src/home/homed-home.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #if HAVE_LINUX_MEMFD_H
   4 #include <linux/memfd.h>
   5 #endif
   6
   7 #include <sys/mman.h>
   8 #include <sys/quota.h>
   9 #include <sys/vfs.h>
  10
  11 #include "blockdev-util.h"
  12 #include "btrfs-util.h"
  13 #include "bus-common-errors.h"
  14 #include "data-fd-util.h"
  15 #include "env-util.h"
  16 #include "errno-list.h"
  17 #include "errno-util.h"
  18 #include "fd-util.h"
  19 #include "fileio.h"
  20 #include "filesystems.h"
  21 #include "fs-util.h"
  22 #include "home-util.h"
  23 #include "homed-home-bus.h"
  24 #include "homed-home.h"
  25 #include "missing_magic.h"
  26 #include "missing_syscall.h"
  27 #include "mkdir.h"
  28 #include "path-util.h"
  29 #include "process-util.h"
  30 #include "pwquality-util.h"
  31 #include "quota-util.h"
  32 #include "resize-fs.h"
  33 #include "set.h"
  34 #include "signal-util.h"
  35 #include "stat-util.h"
  36 #include "string-table.h"
  37 #include "strv.h"
  38 #include "uid-alloc-range.h"
  39 #include "user-record-pwquality.h"
  40 #include "user-record-sign.h"
  41 #include "user-record-util.h"
  42 #include "user-record.h"
  43 #include "user-util.h"
  44
  45 /* Retry to deactivate home directories again and again every 15s until it works */
  46 #define RETRY_DEACTIVATE_USEC (15U * USEC_PER_SEC)
  47
  48 #define HOME_USERS_MAX 500
  49 #define PENDING_OPERATIONS_MAX 100
  50
  51 assert_cc(HOME_UID_MIN <= HOME_UID_MAX);
  52 assert_cc(HOME_USERS_MAX <= (HOME_UID_MAX - HOME_UID_MIN + 1));
  53
  54 static int home_start_work(Home *h, const char *verb, UserRecord *hr, UserRecord *secret);
  55
  56 DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(operation_hash_ops, void, trivial_hash_func, trivial_compare_func, Operation, operation_unref);
  57
  58 static int suitable_home_record(UserRecord *hr) {
  59         int r;
  60
  61         assert(hr);
  62
  63         if (!hr->user_name)
  64                 return -EUNATCH;
  65
  66         /* We are a bit more restrictive with what we accept as homed-managed user than what we accept in
  67          * home records in general. Let's enforce the stricter rule here. */
  68         if (!suitable_user_name(hr->user_name))
  69                 return -EINVAL;
  70         if (!uid_is_valid(hr->uid))
  71                 return -EINVAL;
  72
  73         /* Insist we are outside of the dynamic and system range */
  74         if (uid_is_system(hr->uid) || gid_is_system(user_record_gid(hr)) ||
  75             uid_is_dynamic(hr->uid) || gid_is_dynamic(user_record_gid(hr)))
  76                 return -EADDRNOTAVAIL;
  77
  78         /* Insist that GID and UID match */
  79         if (user_record_gid(hr) != (gid_t) hr->uid)
  80                 return -EBADSLT;
  81
  82         /* Similar for the realm */
  83         if (hr->realm) {
  84                 r = suitable_realm(hr->realm);
  85                 if (r < 0)
  86                         return r;
  87                 if (r == 0)
  88                         return -EINVAL;
  89         }
  90
  91         return 0;
  92 }
  93
  94 int home_new(Manager *m, UserRecord *hr, const char *sysfs, Home **ret) {
  95         _cleanup_(home_freep) Home *home = NULL;
  96         _cleanup_free_ char *nm = NULL, *ns = NULL;
  97         int r;
  98
  99         assert(m);
 100         assert(hr);
 101
 102         r = suitable_home_record(hr);
 103         if (r < 0)
 104                 return r;
 105
 106         if (hashmap_contains(m->homes_by_name, hr->user_name))
 107                 return -EBUSY;
 108
 109         if (hashmap_contains(m->homes_by_uid, UID_TO_PTR(hr->uid)))
 110                 return -EBUSY;
 111
 112         if (sysfs && hashmap_contains(m->homes_by_sysfs, sysfs))
 113                 return -EBUSY;
 114
 115         if (hashmap_size(m->homes_by_name) >= HOME_USERS_MAX)
 116                 return -EUSERS;
 117
 118         nm = strdup(hr->user_name);
 119         if (!nm)
 120                 return -ENOMEM;
 121
 122         if (sysfs) {
 123                 ns = strdup(sysfs);
 124                 if (!ns)
 125                         return -ENOMEM;
 126         }
 127
 128         home = new(Home, 1);
 129         if (!home)
 130                 return -ENOMEM;
 131
 132         *home = (Home) {
 133                 .manager = m,
 134                 .user_name = TAKE_PTR(nm),
 135                 .uid = hr->uid,
 136                 .state = _HOME_STATE_INVALID,
 137                 .worker_stdout_fd = -1,
 138                 .sysfs = TAKE_PTR(ns),
 139                 .signed_locally = -1,
 140                 .pin_fd = -1,
 141                 .luks_lock_fd = -1,
 142         };
 143
 144         r = hashmap_put(m->homes_by_name, home->user_name, home);
 145         if (r < 0)
 146                 return r;
 147
 148         r = hashmap_put(m->homes_by_uid, UID_TO_PTR(home->uid), home);
 149         if (r < 0)
 150                 return r;
 151
 152         if (home->sysfs) {
 153                 r = hashmap_put(m->homes_by_sysfs, home->sysfs, home);
 154                 if (r < 0)
 155                         return r;
 156         }
 157
 158         r = user_record_clone(hr, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_PERMISSIVE, &home->record);
 159         if (r < 0)
 160                 return r;
 161
 162         (void) bus_manager_emit_auto_login_changed(m);
 163         (void) bus_home_emit_change(home);
 164         (void) manager_schedule_rebalance(m, /* immediately= */ false);
 165
 166         if (ret)
 167                 *ret = TAKE_PTR(home);
 168         else
 169                 TAKE_PTR(home);
 170
 171         return 0;
 172 }
 173
 174 Home *home_free(Home *h) {
 175
 176         if (!h)
 177                 return NULL;
 178
 179         if (h->manager) {
 180                 (void) bus_home_emit_remove(h);
 181                 (void) bus_manager_emit_auto_login_changed(h->manager);
 182
 183                 if (h->user_name)
 184                         (void) hashmap_remove_value(h->manager->homes_by_name, h->user_name, h);
 185
 186                 if (uid_is_valid(h->uid))
 187                         (void) hashmap_remove_value(h->manager->homes_by_uid, UID_TO_PTR(h->uid), h);
 188
 189                 if (h->sysfs)
 190                         (void) hashmap_remove_value(h->manager->homes_by_sysfs, h->sysfs, h);
 191
 192                 if (h->worker_pid > 0)
 193                         (void) hashmap_remove_value(h->manager->homes_by_worker_pid, PID_TO_PTR(h->worker_pid), h);
 194
 195                 if (h->manager->gc_focus == h)
 196                         h->manager->gc_focus = NULL;
 197
 198                 (void) manager_schedule_rebalance(h->manager, /* immediately= */ false);
 199         }
 200
 201         user_record_unref(h->record);
 202         user_record_unref(h->secret);
 203
 204         h->worker_event_source = sd_event_source_disable_unref(h->worker_event_source);
 205         safe_close(h->worker_stdout_fd);
 206         free(h->user_name);
 207         free(h->sysfs);
 208
 209         h->ref_event_source_please_suspend = sd_event_source_disable_unref(h->ref_event_source_please_suspend);
 210         h->ref_event_source_dont_suspend = sd_event_source_disable_unref(h->ref_event_source_dont_suspend);
 211
 212         h->pending_operations = ordered_set_free(h->pending_operations);
 213         h->pending_event_source = sd_event_source_disable_unref(h->pending_event_source);
 214         h->deferred_change_event_source = sd_event_source_disable_unref(h->deferred_change_event_source);
 215
 216         h->current_operation = operation_unref(h->current_operation);
 217
 218         safe_close(h->pin_fd);
 219         safe_close(h->luks_lock_fd);
 220
 221         h->retry_deactivate_event_source = sd_event_source_disable_unref(h->retry_deactivate_event_source);
 222
 223         return mfree(h);
 224 }
 225
 226 int home_set_record(Home *h, UserRecord *hr) {
 227         _cleanup_(user_record_unrefp) UserRecord *new_hr = NULL;
 228         Home *other;
 229         int r;
 230
 231         assert(h);
 232         assert(h->user_name);
 233         assert(h->record);
 234         assert(hr);
 235
 236         if (user_record_equal(h->record, hr))
 237                 return 0;
 238
 239         r = suitable_home_record(hr);
 240         if (r < 0)
 241                 return r;
 242
 243         if (!user_record_compatible(h->record, hr))
 244                 return -EREMCHG;
 245
 246         if (!FLAGS_SET(hr->mask, USER_RECORD_REGULAR) ||
 247             FLAGS_SET(hr->mask, USER_RECORD_SECRET))
 248                 return -EINVAL;
 249
 250         if (FLAGS_SET(h->record->mask, USER_RECORD_STATUS)) {
 251                 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 252
 253                 /* Hmm, the existing record has status fields? If so, copy them over */
 254
 255                 v = json_variant_ref(hr->json);
 256                 r = json_variant_set_field(&v, "status", json_variant_by_key(h->record->json, "status"));
 257                 if (r < 0)
 258                         return r;
 259
 260                 new_hr = user_record_new();
 261                 if (!new_hr)
 262                         return -ENOMEM;
 263
 264                 r = user_record_load(new_hr, v, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE);
 265                 if (r < 0)
 266                         return r;
 267
 268                 hr = new_hr;
 269         }
 270
 271         other = hashmap_get(h->manager->homes_by_uid, UID_TO_PTR(hr->uid));
 272         if (other && other != h)
 273                 return -EBUSY;
 274
 275         if (h->uid != hr->uid) {
 276                 r = hashmap_remove_and_replace(h->manager->homes_by_uid, UID_TO_PTR(h->uid), UID_TO_PTR(hr->uid), h);
 277                 if (r < 0)
 278                         return r;
 279         }
 280
 281         user_record_unref(h->record);
 282         h->record = user_record_ref(hr);
 283         h->uid = h->record->uid;
 284
 285         /* The updated record might have a different autologin setting, trigger a PropertiesChanged event for it */
 286         (void) bus_manager_emit_auto_login_changed(h->manager);
 287         (void) bus_home_emit_change(h);
 288
 289         return 0;
 290 }
 291
 292 int home_save_record(Home *h) {
 293         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 294         _cleanup_free_ char *text = NULL;
 295         const char *fn;
 296         int r;
 297
 298         assert(h);
 299
 300         v = json_variant_ref(h->record->json);
 301         r = json_variant_normalize(&v);
 302         if (r < 0)
 303                 log_warning_errno(r, "User record could not be normalized.");
 304
 305         r = json_variant_format(v, JSON_FORMAT_PRETTY|JSON_FORMAT_NEWLINE, &text);
 306         if (r < 0)
 307                 return r;
 308
 309         (void) mkdir("/var/lib/systemd/", 0755);
 310         (void) mkdir(home_record_dir(), 0700);
 311
 312         fn = strjoina(home_record_dir(), "/", h->user_name, ".identity");
 313
 314         r = write_string_file(fn, text, WRITE_STRING_FILE_ATOMIC|WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_MODE_0600|WRITE_STRING_FILE_SYNC);
 315         if (r < 0)
 316                 return r;
 317
 318         return 0;
 319 }
 320
 321 int home_unlink_record(Home *h) {
 322         const char *fn;
 323
 324         assert(h);
 325
 326         fn = strjoina(home_record_dir(), "/", h->user_name, ".identity");
 327         if (unlink(fn) < 0 && errno != ENOENT)
 328                 return -errno;
 329
 330         fn = strjoina("/run/systemd/home/", h->user_name, ".ref");
 331         if (unlink(fn) < 0 && errno != ENOENT)
 332                 return -errno;
 333
 334         return 0;
 335 }
 336
 337 static void home_unpin(Home *h) {
 338         assert(h);
 339
 340         if (h->pin_fd < 0)
 341                 return;
 342
 343         h->pin_fd = safe_close(h->pin_fd);
 344         log_debug("Successfully closed pin fd on home for %s.", h->user_name);
 345 }
 346
 347 static void home_pin(Home *h) {
 348         const char *path;
 349
 350         assert(h);
 351
 352         if (h->pin_fd >= 0) /* Already pinned? */
 353                 return;
 354
 355         path = user_record_home_directory(h->record);
 356         if (!path) {
 357                 log_warning("No home directory path to pin for %s, ignoring.", h->user_name);
 358                 return;
 359         }
 360
 361         h->pin_fd = open(path, O_RDONLY|O_DIRECTORY|O_CLOEXEC);
 362         if (h->pin_fd < 0) {
 363                 log_warning_errno(errno, "Couldn't open home directory '%s' for pinning, ignoring: %m", path);
 364                 return;
 365         }
 366
 367         log_debug("Successfully pinned home directory '%s'.", path);
 368 }
 369
 370 static void home_update_pin_fd(Home *h, HomeState state) {
 371         assert(h);
 372
 373         if (state < 0)
 374                 state = home_get_state(h);
 375
 376         return HOME_STATE_SHALL_PIN(state) ? home_pin(h) : home_unpin(h);
 377 }
 378
 379 static void home_maybe_close_luks_lock_fd(Home *h, HomeState state) {
 380         assert(h);
 381
 382         if (h->luks_lock_fd < 0)
 383                 return;
 384
 385         if (state < 0)
 386                 state = home_get_state(h);
 387
 388         /* Keep the lock as long as the home dir is active or has some operation going */
 389         if (HOME_STATE_IS_EXECUTING_OPERATION(state) || HOME_STATE_IS_ACTIVE(state) || state == HOME_LOCKED)
 390                 return;
 391
 392         h->luks_lock_fd = safe_close(h->luks_lock_fd);
 393         log_debug("Successfully closed LUKS backing file lock for %s.", h->user_name);
 394 }
 395
 396 static void home_maybe_stop_retry_deactivate(Home *h, HomeState state) {
 397         assert(h);
 398
 399         /* Free the deactivation retry event source if we won't need it anymore. Specifically, we'll free the
 400          * event source whenever the home directory is already deactivated (and we thus where successful) or
 401          * if we start executing an operation that indicates that the home directory is going to be used or
 402          * operated on again. Also, if the home is referenced again stop the timer */
 403
 404         if (HOME_STATE_MAY_RETRY_DEACTIVATE(state) &&
 405             !h->ref_event_source_dont_suspend &&
 406             !h->ref_event_source_please_suspend)
 407                 return;
 408
 409         h->retry_deactivate_event_source = sd_event_source_disable_unref(h->retry_deactivate_event_source);
 410 }
 411
 412 static int home_deactivate_internal(Home *h, bool force, sd_bus_error *error);
 413 static void home_start_retry_deactivate(Home *h);
 414
 415 static int home_on_retry_deactivate(sd_event_source *s, uint64_t usec, void *userdata) {
 416         Home *h = userdata;
 417         HomeState state;
 418
 419         assert(s);
 420         assert(h);
 421
 422         /* 15s after the last attempt to deactivate the home directory passed. Let's try it one more time. */
 423
 424         h->retry_deactivate_event_source = sd_event_source_disable_unref(h->retry_deactivate_event_source);
 425
 426         state = home_get_state(h);
 427         if (!HOME_STATE_MAY_RETRY_DEACTIVATE(state))
 428                 return 0;
 429
 430         if (IN_SET(state, HOME_ACTIVE, HOME_LINGERING)) {
 431                 log_info("Again trying to deactivate home directory.");
 432
 433                 /* If we are not executing any operation, let's start deactivating now. Note that this will
 434                  * restart our timer again, we are gonna be called again if this doesn't work. */
 435                 (void) home_deactivate_internal(h, /* force= */ false, NULL);
 436         } else
 437                 /* if we are executing an operation (specifically, area already running a deactivation
 438                  * operation), then simply reque the timer, so that we retry again. */
 439                 home_start_retry_deactivate(h);
 440
 441         return 0;
 442 }
 443
 444 static void home_start_retry_deactivate(Home *h) {
 445         int r;
 446
 447         assert(h);
 448         assert(h->manager);
 449
 450         /* Already allocated? */
 451         if (h->retry_deactivate_event_source)
 452                 return;
 453
 454         /* If the home directory is being used now don't start the timer */
 455         if (h->ref_event_source_dont_suspend || h->ref_event_source_please_suspend)
 456                 return;
 457
 458         r = sd_event_add_time_relative(
 459                         h->manager->event,
 460                         &h->retry_deactivate_event_source,
 461                         CLOCK_MONOTONIC,
 462                         RETRY_DEACTIVATE_USEC,
 463                         1*USEC_PER_MINUTE,
 464                         home_on_retry_deactivate,
 465                         h);
 466         if (r < 0)
 467                 return (void) log_warning_errno(r, "Failed to install retry-deactivate event source, ignoring: %m");
 468
 469         (void) sd_event_source_set_description(h->retry_deactivate_event_source, "retry-deactivate");
 470 }
 471
 472 static void home_set_state(Home *h, HomeState state) {
 473         HomeState old_state, new_state;
 474
 475         assert(h);
 476
 477         old_state = home_get_state(h);
 478         h->state = state;
 479         new_state = home_get_state(h); /* Query the new state, since the 'state' variable might be set to -1,
 480                                         * in which case we synthesize an high-level state on demand */
 481
 482         log_info("%s: changing state %s → %s", h->user_name,
 483                  home_state_to_string(old_state),
 484                  home_state_to_string(new_state));
 485
 486         home_update_pin_fd(h, new_state);
 487         home_maybe_close_luks_lock_fd(h, new_state);
 488         home_maybe_stop_retry_deactivate(h, new_state);
 489
 490         if (HOME_STATE_IS_EXECUTING_OPERATION(old_state) && !HOME_STATE_IS_EXECUTING_OPERATION(new_state)) {
 491                 /* If we just finished executing some operation, process the queue of pending operations. And
 492                  * enqueue it for GC too. */
 493
 494                 home_schedule_operation(h, NULL, NULL);
 495                 manager_reschedule_rebalance(h->manager);
 496                 manager_enqueue_gc(h->manager, h);
 497         }
 498 }
 499
 500 static int home_parse_worker_stdout(int _fd, UserRecord **ret) {
 501         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 502         _cleanup_close_ int fd = _fd; /* take possession, even on failure */
 503         _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
 504         _cleanup_fclose_ FILE *f = NULL;
 505         unsigned line, column;
 506         struct stat st;
 507         int r;
 508
 509         if (fstat(fd, &st) < 0)
 510                 return log_error_errno(errno, "Failed to stat stdout fd: %m");
 511
 512         assert(S_ISREG(st.st_mode));
 513
 514         if (st.st_size == 0) { /* empty record */
 515                 *ret = NULL;
 516                 return 0;
 517         }
 518
 519         if (lseek(fd, SEEK_SET, 0) == (off_t) -1)
 520                 return log_error_errno(errno, "Failed to seek to beginning of memfd: %m");
 521
 522         f = take_fdopen(&fd, "r");
 523         if (!f)
 524                 return log_error_errno(errno, "Failed to reopen memfd: %m");
 525
 526         if (DEBUG_LOGGING) {
 527                 _cleanup_free_ char *text = NULL;
 528
 529                 r = read_full_stream(f, &text, NULL);
 530                 if (r < 0)
 531                         return log_error_errno(r, "Failed to read from client: %m");
 532
 533                 log_debug("Got from worker: %s", text);
 534                 rewind(f);
 535         }
 536
 537         r = json_parse_file(f, "stdout", JSON_PARSE_SENSITIVE, &v, &line, &column);
 538         if (r < 0)
 539                 return log_error_errno(r, "Failed to parse identity at %u:%u: %m", line, column);
 540
 541         hr = user_record_new();
 542         if (!hr)
 543                 return log_oom();
 544
 545         r = user_record_load(hr, v, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE);
 546         if (r < 0)
 547                 return log_error_errno(r, "Failed to load home record identity: %m");
 548
 549         *ret = TAKE_PTR(hr);
 550         return 1;
 551 }
 552
 553 static int home_verify_user_record(Home *h, UserRecord *hr, bool *ret_signed_locally, sd_bus_error *ret_error) {
 554         int is_signed;
 555
 556         assert(h);
 557         assert(hr);
 558         assert(ret_signed_locally);
 559
 560         is_signed = manager_verify_user_record(h->manager, hr);
 561         switch (is_signed) {
 562
 563         case USER_RECORD_SIGNED_EXCLUSIVE:
 564                 log_info("Home %s is signed exclusively by our key, accepting.", hr->user_name);
 565                 *ret_signed_locally = true;
 566                 return 0;
 567
 568         case USER_RECORD_SIGNED:
 569                 log_info("Home %s is signed by our key (and others), accepting.", hr->user_name);
 570                 *ret_signed_locally = false;
 571                 return 0;
 572
 573         case USER_RECORD_FOREIGN:
 574                 log_info("Home %s is signed by foreign key we like, accepting.", hr->user_name);
 575                 *ret_signed_locally = false;
 576                 return 0;
 577
 578         case USER_RECORD_UNSIGNED:
 579                 sd_bus_error_setf(ret_error, BUS_ERROR_BAD_SIGNATURE, "User record %s is not signed at all, refusing.", hr->user_name);
 580                 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Home %s contains user record that is not signed at all, refusing.", hr->user_name);
 581
 582         case -ENOKEY:
 583                 sd_bus_error_setf(ret_error, BUS_ERROR_BAD_SIGNATURE, "User record %s is not signed by any known key, refusing.", hr->user_name);
 584                 return log_error_errno(is_signed, "Home %s contains user record that is not signed by any known key, refusing.", hr->user_name);
 585
 586         default:
 587                 assert(is_signed < 0);
 588                 return log_error_errno(is_signed, "Failed to verify signature on user record for %s, refusing fixation: %m", hr->user_name);
 589         }
 590 }
 591
 592 static int convert_worker_errno(Home *h, int e, sd_bus_error *error) {
 593         /* Converts the error numbers the worker process returned into somewhat sensible dbus errors */
 594
 595         switch (e) {
 596
 597         case -EMSGSIZE:
 598                 return sd_bus_error_set(error, BUS_ERROR_BAD_HOME_SIZE, "File systems of this type cannot be shrunk");
 599         case -ETXTBSY:
 600                 return sd_bus_error_set(error, BUS_ERROR_BAD_HOME_SIZE, "File systems of this type can only be shrunk offline");
 601         case -ERANGE:
 602                 return sd_bus_error_set(error, BUS_ERROR_BAD_HOME_SIZE, "File system size too small");
 603         case -ENOLINK:
 604                 return sd_bus_error_set(error, SD_BUS_ERROR_NOT_SUPPORTED, "System does not support selected storage backend");
 605         case -EPROTONOSUPPORT:
 606                 return sd_bus_error_set(error, SD_BUS_ERROR_NOT_SUPPORTED, "System does not support selected file system");
 607         case -ENOTTY:
 608                 return sd_bus_error_set(error, SD_BUS_ERROR_NOT_SUPPORTED, "Operation not supported on storage backend");
 609         case -ESOCKTNOSUPPORT:
 610                 return sd_bus_error_set(error, SD_BUS_ERROR_NOT_SUPPORTED, "Operation not supported on file system");
 611         case -ENOKEY:
 612                 return sd_bus_error_setf(error, BUS_ERROR_BAD_PASSWORD, "Password for home %s is incorrect or not sufficient for authentication.", h->user_name);
 613         case -EBADSLT:
 614                 return sd_bus_error_setf(error, BUS_ERROR_BAD_PASSWORD_AND_NO_TOKEN, "Password for home %s is incorrect or not sufficient, and configured security token not found either.", h->user_name);
 615         case -EREMOTEIO:
 616                 return sd_bus_error_setf(error, BUS_ERROR_BAD_RECOVERY_KEY, "Recovery key for home %s is incorrect or not sufficient for authentication.", h->user_name);
 617         case -ENOANO:
 618                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_PIN_NEEDED, "PIN for security token required.");
 619         case -ERFKILL:
 620                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_PROTECTED_AUTHENTICATION_PATH_NEEDED, "Security token requires protected authentication path.");
 621         case -EMEDIUMTYPE:
 622                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_USER_PRESENCE_NEEDED, "Security token requires presence confirmation.");
 623         case -ENOCSI:
 624                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_USER_VERIFICATION_NEEDED, "Security token requires user verification.");
 625         case -ENOSTR:
 626                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_ACTION_TIMEOUT, "Token action timeout. (User was supposed to verify presence or similar, by interacting with the token, and didn't do that in time.)");
 627         case -EOWNERDEAD:
 628                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_PIN_LOCKED, "PIN of security token locked.");
 629         case -ENOLCK:
 630                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_BAD_PIN, "Bad PIN of security token.");
 631         case -ETOOMANYREFS:
 632                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_BAD_PIN_FEW_TRIES_LEFT, "Bad PIN of security token, and only a few tries left.");
 633         case -EUCLEAN:
 634                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_BAD_PIN_ONE_TRY_LEFT, "Bad PIN of security token, and only one try left.");
 635         case -EBUSY:
 636                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "Home %s is currently being used, or an operation on home %s is currently being executed.", h->user_name, h->user_name);
 637         case -ENOEXEC:
 638                 return sd_bus_error_setf(error, BUS_ERROR_HOME_NOT_ACTIVE, "Home %s is currently not active", h->user_name);
 639         case -ENOSPC:
 640                 return sd_bus_error_setf(error, BUS_ERROR_NO_DISK_SPACE, "Not enough disk space for home %s", h->user_name);
 641         case -EKEYREVOKED:
 642                 return sd_bus_error_setf(error, BUS_ERROR_HOME_CANT_AUTHENTICATE, "Home %s has no password or other authentication mechanism defined.", h->user_name);
 643         case -EADDRINUSE:
 644                 return sd_bus_error_setf(error, BUS_ERROR_HOME_IN_USE, "Home %s is currently being used elsewhere.", h->user_name);
 645         }
 646
 647         return 0;
 648 }
 649
 650 static void home_count_bad_authentication(Home *h, bool save) {
 651         int r;
 652
 653         assert(h);
 654
 655         r = user_record_bad_authentication(h->record);
 656         if (r < 0) {
 657                 log_warning_errno(r, "Failed to increase bad authentication counter, ignoring: %m");
 658                 return;
 659         }
 660
 661         if (save) {
 662                 r = home_save_record(h);
 663                 if (r < 0)
 664                         log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
 665         }
 666 }
 667
 668 static void home_fixate_finish(Home *h, int ret, UserRecord *hr) {
 669         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 670         _cleanup_(user_record_unrefp) UserRecord *secret = NULL;
 671         bool signed_locally;
 672         int r;
 673
 674         assert(h);
 675         assert(IN_SET(h->state, HOME_FIXATING, HOME_FIXATING_FOR_ACTIVATION, HOME_FIXATING_FOR_ACQUIRE));
 676
 677         secret = TAKE_PTR(h->secret); /* Take possession */
 678
 679         if (ret < 0) {
 680                 if (ret == -ENOKEY)
 681                         (void) home_count_bad_authentication(h, false);
 682
 683                 (void) convert_worker_errno(h, ret, &error);
 684                 r = log_error_errno(ret, "Fixation failed: %m");
 685                 goto fail;
 686         }
 687         if (!hr) {
 688                 r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Did not receive user record from worker process, fixation failed.");
 689                 goto fail;
 690         }
 691
 692         r = home_verify_user_record(h, hr, &signed_locally, &error);
 693         if (r < 0)
 694                 goto fail;
 695
 696         r = home_set_record(h, hr);
 697         if (r < 0) {
 698                 log_error_errno(r, "Failed to update home record: %m");
 699                 goto fail;
 700         }
 701
 702         h->signed_locally = signed_locally;
 703
 704         /* When we finished fixating (and don't follow-up with activation), let's count this as good authentication */
 705         if (h->state == HOME_FIXATING) {
 706                 r = user_record_good_authentication(h->record);
 707                 if (r < 0)
 708                         log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
 709         }
 710
 711         r = home_save_record(h);
 712         if (r < 0)
 713                 log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
 714
 715         if (IN_SET(h->state, HOME_FIXATING_FOR_ACTIVATION, HOME_FIXATING_FOR_ACQUIRE)) {
 716
 717                 r = home_start_work(h, "activate", h->record, secret);
 718                 if (r < 0) {
 719                         h->current_operation = operation_result_unref(h->current_operation, r, NULL);
 720                         home_set_state(h, _HOME_STATE_INVALID);
 721                 } else
 722                         home_set_state(h, h->state == HOME_FIXATING_FOR_ACTIVATION ? HOME_ACTIVATING : HOME_ACTIVATING_FOR_ACQUIRE);
 723
 724                 return;
 725         }
 726
 727         log_debug("Fixation of %s completed.", h->user_name);
 728
 729         h->current_operation = operation_result_unref(h->current_operation, 0, NULL);
 730
 731         /* Reset the state to "invalid", which makes home_get_state() test if the image exists and returns
 732          * HOME_ABSENT vs. HOME_INACTIVE as necessary. */
 733         home_set_state(h, _HOME_STATE_INVALID);
 734         (void) manager_schedule_rebalance(h->manager, /* immediately= */ false);
 735         return;
 736
 737 fail:
 738         /* If fixation fails, we stay in unfixated state! */
 739         h->current_operation = operation_result_unref(h->current_operation, r, &error);
 740         home_set_state(h, HOME_UNFIXATED);
 741 }
 742
 743 static void home_activate_finish(Home *h, int ret, UserRecord *hr) {
 744         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 745         int r;
 746
 747         assert(h);
 748         assert(IN_SET(h->state, HOME_ACTIVATING, HOME_ACTIVATING_FOR_ACQUIRE));
 749
 750         if (ret < 0) {
 751                 if (ret == -ENOKEY)
 752                         home_count_bad_authentication(h, true);
 753
 754                 (void) convert_worker_errno(h, ret, &error);
 755                 r = log_error_errno(ret, "Activation failed: %m");
 756                 goto finish;
 757         }
 758
 759         if (hr) {
 760                 bool signed_locally;
 761
 762                 r = home_verify_user_record(h, hr, &signed_locally, &error);
 763                 if (r < 0)
 764                         goto finish;
 765
 766                 r = home_set_record(h, hr);
 767                 if (r < 0) {
 768                         log_error_errno(r, "Failed to update home record, ignoring: %m");
 769                         goto finish;
 770                 }
 771
 772                 h->signed_locally = signed_locally;
 773
 774                 r = user_record_good_authentication(h->record);
 775                 if (r < 0)
 776                         log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
 777
 778                 r = home_save_record(h);
 779                 if (r < 0)
 780                         log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
 781         }
 782
 783         log_debug("Activation of %s completed.", h->user_name);
 784         r = 0;
 785
 786 finish:
 787         h->current_operation = operation_result_unref(h->current_operation, r, &error);
 788         home_set_state(h, _HOME_STATE_INVALID);
 789
 790         if (r >= 0)
 791                 (void) manager_schedule_rebalance(h->manager, /* immediately= */ true);
 792 }
 793
 794 static void home_deactivate_finish(Home *h, int ret, UserRecord *hr) {
 795         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 796         int r;
 797
 798         assert(h);
 799         assert(h->state == HOME_DEACTIVATING);
 800         assert(!hr); /* We don't expect a record on this operation */
 801
 802         if (ret < 0) {
 803                 (void) convert_worker_errno(h, ret, &error);
 804                 r = log_error_errno(ret, "Deactivation of %s failed: %m", h->user_name);
 805                 goto finish;
 806         }
 807
 808         log_debug("Deactivation of %s completed.", h->user_name);
 809         r = 0;
 810
 811 finish:
 812         h->current_operation = operation_result_unref(h->current_operation, r, &error);
 813         home_set_state(h, _HOME_STATE_INVALID);
 814
 815         if (r >= 0)
 816                 (void) manager_schedule_rebalance(h->manager, /* immediately= */ true);
 817 }
 818
 819 static void home_remove_finish(Home *h, int ret, UserRecord *hr) {
 820         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 821         Manager *m;
 822         int r;
 823
 824         assert(h);
 825         assert(h->state == HOME_REMOVING);
 826         assert(!hr); /* We don't expect a record on this operation */
 827
 828         m = h->manager;
 829
 830         if (ret < 0 && ret != -EALREADY) {
 831                 (void) convert_worker_errno(h, ret, &error);
 832                 r = log_error_errno(ret, "Removing %s failed: %m", h->user_name);
 833                 goto fail;
 834         }
 835
 836         /* For a couple of storage types we can't delete the actual data storage when called (such as LUKS on
 837          * partitions like USB sticks, or so). Sometimes these storage locations are among those we normally
 838          * automatically discover in /home or in udev. When such a home is deleted let's hence issue a rescan
 839          * after completion, so that "unfixated" entries are rediscovered.  */
 840         if (!IN_SET(user_record_test_image_path(h->record), USER_TEST_UNDEFINED, USER_TEST_ABSENT))
 841                 manager_enqueue_rescan(m);
 842
 843         /* The image is now removed from disk. Now also remove our stored record */
 844         r = home_unlink_record(h);
 845         if (r < 0) {
 846                 log_error_errno(r, "Removing record file failed: %m");
 847                 goto fail;
 848         }
 849
 850         log_debug("Removal of %s completed.", h->user_name);
 851         h->current_operation = operation_result_unref(h->current_operation, 0, NULL);
 852
 853         /* Unload this record from memory too now. */
 854         h = home_free(h);
 855
 856         (void) manager_schedule_rebalance(m, /* immediately= */ true);
 857         return;
 858
 859 fail:
 860         h->current_operation = operation_result_unref(h->current_operation, r, &error);
 861         home_set_state(h, _HOME_STATE_INVALID);
 862 }
 863
 864 static void home_create_finish(Home *h, int ret, UserRecord *hr) {
 865         int r;
 866
 867         assert(h);
 868         assert(h->state == HOME_CREATING);
 869
 870         if (ret < 0) {
 871                 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 872
 873                 (void) convert_worker_errno(h, ret, &error);
 874                 log_error_errno(ret, "Operation on %s failed: %m", h->user_name);
 875                 h->current_operation = operation_result_unref(h->current_operation, ret, &error);
 876
 877                 if (h->unregister_on_failure) {
 878                         (void) home_unlink_record(h);
 879                         h = home_free(h);
 880                         return;
 881                 }
 882
 883                 home_set_state(h, _HOME_STATE_INVALID);
 884                 return;
 885         }
 886
 887         if (hr) {
 888                 r = home_set_record(h, hr);
 889                 if (r < 0)
 890                         log_warning_errno(r, "Failed to update home record, ignoring: %m");
 891         }
 892
 893         r = home_save_record(h);
 894         if (r < 0)
 895                 log_warning_errno(r, "Failed to save record to disk, ignoring: %m");
 896
 897         log_debug("Creation of %s completed.", h->user_name);
 898
 899         h->current_operation = operation_result_unref(h->current_operation, 0, NULL);
 900         home_set_state(h, _HOME_STATE_INVALID);
 901
 902         (void) manager_schedule_rebalance(h->manager, /* immediately= */ true);
 903 }
 904
 905 static void home_change_finish(Home *h, int ret, UserRecord *hr) {
 906         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 907         int r;
 908
 909         assert(h);
 910
 911         if (ret < 0) {
 912                 if (ret == -ENOKEY)
 913                         (void) home_count_bad_authentication(h, true);
 914
 915                 (void) convert_worker_errno(h, ret, &error);
 916                 r = log_error_errno(ret, "Change operation failed: %m");
 917                 goto finish;
 918         }
 919
 920         if (hr) {
 921                 r = home_set_record(h, hr);
 922                 if (r < 0)
 923                         log_warning_errno(r, "Failed to update home record, ignoring: %m");
 924                 else {
 925                         r = user_record_good_authentication(h->record);
 926                         if (r < 0)
 927                                 log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
 928
 929                         r = home_save_record(h);
 930                         if (r < 0)
 931                                 log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
 932                 }
 933         }
 934
 935         log_debug("Change operation of %s completed.", h->user_name);
 936         (void) manager_schedule_rebalance(h->manager, /* immediately= */ false);
 937         r = 0;
 938
 939 finish:
 940         h->current_operation = operation_result_unref(h->current_operation, r, &error);
 941         home_set_state(h, _HOME_STATE_INVALID);
 942 }
 943
 944 static void home_locking_finish(Home *h, int ret, UserRecord *hr) {
 945         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 946         int r;
 947
 948         assert(h);
 949         assert(h->state == HOME_LOCKING);
 950
 951         if (ret < 0) {
 952                 (void) convert_worker_errno(h, ret, &error);
 953                 r = log_error_errno(ret, "Locking operation failed: %m");
 954                 goto finish;
 955         }
 956
 957         log_debug("Locking operation of %s completed.", h->user_name);
 958         h->current_operation = operation_result_unref(h->current_operation, 0, NULL);
 959         home_set_state(h, HOME_LOCKED);
 960         return;
 961
 962 finish:
 963         /* If a specific home doesn't know the concept of locking, then that's totally OK, don't propagate
 964          * the error if we are executing a LockAllHomes() operation. */
 965
 966         if (h->current_operation->type == OPERATION_LOCK_ALL && r == -ENOTTY)
 967                 h->current_operation = operation_result_unref(h->current_operation, 0, NULL);
 968         else
 969                 h->current_operation = operation_result_unref(h->current_operation, r, &error);
 970
 971         home_set_state(h, _HOME_STATE_INVALID);
 972 }
 973
 974 static void home_unlocking_finish(Home *h, int ret, UserRecord *hr) {
 975         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 976         int r;
 977
 978         assert(h);
 979         assert(IN_SET(h->state, HOME_UNLOCKING, HOME_UNLOCKING_FOR_ACQUIRE));
 980
 981         if (ret < 0) {
 982                 if (ret == -ENOKEY)
 983                         (void) home_count_bad_authentication(h, true);
 984
 985                 (void) convert_worker_errno(h, ret, &error);
 986                 r = log_error_errno(ret, "Unlocking operation failed: %m");
 987
 988                 /* Revert to locked state */
 989                 home_set_state(h, HOME_LOCKED);
 990                 h->current_operation = operation_result_unref(h->current_operation, r, &error);
 991                 return;
 992         }
 993
 994         r = user_record_good_authentication(h->record);
 995         if (r < 0)
 996                 log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
 997         else {
 998                 r = home_save_record(h);
 999                 if (r < 0)
1000                         log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
1001         }
1002
1003         log_debug("Unlocking operation of %s completed.", h->user_name);
1004
1005         h->current_operation = operation_result_unref(h->current_operation, r, &error);
1006         home_set_state(h, _HOME_STATE_INVALID);
1007         return;
1008 }
1009
1010 static void home_authenticating_finish(Home *h, int ret, UserRecord *hr) {
1011         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1012         int r;
1013
1014         assert(h);
1015         assert(IN_SET(h->state, HOME_AUTHENTICATING, HOME_AUTHENTICATING_WHILE_ACTIVE, HOME_AUTHENTICATING_FOR_ACQUIRE));
1016
1017         if (ret < 0) {
1018                 if (ret == -ENOKEY)
1019                         (void) home_count_bad_authentication(h, true);
1020
1021                 (void) convert_worker_errno(h, ret, &error);
1022                 r = log_error_errno(ret, "Authentication failed: %m");
1023                 goto finish;
1024         }
1025
1026         if (hr) {
1027                 r = home_set_record(h, hr);
1028                 if (r < 0)
1029                         log_warning_errno(r, "Failed to update home record, ignoring: %m");
1030                 else {
1031                         r = user_record_good_authentication(h->record);
1032                         if (r < 0)
1033                                 log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
1034
1035                         r = home_save_record(h);
1036                         if (r < 0)
1037                                 log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
1038                 }
1039         }
1040
1041         log_debug("Authentication of %s completed.", h->user_name);
1042         r = 0;
1043
1044 finish:
1045         h->current_operation = operation_result_unref(h->current_operation, r, &error);
1046         home_set_state(h, _HOME_STATE_INVALID);
1047 }
1048
1049 static int home_on_worker_process(sd_event_source *s, const siginfo_t *si, void *userdata) {
1050         _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
1051         Home *h = userdata;
1052         int ret;
1053
1054         assert(s);
1055         assert(si);
1056         assert(h);
1057
1058         assert(h->worker_pid == si->si_pid);
1059         assert(h->worker_event_source);
1060         assert(h->worker_stdout_fd >= 0);
1061
1062         (void) hashmap_remove_value(h->manager->homes_by_worker_pid, PID_TO_PTR(h->worker_pid), h);
1063
1064         h->worker_pid = 0;
1065         h->worker_event_source = sd_event_source_disable_unref(h->worker_event_source);
1066
1067         if (si->si_code != CLD_EXITED) {
1068                 assert(IN_SET(si->si_code, CLD_KILLED, CLD_DUMPED));
1069                 ret = log_debug_errno(SYNTHETIC_ERRNO(EPROTO), "Worker process died abnormally with signal %s.", signal_to_string(si->si_status));
1070         } else if (si->si_status != EXIT_SUCCESS) {
1071                 /* If we received an error code via sd_notify(), use it */
1072                 if (h->worker_error_code != 0)
1073                         ret = log_debug_errno(h->worker_error_code, "Worker reported error code %s.", errno_to_name(h->worker_error_code));
1074                 else
1075                         ret = log_debug_errno(SYNTHETIC_ERRNO(EPROTO), "Worker exited with exit code %i.", si->si_status);
1076         } else
1077                 ret = home_parse_worker_stdout(TAKE_FD(h->worker_stdout_fd), &hr);
1078
1079         h->worker_stdout_fd = safe_close(h->worker_stdout_fd);
1080
1081         switch (h->state) {
1082
1083         case HOME_FIXATING:
1084         case HOME_FIXATING_FOR_ACTIVATION:
1085         case HOME_FIXATING_FOR_ACQUIRE:
1086                 home_fixate_finish(h, ret, hr);
1087                 break;
1088
1089         case HOME_ACTIVATING:
1090         case HOME_ACTIVATING_FOR_ACQUIRE:
1091                 home_activate_finish(h, ret, hr);
1092                 break;
1093
1094         case HOME_DEACTIVATING:
1095                 home_deactivate_finish(h, ret, hr);
1096                 break;
1097
1098         case HOME_LOCKING:
1099                 home_locking_finish(h, ret, hr);
1100                 break;
1101
1102         case HOME_UNLOCKING:
1103         case HOME_UNLOCKING_FOR_ACQUIRE:
1104                 home_unlocking_finish(h, ret, hr);
1105                 break;
1106
1107         case HOME_CREATING:
1108                 home_create_finish(h, ret, hr);
1109                 break;
1110
1111         case HOME_REMOVING:
1112                 home_remove_finish(h, ret, hr);
1113                 break;
1114
1115         case HOME_UPDATING:
1116         case HOME_UPDATING_WHILE_ACTIVE:
1117         case HOME_RESIZING:
1118         case HOME_RESIZING_WHILE_ACTIVE:
1119         case HOME_PASSWD:
1120         case HOME_PASSWD_WHILE_ACTIVE:
1121                 home_change_finish(h, ret, hr);
1122                 break;
1123
1124         case HOME_AUTHENTICATING:
1125         case HOME_AUTHENTICATING_WHILE_ACTIVE:
1126         case HOME_AUTHENTICATING_FOR_ACQUIRE:
1127                 home_authenticating_finish(h, ret, hr);
1128                 break;
1129
1130         default:
1131                 assert_not_reached();
1132         }
1133
1134         return 0;
1135 }
1136
1137 static int home_start_work(Home *h, const char *verb, UserRecord *hr, UserRecord *secret) {
1138         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
1139         _cleanup_(erase_and_freep) char *formatted = NULL;
1140         _cleanup_close_ int stdin_fd = -1, stdout_fd = -1;
1141         pid_t pid = 0;
1142         int r;
1143
1144         assert(h);
1145         assert(verb);
1146         assert(hr);
1147
1148         if (h->worker_pid != 0)
1149                 return -EBUSY;
1150
1151         assert(h->worker_stdout_fd < 0);
1152         assert(!h->worker_event_source);
1153
1154         v = json_variant_ref(hr->json);
1155
1156         if (secret) {
1157                 JsonVariant *sub = NULL;
1158
1159                 sub = json_variant_by_key(secret->json, "secret");
1160                 if (!sub)
1161                         return -ENOKEY;
1162
1163                 r = json_variant_set_field(&v, "secret", sub);
1164                 if (r < 0)
1165                         return r;
1166         }
1167
1168         r = json_variant_format(v, 0, &formatted);
1169         if (r < 0)
1170                 return r;
1171
1172         stdin_fd = acquire_data_fd(formatted, strlen(formatted), 0);
1173         if (stdin_fd < 0)
1174                 return stdin_fd;
1175
1176         log_debug("Sending to worker: %s", formatted);
1177
1178         stdout_fd = memfd_create("homework-stdout", MFD_CLOEXEC);
1179         if (stdout_fd < 0)
1180                 return -errno;
1181
1182         r = safe_fork_full("(sd-homework)",
1183                            (int[]) { stdin_fd, stdout_fd }, 2,
1184                            FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG|FORK_LOG|FORK_REOPEN_LOG, &pid);
1185         if (r < 0)
1186                 return r;
1187         if (r == 0) {
1188                 const char *homework, *suffix, *unix_path;
1189
1190                 /* Child */
1191
1192                 suffix = getenv("SYSTEMD_HOME_DEBUG_SUFFIX");
1193                 if (suffix)
1194                         unix_path = strjoina("/run/systemd/home/notify.", suffix);
1195                 else
1196                         unix_path = "/run/systemd/home/notify";
1197
1198                 if (setenv("NOTIFY_SOCKET", unix_path, 1) < 0) {
1199                         log_error_errno(errno, "Failed to set $NOTIFY_SOCKET: %m");
1200                         _exit(EXIT_FAILURE);
1201                 }
1202
1203                 /* If we haven't locked the device yet, ask for a lock to be taken and be passed back to us via sd_notify(). */
1204                 if (setenv("SYSTEMD_LUKS_LOCK", one_zero(h->luks_lock_fd < 0), 1) < 0) {
1205                         log_error_errno(errno, "Failed to set $SYSTEMD_LUKS_LOCK: %m");
1206                         _exit(EXIT_FAILURE);
1207                 }
1208
1209                 if (h->manager->default_storage >= 0)
1210                         if (setenv("SYSTEMD_HOME_DEFAULT_STORAGE", user_storage_to_string(h->manager->default_storage), 1) < 0) {
1211                                 log_error_errno(errno, "Failed to set $SYSTEMD_HOME_DEFAULT_STORAGE: %m");
1212                                 _exit(EXIT_FAILURE);
1213                         }
1214
1215                 if (h->manager->default_file_system_type)
1216                         if (setenv("SYSTEMD_HOME_DEFAULT_FILE_SYSTEM_TYPE", h->manager->default_file_system_type, 1) < 0) {
1217                                 log_error_errno(errno, "Failed to set $SYSTEMD_HOME_DEFAULT_FILE_SYSTEM_TYPE: %m");
1218                                 _exit(EXIT_FAILURE);
1219                         }
1220
1221                 r = setenv_systemd_exec_pid(true);
1222                 if (r < 0)
1223                         log_warning_errno(r, "Failed to update $SYSTEMD_EXEC_PID, ignoring: %m");
1224
1225                 r = rearrange_stdio(TAKE_FD(stdin_fd), TAKE_FD(stdout_fd), STDERR_FILENO); /* fds are invalidated by rearrange_stdio() even on failure */
1226                 if (r < 0) {
1227                         log_error_errno(r, "Failed to rearrange stdin/stdout/stderr: %m");
1228                         _exit(EXIT_FAILURE);
1229                 }
1230
1231
1232                 /* Allow overriding the homework path via an environment variable, to make debugging
1233                  * easier. */
1234                 homework = getenv("SYSTEMD_HOMEWORK_PATH") ?: SYSTEMD_HOMEWORK_PATH;
1235
1236                 execl(homework, homework, verb, NULL);
1237                 log_error_errno(errno, "Failed to invoke %s: %m", homework);
1238                 _exit(EXIT_FAILURE);
1239         }
1240
1241         r = sd_event_add_child(h->manager->event, &h->worker_event_source, pid, WEXITED, home_on_worker_process, h);
1242         if (r < 0)
1243                 return r;
1244
1245         (void) sd_event_source_set_description(h->worker_event_source, "worker");
1246
1247         r = hashmap_put(h->manager->homes_by_worker_pid, PID_TO_PTR(pid), h);
1248         if (r < 0) {
1249                 h->worker_event_source = sd_event_source_disable_unref(h->worker_event_source);
1250                 return r;
1251         }
1252
1253         h->worker_stdout_fd = TAKE_FD(stdout_fd);
1254         h->worker_pid = pid;
1255         h->worker_error_code = 0;
1256
1257         return 0;
1258 }
1259
1260 static int home_ratelimit(Home *h, sd_bus_error *error) {
1261         int r, ret;
1262
1263         assert(h);
1264
1265         ret = user_record_ratelimit(h->record);
1266         if (ret < 0)
1267                 return ret;
1268
1269         if (h->state != HOME_UNFIXATED) {
1270                 r = home_save_record(h);
1271                 if (r < 0)
1272                         log_warning_errno(r, "Failed to save updated record, ignoring: %m");
1273         }
1274
1275         if (ret == 0) {
1276                 usec_t t, n;
1277
1278                 n = now(CLOCK_REALTIME);
1279                 t = user_record_ratelimit_next_try(h->record);
1280
1281                 if (t != USEC_INFINITY && t > n)
1282                         return sd_bus_error_setf(error, BUS_ERROR_AUTHENTICATION_LIMIT_HIT,
1283                                                  "Too many login attempts, please try again in %s!",
1284                                                  FORMAT_TIMESPAN(t - n, USEC_PER_SEC));
1285
1286                 return sd_bus_error_set(error, BUS_ERROR_AUTHENTICATION_LIMIT_HIT, "Too many login attempts, please try again later.");
1287         }
1288
1289         return 0;
1290 }
1291
1292 static int home_fixate_internal(
1293                 Home *h,
1294                 UserRecord *secret,
1295                 HomeState for_state,
1296                 sd_bus_error *error) {
1297
1298         int r;
1299
1300         assert(h);
1301         assert(IN_SET(for_state, HOME_FIXATING, HOME_FIXATING_FOR_ACTIVATION, HOME_FIXATING_FOR_ACQUIRE));
1302
1303         r = home_start_work(h, "inspect", h->record, secret);
1304         if (r < 0)
1305                 return r;
1306
1307         if (IN_SET(for_state, HOME_FIXATING_FOR_ACTIVATION, HOME_FIXATING_FOR_ACQUIRE)) {
1308                 /* Remember the secret data, since we need it for the activation again, later on. */
1309                 user_record_unref(h->secret);
1310                 h->secret = user_record_ref(secret);
1311         }
1312
1313         home_set_state(h, for_state);
1314         return 0;
1315 }
1316
1317 int home_fixate(Home *h, UserRecord *secret, sd_bus_error *error) {
1318         int r;
1319
1320         assert(h);
1321
1322         switch (home_get_state(h)) {
1323         case HOME_ABSENT:
1324                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1325         case HOME_INACTIVE:
1326         case HOME_DIRTY:
1327         case HOME_ACTIVE:
1328         case HOME_LINGERING:
1329         case HOME_LOCKED:
1330                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ALREADY_FIXATED, "Home %s is already fixated.", h->user_name);
1331         case HOME_UNFIXATED:
1332                 break;
1333         default:
1334                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1335         }
1336
1337         r = home_ratelimit(h, error);
1338         if (r < 0)
1339                 return r;
1340
1341         return home_fixate_internal(h, secret, HOME_FIXATING, error);
1342 }
1343
1344 static int home_activate_internal(Home *h, UserRecord *secret, HomeState for_state, sd_bus_error *error) {
1345         int r;
1346
1347         assert(h);
1348         assert(IN_SET(for_state, HOME_ACTIVATING, HOME_ACTIVATING_FOR_ACQUIRE));
1349
1350         r = home_start_work(h, "activate", h->record, secret);
1351         if (r < 0)
1352                 return r;
1353
1354         home_set_state(h, for_state);
1355         return 0;
1356 }
1357
1358 int home_activate(Home *h, UserRecord *secret, sd_bus_error *error) {
1359         int r;
1360
1361         assert(h);
1362
1363         switch (home_get_state(h)) {
1364         case HOME_UNFIXATED:
1365                 return home_fixate_internal(h, secret, HOME_FIXATING_FOR_ACTIVATION, error);
1366         case HOME_ABSENT:
1367                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1368         case HOME_ACTIVE:
1369                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ALREADY_ACTIVE, "Home %s is already active.", h->user_name);
1370         case HOME_LINGERING:
1371                 /* If we are lingering, i.e. active but are supposed to be deactivated, then cancel this
1372                  * timer if the user explicitly asks us to be active */
1373                 h->retry_deactivate_event_source = sd_event_source_disable_unref(h->retry_deactivate_event_source);
1374                 return 0;
1375         case HOME_LOCKED:
1376                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1377         case HOME_INACTIVE:
1378         case HOME_DIRTY:
1379                 break;
1380         default:
1381                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1382         }
1383
1384         r = home_ratelimit(h, error);
1385         if (r < 0)
1386                 return r;
1387
1388         return home_activate_internal(h, secret, HOME_ACTIVATING, error);
1389 }
1390
1391 static int home_authenticate_internal(Home *h, UserRecord *secret, HomeState for_state, sd_bus_error *error) {
1392         int r;
1393
1394         assert(h);
1395         assert(IN_SET(for_state, HOME_AUTHENTICATING, HOME_AUTHENTICATING_WHILE_ACTIVE, HOME_AUTHENTICATING_FOR_ACQUIRE));
1396
1397         r = home_start_work(h, "inspect", h->record, secret);
1398         if (r < 0)
1399                 return r;
1400
1401         home_set_state(h, for_state);
1402         return 0;
1403 }
1404
1405 int home_authenticate(Home *h, UserRecord *secret, sd_bus_error *error) {
1406         HomeState state;
1407         int r;
1408
1409         assert(h);
1410
1411         state = home_get_state(h);
1412         switch (state) {
1413         case HOME_ABSENT:
1414                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1415         case HOME_LOCKED:
1416                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1417         case HOME_UNFIXATED:
1418         case HOME_INACTIVE:
1419         case HOME_DIRTY:
1420         case HOME_ACTIVE:
1421         case HOME_LINGERING:
1422                 break;
1423         default:
1424                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1425         }
1426
1427         r = home_ratelimit(h, error);
1428         if (r < 0)
1429                 return r;
1430
1431         return home_authenticate_internal(h, secret, HOME_STATE_IS_ACTIVE(state) ? HOME_AUTHENTICATING_WHILE_ACTIVE : HOME_AUTHENTICATING, error);
1432 }
1433
1434 static int home_deactivate_internal(Home *h, bool force, sd_bus_error *error) {
1435         int r;
1436
1437         assert(h);
1438
1439         home_unpin(h); /* unpin so that we can deactivate */
1440
1441         r = home_start_work(h, force ? "deactivate-force" : "deactivate", h->record, NULL);
1442         if (r < 0)
1443                 /* Operation failed before it even started, reacquire pin fd, if state still dictates so */
1444                 home_update_pin_fd(h, _HOME_STATE_INVALID);
1445         else {
1446                 home_set_state(h, HOME_DEACTIVATING);
1447                 r = 0;
1448         }
1449
1450         /* Let's start a timer to retry deactivation in 15. We'll stop the timer once we manage to deactivate
1451          * the home directory again, or we we start any other operation. */
1452         home_start_retry_deactivate(h);
1453
1454         return r;
1455 }
1456
1457 int home_deactivate(Home *h, bool force, sd_bus_error *error) {
1458         assert(h);
1459
1460         switch (home_get_state(h)) {
1461         case HOME_UNFIXATED:
1462         case HOME_ABSENT:
1463         case HOME_INACTIVE:
1464         case HOME_DIRTY:
1465                 return sd_bus_error_setf(error, BUS_ERROR_HOME_NOT_ACTIVE, "Home %s not active.", h->user_name);
1466         case HOME_LOCKED:
1467                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1468         case HOME_ACTIVE:
1469         case HOME_LINGERING:
1470                 break;
1471         default:
1472                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1473         }
1474
1475         return home_deactivate_internal(h, force, error);
1476 }
1477
1478 int home_create(Home *h, UserRecord *secret, sd_bus_error *error) {
1479         int r;
1480
1481         assert(h);
1482
1483         switch (home_get_state(h)) {
1484         case HOME_INACTIVE: {
1485                 int t;
1486
1487                 if (h->record->storage < 0)
1488                         break; /* if no storage is defined we don't know what precisely to look for, hence
1489                                 * HOME_INACTIVE is OK in that case too. */
1490
1491                 t = user_record_test_image_path(h->record);
1492                 if (IN_SET(t, USER_TEST_MAYBE, USER_TEST_UNDEFINED))
1493                         break; /* And if the image path test isn't conclusive, let's also go on */
1494
1495                 if (IN_SET(t, -EBADFD, -ENOTDIR))
1496                         return sd_bus_error_setf(error, BUS_ERROR_HOME_EXISTS, "Selected home image of user %s already exists or has wrong inode type.", h->user_name);
1497
1498                 return sd_bus_error_setf(error, BUS_ERROR_HOME_EXISTS, "Selected home image of user %s already exists.", h->user_name);
1499         }
1500         case HOME_UNFIXATED:
1501         case HOME_DIRTY:
1502                 return sd_bus_error_setf(error, BUS_ERROR_HOME_EXISTS, "Home of user %s already exists.", h->user_name);
1503         case HOME_ABSENT:
1504                 break;
1505         case HOME_ACTIVE:
1506         case HOME_LINGERING:
1507         case HOME_LOCKED:
1508         default:
1509                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "Home %s is currently being used, or an operation on home %s is currently being executed.", h->user_name, h->user_name);
1510         }
1511
1512         if (h->record->enforce_password_policy == false)
1513                 log_debug("Password quality check turned off for account, skipping.");
1514         else {
1515                 r = user_record_quality_check_password(h->record, secret, error);
1516                 if (r < 0)
1517                         return r;
1518         }
1519
1520         r = home_start_work(h, "create", h->record, secret);
1521         if (r < 0)
1522                 return r;
1523
1524         home_set_state(h, HOME_CREATING);
1525         return 0;
1526 }
1527
1528 int home_remove(Home *h, sd_bus_error *error) {
1529         HomeState state;
1530         int r;
1531
1532         assert(h);
1533
1534         state = home_get_state(h);
1535         switch (state) {
1536         case HOME_ABSENT: /* If the home directory is absent, then this is just like unregistering */
1537                 return home_unregister(h, error);
1538         case HOME_LOCKED:
1539                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1540         case HOME_UNFIXATED:
1541         case HOME_INACTIVE:
1542         case HOME_DIRTY:
1543                 break;
1544         case HOME_ACTIVE:
1545         case HOME_LINGERING:
1546         default:
1547                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "Home %s is currently being used, or an operation on home %s is currently being executed.", h->user_name, h->user_name);
1548         }
1549
1550         r = home_start_work(h, "remove", h->record, NULL);
1551         if (r < 0)
1552                 return r;
1553
1554         home_set_state(h, HOME_REMOVING);
1555         return 0;
1556 }
1557
1558 static int user_record_extend_with_binding(UserRecord *hr, UserRecord *with_binding, UserRecordLoadFlags flags, UserRecord **ret) {
1559         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
1560         _cleanup_(user_record_unrefp) UserRecord *nr = NULL;
1561         JsonVariant *binding;
1562         int r;
1563
1564         assert(hr);
1565         assert(with_binding);
1566         assert(ret);
1567
1568         assert_se(v = json_variant_ref(hr->json));
1569
1570         binding = json_variant_by_key(with_binding->json, "binding");
1571         if (binding) {
1572                 r = json_variant_set_field(&v, "binding", binding);
1573                 if (r < 0)
1574                         return r;
1575         }
1576
1577         nr = user_record_new();
1578         if (!nr)
1579                 return -ENOMEM;
1580
1581         r = user_record_load(nr, v, flags);
1582         if (r < 0)
1583                 return r;
1584
1585         *ret = TAKE_PTR(nr);
1586         return 0;
1587 }
1588
1589 static int home_update_internal(
1590                 Home *h,
1591                 const char *verb,
1592                 UserRecord *hr,
1593                 UserRecord *secret,
1594                 sd_bus_error *error) {
1595
1596         _cleanup_(user_record_unrefp) UserRecord *new_hr = NULL, *saved_secret = NULL, *signed_hr = NULL;
1597         int r, c;
1598
1599         assert(h);
1600         assert(verb);
1601         assert(hr);
1602
1603         if (!user_record_compatible(hr, h->record))
1604                 return sd_bus_error_set(error, BUS_ERROR_HOME_RECORD_MISMATCH, "Updated user record is not compatible with existing one.");
1605         c = user_record_compare_last_change(hr, h->record); /* refuse downgrades */
1606         if (c < 0)
1607                 return sd_bus_error_set(error, BUS_ERROR_HOME_RECORD_DOWNGRADE, "Refusing to update to older home record.");
1608
1609         if (!secret && FLAGS_SET(hr->mask, USER_RECORD_SECRET)) {
1610                 r = user_record_clone(hr, USER_RECORD_EXTRACT_SECRET|USER_RECORD_PERMISSIVE, &saved_secret);
1611                 if (r < 0)
1612                         return r;
1613
1614                 secret = saved_secret;
1615         }
1616
1617         r = manager_verify_user_record(h->manager, hr);
1618         switch (r) {
1619
1620         case USER_RECORD_UNSIGNED:
1621                 if (h->signed_locally <= 0) /* If the existing record is not owned by us, don't accept an
1622                                              * unsigned new record. i.e. only implicitly sign new records
1623                                              * that where previously signed by us too. */
1624                         return sd_bus_error_setf(error, BUS_ERROR_HOME_RECORD_SIGNED, "Home %s is signed and cannot be modified locally.", h->user_name);
1625
1626                 /* The updated record is not signed, then do so now */
1627                 r = manager_sign_user_record(h->manager, hr, &signed_hr, error);
1628                 if (r < 0)
1629                         return r;
1630
1631                 hr = signed_hr;
1632                 break;
1633
1634         case USER_RECORD_SIGNED_EXCLUSIVE:
1635         case USER_RECORD_SIGNED:
1636         case USER_RECORD_FOREIGN:
1637                 /* Has already been signed. Great! */
1638                 break;
1639
1640         case -ENOKEY:
1641         default:
1642                 return r;
1643         }
1644
1645         r = user_record_extend_with_binding(hr, h->record, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_PERMISSIVE, &new_hr);
1646         if (r < 0)
1647                 return r;
1648
1649         if (c == 0) {
1650                 /* different payload but same lastChangeUSec field? That's not cool! */
1651
1652                 r = user_record_masked_equal(new_hr, h->record, USER_RECORD_REGULAR|USER_RECORD_PRIVILEGED|USER_RECORD_PER_MACHINE);
1653                 if (r < 0)
1654                         return r;
1655                 if (r == 0)
1656                         return sd_bus_error_set(error, BUS_ERROR_HOME_RECORD_MISMATCH, "Home record different but timestamp remained the same, refusing.");
1657         }
1658
1659         r = home_start_work(h, verb, new_hr, secret);
1660         if (r < 0)
1661                 return r;
1662
1663         return 0;
1664 }
1665
1666 int home_update(Home *h, UserRecord *hr, sd_bus_error *error) {
1667         HomeState state;
1668         int r;
1669
1670         assert(h);
1671         assert(hr);
1672
1673         state = home_get_state(h);
1674         switch (state) {
1675         case HOME_UNFIXATED:
1676                 return sd_bus_error_setf(error, BUS_ERROR_HOME_UNFIXATED, "Home %s has not been fixated yet.", h->user_name);
1677         case HOME_ABSENT:
1678                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1679         case HOME_LOCKED:
1680                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1681         case HOME_INACTIVE:
1682         case HOME_DIRTY:
1683         case HOME_ACTIVE:
1684         case HOME_LINGERING:
1685                 break;
1686         default:
1687                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1688         }
1689
1690         r = home_ratelimit(h, error);
1691         if (r < 0)
1692                 return r;
1693
1694         r = home_update_internal(h, "update", hr, NULL, error);
1695         if (r < 0)
1696                 return r;
1697
1698         home_set_state(h, HOME_STATE_IS_ACTIVE(state) ? HOME_UPDATING_WHILE_ACTIVE : HOME_UPDATING);
1699         return 0;
1700 }
1701
1702 int home_resize(Home *h,
1703                 uint64_t disk_size,
1704                 UserRecord *secret,
1705                 bool automatic,
1706                 sd_bus_error *error) {
1707
1708         _cleanup_(user_record_unrefp) UserRecord *c = NULL;
1709         HomeState state;
1710         int r;
1711
1712         assert(h);
1713
1714         state = home_get_state(h);
1715         switch (state) {
1716         case HOME_UNFIXATED:
1717                 return sd_bus_error_setf(error, BUS_ERROR_HOME_UNFIXATED, "Home %s has not been fixated yet.", h->user_name);
1718         case HOME_ABSENT:
1719                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1720         case HOME_LOCKED:
1721                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1722         case HOME_INACTIVE:
1723         case HOME_DIRTY:
1724         case HOME_ACTIVE:
1725         case HOME_LINGERING:
1726                 break;
1727         default:
1728                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1729         }
1730
1731         r = home_ratelimit(h, error);
1732         if (r < 0)
1733                 return r;
1734
1735         /* If the user didn't specify any size explicitly and rebalancing is on, then the disk size is
1736          * determined by automatic rebalancing and hence not user configured but determined by us and thus
1737          * applied anyway. */
1738         if (disk_size == UINT64_MAX && h->record->rebalance_weight != REBALANCE_WEIGHT_OFF)
1739                 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Disk size is being determined by automatic disk space rebalancing.");
1740
1741         if (disk_size == UINT64_MAX || disk_size == h->record->disk_size) {
1742                 if (h->record->disk_size == UINT64_MAX)
1743                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "No disk size to resize to specified.");
1744
1745                 c = user_record_ref(h->record); /* Shortcut if size is unspecified or matches the record */
1746         } else {
1747                 _cleanup_(user_record_unrefp) UserRecord *signed_c = NULL;
1748
1749                 if (h->signed_locally <= 0) /* Don't allow changing of records not signed only by us */
1750                         return sd_bus_error_setf(error, BUS_ERROR_HOME_RECORD_SIGNED, "Home %s is signed and cannot be modified locally.", h->user_name);
1751
1752                 r = user_record_clone(h->record, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE, &c);
1753                 if (r < 0)
1754                         return r;
1755
1756                 r = user_record_set_disk_size(c, disk_size);
1757                 if (r == -ERANGE)
1758                         return sd_bus_error_setf(error, BUS_ERROR_BAD_HOME_SIZE, "Requested size for home %s out of acceptable range.", h->user_name);
1759                 if (r < 0)
1760                         return r;
1761
1762                 /* If user picked an explicit size, then turn off rebalancing, so that we don't undo what user chose */
1763                 r = user_record_set_rebalance_weight(c, REBALANCE_WEIGHT_OFF);
1764                 if (r < 0)
1765                         return r;
1766
1767                 r = user_record_update_last_changed(c, false);
1768                 if (r == -ECHRNG)
1769                         return sd_bus_error_setf(error, BUS_ERROR_HOME_RECORD_MISMATCH, "Record last change time of %s is newer than current time, cannot update.", h->user_name);
1770                 if (r < 0)
1771                         return r;
1772
1773                 r = manager_sign_user_record(h->manager, c, &signed_c, error);
1774                 if (r < 0)
1775                         return r;
1776
1777                 user_record_unref(c);
1778                 c = TAKE_PTR(signed_c);
1779         }
1780
1781         r = home_update_internal(h, automatic ? "resize-auto" : "resize", c, secret, error);
1782         if (r < 0)
1783                 return r;
1784
1785         home_set_state(h, HOME_STATE_IS_ACTIVE(state) ? HOME_RESIZING_WHILE_ACTIVE : HOME_RESIZING);
1786         return 0;
1787 }
1788
1789 static int home_may_change_password(
1790                 Home *h,
1791                 sd_bus_error *error) {
1792
1793         int r;
1794
1795         assert(h);
1796
1797         r = user_record_test_password_change_required(h->record);
1798         if (IN_SET(r, -EKEYREVOKED, -EOWNERDEAD, -EKEYEXPIRED, -ESTALE))
1799                 return 0; /* expired in some form, but changing is allowed */
1800         if (IN_SET(r, -EKEYREJECTED, -EROFS))
1801                 return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Expiration settings of account %s do not allow changing of password.", h->user_name);
1802         if (r < 0)
1803                 return log_error_errno(r, "Failed to test password expiry: %m");
1804
1805         return 0; /* not expired */
1806 }
1807
1808 int home_passwd(Home *h,
1809                 UserRecord *new_secret,
1810                 UserRecord *old_secret,
1811                 sd_bus_error *error) {
1812
1813         _cleanup_(user_record_unrefp) UserRecord *c = NULL, *merged_secret = NULL, *signed_c = NULL;
1814         HomeState state;
1815         int r;
1816
1817         assert(h);
1818
1819         if (h->signed_locally <= 0) /* Don't allow changing of records not signed only by us */
1820                 return sd_bus_error_setf(error, BUS_ERROR_HOME_RECORD_SIGNED, "Home %s is signed and cannot be modified locally.", h->user_name);
1821
1822         state = home_get_state(h);
1823         switch (state) {
1824         case HOME_UNFIXATED:
1825                 return sd_bus_error_setf(error, BUS_ERROR_HOME_UNFIXATED, "Home %s has not been fixated yet.", h->user_name);
1826         case HOME_ABSENT:
1827                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1828         case HOME_LOCKED:
1829                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1830         case HOME_INACTIVE:
1831         case HOME_DIRTY:
1832         case HOME_ACTIVE:
1833         case HOME_LINGERING:
1834                 break;
1835         default:
1836                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1837         }
1838
1839         r = home_ratelimit(h, error);
1840         if (r < 0)
1841                 return r;
1842
1843         r = home_may_change_password(h, error);
1844         if (r < 0)
1845                 return r;
1846
1847         r = user_record_clone(h->record, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE, &c);
1848         if (r < 0)
1849                 return r;
1850
1851         merged_secret = user_record_new();
1852         if (!merged_secret)
1853                 return -ENOMEM;
1854
1855         r = user_record_merge_secret(merged_secret, old_secret);
1856         if (r < 0)
1857                 return r;
1858
1859         r = user_record_merge_secret(merged_secret, new_secret);
1860         if (r < 0)
1861                 return r;
1862
1863         if (!strv_isempty(new_secret->password)) {
1864                 /* Update the password only if one is specified, otherwise let's just reuse the old password
1865                  * data. This is useful as a way to propagate updated user records into the LUKS backends
1866                  * properly. */
1867
1868                 r = user_record_make_hashed_password(c, new_secret->password, /* extend = */ false);
1869                 if (r < 0)
1870                         return r;
1871
1872                 r = user_record_set_password_change_now(c, -1 /* remove */);
1873                 if (r < 0)
1874                         return r;
1875         }
1876
1877         r = user_record_update_last_changed(c, true);
1878         if (r == -ECHRNG)
1879                 return sd_bus_error_setf(error, BUS_ERROR_HOME_RECORD_MISMATCH, "Record last change time of %s is newer than current time, cannot update.", h->user_name);
1880         if (r < 0)
1881                 return r;
1882
1883         r = manager_sign_user_record(h->manager, c, &signed_c, error);
1884         if (r < 0)
1885                 return r;
1886
1887         if (c->enforce_password_policy == false)
1888                 log_debug("Password quality check turned off for account, skipping.");
1889         else {
1890                 r = user_record_quality_check_password(c, merged_secret, error);
1891                 if (r < 0)
1892                         return r;
1893         }
1894
1895         r = home_update_internal(h, "passwd", signed_c, merged_secret, error);
1896         if (r < 0)
1897                 return r;
1898
1899         home_set_state(h, HOME_STATE_IS_ACTIVE(state) ? HOME_PASSWD_WHILE_ACTIVE : HOME_PASSWD);
1900         return 0;
1901 }
1902
1903 int home_unregister(Home *h, sd_bus_error *error) {
1904         int r;
1905
1906         assert(h);
1907
1908         switch (home_get_state(h)) {
1909         case HOME_UNFIXATED:
1910                 return sd_bus_error_setf(error, BUS_ERROR_HOME_UNFIXATED, "Home %s is not registered.", h->user_name);
1911         case HOME_LOCKED:
1912                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1913         case HOME_ABSENT:
1914         case HOME_INACTIVE:
1915         case HOME_DIRTY:
1916                 break;
1917         case HOME_ACTIVE:
1918         case HOME_LINGERING:
1919         default:
1920                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "Home %s is currently being used, or an operation on home %s is currently being executed.", h->user_name, h->user_name);
1921         }
1922
1923         r = home_unlink_record(h);
1924         if (r < 0)
1925                 return r;
1926
1927         /* And destroy the whole entry. The caller needs to be prepared for that. */
1928         h = home_free(h);
1929         return 1;
1930 }
1931
1932 int home_lock(Home *h, sd_bus_error *error) {
1933         int r;
1934
1935         assert(h);
1936
1937         switch (home_get_state(h)) {
1938         case HOME_UNFIXATED:
1939         case HOME_ABSENT:
1940         case HOME_INACTIVE:
1941         case HOME_DIRTY:
1942                 return sd_bus_error_setf(error, BUS_ERROR_HOME_NOT_ACTIVE, "Home %s is not active.", h->user_name);
1943         case HOME_LOCKED:
1944                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is already locked.", h->user_name);
1945         case HOME_ACTIVE:
1946         case HOME_LINGERING:
1947                 break;
1948         default:
1949                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1950         }
1951
1952         r = home_start_work(h, "lock", h->record, NULL);
1953         if (r < 0)
1954                 return r;
1955
1956         home_set_state(h, HOME_LOCKING);
1957         return 0;
1958 }
1959
1960 static int home_unlock_internal(Home *h, UserRecord *secret, HomeState for_state, sd_bus_error *error) {
1961         int r;
1962
1963         assert(h);
1964         assert(IN_SET(for_state, HOME_UNLOCKING, HOME_UNLOCKING_FOR_ACQUIRE));
1965
1966         r = home_start_work(h, "unlock", h->record, secret);
1967         if (r < 0)
1968                 return r;
1969
1970         home_set_state(h, for_state);
1971         return 0;
1972 }
1973
1974 int home_unlock(Home *h, UserRecord *secret, sd_bus_error *error) {
1975         int r;
1976         assert(h);
1977
1978         r = home_ratelimit(h, error);
1979         if (r < 0)
1980                 return r;
1981
1982         switch (home_get_state(h)) {
1983         case HOME_UNFIXATED:
1984         case HOME_ABSENT:
1985         case HOME_INACTIVE:
1986         case HOME_ACTIVE:
1987         case HOME_LINGERING:
1988         case HOME_DIRTY:
1989                 return sd_bus_error_setf(error, BUS_ERROR_HOME_NOT_LOCKED, "Home %s is not locked.", h->user_name);
1990         case HOME_LOCKED:
1991                 break;
1992         default:
1993                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1994         }
1995
1996         return home_unlock_internal(h, secret, HOME_UNLOCKING, error);
1997 }
1998
1999 HomeState home_get_state(Home *h) {
2000         int r;
2001         assert(h);
2002
2003         /* When the state field is initialized, it counts. */
2004         if (h->state >= 0)
2005                 return h->state;
2006
2007         /* Otherwise, let's see if the home directory is mounted. If so, we assume for sure the home
2008          * directory is active */
2009         if (user_record_test_home_directory(h->record) == USER_TEST_MOUNTED)
2010                 return h->retry_deactivate_event_source ? HOME_LINGERING : HOME_ACTIVE;
2011
2012         /* And if we see the image being gone, we report this as absent */
2013         r = user_record_test_image_path(h->record);
2014         if (r == USER_TEST_ABSENT)
2015                 return HOME_ABSENT;
2016         if (r == USER_TEST_DIRTY)
2017                 return HOME_DIRTY;
2018
2019         /* And for all other cases we return "inactive". */
2020         return HOME_INACTIVE;
2021 }
2022
2023 void home_process_notify(Home *h, char **l, int fd) {
2024         _cleanup_close_ int taken_fd = TAKE_FD(fd);
2025         const char *e;
2026         int error;
2027         int r;
2028
2029         assert(h);
2030
2031         e = strv_env_get(l, "SYSTEMD_LUKS_LOCK_FD");
2032         if (e) {
2033                 r = parse_boolean(e);
2034                 if (r < 0)
2035                         return (void) log_debug_errno(r, "Failed to parse SYSTEMD_LUKS_LOCK_FD value: %m");
2036                 if (r > 0) {
2037                         if (taken_fd < 0)
2038                                 return (void) log_debug("Got notify message with SYSTEMD_LUKS_LOCK_FD=1 but no fd passed, ignoring: %m");
2039
2040                         safe_close(h->luks_lock_fd);
2041                         h->luks_lock_fd = TAKE_FD(taken_fd);
2042
2043                         log_debug("Successfully acquired LUKS lock fd from worker.");
2044
2045                         /* Immediately check if we actually want to keep it */
2046                         home_maybe_close_luks_lock_fd(h, _HOME_STATE_INVALID);
2047                 } else {
2048                         if (taken_fd >= 0)
2049                                 return (void) log_debug("Got notify message with SYSTEMD_LUKS_LOCK_FD=0 but fd passed, ignoring: %m");
2050
2051                         h->luks_lock_fd = safe_close(h->luks_lock_fd);
2052                 }
2053
2054                 return;
2055         }
2056
2057         e = strv_env_get(l, "ERRNO");
2058         if (!e)
2059                 return (void) log_debug("Got notify message lacking both ERRNO= and SYSTEMD_LUKS_LOCK_FD= field, ignoring.");
2060
2061         r = safe_atoi(e, &error);
2062         if (r < 0)
2063                 return (void) log_debug_errno(r, "Failed to parse received error number, ignoring: %s", e);
2064         if (error <= 0)
2065                 return (void) log_debug("Error number is out of range: %i", error);
2066
2067         h->worker_error_code = error;
2068 }
2069
2070 int home_killall(Home *h) {
2071         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2072         _cleanup_free_ char *unit = NULL;
2073         int r;
2074
2075         assert(h);
2076
2077         if (!uid_is_valid(h->uid))
2078                 return 0;
2079
2080         assert(h->uid > 0); /* We never should be UID 0 */
2081
2082         /* Let's kill everything matching the specified UID */
2083         r = safe_fork("(sd-killer)",
2084                       FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG|FORK_REOPEN_LOG,
2085                       NULL);
2086         if (r < 0)
2087                 return r;
2088         if (r == 0) {
2089                 gid_t gid;
2090
2091                 /* Child */
2092
2093                 gid = user_record_gid(h->record);
2094                 if (setresgid(gid, gid, gid) < 0) {
2095                         log_error_errno(errno, "Failed to change GID to " GID_FMT ": %m", gid);
2096                         _exit(EXIT_FAILURE);
2097                 }
2098
2099                 if (setgroups(0, NULL) < 0) {
2100                         log_error_errno(errno, "Failed to reset auxiliary groups list: %m");
2101                         _exit(EXIT_FAILURE);
2102                 }
2103
2104                 if (setresuid(h->uid, h->uid, h->uid) < 0) {
2105                         log_error_errno(errno, "Failed to change UID to " UID_FMT ": %m", h->uid);
2106                         _exit(EXIT_FAILURE);
2107                 }
2108
2109                 if (kill(-1, SIGKILL) < 0) {
2110                         log_error_errno(errno, "Failed to kill all processes of UID " UID_FMT ": %m", h->uid);
2111                         _exit(EXIT_FAILURE);
2112                 }
2113
2114                 _exit(EXIT_SUCCESS);
2115         }
2116
2117         /* Let's also kill everything in the user's slice */
2118         if (asprintf(&unit, "user-" UID_FMT ".slice", h->uid) < 0)
2119                 return log_oom();
2120
2121         r = sd_bus_call_method(
2122                         h->manager->bus,
2123                         "org.freedesktop.systemd1",
2124                         "/org/freedesktop/systemd1",
2125                         "org.freedesktop.systemd1.Manager",
2126                         "KillUnit",
2127                         &error,
2128                         NULL,
2129                         "ssi", unit, "all", SIGKILL);
2130         if (r < 0)
2131                 log_full_errno(sd_bus_error_has_name(&error, BUS_ERROR_NO_SUCH_UNIT) ? LOG_DEBUG : LOG_WARNING,
2132                                r, "Failed to kill login processes of user, ignoring: %s", bus_error_message(&error, r));
2133
2134         return 1;
2135 }
2136
2137 static int home_get_disk_status_luks(
2138                 Home *h,
2139                 HomeState state,
2140                 uint64_t *ret_disk_size,
2141                 uint64_t *ret_disk_usage,
2142                 uint64_t *ret_disk_free,
2143                 uint64_t *ret_disk_ceiling,
2144                 uint64_t *ret_disk_floor,
2145                 statfs_f_type_t *ret_fstype,
2146                 mode_t *ret_access_mode) {
2147
2148         uint64_t disk_size = UINT64_MAX, disk_usage = UINT64_MAX, disk_free = UINT64_MAX,
2149                 disk_ceiling = UINT64_MAX, disk_floor = UINT64_MAX,
2150                 stat_used = UINT64_MAX, fs_size = UINT64_MAX, header_size = 0;
2151         mode_t access_mode = MODE_INVALID;
2152         statfs_f_type_t fstype = 0;
2153         struct statfs sfs;
2154         struct stat st;
2155         const char *hd;
2156         int r;
2157
2158         assert(h);
2159
2160         if (state != HOME_ABSENT) {
2161                 const char *ip;
2162
2163                 ip = user_record_image_path(h->record);
2164                 if (ip) {
2165                         if (stat(ip, &st) < 0)
2166                                 log_debug_errno(errno, "Failed to stat() %s, ignoring: %m", ip);
2167                         else if (S_ISREG(st.st_mode)) {
2168                                 _cleanup_free_ char *parent = NULL;
2169
2170                                 disk_size = st.st_size;
2171                                 stat_used = st.st_blocks * 512;
2172
2173                                 parent = dirname_malloc(ip);
2174                                 if (!parent)
2175                                         return log_oom();
2176
2177                                 if (statfs(parent, &sfs) < 0)
2178                                         log_debug_errno(errno, "Failed to statfs() %s, ignoring: %m", parent);
2179                                 else
2180                                         disk_ceiling = stat_used + sfs.f_bsize * sfs.f_bavail;
2181
2182                         } else if (S_ISBLK(st.st_mode)) {
2183                                 _cleanup_free_ char *szbuf = NULL;
2184                                 char p[SYS_BLOCK_PATH_MAX("/size")];
2185
2186                                 /* Let's read the size off sysfs, so that we don't have to open the device */
2187                                 xsprintf_sys_block_path(p, "/size", st.st_rdev);
2188                                 r = read_one_line_file(p, &szbuf);
2189                                 if (r < 0)
2190                                         log_debug_errno(r, "Failed to read %s, ignoring: %m", p);
2191                                 else {
2192                                         uint64_t sz;
2193
2194                                         r = safe_atou64(szbuf, &sz);
2195                                         if (r < 0)
2196                                                 log_debug_errno(r, "Failed to parse %s, ignoring: %s", p, szbuf);
2197                                         else
2198                                                 disk_size = sz * 512;
2199                                 }
2200                         } else
2201                                 log_debug("Image path is not a block device or regular file, not able to acquire size.");
2202                 }
2203         }
2204
2205         if (!HOME_STATE_IS_ACTIVE(state))
2206                 goto finish;
2207
2208         hd = user_record_home_directory(h->record);
2209         if (!hd)
2210                 goto finish;
2211
2212         if (stat(hd, &st) < 0) {
2213                 log_debug_errno(errno, "Failed to stat() %s, ignoring: %m", hd);
2214                 goto finish;
2215         }
2216
2217         r = stat_verify_directory(&st);
2218         if (r < 0) {
2219                 log_debug_errno(r, "Home directory %s is not a directory, ignoring: %m", hd);
2220                 goto finish;
2221         }
2222
2223         access_mode = st.st_mode & 07777;
2224
2225         if (statfs(hd, &sfs) < 0) {
2226                 log_debug_errno(errno, "Failed to statfs() %s, ignoring: %m", hd);
2227                 goto finish;
2228         }
2229
2230         fstype = sfs.f_type;
2231
2232         disk_free = sfs.f_bsize * sfs.f_bavail;
2233         fs_size = sfs.f_bsize * sfs.f_blocks;
2234         if (disk_size != UINT64_MAX && disk_size > fs_size)
2235                 header_size = disk_size - fs_size;
2236
2237         /* We take a perspective from the user here (as opposed to from the host): the used disk space is the
2238          * difference from the limit and what's free. This makes a difference if sparse mode is not used: in
2239          * that case the image is pre-allocated and thus appears all used from the host PoV but is not used
2240          * up at all yet from the user's PoV.
2241          *
2242          * That said, we use use the stat() reported loopback file size as upper boundary: our footprint can
2243          * never be larger than what we take up on the lowest layers. */
2244
2245         if (disk_size != UINT64_MAX && disk_size > disk_free) {
2246                 disk_usage = disk_size - disk_free;
2247
2248                 if (stat_used != UINT64_MAX && disk_usage > stat_used)
2249                         disk_usage = stat_used;
2250         } else
2251                 disk_usage = stat_used;
2252
2253         /* If we have the magic, determine floor preferably by magic */
2254         disk_floor = minimal_size_by_fs_magic(sfs.f_type) + header_size;
2255
2256 finish:
2257         /* If we don't know the magic, go by file system name */
2258         if (disk_floor == UINT64_MAX)
2259                 disk_floor = minimal_size_by_fs_name(user_record_file_system_type(h->record));
2260
2261         if (ret_disk_size)
2262                 *ret_disk_size = disk_size;
2263         if (ret_disk_usage)
2264                 *ret_disk_usage = disk_usage;
2265         if (ret_disk_free)
2266                 *ret_disk_free = disk_free;
2267         if (ret_disk_ceiling)
2268                 *ret_disk_ceiling = disk_ceiling;
2269         if (ret_disk_floor)
2270                 *ret_disk_floor = disk_floor;
2271         if (ret_fstype)
2272                 *ret_fstype = fstype;
2273         if (ret_access_mode)
2274                 *ret_access_mode = access_mode;
2275
2276         return 0;
2277 }
2278
2279 static int home_get_disk_status_directory(
2280                 Home *h,
2281                 HomeState state,
2282                 uint64_t *ret_disk_size,
2283                 uint64_t *ret_disk_usage,
2284                 uint64_t *ret_disk_free,
2285                 uint64_t *ret_disk_ceiling,
2286                 uint64_t *ret_disk_floor,
2287                 statfs_f_type_t *ret_fstype,
2288                 mode_t *ret_access_mode) {
2289
2290         uint64_t disk_size = UINT64_MAX, disk_usage = UINT64_MAX, disk_free = UINT64_MAX,
2291                 disk_ceiling = UINT64_MAX, disk_floor = UINT64_MAX;
2292         mode_t access_mode = MODE_INVALID;
2293         statfs_f_type_t fstype = 0;
2294         struct statfs sfs;
2295         struct dqblk req;
2296         const char *path = NULL;
2297         int r;
2298
2299         assert(h);
2300
2301         if (HOME_STATE_IS_ACTIVE(state))
2302                 path = user_record_home_directory(h->record);
2303
2304         if (!path) {
2305                 if (state == HOME_ABSENT)
2306                         goto finish;
2307
2308                 path = user_record_image_path(h->record);
2309         }
2310
2311         if (!path)
2312                 goto finish;
2313
2314         if (statfs(path, &sfs) < 0)
2315                 log_debug_errno(errno, "Failed to statfs() %s, ignoring: %m", path);
2316         else {
2317                 disk_free = sfs.f_bsize * sfs.f_bavail;
2318                 disk_size = sfs.f_bsize * sfs.f_blocks;
2319
2320                 /* We don't initialize disk_usage from statfs() data here, since the device is likely not used
2321                  * by us alone, and disk_usage should only reflect our own use. */
2322
2323                 fstype = sfs.f_type;
2324         }
2325
2326         if (IN_SET(h->record->storage, USER_CLASSIC, USER_DIRECTORY, USER_SUBVOLUME)) {
2327
2328                 r = btrfs_is_subvol(path);
2329                 if (r < 0)
2330                         log_debug_errno(r, "Failed to determine whether %s is a btrfs subvolume: %m", path);
2331                 else if (r > 0) {
2332                         BtrfsQuotaInfo qi;
2333
2334                         r = btrfs_subvol_get_subtree_quota(path, 0, &qi);
2335                         if (r < 0)
2336                                 log_debug_errno(r, "Failed to query btrfs subtree quota, ignoring: %m");
2337                         else {
2338                                 disk_usage = qi.referenced;
2339
2340                                 if (disk_free != UINT64_MAX) {
2341                                         disk_ceiling = qi.referenced + disk_free;
2342
2343                                         if (disk_size != UINT64_MAX && disk_ceiling > disk_size)
2344                                                 disk_ceiling = disk_size;
2345                                 }
2346
2347                                 if (qi.referenced_max != UINT64_MAX) {
2348                                         if (disk_size != UINT64_MAX)
2349                                                 disk_size = MIN(qi.referenced_max, disk_size);
2350                                         else
2351                                                 disk_size = qi.referenced_max;
2352                                 }
2353
2354                                 if (disk_size != UINT64_MAX) {
2355                                         if (disk_size > disk_usage)
2356                                                 disk_free = disk_size - disk_usage;
2357                                         else
2358                                                 disk_free = 0;
2359                                 }
2360                         }
2361
2362                         goto finish;
2363                 }
2364         }
2365
2366         if (IN_SET(h->record->storage, USER_CLASSIC, USER_DIRECTORY, USER_FSCRYPT)) {
2367                 r = quotactl_path(QCMD_FIXED(Q_GETQUOTA, USRQUOTA), path, h->uid, &req);
2368                 if (r < 0) {
2369                         if (ERRNO_IS_NOT_SUPPORTED(r)) {
2370                                 log_debug_errno(r, "No UID quota support on %s.", path);
2371                                 goto finish;
2372                         }
2373
2374                         if (r != -ESRCH) {
2375                                 log_debug_errno(r, "Failed to query disk quota for UID " UID_FMT ": %m", h->uid);
2376                                 goto finish;
2377                         }
2378
2379                         disk_usage = 0; /* No record of this user? then nothing was used */
2380                 } else {
2381                         if (FLAGS_SET(req.dqb_valid, QIF_SPACE) && disk_free != UINT64_MAX) {
2382                                 disk_ceiling = req.dqb_curspace + disk_free;
2383
2384                                 if (disk_size != UINT64_MAX && disk_ceiling > disk_size)
2385                                         disk_ceiling = disk_size;
2386                         }
2387
2388                         if (FLAGS_SET(req.dqb_valid, QIF_BLIMITS)) {
2389                                 uint64_t q;
2390
2391                                 /* Take the minimum of the quota and the available disk space here */
2392                                 q = req.dqb_bhardlimit * QIF_DQBLKSIZE;
2393                                 if (disk_size != UINT64_MAX)
2394                                         disk_size = MIN(disk_size, q);
2395                                 else
2396                                         disk_size = q;
2397                         }
2398                         if (FLAGS_SET(req.dqb_valid, QIF_SPACE)) {
2399                                 disk_usage = req.dqb_curspace;
2400
2401                                 if (disk_size != UINT64_MAX) {
2402                                         if (disk_size > disk_usage)
2403                                                 disk_free = disk_size - disk_usage;
2404                                         else
2405                                                 disk_free = 0;
2406                                 }
2407                         }
2408                 }
2409         }
2410
2411 finish:
2412         if (ret_disk_size)
2413                 *ret_disk_size = disk_size;
2414         if (ret_disk_usage)
2415                 *ret_disk_usage = disk_usage;
2416         if (ret_disk_free)
2417                 *ret_disk_free = disk_free;
2418         if (ret_disk_ceiling)
2419                 *ret_disk_ceiling = disk_ceiling;
2420         if (ret_disk_floor)
2421                 *ret_disk_floor = disk_floor;
2422         if (ret_fstype)
2423                 *ret_fstype = fstype;
2424         if (ret_access_mode)
2425                 *ret_access_mode = access_mode;
2426
2427         return 0;
2428 }
2429
2430 static int home_get_disk_status_internal(
2431                 Home *h,
2432                 HomeState state,
2433                 uint64_t *ret_disk_size,
2434                 uint64_t *ret_disk_usage,
2435                 uint64_t *ret_disk_free,
2436                 uint64_t *ret_disk_ceiling,
2437                 uint64_t *ret_disk_floor,
2438                 statfs_f_type_t *ret_fstype,
2439                 mode_t *ret_access_mode) {
2440
2441         assert(h);
2442         assert(h->record);
2443
2444         switch (h->record->storage) {
2445
2446         case USER_LUKS:
2447                 return home_get_disk_status_luks(h, state, ret_disk_size, ret_disk_usage, ret_disk_free, ret_disk_ceiling, ret_disk_floor, ret_fstype, ret_access_mode);
2448
2449         case USER_CLASSIC:
2450         case USER_DIRECTORY:
2451         case USER_SUBVOLUME:
2452         case USER_FSCRYPT:
2453         case USER_CIFS:
2454                 return home_get_disk_status_directory(h, state, ret_disk_size, ret_disk_usage, ret_disk_free, ret_disk_ceiling, ret_disk_floor, ret_fstype, ret_access_mode);
2455
2456         default:
2457                 /* don't know */
2458
2459                 if (ret_disk_size)
2460                         *ret_disk_size = UINT64_MAX;
2461                 if (ret_disk_usage)
2462                         *ret_disk_usage = UINT64_MAX;
2463                 if (ret_disk_free)
2464                         *ret_disk_free = UINT64_MAX;
2465                 if (ret_disk_ceiling)
2466                         *ret_disk_ceiling = UINT64_MAX;
2467                 if (ret_disk_floor)
2468                         *ret_disk_floor = UINT64_MAX;
2469                 if (ret_fstype)
2470                         *ret_fstype = 0;
2471                 if (ret_access_mode)
2472                         *ret_access_mode = MODE_INVALID;
2473
2474                 return 0;
2475         }
2476 }
2477
2478 int home_get_disk_status(
2479                 Home *h,
2480                 uint64_t *ret_disk_size,
2481                 uint64_t *ret_disk_usage,
2482                 uint64_t *ret_disk_free,
2483                 uint64_t *ret_disk_ceiling,
2484                 uint64_t *ret_disk_floor,
2485                 statfs_f_type_t *ret_fstype,
2486                 mode_t *ret_access_mode) {
2487
2488         assert(h);
2489
2490         return home_get_disk_status_internal(
2491                         h,
2492                         home_get_state(h),
2493                         ret_disk_size,
2494                         ret_disk_usage,
2495                         ret_disk_free,
2496                         ret_disk_ceiling,
2497                         ret_disk_floor,
2498                         ret_fstype,
2499                         ret_access_mode);
2500 }
2501
2502 int home_augment_status(
2503                 Home *h,
2504                 UserRecordLoadFlags flags,
2505                 UserRecord **ret) {
2506
2507         uint64_t disk_size = UINT64_MAX, disk_usage = UINT64_MAX, disk_free = UINT64_MAX, disk_ceiling = UINT64_MAX, disk_floor = UINT64_MAX;
2508         _cleanup_(json_variant_unrefp) JsonVariant *j = NULL, *v = NULL, *m = NULL, *status = NULL;
2509         _cleanup_(user_record_unrefp) UserRecord *ur = NULL;
2510         statfs_f_type_t magic;
2511         const char *fstype;
2512         mode_t access_mode;
2513         HomeState state;
2514         sd_id128_t id;
2515         int r;
2516
2517         assert(h);
2518         assert(ret);
2519
2520         /* We are supposed to add this, this can't be on hence. */
2521         assert(!FLAGS_SET(flags, USER_RECORD_STRIP_STATUS));
2522
2523         r = sd_id128_get_machine(&id);
2524         if (r < 0)
2525                 return r;
2526
2527         state = home_get_state(h);
2528
2529         r = home_get_disk_status_internal(
2530                         h, state,
2531                         &disk_size,
2532                         &disk_usage,
2533                         &disk_free,
2534                         &disk_ceiling,
2535                         &disk_floor,
2536                         &magic,
2537                         &access_mode);
2538         if (r < 0)
2539                 return r;
2540
2541         fstype = fs_type_to_string(magic);
2542
2543         if (disk_floor == UINT64_MAX || (disk_usage != UINT64_MAX && disk_floor < disk_usage))
2544                 disk_floor = disk_usage;
2545         if (disk_floor == UINT64_MAX || disk_floor < USER_DISK_SIZE_MIN)
2546                 disk_floor = USER_DISK_SIZE_MIN;
2547         if (disk_ceiling == UINT64_MAX || disk_ceiling > USER_DISK_SIZE_MAX)
2548                 disk_ceiling = USER_DISK_SIZE_MAX;
2549
2550         r = json_build(&status,
2551                        JSON_BUILD_OBJECT(
2552                                        JSON_BUILD_PAIR("state", JSON_BUILD_STRING(home_state_to_string(state))),
2553                                        JSON_BUILD_PAIR("service", JSON_BUILD_CONST_STRING("io.systemd.Home")),
2554                                        JSON_BUILD_PAIR_CONDITION(disk_size != UINT64_MAX, "diskSize", JSON_BUILD_UNSIGNED(disk_size)),
2555                                        JSON_BUILD_PAIR_CONDITION(disk_usage != UINT64_MAX, "diskUsage", JSON_BUILD_UNSIGNED(disk_usage)),
2556                                        JSON_BUILD_PAIR_CONDITION(disk_free != UINT64_MAX, "diskFree", JSON_BUILD_UNSIGNED(disk_free)),
2557                                        JSON_BUILD_PAIR_CONDITION(disk_ceiling != UINT64_MAX, "diskCeiling", JSON_BUILD_UNSIGNED(disk_ceiling)),
2558                                        JSON_BUILD_PAIR_CONDITION(disk_floor != UINT64_MAX, "diskFloor", JSON_BUILD_UNSIGNED(disk_floor)),
2559                                        JSON_BUILD_PAIR_CONDITION(h->signed_locally >= 0, "signedLocally", JSON_BUILD_BOOLEAN(h->signed_locally)),
2560                                        JSON_BUILD_PAIR_CONDITION(fstype, "fileSystemType", JSON_BUILD_STRING(fstype)),
2561                                        JSON_BUILD_PAIR_CONDITION(access_mode != MODE_INVALID, "accessMode", JSON_BUILD_UNSIGNED(access_mode))
2562                        ));
2563         if (r < 0)
2564                 return r;
2565
2566         j = json_variant_ref(h->record->json);
2567         v = json_variant_ref(json_variant_by_key(j, "status"));
2568         m = json_variant_ref(json_variant_by_key(v, SD_ID128_TO_STRING(id)));
2569
2570         r = json_variant_filter(&m, STRV_MAKE("diskSize", "diskUsage", "diskFree", "diskCeiling", "diskFloor", "signedLocally"));
2571         if (r < 0)
2572                 return r;
2573
2574         r = json_variant_merge(&m, status);
2575         if (r < 0)
2576                 return r;
2577
2578         r = json_variant_set_field(&v, SD_ID128_TO_STRING(id), m);
2579         if (r < 0)
2580                 return r;
2581
2582         r = json_variant_set_field(&j, "status", v);
2583         if (r < 0)
2584                 return r;
2585
2586         ur = user_record_new();
2587         if (!ur)
2588                 return -ENOMEM;
2589
2590         r = user_record_load(ur, j, flags);
2591         if (r < 0)
2592                 return r;
2593
2594         ur->incomplete =
2595                 FLAGS_SET(h->record->mask, USER_RECORD_PRIVILEGED) &&
2596                 !FLAGS_SET(ur->mask, USER_RECORD_PRIVILEGED);
2597
2598         *ret = TAKE_PTR(ur);
2599         return 0;
2600 }
2601
2602 static int on_home_ref_eof(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
2603         _cleanup_(operation_unrefp) Operation *o = NULL;
2604         Home *h = userdata;
2605
2606         assert(s);
2607         assert(h);
2608
2609         if (h->ref_event_source_please_suspend == s)
2610                 h->ref_event_source_please_suspend = sd_event_source_disable_unref(h->ref_event_source_please_suspend);
2611
2612         if (h->ref_event_source_dont_suspend == s)
2613                 h->ref_event_source_dont_suspend = sd_event_source_disable_unref(h->ref_event_source_dont_suspend);
2614
2615         if (h->ref_event_source_dont_suspend || h->ref_event_source_please_suspend)
2616                 return 0;
2617
2618         log_info("Got notification that all sessions of user %s ended, deactivating automatically.", h->user_name);
2619
2620         o = operation_new(OPERATION_PIPE_EOF, NULL);
2621         if (!o) {
2622                 log_oom();
2623                 return 0;
2624         }
2625
2626         home_schedule_operation(h, o, NULL);
2627         return 0;
2628 }
2629
2630 int home_create_fifo(Home *h, bool please_suspend) {
2631         _cleanup_close_ int ret_fd = -1;
2632         sd_event_source **ss;
2633         const char *fn, *suffix;
2634         int r;
2635
2636         assert(h);
2637
2638         if (please_suspend) {
2639                 suffix = ".please-suspend";
2640                 ss = &h->ref_event_source_please_suspend;
2641         } else {
2642                 suffix = ".dont-suspend";
2643                 ss = &h->ref_event_source_dont_suspend;
2644         }
2645
2646         fn = strjoina("/run/systemd/home/", h->user_name, suffix);
2647
2648         if (!*ss) {
2649                 _cleanup_close_ int ref_fd = -1;
2650
2651                 (void) mkdir("/run/systemd/home/", 0755);
2652                 if (mkfifo(fn, 0600) < 0 && errno != EEXIST)
2653                         return log_error_errno(errno, "Failed to create FIFO %s: %m", fn);
2654
2655                 ref_fd = open(fn, O_RDONLY|O_CLOEXEC|O_NONBLOCK);
2656                 if (ref_fd < 0)
2657                         return log_error_errno(errno, "Failed to open FIFO %s for reading: %m", fn);
2658
2659                 r = sd_event_add_io(h->manager->event, ss, ref_fd, 0, on_home_ref_eof, h);
2660                 if (r < 0)
2661                         return log_error_errno(r, "Failed to allocate reference FIFO event source: %m");
2662
2663                 (void) sd_event_source_set_description(*ss, "acquire-ref");
2664
2665                 r = sd_event_source_set_priority(*ss, SD_EVENT_PRIORITY_IDLE-1);
2666                 if (r < 0)
2667                         return r;
2668
2669                 r = sd_event_source_set_io_fd_own(*ss, true);
2670                 if (r < 0)
2671                         return log_error_errno(r, "Failed to pass ownership of FIFO event fd to event source: %m");
2672
2673                 TAKE_FD(ref_fd);
2674         }
2675
2676         ret_fd = open(fn, O_WRONLY|O_CLOEXEC|O_NONBLOCK);
2677         if (ret_fd < 0)
2678                 return log_error_errno(errno, "Failed to open FIFO %s for writing: %m", fn);
2679
2680         return TAKE_FD(ret_fd);
2681 }
2682
2683 static int home_dispatch_acquire(Home *h, Operation *o) {
2684         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2685         int (*call)(Home *h, UserRecord *secret, HomeState for_state, sd_bus_error *error) = NULL;
2686         HomeState for_state;
2687         int r;
2688
2689         assert(h);
2690         assert(o);
2691         assert(o->type == OPERATION_ACQUIRE);
2692
2693         assert(!h->current_operation);
2694
2695         switch (home_get_state(h)) {
2696
2697         case HOME_UNFIXATED:
2698                 for_state = HOME_FIXATING_FOR_ACQUIRE;
2699                 call = home_fixate_internal;
2700                 break;
2701
2702         case HOME_ABSENT:
2703                 r = sd_bus_error_setf(&error, BUS_ERROR_HOME_ABSENT,
2704                                       "Home %s is currently missing or not plugged in.", h->user_name);
2705                 goto check;
2706
2707         case HOME_INACTIVE:
2708         case HOME_DIRTY:
2709                 for_state = HOME_ACTIVATING_FOR_ACQUIRE;
2710                 call = home_activate_internal;
2711                 break;
2712
2713         case HOME_ACTIVE:
2714         case HOME_LINGERING:
2715                 for_state = HOME_AUTHENTICATING_FOR_ACQUIRE;
2716                 call = home_authenticate_internal;
2717                 break;
2718
2719         case HOME_LOCKED:
2720                 for_state = HOME_UNLOCKING_FOR_ACQUIRE;
2721                 call = home_unlock_internal;
2722                 break;
2723
2724         default:
2725                 /* All other cases means we are currently executing an operation, which means the job remains
2726                  * pending. */
2727                 return 0;
2728         }
2729
2730         r = home_ratelimit(h, &error);
2731         if (r >= 0)
2732                 r = call(h, o->secret, for_state, &error);
2733
2734  check:
2735         if (r != 0) /* failure or completed */
2736                 operation_result(o, r, &error);
2737         else /* ongoing */
2738                 h->current_operation = operation_ref(o);
2739
2740         return 1;
2741 }
2742
2743 static int home_dispatch_release(Home *h, Operation *o) {
2744         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2745         int r;
2746
2747         assert(h);
2748         assert(o);
2749         assert(o->type == OPERATION_RELEASE);
2750
2751         if (h->ref_event_source_dont_suspend || h->ref_event_source_please_suspend)
2752                 /* If there's now a reference again, then let's abort the release attempt */
2753                 r = sd_bus_error_setf(&error, BUS_ERROR_HOME_BUSY, "Home %s is currently referenced.", h->user_name);
2754         else {
2755                 switch (home_get_state(h)) {
2756
2757                 case HOME_UNFIXATED:
2758                 case HOME_ABSENT:
2759                 case HOME_INACTIVE:
2760                 case HOME_DIRTY:
2761                         r = 1; /* done */
2762                         break;
2763
2764                 case HOME_LOCKED:
2765                         r = sd_bus_error_setf(&error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
2766                         break;
2767
2768                 case HOME_ACTIVE:
2769                 case HOME_LINGERING:
2770                         r = home_deactivate_internal(h, false, &error);
2771                         break;
2772
2773                 default:
2774                         /* All other cases means we are currently executing an operation, which means the job remains
2775                          * pending. */
2776                         return 0;
2777                 }
2778         }
2779
2780         assert(!h->current_operation);
2781
2782         if (r != 0) /* failure or completed */
2783                 operation_result(o, r, &error);
2784         else /* ongoing */
2785                 h->current_operation = operation_ref(o);
2786
2787         return 1;
2788 }
2789
2790 static int home_dispatch_lock_all(Home *h, Operation *o) {
2791         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2792         int r;
2793
2794         assert(h);
2795         assert(o);
2796         assert(o->type == OPERATION_LOCK_ALL);
2797
2798         switch (home_get_state(h)) {
2799
2800         case HOME_UNFIXATED:
2801         case HOME_ABSENT:
2802         case HOME_INACTIVE:
2803         case HOME_DIRTY:
2804                 log_info("Home %s is not active, no locking necessary.", h->user_name);
2805                 r = 1; /* done */
2806                 break;
2807
2808         case HOME_LOCKED:
2809                 log_info("Home %s is already locked.", h->user_name);
2810                 r = 1; /* done */
2811                 break;
2812
2813         case HOME_ACTIVE:
2814         case HOME_LINGERING:
2815                 log_info("Locking home %s.", h->user_name);
2816                 r = home_lock(h, &error);
2817                 break;
2818
2819         default:
2820                 /* All other cases means we are currently executing an operation, which means the job remains
2821                  * pending. */
2822                 return 0;
2823         }
2824
2825         assert(!h->current_operation);
2826
2827         if (r != 0) /* failure or completed */
2828                 operation_result(o, r, &error);
2829         else /* ongoing */
2830                 h->current_operation = operation_ref(o);
2831
2832         return 1;
2833 }
2834
2835 static int home_dispatch_deactivate_all(Home *h, Operation *o) {
2836         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2837         int r;
2838
2839         assert(h);
2840         assert(o);
2841         assert(o->type == OPERATION_DEACTIVATE_ALL);
2842
2843         switch (home_get_state(h)) {
2844
2845         case HOME_UNFIXATED:
2846         case HOME_ABSENT:
2847         case HOME_INACTIVE:
2848         case HOME_DIRTY:
2849                 log_info("Home %s is already deactivated.", h->user_name);
2850                 r = 1; /* done */
2851                 break;
2852
2853         case HOME_LOCKED:
2854                 log_info("Home %s is currently locked, not deactivating.", h->user_name);
2855                 r = 1; /* done */
2856                 break;
2857
2858         case HOME_ACTIVE:
2859         case HOME_LINGERING:
2860                 log_info("Deactivating home %s.", h->user_name);
2861                 r = home_deactivate_internal(h, false, &error);
2862                 break;
2863
2864         default:
2865                 /* All other cases means we are currently executing an operation, which means the job remains
2866                  * pending. */
2867                 return 0;
2868         }
2869
2870         assert(!h->current_operation);
2871
2872         if (r != 0) /* failure or completed */
2873                 operation_result(o, r, &error);
2874         else /* ongoing */
2875                 h->current_operation = operation_ref(o);
2876
2877         return 1;
2878 }
2879
2880 static int home_dispatch_pipe_eof(Home *h, Operation *o) {
2881         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2882         int r;
2883
2884         assert(h);
2885         assert(o);
2886         assert(o->type == OPERATION_PIPE_EOF);
2887
2888         if (h->ref_event_source_please_suspend || h->ref_event_source_dont_suspend)
2889                 return 1; /* Hmm, there's a reference again, let's cancel this */
2890
2891         switch (home_get_state(h)) {
2892
2893         case HOME_UNFIXATED:
2894         case HOME_ABSENT:
2895         case HOME_INACTIVE:
2896         case HOME_DIRTY:
2897                 log_info("Home %s already deactivated, no automatic deactivation needed.", h->user_name);
2898                 break;
2899
2900         case HOME_DEACTIVATING:
2901                 log_info("Home %s is already being deactivated, automatic deactivated unnecessary.", h->user_name);
2902                 break;
2903
2904         case HOME_ACTIVE:
2905         case HOME_LINGERING:
2906                 r = home_deactivate_internal(h, false, &error);
2907                 if (r < 0)
2908                         log_warning_errno(r, "Failed to deactivate %s, ignoring: %s", h->user_name, bus_error_message(&error, r));
2909                 break;
2910
2911         case HOME_LOCKED:
2912         default:
2913                 /* If the device is locked or any operation is being executed, let's leave this pending */
2914                 return 0;
2915         }
2916
2917         /* Note that we don't call operation_fail() or operation_success() here, because this kind of
2918          * operation has no message associated with it, and thus there's no need to propagate success. */
2919
2920         assert(!o->message);
2921         return 1;
2922 }
2923
2924 static int home_dispatch_deactivate_force(Home *h, Operation *o) {
2925         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2926         int r;
2927
2928         assert(h);
2929         assert(o);
2930         assert(o->type == OPERATION_DEACTIVATE_FORCE);
2931
2932         switch (home_get_state(h)) {
2933
2934         case HOME_UNFIXATED:
2935         case HOME_ABSENT:
2936         case HOME_INACTIVE:
2937         case HOME_DIRTY:
2938                 log_debug("Home %s already deactivated, no forced deactivation due to unplug needed.", h->user_name);
2939                 break;
2940
2941         case HOME_DEACTIVATING:
2942                 log_debug("Home %s is already being deactivated, forced deactivation due to unplug unnecessary.", h->user_name);
2943                 break;
2944
2945         case HOME_ACTIVE:
2946         case HOME_LOCKED:
2947         case HOME_LINGERING:
2948                 r = home_deactivate_internal(h, true, &error);
2949                 if (r < 0)
2950                         log_warning_errno(r, "Failed to forcibly deactivate %s, ignoring: %s", h->user_name, bus_error_message(&error, r));
2951                 break;
2952
2953         default:
2954                 /* If any operation is being executed, let's leave this pending */
2955                 return 0;
2956         }
2957
2958         /* Note that we don't call operation_fail() or operation_success() here, because this kind of
2959          * operation has no message associated with it, and thus there's no need to propagate success. */
2960
2961         assert(!o->message);
2962         return 1;
2963 }
2964
2965 static int on_pending(sd_event_source *s, void *userdata) {
2966         Home *h = userdata;
2967         Operation *o;
2968         int r;
2969
2970         assert(s);
2971         assert(h);
2972
2973         o = ordered_set_first(h->pending_operations);
2974         if (o) {
2975                 static int (* const operation_table[_OPERATION_MAX])(Home *h, Operation *o) = {
2976                         [OPERATION_ACQUIRE]          = home_dispatch_acquire,
2977                         [OPERATION_RELEASE]          = home_dispatch_release,
2978                         [OPERATION_LOCK_ALL]         = home_dispatch_lock_all,
2979                         [OPERATION_DEACTIVATE_ALL]   = home_dispatch_deactivate_all,
2980                         [OPERATION_PIPE_EOF]         = home_dispatch_pipe_eof,
2981                         [OPERATION_DEACTIVATE_FORCE] = home_dispatch_deactivate_force,
2982                 };
2983
2984                 assert(operation_table[o->type]);
2985                 r = operation_table[o->type](h, o);
2986                 if (r != 0) {
2987                         /* The operation completed, let's remove it from the pending list, and exit while
2988                          * leaving the event source enabled as it is. */
2989                         assert_se(ordered_set_remove(h->pending_operations, o) == o);
2990                         operation_unref(o);
2991                         return 0;
2992                 }
2993         }
2994
2995         /* Nothing to do anymore, let's turn off this event source */
2996         r = sd_event_source_set_enabled(s, SD_EVENT_OFF);
2997         if (r < 0)
2998                 return log_error_errno(r, "Failed to disable event source: %m");
2999
3000         /* No operations pending anymore, maybe this is a good time to trigger a rebalancing */
3001         manager_reschedule_rebalance(h->manager);
3002         return 0;
3003 }
3004
3005 int home_schedule_operation(Home *h, Operation *o, sd_bus_error *error) {
3006         int r;
3007
3008         assert(h);
3009
3010         if (o) {
3011                 if (ordered_set_size(h->pending_operations) >= PENDING_OPERATIONS_MAX)
3012                         return sd_bus_error_set(error, BUS_ERROR_TOO_MANY_OPERATIONS, "Too many client operations requested");
3013
3014                 r = ordered_set_ensure_put(&h->pending_operations, &operation_hash_ops, o);
3015                 if (r < 0)
3016                         return r;
3017
3018                 operation_ref(o);
3019         }
3020
3021         if (!h->pending_event_source) {
3022                 r = sd_event_add_defer(h->manager->event, &h->pending_event_source, on_pending, h);
3023                 if (r < 0)
3024                         return log_error_errno(r, "Failed to allocate pending defer event source: %m");
3025
3026                 (void) sd_event_source_set_description(h->pending_event_source, "pending");
3027
3028                 r = sd_event_source_set_priority(h->pending_event_source, SD_EVENT_PRIORITY_IDLE);
3029                 if (r < 0)
3030                         return r;
3031         }
3032
3033         r = sd_event_source_set_enabled(h->pending_event_source, SD_EVENT_ON);
3034         if (r < 0)
3035                 return log_error_errno(r, "Failed to trigger pending event source: %m");
3036
3037         return 0;
3038 }
3039
3040 static int home_get_image_path_seat(Home *h, char **ret) {
3041         _cleanup_(sd_device_unrefp) sd_device *d = NULL;
3042         _cleanup_free_ char *c = NULL;
3043         const char *ip, *seat;
3044         struct stat st;
3045         int r;
3046
3047         assert(h);
3048
3049         if (user_record_storage(h->record) != USER_LUKS)
3050                 return -ENXIO;
3051
3052         ip = user_record_image_path(h->record);
3053         if (!ip)
3054                 return -ENXIO;
3055
3056         if (!path_startswith(ip, "/dev/"))
3057                 return -ENXIO;
3058
3059         if (stat(ip, &st) < 0)
3060                 return -errno;
3061
3062         if (!S_ISBLK(st.st_mode))
3063                 return -ENOTBLK;
3064
3065         r = sd_device_new_from_stat_rdev(&d, &st);
3066         if (r < 0)
3067                 return r;
3068
3069         r = sd_device_get_property_value(d, "ID_SEAT", &seat);
3070         if (r == -ENOENT) /* no property means seat0 */
3071                 seat = "seat0";
3072         else if (r < 0)
3073                 return r;
3074
3075         c = strdup(seat);
3076         if (!c)
3077                 return -ENOMEM;
3078
3079         *ret = TAKE_PTR(c);
3080         return 0;
3081 }
3082
3083 int home_auto_login(Home *h, char ***ret_seats) {
3084         _cleanup_free_ char *seat = NULL, *seat2 = NULL;
3085
3086         assert(h);
3087         assert(ret_seats);
3088
3089         (void) home_get_image_path_seat(h, &seat);
3090
3091         if (h->record->auto_login > 0 && !streq_ptr(seat, "seat0")) {
3092                 /* For now, when the auto-login boolean is set for a user, let's make it mean
3093                  * "seat0". Eventually we can extend the concept and allow configuration of any kind of seat,
3094                  * but let's keep simple initially, most likely the feature is interesting on single-user
3095                  * systems anyway, only.
3096                  *
3097                  * We filter out users marked for auto-login in we know for sure their home directory is
3098                  * absent. */
3099
3100                 if (user_record_test_image_path(h->record) != USER_TEST_ABSENT) {
3101                         seat2 = strdup("seat0");
3102                         if (!seat2)
3103                                 return -ENOMEM;
3104                 }
3105         }
3106
3107         if (seat || seat2) {
3108                 _cleanup_strv_free_ char **list = NULL;
3109                 size_t i = 0;
3110
3111                 list = new(char*, 3);
3112                 if (!list)
3113                         return -ENOMEM;
3114
3115                 if (seat)
3116                         list[i++] = TAKE_PTR(seat);
3117                 if (seat2)
3118                         list[i++] = TAKE_PTR(seat2);
3119
3120                 list[i] = NULL;
3121                 *ret_seats = TAKE_PTR(list);
3122                 return 1;
3123         }
3124
3125         *ret_seats = NULL;
3126         return 0;
3127 }
3128
3129 int home_set_current_message(Home *h, sd_bus_message *m) {
3130         assert(h);
3131
3132         if (!m)
3133                 return 0;
3134
3135         if (h->current_operation)
3136                 return -EBUSY;
3137
3138         h->current_operation = operation_new(OPERATION_IMMEDIATE, m);
3139         if (!h->current_operation)
3140                 return -ENOMEM;
3141
3142         return 1;
3143 }
3144
3145 int home_wait_for_worker(Home *h) {
3146         assert(h);
3147
3148         if (h->worker_pid <= 0)
3149                 return 0;
3150
3151         log_info("Worker process for home %s is still running while exiting. Waiting for it to finish.", h->user_name);
3152         (void) wait_for_terminate(h->worker_pid, NULL);
3153         (void) hashmap_remove_value(h->manager->homes_by_worker_pid, PID_TO_PTR(h->worker_pid), h);
3154         h->worker_pid = 0;
3155         return 1;
3156 }
3157
3158 bool home_shall_rebalance(Home *h) {
3159         HomeState state;
3160
3161         assert(h);
3162
3163         /* Determines if the home directory is a candidate for rebalancing */
3164
3165         if (!user_record_shall_rebalance(h->record))
3166                 return false;
3167
3168         state = home_get_state(h);
3169         if (!HOME_STATE_SHALL_REBALANCE(state))
3170                 return false;
3171
3172         return true;
3173 }
3174
3175 bool home_is_busy(Home *h) {
3176         assert(h);
3177
3178         if (h->current_operation)
3179                 return true;
3180
3181         if (!ordered_set_isempty(h->pending_operations))
3182                 return true;
3183
3184         return HOME_STATE_IS_EXECUTING_OPERATION(home_get_state(h));
3185 }
3186
3187 static const char* const home_state_table[_HOME_STATE_MAX] = {
3188         [HOME_UNFIXATED]                   = "unfixated",
3189         [HOME_ABSENT]                      = "absent",
3190         [HOME_INACTIVE]                    = "inactive",
3191         [HOME_DIRTY]                       = "dirty",
3192         [HOME_FIXATING]                    = "fixating",
3193         [HOME_FIXATING_FOR_ACTIVATION]     = "fixating-for-activation",
3194         [HOME_FIXATING_FOR_ACQUIRE]        = "fixating-for-acquire",
3195         [HOME_ACTIVATING]                  = "activating",
3196         [HOME_ACTIVATING_FOR_ACQUIRE]      = "activating-for-acquire",
3197         [HOME_DEACTIVATING]                = "deactivating",
3198         [HOME_ACTIVE]                      = "active",
3199         [HOME_LINGERING]                   = "lingering",
3200         [HOME_LOCKING]                     = "locking",
3201         [HOME_LOCKED]                      = "locked",
3202         [HOME_UNLOCKING]                   = "unlocking",
3203         [HOME_UNLOCKING_FOR_ACQUIRE]       = "unlocking-for-acquire",
3204         [HOME_CREATING]                    = "creating",
3205         [HOME_REMOVING]                    = "removing",
3206         [HOME_UPDATING]                    = "updating",
3207         [HOME_UPDATING_WHILE_ACTIVE]       = "updating-while-active",
3208         [HOME_RESIZING]                    = "resizing",
3209         [HOME_RESIZING_WHILE_ACTIVE]       = "resizing-while-active",
3210         [HOME_PASSWD]                      = "passwd",
3211         [HOME_PASSWD_WHILE_ACTIVE]         = "passwd-while-active",
3212         [HOME_AUTHENTICATING]              = "authenticating",
3213         [HOME_AUTHENTICATING_WHILE_ACTIVE] = "authenticating-while-active",
3214         [HOME_AUTHENTICATING_FOR_ACQUIRE]  = "authenticating-for-acquire",
3215 };
3216
3217 DEFINE_STRING_TABLE_LOOKUP(home_state, HomeState);