src/home/homed-home.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #if HAVE_LINUX_MEMFD_H
   4 #include <linux/memfd.h>
   5 #endif
   6
   7 #include <sys/mman.h>
   8 #include <sys/quota.h>
   9 #include <sys/vfs.h>
  10
  11 #include "blockdev-util.h"
  12 #include "btrfs-util.h"
  13 #include "bus-common-errors.h"
  14 #include "data-fd-util.h"
  15 #include "env-util.h"
  16 #include "errno-list.h"
  17 #include "errno-util.h"
  18 #include "fd-util.h"
  19 #include "fileio.h"
  20 #include "filesystems.h"
  21 #include "fs-util.h"
  22 #include "glyph-util.h"
  23 #include "home-util.h"
  24 #include "homed-home-bus.h"
  25 #include "homed-home.h"
  26 #include "missing_magic.h"
  27 #include "missing_syscall.h"
  28 #include "mkdir.h"
  29 #include "path-util.h"
  30 #include "process-util.h"
  31 #include "pwquality-util.h"
  32 #include "quota-util.h"
  33 #include "resize-fs.h"
  34 #include "set.h"
  35 #include "signal-util.h"
  36 #include "stat-util.h"
  37 #include "string-table.h"
  38 #include "strv.h"
  39 #include "uid-alloc-range.h"
  40 #include "user-record-pwquality.h"
  41 #include "user-record-sign.h"
  42 #include "user-record-util.h"
  43 #include "user-record.h"
  44 #include "user-util.h"
  45
  46 /* Retry to deactivate home directories again and again every 15s until it works */
  47 #define RETRY_DEACTIVATE_USEC (15U * USEC_PER_SEC)
  48
  49 #define HOME_USERS_MAX 500
  50 #define PENDING_OPERATIONS_MAX 100
  51
  52 assert_cc(HOME_UID_MIN <= HOME_UID_MAX);
  53 assert_cc(HOME_USERS_MAX <= (HOME_UID_MAX - HOME_UID_MIN + 1));
  54
  55 static int home_start_work(Home *h, const char *verb, UserRecord *hr, UserRecord *secret);
  56
  57 DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(operation_hash_ops, void, trivial_hash_func, trivial_compare_func, Operation, operation_unref);
  58
  59 static int suitable_home_record(UserRecord *hr) {
  60         int r;
  61
  62         assert(hr);
  63
  64         if (!hr->user_name)
  65                 return -EUNATCH;
  66
  67         /* We are a bit more restrictive with what we accept as homed-managed user than what we accept in
  68          * home records in general. Let's enforce the stricter rule here. */
  69         if (!suitable_user_name(hr->user_name))
  70                 return -EINVAL;
  71         if (!uid_is_valid(hr->uid))
  72                 return -EINVAL;
  73
  74         /* Insist we are outside of the dynamic and system range */
  75         if (uid_is_system(hr->uid) || gid_is_system(user_record_gid(hr)) ||
  76             uid_is_dynamic(hr->uid) || gid_is_dynamic(user_record_gid(hr)))
  77                 return -EADDRNOTAVAIL;
  78
  79         /* Insist that GID and UID match */
  80         if (user_record_gid(hr) != (gid_t) hr->uid)
  81                 return -EBADSLT;
  82
  83         /* Similar for the realm */
  84         if (hr->realm) {
  85                 r = suitable_realm(hr->realm);
  86                 if (r < 0)
  87                         return r;
  88                 if (r == 0)
  89                         return -EINVAL;
  90         }
  91
  92         return 0;
  93 }
  94
  95 int home_new(Manager *m, UserRecord *hr, const char *sysfs, Home **ret) {
  96         _cleanup_(home_freep) Home *home = NULL;
  97         _cleanup_free_ char *nm = NULL, *ns = NULL;
  98         int r;
  99
 100         assert(m);
 101         assert(hr);
 102
 103         r = suitable_home_record(hr);
 104         if (r < 0)
 105                 return r;
 106
 107         if (hashmap_contains(m->homes_by_name, hr->user_name))
 108                 return -EBUSY;
 109
 110         if (hashmap_contains(m->homes_by_uid, UID_TO_PTR(hr->uid)))
 111                 return -EBUSY;
 112
 113         if (sysfs && hashmap_contains(m->homes_by_sysfs, sysfs))
 114                 return -EBUSY;
 115
 116         if (hashmap_size(m->homes_by_name) >= HOME_USERS_MAX)
 117                 return -EUSERS;
 118
 119         nm = strdup(hr->user_name);
 120         if (!nm)
 121                 return -ENOMEM;
 122
 123         if (sysfs) {
 124                 ns = strdup(sysfs);
 125                 if (!ns)
 126                         return -ENOMEM;
 127         }
 128
 129         home = new(Home, 1);
 130         if (!home)
 131                 return -ENOMEM;
 132
 133         *home = (Home) {
 134                 .manager = m,
 135                 .user_name = TAKE_PTR(nm),
 136                 .uid = hr->uid,
 137                 .state = _HOME_STATE_INVALID,
 138                 .worker_stdout_fd = -EBADF,
 139                 .sysfs = TAKE_PTR(ns),
 140                 .signed_locally = -1,
 141                 .pin_fd = -EBADF,
 142                 .luks_lock_fd = -EBADF,
 143         };
 144
 145         r = hashmap_put(m->homes_by_name, home->user_name, home);
 146         if (r < 0)
 147                 return r;
 148
 149         r = hashmap_put(m->homes_by_uid, UID_TO_PTR(home->uid), home);
 150         if (r < 0)
 151                 return r;
 152
 153         if (home->sysfs) {
 154                 r = hashmap_put(m->homes_by_sysfs, home->sysfs, home);
 155                 if (r < 0)
 156                         return r;
 157         }
 158
 159         r = user_record_clone(hr, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_PERMISSIVE, &home->record);
 160         if (r < 0)
 161                 return r;
 162
 163         (void) bus_manager_emit_auto_login_changed(m);
 164         (void) bus_home_emit_change(home);
 165         (void) manager_schedule_rebalance(m, /* immediately= */ false);
 166
 167         if (ret)
 168                 *ret = TAKE_PTR(home);
 169         else
 170                 TAKE_PTR(home);
 171
 172         return 0;
 173 }
 174
 175 Home *home_free(Home *h) {
 176
 177         if (!h)
 178                 return NULL;
 179
 180         if (h->manager) {
 181                 (void) bus_home_emit_remove(h);
 182                 (void) bus_manager_emit_auto_login_changed(h->manager);
 183
 184                 if (h->user_name)
 185                         (void) hashmap_remove_value(h->manager->homes_by_name, h->user_name, h);
 186
 187                 if (uid_is_valid(h->uid))
 188                         (void) hashmap_remove_value(h->manager->homes_by_uid, UID_TO_PTR(h->uid), h);
 189
 190                 if (h->sysfs)
 191                         (void) hashmap_remove_value(h->manager->homes_by_sysfs, h->sysfs, h);
 192
 193                 if (h->worker_pid > 0)
 194                         (void) hashmap_remove_value(h->manager->homes_by_worker_pid, PID_TO_PTR(h->worker_pid), h);
 195
 196                 if (h->manager->gc_focus == h)
 197                         h->manager->gc_focus = NULL;
 198
 199                 (void) manager_schedule_rebalance(h->manager, /* immediately= */ false);
 200         }
 201
 202         user_record_unref(h->record);
 203         user_record_unref(h->secret);
 204
 205         h->worker_event_source = sd_event_source_disable_unref(h->worker_event_source);
 206         safe_close(h->worker_stdout_fd);
 207         free(h->user_name);
 208         free(h->sysfs);
 209
 210         h->ref_event_source_please_suspend = sd_event_source_disable_unref(h->ref_event_source_please_suspend);
 211         h->ref_event_source_dont_suspend = sd_event_source_disable_unref(h->ref_event_source_dont_suspend);
 212
 213         h->pending_operations = ordered_set_free(h->pending_operations);
 214         h->pending_event_source = sd_event_source_disable_unref(h->pending_event_source);
 215         h->deferred_change_event_source = sd_event_source_disable_unref(h->deferred_change_event_source);
 216
 217         h->current_operation = operation_unref(h->current_operation);
 218
 219         safe_close(h->pin_fd);
 220         safe_close(h->luks_lock_fd);
 221
 222         h->retry_deactivate_event_source = sd_event_source_disable_unref(h->retry_deactivate_event_source);
 223
 224         return mfree(h);
 225 }
 226
 227 int home_set_record(Home *h, UserRecord *hr) {
 228         _cleanup_(user_record_unrefp) UserRecord *new_hr = NULL;
 229         Home *other;
 230         int r;
 231
 232         assert(h);
 233         assert(h->user_name);
 234         assert(h->record);
 235         assert(hr);
 236
 237         if (user_record_equal(h->record, hr))
 238                 return 0;
 239
 240         r = suitable_home_record(hr);
 241         if (r < 0)
 242                 return r;
 243
 244         if (!user_record_compatible(h->record, hr))
 245                 return -EREMCHG;
 246
 247         if (!FLAGS_SET(hr->mask, USER_RECORD_REGULAR) ||
 248             FLAGS_SET(hr->mask, USER_RECORD_SECRET))
 249                 return -EINVAL;
 250
 251         if (FLAGS_SET(h->record->mask, USER_RECORD_STATUS)) {
 252                 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 253
 254                 /* Hmm, the existing record has status fields? If so, copy them over */
 255
 256                 v = json_variant_ref(hr->json);
 257                 r = json_variant_set_field(&v, "status", json_variant_by_key(h->record->json, "status"));
 258                 if (r < 0)
 259                         return r;
 260
 261                 new_hr = user_record_new();
 262                 if (!new_hr)
 263                         return -ENOMEM;
 264
 265                 r = user_record_load(new_hr, v, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE);
 266                 if (r < 0)
 267                         return r;
 268
 269                 hr = new_hr;
 270         }
 271
 272         other = hashmap_get(h->manager->homes_by_uid, UID_TO_PTR(hr->uid));
 273         if (other && other != h)
 274                 return -EBUSY;
 275
 276         if (h->uid != hr->uid) {
 277                 r = hashmap_remove_and_replace(h->manager->homes_by_uid, UID_TO_PTR(h->uid), UID_TO_PTR(hr->uid), h);
 278                 if (r < 0)
 279                         return r;
 280         }
 281
 282         user_record_unref(h->record);
 283         h->record = user_record_ref(hr);
 284         h->uid = h->record->uid;
 285
 286         /* The updated record might have a different autologin setting, trigger a PropertiesChanged event for it */
 287         (void) bus_manager_emit_auto_login_changed(h->manager);
 288         (void) bus_home_emit_change(h);
 289
 290         return 0;
 291 }
 292
 293 int home_save_record(Home *h) {
 294         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 295         _cleanup_free_ char *text = NULL;
 296         const char *fn;
 297         int r;
 298
 299         assert(h);
 300
 301         v = json_variant_ref(h->record->json);
 302         r = json_variant_normalize(&v);
 303         if (r < 0)
 304                 log_warning_errno(r, "User record could not be normalized.");
 305
 306         r = json_variant_format(v, JSON_FORMAT_PRETTY|JSON_FORMAT_NEWLINE, &text);
 307         if (r < 0)
 308                 return r;
 309
 310         (void) mkdir("/var/lib/systemd/", 0755);
 311         (void) mkdir(home_record_dir(), 0700);
 312
 313         fn = strjoina(home_record_dir(), "/", h->user_name, ".identity");
 314
 315         r = write_string_file(fn, text, WRITE_STRING_FILE_ATOMIC|WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_MODE_0600|WRITE_STRING_FILE_SYNC);
 316         if (r < 0)
 317                 return r;
 318
 319         return 0;
 320 }
 321
 322 int home_unlink_record(Home *h) {
 323         const char *fn;
 324
 325         assert(h);
 326
 327         fn = strjoina(home_record_dir(), "/", h->user_name, ".identity");
 328         if (unlink(fn) < 0 && errno != ENOENT)
 329                 return -errno;
 330
 331         fn = strjoina("/run/systemd/home/", h->user_name, ".ref");
 332         if (unlink(fn) < 0 && errno != ENOENT)
 333                 return -errno;
 334
 335         return 0;
 336 }
 337
 338 static void home_unpin(Home *h) {
 339         assert(h);
 340
 341         if (h->pin_fd < 0)
 342                 return;
 343
 344         h->pin_fd = safe_close(h->pin_fd);
 345         log_debug("Successfully closed pin fd on home for %s.", h->user_name);
 346 }
 347
 348 static void home_pin(Home *h) {
 349         const char *path;
 350
 351         assert(h);
 352
 353         if (h->pin_fd >= 0) /* Already pinned? */
 354                 return;
 355
 356         path = user_record_home_directory(h->record);
 357         if (!path) {
 358                 log_warning("No home directory path to pin for %s, ignoring.", h->user_name);
 359                 return;
 360         }
 361
 362         h->pin_fd = open(path, O_RDONLY|O_DIRECTORY|O_CLOEXEC);
 363         if (h->pin_fd < 0) {
 364                 log_warning_errno(errno, "Couldn't open home directory '%s' for pinning, ignoring: %m", path);
 365                 return;
 366         }
 367
 368         log_debug("Successfully pinned home directory '%s'.", path);
 369 }
 370
 371 static void home_update_pin_fd(Home *h, HomeState state) {
 372         assert(h);
 373
 374         if (state < 0)
 375                 state = home_get_state(h);
 376
 377         return HOME_STATE_SHALL_PIN(state) ? home_pin(h) : home_unpin(h);
 378 }
 379
 380 static void home_maybe_close_luks_lock_fd(Home *h, HomeState state) {
 381         assert(h);
 382
 383         if (h->luks_lock_fd < 0)
 384                 return;
 385
 386         if (state < 0)
 387                 state = home_get_state(h);
 388
 389         /* Keep the lock as long as the home dir is active or has some operation going */
 390         if (HOME_STATE_IS_EXECUTING_OPERATION(state) || HOME_STATE_IS_ACTIVE(state) || state == HOME_LOCKED)
 391                 return;
 392
 393         h->luks_lock_fd = safe_close(h->luks_lock_fd);
 394         log_debug("Successfully closed LUKS backing file lock for %s.", h->user_name);
 395 }
 396
 397 static void home_maybe_stop_retry_deactivate(Home *h, HomeState state) {
 398         assert(h);
 399
 400         /* Free the deactivation retry event source if we won't need it anymore. Specifically, we'll free the
 401          * event source whenever the home directory is already deactivated (and we thus where successful) or
 402          * if we start executing an operation that indicates that the home directory is going to be used or
 403          * operated on again. Also, if the home is referenced again stop the timer */
 404
 405         if (HOME_STATE_MAY_RETRY_DEACTIVATE(state) &&
 406             !h->ref_event_source_dont_suspend &&
 407             !h->ref_event_source_please_suspend)
 408                 return;
 409
 410         h->retry_deactivate_event_source = sd_event_source_disable_unref(h->retry_deactivate_event_source);
 411 }
 412
 413 static int home_deactivate_internal(Home *h, bool force, sd_bus_error *error);
 414 static void home_start_retry_deactivate(Home *h);
 415
 416 static int home_on_retry_deactivate(sd_event_source *s, uint64_t usec, void *userdata) {
 417         Home *h = ASSERT_PTR(userdata);
 418         HomeState state;
 419
 420         assert(s);
 421
 422         /* 15s after the last attempt to deactivate the home directory passed. Let's try it one more time. */
 423
 424         h->retry_deactivate_event_source = sd_event_source_disable_unref(h->retry_deactivate_event_source);
 425
 426         state = home_get_state(h);
 427         if (!HOME_STATE_MAY_RETRY_DEACTIVATE(state))
 428                 return 0;
 429
 430         if (IN_SET(state, HOME_ACTIVE, HOME_LINGERING)) {
 431                 log_info("Again trying to deactivate home directory.");
 432
 433                 /* If we are not executing any operation, let's start deactivating now. Note that this will
 434                  * restart our timer again, we are gonna be called again if this doesn't work. */
 435                 (void) home_deactivate_internal(h, /* force= */ false, NULL);
 436         } else
 437                 /* if we are executing an operation (specifically, area already running a deactivation
 438                  * operation), then simply reque the timer, so that we retry again. */
 439                 home_start_retry_deactivate(h);
 440
 441         return 0;
 442 }
 443
 444 static void home_start_retry_deactivate(Home *h) {
 445         int r;
 446
 447         assert(h);
 448         assert(h->manager);
 449
 450         /* Already allocated? */
 451         if (h->retry_deactivate_event_source)
 452                 return;
 453
 454         /* If the home directory is being used now don't start the timer */
 455         if (h->ref_event_source_dont_suspend || h->ref_event_source_please_suspend)
 456                 return;
 457
 458         r = sd_event_add_time_relative(
 459                         h->manager->event,
 460                         &h->retry_deactivate_event_source,
 461                         CLOCK_MONOTONIC,
 462                         RETRY_DEACTIVATE_USEC,
 463                         1*USEC_PER_MINUTE,
 464                         home_on_retry_deactivate,
 465                         h);
 466         if (r < 0)
 467                 return (void) log_warning_errno(r, "Failed to install retry-deactivate event source, ignoring: %m");
 468
 469         (void) sd_event_source_set_description(h->retry_deactivate_event_source, "retry-deactivate");
 470 }
 471
 472 static void home_set_state(Home *h, HomeState state) {
 473         HomeState old_state, new_state;
 474
 475         assert(h);
 476
 477         old_state = home_get_state(h);
 478         h->state = state;
 479         new_state = home_get_state(h); /* Query the new state, since the 'state' variable might be set to -1,
 480                                         * in which case we synthesize an high-level state on demand */
 481
 482         log_info("%s: changing state %s %s %s", h->user_name,
 483                  home_state_to_string(old_state),
 484                  special_glyph(SPECIAL_GLYPH_ARROW_RIGHT),
 485                  home_state_to_string(new_state));
 486
 487         home_update_pin_fd(h, new_state);
 488         home_maybe_close_luks_lock_fd(h, new_state);
 489         home_maybe_stop_retry_deactivate(h, new_state);
 490
 491         if (HOME_STATE_IS_EXECUTING_OPERATION(old_state) && !HOME_STATE_IS_EXECUTING_OPERATION(new_state)) {
 492                 /* If we just finished executing some operation, process the queue of pending operations. And
 493                  * enqueue it for GC too. */
 494
 495                 home_schedule_operation(h, NULL, NULL);
 496                 manager_reschedule_rebalance(h->manager);
 497                 manager_enqueue_gc(h->manager, h);
 498         }
 499 }
 500
 501 static int home_parse_worker_stdout(int _fd, UserRecord **ret) {
 502         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 503         _cleanup_close_ int fd = _fd; /* take possession, even on failure */
 504         _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
 505         _cleanup_fclose_ FILE *f = NULL;
 506         unsigned line, column;
 507         struct stat st;
 508         int r;
 509
 510         if (fstat(fd, &st) < 0)
 511                 return log_error_errno(errno, "Failed to stat stdout fd: %m");
 512
 513         assert(S_ISREG(st.st_mode));
 514
 515         if (st.st_size == 0) { /* empty record */
 516                 *ret = NULL;
 517                 return 0;
 518         }
 519
 520         if (lseek(fd, SEEK_SET, 0) == (off_t) -1)
 521                 return log_error_errno(errno, "Failed to seek to beginning of memfd: %m");
 522
 523         f = take_fdopen(&fd, "r");
 524         if (!f)
 525                 return log_error_errno(errno, "Failed to reopen memfd: %m");
 526
 527         if (DEBUG_LOGGING) {
 528                 _cleanup_free_ char *text = NULL;
 529
 530                 r = read_full_stream(f, &text, NULL);
 531                 if (r < 0)
 532                         return log_error_errno(r, "Failed to read from client: %m");
 533
 534                 log_debug("Got from worker: %s", text);
 535                 rewind(f);
 536         }
 537
 538         r = json_parse_file(f, "stdout", JSON_PARSE_SENSITIVE, &v, &line, &column);
 539         if (r < 0)
 540                 return log_error_errno(r, "Failed to parse identity at %u:%u: %m", line, column);
 541
 542         hr = user_record_new();
 543         if (!hr)
 544                 return log_oom();
 545
 546         r = user_record_load(hr, v, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE);
 547         if (r < 0)
 548                 return log_error_errno(r, "Failed to load home record identity: %m");
 549
 550         *ret = TAKE_PTR(hr);
 551         return 1;
 552 }
 553
 554 static int home_verify_user_record(Home *h, UserRecord *hr, bool *ret_signed_locally, sd_bus_error *ret_error) {
 555         int is_signed;
 556
 557         assert(h);
 558         assert(hr);
 559         assert(ret_signed_locally);
 560
 561         is_signed = manager_verify_user_record(h->manager, hr);
 562         switch (is_signed) {
 563
 564         case USER_RECORD_SIGNED_EXCLUSIVE:
 565                 log_info("Home %s is signed exclusively by our key, accepting.", hr->user_name);
 566                 *ret_signed_locally = true;
 567                 return 0;
 568
 569         case USER_RECORD_SIGNED:
 570                 log_info("Home %s is signed by our key (and others), accepting.", hr->user_name);
 571                 *ret_signed_locally = false;
 572                 return 0;
 573
 574         case USER_RECORD_FOREIGN:
 575                 log_info("Home %s is signed by foreign key we like, accepting.", hr->user_name);
 576                 *ret_signed_locally = false;
 577                 return 0;
 578
 579         case USER_RECORD_UNSIGNED:
 580                 sd_bus_error_setf(ret_error, BUS_ERROR_BAD_SIGNATURE, "User record %s is not signed at all, refusing.", hr->user_name);
 581                 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Home %s contains user record that is not signed at all, refusing.", hr->user_name);
 582
 583         case -ENOKEY:
 584                 sd_bus_error_setf(ret_error, BUS_ERROR_BAD_SIGNATURE, "User record %s is not signed by any known key, refusing.", hr->user_name);
 585                 return log_error_errno(is_signed, "Home %s contains user record that is not signed by any known key, refusing.", hr->user_name);
 586
 587         default:
 588                 assert(is_signed < 0);
 589                 return log_error_errno(is_signed, "Failed to verify signature on user record for %s, refusing fixation: %m", hr->user_name);
 590         }
 591 }
 592
 593 static int convert_worker_errno(Home *h, int e, sd_bus_error *error) {
 594         /* Converts the error numbers the worker process returned into somewhat sensible dbus errors */
 595
 596         switch (e) {
 597
 598         case -EMSGSIZE:
 599                 return sd_bus_error_set(error, BUS_ERROR_BAD_HOME_SIZE, "File systems of this type cannot be shrunk");
 600         case -ETXTBSY:
 601                 return sd_bus_error_set(error, BUS_ERROR_BAD_HOME_SIZE, "File systems of this type can only be shrunk offline");
 602         case -ERANGE:
 603                 return sd_bus_error_set(error, BUS_ERROR_BAD_HOME_SIZE, "File system size too small");
 604         case -ENOLINK:
 605                 return sd_bus_error_set(error, SD_BUS_ERROR_NOT_SUPPORTED, "System does not support selected storage backend");
 606         case -EPROTONOSUPPORT:
 607                 return sd_bus_error_set(error, SD_BUS_ERROR_NOT_SUPPORTED, "System does not support selected file system");
 608         case -ENOTTY:
 609                 return sd_bus_error_set(error, SD_BUS_ERROR_NOT_SUPPORTED, "Operation not supported on storage backend");
 610         case -ESOCKTNOSUPPORT:
 611                 return sd_bus_error_set(error, SD_BUS_ERROR_NOT_SUPPORTED, "Operation not supported on file system");
 612         case -ENOKEY:
 613                 return sd_bus_error_setf(error, BUS_ERROR_BAD_PASSWORD, "Password for home %s is incorrect or not sufficient for authentication.", h->user_name);
 614         case -EBADSLT:
 615                 return sd_bus_error_setf(error, BUS_ERROR_BAD_PASSWORD_AND_NO_TOKEN, "Password for home %s is incorrect or not sufficient, and configured security token not found either.", h->user_name);
 616         case -EREMOTEIO:
 617                 return sd_bus_error_setf(error, BUS_ERROR_BAD_RECOVERY_KEY, "Recovery key for home %s is incorrect or not sufficient for authentication.", h->user_name);
 618         case -ENOANO:
 619                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_PIN_NEEDED, "PIN for security token required.");
 620         case -ERFKILL:
 621                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_PROTECTED_AUTHENTICATION_PATH_NEEDED, "Security token requires protected authentication path.");
 622         case -EMEDIUMTYPE:
 623                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_USER_PRESENCE_NEEDED, "Security token requires presence confirmation.");
 624         case -ENOCSI:
 625                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_USER_VERIFICATION_NEEDED, "Security token requires user verification.");
 626         case -ENOSTR:
 627                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_ACTION_TIMEOUT, "Token action timeout. (User was supposed to verify presence or similar, by interacting with the token, and didn't do that in time.)");
 628         case -EOWNERDEAD:
 629                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_PIN_LOCKED, "PIN of security token locked.");
 630         case -ENOLCK:
 631                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_BAD_PIN, "Bad PIN of security token.");
 632         case -ETOOMANYREFS:
 633                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_BAD_PIN_FEW_TRIES_LEFT, "Bad PIN of security token, and only a few tries left.");
 634         case -EUCLEAN:
 635                 return sd_bus_error_set(error, BUS_ERROR_TOKEN_BAD_PIN_ONE_TRY_LEFT, "Bad PIN of security token, and only one try left.");
 636         case -EBUSY:
 637                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "Home %s is currently being used, or an operation on home %s is currently being executed.", h->user_name, h->user_name);
 638         case -ENOEXEC:
 639                 return sd_bus_error_setf(error, BUS_ERROR_HOME_NOT_ACTIVE, "Home %s is currently not active", h->user_name);
 640         case -ENOSPC:
 641                 return sd_bus_error_setf(error, BUS_ERROR_NO_DISK_SPACE, "Not enough disk space for home %s", h->user_name);
 642         case -EKEYREVOKED:
 643                 return sd_bus_error_setf(error, BUS_ERROR_HOME_CANT_AUTHENTICATE, "Home %s has no password or other authentication mechanism defined.", h->user_name);
 644         case -EADDRINUSE:
 645                 return sd_bus_error_setf(error, BUS_ERROR_HOME_IN_USE, "Home %s is currently being used elsewhere.", h->user_name);
 646         }
 647
 648         return 0;
 649 }
 650
 651 static void home_count_bad_authentication(Home *h, bool save) {
 652         int r;
 653
 654         assert(h);
 655
 656         r = user_record_bad_authentication(h->record);
 657         if (r < 0) {
 658                 log_warning_errno(r, "Failed to increase bad authentication counter, ignoring: %m");
 659                 return;
 660         }
 661
 662         if (save) {
 663                 r = home_save_record(h);
 664                 if (r < 0)
 665                         log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
 666         }
 667 }
 668
 669 static void home_fixate_finish(Home *h, int ret, UserRecord *hr) {
 670         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 671         _cleanup_(user_record_unrefp) UserRecord *secret = NULL;
 672         bool signed_locally;
 673         int r;
 674
 675         assert(h);
 676         assert(IN_SET(h->state, HOME_FIXATING, HOME_FIXATING_FOR_ACTIVATION, HOME_FIXATING_FOR_ACQUIRE));
 677
 678         secret = TAKE_PTR(h->secret); /* Take possession */
 679
 680         if (ret < 0) {
 681                 if (ret == -ENOKEY)
 682                         (void) home_count_bad_authentication(h, false);
 683
 684                 (void) convert_worker_errno(h, ret, &error);
 685                 r = log_error_errno(ret, "Fixation failed: %m");
 686                 goto fail;
 687         }
 688         if (!hr) {
 689                 r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Did not receive user record from worker process, fixation failed.");
 690                 goto fail;
 691         }
 692
 693         r = home_verify_user_record(h, hr, &signed_locally, &error);
 694         if (r < 0)
 695                 goto fail;
 696
 697         r = home_set_record(h, hr);
 698         if (r < 0) {
 699                 log_error_errno(r, "Failed to update home record: %m");
 700                 goto fail;
 701         }
 702
 703         h->signed_locally = signed_locally;
 704
 705         /* When we finished fixating (and don't follow-up with activation), let's count this as good authentication */
 706         if (h->state == HOME_FIXATING) {
 707                 r = user_record_good_authentication(h->record);
 708                 if (r < 0)
 709                         log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
 710         }
 711
 712         r = home_save_record(h);
 713         if (r < 0)
 714                 log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
 715
 716         if (IN_SET(h->state, HOME_FIXATING_FOR_ACTIVATION, HOME_FIXATING_FOR_ACQUIRE)) {
 717
 718                 r = home_start_work(h, "activate", h->record, secret);
 719                 if (r < 0) {
 720                         h->current_operation = operation_result_unref(h->current_operation, r, NULL);
 721                         home_set_state(h, _HOME_STATE_INVALID);
 722                 } else
 723                         home_set_state(h, h->state == HOME_FIXATING_FOR_ACTIVATION ? HOME_ACTIVATING : HOME_ACTIVATING_FOR_ACQUIRE);
 724
 725                 return;
 726         }
 727
 728         log_debug("Fixation of %s completed.", h->user_name);
 729
 730         h->current_operation = operation_result_unref(h->current_operation, 0, NULL);
 731
 732         /* Reset the state to "invalid", which makes home_get_state() test if the image exists and returns
 733          * HOME_ABSENT vs. HOME_INACTIVE as necessary. */
 734         home_set_state(h, _HOME_STATE_INVALID);
 735         (void) manager_schedule_rebalance(h->manager, /* immediately= */ false);
 736         return;
 737
 738 fail:
 739         /* If fixation fails, we stay in unfixated state! */
 740         h->current_operation = operation_result_unref(h->current_operation, r, &error);
 741         home_set_state(h, HOME_UNFIXATED);
 742 }
 743
 744 static void home_activate_finish(Home *h, int ret, UserRecord *hr) {
 745         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 746         int r;
 747
 748         assert(h);
 749         assert(IN_SET(h->state, HOME_ACTIVATING, HOME_ACTIVATING_FOR_ACQUIRE));
 750
 751         if (ret < 0) {
 752                 if (ret == -ENOKEY)
 753                         home_count_bad_authentication(h, true);
 754
 755                 (void) convert_worker_errno(h, ret, &error);
 756                 r = log_error_errno(ret, "Activation failed: %m");
 757                 goto finish;
 758         }
 759
 760         if (hr) {
 761                 bool signed_locally;
 762
 763                 r = home_verify_user_record(h, hr, &signed_locally, &error);
 764                 if (r < 0)
 765                         goto finish;
 766
 767                 r = home_set_record(h, hr);
 768                 if (r < 0) {
 769                         log_error_errno(r, "Failed to update home record, ignoring: %m");
 770                         goto finish;
 771                 }
 772
 773                 h->signed_locally = signed_locally;
 774
 775                 r = user_record_good_authentication(h->record);
 776                 if (r < 0)
 777                         log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
 778
 779                 r = home_save_record(h);
 780                 if (r < 0)
 781                         log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
 782         }
 783
 784         log_debug("Activation of %s completed.", h->user_name);
 785         r = 0;
 786
 787 finish:
 788         h->current_operation = operation_result_unref(h->current_operation, r, &error);
 789         home_set_state(h, _HOME_STATE_INVALID);
 790
 791         if (r >= 0)
 792                 (void) manager_schedule_rebalance(h->manager, /* immediately= */ true);
 793 }
 794
 795 static void home_deactivate_finish(Home *h, int ret, UserRecord *hr) {
 796         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 797         int r;
 798
 799         assert(h);
 800         assert(h->state == HOME_DEACTIVATING);
 801         assert(!hr); /* We don't expect a record on this operation */
 802
 803         if (ret < 0) {
 804                 (void) convert_worker_errno(h, ret, &error);
 805                 r = log_error_errno(ret, "Deactivation of %s failed: %m", h->user_name);
 806                 goto finish;
 807         }
 808
 809         log_debug("Deactivation of %s completed.", h->user_name);
 810         r = 0;
 811
 812 finish:
 813         h->current_operation = operation_result_unref(h->current_operation, r, &error);
 814         home_set_state(h, _HOME_STATE_INVALID);
 815
 816         if (r >= 0)
 817                 (void) manager_schedule_rebalance(h->manager, /* immediately= */ true);
 818 }
 819
 820 static void home_remove_finish(Home *h, int ret, UserRecord *hr) {
 821         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 822         Manager *m;
 823         int r;
 824
 825         assert(h);
 826         assert(h->state == HOME_REMOVING);
 827         assert(!hr); /* We don't expect a record on this operation */
 828
 829         m = h->manager;
 830
 831         if (ret < 0 && ret != -EALREADY) {
 832                 (void) convert_worker_errno(h, ret, &error);
 833                 r = log_error_errno(ret, "Removing %s failed: %m", h->user_name);
 834                 goto fail;
 835         }
 836
 837         /* For a couple of storage types we can't delete the actual data storage when called (such as LUKS on
 838          * partitions like USB sticks, or so). Sometimes these storage locations are among those we normally
 839          * automatically discover in /home or in udev. When such a home is deleted let's hence issue a rescan
 840          * after completion, so that "unfixated" entries are rediscovered.  */
 841         if (!IN_SET(user_record_test_image_path(h->record), USER_TEST_UNDEFINED, USER_TEST_ABSENT))
 842                 manager_enqueue_rescan(m);
 843
 844         /* The image is now removed from disk. Now also remove our stored record */
 845         r = home_unlink_record(h);
 846         if (r < 0) {
 847                 log_error_errno(r, "Removing record file failed: %m");
 848                 goto fail;
 849         }
 850
 851         log_debug("Removal of %s completed.", h->user_name);
 852         h->current_operation = operation_result_unref(h->current_operation, 0, NULL);
 853
 854         /* Unload this record from memory too now. */
 855         h = home_free(h);
 856
 857         (void) manager_schedule_rebalance(m, /* immediately= */ true);
 858         return;
 859
 860 fail:
 861         h->current_operation = operation_result_unref(h->current_operation, r, &error);
 862         home_set_state(h, _HOME_STATE_INVALID);
 863 }
 864
 865 static void home_create_finish(Home *h, int ret, UserRecord *hr) {
 866         int r;
 867
 868         assert(h);
 869         assert(h->state == HOME_CREATING);
 870
 871         if (ret < 0) {
 872                 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 873
 874                 (void) convert_worker_errno(h, ret, &error);
 875                 log_error_errno(ret, "Operation on %s failed: %m", h->user_name);
 876                 h->current_operation = operation_result_unref(h->current_operation, ret, &error);
 877
 878                 if (h->unregister_on_failure) {
 879                         (void) home_unlink_record(h);
 880                         h = home_free(h);
 881                         return;
 882                 }
 883
 884                 home_set_state(h, _HOME_STATE_INVALID);
 885                 return;
 886         }
 887
 888         if (hr) {
 889                 r = home_set_record(h, hr);
 890                 if (r < 0)
 891                         log_warning_errno(r, "Failed to update home record, ignoring: %m");
 892         }
 893
 894         r = home_save_record(h);
 895         if (r < 0)
 896                 log_warning_errno(r, "Failed to save record to disk, ignoring: %m");
 897
 898         log_debug("Creation of %s completed.", h->user_name);
 899
 900         h->current_operation = operation_result_unref(h->current_operation, 0, NULL);
 901         home_set_state(h, _HOME_STATE_INVALID);
 902
 903         (void) manager_schedule_rebalance(h->manager, /* immediately= */ true);
 904 }
 905
 906 static void home_change_finish(Home *h, int ret, UserRecord *hr) {
 907         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 908         int r;
 909
 910         assert(h);
 911
 912         if (ret < 0) {
 913                 if (ret == -ENOKEY)
 914                         (void) home_count_bad_authentication(h, true);
 915
 916                 (void) convert_worker_errno(h, ret, &error);
 917                 r = log_error_errno(ret, "Change operation failed: %m");
 918                 goto finish;
 919         }
 920
 921         if (hr) {
 922                 r = home_set_record(h, hr);
 923                 if (r < 0)
 924                         log_warning_errno(r, "Failed to update home record, ignoring: %m");
 925                 else {
 926                         r = user_record_good_authentication(h->record);
 927                         if (r < 0)
 928                                 log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
 929
 930                         r = home_save_record(h);
 931                         if (r < 0)
 932                                 log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
 933                 }
 934         }
 935
 936         log_debug("Change operation of %s completed.", h->user_name);
 937         (void) manager_schedule_rebalance(h->manager, /* immediately= */ false);
 938         r = 0;
 939
 940 finish:
 941         h->current_operation = operation_result_unref(h->current_operation, r, &error);
 942         home_set_state(h, _HOME_STATE_INVALID);
 943 }
 944
 945 static void home_locking_finish(Home *h, int ret, UserRecord *hr) {
 946         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 947         int r;
 948
 949         assert(h);
 950         assert(h->state == HOME_LOCKING);
 951
 952         if (ret < 0) {
 953                 (void) convert_worker_errno(h, ret, &error);
 954                 r = log_error_errno(ret, "Locking operation failed: %m");
 955                 goto finish;
 956         }
 957
 958         log_debug("Locking operation of %s completed.", h->user_name);
 959         h->current_operation = operation_result_unref(h->current_operation, 0, NULL);
 960         home_set_state(h, HOME_LOCKED);
 961         return;
 962
 963 finish:
 964         /* If a specific home doesn't know the concept of locking, then that's totally OK, don't propagate
 965          * the error if we are executing a LockAllHomes() operation. */
 966
 967         if (h->current_operation->type == OPERATION_LOCK_ALL && r == -ENOTTY)
 968                 h->current_operation = operation_result_unref(h->current_operation, 0, NULL);
 969         else
 970                 h->current_operation = operation_result_unref(h->current_operation, r, &error);
 971
 972         home_set_state(h, _HOME_STATE_INVALID);
 973 }
 974
 975 static void home_unlocking_finish(Home *h, int ret, UserRecord *hr) {
 976         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 977         int r;
 978
 979         assert(h);
 980         assert(IN_SET(h->state, HOME_UNLOCKING, HOME_UNLOCKING_FOR_ACQUIRE));
 981
 982         if (ret < 0) {
 983                 if (ret == -ENOKEY)
 984                         (void) home_count_bad_authentication(h, true);
 985
 986                 (void) convert_worker_errno(h, ret, &error);
 987                 r = log_error_errno(ret, "Unlocking operation failed: %m");
 988
 989                 /* Revert to locked state */
 990                 home_set_state(h, HOME_LOCKED);
 991                 h->current_operation = operation_result_unref(h->current_operation, r, &error);
 992                 return;
 993         }
 994
 995         r = user_record_good_authentication(h->record);
 996         if (r < 0)
 997                 log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
 998         else {
 999                 r = home_save_record(h);
1000                 if (r < 0)
1001                         log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
1002         }
1003
1004         log_debug("Unlocking operation of %s completed.", h->user_name);
1005
1006         h->current_operation = operation_result_unref(h->current_operation, r, &error);
1007         home_set_state(h, _HOME_STATE_INVALID);
1008         return;
1009 }
1010
1011 static void home_authenticating_finish(Home *h, int ret, UserRecord *hr) {
1012         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1013         int r;
1014
1015         assert(h);
1016         assert(IN_SET(h->state, HOME_AUTHENTICATING, HOME_AUTHENTICATING_WHILE_ACTIVE, HOME_AUTHENTICATING_FOR_ACQUIRE));
1017
1018         if (ret < 0) {
1019                 if (ret == -ENOKEY)
1020                         (void) home_count_bad_authentication(h, true);
1021
1022                 (void) convert_worker_errno(h, ret, &error);
1023                 r = log_error_errno(ret, "Authentication failed: %m");
1024                 goto finish;
1025         }
1026
1027         if (hr) {
1028                 r = home_set_record(h, hr);
1029                 if (r < 0)
1030                         log_warning_errno(r, "Failed to update home record, ignoring: %m");
1031                 else {
1032                         r = user_record_good_authentication(h->record);
1033                         if (r < 0)
1034                                 log_warning_errno(r, "Failed to increase good authentication counter, ignoring: %m");
1035
1036                         r = home_save_record(h);
1037                         if (r < 0)
1038                                 log_warning_errno(r, "Failed to write home record to disk, ignoring: %m");
1039                 }
1040         }
1041
1042         log_debug("Authentication of %s completed.", h->user_name);
1043         r = 0;
1044
1045 finish:
1046         h->current_operation = operation_result_unref(h->current_operation, r, &error);
1047         home_set_state(h, _HOME_STATE_INVALID);
1048 }
1049
1050 static int home_on_worker_process(sd_event_source *s, const siginfo_t *si, void *userdata) {
1051         _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
1052         Home *h = ASSERT_PTR(userdata);
1053         int ret;
1054
1055         assert(s);
1056         assert(si);
1057
1058         assert(h->worker_pid == si->si_pid);
1059         assert(h->worker_event_source);
1060         assert(h->worker_stdout_fd >= 0);
1061
1062         (void) hashmap_remove_value(h->manager->homes_by_worker_pid, PID_TO_PTR(h->worker_pid), h);
1063
1064         h->worker_pid = 0;
1065         h->worker_event_source = sd_event_source_disable_unref(h->worker_event_source);
1066
1067         if (si->si_code != CLD_EXITED) {
1068                 assert(IN_SET(si->si_code, CLD_KILLED, CLD_DUMPED));
1069                 ret = log_debug_errno(SYNTHETIC_ERRNO(EPROTO), "Worker process died abnormally with signal %s.", signal_to_string(si->si_status));
1070         } else if (si->si_status != EXIT_SUCCESS) {
1071                 /* If we received an error code via sd_notify(), use it */
1072                 if (h->worker_error_code != 0)
1073                         ret = log_debug_errno(h->worker_error_code, "Worker reported error code %s.", errno_to_name(h->worker_error_code));
1074                 else
1075                         ret = log_debug_errno(SYNTHETIC_ERRNO(EPROTO), "Worker exited with exit code %i.", si->si_status);
1076         } else
1077                 ret = home_parse_worker_stdout(TAKE_FD(h->worker_stdout_fd), &hr);
1078
1079         h->worker_stdout_fd = safe_close(h->worker_stdout_fd);
1080
1081         switch (h->state) {
1082
1083         case HOME_FIXATING:
1084         case HOME_FIXATING_FOR_ACTIVATION:
1085         case HOME_FIXATING_FOR_ACQUIRE:
1086                 home_fixate_finish(h, ret, hr);
1087                 break;
1088
1089         case HOME_ACTIVATING:
1090         case HOME_ACTIVATING_FOR_ACQUIRE:
1091                 home_activate_finish(h, ret, hr);
1092                 break;
1093
1094         case HOME_DEACTIVATING:
1095                 home_deactivate_finish(h, ret, hr);
1096                 break;
1097
1098         case HOME_LOCKING:
1099                 home_locking_finish(h, ret, hr);
1100                 break;
1101
1102         case HOME_UNLOCKING:
1103         case HOME_UNLOCKING_FOR_ACQUIRE:
1104                 home_unlocking_finish(h, ret, hr);
1105                 break;
1106
1107         case HOME_CREATING:
1108                 home_create_finish(h, ret, hr);
1109                 break;
1110
1111         case HOME_REMOVING:
1112                 home_remove_finish(h, ret, hr);
1113                 break;
1114
1115         case HOME_UPDATING:
1116         case HOME_UPDATING_WHILE_ACTIVE:
1117         case HOME_RESIZING:
1118         case HOME_RESIZING_WHILE_ACTIVE:
1119         case HOME_PASSWD:
1120         case HOME_PASSWD_WHILE_ACTIVE:
1121                 home_change_finish(h, ret, hr);
1122                 break;
1123
1124         case HOME_AUTHENTICATING:
1125         case HOME_AUTHENTICATING_WHILE_ACTIVE:
1126         case HOME_AUTHENTICATING_FOR_ACQUIRE:
1127                 home_authenticating_finish(h, ret, hr);
1128                 break;
1129
1130         default:
1131                 assert_not_reached();
1132         }
1133
1134         return 0;
1135 }
1136
1137 static int home_start_work(Home *h, const char *verb, UserRecord *hr, UserRecord *secret) {
1138         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
1139         _cleanup_(erase_and_freep) char *formatted = NULL;
1140         _cleanup_close_ int stdin_fd = -EBADF, stdout_fd = -EBADF;
1141         pid_t pid = 0;
1142         int r;
1143
1144         assert(h);
1145         assert(verb);
1146         assert(hr);
1147
1148         if (h->worker_pid != 0)
1149                 return -EBUSY;
1150
1151         assert(h->worker_stdout_fd < 0);
1152         assert(!h->worker_event_source);
1153
1154         v = json_variant_ref(hr->json);
1155
1156         if (secret) {
1157                 JsonVariant *sub = NULL;
1158
1159                 sub = json_variant_by_key(secret->json, "secret");
1160                 if (!sub)
1161                         return -ENOKEY;
1162
1163                 r = json_variant_set_field(&v, "secret", sub);
1164                 if (r < 0)
1165                         return r;
1166         }
1167
1168         r = json_variant_format(v, 0, &formatted);
1169         if (r < 0)
1170                 return r;
1171
1172         stdin_fd = acquire_data_fd(formatted, strlen(formatted), 0);
1173         if (stdin_fd < 0)
1174                 return stdin_fd;
1175
1176         log_debug("Sending to worker: %s", formatted);
1177
1178         stdout_fd = memfd_create("homework-stdout", MFD_CLOEXEC);
1179         if (stdout_fd < 0)
1180                 return -errno;
1181
1182         r = safe_fork_full("(sd-homework)",
1183                            NULL,
1184                            (int[]) { stdin_fd, stdout_fd }, 2,
1185                            FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG|FORK_LOG|FORK_REOPEN_LOG, &pid);
1186         if (r < 0)
1187                 return r;
1188         if (r == 0) {
1189                 _cleanup_free_ char *joined = NULL;
1190                 const char *homework, *suffix, *unix_path;
1191
1192                 /* Child */
1193
1194                 suffix = getenv("SYSTEMD_HOME_DEBUG_SUFFIX");
1195                 if (suffix) {
1196                         joined = strjoin("/run/systemd/home/notify.", suffix);
1197                         if (!joined)
1198                                 return log_oom();
1199                         unix_path = joined;
1200                 } else
1201                         unix_path = "/run/systemd/home/notify";
1202
1203                 if (setenv("NOTIFY_SOCKET", unix_path, 1) < 0) {
1204                         log_error_errno(errno, "Failed to set $NOTIFY_SOCKET: %m");
1205                         _exit(EXIT_FAILURE);
1206                 }
1207
1208                 /* If we haven't locked the device yet, ask for a lock to be taken and be passed back to us via sd_notify(). */
1209                 if (setenv("SYSTEMD_LUKS_LOCK", one_zero(h->luks_lock_fd < 0), 1) < 0) {
1210                         log_error_errno(errno, "Failed to set $SYSTEMD_LUKS_LOCK: %m");
1211                         _exit(EXIT_FAILURE);
1212                 }
1213
1214                 if (h->manager->default_storage >= 0)
1215                         if (setenv("SYSTEMD_HOME_DEFAULT_STORAGE", user_storage_to_string(h->manager->default_storage), 1) < 0) {
1216                                 log_error_errno(errno, "Failed to set $SYSTEMD_HOME_DEFAULT_STORAGE: %m");
1217                                 _exit(EXIT_FAILURE);
1218                         }
1219
1220                 if (h->manager->default_file_system_type)
1221                         if (setenv("SYSTEMD_HOME_DEFAULT_FILE_SYSTEM_TYPE", h->manager->default_file_system_type, 1) < 0) {
1222                                 log_error_errno(errno, "Failed to set $SYSTEMD_HOME_DEFAULT_FILE_SYSTEM_TYPE: %m");
1223                                 _exit(EXIT_FAILURE);
1224                         }
1225
1226                 r = setenv_systemd_exec_pid(true);
1227                 if (r < 0)
1228                         log_warning_errno(r, "Failed to update $SYSTEMD_EXEC_PID, ignoring: %m");
1229
1230                 r = rearrange_stdio(TAKE_FD(stdin_fd), TAKE_FD(stdout_fd), STDERR_FILENO); /* fds are invalidated by rearrange_stdio() even on failure */
1231                 if (r < 0) {
1232                         log_error_errno(r, "Failed to rearrange stdin/stdout/stderr: %m");
1233                         _exit(EXIT_FAILURE);
1234                 }
1235
1236
1237                 /* Allow overriding the homework path via an environment variable, to make debugging
1238                  * easier. */
1239                 homework = getenv("SYSTEMD_HOMEWORK_PATH") ?: SYSTEMD_HOMEWORK_PATH;
1240
1241                 execl(homework, homework, verb, NULL);
1242                 log_error_errno(errno, "Failed to invoke %s: %m", homework);
1243                 _exit(EXIT_FAILURE);
1244         }
1245
1246         r = sd_event_add_child(h->manager->event, &h->worker_event_source, pid, WEXITED, home_on_worker_process, h);
1247         if (r < 0)
1248                 return r;
1249
1250         (void) sd_event_source_set_description(h->worker_event_source, "worker");
1251
1252         r = hashmap_put(h->manager->homes_by_worker_pid, PID_TO_PTR(pid), h);
1253         if (r < 0) {
1254                 h->worker_event_source = sd_event_source_disable_unref(h->worker_event_source);
1255                 return r;
1256         }
1257
1258         h->worker_stdout_fd = TAKE_FD(stdout_fd);
1259         h->worker_pid = pid;
1260         h->worker_error_code = 0;
1261
1262         return 0;
1263 }
1264
1265 static int home_ratelimit(Home *h, sd_bus_error *error) {
1266         int r, ret;
1267
1268         assert(h);
1269
1270         ret = user_record_ratelimit(h->record);
1271         if (ret < 0)
1272                 return ret;
1273
1274         if (h->state != HOME_UNFIXATED) {
1275                 r = home_save_record(h);
1276                 if (r < 0)
1277                         log_warning_errno(r, "Failed to save updated record, ignoring: %m");
1278         }
1279
1280         if (ret == 0) {
1281                 usec_t t, n;
1282
1283                 n = now(CLOCK_REALTIME);
1284                 t = user_record_ratelimit_next_try(h->record);
1285
1286                 if (t != USEC_INFINITY && t > n)
1287                         return sd_bus_error_setf(error, BUS_ERROR_AUTHENTICATION_LIMIT_HIT,
1288                                                  "Too many login attempts, please try again in %s!",
1289                                                  FORMAT_TIMESPAN(t - n, USEC_PER_SEC));
1290
1291                 return sd_bus_error_set(error, BUS_ERROR_AUTHENTICATION_LIMIT_HIT, "Too many login attempts, please try again later.");
1292         }
1293
1294         return 0;
1295 }
1296
1297 static int home_fixate_internal(
1298                 Home *h,
1299                 UserRecord *secret,
1300                 HomeState for_state,
1301                 sd_bus_error *error) {
1302
1303         int r;
1304
1305         assert(h);
1306         assert(IN_SET(for_state, HOME_FIXATING, HOME_FIXATING_FOR_ACTIVATION, HOME_FIXATING_FOR_ACQUIRE));
1307
1308         r = home_start_work(h, "inspect", h->record, secret);
1309         if (r < 0)
1310                 return r;
1311
1312         if (IN_SET(for_state, HOME_FIXATING_FOR_ACTIVATION, HOME_FIXATING_FOR_ACQUIRE)) {
1313                 /* Remember the secret data, since we need it for the activation again, later on. */
1314                 user_record_unref(h->secret);
1315                 h->secret = user_record_ref(secret);
1316         }
1317
1318         home_set_state(h, for_state);
1319         return 0;
1320 }
1321
1322 int home_fixate(Home *h, UserRecord *secret, sd_bus_error *error) {
1323         int r;
1324
1325         assert(h);
1326
1327         switch (home_get_state(h)) {
1328         case HOME_ABSENT:
1329                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1330         case HOME_INACTIVE:
1331         case HOME_DIRTY:
1332         case HOME_ACTIVE:
1333         case HOME_LINGERING:
1334         case HOME_LOCKED:
1335                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ALREADY_FIXATED, "Home %s is already fixated.", h->user_name);
1336         case HOME_UNFIXATED:
1337                 break;
1338         default:
1339                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1340         }
1341
1342         r = home_ratelimit(h, error);
1343         if (r < 0)
1344                 return r;
1345
1346         return home_fixate_internal(h, secret, HOME_FIXATING, error);
1347 }
1348
1349 static int home_activate_internal(Home *h, UserRecord *secret, HomeState for_state, sd_bus_error *error) {
1350         int r;
1351
1352         assert(h);
1353         assert(IN_SET(for_state, HOME_ACTIVATING, HOME_ACTIVATING_FOR_ACQUIRE));
1354
1355         r = home_start_work(h, "activate", h->record, secret);
1356         if (r < 0)
1357                 return r;
1358
1359         home_set_state(h, for_state);
1360         return 0;
1361 }
1362
1363 int home_activate(Home *h, UserRecord *secret, sd_bus_error *error) {
1364         int r;
1365
1366         assert(h);
1367
1368         switch (home_get_state(h)) {
1369         case HOME_UNFIXATED:
1370                 return home_fixate_internal(h, secret, HOME_FIXATING_FOR_ACTIVATION, error);
1371         case HOME_ABSENT:
1372                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1373         case HOME_ACTIVE:
1374                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ALREADY_ACTIVE, "Home %s is already active.", h->user_name);
1375         case HOME_LINGERING:
1376                 /* If we are lingering, i.e. active but are supposed to be deactivated, then cancel this
1377                  * timer if the user explicitly asks us to be active */
1378                 h->retry_deactivate_event_source = sd_event_source_disable_unref(h->retry_deactivate_event_source);
1379                 return 0;
1380         case HOME_LOCKED:
1381                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1382         case HOME_INACTIVE:
1383         case HOME_DIRTY:
1384                 break;
1385         default:
1386                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1387         }
1388
1389         r = home_ratelimit(h, error);
1390         if (r < 0)
1391                 return r;
1392
1393         return home_activate_internal(h, secret, HOME_ACTIVATING, error);
1394 }
1395
1396 static int home_authenticate_internal(Home *h, UserRecord *secret, HomeState for_state, sd_bus_error *error) {
1397         int r;
1398
1399         assert(h);
1400         assert(IN_SET(for_state, HOME_AUTHENTICATING, HOME_AUTHENTICATING_WHILE_ACTIVE, HOME_AUTHENTICATING_FOR_ACQUIRE));
1401
1402         r = home_start_work(h, "inspect", h->record, secret);
1403         if (r < 0)
1404                 return r;
1405
1406         home_set_state(h, for_state);
1407         return 0;
1408 }
1409
1410 int home_authenticate(Home *h, UserRecord *secret, sd_bus_error *error) {
1411         HomeState state;
1412         int r;
1413
1414         assert(h);
1415
1416         state = home_get_state(h);
1417         switch (state) {
1418         case HOME_ABSENT:
1419                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1420         case HOME_LOCKED:
1421                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1422         case HOME_UNFIXATED:
1423         case HOME_INACTIVE:
1424         case HOME_DIRTY:
1425         case HOME_ACTIVE:
1426         case HOME_LINGERING:
1427                 break;
1428         default:
1429                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1430         }
1431
1432         r = home_ratelimit(h, error);
1433         if (r < 0)
1434                 return r;
1435
1436         return home_authenticate_internal(h, secret, HOME_STATE_IS_ACTIVE(state) ? HOME_AUTHENTICATING_WHILE_ACTIVE : HOME_AUTHENTICATING, error);
1437 }
1438
1439 static int home_deactivate_internal(Home *h, bool force, sd_bus_error *error) {
1440         int r;
1441
1442         assert(h);
1443
1444         home_unpin(h); /* unpin so that we can deactivate */
1445
1446         r = home_start_work(h, force ? "deactivate-force" : "deactivate", h->record, NULL);
1447         if (r < 0)
1448                 /* Operation failed before it even started, reacquire pin fd, if state still dictates so */
1449                 home_update_pin_fd(h, _HOME_STATE_INVALID);
1450         else {
1451                 home_set_state(h, HOME_DEACTIVATING);
1452                 r = 0;
1453         }
1454
1455         /* Let's start a timer to retry deactivation in 15. We'll stop the timer once we manage to deactivate
1456          * the home directory again, or we start any other operation. */
1457         home_start_retry_deactivate(h);
1458
1459         return r;
1460 }
1461
1462 int home_deactivate(Home *h, bool force, sd_bus_error *error) {
1463         assert(h);
1464
1465         switch (home_get_state(h)) {
1466         case HOME_UNFIXATED:
1467         case HOME_ABSENT:
1468         case HOME_INACTIVE:
1469         case HOME_DIRTY:
1470                 return sd_bus_error_setf(error, BUS_ERROR_HOME_NOT_ACTIVE, "Home %s not active.", h->user_name);
1471         case HOME_LOCKED:
1472                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1473         case HOME_ACTIVE:
1474         case HOME_LINGERING:
1475                 break;
1476         default:
1477                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1478         }
1479
1480         return home_deactivate_internal(h, force, error);
1481 }
1482
1483 int home_create(Home *h, UserRecord *secret, sd_bus_error *error) {
1484         int r;
1485
1486         assert(h);
1487
1488         switch (home_get_state(h)) {
1489         case HOME_INACTIVE: {
1490                 int t;
1491
1492                 if (h->record->storage < 0)
1493                         break; /* if no storage is defined we don't know what precisely to look for, hence
1494                                 * HOME_INACTIVE is OK in that case too. */
1495
1496                 t = user_record_test_image_path(h->record);
1497                 if (IN_SET(t, USER_TEST_MAYBE, USER_TEST_UNDEFINED))
1498                         break; /* And if the image path test isn't conclusive, let's also go on */
1499
1500                 if (IN_SET(t, -EBADF, -ENOTDIR))
1501                         return sd_bus_error_setf(error, BUS_ERROR_HOME_EXISTS, "Selected home image of user %s already exists or has wrong inode type.", h->user_name);
1502
1503                 return sd_bus_error_setf(error, BUS_ERROR_HOME_EXISTS, "Selected home image of user %s already exists.", h->user_name);
1504         }
1505         case HOME_UNFIXATED:
1506         case HOME_DIRTY:
1507                 return sd_bus_error_setf(error, BUS_ERROR_HOME_EXISTS, "Home of user %s already exists.", h->user_name);
1508         case HOME_ABSENT:
1509                 break;
1510         case HOME_ACTIVE:
1511         case HOME_LINGERING:
1512         case HOME_LOCKED:
1513         default:
1514                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "Home %s is currently being used, or an operation on home %s is currently being executed.", h->user_name, h->user_name);
1515         }
1516
1517         if (h->record->enforce_password_policy == false)
1518                 log_debug("Password quality check turned off for account, skipping.");
1519         else {
1520                 r = user_record_quality_check_password(h->record, secret, error);
1521                 if (r < 0)
1522                         return r;
1523         }
1524
1525         r = home_start_work(h, "create", h->record, secret);
1526         if (r < 0)
1527                 return r;
1528
1529         home_set_state(h, HOME_CREATING);
1530         return 0;
1531 }
1532
1533 int home_remove(Home *h, sd_bus_error *error) {
1534         HomeState state;
1535         int r;
1536
1537         assert(h);
1538
1539         state = home_get_state(h);
1540         switch (state) {
1541         case HOME_ABSENT: /* If the home directory is absent, then this is just like unregistering */
1542                 return home_unregister(h, error);
1543         case HOME_LOCKED:
1544                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1545         case HOME_UNFIXATED:
1546         case HOME_INACTIVE:
1547         case HOME_DIRTY:
1548                 break;
1549         case HOME_ACTIVE:
1550         case HOME_LINGERING:
1551         default:
1552                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "Home %s is currently being used, or an operation on home %s is currently being executed.", h->user_name, h->user_name);
1553         }
1554
1555         r = home_start_work(h, "remove", h->record, NULL);
1556         if (r < 0)
1557                 return r;
1558
1559         home_set_state(h, HOME_REMOVING);
1560         return 0;
1561 }
1562
1563 static int user_record_extend_with_binding(UserRecord *hr, UserRecord *with_binding, UserRecordLoadFlags flags, UserRecord **ret) {
1564         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
1565         _cleanup_(user_record_unrefp) UserRecord *nr = NULL;
1566         JsonVariant *binding;
1567         int r;
1568
1569         assert(hr);
1570         assert(with_binding);
1571         assert(ret);
1572
1573         assert_se(v = json_variant_ref(hr->json));
1574
1575         binding = json_variant_by_key(with_binding->json, "binding");
1576         if (binding) {
1577                 r = json_variant_set_field(&v, "binding", binding);
1578                 if (r < 0)
1579                         return r;
1580         }
1581
1582         nr = user_record_new();
1583         if (!nr)
1584                 return -ENOMEM;
1585
1586         r = user_record_load(nr, v, flags);
1587         if (r < 0)
1588                 return r;
1589
1590         *ret = TAKE_PTR(nr);
1591         return 0;
1592 }
1593
1594 static int home_update_internal(
1595                 Home *h,
1596                 const char *verb,
1597                 UserRecord *hr,
1598                 UserRecord *secret,
1599                 sd_bus_error *error) {
1600
1601         _cleanup_(user_record_unrefp) UserRecord *new_hr = NULL, *saved_secret = NULL, *signed_hr = NULL;
1602         int r, c;
1603
1604         assert(h);
1605         assert(verb);
1606         assert(hr);
1607
1608         if (!user_record_compatible(hr, h->record))
1609                 return sd_bus_error_set(error, BUS_ERROR_HOME_RECORD_MISMATCH, "Updated user record is not compatible with existing one.");
1610         c = user_record_compare_last_change(hr, h->record); /* refuse downgrades */
1611         if (c < 0)
1612                 return sd_bus_error_set(error, BUS_ERROR_HOME_RECORD_DOWNGRADE, "Refusing to update to older home record.");
1613
1614         if (!secret && FLAGS_SET(hr->mask, USER_RECORD_SECRET)) {
1615                 r = user_record_clone(hr, USER_RECORD_EXTRACT_SECRET|USER_RECORD_PERMISSIVE, &saved_secret);
1616                 if (r < 0)
1617                         return r;
1618
1619                 secret = saved_secret;
1620         }
1621
1622         r = manager_verify_user_record(h->manager, hr);
1623         switch (r) {
1624
1625         case USER_RECORD_UNSIGNED:
1626                 if (h->signed_locally <= 0) /* If the existing record is not owned by us, don't accept an
1627                                              * unsigned new record. i.e. only implicitly sign new records
1628                                              * that where previously signed by us too. */
1629                         return sd_bus_error_setf(error, BUS_ERROR_HOME_RECORD_SIGNED, "Home %s is signed and cannot be modified locally.", h->user_name);
1630
1631                 /* The updated record is not signed, then do so now */
1632                 r = manager_sign_user_record(h->manager, hr, &signed_hr, error);
1633                 if (r < 0)
1634                         return r;
1635
1636                 hr = signed_hr;
1637                 break;
1638
1639         case USER_RECORD_SIGNED_EXCLUSIVE:
1640         case USER_RECORD_SIGNED:
1641         case USER_RECORD_FOREIGN:
1642                 /* Has already been signed. Great! */
1643                 break;
1644
1645         case -ENOKEY:
1646         default:
1647                 return r;
1648         }
1649
1650         r = user_record_extend_with_binding(hr, h->record, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_PERMISSIVE, &new_hr);
1651         if (r < 0)
1652                 return r;
1653
1654         if (c == 0) {
1655                 /* different payload but same lastChangeUSec field? That's not cool! */
1656
1657                 r = user_record_masked_equal(new_hr, h->record, USER_RECORD_REGULAR|USER_RECORD_PRIVILEGED|USER_RECORD_PER_MACHINE);
1658                 if (r < 0)
1659                         return r;
1660                 if (r == 0)
1661                         return sd_bus_error_set(error, BUS_ERROR_HOME_RECORD_MISMATCH, "Home record different but timestamp remained the same, refusing.");
1662         }
1663
1664         r = home_start_work(h, verb, new_hr, secret);
1665         if (r < 0)
1666                 return r;
1667
1668         return 0;
1669 }
1670
1671 int home_update(Home *h, UserRecord *hr, sd_bus_error *error) {
1672         HomeState state;
1673         int r;
1674
1675         assert(h);
1676         assert(hr);
1677
1678         state = home_get_state(h);
1679         switch (state) {
1680         case HOME_UNFIXATED:
1681                 return sd_bus_error_setf(error, BUS_ERROR_HOME_UNFIXATED, "Home %s has not been fixated yet.", h->user_name);
1682         case HOME_ABSENT:
1683                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1684         case HOME_LOCKED:
1685                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1686         case HOME_INACTIVE:
1687         case HOME_DIRTY:
1688         case HOME_ACTIVE:
1689         case HOME_LINGERING:
1690                 break;
1691         default:
1692                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1693         }
1694
1695         r = home_ratelimit(h, error);
1696         if (r < 0)
1697                 return r;
1698
1699         r = home_update_internal(h, "update", hr, NULL, error);
1700         if (r < 0)
1701                 return r;
1702
1703         home_set_state(h, HOME_STATE_IS_ACTIVE(state) ? HOME_UPDATING_WHILE_ACTIVE : HOME_UPDATING);
1704         return 0;
1705 }
1706
1707 int home_resize(Home *h,
1708                 uint64_t disk_size,
1709                 UserRecord *secret,
1710                 bool automatic,
1711                 sd_bus_error *error) {
1712
1713         _cleanup_(user_record_unrefp) UserRecord *c = NULL;
1714         HomeState state;
1715         int r;
1716
1717         assert(h);
1718
1719         state = home_get_state(h);
1720         switch (state) {
1721         case HOME_UNFIXATED:
1722                 return sd_bus_error_setf(error, BUS_ERROR_HOME_UNFIXATED, "Home %s has not been fixated yet.", h->user_name);
1723         case HOME_ABSENT:
1724                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1725         case HOME_LOCKED:
1726                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1727         case HOME_INACTIVE:
1728         case HOME_DIRTY:
1729         case HOME_ACTIVE:
1730         case HOME_LINGERING:
1731                 break;
1732         default:
1733                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1734         }
1735
1736         r = home_ratelimit(h, error);
1737         if (r < 0)
1738                 return r;
1739
1740         /* If the user didn't specify any size explicitly and rebalancing is on, then the disk size is
1741          * determined by automatic rebalancing and hence not user configured but determined by us and thus
1742          * applied anyway. */
1743         if (disk_size == UINT64_MAX && h->record->rebalance_weight != REBALANCE_WEIGHT_OFF)
1744                 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Disk size is being determined by automatic disk space rebalancing.");
1745
1746         if (disk_size == UINT64_MAX || disk_size == h->record->disk_size) {
1747                 if (h->record->disk_size == UINT64_MAX)
1748                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "No disk size to resize to specified.");
1749
1750                 c = user_record_ref(h->record); /* Shortcut if size is unspecified or matches the record */
1751         } else {
1752                 _cleanup_(user_record_unrefp) UserRecord *signed_c = NULL;
1753
1754                 if (h->signed_locally <= 0) /* Don't allow changing of records not signed only by us */
1755                         return sd_bus_error_setf(error, BUS_ERROR_HOME_RECORD_SIGNED, "Home %s is signed and cannot be modified locally.", h->user_name);
1756
1757                 r = user_record_clone(h->record, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE, &c);
1758                 if (r < 0)
1759                         return r;
1760
1761                 r = user_record_set_disk_size(c, disk_size);
1762                 if (r == -ERANGE)
1763                         return sd_bus_error_setf(error, BUS_ERROR_BAD_HOME_SIZE, "Requested size for home %s out of acceptable range.", h->user_name);
1764                 if (r < 0)
1765                         return r;
1766
1767                 /* If user picked an explicit size, then turn off rebalancing, so that we don't undo what user chose */
1768                 r = user_record_set_rebalance_weight(c, REBALANCE_WEIGHT_OFF);
1769                 if (r < 0)
1770                         return r;
1771
1772                 r = user_record_update_last_changed(c, false);
1773                 if (r == -ECHRNG)
1774                         return sd_bus_error_setf(error, BUS_ERROR_HOME_RECORD_MISMATCH, "Record last change time of %s is newer than current time, cannot update.", h->user_name);
1775                 if (r < 0)
1776                         return r;
1777
1778                 r = manager_sign_user_record(h->manager, c, &signed_c, error);
1779                 if (r < 0)
1780                         return r;
1781
1782                 user_record_unref(c);
1783                 c = TAKE_PTR(signed_c);
1784         }
1785
1786         r = home_update_internal(h, automatic ? "resize-auto" : "resize", c, secret, error);
1787         if (r < 0)
1788                 return r;
1789
1790         home_set_state(h, HOME_STATE_IS_ACTIVE(state) ? HOME_RESIZING_WHILE_ACTIVE : HOME_RESIZING);
1791         return 0;
1792 }
1793
1794 static int home_may_change_password(
1795                 Home *h,
1796                 sd_bus_error *error) {
1797
1798         int r;
1799
1800         assert(h);
1801
1802         r = user_record_test_password_change_required(h->record);
1803         if (IN_SET(r, -EKEYREVOKED, -EOWNERDEAD, -EKEYEXPIRED, -ESTALE))
1804                 return 0; /* expired in some form, but changing is allowed */
1805         if (IN_SET(r, -EKEYREJECTED, -EROFS))
1806                 return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Expiration settings of account %s do not allow changing of password.", h->user_name);
1807         if (r < 0)
1808                 return log_error_errno(r, "Failed to test password expiry: %m");
1809
1810         return 0; /* not expired */
1811 }
1812
1813 int home_passwd(Home *h,
1814                 UserRecord *new_secret,
1815                 UserRecord *old_secret,
1816                 sd_bus_error *error) {
1817
1818         _cleanup_(user_record_unrefp) UserRecord *c = NULL, *merged_secret = NULL, *signed_c = NULL;
1819         HomeState state;
1820         int r;
1821
1822         assert(h);
1823
1824         if (h->signed_locally <= 0) /* Don't allow changing of records not signed only by us */
1825                 return sd_bus_error_setf(error, BUS_ERROR_HOME_RECORD_SIGNED, "Home %s is signed and cannot be modified locally.", h->user_name);
1826
1827         state = home_get_state(h);
1828         switch (state) {
1829         case HOME_UNFIXATED:
1830                 return sd_bus_error_setf(error, BUS_ERROR_HOME_UNFIXATED, "Home %s has not been fixated yet.", h->user_name);
1831         case HOME_ABSENT:
1832                 return sd_bus_error_setf(error, BUS_ERROR_HOME_ABSENT, "Home %s is currently missing or not plugged in.", h->user_name);
1833         case HOME_LOCKED:
1834                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1835         case HOME_INACTIVE:
1836         case HOME_DIRTY:
1837         case HOME_ACTIVE:
1838         case HOME_LINGERING:
1839                 break;
1840         default:
1841                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1842         }
1843
1844         r = home_ratelimit(h, error);
1845         if (r < 0)
1846                 return r;
1847
1848         r = home_may_change_password(h, error);
1849         if (r < 0)
1850                 return r;
1851
1852         r = user_record_clone(h->record, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_PERMISSIVE, &c);
1853         if (r < 0)
1854                 return r;
1855
1856         merged_secret = user_record_new();
1857         if (!merged_secret)
1858                 return -ENOMEM;
1859
1860         r = user_record_merge_secret(merged_secret, old_secret);
1861         if (r < 0)
1862                 return r;
1863
1864         r = user_record_merge_secret(merged_secret, new_secret);
1865         if (r < 0)
1866                 return r;
1867
1868         if (!strv_isempty(new_secret->password)) {
1869                 /* Update the password only if one is specified, otherwise let's just reuse the old password
1870                  * data. This is useful as a way to propagate updated user records into the LUKS backends
1871                  * properly. */
1872
1873                 r = user_record_make_hashed_password(c, new_secret->password, /* extend = */ false);
1874                 if (r < 0)
1875                         return r;
1876
1877                 r = user_record_set_password_change_now(c, -1 /* remove */);
1878                 if (r < 0)
1879                         return r;
1880         }
1881
1882         r = user_record_update_last_changed(c, true);
1883         if (r == -ECHRNG)
1884                 return sd_bus_error_setf(error, BUS_ERROR_HOME_RECORD_MISMATCH, "Record last change time of %s is newer than current time, cannot update.", h->user_name);
1885         if (r < 0)
1886                 return r;
1887
1888         r = manager_sign_user_record(h->manager, c, &signed_c, error);
1889         if (r < 0)
1890                 return r;
1891
1892         if (c->enforce_password_policy == false)
1893                 log_debug("Password quality check turned off for account, skipping.");
1894         else {
1895                 r = user_record_quality_check_password(c, merged_secret, error);
1896                 if (r < 0)
1897                         return r;
1898         }
1899
1900         r = home_update_internal(h, "passwd", signed_c, merged_secret, error);
1901         if (r < 0)
1902                 return r;
1903
1904         home_set_state(h, HOME_STATE_IS_ACTIVE(state) ? HOME_PASSWD_WHILE_ACTIVE : HOME_PASSWD);
1905         return 0;
1906 }
1907
1908 int home_unregister(Home *h, sd_bus_error *error) {
1909         int r;
1910
1911         assert(h);
1912
1913         switch (home_get_state(h)) {
1914         case HOME_UNFIXATED:
1915                 return sd_bus_error_setf(error, BUS_ERROR_HOME_UNFIXATED, "Home %s is not registered.", h->user_name);
1916         case HOME_LOCKED:
1917                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
1918         case HOME_ABSENT:
1919         case HOME_INACTIVE:
1920         case HOME_DIRTY:
1921                 break;
1922         case HOME_ACTIVE:
1923         case HOME_LINGERING:
1924         default:
1925                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "Home %s is currently being used, or an operation on home %s is currently being executed.", h->user_name, h->user_name);
1926         }
1927
1928         r = home_unlink_record(h);
1929         if (r < 0)
1930                 return r;
1931
1932         /* And destroy the whole entry. The caller needs to be prepared for that. */
1933         h = home_free(h);
1934         return 1;
1935 }
1936
1937 int home_lock(Home *h, sd_bus_error *error) {
1938         int r;
1939
1940         assert(h);
1941
1942         switch (home_get_state(h)) {
1943         case HOME_UNFIXATED:
1944         case HOME_ABSENT:
1945         case HOME_INACTIVE:
1946         case HOME_DIRTY:
1947                 return sd_bus_error_setf(error, BUS_ERROR_HOME_NOT_ACTIVE, "Home %s is not active.", h->user_name);
1948         case HOME_LOCKED:
1949                 return sd_bus_error_setf(error, BUS_ERROR_HOME_LOCKED, "Home %s is already locked.", h->user_name);
1950         case HOME_ACTIVE:
1951         case HOME_LINGERING:
1952                 break;
1953         default:
1954                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1955         }
1956
1957         r = home_start_work(h, "lock", h->record, NULL);
1958         if (r < 0)
1959                 return r;
1960
1961         home_set_state(h, HOME_LOCKING);
1962         return 0;
1963 }
1964
1965 static int home_unlock_internal(Home *h, UserRecord *secret, HomeState for_state, sd_bus_error *error) {
1966         int r;
1967
1968         assert(h);
1969         assert(IN_SET(for_state, HOME_UNLOCKING, HOME_UNLOCKING_FOR_ACQUIRE));
1970
1971         r = home_start_work(h, "unlock", h->record, secret);
1972         if (r < 0)
1973                 return r;
1974
1975         home_set_state(h, for_state);
1976         return 0;
1977 }
1978
1979 int home_unlock(Home *h, UserRecord *secret, sd_bus_error *error) {
1980         int r;
1981         assert(h);
1982
1983         r = home_ratelimit(h, error);
1984         if (r < 0)
1985                 return r;
1986
1987         switch (home_get_state(h)) {
1988         case HOME_UNFIXATED:
1989         case HOME_ABSENT:
1990         case HOME_INACTIVE:
1991         case HOME_ACTIVE:
1992         case HOME_LINGERING:
1993         case HOME_DIRTY:
1994                 return sd_bus_error_setf(error, BUS_ERROR_HOME_NOT_LOCKED, "Home %s is not locked.", h->user_name);
1995         case HOME_LOCKED:
1996                 break;
1997         default:
1998                 return sd_bus_error_setf(error, BUS_ERROR_HOME_BUSY, "An operation on home %s is currently being executed.", h->user_name);
1999         }
2000
2001         return home_unlock_internal(h, secret, HOME_UNLOCKING, error);
2002 }
2003
2004 HomeState home_get_state(Home *h) {
2005         int r;
2006         assert(h);
2007
2008         /* When the state field is initialized, it counts. */
2009         if (h->state >= 0)
2010                 return h->state;
2011
2012         /* Otherwise, let's see if the home directory is mounted. If so, we assume for sure the home
2013          * directory is active */
2014         if (user_record_test_home_directory(h->record) == USER_TEST_MOUNTED)
2015                 return h->retry_deactivate_event_source ? HOME_LINGERING : HOME_ACTIVE;
2016
2017         /* And if we see the image being gone, we report this as absent */
2018         r = user_record_test_image_path(h->record);
2019         if (r == USER_TEST_ABSENT)
2020                 return HOME_ABSENT;
2021         if (r == USER_TEST_DIRTY)
2022                 return HOME_DIRTY;
2023
2024         /* And for all other cases we return "inactive". */
2025         return HOME_INACTIVE;
2026 }
2027
2028 void home_process_notify(Home *h, char **l, int fd) {
2029         _cleanup_close_ int taken_fd = TAKE_FD(fd);
2030         const char *e;
2031         int error;
2032         int r;
2033
2034         assert(h);
2035
2036         e = strv_env_get(l, "SYSTEMD_LUKS_LOCK_FD");
2037         if (e) {
2038                 r = parse_boolean(e);
2039                 if (r < 0)
2040                         return (void) log_debug_errno(r, "Failed to parse SYSTEMD_LUKS_LOCK_FD value: %m");
2041                 if (r > 0) {
2042                         if (taken_fd < 0)
2043                                 return (void) log_debug("Got notify message with SYSTEMD_LUKS_LOCK_FD=1 but no fd passed, ignoring: %m");
2044
2045                         close_and_replace(h->luks_lock_fd, taken_fd);
2046
2047                         log_debug("Successfully acquired LUKS lock fd from worker.");
2048
2049                         /* Immediately check if we actually want to keep it */
2050                         home_maybe_close_luks_lock_fd(h, _HOME_STATE_INVALID);
2051                 } else {
2052                         if (taken_fd >= 0)
2053                                 return (void) log_debug("Got notify message with SYSTEMD_LUKS_LOCK_FD=0 but fd passed, ignoring: %m");
2054
2055                         h->luks_lock_fd = safe_close(h->luks_lock_fd);
2056                 }
2057
2058                 return;
2059         }
2060
2061         e = strv_env_get(l, "ERRNO");
2062         if (!e)
2063                 return (void) log_debug("Got notify message lacking both ERRNO= and SYSTEMD_LUKS_LOCK_FD= field, ignoring.");
2064
2065         r = safe_atoi(e, &error);
2066         if (r < 0)
2067                 return (void) log_debug_errno(r, "Failed to parse received error number, ignoring: %s", e);
2068         if (error <= 0)
2069                 return (void) log_debug("Error number is out of range: %i", error);
2070
2071         h->worker_error_code = error;
2072 }
2073
2074 int home_killall(Home *h) {
2075         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2076         _cleanup_free_ char *unit = NULL;
2077         int r;
2078
2079         assert(h);
2080
2081         if (!uid_is_valid(h->uid))
2082                 return 0;
2083
2084         assert(h->uid > 0); /* We never should be UID 0 */
2085
2086         /* Let's kill everything matching the specified UID */
2087         r = safe_fork("(sd-killer)",
2088                       FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG|FORK_WAIT|FORK_LOG|FORK_REOPEN_LOG,
2089                       NULL);
2090         if (r < 0)
2091                 return r;
2092         if (r == 0) {
2093                 gid_t gid;
2094
2095                 /* Child */
2096
2097                 gid = user_record_gid(h->record);
2098                 if (setresgid(gid, gid, gid) < 0) {
2099                         log_error_errno(errno, "Failed to change GID to " GID_FMT ": %m", gid);
2100                         _exit(EXIT_FAILURE);
2101                 }
2102
2103                 if (setgroups(0, NULL) < 0) {
2104                         log_error_errno(errno, "Failed to reset auxiliary groups list: %m");
2105                         _exit(EXIT_FAILURE);
2106                 }
2107
2108                 if (setresuid(h->uid, h->uid, h->uid) < 0) {
2109                         log_error_errno(errno, "Failed to change UID to " UID_FMT ": %m", h->uid);
2110                         _exit(EXIT_FAILURE);
2111                 }
2112
2113                 if (kill(-1, SIGKILL) < 0) {
2114                         log_error_errno(errno, "Failed to kill all processes of UID " UID_FMT ": %m", h->uid);
2115                         _exit(EXIT_FAILURE);
2116                 }
2117
2118                 _exit(EXIT_SUCCESS);
2119         }
2120
2121         /* Let's also kill everything in the user's slice */
2122         if (asprintf(&unit, "user-" UID_FMT ".slice", h->uid) < 0)
2123                 return log_oom();
2124
2125         r = sd_bus_call_method(
2126                         h->manager->bus,
2127                         "org.freedesktop.systemd1",
2128                         "/org/freedesktop/systemd1",
2129                         "org.freedesktop.systemd1.Manager",
2130                         "KillUnit",
2131                         &error,
2132                         NULL,
2133                         "ssi", unit, "all", SIGKILL);
2134         if (r < 0)
2135                 log_full_errno(sd_bus_error_has_name(&error, BUS_ERROR_NO_SUCH_UNIT) ? LOG_DEBUG : LOG_WARNING,
2136                                r, "Failed to kill login processes of user, ignoring: %s", bus_error_message(&error, r));
2137
2138         return 1;
2139 }
2140
2141 static int home_get_disk_status_luks(
2142                 Home *h,
2143                 HomeState state,
2144                 uint64_t *ret_disk_size,
2145                 uint64_t *ret_disk_usage,
2146                 uint64_t *ret_disk_free,
2147                 uint64_t *ret_disk_ceiling,
2148                 uint64_t *ret_disk_floor,
2149                 statfs_f_type_t *ret_fstype,
2150                 mode_t *ret_access_mode) {
2151
2152         uint64_t disk_size = UINT64_MAX, disk_usage = UINT64_MAX, disk_free = UINT64_MAX,
2153                 disk_ceiling = UINT64_MAX, disk_floor = UINT64_MAX,
2154                 stat_used = UINT64_MAX, fs_size = UINT64_MAX, header_size = 0;
2155         mode_t access_mode = MODE_INVALID;
2156         statfs_f_type_t fstype = 0;
2157         struct statfs sfs;
2158         struct stat st;
2159         const char *hd;
2160         int r;
2161
2162         assert(h);
2163
2164         if (state != HOME_ABSENT) {
2165                 const char *ip;
2166
2167                 ip = user_record_image_path(h->record);
2168                 if (ip) {
2169                         if (stat(ip, &st) < 0)
2170                                 log_debug_errno(errno, "Failed to stat() %s, ignoring: %m", ip);
2171                         else if (S_ISREG(st.st_mode)) {
2172                                 _cleanup_free_ char *parent = NULL;
2173
2174                                 disk_size = st.st_size;
2175                                 stat_used = st.st_blocks * 512;
2176
2177                                 r = path_extract_directory(ip, &parent);
2178                                 if (r < 0)
2179                                         return log_error_errno(r, "Failed to extract parent directory from image path '%s': %m", ip);
2180
2181                                 if (statfs(parent, &sfs) < 0)
2182                                         log_debug_errno(errno, "Failed to statfs() %s, ignoring: %m", parent);
2183                                 else
2184                                         disk_ceiling = stat_used + sfs.f_bsize * sfs.f_bavail;
2185
2186                         } else if (S_ISBLK(st.st_mode)) {
2187                                 _cleanup_free_ char *szbuf = NULL;
2188                                 char p[SYS_BLOCK_PATH_MAX("/size")];
2189
2190                                 /* Let's read the size off sysfs, so that we don't have to open the device */
2191                                 xsprintf_sys_block_path(p, "/size", st.st_rdev);
2192                                 r = read_one_line_file(p, &szbuf);
2193                                 if (r < 0)
2194                                         log_debug_errno(r, "Failed to read %s, ignoring: %m", p);
2195                                 else {
2196                                         uint64_t sz;
2197
2198                                         r = safe_atou64(szbuf, &sz);
2199                                         if (r < 0)
2200                                                 log_debug_errno(r, "Failed to parse %s, ignoring: %s", p, szbuf);
2201                                         else
2202                                                 disk_size = sz * 512;
2203                                 }
2204                         } else
2205                                 log_debug("Image path is not a block device or regular file, not able to acquire size.");
2206                 }
2207         }
2208
2209         if (!HOME_STATE_IS_ACTIVE(state))
2210                 goto finish;
2211
2212         hd = user_record_home_directory(h->record);
2213         if (!hd)
2214                 goto finish;
2215
2216         if (stat(hd, &st) < 0) {
2217                 log_debug_errno(errno, "Failed to stat() %s, ignoring: %m", hd);
2218                 goto finish;
2219         }
2220
2221         r = stat_verify_directory(&st);
2222         if (r < 0) {
2223                 log_debug_errno(r, "Home directory %s is not a directory, ignoring: %m", hd);
2224                 goto finish;
2225         }
2226
2227         access_mode = st.st_mode & 07777;
2228
2229         if (statfs(hd, &sfs) < 0) {
2230                 log_debug_errno(errno, "Failed to statfs() %s, ignoring: %m", hd);
2231                 goto finish;
2232         }
2233
2234         fstype = sfs.f_type;
2235
2236         disk_free = sfs.f_bsize * sfs.f_bavail;
2237         fs_size = sfs.f_bsize * sfs.f_blocks;
2238         if (disk_size != UINT64_MAX && disk_size > fs_size)
2239                 header_size = disk_size - fs_size;
2240
2241         /* We take a perspective from the user here (as opposed to from the host): the used disk space is the
2242          * difference from the limit and what's free. This makes a difference if sparse mode is not used: in
2243          * that case the image is pre-allocated and thus appears all used from the host PoV but is not used
2244          * up at all yet from the user's PoV.
2245          *
2246          * That said, we use the stat() reported loopback file size as upper boundary: our footprint can
2247          * never be larger than what we take up on the lowest layers. */
2248
2249         if (disk_size != UINT64_MAX && disk_size > disk_free) {
2250                 disk_usage = disk_size - disk_free;
2251
2252                 if (stat_used != UINT64_MAX && disk_usage > stat_used)
2253                         disk_usage = stat_used;
2254         } else
2255                 disk_usage = stat_used;
2256
2257         /* If we have the magic, determine floor preferably by magic */
2258         disk_floor = minimal_size_by_fs_magic(sfs.f_type) + header_size;
2259
2260 finish:
2261         /* If we don't know the magic, go by file system name */
2262         if (disk_floor == UINT64_MAX)
2263                 disk_floor = minimal_size_by_fs_name(user_record_file_system_type(h->record));
2264
2265         if (ret_disk_size)
2266                 *ret_disk_size = disk_size;
2267         if (ret_disk_usage)
2268                 *ret_disk_usage = disk_usage;
2269         if (ret_disk_free)
2270                 *ret_disk_free = disk_free;
2271         if (ret_disk_ceiling)
2272                 *ret_disk_ceiling = disk_ceiling;
2273         if (ret_disk_floor)
2274                 *ret_disk_floor = disk_floor;
2275         if (ret_fstype)
2276                 *ret_fstype = fstype;
2277         if (ret_access_mode)
2278                 *ret_access_mode = access_mode;
2279
2280         return 0;
2281 }
2282
2283 static int home_get_disk_status_directory(
2284                 Home *h,
2285                 HomeState state,
2286                 uint64_t *ret_disk_size,
2287                 uint64_t *ret_disk_usage,
2288                 uint64_t *ret_disk_free,
2289                 uint64_t *ret_disk_ceiling,
2290                 uint64_t *ret_disk_floor,
2291                 statfs_f_type_t *ret_fstype,
2292                 mode_t *ret_access_mode) {
2293
2294         uint64_t disk_size = UINT64_MAX, disk_usage = UINT64_MAX, disk_free = UINT64_MAX,
2295                 disk_ceiling = UINT64_MAX, disk_floor = UINT64_MAX;
2296         mode_t access_mode = MODE_INVALID;
2297         statfs_f_type_t fstype = 0;
2298         struct statfs sfs;
2299         struct dqblk req;
2300         const char *path = NULL;
2301         int r;
2302
2303         assert(h);
2304
2305         if (HOME_STATE_IS_ACTIVE(state))
2306                 path = user_record_home_directory(h->record);
2307
2308         if (!path) {
2309                 if (state == HOME_ABSENT)
2310                         goto finish;
2311
2312                 path = user_record_image_path(h->record);
2313         }
2314
2315         if (!path)
2316                 goto finish;
2317
2318         if (statfs(path, &sfs) < 0)
2319                 log_debug_errno(errno, "Failed to statfs() %s, ignoring: %m", path);
2320         else {
2321                 disk_free = sfs.f_bsize * sfs.f_bavail;
2322                 disk_size = sfs.f_bsize * sfs.f_blocks;
2323
2324                 /* We don't initialize disk_usage from statfs() data here, since the device is likely not used
2325                  * by us alone, and disk_usage should only reflect our own use. */
2326
2327                 fstype = sfs.f_type;
2328         }
2329
2330         if (IN_SET(h->record->storage, USER_CLASSIC, USER_DIRECTORY, USER_SUBVOLUME)) {
2331
2332                 r = btrfs_is_subvol(path);
2333                 if (r < 0)
2334                         log_debug_errno(r, "Failed to determine whether %s is a btrfs subvolume: %m", path);
2335                 else if (r > 0) {
2336                         BtrfsQuotaInfo qi;
2337
2338                         r = btrfs_subvol_get_subtree_quota(path, 0, &qi);
2339                         if (r < 0)
2340                                 log_debug_errno(r, "Failed to query btrfs subtree quota, ignoring: %m");
2341                         else {
2342                                 disk_usage = qi.referenced;
2343
2344                                 if (disk_free != UINT64_MAX) {
2345                                         disk_ceiling = qi.referenced + disk_free;
2346
2347                                         if (disk_size != UINT64_MAX && disk_ceiling > disk_size)
2348                                                 disk_ceiling = disk_size;
2349                                 }
2350
2351                                 if (qi.referenced_max != UINT64_MAX) {
2352                                         if (disk_size != UINT64_MAX)
2353                                                 disk_size = MIN(qi.referenced_max, disk_size);
2354                                         else
2355                                                 disk_size = qi.referenced_max;
2356                                 }
2357
2358                                 if (disk_size != UINT64_MAX) {
2359                                         if (disk_size > disk_usage)
2360                                                 disk_free = disk_size - disk_usage;
2361                                         else
2362                                                 disk_free = 0;
2363                                 }
2364                         }
2365
2366                         goto finish;
2367                 }
2368         }
2369
2370         if (IN_SET(h->record->storage, USER_CLASSIC, USER_DIRECTORY, USER_FSCRYPT)) {
2371                 r = quotactl_path(QCMD_FIXED(Q_GETQUOTA, USRQUOTA), path, h->uid, &req);
2372                 if (r < 0) {
2373                         if (ERRNO_IS_NOT_SUPPORTED(r)) {
2374                                 log_debug_errno(r, "No UID quota support on %s.", path);
2375                                 goto finish;
2376                         }
2377
2378                         if (r != -ESRCH) {
2379                                 log_debug_errno(r, "Failed to query disk quota for UID " UID_FMT ": %m", h->uid);
2380                                 goto finish;
2381                         }
2382
2383                         disk_usage = 0; /* No record of this user? then nothing was used */
2384                 } else {
2385                         if (FLAGS_SET(req.dqb_valid, QIF_SPACE) && disk_free != UINT64_MAX) {
2386                                 disk_ceiling = req.dqb_curspace + disk_free;
2387
2388                                 if (disk_size != UINT64_MAX && disk_ceiling > disk_size)
2389                                         disk_ceiling = disk_size;
2390                         }
2391
2392                         if (FLAGS_SET(req.dqb_valid, QIF_BLIMITS)) {
2393                                 uint64_t q;
2394
2395                                 /* Take the minimum of the quota and the available disk space here */
2396                                 q = req.dqb_bhardlimit * QIF_DQBLKSIZE;
2397                                 if (disk_size != UINT64_MAX)
2398                                         disk_size = MIN(disk_size, q);
2399                                 else
2400                                         disk_size = q;
2401                         }
2402                         if (FLAGS_SET(req.dqb_valid, QIF_SPACE)) {
2403                                 disk_usage = req.dqb_curspace;
2404
2405                                 if (disk_size != UINT64_MAX) {
2406                                         if (disk_size > disk_usage)
2407                                                 disk_free = disk_size - disk_usage;
2408                                         else
2409                                                 disk_free = 0;
2410                                 }
2411                         }
2412                 }
2413         }
2414
2415 finish:
2416         if (ret_disk_size)
2417                 *ret_disk_size = disk_size;
2418         if (ret_disk_usage)
2419                 *ret_disk_usage = disk_usage;
2420         if (ret_disk_free)
2421                 *ret_disk_free = disk_free;
2422         if (ret_disk_ceiling)
2423                 *ret_disk_ceiling = disk_ceiling;
2424         if (ret_disk_floor)
2425                 *ret_disk_floor = disk_floor;
2426         if (ret_fstype)
2427                 *ret_fstype = fstype;
2428         if (ret_access_mode)
2429                 *ret_access_mode = access_mode;
2430
2431         return 0;
2432 }
2433
2434 static int home_get_disk_status_internal(
2435                 Home *h,
2436                 HomeState state,
2437                 uint64_t *ret_disk_size,
2438                 uint64_t *ret_disk_usage,
2439                 uint64_t *ret_disk_free,
2440                 uint64_t *ret_disk_ceiling,
2441                 uint64_t *ret_disk_floor,
2442                 statfs_f_type_t *ret_fstype,
2443                 mode_t *ret_access_mode) {
2444
2445         assert(h);
2446         assert(h->record);
2447
2448         switch (h->record->storage) {
2449
2450         case USER_LUKS:
2451                 return home_get_disk_status_luks(h, state, ret_disk_size, ret_disk_usage, ret_disk_free, ret_disk_ceiling, ret_disk_floor, ret_fstype, ret_access_mode);
2452
2453         case USER_CLASSIC:
2454         case USER_DIRECTORY:
2455         case USER_SUBVOLUME:
2456         case USER_FSCRYPT:
2457         case USER_CIFS:
2458                 return home_get_disk_status_directory(h, state, ret_disk_size, ret_disk_usage, ret_disk_free, ret_disk_ceiling, ret_disk_floor, ret_fstype, ret_access_mode);
2459
2460         default:
2461                 /* don't know */
2462
2463                 if (ret_disk_size)
2464                         *ret_disk_size = UINT64_MAX;
2465                 if (ret_disk_usage)
2466                         *ret_disk_usage = UINT64_MAX;
2467                 if (ret_disk_free)
2468                         *ret_disk_free = UINT64_MAX;
2469                 if (ret_disk_ceiling)
2470                         *ret_disk_ceiling = UINT64_MAX;
2471                 if (ret_disk_floor)
2472                         *ret_disk_floor = UINT64_MAX;
2473                 if (ret_fstype)
2474                         *ret_fstype = 0;
2475                 if (ret_access_mode)
2476                         *ret_access_mode = MODE_INVALID;
2477
2478                 return 0;
2479         }
2480 }
2481
2482 int home_get_disk_status(
2483                 Home *h,
2484                 uint64_t *ret_disk_size,
2485                 uint64_t *ret_disk_usage,
2486                 uint64_t *ret_disk_free,
2487                 uint64_t *ret_disk_ceiling,
2488                 uint64_t *ret_disk_floor,
2489                 statfs_f_type_t *ret_fstype,
2490                 mode_t *ret_access_mode) {
2491
2492         assert(h);
2493
2494         return home_get_disk_status_internal(
2495                         h,
2496                         home_get_state(h),
2497                         ret_disk_size,
2498                         ret_disk_usage,
2499                         ret_disk_free,
2500                         ret_disk_ceiling,
2501                         ret_disk_floor,
2502                         ret_fstype,
2503                         ret_access_mode);
2504 }
2505
2506 int home_augment_status(
2507                 Home *h,
2508                 UserRecordLoadFlags flags,
2509                 UserRecord **ret) {
2510
2511         uint64_t disk_size = UINT64_MAX, disk_usage = UINT64_MAX, disk_free = UINT64_MAX, disk_ceiling = UINT64_MAX, disk_floor = UINT64_MAX;
2512         _cleanup_(json_variant_unrefp) JsonVariant *j = NULL, *v = NULL, *m = NULL, *status = NULL;
2513         _cleanup_(user_record_unrefp) UserRecord *ur = NULL;
2514         statfs_f_type_t magic;
2515         const char *fstype;
2516         mode_t access_mode;
2517         HomeState state;
2518         sd_id128_t id;
2519         int r;
2520
2521         assert(h);
2522         assert(ret);
2523
2524         /* We are supposed to add this, this can't be on hence. */
2525         assert(!FLAGS_SET(flags, USER_RECORD_STRIP_STATUS));
2526
2527         r = sd_id128_get_machine(&id);
2528         if (r < 0)
2529                 return r;
2530
2531         state = home_get_state(h);
2532
2533         r = home_get_disk_status_internal(
2534                         h, state,
2535                         &disk_size,
2536                         &disk_usage,
2537                         &disk_free,
2538                         &disk_ceiling,
2539                         &disk_floor,
2540                         &magic,
2541                         &access_mode);
2542         if (r < 0)
2543                 return r;
2544
2545         fstype = fs_type_to_string(magic);
2546
2547         if (disk_floor == UINT64_MAX || (disk_usage != UINT64_MAX && disk_floor < disk_usage))
2548                 disk_floor = disk_usage;
2549         if (disk_floor == UINT64_MAX || disk_floor < USER_DISK_SIZE_MIN)
2550                 disk_floor = USER_DISK_SIZE_MIN;
2551         if (disk_ceiling == UINT64_MAX || disk_ceiling > USER_DISK_SIZE_MAX)
2552                 disk_ceiling = USER_DISK_SIZE_MAX;
2553
2554         r = json_build(&status,
2555                        JSON_BUILD_OBJECT(
2556                                        JSON_BUILD_PAIR("state", JSON_BUILD_STRING(home_state_to_string(state))),
2557                                        JSON_BUILD_PAIR("service", JSON_BUILD_CONST_STRING("io.systemd.Home")),
2558                                        JSON_BUILD_PAIR_CONDITION(disk_size != UINT64_MAX, "diskSize", JSON_BUILD_UNSIGNED(disk_size)),
2559                                        JSON_BUILD_PAIR_CONDITION(disk_usage != UINT64_MAX, "diskUsage", JSON_BUILD_UNSIGNED(disk_usage)),
2560                                        JSON_BUILD_PAIR_CONDITION(disk_free != UINT64_MAX, "diskFree", JSON_BUILD_UNSIGNED(disk_free)),
2561                                        JSON_BUILD_PAIR_CONDITION(disk_ceiling != UINT64_MAX, "diskCeiling", JSON_BUILD_UNSIGNED(disk_ceiling)),
2562                                        JSON_BUILD_PAIR_CONDITION(disk_floor != UINT64_MAX, "diskFloor", JSON_BUILD_UNSIGNED(disk_floor)),
2563                                        JSON_BUILD_PAIR_CONDITION(h->signed_locally >= 0, "signedLocally", JSON_BUILD_BOOLEAN(h->signed_locally)),
2564                                        JSON_BUILD_PAIR_CONDITION(fstype, "fileSystemType", JSON_BUILD_STRING(fstype)),
2565                                        JSON_BUILD_PAIR_CONDITION(access_mode != MODE_INVALID, "accessMode", JSON_BUILD_UNSIGNED(access_mode))
2566                        ));
2567         if (r < 0)
2568                 return r;
2569
2570         j = json_variant_ref(h->record->json);
2571         v = json_variant_ref(json_variant_by_key(j, "status"));
2572         m = json_variant_ref(json_variant_by_key(v, SD_ID128_TO_STRING(id)));
2573
2574         r = json_variant_filter(&m, STRV_MAKE("diskSize", "diskUsage", "diskFree", "diskCeiling", "diskFloor", "signedLocally"));
2575         if (r < 0)
2576                 return r;
2577
2578         r = json_variant_merge(&m, status);
2579         if (r < 0)
2580                 return r;
2581
2582         r = json_variant_set_field(&v, SD_ID128_TO_STRING(id), m);
2583         if (r < 0)
2584                 return r;
2585
2586         r = json_variant_set_field(&j, "status", v);
2587         if (r < 0)
2588                 return r;
2589
2590         ur = user_record_new();
2591         if (!ur)
2592                 return -ENOMEM;
2593
2594         r = user_record_load(ur, j, flags);
2595         if (r < 0)
2596                 return r;
2597
2598         ur->incomplete =
2599                 FLAGS_SET(h->record->mask, USER_RECORD_PRIVILEGED) &&
2600                 !FLAGS_SET(ur->mask, USER_RECORD_PRIVILEGED);
2601
2602         *ret = TAKE_PTR(ur);
2603         return 0;
2604 }
2605
2606 static int on_home_ref_eof(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
2607         _cleanup_(operation_unrefp) Operation *o = NULL;
2608         Home *h = ASSERT_PTR(userdata);
2609
2610         assert(s);
2611
2612         if (h->ref_event_source_please_suspend == s)
2613                 h->ref_event_source_please_suspend = sd_event_source_disable_unref(h->ref_event_source_please_suspend);
2614
2615         if (h->ref_event_source_dont_suspend == s)
2616                 h->ref_event_source_dont_suspend = sd_event_source_disable_unref(h->ref_event_source_dont_suspend);
2617
2618         if (h->ref_event_source_dont_suspend || h->ref_event_source_please_suspend)
2619                 return 0;
2620
2621         log_info("Got notification that all sessions of user %s ended, deactivating automatically.", h->user_name);
2622
2623         o = operation_new(OPERATION_PIPE_EOF, NULL);
2624         if (!o) {
2625                 log_oom();
2626                 return 0;
2627         }
2628
2629         home_schedule_operation(h, o, NULL);
2630         return 0;
2631 }
2632
2633 int home_create_fifo(Home *h, bool please_suspend) {
2634         _cleanup_close_ int ret_fd = -EBADF;
2635         sd_event_source **ss;
2636         const char *fn, *suffix;
2637         int r;
2638
2639         assert(h);
2640
2641         if (please_suspend) {
2642                 suffix = ".please-suspend";
2643                 ss = &h->ref_event_source_please_suspend;
2644         } else {
2645                 suffix = ".dont-suspend";
2646                 ss = &h->ref_event_source_dont_suspend;
2647         }
2648
2649         fn = strjoina("/run/systemd/home/", h->user_name, suffix);
2650
2651         if (!*ss) {
2652                 _cleanup_close_ int ref_fd = -EBADF;
2653
2654                 (void) mkdir("/run/systemd/home/", 0755);
2655                 if (mkfifo(fn, 0600) < 0 && errno != EEXIST)
2656                         return log_error_errno(errno, "Failed to create FIFO %s: %m", fn);
2657
2658                 ref_fd = open(fn, O_RDONLY|O_CLOEXEC|O_NONBLOCK);
2659                 if (ref_fd < 0)
2660                         return log_error_errno(errno, "Failed to open FIFO %s for reading: %m", fn);
2661
2662                 r = sd_event_add_io(h->manager->event, ss, ref_fd, 0, on_home_ref_eof, h);
2663                 if (r < 0)
2664                         return log_error_errno(r, "Failed to allocate reference FIFO event source: %m");
2665
2666                 (void) sd_event_source_set_description(*ss, "acquire-ref");
2667
2668                 r = sd_event_source_set_priority(*ss, SD_EVENT_PRIORITY_IDLE-1);
2669                 if (r < 0)
2670                         return r;
2671
2672                 r = sd_event_source_set_io_fd_own(*ss, true);
2673                 if (r < 0)
2674                         return log_error_errno(r, "Failed to pass ownership of FIFO event fd to event source: %m");
2675
2676                 TAKE_FD(ref_fd);
2677         }
2678
2679         ret_fd = open(fn, O_WRONLY|O_CLOEXEC|O_NONBLOCK);
2680         if (ret_fd < 0)
2681                 return log_error_errno(errno, "Failed to open FIFO %s for writing: %m", fn);
2682
2683         return TAKE_FD(ret_fd);
2684 }
2685
2686 static int home_dispatch_acquire(Home *h, Operation *o) {
2687         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2688         int (*call)(Home *h, UserRecord *secret, HomeState for_state, sd_bus_error *error) = NULL;
2689         HomeState for_state;
2690         int r;
2691
2692         assert(h);
2693         assert(o);
2694         assert(o->type == OPERATION_ACQUIRE);
2695
2696         assert(!h->current_operation);
2697
2698         switch (home_get_state(h)) {
2699
2700         case HOME_UNFIXATED:
2701                 for_state = HOME_FIXATING_FOR_ACQUIRE;
2702                 call = home_fixate_internal;
2703                 break;
2704
2705         case HOME_ABSENT:
2706                 r = sd_bus_error_setf(&error, BUS_ERROR_HOME_ABSENT,
2707                                       "Home %s is currently missing or not plugged in.", h->user_name);
2708                 goto check;
2709
2710         case HOME_INACTIVE:
2711         case HOME_DIRTY:
2712                 for_state = HOME_ACTIVATING_FOR_ACQUIRE;
2713                 call = home_activate_internal;
2714                 break;
2715
2716         case HOME_ACTIVE:
2717         case HOME_LINGERING:
2718                 for_state = HOME_AUTHENTICATING_FOR_ACQUIRE;
2719                 call = home_authenticate_internal;
2720                 break;
2721
2722         case HOME_LOCKED:
2723                 for_state = HOME_UNLOCKING_FOR_ACQUIRE;
2724                 call = home_unlock_internal;
2725                 break;
2726
2727         default:
2728                 /* All other cases means we are currently executing an operation, which means the job remains
2729                  * pending. */
2730                 return 0;
2731         }
2732
2733         r = home_ratelimit(h, &error);
2734         if (r >= 0)
2735                 r = call(h, o->secret, for_state, &error);
2736
2737  check:
2738         if (r != 0) /* failure or completed */
2739                 operation_result(o, r, &error);
2740         else /* ongoing */
2741                 h->current_operation = operation_ref(o);
2742
2743         return 1;
2744 }
2745
2746 static int home_dispatch_release(Home *h, Operation *o) {
2747         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2748         int r;
2749
2750         assert(h);
2751         assert(o);
2752         assert(o->type == OPERATION_RELEASE);
2753
2754         if (h->ref_event_source_dont_suspend || h->ref_event_source_please_suspend)
2755                 /* If there's now a reference again, then let's abort the release attempt */
2756                 r = sd_bus_error_setf(&error, BUS_ERROR_HOME_BUSY, "Home %s is currently referenced.", h->user_name);
2757         else {
2758                 switch (home_get_state(h)) {
2759
2760                 case HOME_UNFIXATED:
2761                 case HOME_ABSENT:
2762                 case HOME_INACTIVE:
2763                 case HOME_DIRTY:
2764                         r = 1; /* done */
2765                         break;
2766
2767                 case HOME_LOCKED:
2768                         r = sd_bus_error_setf(&error, BUS_ERROR_HOME_LOCKED, "Home %s is currently locked.", h->user_name);
2769                         break;
2770
2771                 case HOME_ACTIVE:
2772                 case HOME_LINGERING:
2773                         r = home_deactivate_internal(h, false, &error);
2774                         break;
2775
2776                 default:
2777                         /* All other cases means we are currently executing an operation, which means the job remains
2778                          * pending. */
2779                         return 0;
2780                 }
2781         }
2782
2783         assert(!h->current_operation);
2784
2785         if (r != 0) /* failure or completed */
2786                 operation_result(o, r, &error);
2787         else /* ongoing */
2788                 h->current_operation = operation_ref(o);
2789
2790         return 1;
2791 }
2792
2793 static int home_dispatch_lock_all(Home *h, Operation *o) {
2794         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2795         int r;
2796
2797         assert(h);
2798         assert(o);
2799         assert(o->type == OPERATION_LOCK_ALL);
2800
2801         switch (home_get_state(h)) {
2802
2803         case HOME_UNFIXATED:
2804         case HOME_ABSENT:
2805         case HOME_INACTIVE:
2806         case HOME_DIRTY:
2807                 log_info("Home %s is not active, no locking necessary.", h->user_name);
2808                 r = 1; /* done */
2809                 break;
2810
2811         case HOME_LOCKED:
2812                 log_info("Home %s is already locked.", h->user_name);
2813                 r = 1; /* done */
2814                 break;
2815
2816         case HOME_ACTIVE:
2817         case HOME_LINGERING:
2818                 log_info("Locking home %s.", h->user_name);
2819                 r = home_lock(h, &error);
2820                 break;
2821
2822         default:
2823                 /* All other cases means we are currently executing an operation, which means the job remains
2824                  * pending. */
2825                 return 0;
2826         }
2827
2828         assert(!h->current_operation);
2829
2830         if (r != 0) /* failure or completed */
2831                 operation_result(o, r, &error);
2832         else /* ongoing */
2833                 h->current_operation = operation_ref(o);
2834
2835         return 1;
2836 }
2837
2838 static int home_dispatch_deactivate_all(Home *h, Operation *o) {
2839         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2840         int r;
2841
2842         assert(h);
2843         assert(o);
2844         assert(o->type == OPERATION_DEACTIVATE_ALL);
2845
2846         switch (home_get_state(h)) {
2847
2848         case HOME_UNFIXATED:
2849         case HOME_ABSENT:
2850         case HOME_INACTIVE:
2851         case HOME_DIRTY:
2852                 log_info("Home %s is already deactivated.", h->user_name);
2853                 r = 1; /* done */
2854                 break;
2855
2856         case HOME_LOCKED:
2857                 log_info("Home %s is currently locked, not deactivating.", h->user_name);
2858                 r = 1; /* done */
2859                 break;
2860
2861         case HOME_ACTIVE:
2862         case HOME_LINGERING:
2863                 log_info("Deactivating home %s.", h->user_name);
2864                 r = home_deactivate_internal(h, false, &error);
2865                 break;
2866
2867         default:
2868                 /* All other cases means we are currently executing an operation, which means the job remains
2869                  * pending. */
2870                 return 0;
2871         }
2872
2873         assert(!h->current_operation);
2874
2875         if (r != 0) /* failure or completed */
2876                 operation_result(o, r, &error);
2877         else /* ongoing */
2878                 h->current_operation = operation_ref(o);
2879
2880         return 1;
2881 }
2882
2883 static int home_dispatch_pipe_eof(Home *h, Operation *o) {
2884         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2885         int r;
2886
2887         assert(h);
2888         assert(o);
2889         assert(o->type == OPERATION_PIPE_EOF);
2890
2891         if (h->ref_event_source_please_suspend || h->ref_event_source_dont_suspend)
2892                 return 1; /* Hmm, there's a reference again, let's cancel this */
2893
2894         switch (home_get_state(h)) {
2895
2896         case HOME_UNFIXATED:
2897         case HOME_ABSENT:
2898         case HOME_INACTIVE:
2899         case HOME_DIRTY:
2900                 log_info("Home %s already deactivated, no automatic deactivation needed.", h->user_name);
2901                 break;
2902
2903         case HOME_DEACTIVATING:
2904                 log_info("Home %s is already being deactivated, automatic deactivated unnecessary.", h->user_name);
2905                 break;
2906
2907         case HOME_ACTIVE:
2908         case HOME_LINGERING:
2909                 r = home_deactivate_internal(h, false, &error);
2910                 if (r < 0)
2911                         log_warning_errno(r, "Failed to deactivate %s, ignoring: %s", h->user_name, bus_error_message(&error, r));
2912                 break;
2913
2914         case HOME_LOCKED:
2915         default:
2916                 /* If the device is locked or any operation is being executed, let's leave this pending */
2917                 return 0;
2918         }
2919
2920         /* Note that we don't call operation_fail() or operation_success() here, because this kind of
2921          * operation has no message associated with it, and thus there's no need to propagate success. */
2922
2923         assert(!o->message);
2924         return 1;
2925 }
2926
2927 static int home_dispatch_deactivate_force(Home *h, Operation *o) {
2928         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2929         int r;
2930
2931         assert(h);
2932         assert(o);
2933         assert(o->type == OPERATION_DEACTIVATE_FORCE);
2934
2935         switch (home_get_state(h)) {
2936
2937         case HOME_UNFIXATED:
2938         case HOME_ABSENT:
2939         case HOME_INACTIVE:
2940         case HOME_DIRTY:
2941                 log_debug("Home %s already deactivated, no forced deactivation due to unplug needed.", h->user_name);
2942                 break;
2943
2944         case HOME_DEACTIVATING:
2945                 log_debug("Home %s is already being deactivated, forced deactivation due to unplug unnecessary.", h->user_name);
2946                 break;
2947
2948         case HOME_ACTIVE:
2949         case HOME_LOCKED:
2950         case HOME_LINGERING:
2951                 r = home_deactivate_internal(h, true, &error);
2952                 if (r < 0)
2953                         log_warning_errno(r, "Failed to forcibly deactivate %s, ignoring: %s", h->user_name, bus_error_message(&error, r));
2954                 break;
2955
2956         default:
2957                 /* If any operation is being executed, let's leave this pending */
2958                 return 0;
2959         }
2960
2961         /* Note that we don't call operation_fail() or operation_success() here, because this kind of
2962          * operation has no message associated with it, and thus there's no need to propagate success. */
2963
2964         assert(!o->message);
2965         return 1;
2966 }
2967
2968 static int on_pending(sd_event_source *s, void *userdata) {
2969         Home *h = ASSERT_PTR(userdata);
2970         Operation *o;
2971         int r;
2972
2973         assert(s);
2974
2975         o = ordered_set_first(h->pending_operations);
2976         if (o) {
2977                 static int (* const operation_table[_OPERATION_MAX])(Home *h, Operation *o) = {
2978                         [OPERATION_ACQUIRE]          = home_dispatch_acquire,
2979                         [OPERATION_RELEASE]          = home_dispatch_release,
2980                         [OPERATION_LOCK_ALL]         = home_dispatch_lock_all,
2981                         [OPERATION_DEACTIVATE_ALL]   = home_dispatch_deactivate_all,
2982                         [OPERATION_PIPE_EOF]         = home_dispatch_pipe_eof,
2983                         [OPERATION_DEACTIVATE_FORCE] = home_dispatch_deactivate_force,
2984                 };
2985
2986                 assert(operation_table[o->type]);
2987                 r = operation_table[o->type](h, o);
2988                 if (r != 0) {
2989                         /* The operation completed, let's remove it from the pending list, and exit while
2990                          * leaving the event source enabled as it is. */
2991                         assert_se(ordered_set_remove(h->pending_operations, o) == o);
2992                         operation_unref(o);
2993                         return 0;
2994                 }
2995         }
2996
2997         /* Nothing to do anymore, let's turn off this event source */
2998         r = sd_event_source_set_enabled(s, SD_EVENT_OFF);
2999         if (r < 0)
3000                 return log_error_errno(r, "Failed to disable event source: %m");
3001
3002         /* No operations pending anymore, maybe this is a good time to trigger a rebalancing */
3003         manager_reschedule_rebalance(h->manager);
3004         return 0;
3005 }
3006
3007 int home_schedule_operation(Home *h, Operation *o, sd_bus_error *error) {
3008         int r;
3009
3010         assert(h);
3011
3012         if (o) {
3013                 if (ordered_set_size(h->pending_operations) >= PENDING_OPERATIONS_MAX)
3014                         return sd_bus_error_set(error, BUS_ERROR_TOO_MANY_OPERATIONS, "Too many client operations requested");
3015
3016                 r = ordered_set_ensure_put(&h->pending_operations, &operation_hash_ops, o);
3017                 if (r < 0)
3018                         return r;
3019
3020                 operation_ref(o);
3021         }
3022
3023         if (!h->pending_event_source) {
3024                 r = sd_event_add_defer(h->manager->event, &h->pending_event_source, on_pending, h);
3025                 if (r < 0)
3026                         return log_error_errno(r, "Failed to allocate pending defer event source: %m");
3027
3028                 (void) sd_event_source_set_description(h->pending_event_source, "pending");
3029
3030                 r = sd_event_source_set_priority(h->pending_event_source, SD_EVENT_PRIORITY_IDLE);
3031                 if (r < 0)
3032                         return r;
3033         }
3034
3035         r = sd_event_source_set_enabled(h->pending_event_source, SD_EVENT_ON);
3036         if (r < 0)
3037                 return log_error_errno(r, "Failed to trigger pending event source: %m");
3038
3039         return 0;
3040 }
3041
3042 static int home_get_image_path_seat(Home *h, char **ret) {
3043         _cleanup_(sd_device_unrefp) sd_device *d = NULL;
3044         _cleanup_free_ char *c = NULL;
3045         const char *ip, *seat;
3046         struct stat st;
3047         int r;
3048
3049         assert(h);
3050
3051         if (user_record_storage(h->record) != USER_LUKS)
3052                 return -ENXIO;
3053
3054         ip = user_record_image_path(h->record);
3055         if (!ip)
3056                 return -ENXIO;
3057
3058         if (!path_startswith(ip, "/dev/"))
3059                 return -ENXIO;
3060
3061         if (stat(ip, &st) < 0)
3062                 return -errno;
3063
3064         if (!S_ISBLK(st.st_mode))
3065                 return -ENOTBLK;
3066
3067         r = sd_device_new_from_stat_rdev(&d, &st);
3068         if (r < 0)
3069                 return r;
3070
3071         r = sd_device_get_property_value(d, "ID_SEAT", &seat);
3072         if (r == -ENOENT) /* no property means seat0 */
3073                 seat = "seat0";
3074         else if (r < 0)
3075                 return r;
3076
3077         c = strdup(seat);
3078         if (!c)
3079                 return -ENOMEM;
3080
3081         *ret = TAKE_PTR(c);
3082         return 0;
3083 }
3084
3085 int home_auto_login(Home *h, char ***ret_seats) {
3086         _cleanup_free_ char *seat = NULL, *seat2 = NULL;
3087
3088         assert(h);
3089         assert(ret_seats);
3090
3091         (void) home_get_image_path_seat(h, &seat);
3092
3093         if (h->record->auto_login > 0 && !streq_ptr(seat, "seat0")) {
3094                 /* For now, when the auto-login boolean is set for a user, let's make it mean
3095                  * "seat0". Eventually we can extend the concept and allow configuration of any kind of seat,
3096                  * but let's keep simple initially, most likely the feature is interesting on single-user
3097                  * systems anyway, only.
3098                  *
3099                  * We filter out users marked for auto-login in we know for sure their home directory is
3100                  * absent. */
3101
3102                 if (user_record_test_image_path(h->record) != USER_TEST_ABSENT) {
3103                         seat2 = strdup("seat0");
3104                         if (!seat2)
3105                                 return -ENOMEM;
3106                 }
3107         }
3108
3109         if (seat || seat2) {
3110                 _cleanup_strv_free_ char **list = NULL;
3111                 size_t i = 0;
3112
3113                 list = new(char*, 3);
3114                 if (!list)
3115                         return -ENOMEM;
3116
3117                 if (seat)
3118                         list[i++] = TAKE_PTR(seat);
3119                 if (seat2)
3120                         list[i++] = TAKE_PTR(seat2);
3121
3122                 list[i] = NULL;
3123                 *ret_seats = TAKE_PTR(list);
3124                 return 1;
3125         }
3126
3127         *ret_seats = NULL;
3128         return 0;
3129 }
3130
3131 int home_set_current_message(Home *h, sd_bus_message *m) {
3132         assert(h);
3133
3134         if (!m)
3135                 return 0;
3136
3137         if (h->current_operation)
3138                 return -EBUSY;
3139
3140         h->current_operation = operation_new(OPERATION_IMMEDIATE, m);
3141         if (!h->current_operation)
3142                 return -ENOMEM;
3143
3144         return 1;
3145 }
3146
3147 int home_wait_for_worker(Home *h) {
3148         int r;
3149
3150         assert(h);
3151
3152         if (h->worker_pid <= 0)
3153                 return 0;
3154
3155         log_info("Worker process for home %s is still running while exiting. Waiting for it to finish.", h->user_name);
3156
3157         r = wait_for_terminate_with_timeout(h->worker_pid, 30 * USEC_PER_SEC);
3158         if (r == -ETIMEDOUT)
3159                 log_warning_errno(r, "Waiting for worker process for home %s timed out. Ignoring.", h->user_name);
3160         else
3161                 log_warning_errno(r, "Failed to wait for worker process for home %s. Ignoring.", h->user_name);
3162
3163         (void) hashmap_remove_value(h->manager->homes_by_worker_pid, PID_TO_PTR(h->worker_pid), h);
3164         h->worker_pid = 0;
3165         return 1;
3166 }
3167
3168 bool home_shall_rebalance(Home *h) {
3169         HomeState state;
3170
3171         assert(h);
3172
3173         /* Determines if the home directory is a candidate for rebalancing */
3174
3175         if (!user_record_shall_rebalance(h->record))
3176                 return false;
3177
3178         state = home_get_state(h);
3179         if (!HOME_STATE_SHALL_REBALANCE(state))
3180                 return false;
3181
3182         return true;
3183 }
3184
3185 bool home_is_busy(Home *h) {
3186         assert(h);
3187
3188         if (h->current_operation)
3189                 return true;
3190
3191         if (!ordered_set_isempty(h->pending_operations))
3192                 return true;
3193
3194         return HOME_STATE_IS_EXECUTING_OPERATION(home_get_state(h));
3195 }
3196
3197 static const char* const home_state_table[_HOME_STATE_MAX] = {
3198         [HOME_UNFIXATED]                   = "unfixated",
3199         [HOME_ABSENT]                      = "absent",
3200         [HOME_INACTIVE]                    = "inactive",
3201         [HOME_DIRTY]                       = "dirty",
3202         [HOME_FIXATING]                    = "fixating",
3203         [HOME_FIXATING_FOR_ACTIVATION]     = "fixating-for-activation",
3204         [HOME_FIXATING_FOR_ACQUIRE]        = "fixating-for-acquire",
3205         [HOME_ACTIVATING]                  = "activating",
3206         [HOME_ACTIVATING_FOR_ACQUIRE]      = "activating-for-acquire",
3207         [HOME_DEACTIVATING]                = "deactivating",
3208         [HOME_ACTIVE]                      = "active",
3209         [HOME_LINGERING]                   = "lingering",
3210         [HOME_LOCKING]                     = "locking",
3211         [HOME_LOCKED]                      = "locked",
3212         [HOME_UNLOCKING]                   = "unlocking",
3213         [HOME_UNLOCKING_FOR_ACQUIRE]       = "unlocking-for-acquire",
3214         [HOME_CREATING]                    = "creating",
3215         [HOME_REMOVING]                    = "removing",
3216         [HOME_UPDATING]                    = "updating",
3217         [HOME_UPDATING_WHILE_ACTIVE]       = "updating-while-active",
3218         [HOME_RESIZING]                    = "resizing",
3219         [HOME_RESIZING_WHILE_ACTIVE]       = "resizing-while-active",
3220         [HOME_PASSWD]                      = "passwd",
3221         [HOME_PASSWD_WHILE_ACTIVE]         = "passwd-while-active",
3222         [HOME_AUTHENTICATING]              = "authenticating",
3223         [HOME_AUTHENTICATING_WHILE_ACTIVE] = "authenticating-while-active",
3224         [HOME_AUTHENTICATING_FOR_ACQUIRE]  = "authenticating-for-acquire",
3225 };
3226
3227 DEFINE_STRING_TABLE_LOOKUP(home_state, HomeState);