nspawn: Support idmapped mounts on homed managed home directories (#38069)

Christian made this possible in Linux 6.15 with a new system call
open_tree_attr() that combines open_tree() and mount_setattr(). Because
idmapped mounts are (rightfully) not nested, we have to do some extra
shenanigans to make source we're putting the right source uid in the
userns for any idmapped mounts that we do in nspawn.

Of course we also add the necessary boilerplate to make open_tree_attr()
available in our code and wrap open_tree_attr() and the corresponding
fallback in a new function which we then use everywhere else.

src/basic/forward.h

@@ -36,6 +36,7 @@ struct in_addr;
 struct in6_addr;
 struct inotify_event;
 struct iovec;
+struct mount_attr;
 struct msghdr;
 struct passwd;
 struct pollfd;

src/basic/include/sys/mount.h

@@ -120,3 +120,13 @@ static inline int missing_mount_setattr(int dfd, const char *path, unsigned flag
 }
 #  define mount_setattr missing_mount_setattr
 #endif
+
+#if HAVE_OPEN_TREE_ATTR
+extern int open_tree_attr(int __dfd, const char *__filename, unsigned int __flags, struct mount_attr *__uattr, size_t __usize) __THROW;
+#else
+static inline int missing_open_tree_attr(int dfd, const char *filename, unsigned int flags, struct mount_attr *attr, size_t size) {
+        return syscall(__NR_open_tree_attr, dfd, filename, flags, attr, size);
+}
+
+#  define open_tree_attr missing_open_tree_attr
+#endif

src/basic/missing_syscall_def.h

@@ -6,8 +6,6 @@
  */
 #pragma once
 
-#include "forward.h"
-
 /* Note: if this code looks strange, this is because it is derived from the same
  * template as the per-syscall blocks below. */
 #  if defined(__aarch64__)
@@ -100,7 +98,7 @@
 /* may be an (invalid) negative number due to libseccomp, see PR 13319 */
 #  if defined __NR_close_range && __NR_close_range >= 0
 #    if defined systemd_NR_close_range
-assert_cc(__NR_close_range == systemd_NR_close_range);
+_Static_assert(__NR_close_range == systemd_NR_close_range, "");
 #    endif
 #  else
 #    if defined __NR_close_range
@@ -168,7 +166,7 @@ assert_cc(__NR_close_range == systemd_NR_close_range);
 /* may be an (invalid) negative number due to libseccomp, see PR 13319 */
 #  if defined __NR_fchmodat2 && __NR_fchmodat2 >= 0
 #    if defined systemd_NR_fchmodat2
-assert_cc(__NR_fchmodat2 == systemd_NR_fchmodat2);
+_Static_assert(__NR_fchmodat2 == systemd_NR_fchmodat2, "");
 #    endif
 #  else
 #    if defined __NR_fchmodat2
@@ -236,7 +234,7 @@ assert_cc(__NR_fchmodat2 == systemd_NR_fchmodat2);
 /* may be an (invalid) negative number due to libseccomp, see PR 13319 */
 #  if defined __NR_mount_setattr && __NR_mount_setattr >= 0
 #    if defined systemd_NR_mount_setattr
-assert_cc(__NR_mount_setattr == systemd_NR_mount_setattr);
+_Static_assert(__NR_mount_setattr == systemd_NR_mount_setattr, "");
 #    endif
 #  else
 #    if defined __NR_mount_setattr
@@ -304,7 +302,7 @@ assert_cc(__NR_mount_setattr == systemd_NR_mount_setattr);
 /* may be an (invalid) negative number due to libseccomp, see PR 13319 */
 #  if defined __NR_openat2 && __NR_openat2 >= 0
 #    if defined systemd_NR_openat2
-assert_cc(__NR_openat2 == systemd_NR_openat2);
+_Static_assert(__NR_openat2 == systemd_NR_openat2, "");
 #    endif
 #  else
 #    if defined __NR_openat2
@@ -372,7 +370,7 @@ assert_cc(__NR_openat2 == systemd_NR_openat2);
 /* may be an (invalid) negative number due to libseccomp, see PR 13319 */
 #  if defined __NR_quotactl_fd && __NR_quotactl_fd >= 0
 #    if defined systemd_NR_quotactl_fd
-assert_cc(__NR_quotactl_fd == systemd_NR_quotactl_fd);
+_Static_assert(__NR_quotactl_fd == systemd_NR_quotactl_fd, "");
 #    endif
 #  else
 #    if defined __NR_quotactl_fd
@@ -440,7 +438,7 @@ assert_cc(__NR_quotactl_fd == systemd_NR_quotactl_fd);
 /* may be an (invalid) negative number due to libseccomp, see PR 13319 */
 #  if defined __NR_removexattrat && __NR_removexattrat >= 0
 #    if defined systemd_NR_removexattrat
-assert_cc(__NR_removexattrat == systemd_NR_removexattrat);
+_Static_assert(__NR_removexattrat == systemd_NR_removexattrat, "");
 #    endif
 #  else
 #    if defined __NR_removexattrat
@@ -508,7 +506,7 @@ assert_cc(__NR_removexattrat == systemd_NR_removexattrat);
 /* may be an (invalid) negative number due to libseccomp, see PR 13319 */
 #  if defined __NR_setxattrat && __NR_setxattrat >= 0
 #    if defined systemd_NR_setxattrat
-assert_cc(__NR_setxattrat == systemd_NR_setxattrat);
+_Static_assert(__NR_setxattrat == systemd_NR_setxattrat, "");
 #    endif
 #  else
 #    if defined __NR_setxattrat
@@ -519,3 +517,71 @@ assert_cc(__NR_setxattrat == systemd_NR_setxattrat);
 #    endif
 #  endif
 #endif
+
+#ifndef __IGNORE_open_tree_attr
+#  if defined(__aarch64__)
+#    define systemd_NR_open_tree_attr 467
+#  elif defined(__alpha__)
+#    define systemd_NR_open_tree_attr 577
+#  elif defined(__arc__) || defined(__tilegx__)
+#    define systemd_NR_open_tree_attr 467
+#  elif defined(__arm__)
+#    define systemd_NR_open_tree_attr 467
+#  elif defined(__i386__)
+#    define systemd_NR_open_tree_attr 467
+#  elif defined(__ia64__)
+#    define systemd_NR_open_tree_attr -1
+#  elif defined(__loongarch_lp64)
+#    define systemd_NR_open_tree_attr 467
+#  elif defined(__m68k__)
+#    define systemd_NR_open_tree_attr 467
+#  elif defined(_MIPS_SIM)
+#    if _MIPS_SIM == _MIPS_SIM_ABI32
+#      define systemd_NR_open_tree_attr 4467
+#    elif _MIPS_SIM == _MIPS_SIM_NABI32
+#      define systemd_NR_open_tree_attr 6467
+#    elif _MIPS_SIM == _MIPS_SIM_ABI64
+#      define systemd_NR_open_tree_attr 5467
+#    else
+#      error "Unknown MIPS ABI"
+#    endif
+#  elif defined(__hppa__)
+#    define systemd_NR_open_tree_attr 467
+#  elif defined(__powerpc__)
+#    define systemd_NR_open_tree_attr 467
+#  elif defined(__riscv)
+#    if __riscv_xlen == 32
+#      define systemd_NR_open_tree_attr 467
+#    elif __riscv_xlen == 64
+#      define systemd_NR_open_tree_attr 467
+#    else
+#      error "Unknown RISC-V ABI"
+#    endif
+#  elif defined(__s390__)
+#    define systemd_NR_open_tree_attr 467
+#  elif defined(__sparc__)
+#    define systemd_NR_open_tree_attr 467
+#  elif defined(__x86_64__)
+#    if defined(__ILP32__)
+#      define systemd_NR_open_tree_attr (467 | /* __X32_SYSCALL_BIT */ 0x40000000)
+#    else
+#      define systemd_NR_open_tree_attr 467
+#    endif
+#  elif !defined(missing_arch_template)
+#    warning "open_tree_attr() syscall number is unknown for your architecture"
+#  endif
+
+/* may be an (invalid) negative number due to libseccomp, see PR 13319 */
+#  if defined __NR_open_tree_attr && __NR_open_tree_attr >= 0
+#    if defined systemd_NR_open_tree_attr
+_Static_assert(__NR_open_tree_attr == systemd_NR_open_tree_attr, "");
+#    endif
+#  else
+#    if defined __NR_open_tree_attr
+#      undef __NR_open_tree_attr
+#    endif
+#    if defined systemd_NR_open_tree_attr && systemd_NR_open_tree_attr >= 0
+#      define __NR_open_tree_attr systemd_NR_open_tree_attr
+#    endif
+#  endif
+#endif

src/basic/missing_syscalls.py

@@ -9,6 +9,7 @@ SYSCALLS = [
     'close_range',   # defined in glibc header since glibc-2.33
     'fchmodat2',     # defined in glibc header since glibc-2.39
     'mount_setattr', # defined in glibc header since glibc-2.34
+    'open_tree_attr',
     'openat2',       # defined in glibc header since glibc-2.32
     'quotactl_fd',   # defined in glibc header since glibc-2.35
     'removexattrat',
@@ -96,7 +97,7 @@ DEF_TEMPLATE_C = '''\
 /* may be an (invalid) negative number due to libseccomp, see PR 13319 */
 #  if defined __NR_{syscall} && __NR_{syscall} >= 0
 #    if defined systemd_NR_{syscall}
-assert_cc(__NR_{syscall} == systemd_NR_{syscall});
+_Static_assert(__NR_{syscall} == systemd_NR_{syscall}, "");
 #    endif
 #  else
 #    if defined __NR_{syscall}