]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/core/execute.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
core: add two new service settings ProtectKernelTunables= and ProtectControlGroups=
[thirdparty/systemd.git] / src / core / execute.c
1 /***
2 This file is part of systemd.
3
4 Copyright 2010 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18 ***/
19
20 #include <errno.h>
21 #include <fcntl.h>
22 #include <glob.h>
23 #include <grp.h>
24 #include <poll.h>
25 #include <signal.h>
26 #include <string.h>
27 #include <sys/capability.h>
28 #include <sys/eventfd.h>
29 #include <sys/mman.h>
30 #include <sys/personality.h>
31 #include <sys/prctl.h>
32 #include <sys/socket.h>
33 #include <sys/stat.h>
34 #include <sys/un.h>
35 #include <unistd.h>
36 #include <utmpx.h>
37
38 #ifdef HAVE_PAM
39 #include <security/pam_appl.h>
40 #endif
41
42 #ifdef HAVE_SELINUX
43 #include <selinux/selinux.h>
44 #endif
45
46 #ifdef HAVE_SECCOMP
47 #include <seccomp.h>
48 #endif
49
50 #ifdef HAVE_APPARMOR
51 #include <sys/apparmor.h>
52 #endif
53
54 #include "sd-messages.h"
55
56 #include "af-list.h"
57 #include "alloc-util.h"
58 #ifdef HAVE_APPARMOR
59 #include "apparmor-util.h"
60 #endif
61 #include "async.h"
62 #include "barrier.h"
63 #include "cap-list.h"
64 #include "capability-util.h"
65 #include "def.h"
66 #include "env-util.h"
67 #include "errno-list.h"
68 #include "execute.h"
69 #include "exit-status.h"
70 #include "fd-util.h"
71 #include "fileio.h"
72 #include "formats-util.h"
73 #include "fs-util.h"
74 #include "glob-util.h"
75 #include "io-util.h"
76 #include "ioprio.h"
77 #include "log.h"
78 #include "macro.h"
79 #include "missing.h"
80 #include "mkdir.h"
81 #include "namespace.h"
82 #include "parse-util.h"
83 #include "path-util.h"
84 #include "process-util.h"
85 #include "rlimit-util.h"
86 #include "rm-rf.h"
87 #ifdef HAVE_SECCOMP
88 #include "seccomp-util.h"
89 #endif
90 #include "securebits.h"
91 #include "selinux-util.h"
92 #include "signal-util.h"
93 #include "smack-util.h"
94 #include "special.h"
95 #include "string-table.h"
96 #include "string-util.h"
97 #include "strv.h"
98 #include "syslog-util.h"
99 #include "terminal-util.h"
100 #include "unit.h"
101 #include "user-util.h"
102 #include "util.h"
103 #include "utmp-wtmp.h"
104
105 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
106 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
107
108 /* This assumes there is a 'tty' group */
109 #define TTY_MODE 0620
110
111 #define SNDBUF_SIZE (8*1024*1024)
112
113 static int shift_fds(int fds[], unsigned n_fds) {
114 int start, restart_from;
115
116 if (n_fds <= 0)
117 return 0;
118
119 /* Modifies the fds array! (sorts it) */
120
121 assert(fds);
122
123 start = 0;
124 for (;;) {
125 int i;
126
127 restart_from = -1;
128
129 for (i = start; i < (int) n_fds; i++) {
130 int nfd;
131
132 /* Already at right index? */
133 if (fds[i] == i+3)
134 continue;
135
136 nfd = fcntl(fds[i], F_DUPFD, i + 3);
137 if (nfd < 0)
138 return -errno;
139
140 safe_close(fds[i]);
141 fds[i] = nfd;
142
143 /* Hmm, the fd we wanted isn't free? Then
144 * let's remember that and try again from here */
145 if (nfd != i+3 && restart_from < 0)
146 restart_from = i;
147 }
148
149 if (restart_from < 0)
150 break;
151
152 start = restart_from;
153 }
154
155 return 0;
156 }
157
158 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
159 unsigned i;
160 int r;
161
162 if (n_fds <= 0)
163 return 0;
164
165 assert(fds);
166
167 /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
168
169 for (i = 0; i < n_fds; i++) {
170
171 r = fd_nonblock(fds[i], nonblock);
172 if (r < 0)
173 return r;
174
175 /* We unconditionally drop FD_CLOEXEC from the fds,
176 * since after all we want to pass these fds to our
177 * children */
178
179 r = fd_cloexec(fds[i], false);
180 if (r < 0)
181 return r;
182 }
183
184 return 0;
185 }
186
187 static const char *exec_context_tty_path(const ExecContext *context) {
188 assert(context);
189
190 if (context->stdio_as_fds)
191 return NULL;
192
193 if (context->tty_path)
194 return context->tty_path;
195
196 return "/dev/console";
197 }
198
199 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
200 const char *path;
201
202 assert(context);
203
204 path = exec_context_tty_path(context);
205
206 if (context->tty_vhangup) {
207 if (p && p->stdin_fd >= 0)
208 (void) terminal_vhangup_fd(p->stdin_fd);
209 else if (path)
210 (void) terminal_vhangup(path);
211 }
212
213 if (context->tty_reset) {
214 if (p && p->stdin_fd >= 0)
215 (void) reset_terminal_fd(p->stdin_fd, true);
216 else if (path)
217 (void) reset_terminal(path);
218 }
219
220 if (context->tty_vt_disallocate && path)
221 (void) vt_disallocate(path);
222 }
223
224 static bool is_terminal_input(ExecInput i) {
225 return IN_SET(i,
226 EXEC_INPUT_TTY,
227 EXEC_INPUT_TTY_FORCE,
228 EXEC_INPUT_TTY_FAIL);
229 }
230
231 static bool is_terminal_output(ExecOutput o) {
232 return IN_SET(o,
233 EXEC_OUTPUT_TTY,
234 EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
235 EXEC_OUTPUT_KMSG_AND_CONSOLE,
236 EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
237 }
238
239 static bool exec_context_needs_term(const ExecContext *c) {
240 assert(c);
241
242 /* Return true if the execution context suggests we should set $TERM to something useful. */
243
244 if (is_terminal_input(c->std_input))
245 return true;
246
247 if (is_terminal_output(c->std_output))
248 return true;
249
250 if (is_terminal_output(c->std_error))
251 return true;
252
253 return !!c->tty_path;
254 }
255
256 static int open_null_as(int flags, int nfd) {
257 int fd, r;
258
259 assert(nfd >= 0);
260
261 fd = open("/dev/null", flags|O_NOCTTY);
262 if (fd < 0)
263 return -errno;
264
265 if (fd != nfd) {
266 r = dup2(fd, nfd) < 0 ? -errno : nfd;
267 safe_close(fd);
268 } else
269 r = nfd;
270
271 return r;
272 }
273
274 static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
275 union sockaddr_union sa = {
276 .un.sun_family = AF_UNIX,
277 .un.sun_path = "/run/systemd/journal/stdout",
278 };
279 uid_t olduid = UID_INVALID;
280 gid_t oldgid = GID_INVALID;
281 int r;
282
283 if (gid != GID_INVALID) {
284 oldgid = getgid();
285
286 r = setegid(gid);
287 if (r < 0)
288 return -errno;
289 }
290
291 if (uid != UID_INVALID) {
292 olduid = getuid();
293
294 r = seteuid(uid);
295 if (r < 0) {
296 r = -errno;
297 goto restore_gid;
298 }
299 }
300
301 r = connect(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
302 if (r < 0)
303 r = -errno;
304
305 /* If we fail to restore the uid or gid, things will likely
306 fail later on. This should only happen if an LSM interferes. */
307
308 if (uid != UID_INVALID)
309 (void) seteuid(olduid);
310
311 restore_gid:
312 if (gid != GID_INVALID)
313 (void) setegid(oldgid);
314
315 return r;
316 }
317
318 static int connect_logger_as(
319 Unit *unit,
320 const ExecContext *context,
321 ExecOutput output,
322 const char *ident,
323 int nfd,
324 uid_t uid,
325 gid_t gid) {
326
327 int fd, r;
328
329 assert(context);
330 assert(output < _EXEC_OUTPUT_MAX);
331 assert(ident);
332 assert(nfd >= 0);
333
334 fd = socket(AF_UNIX, SOCK_STREAM, 0);
335 if (fd < 0)
336 return -errno;
337
338 r = connect_journal_socket(fd, uid, gid);
339 if (r < 0)
340 return r;
341
342 if (shutdown(fd, SHUT_RD) < 0) {
343 safe_close(fd);
344 return -errno;
345 }
346
347 (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
348
349 dprintf(fd,
350 "%s\n"
351 "%s\n"
352 "%i\n"
353 "%i\n"
354 "%i\n"
355 "%i\n"
356 "%i\n",
357 context->syslog_identifier ? context->syslog_identifier : ident,
358 unit->id,
359 context->syslog_priority,
360 !!context->syslog_level_prefix,
361 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
362 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
363 is_terminal_output(output));
364
365 if (fd == nfd)
366 return nfd;
367
368 r = dup2(fd, nfd) < 0 ? -errno : nfd;
369 safe_close(fd);
370
371 return r;
372 }
373 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
374 int fd, r;
375
376 assert(path);
377 assert(nfd >= 0);
378
379 fd = open_terminal(path, mode | O_NOCTTY);
380 if (fd < 0)
381 return fd;
382
383 if (fd != nfd) {
384 r = dup2(fd, nfd) < 0 ? -errno : nfd;
385 safe_close(fd);
386 } else
387 r = nfd;
388
389 return r;
390 }
391
392 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
393
394 if (is_terminal_input(std_input) && !apply_tty_stdin)
395 return EXEC_INPUT_NULL;
396
397 if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
398 return EXEC_INPUT_NULL;
399
400 return std_input;
401 }
402
403 static int fixup_output(ExecOutput std_output, int socket_fd) {
404
405 if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
406 return EXEC_OUTPUT_INHERIT;
407
408 return std_output;
409 }
410
411 static int setup_input(
412 const ExecContext *context,
413 const ExecParameters *params,
414 int socket_fd) {
415
416 ExecInput i;
417
418 assert(context);
419 assert(params);
420
421 if (params->stdin_fd >= 0) {
422 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
423 return -errno;
424
425 /* Try to make this the controlling tty, if it is a tty, and reset it */
426 (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
427 (void) reset_terminal_fd(STDIN_FILENO, true);
428
429 return STDIN_FILENO;
430 }
431
432 i = fixup_input(context->std_input, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
433
434 switch (i) {
435
436 case EXEC_INPUT_NULL:
437 return open_null_as(O_RDONLY, STDIN_FILENO);
438
439 case EXEC_INPUT_TTY:
440 case EXEC_INPUT_TTY_FORCE:
441 case EXEC_INPUT_TTY_FAIL: {
442 int fd, r;
443
444 fd = acquire_terminal(exec_context_tty_path(context),
445 i == EXEC_INPUT_TTY_FAIL,
446 i == EXEC_INPUT_TTY_FORCE,
447 false,
448 USEC_INFINITY);
449 if (fd < 0)
450 return fd;
451
452 if (fd != STDIN_FILENO) {
453 r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
454 safe_close(fd);
455 } else
456 r = STDIN_FILENO;
457
458 return r;
459 }
460
461 case EXEC_INPUT_SOCKET:
462 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
463
464 default:
465 assert_not_reached("Unknown input type");
466 }
467 }
468
469 static int setup_output(
470 Unit *unit,
471 const ExecContext *context,
472 const ExecParameters *params,
473 int fileno,
474 int socket_fd,
475 const char *ident,
476 uid_t uid,
477 gid_t gid,
478 dev_t *journal_stream_dev,
479 ino_t *journal_stream_ino) {
480
481 ExecOutput o;
482 ExecInput i;
483 int r;
484
485 assert(unit);
486 assert(context);
487 assert(params);
488 assert(ident);
489 assert(journal_stream_dev);
490 assert(journal_stream_ino);
491
492 if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
493
494 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
495 return -errno;
496
497 return STDOUT_FILENO;
498 }
499
500 if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
501 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
502 return -errno;
503
504 return STDERR_FILENO;
505 }
506
507 i = fixup_input(context->std_input, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
508 o = fixup_output(context->std_output, socket_fd);
509
510 if (fileno == STDERR_FILENO) {
511 ExecOutput e;
512 e = fixup_output(context->std_error, socket_fd);
513
514 /* This expects the input and output are already set up */
515
516 /* Don't change the stderr file descriptor if we inherit all
517 * the way and are not on a tty */
518 if (e == EXEC_OUTPUT_INHERIT &&
519 o == EXEC_OUTPUT_INHERIT &&
520 i == EXEC_INPUT_NULL &&
521 !is_terminal_input(context->std_input) &&
522 getppid () != 1)
523 return fileno;
524
525 /* Duplicate from stdout if possible */
526 if (e == o || e == EXEC_OUTPUT_INHERIT)
527 return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
528
529 o = e;
530
531 } else if (o == EXEC_OUTPUT_INHERIT) {
532 /* If input got downgraded, inherit the original value */
533 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
534 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
535
536 /* If the input is connected to anything that's not a /dev/null, inherit that... */
537 if (i != EXEC_INPUT_NULL)
538 return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
539
540 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
541 if (getppid() != 1)
542 return fileno;
543
544 /* We need to open /dev/null here anew, to get the right access mode. */
545 return open_null_as(O_WRONLY, fileno);
546 }
547
548 switch (o) {
549
550 case EXEC_OUTPUT_NULL:
551 return open_null_as(O_WRONLY, fileno);
552
553 case EXEC_OUTPUT_TTY:
554 if (is_terminal_input(i))
555 return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
556
557 /* We don't reset the terminal if this is just about output */
558 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
559
560 case EXEC_OUTPUT_SYSLOG:
561 case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
562 case EXEC_OUTPUT_KMSG:
563 case EXEC_OUTPUT_KMSG_AND_CONSOLE:
564 case EXEC_OUTPUT_JOURNAL:
565 case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
566 r = connect_logger_as(unit, context, o, ident, fileno, uid, gid);
567 if (r < 0) {
568 log_unit_error_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
569 r = open_null_as(O_WRONLY, fileno);
570 } else {
571 struct stat st;
572
573 /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
574 * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
575 * services to detect whether they are connected to the journal or not. */
576
577 if (fstat(fileno, &st) >= 0) {
578 *journal_stream_dev = st.st_dev;
579 *journal_stream_ino = st.st_ino;
580 }
581 }
582 return r;
583
584 case EXEC_OUTPUT_SOCKET:
585 assert(socket_fd >= 0);
586 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
587
588 default:
589 assert_not_reached("Unknown error type");
590 }
591 }
592
593 static int chown_terminal(int fd, uid_t uid) {
594 struct stat st;
595
596 assert(fd >= 0);
597
598 /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
599 if (isatty(fd) < 1)
600 return 0;
601
602 /* This might fail. What matters are the results. */
603 (void) fchown(fd, uid, -1);
604 (void) fchmod(fd, TTY_MODE);
605
606 if (fstat(fd, &st) < 0)
607 return -errno;
608
609 if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
610 return -EPERM;
611
612 return 0;
613 }
614
615 static int setup_confirm_stdio(int *_saved_stdin, int *_saved_stdout) {
616 _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
617 int r;
618
619 assert(_saved_stdin);
620 assert(_saved_stdout);
621
622 saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
623 if (saved_stdin < 0)
624 return -errno;
625
626 saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
627 if (saved_stdout < 0)
628 return -errno;
629
630 fd = acquire_terminal(
631 "/dev/console",
632 false,
633 false,
634 false,
635 DEFAULT_CONFIRM_USEC);
636 if (fd < 0)
637 return fd;
638
639 r = chown_terminal(fd, getuid());
640 if (r < 0)
641 return r;
642
643 r = reset_terminal_fd(fd, true);
644 if (r < 0)
645 return r;
646
647 if (dup2(fd, STDIN_FILENO) < 0)
648 return -errno;
649
650 if (dup2(fd, STDOUT_FILENO) < 0)
651 return -errno;
652
653 if (fd >= 2)
654 safe_close(fd);
655 fd = -1;
656
657 *_saved_stdin = saved_stdin;
658 *_saved_stdout = saved_stdout;
659
660 saved_stdin = saved_stdout = -1;
661
662 return 0;
663 }
664
665 _printf_(1, 2) static int write_confirm_message(const char *format, ...) {
666 _cleanup_close_ int fd = -1;
667 va_list ap;
668
669 assert(format);
670
671 fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
672 if (fd < 0)
673 return fd;
674
675 va_start(ap, format);
676 vdprintf(fd, format, ap);
677 va_end(ap);
678
679 return 0;
680 }
681
682 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
683 int r = 0;
684
685 assert(saved_stdin);
686 assert(saved_stdout);
687
688 release_terminal();
689
690 if (*saved_stdin >= 0)
691 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
692 r = -errno;
693
694 if (*saved_stdout >= 0)
695 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
696 r = -errno;
697
698 *saved_stdin = safe_close(*saved_stdin);
699 *saved_stdout = safe_close(*saved_stdout);
700
701 return r;
702 }
703
704 static int ask_for_confirmation(char *response, char **argv) {
705 int saved_stdout = -1, saved_stdin = -1, r;
706 _cleanup_free_ char *line = NULL;
707
708 r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
709 if (r < 0)
710 return r;
711
712 line = exec_command_line(argv);
713 if (!line)
714 return -ENOMEM;
715
716 r = ask_char(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
717
718 restore_confirm_stdio(&saved_stdin, &saved_stdout);
719
720 return r;
721 }
722
723 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
724 bool keep_groups = false;
725 int r;
726
727 assert(context);
728
729 /* Lookup and set GID and supplementary group list. Here too
730 * we avoid NSS lookups for gid=0. */
731
732 if (context->group || username) {
733 /* First step, initialize groups from /etc/groups */
734 if (username && gid != 0) {
735 if (initgroups(username, gid) < 0)
736 return -errno;
737
738 keep_groups = true;
739 }
740
741 /* Second step, set our gids */
742 if (setresgid(gid, gid, gid) < 0)
743 return -errno;
744 }
745
746 if (context->supplementary_groups) {
747 int ngroups_max, k;
748 gid_t *gids;
749 char **i;
750
751 /* Final step, initialize any manually set supplementary groups */
752 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
753
754 if (!(gids = new(gid_t, ngroups_max)))
755 return -ENOMEM;
756
757 if (keep_groups) {
758 k = getgroups(ngroups_max, gids);
759 if (k < 0) {
760 free(gids);
761 return -errno;
762 }
763 } else
764 k = 0;
765
766 STRV_FOREACH(i, context->supplementary_groups) {
767 const char *g;
768
769 if (k >= ngroups_max) {
770 free(gids);
771 return -E2BIG;
772 }
773
774 g = *i;
775 r = get_group_creds(&g, gids+k);
776 if (r < 0) {
777 free(gids);
778 return r;
779 }
780
781 k++;
782 }
783
784 if (setgroups(k, gids) < 0) {
785 free(gids);
786 return -errno;
787 }
788
789 free(gids);
790 }
791
792 return 0;
793 }
794
795 static int enforce_user(const ExecContext *context, uid_t uid) {
796 assert(context);
797
798 /* Sets (but doesn't look up) the uid and make sure we keep the
799 * capabilities while doing so. */
800
801 if (context->capability_ambient_set != 0) {
802
803 /* First step: If we need to keep capabilities but
804 * drop privileges we need to make sure we keep our
805 * caps, while we drop privileges. */
806 if (uid != 0) {
807 int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
808
809 if (prctl(PR_GET_SECUREBITS) != sb)
810 if (prctl(PR_SET_SECUREBITS, sb) < 0)
811 return -errno;
812 }
813 }
814
815 /* Second step: actually set the uids */
816 if (setresuid(uid, uid, uid) < 0)
817 return -errno;
818
819 /* At this point we should have all necessary capabilities but
820 are otherwise a normal user. However, the caps might got
821 corrupted due to the setresuid() so we need clean them up
822 later. This is done outside of this call. */
823
824 return 0;
825 }
826
827 #ifdef HAVE_PAM
828
829 static int null_conv(
830 int num_msg,
831 const struct pam_message **msg,
832 struct pam_response **resp,
833 void *appdata_ptr) {
834
835 /* We don't support conversations */
836
837 return PAM_CONV_ERR;
838 }
839
840 static int setup_pam(
841 const char *name,
842 const char *user,
843 uid_t uid,
844 const char *tty,
845 char ***env,
846 int fds[], unsigned n_fds) {
847
848 static const struct pam_conv conv = {
849 .conv = null_conv,
850 .appdata_ptr = NULL
851 };
852
853 _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
854 pam_handle_t *handle = NULL;
855 sigset_t old_ss;
856 int pam_code = PAM_SUCCESS, r;
857 char **nv, **e = NULL;
858 bool close_session = false;
859 pid_t pam_pid = 0, parent_pid;
860 int flags = 0;
861
862 assert(name);
863 assert(user);
864 assert(env);
865
866 /* We set up PAM in the parent process, then fork. The child
867 * will then stay around until killed via PR_GET_PDEATHSIG or
868 * systemd via the cgroup logic. It will then remove the PAM
869 * session again. The parent process will exec() the actual
870 * daemon. We do things this way to ensure that the main PID
871 * of the daemon is the one we initially fork()ed. */
872
873 r = barrier_create(&barrier);
874 if (r < 0)
875 goto fail;
876
877 if (log_get_max_level() < LOG_DEBUG)
878 flags |= PAM_SILENT;
879
880 pam_code = pam_start(name, user, &conv, &handle);
881 if (pam_code != PAM_SUCCESS) {
882 handle = NULL;
883 goto fail;
884 }
885
886 if (tty) {
887 pam_code = pam_set_item(handle, PAM_TTY, tty);
888 if (pam_code != PAM_SUCCESS)
889 goto fail;
890 }
891
892 STRV_FOREACH(nv, *env) {
893 pam_code = pam_putenv(handle, *nv);
894 if (pam_code != PAM_SUCCESS)
895 goto fail;
896 }
897
898 pam_code = pam_acct_mgmt(handle, flags);
899 if (pam_code != PAM_SUCCESS)
900 goto fail;
901
902 pam_code = pam_open_session(handle, flags);
903 if (pam_code != PAM_SUCCESS)
904 goto fail;
905
906 close_session = true;
907
908 e = pam_getenvlist(handle);
909 if (!e) {
910 pam_code = PAM_BUF_ERR;
911 goto fail;
912 }
913
914 /* Block SIGTERM, so that we know that it won't get lost in
915 * the child */
916
917 assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
918
919 parent_pid = getpid();
920
921 pam_pid = fork();
922 if (pam_pid < 0) {
923 r = -errno;
924 goto fail;
925 }
926
927 if (pam_pid == 0) {
928 int sig, ret = EXIT_PAM;
929
930 /* The child's job is to reset the PAM session on
931 * termination */
932 barrier_set_role(&barrier, BARRIER_CHILD);
933
934 /* This string must fit in 10 chars (i.e. the length
935 * of "/sbin/init"), to look pretty in /bin/ps */
936 rename_process("(sd-pam)");
937
938 /* Make sure we don't keep open the passed fds in this
939 child. We assume that otherwise only those fds are
940 open here that have been opened by PAM. */
941 close_many(fds, n_fds);
942
943 /* Drop privileges - we don't need any to pam_close_session
944 * and this will make PR_SET_PDEATHSIG work in most cases.
945 * If this fails, ignore the error - but expect sd-pam threads
946 * to fail to exit normally */
947 if (setresuid(uid, uid, uid) < 0)
948 log_error_errno(r, "Error: Failed to setresuid() in sd-pam: %m");
949
950 (void) ignore_signals(SIGPIPE, -1);
951
952 /* Wait until our parent died. This will only work if
953 * the above setresuid() succeeds, otherwise the kernel
954 * will not allow unprivileged parents kill their privileged
955 * children this way. We rely on the control groups kill logic
956 * to do the rest for us. */
957 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
958 goto child_finish;
959
960 /* Tell the parent that our setup is done. This is especially
961 * important regarding dropping privileges. Otherwise, unit
962 * setup might race against our setresuid(2) call. */
963 barrier_place(&barrier);
964
965 /* Check if our parent process might already have
966 * died? */
967 if (getppid() == parent_pid) {
968 sigset_t ss;
969
970 assert_se(sigemptyset(&ss) >= 0);
971 assert_se(sigaddset(&ss, SIGTERM) >= 0);
972
973 for (;;) {
974 if (sigwait(&ss, &sig) < 0) {
975 if (errno == EINTR)
976 continue;
977
978 goto child_finish;
979 }
980
981 assert(sig == SIGTERM);
982 break;
983 }
984 }
985
986 /* If our parent died we'll end the session */
987 if (getppid() != parent_pid) {
988 pam_code = pam_close_session(handle, flags);
989 if (pam_code != PAM_SUCCESS)
990 goto child_finish;
991 }
992
993 ret = 0;
994
995 child_finish:
996 pam_end(handle, pam_code | flags);
997 _exit(ret);
998 }
999
1000 barrier_set_role(&barrier, BARRIER_PARENT);
1001
1002 /* If the child was forked off successfully it will do all the
1003 * cleanups, so forget about the handle here. */
1004 handle = NULL;
1005
1006 /* Unblock SIGTERM again in the parent */
1007 assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
1008
1009 /* We close the log explicitly here, since the PAM modules
1010 * might have opened it, but we don't want this fd around. */
1011 closelog();
1012
1013 /* Synchronously wait for the child to initialize. We don't care for
1014 * errors as we cannot recover. However, warn loudly if it happens. */
1015 if (!barrier_place_and_sync(&barrier))
1016 log_error("PAM initialization failed");
1017
1018 strv_free(*env);
1019 *env = e;
1020
1021 return 0;
1022
1023 fail:
1024 if (pam_code != PAM_SUCCESS) {
1025 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1026 r = -EPERM; /* PAM errors do not map to errno */
1027 } else
1028 log_error_errno(r, "PAM failed: %m");
1029
1030 if (handle) {
1031 if (close_session)
1032 pam_code = pam_close_session(handle, flags);
1033
1034 pam_end(handle, pam_code | flags);
1035 }
1036
1037 strv_free(e);
1038 closelog();
1039
1040 return r;
1041 }
1042 #endif
1043
1044 static void rename_process_from_path(const char *path) {
1045 char process_name[11];
1046 const char *p;
1047 size_t l;
1048
1049 /* This resulting string must fit in 10 chars (i.e. the length
1050 * of "/sbin/init") to look pretty in /bin/ps */
1051
1052 p = basename(path);
1053 if (isempty(p)) {
1054 rename_process("(...)");
1055 return;
1056 }
1057
1058 l = strlen(p);
1059 if (l > 8) {
1060 /* The end of the process name is usually more
1061 * interesting, since the first bit might just be
1062 * "systemd-" */
1063 p = p + l - 8;
1064 l = 8;
1065 }
1066
1067 process_name[0] = '(';
1068 memcpy(process_name+1, p, l);
1069 process_name[1+l] = ')';
1070 process_name[1+l+1] = 0;
1071
1072 rename_process(process_name);
1073 }
1074
1075 #ifdef HAVE_SECCOMP
1076
1077 static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
1078 if (!is_seccomp_available()) {
1079 log_open();
1080 log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
1081 log_close();
1082 return true;
1083 }
1084 return false;
1085 }
1086
1087 static int apply_seccomp(const Unit* u, const ExecContext *c) {
1088 uint32_t negative_action, action;
1089 scmp_filter_ctx *seccomp;
1090 Iterator i;
1091 void *id;
1092 int r;
1093
1094 assert(c);
1095
1096 if (skip_seccomp_unavailable(u, "syscall filtering"))
1097 return 0;
1098
1099 negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
1100
1101 seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
1102 if (!seccomp)
1103 return -ENOMEM;
1104
1105 if (c->syscall_archs) {
1106
1107 SET_FOREACH(id, c->syscall_archs, i) {
1108 r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
1109 if (r == -EEXIST)
1110 continue;
1111 if (r < 0)
1112 goto finish;
1113 }
1114
1115 } else {
1116 r = seccomp_add_secondary_archs(seccomp);
1117 if (r < 0)
1118 goto finish;
1119 }
1120
1121 action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
1122 SET_FOREACH(id, c->syscall_filter, i) {
1123 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
1124 if (r < 0)
1125 goto finish;
1126 }
1127
1128 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1129 if (r < 0)
1130 goto finish;
1131
1132 r = seccomp_load(seccomp);
1133
1134 finish:
1135 seccomp_release(seccomp);
1136 return r;
1137 }
1138
1139 static int apply_address_families(const Unit* u, const ExecContext *c) {
1140 scmp_filter_ctx *seccomp;
1141 Iterator i;
1142 int r;
1143
1144 assert(c);
1145
1146 if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1147 return 0;
1148
1149 seccomp = seccomp_init(SCMP_ACT_ALLOW);
1150 if (!seccomp)
1151 return -ENOMEM;
1152
1153 r = seccomp_add_secondary_archs(seccomp);
1154 if (r < 0)
1155 goto finish;
1156
1157 if (c->address_families_whitelist) {
1158 int af, first = 0, last = 0;
1159 void *afp;
1160
1161 /* If this is a whitelist, we first block the address
1162 * families that are out of range and then everything
1163 * that is not in the set. First, we find the lowest
1164 * and highest address family in the set. */
1165
1166 SET_FOREACH(afp, c->address_families, i) {
1167 af = PTR_TO_INT(afp);
1168
1169 if (af <= 0 || af >= af_max())
1170 continue;
1171
1172 if (first == 0 || af < first)
1173 first = af;
1174
1175 if (last == 0 || af > last)
1176 last = af;
1177 }
1178
1179 assert((first == 0) == (last == 0));
1180
1181 if (first == 0) {
1182
1183 /* No entries in the valid range, block everything */
1184 r = seccomp_rule_add(
1185 seccomp,
1186 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1187 SCMP_SYS(socket),
1188 0);
1189 if (r < 0)
1190 goto finish;
1191
1192 } else {
1193
1194 /* Block everything below the first entry */
1195 r = seccomp_rule_add(
1196 seccomp,
1197 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1198 SCMP_SYS(socket),
1199 1,
1200 SCMP_A0(SCMP_CMP_LT, first));
1201 if (r < 0)
1202 goto finish;
1203
1204 /* Block everything above the last entry */
1205 r = seccomp_rule_add(
1206 seccomp,
1207 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1208 SCMP_SYS(socket),
1209 1,
1210 SCMP_A0(SCMP_CMP_GT, last));
1211 if (r < 0)
1212 goto finish;
1213
1214 /* Block everything between the first and last
1215 * entry */
1216 for (af = 1; af < af_max(); af++) {
1217
1218 if (set_contains(c->address_families, INT_TO_PTR(af)))
1219 continue;
1220
1221 r = seccomp_rule_add(
1222 seccomp,
1223 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1224 SCMP_SYS(socket),
1225 1,
1226 SCMP_A0(SCMP_CMP_EQ, af));
1227 if (r < 0)
1228 goto finish;
1229 }
1230 }
1231
1232 } else {
1233 void *af;
1234
1235 /* If this is a blacklist, then generate one rule for
1236 * each address family that are then combined in OR
1237 * checks. */
1238
1239 SET_FOREACH(af, c->address_families, i) {
1240
1241 r = seccomp_rule_add(
1242 seccomp,
1243 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1244 SCMP_SYS(socket),
1245 1,
1246 SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
1247 if (r < 0)
1248 goto finish;
1249 }
1250 }
1251
1252 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1253 if (r < 0)
1254 goto finish;
1255
1256 r = seccomp_load(seccomp);
1257
1258 finish:
1259 seccomp_release(seccomp);
1260 return r;
1261 }
1262
1263 static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
1264 scmp_filter_ctx *seccomp;
1265 int r;
1266
1267 assert(c);
1268
1269 if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1270 return 0;
1271
1272 seccomp = seccomp_init(SCMP_ACT_ALLOW);
1273 if (!seccomp)
1274 return -ENOMEM;
1275
1276 r = seccomp_add_secondary_archs(seccomp);
1277 if (r < 0)
1278 goto finish;
1279
1280 r = seccomp_rule_add(
1281 seccomp,
1282 SCMP_ACT_ERRNO(EPERM),
1283 SCMP_SYS(mmap),
1284 1,
1285 SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC|PROT_WRITE, PROT_EXEC|PROT_WRITE));
1286 if (r < 0)
1287 goto finish;
1288
1289 r = seccomp_rule_add(
1290 seccomp,
1291 SCMP_ACT_ERRNO(EPERM),
1292 SCMP_SYS(mprotect),
1293 1,
1294 SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC, PROT_EXEC));
1295 if (r < 0)
1296 goto finish;
1297
1298 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1299 if (r < 0)
1300 goto finish;
1301
1302 r = seccomp_load(seccomp);
1303
1304 finish:
1305 seccomp_release(seccomp);
1306 return r;
1307 }
1308
1309 static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
1310 static const int permitted_policies[] = {
1311 SCHED_OTHER,
1312 SCHED_BATCH,
1313 SCHED_IDLE,
1314 };
1315
1316 scmp_filter_ctx *seccomp;
1317 unsigned i;
1318 int r, p, max_policy = 0;
1319
1320 assert(c);
1321
1322 if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1323 return 0;
1324
1325 seccomp = seccomp_init(SCMP_ACT_ALLOW);
1326 if (!seccomp)
1327 return -ENOMEM;
1328
1329 r = seccomp_add_secondary_archs(seccomp);
1330 if (r < 0)
1331 goto finish;
1332
1333 /* Determine the highest policy constant we want to allow */
1334 for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
1335 if (permitted_policies[i] > max_policy)
1336 max_policy = permitted_policies[i];
1337
1338 /* Go through all policies with lower values than that, and block them -- unless they appear in the
1339 * whitelist. */
1340 for (p = 0; p < max_policy; p++) {
1341 bool good = false;
1342
1343 /* Check if this is in the whitelist. */
1344 for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
1345 if (permitted_policies[i] == p) {
1346 good = true;
1347 break;
1348 }
1349
1350 if (good)
1351 continue;
1352
1353 /* Deny this policy */
1354 r = seccomp_rule_add(
1355 seccomp,
1356 SCMP_ACT_ERRNO(EPERM),
1357 SCMP_SYS(sched_setscheduler),
1358 1,
1359 SCMP_A1(SCMP_CMP_EQ, p));
1360 if (r < 0)
1361 goto finish;
1362 }
1363
1364 /* Blacklist all other policies, i.e. the ones with higher values. Note that all comparisons are unsigned here,
1365 * hence no need no check for < 0 values. */
1366 r = seccomp_rule_add(
1367 seccomp,
1368 SCMP_ACT_ERRNO(EPERM),
1369 SCMP_SYS(sched_setscheduler),
1370 1,
1371 SCMP_A1(SCMP_CMP_GT, max_policy));
1372 if (r < 0)
1373 goto finish;
1374
1375 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1376 if (r < 0)
1377 goto finish;
1378
1379 r = seccomp_load(seccomp);
1380
1381 finish:
1382 seccomp_release(seccomp);
1383 return r;
1384 }
1385
1386 static int apply_protect_sysctl(Unit *u, const ExecContext *c) {
1387 scmp_filter_ctx *seccomp;
1388 int r;
1389
1390 assert(c);
1391
1392 /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1393 * let's protect even those systems where this is left on in the kernel. */
1394
1395 if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1396 return 0;
1397
1398 seccomp = seccomp_init(SCMP_ACT_ALLOW);
1399 if (!seccomp)
1400 return -ENOMEM;
1401
1402 r = seccomp_add_secondary_archs(seccomp);
1403 if (r < 0)
1404 goto finish;
1405
1406 r = seccomp_rule_add(
1407 seccomp,
1408 SCMP_ACT_ERRNO(EPERM),
1409 SCMP_SYS(_sysctl),
1410 0);
1411 if (r < 0)
1412 goto finish;
1413
1414 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1415 if (r < 0)
1416 goto finish;
1417
1418 r = seccomp_load(seccomp);
1419
1420 finish:
1421 seccomp_release(seccomp);
1422 return r;
1423 }
1424
1425 #endif
1426
1427 static void do_idle_pipe_dance(int idle_pipe[4]) {
1428 assert(idle_pipe);
1429
1430
1431 idle_pipe[1] = safe_close(idle_pipe[1]);
1432 idle_pipe[2] = safe_close(idle_pipe[2]);
1433
1434 if (idle_pipe[0] >= 0) {
1435 int r;
1436
1437 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1438
1439 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1440 ssize_t n;
1441
1442 /* Signal systemd that we are bored and want to continue. */
1443 n = write(idle_pipe[3], "x", 1);
1444 if (n > 0)
1445 /* Wait for systemd to react to the signal above. */
1446 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1447 }
1448
1449 idle_pipe[0] = safe_close(idle_pipe[0]);
1450
1451 }
1452
1453 idle_pipe[3] = safe_close(idle_pipe[3]);
1454 }
1455
1456 static int build_environment(
1457 Unit *u,
1458 const ExecContext *c,
1459 const ExecParameters *p,
1460 unsigned n_fds,
1461 const char *home,
1462 const char *username,
1463 const char *shell,
1464 dev_t journal_stream_dev,
1465 ino_t journal_stream_ino,
1466 char ***ret) {
1467
1468 _cleanup_strv_free_ char **our_env = NULL;
1469 unsigned n_env = 0;
1470 char *x;
1471
1472 assert(c);
1473 assert(ret);
1474
1475 our_env = new0(char*, 13);
1476 if (!our_env)
1477 return -ENOMEM;
1478
1479 if (n_fds > 0) {
1480 _cleanup_free_ char *joined = NULL;
1481
1482 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
1483 return -ENOMEM;
1484 our_env[n_env++] = x;
1485
1486 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1487 return -ENOMEM;
1488 our_env[n_env++] = x;
1489
1490 joined = strv_join(p->fd_names, ":");
1491 if (!joined)
1492 return -ENOMEM;
1493
1494 x = strjoin("LISTEN_FDNAMES=", joined, NULL);
1495 if (!x)
1496 return -ENOMEM;
1497 our_env[n_env++] = x;
1498 }
1499
1500 if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
1501 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
1502 return -ENOMEM;
1503 our_env[n_env++] = x;
1504
1505 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1506 return -ENOMEM;
1507 our_env[n_env++] = x;
1508 }
1509
1510 /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use D-Bus look up dynamic
1511 * users via PID 1, possibly dead-locking the dbus daemon. This way it will not use D-Bus to resolve names, but
1512 * check the database directly. */
1513 if (unit_has_name(u, SPECIAL_DBUS_SERVICE)) {
1514 x = strdup("SYSTEMD_NSS_BYPASS_BUS=1");
1515 if (!x)
1516 return -ENOMEM;
1517 our_env[n_env++] = x;
1518 }
1519
1520 if (home) {
1521 x = strappend("HOME=", home);
1522 if (!x)
1523 return -ENOMEM;
1524 our_env[n_env++] = x;
1525 }
1526
1527 if (username) {
1528 x = strappend("LOGNAME=", username);
1529 if (!x)
1530 return -ENOMEM;
1531 our_env[n_env++] = x;
1532
1533 x = strappend("USER=", username);
1534 if (!x)
1535 return -ENOMEM;
1536 our_env[n_env++] = x;
1537 }
1538
1539 if (shell) {
1540 x = strappend("SHELL=", shell);
1541 if (!x)
1542 return -ENOMEM;
1543 our_env[n_env++] = x;
1544 }
1545
1546 if (exec_context_needs_term(c)) {
1547 const char *tty_path, *term = NULL;
1548
1549 tty_path = exec_context_tty_path(c);
1550
1551 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try to inherit
1552 * the $TERM set for PID 1. This is useful for containers so that the $TERM the container manager
1553 * passes to PID 1 ends up all the way in the console login shown. */
1554
1555 if (path_equal(tty_path, "/dev/console") && getppid() == 1)
1556 term = getenv("TERM");
1557 if (!term)
1558 term = default_term_for_tty(tty_path);
1559
1560 x = strappend("TERM=", term);
1561 if (!x)
1562 return -ENOMEM;
1563 our_env[n_env++] = x;
1564 }
1565
1566 if (journal_stream_dev != 0 && journal_stream_ino != 0) {
1567 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
1568 return -ENOMEM;
1569
1570 our_env[n_env++] = x;
1571 }
1572
1573 our_env[n_env++] = NULL;
1574 assert(n_env <= 12);
1575
1576 *ret = our_env;
1577 our_env = NULL;
1578
1579 return 0;
1580 }
1581
1582 static int build_pass_environment(const ExecContext *c, char ***ret) {
1583 _cleanup_strv_free_ char **pass_env = NULL;
1584 size_t n_env = 0, n_bufsize = 0;
1585 char **i;
1586
1587 STRV_FOREACH(i, c->pass_environment) {
1588 _cleanup_free_ char *x = NULL;
1589 char *v;
1590
1591 v = getenv(*i);
1592 if (!v)
1593 continue;
1594 x = strjoin(*i, "=", v, NULL);
1595 if (!x)
1596 return -ENOMEM;
1597 if (!GREEDY_REALLOC(pass_env, n_bufsize, n_env + 2))
1598 return -ENOMEM;
1599 pass_env[n_env++] = x;
1600 pass_env[n_env] = NULL;
1601 x = NULL;
1602 }
1603
1604 *ret = pass_env;
1605 pass_env = NULL;
1606
1607 return 0;
1608 }
1609
1610 static bool exec_needs_mount_namespace(
1611 const ExecContext *context,
1612 const ExecParameters *params,
1613 ExecRuntime *runtime) {
1614
1615 assert(context);
1616 assert(params);
1617
1618 if (!strv_isempty(context->read_write_paths) ||
1619 !strv_isempty(context->read_only_paths) ||
1620 !strv_isempty(context->inaccessible_paths))
1621 return true;
1622
1623 if (context->mount_flags != 0)
1624 return true;
1625
1626 if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
1627 return true;
1628
1629 if (context->private_devices ||
1630 context->protect_system != PROTECT_SYSTEM_NO ||
1631 context->protect_home != PROTECT_HOME_NO ||
1632 context->protect_kernel_tunables ||
1633 context->protect_control_groups)
1634 return true;
1635
1636 return false;
1637 }
1638
1639 static int setup_private_users(uid_t uid, gid_t gid) {
1640 _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
1641 _cleanup_close_pair_ int errno_pipe[2] = { -1, -1 };
1642 _cleanup_close_ int unshare_ready_fd = -1;
1643 _cleanup_(sigkill_waitp) pid_t pid = 0;
1644 uint64_t c = 1;
1645 siginfo_t si;
1646 ssize_t n;
1647 int r;
1648
1649 /* Set up a user namespace and map root to root, the selected UID/GID to itself, and everything else to
1650 * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
1651 * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
1652 * which waits for the parent to create the new user namespace while staying in the original namespace. The
1653 * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
1654 * continues execution normally. */
1655
1656 if (uid != 0 && uid_is_valid(uid))
1657 asprintf(&uid_map,
1658 "0 0 1\n" /* Map root → root */
1659 UID_FMT " " UID_FMT " 1\n", /* Map $UID → $UID */
1660 uid, uid); /* The case where the above is the same */
1661 else
1662 uid_map = strdup("0 0 1\n");
1663 if (!uid_map)
1664 return -ENOMEM;
1665
1666 if (gid != 0 && gid_is_valid(gid))
1667 asprintf(&gid_map,
1668 "0 0 1\n" /* Map root → root */
1669 GID_FMT " " GID_FMT " 1\n", /* Map $GID → $GID */
1670 gid, gid);
1671 else
1672 gid_map = strdup("0 0 1\n"); /* The case where the above is the same */
1673 if (!gid_map)
1674 return -ENOMEM;
1675
1676 /* Create a communication channel so that the parent can tell the child when it finished creating the user
1677 * namespace. */
1678 unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
1679 if (unshare_ready_fd < 0)
1680 return -errno;
1681
1682 /* Create a communication channel so that the child can tell the parent a proper error code in case it
1683 * failed. */
1684 if (pipe2(errno_pipe, O_CLOEXEC) < 0)
1685 return -errno;
1686
1687 pid = fork();
1688 if (pid < 0)
1689 return -errno;
1690
1691 if (pid == 0) {
1692 _cleanup_close_ int fd = -1;
1693 const char *a;
1694 pid_t ppid;
1695
1696 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
1697 * here, after the parent opened its own user namespace. */
1698
1699 ppid = getppid();
1700 errno_pipe[0] = safe_close(errno_pipe[0]);
1701
1702 /* Wait until the parent unshared the user namespace */
1703 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
1704 r = -errno;
1705 goto child_fail;
1706 }
1707
1708 /* Disable the setgroups() system call in the child user namespace, for good. */
1709 a = procfs_file_alloca(ppid, "setgroups");
1710 fd = open(a, O_WRONLY|O_CLOEXEC);
1711 if (fd < 0) {
1712 if (errno != ENOENT) {
1713 r = -errno;
1714 goto child_fail;
1715 }
1716
1717 /* If the file is missing the kernel is too old, let's continue anyway. */
1718 } else {
1719 if (write(fd, "deny\n", 5) < 0) {
1720 r = -errno;
1721 goto child_fail;
1722 }
1723
1724 fd = safe_close(fd);
1725 }
1726
1727 /* First write the GID map */
1728 a = procfs_file_alloca(ppid, "gid_map");
1729 fd = open(a, O_WRONLY|O_CLOEXEC);
1730 if (fd < 0) {
1731 r = -errno;
1732 goto child_fail;
1733 }
1734 if (write(fd, gid_map, strlen(gid_map)) < 0) {
1735 r = -errno;
1736 goto child_fail;
1737 }
1738 fd = safe_close(fd);
1739
1740 /* The write the UID map */
1741 a = procfs_file_alloca(ppid, "uid_map");
1742 fd = open(a, O_WRONLY|O_CLOEXEC);
1743 if (fd < 0) {
1744 r = -errno;
1745 goto child_fail;
1746 }
1747 if (write(fd, uid_map, strlen(uid_map)) < 0) {
1748 r = -errno;
1749 goto child_fail;
1750 }
1751
1752 _exit(EXIT_SUCCESS);
1753
1754 child_fail:
1755 (void) write(errno_pipe[1], &r, sizeof(r));
1756 _exit(EXIT_FAILURE);
1757 }
1758
1759 errno_pipe[1] = safe_close(errno_pipe[1]);
1760
1761 if (unshare(CLONE_NEWUSER) < 0)
1762 return -errno;
1763
1764 /* Let the child know that the namespace is ready now */
1765 if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
1766 return -errno;
1767
1768 /* Try to read an error code from the child */
1769 n = read(errno_pipe[0], &r, sizeof(r));
1770 if (n < 0)
1771 return -errno;
1772 if (n == sizeof(r)) { /* an error code was sent to us */
1773 if (r < 0)
1774 return r;
1775 return -EIO;
1776 }
1777 if (n != 0) /* on success we should have read 0 bytes */
1778 return -EIO;
1779
1780 r = wait_for_terminate(pid, &si);
1781 if (r < 0)
1782 return r;
1783 pid = 0;
1784
1785 /* If something strange happened with the child, let's consider this fatal, too */
1786 if (si.si_code != CLD_EXITED || si.si_status != 0)
1787 return -EIO;
1788
1789 return 0;
1790 }
1791
1792 static void append_socket_pair(int *array, unsigned *n, int pair[2]) {
1793 assert(array);
1794 assert(n);
1795
1796 if (!pair)
1797 return;
1798
1799 if (pair[0] >= 0)
1800 array[(*n)++] = pair[0];
1801 if (pair[1] >= 0)
1802 array[(*n)++] = pair[1];
1803 }
1804
1805 static int close_remaining_fds(
1806 const ExecParameters *params,
1807 ExecRuntime *runtime,
1808 DynamicCreds *dcreds,
1809 int user_lookup_fd,
1810 int socket_fd,
1811 int *fds, unsigned n_fds) {
1812
1813 unsigned n_dont_close = 0;
1814 int dont_close[n_fds + 12];
1815
1816 assert(params);
1817
1818 if (params->stdin_fd >= 0)
1819 dont_close[n_dont_close++] = params->stdin_fd;
1820 if (params->stdout_fd >= 0)
1821 dont_close[n_dont_close++] = params->stdout_fd;
1822 if (params->stderr_fd >= 0)
1823 dont_close[n_dont_close++] = params->stderr_fd;
1824
1825 if (socket_fd >= 0)
1826 dont_close[n_dont_close++] = socket_fd;
1827 if (n_fds > 0) {
1828 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1829 n_dont_close += n_fds;
1830 }
1831
1832 if (runtime)
1833 append_socket_pair(dont_close, &n_dont_close, runtime->netns_storage_socket);
1834
1835 if (dcreds) {
1836 if (dcreds->user)
1837 append_socket_pair(dont_close, &n_dont_close, dcreds->user->storage_socket);
1838 if (dcreds->group)
1839 append_socket_pair(dont_close, &n_dont_close, dcreds->group->storage_socket);
1840 }
1841
1842 if (user_lookup_fd >= 0)
1843 dont_close[n_dont_close++] = user_lookup_fd;
1844
1845 return close_all_fds(dont_close, n_dont_close);
1846 }
1847
1848 static bool context_has_address_families(const ExecContext *c) {
1849 assert(c);
1850
1851 return c->address_families_whitelist ||
1852 !set_isempty(c->address_families);
1853 }
1854
1855 static bool context_has_syscall_filters(const ExecContext *c) {
1856 assert(c);
1857
1858 return c->syscall_whitelist ||
1859 !set_isempty(c->syscall_filter) ||
1860 !set_isempty(c->syscall_archs);
1861 }
1862
1863 static bool context_has_no_new_privileges(const ExecContext *c) {
1864 assert(c);
1865
1866 if (c->no_new_privileges)
1867 return true;
1868
1869 if (have_effective_cap(CAP_SYS_ADMIN)) /* if we are privileged, we don't need NNP */
1870 return false;
1871
1872 return context_has_address_families(c) || /* we need NNP if we have any form of seccomp and are unprivileged */
1873 c->memory_deny_write_execute ||
1874 c->restrict_realtime ||
1875 c->protect_kernel_tunables ||
1876 context_has_syscall_filters(c);
1877 }
1878
1879 static int send_user_lookup(
1880 Unit *unit,
1881 int user_lookup_fd,
1882 uid_t uid,
1883 gid_t gid) {
1884
1885 assert(unit);
1886
1887 /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
1888 * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
1889 * specified. */
1890
1891 if (user_lookup_fd < 0)
1892 return 0;
1893
1894 if (!uid_is_valid(uid) && !gid_is_valid(gid))
1895 return 0;
1896
1897 if (writev(user_lookup_fd,
1898 (struct iovec[]) {
1899 { .iov_base = &uid, .iov_len = sizeof(uid) },
1900 { .iov_base = &gid, .iov_len = sizeof(gid) },
1901 { .iov_base = unit->id, .iov_len = strlen(unit->id) }}, 3) < 0)
1902 return -errno;
1903
1904 return 0;
1905 }
1906
1907 static int exec_child(
1908 Unit *unit,
1909 ExecCommand *command,
1910 const ExecContext *context,
1911 const ExecParameters *params,
1912 ExecRuntime *runtime,
1913 DynamicCreds *dcreds,
1914 char **argv,
1915 int socket_fd,
1916 int *fds, unsigned n_fds,
1917 char **files_env,
1918 int user_lookup_fd,
1919 int *exit_status) {
1920
1921 _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **accum_env = NULL, **final_argv = NULL;
1922 _cleanup_free_ char *mac_selinux_context_net = NULL;
1923 const char *username = NULL, *home = NULL, *shell = NULL, *wd;
1924 dev_t journal_stream_dev = 0;
1925 ino_t journal_stream_ino = 0;
1926 bool needs_mount_namespace;
1927 uid_t uid = UID_INVALID;
1928 gid_t gid = GID_INVALID;
1929 int i, r;
1930
1931 assert(unit);
1932 assert(command);
1933 assert(context);
1934 assert(params);
1935 assert(exit_status);
1936
1937 rename_process_from_path(command->path);
1938
1939 /* We reset exactly these signals, since they are the
1940 * only ones we set to SIG_IGN in the main daemon. All
1941 * others we leave untouched because we set them to
1942 * SIG_DFL or a valid handler initially, both of which
1943 * will be demoted to SIG_DFL. */
1944 (void) default_signals(SIGNALS_CRASH_HANDLER,
1945 SIGNALS_IGNORE, -1);
1946
1947 if (context->ignore_sigpipe)
1948 (void) ignore_signals(SIGPIPE, -1);
1949
1950 r = reset_signal_mask();
1951 if (r < 0) {
1952 *exit_status = EXIT_SIGNAL_MASK;
1953 return r;
1954 }
1955
1956 if (params->idle_pipe)
1957 do_idle_pipe_dance(params->idle_pipe);
1958
1959 /* Close sockets very early to make sure we don't
1960 * block init reexecution because it cannot bind its
1961 * sockets */
1962
1963 log_forget_fds();
1964
1965 r = close_remaining_fds(params, runtime, dcreds, user_lookup_fd, socket_fd, fds, n_fds);
1966 if (r < 0) {
1967 *exit_status = EXIT_FDS;
1968 return r;
1969 }
1970
1971 if (!context->same_pgrp)
1972 if (setsid() < 0) {
1973 *exit_status = EXIT_SETSID;
1974 return -errno;
1975 }
1976
1977 exec_context_tty_reset(context, params);
1978
1979 if (params->flags & EXEC_CONFIRM_SPAWN) {
1980 char response;
1981
1982 r = ask_for_confirmation(&response, argv);
1983 if (r == -ETIMEDOUT)
1984 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1985 else if (r < 0)
1986 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-r));
1987 else if (response == 's') {
1988 write_confirm_message("Skipping execution.\n");
1989 *exit_status = EXIT_CONFIRM;
1990 return -ECANCELED;
1991 } else if (response == 'n') {
1992 write_confirm_message("Failing execution.\n");
1993 *exit_status = 0;
1994 return 0;
1995 }
1996 }
1997
1998 if (context->dynamic_user && dcreds) {
1999
2000 /* Make sure we bypass our own NSS module for any NSS checks */
2001 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
2002 *exit_status = EXIT_USER;
2003 return -errno;
2004 }
2005
2006 r = dynamic_creds_realize(dcreds, &uid, &gid);
2007 if (r < 0) {
2008 *exit_status = EXIT_USER;
2009 return r;
2010 }
2011
2012 if (!uid_is_valid(uid) || !gid_is_valid(gid)) {
2013 *exit_status = EXIT_USER;
2014 return -ESRCH;
2015 }
2016
2017 if (dcreds->user)
2018 username = dcreds->user->name;
2019
2020 } else {
2021 if (context->user) {
2022 username = context->user;
2023 r = get_user_creds(&username, &uid, &gid, &home, &shell);
2024 if (r < 0) {
2025 *exit_status = EXIT_USER;
2026 return r;
2027 }
2028
2029 /* Don't set $HOME or $SHELL if they are are not particularly enlightening anyway. */
2030 if (isempty(home) || path_equal(home, "/"))
2031 home = NULL;
2032
2033 if (isempty(shell) || PATH_IN_SET(shell,
2034 "/bin/nologin",
2035 "/sbin/nologin",
2036 "/usr/bin/nologin",
2037 "/usr/sbin/nologin"))
2038 shell = NULL;
2039 }
2040
2041 if (context->group) {
2042 const char *g = context->group;
2043
2044 r = get_group_creds(&g, &gid);
2045 if (r < 0) {
2046 *exit_status = EXIT_GROUP;
2047 return r;
2048 }
2049 }
2050 }
2051
2052 r = send_user_lookup(unit, user_lookup_fd, uid, gid);
2053 if (r < 0) {
2054 *exit_status = EXIT_USER;
2055 return r;
2056 }
2057
2058 user_lookup_fd = safe_close(user_lookup_fd);
2059
2060 /* If a socket is connected to STDIN/STDOUT/STDERR, we
2061 * must sure to drop O_NONBLOCK */
2062 if (socket_fd >= 0)
2063 (void) fd_nonblock(socket_fd, false);
2064
2065 r = setup_input(context, params, socket_fd);
2066 if (r < 0) {
2067 *exit_status = EXIT_STDIN;
2068 return r;
2069 }
2070
2071 r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
2072 if (r < 0) {
2073 *exit_status = EXIT_STDOUT;
2074 return r;
2075 }
2076
2077 r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
2078 if (r < 0) {
2079 *exit_status = EXIT_STDERR;
2080 return r;
2081 }
2082
2083 if (params->cgroup_path) {
2084 r = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0, NULL, NULL);
2085 if (r < 0) {
2086 *exit_status = EXIT_CGROUP;
2087 return r;
2088 }
2089 }
2090
2091 if (context->oom_score_adjust_set) {
2092 char t[DECIMAL_STR_MAX(context->oom_score_adjust)];
2093
2094 /* When we can't make this change due to EPERM, then
2095 * let's silently skip over it. User namespaces
2096 * prohibit write access to this file, and we
2097 * shouldn't trip up over that. */
2098
2099 sprintf(t, "%i", context->oom_score_adjust);
2100 r = write_string_file("/proc/self/oom_score_adj", t, 0);
2101 if (r == -EPERM || r == -EACCES) {
2102 log_open();
2103 log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
2104 log_close();
2105 } else if (r < 0) {
2106 *exit_status = EXIT_OOM_ADJUST;
2107 return -errno;
2108 }
2109 }
2110
2111 if (context->nice_set)
2112 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
2113 *exit_status = EXIT_NICE;
2114 return -errno;
2115 }
2116
2117 if (context->cpu_sched_set) {
2118 struct sched_param param = {
2119 .sched_priority = context->cpu_sched_priority,
2120 };
2121
2122 r = sched_setscheduler(0,
2123 context->cpu_sched_policy |
2124 (context->cpu_sched_reset_on_fork ?
2125 SCHED_RESET_ON_FORK : 0),
2126 &param);
2127 if (r < 0) {
2128 *exit_status = EXIT_SETSCHEDULER;
2129 return -errno;
2130 }
2131 }
2132
2133 if (context->cpuset)
2134 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
2135 *exit_status = EXIT_CPUAFFINITY;
2136 return -errno;
2137 }
2138
2139 if (context->ioprio_set)
2140 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
2141 *exit_status = EXIT_IOPRIO;
2142 return -errno;
2143 }
2144
2145 if (context->timer_slack_nsec != NSEC_INFINITY)
2146 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
2147 *exit_status = EXIT_TIMERSLACK;
2148 return -errno;
2149 }
2150
2151 if (context->personality != PERSONALITY_INVALID)
2152 if (personality(context->personality) < 0) {
2153 *exit_status = EXIT_PERSONALITY;
2154 return -errno;
2155 }
2156
2157 if (context->utmp_id)
2158 utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path,
2159 context->utmp_mode == EXEC_UTMP_INIT ? INIT_PROCESS :
2160 context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
2161 USER_PROCESS,
2162 username ? "root" : context->user);
2163
2164 if (context->user && is_terminal_input(context->std_input)) {
2165 r = chown_terminal(STDIN_FILENO, uid);
2166 if (r < 0) {
2167 *exit_status = EXIT_STDIN;
2168 return r;
2169 }
2170 }
2171
2172 /* If delegation is enabled we'll pass ownership of the cgroup
2173 * (but only in systemd's own controller hierarchy!) to the
2174 * user of the new process. */
2175 if (params->cgroup_path && context->user && params->cgroup_delegate) {
2176 r = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
2177 if (r < 0) {
2178 *exit_status = EXIT_CGROUP;
2179 return r;
2180 }
2181
2182
2183 r = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
2184 if (r < 0) {
2185 *exit_status = EXIT_CGROUP;
2186 return r;
2187 }
2188 }
2189
2190 if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
2191 char **rt;
2192
2193 STRV_FOREACH(rt, context->runtime_directory) {
2194 _cleanup_free_ char *p;
2195
2196 p = strjoin(params->runtime_prefix, "/", *rt, NULL);
2197 if (!p) {
2198 *exit_status = EXIT_RUNTIME_DIRECTORY;
2199 return -ENOMEM;
2200 }
2201
2202 r = mkdir_p_label(p, context->runtime_directory_mode);
2203 if (r < 0) {
2204 *exit_status = EXIT_RUNTIME_DIRECTORY;
2205 return r;
2206 }
2207
2208 r = chmod_and_chown(p, context->runtime_directory_mode, uid, gid);
2209 if (r < 0) {
2210 *exit_status = EXIT_RUNTIME_DIRECTORY;
2211 return r;
2212 }
2213 }
2214 }
2215
2216 r = build_environment(
2217 unit,
2218 context,
2219 params,
2220 n_fds,
2221 home,
2222 username,
2223 shell,
2224 journal_stream_dev,
2225 journal_stream_ino,
2226 &our_env);
2227 if (r < 0) {
2228 *exit_status = EXIT_MEMORY;
2229 return r;
2230 }
2231
2232 r = build_pass_environment(context, &pass_env);
2233 if (r < 0) {
2234 *exit_status = EXIT_MEMORY;
2235 return r;
2236 }
2237
2238 accum_env = strv_env_merge(5,
2239 params->environment,
2240 our_env,
2241 pass_env,
2242 context->environment,
2243 files_env,
2244 NULL);
2245 if (!accum_env) {
2246 *exit_status = EXIT_MEMORY;
2247 return -ENOMEM;
2248 }
2249 accum_env = strv_env_clean(accum_env);
2250
2251 umask(context->umask);
2252
2253 if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2254 r = enforce_groups(context, username, gid);
2255 if (r < 0) {
2256 *exit_status = EXIT_GROUP;
2257 return r;
2258 }
2259 #ifdef HAVE_SMACK
2260 if (context->smack_process_label) {
2261 r = mac_smack_apply_pid(0, context->smack_process_label);
2262 if (r < 0) {
2263 *exit_status = EXIT_SMACK_PROCESS_LABEL;
2264 return r;
2265 }
2266 }
2267 #ifdef SMACK_DEFAULT_PROCESS_LABEL
2268 else {
2269 _cleanup_free_ char *exec_label = NULL;
2270
2271 r = mac_smack_read(command->path, SMACK_ATTR_EXEC, &exec_label);
2272 if (r < 0 && r != -ENODATA && r != -EOPNOTSUPP) {
2273 *exit_status = EXIT_SMACK_PROCESS_LABEL;
2274 return r;
2275 }
2276
2277 r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
2278 if (r < 0) {
2279 *exit_status = EXIT_SMACK_PROCESS_LABEL;
2280 return r;
2281 }
2282 }
2283 #endif
2284 #endif
2285 #ifdef HAVE_PAM
2286 if (context->pam_name && username) {
2287 r = setup_pam(context->pam_name, username, uid, context->tty_path, &accum_env, fds, n_fds);
2288 if (r < 0) {
2289 *exit_status = EXIT_PAM;
2290 return r;
2291 }
2292 }
2293 #endif
2294 }
2295
2296 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
2297 r = setup_netns(runtime->netns_storage_socket);
2298 if (r < 0) {
2299 *exit_status = EXIT_NETWORK;
2300 return r;
2301 }
2302 }
2303
2304 needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
2305
2306 if (needs_mount_namespace) {
2307 char *tmp = NULL, *var = NULL;
2308
2309 /* The runtime struct only contains the parent
2310 * of the private /tmp, which is
2311 * non-accessible to world users. Inside of it
2312 * there's a /tmp that is sticky, and that's
2313 * the one we want to use here. */
2314
2315 if (context->private_tmp && runtime) {
2316 if (runtime->tmp_dir)
2317 tmp = strjoina(runtime->tmp_dir, "/tmp");
2318 if (runtime->var_tmp_dir)
2319 var = strjoina(runtime->var_tmp_dir, "/tmp");
2320 }
2321
2322 r = setup_namespace(
2323 (params->flags & EXEC_APPLY_CHROOT) ? context->root_directory : NULL,
2324 context->read_write_paths,
2325 context->read_only_paths,
2326 context->inaccessible_paths,
2327 tmp,
2328 var,
2329 context->private_devices,
2330 context->protect_kernel_tunables,
2331 context->protect_control_groups,
2332 context->protect_home,
2333 context->protect_system,
2334 context->mount_flags);
2335
2336 /* If we couldn't set up the namespace this is
2337 * probably due to a missing capability. In this case,
2338 * silently proceeed. */
2339 if (r == -EPERM || r == -EACCES) {
2340 log_open();
2341 log_unit_debug_errno(unit, r, "Failed to set up namespace, assuming containerized execution, ignoring: %m");
2342 log_close();
2343 } else if (r < 0) {
2344 *exit_status = EXIT_NAMESPACE;
2345 return r;
2346 }
2347 }
2348
2349 if (context->working_directory_home)
2350 wd = home;
2351 else if (context->working_directory)
2352 wd = context->working_directory;
2353 else
2354 wd = "/";
2355
2356 if (params->flags & EXEC_APPLY_CHROOT) {
2357 if (!needs_mount_namespace && context->root_directory)
2358 if (chroot(context->root_directory) < 0) {
2359 *exit_status = EXIT_CHROOT;
2360 return -errno;
2361 }
2362
2363 if (chdir(wd) < 0 &&
2364 !context->working_directory_missing_ok) {
2365 *exit_status = EXIT_CHDIR;
2366 return -errno;
2367 }
2368 } else {
2369 const char *d;
2370
2371 d = strjoina(strempty(context->root_directory), "/", strempty(wd));
2372 if (chdir(d) < 0 &&
2373 !context->working_directory_missing_ok) {
2374 *exit_status = EXIT_CHDIR;
2375 return -errno;
2376 }
2377 }
2378
2379 #ifdef HAVE_SELINUX
2380 if ((params->flags & EXEC_APPLY_PERMISSIONS) &&
2381 mac_selinux_use() &&
2382 params->selinux_context_net &&
2383 socket_fd >= 0 &&
2384 !command->privileged) {
2385
2386 r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
2387 if (r < 0) {
2388 *exit_status = EXIT_SELINUX_CONTEXT;
2389 return r;
2390 }
2391 }
2392 #endif
2393
2394 if ((params->flags & EXEC_APPLY_PERMISSIONS) && context->private_users) {
2395 r = setup_private_users(uid, gid);
2396 if (r < 0) {
2397 *exit_status = EXIT_USER;
2398 return r;
2399 }
2400 }
2401
2402 /* We repeat the fd closing here, to make sure that
2403 * nothing is leaked from the PAM modules. Note that
2404 * we are more aggressive this time since socket_fd
2405 * and the netns fds we don't need anymore. The custom
2406 * endpoint fd was needed to upload the policy and can
2407 * now be closed as well. */
2408 r = close_all_fds(fds, n_fds);
2409 if (r >= 0)
2410 r = shift_fds(fds, n_fds);
2411 if (r >= 0)
2412 r = flags_fds(fds, n_fds, context->non_blocking);
2413 if (r < 0) {
2414 *exit_status = EXIT_FDS;
2415 return r;
2416 }
2417
2418 if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2419
2420 int secure_bits = context->secure_bits;
2421
2422 for (i = 0; i < _RLIMIT_MAX; i++) {
2423
2424 if (!context->rlimit[i])
2425 continue;
2426
2427 r = setrlimit_closest(i, context->rlimit[i]);
2428 if (r < 0) {
2429 *exit_status = EXIT_LIMITS;
2430 return r;
2431 }
2432 }
2433
2434 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. */
2435 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
2436 if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
2437 *exit_status = EXIT_LIMITS;
2438 return -errno;
2439 }
2440 }
2441
2442 if (!cap_test_all(context->capability_bounding_set)) {
2443 r = capability_bounding_set_drop(context->capability_bounding_set, false);
2444 if (r < 0) {
2445 *exit_status = EXIT_CAPABILITIES;
2446 return r;
2447 }
2448 }
2449
2450 /* This is done before enforce_user, but ambient set
2451 * does not survive over setresuid() if keep_caps is not set. */
2452 if (context->capability_ambient_set != 0) {
2453 r = capability_ambient_set_apply(context->capability_ambient_set, true);
2454 if (r < 0) {
2455 *exit_status = EXIT_CAPABILITIES;
2456 return r;
2457 }
2458 }
2459
2460 if (context->user) {
2461 r = enforce_user(context, uid);
2462 if (r < 0) {
2463 *exit_status = EXIT_USER;
2464 return r;
2465 }
2466 if (context->capability_ambient_set != 0) {
2467
2468 /* Fix the ambient capabilities after user change. */
2469 r = capability_ambient_set_apply(context->capability_ambient_set, false);
2470 if (r < 0) {
2471 *exit_status = EXIT_CAPABILITIES;
2472 return r;
2473 }
2474
2475 /* If we were asked to change user and ambient capabilities
2476 * were requested, we had to add keep-caps to the securebits
2477 * so that we would maintain the inherited capability set
2478 * through the setresuid(). Make sure that the bit is added
2479 * also to the context secure_bits so that we don't try to
2480 * drop the bit away next. */
2481
2482 secure_bits |= 1<<SECURE_KEEP_CAPS;
2483 }
2484 }
2485
2486 /* PR_GET_SECUREBITS is not privileged, while
2487 * PR_SET_SECUREBITS is. So to suppress
2488 * potential EPERMs we'll try not to call
2489 * PR_SET_SECUREBITS unless necessary. */
2490 if (prctl(PR_GET_SECUREBITS) != secure_bits)
2491 if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
2492 *exit_status = EXIT_SECUREBITS;
2493 return -errno;
2494 }
2495
2496 if (context_has_no_new_privileges(context))
2497 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
2498 *exit_status = EXIT_NO_NEW_PRIVILEGES;
2499 return -errno;
2500 }
2501
2502 #ifdef HAVE_SECCOMP
2503 if (context_has_address_families(context)) {
2504 r = apply_address_families(unit, context);
2505 if (r < 0) {
2506 *exit_status = EXIT_ADDRESS_FAMILIES;
2507 return r;
2508 }
2509 }
2510
2511 if (context->memory_deny_write_execute) {
2512 r = apply_memory_deny_write_execute(unit, context);
2513 if (r < 0) {
2514 *exit_status = EXIT_SECCOMP;
2515 return r;
2516 }
2517 }
2518
2519 if (context->restrict_realtime) {
2520 r = apply_restrict_realtime(unit, context);
2521 if (r < 0) {
2522 *exit_status = EXIT_SECCOMP;
2523 return r;
2524 }
2525 }
2526
2527 if (context->protect_kernel_tunables) {
2528 r = apply_protect_sysctl(unit, context);
2529 if (r < 0) {
2530 *exit_status = EXIT_SECCOMP;
2531 return r;
2532 }
2533 }
2534
2535 if (context_has_syscall_filters(context)) {
2536 r = apply_seccomp(unit, context);
2537 if (r < 0) {
2538 *exit_status = EXIT_SECCOMP;
2539 return r;
2540 }
2541 }
2542 #endif
2543
2544 #ifdef HAVE_SELINUX
2545 if (mac_selinux_use()) {
2546 char *exec_context = mac_selinux_context_net ?: context->selinux_context;
2547
2548 if (exec_context) {
2549 r = setexeccon(exec_context);
2550 if (r < 0) {
2551 *exit_status = EXIT_SELINUX_CONTEXT;
2552 return r;
2553 }
2554 }
2555 }
2556 #endif
2557
2558 #ifdef HAVE_APPARMOR
2559 if (context->apparmor_profile && mac_apparmor_use()) {
2560 r = aa_change_onexec(context->apparmor_profile);
2561 if (r < 0 && !context->apparmor_profile_ignore) {
2562 *exit_status = EXIT_APPARMOR_PROFILE;
2563 return -errno;
2564 }
2565 }
2566 #endif
2567 }
2568
2569 final_argv = replace_env_argv(argv, accum_env);
2570 if (!final_argv) {
2571 *exit_status = EXIT_MEMORY;
2572 return -ENOMEM;
2573 }
2574
2575 if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
2576 _cleanup_free_ char *line;
2577
2578 line = exec_command_line(final_argv);
2579 if (line) {
2580 log_open();
2581 log_struct(LOG_DEBUG,
2582 LOG_UNIT_ID(unit),
2583 "EXECUTABLE=%s", command->path,
2584 LOG_UNIT_MESSAGE(unit, "Executing: %s", line),
2585 NULL);
2586 log_close();
2587 }
2588 }
2589
2590 execve(command->path, final_argv, accum_env);
2591 *exit_status = EXIT_EXEC;
2592 return -errno;
2593 }
2594
2595 int exec_spawn(Unit *unit,
2596 ExecCommand *command,
2597 const ExecContext *context,
2598 const ExecParameters *params,
2599 ExecRuntime *runtime,
2600 DynamicCreds *dcreds,
2601 pid_t *ret) {
2602
2603 _cleanup_strv_free_ char **files_env = NULL;
2604 int *fds = NULL; unsigned n_fds = 0;
2605 _cleanup_free_ char *line = NULL;
2606 int socket_fd, r;
2607 char **argv;
2608 pid_t pid;
2609
2610 assert(unit);
2611 assert(command);
2612 assert(context);
2613 assert(ret);
2614 assert(params);
2615 assert(params->fds || params->n_fds <= 0);
2616
2617 if (context->std_input == EXEC_INPUT_SOCKET ||
2618 context->std_output == EXEC_OUTPUT_SOCKET ||
2619 context->std_error == EXEC_OUTPUT_SOCKET) {
2620
2621 if (params->n_fds != 1) {
2622 log_unit_error(unit, "Got more than one socket.");
2623 return -EINVAL;
2624 }
2625
2626 socket_fd = params->fds[0];
2627 } else {
2628 socket_fd = -1;
2629 fds = params->fds;
2630 n_fds = params->n_fds;
2631 }
2632
2633 r = exec_context_load_environment(unit, context, &files_env);
2634 if (r < 0)
2635 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
2636
2637 argv = params->argv ?: command->argv;
2638 line = exec_command_line(argv);
2639 if (!line)
2640 return log_oom();
2641
2642 log_struct(LOG_DEBUG,
2643 LOG_UNIT_ID(unit),
2644 LOG_UNIT_MESSAGE(unit, "About to execute: %s", line),
2645 "EXECUTABLE=%s", command->path,
2646 NULL);
2647 pid = fork();
2648 if (pid < 0)
2649 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
2650
2651 if (pid == 0) {
2652 int exit_status;
2653
2654 r = exec_child(unit,
2655 command,
2656 context,
2657 params,
2658 runtime,
2659 dcreds,
2660 argv,
2661 socket_fd,
2662 fds, n_fds,
2663 files_env,
2664 unit->manager->user_lookup_fds[1],
2665 &exit_status);
2666 if (r < 0) {
2667 log_open();
2668 log_struct_errno(LOG_ERR, r,
2669 LOG_MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
2670 LOG_UNIT_ID(unit),
2671 LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
2672 exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
2673 command->path),
2674 "EXECUTABLE=%s", command->path,
2675 NULL);
2676 }
2677
2678 _exit(exit_status);
2679 }
2680
2681 log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
2682
2683 /* We add the new process to the cgroup both in the child (so
2684 * that we can be sure that no user code is ever executed
2685 * outside of the cgroup) and in the parent (so that we can be
2686 * sure that when we kill the cgroup the process will be
2687 * killed too). */
2688 if (params->cgroup_path)
2689 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
2690
2691 exec_status_start(&command->exec_status, pid);
2692
2693 *ret = pid;
2694 return 0;
2695 }
2696
2697 void exec_context_init(ExecContext *c) {
2698 assert(c);
2699
2700 c->umask = 0022;
2701 c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
2702 c->cpu_sched_policy = SCHED_OTHER;
2703 c->syslog_priority = LOG_DAEMON|LOG_INFO;
2704 c->syslog_level_prefix = true;
2705 c->ignore_sigpipe = true;
2706 c->timer_slack_nsec = NSEC_INFINITY;
2707 c->personality = PERSONALITY_INVALID;
2708 c->runtime_directory_mode = 0755;
2709 c->capability_bounding_set = CAP_ALL;
2710 }
2711
2712 void exec_context_done(ExecContext *c) {
2713 unsigned l;
2714
2715 assert(c);
2716
2717 c->environment = strv_free(c->environment);
2718 c->environment_files = strv_free(c->environment_files);
2719 c->pass_environment = strv_free(c->pass_environment);
2720
2721 for (l = 0; l < ELEMENTSOF(c->rlimit); l++)
2722 c->rlimit[l] = mfree(c->rlimit[l]);
2723
2724 c->working_directory = mfree(c->working_directory);
2725 c->root_directory = mfree(c->root_directory);
2726 c->tty_path = mfree(c->tty_path);
2727 c->syslog_identifier = mfree(c->syslog_identifier);
2728 c->user = mfree(c->user);
2729 c->group = mfree(c->group);
2730
2731 c->supplementary_groups = strv_free(c->supplementary_groups);
2732
2733 c->pam_name = mfree(c->pam_name);
2734
2735 c->read_only_paths = strv_free(c->read_only_paths);
2736 c->read_write_paths = strv_free(c->read_write_paths);
2737 c->inaccessible_paths = strv_free(c->inaccessible_paths);
2738
2739 if (c->cpuset)
2740 CPU_FREE(c->cpuset);
2741
2742 c->utmp_id = mfree(c->utmp_id);
2743 c->selinux_context = mfree(c->selinux_context);
2744 c->apparmor_profile = mfree(c->apparmor_profile);
2745
2746 c->syscall_filter = set_free(c->syscall_filter);
2747 c->syscall_archs = set_free(c->syscall_archs);
2748 c->address_families = set_free(c->address_families);
2749
2750 c->runtime_directory = strv_free(c->runtime_directory);
2751 }
2752
2753 int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
2754 char **i;
2755
2756 assert(c);
2757
2758 if (!runtime_prefix)
2759 return 0;
2760
2761 STRV_FOREACH(i, c->runtime_directory) {
2762 _cleanup_free_ char *p;
2763
2764 p = strjoin(runtime_prefix, "/", *i, NULL);
2765 if (!p)
2766 return -ENOMEM;
2767
2768 /* We execute this synchronously, since we need to be
2769 * sure this is gone when we start the service
2770 * next. */
2771 (void) rm_rf(p, REMOVE_ROOT);
2772 }
2773
2774 return 0;
2775 }
2776
2777 void exec_command_done(ExecCommand *c) {
2778 assert(c);
2779
2780 c->path = mfree(c->path);
2781
2782 c->argv = strv_free(c->argv);
2783 }
2784
2785 void exec_command_done_array(ExecCommand *c, unsigned n) {
2786 unsigned i;
2787
2788 for (i = 0; i < n; i++)
2789 exec_command_done(c+i);
2790 }
2791
2792 ExecCommand* exec_command_free_list(ExecCommand *c) {
2793 ExecCommand *i;
2794
2795 while ((i = c)) {
2796 LIST_REMOVE(command, c, i);
2797 exec_command_done(i);
2798 free(i);
2799 }
2800
2801 return NULL;
2802 }
2803
2804 void exec_command_free_array(ExecCommand **c, unsigned n) {
2805 unsigned i;
2806
2807 for (i = 0; i < n; i++)
2808 c[i] = exec_command_free_list(c[i]);
2809 }
2810
2811 typedef struct InvalidEnvInfo {
2812 Unit *unit;
2813 const char *path;
2814 } InvalidEnvInfo;
2815
2816 static void invalid_env(const char *p, void *userdata) {
2817 InvalidEnvInfo *info = userdata;
2818
2819 log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
2820 }
2821
2822 int exec_context_load_environment(Unit *unit, const ExecContext *c, char ***l) {
2823 char **i, **r = NULL;
2824
2825 assert(c);
2826 assert(l);
2827
2828 STRV_FOREACH(i, c->environment_files) {
2829 char *fn;
2830 int k;
2831 bool ignore = false;
2832 char **p;
2833 _cleanup_globfree_ glob_t pglob = {};
2834 int count, n;
2835
2836 fn = *i;
2837
2838 if (fn[0] == '-') {
2839 ignore = true;
2840 fn++;
2841 }
2842
2843 if (!path_is_absolute(fn)) {
2844 if (ignore)
2845 continue;
2846
2847 strv_free(r);
2848 return -EINVAL;
2849 }
2850
2851 /* Filename supports globbing, take all matching files */
2852 errno = 0;
2853 if (glob(fn, 0, NULL, &pglob) != 0) {
2854 if (ignore)
2855 continue;
2856
2857 strv_free(r);
2858 return errno > 0 ? -errno : -EINVAL;
2859 }
2860 count = pglob.gl_pathc;
2861 if (count == 0) {
2862 if (ignore)
2863 continue;
2864
2865 strv_free(r);
2866 return -EINVAL;
2867 }
2868 for (n = 0; n < count; n++) {
2869 k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
2870 if (k < 0) {
2871 if (ignore)
2872 continue;
2873
2874 strv_free(r);
2875 return k;
2876 }
2877 /* Log invalid environment variables with filename */
2878 if (p) {
2879 InvalidEnvInfo info = {
2880 .unit = unit,
2881 .path = pglob.gl_pathv[n]
2882 };
2883
2884 p = strv_env_clean_with_callback(p, invalid_env, &info);
2885 }
2886
2887 if (r == NULL)
2888 r = p;
2889 else {
2890 char **m;
2891
2892 m = strv_env_merge(2, r, p);
2893 strv_free(r);
2894 strv_free(p);
2895 if (!m)
2896 return -ENOMEM;
2897
2898 r = m;
2899 }
2900 }
2901 }
2902
2903 *l = r;
2904
2905 return 0;
2906 }
2907
2908 static bool tty_may_match_dev_console(const char *tty) {
2909 _cleanup_free_ char *active = NULL;
2910 char *console;
2911
2912 if (!tty)
2913 return true;
2914
2915 if (startswith(tty, "/dev/"))
2916 tty += 5;
2917
2918 /* trivial identity? */
2919 if (streq(tty, "console"))
2920 return true;
2921
2922 console = resolve_dev_console(&active);
2923 /* if we could not resolve, assume it may */
2924 if (!console)
2925 return true;
2926
2927 /* "tty0" means the active VC, so it may be the same sometimes */
2928 return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
2929 }
2930
2931 bool exec_context_may_touch_console(ExecContext *ec) {
2932
2933 return (ec->tty_reset ||
2934 ec->tty_vhangup ||
2935 ec->tty_vt_disallocate ||
2936 is_terminal_input(ec->std_input) ||
2937 is_terminal_output(ec->std_output) ||
2938 is_terminal_output(ec->std_error)) &&
2939 tty_may_match_dev_console(exec_context_tty_path(ec));
2940 }
2941
2942 static void strv_fprintf(FILE *f, char **l) {
2943 char **g;
2944
2945 assert(f);
2946
2947 STRV_FOREACH(g, l)
2948 fprintf(f, " %s", *g);
2949 }
2950
2951 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
2952 char **e, **d;
2953 unsigned i;
2954
2955 assert(c);
2956 assert(f);
2957
2958 prefix = strempty(prefix);
2959
2960 fprintf(f,
2961 "%sUMask: %04o\n"
2962 "%sWorkingDirectory: %s\n"
2963 "%sRootDirectory: %s\n"
2964 "%sNonBlocking: %s\n"
2965 "%sPrivateTmp: %s\n"
2966 "%sPrivateDevices: %s\n"
2967 "%sProtectKernelTunables: %s\n"
2968 "%sProtectControlGroups: %s\n"
2969 "%sPrivateNetwork: %s\n"
2970 "%sPrivateUsers: %s\n"
2971 "%sProtectHome: %s\n"
2972 "%sProtectSystem: %s\n"
2973 "%sIgnoreSIGPIPE: %s\n"
2974 "%sMemoryDenyWriteExecute: %s\n"
2975 "%sRestrictRealtime: %s\n",
2976 prefix, c->umask,
2977 prefix, c->working_directory ? c->working_directory : "/",
2978 prefix, c->root_directory ? c->root_directory : "/",
2979 prefix, yes_no(c->non_blocking),
2980 prefix, yes_no(c->private_tmp),
2981 prefix, yes_no(c->private_devices),
2982 prefix, yes_no(c->protect_kernel_tunables),
2983 prefix, yes_no(c->protect_control_groups),
2984 prefix, yes_no(c->private_network),
2985 prefix, yes_no(c->private_users),
2986 prefix, protect_home_to_string(c->protect_home),
2987 prefix, protect_system_to_string(c->protect_system),
2988 prefix, yes_no(c->ignore_sigpipe),
2989 prefix, yes_no(c->memory_deny_write_execute),
2990 prefix, yes_no(c->restrict_realtime));
2991
2992 STRV_FOREACH(e, c->environment)
2993 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
2994
2995 STRV_FOREACH(e, c->environment_files)
2996 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
2997
2998 STRV_FOREACH(e, c->pass_environment)
2999 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
3000
3001 fprintf(f, "%sRuntimeDirectoryMode: %04o\n", prefix, c->runtime_directory_mode);
3002
3003 STRV_FOREACH(d, c->runtime_directory)
3004 fprintf(f, "%sRuntimeDirectory: %s\n", prefix, *d);
3005
3006 if (c->nice_set)
3007 fprintf(f,
3008 "%sNice: %i\n",
3009 prefix, c->nice);
3010
3011 if (c->oom_score_adjust_set)
3012 fprintf(f,
3013 "%sOOMScoreAdjust: %i\n",
3014 prefix, c->oom_score_adjust);
3015
3016 for (i = 0; i < RLIM_NLIMITS; i++)
3017 if (c->rlimit[i]) {
3018 fprintf(f, "%s%s: " RLIM_FMT "\n",
3019 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
3020 fprintf(f, "%s%sSoft: " RLIM_FMT "\n",
3021 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
3022 }
3023
3024 if (c->ioprio_set) {
3025 _cleanup_free_ char *class_str = NULL;
3026
3027 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
3028 fprintf(f,
3029 "%sIOSchedulingClass: %s\n"
3030 "%sIOPriority: %i\n",
3031 prefix, strna(class_str),
3032 prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
3033 }
3034
3035 if (c->cpu_sched_set) {
3036 _cleanup_free_ char *policy_str = NULL;
3037
3038 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
3039 fprintf(f,
3040 "%sCPUSchedulingPolicy: %s\n"
3041 "%sCPUSchedulingPriority: %i\n"
3042 "%sCPUSchedulingResetOnFork: %s\n",
3043 prefix, strna(policy_str),
3044 prefix, c->cpu_sched_priority,
3045 prefix, yes_no(c->cpu_sched_reset_on_fork));
3046 }
3047
3048 if (c->cpuset) {
3049 fprintf(f, "%sCPUAffinity:", prefix);
3050 for (i = 0; i < c->cpuset_ncpus; i++)
3051 if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
3052 fprintf(f, " %u", i);
3053 fputs("\n", f);
3054 }
3055
3056 if (c->timer_slack_nsec != NSEC_INFINITY)
3057 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
3058
3059 fprintf(f,
3060 "%sStandardInput: %s\n"
3061 "%sStandardOutput: %s\n"
3062 "%sStandardError: %s\n",
3063 prefix, exec_input_to_string(c->std_input),
3064 prefix, exec_output_to_string(c->std_output),
3065 prefix, exec_output_to_string(c->std_error));
3066
3067 if (c->tty_path)
3068 fprintf(f,
3069 "%sTTYPath: %s\n"
3070 "%sTTYReset: %s\n"
3071 "%sTTYVHangup: %s\n"
3072 "%sTTYVTDisallocate: %s\n",
3073 prefix, c->tty_path,
3074 prefix, yes_no(c->tty_reset),
3075 prefix, yes_no(c->tty_vhangup),
3076 prefix, yes_no(c->tty_vt_disallocate));
3077
3078 if (c->std_output == EXEC_OUTPUT_SYSLOG ||
3079 c->std_output == EXEC_OUTPUT_KMSG ||
3080 c->std_output == EXEC_OUTPUT_JOURNAL ||
3081 c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
3082 c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
3083 c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
3084 c->std_error == EXEC_OUTPUT_SYSLOG ||
3085 c->std_error == EXEC_OUTPUT_KMSG ||
3086 c->std_error == EXEC_OUTPUT_JOURNAL ||
3087 c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
3088 c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
3089 c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
3090
3091 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
3092
3093 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
3094 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
3095
3096 fprintf(f,
3097 "%sSyslogFacility: %s\n"
3098 "%sSyslogLevel: %s\n",
3099 prefix, strna(fac_str),
3100 prefix, strna(lvl_str));
3101 }
3102
3103 if (c->secure_bits)
3104 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
3105 prefix,
3106 (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
3107 (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
3108 (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
3109 (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
3110 (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
3111 (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
3112
3113 if (c->capability_bounding_set != CAP_ALL) {
3114 unsigned long l;
3115 fprintf(f, "%sCapabilityBoundingSet:", prefix);
3116
3117 for (l = 0; l <= cap_last_cap(); l++)
3118 if (c->capability_bounding_set & (UINT64_C(1) << l))
3119 fprintf(f, " %s", strna(capability_to_name(l)));
3120
3121 fputs("\n", f);
3122 }
3123
3124 if (c->capability_ambient_set != 0) {
3125 unsigned long l;
3126 fprintf(f, "%sAmbientCapabilities:", prefix);
3127
3128 for (l = 0; l <= cap_last_cap(); l++)
3129 if (c->capability_ambient_set & (UINT64_C(1) << l))
3130 fprintf(f, " %s", strna(capability_to_name(l)));
3131
3132 fputs("\n", f);
3133 }
3134
3135 if (c->user)
3136 fprintf(f, "%sUser: %s\n", prefix, c->user);
3137 if (c->group)
3138 fprintf(f, "%sGroup: %s\n", prefix, c->group);
3139
3140 fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
3141
3142 if (strv_length(c->supplementary_groups) > 0) {
3143 fprintf(f, "%sSupplementaryGroups:", prefix);
3144 strv_fprintf(f, c->supplementary_groups);
3145 fputs("\n", f);
3146 }
3147
3148 if (c->pam_name)
3149 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
3150
3151 if (strv_length(c->read_write_paths) > 0) {
3152 fprintf(f, "%sReadWritePaths:", prefix);
3153 strv_fprintf(f, c->read_write_paths);
3154 fputs("\n", f);
3155 }
3156
3157 if (strv_length(c->read_only_paths) > 0) {
3158 fprintf(f, "%sReadOnlyPaths:", prefix);
3159 strv_fprintf(f, c->read_only_paths);
3160 fputs("\n", f);
3161 }
3162
3163 if (strv_length(c->inaccessible_paths) > 0) {
3164 fprintf(f, "%sInaccessiblePaths:", prefix);
3165 strv_fprintf(f, c->inaccessible_paths);
3166 fputs("\n", f);
3167 }
3168
3169 if (c->utmp_id)
3170 fprintf(f,
3171 "%sUtmpIdentifier: %s\n",
3172 prefix, c->utmp_id);
3173
3174 if (c->selinux_context)
3175 fprintf(f,
3176 "%sSELinuxContext: %s%s\n",
3177 prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
3178
3179 if (c->personality != PERSONALITY_INVALID)
3180 fprintf(f,
3181 "%sPersonality: %s\n",
3182 prefix, strna(personality_to_string(c->personality)));
3183
3184 if (c->syscall_filter) {
3185 #ifdef HAVE_SECCOMP
3186 Iterator j;
3187 void *id;
3188 bool first = true;
3189 #endif
3190
3191 fprintf(f,
3192 "%sSystemCallFilter: ",
3193 prefix);
3194
3195 if (!c->syscall_whitelist)
3196 fputc('~', f);
3197
3198 #ifdef HAVE_SECCOMP
3199 SET_FOREACH(id, c->syscall_filter, j) {
3200 _cleanup_free_ char *name = NULL;
3201
3202 if (first)
3203 first = false;
3204 else
3205 fputc(' ', f);
3206
3207 name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
3208 fputs(strna(name), f);
3209 }
3210 #endif
3211
3212 fputc('\n', f);
3213 }
3214
3215 if (c->syscall_archs) {
3216 #ifdef HAVE_SECCOMP
3217 Iterator j;
3218 void *id;
3219 #endif
3220
3221 fprintf(f,
3222 "%sSystemCallArchitectures:",
3223 prefix);
3224
3225 #ifdef HAVE_SECCOMP
3226 SET_FOREACH(id, c->syscall_archs, j)
3227 fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
3228 #endif
3229 fputc('\n', f);
3230 }
3231
3232 if (c->syscall_errno > 0)
3233 fprintf(f,
3234 "%sSystemCallErrorNumber: %s\n",
3235 prefix, strna(errno_to_name(c->syscall_errno)));
3236
3237 if (c->apparmor_profile)
3238 fprintf(f,
3239 "%sAppArmorProfile: %s%s\n",
3240 prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
3241 }
3242
3243 bool exec_context_maintains_privileges(ExecContext *c) {
3244 assert(c);
3245
3246 /* Returns true if the process forked off would run under
3247 * an unchanged UID or as root. */
3248
3249 if (!c->user)
3250 return true;
3251
3252 if (streq(c->user, "root") || streq(c->user, "0"))
3253 return true;
3254
3255 return false;
3256 }
3257
3258 void exec_status_start(ExecStatus *s, pid_t pid) {
3259 assert(s);
3260
3261 zero(*s);
3262 s->pid = pid;
3263 dual_timestamp_get(&s->start_timestamp);
3264 }
3265
3266 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
3267 assert(s);
3268
3269 if (s->pid && s->pid != pid)
3270 zero(*s);
3271
3272 s->pid = pid;
3273 dual_timestamp_get(&s->exit_timestamp);
3274
3275 s->code = code;
3276 s->status = status;
3277
3278 if (context) {
3279 if (context->utmp_id)
3280 utmp_put_dead_process(context->utmp_id, pid, code, status);
3281
3282 exec_context_tty_reset(context, NULL);
3283 }
3284 }
3285
3286 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
3287 char buf[FORMAT_TIMESTAMP_MAX];
3288
3289 assert(s);
3290 assert(f);
3291
3292 if (s->pid <= 0)
3293 return;
3294
3295 prefix = strempty(prefix);
3296
3297 fprintf(f,
3298 "%sPID: "PID_FMT"\n",
3299 prefix, s->pid);
3300
3301 if (dual_timestamp_is_set(&s->start_timestamp))
3302 fprintf(f,
3303 "%sStart Timestamp: %s\n",
3304 prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
3305
3306 if (dual_timestamp_is_set(&s->exit_timestamp))
3307 fprintf(f,
3308 "%sExit Timestamp: %s\n"
3309 "%sExit Code: %s\n"
3310 "%sExit Status: %i\n",
3311 prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
3312 prefix, sigchld_code_to_string(s->code),
3313 prefix, s->status);
3314 }
3315
3316 char *exec_command_line(char **argv) {
3317 size_t k;
3318 char *n, *p, **a;
3319 bool first = true;
3320
3321 assert(argv);
3322
3323 k = 1;
3324 STRV_FOREACH(a, argv)
3325 k += strlen(*a)+3;
3326
3327 if (!(n = new(char, k)))
3328 return NULL;
3329
3330 p = n;
3331 STRV_FOREACH(a, argv) {
3332
3333 if (!first)
3334 *(p++) = ' ';
3335 else
3336 first = false;
3337
3338 if (strpbrk(*a, WHITESPACE)) {
3339 *(p++) = '\'';
3340 p = stpcpy(p, *a);
3341 *(p++) = '\'';
3342 } else
3343 p = stpcpy(p, *a);
3344
3345 }
3346
3347 *p = 0;
3348
3349 /* FIXME: this doesn't really handle arguments that have
3350 * spaces and ticks in them */
3351
3352 return n;
3353 }
3354
3355 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
3356 _cleanup_free_ char *cmd = NULL;
3357 const char *prefix2;
3358
3359 assert(c);
3360 assert(f);
3361
3362 prefix = strempty(prefix);
3363 prefix2 = strjoina(prefix, "\t");
3364
3365 cmd = exec_command_line(c->argv);
3366 fprintf(f,
3367 "%sCommand Line: %s\n",
3368 prefix, cmd ? cmd : strerror(ENOMEM));
3369
3370 exec_status_dump(&c->exec_status, f, prefix2);
3371 }
3372
3373 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
3374 assert(f);
3375
3376 prefix = strempty(prefix);
3377
3378 LIST_FOREACH(command, c, c)
3379 exec_command_dump(c, f, prefix);
3380 }
3381
3382 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
3383 ExecCommand *end;
3384
3385 assert(l);
3386 assert(e);
3387
3388 if (*l) {
3389 /* It's kind of important, that we keep the order here */
3390 LIST_FIND_TAIL(command, *l, end);
3391 LIST_INSERT_AFTER(command, *l, end, e);
3392 } else
3393 *l = e;
3394 }
3395
3396 int exec_command_set(ExecCommand *c, const char *path, ...) {
3397 va_list ap;
3398 char **l, *p;
3399
3400 assert(c);
3401 assert(path);
3402
3403 va_start(ap, path);
3404 l = strv_new_ap(path, ap);
3405 va_end(ap);
3406
3407 if (!l)
3408 return -ENOMEM;
3409
3410 p = strdup(path);
3411 if (!p) {
3412 strv_free(l);
3413 return -ENOMEM;
3414 }
3415
3416 free(c->path);
3417 c->path = p;
3418
3419 strv_free(c->argv);
3420 c->argv = l;
3421
3422 return 0;
3423 }
3424
3425 int exec_command_append(ExecCommand *c, const char *path, ...) {
3426 _cleanup_strv_free_ char **l = NULL;
3427 va_list ap;
3428 int r;
3429
3430 assert(c);
3431 assert(path);
3432
3433 va_start(ap, path);
3434 l = strv_new_ap(path, ap);
3435 va_end(ap);
3436
3437 if (!l)
3438 return -ENOMEM;
3439
3440 r = strv_extend_strv(&c->argv, l, false);
3441 if (r < 0)
3442 return r;
3443
3444 return 0;
3445 }
3446
3447
3448 static int exec_runtime_allocate(ExecRuntime **rt) {
3449
3450 if (*rt)
3451 return 0;
3452
3453 *rt = new0(ExecRuntime, 1);
3454 if (!*rt)
3455 return -ENOMEM;
3456
3457 (*rt)->n_ref = 1;
3458 (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
3459
3460 return 0;
3461 }
3462
3463 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
3464 int r;
3465
3466 assert(rt);
3467 assert(c);
3468 assert(id);
3469
3470 if (*rt)
3471 return 1;
3472
3473 if (!c->private_network && !c->private_tmp)
3474 return 0;
3475
3476 r = exec_runtime_allocate(rt);
3477 if (r < 0)
3478 return r;
3479
3480 if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
3481 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, (*rt)->netns_storage_socket) < 0)
3482 return -errno;
3483 }
3484
3485 if (c->private_tmp && !(*rt)->tmp_dir) {
3486 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
3487 if (r < 0)
3488 return r;
3489 }
3490
3491 return 1;
3492 }
3493
3494 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
3495 assert(r);
3496 assert(r->n_ref > 0);
3497
3498 r->n_ref++;
3499 return r;
3500 }
3501
3502 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
3503
3504 if (!r)
3505 return NULL;
3506
3507 assert(r->n_ref > 0);
3508
3509 r->n_ref--;
3510 if (r->n_ref > 0)
3511 return NULL;
3512
3513 free(r->tmp_dir);
3514 free(r->var_tmp_dir);
3515 safe_close_pair(r->netns_storage_socket);
3516 free(r);
3517
3518 return NULL;
3519 }
3520
3521 int exec_runtime_serialize(Unit *u, ExecRuntime *rt, FILE *f, FDSet *fds) {
3522 assert(u);
3523 assert(f);
3524 assert(fds);
3525
3526 if (!rt)
3527 return 0;
3528
3529 if (rt->tmp_dir)
3530 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
3531
3532 if (rt->var_tmp_dir)
3533 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
3534
3535 if (rt->netns_storage_socket[0] >= 0) {
3536 int copy;
3537
3538 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
3539 if (copy < 0)
3540 return copy;
3541
3542 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
3543 }
3544
3545 if (rt->netns_storage_socket[1] >= 0) {
3546 int copy;
3547
3548 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
3549 if (copy < 0)
3550 return copy;
3551
3552 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
3553 }
3554
3555 return 0;
3556 }
3557
3558 int exec_runtime_deserialize_item(Unit *u, ExecRuntime **rt, const char *key, const char *value, FDSet *fds) {
3559 int r;
3560
3561 assert(rt);
3562 assert(key);
3563 assert(value);
3564
3565 if (streq(key, "tmp-dir")) {
3566 char *copy;
3567
3568 r = exec_runtime_allocate(rt);
3569 if (r < 0)
3570 return log_oom();
3571
3572 copy = strdup(value);
3573 if (!copy)
3574 return log_oom();
3575
3576 free((*rt)->tmp_dir);
3577 (*rt)->tmp_dir = copy;
3578
3579 } else if (streq(key, "var-tmp-dir")) {
3580 char *copy;
3581
3582 r = exec_runtime_allocate(rt);
3583 if (r < 0)
3584 return log_oom();
3585
3586 copy = strdup(value);
3587 if (!copy)
3588 return log_oom();
3589
3590 free((*rt)->var_tmp_dir);
3591 (*rt)->var_tmp_dir = copy;
3592
3593 } else if (streq(key, "netns-socket-0")) {
3594 int fd;
3595
3596 r = exec_runtime_allocate(rt);
3597 if (r < 0)
3598 return log_oom();
3599
3600 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
3601 log_unit_debug(u, "Failed to parse netns socket value: %s", value);
3602 else {
3603 safe_close((*rt)->netns_storage_socket[0]);
3604 (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
3605 }
3606 } else if (streq(key, "netns-socket-1")) {
3607 int fd;
3608
3609 r = exec_runtime_allocate(rt);
3610 if (r < 0)
3611 return log_oom();
3612
3613 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
3614 log_unit_debug(u, "Failed to parse netns socket value: %s", value);
3615 else {
3616 safe_close((*rt)->netns_storage_socket[1]);
3617 (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
3618 }
3619 } else
3620 return 0;
3621
3622 return 1;
3623 }
3624
3625 static void *remove_tmpdir_thread(void *p) {
3626 _cleanup_free_ char *path = p;
3627
3628 (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
3629 return NULL;
3630 }
3631
3632 void exec_runtime_destroy(ExecRuntime *rt) {
3633 int r;
3634
3635 if (!rt)
3636 return;
3637
3638 /* If there are multiple users of this, let's leave the stuff around */
3639 if (rt->n_ref > 1)
3640 return;
3641
3642 if (rt->tmp_dir) {
3643 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
3644
3645 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
3646 if (r < 0) {
3647 log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
3648 free(rt->tmp_dir);
3649 }
3650
3651 rt->tmp_dir = NULL;
3652 }
3653
3654 if (rt->var_tmp_dir) {
3655 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
3656
3657 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
3658 if (r < 0) {
3659 log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
3660 free(rt->var_tmp_dir);
3661 }
3662
3663 rt->var_tmp_dir = NULL;
3664 }
3665
3666 safe_close_pair(rt->netns_storage_socket);
3667 }
3668
3669 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
3670 [EXEC_INPUT_NULL] = "null",
3671 [EXEC_INPUT_TTY] = "tty",
3672 [EXEC_INPUT_TTY_FORCE] = "tty-force",
3673 [EXEC_INPUT_TTY_FAIL] = "tty-fail",
3674 [EXEC_INPUT_SOCKET] = "socket"
3675 };
3676
3677 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
3678
3679 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
3680 [EXEC_OUTPUT_INHERIT] = "inherit",
3681 [EXEC_OUTPUT_NULL] = "null",
3682 [EXEC_OUTPUT_TTY] = "tty",
3683 [EXEC_OUTPUT_SYSLOG] = "syslog",
3684 [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
3685 [EXEC_OUTPUT_KMSG] = "kmsg",
3686 [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
3687 [EXEC_OUTPUT_JOURNAL] = "journal",
3688 [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
3689 [EXEC_OUTPUT_SOCKET] = "socket"
3690 };
3691
3692 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
3693
3694 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
3695 [EXEC_UTMP_INIT] = "init",
3696 [EXEC_UTMP_LOGIN] = "login",
3697 [EXEC_UTMP_USER] = "user",
3698 };
3699
3700 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);
Unnamed repository; edit this file 'description' to name the repository.