]>
git.ipfire.org Git - thirdparty/systemd.git/blob - src/resolve/resolved.c
1625c5189d0e95ef8e244b5420bf13b1afd45c73
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
10 #include "bus-log-control-api.h"
11 #include "capability-util.h"
12 #include "daemon-util.h"
13 #include "main-func.h"
14 #include "mkdir-label.h"
15 #include "resolved-bus.h"
16 #include "resolved-conf.h"
17 #include "resolved-manager.h"
18 #include "resolved-resolv-conf.h"
19 #include "selinux-util.h"
20 #include "service-util.h"
21 #include "signal-util.h"
22 #include "user-util.h"
24 static int run(int argc
, char *argv
[]) {
25 _cleanup_(manager_freep
) Manager
*m
= NULL
;
26 _unused_
_cleanup_(notify_on_cleanup
) const char *notify_stop
= NULL
;
31 r
= service_parse_argv("systemd-resolved.service",
32 "Provide name resolution with caching using DNS, mDNS, LLMNR.",
33 BUS_IMPLEMENTATIONS(&manager_object
,
45 /* Drop privileges, but only if we have been started as root. If we are not running as root we assume most
46 * privileges are already dropped and we can't create our directory. */
48 const char *user
= "systemd-resolve";
52 r
= get_user_creds(&user
, &uid
, &gid
, NULL
, NULL
, 0);
54 return log_error_errno(r
, "Cannot resolve user name %s: %m", user
);
56 /* As we're root, we can create the directory where resolv.conf will live */
57 r
= mkdir_safe_label("/run/systemd/resolve", 0755, uid
, gid
, MKDIR_WARN_MODE
);
59 return log_error_errno(r
, "Could not create runtime directory: %m");
61 /* Drop privileges, but keep three caps. Note that we drop two of those too, later on (see below) */
62 r
= drop_privileges(uid
, gid
,
63 (UINT64_C(1) << CAP_NET_RAW
)| /* needed for SO_BINDTODEVICE */
64 (UINT64_C(1) << CAP_NET_BIND_SERVICE
)| /* needed to bind on port 53 */
65 (UINT64_C(1) << CAP_SETPCAP
) /* needed in order to drop the caps later */);
67 return log_error_errno(r
, "Failed to drop privileges: %m");
70 assert_se(sigprocmask_many(SIG_BLOCK
, NULL
, SIGTERM
, SIGINT
, SIGUSR1
, SIGUSR2
, SIGRTMIN
+1, SIGRTMIN
+18, -1) >= 0);
74 return log_error_errno(r
, "Could not create manager: %m");
78 return log_error_errno(r
, "Failed to start manager: %m");
80 /* Write finish default resolv.conf to avoid a dangling symlink */
81 (void) manager_write_resolv_conf(m
);
83 (void) manager_check_resolv_conf(m
);
85 /* Let's drop the remaining caps now */
86 r
= capability_bounding_set_drop((UINT64_C(1) << CAP_NET_RAW
), true);
88 return log_error_errno(r
, "Failed to drop remaining caps: %m");
90 notify_stop
= notify_start(NOTIFY_READY
, NOTIFY_STOPPING
);
92 r
= sd_event_loop(m
->event
);
94 return log_error_errno(r
, "Event loop failed: %m");
99 DEFINE_MAIN_FUNCTION(run
);