From 5609f6888ba4cbe706ba415e5a94e09d6ef4c122 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 25 May 2018 17:25:17 +0900 Subject: [PATCH 1/2] core: make StateDirectory= or friends works with DynamicUser= and RootDirectory=/RootImage= The symbolic links to private directories specified by StateDirectory= or its friends are created on the host. So, when DynamicUser= and RootDirectory=/RootImage= are set, then the executed process cannot access private directory. This makes the private directories are mounted on the non-private place when both DynamicUser= and RootDirectory=/RootImage= are set. Fixes #8965. --- src/core/execute.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/core/execute.c b/src/core/execute.c index 939bc12b56..285fe5bf39 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -2220,7 +2220,8 @@ static int compile_bind_mounts( continue; if (context->dynamic_user && - !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION)) { + !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) && + !(context->root_directory || context->root_image)) { char *private_root; /* So this is for a dynamic user, and we need to make sure the process can access its own @@ -2251,7 +2252,15 @@ static int compile_bind_mounts( goto finish; } - d = strdup(s); + if (context->dynamic_user && + !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) && + (context->root_directory || context->root_image)) + /* When RootDirectory= or RootImage= are set, then the symbolic link to the private + * directory is not created on the root directory. So, let's bind-mount the directory + * on the 'non-private' place. */ + d = strjoin(params->prefix[t], "/", *suffix); + else + d = strdup(s); if (!d) { free(s); r = -ENOMEM; From 37c56f89d2563e5ee413e6d9ca70b01ecfbc3b4c Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 25 May 2018 17:32:55 +0900 Subject: [PATCH 2/2] core: setup mount namespace when RootDirectory= and RuntimeDirectory= or friends are set The directories specified by RuntimeDirectory= or friends are created on host. So, it is necessary to bind-mount them on root directory. --- src/core/execute.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/src/core/execute.c b/src/core/execute.c index 285fe5bf39..f36672c9df 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -1787,8 +1787,20 @@ static bool exec_needs_mount_namespace( context->protect_control_groups) return true; - if (context->mount_apivfs && (context->root_image || context->root_directory)) - return true; + if (context->root_directory) { + ExecDirectoryType t; + + if (context->mount_apivfs) + return true; + + for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) { + if (!params->prefix[t]) + continue; + + if (!strv_isempty(context->directories[t].paths)) + return true; + } + } if (context->dynamic_user && (!strv_isempty(context->directories[EXEC_DIRECTORY_STATE].paths) ||