src/core/dbus-execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <sys/mount.h>
   4 #include <sys/prctl.h>
   5 #include "af-list.h"
   6 #include "alloc-util.h"
   7 #include "bus-get-properties.h"
   8 #include "bus-util.h"
   9 #include "cap-list.h"
  10 #include "capability-util.h"
  11 #include "cpu-set-util.h"
  12 #include "creds-util.h"
  13 #include "dbus-execute.h"
  14 #include "dbus-util.h"
  15 #include "env-util.h"
  16 #include "errno-list.h"
  17 #include "escape.h"
  18 #include "exec-credential.h"
  19 #include "execute.h"
  20 #include "fd-util.h"
  21 #include "fileio.h"
  22 #include "hexdecoct.h"
  23 #include "iovec-util.h"
  24 #include "ioprio-util.h"
  25 #include "journal-file.h"
  26 #include "load-fragment.h"
  27 #include "memstream-util.h"
  28 #include "missing_ioprio.h"
  29 #include "mountpoint-util.h"
  30 #include "namespace.h"
  31 #include "parse-util.h"
  32 #include "path-util.h"
  33 #include "pcre2-util.h"
  34 #include "process-util.h"
  35 #include "rlimit-util.h"
  36 #include "seccomp-util.h"
  37 #include "securebits-util.h"
  38 #include "specifier.h"
  39 #include "stat-util.h"
  40 #include "strv.h"
  41 #include "syslog-util.h"
  42 #include "unit-printf.h"
  43 #include "user-util.h"
  44 #include "utf8.h"
  45
  46 BUS_DEFINE_PROPERTY_GET_ENUM(bus_property_get_exec_output, exec_output, ExecOutput);
  47 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_input, exec_input, ExecInput);
  48 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_utmp_mode, exec_utmp_mode, ExecUtmpMode);
  49 BUS_DEFINE_PROPERTY_GET_ENUM(bus_property_get_exec_preserve_mode, exec_preserve_mode, ExecPreserveMode);
  50 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_keyring_mode, exec_keyring_mode, ExecKeyringMode);
  51 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_protect_proc, protect_proc, ProtectProc);
  52 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_proc_subset, proc_subset, ProcSubset);
  53 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_protect_home, protect_home, ProtectHome);
  54 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_protect_system, protect_system, ProtectSystem);
  55 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_personality, personality, unsigned long);
  56 static BUS_DEFINE_PROPERTY_GET(property_get_ioprio, "i", ExecContext, exec_context_get_effective_ioprio);
  57 static BUS_DEFINE_PROPERTY_GET(property_get_mount_apivfs, "b", ExecContext, exec_context_get_effective_mount_apivfs);
  58 static BUS_DEFINE_PROPERTY_GET2(property_get_ioprio_class, "i", ExecContext, exec_context_get_effective_ioprio, ioprio_prio_class);
  59 static BUS_DEFINE_PROPERTY_GET2(property_get_ioprio_priority, "i", ExecContext, exec_context_get_effective_ioprio, ioprio_prio_data);
  60 static BUS_DEFINE_PROPERTY_GET_GLOBAL(property_get_empty_string, "s", NULL);
  61 static BUS_DEFINE_PROPERTY_GET_REF(property_get_syslog_level, "i", int, LOG_PRI);
  62 static BUS_DEFINE_PROPERTY_GET_REF(property_get_syslog_facility, "i", int, LOG_FAC);
  63 static BUS_DEFINE_PROPERTY_GET(property_get_cpu_affinity_from_numa, "b", ExecContext, exec_context_get_cpu_affinity_from_numa);
  64 static BUS_DEFINE_PROPERTY_GET(property_get_oom_score_adjust, "i", ExecContext, exec_context_get_oom_score_adjust);
  65 static BUS_DEFINE_PROPERTY_GET(property_get_nice, "i", ExecContext, exec_context_get_nice);
  66 static BUS_DEFINE_PROPERTY_GET(property_get_cpu_sched_policy, "i", ExecContext, exec_context_get_cpu_sched_policy);
  67 static BUS_DEFINE_PROPERTY_GET(property_get_cpu_sched_priority, "i", ExecContext, exec_context_get_cpu_sched_priority);
  68 static BUS_DEFINE_PROPERTY_GET(property_get_coredump_filter, "t", ExecContext, exec_context_get_coredump_filter);
  69 static BUS_DEFINE_PROPERTY_GET(property_get_timer_slack_nsec, "t", ExecContext, exec_context_get_timer_slack_nsec);
  70
  71 static int property_get_environment_files(
  72                 sd_bus *bus,
  73                 const char *path,
  74                 const char *interface,
  75                 const char *property,
  76                 sd_bus_message *reply,
  77                 void *userdata,
  78                 sd_bus_error *error) {
  79
  80         ExecContext *c = ASSERT_PTR(userdata);
  81         int r;
  82
  83         assert(bus);
  84         assert(reply);
  85
  86         r = sd_bus_message_open_container(reply, 'a', "(sb)");
  87         if (r < 0)
  88                 return r;
  89
  90         STRV_FOREACH(j, c->environment_files) {
  91                 const char *fn = *j;
  92
  93                 r = sd_bus_message_append(reply, "(sb)", fn[0] == '-' ? fn + 1 : fn, fn[0] == '-');
  94                 if (r < 0)
  95                         return r;
  96         }
  97
  98         return sd_bus_message_close_container(reply);
  99 }
 100
 101 static int property_get_cpu_affinity(
 102                 sd_bus *bus,
 103                 const char *path,
 104                 const char *interface,
 105                 const char *property,
 106                 sd_bus_message *reply,
 107                 void *userdata,
 108                 sd_bus_error *error) {
 109
 110         ExecContext *c = ASSERT_PTR(userdata);
 111         _cleanup_(cpu_set_reset) CPUSet s = {};
 112         _cleanup_free_ uint8_t *array = NULL;
 113         size_t allocated;
 114
 115         assert(bus);
 116         assert(reply);
 117
 118         if (c->cpu_affinity_from_numa) {
 119                 int r;
 120
 121                 r = numa_to_cpu_set(&c->numa_policy, &s);
 122                 if (r < 0)
 123                         return r;
 124         }
 125
 126         (void) cpu_set_to_dbus(c->cpu_affinity_from_numa ? &s : &c->cpu_set,  &array, &allocated);
 127
 128         return sd_bus_message_append_array(reply, 'y', array, allocated);
 129 }
 130
 131 static int property_get_numa_mask(
 132                 sd_bus *bus,
 133                 const char *path,
 134                 const char *interface,
 135                 const char *property,
 136                 sd_bus_message *reply,
 137                 void *userdata,
 138                 sd_bus_error *error) {
 139
 140         ExecContext *c = ASSERT_PTR(userdata);
 141         _cleanup_free_ uint8_t *array = NULL;
 142         size_t allocated;
 143
 144         assert(bus);
 145         assert(reply);
 146
 147         (void) cpu_set_to_dbus(&c->numa_policy.nodes, &array, &allocated);
 148
 149         return sd_bus_message_append_array(reply, 'y', array, allocated);
 150 }
 151
 152 static int property_get_numa_policy(
 153                 sd_bus *bus,
 154                 const char *path,
 155                 const char *interface,
 156                 const char *property,
 157                 sd_bus_message *reply,
 158                 void *userdata,
 159                 sd_bus_error *error) {
 160         ExecContext *c = ASSERT_PTR(userdata);
 161         int32_t policy;
 162
 163         assert(bus);
 164         assert(reply);
 165
 166         policy = numa_policy_get_type(&c->numa_policy);
 167
 168         return sd_bus_message_append_basic(reply, 'i', &policy);
 169 }
 170
 171 static int property_get_syscall_filter(
 172                 sd_bus *bus,
 173                 const char *path,
 174                 const char *interface,
 175                 const char *property,
 176                 sd_bus_message *reply,
 177                 void *userdata,
 178                 sd_bus_error *error) {
 179
 180         ExecContext *c = ASSERT_PTR(userdata);
 181         _cleanup_strv_free_ char **l = NULL;
 182         int r;
 183
 184         assert(bus);
 185         assert(reply);
 186
 187         r = sd_bus_message_open_container(reply, 'r', "bas");
 188         if (r < 0)
 189                 return r;
 190
 191         r = sd_bus_message_append(reply, "b", c->syscall_allow_list);
 192         if (r < 0)
 193                 return r;
 194
 195         l = exec_context_get_syscall_filter(c);
 196         if (!l)
 197                 return -ENOMEM;
 198
 199         r = sd_bus_message_append_strv(reply, l);
 200         if (r < 0)
 201                 return r;
 202
 203         return sd_bus_message_close_container(reply);
 204 }
 205
 206 static int property_get_syscall_log(
 207                 sd_bus *bus,
 208                 const char *path,
 209                 const char *interface,
 210                 const char *property,
 211                 sd_bus_message *reply,
 212                 void *userdata,
 213                 sd_bus_error *error) {
 214
 215         ExecContext *c = ASSERT_PTR(userdata);
 216         _cleanup_strv_free_ char **l = NULL;
 217         int r;
 218
 219         assert(bus);
 220         assert(reply);
 221
 222         r = sd_bus_message_open_container(reply, 'r', "bas");
 223         if (r < 0)
 224                 return r;
 225
 226         r = sd_bus_message_append(reply, "b", c->syscall_log_allow_list);
 227         if (r < 0)
 228                 return r;
 229
 230         l = exec_context_get_syscall_log(c);
 231         if (!l)
 232                 return -ENOMEM;
 233
 234         r = sd_bus_message_append_strv(reply, l);
 235         if (r < 0)
 236                 return r;
 237
 238         return sd_bus_message_close_container(reply);
 239 }
 240
 241 static int property_get_syscall_archs(
 242                 sd_bus *bus,
 243                 const char *path,
 244                 const char *interface,
 245                 const char *property,
 246                 sd_bus_message *reply,
 247                 void *userdata,
 248                 sd_bus_error *error) {
 249
 250         ExecContext *c = ASSERT_PTR(userdata);
 251         _cleanup_strv_free_ char **l = NULL;
 252         int r;
 253
 254         assert(bus);
 255         assert(reply);
 256
 257         l = exec_context_get_syscall_archs(c);
 258         if (!l)
 259                 return -ENOMEM;
 260
 261         r = sd_bus_message_append_strv(reply, l);
 262         if (r < 0)
 263                 return r;
 264
 265         return 0;
 266 }
 267
 268 static int property_get_selinux_context(
 269                 sd_bus *bus,
 270                 const char *path,
 271                 const char *interface,
 272                 const char *property,
 273                 sd_bus_message *reply,
 274                 void *userdata,
 275                 sd_bus_error *error) {
 276
 277         ExecContext *c = ASSERT_PTR(userdata);
 278
 279         assert(bus);
 280         assert(reply);
 281
 282         return sd_bus_message_append(reply, "(bs)", c->selinux_context_ignore, c->selinux_context);
 283 }
 284
 285 static int property_get_apparmor_profile(
 286                 sd_bus *bus,
 287                 const char *path,
 288                 const char *interface,
 289                 const char *property,
 290                 sd_bus_message *reply,
 291                 void *userdata,
 292                 sd_bus_error *error) {
 293
 294         ExecContext *c = ASSERT_PTR(userdata);
 295
 296         assert(bus);
 297         assert(reply);
 298
 299         return sd_bus_message_append(reply, "(bs)", c->apparmor_profile_ignore, c->apparmor_profile);
 300 }
 301
 302 static int property_get_smack_process_label(
 303                 sd_bus *bus,
 304                 const char *path,
 305                 const char *interface,
 306                 const char *property,
 307                 sd_bus_message *reply,
 308                 void *userdata,
 309                 sd_bus_error *error) {
 310
 311         ExecContext *c = ASSERT_PTR(userdata);
 312
 313         assert(bus);
 314         assert(reply);
 315
 316         return sd_bus_message_append(reply, "(bs)", c->smack_process_label_ignore, c->smack_process_label);
 317 }
 318
 319 static int property_get_address_families(
 320                 sd_bus *bus,
 321                 const char *path,
 322                 const char *interface,
 323                 const char *property,
 324                 sd_bus_message *reply,
 325                 void *userdata,
 326                 sd_bus_error *error) {
 327
 328         ExecContext *c = ASSERT_PTR(userdata);
 329         _cleanup_strv_free_ char **l = NULL;
 330         int r;
 331
 332         assert(bus);
 333         assert(reply);
 334
 335         r = sd_bus_message_open_container(reply, 'r', "bas");
 336         if (r < 0)
 337                 return r;
 338
 339         r = sd_bus_message_append(reply, "b", c->address_families_allow_list);
 340         if (r < 0)
 341                 return r;
 342
 343         l = exec_context_get_address_families(c);
 344         if (!l)
 345                 return -ENOMEM;
 346
 347         r = sd_bus_message_append_strv(reply, l);
 348         if (r < 0)
 349                 return r;
 350
 351         return sd_bus_message_close_container(reply);
 352 }
 353
 354 static int property_get_working_directory(
 355                 sd_bus *bus,
 356                 const char *path,
 357                 const char *interface,
 358                 const char *property,
 359                 sd_bus_message *reply,
 360                 void *userdata,
 361                 sd_bus_error *error) {
 362
 363         ExecContext *c = ASSERT_PTR(userdata);
 364         const char *wd;
 365
 366         assert(bus);
 367         assert(reply);
 368
 369         if (c->working_directory_home)
 370                 wd = "~";
 371         else
 372                 wd = c->working_directory;
 373
 374         if (c->working_directory_missing_ok)
 375                 wd = strjoina("!", wd);
 376
 377         return sd_bus_message_append(reply, "s", wd);
 378 }
 379
 380 static int property_get_stdio_fdname(
 381                 sd_bus *bus,
 382                 const char *path,
 383                 const char *interface,
 384                 const char *property,
 385                 sd_bus_message *reply,
 386                 void *userdata,
 387                 sd_bus_error *error) {
 388
 389         ExecContext *c = ASSERT_PTR(userdata);
 390         int fileno;
 391
 392         assert(bus);
 393         assert(property);
 394         assert(reply);
 395
 396         if (streq(property, "StandardInputFileDescriptorName"))
 397                 fileno = STDIN_FILENO;
 398         else if (streq(property, "StandardOutputFileDescriptorName"))
 399                 fileno = STDOUT_FILENO;
 400         else {
 401                 assert(streq(property, "StandardErrorFileDescriptorName"));
 402                 fileno = STDERR_FILENO;
 403         }
 404
 405         return sd_bus_message_append(reply, "s", exec_context_fdname(c, fileno));
 406 }
 407
 408 static int property_get_input_data(
 409                 sd_bus *bus,
 410                 const char *path,
 411                 const char *interface,
 412                 const char *property,
 413                 sd_bus_message *reply,
 414                 void *userdata,
 415                 sd_bus_error *error) {
 416
 417         ExecContext *c = ASSERT_PTR(userdata);
 418
 419         assert(bus);
 420         assert(property);
 421         assert(reply);
 422
 423         return sd_bus_message_append_array(reply, 'y', c->stdin_data, c->stdin_data_size);
 424 }
 425
 426 static int property_get_restrict_filesystems(
 427                 sd_bus *bus,
 428                 const char *path,
 429                 const char *interface,
 430                 const char *property,
 431                 sd_bus_message *reply,
 432                 void *userdata,
 433                 sd_bus_error *error) {
 434
 435         ExecContext *c = ASSERT_PTR(userdata);
 436         _cleanup_free_ char **l = NULL;
 437         int r;
 438
 439         assert(bus);
 440         assert(reply);
 441
 442         r = sd_bus_message_open_container(reply, 'r', "bas");
 443         if (r < 0)
 444                 return r;
 445
 446         r = sd_bus_message_append(reply, "b", c->restrict_filesystems_allow_list);
 447         if (r < 0)
 448                 return r;
 449
 450         l = exec_context_get_restrict_filesystems(c);
 451         if (!l)
 452                 return -ENOMEM;
 453
 454         r = sd_bus_message_append_strv(reply, l);
 455         if (r < 0)
 456                 return r;
 457
 458         return sd_bus_message_close_container(reply);
 459 }
 460
 461 static int property_get_bind_paths(
 462                 sd_bus *bus,
 463                 const char *path,
 464                 const char *interface,
 465                 const char *property,
 466                 sd_bus_message *reply,
 467                 void *userdata,
 468                 sd_bus_error *error) {
 469
 470         ExecContext *c = ASSERT_PTR(userdata);
 471         bool ro;
 472         int r;
 473
 474         assert(bus);
 475         assert(property);
 476         assert(reply);
 477
 478         ro = strstr(property, "ReadOnly");
 479
 480         r = sd_bus_message_open_container(reply, 'a', "(ssbt)");
 481         if (r < 0)
 482                 return r;
 483
 484         for (size_t i = 0; i < c->n_bind_mounts; i++) {
 485
 486                 if (ro != c->bind_mounts[i].read_only)
 487                         continue;
 488
 489                 r = sd_bus_message_append(
 490                                 reply, "(ssbt)",
 491                                 c->bind_mounts[i].source,
 492                                 c->bind_mounts[i].destination,
 493                                 c->bind_mounts[i].ignore_enoent,
 494                                 c->bind_mounts[i].recursive ? (uint64_t) MS_REC : (uint64_t) 0);
 495                 if (r < 0)
 496                         return r;
 497         }
 498
 499         return sd_bus_message_close_container(reply);
 500 }
 501
 502 static int property_get_temporary_filesystems(
 503                 sd_bus *bus,
 504                 const char *path,
 505                 const char *interface,
 506                 const char *property,
 507                 sd_bus_message *reply,
 508                 void *userdata,
 509                 sd_bus_error *error) {
 510
 511         ExecContext *c = ASSERT_PTR(userdata);
 512         int r;
 513
 514         assert(bus);
 515         assert(property);
 516         assert(reply);
 517
 518         r = sd_bus_message_open_container(reply, 'a', "(ss)");
 519         if (r < 0)
 520                 return r;
 521
 522         for (unsigned i = 0; i < c->n_temporary_filesystems; i++) {
 523                 TemporaryFileSystem *t = c->temporary_filesystems + i;
 524
 525                 r = sd_bus_message_append(
 526                                 reply, "(ss)",
 527                                 t->path,
 528                                 t->options);
 529                 if (r < 0)
 530                         return r;
 531         }
 532
 533         return sd_bus_message_close_container(reply);
 534 }
 535
 536 static int property_get_log_extra_fields(
 537                 sd_bus *bus,
 538                 const char *path,
 539                 const char *interface,
 540                 const char *property,
 541                 sd_bus_message *reply,
 542                 void *userdata,
 543                 sd_bus_error *error) {
 544
 545         ExecContext *c = ASSERT_PTR(userdata);
 546         int r;
 547
 548         assert(bus);
 549         assert(property);
 550         assert(reply);
 551
 552         r = sd_bus_message_open_container(reply, 'a', "ay");
 553         if (r < 0)
 554                 return r;
 555
 556         for (size_t i = 0; i < c->n_log_extra_fields; i++) {
 557                 r = sd_bus_message_append_array(reply, 'y', c->log_extra_fields[i].iov_base, c->log_extra_fields[i].iov_len);
 558                 if (r < 0)
 559                         return r;
 560         }
 561
 562         return sd_bus_message_close_container(reply);
 563 }
 564
 565 static int sd_bus_message_append_log_filter_patterns(sd_bus_message *reply, Set *patterns, bool is_allowlist) {
 566         const char *pattern;
 567         int r;
 568
 569         assert(reply);
 570
 571         SET_FOREACH(pattern, patterns) {
 572                 r = sd_bus_message_append(reply, "(bs)", is_allowlist, pattern);
 573                 if (r < 0)
 574                         return r;
 575         }
 576
 577         return 0;
 578 }
 579
 580 static int property_get_log_filter_patterns(
 581                 sd_bus *bus,
 582                 const char *path,
 583                 const char *interface,
 584                 const char *property,
 585                 sd_bus_message *reply,
 586                 void *userdata,
 587                 sd_bus_error *error) {
 588
 589         ExecContext *c = userdata;
 590         int r;
 591
 592         assert(c);
 593         assert(reply);
 594
 595         r = sd_bus_message_open_container(reply, 'a', "(bs)");
 596         if (r < 0)
 597                 return r;
 598
 599         r = sd_bus_message_append_log_filter_patterns(reply, c->log_filter_allowed_patterns,
 600                                                       /* is_allowlist = */ true);
 601         if (r < 0)
 602                 return r;
 603
 604         r = sd_bus_message_append_log_filter_patterns(reply, c->log_filter_denied_patterns,
 605                                                       /* is_allowlist = */ false);
 606         if (r < 0)
 607                 return r;
 608
 609         return sd_bus_message_close_container(reply);
 610 }
 611
 612 static int property_get_set_credential(
 613                 sd_bus *bus,
 614                 const char *path,
 615                 const char *interface,
 616                 const char *property,
 617                 sd_bus_message *reply,
 618                 void *userdata,
 619                 sd_bus_error *error) {
 620
 621         ExecContext *c = ASSERT_PTR(userdata);
 622         ExecSetCredential *sc;
 623         int r;
 624
 625         assert(bus);
 626         assert(property);
 627         assert(reply);
 628
 629         r = sd_bus_message_open_container(reply, 'a', "(say)");
 630         if (r < 0)
 631                 return r;
 632
 633         HASHMAP_FOREACH(sc, c->set_credentials) {
 634
 635                 if (sc->encrypted != streq(property, "SetCredentialEncrypted"))
 636                         continue;
 637
 638                 r = sd_bus_message_open_container(reply, 'r', "say");
 639                 if (r < 0)
 640                         return r;
 641
 642                 r = sd_bus_message_append(reply, "s", sc->id);
 643                 if (r < 0)
 644                         return r;
 645
 646                 r = sd_bus_message_append_array(reply, 'y', sc->data, sc->size);
 647                 if (r < 0)
 648                         return r;
 649
 650                 r = sd_bus_message_close_container(reply);
 651                 if (r < 0)
 652                         return r;
 653         }
 654
 655         return sd_bus_message_close_container(reply);
 656 }
 657
 658 static int property_get_load_credential(
 659                 sd_bus *bus,
 660                 const char *path,
 661                 const char *interface,
 662                 const char *property,
 663                 sd_bus_message *reply,
 664                 void *userdata,
 665                 sd_bus_error *error) {
 666
 667         ExecContext *c = ASSERT_PTR(userdata);
 668         ExecLoadCredential *lc;
 669         int r;
 670
 671         assert(bus);
 672         assert(property);
 673         assert(reply);
 674
 675         r = sd_bus_message_open_container(reply, 'a', "(ss)");
 676         if (r < 0)
 677                 return r;
 678
 679         HASHMAP_FOREACH(lc, c->load_credentials) {
 680
 681                 if (lc->encrypted != streq(property, "LoadCredentialEncrypted"))
 682                         continue;
 683
 684                 r = sd_bus_message_append(reply, "(ss)", lc->id, lc->path);
 685                 if (r < 0)
 686                         return r;
 687         }
 688
 689         return sd_bus_message_close_container(reply);
 690 }
 691
 692 static int property_get_root_hash(
 693                 sd_bus *bus,
 694                 const char *path,
 695                 const char *interface,
 696                 const char *property,
 697                 sd_bus_message *reply,
 698                 void *userdata,
 699                 sd_bus_error *error) {
 700
 701         ExecContext *c = ASSERT_PTR(userdata);
 702
 703         assert(bus);
 704         assert(property);
 705         assert(reply);
 706
 707         return sd_bus_message_append_array(reply, 'y', c->root_hash, c->root_hash_size);
 708 }
 709
 710 static int property_get_root_hash_sig(
 711                 sd_bus *bus,
 712                 const char *path,
 713                 const char *interface,
 714                 const char *property,
 715                 sd_bus_message *reply,
 716                 void *userdata,
 717                 sd_bus_error *error) {
 718
 719         ExecContext *c = ASSERT_PTR(userdata);
 720
 721         assert(bus);
 722         assert(property);
 723         assert(reply);
 724
 725         return sd_bus_message_append_array(reply, 'y', c->root_hash_sig, c->root_hash_sig_size);
 726 }
 727
 728 static int property_get_root_image_options(
 729                 sd_bus *bus,
 730                 const char *path,
 731                 const char *interface,
 732                 const char *property,
 733                 sd_bus_message *reply,
 734                 void *userdata,
 735                 sd_bus_error *error) {
 736
 737         ExecContext *c = ASSERT_PTR(userdata);
 738         int r;
 739
 740         assert(bus);
 741         assert(property);
 742         assert(reply);
 743
 744         r = sd_bus_message_open_container(reply, 'a', "(ss)");
 745         if (r < 0)
 746                 return r;
 747
 748         LIST_FOREACH(mount_options, m, c->root_image_options) {
 749                 r = sd_bus_message_append(reply, "(ss)",
 750                                           partition_designator_to_string(m->partition_designator),
 751                                           m->options);
 752                 if (r < 0)
 753                         return r;
 754         }
 755
 756         return sd_bus_message_close_container(reply);
 757 }
 758
 759 static int property_get_mount_images(
 760                 sd_bus *bus,
 761                 const char *path,
 762                 const char *interface,
 763                 const char *property,
 764                 sd_bus_message *reply,
 765                 void *userdata,
 766                 sd_bus_error *error) {
 767
 768         ExecContext *c = ASSERT_PTR(userdata);
 769         int r;
 770
 771         assert(bus);
 772         assert(property);
 773         assert(reply);
 774
 775         r = sd_bus_message_open_container(reply, 'a', "(ssba(ss))");
 776         if (r < 0)
 777                 return r;
 778
 779         for (size_t i = 0; i < c->n_mount_images; i++) {
 780                 r = sd_bus_message_open_container(reply, SD_BUS_TYPE_STRUCT, "ssba(ss)");
 781                 if (r < 0)
 782                         return r;
 783                 r = sd_bus_message_append(
 784                                 reply, "ssb",
 785                                 c->mount_images[i].source,
 786                                 c->mount_images[i].destination,
 787                                 c->mount_images[i].ignore_enoent);
 788                 if (r < 0)
 789                         return r;
 790                 r = sd_bus_message_open_container(reply, 'a', "(ss)");
 791                 if (r < 0)
 792                         return r;
 793                 LIST_FOREACH(mount_options, m, c->mount_images[i].mount_options) {
 794                         r = sd_bus_message_append(reply, "(ss)",
 795                                                   partition_designator_to_string(m->partition_designator),
 796                                                   m->options);
 797                         if (r < 0)
 798                                 return r;
 799                 }
 800                 r = sd_bus_message_close_container(reply);
 801                 if (r < 0)
 802                         return r;
 803                 r = sd_bus_message_close_container(reply);
 804                 if (r < 0)
 805                         return r;
 806         }
 807
 808         return sd_bus_message_close_container(reply);
 809 }
 810
 811 static int property_get_extension_images(
 812                 sd_bus *bus,
 813                 const char *path,
 814                 const char *interface,
 815                 const char *property,
 816                 sd_bus_message *reply,
 817                 void *userdata,
 818                 sd_bus_error *error) {
 819
 820         ExecContext *c = ASSERT_PTR(userdata);
 821         int r;
 822
 823         assert(bus);
 824         assert(property);
 825         assert(reply);
 826
 827         r = sd_bus_message_open_container(reply, 'a', "(sba(ss))");
 828         if (r < 0)
 829                 return r;
 830
 831         for (size_t i = 0; i < c->n_extension_images; i++) {
 832                 r = sd_bus_message_open_container(reply, SD_BUS_TYPE_STRUCT, "sba(ss)");
 833                 if (r < 0)
 834                         return r;
 835                 r = sd_bus_message_append(
 836                                 reply, "sb",
 837                                 c->extension_images[i].source,
 838                                 c->extension_images[i].ignore_enoent);
 839                 if (r < 0)
 840                         return r;
 841                 r = sd_bus_message_open_container(reply, 'a', "(ss)");
 842                 if (r < 0)
 843                         return r;
 844                 LIST_FOREACH(mount_options, m, c->extension_images[i].mount_options) {
 845                         r = sd_bus_message_append(reply, "(ss)",
 846                                                   partition_designator_to_string(m->partition_designator),
 847                                                   m->options);
 848                         if (r < 0)
 849                                 return r;
 850                 }
 851                 r = sd_bus_message_close_container(reply);
 852                 if (r < 0)
 853                         return r;
 854                 r = sd_bus_message_close_container(reply);
 855                 if (r < 0)
 856                         return r;
 857         }
 858
 859         return sd_bus_message_close_container(reply);
 860 }
 861
 862 static int bus_property_get_exec_dir(
 863                 sd_bus *bus,
 864                 const char *path,
 865                 const char *interface,
 866                 const char *property,
 867                 sd_bus_message *reply,
 868                 void *userdata,
 869                 sd_bus_error *error) {
 870
 871         ExecDirectory *d = ASSERT_PTR(userdata);
 872         int r;
 873
 874         assert(bus);
 875         assert(property);
 876         assert(reply);
 877
 878         r = sd_bus_message_open_container(reply, 'a', "s");
 879         if (r < 0)
 880                 return r;
 881
 882         for (size_t i = 0; i < d->n_items; i++) {
 883                 r = sd_bus_message_append_basic(reply, 's', d->items[i].path);
 884                 if (r < 0)
 885                         return r;
 886         }
 887
 888         return sd_bus_message_close_container(reply);
 889 }
 890
 891 static int bus_property_get_exec_dir_symlink(
 892                 sd_bus *bus,
 893                 const char *path,
 894                 const char *interface,
 895                 const char *property,
 896                 sd_bus_message *reply,
 897                 void *userdata,
 898                 sd_bus_error *error) {
 899
 900         ExecDirectory *d = ASSERT_PTR(userdata);
 901         int r;
 902
 903         assert(bus);
 904         assert(property);
 905         assert(reply);
 906
 907         r = sd_bus_message_open_container(reply, 'a', "(sst)");
 908         if (r < 0)
 909                 return r;
 910
 911         for (size_t i = 0; i < d->n_items; i++)
 912                 STRV_FOREACH(dst, d->items[i].symlinks) {
 913                         r = sd_bus_message_append(reply, "(sst)", d->items[i].path, *dst, 0 /* flags, unused for now */);
 914                         if (r < 0)
 915                                 return r;
 916                 }
 917
 918         return sd_bus_message_close_container(reply);
 919 }
 920
 921 static int property_get_image_policy(
 922                 sd_bus *bus,
 923                 const char *path,
 924                 const char *interface,
 925                 const char *property,
 926                 sd_bus_message *reply,
 927                 void *userdata,
 928                 sd_bus_error *error) {
 929
 930         ImagePolicy **pp = ASSERT_PTR(userdata);
 931         _cleanup_free_ char *s = NULL;
 932         int r;
 933
 934         assert(bus);
 935         assert(property);
 936         assert(reply);
 937
 938         r = image_policy_to_string(*pp ?: &image_policy_service, /* simplify= */ true, &s);
 939         if (r < 0)
 940                 return r;
 941
 942         return sd_bus_message_append(reply, "s", s);
 943 }
 944
 945 const sd_bus_vtable bus_exec_vtable[] = {
 946         SD_BUS_VTABLE_START(0),
 947         SD_BUS_PROPERTY("Environment", "as", NULL, offsetof(ExecContext, environment), SD_BUS_VTABLE_PROPERTY_CONST),
 948         SD_BUS_PROPERTY("EnvironmentFiles", "a(sb)", property_get_environment_files, 0, SD_BUS_VTABLE_PROPERTY_CONST),
 949         SD_BUS_PROPERTY("PassEnvironment", "as", NULL, offsetof(ExecContext, pass_environment), SD_BUS_VTABLE_PROPERTY_CONST),
 950         SD_BUS_PROPERTY("UnsetEnvironment", "as", NULL, offsetof(ExecContext, unset_environment), SD_BUS_VTABLE_PROPERTY_CONST),
 951         SD_BUS_PROPERTY("UMask", "u", bus_property_get_mode, offsetof(ExecContext, umask), SD_BUS_VTABLE_PROPERTY_CONST),
 952         SD_BUS_PROPERTY("LimitCPU", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_CPU]), SD_BUS_VTABLE_PROPERTY_CONST),
 953         SD_BUS_PROPERTY("LimitCPUSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_CPU]), SD_BUS_VTABLE_PROPERTY_CONST),
 954         SD_BUS_PROPERTY("LimitFSIZE", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_FSIZE]), SD_BUS_VTABLE_PROPERTY_CONST),
 955         SD_BUS_PROPERTY("LimitFSIZESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_FSIZE]), SD_BUS_VTABLE_PROPERTY_CONST),
 956         SD_BUS_PROPERTY("LimitDATA", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_DATA]), SD_BUS_VTABLE_PROPERTY_CONST),
 957         SD_BUS_PROPERTY("LimitDATASoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_DATA]), SD_BUS_VTABLE_PROPERTY_CONST),
 958         SD_BUS_PROPERTY("LimitSTACK", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_STACK]), SD_BUS_VTABLE_PROPERTY_CONST),
 959         SD_BUS_PROPERTY("LimitSTACKSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_STACK]), SD_BUS_VTABLE_PROPERTY_CONST),
 960         SD_BUS_PROPERTY("LimitCORE", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_CORE]), SD_BUS_VTABLE_PROPERTY_CONST),
 961         SD_BUS_PROPERTY("LimitCORESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_CORE]), SD_BUS_VTABLE_PROPERTY_CONST),
 962         SD_BUS_PROPERTY("LimitRSS", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RSS]), SD_BUS_VTABLE_PROPERTY_CONST),
 963         SD_BUS_PROPERTY("LimitRSSSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RSS]), SD_BUS_VTABLE_PROPERTY_CONST),
 964         SD_BUS_PROPERTY("LimitNOFILE", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NOFILE]), SD_BUS_VTABLE_PROPERTY_CONST),
 965         SD_BUS_PROPERTY("LimitNOFILESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NOFILE]), SD_BUS_VTABLE_PROPERTY_CONST),
 966         SD_BUS_PROPERTY("LimitAS", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_AS]), SD_BUS_VTABLE_PROPERTY_CONST),
 967         SD_BUS_PROPERTY("LimitASSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_AS]), SD_BUS_VTABLE_PROPERTY_CONST),
 968         SD_BUS_PROPERTY("LimitNPROC", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NPROC]), SD_BUS_VTABLE_PROPERTY_CONST),
 969         SD_BUS_PROPERTY("LimitNPROCSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NPROC]), SD_BUS_VTABLE_PROPERTY_CONST),
 970         SD_BUS_PROPERTY("LimitMEMLOCK", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_MEMLOCK]), SD_BUS_VTABLE_PROPERTY_CONST),
 971         SD_BUS_PROPERTY("LimitMEMLOCKSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_MEMLOCK]), SD_BUS_VTABLE_PROPERTY_CONST),
 972         SD_BUS_PROPERTY("LimitLOCKS", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_LOCKS]), SD_BUS_VTABLE_PROPERTY_CONST),
 973         SD_BUS_PROPERTY("LimitLOCKSSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_LOCKS]), SD_BUS_VTABLE_PROPERTY_CONST),
 974         SD_BUS_PROPERTY("LimitSIGPENDING", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_SIGPENDING]), SD_BUS_VTABLE_PROPERTY_CONST),
 975         SD_BUS_PROPERTY("LimitSIGPENDINGSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_SIGPENDING]), SD_BUS_VTABLE_PROPERTY_CONST),
 976         SD_BUS_PROPERTY("LimitMSGQUEUE", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_MSGQUEUE]), SD_BUS_VTABLE_PROPERTY_CONST),
 977         SD_BUS_PROPERTY("LimitMSGQUEUESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_MSGQUEUE]), SD_BUS_VTABLE_PROPERTY_CONST),
 978         SD_BUS_PROPERTY("LimitNICE", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NICE]), SD_BUS_VTABLE_PROPERTY_CONST),
 979         SD_BUS_PROPERTY("LimitNICESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NICE]), SD_BUS_VTABLE_PROPERTY_CONST),
 980         SD_BUS_PROPERTY("LimitRTPRIO", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RTPRIO]), SD_BUS_VTABLE_PROPERTY_CONST),
 981         SD_BUS_PROPERTY("LimitRTPRIOSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RTPRIO]), SD_BUS_VTABLE_PROPERTY_CONST),
 982         SD_BUS_PROPERTY("LimitRTTIME", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RTTIME]), SD_BUS_VTABLE_PROPERTY_CONST),
 983         SD_BUS_PROPERTY("LimitRTTIMESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RTTIME]), SD_BUS_VTABLE_PROPERTY_CONST),
 984         SD_BUS_PROPERTY("WorkingDirectory", "s", property_get_working_directory, 0, SD_BUS_VTABLE_PROPERTY_CONST),
 985         SD_BUS_PROPERTY("RootDirectory", "s", NULL, offsetof(ExecContext, root_directory), SD_BUS_VTABLE_PROPERTY_CONST),
 986         SD_BUS_PROPERTY("RootImage", "s", NULL, offsetof(ExecContext, root_image), SD_BUS_VTABLE_PROPERTY_CONST),
 987         SD_BUS_PROPERTY("RootImageOptions", "a(ss)", property_get_root_image_options, 0, SD_BUS_VTABLE_PROPERTY_CONST),
 988         SD_BUS_PROPERTY("RootHash", "ay", property_get_root_hash, 0, SD_BUS_VTABLE_PROPERTY_CONST),
 989         SD_BUS_PROPERTY("RootHashPath", "s", NULL, offsetof(ExecContext, root_hash_path), SD_BUS_VTABLE_PROPERTY_CONST),
 990         SD_BUS_PROPERTY("RootHashSignature", "ay", property_get_root_hash_sig, 0, SD_BUS_VTABLE_PROPERTY_CONST),
 991         SD_BUS_PROPERTY("RootHashSignaturePath", "s", NULL, offsetof(ExecContext, root_hash_sig_path), SD_BUS_VTABLE_PROPERTY_CONST),
 992         SD_BUS_PROPERTY("RootVerity", "s", NULL, offsetof(ExecContext, root_verity), SD_BUS_VTABLE_PROPERTY_CONST),
 993         SD_BUS_PROPERTY("RootEphemeral", "b", bus_property_get_bool, offsetof(ExecContext, root_ephemeral), SD_BUS_VTABLE_PROPERTY_CONST),
 994         SD_BUS_PROPERTY("ExtensionDirectories", "as", NULL, offsetof(ExecContext, extension_directories), SD_BUS_VTABLE_PROPERTY_CONST),
 995         SD_BUS_PROPERTY("ExtensionImages", "a(sba(ss))", property_get_extension_images, 0, SD_BUS_VTABLE_PROPERTY_CONST),
 996         SD_BUS_PROPERTY("MountImages", "a(ssba(ss))", property_get_mount_images, 0, SD_BUS_VTABLE_PROPERTY_CONST),
 997         SD_BUS_PROPERTY("OOMScoreAdjust", "i", property_get_oom_score_adjust, 0, SD_BUS_VTABLE_PROPERTY_CONST),
 998         SD_BUS_PROPERTY("CoredumpFilter", "t", property_get_coredump_filter, 0, SD_BUS_VTABLE_PROPERTY_CONST),
 999         SD_BUS_PROPERTY("Nice", "i", property_get_nice, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1000         SD_BUS_PROPERTY("IOSchedulingClass", "i", property_get_ioprio_class, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1001         SD_BUS_PROPERTY("IOSchedulingPriority", "i", property_get_ioprio_priority, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1002         SD_BUS_PROPERTY("CPUSchedulingPolicy", "i", property_get_cpu_sched_policy, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1003         SD_BUS_PROPERTY("CPUSchedulingPriority", "i", property_get_cpu_sched_priority, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1004         SD_BUS_PROPERTY("CPUAffinity", "ay", property_get_cpu_affinity, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1005         SD_BUS_PROPERTY("CPUAffinityFromNUMA", "b", property_get_cpu_affinity_from_numa, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1006         SD_BUS_PROPERTY("NUMAPolicy", "i", property_get_numa_policy, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1007         SD_BUS_PROPERTY("NUMAMask", "ay", property_get_numa_mask, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1008         SD_BUS_PROPERTY("TimerSlackNSec", "t", property_get_timer_slack_nsec, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1009         SD_BUS_PROPERTY("CPUSchedulingResetOnFork", "b", bus_property_get_bool, offsetof(ExecContext, cpu_sched_reset_on_fork), SD_BUS_VTABLE_PROPERTY_CONST),
1010         SD_BUS_PROPERTY("NonBlocking", "b", bus_property_get_bool, offsetof(ExecContext, non_blocking), SD_BUS_VTABLE_PROPERTY_CONST),
1011         SD_BUS_PROPERTY("StandardInput", "s", property_get_exec_input, offsetof(ExecContext, std_input), SD_BUS_VTABLE_PROPERTY_CONST),
1012         SD_BUS_PROPERTY("StandardInputFileDescriptorName", "s", property_get_stdio_fdname, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1013         SD_BUS_PROPERTY("StandardInputData", "ay", property_get_input_data, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1014         SD_BUS_PROPERTY("StandardOutput", "s", bus_property_get_exec_output, offsetof(ExecContext, std_output), SD_BUS_VTABLE_PROPERTY_CONST),
1015         SD_BUS_PROPERTY("StandardOutputFileDescriptorName", "s", property_get_stdio_fdname, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1016         SD_BUS_PROPERTY("StandardError", "s", bus_property_get_exec_output, offsetof(ExecContext, std_error), SD_BUS_VTABLE_PROPERTY_CONST),
1017         SD_BUS_PROPERTY("StandardErrorFileDescriptorName", "s", property_get_stdio_fdname, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1018         SD_BUS_PROPERTY("TTYPath", "s", NULL, offsetof(ExecContext, tty_path), SD_BUS_VTABLE_PROPERTY_CONST),
1019         SD_BUS_PROPERTY("TTYReset", "b", bus_property_get_bool, offsetof(ExecContext, tty_reset), SD_BUS_VTABLE_PROPERTY_CONST),
1020         SD_BUS_PROPERTY("TTYVHangup", "b", bus_property_get_bool, offsetof(ExecContext, tty_vhangup), SD_BUS_VTABLE_PROPERTY_CONST),
1021         SD_BUS_PROPERTY("TTYVTDisallocate", "b", bus_property_get_bool, offsetof(ExecContext, tty_vt_disallocate), SD_BUS_VTABLE_PROPERTY_CONST),
1022         SD_BUS_PROPERTY("TTYRows", "q", bus_property_get_unsigned, offsetof(ExecContext, tty_rows), SD_BUS_VTABLE_PROPERTY_CONST),
1023         SD_BUS_PROPERTY("TTYColumns", "q", bus_property_get_unsigned, offsetof(ExecContext, tty_cols), SD_BUS_VTABLE_PROPERTY_CONST),
1024         SD_BUS_PROPERTY("SyslogPriority", "i", bus_property_get_int, offsetof(ExecContext, syslog_priority), SD_BUS_VTABLE_PROPERTY_CONST),
1025         SD_BUS_PROPERTY("SyslogIdentifier", "s", NULL, offsetof(ExecContext, syslog_identifier), SD_BUS_VTABLE_PROPERTY_CONST),
1026         SD_BUS_PROPERTY("SyslogLevelPrefix", "b", bus_property_get_bool, offsetof(ExecContext, syslog_level_prefix), SD_BUS_VTABLE_PROPERTY_CONST),
1027         SD_BUS_PROPERTY("SyslogLevel", "i", property_get_syslog_level, offsetof(ExecContext, syslog_priority), SD_BUS_VTABLE_PROPERTY_CONST),
1028         SD_BUS_PROPERTY("SyslogFacility", "i", property_get_syslog_facility, offsetof(ExecContext, syslog_priority), SD_BUS_VTABLE_PROPERTY_CONST),
1029         SD_BUS_PROPERTY("LogLevelMax", "i", bus_property_get_int, offsetof(ExecContext, log_level_max), SD_BUS_VTABLE_PROPERTY_CONST),
1030         SD_BUS_PROPERTY("LogRateLimitIntervalUSec", "t", bus_property_get_usec, offsetof(ExecContext, log_ratelimit_interval_usec), SD_BUS_VTABLE_PROPERTY_CONST),
1031         SD_BUS_PROPERTY("LogRateLimitBurst", "u", bus_property_get_unsigned, offsetof(ExecContext, log_ratelimit_burst), SD_BUS_VTABLE_PROPERTY_CONST),
1032         SD_BUS_PROPERTY("LogExtraFields", "aay", property_get_log_extra_fields, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1033         SD_BUS_PROPERTY("LogFilterPatterns", "a(bs)", property_get_log_filter_patterns, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1034         SD_BUS_PROPERTY("LogNamespace", "s", NULL, offsetof(ExecContext, log_namespace), SD_BUS_VTABLE_PROPERTY_CONST),
1035         SD_BUS_PROPERTY("SecureBits", "i", bus_property_get_int, offsetof(ExecContext, secure_bits), SD_BUS_VTABLE_PROPERTY_CONST),
1036         SD_BUS_PROPERTY("CapabilityBoundingSet", "t", NULL, offsetof(ExecContext, capability_bounding_set), SD_BUS_VTABLE_PROPERTY_CONST),
1037         SD_BUS_PROPERTY("AmbientCapabilities", "t", NULL, offsetof(ExecContext, capability_ambient_set), SD_BUS_VTABLE_PROPERTY_CONST),
1038         SD_BUS_PROPERTY("User", "s", NULL, offsetof(ExecContext, user), SD_BUS_VTABLE_PROPERTY_CONST),
1039         SD_BUS_PROPERTY("Group", "s", NULL, offsetof(ExecContext, group), SD_BUS_VTABLE_PROPERTY_CONST),
1040         SD_BUS_PROPERTY("DynamicUser", "b", bus_property_get_bool, offsetof(ExecContext, dynamic_user), SD_BUS_VTABLE_PROPERTY_CONST),
1041         SD_BUS_PROPERTY("SetLoginEnvironment", "b", bus_property_get_tristate, offsetof(ExecContext, set_login_environment), SD_BUS_VTABLE_PROPERTY_CONST),
1042         SD_BUS_PROPERTY("RemoveIPC", "b", bus_property_get_bool, offsetof(ExecContext, remove_ipc), SD_BUS_VTABLE_PROPERTY_CONST),
1043         SD_BUS_PROPERTY("SetCredential", "a(say)", property_get_set_credential, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1044         SD_BUS_PROPERTY("SetCredentialEncrypted", "a(say)", property_get_set_credential, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1045         SD_BUS_PROPERTY("LoadCredential", "a(ss)", property_get_load_credential, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1046         SD_BUS_PROPERTY("LoadCredentialEncrypted", "a(ss)", property_get_load_credential, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1047         SD_BUS_PROPERTY("ImportCredential", "as", bus_property_get_string_set, offsetof(ExecContext, import_credentials), SD_BUS_VTABLE_PROPERTY_CONST),
1048         SD_BUS_PROPERTY("SupplementaryGroups", "as", NULL, offsetof(ExecContext, supplementary_groups), SD_BUS_VTABLE_PROPERTY_CONST),
1049         SD_BUS_PROPERTY("PAMName", "s", NULL, offsetof(ExecContext, pam_name), SD_BUS_VTABLE_PROPERTY_CONST),
1050         SD_BUS_PROPERTY("ReadWritePaths", "as", NULL, offsetof(ExecContext, read_write_paths), SD_BUS_VTABLE_PROPERTY_CONST),
1051         SD_BUS_PROPERTY("ReadOnlyPaths", "as", NULL, offsetof(ExecContext, read_only_paths), SD_BUS_VTABLE_PROPERTY_CONST),
1052         SD_BUS_PROPERTY("InaccessiblePaths", "as", NULL, offsetof(ExecContext, inaccessible_paths), SD_BUS_VTABLE_PROPERTY_CONST),
1053         SD_BUS_PROPERTY("ExecPaths", "as", NULL, offsetof(ExecContext, exec_paths), SD_BUS_VTABLE_PROPERTY_CONST),
1054         SD_BUS_PROPERTY("NoExecPaths", "as", NULL, offsetof(ExecContext, no_exec_paths), SD_BUS_VTABLE_PROPERTY_CONST),
1055         SD_BUS_PROPERTY("ExecSearchPath", "as", NULL, offsetof(ExecContext, exec_search_path), SD_BUS_VTABLE_PROPERTY_CONST),
1056         SD_BUS_PROPERTY("MountFlags", "t", bus_property_get_ulong, offsetof(ExecContext, mount_propagation_flag), SD_BUS_VTABLE_PROPERTY_CONST),
1057         SD_BUS_PROPERTY("PrivateTmp", "b", bus_property_get_bool, offsetof(ExecContext, private_tmp), SD_BUS_VTABLE_PROPERTY_CONST),
1058         SD_BUS_PROPERTY("PrivateDevices", "b", bus_property_get_bool, offsetof(ExecContext, private_devices), SD_BUS_VTABLE_PROPERTY_CONST),
1059         SD_BUS_PROPERTY("ProtectClock", "b", bus_property_get_bool, offsetof(ExecContext, protect_clock), SD_BUS_VTABLE_PROPERTY_CONST),
1060         SD_BUS_PROPERTY("ProtectKernelTunables", "b", bus_property_get_bool, offsetof(ExecContext, protect_kernel_tunables), SD_BUS_VTABLE_PROPERTY_CONST),
1061         SD_BUS_PROPERTY("ProtectKernelModules", "b", bus_property_get_bool, offsetof(ExecContext, protect_kernel_modules), SD_BUS_VTABLE_PROPERTY_CONST),
1062         SD_BUS_PROPERTY("ProtectKernelLogs", "b", bus_property_get_bool, offsetof(ExecContext, protect_kernel_logs), SD_BUS_VTABLE_PROPERTY_CONST),
1063         SD_BUS_PROPERTY("ProtectControlGroups", "b", bus_property_get_bool, offsetof(ExecContext, protect_control_groups), SD_BUS_VTABLE_PROPERTY_CONST),
1064         SD_BUS_PROPERTY("PrivateNetwork", "b", bus_property_get_bool, offsetof(ExecContext, private_network), SD_BUS_VTABLE_PROPERTY_CONST),
1065         SD_BUS_PROPERTY("PrivateUsers", "b", bus_property_get_bool, offsetof(ExecContext, private_users), SD_BUS_VTABLE_PROPERTY_CONST),
1066         SD_BUS_PROPERTY("PrivateMounts", "b", bus_property_get_tristate, offsetof(ExecContext, private_mounts), SD_BUS_VTABLE_PROPERTY_CONST),
1067         SD_BUS_PROPERTY("PrivateIPC", "b", bus_property_get_bool, offsetof(ExecContext, private_ipc), SD_BUS_VTABLE_PROPERTY_CONST),
1068         SD_BUS_PROPERTY("ProtectHome", "s", property_get_protect_home, offsetof(ExecContext, protect_home), SD_BUS_VTABLE_PROPERTY_CONST),
1069         SD_BUS_PROPERTY("ProtectSystem", "s", property_get_protect_system, offsetof(ExecContext, protect_system), SD_BUS_VTABLE_PROPERTY_CONST),
1070         SD_BUS_PROPERTY("SameProcessGroup", "b", bus_property_get_bool, offsetof(ExecContext, same_pgrp), SD_BUS_VTABLE_PROPERTY_CONST),
1071         SD_BUS_PROPERTY("UtmpIdentifier", "s", NULL, offsetof(ExecContext, utmp_id), SD_BUS_VTABLE_PROPERTY_CONST),
1072         SD_BUS_PROPERTY("UtmpMode", "s", property_get_exec_utmp_mode, offsetof(ExecContext, utmp_mode), SD_BUS_VTABLE_PROPERTY_CONST),
1073         SD_BUS_PROPERTY("SELinuxContext", "(bs)", property_get_selinux_context, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1074         SD_BUS_PROPERTY("AppArmorProfile", "(bs)", property_get_apparmor_profile, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1075         SD_BUS_PROPERTY("SmackProcessLabel", "(bs)", property_get_smack_process_label, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1076         SD_BUS_PROPERTY("IgnoreSIGPIPE", "b", bus_property_get_bool, offsetof(ExecContext, ignore_sigpipe), SD_BUS_VTABLE_PROPERTY_CONST),
1077         SD_BUS_PROPERTY("NoNewPrivileges", "b", bus_property_get_bool, offsetof(ExecContext, no_new_privileges), SD_BUS_VTABLE_PROPERTY_CONST),
1078         SD_BUS_PROPERTY("SystemCallFilter", "(bas)", property_get_syscall_filter, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1079         SD_BUS_PROPERTY("SystemCallArchitectures", "as", property_get_syscall_archs, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1080         SD_BUS_PROPERTY("SystemCallErrorNumber", "i", bus_property_get_int, offsetof(ExecContext, syscall_errno), SD_BUS_VTABLE_PROPERTY_CONST),
1081         SD_BUS_PROPERTY("SystemCallLog", "(bas)", property_get_syscall_log, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1082         SD_BUS_PROPERTY("Personality", "s", property_get_personality, offsetof(ExecContext, personality), SD_BUS_VTABLE_PROPERTY_CONST),
1083         SD_BUS_PROPERTY("LockPersonality", "b", bus_property_get_bool, offsetof(ExecContext, lock_personality), SD_BUS_VTABLE_PROPERTY_CONST),
1084         SD_BUS_PROPERTY("RestrictAddressFamilies", "(bas)", property_get_address_families, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1085         SD_BUS_PROPERTY("RuntimeDirectorySymlink", "a(sst)", bus_property_get_exec_dir_symlink, offsetof(ExecContext, directories[EXEC_DIRECTORY_RUNTIME]), SD_BUS_VTABLE_PROPERTY_CONST),
1086         SD_BUS_PROPERTY("RuntimeDirectoryPreserve", "s", bus_property_get_exec_preserve_mode, offsetof(ExecContext, runtime_directory_preserve_mode), SD_BUS_VTABLE_PROPERTY_CONST),
1087         SD_BUS_PROPERTY("RuntimeDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, directories[EXEC_DIRECTORY_RUNTIME].mode), SD_BUS_VTABLE_PROPERTY_CONST),
1088         SD_BUS_PROPERTY("RuntimeDirectory", "as", bus_property_get_exec_dir, offsetof(ExecContext, directories[EXEC_DIRECTORY_RUNTIME]), SD_BUS_VTABLE_PROPERTY_CONST),
1089         SD_BUS_PROPERTY("StateDirectorySymlink", "a(sst)", bus_property_get_exec_dir_symlink, offsetof(ExecContext, directories[EXEC_DIRECTORY_STATE]), SD_BUS_VTABLE_PROPERTY_CONST),
1090         SD_BUS_PROPERTY("StateDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, directories[EXEC_DIRECTORY_STATE].mode), SD_BUS_VTABLE_PROPERTY_CONST),
1091         SD_BUS_PROPERTY("StateDirectory", "as", bus_property_get_exec_dir, offsetof(ExecContext, directories[EXEC_DIRECTORY_STATE]), SD_BUS_VTABLE_PROPERTY_CONST),
1092         SD_BUS_PROPERTY("CacheDirectorySymlink", "a(sst)", bus_property_get_exec_dir_symlink, offsetof(ExecContext, directories[EXEC_DIRECTORY_CACHE]), SD_BUS_VTABLE_PROPERTY_CONST),
1093         SD_BUS_PROPERTY("CacheDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, directories[EXEC_DIRECTORY_CACHE].mode), SD_BUS_VTABLE_PROPERTY_CONST),
1094         SD_BUS_PROPERTY("CacheDirectory", "as", bus_property_get_exec_dir, offsetof(ExecContext, directories[EXEC_DIRECTORY_CACHE]), SD_BUS_VTABLE_PROPERTY_CONST),
1095         SD_BUS_PROPERTY("LogsDirectorySymlink", "a(sst)", bus_property_get_exec_dir_symlink, offsetof(ExecContext, directories[EXEC_DIRECTORY_LOGS]), SD_BUS_VTABLE_PROPERTY_CONST),
1096         SD_BUS_PROPERTY("LogsDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, directories[EXEC_DIRECTORY_LOGS].mode), SD_BUS_VTABLE_PROPERTY_CONST),
1097         SD_BUS_PROPERTY("LogsDirectory", "as", bus_property_get_exec_dir, offsetof(ExecContext, directories[EXEC_DIRECTORY_LOGS]), SD_BUS_VTABLE_PROPERTY_CONST),
1098         SD_BUS_PROPERTY("ConfigurationDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, directories[EXEC_DIRECTORY_CONFIGURATION].mode), SD_BUS_VTABLE_PROPERTY_CONST),
1099         SD_BUS_PROPERTY("ConfigurationDirectory", "as", bus_property_get_exec_dir, offsetof(ExecContext, directories[EXEC_DIRECTORY_CONFIGURATION]), SD_BUS_VTABLE_PROPERTY_CONST),
1100         SD_BUS_PROPERTY("TimeoutCleanUSec", "t", bus_property_get_usec, offsetof(ExecContext, timeout_clean_usec), SD_BUS_VTABLE_PROPERTY_CONST),
1101         SD_BUS_PROPERTY("MemoryDenyWriteExecute", "b", bus_property_get_bool, offsetof(ExecContext, memory_deny_write_execute), SD_BUS_VTABLE_PROPERTY_CONST),
1102         SD_BUS_PROPERTY("RestrictRealtime", "b", bus_property_get_bool, offsetof(ExecContext, restrict_realtime), SD_BUS_VTABLE_PROPERTY_CONST),
1103         SD_BUS_PROPERTY("RestrictSUIDSGID", "b", bus_property_get_bool, offsetof(ExecContext, restrict_suid_sgid), SD_BUS_VTABLE_PROPERTY_CONST),
1104         SD_BUS_PROPERTY("RestrictNamespaces", "t", bus_property_get_ulong, offsetof(ExecContext, restrict_namespaces), SD_BUS_VTABLE_PROPERTY_CONST),
1105         SD_BUS_PROPERTY("RestrictFileSystems", "(bas)", property_get_restrict_filesystems, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1106         SD_BUS_PROPERTY("BindPaths", "a(ssbt)", property_get_bind_paths, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1107         SD_BUS_PROPERTY("BindReadOnlyPaths", "a(ssbt)", property_get_bind_paths, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1108         SD_BUS_PROPERTY("TemporaryFileSystem", "a(ss)", property_get_temporary_filesystems, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1109         SD_BUS_PROPERTY("MountAPIVFS", "b", property_get_mount_apivfs, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1110         SD_BUS_PROPERTY("KeyringMode", "s", property_get_exec_keyring_mode, offsetof(ExecContext, keyring_mode), SD_BUS_VTABLE_PROPERTY_CONST),
1111         SD_BUS_PROPERTY("ProtectProc", "s", property_get_protect_proc, offsetof(ExecContext, protect_proc), SD_BUS_VTABLE_PROPERTY_CONST),
1112         SD_BUS_PROPERTY("ProcSubset", "s", property_get_proc_subset, offsetof(ExecContext, proc_subset), SD_BUS_VTABLE_PROPERTY_CONST),
1113         SD_BUS_PROPERTY("ProtectHostname", "b", bus_property_get_bool, offsetof(ExecContext, protect_hostname), SD_BUS_VTABLE_PROPERTY_CONST),
1114         SD_BUS_PROPERTY("MemoryKSM", "b", bus_property_get_tristate, offsetof(ExecContext, memory_ksm), SD_BUS_VTABLE_PROPERTY_CONST),
1115         SD_BUS_PROPERTY("NetworkNamespacePath", "s", NULL, offsetof(ExecContext, network_namespace_path), SD_BUS_VTABLE_PROPERTY_CONST),
1116         SD_BUS_PROPERTY("IPCNamespacePath", "s", NULL, offsetof(ExecContext, ipc_namespace_path), SD_BUS_VTABLE_PROPERTY_CONST),
1117         SD_BUS_PROPERTY("RootImagePolicy", "s", property_get_image_policy, offsetof(ExecContext, root_image_policy), SD_BUS_VTABLE_PROPERTY_CONST),
1118         SD_BUS_PROPERTY("MountImagePolicy", "s", property_get_image_policy, offsetof(ExecContext, mount_image_policy), SD_BUS_VTABLE_PROPERTY_CONST),
1119         SD_BUS_PROPERTY("ExtensionImagePolicy", "s", property_get_image_policy, offsetof(ExecContext, extension_image_policy), SD_BUS_VTABLE_PROPERTY_CONST),
1120
1121         /* Obsolete/redundant properties: */
1122         SD_BUS_PROPERTY("Capabilities", "s", property_get_empty_string, 0, SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
1123         SD_BUS_PROPERTY("ReadWriteDirectories", "as", NULL, offsetof(ExecContext, read_write_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
1124         SD_BUS_PROPERTY("ReadOnlyDirectories", "as", NULL, offsetof(ExecContext, read_only_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
1125         SD_BUS_PROPERTY("InaccessibleDirectories", "as", NULL, offsetof(ExecContext, inaccessible_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
1126         SD_BUS_PROPERTY("IOScheduling", "i", property_get_ioprio, 0, SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
1127
1128         SD_BUS_VTABLE_END
1129 };
1130
1131 static int append_exec_command(sd_bus_message *reply, ExecCommand *c) {
1132         int r;
1133
1134         assert(reply);
1135         assert(c);
1136
1137         if (!c->path)
1138                 return 0;
1139
1140         r = sd_bus_message_open_container(reply, 'r', "sasbttttuii");
1141         if (r < 0)
1142                 return r;
1143
1144         r = sd_bus_message_append(reply, "s", c->path);
1145         if (r < 0)
1146                 return r;
1147
1148         r = sd_bus_message_append_strv(reply, c->argv);
1149         if (r < 0)
1150                 return r;
1151
1152         r = sd_bus_message_append(reply, "bttttuii",
1153                                   !!(c->flags & EXEC_COMMAND_IGNORE_FAILURE),
1154                                   c->exec_status.start_timestamp.realtime,
1155                                   c->exec_status.start_timestamp.monotonic,
1156                                   c->exec_status.exit_timestamp.realtime,
1157                                   c->exec_status.exit_timestamp.monotonic,
1158                                   (uint32_t) c->exec_status.pid,
1159                                   (int32_t) c->exec_status.code,
1160                                   (int32_t) c->exec_status.status);
1161         if (r < 0)
1162                 return r;
1163
1164         return sd_bus_message_close_container(reply);
1165 }
1166
1167 static int append_exec_ex_command(sd_bus_message *reply, ExecCommand *c) {
1168         _cleanup_strv_free_ char **ex_opts = NULL;
1169         int r;
1170
1171         assert(reply);
1172         assert(c);
1173
1174         if (!c->path)
1175                 return 0;
1176
1177         r = sd_bus_message_open_container(reply, 'r', "sasasttttuii");
1178         if (r < 0)
1179                 return r;
1180
1181         r = sd_bus_message_append(reply, "s", c->path);
1182         if (r < 0)
1183                 return r;
1184
1185         r = sd_bus_message_append_strv(reply, c->argv);
1186         if (r < 0)
1187                 return r;
1188
1189         r = exec_command_flags_to_strv(c->flags, &ex_opts);
1190         if (r < 0)
1191                 return r;
1192
1193         r = sd_bus_message_append_strv(reply, ex_opts);
1194         if (r < 0)
1195                 return r;
1196
1197         r = sd_bus_message_append(reply, "ttttuii",
1198                                   c->exec_status.start_timestamp.realtime,
1199                                   c->exec_status.start_timestamp.monotonic,
1200                                   c->exec_status.exit_timestamp.realtime,
1201                                   c->exec_status.exit_timestamp.monotonic,
1202                                   (uint32_t) c->exec_status.pid,
1203                                   (int32_t) c->exec_status.code,
1204                                   (int32_t) c->exec_status.status);
1205         if (r < 0)
1206                 return r;
1207
1208         return sd_bus_message_close_container(reply);
1209 }
1210
1211 int bus_property_get_exec_command(
1212                 sd_bus *bus,
1213                 const char *path,
1214                 const char *interface,
1215                 const char *property,
1216                 sd_bus_message *reply,
1217                 void *userdata,
1218                 sd_bus_error *ret_error) {
1219
1220         ExecCommand *c = (ExecCommand*) userdata;
1221         int r;
1222
1223         assert(bus);
1224         assert(reply);
1225
1226         r = sd_bus_message_open_container(reply, 'a', "(sasbttttuii)");
1227         if (r < 0)
1228                 return r;
1229
1230         r = append_exec_command(reply, c);
1231         if (r < 0)
1232                 return r;
1233
1234         return sd_bus_message_close_container(reply);
1235 }
1236
1237 int bus_property_get_exec_command_list(
1238                 sd_bus *bus,
1239                 const char *path,
1240                 const char *interface,
1241                 const char *property,
1242                 sd_bus_message *reply,
1243                 void *userdata,
1244                 sd_bus_error *ret_error) {
1245
1246         ExecCommand *exec_command = *(ExecCommand**) userdata;
1247         int r;
1248
1249         assert(bus);
1250         assert(reply);
1251
1252         r = sd_bus_message_open_container(reply, 'a', "(sasbttttuii)");
1253         if (r < 0)
1254                 return r;
1255
1256         LIST_FOREACH(command, c, exec_command) {
1257                 r = append_exec_command(reply, c);
1258                 if (r < 0)
1259                         return r;
1260         }
1261
1262         return sd_bus_message_close_container(reply);
1263 }
1264
1265 int bus_property_get_exec_ex_command_list(
1266                 sd_bus *bus,
1267                 const char *path,
1268                 const char *interface,
1269                 const char *property,
1270                 sd_bus_message *reply,
1271                 void *userdata,
1272                 sd_bus_error *ret_error) {
1273
1274         ExecCommand *exec_command = *(ExecCommand**) userdata;
1275         int r;
1276
1277         assert(bus);
1278         assert(reply);
1279
1280         r = sd_bus_message_open_container(reply, 'a', "(sasasttttuii)");
1281         if (r < 0)
1282                 return r;
1283
1284         LIST_FOREACH(command, c, exec_command) {
1285                 r = append_exec_ex_command(reply, c);
1286                 if (r < 0)
1287                         return r;
1288         }
1289
1290         return sd_bus_message_close_container(reply);
1291 }
1292
1293 static char *exec_command_flags_to_exec_chars(ExecCommandFlags flags) {
1294         return strjoin(FLAGS_SET(flags, EXEC_COMMAND_IGNORE_FAILURE)   ? "-" : "",
1295                        FLAGS_SET(flags, EXEC_COMMAND_NO_ENV_EXPAND)    ? ":" : "",
1296                        FLAGS_SET(flags, EXEC_COMMAND_FULLY_PRIVILEGED) ? "+" : "",
1297                        FLAGS_SET(flags, EXEC_COMMAND_NO_SETUID)        ? "!" : "",
1298                        FLAGS_SET(flags, EXEC_COMMAND_AMBIENT_MAGIC)    ? "!!" : "");
1299 }
1300
1301 int bus_set_transient_exec_command(
1302                 Unit *u,
1303                 const char *name,
1304                 ExecCommand **exec_command,
1305                 sd_bus_message *message,
1306                 UnitWriteFlags flags,
1307                 sd_bus_error *error) {
1308         bool is_ex_prop = endswith(name, "Ex");
1309         unsigned n = 0;
1310         int r;
1311
1312         /* Drop Ex from the written setting. E.g. ExecStart=, not ExecStartEx=. */
1313         const char *written_name = is_ex_prop ? strndupa(name, strlen(name) - 2) : name;
1314
1315         r = sd_bus_message_enter_container(message, 'a', is_ex_prop ? "(sasas)" : "(sasb)");
1316         if (r < 0)
1317                 return r;
1318
1319         while ((r = sd_bus_message_enter_container(message, 'r', is_ex_prop ? "sasas" : "sasb")) > 0) {
1320                 _cleanup_strv_free_ char **argv = NULL, **ex_opts = NULL;
1321                 const char *path;
1322                 int b;
1323
1324                 r = sd_bus_message_read(message, "s", &path);
1325                 if (r < 0)
1326                         return r;
1327
1328                 if (!path_is_absolute(path) && !filename_is_valid(path))
1329                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS,
1330                                                  "\"%s\" is neither a valid executable name nor an absolute path",
1331                                                  path);
1332
1333                 r = sd_bus_message_read_strv(message, &argv);
1334                 if (r < 0)
1335                         return r;
1336
1337                 if (strv_isempty(argv))
1338                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS,
1339                                                  "\"%s\" argv cannot be empty", name);
1340
1341                 r = is_ex_prop ? sd_bus_message_read_strv(message, &ex_opts) : sd_bus_message_read(message, "b", &b);
1342                 if (r < 0)
1343                         return r;
1344
1345                 r = sd_bus_message_exit_container(message);
1346                 if (r < 0)
1347                         return r;
1348
1349                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1350                         ExecCommand *c;
1351
1352                         c = new0(ExecCommand, 1);
1353                         if (!c)
1354                                 return -ENOMEM;
1355
1356                         c->path = strdup(path);
1357                         if (!c->path) {
1358                                 free(c);
1359                                 return -ENOMEM;
1360                         }
1361
1362                         c->argv = TAKE_PTR(argv);
1363
1364                         if (is_ex_prop) {
1365                                 r = exec_command_flags_from_strv(ex_opts, &c->flags);
1366                                 if (r < 0)
1367                                         return r;
1368                         } else
1369                                 c->flags = b ? EXEC_COMMAND_IGNORE_FAILURE : 0;
1370
1371                         path_simplify(c->path);
1372                         exec_command_append_list(exec_command, c);
1373                 }
1374
1375                 n++;
1376         }
1377         if (r < 0)
1378                 return r;
1379
1380         r = sd_bus_message_exit_container(message);
1381         if (r < 0)
1382                 return r;
1383
1384         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1385                 _cleanup_(memstream_done) MemStream m = {};
1386                 _cleanup_free_ char *buf = NULL;
1387                 FILE *f;
1388
1389                 if (n == 0)
1390                         *exec_command = exec_command_free_list(*exec_command);
1391
1392                 f = memstream_init(&m);
1393                 if (!f)
1394                         return -ENOMEM;
1395
1396                 fprintf(f, "%s=\n", written_name);
1397
1398                 LIST_FOREACH(command, c, *exec_command) {
1399                         _cleanup_free_ char *a = NULL, *exec_chars = NULL;
1400                         UnitWriteFlags esc_flags = UNIT_ESCAPE_SPECIFIERS |
1401                                 (FLAGS_SET(c->flags, EXEC_COMMAND_NO_ENV_EXPAND) ? UNIT_ESCAPE_EXEC_SYNTAX : UNIT_ESCAPE_EXEC_SYNTAX_ENV);
1402
1403                         exec_chars = exec_command_flags_to_exec_chars(c->flags);
1404                         if (!exec_chars)
1405                                 return -ENOMEM;
1406
1407                         a = unit_concat_strv(c->argv, esc_flags);
1408                         if (!a)
1409                                 return -ENOMEM;
1410
1411                         if (streq_ptr(c->path, c->argv ? c->argv[0] : NULL))
1412                                 fprintf(f, "%s=%s%s\n", written_name, exec_chars, a);
1413                         else {
1414                                 _cleanup_free_ char *t = NULL;
1415                                 const char *p;
1416
1417                                 p = unit_escape_setting(c->path, esc_flags, &t);
1418                                 if (!p)
1419                                         return -ENOMEM;
1420
1421                                 fprintf(f, "%s=%s@%s %s\n", written_name, exec_chars, p, a);
1422                         }
1423                 }
1424
1425                 r = memstream_finalize(&m, &buf, NULL);
1426                 if (r < 0)
1427                         return r;
1428
1429                 unit_write_setting(u, flags, written_name, buf);
1430         }
1431
1432         return 1;
1433 }
1434
1435 static int parse_personality(const char *s, unsigned long *p) {
1436         unsigned long v;
1437
1438         assert(p);
1439
1440         v = personality_from_string(s);
1441         if (v == PERSONALITY_INVALID)
1442                 return -EINVAL;
1443
1444         *p = v;
1445         return 0;
1446 }
1447
1448 static const char* mount_propagation_flag_to_string_with_check(unsigned long n) {
1449         if (!mount_propagation_flag_is_valid(n))
1450                 return NULL;
1451
1452         return mount_propagation_flag_to_string(n);
1453 }
1454
1455 static BUS_DEFINE_SET_TRANSIENT(nsec, "t", uint64_t, nsec_t, NSEC_FMT);
1456 static BUS_DEFINE_SET_TRANSIENT_IS_VALID(log_level, "i", int32_t, int, "%" PRIi32, log_level_is_valid);
1457 #if HAVE_SECCOMP
1458 static BUS_DEFINE_SET_TRANSIENT_IS_VALID(errno, "i", int32_t, int, "%" PRIi32, seccomp_errno_or_action_is_valid);
1459 #endif
1460 static BUS_DEFINE_SET_TRANSIENT_PARSE(std_input, ExecInput, exec_input_from_string);
1461 static BUS_DEFINE_SET_TRANSIENT_PARSE(std_output, ExecOutput, exec_output_from_string);
1462 static BUS_DEFINE_SET_TRANSIENT_PARSE(utmp_mode, ExecUtmpMode, exec_utmp_mode_from_string);
1463 static BUS_DEFINE_SET_TRANSIENT_PARSE(protect_system, ProtectSystem, protect_system_from_string);
1464 static BUS_DEFINE_SET_TRANSIENT_PARSE(protect_home, ProtectHome, protect_home_from_string);
1465 static BUS_DEFINE_SET_TRANSIENT_PARSE(keyring_mode, ExecKeyringMode, exec_keyring_mode_from_string);
1466 static BUS_DEFINE_SET_TRANSIENT_PARSE(protect_proc, ProtectProc, protect_proc_from_string);
1467 static BUS_DEFINE_SET_TRANSIENT_PARSE(proc_subset, ProcSubset, proc_subset_from_string);
1468 BUS_DEFINE_SET_TRANSIENT_PARSE(exec_preserve_mode, ExecPreserveMode, exec_preserve_mode_from_string);
1469 static BUS_DEFINE_SET_TRANSIENT_PARSE_PTR(personality, unsigned long, parse_personality);
1470 static BUS_DEFINE_SET_TRANSIENT_TO_STRING_ALLOC(secure_bits, "i", int32_t, int, "%" PRIi32, secure_bits_to_string_alloc_with_check);
1471 static BUS_DEFINE_SET_TRANSIENT_TO_STRING_ALLOC(capability, "t", uint64_t, uint64_t, "%" PRIu64, capability_set_to_string);
1472 static BUS_DEFINE_SET_TRANSIENT_TO_STRING_ALLOC(namespace_flag, "t", uint64_t, unsigned long, "%" PRIu64, namespace_flags_to_string);
1473 static BUS_DEFINE_SET_TRANSIENT_TO_STRING(mount_propagation_flag, "t", uint64_t, unsigned long, "%" PRIu64, mount_propagation_flag_to_string_with_check);
1474
1475 int bus_exec_context_set_transient_property(
1476                 Unit *u,
1477                 ExecContext *c,
1478                 const char *name,
1479                 sd_bus_message *message,
1480                 UnitWriteFlags flags,
1481                 sd_bus_error *error) {
1482
1483         const char *suffix;
1484         int r;
1485
1486         assert(u);
1487         assert(c);
1488         assert(name);
1489         assert(message);
1490
1491         flags |= UNIT_PRIVATE;
1492
1493         if (streq(name, "User"))
1494                 return bus_set_transient_user_relaxed(u, name, &c->user, message, flags, error);
1495
1496         if (streq(name, "Group"))
1497                 return bus_set_transient_user_relaxed(u, name, &c->group, message, flags, error);
1498
1499         if (streq(name, "SetLoginEnvironment"))
1500                 return bus_set_transient_tristate(u, name, &c->set_login_environment, message, flags, error);
1501
1502         if (streq(name, "TTYPath"))
1503                 return bus_set_transient_path(u, name, &c->tty_path, message, flags, error);
1504
1505         if (streq(name, "RootImage"))
1506                 return bus_set_transient_path(u, name, &c->root_image, message, flags, error);
1507
1508         if (streq(name, "RootImageOptions")) {
1509                 _cleanup_(mount_options_free_allp) MountOptions *options = NULL;
1510                 _cleanup_free_ char *format_str = NULL;
1511
1512                 r = bus_read_mount_options(message, error, &options, &format_str, " ");
1513                 if (r < 0)
1514                         return r;
1515
1516                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1517                         if (options) {
1518                                 LIST_JOIN(mount_options, c->root_image_options, options);
1519                                 unit_write_settingf(
1520                                                 u, flags|UNIT_ESCAPE_SPECIFIERS, name,
1521                                                 "%s=%s",
1522                                                 name,
1523                                                 format_str);
1524                         } else {
1525                                 c->root_image_options = mount_options_free_all(c->root_image_options);
1526                                 unit_write_settingf(u, flags, name, "%s=", name);
1527                         }
1528                 }
1529
1530                 return 1;
1531         }
1532
1533         if (streq(name, "RootHash")) {
1534                 const void *roothash_decoded;
1535                 size_t roothash_decoded_size;
1536
1537                 r = sd_bus_message_read_array(message, 'y', &roothash_decoded, &roothash_decoded_size);
1538                 if (r < 0)
1539                         return r;
1540
1541                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1542                         _cleanup_free_ char *encoded = NULL;
1543
1544                         if (roothash_decoded_size == 0) {
1545                                 c->root_hash_path = mfree(c->root_hash_path);
1546                                 c->root_hash = mfree(c->root_hash);
1547                                 c->root_hash_size = 0;
1548
1549                                 unit_write_settingf(u, flags, name, "RootHash=");
1550                         } else {
1551                                 _cleanup_free_ void *p = NULL;
1552
1553                                 encoded = hexmem(roothash_decoded, roothash_decoded_size);
1554                                 if (!encoded)
1555                                         return -ENOMEM;
1556
1557                                 p = memdup(roothash_decoded, roothash_decoded_size);
1558                                 if (!p)
1559                                         return -ENOMEM;
1560
1561                                 free_and_replace(c->root_hash, p);
1562                                 c->root_hash_size = roothash_decoded_size;
1563                                 c->root_hash_path = mfree(c->root_hash_path);
1564
1565                                 unit_write_settingf(u, flags, name, "RootHash=%s", encoded);
1566                         }
1567                 }
1568
1569                 return 1;
1570         }
1571
1572         if (streq(name, "RootHashPath")) {
1573                 c->root_hash_size = 0;
1574                 c->root_hash = mfree(c->root_hash);
1575
1576                 return bus_set_transient_path(u, "RootHash", &c->root_hash_path, message, flags, error);
1577         }
1578
1579         if (streq(name, "RootHashSignature")) {
1580                 const void *roothash_sig_decoded;
1581                 size_t roothash_sig_decoded_size;
1582
1583                 r = sd_bus_message_read_array(message, 'y', &roothash_sig_decoded, &roothash_sig_decoded_size);
1584                 if (r < 0)
1585                         return r;
1586
1587                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1588                         _cleanup_free_ char *encoded = NULL;
1589
1590                         if (roothash_sig_decoded_size == 0) {
1591                                 c->root_hash_sig_path = mfree(c->root_hash_sig_path);
1592                                 c->root_hash_sig = mfree(c->root_hash_sig);
1593                                 c->root_hash_sig_size = 0;
1594
1595                                 unit_write_settingf(u, flags, name, "RootHashSignature=");
1596                         } else {
1597                                 _cleanup_free_ void *p = NULL;
1598                                 ssize_t len;
1599
1600                                 len = base64mem(roothash_sig_decoded, roothash_sig_decoded_size, &encoded);
1601                                 if (len < 0)
1602                                         return -ENOMEM;
1603
1604                                 p = memdup(roothash_sig_decoded, roothash_sig_decoded_size);
1605                                 if (!p)
1606                                         return -ENOMEM;
1607
1608                                 free_and_replace(c->root_hash_sig, p);
1609                                 c->root_hash_sig_size = roothash_sig_decoded_size;
1610                                 c->root_hash_sig_path = mfree(c->root_hash_sig_path);
1611
1612                                 unit_write_settingf(u, flags, name, "RootHashSignature=base64:%s", encoded);
1613                         }
1614                 }
1615
1616                 return 1;
1617         }
1618
1619         if (streq(name, "RootHashSignaturePath")) {
1620                 c->root_hash_sig_size = 0;
1621                 c->root_hash_sig = mfree(c->root_hash_sig);
1622
1623                 return bus_set_transient_path(u, "RootHashSignature", &c->root_hash_sig_path, message, flags, error);
1624         }
1625
1626         if (streq(name, "RootVerity"))
1627                 return bus_set_transient_path(u, name, &c->root_verity, message, flags, error);
1628
1629         if (streq(name, "RootDirectory"))
1630                 return bus_set_transient_path(u, name, &c->root_directory, message, flags, error);
1631
1632         if (streq(name, "RootEphemeral"))
1633                 return bus_set_transient_bool(u, name, &c->root_ephemeral, message, flags, error);
1634
1635         if (streq(name, "SyslogIdentifier"))
1636                 return bus_set_transient_string(u, name, &c->syslog_identifier, message, flags, error);
1637
1638         if (streq(name, "LogLevelMax"))
1639                 return bus_set_transient_log_level(u, name, &c->log_level_max, message, flags, error);
1640
1641         if (streq(name, "LogRateLimitIntervalUSec"))
1642                 return bus_set_transient_usec(u, name, &c->log_ratelimit_interval_usec, message, flags, error);
1643
1644         if (streq(name, "LogRateLimitBurst"))
1645                 return bus_set_transient_unsigned(u, name, &c->log_ratelimit_burst, message, flags, error);
1646
1647         if (streq(name, "LogFilterPatterns")) {
1648                 /* Use _cleanup_free_, not _cleanup_strv_free_, as we don't want the content of the strv
1649                  * to be freed. */
1650                 _cleanup_free_ char **allow_list = NULL, **deny_list = NULL;
1651                 const char *pattern;
1652                 int is_allowlist;
1653
1654                 r = sd_bus_message_enter_container(message, 'a', "(bs)");
1655                 if (r < 0)
1656                         return r;
1657
1658                 while ((r = sd_bus_message_read(message, "(bs)", &is_allowlist, &pattern)) > 0) {
1659                         _cleanup_(pattern_freep) pcre2_code *compiled_pattern = NULL;
1660
1661                         if (isempty(pattern))
1662                                 continue;
1663
1664                         r = pattern_compile_and_log(pattern, 0, &compiled_pattern);
1665                         if (r < 0)
1666                                 return r;
1667
1668                         r = strv_push(is_allowlist ? &allow_list : &deny_list, (char *)pattern);
1669                         if (r < 0)
1670                                 return r;
1671                 }
1672                 if (r < 0)
1673                         return r;
1674
1675                 r = sd_bus_message_exit_container(message);
1676                 if (r < 0)
1677                         return r;
1678
1679                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1680                         if (strv_isempty(allow_list) && strv_isempty(deny_list)) {
1681                                 c->log_filter_allowed_patterns = set_free_free(c->log_filter_allowed_patterns);
1682                                 c->log_filter_denied_patterns = set_free_free(c->log_filter_denied_patterns);
1683                                 unit_write_settingf(u, flags, name, "%s=", name);
1684                         } else {
1685                                 r = set_put_strdupv(&c->log_filter_allowed_patterns, allow_list);
1686                                 if (r < 0)
1687                                         return r;
1688                                 r = set_put_strdupv(&c->log_filter_denied_patterns, deny_list);
1689                                 if (r < 0)
1690                                         return r;
1691
1692                                 STRV_FOREACH(unit_pattern, allow_list)
1693                                         unit_write_settingf(u, flags, name, "%s=%s", name, *unit_pattern);
1694                                 STRV_FOREACH(unit_pattern, deny_list)
1695                                         unit_write_settingf(u, flags, name, "%s=~%s", name, *unit_pattern);
1696                         }
1697                 }
1698
1699                 return 1;
1700         }
1701
1702         if (streq(name, "Personality"))
1703                 return bus_set_transient_personality(u, name, &c->personality, message, flags, error);
1704
1705         if (streq(name, "StandardInput"))
1706                 return bus_set_transient_std_input(u, name, &c->std_input, message, flags, error);
1707
1708         if (streq(name, "StandardOutput"))
1709                 return bus_set_transient_std_output(u, name, &c->std_output, message, flags, error);
1710
1711         if (streq(name, "StandardError"))
1712                 return bus_set_transient_std_output(u, name, &c->std_error, message, flags, error);
1713
1714         if (streq(name, "IgnoreSIGPIPE"))
1715                 return bus_set_transient_bool(u, name, &c->ignore_sigpipe, message, flags, error);
1716
1717         if (streq(name, "TTYVHangup"))
1718                 return bus_set_transient_bool(u, name, &c->tty_vhangup, message, flags, error);
1719
1720         if (streq(name, "TTYReset"))
1721                 return bus_set_transient_bool(u, name, &c->tty_reset, message, flags, error);
1722
1723         if (streq(name, "TTYVTDisallocate"))
1724                 return bus_set_transient_bool(u, name, &c->tty_vt_disallocate, message, flags, error);
1725
1726         if (streq(name, "TTYRows"))
1727                 return bus_set_transient_unsigned(u, name, &c->tty_rows, message, flags, error);
1728
1729         if (streq(name, "TTYColumns"))
1730                 return bus_set_transient_unsigned(u, name, &c->tty_cols, message, flags, error);
1731
1732         if (streq(name, "PrivateTmp"))
1733                 return bus_set_transient_bool(u, name, &c->private_tmp, message, flags, error);
1734
1735         if (streq(name, "PrivateDevices"))
1736                 return bus_set_transient_bool(u, name, &c->private_devices, message, flags, error);
1737
1738         if (streq(name, "PrivateMounts"))
1739                 return bus_set_transient_tristate(u, name, &c->private_mounts, message, flags, error);
1740
1741         if (streq(name, "PrivateNetwork"))
1742                 return bus_set_transient_bool(u, name, &c->private_network, message, flags, error);
1743
1744         if (streq(name, "PrivateIPC"))
1745                 return bus_set_transient_bool(u, name, &c->private_ipc, message, flags, error);
1746
1747         if (streq(name, "PrivateUsers"))
1748                 return bus_set_transient_bool(u, name, &c->private_users, message, flags, error);
1749
1750         if (streq(name, "NoNewPrivileges"))
1751                 return bus_set_transient_bool(u, name, &c->no_new_privileges, message, flags, error);
1752
1753         if (streq(name, "SyslogLevelPrefix"))
1754                 return bus_set_transient_bool(u, name, &c->syslog_level_prefix, message, flags, error);
1755
1756         if (streq(name, "MemoryDenyWriteExecute"))
1757                 return bus_set_transient_bool(u, name, &c->memory_deny_write_execute, message, flags, error);
1758
1759         if (streq(name, "RestrictRealtime"))
1760                 return bus_set_transient_bool(u, name, &c->restrict_realtime, message, flags, error);
1761
1762         if (streq(name, "RestrictSUIDSGID"))
1763                 return bus_set_transient_bool(u, name, &c->restrict_suid_sgid, message, flags, error);
1764
1765         if (streq(name, "DynamicUser"))
1766                 return bus_set_transient_bool(u, name, &c->dynamic_user, message, flags, error);
1767
1768         if (streq(name, "RemoveIPC"))
1769                 return bus_set_transient_bool(u, name, &c->remove_ipc, message, flags, error);
1770
1771         if (streq(name, "ProtectKernelTunables"))
1772                 return bus_set_transient_bool(u, name, &c->protect_kernel_tunables, message, flags, error);
1773
1774         if (streq(name, "ProtectKernelModules"))
1775                 return bus_set_transient_bool(u, name, &c->protect_kernel_modules, message, flags, error);
1776
1777         if (streq(name, "ProtectKernelLogs"))
1778                 return bus_set_transient_bool(u, name, &c->protect_kernel_logs, message, flags, error);
1779
1780         if (streq(name, "ProtectClock"))
1781                 return bus_set_transient_bool(u, name, &c->protect_clock, message, flags, error);
1782
1783         if (streq(name, "ProtectControlGroups"))
1784                 return bus_set_transient_bool(u, name, &c->protect_control_groups, message, flags, error);
1785
1786         if (streq(name, "CPUSchedulingResetOnFork"))
1787                 return bus_set_transient_bool(u, name, &c->cpu_sched_reset_on_fork, message, flags, error);
1788
1789         if (streq(name, "NonBlocking"))
1790                 return bus_set_transient_bool(u, name, &c->non_blocking, message, flags, error);
1791
1792         if (streq(name, "LockPersonality"))
1793                 return bus_set_transient_bool(u, name, &c->lock_personality, message, flags, error);
1794
1795         if (streq(name, "ProtectHostname"))
1796                 return bus_set_transient_bool(u, name, &c->protect_hostname, message, flags, error);
1797
1798         if (streq(name, "MemoryKSM"))
1799                 return bus_set_transient_tristate(u, name, &c->memory_ksm, message, flags, error);
1800
1801         if (streq(name, "UtmpIdentifier"))
1802                 return bus_set_transient_string(u, name, &c->utmp_id, message, flags, error);
1803
1804         if (streq(name, "UtmpMode"))
1805                 return bus_set_transient_utmp_mode(u, name, &c->utmp_mode, message, flags, error);
1806
1807         if (streq(name, "PAMName"))
1808                 return bus_set_transient_string(u, name, &c->pam_name, message, flags, error);
1809
1810         if (streq(name, "TimerSlackNSec"))
1811                 return bus_set_transient_nsec(u, name, &c->timer_slack_nsec, message, flags, error);
1812
1813         if (streq(name, "ProtectSystem"))
1814                 return bus_set_transient_protect_system(u, name, &c->protect_system, message, flags, error);
1815
1816         if (streq(name, "ProtectHome"))
1817                 return bus_set_transient_protect_home(u, name, &c->protect_home, message, flags, error);
1818
1819         if (streq(name, "KeyringMode"))
1820                 return bus_set_transient_keyring_mode(u, name, &c->keyring_mode, message, flags, error);
1821
1822         if (streq(name, "ProtectProc"))
1823                 return bus_set_transient_protect_proc(u, name, &c->protect_proc, message, flags, error);
1824
1825         if (streq(name, "ProcSubset"))
1826                 return bus_set_transient_proc_subset(u, name, &c->proc_subset, message, flags, error);
1827
1828         if (streq(name, "RuntimeDirectoryPreserve"))
1829                 return bus_set_transient_exec_preserve_mode(u, name, &c->runtime_directory_preserve_mode, message, flags, error);
1830
1831         if (streq(name, "UMask"))
1832                 return bus_set_transient_mode_t(u, name, &c->umask, message, flags, error);
1833
1834         if (streq(name, "RuntimeDirectoryMode"))
1835                 return bus_set_transient_mode_t(u, name, &c->directories[EXEC_DIRECTORY_RUNTIME].mode, message, flags, error);
1836
1837         if (streq(name, "StateDirectoryMode"))
1838                 return bus_set_transient_mode_t(u, name, &c->directories[EXEC_DIRECTORY_STATE].mode, message, flags, error);
1839
1840         if (streq(name, "CacheDirectoryMode"))
1841                 return bus_set_transient_mode_t(u, name, &c->directories[EXEC_DIRECTORY_CACHE].mode, message, flags, error);
1842
1843         if (streq(name, "LogsDirectoryMode"))
1844                 return bus_set_transient_mode_t(u, name, &c->directories[EXEC_DIRECTORY_LOGS].mode, message, flags, error);
1845
1846         if (streq(name, "ConfigurationDirectoryMode"))
1847                 return bus_set_transient_mode_t(u, name, &c->directories[EXEC_DIRECTORY_CONFIGURATION].mode, message, flags, error);
1848
1849         if (streq(name, "SELinuxContext"))
1850                 return bus_set_transient_string(u, name, &c->selinux_context, message, flags, error);
1851
1852         if (streq(name, "SecureBits"))
1853                 return bus_set_transient_secure_bits(u, name, &c->secure_bits, message, flags, error);
1854
1855         if (streq(name, "CapabilityBoundingSet"))
1856                 return bus_set_transient_capability(u, name, &c->capability_bounding_set, message, flags, error);
1857
1858         if (streq(name, "AmbientCapabilities"))
1859                 return bus_set_transient_capability(u, name, &c->capability_ambient_set, message, flags, error);
1860
1861         if (streq(name, "RestrictNamespaces"))
1862                 return bus_set_transient_namespace_flag(u, name, &c->restrict_namespaces, message, flags, error);
1863
1864         if (streq(name, "RestrictFileSystems")) {
1865                 int allow_list;
1866                 _cleanup_strv_free_ char **l = NULL;
1867
1868                 r = sd_bus_message_enter_container(message, 'r', "bas");
1869                 if (r < 0)
1870                         return r;
1871
1872                 r = sd_bus_message_read(message, "b", &allow_list);
1873                 if (r < 0)
1874                         return r;
1875
1876                 r = sd_bus_message_read_strv(message, &l);
1877                 if (r < 0)
1878                         return r;
1879
1880                 r = sd_bus_message_exit_container(message);
1881                 if (r < 0)
1882                         return r;
1883
1884                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1885                         _cleanup_free_ char *joined = NULL;
1886                         FilesystemParseFlags invert_flag = allow_list ? 0 : FILESYSTEM_PARSE_INVERT;
1887
1888                         if (strv_isempty(l)) {
1889                                 c->restrict_filesystems_allow_list = false;
1890                                 c->restrict_filesystems = set_free_free(c->restrict_filesystems);
1891
1892                                 unit_write_setting(u, flags, name, "RestrictFileSystems=");
1893                                 return 1;
1894                         }
1895
1896                         if (!c->restrict_filesystems)
1897                                 c->restrict_filesystems_allow_list = allow_list;
1898
1899                         STRV_FOREACH(s, l) {
1900                                 r = lsm_bpf_parse_filesystem(
1901                                               *s,
1902                                               &c->restrict_filesystems,
1903                                               FILESYSTEM_PARSE_LOG|
1904                                               (invert_flag ? FILESYSTEM_PARSE_INVERT : 0)|
1905                                               (c->restrict_filesystems_allow_list ? FILESYSTEM_PARSE_ALLOW_LIST : 0),
1906                                               u->id, NULL, 0);
1907                                 if (r < 0)
1908                                         return r;
1909                         }
1910
1911                         joined = strv_join(l, " ");
1912                         if (!joined)
1913                                 return -ENOMEM;
1914
1915                         unit_write_settingf(u, flags, name, "%s=%s%s", name, allow_list ? "" : "~", joined);
1916                 }
1917
1918                 return 1;
1919         }
1920
1921         if (streq(name, "MountFlags"))
1922                 return bus_set_transient_mount_propagation_flag(u, name, &c->mount_propagation_flag, message, flags, error);
1923
1924         if (streq(name, "NetworkNamespacePath"))
1925                 return bus_set_transient_path(u, name, &c->network_namespace_path, message, flags, error);
1926
1927         if (streq(name, "IPCNamespacePath"))
1928                 return bus_set_transient_path(u, name, &c->ipc_namespace_path, message, flags, error);
1929
1930         if (streq(name, "SupplementaryGroups")) {
1931                 _cleanup_strv_free_ char **l = NULL;
1932
1933                 r = sd_bus_message_read_strv(message, &l);
1934                 if (r < 0)
1935                         return r;
1936
1937                 STRV_FOREACH(p, l)
1938                         if (!isempty(*p) && !valid_user_group_name(*p, VALID_USER_ALLOW_NUMERIC|VALID_USER_RELAX|VALID_USER_WARN))
1939                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS,
1940                                                          "Invalid supplementary group names");
1941
1942                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1943                         if (strv_isempty(l)) {
1944                                 c->supplementary_groups = strv_free(c->supplementary_groups);
1945                                 unit_write_settingf(u, flags, name, "%s=", name);
1946                         } else {
1947                                 _cleanup_free_ char *joined = NULL;
1948
1949                                 r = strv_extend_strv(&c->supplementary_groups, l, true);
1950                                 if (r < 0)
1951                                         return -ENOMEM;
1952
1953                                 joined = strv_join(c->supplementary_groups, " ");
1954                                 if (!joined)
1955                                         return -ENOMEM;
1956
1957                                 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "%s=%s", name, joined);
1958                         }
1959                 }
1960
1961                 return 1;
1962
1963         } else if (STR_IN_SET(name, "SetCredential", "SetCredentialEncrypted")) {
1964                 bool isempty = true;
1965
1966                 r = sd_bus_message_enter_container(message, 'a', "(say)");
1967                 if (r < 0)
1968                         return r;
1969
1970                 for (;;) {
1971                         const char *id;
1972                         const void *p;
1973                         size_t sz;
1974
1975                         r = sd_bus_message_enter_container(message, 'r', "say");
1976                         if (r < 0)
1977                                 return r;
1978                         if (r == 0)
1979                                 break;
1980
1981                         r = sd_bus_message_read(message, "s", &id);
1982                         if (r < 0)
1983                                 return r;
1984
1985                         r = sd_bus_message_read_array(message, 'y', &p, &sz);
1986                         if (r < 0)
1987                                 return r;
1988
1989                         r = sd_bus_message_exit_container(message);
1990                         if (r < 0)
1991                                 return r;
1992
1993                         if (!credential_name_valid(id))
1994                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Credential ID is invalid: %s", id);
1995
1996                         isempty = false;
1997
1998                         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1999                                 _cleanup_free_ char *a = NULL, *b = NULL;
2000                                 _cleanup_free_ void *copy = NULL;
2001                                 ExecSetCredential *old;
2002
2003                                 copy = memdup(p, sz);
2004                                 if (!copy)
2005                                         return -ENOMEM;
2006
2007                                 old = hashmap_get(c->set_credentials, id);
2008                                 if (old) {
2009                                         free_and_replace(old->data, copy);
2010                                         old->size = sz;
2011                                         old->encrypted = streq(name, "SetCredentialEncrypted");
2012                                 } else {
2013                                         _cleanup_(exec_set_credential_freep) ExecSetCredential *sc = NULL;
2014
2015                                         sc = new(ExecSetCredential, 1);
2016                                         if (!sc)
2017                                                 return -ENOMEM;
2018
2019                                         *sc = (ExecSetCredential) {
2020                                                 .id = strdup(id),
2021                                                 .data = TAKE_PTR(copy),
2022                                                 .size = sz,
2023                                                 .encrypted = streq(name, "SetCredentialEncrypted"),
2024                                         };
2025
2026                                         if (!sc->id)
2027                                                 return -ENOMEM;
2028
2029                                         r = hashmap_ensure_put(&c->set_credentials, &exec_set_credential_hash_ops, sc->id, sc);
2030                                         if (r < 0)
2031                                                 return r;
2032
2033                                         TAKE_PTR(sc);
2034                                 }
2035
2036                                 a = specifier_escape(id);
2037                                 if (!a)
2038                                         return -ENOMEM;
2039
2040                                 b = cescape_length(p, sz);
2041                                 if (!b)
2042                                         return -ENOMEM;
2043
2044                                 (void) unit_write_settingf(u, flags, name, "%s=%s:%s", name, a, b);
2045                         }
2046                 }
2047
2048                 r = sd_bus_message_exit_container(message);
2049                 if (r < 0)
2050                         return r;
2051
2052                 if (!UNIT_WRITE_FLAGS_NOOP(flags) && isempty) {
2053                         c->set_credentials = hashmap_free(c->set_credentials);
2054                         (void) unit_write_settingf(u, flags, name, "%s=", name);
2055                 }
2056
2057                 return 1;
2058
2059         } else if (STR_IN_SET(name, "LoadCredential", "LoadCredentialEncrypted")) {
2060                 bool isempty = true;
2061
2062                 r = sd_bus_message_enter_container(message, 'a', "(ss)");
2063                 if (r < 0)
2064                         return r;
2065
2066                 for (;;) {
2067                         const char *id, *source;
2068
2069                         r = sd_bus_message_read(message, "(ss)", &id, &source);
2070                         if (r < 0)
2071                                 return r;
2072                         if (r == 0)
2073                                 break;
2074
2075                         if (!credential_name_valid(id))
2076                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Credential ID is invalid: %s", id);
2077
2078                         if (!(path_is_absolute(source) ? path_is_normalized(source) : credential_name_valid(source)))
2079                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Credential source is invalid: %s", source);
2080
2081                         isempty = false;
2082
2083                         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2084                                 bool encrypted = streq(name, "LoadCredentialEncrypted");
2085
2086                                 r = hashmap_put_credential(&c->load_credentials, id, source, encrypted);
2087                                 if (r < 0)
2088                                         return r;
2089
2090                                 (void) unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "%s=%s:%s", name, id, source);
2091                         }
2092                 }
2093
2094                 r = sd_bus_message_exit_container(message);
2095                 if (r < 0)
2096                         return r;
2097
2098                 if (!UNIT_WRITE_FLAGS_NOOP(flags) && isempty) {
2099                         c->load_credentials = hashmap_free(c->load_credentials);
2100                         (void) unit_write_settingf(u, flags, name, "%s=", name);
2101                 }
2102
2103                 return 1;
2104
2105         } else if (streq(name, "ImportCredential")) {
2106                 bool isempty = true;
2107
2108                 r = sd_bus_message_enter_container(message, 'a', "s");
2109                 if (r < 0)
2110                         return r;
2111
2112                 for (;;) {
2113                         const char *s;
2114
2115                         r = sd_bus_message_read(message, "s", &s);
2116                         if (r < 0)
2117                                 return r;
2118                         if (r == 0)
2119                                 break;
2120
2121                         if (!credential_glob_valid(s))
2122                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Credential name or glob is invalid: %s", s);
2123
2124                         isempty = false;
2125
2126                         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2127                                 r = set_put_strdup(&c->import_credentials, s);
2128                                 if (r < 0)
2129                                         return r;
2130
2131                                 (void) unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "%s=%s", name, s);
2132                         }
2133                 }
2134
2135                 r = sd_bus_message_exit_container(message);
2136                 if (r < 0)
2137                         return r;
2138
2139                 if (!UNIT_WRITE_FLAGS_NOOP(flags) && isempty) {
2140                         c->import_credentials = set_free_free(c->import_credentials);
2141                         (void) unit_write_settingf(u, flags, name, "%s=", name);
2142                 }
2143
2144                 return 1;
2145
2146         } else if (streq(name, "SyslogLevel")) {
2147                 int32_t level;
2148
2149                 r = sd_bus_message_read(message, "i", &level);
2150                 if (r < 0)
2151                         return r;
2152
2153                 if (!log_level_is_valid(level))
2154                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Log level value out of range");
2155
2156                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2157                         c->syslog_priority = (c->syslog_priority & LOG_FACMASK) | level;
2158                         unit_write_settingf(u, flags, name, "SyslogLevel=%i", level);
2159                 }
2160
2161                 return 1;
2162
2163         } else if (streq(name, "SyslogFacility")) {
2164                 int32_t facility;
2165
2166                 r = sd_bus_message_read(message, "i", &facility);
2167                 if (r < 0)
2168                         return r;
2169
2170                 if (!log_facility_unshifted_is_valid(facility))
2171                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Log facility value out of range");
2172
2173                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2174                         c->syslog_priority = (facility << 3) | LOG_PRI(c->syslog_priority);
2175                         unit_write_settingf(u, flags, name, "SyslogFacility=%i", facility);
2176                 }
2177
2178                 return 1;
2179
2180         } else if (streq(name, "LogNamespace")) {
2181                 const char *n;
2182
2183                 r = sd_bus_message_read(message, "s", &n);
2184                 if (r < 0)
2185                         return r;
2186
2187                 if (!isempty(n) && !log_namespace_name_valid(n))
2188                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Log namespace name not valid");
2189
2190                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2191
2192                         if (isempty(n)) {
2193                                 c->log_namespace = mfree(c->log_namespace);
2194                                 unit_write_settingf(u, flags, name, "%s=", name);
2195                         } else {
2196                                 r = free_and_strdup(&c->log_namespace, n);
2197                                 if (r < 0)
2198                                         return r;
2199
2200                                 unit_write_settingf(u, flags, name, "%s=%s", name, n);
2201                         }
2202                 }
2203
2204                 return 1;
2205
2206         } else if (streq(name, "LogExtraFields")) {
2207                 size_t n = 0;
2208
2209                 r = sd_bus_message_enter_container(message, 'a', "ay");
2210                 if (r < 0)
2211                         return r;
2212
2213                 for (;;) {
2214                         _cleanup_free_ void *copy = NULL;
2215                         struct iovec *t;
2216                         const char *eq;
2217                         const void *p;
2218                         size_t sz;
2219
2220                         /* Note that we expect a byte array for each field, instead of a string. That's because on the
2221                          * lower-level journal fields can actually contain binary data and are not restricted to text,
2222                          * and we should not "lose precision" in our types on the way. That said, I am pretty sure
2223                          * actually encoding binary data as unit metadata is not a good idea. Hence we actually refuse
2224                          * any actual binary data, and only accept UTF-8. This allows us to eventually lift this
2225                          * limitation, should a good, valid use case arise. */
2226
2227                         r = sd_bus_message_read_array(message, 'y', &p, &sz);
2228                         if (r < 0)
2229                                 return r;
2230                         if (r == 0)
2231                                 break;
2232
2233                         if (memchr(p, 0, sz))
2234                                 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Journal field contains zero byte");
2235
2236                         eq = memchr(p, '=', sz);
2237                         if (!eq)
2238                                 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Journal field contains no '=' character");
2239                         if (!journal_field_valid(p, eq - (const char*) p, false))
2240                                 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Journal field invalid");
2241
2242                         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2243                                 t = reallocarray(c->log_extra_fields, c->n_log_extra_fields+1, sizeof(struct iovec));
2244                                 if (!t)
2245                                         return -ENOMEM;
2246                                 c->log_extra_fields = t;
2247                         }
2248
2249                         copy = malloc(sz + 1);
2250                         if (!copy)
2251                                 return -ENOMEM;
2252
2253                         memcpy(copy, p, sz);
2254                         ((uint8_t*) copy)[sz] = 0;
2255
2256                         if (!utf8_is_valid(copy))
2257                                 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Journal field is not valid UTF-8");
2258
2259                         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2260                                 c->log_extra_fields[c->n_log_extra_fields++] = IOVEC_MAKE(copy, sz);
2261                                 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS|UNIT_ESCAPE_C, name, "LogExtraFields=%s", (char*) copy);
2262
2263                                 copy = NULL;
2264                         }
2265
2266                         n++;
2267                 }
2268
2269                 r = sd_bus_message_exit_container(message);
2270                 if (r < 0)
2271                         return r;
2272
2273                 if (!UNIT_WRITE_FLAGS_NOOP(flags) && n == 0) {
2274                         exec_context_free_log_extra_fields(c);
2275                         unit_write_setting(u, flags, name, "LogExtraFields=");
2276                 }
2277
2278                 return 1;
2279         }
2280
2281 #if HAVE_SECCOMP
2282
2283         if (streq(name, "SystemCallErrorNumber"))
2284                 return bus_set_transient_errno(u, name, &c->syscall_errno, message, flags, error);
2285
2286         if (streq(name, "SystemCallFilter")) {
2287                 int allow_list;
2288                 _cleanup_strv_free_ char **l = NULL;
2289
2290                 r = sd_bus_message_enter_container(message, 'r', "bas");
2291                 if (r < 0)
2292                         return r;
2293
2294                 r = sd_bus_message_read(message, "b", &allow_list);
2295                 if (r < 0)
2296                         return r;
2297
2298                 r = sd_bus_message_read_strv(message, &l);
2299                 if (r < 0)
2300                         return r;
2301
2302                 r = sd_bus_message_exit_container(message);
2303                 if (r < 0)
2304                         return r;
2305
2306                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2307                         _cleanup_free_ char *joined = NULL;
2308                         SeccompParseFlags invert_flag = allow_list ? 0 : SECCOMP_PARSE_INVERT;
2309
2310                         if (strv_isempty(l)) {
2311                                 c->syscall_allow_list = false;
2312                                 c->syscall_filter = hashmap_free(c->syscall_filter);
2313
2314                                 unit_write_settingf(u, flags, name, "SystemCallFilter=");
2315                                 return 1;
2316                         }
2317
2318                         if (!c->syscall_filter) {
2319                                 c->syscall_filter = hashmap_new(NULL);
2320                                 if (!c->syscall_filter)
2321                                         return log_oom();
2322
2323                                 c->syscall_allow_list = allow_list;
2324
2325                                 if (c->syscall_allow_list) {
2326                                         r = seccomp_parse_syscall_filter("@default",
2327                                                                          -1,
2328                                                                          c->syscall_filter,
2329                                                                          SECCOMP_PARSE_PERMISSIVE |
2330                                                                          SECCOMP_PARSE_ALLOW_LIST,
2331                                                                          u->id,
2332                                                                          NULL, 0);
2333                                         if (r < 0)
2334                                                 return r;
2335                                 }
2336                         }
2337
2338                         STRV_FOREACH(s, l) {
2339                                 _cleanup_free_ char *n = NULL;
2340                                 int e;
2341
2342                                 r = parse_syscall_and_errno(*s, &n, &e);
2343                                 if (r < 0)
2344                                         return r;
2345
2346                                 if (allow_list && e >= 0)
2347                                         return -EINVAL;
2348
2349                                 r = seccomp_parse_syscall_filter(n,
2350                                                                  e,
2351                                                                  c->syscall_filter,
2352                                                                  SECCOMP_PARSE_LOG | SECCOMP_PARSE_PERMISSIVE |
2353                                                                  invert_flag |
2354                                                                  (c->syscall_allow_list ? SECCOMP_PARSE_ALLOW_LIST : 0),
2355                                                                  u->id,
2356                                                                  NULL, 0);
2357                                 if (r < 0)
2358                                         return r;
2359                         }
2360
2361                         joined = strv_join(l, " ");
2362                         if (!joined)
2363                                 return -ENOMEM;
2364
2365                         unit_write_settingf(u, flags, name, "SystemCallFilter=%s%s", allow_list ? "" : "~", joined);
2366                 }
2367
2368                 return 1;
2369
2370         } else if (streq(name, "SystemCallLog")) {
2371                 int allow_list;
2372                 _cleanup_strv_free_ char **l = NULL;
2373
2374                 r = sd_bus_message_enter_container(message, 'r', "bas");
2375                 if (r < 0)
2376                         return r;
2377
2378                 r = sd_bus_message_read(message, "b", &allow_list);
2379                 if (r < 0)
2380                         return r;
2381
2382                 r = sd_bus_message_read_strv(message, &l);
2383                 if (r < 0)
2384                         return r;
2385
2386                 r = sd_bus_message_exit_container(message);
2387                 if (r < 0)
2388                         return r;
2389
2390                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2391                         _cleanup_free_ char *joined = NULL;
2392                         SeccompParseFlags invert_flag = allow_list ? 0 : SECCOMP_PARSE_INVERT;
2393
2394                         if (strv_isempty(l)) {
2395                                 c->syscall_log_allow_list = false;
2396                                 c->syscall_log = hashmap_free(c->syscall_log);
2397
2398                                 unit_write_settingf(u, flags, name, "SystemCallLog=");
2399                                 return 1;
2400                         }
2401
2402                         if (!c->syscall_log) {
2403                                 c->syscall_log = hashmap_new(NULL);
2404                                 if (!c->syscall_log)
2405                                         return log_oom();
2406
2407                                 c->syscall_log_allow_list = allow_list;
2408                         }
2409
2410                         STRV_FOREACH(s, l) {
2411                                 r = seccomp_parse_syscall_filter(*s,
2412                                                                  -1, /* errno not used */
2413                                                                  c->syscall_log,
2414                                                                  SECCOMP_PARSE_LOG | SECCOMP_PARSE_PERMISSIVE |
2415                                                                  invert_flag |
2416                                                                  (c->syscall_log_allow_list ? SECCOMP_PARSE_ALLOW_LIST : 0),
2417                                                                  u->id,
2418                                                                  NULL, 0);
2419                                 if (r < 0)
2420                                         return r;
2421                         }
2422
2423                         joined = strv_join(l, " ");
2424                         if (!joined)
2425                                 return -ENOMEM;
2426
2427                         unit_write_settingf(u, flags, name, "SystemCallLog=%s%s", allow_list ? "" : "~", joined);
2428                 }
2429
2430                 return 1;
2431
2432         } else if (streq(name, "SystemCallArchitectures")) {
2433                 _cleanup_strv_free_ char **l = NULL;
2434
2435                 r = sd_bus_message_read_strv(message, &l);
2436                 if (r < 0)
2437                         return r;
2438
2439                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2440                         _cleanup_free_ char *joined = NULL;
2441
2442                         if (strv_isempty(l))
2443                                 c->syscall_archs = set_free(c->syscall_archs);
2444                         else
2445                                 STRV_FOREACH(s, l) {
2446                                         uint32_t a;
2447
2448                                         r = seccomp_arch_from_string(*s, &a);
2449                                         if (r < 0)
2450                                                 return r;
2451
2452                                         r = set_ensure_put(&c->syscall_archs, NULL, UINT32_TO_PTR(a + 1));
2453                                         if (r < 0)
2454                                                 return r;
2455                                 }
2456
2457                         joined = strv_join(l, " ");
2458                         if (!joined)
2459                                 return -ENOMEM;
2460
2461                         unit_write_settingf(u, flags, name, "%s=%s", name, joined);
2462                 }
2463
2464                 return 1;
2465
2466         } else if (streq(name, "RestrictAddressFamilies")) {
2467                 _cleanup_strv_free_ char **l = NULL;
2468                 int allow_list;
2469
2470                 r = sd_bus_message_enter_container(message, 'r', "bas");
2471                 if (r < 0)
2472                         return r;
2473
2474                 r = sd_bus_message_read(message, "b", &allow_list);
2475                 if (r < 0)
2476                         return r;
2477
2478                 r = sd_bus_message_read_strv(message, &l);
2479                 if (r < 0)
2480                         return r;
2481
2482                 r = sd_bus_message_exit_container(message);
2483                 if (r < 0)
2484                         return r;
2485
2486                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2487                         _cleanup_free_ char *joined = NULL;
2488
2489                         if (strv_isempty(l)) {
2490                                 c->address_families_allow_list = allow_list;
2491                                 c->address_families = set_free(c->address_families);
2492
2493                                 unit_write_settingf(u, flags, name, "RestrictAddressFamilies=%s",
2494                                                     allow_list ? "none" : "");
2495                                 return 1;
2496                         }
2497
2498                         if (!c->address_families) {
2499                                 c->address_families = set_new(NULL);
2500                                 if (!c->address_families)
2501                                         return log_oom();
2502
2503                                 c->address_families_allow_list = allow_list;
2504                         }
2505
2506                         STRV_FOREACH(s, l) {
2507                                 int af;
2508
2509                                 af = af_from_name(*s);
2510                                 if (af < 0)
2511                                         return af;
2512
2513                                 if (allow_list == c->address_families_allow_list) {
2514                                         r = set_put(c->address_families, INT_TO_PTR(af));
2515                                         if (r < 0)
2516                                                 return r;
2517                                 } else
2518                                         set_remove(c->address_families, INT_TO_PTR(af));
2519                         }
2520
2521                         joined = strv_join(l, " ");
2522                         if (!joined)
2523                                 return -ENOMEM;
2524
2525                         unit_write_settingf(u, flags, name, "RestrictAddressFamilies=%s%s", allow_list ? "" : "~", joined);
2526                 }
2527
2528                 return 1;
2529         }
2530 #endif
2531         if (STR_IN_SET(name, "CPUAffinity", "NUMAMask")) {
2532                 const void *a;
2533                 size_t n;
2534                 bool affinity = streq(name, "CPUAffinity");
2535                 _cleanup_(cpu_set_reset) CPUSet set = {};
2536
2537                 r = sd_bus_message_read_array(message, 'y', &a, &n);
2538                 if (r < 0)
2539                         return r;
2540
2541                 r = cpu_set_from_dbus(a, n, &set);
2542                 if (r < 0)
2543                         return r;
2544
2545                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2546                         if (n == 0) {
2547                                 cpu_set_reset(affinity ? &c->cpu_set : &c->numa_policy.nodes);
2548                                 unit_write_settingf(u, flags, name, "%s=", name);
2549                         } else {
2550                                 _cleanup_free_ char *str = NULL;
2551
2552                                 str = cpu_set_to_string(&set);
2553                                 if (!str)
2554                                         return -ENOMEM;
2555
2556                                 /* We forego any optimizations here, and always create the structure using
2557                                  * cpu_set_add_all(), because we don't want to care if the existing size we
2558                                  * got over dbus is appropriate. */
2559                                 r = cpu_set_add_all(affinity ? &c->cpu_set : &c->numa_policy.nodes, &set);
2560                                 if (r < 0)
2561                                         return r;
2562
2563                                 unit_write_settingf(u, flags, name, "%s=%s", name, str);
2564                         }
2565                 }
2566
2567                 return 1;
2568
2569         } else if (streq(name, "CPUAffinityFromNUMA")) {
2570                 int q;
2571
2572                 r = sd_bus_message_read_basic(message, 'b', &q);
2573                 if (r < 0)
2574                         return r;
2575
2576                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2577                         c->cpu_affinity_from_numa = q;
2578                         unit_write_settingf(u, flags, name, "%s=%s", "CPUAffinity", "numa");
2579                 }
2580
2581                 return 1;
2582
2583         } else if (streq(name, "NUMAPolicy")) {
2584                 int32_t type;
2585
2586                 r = sd_bus_message_read(message, "i", &type);
2587                 if (r < 0)
2588                         return r;
2589
2590                 if (!mpol_is_valid(type))
2591                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid NUMAPolicy value: %i", type);
2592
2593                 if (!UNIT_WRITE_FLAGS_NOOP(flags))
2594                         c->numa_policy.type = type;
2595
2596                 return 1;
2597
2598         } else if (streq(name, "Nice")) {
2599                 int32_t q;
2600
2601                 r = sd_bus_message_read(message, "i", &q);
2602                 if (r < 0)
2603                         return r;
2604
2605                 if (!nice_is_valid(q))
2606                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid Nice value: %i", q);
2607
2608                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2609                         c->nice = q;
2610                         c->nice_set = true;
2611
2612                         unit_write_settingf(u, flags, name, "Nice=%i", q);
2613                 }
2614
2615                 return 1;
2616
2617         } else if (streq(name, "CPUSchedulingPolicy")) {
2618                 int32_t q;
2619
2620                 r = sd_bus_message_read(message, "i", &q);
2621                 if (r < 0)
2622                         return r;
2623
2624                 if (!sched_policy_is_valid(q))
2625                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid CPU scheduling policy: %i", q);
2626
2627                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2628                         _cleanup_free_ char *s = NULL;
2629
2630                         r = sched_policy_to_string_alloc(q, &s);
2631                         if (r < 0)
2632                                 return r;
2633
2634                         c->cpu_sched_policy = q;
2635                         c->cpu_sched_priority = CLAMP(c->cpu_sched_priority, sched_get_priority_min(q), sched_get_priority_max(q));
2636                         c->cpu_sched_set = true;
2637
2638                         unit_write_settingf(u, flags, name, "CPUSchedulingPolicy=%s", s);
2639                 }
2640
2641                 return 1;
2642
2643         } else if (streq(name, "CPUSchedulingPriority")) {
2644                 int32_t p;
2645
2646                 r = sd_bus_message_read(message, "i", &p);
2647                 if (r < 0)
2648                         return r;
2649
2650                 /* On Linux RR/FIFO range from 1 to 99 and OTHER/BATCH may only be 0. Policy might be set
2651                  * later so we do not check the precise range, but only the generic outer bounds. */
2652                 if (p < 0 || p > 99)
2653                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid CPU scheduling priority: %i", p);
2654
2655                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2656                         c->cpu_sched_priority = p;
2657                         c->cpu_sched_set = true;
2658
2659                         unit_write_settingf(u, flags, name, "CPUSchedulingPriority=%i", p);
2660                 }
2661
2662                 return 1;
2663
2664         } else if (streq(name, "IOSchedulingClass")) {
2665                 int32_t q;
2666
2667                 r = sd_bus_message_read(message, "i", &q);
2668                 if (r < 0)
2669                         return r;
2670
2671                 if (!ioprio_class_is_valid(q))
2672                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid IO scheduling class: %i", q);
2673
2674                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2675                         _cleanup_free_ char *s = NULL;
2676
2677                         r = ioprio_class_to_string_alloc(q, &s);
2678                         if (r < 0)
2679                                 return r;
2680
2681                         c->ioprio = ioprio_normalize(ioprio_prio_value(q, ioprio_prio_data(c->ioprio)));
2682                         c->ioprio_set = true;
2683
2684                         unit_write_settingf(u, flags, name, "IOSchedulingClass=%s", s);
2685                 }
2686
2687                 return 1;
2688
2689         } else if (streq(name, "IOSchedulingPriority")) {
2690                 int32_t p;
2691
2692                 r = sd_bus_message_read(message, "i", &p);
2693                 if (r < 0)
2694                         return r;
2695
2696                 if (!ioprio_priority_is_valid(p))
2697                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid IO scheduling priority: %i", p);
2698
2699                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2700                         c->ioprio = ioprio_normalize(ioprio_prio_value(ioprio_prio_class(c->ioprio), p));
2701                         c->ioprio_set = true;
2702
2703                         unit_write_settingf(u, flags, name, "IOSchedulingPriority=%i", p);
2704                 }
2705
2706                 return 1;
2707
2708         } else if (streq(name, "MountAPIVFS")) {
2709                 bool b;
2710
2711                 r = bus_set_transient_bool(u, name, &b, message, flags, error);
2712                 if (r < 0)
2713                         return r;
2714
2715                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2716                         c->mount_apivfs = b;
2717                         c->mount_apivfs_set = true;
2718                 }
2719
2720                 return 1;
2721
2722         } else if (streq(name, "WorkingDirectory")) {
2723                 const char *s;
2724                 bool missing_ok;
2725
2726                 r = sd_bus_message_read(message, "s", &s);
2727                 if (r < 0)
2728                         return r;
2729
2730                 if (s[0] == '-') {
2731                         missing_ok = true;
2732                         s++;
2733                 } else
2734                         missing_ok = false;
2735
2736                 if (!isempty(s) && !streq(s, "~") && !path_is_absolute(s))
2737                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "WorkingDirectory= expects an absolute path or '~'");
2738
2739                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2740                         if (streq(s, "~")) {
2741                                 c->working_directory = mfree(c->working_directory);
2742                                 c->working_directory_home = true;
2743                         } else {
2744                                 r = free_and_strdup(&c->working_directory, empty_to_null(s));
2745                                 if (r < 0)
2746                                         return r;
2747
2748                                 c->working_directory_home = false;
2749                         }
2750
2751                         c->working_directory_missing_ok = missing_ok;
2752                         unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "WorkingDirectory=%s%s", missing_ok ? "-" : "", s);
2753                 }
2754
2755                 return 1;
2756
2757         } else if (STR_IN_SET(name,
2758                               "StandardInputFileDescriptorName", "StandardOutputFileDescriptorName", "StandardErrorFileDescriptorName")) {
2759                 const char *s;
2760
2761                 r = sd_bus_message_read(message, "s", &s);
2762                 if (r < 0)
2763                         return r;
2764
2765                 if (!isempty(s) && !fdname_is_valid(s))
2766                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid file descriptor name");
2767
2768                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2769
2770                         if (streq(name, "StandardInputFileDescriptorName")) {
2771                                 r = free_and_strdup(c->stdio_fdname + STDIN_FILENO, empty_to_null(s));
2772                                 if (r < 0)
2773                                         return r;
2774
2775                                 c->std_input = EXEC_INPUT_NAMED_FD;
2776                                 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardInput=fd:%s", exec_context_fdname(c, STDIN_FILENO));
2777
2778                         } else if (streq(name, "StandardOutputFileDescriptorName")) {
2779                                 r = free_and_strdup(c->stdio_fdname + STDOUT_FILENO, empty_to_null(s));
2780                                 if (r < 0)
2781                                         return r;
2782
2783                                 c->std_output = EXEC_OUTPUT_NAMED_FD;
2784                                 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardOutput=fd:%s", exec_context_fdname(c, STDOUT_FILENO));
2785
2786                         } else {
2787                                 assert(streq(name, "StandardErrorFileDescriptorName"));
2788
2789                                 r = free_and_strdup(&c->stdio_fdname[STDERR_FILENO], empty_to_null(s));
2790                                 if (r < 0)
2791                                         return r;
2792
2793                                 c->std_error = EXEC_OUTPUT_NAMED_FD;
2794                                 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardError=fd:%s", exec_context_fdname(c, STDERR_FILENO));
2795                         }
2796                 }
2797
2798                 return 1;
2799
2800         } else if (STR_IN_SET(name,
2801                               "StandardInputFile",
2802                               "StandardOutputFile", "StandardOutputFileToAppend", "StandardOutputFileToTruncate",
2803                               "StandardErrorFile", "StandardErrorFileToAppend", "StandardErrorFileToTruncate")) {
2804                 const char *s;
2805
2806                 r = sd_bus_message_read(message, "s", &s);
2807                 if (r < 0)
2808                         return r;
2809
2810                 if (!isempty(s)) {
2811                         if (!path_is_absolute(s))
2812                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Path %s is not absolute", s);
2813                         if (!path_is_normalized(s))
2814                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Path %s is not normalized", s);
2815                 }
2816
2817                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2818
2819                         if (streq(name, "StandardInputFile")) {
2820                                 r = free_and_strdup(&c->stdio_file[STDIN_FILENO], empty_to_null(s));
2821                                 if (r < 0)
2822                                         return r;
2823
2824                                 c->std_input = EXEC_INPUT_FILE;
2825                                 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardInput=file:%s", s);
2826
2827                         } else if (STR_IN_SET(name, "StandardOutputFile", "StandardOutputFileToAppend", "StandardOutputFileToTruncate")) {
2828                                 r = free_and_strdup(&c->stdio_file[STDOUT_FILENO], empty_to_null(s));
2829                                 if (r < 0)
2830                                         return r;
2831
2832                                 if (streq(name, "StandardOutputFile")) {
2833                                         c->std_output = EXEC_OUTPUT_FILE;
2834                                         unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardOutput=file:%s", s);
2835                                 } else if (streq(name, "StandardOutputFileToAppend")) {
2836                                         c->std_output = EXEC_OUTPUT_FILE_APPEND;
2837                                         unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardOutput=append:%s", s);
2838                                 } else {
2839                                         assert(streq(name, "StandardOutputFileToTruncate"));
2840                                         c->std_output = EXEC_OUTPUT_FILE_TRUNCATE;
2841                                         unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardOutput=truncate:%s", s);
2842                                 }
2843                         } else {
2844                                 assert(STR_IN_SET(name, "StandardErrorFile", "StandardErrorFileToAppend", "StandardErrorFileToTruncate"));
2845
2846                                 r = free_and_strdup(&c->stdio_file[STDERR_FILENO], empty_to_null(s));
2847                                 if (r < 0)
2848                                         return r;
2849
2850                                 if (streq(name, "StandardErrorFile")) {
2851                                         c->std_error = EXEC_OUTPUT_FILE;
2852                                         unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardError=file:%s", s);
2853                                 } else if (streq(name, "StandardErrorFileToAppend")) {
2854                                         c->std_error = EXEC_OUTPUT_FILE_APPEND;
2855                                         unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardError=append:%s", s);
2856                                 } else {
2857                                         assert(streq(name, "StandardErrorFileToTruncate"));
2858                                         c->std_error = EXEC_OUTPUT_FILE_TRUNCATE;
2859                                         unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardError=truncate:%s", s);
2860                                 }
2861                         }
2862                 }
2863
2864                 return 1;
2865
2866         } else if (streq(name, "StandardInputData")) {
2867                 const void *p;
2868                 size_t sz;
2869
2870                 r = sd_bus_message_read_array(message, 'y', &p, &sz);
2871                 if (r < 0)
2872                         return r;
2873
2874                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2875                         _cleanup_free_ char *encoded = NULL;
2876
2877                         if (sz == 0) {
2878                                 c->stdin_data = mfree(c->stdin_data);
2879                                 c->stdin_data_size = 0;
2880
2881                                 unit_write_settingf(u, flags, name, "StandardInputData=");
2882                         } else {
2883                                 void *q;
2884                                 ssize_t n;
2885
2886                                 if (c->stdin_data_size + sz < c->stdin_data_size || /* check for overflow */
2887                                     c->stdin_data_size + sz > EXEC_STDIN_DATA_MAX)
2888                                         return -E2BIG;
2889
2890                                 n = base64mem(p, sz, &encoded);
2891                                 if (n < 0)
2892                                         return (int) n;
2893
2894                                 q = realloc(c->stdin_data, c->stdin_data_size + sz);
2895                                 if (!q)
2896                                         return -ENOMEM;
2897
2898                                 memcpy((uint8_t*) q + c->stdin_data_size, p, sz);
2899
2900                                 c->stdin_data = q;
2901                                 c->stdin_data_size += sz;
2902
2903                                 unit_write_settingf(u, flags, name, "StandardInputData=%s", encoded);
2904                         }
2905                 }
2906
2907                 return 1;
2908
2909         } else if (streq(name, "Environment")) {
2910
2911                 _cleanup_strv_free_ char **l = NULL;
2912
2913                 r = sd_bus_message_read_strv(message, &l);
2914                 if (r < 0)
2915                         return r;
2916
2917                 if (!strv_env_is_valid(l))
2918                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment block.");
2919
2920                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2921                         if (strv_isempty(l)) {
2922                                 c->environment = strv_free(c->environment);
2923                                 unit_write_setting(u, flags, name, "Environment=");
2924                         } else {
2925                                 _cleanup_free_ char *joined = NULL;
2926                                 char **e;
2927
2928                                 joined = unit_concat_strv(l, UNIT_ESCAPE_SPECIFIERS|UNIT_ESCAPE_C);
2929                                 if (!joined)
2930                                         return -ENOMEM;
2931
2932                                 e = strv_env_merge(c->environment, l);
2933                                 if (!e)
2934                                         return -ENOMEM;
2935
2936                                 strv_free_and_replace(c->environment, e);
2937                                 unit_write_settingf(u, flags, name, "Environment=%s", joined);
2938                         }
2939                 }
2940
2941                 return 1;
2942
2943         } else if (streq(name, "UnsetEnvironment")) {
2944
2945                 _cleanup_strv_free_ char **l = NULL;
2946
2947                 r = sd_bus_message_read_strv(message, &l);
2948                 if (r < 0)
2949                         return r;
2950
2951                 if (!strv_env_name_or_assignment_is_valid(l))
2952                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid UnsetEnvironment= list.");
2953
2954                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2955                         if (strv_isempty(l)) {
2956                                 c->unset_environment = strv_free(c->unset_environment);
2957                                 unit_write_setting(u, flags, name, "UnsetEnvironment=");
2958                         } else {
2959                                 _cleanup_free_ char *joined = NULL;
2960                                 char **e;
2961
2962                                 joined = unit_concat_strv(l, UNIT_ESCAPE_SPECIFIERS|UNIT_ESCAPE_C);
2963                                 if (!joined)
2964                                         return -ENOMEM;
2965
2966                                 e = strv_env_merge(c->unset_environment, l);
2967                                 if (!e)
2968                                         return -ENOMEM;
2969
2970                                 strv_free_and_replace(c->unset_environment, e);
2971                                 unit_write_settingf(u, flags, name, "UnsetEnvironment=%s", joined);
2972                         }
2973                 }
2974
2975                 return 1;
2976
2977         } else if (streq(name, "OOMScoreAdjust")) {
2978                 int oa;
2979
2980                 r = sd_bus_message_read(message, "i", &oa);
2981                 if (r < 0)
2982                         return r;
2983
2984                 if (!oom_score_adjust_is_valid(oa))
2985                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "OOM score adjust value out of range");
2986
2987                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2988                         c->oom_score_adjust = oa;
2989                         c->oom_score_adjust_set = true;
2990                         unit_write_settingf(u, flags, name, "OOMScoreAdjust=%i", oa);
2991                 }
2992
2993                 return 1;
2994
2995         } else if (streq(name, "CoredumpFilter")) {
2996                 uint64_t f;
2997
2998                 r = sd_bus_message_read(message, "t", &f);
2999                 if (r < 0)
3000                         return r;
3001
3002                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3003                         c->coredump_filter = f;
3004                         c->coredump_filter_set = true;
3005                         unit_write_settingf(u, flags, name, "CoredumpFilter=0x%"PRIx64, f);
3006                 }
3007
3008                 return 1;
3009
3010         } else if (streq(name, "EnvironmentFiles")) {
3011                 _cleanup_(memstream_done) MemStream m = {};
3012                 _cleanup_free_ char *joined = NULL;
3013                 _cleanup_strv_free_ char **l = NULL;
3014                 FILE *f;
3015
3016                 r = sd_bus_message_enter_container(message, 'a', "(sb)");
3017                 if (r < 0)
3018                         return r;
3019
3020                 f = memstream_init(&m);
3021                 if (!f)
3022                         return -ENOMEM;
3023
3024                 fputs("EnvironmentFile=\n", f);
3025
3026                 STRV_FOREACH(i, c->environment_files) {
3027                         _cleanup_free_ char *q = NULL;
3028
3029                         q = specifier_escape(*i);
3030                         if (!q)
3031                                 return -ENOMEM;
3032
3033                         fprintf(f, "EnvironmentFile=%s\n", q);
3034                 }
3035
3036                 while ((r = sd_bus_message_enter_container(message, 'r', "sb")) > 0) {
3037                         const char *path;
3038                         int b;
3039
3040                         r = sd_bus_message_read(message, "sb", &path, &b);
3041                         if (r < 0)
3042                                 return r;
3043
3044                         r = sd_bus_message_exit_container(message);
3045                         if (r < 0)
3046                                 return r;
3047
3048                         if (!path_is_absolute(path))
3049                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Path %s is not absolute.", path);
3050
3051                         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3052                                 _cleanup_free_ char *q = NULL, *buf = NULL;
3053
3054                                 buf = strjoin(b ? "-" : "", path);
3055                                 if (!buf)
3056                                         return -ENOMEM;
3057
3058                                 q = specifier_escape(buf);
3059                                 if (!q)
3060                                         return -ENOMEM;
3061
3062                                 fprintf(f, "EnvironmentFile=%s\n", q);
3063
3064                                 r = strv_consume(&l, TAKE_PTR(buf));
3065                                 if (r < 0)
3066                                         return r;
3067                         }
3068                 }
3069                 if (r < 0)
3070                         return r;
3071
3072                 r = sd_bus_message_exit_container(message);
3073                 if (r < 0)
3074                         return r;
3075
3076                 r = memstream_finalize(&m, &joined, NULL);
3077                 if (r < 0)
3078                         return r;
3079
3080                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3081                         if (strv_isempty(l)) {
3082                                 c->environment_files = strv_free(c->environment_files);
3083                                 unit_write_setting(u, flags, name, "EnvironmentFile=");
3084                         } else {
3085                                 r = strv_extend_strv(&c->environment_files, l, true);
3086                                 if (r < 0)
3087                                         return r;
3088
3089                                 unit_write_setting(u, flags, name, joined);
3090                         }
3091                 }
3092
3093                 return 1;
3094
3095         } else if (streq(name, "PassEnvironment")) {
3096
3097                 _cleanup_strv_free_ char **l = NULL;
3098
3099                 r = sd_bus_message_read_strv(message, &l);
3100                 if (r < 0)
3101                         return r;
3102
3103                 if (!strv_env_name_is_valid(l))
3104                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid PassEnvironment= block.");
3105
3106                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3107                         if (strv_isempty(l)) {
3108                                 c->pass_environment = strv_free(c->pass_environment);
3109                                 unit_write_setting(u, flags, name, "PassEnvironment=");
3110                         } else {
3111                                 _cleanup_free_ char *joined = NULL;
3112
3113                                 r = strv_extend_strv(&c->pass_environment, l, true);
3114                                 if (r < 0)
3115                                         return r;
3116
3117                                 /* We write just the new settings out to file, with unresolved specifiers. */
3118                                 joined = unit_concat_strv(l, UNIT_ESCAPE_SPECIFIERS);
3119                                 if (!joined)
3120                                         return -ENOMEM;
3121
3122                                 unit_write_settingf(u, flags, name, "PassEnvironment=%s", joined);
3123                         }
3124                 }
3125
3126                 return 1;
3127
3128         } else if (STR_IN_SET(name, "ReadWriteDirectories", "ReadOnlyDirectories", "InaccessibleDirectories",
3129                               "ReadWritePaths", "ReadOnlyPaths", "InaccessiblePaths", "ExecPaths", "NoExecPaths",
3130                               "ExtensionDirectories")) {
3131                 _cleanup_strv_free_ char **l = NULL;
3132                 char ***dirs;
3133
3134                 r = sd_bus_message_read_strv(message, &l);
3135                 if (r < 0)
3136                         return r;
3137
3138                 STRV_FOREACH(p, l) {
3139                         char *i = *p;
3140                         size_t offset;
3141
3142                         offset = i[0] == '-';
3143                         offset += i[offset] == '+';
3144                         if (!path_is_absolute(i + offset))
3145                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid %s", name);
3146
3147                         path_simplify(i + offset);
3148                 }
3149
3150                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3151                         if (STR_IN_SET(name, "ReadWriteDirectories", "ReadWritePaths"))
3152                                 dirs = &c->read_write_paths;
3153                         else if (STR_IN_SET(name, "ReadOnlyDirectories", "ReadOnlyPaths"))
3154                                 dirs = &c->read_only_paths;
3155                         else if (streq(name, "ExecPaths"))
3156                                 dirs = &c->exec_paths;
3157                         else if (streq(name, "NoExecPaths"))
3158                                 dirs = &c->no_exec_paths;
3159                         else if (streq(name, "ExtensionDirectories"))
3160                                 dirs = &c->extension_directories;
3161                         else /* "InaccessiblePaths" */
3162                                 dirs = &c->inaccessible_paths;
3163
3164                         if (strv_isempty(l)) {
3165                                 *dirs = strv_free(*dirs);
3166                                 unit_write_settingf(u, flags, name, "%s=", name);
3167                         } else {
3168                                 _cleanup_free_ char *joined = NULL;
3169
3170                                 joined = unit_concat_strv(l, UNIT_ESCAPE_SPECIFIERS);
3171                                 if (!joined)
3172                                         return -ENOMEM;
3173
3174                                 r = strv_extend_strv(dirs, l, true);
3175                                 if (r < 0)
3176                                         return -ENOMEM;
3177
3178                                 unit_write_settingf(u, flags, name, "%s=%s", name, joined);
3179                         }
3180                 }
3181
3182                 return 1;
3183
3184         } else if (streq(name, "ExecSearchPath")) {
3185                 _cleanup_strv_free_ char **l = NULL;
3186
3187                 r = sd_bus_message_read_strv(message, &l);
3188                 if (r < 0)
3189                         return r;
3190
3191                 STRV_FOREACH(p, l)
3192                         if (!path_is_absolute(*p) || !path_is_normalized(*p) || strchr(*p, ':'))
3193                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid %s", name);
3194
3195                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3196                         if (strv_isempty(l)) {
3197                                 c->exec_search_path = strv_free(c->exec_search_path);
3198                                 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "ExecSearchPath=");
3199                         } else {
3200                                 _cleanup_free_ char *joined = NULL;
3201                                 r = strv_extend_strv(&c->exec_search_path, l, true);
3202                                 if (r < 0)
3203                                         return -ENOMEM;
3204                                 joined = strv_join(c->exec_search_path, ":");
3205                                 if (!joined)
3206                                         return log_oom();
3207                                 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "ExecSearchPath=%s", joined);
3208                         }
3209                 }
3210
3211                 return 1;
3212
3213         } else if (STR_IN_SET(name, "RuntimeDirectory", "StateDirectory", "CacheDirectory", "LogsDirectory", "ConfigurationDirectory")) {
3214                 _cleanup_strv_free_ char **l = NULL;
3215
3216                 r = sd_bus_message_read_strv(message, &l);
3217                 if (r < 0)
3218                         return r;
3219
3220                 STRV_FOREACH(p, l) {
3221                         if (!path_is_normalized(*p))
3222                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "%s= path is not normalized: %s", name, *p);
3223
3224                         if (path_is_absolute(*p))
3225                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "%s= path is absolute: %s", name, *p);
3226
3227                         if (path_startswith(*p, "private"))
3228                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "%s= path can't be 'private': %s", name, *p);
3229                 }
3230
3231                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3232                         ExecDirectoryType i;
3233                         ExecDirectory *d;
3234
3235                         assert_se((i = exec_directory_type_from_string(name)) >= 0);
3236                         d = c->directories + i;
3237
3238                         if (strv_isempty(l)) {
3239                                 exec_directory_done(d);
3240                                 unit_write_settingf(u, flags, name, "%s=", name);
3241                         } else {
3242                                 _cleanup_free_ char *joined = NULL;
3243
3244                                 STRV_FOREACH(source, l) {
3245                                         r = exec_directory_add(d, *source, NULL);
3246                                         if (r < 0)
3247                                                 return log_oom();
3248                                 }
3249                                 exec_directory_sort(d);
3250
3251                                 joined = unit_concat_strv(l, UNIT_ESCAPE_SPECIFIERS);
3252                                 if (!joined)
3253                                         return -ENOMEM;
3254
3255                                 unit_write_settingf(u, flags, name, "%s=%s", name, joined);
3256                         }
3257                 }
3258
3259                 return 1;
3260
3261         } else if (STR_IN_SET(name, "AppArmorProfile", "SmackProcessLabel")) {
3262                 int ignore;
3263                 const char *s;
3264
3265                 r = sd_bus_message_read(message, "(bs)", &ignore, &s);
3266                 if (r < 0)
3267                         return r;
3268
3269                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3270                         char **p;
3271                         bool *b;
3272
3273                         if (streq(name, "AppArmorProfile")) {
3274                                 p = &c->apparmor_profile;
3275                                 b = &c->apparmor_profile_ignore;
3276                         } else { /* "SmackProcessLabel" */
3277                                 p = &c->smack_process_label;
3278                                 b = &c->smack_process_label_ignore;
3279                         }
3280
3281                         if (isempty(s)) {
3282                                 *p = mfree(*p);
3283                                 *b = false;
3284                         } else {
3285                                 if (free_and_strdup(p, s) < 0)
3286                                         return -ENOMEM;
3287                                 *b = ignore;
3288                         }
3289
3290                         unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "%s=%s%s", name, ignore ? "-" : "", strempty(s));
3291                 }
3292
3293                 return 1;
3294
3295         } else if (STR_IN_SET(name, "BindPaths", "BindReadOnlyPaths")) {
3296                 char *source, *destination;
3297                 int ignore_enoent;
3298                 uint64_t mount_flags;
3299                 bool empty = true;
3300
3301                 r = sd_bus_message_enter_container(message, 'a', "(ssbt)");
3302                 if (r < 0)
3303                         return r;
3304
3305                 while ((r = sd_bus_message_read(message, "(ssbt)", &source, &destination, &ignore_enoent, &mount_flags)) > 0) {
3306
3307                         if (!path_is_absolute(source))
3308                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not absolute.", source);
3309                         if (!path_is_absolute(destination))
3310                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is not absolute.", destination);
3311                         if (!IN_SET(mount_flags, 0, MS_REC))
3312                                 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Unknown mount flags.");
3313
3314                         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3315                                 r = bind_mount_add(&c->bind_mounts, &c->n_bind_mounts,
3316                                                    &(BindMount) {
3317                                                            .source = source,
3318                                                            .destination = destination,
3319                                                            .read_only = !!strstr(name, "ReadOnly"),
3320                                                            .recursive = !!(mount_flags & MS_REC),
3321                                                            .ignore_enoent = ignore_enoent,
3322                                                    });
3323                                 if (r < 0)
3324                                         return r;
3325
3326                                 unit_write_settingf(
3327                                                 u, flags|UNIT_ESCAPE_SPECIFIERS, name,
3328                                                 "%s=%s%s:%s:%s",
3329                                                 name,
3330                                                 ignore_enoent ? "-" : "",
3331                                                 source,
3332                                                 destination,
3333                                                 (mount_flags & MS_REC) ? "rbind" : "norbind");
3334                         }
3335
3336                         empty = false;
3337                 }
3338                 if (r < 0)
3339                         return r;
3340
3341                 r = sd_bus_message_exit_container(message);
3342                 if (r < 0)
3343                         return r;
3344
3345                 if (empty) {
3346                         bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
3347                         c->bind_mounts = NULL;
3348                         c->n_bind_mounts = 0;
3349
3350                         unit_write_settingf(u, flags, name, "%s=", name);
3351                 }
3352
3353                 return 1;
3354
3355         } else if (streq(name, "TemporaryFileSystem")) {
3356                 const char *path, *options;
3357                 bool empty = true;
3358
3359                 r = sd_bus_message_enter_container(message, 'a', "(ss)");
3360                 if (r < 0)
3361                         return r;
3362
3363                 while ((r = sd_bus_message_read(message, "(ss)", &path, &options)) > 0) {
3364
3365                         if (!path_is_absolute(path))
3366                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Mount point %s is not absolute.", path);
3367
3368                         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3369                                 r = temporary_filesystem_add(&c->temporary_filesystems, &c->n_temporary_filesystems, path, options);
3370                                 if (r < 0)
3371                                         return r;
3372
3373                                 unit_write_settingf(
3374                                                 u, flags|UNIT_ESCAPE_SPECIFIERS, name,
3375                                                 "%s=%s:%s",
3376                                                 name,
3377                                                 path,
3378                                                 options);
3379                         }
3380
3381                         empty = false;
3382                 }
3383                 if (r < 0)
3384                         return r;
3385
3386                 r = sd_bus_message_exit_container(message);
3387                 if (r < 0)
3388                         return r;
3389
3390                 if (empty) {
3391                         temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);
3392                         c->temporary_filesystems = NULL;
3393                         c->n_temporary_filesystems = 0;
3394
3395                         unit_write_settingf(u, flags, name, "%s=", name);
3396                 }
3397
3398                 return 1;
3399
3400         } else if ((suffix = startswith(name, "Limit"))) {
3401                 const char *soft = NULL;
3402                 int ri;
3403
3404                 ri = rlimit_from_string(suffix);
3405                 if (ri < 0) {
3406                         soft = endswith(suffix, "Soft");
3407                         if (soft) {
3408                                 const char *n;
3409
3410                                 n = strndupa_safe(suffix, soft - suffix);
3411                                 ri = rlimit_from_string(n);
3412                                 if (ri >= 0)
3413                                         name = strjoina("Limit", n);
3414                         }
3415                 }
3416
3417                 if (ri >= 0) {
3418                         uint64_t rl;
3419                         rlim_t x;
3420
3421                         r = sd_bus_message_read(message, "t", &rl);
3422                         if (r < 0)
3423                                 return r;
3424
3425                         if (rl == UINT64_MAX)
3426                                 x = RLIM_INFINITY;
3427                         else {
3428                                 x = (rlim_t) rl;
3429
3430                                 if ((uint64_t) x != rl)
3431                                         return -ERANGE;
3432                         }
3433
3434                         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3435                                 _cleanup_free_ char *f = NULL;
3436                                 struct rlimit nl;
3437
3438                                 if (c->rlimit[ri]) {
3439                                         nl = *c->rlimit[ri];
3440
3441                                         if (soft)
3442                                                 nl.rlim_cur = x;
3443                                         else
3444                                                 nl.rlim_max = x;
3445                                 } else
3446                                         /* When the resource limit is not initialized yet, then assign the value to both fields */
3447                                         nl = (struct rlimit) {
3448                                                 .rlim_cur = x,
3449                                                 .rlim_max = x,
3450                                         };
3451
3452                                 r = rlimit_format(&nl, &f);
3453                                 if (r < 0)
3454                                         return r;
3455
3456                                 if (c->rlimit[ri])
3457                                         *c->rlimit[ri] = nl;
3458                                 else {
3459                                         c->rlimit[ri] = newdup(struct rlimit, &nl, 1);
3460                                         if (!c->rlimit[ri])
3461                                                 return -ENOMEM;
3462                                 }
3463
3464                                 unit_write_settingf(u, flags, name, "%s=%s", name, f);
3465                         }
3466
3467                         return 1;
3468                 }
3469
3470         } else if (streq(name, "MountImages")) {
3471                 _cleanup_free_ char *format_str = NULL;
3472                 MountImage *mount_images = NULL;
3473                 size_t n_mount_images = 0;
3474                 char *source, *destination;
3475                 int permissive;
3476
3477                 r = sd_bus_message_enter_container(message, 'a', "(ssba(ss))");
3478                 if (r < 0)
3479                         return r;
3480
3481                 for (;;) {
3482                         _cleanup_(mount_options_free_allp) MountOptions *options = NULL;
3483                         _cleanup_free_ char *source_escaped = NULL, *destination_escaped = NULL;
3484                         char *tuple;
3485
3486                         r = sd_bus_message_enter_container(message, 'r', "ssba(ss)");
3487                         if (r < 0)
3488                                 return r;
3489
3490                         r = sd_bus_message_read(message, "ssb", &source, &destination, &permissive);
3491                         if (r <= 0)
3492                                 break;
3493
3494                         if (!path_is_absolute(source))
3495                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not absolute.", source);
3496                         if (!path_is_normalized(source))
3497                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not normalized.", source);
3498                         if (!path_is_absolute(destination))
3499                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is not absolute.", destination);
3500                         if (!path_is_normalized(destination))
3501                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is not normalized.", destination);
3502
3503                         /* Need to store them in the unit with the escapes, so that they can be parsed again */
3504                         source_escaped = shell_escape(source, ":");
3505                         if (!source_escaped)
3506                                 return -ENOMEM;
3507                         destination_escaped = shell_escape(destination, ":");
3508                         if (!destination_escaped)
3509                                 return -ENOMEM;
3510
3511                         tuple = strjoin(format_str,
3512                                         format_str ? " " : "",
3513                                         permissive ? "-" : "",
3514                                         source_escaped,
3515                                         ":",
3516                                         destination_escaped);
3517                         if (!tuple)
3518                                 return -ENOMEM;
3519                         free_and_replace(format_str, tuple);
3520
3521                         r = bus_read_mount_options(message, error, &options, &format_str, ":");
3522                         if (r < 0)
3523                                 return r;
3524
3525                         r = sd_bus_message_exit_container(message);
3526                         if (r < 0)
3527                                 return r;
3528
3529                         r = mount_image_add(&mount_images, &n_mount_images,
3530                                             &(MountImage) {
3531                                                     .source = source,
3532                                                     .destination = destination,
3533                                                     .mount_options = options,
3534                                                     .ignore_enoent = permissive,
3535                                                     .type = MOUNT_IMAGE_DISCRETE,
3536                                             });
3537                         if (r < 0)
3538                                 return r;
3539                 }
3540                 if (r < 0)
3541                         return r;
3542
3543                 r = sd_bus_message_exit_container(message);
3544                 if (r < 0)
3545                         return r;
3546
3547                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3548                         if (n_mount_images == 0) {
3549                                 c->mount_images = mount_image_free_many(c->mount_images, &c->n_mount_images);
3550
3551                                 unit_write_settingf(u, flags, name, "%s=", name);
3552                         } else {
3553                                 for (size_t i = 0; i < n_mount_images; ++i) {
3554                                         r = mount_image_add(&c->mount_images, &c->n_mount_images, &mount_images[i]);
3555                                         if (r < 0)
3556                                                 return r;
3557                                 }
3558
3559                                 unit_write_settingf(u, flags|UNIT_ESCAPE_C|UNIT_ESCAPE_SPECIFIERS,
3560                                                     name,
3561                                                     "%s=%s",
3562                                                     name,
3563                                                     format_str);
3564                         }
3565                 }
3566
3567                 mount_images = mount_image_free_many(mount_images, &n_mount_images);
3568
3569                 return 1;
3570         } else if (streq(name, "ExtensionImages")) {
3571                 _cleanup_free_ char *format_str = NULL;
3572                 MountImage *extension_images = NULL;
3573                 size_t n_extension_images = 0;
3574
3575                 r = sd_bus_message_enter_container(message, 'a', "(sba(ss))");
3576                 if (r < 0)
3577                         return r;
3578
3579                 for (;;) {
3580                         _cleanup_(mount_options_free_allp) MountOptions *options = NULL;
3581                         _cleanup_free_ char *source_escaped = NULL;
3582                         char *source, *tuple;
3583                         int permissive;
3584
3585                         r = sd_bus_message_enter_container(message, 'r', "sba(ss)");
3586                         if (r < 0)
3587                                 return r;
3588
3589                         r = sd_bus_message_read(message, "sb", &source, &permissive);
3590                         if (r <= 0)
3591                                 break;
3592
3593                         if (!path_is_absolute(source))
3594                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not absolute.", source);
3595                         if (!path_is_normalized(source))
3596                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not normalized.", source);
3597
3598                         /* Need to store them in the unit with the escapes, so that they can be parsed again */
3599                         source_escaped = shell_escape(source, ":");
3600                         if (!source_escaped)
3601                                 return -ENOMEM;
3602
3603                         tuple = strjoin(format_str,
3604                                         format_str ? " " : "",
3605                                         permissive ? "-" : "",
3606                                         source_escaped);
3607                         if (!tuple)
3608                                 return -ENOMEM;
3609                         free_and_replace(format_str, tuple);
3610
3611                         r = bus_read_mount_options(message, error, &options, &format_str, ":");
3612                         if (r < 0)
3613                                 return r;
3614
3615                         r = sd_bus_message_exit_container(message);
3616                         if (r < 0)
3617                                 return r;
3618
3619                         r = mount_image_add(&extension_images, &n_extension_images,
3620                                             &(MountImage) {
3621                                                     .source = source,
3622                                                     .mount_options = options,
3623                                                     .ignore_enoent = permissive,
3624                                                     .type = MOUNT_IMAGE_EXTENSION,
3625                                             });
3626                         if (r < 0)
3627                                 return r;
3628                 }
3629                 if (r < 0)
3630                         return r;
3631
3632                 r = sd_bus_message_exit_container(message);
3633                 if (r < 0)
3634                         return r;
3635
3636                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3637                         if (n_extension_images == 0) {
3638                                 c->extension_images = mount_image_free_many(c->extension_images, &c->n_extension_images);
3639
3640                                 unit_write_settingf(u, flags, name, "%s=", name);
3641                         } else {
3642                                 for (size_t i = 0; i < n_extension_images; ++i) {
3643                                         r = mount_image_add(&c->extension_images, &c->n_extension_images, &extension_images[i]);
3644                                         if (r < 0)
3645                                                 return r;
3646                                 }
3647
3648                                 unit_write_settingf(u, flags|UNIT_ESCAPE_C|UNIT_ESCAPE_SPECIFIERS,
3649                                                     name,
3650                                                     "%s=%s",
3651                                                     name,
3652                                                     format_str);
3653                         }
3654                 }
3655
3656                 extension_images = mount_image_free_many(extension_images, &n_extension_images);
3657
3658                 return 1;
3659
3660         } else if (STR_IN_SET(name, "StateDirectorySymlink", "RuntimeDirectorySymlink", "CacheDirectorySymlink", "LogsDirectorySymlink")) {
3661                 char *source, *destination;
3662                 ExecDirectory *directory;
3663                 uint64_t symlink_flags; /* No flags for now, reserved for future uses. */
3664                 ExecDirectoryType i;
3665
3666                 assert_se((i = exec_directory_type_symlink_from_string(name)) >= 0);
3667                 directory = c->directories + i;
3668
3669                 r = sd_bus_message_enter_container(message, 'a', "(sst)");
3670                 if (r < 0)
3671                         return r;
3672
3673                 while ((r = sd_bus_message_read(message, "(sst)", &source, &destination, &symlink_flags)) > 0) {
3674                         if (!path_is_valid(source))
3675                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not valid.", source);
3676                         if (path_is_absolute(source))
3677                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is absolute.", source);
3678                         if (!path_is_normalized(source))
3679                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not normalized.", source);
3680                         if (!path_is_valid(destination))
3681                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is not valid.", destination);
3682                         if (path_is_absolute(destination))
3683                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is absolute.", destination);
3684                         if (!path_is_normalized(destination))
3685                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is not normalized.", destination);
3686                         if (symlink_flags != 0)
3687                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Flags must be zero.");
3688
3689                         if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3690                                 _cleanup_free_ char *destination_escaped = NULL, *source_escaped = NULL;
3691
3692                                 r = exec_directory_add(directory, source, destination);
3693                                 if (r < 0)
3694                                         return r;
3695
3696                                 /* Need to store them in the unit with the escapes, so that they can be parsed again */
3697                                 source_escaped = xescape(source, ":");
3698                                 destination_escaped = xescape(destination, ":");
3699                                 if (!source_escaped || !destination_escaped)
3700                                         return -ENOMEM;
3701
3702                                 unit_write_settingf(
3703                                                 u, flags|UNIT_ESCAPE_SPECIFIERS, exec_directory_type_to_string(i),
3704                                                 "%s=%s:%s",
3705                                                 exec_directory_type_to_string(i),
3706                                                 source_escaped,
3707                                                 destination_escaped);
3708                         }
3709                 }
3710                 if (r < 0)
3711                         return r;
3712
3713                 exec_directory_sort(directory);
3714
3715                 r = sd_bus_message_exit_container(message);
3716                 if (r < 0)
3717                         return r;
3718
3719                 return 1;
3720
3721         } else if (STR_IN_SET(name, "RootImagePolicy", "MountImagePolicy", "ExtensionImagePolicy")) {
3722                 _cleanup_(image_policy_freep) ImagePolicy *p = NULL;
3723                 const char *s;
3724
3725                 r = sd_bus_message_read(message, "s", &s);
3726                 if (r < 0)
3727                         return r;
3728
3729                 r = image_policy_from_string(s, &p);
3730                 if (r < 0)
3731                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Failed to parse image policy string: %s", s);
3732
3733                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3734                         _cleanup_free_ char *t = NULL;
3735                         ImagePolicy **pp =
3736                                 streq(name, "RootImagePolicy")  ? &c->root_image_policy :
3737                                 streq(name, "MountImagePolicy") ? &c->mount_image_policy :
3738                                                                   &c->extension_image_policy;
3739
3740                         r = image_policy_to_string(p, /* simplify= */ true, &t);
3741                         if (r < 0)
3742                                 return r;
3743
3744                         image_policy_free(*pp);
3745                         *pp = TAKE_PTR(p);
3746
3747                         unit_write_settingf(
3748                                         u, flags, name,
3749                                         "%s=%s",
3750                                         name,
3751                                         t); /* no escaping necessary */
3752                 }
3753
3754                 return 1;
3755         }
3756
3757         return 0;
3758 }