blob: aaee35a3e4b7f20dd1c8b782ad91b2c30d573920 [file] [log] [blame]
"Robert P. J. Day"63fc1a92006-07-02 19:47:05 +00001/* vi: set sw=4 ts=4: */
Rob Landley3ea05d32006-03-21 18:20:40 +00002/* Copyright 2005 Rob Landley <rob@landley.net>
3 *
4 * Switch from rootfs to another filesystem as the root of the mount tree.
5 *
Denys Vlasenko0ef64bd2010-08-16 20:14:46 +02006 * Licensed under GPLv2, see file LICENSE in this source tree.
Rob Landley3ea05d32006-03-21 18:20:40 +00007 */
Denys Vlasenkodd898c92016-11-23 11:46:32 +01008//config:config SWITCH_ROOT
9//config: bool "switch_root"
10//config: default y
11//config: select PLATFORM_LINUX
12//config: help
13//config: The switch_root utility is used from initramfs to select a new
14//config: root device. Under initramfs, you have to use this instead of
15//config: pivot_root. (Stop reading here if you don't care why.)
16//config:
17//config: Booting with initramfs extracts a gzipped cpio archive into rootfs
18//config: (which is a variant of ramfs/tmpfs). Because rootfs can't be moved
19//config: or unmounted*, pivot_root will not work from initramfs. Instead,
20//config: switch_root deletes everything out of rootfs (including itself),
21//config: does a mount --move that overmounts rootfs with the new root, and
22//config: then execs the specified init program.
23//config:
24//config: * Because the Linux kernel uses rootfs internally as the starting
25//config: and ending point for searching through the kernel's doubly linked
26//config: list of active mount points. That's why.
27
28//applet:IF_SWITCH_ROOT(APPLET(switch_root, BB_DIR_SBIN, BB_SUID_DROP))
29
30//kbuild:lib-$(CONFIG_SWITCH_ROOT) += switch_root.o
Pere Orga5bc8c002011-04-11 03:29:49 +020031
32//usage:#define switch_root_trivial_usage
33//usage: "[-c /dev/console] NEW_ROOT NEW_INIT [ARGS]"
34//usage:#define switch_root_full_usage "\n\n"
35//usage: "Free initramfs and switch to another root fs:\n"
36//usage: "chroot to NEW_ROOT, delete all in /, move NEW_ROOT to /,\n"
37//usage: "execute NEW_INIT. PID must be 1. NEW_ROOT must be a mountpoint.\n"
Pere Orga5bc8c002011-04-11 03:29:49 +020038//usage: "\n -c DEV Reopen stdio to DEV after switch"
39
Rob Landley0f34a822005-10-27 22:55:50 +000040#include <sys/vfs.h>
Denys Vlasenkoda49f582009-07-08 02:58:38 +020041#include <sys/mount.h>
42#include "libbb.h"
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000043// Make up for header deficiencies
Rob Landley0f34a822005-10-27 22:55:50 +000044#ifndef RAMFS_MAGIC
Denys Vlasenkoa5bdbe12009-06-17 14:03:24 +020045# define RAMFS_MAGIC ((unsigned)0x858458f6)
Rob Landley0f34a822005-10-27 22:55:50 +000046#endif
Rob Landley0f34a822005-10-27 22:55:50 +000047#ifndef TMPFS_MAGIC
Denys Vlasenkoa5bdbe12009-06-17 14:03:24 +020048# define TMPFS_MAGIC ((unsigned)0x01021994)
Rob Landley0f34a822005-10-27 22:55:50 +000049#endif
Rob Landley0f34a822005-10-27 22:55:50 +000050#ifndef MS_MOVE
Denys Vlasenkoa5bdbe12009-06-17 14:03:24 +020051# define MS_MOVE 8192
Rob Landley0f34a822005-10-27 22:55:50 +000052#endif
53
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000054// Recursively delete contents of rootfs
Denis Vlasenko39acf452008-07-11 23:44:50 +000055static void delete_contents(const char *directory, dev_t rootdev)
Rob Landley0f34a822005-10-27 22:55:50 +000056{
57 DIR *dir;
58 struct dirent *d;
59 struct stat st;
60
61 // Don't descend into other filesystems
Denis Vlasenko39acf452008-07-11 23:44:50 +000062 if (lstat(directory, &st) || st.st_dev != rootdev)
63 return;
Rob Landley0f34a822005-10-27 22:55:50 +000064
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000065 // Recursively delete the contents of directories
Rob Landley0f34a822005-10-27 22:55:50 +000066 if (S_ISDIR(st.st_mode)) {
Denis Vlasenko51742f42007-04-12 00:32:05 +000067 dir = opendir(directory);
68 if (dir) {
Rob Landley0f34a822005-10-27 22:55:50 +000069 while ((d = readdir(dir))) {
Denis Vlasenko51742f42007-04-12 00:32:05 +000070 char *newdir = d->d_name;
Rob Landley0f34a822005-10-27 22:55:50 +000071
72 // Skip . and ..
Denis Vlasenko39acf452008-07-11 23:44:50 +000073 if (DOT_OR_DOTDOT(newdir))
Rob Landley0f34a822005-10-27 22:55:50 +000074 continue;
Tim Rikerc1ef7bd2006-01-25 00:08:53 +000075
Rob Landley0f34a822005-10-27 22:55:50 +000076 // Recurse to delete contents
Denis Vlasenko39acf452008-07-11 23:44:50 +000077 newdir = concat_path_file(directory, newdir);
78 delete_contents(newdir, rootdev);
79 free(newdir);
Rob Landley0f34a822005-10-27 22:55:50 +000080 }
81 closedir(dir);
Tim Rikerc1ef7bd2006-01-25 00:08:53 +000082
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000083 // Directory should now be empty, zap it
Rob Landley5d84c232005-12-20 17:25:51 +000084 rmdir(directory);
Rob Landley0f34a822005-10-27 22:55:50 +000085 }
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000086 } else {
87 // It wasn't a directory, zap it
88 unlink(directory);
89 }
Rob Landley0f34a822005-10-27 22:55:50 +000090}
91
Denis Vlasenko9b49a5e2007-10-11 10:05:36 +000092int switch_root_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
Denis Vlasenkoa60f84e2008-07-05 09:18:54 +000093int switch_root_main(int argc UNUSED_PARAM, char **argv)
Rob Landley0f34a822005-10-27 22:55:50 +000094{
Denis Vlasenko51742f42007-04-12 00:32:05 +000095 char *newroot, *console = NULL;
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000096 struct stat st;
Rob Landley0f34a822005-10-27 22:55:50 +000097 struct statfs stfs;
Denis Vlasenko39acf452008-07-11 23:44:50 +000098 dev_t rootdev;
Rob Landley0f34a822005-10-27 22:55:50 +000099
100 // Parse args (-c console)
Denis Vlasenko6dd03f02008-02-13 17:25:31 +0000101 opt_complementary = "-2"; // minimum 2 params
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000102 getopt32(argv, "+c:", &console); // '+': stop at first non-option
Denis Vlasenko3ace9fa2007-04-18 21:40:30 +0000103 argv += optind;
Denis Vlasenko3ace9fa2007-04-18 21:40:30 +0000104 newroot = *argv++;
Tim Rikerc1ef7bd2006-01-25 00:08:53 +0000105
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000106 // Change to new root directory and verify it's a different fs
Denis Vlasenko3ace9fa2007-04-18 21:40:30 +0000107 xchdir(newroot);
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000108 xstat("/", &st);
109 rootdev = st.st_dev;
110 xstat(".", &st);
111 if (st.st_dev == rootdev || getpid() != 1) {
112 // Show usage, it says new root must be a mountpoint
113 // and we must be PID 1
114 bb_show_usage();
Rob Landley0f34a822005-10-27 22:55:50 +0000115 }
Tim Rikerc1ef7bd2006-01-25 00:08:53 +0000116
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000117 // Additional sanity checks: we're about to rm -rf /, so be REALLY SURE
118 // we mean it. I could make this a CONFIG option, but I would get email
119 // from all the people who WILL destroy their filesystems.
Denys Vlasenkocb376372009-12-15 01:55:55 +0100120 if (stat("/init", &st) != 0 || !S_ISREG(st.st_mode)) {
121 bb_error_msg_and_die("/init is not a regular file");
122 }
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000123 statfs("/", &stfs); // this never fails
Denys Vlasenkocb376372009-12-15 01:55:55 +0100124 if ((unsigned)stfs.f_type != RAMFS_MAGIC
125 && (unsigned)stfs.f_type != TMPFS_MAGIC
Denis Vlasenko77ad97f2008-05-13 02:27:31 +0000126 ) {
Denys Vlasenkocb376372009-12-15 01:55:55 +0100127 bb_error_msg_and_die("root filesystem is not ramfs/tmpfs");
Rob Landley0f34a822005-10-27 22:55:50 +0000128 }
129
130 // Zap everything out of rootdev
Denis Vlasenko39acf452008-07-11 23:44:50 +0000131 delete_contents("/", rootdev);
Tim Rikerc1ef7bd2006-01-25 00:08:53 +0000132
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000133 // Overmount / with newdir and chroot into it
134 if (mount(".", "/", NULL, MS_MOVE, NULL)) {
135 // For example, fails when newroot is not a mountpoint
Denis Vlasenko0ad82342009-04-21 00:29:17 +0000136 bb_perror_msg_and_die("error moving root");
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000137 }
Denis Vlasenko394eebe2008-02-25 20:30:24 +0000138 xchroot(".");
Denis Vlasenkoe6b10ef2009-04-21 20:52:58 +0000139 // The chdir is needed to recalculate "." and ".." links
Denys Vlasenko0687a5b2012-03-08 00:28:24 +0100140 /*xchdir("/"); - done in xchroot */
Tim Rikerc1ef7bd2006-01-25 00:08:53 +0000141
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000142 // If a new console specified, redirect stdin/stdout/stderr to it
Rob Landley5d84c232005-12-20 17:25:51 +0000143 if (console) {
Andrei Gherzane3b65ab2017-03-24 16:39:08 +0100144 int fd = open_or_warn(console, O_RDWR);
145 if (fd >= 0) {
146 xmove_fd(fd, 0);
147 xdup2(0, 1);
148 xdup2(0, 2);
149 }
Rob Landley5d84c232005-12-20 17:25:51 +0000150 }
Rob Landley0f34a822005-10-27 22:55:50 +0000151
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000152 // Exec real init
Denis Vlasenko3ace9fa2007-04-18 21:40:30 +0000153 execv(argv[0], argv);
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000154 bb_perror_msg_and_die("can't execute '%s'", argv[0]);
Rob Landley0f34a822005-10-27 22:55:50 +0000155}
Denys Vlasenkoa5bdbe12009-06-17 14:03:24 +0200156
157/*
158From: Rob Landley <rob@landley.net>
159Date: Tue, Jun 16, 2009 at 7:47 PM
160Subject: Re: switch_root...
161
162...
163...
164...
165
166If you're _not_ running out of init_ramfs (if for example you're using initrd
167instead), you probably shouldn't use switch_root because it's the wrong tool.
168
169Basically what the sucker does is something like the following shell script:
170
171 find / -xdev | xargs rm -rf
172 cd "$1"
173 shift
174 mount --move . /
175 exec chroot . "$@"
176
177There are a couple reasons that won't work as a shell script:
178
1791) If you delete the commands out of your $PATH, your shell scripts can't run
180more commands, but you can't start using dynamically linked _new_ commands
181until after you do the chroot because the path to the dynamic linker is wrong.
182So there's a step that needs to be sort of atomic but can't be as a shell
183script. (You can work around this with static linking or very carefully laid
184out paths and sequencing, but it's brittle, ugly, and non-obvious.)
185
1862) The "find | rm" bit will acually delete everything because the mount points
187still show up (even if their contents don't), and rm -rf will then happily zap
188that. So the first line is an oversimplification of what you need to do _not_
189to descend into other filesystems and delete their contents.
190
191The reason we do this is to free up memory, by the way. Since initramfs is a
192ramfs, deleting its contents frees up the memory it uses. (We leave it with
193one remaining dentry for the new mount point, but that's ok.)
194
195Note that you cannot ever umount rootfs, for approximately the same reason you
196can't kill PID 1. The kernel tracks mount points as a doubly linked list, and
197the pointer to the start/end of that list always points to an entry that's
198known to be there (rootfs), so it never has to worry about moving that pointer
199and it never has to worry about the list being empty. (Back around 2.6.13
200there _was_ a bug that let you umount rootfs, and the system locked hard the
201instant you did so endlessly looping to find the end of the mount list and
202never stopping. They fixed it.)
203
204Oh, and the reason we mount --move _and_ do the chroot is due to the way "/"
205works. Each process has two special symlinks, ".", and "/". Each of them
206points to the dentry of a directory, and give you a location paths can start
207from. (Historically ".." was also special, because you could enter a
208directory via a symlink so backing out to the directory you came from doesn't
209necessarily mean the one physically above where "." points to. These days I
210think it's just handed off to the filesystem.)
211
212Anyway, path resolution starts with "." or "/" (although the "./" at the start
213of the path may be implicit), meaning it's relative to one of those two
214directories. Your current directory, and your current root directory. The
215chdir() syscall changes where "." points to, and the chroot() syscall changes
216where "/" points to. (Again, both are per-process which is why chroot only
217affects your current process and its child processes.)
218
219Note that chroot() does _not_ change where "." points to, and back before they
220put crazy security checks into the kernel your current directory could be
221somewhere you could no longer access after the chroot. (The command line
222chroot does a cd as well, the chroot _syscall_ is what I'm talking about.)
223
224The reason mounting something new over / has no obvious effect is the same
225reason mounting something over your current directory has no obvious effect:
226the . and / links aren't recalculated after a mount, so they still point to
227the same dentry they did before, even if that dentry is no longer accessible
228by other means. Note that "cd ." is a NOP, and "chroot /" is a nop; both look
229up the cached dentry and set it right back. They don't re-parse any paths,
230because they're what all paths your process uses would be relative to.
231
232That's why the careful sequencing above: we cd into the new mount point before
233we do the mount --move. Moving the mount point would otherwise make it
Denys Vlasenkobf74fb42015-10-13 12:34:35 +0200234totally inaccessible to us because cd-ing to the old path wouldn't give it to
Denys Vlasenkoa5bdbe12009-06-17 14:03:24 +0200235us anymore, and cd "/" just gives us the cached dentry from when the process
236was created (in this case the old initramfs one). But the "." symlink gives
237us the dentry of the filesystem we just moved, so we can then "chroot ." to
238copy that dentry to "/" and get the new filesystem. If we _didn't_ save that
239dentry in "." we couldn't get it back after the mount --move.
240
241(Yes, this is all screwy and I had to email questions to Linus Torvalds to get
242it straight myself. I keep meaning to write up a "how mount actually works"
243document someday...)
244*/