFS, false },

{ "/dev", BIND_DEV, false },

{ "/sys", SYSFS, false },

{ "/run", RUN, false, .options_const = "mode=755" TMPFS_LIMITS_RUN, .flags = MS_NOSUID|MS_NODEV|MS_STRICTATIME },

};

static const MountEntry protect_kernel_tunables_table[] = {

{ "/proc/acpi", READONLY, true },

{ "/proc/apm", READONLY, true }, /* Obsolete API, there's no point in permitting access to this, ever */

{ "/proc/asound", READONLY, true },

{ "/proc/bus", READONLY, true },

{ "/proc/fs", READONLY, true },

{ "/proc/irq", READONLY, true },

{ "/proc/kallsyms", INACCESSIBLE, true },

{ "/proc/kcore", INACCESSIBLE, true },

{ "/proc/latency_stats", READONLY, true },

{ "/proc/mtrr", READONLY, true },

{ "/proc/scsi", READONLY, true },

{ "/proc/sys", READONLY, true },

{ "/proc/sysrq-trigger", READONLY, true },

{ "/proc/timer_stats", READONLY, true },

{ "/sys", READONLY, false },

{ "/sys/fs/bpf", READONLY, true },

{ "/sys/fs/cgroup", READWRITE_IMPLICIT, false }, /* READONLY is set by ProtectControlGroups= option */

{ "/sys/fs/selinux", READWRITE_IMPLICIT, true },

{ "/sys/kernel/debug", READONLY, true },

{ "/sys/kernel/tracing", READONLY, true },

};

static const MountEntry protect_kernel_modules_table[] = {

#if HAVE_SPLIT_USR

{ "/lib/modules", INACCESSIBLE, true },

{ "/usr/lib/modules", INACCESSIBLE, true },

};

static const MountEntry protect_kernel_logs_table[] = {

{ "/proc/kmsg", INACCESSIBLE, true },

{ "/dev/kmsg", INACCESSIBLE, true },

};

static const MountEntry protect_home_read_only_table[] = {

{ "/home", READONLY, true },

{ "/run/user", READONLY, true },

{ "/root", READONLY, true },

};

static const MountEntry protect_home_tmpfs_table[] = {

{ "/home", TMPFS, true, .read_only = true, .options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },

{ "/run/user", TMPFS, true, .read_only = true, .options_const = "mode=0755" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },

{ "/root", TMPFS, true, .read_only = true, .options_const = "mode=0700" TMPFS_LIMITS_EMPTY_OR_ALMOST, .flags = MS_NODEV|MS_STRICTATIME },

};

static const MountEntry protect_home_yes_table[] = {

{ "/home", INACCESSIBLE, true },

{ "/run/user", INACCESSIBLE, true },

{ "/root", INACCESSIBLE, true },

};

static const MountEntry protect_system_yes_table[] = {

{ "/usr", READONLY, false },

{ "/boot", READONLY, true },

{ "/efi", READONLY, true },

#if HAVE_SPLIT_USR

{ "/lib", READONLY, true },

{ "/lib64", READONLY, true },

{ "/bin", READONLY, true },

# if HAVE_SPLIT_BIN

{ "/sbin", READONLY, true },

};

static const MountEntry protect_system_full_table[] = {

{ "/usr", READONLY, false },

{ "/boot", READONLY, true },

{ "/efi", READONLY, true },

{ "/etc", READONLY, false },

#if HAVE_SPLIT_USR

{ "/lib", READONLY, true },

{ "/lib64", READONLY, true },

{ "/bin", READONLY, true },

# if HAVE_SPLIT_BIN

{ "/sbin", READONLY, true },

};

static const MountEntry protect_system_strict_table[] = {

{ "/", READONLY, false },

{ "/proc", READWRITE_IMPLICIT, false }, /* ProtectKernelTunables= */

{ "/sys", READWRITE_IMPLICIT, false }, /* ProtectKernelTunables= */

{ "/dev", READWRITE_IMPLICIT, false }, /* PrivateDevices= */

{ "/home", READWRITE_IMPLICIT, true }, /* ProtectHome= */

{ "/run/user", READWRITE_IMPLICIT, true }, /* ProtectHome= */

{ "/root", READWRITE_IMPLICIT, true }, /* ProtectHome= */

};

static const char * const mount_mode_table[_MOUNT_MODE_MAX] = {

[INACCESSIBLE] = "inaccessible",

[OVERLAY_MOUNT] = "overlay",

[BIND_MOUNT] = "bind",

[BIND_MOUNT_RECURSIVE] = "rbind",

[PRIVATE_TMP] = "private-tmp",

[PRIVATE_DEV] = "private-dev",

[BIND_DEV] = "bind-dev",

[EMPTY_DIR] = "empty",

[SYSFS] = "sysfs",

[PROCFS] = "procfs",

[READONLY] = "read-only",

[READWRITE] = "read-write",

[TMPFS] = "tmpfs",

[MOUNT_IMAGES] = "mount-images",

[READWRITE_IMPLICIT] = "rw-implicit",

[EXEC] = "exec",

[NOEXEC] = "noexec",

[MQUEUEFS] = "mqueuefs",

};

DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(mount_mode, MountMode);

static const char *mount_entry_path(const MountEntry *p) {

assert(p);

/* Returns the path of this bind mount. If the malloc()-allocated ->path_buffer field is set we return that,

return p->path_malloc ?: p->path_const;

}

static const char *mount_entry_unprefixed_path(const MountEntry *p) {

assert(p);

/* Returns the unprefixed path (ie: before prefix_where_needed() ran), if any */

return p->unprefixed_path_malloc ?: p->unprefixed_path_const ?: mount_entry_path(p);

}

static void mount_entry_consume_prefix(MountEntry *p, char *new_path) {

assert(p);

assert(p->path_malloc || p->path_const);

assert(new_path);

/* Saves current path in unprefixed_ variable, and takes over new_path */

free_and_replace(p->unprefixed_path_malloc, p->path_malloc);

/* If we didn't have a path on the heap, then it's a static one */

if (!p->unprefixed_path_malloc)

p->unprefixed_path_const = p->path_const;

p->path_malloc = new_path;

p->has_prefix = true;

}

static bool mount_entry_read_only(const MountEntry *p) {

assert(p);

return p->read_only || IN_SET(p->mode, READONLY, INACCESSIBLE, PRIVATE_TMP_READONLY);

}

static bool mount_entry_noexec(const MountEntry *p) {

assert(p);

return p->noexec || IN_SET(p->mode, NOEXEC, INACCESSIBLE, SYSFS, PROCFS);

}

static bool mount_entry_exec(const MountEntry *p) {

assert(p);

return p->exec || p->mode == EXEC;

}

static const char *mount_entry_source(const MountEntry *p) {

assert(p);

return p->source_malloc ?: p->source_const;

}

static const char *mount_entry_options(const MountEntry *p) {

assert(p);

return p->options_malloc ?: p->options_const;

}

static void mount_entry_done(MountEntry *p) {

assert(p);

p->path_malloc = mfree(p->path_malloc);

p->unprefixed_path_malloc = mfree(p->unprefixed_path_malloc);

p->source_malloc = mfree(p->source_malloc);

p->options_malloc = mfree(p->options_malloc);

p->image_options = mount_options_free_all(p->image_options);

}

static int append_access_mounts(MountEntry **p, char **strv, MountMode mode, bool forcibly_require_prefix) {

char **i;

assert(p);

/* Adds a list of user-supplied READWRITE/READWRITE_IMPLICIT/READONLY/INACCESSIBLE entries */

STRV_FOREACH(i, strv) {

bool ignore = false, needs_prefix = false;

const char *e = *i;

/* Look for any prefixes */

if (startswith(e, "-")) {

e++;

ignore = true;

}

if (startswith(e, "+")) {

e++;

needs_prefix = true;

}

if (!path_is_absolute(e))

return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),

"Path is not absolute: %s", e);

*((*p)++) = (MountEntry) {

.path_const = e,

.mode = mode,

.ignore = ignore,

.has_prefix = !needs_prefix && !forcibly_require_prefix,

};

}

return 0;

}

static int append_empty_dir_mounts(MountEntry **p, char **strv) {

char **i;

assert(p);

/* Adds tmpfs mounts to provide readable but empty directories. This is primarily used to implement the

STRV_FOREACH(i, strv) {

*((*p)++) = (MountEntry) {

.path_const = *i,

.mode = EMPTY_DIR,

.ignore = false,

.read_only = true,

.options_const = "mode=755" TMPFS_LIMITS_EMPTY_OR_ALMOST,

.flags = MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,

};

}

return 0;

}

static int append_bind_mounts(MountEntry **p, const BindMount *binds, size_t n) {

assert(p);

for (size_t i = 0; i < n; i++) {

const BindMount *b = binds + i;

*((*p)++) = (MountEntry) {

.path_const = b->destination,

.mode = b->recursive ? BIND_MOUNT_RECURSIVE : BIND_MOUNT,

.read_only = b->read_only,

.nosuid = b->nosuid,

.source_const = b->source,

.ignore = b->ignore_enoent,

};

}

return 0;

}

static int append_mount_images(MountEntry **p, const MountImage *mount_images, size_t n) {

assert(p);

for (size_t i = 0; i < n; i++) {

const MountImage *m = mount_images + i;

*((*p)++) = (MountEntry) {

.path_const = m->destination,

.mode = MOUNT_IMAGES,

.source_const = m->source,

.image_options = m->mount_options,

.ignore = m->ignore_enoent,

};

}

return 0;

}

static int append_extension_images(

size_t n) {

_cleanup_strv_free_ char **overlays = NULL;

char **hierarchy;

int r;

assert(p);

assert(extension_dir);

if (n == 0)

return 0;

/* Prepare a list of overlays, that will have as each element a string suitable for being

STRV_FOREACH(hierarchy, hierarchies) {

_cleanup_free_ char *prefixed_hierarchy = NULL;

prefixed_hierarchy = path_join(root, *hierarchy);

if (!prefixed_hierarchy)

return -ENOMEM;

r = strv_consume(&overlays, TAKE_PTR(prefixed_hierarchy));

if (r < 0)

return r;

}

/* First, prepare a mount for each image, but these won't be visible to the unit, instead

for (size_t i = 0; i < n; i++) {

_cleanup_free_ char *mount_point = NULL;

const MountImage *m = mount_images + i;

r = asprintf(&mount_point, "%s/%zu", extension_dir, i);

if (r < 0)

return -ENOMEM;

for (size_t j = 0; hierarchies && hierarchies[j]; ++j) {

_cleanup_free_ char *prefixed_hierarchy = NULL, *escaped = NULL, *lowerdir = NULL;

prefixed_hierarchy = path_join(mount_point, hierarchies[j]);

if (!prefixed_hierarchy)

return -ENOMEM;

escaped = shell_escape(prefixed_hierarchy, ",:");

if (!escaped)

return -ENOMEM;

/* Note that lowerdir= parameters are in 'reverse' order, so the

lowerdir = strjoin(escaped, ":", overlays[j]);

if (!lowerdir)

return -ENOMEM;

free_and_replace(overlays[j], lowerdir);

}

*((*p)++) = (MountEntry) {

.path_malloc = TAKE_PTR(mount_point),

.image_options = m->mount_options,

.ignore = m->ignore_enoent,

.source_const = m->source,

.mode = EXTENSION_IMAGES,

.has_prefix = true,

};

}

/* Then, for each hierarchy, prepare an overlay with the list of lowerdir= strings

for (size_t i = 0; hierarchies && hierarchies[i]; ++i) {

_cleanup_free_ char *prefixed_hierarchy = NULL;

prefixed_hierarchy = path_join(root, hierarchies[i]);

if (!prefixed_hierarchy)

return -ENOMEM;

*((*p)++) = (MountEntry) {

.path_malloc = TAKE_PTR(prefixed_hierarchy),

.options_malloc = TAKE_PTR(overlays[i]),

.mode = OVERLAY_MOUNT,

.has_prefix = true,

.ignore = true, /* If the source image doesn't set the ignore bit it will fail earlier. */

};

}

return 0;

}

static int append_tmpfs_mounts(MountEntry **p, const TemporaryFileSystem *tmpfs, size_t n) {

assert(p);

for (size_t i = 0; i < n; i++) {

const TemporaryFileSystem *t = tmpfs + i;

_cleanup_free_ char *o = NULL, *str = NULL;

unsigned long flags;

bool ro = false;

int r;

if (!path_is_absolute(t->path))

return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),

"Path is not absolute: %s",

t->path);

str = strjoin("mode=0755" NESTED_TMPFS_LIMITS ",", t->options);

if (!str)

return -ENOMEM;

r = mount_option_mangle(str, MS_NODEV|MS_STRICTATIME, &flags, &o);

if (r < 0)

return log_debug_errno(r, "Failed to parse mount option '%s': %m", str);

ro = flags & MS_RDONLY;

if (ro)

flags ^= MS_RDONLY;

*((*p)++) = (MountEntry) {

.path_const = t->path,

.mode = TMPFS,

.read_only = ro,

.options_malloc = TAKE_PTR(o),

.flags = flags,

};

}

return 0;

}

static int append_static_mounts(MountEntry **p, const MountEntry *mounts, size_t n, bool ignore_protect) {

assert(p);

assert(mounts);

/* Adds a list of static pre-defined entries */

for (size_t i = 0; i < n; i++)

*((*p)++) = (MountEntry) {

.path_const = mount_entry_path(mounts+i),

.mode = mounts[i].mode,

.ignore = mounts[i].ignore || ignore_protect,

};

return 0;

}

static int append_protect_home(MountEntry **p, ProtectHome protect_home, bool ignore_protect) {

assert(p);

switch (protect_home) {

case PROTECT_HOME_NO:

return 0;

case PROTECT_HOME_READ_ONLY:

return append_static_mounts(p, protect_home_read_only_table, ELEMENTSOF(protect_home_read_only_table), ignore_protect);

case PROTECT_HOME_TMPFS:

return append_static_mounts(p, protect_home_tmpfs_table, ELEMENTSOF(protect_home_tmpfs_table), ignore_protect);

case PROTECT_HOME_YES:

return append_static_mounts(p, protect_home_yes_table, ELEMENTSOF(protect_home_yes_table), ignore_protect);

default:

assert_not_reached("Unexpected ProtectHome= value");

}

}

static int append_protect_system(MountEntry **p, ProtectSystem protect_system, bool ignore_protect) {

assert(p);

switch (protect_system) {

case PROTECT_SYSTEM_NO:

return 0;

case PROTECT_SYSTEM_STRICT:

return append_static_mounts(p, protect_system_strict_table, ELEMENTSOF(protect_system_strict_table), ignore_protect);

case PROTECT_SYSTEM_YES:

return append_static_mounts(p, protect_system_yes_table, ELEMENTSOF(protect_system_yes_table), ignore_protect);

case PROTECT_SYSTEM_FULL:

return append_static_mounts(p, protect_system_full_table, ELEMENTSOF(protect_system_full_table), ignore_protect);

default:

assert_not_reached("Unexpected ProtectSystem= value");

}

}

static int mount_path_compare(const MountEntry *a, const MountEntry *b) {

int d;

/* EXTENSION_IMAGES will be used by other mounts as a base, so sort them first

d = -CMP(a->mode == EXTENSION_IMAGES, b->mode == EXTENSION_IMAGES);

if (d != 0)

return d;

/* If the paths are not equal, then order prefixes first */

d = path_compare(mount_entry_path(a), mount_entry_path(b));

if (d != 0)

return d;

/* If the paths are equal, check the mode */

return CMP((int) a->mode, (int) b->mode);

}

static int prefix_where_needed(MountEntry *m, size_t n, const char *root_directory) {

/* Prefixes all paths in the bind mount table with the root directory if the entry needs that. */

assert(m || n == 0);

for (size_t i = 0; i < n; i++) {

char *s;

if (m[i].has_prefix)

continue;

s = path_join(root_directory, mount_entry_path(m+i));

if (!s)

return -ENOMEM;

mount_entry_consume_prefix(&m[i], s);

}

return 0;

}

static void drop_duplicates(MountEntry *m, size_t *n) {

MountEntry *f, *t, *previous;

assert(m);

assert(n);

/* Drops duplicate entries. Expects that the array is properly ordered already. */

for (f = m, t = m, previous = NULL; f < m + *n; f++) {

/* The first one wins (which is the one with the more restrictive mode), see mount_path_compare()

if (previous &&

path_equal(mount_entry_path(f), mount_entry_path(previous)) &&

!f->applied && !previous->applied) {

log_debug("%s (%s) is duplicate.", mount_entry_path(f), mount_mode_to_string(f->mode));

/* Propagate the flags to the remaining entry */

previous->read_only = previous->read_only || mount_entry_read_only(f);

previous->noexec = previous->noexec || mount_entry_noexec(f);

previous->exec = previous->exec || mount_entry_exec(f);

mount_entry_done(f);

continue;

}

*t = *f;

previous = t;

t++;

}

*n = t - m;

}

static void drop_inaccessible(MountEntry *m, size_t *n) {

MountEntry *f, *t;

const char *clear = NULL;

assert(m);

assert(n);

/* Drops all entries obstructed by another entry further up the tree. Expects that the array is properly

for (f = m, t = m; f < m + *n; f++) {

/* If we found a path set for INACCESSIBLE earlier, and this entry has it as prefix we should drop

if (clear && path_startswith(mount_entry_path(f), clear)) {

log_debug("%s is masked by %s.", mount_entry_path(f), clear);

mount_entry_done(f);

continue;

}

clear = f->mode == INACCESSIBLE ? mount_entry_path(f) : NULL;

*t = *f;

t++;

}

*n = t - m;

}

static void drop_nop(MountEntry *m, size_t *n) {

MountEntry *f, *t;

assert(m);

assert(n);

/* Drops all entries which have an immediate parent that has the same type, as they are redundant. Assumes the

for (f = m, t = m; f < m + *n; f++) {

/* Only suppress such subtrees for READONLY, READWRITE and READWRITE_IMPLICIT entries */

if (IN_SET(f->mode, READONLY, READWRITE, READWRITE_IMPLICIT)) {

MountEntry *p;

bool found = false;

/* Now let's find the first parent of the entry we are looking at. */

for (p = t-1; p >= m; p--) {

if (path_startswith(mount_entry_path(f), mount_entry_path(p))) {

found = true;

break;

}

}

/* We found it, let's see if it's the same mode, if so, we can drop this entry */

if (found && p->mode == f->mode) {

log_debug("%s (%s) is made redundant by %s (%s)",

mount_entry_path(f), mount_mode_to_string(f->mode),

mount_entry_path(p), mount_mode_to_string(p->mode));

mount_entry_done(f);

continue;

}

}

*t = *f;

t++;

}

*n = t - m;

}

static void drop_outside_root(const char *root_directory, MountEntry *m, size_t *n) {

MountEntry *f, *t;

assert(m);

assert(n);

/* Nothing to do */

if (!root_directory)

return;

/* Drops all mounts that are outside of the root directory. */

for (f = m, t = m; f < m + *n; f++) {

/* ExtensionImages bases are opened in /run/systemd/unit-extensions on the host */

if (f->mode != EXTENSION_IMAGES && !path_startswith(mount_entry_path(f), root_directory)) {

log_debug("%s is outside of root directory.", mount_entry_path(f));

mount_entry_done(f);

continue;

}

*t = *f;

t++;

}

*n = t - m;

}

static int clone_device_node(

const char *d,

const char *temporary_mount,

bool *make_devnode) {

_cleanup_free_ char *sl = NULL;

const char *dn, *bn, *t;

struct stat st;

int r;

if (stat(d, &st) < 0) {

if (errno == ENOENT) {

log_debug_errno(errno, "Device node '%s' to clone does not exist, ignoring.", d);

return -ENXIO;

}

return log_debug_errno(errno, "Failed to stat() device node '%s' to clone, ignoring: %m", d);

}

if (!S_ISBLK(st.st_mode) &&

!S_ISCHR(st.st_mode))

return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),

"Device node '%s' to clone is not a device node, ignoring.",

d);

dn = strjoina(temporary_mount, d);

/* First, try to create device node properly */

if (*make_devnode) {

mac_selinux_create_file_prepare(d, st.st_mode);

r = mknod(dn, st.st_mode, st.st_rdev);

mac_selinux_create_file_clear();

if (r >= 0)

goto add_symlink;

if (errno != EPERM)

return log_debug_errno(errno, "mknod failed for %s: %m", d);

/* This didn't work, let's not try this again for the next iterations. */

*make_devnode = false;

}

/* We're about to fall back to bind-mounting the device

r = mknod(dn, S_IFREG, 0);

if (r < 0 && errno != EEXIST)

return log_debug_errno(errno, "mknod() fallback failed for '%s': %m", d);

/* Fallback to bind-mounting: The assumption here is that all used device nodes carry standard

r = mount_nofollow_verbose(LOG_DEBUG, d, dn, NULL, MS_BIND, NULL);

if (r < 0)

return r;

add_symlink:

bn = path_startswith(d, "/dev/");

if (!bn)

return 0;

/* Create symlinks like /dev/char/1:9 → ../urandom */

if (asprintf(&sl, "%s/dev/%s/%u:%u",

temporary_mount,

S_ISCHR(st.st_mode) ? "char" : "block",

major(st.st_rdev), minor(st.st_rdev)) < 0)

return log_oom();

(void) mkdir_parents(sl, 0755);

t = strjoina("../", bn);

if (symlink(t, sl) < 0)

log_debug_errno(errno, "Failed to symlink '%s' to '%s', ignoring: %m", t, sl);

return 0;

}

static int mount_private_dev(MountEntry *m) {

static const char devnodes[] =

"/dev/null\0"

"/dev/zero\0"

"/dev/full\0"

"/dev/random\0"

"/dev/urandom\0"

"/dev/tty\0";

char temporary_mount[] = "/tmp/namespace-dev-XXXXXX";

const char *d, *dev = NULL, *devpts = NULL, *devshm = NULL, *devhugepages = NULL, *devmqueue = NULL, *devlog = NULL, *devptmx = NULL;

bool can_mknod = true;

_cleanup_umask_ mode_t u;

int r;

assert(m);

u = umask(0000);

if (!mkdtemp(temporary_mount))

return log_debug_errno(errno, "Failed to create temporary directory '%s': %m", temporary_mount);

dev = strjoina(temporary_mount, "/dev");

(void) mkdir(dev, 0755);

r = mount_nofollow_verbose(LOG_DEBUG, "tmpfs", dev, "tmpfs", DEV_MOUNT_OPTIONS, "mode=755" TMPFS_LIMITS_DEV);

if (r < 0)

goto fail;

r = label_fix_container(dev, "/dev", 0);

if (r < 0) {

log_debug_errno(errno, "Failed to fix label of '%s' as /dev: %m", dev);

goto fail;

}

devpts = strjoina(temporary_mount, "/dev/pts");

(void) mkdir(devpts, 0755);

r = mount_nofollow_verbose(LOG_DEBUG, "/dev/pts", devpts, NULL, MS_BIND, NULL);

if (r < 0)

goto fail;

/* /dev/ptmx can either be a device node or a symlink to /dev/pts/ptmx.

r = is_symlink("/dev/ptmx");

if (r < 0) {

log_debug_errno(r, "Failed to detect whether /dev/ptmx is a symlink or not: %m");

goto fail;

} else if (r > 0) {

devptmx = strjoina(temporary_mount, "/dev/ptmx");

if (symlink("pts/ptmx", devptmx) < 0) {

r = log_debug_errno(errno, "Failed to create a symlink '%s' to pts/ptmx: %m", devptmx);

goto fail;

}

} else {

r = clone_device_node("/dev/ptmx", temporary_mount, &can_mknod);

if (r < 0)

goto fail;

}

devshm = strjoina(temporary_mount, "/dev/shm");

(void) mkdir(devshm, 0755);

r = mount_nofollow_verbose(LOG_DEBUG, "/dev/shm", devshm, NULL, MS_BIND, NULL);

if (r < 0)

goto fail;

devmqueue = strjoina(temporary_mount, "/dev/mqueue");

(void) mkdir(devmqueue, 0755);

(void) mount_nofollow_verbose(LOG_DEBUG, "/dev/mqueue", devmqueue, NULL, MS_BIND, NULL);

devhugepages = strjoina(temporary_mount, "/dev/hugepages");

(void) mkdir(devhugepages, 0755);

(void) mount_nofollow_verbose(LOG_DEBUG, "/dev/hugepages", devhugepages, NULL, MS_BIND, NULL);

devlog = strjoina(temporary_mount, "/dev/log");

if (symlink("/run/systemd/journal/dev-log", devlog) < 0)

log_debug_errno(errno, "Failed to create a symlink '%s' to /run/systemd/journal/dev-log, ignoring: %m", devlog);

NULSTR_FOREACH(d, devnodes) {

r = clone_device_node(d, temporary_mount, &can_mknod);

/* ENXIO means the *source* is not a device file, skip creation in that case */

if (r < 0 && r != -ENXIO)

goto fail;

}

r = dev_setup(temporary_mount, UID_INVALID, GID_INVALID);

if (r < 0)

log_debug_errno(r, "Failed to set up basic device tree at '%s', ignoring: %m", temporary_mount);

/* Create the /dev directory if missing. It is more likely to be

(void) mkdir_p_label(mount_entry_path(m), 0755);

/* Unmount everything in old /dev */

r = umount_recursive(mount_entry_path(m), 0);

if (r < 0)

log_debug_errno(r, "Failed to unmount directories below '%s', ignoring: %m", mount_entry_path(m));

r = mount_nofollow_verbose(LOG_DEBUG, dev, mount_entry_path(m), NULL, MS_MOVE, NULL);

if (r < 0)

goto fail;

(void) rmdir(dev);

(void) rmdir(temporary_mount);

return 0;

fail:

if (devpts)

(void) umount_verbose(LOG_DEBUG, devpts, UMOUNT_NOFOLLOW);

if (devshm)

(void) umount_verbose(LOG_DEBUG, devshm, UMOUNT_NOFOLLOW);

if (devhugepages)

(void) umount_verbose(LOG_DEBUG, devhugepages, UMOUNT_NOFOLLOW);

if (devmqueue)

(void) umount_verbose(LOG_DEBUG, devmqueue, UMOUNT_NOFOLLOW);

(void) umount_verbose(LOG_DEBUG, dev, UMOUNT_NOFOLLOW);

(void) rmdir(dev);

(void) rmdir(temporary_mount);

return r;

}

static int mount_bind_dev(const MountEntry *m) {

int r;

assert(m);

/* Implements the little brother of mount_private_dev(): simply bind mounts the host's /dev into the service's

(void) mkdir_p_label(mount_entry_path(m), 0755);

r = path_is_mount_point(mount_entry_path(m), NULL, 0);

if (r < 0)

return log_debug_errno(r, "Unable to determine whether /dev is already mounted: %m");

if (r > 0) /* make this a NOP if /dev is already a mount point */

return 0;

r = mount_nofollow_verbose(LOG_DEBUG, "/dev", mount_entry_path(m), NULL, MS_BIND|MS_REC, NULL);

if (r < 0)

return r;

return 1;

}

static int mount_sysfs(const MountEntry *m) {

int r;

assert(m);