Branch data Line data Source code
1 : : /* SPDX-License-Identifier: LGPL-2.1+ */
2 : :
3 : : #include <fcntl.h>
4 : : #include <sched.h>
5 : : #include <sys/mount.h>
6 : : #include <unistd.h>
7 : :
8 : : #include "sd-id128.h"
9 : :
10 : : #include "alloc-util.h"
11 : : #include "fd-util.h"
12 : : #include "fs-util.h"
13 : : #include "id128-util.h"
14 : : #include "log.h"
15 : : #include "machine-id-setup.h"
16 : : #include "macro.h"
17 : : #include "mkdir.h"
18 : : #include "mountpoint-util.h"
19 : : #include "namespace-util.h"
20 : : #include "path-util.h"
21 : : #include "process-util.h"
22 : : #include "stat-util.h"
23 : : #include "string-util.h"
24 : : #include "umask-util.h"
25 : : #include "util.h"
26 : : #include "virt.h"
27 : :
28 : 0 : static int generate_machine_id(const char *root, sd_id128_t *ret) {
29 : : const char *dbus_machine_id;
30 : 0 : _cleanup_close_ int fd = -1;
31 : : int r;
32 : :
33 [ # # ]: 0 : assert(ret);
34 : :
35 : : /* First, try reading the D-Bus machine id, unless it is a symlink */
36 [ # # # # : 0 : dbus_machine_id = prefix_roota(root, "/var/lib/dbus/machine-id");
# # # # #
# # # # #
# # ]
37 : 0 : fd = open(dbus_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
38 [ # # ]: 0 : if (fd >= 0) {
39 [ # # ]: 0 : if (id128_read_fd(fd, ID128_PLAIN, ret) >= 0) {
40 [ # # ]: 0 : log_info("Initializing machine ID from D-Bus machine ID.");
41 : 0 : return 0;
42 : : }
43 : :
44 : 0 : fd = safe_close(fd);
45 : : }
46 : :
47 [ # # ]: 0 : if (isempty(root)) {
48 : : /* If that didn't work, see if we are running in a container,
49 : : * and a machine ID was passed in via $container_uuid the way
50 : : * libvirt/LXC does it */
51 : :
52 [ # # ]: 0 : if (detect_container() > 0) {
53 [ # # ]: 0 : _cleanup_free_ char *e = NULL;
54 : :
55 [ # # # # ]: 0 : if (getenv_for_pid(1, "container_uuid", &e) > 0 &&
56 : 0 : sd_id128_from_string(e, ret) >= 0) {
57 [ # # ]: 0 : log_info("Initializing machine ID from container UUID.");
58 : 0 : return 0;
59 : : }
60 : :
61 [ # # ]: 0 : } else if (detect_vm() == VIRTUALIZATION_KVM) {
62 : :
63 : : /* If we are not running in a container, see if we are
64 : : * running in qemu/kvm and a machine ID was passed in
65 : : * via -uuid on the qemu/kvm command line */
66 : :
67 [ # # ]: 0 : if (id128_read("/sys/class/dmi/id/product_uuid", ID128_UUID, ret) >= 0) {
68 [ # # ]: 0 : log_info("Initializing machine ID from KVM UUID.");
69 : 0 : return 0;
70 : : }
71 : : }
72 : : }
73 : :
74 : : /* If that didn't work, generate a random machine id */
75 : 0 : r = sd_id128_randomize(ret);
76 [ # # ]: 0 : if (r < 0)
77 [ # # ]: 0 : return log_error_errno(r, "Failed to generate randomized machine ID: %m");
78 : :
79 [ # # ]: 0 : log_info("Initializing machine ID from random generator.");
80 : 0 : return 0;
81 : : }
82 : :
83 : 0 : int machine_id_setup(const char *root, sd_id128_t machine_id, sd_id128_t *ret) {
84 : : const char *etc_machine_id, *run_machine_id;
85 : 0 : _cleanup_close_ int fd = -1;
86 : : bool writable;
87 : : int r;
88 : :
89 [ # # # # : 0 : etc_machine_id = prefix_roota(root, "/etc/machine-id");
# # # # #
# # # # #
# # ]
90 : :
91 [ # # # # ]: 0 : RUN_WITH_UMASK(0000) {
92 : : /* We create this 0444, to indicate that this isn't really
93 : : * something you should ever modify. Of course, since the file
94 : : * will be owned by root it doesn't matter much, but maybe
95 : : * people look. */
96 : :
97 : 0 : (void) mkdir_parents(etc_machine_id, 0755);
98 : 0 : fd = open(etc_machine_id, O_RDWR|O_CREAT|O_CLOEXEC|O_NOCTTY, 0444);
99 [ # # ]: 0 : if (fd < 0) {
100 : 0 : int old_errno = errno;
101 : :
102 : 0 : fd = open(etc_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY);
103 [ # # ]: 0 : if (fd < 0) {
104 [ # # # # ]: 0 : if (old_errno == EROFS && errno == ENOENT)
105 [ # # ]: 0 : return log_error_errno(errno,
106 : : "System cannot boot: Missing /etc/machine-id and /etc is mounted read-only.\n"
107 : : "Booting up is supported only when:\n"
108 : : "1) /etc/machine-id exists and is populated.\n"
109 : : "2) /etc/machine-id exists and is empty.\n"
110 : : "3) /etc/machine-id is missing and /etc is writable.\n");
111 : : else
112 [ # # ]: 0 : return log_error_errno(errno, "Cannot open %s: %m", etc_machine_id);
113 : : }
114 : :
115 : 0 : writable = false;
116 : : } else
117 : 0 : writable = true;
118 : : }
119 : :
120 : : /* A we got a valid machine ID argument, that's what counts */
121 [ # # ]: 0 : if (sd_id128_is_null(machine_id)) {
122 : :
123 : : /* Try to read any existing machine ID */
124 [ # # ]: 0 : if (id128_read_fd(fd, ID128_PLAIN, ret) >= 0)
125 : 0 : return 0;
126 : :
127 : : /* Hmm, so, the id currently stored is not useful, then let's generate one */
128 : 0 : r = generate_machine_id(root, &machine_id);
129 [ # # ]: 0 : if (r < 0)
130 : 0 : return r;
131 : : }
132 : :
133 [ # # ]: 0 : if (writable) {
134 [ # # ]: 0 : if (lseek(fd, 0, SEEK_SET) == (off_t) -1)
135 [ # # ]: 0 : return log_error_errno(errno, "Failed to seek %s: %m", etc_machine_id);
136 : :
137 [ # # ]: 0 : if (ftruncate(fd, 0) < 0)
138 [ # # ]: 0 : return log_error_errno(errno, "Failed to truncate %s: %m", etc_machine_id);
139 : :
140 [ # # ]: 0 : if (id128_write_fd(fd, ID128_PLAIN, machine_id, true) >= 0)
141 : 0 : goto finish;
142 : : }
143 : :
144 : 0 : fd = safe_close(fd);
145 : :
146 : : /* Hmm, we couldn't write it? So let's write it to /run/machine-id as a replacement */
147 : :
148 [ # # # # : 0 : run_machine_id = prefix_roota(root, "/run/machine-id");
# # # # #
# # # # #
# # ]
149 : :
150 [ # # ]: 0 : RUN_WITH_UMASK(0022)
151 : 0 : r = id128_write(run_machine_id, ID128_PLAIN, machine_id, false);
152 [ # # ]: 0 : if (r < 0) {
153 : 0 : (void) unlink(run_machine_id);
154 [ # # ]: 0 : return log_error_errno(r, "Cannot write %s: %m", run_machine_id);
155 : : }
156 : :
157 : : /* And now, let's mount it over */
158 [ # # ]: 0 : if (mount(run_machine_id, etc_machine_id, NULL, MS_BIND, NULL) < 0) {
159 : 0 : (void) unlink_noerrno(run_machine_id);
160 [ # # ]: 0 : return log_error_errno(errno, "Failed to mount %s: %m", etc_machine_id);
161 : : }
162 : :
163 [ # # ]: 0 : log_info("Installed transient %s file.", etc_machine_id);
164 : :
165 : : /* Mark the mount read-only */
166 [ # # ]: 0 : if (mount(NULL, etc_machine_id, NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, NULL) < 0)
167 [ # # ]: 0 : log_warning_errno(errno, "Failed to make transient %s read-only, ignoring: %m", etc_machine_id);
168 : :
169 : 0 : finish:
170 [ # # ]: 0 : if (ret)
171 : 0 : *ret = machine_id;
172 : :
173 : 0 : return 0;
174 : : }
175 : :
176 : 0 : int machine_id_commit(const char *root) {
177 : 0 : _cleanup_close_ int fd = -1, initial_mntns_fd = -1;
178 : : const char *etc_machine_id;
179 : : sd_id128_t id;
180 : : int r;
181 : :
182 : : /* Replaces a tmpfs bind mount of /etc/machine-id by a proper file, atomically. For this, the umount is removed
183 : : * in a mount namespace, a new file is created at the right place. Afterwards the mount is also removed in the
184 : : * original mount namespace, thus revealing the file that was just created. */
185 : :
186 [ # # # # : 0 : etc_machine_id = prefix_roota(root, "/etc/machine-id");
# # # # #
# # # # #
# # ]
187 : :
188 : 0 : r = path_is_mount_point(etc_machine_id, NULL, 0);
189 [ # # ]: 0 : if (r < 0)
190 [ # # ]: 0 : return log_error_errno(r, "Failed to determine whether %s is a mount point: %m", etc_machine_id);
191 [ # # ]: 0 : if (r == 0) {
192 [ # # ]: 0 : log_debug("%s is not a mount point. Nothing to do.", etc_machine_id);
193 : 0 : return 0;
194 : : }
195 : :
196 : : /* Read existing machine-id */
197 : 0 : fd = open(etc_machine_id, O_RDONLY|O_CLOEXEC|O_NOCTTY);
198 [ # # ]: 0 : if (fd < 0)
199 [ # # ]: 0 : return log_error_errno(errno, "Cannot open %s: %m", etc_machine_id);
200 : :
201 : 0 : r = fd_is_temporary_fs(fd);
202 [ # # ]: 0 : if (r < 0)
203 [ # # ]: 0 : return log_error_errno(r, "Failed to determine whether %s is on a temporary file system: %m", etc_machine_id);
204 [ # # ]: 0 : if (r == 0)
205 [ # # ]: 0 : return log_error_errno(SYNTHETIC_ERRNO(EROFS),
206 : : "%s is not on a temporary file system.",
207 : : etc_machine_id);
208 : :
209 : 0 : r = id128_read_fd(fd, ID128_PLAIN, &id);
210 [ # # ]: 0 : if (r < 0)
211 [ # # ]: 0 : return log_error_errno(r, "We didn't find a valid machine ID in %s: %m", etc_machine_id);
212 : :
213 : 0 : fd = safe_close(fd);
214 : :
215 : : /* Store current mount namespace */
216 : 0 : r = namespace_open(0, NULL, &initial_mntns_fd, NULL, NULL, NULL);
217 [ # # ]: 0 : if (r < 0)
218 [ # # ]: 0 : return log_error_errno(r, "Can't fetch current mount namespace: %m");
219 : :
220 : : /* Switch to a new mount namespace, isolate ourself and unmount etc_machine_id in our new namespace */
221 [ # # ]: 0 : if (unshare(CLONE_NEWNS) < 0)
222 [ # # ]: 0 : return log_error_errno(errno, "Failed to enter new namespace: %m");
223 : :
224 [ # # ]: 0 : if (mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL) < 0)
225 [ # # ]: 0 : return log_error_errno(errno, "Couldn't make-rslave / mountpoint in our private namespace: %m");
226 : :
227 [ # # ]: 0 : if (umount(etc_machine_id) < 0)
228 [ # # ]: 0 : return log_error_errno(errno, "Failed to unmount transient %s file in our private namespace: %m", etc_machine_id);
229 : :
230 : : /* Update a persistent version of etc_machine_id */
231 : 0 : r = id128_write(etc_machine_id, ID128_PLAIN, id, true);
232 [ # # ]: 0 : if (r < 0)
233 [ # # ]: 0 : return log_error_errno(r, "Cannot write %s. This is mandatory to get a persistent machine ID: %m", etc_machine_id);
234 : :
235 : : /* Return to initial namespace and proceed a lazy tmpfs unmount */
236 : 0 : r = namespace_enter(-1, initial_mntns_fd, -1, -1, -1);
237 [ # # ]: 0 : if (r < 0)
238 [ # # ]: 0 : return log_warning_errno(r, "Failed to switch back to initial mount namespace: %m.\nWe'll keep transient %s file until next reboot.", etc_machine_id);
239 : :
240 [ # # ]: 0 : if (umount2(etc_machine_id, MNT_DETACH) < 0)
241 [ # # ]: 0 : return log_warning_errno(errno, "Failed to unmount transient %s file: %m.\nWe keep that mount until next reboot.", etc_machine_id);
242 : :
243 : 0 : return 0;
244 : : }
|
