]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/core/execute.c
execute: share error path between reg file/dir credential loading
[thirdparty/systemd.git] / src / core / execute.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
a7334b09 2
034c6ed7
LP
3#include <errno.h>
4#include <fcntl.h>
8dd4c05b 5#include <poll.h>
d251207d 6#include <sys/eventfd.h>
f5947a5e 7#include <sys/ioctl.h>
f3e43635 8#include <sys/mman.h>
bb0c0d6f 9#include <sys/mount.h>
8dd4c05b 10#include <sys/personality.h>
94f04347 11#include <sys/prctl.h>
d2ffa389 12#include <sys/shm.h>
d2ffa389 13#include <sys/types.h>
8dd4c05b
LP
14#include <sys/un.h>
15#include <unistd.h>
023a4f67 16#include <utmpx.h>
5cb5a6ff 17
349cc4a5 18#if HAVE_PAM
5b6319dc
LP
19#include <security/pam_appl.h>
20#endif
21
349cc4a5 22#if HAVE_SELINUX
7b52a628
MS
23#include <selinux/selinux.h>
24#endif
25
349cc4a5 26#if HAVE_SECCOMP
17df7223
LP
27#include <seccomp.h>
28#endif
29
349cc4a5 30#if HAVE_APPARMOR
eef65bf3
MS
31#include <sys/apparmor.h>
32#endif
33
24882e06 34#include "sd-messages.h"
8dd4c05b 35
bb0c0d6f 36#include "acl-util.h"
8dd4c05b 37#include "af-list.h"
b5efdb8a 38#include "alloc-util.h"
349cc4a5 39#if HAVE_APPARMOR
3ffd4af2
LP
40#include "apparmor-util.h"
41#endif
8dd4c05b
LP
42#include "async.h"
43#include "barrier.h"
b1994387 44#include "bpf-lsm.h"
8dd4c05b 45#include "cap-list.h"
430f0182 46#include "capability-util.h"
fdb3deca 47#include "cgroup-setup.h"
f4351959 48#include "chase-symlinks.h"
bb0c0d6f 49#include "chown-recursive.h"
da681e1b 50#include "cpu-set-util.h"
43144be4 51#include "creds-util.h"
6a818c3c 52#include "data-fd-util.h"
f6a6225e 53#include "def.h"
686d13b9 54#include "env-file.h"
4d1a6904 55#include "env-util.h"
17df7223 56#include "errno-list.h"
8a62620e 57#include "escape.h"
3ffd4af2 58#include "execute.h"
8dd4c05b 59#include "exit-status.h"
3ffd4af2 60#include "fd-util.h"
bb0c0d6f 61#include "fileio.h"
f97b34a6 62#include "format-util.h"
7d50b32a 63#include "glob-util.h"
0389f4fa 64#include "hexdecoct.h"
c004493c 65#include "io-util.h"
032b3afb 66#include "ioprio-util.h"
a1164ae3 67#include "label.h"
8dd4c05b
LP
68#include "log.h"
69#include "macro.h"
e8a565cb 70#include "manager.h"
2a341bb9 71#include "manager-dump.h"
0a970718 72#include "memory-util.h"
f5947a5e 73#include "missing_fs.h"
5bead76e 74#include "missing_ioprio.h"
35cd0ba5 75#include "mkdir-label.h"
21935150 76#include "mount-util.h"
bb0c0d6f 77#include "mountpoint-util.h"
8dd4c05b 78#include "namespace.h"
6bedfcbb 79#include "parse-util.h"
8dd4c05b 80#include "path-util.h"
0b452006 81#include "process-util.h"
d3dcf4e3 82#include "random-util.h"
3989bdc1 83#include "recurse-dir.h"
78f22b97 84#include "rlimit-util.h"
8dd4c05b 85#include "rm-rf.h"
349cc4a5 86#if HAVE_SECCOMP
3ffd4af2
LP
87#include "seccomp-util.h"
88#endif
07d46372 89#include "securebits-util.h"
8dd4c05b 90#include "selinux-util.h"
24882e06 91#include "signal-util.h"
8dd4c05b 92#include "smack-util.h"
57b7a260 93#include "socket-util.h"
fd63e712 94#include "special.h"
949befd3 95#include "stat-util.h"
8b43440b 96#include "string-table.h"
07630cea 97#include "string-util.h"
8dd4c05b 98#include "strv.h"
7ccbd1ae 99#include "syslog-util.h"
8dd4c05b 100#include "terminal-util.h"
bb0c0d6f 101#include "tmpfile-util.h"
566b7d23 102#include "umask-util.h"
2d3b784d 103#include "unit-serialize.h"
b1d4f8e1 104#include "user-util.h"
8dd4c05b 105#include "utmp-wtmp.h"
5cb5a6ff 106
e056b01d 107#define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
31a7eb86 108#define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
e6a26745 109
531dca78
LP
110#define SNDBUF_SIZE (8*1024*1024)
111
da6053d0 112static int shift_fds(int fds[], size_t n_fds) {
034c6ed7
LP
113 if (n_fds <= 0)
114 return 0;
115
a0d40ac5
LP
116 /* Modifies the fds array! (sorts it) */
117
034c6ed7
LP
118 assert(fds);
119
5b10116e
ZJS
120 for (int start = 0;;) {
121 int restart_from = -1;
034c6ed7 122
5b10116e 123 for (int i = start; i < (int) n_fds; i++) {
034c6ed7
LP
124 int nfd;
125
126 /* Already at right index? */
127 if (fds[i] == i+3)
128 continue;
129
3cc2aff1
LP
130 nfd = fcntl(fds[i], F_DUPFD, i + 3);
131 if (nfd < 0)
034c6ed7
LP
132 return -errno;
133
03e334a1 134 safe_close(fds[i]);
034c6ed7
LP
135 fds[i] = nfd;
136
137 /* Hmm, the fd we wanted isn't free? Then
ee33e53a 138 * let's remember that and try again from here */
034c6ed7
LP
139 if (nfd != i+3 && restart_from < 0)
140 restart_from = i;
141 }
142
143 if (restart_from < 0)
144 break;
145
146 start = restart_from;
147 }
148
149 return 0;
150}
151
25b583d7 152static int flags_fds(const int fds[], size_t n_socket_fds, size_t n_storage_fds, bool nonblock) {
5b10116e 153 size_t n_fds;
e2c76839 154 int r;
47a71eed 155
25b583d7 156 n_fds = n_socket_fds + n_storage_fds;
47a71eed
LP
157 if (n_fds <= 0)
158 return 0;
159
160 assert(fds);
161
9b141911
FB
162 /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags.
163 * O_NONBLOCK only applies to socket activation though. */
47a71eed 164
5b10116e 165 for (size_t i = 0; i < n_fds; i++) {
47a71eed 166
9b141911
FB
167 if (i < n_socket_fds) {
168 r = fd_nonblock(fds[i], nonblock);
169 if (r < 0)
170 return r;
171 }
47a71eed 172
451a074f
LP
173 /* We unconditionally drop FD_CLOEXEC from the fds,
174 * since after all we want to pass these fds to our
175 * children */
47a71eed 176
3cc2aff1
LP
177 r = fd_cloexec(fds[i], false);
178 if (r < 0)
e2c76839 179 return r;
47a71eed
LP
180 }
181
182 return 0;
183}
184
1e22b5cd 185static const char *exec_context_tty_path(const ExecContext *context) {
80876c20
LP
186 assert(context);
187
1e22b5cd
LP
188 if (context->stdio_as_fds)
189 return NULL;
190
80876c20
LP
191 if (context->tty_path)
192 return context->tty_path;
193
194 return "/dev/console";
195}
196
1e22b5cd
LP
197static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
198 const char *path;
199
6ea832a2
LP
200 assert(context);
201
1e22b5cd 202 path = exec_context_tty_path(context);
6ea832a2 203
1e22b5cd
LP
204 if (context->tty_vhangup) {
205 if (p && p->stdin_fd >= 0)
206 (void) terminal_vhangup_fd(p->stdin_fd);
207 else if (path)
208 (void) terminal_vhangup(path);
209 }
6ea832a2 210
1e22b5cd
LP
211 if (context->tty_reset) {
212 if (p && p->stdin_fd >= 0)
213 (void) reset_terminal_fd(p->stdin_fd, true);
214 else if (path)
215 (void) reset_terminal(path);
216 }
217
51462135
DDM
218 if (p && p->stdin_fd >= 0)
219 (void) terminal_set_size_fd(p->stdin_fd, path, context->tty_rows, context->tty_cols);
220
1e22b5cd
LP
221 if (context->tty_vt_disallocate && path)
222 (void) vt_disallocate(path);
6ea832a2
LP
223}
224
6af760f3
LP
225static bool is_terminal_input(ExecInput i) {
226 return IN_SET(i,
227 EXEC_INPUT_TTY,
228 EXEC_INPUT_TTY_FORCE,
229 EXEC_INPUT_TTY_FAIL);
230}
231
3a1286b6 232static bool is_terminal_output(ExecOutput o) {
6af760f3
LP
233 return IN_SET(o,
234 EXEC_OUTPUT_TTY,
6af760f3
LP
235 EXEC_OUTPUT_KMSG_AND_CONSOLE,
236 EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
237}
238
aac8c0c3
LP
239static bool is_kmsg_output(ExecOutput o) {
240 return IN_SET(o,
241 EXEC_OUTPUT_KMSG,
242 EXEC_OUTPUT_KMSG_AND_CONSOLE);
243}
244
6af760f3
LP
245static bool exec_context_needs_term(const ExecContext *c) {
246 assert(c);
247
248 /* Return true if the execution context suggests we should set $TERM to something useful. */
249
250 if (is_terminal_input(c->std_input))
251 return true;
252
253 if (is_terminal_output(c->std_output))
254 return true;
255
256 if (is_terminal_output(c->std_error))
257 return true;
258
259 return !!c->tty_path;
3a1286b6
MS
260}
261
80876c20 262static int open_null_as(int flags, int nfd) {
046a82c1 263 int fd;
071830ff 264
80876c20 265 assert(nfd >= 0);
071830ff 266
613b411c
LP
267 fd = open("/dev/null", flags|O_NOCTTY);
268 if (fd < 0)
071830ff
LP
269 return -errno;
270
046a82c1 271 return move_fd(fd, nfd, false);
071830ff
LP
272}
273
91dd5f7c
LP
274static int connect_journal_socket(
275 int fd,
276 const char *log_namespace,
277 uid_t uid,
278 gid_t gid) {
279
f36a9d59
ZJS
280 union sockaddr_union sa;
281 socklen_t sa_len;
524daa8c
ZJS
282 uid_t olduid = UID_INVALID;
283 gid_t oldgid = GID_INVALID;
91dd5f7c 284 const char *j;
524daa8c
ZJS
285 int r;
286
91dd5f7c
LP
287 j = log_namespace ?
288 strjoina("/run/systemd/journal.", log_namespace, "/stdout") :
289 "/run/systemd/journal/stdout";
290 r = sockaddr_un_set_path(&sa.un, j);
291 if (r < 0)
292 return r;
f36a9d59 293 sa_len = r;
91dd5f7c 294
cad93f29 295 if (gid_is_valid(gid)) {
524daa8c
ZJS
296 oldgid = getgid();
297
92a17af9 298 if (setegid(gid) < 0)
524daa8c
ZJS
299 return -errno;
300 }
301
cad93f29 302 if (uid_is_valid(uid)) {
524daa8c
ZJS
303 olduid = getuid();
304
92a17af9 305 if (seteuid(uid) < 0) {
524daa8c
ZJS
306 r = -errno;
307 goto restore_gid;
308 }
309 }
310
7c248223 311 r = RET_NERRNO(connect(fd, &sa.sa, sa_len));
524daa8c
ZJS
312
313 /* If we fail to restore the uid or gid, things will likely
314 fail later on. This should only happen if an LSM interferes. */
315
cad93f29 316 if (uid_is_valid(uid))
524daa8c
ZJS
317 (void) seteuid(olduid);
318
319 restore_gid:
cad93f29 320 if (gid_is_valid(gid))
524daa8c
ZJS
321 (void) setegid(oldgid);
322
323 return r;
324}
325
fd1f9c89 326static int connect_logger_as(
34cf6c43 327 const Unit *unit,
fd1f9c89 328 const ExecContext *context,
af635cf3 329 const ExecParameters *params,
fd1f9c89
LP
330 ExecOutput output,
331 const char *ident,
fd1f9c89
LP
332 int nfd,
333 uid_t uid,
334 gid_t gid) {
335
2ac1ff68
EV
336 _cleanup_close_ int fd = -1;
337 int r;
071830ff
LP
338
339 assert(context);
af635cf3 340 assert(params);
80876c20
LP
341 assert(output < _EXEC_OUTPUT_MAX);
342 assert(ident);
343 assert(nfd >= 0);
071830ff 344
54fe0cdb
LP
345 fd = socket(AF_UNIX, SOCK_STREAM, 0);
346 if (fd < 0)
80876c20 347 return -errno;
071830ff 348
91dd5f7c 349 r = connect_journal_socket(fd, context->log_namespace, uid, gid);
524daa8c
ZJS
350 if (r < 0)
351 return r;
071830ff 352
2ac1ff68 353 if (shutdown(fd, SHUT_RD) < 0)
80876c20 354 return -errno;
071830ff 355
fd1f9c89 356 (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
531dca78 357
2ac1ff68 358 if (dprintf(fd,
62bca2c6 359 "%s\n"
80876c20
LP
360 "%s\n"
361 "%i\n"
54fe0cdb
LP
362 "%i\n"
363 "%i\n"
364 "%i\n"
4f4a1dbf 365 "%i\n",
c867611e 366 context->syslog_identifier ?: ident,
af635cf3 367 params->flags & EXEC_PASS_LOG_UNIT ? unit->id : "",
54fe0cdb
LP
368 context->syslog_priority,
369 !!context->syslog_level_prefix,
f3dc6af2 370 false,
aac8c0c3 371 is_kmsg_output(output),
2ac1ff68
EV
372 is_terminal_output(output)) < 0)
373 return -errno;
80876c20 374
2ac1ff68 375 return move_fd(TAKE_FD(fd), nfd, false);
80876c20 376}
2ac1ff68 377
3a274a21 378static int open_terminal_as(const char *path, int flags, int nfd) {
046a82c1 379 int fd;
071830ff 380
80876c20
LP
381 assert(path);
382 assert(nfd >= 0);
fd1f9c89 383
3a274a21 384 fd = open_terminal(path, flags | O_NOCTTY);
3cc2aff1 385 if (fd < 0)
80876c20 386 return fd;
071830ff 387
046a82c1 388 return move_fd(fd, nfd, false);
80876c20 389}
071830ff 390
2038c3f5 391static int acquire_path(const char *path, int flags, mode_t mode) {
86fca584
ZJS
392 union sockaddr_union sa;
393 socklen_t sa_len;
15a3e96f 394 _cleanup_close_ int fd = -1;
86fca584 395 int r;
071830ff 396
80876c20 397 assert(path);
071830ff 398
2038c3f5
LP
399 if (IN_SET(flags & O_ACCMODE, O_WRONLY, O_RDWR))
400 flags |= O_CREAT;
401
402 fd = open(path, flags|O_NOCTTY, mode);
403 if (fd >= 0)
15a3e96f 404 return TAKE_FD(fd);
071830ff 405
2038c3f5
LP
406 if (errno != ENXIO) /* ENXIO is returned when we try to open() an AF_UNIX file system socket on Linux */
407 return -errno;
2038c3f5
LP
408
409 /* So, it appears the specified path could be an AF_UNIX socket. Let's see if we can connect to it. */
410
86fca584
ZJS
411 r = sockaddr_un_set_path(&sa.un, path);
412 if (r < 0)
413 return r == -EINVAL ? -ENXIO : r;
414 sa_len = r;
415
2038c3f5
LP
416 fd = socket(AF_UNIX, SOCK_STREAM, 0);
417 if (fd < 0)
418 return -errno;
419
86fca584 420 if (connect(fd, &sa.sa, sa_len) < 0)
2038c3f5 421 return errno == EINVAL ? -ENXIO : -errno; /* Propagate initial error if we get EINVAL, i.e. we have
e8607daf 422 * indication that this wasn't an AF_UNIX socket after all */
071830ff 423
2038c3f5
LP
424 if ((flags & O_ACCMODE) == O_RDONLY)
425 r = shutdown(fd, SHUT_WR);
426 else if ((flags & O_ACCMODE) == O_WRONLY)
427 r = shutdown(fd, SHUT_RD);
428 else
86fca584 429 r = 0;
15a3e96f 430 if (r < 0)
2038c3f5 431 return -errno;
2038c3f5 432
15a3e96f 433 return TAKE_FD(fd);
80876c20 434}
071830ff 435
08f3be7a
LP
436static int fixup_input(
437 const ExecContext *context,
438 int socket_fd,
439 bool apply_tty_stdin) {
440
441 ExecInput std_input;
442
443 assert(context);
444
445 std_input = context->std_input;
1e3ad081
LP
446
447 if (is_terminal_input(std_input) && !apply_tty_stdin)
448 return EXEC_INPUT_NULL;
071830ff 449
03fd9c49 450 if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
4f2d528d
LP
451 return EXEC_INPUT_NULL;
452
08f3be7a
LP
453 if (std_input == EXEC_INPUT_DATA && context->stdin_data_size == 0)
454 return EXEC_INPUT_NULL;
455
03fd9c49 456 return std_input;
4f2d528d
LP
457}
458
7966a916 459static int fixup_output(ExecOutput output, int socket_fd) {
4f2d528d 460
7966a916 461 if (output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
4f2d528d
LP
462 return EXEC_OUTPUT_INHERIT;
463
7966a916 464 return output;
4f2d528d
LP
465}
466
a34ceba6
LP
467static int setup_input(
468 const ExecContext *context,
469 const ExecParameters *params,
52c239d7 470 int socket_fd,
2caa38e9 471 const int named_iofds[static 3]) {
a34ceba6 472
4f2d528d 473 ExecInput i;
51462135 474 int r;
4f2d528d
LP
475
476 assert(context);
a34ceba6 477 assert(params);
2caa38e9 478 assert(named_iofds);
a34ceba6
LP
479
480 if (params->stdin_fd >= 0) {
481 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
482 return -errno;
483
484 /* Try to make this the controlling tty, if it is a tty, and reset it */
1fb0682e
LP
485 if (isatty(STDIN_FILENO)) {
486 (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
487 (void) reset_terminal_fd(STDIN_FILENO, true);
51462135 488 (void) terminal_set_size_fd(STDIN_FILENO, NULL, context->tty_rows, context->tty_cols);
1fb0682e 489 }
a34ceba6
LP
490
491 return STDIN_FILENO;
492 }
4f2d528d 493
08f3be7a 494 i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
4f2d528d
LP
495
496 switch (i) {
071830ff 497
80876c20
LP
498 case EXEC_INPUT_NULL:
499 return open_null_as(O_RDONLY, STDIN_FILENO);
500
501 case EXEC_INPUT_TTY:
502 case EXEC_INPUT_TTY_FORCE:
503 case EXEC_INPUT_TTY_FAIL: {
046a82c1 504 int fd;
071830ff 505
1e22b5cd 506 fd = acquire_terminal(exec_context_tty_path(context),
8854d795
LP
507 i == EXEC_INPUT_TTY_FAIL ? ACQUIRE_TERMINAL_TRY :
508 i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE :
509 ACQUIRE_TERMINAL_WAIT,
3a43da28 510 USEC_INFINITY);
970edce6 511 if (fd < 0)
80876c20
LP
512 return fd;
513
51462135
DDM
514 r = terminal_set_size_fd(fd, exec_context_tty_path(context), context->tty_rows, context->tty_cols);
515 if (r < 0)
516 return r;
517
046a82c1 518 return move_fd(fd, STDIN_FILENO, false);
80876c20
LP
519 }
520
4f2d528d 521 case EXEC_INPUT_SOCKET:
e75a9ed1
LP
522 assert(socket_fd >= 0);
523
7c248223 524 return RET_NERRNO(dup2(socket_fd, STDIN_FILENO));
4f2d528d 525
52c239d7 526 case EXEC_INPUT_NAMED_FD:
e75a9ed1
LP
527 assert(named_iofds[STDIN_FILENO] >= 0);
528
52c239d7 529 (void) fd_nonblock(named_iofds[STDIN_FILENO], false);
7c248223 530 return RET_NERRNO(dup2(named_iofds[STDIN_FILENO], STDIN_FILENO));
52c239d7 531
08f3be7a
LP
532 case EXEC_INPUT_DATA: {
533 int fd;
534
535 fd = acquire_data_fd(context->stdin_data, context->stdin_data_size, 0);
536 if (fd < 0)
537 return fd;
538
539 return move_fd(fd, STDIN_FILENO, false);
540 }
541
2038c3f5
LP
542 case EXEC_INPUT_FILE: {
543 bool rw;
544 int fd;
545
546 assert(context->stdio_file[STDIN_FILENO]);
547
548 rw = (context->std_output == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDOUT_FILENO])) ||
549 (context->std_error == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDERR_FILENO]));
550
551 fd = acquire_path(context->stdio_file[STDIN_FILENO], rw ? O_RDWR : O_RDONLY, 0666 & ~context->umask);
552 if (fd < 0)
553 return fd;
554
555 return move_fd(fd, STDIN_FILENO, false);
556 }
557
80876c20 558 default:
04499a70 559 assert_not_reached();
80876c20
LP
560 }
561}
562
41fc585a
LP
563static bool can_inherit_stderr_from_stdout(
564 const ExecContext *context,
565 ExecOutput o,
566 ExecOutput e) {
567
568 assert(context);
569
570 /* Returns true, if given the specified STDERR and STDOUT output we can directly dup() the stdout fd to the
571 * stderr fd */
572
573 if (e == EXEC_OUTPUT_INHERIT)
574 return true;
575 if (e != o)
576 return false;
577
578 if (e == EXEC_OUTPUT_NAMED_FD)
579 return streq_ptr(context->stdio_fdname[STDOUT_FILENO], context->stdio_fdname[STDERR_FILENO]);
580
8d7dab1f 581 if (IN_SET(e, EXEC_OUTPUT_FILE, EXEC_OUTPUT_FILE_APPEND, EXEC_OUTPUT_FILE_TRUNCATE))
41fc585a
LP
582 return streq_ptr(context->stdio_file[STDOUT_FILENO], context->stdio_file[STDERR_FILENO]);
583
584 return true;
585}
586
a34ceba6 587static int setup_output(
34cf6c43 588 const Unit *unit,
a34ceba6
LP
589 const ExecContext *context,
590 const ExecParameters *params,
591 int fileno,
592 int socket_fd,
2caa38e9 593 const int named_iofds[static 3],
a34ceba6 594 const char *ident,
7bce046b
LP
595 uid_t uid,
596 gid_t gid,
597 dev_t *journal_stream_dev,
598 ino_t *journal_stream_ino) {
a34ceba6 599
4f2d528d
LP
600 ExecOutput o;
601 ExecInput i;
47c1d80d 602 int r;
4f2d528d 603
f2341e0a 604 assert(unit);
80876c20 605 assert(context);
a34ceba6 606 assert(params);
80876c20 607 assert(ident);
7bce046b
LP
608 assert(journal_stream_dev);
609 assert(journal_stream_ino);
80876c20 610
a34ceba6
LP
611 if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
612
613 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
614 return -errno;
615
616 return STDOUT_FILENO;
617 }
618
619 if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
620 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
621 return -errno;
622
623 return STDERR_FILENO;
624 }
625
08f3be7a 626 i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
03fd9c49 627 o = fixup_output(context->std_output, socket_fd);
4f2d528d 628
eb17e935
MS
629 if (fileno == STDERR_FILENO) {
630 ExecOutput e;
631 e = fixup_output(context->std_error, socket_fd);
80876c20 632
eb17e935
MS
633 /* This expects the input and output are already set up */
634
635 /* Don't change the stderr file descriptor if we inherit all
636 * the way and are not on a tty */
637 if (e == EXEC_OUTPUT_INHERIT &&
638 o == EXEC_OUTPUT_INHERIT &&
639 i == EXEC_INPUT_NULL &&
640 !is_terminal_input(context->std_input) &&
7966a916 641 getppid() != 1)
eb17e935
MS
642 return fileno;
643
644 /* Duplicate from stdout if possible */
41fc585a 645 if (can_inherit_stderr_from_stdout(context, o, e))
7c248223 646 return RET_NERRNO(dup2(STDOUT_FILENO, fileno));
071830ff 647
eb17e935 648 o = e;
80876c20 649
eb17e935 650 } else if (o == EXEC_OUTPUT_INHERIT) {
21d21ea4
LP
651 /* If input got downgraded, inherit the original value */
652 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
1e22b5cd 653 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
21d21ea4 654
08f3be7a
LP
655 /* If the input is connected to anything that's not a /dev/null or a data fd, inherit that... */
656 if (!IN_SET(i, EXEC_INPUT_NULL, EXEC_INPUT_DATA))
7c248223 657 return RET_NERRNO(dup2(STDIN_FILENO, fileno));
071830ff 658
acb591e4
LP
659 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
660 if (getppid() != 1)
eb17e935 661 return fileno;
94f04347 662
eb17e935
MS
663 /* We need to open /dev/null here anew, to get the right access mode. */
664 return open_null_as(O_WRONLY, fileno);
071830ff 665 }
94f04347 666
eb17e935 667 switch (o) {
80876c20
LP
668
669 case EXEC_OUTPUT_NULL:
eb17e935 670 return open_null_as(O_WRONLY, fileno);
80876c20
LP
671
672 case EXEC_OUTPUT_TTY:
4f2d528d 673 if (is_terminal_input(i))
7c248223 674 return RET_NERRNO(dup2(STDIN_FILENO, fileno));
80876c20
LP
675
676 /* We don't reset the terminal if this is just about output */
1e22b5cd 677 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
80876c20 678
9a6bca7a 679 case EXEC_OUTPUT_KMSG:
28dbc1e8 680 case EXEC_OUTPUT_KMSG_AND_CONSOLE:
706343f4
LP
681 case EXEC_OUTPUT_JOURNAL:
682 case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
af635cf3 683 r = connect_logger_as(unit, context, params, o, ident, fileno, uid, gid);
47c1d80d 684 if (r < 0) {
7966a916
ZJS
685 log_unit_warning_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m",
686 fileno == STDOUT_FILENO ? "stdout" : "stderr");
eb17e935 687 r = open_null_as(O_WRONLY, fileno);
7bce046b
LP
688 } else {
689 struct stat st;
690
691 /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
692 * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
ab2116b1
LP
693 * services to detect whether they are connected to the journal or not.
694 *
695 * If both stdout and stderr are connected to a stream then let's make sure to store the data
696 * about STDERR as that's usually the best way to do logging. */
7bce046b 697
ab2116b1
LP
698 if (fstat(fileno, &st) >= 0 &&
699 (*journal_stream_ino == 0 || fileno == STDERR_FILENO)) {
7bce046b
LP
700 *journal_stream_dev = st.st_dev;
701 *journal_stream_ino = st.st_ino;
702 }
47c1d80d
MS
703 }
704 return r;
4f2d528d
LP
705
706 case EXEC_OUTPUT_SOCKET:
707 assert(socket_fd >= 0);
e75a9ed1 708
7c248223 709 return RET_NERRNO(dup2(socket_fd, fileno));
94f04347 710
52c239d7 711 case EXEC_OUTPUT_NAMED_FD:
e75a9ed1
LP
712 assert(named_iofds[fileno] >= 0);
713
52c239d7 714 (void) fd_nonblock(named_iofds[fileno], false);
7c248223 715 return RET_NERRNO(dup2(named_iofds[fileno], fileno));
52c239d7 716
566b7d23 717 case EXEC_OUTPUT_FILE:
8d7dab1f
LW
718 case EXEC_OUTPUT_FILE_APPEND:
719 case EXEC_OUTPUT_FILE_TRUNCATE: {
2038c3f5 720 bool rw;
566b7d23 721 int fd, flags;
2038c3f5
LP
722
723 assert(context->stdio_file[fileno]);
724
725 rw = context->std_input == EXEC_INPUT_FILE &&
726 streq_ptr(context->stdio_file[fileno], context->stdio_file[STDIN_FILENO]);
727
728 if (rw)
7c248223 729 return RET_NERRNO(dup2(STDIN_FILENO, fileno));
2038c3f5 730
566b7d23
ZD
731 flags = O_WRONLY;
732 if (o == EXEC_OUTPUT_FILE_APPEND)
733 flags |= O_APPEND;
8d7dab1f
LW
734 else if (o == EXEC_OUTPUT_FILE_TRUNCATE)
735 flags |= O_TRUNC;
566b7d23
ZD
736
737 fd = acquire_path(context->stdio_file[fileno], flags, 0666 & ~context->umask);
2038c3f5
LP
738 if (fd < 0)
739 return fd;
740
566b7d23 741 return move_fd(fd, fileno, 0);
2038c3f5
LP
742 }
743
94f04347 744 default:
04499a70 745 assert_not_reached();
94f04347 746 }
071830ff
LP
747}
748
02a51aba 749static int chown_terminal(int fd, uid_t uid) {
4b3b5bc7 750 int r;
02a51aba
LP
751
752 assert(fd >= 0);
02a51aba 753
1ff74fb6 754 /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
4b3b5bc7
LP
755 if (isatty(fd) < 1) {
756 if (IN_SET(errno, EINVAL, ENOTTY))
757 return 0; /* not a tty */
1ff74fb6 758
02a51aba 759 return -errno;
4b3b5bc7 760 }
02a51aba 761
4b3b5bc7 762 /* This might fail. What matters are the results. */
f2df231f 763 r = fchmod_and_chown(fd, TTY_MODE, uid, GID_INVALID);
4b3b5bc7
LP
764 if (r < 0)
765 return r;
02a51aba 766
4b3b5bc7 767 return 1;
02a51aba
LP
768}
769
aedec452 770static int setup_confirm_stdio(
51462135 771 const ExecContext *context,
aedec452
LP
772 const char *vc,
773 int *ret_saved_stdin,
774 int *ret_saved_stdout) {
775
3d18b167
LP
776 _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
777 int r;
80876c20 778
aedec452
LP
779 assert(ret_saved_stdin);
780 assert(ret_saved_stdout);
80876c20 781
af6da548
LP
782 saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
783 if (saved_stdin < 0)
784 return -errno;
80876c20 785
af6da548 786 saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
3d18b167
LP
787 if (saved_stdout < 0)
788 return -errno;
80876c20 789
8854d795 790 fd = acquire_terminal(vc, ACQUIRE_TERMINAL_WAIT, DEFAULT_CONFIRM_USEC);
3d18b167
LP
791 if (fd < 0)
792 return fd;
80876c20 793
af6da548
LP
794 r = chown_terminal(fd, getuid());
795 if (r < 0)
3d18b167 796 return r;
02a51aba 797
3d18b167
LP
798 r = reset_terminal_fd(fd, true);
799 if (r < 0)
800 return r;
80876c20 801
51462135
DDM
802 r = terminal_set_size_fd(fd, vc, context->tty_rows, context->tty_cols);
803 if (r < 0)
804 return r;
805
aedec452
LP
806 r = rearrange_stdio(fd, fd, STDERR_FILENO); /* Invalidates 'fd' also on failure */
807 TAKE_FD(fd);
2b33ab09
LP
808 if (r < 0)
809 return r;
80876c20 810
aedec452
LP
811 *ret_saved_stdin = TAKE_FD(saved_stdin);
812 *ret_saved_stdout = TAKE_FD(saved_stdout);
3d18b167 813 return 0;
80876c20
LP
814}
815
63d77c92 816static void write_confirm_error_fd(int err, int fd, const Unit *u) {
3b20f877
FB
817 assert(err < 0);
818
819 if (err == -ETIMEDOUT)
63d77c92 820 dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);
3b20f877
FB
821 else {
822 errno = -err;
63d77c92 823 dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);
3b20f877
FB
824 }
825}
826
63d77c92 827static void write_confirm_error(int err, const char *vc, const Unit *u) {
03e334a1 828 _cleanup_close_ int fd = -1;
80876c20 829
3b20f877 830 assert(vc);
80876c20 831
7d5ceb64 832 fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);
af6da548 833 if (fd < 0)
3b20f877 834 return;
80876c20 835
63d77c92 836 write_confirm_error_fd(err, fd, u);
af6da548 837}
80876c20 838
3d18b167 839static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
af6da548 840 int r = 0;
80876c20 841
af6da548
LP
842 assert(saved_stdin);
843 assert(saved_stdout);
844
845 release_terminal();
846
847 if (*saved_stdin >= 0)
80876c20 848 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
af6da548 849 r = -errno;
80876c20 850
af6da548 851 if (*saved_stdout >= 0)
80876c20 852 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
af6da548 853 r = -errno;
80876c20 854
3d18b167
LP
855 *saved_stdin = safe_close(*saved_stdin);
856 *saved_stdout = safe_close(*saved_stdout);
af6da548
LP
857
858 return r;
859}
860
3b20f877
FB
861enum {
862 CONFIRM_PRETEND_FAILURE = -1,
863 CONFIRM_PRETEND_SUCCESS = 0,
864 CONFIRM_EXECUTE = 1,
865};
866
51462135 867static int ask_for_confirmation(const ExecContext *context, const char *vc, Unit *u, const char *cmdline) {
af6da548 868 int saved_stdout = -1, saved_stdin = -1, r;
2bcd3c26 869 _cleanup_free_ char *e = NULL;
3b20f877 870 char c;
af6da548 871
3b20f877 872 /* For any internal errors, assume a positive response. */
51462135 873 r = setup_confirm_stdio(context, vc, &saved_stdin, &saved_stdout);
3b20f877 874 if (r < 0) {
63d77c92 875 write_confirm_error(r, vc, u);
3b20f877
FB
876 return CONFIRM_EXECUTE;
877 }
af6da548 878
b0eb2944
FB
879 /* confirm_spawn might have been disabled while we were sleeping. */
880 if (manager_is_confirm_spawn_disabled(u->manager)) {
881 r = 1;
882 goto restore_stdio;
883 }
af6da548 884
2bcd3c26
FB
885 e = ellipsize(cmdline, 60, 100);
886 if (!e) {
887 log_oom();
888 r = CONFIRM_EXECUTE;
889 goto restore_stdio;
890 }
af6da548 891
d172b175 892 for (;;) {
539622bd 893 r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);
d172b175 894 if (r < 0) {
63d77c92 895 write_confirm_error_fd(r, STDOUT_FILENO, u);
d172b175
FB
896 r = CONFIRM_EXECUTE;
897 goto restore_stdio;
898 }
af6da548 899
d172b175 900 switch (c) {
b0eb2944
FB
901 case 'c':
902 printf("Resuming normal execution.\n");
903 manager_disable_confirm_spawn();
904 r = 1;
905 break;
dd6f9ac0
FB
906 case 'D':
907 unit_dump(u, stdout, " ");
908 continue; /* ask again */
d172b175
FB
909 case 'f':
910 printf("Failing execution.\n");
911 r = CONFIRM_PRETEND_FAILURE;
912 break;
913 case 'h':
b0eb2944
FB
914 printf(" c - continue, proceed without asking anymore\n"
915 " D - dump, show the state of the unit\n"
dd6f9ac0 916 " f - fail, don't execute the command and pretend it failed\n"
d172b175 917 " h - help\n"
eedf223a 918 " i - info, show a short summary of the unit\n"
56fde33a 919 " j - jobs, show jobs that are in progress\n"
d172b175
FB
920 " s - skip, don't execute the command and pretend it succeeded\n"
921 " y - yes, execute the command\n");
dd6f9ac0 922 continue; /* ask again */
eedf223a
FB
923 case 'i':
924 printf(" Description: %s\n"
925 " Unit: %s\n"
926 " Command: %s\n",
927 u->id, u->description, cmdline);
928 continue; /* ask again */
56fde33a
FB
929 case 'j':
930 manager_dump_jobs(u->manager, stdout, " ");
931 continue; /* ask again */
539622bd
FB
932 case 'n':
933 /* 'n' was removed in favor of 'f'. */
934 printf("Didn't understand 'n', did you mean 'f'?\n");
935 continue; /* ask again */
d172b175
FB
936 case 's':
937 printf("Skipping execution.\n");
938 r = CONFIRM_PRETEND_SUCCESS;
939 break;
940 case 'y':
941 r = CONFIRM_EXECUTE;
942 break;
943 default:
04499a70 944 assert_not_reached();
d172b175 945 }
3b20f877 946 break;
3b20f877 947 }
af6da548 948
3b20f877 949restore_stdio:
af6da548 950 restore_confirm_stdio(&saved_stdin, &saved_stdout);
af6da548 951 return r;
80876c20
LP
952}
953
4d885bd3
DH
954static int get_fixed_user(const ExecContext *c, const char **user,
955 uid_t *uid, gid_t *gid,
956 const char **home, const char **shell) {
81a2b7ce 957 int r;
4d885bd3 958 const char *name;
81a2b7ce 959
4d885bd3 960 assert(c);
81a2b7ce 961
23deef88
LP
962 if (!c->user)
963 return 0;
964
4d885bd3
DH
965 /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway
966 * (i.e. are "/" or "/bin/nologin"). */
81a2b7ce 967
23deef88 968 name = c->user;
fafff8f1 969 r = get_user_creds(&name, uid, gid, home, shell, USER_CREDS_CLEAN);
4d885bd3
DH
970 if (r < 0)
971 return r;
81a2b7ce 972
4d885bd3
DH
973 *user = name;
974 return 0;
975}
976
977static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {
978 int r;
979 const char *name;
980
981 assert(c);
982
983 if (!c->group)
984 return 0;
985
986 name = c->group;
fafff8f1 987 r = get_group_creds(&name, gid, 0);
4d885bd3
DH
988 if (r < 0)
989 return r;
990
991 *group = name;
992 return 0;
993}
994
cdc5d5c5
DH
995static int get_supplementary_groups(const ExecContext *c, const char *user,
996 const char *group, gid_t gid,
997 gid_t **supplementary_gids, int *ngids) {
4d885bd3
DH
998 int r, k = 0;
999 int ngroups_max;
1000 bool keep_groups = false;
1001 gid_t *groups = NULL;
1002 _cleanup_free_ gid_t *l_gids = NULL;
1003
1004 assert(c);
1005
bbeea271
DH
1006 /*
1007 * If user is given, then lookup GID and supplementary groups list.
1008 * We avoid NSS lookups for gid=0. Also we have to initialize groups
cdc5d5c5
DH
1009 * here and as early as possible so we keep the list of supplementary
1010 * groups of the caller.
bbeea271
DH
1011 */
1012 if (user && gid_is_valid(gid) && gid != 0) {
1013 /* First step, initialize groups from /etc/groups */
1014 if (initgroups(user, gid) < 0)
1015 return -errno;
1016
1017 keep_groups = true;
1018 }
1019
ac6e8be6 1020 if (strv_isempty(c->supplementary_groups))
4d885bd3
DH
1021 return 0;
1022
366ddd25
DH
1023 /*
1024 * If SupplementaryGroups= was passed then NGROUPS_MAX has to
1025 * be positive, otherwise fail.
1026 */
1027 errno = 0;
1028 ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
66855de7
LP
1029 if (ngroups_max <= 0)
1030 return errno_or_else(EOPNOTSUPP);
366ddd25 1031
4d885bd3
DH
1032 l_gids = new(gid_t, ngroups_max);
1033 if (!l_gids)
1034 return -ENOMEM;
81a2b7ce 1035
4d885bd3
DH
1036 if (keep_groups) {
1037 /*
1038 * Lookup the list of groups that the user belongs to, we
1039 * avoid NSS lookups here too for gid=0.
1040 */
1041 k = ngroups_max;
1042 if (getgrouplist(user, gid, l_gids, &k) < 0)
1043 return -EINVAL;
1044 } else
1045 k = 0;
81a2b7ce 1046
4d885bd3
DH
1047 STRV_FOREACH(i, c->supplementary_groups) {
1048 const char *g;
81a2b7ce 1049
4d885bd3
DH
1050 if (k >= ngroups_max)
1051 return -E2BIG;
81a2b7ce 1052
4d885bd3 1053 g = *i;
fafff8f1 1054 r = get_group_creds(&g, l_gids+k, 0);
4d885bd3
DH
1055 if (r < 0)
1056 return r;
81a2b7ce 1057
4d885bd3
DH
1058 k++;
1059 }
81a2b7ce 1060
4d885bd3
DH
1061 /*
1062 * Sets ngids to zero to drop all supplementary groups, happens
1063 * when we are under root and SupplementaryGroups= is empty.
1064 */
1065 if (k == 0) {
1066 *ngids = 0;
1067 return 0;
1068 }
81a2b7ce 1069
4d885bd3
DH
1070 /* Otherwise get the final list of supplementary groups */
1071 groups = memdup(l_gids, sizeof(gid_t) * k);
1072 if (!groups)
1073 return -ENOMEM;
1074
1075 *supplementary_gids = groups;
1076 *ngids = k;
1077
1078 groups = NULL;
1079
1080 return 0;
1081}
1082
34cf6c43 1083static int enforce_groups(gid_t gid, const gid_t *supplementary_gids, int ngids) {
4d885bd3
DH
1084 int r;
1085
709dbeac
YW
1086 /* Handle SupplementaryGroups= if it is not empty */
1087 if (ngids > 0) {
4d885bd3
DH
1088 r = maybe_setgroups(ngids, supplementary_gids);
1089 if (r < 0)
97f0e76f 1090 return r;
4d885bd3 1091 }
81a2b7ce 1092
4d885bd3
DH
1093 if (gid_is_valid(gid)) {
1094 /* Then set our gids */
1095 if (setresgid(gid, gid, gid) < 0)
1096 return -errno;
81a2b7ce
LP
1097 }
1098
1099 return 0;
1100}
1101
dbdc4098
TK
1102static int set_securebits(int bits, int mask) {
1103 int current, applied;
1104 current = prctl(PR_GET_SECUREBITS);
1105 if (current < 0)
1106 return -errno;
1107 /* Clear all securebits defined in mask and set bits */
1108 applied = (current & ~mask) | bits;
1109 if (current == applied)
1110 return 0;
1111 if (prctl(PR_SET_SECUREBITS, applied) < 0)
1112 return -errno;
1113 return 1;
1114}
1115
81a2b7ce 1116static int enforce_user(const ExecContext *context, uid_t uid) {
81a2b7ce 1117 assert(context);
dbdc4098 1118 int r;
81a2b7ce 1119
4d885bd3
DH
1120 if (!uid_is_valid(uid))
1121 return 0;
1122
479050b3 1123 /* Sets (but doesn't look up) the uid and make sure we keep the
dbdc4098
TK
1124 * capabilities while doing so. For setting secure bits the capability CAP_SETPCAP is
1125 * required, so we also need keep-caps in this case.
1126 */
81a2b7ce 1127
dbdc4098 1128 if (context->capability_ambient_set != 0 || context->secure_bits != 0) {
81a2b7ce
LP
1129
1130 /* First step: If we need to keep capabilities but
1131 * drop privileges we need to make sure we keep our
cbb21cca 1132 * caps, while we drop privileges. */
693ced48 1133 if (uid != 0) {
dbdc4098
TK
1134 /* Add KEEP_CAPS to the securebits */
1135 r = set_securebits(1<<SECURE_KEEP_CAPS, 0);
1136 if (r < 0)
1137 return r;
693ced48 1138 }
81a2b7ce
LP
1139 }
1140
479050b3 1141 /* Second step: actually set the uids */
81a2b7ce
LP
1142 if (setresuid(uid, uid, uid) < 0)
1143 return -errno;
1144
1145 /* At this point we should have all necessary capabilities but
1146 are otherwise a normal user. However, the caps might got
1147 corrupted due to the setresuid() so we need clean them up
1148 later. This is done outside of this call. */
1149
1150 return 0;
1151}
1152
349cc4a5 1153#if HAVE_PAM
5b6319dc
LP
1154
1155static int null_conv(
1156 int num_msg,
1157 const struct pam_message **msg,
1158 struct pam_response **resp,
1159 void *appdata_ptr) {
1160
1161 /* We don't support conversations */
1162
1163 return PAM_CONV_ERR;
1164}
1165
cefc33ae
LP
1166#endif
1167
5b6319dc
LP
1168static int setup_pam(
1169 const char *name,
1170 const char *user,
940c5210 1171 uid_t uid,
2d6fce8d 1172 gid_t gid,
5b6319dc 1173 const char *tty,
421bb42d 1174 char ***env, /* updated on success */
5b8d1f6b 1175 const int fds[], size_t n_fds) {
5b6319dc 1176
349cc4a5 1177#if HAVE_PAM
cefc33ae 1178
5b6319dc
LP
1179 static const struct pam_conv conv = {
1180 .conv = null_conv,
1181 .appdata_ptr = NULL
1182 };
1183
2d7c6aa2 1184 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
46e5bbab 1185 _cleanup_strv_free_ char **e = NULL;
5b6319dc 1186 pam_handle_t *handle = NULL;
d6e5f3ad 1187 sigset_t old_ss;
7bb70b6e 1188 int pam_code = PAM_SUCCESS, r;
5b6319dc
LP
1189 bool close_session = false;
1190 pid_t pam_pid = 0, parent_pid;
970edce6 1191 int flags = 0;
5b6319dc
LP
1192
1193 assert(name);
1194 assert(user);
2065ca69 1195 assert(env);
5b6319dc
LP
1196
1197 /* We set up PAM in the parent process, then fork. The child
35b8ca3a 1198 * will then stay around until killed via PR_GET_PDEATHSIG or
5b6319dc
LP
1199 * systemd via the cgroup logic. It will then remove the PAM
1200 * session again. The parent process will exec() the actual
1201 * daemon. We do things this way to ensure that the main PID
1202 * of the daemon is the one we initially fork()ed. */
1203
7bb70b6e
LP
1204 r = barrier_create(&barrier);
1205 if (r < 0)
2d7c6aa2
DH
1206 goto fail;
1207
553d2243 1208 if (log_get_max_level() < LOG_DEBUG)
970edce6
ZJS
1209 flags |= PAM_SILENT;
1210
f546241b
ZJS
1211 pam_code = pam_start(name, user, &conv, &handle);
1212 if (pam_code != PAM_SUCCESS) {
5b6319dc
LP
1213 handle = NULL;
1214 goto fail;
1215 }
1216
3cd24c1a
LP
1217 if (!tty) {
1218 _cleanup_free_ char *q = NULL;
1219
1220 /* Hmm, so no TTY was explicitly passed, but an fd passed to us directly might be a TTY. Let's figure
1221 * out if that's the case, and read the TTY off it. */
1222
1223 if (getttyname_malloc(STDIN_FILENO, &q) >= 0)
1224 tty = strjoina("/dev/", q);
1225 }
1226
f546241b
ZJS
1227 if (tty) {
1228 pam_code = pam_set_item(handle, PAM_TTY, tty);
1229 if (pam_code != PAM_SUCCESS)
5b6319dc 1230 goto fail;
f546241b 1231 }
5b6319dc 1232
84eada2f
JW
1233 STRV_FOREACH(nv, *env) {
1234 pam_code = pam_putenv(handle, *nv);
2065ca69
JW
1235 if (pam_code != PAM_SUCCESS)
1236 goto fail;
1237 }
1238
970edce6 1239 pam_code = pam_acct_mgmt(handle, flags);
f546241b 1240 if (pam_code != PAM_SUCCESS)
5b6319dc
LP
1241 goto fail;
1242
3bb39ea9
DG
1243 pam_code = pam_setcred(handle, PAM_ESTABLISH_CRED | flags);
1244 if (pam_code != PAM_SUCCESS)
46d7c6af 1245 log_debug("pam_setcred() failed, ignoring: %s", pam_strerror(handle, pam_code));
3bb39ea9 1246
970edce6 1247 pam_code = pam_open_session(handle, flags);
f546241b 1248 if (pam_code != PAM_SUCCESS)
5b6319dc
LP
1249 goto fail;
1250
1251 close_session = true;
1252
f546241b
ZJS
1253 e = pam_getenvlist(handle);
1254 if (!e) {
5b6319dc
LP
1255 pam_code = PAM_BUF_ERR;
1256 goto fail;
1257 }
1258
cafc5ca1 1259 /* Block SIGTERM, so that we know that it won't get lost in the child */
ce30c8dc 1260
72c0a2c2 1261 assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
5b6319dc 1262
df0ff127 1263 parent_pid = getpid_cached();
5b6319dc 1264
4c253ed1
LP
1265 r = safe_fork("(sd-pam)", 0, &pam_pid);
1266 if (r < 0)
5b6319dc 1267 goto fail;
4c253ed1 1268 if (r == 0) {
7bb70b6e 1269 int sig, ret = EXIT_PAM;
5b6319dc 1270
cafc5ca1 1271 /* The child's job is to reset the PAM session on termination */
2d7c6aa2 1272 barrier_set_role(&barrier, BARRIER_CHILD);
5b6319dc 1273
1da37e58
ZJS
1274 /* Make sure we don't keep open the passed fds in this child. We assume that otherwise only
1275 * those fds are open here that have been opened by PAM. */
4c253ed1 1276 (void) close_many(fds, n_fds);
5b6319dc 1277
cafc5ca1
LP
1278 /* Drop privileges - we don't need any to pam_close_session and this will make
1279 * PR_SET_PDEATHSIG work in most cases. If this fails, ignore the error - but expect sd-pam
1280 * threads to fail to exit normally */
2d6fce8d 1281
97f0e76f
LP
1282 r = maybe_setgroups(0, NULL);
1283 if (r < 0)
1284 log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
2d6fce8d
LP
1285 if (setresgid(gid, gid, gid) < 0)
1286 log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
940c5210 1287 if (setresuid(uid, uid, uid) < 0)
2d6fce8d 1288 log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m");
940c5210 1289
9c274488 1290 (void) ignore_signals(SIGPIPE);
ce30c8dc 1291
cafc5ca1
LP
1292 /* Wait until our parent died. This will only work if the above setresuid() succeeds,
1293 * otherwise the kernel will not allow unprivileged parents kill their privileged children
1294 * this way. We rely on the control groups kill logic to do the rest for us. */
5b6319dc
LP
1295 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
1296 goto child_finish;
1297
cafc5ca1
LP
1298 /* Tell the parent that our setup is done. This is especially important regarding dropping
1299 * privileges. Otherwise, unit setup might race against our setresuid(2) call.
643f4706 1300 *
cafc5ca1 1301 * If the parent aborted, we'll detect this below, hence ignore return failure here. */
643f4706 1302 (void) barrier_place(&barrier);
2d7c6aa2 1303
643f4706 1304 /* Check if our parent process might already have died? */
5b6319dc 1305 if (getppid() == parent_pid) {
d6e5f3ad
DM
1306 sigset_t ss;
1307
1308 assert_se(sigemptyset(&ss) >= 0);
1309 assert_se(sigaddset(&ss, SIGTERM) >= 0);
1310
3dead8d9
LP
1311 for (;;) {
1312 if (sigwait(&ss, &sig) < 0) {
1313 if (errno == EINTR)
1314 continue;
1315
1316 goto child_finish;
1317 }
5b6319dc 1318
3dead8d9
LP
1319 assert(sig == SIGTERM);
1320 break;
1321 }
5b6319dc
LP
1322 }
1323
3bb39ea9
DG
1324 pam_code = pam_setcred(handle, PAM_DELETE_CRED | flags);
1325 if (pam_code != PAM_SUCCESS)
1326 goto child_finish;
1327
3dead8d9 1328 /* If our parent died we'll end the session */
f546241b 1329 if (getppid() != parent_pid) {
970edce6 1330 pam_code = pam_close_session(handle, flags);
f546241b 1331 if (pam_code != PAM_SUCCESS)
5b6319dc 1332 goto child_finish;
f546241b 1333 }
5b6319dc 1334
7bb70b6e 1335 ret = 0;
5b6319dc
LP
1336
1337 child_finish:
7feb2b57
LP
1338 /* NB: pam_end() when called in child processes should set PAM_DATA_SILENT to let the module
1339 * know about this. See pam_end(3) */
1340 (void) pam_end(handle, pam_code | flags | PAM_DATA_SILENT);
7bb70b6e 1341 _exit(ret);
5b6319dc
LP
1342 }
1343
2d7c6aa2
DH
1344 barrier_set_role(&barrier, BARRIER_PARENT);
1345
cafc5ca1
LP
1346 /* If the child was forked off successfully it will do all the cleanups, so forget about the handle
1347 * here. */
5b6319dc
LP
1348 handle = NULL;
1349
3b8bddde 1350 /* Unblock SIGTERM again in the parent */
72c0a2c2 1351 assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
5b6319dc 1352
cafc5ca1
LP
1353 /* We close the log explicitly here, since the PAM modules might have opened it, but we don't want
1354 * this fd around. */
5b6319dc
LP
1355 closelog();
1356
cafc5ca1
LP
1357 /* Synchronously wait for the child to initialize. We don't care for errors as we cannot
1358 * recover. However, warn loudly if it happens. */
2d7c6aa2
DH
1359 if (!barrier_place_and_sync(&barrier))
1360 log_error("PAM initialization failed");
1361
130d3d22 1362 return strv_free_and_replace(*env, e);
5b6319dc
LP
1363
1364fail:
970edce6
ZJS
1365 if (pam_code != PAM_SUCCESS) {
1366 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
7bb70b6e
LP
1367 r = -EPERM; /* PAM errors do not map to errno */
1368 } else
1369 log_error_errno(r, "PAM failed: %m");
9ba35398 1370
5b6319dc
LP
1371 if (handle) {
1372 if (close_session)
970edce6 1373 pam_code = pam_close_session(handle, flags);
5b6319dc 1374
7feb2b57 1375 (void) pam_end(handle, pam_code | flags);
5b6319dc
LP
1376 }
1377
5b6319dc 1378 closelog();
7bb70b6e 1379 return r;
cefc33ae
LP
1380#else
1381 return 0;
5b6319dc 1382#endif
cefc33ae 1383}
5b6319dc 1384
5d6b1584
LP
1385static void rename_process_from_path(const char *path) {
1386 char process_name[11];
1387 const char *p;
1388 size_t l;
1389
1390 /* This resulting string must fit in 10 chars (i.e. the length
1391 * of "/sbin/init") to look pretty in /bin/ps */
1392
2b6bf07d 1393 p = basename(path);
5d6b1584
LP
1394 if (isempty(p)) {
1395 rename_process("(...)");
1396 return;
1397 }
1398
1399 l = strlen(p);
1400 if (l > 8) {
1401 /* The end of the process name is usually more
1402 * interesting, since the first bit might just be
1403 * "systemd-" */
1404 p = p + l - 8;
1405 l = 8;
1406 }
1407
1408 process_name[0] = '(';
1409 memcpy(process_name+1, p, l);
1410 process_name[1+l] = ')';
1411 process_name[1+l+1] = 0;
1412
1413 rename_process(process_name);
1414}
1415
469830d1
LP
1416static bool context_has_address_families(const ExecContext *c) {
1417 assert(c);
1418
6b000af4 1419 return c->address_families_allow_list ||
469830d1
LP
1420 !set_isempty(c->address_families);
1421}
1422
1423static bool context_has_syscall_filters(const ExecContext *c) {
1424 assert(c);
1425
6b000af4 1426 return c->syscall_allow_list ||
8cfa775f 1427 !hashmap_isempty(c->syscall_filter);
469830d1
LP
1428}
1429
9df2cdd8
TM
1430static bool context_has_syscall_logs(const ExecContext *c) {
1431 assert(c);
1432
1433 return c->syscall_log_allow_list ||
1434 !hashmap_isempty(c->syscall_log);
1435}
1436
469830d1
LP
1437static bool context_has_no_new_privileges(const ExecContext *c) {
1438 assert(c);
1439
1440 if (c->no_new_privileges)
1441 return true;
1442
1443 if (have_effective_cap(CAP_SYS_ADMIN)) /* if we are privileged, we don't need NNP */
1444 return false;
1445
1446 /* We need NNP if we have any form of seccomp and are unprivileged */
0538d2a8 1447 return c->lock_personality ||
469830d1 1448 c->memory_deny_write_execute ||
0538d2a8 1449 c->private_devices ||
fc64760d 1450 c->protect_clock ||
0538d2a8 1451 c->protect_hostname ||
469830d1
LP
1452 c->protect_kernel_tunables ||
1453 c->protect_kernel_modules ||
84703040 1454 c->protect_kernel_logs ||
0538d2a8
YW
1455 context_has_address_families(c) ||
1456 exec_context_restrict_namespaces_set(c) ||
1457 c->restrict_realtime ||
1458 c->restrict_suid_sgid ||
78e864e5 1459 !set_isempty(c->syscall_archs) ||
0538d2a8
YW
1460 context_has_syscall_filters(c) ||
1461 context_has_syscall_logs(c);
469830d1
LP
1462}
1463
bb0c0d6f
LP
1464static bool exec_context_has_credentials(const ExecContext *context) {
1465
1466 assert(context);
1467
1468 return !hashmap_isempty(context->set_credentials) ||
43144be4 1469 !hashmap_isempty(context->load_credentials);
bb0c0d6f
LP
1470}
1471
349cc4a5 1472#if HAVE_SECCOMP
17df7223 1473
83f12b27 1474static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
f673b62d
LP
1475
1476 if (is_seccomp_available())
1477 return false;
1478
f673b62d 1479 log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
f673b62d 1480 return true;
83f12b27
FS
1481}
1482
165a31c0 1483static int apply_syscall_filter(const Unit* u, const ExecContext *c, bool needs_ambient_hack) {
469830d1 1484 uint32_t negative_action, default_action, action;
165a31c0 1485 int r;
8351ceae 1486
469830d1 1487 assert(u);
c0467cf3 1488 assert(c);
8351ceae 1489
469830d1 1490 if (!context_has_syscall_filters(c))
83f12b27
FS
1491 return 0;
1492
469830d1
LP
1493 if (skip_seccomp_unavailable(u, "SystemCallFilter="))
1494 return 0;
e9642be2 1495
005bfaf1 1496 negative_action = c->syscall_errno == SECCOMP_ERROR_NUMBER_KILL ? scmp_act_kill_process() : SCMP_ACT_ERRNO(c->syscall_errno);
e9642be2 1497
6b000af4 1498 if (c->syscall_allow_list) {
469830d1
LP
1499 default_action = negative_action;
1500 action = SCMP_ACT_ALLOW;
7c66bae2 1501 } else {
469830d1
LP
1502 default_action = SCMP_ACT_ALLOW;
1503 action = negative_action;
57183d11 1504 }
8351ceae 1505
165a31c0 1506 if (needs_ambient_hack) {
6b000af4 1507 r = seccomp_filter_set_add(c->syscall_filter, c->syscall_allow_list, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID);
165a31c0
LP
1508 if (r < 0)
1509 return r;
1510 }
1511
b54f36c6 1512 return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false);
4298d0b5
LP
1513}
1514
9df2cdd8
TM
1515static int apply_syscall_log(const Unit* u, const ExecContext *c) {
1516#ifdef SCMP_ACT_LOG
1517 uint32_t default_action, action;
1518#endif
1519
1520 assert(u);
1521 assert(c);
1522
1523 if (!context_has_syscall_logs(c))
1524 return 0;
1525
1526#ifdef SCMP_ACT_LOG
1527 if (skip_seccomp_unavailable(u, "SystemCallLog="))
1528 return 0;
1529
1530 if (c->syscall_log_allow_list) {
1531 /* Log nothing but the ones listed */
1532 default_action = SCMP_ACT_ALLOW;
1533 action = SCMP_ACT_LOG;
1534 } else {
1535 /* Log everything but the ones listed */
1536 default_action = SCMP_ACT_LOG;
1537 action = SCMP_ACT_ALLOW;
1538 }
1539
1540 return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_log, action, false);
1541#else
1542 /* old libseccomp */
1543 log_unit_debug(u, "SECCOMP feature SCMP_ACT_LOG not available, skipping SystemCallLog=");
1544 return 0;
1545#endif
1546}
1547
469830d1
LP
1548static int apply_syscall_archs(const Unit *u, const ExecContext *c) {
1549 assert(u);
4298d0b5
LP
1550 assert(c);
1551
469830d1 1552 if (set_isempty(c->syscall_archs))
83f12b27
FS
1553 return 0;
1554
469830d1
LP
1555 if (skip_seccomp_unavailable(u, "SystemCallArchitectures="))
1556 return 0;
4298d0b5 1557
469830d1
LP
1558 return seccomp_restrict_archs(c->syscall_archs);
1559}
4298d0b5 1560
469830d1
LP
1561static int apply_address_families(const Unit* u, const ExecContext *c) {
1562 assert(u);
1563 assert(c);
4298d0b5 1564
469830d1
LP
1565 if (!context_has_address_families(c))
1566 return 0;
4298d0b5 1567
469830d1
LP
1568 if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1569 return 0;
4298d0b5 1570
6b000af4 1571 return seccomp_restrict_address_families(c->address_families, c->address_families_allow_list);
8351ceae 1572}
4298d0b5 1573
83f12b27 1574static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
469830d1 1575 assert(u);
f3e43635
TM
1576 assert(c);
1577
469830d1 1578 if (!c->memory_deny_write_execute)
83f12b27
FS
1579 return 0;
1580
469830d1
LP
1581 if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1582 return 0;
f3e43635 1583
469830d1 1584 return seccomp_memory_deny_write_execute();
f3e43635
TM
1585}
1586
83f12b27 1587static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
469830d1 1588 assert(u);
f4170c67
LP
1589 assert(c);
1590
469830d1 1591 if (!c->restrict_realtime)
83f12b27
FS
1592 return 0;
1593
469830d1
LP
1594 if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1595 return 0;
f4170c67 1596
469830d1 1597 return seccomp_restrict_realtime();
f4170c67
LP
1598}
1599
f69567cb
LP
1600static int apply_restrict_suid_sgid(const Unit* u, const ExecContext *c) {
1601 assert(u);
1602 assert(c);
1603
1604 if (!c->restrict_suid_sgid)
1605 return 0;
1606
1607 if (skip_seccomp_unavailable(u, "RestrictSUIDSGID="))
1608 return 0;
1609
1610 return seccomp_restrict_suid_sgid();
1611}
1612
59e856c7 1613static int apply_protect_sysctl(const Unit *u, const ExecContext *c) {
469830d1 1614 assert(u);
59eeb84b
LP
1615 assert(c);
1616
1617 /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1618 * let's protect even those systems where this is left on in the kernel. */
1619
469830d1 1620 if (!c->protect_kernel_tunables)
59eeb84b
LP
1621 return 0;
1622
469830d1
LP
1623 if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1624 return 0;
59eeb84b 1625
469830d1 1626 return seccomp_protect_sysctl();
59eeb84b
LP
1627}
1628
59e856c7 1629static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
469830d1 1630 assert(u);
502d704e
DH
1631 assert(c);
1632
25a8d8a0 1633 /* Turn off module syscalls on ProtectKernelModules=yes */
502d704e 1634
469830d1
LP
1635 if (!c->protect_kernel_modules)
1636 return 0;
1637
502d704e
DH
1638 if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
1639 return 0;
1640
b54f36c6 1641 return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM), false);
502d704e
DH
1642}
1643
84703040
KK
1644static int apply_protect_kernel_logs(const Unit *u, const ExecContext *c) {
1645 assert(u);
1646 assert(c);
1647
1648 if (!c->protect_kernel_logs)
1649 return 0;
1650
1651 if (skip_seccomp_unavailable(u, "ProtectKernelLogs="))
1652 return 0;
1653
1654 return seccomp_protect_syslog();
1655}
1656
daf8f72b 1657static int apply_protect_clock(const Unit *u, const ExecContext *c) {
fc64760d
KK
1658 assert(u);
1659 assert(c);
1660
1661 if (!c->protect_clock)
1662 return 0;
1663
1664 if (skip_seccomp_unavailable(u, "ProtectClock="))
1665 return 0;
1666
1667 return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK, SCMP_ACT_ERRNO(EPERM), false);
1668}
1669
59e856c7 1670static int apply_private_devices(const Unit *u, const ExecContext *c) {
469830d1 1671 assert(u);
ba128bb8
LP
1672 assert(c);
1673
8f81a5f6 1674 /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */
ba128bb8 1675
469830d1
LP
1676 if (!c->private_devices)
1677 return 0;
1678
ba128bb8
LP
1679 if (skip_seccomp_unavailable(u, "PrivateDevices="))
1680 return 0;
1681
b54f36c6 1682 return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM), false);
ba128bb8
LP
1683}
1684
34cf6c43 1685static int apply_restrict_namespaces(const Unit *u, const ExecContext *c) {
469830d1 1686 assert(u);
add00535
LP
1687 assert(c);
1688
1689 if (!exec_context_restrict_namespaces_set(c))
1690 return 0;
1691
1692 if (skip_seccomp_unavailable(u, "RestrictNamespaces="))
1693 return 0;
1694
1695 return seccomp_restrict_namespaces(c->restrict_namespaces);
1696}
1697
78e864e5 1698static int apply_lock_personality(const Unit* u, const ExecContext *c) {
e8132d63
LP
1699 unsigned long personality;
1700 int r;
78e864e5
TM
1701
1702 assert(u);
1703 assert(c);
1704
1705 if (!c->lock_personality)
1706 return 0;
1707
1708 if (skip_seccomp_unavailable(u, "LockPersonality="))
1709 return 0;
1710
e8132d63
LP
1711 personality = c->personality;
1712
1713 /* If personality is not specified, use either PER_LINUX or PER_LINUX32 depending on what is currently set. */
1714 if (personality == PERSONALITY_INVALID) {
1715
1716 r = opinionated_personality(&personality);
1717 if (r < 0)
1718 return r;
1719 }
78e864e5
TM
1720
1721 return seccomp_lock_personality(personality);
1722}
1723
c0467cf3 1724#endif
8351ceae 1725
7a8288f6 1726#if HAVE_LIBBPF
7a8288f6
DM
1727static int apply_restrict_filesystems(Unit *u, const ExecContext *c) {
1728 assert(u);
1729 assert(c);
1730
1731 if (!exec_context_restrict_filesystems_set(c))
1732 return 0;
1733
46004616
ZJS
1734 if (!u->manager->restrict_fs) {
1735 /* LSM BPF is unsupported or lsm_bpf_setup failed */
1736 log_unit_debug(u, "LSM BPF not supported, skipping RestrictFileSystems=");
7a8288f6 1737 return 0;
46004616 1738 }
7a8288f6
DM
1739
1740 return lsm_bpf_unit_restrict_filesystems(u, c->restrict_filesystems, c->restrict_filesystems_allow_list);
1741}
1742#endif
1743
daf8f72b 1744static int apply_protect_hostname(const Unit *u, const ExecContext *c, int *ret_exit_status) {
daf8f72b
LP
1745 assert(u);
1746 assert(c);
1747
1748 if (!c->protect_hostname)
1749 return 0;
1750
1751 if (ns_type_supported(NAMESPACE_UTS)) {
1752 if (unshare(CLONE_NEWUTS) < 0) {
1753 if (!ERRNO_IS_NOT_SUPPORTED(errno) && !ERRNO_IS_PRIVILEGE(errno)) {
1754 *ret_exit_status = EXIT_NAMESPACE;
1755 return log_unit_error_errno(u, errno, "Failed to set up UTS namespacing: %m");
1756 }
1757
1758 log_unit_warning(u, "ProtectHostname=yes is configured, but UTS namespace setup is prohibited (container manager?), ignoring namespace setup.");
1759 }
1760 } else
1761 log_unit_warning(u, "ProtectHostname=yes is configured, but the kernel does not support UTS namespaces, ignoring namespace setup.");
1762
1763#if HAVE_SECCOMP
8f3e342f
ZJS
1764 int r;
1765
daf8f72b
LP
1766 if (skip_seccomp_unavailable(u, "ProtectHostname="))
1767 return 0;
1768
1769 r = seccomp_protect_hostname();
1770 if (r < 0) {
1771 *ret_exit_status = EXIT_SECCOMP;
1772 return log_unit_error_errno(u, r, "Failed to apply hostname restrictions: %m");
1773 }
1774#endif
1775
1776 return 0;
1777}
1778
3042bbeb 1779static void do_idle_pipe_dance(int idle_pipe[static 4]) {
31a7eb86
ZJS
1780 assert(idle_pipe);
1781
54eb2300
LP
1782 idle_pipe[1] = safe_close(idle_pipe[1]);
1783 idle_pipe[2] = safe_close(idle_pipe[2]);
31a7eb86
ZJS
1784
1785 if (idle_pipe[0] >= 0) {
1786 int r;
1787
1788 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1789
1790 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
c7cc737f
LP
1791 ssize_t n;
1792
31a7eb86 1793 /* Signal systemd that we are bored and want to continue. */
c7cc737f
LP
1794 n = write(idle_pipe[3], "x", 1);
1795 if (n > 0)
cd972d69 1796 /* Wait for systemd to react to the signal above. */
54756dce 1797 (void) fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
31a7eb86
ZJS
1798 }
1799
54eb2300 1800 idle_pipe[0] = safe_close(idle_pipe[0]);
31a7eb86
ZJS
1801
1802 }
1803
54eb2300 1804 idle_pipe[3] = safe_close(idle_pipe[3]);
31a7eb86
ZJS
1805}
1806
fb2042dd
YW
1807static const char *exec_directory_env_name_to_string(ExecDirectoryType t);
1808
7cae38c4 1809static int build_environment(
34cf6c43 1810 const Unit *u,
9fa95f85 1811 const ExecContext *c,
1e22b5cd 1812 const ExecParameters *p,
da6053d0 1813 size_t n_fds,
7cae38c4
LP
1814 const char *home,
1815 const char *username,
1816 const char *shell,
7bce046b
LP
1817 dev_t journal_stream_dev,
1818 ino_t journal_stream_ino,
7cae38c4
LP
1819 char ***ret) {
1820
1821 _cleanup_strv_free_ char **our_env = NULL;
da6053d0 1822 size_t n_env = 0;
7cae38c4
LP
1823 char *x;
1824
4b58153d 1825 assert(u);
7cae38c4 1826 assert(c);
7c1cb6f1 1827 assert(p);
7cae38c4
LP
1828 assert(ret);
1829
dc4e2940 1830#define N_ENV_VARS 17
8d5bb13d 1831 our_env = new0(char*, N_ENV_VARS + _EXEC_DIRECTORY_TYPE_MAX);
7cae38c4
LP
1832 if (!our_env)
1833 return -ENOMEM;
1834
1835 if (n_fds > 0) {
8dd4c05b
LP
1836 _cleanup_free_ char *joined = NULL;
1837
df0ff127 1838 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid_cached()) < 0)
7cae38c4
LP
1839 return -ENOMEM;
1840 our_env[n_env++] = x;
1841
da6053d0 1842 if (asprintf(&x, "LISTEN_FDS=%zu", n_fds) < 0)
7cae38c4
LP
1843 return -ENOMEM;
1844 our_env[n_env++] = x;
8dd4c05b 1845
1e22b5cd 1846 joined = strv_join(p->fd_names, ":");
8dd4c05b
LP
1847 if (!joined)
1848 return -ENOMEM;
1849
605405c6 1850 x = strjoin("LISTEN_FDNAMES=", joined);
8dd4c05b
LP
1851 if (!x)
1852 return -ENOMEM;
1853 our_env[n_env++] = x;
7cae38c4
LP
1854 }
1855
b08af3b1 1856 if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
df0ff127 1857 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid_cached()) < 0)
09812eb7
LP
1858 return -ENOMEM;
1859 our_env[n_env++] = x;
1860
1e22b5cd 1861 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
09812eb7
LP
1862 return -ENOMEM;
1863 our_env[n_env++] = x;
1864 }
1865
de90700f
LP
1866 /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use blocking
1867 * Varlink calls back to us for look up dynamic users in PID 1. Break the deadlock between D-Bus and
1868 * PID 1 by disabling use of PID1' NSS interface for looking up dynamic users. */
1869 if (p->flags & EXEC_NSS_DYNAMIC_BYPASS) {
1870 x = strdup("SYSTEMD_NSS_DYNAMIC_BYPASS=1");
fd63e712
LP
1871 if (!x)
1872 return -ENOMEM;
1873 our_env[n_env++] = x;
1874 }
1875
7cae38c4 1876 if (home) {
b910cc72 1877 x = strjoin("HOME=", home);
7cae38c4
LP
1878 if (!x)
1879 return -ENOMEM;
7bbead1d 1880
4ff361cc 1881 path_simplify(x + 5);
7cae38c4
LP
1882 our_env[n_env++] = x;
1883 }
1884
1885 if (username) {
b910cc72 1886 x = strjoin("LOGNAME=", username);
7cae38c4
LP
1887 if (!x)
1888 return -ENOMEM;
1889 our_env[n_env++] = x;
1890
b910cc72 1891 x = strjoin("USER=", username);
7cae38c4
LP
1892 if (!x)
1893 return -ENOMEM;
1894 our_env[n_env++] = x;
1895 }
1896
1897 if (shell) {
b910cc72 1898 x = strjoin("SHELL=", shell);
7cae38c4
LP
1899 if (!x)
1900 return -ENOMEM;
7bbead1d 1901
4ff361cc 1902 path_simplify(x + 6);
7cae38c4
LP
1903 our_env[n_env++] = x;
1904 }
1905
4b58153d
LP
1906 if (!sd_id128_is_null(u->invocation_id)) {
1907 if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0)
1908 return -ENOMEM;
1909
1910 our_env[n_env++] = x;
1911 }
1912
6af760f3
LP
1913 if (exec_context_needs_term(c)) {
1914 const char *tty_path, *term = NULL;
1915
1916 tty_path = exec_context_tty_path(c);
1917
e8cf09b2
LP
1918 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try
1919 * to inherit the $TERM set for PID 1. This is useful for containers so that the $TERM the
1920 * container manager passes to PID 1 ends up all the way in the console login shown. */
6af760f3 1921
e8cf09b2 1922 if (path_equal_ptr(tty_path, "/dev/console") && getppid() == 1)
6af760f3 1923 term = getenv("TERM");
e8cf09b2 1924
6af760f3
LP
1925 if (!term)
1926 term = default_term_for_tty(tty_path);
7cae38c4 1927
b910cc72 1928 x = strjoin("TERM=", term);
7cae38c4
LP
1929 if (!x)
1930 return -ENOMEM;
1931 our_env[n_env++] = x;
1932 }
1933
7bce046b
LP
1934 if (journal_stream_dev != 0 && journal_stream_ino != 0) {
1935 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
1936 return -ENOMEM;
1937
1938 our_env[n_env++] = x;
1939 }
1940
91dd5f7c
LP
1941 if (c->log_namespace) {
1942 x = strjoin("LOG_NAMESPACE=", c->log_namespace);
1943 if (!x)
1944 return -ENOMEM;
1945
1946 our_env[n_env++] = x;
1947 }
1948
5b10116e 1949 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
211a3d87 1950 _cleanup_free_ char *joined = NULL;
fb2042dd
YW
1951 const char *n;
1952
1953 if (!p->prefix[t])
1954 continue;
1955
211a3d87 1956 if (c->directories[t].n_items == 0)
fb2042dd
YW
1957 continue;
1958
1959 n = exec_directory_env_name_to_string(t);
1960 if (!n)
1961 continue;
1962
211a3d87
LB
1963 for (size_t i = 0; i < c->directories[t].n_items; i++) {
1964 _cleanup_free_ char *prefixed = NULL;
fb2042dd 1965
211a3d87
LB
1966 prefixed = path_join(p->prefix[t], c->directories[t].items[i].path);
1967 if (!prefixed)
1968 return -ENOMEM;
1969
1970 if (!strextend_with_separator(&joined, ":", prefixed))
1971 return -ENOMEM;
1972 }
fb2042dd
YW
1973
1974 x = strjoin(n, "=", joined);
1975 if (!x)
1976 return -ENOMEM;
1977
1978 our_env[n_env++] = x;
1979 }
1980
bb0c0d6f
LP
1981 if (exec_context_has_credentials(c) && p->prefix[EXEC_DIRECTORY_RUNTIME]) {
1982 x = strjoin("CREDENTIALS_DIRECTORY=", p->prefix[EXEC_DIRECTORY_RUNTIME], "/credentials/", u->id);
1983 if (!x)
1984 return -ENOMEM;
1985
1986 our_env[n_env++] = x;
1987 }
1988
dc4e2940
YW
1989 if (asprintf(&x, "SYSTEMD_EXEC_PID=" PID_FMT, getpid_cached()) < 0)
1990 return -ENOMEM;
1991
1992 our_env[n_env++] = x;
1993
7cae38c4 1994 our_env[n_env++] = NULL;
8d5bb13d
LP
1995 assert(n_env <= N_ENV_VARS + _EXEC_DIRECTORY_TYPE_MAX);
1996#undef N_ENV_VARS
7cae38c4 1997
ae2a15bc 1998 *ret = TAKE_PTR(our_env);
7cae38c4
LP
1999
2000 return 0;
2001}
2002
b4c14404
FB
2003static int build_pass_environment(const ExecContext *c, char ***ret) {
2004 _cleanup_strv_free_ char **pass_env = NULL;
319a4f4b 2005 size_t n_env = 0;
b4c14404
FB
2006
2007 STRV_FOREACH(i, c->pass_environment) {
2008 _cleanup_free_ char *x = NULL;
2009 char *v;
2010
2011 v = getenv(*i);
2012 if (!v)
2013 continue;
605405c6 2014 x = strjoin(*i, "=", v);
b4c14404
FB
2015 if (!x)
2016 return -ENOMEM;
00819cc1 2017
319a4f4b 2018 if (!GREEDY_REALLOC(pass_env, n_env + 2))
b4c14404 2019 return -ENOMEM;
00819cc1 2020
1cc6c93a 2021 pass_env[n_env++] = TAKE_PTR(x);
b4c14404 2022 pass_env[n_env] = NULL;
b4c14404
FB
2023 }
2024
ae2a15bc 2025 *ret = TAKE_PTR(pass_env);
b4c14404
FB
2026
2027 return 0;
2028}
2029
5e8deb94 2030bool exec_needs_mount_namespace(
8b44a3d2
LP
2031 const ExecContext *context,
2032 const ExecParameters *params,
4657abb5 2033 const ExecRuntime *runtime) {
8b44a3d2
LP
2034
2035 assert(context);
8b44a3d2 2036
915e6d16
LP
2037 if (context->root_image)
2038 return true;
2039
2a624c36
AP
2040 if (!strv_isempty(context->read_write_paths) ||
2041 !strv_isempty(context->read_only_paths) ||
ddc155b2
TM
2042 !strv_isempty(context->inaccessible_paths) ||
2043 !strv_isempty(context->exec_paths) ||
2044 !strv_isempty(context->no_exec_paths))
8b44a3d2
LP
2045 return true;
2046
42b1d8e0 2047 if (context->n_bind_mounts > 0)
d2d6c096
LP
2048 return true;
2049
2abd4e38
YW
2050 if (context->n_temporary_filesystems > 0)
2051 return true;
2052
b3d13314
LB
2053 if (context->n_mount_images > 0)
2054 return true;
2055
93f59701
LB
2056 if (context->n_extension_images > 0)
2057 return true;
2058
a07b9926
LB
2059 if (!strv_isempty(context->extension_directories))
2060 return true;
2061
37ed15d7 2062 if (!IN_SET(context->mount_flags, 0, MS_SHARED))
8b44a3d2
LP
2063 return true;
2064
2065 if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
2066 return true;
2067
8b44a3d2 2068 if (context->private_devices ||
228af36f 2069 context->private_mounts ||
8b44a3d2 2070 context->protect_system != PROTECT_SYSTEM_NO ||
59eeb84b
LP
2071 context->protect_home != PROTECT_HOME_NO ||
2072 context->protect_kernel_tunables ||
c575770b 2073 context->protect_kernel_modules ||
94a7b275 2074 context->protect_kernel_logs ||
4e399953
LP
2075 context->protect_control_groups ||
2076 context->protect_proc != PROTECT_PROC_DEFAULT ||
80271a44
XR
2077 context->proc_subset != PROC_SUBSET_ALL ||
2078 context->private_ipc ||
2079 context->ipc_namespace_path)
8b44a3d2
LP
2080 return true;
2081
37c56f89 2082 if (context->root_directory) {
5e98086d 2083 if (exec_context_get_effective_mount_apivfs(context))
37c56f89
YW
2084 return true;
2085
5b10116e 2086 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
5e8deb94 2087 if (params && !params->prefix[t])
37c56f89
YW
2088 continue;
2089
211a3d87 2090 if (context->directories[t].n_items > 0)
37c56f89
YW
2091 return true;
2092 }
2093 }
5d997827 2094
42b1d8e0 2095 if (context->dynamic_user &&
211a3d87
LB
2096 (context->directories[EXEC_DIRECTORY_STATE].n_items > 0 ||
2097 context->directories[EXEC_DIRECTORY_CACHE].n_items > 0 ||
2098 context->directories[EXEC_DIRECTORY_LOGS].n_items > 0))
42b1d8e0
YW
2099 return true;
2100
91dd5f7c
LP
2101 if (context->log_namespace)
2102 return true;
2103
8b44a3d2
LP
2104 return false;
2105}
2106
5749f855 2107static int setup_private_users(uid_t ouid, gid_t ogid, uid_t uid, gid_t gid) {
d251207d
LP
2108 _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
2109 _cleanup_close_pair_ int errno_pipe[2] = { -1, -1 };
2110 _cleanup_close_ int unshare_ready_fd = -1;
2111 _cleanup_(sigkill_waitp) pid_t pid = 0;
2112 uint64_t c = 1;
d251207d
LP
2113 ssize_t n;
2114 int r;
2115
5749f855
AZ
2116 /* Set up a user namespace and map the original UID/GID (IDs from before any user or group changes, i.e.
2117 * the IDs from the user or system manager(s)) to itself, the selected UID/GID to itself, and everything else to
d251207d
LP
2118 * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
2119 * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
2120 * which waits for the parent to create the new user namespace while staying in the original namespace. The
2121 * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
5749f855
AZ
2122 * continues execution normally.
2123 * For unprivileged users (i.e. without capabilities), the root to root mapping is excluded. As such, it
2124 * does not need CAP_SETUID to write the single line mapping to itself. */
d251207d 2125
5749f855
AZ
2126 /* Can only set up multiple mappings with CAP_SETUID. */
2127 if (have_effective_cap(CAP_SETUID) && uid != ouid && uid_is_valid(uid))
587ab01b 2128 r = asprintf(&uid_map,
5749f855 2129 UID_FMT " " UID_FMT " 1\n" /* Map $OUID → $OUID */
587ab01b 2130 UID_FMT " " UID_FMT " 1\n", /* Map $UID → $UID */
5749f855
AZ
2131 ouid, ouid, uid, uid);
2132 else
2133 r = asprintf(&uid_map,
2134 UID_FMT " " UID_FMT " 1\n", /* Map $OUID → $OUID */
2135 ouid, ouid);
d251207d 2136
5749f855
AZ
2137 if (r < 0)
2138 return -ENOMEM;
2139
2140 /* Can only set up multiple mappings with CAP_SETGID. */
2141 if (have_effective_cap(CAP_SETGID) && gid != ogid && gid_is_valid(gid))
587ab01b 2142 r = asprintf(&gid_map,
5749f855 2143 GID_FMT " " GID_FMT " 1\n" /* Map $OGID → $OGID */
587ab01b 2144 GID_FMT " " GID_FMT " 1\n", /* Map $GID → $GID */
5749f855
AZ
2145 ogid, ogid, gid, gid);
2146 else
2147 r = asprintf(&gid_map,
2148 GID_FMT " " GID_FMT " 1\n", /* Map $OGID -> $OGID */
2149 ogid, ogid);
2150
2151 if (r < 0)
2152 return -ENOMEM;
d251207d
LP
2153
2154 /* Create a communication channel so that the parent can tell the child when it finished creating the user
2155 * namespace. */
2156 unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
2157 if (unshare_ready_fd < 0)
2158 return -errno;
2159
2160 /* Create a communication channel so that the child can tell the parent a proper error code in case it
2161 * failed. */
2162 if (pipe2(errno_pipe, O_CLOEXEC) < 0)
2163 return -errno;
2164
4c253ed1
LP
2165 r = safe_fork("(sd-userns)", FORK_RESET_SIGNALS|FORK_DEATHSIG, &pid);
2166 if (r < 0)
2167 return r;
2168 if (r == 0) {
d251207d
LP
2169 _cleanup_close_ int fd = -1;
2170 const char *a;
2171 pid_t ppid;
2172
2173 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
2174 * here, after the parent opened its own user namespace. */
2175
2176 ppid = getppid();
2177 errno_pipe[0] = safe_close(errno_pipe[0]);
2178
2179 /* Wait until the parent unshared the user namespace */
2180 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
2181 r = -errno;
2182 goto child_fail;
2183 }
2184
2185 /* Disable the setgroups() system call in the child user namespace, for good. */
2186 a = procfs_file_alloca(ppid, "setgroups");
2187 fd = open(a, O_WRONLY|O_CLOEXEC);
2188 if (fd < 0) {
2189 if (errno != ENOENT) {
2190 r = -errno;
2191 goto child_fail;
2192 }
2193
2194 /* If the file is missing the kernel is too old, let's continue anyway. */
2195 } else {
2196 if (write(fd, "deny\n", 5) < 0) {
2197 r = -errno;
2198 goto child_fail;
2199 }
2200
2201 fd = safe_close(fd);
2202 }
2203
2204 /* First write the GID map */
2205 a = procfs_file_alloca(ppid, "gid_map");
2206 fd = open(a, O_WRONLY|O_CLOEXEC);
2207 if (fd < 0) {
2208 r = -errno;
2209 goto child_fail;
2210 }
2211 if (write(fd, gid_map, strlen(gid_map)) < 0) {
2212 r = -errno;
2213 goto child_fail;
2214 }
2215 fd = safe_close(fd);
2216
2217 /* The write the UID map */
2218 a = procfs_file_alloca(ppid, "uid_map");
2219 fd = open(a, O_WRONLY|O_CLOEXEC);
2220 if (fd < 0) {
2221 r = -errno;
2222 goto child_fail;
2223 }
2224 if (write(fd, uid_map, strlen(uid_map)) < 0) {
2225 r = -errno;
2226 goto child_fail;
2227 }
2228
2229 _exit(EXIT_SUCCESS);
2230
2231 child_fail:
2232 (void) write(errno_pipe[1], &r, sizeof(r));
2233 _exit(EXIT_FAILURE);
2234 }
2235
2236 errno_pipe[1] = safe_close(errno_pipe[1]);
2237
2238 if (unshare(CLONE_NEWUSER) < 0)
2239 return -errno;
2240
2241 /* Let the child know that the namespace is ready now */
2242 if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
2243 return -errno;
2244
2245 /* Try to read an error code from the child */
2246 n = read(errno_pipe[0], &r, sizeof(r));
2247 if (n < 0)
2248 return -errno;
2249 if (n == sizeof(r)) { /* an error code was sent to us */
2250 if (r < 0)
2251 return r;
2252 return -EIO;
2253 }
2254 if (n != 0) /* on success we should have read 0 bytes */
2255 return -EIO;
2256
8f03de53 2257 r = wait_for_terminate_and_check("(sd-userns)", TAKE_PID(pid), 0);
d251207d
LP
2258 if (r < 0)
2259 return r;
2e87a1fd 2260 if (r != EXIT_SUCCESS) /* If something strange happened with the child, let's consider this fatal, too */
d251207d
LP
2261 return -EIO;
2262
2263 return 0;
2264}
2265
494d0247
YW
2266static bool exec_directory_is_private(const ExecContext *context, ExecDirectoryType type) {
2267 if (!context->dynamic_user)
2268 return false;
2269
2270 if (type == EXEC_DIRECTORY_CONFIGURATION)
2271 return false;
2272
2273 if (type == EXEC_DIRECTORY_RUNTIME && context->runtime_directory_preserve_mode == EXEC_PRESERVE_NO)
2274 return false;
2275
2276 return true;
2277}
2278
211a3d87
LB
2279static int create_many_symlinks(const char *root, const char *source, char **symlinks) {
2280 _cleanup_free_ char *src_abs = NULL;
211a3d87
LB
2281 int r;
2282
2283 assert(source);
2284
2285 src_abs = path_join(root, source);
2286 if (!src_abs)
2287 return -ENOMEM;
2288
2289 STRV_FOREACH(dst, symlinks) {
2290 _cleanup_free_ char *dst_abs = NULL;
2291
2292 dst_abs = path_join(root, *dst);
2293 if (!dst_abs)
2294 return -ENOMEM;
2295
2296 r = mkdir_parents_label(dst_abs, 0755);
2297 if (r < 0)
2298 return r;
2299
2300 r = symlink_idempotent(src_abs, dst_abs, true);
2301 if (r < 0)
2302 return r;
2303 }
2304
2305 return 0;
2306}
2307
3536f49e 2308static int setup_exec_directory(
07689d5d
LP
2309 const ExecContext *context,
2310 const ExecParameters *params,
2311 uid_t uid,
3536f49e 2312 gid_t gid,
3536f49e 2313 ExecDirectoryType type,
211a3d87 2314 bool needs_mount_namespace,
3536f49e 2315 int *exit_status) {
07689d5d 2316
72fd1768 2317 static const int exit_status_table[_EXEC_DIRECTORY_TYPE_MAX] = {
3536f49e
YW
2318 [EXEC_DIRECTORY_RUNTIME] = EXIT_RUNTIME_DIRECTORY,
2319 [EXEC_DIRECTORY_STATE] = EXIT_STATE_DIRECTORY,
2320 [EXEC_DIRECTORY_CACHE] = EXIT_CACHE_DIRECTORY,
2321 [EXEC_DIRECTORY_LOGS] = EXIT_LOGS_DIRECTORY,
2322 [EXEC_DIRECTORY_CONFIGURATION] = EXIT_CONFIGURATION_DIRECTORY,
2323 };
07689d5d
LP
2324 int r;
2325
2326 assert(context);
2327 assert(params);
72fd1768 2328 assert(type >= 0 && type < _EXEC_DIRECTORY_TYPE_MAX);
3536f49e 2329 assert(exit_status);
07689d5d 2330
3536f49e
YW
2331 if (!params->prefix[type])
2332 return 0;
2333
8679efde 2334 if (params->flags & EXEC_CHOWN_DIRECTORIES) {
3536f49e
YW
2335 if (!uid_is_valid(uid))
2336 uid = 0;
2337 if (!gid_is_valid(gid))
2338 gid = 0;
2339 }
2340
211a3d87 2341 for (size_t i = 0; i < context->directories[type].n_items; i++) {
6c47cd7d 2342 _cleanup_free_ char *p = NULL, *pp = NULL;
07689d5d 2343
211a3d87 2344 p = path_join(params->prefix[type], context->directories[type].items[i].path);
3536f49e
YW
2345 if (!p) {
2346 r = -ENOMEM;
2347 goto fail;
2348 }
07689d5d 2349
23a7448e
YW
2350 r = mkdir_parents_label(p, 0755);
2351 if (r < 0)
3536f49e 2352 goto fail;
23a7448e 2353
494d0247 2354 if (exec_directory_is_private(context, type)) {
3f5b1508
LP
2355 /* So, here's one extra complication when dealing with DynamicUser=1 units. In that
2356 * case we want to avoid leaving a directory around fully accessible that is owned by
2357 * a dynamic user whose UID is later on reused. To lock this down we use the same
2358 * trick used by container managers to prohibit host users to get access to files of
2359 * the same UID in containers: we place everything inside a directory that has an
2360 * access mode of 0700 and is owned root:root, so that it acts as security boundary
2361 * for unprivileged host code. We then use fs namespacing to make this directory
2362 * permeable for the service itself.
6c47cd7d 2363 *
3f5b1508
LP
2364 * Specifically: for a service which wants a special directory "foo/" we first create
2365 * a directory "private/" with access mode 0700 owned by root:root. Then we place
2366 * "foo" inside of that directory (i.e. "private/foo/"), and make "foo" a symlink to
2367 * "private/foo". This way, privileged host users can access "foo/" as usual, but
2368 * unprivileged host users can't look into it. Inside of the namespace of the unit
2369 * "private/" is replaced by a more liberally accessible tmpfs, into which the host's
2370 * "private/foo/" is mounted under the same name, thus disabling the access boundary
2371 * for the service and making sure it only gets access to the dirs it needs but no
2372 * others. Tricky? Yes, absolutely, but it works!
6c47cd7d 2373 *
3f5b1508
LP
2374 * Note that we don't do this for EXEC_DIRECTORY_CONFIGURATION as that's assumed not
2375 * to be owned by the service itself.
2376 *
2377 * Also, note that we don't do this for EXEC_DIRECTORY_RUNTIME as that's often used
2378 * for sharing files or sockets with other services. */
6c47cd7d 2379
4ede9802
LP
2380 pp = path_join(params->prefix[type], "private");
2381 if (!pp) {
6c47cd7d
LP
2382 r = -ENOMEM;
2383 goto fail;
2384 }
2385
2386 /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */
4ede9802 2387 r = mkdir_safe_label(pp, 0700, 0, 0, MKDIR_WARN_MODE);
6c47cd7d
LP
2388 if (r < 0)
2389 goto fail;
2390
211a3d87 2391 if (!path_extend(&pp, context->directories[type].items[i].path)) {
6c47cd7d
LP
2392 r = -ENOMEM;
2393 goto fail;
2394 }
2395
2396 /* Create all directories between the configured directory and this private root, and mark them 0755 */
2397 r = mkdir_parents_label(pp, 0755);
2398 if (r < 0)
2399 goto fail;
2400
949befd3
LP
2401 if (is_dir(p, false) > 0 &&
2402 (laccess(pp, F_OK) < 0 && errno == ENOENT)) {
2403
2404 /* Hmm, the private directory doesn't exist yet, but the normal one exists? If so, move
2405 * it over. Most likely the service has been upgraded from one that didn't use
2406 * DynamicUser=1, to one that does. */
2407
cf52c45d
LP
2408 log_info("Found pre-existing public %s= directory %s, migrating to %s.\n"
2409 "Apparently, service previously had DynamicUser= turned off, and has now turned it on.",
2410 exec_directory_type_to_string(type), p, pp);
2411
949befd3
LP
2412 if (rename(p, pp) < 0) {
2413 r = -errno;
2414 goto fail;
2415 }
2416 } else {
2417 /* Otherwise, create the actual directory for the service */
2418
2419 r = mkdir_label(pp, context->directories[type].mode);
2420 if (r < 0 && r != -EEXIST)
2421 goto fail;
2422 }
6c47cd7d 2423
df61e79a
LB
2424 /* And link it up from the original place. Note that if a mount namespace is going to be
2425 * used, then this symlink remains on the host, and a new one for the child namespace will
2426 * be created later. */
6c9c51e5 2427 r = symlink_idempotent(pp, p, true);
6c47cd7d
LP
2428 if (r < 0)
2429 goto fail;
2430
6c47cd7d 2431 } else {
5c6d40d1
LP
2432 _cleanup_free_ char *target = NULL;
2433
2434 if (type != EXEC_DIRECTORY_CONFIGURATION &&
2435 readlink_and_make_absolute(p, &target) >= 0) {
578dc69f 2436 _cleanup_free_ char *q = NULL, *q_resolved = NULL, *target_resolved = NULL;
5c6d40d1
LP
2437
2438 /* This already exists and is a symlink? Interesting. Maybe it's one created
2193f17c
LP
2439 * by DynamicUser=1 (see above)?
2440 *
2441 * We do this for all directory types except for ConfigurationDirectory=,
2442 * since they all support the private/ symlink logic at least in some
2443 * configurations, see above. */
5c6d40d1 2444
578dc69f
YW
2445 r = chase_symlinks(target, NULL, 0, &target_resolved, NULL);
2446 if (r < 0)
2447 goto fail;
2448
211a3d87 2449 q = path_join(params->prefix[type], "private", context->directories[type].items[i].path);
5c6d40d1
LP
2450 if (!q) {
2451 r = -ENOMEM;
2452 goto fail;
2453 }
2454
578dc69f
YW
2455 /* /var/lib or friends may be symlinks. So, let's chase them also. */
2456 r = chase_symlinks(q, NULL, CHASE_NONEXISTENT, &q_resolved, NULL);
2457 if (r < 0)
2458 goto fail;
2459
2460 if (path_equal(q_resolved, target_resolved)) {
5c6d40d1
LP
2461
2462 /* Hmm, apparently DynamicUser= was once turned on for this service,
2463 * but is no longer. Let's move the directory back up. */
2464
cf52c45d
LP
2465 log_info("Found pre-existing private %s= directory %s, migrating to %s.\n"
2466 "Apparently, service previously had DynamicUser= turned on, and has now turned it off.",
2467 exec_directory_type_to_string(type), q, p);
2468
5c6d40d1
LP
2469 if (unlink(p) < 0) {
2470 r = -errno;
2471 goto fail;
2472 }
2473
2474 if (rename(q, p) < 0) {
2475 r = -errno;
2476 goto fail;
2477 }
2478 }
2479 }
2480
6c47cd7d 2481 r = mkdir_label(p, context->directories[type].mode);
d484580c 2482 if (r < 0) {
d484580c
LP
2483 if (r != -EEXIST)
2484 goto fail;
2485
206e9864
LP
2486 if (type == EXEC_DIRECTORY_CONFIGURATION) {
2487 struct stat st;
2488
2489 /* Don't change the owner/access mode of the configuration directory,
2490 * as in the common case it is not written to by a service, and shall
2491 * not be writable. */
2492
2493 if (stat(p, &st) < 0) {
2494 r = -errno;
2495 goto fail;
2496 }
2497
2498 /* Still complain if the access mode doesn't match */
2499 if (((st.st_mode ^ context->directories[type].mode) & 07777) != 0)
2500 log_warning("%s \'%s\' already exists but the mode is different. "
2501 "(File system: %o %sMode: %o)",
211a3d87 2502 exec_directory_type_to_string(type), context->directories[type].items[i].path,
206e9864
LP
2503 st.st_mode & 07777, exec_directory_type_to_string(type), context->directories[type].mode & 07777);
2504
6cff72eb 2505 continue;
206e9864 2506 }
6cff72eb 2507 }
a1164ae3 2508 }
07689d5d 2509
206e9864 2510 /* Lock down the access mode (we use chmod_and_chown() to make this idempotent. We don't
5238e957 2511 * specify UID/GID here, so that path_chown_recursive() can optimize things depending on the
206e9864
LP
2512 * current UID/GID ownership.) */
2513 r = chmod_and_chown(pp ?: p, context->directories[type].mode, UID_INVALID, GID_INVALID);
2514 if (r < 0)
2515 goto fail;
c71b2eb7 2516
607b358e
LP
2517 /* Then, change the ownership of the whole tree, if necessary. When dynamic users are used we
2518 * drop the suid/sgid bits, since we really don't want SUID/SGID files for dynamic UID/GID
7802194a 2519 * assignments to exist. */
607b358e 2520 r = path_chown_recursive(pp ?: p, uid, gid, context->dynamic_user ? 01777 : 07777);
07689d5d 2521 if (r < 0)
3536f49e 2522 goto fail;
07689d5d
LP
2523 }
2524
211a3d87
LB
2525 /* If we are not going to run in a namespace, set up the symlinks - otherwise
2526 * they are set up later, to allow configuring empty var/run/etc. */
2527 if (!needs_mount_namespace)
2528 for (size_t i = 0; i < context->directories[type].n_items; i++) {
2529 r = create_many_symlinks(params->prefix[type],
2530 context->directories[type].items[i].path,
2531 context->directories[type].items[i].symlinks);
2532 if (r < 0)
2533 goto fail;
2534 }
2535
07689d5d 2536 return 0;
3536f49e
YW
2537
2538fail:
2539 *exit_status = exit_status_table[type];
3536f49e 2540 return r;
07689d5d
LP
2541}
2542
bb0c0d6f
LP
2543static int write_credential(
2544 int dfd,
2545 const char *id,
2546 const void *data,
2547 size_t size,
2548 uid_t uid,
2549 bool ownership_ok) {
2550
2551 _cleanup_(unlink_and_freep) char *tmp = NULL;
2552 _cleanup_close_ int fd = -1;
2553 int r;
2554
2555 r = tempfn_random_child("", "cred", &tmp);
2556 if (r < 0)
2557 return r;
2558
2559 fd = openat(dfd, tmp, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL|O_NOFOLLOW|O_NOCTTY, 0600);
2560 if (fd < 0) {
2561 tmp = mfree(tmp);
2562 return -errno;
2563 }
2564
43144be4 2565 r = loop_write(fd, data, size, /* do_poll = */ false);
bb0c0d6f
LP
2566 if (r < 0)
2567 return r;
2568
2569 if (fchmod(fd, 0400) < 0) /* Take away "w" bit */
2570 return -errno;
2571
2572 if (uid_is_valid(uid) && uid != getuid()) {
567aeb58 2573 r = fd_add_uid_acl_permission(fd, uid, ACL_READ);
bb0c0d6f
LP
2574 if (r < 0) {
2575 if (!ERRNO_IS_NOT_SUPPORTED(r) && !ERRNO_IS_PRIVILEGE(r))
2576 return r;
2577
2578 if (!ownership_ok) /* Ideally we use ACLs, since we can neatly express what we want
2579 * to express: that the user gets read access and nothing
2580 * else. But if the backing fs can't support that (e.g. ramfs)
2581 * then we can use file ownership instead. But that's only safe if
2582 * we can then re-mount the whole thing read-only, so that the
2583 * user can no longer chmod() the file to gain write access. */
2584 return r;
2585
f5fbe71d 2586 if (fchown(fd, uid, GID_INVALID) < 0)
bb0c0d6f
LP
2587 return -errno;
2588 }
2589 }
2590
2591 if (renameat(dfd, tmp, dfd, id) < 0)
2592 return -errno;
2593
2594 tmp = mfree(tmp);
2595 return 0;
2596}
2597
3989bdc1
AB
2598static int load_credential(
2599 const ExecContext *context,
2600 const ExecParameters *params,
10b44e1d
LP
2601 const char *id,
2602 const char *path,
2603 bool encrypted,
3989bdc1
AB
2604 const char *unit,
2605 int read_dfd,
2606 int write_dfd,
2607 uid_t uid,
2608 bool ownership_ok,
2609 uint64_t *left) {
2610
3989bdc1
AB
2611 ReadFullFileFlags flags = READ_FULL_FILE_SECURE|READ_FULL_FILE_FAIL_WHEN_LARGER;
2612 _cleanup_(erase_and_freep) char *data = NULL;
2613 _cleanup_free_ char *j = NULL, *bindname = NULL;
2614 bool missing_ok = true;
2615 const char *source;
2616 size_t size, add;
2617 int r;
2618
10b44e1d
LP
2619 assert(context);
2620 assert(params);
2621 assert(id);
2622 assert(path);
2623 assert(unit);
2624 assert(write_dfd >= 0);
2625 assert(left);
2626
2627 if (path_is_absolute(path) || read_dfd >= 0) {
3989bdc1 2628 /* If this is an absolute path, read the data directly from it, and support AF_UNIX sockets */
10b44e1d 2629 source = path;
3989bdc1
AB
2630 flags |= READ_FULL_FILE_CONNECT_SOCKET;
2631
2632 /* Pass some minimal info about the unit and the credential name we are looking to acquire
2633 * via the source socket address in case we read off an AF_UNIX socket. */
10b44e1d 2634 if (asprintf(&bindname, "@%" PRIx64"/unit/%s/%s", random_u64(), unit, id) < 0)
3989bdc1
AB
2635 return -ENOMEM;
2636
2637 missing_ok = false;
2638
2639 } else if (params->received_credentials) {
2640 /* If this is a relative path, take it relative to the credentials we received
2641 * ourselves. We don't support the AF_UNIX stuff in this mode, since we are operating
2642 * on a credential store, i.e. this is guaranteed to be regular files. */
10b44e1d 2643 j = path_join(params->received_credentials, path);
3989bdc1
AB
2644 if (!j)
2645 return -ENOMEM;
2646
2647 source = j;
2648 } else
2649 source = NULL;
2650
2651 if (source)
2652 r = read_full_file_full(
2653 read_dfd, source,
2654 UINT64_MAX,
10b44e1d
LP
2655 encrypted ? CREDENTIAL_ENCRYPTED_SIZE_MAX : CREDENTIAL_SIZE_MAX,
2656 flags | (encrypted ? READ_FULL_FILE_UNBASE64 : 0),
3989bdc1
AB
2657 bindname,
2658 &data, &size);
2659 else
2660 r = -ENOENT;
2661
10b44e1d 2662 if (r == -ENOENT && (missing_ok || hashmap_contains(context->set_credentials, id))) {
3989bdc1
AB
2663 /* Make a missing inherited credential non-fatal, let's just continue. After all apps
2664 * will get clear errors if we don't pass such a missing credential on as they
2665 * themselves will get ENOENT when trying to read them, which should not be much
2666 * worse than when we handle the error here and make it fatal.
2667 *
2668 * Also, if the source file doesn't exist, but a fallback is set via SetCredentials=
2669 * we are fine, too. */
10b44e1d 2670 log_debug_errno(r, "Couldn't read inherited credential '%s', skipping: %m", path);
3989bdc1
AB
2671 return 0;
2672 }
2673 if (r < 0)
10b44e1d 2674 return log_debug_errno(r, "Failed to read credential '%s': %m", path);
3989bdc1 2675
10b44e1d 2676 if (encrypted) {
3989bdc1
AB
2677 _cleanup_free_ void *plaintext = NULL;
2678 size_t plaintext_size = 0;
2679
10b44e1d 2680 r = decrypt_credential_and_warn(id, now(CLOCK_REALTIME), NULL, data, size, &plaintext, &plaintext_size);
3989bdc1
AB
2681 if (r < 0)
2682 return r;
2683
2684 free_and_replace(data, plaintext);
2685 size = plaintext_size;
2686 }
2687
10b44e1d 2688 add = strlen(id) + size;
3989bdc1
AB
2689 if (add > *left)
2690 return -E2BIG;
2691
10b44e1d 2692 r = write_credential(write_dfd, id, data, size, uid, ownership_ok);
3989bdc1
AB
2693 if (r < 0)
2694 return r;
2695
2696 *left -= add;
2697 return 0;
2698}
2699
2700struct load_cred_args {
3989bdc1
AB
2701 const ExecContext *context;
2702 const ExecParameters *params;
461345a1 2703 bool encrypted;
3989bdc1
AB
2704 const char *unit;
2705 int dfd;
2706 uid_t uid;
2707 bool ownership_ok;
2708 uint64_t *left;
2709};
2710
2711static int load_cred_recurse_dir_cb(
2712 RecurseDirEvent event,
2713 const char *path,
2714 int dir_fd,
2715 int inode_fd,
2716 const struct dirent *de,
2717 const struct statx *sx,
2718 void *userdata) {
2719
6394e5cd 2720 struct load_cred_args *args = ASSERT_PTR(userdata);
11348386 2721 _cleanup_free_ char *sub_id = NULL;
3989bdc1
AB
2722 int r;
2723
2724 if (event != RECURSE_DIR_ENTRY)
2725 return RECURSE_DIR_CONTINUE;
2726
2727 if (!IN_SET(de->d_type, DT_REG, DT_SOCK))
2728 return RECURSE_DIR_CONTINUE;
2729
11348386 2730 sub_id = strreplace(path, "/", "_");
3989bdc1
AB
2731 if (!sub_id)
2732 return -ENOMEM;
2733
2734 if (!credential_name_valid(sub_id))
1451435c 2735 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Credential would get ID %s, which is not valid, refusing", sub_id);
3989bdc1 2736
5bec447a 2737 if (faccessat(args->dfd, sub_id, F_OK, AT_SYMLINK_NOFOLLOW) >= 0) {
3989bdc1
AB
2738 log_debug("Skipping credential with duplicated ID %s at %s", sub_id, path);
2739 return RECURSE_DIR_CONTINUE;
2740 }
5bec447a
LP
2741 if (errno != ENOENT)
2742 return log_debug_errno(errno, "Failed to test if credential %s exists: %m", sub_id);
3989bdc1 2743
10b44e1d
LP
2744 r = load_credential(
2745 args->context,
2746 args->params,
2747 sub_id,
2748 de->d_name,
461345a1 2749 args->encrypted,
10b44e1d
LP
2750 args->unit,
2751 dir_fd,
2752 args->dfd,
2753 args->uid,
2754 args->ownership_ok,
2755 args->left);
3989bdc1
AB
2756 if (r < 0)
2757 return r;
2758
2759 return RECURSE_DIR_CONTINUE;
2760}
2761
bb0c0d6f
LP
2762static int acquire_credentials(
2763 const ExecContext *context,
2764 const ExecParameters *params,
d3dcf4e3 2765 const char *unit,
bb0c0d6f
LP
2766 const char *p,
2767 uid_t uid,
2768 bool ownership_ok) {
2769
43144be4 2770 uint64_t left = CREDENTIALS_TOTAL_SIZE_MAX;
bb0c0d6f 2771 _cleanup_close_ int dfd = -1;
43144be4 2772 ExecLoadCredential *lc;
bb0c0d6f 2773 ExecSetCredential *sc;
bb0c0d6f
LP
2774 int r;
2775
2776 assert(context);
2777 assert(p);
2778
2779 dfd = open(p, O_DIRECTORY|O_CLOEXEC);
2780 if (dfd < 0)
2781 return -errno;
2782
43144be4
LP
2783 /* First, load credentials off disk (or acquire via AF_UNIX socket) */
2784 HASHMAP_FOREACH(lc, context->load_credentials) {
3989bdc1 2785 _cleanup_close_ int sub_fd = -1;
d3dcf4e3 2786
3989bdc1
AB
2787 /* Skip over credentials with unspecified paths. These are received by the
2788 * service manager via the $CREDENTIALS_DIRECTORY environment variable. */
2789 if (!is_path(lc->path) && streq(lc->id, lc->path))
bb0c0d6f 2790 continue;
43144be4 2791
3989bdc1
AB
2792 sub_fd = open(lc->path, O_DIRECTORY|O_CLOEXEC|O_RDONLY);
2793 if (sub_fd < 0 && errno != ENOTDIR)
2794 return -errno;
43144be4 2795
61c5a49e 2796 if (sub_fd < 0)
10b44e1d 2797 /* Regular file */
10b44e1d
LP
2798 r = load_credential(
2799 context,
2800 params,
2801 lc->id,
2802 lc->path,
2803 lc->encrypted,
2804 unit,
2805 -1,
2806 dfd,
2807 uid,
2808 ownership_ok,
2809 &left);
61c5a49e 2810 else
10b44e1d 2811 /* Directory */
3989bdc1
AB
2812 r = recurse_dir(
2813 sub_fd,
11348386 2814 /* path= */ lc->id, /* recurse_dir() will suffix the subdir paths from here to the top-level id */
3989bdc1
AB
2815 /* statx_mask= */ 0,
2816 /* n_depth_max= */ UINT_MAX,
9883cbb2 2817 RECURSE_DIR_SORT|RECURSE_DIR_IGNORE_DOT|RECURSE_DIR_ENSURE_TYPE,
3989bdc1
AB
2818 load_cred_recurse_dir_cb,
2819 &(struct load_cred_args) {
3989bdc1
AB
2820 .context = context,
2821 .params = params,
461345a1 2822 .encrypted = lc->encrypted,
3989bdc1
AB
2823 .unit = unit,
2824 .dfd = dfd,
2825 .uid = uid,
2826 .ownership_ok = ownership_ok,
2827 .left = &left,
2828 });
61c5a49e
LP
2829 if (r < 0)
2830 return r;
bb0c0d6f
LP
2831 }
2832
9e6e9d61
LP
2833 /* Second, we add in literally specified credentials. If the credentials already exist, we'll not add
2834 * them, so that they can act as a "default" if the same credential is specified multiple times. */
43144be4
LP
2835 HASHMAP_FOREACH(sc, context->set_credentials) {
2836 _cleanup_(erase_and_freep) void *plaintext = NULL;
2837 const char *data;
2838 size_t size, add;
2839
9e6e9d61
LP
2840 /* Note that we check ahead of time here instead of relying on O_EXCL|O_CREAT later to return
2841 * EEXIST if the credential already exists. That's because the TPM2-based decryption is kinda
2842 * slow and involved, hence it's nice to be able to skip that if the credential already
2843 * exists anyway. */
43144be4
LP
2844 if (faccessat(dfd, sc->id, F_OK, AT_SYMLINK_NOFOLLOW) >= 0)
2845 continue;
2846 if (errno != ENOENT)
2847 return log_debug_errno(errno, "Failed to test if credential %s exists: %m", sc->id);
2848
2849 if (sc->encrypted) {
2850 r = decrypt_credential_and_warn(sc->id, now(CLOCK_REALTIME), NULL, sc->data, sc->size, &plaintext, &size);
2851 if (r < 0)
2852 return r;
2853
2854 data = plaintext;
2855 } else {
2856 data = sc->data;
2857 size = sc->size;
2858 }
2859
2860 add = strlen(sc->id) + size;
2861 if (add > left)
2862 return -E2BIG;
2863
2864 r = write_credential(dfd, sc->id, data, size, uid, ownership_ok);
2865 if (r < 0)
2866 return r;
2867
43144be4
LP
2868 left -= add;
2869 }
2870
bb0c0d6f
LP
2871 if (fchmod(dfd, 0500) < 0) /* Now take away the "w" bit */
2872 return -errno;
2873
2874 /* After we created all keys with the right perms, also make sure the credential store as a whole is
2875 * accessible */
2876
2877 if (uid_is_valid(uid) && uid != getuid()) {
567aeb58 2878 r = fd_add_uid_acl_permission(dfd, uid, ACL_READ | ACL_EXECUTE);
bb0c0d6f
LP
2879 if (r < 0) {
2880 if (!ERRNO_IS_NOT_SUPPORTED(r) && !ERRNO_IS_PRIVILEGE(r))
2881 return r;
2882
2883 if (!ownership_ok)
2884 return r;
2885
f5fbe71d 2886 if (fchown(dfd, uid, GID_INVALID) < 0)
bb0c0d6f
LP
2887 return -errno;
2888 }
2889 }
2890
2891 return 0;
2892}
2893
2894static int setup_credentials_internal(
2895 const ExecContext *context,
2896 const ExecParameters *params,
d3dcf4e3 2897 const char *unit,
bb0c0d6f
LP
2898 const char *final, /* This is where the credential store shall eventually end up at */
2899 const char *workspace, /* This is where we can prepare it before moving it to the final place */
2900 bool reuse_workspace, /* Whether to reuse any existing workspace mount if it already is a mount */
2901 bool must_mount, /* Whether to require that we mount something, it's not OK to use the plain directory fall back */
2902 uid_t uid) {
2903
2904 int r, workspace_mounted; /* negative if we don't know yet whether we have/can mount something; true
2905 * if we mounted something; false if we definitely can't mount anything */
2906 bool final_mounted;
2907 const char *where;
2908
2909 assert(context);
2910 assert(final);
2911 assert(workspace);
2912
2913 if (reuse_workspace) {
2914 r = path_is_mount_point(workspace, NULL, 0);
2915 if (r < 0)
2916 return r;
2917 if (r > 0)
2918 workspace_mounted = true; /* If this is already a mount, and we are supposed to reuse it, let's keep this in mind */
2919 else
2920 workspace_mounted = -1; /* We need to figure out if we can mount something to the workspace */
2921 } else
2922 workspace_mounted = -1; /* ditto */
2923
2924 r = path_is_mount_point(final, NULL, 0);
2925 if (r < 0)
2926 return r;
2927 if (r > 0) {
2928 /* If the final place already has something mounted, we use that. If the workspace also has
2929 * something mounted we assume it's actually the same mount (but with MS_RDONLY
2930 * different). */
2931 final_mounted = true;
2932
2933 if (workspace_mounted < 0) {
2934 /* If the final place is mounted, but the workspace we isn't, then let's bind mount
2935 * the final version to the workspace, and make it writable, so that we can make
2936 * changes */
2937
21935150
LP
2938 r = mount_nofollow_verbose(LOG_DEBUG, final, workspace, NULL, MS_BIND|MS_REC, NULL);
2939 if (r < 0)
2940 return r;
bb0c0d6f 2941
21935150
LP
2942 r = mount_nofollow_verbose(LOG_DEBUG, NULL, workspace, NULL, MS_BIND|MS_REMOUNT|MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL);
2943 if (r < 0)
2944 return r;
bb0c0d6f
LP
2945
2946 workspace_mounted = true;
2947 }
2948 } else
2949 final_mounted = false;
2950
2951 if (workspace_mounted < 0) {
2952 /* Nothing is mounted on the workspace yet, let's try to mount something now */
2953 for (int try = 0;; try++) {
2954
2955 if (try == 0) {
2956 /* Try "ramfs" first, since it's not swap backed */
21935150
LP
2957 r = mount_nofollow_verbose(LOG_DEBUG, "ramfs", workspace, "ramfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, "mode=0700");
2958 if (r >= 0) {
bb0c0d6f
LP
2959 workspace_mounted = true;
2960 break;
2961 }
2962
2963 } else if (try == 1) {
2964 _cleanup_free_ char *opts = NULL;
2965
43144be4 2966 if (asprintf(&opts, "mode=0700,nr_inodes=1024,size=%zu", (size_t) CREDENTIALS_TOTAL_SIZE_MAX) < 0)
bb0c0d6f
LP
2967 return -ENOMEM;
2968
2969 /* Fall back to "tmpfs" otherwise */
21935150
LP
2970 r = mount_nofollow_verbose(LOG_DEBUG, "tmpfs", workspace, "tmpfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, opts);
2971 if (r >= 0) {
bb0c0d6f
LP
2972 workspace_mounted = true;
2973 break;
2974 }
2975
2976 } else {
2977 /* If that didn't work, try to make a bind mount from the final to the workspace, so that we can make it writable there. */
21935150
LP
2978 r = mount_nofollow_verbose(LOG_DEBUG, final, workspace, NULL, MS_BIND|MS_REC, NULL);
2979 if (r < 0) {
2980 if (!ERRNO_IS_PRIVILEGE(r)) /* Propagate anything that isn't a permission problem */
2981 return r;
bb0c0d6f
LP
2982
2983 if (must_mount) /* If we it's not OK to use the plain directory
2984 * fallback, propagate all errors too */
21935150 2985 return r;
bb0c0d6f
LP
2986
2987 /* If we lack privileges to bind mount stuff, then let's gracefully
2988 * proceed for compat with container envs, and just use the final dir
2989 * as is. */
2990
2991 workspace_mounted = false;
2992 break;
2993 }
2994
2995 /* Make the new bind mount writable (i.e. drop MS_RDONLY) */
21935150
LP
2996 r = mount_nofollow_verbose(LOG_DEBUG, NULL, workspace, NULL, MS_BIND|MS_REMOUNT|MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL);
2997 if (r < 0)
2998 return r;
bb0c0d6f
LP
2999
3000 workspace_mounted = true;
3001 break;
3002 }
3003 }
3004 }
3005
3006 assert(!must_mount || workspace_mounted > 0);
3007 where = workspace_mounted ? workspace : final;
3008
e3a0a862
CG
3009 (void) label_fix_container(where, final, 0);
3010
d3dcf4e3 3011 r = acquire_credentials(context, params, unit, where, uid, workspace_mounted);
bb0c0d6f
LP
3012 if (r < 0)
3013 return r;
3014
3015 if (workspace_mounted) {
3016 /* Make workspace read-only now, so that any bind mount we make from it defaults to read-only too */
21935150
LP
3017 r = mount_nofollow_verbose(LOG_DEBUG, NULL, workspace, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL);
3018 if (r < 0)
3019 return r;
bb0c0d6f
LP
3020
3021 /* And mount it to the final place, read-only */
21935150
LP
3022 if (final_mounted)
3023 r = umount_verbose(LOG_DEBUG, workspace, MNT_DETACH|UMOUNT_NOFOLLOW);
3024 else
3025 r = mount_nofollow_verbose(LOG_DEBUG, workspace, final, NULL, MS_MOVE, NULL);
3026 if (r < 0)
3027 return r;
bb0c0d6f
LP
3028 } else {
3029 _cleanup_free_ char *parent = NULL;
3030
3031 /* If we do not have our own mount put used the plain directory fallback, then we need to
3032 * open access to the top-level credential directory and the per-service directory now */
3033
3034 parent = dirname_malloc(final);
3035 if (!parent)
3036 return -ENOMEM;
3037 if (chmod(parent, 0755) < 0)
3038 return -errno;
3039 }
3040
3041 return 0;
3042}
3043
3044static int setup_credentials(
3045 const ExecContext *context,
3046 const ExecParameters *params,
3047 const char *unit,
3048 uid_t uid) {
3049
3050 _cleanup_free_ char *p = NULL, *q = NULL;
bb0c0d6f
LP
3051 int r;
3052
3053 assert(context);
3054 assert(params);
3055
3056 if (!exec_context_has_credentials(context))
3057 return 0;
3058
3059 if (!params->prefix[EXEC_DIRECTORY_RUNTIME])
3060 return -EINVAL;
3061
3062 /* This where we'll place stuff when we are done; this main credentials directory is world-readable,
3063 * and the subdir we mount over with a read-only file system readable by the service's user */
3064 q = path_join(params->prefix[EXEC_DIRECTORY_RUNTIME], "credentials");
3065 if (!q)
3066 return -ENOMEM;
3067
3068 r = mkdir_label(q, 0755); /* top-level dir: world readable/searchable */
3069 if (r < 0 && r != -EEXIST)
3070 return r;
3071
3072 p = path_join(q, unit);
3073 if (!p)
3074 return -ENOMEM;
3075
3076 r = mkdir_label(p, 0700); /* per-unit dir: private to user */
3077 if (r < 0 && r != -EEXIST)
3078 return r;
3079
3080 r = safe_fork("(sd-mkdcreds)", FORK_DEATHSIG|FORK_WAIT|FORK_NEW_MOUNTNS, NULL);
3081 if (r < 0) {
3082 _cleanup_free_ char *t = NULL, *u = NULL;
3083
3084 /* If this is not a privilege or support issue then propagate the error */
3085 if (!ERRNO_IS_NOT_SUPPORTED(r) && !ERRNO_IS_PRIVILEGE(r))
3086 return r;
3087
3088 /* Temporary workspace, that remains inaccessible all the time. We prepare stuff there before moving
3089 * it into place, so that users can't access half-initialized credential stores. */
3090 t = path_join(params->prefix[EXEC_DIRECTORY_RUNTIME], "systemd/temporary-credentials");
3091 if (!t)
3092 return -ENOMEM;
3093
3094 /* We can't set up a mount namespace. In that case operate on a fixed, inaccessible per-unit
3095 * directory outside of /run/credentials/ first, and then move it over to /run/credentials/
3096 * after it is fully set up */
3097 u = path_join(t, unit);
3098 if (!u)
3099 return -ENOMEM;
3100
3101 FOREACH_STRING(i, t, u) {
3102 r = mkdir_label(i, 0700);
3103 if (r < 0 && r != -EEXIST)
3104 return r;
3105 }
3106
3107 r = setup_credentials_internal(
3108 context,
3109 params,
d3dcf4e3 3110 unit,
bb0c0d6f
LP
3111 p, /* final mount point */
3112 u, /* temporary workspace to overmount */
3113 true, /* reuse the workspace if it is already a mount */
3114 false, /* it's OK to fall back to a plain directory if we can't mount anything */
3115 uid);
3116
3117 (void) rmdir(u); /* remove the workspace again if we can. */
3118
3119 if (r < 0)
3120 return r;
3121
3122 } else if (r == 0) {
3123
3124 /* We managed to set up a mount namespace, and are now in a child. That's great. In this case
3125 * we can use the same directory for all cases, after turning off propagation. Question
3126 * though is: where do we turn off propagation exactly, and where do we place the workspace
3127 * directory? We need some place that is guaranteed to be a mount point in the host, and
3128 * which is guaranteed to have a subdir we can mount over. /run/ is not suitable for this,
3129 * since we ultimately want to move the resulting file system there, i.e. we need propagation
3130 * for /run/ eventually. We could use our own /run/systemd/bind mount on itself, but that
3131 * would be visible in the host mount table all the time, which we want to avoid. Hence, what
3132 * we do here instead we use /dev/ and /dev/shm/ for our purposes. We know for sure that
3133 * /dev/ is a mount point and we now for sure that /dev/shm/ exists. Hence we can turn off
3134 * propagation on the former, and then overmount the latter.
3135 *
3136 * Yes it's nasty playing games with /dev/ and /dev/shm/ like this, since it does not exist
3137 * for this purpose, but there are few other candidates that work equally well for us, and
3138 * given that the we do this in a privately namespaced short-lived single-threaded process
7802194a 3139 * that no one else sees this should be OK to do. */
bb0c0d6f 3140
21935150
LP
3141 r = mount_nofollow_verbose(LOG_DEBUG, NULL, "/dev", NULL, MS_SLAVE|MS_REC, NULL); /* Turn off propagation from our namespace to host */
3142 if (r < 0)
bb0c0d6f
LP
3143 goto child_fail;
3144
3145 r = setup_credentials_internal(
3146 context,
3147 params,
d3dcf4e3 3148 unit,
bb0c0d6f
LP
3149 p, /* final mount point */
3150 "/dev/shm", /* temporary workspace to overmount */
3151 false, /* do not reuse /dev/shm if it is already a mount, under no circumstances */
3152 true, /* insist that something is mounted, do not allow fallback to plain directory */
3153 uid);
3154 if (r < 0)
3155 goto child_fail;
3156
3157 _exit(EXIT_SUCCESS);
3158
3159 child_fail:
3160 _exit(EXIT_FAILURE);
3161 }
3162
3163 return 0;
3164}
3165
92b423b9 3166#if ENABLE_SMACK
cefc33ae
LP
3167static int setup_smack(
3168 const ExecContext *context,
b83d5050 3169 int executable_fd) {
cefc33ae
LP
3170 int r;
3171
3172 assert(context);
b83d5050 3173 assert(executable_fd >= 0);
cefc33ae 3174
cefc33ae
LP
3175 if (context->smack_process_label) {
3176 r = mac_smack_apply_pid(0, context->smack_process_label);
3177 if (r < 0)
3178 return r;
3179 }
3180#ifdef SMACK_DEFAULT_PROCESS_LABEL
3181 else {
3182 _cleanup_free_ char *exec_label = NULL;
3183
b83d5050 3184 r = mac_smack_read_fd(executable_fd, SMACK_ATTR_EXEC, &exec_label);
4c701096 3185 if (r < 0 && !IN_SET(r, -ENODATA, -EOPNOTSUPP))
cefc33ae
LP
3186 return r;
3187
3188 r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
3189 if (r < 0)
3190 return r;
3191 }
cefc33ae
LP
3192#endif
3193
3194 return 0;
3195}
92b423b9 3196#endif
cefc33ae 3197
6c47cd7d
LP
3198static int compile_bind_mounts(
3199 const ExecContext *context,
3200 const ExecParameters *params,
3201 BindMount **ret_bind_mounts,
da6053d0 3202 size_t *ret_n_bind_mounts,
6c47cd7d
LP
3203 char ***ret_empty_directories) {
3204
3205 _cleanup_strv_free_ char **empty_directories = NULL;
3206 BindMount *bind_mounts;
5b10116e 3207 size_t n, h = 0;
6c47cd7d
LP
3208 int r;
3209
3210 assert(context);
3211 assert(params);
3212 assert(ret_bind_mounts);
3213 assert(ret_n_bind_mounts);
3214 assert(ret_empty_directories);
3215
3216 n = context->n_bind_mounts;
5b10116e 3217 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
6c47cd7d
LP
3218 if (!params->prefix[t])
3219 continue;
3220
211a3d87 3221 n += context->directories[t].n_items;
6c47cd7d
LP
3222 }
3223
3224 if (n <= 0) {
3225 *ret_bind_mounts = NULL;
3226 *ret_n_bind_mounts = 0;
3227 *ret_empty_directories = NULL;
3228 return 0;
3229 }
3230
3231 bind_mounts = new(BindMount, n);
3232 if (!bind_mounts)
3233 return -ENOMEM;
3234
5b10116e 3235 for (size_t i = 0; i < context->n_bind_mounts; i++) {
6c47cd7d
LP
3236 BindMount *item = context->bind_mounts + i;
3237 char *s, *d;
3238
3239 s = strdup(item->source);
3240 if (!s) {
3241 r = -ENOMEM;
3242 goto finish;
3243 }
3244
3245 d = strdup(item->destination);
3246 if (!d) {
3247 free(s);
3248 r = -ENOMEM;
3249 goto finish;
3250 }
3251
3252 bind_mounts[h++] = (BindMount) {
3253 .source = s,
3254 .destination = d,
3255 .read_only = item->read_only,
3256 .recursive = item->recursive,
3257 .ignore_enoent = item->ignore_enoent,
3258 };
3259 }
3260
5b10116e 3261 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
6c47cd7d
LP
3262 if (!params->prefix[t])
3263 continue;
3264
211a3d87 3265 if (context->directories[t].n_items == 0)
6c47cd7d
LP
3266 continue;
3267
494d0247 3268 if (exec_directory_is_private(context, t) &&
74e12520 3269 !exec_context_with_rootfs(context)) {
6c47cd7d
LP
3270 char *private_root;
3271
3272 /* So this is for a dynamic user, and we need to make sure the process can access its own
3273 * directory. For that we overmount the usually inaccessible "private" subdirectory with a
3274 * tmpfs that makes it accessible and is empty except for the submounts we do this for. */
3275
657ee2d8 3276 private_root = path_join(params->prefix[t], "private");
6c47cd7d
LP
3277 if (!private_root) {
3278 r = -ENOMEM;
3279 goto finish;
3280 }
3281
3282 r = strv_consume(&empty_directories, private_root);
a635a7ae 3283 if (r < 0)
6c47cd7d 3284 goto finish;
6c47cd7d
LP
3285 }
3286
211a3d87 3287 for (size_t i = 0; i < context->directories[t].n_items; i++) {
6c47cd7d
LP
3288 char *s, *d;
3289
494d0247 3290 if (exec_directory_is_private(context, t))
211a3d87 3291 s = path_join(params->prefix[t], "private", context->directories[t].items[i].path);
6c47cd7d 3292 else
211a3d87 3293 s = path_join(params->prefix[t], context->directories[t].items[i].path);
6c47cd7d
LP
3294 if (!s) {
3295 r = -ENOMEM;
3296 goto finish;
3297 }
3298
494d0247 3299 if (exec_directory_is_private(context, t) &&
74e12520 3300 exec_context_with_rootfs(context))
5609f688
YW
3301 /* When RootDirectory= or RootImage= are set, then the symbolic link to the private
3302 * directory is not created on the root directory. So, let's bind-mount the directory
3303 * on the 'non-private' place. */
211a3d87 3304 d = path_join(params->prefix[t], context->directories[t].items[i].path);
5609f688
YW
3305 else
3306 d = strdup(s);
6c47cd7d
LP
3307 if (!d) {
3308 free(s);
3309 r = -ENOMEM;
3310 goto finish;
3311 }
3312
3313 bind_mounts[h++] = (BindMount) {
3314 .source = s,
3315 .destination = d,
3316 .read_only = false,
9ce4e4b0 3317 .nosuid = context->dynamic_user, /* don't allow suid/sgid when DynamicUser= is on */
6c47cd7d
LP
3318 .recursive = true,
3319 .ignore_enoent = false,
3320 };
3321 }
3322 }
3323
3324 assert(h == n);
3325
3326 *ret_bind_mounts = bind_mounts;
3327 *ret_n_bind_mounts = n;
ae2a15bc 3328 *ret_empty_directories = TAKE_PTR(empty_directories);
6c47cd7d
LP
3329
3330 return (int) n;
3331
3332finish:
3333 bind_mount_free_many(bind_mounts, h);
3334 return r;
3335}
3336
df61e79a
LB
3337/* ret_symlinks will contain a list of pairs src:dest that describes
3338 * the symlinks to create later on. For example, the symlinks needed
3339 * to safely give private directories to DynamicUser=1 users. */
3340static int compile_symlinks(
3341 const ExecContext *context,
3342 const ExecParameters *params,
3343 char ***ret_symlinks) {
3344
3345 _cleanup_strv_free_ char **symlinks = NULL;
3346 int r;
3347
3348 assert(context);
3349 assert(params);
3350 assert(ret_symlinks);
3351
3352 for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
211a3d87
LB
3353 for (size_t i = 0; i < context->directories[dt].n_items; i++) {
3354 _cleanup_free_ char *private_path = NULL, *path = NULL;
df61e79a 3355
211a3d87
LB
3356 STRV_FOREACH(symlink, context->directories[dt].items[i].symlinks) {
3357 _cleanup_free_ char *src_abs = NULL, *dst_abs = NULL;
df61e79a 3358
211a3d87
LB
3359 src_abs = path_join(params->prefix[dt], context->directories[dt].items[i].path);
3360 dst_abs = path_join(params->prefix[dt], *symlink);
3361 if (!src_abs || !dst_abs)
3362 return -ENOMEM;
df61e79a 3363
211a3d87
LB
3364 r = strv_consume_pair(&symlinks, TAKE_PTR(src_abs), TAKE_PTR(dst_abs));
3365 if (r < 0)
3366 return r;
3367 }
3368
3fa80e5e 3369 if (!exec_directory_is_private(context, dt) || exec_context_with_rootfs(context))
211a3d87
LB
3370 continue;
3371
3372 private_path = path_join(params->prefix[dt], "private", context->directories[dt].items[i].path);
df61e79a
LB
3373 if (!private_path)
3374 return -ENOMEM;
3375
211a3d87 3376 path = path_join(params->prefix[dt], context->directories[dt].items[i].path);
df61e79a
LB
3377 if (!path)
3378 return -ENOMEM;
3379
3380 r = strv_consume_pair(&symlinks, TAKE_PTR(private_path), TAKE_PTR(path));
3381 if (r < 0)
3382 return r;
3383 }
3384 }
3385
3386 *ret_symlinks = TAKE_PTR(symlinks);
3387
3388 return 0;
3389}
3390
4e677599
LP
3391static bool insist_on_sandboxing(
3392 const ExecContext *context,
3393 const char *root_dir,
3394 const char *root_image,
3395 const BindMount *bind_mounts,
3396 size_t n_bind_mounts) {
3397
4e677599
LP
3398 assert(context);
3399 assert(n_bind_mounts == 0 || bind_mounts);
3400
3401 /* Checks whether we need to insist on fs namespacing. i.e. whether we have settings configured that
86b52a39 3402 * would alter the view on the file system beyond making things read-only or invisible, i.e. would
4e677599
LP
3403 * rearrange stuff in a way we cannot ignore gracefully. */
3404
3405 if (context->n_temporary_filesystems > 0)
3406 return true;
3407
3408 if (root_dir || root_image)
3409 return true;
3410
b3d13314
LB
3411 if (context->n_mount_images > 0)
3412 return true;
3413
4e677599
LP
3414 if (context->dynamic_user)
3415 return true;
3416
4355c04f
LB
3417 if (context->n_extension_images > 0 || !strv_isempty(context->extension_directories))
3418 return true;
3419
4e677599
LP
3420 /* If there are any bind mounts set that don't map back onto themselves, fs namespacing becomes
3421 * essential. */
5b10116e 3422 for (size_t i = 0; i < n_bind_mounts; i++)
4e677599
LP
3423 if (!path_equal(bind_mounts[i].source, bind_mounts[i].destination))
3424 return true;
3425
91dd5f7c
LP
3426 if (context->log_namespace)
3427 return true;
3428
4e677599
LP
3429 return false;
3430}
3431
6818c54c 3432static int apply_mount_namespace(
34cf6c43 3433 const Unit *u,
9f71ba8d 3434 ExecCommandFlags command_flags,
6818c54c
LP
3435 const ExecContext *context,
3436 const ExecParameters *params,
7cc5ef5f
ZJS
3437 const ExecRuntime *runtime,
3438 char **error_path) {
6818c54c 3439
df61e79a 3440 _cleanup_strv_free_ char **empty_directories = NULL, **symlinks = NULL;
56a13a49 3441 const char *tmp_dir = NULL, *var_tmp_dir = NULL;
915e6d16 3442 const char *root_dir = NULL, *root_image = NULL;
24759d8f
LB
3443 _cleanup_free_ char *creds_path = NULL, *incoming_dir = NULL, *propagate_dir = NULL,
3444 *extension_dir = NULL;
228af36f 3445 NamespaceInfo ns_info;
165a31c0 3446 bool needs_sandboxing;
6c47cd7d 3447 BindMount *bind_mounts = NULL;
da6053d0 3448 size_t n_bind_mounts = 0;
6818c54c 3449 int r;
93c6bb51 3450
2b3c1b9e
DH
3451 assert(context);
3452
915e6d16
LP
3453 if (params->flags & EXEC_APPLY_CHROOT) {
3454 root_image = context->root_image;
3455
3456 if (!root_image)
3457 root_dir = context->root_directory;
3458 }
93c6bb51 3459
6c47cd7d
LP
3460 r = compile_bind_mounts(context, params, &bind_mounts, &n_bind_mounts, &empty_directories);
3461 if (r < 0)
3462 return r;
3463
211a3d87 3464 /* Symlinks for exec dirs are set up after other mounts, before they are made read-only. */
df61e79a
LB
3465 r = compile_symlinks(context, params, &symlinks);
3466 if (r < 0)
3467 return r;
3468
9f71ba8d 3469 needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command_flags & EXEC_COMMAND_FULLY_PRIVILEGED);
ecf63c91
NJ
3470 if (needs_sandboxing) {
3471 /* The runtime struct only contains the parent of the private /tmp,
3472 * which is non-accessible to world users. Inside of it there's a /tmp
56a13a49
ZJS
3473 * that is sticky, and that's the one we want to use here.
3474 * This does not apply when we are using /run/systemd/empty as fallback. */
ecf63c91
NJ
3475
3476 if (context->private_tmp && runtime) {
56a13a49
ZJS
3477 if (streq_ptr(runtime->tmp_dir, RUN_SYSTEMD_EMPTY))
3478 tmp_dir = runtime->tmp_dir;
3479 else if (runtime->tmp_dir)
3480 tmp_dir = strjoina(runtime->tmp_dir, "/tmp");
3481
3482 if (streq_ptr(runtime->var_tmp_dir, RUN_SYSTEMD_EMPTY))
3483 var_tmp_dir = runtime->var_tmp_dir;
f63ef937 3484 else if (runtime->var_tmp_dir)
56a13a49 3485 var_tmp_dir = strjoina(runtime->var_tmp_dir, "/tmp");
ecf63c91
NJ
3486 }
3487
b5a33299
YW
3488 ns_info = (NamespaceInfo) {
3489 .ignore_protect_paths = false,
3490 .private_dev = context->private_devices,
3491 .protect_control_groups = context->protect_control_groups,
3492 .protect_kernel_tunables = context->protect_kernel_tunables,
3493 .protect_kernel_modules = context->protect_kernel_modules,
94a7b275 3494 .protect_kernel_logs = context->protect_kernel_logs,
aecd5ac6 3495 .protect_hostname = context->protect_hostname,
5e98086d 3496 .mount_apivfs = exec_context_get_effective_mount_apivfs(context),
228af36f 3497 .private_mounts = context->private_mounts,
52b3d652
LP
3498 .protect_home = context->protect_home,
3499 .protect_system = context->protect_system,
4e399953
LP
3500 .protect_proc = context->protect_proc,
3501 .proc_subset = context->proc_subset,
80271a44 3502 .private_ipc = context->private_ipc || context->ipc_namespace_path,
6720e356 3503 /* If NNP is on, we can turn on MS_NOSUID, since it won't have any effect anymore. */
5181630f 3504 .mount_nosuid = context->no_new_privileges && !mac_selinux_use(),
b5a33299 3505 };
ecf63c91 3506 } else if (!context->dynamic_user && root_dir)
228af36f
LP
3507 /*
3508 * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed
3509 * sandbox info, otherwise enforce it, don't ignore protected paths and
3510 * fail if we are enable to apply the sandbox inside the mount namespace.
3511 */
3512 ns_info = (NamespaceInfo) {
3513 .ignore_protect_paths = true,
3514 };
3515 else
3516 ns_info = (NamespaceInfo) {};
b5a33299 3517
37ed15d7
FB
3518 if (context->mount_flags == MS_SHARED)
3519 log_unit_debug(u, "shared mount propagation hidden by other fs namespacing unit settings: ignoring");
3520
a631cbfa
LP
3521 if (exec_context_has_credentials(context) &&
3522 params->prefix[EXEC_DIRECTORY_RUNTIME] &&
3523 FLAGS_SET(params->flags, EXEC_WRITE_CREDENTIALS)) {
bbb4e7f3 3524 creds_path = path_join(params->prefix[EXEC_DIRECTORY_RUNTIME], "credentials", u->id);
8062e643
YW
3525 if (!creds_path) {
3526 r = -ENOMEM;
3527 goto finalize;
3528 }
bbb4e7f3
LP
3529 }
3530
5e8deb94
LB
3531 if (MANAGER_IS_SYSTEM(u->manager)) {
3532 propagate_dir = path_join("/run/systemd/propagate/", u->id);
f2550b98
LP
3533 if (!propagate_dir) {
3534 r = -ENOMEM;
3535 goto finalize;
3536 }
3537
5e8deb94 3538 incoming_dir = strdup("/run/systemd/incoming");
f2550b98
LP
3539 if (!incoming_dir) {
3540 r = -ENOMEM;
3541 goto finalize;
3542 }
24759d8f
LB
3543
3544 extension_dir = strdup("/run/systemd/unit-extensions");
3545 if (!extension_dir) {
3546 r = -ENOMEM;
3547 goto finalize;
3548 }
3549 } else
3550 if (asprintf(&extension_dir, "/run/user/" UID_FMT "/systemd/unit-extensions", geteuid()) < 0) {
3551 r = -ENOMEM;
3552 goto finalize;
3553 }
5e8deb94 3554
18d73705 3555 r = setup_namespace(root_dir, root_image, context->root_image_options,
7bcef4ef 3556 &ns_info, context->read_write_paths,
165a31c0
LP
3557 needs_sandboxing ? context->read_only_paths : NULL,
3558 needs_sandboxing ? context->inaccessible_paths : NULL,
ddc155b2
TM
3559 needs_sandboxing ? context->exec_paths : NULL,
3560 needs_sandboxing ? context->no_exec_paths : NULL,
6c47cd7d 3561 empty_directories,
df61e79a 3562 symlinks,
6c47cd7d
LP
3563 bind_mounts,
3564 n_bind_mounts,
2abd4e38
YW
3565 context->temporary_filesystems,
3566 context->n_temporary_filesystems,
b3d13314
LB
3567 context->mount_images,
3568 context->n_mount_images,
56a13a49
ZJS
3569 tmp_dir,
3570 var_tmp_dir,
bbb4e7f3 3571 creds_path,
91dd5f7c 3572 context->log_namespace,
915e6d16 3573 context->mount_flags,
d4d55b0d
LB
3574 context->root_hash, context->root_hash_size, context->root_hash_path,
3575 context->root_hash_sig, context->root_hash_sig_size, context->root_hash_sig_path,
3576 context->root_verity,
93f59701
LB
3577 context->extension_images,
3578 context->n_extension_images,
a07b9926 3579 context->extension_directories,
5e8deb94
LB
3580 propagate_dir,
3581 incoming_dir,
24759d8f 3582 extension_dir,
3bdc25a4 3583 root_dir || root_image ? params->notify_socket : NULL,
7cc5ef5f 3584 error_path);
93c6bb51 3585
1beab8b0 3586 /* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports
5238e957 3587 * that with a special, recognizable error ENOANO. In this case, silently proceed, but only if exclusively
1beab8b0
LP
3588 * sandboxing options were used, i.e. nothing such as RootDirectory= or BindMount= that would result in a
3589 * completely different execution environment. */
aca835ed 3590 if (r == -ENOANO) {
4e677599
LP
3591 if (insist_on_sandboxing(
3592 context,
3593 root_dir, root_image,
3594 bind_mounts,
3595 n_bind_mounts)) {
3596 log_unit_debug(u, "Failed to set up namespace, and refusing to continue since the selected namespacing options alter mount environment non-trivially.\n"
3597 "Bind mounts: %zu, temporary filesystems: %zu, root directory: %s, root image: %s, dynamic user: %s",
3598 n_bind_mounts, context->n_temporary_filesystems, yes_no(root_dir), yes_no(root_image), yes_no(context->dynamic_user));
3599
3600 r = -EOPNOTSUPP;
3601 } else {
aca835ed 3602 log_unit_debug(u, "Failed to set up namespace, assuming containerized execution and ignoring.");
4e677599 3603 r = 0;
aca835ed 3604 }
93c6bb51
DH
3605 }
3606
8062e643 3607finalize:
4e677599 3608 bind_mount_free_many(bind_mounts, n_bind_mounts);
93c6bb51
DH
3609 return r;
3610}
3611
915e6d16
LP
3612static int apply_working_directory(
3613 const ExecContext *context,
3614 const ExecParameters *params,
3615 const char *home,
376fecf6 3616 int *exit_status) {
915e6d16 3617
6732edab 3618 const char *d, *wd;
2b3c1b9e
DH
3619
3620 assert(context);
376fecf6 3621 assert(exit_status);
2b3c1b9e 3622
6732edab
LP
3623 if (context->working_directory_home) {
3624
376fecf6
LP
3625 if (!home) {
3626 *exit_status = EXIT_CHDIR;
6732edab 3627 return -ENXIO;
376fecf6 3628 }
6732edab 3629
2b3c1b9e 3630 wd = home;
6732edab 3631
14eb3285
LP
3632 } else
3633 wd = empty_to_root(context->working_directory);
e7f1e7c6 3634
fa97f630 3635 if (params->flags & EXEC_APPLY_CHROOT)
2b3c1b9e 3636 d = wd;
fa97f630 3637 else
3b0e5bb5 3638 d = prefix_roota(context->root_directory, wd);
e7f1e7c6 3639
376fecf6
LP
3640 if (chdir(d) < 0 && !context->working_directory_missing_ok) {
3641 *exit_status = EXIT_CHDIR;
2b3c1b9e 3642 return -errno;
376fecf6 3643 }
e7f1e7c6
DH
3644
3645 return 0;
3646}
3647
fa97f630
JB
3648static int apply_root_directory(
3649 const ExecContext *context,
3650 const ExecParameters *params,
3651 const bool needs_mount_ns,
3652 int *exit_status) {
3653
3654 assert(context);
3655 assert(exit_status);
3656
5b10116e 3657 if (params->flags & EXEC_APPLY_CHROOT)
fa97f630
JB
3658 if (!needs_mount_ns && context->root_directory)
3659 if (chroot(context->root_directory) < 0) {
3660 *exit_status = EXIT_CHROOT;
3661 return -errno;
3662 }
fa97f630
JB
3663
3664 return 0;
3665}
3666
b1edf445 3667static int setup_keyring(
34cf6c43 3668 const Unit *u,
b1edf445
LP
3669 const ExecContext *context,
3670 const ExecParameters *p,
3671 uid_t uid, gid_t gid) {
3672
74dd6b51 3673 key_serial_t keyring;
e64c2d0b
DJL
3674 int r = 0;
3675 uid_t saved_uid;
3676 gid_t saved_gid;
74dd6b51
LP
3677
3678 assert(u);
b1edf445 3679 assert(context);
74dd6b51
LP
3680 assert(p);
3681
3682 /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that
3683 * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond
3684 * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be
3685 * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in
3686 * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where
3687 * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */
3688
b1edf445
LP
3689 if (context->keyring_mode == EXEC_KEYRING_INHERIT)
3690 return 0;
3691
e64c2d0b
DJL
3692 /* Acquiring a reference to the user keyring is nasty. We briefly change identity in order to get things set up
3693 * properly by the kernel. If we don't do that then we can't create it atomically, and that sucks for parallel
3694 * execution. This mimics what pam_keyinit does, too. Setting up session keyring, to be owned by the right user
3695 * & group is just as nasty as acquiring a reference to the user keyring. */
3696
3697 saved_uid = getuid();
3698 saved_gid = getgid();
3699
3700 if (gid_is_valid(gid) && gid != saved_gid) {
3701 if (setregid(gid, -1) < 0)
3702 return log_unit_error_errno(u, errno, "Failed to change GID for user keyring: %m");
3703 }
3704
3705 if (uid_is_valid(uid) && uid != saved_uid) {
3706 if (setreuid(uid, -1) < 0) {
3707 r = log_unit_error_errno(u, errno, "Failed to change UID for user keyring: %m");
3708 goto out;
3709 }
3710 }
3711
74dd6b51
LP
3712 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
3713 if (keyring == -1) {
3714 if (errno == ENOSYS)
8002fb97 3715 log_unit_debug_errno(u, errno, "Kernel keyring not supported, ignoring.");
065b4774 3716 else if (ERRNO_IS_PRIVILEGE(errno))
8002fb97 3717 log_unit_debug_errno(u, errno, "Kernel keyring access prohibited, ignoring.");
74dd6b51 3718 else if (errno == EDQUOT)
8002fb97 3719 log_unit_debug_errno(u, errno, "Out of kernel keyrings to allocate, ignoring.");
74dd6b51 3720 else
e64c2d0b 3721 r = log_unit_error_errno(u, errno, "Setting up kernel keyring failed: %m");
74dd6b51 3722
e64c2d0b 3723 goto out;
74dd6b51
LP
3724 }
3725
e64c2d0b
DJL
3726 /* When requested link the user keyring into the session keyring. */
3727 if (context->keyring_mode == EXEC_KEYRING_SHARED) {
3728
3729 if (keyctl(KEYCTL_LINK,
3730 KEY_SPEC_USER_KEYRING,
3731 KEY_SPEC_SESSION_KEYRING, 0, 0) < 0) {
3732 r = log_unit_error_errno(u, errno, "Failed to link user keyring into session keyring: %m");
3733 goto out;
3734 }
3735 }
3736
3737 /* Restore uid/gid back */
3738 if (uid_is_valid(uid) && uid != saved_uid) {
3739 if (setreuid(saved_uid, -1) < 0) {
3740 r = log_unit_error_errno(u, errno, "Failed to change UID back for user keyring: %m");
3741 goto out;
3742 }
3743 }
3744
3745 if (gid_is_valid(gid) && gid != saved_gid) {
3746 if (setregid(saved_gid, -1) < 0)
3747 return log_unit_error_errno(u, errno, "Failed to change GID back for user keyring: %m");
3748 }
3749
3750 /* Populate they keyring with the invocation ID by default, as original saved_uid. */
b3415f5d
LP
3751 if (!sd_id128_is_null(u->invocation_id)) {
3752 key_serial_t key;
3753
3754 key = add_key("user", "invocation_id", &u->invocation_id, sizeof(u->invocation_id), KEY_SPEC_SESSION_KEYRING);
3755 if (key == -1)
8002fb97 3756 log_unit_debug_errno(u, errno, "Failed to add invocation ID to keyring, ignoring: %m");
b3415f5d
LP
3757 else {
3758 if (keyctl(KEYCTL_SETPERM, key,
3759 KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH|
3760 KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0)
e64c2d0b 3761 r = log_unit_error_errno(u, errno, "Failed to restrict invocation ID permission: %m");
b3415f5d
LP
3762 }
3763 }
3764
e64c2d0b 3765out:
37b22b3b 3766 /* Revert back uid & gid for the last time, and exit */
e64c2d0b
DJL
3767 /* no extra logging, as only the first already reported error matters */
3768 if (getuid() != saved_uid)
3769 (void) setreuid(saved_uid, -1);
b1edf445 3770
e64c2d0b
DJL
3771 if (getgid() != saved_gid)
3772 (void) setregid(saved_gid, -1);
b1edf445 3773
e64c2d0b 3774 return r;
74dd6b51
LP
3775}
3776
3042bbeb 3777static void append_socket_pair(int *array, size_t *n, const int pair[static 2]) {
29206d46
LP
3778 assert(array);
3779 assert(n);
2caa38e9 3780 assert(pair);
29206d46
LP
3781
3782 if (pair[0] >= 0)
3783 array[(*n)++] = pair[0];
3784 if (pair[1] >= 0)
3785 array[(*n)++] = pair[1];
3786}
3787
a34ceba6
LP
3788static int close_remaining_fds(
3789 const ExecParameters *params,
34cf6c43
YW
3790 const ExecRuntime *runtime,
3791 const DynamicCreds *dcreds,
00d9ef85 3792 int user_lookup_fd,
a34ceba6 3793 int socket_fd,
5b8d1f6b 3794 const int *fds, size_t n_fds) {
a34ceba6 3795
da6053d0 3796 size_t n_dont_close = 0;
00d9ef85 3797 int dont_close[n_fds + 12];
a34ceba6
LP
3798
3799 assert(params);
3800
3801 if (params->stdin_fd >= 0)
3802 dont_close[n_dont_close++] = params->stdin_fd;
3803 if (params->stdout_fd >= 0)
3804 dont_close[n_dont_close++] = params->stdout_fd;
3805 if (params->stderr_fd >= 0)
3806 dont_close[n_dont_close++] = params->stderr_fd;
3807
3808 if (socket_fd >= 0)
3809 dont_close[n_dont_close++] = socket_fd;
3810 if (n_fds > 0) {
3811 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
3812 n_dont_close += n_fds;
3813 }
3814
a70581ff 3815 if (runtime) {
29206d46 3816 append_socket_pair(dont_close, &n_dont_close, runtime->netns_storage_socket);
a70581ff
XR
3817 append_socket_pair(dont_close, &n_dont_close, runtime->ipcns_storage_socket);
3818 }
29206d46
LP
3819
3820 if (dcreds) {
3821 if (dcreds->user)
3822 append_socket_pair(dont_close, &n_dont_close, dcreds->user->storage_socket);
3823 if (dcreds->group)
3824 append_socket_pair(dont_close, &n_dont_close, dcreds->group->storage_socket);
a34ceba6
LP
3825 }
3826
00d9ef85
LP
3827 if (user_lookup_fd >= 0)
3828 dont_close[n_dont_close++] = user_lookup_fd;
3829
a34ceba6
LP
3830 return close_all_fds(dont_close, n_dont_close);
3831}
3832
00d9ef85
LP
3833static int send_user_lookup(
3834 Unit *unit,
3835 int user_lookup_fd,
3836 uid_t uid,
3837 gid_t gid) {
3838
3839 assert(unit);
3840
3841 /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
3842 * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
3843 * specified. */
3844
3845 if (user_lookup_fd < 0)
3846 return 0;
3847
3848 if (!uid_is_valid(uid) && !gid_is_valid(gid))
3849 return 0;
3850
3851 if (writev(user_lookup_fd,
3852 (struct iovec[]) {
e6a7ec4b
LP
3853 IOVEC_INIT(&uid, sizeof(uid)),
3854 IOVEC_INIT(&gid, sizeof(gid)),
3855 IOVEC_INIT_STRING(unit->id) }, 3) < 0)
00d9ef85
LP
3856 return -errno;
3857
3858 return 0;
3859}
3860
6732edab
LP
3861static int acquire_home(const ExecContext *c, uid_t uid, const char** home, char **buf) {
3862 int r;
3863
3864 assert(c);
3865 assert(home);
3866 assert(buf);
3867
3868 /* If WorkingDirectory=~ is set, try to acquire a usable home directory. */
3869
3870 if (*home)
3871 return 0;
3872
3873 if (!c->working_directory_home)
3874 return 0;
3875
6732edab
LP
3876 r = get_home_dir(buf);
3877 if (r < 0)
3878 return r;
3879
3880 *home = *buf;
3881 return 1;
3882}
3883
da50b85a
LP
3884static int compile_suggested_paths(const ExecContext *c, const ExecParameters *p, char ***ret) {
3885 _cleanup_strv_free_ char ** list = NULL;
da50b85a
LP
3886 int r;
3887
3888 assert(c);
3889 assert(p);
3890 assert(ret);
3891
3892 assert(c->dynamic_user);
3893
3894 /* Compile a list of paths that it might make sense to read the owning UID from to use as initial candidate for
3895 * dynamic UID allocation, in order to save us from doing costly recursive chown()s of the special
3896 * directories. */
3897
5b10116e 3898 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
da50b85a
LP
3899 if (t == EXEC_DIRECTORY_CONFIGURATION)
3900 continue;
3901
3902 if (!p->prefix[t])
3903 continue;
3904
211a3d87 3905 for (size_t i = 0; i < c->directories[t].n_items; i++) {
da50b85a
LP
3906 char *e;
3907
494d0247 3908 if (exec_directory_is_private(c, t))
211a3d87 3909 e = path_join(p->prefix[t], "private", c->directories[t].items[i].path);
494d0247 3910 else
211a3d87 3911 e = path_join(p->prefix[t], c->directories[t].items[i].path);
da50b85a
LP
3912 if (!e)
3913 return -ENOMEM;
3914
3915 r = strv_consume(&list, e);
3916 if (r < 0)
3917 return r;
3918 }
3919 }
3920
ae2a15bc 3921 *ret = TAKE_PTR(list);
da50b85a
LP
3922
3923 return 0;
3924}
3925
78f93209
LP
3926static int exec_parameters_get_cgroup_path(const ExecParameters *params, char **ret) {
3927 bool using_subcgroup;
3928 char *p;
3929
3930 assert(params);
3931 assert(ret);
3932
3933 if (!params->cgroup_path)
3934 return -EINVAL;
3935
3936 /* If we are called for a unit where cgroup delegation is on, and the payload created its own populated
3937 * subcgroup (which we expect it to do, after all it asked for delegation), then we cannot place the control
3938 * processes started after the main unit's process in the unit's main cgroup because it is now an inner one,
3939 * and inner cgroups may not contain processes. Hence, if delegation is on, and this is a control process,
3940 * let's use ".control" as subcgroup instead. Note that we do so only for ExecStartPost=, ExecReload=,
3941 * ExecStop=, ExecStopPost=, i.e. for the commands where the main process is already forked. For ExecStartPre=
3942 * this is not necessary, the cgroup is still empty. We distinguish these cases with the EXEC_CONTROL_CGROUP
3943 * flag, which is only passed for the former statements, not for the latter. */
3944
3945 using_subcgroup = FLAGS_SET(params->flags, EXEC_CONTROL_CGROUP|EXEC_CGROUP_DELEGATE|EXEC_IS_CONTROL);
3946 if (using_subcgroup)
657ee2d8 3947 p = path_join(params->cgroup_path, ".control");
78f93209
LP
3948 else
3949 p = strdup(params->cgroup_path);
3950 if (!p)
3951 return -ENOMEM;
3952
3953 *ret = p;
3954 return using_subcgroup;
3955}
3956
e2b2fb7f
MS
3957static int exec_context_cpu_affinity_from_numa(const ExecContext *c, CPUSet *ret) {
3958 _cleanup_(cpu_set_reset) CPUSet s = {};
3959 int r;
3960
3961 assert(c);
3962 assert(ret);
3963
3964 if (!c->numa_policy.nodes.set) {
3965 log_debug("Can't derive CPU affinity mask from NUMA mask because NUMA mask is not set, ignoring");
3966 return 0;
3967 }
3968
3969 r = numa_to_cpu_set(&c->numa_policy, &s);
3970 if (r < 0)
3971 return r;
3972
3973 cpu_set_reset(ret);
3974
3975 return cpu_set_add_all(ret, &s);
3976}
3977
3978bool exec_context_get_cpu_affinity_from_numa(const ExecContext *c) {
3979 assert(c);
3980
3981 return c->cpu_affinity_from_numa;
3982}
3983
1da37e58
ZJS
3984static int add_shifted_fd(int *fds, size_t fds_size, size_t *n_fds, int fd, int *ret_fd) {
3985 int r;
3986
3987 assert(fds);
3988 assert(n_fds);
3989 assert(*n_fds < fds_size);
3990 assert(ret_fd);
3991
3992 if (fd < 0) {
3993 *ret_fd = -1;
3994 return 0;
3995 }
3996
3997 if (fd < 3 + (int) *n_fds) {
3998 /* Let's move the fd up, so that it's outside of the fd range we will use to store
3999 * the fds we pass to the process (or which are closed only during execve). */
4000
4001 r = fcntl(fd, F_DUPFD_CLOEXEC, 3 + (int) *n_fds);
4002 if (r < 0)
4003 return -errno;
4004
4005 CLOSE_AND_REPLACE(fd, r);
4006 }
4007
4008 *ret_fd = fds[*n_fds] = fd;
4009 (*n_fds) ++;
4010 return 1;
4011}
4012
ff0af2a1 4013static int exec_child(
f2341e0a 4014 Unit *unit,
34cf6c43 4015 const ExecCommand *command,
ff0af2a1
LP
4016 const ExecContext *context,
4017 const ExecParameters *params,
4018 ExecRuntime *runtime,
29206d46 4019 DynamicCreds *dcreds,
ff0af2a1 4020 int socket_fd,
2caa38e9 4021 const int named_iofds[static 3],
4c47affc 4022 int *fds,
da6053d0 4023 size_t n_socket_fds,
25b583d7 4024 size_t n_storage_fds,
ff0af2a1 4025 char **files_env,
00d9ef85 4026 int user_lookup_fd,
12145637 4027 int *exit_status) {
d35fbf6b 4028
8c35c10d 4029 _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **joined_exec_search_path = NULL, **accum_env = NULL, **replaced_argv = NULL;
1da37e58 4030 int r, ngids = 0, exec_fd;
4d885bd3
DH
4031 _cleanup_free_ gid_t *supplementary_gids = NULL;
4032 const char *username = NULL, *groupname = NULL;
5686391b 4033 _cleanup_free_ char *home_buffer = NULL;
2b3c1b9e 4034 const char *home = NULL, *shell = NULL;
7ca69792 4035 char **final_argv = NULL;
7bce046b
LP
4036 dev_t journal_stream_dev = 0;
4037 ino_t journal_stream_ino = 0;
5749f855 4038 bool userns_set_up = false;
165a31c0
LP
4039 bool needs_sandboxing, /* Do we need to set up full sandboxing? (i.e. all namespacing, all MAC stuff, caps, yadda yadda */
4040 needs_setuid, /* Do we need to do the actual setresuid()/setresgid() calls? */
4041 needs_mount_namespace, /* Do we need to set up a mount namespace for this kernel? */
4042 needs_ambient_hack; /* Do we need to apply the ambient capabilities hack? */
349cc4a5 4043#if HAVE_SELINUX
7f59dd35 4044 _cleanup_free_ char *mac_selinux_context_net = NULL;
43b1f709 4045 bool use_selinux = false;
ecfbc84f 4046#endif
f9fa32f0 4047#if ENABLE_SMACK
43b1f709 4048 bool use_smack = false;
ecfbc84f 4049#endif
349cc4a5 4050#if HAVE_APPARMOR
43b1f709 4051 bool use_apparmor = false;
ecfbc84f 4052#endif
5749f855
AZ
4053 uid_t saved_uid = getuid();
4054 gid_t saved_gid = getgid();
fed1e721
LP
4055 uid_t uid = UID_INVALID;
4056 gid_t gid = GID_INVALID;
1da37e58
ZJS
4057 size_t n_fds = n_socket_fds + n_storage_fds, /* fds to pass to the child */
4058 n_keep_fds; /* total number of fds not to close */
165a31c0 4059 int secure_bits;
afb11bf1
DG
4060 _cleanup_free_ gid_t *gids_after_pam = NULL;
4061 int ngids_after_pam = 0;
034c6ed7 4062
f2341e0a 4063 assert(unit);
5cb5a6ff
LP
4064 assert(command);
4065 assert(context);
d35fbf6b 4066 assert(params);
ff0af2a1 4067 assert(exit_status);
d35fbf6b 4068
69339ae9
LP
4069 /* Explicitly test for CVE-2021-4034 inspired invocations */
4070 assert(command->path);
4071 assert(!strv_isempty(command->argv));
4072
d35fbf6b
DM
4073 rename_process_from_path(command->path);
4074
9c274488
LP
4075 /* We reset exactly these signals, since they are the only ones we set to SIG_IGN in the main
4076 * daemon. All others we leave untouched because we set them to SIG_DFL or a valid handler initially,
4077 * both of which will be demoted to SIG_DFL. */
ce30c8dc 4078 (void) default_signals(SIGNALS_CRASH_HANDLER,
9c274488 4079 SIGNALS_IGNORE);
d35fbf6b
DM
4080
4081 if (context->ignore_sigpipe)
9c274488 4082 (void) ignore_signals(SIGPIPE);
d35fbf6b 4083
ff0af2a1
LP
4084 r = reset_signal_mask();
4085 if (r < 0) {
4086 *exit_status = EXIT_SIGNAL_MASK;
12145637 4087 return log_unit_error_errno(unit, r, "Failed to set process signal mask: %m");
d35fbf6b 4088 }
034c6ed7 4089
d35fbf6b
DM
4090 if (params->idle_pipe)
4091 do_idle_pipe_dance(params->idle_pipe);
4f2d528d 4092
2c027c62
LP
4093 /* Close fds we don't need very early to make sure we don't block init reexecution because it cannot bind its
4094 * sockets. Among the fds we close are the logging fds, and we want to keep them closed, so that we don't have
4095 * any fds open we don't really want open during the transition. In order to make logging work, we switch the
4096 * log subsystem into open_when_needed mode, so that it reopens the logs on every single log call. */
ff0af2a1 4097
d35fbf6b 4098 log_forget_fds();
2c027c62 4099 log_set_open_when_needed(true);
4f2d528d 4100
40a80078
LP
4101 /* In case anything used libc syslog(), close this here, too */
4102 closelog();
4103
b1994387 4104 int keep_fds[n_fds + 3];
1da37e58
ZJS
4105 memcpy_safe(keep_fds, fds, n_fds * sizeof(int));
4106 n_keep_fds = n_fds;
4107
4108 r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, params->exec_fd, &exec_fd);
4109 if (r < 0) {
4110 *exit_status = EXIT_FDS;
4111 return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m");
4112 }
4113
b1994387 4114#if HAVE_LIBBPF
46004616
ZJS
4115 if (unit->manager->restrict_fs) {
4116 int bpf_map_fd = lsm_bpf_map_restrict_fs_fd(unit);
b1994387
ILG
4117 if (bpf_map_fd < 0) {
4118 *exit_status = EXIT_FDS;
46004616 4119 return log_unit_error_errno(unit, bpf_map_fd, "Failed to get restrict filesystems BPF map fd: %m");
b1994387
ILG
4120 }
4121
4122 r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, bpf_map_fd, &bpf_map_fd);
4123 if (r < 0) {
4124 *exit_status = EXIT_FDS;
4125 return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m");
4126 }
4127 }
4128#endif
4129
1da37e58 4130 r = close_remaining_fds(params, runtime, dcreds, user_lookup_fd, socket_fd, keep_fds, n_keep_fds);
ff0af2a1
LP
4131 if (r < 0) {
4132 *exit_status = EXIT_FDS;
12145637 4133 return log_unit_error_errno(unit, r, "Failed to close unwanted file descriptors: %m");
8c7be95e
LP
4134 }
4135
0af07108
ZJS
4136 if (!context->same_pgrp &&
4137 setsid() < 0) {
4138 *exit_status = EXIT_SETSID;
4139 return log_unit_error_errno(unit, errno, "Failed to create new process session: %m");
4140 }
9e2f7c11 4141
1e22b5cd 4142 exec_context_tty_reset(context, params);
d35fbf6b 4143
c891efaf 4144 if (unit_shall_confirm_spawn(unit)) {
3b20f877
FB
4145 _cleanup_free_ char *cmdline = NULL;
4146
4ef15008 4147 cmdline = quote_command_line(command->argv, SHELL_ESCAPE_EMPTY);
3b20f877 4148 if (!cmdline) {
0460aa5c 4149 *exit_status = EXIT_MEMORY;
12145637 4150 return log_oom();
3b20f877 4151 }
d35fbf6b 4152
4ef15008 4153 r = ask_for_confirmation(context, params->confirm_spawn, unit, cmdline);
3b20f877
FB
4154 if (r != CONFIRM_EXECUTE) {
4155 if (r == CONFIRM_PRETEND_SUCCESS) {
4156 *exit_status = EXIT_SUCCESS;
4157 return 0;
4158 }
ff0af2a1 4159 *exit_status = EXIT_CONFIRM;
0af07108
ZJS
4160 return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ECANCELED),
4161 "Execution cancelled by the user");
d35fbf6b
DM
4162 }
4163 }
1a63a750 4164
d521916d
LP
4165 /* We are about to invoke NSS and PAM modules. Let's tell them what we are doing here, maybe they care. This is
4166 * used by nss-resolve to disable itself when we are about to start systemd-resolved, to avoid deadlocks. Note
4167 * that these env vars do not survive the execve(), which means they really only apply to the PAM and NSS
4168 * invocations themselves. Also note that while we'll only invoke NSS modules involved in user management they
4169 * might internally call into other NSS modules that are involved in hostname resolution, we never know. */
4170 if (setenv("SYSTEMD_ACTIVATION_UNIT", unit->id, true) != 0 ||
4171 setenv("SYSTEMD_ACTIVATION_SCOPE", MANAGER_IS_SYSTEM(unit->manager) ? "system" : "user", true) != 0) {
4172 *exit_status = EXIT_MEMORY;
4173 return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
4174 }
4175
29206d46 4176 if (context->dynamic_user && dcreds) {
da50b85a 4177 _cleanup_strv_free_ char **suggested_paths = NULL;
29206d46 4178
d521916d 4179 /* On top of that, make sure we bypass our own NSS module nss-systemd comprehensively for any NSS
7802194a 4180 * checks, if DynamicUser=1 is used, as we shouldn't create a feedback loop with ourselves here. */
409093fe
LP
4181 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
4182 *exit_status = EXIT_USER;
12145637 4183 return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
409093fe
LP
4184 }
4185
da50b85a
LP
4186 r = compile_suggested_paths(context, params, &suggested_paths);
4187 if (r < 0) {
4188 *exit_status = EXIT_MEMORY;
4189 return log_oom();
4190 }
4191
4192 r = dynamic_creds_realize(dcreds, suggested_paths, &uid, &gid);
ff0af2a1
LP
4193 if (r < 0) {
4194 *exit_status = EXIT_USER;
d85ff944
YW
4195 if (r == -EILSEQ)
4196 return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP),
4197 "Failed to update dynamic user credentials: User or group with specified name already exists.");
12145637 4198 return log_unit_error_errno(unit, r, "Failed to update dynamic user credentials: %m");
524daa8c 4199 }
524daa8c 4200
70dd455c 4201 if (!uid_is_valid(uid)) {
29206d46 4202 *exit_status = EXIT_USER;
d85ff944 4203 return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ESRCH), "UID validation failed for \""UID_FMT"\"", uid);
70dd455c
ZJS
4204 }
4205
4206 if (!gid_is_valid(gid)) {
4207 *exit_status = EXIT_USER;
d85ff944 4208 return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ESRCH), "GID validation failed for \""GID_FMT"\"", gid);
29206d46 4209 }
5bc7452b 4210
29206d46
LP
4211 if (dcreds->user)
4212 username = dcreds->user->name;
4213
4214 } else {
4d885bd3
DH
4215 r = get_fixed_user(context, &username, &uid, &gid, &home, &shell);
4216 if (r < 0) {
4217 *exit_status = EXIT_USER;
12145637 4218 return log_unit_error_errno(unit, r, "Failed to determine user credentials: %m");
5bc7452b 4219 }
5bc7452b 4220
4d885bd3
DH
4221 r = get_fixed_group(context, &groupname, &gid);
4222 if (r < 0) {
4223 *exit_status = EXIT_GROUP;
12145637 4224 return log_unit_error_errno(unit, r, "Failed to determine group credentials: %m");
4d885bd3 4225 }
cdc5d5c5 4226 }
29206d46 4227
cdc5d5c5
DH
4228 /* Initialize user supplementary groups and get SupplementaryGroups= ones */
4229 r = get_supplementary_groups(context, username, groupname, gid,
4230 &supplementary_gids, &ngids);
4231 if (r < 0) {
4232 *exit_status = EXIT_GROUP;
12145637 4233 return log_unit_error_errno(unit, r, "Failed to determine supplementary groups: %m");
29206d46 4234 }
5bc7452b 4235
00d9ef85
LP
4236 r = send_user_lookup(unit, user_lookup_fd, uid, gid);
4237 if (r < 0) {
4238 *exit_status = EXIT_USER;
12145637 4239 return log_unit_error_errno(unit, r, "Failed to send user credentials to PID1: %m");
00d9ef85
LP
4240 }
4241
4242 user_lookup_fd = safe_close(user_lookup_fd);
4243
6732edab
LP
4244 r = acquire_home(context, uid, &home, &home_buffer);
4245 if (r < 0) {
4246 *exit_status = EXIT_CHDIR;
12145637 4247 return log_unit_error_errno(unit, r, "Failed to determine $HOME for user: %m");
6732edab
LP
4248 }
4249
d35fbf6b
DM
4250 /* If a socket is connected to STDIN/STDOUT/STDERR, we
4251 * must sure to drop O_NONBLOCK */
4252 if (socket_fd >= 0)
a34ceba6 4253 (void) fd_nonblock(socket_fd, false);
acbb0225 4254
4c70a4a7
MS
4255 /* Journald will try to look-up our cgroup in order to populate _SYSTEMD_CGROUP and _SYSTEMD_UNIT fields.
4256 * Hence we need to migrate to the target cgroup from init.scope before connecting to journald */
4257 if (params->cgroup_path) {
4258 _cleanup_free_ char *p = NULL;
4259
4260 r = exec_parameters_get_cgroup_path(params, &p);
4261 if (r < 0) {
4262 *exit_status = EXIT_CGROUP;
4263 return log_unit_error_errno(unit, r, "Failed to acquire cgroup path: %m");
4264 }
4265
4266 r = cg_attach_everywhere(params->cgroup_supported, p, 0, NULL, NULL);
702cf08f
YW
4267 if (r == -EUCLEAN) {
4268 *exit_status = EXIT_CGROUP;
4269 return log_unit_error_errno(unit, r, "Failed to attach process to cgroup %s "
4270 "because the cgroup or one of its parents or "
4271 "siblings is in the threaded mode: %m", p);
4272 }
4c70a4a7
MS
4273 if (r < 0) {
4274 *exit_status = EXIT_CGROUP;
4275 return log_unit_error_errno(unit, r, "Failed to attach to cgroup %s: %m", p);
4276 }
4277 }
4278
a8d08f39 4279 if (context->network_namespace_path && runtime && runtime->netns_storage_socket[0] >= 0) {
54c2459d 4280 r = open_shareable_ns_path(runtime->netns_storage_socket, context->network_namespace_path, CLONE_NEWNET);
a8d08f39
LP
4281 if (r < 0) {
4282 *exit_status = EXIT_NETWORK;
4283 return log_unit_error_errno(unit, r, "Failed to open network namespace path %s: %m", context->network_namespace_path);
4284 }
4285 }
4286
a70581ff
XR
4287 if (context->ipc_namespace_path && runtime && runtime->ipcns_storage_socket[0] >= 0) {
4288 r = open_shareable_ns_path(runtime->ipcns_storage_socket, context->ipc_namespace_path, CLONE_NEWIPC);
4289 if (r < 0) {
4290 *exit_status = EXIT_NAMESPACE;
4291 return log_unit_error_errno(unit, r, "Failed to open IPC namespace path %s: %m", context->ipc_namespace_path);
4292 }
4293 }
4294
52c239d7 4295 r = setup_input(context, params, socket_fd, named_iofds);
ff0af2a1
LP
4296 if (r < 0) {
4297 *exit_status = EXIT_STDIN;
12145637 4298 return log_unit_error_errno(unit, r, "Failed to set up standard input: %m");
d35fbf6b 4299 }
034c6ed7 4300
52c239d7 4301 r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
ff0af2a1
LP
4302 if (r < 0) {
4303 *exit_status = EXIT_STDOUT;
12145637 4304 return log_unit_error_errno(unit, r, "Failed to set up standard output: %m");
d35fbf6b
DM
4305 }
4306
52c239d7 4307 r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
ff0af2a1
LP
4308 if (r < 0) {
4309 *exit_status = EXIT_STDERR;
12145637 4310 return log_unit_error_errno(unit, r, "Failed to set up standard error output: %m");
d35fbf6b
DM
4311 }
4312
d35fbf6b 4313 if (context->oom_score_adjust_set) {
9f8168eb
LP
4314 /* When we can't make this change due to EPERM, then let's silently skip over it. User namespaces
4315 * prohibit write access to this file, and we shouldn't trip up over that. */
4316 r = set_oom_score_adjust(context->oom_score_adjust);
065b4774 4317 if (ERRNO_IS_PRIVILEGE(r))
f2341e0a 4318 log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
12145637 4319 else if (r < 0) {
ff0af2a1 4320 *exit_status = EXIT_OOM_ADJUST;
12145637 4321 return log_unit_error_errno(unit, r, "Failed to adjust OOM setting: %m");
613b411c 4322 }
d35fbf6b
DM
4323 }
4324
ad21e542
ZJS
4325 if (context->coredump_filter_set) {
4326 r = set_coredump_filter(context->coredump_filter);
4327 if (ERRNO_IS_PRIVILEGE(r))
4328 log_unit_debug_errno(unit, r, "Failed to adjust coredump_filter, ignoring: %m");
4329 else if (r < 0)
4330 return log_unit_error_errno(unit, r, "Failed to adjust coredump_filter: %m");
4331 }
4332
39090201
DJL
4333 if (context->nice_set) {
4334 r = setpriority_closest(context->nice);
4335 if (r < 0)
4336 return log_unit_error_errno(unit, r, "Failed to set up process scheduling priority (nice level): %m");
4337 }
613b411c 4338
d35fbf6b
DM
4339 if (context->cpu_sched_set) {
4340 struct sched_param param = {
4341 .sched_priority = context->cpu_sched_priority,
4342 };
4343
ff0af2a1
LP
4344 r = sched_setscheduler(0,
4345 context->cpu_sched_policy |
4346 (context->cpu_sched_reset_on_fork ?
4347 SCHED_RESET_ON_FORK : 0),
4348 &param);
4349 if (r < 0) {
4350 *exit_status = EXIT_SETSCHEDULER;
12145637 4351 return log_unit_error_errno(unit, errno, "Failed to set up CPU scheduling: %m");
fc9b2a84 4352 }
d35fbf6b 4353 }
fc9b2a84 4354
e2b2fb7f
MS
4355 if (context->cpu_affinity_from_numa || context->cpu_set.set) {
4356 _cleanup_(cpu_set_reset) CPUSet converted_cpu_set = {};
4357 const CPUSet *cpu_set;
4358
4359 if (context->cpu_affinity_from_numa) {
4360 r = exec_context_cpu_affinity_from_numa(context, &converted_cpu_set);
4361 if (r < 0) {
4362 *exit_status = EXIT_CPUAFFINITY;
4363 return log_unit_error_errno(unit, r, "Failed to derive CPU affinity mask from NUMA mask: %m");
4364 }
4365
4366 cpu_set = &converted_cpu_set;
4367 } else
4368 cpu_set = &context->cpu_set;
4369
4370 if (sched_setaffinity(0, cpu_set->allocated, cpu_set->set) < 0) {
ff0af2a1 4371 *exit_status = EXIT_CPUAFFINITY;
12145637 4372 return log_unit_error_errno(unit, errno, "Failed to set up CPU affinity: %m");
034c6ed7 4373 }
e2b2fb7f 4374 }
034c6ed7 4375
b070c7c0
MS
4376 if (mpol_is_valid(numa_policy_get_type(&context->numa_policy))) {
4377 r = apply_numa_policy(&context->numa_policy);
4378 if (r == -EOPNOTSUPP)
33fe9e3f 4379 log_unit_debug_errno(unit, r, "NUMA support not available, ignoring.");
b070c7c0
MS
4380 else if (r < 0) {
4381 *exit_status = EXIT_NUMA_POLICY;
4382 return log_unit_error_errno(unit, r, "Failed to set NUMA memory policy: %m");
4383 }
4384 }
4385
d35fbf6b
DM
4386 if (context->ioprio_set)
4387 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
ff0af2a1 4388 *exit_status = EXIT_IOPRIO;
12145637 4389 return log_unit_error_errno(unit, errno, "Failed to set up IO scheduling priority: %m");
d35fbf6b 4390 }
da726a4d 4391
d35fbf6b
DM
4392 if (context->timer_slack_nsec != NSEC_INFINITY)
4393 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
ff0af2a1 4394 *exit_status = EXIT_TIMERSLACK;
12145637 4395 return log_unit_error_errno(unit, errno, "Failed to set up timer slack: %m");
4c2630eb 4396 }
9eba9da4 4397
21022b9d
LP
4398 if (context->personality != PERSONALITY_INVALID) {
4399 r = safe_personality(context->personality);
4400 if (r < 0) {
ff0af2a1 4401 *exit_status = EXIT_PERSONALITY;
12145637 4402 return log_unit_error_errno(unit, r, "Failed to set up execution domain (personality): %m");
4c2630eb 4403 }
21022b9d 4404 }
94f04347 4405
33331d11
VB
4406 if (context->utmp_id) {
4407 const char *line = context->tty_path ?
4408 (path_startswith(context->tty_path, "/dev/") ?: context->tty_path) :
4409 NULL;
df0ff127 4410 utmp_put_init_process(context->utmp_id, getpid_cached(), getsid(0),
33331d11 4411 line,
023a4f67
LP
4412 context->utmp_mode == EXEC_UTMP_INIT ? INIT_PROCESS :
4413 context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
4414 USER_PROCESS,
6a93917d 4415 username);
33331d11 4416 }
d35fbf6b 4417
08f67696 4418 if (uid_is_valid(uid)) {
ff0af2a1
LP
4419 r = chown_terminal(STDIN_FILENO, uid);
4420 if (r < 0) {
4421 *exit_status = EXIT_STDIN;
12145637 4422 return log_unit_error_errno(unit, r, "Failed to change ownership of terminal: %m");
071830ff 4423 }
d35fbf6b 4424 }
8e274523 4425
4e1dfa45 4426 /* If delegation is enabled we'll pass ownership of the cgroup to the user of the new process. On cgroup v1
62b9bb26 4427 * this is only about systemd's own hierarchy, i.e. not the controller hierarchies, simply because that's not
4e1dfa45 4428 * safe. On cgroup v2 there's only one hierarchy anyway, and delegation is safe there, hence in that case only
62b9bb26 4429 * touch a single hierarchy too. */
584b8688 4430 if (params->cgroup_path && context->user && (params->flags & EXEC_CGROUP_DELEGATE)) {
62b9bb26 4431 r = cg_set_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, uid, gid);
ff0af2a1
LP
4432 if (r < 0) {
4433 *exit_status = EXIT_CGROUP;
12145637 4434 return log_unit_error_errno(unit, r, "Failed to adjust control group access: %m");
034c6ed7 4435 }
d35fbf6b 4436 }
034c6ed7 4437
211a3d87
LB
4438 needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
4439
5b10116e 4440 for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
211a3d87 4441 r = setup_exec_directory(context, params, uid, gid, dt, needs_mount_namespace, exit_status);
12145637
LP
4442 if (r < 0)
4443 return log_unit_error_errno(unit, r, "Failed to set up special execution directory in %s: %m", params->prefix[dt]);
d35fbf6b 4444 }
94f04347 4445
bb0c0d6f
LP
4446 if (FLAGS_SET(params->flags, EXEC_WRITE_CREDENTIALS)) {
4447 r = setup_credentials(context, params, unit->id, uid);
4448 if (r < 0) {
4449 *exit_status = EXIT_CREDENTIALS;
4450 return log_unit_error_errno(unit, r, "Failed to set up credentials: %m");
4451 }
4452 }
4453
7bce046b 4454 r = build_environment(
fd63e712 4455 unit,
7bce046b
LP
4456 context,
4457 params,
4458 n_fds,
4459 home,
4460 username,
4461 shell,
4462 journal_stream_dev,
4463 journal_stream_ino,
4464 &our_env);
2065ca69
JW
4465 if (r < 0) {
4466 *exit_status = EXIT_MEMORY;
12145637 4467 return log_oom();
2065ca69
JW
4468 }
4469
4470 r = build_pass_environment(context, &pass_env);
4471 if (r < 0) {
4472 *exit_status = EXIT_MEMORY;
12145637 4473 return log_oom();
2065ca69
JW
4474 }
4475
adf769b0
ZJS
4476 /* The $PATH variable is set to the default path in params->environment. However, this is overridden
4477 * if user-specified fields have $PATH set. The intention is to also override $PATH if the unit does
4478 * not specify PATH but the unit has ExecSearchPath. */
8c35c10d 4479 if (!strv_isempty(context->exec_search_path)) {
4480 _cleanup_free_ char *joined = NULL;
4481
4482 joined = strv_join(context->exec_search_path, ":");
4483 if (!joined) {
4484 *exit_status = EXIT_MEMORY;
4485 return log_oom();
4486 }
4487
4488 r = strv_env_assign(&joined_exec_search_path, "PATH", joined);
4489 if (r < 0) {
4490 *exit_status = EXIT_MEMORY;
4491 return log_oom();
4492 }
4493 }
4494
4ab3d29f 4495 accum_env = strv_env_merge(params->environment,
2065ca69 4496 our_env,
8c35c10d 4497 joined_exec_search_path,
2065ca69
JW
4498 pass_env,
4499 context->environment,
44e5d006 4500 files_env);
2065ca69
JW
4501 if (!accum_env) {
4502 *exit_status = EXIT_MEMORY;
12145637 4503 return log_oom();
2065ca69 4504 }
1280503b 4505 accum_env = strv_env_clean(accum_env);
2065ca69 4506
096424d1 4507 (void) umask(context->umask);
b213e1c1 4508
b1edf445 4509 r = setup_keyring(unit, context, params, uid, gid);
74dd6b51
LP
4510 if (r < 0) {
4511 *exit_status = EXIT_KEYRING;
12145637 4512 return log_unit_error_errno(unit, r, "Failed to set up kernel keyring: %m");
74dd6b51
LP
4513 }
4514
adf769b0
ZJS
4515 /* We need sandboxing if the caller asked us to apply it and the command isn't explicitly excepted
4516 * from it. */
1703fa41 4517 needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
7f18ef0a 4518
adf769b0
ZJS
4519 /* We need the ambient capability hack, if the caller asked us to apply it and the command is marked
4520 * for it, and the kernel doesn't actually support ambient caps. */
165a31c0 4521 needs_ambient_hack = (params->flags & EXEC_APPLY_SANDBOXING) && (command->flags & EXEC_COMMAND_AMBIENT_MAGIC) && !ambient_capabilities_supported();
7f18ef0a 4522
adf769b0
ZJS
4523 /* We need setresuid() if the caller asked us to apply sandboxing and the command isn't explicitly
4524 * excepted from either whole sandboxing or just setresuid() itself, and the ambient hack is not
4525 * desired. */
165a31c0
LP
4526 if (needs_ambient_hack)
4527 needs_setuid = false;
4528 else
4529 needs_setuid = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & (EXEC_COMMAND_FULLY_PRIVILEGED|EXEC_COMMAND_NO_SETUID));
4530
4531 if (needs_sandboxing) {
adf769b0
ZJS
4532 /* MAC enablement checks need to be done before a new mount ns is created, as they rely on
4533 * /sys being present. The actual MAC context application will happen later, as late as
4534 * possible, to avoid impacting our own code paths. */
7f18ef0a 4535
349cc4a5 4536#if HAVE_SELINUX
43b1f709 4537 use_selinux = mac_selinux_use();
7f18ef0a 4538#endif
f9fa32f0 4539#if ENABLE_SMACK
43b1f709 4540 use_smack = mac_smack_use();
7f18ef0a 4541#endif
349cc4a5 4542#if HAVE_APPARMOR
43b1f709 4543 use_apparmor = mac_apparmor_use();
7f18ef0a 4544#endif
165a31c0 4545 }
7f18ef0a 4546
ce932d2d
LP
4547 if (needs_sandboxing) {
4548 int which_failed;
4549
4550 /* Let's set the resource limits before we call into PAM, so that pam_limits wins over what
4551 * is set here. (See below.) */
4552
4553 r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
4554 if (r < 0) {
4555 *exit_status = EXIT_LIMITS;
4556 return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
4557 }
4558 }
4559
0af07108 4560 if (needs_setuid && context->pam_name && username) {
ce932d2d
LP
4561 /* Let's call into PAM after we set up our own idea of resource limits to that pam_limits
4562 * wins here. (See above.) */
4563
1da37e58 4564 /* All fds passed in the fds array will be closed in the pam child process. */
0af07108
ZJS
4565 r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
4566 if (r < 0) {
4567 *exit_status = EXIT_PAM;
4568 return log_unit_error_errno(unit, r, "Failed to set up PAM session: %m");
165a31c0 4569 }
ac45f971 4570
0af07108
ZJS
4571 ngids_after_pam = getgroups_alloc(&gids_after_pam);
4572 if (ngids_after_pam < 0) {
4573 *exit_status = EXIT_MEMORY;
4574 return log_unit_error_errno(unit, ngids_after_pam, "Failed to obtain groups after setting up PAM: %m");
5749f855 4575 }
b213e1c1 4576 }
5749f855 4577
0af07108 4578 if (needs_sandboxing && context->private_users && !have_effective_cap(CAP_SYS_ADMIN)) {
5749f855
AZ
4579 /* If we're unprivileged, set up the user namespace first to enable use of the other namespaces.
4580 * Users with CAP_SYS_ADMIN can set up user namespaces last because they will be able to
4581 * set up the all of the other namespaces (i.e. network, mount, UTS) without a user namespace. */
0af07108
ZJS
4582
4583 userns_set_up = true;
4584 r = setup_private_users(saved_uid, saved_gid, uid, gid);
4585 if (r < 0) {
4586 *exit_status = EXIT_USER;
4587 return log_unit_error_errno(unit, r, "Failed to set up user namespacing for unprivileged user: %m");
5749f855
AZ
4588 }
4589 }
4590
a8d08f39
LP
4591 if ((context->private_network || context->network_namespace_path) && runtime && runtime->netns_storage_socket[0] >= 0) {
4592
6e2d7c4f 4593 if (ns_type_supported(NAMESPACE_NET)) {
54c2459d 4594 r = setup_shareable_ns(runtime->netns_storage_socket, CLONE_NEWNET);
ee00d1e9
ZJS
4595 if (r == -EPERM)
4596 log_unit_warning_errno(unit, r,
4597 "PrivateNetwork=yes is configured, but network namespace setup failed, ignoring: %m");
4598 else if (r < 0) {
6e2d7c4f
MS
4599 *exit_status = EXIT_NETWORK;
4600 return log_unit_error_errno(unit, r, "Failed to set up network namespacing: %m");
4601 }
a8d08f39
LP
4602 } else if (context->network_namespace_path) {
4603 *exit_status = EXIT_NETWORK;
ee00d1e9
ZJS
4604 return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP),
4605 "NetworkNamespacePath= is not supported, refusing.");
6e2d7c4f
MS
4606 } else
4607 log_unit_warning(unit, "PrivateNetwork=yes is configured, but the kernel does not support network namespaces, ignoring.");
d35fbf6b 4608 }
169c1bda 4609
a70581ff
XR
4610 if ((context->private_ipc || context->ipc_namespace_path) && runtime && runtime->ipcns_storage_socket[0] >= 0) {
4611
4612 if (ns_type_supported(NAMESPACE_IPC)) {
4613 r = setup_shareable_ns(runtime->ipcns_storage_socket, CLONE_NEWIPC);
4614 if (r == -EPERM)
4615 log_unit_warning_errno(unit, r,
4616 "PrivateIPC=yes is configured, but IPC namespace setup failed, ignoring: %m");
4617 else if (r < 0) {
4618 *exit_status = EXIT_NAMESPACE;
4619 return log_unit_error_errno(unit, r, "Failed to set up IPC namespacing: %m");
4620 }
4621 } else if (context->ipc_namespace_path) {
4622 *exit_status = EXIT_NAMESPACE;
4623 return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP),
4624 "IPCNamespacePath= is not supported, refusing.");
4625 } else
4626 log_unit_warning(unit, "PrivateIPC=yes is configured, but the kernel does not support IPC namespaces, ignoring.");
4627 }
4628
ee818b89 4629 if (needs_mount_namespace) {
7cc5ef5f
ZJS
4630 _cleanup_free_ char *error_path = NULL;
4631
9f71ba8d 4632 r = apply_mount_namespace(unit, command->flags, context, params, runtime, &error_path);
3fbe8dbe
LP
4633 if (r < 0) {
4634 *exit_status = EXIT_NAMESPACE;
7cc5ef5f
ZJS
4635 return log_unit_error_errno(unit, r, "Failed to set up mount namespacing%s%s: %m",
4636 error_path ? ": " : "", strempty(error_path));
3fbe8dbe 4637 }
d35fbf6b 4638 }
81a2b7ce 4639
daf8f72b
LP
4640 if (needs_sandboxing) {
4641 r = apply_protect_hostname(unit, context, exit_status);
4642 if (r < 0)
4643 return r;
aecd5ac6
TM
4644 }
4645
5749f855
AZ
4646 /* Drop groups as early as possible.
4647 * This needs to be done after PrivateDevices=y setup as device nodes should be owned by the host's root.
4648 * For non-root in a userns, devices will be owned by the user/group before the group change, and nobody. */
165a31c0 4649 if (needs_setuid) {
afb11bf1
DG
4650 _cleanup_free_ gid_t *gids_to_enforce = NULL;
4651 int ngids_to_enforce = 0;
4652
4653 ngids_to_enforce = merge_gid_lists(supplementary_gids,
4654 ngids,
4655 gids_after_pam,
4656 ngids_after_pam,
4657 &gids_to_enforce);
4658 if (ngids_to_enforce < 0) {
4659 *exit_status = EXIT_MEMORY;
4660 return log_unit_error_errno(unit,
4661 ngids_to_enforce,
4662 "Failed to merge group lists. Group membership might be incorrect: %m");
4663 }
4664
4665 r = enforce_groups(gid, gids_to_enforce, ngids_to_enforce);
096424d1
LP
4666 if (r < 0) {
4667 *exit_status = EXIT_GROUP;
12145637 4668 return log_unit_error_errno(unit, r, "Changing group credentials failed: %m");
096424d1 4669 }
165a31c0 4670 }
096424d1 4671
5749f855
AZ
4672 /* If the user namespace was not set up above, try to do it now.
4673 * It's preferred to set up the user namespace later (after all other namespaces) so as not to be
4674 * restricted by rules pertaining to combining user namspaces with other namespaces (e.g. in the
4675 * case of mount namespaces being less privileged when the mount point list is copied from a
4676 * different user namespace). */
9008e1ac 4677
5749f855
AZ
4678 if (needs_sandboxing && context->private_users && !userns_set_up) {
4679 r = setup_private_users(saved_uid, saved_gid, uid, gid);
4680 if (r < 0) {
4681 *exit_status = EXIT_USER;
4682 return log_unit_error_errno(unit, r, "Failed to set up user namespacing: %m");
d251207d
LP
4683 }
4684 }
4685
9f71ba8d
ZJS
4686 /* Now that the mount namespace has been set up and privileges adjusted, let's look for the thing we
4687 * shall execute. */
4688
4689 _cleanup_free_ char *executable = NULL;
b83d5050 4690 _cleanup_close_ int executable_fd = -1;
8c35c10d 4691 r = find_executable_full(command->path, /* root= */ NULL, context->exec_search_path, false, &executable, &executable_fd);
9f71ba8d
ZJS
4692 if (r < 0) {
4693 if (r != -ENOMEM && (command->flags & EXEC_COMMAND_IGNORE_FAILURE)) {
c2503e35
RH
4694 log_unit_struct_errno(unit, LOG_INFO, r,
4695 "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
4696 LOG_UNIT_INVOCATION_ID(unit),
4697 LOG_UNIT_MESSAGE(unit, "Executable %s missing, skipping: %m",
4698 command->path),
4699 "EXECUTABLE=%s", command->path);
9f71ba8d
ZJS
4700 return 0;
4701 }
4702
4703 *exit_status = EXIT_EXEC;
c2503e35
RH
4704
4705 return log_unit_struct_errno(unit, LOG_INFO, r,
4706 "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
4707 LOG_UNIT_INVOCATION_ID(unit),
4708 LOG_UNIT_MESSAGE(unit, "Failed to locate executable %s: %m",
4709 command->path),
4710 "EXECUTABLE=%s", command->path);
9f71ba8d
ZJS
4711 }
4712
b83d5050
ZJS
4713 r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, executable_fd, &executable_fd);
4714 if (r < 0) {
4715 *exit_status = EXIT_FDS;
4716 return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m");
4717 }
4718
9f71ba8d 4719#if HAVE_SELINUX
49590d67
MS
4720 if (needs_sandboxing && use_selinux && params->selinux_context_net) {
4721 int fd = -1;
4722
4723 if (socket_fd >= 0)
4724 fd = socket_fd;
4725 else if (params->n_socket_fds == 1)
4726 /* If stdin is not connected to a socket but we are triggered by exactly one socket unit then we
4727 * use context from that fd to compute the label. */
4728 fd = params->fds[0];
4729
4730 if (fd >= 0) {
4731 r = mac_selinux_get_child_mls_label(fd, executable, context->selinux_context, &mac_selinux_context_net);
006d1864
TM
4732 if (r < 0) {
4733 if (!context->selinux_context_ignore) {
4734 *exit_status = EXIT_SELINUX_CONTEXT;
4735 return log_unit_error_errno(unit, r, "Failed to determine SELinux context: %m");
4736 }
4737 log_unit_debug_errno(unit, r, "Failed to determine SELinux context, ignoring: %m");
49590d67 4738 }
9f71ba8d
ZJS
4739 }
4740 }
4741#endif
4742
165a31c0 4743 /* We repeat the fd closing here, to make sure that nothing is leaked from the PAM modules. Note that we are
a70581ff 4744 * more aggressive this time since socket_fd and the netns and ipcns fds we don't need anymore. We do keep the exec_fd
5686391b
LP
4745 * however if we have it as we want to keep it open until the final execve(). */
4746
1da37e58 4747 r = close_all_fds(keep_fds, n_keep_fds);
ff0af2a1
LP
4748 if (r >= 0)
4749 r = shift_fds(fds, n_fds);
4750 if (r >= 0)
25b583d7 4751 r = flags_fds(fds, n_socket_fds, n_storage_fds, context->non_blocking);
ff0af2a1
LP
4752 if (r < 0) {
4753 *exit_status = EXIT_FDS;
12145637 4754 return log_unit_error_errno(unit, r, "Failed to adjust passed file descriptors: %m");
d35fbf6b 4755 }
e66cf1a3 4756
5686391b
LP
4757 /* At this point, the fds we want to pass to the program are all ready and set up, with O_CLOEXEC turned off
4758 * and at the right fd numbers. The are no other fds open, with one exception: the exec_fd if it is defined,
4759 * and it has O_CLOEXEC set, after all we want it to be closed by the execve(), so that our parent knows we
4760 * came this far. */
4761
165a31c0 4762 secure_bits = context->secure_bits;
e66cf1a3 4763
165a31c0
LP
4764 if (needs_sandboxing) {
4765 uint64_t bset;
e66cf1a3 4766
ce932d2d
LP
4767 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly
4768 * requested. (Note this is placed after the general resource limit initialization, see
4769 * above, in order to take precedence.) */
f4170c67
LP
4770 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
4771 if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
4772 *exit_status = EXIT_LIMITS;
12145637 4773 return log_unit_error_errno(unit, errno, "Failed to adjust RLIMIT_RTPRIO resource limit: %m");
f4170c67
LP
4774 }
4775 }
4776
37ac2744
JB
4777#if ENABLE_SMACK
4778 /* LSM Smack needs the capability CAP_MAC_ADMIN to change the current execution security context of the
4779 * process. This is the latest place before dropping capabilities. Other MAC context are set later. */
4780 if (use_smack) {
b83d5050 4781 r = setup_smack(context, executable_fd);
29ff6247 4782 if (r < 0 && !context->smack_process_label_ignore) {
37ac2744
JB
4783 *exit_status = EXIT_SMACK_PROCESS_LABEL;
4784 return log_unit_error_errno(unit, r, "Failed to set SMACK process label: %m");
4785 }
4786 }
4787#endif
4788
165a31c0
LP
4789 bset = context->capability_bounding_set;
4790 /* If the ambient caps hack is enabled (which means the kernel can't do them, and the user asked for
4791 * our magic fallback), then let's add some extra caps, so that the service can drop privs of its own,
4792 * instead of us doing that */
4793 if (needs_ambient_hack)
4794 bset |= (UINT64_C(1) << CAP_SETPCAP) |
4795 (UINT64_C(1) << CAP_SETUID) |
4796 (UINT64_C(1) << CAP_SETGID);
4797
4798 if (!cap_test_all(bset)) {
4799 r = capability_bounding_set_drop(bset, false);
ff0af2a1
LP
4800 if (r < 0) {
4801 *exit_status = EXIT_CAPABILITIES;
12145637 4802 return log_unit_error_errno(unit, r, "Failed to drop capabilities: %m");
3b8bddde 4803 }
4c2630eb 4804 }
3b8bddde 4805
16fcb191
TK
4806 /* Ambient capabilities are cleared during setresuid() (in enforce_user()) even with
4807 * keep-caps set.
4808 * To be able to raise the ambient capabilities after setresuid() they have to be
4809 * added to the inherited set and keep caps has to be set (done in enforce_user()).
4810 * After setresuid() the ambient capabilities can be raised as they are present in
4811 * the permitted and inhertiable set. However it is possible that someone wants to
4812 * set ambient capabilities without changing the user, so we also set the ambient
4813 * capabilities here.
4814 * The requested ambient capabilities are raised in the inheritable set if the
4815 * second argument is true. */
943800f4 4816 if (!needs_ambient_hack) {
755d4b67
IP
4817 r = capability_ambient_set_apply(context->capability_ambient_set, true);
4818 if (r < 0) {
4819 *exit_status = EXIT_CAPABILITIES;
12145637 4820 return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (before UID change): %m");
755d4b67 4821 }
755d4b67 4822 }
165a31c0 4823 }
755d4b67 4824
fa97f630
JB
4825 /* chroot to root directory first, before we lose the ability to chroot */
4826 r = apply_root_directory(context, params, needs_mount_namespace, exit_status);
4827 if (r < 0)
4828 return log_unit_error_errno(unit, r, "Chrooting to the requested root directory failed: %m");
4829
165a31c0 4830 if (needs_setuid) {
08f67696 4831 if (uid_is_valid(uid)) {
ff0af2a1
LP
4832 r = enforce_user(context, uid);
4833 if (r < 0) {
4834 *exit_status = EXIT_USER;
12145637 4835 return log_unit_error_errno(unit, r, "Failed to change UID to " UID_FMT ": %m", uid);
5b6319dc 4836 }
165a31c0
LP
4837
4838 if (!needs_ambient_hack &&
4839 context->capability_ambient_set != 0) {
755d4b67 4840
16fcb191 4841 /* Raise the ambient capabilities after user change. */
755d4b67
IP
4842 r = capability_ambient_set_apply(context->capability_ambient_set, false);
4843 if (r < 0) {
4844 *exit_status = EXIT_CAPABILITIES;
12145637 4845 return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (after UID change): %m");
755d4b67 4846 }
755d4b67 4847 }
5b6319dc 4848 }
165a31c0 4849 }
d35fbf6b 4850
56ef8db9
JB
4851 /* Apply working directory here, because the working directory might be on NFS and only the user running
4852 * this service might have the correct privilege to change to the working directory */
fa97f630 4853 r = apply_working_directory(context, params, home, exit_status);
56ef8db9
JB
4854 if (r < 0)
4855 return log_unit_error_errno(unit, r, "Changing to the requested working directory failed: %m");
4856
165a31c0 4857 if (needs_sandboxing) {
37ac2744 4858 /* Apply other MAC contexts late, but before seccomp syscall filtering, as those should really be last to
5cd9cd35
LP
4859 * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires
4860 * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls
4861 * are restricted. */
4862
349cc4a5 4863#if HAVE_SELINUX
43b1f709 4864 if (use_selinux) {
5cd9cd35
LP
4865 char *exec_context = mac_selinux_context_net ?: context->selinux_context;
4866
4867 if (exec_context) {
4868 r = setexeccon(exec_context);
006d1864
TM
4869 if (r < 0) {
4870 if (!context->selinux_context_ignore) {
4871 *exit_status = EXIT_SELINUX_CONTEXT;
4872 return log_unit_error_errno(unit, r, "Failed to change SELinux context to %s: %m", exec_context);
4873 }
4874 log_unit_debug_errno(unit, r, "Failed to change SELinux context to %s, ignoring: %m", exec_context);
5cd9cd35
LP
4875 }
4876 }
4877 }
4878#endif
4879
349cc4a5 4880#if HAVE_APPARMOR
43b1f709 4881 if (use_apparmor && context->apparmor_profile) {
5cd9cd35
LP
4882 r = aa_change_onexec(context->apparmor_profile);
4883 if (r < 0 && !context->apparmor_profile_ignore) {
4884 *exit_status = EXIT_APPARMOR_PROFILE;
12145637 4885 return log_unit_error_errno(unit, errno, "Failed to prepare AppArmor profile change to %s: %m", context->apparmor_profile);
5cd9cd35
LP
4886 }
4887 }
4888#endif
4889
165a31c0 4890 /* PR_GET_SECUREBITS is not privileged, while PR_SET_SECUREBITS is. So to suppress potential EPERMs
dbdc4098
TK
4891 * we'll try not to call PR_SET_SECUREBITS unless necessary. Setting securebits requires
4892 * CAP_SETPCAP. */
4893 if (prctl(PR_GET_SECUREBITS) != secure_bits) {
69e3234d 4894 /* CAP_SETPCAP is required to set securebits. This capability is raised into the
dbdc4098
TK
4895 * effective set here.
4896 * The effective set is overwritten during execve with the following values:
4897 * - ambient set (for non-root processes)
4898 * - (inheritable | bounding) set for root processes)
4899 *
4900 * Hence there is no security impact to raise it in the effective set before execve
4901 */
4902 r = capability_gain_cap_setpcap(NULL);
4903 if (r < 0) {
4904 *exit_status = EXIT_CAPABILITIES;
4905 return log_unit_error_errno(unit, r, "Failed to gain CAP_SETPCAP for setting secure bits");
4906 }
755d4b67 4907 if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
ff0af2a1 4908 *exit_status = EXIT_SECUREBITS;
12145637 4909 return log_unit_error_errno(unit, errno, "Failed to set process secure bits: %m");
ff01d048 4910 }
dbdc4098 4911 }
5b6319dc 4912
59eeb84b 4913 if (context_has_no_new_privileges(context))
d35fbf6b 4914 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
ff0af2a1 4915 *exit_status = EXIT_NO_NEW_PRIVILEGES;
12145637 4916 return log_unit_error_errno(unit, errno, "Failed to disable new privileges: %m");
d35fbf6b
DM
4917 }
4918
349cc4a5 4919#if HAVE_SECCOMP
469830d1
LP
4920 r = apply_address_families(unit, context);
4921 if (r < 0) {
4922 *exit_status = EXIT_ADDRESS_FAMILIES;
12145637 4923 return log_unit_error_errno(unit, r, "Failed to restrict address families: %m");
4c2630eb 4924 }
04aa0cb9 4925
469830d1
LP
4926 r = apply_memory_deny_write_execute(unit, context);
4927 if (r < 0) {
4928 *exit_status = EXIT_SECCOMP;
12145637 4929 return log_unit_error_errno(unit, r, "Failed to disable writing to executable memory: %m");
f3e43635 4930 }
f4170c67 4931
469830d1
LP
4932 r = apply_restrict_realtime(unit, context);
4933 if (r < 0) {
4934 *exit_status = EXIT_SECCOMP;
12145637 4935 return log_unit_error_errno(unit, r, "Failed to apply realtime restrictions: %m");
f4170c67
LP
4936 }
4937
f69567cb
LP
4938 r = apply_restrict_suid_sgid(unit, context);
4939 if (r < 0) {
4940 *exit_status = EXIT_SECCOMP;
4941 return log_unit_error_errno(unit, r, "Failed to apply SUID/SGID restrictions: %m");
4942 }
4943
add00535
LP
4944 r = apply_restrict_namespaces(unit, context);
4945 if (r < 0) {
4946 *exit_status = EXIT_SECCOMP;
12145637 4947 return log_unit_error_errno(unit, r, "Failed to apply namespace restrictions: %m");
add00535
LP
4948 }
4949
469830d1
LP
4950 r = apply_protect_sysctl(unit, context);
4951 if (r < 0) {
4952 *exit_status = EXIT_SECCOMP;
12145637 4953 return log_unit_error_errno(unit, r, "Failed to apply sysctl restrictions: %m");
502d704e
DH
4954 }
4955
469830d1
LP
4956 r = apply_protect_kernel_modules(unit, context);
4957 if (r < 0) {
4958 *exit_status = EXIT_SECCOMP;
12145637 4959 return log_unit_error_errno(unit, r, "Failed to apply module loading restrictions: %m");
59eeb84b
LP
4960 }
4961
84703040
KK
4962 r = apply_protect_kernel_logs(unit, context);
4963 if (r < 0) {
4964 *exit_status = EXIT_SECCOMP;
4965 return log_unit_error_errno(unit, r, "Failed to apply kernel log restrictions: %m");
4966 }
4967
fc64760d
KK
4968 r = apply_protect_clock(unit, context);
4969 if (r < 0) {
4970 *exit_status = EXIT_SECCOMP;
4971 return log_unit_error_errno(unit, r, "Failed to apply clock restrictions: %m");
4972 }
4973
469830d1
LP
4974 r = apply_private_devices(unit, context);
4975 if (r < 0) {
4976 *exit_status = EXIT_SECCOMP;
12145637 4977 return log_unit_error_errno(unit, r, "Failed to set up private devices: %m");
469830d1
LP
4978 }
4979
4980 r = apply_syscall_archs(unit, context);
4981 if (r < 0) {
4982 *exit_status = EXIT_SECCOMP;
12145637 4983 return log_unit_error_errno(unit, r, "Failed to apply syscall architecture restrictions: %m");
ba128bb8
LP
4984 }
4985
78e864e5
TM
4986 r = apply_lock_personality(unit, context);
4987 if (r < 0) {
4988 *exit_status = EXIT_SECCOMP;
12145637 4989 return log_unit_error_errno(unit, r, "Failed to lock personalities: %m");
78e864e5
TM
4990 }
4991
9df2cdd8
TM
4992 r = apply_syscall_log(unit, context);
4993 if (r < 0) {
4994 *exit_status = EXIT_SECCOMP;
4995 return log_unit_error_errno(unit, r, "Failed to apply system call log filters: %m");
4996 }
4997
5cd9cd35
LP
4998 /* This really should remain the last step before the execve(), to make sure our own code is unaffected
4999 * by the filter as little as possible. */
165a31c0 5000 r = apply_syscall_filter(unit, context, needs_ambient_hack);
469830d1
LP
5001 if (r < 0) {
5002 *exit_status = EXIT_SECCOMP;
12145637 5003 return log_unit_error_errno(unit, r, "Failed to apply system call filters: %m");
d35fbf6b
DM
5004 }
5005#endif
b1994387
ILG
5006
5007#if HAVE_LIBBPF
5008 r = apply_restrict_filesystems(unit, context);
5009 if (r < 0) {
5010 *exit_status = EXIT_BPF;
5011 return log_unit_error_errno(unit, r, "Failed to restrict filesystems: %m");
5012 }
5013#endif
5014
d35fbf6b 5015 }
034c6ed7 5016
00819cc1
LP
5017 if (!strv_isempty(context->unset_environment)) {
5018 char **ee = NULL;
5019
5020 ee = strv_env_delete(accum_env, 1, context->unset_environment);
5021 if (!ee) {
5022 *exit_status = EXIT_MEMORY;
12145637 5023 return log_oom();
00819cc1
LP
5024 }
5025
130d3d22 5026 strv_free_and_replace(accum_env, ee);
00819cc1
LP
5027 }
5028
7ca69792
AZ
5029 if (!FLAGS_SET(command->flags, EXEC_COMMAND_NO_ENV_EXPAND)) {
5030 replaced_argv = replace_env_argv(command->argv, accum_env);
5031 if (!replaced_argv) {
5032 *exit_status = EXIT_MEMORY;
5033 return log_oom();
5034 }
5035 final_argv = replaced_argv;
5036 } else
5037 final_argv = command->argv;
034c6ed7 5038
f1d34068 5039 if (DEBUG_LOGGING) {
c2b2df60 5040 _cleanup_free_ char *line = NULL;
81a2b7ce 5041
4ef15008 5042 line = quote_command_line(final_argv, SHELL_ESCAPE_EMPTY);
8a62620e
ZJS
5043 if (!line) {
5044 *exit_status = EXIT_MEMORY;
5045 return log_oom();
5046 }
5047
5048 log_unit_struct(unit, LOG_DEBUG,
5049 "EXECUTABLE=%s", executable,
5050 LOG_UNIT_MESSAGE(unit, "Executing: %s", line));
d35fbf6b 5051 }
dd305ec9 5052
5686391b
LP
5053 if (exec_fd >= 0) {
5054 uint8_t hot = 1;
5055
5056 /* We have finished with all our initializations. Let's now let the manager know that. From this point
5057 * on, if the manager sees POLLHUP on the exec_fd, then execve() was successful. */
5058
5059 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
5060 *exit_status = EXIT_EXEC;
5061 return log_unit_error_errno(unit, errno, "Failed to enable exec_fd: %m");
5062 }
5063 }
5064
a6d9111c 5065 r = fexecve_or_execve(executable_fd, executable, final_argv, accum_env);
5686391b
LP
5066
5067 if (exec_fd >= 0) {
5068 uint8_t hot = 0;
5069
5070 /* The execve() failed. This means the exec_fd is still open. Which means we need to tell the manager
5071 * that POLLHUP on it no longer means execve() succeeded. */
5072
5073 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
5074 *exit_status = EXIT_EXEC;
5075 return log_unit_error_errno(unit, errno, "Failed to disable exec_fd: %m");
5076 }
5077 }
12145637 5078
ff0af2a1 5079 *exit_status = EXIT_EXEC;
9f71ba8d 5080 return log_unit_error_errno(unit, r, "Failed to execute %s: %m", executable);
d35fbf6b 5081}
81a2b7ce 5082
34cf6c43 5083static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l);
2caa38e9 5084static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[static 3]);
34cf6c43 5085
f2341e0a
LP
5086int exec_spawn(Unit *unit,
5087 ExecCommand *command,
d35fbf6b
DM
5088 const ExecContext *context,
5089 const ExecParameters *params,
5090 ExecRuntime *runtime,
29206d46 5091 DynamicCreds *dcreds,
d35fbf6b 5092 pid_t *ret) {
8351ceae 5093
ee39ca20 5094 int socket_fd, r, named_iofds[3] = { -1, -1, -1 }, *fds = NULL;
78f93209 5095 _cleanup_free_ char *subcgroup_path = NULL;
d35fbf6b 5096 _cleanup_strv_free_ char **files_env = NULL;
da6053d0 5097 size_t n_storage_fds = 0, n_socket_fds = 0;
ff0af2a1 5098 _cleanup_free_ char *line = NULL;
d35fbf6b 5099 pid_t pid;
8351ceae 5100
f2341e0a 5101 assert(unit);
d35fbf6b
DM
5102 assert(command);
5103 assert(context);
5104 assert(ret);
5105 assert(params);
25b583d7 5106 assert(params->fds || (params->n_socket_fds + params->n_storage_fds <= 0));
4298d0b5 5107
d35fbf6b
DM
5108 if (context->std_input == EXEC_INPUT_SOCKET ||
5109 context->std_output == EXEC_OUTPUT_SOCKET ||
5110 context->std_error == EXEC_OUTPUT_SOCKET) {
17df7223 5111
d85ff944
YW
5112 if (params->n_socket_fds > 1)
5113 return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EINVAL), "Got more than one socket.");
eef65bf3 5114
d85ff944
YW
5115 if (params->n_socket_fds == 0)
5116 return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EINVAL), "Got no socket.");
488ab41c 5117
d35fbf6b
DM
5118 socket_fd = params->fds[0];
5119 } else {
5120 socket_fd = -1;
5121 fds = params->fds;
9b141911 5122 n_socket_fds = params->n_socket_fds;
25b583d7 5123 n_storage_fds = params->n_storage_fds;
d35fbf6b 5124 }
94f04347 5125
34cf6c43 5126 r = exec_context_named_iofds(context, params, named_iofds);
52c239d7
LB
5127 if (r < 0)
5128 return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m");
5129
f2341e0a 5130 r = exec_context_load_environment(unit, context, &files_env);
ff0af2a1 5131 if (r < 0)
f2341e0a 5132 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
034c6ed7 5133
4ef15008 5134 line = quote_command_line(command->argv, SHELL_ESCAPE_EMPTY);
d35fbf6b
DM
5135 if (!line)
5136 return log_oom();
fab56fc5 5137
9f71ba8d
ZJS
5138 /* Fork with up-to-date SELinux label database, so the child inherits the up-to-date db
5139 and, until the next SELinux policy changes, we save further reloads in future children. */
2df2152c
CG
5140 mac_selinux_maybe_reload();
5141
c2503e35
RH
5142 log_unit_struct(unit, LOG_DEBUG,
5143 LOG_UNIT_MESSAGE(unit, "About to execute %s", line),
5144 "EXECUTABLE=%s", command->path, /* We won't know the real executable path until we create
5145 the mount namespace in the child, but we want to log
5146 from the parent, so we need to use the (possibly
5147 inaccurate) path here. */
5148 LOG_UNIT_INVOCATION_ID(unit));
12145637 5149
78f93209
LP
5150 if (params->cgroup_path) {
5151 r = exec_parameters_get_cgroup_path(params, &subcgroup_path);
5152 if (r < 0)
5153 return log_unit_error_errno(unit, r, "Failed to acquire subcgroup path: %m");
5154 if (r > 0) { /* We are using a child cgroup */
5155 r = cg_create(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path);
5156 if (r < 0)
5157 return log_unit_error_errno(unit, r, "Failed to create control group '%s': %m", subcgroup_path);
4e806bfa
AZ
5158
5159 /* Normally we would not propagate the oomd xattrs to children but since we created this
5160 * sub-cgroup internally we should do it. */
5161 cgroup_oomd_xattr_apply(unit, subcgroup_path);
78f93209
LP
5162 }
5163 }
5164
d35fbf6b
DM
5165 pid = fork();
5166 if (pid < 0)
74129a12 5167 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
d35fbf6b
DM
5168
5169 if (pid == 0) {
12145637 5170 int exit_status = EXIT_SUCCESS;
ff0af2a1 5171
f2341e0a
LP
5172 r = exec_child(unit,
5173 command,
ff0af2a1
LP
5174 context,
5175 params,
5176 runtime,
29206d46 5177 dcreds,
ff0af2a1 5178 socket_fd,
52c239d7 5179 named_iofds,
4c47affc 5180 fds,
9b141911 5181 n_socket_fds,
25b583d7 5182 n_storage_fds,
ff0af2a1 5183 files_env,
00d9ef85 5184 unit->manager->user_lookup_fds[1],
12145637
LP
5185 &exit_status);
5186
e1714f02
ZJS
5187 if (r < 0) {
5188 const char *status =
5189 exit_status_to_string(exit_status,
e04ed6db 5190 EXIT_STATUS_LIBC | EXIT_STATUS_SYSTEMD);
e1714f02 5191
c2503e35
RH
5192 log_unit_struct_errno(unit, LOG_ERR, r,
5193 "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
5194 LOG_UNIT_INVOCATION_ID(unit),
5195 LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
5196 status, command->path),
5197 "EXECUTABLE=%s", command->path);
e1714f02 5198 }
4c2630eb 5199
ff0af2a1 5200 _exit(exit_status);
034c6ed7
LP
5201 }
5202
f2341e0a 5203 log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
23635a85 5204
78f93209
LP
5205 /* We add the new process to the cgroup both in the child (so that we can be sure that no user code is ever
5206 * executed outside of the cgroup) and in the parent (so that we can be sure that when we kill the cgroup the
5207 * process will be killed too). */
5208 if (subcgroup_path)
5209 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path, pid);
2da3263a 5210
b58b4116 5211 exec_status_start(&command->exec_status, pid);
9fb86720 5212
034c6ed7 5213 *ret = pid;
5cb5a6ff
LP
5214 return 0;
5215}
5216
034c6ed7
LP
5217void exec_context_init(ExecContext *c) {
5218 assert(c);
5219
4c12626c 5220 c->umask = 0022;
0692548c 5221 c->ioprio = IOPRIO_DEFAULT_CLASS_AND_PRIO;
94f04347 5222 c->cpu_sched_policy = SCHED_OTHER;
071830ff 5223 c->syslog_priority = LOG_DAEMON|LOG_INFO;
74922904 5224 c->syslog_level_prefix = true;
353e12c2 5225 c->ignore_sigpipe = true;
3a43da28 5226 c->timer_slack_nsec = NSEC_INFINITY;
050f7277 5227 c->personality = PERSONALITY_INVALID;
5b10116e
ZJS
5228 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++)
5229 c->directories[t].mode = 0755;
12213aed 5230 c->timeout_clean_usec = USEC_INFINITY;
a103496c 5231 c->capability_bounding_set = CAP_ALL;
aa9d574d
YW
5232 assert_cc(NAMESPACE_FLAGS_INITIAL != NAMESPACE_FLAGS_ALL);
5233 c->restrict_namespaces = NAMESPACE_FLAGS_INITIAL;
d3070fbd 5234 c->log_level_max = -1;
005bfaf1
TM
5235#if HAVE_SECCOMP
5236 c->syscall_errno = SECCOMP_ERROR_NUMBER_KILL;
5237#endif
51462135
DDM
5238 c->tty_rows = UINT_MAX;
5239 c->tty_cols = UINT_MAX;
b070c7c0 5240 numa_policy_reset(&c->numa_policy);
034c6ed7
LP
5241}
5242
613b411c 5243void exec_context_done(ExecContext *c) {
5cb5a6ff
LP
5244 assert(c);
5245
6796073e
LP
5246 c->environment = strv_free(c->environment);
5247 c->environment_files = strv_free(c->environment_files);
b4c14404 5248 c->pass_environment = strv_free(c->pass_environment);
00819cc1 5249 c->unset_environment = strv_free(c->unset_environment);
8c7be95e 5250
31ce987c 5251 rlimit_free_all(c->rlimit);
034c6ed7 5252
5b10116e 5253 for (size_t l = 0; l < 3; l++) {
52c239d7 5254 c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);
2038c3f5
LP
5255 c->stdio_file[l] = mfree(c->stdio_file[l]);
5256 }
52c239d7 5257
a1e58e8e
LP
5258 c->working_directory = mfree(c->working_directory);
5259 c->root_directory = mfree(c->root_directory);
915e6d16 5260 c->root_image = mfree(c->root_image);
18d73705 5261 c->root_image_options = mount_options_free_all(c->root_image_options);
0389f4fa
LB
5262 c->root_hash = mfree(c->root_hash);
5263 c->root_hash_size = 0;
5264 c->root_hash_path = mfree(c->root_hash_path);
d4d55b0d
LB
5265 c->root_hash_sig = mfree(c->root_hash_sig);
5266 c->root_hash_sig_size = 0;
5267 c->root_hash_sig_path = mfree(c->root_hash_sig_path);
0389f4fa 5268 c->root_verity = mfree(c->root_verity);
93f59701 5269 c->extension_images = mount_image_free_many(c->extension_images, &c->n_extension_images);
a07b9926 5270 c->extension_directories = strv_free(c->extension_directories);
a1e58e8e
LP
5271 c->tty_path = mfree(c->tty_path);
5272 c->syslog_identifier = mfree(c->syslog_identifier);
5273 c->user = mfree(c->user);
5274 c->group = mfree(c->group);
034c6ed7 5275
6796073e 5276 c->supplementary_groups = strv_free(c->supplementary_groups);
94f04347 5277
a1e58e8e 5278 c->pam_name = mfree(c->pam_name);
5b6319dc 5279
2a624c36
AP
5280 c->read_only_paths = strv_free(c->read_only_paths);
5281 c->read_write_paths = strv_free(c->read_write_paths);
5282 c->inaccessible_paths = strv_free(c->inaccessible_paths);
ddc155b2
TM
5283 c->exec_paths = strv_free(c->exec_paths);
5284 c->no_exec_paths = strv_free(c->no_exec_paths);
8c35c10d 5285 c->exec_search_path = strv_free(c->exec_search_path);
82c121a4 5286
d2d6c096 5287 bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
8e06d57c
YW
5288 c->bind_mounts = NULL;
5289 c->n_bind_mounts = 0;
2abd4e38
YW
5290 temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);
5291 c->temporary_filesystems = NULL;
5292 c->n_temporary_filesystems = 0;
b3d13314 5293 c->mount_images = mount_image_free_many(c->mount_images, &c->n_mount_images);
d2d6c096 5294
0985c7c4 5295 cpu_set_reset(&c->cpu_set);
b070c7c0 5296 numa_policy_reset(&c->numa_policy);
86a3475b 5297
a1e58e8e
LP
5298 c->utmp_id = mfree(c->utmp_id);
5299 c->selinux_context = mfree(c->selinux_context);
5300 c->apparmor_profile = mfree(c->apparmor_profile);
5b8e1b77 5301 c->smack_process_label = mfree(c->smack_process_label);
eef65bf3 5302
b1994387
ILG
5303 c->restrict_filesystems = set_free(c->restrict_filesystems);
5304
8cfa775f 5305 c->syscall_filter = hashmap_free(c->syscall_filter);
525d3cc7
LP
5306 c->syscall_archs = set_free(c->syscall_archs);
5307 c->address_families = set_free(c->address_families);
e66cf1a3 5308
5b10116e 5309 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++)
211a3d87 5310 exec_directory_done(&c->directories[t]);
d3070fbd
LP
5311
5312 c->log_level_max = -1;
5313
5314 exec_context_free_log_extra_fields(c);
08f3be7a 5315
5ac1530e
ZJS
5316 c->log_ratelimit_interval_usec = 0;
5317 c->log_ratelimit_burst = 0;
90fc172e 5318
08f3be7a
LP
5319 c->stdin_data = mfree(c->stdin_data);
5320 c->stdin_data_size = 0;
a8d08f39
LP
5321
5322 c->network_namespace_path = mfree(c->network_namespace_path);
71d1e583 5323 c->ipc_namespace_path = mfree(c->ipc_namespace_path);
91dd5f7c
LP
5324
5325 c->log_namespace = mfree(c->log_namespace);
bb0c0d6f 5326
43144be4 5327 c->load_credentials = hashmap_free(c->load_credentials);
bb0c0d6f 5328 c->set_credentials = hashmap_free(c->set_credentials);
e66cf1a3
LP
5329}
5330
34cf6c43 5331int exec_context_destroy_runtime_directory(const ExecContext *c, const char *runtime_prefix) {
e66cf1a3
LP
5332 assert(c);
5333
5334 if (!runtime_prefix)
5335 return 0;
5336
211a3d87 5337 for (size_t i = 0; i < c->directories[EXEC_DIRECTORY_RUNTIME].n_items; i++) {
c2b2df60 5338 _cleanup_free_ char *p = NULL;
e66cf1a3 5339
494d0247 5340 if (exec_directory_is_private(c, EXEC_DIRECTORY_RUNTIME))
211a3d87 5341 p = path_join(runtime_prefix, "private", c->directories[EXEC_DIRECTORY_RUNTIME].items[i].path);
494d0247 5342 else
211a3d87 5343 p = path_join(runtime_prefix, c->directories[EXEC_DIRECTORY_RUNTIME].items[i].path);
e66cf1a3
LP
5344 if (!p)
5345 return -ENOMEM;
5346
7bc4bf4a
LP
5347 /* We execute this synchronously, since we need to be sure this is gone when we start the
5348 * service next. */
c6878637 5349 (void) rm_rf(p, REMOVE_ROOT);
211a3d87 5350
211a3d87
LB
5351 STRV_FOREACH(symlink, c->directories[EXEC_DIRECTORY_RUNTIME].items[i].symlinks) {
5352 _cleanup_free_ char *symlink_abs = NULL;
5353
5354 if (exec_directory_is_private(c, EXEC_DIRECTORY_RUNTIME))
5355 symlink_abs = path_join(runtime_prefix, "private", *symlink);
5356 else
5357 symlink_abs = path_join(runtime_prefix, *symlink);
5358 if (!symlink_abs)
5359 return -ENOMEM;
5360
5361 (void) unlink(symlink_abs);
5362 }
5363
e66cf1a3
LP
5364 }
5365
5366 return 0;
5cb5a6ff
LP
5367}
5368
bb0c0d6f
LP
5369int exec_context_destroy_credentials(const ExecContext *c, const char *runtime_prefix, const char *unit) {
5370 _cleanup_free_ char *p = NULL;
5371
5372 assert(c);
5373
5374 if (!runtime_prefix || !unit)
5375 return 0;
5376
5377 p = path_join(runtime_prefix, "credentials", unit);
5378 if (!p)
5379 return -ENOMEM;
5380
5381 /* This is either a tmpfs/ramfs of its own, or a plain directory. Either way, let's first try to
5382 * unmount it, and afterwards remove the mount point */
5383 (void) umount2(p, MNT_DETACH|UMOUNT_NOFOLLOW);
5384 (void) rm_rf(p, REMOVE_ROOT|REMOVE_CHMOD);
5385
5386 return 0;
5387}
5388
34cf6c43 5389static void exec_command_done(ExecCommand *c) {
43d0fcbd
LP
5390 assert(c);
5391
a1e58e8e 5392 c->path = mfree(c->path);
6796073e 5393 c->argv = strv_free(c->argv);
43d0fcbd
LP
5394}
5395
da6053d0 5396void exec_command_done_array(ExecCommand *c, size_t n) {
fe96c0f8 5397 for (size_t i = 0; i < n; i++)
43d0fcbd
LP
5398 exec_command_done(c+i);
5399}
5400
f1acf85a 5401ExecCommand* exec_command_free_list(ExecCommand *c) {
5cb5a6ff
LP
5402 ExecCommand *i;
5403
5404 while ((i = c)) {
71fda00f 5405 LIST_REMOVE(command, c, i);
43d0fcbd 5406 exec_command_done(i);
5cb5a6ff
LP
5407 free(i);
5408 }
f1acf85a
ZJS
5409
5410 return NULL;
5cb5a6ff
LP
5411}
5412
da6053d0 5413void exec_command_free_array(ExecCommand **c, size_t n) {
5b10116e 5414 for (size_t i = 0; i < n; i++)
f1acf85a 5415 c[i] = exec_command_free_list(c[i]);
034c6ed7
LP
5416}
5417
6a1d4d9f 5418void exec_command_reset_status_array(ExecCommand *c, size_t n) {
5b10116e 5419 for (size_t i = 0; i < n; i++)
6a1d4d9f
LP
5420 exec_status_reset(&c[i].exec_status);
5421}
5422
5423void exec_command_reset_status_list_array(ExecCommand **c, size_t n) {
03677889 5424 for (size_t i = 0; i < n; i++)
6a1d4d9f
LP
5425 LIST_FOREACH(command, z, c[i])
5426 exec_status_reset(&z->exec_status);
6a1d4d9f
LP
5427}
5428
039f0e70 5429typedef struct InvalidEnvInfo {
34cf6c43 5430 const Unit *unit;
039f0e70
LP
5431 const char *path;
5432} InvalidEnvInfo;
5433
5434static void invalid_env(const char *p, void *userdata) {
5435 InvalidEnvInfo *info = userdata;
5436
f2341e0a 5437 log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
039f0e70
LP
5438}
5439
52c239d7
LB
5440const char* exec_context_fdname(const ExecContext *c, int fd_index) {
5441 assert(c);
5442
5443 switch (fd_index) {
5073ff6b 5444
52c239d7
LB
5445 case STDIN_FILENO:
5446 if (c->std_input != EXEC_INPUT_NAMED_FD)
5447 return NULL;
5073ff6b 5448
52c239d7 5449 return c->stdio_fdname[STDIN_FILENO] ?: "stdin";
5073ff6b 5450
52c239d7
LB
5451 case STDOUT_FILENO:
5452 if (c->std_output != EXEC_OUTPUT_NAMED_FD)
5453 return NULL;
5073ff6b 5454
52c239d7 5455 return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";
5073ff6b 5456
52c239d7
LB
5457 case STDERR_FILENO:
5458 if (c->std_error != EXEC_OUTPUT_NAMED_FD)
5459 return NULL;
5073ff6b 5460
52c239d7 5461 return c->stdio_fdname[STDERR_FILENO] ?: "stderr";
5073ff6b 5462
52c239d7
LB
5463 default:
5464 return NULL;
5465 }
5466}
5467
2caa38e9
LP
5468static int exec_context_named_iofds(
5469 const ExecContext *c,
5470 const ExecParameters *p,
5471 int named_iofds[static 3]) {
5472
5b10116e 5473 size_t targets;
56fbd561 5474 const char* stdio_fdname[3];
da6053d0 5475 size_t n_fds;
52c239d7
LB
5476
5477 assert(c);
5478 assert(p);
2caa38e9 5479 assert(named_iofds);
52c239d7
LB
5480
5481 targets = (c->std_input == EXEC_INPUT_NAMED_FD) +
5482 (c->std_output == EXEC_OUTPUT_NAMED_FD) +
5483 (c->std_error == EXEC_OUTPUT_NAMED_FD);
5484
5b10116e 5485 for (size_t i = 0; i < 3; i++)
52c239d7
LB
5486 stdio_fdname[i] = exec_context_fdname(c, i);
5487
4c47affc
FB
5488 n_fds = p->n_storage_fds + p->n_socket_fds;
5489
5b10116e 5490 for (size_t i = 0; i < n_fds && targets > 0; i++)
56fbd561
ZJS
5491 if (named_iofds[STDIN_FILENO] < 0 &&
5492 c->std_input == EXEC_INPUT_NAMED_FD &&
5493 stdio_fdname[STDIN_FILENO] &&
5494 streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) {
5495
52c239d7
LB
5496 named_iofds[STDIN_FILENO] = p->fds[i];
5497 targets--;
56fbd561
ZJS
5498
5499 } else if (named_iofds[STDOUT_FILENO] < 0 &&
5500 c->std_output == EXEC_OUTPUT_NAMED_FD &&
5501 stdio_fdname[STDOUT_FILENO] &&
5502 streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) {
5503
52c239d7
LB
5504 named_iofds[STDOUT_FILENO] = p->fds[i];
5505 targets--;
56fbd561
ZJS
5506
5507 } else if (named_iofds[STDERR_FILENO] < 0 &&
5508 c->std_error == EXEC_OUTPUT_NAMED_FD &&
5509 stdio_fdname[STDERR_FILENO] &&
5510 streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) {
5511
52c239d7
LB
5512 named_iofds[STDERR_FILENO] = p->fds[i];
5513 targets--;
5514 }
5515
56fbd561 5516 return targets == 0 ? 0 : -ENOENT;
52c239d7
LB
5517}
5518
398a5009
ZJS
5519static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***ret) {
5520 _cleanup_strv_free_ char **v = NULL;
398a5009 5521 int r;
8c7be95e
LP
5522
5523 assert(c);
398a5009 5524 assert(ret);
8c7be95e
LP
5525
5526 STRV_FOREACH(i, c->environment_files) {
7fd1b19b 5527 _cleanup_globfree_ glob_t pglob = {};
398a5009
ZJS
5528 bool ignore = false;
5529 char *fn = *i;
8c7be95e
LP
5530
5531 if (fn[0] == '-') {
5532 ignore = true;
313cefa1 5533 fn++;
8c7be95e
LP
5534 }
5535
5536 if (!path_is_absolute(fn)) {
8c7be95e
LP
5537 if (ignore)
5538 continue;
8c7be95e
LP
5539 return -EINVAL;
5540 }
5541
2bef10ab 5542 /* Filename supports globbing, take all matching files */
398a5009
ZJS
5543 r = safe_glob(fn, 0, &pglob);
5544 if (r < 0) {
2bef10ab
PL
5545 if (ignore)
5546 continue;
398a5009 5547 return r;
2bef10ab 5548 }
8c7be95e 5549
d8c92e8b
ZJS
5550 /* When we don't match anything, -ENOENT should be returned */
5551 assert(pglob.gl_pathc > 0);
5552
5b10116e 5553 for (unsigned n = 0; n < pglob.gl_pathc; n++) {
398a5009
ZJS
5554 _cleanup_strv_free_ char **p = NULL;
5555
5556 r = load_env_file(NULL, pglob.gl_pathv[n], &p);
5557 if (r < 0) {
2bef10ab
PL
5558 if (ignore)
5559 continue;
398a5009 5560 return r;
e9c1ea9d 5561 }
398a5009 5562
ebc05a09 5563 /* Log invalid environment variables with filename */
039f0e70
LP
5564 if (p) {
5565 InvalidEnvInfo info = {
f2341e0a 5566 .unit = unit,
039f0e70
LP
5567 .path = pglob.gl_pathv[n]
5568 };
5569
5570 p = strv_env_clean_with_callback(p, invalid_env, &info);
5571 }
8c7be95e 5572
398a5009
ZJS
5573 if (!v)
5574 v = TAKE_PTR(p);
2bef10ab 5575 else {
398a5009 5576 char **m = strv_env_merge(v, p);
c84a9488 5577 if (!m)
2bef10ab 5578 return -ENOMEM;
2bef10ab 5579
398a5009 5580 strv_free_and_replace(v, m);
2bef10ab 5581 }
8c7be95e
LP
5582 }
5583 }
5584
398a5009 5585 *ret = TAKE_PTR(v);
8c7be95e
LP
5586
5587 return 0;
5588}
5589
6ac8fdc9 5590static bool tty_may_match_dev_console(const char *tty) {
7b912648 5591 _cleanup_free_ char *resolved = NULL;
6ac8fdc9 5592
1e22b5cd
LP
5593 if (!tty)
5594 return true;
5595
a119ec7c 5596 tty = skip_dev_prefix(tty);
6ac8fdc9
MS
5597
5598 /* trivial identity? */
5599 if (streq(tty, "console"))
5600 return true;
5601
7b912648
LP
5602 if (resolve_dev_console(&resolved) < 0)
5603 return true; /* if we could not resolve, assume it may */
6ac8fdc9
MS
5604
5605 /* "tty0" means the active VC, so it may be the same sometimes */
955f1c85 5606 return path_equal(resolved, tty) || (streq(resolved, "tty0") && tty_is_vc(tty));
6ac8fdc9
MS
5607}
5608
6c0ae739
LP
5609static bool exec_context_may_touch_tty(const ExecContext *ec) {
5610 assert(ec);
1e22b5cd 5611
6c0ae739 5612 return ec->tty_reset ||
1e22b5cd
LP
5613 ec->tty_vhangup ||
5614 ec->tty_vt_disallocate ||
6ac8fdc9
MS
5615 is_terminal_input(ec->std_input) ||
5616 is_terminal_output(ec->std_output) ||
6c0ae739
LP
5617 is_terminal_output(ec->std_error);
5618}
5619
5620bool exec_context_may_touch_console(const ExecContext *ec) {
5621
5622 return exec_context_may_touch_tty(ec) &&
1e22b5cd 5623 tty_may_match_dev_console(exec_context_tty_path(ec));
6ac8fdc9
MS
5624}
5625
15ae422b 5626static void strv_fprintf(FILE *f, char **l) {
15ae422b
LP
5627 assert(f);
5628
5629 STRV_FOREACH(g, l)
5630 fprintf(f, " %s", *g);
5631}
5632
ddc155b2
TM
5633static void strv_dump(FILE* f, const char *prefix, const char *name, char **strv) {
5634 assert(f);
5635 assert(prefix);
5636 assert(name);
5637
5638 if (!strv_isempty(strv)) {
a7bd1656 5639 fprintf(f, "%s%s:", prefix, name);
ddc155b2
TM
5640 strv_fprintf(f, strv);
5641 fputs("\n", f);
5642 }
5643}
5644
34cf6c43 5645void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
add00535 5646 int r;
9eba9da4 5647
5cb5a6ff
LP
5648 assert(c);
5649 assert(f);
5650
4ad49000 5651 prefix = strempty(prefix);
5cb5a6ff
LP
5652
5653 fprintf(f,
94f04347
LP
5654 "%sUMask: %04o\n"
5655 "%sWorkingDirectory: %s\n"
451a074f 5656 "%sRootDirectory: %s\n"
15ae422b 5657 "%sNonBlocking: %s\n"
64747e2d 5658 "%sPrivateTmp: %s\n"
7f112f50 5659 "%sPrivateDevices: %s\n"
59eeb84b 5660 "%sProtectKernelTunables: %s\n"
e66a2f65 5661 "%sProtectKernelModules: %s\n"
84703040 5662 "%sProtectKernelLogs: %s\n"
fc64760d 5663 "%sProtectClock: %s\n"
59eeb84b 5664 "%sProtectControlGroups: %s\n"
d251207d
LP
5665 "%sPrivateNetwork: %s\n"
5666 "%sPrivateUsers: %s\n"
1b8689f9
LP
5667 "%sProtectHome: %s\n"
5668 "%sProtectSystem: %s\n"
5d997827 5669 "%sMountAPIVFS: %s\n"
f3e43635 5670 "%sIgnoreSIGPIPE: %s\n"
f4170c67 5671 "%sMemoryDenyWriteExecute: %s\n"
b1edf445 5672 "%sRestrictRealtime: %s\n"
f69567cb 5673 "%sRestrictSUIDSGID: %s\n"
aecd5ac6 5674 "%sKeyringMode: %s\n"
4e399953
LP
5675 "%sProtectHostname: %s\n"
5676 "%sProtectProc: %s\n"
5677 "%sProcSubset: %s\n",
5cb5a6ff 5678 prefix, c->umask,
14eb3285
LP
5679 prefix, empty_to_root(c->working_directory),
5680 prefix, empty_to_root(c->root_directory),
15ae422b 5681 prefix, yes_no(c->non_blocking),
64747e2d 5682 prefix, yes_no(c->private_tmp),
7f112f50 5683 prefix, yes_no(c->private_devices),
59eeb84b 5684 prefix, yes_no(c->protect_kernel_tunables),
e66a2f65 5685 prefix, yes_no(c->protect_kernel_modules),
84703040 5686 prefix, yes_no(c->protect_kernel_logs),
fc64760d 5687 prefix, yes_no(c->protect_clock),
59eeb84b 5688 prefix, yes_no(c->protect_control_groups),
d251207d
LP
5689 prefix, yes_no(c->private_network),
5690 prefix, yes_no(c->private_users),
1b8689f9
LP
5691 prefix, protect_home_to_string(c->protect_home),
5692 prefix, protect_system_to_string(c->protect_system),
5e98086d 5693 prefix, yes_no(exec_context_get_effective_mount_apivfs(c)),
f3e43635 5694 prefix, yes_no(c->ignore_sigpipe),
f4170c67 5695 prefix, yes_no(c->memory_deny_write_execute),
b1edf445 5696 prefix, yes_no(c->restrict_realtime),
f69567cb 5697 prefix, yes_no(c->restrict_suid_sgid),
aecd5ac6 5698 prefix, exec_keyring_mode_to_string(c->keyring_mode),
4e399953
LP
5699 prefix, yes_no(c->protect_hostname),
5700 prefix, protect_proc_to_string(c->protect_proc),
5701 prefix, proc_subset_to_string(c->proc_subset));
fb33a393 5702
915e6d16
LP
5703 if (c->root_image)
5704 fprintf(f, "%sRootImage: %s\n", prefix, c->root_image);
5705
18d73705 5706 if (c->root_image_options) {
18d73705
LB
5707 fprintf(f, "%sRootImageOptions:", prefix);
5708 LIST_FOREACH(mount_options, o, c->root_image_options)
5709 if (!isempty(o->options))
9ece6444
LB
5710 fprintf(f, " %s:%s",
5711 partition_designator_to_string(o->partition_designator),
5712 o->options);
18d73705
LB
5713 fprintf(f, "\n");
5714 }
5715
0389f4fa
LB
5716 if (c->root_hash) {
5717 _cleanup_free_ char *encoded = NULL;
5718 encoded = hexmem(c->root_hash, c->root_hash_size);
5719 if (encoded)
5720 fprintf(f, "%sRootHash: %s\n", prefix, encoded);
5721 }
5722
5723 if (c->root_hash_path)
5724 fprintf(f, "%sRootHash: %s\n", prefix, c->root_hash_path);
5725
d4d55b0d
LB
5726 if (c->root_hash_sig) {
5727 _cleanup_free_ char *encoded = NULL;
5728 ssize_t len;
5729 len = base64mem(c->root_hash_sig, c->root_hash_sig_size, &encoded);
5730 if (len)
5731 fprintf(f, "%sRootHashSignature: base64:%s\n", prefix, encoded);
5732 }
5733
5734 if (c->root_hash_sig_path)
5735 fprintf(f, "%sRootHashSignature: %s\n", prefix, c->root_hash_sig_path);
5736
0389f4fa
LB
5737 if (c->root_verity)
5738 fprintf(f, "%sRootVerity: %s\n", prefix, c->root_verity);
5739
8c7be95e
LP
5740 STRV_FOREACH(e, c->environment)
5741 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
5742
5743 STRV_FOREACH(e, c->environment_files)
5744 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
94f04347 5745
b4c14404
FB
5746 STRV_FOREACH(e, c->pass_environment)
5747 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
5748
00819cc1
LP
5749 STRV_FOREACH(e, c->unset_environment)
5750 fprintf(f, "%sUnsetEnvironment: %s\n", prefix, *e);
5751
53f47dfc
YW
5752 fprintf(f, "%sRuntimeDirectoryPreserve: %s\n", prefix, exec_preserve_mode_to_string(c->runtime_directory_preserve_mode));
5753
5b10116e 5754 for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
3536f49e
YW
5755 fprintf(f, "%s%sMode: %04o\n", prefix, exec_directory_type_to_string(dt), c->directories[dt].mode);
5756
211a3d87
LB
5757 for (size_t i = 0; i < c->directories[dt].n_items; i++) {
5758 fprintf(f, "%s%s: %s\n", prefix, exec_directory_type_to_string(dt), c->directories[dt].items[i].path);
5759
5760 STRV_FOREACH(d, c->directories[dt].items[i].symlinks)
5761 fprintf(f, "%s%s: %s:%s\n", prefix, exec_directory_type_symlink_to_string(dt), c->directories[dt].items[i].path, *d);
5762 }
3536f49e 5763 }
c2bbd90b 5764
5291f26d 5765 fprintf(f, "%sTimeoutCleanSec: %s\n", prefix, FORMAT_TIMESPAN(c->timeout_clean_usec, USEC_PER_SEC));
12213aed 5766
fb33a393 5767 if (c->nice_set)
5291f26d 5768 fprintf(f, "%sNice: %i\n", prefix, c->nice);
fb33a393 5769
dd6c17b1 5770 if (c->oom_score_adjust_set)
5291f26d 5771 fprintf(f, "%sOOMScoreAdjust: %i\n", prefix, c->oom_score_adjust);
9eba9da4 5772
ad21e542 5773 if (c->coredump_filter_set)
5291f26d 5774 fprintf(f, "%sCoredumpFilter: 0x%"PRIx64"\n", prefix, c->coredump_filter);
ad21e542 5775
5b10116e 5776 for (unsigned i = 0; i < RLIM_NLIMITS; i++)
3c11da9d 5777 if (c->rlimit[i]) {
4c3a2b84 5778 fprintf(f, "%sLimit%s: " RLIM_FMT "\n",
3c11da9d 5779 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
4c3a2b84 5780 fprintf(f, "%sLimit%sSoft: " RLIM_FMT "\n",
3c11da9d
EV
5781 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
5782 }
94f04347 5783
f8b69d1d 5784 if (c->ioprio_set) {
1756a011 5785 _cleanup_free_ char *class_str = NULL;
f8b69d1d 5786
5bead76e 5787 r = ioprio_class_to_string_alloc(ioprio_prio_class(c->ioprio), &class_str);
837df140
YW
5788 if (r >= 0)
5789 fprintf(f, "%sIOSchedulingClass: %s\n", prefix, class_str);
5790
5bead76e 5791 fprintf(f, "%sIOPriority: %d\n", prefix, ioprio_prio_data(c->ioprio));
f8b69d1d 5792 }
94f04347 5793
f8b69d1d 5794 if (c->cpu_sched_set) {
1756a011 5795 _cleanup_free_ char *policy_str = NULL;
f8b69d1d 5796
837df140
YW
5797 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
5798 if (r >= 0)
5799 fprintf(f, "%sCPUSchedulingPolicy: %s\n", prefix, policy_str);
5800
94f04347 5801 fprintf(f,
38b48754
LP
5802 "%sCPUSchedulingPriority: %i\n"
5803 "%sCPUSchedulingResetOnFork: %s\n",
38b48754
LP
5804 prefix, c->cpu_sched_priority,
5805 prefix, yes_no(c->cpu_sched_reset_on_fork));
b929bf04 5806 }
94f04347 5807
0985c7c4 5808 if (c->cpu_set.set) {
e7fca352
MS
5809 _cleanup_free_ char *affinity = NULL;
5810
5811 affinity = cpu_set_to_range_string(&c->cpu_set);
5812 fprintf(f, "%sCPUAffinity: %s\n", prefix, affinity);
94f04347
LP
5813 }
5814
b070c7c0
MS
5815 if (mpol_is_valid(numa_policy_get_type(&c->numa_policy))) {
5816 _cleanup_free_ char *nodes = NULL;
5817
5818 nodes = cpu_set_to_range_string(&c->numa_policy.nodes);
5819 fprintf(f, "%sNUMAPolicy: %s\n", prefix, mpol_to_string(numa_policy_get_type(&c->numa_policy)));
5820 fprintf(f, "%sNUMAMask: %s\n", prefix, strnull(nodes));
5821 }
5822
3a43da28 5823 if (c->timer_slack_nsec != NSEC_INFINITY)
ccd06097 5824 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
94f04347
LP
5825
5826 fprintf(f,
80876c20
LP
5827 "%sStandardInput: %s\n"
5828 "%sStandardOutput: %s\n"
5829 "%sStandardError: %s\n",
5830 prefix, exec_input_to_string(c->std_input),
5831 prefix, exec_output_to_string(c->std_output),
5832 prefix, exec_output_to_string(c->std_error));
5833
befc4a80
LP
5834 if (c->std_input == EXEC_INPUT_NAMED_FD)
5835 fprintf(f, "%sStandardInputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDIN_FILENO]);
5836 if (c->std_output == EXEC_OUTPUT_NAMED_FD)
5837 fprintf(f, "%sStandardOutputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDOUT_FILENO]);
5838 if (c->std_error == EXEC_OUTPUT_NAMED_FD)
5839 fprintf(f, "%sStandardErrorFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDERR_FILENO]);
5840
5841 if (c->std_input == EXEC_INPUT_FILE)
5842 fprintf(f, "%sStandardInputFile: %s\n", prefix, c->stdio_file[STDIN_FILENO]);
5843 if (c->std_output == EXEC_OUTPUT_FILE)
5844 fprintf(f, "%sStandardOutputFile: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
566b7d23
ZD
5845 if (c->std_output == EXEC_OUTPUT_FILE_APPEND)
5846 fprintf(f, "%sStandardOutputFileToAppend: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
8d7dab1f
LW
5847 if (c->std_output == EXEC_OUTPUT_FILE_TRUNCATE)
5848 fprintf(f, "%sStandardOutputFileToTruncate: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
befc4a80
LP
5849 if (c->std_error == EXEC_OUTPUT_FILE)
5850 fprintf(f, "%sStandardErrorFile: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
566b7d23
ZD
5851 if (c->std_error == EXEC_OUTPUT_FILE_APPEND)
5852 fprintf(f, "%sStandardErrorFileToAppend: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
8d7dab1f
LW
5853 if (c->std_error == EXEC_OUTPUT_FILE_TRUNCATE)
5854 fprintf(f, "%sStandardErrorFileToTruncate: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
befc4a80 5855
80876c20
LP
5856 if (c->tty_path)
5857 fprintf(f,
6ea832a2
LP
5858 "%sTTYPath: %s\n"
5859 "%sTTYReset: %s\n"
5860 "%sTTYVHangup: %s\n"
51462135
DDM
5861 "%sTTYVTDisallocate: %s\n"
5862 "%sTTYRows: %u\n"
5863 "%sTTYColumns: %u\n",
6ea832a2
LP
5864 prefix, c->tty_path,
5865 prefix, yes_no(c->tty_reset),
5866 prefix, yes_no(c->tty_vhangup),
51462135
DDM
5867 prefix, yes_no(c->tty_vt_disallocate),
5868 prefix, c->tty_rows,
5869 prefix, c->tty_cols);
94f04347 5870
9f6444eb 5871 if (IN_SET(c->std_output,
9f6444eb
LP
5872 EXEC_OUTPUT_KMSG,
5873 EXEC_OUTPUT_JOURNAL,
9f6444eb
LP
5874 EXEC_OUTPUT_KMSG_AND_CONSOLE,
5875 EXEC_OUTPUT_JOURNAL_AND_CONSOLE) ||
5876 IN_SET(c->std_error,
9f6444eb
LP
5877 EXEC_OUTPUT_KMSG,
5878 EXEC_OUTPUT_JOURNAL,
9f6444eb
LP
5879 EXEC_OUTPUT_KMSG_AND_CONSOLE,
5880 EXEC_OUTPUT_JOURNAL_AND_CONSOLE)) {
f8b69d1d 5881
5ce70e5b 5882 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
f8b69d1d 5883
837df140
YW
5884 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
5885 if (r >= 0)
5886 fprintf(f, "%sSyslogFacility: %s\n", prefix, fac_str);
f8b69d1d 5887
837df140
YW
5888 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
5889 if (r >= 0)
5890 fprintf(f, "%sSyslogLevel: %s\n", prefix, lvl_str);
f8b69d1d 5891 }
94f04347 5892
d3070fbd
LP
5893 if (c->log_level_max >= 0) {
5894 _cleanup_free_ char *t = NULL;
5895
5896 (void) log_level_to_string_alloc(c->log_level_max, &t);
5897
5898 fprintf(f, "%sLogLevelMax: %s\n", prefix, strna(t));
5899 }
5900
5291f26d 5901 if (c->log_ratelimit_interval_usec > 0)
90fc172e
AZ
5902 fprintf(f,
5903 "%sLogRateLimitIntervalSec: %s\n",
5291f26d 5904 prefix, FORMAT_TIMESPAN(c->log_ratelimit_interval_usec, USEC_PER_SEC));
90fc172e 5905
5ac1530e
ZJS
5906 if (c->log_ratelimit_burst > 0)
5907 fprintf(f, "%sLogRateLimitBurst: %u\n", prefix, c->log_ratelimit_burst);
90fc172e 5908
5b10116e
ZJS
5909 for (size_t j = 0; j < c->n_log_extra_fields; j++) {
5910 fprintf(f, "%sLogExtraFields: ", prefix);
5911 fwrite(c->log_extra_fields[j].iov_base,
5912 1, c->log_extra_fields[j].iov_len,
5913 f);
5914 fputc('\n', f);
d3070fbd
LP
5915 }
5916
91dd5f7c
LP
5917 if (c->log_namespace)
5918 fprintf(f, "%sLogNamespace: %s\n", prefix, c->log_namespace);
5919
07d46372
YW
5920 if (c->secure_bits) {
5921 _cleanup_free_ char *str = NULL;
5922
5923 r = secure_bits_to_string_alloc(c->secure_bits, &str);
5924 if (r >= 0)
5925 fprintf(f, "%sSecure Bits: %s\n", prefix, str);
5926 }
94f04347 5927
a103496c 5928 if (c->capability_bounding_set != CAP_ALL) {
dd1f5bd0 5929 _cleanup_free_ char *str = NULL;
94f04347 5930
dd1f5bd0
YW
5931 r = capability_set_to_string_alloc(c->capability_bounding_set, &str);
5932 if (r >= 0)
5933 fprintf(f, "%sCapabilityBoundingSet: %s\n", prefix, str);
755d4b67
IP
5934 }
5935
5936 if (c->capability_ambient_set != 0) {
dd1f5bd0 5937 _cleanup_free_ char *str = NULL;
755d4b67 5938
dd1f5bd0
YW
5939 r = capability_set_to_string_alloc(c->capability_ambient_set, &str);
5940 if (r >= 0)
5941 fprintf(f, "%sAmbientCapabilities: %s\n", prefix, str);
94f04347
LP
5942 }
5943
5944 if (c->user)
f2d3769a 5945 fprintf(f, "%sUser: %s\n", prefix, c->user);
94f04347 5946 if (c->group)
f2d3769a 5947 fprintf(f, "%sGroup: %s\n", prefix, c->group);
94f04347 5948
29206d46
LP
5949 fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
5950
ddc155b2 5951 strv_dump(f, prefix, "SupplementaryGroups", c->supplementary_groups);
94f04347 5952
5b6319dc 5953 if (c->pam_name)
f2d3769a 5954 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
5b6319dc 5955
ddc155b2
TM
5956 strv_dump(f, prefix, "ReadWritePaths", c->read_write_paths);
5957 strv_dump(f, prefix, "ReadOnlyPaths", c->read_only_paths);
5958 strv_dump(f, prefix, "InaccessiblePaths", c->inaccessible_paths);
5959 strv_dump(f, prefix, "ExecPaths", c->exec_paths);
5960 strv_dump(f, prefix, "NoExecPaths", c->no_exec_paths);
8c35c10d 5961 strv_dump(f, prefix, "ExecSearchPath", c->exec_search_path);
2e22afe9 5962
5b10116e
ZJS
5963 for (size_t i = 0; i < c->n_bind_mounts; i++)
5964 fprintf(f, "%s%s: %s%s:%s:%s\n", prefix,
5965 c->bind_mounts[i].read_only ? "BindReadOnlyPaths" : "BindPaths",
5966 c->bind_mounts[i].ignore_enoent ? "-": "",
5967 c->bind_mounts[i].source,
5968 c->bind_mounts[i].destination,
5969 c->bind_mounts[i].recursive ? "rbind" : "norbind");
d2d6c096 5970
5b10116e
ZJS
5971 for (size_t i = 0; i < c->n_temporary_filesystems; i++) {
5972 const TemporaryFileSystem *t = c->temporary_filesystems + i;
2abd4e38 5973
5b10116e
ZJS
5974 fprintf(f, "%sTemporaryFileSystem: %s%s%s\n", prefix,
5975 t->path,
5976 isempty(t->options) ? "" : ":",
5977 strempty(t->options));
5978 }
2abd4e38 5979
169c1bda
LP
5980 if (c->utmp_id)
5981 fprintf(f,
5982 "%sUtmpIdentifier: %s\n",
5983 prefix, c->utmp_id);
7b52a628
MS
5984
5985 if (c->selinux_context)
5986 fprintf(f,
5f8640fb
LP
5987 "%sSELinuxContext: %s%s\n",
5988 prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
17df7223 5989
80c21aea
WC
5990 if (c->apparmor_profile)
5991 fprintf(f,
5992 "%sAppArmorProfile: %s%s\n",
5993 prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
5994
5995 if (c->smack_process_label)
5996 fprintf(f,
5997 "%sSmackProcessLabel: %s%s\n",
5998 prefix, c->smack_process_label_ignore ? "-" : "", c->smack_process_label);
5999
050f7277 6000 if (c->personality != PERSONALITY_INVALID)
ac45f971
LP
6001 fprintf(f,
6002 "%sPersonality: %s\n",
6003 prefix, strna(personality_to_string(c->personality)));
6004
78e864e5
TM
6005 fprintf(f,
6006 "%sLockPersonality: %s\n",
6007 prefix, yes_no(c->lock_personality));
6008
17df7223 6009 if (c->syscall_filter) {
349cc4a5 6010#if HAVE_SECCOMP
8cfa775f 6011 void *id, *val;
17df7223 6012 bool first = true;
351a19b1 6013#endif
17df7223
LP
6014
6015 fprintf(f,
57183d11 6016 "%sSystemCallFilter: ",
17df7223
LP
6017 prefix);
6018
6b000af4 6019 if (!c->syscall_allow_list)
17df7223
LP
6020 fputc('~', f);
6021
349cc4a5 6022#if HAVE_SECCOMP
90e74a66 6023 HASHMAP_FOREACH_KEY(val, id, c->syscall_filter) {
17df7223 6024 _cleanup_free_ char *name = NULL;
8cfa775f
YW
6025 const char *errno_name = NULL;
6026 int num = PTR_TO_INT(val);
17df7223
LP
6027
6028 if (first)
6029 first = false;
6030 else
6031 fputc(' ', f);
6032
57183d11 6033 name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
17df7223 6034 fputs(strna(name), f);
8cfa775f
YW
6035
6036 if (num >= 0) {
005bfaf1 6037 errno_name = seccomp_errno_or_action_to_string(num);
8cfa775f
YW
6038 if (errno_name)
6039 fprintf(f, ":%s", errno_name);
6040 else
6041 fprintf(f, ":%d", num);
6042 }
17df7223 6043 }
351a19b1 6044#endif
17df7223
LP
6045
6046 fputc('\n', f);
6047 }
6048
57183d11 6049 if (c->syscall_archs) {
349cc4a5 6050#if HAVE_SECCOMP
57183d11
LP
6051 void *id;
6052#endif
6053
6054 fprintf(f,
6055 "%sSystemCallArchitectures:",
6056 prefix);
6057
349cc4a5 6058#if HAVE_SECCOMP
90e74a66 6059 SET_FOREACH(id, c->syscall_archs)
57183d11
LP
6060 fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
6061#endif
6062 fputc('\n', f);
6063 }
6064
add00535
LP
6065 if (exec_context_restrict_namespaces_set(c)) {
6066 _cleanup_free_ char *s = NULL;
6067
86c2a9f1 6068 r = namespace_flags_to_string(c->restrict_namespaces, &s);
add00535
LP
6069 if (r >= 0)
6070 fprintf(f, "%sRestrictNamespaces: %s\n",
dd0395b5 6071 prefix, strna(s));
add00535
LP
6072 }
6073
b1994387 6074#if HAVE_LIBBPF
8fe84dc8
YW
6075 if (exec_context_restrict_filesystems_set(c)) {
6076 char *fs;
6077 SET_FOREACH(fs, c->restrict_filesystems)
6078 fprintf(f, "%sRestrictFileSystems: %s\n", prefix, fs);
6079 }
b1994387
ILG
6080#endif
6081
a8d08f39
LP
6082 if (c->network_namespace_path)
6083 fprintf(f,
6084 "%sNetworkNamespacePath: %s\n",
6085 prefix, c->network_namespace_path);
6086
3df90f24 6087 if (c->syscall_errno > 0) {
005bfaf1 6088#if HAVE_SECCOMP
3df90f24 6089 const char *errno_name;
005bfaf1 6090#endif
3df90f24
YW
6091
6092 fprintf(f, "%sSystemCallErrorNumber: ", prefix);
6093
005bfaf1
TM
6094#if HAVE_SECCOMP
6095 errno_name = seccomp_errno_or_action_to_string(c->syscall_errno);
3df90f24 6096 if (errno_name)
005bfaf1 6097 fputs(errno_name, f);
3df90f24 6098 else
005bfaf1
TM
6099 fprintf(f, "%d", c->syscall_errno);
6100#endif
6101 fputc('\n', f);
3df90f24 6102 }
b3d13314 6103
5b10116e 6104 for (size_t i = 0; i < c->n_mount_images; i++) {
79e20ceb 6105 fprintf(f, "%sMountImages: %s%s:%s", prefix,
b3d13314
LB
6106 c->mount_images[i].ignore_enoent ? "-": "",
6107 c->mount_images[i].source,
79e20ceb 6108 c->mount_images[i].destination);
427353f6 6109 LIST_FOREACH(mount_options, o, c->mount_images[i].mount_options)
79e20ceb 6110 fprintf(f, ":%s:%s",
427353f6 6111 partition_designator_to_string(o->partition_designator),
79e20ceb 6112 strempty(o->options));
427353f6
LB
6113 fprintf(f, "\n");
6114 }
93f59701
LB
6115
6116 for (size_t i = 0; i < c->n_extension_images; i++) {
93f59701
LB
6117 fprintf(f, "%sExtensionImages: %s%s", prefix,
6118 c->extension_images[i].ignore_enoent ? "-": "",
6119 c->extension_images[i].source);
6120 LIST_FOREACH(mount_options, o, c->extension_images[i].mount_options)
6121 fprintf(f, ":%s:%s",
6122 partition_designator_to_string(o->partition_designator),
6123 strempty(o->options));
6124 fprintf(f, "\n");
6125 }
a07b9926
LB
6126
6127 strv_dump(f, prefix, "ExtensionDirectories", c->extension_directories);
5cb5a6ff
LP
6128}
6129
34cf6c43 6130bool exec_context_maintains_privileges(const ExecContext *c) {
a931ad47
LP
6131 assert(c);
6132
61233823 6133 /* Returns true if the process forked off would run under
a931ad47
LP
6134 * an unchanged UID or as root. */
6135
6136 if (!c->user)
6137 return true;
6138
6139 if (streq(c->user, "root") || streq(c->user, "0"))
6140 return true;
6141
6142 return false;
6143}
6144
34cf6c43 6145int exec_context_get_effective_ioprio(const ExecContext *c) {
7f452159
LP
6146 int p;
6147
6148 assert(c);
6149
6150 if (c->ioprio_set)
6151 return c->ioprio;
6152
6153 p = ioprio_get(IOPRIO_WHO_PROCESS, 0);
6154 if (p < 0)
0692548c 6155 return IOPRIO_DEFAULT_CLASS_AND_PRIO;
7f452159 6156
8b330d7d 6157 return ioprio_normalize(p);
7f452159
LP
6158}
6159
5e98086d
ZJS
6160bool exec_context_get_effective_mount_apivfs(const ExecContext *c) {
6161 assert(c);
6162
61198784 6163 /* Explicit setting wins */
5e98086d
ZJS
6164 if (c->mount_apivfs_set)
6165 return c->mount_apivfs;
6166
61198784 6167 /* Default to "yes" if root directory or image are specified */
74e12520 6168 if (exec_context_with_rootfs(c))
61198784
ZJS
6169 return true;
6170
5e98086d
ZJS
6171 return false;
6172}
6173
d3070fbd 6174void exec_context_free_log_extra_fields(ExecContext *c) {
d3070fbd
LP
6175 assert(c);
6176
5b10116e 6177 for (size_t l = 0; l < c->n_log_extra_fields; l++)
d3070fbd
LP
6178 free(c->log_extra_fields[l].iov_base);
6179 c->log_extra_fields = mfree(c->log_extra_fields);
6180 c->n_log_extra_fields = 0;
6181}
6182
6f765baf 6183void exec_context_revert_tty(ExecContext *c) {
0ba976e8
LP
6184 _cleanup_close_ int fd = -1;
6185 const char *path;
6186 struct stat st;
6f765baf
LP
6187 int r;
6188
6189 assert(c);
6190
6191 /* First, reset the TTY (possibly kicking everybody else from the TTY) */
6192 exec_context_tty_reset(c, NULL);
6193
6194 /* And then undo what chown_terminal() did earlier. Note that we only do this if we have a path
6195 * configured. If the TTY was passed to us as file descriptor we assume the TTY is opened and managed
6196 * by whoever passed it to us and thus knows better when and how to chmod()/chown() it back. */
0ba976e8
LP
6197 if (!exec_context_may_touch_tty(c))
6198 return;
6f765baf 6199
0ba976e8
LP
6200 path = exec_context_tty_path(c);
6201 if (!path)
6202 return;
6f765baf 6203
0ba976e8
LP
6204 fd = open(path, O_PATH|O_CLOEXEC);
6205 if (fd < 0)
6206 return (void) log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno,
6207 "Failed to open TTY inode of '%s' to adjust ownership/access mode, ignoring: %m",
6208 path);
6209
6210 if (fstat(fd, &st) < 0)
6211 return (void) log_warning_errno(errno, "Failed to stat TTY '%s', ignoring: %m", path);
6212
6213 /* Let's add a superficial check that we only do this for stuff that looks like a TTY. We only check
6214 * if things are a character device, since a proper check either means we'd have to open the TTY and
6215 * use isatty(), but we'd rather not do that since opening TTYs comes with all kinds of side-effects
6216 * and is slow. Or we'd have to hardcode dev_t major information, which we'd rather avoid. Why bother
6217 * with this at all? → https://github.com/systemd/systemd/issues/19213 */
6218 if (!S_ISCHR(st.st_mode))
6219 return log_warning("Configured TTY '%s' is not actually a character device, ignoring.", path);
6220
6221 r = fchmod_and_chown(fd, TTY_MODE, 0, TTY_GID);
6222 if (r < 0)
6223 log_warning_errno(r, "Failed to reset TTY ownership/access mode of %s, ignoring: %m", path);
6f765baf
LP
6224}
6225
4c2f5842
LP
6226int exec_context_get_clean_directories(
6227 ExecContext *c,
6228 char **prefix,
6229 ExecCleanMask mask,
6230 char ***ret) {
6231
6232 _cleanup_strv_free_ char **l = NULL;
4c2f5842
LP
6233 int r;
6234
6235 assert(c);
6236 assert(prefix);
6237 assert(ret);
6238
5b10116e 6239 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
4c2f5842
LP
6240 if (!FLAGS_SET(mask, 1U << t))
6241 continue;
6242
6243 if (!prefix[t])
6244 continue;
6245
211a3d87 6246 for (size_t i = 0; i < c->directories[t].n_items; i++) {
4c2f5842
LP
6247 char *j;
6248
211a3d87 6249 j = path_join(prefix[t], c->directories[t].items[i].path);
4c2f5842
LP
6250 if (!j)
6251 return -ENOMEM;
6252
6253 r = strv_consume(&l, j);
6254 if (r < 0)
6255 return r;
7f622a19
YW
6256
6257 /* Also remove private directories unconditionally. */
6258 if (t != EXEC_DIRECTORY_CONFIGURATION) {
211a3d87
LB
6259 j = path_join(prefix[t], "private", c->directories[t].items[i].path);
6260 if (!j)
6261 return -ENOMEM;
6262
6263 r = strv_consume(&l, j);
6264 if (r < 0)
6265 return r;
6266 }
6267
211a3d87
LB
6268 STRV_FOREACH(symlink, c->directories[t].items[i].symlinks) {
6269 j = path_join(prefix[t], *symlink);
7f622a19
YW
6270 if (!j)
6271 return -ENOMEM;
6272
6273 r = strv_consume(&l, j);
6274 if (r < 0)
6275 return r;
6276 }
4c2f5842
LP
6277 }
6278 }
6279
6280 *ret = TAKE_PTR(l);
6281 return 0;
6282}
6283
6284int exec_context_get_clean_mask(ExecContext *c, ExecCleanMask *ret) {
6285 ExecCleanMask mask = 0;
6286
6287 assert(c);
6288 assert(ret);
6289
6290 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++)
211a3d87 6291 if (c->directories[t].n_items > 0)
4c2f5842
LP
6292 mask |= 1U << t;
6293
6294 *ret = mask;
6295 return 0;
6296}
6297
b58b4116 6298void exec_status_start(ExecStatus *s, pid_t pid) {
034c6ed7 6299 assert(s);
5cb5a6ff 6300
2ed26ed0
LP
6301 *s = (ExecStatus) {
6302 .pid = pid,
6303 };
6304
b58b4116
LP
6305 dual_timestamp_get(&s->start_timestamp);
6306}
6307
34cf6c43 6308void exec_status_exit(ExecStatus *s, const ExecContext *context, pid_t pid, int code, int status) {
b58b4116
LP
6309 assert(s);
6310
d46b79bb 6311 if (s->pid != pid)
2ed26ed0
LP
6312 *s = (ExecStatus) {
6313 .pid = pid,
6314 };
b58b4116 6315
63983207 6316 dual_timestamp_get(&s->exit_timestamp);
9fb86720 6317
034c6ed7
LP
6318 s->code = code;
6319 s->status = status;
169c1bda 6320
6f765baf
LP
6321 if (context && context->utmp_id)
6322 (void) utmp_put_dead_process(context->utmp_id, pid, code, status);
9fb86720
LP
6323}
6324
6a1d4d9f
LP
6325void exec_status_reset(ExecStatus *s) {
6326 assert(s);
6327
6328 *s = (ExecStatus) {};
6329}
6330
34cf6c43 6331void exec_status_dump(const ExecStatus *s, FILE *f, const char *prefix) {
9fb86720
LP
6332 assert(s);
6333 assert(f);
6334
9fb86720
LP
6335 if (s->pid <= 0)
6336 return;
6337
4c940960
LP
6338 prefix = strempty(prefix);
6339
9fb86720 6340 fprintf(f,
ccd06097
ZJS
6341 "%sPID: "PID_FMT"\n",
6342 prefix, s->pid);
9fb86720 6343
af9d16e1 6344 if (dual_timestamp_is_set(&s->start_timestamp))
9fb86720
LP
6345 fprintf(f,
6346 "%sStart Timestamp: %s\n",
04f5c018 6347 prefix, FORMAT_TIMESTAMP(s->start_timestamp.realtime));
9fb86720 6348
af9d16e1 6349 if (dual_timestamp_is_set(&s->exit_timestamp))
9fb86720
LP
6350 fprintf(f,
6351 "%sExit Timestamp: %s\n"
6352 "%sExit Code: %s\n"
6353 "%sExit Status: %i\n",
04f5c018 6354 prefix, FORMAT_TIMESTAMP(s->exit_timestamp.realtime),
9fb86720
LP
6355 prefix, sigchld_code_to_string(s->code),
6356 prefix, s->status);
5cb5a6ff 6357}
44d8db9e 6358
34cf6c43 6359static void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
e1d75803 6360 _cleanup_free_ char *cmd = NULL;
4c940960 6361 const char *prefix2;
44d8db9e
LP
6362
6363 assert(c);
6364 assert(f);
6365
4c940960 6366 prefix = strempty(prefix);
63c372cb 6367 prefix2 = strjoina(prefix, "\t");
44d8db9e 6368
4ef15008 6369 cmd = quote_command_line(c->argv, SHELL_ESCAPE_EMPTY);
44d8db9e
LP
6370 fprintf(f,
6371 "%sCommand Line: %s\n",
7c248223 6372 prefix, cmd ?: strerror_safe(ENOMEM));
44d8db9e 6373
9fb86720 6374 exec_status_dump(&c->exec_status, f, prefix2);
44d8db9e
LP
6375}
6376
6377void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
6378 assert(f);
6379
4c940960 6380 prefix = strempty(prefix);
44d8db9e 6381
03677889
YW
6382 LIST_FOREACH(command, i, c)
6383 exec_command_dump(i, f, prefix);
44d8db9e 6384}
94f04347 6385
a6a80b4f
LP
6386void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
6387 ExecCommand *end;
6388
6389 assert(l);
6390 assert(e);
6391
6392 if (*l) {
35b8ca3a 6393 /* It's kind of important, that we keep the order here */
71fda00f
LP
6394 LIST_FIND_TAIL(command, *l, end);
6395 LIST_INSERT_AFTER(command, *l, end, e);
a6a80b4f
LP
6396 } else
6397 *l = e;
6398}
6399
26fd040d
LP
6400int exec_command_set(ExecCommand *c, const char *path, ...) {
6401 va_list ap;
6402 char **l, *p;
6403
6404 assert(c);
6405 assert(path);
6406
6407 va_start(ap, path);
6408 l = strv_new_ap(path, ap);
6409 va_end(ap);
6410
6411 if (!l)
6412 return -ENOMEM;
6413
250a918d
LP
6414 p = strdup(path);
6415 if (!p) {
26fd040d
LP
6416 strv_free(l);
6417 return -ENOMEM;
6418 }
6419
6897dfe8 6420 free_and_replace(c->path, p);
26fd040d 6421
130d3d22 6422 return strv_free_and_replace(c->argv, l);
26fd040d
LP
6423}
6424
86b23b07 6425int exec_command_append(ExecCommand *c, const char *path, ...) {
e63ff941 6426 _cleanup_strv_free_ char **l = NULL;
86b23b07 6427 va_list ap;
86b23b07
JS
6428 int r;
6429
6430 assert(c);
6431 assert(path);
6432
6433 va_start(ap, path);
6434 l = strv_new_ap(path, ap);
6435 va_end(ap);
6436
6437 if (!l)
6438 return -ENOMEM;
6439
e287086b 6440 r = strv_extend_strv(&c->argv, l, false);
e63ff941 6441 if (r < 0)
86b23b07 6442 return r;
86b23b07
JS
6443
6444 return 0;
6445}
6446
e8a565cb
YW
6447static void *remove_tmpdir_thread(void *p) {
6448 _cleanup_free_ char *path = p;
86b23b07 6449
e8a565cb
YW
6450 (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
6451 return NULL;
6452}
6453
6454static ExecRuntime* exec_runtime_free(ExecRuntime *rt, bool destroy) {
6455 int r;
6456
6457 if (!rt)
6458 return NULL;
6459
6460 if (rt->manager)
6461 (void) hashmap_remove(rt->manager->exec_runtime_by_id, rt->id);
6462
6463 /* When destroy is true, then rm_rf tmp_dir and var_tmp_dir. */
56a13a49
ZJS
6464
6465 if (destroy && rt->tmp_dir && !streq(rt->tmp_dir, RUN_SYSTEMD_EMPTY)) {
e8a565cb
YW
6466 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
6467
6468 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
56a13a49 6469 if (r < 0)
e8a565cb 6470 log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
56a13a49
ZJS
6471 else
6472 rt->tmp_dir = NULL;
e8a565cb 6473 }
613b411c 6474
56a13a49 6475 if (destroy && rt->var_tmp_dir && !streq(rt->var_tmp_dir, RUN_SYSTEMD_EMPTY)) {
e8a565cb
YW
6476 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
6477
6478 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
56a13a49 6479 if (r < 0)
e8a565cb 6480 log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
56a13a49
ZJS
6481 else
6482 rt->var_tmp_dir = NULL;
e8a565cb
YW
6483 }
6484
6485 rt->id = mfree(rt->id);
6486 rt->tmp_dir = mfree(rt->tmp_dir);
6487 rt->var_tmp_dir = mfree(rt->var_tmp_dir);
6488 safe_close_pair(rt->netns_storage_socket);
a70581ff 6489 safe_close_pair(rt->ipcns_storage_socket);
e8a565cb
YW
6490 return mfree(rt);
6491}
6492
6493static void exec_runtime_freep(ExecRuntime **rt) {
da6bc6ed 6494 (void) exec_runtime_free(*rt, false);
e8a565cb
YW
6495}
6496
56a13a49
ZJS
6497static int exec_runtime_allocate(ExecRuntime **ret, const char *id) {
6498 _cleanup_free_ char *id_copy = NULL;
8e8009dc 6499 ExecRuntime *n;
613b411c 6500
8e8009dc 6501 assert(ret);
613b411c 6502
56a13a49
ZJS
6503 id_copy = strdup(id);
6504 if (!id_copy)
6505 return -ENOMEM;
6506
8e8009dc
LP
6507 n = new(ExecRuntime, 1);
6508 if (!n)
613b411c
LP
6509 return -ENOMEM;
6510
8e8009dc 6511 *n = (ExecRuntime) {
56a13a49 6512 .id = TAKE_PTR(id_copy),
8e8009dc 6513 .netns_storage_socket = { -1, -1 },
a70581ff 6514 .ipcns_storage_socket = { -1, -1 },
8e8009dc
LP
6515 };
6516
6517 *ret = n;
613b411c
LP
6518 return 0;
6519}
6520
e8a565cb
YW
6521static int exec_runtime_add(
6522 Manager *m,
6523 const char *id,
56a13a49
ZJS
6524 char **tmp_dir,
6525 char **var_tmp_dir,
6526 int netns_storage_socket[2],
a70581ff 6527 int ipcns_storage_socket[2],
e8a565cb
YW
6528 ExecRuntime **ret) {
6529
6530 _cleanup_(exec_runtime_freep) ExecRuntime *rt = NULL;
613b411c
LP
6531 int r;
6532
e8a565cb 6533 assert(m);
613b411c
LP
6534 assert(id);
6535
a70581ff 6536 /* tmp_dir, var_tmp_dir, {net,ipc}ns_storage_socket fds are donated on success */
56a13a49 6537
56a13a49 6538 r = exec_runtime_allocate(&rt, id);
613b411c
LP
6539 if (r < 0)
6540 return r;
6541
63083706 6542 r = hashmap_ensure_put(&m->exec_runtime_by_id, &string_hash_ops, rt->id, rt);
56a13a49
ZJS
6543 if (r < 0)
6544 return r;
e8a565cb 6545
56a13a49
ZJS
6546 assert(!!rt->tmp_dir == !!rt->var_tmp_dir); /* We require both to be set together */
6547 rt->tmp_dir = TAKE_PTR(*tmp_dir);
6548 rt->var_tmp_dir = TAKE_PTR(*var_tmp_dir);
e8a565cb
YW
6549
6550 if (netns_storage_socket) {
56a13a49
ZJS
6551 rt->netns_storage_socket[0] = TAKE_FD(netns_storage_socket[0]);
6552 rt->netns_storage_socket[1] = TAKE_FD(netns_storage_socket[1]);
613b411c
LP
6553 }
6554
a70581ff
XR
6555 if (ipcns_storage_socket) {
6556 rt->ipcns_storage_socket[0] = TAKE_FD(ipcns_storage_socket[0]);
6557 rt->ipcns_storage_socket[1] = TAKE_FD(ipcns_storage_socket[1]);
6558 }
6559
e8a565cb
YW
6560 rt->manager = m;
6561
6562 if (ret)
6563 *ret = rt;
e8a565cb 6564 /* do not remove created ExecRuntime object when the operation succeeds. */
56a13a49 6565 TAKE_PTR(rt);
e8a565cb
YW
6566 return 0;
6567}
6568
74aaf59b
LP
6569static int exec_runtime_make(
6570 Manager *m,
6571 const ExecContext *c,
6572 const char *id,
6573 ExecRuntime **ret) {
6574
56a13a49 6575 _cleanup_(namespace_cleanup_tmpdirp) char *tmp_dir = NULL, *var_tmp_dir = NULL;
a70581ff 6576 _cleanup_close_pair_ int netns_storage_socket[2] = { -1, -1 }, ipcns_storage_socket[2] = { -1, -1 };
e8a565cb
YW
6577 int r;
6578
6579 assert(m);
6580 assert(c);
6581 assert(id);
6582
6583 /* It is not necessary to create ExecRuntime object. */
a70581ff 6584 if (!c->private_network && !c->private_ipc && !c->private_tmp && !c->network_namespace_path) {
74aaf59b 6585 *ret = NULL;
e8a565cb 6586 return 0;
74aaf59b 6587 }
e8a565cb 6588
efa2f3a1
TM
6589 if (c->private_tmp &&
6590 !(prefixed_path_strv_contains(c->inaccessible_paths, "/tmp") &&
6591 (prefixed_path_strv_contains(c->inaccessible_paths, "/var/tmp") ||
6592 prefixed_path_strv_contains(c->inaccessible_paths, "/var")))) {
e8a565cb 6593 r = setup_tmp_dirs(id, &tmp_dir, &var_tmp_dir);
613b411c
LP
6594 if (r < 0)
6595 return r;
6596 }
6597
a8d08f39 6598 if (c->private_network || c->network_namespace_path) {
e8a565cb
YW
6599 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, netns_storage_socket) < 0)
6600 return -errno;
6601 }
6602
a70581ff
XR
6603 if (c->private_ipc || c->ipc_namespace_path) {
6604 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, ipcns_storage_socket) < 0)
6605 return -errno;
6606 }
6607
6608 r = exec_runtime_add(m, id, &tmp_dir, &var_tmp_dir, netns_storage_socket, ipcns_storage_socket, ret);
e8a565cb
YW
6609 if (r < 0)
6610 return r;
6611
613b411c
LP
6612 return 1;
6613}
6614
e8a565cb
YW
6615int exec_runtime_acquire(Manager *m, const ExecContext *c, const char *id, bool create, ExecRuntime **ret) {
6616 ExecRuntime *rt;
6617 int r;
613b411c 6618
e8a565cb
YW
6619 assert(m);
6620 assert(id);
6621 assert(ret);
6622
6623 rt = hashmap_get(m->exec_runtime_by_id, id);
6624 if (rt)
387f6955 6625 /* We already have an ExecRuntime object, let's increase the ref count and reuse it */
e8a565cb
YW
6626 goto ref;
6627
74aaf59b
LP
6628 if (!create) {
6629 *ret = NULL;
e8a565cb 6630 return 0;
74aaf59b 6631 }
e8a565cb
YW
6632
6633 /* If not found, then create a new object. */
6634 r = exec_runtime_make(m, c, id, &rt);
74aaf59b 6635 if (r < 0)
e8a565cb 6636 return r;
74aaf59b
LP
6637 if (r == 0) {
6638 /* When r == 0, it is not necessary to create ExecRuntime object. */
6639 *ret = NULL;
6640 return 0;
6641 }
613b411c 6642
e8a565cb
YW
6643ref:
6644 /* increment reference counter. */
6645 rt->n_ref++;
6646 *ret = rt;
6647 return 1;
6648}
613b411c 6649
e8a565cb
YW
6650ExecRuntime *exec_runtime_unref(ExecRuntime *rt, bool destroy) {
6651 if (!rt)
613b411c
LP
6652 return NULL;
6653
e8a565cb 6654 assert(rt->n_ref > 0);
613b411c 6655
e8a565cb
YW
6656 rt->n_ref--;
6657 if (rt->n_ref > 0)
f2341e0a
LP
6658 return NULL;
6659
e8a565cb 6660 return exec_runtime_free(rt, destroy);
613b411c
LP
6661}
6662
e8a565cb
YW
6663int exec_runtime_serialize(const Manager *m, FILE *f, FDSet *fds) {
6664 ExecRuntime *rt;
e8a565cb
YW
6665
6666 assert(m);
613b411c
LP
6667 assert(f);
6668 assert(fds);
6669
90e74a66 6670 HASHMAP_FOREACH(rt, m->exec_runtime_by_id) {
e8a565cb 6671 fprintf(f, "exec-runtime=%s", rt->id);
613b411c 6672
e8a565cb
YW
6673 if (rt->tmp_dir)
6674 fprintf(f, " tmp-dir=%s", rt->tmp_dir);
613b411c 6675
e8a565cb
YW
6676 if (rt->var_tmp_dir)
6677 fprintf(f, " var-tmp-dir=%s", rt->var_tmp_dir);
613b411c 6678
e8a565cb
YW
6679 if (rt->netns_storage_socket[0] >= 0) {
6680 int copy;
613b411c 6681
e8a565cb
YW
6682 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
6683 if (copy < 0)
6684 return copy;
613b411c 6685
e8a565cb
YW
6686 fprintf(f, " netns-socket-0=%i", copy);
6687 }
613b411c 6688
e8a565cb
YW
6689 if (rt->netns_storage_socket[1] >= 0) {
6690 int copy;
613b411c 6691
e8a565cb
YW
6692 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
6693 if (copy < 0)
6694 return copy;
613b411c 6695
e8a565cb
YW
6696 fprintf(f, " netns-socket-1=%i", copy);
6697 }
6698
a70581ff
XR
6699 if (rt->ipcns_storage_socket[0] >= 0) {
6700 int copy;
6701
6702 copy = fdset_put_dup(fds, rt->ipcns_storage_socket[0]);
6703 if (copy < 0)
6704 return copy;
6705
6706 fprintf(f, " ipcns-socket-0=%i", copy);
6707 }
6708
6709 if (rt->ipcns_storage_socket[1] >= 0) {
6710 int copy;
6711
6712 copy = fdset_put_dup(fds, rt->ipcns_storage_socket[1]);
6713 if (copy < 0)
6714 return copy;
6715
6716 fprintf(f, " ipcns-socket-1=%i", copy);
6717 }
6718
e8a565cb 6719 fputc('\n', f);
613b411c
LP
6720 }
6721
6722 return 0;
6723}
6724
e8a565cb
YW
6725int exec_runtime_deserialize_compat(Unit *u, const char *key, const char *value, FDSet *fds) {
6726 _cleanup_(exec_runtime_freep) ExecRuntime *rt_create = NULL;
6727 ExecRuntime *rt;
613b411c
LP
6728 int r;
6729
e8a565cb
YW
6730 /* This is for the migration from old (v237 or earlier) deserialization text.
6731 * Due to the bug #7790, this may not work with the units that use JoinsNamespaceOf=.
6732 * Even if the ExecRuntime object originally created by the other unit, we cannot judge
6733 * so or not from the serialized text, then we always creates a new object owned by this. */
6734
6735 assert(u);
613b411c
LP
6736 assert(key);
6737 assert(value);
6738
e8a565cb
YW
6739 /* Manager manages ExecRuntime objects by the unit id.
6740 * So, we omit the serialized text when the unit does not have id (yet?)... */
6741 if (isempty(u->id)) {
6742 log_unit_debug(u, "Invocation ID not found. Dropping runtime parameter.");
6743 return 0;
6744 }
613b411c 6745
cbc165d1
ZJS
6746 if (hashmap_ensure_allocated(&u->manager->exec_runtime_by_id, &string_hash_ops) < 0)
6747 return log_oom();
e8a565cb
YW
6748
6749 rt = hashmap_get(u->manager->exec_runtime_by_id, u->id);
6750 if (!rt) {
cbc165d1 6751 if (exec_runtime_allocate(&rt_create, u->id) < 0)
f2341e0a 6752 return log_oom();
613b411c 6753
e8a565cb
YW
6754 rt = rt_create;
6755 }
6756
6757 if (streq(key, "tmp-dir")) {
cbc165d1
ZJS
6758 if (free_and_strdup_warn(&rt->tmp_dir, value) < 0)
6759 return -ENOMEM;
613b411c
LP
6760
6761 } else if (streq(key, "var-tmp-dir")) {
cbc165d1
ZJS
6762 if (free_and_strdup_warn(&rt->var_tmp_dir, value) < 0)
6763 return -ENOMEM;
613b411c
LP
6764
6765 } else if (streq(key, "netns-socket-0")) {
6766 int fd;
6767
e8a565cb 6768 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
f2341e0a 6769 log_unit_debug(u, "Failed to parse netns socket value: %s", value);
e8a565cb 6770 return 0;
613b411c 6771 }
e8a565cb
YW
6772
6773 safe_close(rt->netns_storage_socket[0]);
6774 rt->netns_storage_socket[0] = fdset_remove(fds, fd);
6775
613b411c
LP
6776 } else if (streq(key, "netns-socket-1")) {
6777 int fd;
6778
e8a565cb 6779 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
f2341e0a 6780 log_unit_debug(u, "Failed to parse netns socket value: %s", value);
e8a565cb 6781 return 0;
613b411c 6782 }
e8a565cb
YW
6783
6784 safe_close(rt->netns_storage_socket[1]);
6785 rt->netns_storage_socket[1] = fdset_remove(fds, fd);
a70581ff 6786
613b411c
LP
6787 } else
6788 return 0;
6789
e8a565cb
YW
6790 /* If the object is newly created, then put it to the hashmap which manages ExecRuntime objects. */
6791 if (rt_create) {
6792 r = hashmap_put(u->manager->exec_runtime_by_id, rt_create->id, rt_create);
6793 if (r < 0) {
3fe91079 6794 log_unit_debug_errno(u, r, "Failed to put runtime parameter to manager's storage: %m");
e8a565cb
YW
6795 return 0;
6796 }
613b411c 6797
e8a565cb 6798 rt_create->manager = u->manager;
613b411c 6799
e8a565cb 6800 /* Avoid cleanup */
56a13a49 6801 TAKE_PTR(rt_create);
e8a565cb 6802 }
98b47d54 6803
e8a565cb
YW
6804 return 1;
6805}
613b411c 6806
56a13a49
ZJS
6807int exec_runtime_deserialize_one(Manager *m, const char *value, FDSet *fds) {
6808 _cleanup_free_ char *tmp_dir = NULL, *var_tmp_dir = NULL;
6809 char *id = NULL;
a70581ff 6810 int r, netns_fdpair[] = {-1, -1}, ipcns_fdpair[] = {-1, -1};
e8a565cb
YW
6811 const char *p, *v = value;
6812 size_t n;
613b411c 6813
e8a565cb
YW
6814 assert(m);
6815 assert(value);
6816 assert(fds);
98b47d54 6817
e8a565cb 6818 n = strcspn(v, " ");
2f82562b 6819 id = strndupa_safe(v, n);
e8a565cb
YW
6820 if (v[n] != ' ')
6821 goto finalize;
6822 p = v + n + 1;
6823
6824 v = startswith(p, "tmp-dir=");
6825 if (v) {
6826 n = strcspn(v, " ");
56a13a49
ZJS
6827 tmp_dir = strndup(v, n);
6828 if (!tmp_dir)
6829 return log_oom();
e8a565cb
YW
6830 if (v[n] != ' ')
6831 goto finalize;
6832 p = v + n + 1;
6833 }
6834
6835 v = startswith(p, "var-tmp-dir=");
6836 if (v) {
6837 n = strcspn(v, " ");
56a13a49
ZJS
6838 var_tmp_dir = strndup(v, n);
6839 if (!var_tmp_dir)
6840 return log_oom();
e8a565cb
YW
6841 if (v[n] != ' ')
6842 goto finalize;
6843 p = v + n + 1;
6844 }
6845
6846 v = startswith(p, "netns-socket-0=");
6847 if (v) {
6848 char *buf;
6849
6850 n = strcspn(v, " ");
2f82562b 6851 buf = strndupa_safe(v, n);
c413bb28 6852
a70581ff 6853 r = safe_atoi(buf, &netns_fdpair[0]);
c413bb28
ZJS
6854 if (r < 0)
6855 return log_debug_errno(r, "Unable to parse exec-runtime specification netns-socket-0=%s: %m", buf);
a70581ff 6856 if (!fdset_contains(fds, netns_fdpair[0]))
c413bb28 6857 return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
a70581ff
XR
6858 "exec-runtime specification netns-socket-0= refers to unknown fd %d: %m", netns_fdpair[0]);
6859 netns_fdpair[0] = fdset_remove(fds, netns_fdpair[0]);
e8a565cb
YW
6860 if (v[n] != ' ')
6861 goto finalize;
6862 p = v + n + 1;
613b411c
LP
6863 }
6864
e8a565cb
YW
6865 v = startswith(p, "netns-socket-1=");
6866 if (v) {
6867 char *buf;
98b47d54 6868
e8a565cb 6869 n = strcspn(v, " ");
2f82562b 6870 buf = strndupa_safe(v, n);
a70581ff
XR
6871
6872 r = safe_atoi(buf, &netns_fdpair[1]);
c413bb28
ZJS
6873 if (r < 0)
6874 return log_debug_errno(r, "Unable to parse exec-runtime specification netns-socket-1=%s: %m", buf);
a70581ff
XR
6875 if (!fdset_contains(fds, netns_fdpair[1]))
6876 return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
6877 "exec-runtime specification netns-socket-1= refers to unknown fd %d: %m", netns_fdpair[1]);
6878 netns_fdpair[1] = fdset_remove(fds, netns_fdpair[1]);
6879 if (v[n] != ' ')
6880 goto finalize;
6881 p = v + n + 1;
6882 }
6883
6884 v = startswith(p, "ipcns-socket-0=");
6885 if (v) {
6886 char *buf;
6887
6888 n = strcspn(v, " ");
2f82562b 6889 buf = strndupa_safe(v, n);
a70581ff
XR
6890
6891 r = safe_atoi(buf, &ipcns_fdpair[0]);
6892 if (r < 0)
6893 return log_debug_errno(r, "Unable to parse exec-runtime specification ipcns-socket-0=%s: %m", buf);
6894 if (!fdset_contains(fds, ipcns_fdpair[0]))
6895 return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
6896 "exec-runtime specification ipcns-socket-0= refers to unknown fd %d: %m", ipcns_fdpair[0]);
6897 ipcns_fdpair[0] = fdset_remove(fds, ipcns_fdpair[0]);
6898 if (v[n] != ' ')
6899 goto finalize;
6900 p = v + n + 1;
6901 }
6902
6903 v = startswith(p, "ipcns-socket-1=");
6904 if (v) {
6905 char *buf;
6906
6907 n = strcspn(v, " ");
2f82562b 6908 buf = strndupa_safe(v, n);
a70581ff
XR
6909
6910 r = safe_atoi(buf, &ipcns_fdpair[1]);
6911 if (r < 0)
6912 return log_debug_errno(r, "Unable to parse exec-runtime specification ipcns-socket-1=%s: %m", buf);
6913 if (!fdset_contains(fds, ipcns_fdpair[1]))
c413bb28 6914 return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
a70581ff
XR
6915 "exec-runtime specification ipcns-socket-1= refers to unknown fd %d: %m", ipcns_fdpair[1]);
6916 ipcns_fdpair[1] = fdset_remove(fds, ipcns_fdpair[1]);
e8a565cb 6917 }
98b47d54 6918
e8a565cb 6919finalize:
a70581ff 6920 r = exec_runtime_add(m, id, &tmp_dir, &var_tmp_dir, netns_fdpair, ipcns_fdpair, NULL);
7d853ca6 6921 if (r < 0)
56a13a49
ZJS
6922 return log_debug_errno(r, "Failed to add exec-runtime: %m");
6923 return 0;
e8a565cb 6924}
613b411c 6925
e8a565cb
YW
6926void exec_runtime_vacuum(Manager *m) {
6927 ExecRuntime *rt;
e8a565cb
YW
6928
6929 assert(m);
6930
6931 /* Free unreferenced ExecRuntime objects. This is used after manager deserialization process. */
6932
90e74a66 6933 HASHMAP_FOREACH(rt, m->exec_runtime_by_id) {
e8a565cb
YW
6934 if (rt->n_ref > 0)
6935 continue;
6936
6937 (void) exec_runtime_free(rt, false);
6938 }
613b411c
LP
6939}
6940
b9c04eaf
YW
6941void exec_params_clear(ExecParameters *p) {
6942 if (!p)
6943 return;
6944
c3f8a065
LP
6945 p->environment = strv_free(p->environment);
6946 p->fd_names = strv_free(p->fd_names);
6947 p->fds = mfree(p->fds);
6948 p->exec_fd = safe_close(p->exec_fd);
b9c04eaf
YW
6949}
6950
bb0c0d6f
LP
6951ExecSetCredential *exec_set_credential_free(ExecSetCredential *sc) {
6952 if (!sc)
6953 return NULL;
6954
6955 free(sc->id);
6956 free(sc->data);
6957 return mfree(sc);
6958}
6959
43144be4
LP
6960ExecLoadCredential *exec_load_credential_free(ExecLoadCredential *lc) {
6961 if (!lc)
6962 return NULL;
6963
6964 free(lc->id);
6965 free(lc->path);
6966 return mfree(lc);
6967}
6968
211a3d87
LB
6969void exec_directory_done(ExecDirectory *d) {
6970 if (!d)
6971 return;
6972
6973 for (size_t i = 0; i < d->n_items; i++) {
6974 free(d->items[i].path);
6975 strv_free(d->items[i].symlinks);
6976 }
6977
6978 d->items = mfree(d->items);
6979 d->n_items = 0;
6980 d->mode = 0755;
6981}
6982
6983int exec_directory_add(ExecDirectoryItem **d, size_t *n, const char *path, char **symlinks) {
6984 _cleanup_strv_free_ char **s = NULL;
6985 _cleanup_free_ char *p = NULL;
6986
6987 assert(d);
6988 assert(n);
6989 assert(path);
6990
6991 p = strdup(path);
6992 if (!p)
6993 return -ENOMEM;
6994
6995 if (symlinks) {
6996 s = strv_copy(symlinks);
6997 if (!s)
6998 return -ENOMEM;
6999 }
7000
7001 if (!GREEDY_REALLOC(*d, *n + 1))
7002 return -ENOMEM;
7003
7004 (*d)[(*n) ++] = (ExecDirectoryItem) {
7005 .path = TAKE_PTR(p),
7006 .symlinks = TAKE_PTR(s),
7007 };
7008
7009 return 0;
7010}
7011
bb0c0d6f 7012DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(exec_set_credential_hash_ops, char, string_hash_func, string_compare_func, ExecSetCredential, exec_set_credential_free);
43144be4 7013DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(exec_load_credential_hash_ops, char, string_hash_func, string_compare_func, ExecLoadCredential, exec_load_credential_free);
bb0c0d6f 7014
80876c20
LP
7015static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
7016 [EXEC_INPUT_NULL] = "null",
7017 [EXEC_INPUT_TTY] = "tty",
7018 [EXEC_INPUT_TTY_FORCE] = "tty-force",
4f2d528d 7019 [EXEC_INPUT_TTY_FAIL] = "tty-fail",
52c239d7
LB
7020 [EXEC_INPUT_SOCKET] = "socket",
7021 [EXEC_INPUT_NAMED_FD] = "fd",
08f3be7a 7022 [EXEC_INPUT_DATA] = "data",
2038c3f5 7023 [EXEC_INPUT_FILE] = "file",
80876c20
LP
7024};
7025
8a0867d6
LP
7026DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
7027
94f04347 7028static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
80876c20 7029 [EXEC_OUTPUT_INHERIT] = "inherit",
94f04347 7030 [EXEC_OUTPUT_NULL] = "null",
80876c20 7031 [EXEC_OUTPUT_TTY] = "tty",
9a6bca7a 7032 [EXEC_OUTPUT_KMSG] = "kmsg",
28dbc1e8 7033 [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
706343f4
LP
7034 [EXEC_OUTPUT_JOURNAL] = "journal",
7035 [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
52c239d7
LB
7036 [EXEC_OUTPUT_SOCKET] = "socket",
7037 [EXEC_OUTPUT_NAMED_FD] = "fd",
2038c3f5 7038 [EXEC_OUTPUT_FILE] = "file",
566b7d23 7039 [EXEC_OUTPUT_FILE_APPEND] = "append",
8d7dab1f 7040 [EXEC_OUTPUT_FILE_TRUNCATE] = "truncate",
94f04347
LP
7041};
7042
7043DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
023a4f67
LP
7044
7045static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
7046 [EXEC_UTMP_INIT] = "init",
7047 [EXEC_UTMP_LOGIN] = "login",
7048 [EXEC_UTMP_USER] = "user",
7049};
7050
7051DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);
53f47dfc
YW
7052
7053static const char* const exec_preserve_mode_table[_EXEC_PRESERVE_MODE_MAX] = {
7054 [EXEC_PRESERVE_NO] = "no",
7055 [EXEC_PRESERVE_YES] = "yes",
7056 [EXEC_PRESERVE_RESTART] = "restart",
7057};
7058
7059DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(exec_preserve_mode, ExecPreserveMode, EXEC_PRESERVE_YES);
3536f49e 7060
6b7b2ed9 7061/* This table maps ExecDirectoryType to the setting it is configured with in the unit */
72fd1768 7062static const char* const exec_directory_type_table[_EXEC_DIRECTORY_TYPE_MAX] = {
3536f49e
YW
7063 [EXEC_DIRECTORY_RUNTIME] = "RuntimeDirectory",
7064 [EXEC_DIRECTORY_STATE] = "StateDirectory",
7065 [EXEC_DIRECTORY_CACHE] = "CacheDirectory",
7066 [EXEC_DIRECTORY_LOGS] = "LogsDirectory",
7067 [EXEC_DIRECTORY_CONFIGURATION] = "ConfigurationDirectory",
7068};
7069
7070DEFINE_STRING_TABLE_LOOKUP(exec_directory_type, ExecDirectoryType);
b1edf445 7071
211a3d87
LB
7072/* This table maps ExecDirectoryType to the symlink setting it is configured with in the unit */
7073static const char* const exec_directory_type_symlink_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7074 [EXEC_DIRECTORY_RUNTIME] = "RuntimeDirectorySymlink",
7075 [EXEC_DIRECTORY_STATE] = "StateDirectorySymlink",
7076 [EXEC_DIRECTORY_CACHE] = "CacheDirectorySymlink",
7077 [EXEC_DIRECTORY_LOGS] = "LogsDirectorySymlink",
7078 [EXEC_DIRECTORY_CONFIGURATION] = "ConfigurationDirectorySymlink",
7079};
7080
7081DEFINE_STRING_TABLE_LOOKUP(exec_directory_type_symlink, ExecDirectoryType);
7082
6b7b2ed9
LP
7083/* And this table maps ExecDirectoryType too, but to a generic term identifying the type of resource. This
7084 * one is supposed to be generic enough to be used for unit types that don't use ExecContext and per-unit
7085 * directories, specifically .timer units with their timestamp touch file. */
7086static const char* const exec_resource_type_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7087 [EXEC_DIRECTORY_RUNTIME] = "runtime",
7088 [EXEC_DIRECTORY_STATE] = "state",
7089 [EXEC_DIRECTORY_CACHE] = "cache",
7090 [EXEC_DIRECTORY_LOGS] = "logs",
7091 [EXEC_DIRECTORY_CONFIGURATION] = "configuration",
7092};
7093
7094DEFINE_STRING_TABLE_LOOKUP(exec_resource_type, ExecDirectoryType);
7095
7096/* And this table also maps ExecDirectoryType, to the environment variable we pass the selected directory to
7097 * the service payload in. */
fb2042dd
YW
7098static const char* const exec_directory_env_name_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7099 [EXEC_DIRECTORY_RUNTIME] = "RUNTIME_DIRECTORY",
7100 [EXEC_DIRECTORY_STATE] = "STATE_DIRECTORY",
7101 [EXEC_DIRECTORY_CACHE] = "CACHE_DIRECTORY",
7102 [EXEC_DIRECTORY_LOGS] = "LOGS_DIRECTORY",
7103 [EXEC_DIRECTORY_CONFIGURATION] = "CONFIGURATION_DIRECTORY",
7104};
7105
7106DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(exec_directory_env_name, ExecDirectoryType);
7107
b1edf445
LP
7108static const char* const exec_keyring_mode_table[_EXEC_KEYRING_MODE_MAX] = {
7109 [EXEC_KEYRING_INHERIT] = "inherit",
7110 [EXEC_KEYRING_PRIVATE] = "private",
7111 [EXEC_KEYRING_SHARED] = "shared",
7112};
7113
7114DEFINE_STRING_TABLE_LOOKUP(exec_keyring_mode, ExecKeyringMode);