blob: 0f00b605afe2bfc539b67f39ed8e3f06481fca0b [file] [log] [blame]
"Robert P. J. Day"63fc1a92006-07-02 19:47:05 +00001/* vi: set sw=4 ts=4: */
Rob Landley3ea05d32006-03-21 18:20:40 +00002/* Copyright 2005 Rob Landley <rob@landley.net>
3 *
4 * Switch from rootfs to another filesystem as the root of the mount tree.
5 *
Rob Landleye9a7a622006-09-22 02:52:41 +00006 * Licensed under GPL version 2, see file LICENSE in this tarball for details.
Rob Landley3ea05d32006-03-21 18:20:40 +00007 */
Denis Vlasenkob6adbf12007-05-26 19:00:18 +00008#include "libbb.h"
Rob Landley0f34a822005-10-27 22:55:50 +00009#include <sys/vfs.h>
Rob Landley0f34a822005-10-27 22:55:50 +000010
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000011// Make up for header deficiencies
Rob Landley0f34a822005-10-27 22:55:50 +000012#ifndef RAMFS_MAGIC
Denys Vlasenkoa5bdbe12009-06-17 14:03:24 +020013# define RAMFS_MAGIC ((unsigned)0x858458f6)
Rob Landley0f34a822005-10-27 22:55:50 +000014#endif
15
16#ifndef TMPFS_MAGIC
Denys Vlasenkoa5bdbe12009-06-17 14:03:24 +020017# define TMPFS_MAGIC ((unsigned)0x01021994)
Rob Landley0f34a822005-10-27 22:55:50 +000018#endif
19
20#ifndef MS_MOVE
Denys Vlasenkoa5bdbe12009-06-17 14:03:24 +020021# define MS_MOVE 8192
Rob Landley0f34a822005-10-27 22:55:50 +000022#endif
23
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000024// Recursively delete contents of rootfs
Denis Vlasenko39acf452008-07-11 23:44:50 +000025static void delete_contents(const char *directory, dev_t rootdev)
Rob Landley0f34a822005-10-27 22:55:50 +000026{
27 DIR *dir;
28 struct dirent *d;
29 struct stat st;
30
31 // Don't descend into other filesystems
Denis Vlasenko39acf452008-07-11 23:44:50 +000032 if (lstat(directory, &st) || st.st_dev != rootdev)
33 return;
Rob Landley0f34a822005-10-27 22:55:50 +000034
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000035 // Recursively delete the contents of directories
Rob Landley0f34a822005-10-27 22:55:50 +000036 if (S_ISDIR(st.st_mode)) {
Denis Vlasenko51742f42007-04-12 00:32:05 +000037 dir = opendir(directory);
38 if (dir) {
Rob Landley0f34a822005-10-27 22:55:50 +000039 while ((d = readdir(dir))) {
Denis Vlasenko51742f42007-04-12 00:32:05 +000040 char *newdir = d->d_name;
Rob Landley0f34a822005-10-27 22:55:50 +000041
42 // Skip . and ..
Denis Vlasenko39acf452008-07-11 23:44:50 +000043 if (DOT_OR_DOTDOT(newdir))
Rob Landley0f34a822005-10-27 22:55:50 +000044 continue;
Tim Rikerc1ef7bd2006-01-25 00:08:53 +000045
Rob Landley0f34a822005-10-27 22:55:50 +000046 // Recurse to delete contents
Denis Vlasenko39acf452008-07-11 23:44:50 +000047 newdir = concat_path_file(directory, newdir);
48 delete_contents(newdir, rootdev);
49 free(newdir);
Rob Landley0f34a822005-10-27 22:55:50 +000050 }
51 closedir(dir);
Tim Rikerc1ef7bd2006-01-25 00:08:53 +000052
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000053 // Directory should now be empty, zap it
Rob Landley5d84c232005-12-20 17:25:51 +000054 rmdir(directory);
Rob Landley0f34a822005-10-27 22:55:50 +000055 }
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000056 } else {
57 // It wasn't a directory, zap it
58 unlink(directory);
59 }
Rob Landley0f34a822005-10-27 22:55:50 +000060}
61
Denis Vlasenko9b49a5e2007-10-11 10:05:36 +000062int switch_root_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
Denis Vlasenkoa60f84e2008-07-05 09:18:54 +000063int switch_root_main(int argc UNUSED_PARAM, char **argv)
Rob Landley0f34a822005-10-27 22:55:50 +000064{
Denis Vlasenko51742f42007-04-12 00:32:05 +000065 char *newroot, *console = NULL;
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000066 struct stat st;
Rob Landley0f34a822005-10-27 22:55:50 +000067 struct statfs stfs;
Denis Vlasenko39acf452008-07-11 23:44:50 +000068 dev_t rootdev;
Rob Landley0f34a822005-10-27 22:55:50 +000069
70 // Parse args (-c console)
Denis Vlasenko6dd03f02008-02-13 17:25:31 +000071 opt_complementary = "-2"; // minimum 2 params
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000072 getopt32(argv, "+c:", &console); // '+': stop at first non-option
Denis Vlasenko3ace9fa2007-04-18 21:40:30 +000073 argv += optind;
Denis Vlasenko3ace9fa2007-04-18 21:40:30 +000074 newroot = *argv++;
Tim Rikerc1ef7bd2006-01-25 00:08:53 +000075
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000076 // Change to new root directory and verify it's a different fs
Denis Vlasenko3ace9fa2007-04-18 21:40:30 +000077 xchdir(newroot);
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000078 xstat("/", &st);
79 rootdev = st.st_dev;
80 xstat(".", &st);
81 if (st.st_dev == rootdev || getpid() != 1) {
82 // Show usage, it says new root must be a mountpoint
83 // and we must be PID 1
84 bb_show_usage();
Rob Landley0f34a822005-10-27 22:55:50 +000085 }
Tim Rikerc1ef7bd2006-01-25 00:08:53 +000086
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000087 // Additional sanity checks: we're about to rm -rf /, so be REALLY SURE
88 // we mean it. I could make this a CONFIG option, but I would get email
89 // from all the people who WILL destroy their filesystems.
90 statfs("/", &stfs); // this never fails
Denys Vlasenkoa5bdbe12009-06-17 14:03:24 +020091 if (stat("/init", &st) != 0 || !S_ISREG(st.st_mode)
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +000092 || ((unsigned)stfs.f_type != RAMFS_MAGIC
93 && (unsigned)stfs.f_type != TMPFS_MAGIC)
Denis Vlasenko77ad97f2008-05-13 02:27:31 +000094 ) {
Rob Landley0f34a822005-10-27 22:55:50 +000095 bb_error_msg_and_die("not rootfs");
96 }
97
98 // Zap everything out of rootdev
Denis Vlasenko39acf452008-07-11 23:44:50 +000099 delete_contents("/", rootdev);
Tim Rikerc1ef7bd2006-01-25 00:08:53 +0000100
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000101 // Overmount / with newdir and chroot into it
102 if (mount(".", "/", NULL, MS_MOVE, NULL)) {
103 // For example, fails when newroot is not a mountpoint
Denis Vlasenko0ad82342009-04-21 00:29:17 +0000104 bb_perror_msg_and_die("error moving root");
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000105 }
Denis Vlasenko394eebe2008-02-25 20:30:24 +0000106 xchroot(".");
Denis Vlasenkoe6b10ef2009-04-21 20:52:58 +0000107 // The chdir is needed to recalculate "." and ".." links
Denis Vlasenko3ace9fa2007-04-18 21:40:30 +0000108 xchdir("/");
Tim Rikerc1ef7bd2006-01-25 00:08:53 +0000109
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000110 // If a new console specified, redirect stdin/stdout/stderr to it
Rob Landley5d84c232005-12-20 17:25:51 +0000111 if (console) {
112 close(0);
Denis Vlasenko51742f42007-04-12 00:32:05 +0000113 xopen(console, O_RDWR);
Denis Vlasenko39acf452008-07-11 23:44:50 +0000114 xdup2(0, 1);
115 xdup2(0, 2);
Rob Landley5d84c232005-12-20 17:25:51 +0000116 }
Rob Landley0f34a822005-10-27 22:55:50 +0000117
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000118 // Exec real init
Denis Vlasenko3ace9fa2007-04-18 21:40:30 +0000119 execv(argv[0], argv);
Denis Vlasenkof9d4fc32009-04-21 20:40:51 +0000120 bb_perror_msg_and_die("can't execute '%s'", argv[0]);
Rob Landley0f34a822005-10-27 22:55:50 +0000121}
Denys Vlasenkoa5bdbe12009-06-17 14:03:24 +0200122
123/*
124From: Rob Landley <rob@landley.net>
125Date: Tue, Jun 16, 2009 at 7:47 PM
126Subject: Re: switch_root...
127
128...
129...
130...
131
132If you're _not_ running out of init_ramfs (if for example you're using initrd
133instead), you probably shouldn't use switch_root because it's the wrong tool.
134
135Basically what the sucker does is something like the following shell script:
136
137 find / -xdev | xargs rm -rf
138 cd "$1"
139 shift
140 mount --move . /
141 exec chroot . "$@"
142
143There are a couple reasons that won't work as a shell script:
144
1451) If you delete the commands out of your $PATH, your shell scripts can't run
146more commands, but you can't start using dynamically linked _new_ commands
147until after you do the chroot because the path to the dynamic linker is wrong.
148So there's a step that needs to be sort of atomic but can't be as a shell
149script. (You can work around this with static linking or very carefully laid
150out paths and sequencing, but it's brittle, ugly, and non-obvious.)
151
1522) The "find | rm" bit will acually delete everything because the mount points
153still show up (even if their contents don't), and rm -rf will then happily zap
154that. So the first line is an oversimplification of what you need to do _not_
155to descend into other filesystems and delete their contents.
156
157The reason we do this is to free up memory, by the way. Since initramfs is a
158ramfs, deleting its contents frees up the memory it uses. (We leave it with
159one remaining dentry for the new mount point, but that's ok.)
160
161Note that you cannot ever umount rootfs, for approximately the same reason you
162can't kill PID 1. The kernel tracks mount points as a doubly linked list, and
163the pointer to the start/end of that list always points to an entry that's
164known to be there (rootfs), so it never has to worry about moving that pointer
165and it never has to worry about the list being empty. (Back around 2.6.13
166there _was_ a bug that let you umount rootfs, and the system locked hard the
167instant you did so endlessly looping to find the end of the mount list and
168never stopping. They fixed it.)
169
170Oh, and the reason we mount --move _and_ do the chroot is due to the way "/"
171works. Each process has two special symlinks, ".", and "/". Each of them
172points to the dentry of a directory, and give you a location paths can start
173from. (Historically ".." was also special, because you could enter a
174directory via a symlink so backing out to the directory you came from doesn't
175necessarily mean the one physically above where "." points to. These days I
176think it's just handed off to the filesystem.)
177
178Anyway, path resolution starts with "." or "/" (although the "./" at the start
179of the path may be implicit), meaning it's relative to one of those two
180directories. Your current directory, and your current root directory. The
181chdir() syscall changes where "." points to, and the chroot() syscall changes
182where "/" points to. (Again, both are per-process which is why chroot only
183affects your current process and its child processes.)
184
185Note that chroot() does _not_ change where "." points to, and back before they
186put crazy security checks into the kernel your current directory could be
187somewhere you could no longer access after the chroot. (The command line
188chroot does a cd as well, the chroot _syscall_ is what I'm talking about.)
189
190The reason mounting something new over / has no obvious effect is the same
191reason mounting something over your current directory has no obvious effect:
192the . and / links aren't recalculated after a mount, so they still point to
193the same dentry they did before, even if that dentry is no longer accessible
194by other means. Note that "cd ." is a NOP, and "chroot /" is a nop; both look
195up the cached dentry and set it right back. They don't re-parse any paths,
196because they're what all paths your process uses would be relative to.
197
198That's why the careful sequencing above: we cd into the new mount point before
199we do the mount --move. Moving the mount point would otherwise make it
200totally inaccessible to is because cd-ing to the old path wouldn't give it to
201us anymore, and cd "/" just gives us the cached dentry from when the process
202was created (in this case the old initramfs one). But the "." symlink gives
203us the dentry of the filesystem we just moved, so we can then "chroot ." to
204copy that dentry to "/" and get the new filesystem. If we _didn't_ save that
205dentry in "." we couldn't get it back after the mount --move.
206
207(Yes, this is all screwy and I had to email questions to Linus Torvalds to get
208it straight myself. I keep meaning to write up a "how mount actually works"
209document someday...)
210*/