1/* vi: set sw=4 ts=4: */ 2/* 3 * Copyright 2005 Rob Landley <rob@landley.net> 4 * 5 * Switch from rootfs to another filesystem as the root of the mount tree. 6 * 7 * Licensed under GPLv2, see file LICENSE in this source tree. 8 */ 9//config:config SWITCH_ROOT 10//config: bool "switch_root (5.5 kb)" 11//config: default y 12//config: select PLATFORM_LINUX 13//config: help 14//config: The switch_root utility is used from initramfs to select a new 15//config: root device. Under initramfs, you have to use this instead of 16//config: pivot_root. (Stop reading here if you don't care why.) 17//config: 18//config: Booting with initramfs extracts a gzipped cpio archive into rootfs 19//config: (which is a variant of ramfs/tmpfs). Because rootfs can't be moved 20//config: or unmounted*, pivot_root will not work from initramfs. Instead, 21//config: switch_root deletes everything out of rootfs (including itself), 22//config: does a mount --move that overmounts rootfs with the new root, and 23//config: then execs the specified init program. 24//config: 25//config: * Because the Linux kernel uses rootfs internally as the starting 26//config: and ending point for searching through the kernel's doubly linked 27//config: list of active mount points. That's why. 28//config: 29// RUN_INIT config item is in klibc-utils 30 31//applet:IF_SWITCH_ROOT(APPLET(switch_root, BB_DIR_SBIN, BB_SUID_DROP)) 32// APPLET_ODDNAME:name main location suid_type help 33//applet:IF_RUN_INIT( APPLET_ODDNAME(run-init, switch_root, BB_DIR_SBIN, BB_SUID_DROP, run_init)) 34 35//kbuild:lib-$(CONFIG_SWITCH_ROOT) += switch_root.o 36//kbuild:lib-$(CONFIG_RUN_INIT) += switch_root.o 37 38#include <sys/vfs.h> 39#include <sys/mount.h> 40#if ENABLE_RUN_INIT 41# include <sys/prctl.h> 42# ifndef PR_CAPBSET_READ 43# define PR_CAPBSET_READ 23 44# endif 45# ifndef PR_CAPBSET_DROP 46# define PR_CAPBSET_DROP 24 47# endif 48# include <linux/capability.h> 49// #include <sys/capability.h> 50// This header is in libcap, but the functions are in libc. 51// Comment in the header says this above capset/capget: 52/* system calls - look to libc for function to system call mapping */ 53extern int capset(cap_user_header_t header, cap_user_data_t data); 54extern int capget(cap_user_header_t header, const cap_user_data_t data); 55// so for bbox, let's just repeat the declarations. 56// This way, libcap needs not be installed in build environment. 57#endif 58 59#include "libbb.h" 60 61// Make up for header deficiencies 62#ifndef RAMFS_MAGIC 63# define RAMFS_MAGIC ((unsigned)0x858458f6) 64#endif 65#ifndef TMPFS_MAGIC 66# define TMPFS_MAGIC ((unsigned)0x01021994) 67#endif 68#ifndef MS_MOVE 69# define MS_MOVE 8192 70#endif 71 72// Recursively delete contents of rootfs 73static void delete_contents(const char *directory, dev_t rootdev) 74{ 75 DIR *dir; 76 struct dirent *d; 77 struct stat st; 78 79 // Don't descend into other filesystems 80 if (lstat(directory, &st) || st.st_dev != rootdev) 81 return; 82 83 // Recursively delete the contents of directories 84 if (S_ISDIR(st.st_mode)) { 85 dir = opendir(directory); 86 if (dir) { 87 while ((d = readdir(dir))) { 88 char *newdir = d->d_name; 89 90 // Skip . and .. 91 if (DOT_OR_DOTDOT(newdir)) 92 continue; 93 94 // Recurse to delete contents 95 newdir = concat_path_file(directory, newdir); 96 delete_contents(newdir, rootdev); 97 free(newdir); 98 } 99 closedir(dir); 100 101 // Directory should now be empty, zap it 102 rmdir(directory); 103 } 104 } else { 105 // It wasn't a directory, zap it 106 unlink(directory); 107 } 108} 109 110#if ENABLE_RUN_INIT 111DEFINE_STRUCT_CAPS; 112 113static void drop_capset(int cap_idx) 114{ 115 struct caps caps; 116 117 getcaps(&caps); 118 caps.data[CAP_TO_INDEX(cap_idx)].inheritable &= ~CAP_TO_MASK(cap_idx); 119 if (capset(&caps.header, caps.data) != 0) 120 bb_perror_msg_and_die("capset"); 121} 122 123static void drop_bounding_set(int cap_idx) 124{ 125 int ret; 126 127 ret = prctl(PR_CAPBSET_READ, cap_idx, 0, 0, 0); 128 if (ret < 0) 129 bb_perror_msg_and_die("prctl: %s", "PR_CAPBSET_READ"); 130 131 if (ret == 1) { 132 ret = prctl(PR_CAPBSET_DROP, cap_idx, 0, 0, 0); 133 if (ret != 0) 134 bb_perror_msg_and_die("prctl: %s", "PR_CAPBSET_DROP"); 135 } 136} 137 138static void drop_usermodehelper(const char *filename, int cap_idx) 139{ 140 unsigned lo, hi; 141 char buf[sizeof(int)*3 * 2 + 8]; 142 int fd; 143 int ret; 144 145 ret = open_read_close(filename, buf, sizeof(buf) - 1); 146 if (ret < 0) 147 return; /* assuming files do not exist */ 148 149 buf[ret] = '\0'; 150 ret = sscanf(buf, "%u %u", &lo, &hi); 151 if (ret != 2) 152 bb_perror_msg_and_die("can't parse file '%s'", filename); 153 154 if (cap_idx < 32) 155 lo &= ~(1 << cap_idx); 156 else 157 hi &= ~(1 << (cap_idx - 32)); 158 159 fd = xopen(filename, O_WRONLY); 160 fdprintf(fd, "%u %u", lo, hi); 161 close(fd); 162} 163 164static void drop_capabilities(char *string) 165{ 166 char *cap; 167 168 cap = strtok(string, ","); 169 while (cap) { 170 unsigned cap_idx; 171 172 cap_idx = cap_name_to_number(cap); 173 drop_usermodehelper("/proc/sys/kernel/usermodehelper/bset", cap_idx); 174 drop_usermodehelper("/proc/sys/kernel/usermodehelper/inheritable", cap_idx); 175 drop_bounding_set(cap_idx); 176 drop_capset(cap_idx); 177 bb_error_msg("dropped capability: %s", cap); 178 cap = strtok(NULL, ","); 179 } 180} 181#endif 182 183int switch_root_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; 184int switch_root_main(int argc UNUSED_PARAM, char **argv) 185{ 186 char *newroot, *console = NULL; 187 struct stat st; 188 struct statfs stfs; 189 unsigned dry_run = 0; 190 dev_t rootdev; 191 192 // Parse args. '+': stop at first non-option 193 if (ENABLE_SWITCH_ROOT && (!ENABLE_RUN_INIT || applet_name[0] == 's')) { 194//usage:#define switch_root_trivial_usage 195//usage: "[-c CONSOLE_DEV] NEW_ROOT NEW_INIT [ARGS]" 196//usage:#define switch_root_full_usage "\n\n" 197//usage: "Free initramfs and switch to another root fs:\n" 198//usage: "chroot to NEW_ROOT, delete all in /, move NEW_ROOT to /,\n" 199//usage: "execute NEW_INIT. PID must be 1. NEW_ROOT must be a mountpoint.\n" 200//usage: "\n -c DEV Reopen stdio to DEV after switch" 201 getopt32(argv, "^+" 202 "c:" 203 "\0" "-2" /* minimum 2 args */, 204 &console 205 ); 206 } else { 207#if ENABLE_RUN_INIT 208//usage:#define run_init_trivial_usage 209//usage: "[-d CAP,CAP...] [-n] [-c CONSOLE_DEV] NEW_ROOT NEW_INIT [ARGS]" 210//usage:#define run_init_full_usage "\n\n" 211//usage: "Free initramfs and switch to another root fs:\n" 212//usage: "chroot to NEW_ROOT, delete all in /, move NEW_ROOT to /,\n" 213//usage: "execute NEW_INIT. PID must be 1. NEW_ROOT must be a mountpoint.\n" 214//usage: "\n -c DEV Reopen stdio to DEV after switch" 215//usage: "\n -d CAPS Drop capabilities" 216//usage: "\n -n Dry run" 217 char *cap_list = NULL; 218 dry_run = getopt32(argv, "^+" 219 "c:d:n" 220 "\0" "-2" /* minimum 2 args */, 221 &console, 222 &cap_list 223 ); 224 dry_run >>= 2; // -n 225 if (cap_list) 226 drop_capabilities(cap_list); 227#endif 228 } 229 argv += optind; 230 newroot = *argv++; 231 232 // Change to new root directory and verify it's a different fs 233 xchdir(newroot); 234 xstat("/", &st); 235 rootdev = st.st_dev; 236 xstat(".", &st); 237 if (st.st_dev == rootdev) { 238 // Show usage, it says new root must be a mountpoint 239 bb_show_usage(); 240 } 241 if (!dry_run && getpid() != 1) { 242 // Show usage, it says we must be PID 1 243 bb_show_usage(); 244 } 245 246 // Additional sanity checks: we're about to rm -rf /, so be REALLY SURE 247 // we mean it. I could make this a CONFIG option, but I would get email 248 // from all the people who WILL destroy their filesystems. 249 if (stat("/init", &st) != 0 || !S_ISREG(st.st_mode)) { 250 bb_error_msg_and_die("'%s' is not a regular file", "/init"); 251 } 252 statfs("/", &stfs); // this never fails 253 if ((unsigned)stfs.f_type != RAMFS_MAGIC 254 && (unsigned)stfs.f_type != TMPFS_MAGIC 255 ) { 256 bb_error_msg_and_die("root filesystem is not ramfs/tmpfs"); 257 } 258 259 if (!dry_run) { 260 // Zap everything out of rootdev 261 delete_contents("/", rootdev); 262 263 // Overmount / with newdir and chroot into it 264 if (mount(".", "/", NULL, MS_MOVE, NULL)) { 265 // For example, fails when newroot is not a mountpoint 266 bb_perror_msg_and_die("error moving root"); 267 } 268 } 269 xchroot("."); 270 // The chdir is needed to recalculate "." and ".." links 271 /*xchdir("/"); - done in xchroot */ 272 273 // If a new console specified, redirect stdin/stdout/stderr to it 274 if (console) { 275 int fd = open_or_warn(console, O_RDWR); 276 if (fd >= 0) { 277 xmove_fd(fd, 0); 278 xdup2(0, 1); 279 xdup2(0, 2); 280 } 281 } 282 283 if (dry_run) { 284 // Does NEW_INIT look like it can be executed? 285 //xstat(argv[0], &st); 286 //if (!S_ISREG(st.st_mode)) 287 // bb_perror_msg_and_die("'%s' is not a regular file", argv[0]); 288 if (access(argv[0], X_OK) == 0) 289 return 0; 290 } else { 291 // Exec NEW_INIT 292 execv(argv[0], argv); 293 } 294 bb_perror_msg_and_die("can't execute '%s'", argv[0]); 295} 296 297/* 298From: Rob Landley <rob@landley.net> 299Date: Tue, Jun 16, 2009 at 7:47 PM 300Subject: Re: switch_root... 301 302... 303... 304... 305 306If you're _not_ running out of init_ramfs (if for example you're using initrd 307instead), you probably shouldn't use switch_root because it's the wrong tool. 308 309Basically what the sucker does is something like the following shell script: 310 311 find / -xdev | xargs rm -rf 312 cd "$1" 313 shift 314 mount --move . / 315 exec chroot . "$@" 316 317There are a couple reasons that won't work as a shell script: 318 3191) If you delete the commands out of your $PATH, your shell scripts can't run 320more commands, but you can't start using dynamically linked _new_ commands 321until after you do the chroot because the path to the dynamic linker is wrong. 322So there's a step that needs to be sort of atomic but can't be as a shell 323script. (You can work around this with static linking or very carefully laid 324out paths and sequencing, but it's brittle, ugly, and non-obvious.) 325 3262) The "find | rm" bit will actually delete everything because the mount points 327still show up (even if their contents don't), and rm -rf will then happily zap 328that. So the first line is an oversimplification of what you need to do _not_ 329to descend into other filesystems and delete their contents. 330 331The reason we do this is to free up memory, by the way. Since initramfs is a 332ramfs, deleting its contents frees up the memory it uses. (We leave it with 333one remaining dentry for the new mount point, but that's ok.) 334 335Note that you cannot ever umount rootfs, for approximately the same reason you 336can't kill PID 1. The kernel tracks mount points as a doubly linked list, and 337the pointer to the start/end of that list always points to an entry that's 338known to be there (rootfs), so it never has to worry about moving that pointer 339and it never has to worry about the list being empty. (Back around 2.6.13 340there _was_ a bug that let you umount rootfs, and the system locked hard the 341instant you did so endlessly looping to find the end of the mount list and 342never stopping. They fixed it.) 343 344Oh, and the reason we mount --move _and_ do the chroot is due to the way "/" 345works. Each process has two special symlinks, ".", and "/". Each of them 346points to the dentry of a directory, and give you a location paths can start 347from. (Historically ".." was also special, because you could enter a 348directory via a symlink so backing out to the directory you came from doesn't 349necessarily mean the one physically above where "." points to. These days I 350think it's just handed off to the filesystem.) 351 352Anyway, path resolution starts with "." or "/" (although the "./" at the start 353of the path may be implicit), meaning it's relative to one of those two 354directories. Your current directory, and your current root directory. The 355chdir() syscall changes where "." points to, and the chroot() syscall changes 356where "/" points to. (Again, both are per-process which is why chroot only 357affects your current process and its child processes.) 358 359Note that chroot() does _not_ change where "." points to, and back before they 360put crazy security checks into the kernel your current directory could be 361somewhere you could no longer access after the chroot. (The command line 362chroot does a cd as well, the chroot _syscall_ is what I'm talking about.) 363 364The reason mounting something new over / has no obvious effect is the same 365reason mounting something over your current directory has no obvious effect: 366the . and / links aren't recalculated after a mount, so they still point to 367the same dentry they did before, even if that dentry is no longer accessible 368by other means. Note that "cd ." is a NOP, and "chroot /" is a nop; both look 369up the cached dentry and set it right back. They don't re-parse any paths, 370because they're what all paths your process uses would be relative to. 371 372That's why the careful sequencing above: we cd into the new mount point before 373we do the mount --move. Moving the mount point would otherwise make it 374totally inaccessible to us because cd-ing to the old path wouldn't give it to 375us anymore, and cd "/" just gives us the cached dentry from when the process 376was created (in this case the old initramfs one). But the "." symlink gives 377us the dentry of the filesystem we just moved, so we can then "chroot ." to 378copy that dentry to "/" and get the new filesystem. If we _didn't_ save that 379dentry in "." we couldn't get it back after the mount --move. 380 381(Yes, this is all screwy and I had to email questions to Linus Torvalds to get 382it straight myself. I keep meaning to write up a "how mount actually works" 383document someday...) 384*/ 385