X Tutup
Skip to content

Commit 6faecbd

Browse files
blucabluca
committed
systemctl: add new option to mount image inside a running service namespace
Use the new DBUS method and follow the same pattern as the systemctl bind command.
1 parent af47713 commit 6faecbd

File tree

7 files changed

+126
-2
lines changed

7 files changed

+126
-2
lines changed

‎man/systemctl.xml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -567,6 +567,24 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
567567
<option>ExecStartPre=</option>, etc.) </para></listitem>
568568
</varlistentry>
569569

570+
<varlistentry>
571+
<term><command>mount-image</command> <replaceable>UNIT</replaceable> <replaceable>IMAGE</replaceable> [<replaceable>PATH</replaceable> [<replaceable>PARTITION_NAME</replaceable>:<replaceable>MOUNT_OPTIONS</replaceable>]]</term>
572+
573+
<listitem><para>Mounts an image from the host into the specified unit's view. The first path argument is the source
574+
image on the host, the second path argument is the destination directory in the unit's view (ie: inside
575+
<option>RootImage=</option>/<option>RootDirectory=</option>). Any following argument is interpreted as a
576+
colon-separated tuple of partition name and comma-separated list of mount options for that partition. The format is the
577+
same as the service <option>MountImages=</option> setting. When combined with the <option>--read-only</option> switch, a
578+
ready-only mount is created. When combined with the <option>--mkdir</option> switch, the destination path is first
579+
created before the mount is applied. Note that this option is currently only supported for units that run within a mount
580+
namespace (e.g.: with <option>RootImage=</option>, <option>PrivateMounts=</option>, etc.).
581+
Note that the namespace mentioned here, where the image mount will be added to, is the one where the main service
582+
process runs, as other processes run in distinct namespaces (e.g.: <option>ExecReload=</option>,
583+
<option>ExecStartPre=</option>, etc.). Example:
584+
<programlisting>systemctl mount-image foo.service /tmp/img.raw /var/lib/image root:ro,nosuid</programlisting>
585+
<programlisting>systemctl mount-image --mkdir bar.service /tmp/img.raw /var/lib/baz/img</programlisting></para></listitem>
586+
</varlistentry>
587+
570588
<varlistentry>
571589
<term><command>service-log-level</command> <replaceable>SERVICE</replaceable> [<replaceable>LEVEL</replaceable>]</term>
572590

‎shell-completion/bash/systemctl.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@ _systemctl () {
214214
list-timers list-units list-unit-files poweroff
215215
reboot rescue show-environment suspend get-default
216216
is-system-running preset-all'
217-
[FILE]='link switch-root bind'
217+
[FILE]='link switch-root bind mount-image'
218218
[TARGETS]='set-default'
219219
[MACHINES]='list-machines'
220220
[LOG_LEVEL]='log-level'

‎shell-completion/zsh/_systemctl.in‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
"list-dependencies:Show unit dependency tree"
3333
"clean:Remove configuration, state, cache, logs or runtime data of units"
3434
"bind:Bind mount a path from the host into a unit's namespace"
35+
"mount-image:Mount an image from the host into a unit's namespace"
3536
)
3637

3738
local -a machine_commands=(
@@ -383,6 +384,10 @@ done
383384
_files
384385
}
385386

387+
(( $+functions[_systemctl_mount-image] )) || _systemctl_mount-image() {
388+
_files
389+
}
390+
386391
# no systemctl completion for:
387392
# [STANDALONE]='daemon-reexec daemon-reload default
388393
# emergency exit halt kexec list-jobs list-units

‎src/systemctl/systemctl-mount.c‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
#include "bus-error.h"
44
#include "bus-locator.h"
5+
#include "dissect-image.h"
56
#include "systemctl-mount.h"
67
#include "systemctl-util.h"
78
#include "systemctl.h"
@@ -39,3 +40,77 @@ int mount_bind(int argc, char *argv[], void *userdata) {
3940

4041
return 0;
4142
}
43+
44+
int mount_image(int argc, char *argv[], void *userdata) {
45+
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
46+
const char *unit = argv[1], *src = argv[2], *dest = argv[3];
47+
_cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
48+
_cleanup_free_ char *n = NULL;
49+
sd_bus *bus;
50+
int r;
51+
52+
r = acquire_bus(BUS_MANAGER, &bus);
53+
if (r < 0)
54+
return r;
55+
56+
polkit_agent_open_maybe();
57+
58+
r = unit_name_mangle(unit, arg_quiet ? 0 : UNIT_NAME_MANGLE_WARN, &n);
59+
if (r < 0)
60+
return log_error_errno(r, "Failed to mangle unit name: %m");
61+
62+
r = bus_message_new_method_call(
63+
bus,
64+
&m,
65+
bus_systemd_mgr,
66+
"MountImageUnit");
67+
if (r < 0)
68+
return bus_log_create_error(r);
69+
70+
r = sd_bus_message_append(
71+
m,
72+
"sssbb",
73+
n,
74+
src,
75+
dest,
76+
arg_read_only,
77+
arg_mkdir);
78+
if (r < 0)
79+
return bus_log_create_error(r);
80+
81+
r = sd_bus_message_open_container(m, 'a', "(ss)");
82+
if (r < 0)
83+
return bus_log_create_error(r);
84+
85+
if (argc > 4) {
86+
_cleanup_free_ char *partition = NULL, *mount_options = NULL;
87+
const char *options = argv[4];
88+
89+
r = extract_many_words(&options, ":", EXTRACT_CUNESCAPE|EXTRACT_UNESCAPE_SEPARATORS, &partition, &mount_options, NULL);
90+
if (r < 0)
91+
return r;
92+
/* Single set of options, applying to the root partition/single filesystem */
93+
if (r == 1) {
94+
r = sd_bus_message_append(m, "(ss)", "root", partition);
95+
if (r < 0)
96+
return bus_log_create_error(r);
97+
} else if (r > 1) {
98+
if (partition_designator_from_string(partition) < 0)
99+
return bus_log_create_error(-EINVAL);
100+
101+
r = sd_bus_message_append(m, "(ss)", partition, mount_options);
102+
if (r < 0)
103+
return bus_log_create_error(r);
104+
}
105+
}
106+
107+
r = sd_bus_message_close_container(m);
108+
if (r < 0)
109+
return bus_log_create_error(r);
110+
111+
r = sd_bus_call(bus, m, -1, &error, NULL);
112+
if (r < 0)
113+
return log_error_errno(r, "Failed to mount image: %s", bus_error_message(&error, r));
114+
115+
return 0;
116+
}

‎src/systemctl/systemctl-mount.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,4 @@
22
#pragma once
33

44
int mount_bind(int argc, char *argv[], void *userdata);
5+
int mount_image(int argc, char *argv[], void *userdata);

‎src/systemctl/systemctl.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,8 @@ static int systemctl_help(void) {
162162
" set-property UNIT PROPERTY=VALUE... Sets one or more properties of a unit\n"
163163
" bind UNIT PATH [PATH] Bind-mount a path from the host into a\n"
164164
" unit's namespace\n"
165+
" mount-image UNIT PATH [PATH [OPTS]] Mount an image from the host into a\n"
166+
" unit's namespace\n"
165167
" service-log-level SERVICE [LEVEL] Get/set logging threshold for service\n"
166168
" service-log-target SERVICE [TARGET] Get/set logging target for service\n"
167169
" reset-failed [PATTERN...] Reset failed state for all, one, or more\n"
@@ -292,7 +294,7 @@ static int systemctl_help(void) {
292294
" 'utc': 'Day YYYY-MM-DD HH:MM:SS UTC\n"
293295
" 'us+utc': 'Day YYYY-MM-DD HH:MM:SS.UUUUUU UTC\n"
294296
" --read-only Create read-only bind mount\n"
295-
" --mkdir Create directory before bind-mounting, if missing\n"
297+
" --mkdir Create directory before mounting, if missing\n"
296298
"\nSee the %2$s for details.\n"
297299
, program_invocation_short_name
298300
, link
@@ -1065,6 +1067,7 @@ static int systemctl_main(int argc, char *argv[]) {
10651067
{ "add-requires", 3, VERB_ANY, 0, add_dependency },
10661068
{ "edit", 2, VERB_ANY, VERB_ONLINE_ONLY, edit },
10671069
{ "bind", 3, 4, VERB_ONLINE_ONLY, mount_bind },
1070+
{ "mount-image", 4, 5, VERB_ONLINE_ONLY, mount_image },
10681071
{}
10691072
};
10701073

‎test/units/testsuite-50.sh‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,28 @@ grep -q -F "MARKER=1" ${image_dir}/result/c
205205
grep -F "squashfs" ${image_dir}/result/c | grep -q -F "noatime"
206206
grep -F "squashfs" ${image_dir}/result/c | grep -q -F -v "nosuid"
207207

208+
# Adding a new mounts at runtime works if the unit is in the active state,
209+
# so use Type=notify to make sure there's no race condition in the test
210+
cat > /run/systemd/system/testservice-50d.service <<EOF
211+
[Service]
212+
RuntimeMaxSec=300
213+
Type=notify
214+
RemainAfterExit=yes
215+
MountAPIVFS=yes
216+
PrivateTmp=yes
217+
ExecStart=/bin/sh -c 'systemd-notify --ready; while ! grep -q -F MARKER /tmp/img/usr/lib/os-release; do sleep 0.1; done; mount | grep -F "/tmp/img" | grep -q -F "nosuid"'
218+
EOF
219+
systemctl start testservice-50d.service
220+
221+
systemctl mount-image --mkdir testservice-50d.service ${image}.raw /tmp/img root:nosuid
222+
223+
while systemctl show -P SubState testservice-50d.service | grep -q running
224+
do
225+
sleep 0.1
226+
done
227+
228+
systemctl is-active testservice-50d.service
229+
208230
echo OK >/testok
209231

210232
exit 0

0 commit comments

Comments
 (0)
X Tutup