1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
4 typedef struct ExecStatus ExecStatus
;
5 typedef struct ExecCommand ExecCommand
;
6 typedef struct ExecContext ExecContext
;
7 typedef struct ExecSharedRuntime ExecSharedRuntime
;
8 typedef struct DynamicCreds DynamicCreds
;
9 typedef struct ExecRuntime ExecRuntime
;
10 typedef struct ExecParameters ExecParameters
;
11 typedef struct Manager Manager
;
16 #include <sys/capability.h>
18 #include "cgroup-util.h"
19 #include "coredump-util.h"
20 #include "cpu-set-util.h"
21 #include "exec-util.h"
24 #include "missing_resource.h"
25 #include "namespace.h"
27 #include "numa-util.h"
28 #include "open-file.h"
29 #include "path-util.h"
31 #include "time-util.h"
33 #define EXEC_STDIN_DATA_MAX (64U*1024U*1024U)
35 typedef enum ExecUtmpMode
{
40 _EXEC_UTMP_MODE_INVALID
= -EINVAL
,
43 typedef enum ExecInput
{
53 _EXEC_INPUT_INVALID
= -EINVAL
,
56 typedef enum ExecOutput
{
61 EXEC_OUTPUT_KMSG_AND_CONSOLE
,
63 EXEC_OUTPUT_JOURNAL_AND_CONSOLE
,
67 EXEC_OUTPUT_FILE_APPEND
,
68 EXEC_OUTPUT_FILE_TRUNCATE
,
70 _EXEC_OUTPUT_INVALID
= -EINVAL
,
73 typedef enum ExecPreserveMode
{
76 EXEC_PRESERVE_RESTART
,
77 _EXEC_PRESERVE_MODE_MAX
,
78 _EXEC_PRESERVE_MODE_INVALID
= -EINVAL
,
81 typedef enum ExecKeyringMode
{
85 _EXEC_KEYRING_MODE_MAX
,
86 _EXEC_KEYRING_MODE_INVALID
= -EINVAL
,
89 /* Contains start and exit information about an executed command. */
91 dual_timestamp start_timestamp
;
92 dual_timestamp exit_timestamp
;
94 int code
; /* as in siginfo_t::si_code */
95 int status
; /* as in siginfo_t::si_status */
98 /* Stores information about commands we execute. Covers both configuration settings as well as runtime data. */
102 ExecStatus exec_status
;
103 ExecCommandFlags flags
;
104 LIST_FIELDS(ExecCommand
, command
); /* useful for chaining commands */
107 /* Encapsulates certain aspects of the runtime environment that is to be shared between multiple otherwise separate
108 * invocations of commands. Specifically, this allows sharing of /tmp and /var/tmp data as well as network namespaces
109 * between invocations of commands. This is a reference counted object, with one reference taken by each currently
110 * active command invocation that wants to share this runtime. */
111 struct ExecSharedRuntime
{
116 char *id
; /* Unit id of the owner */
121 /* An AF_UNIX socket pair, that contains a datagram containing a file descriptor referring to the network
123 int netns_storage_socket
[2];
125 /* Like netns_storage_socket, but the file descriptor is referring to the IPC namespace. */
126 int ipcns_storage_socket
[2];
130 ExecSharedRuntime
*shared
;
131 DynamicCreds
*dynamic_creds
;
134 typedef enum ExecDirectoryType
{
135 EXEC_DIRECTORY_RUNTIME
= 0,
136 EXEC_DIRECTORY_STATE
,
137 EXEC_DIRECTORY_CACHE
,
139 EXEC_DIRECTORY_CONFIGURATION
,
140 _EXEC_DIRECTORY_TYPE_MAX
,
141 _EXEC_DIRECTORY_TYPE_INVALID
= -EINVAL
,
144 typedef struct ExecDirectoryItem
{
150 typedef struct ExecDirectory
{
153 ExecDirectoryItem
*items
;
156 typedef enum ExecCleanMask
{
157 /* In case you wonder why the bitmask below doesn't use "directory" in its name: we want to keep this
158 * generic so that .timer timestamp files can nicely be covered by this too, and similar. */
159 EXEC_CLEAN_RUNTIME
= 1U << EXEC_DIRECTORY_RUNTIME
,
160 EXEC_CLEAN_STATE
= 1U << EXEC_DIRECTORY_STATE
,
161 EXEC_CLEAN_CACHE
= 1U << EXEC_DIRECTORY_CACHE
,
162 EXEC_CLEAN_LOGS
= 1U << EXEC_DIRECTORY_LOGS
,
163 EXEC_CLEAN_CONFIGURATION
= 1U << EXEC_DIRECTORY_CONFIGURATION
,
164 EXEC_CLEAN_FDSTORE
= 1U << _EXEC_DIRECTORY_TYPE_MAX
,
166 EXEC_CLEAN_ALL
= (1U << (_EXEC_DIRECTORY_TYPE_MAX
+1)) - 1,
167 _EXEC_CLEAN_MASK_INVALID
= -EINVAL
,
170 /* A credential configured with LoadCredential= */
171 typedef struct ExecLoadCredential
{
174 } ExecLoadCredential
;
176 /* A credential configured with SetCredential= */
177 typedef struct ExecSetCredential
{
184 /* Encodes configuration parameters applied to invoked commands. Does not carry runtime data, but only configuration
185 * changes sourced from unit files and suchlike. ExecContext objects are usually embedded into Unit objects, and do not
186 * change after being loaded. */
189 char **environment_files
;
190 char **pass_environment
;
191 char **unset_environment
;
193 struct rlimit
*rlimit
[_RLIMIT_MAX
];
194 char *working_directory
, *root_directory
, *root_image
, *root_verity
, *root_hash_path
, *root_hash_sig_path
;
195 void *root_hash
, *root_hash_sig
;
196 size_t root_hash_size
, root_hash_sig_size
;
197 LIST_HEAD(MountOptions
, root_image_options
);
198 bool working_directory_missing_ok
:1;
199 bool working_directory_home
:1;
201 bool oom_score_adjust_set
:1;
202 bool coredump_filter_set
:1;
205 bool cpu_sched_set
:1;
206 bool mount_apivfs_set
:1;
208 /* This is not exposed to the user but available internally. We need it to make sure that whenever we
209 * spawn /usr/bin/mount it is run in the same process group as us so that the autofs logic detects
210 * that it belongs to us and we don't enter a trigger loop. */
213 bool cpu_sched_reset_on_fork
;
217 int oom_score_adjust
;
220 int cpu_sched_policy
;
221 int cpu_sched_priority
;
222 uint64_t coredump_filter
;
225 NUMAPolicy numa_policy
;
226 bool cpu_affinity_from_numa
;
229 ExecOutput std_output
;
230 ExecOutput std_error
;
232 char *stdio_fdname
[3];
236 size_t stdin_data_size
;
238 nsec_t timer_slack_nsec
;
244 bool tty_vt_disallocate
;
251 ExecKeyringMode keyring_mode
;
253 /* Since resolving these names might involve socket
254 * connections and we don't want to deadlock ourselves these
255 * names are resolved on execution only and in the child
259 char **supplementary_groups
;
264 ExecUtmpMode utmp_mode
;
266 bool no_new_privileges
;
268 bool selinux_context_ignore
;
269 bool apparmor_profile_ignore
;
270 bool smack_process_label_ignore
;
272 char *selinux_context
;
273 char *apparmor_profile
;
274 char *smack_process_label
;
276 char **read_write_paths
, **read_only_paths
, **inaccessible_paths
, **exec_paths
, **no_exec_paths
;
277 char **exec_search_path
;
278 unsigned long mount_propagation_flag
;
279 BindMount
*bind_mounts
;
280 size_t n_bind_mounts
;
281 TemporaryFileSystem
*temporary_filesystems
;
282 size_t n_temporary_filesystems
;
283 MountImage
*mount_images
;
284 size_t n_mount_images
;
285 MountImage
*extension_images
;
286 size_t n_extension_images
;
287 char **extension_directories
;
289 uint64_t capability_bounding_set
;
290 uint64_t capability_ambient_set
;
294 bool syslog_level_prefix
;
295 char *syslog_identifier
;
297 struct iovec
* log_extra_fields
;
298 size_t n_log_extra_fields
;
299 Set
*log_filter_allowed_patterns
;
300 Set
*log_filter_denied_patterns
;
302 usec_t log_ratelimit_interval_usec
;
303 unsigned log_ratelimit_burst
;
309 ProtectProc protect_proc
; /* hidepid= */
310 ProcSubset proc_subset
; /* subset= */
314 bool private_network
;
315 bool private_devices
;
318 bool protect_kernel_tunables
;
319 bool protect_kernel_modules
;
320 bool protect_kernel_logs
;
322 bool protect_control_groups
;
323 ProtectSystem protect_system
;
324 ProtectHome protect_home
;
325 bool protect_hostname
;
331 bool memory_deny_write_execute
;
332 bool restrict_realtime
;
333 bool restrict_suid_sgid
;
335 bool lock_personality
;
336 unsigned long personality
;
338 unsigned long restrict_namespaces
; /* The CLONE_NEWxyz flags permitted to the unit's processes */
340 Set
*restrict_filesystems
;
341 bool restrict_filesystems_allow_list
:1;
343 Hashmap
*syscall_filter
;
346 bool syscall_allow_list
:1;
348 Hashmap
*syscall_log
;
349 bool syscall_log_allow_list
:1; /* Log listed system calls */
351 bool address_families_allow_list
:1;
352 Set
*address_families
;
354 char *network_namespace_path
;
355 char *ipc_namespace_path
;
357 ExecDirectory directories
[_EXEC_DIRECTORY_TYPE_MAX
];
358 ExecPreserveMode runtime_directory_preserve_mode
;
359 usec_t timeout_clean_usec
;
361 Hashmap
*set_credentials
; /* output id → ExecSetCredential */
362 Hashmap
*load_credentials
; /* output id → ExecLoadCredential */
364 ImagePolicy
*root_image_policy
, *mount_image_policy
, *extension_image_policy
;
367 static inline bool exec_context_restrict_namespaces_set(const ExecContext
*c
) {
370 return (c
->restrict_namespaces
& NAMESPACE_FLAGS_ALL
) != NAMESPACE_FLAGS_ALL
;
373 static inline bool exec_context_restrict_filesystems_set(const ExecContext
*c
) {
376 return c
->restrict_filesystems_allow_list
||
377 !set_isempty(c
->restrict_filesystems
);
380 static inline bool exec_context_with_rootfs(const ExecContext
*c
) {
383 /* Checks if RootDirectory= or RootImage= are used */
385 return !empty_or_root(c
->root_directory
) || c
->root_image
;
388 typedef enum ExecFlags
{
389 EXEC_APPLY_SANDBOXING
= 1 << 0,
390 EXEC_APPLY_CHROOT
= 1 << 1,
391 EXEC_APPLY_TTY_STDIN
= 1 << 2,
392 EXEC_PASS_LOG_UNIT
= 1 << 3, /* Whether to pass the unit name to the service's journal stream connection */
393 EXEC_CHOWN_DIRECTORIES
= 1 << 4, /* chown() the runtime/state/cache/log directories to the user we run as, under all conditions */
394 EXEC_NSS_DYNAMIC_BYPASS
= 1 << 5, /* Set the SYSTEMD_NSS_DYNAMIC_BYPASS environment variable, to disable nss-systemd blocking on PID 1, for use by dbus-daemon */
395 EXEC_CGROUP_DELEGATE
= 1 << 6,
396 EXEC_IS_CONTROL
= 1 << 7,
397 EXEC_CONTROL_CGROUP
= 1 << 8, /* Place the process not in the indicated cgroup but in a subcgroup '/.control', but only EXEC_CGROUP_DELEGATE and EXEC_IS_CONTROL is set, too */
398 EXEC_WRITE_CREDENTIALS
= 1 << 9, /* Set up the credential store logic */
400 /* The following are not used by execute.c, but by consumers internally */
401 EXEC_PASS_FDS
= 1 << 10,
402 EXEC_SETENV_RESULT
= 1 << 11,
403 EXEC_SET_WATCHDOG
= 1 << 12,
404 EXEC_SETENV_MONITOR_RESULT
= 1 << 13, /* Pass exit status to OnFailure= and OnSuccess= dependencies. */
407 /* Parameters for a specific invocation of a command. This structure is put together right before a command is
409 struct ExecParameters
{
415 size_t n_storage_fds
;
418 bool selinux_context_net
:1;
420 CGroupMask cgroup_supported
;
421 const char *cgroup_path
;
424 const char *received_credentials_directory
;
425 const char *received_encrypted_credentials_directory
;
427 const char *confirm_spawn
;
429 usec_t watchdog_usec
;
437 /* An fd that is closed by the execve(), and thus will result in EOF when the execve() is done */
440 const char *notify_socket
;
442 LIST_HEAD(OpenFile
, open_files
);
446 #include "dynamic-user.h"
448 int exec_spawn(Unit
*unit
,
449 ExecCommand
*command
,
450 const ExecContext
*context
,
451 const ExecParameters
*exec_params
,
452 ExecRuntime
*runtime
,
453 const CGroupContext
*cgroup_context
,
456 void exec_command_done_array(ExecCommand
*c
, size_t n
);
457 ExecCommand
* exec_command_free_list(ExecCommand
*c
);
458 void exec_command_free_array(ExecCommand
**c
, size_t n
);
459 void exec_command_reset_status_array(ExecCommand
*c
, size_t n
);
460 void exec_command_reset_status_list_array(ExecCommand
**c
, size_t n
);
461 void exec_command_dump_list(ExecCommand
*c
, FILE *f
, const char *prefix
);
462 void exec_command_append_list(ExecCommand
**l
, ExecCommand
*e
);
463 int exec_command_set(ExecCommand
*c
, const char *path
, ...) _sentinel_
;
464 int exec_command_append(ExecCommand
*c
, const char *path
, ...) _sentinel_
;
466 void exec_context_init(ExecContext
*c
);
467 void exec_context_done(ExecContext
*c
);
468 void exec_context_dump(const ExecContext
*c
, FILE* f
, const char *prefix
);
470 int exec_context_destroy_runtime_directory(const ExecContext
*c
, const char *runtime_root
);
471 int exec_context_destroy_credentials(const ExecContext
*c
, const char *runtime_root
, const char *unit
);
472 int exec_context_destroy_mount_ns_dir(Unit
*u
);
474 const char* exec_context_fdname(const ExecContext
*c
, int fd_index
);
476 bool exec_context_may_touch_console(const ExecContext
*c
);
477 bool exec_context_maintains_privileges(const ExecContext
*c
);
478 bool exec_context_has_encrypted_credentials(ExecContext
*c
);
479 bool exec_context_has_credentials(const ExecContext
*context
);
481 int exec_context_get_effective_ioprio(const ExecContext
*c
);
482 bool exec_context_get_effective_mount_apivfs(const ExecContext
*c
);
484 void exec_context_free_log_extra_fields(ExecContext
*c
);
486 void exec_context_revert_tty(ExecContext
*c
);
488 int exec_context_get_clean_directories(ExecContext
*c
, char **prefix
, ExecCleanMask mask
, char ***ret
);
489 int exec_context_get_clean_mask(ExecContext
*c
, ExecCleanMask
*ret
);
490 int exec_context_add_default_dependencies(Unit
*u
, const ExecContext
*c
);
492 void exec_status_start(ExecStatus
*s
, pid_t pid
);
493 void exec_status_exit(ExecStatus
*s
, const ExecContext
*context
, pid_t pid
, int code
, int status
);
494 void exec_status_dump(const ExecStatus
*s
, FILE *f
, const char *prefix
);
495 void exec_status_reset(ExecStatus
*s
);
497 int exec_shared_runtime_acquire(Manager
*m
, const ExecContext
*c
, const char *name
, bool create
, ExecSharedRuntime
**ret
);
498 ExecSharedRuntime
*exec_shared_runtime_destroy(ExecSharedRuntime
*r
);
499 ExecSharedRuntime
*exec_shared_runtime_unref(ExecSharedRuntime
*r
);
500 DEFINE_TRIVIAL_CLEANUP_FUNC(ExecSharedRuntime
*, exec_shared_runtime_unref
);
502 int exec_shared_runtime_serialize(const Manager
*m
, FILE *f
, FDSet
*fds
);
503 int exec_shared_runtime_deserialize_compat(Unit
*u
, const char *key
, const char *value
, FDSet
*fds
);
504 int exec_shared_runtime_deserialize_one(Manager
*m
, const char *value
, FDSet
*fds
);
505 void exec_shared_runtime_vacuum(Manager
*m
);
507 int exec_runtime_make(ExecSharedRuntime
*shared
, DynamicCreds
*creds
, ExecRuntime
**ret
);
508 ExecRuntime
* exec_runtime_free(ExecRuntime
*rt
);
509 DEFINE_TRIVIAL_CLEANUP_FUNC(ExecRuntime
*, exec_runtime_free
);
510 ExecRuntime
* exec_runtime_destroy(ExecRuntime
*rt
);
512 void exec_params_clear(ExecParameters
*p
);
514 bool exec_context_get_cpu_affinity_from_numa(const ExecContext
*c
);
516 ExecSetCredential
*exec_set_credential_free(ExecSetCredential
*sc
);
517 DEFINE_TRIVIAL_CLEANUP_FUNC(ExecSetCredential
*, exec_set_credential_free
);
519 ExecLoadCredential
*exec_load_credential_free(ExecLoadCredential
*lc
);
520 DEFINE_TRIVIAL_CLEANUP_FUNC(ExecLoadCredential
*, exec_load_credential_free
);
522 void exec_directory_done(ExecDirectory
*d
);
523 int exec_directory_add(ExecDirectory
*d
, const char *path
, const char *symlink
);
524 void exec_directory_sort(ExecDirectory
*d
);
526 ExecCleanMask
exec_clean_mask_from_string(const char *s
);
528 extern const struct hash_ops exec_set_credential_hash_ops
;
529 extern const struct hash_ops exec_load_credential_hash_ops
;
531 const char* exec_output_to_string(ExecOutput i
) _const_
;
532 ExecOutput
exec_output_from_string(const char *s
) _pure_
;
534 const char* exec_input_to_string(ExecInput i
) _const_
;
535 ExecInput
exec_input_from_string(const char *s
) _pure_
;
537 const char* exec_utmp_mode_to_string(ExecUtmpMode i
) _const_
;
538 ExecUtmpMode
exec_utmp_mode_from_string(const char *s
) _pure_
;
540 const char* exec_preserve_mode_to_string(ExecPreserveMode i
) _const_
;
541 ExecPreserveMode
exec_preserve_mode_from_string(const char *s
) _pure_
;
543 const char* exec_keyring_mode_to_string(ExecKeyringMode i
) _const_
;
544 ExecKeyringMode
exec_keyring_mode_from_string(const char *s
) _pure_
;
546 const char* exec_directory_type_to_string(ExecDirectoryType i
) _const_
;
547 ExecDirectoryType
exec_directory_type_from_string(const char *s
) _pure_
;
549 const char* exec_directory_type_symlink_to_string(ExecDirectoryType i
) _const_
;
550 ExecDirectoryType
exec_directory_type_symlink_from_string(const char *s
) _pure_
;
552 const char* exec_resource_type_to_string(ExecDirectoryType i
) _const_
;
553 ExecDirectoryType
exec_resource_type_from_string(const char *s
) _pure_
;
555 bool exec_needs_mount_namespace(const ExecContext
*context
, const ExecParameters
*params
, const ExecRuntime
*runtime
);
556 bool exec_needs_network_namespace(const ExecContext
*context
);