20701275481

Committed 04 Jan 2026 11:26PM UTC coverage: 72.733% (+0.03%) from 72.702%

Build # 20701275481

Build Type

push

github

Committed by

yuwata

Commit Message

meson: remove deprecated meson options

These options are deprecated since
- 87541e254 : -Dcryptolib=
- 710653d3b : -Dintegration-tests=

Run Details

310340 of 426681 relevant lines covered (72.73%)

1174897.51 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

60.0

/src/shared/switch-root.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <unistd.h>

#include "alloc-util.h"
#include "base-filesystem.h"
#include "chase.h"
#include "errno-util.h"
#include "fd-util.h"
#include "log.h"
#include "mkdir-label.h"
#include "mount-util.h"
#include "mountpoint-util.h"
#include "rm-rf.h"
#include "stat-util.h"
#include "switch-root.h"

int switch_root(const char *new_root,
                const char *old_root_after,   /* path below the new root, where to place the old root after the transition; may be NULL to unmount it */
                SwitchRootFlags flags) {

        /* Stuff mounted below /run/ we don't save on soft reboot, as it might have lost its relevance,
         * e.g. removable media and such. We rather want that the new boot mounts this fresh. But on
         * the switch from initrd we do use MS_REC, as it is expected that mounts set up in /run/ are
         * maintained. */
        static const struct {
                const char *path;
                unsigned long mount_flags;                 /* Flags to apply if SWITCH_ROOT_RECURSIVE_RUN is unset */
                unsigned long mount_flags_recursive_run;   /* Flags to apply if SWITCH_ROOT_RECURSIVE_RUN is set (0 if shall be skipped) */
        } transfer_table[] = {
                { "/dev",             MS_BIND|MS_REC,  MS_BIND|MS_REC }, /* Recursive, because we want to save the original /dev/shm/ + /dev/pts/ and similar */
                { "/sys",             MS_BIND|MS_REC,  MS_BIND|MS_REC }, /* Similar, we want to retain various API VFS, or the cgroupv1 /sys/fs/cgroup/ tree */
                { "/proc",            MS_BIND|MS_REC,  MS_BIND|MS_REC }, /* Similar */
                { "/run",             MS_BIND,         MS_BIND|MS_REC }, /* Recursive except on soft reboot, see above */
                { "/run/credentials", MS_BIND|MS_REC,  0 /* skip! */  }, /* Credential mounts should survive */
                { "/run/host",        MS_BIND|MS_REC,  0 /* skip! */  }, /* Host supplied hierarchy should also survive */
        };

        _cleanup_close_ int old_root_fd = -EBADF, new_root_fd = -EBADF;
        _cleanup_free_ char *resolved_old_root_after = NULL;
        int r, istmp;

        assert(new_root);

        /* Check if we shall remove the contents of the old root */
        old_root_fd = open("/", O_DIRECTORY|O_CLOEXEC);
        if (old_root_fd < 0)
                return log_error_errno(errno, "Failed to open root directory: %m");

        new_root_fd = open(new_root, O_PATH|O_DIRECTORY|O_CLOEXEC);
        if (new_root_fd < 0)
                return log_error_errno(errno, "Failed to open target directory '%s': %m", new_root);

        r = fds_are_same_mount(old_root_fd, new_root_fd); /* checks if referenced inodes and mounts match */
        if (r < 0)
                return log_error_errno(r, "Failed to check if old and new root directory/mount are the same: %m");
        if (r > 0) {
                log_debug("Skipping switch root, as old and new root directories/mounts are the same.");
                return 0;
        }

        /* Make the new root directory a mount point if it isn't */
        r = fd_make_mount_point(new_root_fd);
        if (r < 0)
                return log_error_errno(r, "Failed to make new root directory a mount point: %m");
        if (r > 0) {
                int fd;

                /* When the path was not a mount point, then we need to reopen the path, otherwise, it still
                 * points to the underlying directory. */

                fd = open(new_root, O_DIRECTORY|O_CLOEXEC);
                if (fd < 0)
                        return log_error_errno(errno, "Failed to reopen target directory '%s': %m", new_root);

                close_and_replace(new_root_fd, fd);
        }

        if (FLAGS_SET(flags, SWITCH_ROOT_DESTROY_OLD_ROOT)) {
                istmp = fd_is_temporary_fs(old_root_fd);
                if (istmp < 0)
                        return log_error_errno(istmp, "Failed to stat root directory: %m");
                if (istmp > 0)
                        log_debug("Root directory is on tmpfs, will do cleanup later.");
        } else
                istmp = -1; /* don't know */

        if (old_root_after) {
                /* Determine where we shall place the old root after the transition */
                r = chase(old_root_after, new_root, CHASE_PREFIX_ROOT|CHASE_NONEXISTENT, &resolved_old_root_after, NULL);
                if (r < 0)
                        return log_error_errno(r, "Failed to resolve %s/%s: %m", new_root, old_root_after);
                if (r == 0) /* Doesn't exist yet. Let's create it */
                        (void) mkdir_p_label(resolved_old_root_after, 0755);
        }

        /* We are about to unmount various file systems with MNT_DETACH (either explicitly via umount() or
         * indirectly via pivot_root()), and thus do not synchronously wait for them to be fully sync'ed —
         * all while making them invisible/inaccessible in the file system tree for later code. That makes
         * sync'ing them then difficult. Let's hence issue a manual sync() here, so that we at least can
         * guarantee all file systems are an a good state before entering this state. */
        if (!FLAGS_SET(flags, SWITCH_ROOT_DONT_SYNC))
                sync();

        /* Work-around for kernel design: the kernel refuses MS_MOVE if any file systems are mounted
         * MS_SHARED. Hence remount them MS_PRIVATE here as a work-around.
         *
         * https://bugzilla.redhat.com/show_bug.cgi?id=847418 */
        if (mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) < 0)
                return log_error_errno(errno, "Failed to set \"/\" mount propagation to private: %m");

        /* Do not fail if base_filesystem_create() fails. Not all switch roots are like base_filesystem_create() wants
         * them to look like. They might even boot, if they are RO and don't have the FS layout. Just ignore the error
         * and switch_root() nevertheless. */
        (void) base_filesystem_create_fd(new_root_fd, new_root, UID_INVALID, GID_INVALID);

        FOREACH_ELEMENT(transfer, transfer_table) {
                _cleanup_free_ char *chased = NULL;
                unsigned long mount_flags;

                mount_flags = FLAGS_SET(flags, SWITCH_ROOT_RECURSIVE_RUN) ? transfer->mount_flags_recursive_run : transfer->mount_flags;
                if (mount_flags == 0) /* skip if zero */
                        continue;

                if (access(transfer->path, F_OK) < 0) {
                        log_debug_errno(errno, "Path '%s' to move to target root directory, not found, ignoring: %m", transfer->path);
                        continue;
                }

                r = chase(transfer->path, new_root, CHASE_PREFIX_ROOT, &chased, NULL);
                if (r < 0)
                        return log_error_errno(r, "Failed to resolve %s/%s: %m", new_root, transfer->path);

                /* Let's see if it is a mount point already. */
                r = path_is_mount_point(chased);
                if (r < 0)
                        return log_error_errno(r, "Failed to determine whether %s is a mount point: %m", chased);
                if (r > 0) /* If it is already mounted, then do nothing */
                        continue;

                r = mount_nofollow_verbose(LOG_ERR, transfer->path, chased, NULL, mount_flags, NULL);
                if (r < 0)
                        return r;
        }

        if (fchdir(new_root_fd) < 0)
                return log_error_errno(errno, "Failed to change directory to %s: %m", new_root);

        /* We first try a pivot_root() so that we can umount the old root dir. In many cases (i.e. where rootfs is /),
         * that's not possible however, and hence we simply overmount root */
        if (resolved_old_root_after)
                r = RET_NERRNO(pivot_root(".", resolved_old_root_after));
        else {
                r = RET_NERRNO(pivot_root(".", "."));
                if (r >= 0) {
                        /* Now unmount the upper of the two stacked file systems */
                        if (umount2(".", MNT_DETACH) < 0)
                                return log_error_errno(errno, "Failed to unmount the old root: %m");
                }
        }
        if (r < 0) {
                log_debug_errno(r, "Pivoting root file system failed, moving mounts instead: %m");

                if (resolved_old_root_after) {
                        r = mount_nofollow_verbose(LOG_ERR, "/", resolved_old_root_after, NULL, MS_BIND|MS_REC, NULL);
                        if (r < 0)
                                return r;
                }

                /* If we have to use MS_MOVE let's first try to get rid of *all* mounts we can, with the
                 * exception of the path we want to switch to, plus everything leading to it and within
                 * it. This is necessary because unlike pivot_root() just moving the mount to the root via
                 * MS_MOVE won't magically unmount anything below it. Once the chroot() succeeds the mounts
                 * below would still be around but invisible to us, because not accessible via
                 * /proc/self/mountinfo. Hence, let's clean everything up first, as long as we still can. */
                (void) umount_recursive_full(NULL, MNT_DETACH, STRV_MAKE(new_root));

                if (mount(".", "/", NULL, MS_MOVE, NULL) < 0)
                        return log_error_errno(errno, "Failed to move %s to /: %m", new_root);

                if (chroot(".") < 0)
                        return log_error_errno(errno, "Failed to change root: %m");

                if (chdir(".") < 0)
                        return log_error_errno(errno, "Failed to change directory: %m");

                /* Now empty the old root superblock */
                if (istmp > 0) {
                        struct stat rb;

                        if (fstat(old_root_fd, &rb) < 0)
                                return log_error_errno(errno, "Failed to stat old root directory: %m");

                        /* Note: the below won't operate on non-memory file systems (i.e. only on tmpfs, ramfs), and
                         * it will stop at mount boundaries */
                        (void) rm_rf_children(TAKE_FD(old_root_fd), 0, &rb); /* takes possession of the dir fd, even on failure */
                }
        } else
                /* NB: we don't bother with emptying the old root superblock here, under the assumption the
                 * pivot_root() + umount() sufficiently detached from the superblock to the point we don't
                 * need to empty it anymore */
                log_debug("Pivoting root worked.");

        return 0;
}

1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3	#include <fcntl.h>
4	#include <sys/mount.h>
5	#include <sys/stat.h>
6	#include <unistd.h>
7
8	#include "alloc-util.h"
9	#include "base-filesystem.h"
10	#include "chase.h"
11	#include "errno-util.h"
12	#include "fd-util.h"
13	#include "log.h"
14	#include "mkdir-label.h"
15	#include "mount-util.h"
16	#include "mountpoint-util.h"
17	#include "rm-rf.h"
18	#include "stat-util.h"
19	#include "switch-root.h"
20
21	int switch_root(const char *new_root,	11✔
22	const char old_root_after, / path below the new root, where to place the old root after the transition; may be NULL to unmount it */
23	SwitchRootFlags flags) {
24
25	/* Stuff mounted below /run/ we don't save on soft reboot, as it might have lost its relevance,
26	* e.g. removable media and such. We rather want that the new boot mounts this fresh. But on
27	* the switch from initrd we do use MS_REC, as it is expected that mounts set up in /run/ are
28	* maintained. */
29	static const struct {	11✔
30	const char *path;
31	unsigned long mount_flags; /* Flags to apply if SWITCH_ROOT_RECURSIVE_RUN is unset */
32	unsigned long mount_flags_recursive_run; /* Flags to apply if SWITCH_ROOT_RECURSIVE_RUN is set (0 if shall be skipped) */
33	} transfer_table[] = {
34	{ "/dev", MS_BIND\|MS_REC, MS_BIND\|MS_REC }, /* Recursive, because we want to save the original /dev/shm/ + /dev/pts/ and similar */
35	{ "/sys", MS_BIND\|MS_REC, MS_BIND\|MS_REC }, /* Similar, we want to retain various API VFS, or the cgroupv1 /sys/fs/cgroup/ tree */
36	{ "/proc", MS_BIND\|MS_REC, MS_BIND\|MS_REC }, /* Similar */
37	{ "/run", MS_BIND, MS_BIND\|MS_REC }, /* Recursive except on soft reboot, see above */
38	{ "/run/credentials", MS_BIND\|MS_REC, 0 /* skip! / }, / Credential mounts should survive */
39	{ "/run/host", MS_BIND\|MS_REC, 0 /* skip! / }, / Host supplied hierarchy should also survive */
40	};
41
42	_cleanup_close_ int old_root_fd = -EBADF, new_root_fd = -EBADF;	11✔
43	_cleanup_free_ char *resolved_old_root_after = NULL;	11✔
44	int r, istmp;	11✔
45
46	assert(new_root);	11✔
47
48	/* Check if we shall remove the contents of the old root */
49	old_root_fd = open("/", O_DIRECTORY\|O_CLOEXEC);	11✔
50	if (old_root_fd < 0)	11✔
51	return log_error_errno(errno, "Failed to open root directory: %m");	×
52
53	new_root_fd = open(new_root, O_PATH\|O_DIRECTORY\|O_CLOEXEC);	11✔
54	if (new_root_fd < 0)	11✔
55	return log_error_errno(errno, "Failed to open target directory '%s': %m", new_root);	×
56
57	r = fds_are_same_mount(old_root_fd, new_root_fd); /* checks if referenced inodes and mounts match */	11✔
58	if (r < 0)	11✔
59	return log_error_errno(r, "Failed to check if old and new root directory/mount are the same: %m");	×
60	if (r > 0) {	11✔
61	log_debug("Skipping switch root, as old and new root directories/mounts are the same.");	×
62	return 0;	×
63	}
64
65	/* Make the new root directory a mount point if it isn't */
66	r = fd_make_mount_point(new_root_fd);	11✔
67	if (r < 0)	11✔
68	return log_error_errno(r, "Failed to make new root directory a mount point: %m");	×
69	if (r > 0) {	11✔
70	int fd;	×
71
72	/* When the path was not a mount point, then we need to reopen the path, otherwise, it still
73	* points to the underlying directory. */
74
75	fd = open(new_root, O_DIRECTORY\|O_CLOEXEC);	×
76	if (fd < 0)	×
77	return log_error_errno(errno, "Failed to reopen target directory '%s': %m", new_root);	×
78
79	close_and_replace(new_root_fd, fd);	×
80	}
81
82	if (FLAGS_SET(flags, SWITCH_ROOT_DESTROY_OLD_ROOT)) {	11✔
83	istmp = fd_is_temporary_fs(old_root_fd);	11✔
84	if (istmp < 0)	11✔
85	return log_error_errno(istmp, "Failed to stat root directory: %m");	×
86	if (istmp > 0)	11✔
87	log_debug("Root directory is on tmpfs, will do cleanup later.");	11✔
88	} else
89	istmp = -1; /* don't know */
90
91	if (old_root_after) {	11✔
92	/* Determine where we shall place the old root after the transition */
93	r = chase(old_root_after, new_root, CHASE_PREFIX_ROOT\|CHASE_NONEXISTENT, &resolved_old_root_after, NULL);	×
94	if (r < 0)	×
95	return log_error_errno(r, "Failed to resolve %s/%s: %m", new_root, old_root_after);	×
96	if (r == 0) /* Doesn't exist yet. Let's create it */	×
97	(void) mkdir_p_label(resolved_old_root_after, 0755);	×
98	}
99
100	/* We are about to unmount various file systems with MNT_DETACH (either explicitly via umount() or
101	* indirectly via pivot_root()), and thus do not synchronously wait for them to be fully sync'ed —
102	* all while making them invisible/inaccessible in the file system tree for later code. That makes
103	* sync'ing them then difficult. Let's hence issue a manual sync() here, so that we at least can
104	* guarantee all file systems are an a good state before entering this state. */
105	if (!FLAGS_SET(flags, SWITCH_ROOT_DONT_SYNC))	11✔
106	sync();	11✔
107
108	/* Work-around for kernel design: the kernel refuses MS_MOVE if any file systems are mounted
109	* MS_SHARED. Hence remount them MS_PRIVATE here as a work-around.
110	*
111	* https://bugzilla.redhat.com/show_bug.cgi?id=847418 */
112	if (mount(NULL, "/", NULL, MS_REC\|MS_PRIVATE, NULL) < 0)	11✔
113	return log_error_errno(errno, "Failed to set \"/\" mount propagation to private: %m");	×
114
115	/* Do not fail if base_filesystem_create() fails. Not all switch roots are like base_filesystem_create() wants
116	* them to look like. They might even boot, if they are RO and don't have the FS layout. Just ignore the error
117	* and switch_root() nevertheless. */
118	(void) base_filesystem_create_fd(new_root_fd, new_root, UID_INVALID, GID_INVALID);	11✔
119
120	FOREACH_ELEMENT(transfer, transfer_table) {	77✔
121	_cleanup_free_ char *chased = NULL;	66✔
122	unsigned long mount_flags;	66✔
123
124	mount_flags = FLAGS_SET(flags, SWITCH_ROOT_RECURSIVE_RUN) ? transfer->mount_flags_recursive_run : transfer->mount_flags;	66✔
125	if (mount_flags == 0) /* skip if zero */	66✔
126	continue;	22✔
127
128	if (access(transfer->path, F_OK) < 0) {	44✔
129	log_debug_errno(errno, "Path '%s' to move to target root directory, not found, ignoring: %m", transfer->path);	×
130	continue;	×
131	}
132
133	r = chase(transfer->path, new_root, CHASE_PREFIX_ROOT, &chased, NULL);	44✔
134	if (r < 0)	44✔
135	return log_error_errno(r, "Failed to resolve %s/%s: %m", new_root, transfer->path);	×
136
137	/* Let's see if it is a mount point already. */
138	r = path_is_mount_point(chased);	44✔
139	if (r < 0)	44✔
140	return log_error_errno(r, "Failed to determine whether %s is a mount point: %m", chased);	×
141	if (r > 0) /* If it is already mounted, then do nothing */	44✔
142	continue;	×
143
144	r = mount_nofollow_verbose(LOG_ERR, transfer->path, chased, NULL, mount_flags, NULL);	44✔
145	if (r < 0)	44✔
146	return r;
147	}
148
149	if (fchdir(new_root_fd) < 0)	11✔
150	return log_error_errno(errno, "Failed to change directory to %s: %m", new_root);	×
151
152	/* We first try a pivot_root() so that we can umount the old root dir. In many cases (i.e. where rootfs is /),
153	* that's not possible however, and hence we simply overmount root */
154	if (resolved_old_root_after)	11✔
155	r = RET_NERRNO(pivot_root(".", resolved_old_root_after));	×
156	else {
157	r = RET_NERRNO(pivot_root(".", "."));	11✔
158	if (r >= 0) {	11✔
159	/* Now unmount the upper of the two stacked file systems */
160	if (umount2(".", MNT_DETACH) < 0)	×
161	return log_error_errno(errno, "Failed to unmount the old root: %m");	×
162	}
163	}
164	if (r < 0) {	×
165	log_debug_errno(r, "Pivoting root file system failed, moving mounts instead: %m");	11✔
166
167	if (resolved_old_root_after) {	11✔
168	r = mount_nofollow_verbose(LOG_ERR, "/", resolved_old_root_after, NULL, MS_BIND\|MS_REC, NULL);	×
169	if (r < 0)	×
170	return r;	×
171	}
172
173	/* If we have to use MS_MOVE let's first try to get rid of all mounts we can, with the
174	* exception of the path we want to switch to, plus everything leading to it and within
175	* it. This is necessary because unlike pivot_root() just moving the mount to the root via
176	* MS_MOVE won't magically unmount anything below it. Once the chroot() succeeds the mounts
177	* below would still be around but invisible to us, because not accessible via
178	* /proc/self/mountinfo. Hence, let's clean everything up first, as long as we still can. */
179	(void) umount_recursive_full(NULL, MNT_DETACH, STRV_MAKE(new_root));	11✔
180
181	if (mount(".", "/", NULL, MS_MOVE, NULL) < 0)	11✔
182	return log_error_errno(errno, "Failed to move %s to /: %m", new_root);	×
183
184	if (chroot(".") < 0)	11✔
185	return log_error_errno(errno, "Failed to change root: %m");	×
186
187	if (chdir(".") < 0)	11✔
188	return log_error_errno(errno, "Failed to change directory: %m");	×
189
190	/* Now empty the old root superblock */
191	if (istmp > 0) {	11✔
192	struct stat rb;	11✔
193
194	if (fstat(old_root_fd, &rb) < 0)	11✔
195	return log_error_errno(errno, "Failed to stat old root directory: %m");	×
196
197	/* Note: the below won't operate on non-memory file systems (i.e. only on tmpfs, ramfs), and
198	* it will stop at mount boundaries */
199	(void) rm_rf_children(TAKE_FD(old_root_fd), 0, &rb); /* takes possession of the dir fd, even on failure */	11✔
200	}
201	} else
202	/* NB: we don't bother with emptying the old root superblock here, under the assumption the
203	* pivot_root() + umount() sufficiently detached from the superblock to the point we don't
204	* need to empty it anymore */
205	log_debug("Pivoting root worked.");	×
206
207	return 0;
208	}

systemd / systemd / 20701275481

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous