]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/core/execute.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
barrier: convert msecs to usecs in test-code
[thirdparty/systemd.git] / src / core / execute.c
CommitLineData
d6c9574f 1/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
5cb5a6ff 2
a7334b09
LP		 3/***
4 This file is part of systemd.
5
6 Copyright 2010 Lennart Poettering
7
8 systemd is free software; you can redistribute it and/or modify it
5430f7f2
LP		 9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
a7334b09
LP		 11 (at your option) any later version.
12
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2 16 Lesser General Public License for more details.
a7334b09 17
5430f7f2 18 You should have received a copy of the GNU Lesser General Public License
a7334b09
LP		 19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
20***/
21
5cb5a6ff 22#include <assert.h>
034c6ed7
LP		 23#include <dirent.h>
24#include <errno.h>
25#include <fcntl.h>
26#include <unistd.h>
44d8db9e 27#include <string.h>
309bff19 28#include <signal.h>
071830ff
LP		 29#include <sys/socket.h>
30#include <sys/un.h>
94f04347 31#include <sys/prctl.h>
66ee3769 32#include <linux/sched.h>
451a074f
LP		 33#include <sys/types.h>
34#include <sys/stat.h>
81a2b7ce
LP		 35#include <grp.h>
36#include <pwd.h>
15ae422b 37#include <sys/mount.h>
25e870b5 38#include <linux/fs.h>
dd6c17b1 39#include <linux/oom.h>
f2b68789 40#include <sys/poll.h>
2bef10ab 41#include <glob.h>
ac45f971 42#include <sys/personality.h>
d34cd374 43#include <libgen.h>
2b6bf07d 44#undef basename
5cb5a6ff 45
5b6319dc
LP		 46#ifdef HAVE_PAM
47#include <security/pam_appl.h>
48#endif
49
7b52a628
MS		 50#ifdef HAVE_SELINUX
51#include <selinux/selinux.h>
52#endif
53
17df7223
LP		 54#ifdef HAVE_SECCOMP
55#include <seccomp.h>
56#endif
57
eef65bf3
MS		 58#ifdef HAVE_APPARMOR
59#include <sys/apparmor.h>
60#endif
61
5cb5a6ff
LP		 62#include "execute.h"
63#include "strv.h"
64#include "macro.h"
d7832d2c 65#include "capability.h"
5cb5a6ff 66#include "util.h"
acbb0225 67#include "log.h"
20ad4cfd 68#include "sd-messages.h"
9eba9da4 69#include "ioprio.h"
94f04347 70#include "securebits.h"
15ae422b 71#include "namespace.h"
d06dacd0 72#include "exit-status.h"
dd6c17b1 73#include "missing.h"
169c1bda 74#include "utmp-wtmp.h"
f6a6225e 75#include "def.h"
9eb977db 76#include "path-util.h"
4d1a6904 77#include "env-util.h"
a5c32cff 78#include "fileio.h"
4ad49000 79#include "unit.h"
f485606b 80#include "async.h"
0d3f7bb3 81#include "selinux-util.h"
17df7223 82#include "errno-list.h"
4298d0b5 83#include "af-list.h"
e66cf1a3 84#include "mkdir.h"
eef65bf3 85#include "apparmor-util.h"
5cb5a6ff 86
57183d11
LP		 87#ifdef HAVE_SECCOMP
88#include "seccomp-util.h"
89#endif
90
e056b01d 91#define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
31a7eb86 92#define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
e6a26745 93
02a51aba
LP		 94/* This assumes there is a 'tty' group */
95#define TTY_MODE 0620
96
531dca78
LP		 97#define SNDBUF_SIZE (8*1024*1024)
98
034c6ed7
LP		 99static int shift_fds(int fds[], unsigned n_fds) {
100 int start, restart_from;
101
102 if (n_fds <= 0)
103 return 0;
104
a0d40ac5
LP		 105 /* Modifies the fds array! (sorts it) */
106
034c6ed7
LP		 107 assert(fds);
108
109 start = 0;
110 for (;;) {
111 int i;
112
113 restart_from = -1;
114
115 for (i = start; i < (int) n_fds; i++) {
116 int nfd;
117
118 /* Already at right index? */
119 if (fds[i] == i+3)
120 continue;
121
122 if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
123 return -errno;
124
03e334a1 125 safe_close(fds[i]);
034c6ed7
LP		 126 fds[i] = nfd;
127
128 /* Hmm, the fd we wanted isn't free? Then
129 * let's remember that and try again from here*/
130 if (nfd != i+3 && restart_from < 0)
131 restart_from = i;
132 }
133
134 if (restart_from < 0)
135 break;
136
137 start = restart_from;
138 }
139
140 return 0;
141}
142
c2748801 143static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
47a71eed 144 unsigned i;
e2c76839 145 int r;
47a71eed
LP		 146
147 if (n_fds <= 0)
148 return 0;
149
150 assert(fds);
151
451a074f 152 /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
47a71eed
LP		 153
154 for (i = 0; i < n_fds; i++) {
47a71eed 155
e2c76839
LP		 156 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
157 return r;
47a71eed 158
451a074f
LP		 159 /* We unconditionally drop FD_CLOEXEC from the fds,
160 * since after all we want to pass these fds to our
161 * children */
47a71eed 162
e2c76839
LP		 163 if ((r = fd_cloexec(fds[i], false)) < 0)
164 return r;
47a71eed
LP		 165 }
166
167 return 0;
168}
169
44a6b1b6 170_pure_ static const char *tty_path(const ExecContext *context) {
80876c20
LP		 171 assert(context);
172
173 if (context->tty_path)
174 return context->tty_path;
175
176 return "/dev/console";
177}
178
9588bc32 179static void exec_context_tty_reset(const ExecContext *context) {
6ea832a2
LP		 180 assert(context);
181
182 if (context->tty_vhangup)
183 terminal_vhangup(tty_path(context));
184
185 if (context->tty_reset)
186 reset_terminal(tty_path(context));
187
188 if (context->tty_vt_disallocate && context->tty_path)
189 vt_disallocate(context->tty_path);
190}
191
3a1286b6
MS		 192static bool is_terminal_output(ExecOutput o) {
193 return
194 o == EXEC_OUTPUT_TTY ||
195 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
196 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
197 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
198}
199
80876c20
LP		 200static int open_null_as(int flags, int nfd) {
201 int fd, r;
071830ff 202
80876c20 203 assert(nfd >= 0);
071830ff 204
613b411c
LP		 205 fd = open("/dev/null", flags|O_NOCTTY);
206 if (fd < 0)
071830ff
LP		 207 return -errno;
208
80876c20
LP		 209 if (fd != nfd) {
210 r = dup2(fd, nfd) < 0 ? -errno : nfd;
03e334a1 211 safe_close(fd);
80876c20
LP		 212 } else
213 r = nfd;
071830ff 214
80876c20 215 return r;
071830ff
LP		 216}
217
62bca2c6 218static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
80876c20 219 int fd, r;
b92bea5d
ZJS		 220 union sockaddr_union sa = {
221 .un.sun_family = AF_UNIX,
222 .un.sun_path = "/run/systemd/journal/stdout",
223 };
071830ff
LP		 224
225 assert(context);
80876c20
LP		 226 assert(output < _EXEC_OUTPUT_MAX);
227 assert(ident);
228 assert(nfd >= 0);
071830ff 229
54fe0cdb
LP		 230 fd = socket(AF_UNIX, SOCK_STREAM, 0);
231 if (fd < 0)
80876c20 232 return -errno;
071830ff 233
54fe0cdb
LP		 234 r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
235 if (r < 0) {
03e334a1 236 safe_close(fd);
80876c20
LP		 237 return -errno;
238 }
071830ff 239
80876c20 240 if (shutdown(fd, SHUT_RD) < 0) {
03e334a1 241 safe_close(fd);
80876c20
LP		 242 return -errno;
243 }
071830ff 244
531dca78
LP		 245 fd_inc_sndbuf(fd, SNDBUF_SIZE);
246
80876c20 247 dprintf(fd,
62bca2c6 248 "%s\n"
80876c20
LP		 249 "%s\n"
250 "%i\n"
54fe0cdb
LP		 251 "%i\n"
252 "%i\n"
253 "%i\n"
4f4a1dbf 254 "%i\n",
4f4a1dbf 255 context->syslog_identifier ? context->syslog_identifier : ident,
62bca2c6 256 unit_id,
54fe0cdb
LP		 257 context->syslog_priority,
258 !!context->syslog_level_prefix,
259 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
260 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
3a1286b6 261 is_terminal_output(output));
80876c20
LP		 262
263 if (fd != nfd) {
264 r = dup2(fd, nfd) < 0 ? -errno : nfd;
03e334a1 265 safe_close(fd);
80876c20
LP		 266 } else
267 r = nfd;
071830ff 268
80876c20
LP		 269 return r;
270}
271static int open_terminal_as(const char *path, mode_t mode, int nfd) {
272 int fd, r;
071830ff 273
80876c20
LP		 274 assert(path);
275 assert(nfd >= 0);
071830ff 276
80876c20
LP		 277 if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
278 return fd;
071830ff 279
80876c20
LP		 280 if (fd != nfd) {
281 r = dup2(fd, nfd) < 0 ? -errno : nfd;
03e334a1 282 safe_close(fd);
80876c20
LP		 283 } else
284 r = nfd;
071830ff 285
80876c20
LP		 286 return r;
287}
071830ff 288
80876c20
LP		 289static bool is_terminal_input(ExecInput i) {
290 return
291 i == EXEC_INPUT_TTY ||
292 i == EXEC_INPUT_TTY_FORCE ||
293 i == EXEC_INPUT_TTY_FAIL;
294}
071830ff 295
1e3ad081
LP		 296static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
297
298 if (is_terminal_input(std_input) && !apply_tty_stdin)
299 return EXEC_INPUT_NULL;
071830ff 300
03fd9c49 301 if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
4f2d528d
LP		 302 return EXEC_INPUT_NULL;
303
03fd9c49 304 return std_input;
4f2d528d
LP		 305}
306
03fd9c49 307static int fixup_output(ExecOutput std_output, int socket_fd) {
4f2d528d 308
03fd9c49 309 if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
4f2d528d
LP		 310 return EXEC_OUTPUT_INHERIT;
311
03fd9c49 312 return std_output;
4f2d528d
LP		 313}
314
1e3ad081 315static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
4f2d528d
LP		 316 ExecInput i;
317
318 assert(context);
319
1e3ad081 320 i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
4f2d528d
LP		 321
322 switch (i) {
071830ff 323
80876c20
LP		 324 case EXEC_INPUT_NULL:
325 return open_null_as(O_RDONLY, STDIN_FILENO);
326
327 case EXEC_INPUT_TTY:
328 case EXEC_INPUT_TTY_FORCE:
329 case EXEC_INPUT_TTY_FAIL: {
330 int fd, r;
071830ff 331
970edce6
ZJS		 332 fd = acquire_terminal(tty_path(context),
333 i == EXEC_INPUT_TTY_FAIL,
334 i == EXEC_INPUT_TTY_FORCE,
335 false,
336 (usec_t) -1);
337 if (fd < 0)
80876c20
LP		 338 return fd;
339
340 if (fd != STDIN_FILENO) {
341 r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
03e334a1 342 safe_close(fd);
80876c20
LP		 343 } else
344 r = STDIN_FILENO;
345
346 return r;
347 }
348
4f2d528d
LP		 349 case EXEC_INPUT_SOCKET:
350 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
351
80876c20
LP		 352 default:
353 assert_not_reached("Unknown input type");
354 }
355}
356
eb17e935 357static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
4f2d528d
LP		 358 ExecOutput o;
359 ExecInput i;
47c1d80d 360 int r;
4f2d528d 361
80876c20
LP		 362 assert(context);
363 assert(ident);
364
1e3ad081 365 i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
03fd9c49 366 o = fixup_output(context->std_output, socket_fd);
4f2d528d 367
eb17e935
MS		 368 if (fileno == STDERR_FILENO) {
369 ExecOutput e;
370 e = fixup_output(context->std_error, socket_fd);
80876c20 371
eb17e935
MS		 372 /* This expects the input and output are already set up */
373
374 /* Don't change the stderr file descriptor if we inherit all
375 * the way and are not on a tty */
376 if (e == EXEC_OUTPUT_INHERIT &&
377 o == EXEC_OUTPUT_INHERIT &&
378 i == EXEC_INPUT_NULL &&
379 !is_terminal_input(context->std_input) &&
380 getppid () != 1)
381 return fileno;
382
383 /* Duplicate from stdout if possible */
384 if (e == o || e == EXEC_OUTPUT_INHERIT)
385 return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
071830ff 386
eb17e935 387 o = e;
80876c20 388
eb17e935 389 } else if (o == EXEC_OUTPUT_INHERIT) {
21d21ea4
LP		 390 /* If input got downgraded, inherit the original value */
391 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
eb17e935 392 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
21d21ea4 393
acb591e4 394 /* If the input is connected to anything that's not a /dev/null, inherit that... */
ff876e28 395 if (i != EXEC_INPUT_NULL)
eb17e935 396 return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
071830ff 397
acb591e4
LP		 398 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
399 if (getppid() != 1)
eb17e935 400 return fileno;
94f04347 401
eb17e935
MS		 402 /* We need to open /dev/null here anew, to get the right access mode. */
403 return open_null_as(O_WRONLY, fileno);
071830ff 404 }
94f04347 405
eb17e935 406 switch (o) {
80876c20
LP		 407
408 case EXEC_OUTPUT_NULL:
eb17e935 409 return open_null_as(O_WRONLY, fileno);
80876c20
LP		 410
411 case EXEC_OUTPUT_TTY:
4f2d528d 412 if (is_terminal_input(i))
eb17e935 413 return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
80876c20
LP		 414
415 /* We don't reset the terminal if this is just about output */
eb17e935 416 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
80876c20
LP		 417
418 case EXEC_OUTPUT_SYSLOG:
28dbc1e8 419 case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
9a6bca7a 420 case EXEC_OUTPUT_KMSG:
28dbc1e8 421 case EXEC_OUTPUT_KMSG_AND_CONSOLE:
706343f4
LP		 422 case EXEC_OUTPUT_JOURNAL:
423 case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
eb17e935 424 r = connect_logger_as(context, o, ident, unit_id, fileno);
47c1d80d 425 if (r < 0) {
80cbda35
MS		 426 log_struct_unit(LOG_CRIT, unit_id,
427 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
eb17e935 428 fileno == STDOUT_FILENO ? "out" : "err",
80cbda35
MS		 429 unit_id, strerror(-r),
430 "ERRNO=%d", -r,
431 NULL);
eb17e935 432 r = open_null_as(O_WRONLY, fileno);
47c1d80d
MS		 433 }
434 return r;
4f2d528d
LP		 435
436 case EXEC_OUTPUT_SOCKET:
437 assert(socket_fd >= 0);
eb17e935 438 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
94f04347
LP		 439
440 default:
80876c20 441 assert_not_reached("Unknown error type");
94f04347 442 }
071830ff
LP		 443}
444
02a51aba
LP		 445static int chown_terminal(int fd, uid_t uid) {
446 struct stat st;
447
448 assert(fd >= 0);
02a51aba
LP		 449
450 /* This might fail. What matters are the results. */
bab45044
LP		 451 (void) fchown(fd, uid, -1);
452 (void) fchmod(fd, TTY_MODE);
02a51aba
LP		 453
454 if (fstat(fd, &st) < 0)
455 return -errno;
456
d8b4e2e9 457 if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
02a51aba
LP		 458 return -EPERM;
459
460 return 0;
461}
462
af6da548 463static int setup_confirm_stdio(int *_saved_stdin,
80876c20
LP		 464 int *_saved_stdout) {
465 int fd = -1, saved_stdin, saved_stdout = -1, r;
466
80876c20
LP		 467 assert(_saved_stdin);
468 assert(_saved_stdout);
469
af6da548
LP		 470 saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
471 if (saved_stdin < 0)
472 return -errno;
80876c20 473
af6da548
LP		 474 saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
475 if (saved_stdout < 0) {
476 r = errno;
80876c20
LP		 477 goto fail;
478 }
479
af6da548
LP		 480 fd = acquire_terminal(
481 "/dev/console",
482 false,
483 false,
484 false,
485 DEFAULT_CONFIRM_USEC);
486 if (fd < 0) {
487 r = fd;
80876c20
LP		 488 goto fail;
489 }
490
af6da548
LP		 491 r = chown_terminal(fd, getuid());
492 if (r < 0)
02a51aba 493 goto fail;
02a51aba 494
80876c20 495 if (dup2(fd, STDIN_FILENO) < 0) {
af6da548 496 r = -errno;
80876c20
LP		 497 goto fail;
498 }
499
500 if (dup2(fd, STDOUT_FILENO) < 0) {
af6da548 501 r = -errno;
80876c20
LP		 502 goto fail;
503 }
504
505 if (fd >= 2)
03e334a1 506 safe_close(fd);
80876c20
LP		 507
508 *_saved_stdin = saved_stdin;
509 *_saved_stdout = saved_stdout;
510
511 return 0;
512
513fail:
03e334a1
LP		 514 safe_close(saved_stdout);
515 safe_close(saved_stdin);
516 safe_close(fd);
80876c20
LP		 517
518 return r;
519}
520
44b601bc 521_printf_(1, 2) static int write_confirm_message(const char *format, ...) {
03e334a1 522 _cleanup_close_ int fd = -1;
af6da548 523 va_list ap;
80876c20 524
af6da548 525 assert(format);
80876c20 526
af6da548
LP		 527 fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
528 if (fd < 0)
529 return fd;
80876c20 530
af6da548
LP		 531 va_start(ap, format);
532 vdprintf(fd, format, ap);
533 va_end(ap);
80876c20 534
af6da548
LP		 535 return 0;
536}
80876c20 537
af6da548
LP		 538static int restore_confirm_stdio(int *saved_stdin,
539 int *saved_stdout) {
80876c20 540
af6da548 541 int r = 0;
80876c20 542
af6da548
LP		 543 assert(saved_stdin);
544 assert(saved_stdout);
545
546 release_terminal();
547
548 if (*saved_stdin >= 0)
80876c20 549 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
af6da548 550 r = -errno;
80876c20 551
af6da548 552 if (*saved_stdout >= 0)
80876c20 553 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
af6da548 554 r = -errno;
80876c20 555
03e334a1
LP		 556 safe_close(*saved_stdin);
557 safe_close(*saved_stdout);
af6da548
LP		 558
559 return r;
560}
561
562static int ask_for_confirmation(char *response, char **argv) {
563 int saved_stdout = -1, saved_stdin = -1, r;
e1d75803 564 _cleanup_free_ char *line = NULL;
af6da548
LP		 565
566 r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
567 if (r < 0)
568 return r;
569
570 line = exec_command_line(argv);
571 if (!line)
572 return -ENOMEM;
573
418b9be5 574 r = ask_char(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
af6da548
LP		 575
576 restore_confirm_stdio(&saved_stdin, &saved_stdout);
577
578 return r;
80876c20
LP		 579}
580
81a2b7ce
LP		 581static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
582 bool keep_groups = false;
583 int r;
584
585 assert(context);
586
35b8ca3a 587 /* Lookup and set GID and supplementary group list. Here too
81a2b7ce
LP		 588 * we avoid NSS lookups for gid=0. */
589
590 if (context->group || username) {
591
4b67834e
LP		 592 if (context->group) {
593 const char *g = context->group;
594
595 if ((r = get_group_creds(&g, &gid)) < 0)
81a2b7ce 596 return r;
4b67834e 597 }
81a2b7ce
LP		 598
599 /* First step, initialize groups from /etc/groups */
600 if (username && gid != 0) {
601 if (initgroups(username, gid) < 0)
602 return -errno;
603
604 keep_groups = true;
605 }
606
607 /* Second step, set our gids */
608 if (setresgid(gid, gid, gid) < 0)
609 return -errno;
610 }
611
612 if (context->supplementary_groups) {
613 int ngroups_max, k;
614 gid_t *gids;
615 char **i;
616
617 /* Final step, initialize any manually set supplementary groups */
da19d5c1 618 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
81a2b7ce
LP		 619
620 if (!(gids = new(gid_t, ngroups_max)))
621 return -ENOMEM;
622
623 if (keep_groups) {
624 if ((k = getgroups(ngroups_max, gids)) < 0) {
625 free(gids);
626 return -errno;
627 }
628 } else
629 k = 0;
630
631 STRV_FOREACH(i, context->supplementary_groups) {
4b67834e 632 const char *g;
81a2b7ce
LP		 633
634 if (k >= ngroups_max) {
635 free(gids);
636 return -E2BIG;
637 }
638
4b67834e
LP		 639 g = *i;
640 r = get_group_creds(&g, gids+k);
641 if (r < 0) {
81a2b7ce
LP		 642 free(gids);
643 return r;
644 }
645
646 k++;
647 }
648
649 if (setgroups(k, gids) < 0) {
650 free(gids);
651 return -errno;
652 }
653
654 free(gids);
655 }
656
657 return 0;
658}
659
660static int enforce_user(const ExecContext *context, uid_t uid) {
81a2b7ce
LP		 661 assert(context);
662
663 /* Sets (but doesn't lookup) the uid and make sure we keep the
664 * capabilities while doing so. */
665
666 if (context->capabilities) {
5ce70e5b 667 _cleanup_cap_free_ cap_t d = NULL;
81a2b7ce
LP		 668 static const cap_value_t bits[] = {
669 CAP_SETUID, /* Necessary so that we can run setresuid() below */
670 CAP_SETPCAP /* Necessary so that we can set PR_SET_SECUREBITS later on */
671 };
672
673 /* First step: If we need to keep capabilities but
674 * drop privileges we need to make sure we keep our
cbb21cca 675 * caps, while we drop privileges. */
693ced48 676 if (uid != 0) {
cbb21cca 677 int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
693ced48
LP		 678
679 if (prctl(PR_GET_SECUREBITS) != sb)
680 if (prctl(PR_SET_SECUREBITS, sb) < 0)
681 return -errno;
682 }
81a2b7ce 683
35b8ca3a 684 /* Second step: set the capabilities. This will reduce
81a2b7ce
LP		 685 * the capabilities to the minimum we need. */
686
5ce70e5b
ZJS		 687 d = cap_dup(context->capabilities);
688 if (!d)
81a2b7ce
LP		 689 return -errno;
690
691 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
5ce70e5b
ZJS		 692 cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0)
693 return -errno;
81a2b7ce 694
5ce70e5b
ZJS		 695 if (cap_set_proc(d) < 0)
696 return -errno;
81a2b7ce
LP		 697 }
698
699 /* Third step: actually set the uids */
700 if (setresuid(uid, uid, uid) < 0)
701 return -errno;
702
703 /* At this point we should have all necessary capabilities but
704 are otherwise a normal user. However, the caps might got
705 corrupted due to the setresuid() so we need clean them up
706 later. This is done outside of this call. */
707
708 return 0;
709}
710
5b6319dc
LP		 711#ifdef HAVE_PAM
712
713static int null_conv(
714 int num_msg,
715 const struct pam_message **msg,
716 struct pam_response **resp,
717 void *appdata_ptr) {
718
719 /* We don't support conversations */
720
721 return PAM_CONV_ERR;
722}
723
724static int setup_pam(
725 const char *name,
726 const char *user,
940c5210 727 uid_t uid,
5b6319dc
LP		 728 const char *tty,
729 char ***pam_env,
730 int fds[], unsigned n_fds) {
731
732 static const struct pam_conv conv = {
733 .conv = null_conv,
734 .appdata_ptr = NULL
735 };
736
737 pam_handle_t *handle = NULL;
738 sigset_t ss, old_ss;
739 int pam_code = PAM_SUCCESS;
9ba35398 740 int err;
5b6319dc
LP		 741 char **e = NULL;
742 bool close_session = false;
743 pid_t pam_pid = 0, parent_pid;
970edce6 744 int flags = 0;
5b6319dc
LP		 745
746 assert(name);
747 assert(user);
748 assert(pam_env);
749
750 /* We set up PAM in the parent process, then fork. The child
35b8ca3a 751 * will then stay around until killed via PR_GET_PDEATHSIG or
5b6319dc
LP		 752 * systemd via the cgroup logic. It will then remove the PAM
753 * session again. The parent process will exec() the actual
754 * daemon. We do things this way to ensure that the main PID
755 * of the daemon is the one we initially fork()ed. */
756
970edce6
ZJS		 757 if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
758 flags |= PAM_SILENT;
759
f546241b
ZJS		 760 pam_code = pam_start(name, user, &conv, &handle);
761 if (pam_code != PAM_SUCCESS) {
5b6319dc
LP		 762 handle = NULL;
763 goto fail;
764 }
765
f546241b
ZJS		 766 if (tty) {
767 pam_code = pam_set_item(handle, PAM_TTY, tty);
768 if (pam_code != PAM_SUCCESS)
5b6319dc 769 goto fail;
f546241b 770 }
5b6319dc 771
970edce6 772 pam_code = pam_acct_mgmt(handle, flags);
f546241b 773 if (pam_code != PAM_SUCCESS)
5b6319dc
LP		 774 goto fail;
775
970edce6 776 pam_code = pam_open_session(handle, flags);
f546241b 777 if (pam_code != PAM_SUCCESS)
5b6319dc
LP		 778 goto fail;
779
780 close_session = true;
781
f546241b
ZJS		 782 e = pam_getenvlist(handle);
783 if (!e) {
5b6319dc
LP		 784 pam_code = PAM_BUF_ERR;
785 goto fail;
786 }
787
788 /* Block SIGTERM, so that we know that it won't get lost in
789 * the child */
790 if (sigemptyset(&ss) < 0 ||
791 sigaddset(&ss, SIGTERM) < 0 ||
792 sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
793 goto fail;
794
795 parent_pid = getpid();
796
f546241b
ZJS		 797 pam_pid = fork();
798 if (pam_pid < 0)
5b6319dc
LP		 799 goto fail;
800
801 if (pam_pid == 0) {
802 int sig;
803 int r = EXIT_PAM;
804
805 /* The child's job is to reset the PAM session on
806 * termination */
807
808 /* This string must fit in 10 chars (i.e. the length
5d6b1584
LP		 809 * of "/sbin/init"), to look pretty in /bin/ps */
810 rename_process("(sd-pam)");
5b6319dc
LP		 811
812 /* Make sure we don't keep open the passed fds in this
813 child. We assume that otherwise only those fds are
814 open here that have been opened by PAM. */
815 close_many(fds, n_fds);
816
940c5210
AK		 817 /* Drop privileges - we don't need any to pam_close_session
818 * and this will make PR_SET_PDEATHSIG work in most cases.
819 * If this fails, ignore the error - but expect sd-pam threads
820 * to fail to exit normally */
821 if (setresuid(uid, uid, uid) < 0)
822 log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
823
824 /* Wait until our parent died. This will only work if
825 * the above setresuid() succeeds, otherwise the kernel
826 * will not allow unprivileged parents kill their privileged
827 * children this way. We rely on the control groups kill logic
5b6319dc
LP		 828 * to do the rest for us. */
829 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
830 goto child_finish;
831
832 /* Check if our parent process might already have
833 * died? */
834 if (getppid() == parent_pid) {
3dead8d9
LP		 835 for (;;) {
836 if (sigwait(&ss, &sig) < 0) {
837 if (errno == EINTR)
838 continue;
839
840 goto child_finish;
841 }
5b6319dc 842
3dead8d9
LP		 843 assert(sig == SIGTERM);
844 break;
845 }
5b6319dc
LP		 846 }
847
3dead8d9 848 /* If our parent died we'll end the session */
f546241b 849 if (getppid() != parent_pid) {
970edce6 850 pam_code = pam_close_session(handle, flags);
f546241b 851 if (pam_code != PAM_SUCCESS)
5b6319dc 852 goto child_finish;
f546241b 853 }
5b6319dc
LP		 854
855 r = 0;
856
857 child_finish:
970edce6 858 pam_end(handle, pam_code | flags);
5b6319dc
LP		 859 _exit(r);
860 }
861
862 /* If the child was forked off successfully it will do all the
863 * cleanups, so forget about the handle here. */
864 handle = NULL;
865
3b8bddde 866 /* Unblock SIGTERM again in the parent */
5b6319dc
LP		 867 if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
868 goto fail;
869
870 /* We close the log explicitly here, since the PAM modules
871 * might have opened it, but we don't want this fd around. */
872 closelog();
873
aa87e624
LP		 874 *pam_env = e;
875 e = NULL;
876
5b6319dc
LP		 877 return 0;
878
879fail:
970edce6
ZJS		 880 if (pam_code != PAM_SUCCESS) {
881 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
9ba35398 882 err = -EPERM; /* PAM errors do not map to errno */
970edce6
ZJS		 883 } else {
884 log_error("PAM failed: %m");
9ba35398 885 err = -errno;
970edce6 886 }
9ba35398 887
5b6319dc
LP		 888 if (handle) {
889 if (close_session)
970edce6 890 pam_code = pam_close_session(handle, flags);
5b6319dc 891
970edce6 892 pam_end(handle, pam_code | flags);
5b6319dc
LP		 893 }
894
895 strv_free(e);
896
897 closelog();
898
430c18ed 899 if (pam_pid > 1) {
5b6319dc 900 kill(pam_pid, SIGTERM);
430c18ed
LP		 901 kill(pam_pid, SIGCONT);
902 }
5b6319dc 903
9ba35398 904 return err;
5b6319dc
LP		 905}
906#endif
907
5d6b1584
LP		 908static void rename_process_from_path(const char *path) {
909 char process_name[11];
910 const char *p;
911 size_t l;
912
913 /* This resulting string must fit in 10 chars (i.e. the length
914 * of "/sbin/init") to look pretty in /bin/ps */
915
2b6bf07d 916 p = basename(path);
5d6b1584
LP		 917 if (isempty(p)) {
918 rename_process("(...)");
919 return;
920 }
921
922 l = strlen(p);
923 if (l > 8) {
924 /* The end of the process name is usually more
925 * interesting, since the first bit might just be
926 * "systemd-" */
927 p = p + l - 8;
928 l = 8;
929 }
930
931 process_name[0] = '(';
932 memcpy(process_name+1, p, l);
933 process_name[1+l] = ')';
934 process_name[1+l+1] = 0;
935
936 rename_process(process_name);
937}
938
c0467cf3 939#ifdef HAVE_SECCOMP
17df7223 940
c0467cf3 941static int apply_seccomp(ExecContext *c) {
17df7223
LP		 942 uint32_t negative_action, action;
943 scmp_filter_ctx *seccomp;
c0467cf3
RC		 944 Iterator i;
945 void *id;
17df7223 946 int r;
8351ceae 947
c0467cf3 948 assert(c);
8351ceae 949
17df7223
LP		 950 negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
951
952 seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
953 if (!seccomp)
954 return -ENOMEM;
8351ceae 955
e9642be2
LP		 956 if (c->syscall_archs) {
957
958 SET_FOREACH(id, c->syscall_archs, i) {
959 r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
960 if (r == -EEXIST)
961 continue;
7c66bae2
LP		 962 if (r < 0)
963 goto finish;
e9642be2 964 }
e9642be2 965
7c66bae2 966 } else {
e9642be2 967 r = seccomp_add_secondary_archs(seccomp);
7c66bae2
LP		 968 if (r < 0)
969 goto finish;
57183d11 970 }
8351ceae 971
57183d11 972 action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
17df7223
LP		 973 SET_FOREACH(id, c->syscall_filter, i) {
974 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
7c66bae2
LP		 975 if (r < 0)
976 goto finish;
c0467cf3 977 }
8351ceae 978
7c66bae2
LP		 979 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
980 if (r < 0)
981 goto finish;
982
17df7223 983 r = seccomp_load(seccomp);
7c66bae2
LP		 984
985finish:
17df7223 986 seccomp_release(seccomp);
4298d0b5
LP		 987 return r;
988}
989
990static int apply_address_families(ExecContext *c) {
991 scmp_filter_ctx *seccomp;
992 Iterator i;
993 int r;
994
995 assert(c);
996
997 seccomp = seccomp_init(SCMP_ACT_ALLOW);
998 if (!seccomp)
999 return -ENOMEM;
1000
1001 r = seccomp_add_secondary_archs(seccomp);
1002 if (r < 0)
1003 goto finish;
1004
1005 if (c->address_families_whitelist) {
1006 int af, first = 0, last = 0;
1007 void *afp;
1008
1009 /* If this is a whitelist, we first block the address
1010 * families that are out of range and then everything
1011 * that is not in the set. First, we find the lowest
1012 * and highest address family in the set. */
1013
1014 SET_FOREACH(afp, c->address_families, i) {
1015 af = PTR_TO_INT(afp);
17df7223 1016
4298d0b5
LP		 1017 if (af <= 0 || af >= af_max())
1018 continue;
1019
1020 if (first == 0 || af < first)
1021 first = af;
1022
1023 if (last == 0 || af > last)
1024 last = af;
1025 }
1026
1027 assert((first == 0) == (last == 0));
1028
1029 if (first == 0) {
1030
1031 /* No entries in the valid range, block everything */
1032 r = seccomp_rule_add(
1033 seccomp,
1034 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1035 SCMP_SYS(socket),
1036 0);
1037 if (r < 0)
1038 goto finish;
1039
1040 } else {
1041
1042 /* Block everything below the first entry */
1043 r = seccomp_rule_add(
1044 seccomp,
1045 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1046 SCMP_SYS(socket),
1047 1,
1048 SCMP_A0(SCMP_CMP_LT, first));
1049 if (r < 0)
1050 goto finish;
1051
1052 /* Block everything above the last entry */
1053 r = seccomp_rule_add(
1054 seccomp,
1055 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1056 SCMP_SYS(socket),
1057 1,
1058 SCMP_A0(SCMP_CMP_GT, last));
1059 if (r < 0)
1060 goto finish;
1061
1062 /* Block everything between the first and last
1063 * entry */
1064 for (af = 1; af < af_max(); af++) {
1065
1066 if (set_contains(c->address_families, INT_TO_PTR(af)))
1067 continue;
1068
1069 r = seccomp_rule_add(
1070 seccomp,
1071 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1072 SCMP_SYS(socket),
1073 1,
1074 SCMP_A0(SCMP_CMP_EQ, af));
1075 if (r < 0)
1076 goto finish;
1077 }
1078 }
1079
1080 } else {
1081 void *af;
1082
1083 /* If this is a blacklist, then generate one rule for
1084 * each address family that are then combined in OR
1085 * checks. */
1086
1087 SET_FOREACH(af, c->address_families, i) {
1088
1089 r = seccomp_rule_add(
1090 seccomp,
1091 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1092 SCMP_SYS(socket),
1093 1,
1094 SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
1095 if (r < 0)
1096 goto finish;
1097 }
1098 }
1099
1100 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1101 if (r < 0)
1102 goto finish;
1103
1104 r = seccomp_load(seccomp);
1105
1106finish:
1107 seccomp_release(seccomp);
17df7223 1108 return r;
8351ceae 1109}
4298d0b5 1110
c0467cf3 1111#endif
8351ceae 1112
31a7eb86
ZJS		 1113static void do_idle_pipe_dance(int idle_pipe[4]) {
1114 assert(idle_pipe);
1115
03e334a1
LP		 1116
1117 safe_close(idle_pipe[1]);
1118 safe_close(idle_pipe[2]);
31a7eb86
ZJS		 1119
1120 if (idle_pipe[0] >= 0) {
1121 int r;
1122
1123 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1124
1125 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1126 /* Signal systemd that we are bored and want to continue. */
1127 write(idle_pipe[3], "x", 1);
1128
1129 /* Wait for systemd to react to the signal above. */
1130 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1131 }
1132
03e334a1 1133 safe_close(idle_pipe[0]);
31a7eb86
ZJS		 1134
1135 }
1136
03e334a1 1137 safe_close(idle_pipe[3]);
31a7eb86
ZJS		 1138}
1139
7cae38c4
LP		 1140static int build_environment(
1141 ExecContext *c,
1142 unsigned n_fds,
09812eb7 1143 usec_t watchdog_usec,
7cae38c4
LP		 1144 const char *home,
1145 const char *username,
1146 const char *shell,
1147 char ***ret) {
1148
1149 _cleanup_strv_free_ char **our_env = NULL;
1150 unsigned n_env = 0;
1151 char *x;
1152
1153 assert(c);
1154 assert(ret);
1155
09812eb7 1156 our_env = new0(char*, 10);
7cae38c4
LP		 1157 if (!our_env)
1158 return -ENOMEM;
1159
1160 if (n_fds > 0) {
ccd06097 1161 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
7cae38c4
LP		 1162 return -ENOMEM;
1163 our_env[n_env++] = x;
1164
1165 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1166 return -ENOMEM;
1167 our_env[n_env++] = x;
1168 }
1169
09812eb7 1170 if (watchdog_usec > 0) {
ccd06097 1171 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
09812eb7
LP		 1172 return -ENOMEM;
1173 our_env[n_env++] = x;
1174
de0671ee 1175 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, watchdog_usec) < 0)
09812eb7
LP		 1176 return -ENOMEM;
1177 our_env[n_env++] = x;
1178 }
1179
7cae38c4
LP		 1180 if (home) {
1181 x = strappend("HOME=", home);
1182 if (!x)
1183 return -ENOMEM;
1184 our_env[n_env++] = x;
1185 }
1186
1187 if (username) {
1188 x = strappend("LOGNAME=", username);
1189 if (!x)
1190 return -ENOMEM;
1191 our_env[n_env++] = x;
1192
1193 x = strappend("USER=", username);
1194 if (!x)
1195 return -ENOMEM;
1196 our_env[n_env++] = x;
1197 }
1198
1199 if (shell) {
1200 x = strappend("SHELL=", shell);
1201 if (!x)
1202 return -ENOMEM;
1203 our_env[n_env++] = x;
1204 }
1205
1206 if (is_terminal_input(c->std_input) ||
1207 c->std_output == EXEC_OUTPUT_TTY ||
1208 c->std_error == EXEC_OUTPUT_TTY ||
1209 c->tty_path) {
1210
1211 x = strdup(default_term_for_tty(tty_path(c)));
1212 if (!x)
1213 return -ENOMEM;
1214 our_env[n_env++] = x;
1215 }
1216
1217 our_env[n_env++] = NULL;
09812eb7 1218 assert(n_env <= 10);
7cae38c4
LP		 1219
1220 *ret = our_env;
1221 our_env = NULL;
1222
1223 return 0;
1224}
1225
9fb86720 1226int exec_spawn(ExecCommand *command,
9e2f7c11 1227 char **argv,
c17ec25e 1228 ExecContext *context,
c2748801 1229 int fds[], unsigned n_fds,
1137a57c 1230 char **environment,
81a2b7ce
LP		 1231 bool apply_permissions,
1232 bool apply_chroot,
1e3ad081 1233 bool apply_tty_stdin,
80876c20 1234 bool confirm_spawn,
13b84ec7 1235 CGroupControllerMask cgroup_supported,
4ad49000 1236 const char *cgroup_path,
e66cf1a3 1237 const char *runtime_prefix,
62bca2c6 1238 const char *unit_id,
09812eb7 1239 usec_t watchdog_usec,
31a7eb86 1240 int idle_pipe[4],
613b411c 1241 ExecRuntime *runtime,
81a2b7ce
LP		 1242 pid_t *ret) {
1243
4ad49000
LP		 1244 _cleanup_strv_free_ char **files_env = NULL;
1245 int socket_fd;
1246 char *line;
034c6ed7 1247 pid_t pid;
8e274523 1248 int r;
034c6ed7 1249
5cb5a6ff
LP		 1250 assert(command);
1251 assert(context);
1252 assert(ret);
034c6ed7
LP		 1253 assert(fds || n_fds <= 0);
1254
4f2d528d
LP		 1255 if (context->std_input == EXEC_INPUT_SOCKET ||
1256 context->std_output == EXEC_OUTPUT_SOCKET ||
1257 context->std_error == EXEC_OUTPUT_SOCKET) {
1258
1259 if (n_fds != 1)
1260 return -EINVAL;
1261
1262 socket_fd = fds[0];
1263
1264 fds = NULL;
1265 n_fds = 0;
1266 } else
1267 socket_fd = -1;
1268
b66871da
ZJS		 1269 r = exec_context_load_environment(context, &files_env);
1270 if (r < 0) {
bbc9006e
MT		 1271 log_struct_unit(LOG_ERR,
1272 unit_id,
23635a85
ZJS		 1273 "MESSAGE=Failed to load environment files: %s", strerror(-r),
1274 "ERRNO=%d", -r,
1275 NULL);
8c7be95e
LP		 1276 return r;
1277 }
1278
9e2f7c11
LP		 1279 if (!argv)
1280 argv = command->argv;
1281
af6da548 1282 line = exec_command_line(argv);
b66871da
ZJS		 1283 if (!line)
1284 return log_oom();
1a63a750 1285
bbc9006e 1286 log_struct_unit(LOG_DEBUG,
099a804b
LP		 1287 unit_id,
1288 "EXECUTABLE=%s", command->path,
1289 "MESSAGE=About to execute: %s", line,
1290 NULL);
1a63a750 1291 free(line);
acbb0225 1292
b66871da
ZJS		 1293 pid = fork();
1294 if (pid < 0)
1295 return -errno;
034c6ed7
LP		 1296
1297 if (pid == 0) {
613b411c 1298 _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
59fccd82 1299 const char *username = NULL, *home = NULL, *shell = NULL;
7cae38c4 1300 unsigned n_dont_close = 0;
613b411c 1301 int dont_close[n_fds + 3];
81a2b7ce
LP		 1302 uid_t uid = (uid_t) -1;
1303 gid_t gid = (gid_t) -1;
613b411c
LP		 1304 sigset_t ss;
1305 int i, err;
309bff19 1306
034c6ed7 1307 /* child */
5cb5a6ff 1308
5d6b1584 1309 rename_process_from_path(command->path);
5b6319dc 1310
1b91d3e8
LP		 1311 /* We reset exactly these signals, since they are the
1312 * only ones we set to SIG_IGN in the main daemon. All
1313 * others we leave untouched because we set them to
1314 * SIG_DFL or a valid handler initially, both of which
1315 * will be demoted to SIG_DFL. */
1316 default_signals(SIGNALS_CRASH_HANDLER,
9a34ec5f 1317 SIGNALS_IGNORE, -1);
7b683879 1318
353e12c2
LP		 1319 if (context->ignore_sigpipe)
1320 ignore_signals(SIGPIPE, -1);
1321
1322 assert_se(sigemptyset(&ss) == 0);
1323 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
4c2630eb 1324 err = -errno;
309bff19 1325 r = EXIT_SIGNAL_MASK;
8c7be95e 1326 goto fail_child;
309bff19
LP		 1327 }
1328
31a7eb86
ZJS		 1329 if (idle_pipe)
1330 do_idle_pipe_dance(idle_pipe);
f2b68789 1331
85d73053
LP		 1332 /* Close sockets very early to make sure we don't
1333 * block init reexecution because it cannot bind its
1334 * sockets */
4d8a7798 1335 log_forget_fds();
613b411c
LP		 1336
1337 if (socket_fd >= 0)
1338 dont_close[n_dont_close++] = socket_fd;
1339 if (n_fds > 0) {
1340 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1341 n_dont_close += n_fds;
1342 }
1343 if (runtime) {
1344 if (runtime->netns_storage_socket[0] >= 0)
1345 dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
1346 if (runtime->netns_storage_socket[1] >= 0)
1347 dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
1348 }
1349
1350 err = close_all_fds(dont_close, n_dont_close);
4c2630eb 1351 if (err < 0) {
fc9b2a84 1352 r = EXIT_FDS;
8c7be95e 1353 goto fail_child;
fc9b2a84
LP		 1354 }
1355
74922904 1356 if (!context->same_pgrp)
8d567588 1357 if (setsid() < 0) {
4c2630eb 1358 err = -errno;
8d567588 1359 r = EXIT_SETSID;
8c7be95e 1360 goto fail_child;
8d567588 1361 }
80876c20 1362
6ea832a2
LP		 1363 exec_context_tty_reset(context);
1364
af6da548 1365 if (confirm_spawn) {
80876c20
LP		 1366 char response;
1367
af6da548
LP		 1368 err = ask_for_confirmation(&response, argv);
1369 if (err == -ETIMEDOUT)
1370 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1371 else if (err < 0)
1372 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1373 else if (response == 's') {
1374 write_confirm_message("Skipping execution.\n");
4c2630eb 1375 err = -ECANCELED;
80876c20 1376 r = EXIT_CONFIRM;
8c7be95e 1377 goto fail_child;
af6da548
LP		 1378 } else if (response == 'n') {
1379 write_confirm_message("Failing execution.\n");
4c2630eb 1380 err = r = 0;
8c7be95e 1381 goto fail_child;
ee2b4894 1382 }
034c6ed7
LP		 1383 }
1384
da726a4d
LP		 1385 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1386 * must sure to drop O_NONBLOCK */
1387 if (socket_fd >= 0)
1388 fd_nonblock(socket_fd, false);
1389
af6da548
LP		 1390 err = setup_input(context, socket_fd, apply_tty_stdin);
1391 if (err < 0) {
1392 r = EXIT_STDIN;
1393 goto fail_child;
4c2630eb 1394 }
9eba9da4 1395
2b6bf07d 1396 err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
af6da548
LP		 1397 if (err < 0) {
1398 r = EXIT_STDOUT;
1399 goto fail_child;
4c2630eb 1400 }
94f04347 1401
2b6bf07d 1402 err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
4c2630eb 1403 if (err < 0) {
80876c20 1404 r = EXIT_STDERR;
8c7be95e 1405 goto fail_child;
071830ff
LP		 1406 }
1407
4ad49000 1408 if (cgroup_path) {
13b84ec7 1409 err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
4c2630eb 1410 if (err < 0) {
8e274523 1411 r = EXIT_CGROUP;
8c7be95e 1412 goto fail_child;
8e274523 1413 }
4c2630eb 1414 }
8e274523 1415
dd6c17b1 1416 if (context->oom_score_adjust_set) {
fb33a393 1417 char t[16];
034c6ed7 1418
dd6c17b1 1419 snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
fb33a393 1420 char_array_0(t);
034c6ed7 1421
574d5f2d 1422 if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
8600c525
KS		 1423 err = -errno;
1424 r = EXIT_OOM_ADJUST;
1425 goto fail_child;
fb33a393 1426 }
034c6ed7
LP		 1427 }
1428
fb33a393
LP		 1429 if (context->nice_set)
1430 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
4c2630eb 1431 err = -errno;
fb33a393 1432 r = EXIT_NICE;
8c7be95e 1433 goto fail_child;
fb33a393
LP		 1434 }
1435
94f04347 1436 if (context->cpu_sched_set) {
b92bea5d
ZJS		 1437 struct sched_param param = {
1438 .sched_priority = context->cpu_sched_priority,
1439 };
94f04347 1440
e62d8c39
ZJS		 1441 r = sched_setscheduler(0,
1442 context->cpu_sched_policy |
1443 (context->cpu_sched_reset_on_fork ?
1444 SCHED_RESET_ON_FORK : 0),
1445 &param);
1446 if (r < 0) {
4c2630eb 1447 err = -errno;
94f04347 1448 r = EXIT_SETSCHEDULER;
8c7be95e 1449 goto fail_child;
94f04347
LP		 1450 }
1451 }
1452
82c121a4
LP		 1453 if (context->cpuset)
1454 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
4c2630eb 1455 err = -errno;
94f04347 1456 r = EXIT_CPUAFFINITY;
8c7be95e 1457 goto fail_child;
94f04347
LP		 1458 }
1459
9eba9da4
LP		 1460 if (context->ioprio_set)
1461 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
4c2630eb 1462 err = -errno;
9eba9da4 1463 r = EXIT_IOPRIO;
8c7be95e 1464 goto fail_child;
9eba9da4
LP		 1465 }
1466
d88a251b 1467 if (context->timer_slack_nsec != (nsec_t) -1)
03fae018 1468 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
4c2630eb 1469 err = -errno;
94f04347 1470 r = EXIT_TIMERSLACK;
8c7be95e 1471 goto fail_child;
94f04347
LP		 1472 }
1473
ac45f971
LP		 1474 if (context->personality != 0xffffffffUL)
1475 if (personality(context->personality) < 0) {
1476 err = -errno;
1477 r = EXIT_PERSONALITY;
1478 goto fail_child;
1479 }
1480
169c1bda 1481 if (context->utmp_id)
0ad26e09 1482 utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
169c1bda 1483
81a2b7ce
LP		 1484 if (context->user) {
1485 username = context->user;
59fccd82 1486 err = get_user_creds(&username, &uid, &gid, &home, &shell);
4c2630eb 1487 if (err < 0) {
81a2b7ce 1488 r = EXIT_USER;
8c7be95e 1489 goto fail_child;
81a2b7ce 1490 }
d8b4e2e9 1491
4c2630eb
MS		 1492 if (is_terminal_input(context->std_input)) {
1493 err = chown_terminal(STDIN_FILENO, uid);
1494 if (err < 0) {
d8b4e2e9 1495 r = EXIT_STDIN;
8c7be95e 1496 goto fail_child;
d8b4e2e9 1497 }
4c2630eb 1498 }
81a2b7ce
LP		 1499 }
1500
8aa75193
LP		 1501#ifdef HAVE_PAM
1502 if (cgroup_path && context->user && context->pam_name) {
1503 err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
1504 if (err < 0) {
1505 r = EXIT_CGROUP;
1506 goto fail_child;
1507 }
1508
1509
1510 err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
1511 if (err < 0) {
1512 r = EXIT_CGROUP;
1513 goto fail_child;
1514 }
1515 }
1516#endif
1517
e66cf1a3
LP		 1518 if (!strv_isempty(context->runtime_directory) && runtime_prefix) {
1519 char **rt;
1520
1521 STRV_FOREACH(rt, context->runtime_directory) {
1522 _cleanup_free_ char *p;
1523
1524 p = strjoin(runtime_prefix, "/", *rt, NULL);
1525 if (!p) {
1526 r = EXIT_RUNTIME_DIRECTORY;
1527 err = -ENOMEM;
1528 goto fail_child;
1529 }
1530
1531 err = mkdir_safe(p, context->runtime_directory_mode, uid, gid);
1532 if (err < 0) {
1533 r = EXIT_RUNTIME_DIRECTORY;
1534 goto fail_child;
1535 }
1536 }
1537 }
1538
4c2630eb
MS		 1539 if (apply_permissions) {
1540 err = enforce_groups(context, username, gid);
1541 if (err < 0) {
3b8bddde
LP		 1542 r = EXIT_GROUP;
1543 goto fail_child;
1544 }
4c2630eb 1545 }
3b8bddde
LP		 1546
1547 umask(context->umask);
1548
5b6319dc 1549#ifdef HAVE_PAM
b7848021 1550 if (apply_permissions && context->pam_name && username) {
940c5210 1551 err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
4c2630eb 1552 if (err < 0) {
5b6319dc 1553 r = EXIT_PAM;
8c7be95e 1554 goto fail_child;
5b6319dc
LP		 1555 }
1556 }
1557#endif
613b411c
LP		 1558 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
1559 err = setup_netns(runtime->netns_storage_socket);
1560 if (err < 0) {
ff01d048
LP		 1561 r = EXIT_NETWORK;
1562 goto fail_child;
1563 }
ff01d048 1564 }
5b6319dc 1565
613b411c
LP		 1566 if (!strv_isempty(context->read_write_dirs) ||
1567 !strv_isempty(context->read_only_dirs) ||
1568 !strv_isempty(context->inaccessible_dirs) ||
ac0930c8 1569 context->mount_flags != 0 ||
7f112f50 1570 (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
417116f2 1571 context->private_devices ||
1b8689f9
LP		 1572 context->protect_system != PROTECT_SYSTEM_NO ||
1573 context->protect_home != PROTECT_HOME_NO) {
613b411c
LP		 1574
1575 char *tmp = NULL, *var = NULL;
1576
1577 /* The runtime struct only contains the parent
1578 * of the private /tmp, which is
1579 * non-accessible to world users. Inside of it
1580 * there's a /tmp that is sticky, and that's
1581 * the one we want to use here. */
1582
1583 if (context->private_tmp && runtime) {
1584 if (runtime->tmp_dir)
1585 tmp = strappenda(runtime->tmp_dir, "/tmp");
1586 if (runtime->var_tmp_dir)
1587 var = strappenda(runtime->var_tmp_dir, "/tmp");
1588 }
1589
1590 err = setup_namespace(
1591 context->read_write_dirs,
1592 context->read_only_dirs,
1593 context->inaccessible_dirs,
1594 tmp,
1595 var,
7f112f50 1596 context->private_devices,
1b8689f9
LP		 1597 context->protect_home,
1598 context->protect_system,
613b411c 1599 context->mount_flags);
4c2630eb
MS		 1600 if (err < 0) {
1601 r = EXIT_NAMESPACE;
8c7be95e 1602 goto fail_child;
4c2630eb
MS		 1603 }
1604 }
04aa0cb9 1605
81a2b7ce
LP		 1606 if (apply_chroot) {
1607 if (context->root_directory)
1608 if (chroot(context->root_directory) < 0) {
4c2630eb 1609 err = -errno;
81a2b7ce 1610 r = EXIT_CHROOT;
8c7be95e 1611 goto fail_child;
81a2b7ce
LP		 1612 }
1613
1614 if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
4c2630eb 1615 err = -errno;
81a2b7ce 1616 r = EXIT_CHDIR;
8c7be95e 1617 goto fail_child;
81a2b7ce
LP		 1618 }
1619 } else {
7fd1b19b 1620 _cleanup_free_ char *d = NULL;
81a2b7ce
LP		 1621
1622 if (asprintf(&d, "%s/%s",
1623 context->root_directory ? context->root_directory : "",
1624 context->working_directory ? context->working_directory : "") < 0) {
4c2630eb 1625 err = -ENOMEM;
81a2b7ce 1626 r = EXIT_MEMORY;
8c7be95e 1627 goto fail_child;
81a2b7ce
LP		 1628 }
1629
1630 if (chdir(d) < 0) {
4c2630eb 1631 err = -errno;
81a2b7ce 1632 r = EXIT_CHDIR;
8c7be95e 1633 goto fail_child;
81a2b7ce 1634 }
81a2b7ce
LP		 1635 }
1636
fc9b2a84
LP		 1637 /* We repeat the fd closing here, to make sure that
1638 * nothing is leaked from the PAM modules */
4c2630eb
MS		 1639 err = close_all_fds(fds, n_fds);
1640 if (err >= 0)
1641 err = shift_fds(fds, n_fds);
1642 if (err >= 0)
1643 err = flags_fds(fds, n_fds, context->non_blocking);
1644 if (err < 0) {
034c6ed7 1645 r = EXIT_FDS;
8c7be95e 1646 goto fail_child;
034c6ed7
LP		 1647 }
1648
81a2b7ce 1649 if (apply_permissions) {
034c6ed7 1650
517d56b1 1651 for (i = 0; i < _RLIMIT_MAX; i++) {
81a2b7ce
LP		 1652 if (!context->rlimit[i])
1653 continue;
1654
68faf98c 1655 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
4c2630eb 1656 err = -errno;
81a2b7ce 1657 r = EXIT_LIMITS;
8c7be95e 1658 goto fail_child;
81a2b7ce 1659 }
034c6ed7 1660 }
034c6ed7 1661
4c2630eb 1662 if (context->capability_bounding_set_drop) {
ec8927ca 1663 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
4c2630eb 1664 if (err < 0) {
73090dc8
LP		 1665 r = EXIT_CAPABILITIES;
1666 goto fail_child;
1667 }
4c2630eb 1668 }
260abb78 1669
4c2630eb
MS		 1670 if (context->user) {
1671 err = enforce_user(context, uid);
1672 if (err < 0) {
81a2b7ce 1673 r = EXIT_USER;
8c7be95e 1674 goto fail_child;
81a2b7ce 1675 }
4c2630eb 1676 }
81a2b7ce 1677
35b8ca3a 1678 /* PR_GET_SECUREBITS is not privileged, while
693ced48
LP		 1679 * PR_SET_SECUREBITS is. So to suppress
1680 * potential EPERMs we'll try not to call
1681 * PR_SET_SECUREBITS unless necessary. */
1682 if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1683 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
4c2630eb 1684 err = -errno;
693ced48 1685 r = EXIT_SECUREBITS;
8c7be95e 1686 goto fail_child;
693ced48 1687 }
81a2b7ce
LP		 1688
1689 if (context->capabilities)
1690 if (cap_set_proc(context->capabilities) < 0) {
4c2630eb 1691 err = -errno;
81a2b7ce 1692 r = EXIT_CAPABILITIES;
8c7be95e 1693 goto fail_child;
81a2b7ce 1694 }
8351ceae
LP		 1695
1696 if (context->no_new_privileges)
1697 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1698 err = -errno;
1699 r = EXIT_NO_NEW_PRIVILEGES;
1700 goto fail_child;
1701 }
1702
c0467cf3 1703#ifdef HAVE_SECCOMP
f513e420
LP		 1704 if (context->address_families_whitelist ||
1705 !set_isempty(context->address_families)) {
4298d0b5
LP		 1706 err = apply_address_families(context);
1707 if (err < 0) {
1708 r = EXIT_ADDRESS_FAMILIES;
1709 goto fail_child;
1710 }
1711 }
1712
f513e420
LP		 1713 if (context->syscall_whitelist ||
1714 !set_isempty(context->syscall_filter) ||
1715 !set_isempty(context->syscall_archs)) {
c0467cf3 1716 err = apply_seccomp(context);
8351ceae
LP		 1717 if (err < 0) {
1718 r = EXIT_SECCOMP;
1719 goto fail_child;
1720 }
1721 }
c0467cf3 1722#endif
17df7223 1723
7b52a628 1724#ifdef HAVE_SELINUX
5c56a259 1725 if (context->selinux_context && use_selinux()) {
5f8640fb
LP		 1726 err = setexeccon(context->selinux_context);
1727 if (err < 0 && !context->selinux_context_ignore) {
7b52a628
MS		 1728 r = EXIT_SELINUX_CONTEXT;
1729 goto fail_child;
1730 }
1731 }
1732#endif
eef65bf3
MS		 1733
1734#ifdef HAVE_APPARMOR
1735 if (context->apparmor_profile && use_apparmor()) {
1736 err = aa_change_onexec(context->apparmor_profile);
1737 if (err < 0 && !context->apparmor_profile_ignore) {
1738 r = EXIT_APPARMOR_PROFILE;
1739 goto fail_child;
1740 }
1741 }
1742#endif
94f04347
LP		 1743 }
1744
09812eb7 1745 err = build_environment(context, n_fds, watchdog_usec, home, username, shell, &our_env);
7cae38c4 1746 if (r < 0) {
81a2b7ce 1747 r = EXIT_MEMORY;
8c7be95e 1748 goto fail_child;
81a2b7ce 1749 }
034c6ed7 1750
e62d8c39
ZJS		 1751 final_env = strv_env_merge(5,
1752 environment,
1753 our_env,
1754 context->environment,
1755 files_env,
1756 pam_env,
1757 NULL);
1758 if (!final_env) {
4c2630eb 1759 err = -ENOMEM;
81a2b7ce 1760 r = EXIT_MEMORY;
8c7be95e 1761 goto fail_child;
81a2b7ce 1762 }
034c6ed7 1763
e62d8c39
ZJS		 1764 final_argv = replace_env_argv(argv, final_env);
1765 if (!final_argv) {
4c2630eb 1766 err = -ENOMEM;
fab56fc5 1767 r = EXIT_MEMORY;
8c7be95e 1768 goto fail_child;
fab56fc5
LP		 1769 }
1770
a6ff950e
LP		 1771 final_env = strv_env_clean(final_env);
1772
03bb799e
HH		 1773 if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
1774 line = exec_command_line(final_argv);
1775 if (line) {
1776 log_open();
1777 log_struct_unit(LOG_DEBUG,
1778 unit_id,
1779 "EXECUTABLE=%s", command->path,
099a804b
LP		 1780 "MESSAGE=Executing: %s", line,
1781 NULL);
03bb799e
HH		 1782 log_close();
1783 free(line);
1784 line = NULL;
1785 }
1786 }
fab56fc5 1787 execve(command->path, final_argv, final_env);
4c2630eb 1788 err = -errno;
034c6ed7
LP		 1789 r = EXIT_EXEC;
1790
8c7be95e 1791 fail_child:
4c2630eb
MS		 1792 if (r != 0) {
1793 log_open();
23635a85
ZJS		 1794 log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1795 "EXECUTABLE=%s", command->path,
1796 "MESSAGE=Failed at step %s spawning %s: %s",
1797 exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1798 command->path, strerror(-err),
1799 "ERRNO=%d", -err,
1800 NULL);
1801 log_close();
4c2630eb
MS		 1802 }
1803
034c6ed7
LP		 1804 _exit(r);
1805 }
1806
bbc9006e 1807 log_struct_unit(LOG_DEBUG,
e62d8c39 1808 unit_id,
ccd06097
ZJS		 1809 "MESSAGE=Forked %s as "PID_FMT,
1810 command->path, pid,
e62d8c39 1811 NULL);
23635a85 1812
80876c20
LP		 1813 /* We add the new process to the cgroup both in the child (so
1814 * that we can be sure that no user code is ever executed
1815 * outside of the cgroup) and in the parent (so that we can be
1816 * sure that when we kill the cgroup the process will be
1817 * killed too). */
4ad49000
LP		 1818 if (cgroup_path)
1819 cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
2da3263a 1820
b58b4116 1821 exec_status_start(&command->exec_status, pid);
9fb86720 1822
034c6ed7 1823 *ret = pid;
5cb5a6ff
LP		 1824 return 0;
1825}
1826
034c6ed7
LP		 1827void exec_context_init(ExecContext *c) {
1828 assert(c);
1829
4c12626c 1830 c->umask = 0022;
9eba9da4 1831 c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
94f04347 1832 c->cpu_sched_policy = SCHED_OTHER;
071830ff 1833 c->syslog_priority = LOG_DAEMON|LOG_INFO;
74922904 1834 c->syslog_level_prefix = true;
353e12c2 1835 c->ignore_sigpipe = true;
d88a251b 1836 c->timer_slack_nsec = (nsec_t) -1;
ac45f971 1837 c->personality = 0xffffffffUL;
e66cf1a3 1838 c->runtime_directory_mode = 0755;
034c6ed7
LP		 1839}
1840
613b411c 1841void exec_context_done(ExecContext *c) {
5cb5a6ff
LP		 1842 unsigned l;
1843
1844 assert(c);
1845
1846 strv_free(c->environment);
034c6ed7 1847 c->environment = NULL;
5cb5a6ff 1848
8c7be95e
LP		 1849 strv_free(c->environment_files);
1850 c->environment_files = NULL;
1851
034c6ed7 1852 for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
5cb5a6ff 1853 free(c->rlimit[l]);
034c6ed7
LP		 1854 c->rlimit[l] = NULL;
1855 }
1856
9eba9da4
LP		 1857 free(c->working_directory);
1858 c->working_directory = NULL;
1859 free(c->root_directory);
1860 c->root_directory = NULL;
5cb5a6ff 1861
80876c20
LP		 1862 free(c->tty_path);
1863 c->tty_path = NULL;
1864
071830ff
LP		 1865 free(c->syslog_identifier);
1866 c->syslog_identifier = NULL;
1867
5cb5a6ff 1868 free(c->user);
034c6ed7
LP		 1869 c->user = NULL;
1870
5cb5a6ff 1871 free(c->group);
034c6ed7
LP		 1872 c->group = NULL;
1873
1874 strv_free(c->supplementary_groups);
1875 c->supplementary_groups = NULL;
94f04347 1876
5b6319dc
LP		 1877 free(c->pam_name);
1878 c->pam_name = NULL;
1879
94f04347
LP		 1880 if (c->capabilities) {
1881 cap_free(c->capabilities);
1882 c->capabilities = NULL;
1883 }
15ae422b
LP		 1884
1885 strv_free(c->read_only_dirs);
1886 c->read_only_dirs = NULL;
1887
1888 strv_free(c->read_write_dirs);
1889 c->read_write_dirs = NULL;
1890
1891 strv_free(c->inaccessible_dirs);
1892 c->inaccessible_dirs = NULL;
82c121a4
LP		 1893
1894 if (c->cpuset)
1895 CPU_FREE(c->cpuset);
86a3475b
LP		 1896
1897 free(c->utmp_id);
1898 c->utmp_id = NULL;
b9a0e010 1899
7b52a628
MS		 1900 free(c->selinux_context);
1901 c->selinux_context = NULL;
1902
eef65bf3
MS		 1903 free(c->apparmor_profile);
1904 c->apparmor_profile = NULL;
1905
17df7223
LP		 1906 set_free(c->syscall_filter);
1907 c->syscall_filter = NULL;
57183d11
LP		 1908
1909 set_free(c->syscall_archs);
1910 c->syscall_archs = NULL;
4298d0b5
LP		 1911
1912 set_free(c->address_families);
1913 c->address_families = NULL;
e66cf1a3
LP		 1914
1915 strv_free(c->runtime_directory);
1916 c->runtime_directory = NULL;
1917}
1918
1919int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
1920 char **i;
1921
1922 assert(c);
1923
1924 if (!runtime_prefix)
1925 return 0;
1926
1927 STRV_FOREACH(i, c->runtime_directory) {
1928 _cleanup_free_ char *p;
1929
1930 p = strjoin(runtime_prefix, "/", *i, NULL);
1931 if (!p)
1932 return -ENOMEM;
1933
1934 /* We execute this synchronously, since we need to be
1935 * sure this is gone when we start the service
1936 * next. */
1937 rm_rf_dangerous(p, false, true, false);
1938 }
1939
1940 return 0;
5cb5a6ff
LP		 1941}
1942
43d0fcbd
LP		 1943void exec_command_done(ExecCommand *c) {
1944 assert(c);
1945
1946 free(c->path);
1947 c->path = NULL;
1948
1949 strv_free(c->argv);
1950 c->argv = NULL;
1951}
1952
1953void exec_command_done_array(ExecCommand *c, unsigned n) {
1954 unsigned i;
1955
1956 for (i = 0; i < n; i++)
1957 exec_command_done(c+i);
1958}
1959
5cb5a6ff
LP		 1960void exec_command_free_list(ExecCommand *c) {
1961 ExecCommand *i;
1962
1963 while ((i = c)) {
71fda00f 1964 LIST_REMOVE(command, c, i);
43d0fcbd 1965 exec_command_done(i);
5cb5a6ff
LP		 1966 free(i);
1967 }
1968}
1969
034c6ed7
LP		 1970void exec_command_free_array(ExecCommand **c, unsigned n) {
1971 unsigned i;
1972
1973 for (i = 0; i < n; i++) {
1974 exec_command_free_list(c[i]);
1975 c[i] = NULL;
1976 }
1977}
1978
8c7be95e
LP		 1979int exec_context_load_environment(const ExecContext *c, char ***l) {
1980 char **i, **r = NULL;
1981
1982 assert(c);
1983 assert(l);
1984
1985 STRV_FOREACH(i, c->environment_files) {
1986 char *fn;
1987 int k;
1988 bool ignore = false;
1989 char **p;
7fd1b19b 1990 _cleanup_globfree_ glob_t pglob = {};
2bef10ab 1991 int count, n;
8c7be95e
LP		 1992
1993 fn = *i;
1994
1995 if (fn[0] == '-') {
1996 ignore = true;
1997 fn ++;
1998 }
1999
2000 if (!path_is_absolute(fn)) {
8c7be95e
LP		 2001 if (ignore)
2002 continue;
2003
2004 strv_free(r);
2005 return -EINVAL;
2006 }
2007
2bef10ab 2008 /* Filename supports globbing, take all matching files */
2bef10ab
PL		 2009 errno = 0;
2010 if (glob(fn, 0, NULL, &pglob) != 0) {
2bef10ab
PL		 2011 if (ignore)
2012 continue;
8c7be95e 2013
2bef10ab
PL		 2014 strv_free(r);
2015 return errno ? -errno : -EINVAL;
2016 }
2017 count = pglob.gl_pathc;
2018 if (count == 0) {
8c7be95e
LP		 2019 if (ignore)
2020 continue;
2021
2022 strv_free(r);
2bef10ab 2023 return -EINVAL;
8c7be95e 2024 }
2bef10ab 2025 for (n = 0; n < count; n++) {
717603e3 2026 k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
2bef10ab
PL		 2027 if (k < 0) {
2028 if (ignore)
2029 continue;
8c7be95e 2030
2bef10ab 2031 strv_free(r);
2bef10ab 2032 return k;
e9c1ea9d 2033 }
ebc05a09 2034 /* Log invalid environment variables with filename */
e9c1ea9d
JSJ		 2035 if (p)
2036 p = strv_env_clean_log(p, pglob.gl_pathv[n]);
8c7be95e 2037
2bef10ab
PL		 2038 if (r == NULL)
2039 r = p;
2040 else {
2041 char **m;
8c7be95e 2042
2bef10ab
PL		 2043 m = strv_env_merge(2, r, p);
2044 strv_free(r);
2045 strv_free(p);
c84a9488 2046 if (!m)
2bef10ab 2047 return -ENOMEM;
2bef10ab
PL		 2048
2049 r = m;
2050 }
8c7be95e
LP		 2051 }
2052 }
2053
2054 *l = r;
2055
2056 return 0;
2057}
2058
6ac8fdc9 2059static bool tty_may_match_dev_console(const char *tty) {
e1d75803
RC		 2060 _cleanup_free_ char *active = NULL;
2061 char *console;
6ac8fdc9
MS		 2062
2063 if (startswith(tty, "/dev/"))
2064 tty += 5;
2065
2066 /* trivial identity? */
2067 if (streq(tty, "console"))
2068 return true;
2069
2070 console = resolve_dev_console(&active);
2071 /* if we could not resolve, assume it may */
2072 if (!console)
2073 return true;
2074
2075 /* "tty0" means the active VC, so it may be the same sometimes */
e1d75803 2076 return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
6ac8fdc9
MS		 2077}
2078
2079bool exec_context_may_touch_console(ExecContext *ec) {
2080 return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
2081 is_terminal_input(ec->std_input) ||
2082 is_terminal_output(ec->std_output) ||
2083 is_terminal_output(ec->std_error)) &&
2084 tty_may_match_dev_console(tty_path(ec));
2085}
2086
15ae422b
LP		 2087static void strv_fprintf(FILE *f, char **l) {
2088 char **g;
2089
2090 assert(f);
2091
2092 STRV_FOREACH(g, l)
2093 fprintf(f, " %s", *g);
2094}
2095
5cb5a6ff 2096void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
507f22bd 2097 char **e;
94f04347 2098 unsigned i;
9eba9da4 2099
5cb5a6ff
LP		 2100 assert(c);
2101 assert(f);
2102
4ad49000 2103 prefix = strempty(prefix);
5cb5a6ff
LP		 2104
2105 fprintf(f,
94f04347
LP		 2106 "%sUMask: %04o\n"
2107 "%sWorkingDirectory: %s\n"
451a074f 2108 "%sRootDirectory: %s\n"
15ae422b 2109 "%sNonBlocking: %s\n"
64747e2d 2110 "%sPrivateTmp: %s\n"
4819ff03 2111 "%sPrivateNetwork: %s\n"
7f112f50 2112 "%sPrivateDevices: %s\n"
1b8689f9
LP		 2113 "%sProtectHome: %s\n"
2114 "%sProtectSystem: %s\n"
4819ff03 2115 "%sIgnoreSIGPIPE: %s\n",
5cb5a6ff 2116 prefix, c->umask,
9eba9da4 2117 prefix, c->working_directory ? c->working_directory : "/",
451a074f 2118 prefix, c->root_directory ? c->root_directory : "/",
15ae422b 2119 prefix, yes_no(c->non_blocking),
64747e2d 2120 prefix, yes_no(c->private_tmp),
4819ff03 2121 prefix, yes_no(c->private_network),
7f112f50 2122 prefix, yes_no(c->private_devices),
1b8689f9
LP		 2123 prefix, protect_home_to_string(c->protect_home),
2124 prefix, protect_system_to_string(c->protect_system),
4819ff03 2125 prefix, yes_no(c->ignore_sigpipe));
fb33a393 2126
8c7be95e
LP		 2127 STRV_FOREACH(e, c->environment)
2128 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
2129
2130 STRV_FOREACH(e, c->environment_files)
2131 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
94f04347 2132
fb33a393
LP		 2133 if (c->nice_set)
2134 fprintf(f,
2135 "%sNice: %i\n",
2136 prefix, c->nice);
2137
dd6c17b1 2138 if (c->oom_score_adjust_set)
fb33a393 2139 fprintf(f,
dd6c17b1
LP		 2140 "%sOOMScoreAdjust: %i\n",
2141 prefix, c->oom_score_adjust);
9eba9da4 2142
94f04347
LP		 2143 for (i = 0; i < RLIM_NLIMITS; i++)
2144 if (c->rlimit[i])
de0671ee
ZJS		 2145 fprintf(f, "%s%s: "RLIM_FMT"\n",
2146 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
94f04347 2147
f8b69d1d 2148 if (c->ioprio_set) {
1756a011 2149 _cleanup_free_ char *class_str = NULL;
f8b69d1d 2150
1756a011 2151 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
9eba9da4
LP		 2152 fprintf(f,
2153 "%sIOSchedulingClass: %s\n"
2154 "%sIOPriority: %i\n",
f8b69d1d 2155 prefix, strna(class_str),
9eba9da4 2156 prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
f8b69d1d 2157 }
94f04347 2158
f8b69d1d 2159 if (c->cpu_sched_set) {
1756a011 2160 _cleanup_free_ char *policy_str = NULL;
f8b69d1d 2161
1756a011 2162 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
94f04347
LP		 2163 fprintf(f,
2164 "%sCPUSchedulingPolicy: %s\n"
38b48754
LP		 2165 "%sCPUSchedulingPriority: %i\n"
2166 "%sCPUSchedulingResetOnFork: %s\n",
f8b69d1d 2167 prefix, strna(policy_str),
38b48754
LP		 2168 prefix, c->cpu_sched_priority,
2169 prefix, yes_no(c->cpu_sched_reset_on_fork));
b929bf04 2170 }
94f04347 2171
82c121a4 2172 if (c->cpuset) {
94f04347 2173 fprintf(f, "%sCPUAffinity:", prefix);
82c121a4
LP		 2174 for (i = 0; i < c->cpuset_ncpus; i++)
2175 if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
43a99a7a 2176 fprintf(f, " %u", i);
94f04347
LP		 2177 fputs("\n", f);
2178 }
2179
d88a251b 2180 if (c->timer_slack_nsec != (nsec_t) -1)
ccd06097 2181 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
94f04347
LP		 2182
2183 fprintf(f,
80876c20
LP		 2184 "%sStandardInput: %s\n"
2185 "%sStandardOutput: %s\n"
2186 "%sStandardError: %s\n",
2187 prefix, exec_input_to_string(c->std_input),
2188 prefix, exec_output_to_string(c->std_output),
2189 prefix, exec_output_to_string(c->std_error));
2190
2191 if (c->tty_path)
2192 fprintf(f,
6ea832a2
LP		 2193 "%sTTYPath: %s\n"
2194 "%sTTYReset: %s\n"
2195 "%sTTYVHangup: %s\n"
2196 "%sTTYVTDisallocate: %s\n",
2197 prefix, c->tty_path,
2198 prefix, yes_no(c->tty_reset),
2199 prefix, yes_no(c->tty_vhangup),
2200 prefix, yes_no(c->tty_vt_disallocate));
94f04347 2201
5ce70e5b
ZJS		 2202 if (c->std_output == EXEC_OUTPUT_SYSLOG ||
2203 c->std_output == EXEC_OUTPUT_KMSG ||
2204 c->std_output == EXEC_OUTPUT_JOURNAL ||
2205 c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2206 c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2207 c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
2208 c->std_error == EXEC_OUTPUT_SYSLOG ||
2209 c->std_error == EXEC_OUTPUT_KMSG ||
2210 c->std_error == EXEC_OUTPUT_JOURNAL ||
2211 c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2212 c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2213 c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
f8b69d1d 2214
5ce70e5b 2215 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
f8b69d1d 2216
5ce70e5b
ZJS		 2217 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
2218 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
f8b69d1d 2219
94f04347
LP		 2220 fprintf(f,
2221 "%sSyslogFacility: %s\n"
2222 "%sSyslogLevel: %s\n",
f8b69d1d
MS		 2223 prefix, strna(fac_str),
2224 prefix, strna(lvl_str));
f8b69d1d 2225 }
94f04347
LP		 2226
2227 if (c->capabilities) {
5ce70e5b
ZJS		 2228 _cleanup_cap_free_charp_ char *t;
2229
2230 t = cap_to_text(c->capabilities, NULL);
2231 if (t)
2232 fprintf(f, "%sCapabilities: %s\n", prefix, t);
94f04347
LP		 2233 }
2234
2235 if (c->secure_bits)
2236 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
2237 prefix,
cbb21cca
ZJS		 2238 (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
2239 (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
2240 (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
2241 (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
2242 (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
2243 (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
94f04347
LP		 2244
2245 if (c->capability_bounding_set_drop) {
ae556c21 2246 unsigned long l;
260abb78 2247 fprintf(f, "%sCapabilityBoundingSet:", prefix);
94f04347 2248
64685e0c 2249 for (l = 0; l <= cap_last_cap(); l++)
ae556c21 2250 if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
5ce70e5b 2251 _cleanup_cap_free_charp_ char *t;
94f04347 2252
5ce70e5b
ZJS		 2253 t = cap_to_name(l);
2254 if (t)
94f04347 2255 fprintf(f, " %s", t);
94f04347
LP		 2256 }
2257
2258 fputs("\n", f);
2259 }
2260
2261 if (c->user)
f2d3769a 2262 fprintf(f, "%sUser: %s\n", prefix, c->user);
94f04347 2263 if (c->group)
f2d3769a 2264 fprintf(f, "%sGroup: %s\n", prefix, c->group);
94f04347 2265
15ae422b 2266 if (strv_length(c->supplementary_groups) > 0) {
94f04347 2267 fprintf(f, "%sSupplementaryGroups:", prefix);
15ae422b
LP		 2268 strv_fprintf(f, c->supplementary_groups);
2269 fputs("\n", f);
2270 }
94f04347 2271
5b6319dc 2272 if (c->pam_name)
f2d3769a 2273 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
5b6319dc 2274
15ae422b
LP		 2275 if (strv_length(c->read_write_dirs) > 0) {
2276 fprintf(f, "%sReadWriteDirs:", prefix);
2277 strv_fprintf(f, c->read_write_dirs);
2278 fputs("\n", f);
2279 }
2280
2281 if (strv_length(c->read_only_dirs) > 0) {
2282 fprintf(f, "%sReadOnlyDirs:", prefix);
2283 strv_fprintf(f, c->read_only_dirs);
2284 fputs("\n", f);
2285 }
94f04347 2286
15ae422b
LP		 2287 if (strv_length(c->inaccessible_dirs) > 0) {
2288 fprintf(f, "%sInaccessibleDirs:", prefix);
2289 strv_fprintf(f, c->inaccessible_dirs);
94f04347
LP		 2290 fputs("\n", f);
2291 }
2e22afe9 2292
169c1bda
LP		 2293 if (c->utmp_id)
2294 fprintf(f,
2295 "%sUtmpIdentifier: %s\n",
2296 prefix, c->utmp_id);
7b52a628
MS		 2297
2298 if (c->selinux_context)
2299 fprintf(f,
5f8640fb
LP		 2300 "%sSELinuxContext: %s%s\n",
2301 prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
17df7223 2302
ac45f971
LP		 2303 if (c->personality != 0xffffffffUL)
2304 fprintf(f,
2305 "%sPersonality: %s\n",
2306 prefix, strna(personality_to_string(c->personality)));
2307
17df7223 2308 if (c->syscall_filter) {
351a19b1 2309#ifdef HAVE_SECCOMP
17df7223
LP		 2310 Iterator j;
2311 void *id;
2312 bool first = true;
351a19b1 2313#endif
17df7223
LP		 2314
2315 fprintf(f,
57183d11 2316 "%sSystemCallFilter: ",
17df7223
LP		 2317 prefix);
2318
2319 if (!c->syscall_whitelist)
2320 fputc('~', f);
2321
351a19b1 2322#ifdef HAVE_SECCOMP
17df7223
LP		 2323 SET_FOREACH(id, c->syscall_filter, j) {
2324 _cleanup_free_ char *name = NULL;
2325
2326 if (first)
2327 first = false;
2328 else
2329 fputc(' ', f);
2330
57183d11 2331 name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
17df7223
LP		 2332 fputs(strna(name), f);
2333 }
351a19b1 2334#endif
17df7223
LP		 2335
2336 fputc('\n', f);
2337 }
2338
57183d11
LP		 2339 if (c->syscall_archs) {
2340#ifdef HAVE_SECCOMP
2341 Iterator j;
2342 void *id;
2343#endif
2344
2345 fprintf(f,
2346 "%sSystemCallArchitectures:",
2347 prefix);
2348
2349#ifdef HAVE_SECCOMP
2350 SET_FOREACH(id, c->syscall_archs, j)
2351 fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
2352#endif
2353 fputc('\n', f);
2354 }
2355
17df7223
LP		 2356 if (c->syscall_errno != 0)
2357 fprintf(f,
2358 "%sSystemCallErrorNumber: %s\n",
2359 prefix, strna(errno_to_name(c->syscall_errno)));
eef65bf3
MS		 2360
2361 if (c->apparmor_profile)
2362 fprintf(f,
2363 "%sAppArmorProfile: %s%s\n",
2364 prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
5cb5a6ff
LP		 2365}
2366
b58b4116 2367void exec_status_start(ExecStatus *s, pid_t pid) {
034c6ed7 2368 assert(s);
5cb5a6ff 2369
b58b4116
LP		 2370 zero(*s);
2371 s->pid = pid;
2372 dual_timestamp_get(&s->start_timestamp);
2373}
2374
6ea832a2 2375void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
b58b4116
LP		 2376 assert(s);
2377
0b1f4ae6 2378 if (s->pid && s->pid != pid)
b58b4116
LP		 2379 zero(*s);
2380
034c6ed7 2381 s->pid = pid;
63983207 2382 dual_timestamp_get(&s->exit_timestamp);
9fb86720 2383
034c6ed7
LP		 2384 s->code = code;
2385 s->status = status;
169c1bda 2386
6ea832a2
LP		 2387 if (context) {
2388 if (context->utmp_id)
2389 utmp_put_dead_process(context->utmp_id, pid, code, status);
2390
2391 exec_context_tty_reset(context);
2392 }
9fb86720
LP		 2393}
2394
2395void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2396 char buf[FORMAT_TIMESTAMP_MAX];
2397
2398 assert(s);
2399 assert(f);
2400
2401 if (!prefix)
2402 prefix = "";
2403
2404 if (s->pid <= 0)
2405 return;
2406
2407 fprintf(f,
ccd06097
ZJS		 2408 "%sPID: "PID_FMT"\n",
2409 prefix, s->pid);
9fb86720 2410
63983207 2411 if (s->start_timestamp.realtime > 0)
9fb86720
LP		 2412 fprintf(f,
2413 "%sStart Timestamp: %s\n",
63983207 2414 prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
9fb86720 2415
63983207 2416 if (s->exit_timestamp.realtime > 0)
9fb86720
LP		 2417 fprintf(f,
2418 "%sExit Timestamp: %s\n"
2419 "%sExit Code: %s\n"
2420 "%sExit Status: %i\n",
63983207 2421 prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
9fb86720
LP		 2422 prefix, sigchld_code_to_string(s->code),
2423 prefix, s->status);
5cb5a6ff 2424}
44d8db9e 2425
9e2f7c11 2426char *exec_command_line(char **argv) {
44d8db9e
LP		 2427 size_t k;
2428 char *n, *p, **a;
2429 bool first = true;
2430
9e2f7c11 2431 assert(argv);
44d8db9e 2432
9164977d 2433 k = 1;
9e2f7c11 2434 STRV_FOREACH(a, argv)
44d8db9e
LP		 2435 k += strlen(*a)+3;
2436
2437 if (!(n = new(char, k)))
2438 return NULL;
2439
2440 p = n;
9e2f7c11 2441 STRV_FOREACH(a, argv) {
44d8db9e
LP		 2442
2443 if (!first)
2444 *(p++) = ' ';
2445 else
2446 first = false;
2447
2448 if (strpbrk(*a, WHITESPACE)) {
2449 *(p++) = '\'';
2450 p = stpcpy(p, *a);
2451 *(p++) = '\'';
2452 } else
2453 p = stpcpy(p, *a);
2454
2455 }
2456
9164977d
LP		 2457 *p = 0;
2458
44d8db9e
LP		 2459 /* FIXME: this doesn't really handle arguments that have
2460 * spaces and ticks in them */
2461
2462 return n;
2463}
2464
2465void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
e1d75803 2466 _cleanup_free_ char *p2 = NULL;
9fb86720
LP		 2467 const char *prefix2;
2468
e1d75803 2469 _cleanup_free_ char *cmd = NULL;
44d8db9e
LP		 2470
2471 assert(c);
2472 assert(f);
2473
2474 if (!prefix)
2475 prefix = "";
9fb86720
LP		 2476 p2 = strappend(prefix, "\t");
2477 prefix2 = p2 ? p2 : prefix;
44d8db9e 2478
9e2f7c11 2479 cmd = exec_command_line(c->argv);
44d8db9e
LP		 2480
2481 fprintf(f,
2482 "%sCommand Line: %s\n",
2483 prefix, cmd ? cmd : strerror(ENOMEM));
2484
9fb86720 2485 exec_status_dump(&c->exec_status, f, prefix2);
44d8db9e
LP		 2486}
2487
2488void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2489 assert(f);
2490
2491 if (!prefix)
2492 prefix = "";
2493
2494 LIST_FOREACH(command, c, c)
2495 exec_command_dump(c, f, prefix);
2496}
94f04347 2497
a6a80b4f
LP		 2498void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2499 ExecCommand *end;
2500
2501 assert(l);
2502 assert(e);
2503
2504 if (*l) {
35b8ca3a 2505 /* It's kind of important, that we keep the order here */
71fda00f
LP		 2506 LIST_FIND_TAIL(command, *l, end);
2507 LIST_INSERT_AFTER(command, *l, end, e);
a6a80b4f
LP		 2508 } else
2509 *l = e;
2510}
2511
26fd040d
LP		 2512int exec_command_set(ExecCommand *c, const char *path, ...) {
2513 va_list ap;
2514 char **l, *p;
2515
2516 assert(c);
2517 assert(path);
2518
2519 va_start(ap, path);
2520 l = strv_new_ap(path, ap);
2521 va_end(ap);
2522
2523 if (!l)
2524 return -ENOMEM;
2525
250a918d
LP		 2526 p = strdup(path);
2527 if (!p) {
26fd040d
LP		 2528 strv_free(l);
2529 return -ENOMEM;
2530 }
2531
2532 free(c->path);
2533 c->path = p;
2534
2535 strv_free(c->argv);
2536 c->argv = l;
2537
2538 return 0;
2539}
2540
613b411c
LP		 2541static int exec_runtime_allocate(ExecRuntime **rt) {
2542
2543 if (*rt)
2544 return 0;
2545
2546 *rt = new0(ExecRuntime, 1);
f146f5e1 2547 if (!*rt)
613b411c
LP		 2548 return -ENOMEM;
2549
2550 (*rt)->n_ref = 1;
2551 (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
2552
2553 return 0;
2554}
2555
2556int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
2557 int r;
2558
2559 assert(rt);
2560 assert(c);
2561 assert(id);
2562
2563 if (*rt)
2564 return 1;
2565
2566 if (!c->private_network && !c->private_tmp)
2567 return 0;
2568
2569 r = exec_runtime_allocate(rt);
2570 if (r < 0)
2571 return r;
2572
2573 if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
2574 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
2575 return -errno;
2576 }
2577
2578 if (c->private_tmp && !(*rt)->tmp_dir) {
2579 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
2580 if (r < 0)
2581 return r;
2582 }
2583
2584 return 1;
2585}
2586
2587ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
2588 assert(r);
2589 assert(r->n_ref > 0);
2590
2591 r->n_ref++;
2592 return r;
2593}
2594
2595ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
2596
2597 if (!r)
2598 return NULL;
2599
2600 assert(r->n_ref > 0);
2601
2602 r->n_ref--;
2603 if (r->n_ref <= 0) {
2604 free(r->tmp_dir);
2605 free(r->var_tmp_dir);
3d94f76c 2606 safe_close_pair(r->netns_storage_socket);
613b411c
LP		 2607 free(r);
2608 }
2609
2610 return NULL;
2611}
2612
2613int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds) {
2614 assert(u);
2615 assert(f);
2616 assert(fds);
2617
2618 if (!rt)
2619 return 0;
2620
2621 if (rt->tmp_dir)
2622 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
2623
2624 if (rt->var_tmp_dir)
2625 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
2626
2627 if (rt->netns_storage_socket[0] >= 0) {
2628 int copy;
2629
2630 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
2631 if (copy < 0)
2632 return copy;
2633
2634 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
2635 }
2636
2637 if (rt->netns_storage_socket[1] >= 0) {
2638 int copy;
2639
2640 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
2641 if (copy < 0)
2642 return copy;
2643
2644 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
2645 }
2646
2647 return 0;
2648}
2649
2650int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds) {
2651 int r;
2652
2653 assert(rt);
2654 assert(key);
2655 assert(value);
2656
2657 if (streq(key, "tmp-dir")) {
2658 char *copy;
2659
2660 r = exec_runtime_allocate(rt);
2661 if (r < 0)
2662 return r;
2663
2664 copy = strdup(value);
2665 if (!copy)
2666 return log_oom();
2667
2668 free((*rt)->tmp_dir);
2669 (*rt)->tmp_dir = copy;
2670
2671 } else if (streq(key, "var-tmp-dir")) {
2672 char *copy;
2673
2674 r = exec_runtime_allocate(rt);
2675 if (r < 0)
2676 return r;
2677
2678 copy = strdup(value);
2679 if (!copy)
2680 return log_oom();
2681
2682 free((*rt)->var_tmp_dir);
2683 (*rt)->var_tmp_dir = copy;
2684
2685 } else if (streq(key, "netns-socket-0")) {
2686 int fd;
2687
2688 r = exec_runtime_allocate(rt);
2689 if (r < 0)
2690 return r;
2691
2692 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2693 log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2694 else {
03e334a1 2695 safe_close((*rt)->netns_storage_socket[0]);
613b411c
LP		 2696 (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
2697 }
2698 } else if (streq(key, "netns-socket-1")) {
2699 int fd;
2700
2701 r = exec_runtime_allocate(rt);
2702 if (r < 0)
2703 return r;
2704
2705 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2706 log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2707 else {
03e334a1 2708 safe_close((*rt)->netns_storage_socket[1]);
613b411c
LP		 2709 (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
2710 }
2711 } else
2712 return 0;
2713
2714 return 1;
2715}
2716
2717static void *remove_tmpdir_thread(void *p) {
2718 _cleanup_free_ char *path = p;
2719
2720 rm_rf_dangerous(path, false, true, false);
2721 return NULL;
2722}
2723
2724void exec_runtime_destroy(ExecRuntime *rt) {
98b47d54
LP		 2725 int r;
2726
613b411c
LP		 2727 if (!rt)
2728 return;
2729
2730 /* If there are multiple users of this, let's leave the stuff around */
2731 if (rt->n_ref > 1)
2732 return;
2733
2734 if (rt->tmp_dir) {
2735 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
98b47d54
LP		 2736
2737 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
2738 if (r < 0) {
2739 log_warning("Failed to nuke %s: %s", rt->tmp_dir, strerror(-r));
2740 free(rt->tmp_dir);
2741 }
2742
613b411c
LP		 2743 rt->tmp_dir = NULL;
2744 }
2745
2746 if (rt->var_tmp_dir) {
2747 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
98b47d54
LP		 2748
2749 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
2750 if (r < 0) {
2751 log_warning("Failed to nuke %s: %s", rt->var_tmp_dir, strerror(-r));
2752 free(rt->var_tmp_dir);
2753 }
2754
613b411c
LP		 2755 rt->var_tmp_dir = NULL;
2756 }
2757
3d94f76c 2758 safe_close_pair(rt->netns_storage_socket);
613b411c
LP		 2759}
2760
80876c20
LP		 2761static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2762 [EXEC_INPUT_NULL] = "null",
2763 [EXEC_INPUT_TTY] = "tty",
2764 [EXEC_INPUT_TTY_FORCE] = "tty-force",
4f2d528d
LP		 2765 [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2766 [EXEC_INPUT_SOCKET] = "socket"
80876c20
LP		 2767};
2768
8a0867d6
LP		 2769DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2770
94f04347 2771static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
80876c20 2772 [EXEC_OUTPUT_INHERIT] = "inherit",
94f04347 2773 [EXEC_OUTPUT_NULL] = "null",
80876c20 2774 [EXEC_OUTPUT_TTY] = "tty",
94f04347 2775 [EXEC_OUTPUT_SYSLOG] = "syslog",
28dbc1e8 2776 [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
9a6bca7a 2777 [EXEC_OUTPUT_KMSG] = "kmsg",
28dbc1e8 2778 [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
706343f4
LP		 2779 [EXEC_OUTPUT_JOURNAL] = "journal",
2780 [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
4f2d528d 2781 [EXEC_OUTPUT_SOCKET] = "socket"
94f04347
LP		 2782};
2783
2784DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
Unnamed repository; edit this file 'description' to name the repository.