1 /* vi: set sw=4 ts=4: */
2 /* Copyright 2005 Rob Landley <rob@landley.net>
3 *
4 * Switch from rootfs to another filesystem as the root of the mount tree.
5 *
6 * Licensed under GPLv2, see file LICENSE in this source tree.
7 */
8 //config:config SWITCH_ROOT
9 //config: bool "switch_root"
10 //config: default y
11 //config: select PLATFORM_LINUX
12 //config: help
13 //config: The switch_root utility is used from initramfs to select a new
14 //config: root device. Under initramfs, you have to use this instead of
15 //config: pivot_root. (Stop reading here if you don't care why.)
16 //config:
17 //config: Booting with initramfs extracts a gzipped cpio archive into rootfs
18 //config: (which is a variant of ramfs/tmpfs). Because rootfs can't be moved
19 //config: or unmounted*, pivot_root will not work from initramfs. Instead,
20 //config: switch_root deletes everything out of rootfs (including itself),
21 //config: does a mount --move that overmounts rootfs with the new root, and
22 //config: then execs the specified init program.
23 //config:
24 //config: * Because the Linux kernel uses rootfs internally as the starting
25 //config: and ending point for searching through the kernel's doubly linked
26 //config: list of active mount points. That's why.
27
28 //applet:IF_SWITCH_ROOT(APPLET(switch_root, BB_DIR_SBIN, BB_SUID_DROP))
29
30 //kbuild:lib-$(CONFIG_SWITCH_ROOT) += switch_root.o
31
32 //usage:#define switch_root_trivial_usage
33 //usage: "[-c /dev/console] NEW_ROOT NEW_INIT [ARGS]"
34 //usage:#define switch_root_full_usage "\n\n"
35 //usage: "Free initramfs and switch to another root fs:\n"
36 //usage: "chroot to NEW_ROOT, delete all in /, move NEW_ROOT to /,\n"
37 //usage: "execute NEW_INIT. PID must be 1. NEW_ROOT must be a mountpoint.\n"
38 //usage: "\n -c DEV Reopen stdio to DEV after switch"
39
40 #include <sys/vfs.h>
41 #include <sys/mount.h>
42 #include "libbb.h"
43 // Make up for header deficiencies
44 #ifndef RAMFS_MAGIC
45 # define RAMFS_MAGIC ((unsigned)0x858458f6)
46 #endif
47 #ifndef TMPFS_MAGIC
48 # define TMPFS_MAGIC ((unsigned)0x01021994)
49 #endif
50 #ifndef MS_MOVE
51 # define MS_MOVE 8192
52 #endif
53
54 // Recursively delete contents of rootfs
delete_contents(const char * directory,dev_t rootdev)55 static void delete_contents(const char *directory, dev_t rootdev)
56 {
57 DIR *dir;
58 struct dirent *d;
59 struct stat st;
60
61 // Don't descend into other filesystems
62 if (lstat(directory, &st) || st.st_dev != rootdev)
63 return;
64
65 // Recursively delete the contents of directories
66 if (S_ISDIR(st.st_mode)) {
67 dir = opendir(directory);
68 if (dir) {
69 while ((d = readdir(dir))) {
70 char *newdir = d->d_name;
71
72 // Skip . and ..
73 if (DOT_OR_DOTDOT(newdir))
74 continue;
75
76 // Recurse to delete contents
77 newdir = concat_path_file(directory, newdir);
78 delete_contents(newdir, rootdev);
79 free(newdir);
80 }
81 closedir(dir);
82
83 // Directory should now be empty, zap it
84 rmdir(directory);
85 }
86 } else {
87 // It wasn't a directory, zap it
88 unlink(directory);
89 }
90 }
91
92 int switch_root_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
switch_root_main(int argc UNUSED_PARAM,char ** argv)93 int switch_root_main(int argc UNUSED_PARAM, char **argv)
94 {
95 char *newroot, *console = NULL;
96 struct stat st;
97 struct statfs stfs;
98 dev_t rootdev;
99
100 // Parse args (-c console)
101 opt_complementary = "-2"; // minimum 2 params
102 getopt32(argv, "+c:", &console); // '+': stop at first non-option
103 argv += optind;
104 newroot = *argv++;
105
106 // Change to new root directory and verify it's a different fs
107 xchdir(newroot);
108 xstat("/", &st);
109 rootdev = st.st_dev;
110 xstat(".", &st);
111 if (st.st_dev == rootdev || getpid() != 1) {
112 // Show usage, it says new root must be a mountpoint
113 // and we must be PID 1
114 bb_show_usage();
115 }
116
117 // Additional sanity checks: we're about to rm -rf /, so be REALLY SURE
118 // we mean it. I could make this a CONFIG option, but I would get email
119 // from all the people who WILL destroy their filesystems.
120 if (stat("/init", &st) != 0 || !S_ISREG(st.st_mode)) {
121 bb_error_msg_and_die("/init is not a regular file");
122 }
123 statfs("/", &stfs); // this never fails
124 if ((unsigned)stfs.f_type != RAMFS_MAGIC
125 && (unsigned)stfs.f_type != TMPFS_MAGIC
126 ) {
127 bb_error_msg_and_die("root filesystem is not ramfs/tmpfs");
128 }
129
130 // Zap everything out of rootdev
131 delete_contents("/", rootdev);
132
133 // Overmount / with newdir and chroot into it
134 if (mount(".", "/", NULL, MS_MOVE, NULL)) {
135 // For example, fails when newroot is not a mountpoint
136 bb_perror_msg_and_die("error moving root");
137 }
138 xchroot(".");
139 // The chdir is needed to recalculate "." and ".." links
140 /*xchdir("/"); - done in xchroot */
141
142 // If a new console specified, redirect stdin/stdout/stderr to it
143 if (console) {
144 close(0);
145 xopen(console, O_RDWR);
146 xdup2(0, 1);
147 xdup2(0, 2);
148 }
149
150 // Exec real init
151 execv(argv[0], argv);
152 bb_perror_msg_and_die("can't execute '%s'", argv[0]);
153 }
154
155 /*
156 From: Rob Landley <rob@landley.net>
157 Date: Tue, Jun 16, 2009 at 7:47 PM
158 Subject: Re: switch_root...
159
160 ...
161 ...
162 ...
163
164 If you're _not_ running out of init_ramfs (if for example you're using initrd
165 instead), you probably shouldn't use switch_root because it's the wrong tool.
166
167 Basically what the sucker does is something like the following shell script:
168
169 find / -xdev | xargs rm -rf
170 cd "$1"
171 shift
172 mount --move . /
173 exec chroot . "$@"
174
175 There are a couple reasons that won't work as a shell script:
176
177 1) If you delete the commands out of your $PATH, your shell scripts can't run
178 more commands, but you can't start using dynamically linked _new_ commands
179 until after you do the chroot because the path to the dynamic linker is wrong.
180 So there's a step that needs to be sort of atomic but can't be as a shell
181 script. (You can work around this with static linking or very carefully laid
182 out paths and sequencing, but it's brittle, ugly, and non-obvious.)
183
184 2) The "find | rm" bit will acually delete everything because the mount points
185 still show up (even if their contents don't), and rm -rf will then happily zap
186 that. So the first line is an oversimplification of what you need to do _not_
187 to descend into other filesystems and delete their contents.
188
189 The reason we do this is to free up memory, by the way. Since initramfs is a
190 ramfs, deleting its contents frees up the memory it uses. (We leave it with
191 one remaining dentry for the new mount point, but that's ok.)
192
193 Note that you cannot ever umount rootfs, for approximately the same reason you
194 can't kill PID 1. The kernel tracks mount points as a doubly linked list, and
195 the pointer to the start/end of that list always points to an entry that's
196 known to be there (rootfs), so it never has to worry about moving that pointer
197 and it never has to worry about the list being empty. (Back around 2.6.13
198 there _was_ a bug that let you umount rootfs, and the system locked hard the
199 instant you did so endlessly looping to find the end of the mount list and
200 never stopping. They fixed it.)
201
202 Oh, and the reason we mount --move _and_ do the chroot is due to the way "/"
203 works. Each process has two special symlinks, ".", and "/". Each of them
204 points to the dentry of a directory, and give you a location paths can start
205 from. (Historically ".." was also special, because you could enter a
206 directory via a symlink so backing out to the directory you came from doesn't
207 necessarily mean the one physically above where "." points to. These days I
208 think it's just handed off to the filesystem.)
209
210 Anyway, path resolution starts with "." or "/" (although the "./" at the start
211 of the path may be implicit), meaning it's relative to one of those two
212 directories. Your current directory, and your current root directory. The
213 chdir() syscall changes where "." points to, and the chroot() syscall changes
214 where "/" points to. (Again, both are per-process which is why chroot only
215 affects your current process and its child processes.)
216
217 Note that chroot() does _not_ change where "." points to, and back before they
218 put crazy security checks into the kernel your current directory could be
219 somewhere you could no longer access after the chroot. (The command line
220 chroot does a cd as well, the chroot _syscall_ is what I'm talking about.)
221
222 The reason mounting something new over / has no obvious effect is the same
223 reason mounting something over your current directory has no obvious effect:
224 the . and / links aren't recalculated after a mount, so they still point to
225 the same dentry they did before, even if that dentry is no longer accessible
226 by other means. Note that "cd ." is a NOP, and "chroot /" is a nop; both look
227 up the cached dentry and set it right back. They don't re-parse any paths,
228 because they're what all paths your process uses would be relative to.
229
230 That's why the careful sequencing above: we cd into the new mount point before
231 we do the mount --move. Moving the mount point would otherwise make it
232 totally inaccessible to us because cd-ing to the old path wouldn't give it to
233 us anymore, and cd "/" just gives us the cached dentry from when the process
234 was created (in this case the old initramfs one). But the "." symlink gives
235 us the dentry of the filesystem we just moved, so we can then "chroot ." to
236 copy that dentry to "/" and get the new filesystem. If we _didn't_ save that
237 dentry in "." we couldn't get it back after the mount --move.
238
239 (Yes, this is all screwy and I had to email questions to Linus Torvalds to get
240 it straight myself. I keep meaning to write up a "how mount actually works"
241 document someday...)
242 */
243