core: add two new unit file settings: StandardInputData= + StandardInputText=

[thirdparty/systemd.git] / src / core / execute.h

diff --git a/src/core/execute.h b/src/core/execute.h
index 4742f4e6c1ce57c72d0f0ec4dad5037dc5f83b62..d1cf7dca9314a8a3a43f1ab98319896a7a1f799e 100644 (file)
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -37,6 +37,8 @@ typedef struct ExecParameters ExecParameters;
 #include "namespace.h"
 #include "nsflags.h"
 
+#define EXEC_STDIN_DATA_MAX (64U*1024U*1024U)
+
 typedef enum ExecUtmpMode {
         EXEC_UTMP_INIT,
         EXEC_UTMP_LOGIN,
@@ -52,6 +54,7 @@ typedef enum ExecInput {
         EXEC_INPUT_TTY_FAIL,
         EXEC_INPUT_SOCKET,
         EXEC_INPUT_NAMED_FD,
+        EXEC_INPUT_DATA,
         _EXEC_INPUT_MAX,
         _EXEC_INPUT_INVALID = -1
 } ExecInput;
@@ -80,6 +83,14 @@ typedef enum ExecPreserveMode {
         _EXEC_PRESERVE_MODE_INVALID = -1
 } ExecPreserveMode;
 
+typedef enum ExecKeyringMode {
+        EXEC_KEYRING_INHERIT,
+        EXEC_KEYRING_PRIVATE,
+        EXEC_KEYRING_SHARED,
+        _EXEC_KEYRING_MODE_MAX,
+        _EXEC_KEYRING_MODE_INVALID = -1,
+} ExecKeyringMode;
+
 struct ExecStatus {
         dual_timestamp start_timestamp;
         dual_timestamp exit_timestamp;
@@ -91,6 +102,8 @@ struct ExecStatus {
 typedef enum ExecCommandFlags {
         EXEC_COMMAND_IGNORE_FAILURE = 1,
         EXEC_COMMAND_FULLY_PRIVILEGED = 2,
+        EXEC_COMMAND_NO_SETUID = 4,
+        EXEC_COMMAND_AMBIENT_MAGIC = 8,
 } ExecCommandFlags;
 
 struct ExecCommand {
@@ -118,8 +131,8 @@ typedef enum ExecDirectoryType {
         EXEC_DIRECTORY_CACHE,
         EXEC_DIRECTORY_LOGS,
         EXEC_DIRECTORY_CONFIGURATION,
-        _EXEC_DIRECTORY_MAX,
-        _EXEC_DIRECTORY_INVALID = -1,
+        _EXEC_DIRECTORY_TYPE_MAX,
+        _EXEC_DIRECTORY_TYPE_INVALID = -1,
 } ExecDirectoryType;
 
 typedef struct ExecDirectory {
@@ -131,6 +144,7 @@ struct ExecContext {
         char **environment;
         char **environment_files;
         char **pass_environment;
+        char **unset_environment;
 
         struct rlimit *rlimit[_RLIMIT_MAX];
         char *working_directory, *root_directory, *root_image;
@@ -152,6 +166,9 @@ struct ExecContext {
         ExecOutput std_error;
         char *stdio_fdname[3];
 
+        void *stdin_data;
+        size_t stdin_data_size;
+
         nsec_t timer_slack_nsec;
 
         bool stdio_as_fds;
@@ -186,6 +203,8 @@ struct ExecContext {
         bool smack_process_label_ignore;
         char *smack_process_label;
 
+        ExecKeyringMode keyring_mode;
+
         char **read_write_paths, **read_only_paths, **inaccessible_paths;
         unsigned long mount_flags;
         BindMount *bind_mounts;
@@ -199,6 +218,11 @@ struct ExecContext {
         char *syslog_identifier;
         bool syslog_level_prefix;
 
+        int log_level_max;
+
+        struct iovec* log_extra_fields;
+        size_t n_log_extra_fields;
+
         bool cpu_sched_reset_on_fork;
         bool non_blocking;
         bool private_tmp;
@@ -225,10 +249,11 @@ struct ExecContext {
         bool same_pgrp;
 
         unsigned long personality;
+        bool lock_personality;
 
         unsigned long restrict_namespaces; /* The CLONE_NEWxyz flags permitted to the unit's processes */
 
-        Set *syscall_filter;
+        Hashmap *syscall_filter;
         Set *syscall_archs;
         int syscall_errno;
         bool syscall_whitelist:1;
@@ -237,7 +262,7 @@ struct ExecContext {
         bool address_families_whitelist:1;
 
         ExecPreserveMode runtime_directory_preserve_mode;
-        ExecDirectory directories[_EXEC_DIRECTORY_MAX];
+        ExecDirectory directories[_EXEC_DIRECTORY_TYPE_MAX];
 
         bool memory_deny_write_execute;
         bool restrict_realtime;
@@ -255,16 +280,20 @@ static inline bool exec_context_restrict_namespaces_set(const ExecContext *c) {
 }
 
 typedef enum ExecFlags {
-        EXEC_APPLY_PERMISSIONS = 1U << 0,
+        EXEC_APPLY_SANDBOXING  = 1U << 0,
         EXEC_APPLY_CHROOT      = 1U << 1,
         EXEC_APPLY_TTY_STDIN   = 1U << 2,
         EXEC_NEW_KEYRING       = 1U << 3,
+        EXEC_PASS_LOG_UNIT     = 1U << 4, /* Whether to pass the unit name to the service's journal stream connection */
+        EXEC_CHOWN_DIRECTORIES = 1U << 5, /* chown() the runtime/state/cache/log directories to the user we run as, under all conditions */
+        EXEC_NSS_BYPASS_BUS    = 1U << 6, /* Set the SYSTEMD_NSS_BYPASS_BUS environment variable, to disable nss-systemd for dbus */
+        EXEC_CGROUP_DELEGATE   = 1U << 7,
 
         /* The following are not used by execute.c, but by consumers internally */
-        EXEC_PASS_FDS          = 1U << 4,
-        EXEC_IS_CONTROL        = 1U << 5,
-        EXEC_SETENV_RESULT     = 1U << 6,
-        EXEC_SET_WATCHDOG      = 1U << 7,
+        EXEC_PASS_FDS          = 1U << 8,
+        EXEC_IS_CONTROL        = 1U << 9,
+        EXEC_SETENV_RESULT     = 1U << 10,
+        EXEC_SET_WATCHDOG      = 1U << 11,
 } ExecFlags;
 
 struct ExecParameters {
@@ -279,7 +308,6 @@ struct ExecParameters {
         ExecFlags flags;
         bool selinux_context_net:1;
 
-        bool cgroup_delegate:1;
         CGroupMask cgroup_supported;
         const char *cgroup_path;
 
@@ -336,6 +364,8 @@ bool exec_context_maintains_privileges(ExecContext *c);
 
 int exec_context_get_effective_ioprio(ExecContext *c);
 
+void exec_context_free_log_extra_fields(ExecContext *c);
+
 void exec_status_start(ExecStatus *s, pid_t pid);
 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status);
 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix);
@@ -361,5 +391,8 @@ ExecUtmpMode exec_utmp_mode_from_string(const char *s) _pure_;
 const char* exec_preserve_mode_to_string(ExecPreserveMode i) _const_;
 ExecPreserveMode exec_preserve_mode_from_string(const char *s) _pure_;
 
+const char* exec_keyring_mode_to_string(ExecKeyringMode i) _const_;
+ExecKeyringMode exec_keyring_mode_from_string(const char *s) _pure_;
+
 const char* exec_directory_type_to_string(ExecDirectoryType i) _const_;
 ExecDirectoryType exec_directory_type_from_string(const char *s) _pure_;