src/sysctl/sysctl.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <getopt.h>
   5 #include <limits.h>
   6 #include <stdbool.h>
   7 #include <stdio.h>
   8 #include <stdlib.h>
   9 #include <sys/stat.h>
  10 #include <sys/types.h>
  11
  12 #include "build.h"
  13 #include "conf-files.h"
  14 #include "constants.h"
  15 #include "creds-util.h"
  16 #include "errno-util.h"
  17 #include "fd-util.h"
  18 #include "fileio.h"
  19 #include "glob-util.h"
  20 #include "hashmap.h"
  21 #include "log.h"
  22 #include "main-func.h"
  23 #include "pager.h"
  24 #include "path-util.h"
  25 #include "pretty-print.h"
  26 #include "string-util.h"
  27 #include "strv.h"
  28 #include "sysctl-util.h"
  29
  30 static char **arg_prefixes = NULL;
  31 static bool arg_cat_config = false;
  32 static bool arg_strict = false;
  33 static PagerFlags arg_pager_flags = 0;
  34
  35 STATIC_DESTRUCTOR_REGISTER(arg_prefixes, strv_freep);
  36
  37 typedef struct Option {
  38         char *key;
  39         char *value;
  40         bool ignore_failure;
  41 } Option;
  42
  43 static Option *option_free(Option *o) {
  44         if (!o)
  45                 return NULL;
  46
  47         free(o->key);
  48         free(o->value);
  49
  50         return mfree(o);
  51 }
  52
  53 DEFINE_TRIVIAL_CLEANUP_FUNC(Option*, option_free);
  54 DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(option_hash_ops, char, string_hash_func, string_compare_func, Option, option_free);
  55
  56 static bool test_prefix(const char *p) {
  57         if (strv_isempty(arg_prefixes))
  58                 return true;
  59
  60         return path_startswith_strv(p, arg_prefixes);
  61 }
  62
  63 static Option *option_new(
  64                 const char *key,
  65                 const char *value,
  66                 bool ignore_failure) {
  67
  68         _cleanup_(option_freep) Option *o = NULL;
  69
  70         assert(key);
  71
  72         o = new(Option, 1);
  73         if (!o)
  74                 return NULL;
  75
  76         *o = (Option) {
  77                 .key = strdup(key),
  78                 .value = value ? strdup(value) : NULL,
  79                 .ignore_failure = ignore_failure,
  80         };
  81
  82         if (!o->key)
  83                 return NULL;
  84         if (value && !o->value)
  85                 return NULL;
  86
  87         return TAKE_PTR(o);
  88 }
  89
  90 static int sysctl_write_or_warn(const char *key, const char *value, bool ignore_failure, bool ignore_enoent) {
  91         int r;
  92
  93         r = sysctl_write(key, value);
  94         if (r < 0) {
  95                 /* Proceed without failing if ignore_failure is true.
  96                  * If the sysctl is not available in the kernel or we are running with reduced privileges and
  97                  * cannot write it, then log about the issue, and proceed without failing. Unless strict mode
  98                  * (arg_strict = true) is enabled, in which case we should fail. (EROFS is treated as a
  99                  * permission problem here, since that's how container managers usually protected their
 100                  * sysctls.)
 101                  * In all other cases log an error and make the tool fail. */
 102                 if (ignore_failure || (!arg_strict && (r == -EROFS || ERRNO_IS_PRIVILEGE(r))))
 103                         log_debug_errno(r, "Couldn't write '%s' to '%s', ignoring: %m", value, key);
 104                 else if (ignore_enoent && r == -ENOENT)
 105                         log_warning_errno(r, "Couldn't write '%s' to '%s', ignoring: %m", value, key);
 106                 else
 107                         return log_error_errno(r, "Couldn't write '%s' to '%s': %m", value, key);
 108         }
 109
 110         return 0;
 111 }
 112
 113 static int apply_glob_option_with_prefix(OrderedHashmap *sysctl_options, Option *option, const char *prefix) {
 114         _cleanup_strv_free_ char **paths = NULL;
 115         _cleanup_free_ char *pattern = NULL;
 116         int r, k;
 117
 118         assert(sysctl_options);
 119         assert(option);
 120
 121         if (prefix) {
 122                 _cleanup_free_ char *key = NULL;
 123
 124                 r = path_glob_can_match(option->key, prefix, &key);
 125                 if (r < 0)
 126                         return log_error_errno(r, "Failed to check if the glob '%s' matches prefix '%s': %m",
 127                                                option->key, prefix);
 128                 if (r == 0) {
 129                         log_debug("The glob '%s' does not match prefix '%s'.", option->key, prefix);
 130                         return 0;
 131                 }
 132
 133                 log_debug("The glob '%s' is prefixed with '%s': '%s'", option->key, prefix, key);
 134
 135                 if (!string_is_glob(key)) {
 136                         /* The prefixed pattern is not glob anymore. Let's skip to call glob(). */
 137                         if (ordered_hashmap_contains(sysctl_options, key)) {
 138                                 log_debug("Not setting %s (explicit setting exists).", key);
 139                                 return 0;
 140                         }
 141
 142                         return sysctl_write_or_warn(key, option->value,
 143                                                     /* ignore_failure = */ option->ignore_failure,
 144                                                     /* ignore_enoent = */ true);
 145                 }
 146
 147                 pattern = path_join("/proc/sys", key);
 148         } else
 149                 pattern = path_join("/proc/sys", option->key);
 150         if (!pattern)
 151                 return log_oom();
 152
 153         r = glob_extend(&paths, pattern, GLOB_NOCHECK);
 154         if (r < 0) {
 155                 if (r == -ENOENT) {
 156                         log_debug("No match for glob: %s", option->key);
 157                         return 0;
 158                 }
 159                 if (option->ignore_failure || ERRNO_IS_PRIVILEGE(r)) {
 160                         log_debug_errno(r, "Failed to resolve glob '%s', ignoring: %m", option->key);
 161                         return 0;
 162                 } else
 163                         return log_error_errno(r, "Couldn't resolve glob '%s': %m", option->key);
 164         }
 165
 166         STRV_FOREACH(s, paths) {
 167                 const char *key;
 168
 169                 assert_se(key = path_startswith(*s, "/proc/sys"));
 170
 171                 if (ordered_hashmap_contains(sysctl_options, key)) {
 172                         log_debug("Not setting %s (explicit setting exists).", key);
 173                         continue;
 174                 }
 175
 176                 k = sysctl_write_or_warn(key, option->value,
 177                                          /* ignore_failure = */ option->ignore_failure,
 178                                          /* ignore_enoent = */ !arg_strict);
 179                 if (k < 0 && r >= 0)
 180                         r = k;
 181         }
 182
 183         return r;
 184 }
 185
 186 static int apply_glob_option(OrderedHashmap *sysctl_options, Option *option) {
 187         int r = 0, k;
 188
 189         if (strv_isempty(arg_prefixes))
 190                 return apply_glob_option_with_prefix(sysctl_options, option, NULL);
 191
 192         STRV_FOREACH(i, arg_prefixes) {
 193                 k = apply_glob_option_with_prefix(sysctl_options, option, *i);
 194                 if (k < 0 && r >= 0)
 195                         r = k;
 196         }
 197
 198         return r;
 199 }
 200
 201 static int apply_all(OrderedHashmap *sysctl_options) {
 202         Option *option;
 203         int r = 0;
 204
 205         ORDERED_HASHMAP_FOREACH(option, sysctl_options) {
 206                 int k;
 207
 208                 /* Ignore "negative match" options, they are there only to exclude stuff from globs. */
 209                 if (!option->value)
 210                         continue;
 211
 212                 if (string_is_glob(option->key))
 213                         k = apply_glob_option(sysctl_options, option);
 214                 else
 215                         k = sysctl_write_or_warn(option->key, option->value,
 216                                                  /* ignore_failure = */ option->ignore_failure,
 217                                                  /* ignore_enoent = */ !arg_strict);
 218                 if (k < 0 && r >= 0)
 219                         r = k;
 220         }
 221
 222         return r;
 223 }
 224
 225 static int parse_file(OrderedHashmap **sysctl_options, const char *path, bool ignore_enoent) {
 226         _cleanup_fclose_ FILE *f = NULL;
 227         _cleanup_free_ char *pp = NULL;
 228         unsigned c = 0;
 229         int r;
 230
 231         assert(path);
 232
 233         r = search_and_fopen(path, "re", NULL, (const char**) CONF_PATHS_STRV("sysctl.d"), &f, &pp);
 234         if (r < 0) {
 235                 if (ignore_enoent && r == -ENOENT)
 236                         return 0;
 237
 238                 return log_error_errno(r, "Failed to open file '%s', ignoring: %m", path);
 239         }
 240
 241         log_debug("Parsing %s", pp);
 242         for (;;) {
 243                 _cleanup_(option_freep) Option *new_option = NULL;
 244                 _cleanup_free_ char *l = NULL;
 245                 bool ignore_failure = false;
 246                 Option *existing;
 247                 char *p, *value;
 248                 int k;
 249
 250                 k = read_line(f, LONG_LINE_MAX, &l);
 251                 if (k == 0)
 252                         break;
 253                 if (k < 0)
 254                         return log_error_errno(k, "Failed to read file '%s', ignoring: %m", pp);
 255
 256                 c++;
 257
 258                 p = strstrip(l);
 259
 260                 if (isempty(p))
 261                         continue;
 262                 if (strchr(COMMENTS "\n", *p))
 263                         continue;
 264
 265                 value = strchr(p, '=');
 266                 if (value) {
 267                         if (p[0] == '-') {
 268                                 ignore_failure = true;
 269                                 p++;
 270                         }
 271
 272                         *value = 0;
 273                         value++;
 274                         value = strstrip(value);
 275
 276                 } else {
 277                         if (p[0] == '-')
 278                                 /* We have a "negative match" option. Let's continue with value==NULL. */
 279                                 p++;
 280                         else {
 281                                 log_syntax(NULL, LOG_WARNING, pp, c, 0,
 282                                            "Line is not an assignment, ignoring: %s", p);
 283                                 if (r == 0)
 284                                         r = -EINVAL;
 285                                 continue;
 286                         }
 287                 }
 288
 289                 p = strstrip(p);
 290                 p = sysctl_normalize(p);
 291
 292                 /* We can't filter out globs at this point, we'll need to do that later. */
 293                 if (!string_is_glob(p) &&
 294                     !test_prefix(p))
 295                         continue;
 296
 297                 existing = ordered_hashmap_get(*sysctl_options, p);
 298                 if (existing) {
 299                         if (streq_ptr(value, existing->value)) {
 300                                 existing->ignore_failure = existing->ignore_failure || ignore_failure;
 301                                 continue;
 302                         }
 303
 304                         log_debug("Overwriting earlier assignment of %s at '%s:%u'.", p, pp, c);
 305                         option_free(ordered_hashmap_remove(*sysctl_options, p));
 306                 }
 307
 308                 new_option = option_new(p, value, ignore_failure);
 309                 if (!new_option)
 310                         return log_oom();
 311
 312                 k = ordered_hashmap_ensure_put(sysctl_options, &option_hash_ops, new_option->key, new_option);
 313                 if (k < 0)
 314                         return log_error_errno(k, "Failed to add sysctl variable %s to hashmap: %m", p);
 315
 316                 TAKE_PTR(new_option);
 317         }
 318
 319         return r;
 320 }
 321
 322 static int read_credential_lines(OrderedHashmap **sysctl_options) {
 323         _cleanup_free_ char *j = NULL;
 324         const char *d;
 325         int r;
 326
 327         r = get_credentials_dir(&d);
 328         if (r == -ENXIO)
 329                 return 0;
 330         if (r < 0)
 331                 return log_error_errno(r, "Failed to get credentials directory: %m");
 332
 333         j = path_join(d, "sysctl.extra");
 334         if (!j)
 335                 return log_oom();
 336
 337         (void) parse_file(sysctl_options, j, /* ignore_enoent= */ true);
 338         return 0;
 339 }
 340
 341 static int help(void) {
 342         _cleanup_free_ char *link = NULL;
 343         int r;
 344
 345         r = terminal_urlify_man("systemd-sysctl.service", "8", &link);
 346         if (r < 0)
 347                 return log_oom();
 348
 349         printf("%s [OPTIONS...] [CONFIGURATION FILE...]\n\n"
 350                "Applies kernel sysctl settings.\n\n"
 351                "  -h --help             Show this help\n"
 352                "     --version          Show package version\n"
 353                "     --cat-config       Show configuration files\n"
 354                "     --prefix=PATH      Only apply rules with the specified prefix\n"
 355                "     --no-pager         Do not pipe output into a pager\n"
 356                "\nSee the %s for details.\n",
 357                program_invocation_short_name,
 358                link);
 359
 360         return 0;
 361 }
 362
 363 static int parse_argv(int argc, char *argv[]) {
 364
 365         enum {
 366                 ARG_VERSION = 0x100,
 367                 ARG_CAT_CONFIG,
 368                 ARG_PREFIX,
 369                 ARG_NO_PAGER,
 370                 ARG_STRICT,
 371         };
 372
 373         static const struct option options[] = {
 374                 { "help",       no_argument,       NULL, 'h'            },
 375                 { "version",    no_argument,       NULL, ARG_VERSION    },
 376                 { "cat-config", no_argument,       NULL, ARG_CAT_CONFIG },
 377                 { "prefix",     required_argument, NULL, ARG_PREFIX     },
 378                 { "no-pager",   no_argument,       NULL, ARG_NO_PAGER   },
 379                 { "strict",     no_argument,       NULL, ARG_STRICT     },
 380                 {}
 381         };
 382
 383         int c;
 384
 385         assert(argc >= 0);
 386         assert(argv);
 387
 388         while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0)
 389
 390                 switch (c) {
 391
 392                 case 'h':
 393                         return help();
 394
 395                 case ARG_VERSION:
 396                         return version();
 397
 398                 case ARG_CAT_CONFIG:
 399                         arg_cat_config = true;
 400                         break;
 401
 402                 case ARG_PREFIX: {
 403                         const char *s;
 404                         char *p;
 405
 406                         /* We used to require people to specify absolute paths
 407                          * in /proc/sys in the past. This is kinda useless, but
 408                          * we need to keep compatibility. We now support any
 409                          * sysctl name available. */
 410                         sysctl_normalize(optarg);
 411
 412                         s = path_startswith(optarg, "/proc/sys");
 413                         p = strdup(s ?: optarg);
 414                         if (!p)
 415                                 return log_oom();
 416
 417                         if (strv_consume(&arg_prefixes, p) < 0)
 418                                 return log_oom();
 419
 420                         break;
 421                 }
 422
 423                 case ARG_NO_PAGER:
 424                         arg_pager_flags |= PAGER_DISABLE;
 425                         break;
 426
 427                 case ARG_STRICT:
 428                         arg_strict = true;
 429                         break;
 430
 431                 case '?':
 432                         return -EINVAL;
 433
 434                 default:
 435                         assert_not_reached();
 436                 }
 437
 438         if (arg_cat_config && argc > optind)
 439                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 440                                        "Positional arguments are not allowed with --cat-config");
 441
 442         return 1;
 443 }
 444
 445 static int run(int argc, char *argv[]) {
 446         _cleanup_ordered_hashmap_free_ OrderedHashmap *sysctl_options = NULL;
 447         int r, k;
 448
 449         r = parse_argv(argc, argv);
 450         if (r <= 0)
 451                 return r;
 452
 453         log_setup();
 454
 455         umask(0022);
 456
 457         if (argc > optind) {
 458                 int i;
 459
 460                 r = 0;
 461
 462                 for (i = optind; i < argc; i++) {
 463                         k = parse_file(&sysctl_options, argv[i], false);
 464                         if (k < 0 && r == 0)
 465                                 r = k;
 466                 }
 467         } else {
 468                 _cleanup_strv_free_ char **files = NULL;
 469
 470                 r = conf_files_list_strv(&files, ".conf", NULL, 0, (const char**) CONF_PATHS_STRV("sysctl.d"));
 471                 if (r < 0)
 472                         return log_error_errno(r, "Failed to enumerate sysctl.d files: %m");
 473
 474                 if (arg_cat_config) {
 475                         pager_open(arg_pager_flags);
 476
 477                         return cat_files(NULL, files, 0);
 478                 }
 479
 480                 STRV_FOREACH(f, files) {
 481                         k = parse_file(&sysctl_options, *f, true);
 482                         if (k < 0 && r == 0)
 483                                 r = k;
 484                 }
 485
 486                 k = read_credential_lines(&sysctl_options);
 487                 if (k < 0 && r == 0)
 488                         r = k;
 489         }
 490
 491         k = apply_all(sysctl_options);
 492         if (k < 0 && r == 0)
 493                 r = k;
 494
 495         return r;
 496 }
 497
 498 DEFINE_MAIN_FUNCTION(run);