]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/core/execute.c
projects / thirdparty / systemd.git / blob
? search:


184c72dbe7ec98541440d69c23893f1a2530ec43
[thirdparty/systemd.git] / src / core / execute.c
1 /***
2 This file is part of systemd.
3
4 Copyright 2010 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18 ***/
19
20 #include <errno.h>
21 #include <fcntl.h>
22 #include <glob.h>
23 #include <grp.h>
24 #include <poll.h>
25 #include <signal.h>
26 #include <string.h>
27 #include <sys/personality.h>
28 #include <sys/prctl.h>
29 #include <sys/socket.h>
30 #include <sys/stat.h>
31 #include <sys/un.h>
32 #include <unistd.h>
33 #include <utmpx.h>
34
35 #ifdef HAVE_PAM
36 #include <security/pam_appl.h>
37 #endif
38
39 #ifdef HAVE_SELINUX
40 #include <selinux/selinux.h>
41 #endif
42
43 #ifdef HAVE_SECCOMP
44 #include <seccomp.h>
45 #endif
46
47 #ifdef HAVE_APPARMOR
48 #include <sys/apparmor.h>
49 #endif
50
51 #include "sd-messages.h"
52
53 #include "af-list.h"
54 #include "alloc-util.h"
55 #ifdef HAVE_APPARMOR
56 #include "apparmor-util.h"
57 #endif
58 #include "async.h"
59 #include "barrier.h"
60 #include "cap-list.h"
61 #include "capability-util.h"
62 #include "def.h"
63 #include "env-util.h"
64 #include "errno-list.h"
65 #include "execute.h"
66 #include "exit-status.h"
67 #include "fd-util.h"
68 #include "fileio.h"
69 #include "formats-util.h"
70 #include "fs-util.h"
71 #include "glob-util.h"
72 #include "io-util.h"
73 #include "ioprio.h"
74 #include "log.h"
75 #include "macro.h"
76 #include "missing.h"
77 #include "mkdir.h"
78 #include "namespace.h"
79 #include "parse-util.h"
80 #include "path-util.h"
81 #include "process-util.h"
82 #include "rlimit-util.h"
83 #include "rm-rf.h"
84 #ifdef HAVE_SECCOMP
85 #include "seccomp-util.h"
86 #endif
87 #include "securebits.h"
88 #include "selinux-util.h"
89 #include "signal-util.h"
90 #include "smack-util.h"
91 #include "string-table.h"
92 #include "string-util.h"
93 #include "strv.h"
94 #include "syslog-util.h"
95 #include "terminal-util.h"
96 #include "unit.h"
97 #include "user-util.h"
98 #include "util.h"
99 #include "utmp-wtmp.h"
100
101 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
102 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
103
104 /* This assumes there is a 'tty' group */
105 #define TTY_MODE 0620
106
107 #define SNDBUF_SIZE (8*1024*1024)
108
109 static int shift_fds(int fds[], unsigned n_fds) {
110 int start, restart_from;
111
112 if (n_fds <= 0)
113 return 0;
114
115 /* Modifies the fds array! (sorts it) */
116
117 assert(fds);
118
119 start = 0;
120 for (;;) {
121 int i;
122
123 restart_from = -1;
124
125 for (i = start; i < (int) n_fds; i++) {
126 int nfd;
127
128 /* Already at right index? */
129 if (fds[i] == i+3)
130 continue;
131
132 nfd = fcntl(fds[i], F_DUPFD, i + 3);
133 if (nfd < 0)
134 return -errno;
135
136 safe_close(fds[i]);
137 fds[i] = nfd;
138
139 /* Hmm, the fd we wanted isn't free? Then
140 * let's remember that and try again from here */
141 if (nfd != i+3 && restart_from < 0)
142 restart_from = i;
143 }
144
145 if (restart_from < 0)
146 break;
147
148 start = restart_from;
149 }
150
151 return 0;
152 }
153
154 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
155 unsigned i;
156 int r;
157
158 if (n_fds <= 0)
159 return 0;
160
161 assert(fds);
162
163 /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
164
165 for (i = 0; i < n_fds; i++) {
166
167 r = fd_nonblock(fds[i], nonblock);
168 if (r < 0)
169 return r;
170
171 /* We unconditionally drop FD_CLOEXEC from the fds,
172 * since after all we want to pass these fds to our
173 * children */
174
175 r = fd_cloexec(fds[i], false);
176 if (r < 0)
177 return r;
178 }
179
180 return 0;
181 }
182
183 static const char *exec_context_tty_path(const ExecContext *context) {
184 assert(context);
185
186 if (context->stdio_as_fds)
187 return NULL;
188
189 if (context->tty_path)
190 return context->tty_path;
191
192 return "/dev/console";
193 }
194
195 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
196 const char *path;
197
198 assert(context);
199
200 path = exec_context_tty_path(context);
201
202 if (context->tty_vhangup) {
203 if (p && p->stdin_fd >= 0)
204 (void) terminal_vhangup_fd(p->stdin_fd);
205 else if (path)
206 (void) terminal_vhangup(path);
207 }
208
209 if (context->tty_reset) {
210 if (p && p->stdin_fd >= 0)
211 (void) reset_terminal_fd(p->stdin_fd, true);
212 else if (path)
213 (void) reset_terminal(path);
214 }
215
216 if (context->tty_vt_disallocate && path)
217 (void) vt_disallocate(path);
218 }
219
220 static bool is_terminal_output(ExecOutput o) {
221 return
222 o == EXEC_OUTPUT_TTY ||
223 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
224 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
225 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
226 }
227
228 static int open_null_as(int flags, int nfd) {
229 int fd, r;
230
231 assert(nfd >= 0);
232
233 fd = open("/dev/null", flags|O_NOCTTY);
234 if (fd < 0)
235 return -errno;
236
237 if (fd != nfd) {
238 r = dup2(fd, nfd) < 0 ? -errno : nfd;
239 safe_close(fd);
240 } else
241 r = nfd;
242
243 return r;
244 }
245
246 static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
247 union sockaddr_union sa = {
248 .un.sun_family = AF_UNIX,
249 .un.sun_path = "/run/systemd/journal/stdout",
250 };
251 uid_t olduid = UID_INVALID;
252 gid_t oldgid = GID_INVALID;
253 int r;
254
255 if (gid != GID_INVALID) {
256 oldgid = getgid();
257
258 r = setegid(gid);
259 if (r < 0)
260 return -errno;
261 }
262
263 if (uid != UID_INVALID) {
264 olduid = getuid();
265
266 r = seteuid(uid);
267 if (r < 0) {
268 r = -errno;
269 goto restore_gid;
270 }
271 }
272
273 r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
274 if (r < 0)
275 r = -errno;
276
277 /* If we fail to restore the uid or gid, things will likely
278 fail later on. This should only happen if an LSM interferes. */
279
280 if (uid != UID_INVALID)
281 (void) seteuid(olduid);
282
283 restore_gid:
284 if (gid != GID_INVALID)
285 (void) setegid(oldgid);
286
287 return r;
288 }
289
290 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd, uid_t uid, gid_t gid) {
291 int fd, r;
292
293 assert(context);
294 assert(output < _EXEC_OUTPUT_MAX);
295 assert(ident);
296 assert(nfd >= 0);
297
298 fd = socket(AF_UNIX, SOCK_STREAM, 0);
299 if (fd < 0)
300 return -errno;
301
302 r = connect_journal_socket(fd, uid, gid);
303 if (r < 0)
304 return r;
305
306 if (shutdown(fd, SHUT_RD) < 0) {
307 safe_close(fd);
308 return -errno;
309 }
310
311 fd_inc_sndbuf(fd, SNDBUF_SIZE);
312
313 dprintf(fd,
314 "%s\n"
315 "%s\n"
316 "%i\n"
317 "%i\n"
318 "%i\n"
319 "%i\n"
320 "%i\n",
321 context->syslog_identifier ? context->syslog_identifier : ident,
322 unit_id,
323 context->syslog_priority,
324 !!context->syslog_level_prefix,
325 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
326 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
327 is_terminal_output(output));
328
329 if (fd != nfd) {
330 r = dup2(fd, nfd) < 0 ? -errno : nfd;
331 safe_close(fd);
332 } else
333 r = nfd;
334
335 return r;
336 }
337 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
338 int fd, r;
339
340 assert(path);
341 assert(nfd >= 0);
342
343 fd = open_terminal(path, mode | O_NOCTTY);
344 if (fd < 0)
345 return fd;
346
347 if (fd != nfd) {
348 r = dup2(fd, nfd) < 0 ? -errno : nfd;
349 safe_close(fd);
350 } else
351 r = nfd;
352
353 return r;
354 }
355
356 static bool is_terminal_input(ExecInput i) {
357 return
358 i == EXEC_INPUT_TTY ||
359 i == EXEC_INPUT_TTY_FORCE ||
360 i == EXEC_INPUT_TTY_FAIL;
361 }
362
363 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
364
365 if (is_terminal_input(std_input) && !apply_tty_stdin)
366 return EXEC_INPUT_NULL;
367
368 if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
369 return EXEC_INPUT_NULL;
370
371 return std_input;
372 }
373
374 static int fixup_output(ExecOutput std_output, int socket_fd) {
375
376 if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
377 return EXEC_OUTPUT_INHERIT;
378
379 return std_output;
380 }
381
382 static int setup_input(
383 const ExecContext *context,
384 const ExecParameters *params,
385 int socket_fd) {
386
387 ExecInput i;
388
389 assert(context);
390 assert(params);
391
392 if (params->stdin_fd >= 0) {
393 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
394 return -errno;
395
396 /* Try to make this the controlling tty, if it is a tty, and reset it */
397 (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
398 (void) reset_terminal_fd(STDIN_FILENO, true);
399
400 return STDIN_FILENO;
401 }
402
403 i = fixup_input(context->std_input, socket_fd, params->apply_tty_stdin);
404
405 switch (i) {
406
407 case EXEC_INPUT_NULL:
408 return open_null_as(O_RDONLY, STDIN_FILENO);
409
410 case EXEC_INPUT_TTY:
411 case EXEC_INPUT_TTY_FORCE:
412 case EXEC_INPUT_TTY_FAIL: {
413 int fd, r;
414
415 fd = acquire_terminal(exec_context_tty_path(context),
416 i == EXEC_INPUT_TTY_FAIL,
417 i == EXEC_INPUT_TTY_FORCE,
418 false,
419 USEC_INFINITY);
420 if (fd < 0)
421 return fd;
422
423 if (fd != STDIN_FILENO) {
424 r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
425 safe_close(fd);
426 } else
427 r = STDIN_FILENO;
428
429 return r;
430 }
431
432 case EXEC_INPUT_SOCKET:
433 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
434
435 default:
436 assert_not_reached("Unknown input type");
437 }
438 }
439
440 static int setup_output(
441 Unit *unit,
442 const ExecContext *context,
443 const ExecParameters *params,
444 int fileno,
445 int socket_fd,
446 const char *ident,
447 uid_t uid, gid_t gid) {
448
449 ExecOutput o;
450 ExecInput i;
451 int r;
452
453 assert(unit);
454 assert(context);
455 assert(params);
456 assert(ident);
457
458 if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
459
460 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
461 return -errno;
462
463 return STDOUT_FILENO;
464 }
465
466 if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
467 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
468 return -errno;
469
470 return STDERR_FILENO;
471 }
472
473 i = fixup_input(context->std_input, socket_fd, params->apply_tty_stdin);
474 o = fixup_output(context->std_output, socket_fd);
475
476 if (fileno == STDERR_FILENO) {
477 ExecOutput e;
478 e = fixup_output(context->std_error, socket_fd);
479
480 /* This expects the input and output are already set up */
481
482 /* Don't change the stderr file descriptor if we inherit all
483 * the way and are not on a tty */
484 if (e == EXEC_OUTPUT_INHERIT &&
485 o == EXEC_OUTPUT_INHERIT &&
486 i == EXEC_INPUT_NULL &&
487 !is_terminal_input(context->std_input) &&
488 getppid () != 1)
489 return fileno;
490
491 /* Duplicate from stdout if possible */
492 if (e == o || e == EXEC_OUTPUT_INHERIT)
493 return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
494
495 o = e;
496
497 } else if (o == EXEC_OUTPUT_INHERIT) {
498 /* If input got downgraded, inherit the original value */
499 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
500 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
501
502 /* If the input is connected to anything that's not a /dev/null, inherit that... */
503 if (i != EXEC_INPUT_NULL)
504 return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
505
506 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
507 if (getppid() != 1)
508 return fileno;
509
510 /* We need to open /dev/null here anew, to get the right access mode. */
511 return open_null_as(O_WRONLY, fileno);
512 }
513
514 switch (o) {
515
516 case EXEC_OUTPUT_NULL:
517 return open_null_as(O_WRONLY, fileno);
518
519 case EXEC_OUTPUT_TTY:
520 if (is_terminal_input(i))
521 return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
522
523 /* We don't reset the terminal if this is just about output */
524 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
525
526 case EXEC_OUTPUT_SYSLOG:
527 case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
528 case EXEC_OUTPUT_KMSG:
529 case EXEC_OUTPUT_KMSG_AND_CONSOLE:
530 case EXEC_OUTPUT_JOURNAL:
531 case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
532 r = connect_logger_as(context, o, ident, unit->id, fileno, uid, gid);
533 if (r < 0) {
534 log_unit_error_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
535 r = open_null_as(O_WRONLY, fileno);
536 }
537 return r;
538
539 case EXEC_OUTPUT_SOCKET:
540 assert(socket_fd >= 0);
541 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
542
543 default:
544 assert_not_reached("Unknown error type");
545 }
546 }
547
548 static int chown_terminal(int fd, uid_t uid) {
549 struct stat st;
550
551 assert(fd >= 0);
552
553 /* This might fail. What matters are the results. */
554 (void) fchown(fd, uid, -1);
555 (void) fchmod(fd, TTY_MODE);
556
557 if (fstat(fd, &st) < 0)
558 return -errno;
559
560 if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
561 return -EPERM;
562
563 return 0;
564 }
565
566 static int setup_confirm_stdio(int *_saved_stdin, int *_saved_stdout) {
567 _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
568 int r;
569
570 assert(_saved_stdin);
571 assert(_saved_stdout);
572
573 saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
574 if (saved_stdin < 0)
575 return -errno;
576
577 saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
578 if (saved_stdout < 0)
579 return -errno;
580
581 fd = acquire_terminal(
582 "/dev/console",
583 false,
584 false,
585 false,
586 DEFAULT_CONFIRM_USEC);
587 if (fd < 0)
588 return fd;
589
590 r = chown_terminal(fd, getuid());
591 if (r < 0)
592 return r;
593
594 r = reset_terminal_fd(fd, true);
595 if (r < 0)
596 return r;
597
598 if (dup2(fd, STDIN_FILENO) < 0)
599 return -errno;
600
601 if (dup2(fd, STDOUT_FILENO) < 0)
602 return -errno;
603
604 if (fd >= 2)
605 safe_close(fd);
606 fd = -1;
607
608 *_saved_stdin = saved_stdin;
609 *_saved_stdout = saved_stdout;
610
611 saved_stdin = saved_stdout = -1;
612
613 return 0;
614 }
615
616 _printf_(1, 2) static int write_confirm_message(const char *format, ...) {
617 _cleanup_close_ int fd = -1;
618 va_list ap;
619
620 assert(format);
621
622 fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
623 if (fd < 0)
624 return fd;
625
626 va_start(ap, format);
627 vdprintf(fd, format, ap);
628 va_end(ap);
629
630 return 0;
631 }
632
633 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
634 int r = 0;
635
636 assert(saved_stdin);
637 assert(saved_stdout);
638
639 release_terminal();
640
641 if (*saved_stdin >= 0)
642 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
643 r = -errno;
644
645 if (*saved_stdout >= 0)
646 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
647 r = -errno;
648
649 *saved_stdin = safe_close(*saved_stdin);
650 *saved_stdout = safe_close(*saved_stdout);
651
652 return r;
653 }
654
655 static int ask_for_confirmation(char *response, char **argv) {
656 int saved_stdout = -1, saved_stdin = -1, r;
657 _cleanup_free_ char *line = NULL;
658
659 r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
660 if (r < 0)
661 return r;
662
663 line = exec_command_line(argv);
664 if (!line)
665 return -ENOMEM;
666
667 r = ask_char(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
668
669 restore_confirm_stdio(&saved_stdin, &saved_stdout);
670
671 return r;
672 }
673
674 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
675 bool keep_groups = false;
676 int r;
677
678 assert(context);
679
680 /* Lookup and set GID and supplementary group list. Here too
681 * we avoid NSS lookups for gid=0. */
682
683 if (context->group || username) {
684 /* First step, initialize groups from /etc/groups */
685 if (username && gid != 0) {
686 if (initgroups(username, gid) < 0)
687 return -errno;
688
689 keep_groups = true;
690 }
691
692 /* Second step, set our gids */
693 if (setresgid(gid, gid, gid) < 0)
694 return -errno;
695 }
696
697 if (context->supplementary_groups) {
698 int ngroups_max, k;
699 gid_t *gids;
700 char **i;
701
702 /* Final step, initialize any manually set supplementary groups */
703 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
704
705 if (!(gids = new(gid_t, ngroups_max)))
706 return -ENOMEM;
707
708 if (keep_groups) {
709 k = getgroups(ngroups_max, gids);
710 if (k < 0) {
711 free(gids);
712 return -errno;
713 }
714 } else
715 k = 0;
716
717 STRV_FOREACH(i, context->supplementary_groups) {
718 const char *g;
719
720 if (k >= ngroups_max) {
721 free(gids);
722 return -E2BIG;
723 }
724
725 g = *i;
726 r = get_group_creds(&g, gids+k);
727 if (r < 0) {
728 free(gids);
729 return r;
730 }
731
732 k++;
733 }
734
735 if (setgroups(k, gids) < 0) {
736 free(gids);
737 return -errno;
738 }
739
740 free(gids);
741 }
742
743 return 0;
744 }
745
746 static int enforce_user(const ExecContext *context, uid_t uid) {
747 assert(context);
748
749 /* Sets (but doesn't look up) the uid and make sure we keep the
750 * capabilities while doing so. */
751
752 if (context->capability_ambient_set != 0) {
753
754 /* First step: If we need to keep capabilities but
755 * drop privileges we need to make sure we keep our
756 * caps, while we drop privileges. */
757 if (uid != 0) {
758 int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
759
760 if (prctl(PR_GET_SECUREBITS) != sb)
761 if (prctl(PR_SET_SECUREBITS, sb) < 0)
762 return -errno;
763 }
764 }
765
766 /* Second step: actually set the uids */
767 if (setresuid(uid, uid, uid) < 0)
768 return -errno;
769
770 /* At this point we should have all necessary capabilities but
771 are otherwise a normal user. However, the caps might got
772 corrupted due to the setresuid() so we need clean them up
773 later. This is done outside of this call. */
774
775 return 0;
776 }
777
778 #ifdef HAVE_PAM
779
780 static int null_conv(
781 int num_msg,
782 const struct pam_message **msg,
783 struct pam_response **resp,
784 void *appdata_ptr) {
785
786 /* We don't support conversations */
787
788 return PAM_CONV_ERR;
789 }
790
791 static int setup_pam(
792 const char *name,
793 const char *user,
794 uid_t uid,
795 const char *tty,
796 char ***pam_env,
797 int fds[], unsigned n_fds) {
798
799 static const struct pam_conv conv = {
800 .conv = null_conv,
801 .appdata_ptr = NULL
802 };
803
804 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
805 pam_handle_t *handle = NULL;
806 sigset_t old_ss;
807 int pam_code = PAM_SUCCESS, r;
808 char **e = NULL;
809 bool close_session = false;
810 pid_t pam_pid = 0, parent_pid;
811 int flags = 0;
812
813 assert(name);
814 assert(user);
815 assert(pam_env);
816
817 /* We set up PAM in the parent process, then fork. The child
818 * will then stay around until killed via PR_GET_PDEATHSIG or
819 * systemd via the cgroup logic. It will then remove the PAM
820 * session again. The parent process will exec() the actual
821 * daemon. We do things this way to ensure that the main PID
822 * of the daemon is the one we initially fork()ed. */
823
824 r = barrier_create(&barrier);
825 if (r < 0)
826 goto fail;
827
828 if (log_get_max_level() < LOG_DEBUG)
829 flags |= PAM_SILENT;
830
831 pam_code = pam_start(name, user, &conv, &handle);
832 if (pam_code != PAM_SUCCESS) {
833 handle = NULL;
834 goto fail;
835 }
836
837 if (tty) {
838 pam_code = pam_set_item(handle, PAM_TTY, tty);
839 if (pam_code != PAM_SUCCESS)
840 goto fail;
841 }
842
843 pam_code = pam_acct_mgmt(handle, flags);
844 if (pam_code != PAM_SUCCESS)
845 goto fail;
846
847 pam_code = pam_open_session(handle, flags);
848 if (pam_code != PAM_SUCCESS)
849 goto fail;
850
851 close_session = true;
852
853 e = pam_getenvlist(handle);
854 if (!e) {
855 pam_code = PAM_BUF_ERR;
856 goto fail;
857 }
858
859 /* Block SIGTERM, so that we know that it won't get lost in
860 * the child */
861
862 assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
863
864 parent_pid = getpid();
865
866 pam_pid = fork();
867 if (pam_pid < 0) {
868 r = -errno;
869 goto fail;
870 }
871
872 if (pam_pid == 0) {
873 int sig, ret = EXIT_PAM;
874
875 /* The child's job is to reset the PAM session on
876 * termination */
877 barrier_set_role(&barrier, BARRIER_CHILD);
878
879 /* This string must fit in 10 chars (i.e. the length
880 * of "/sbin/init"), to look pretty in /bin/ps */
881 rename_process("(sd-pam)");
882
883 /* Make sure we don't keep open the passed fds in this
884 child. We assume that otherwise only those fds are
885 open here that have been opened by PAM. */
886 close_many(fds, n_fds);
887
888 /* Drop privileges - we don't need any to pam_close_session
889 * and this will make PR_SET_PDEATHSIG work in most cases.
890 * If this fails, ignore the error - but expect sd-pam threads
891 * to fail to exit normally */
892 if (setresuid(uid, uid, uid) < 0)
893 log_error_errno(r, "Error: Failed to setresuid() in sd-pam: %m");
894
895 (void) ignore_signals(SIGPIPE, -1);
896
897 /* Wait until our parent died. This will only work if
898 * the above setresuid() succeeds, otherwise the kernel
899 * will not allow unprivileged parents kill their privileged
900 * children this way. We rely on the control groups kill logic
901 * to do the rest for us. */
902 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
903 goto child_finish;
904
905 /* Tell the parent that our setup is done. This is especially
906 * important regarding dropping privileges. Otherwise, unit
907 * setup might race against our setresuid(2) call. */
908 barrier_place(&barrier);
909
910 /* Check if our parent process might already have
911 * died? */
912 if (getppid() == parent_pid) {
913 sigset_t ss;
914
915 assert_se(sigemptyset(&ss) >= 0);
916 assert_se(sigaddset(&ss, SIGTERM) >= 0);
917
918 for (;;) {
919 if (sigwait(&ss, &sig) < 0) {
920 if (errno == EINTR)
921 continue;
922
923 goto child_finish;
924 }
925
926 assert(sig == SIGTERM);
927 break;
928 }
929 }
930
931 /* If our parent died we'll end the session */
932 if (getppid() != parent_pid) {
933 pam_code = pam_close_session(handle, flags);
934 if (pam_code != PAM_SUCCESS)
935 goto child_finish;
936 }
937
938 ret = 0;
939
940 child_finish:
941 pam_end(handle, pam_code | flags);
942 _exit(ret);
943 }
944
945 barrier_set_role(&barrier, BARRIER_PARENT);
946
947 /* If the child was forked off successfully it will do all the
948 * cleanups, so forget about the handle here. */
949 handle = NULL;
950
951 /* Unblock SIGTERM again in the parent */
952 assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
953
954 /* We close the log explicitly here, since the PAM modules
955 * might have opened it, but we don't want this fd around. */
956 closelog();
957
958 /* Synchronously wait for the child to initialize. We don't care for
959 * errors as we cannot recover. However, warn loudly if it happens. */
960 if (!barrier_place_and_sync(&barrier))
961 log_error("PAM initialization failed");
962
963 *pam_env = e;
964 e = NULL;
965
966 return 0;
967
968 fail:
969 if (pam_code != PAM_SUCCESS) {
970 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
971 r = -EPERM; /* PAM errors do not map to errno */
972 } else
973 log_error_errno(r, "PAM failed: %m");
974
975 if (handle) {
976 if (close_session)
977 pam_code = pam_close_session(handle, flags);
978
979 pam_end(handle, pam_code | flags);
980 }
981
982 strv_free(e);
983 closelog();
984
985 return r;
986 }
987 #endif
988
989 static void rename_process_from_path(const char *path) {
990 char process_name[11];
991 const char *p;
992 size_t l;
993
994 /* This resulting string must fit in 10 chars (i.e. the length
995 * of "/sbin/init") to look pretty in /bin/ps */
996
997 p = basename(path);
998 if (isempty(p)) {
999 rename_process("(...)");
1000 return;
1001 }
1002
1003 l = strlen(p);
1004 if (l > 8) {
1005 /* The end of the process name is usually more
1006 * interesting, since the first bit might just be
1007 * "systemd-" */
1008 p = p + l - 8;
1009 l = 8;
1010 }
1011
1012 process_name[0] = '(';
1013 memcpy(process_name+1, p, l);
1014 process_name[1+l] = ')';
1015 process_name[1+l+1] = 0;
1016
1017 rename_process(process_name);
1018 }
1019
1020 #ifdef HAVE_SECCOMP
1021
1022 static int apply_seccomp(const ExecContext *c) {
1023 uint32_t negative_action, action;
1024 scmp_filter_ctx *seccomp;
1025 Iterator i;
1026 void *id;
1027 int r;
1028
1029 assert(c);
1030
1031 negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
1032
1033 seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
1034 if (!seccomp)
1035 return -ENOMEM;
1036
1037 if (c->syscall_archs) {
1038
1039 SET_FOREACH(id, c->syscall_archs, i) {
1040 r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
1041 if (r == -EEXIST)
1042 continue;
1043 if (r < 0)
1044 goto finish;
1045 }
1046
1047 } else {
1048 r = seccomp_add_secondary_archs(seccomp);
1049 if (r < 0)
1050 goto finish;
1051 }
1052
1053 action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
1054 SET_FOREACH(id, c->syscall_filter, i) {
1055 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
1056 if (r < 0)
1057 goto finish;
1058 }
1059
1060 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1061 if (r < 0)
1062 goto finish;
1063
1064 r = seccomp_load(seccomp);
1065
1066 finish:
1067 seccomp_release(seccomp);
1068 return r;
1069 }
1070
1071 static int apply_address_families(const ExecContext *c) {
1072 scmp_filter_ctx *seccomp;
1073 Iterator i;
1074 int r;
1075
1076 assert(c);
1077
1078 seccomp = seccomp_init(SCMP_ACT_ALLOW);
1079 if (!seccomp)
1080 return -ENOMEM;
1081
1082 r = seccomp_add_secondary_archs(seccomp);
1083 if (r < 0)
1084 goto finish;
1085
1086 if (c->address_families_whitelist) {
1087 int af, first = 0, last = 0;
1088 void *afp;
1089
1090 /* If this is a whitelist, we first block the address
1091 * families that are out of range and then everything
1092 * that is not in the set. First, we find the lowest
1093 * and highest address family in the set. */
1094
1095 SET_FOREACH(afp, c->address_families, i) {
1096 af = PTR_TO_INT(afp);
1097
1098 if (af <= 0 || af >= af_max())
1099 continue;
1100
1101 if (first == 0 || af < first)
1102 first = af;
1103
1104 if (last == 0 || af > last)
1105 last = af;
1106 }
1107
1108 assert((first == 0) == (last == 0));
1109
1110 if (first == 0) {
1111
1112 /* No entries in the valid range, block everything */
1113 r = seccomp_rule_add(
1114 seccomp,
1115 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1116 SCMP_SYS(socket),
1117 0);
1118 if (r < 0)
1119 goto finish;
1120
1121 } else {
1122
1123 /* Block everything below the first entry */
1124 r = seccomp_rule_add(
1125 seccomp,
1126 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1127 SCMP_SYS(socket),
1128 1,
1129 SCMP_A0(SCMP_CMP_LT, first));
1130 if (r < 0)
1131 goto finish;
1132
1133 /* Block everything above the last entry */
1134 r = seccomp_rule_add(
1135 seccomp,
1136 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1137 SCMP_SYS(socket),
1138 1,
1139 SCMP_A0(SCMP_CMP_GT, last));
1140 if (r < 0)
1141 goto finish;
1142
1143 /* Block everything between the first and last
1144 * entry */
1145 for (af = 1; af < af_max(); af++) {
1146
1147 if (set_contains(c->address_families, INT_TO_PTR(af)))
1148 continue;
1149
1150 r = seccomp_rule_add(
1151 seccomp,
1152 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1153 SCMP_SYS(socket),
1154 1,
1155 SCMP_A0(SCMP_CMP_EQ, af));
1156 if (r < 0)
1157 goto finish;
1158 }
1159 }
1160
1161 } else {
1162 void *af;
1163
1164 /* If this is a blacklist, then generate one rule for
1165 * each address family that are then combined in OR
1166 * checks. */
1167
1168 SET_FOREACH(af, c->address_families, i) {
1169
1170 r = seccomp_rule_add(
1171 seccomp,
1172 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1173 SCMP_SYS(socket),
1174 1,
1175 SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
1176 if (r < 0)
1177 goto finish;
1178 }
1179 }
1180
1181 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1182 if (r < 0)
1183 goto finish;
1184
1185 r = seccomp_load(seccomp);
1186
1187 finish:
1188 seccomp_release(seccomp);
1189 return r;
1190 }
1191
1192 #endif
1193
1194 static void do_idle_pipe_dance(int idle_pipe[4]) {
1195 assert(idle_pipe);
1196
1197
1198 idle_pipe[1] = safe_close(idle_pipe[1]);
1199 idle_pipe[2] = safe_close(idle_pipe[2]);
1200
1201 if (idle_pipe[0] >= 0) {
1202 int r;
1203
1204 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1205
1206 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1207 ssize_t n;
1208
1209 /* Signal systemd that we are bored and want to continue. */
1210 n = write(idle_pipe[3], "x", 1);
1211 if (n > 0)
1212 /* Wait for systemd to react to the signal above. */
1213 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1214 }
1215
1216 idle_pipe[0] = safe_close(idle_pipe[0]);
1217
1218 }
1219
1220 idle_pipe[3] = safe_close(idle_pipe[3]);
1221 }
1222
1223 static int build_environment(
1224 const ExecContext *c,
1225 const ExecParameters *p,
1226 unsigned n_fds,
1227 const char *home,
1228 const char *username,
1229 const char *shell,
1230 char ***ret) {
1231
1232 _cleanup_strv_free_ char **our_env = NULL;
1233 unsigned n_env = 0;
1234 char *x;
1235
1236 assert(c);
1237 assert(ret);
1238
1239 our_env = new0(char*, 11);
1240 if (!our_env)
1241 return -ENOMEM;
1242
1243 if (n_fds > 0) {
1244 _cleanup_free_ char *joined = NULL;
1245
1246 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
1247 return -ENOMEM;
1248 our_env[n_env++] = x;
1249
1250 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1251 return -ENOMEM;
1252 our_env[n_env++] = x;
1253
1254 joined = strv_join(p->fd_names, ":");
1255 if (!joined)
1256 return -ENOMEM;
1257
1258 x = strjoin("LISTEN_FDNAMES=", joined, NULL);
1259 if (!x)
1260 return -ENOMEM;
1261 our_env[n_env++] = x;
1262 }
1263
1264 if (p->watchdog_usec > 0) {
1265 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
1266 return -ENOMEM;
1267 our_env[n_env++] = x;
1268
1269 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1270 return -ENOMEM;
1271 our_env[n_env++] = x;
1272 }
1273
1274 if (home) {
1275 x = strappend("HOME=", home);
1276 if (!x)
1277 return -ENOMEM;
1278 our_env[n_env++] = x;
1279 }
1280
1281 if (username) {
1282 x = strappend("LOGNAME=", username);
1283 if (!x)
1284 return -ENOMEM;
1285 our_env[n_env++] = x;
1286
1287 x = strappend("USER=", username);
1288 if (!x)
1289 return -ENOMEM;
1290 our_env[n_env++] = x;
1291 }
1292
1293 if (shell) {
1294 x = strappend("SHELL=", shell);
1295 if (!x)
1296 return -ENOMEM;
1297 our_env[n_env++] = x;
1298 }
1299
1300 if (is_terminal_input(c->std_input) ||
1301 c->std_output == EXEC_OUTPUT_TTY ||
1302 c->std_error == EXEC_OUTPUT_TTY ||
1303 c->tty_path) {
1304
1305 x = strdup(default_term_for_tty(exec_context_tty_path(c)));
1306 if (!x)
1307 return -ENOMEM;
1308 our_env[n_env++] = x;
1309 }
1310
1311 our_env[n_env++] = NULL;
1312 assert(n_env <= 11);
1313
1314 *ret = our_env;
1315 our_env = NULL;
1316
1317 return 0;
1318 }
1319
1320 static int build_pass_environment(const ExecContext *c, char ***ret) {
1321 _cleanup_strv_free_ char **pass_env = NULL;
1322 size_t n_env = 0, n_bufsize = 0;
1323 char **i;
1324
1325 STRV_FOREACH(i, c->pass_environment) {
1326 _cleanup_free_ char *x = NULL;
1327 char *v;
1328
1329 v = getenv(*i);
1330 if (!v)
1331 continue;
1332 x = strjoin(*i, "=", v, NULL);
1333 if (!x)
1334 return -ENOMEM;
1335 if (!GREEDY_REALLOC(pass_env, n_bufsize, n_env + 2))
1336 return -ENOMEM;
1337 pass_env[n_env++] = x;
1338 pass_env[n_env] = NULL;
1339 x = NULL;
1340 }
1341
1342 *ret = pass_env;
1343 pass_env = NULL;
1344
1345 return 0;
1346 }
1347
1348 static bool exec_needs_mount_namespace(
1349 const ExecContext *context,
1350 const ExecParameters *params,
1351 ExecRuntime *runtime) {
1352
1353 assert(context);
1354 assert(params);
1355
1356 if (!strv_isempty(context->read_write_dirs) ||
1357 !strv_isempty(context->read_only_dirs) ||
1358 !strv_isempty(context->inaccessible_dirs))
1359 return true;
1360
1361 if (context->mount_flags != 0)
1362 return true;
1363
1364 if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
1365 return true;
1366
1367 if (context->private_devices ||
1368 context->protect_system != PROTECT_SYSTEM_NO ||
1369 context->protect_home != PROTECT_HOME_NO)
1370 return true;
1371
1372 return false;
1373 }
1374
1375 static int close_remaining_fds(
1376 const ExecParameters *params,
1377 ExecRuntime *runtime,
1378 int socket_fd,
1379 int *fds, unsigned n_fds) {
1380
1381 unsigned n_dont_close = 0;
1382 int dont_close[n_fds + 7];
1383
1384 assert(params);
1385
1386 if (params->stdin_fd >= 0)
1387 dont_close[n_dont_close++] = params->stdin_fd;
1388 if (params->stdout_fd >= 0)
1389 dont_close[n_dont_close++] = params->stdout_fd;
1390 if (params->stderr_fd >= 0)
1391 dont_close[n_dont_close++] = params->stderr_fd;
1392
1393 if (socket_fd >= 0)
1394 dont_close[n_dont_close++] = socket_fd;
1395 if (n_fds > 0) {
1396 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1397 n_dont_close += n_fds;
1398 }
1399
1400 if (runtime) {
1401 if (runtime->netns_storage_socket[0] >= 0)
1402 dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
1403 if (runtime->netns_storage_socket[1] >= 0)
1404 dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
1405 }
1406
1407 return close_all_fds(dont_close, n_dont_close);
1408 }
1409
1410 static int exec_child(
1411 Unit *unit,
1412 ExecCommand *command,
1413 const ExecContext *context,
1414 const ExecParameters *params,
1415 ExecRuntime *runtime,
1416 char **argv,
1417 int socket_fd,
1418 int *fds, unsigned n_fds,
1419 char **files_env,
1420 int *exit_status) {
1421
1422 _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
1423 _cleanup_free_ char *mac_selinux_context_net = NULL;
1424 const char *username = NULL, *home = NULL, *shell = NULL, *wd;
1425 uid_t uid = UID_INVALID;
1426 gid_t gid = GID_INVALID;
1427 int i, r;
1428 bool needs_mount_namespace;
1429
1430 assert(unit);
1431 assert(command);
1432 assert(context);
1433 assert(params);
1434 assert(exit_status);
1435
1436 rename_process_from_path(command->path);
1437
1438 /* We reset exactly these signals, since they are the
1439 * only ones we set to SIG_IGN in the main daemon. All
1440 * others we leave untouched because we set them to
1441 * SIG_DFL or a valid handler initially, both of which
1442 * will be demoted to SIG_DFL. */
1443 (void) default_signals(SIGNALS_CRASH_HANDLER,
1444 SIGNALS_IGNORE, -1);
1445
1446 if (context->ignore_sigpipe)
1447 (void) ignore_signals(SIGPIPE, -1);
1448
1449 r = reset_signal_mask();
1450 if (r < 0) {
1451 *exit_status = EXIT_SIGNAL_MASK;
1452 return r;
1453 }
1454
1455 if (params->idle_pipe)
1456 do_idle_pipe_dance(params->idle_pipe);
1457
1458 /* Close sockets very early to make sure we don't
1459 * block init reexecution because it cannot bind its
1460 * sockets */
1461
1462 log_forget_fds();
1463
1464 r = close_remaining_fds(params, runtime, socket_fd, fds, n_fds);
1465 if (r < 0) {
1466 *exit_status = EXIT_FDS;
1467 return r;
1468 }
1469
1470 if (!context->same_pgrp)
1471 if (setsid() < 0) {
1472 *exit_status = EXIT_SETSID;
1473 return -errno;
1474 }
1475
1476 exec_context_tty_reset(context, params);
1477
1478 if (params->confirm_spawn) {
1479 char response;
1480
1481 r = ask_for_confirmation(&response, argv);
1482 if (r == -ETIMEDOUT)
1483 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1484 else if (r < 0)
1485 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-r));
1486 else if (response == 's') {
1487 write_confirm_message("Skipping execution.\n");
1488 *exit_status = EXIT_CONFIRM;
1489 return -ECANCELED;
1490 } else if (response == 'n') {
1491 write_confirm_message("Failing execution.\n");
1492 *exit_status = 0;
1493 return 0;
1494 }
1495 }
1496
1497 if (context->user) {
1498 username = context->user;
1499 r = get_user_creds(&username, &uid, &gid, &home, &shell);
1500 if (r < 0) {
1501 *exit_status = EXIT_USER;
1502 return r;
1503 }
1504 }
1505
1506 if (context->group) {
1507 const char *g = context->group;
1508
1509 r = get_group_creds(&g, &gid);
1510 if (r < 0) {
1511 *exit_status = EXIT_GROUP;
1512 return r;
1513 }
1514 }
1515
1516
1517 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1518 * must sure to drop O_NONBLOCK */
1519 if (socket_fd >= 0)
1520 (void) fd_nonblock(socket_fd, false);
1521
1522 r = setup_input(context, params, socket_fd);
1523 if (r < 0) {
1524 *exit_status = EXIT_STDIN;
1525 return r;
1526 }
1527
1528 r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, basename(command->path), uid, gid);
1529 if (r < 0) {
1530 *exit_status = EXIT_STDOUT;
1531 return r;
1532 }
1533
1534 r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, basename(command->path), uid, gid);
1535 if (r < 0) {
1536 *exit_status = EXIT_STDERR;
1537 return r;
1538 }
1539
1540 if (params->cgroup_path) {
1541 r = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0, NULL, NULL);
1542 if (r < 0) {
1543 *exit_status = EXIT_CGROUP;
1544 return r;
1545 }
1546 }
1547
1548 if (context->oom_score_adjust_set) {
1549 char t[DECIMAL_STR_MAX(context->oom_score_adjust)];
1550
1551 /* When we can't make this change due to EPERM, then
1552 * let's silently skip over it. User namespaces
1553 * prohibit write access to this file, and we
1554 * shouldn't trip up over that. */
1555
1556 sprintf(t, "%i", context->oom_score_adjust);
1557 r = write_string_file("/proc/self/oom_score_adj", t, 0);
1558 if (r == -EPERM || r == -EACCES) {
1559 log_open();
1560 log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
1561 log_close();
1562 } else if (r < 0) {
1563 *exit_status = EXIT_OOM_ADJUST;
1564 return -errno;
1565 }
1566 }
1567
1568 if (context->nice_set)
1569 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1570 *exit_status = EXIT_NICE;
1571 return -errno;
1572 }
1573
1574 if (context->cpu_sched_set) {
1575 struct sched_param param = {
1576 .sched_priority = context->cpu_sched_priority,
1577 };
1578
1579 r = sched_setscheduler(0,
1580 context->cpu_sched_policy |
1581 (context->cpu_sched_reset_on_fork ?
1582 SCHED_RESET_ON_FORK : 0),
1583 &param);
1584 if (r < 0) {
1585 *exit_status = EXIT_SETSCHEDULER;
1586 return -errno;
1587 }
1588 }
1589
1590 if (context->cpuset)
1591 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1592 *exit_status = EXIT_CPUAFFINITY;
1593 return -errno;
1594 }
1595
1596 if (context->ioprio_set)
1597 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1598 *exit_status = EXIT_IOPRIO;
1599 return -errno;
1600 }
1601
1602 if (context->timer_slack_nsec != NSEC_INFINITY)
1603 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1604 *exit_status = EXIT_TIMERSLACK;
1605 return -errno;
1606 }
1607
1608 if (context->personality != PERSONALITY_INVALID)
1609 if (personality(context->personality) < 0) {
1610 *exit_status = EXIT_PERSONALITY;
1611 return -errno;
1612 }
1613
1614 if (context->utmp_id)
1615 utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path,
1616 context->utmp_mode == EXEC_UTMP_INIT ? INIT_PROCESS :
1617 context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
1618 USER_PROCESS,
1619 username ? "root" : context->user);
1620
1621 if (context->user && is_terminal_input(context->std_input)) {
1622 r = chown_terminal(STDIN_FILENO, uid);
1623 if (r < 0) {
1624 *exit_status = EXIT_STDIN;
1625 return r;
1626 }
1627 }
1628
1629 /* If delegation is enabled we'll pass ownership of the cgroup
1630 * (but only in systemd's own controller hierarchy!) to the
1631 * user of the new process. */
1632 if (params->cgroup_path && context->user && params->cgroup_delegate) {
1633 r = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
1634 if (r < 0) {
1635 *exit_status = EXIT_CGROUP;
1636 return r;
1637 }
1638
1639
1640 r = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
1641 if (r < 0) {
1642 *exit_status = EXIT_CGROUP;
1643 return r;
1644 }
1645 }
1646
1647 if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
1648 char **rt;
1649
1650 STRV_FOREACH(rt, context->runtime_directory) {
1651 _cleanup_free_ char *p;
1652
1653 p = strjoin(params->runtime_prefix, "/", *rt, NULL);
1654 if (!p) {
1655 *exit_status = EXIT_RUNTIME_DIRECTORY;
1656 return -ENOMEM;
1657 }
1658
1659 r = mkdir_p_label(p, context->runtime_directory_mode);
1660 if (r < 0) {
1661 *exit_status = EXIT_RUNTIME_DIRECTORY;
1662 return r;
1663 }
1664
1665 r = chmod_and_chown(p, context->runtime_directory_mode, uid, gid);
1666 if (r < 0) {
1667 *exit_status = EXIT_RUNTIME_DIRECTORY;
1668 return r;
1669 }
1670 }
1671 }
1672
1673 umask(context->umask);
1674
1675 if (params->apply_permissions) {
1676 r = enforce_groups(context, username, gid);
1677 if (r < 0) {
1678 *exit_status = EXIT_GROUP;
1679 return r;
1680 }
1681 #ifdef HAVE_SMACK
1682 if (context->smack_process_label) {
1683 r = mac_smack_apply_pid(0, context->smack_process_label);
1684 if (r < 0) {
1685 *exit_status = EXIT_SMACK_PROCESS_LABEL;
1686 return r;
1687 }
1688 }
1689 #ifdef SMACK_DEFAULT_PROCESS_LABEL
1690 else {
1691 _cleanup_free_ char *exec_label = NULL;
1692
1693 r = mac_smack_read(command->path, SMACK_ATTR_EXEC, &exec_label);
1694 if (r < 0 && r != -ENODATA && r != -EOPNOTSUPP) {
1695 *exit_status = EXIT_SMACK_PROCESS_LABEL;
1696 return r;
1697 }
1698
1699 r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
1700 if (r < 0) {
1701 *exit_status = EXIT_SMACK_PROCESS_LABEL;
1702 return r;
1703 }
1704 }
1705 #endif
1706 #endif
1707 #ifdef HAVE_PAM
1708 if (context->pam_name && username) {
1709 r = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1710 if (r < 0) {
1711 *exit_status = EXIT_PAM;
1712 return r;
1713 }
1714 }
1715 #endif
1716 }
1717
1718 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
1719 r = setup_netns(runtime->netns_storage_socket);
1720 if (r < 0) {
1721 *exit_status = EXIT_NETWORK;
1722 return r;
1723 }
1724 }
1725
1726 needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
1727
1728 if (needs_mount_namespace) {
1729 char *tmp = NULL, *var = NULL;
1730
1731 /* The runtime struct only contains the parent
1732 * of the private /tmp, which is
1733 * non-accessible to world users. Inside of it
1734 * there's a /tmp that is sticky, and that's
1735 * the one we want to use here. */
1736
1737 if (context->private_tmp && runtime) {
1738 if (runtime->tmp_dir)
1739 tmp = strjoina(runtime->tmp_dir, "/tmp");
1740 if (runtime->var_tmp_dir)
1741 var = strjoina(runtime->var_tmp_dir, "/tmp");
1742 }
1743
1744 r = setup_namespace(
1745 params->apply_chroot ? context->root_directory : NULL,
1746 context->read_write_dirs,
1747 context->read_only_dirs,
1748 context->inaccessible_dirs,
1749 tmp,
1750 var,
1751 context->private_devices,
1752 context->protect_home,
1753 context->protect_system,
1754 context->mount_flags);
1755
1756 /* If we couldn't set up the namespace this is
1757 * probably due to a missing capability. In this case,
1758 * silently proceeed. */
1759 if (r == -EPERM || r == -EACCES) {
1760 log_open();
1761 log_unit_debug_errno(unit, r, "Failed to set up namespace, assuming containerized execution, ignoring: %m");
1762 log_close();
1763 } else if (r < 0) {
1764 *exit_status = EXIT_NAMESPACE;
1765 return r;
1766 }
1767 }
1768
1769 if (context->working_directory_home)
1770 wd = home;
1771 else if (context->working_directory)
1772 wd = context->working_directory;
1773 else
1774 wd = "/";
1775
1776 if (params->apply_chroot) {
1777 if (!needs_mount_namespace && context->root_directory)
1778 if (chroot(context->root_directory) < 0) {
1779 *exit_status = EXIT_CHROOT;
1780 return -errno;
1781 }
1782
1783 if (chdir(wd) < 0 &&
1784 !context->working_directory_missing_ok) {
1785 *exit_status = EXIT_CHDIR;
1786 return -errno;
1787 }
1788 } else {
1789 const char *d;
1790
1791 d = strjoina(strempty(context->root_directory), "/", strempty(wd));
1792 if (chdir(d) < 0 &&
1793 !context->working_directory_missing_ok) {
1794 *exit_status = EXIT_CHDIR;
1795 return -errno;
1796 }
1797 }
1798
1799 #ifdef HAVE_SELINUX
1800 if (params->apply_permissions && mac_selinux_use() && params->selinux_context_net && socket_fd >= 0) {
1801 r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
1802 if (r < 0) {
1803 *exit_status = EXIT_SELINUX_CONTEXT;
1804 return r;
1805 }
1806 }
1807 #endif
1808
1809 /* We repeat the fd closing here, to make sure that
1810 * nothing is leaked from the PAM modules. Note that
1811 * we are more aggressive this time since socket_fd
1812 * and the netns fds we don't need anymore. The custom
1813 * endpoint fd was needed to upload the policy and can
1814 * now be closed as well. */
1815 r = close_all_fds(fds, n_fds);
1816 if (r >= 0)
1817 r = shift_fds(fds, n_fds);
1818 if (r >= 0)
1819 r = flags_fds(fds, n_fds, context->non_blocking);
1820 if (r < 0) {
1821 *exit_status = EXIT_FDS;
1822 return r;
1823 }
1824
1825 if (params->apply_permissions) {
1826
1827 int secure_bits = context->secure_bits;
1828
1829 for (i = 0; i < _RLIMIT_MAX; i++) {
1830 if (!context->rlimit[i])
1831 continue;
1832
1833 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1834 *exit_status = EXIT_LIMITS;
1835 return -errno;
1836 }
1837 }
1838
1839 if (!cap_test_all(context->capability_bounding_set)) {
1840 r = capability_bounding_set_drop(context->capability_bounding_set, false);
1841 if (r < 0) {
1842 *exit_status = EXIT_CAPABILITIES;
1843 return r;
1844 }
1845 }
1846
1847 /* This is done before enforce_user, but ambient set
1848 * does not survive over setresuid() if keep_caps is not set. */
1849 if (context->capability_ambient_set != 0) {
1850 r = capability_ambient_set_apply(context->capability_ambient_set, true);
1851 if (r < 0) {
1852 *exit_status = EXIT_CAPABILITIES;
1853 return r;
1854 }
1855 }
1856
1857 if (context->user) {
1858 r = enforce_user(context, uid);
1859 if (r < 0) {
1860 *exit_status = EXIT_USER;
1861 return r;
1862 }
1863 if (context->capability_ambient_set != 0) {
1864
1865 /* Fix the ambient capabilities after user change. */
1866 r = capability_ambient_set_apply(context->capability_ambient_set, false);
1867 if (r < 0) {
1868 *exit_status = EXIT_CAPABILITIES;
1869 return r;
1870 }
1871
1872 /* If we were asked to change user and ambient capabilities
1873 * were requested, we had to add keep-caps to the securebits
1874 * so that we would maintain the inherited capability set
1875 * through the setresuid(). Make sure that the bit is added
1876 * also to the context secure_bits so that we don't try to
1877 * drop the bit away next. */
1878
1879 secure_bits |= 1<<SECURE_KEEP_CAPS;
1880 }
1881 }
1882
1883 /* PR_GET_SECUREBITS is not privileged, while
1884 * PR_SET_SECUREBITS is. So to suppress
1885 * potential EPERMs we'll try not to call
1886 * PR_SET_SECUREBITS unless necessary. */
1887 if (prctl(PR_GET_SECUREBITS) != secure_bits)
1888 if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
1889 *exit_status = EXIT_SECUREBITS;
1890 return -errno;
1891 }
1892
1893 if (context->no_new_privileges)
1894 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1895 *exit_status = EXIT_NO_NEW_PRIVILEGES;
1896 return -errno;
1897 }
1898
1899 #ifdef HAVE_SECCOMP
1900 if (context->address_families_whitelist ||
1901 !set_isempty(context->address_families)) {
1902 r = apply_address_families(context);
1903 if (r < 0) {
1904 *exit_status = EXIT_ADDRESS_FAMILIES;
1905 return r;
1906 }
1907 }
1908
1909 if (context->syscall_whitelist ||
1910 !set_isempty(context->syscall_filter) ||
1911 !set_isempty(context->syscall_archs)) {
1912 r = apply_seccomp(context);
1913 if (r < 0) {
1914 *exit_status = EXIT_SECCOMP;
1915 return r;
1916 }
1917 }
1918 #endif
1919
1920 #ifdef HAVE_SELINUX
1921 if (mac_selinux_use()) {
1922 char *exec_context = mac_selinux_context_net ?: context->selinux_context;
1923
1924 if (exec_context) {
1925 r = setexeccon(exec_context);
1926 if (r < 0) {
1927 *exit_status = EXIT_SELINUX_CONTEXT;
1928 return r;
1929 }
1930 }
1931 }
1932 #endif
1933
1934 #ifdef HAVE_APPARMOR
1935 if (context->apparmor_profile && mac_apparmor_use()) {
1936 r = aa_change_onexec(context->apparmor_profile);
1937 if (r < 0 && !context->apparmor_profile_ignore) {
1938 *exit_status = EXIT_APPARMOR_PROFILE;
1939 return -errno;
1940 }
1941 }
1942 #endif
1943 }
1944
1945 r = build_environment(context, params, n_fds, home, username, shell, &our_env);
1946 if (r < 0) {
1947 *exit_status = EXIT_MEMORY;
1948 return r;
1949 }
1950
1951 r = build_pass_environment(context, &pass_env);
1952 if (r < 0) {
1953 *exit_status = EXIT_MEMORY;
1954 return r;
1955 }
1956
1957 final_env = strv_env_merge(6,
1958 params->environment,
1959 our_env,
1960 pass_env,
1961 context->environment,
1962 files_env,
1963 pam_env,
1964 NULL);
1965 if (!final_env) {
1966 *exit_status = EXIT_MEMORY;
1967 return -ENOMEM;
1968 }
1969
1970 final_argv = replace_env_argv(argv, final_env);
1971 if (!final_argv) {
1972 *exit_status = EXIT_MEMORY;
1973 return -ENOMEM;
1974 }
1975
1976 final_env = strv_env_clean(final_env);
1977
1978 if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
1979 _cleanup_free_ char *line;
1980
1981 line = exec_command_line(final_argv);
1982 if (line) {
1983 log_open();
1984 log_struct(LOG_DEBUG,
1985 LOG_UNIT_ID(unit),
1986 "EXECUTABLE=%s", command->path,
1987 LOG_UNIT_MESSAGE(unit, "Executing: %s", line),
1988 NULL);
1989 log_close();
1990 }
1991 }
1992
1993 execve(command->path, final_argv, final_env);
1994 *exit_status = EXIT_EXEC;
1995 return -errno;
1996 }
1997
1998 int exec_spawn(Unit *unit,
1999 ExecCommand *command,
2000 const ExecContext *context,
2001 const ExecParameters *params,
2002 ExecRuntime *runtime,
2003 pid_t *ret) {
2004
2005 _cleanup_strv_free_ char **files_env = NULL;
2006 int *fds = NULL; unsigned n_fds = 0;
2007 _cleanup_free_ char *line = NULL;
2008 int socket_fd, r;
2009 char **argv;
2010 pid_t pid;
2011
2012 assert(unit);
2013 assert(command);
2014 assert(context);
2015 assert(ret);
2016 assert(params);
2017 assert(params->fds || params->n_fds <= 0);
2018
2019 if (context->std_input == EXEC_INPUT_SOCKET ||
2020 context->std_output == EXEC_OUTPUT_SOCKET ||
2021 context->std_error == EXEC_OUTPUT_SOCKET) {
2022
2023 if (params->n_fds != 1) {
2024 log_unit_error(unit, "Got more than one socket.");
2025 return -EINVAL;
2026 }
2027
2028 socket_fd = params->fds[0];
2029 } else {
2030 socket_fd = -1;
2031 fds = params->fds;
2032 n_fds = params->n_fds;
2033 }
2034
2035 r = exec_context_load_environment(unit, context, &files_env);
2036 if (r < 0)
2037 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
2038
2039 argv = params->argv ?: command->argv;
2040 line = exec_command_line(argv);
2041 if (!line)
2042 return log_oom();
2043
2044 log_struct(LOG_DEBUG,
2045 LOG_UNIT_ID(unit),
2046 LOG_UNIT_MESSAGE(unit, "About to execute: %s", line),
2047 "EXECUTABLE=%s", command->path,
2048 NULL);
2049 pid = fork();
2050 if (pid < 0)
2051 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
2052
2053 if (pid == 0) {
2054 int exit_status;
2055
2056 r = exec_child(unit,
2057 command,
2058 context,
2059 params,
2060 runtime,
2061 argv,
2062 socket_fd,
2063 fds, n_fds,
2064 files_env,
2065 &exit_status);
2066 if (r < 0) {
2067 log_open();
2068 log_struct_errno(LOG_ERR, r,
2069 LOG_MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
2070 LOG_UNIT_ID(unit),
2071 LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
2072 exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
2073 command->path),
2074 "EXECUTABLE=%s", command->path,
2075 NULL);
2076 }
2077
2078 _exit(exit_status);
2079 }
2080
2081 log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
2082
2083 /* We add the new process to the cgroup both in the child (so
2084 * that we can be sure that no user code is ever executed
2085 * outside of the cgroup) and in the parent (so that we can be
2086 * sure that when we kill the cgroup the process will be
2087 * killed too). */
2088 if (params->cgroup_path)
2089 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
2090
2091 exec_status_start(&command->exec_status, pid);
2092
2093 *ret = pid;
2094 return 0;
2095 }
2096
2097 void exec_context_init(ExecContext *c) {
2098 assert(c);
2099
2100 c->umask = 0022;
2101 c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
2102 c->cpu_sched_policy = SCHED_OTHER;
2103 c->syslog_priority = LOG_DAEMON|LOG_INFO;
2104 c->syslog_level_prefix = true;
2105 c->ignore_sigpipe = true;
2106 c->timer_slack_nsec = NSEC_INFINITY;
2107 c->personality = PERSONALITY_INVALID;
2108 c->runtime_directory_mode = 0755;
2109 c->capability_bounding_set = CAP_ALL;
2110 }
2111
2112 void exec_context_done(ExecContext *c) {
2113 unsigned l;
2114
2115 assert(c);
2116
2117 c->environment = strv_free(c->environment);
2118 c->environment_files = strv_free(c->environment_files);
2119 c->pass_environment = strv_free(c->pass_environment);
2120
2121 for (l = 0; l < ELEMENTSOF(c->rlimit); l++)
2122 c->rlimit[l] = mfree(c->rlimit[l]);
2123
2124 c->working_directory = mfree(c->working_directory);
2125 c->root_directory = mfree(c->root_directory);
2126 c->tty_path = mfree(c->tty_path);
2127 c->syslog_identifier = mfree(c->syslog_identifier);
2128 c->user = mfree(c->user);
2129 c->group = mfree(c->group);
2130
2131 c->supplementary_groups = strv_free(c->supplementary_groups);
2132
2133 c->pam_name = mfree(c->pam_name);
2134
2135 c->read_only_dirs = strv_free(c->read_only_dirs);
2136 c->read_write_dirs = strv_free(c->read_write_dirs);
2137 c->inaccessible_dirs = strv_free(c->inaccessible_dirs);
2138
2139 if (c->cpuset)
2140 CPU_FREE(c->cpuset);
2141
2142 c->utmp_id = mfree(c->utmp_id);
2143 c->selinux_context = mfree(c->selinux_context);
2144 c->apparmor_profile = mfree(c->apparmor_profile);
2145
2146 c->syscall_filter = set_free(c->syscall_filter);
2147 c->syscall_archs = set_free(c->syscall_archs);
2148 c->address_families = set_free(c->address_families);
2149
2150 c->runtime_directory = strv_free(c->runtime_directory);
2151 }
2152
2153 int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
2154 char **i;
2155
2156 assert(c);
2157
2158 if (!runtime_prefix)
2159 return 0;
2160
2161 STRV_FOREACH(i, c->runtime_directory) {
2162 _cleanup_free_ char *p;
2163
2164 p = strjoin(runtime_prefix, "/", *i, NULL);
2165 if (!p)
2166 return -ENOMEM;
2167
2168 /* We execute this synchronously, since we need to be
2169 * sure this is gone when we start the service
2170 * next. */
2171 (void) rm_rf(p, REMOVE_ROOT);
2172 }
2173
2174 return 0;
2175 }
2176
2177 void exec_command_done(ExecCommand *c) {
2178 assert(c);
2179
2180 c->path = mfree(c->path);
2181
2182 c->argv = strv_free(c->argv);
2183 }
2184
2185 void exec_command_done_array(ExecCommand *c, unsigned n) {
2186 unsigned i;
2187
2188 for (i = 0; i < n; i++)
2189 exec_command_done(c+i);
2190 }
2191
2192 ExecCommand* exec_command_free_list(ExecCommand *c) {
2193 ExecCommand *i;
2194
2195 while ((i = c)) {
2196 LIST_REMOVE(command, c, i);
2197 exec_command_done(i);
2198 free(i);
2199 }
2200
2201 return NULL;
2202 }
2203
2204 void exec_command_free_array(ExecCommand **c, unsigned n) {
2205 unsigned i;
2206
2207 for (i = 0; i < n; i++)
2208 c[i] = exec_command_free_list(c[i]);
2209 }
2210
2211 typedef struct InvalidEnvInfo {
2212 Unit *unit;
2213 const char *path;
2214 } InvalidEnvInfo;
2215
2216 static void invalid_env(const char *p, void *userdata) {
2217 InvalidEnvInfo *info = userdata;
2218
2219 log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
2220 }
2221
2222 int exec_context_load_environment(Unit *unit, const ExecContext *c, char ***l) {
2223 char **i, **r = NULL;
2224
2225 assert(c);
2226 assert(l);
2227
2228 STRV_FOREACH(i, c->environment_files) {
2229 char *fn;
2230 int k;
2231 bool ignore = false;
2232 char **p;
2233 _cleanup_globfree_ glob_t pglob = {};
2234 int count, n;
2235
2236 fn = *i;
2237
2238 if (fn[0] == '-') {
2239 ignore = true;
2240 fn ++;
2241 }
2242
2243 if (!path_is_absolute(fn)) {
2244 if (ignore)
2245 continue;
2246
2247 strv_free(r);
2248 return -EINVAL;
2249 }
2250
2251 /* Filename supports globbing, take all matching files */
2252 errno = 0;
2253 if (glob(fn, 0, NULL, &pglob) != 0) {
2254 if (ignore)
2255 continue;
2256
2257 strv_free(r);
2258 return errno > 0 ? -errno : -EINVAL;
2259 }
2260 count = pglob.gl_pathc;
2261 if (count == 0) {
2262 if (ignore)
2263 continue;
2264
2265 strv_free(r);
2266 return -EINVAL;
2267 }
2268 for (n = 0; n < count; n++) {
2269 k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
2270 if (k < 0) {
2271 if (ignore)
2272 continue;
2273
2274 strv_free(r);
2275 return k;
2276 }
2277 /* Log invalid environment variables with filename */
2278 if (p) {
2279 InvalidEnvInfo info = {
2280 .unit = unit,
2281 .path = pglob.gl_pathv[n]
2282 };
2283
2284 p = strv_env_clean_with_callback(p, invalid_env, &info);
2285 }
2286
2287 if (r == NULL)
2288 r = p;
2289 else {
2290 char **m;
2291
2292 m = strv_env_merge(2, r, p);
2293 strv_free(r);
2294 strv_free(p);
2295 if (!m)
2296 return -ENOMEM;
2297
2298 r = m;
2299 }
2300 }
2301 }
2302
2303 *l = r;
2304
2305 return 0;
2306 }
2307
2308 static bool tty_may_match_dev_console(const char *tty) {
2309 _cleanup_free_ char *active = NULL;
2310 char *console;
2311
2312 if (!tty)
2313 return true;
2314
2315 if (startswith(tty, "/dev/"))
2316 tty += 5;
2317
2318 /* trivial identity? */
2319 if (streq(tty, "console"))
2320 return true;
2321
2322 console = resolve_dev_console(&active);
2323 /* if we could not resolve, assume it may */
2324 if (!console)
2325 return true;
2326
2327 /* "tty0" means the active VC, so it may be the same sometimes */
2328 return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
2329 }
2330
2331 bool exec_context_may_touch_console(ExecContext *ec) {
2332
2333 return (ec->tty_reset ||
2334 ec->tty_vhangup ||
2335 ec->tty_vt_disallocate ||
2336 is_terminal_input(ec->std_input) ||
2337 is_terminal_output(ec->std_output) ||
2338 is_terminal_output(ec->std_error)) &&
2339 tty_may_match_dev_console(exec_context_tty_path(ec));
2340 }
2341
2342 static void strv_fprintf(FILE *f, char **l) {
2343 char **g;
2344
2345 assert(f);
2346
2347 STRV_FOREACH(g, l)
2348 fprintf(f, " %s", *g);
2349 }
2350
2351 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
2352 char **e, **d;
2353 unsigned i;
2354
2355 assert(c);
2356 assert(f);
2357
2358 prefix = strempty(prefix);
2359
2360 fprintf(f,
2361 "%sUMask: %04o\n"
2362 "%sWorkingDirectory: %s\n"
2363 "%sRootDirectory: %s\n"
2364 "%sNonBlocking: %s\n"
2365 "%sPrivateTmp: %s\n"
2366 "%sPrivateNetwork: %s\n"
2367 "%sPrivateDevices: %s\n"
2368 "%sProtectHome: %s\n"
2369 "%sProtectSystem: %s\n"
2370 "%sIgnoreSIGPIPE: %s\n",
2371 prefix, c->umask,
2372 prefix, c->working_directory ? c->working_directory : "/",
2373 prefix, c->root_directory ? c->root_directory : "/",
2374 prefix, yes_no(c->non_blocking),
2375 prefix, yes_no(c->private_tmp),
2376 prefix, yes_no(c->private_network),
2377 prefix, yes_no(c->private_devices),
2378 prefix, protect_home_to_string(c->protect_home),
2379 prefix, protect_system_to_string(c->protect_system),
2380 prefix, yes_no(c->ignore_sigpipe));
2381
2382 STRV_FOREACH(e, c->environment)
2383 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
2384
2385 STRV_FOREACH(e, c->environment_files)
2386 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
2387
2388 STRV_FOREACH(e, c->pass_environment)
2389 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
2390
2391 fprintf(f, "%sRuntimeDirectoryMode: %04o\n", prefix, c->runtime_directory_mode);
2392
2393 STRV_FOREACH(d, c->runtime_directory)
2394 fprintf(f, "%sRuntimeDirectory: %s\n", prefix, *d);
2395
2396 if (c->nice_set)
2397 fprintf(f,
2398 "%sNice: %i\n",
2399 prefix, c->nice);
2400
2401 if (c->oom_score_adjust_set)
2402 fprintf(f,
2403 "%sOOMScoreAdjust: %i\n",
2404 prefix, c->oom_score_adjust);
2405
2406 for (i = 0; i < RLIM_NLIMITS; i++)
2407 if (c->rlimit[i]) {
2408 fprintf(f, "%s%s: " RLIM_FMT "\n",
2409 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
2410 fprintf(f, "%s%sSoft: " RLIM_FMT "\n",
2411 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
2412 }
2413
2414 if (c->ioprio_set) {
2415 _cleanup_free_ char *class_str = NULL;
2416
2417 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
2418 fprintf(f,
2419 "%sIOSchedulingClass: %s\n"
2420 "%sIOPriority: %i\n",
2421 prefix, strna(class_str),
2422 prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
2423 }
2424
2425 if (c->cpu_sched_set) {
2426 _cleanup_free_ char *policy_str = NULL;
2427
2428 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
2429 fprintf(f,
2430 "%sCPUSchedulingPolicy: %s\n"
2431 "%sCPUSchedulingPriority: %i\n"
2432 "%sCPUSchedulingResetOnFork: %s\n",
2433 prefix, strna(policy_str),
2434 prefix, c->cpu_sched_priority,
2435 prefix, yes_no(c->cpu_sched_reset_on_fork));
2436 }
2437
2438 if (c->cpuset) {
2439 fprintf(f, "%sCPUAffinity:", prefix);
2440 for (i = 0; i < c->cpuset_ncpus; i++)
2441 if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
2442 fprintf(f, " %u", i);
2443 fputs("\n", f);
2444 }
2445
2446 if (c->timer_slack_nsec != NSEC_INFINITY)
2447 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
2448
2449 fprintf(f,
2450 "%sStandardInput: %s\n"
2451 "%sStandardOutput: %s\n"
2452 "%sStandardError: %s\n",
2453 prefix, exec_input_to_string(c->std_input),
2454 prefix, exec_output_to_string(c->std_output),
2455 prefix, exec_output_to_string(c->std_error));
2456
2457 if (c->tty_path)
2458 fprintf(f,
2459 "%sTTYPath: %s\n"
2460 "%sTTYReset: %s\n"
2461 "%sTTYVHangup: %s\n"
2462 "%sTTYVTDisallocate: %s\n",
2463 prefix, c->tty_path,
2464 prefix, yes_no(c->tty_reset),
2465 prefix, yes_no(c->tty_vhangup),
2466 prefix, yes_no(c->tty_vt_disallocate));
2467
2468 if (c->std_output == EXEC_OUTPUT_SYSLOG ||
2469 c->std_output == EXEC_OUTPUT_KMSG ||
2470 c->std_output == EXEC_OUTPUT_JOURNAL ||
2471 c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2472 c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2473 c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
2474 c->std_error == EXEC_OUTPUT_SYSLOG ||
2475 c->std_error == EXEC_OUTPUT_KMSG ||
2476 c->std_error == EXEC_OUTPUT_JOURNAL ||
2477 c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2478 c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2479 c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
2480
2481 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
2482
2483 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
2484 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
2485
2486 fprintf(f,
2487 "%sSyslogFacility: %s\n"
2488 "%sSyslogLevel: %s\n",
2489 prefix, strna(fac_str),
2490 prefix, strna(lvl_str));
2491 }
2492
2493 if (c->secure_bits)
2494 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
2495 prefix,
2496 (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
2497 (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
2498 (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
2499 (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
2500 (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
2501 (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
2502
2503 if (c->capability_bounding_set != CAP_ALL) {
2504 unsigned long l;
2505 fprintf(f, "%sCapabilityBoundingSet:", prefix);
2506
2507 for (l = 0; l <= cap_last_cap(); l++)
2508 if (c->capability_bounding_set & (UINT64_C(1) << l))
2509 fprintf(f, " %s", strna(capability_to_name(l)));
2510
2511 fputs("\n", f);
2512 }
2513
2514 if (c->capability_ambient_set != 0) {
2515 unsigned long l;
2516 fprintf(f, "%sAmbientCapabilities:", prefix);
2517
2518 for (l = 0; l <= cap_last_cap(); l++)
2519 if (c->capability_ambient_set & (UINT64_C(1) << l))
2520 fprintf(f, " %s", strna(capability_to_name(l)));
2521
2522 fputs("\n", f);
2523 }
2524
2525 if (c->user)
2526 fprintf(f, "%sUser: %s\n", prefix, c->user);
2527 if (c->group)
2528 fprintf(f, "%sGroup: %s\n", prefix, c->group);
2529
2530 if (strv_length(c->supplementary_groups) > 0) {
2531 fprintf(f, "%sSupplementaryGroups:", prefix);
2532 strv_fprintf(f, c->supplementary_groups);
2533 fputs("\n", f);
2534 }
2535
2536 if (c->pam_name)
2537 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
2538
2539 if (strv_length(c->read_write_dirs) > 0) {
2540 fprintf(f, "%sReadWriteDirs:", prefix);
2541 strv_fprintf(f, c->read_write_dirs);
2542 fputs("\n", f);
2543 }
2544
2545 if (strv_length(c->read_only_dirs) > 0) {
2546 fprintf(f, "%sReadOnlyDirs:", prefix);
2547 strv_fprintf(f, c->read_only_dirs);
2548 fputs("\n", f);
2549 }
2550
2551 if (strv_length(c->inaccessible_dirs) > 0) {
2552 fprintf(f, "%sInaccessibleDirs:", prefix);
2553 strv_fprintf(f, c->inaccessible_dirs);
2554 fputs("\n", f);
2555 }
2556
2557 if (c->utmp_id)
2558 fprintf(f,
2559 "%sUtmpIdentifier: %s\n",
2560 prefix, c->utmp_id);
2561
2562 if (c->selinux_context)
2563 fprintf(f,
2564 "%sSELinuxContext: %s%s\n",
2565 prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
2566
2567 if (c->personality != PERSONALITY_INVALID)
2568 fprintf(f,
2569 "%sPersonality: %s\n",
2570 prefix, strna(personality_to_string(c->personality)));
2571
2572 if (c->syscall_filter) {
2573 #ifdef HAVE_SECCOMP
2574 Iterator j;
2575 void *id;
2576 bool first = true;
2577 #endif
2578
2579 fprintf(f,
2580 "%sSystemCallFilter: ",
2581 prefix);
2582
2583 if (!c->syscall_whitelist)
2584 fputc('~', f);
2585
2586 #ifdef HAVE_SECCOMP
2587 SET_FOREACH(id, c->syscall_filter, j) {
2588 _cleanup_free_ char *name = NULL;
2589
2590 if (first)
2591 first = false;
2592 else
2593 fputc(' ', f);
2594
2595 name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
2596 fputs(strna(name), f);
2597 }
2598 #endif
2599
2600 fputc('\n', f);
2601 }
2602
2603 if (c->syscall_archs) {
2604 #ifdef HAVE_SECCOMP
2605 Iterator j;
2606 void *id;
2607 #endif
2608
2609 fprintf(f,
2610 "%sSystemCallArchitectures:",
2611 prefix);
2612
2613 #ifdef HAVE_SECCOMP
2614 SET_FOREACH(id, c->syscall_archs, j)
2615 fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
2616 #endif
2617 fputc('\n', f);
2618 }
2619
2620 if (c->syscall_errno > 0)
2621 fprintf(f,
2622 "%sSystemCallErrorNumber: %s\n",
2623 prefix, strna(errno_to_name(c->syscall_errno)));
2624
2625 if (c->apparmor_profile)
2626 fprintf(f,
2627 "%sAppArmorProfile: %s%s\n",
2628 prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
2629 }
2630
2631 bool exec_context_maintains_privileges(ExecContext *c) {
2632 assert(c);
2633
2634 /* Returns true if the process forked off would run run under
2635 * an unchanged UID or as root. */
2636
2637 if (!c->user)
2638 return true;
2639
2640 if (streq(c->user, "root") || streq(c->user, "0"))
2641 return true;
2642
2643 return false;
2644 }
2645
2646 void exec_status_start(ExecStatus *s, pid_t pid) {
2647 assert(s);
2648
2649 zero(*s);
2650 s->pid = pid;
2651 dual_timestamp_get(&s->start_timestamp);
2652 }
2653
2654 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2655 assert(s);
2656
2657 if (s->pid && s->pid != pid)
2658 zero(*s);
2659
2660 s->pid = pid;
2661 dual_timestamp_get(&s->exit_timestamp);
2662
2663 s->code = code;
2664 s->status = status;
2665
2666 if (context) {
2667 if (context->utmp_id)
2668 utmp_put_dead_process(context->utmp_id, pid, code, status);
2669
2670 exec_context_tty_reset(context, NULL);
2671 }
2672 }
2673
2674 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2675 char buf[FORMAT_TIMESTAMP_MAX];
2676
2677 assert(s);
2678 assert(f);
2679
2680 if (s->pid <= 0)
2681 return;
2682
2683 prefix = strempty(prefix);
2684
2685 fprintf(f,
2686 "%sPID: "PID_FMT"\n",
2687 prefix, s->pid);
2688
2689 if (s->start_timestamp.realtime > 0)
2690 fprintf(f,
2691 "%sStart Timestamp: %s\n",
2692 prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2693
2694 if (s->exit_timestamp.realtime > 0)
2695 fprintf(f,
2696 "%sExit Timestamp: %s\n"
2697 "%sExit Code: %s\n"
2698 "%sExit Status: %i\n",
2699 prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2700 prefix, sigchld_code_to_string(s->code),
2701 prefix, s->status);
2702 }
2703
2704 char *exec_command_line(char **argv) {
2705 size_t k;
2706 char *n, *p, **a;
2707 bool first = true;
2708
2709 assert(argv);
2710
2711 k = 1;
2712 STRV_FOREACH(a, argv)
2713 k += strlen(*a)+3;
2714
2715 if (!(n = new(char, k)))
2716 return NULL;
2717
2718 p = n;
2719 STRV_FOREACH(a, argv) {
2720
2721 if (!first)
2722 *(p++) = ' ';
2723 else
2724 first = false;
2725
2726 if (strpbrk(*a, WHITESPACE)) {
2727 *(p++) = '\'';
2728 p = stpcpy(p, *a);
2729 *(p++) = '\'';
2730 } else
2731 p = stpcpy(p, *a);
2732
2733 }
2734
2735 *p = 0;
2736
2737 /* FIXME: this doesn't really handle arguments that have
2738 * spaces and ticks in them */
2739
2740 return n;
2741 }
2742
2743 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2744 _cleanup_free_ char *cmd = NULL;
2745 const char *prefix2;
2746
2747 assert(c);
2748 assert(f);
2749
2750 prefix = strempty(prefix);
2751 prefix2 = strjoina(prefix, "\t");
2752
2753 cmd = exec_command_line(c->argv);
2754 fprintf(f,
2755 "%sCommand Line: %s\n",
2756 prefix, cmd ? cmd : strerror(ENOMEM));
2757
2758 exec_status_dump(&c->exec_status, f, prefix2);
2759 }
2760
2761 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2762 assert(f);
2763
2764 prefix = strempty(prefix);
2765
2766 LIST_FOREACH(command, c, c)
2767 exec_command_dump(c, f, prefix);
2768 }
2769
2770 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2771 ExecCommand *end;
2772
2773 assert(l);
2774 assert(e);
2775
2776 if (*l) {
2777 /* It's kind of important, that we keep the order here */
2778 LIST_FIND_TAIL(command, *l, end);
2779 LIST_INSERT_AFTER(command, *l, end, e);
2780 } else
2781 *l = e;
2782 }
2783
2784 int exec_command_set(ExecCommand *c, const char *path, ...) {
2785 va_list ap;
2786 char **l, *p;
2787
2788 assert(c);
2789 assert(path);
2790
2791 va_start(ap, path);
2792 l = strv_new_ap(path, ap);
2793 va_end(ap);
2794
2795 if (!l)
2796 return -ENOMEM;
2797
2798 p = strdup(path);
2799 if (!p) {
2800 strv_free(l);
2801 return -ENOMEM;
2802 }
2803
2804 free(c->path);
2805 c->path = p;
2806
2807 strv_free(c->argv);
2808 c->argv = l;
2809
2810 return 0;
2811 }
2812
2813 int exec_command_append(ExecCommand *c, const char *path, ...) {
2814 _cleanup_strv_free_ char **l = NULL;
2815 va_list ap;
2816 int r;
2817
2818 assert(c);
2819 assert(path);
2820
2821 va_start(ap, path);
2822 l = strv_new_ap(path, ap);
2823 va_end(ap);
2824
2825 if (!l)
2826 return -ENOMEM;
2827
2828 r = strv_extend_strv(&c->argv, l, false);
2829 if (r < 0)
2830 return r;
2831
2832 return 0;
2833 }
2834
2835
2836 static int exec_runtime_allocate(ExecRuntime **rt) {
2837
2838 if (*rt)
2839 return 0;
2840
2841 *rt = new0(ExecRuntime, 1);
2842 if (!*rt)
2843 return -ENOMEM;
2844
2845 (*rt)->n_ref = 1;
2846 (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
2847
2848 return 0;
2849 }
2850
2851 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
2852 int r;
2853
2854 assert(rt);
2855 assert(c);
2856 assert(id);
2857
2858 if (*rt)
2859 return 1;
2860
2861 if (!c->private_network && !c->private_tmp)
2862 return 0;
2863
2864 r = exec_runtime_allocate(rt);
2865 if (r < 0)
2866 return r;
2867
2868 if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
2869 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
2870 return -errno;
2871 }
2872
2873 if (c->private_tmp && !(*rt)->tmp_dir) {
2874 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
2875 if (r < 0)
2876 return r;
2877 }
2878
2879 return 1;
2880 }
2881
2882 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
2883 assert(r);
2884 assert(r->n_ref > 0);
2885
2886 r->n_ref++;
2887 return r;
2888 }
2889
2890 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
2891
2892 if (!r)
2893 return NULL;
2894
2895 assert(r->n_ref > 0);
2896
2897 r->n_ref--;
2898 if (r->n_ref > 0)
2899 return NULL;
2900
2901 free(r->tmp_dir);
2902 free(r->var_tmp_dir);
2903 safe_close_pair(r->netns_storage_socket);
2904 free(r);
2905
2906 return NULL;
2907 }
2908
2909 int exec_runtime_serialize(Unit *u, ExecRuntime *rt, FILE *f, FDSet *fds) {
2910 assert(u);
2911 assert(f);
2912 assert(fds);
2913
2914 if (!rt)
2915 return 0;
2916
2917 if (rt->tmp_dir)
2918 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
2919
2920 if (rt->var_tmp_dir)
2921 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
2922
2923 if (rt->netns_storage_socket[0] >= 0) {
2924 int copy;
2925
2926 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
2927 if (copy < 0)
2928 return copy;
2929
2930 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
2931 }
2932
2933 if (rt->netns_storage_socket[1] >= 0) {
2934 int copy;
2935
2936 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
2937 if (copy < 0)
2938 return copy;
2939
2940 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
2941 }
2942
2943 return 0;
2944 }
2945
2946 int exec_runtime_deserialize_item(Unit *u, ExecRuntime **rt, const char *key, const char *value, FDSet *fds) {
2947 int r;
2948
2949 assert(rt);
2950 assert(key);
2951 assert(value);
2952
2953 if (streq(key, "tmp-dir")) {
2954 char *copy;
2955
2956 r = exec_runtime_allocate(rt);
2957 if (r < 0)
2958 return log_oom();
2959
2960 copy = strdup(value);
2961 if (!copy)
2962 return log_oom();
2963
2964 free((*rt)->tmp_dir);
2965 (*rt)->tmp_dir = copy;
2966
2967 } else if (streq(key, "var-tmp-dir")) {
2968 char *copy;
2969
2970 r = exec_runtime_allocate(rt);
2971 if (r < 0)
2972 return log_oom();
2973
2974 copy = strdup(value);
2975 if (!copy)
2976 return log_oom();
2977
2978 free((*rt)->var_tmp_dir);
2979 (*rt)->var_tmp_dir = copy;
2980
2981 } else if (streq(key, "netns-socket-0")) {
2982 int fd;
2983
2984 r = exec_runtime_allocate(rt);
2985 if (r < 0)
2986 return log_oom();
2987
2988 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2989 log_unit_debug(u, "Failed to parse netns socket value: %s", value);
2990 else {
2991 safe_close((*rt)->netns_storage_socket[0]);
2992 (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
2993 }
2994 } else if (streq(key, "netns-socket-1")) {
2995 int fd;
2996
2997 r = exec_runtime_allocate(rt);
2998 if (r < 0)
2999 return log_oom();
3000
3001 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
3002 log_unit_debug(u, "Failed to parse netns socket value: %s", value);
3003 else {
3004 safe_close((*rt)->netns_storage_socket[1]);
3005 (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
3006 }
3007 } else
3008 return 0;
3009
3010 return 1;
3011 }
3012
3013 static void *remove_tmpdir_thread(void *p) {
3014 _cleanup_free_ char *path = p;
3015
3016 (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
3017 return NULL;
3018 }
3019
3020 void exec_runtime_destroy(ExecRuntime *rt) {
3021 int r;
3022
3023 if (!rt)
3024 return;
3025
3026 /* If there are multiple users of this, let's leave the stuff around */
3027 if (rt->n_ref > 1)
3028 return;
3029
3030 if (rt->tmp_dir) {
3031 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
3032
3033 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
3034 if (r < 0) {
3035 log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
3036 free(rt->tmp_dir);
3037 }
3038
3039 rt->tmp_dir = NULL;
3040 }
3041
3042 if (rt->var_tmp_dir) {
3043 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
3044
3045 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
3046 if (r < 0) {
3047 log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
3048 free(rt->var_tmp_dir);
3049 }
3050
3051 rt->var_tmp_dir = NULL;
3052 }
3053
3054 safe_close_pair(rt->netns_storage_socket);
3055 }
3056
3057 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
3058 [EXEC_INPUT_NULL] = "null",
3059 [EXEC_INPUT_TTY] = "tty",
3060 [EXEC_INPUT_TTY_FORCE] = "tty-force",
3061 [EXEC_INPUT_TTY_FAIL] = "tty-fail",
3062 [EXEC_INPUT_SOCKET] = "socket"
3063 };
3064
3065 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
3066
3067 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
3068 [EXEC_OUTPUT_INHERIT] = "inherit",
3069 [EXEC_OUTPUT_NULL] = "null",
3070 [EXEC_OUTPUT_TTY] = "tty",
3071 [EXEC_OUTPUT_SYSLOG] = "syslog",
3072 [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
3073 [EXEC_OUTPUT_KMSG] = "kmsg",
3074 [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
3075 [EXEC_OUTPUT_JOURNAL] = "journal",
3076 [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
3077 [EXEC_OUTPUT_SOCKET] = "socket"
3078 };
3079
3080 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
3081
3082 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
3083 [EXEC_UTMP_INIT] = "init",
3084 [EXEC_UTMP_LOGIN] = "login",
3085 [EXEC_UTMP_USER] = "user",
3086 };
3087
3088 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);
Unnamed repository; edit this file 'description' to name the repository.