src/core/execute.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <glob.h>
  23 #include <grp.h>
  24 #include <poll.h>
  25 #include <signal.h>
  26 #include <string.h>
  27 #include <sys/capability.h>
  28 #include <sys/eventfd.h>
  29 #include <sys/mman.h>
  30 #include <sys/personality.h>
  31 #include <sys/prctl.h>
  32 #include <sys/shm.h>
  33 #include <sys/socket.h>
  34 #include <sys/stat.h>
  35 #include <sys/types.h>
  36 #include <sys/un.h>
  37 #include <unistd.h>
  38 #include <utmpx.h>
  39
  40 #ifdef HAVE_PAM
  41 #include <security/pam_appl.h>
  42 #endif
  43
  44 #ifdef HAVE_SELINUX
  45 #include <selinux/selinux.h>
  46 #endif
  47
  48 #ifdef HAVE_SECCOMP
  49 #include <seccomp.h>
  50 #endif
  51
  52 #ifdef HAVE_APPARMOR
  53 #include <sys/apparmor.h>
  54 #endif
  55
  56 #include "sd-messages.h"
  57
  58 #include "af-list.h"
  59 #include "alloc-util.h"
  60 #ifdef HAVE_APPARMOR
  61 #include "apparmor-util.h"
  62 #endif
  63 #include "async.h"
  64 #include "barrier.h"
  65 #include "cap-list.h"
  66 #include "capability-util.h"
  67 #include "def.h"
  68 #include "env-util.h"
  69 #include "errno-list.h"
  70 #include "execute.h"
  71 #include "exit-status.h"
  72 #include "fd-util.h"
  73 #include "fileio.h"
  74 #include "format-util.h"
  75 #include "fs-util.h"
  76 #include "glob-util.h"
  77 #include "io-util.h"
  78 #include "ioprio.h"
  79 #include "log.h"
  80 #include "macro.h"
  81 #include "missing.h"
  82 #include "mkdir.h"
  83 #include "namespace.h"
  84 #include "parse-util.h"
  85 #include "path-util.h"
  86 #include "process-util.h"
  87 #include "rlimit-util.h"
  88 #include "rm-rf.h"
  89 #ifdef HAVE_SECCOMP
  90 #include "seccomp-util.h"
  91 #endif
  92 #include "securebits.h"
  93 #include "selinux-util.h"
  94 #include "signal-util.h"
  95 #include "smack-util.h"
  96 #include "special.h"
  97 #include "string-table.h"
  98 #include "string-util.h"
  99 #include "strv.h"
 100 #include "syslog-util.h"
 101 #include "terminal-util.h"
 102 #include "unit.h"
 103 #include "user-util.h"
 104 #include "util.h"
 105 #include "utmp-wtmp.h"
 106
 107 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
 108 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
 109
 110 /* This assumes there is a 'tty' group */
 111 #define TTY_MODE 0620
 112
 113 #define SNDBUF_SIZE (8*1024*1024)
 114
 115 static int shift_fds(int fds[], unsigned n_fds) {
 116         int start, restart_from;
 117
 118         if (n_fds <= 0)
 119                 return 0;
 120
 121         /* Modifies the fds array! (sorts it) */
 122
 123         assert(fds);
 124
 125         start = 0;
 126         for (;;) {
 127                 int i;
 128
 129                 restart_from = -1;
 130
 131                 for (i = start; i < (int) n_fds; i++) {
 132                         int nfd;
 133
 134                         /* Already at right index? */
 135                         if (fds[i] == i+3)
 136                                 continue;
 137
 138                         nfd = fcntl(fds[i], F_DUPFD, i + 3);
 139                         if (nfd < 0)
 140                                 return -errno;
 141
 142                         safe_close(fds[i]);
 143                         fds[i] = nfd;
 144
 145                         /* Hmm, the fd we wanted isn't free? Then
 146                          * let's remember that and try again from here */
 147                         if (nfd != i+3 && restart_from < 0)
 148                                 restart_from = i;
 149                 }
 150
 151                 if (restart_from < 0)
 152                         break;
 153
 154                 start = restart_from;
 155         }
 156
 157         return 0;
 158 }
 159
 160 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 161         unsigned i;
 162         int r;
 163
 164         if (n_fds <= 0)
 165                 return 0;
 166
 167         assert(fds);
 168
 169         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 170
 171         for (i = 0; i < n_fds; i++) {
 172
 173                 r = fd_nonblock(fds[i], nonblock);
 174                 if (r < 0)
 175                         return r;
 176
 177                 /* We unconditionally drop FD_CLOEXEC from the fds,
 178                  * since after all we want to pass these fds to our
 179                  * children */
 180
 181                 r = fd_cloexec(fds[i], false);
 182                 if (r < 0)
 183                         return r;
 184         }
 185
 186         return 0;
 187 }
 188
 189 static const char *exec_context_tty_path(const ExecContext *context) {
 190         assert(context);
 191
 192         if (context->stdio_as_fds)
 193                 return NULL;
 194
 195         if (context->tty_path)
 196                 return context->tty_path;
 197
 198         return "/dev/console";
 199 }
 200
 201 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
 202         const char *path;
 203
 204         assert(context);
 205
 206         path = exec_context_tty_path(context);
 207
 208         if (context->tty_vhangup) {
 209                 if (p && p->stdin_fd >= 0)
 210                         (void) terminal_vhangup_fd(p->stdin_fd);
 211                 else if (path)
 212                         (void) terminal_vhangup(path);
 213         }
 214
 215         if (context->tty_reset) {
 216                 if (p && p->stdin_fd >= 0)
 217                         (void) reset_terminal_fd(p->stdin_fd, true);
 218                 else if (path)
 219                         (void) reset_terminal(path);
 220         }
 221
 222         if (context->tty_vt_disallocate && path)
 223                 (void) vt_disallocate(path);
 224 }
 225
 226 static bool is_terminal_input(ExecInput i) {
 227         return IN_SET(i,
 228                       EXEC_INPUT_TTY,
 229                       EXEC_INPUT_TTY_FORCE,
 230                       EXEC_INPUT_TTY_FAIL);
 231 }
 232
 233 static bool is_terminal_output(ExecOutput o) {
 234         return IN_SET(o,
 235                       EXEC_OUTPUT_TTY,
 236                       EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 237                       EXEC_OUTPUT_KMSG_AND_CONSOLE,
 238                       EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 239 }
 240
 241 static bool exec_context_needs_term(const ExecContext *c) {
 242         assert(c);
 243
 244         /* Return true if the execution context suggests we should set $TERM to something useful. */
 245
 246         if (is_terminal_input(c->std_input))
 247                 return true;
 248
 249         if (is_terminal_output(c->std_output))
 250                 return true;
 251
 252         if (is_terminal_output(c->std_error))
 253                 return true;
 254
 255         return !!c->tty_path;
 256 }
 257
 258 static int open_null_as(int flags, int nfd) {
 259         int fd, r;
 260
 261         assert(nfd >= 0);
 262
 263         fd = open("/dev/null", flags|O_NOCTTY);
 264         if (fd < 0)
 265                 return -errno;
 266
 267         if (fd != nfd) {
 268                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 269                 safe_close(fd);
 270         } else
 271                 r = nfd;
 272
 273         return r;
 274 }
 275
 276 static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
 277         union sockaddr_union sa = {
 278                 .un.sun_family = AF_UNIX,
 279                 .un.sun_path = "/run/systemd/journal/stdout",
 280         };
 281         uid_t olduid = UID_INVALID;
 282         gid_t oldgid = GID_INVALID;
 283         int r;
 284
 285         if (gid != GID_INVALID) {
 286                 oldgid = getgid();
 287
 288                 r = setegid(gid);
 289                 if (r < 0)
 290                         return -errno;
 291         }
 292
 293         if (uid != UID_INVALID) {
 294                 olduid = getuid();
 295
 296                 r = seteuid(uid);
 297                 if (r < 0) {
 298                         r = -errno;
 299                         goto restore_gid;
 300                 }
 301         }
 302
 303         r = connect(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
 304         if (r < 0)
 305                 r = -errno;
 306
 307         /* If we fail to restore the uid or gid, things will likely
 308            fail later on. This should only happen if an LSM interferes. */
 309
 310         if (uid != UID_INVALID)
 311                 (void) seteuid(olduid);
 312
 313  restore_gid:
 314         if (gid != GID_INVALID)
 315                 (void) setegid(oldgid);
 316
 317         return r;
 318 }
 319
 320 static int connect_logger_as(
 321                 Unit *unit,
 322                 const ExecContext *context,
 323                 ExecOutput output,
 324                 const char *ident,
 325                 int nfd,
 326                 uid_t uid,
 327                 gid_t gid) {
 328
 329         int fd, r;
 330
 331         assert(context);
 332         assert(output < _EXEC_OUTPUT_MAX);
 333         assert(ident);
 334         assert(nfd >= 0);
 335
 336         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 337         if (fd < 0)
 338                 return -errno;
 339
 340         r = connect_journal_socket(fd, uid, gid);
 341         if (r < 0)
 342                 return r;
 343
 344         if (shutdown(fd, SHUT_RD) < 0) {
 345                 safe_close(fd);
 346                 return -errno;
 347         }
 348
 349         (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
 350
 351         dprintf(fd,
 352                 "%s\n"
 353                 "%s\n"
 354                 "%i\n"
 355                 "%i\n"
 356                 "%i\n"
 357                 "%i\n"
 358                 "%i\n",
 359                 context->syslog_identifier ? context->syslog_identifier : ident,
 360                 unit->id,
 361                 context->syslog_priority,
 362                 !!context->syslog_level_prefix,
 363                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 364                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 365                 is_terminal_output(output));
 366
 367         if (fd == nfd)
 368                 return nfd;
 369
 370         r = dup2(fd, nfd) < 0 ? -errno : nfd;
 371         safe_close(fd);
 372
 373         return r;
 374 }
 375 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 376         int fd, r;
 377
 378         assert(path);
 379         assert(nfd >= 0);
 380
 381         fd = open_terminal(path, mode | O_NOCTTY);
 382         if (fd < 0)
 383                 return fd;
 384
 385         if (fd != nfd) {
 386                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 387                 safe_close(fd);
 388         } else
 389                 r = nfd;
 390
 391         return r;
 392 }
 393
 394 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 395
 396         if (is_terminal_input(std_input) && !apply_tty_stdin)
 397                 return EXEC_INPUT_NULL;
 398
 399         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 400                 return EXEC_INPUT_NULL;
 401
 402         return std_input;
 403 }
 404
 405 static int fixup_output(ExecOutput std_output, int socket_fd) {
 406
 407         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 408                 return EXEC_OUTPUT_INHERIT;
 409
 410         return std_output;
 411 }
 412
 413 static int setup_input(
 414                 const ExecContext *context,
 415                 const ExecParameters *params,
 416                 int socket_fd,
 417                 int named_iofds[3]) {
 418
 419         ExecInput i;
 420
 421         assert(context);
 422         assert(params);
 423
 424         if (params->stdin_fd >= 0) {
 425                 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
 426                         return -errno;
 427
 428                 /* Try to make this the controlling tty, if it is a tty, and reset it */
 429                 (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
 430                 (void) reset_terminal_fd(STDIN_FILENO, true);
 431
 432                 return STDIN_FILENO;
 433         }
 434
 435         i = fixup_input(context->std_input, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 436
 437         switch (i) {
 438
 439         case EXEC_INPUT_NULL:
 440                 return open_null_as(O_RDONLY, STDIN_FILENO);
 441
 442         case EXEC_INPUT_TTY:
 443         case EXEC_INPUT_TTY_FORCE:
 444         case EXEC_INPUT_TTY_FAIL: {
 445                 int fd, r;
 446
 447                 fd = acquire_terminal(exec_context_tty_path(context),
 448                                       i == EXEC_INPUT_TTY_FAIL,
 449                                       i == EXEC_INPUT_TTY_FORCE,
 450                                       false,
 451                                       USEC_INFINITY);
 452                 if (fd < 0)
 453                         return fd;
 454
 455                 if (fd != STDIN_FILENO) {
 456                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 457                         safe_close(fd);
 458                 } else
 459                         r = STDIN_FILENO;
 460
 461                 return r;
 462         }
 463
 464         case EXEC_INPUT_SOCKET:
 465                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 466
 467         case EXEC_INPUT_NAMED_FD:
 468                 (void) fd_nonblock(named_iofds[STDIN_FILENO], false);
 469                 return dup2(named_iofds[STDIN_FILENO], STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 470
 471         default:
 472                 assert_not_reached("Unknown input type");
 473         }
 474 }
 475
 476 static int setup_output(
 477                 Unit *unit,
 478                 const ExecContext *context,
 479                 const ExecParameters *params,
 480                 int fileno,
 481                 int socket_fd,
 482                 int named_iofds[3],
 483                 const char *ident,
 484                 uid_t uid,
 485                 gid_t gid,
 486                 dev_t *journal_stream_dev,
 487                 ino_t *journal_stream_ino) {
 488
 489         ExecOutput o;
 490         ExecInput i;
 491         int r;
 492
 493         assert(unit);
 494         assert(context);
 495         assert(params);
 496         assert(ident);
 497         assert(journal_stream_dev);
 498         assert(journal_stream_ino);
 499
 500         if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
 501
 502                 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
 503                         return -errno;
 504
 505                 return STDOUT_FILENO;
 506         }
 507
 508         if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
 509                 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
 510                         return -errno;
 511
 512                 return STDERR_FILENO;
 513         }
 514
 515         i = fixup_input(context->std_input, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 516         o = fixup_output(context->std_output, socket_fd);
 517
 518         if (fileno == STDERR_FILENO) {
 519                 ExecOutput e;
 520                 e = fixup_output(context->std_error, socket_fd);
 521
 522                 /* This expects the input and output are already set up */
 523
 524                 /* Don't change the stderr file descriptor if we inherit all
 525                  * the way and are not on a tty */
 526                 if (e == EXEC_OUTPUT_INHERIT &&
 527                     o == EXEC_OUTPUT_INHERIT &&
 528                     i == EXEC_INPUT_NULL &&
 529                     !is_terminal_input(context->std_input) &&
 530                     getppid () != 1)
 531                         return fileno;
 532
 533                 /* Duplicate from stdout if possible */
 534                 if ((e == o && e != EXEC_OUTPUT_NAMED_FD) || e == EXEC_OUTPUT_INHERIT)
 535                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 536
 537                 o = e;
 538
 539         } else if (o == EXEC_OUTPUT_INHERIT) {
 540                 /* If input got downgraded, inherit the original value */
 541                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 542                         return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 543
 544                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 545                 if (i != EXEC_INPUT_NULL)
 546                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 547
 548                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 549                 if (getppid() != 1)
 550                         return fileno;
 551
 552                 /* We need to open /dev/null here anew, to get the right access mode. */
 553                 return open_null_as(O_WRONLY, fileno);
 554         }
 555
 556         switch (o) {
 557
 558         case EXEC_OUTPUT_NULL:
 559                 return open_null_as(O_WRONLY, fileno);
 560
 561         case EXEC_OUTPUT_TTY:
 562                 if (is_terminal_input(i))
 563                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 564
 565                 /* We don't reset the terminal if this is just about output */
 566                 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 567
 568         case EXEC_OUTPUT_SYSLOG:
 569         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 570         case EXEC_OUTPUT_KMSG:
 571         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 572         case EXEC_OUTPUT_JOURNAL:
 573         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 574                 r = connect_logger_as(unit, context, o, ident, fileno, uid, gid);
 575                 if (r < 0) {
 576                         log_unit_error_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
 577                         r = open_null_as(O_WRONLY, fileno);
 578                 } else {
 579                         struct stat st;
 580
 581                         /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
 582                          * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
 583                          * services to detect whether they are connected to the journal or not. */
 584
 585                         if (fstat(fileno, &st) >= 0) {
 586                                 *journal_stream_dev = st.st_dev;
 587                                 *journal_stream_ino = st.st_ino;
 588                         }
 589                 }
 590                 return r;
 591
 592         case EXEC_OUTPUT_SOCKET:
 593                 assert(socket_fd >= 0);
 594                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 595
 596         case EXEC_OUTPUT_NAMED_FD:
 597                 (void) fd_nonblock(named_iofds[fileno], false);
 598                 return dup2(named_iofds[fileno], fileno) < 0 ? -errno : fileno;
 599
 600         default:
 601                 assert_not_reached("Unknown error type");
 602         }
 603 }
 604
 605 static int chown_terminal(int fd, uid_t uid) {
 606         struct stat st;
 607
 608         assert(fd >= 0);
 609
 610         /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
 611         if (isatty(fd) < 1)
 612                 return 0;
 613
 614         /* This might fail. What matters are the results. */
 615         (void) fchown(fd, uid, -1);
 616         (void) fchmod(fd, TTY_MODE);
 617
 618         if (fstat(fd, &st) < 0)
 619                 return -errno;
 620
 621         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 622                 return -EPERM;
 623
 624         return 0;
 625 }
 626
 627 static int setup_confirm_stdio(const char *vc, int *_saved_stdin, int *_saved_stdout) {
 628         _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
 629         int r;
 630
 631         assert(_saved_stdin);
 632         assert(_saved_stdout);
 633
 634         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 635         if (saved_stdin < 0)
 636                 return -errno;
 637
 638         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 639         if (saved_stdout < 0)
 640                 return -errno;
 641
 642         fd = acquire_terminal(vc, false, false, false, DEFAULT_CONFIRM_USEC);
 643         if (fd < 0)
 644                 return fd;
 645
 646         r = chown_terminal(fd, getuid());
 647         if (r < 0)
 648                 return r;
 649
 650         r = reset_terminal_fd(fd, true);
 651         if (r < 0)
 652                 return r;
 653
 654         if (dup2(fd, STDIN_FILENO) < 0)
 655                 return -errno;
 656
 657         if (dup2(fd, STDOUT_FILENO) < 0)
 658                 return -errno;
 659
 660         if (fd >= 2)
 661                 safe_close(fd);
 662         fd = -1;
 663
 664         *_saved_stdin = saved_stdin;
 665         *_saved_stdout = saved_stdout;
 666
 667         saved_stdin = saved_stdout = -1;
 668
 669         return 0;
 670 }
 671
 672 static void write_confirm_error_fd(int err, int fd, const Unit *u) {
 673         assert(err < 0);
 674
 675         if (err == -ETIMEDOUT)
 676                 dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);
 677         else {
 678                 errno = -err;
 679                 dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);
 680         }
 681 }
 682
 683 static void write_confirm_error(int err, const char *vc, const Unit *u) {
 684         _cleanup_close_ int fd = -1;
 685
 686         assert(vc);
 687
 688         fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);
 689         if (fd < 0)
 690                 return;
 691
 692         write_confirm_error_fd(err, fd, u);
 693 }
 694
 695 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
 696         int r = 0;
 697
 698         assert(saved_stdin);
 699         assert(saved_stdout);
 700
 701         release_terminal();
 702
 703         if (*saved_stdin >= 0)
 704                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 705                         r = -errno;
 706
 707         if (*saved_stdout >= 0)
 708                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 709                         r = -errno;
 710
 711         *saved_stdin = safe_close(*saved_stdin);
 712         *saved_stdout = safe_close(*saved_stdout);
 713
 714         return r;
 715 }
 716
 717 enum {
 718         CONFIRM_PRETEND_FAILURE = -1,
 719         CONFIRM_PRETEND_SUCCESS =  0,
 720         CONFIRM_EXECUTE = 1,
 721 };
 722
 723 static int ask_for_confirmation(const char *vc, Unit *u, const char *cmdline) {
 724         int saved_stdout = -1, saved_stdin = -1, r;
 725         _cleanup_free_ char *e = NULL;
 726         char c;
 727
 728         /* For any internal errors, assume a positive response. */
 729         r = setup_confirm_stdio(vc, &saved_stdin, &saved_stdout);
 730         if (r < 0) {
 731                 write_confirm_error(r, vc, u);
 732                 return CONFIRM_EXECUTE;
 733         }
 734
 735         /* confirm_spawn might have been disabled while we were sleeping. */
 736         if (manager_is_confirm_spawn_disabled(u->manager)) {
 737                 r = 1;
 738                 goto restore_stdio;
 739         }
 740
 741         e = ellipsize(cmdline, 60, 100);
 742         if (!e) {
 743                 log_oom();
 744                 r = CONFIRM_EXECUTE;
 745                 goto restore_stdio;
 746         }
 747
 748         for (;;) {
 749                 r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);
 750                 if (r < 0) {
 751                         write_confirm_error_fd(r, STDOUT_FILENO, u);
 752                         r = CONFIRM_EXECUTE;
 753                         goto restore_stdio;
 754                 }
 755
 756                 switch (c) {
 757                 case 'c':
 758                         printf("Resuming normal execution.\n");
 759                         manager_disable_confirm_spawn();
 760                         r = 1;
 761                         break;
 762                 case 'D':
 763                         unit_dump(u, stdout, "  ");
 764                         continue; /* ask again */
 765                 case 'f':
 766                         printf("Failing execution.\n");
 767                         r = CONFIRM_PRETEND_FAILURE;
 768                         break;
 769                 case 'h':
 770                         printf("  c - continue, proceed without asking anymore\n"
 771                                "  D - dump, show the state of the unit\n"
 772                                "  f - fail, don't execute the command and pretend it failed\n"
 773                                "  h - help\n"
 774                                "  i - info, show a short summary of the unit\n"
 775                                "  j - jobs, show jobs that are in progress\n"
 776                                "  s - skip, don't execute the command and pretend it succeeded\n"
 777                                "  y - yes, execute the command\n");
 778                         continue; /* ask again */
 779                 case 'i':
 780                         printf("  Description: %s\n"
 781                                "  Unit:        %s\n"
 782                                "  Command:     %s\n",
 783                                u->id, u->description, cmdline);
 784                         continue; /* ask again */
 785                 case 'j':
 786                         manager_dump_jobs(u->manager, stdout, "  ");
 787                         continue; /* ask again */
 788                 case 'n':
 789                         /* 'n' was removed in favor of 'f'. */
 790                         printf("Didn't understand 'n', did you mean 'f'?\n");
 791                         continue; /* ask again */
 792                 case 's':
 793                         printf("Skipping execution.\n");
 794                         r = CONFIRM_PRETEND_SUCCESS;
 795                         break;
 796                 case 'y':
 797                         r = CONFIRM_EXECUTE;
 798                         break;
 799                 default:
 800                         assert_not_reached("Unhandled choice");
 801                 }
 802                 break;
 803         }
 804
 805 restore_stdio:
 806         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 807         return r;
 808 }
 809
 810 static int get_fixed_user(const ExecContext *c, const char **user,
 811                           uid_t *uid, gid_t *gid,
 812                           const char **home, const char **shell) {
 813         int r;
 814         const char *name;
 815
 816         assert(c);
 817
 818         if (!c->user)
 819                 return 0;
 820
 821         /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway
 822          * (i.e. are "/" or "/bin/nologin"). */
 823
 824         name = c->user;
 825         r = get_user_creds_clean(&name, uid, gid, home, shell);
 826         if (r < 0)
 827                 return r;
 828
 829         *user = name;
 830         return 0;
 831 }
 832
 833 static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {
 834         int r;
 835         const char *name;
 836
 837         assert(c);
 838
 839         if (!c->group)
 840                 return 0;
 841
 842         name = c->group;
 843         r = get_group_creds(&name, gid);
 844         if (r < 0)
 845                 return r;
 846
 847         *group = name;
 848         return 0;
 849 }
 850
 851 static int get_supplementary_groups(const ExecContext *c, const char *user,
 852                                     const char *group, gid_t gid,
 853                                     gid_t **supplementary_gids, int *ngids) {
 854         char **i;
 855         int r, k = 0;
 856         int ngroups_max;
 857         bool keep_groups = false;
 858         gid_t *groups = NULL;
 859         _cleanup_free_ gid_t *l_gids = NULL;
 860
 861         assert(c);
 862
 863         /*
 864          * If user is given, then lookup GID and supplementary groups list.
 865          * We avoid NSS lookups for gid=0. Also we have to initialize groups
 866          * here and as early as possible so we keep the list of supplementary
 867          * groups of the caller.
 868          */
 869         if (user && gid_is_valid(gid) && gid != 0) {
 870                 /* First step, initialize groups from /etc/groups */
 871                 if (initgroups(user, gid) < 0)
 872                         return -errno;
 873
 874                 keep_groups = true;
 875         }
 876
 877         if (!c->supplementary_groups)
 878                 return 0;
 879
 880         /*
 881          * If SupplementaryGroups= was passed then NGROUPS_MAX has to
 882          * be positive, otherwise fail.
 883          */
 884         errno = 0;
 885         ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
 886         if (ngroups_max <= 0) {
 887                 if (errno > 0)
 888                         return -errno;
 889                 else
 890                         return -EOPNOTSUPP; /* For all other values */
 891         }
 892
 893         l_gids = new(gid_t, ngroups_max);
 894         if (!l_gids)
 895                 return -ENOMEM;
 896
 897         if (keep_groups) {
 898                 /*
 899                  * Lookup the list of groups that the user belongs to, we
 900                  * avoid NSS lookups here too for gid=0.
 901                  */
 902                 k = ngroups_max;
 903                 if (getgrouplist(user, gid, l_gids, &k) < 0)
 904                         return -EINVAL;
 905         } else
 906                 k = 0;
 907
 908         STRV_FOREACH(i, c->supplementary_groups) {
 909                 const char *g;
 910
 911                 if (k >= ngroups_max)
 912                         return -E2BIG;
 913
 914                 g = *i;
 915                 r = get_group_creds(&g, l_gids+k);
 916                 if (r < 0)
 917                         return r;
 918
 919                 k++;
 920         }
 921
 922         /*
 923          * Sets ngids to zero to drop all supplementary groups, happens
 924          * when we are under root and SupplementaryGroups= is empty.
 925          */
 926         if (k == 0) {
 927                 *ngids = 0;
 928                 return 0;
 929         }
 930
 931         /* Otherwise get the final list of supplementary groups */
 932         groups = memdup(l_gids, sizeof(gid_t) * k);
 933         if (!groups)
 934                 return -ENOMEM;
 935
 936         *supplementary_gids = groups;
 937         *ngids = k;
 938
 939         groups = NULL;
 940
 941         return 0;
 942 }
 943
 944 static int enforce_groups(const ExecContext *context, gid_t gid,
 945                           gid_t *supplementary_gids, int ngids) {
 946         int r;
 947
 948         assert(context);
 949
 950         /* Handle SupplementaryGroups= even if it is empty */
 951         if (context->supplementary_groups) {
 952                 r = maybe_setgroups(ngids, supplementary_gids);
 953                 if (r < 0)
 954                         return r;
 955         }
 956
 957         if (gid_is_valid(gid)) {
 958                 /* Then set our gids */
 959                 if (setresgid(gid, gid, gid) < 0)
 960                         return -errno;
 961         }
 962
 963         return 0;
 964 }
 965
 966 static int enforce_user(const ExecContext *context, uid_t uid) {
 967         assert(context);
 968
 969         if (!uid_is_valid(uid))
 970                 return 0;
 971
 972         /* Sets (but doesn't look up) the uid and make sure we keep the
 973          * capabilities while doing so. */
 974
 975         if (context->capability_ambient_set != 0) {
 976
 977                 /* First step: If we need to keep capabilities but
 978                  * drop privileges we need to make sure we keep our
 979                  * caps, while we drop privileges. */
 980                 if (uid != 0) {
 981                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 982
 983                         if (prctl(PR_GET_SECUREBITS) != sb)
 984                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 985                                         return -errno;
 986                 }
 987         }
 988
 989         /* Second step: actually set the uids */
 990         if (setresuid(uid, uid, uid) < 0)
 991                 return -errno;
 992
 993         /* At this point we should have all necessary capabilities but
 994            are otherwise a normal user. However, the caps might got
 995            corrupted due to the setresuid() so we need clean them up
 996            later. This is done outside of this call. */
 997
 998         return 0;
 999 }
1000
1001 #ifdef HAVE_PAM
1002
1003 static int null_conv(
1004                 int num_msg,
1005                 const struct pam_message **msg,
1006                 struct pam_response **resp,
1007                 void *appdata_ptr) {
1008
1009         /* We don't support conversations */
1010
1011         return PAM_CONV_ERR;
1012 }
1013
1014 #endif
1015
1016 static int setup_pam(
1017                 const char *name,
1018                 const char *user,
1019                 uid_t uid,
1020                 gid_t gid,
1021                 const char *tty,
1022                 char ***env,
1023                 int fds[], unsigned n_fds) {
1024
1025 #ifdef HAVE_PAM
1026
1027         static const struct pam_conv conv = {
1028                 .conv = null_conv,
1029                 .appdata_ptr = NULL
1030         };
1031
1032         _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
1033         pam_handle_t *handle = NULL;
1034         sigset_t old_ss;
1035         int pam_code = PAM_SUCCESS, r;
1036         char **nv, **e = NULL;
1037         bool close_session = false;
1038         pid_t pam_pid = 0, parent_pid;
1039         int flags = 0;
1040
1041         assert(name);
1042         assert(user);
1043         assert(env);
1044
1045         /* We set up PAM in the parent process, then fork. The child
1046          * will then stay around until killed via PR_GET_PDEATHSIG or
1047          * systemd via the cgroup logic. It will then remove the PAM
1048          * session again. The parent process will exec() the actual
1049          * daemon. We do things this way to ensure that the main PID
1050          * of the daemon is the one we initially fork()ed. */
1051
1052         r = barrier_create(&barrier);
1053         if (r < 0)
1054                 goto fail;
1055
1056         if (log_get_max_level() < LOG_DEBUG)
1057                 flags |= PAM_SILENT;
1058
1059         pam_code = pam_start(name, user, &conv, &handle);
1060         if (pam_code != PAM_SUCCESS) {
1061                 handle = NULL;
1062                 goto fail;
1063         }
1064
1065         if (tty) {
1066                 pam_code = pam_set_item(handle, PAM_TTY, tty);
1067                 if (pam_code != PAM_SUCCESS)
1068                         goto fail;
1069         }
1070
1071         STRV_FOREACH(nv, *env) {
1072                 pam_code = pam_putenv(handle, *nv);
1073                 if (pam_code != PAM_SUCCESS)
1074                         goto fail;
1075         }
1076
1077         pam_code = pam_acct_mgmt(handle, flags);
1078         if (pam_code != PAM_SUCCESS)
1079                 goto fail;
1080
1081         pam_code = pam_open_session(handle, flags);
1082         if (pam_code != PAM_SUCCESS)
1083                 goto fail;
1084
1085         close_session = true;
1086
1087         e = pam_getenvlist(handle);
1088         if (!e) {
1089                 pam_code = PAM_BUF_ERR;
1090                 goto fail;
1091         }
1092
1093         /* Block SIGTERM, so that we know that it won't get lost in
1094          * the child */
1095
1096         assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
1097
1098         parent_pid = getpid();
1099
1100         pam_pid = fork();
1101         if (pam_pid < 0) {
1102                 r = -errno;
1103                 goto fail;
1104         }
1105
1106         if (pam_pid == 0) {
1107                 int sig, ret = EXIT_PAM;
1108
1109                 /* The child's job is to reset the PAM session on
1110                  * termination */
1111                 barrier_set_role(&barrier, BARRIER_CHILD);
1112
1113                 /* This string must fit in 10 chars (i.e. the length
1114                  * of "/sbin/init"), to look pretty in /bin/ps */
1115                 rename_process("(sd-pam)");
1116
1117                 /* Make sure we don't keep open the passed fds in this
1118                 child. We assume that otherwise only those fds are
1119                 open here that have been opened by PAM. */
1120                 close_many(fds, n_fds);
1121
1122                 /* Drop privileges - we don't need any to pam_close_session
1123                  * and this will make PR_SET_PDEATHSIG work in most cases.
1124                  * If this fails, ignore the error - but expect sd-pam threads
1125                  * to fail to exit normally */
1126
1127                 r = maybe_setgroups(0, NULL);
1128                 if (r < 0)
1129                         log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
1130                 if (setresgid(gid, gid, gid) < 0)
1131                         log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
1132                 if (setresuid(uid, uid, uid) < 0)
1133                         log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m");
1134
1135                 (void) ignore_signals(SIGPIPE, -1);
1136
1137                 /* Wait until our parent died. This will only work if
1138                  * the above setresuid() succeeds, otherwise the kernel
1139                  * will not allow unprivileged parents kill their privileged
1140                  * children this way. We rely on the control groups kill logic
1141                  * to do the rest for us. */
1142                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
1143                         goto child_finish;
1144
1145                 /* Tell the parent that our setup is done. This is especially
1146                  * important regarding dropping privileges. Otherwise, unit
1147                  * setup might race against our setresuid(2) call. */
1148                 barrier_place(&barrier);
1149
1150                 /* Check if our parent process might already have
1151                  * died? */
1152                 if (getppid() == parent_pid) {
1153                         sigset_t ss;
1154
1155                         assert_se(sigemptyset(&ss) >= 0);
1156                         assert_se(sigaddset(&ss, SIGTERM) >= 0);
1157
1158                         for (;;) {
1159                                 if (sigwait(&ss, &sig) < 0) {
1160                                         if (errno == EINTR)
1161                                                 continue;
1162
1163                                         goto child_finish;
1164                                 }
1165
1166                                 assert(sig == SIGTERM);
1167                                 break;
1168                         }
1169                 }
1170
1171                 /* If our parent died we'll end the session */
1172                 if (getppid() != parent_pid) {
1173                         pam_code = pam_close_session(handle, flags);
1174                         if (pam_code != PAM_SUCCESS)
1175                                 goto child_finish;
1176                 }
1177
1178                 ret = 0;
1179
1180         child_finish:
1181                 pam_end(handle, pam_code | flags);
1182                 _exit(ret);
1183         }
1184
1185         barrier_set_role(&barrier, BARRIER_PARENT);
1186
1187         /* If the child was forked off successfully it will do all the
1188          * cleanups, so forget about the handle here. */
1189         handle = NULL;
1190
1191         /* Unblock SIGTERM again in the parent */
1192         assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
1193
1194         /* We close the log explicitly here, since the PAM modules
1195          * might have opened it, but we don't want this fd around. */
1196         closelog();
1197
1198         /* Synchronously wait for the child to initialize. We don't care for
1199          * errors as we cannot recover. However, warn loudly if it happens. */
1200         if (!barrier_place_and_sync(&barrier))
1201                 log_error("PAM initialization failed");
1202
1203         strv_free(*env);
1204         *env = e;
1205
1206         return 0;
1207
1208 fail:
1209         if (pam_code != PAM_SUCCESS) {
1210                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1211                 r = -EPERM;  /* PAM errors do not map to errno */
1212         } else
1213                 log_error_errno(r, "PAM failed: %m");
1214
1215         if (handle) {
1216                 if (close_session)
1217                         pam_code = pam_close_session(handle, flags);
1218
1219                 pam_end(handle, pam_code | flags);
1220         }
1221
1222         strv_free(e);
1223         closelog();
1224
1225         return r;
1226 #else
1227         return 0;
1228 #endif
1229 }
1230
1231 static void rename_process_from_path(const char *path) {
1232         char process_name[11];
1233         const char *p;
1234         size_t l;
1235
1236         /* This resulting string must fit in 10 chars (i.e. the length
1237          * of "/sbin/init") to look pretty in /bin/ps */
1238
1239         p = basename(path);
1240         if (isempty(p)) {
1241                 rename_process("(...)");
1242                 return;
1243         }
1244
1245         l = strlen(p);
1246         if (l > 8) {
1247                 /* The end of the process name is usually more
1248                  * interesting, since the first bit might just be
1249                  * "systemd-" */
1250                 p = p + l - 8;
1251                 l = 8;
1252         }
1253
1254         process_name[0] = '(';
1255         memcpy(process_name+1, p, l);
1256         process_name[1+l] = ')';
1257         process_name[1+l+1] = 0;
1258
1259         rename_process(process_name);
1260 }
1261
1262 #ifdef HAVE_SECCOMP
1263
1264 static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
1265
1266         if (is_seccomp_available())
1267                 return false;
1268
1269         log_open();
1270         log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
1271         log_close();
1272         return true;
1273 }
1274
1275 static int apply_seccomp(const Unit* u, const ExecContext *c) {
1276         uint32_t negative_action, action;
1277         scmp_filter_ctx seccomp;
1278         Iterator i;
1279         void *id;
1280         int r;
1281
1282         assert(c);
1283
1284         if (skip_seccomp_unavailable(u, "syscall filtering"))
1285                 return 0;
1286
1287         negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
1288
1289         seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
1290         if (!seccomp)
1291                 return -ENOMEM;
1292
1293         if (c->syscall_archs) {
1294
1295                 SET_FOREACH(id, c->syscall_archs, i) {
1296                         r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
1297                         if (r == -EEXIST)
1298                                 continue;
1299                         if (r < 0)
1300                                 goto finish;
1301                 }
1302
1303         } else {
1304                 r = seccomp_add_secondary_archs(seccomp);
1305                 if (r < 0)
1306                         goto finish;
1307         }
1308
1309         action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
1310         SET_FOREACH(id, c->syscall_filter, i) {
1311                 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
1312                 if (r < 0)
1313                         goto finish;
1314         }
1315
1316         r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1317         if (r < 0)
1318                 goto finish;
1319
1320         r = seccomp_load(seccomp);
1321
1322 finish:
1323         seccomp_release(seccomp);
1324         return r;
1325 }
1326
1327 static int apply_address_families(const Unit* u, const ExecContext *c) {
1328         scmp_filter_ctx seccomp;
1329         Iterator i;
1330         int r;
1331
1332         assert(c);
1333
1334         if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1335                 return 0;
1336
1337         r = seccomp_init_conservative(&seccomp, SCMP_ACT_ALLOW);
1338         if (r < 0)
1339                 return r;
1340
1341         if (c->address_families_whitelist) {
1342                 int af, first = 0, last = 0;
1343                 void *afp;
1344
1345                 /* If this is a whitelist, we first block the address
1346                  * families that are out of range and then everything
1347                  * that is not in the set. First, we find the lowest
1348                  * and highest address family in the set. */
1349
1350                 SET_FOREACH(afp, c->address_families, i) {
1351                         af = PTR_TO_INT(afp);
1352
1353                         if (af <= 0 || af >= af_max())
1354                                 continue;
1355
1356                         if (first == 0 || af < first)
1357                                 first = af;
1358
1359                         if (last == 0 || af > last)
1360                                 last = af;
1361                 }
1362
1363                 assert((first == 0) == (last == 0));
1364
1365                 if (first == 0) {
1366
1367                         /* No entries in the valid range, block everything */
1368                         r = seccomp_rule_add(
1369                                         seccomp,
1370                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1371                                         SCMP_SYS(socket),
1372                                         0);
1373                         if (r < 0)
1374                                 goto finish;
1375
1376                 } else {
1377
1378                         /* Block everything below the first entry */
1379                         r = seccomp_rule_add(
1380                                         seccomp,
1381                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1382                                         SCMP_SYS(socket),
1383                                         1,
1384                                         SCMP_A0(SCMP_CMP_LT, first));
1385                         if (r < 0)
1386                                 goto finish;
1387
1388                         /* Block everything above the last entry */
1389                         r = seccomp_rule_add(
1390                                         seccomp,
1391                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1392                                         SCMP_SYS(socket),
1393                                         1,
1394                                         SCMP_A0(SCMP_CMP_GT, last));
1395                         if (r < 0)
1396                                 goto finish;
1397
1398                         /* Block everything between the first and last
1399                          * entry */
1400                         for (af = 1; af < af_max(); af++) {
1401
1402                                 if (set_contains(c->address_families, INT_TO_PTR(af)))
1403                                         continue;
1404
1405                                 r = seccomp_rule_add(
1406                                                 seccomp,
1407                                                 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1408                                                 SCMP_SYS(socket),
1409                                                 1,
1410                                                 SCMP_A0(SCMP_CMP_EQ, af));
1411                                 if (r < 0)
1412                                         goto finish;
1413                         }
1414                 }
1415
1416         } else {
1417                 void *af;
1418
1419                 /* If this is a blacklist, then generate one rule for
1420                  * each address family that are then combined in OR
1421                  * checks. */
1422
1423                 SET_FOREACH(af, c->address_families, i) {
1424
1425                         r = seccomp_rule_add(
1426                                         seccomp,
1427                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1428                                         SCMP_SYS(socket),
1429                                         1,
1430                                         SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
1431                         if (r < 0)
1432                                 goto finish;
1433                 }
1434         }
1435
1436         r = seccomp_load(seccomp);
1437
1438 finish:
1439         seccomp_release(seccomp);
1440         return r;
1441 }
1442
1443 static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
1444         scmp_filter_ctx seccomp;
1445         int r;
1446
1447         assert(c);
1448
1449         if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1450                 return 0;
1451
1452         r = seccomp_init_conservative(&seccomp, SCMP_ACT_ALLOW);
1453         if (r < 0)
1454                 return r;
1455
1456         r = seccomp_rule_add(
1457                         seccomp,
1458                         SCMP_ACT_ERRNO(EPERM),
1459                         SCMP_SYS(mmap),
1460                         1,
1461                         SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC|PROT_WRITE, PROT_EXEC|PROT_WRITE));
1462         if (r < 0)
1463                 goto finish;
1464
1465         r = seccomp_rule_add(
1466                         seccomp,
1467                         SCMP_ACT_ERRNO(EPERM),
1468                         SCMP_SYS(mprotect),
1469                         1,
1470                         SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC, PROT_EXEC));
1471         if (r < 0)
1472                 goto finish;
1473
1474         r = seccomp_rule_add(
1475                         seccomp,
1476                         SCMP_ACT_ERRNO(EPERM),
1477                         SCMP_SYS(shmat),
1478                         1,
1479                         SCMP_A2(SCMP_CMP_MASKED_EQ, SHM_EXEC, SHM_EXEC));
1480         if (r < 0)
1481                 goto finish;
1482
1483         r = seccomp_load(seccomp);
1484
1485 finish:
1486         seccomp_release(seccomp);
1487         return r;
1488 }
1489
1490 static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
1491         static const int permitted_policies[] = {
1492                 SCHED_OTHER,
1493                 SCHED_BATCH,
1494                 SCHED_IDLE,
1495         };
1496
1497         scmp_filter_ctx seccomp;
1498         unsigned i;
1499         int r, p, max_policy = 0;
1500
1501         assert(c);
1502
1503         if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1504                 return 0;
1505
1506         r = seccomp_init_conservative(&seccomp, SCMP_ACT_ALLOW);
1507         if (r < 0)
1508                 return r;
1509
1510         /* Determine the highest policy constant we want to allow */
1511         for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
1512                 if (permitted_policies[i] > max_policy)
1513                         max_policy = permitted_policies[i];
1514
1515         /* Go through all policies with lower values than that, and block them -- unless they appear in the
1516          * whitelist. */
1517         for (p = 0; p < max_policy; p++) {
1518                 bool good = false;
1519
1520                 /* Check if this is in the whitelist. */
1521                 for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
1522                         if (permitted_policies[i] == p) {
1523                                 good = true;
1524                                 break;
1525                         }
1526
1527                 if (good)
1528                         continue;
1529
1530                 /* Deny this policy */
1531                 r = seccomp_rule_add(
1532                                 seccomp,
1533                                 SCMP_ACT_ERRNO(EPERM),
1534                                 SCMP_SYS(sched_setscheduler),
1535                                 1,
1536                                 SCMP_A1(SCMP_CMP_EQ, p));
1537                 if (r < 0)
1538                         goto finish;
1539         }
1540
1541         /* Blacklist all other policies, i.e. the ones with higher values. Note that all comparisons are unsigned here,
1542          * hence no need no check for < 0 values. */
1543         r = seccomp_rule_add(
1544                         seccomp,
1545                         SCMP_ACT_ERRNO(EPERM),
1546                         SCMP_SYS(sched_setscheduler),
1547                         1,
1548                         SCMP_A1(SCMP_CMP_GT, max_policy));
1549         if (r < 0)
1550                 goto finish;
1551
1552         r = seccomp_load(seccomp);
1553
1554 finish:
1555         seccomp_release(seccomp);
1556         return r;
1557 }
1558
1559 static int apply_protect_sysctl(const Unit *u, const ExecContext *c) {
1560         scmp_filter_ctx seccomp;
1561         int r;
1562
1563         assert(c);
1564
1565         /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1566          * let's protect even those systems where this is left on in the kernel. */
1567
1568         if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1569                 return 0;
1570
1571         r = seccomp_init_conservative(&seccomp, SCMP_ACT_ALLOW);
1572         if (r < 0)
1573                 return r;
1574
1575         r = seccomp_rule_add(
1576                         seccomp,
1577                         SCMP_ACT_ERRNO(EPERM),
1578                         SCMP_SYS(_sysctl),
1579                         0);
1580         if (r < 0)
1581                 goto finish;
1582
1583         r = seccomp_load(seccomp);
1584
1585 finish:
1586         seccomp_release(seccomp);
1587         return r;
1588 }
1589
1590 static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
1591         assert(c);
1592
1593         /* Turn off module syscalls on ProtectKernelModules=yes */
1594
1595         if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
1596                 return 0;
1597
1598         return seccomp_load_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM));
1599 }
1600
1601 static int apply_private_devices(const Unit *u, const ExecContext *c) {
1602         assert(c);
1603
1604         /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */
1605
1606         if (skip_seccomp_unavailable(u, "PrivateDevices="))
1607                 return 0;
1608
1609         return seccomp_load_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM));
1610 }
1611
1612 static int apply_restrict_namespaces(Unit *u, const ExecContext *c) {
1613         assert(c);
1614
1615         if (!exec_context_restrict_namespaces_set(c))
1616                 return 0;
1617
1618         if (skip_seccomp_unavailable(u, "RestrictNamespaces="))
1619                 return 0;
1620
1621         return seccomp_restrict_namespaces(c->restrict_namespaces);
1622 }
1623
1624 #endif
1625
1626 static void do_idle_pipe_dance(int idle_pipe[4]) {
1627         assert(idle_pipe);
1628
1629         idle_pipe[1] = safe_close(idle_pipe[1]);
1630         idle_pipe[2] = safe_close(idle_pipe[2]);
1631
1632         if (idle_pipe[0] >= 0) {
1633                 int r;
1634
1635                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1636
1637                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1638                         ssize_t n;
1639
1640                         /* Signal systemd that we are bored and want to continue. */
1641                         n = write(idle_pipe[3], "x", 1);
1642                         if (n > 0)
1643                                 /* Wait for systemd to react to the signal above. */
1644                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1645                 }
1646
1647                 idle_pipe[0] = safe_close(idle_pipe[0]);
1648
1649         }
1650
1651         idle_pipe[3] = safe_close(idle_pipe[3]);
1652 }
1653
1654 static int build_environment(
1655                 Unit *u,
1656                 const ExecContext *c,
1657                 const ExecParameters *p,
1658                 unsigned n_fds,
1659                 const char *home,
1660                 const char *username,
1661                 const char *shell,
1662                 dev_t journal_stream_dev,
1663                 ino_t journal_stream_ino,
1664                 char ***ret) {
1665
1666         _cleanup_strv_free_ char **our_env = NULL;
1667         unsigned n_env = 0;
1668         char *x;
1669
1670         assert(u);
1671         assert(c);
1672         assert(ret);
1673
1674         our_env = new0(char*, 14);
1675         if (!our_env)
1676                 return -ENOMEM;
1677
1678         if (n_fds > 0) {
1679                 _cleanup_free_ char *joined = NULL;
1680
1681                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
1682                         return -ENOMEM;
1683                 our_env[n_env++] = x;
1684
1685                 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1686                         return -ENOMEM;
1687                 our_env[n_env++] = x;
1688
1689                 joined = strv_join(p->fd_names, ":");
1690                 if (!joined)
1691                         return -ENOMEM;
1692
1693                 x = strjoin("LISTEN_FDNAMES=", joined);
1694                 if (!x)
1695                         return -ENOMEM;
1696                 our_env[n_env++] = x;
1697         }
1698
1699         if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
1700                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
1701                         return -ENOMEM;
1702                 our_env[n_env++] = x;
1703
1704                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1705                         return -ENOMEM;
1706                 our_env[n_env++] = x;
1707         }
1708
1709         /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use D-Bus look up dynamic
1710          * users via PID 1, possibly dead-locking the dbus daemon. This way it will not use D-Bus to resolve names, but
1711          * check the database directly. */
1712         if (unit_has_name(u, SPECIAL_DBUS_SERVICE)) {
1713                 x = strdup("SYSTEMD_NSS_BYPASS_BUS=1");
1714                 if (!x)
1715                         return -ENOMEM;
1716                 our_env[n_env++] = x;
1717         }
1718
1719         if (home) {
1720                 x = strappend("HOME=", home);
1721                 if (!x)
1722                         return -ENOMEM;
1723                 our_env[n_env++] = x;
1724         }
1725
1726         if (username) {
1727                 x = strappend("LOGNAME=", username);
1728                 if (!x)
1729                         return -ENOMEM;
1730                 our_env[n_env++] = x;
1731
1732                 x = strappend("USER=", username);
1733                 if (!x)
1734                         return -ENOMEM;
1735                 our_env[n_env++] = x;
1736         }
1737
1738         if (shell) {
1739                 x = strappend("SHELL=", shell);
1740                 if (!x)
1741                         return -ENOMEM;
1742                 our_env[n_env++] = x;
1743         }
1744
1745         if (!sd_id128_is_null(u->invocation_id)) {
1746                 if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0)
1747                         return -ENOMEM;
1748
1749                 our_env[n_env++] = x;
1750         }
1751
1752         if (exec_context_needs_term(c)) {
1753                 const char *tty_path, *term = NULL;
1754
1755                 tty_path = exec_context_tty_path(c);
1756
1757                 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try to inherit
1758                  * the $TERM set for PID 1. This is useful for containers so that the $TERM the container manager
1759                  * passes to PID 1 ends up all the way in the console login shown. */
1760
1761                 if (path_equal(tty_path, "/dev/console") && getppid() == 1)
1762                         term = getenv("TERM");
1763                 if (!term)
1764                         term = default_term_for_tty(tty_path);
1765
1766                 x = strappend("TERM=", term);
1767                 if (!x)
1768                         return -ENOMEM;
1769                 our_env[n_env++] = x;
1770         }
1771
1772         if (journal_stream_dev != 0 && journal_stream_ino != 0) {
1773                 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
1774                         return -ENOMEM;
1775
1776                 our_env[n_env++] = x;
1777         }
1778
1779         our_env[n_env++] = NULL;
1780         assert(n_env <= 12);
1781
1782         *ret = our_env;
1783         our_env = NULL;
1784
1785         return 0;
1786 }
1787
1788 static int build_pass_environment(const ExecContext *c, char ***ret) {
1789         _cleanup_strv_free_ char **pass_env = NULL;
1790         size_t n_env = 0, n_bufsize = 0;
1791         char **i;
1792
1793         STRV_FOREACH(i, c->pass_environment) {
1794                 _cleanup_free_ char *x = NULL;
1795                 char *v;
1796
1797                 v = getenv(*i);
1798                 if (!v)
1799                         continue;
1800                 x = strjoin(*i, "=", v);
1801                 if (!x)
1802                         return -ENOMEM;
1803                 if (!GREEDY_REALLOC(pass_env, n_bufsize, n_env + 2))
1804                         return -ENOMEM;
1805                 pass_env[n_env++] = x;
1806                 pass_env[n_env] = NULL;
1807                 x = NULL;
1808         }
1809
1810         *ret = pass_env;
1811         pass_env = NULL;
1812
1813         return 0;
1814 }
1815
1816 static bool exec_needs_mount_namespace(
1817                 const ExecContext *context,
1818                 const ExecParameters *params,
1819                 ExecRuntime *runtime) {
1820
1821         assert(context);
1822         assert(params);
1823
1824         if (!strv_isempty(context->read_write_paths) ||
1825             !strv_isempty(context->read_only_paths) ||
1826             !strv_isempty(context->inaccessible_paths))
1827                 return true;
1828
1829         if (context->mount_flags != 0)
1830                 return true;
1831
1832         if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
1833                 return true;
1834
1835         if (context->private_devices ||
1836             context->protect_system != PROTECT_SYSTEM_NO ||
1837             context->protect_home != PROTECT_HOME_NO ||
1838             context->protect_kernel_tunables ||
1839             context->protect_kernel_modules ||
1840             context->protect_control_groups)
1841                 return true;
1842
1843         return false;
1844 }
1845
1846 static int setup_private_users(uid_t uid, gid_t gid) {
1847         _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
1848         _cleanup_close_pair_ int errno_pipe[2] = { -1, -1 };
1849         _cleanup_close_ int unshare_ready_fd = -1;
1850         _cleanup_(sigkill_waitp) pid_t pid = 0;
1851         uint64_t c = 1;
1852         siginfo_t si;
1853         ssize_t n;
1854         int r;
1855
1856         /* Set up a user namespace and map root to root, the selected UID/GID to itself, and everything else to
1857          * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
1858          * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
1859          * which waits for the parent to create the new user namespace while staying in the original namespace. The
1860          * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
1861          * continues execution normally. */
1862
1863         if (uid != 0 && uid_is_valid(uid))
1864                 asprintf(&uid_map,
1865                          "0 0 1\n"                      /* Map root → root */
1866                          UID_FMT " " UID_FMT " 1\n",    /* Map $UID → $UID */
1867                          uid, uid);
1868         else
1869                 uid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1870         if (!uid_map)
1871                 return -ENOMEM;
1872
1873         if (gid != 0 && gid_is_valid(gid))
1874                 asprintf(&gid_map,
1875                          "0 0 1\n"                      /* Map root → root */
1876                          GID_FMT " " GID_FMT " 1\n",    /* Map $GID → $GID */
1877                          gid, gid);
1878         else
1879                 gid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1880         if (!gid_map)
1881                 return -ENOMEM;
1882
1883         /* Create a communication channel so that the parent can tell the child when it finished creating the user
1884          * namespace. */
1885         unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
1886         if (unshare_ready_fd < 0)
1887                 return -errno;
1888
1889         /* Create a communication channel so that the child can tell the parent a proper error code in case it
1890          * failed. */
1891         if (pipe2(errno_pipe, O_CLOEXEC) < 0)
1892                 return -errno;
1893
1894         pid = fork();
1895         if (pid < 0)
1896                 return -errno;
1897
1898         if (pid == 0) {
1899                 _cleanup_close_ int fd = -1;
1900                 const char *a;
1901                 pid_t ppid;
1902
1903                 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
1904                  * here, after the parent opened its own user namespace. */
1905
1906                 ppid = getppid();
1907                 errno_pipe[0] = safe_close(errno_pipe[0]);
1908
1909                 /* Wait until the parent unshared the user namespace */
1910                 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
1911                         r = -errno;
1912                         goto child_fail;
1913                 }
1914
1915                 /* Disable the setgroups() system call in the child user namespace, for good. */
1916                 a = procfs_file_alloca(ppid, "setgroups");
1917                 fd = open(a, O_WRONLY|O_CLOEXEC);
1918                 if (fd < 0) {
1919                         if (errno != ENOENT) {
1920                                 r = -errno;
1921                                 goto child_fail;
1922                         }
1923
1924                         /* If the file is missing the kernel is too old, let's continue anyway. */
1925                 } else {
1926                         if (write(fd, "deny\n", 5) < 0) {
1927                                 r = -errno;
1928                                 goto child_fail;
1929                         }
1930
1931                         fd = safe_close(fd);
1932                 }
1933
1934                 /* First write the GID map */
1935                 a = procfs_file_alloca(ppid, "gid_map");
1936                 fd = open(a, O_WRONLY|O_CLOEXEC);
1937                 if (fd < 0) {
1938                         r = -errno;
1939                         goto child_fail;
1940                 }
1941                 if (write(fd, gid_map, strlen(gid_map)) < 0) {
1942                         r = -errno;
1943                         goto child_fail;
1944                 }
1945                 fd = safe_close(fd);
1946
1947                 /* The write the UID map */
1948                 a = procfs_file_alloca(ppid, "uid_map");
1949                 fd = open(a, O_WRONLY|O_CLOEXEC);
1950                 if (fd < 0) {
1951                         r = -errno;
1952                         goto child_fail;
1953                 }
1954                 if (write(fd, uid_map, strlen(uid_map)) < 0) {
1955                         r = -errno;
1956                         goto child_fail;
1957                 }
1958
1959                 _exit(EXIT_SUCCESS);
1960
1961         child_fail:
1962                 (void) write(errno_pipe[1], &r, sizeof(r));
1963                 _exit(EXIT_FAILURE);
1964         }
1965
1966         errno_pipe[1] = safe_close(errno_pipe[1]);
1967
1968         if (unshare(CLONE_NEWUSER) < 0)
1969                 return -errno;
1970
1971         /* Let the child know that the namespace is ready now */
1972         if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
1973                 return -errno;
1974
1975         /* Try to read an error code from the child */
1976         n = read(errno_pipe[0], &r, sizeof(r));
1977         if (n < 0)
1978                 return -errno;
1979         if (n == sizeof(r)) { /* an error code was sent to us */
1980                 if (r < 0)
1981                         return r;
1982                 return -EIO;
1983         }
1984         if (n != 0) /* on success we should have read 0 bytes */
1985                 return -EIO;
1986
1987         r = wait_for_terminate(pid, &si);
1988         if (r < 0)
1989                 return r;
1990         pid = 0;
1991
1992         /* If something strange happened with the child, let's consider this fatal, too */
1993         if (si.si_code != CLD_EXITED || si.si_status != 0)
1994                 return -EIO;
1995
1996         return 0;
1997 }
1998
1999 static int setup_runtime_directory(
2000                 const ExecContext *context,
2001                 const ExecParameters *params,
2002                 uid_t uid,
2003                 gid_t gid) {
2004
2005         char **rt;
2006         int r;
2007
2008         assert(context);
2009         assert(params);
2010
2011         STRV_FOREACH(rt, context->runtime_directory) {
2012                 _cleanup_free_ char *p;
2013
2014                 p = strjoin(params->runtime_prefix, "/", *rt);
2015                 if (!p)
2016                         return -ENOMEM;
2017
2018                 r = mkdir_p_label(p, context->runtime_directory_mode);
2019                 if (r < 0)
2020                         return r;
2021
2022                 r = chmod_and_chown(p, context->runtime_directory_mode, uid, gid);
2023                 if (r < 0)
2024                         return r;
2025         }
2026
2027         return 0;
2028 }
2029
2030 static int setup_smack(
2031                 const ExecContext *context,
2032                 const ExecCommand *command) {
2033
2034 #ifdef HAVE_SMACK
2035         int r;
2036
2037         assert(context);
2038         assert(command);
2039
2040         if (!mac_smack_use())
2041                 return 0;
2042
2043         if (context->smack_process_label) {
2044                 r = mac_smack_apply_pid(0, context->smack_process_label);
2045                 if (r < 0)
2046                         return r;
2047         }
2048 #ifdef SMACK_DEFAULT_PROCESS_LABEL
2049         else {
2050                 _cleanup_free_ char *exec_label = NULL;
2051
2052                 r = mac_smack_read(command->path, SMACK_ATTR_EXEC, &exec_label);
2053                 if (r < 0 && r != -ENODATA && r != -EOPNOTSUPP)
2054                         return r;
2055
2056                 r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
2057                 if (r < 0)
2058                         return r;
2059         }
2060 #endif
2061 #endif
2062
2063         return 0;
2064 }
2065
2066 static int compile_read_write_paths(
2067                 const ExecContext *context,
2068                 const ExecParameters *params,
2069                 char ***ret) {
2070
2071         _cleanup_strv_free_ char **l = NULL;
2072         char **rt;
2073
2074         /* Compile the list of writable paths. This is the combination of the explicitly configured paths, plus all
2075          * runtime directories. */
2076
2077         if (strv_isempty(context->read_write_paths) &&
2078             strv_isempty(context->runtime_directory)) {
2079                 *ret = NULL; /* NOP if neither is set */
2080                 return 0;
2081         }
2082
2083         l = strv_copy(context->read_write_paths);
2084         if (!l)
2085                 return -ENOMEM;
2086
2087         STRV_FOREACH(rt, context->runtime_directory) {
2088                 char *s;
2089
2090                 s = strjoin(params->runtime_prefix, "/", *rt);
2091                 if (!s)
2092                         return -ENOMEM;
2093
2094                 if (strv_consume(&l, s) < 0)
2095                         return -ENOMEM;
2096         }
2097
2098         *ret = l;
2099         l = NULL;
2100
2101         return 0;
2102 }
2103
2104 static int apply_mount_namespace(Unit *u, const ExecContext *context,
2105                                  const ExecParameters *params,
2106                                  ExecRuntime *runtime) {
2107         int r;
2108         _cleanup_free_ char **rw = NULL;
2109         char *tmp = NULL, *var = NULL;
2110         const char *root_dir = NULL;
2111         NameSpaceInfo ns_info = {
2112                 .ignore_protect_paths = false,
2113                 .private_dev = context->private_devices,
2114                 .protect_control_groups = context->protect_control_groups,
2115                 .protect_kernel_tunables = context->protect_kernel_tunables,
2116                 .protect_kernel_modules = context->protect_kernel_modules,
2117         };
2118
2119         assert(context);
2120
2121         /* The runtime struct only contains the parent of the private /tmp,
2122          * which is non-accessible to world users. Inside of it there's a /tmp
2123          * that is sticky, and that's the one we want to use here. */
2124
2125         if (context->private_tmp && runtime) {
2126                 if (runtime->tmp_dir)
2127                         tmp = strjoina(runtime->tmp_dir, "/tmp");
2128                 if (runtime->var_tmp_dir)
2129                         var = strjoina(runtime->var_tmp_dir, "/tmp");
2130         }
2131
2132         r = compile_read_write_paths(context, params, &rw);
2133         if (r < 0)
2134                 return r;
2135
2136         if (params->flags & EXEC_APPLY_CHROOT)
2137                 root_dir = context->root_directory;
2138
2139         /*
2140          * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed
2141          * sandbox info, otherwise enforce it, don't ignore protected paths and
2142          * fail if we are enable to apply the sandbox inside the mount namespace.
2143          */
2144         if (!context->dynamic_user && root_dir)
2145                 ns_info.ignore_protect_paths = true;
2146
2147         r = setup_namespace(root_dir, &ns_info, rw,
2148                             context->read_only_paths,
2149                             context->inaccessible_paths,
2150                             tmp,
2151                             var,
2152                             context->protect_home,
2153                             context->protect_system,
2154                             context->mount_flags);
2155
2156         /* If we couldn't set up the namespace this is probably due to a
2157          * missing capability. In this case, silently proceeed. */
2158         if (IN_SET(r, -EPERM, -EACCES)) {
2159                 log_open();
2160                 log_unit_debug_errno(u, r, "Failed to set up namespace, assuming containerized execution, ignoring: %m");
2161                 log_close();
2162                 r = 0;
2163         }
2164
2165         return r;
2166 }
2167
2168 static int apply_working_directory(const ExecContext *context,
2169                                    const ExecParameters *params,
2170                                    const char *home,
2171                                    const bool needs_mount_ns) {
2172         const char *d;
2173         const char *wd;
2174
2175         assert(context);
2176
2177         if (context->working_directory_home)
2178                 wd = home;
2179         else if (context->working_directory)
2180                 wd = context->working_directory;
2181         else
2182                 wd = "/";
2183
2184         if (params->flags & EXEC_APPLY_CHROOT) {
2185                 if (!needs_mount_ns && context->root_directory)
2186                         if (chroot(context->root_directory) < 0)
2187                                 return -errno;
2188
2189                 d = wd;
2190         } else
2191                 d = strjoina(strempty(context->root_directory), "/", strempty(wd));
2192
2193         if (chdir(d) < 0 && !context->working_directory_missing_ok)
2194                 return -errno;
2195
2196         return 0;
2197 }
2198
2199 static void append_socket_pair(int *array, unsigned *n, int pair[2]) {
2200         assert(array);
2201         assert(n);
2202
2203         if (!pair)
2204                 return;
2205
2206         if (pair[0] >= 0)
2207                 array[(*n)++] = pair[0];
2208         if (pair[1] >= 0)
2209                 array[(*n)++] = pair[1];
2210 }
2211
2212 static int close_remaining_fds(
2213                 const ExecParameters *params,
2214                 ExecRuntime *runtime,
2215                 DynamicCreds *dcreds,
2216                 int user_lookup_fd,
2217                 int socket_fd,
2218                 int *fds, unsigned n_fds) {
2219
2220         unsigned n_dont_close = 0;
2221         int dont_close[n_fds + 12];
2222
2223         assert(params);
2224
2225         if (params->stdin_fd >= 0)
2226                 dont_close[n_dont_close++] = params->stdin_fd;
2227         if (params->stdout_fd >= 0)
2228                 dont_close[n_dont_close++] = params->stdout_fd;
2229         if (params->stderr_fd >= 0)
2230                 dont_close[n_dont_close++] = params->stderr_fd;
2231
2232         if (socket_fd >= 0)
2233                 dont_close[n_dont_close++] = socket_fd;
2234         if (n_fds > 0) {
2235                 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
2236                 n_dont_close += n_fds;
2237         }
2238
2239         if (runtime)
2240                 append_socket_pair(dont_close, &n_dont_close, runtime->netns_storage_socket);
2241
2242         if (dcreds) {
2243                 if (dcreds->user)
2244                         append_socket_pair(dont_close, &n_dont_close, dcreds->user->storage_socket);
2245                 if (dcreds->group)
2246                         append_socket_pair(dont_close, &n_dont_close, dcreds->group->storage_socket);
2247         }
2248
2249         if (user_lookup_fd >= 0)
2250                 dont_close[n_dont_close++] = user_lookup_fd;
2251
2252         return close_all_fds(dont_close, n_dont_close);
2253 }
2254
2255 static bool context_has_address_families(const ExecContext *c) {
2256         assert(c);
2257
2258         return c->address_families_whitelist ||
2259                 !set_isempty(c->address_families);
2260 }
2261
2262 static bool context_has_syscall_filters(const ExecContext *c) {
2263         assert(c);
2264
2265         return c->syscall_whitelist ||
2266                 !set_isempty(c->syscall_filter) ||
2267                 !set_isempty(c->syscall_archs);
2268 }
2269
2270 static bool context_has_no_new_privileges(const ExecContext *c) {
2271         assert(c);
2272
2273         if (c->no_new_privileges)
2274                 return true;
2275
2276         if (have_effective_cap(CAP_SYS_ADMIN)) /* if we are privileged, we don't need NNP */
2277                 return false;
2278
2279         return context_has_address_families(c) || /* we need NNP if we have any form of seccomp and are unprivileged */
2280                 c->memory_deny_write_execute ||
2281                 c->restrict_realtime ||
2282                 exec_context_restrict_namespaces_set(c) ||
2283                 c->protect_kernel_tunables ||
2284                 c->protect_kernel_modules ||
2285                 c->private_devices ||
2286                 context_has_syscall_filters(c);
2287 }
2288
2289 static int send_user_lookup(
2290                 Unit *unit,
2291                 int user_lookup_fd,
2292                 uid_t uid,
2293                 gid_t gid) {
2294
2295         assert(unit);
2296
2297         /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
2298          * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
2299          * specified. */
2300
2301         if (user_lookup_fd < 0)
2302                 return 0;
2303
2304         if (!uid_is_valid(uid) && !gid_is_valid(gid))
2305                 return 0;
2306
2307         if (writev(user_lookup_fd,
2308                (struct iovec[]) {
2309                            { .iov_base = &uid, .iov_len = sizeof(uid) },
2310                            { .iov_base = &gid, .iov_len = sizeof(gid) },
2311                            { .iov_base = unit->id, .iov_len = strlen(unit->id) }}, 3) < 0)
2312                 return -errno;
2313
2314         return 0;
2315 }
2316
2317 static int exec_child(
2318                 Unit *unit,
2319                 ExecCommand *command,
2320                 const ExecContext *context,
2321                 const ExecParameters *params,
2322                 ExecRuntime *runtime,
2323                 DynamicCreds *dcreds,
2324                 char **argv,
2325                 int socket_fd,
2326                 int named_iofds[3],
2327                 int *fds, unsigned n_fds,
2328                 char **files_env,
2329                 int user_lookup_fd,
2330                 int *exit_status) {
2331
2332         _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **accum_env = NULL, **final_argv = NULL;
2333         _cleanup_free_ char *mac_selinux_context_net = NULL;
2334         _cleanup_free_ gid_t *supplementary_gids = NULL;
2335         const char *username = NULL, *groupname = NULL;
2336         const char *home = NULL, *shell = NULL;
2337         dev_t journal_stream_dev = 0;
2338         ino_t journal_stream_ino = 0;
2339         bool needs_mount_namespace;
2340         uid_t uid = UID_INVALID;
2341         gid_t gid = GID_INVALID;
2342         int i, r, ngids = 0;
2343
2344         assert(unit);
2345         assert(command);
2346         assert(context);
2347         assert(params);
2348         assert(exit_status);
2349
2350         rename_process_from_path(command->path);
2351
2352         /* We reset exactly these signals, since they are the
2353          * only ones we set to SIG_IGN in the main daemon. All
2354          * others we leave untouched because we set them to
2355          * SIG_DFL or a valid handler initially, both of which
2356          * will be demoted to SIG_DFL. */
2357         (void) default_signals(SIGNALS_CRASH_HANDLER,
2358                                SIGNALS_IGNORE, -1);
2359
2360         if (context->ignore_sigpipe)
2361                 (void) ignore_signals(SIGPIPE, -1);
2362
2363         r = reset_signal_mask();
2364         if (r < 0) {
2365                 *exit_status = EXIT_SIGNAL_MASK;
2366                 return r;
2367         }
2368
2369         if (params->idle_pipe)
2370                 do_idle_pipe_dance(params->idle_pipe);
2371
2372         /* Close sockets very early to make sure we don't
2373          * block init reexecution because it cannot bind its
2374          * sockets */
2375
2376         log_forget_fds();
2377
2378         r = close_remaining_fds(params, runtime, dcreds, user_lookup_fd, socket_fd, fds, n_fds);
2379         if (r < 0) {
2380                 *exit_status = EXIT_FDS;
2381                 return r;
2382         }
2383
2384         if (!context->same_pgrp)
2385                 if (setsid() < 0) {
2386                         *exit_status = EXIT_SETSID;
2387                         return -errno;
2388                 }
2389
2390         exec_context_tty_reset(context, params);
2391
2392         if (unit_shall_confirm_spawn(unit)) {
2393                 const char *vc = params->confirm_spawn;
2394                 _cleanup_free_ char *cmdline = NULL;
2395
2396                 cmdline = exec_command_line(argv);
2397                 if (!cmdline) {
2398                         *exit_status = EXIT_CONFIRM;
2399                         return -ENOMEM;
2400                 }
2401
2402                 r = ask_for_confirmation(vc, unit, cmdline);
2403                 if (r != CONFIRM_EXECUTE) {
2404                         if (r == CONFIRM_PRETEND_SUCCESS) {
2405                                 *exit_status = EXIT_SUCCESS;
2406                                 return 0;
2407                         }
2408                         *exit_status = EXIT_CONFIRM;
2409                         return -ECANCELED;
2410                 }
2411         }
2412
2413         if (context->dynamic_user && dcreds) {
2414
2415                 /* Make sure we bypass our own NSS module for any NSS checks */
2416                 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
2417                         *exit_status = EXIT_USER;
2418                         return -errno;
2419                 }
2420
2421                 r = dynamic_creds_realize(dcreds, &uid, &gid);
2422                 if (r < 0) {
2423                         *exit_status = EXIT_USER;
2424                         return r;
2425                 }
2426
2427                 if (!uid_is_valid(uid) || !gid_is_valid(gid)) {
2428                         *exit_status = EXIT_USER;
2429                         return -ESRCH;
2430                 }
2431
2432                 if (dcreds->user)
2433                         username = dcreds->user->name;
2434
2435         } else {
2436                 r = get_fixed_user(context, &username, &uid, &gid, &home, &shell);
2437                 if (r < 0) {
2438                         *exit_status = EXIT_USER;
2439                         return r;
2440                 }
2441
2442                 r = get_fixed_group(context, &groupname, &gid);
2443                 if (r < 0) {
2444                         *exit_status = EXIT_GROUP;
2445                         return r;
2446                 }
2447         }
2448
2449         /* Initialize user supplementary groups and get SupplementaryGroups= ones */
2450         r = get_supplementary_groups(context, username, groupname, gid,
2451                                      &supplementary_gids, &ngids);
2452         if (r < 0) {
2453                 *exit_status = EXIT_GROUP;
2454                 return r;
2455         }
2456
2457         r = send_user_lookup(unit, user_lookup_fd, uid, gid);
2458         if (r < 0) {
2459                 *exit_status = EXIT_USER;
2460                 return r;
2461         }
2462
2463         user_lookup_fd = safe_close(user_lookup_fd);
2464
2465         /* If a socket is connected to STDIN/STDOUT/STDERR, we
2466          * must sure to drop O_NONBLOCK */
2467         if (socket_fd >= 0)
2468                 (void) fd_nonblock(socket_fd, false);
2469
2470         r = setup_input(context, params, socket_fd, named_iofds);
2471         if (r < 0) {
2472                 *exit_status = EXIT_STDIN;
2473                 return r;
2474         }
2475
2476         r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
2477         if (r < 0) {
2478                 *exit_status = EXIT_STDOUT;
2479                 return r;
2480         }
2481
2482         r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
2483         if (r < 0) {
2484                 *exit_status = EXIT_STDERR;
2485                 return r;
2486         }
2487
2488         if (params->cgroup_path) {
2489                 r = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0, NULL, NULL);
2490                 if (r < 0) {
2491                         *exit_status = EXIT_CGROUP;
2492                         return r;
2493                 }
2494         }
2495
2496         if (context->oom_score_adjust_set) {
2497                 char t[DECIMAL_STR_MAX(context->oom_score_adjust)];
2498
2499                 /* When we can't make this change due to EPERM, then
2500                  * let's silently skip over it. User namespaces
2501                  * prohibit write access to this file, and we
2502                  * shouldn't trip up over that. */
2503
2504                 sprintf(t, "%i", context->oom_score_adjust);
2505                 r = write_string_file("/proc/self/oom_score_adj", t, 0);
2506                 if (r == -EPERM || r == -EACCES) {
2507                         log_open();
2508                         log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
2509                         log_close();
2510                 } else if (r < 0) {
2511                         *exit_status = EXIT_OOM_ADJUST;
2512                         return -errno;
2513                 }
2514         }
2515
2516         if (context->nice_set)
2517                 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
2518                         *exit_status = EXIT_NICE;
2519                         return -errno;
2520                 }
2521
2522         if (context->cpu_sched_set) {
2523                 struct sched_param param = {
2524                         .sched_priority = context->cpu_sched_priority,
2525                 };
2526
2527                 r = sched_setscheduler(0,
2528                                        context->cpu_sched_policy |
2529                                        (context->cpu_sched_reset_on_fork ?
2530                                         SCHED_RESET_ON_FORK : 0),
2531                                        &param);
2532                 if (r < 0) {
2533                         *exit_status = EXIT_SETSCHEDULER;
2534                         return -errno;
2535                 }
2536         }
2537
2538         if (context->cpuset)
2539                 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
2540                         *exit_status = EXIT_CPUAFFINITY;
2541                         return -errno;
2542                 }
2543
2544         if (context->ioprio_set)
2545                 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
2546                         *exit_status = EXIT_IOPRIO;
2547                         return -errno;
2548                 }
2549
2550         if (context->timer_slack_nsec != NSEC_INFINITY)
2551                 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
2552                         *exit_status = EXIT_TIMERSLACK;
2553                         return -errno;
2554                 }
2555
2556         if (context->personality != PERSONALITY_INVALID)
2557                 if (personality(context->personality) < 0) {
2558                         *exit_status = EXIT_PERSONALITY;
2559                         return -errno;
2560                 }
2561
2562         if (context->utmp_id)
2563                 utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path,
2564                                       context->utmp_mode == EXEC_UTMP_INIT  ? INIT_PROCESS :
2565                                       context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
2566                                       USER_PROCESS,
2567                                       username ? "root" : context->user);
2568
2569         if (context->user) {
2570                 r = chown_terminal(STDIN_FILENO, uid);
2571                 if (r < 0) {
2572                         *exit_status = EXIT_STDIN;
2573                         return r;
2574                 }
2575         }
2576
2577         /* If delegation is enabled we'll pass ownership of the cgroup
2578          * (but only in systemd's own controller hierarchy!) to the
2579          * user of the new process. */
2580         if (params->cgroup_path && context->user && params->cgroup_delegate) {
2581                 r = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
2582                 if (r < 0) {
2583                         *exit_status = EXIT_CGROUP;
2584                         return r;
2585                 }
2586
2587
2588                 r = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
2589                 if (r < 0) {
2590                         *exit_status = EXIT_CGROUP;
2591                         return r;
2592                 }
2593         }
2594
2595         if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
2596                 r = setup_runtime_directory(context, params, uid, gid);
2597                 if (r < 0) {
2598                         *exit_status = EXIT_RUNTIME_DIRECTORY;
2599                         return r;
2600                 }
2601         }
2602
2603         r = build_environment(
2604                         unit,
2605                         context,
2606                         params,
2607                         n_fds,
2608                         home,
2609                         username,
2610                         shell,
2611                         journal_stream_dev,
2612                         journal_stream_ino,
2613                         &our_env);
2614         if (r < 0) {
2615                 *exit_status = EXIT_MEMORY;
2616                 return r;
2617         }
2618
2619         r = build_pass_environment(context, &pass_env);
2620         if (r < 0) {
2621                 *exit_status = EXIT_MEMORY;
2622                 return r;
2623         }
2624
2625         accum_env = strv_env_merge(5,
2626                                    params->environment,
2627                                    our_env,
2628                                    pass_env,
2629                                    context->environment,
2630                                    files_env,
2631                                    NULL);
2632         if (!accum_env) {
2633                 *exit_status = EXIT_MEMORY;
2634                 return -ENOMEM;
2635         }
2636         accum_env = strv_env_clean(accum_env);
2637
2638         (void) umask(context->umask);
2639
2640         if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2641                 if (context->pam_name && username) {
2642                         r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
2643                         if (r < 0) {
2644                                 *exit_status = EXIT_PAM;
2645                                 return r;
2646                         }
2647                 }
2648         }
2649
2650         if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
2651                 r = setup_netns(runtime->netns_storage_socket);
2652                 if (r < 0) {
2653                         *exit_status = EXIT_NETWORK;
2654                         return r;
2655                 }
2656         }
2657
2658         needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
2659         if (needs_mount_namespace) {
2660                 r = apply_mount_namespace(unit, context, params, runtime);
2661                 if (r < 0) {
2662                         *exit_status = EXIT_NAMESPACE;
2663                         return r;
2664                 }
2665         }
2666
2667         /* Apply just after mount namespace setup */
2668         r = apply_working_directory(context, params, home, needs_mount_namespace);
2669         if (r < 0) {
2670                 *exit_status = EXIT_CHROOT;
2671                 return r;
2672         }
2673
2674         /* Drop groups as early as possbile */
2675         if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2676                 r = enforce_groups(context, gid, supplementary_gids, ngids);
2677                 if (r < 0) {
2678                         *exit_status = EXIT_GROUP;
2679                         return r;
2680                 }
2681         }
2682
2683 #ifdef HAVE_SELINUX
2684         if ((params->flags & EXEC_APPLY_PERMISSIONS) &&
2685             mac_selinux_use() &&
2686             params->selinux_context_net &&
2687             socket_fd >= 0 &&
2688             !command->privileged) {
2689
2690                 r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
2691                 if (r < 0) {
2692                         *exit_status = EXIT_SELINUX_CONTEXT;
2693                         return r;
2694                 }
2695         }
2696 #endif
2697
2698         if ((params->flags & EXEC_APPLY_PERMISSIONS) && context->private_users) {
2699                 r = setup_private_users(uid, gid);
2700                 if (r < 0) {
2701                         *exit_status = EXIT_USER;
2702                         return r;
2703                 }
2704         }
2705
2706         /* We repeat the fd closing here, to make sure that
2707          * nothing is leaked from the PAM modules. Note that
2708          * we are more aggressive this time since socket_fd
2709          * and the netns fds we don't need anymore. The custom
2710          * endpoint fd was needed to upload the policy and can
2711          * now be closed as well. */
2712         r = close_all_fds(fds, n_fds);
2713         if (r >= 0)
2714                 r = shift_fds(fds, n_fds);
2715         if (r >= 0)
2716                 r = flags_fds(fds, n_fds, context->non_blocking);
2717         if (r < 0) {
2718                 *exit_status = EXIT_FDS;
2719                 return r;
2720         }
2721
2722         if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2723
2724                 int secure_bits = context->secure_bits;
2725
2726                 for (i = 0; i < _RLIMIT_MAX; i++) {
2727
2728                         if (!context->rlimit[i])
2729                                 continue;
2730
2731                         r = setrlimit_closest(i, context->rlimit[i]);
2732                         if (r < 0) {
2733                                 *exit_status = EXIT_LIMITS;
2734                                 return r;
2735                         }
2736                 }
2737
2738                 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. */
2739                 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
2740                         if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
2741                                 *exit_status = EXIT_LIMITS;
2742                                 return -errno;
2743                         }
2744                 }
2745
2746                 if (!cap_test_all(context->capability_bounding_set)) {
2747                         r = capability_bounding_set_drop(context->capability_bounding_set, false);
2748                         if (r < 0) {
2749                                 *exit_status = EXIT_CAPABILITIES;
2750                                 return r;
2751                         }
2752                 }
2753
2754                 /* This is done before enforce_user, but ambient set
2755                  * does not survive over setresuid() if keep_caps is not set. */
2756                 if (context->capability_ambient_set != 0) {
2757                         r = capability_ambient_set_apply(context->capability_ambient_set, true);
2758                         if (r < 0) {
2759                                 *exit_status = EXIT_CAPABILITIES;
2760                                 return r;
2761                         }
2762                 }
2763
2764                 if (context->user) {
2765                         r = enforce_user(context, uid);
2766                         if (r < 0) {
2767                                 *exit_status = EXIT_USER;
2768                                 return r;
2769                         }
2770                         if (context->capability_ambient_set != 0) {
2771
2772                                 /* Fix the ambient capabilities after user change. */
2773                                 r = capability_ambient_set_apply(context->capability_ambient_set, false);
2774                                 if (r < 0) {
2775                                         *exit_status = EXIT_CAPABILITIES;
2776                                         return r;
2777                                 }
2778
2779                                 /* If we were asked to change user and ambient capabilities
2780                                  * were requested, we had to add keep-caps to the securebits
2781                                  * so that we would maintain the inherited capability set
2782                                  * through the setresuid(). Make sure that the bit is added
2783                                  * also to the context secure_bits so that we don't try to
2784                                  * drop the bit away next. */
2785
2786                                 secure_bits |= 1<<SECURE_KEEP_CAPS;
2787                         }
2788                 }
2789
2790                 /* Apply the MAC contexts late, but before seccomp syscall filtering, as those should really be last to
2791                  * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires
2792                  * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls
2793                  * are restricted. */
2794
2795 #ifdef HAVE_SELINUX
2796                 if (mac_selinux_use()) {
2797                         char *exec_context = mac_selinux_context_net ?: context->selinux_context;
2798
2799                         if (exec_context) {
2800                                 r = setexeccon(exec_context);
2801                                 if (r < 0) {
2802                                         *exit_status = EXIT_SELINUX_CONTEXT;
2803                                         return r;
2804                                 }
2805                         }
2806                 }
2807 #endif
2808
2809                 r = setup_smack(context, command);
2810                 if (r < 0) {
2811                         *exit_status = EXIT_SMACK_PROCESS_LABEL;
2812                         return r;
2813                 }
2814
2815 #ifdef HAVE_APPARMOR
2816                 if (context->apparmor_profile && mac_apparmor_use()) {
2817                         r = aa_change_onexec(context->apparmor_profile);
2818                         if (r < 0 && !context->apparmor_profile_ignore) {
2819                                 *exit_status = EXIT_APPARMOR_PROFILE;
2820                                 return -errno;
2821                         }
2822                 }
2823 #endif
2824
2825                 /* PR_GET_SECUREBITS is not privileged, while
2826                  * PR_SET_SECUREBITS is. So to suppress
2827                  * potential EPERMs we'll try not to call
2828                  * PR_SET_SECUREBITS unless necessary. */
2829                 if (prctl(PR_GET_SECUREBITS) != secure_bits)
2830                         if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
2831                                 *exit_status = EXIT_SECUREBITS;
2832                                 return -errno;
2833                         }
2834
2835                 if (context_has_no_new_privileges(context))
2836                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
2837                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
2838                                 return -errno;
2839                         }
2840
2841 #ifdef HAVE_SECCOMP
2842                 if (context_has_address_families(context)) {
2843                         r = apply_address_families(unit, context);
2844                         if (r < 0) {
2845                                 *exit_status = EXIT_ADDRESS_FAMILIES;
2846                                 return r;
2847                         }
2848                 }
2849
2850                 if (context->memory_deny_write_execute) {
2851                         r = apply_memory_deny_write_execute(unit, context);
2852                         if (r < 0) {
2853                                 *exit_status = EXIT_SECCOMP;
2854                                 return r;
2855                         }
2856                 }
2857
2858                 if (context->restrict_realtime) {
2859                         r = apply_restrict_realtime(unit, context);
2860                         if (r < 0) {
2861                                 *exit_status = EXIT_SECCOMP;
2862                                 return r;
2863                         }
2864                 }
2865
2866                 r = apply_restrict_namespaces(unit, context);
2867                 if (r < 0) {
2868                         *exit_status = EXIT_SECCOMP;
2869                         return r;
2870                 }
2871
2872                 if (context->protect_kernel_tunables) {
2873                         r = apply_protect_sysctl(unit, context);
2874                         if (r < 0) {
2875                                 *exit_status = EXIT_SECCOMP;
2876                                 return r;
2877                         }
2878                 }
2879
2880                 if (context->protect_kernel_modules) {
2881                         r = apply_protect_kernel_modules(unit, context);
2882                         if (r < 0) {
2883                                 *exit_status = EXIT_SECCOMP;
2884                                 return r;
2885                         }
2886                 }
2887
2888                 if (context->private_devices) {
2889                         r = apply_private_devices(unit, context);
2890                         if (r < 0) {
2891                                 *exit_status = EXIT_SECCOMP;
2892                                 return r;
2893                         }
2894                 }
2895
2896                 /* This really should remain the last step before the execve(), to make sure our own code is unaffected
2897                  * by the filter as little as possible. */
2898                 if (context_has_syscall_filters(context)) {
2899                         r = apply_seccomp(unit, context);
2900                         if (r < 0) {
2901                                 *exit_status = EXIT_SECCOMP;
2902                                 return r;
2903                         }
2904                 }
2905 #endif
2906         }
2907
2908         final_argv = replace_env_argv(argv, accum_env);
2909         if (!final_argv) {
2910                 *exit_status = EXIT_MEMORY;
2911                 return -ENOMEM;
2912         }
2913
2914         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
2915                 _cleanup_free_ char *line;
2916
2917                 line = exec_command_line(final_argv);
2918                 if (line) {
2919                         log_open();
2920                         log_struct(LOG_DEBUG,
2921                                    LOG_UNIT_ID(unit),
2922                                    "EXECUTABLE=%s", command->path,
2923                                    LOG_UNIT_MESSAGE(unit, "Executing: %s", line),
2924                                    NULL);
2925                         log_close();
2926                 }
2927         }
2928
2929         execve(command->path, final_argv, accum_env);
2930         *exit_status = EXIT_EXEC;
2931         return -errno;
2932 }
2933
2934 int exec_spawn(Unit *unit,
2935                ExecCommand *command,
2936                const ExecContext *context,
2937                const ExecParameters *params,
2938                ExecRuntime *runtime,
2939                DynamicCreds *dcreds,
2940                pid_t *ret) {
2941
2942         _cleanup_strv_free_ char **files_env = NULL;
2943         int *fds = NULL; unsigned n_fds = 0;
2944         _cleanup_free_ char *line = NULL;
2945         int socket_fd, r;
2946         int named_iofds[3] = { -1, -1, -1 };
2947         char **argv;
2948         pid_t pid;
2949
2950         assert(unit);
2951         assert(command);
2952         assert(context);
2953         assert(ret);
2954         assert(params);
2955         assert(params->fds || params->n_fds <= 0);
2956
2957         if (context->std_input == EXEC_INPUT_SOCKET ||
2958             context->std_output == EXEC_OUTPUT_SOCKET ||
2959             context->std_error == EXEC_OUTPUT_SOCKET) {
2960
2961                 if (params->n_fds != 1) {
2962                         log_unit_error(unit, "Got more than one socket.");
2963                         return -EINVAL;
2964                 }
2965
2966                 socket_fd = params->fds[0];
2967         } else {
2968                 socket_fd = -1;
2969                 fds = params->fds;
2970                 n_fds = params->n_fds;
2971         }
2972
2973         r = exec_context_named_iofds(unit, context, params, named_iofds);
2974         if (r < 0)
2975                 return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m");
2976
2977         r = exec_context_load_environment(unit, context, &files_env);
2978         if (r < 0)
2979                 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
2980
2981         argv = params->argv ?: command->argv;
2982         line = exec_command_line(argv);
2983         if (!line)
2984                 return log_oom();
2985
2986         log_struct(LOG_DEBUG,
2987                    LOG_UNIT_ID(unit),
2988                    LOG_UNIT_MESSAGE(unit, "About to execute: %s", line),
2989                    "EXECUTABLE=%s", command->path,
2990                    NULL);
2991         pid = fork();
2992         if (pid < 0)
2993                 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
2994
2995         if (pid == 0) {
2996                 int exit_status;
2997
2998                 r = exec_child(unit,
2999                                command,
3000                                context,
3001                                params,
3002                                runtime,
3003                                dcreds,
3004                                argv,
3005                                socket_fd,
3006                                named_iofds,
3007                                fds, n_fds,
3008                                files_env,
3009                                unit->manager->user_lookup_fds[1],
3010                                &exit_status);
3011                 if (r < 0) {
3012                         log_open();
3013                         log_struct_errno(LOG_ERR, r,
3014                                          LOG_MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
3015                                          LOG_UNIT_ID(unit),
3016                                          LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
3017                                                           exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
3018                                                           command->path),
3019                                          "EXECUTABLE=%s", command->path,
3020                                          NULL);
3021                 }
3022
3023                 _exit(exit_status);
3024         }
3025
3026         log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
3027
3028         /* We add the new process to the cgroup both in the child (so
3029          * that we can be sure that no user code is ever executed
3030          * outside of the cgroup) and in the parent (so that we can be
3031          * sure that when we kill the cgroup the process will be
3032          * killed too). */
3033         if (params->cgroup_path)
3034                 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
3035
3036         exec_status_start(&command->exec_status, pid);
3037
3038         *ret = pid;
3039         return 0;
3040 }
3041
3042 void exec_context_init(ExecContext *c) {
3043         assert(c);
3044
3045         c->umask = 0022;
3046         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
3047         c->cpu_sched_policy = SCHED_OTHER;
3048         c->syslog_priority = LOG_DAEMON|LOG_INFO;
3049         c->syslog_level_prefix = true;
3050         c->ignore_sigpipe = true;
3051         c->timer_slack_nsec = NSEC_INFINITY;
3052         c->personality = PERSONALITY_INVALID;
3053         c->runtime_directory_mode = 0755;
3054         c->capability_bounding_set = CAP_ALL;
3055         c->restrict_namespaces = NAMESPACE_FLAGS_ALL;
3056 }
3057
3058 void exec_context_done(ExecContext *c) {
3059         unsigned l;
3060
3061         assert(c);
3062
3063         c->environment = strv_free(c->environment);
3064         c->environment_files = strv_free(c->environment_files);
3065         c->pass_environment = strv_free(c->pass_environment);
3066
3067         for (l = 0; l < ELEMENTSOF(c->rlimit); l++)
3068                 c->rlimit[l] = mfree(c->rlimit[l]);
3069
3070         for (l = 0; l < 3; l++)
3071                 c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);
3072
3073         c->working_directory = mfree(c->working_directory);
3074         c->root_directory = mfree(c->root_directory);
3075         c->tty_path = mfree(c->tty_path);
3076         c->syslog_identifier = mfree(c->syslog_identifier);
3077         c->user = mfree(c->user);
3078         c->group = mfree(c->group);
3079
3080         c->supplementary_groups = strv_free(c->supplementary_groups);
3081
3082         c->pam_name = mfree(c->pam_name);
3083
3084         c->read_only_paths = strv_free(c->read_only_paths);
3085         c->read_write_paths = strv_free(c->read_write_paths);
3086         c->inaccessible_paths = strv_free(c->inaccessible_paths);
3087
3088         if (c->cpuset)
3089                 CPU_FREE(c->cpuset);
3090
3091         c->utmp_id = mfree(c->utmp_id);
3092         c->selinux_context = mfree(c->selinux_context);
3093         c->apparmor_profile = mfree(c->apparmor_profile);
3094
3095         c->syscall_filter = set_free(c->syscall_filter);
3096         c->syscall_archs = set_free(c->syscall_archs);
3097         c->address_families = set_free(c->address_families);
3098
3099         c->runtime_directory = strv_free(c->runtime_directory);
3100 }
3101
3102 int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
3103         char **i;
3104
3105         assert(c);
3106
3107         if (!runtime_prefix)
3108                 return 0;
3109
3110         STRV_FOREACH(i, c->runtime_directory) {
3111                 _cleanup_free_ char *p;
3112
3113                 p = strjoin(runtime_prefix, "/", *i);
3114                 if (!p)
3115                         return -ENOMEM;
3116
3117                 /* We execute this synchronously, since we need to be
3118                  * sure this is gone when we start the service
3119                  * next. */
3120                 (void) rm_rf(p, REMOVE_ROOT);
3121         }
3122
3123         return 0;
3124 }
3125
3126 void exec_command_done(ExecCommand *c) {
3127         assert(c);
3128
3129         c->path = mfree(c->path);
3130
3131         c->argv = strv_free(c->argv);
3132 }
3133
3134 void exec_command_done_array(ExecCommand *c, unsigned n) {
3135         unsigned i;
3136
3137         for (i = 0; i < n; i++)
3138                 exec_command_done(c+i);
3139 }
3140
3141 ExecCommand* exec_command_free_list(ExecCommand *c) {
3142         ExecCommand *i;
3143
3144         while ((i = c)) {
3145                 LIST_REMOVE(command, c, i);
3146                 exec_command_done(i);
3147                 free(i);
3148         }
3149
3150         return NULL;
3151 }
3152
3153 void exec_command_free_array(ExecCommand **c, unsigned n) {
3154         unsigned i;
3155
3156         for (i = 0; i < n; i++)
3157                 c[i] = exec_command_free_list(c[i]);
3158 }
3159
3160 typedef struct InvalidEnvInfo {
3161         Unit *unit;
3162         const char *path;
3163 } InvalidEnvInfo;
3164
3165 static void invalid_env(const char *p, void *userdata) {
3166         InvalidEnvInfo *info = userdata;
3167
3168         log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
3169 }
3170
3171 const char* exec_context_fdname(const ExecContext *c, int fd_index) {
3172         assert(c);
3173
3174         switch (fd_index) {
3175         case STDIN_FILENO:
3176                 if (c->std_input != EXEC_INPUT_NAMED_FD)
3177                         return NULL;
3178                 return c->stdio_fdname[STDIN_FILENO] ?: "stdin";
3179         case STDOUT_FILENO:
3180                 if (c->std_output != EXEC_OUTPUT_NAMED_FD)
3181                         return NULL;
3182                 return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";
3183         case STDERR_FILENO:
3184                 if (c->std_error != EXEC_OUTPUT_NAMED_FD)
3185                         return NULL;
3186                 return c->stdio_fdname[STDERR_FILENO] ?: "stderr";
3187         default:
3188                 return NULL;
3189         }
3190 }
3191
3192 int exec_context_named_iofds(Unit *unit, const ExecContext *c, const ExecParameters *p, int named_iofds[3]) {
3193         unsigned i, targets;
3194         const char *stdio_fdname[3];
3195
3196         assert(c);
3197         assert(p);
3198
3199         targets = (c->std_input == EXEC_INPUT_NAMED_FD) +
3200                   (c->std_output == EXEC_OUTPUT_NAMED_FD) +
3201                   (c->std_error == EXEC_OUTPUT_NAMED_FD);
3202
3203         for (i = 0; i < 3; i++)
3204                 stdio_fdname[i] = exec_context_fdname(c, i);
3205
3206         for (i = 0; i < p->n_fds && targets > 0; i++)
3207                 if (named_iofds[STDIN_FILENO] < 0 && c->std_input == EXEC_INPUT_NAMED_FD && stdio_fdname[STDIN_FILENO] && streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) {
3208                         named_iofds[STDIN_FILENO] = p->fds[i];
3209                         targets--;
3210                 } else if (named_iofds[STDOUT_FILENO] < 0 && c->std_output == EXEC_OUTPUT_NAMED_FD && stdio_fdname[STDOUT_FILENO] && streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) {
3211                         named_iofds[STDOUT_FILENO] = p->fds[i];
3212                         targets--;
3213                 } else if (named_iofds[STDERR_FILENO] < 0 && c->std_error == EXEC_OUTPUT_NAMED_FD && stdio_fdname[STDERR_FILENO] && streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) {
3214                         named_iofds[STDERR_FILENO] = p->fds[i];
3215                         targets--;
3216                 }
3217
3218         return (targets == 0 ? 0 : -ENOENT);
3219 }
3220
3221 int exec_context_load_environment(Unit *unit, const ExecContext *c, char ***l) {
3222         char **i, **r = NULL;
3223
3224         assert(c);
3225         assert(l);
3226
3227         STRV_FOREACH(i, c->environment_files) {
3228                 char *fn;
3229                 int k;
3230                 bool ignore = false;
3231                 char **p;
3232                 _cleanup_globfree_ glob_t pglob = {};
3233                 int count, n;
3234
3235                 fn = *i;
3236
3237                 if (fn[0] == '-') {
3238                         ignore = true;
3239                         fn++;
3240                 }
3241
3242                 if (!path_is_absolute(fn)) {
3243                         if (ignore)
3244                                 continue;
3245
3246                         strv_free(r);
3247                         return -EINVAL;
3248                 }
3249
3250                 /* Filename supports globbing, take all matching files */
3251                 errno = 0;
3252                 if (glob(fn, 0, NULL, &pglob) != 0) {
3253                         if (ignore)
3254                                 continue;
3255
3256                         strv_free(r);
3257                         return errno > 0 ? -errno : -EINVAL;
3258                 }
3259                 count = pglob.gl_pathc;
3260                 if (count == 0) {
3261                         if (ignore)
3262                                 continue;
3263
3264                         strv_free(r);
3265                         return -EINVAL;
3266                 }
3267                 for (n = 0; n < count; n++) {
3268                         k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
3269                         if (k < 0) {
3270                                 if (ignore)
3271                                         continue;
3272
3273                                 strv_free(r);
3274                                 return k;
3275                         }
3276                         /* Log invalid environment variables with filename */
3277                         if (p) {
3278                                 InvalidEnvInfo info = {
3279                                         .unit = unit,
3280                                         .path = pglob.gl_pathv[n]
3281                                 };
3282
3283                                 p = strv_env_clean_with_callback(p, invalid_env, &info);
3284                         }
3285
3286                         if (r == NULL)
3287                                 r = p;
3288                         else {
3289                                 char **m;
3290
3291                                 m = strv_env_merge(2, r, p);
3292                                 strv_free(r);
3293                                 strv_free(p);
3294                                 if (!m)
3295                                         return -ENOMEM;
3296
3297                                 r = m;
3298                         }
3299                 }
3300         }
3301
3302         *l = r;
3303
3304         return 0;
3305 }
3306
3307 static bool tty_may_match_dev_console(const char *tty) {
3308         _cleanup_free_ char *active = NULL;
3309         char *console;
3310
3311         if (!tty)
3312                 return true;
3313
3314         if (startswith(tty, "/dev/"))
3315                 tty += 5;
3316
3317         /* trivial identity? */
3318         if (streq(tty, "console"))
3319                 return true;
3320
3321         console = resolve_dev_console(&active);
3322         /* if we could not resolve, assume it may */
3323         if (!console)
3324                 return true;
3325
3326         /* "tty0" means the active VC, so it may be the same sometimes */
3327         return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
3328 }
3329
3330 bool exec_context_may_touch_console(ExecContext *ec) {
3331
3332         return (ec->tty_reset ||
3333                 ec->tty_vhangup ||
3334                 ec->tty_vt_disallocate ||
3335                 is_terminal_input(ec->std_input) ||
3336                 is_terminal_output(ec->std_output) ||
3337                 is_terminal_output(ec->std_error)) &&
3338                tty_may_match_dev_console(exec_context_tty_path(ec));
3339 }
3340
3341 static void strv_fprintf(FILE *f, char **l) {
3342         char **g;
3343
3344         assert(f);
3345
3346         STRV_FOREACH(g, l)
3347                 fprintf(f, " %s", *g);
3348 }
3349
3350 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
3351         char **e, **d;
3352         unsigned i;
3353         int r;
3354
3355         assert(c);
3356         assert(f);
3357
3358         prefix = strempty(prefix);
3359
3360         fprintf(f,
3361                 "%sUMask: %04o\n"
3362                 "%sWorkingDirectory: %s\n"
3363                 "%sRootDirectory: %s\n"
3364                 "%sNonBlocking: %s\n"
3365                 "%sPrivateTmp: %s\n"
3366                 "%sPrivateDevices: %s\n"
3367                 "%sProtectKernelTunables: %s\n"
3368                 "%sProtectKernelModules: %s\n"
3369                 "%sProtectControlGroups: %s\n"
3370                 "%sPrivateNetwork: %s\n"
3371                 "%sPrivateUsers: %s\n"
3372                 "%sProtectHome: %s\n"
3373                 "%sProtectSystem: %s\n"
3374                 "%sIgnoreSIGPIPE: %s\n"
3375                 "%sMemoryDenyWriteExecute: %s\n"
3376                 "%sRestrictRealtime: %s\n",
3377                 prefix, c->umask,
3378                 prefix, c->working_directory ? c->working_directory : "/",
3379                 prefix, c->root_directory ? c->root_directory : "/",
3380                 prefix, yes_no(c->non_blocking),
3381                 prefix, yes_no(c->private_tmp),
3382                 prefix, yes_no(c->private_devices),
3383                 prefix, yes_no(c->protect_kernel_tunables),
3384                 prefix, yes_no(c->protect_kernel_modules),
3385                 prefix, yes_no(c->protect_control_groups),
3386                 prefix, yes_no(c->private_network),
3387                 prefix, yes_no(c->private_users),
3388                 prefix, protect_home_to_string(c->protect_home),
3389                 prefix, protect_system_to_string(c->protect_system),
3390                 prefix, yes_no(c->ignore_sigpipe),
3391                 prefix, yes_no(c->memory_deny_write_execute),
3392                 prefix, yes_no(c->restrict_realtime));
3393
3394         STRV_FOREACH(e, c->environment)
3395                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
3396
3397         STRV_FOREACH(e, c->environment_files)
3398                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
3399
3400         STRV_FOREACH(e, c->pass_environment)
3401                 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
3402
3403         fprintf(f, "%sRuntimeDirectoryMode: %04o\n", prefix, c->runtime_directory_mode);
3404
3405         STRV_FOREACH(d, c->runtime_directory)
3406                 fprintf(f, "%sRuntimeDirectory: %s\n", prefix, *d);
3407
3408         if (c->nice_set)
3409                 fprintf(f,
3410                         "%sNice: %i\n",
3411                         prefix, c->nice);
3412
3413         if (c->oom_score_adjust_set)
3414                 fprintf(f,
3415                         "%sOOMScoreAdjust: %i\n",
3416                         prefix, c->oom_score_adjust);
3417
3418         for (i = 0; i < RLIM_NLIMITS; i++)
3419                 if (c->rlimit[i]) {
3420                         fprintf(f, "%s%s: " RLIM_FMT "\n",
3421                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
3422                         fprintf(f, "%s%sSoft: " RLIM_FMT "\n",
3423                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
3424                 }
3425
3426         if (c->ioprio_set) {
3427                 _cleanup_free_ char *class_str = NULL;
3428
3429                 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
3430                 fprintf(f,
3431                         "%sIOSchedulingClass: %s\n"
3432                         "%sIOPriority: %i\n",
3433                         prefix, strna(class_str),
3434                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
3435         }
3436
3437         if (c->cpu_sched_set) {
3438                 _cleanup_free_ char *policy_str = NULL;
3439
3440                 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
3441                 fprintf(f,
3442                         "%sCPUSchedulingPolicy: %s\n"
3443                         "%sCPUSchedulingPriority: %i\n"
3444                         "%sCPUSchedulingResetOnFork: %s\n",
3445                         prefix, strna(policy_str),
3446                         prefix, c->cpu_sched_priority,
3447                         prefix, yes_no(c->cpu_sched_reset_on_fork));
3448         }
3449
3450         if (c->cpuset) {
3451                 fprintf(f, "%sCPUAffinity:", prefix);
3452                 for (i = 0; i < c->cpuset_ncpus; i++)
3453                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
3454                                 fprintf(f, " %u", i);
3455                 fputs("\n", f);
3456         }
3457
3458         if (c->timer_slack_nsec != NSEC_INFINITY)
3459                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
3460
3461         fprintf(f,
3462                 "%sStandardInput: %s\n"
3463                 "%sStandardOutput: %s\n"
3464                 "%sStandardError: %s\n",
3465                 prefix, exec_input_to_string(c->std_input),
3466                 prefix, exec_output_to_string(c->std_output),
3467                 prefix, exec_output_to_string(c->std_error));
3468
3469         if (c->tty_path)
3470                 fprintf(f,
3471                         "%sTTYPath: %s\n"
3472                         "%sTTYReset: %s\n"
3473                         "%sTTYVHangup: %s\n"
3474                         "%sTTYVTDisallocate: %s\n",
3475                         prefix, c->tty_path,
3476                         prefix, yes_no(c->tty_reset),
3477                         prefix, yes_no(c->tty_vhangup),
3478                         prefix, yes_no(c->tty_vt_disallocate));
3479
3480         if (c->std_output == EXEC_OUTPUT_SYSLOG ||
3481             c->std_output == EXEC_OUTPUT_KMSG ||
3482             c->std_output == EXEC_OUTPUT_JOURNAL ||
3483             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
3484             c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
3485             c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
3486             c->std_error == EXEC_OUTPUT_SYSLOG ||
3487             c->std_error == EXEC_OUTPUT_KMSG ||
3488             c->std_error == EXEC_OUTPUT_JOURNAL ||
3489             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
3490             c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
3491             c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
3492
3493                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
3494
3495                 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
3496                 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
3497
3498                 fprintf(f,
3499                         "%sSyslogFacility: %s\n"
3500                         "%sSyslogLevel: %s\n",
3501                         prefix, strna(fac_str),
3502                         prefix, strna(lvl_str));
3503         }
3504
3505         if (c->secure_bits)
3506                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
3507                         prefix,
3508                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
3509                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
3510                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
3511                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
3512                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
3513                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
3514
3515         if (c->capability_bounding_set != CAP_ALL) {
3516                 unsigned long l;
3517                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
3518
3519                 for (l = 0; l <= cap_last_cap(); l++)
3520                         if (c->capability_bounding_set & (UINT64_C(1) << l))
3521                                 fprintf(f, " %s", strna(capability_to_name(l)));
3522
3523                 fputs("\n", f);
3524         }
3525
3526         if (c->capability_ambient_set != 0) {
3527                 unsigned long l;
3528                 fprintf(f, "%sAmbientCapabilities:", prefix);
3529
3530                 for (l = 0; l <= cap_last_cap(); l++)
3531                         if (c->capability_ambient_set & (UINT64_C(1) << l))
3532                                 fprintf(f, " %s", strna(capability_to_name(l)));
3533
3534                 fputs("\n", f);
3535         }
3536
3537         if (c->user)
3538                 fprintf(f, "%sUser: %s\n", prefix, c->user);
3539         if (c->group)
3540                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
3541
3542         fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
3543
3544         if (strv_length(c->supplementary_groups) > 0) {
3545                 fprintf(f, "%sSupplementaryGroups:", prefix);
3546                 strv_fprintf(f, c->supplementary_groups);
3547                 fputs("\n", f);
3548         }
3549
3550         if (c->pam_name)
3551                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
3552
3553         if (strv_length(c->read_write_paths) > 0) {
3554                 fprintf(f, "%sReadWritePaths:", prefix);
3555                 strv_fprintf(f, c->read_write_paths);
3556                 fputs("\n", f);
3557         }
3558
3559         if (strv_length(c->read_only_paths) > 0) {
3560                 fprintf(f, "%sReadOnlyPaths:", prefix);
3561                 strv_fprintf(f, c->read_only_paths);
3562                 fputs("\n", f);
3563         }
3564
3565         if (strv_length(c->inaccessible_paths) > 0) {
3566                 fprintf(f, "%sInaccessiblePaths:", prefix);
3567                 strv_fprintf(f, c->inaccessible_paths);
3568                 fputs("\n", f);
3569         }
3570
3571         if (c->utmp_id)
3572                 fprintf(f,
3573                         "%sUtmpIdentifier: %s\n",
3574                         prefix, c->utmp_id);
3575
3576         if (c->selinux_context)
3577                 fprintf(f,
3578                         "%sSELinuxContext: %s%s\n",
3579                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
3580
3581         if (c->personality != PERSONALITY_INVALID)
3582                 fprintf(f,
3583                         "%sPersonality: %s\n",
3584                         prefix, strna(personality_to_string(c->personality)));
3585
3586         if (c->syscall_filter) {
3587 #ifdef HAVE_SECCOMP
3588                 Iterator j;
3589                 void *id;
3590                 bool first = true;
3591 #endif
3592
3593                 fprintf(f,
3594                         "%sSystemCallFilter: ",
3595                         prefix);
3596
3597                 if (!c->syscall_whitelist)
3598                         fputc('~', f);
3599
3600 #ifdef HAVE_SECCOMP
3601                 SET_FOREACH(id, c->syscall_filter, j) {
3602                         _cleanup_free_ char *name = NULL;
3603
3604                         if (first)
3605                                 first = false;
3606                         else
3607                                 fputc(' ', f);
3608
3609                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
3610                         fputs(strna(name), f);
3611                 }
3612 #endif
3613
3614                 fputc('\n', f);
3615         }
3616
3617         if (c->syscall_archs) {
3618 #ifdef HAVE_SECCOMP
3619                 Iterator j;
3620                 void *id;
3621 #endif
3622
3623                 fprintf(f,
3624                         "%sSystemCallArchitectures:",
3625                         prefix);
3626
3627 #ifdef HAVE_SECCOMP
3628                 SET_FOREACH(id, c->syscall_archs, j)
3629                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
3630 #endif
3631                 fputc('\n', f);
3632         }
3633
3634         if (exec_context_restrict_namespaces_set(c)) {
3635                 _cleanup_free_ char *s = NULL;
3636
3637                 r = namespace_flag_to_string_many(c->restrict_namespaces, &s);
3638                 if (r >= 0)
3639                         fprintf(f, "%sRestrictNamespaces: %s\n",
3640                                 prefix, s);
3641         }
3642
3643         if (c->syscall_errno > 0)
3644                 fprintf(f,
3645                         "%sSystemCallErrorNumber: %s\n",
3646                         prefix, strna(errno_to_name(c->syscall_errno)));
3647
3648         if (c->apparmor_profile)
3649                 fprintf(f,
3650                         "%sAppArmorProfile: %s%s\n",
3651                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
3652 }
3653
3654 bool exec_context_maintains_privileges(ExecContext *c) {
3655         assert(c);
3656
3657         /* Returns true if the process forked off would run under
3658          * an unchanged UID or as root. */
3659
3660         if (!c->user)
3661                 return true;
3662
3663         if (streq(c->user, "root") || streq(c->user, "0"))
3664                 return true;
3665
3666         return false;
3667 }
3668
3669 void exec_status_start(ExecStatus *s, pid_t pid) {
3670         assert(s);
3671
3672         zero(*s);
3673         s->pid = pid;
3674         dual_timestamp_get(&s->start_timestamp);
3675 }
3676
3677 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
3678         assert(s);
3679
3680         if (s->pid && s->pid != pid)
3681                 zero(*s);
3682
3683         s->pid = pid;
3684         dual_timestamp_get(&s->exit_timestamp);
3685
3686         s->code = code;
3687         s->status = status;
3688
3689         if (context) {
3690                 if (context->utmp_id)
3691                         utmp_put_dead_process(context->utmp_id, pid, code, status);
3692
3693                 exec_context_tty_reset(context, NULL);
3694         }
3695 }
3696
3697 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
3698         char buf[FORMAT_TIMESTAMP_MAX];
3699
3700         assert(s);
3701         assert(f);
3702
3703         if (s->pid <= 0)
3704                 return;
3705
3706         prefix = strempty(prefix);
3707
3708         fprintf(f,
3709                 "%sPID: "PID_FMT"\n",
3710                 prefix, s->pid);
3711
3712         if (dual_timestamp_is_set(&s->start_timestamp))
3713                 fprintf(f,
3714                         "%sStart Timestamp: %s\n",
3715                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
3716
3717         if (dual_timestamp_is_set(&s->exit_timestamp))
3718                 fprintf(f,
3719                         "%sExit Timestamp: %s\n"
3720                         "%sExit Code: %s\n"
3721                         "%sExit Status: %i\n",
3722                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
3723                         prefix, sigchld_code_to_string(s->code),
3724                         prefix, s->status);
3725 }
3726
3727 char *exec_command_line(char **argv) {
3728         size_t k;
3729         char *n, *p, **a;
3730         bool first = true;
3731
3732         assert(argv);
3733
3734         k = 1;
3735         STRV_FOREACH(a, argv)
3736                 k += strlen(*a)+3;
3737
3738         n = new(char, k);
3739         if (!n)
3740                 return NULL;
3741
3742         p = n;
3743         STRV_FOREACH(a, argv) {
3744
3745                 if (!first)
3746                         *(p++) = ' ';
3747                 else
3748                         first = false;
3749
3750                 if (strpbrk(*a, WHITESPACE)) {
3751                         *(p++) = '\'';
3752                         p = stpcpy(p, *a);
3753                         *(p++) = '\'';
3754                 } else
3755                         p = stpcpy(p, *a);
3756
3757         }
3758
3759         *p = 0;
3760
3761         /* FIXME: this doesn't really handle arguments that have
3762          * spaces and ticks in them */
3763
3764         return n;
3765 }
3766
3767 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
3768         _cleanup_free_ char *cmd = NULL;
3769         const char *prefix2;
3770
3771         assert(c);
3772         assert(f);
3773
3774         prefix = strempty(prefix);
3775         prefix2 = strjoina(prefix, "\t");
3776
3777         cmd = exec_command_line(c->argv);
3778         fprintf(f,
3779                 "%sCommand Line: %s\n",
3780                 prefix, cmd ? cmd : strerror(ENOMEM));
3781
3782         exec_status_dump(&c->exec_status, f, prefix2);
3783 }
3784
3785 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
3786         assert(f);
3787
3788         prefix = strempty(prefix);
3789
3790         LIST_FOREACH(command, c, c)
3791                 exec_command_dump(c, f, prefix);
3792 }
3793
3794 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
3795         ExecCommand *end;
3796
3797         assert(l);
3798         assert(e);
3799
3800         if (*l) {
3801                 /* It's kind of important, that we keep the order here */
3802                 LIST_FIND_TAIL(command, *l, end);
3803                 LIST_INSERT_AFTER(command, *l, end, e);
3804         } else
3805               *l = e;
3806 }
3807
3808 int exec_command_set(ExecCommand *c, const char *path, ...) {
3809         va_list ap;
3810         char **l, *p;
3811
3812         assert(c);
3813         assert(path);
3814
3815         va_start(ap, path);
3816         l = strv_new_ap(path, ap);
3817         va_end(ap);
3818
3819         if (!l)
3820                 return -ENOMEM;
3821
3822         p = strdup(path);
3823         if (!p) {
3824                 strv_free(l);
3825                 return -ENOMEM;
3826         }
3827
3828         free(c->path);
3829         c->path = p;
3830
3831         strv_free(c->argv);
3832         c->argv = l;
3833
3834         return 0;
3835 }
3836
3837 int exec_command_append(ExecCommand *c, const char *path, ...) {
3838         _cleanup_strv_free_ char **l = NULL;
3839         va_list ap;
3840         int r;
3841
3842         assert(c);
3843         assert(path);
3844
3845         va_start(ap, path);
3846         l = strv_new_ap(path, ap);
3847         va_end(ap);
3848
3849         if (!l)
3850                 return -ENOMEM;
3851
3852         r = strv_extend_strv(&c->argv, l, false);
3853         if (r < 0)
3854                 return r;
3855
3856         return 0;
3857 }
3858
3859
3860 static int exec_runtime_allocate(ExecRuntime **rt) {
3861
3862         if (*rt)
3863                 return 0;
3864
3865         *rt = new0(ExecRuntime, 1);
3866         if (!*rt)
3867                 return -ENOMEM;
3868
3869         (*rt)->n_ref = 1;
3870         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
3871
3872         return 0;
3873 }
3874
3875 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
3876         int r;
3877
3878         assert(rt);
3879         assert(c);
3880         assert(id);
3881
3882         if (*rt)
3883                 return 1;
3884
3885         if (!c->private_network && !c->private_tmp)
3886                 return 0;
3887
3888         r = exec_runtime_allocate(rt);
3889         if (r < 0)
3890                 return r;
3891
3892         if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
3893                 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, (*rt)->netns_storage_socket) < 0)
3894                         return -errno;
3895         }
3896
3897         if (c->private_tmp && !(*rt)->tmp_dir) {
3898                 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
3899                 if (r < 0)
3900                         return r;
3901         }
3902
3903         return 1;
3904 }
3905
3906 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
3907         assert(r);
3908         assert(r->n_ref > 0);
3909
3910         r->n_ref++;
3911         return r;
3912 }
3913
3914 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
3915
3916         if (!r)
3917                 return NULL;
3918
3919         assert(r->n_ref > 0);
3920
3921         r->n_ref--;
3922         if (r->n_ref > 0)
3923                 return NULL;
3924
3925         free(r->tmp_dir);
3926         free(r->var_tmp_dir);
3927         safe_close_pair(r->netns_storage_socket);
3928         return mfree(r);
3929 }
3930
3931 int exec_runtime_serialize(Unit *u, ExecRuntime *rt, FILE *f, FDSet *fds) {
3932         assert(u);
3933         assert(f);
3934         assert(fds);
3935
3936         if (!rt)
3937                 return 0;
3938
3939         if (rt->tmp_dir)
3940                 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
3941
3942         if (rt->var_tmp_dir)
3943                 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
3944
3945         if (rt->netns_storage_socket[0] >= 0) {
3946                 int copy;
3947
3948                 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
3949                 if (copy < 0)
3950                         return copy;
3951
3952                 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
3953         }
3954
3955         if (rt->netns_storage_socket[1] >= 0) {
3956                 int copy;
3957
3958                 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
3959                 if (copy < 0)
3960                         return copy;
3961
3962                 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
3963         }
3964
3965         return 0;
3966 }
3967
3968 int exec_runtime_deserialize_item(Unit *u, ExecRuntime **rt, const char *key, const char *value, FDSet *fds) {
3969         int r;
3970
3971         assert(rt);
3972         assert(key);
3973         assert(value);
3974
3975         if (streq(key, "tmp-dir")) {
3976                 char *copy;
3977
3978                 r = exec_runtime_allocate(rt);
3979                 if (r < 0)
3980                         return log_oom();
3981
3982                 copy = strdup(value);
3983                 if (!copy)
3984                         return log_oom();
3985
3986                 free((*rt)->tmp_dir);
3987                 (*rt)->tmp_dir = copy;
3988
3989         } else if (streq(key, "var-tmp-dir")) {
3990                 char *copy;
3991
3992                 r = exec_runtime_allocate(rt);
3993                 if (r < 0)
3994                         return log_oom();
3995
3996                 copy = strdup(value);
3997                 if (!copy)
3998                         return log_oom();
3999
4000                 free((*rt)->var_tmp_dir);
4001                 (*rt)->var_tmp_dir = copy;
4002
4003         } else if (streq(key, "netns-socket-0")) {
4004                 int fd;
4005
4006                 r = exec_runtime_allocate(rt);
4007                 if (r < 0)
4008                         return log_oom();
4009
4010                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
4011                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
4012                 else {
4013                         safe_close((*rt)->netns_storage_socket[0]);
4014                         (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
4015                 }
4016         } else if (streq(key, "netns-socket-1")) {
4017                 int fd;
4018
4019                 r = exec_runtime_allocate(rt);
4020                 if (r < 0)
4021                         return log_oom();
4022
4023                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
4024                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
4025                 else {
4026                         safe_close((*rt)->netns_storage_socket[1]);
4027                         (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
4028                 }
4029         } else
4030                 return 0;
4031
4032         return 1;
4033 }
4034
4035 static void *remove_tmpdir_thread(void *p) {
4036         _cleanup_free_ char *path = p;
4037
4038         (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
4039         return NULL;
4040 }
4041
4042 void exec_runtime_destroy(ExecRuntime *rt) {
4043         int r;
4044
4045         if (!rt)
4046                 return;
4047
4048         /* If there are multiple users of this, let's leave the stuff around */
4049         if (rt->n_ref > 1)
4050                 return;
4051
4052         if (rt->tmp_dir) {
4053                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
4054
4055                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
4056                 if (r < 0) {
4057                         log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
4058                         free(rt->tmp_dir);
4059                 }
4060
4061                 rt->tmp_dir = NULL;
4062         }
4063
4064         if (rt->var_tmp_dir) {
4065                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
4066
4067                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
4068                 if (r < 0) {
4069                         log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
4070                         free(rt->var_tmp_dir);
4071                 }
4072
4073                 rt->var_tmp_dir = NULL;
4074         }
4075
4076         safe_close_pair(rt->netns_storage_socket);
4077 }
4078
4079 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
4080         [EXEC_INPUT_NULL] = "null",
4081         [EXEC_INPUT_TTY] = "tty",
4082         [EXEC_INPUT_TTY_FORCE] = "tty-force",
4083         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
4084         [EXEC_INPUT_SOCKET] = "socket",
4085         [EXEC_INPUT_NAMED_FD] = "fd",
4086 };
4087
4088 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
4089
4090 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
4091         [EXEC_OUTPUT_INHERIT] = "inherit",
4092         [EXEC_OUTPUT_NULL] = "null",
4093         [EXEC_OUTPUT_TTY] = "tty",
4094         [EXEC_OUTPUT_SYSLOG] = "syslog",
4095         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
4096         [EXEC_OUTPUT_KMSG] = "kmsg",
4097         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
4098         [EXEC_OUTPUT_JOURNAL] = "journal",
4099         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
4100         [EXEC_OUTPUT_SOCKET] = "socket",
4101         [EXEC_OUTPUT_NAMED_FD] = "fd",
4102 };
4103
4104 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
4105
4106 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
4107         [EXEC_UTMP_INIT] = "init",
4108         [EXEC_UTMP_LOGIN] = "login",
4109         [EXEC_UTMP_USER] = "user",
4110 };
4111
4112 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);