]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/core/execute.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #4806 from poettering/keyring-init
[thirdparty/systemd.git] / src / core / execute.c
1 /***
2 This file is part of systemd.
3
4 Copyright 2010 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18 ***/
19
20 #include <errno.h>
21 #include <fcntl.h>
22 #include <glob.h>
23 #include <grp.h>
24 #include <poll.h>
25 #include <signal.h>
26 #include <string.h>
27 #include <sys/capability.h>
28 #include <sys/eventfd.h>
29 #include <sys/mman.h>
30 #include <sys/personality.h>
31 #include <sys/prctl.h>
32 #include <sys/shm.h>
33 #include <sys/socket.h>
34 #include <sys/stat.h>
35 #include <sys/types.h>
36 #include <sys/un.h>
37 #include <unistd.h>
38 #include <utmpx.h>
39
40 #ifdef HAVE_PAM
41 #include <security/pam_appl.h>
42 #endif
43
44 #ifdef HAVE_SELINUX
45 #include <selinux/selinux.h>
46 #endif
47
48 #ifdef HAVE_SECCOMP
49 #include <seccomp.h>
50 #endif
51
52 #ifdef HAVE_APPARMOR
53 #include <sys/apparmor.h>
54 #endif
55
56 #include "sd-messages.h"
57
58 #include "af-list.h"
59 #include "alloc-util.h"
60 #ifdef HAVE_APPARMOR
61 #include "apparmor-util.h"
62 #endif
63 #include "async.h"
64 #include "barrier.h"
65 #include "cap-list.h"
66 #include "capability-util.h"
67 #include "def.h"
68 #include "env-util.h"
69 #include "errno-list.h"
70 #include "execute.h"
71 #include "exit-status.h"
72 #include "fd-util.h"
73 #include "fileio.h"
74 #include "format-util.h"
75 #include "fs-util.h"
76 #include "glob-util.h"
77 #include "io-util.h"
78 #include "ioprio.h"
79 #include "log.h"
80 #include "macro.h"
81 #include "missing.h"
82 #include "mkdir.h"
83 #include "namespace.h"
84 #include "parse-util.h"
85 #include "path-util.h"
86 #include "process-util.h"
87 #include "rlimit-util.h"
88 #include "rm-rf.h"
89 #ifdef HAVE_SECCOMP
90 #include "seccomp-util.h"
91 #endif
92 #include "securebits.h"
93 #include "selinux-util.h"
94 #include "signal-util.h"
95 #include "smack-util.h"
96 #include "special.h"
97 #include "string-table.h"
98 #include "string-util.h"
99 #include "strv.h"
100 #include "syslog-util.h"
101 #include "terminal-util.h"
102 #include "unit.h"
103 #include "user-util.h"
104 #include "util.h"
105 #include "utmp-wtmp.h"
106
107 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
108 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
109
110 /* This assumes there is a 'tty' group */
111 #define TTY_MODE 0620
112
113 #define SNDBUF_SIZE (8*1024*1024)
114
115 static int shift_fds(int fds[], unsigned n_fds) {
116 int start, restart_from;
117
118 if (n_fds <= 0)
119 return 0;
120
121 /* Modifies the fds array! (sorts it) */
122
123 assert(fds);
124
125 start = 0;
126 for (;;) {
127 int i;
128
129 restart_from = -1;
130
131 for (i = start; i < (int) n_fds; i++) {
132 int nfd;
133
134 /* Already at right index? */
135 if (fds[i] == i+3)
136 continue;
137
138 nfd = fcntl(fds[i], F_DUPFD, i + 3);
139 if (nfd < 0)
140 return -errno;
141
142 safe_close(fds[i]);
143 fds[i] = nfd;
144
145 /* Hmm, the fd we wanted isn't free? Then
146 * let's remember that and try again from here */
147 if (nfd != i+3 && restart_from < 0)
148 restart_from = i;
149 }
150
151 if (restart_from < 0)
152 break;
153
154 start = restart_from;
155 }
156
157 return 0;
158 }
159
160 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
161 unsigned i;
162 int r;
163
164 if (n_fds <= 0)
165 return 0;
166
167 assert(fds);
168
169 /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
170
171 for (i = 0; i < n_fds; i++) {
172
173 r = fd_nonblock(fds[i], nonblock);
174 if (r < 0)
175 return r;
176
177 /* We unconditionally drop FD_CLOEXEC from the fds,
178 * since after all we want to pass these fds to our
179 * children */
180
181 r = fd_cloexec(fds[i], false);
182 if (r < 0)
183 return r;
184 }
185
186 return 0;
187 }
188
189 static const char *exec_context_tty_path(const ExecContext *context) {
190 assert(context);
191
192 if (context->stdio_as_fds)
193 return NULL;
194
195 if (context->tty_path)
196 return context->tty_path;
197
198 return "/dev/console";
199 }
200
201 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
202 const char *path;
203
204 assert(context);
205
206 path = exec_context_tty_path(context);
207
208 if (context->tty_vhangup) {
209 if (p && p->stdin_fd >= 0)
210 (void) terminal_vhangup_fd(p->stdin_fd);
211 else if (path)
212 (void) terminal_vhangup(path);
213 }
214
215 if (context->tty_reset) {
216 if (p && p->stdin_fd >= 0)
217 (void) reset_terminal_fd(p->stdin_fd, true);
218 else if (path)
219 (void) reset_terminal(path);
220 }
221
222 if (context->tty_vt_disallocate && path)
223 (void) vt_disallocate(path);
224 }
225
226 static bool is_terminal_input(ExecInput i) {
227 return IN_SET(i,
228 EXEC_INPUT_TTY,
229 EXEC_INPUT_TTY_FORCE,
230 EXEC_INPUT_TTY_FAIL);
231 }
232
233 static bool is_terminal_output(ExecOutput o) {
234 return IN_SET(o,
235 EXEC_OUTPUT_TTY,
236 EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
237 EXEC_OUTPUT_KMSG_AND_CONSOLE,
238 EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
239 }
240
241 static bool exec_context_needs_term(const ExecContext *c) {
242 assert(c);
243
244 /* Return true if the execution context suggests we should set $TERM to something useful. */
245
246 if (is_terminal_input(c->std_input))
247 return true;
248
249 if (is_terminal_output(c->std_output))
250 return true;
251
252 if (is_terminal_output(c->std_error))
253 return true;
254
255 return !!c->tty_path;
256 }
257
258 static int open_null_as(int flags, int nfd) {
259 int fd, r;
260
261 assert(nfd >= 0);
262
263 fd = open("/dev/null", flags|O_NOCTTY);
264 if (fd < 0)
265 return -errno;
266
267 if (fd != nfd) {
268 r = dup2(fd, nfd) < 0 ? -errno : nfd;
269 safe_close(fd);
270 } else
271 r = nfd;
272
273 return r;
274 }
275
276 static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
277 union sockaddr_union sa = {
278 .un.sun_family = AF_UNIX,
279 .un.sun_path = "/run/systemd/journal/stdout",
280 };
281 uid_t olduid = UID_INVALID;
282 gid_t oldgid = GID_INVALID;
283 int r;
284
285 if (gid != GID_INVALID) {
286 oldgid = getgid();
287
288 r = setegid(gid);
289 if (r < 0)
290 return -errno;
291 }
292
293 if (uid != UID_INVALID) {
294 olduid = getuid();
295
296 r = seteuid(uid);
297 if (r < 0) {
298 r = -errno;
299 goto restore_gid;
300 }
301 }
302
303 r = connect(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
304 if (r < 0)
305 r = -errno;
306
307 /* If we fail to restore the uid or gid, things will likely
308 fail later on. This should only happen if an LSM interferes. */
309
310 if (uid != UID_INVALID)
311 (void) seteuid(olduid);
312
313 restore_gid:
314 if (gid != GID_INVALID)
315 (void) setegid(oldgid);
316
317 return r;
318 }
319
320 static int connect_logger_as(
321 Unit *unit,
322 const ExecContext *context,
323 ExecOutput output,
324 const char *ident,
325 int nfd,
326 uid_t uid,
327 gid_t gid) {
328
329 int fd, r;
330
331 assert(context);
332 assert(output < _EXEC_OUTPUT_MAX);
333 assert(ident);
334 assert(nfd >= 0);
335
336 fd = socket(AF_UNIX, SOCK_STREAM, 0);
337 if (fd < 0)
338 return -errno;
339
340 r = connect_journal_socket(fd, uid, gid);
341 if (r < 0)
342 return r;
343
344 if (shutdown(fd, SHUT_RD) < 0) {
345 safe_close(fd);
346 return -errno;
347 }
348
349 (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
350
351 dprintf(fd,
352 "%s\n"
353 "%s\n"
354 "%i\n"
355 "%i\n"
356 "%i\n"
357 "%i\n"
358 "%i\n",
359 context->syslog_identifier ? context->syslog_identifier : ident,
360 unit->id,
361 context->syslog_priority,
362 !!context->syslog_level_prefix,
363 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
364 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
365 is_terminal_output(output));
366
367 if (fd == nfd)
368 return nfd;
369
370 r = dup2(fd, nfd) < 0 ? -errno : nfd;
371 safe_close(fd);
372
373 return r;
374 }
375 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
376 int fd, r;
377
378 assert(path);
379 assert(nfd >= 0);
380
381 fd = open_terminal(path, mode | O_NOCTTY);
382 if (fd < 0)
383 return fd;
384
385 if (fd != nfd) {
386 r = dup2(fd, nfd) < 0 ? -errno : nfd;
387 safe_close(fd);
388 } else
389 r = nfd;
390
391 return r;
392 }
393
394 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
395
396 if (is_terminal_input(std_input) && !apply_tty_stdin)
397 return EXEC_INPUT_NULL;
398
399 if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
400 return EXEC_INPUT_NULL;
401
402 return std_input;
403 }
404
405 static int fixup_output(ExecOutput std_output, int socket_fd) {
406
407 if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
408 return EXEC_OUTPUT_INHERIT;
409
410 return std_output;
411 }
412
413 static int setup_input(
414 const ExecContext *context,
415 const ExecParameters *params,
416 int socket_fd,
417 int named_iofds[3]) {
418
419 ExecInput i;
420
421 assert(context);
422 assert(params);
423
424 if (params->stdin_fd >= 0) {
425 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
426 return -errno;
427
428 /* Try to make this the controlling tty, if it is a tty, and reset it */
429 (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
430 (void) reset_terminal_fd(STDIN_FILENO, true);
431
432 return STDIN_FILENO;
433 }
434
435 i = fixup_input(context->std_input, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
436
437 switch (i) {
438
439 case EXEC_INPUT_NULL:
440 return open_null_as(O_RDONLY, STDIN_FILENO);
441
442 case EXEC_INPUT_TTY:
443 case EXEC_INPUT_TTY_FORCE:
444 case EXEC_INPUT_TTY_FAIL: {
445 int fd, r;
446
447 fd = acquire_terminal(exec_context_tty_path(context),
448 i == EXEC_INPUT_TTY_FAIL,
449 i == EXEC_INPUT_TTY_FORCE,
450 false,
451 USEC_INFINITY);
452 if (fd < 0)
453 return fd;
454
455 if (fd != STDIN_FILENO) {
456 r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
457 safe_close(fd);
458 } else
459 r = STDIN_FILENO;
460
461 return r;
462 }
463
464 case EXEC_INPUT_SOCKET:
465 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
466
467 case EXEC_INPUT_NAMED_FD:
468 (void) fd_nonblock(named_iofds[STDIN_FILENO], false);
469 return dup2(named_iofds[STDIN_FILENO], STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
470
471 default:
472 assert_not_reached("Unknown input type");
473 }
474 }
475
476 static int setup_output(
477 Unit *unit,
478 const ExecContext *context,
479 const ExecParameters *params,
480 int fileno,
481 int socket_fd,
482 int named_iofds[3],
483 const char *ident,
484 uid_t uid,
485 gid_t gid,
486 dev_t *journal_stream_dev,
487 ino_t *journal_stream_ino) {
488
489 ExecOutput o;
490 ExecInput i;
491 int r;
492
493 assert(unit);
494 assert(context);
495 assert(params);
496 assert(ident);
497 assert(journal_stream_dev);
498 assert(journal_stream_ino);
499
500 if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
501
502 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
503 return -errno;
504
505 return STDOUT_FILENO;
506 }
507
508 if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
509 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
510 return -errno;
511
512 return STDERR_FILENO;
513 }
514
515 i = fixup_input(context->std_input, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
516 o = fixup_output(context->std_output, socket_fd);
517
518 if (fileno == STDERR_FILENO) {
519 ExecOutput e;
520 e = fixup_output(context->std_error, socket_fd);
521
522 /* This expects the input and output are already set up */
523
524 /* Don't change the stderr file descriptor if we inherit all
525 * the way and are not on a tty */
526 if (e == EXEC_OUTPUT_INHERIT &&
527 o == EXEC_OUTPUT_INHERIT &&
528 i == EXEC_INPUT_NULL &&
529 !is_terminal_input(context->std_input) &&
530 getppid () != 1)
531 return fileno;
532
533 /* Duplicate from stdout if possible */
534 if ((e == o && e != EXEC_OUTPUT_NAMED_FD) || e == EXEC_OUTPUT_INHERIT)
535 return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
536
537 o = e;
538
539 } else if (o == EXEC_OUTPUT_INHERIT) {
540 /* If input got downgraded, inherit the original value */
541 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
542 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
543
544 /* If the input is connected to anything that's not a /dev/null, inherit that... */
545 if (i != EXEC_INPUT_NULL)
546 return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
547
548 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
549 if (getppid() != 1)
550 return fileno;
551
552 /* We need to open /dev/null here anew, to get the right access mode. */
553 return open_null_as(O_WRONLY, fileno);
554 }
555
556 switch (o) {
557
558 case EXEC_OUTPUT_NULL:
559 return open_null_as(O_WRONLY, fileno);
560
561 case EXEC_OUTPUT_TTY:
562 if (is_terminal_input(i))
563 return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
564
565 /* We don't reset the terminal if this is just about output */
566 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
567
568 case EXEC_OUTPUT_SYSLOG:
569 case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
570 case EXEC_OUTPUT_KMSG:
571 case EXEC_OUTPUT_KMSG_AND_CONSOLE:
572 case EXEC_OUTPUT_JOURNAL:
573 case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
574 r = connect_logger_as(unit, context, o, ident, fileno, uid, gid);
575 if (r < 0) {
576 log_unit_error_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
577 r = open_null_as(O_WRONLY, fileno);
578 } else {
579 struct stat st;
580
581 /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
582 * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
583 * services to detect whether they are connected to the journal or not. */
584
585 if (fstat(fileno, &st) >= 0) {
586 *journal_stream_dev = st.st_dev;
587 *journal_stream_ino = st.st_ino;
588 }
589 }
590 return r;
591
592 case EXEC_OUTPUT_SOCKET:
593 assert(socket_fd >= 0);
594 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
595
596 case EXEC_OUTPUT_NAMED_FD:
597 (void) fd_nonblock(named_iofds[fileno], false);
598 return dup2(named_iofds[fileno], fileno) < 0 ? -errno : fileno;
599
600 default:
601 assert_not_reached("Unknown error type");
602 }
603 }
604
605 static int chown_terminal(int fd, uid_t uid) {
606 struct stat st;
607
608 assert(fd >= 0);
609
610 /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
611 if (isatty(fd) < 1)
612 return 0;
613
614 /* This might fail. What matters are the results. */
615 (void) fchown(fd, uid, -1);
616 (void) fchmod(fd, TTY_MODE);
617
618 if (fstat(fd, &st) < 0)
619 return -errno;
620
621 if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
622 return -EPERM;
623
624 return 0;
625 }
626
627 static int setup_confirm_stdio(const char *vc, int *_saved_stdin, int *_saved_stdout) {
628 _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
629 int r;
630
631 assert(_saved_stdin);
632 assert(_saved_stdout);
633
634 saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
635 if (saved_stdin < 0)
636 return -errno;
637
638 saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
639 if (saved_stdout < 0)
640 return -errno;
641
642 fd = acquire_terminal(vc, false, false, false, DEFAULT_CONFIRM_USEC);
643 if (fd < 0)
644 return fd;
645
646 r = chown_terminal(fd, getuid());
647 if (r < 0)
648 return r;
649
650 r = reset_terminal_fd(fd, true);
651 if (r < 0)
652 return r;
653
654 if (dup2(fd, STDIN_FILENO) < 0)
655 return -errno;
656
657 if (dup2(fd, STDOUT_FILENO) < 0)
658 return -errno;
659
660 if (fd >= 2)
661 safe_close(fd);
662 fd = -1;
663
664 *_saved_stdin = saved_stdin;
665 *_saved_stdout = saved_stdout;
666
667 saved_stdin = saved_stdout = -1;
668
669 return 0;
670 }
671
672 static void write_confirm_error_fd(int err, int fd, const Unit *u) {
673 assert(err < 0);
674
675 if (err == -ETIMEDOUT)
676 dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);
677 else {
678 errno = -err;
679 dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);
680 }
681 }
682
683 static void write_confirm_error(int err, const char *vc, const Unit *u) {
684 _cleanup_close_ int fd = -1;
685
686 assert(vc);
687
688 fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);
689 if (fd < 0)
690 return;
691
692 write_confirm_error_fd(err, fd, u);
693 }
694
695 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
696 int r = 0;
697
698 assert(saved_stdin);
699 assert(saved_stdout);
700
701 release_terminal();
702
703 if (*saved_stdin >= 0)
704 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
705 r = -errno;
706
707 if (*saved_stdout >= 0)
708 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
709 r = -errno;
710
711 *saved_stdin = safe_close(*saved_stdin);
712 *saved_stdout = safe_close(*saved_stdout);
713
714 return r;
715 }
716
717 enum {
718 CONFIRM_PRETEND_FAILURE = -1,
719 CONFIRM_PRETEND_SUCCESS = 0,
720 CONFIRM_EXECUTE = 1,
721 };
722
723 static int ask_for_confirmation(const char *vc, Unit *u, const char *cmdline) {
724 int saved_stdout = -1, saved_stdin = -1, r;
725 _cleanup_free_ char *e = NULL;
726 char c;
727
728 /* For any internal errors, assume a positive response. */
729 r = setup_confirm_stdio(vc, &saved_stdin, &saved_stdout);
730 if (r < 0) {
731 write_confirm_error(r, vc, u);
732 return CONFIRM_EXECUTE;
733 }
734
735 /* confirm_spawn might have been disabled while we were sleeping. */
736 if (manager_is_confirm_spawn_disabled(u->manager)) {
737 r = 1;
738 goto restore_stdio;
739 }
740
741 e = ellipsize(cmdline, 60, 100);
742 if (!e) {
743 log_oom();
744 r = CONFIRM_EXECUTE;
745 goto restore_stdio;
746 }
747
748 for (;;) {
749 r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);
750 if (r < 0) {
751 write_confirm_error_fd(r, STDOUT_FILENO, u);
752 r = CONFIRM_EXECUTE;
753 goto restore_stdio;
754 }
755
756 switch (c) {
757 case 'c':
758 printf("Resuming normal execution.\n");
759 manager_disable_confirm_spawn();
760 r = 1;
761 break;
762 case 'D':
763 unit_dump(u, stdout, " ");
764 continue; /* ask again */
765 case 'f':
766 printf("Failing execution.\n");
767 r = CONFIRM_PRETEND_FAILURE;
768 break;
769 case 'h':
770 printf(" c - continue, proceed without asking anymore\n"
771 " D - dump, show the state of the unit\n"
772 " f - fail, don't execute the command and pretend it failed\n"
773 " h - help\n"
774 " i - info, show a short summary of the unit\n"
775 " j - jobs, show jobs that are in progress\n"
776 " s - skip, don't execute the command and pretend it succeeded\n"
777 " y - yes, execute the command\n");
778 continue; /* ask again */
779 case 'i':
780 printf(" Description: %s\n"
781 " Unit: %s\n"
782 " Command: %s\n",
783 u->id, u->description, cmdline);
784 continue; /* ask again */
785 case 'j':
786 manager_dump_jobs(u->manager, stdout, " ");
787 continue; /* ask again */
788 case 'n':
789 /* 'n' was removed in favor of 'f'. */
790 printf("Didn't understand 'n', did you mean 'f'?\n");
791 continue; /* ask again */
792 case 's':
793 printf("Skipping execution.\n");
794 r = CONFIRM_PRETEND_SUCCESS;
795 break;
796 case 'y':
797 r = CONFIRM_EXECUTE;
798 break;
799 default:
800 assert_not_reached("Unhandled choice");
801 }
802 break;
803 }
804
805 restore_stdio:
806 restore_confirm_stdio(&saved_stdin, &saved_stdout);
807 return r;
808 }
809
810 static int get_fixed_user(const ExecContext *c, const char **user,
811 uid_t *uid, gid_t *gid,
812 const char **home, const char **shell) {
813 int r;
814 const char *name;
815
816 assert(c);
817
818 if (!c->user)
819 return 0;
820
821 /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway
822 * (i.e. are "/" or "/bin/nologin"). */
823
824 name = c->user;
825 r = get_user_creds_clean(&name, uid, gid, home, shell);
826 if (r < 0)
827 return r;
828
829 *user = name;
830 return 0;
831 }
832
833 static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {
834 int r;
835 const char *name;
836
837 assert(c);
838
839 if (!c->group)
840 return 0;
841
842 name = c->group;
843 r = get_group_creds(&name, gid);
844 if (r < 0)
845 return r;
846
847 *group = name;
848 return 0;
849 }
850
851 static int get_supplementary_groups(const ExecContext *c, const char *user,
852 const char *group, gid_t gid,
853 gid_t **supplementary_gids, int *ngids) {
854 char **i;
855 int r, k = 0;
856 int ngroups_max;
857 bool keep_groups = false;
858 gid_t *groups = NULL;
859 _cleanup_free_ gid_t *l_gids = NULL;
860
861 assert(c);
862
863 /*
864 * If user is given, then lookup GID and supplementary groups list.
865 * We avoid NSS lookups for gid=0. Also we have to initialize groups
866 * here and as early as possible so we keep the list of supplementary
867 * groups of the caller.
868 */
869 if (user && gid_is_valid(gid) && gid != 0) {
870 /* First step, initialize groups from /etc/groups */
871 if (initgroups(user, gid) < 0)
872 return -errno;
873
874 keep_groups = true;
875 }
876
877 if (!c->supplementary_groups)
878 return 0;
879
880 /*
881 * If SupplementaryGroups= was passed then NGROUPS_MAX has to
882 * be positive, otherwise fail.
883 */
884 errno = 0;
885 ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
886 if (ngroups_max <= 0) {
887 if (errno > 0)
888 return -errno;
889 else
890 return -EOPNOTSUPP; /* For all other values */
891 }
892
893 l_gids = new(gid_t, ngroups_max);
894 if (!l_gids)
895 return -ENOMEM;
896
897 if (keep_groups) {
898 /*
899 * Lookup the list of groups that the user belongs to, we
900 * avoid NSS lookups here too for gid=0.
901 */
902 k = ngroups_max;
903 if (getgrouplist(user, gid, l_gids, &k) < 0)
904 return -EINVAL;
905 } else
906 k = 0;
907
908 STRV_FOREACH(i, c->supplementary_groups) {
909 const char *g;
910
911 if (k >= ngroups_max)
912 return -E2BIG;
913
914 g = *i;
915 r = get_group_creds(&g, l_gids+k);
916 if (r < 0)
917 return r;
918
919 k++;
920 }
921
922 /*
923 * Sets ngids to zero to drop all supplementary groups, happens
924 * when we are under root and SupplementaryGroups= is empty.
925 */
926 if (k == 0) {
927 *ngids = 0;
928 return 0;
929 }
930
931 /* Otherwise get the final list of supplementary groups */
932 groups = memdup(l_gids, sizeof(gid_t) * k);
933 if (!groups)
934 return -ENOMEM;
935
936 *supplementary_gids = groups;
937 *ngids = k;
938
939 groups = NULL;
940
941 return 0;
942 }
943
944 static int enforce_groups(const ExecContext *context, gid_t gid,
945 gid_t *supplementary_gids, int ngids) {
946 int r;
947
948 assert(context);
949
950 /* Handle SupplementaryGroups= even if it is empty */
951 if (context->supplementary_groups) {
952 r = maybe_setgroups(ngids, supplementary_gids);
953 if (r < 0)
954 return r;
955 }
956
957 if (gid_is_valid(gid)) {
958 /* Then set our gids */
959 if (setresgid(gid, gid, gid) < 0)
960 return -errno;
961 }
962
963 return 0;
964 }
965
966 static int enforce_user(const ExecContext *context, uid_t uid) {
967 assert(context);
968
969 if (!uid_is_valid(uid))
970 return 0;
971
972 /* Sets (but doesn't look up) the uid and make sure we keep the
973 * capabilities while doing so. */
974
975 if (context->capability_ambient_set != 0) {
976
977 /* First step: If we need to keep capabilities but
978 * drop privileges we need to make sure we keep our
979 * caps, while we drop privileges. */
980 if (uid != 0) {
981 int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
982
983 if (prctl(PR_GET_SECUREBITS) != sb)
984 if (prctl(PR_SET_SECUREBITS, sb) < 0)
985 return -errno;
986 }
987 }
988
989 /* Second step: actually set the uids */
990 if (setresuid(uid, uid, uid) < 0)
991 return -errno;
992
993 /* At this point we should have all necessary capabilities but
994 are otherwise a normal user. However, the caps might got
995 corrupted due to the setresuid() so we need clean them up
996 later. This is done outside of this call. */
997
998 return 0;
999 }
1000
1001 #ifdef HAVE_PAM
1002
1003 static int null_conv(
1004 int num_msg,
1005 const struct pam_message **msg,
1006 struct pam_response **resp,
1007 void *appdata_ptr) {
1008
1009 /* We don't support conversations */
1010
1011 return PAM_CONV_ERR;
1012 }
1013
1014 #endif
1015
1016 static int setup_pam(
1017 const char *name,
1018 const char *user,
1019 uid_t uid,
1020 gid_t gid,
1021 const char *tty,
1022 char ***env,
1023 int fds[], unsigned n_fds) {
1024
1025 #ifdef HAVE_PAM
1026
1027 static const struct pam_conv conv = {
1028 .conv = null_conv,
1029 .appdata_ptr = NULL
1030 };
1031
1032 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
1033 pam_handle_t *handle = NULL;
1034 sigset_t old_ss;
1035 int pam_code = PAM_SUCCESS, r;
1036 char **nv, **e = NULL;
1037 bool close_session = false;
1038 pid_t pam_pid = 0, parent_pid;
1039 int flags = 0;
1040
1041 assert(name);
1042 assert(user);
1043 assert(env);
1044
1045 /* We set up PAM in the parent process, then fork. The child
1046 * will then stay around until killed via PR_GET_PDEATHSIG or
1047 * systemd via the cgroup logic. It will then remove the PAM
1048 * session again. The parent process will exec() the actual
1049 * daemon. We do things this way to ensure that the main PID
1050 * of the daemon is the one we initially fork()ed. */
1051
1052 r = barrier_create(&barrier);
1053 if (r < 0)
1054 goto fail;
1055
1056 if (log_get_max_level() < LOG_DEBUG)
1057 flags |= PAM_SILENT;
1058
1059 pam_code = pam_start(name, user, &conv, &handle);
1060 if (pam_code != PAM_SUCCESS) {
1061 handle = NULL;
1062 goto fail;
1063 }
1064
1065 if (tty) {
1066 pam_code = pam_set_item(handle, PAM_TTY, tty);
1067 if (pam_code != PAM_SUCCESS)
1068 goto fail;
1069 }
1070
1071 STRV_FOREACH(nv, *env) {
1072 pam_code = pam_putenv(handle, *nv);
1073 if (pam_code != PAM_SUCCESS)
1074 goto fail;
1075 }
1076
1077 pam_code = pam_acct_mgmt(handle, flags);
1078 if (pam_code != PAM_SUCCESS)
1079 goto fail;
1080
1081 pam_code = pam_open_session(handle, flags);
1082 if (pam_code != PAM_SUCCESS)
1083 goto fail;
1084
1085 close_session = true;
1086
1087 e = pam_getenvlist(handle);
1088 if (!e) {
1089 pam_code = PAM_BUF_ERR;
1090 goto fail;
1091 }
1092
1093 /* Block SIGTERM, so that we know that it won't get lost in
1094 * the child */
1095
1096 assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
1097
1098 parent_pid = getpid();
1099
1100 pam_pid = fork();
1101 if (pam_pid < 0) {
1102 r = -errno;
1103 goto fail;
1104 }
1105
1106 if (pam_pid == 0) {
1107 int sig, ret = EXIT_PAM;
1108
1109 /* The child's job is to reset the PAM session on
1110 * termination */
1111 barrier_set_role(&barrier, BARRIER_CHILD);
1112
1113 /* This string must fit in 10 chars (i.e. the length
1114 * of "/sbin/init"), to look pretty in /bin/ps */
1115 rename_process("(sd-pam)");
1116
1117 /* Make sure we don't keep open the passed fds in this
1118 child. We assume that otherwise only those fds are
1119 open here that have been opened by PAM. */
1120 close_many(fds, n_fds);
1121
1122 /* Drop privileges - we don't need any to pam_close_session
1123 * and this will make PR_SET_PDEATHSIG work in most cases.
1124 * If this fails, ignore the error - but expect sd-pam threads
1125 * to fail to exit normally */
1126
1127 r = maybe_setgroups(0, NULL);
1128 if (r < 0)
1129 log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
1130 if (setresgid(gid, gid, gid) < 0)
1131 log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
1132 if (setresuid(uid, uid, uid) < 0)
1133 log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m");
1134
1135 (void) ignore_signals(SIGPIPE, -1);
1136
1137 /* Wait until our parent died. This will only work if
1138 * the above setresuid() succeeds, otherwise the kernel
1139 * will not allow unprivileged parents kill their privileged
1140 * children this way. We rely on the control groups kill logic
1141 * to do the rest for us. */
1142 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
1143 goto child_finish;
1144
1145 /* Tell the parent that our setup is done. This is especially
1146 * important regarding dropping privileges. Otherwise, unit
1147 * setup might race against our setresuid(2) call. */
1148 barrier_place(&barrier);
1149
1150 /* Check if our parent process might already have
1151 * died? */
1152 if (getppid() == parent_pid) {
1153 sigset_t ss;
1154
1155 assert_se(sigemptyset(&ss) >= 0);
1156 assert_se(sigaddset(&ss, SIGTERM) >= 0);
1157
1158 for (;;) {
1159 if (sigwait(&ss, &sig) < 0) {
1160 if (errno == EINTR)
1161 continue;
1162
1163 goto child_finish;
1164 }
1165
1166 assert(sig == SIGTERM);
1167 break;
1168 }
1169 }
1170
1171 /* If our parent died we'll end the session */
1172 if (getppid() != parent_pid) {
1173 pam_code = pam_close_session(handle, flags);
1174 if (pam_code != PAM_SUCCESS)
1175 goto child_finish;
1176 }
1177
1178 ret = 0;
1179
1180 child_finish:
1181 pam_end(handle, pam_code | flags);
1182 _exit(ret);
1183 }
1184
1185 barrier_set_role(&barrier, BARRIER_PARENT);
1186
1187 /* If the child was forked off successfully it will do all the
1188 * cleanups, so forget about the handle here. */
1189 handle = NULL;
1190
1191 /* Unblock SIGTERM again in the parent */
1192 assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
1193
1194 /* We close the log explicitly here, since the PAM modules
1195 * might have opened it, but we don't want this fd around. */
1196 closelog();
1197
1198 /* Synchronously wait for the child to initialize. We don't care for
1199 * errors as we cannot recover. However, warn loudly if it happens. */
1200 if (!barrier_place_and_sync(&barrier))
1201 log_error("PAM initialization failed");
1202
1203 strv_free(*env);
1204 *env = e;
1205
1206 return 0;
1207
1208 fail:
1209 if (pam_code != PAM_SUCCESS) {
1210 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1211 r = -EPERM; /* PAM errors do not map to errno */
1212 } else
1213 log_error_errno(r, "PAM failed: %m");
1214
1215 if (handle) {
1216 if (close_session)
1217 pam_code = pam_close_session(handle, flags);
1218
1219 pam_end(handle, pam_code | flags);
1220 }
1221
1222 strv_free(e);
1223 closelog();
1224
1225 return r;
1226 #else
1227 return 0;
1228 #endif
1229 }
1230
1231 static void rename_process_from_path(const char *path) {
1232 char process_name[11];
1233 const char *p;
1234 size_t l;
1235
1236 /* This resulting string must fit in 10 chars (i.e. the length
1237 * of "/sbin/init") to look pretty in /bin/ps */
1238
1239 p = basename(path);
1240 if (isempty(p)) {
1241 rename_process("(...)");
1242 return;
1243 }
1244
1245 l = strlen(p);
1246 if (l > 8) {
1247 /* The end of the process name is usually more
1248 * interesting, since the first bit might just be
1249 * "systemd-" */
1250 p = p + l - 8;
1251 l = 8;
1252 }
1253
1254 process_name[0] = '(';
1255 memcpy(process_name+1, p, l);
1256 process_name[1+l] = ')';
1257 process_name[1+l+1] = 0;
1258
1259 rename_process(process_name);
1260 }
1261
1262 #ifdef HAVE_SECCOMP
1263
1264 static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
1265
1266 if (is_seccomp_available())
1267 return false;
1268
1269 log_open();
1270 log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
1271 log_close();
1272 return true;
1273 }
1274
1275 static int apply_seccomp(const Unit* u, const ExecContext *c) {
1276 uint32_t negative_action, action;
1277 scmp_filter_ctx seccomp;
1278 Iterator i;
1279 void *id;
1280 int r;
1281
1282 assert(c);
1283
1284 if (skip_seccomp_unavailable(u, "syscall filtering"))
1285 return 0;
1286
1287 negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
1288
1289 seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
1290 if (!seccomp)
1291 return -ENOMEM;
1292
1293 if (c->syscall_archs) {
1294
1295 SET_FOREACH(id, c->syscall_archs, i) {
1296 r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
1297 if (r == -EEXIST)
1298 continue;
1299 if (r < 0)
1300 goto finish;
1301 }
1302
1303 } else {
1304 r = seccomp_add_secondary_archs(seccomp);
1305 if (r < 0)
1306 goto finish;
1307 }
1308
1309 action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
1310 SET_FOREACH(id, c->syscall_filter, i) {
1311 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
1312 if (r < 0)
1313 goto finish;
1314 }
1315
1316 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1317 if (r < 0)
1318 goto finish;
1319
1320 r = seccomp_load(seccomp);
1321
1322 finish:
1323 seccomp_release(seccomp);
1324 return r;
1325 }
1326
1327 static int apply_address_families(const Unit* u, const ExecContext *c) {
1328 scmp_filter_ctx seccomp;
1329 Iterator i;
1330 int r;
1331
1332 assert(c);
1333
1334 if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1335 return 0;
1336
1337 r = seccomp_init_conservative(&seccomp, SCMP_ACT_ALLOW);
1338 if (r < 0)
1339 return r;
1340
1341 if (c->address_families_whitelist) {
1342 int af, first = 0, last = 0;
1343 void *afp;
1344
1345 /* If this is a whitelist, we first block the address
1346 * families that are out of range and then everything
1347 * that is not in the set. First, we find the lowest
1348 * and highest address family in the set. */
1349
1350 SET_FOREACH(afp, c->address_families, i) {
1351 af = PTR_TO_INT(afp);
1352
1353 if (af <= 0 || af >= af_max())
1354 continue;
1355
1356 if (first == 0 || af < first)
1357 first = af;
1358
1359 if (last == 0 || af > last)
1360 last = af;
1361 }
1362
1363 assert((first == 0) == (last == 0));
1364
1365 if (first == 0) {
1366
1367 /* No entries in the valid range, block everything */
1368 r = seccomp_rule_add(
1369 seccomp,
1370 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1371 SCMP_SYS(socket),
1372 0);
1373 if (r < 0)
1374 goto finish;
1375
1376 } else {
1377
1378 /* Block everything below the first entry */
1379 r = seccomp_rule_add(
1380 seccomp,
1381 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1382 SCMP_SYS(socket),
1383 1,
1384 SCMP_A0(SCMP_CMP_LT, first));
1385 if (r < 0)
1386 goto finish;
1387
1388 /* Block everything above the last entry */
1389 r = seccomp_rule_add(
1390 seccomp,
1391 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1392 SCMP_SYS(socket),
1393 1,
1394 SCMP_A0(SCMP_CMP_GT, last));
1395 if (r < 0)
1396 goto finish;
1397
1398 /* Block everything between the first and last
1399 * entry */
1400 for (af = 1; af < af_max(); af++) {
1401
1402 if (set_contains(c->address_families, INT_TO_PTR(af)))
1403 continue;
1404
1405 r = seccomp_rule_add(
1406 seccomp,
1407 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1408 SCMP_SYS(socket),
1409 1,
1410 SCMP_A0(SCMP_CMP_EQ, af));
1411 if (r < 0)
1412 goto finish;
1413 }
1414 }
1415
1416 } else {
1417 void *af;
1418
1419 /* If this is a blacklist, then generate one rule for
1420 * each address family that are then combined in OR
1421 * checks. */
1422
1423 SET_FOREACH(af, c->address_families, i) {
1424
1425 r = seccomp_rule_add(
1426 seccomp,
1427 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1428 SCMP_SYS(socket),
1429 1,
1430 SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
1431 if (r < 0)
1432 goto finish;
1433 }
1434 }
1435
1436 r = seccomp_load(seccomp);
1437
1438 finish:
1439 seccomp_release(seccomp);
1440 return r;
1441 }
1442
1443 static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
1444 scmp_filter_ctx seccomp;
1445 int r;
1446
1447 assert(c);
1448
1449 if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1450 return 0;
1451
1452 r = seccomp_init_conservative(&seccomp, SCMP_ACT_ALLOW);
1453 if (r < 0)
1454 return r;
1455
1456 r = seccomp_rule_add(
1457 seccomp,
1458 SCMP_ACT_ERRNO(EPERM),
1459 SCMP_SYS(mmap),
1460 1,
1461 SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC|PROT_WRITE, PROT_EXEC|PROT_WRITE));
1462 if (r < 0)
1463 goto finish;
1464
1465 r = seccomp_rule_add(
1466 seccomp,
1467 SCMP_ACT_ERRNO(EPERM),
1468 SCMP_SYS(mprotect),
1469 1,
1470 SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC, PROT_EXEC));
1471 if (r < 0)
1472 goto finish;
1473
1474 r = seccomp_rule_add(
1475 seccomp,
1476 SCMP_ACT_ERRNO(EPERM),
1477 SCMP_SYS(shmat),
1478 1,
1479 SCMP_A2(SCMP_CMP_MASKED_EQ, SHM_EXEC, SHM_EXEC));
1480 if (r < 0)
1481 goto finish;
1482
1483 r = seccomp_load(seccomp);
1484
1485 finish:
1486 seccomp_release(seccomp);
1487 return r;
1488 }
1489
1490 static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
1491 static const int permitted_policies[] = {
1492 SCHED_OTHER,
1493 SCHED_BATCH,
1494 SCHED_IDLE,
1495 };
1496
1497 scmp_filter_ctx seccomp;
1498 unsigned i;
1499 int r, p, max_policy = 0;
1500
1501 assert(c);
1502
1503 if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1504 return 0;
1505
1506 r = seccomp_init_conservative(&seccomp, SCMP_ACT_ALLOW);
1507 if (r < 0)
1508 return r;
1509
1510 /* Determine the highest policy constant we want to allow */
1511 for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
1512 if (permitted_policies[i] > max_policy)
1513 max_policy = permitted_policies[i];
1514
1515 /* Go through all policies with lower values than that, and block them -- unless they appear in the
1516 * whitelist. */
1517 for (p = 0; p < max_policy; p++) {
1518 bool good = false;
1519
1520 /* Check if this is in the whitelist. */
1521 for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
1522 if (permitted_policies[i] == p) {
1523 good = true;
1524 break;
1525 }
1526
1527 if (good)
1528 continue;
1529
1530 /* Deny this policy */
1531 r = seccomp_rule_add(
1532 seccomp,
1533 SCMP_ACT_ERRNO(EPERM),
1534 SCMP_SYS(sched_setscheduler),
1535 1,
1536 SCMP_A1(SCMP_CMP_EQ, p));
1537 if (r < 0)
1538 goto finish;
1539 }
1540
1541 /* Blacklist all other policies, i.e. the ones with higher values. Note that all comparisons are unsigned here,
1542 * hence no need no check for < 0 values. */
1543 r = seccomp_rule_add(
1544 seccomp,
1545 SCMP_ACT_ERRNO(EPERM),
1546 SCMP_SYS(sched_setscheduler),
1547 1,
1548 SCMP_A1(SCMP_CMP_GT, max_policy));
1549 if (r < 0)
1550 goto finish;
1551
1552 r = seccomp_load(seccomp);
1553
1554 finish:
1555 seccomp_release(seccomp);
1556 return r;
1557 }
1558
1559 static int apply_protect_sysctl(const Unit *u, const ExecContext *c) {
1560 scmp_filter_ctx seccomp;
1561 int r;
1562
1563 assert(c);
1564
1565 /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1566 * let's protect even those systems where this is left on in the kernel. */
1567
1568 if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1569 return 0;
1570
1571 r = seccomp_init_conservative(&seccomp, SCMP_ACT_ALLOW);
1572 if (r < 0)
1573 return r;
1574
1575 r = seccomp_rule_add(
1576 seccomp,
1577 SCMP_ACT_ERRNO(EPERM),
1578 SCMP_SYS(_sysctl),
1579 0);
1580 if (r < 0)
1581 goto finish;
1582
1583 r = seccomp_load(seccomp);
1584
1585 finish:
1586 seccomp_release(seccomp);
1587 return r;
1588 }
1589
1590 static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
1591 assert(c);
1592
1593 /* Turn off module syscalls on ProtectKernelModules=yes */
1594
1595 if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
1596 return 0;
1597
1598 return seccomp_load_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM));
1599 }
1600
1601 static int apply_private_devices(const Unit *u, const ExecContext *c) {
1602 assert(c);
1603
1604 /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */
1605
1606 if (skip_seccomp_unavailable(u, "PrivateDevices="))
1607 return 0;
1608
1609 return seccomp_load_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM));
1610 }
1611
1612 static int apply_restrict_namespaces(Unit *u, const ExecContext *c) {
1613 assert(c);
1614
1615 if (!exec_context_restrict_namespaces_set(c))
1616 return 0;
1617
1618 if (skip_seccomp_unavailable(u, "RestrictNamespaces="))
1619 return 0;
1620
1621 return seccomp_restrict_namespaces(c->restrict_namespaces);
1622 }
1623
1624 #endif
1625
1626 static void do_idle_pipe_dance(int idle_pipe[4]) {
1627 assert(idle_pipe);
1628
1629 idle_pipe[1] = safe_close(idle_pipe[1]);
1630 idle_pipe[2] = safe_close(idle_pipe[2]);
1631
1632 if (idle_pipe[0] >= 0) {
1633 int r;
1634
1635 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1636
1637 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1638 ssize_t n;
1639
1640 /* Signal systemd that we are bored and want to continue. */
1641 n = write(idle_pipe[3], "x", 1);
1642 if (n > 0)
1643 /* Wait for systemd to react to the signal above. */
1644 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1645 }
1646
1647 idle_pipe[0] = safe_close(idle_pipe[0]);
1648
1649 }
1650
1651 idle_pipe[3] = safe_close(idle_pipe[3]);
1652 }
1653
1654 static int build_environment(
1655 Unit *u,
1656 const ExecContext *c,
1657 const ExecParameters *p,
1658 unsigned n_fds,
1659 const char *home,
1660 const char *username,
1661 const char *shell,
1662 dev_t journal_stream_dev,
1663 ino_t journal_stream_ino,
1664 char ***ret) {
1665
1666 _cleanup_strv_free_ char **our_env = NULL;
1667 unsigned n_env = 0;
1668 char *x;
1669
1670 assert(u);
1671 assert(c);
1672 assert(ret);
1673
1674 our_env = new0(char*, 14);
1675 if (!our_env)
1676 return -ENOMEM;
1677
1678 if (n_fds > 0) {
1679 _cleanup_free_ char *joined = NULL;
1680
1681 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
1682 return -ENOMEM;
1683 our_env[n_env++] = x;
1684
1685 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1686 return -ENOMEM;
1687 our_env[n_env++] = x;
1688
1689 joined = strv_join(p->fd_names, ":");
1690 if (!joined)
1691 return -ENOMEM;
1692
1693 x = strjoin("LISTEN_FDNAMES=", joined);
1694 if (!x)
1695 return -ENOMEM;
1696 our_env[n_env++] = x;
1697 }
1698
1699 if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
1700 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
1701 return -ENOMEM;
1702 our_env[n_env++] = x;
1703
1704 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1705 return -ENOMEM;
1706 our_env[n_env++] = x;
1707 }
1708
1709 /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use D-Bus look up dynamic
1710 * users via PID 1, possibly dead-locking the dbus daemon. This way it will not use D-Bus to resolve names, but
1711 * check the database directly. */
1712 if (unit_has_name(u, SPECIAL_DBUS_SERVICE)) {
1713 x = strdup("SYSTEMD_NSS_BYPASS_BUS=1");
1714 if (!x)
1715 return -ENOMEM;
1716 our_env[n_env++] = x;
1717 }
1718
1719 if (home) {
1720 x = strappend("HOME=", home);
1721 if (!x)
1722 return -ENOMEM;
1723 our_env[n_env++] = x;
1724 }
1725
1726 if (username) {
1727 x = strappend("LOGNAME=", username);
1728 if (!x)
1729 return -ENOMEM;
1730 our_env[n_env++] = x;
1731
1732 x = strappend("USER=", username);
1733 if (!x)
1734 return -ENOMEM;
1735 our_env[n_env++] = x;
1736 }
1737
1738 if (shell) {
1739 x = strappend("SHELL=", shell);
1740 if (!x)
1741 return -ENOMEM;
1742 our_env[n_env++] = x;
1743 }
1744
1745 if (!sd_id128_is_null(u->invocation_id)) {
1746 if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0)
1747 return -ENOMEM;
1748
1749 our_env[n_env++] = x;
1750 }
1751
1752 if (exec_context_needs_term(c)) {
1753 const char *tty_path, *term = NULL;
1754
1755 tty_path = exec_context_tty_path(c);
1756
1757 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try to inherit
1758 * the $TERM set for PID 1. This is useful for containers so that the $TERM the container manager
1759 * passes to PID 1 ends up all the way in the console login shown. */
1760
1761 if (path_equal(tty_path, "/dev/console") && getppid() == 1)
1762 term = getenv("TERM");
1763 if (!term)
1764 term = default_term_for_tty(tty_path);
1765
1766 x = strappend("TERM=", term);
1767 if (!x)
1768 return -ENOMEM;
1769 our_env[n_env++] = x;
1770 }
1771
1772 if (journal_stream_dev != 0 && journal_stream_ino != 0) {
1773 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
1774 return -ENOMEM;
1775
1776 our_env[n_env++] = x;
1777 }
1778
1779 our_env[n_env++] = NULL;
1780 assert(n_env <= 12);
1781
1782 *ret = our_env;
1783 our_env = NULL;
1784
1785 return 0;
1786 }
1787
1788 static int build_pass_environment(const ExecContext *c, char ***ret) {
1789 _cleanup_strv_free_ char **pass_env = NULL;
1790 size_t n_env = 0, n_bufsize = 0;
1791 char **i;
1792
1793 STRV_FOREACH(i, c->pass_environment) {
1794 _cleanup_free_ char *x = NULL;
1795 char *v;
1796
1797 v = getenv(*i);
1798 if (!v)
1799 continue;
1800 x = strjoin(*i, "=", v);
1801 if (!x)
1802 return -ENOMEM;
1803 if (!GREEDY_REALLOC(pass_env, n_bufsize, n_env + 2))
1804 return -ENOMEM;
1805 pass_env[n_env++] = x;
1806 pass_env[n_env] = NULL;
1807 x = NULL;
1808 }
1809
1810 *ret = pass_env;
1811 pass_env = NULL;
1812
1813 return 0;
1814 }
1815
1816 static bool exec_needs_mount_namespace(
1817 const ExecContext *context,
1818 const ExecParameters *params,
1819 ExecRuntime *runtime) {
1820
1821 assert(context);
1822 assert(params);
1823
1824 if (!strv_isempty(context->read_write_paths) ||
1825 !strv_isempty(context->read_only_paths) ||
1826 !strv_isempty(context->inaccessible_paths))
1827 return true;
1828
1829 if (context->n_bind_mounts > 0)
1830 return true;
1831
1832 if (context->mount_flags != 0)
1833 return true;
1834
1835 if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
1836 return true;
1837
1838 if (context->private_devices ||
1839 context->protect_system != PROTECT_SYSTEM_NO ||
1840 context->protect_home != PROTECT_HOME_NO ||
1841 context->protect_kernel_tunables ||
1842 context->protect_kernel_modules ||
1843 context->protect_control_groups)
1844 return true;
1845
1846 return false;
1847 }
1848
1849 static int setup_private_users(uid_t uid, gid_t gid) {
1850 _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
1851 _cleanup_close_pair_ int errno_pipe[2] = { -1, -1 };
1852 _cleanup_close_ int unshare_ready_fd = -1;
1853 _cleanup_(sigkill_waitp) pid_t pid = 0;
1854 uint64_t c = 1;
1855 siginfo_t si;
1856 ssize_t n;
1857 int r;
1858
1859 /* Set up a user namespace and map root to root, the selected UID/GID to itself, and everything else to
1860 * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
1861 * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
1862 * which waits for the parent to create the new user namespace while staying in the original namespace. The
1863 * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
1864 * continues execution normally. */
1865
1866 if (uid != 0 && uid_is_valid(uid))
1867 asprintf(&uid_map,
1868 "0 0 1\n" /* Map root → root */
1869 UID_FMT " " UID_FMT " 1\n", /* Map $UID → $UID */
1870 uid, uid);
1871 else
1872 uid_map = strdup("0 0 1\n"); /* The case where the above is the same */
1873 if (!uid_map)
1874 return -ENOMEM;
1875
1876 if (gid != 0 && gid_is_valid(gid))
1877 asprintf(&gid_map,
1878 "0 0 1\n" /* Map root → root */
1879 GID_FMT " " GID_FMT " 1\n", /* Map $GID → $GID */
1880 gid, gid);
1881 else
1882 gid_map = strdup("0 0 1\n"); /* The case where the above is the same */
1883 if (!gid_map)
1884 return -ENOMEM;
1885
1886 /* Create a communication channel so that the parent can tell the child when it finished creating the user
1887 * namespace. */
1888 unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
1889 if (unshare_ready_fd < 0)
1890 return -errno;
1891
1892 /* Create a communication channel so that the child can tell the parent a proper error code in case it
1893 * failed. */
1894 if (pipe2(errno_pipe, O_CLOEXEC) < 0)
1895 return -errno;
1896
1897 pid = fork();
1898 if (pid < 0)
1899 return -errno;
1900
1901 if (pid == 0) {
1902 _cleanup_close_ int fd = -1;
1903 const char *a;
1904 pid_t ppid;
1905
1906 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
1907 * here, after the parent opened its own user namespace. */
1908
1909 ppid = getppid();
1910 errno_pipe[0] = safe_close(errno_pipe[0]);
1911
1912 /* Wait until the parent unshared the user namespace */
1913 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
1914 r = -errno;
1915 goto child_fail;
1916 }
1917
1918 /* Disable the setgroups() system call in the child user namespace, for good. */
1919 a = procfs_file_alloca(ppid, "setgroups");
1920 fd = open(a, O_WRONLY|O_CLOEXEC);
1921 if (fd < 0) {
1922 if (errno != ENOENT) {
1923 r = -errno;
1924 goto child_fail;
1925 }
1926
1927 /* If the file is missing the kernel is too old, let's continue anyway. */
1928 } else {
1929 if (write(fd, "deny\n", 5) < 0) {
1930 r = -errno;
1931 goto child_fail;
1932 }
1933
1934 fd = safe_close(fd);
1935 }
1936
1937 /* First write the GID map */
1938 a = procfs_file_alloca(ppid, "gid_map");
1939 fd = open(a, O_WRONLY|O_CLOEXEC);
1940 if (fd < 0) {
1941 r = -errno;
1942 goto child_fail;
1943 }
1944 if (write(fd, gid_map, strlen(gid_map)) < 0) {
1945 r = -errno;
1946 goto child_fail;
1947 }
1948 fd = safe_close(fd);
1949
1950 /* The write the UID map */
1951 a = procfs_file_alloca(ppid, "uid_map");
1952 fd = open(a, O_WRONLY|O_CLOEXEC);
1953 if (fd < 0) {
1954 r = -errno;
1955 goto child_fail;
1956 }
1957 if (write(fd, uid_map, strlen(uid_map)) < 0) {
1958 r = -errno;
1959 goto child_fail;
1960 }
1961
1962 _exit(EXIT_SUCCESS);
1963
1964 child_fail:
1965 (void) write(errno_pipe[1], &r, sizeof(r));
1966 _exit(EXIT_FAILURE);
1967 }
1968
1969 errno_pipe[1] = safe_close(errno_pipe[1]);
1970
1971 if (unshare(CLONE_NEWUSER) < 0)
1972 return -errno;
1973
1974 /* Let the child know that the namespace is ready now */
1975 if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
1976 return -errno;
1977
1978 /* Try to read an error code from the child */
1979 n = read(errno_pipe[0], &r, sizeof(r));
1980 if (n < 0)
1981 return -errno;
1982 if (n == sizeof(r)) { /* an error code was sent to us */
1983 if (r < 0)
1984 return r;
1985 return -EIO;
1986 }
1987 if (n != 0) /* on success we should have read 0 bytes */
1988 return -EIO;
1989
1990 r = wait_for_terminate(pid, &si);
1991 if (r < 0)
1992 return r;
1993 pid = 0;
1994
1995 /* If something strange happened with the child, let's consider this fatal, too */
1996 if (si.si_code != CLD_EXITED || si.si_status != 0)
1997 return -EIO;
1998
1999 return 0;
2000 }
2001
2002 static int setup_runtime_directory(
2003 const ExecContext *context,
2004 const ExecParameters *params,
2005 uid_t uid,
2006 gid_t gid) {
2007
2008 char **rt;
2009 int r;
2010
2011 assert(context);
2012 assert(params);
2013
2014 STRV_FOREACH(rt, context->runtime_directory) {
2015 _cleanup_free_ char *p;
2016
2017 p = strjoin(params->runtime_prefix, "/", *rt);
2018 if (!p)
2019 return -ENOMEM;
2020
2021 r = mkdir_p_label(p, context->runtime_directory_mode);
2022 if (r < 0)
2023 return r;
2024
2025 r = chmod_and_chown(p, context->runtime_directory_mode, uid, gid);
2026 if (r < 0)
2027 return r;
2028 }
2029
2030 return 0;
2031 }
2032
2033 static int setup_smack(
2034 const ExecContext *context,
2035 const ExecCommand *command) {
2036
2037 #ifdef HAVE_SMACK
2038 int r;
2039
2040 assert(context);
2041 assert(command);
2042
2043 if (!mac_smack_use())
2044 return 0;
2045
2046 if (context->smack_process_label) {
2047 r = mac_smack_apply_pid(0, context->smack_process_label);
2048 if (r < 0)
2049 return r;
2050 }
2051 #ifdef SMACK_DEFAULT_PROCESS_LABEL
2052 else {
2053 _cleanup_free_ char *exec_label = NULL;
2054
2055 r = mac_smack_read(command->path, SMACK_ATTR_EXEC, &exec_label);
2056 if (r < 0 && r != -ENODATA && r != -EOPNOTSUPP)
2057 return r;
2058
2059 r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
2060 if (r < 0)
2061 return r;
2062 }
2063 #endif
2064 #endif
2065
2066 return 0;
2067 }
2068
2069 static int compile_read_write_paths(
2070 const ExecContext *context,
2071 const ExecParameters *params,
2072 char ***ret) {
2073
2074 _cleanup_strv_free_ char **l = NULL;
2075 char **rt;
2076
2077 /* Compile the list of writable paths. This is the combination of the explicitly configured paths, plus all
2078 * runtime directories. */
2079
2080 if (strv_isempty(context->read_write_paths) &&
2081 strv_isempty(context->runtime_directory)) {
2082 *ret = NULL; /* NOP if neither is set */
2083 return 0;
2084 }
2085
2086 l = strv_copy(context->read_write_paths);
2087 if (!l)
2088 return -ENOMEM;
2089
2090 STRV_FOREACH(rt, context->runtime_directory) {
2091 char *s;
2092
2093 s = strjoin(params->runtime_prefix, "/", *rt);
2094 if (!s)
2095 return -ENOMEM;
2096
2097 if (strv_consume(&l, s) < 0)
2098 return -ENOMEM;
2099 }
2100
2101 *ret = l;
2102 l = NULL;
2103
2104 return 0;
2105 }
2106
2107 static int apply_mount_namespace(Unit *u, const ExecContext *context,
2108 const ExecParameters *params,
2109 ExecRuntime *runtime) {
2110 int r;
2111 _cleanup_free_ char **rw = NULL;
2112 char *tmp = NULL, *var = NULL;
2113 const char *root_dir = NULL;
2114 NameSpaceInfo ns_info = {
2115 .ignore_protect_paths = false,
2116 .private_dev = context->private_devices,
2117 .protect_control_groups = context->protect_control_groups,
2118 .protect_kernel_tunables = context->protect_kernel_tunables,
2119 .protect_kernel_modules = context->protect_kernel_modules,
2120 };
2121
2122 assert(context);
2123
2124 /* The runtime struct only contains the parent of the private /tmp,
2125 * which is non-accessible to world users. Inside of it there's a /tmp
2126 * that is sticky, and that's the one we want to use here. */
2127
2128 if (context->private_tmp && runtime) {
2129 if (runtime->tmp_dir)
2130 tmp = strjoina(runtime->tmp_dir, "/tmp");
2131 if (runtime->var_tmp_dir)
2132 var = strjoina(runtime->var_tmp_dir, "/tmp");
2133 }
2134
2135 r = compile_read_write_paths(context, params, &rw);
2136 if (r < 0)
2137 return r;
2138
2139 if (params->flags & EXEC_APPLY_CHROOT)
2140 root_dir = context->root_directory;
2141
2142 /*
2143 * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed
2144 * sandbox info, otherwise enforce it, don't ignore protected paths and
2145 * fail if we are enable to apply the sandbox inside the mount namespace.
2146 */
2147 if (!context->dynamic_user && root_dir)
2148 ns_info.ignore_protect_paths = true;
2149
2150 r = setup_namespace(root_dir, &ns_info, rw,
2151 context->read_only_paths,
2152 context->inaccessible_paths,
2153 context->bind_mounts,
2154 context->n_bind_mounts,
2155 tmp,
2156 var,
2157 context->protect_home,
2158 context->protect_system,
2159 context->mount_flags);
2160
2161 /* If we couldn't set up the namespace this is probably due to a
2162 * missing capability. In this case, silently proceeed. */
2163 if (IN_SET(r, -EPERM, -EACCES)) {
2164 log_open();
2165 log_unit_debug_errno(u, r, "Failed to set up namespace, assuming containerized execution, ignoring: %m");
2166 log_close();
2167 r = 0;
2168 }
2169
2170 return r;
2171 }
2172
2173 static int apply_working_directory(const ExecContext *context,
2174 const ExecParameters *params,
2175 const char *home,
2176 const bool needs_mount_ns) {
2177 const char *d;
2178 const char *wd;
2179
2180 assert(context);
2181
2182 if (context->working_directory_home)
2183 wd = home;
2184 else if (context->working_directory)
2185 wd = context->working_directory;
2186 else
2187 wd = "/";
2188
2189 if (params->flags & EXEC_APPLY_CHROOT) {
2190 if (!needs_mount_ns && context->root_directory)
2191 if (chroot(context->root_directory) < 0)
2192 return -errno;
2193
2194 d = wd;
2195 } else
2196 d = strjoina(strempty(context->root_directory), "/", strempty(wd));
2197
2198 if (chdir(d) < 0 && !context->working_directory_missing_ok)
2199 return -errno;
2200
2201 return 0;
2202 }
2203
2204 static int setup_keyring(Unit *u, const ExecParameters *p, uid_t uid, gid_t gid) {
2205 key_serial_t keyring;
2206
2207 assert(u);
2208 assert(p);
2209
2210 /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that
2211 * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond
2212 * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be
2213 * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in
2214 * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where
2215 * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */
2216
2217 if (!(p->flags & EXEC_NEW_KEYRING))
2218 return 0;
2219
2220 keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2221 if (keyring == -1) {
2222 if (errno == ENOSYS)
2223 log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
2224 else if (IN_SET(errno, EACCES, EPERM))
2225 log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2226 else if (errno == EDQUOT)
2227 log_debug_errno(errno, "Out of kernel keyrings to allocate, ignoring.");
2228 else
2229 return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2230
2231 return 0;
2232 }
2233
2234 /* Populate they keyring with the invocation ID by default. */
2235 if (!sd_id128_is_null(u->invocation_id)) {
2236 key_serial_t key;
2237
2238 key = add_key("user", "invocation_id", &u->invocation_id, sizeof(u->invocation_id), KEY_SPEC_SESSION_KEYRING);
2239 if (key == -1)
2240 log_debug_errno(errno, "Failed to add invocation ID to keyring, ignoring: %m");
2241 else {
2242 if (keyctl(KEYCTL_SETPERM, key,
2243 KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH|
2244 KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0)
2245 return log_error_errno(errno, "Failed to restrict invocation ID permission: %m");
2246 }
2247 }
2248
2249 /* And now, make the keyring owned by the service's user */
2250 if (uid_is_valid(uid) || gid_is_valid(gid))
2251 if (keyctl(KEYCTL_CHOWN, keyring, uid, gid, 0) < 0)
2252 return log_error_errno(errno, "Failed to change ownership of session keyring: %m");
2253
2254 return 0;
2255 }
2256
2257 static void append_socket_pair(int *array, unsigned *n, int pair[2]) {
2258 assert(array);
2259 assert(n);
2260
2261 if (!pair)
2262 return;
2263
2264 if (pair[0] >= 0)
2265 array[(*n)++] = pair[0];
2266 if (pair[1] >= 0)
2267 array[(*n)++] = pair[1];
2268 }
2269
2270 static int close_remaining_fds(
2271 const ExecParameters *params,
2272 ExecRuntime *runtime,
2273 DynamicCreds *dcreds,
2274 int user_lookup_fd,
2275 int socket_fd,
2276 int *fds, unsigned n_fds) {
2277
2278 unsigned n_dont_close = 0;
2279 int dont_close[n_fds + 12];
2280
2281 assert(params);
2282
2283 if (params->stdin_fd >= 0)
2284 dont_close[n_dont_close++] = params->stdin_fd;
2285 if (params->stdout_fd >= 0)
2286 dont_close[n_dont_close++] = params->stdout_fd;
2287 if (params->stderr_fd >= 0)
2288 dont_close[n_dont_close++] = params->stderr_fd;
2289
2290 if (socket_fd >= 0)
2291 dont_close[n_dont_close++] = socket_fd;
2292 if (n_fds > 0) {
2293 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
2294 n_dont_close += n_fds;
2295 }
2296
2297 if (runtime)
2298 append_socket_pair(dont_close, &n_dont_close, runtime->netns_storage_socket);
2299
2300 if (dcreds) {
2301 if (dcreds->user)
2302 append_socket_pair(dont_close, &n_dont_close, dcreds->user->storage_socket);
2303 if (dcreds->group)
2304 append_socket_pair(dont_close, &n_dont_close, dcreds->group->storage_socket);
2305 }
2306
2307 if (user_lookup_fd >= 0)
2308 dont_close[n_dont_close++] = user_lookup_fd;
2309
2310 return close_all_fds(dont_close, n_dont_close);
2311 }
2312
2313 static bool context_has_address_families(const ExecContext *c) {
2314 assert(c);
2315
2316 return c->address_families_whitelist ||
2317 !set_isempty(c->address_families);
2318 }
2319
2320 static bool context_has_syscall_filters(const ExecContext *c) {
2321 assert(c);
2322
2323 return c->syscall_whitelist ||
2324 !set_isempty(c->syscall_filter) ||
2325 !set_isempty(c->syscall_archs);
2326 }
2327
2328 static bool context_has_no_new_privileges(const ExecContext *c) {
2329 assert(c);
2330
2331 if (c->no_new_privileges)
2332 return true;
2333
2334 if (have_effective_cap(CAP_SYS_ADMIN)) /* if we are privileged, we don't need NNP */
2335 return false;
2336
2337 /* We need NNP if we have any form of seccomp and are unprivileged */
2338 return context_has_address_families(c) ||
2339 c->memory_deny_write_execute ||
2340 c->restrict_realtime ||
2341 exec_context_restrict_namespaces_set(c) ||
2342 c->protect_kernel_tunables ||
2343 c->protect_kernel_modules ||
2344 c->private_devices ||
2345 context_has_syscall_filters(c);
2346 }
2347
2348 static int send_user_lookup(
2349 Unit *unit,
2350 int user_lookup_fd,
2351 uid_t uid,
2352 gid_t gid) {
2353
2354 assert(unit);
2355
2356 /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
2357 * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
2358 * specified. */
2359
2360 if (user_lookup_fd < 0)
2361 return 0;
2362
2363 if (!uid_is_valid(uid) && !gid_is_valid(gid))
2364 return 0;
2365
2366 if (writev(user_lookup_fd,
2367 (struct iovec[]) {
2368 { .iov_base = &uid, .iov_len = sizeof(uid) },
2369 { .iov_base = &gid, .iov_len = sizeof(gid) },
2370 { .iov_base = unit->id, .iov_len = strlen(unit->id) }}, 3) < 0)
2371 return -errno;
2372
2373 return 0;
2374 }
2375
2376 static int exec_child(
2377 Unit *unit,
2378 ExecCommand *command,
2379 const ExecContext *context,
2380 const ExecParameters *params,
2381 ExecRuntime *runtime,
2382 DynamicCreds *dcreds,
2383 char **argv,
2384 int socket_fd,
2385 int named_iofds[3],
2386 int *fds, unsigned n_fds,
2387 char **files_env,
2388 int user_lookup_fd,
2389 int *exit_status) {
2390
2391 _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **accum_env = NULL, **final_argv = NULL;
2392 _cleanup_free_ char *mac_selinux_context_net = NULL;
2393 _cleanup_free_ gid_t *supplementary_gids = NULL;
2394 const char *username = NULL, *groupname = NULL;
2395 const char *home = NULL, *shell = NULL;
2396 dev_t journal_stream_dev = 0;
2397 ino_t journal_stream_ino = 0;
2398 bool needs_mount_namespace;
2399 uid_t uid = UID_INVALID;
2400 gid_t gid = GID_INVALID;
2401 int i, r, ngids = 0;
2402
2403 assert(unit);
2404 assert(command);
2405 assert(context);
2406 assert(params);
2407 assert(exit_status);
2408
2409 rename_process_from_path(command->path);
2410
2411 /* We reset exactly these signals, since they are the
2412 * only ones we set to SIG_IGN in the main daemon. All
2413 * others we leave untouched because we set them to
2414 * SIG_DFL or a valid handler initially, both of which
2415 * will be demoted to SIG_DFL. */
2416 (void) default_signals(SIGNALS_CRASH_HANDLER,
2417 SIGNALS_IGNORE, -1);
2418
2419 if (context->ignore_sigpipe)
2420 (void) ignore_signals(SIGPIPE, -1);
2421
2422 r = reset_signal_mask();
2423 if (r < 0) {
2424 *exit_status = EXIT_SIGNAL_MASK;
2425 return r;
2426 }
2427
2428 if (params->idle_pipe)
2429 do_idle_pipe_dance(params->idle_pipe);
2430
2431 /* Close sockets very early to make sure we don't
2432 * block init reexecution because it cannot bind its
2433 * sockets */
2434
2435 log_forget_fds();
2436
2437 r = close_remaining_fds(params, runtime, dcreds, user_lookup_fd, socket_fd, fds, n_fds);
2438 if (r < 0) {
2439 *exit_status = EXIT_FDS;
2440 return r;
2441 }
2442
2443 if (!context->same_pgrp)
2444 if (setsid() < 0) {
2445 *exit_status = EXIT_SETSID;
2446 return -errno;
2447 }
2448
2449 exec_context_tty_reset(context, params);
2450
2451 if (unit_shall_confirm_spawn(unit)) {
2452 const char *vc = params->confirm_spawn;
2453 _cleanup_free_ char *cmdline = NULL;
2454
2455 cmdline = exec_command_line(argv);
2456 if (!cmdline) {
2457 *exit_status = EXIT_CONFIRM;
2458 return -ENOMEM;
2459 }
2460
2461 r = ask_for_confirmation(vc, unit, cmdline);
2462 if (r != CONFIRM_EXECUTE) {
2463 if (r == CONFIRM_PRETEND_SUCCESS) {
2464 *exit_status = EXIT_SUCCESS;
2465 return 0;
2466 }
2467 *exit_status = EXIT_CONFIRM;
2468 return -ECANCELED;
2469 }
2470 }
2471
2472 if (context->dynamic_user && dcreds) {
2473
2474 /* Make sure we bypass our own NSS module for any NSS checks */
2475 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
2476 *exit_status = EXIT_USER;
2477 return -errno;
2478 }
2479
2480 r = dynamic_creds_realize(dcreds, &uid, &gid);
2481 if (r < 0) {
2482 *exit_status = EXIT_USER;
2483 return r;
2484 }
2485
2486 if (!uid_is_valid(uid) || !gid_is_valid(gid)) {
2487 *exit_status = EXIT_USER;
2488 return -ESRCH;
2489 }
2490
2491 if (dcreds->user)
2492 username = dcreds->user->name;
2493
2494 } else {
2495 r = get_fixed_user(context, &username, &uid, &gid, &home, &shell);
2496 if (r < 0) {
2497 *exit_status = EXIT_USER;
2498 return r;
2499 }
2500
2501 r = get_fixed_group(context, &groupname, &gid);
2502 if (r < 0) {
2503 *exit_status = EXIT_GROUP;
2504 return r;
2505 }
2506 }
2507
2508 /* Initialize user supplementary groups and get SupplementaryGroups= ones */
2509 r = get_supplementary_groups(context, username, groupname, gid,
2510 &supplementary_gids, &ngids);
2511 if (r < 0) {
2512 *exit_status = EXIT_GROUP;
2513 return r;
2514 }
2515
2516 r = send_user_lookup(unit, user_lookup_fd, uid, gid);
2517 if (r < 0) {
2518 *exit_status = EXIT_USER;
2519 return r;
2520 }
2521
2522 user_lookup_fd = safe_close(user_lookup_fd);
2523
2524 /* If a socket is connected to STDIN/STDOUT/STDERR, we
2525 * must sure to drop O_NONBLOCK */
2526 if (socket_fd >= 0)
2527 (void) fd_nonblock(socket_fd, false);
2528
2529 r = setup_input(context, params, socket_fd, named_iofds);
2530 if (r < 0) {
2531 *exit_status = EXIT_STDIN;
2532 return r;
2533 }
2534
2535 r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
2536 if (r < 0) {
2537 *exit_status = EXIT_STDOUT;
2538 return r;
2539 }
2540
2541 r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
2542 if (r < 0) {
2543 *exit_status = EXIT_STDERR;
2544 return r;
2545 }
2546
2547 if (params->cgroup_path) {
2548 r = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0, NULL, NULL);
2549 if (r < 0) {
2550 *exit_status = EXIT_CGROUP;
2551 return r;
2552 }
2553 }
2554
2555 if (context->oom_score_adjust_set) {
2556 char t[DECIMAL_STR_MAX(context->oom_score_adjust)];
2557
2558 /* When we can't make this change due to EPERM, then
2559 * let's silently skip over it. User namespaces
2560 * prohibit write access to this file, and we
2561 * shouldn't trip up over that. */
2562
2563 sprintf(t, "%i", context->oom_score_adjust);
2564 r = write_string_file("/proc/self/oom_score_adj", t, 0);
2565 if (r == -EPERM || r == -EACCES) {
2566 log_open();
2567 log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
2568 log_close();
2569 } else if (r < 0) {
2570 *exit_status = EXIT_OOM_ADJUST;
2571 return -errno;
2572 }
2573 }
2574
2575 if (context->nice_set)
2576 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
2577 *exit_status = EXIT_NICE;
2578 return -errno;
2579 }
2580
2581 if (context->cpu_sched_set) {
2582 struct sched_param param = {
2583 .sched_priority = context->cpu_sched_priority,
2584 };
2585
2586 r = sched_setscheduler(0,
2587 context->cpu_sched_policy |
2588 (context->cpu_sched_reset_on_fork ?
2589 SCHED_RESET_ON_FORK : 0),
2590 &param);
2591 if (r < 0) {
2592 *exit_status = EXIT_SETSCHEDULER;
2593 return -errno;
2594 }
2595 }
2596
2597 if (context->cpuset)
2598 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
2599 *exit_status = EXIT_CPUAFFINITY;
2600 return -errno;
2601 }
2602
2603 if (context->ioprio_set)
2604 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
2605 *exit_status = EXIT_IOPRIO;
2606 return -errno;
2607 }
2608
2609 if (context->timer_slack_nsec != NSEC_INFINITY)
2610 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
2611 *exit_status = EXIT_TIMERSLACK;
2612 return -errno;
2613 }
2614
2615 if (context->personality != PERSONALITY_INVALID)
2616 if (personality(context->personality) < 0) {
2617 *exit_status = EXIT_PERSONALITY;
2618 return -errno;
2619 }
2620
2621 if (context->utmp_id)
2622 utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path,
2623 context->utmp_mode == EXEC_UTMP_INIT ? INIT_PROCESS :
2624 context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
2625 USER_PROCESS,
2626 username ? "root" : context->user);
2627
2628 if (context->user) {
2629 r = chown_terminal(STDIN_FILENO, uid);
2630 if (r < 0) {
2631 *exit_status = EXIT_STDIN;
2632 return r;
2633 }
2634 }
2635
2636 /* If delegation is enabled we'll pass ownership of the cgroup
2637 * (but only in systemd's own controller hierarchy!) to the
2638 * user of the new process. */
2639 if (params->cgroup_path && context->user && params->cgroup_delegate) {
2640 r = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
2641 if (r < 0) {
2642 *exit_status = EXIT_CGROUP;
2643 return r;
2644 }
2645
2646
2647 r = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
2648 if (r < 0) {
2649 *exit_status = EXIT_CGROUP;
2650 return r;
2651 }
2652 }
2653
2654 if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
2655 r = setup_runtime_directory(context, params, uid, gid);
2656 if (r < 0) {
2657 *exit_status = EXIT_RUNTIME_DIRECTORY;
2658 return r;
2659 }
2660 }
2661
2662 r = build_environment(
2663 unit,
2664 context,
2665 params,
2666 n_fds,
2667 home,
2668 username,
2669 shell,
2670 journal_stream_dev,
2671 journal_stream_ino,
2672 &our_env);
2673 if (r < 0) {
2674 *exit_status = EXIT_MEMORY;
2675 return r;
2676 }
2677
2678 r = build_pass_environment(context, &pass_env);
2679 if (r < 0) {
2680 *exit_status = EXIT_MEMORY;
2681 return r;
2682 }
2683
2684 accum_env = strv_env_merge(5,
2685 params->environment,
2686 our_env,
2687 pass_env,
2688 context->environment,
2689 files_env,
2690 NULL);
2691 if (!accum_env) {
2692 *exit_status = EXIT_MEMORY;
2693 return -ENOMEM;
2694 }
2695 accum_env = strv_env_clean(accum_env);
2696
2697 (void) umask(context->umask);
2698
2699 r = setup_keyring(unit, params, uid, gid);
2700 if (r < 0) {
2701 *exit_status = EXIT_KEYRING;
2702 return r;
2703 }
2704
2705 if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2706 if (context->pam_name && username) {
2707 r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
2708 if (r < 0) {
2709 *exit_status = EXIT_PAM;
2710 return r;
2711 }
2712 }
2713 }
2714
2715 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
2716 r = setup_netns(runtime->netns_storage_socket);
2717 if (r < 0) {
2718 *exit_status = EXIT_NETWORK;
2719 return r;
2720 }
2721 }
2722
2723 needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
2724 if (needs_mount_namespace) {
2725 r = apply_mount_namespace(unit, context, params, runtime);
2726 if (r < 0) {
2727 *exit_status = EXIT_NAMESPACE;
2728 return r;
2729 }
2730 }
2731
2732 /* Apply just after mount namespace setup */
2733 r = apply_working_directory(context, params, home, needs_mount_namespace);
2734 if (r < 0) {
2735 *exit_status = EXIT_CHROOT;
2736 return r;
2737 }
2738
2739 /* Drop groups as early as possbile */
2740 if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2741 r = enforce_groups(context, gid, supplementary_gids, ngids);
2742 if (r < 0) {
2743 *exit_status = EXIT_GROUP;
2744 return r;
2745 }
2746 }
2747
2748 #ifdef HAVE_SELINUX
2749 if ((params->flags & EXEC_APPLY_PERMISSIONS) &&
2750 mac_selinux_use() &&
2751 params->selinux_context_net &&
2752 socket_fd >= 0 &&
2753 !command->privileged) {
2754
2755 r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
2756 if (r < 0) {
2757 *exit_status = EXIT_SELINUX_CONTEXT;
2758 return r;
2759 }
2760 }
2761 #endif
2762
2763 if ((params->flags & EXEC_APPLY_PERMISSIONS) && context->private_users) {
2764 r = setup_private_users(uid, gid);
2765 if (r < 0) {
2766 *exit_status = EXIT_USER;
2767 return r;
2768 }
2769 }
2770
2771 /* We repeat the fd closing here, to make sure that
2772 * nothing is leaked from the PAM modules. Note that
2773 * we are more aggressive this time since socket_fd
2774 * and the netns fds we don't need anymore. The custom
2775 * endpoint fd was needed to upload the policy and can
2776 * now be closed as well. */
2777 r = close_all_fds(fds, n_fds);
2778 if (r >= 0)
2779 r = shift_fds(fds, n_fds);
2780 if (r >= 0)
2781 r = flags_fds(fds, n_fds, context->non_blocking);
2782 if (r < 0) {
2783 *exit_status = EXIT_FDS;
2784 return r;
2785 }
2786
2787 if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2788
2789 int secure_bits = context->secure_bits;
2790
2791 for (i = 0; i < _RLIMIT_MAX; i++) {
2792
2793 if (!context->rlimit[i])
2794 continue;
2795
2796 r = setrlimit_closest(i, context->rlimit[i]);
2797 if (r < 0) {
2798 *exit_status = EXIT_LIMITS;
2799 return r;
2800 }
2801 }
2802
2803 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. */
2804 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
2805 if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
2806 *exit_status = EXIT_LIMITS;
2807 return -errno;
2808 }
2809 }
2810
2811 if (!cap_test_all(context->capability_bounding_set)) {
2812 r = capability_bounding_set_drop(context->capability_bounding_set, false);
2813 if (r < 0) {
2814 *exit_status = EXIT_CAPABILITIES;
2815 return r;
2816 }
2817 }
2818
2819 /* This is done before enforce_user, but ambient set
2820 * does not survive over setresuid() if keep_caps is not set. */
2821 if (context->capability_ambient_set != 0) {
2822 r = capability_ambient_set_apply(context->capability_ambient_set, true);
2823 if (r < 0) {
2824 *exit_status = EXIT_CAPABILITIES;
2825 return r;
2826 }
2827 }
2828
2829 if (context->user) {
2830 r = enforce_user(context, uid);
2831 if (r < 0) {
2832 *exit_status = EXIT_USER;
2833 return r;
2834 }
2835 if (context->capability_ambient_set != 0) {
2836
2837 /* Fix the ambient capabilities after user change. */
2838 r = capability_ambient_set_apply(context->capability_ambient_set, false);
2839 if (r < 0) {
2840 *exit_status = EXIT_CAPABILITIES;
2841 return r;
2842 }
2843
2844 /* If we were asked to change user and ambient capabilities
2845 * were requested, we had to add keep-caps to the securebits
2846 * so that we would maintain the inherited capability set
2847 * through the setresuid(). Make sure that the bit is added
2848 * also to the context secure_bits so that we don't try to
2849 * drop the bit away next. */
2850
2851 secure_bits |= 1<<SECURE_KEEP_CAPS;
2852 }
2853 }
2854
2855 /* Apply the MAC contexts late, but before seccomp syscall filtering, as those should really be last to
2856 * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires
2857 * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls
2858 * are restricted. */
2859
2860 #ifdef HAVE_SELINUX
2861 if (mac_selinux_use()) {
2862 char *exec_context = mac_selinux_context_net ?: context->selinux_context;
2863
2864 if (exec_context) {
2865 r = setexeccon(exec_context);
2866 if (r < 0) {
2867 *exit_status = EXIT_SELINUX_CONTEXT;
2868 return r;
2869 }
2870 }
2871 }
2872 #endif
2873
2874 r = setup_smack(context, command);
2875 if (r < 0) {
2876 *exit_status = EXIT_SMACK_PROCESS_LABEL;
2877 return r;
2878 }
2879
2880 #ifdef HAVE_APPARMOR
2881 if (context->apparmor_profile && mac_apparmor_use()) {
2882 r = aa_change_onexec(context->apparmor_profile);
2883 if (r < 0 && !context->apparmor_profile_ignore) {
2884 *exit_status = EXIT_APPARMOR_PROFILE;
2885 return -errno;
2886 }
2887 }
2888 #endif
2889
2890 /* PR_GET_SECUREBITS is not privileged, while
2891 * PR_SET_SECUREBITS is. So to suppress
2892 * potential EPERMs we'll try not to call
2893 * PR_SET_SECUREBITS unless necessary. */
2894 if (prctl(PR_GET_SECUREBITS) != secure_bits)
2895 if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
2896 *exit_status = EXIT_SECUREBITS;
2897 return -errno;
2898 }
2899
2900 if (context_has_no_new_privileges(context))
2901 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
2902 *exit_status = EXIT_NO_NEW_PRIVILEGES;
2903 return -errno;
2904 }
2905
2906 #ifdef HAVE_SECCOMP
2907 if (context_has_address_families(context)) {
2908 r = apply_address_families(unit, context);
2909 if (r < 0) {
2910 *exit_status = EXIT_ADDRESS_FAMILIES;
2911 return r;
2912 }
2913 }
2914
2915 if (context->memory_deny_write_execute) {
2916 r = apply_memory_deny_write_execute(unit, context);
2917 if (r < 0) {
2918 *exit_status = EXIT_SECCOMP;
2919 return r;
2920 }
2921 }
2922
2923 if (context->restrict_realtime) {
2924 r = apply_restrict_realtime(unit, context);
2925 if (r < 0) {
2926 *exit_status = EXIT_SECCOMP;
2927 return r;
2928 }
2929 }
2930
2931 r = apply_restrict_namespaces(unit, context);
2932 if (r < 0) {
2933 *exit_status = EXIT_SECCOMP;
2934 return r;
2935 }
2936
2937 if (context->protect_kernel_tunables) {
2938 r = apply_protect_sysctl(unit, context);
2939 if (r < 0) {
2940 *exit_status = EXIT_SECCOMP;
2941 return r;
2942 }
2943 }
2944
2945 if (context->protect_kernel_modules) {
2946 r = apply_protect_kernel_modules(unit, context);
2947 if (r < 0) {
2948 *exit_status = EXIT_SECCOMP;
2949 return r;
2950 }
2951 }
2952
2953 if (context->private_devices) {
2954 r = apply_private_devices(unit, context);
2955 if (r < 0) {
2956 *exit_status = EXIT_SECCOMP;
2957 return r;
2958 }
2959 }
2960
2961 /* This really should remain the last step before the execve(), to make sure our own code is unaffected
2962 * by the filter as little as possible. */
2963 if (context_has_syscall_filters(context)) {
2964 r = apply_seccomp(unit, context);
2965 if (r < 0) {
2966 *exit_status = EXIT_SECCOMP;
2967 return r;
2968 }
2969 }
2970 #endif
2971 }
2972
2973 final_argv = replace_env_argv(argv, accum_env);
2974 if (!final_argv) {
2975 *exit_status = EXIT_MEMORY;
2976 return -ENOMEM;
2977 }
2978
2979 if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
2980 _cleanup_free_ char *line;
2981
2982 line = exec_command_line(final_argv);
2983 if (line) {
2984 log_open();
2985 log_struct(LOG_DEBUG,
2986 LOG_UNIT_ID(unit),
2987 "EXECUTABLE=%s", command->path,
2988 LOG_UNIT_MESSAGE(unit, "Executing: %s", line),
2989 NULL);
2990 log_close();
2991 }
2992 }
2993
2994 execve(command->path, final_argv, accum_env);
2995 *exit_status = EXIT_EXEC;
2996 return -errno;
2997 }
2998
2999 int exec_spawn(Unit *unit,
3000 ExecCommand *command,
3001 const ExecContext *context,
3002 const ExecParameters *params,
3003 ExecRuntime *runtime,
3004 DynamicCreds *dcreds,
3005 pid_t *ret) {
3006
3007 _cleanup_strv_free_ char **files_env = NULL;
3008 int *fds = NULL; unsigned n_fds = 0;
3009 _cleanup_free_ char *line = NULL;
3010 int socket_fd, r;
3011 int named_iofds[3] = { -1, -1, -1 };
3012 char **argv;
3013 pid_t pid;
3014
3015 assert(unit);
3016 assert(command);
3017 assert(context);
3018 assert(ret);
3019 assert(params);
3020 assert(params->fds || params->n_fds <= 0);
3021
3022 if (context->std_input == EXEC_INPUT_SOCKET ||
3023 context->std_output == EXEC_OUTPUT_SOCKET ||
3024 context->std_error == EXEC_OUTPUT_SOCKET) {
3025
3026 if (params->n_fds != 1) {
3027 log_unit_error(unit, "Got more than one socket.");
3028 return -EINVAL;
3029 }
3030
3031 socket_fd = params->fds[0];
3032 } else {
3033 socket_fd = -1;
3034 fds = params->fds;
3035 n_fds = params->n_fds;
3036 }
3037
3038 r = exec_context_named_iofds(unit, context, params, named_iofds);
3039 if (r < 0)
3040 return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m");
3041
3042 r = exec_context_load_environment(unit, context, &files_env);
3043 if (r < 0)
3044 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
3045
3046 argv = params->argv ?: command->argv;
3047 line = exec_command_line(argv);
3048 if (!line)
3049 return log_oom();
3050
3051 log_struct(LOG_DEBUG,
3052 LOG_UNIT_ID(unit),
3053 LOG_UNIT_MESSAGE(unit, "About to execute: %s", line),
3054 "EXECUTABLE=%s", command->path,
3055 NULL);
3056 pid = fork();
3057 if (pid < 0)
3058 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
3059
3060 if (pid == 0) {
3061 int exit_status;
3062
3063 r = exec_child(unit,
3064 command,
3065 context,
3066 params,
3067 runtime,
3068 dcreds,
3069 argv,
3070 socket_fd,
3071 named_iofds,
3072 fds, n_fds,
3073 files_env,
3074 unit->manager->user_lookup_fds[1],
3075 &exit_status);
3076 if (r < 0) {
3077 log_open();
3078 log_struct_errno(LOG_ERR, r,
3079 LOG_MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
3080 LOG_UNIT_ID(unit),
3081 LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
3082 exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
3083 command->path),
3084 "EXECUTABLE=%s", command->path,
3085 NULL);
3086 }
3087
3088 _exit(exit_status);
3089 }
3090
3091 log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
3092
3093 /* We add the new process to the cgroup both in the child (so
3094 * that we can be sure that no user code is ever executed
3095 * outside of the cgroup) and in the parent (so that we can be
3096 * sure that when we kill the cgroup the process will be
3097 * killed too). */
3098 if (params->cgroup_path)
3099 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
3100
3101 exec_status_start(&command->exec_status, pid);
3102
3103 *ret = pid;
3104 return 0;
3105 }
3106
3107 void exec_context_init(ExecContext *c) {
3108 assert(c);
3109
3110 c->umask = 0022;
3111 c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
3112 c->cpu_sched_policy = SCHED_OTHER;
3113 c->syslog_priority = LOG_DAEMON|LOG_INFO;
3114 c->syslog_level_prefix = true;
3115 c->ignore_sigpipe = true;
3116 c->timer_slack_nsec = NSEC_INFINITY;
3117 c->personality = PERSONALITY_INVALID;
3118 c->runtime_directory_mode = 0755;
3119 c->capability_bounding_set = CAP_ALL;
3120 c->restrict_namespaces = NAMESPACE_FLAGS_ALL;
3121 }
3122
3123 void exec_context_done(ExecContext *c) {
3124 unsigned l;
3125
3126 assert(c);
3127
3128 c->environment = strv_free(c->environment);
3129 c->environment_files = strv_free(c->environment_files);
3130 c->pass_environment = strv_free(c->pass_environment);
3131
3132 for (l = 0; l < ELEMENTSOF(c->rlimit); l++)
3133 c->rlimit[l] = mfree(c->rlimit[l]);
3134
3135 for (l = 0; l < 3; l++)
3136 c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);
3137
3138 c->working_directory = mfree(c->working_directory);
3139 c->root_directory = mfree(c->root_directory);
3140 c->tty_path = mfree(c->tty_path);
3141 c->syslog_identifier = mfree(c->syslog_identifier);
3142 c->user = mfree(c->user);
3143 c->group = mfree(c->group);
3144
3145 c->supplementary_groups = strv_free(c->supplementary_groups);
3146
3147 c->pam_name = mfree(c->pam_name);
3148
3149 c->read_only_paths = strv_free(c->read_only_paths);
3150 c->read_write_paths = strv_free(c->read_write_paths);
3151 c->inaccessible_paths = strv_free(c->inaccessible_paths);
3152
3153 bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
3154
3155 if (c->cpuset)
3156 CPU_FREE(c->cpuset);
3157
3158 c->utmp_id = mfree(c->utmp_id);
3159 c->selinux_context = mfree(c->selinux_context);
3160 c->apparmor_profile = mfree(c->apparmor_profile);
3161
3162 c->syscall_filter = set_free(c->syscall_filter);
3163 c->syscall_archs = set_free(c->syscall_archs);
3164 c->address_families = set_free(c->address_families);
3165
3166 c->runtime_directory = strv_free(c->runtime_directory);
3167 }
3168
3169 int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
3170 char **i;
3171
3172 assert(c);
3173
3174 if (!runtime_prefix)
3175 return 0;
3176
3177 STRV_FOREACH(i, c->runtime_directory) {
3178 _cleanup_free_ char *p;
3179
3180 p = strjoin(runtime_prefix, "/", *i);
3181 if (!p)
3182 return -ENOMEM;
3183
3184 /* We execute this synchronously, since we need to be
3185 * sure this is gone when we start the service
3186 * next. */
3187 (void) rm_rf(p, REMOVE_ROOT);
3188 }
3189
3190 return 0;
3191 }
3192
3193 void exec_command_done(ExecCommand *c) {
3194 assert(c);
3195
3196 c->path = mfree(c->path);
3197
3198 c->argv = strv_free(c->argv);
3199 }
3200
3201 void exec_command_done_array(ExecCommand *c, unsigned n) {
3202 unsigned i;
3203
3204 for (i = 0; i < n; i++)
3205 exec_command_done(c+i);
3206 }
3207
3208 ExecCommand* exec_command_free_list(ExecCommand *c) {
3209 ExecCommand *i;
3210
3211 while ((i = c)) {
3212 LIST_REMOVE(command, c, i);
3213 exec_command_done(i);
3214 free(i);
3215 }
3216
3217 return NULL;
3218 }
3219
3220 void exec_command_free_array(ExecCommand **c, unsigned n) {
3221 unsigned i;
3222
3223 for (i = 0; i < n; i++)
3224 c[i] = exec_command_free_list(c[i]);
3225 }
3226
3227 typedef struct InvalidEnvInfo {
3228 Unit *unit;
3229 const char *path;
3230 } InvalidEnvInfo;
3231
3232 static void invalid_env(const char *p, void *userdata) {
3233 InvalidEnvInfo *info = userdata;
3234
3235 log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
3236 }
3237
3238 const char* exec_context_fdname(const ExecContext *c, int fd_index) {
3239 assert(c);
3240
3241 switch (fd_index) {
3242 case STDIN_FILENO:
3243 if (c->std_input != EXEC_INPUT_NAMED_FD)
3244 return NULL;
3245 return c->stdio_fdname[STDIN_FILENO] ?: "stdin";
3246 case STDOUT_FILENO:
3247 if (c->std_output != EXEC_OUTPUT_NAMED_FD)
3248 return NULL;
3249 return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";
3250 case STDERR_FILENO:
3251 if (c->std_error != EXEC_OUTPUT_NAMED_FD)
3252 return NULL;
3253 return c->stdio_fdname[STDERR_FILENO] ?: "stderr";
3254 default:
3255 return NULL;
3256 }
3257 }
3258
3259 int exec_context_named_iofds(Unit *unit, const ExecContext *c, const ExecParameters *p, int named_iofds[3]) {
3260 unsigned i, targets;
3261 const char *stdio_fdname[3];
3262
3263 assert(c);
3264 assert(p);
3265
3266 targets = (c->std_input == EXEC_INPUT_NAMED_FD) +
3267 (c->std_output == EXEC_OUTPUT_NAMED_FD) +
3268 (c->std_error == EXEC_OUTPUT_NAMED_FD);
3269
3270 for (i = 0; i < 3; i++)
3271 stdio_fdname[i] = exec_context_fdname(c, i);
3272
3273 for (i = 0; i < p->n_fds && targets > 0; i++)
3274 if (named_iofds[STDIN_FILENO] < 0 && c->std_input == EXEC_INPUT_NAMED_FD && stdio_fdname[STDIN_FILENO] && streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) {
3275 named_iofds[STDIN_FILENO] = p->fds[i];
3276 targets--;
3277 } else if (named_iofds[STDOUT_FILENO] < 0 && c->std_output == EXEC_OUTPUT_NAMED_FD && stdio_fdname[STDOUT_FILENO] && streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) {
3278 named_iofds[STDOUT_FILENO] = p->fds[i];
3279 targets--;
3280 } else if (named_iofds[STDERR_FILENO] < 0 && c->std_error == EXEC_OUTPUT_NAMED_FD && stdio_fdname[STDERR_FILENO] && streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) {
3281 named_iofds[STDERR_FILENO] = p->fds[i];
3282 targets--;
3283 }
3284
3285 return (targets == 0 ? 0 : -ENOENT);
3286 }
3287
3288 int exec_context_load_environment(Unit *unit, const ExecContext *c, char ***l) {
3289 char **i, **r = NULL;
3290
3291 assert(c);
3292 assert(l);
3293
3294 STRV_FOREACH(i, c->environment_files) {
3295 char *fn;
3296 int k;
3297 bool ignore = false;
3298 char **p;
3299 _cleanup_globfree_ glob_t pglob = {};
3300 int count, n;
3301
3302 fn = *i;
3303
3304 if (fn[0] == '-') {
3305 ignore = true;
3306 fn++;
3307 }
3308
3309 if (!path_is_absolute(fn)) {
3310 if (ignore)
3311 continue;
3312
3313 strv_free(r);
3314 return -EINVAL;
3315 }
3316
3317 /* Filename supports globbing, take all matching files */
3318 errno = 0;
3319 if (glob(fn, 0, NULL, &pglob) != 0) {
3320 if (ignore)
3321 continue;
3322
3323 strv_free(r);
3324 return errno > 0 ? -errno : -EINVAL;
3325 }
3326 count = pglob.gl_pathc;
3327 if (count == 0) {
3328 if (ignore)
3329 continue;
3330
3331 strv_free(r);
3332 return -EINVAL;
3333 }
3334 for (n = 0; n < count; n++) {
3335 k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
3336 if (k < 0) {
3337 if (ignore)
3338 continue;
3339
3340 strv_free(r);
3341 return k;
3342 }
3343 /* Log invalid environment variables with filename */
3344 if (p) {
3345 InvalidEnvInfo info = {
3346 .unit = unit,
3347 .path = pglob.gl_pathv[n]
3348 };
3349
3350 p = strv_env_clean_with_callback(p, invalid_env, &info);
3351 }
3352
3353 if (r == NULL)
3354 r = p;
3355 else {
3356 char **m;
3357
3358 m = strv_env_merge(2, r, p);
3359 strv_free(r);
3360 strv_free(p);
3361 if (!m)
3362 return -ENOMEM;
3363
3364 r = m;
3365 }
3366 }
3367 }
3368
3369 *l = r;
3370
3371 return 0;
3372 }
3373
3374 static bool tty_may_match_dev_console(const char *tty) {
3375 _cleanup_free_ char *active = NULL;
3376 char *console;
3377
3378 if (!tty)
3379 return true;
3380
3381 if (startswith(tty, "/dev/"))
3382 tty += 5;
3383
3384 /* trivial identity? */
3385 if (streq(tty, "console"))
3386 return true;
3387
3388 console = resolve_dev_console(&active);
3389 /* if we could not resolve, assume it may */
3390 if (!console)
3391 return true;
3392
3393 /* "tty0" means the active VC, so it may be the same sometimes */
3394 return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
3395 }
3396
3397 bool exec_context_may_touch_console(ExecContext *ec) {
3398
3399 return (ec->tty_reset ||
3400 ec->tty_vhangup ||
3401 ec->tty_vt_disallocate ||
3402 is_terminal_input(ec->std_input) ||
3403 is_terminal_output(ec->std_output) ||
3404 is_terminal_output(ec->std_error)) &&
3405 tty_may_match_dev_console(exec_context_tty_path(ec));
3406 }
3407
3408 static void strv_fprintf(FILE *f, char **l) {
3409 char **g;
3410
3411 assert(f);
3412
3413 STRV_FOREACH(g, l)
3414 fprintf(f, " %s", *g);
3415 }
3416
3417 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
3418 char **e, **d;
3419 unsigned i;
3420 int r;
3421
3422 assert(c);
3423 assert(f);
3424
3425 prefix = strempty(prefix);
3426
3427 fprintf(f,
3428 "%sUMask: %04o\n"
3429 "%sWorkingDirectory: %s\n"
3430 "%sRootDirectory: %s\n"
3431 "%sNonBlocking: %s\n"
3432 "%sPrivateTmp: %s\n"
3433 "%sPrivateDevices: %s\n"
3434 "%sProtectKernelTunables: %s\n"
3435 "%sProtectKernelModules: %s\n"
3436 "%sProtectControlGroups: %s\n"
3437 "%sPrivateNetwork: %s\n"
3438 "%sPrivateUsers: %s\n"
3439 "%sProtectHome: %s\n"
3440 "%sProtectSystem: %s\n"
3441 "%sIgnoreSIGPIPE: %s\n"
3442 "%sMemoryDenyWriteExecute: %s\n"
3443 "%sRestrictRealtime: %s\n",
3444 prefix, c->umask,
3445 prefix, c->working_directory ? c->working_directory : "/",
3446 prefix, c->root_directory ? c->root_directory : "/",
3447 prefix, yes_no(c->non_blocking),
3448 prefix, yes_no(c->private_tmp),
3449 prefix, yes_no(c->private_devices),
3450 prefix, yes_no(c->protect_kernel_tunables),
3451 prefix, yes_no(c->protect_kernel_modules),
3452 prefix, yes_no(c->protect_control_groups),
3453 prefix, yes_no(c->private_network),
3454 prefix, yes_no(c->private_users),
3455 prefix, protect_home_to_string(c->protect_home),
3456 prefix, protect_system_to_string(c->protect_system),
3457 prefix, yes_no(c->ignore_sigpipe),
3458 prefix, yes_no(c->memory_deny_write_execute),
3459 prefix, yes_no(c->restrict_realtime));
3460
3461 STRV_FOREACH(e, c->environment)
3462 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
3463
3464 STRV_FOREACH(e, c->environment_files)
3465 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
3466
3467 STRV_FOREACH(e, c->pass_environment)
3468 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
3469
3470 fprintf(f, "%sRuntimeDirectoryMode: %04o\n", prefix, c->runtime_directory_mode);
3471
3472 STRV_FOREACH(d, c->runtime_directory)
3473 fprintf(f, "%sRuntimeDirectory: %s\n", prefix, *d);
3474
3475 if (c->nice_set)
3476 fprintf(f,
3477 "%sNice: %i\n",
3478 prefix, c->nice);
3479
3480 if (c->oom_score_adjust_set)
3481 fprintf(f,
3482 "%sOOMScoreAdjust: %i\n",
3483 prefix, c->oom_score_adjust);
3484
3485 for (i = 0; i < RLIM_NLIMITS; i++)
3486 if (c->rlimit[i]) {
3487 fprintf(f, "%s%s: " RLIM_FMT "\n",
3488 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
3489 fprintf(f, "%s%sSoft: " RLIM_FMT "\n",
3490 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
3491 }
3492
3493 if (c->ioprio_set) {
3494 _cleanup_free_ char *class_str = NULL;
3495
3496 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
3497 fprintf(f,
3498 "%sIOSchedulingClass: %s\n"
3499 "%sIOPriority: %i\n",
3500 prefix, strna(class_str),
3501 prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
3502 }
3503
3504 if (c->cpu_sched_set) {
3505 _cleanup_free_ char *policy_str = NULL;
3506
3507 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
3508 fprintf(f,
3509 "%sCPUSchedulingPolicy: %s\n"
3510 "%sCPUSchedulingPriority: %i\n"
3511 "%sCPUSchedulingResetOnFork: %s\n",
3512 prefix, strna(policy_str),
3513 prefix, c->cpu_sched_priority,
3514 prefix, yes_no(c->cpu_sched_reset_on_fork));
3515 }
3516
3517 if (c->cpuset) {
3518 fprintf(f, "%sCPUAffinity:", prefix);
3519 for (i = 0; i < c->cpuset_ncpus; i++)
3520 if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
3521 fprintf(f, " %u", i);
3522 fputs("\n", f);
3523 }
3524
3525 if (c->timer_slack_nsec != NSEC_INFINITY)
3526 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
3527
3528 fprintf(f,
3529 "%sStandardInput: %s\n"
3530 "%sStandardOutput: %s\n"
3531 "%sStandardError: %s\n",
3532 prefix, exec_input_to_string(c->std_input),
3533 prefix, exec_output_to_string(c->std_output),
3534 prefix, exec_output_to_string(c->std_error));
3535
3536 if (c->tty_path)
3537 fprintf(f,
3538 "%sTTYPath: %s\n"
3539 "%sTTYReset: %s\n"
3540 "%sTTYVHangup: %s\n"
3541 "%sTTYVTDisallocate: %s\n",
3542 prefix, c->tty_path,
3543 prefix, yes_no(c->tty_reset),
3544 prefix, yes_no(c->tty_vhangup),
3545 prefix, yes_no(c->tty_vt_disallocate));
3546
3547 if (c->std_output == EXEC_OUTPUT_SYSLOG ||
3548 c->std_output == EXEC_OUTPUT_KMSG ||
3549 c->std_output == EXEC_OUTPUT_JOURNAL ||
3550 c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
3551 c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
3552 c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
3553 c->std_error == EXEC_OUTPUT_SYSLOG ||
3554 c->std_error == EXEC_OUTPUT_KMSG ||
3555 c->std_error == EXEC_OUTPUT_JOURNAL ||
3556 c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
3557 c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
3558 c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
3559
3560 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
3561
3562 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
3563 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
3564
3565 fprintf(f,
3566 "%sSyslogFacility: %s\n"
3567 "%sSyslogLevel: %s\n",
3568 prefix, strna(fac_str),
3569 prefix, strna(lvl_str));
3570 }
3571
3572 if (c->secure_bits)
3573 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
3574 prefix,
3575 (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
3576 (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
3577 (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
3578 (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
3579 (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
3580 (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
3581
3582 if (c->capability_bounding_set != CAP_ALL) {
3583 unsigned long l;
3584 fprintf(f, "%sCapabilityBoundingSet:", prefix);
3585
3586 for (l = 0; l <= cap_last_cap(); l++)
3587 if (c->capability_bounding_set & (UINT64_C(1) << l))
3588 fprintf(f, " %s", strna(capability_to_name(l)));
3589
3590 fputs("\n", f);
3591 }
3592
3593 if (c->capability_ambient_set != 0) {
3594 unsigned long l;
3595 fprintf(f, "%sAmbientCapabilities:", prefix);
3596
3597 for (l = 0; l <= cap_last_cap(); l++)
3598 if (c->capability_ambient_set & (UINT64_C(1) << l))
3599 fprintf(f, " %s", strna(capability_to_name(l)));
3600
3601 fputs("\n", f);
3602 }
3603
3604 if (c->user)
3605 fprintf(f, "%sUser: %s\n", prefix, c->user);
3606 if (c->group)
3607 fprintf(f, "%sGroup: %s\n", prefix, c->group);
3608
3609 fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
3610
3611 if (strv_length(c->supplementary_groups) > 0) {
3612 fprintf(f, "%sSupplementaryGroups:", prefix);
3613 strv_fprintf(f, c->supplementary_groups);
3614 fputs("\n", f);
3615 }
3616
3617 if (c->pam_name)
3618 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
3619
3620 if (strv_length(c->read_write_paths) > 0) {
3621 fprintf(f, "%sReadWritePaths:", prefix);
3622 strv_fprintf(f, c->read_write_paths);
3623 fputs("\n", f);
3624 }
3625
3626 if (strv_length(c->read_only_paths) > 0) {
3627 fprintf(f, "%sReadOnlyPaths:", prefix);
3628 strv_fprintf(f, c->read_only_paths);
3629 fputs("\n", f);
3630 }
3631
3632 if (strv_length(c->inaccessible_paths) > 0) {
3633 fprintf(f, "%sInaccessiblePaths:", prefix);
3634 strv_fprintf(f, c->inaccessible_paths);
3635 fputs("\n", f);
3636 }
3637
3638 if (c->n_bind_mounts > 0)
3639 for (i = 0; i < c->n_bind_mounts; i++) {
3640 fprintf(f, "%s%s: %s:%s:%s\n", prefix,
3641 c->bind_mounts[i].read_only ? "BindReadOnlyPaths" : "BindPaths",
3642 c->bind_mounts[i].source,
3643 c->bind_mounts[i].destination,
3644 c->bind_mounts[i].recursive ? "rbind" : "norbind");
3645 }
3646
3647 if (c->utmp_id)
3648 fprintf(f,
3649 "%sUtmpIdentifier: %s\n",
3650 prefix, c->utmp_id);
3651
3652 if (c->selinux_context)
3653 fprintf(f,
3654 "%sSELinuxContext: %s%s\n",
3655 prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
3656
3657 if (c->personality != PERSONALITY_INVALID)
3658 fprintf(f,
3659 "%sPersonality: %s\n",
3660 prefix, strna(personality_to_string(c->personality)));
3661
3662 if (c->syscall_filter) {
3663 #ifdef HAVE_SECCOMP
3664 Iterator j;
3665 void *id;
3666 bool first = true;
3667 #endif
3668
3669 fprintf(f,
3670 "%sSystemCallFilter: ",
3671 prefix);
3672
3673 if (!c->syscall_whitelist)
3674 fputc('~', f);
3675
3676 #ifdef HAVE_SECCOMP
3677 SET_FOREACH(id, c->syscall_filter, j) {
3678 _cleanup_free_ char *name = NULL;
3679
3680 if (first)
3681 first = false;
3682 else
3683 fputc(' ', f);
3684
3685 name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
3686 fputs(strna(name), f);
3687 }
3688 #endif
3689
3690 fputc('\n', f);
3691 }
3692
3693 if (c->syscall_archs) {
3694 #ifdef HAVE_SECCOMP
3695 Iterator j;
3696 void *id;
3697 #endif
3698
3699 fprintf(f,
3700 "%sSystemCallArchitectures:",
3701 prefix);
3702
3703 #ifdef HAVE_SECCOMP
3704 SET_FOREACH(id, c->syscall_archs, j)
3705 fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
3706 #endif
3707 fputc('\n', f);
3708 }
3709
3710 if (exec_context_restrict_namespaces_set(c)) {
3711 _cleanup_free_ char *s = NULL;
3712
3713 r = namespace_flag_to_string_many(c->restrict_namespaces, &s);
3714 if (r >= 0)
3715 fprintf(f, "%sRestrictNamespaces: %s\n",
3716 prefix, s);
3717 }
3718
3719 if (c->syscall_errno > 0)
3720 fprintf(f,
3721 "%sSystemCallErrorNumber: %s\n",
3722 prefix, strna(errno_to_name(c->syscall_errno)));
3723
3724 if (c->apparmor_profile)
3725 fprintf(f,
3726 "%sAppArmorProfile: %s%s\n",
3727 prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
3728 }
3729
3730 bool exec_context_maintains_privileges(ExecContext *c) {
3731 assert(c);
3732
3733 /* Returns true if the process forked off would run under
3734 * an unchanged UID or as root. */
3735
3736 if (!c->user)
3737 return true;
3738
3739 if (streq(c->user, "root") || streq(c->user, "0"))
3740 return true;
3741
3742 return false;
3743 }
3744
3745 void exec_status_start(ExecStatus *s, pid_t pid) {
3746 assert(s);
3747
3748 zero(*s);
3749 s->pid = pid;
3750 dual_timestamp_get(&s->start_timestamp);
3751 }
3752
3753 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
3754 assert(s);
3755
3756 if (s->pid && s->pid != pid)
3757 zero(*s);
3758
3759 s->pid = pid;
3760 dual_timestamp_get(&s->exit_timestamp);
3761
3762 s->code = code;
3763 s->status = status;
3764
3765 if (context) {
3766 if (context->utmp_id)
3767 utmp_put_dead_process(context->utmp_id, pid, code, status);
3768
3769 exec_context_tty_reset(context, NULL);
3770 }
3771 }
3772
3773 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
3774 char buf[FORMAT_TIMESTAMP_MAX];
3775
3776 assert(s);
3777 assert(f);
3778
3779 if (s->pid <= 0)
3780 return;
3781
3782 prefix = strempty(prefix);
3783
3784 fprintf(f,
3785 "%sPID: "PID_FMT"\n",
3786 prefix, s->pid);
3787
3788 if (dual_timestamp_is_set(&s->start_timestamp))
3789 fprintf(f,
3790 "%sStart Timestamp: %s\n",
3791 prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
3792
3793 if (dual_timestamp_is_set(&s->exit_timestamp))
3794 fprintf(f,
3795 "%sExit Timestamp: %s\n"
3796 "%sExit Code: %s\n"
3797 "%sExit Status: %i\n",
3798 prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
3799 prefix, sigchld_code_to_string(s->code),
3800 prefix, s->status);
3801 }
3802
3803 char *exec_command_line(char **argv) {
3804 size_t k;
3805 char *n, *p, **a;
3806 bool first = true;
3807
3808 assert(argv);
3809
3810 k = 1;
3811 STRV_FOREACH(a, argv)
3812 k += strlen(*a)+3;
3813
3814 n = new(char, k);
3815 if (!n)
3816 return NULL;
3817
3818 p = n;
3819 STRV_FOREACH(a, argv) {
3820
3821 if (!first)
3822 *(p++) = ' ';
3823 else
3824 first = false;
3825
3826 if (strpbrk(*a, WHITESPACE)) {
3827 *(p++) = '\'';
3828 p = stpcpy(p, *a);
3829 *(p++) = '\'';
3830 } else
3831 p = stpcpy(p, *a);
3832
3833 }
3834
3835 *p = 0;
3836
3837 /* FIXME: this doesn't really handle arguments that have
3838 * spaces and ticks in them */
3839
3840 return n;
3841 }
3842
3843 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
3844 _cleanup_free_ char *cmd = NULL;
3845 const char *prefix2;
3846
3847 assert(c);
3848 assert(f);
3849
3850 prefix = strempty(prefix);
3851 prefix2 = strjoina(prefix, "\t");
3852
3853 cmd = exec_command_line(c->argv);
3854 fprintf(f,
3855 "%sCommand Line: %s\n",
3856 prefix, cmd ? cmd : strerror(ENOMEM));
3857
3858 exec_status_dump(&c->exec_status, f, prefix2);
3859 }
3860
3861 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
3862 assert(f);
3863
3864 prefix = strempty(prefix);
3865
3866 LIST_FOREACH(command, c, c)
3867 exec_command_dump(c, f, prefix);
3868 }
3869
3870 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
3871 ExecCommand *end;
3872
3873 assert(l);
3874 assert(e);
3875
3876 if (*l) {
3877 /* It's kind of important, that we keep the order here */
3878 LIST_FIND_TAIL(command, *l, end);
3879 LIST_INSERT_AFTER(command, *l, end, e);
3880 } else
3881 *l = e;
3882 }
3883
3884 int exec_command_set(ExecCommand *c, const char *path, ...) {
3885 va_list ap;
3886 char **l, *p;
3887
3888 assert(c);
3889 assert(path);
3890
3891 va_start(ap, path);
3892 l = strv_new_ap(path, ap);
3893 va_end(ap);
3894
3895 if (!l)
3896 return -ENOMEM;
3897
3898 p = strdup(path);
3899 if (!p) {
3900 strv_free(l);
3901 return -ENOMEM;
3902 }
3903
3904 free(c->path);
3905 c->path = p;
3906
3907 strv_free(c->argv);
3908 c->argv = l;
3909
3910 return 0;
3911 }
3912
3913 int exec_command_append(ExecCommand *c, const char *path, ...) {
3914 _cleanup_strv_free_ char **l = NULL;
3915 va_list ap;
3916 int r;
3917
3918 assert(c);
3919 assert(path);
3920
3921 va_start(ap, path);
3922 l = strv_new_ap(path, ap);
3923 va_end(ap);
3924
3925 if (!l)
3926 return -ENOMEM;
3927
3928 r = strv_extend_strv(&c->argv, l, false);
3929 if (r < 0)
3930 return r;
3931
3932 return 0;
3933 }
3934
3935
3936 static int exec_runtime_allocate(ExecRuntime **rt) {
3937
3938 if (*rt)
3939 return 0;
3940
3941 *rt = new0(ExecRuntime, 1);
3942 if (!*rt)
3943 return -ENOMEM;
3944
3945 (*rt)->n_ref = 1;
3946 (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
3947
3948 return 0;
3949 }
3950
3951 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
3952 int r;
3953
3954 assert(rt);
3955 assert(c);
3956 assert(id);
3957
3958 if (*rt)
3959 return 1;
3960
3961 if (!c->private_network && !c->private_tmp)
3962 return 0;
3963
3964 r = exec_runtime_allocate(rt);
3965 if (r < 0)
3966 return r;
3967
3968 if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
3969 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, (*rt)->netns_storage_socket) < 0)
3970 return -errno;
3971 }
3972
3973 if (c->private_tmp && !(*rt)->tmp_dir) {
3974 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
3975 if (r < 0)
3976 return r;
3977 }
3978
3979 return 1;
3980 }
3981
3982 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
3983 assert(r);
3984 assert(r->n_ref > 0);
3985
3986 r->n_ref++;
3987 return r;
3988 }
3989
3990 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
3991
3992 if (!r)
3993 return NULL;
3994
3995 assert(r->n_ref > 0);
3996
3997 r->n_ref--;
3998 if (r->n_ref > 0)
3999 return NULL;
4000
4001 free(r->tmp_dir);
4002 free(r->var_tmp_dir);
4003 safe_close_pair(r->netns_storage_socket);
4004 return mfree(r);
4005 }
4006
4007 int exec_runtime_serialize(Unit *u, ExecRuntime *rt, FILE *f, FDSet *fds) {
4008 assert(u);
4009 assert(f);
4010 assert(fds);
4011
4012 if (!rt)
4013 return 0;
4014
4015 if (rt->tmp_dir)
4016 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
4017
4018 if (rt->var_tmp_dir)
4019 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
4020
4021 if (rt->netns_storage_socket[0] >= 0) {
4022 int copy;
4023
4024 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
4025 if (copy < 0)
4026 return copy;
4027
4028 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
4029 }
4030
4031 if (rt->netns_storage_socket[1] >= 0) {
4032 int copy;
4033
4034 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
4035 if (copy < 0)
4036 return copy;
4037
4038 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
4039 }
4040
4041 return 0;
4042 }
4043
4044 int exec_runtime_deserialize_item(Unit *u, ExecRuntime **rt, const char *key, const char *value, FDSet *fds) {
4045 int r;
4046
4047 assert(rt);
4048 assert(key);
4049 assert(value);
4050
4051 if (streq(key, "tmp-dir")) {
4052 char *copy;
4053
4054 r = exec_runtime_allocate(rt);
4055 if (r < 0)
4056 return log_oom();
4057
4058 copy = strdup(value);
4059 if (!copy)
4060 return log_oom();
4061
4062 free((*rt)->tmp_dir);
4063 (*rt)->tmp_dir = copy;
4064
4065 } else if (streq(key, "var-tmp-dir")) {
4066 char *copy;
4067
4068 r = exec_runtime_allocate(rt);
4069 if (r < 0)
4070 return log_oom();
4071
4072 copy = strdup(value);
4073 if (!copy)
4074 return log_oom();
4075
4076 free((*rt)->var_tmp_dir);
4077 (*rt)->var_tmp_dir = copy;
4078
4079 } else if (streq(key, "netns-socket-0")) {
4080 int fd;
4081
4082 r = exec_runtime_allocate(rt);
4083 if (r < 0)
4084 return log_oom();
4085
4086 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
4087 log_unit_debug(u, "Failed to parse netns socket value: %s", value);
4088 else {
4089 safe_close((*rt)->netns_storage_socket[0]);
4090 (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
4091 }
4092 } else if (streq(key, "netns-socket-1")) {
4093 int fd;
4094
4095 r = exec_runtime_allocate(rt);
4096 if (r < 0)
4097 return log_oom();
4098
4099 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
4100 log_unit_debug(u, "Failed to parse netns socket value: %s", value);
4101 else {
4102 safe_close((*rt)->netns_storage_socket[1]);
4103 (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
4104 }
4105 } else
4106 return 0;
4107
4108 return 1;
4109 }
4110
4111 static void *remove_tmpdir_thread(void *p) {
4112 _cleanup_free_ char *path = p;
4113
4114 (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
4115 return NULL;
4116 }
4117
4118 void exec_runtime_destroy(ExecRuntime *rt) {
4119 int r;
4120
4121 if (!rt)
4122 return;
4123
4124 /* If there are multiple users of this, let's leave the stuff around */
4125 if (rt->n_ref > 1)
4126 return;
4127
4128 if (rt->tmp_dir) {
4129 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
4130
4131 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
4132 if (r < 0) {
4133 log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
4134 free(rt->tmp_dir);
4135 }
4136
4137 rt->tmp_dir = NULL;
4138 }
4139
4140 if (rt->var_tmp_dir) {
4141 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
4142
4143 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
4144 if (r < 0) {
4145 log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
4146 free(rt->var_tmp_dir);
4147 }
4148
4149 rt->var_tmp_dir = NULL;
4150 }
4151
4152 safe_close_pair(rt->netns_storage_socket);
4153 }
4154
4155 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
4156 [EXEC_INPUT_NULL] = "null",
4157 [EXEC_INPUT_TTY] = "tty",
4158 [EXEC_INPUT_TTY_FORCE] = "tty-force",
4159 [EXEC_INPUT_TTY_FAIL] = "tty-fail",
4160 [EXEC_INPUT_SOCKET] = "socket",
4161 [EXEC_INPUT_NAMED_FD] = "fd",
4162 };
4163
4164 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
4165
4166 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
4167 [EXEC_OUTPUT_INHERIT] = "inherit",
4168 [EXEC_OUTPUT_NULL] = "null",
4169 [EXEC_OUTPUT_TTY] = "tty",
4170 [EXEC_OUTPUT_SYSLOG] = "syslog",
4171 [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
4172 [EXEC_OUTPUT_KMSG] = "kmsg",
4173 [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
4174 [EXEC_OUTPUT_JOURNAL] = "journal",
4175 [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
4176 [EXEC_OUTPUT_SOCKET] = "socket",
4177 [EXEC_OUTPUT_NAMED_FD] = "fd",
4178 };
4179
4180 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
4181
4182 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
4183 [EXEC_UTMP_INIT] = "init",
4184 [EXEC_UTMP_LOGIN] = "login",
4185 [EXEC_UTMP_USER] = "user",
4186 };
4187
4188 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);
Unnamed repository; edit this file 'description' to name the repository.