1 /* vi: set sw=4 ts=4: */
2 /* Copyright 2005 Rob Landley <rob@landley.net>
4 * Switch from rootfs to another filesystem as the root of the mount tree.
6 * Licensed under GPLv2, see file LICENSE in this source tree.
8 //config:config SWITCH_ROOT
9 //config: bool "switch_root (5.2 kb)"
11 //config: select PLATFORM_LINUX
13 //config: The switch_root utility is used from initramfs to select a new
14 //config: root device. Under initramfs, you have to use this instead of
15 //config: pivot_root. (Stop reading here if you don't care why.)
17 //config: Booting with initramfs extracts a gzipped cpio archive into rootfs
18 //config: (which is a variant of ramfs/tmpfs). Because rootfs can't be moved
19 //config: or unmounted*, pivot_root will not work from initramfs. Instead,
20 //config: switch_root deletes everything out of rootfs (including itself),
21 //config: does a mount --move that overmounts rootfs with the new root, and
22 //config: then execs the specified init program.
24 //config: * Because the Linux kernel uses rootfs internally as the starting
25 //config: and ending point for searching through the kernel's doubly linked
26 //config: list of active mount points. That's why.
28 // RUN_INIT config item is in klibc-utils
30 //applet:IF_SWITCH_ROOT(APPLET(switch_root, BB_DIR_SBIN, BB_SUID_DROP))
31 // APPLET_ODDNAME:name main location suid_type help
32 //applet:IF_RUN_INIT( APPLET_ODDNAME(run-init, switch_root, BB_DIR_SBIN, BB_SUID_DROP, run_init))
34 //kbuild:lib-$(CONFIG_SWITCH_ROOT) += switch_root.o
35 //kbuild:lib-$(CONFIG_RUN_INIT) += switch_root.o
38 #include <sys/mount.h>
40 # include <sys/prctl.h>
41 # include <linux/capability.h>
42 // #include <sys/capability.h>
43 // This header is in libcap, but the functions are in libc.
44 // Comment in the header says this above capset/capget:
45 /* system calls - look to libc for function to system call mapping */
46 extern int capset(cap_user_header_t header, cap_user_data_t data);
47 extern int capget(cap_user_header_t header, const cap_user_data_t data);
48 // so for bbox, let's just repeat the declarations.
49 // This way, libcap needs not be installed in build environment.
54 // Make up for header deficiencies
56 # define RAMFS_MAGIC ((unsigned)0x858458f6)
59 # define TMPFS_MAGIC ((unsigned)0x01021994)
65 // Recursively delete contents of rootfs
66 static void delete_contents(const char *directory, dev_t rootdev)
72 // Don't descend into other filesystems
73 if (lstat(directory, &st) || st.st_dev != rootdev)
76 // Recursively delete the contents of directories
77 if (S_ISDIR(st.st_mode)) {
78 dir = opendir(directory);
80 while ((d = readdir(dir))) {
81 char *newdir = d->d_name;
84 if (DOT_OR_DOTDOT(newdir))
87 // Recurse to delete contents
88 newdir = concat_path_file(directory, newdir);
89 delete_contents(newdir, rootdev);
94 // Directory should now be empty, zap it
98 // It wasn't a directory, zap it
106 static void drop_capset(int cap_idx)
111 caps.data[CAP_TO_INDEX(cap_idx)].inheritable &= ~CAP_TO_MASK(cap_idx);
112 if (capset(&caps.header, caps.data) != 0)
113 bb_perror_msg_and_die("capset");
116 static void drop_bounding_set(int cap_idx)
120 ret = prctl(PR_CAPBSET_READ, cap_idx, 0, 0, 0);
122 bb_perror_msg_and_die("prctl: %s", "PR_CAPBSET_READ");
125 ret = prctl(PR_CAPBSET_DROP, cap_idx, 0, 0, 0);
127 bb_perror_msg_and_die("prctl: %s", "PR_CAPBSET_DROP");
131 static void drop_usermodehelper(const char *filename, int cap_idx)
134 char buf[sizeof(int)*3 * 2 + 8];
138 ret = open_read_close(filename, buf, sizeof(buf) - 1);
140 return; /* assuming files do not exist */
143 ret = sscanf(buf, "%u %u", &lo, &hi);
145 bb_perror_msg_and_die("can't parse file '%s'", filename);
148 lo &= ~(1 << cap_idx);
150 hi &= ~(1 << (cap_idx - 32));
152 fd = xopen(filename, O_WRONLY);
153 fdprintf(fd, "%u %u", lo, hi);
157 static void drop_capabilities(char *string)
161 cap = strtok(string, ",");
165 cap_idx = cap_name_to_number(cap);
166 drop_usermodehelper("/proc/sys/kernel/usermodehelper/bset", cap_idx);
167 drop_usermodehelper("/proc/sys/kernel/usermodehelper/inheritable", cap_idx);
168 drop_bounding_set(cap_idx);
169 drop_capset(cap_idx);
170 bb_error_msg("dropped capability: %s", cap);
171 cap = strtok(NULL, ",");
176 int switch_root_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
177 int switch_root_main(int argc UNUSED_PARAM, char **argv)
179 char *newroot, *console = NULL;
182 unsigned dry_run = 0;
185 // Parse args. '+': stop at first non-option
186 if (ENABLE_SWITCH_ROOT && (!ENABLE_RUN_INIT || applet_name[0] == 's')) {
187 //usage:#define switch_root_trivial_usage
188 //usage: "[-c CONSOLE_DEV] NEW_ROOT NEW_INIT [ARGS]"
189 //usage:#define switch_root_full_usage "\n\n"
190 //usage: "Free initramfs and switch to another root fs:\n"
191 //usage: "chroot to NEW_ROOT, delete all in /, move NEW_ROOT to /,\n"
192 //usage: "execute NEW_INIT. PID must be 1. NEW_ROOT must be a mountpoint.\n"
193 //usage: "\n -c DEV Reopen stdio to DEV after switch"
196 "\0" "-2" /* minimum 2 args */,
201 //usage:#define run_init_trivial_usage
202 //usage: "[-d CAP,CAP...] [-n] [-c CONSOLE_DEV] NEW_ROOT NEW_INIT [ARGS]"
203 //usage:#define run_init_full_usage "\n\n"
204 //usage: "Free initramfs and switch to another root fs:\n"
205 //usage: "chroot to NEW_ROOT, delete all in /, move NEW_ROOT to /,\n"
206 //usage: "execute NEW_INIT. PID must be 1. NEW_ROOT must be a mountpoint.\n"
207 //usage: "\n -c DEV Reopen stdio to DEV after switch"
208 //usage: "\n -d CAPS Drop capabilities"
209 //usage: "\n -n Dry run"
210 char *cap_list = NULL;
211 dry_run = getopt32(argv, "^+"
213 "\0" "-2" /* minimum 2 args */,
219 drop_capabilities(cap_list);
225 // Change to new root directory and verify it's a different fs
230 if (st.st_dev == rootdev || getpid() != 1) {
231 // Show usage, it says new root must be a mountpoint
232 // and we must be PID 1
236 // Additional sanity checks: we're about to rm -rf /, so be REALLY SURE
237 // we mean it. I could make this a CONFIG option, but I would get email
238 // from all the people who WILL destroy their filesystems.
239 if (stat("/init", &st) != 0 || !S_ISREG(st.st_mode)) {
240 bb_error_msg_and_die("'%s' is not a regular file", "/init");
242 statfs("/", &stfs); // this never fails
243 if ((unsigned)stfs.f_type != RAMFS_MAGIC
244 && (unsigned)stfs.f_type != TMPFS_MAGIC
246 bb_error_msg_and_die("root filesystem is not ramfs/tmpfs");
250 // Zap everything out of rootdev
251 delete_contents("/", rootdev);
253 // Overmount / with newdir and chroot into it
254 if (mount(".", "/", NULL, MS_MOVE, NULL)) {
255 // For example, fails when newroot is not a mountpoint
256 bb_perror_msg_and_die("error moving root");
260 // The chdir is needed to recalculate "." and ".." links
261 /*xchdir("/"); - done in xchroot */
263 // If a new console specified, redirect stdin/stdout/stderr to it
265 int fd = open_or_warn(console, O_RDWR);
274 // Does NEW_INIT look like it can be executed?
275 //xstat(argv[0], &st);
276 //if (!S_ISREG(st.st_mode))
277 // bb_perror_msg_and_die("'%s' is not a regular file", argv[0]);
278 if (access(argv[0], X_OK) == 0)
282 execv(argv[0], argv);
284 bb_perror_msg_and_die("can't execute '%s'", argv[0]);
288 From: Rob Landley <rob@landley.net>
289 Date: Tue, Jun 16, 2009 at 7:47 PM
290 Subject: Re: switch_root...
296 If you're _not_ running out of init_ramfs (if for example you're using initrd
297 instead), you probably shouldn't use switch_root because it's the wrong tool.
299 Basically what the sucker does is something like the following shell script:
301 find / -xdev | xargs rm -rf
307 There are a couple reasons that won't work as a shell script:
309 1) If you delete the commands out of your $PATH, your shell scripts can't run
310 more commands, but you can't start using dynamically linked _new_ commands
311 until after you do the chroot because the path to the dynamic linker is wrong.
312 So there's a step that needs to be sort of atomic but can't be as a shell
313 script. (You can work around this with static linking or very carefully laid
314 out paths and sequencing, but it's brittle, ugly, and non-obvious.)
316 2) The "find | rm" bit will actually delete everything because the mount points
317 still show up (even if their contents don't), and rm -rf will then happily zap
318 that. So the first line is an oversimplification of what you need to do _not_
319 to descend into other filesystems and delete their contents.
321 The reason we do this is to free up memory, by the way. Since initramfs is a
322 ramfs, deleting its contents frees up the memory it uses. (We leave it with
323 one remaining dentry for the new mount point, but that's ok.)
325 Note that you cannot ever umount rootfs, for approximately the same reason you
326 can't kill PID 1. The kernel tracks mount points as a doubly linked list, and
327 the pointer to the start/end of that list always points to an entry that's
328 known to be there (rootfs), so it never has to worry about moving that pointer
329 and it never has to worry about the list being empty. (Back around 2.6.13
330 there _was_ a bug that let you umount rootfs, and the system locked hard the
331 instant you did so endlessly looping to find the end of the mount list and
332 never stopping. They fixed it.)
334 Oh, and the reason we mount --move _and_ do the chroot is due to the way "/"
335 works. Each process has two special symlinks, ".", and "/". Each of them
336 points to the dentry of a directory, and give you a location paths can start
337 from. (Historically ".." was also special, because you could enter a
338 directory via a symlink so backing out to the directory you came from doesn't
339 necessarily mean the one physically above where "." points to. These days I
340 think it's just handed off to the filesystem.)
342 Anyway, path resolution starts with "." or "/" (although the "./" at the start
343 of the path may be implicit), meaning it's relative to one of those two
344 directories. Your current directory, and your current root directory. The
345 chdir() syscall changes where "." points to, and the chroot() syscall changes
346 where "/" points to. (Again, both are per-process which is why chroot only
347 affects your current process and its child processes.)
349 Note that chroot() does _not_ change where "." points to, and back before they
350 put crazy security checks into the kernel your current directory could be
351 somewhere you could no longer access after the chroot. (The command line
352 chroot does a cd as well, the chroot _syscall_ is what I'm talking about.)
354 The reason mounting something new over / has no obvious effect is the same
355 reason mounting something over your current directory has no obvious effect:
356 the . and / links aren't recalculated after a mount, so they still point to
357 the same dentry they did before, even if that dentry is no longer accessible
358 by other means. Note that "cd ." is a NOP, and "chroot /" is a nop; both look
359 up the cached dentry and set it right back. They don't re-parse any paths,
360 because they're what all paths your process uses would be relative to.
362 That's why the careful sequencing above: we cd into the new mount point before
363 we do the mount --move. Moving the mount point would otherwise make it
364 totally inaccessible to us because cd-ing to the old path wouldn't give it to
365 us anymore, and cd "/" just gives us the cached dentry from when the process
366 was created (in this case the old initramfs one). But the "." symlink gives
367 us the dentry of the filesystem we just moved, so we can then "chroot ." to
368 copy that dentry to "/" and get the new filesystem. If we _didn't_ save that
369 dentry in "." we couldn't get it back after the mount --move.
371 (Yes, this is all screwy and I had to email questions to Linus Torvalds to get
372 it straight myself. I keep meaning to write up a "how mount actually works"