About systemd support for ruri

[Moe-hacker]

I tried to get systemd working in ruri, and here's what happened:

On my Nothing Phone (2) with LXC support, systemd runs fine in an LXC container. But when I try to simulate the same behaviors of LXC, my device crashes. After an auto soft reboot, systemd shows as downgraded. And, the haptic driver was gone.

Inside the container, if I set the environment variable container=lxc or container=ruri and create /run/systemd/container, systemd does recognize it's running in a container, but it still crashes my device.

Also, if I mount cgroup v2 as read-only, systemd won't work at all.

So, there's still a lot to figure out before systemd can be fully supported as the init system in ruri.

And, anyway, ruri should not have any behavior that affects the host system in any way, especially crashing the host.

And, here's the patch I tried to apply to ruri, it will not work, I just write here for a note.

diff --git a/src/chroot.c b/src/chroot.c
index 0be6fb3..5d338b8 100644
--- a/src/chroot.c
+++ b/src/chroot.c
@@ -181,7 +181,39 @@ static void init_container(struct RURI_CONTAINER *_Nonnull container)
 		symlink("/proc/self/fd/1", "/dev/stdout");
 		symlink("/proc/self/fd/2", "/dev/stderr");
 		symlink("/dev/null", "/dev/tty0");
-		if (!container->unmask_dirs) {
+		if (container->systemd_compat) {
+			remove("/dev/console");
+			unlink("/dev/console");
+			mknod("/dev/console", S_IFCHR, makedev(5, 0));
+			chown("/dev/console", 0, 5);
+			chmod("/dev/console", S_IRUSR | S_IWUSR | S_IWGRP | S_IWOTH | S_IROTH);
+			remove("/dev/tty0");
+			unlink("/dev/tty0");
+			symlink("/dev/tty", "/dev/tty0");
+			remove("/etc/machine-id");
+			unlink("/etc/machine-id");
+			close(open("/etc/machine-id", O_CREAT | O_WRONLY | O_CLOEXEC, 0644));
+			mkdir("/run", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP);
+			mkdir("/run/lock", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP);
+			mount("tmpfs", "/run", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC, "mode=755,size=65536k");
+			mkdir("/run/systemd", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP);
+			int ctrfd = open("/run/systemd/container", O_WRONLY | O_CREAT | O_CLOEXEC, 0644);
+			if (ctrfd < 0) {
+				ruri_error("{red}Error: cannot create /run/systemd/container file QwQ\n");
+			} else {
+				if (write(ctrfd, "ruri", strlen("ruri")) < 0) {
+					ruri_error("{red}Error: cannot write to /run/systemd/container file QwQ\n");
+				}
+				close(ctrfd);
+			}
+			mount("tmpfs", "/run/lock", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC, "mode=755,size=65536k");
+			mkdir("/tmp", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP);
+			mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC, "mode=1777,size=65536k");
+			mkdir("/var/lib/journal", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP);
+			mount("tmpfs", "/var/lib/journal", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC, "mode=755,size=65536k");
+			mount("none", "/sys/fs/cgroup", "cgroup2", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL);
+		}
+		if (!container->unmask_dirs && !container->systemd_compat) {
 			// Mask some directories/files that we don't want the container modify it.
 			mount("tmpfs", "/proc/asound", "tmpfs", MS_RDONLY, NULL);
 			mount("tmpfs", "/proc/acpi", "tmpfs", MS_RDONLY, NULL);
@@ -343,6 +375,9 @@ static void set_envs(const struct RURI_CONTAINER *_Nonnull container)
 		}
 		setenv(container->env[i], container->env[i + 1], 1);
 	}
+	if (container->systemd_compat) {
+		setenv("container_uuid", "11451414-1414-1414-1414-141414141414", 1);
+	}
 }
 // Run after init_container().
 static void setup_binfmt_misc(const struct RURI_CONTAINER *_Nonnull container)
@@ -723,7 +758,7 @@ void ruri_run_chroot_container(struct RURI_CONTAINER *_Nonnull container)
 	// Umount binfmt_misc apifs.
 	umount2("/proc/sys/fs/binfmt_misc", MNT_DETACH | MNT_FORCE);
 	// Set up cgroup limit.
-	if (!container->just_chroot) {
+	if (!container->just_chroot && !container->systemd_compat) {
 		ruri_set_limit(container);
 	}
 	// Create character devices.
@@ -735,7 +770,7 @@ void ruri_run_chroot_container(struct RURI_CONTAINER *_Nonnull container)
 		set_oom_score(container->oom_score_adj);
 	}
 	// Set up Seccomp BPF.
-	if (container->enable_default_seccomp || container->seccomp_denied_syscall[0] != NULL) {
+	if (container->enable_default_seccomp || container->seccomp_denied_syscall[0] != NULL || container->systemd_compat) {
 		ruri_setup_seccomp(container);
 	}
 	// Drop caps.
diff --git a/src/config.c b/src/config.c
index 749c472..3677588 100644
--- a/src/config.c
+++ b/src/config.c
@@ -80,6 +80,7 @@ void ruri_init_config(struct RURI_CONTAINER *_Nonnull container)
 	container->timens_monotonic_offset = 0;
 	container->seccomp_denied_syscall[0] = NULL;
 	container->oom_score_adj = 0;
+	container->systemd_compat = false;
 	// Use the time now for container_id.
 	time_t tm = time(NULL);
 	// We need a int value for container_id, so use long%86400.
diff --git a/src/include/ruri.h b/src/include/ruri.h
index cf6715d..c40e3df 100644
--- a/src/include/ruri.h
+++ b/src/include/ruri.h
@@ -201,6 +201,8 @@ struct RURI_CONTAINER {
 	char *_Nonnull seccomp_denied_syscall[RURI_MAX_SECCOMP_DENIED_SYSCALL];
 	// OOM score.
 	int oom_score_adj;
+	// systemd compatibility.
+	bool systemd_compat;
 };
 // For ruri_get_magic().
 #define ruri_magicof(x) (x##_magic)
diff --git a/src/ruri.c b/src/ruri.c
index 0f43ad4..005f1f5 100644
--- a/src/ruri.c
+++ b/src/ruri.c
@@ -307,6 +307,19 @@ static void parse_args(int argc, char **_Nonnull argv, struct RURI_CONTAINER *_N
 		else if (strcmp(argv[index], "-A") == 0 || strcmp(argv[index], "--unmask-dirs") == 0) {
 			container->unmask_dirs = true;
 		}
+		// Systemd compatibility.
+		else if (strcmp(argv[index], "-y") == 0 || strcmp(argv[index], "--systemd-compat") == 0) {
+			container->systemd_compat = true;
+			// privileged = true;
+			container->enable_unshare = true;
+			container->unmask_dirs = true;
+			ruri_add_to_caplist(drop_caplist_extra, CAP_MAC_ADMIN);
+			ruri_add_to_caplist(drop_caplist_extra, CAP_MAC_OVERRIDE);
+			ruri_add_to_caplist(drop_caplist_extra, CAP_SYS_TIME);
+			ruri_add_to_caplist(drop_caplist_extra, CAP_SYS_MODULE);
+			ruri_add_to_caplist(drop_caplist_extra, CAP_SYS_RAWIO);
+			ruri_add_to_caplist(keep_caplist_extra, CAP_SYS_RESOURCE);
+		}
 		// User.
 		else if (strcmp(argv[index], "-E") == 0 || strcmp(argv[index], "--user") == 0) {
 			if (index == argc - 1) {
@@ -676,6 +689,18 @@ static void parse_args(int argc, char **_Nonnull argv, struct RURI_CONTAINER *_N
 					break;
 				}
 				switch (argv[index][i]) {
+				case 'y':
+					container->systemd_compat = true;
+					// privileged = true;
+					container->enable_unshare = true;
+					container->unmask_dirs = true;
+					ruri_add_to_caplist(drop_caplist_extra, CAP_MAC_ADMIN);
+					ruri_add_to_caplist(drop_caplist_extra, CAP_MAC_OVERRIDE);
+					ruri_add_to_caplist(drop_caplist_extra, CAP_SYS_TIME);
+					ruri_add_to_caplist(drop_caplist_extra, CAP_SYS_MODULE);
+					ruri_add_to_caplist(drop_caplist_extra, CAP_SYS_RAWIO);
+					ruri_add_to_caplist(keep_caplist_extra, CAP_SYS_RESOURCE);
+					break;
 				case 'r':
 					container->rootless = true;
 					break;
diff --git a/src/seccomp.c b/src/seccomp.c
index dd672a4..cd7b0a3 100644
--- a/src/seccomp.c
+++ b/src/seccomp.c
@@ -42,6 +42,16 @@ void ruri_setup_seccomp(const struct RURI_CONTAINER *_Nonnull container)
 	 * NOTE: This profile is not fully tested.
 	 */
 	scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ALLOW);
+	// For compatibility with systemd.
+	if (container->systemd_compat) {
+		// From lxc's seccomp profile.
+		seccomp_rule_add(ctx, SCMP_ACT_ERRNO(1), SCMP_SYS(kexec_load), 0);
+		seccomp_rule_add(ctx, SCMP_ACT_ERRNO(1), SCMP_SYS(open_by_handle_at), 0);
+		seccomp_rule_add(ctx, SCMP_ACT_ERRNO(1), SCMP_SYS(init_module), 0);
+		seccomp_rule_add(ctx, SCMP_ACT_ERRNO(1), SCMP_SYS(delete_module), 0);
+		seccomp_rule_add(ctx, SCMP_ACT_ERRNO(1), SCMP_SYS(finit_module), 0);
+		seccomp_rule_add(ctx, SCMP_ACT_ERRNO(1), SCMP_SYS(umount2), 1, SCMP_CMP(5, SCMP_CMP_MASKED_EQ, MNT_FORCE, MNT_FORCE));
+	}
 	// Deny user-defined syscalls.
 	for (int i = 0; container->seccomp_denied_syscall[i] != NULL; i++) {
 		int syscall_nr = seccomp_syscall_resolve_name(container->seccomp_denied_syscall[i]);
diff --git a/src/unshare.c b/src/unshare.c
index fbf1495..3bc3cc0 100644
--- a/src/unshare.c
+++ b/src/unshare.c
@@ -35,6 +35,34 @@
  *
  * For historical reason, unshare is not enabled by default in ruri.
  */
+static void enter_new_cgroups(struct RURI_CONTAINER *_Nonnull container)
+{
+	// Check for cgroup v2.
+	if (access("/sys/fs/cgroup/cgroup.controllers", F_OK) == 0) {
+		// Cgroup v2.
+		char cgroup_path[PATH_MAX] = { '\0' };
+		sprintf(cgroup_path, "%s/%d", "/sys/fs/cgroup/ruri", container->container_id);
+		if (ruri_mkdirs(cgroup_path, 0755) == -1 && errno != EEXIST) {
+			ruri_error("{red}Failed to create cgroup directory: %s{clear}\n", cgroup_path);
+		}
+		if (chdir(cgroup_path) == -1) {
+			ruri_error("{red}Failed to change directory to cgroup: %s{clear}\n", cgroup_path);
+		}
+		// Set cgroup v2 controllers.
+		int fd = open("cgroup.procs", O_WRONLY | O_CLOEXEC);
+		if (fd < 0) {
+			ruri_error("{red}Failed to open cgroup.procs file QwQ\n");
+		}
+		char buf[32] = { '\0' };
+		sprintf(buf, "%d", getpid());
+		if (write(fd, buf, strlen(buf)) < 0) {
+			ruri_error("{red}Failed to write to cgroup.procs file QwQ\n");
+		}
+		close(fd);
+	} else {
+		ruri_error("{red}Cgroup v2 is required for --systemd-compat QwQ\n");
+	}
+}
 // For ruri_run_unshare_container().
 static pid_t init_unshare_container(struct RURI_CONTAINER *_Nonnull container)
 {
@@ -44,6 +72,9 @@ static pid_t init_unshare_container(struct RURI_CONTAINER *_Nonnull container)
 	 *
 	 * NOTE: Network namespace is not supported.
 	 */
+	if (container->systemd_compat) {
+		enter_new_cgroups(container);
+	}
 	// unshare_pid in forked process is 0.
 	pid_t unshare_pid = RURI_INIT_VALUE;
 	// Create namespaces.
@@ -57,11 +88,20 @@ static pid_t init_unshare_container(struct RURI_CONTAINER *_Nonnull container)
 		ruri_warning("{yellow}Warning: seems that ipc namespace is not supported on this device QwQ{clear}\n");
 	}
 	if (unshare(CLONE_NEWPID) == -1 && !container->no_warnings) {
+		if (container->systemd_compat) {
+			ruri_error("{red}Failed to unshare pid namespace, --systemd-compat cannot be enabled QwQ\n");
+		}
 		ruri_warning("{yellow}Warning: seems that pid namespace is not supported on this device QwQ{clear}\n");
 	}
 	if (unshare(CLONE_NEWCGROUP) == -1 && !container->no_warnings) {
+		if (container->systemd_compat) {
+			ruri_error("{red}Failed to unshare cgroup namespace, --systemd-compat cannot be enabled QwQ\n");
+		}
 		ruri_warning("{yellow}Warning: seems that cgroup namespace is not supported on this device QwQ{clear}\n");
 	}
+	if (container->systemd_compat) {
+		enter_new_cgroups(container);
+	}
 	if (unshare(CLONE_NEWTIME) == -1) {
 		if (container->timens_realtime_offset != 0 || container->timens_monotonic_offset != 0) {
 			ruri_error("{red}Failed to unshare time namespace, --timens-offset cannot be enabled QwQ\n");