1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
3 Copyright © 2013 Simon Peeters
14 #include "alloc-util.h"
16 #include "analyze-blame.h"
17 #include "analyze-calendar.h"
18 #include "analyze-capability.h"
19 #include "analyze-cat-config.h"
20 #include "analyze-condition.h"
21 #include "analyze-critical-chain.h"
22 #include "analyze-dot.h"
23 #include "analyze-dump.h"
24 #include "analyze-exit-status.h"
25 #include "analyze-filesystems.h"
26 #include "analyze-inspect-elf.h"
27 #include "analyze-log-control.h"
28 #include "analyze-plot.h"
29 #include "analyze-security.h"
30 #include "analyze-service-watchdogs.h"
31 #include "analyze-syscall-filter.h"
32 #include "analyze-time.h"
33 #include "analyze-time-data.h"
34 #include "analyze-timespan.h"
35 #include "analyze-timestamp.h"
36 #include "analyze-unit-files.h"
37 #include "analyze-unit-paths.h"
38 #include "analyze-compare-versions.h"
39 #include "analyze-verify.h"
41 #include "bus-error.h"
42 #include "bus-locator.h"
43 #include "bus-map-properties.h"
44 #include "bus-unit-util.h"
45 #include "calendarspec.h"
47 #include "capability-util.h"
48 #include "conf-files.h"
50 #include "constants.h"
51 #include "exit-status.h"
52 #include "extract-word.h"
55 #include "filesystems.h"
56 #include "format-table.h"
57 #include "glob-util.h"
59 #include "locale-util.h"
61 #include "main-func.h"
62 #include "mount-util.h"
63 #include "nulstr-util.h"
65 #include "parse-argument.h"
66 #include "parse-util.h"
67 #include "path-util.h"
68 #include "pretty-print.h"
71 # include "seccomp-util.h"
73 #include "sort-util.h"
75 #include "stat-util.h"
76 #include "string-table.h"
79 #include "terminal-util.h"
80 #include "time-util.h"
81 #include "tmpfile-util.h"
82 #include "unit-name.h"
83 #include "verb-log-control.h"
87 DotMode arg_dot
= DEP_ALL
;
88 char **arg_dot_from_patterns
= NULL
, **arg_dot_to_patterns
= NULL
;
90 PagerFlags arg_pager_flags
= 0;
91 BusTransport arg_transport
= BUS_TRANSPORT_LOCAL
;
92 const char *arg_host
= NULL
;
93 LookupScope arg_scope
= LOOKUP_SCOPE_SYSTEM
;
94 RecursiveErrors arg_recursive_errors
= _RECURSIVE_ERRORS_INVALID
;
96 bool arg_generators
= false;
97 char *arg_root
= NULL
;
98 static char *arg_image
= NULL
;
99 char *arg_security_policy
= NULL
;
100 bool arg_offline
= false;
101 unsigned arg_threshold
= 100;
102 unsigned arg_iterations
= 1;
103 usec_t arg_base_time
= USEC_INFINITY
;
104 char *arg_unit
= NULL
;
105 JsonFormatFlags arg_json_format_flags
= JSON_FORMAT_OFF
;
106 bool arg_quiet
= false;
107 char *arg_profile
= NULL
;
108 bool arg_legend
= true;
109 bool arg_table
= false;
111 STATIC_DESTRUCTOR_REGISTER(arg_dot_from_patterns
, strv_freep
);
112 STATIC_DESTRUCTOR_REGISTER(arg_dot_to_patterns
, strv_freep
);
113 STATIC_DESTRUCTOR_REGISTER(arg_root
, freep
);
114 STATIC_DESTRUCTOR_REGISTER(arg_image
, freep
);
115 STATIC_DESTRUCTOR_REGISTER(arg_security_policy
, freep
);
116 STATIC_DESTRUCTOR_REGISTER(arg_unit
, freep
);
117 STATIC_DESTRUCTOR_REGISTER(arg_profile
, freep
);
119 int acquire_bus(sd_bus
**bus
, bool *use_full_bus
) {
120 bool user
= arg_scope
!= LOOKUP_SCOPE_SYSTEM
;
123 if (use_full_bus
&& *use_full_bus
) {
124 r
= bus_connect_transport(arg_transport
, arg_host
, user
, bus
);
125 if (IN_SET(r
, 0, -EHOSTDOWN
))
128 *use_full_bus
= false;
131 return bus_connect_transport_systemd(arg_transport
, arg_host
, user
, bus
);
134 int bus_get_unit_property_strv(sd_bus
*bus
, const char *path
, const char *property
, char ***strv
) {
135 _cleanup_(sd_bus_error_free
) sd_bus_error error
= SD_BUS_ERROR_NULL
;
143 r
= sd_bus_get_property_strv(
145 "org.freedesktop.systemd1",
147 "org.freedesktop.systemd1.Unit",
152 return log_error_errno(r
, "Failed to get unit property %s: %s", property
, bus_error_message(&error
, r
));
157 void time_parsing_hint(const char *p
, bool calendar
, bool timestamp
, bool timespan
) {
158 if (calendar
&& calendar_spec_from_string(p
, NULL
) >= 0)
159 log_notice("Hint: this expression is a valid calendar specification. "
160 "Use 'systemd-analyze calendar \"%s\"' instead?", p
);
161 if (timestamp
&& parse_timestamp(p
, NULL
) >= 0)
162 log_notice("Hint: this expression is a valid timestamp. "
163 "Use 'systemd-analyze timestamp \"%s\"' instead?", p
);
164 if (timespan
&& parse_time(p
, NULL
, USEC_PER_SEC
) >= 0)
165 log_notice("Hint: this expression is a valid timespan. "
166 "Use 'systemd-analyze timespan \"%s\"' instead?", p
);
169 static int help(int argc
, char *argv
[], void *userdata
) {
170 _cleanup_free_
char *link
= NULL
, *dot_link
= NULL
;
173 pager_open(arg_pager_flags
);
175 r
= terminal_urlify_man("systemd-analyze", "1", &link
);
179 /* Not using terminal_urlify_man() for this, since we don't want the "man page" text suffix in this case. */
180 r
= terminal_urlify("man:dot(1)", "dot(1)", &dot_link
);
184 printf("%s [OPTIONS...] COMMAND ...\n\n"
185 "%sProfile systemd, show unit dependencies, check unit files.%s\n"
187 " [time] Print time required to boot the machine\n"
188 " blame Print list of running units ordered by\n"
190 " critical-chain [UNIT...] Print a tree of the time critical chain\n"
192 " plot Output SVG graphic showing service\n"
194 " dot [UNIT...] Output dependency graph in %s format\n"
195 " dump [PATTERN...] Output state serialization of service\n"
197 " cat-config Show configuration file and drop-ins\n"
198 " unit-files List files and symlinks for units\n"
199 " unit-paths List load directories for units\n"
200 " exit-status [STATUS...] List exit status definitions\n"
201 " capability [CAP...] List capability definitions\n"
202 " syscall-filter [NAME...] List syscalls in seccomp filters\n"
203 " filesystems [NAME...] List known filesystems\n"
204 " condition CONDITION... Evaluate conditions and asserts\n"
205 " compare-versions VERSION1 [OP] VERSION2\n"
206 " Compare two version strings\n"
207 " verify FILE... Check unit files for correctness\n"
208 " calendar SPEC... Validate repetitive calendar time\n"
210 " timestamp TIMESTAMP... Validate a timestamp\n"
211 " timespan SPAN... Validate a time span\n"
212 " security [UNIT...] Analyze security of unit\n"
213 " inspect-elf FILE... Parse and print ELF package metadata\n"
215 " --recursive-errors=MODE Control which units are verified\n"
216 " --offline=BOOL Perform a security review on unit file(s)\n"
217 " --threshold=N Exit with a non-zero status when overall\n"
218 " exposure level is over threshold value\n"
219 " --security-policy=PATH Use custom JSON security policy instead\n"
221 " --json=pretty|short|off Generate JSON output of the security\n"
222 " analysis table, or plot's raw time data\n"
223 " --no-pager Do not pipe output into a pager\n"
224 " --no-legend Disable column headers and hints in plot\n"
225 " with either --table or --json=\n"
226 " --system Operate on system systemd instance\n"
227 " --user Operate on user systemd instance\n"
228 " --global Operate on global user configuration\n"
229 " -H --host=[USER@]HOST Operate on remote host\n"
230 " -M --machine=CONTAINER Operate on local container\n"
231 " --order Show only order in the graph\n"
232 " --require Show only requirement in the graph\n"
233 " --from-pattern=GLOB Show only origins in the graph\n"
234 " --to-pattern=GLOB Show only destinations in the graph\n"
235 " --fuzz=SECONDS Also print services which finished SECONDS\n"
236 " earlier than the latest in the branch\n"
237 " --man[=BOOL] Do [not] check for existence of man pages\n"
238 " --generators[=BOOL] Do [not] run unit generators\n"
239 " (requires privileges)\n"
240 " --iterations=N Show the specified number of iterations\n"
241 " --base-time=TIMESTAMP Calculate calendar times relative to\n"
243 " --profile=name|PATH Include the specified profile in the\n"
244 " security review of the unit(s)\n"
245 " --table Output plot's raw time data as a table\n"
246 " -h --help Show this help\n"
247 " --version Show package version\n"
248 " -q --quiet Do not emit hints\n"
249 " --root=PATH Operate on an alternate filesystem root\n"
250 " --image=PATH Operate on disk image as filesystem root\n"
251 "\nSee the %s for details.\n",
252 program_invocation_short_name
,
258 /* When updating this list, including descriptions, apply changes to
259 * shell-completion/bash/systemd-analyze and shell-completion/zsh/_systemd-analyze too. */
264 static int parse_argv(int argc
, char *argv
[]) {
274 ARG_DOT_FROM_PATTERN
,
282 ARG_RECURSIVE_ERRORS
,
292 static const struct option options
[] = {
293 { "help", no_argument
, NULL
, 'h' },
294 { "version", no_argument
, NULL
, ARG_VERSION
},
295 { "quiet", no_argument
, NULL
, 'q' },
296 { "order", no_argument
, NULL
, ARG_ORDER
},
297 { "require", no_argument
, NULL
, ARG_REQUIRE
},
298 { "root", required_argument
, NULL
, ARG_ROOT
},
299 { "image", required_argument
, NULL
, ARG_IMAGE
},
300 { "recursive-errors", required_argument
, NULL
, ARG_RECURSIVE_ERRORS
},
301 { "offline", required_argument
, NULL
, ARG_OFFLINE
},
302 { "threshold", required_argument
, NULL
, ARG_THRESHOLD
},
303 { "security-policy", required_argument
, NULL
, ARG_SECURITY_POLICY
},
304 { "system", no_argument
, NULL
, ARG_SYSTEM
},
305 { "user", no_argument
, NULL
, ARG_USER
},
306 { "global", no_argument
, NULL
, ARG_GLOBAL
},
307 { "from-pattern", required_argument
, NULL
, ARG_DOT_FROM_PATTERN
},
308 { "to-pattern", required_argument
, NULL
, ARG_DOT_TO_PATTERN
},
309 { "fuzz", required_argument
, NULL
, ARG_FUZZ
},
310 { "no-pager", no_argument
, NULL
, ARG_NO_PAGER
},
311 { "man", optional_argument
, NULL
, ARG_MAN
},
312 { "generators", optional_argument
, NULL
, ARG_GENERATORS
},
313 { "host", required_argument
, NULL
, 'H' },
314 { "machine", required_argument
, NULL
, 'M' },
315 { "iterations", required_argument
, NULL
, ARG_ITERATIONS
},
316 { "base-time", required_argument
, NULL
, ARG_BASE_TIME
},
317 { "unit", required_argument
, NULL
, 'U' },
318 { "json", required_argument
, NULL
, ARG_JSON
},
319 { "profile", required_argument
, NULL
, ARG_PROFILE
},
320 { "table", optional_argument
, NULL
, ARG_TABLE
},
321 { "no-legend", optional_argument
, NULL
, ARG_NO_LEGEND
},
330 while ((c
= getopt_long(argc
, argv
, "hH:M:U:", options
, NULL
)) >= 0)
334 return help(0, NULL
, NULL
);
343 case ARG_RECURSIVE_ERRORS
:
344 if (streq(optarg
, "help")) {
345 DUMP_STRING_TABLE(recursive_errors
, RecursiveErrors
, _RECURSIVE_ERRORS_MAX
);
348 r
= recursive_errors_from_string(optarg
);
350 return log_error_errno(r
, "Unknown mode passed to --recursive-errors='%s'.", optarg
);
352 arg_recursive_errors
= r
;
356 r
= parse_path_argument(optarg
, /* suppress_root= */ true, &arg_root
);
362 r
= parse_path_argument(optarg
, /* suppress_root= */ false, &arg_image
);
368 arg_scope
= LOOKUP_SCOPE_SYSTEM
;
372 arg_scope
= LOOKUP_SCOPE_USER
;
376 arg_scope
= LOOKUP_SCOPE_GLOBAL
;
384 arg_dot
= DEP_REQUIRE
;
387 case ARG_DOT_FROM_PATTERN
:
388 if (strv_extend(&arg_dot_from_patterns
, optarg
) < 0)
393 case ARG_DOT_TO_PATTERN
:
394 if (strv_extend(&arg_dot_to_patterns
, optarg
) < 0)
400 r
= parse_sec(optarg
, &arg_fuzz
);
406 arg_pager_flags
|= PAGER_DISABLE
;
410 arg_transport
= BUS_TRANSPORT_REMOTE
;
415 arg_transport
= BUS_TRANSPORT_MACHINE
;
420 r
= parse_boolean_argument("--man", optarg
, &arg_man
);
426 r
= parse_boolean_argument("--generators", optarg
, &arg_generators
);
432 r
= parse_boolean_argument("--offline", optarg
, &arg_offline
);
438 r
= safe_atou(optarg
, &arg_threshold
);
439 if (r
< 0 || arg_threshold
> 100)
440 return log_error_errno(r
< 0 ? r
: SYNTHETIC_ERRNO(EINVAL
), "Failed to parse threshold: %s", optarg
);
444 case ARG_SECURITY_POLICY
:
445 r
= parse_path_argument(optarg
, /* suppress_root= */ false, &arg_security_policy
);
451 r
= parse_json_argument(optarg
, &arg_json_format_flags
);
457 r
= safe_atou(optarg
, &arg_iterations
);
459 return log_error_errno(r
, "Failed to parse iterations: %s", optarg
);
463 r
= parse_timestamp(optarg
, &arg_base_time
);
465 return log_error_errno(r
, "Failed to parse --base-time= parameter: %s", optarg
);
470 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Profile file name is empty");
472 if (is_path(optarg
)) {
473 r
= parse_path_argument(optarg
, /* suppress_root= */ false, &arg_profile
);
476 if (!endswith(arg_profile
, ".conf"))
477 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Profile file name must end with .conf: %s", arg_profile
);
479 r
= free_and_strdup(&arg_profile
, optarg
);
487 _cleanup_free_
char *mangled
= NULL
;
489 r
= unit_name_mangle(optarg
, UNIT_NAME_MANGLE_WARN
, &mangled
);
491 return log_error_errno(r
, "Failed to mangle unit name %s: %m", optarg
);
493 free_and_replace(arg_unit
, mangled
);
509 assert_not_reached();
512 if (arg_offline
&& !streq_ptr(argv
[optind
], "security"))
513 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
514 "Option --offline= is only supported for security right now.");
516 if (arg_json_format_flags
!= JSON_FORMAT_OFF
&& !STRPTR_IN_SET(argv
[optind
], "security", "inspect-elf", "plot"))
517 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
518 "Option --json= is only supported for security, inspect-elf, and plot right now.");
520 if (arg_threshold
!= 100 && !streq_ptr(argv
[optind
], "security"))
521 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
522 "Option --threshold= is only supported for security right now.");
524 if (arg_scope
== LOOKUP_SCOPE_GLOBAL
&&
525 !STR_IN_SET(argv
[optind
] ?: "time", "dot", "unit-paths", "verify"))
526 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
527 "Option --global only makes sense with verbs dot, unit-paths, verify.");
529 if (streq_ptr(argv
[optind
], "cat-config") && arg_scope
== LOOKUP_SCOPE_USER
)
530 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
531 "Option --user is not supported for cat-config right now.");
533 if (arg_security_policy
&& !streq_ptr(argv
[optind
], "security"))
534 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
535 "Option --security-policy= is only supported for security.");
537 if ((arg_root
|| arg_image
) && (!STRPTR_IN_SET(argv
[optind
], "cat-config", "verify", "condition")) &&
538 (!(streq_ptr(argv
[optind
], "security") && arg_offline
)))
539 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
540 "Options --root= and --image= are only supported for cat-config, verify, condition and security when used with --offline= right now.");
542 /* Having both an image and a root is not supported by the code */
543 if (arg_root
&& arg_image
)
544 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Please specify either --root= or --image=, the combination of both is not supported.");
546 if (arg_unit
&& !streq_ptr(argv
[optind
], "condition"))
547 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Option --unit= is only supported for condition");
549 if (streq_ptr(argv
[optind
], "condition") && !arg_unit
&& optind
>= argc
- 1)
550 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Too few arguments for condition");
552 if (streq_ptr(argv
[optind
], "condition") && arg_unit
&& optind
< argc
- 1)
553 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "No conditions can be passed if --unit= is used.");
555 if ((!arg_legend
&& !streq_ptr(argv
[optind
], "plot")) ||
556 (streq_ptr(argv
[optind
], "plot") && !arg_legend
&& !arg_table
&& FLAGS_SET(arg_json_format_flags
, JSON_FORMAT_OFF
)))
557 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Option --no-legend is only supported for plot with either --table or --json=.");
559 if (arg_table
&& !streq_ptr(argv
[optind
], "plot"))
560 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Option --table is only supported for plot right now.");
562 if (arg_table
&& !FLAGS_SET(arg_json_format_flags
, JSON_FORMAT_OFF
))
563 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "--table and --json= are mutually exclusive.");
565 return 1; /* work to do */
568 static int run(int argc
, char *argv
[]) {
569 _cleanup_(loop_device_unrefp
) LoopDevice
*loop_device
= NULL
;
570 _cleanup_(umount_and_rmdir_and_freep
) char *unlink_dir
= NULL
;
572 static const Verb verbs
[] = {
573 { "help", VERB_ANY
, VERB_ANY
, 0, help
},
574 { "time", VERB_ANY
, 1, VERB_DEFAULT
, verb_time
},
575 { "blame", VERB_ANY
, 1, 0, verb_blame
},
576 { "critical-chain", VERB_ANY
, VERB_ANY
, 0, verb_critical_chain
},
577 { "plot", VERB_ANY
, 1, 0, verb_plot
},
578 { "dot", VERB_ANY
, VERB_ANY
, 0, verb_dot
},
579 /* ↓ The following seven verbs are deprecated, from here … ↓ */
580 { "log-level", VERB_ANY
, 2, 0, verb_log_control
},
581 { "log-target", VERB_ANY
, 2, 0, verb_log_control
},
582 { "set-log-level", 2, 2, 0, verb_log_control
},
583 { "get-log-level", VERB_ANY
, 1, 0, verb_log_control
},
584 { "set-log-target", 2, 2, 0, verb_log_control
},
585 { "get-log-target", VERB_ANY
, 1, 0, verb_log_control
},
586 { "service-watchdogs", VERB_ANY
, 2, 0, verb_service_watchdogs
},
587 /* ↑ … until here ↑ */
588 { "dump", VERB_ANY
, VERB_ANY
, 0, verb_dump
},
589 { "cat-config", 2, VERB_ANY
, 0, verb_cat_config
},
590 { "unit-files", VERB_ANY
, VERB_ANY
, 0, verb_unit_files
},
591 { "unit-paths", 1, 1, 0, verb_unit_paths
},
592 { "exit-status", VERB_ANY
, VERB_ANY
, 0, verb_exit_status
},
593 { "syscall-filter", VERB_ANY
, VERB_ANY
, 0, verb_syscall_filters
},
594 { "capability", VERB_ANY
, VERB_ANY
, 0, verb_capabilities
},
595 { "filesystems", VERB_ANY
, VERB_ANY
, 0, verb_filesystems
},
596 { "condition", VERB_ANY
, VERB_ANY
, 0, verb_condition
},
597 { "compare-versions", 3, 4, 0, verb_compare_versions
},
598 { "verify", 2, VERB_ANY
, 0, verb_verify
},
599 { "calendar", 2, VERB_ANY
, 0, verb_calendar
},
600 { "timestamp", 2, VERB_ANY
, 0, verb_timestamp
},
601 { "timespan", 2, VERB_ANY
, 0, verb_timespan
},
602 { "security", VERB_ANY
, VERB_ANY
, 0, verb_security
},
603 { "inspect-elf", 2, VERB_ANY
, 0, verb_elf_inspection
},
609 setlocale(LC_ALL
, "");
610 setlocale(LC_NUMERIC
, "C"); /* we want to format/parse floats in C style */
614 r
= parse_argv(argc
, argv
);
618 /* Open up and mount the image */
622 r
= mount_image_privately_interactively(
624 DISSECT_IMAGE_GENERIC_ROOT
|
625 DISSECT_IMAGE_RELAX_VAR_CHECK
|
626 DISSECT_IMAGE_READ_ONLY
,
632 arg_root
= strdup(unlink_dir
);
637 return dispatch_verb(argc
, argv
, verbs
, NULL
);
640 DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run
);