]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/home/homectl.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
test: extend homed test to test home dir "maximization"
[thirdparty/systemd.git] / src / home / homectl.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
4aa0a8ac
LP		 2
3#include <getopt.h>
4
5#include "sd-bus.h"
6
4aa0a8ac
LP		 7#include "ask-password-api.h"
8#include "bus-common-errors.h"
9#include "bus-error.h"
9b71e4ab 10#include "bus-locator.h"
4aa0a8ac
LP		 11#include "cgroup-util.h"
12#include "dns-domain.h"
13#include "env-util.h"
14#include "fd-util.h"
15#include "fileio.h"
16#include "format-table.h"
16b81da6 17#include "fs-util.h"
d8e32c47 18#include "glyph-util.h"
4aa0a8ac 19#include "home-util.h"
1c0c4a43 20#include "homectl-fido2.h"
93295a25 21#include "homectl-pkcs11.h"
80c41552 22#include "homectl-recovery-key.h"
fb2d839c 23#include "libfido2-util.h"
4aa0a8ac
LP		 24#include "locale-util.h"
25#include "main-func.h"
26#include "memory-util.h"
4aa0a8ac 27#include "pager.h"
614b022c 28#include "parse-argument.h"
4aa0a8ac
LP		 29#include "parse-util.h"
30#include "path-util.h"
ed5033fd 31#include "percent-util.h"
4aa0a8ac
LP		 32#include "pkcs11-util.h"
33#include "pretty-print.h"
34#include "process-util.h"
35#include "pwquality-util.h"
4aa0a8ac
LP		 36#include "rlimit-util.h"
37#include "spawn-polkit-agent.h"
38#include "terminal-util.h"
b085d224 39#include "uid-alloc-range.h"
679badd7 40#include "user-record-pwquality.h"
4aa0a8ac
LP		 41#include "user-record-show.h"
42#include "user-record-util.h"
43#include "user-record.h"
44#include "user-util.h"
45#include "verbs.h"
46
47static PagerFlags arg_pager_flags = 0;
48static bool arg_legend = true;
49static bool arg_ask_password = true;
50static BusTransport arg_transport = BUS_TRANSPORT_LOCAL;
51static const char *arg_host = NULL;
52static const char *arg_identity = NULL;
53static JsonVariant *arg_identity_extra = NULL;
54static JsonVariant *arg_identity_extra_privileged = NULL;
55static JsonVariant *arg_identity_extra_this_machine = NULL;
56static JsonVariant *arg_identity_extra_rlimits = NULL;
57static char **arg_identity_filter = NULL; /* this one is also applied to 'privileged' and 'thisMachine' subobjects */
58static char **arg_identity_filter_rlimits = NULL;
59static uint64_t arg_disk_size = UINT64_MAX;
60static uint64_t arg_disk_size_relative = UINT64_MAX;
61static char **arg_pkcs11_token_uri = NULL;
1c0c4a43 62static char **arg_fido2_device = NULL;
17e7561a 63static Fido2EnrollFlags arg_fido2_lock_with = FIDO2ENROLL_PIN | FIDO2ENROLL_UP;
80c41552 64static bool arg_recovery_key = false;
6a01ea4a 65static JsonFormatFlags arg_json_format_flags = JSON_FORMAT_OFF;
4aa0a8ac
LP		 66static bool arg_and_resize = false;
67static bool arg_and_change_password = false;
68static enum {
69 EXPORT_FORMAT_FULL, /* export the full record */
70 EXPORT_FORMAT_STRIPPED, /* strip "state" + "binding", but leave signature in place */
71 EXPORT_FORMAT_MINIMAL, /* also strip signature */
72} arg_export_format = EXPORT_FORMAT_FULL;
73
74STATIC_DESTRUCTOR_REGISTER(arg_identity_extra, json_variant_unrefp);
75STATIC_DESTRUCTOR_REGISTER(arg_identity_extra_this_machine, json_variant_unrefp);
76STATIC_DESTRUCTOR_REGISTER(arg_identity_extra_privileged, json_variant_unrefp);
77STATIC_DESTRUCTOR_REGISTER(arg_identity_extra_rlimits, json_variant_unrefp);
78STATIC_DESTRUCTOR_REGISTER(arg_identity_filter, strv_freep);
79STATIC_DESTRUCTOR_REGISTER(arg_identity_filter_rlimits, strv_freep);
80STATIC_DESTRUCTOR_REGISTER(arg_pkcs11_token_uri, strv_freep);
1c0c4a43 81STATIC_DESTRUCTOR_REGISTER(arg_fido2_device, strv_freep);
4aa0a8ac 82
cc9886bc
LP		 83static const BusLocator *bus_mgr;
84
4aa0a8ac
LP		 85static bool identity_properties_specified(void) {
86 return
87 arg_identity ||
88 !json_variant_is_blank_object(arg_identity_extra) ||
89 !json_variant_is_blank_object(arg_identity_extra_privileged) ||
90 !json_variant_is_blank_object(arg_identity_extra_this_machine) ||
91 !json_variant_is_blank_object(arg_identity_extra_rlimits) ||
92 !strv_isempty(arg_identity_filter) ||
93 !strv_isempty(arg_identity_filter_rlimits) ||
1c0c4a43
LP		 94 !strv_isempty(arg_pkcs11_token_uri) ||
95 !strv_isempty(arg_fido2_device);
4aa0a8ac
LP		 96}
97
98static int acquire_bus(sd_bus **bus) {
99 int r;
100
101 assert(bus);
102
103 if (*bus)
104 return 0;
105
106 r = bus_connect_transport(arg_transport, arg_host, false, bus);
107 if (r < 0)
10a7340a 108 return bus_log_connect_error(r, arg_transport);
4aa0a8ac
LP		 109
110 (void) sd_bus_set_allow_interactive_authorization(*bus, arg_ask_password);
111
112 return 0;
113}
114
115static int list_homes(int argc, char *argv[], void *userdata) {
116 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
117 _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
118 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
119 _cleanup_(table_unrefp) Table *table = NULL;
120 int r;
121
4aa0a8ac
LP		 122 r = acquire_bus(&bus);
123 if (r < 0)
124 return r;
125
cc9886bc 126 r = bus_call_method(bus, bus_mgr, "ListHomes", &error, &reply, NULL);
4aa0a8ac
LP		 127 if (r < 0)
128 return log_error_errno(r, "Failed to list homes: %s", bus_error_message(&error, r));
129
130 table = table_new("name", "uid", "gid", "state", "realname", "home", "shell");
131 if (!table)
132 return log_oom();
133
134 r = sd_bus_message_enter_container(reply, 'a', "(susussso)");
135 if (r < 0)
136 return bus_log_parse_error(r);
137
138 for (;;) {
139 const char *name, *state, *realname, *home, *shell, *color;
140 TableCell *cell;
141 uint32_t uid, gid;
142
143 r = sd_bus_message_read(reply, "(susussso)", &name, &uid, &state, &gid, &realname, &home, &shell, NULL);
144 if (r < 0)
145 return bus_log_parse_error(r);
146 if (r == 0)
147 break;
148
149 r = table_add_many(table,
150 TABLE_STRING, name,
151 TABLE_UID, uid,
152 TABLE_GID, gid);
153 if (r < 0)
f987a261 154 return table_log_add_error(r);
4aa0a8ac
LP		 155
156
157 r = table_add_cell(table, &cell, TABLE_STRING, state);
158 if (r < 0)
f987a261 159 return table_log_add_error(r);
4aa0a8ac
LP		 160
161 color = user_record_state_color(state);
162 if (color)
163 (void) table_set_color(table, cell, color);
164
165 r = table_add_many(table,
166 TABLE_STRING, strna(empty_to_null(realname)),
167 TABLE_STRING, home,
168 TABLE_STRING, strna(empty_to_null(shell)));
169 if (r < 0)
f987a261 170 return table_log_add_error(r);
4aa0a8ac
LP		 171 }
172
173 r = sd_bus_message_exit_container(reply);
174 if (r < 0)
175 return bus_log_parse_error(r);
176
6a01ea4a 177 if (table_get_rows(table) > 1 || !FLAGS_SET(arg_json_format_flags, JSON_FORMAT_OFF)) {
ef1e0b9a 178 r = table_set_sort(table, (size_t) 0);
4aa0a8ac 179 if (r < 0)
df83eb54 180 return table_log_sort_error(r);
4aa0a8ac 181
665ffc7f 182 r = table_print_with_pager(table, arg_json_format_flags, arg_pager_flags, arg_legend);
4aa0a8ac 183 if (r < 0)
665ffc7f 184 return r;
4aa0a8ac
LP		 185 }
186
6a01ea4a 187 if (arg_legend && (arg_json_format_flags & JSON_FORMAT_OFF)) {
4aa0a8ac 188 if (table_get_rows(table) > 1)
c11428ad 189 printf("\n%zu home areas listed.\n", table_get_rows(table) - 1);
4aa0a8ac 190 else
c11428ad 191 printf("No home areas.\n");
4aa0a8ac
LP		 192 }
193
194 return 0;
195}
196
ea086f06
LP		 197static int acquire_existing_password(
198 const char *user_name,
199 UserRecord *hr,
200 bool emphasize_current,
201 AskPasswordFlags flags) {
202
4aa0a8ac
LP		 203 _cleanup_(strv_free_erasep) char **password = NULL;
204 _cleanup_free_ char *question = NULL;
205 char *e;
206 int r;
207
208 assert(user_name);
209 assert(hr);
210
211 e = getenv("PASSWORD");
212 if (e) {
213 /* People really shouldn't use environment variables for passing passwords. We support this
214 * only for testing purposes, and do not document the behaviour, so that people won't
215 * actually use this outside of testing. */
216
217 r = user_record_set_password(hr, STRV_MAKE(e), true);
218 if (r < 0)
219 return log_error_errno(r, "Failed to store password: %m");
220
7a6abbe9 221 assert_se(unsetenv_erase("PASSWORD") >= 0);
ea086f06 222 return 1;
4aa0a8ac
LP		 223 }
224
7bdbafc2
LP		 225 /* If this is not our own user, then don't use the password cache */
226 if (is_this_me(user_name) <= 0)
227 SET_FLAG(flags, ASK_PASSWORD_ACCEPT_CACHED|ASK_PASSWORD_PUSH_CACHE, false);
228
4aa0a8ac
LP		 229 if (asprintf(&question, emphasize_current ?
230 "Please enter current password for user %s:" :
231 "Please enter password for user %s:",
232 user_name) < 0)
233 return log_oom();
234
ea086f06
LP		 235 r = ask_password_auto(question,
236 /* icon= */ "user-home",
237 NULL,
238 /* key_name= */ "home-password",
239 /* credential_name= */ "home.password",
240 USEC_INFINITY,
241 flags,
242 &password);
57bb9bcb
LP		 243 if (r == -EUNATCH) { /* EUNATCH is returned if no password was found and asking interactively was
244 * disabled via the flags. Not an error for us. */
245 log_debug_errno(r, "No passwords acquired.");
246 return 0;
247 }
4aa0a8ac
LP		 248 if (r < 0)
249 return log_error_errno(r, "Failed to acquire password: %m");
250
251 r = user_record_set_password(hr, password, true);
252 if (r < 0)
253 return log_error_errno(r, "Failed to store password: %m");
254
ea086f06 255 return 1;
4aa0a8ac
LP		 256}
257
c7b6051f
LP		 258static int acquire_recovery_key(
259 const char *user_name,
260 UserRecord *hr,
261 AskPasswordFlags flags) {
262
263 _cleanup_(strv_free_erasep) char **recovery_key = NULL;
264 _cleanup_free_ char *question = NULL;
265 char *e;
266 int r;
267
268 assert(user_name);
269 assert(hr);
270
271 e = getenv("RECOVERY_KEY");
272 if (e) {
273 /* People really shouldn't use environment variables for passing secrets. We support this
274 * only for testing purposes, and do not document the behaviour, so that people won't
275 * actually use this outside of testing. */
276
277 r = user_record_set_password(hr, STRV_MAKE(e), true); /* recovery keys are stored in the record exactly like regular passwords! */
278 if (r < 0)
279 return log_error_errno(r, "Failed to store recovery key: %m");
280
281 assert_se(unsetenv_erase("RECOVERY_KEY") >= 0);
282 return 1;
283 }
284
285 /* If this is not our own user, then don't use the password cache */
286 if (is_this_me(user_name) <= 0)
287 SET_FLAG(flags, ASK_PASSWORD_ACCEPT_CACHED|ASK_PASSWORD_PUSH_CACHE, false);
288
289 if (asprintf(&question, "Please enter recovery key for user %s:", user_name) < 0)
290 return log_oom();
291
292 r = ask_password_auto(question,
293 /* icon= */ "user-home",
294 NULL,
295 /* key_name= */ "home-recovery-key",
296 /* credential_name= */ "home.recovery-key",
297 USEC_INFINITY,
298 flags,
299 &recovery_key);
300 if (r == -EUNATCH) { /* EUNATCH is returned if no recovery key was found and asking interactively was
301 * disabled via the flags. Not an error for us. */
302 log_debug_errno(r, "No recovery keys acquired.");
303 return 0;
304 }
305 if (r < 0)
306 return log_error_errno(r, "Failed to acquire recovery keys: %m");
307
308 r = user_record_set_password(hr, recovery_key, true);
309 if (r < 0)
310 return log_error_errno(r, "Failed to store recovery keys: %m");
311
312 return 1;
313}
314
ea086f06
LP		 315static int acquire_token_pin(
316 const char *user_name,
317 UserRecord *hr,
318 AskPasswordFlags flags) {
319
4aa0a8ac
LP		 320 _cleanup_(strv_free_erasep) char **pin = NULL;
321 _cleanup_free_ char *question = NULL;
322 char *e;
323 int r;
324
325 assert(user_name);
326 assert(hr);
327
328 e = getenv("PIN");
329 if (e) {
c0bde0d2 330 r = user_record_set_token_pin(hr, STRV_MAKE(e), false);
4aa0a8ac 331 if (r < 0)
c0bde0d2 332 return log_error_errno(r, "Failed to store token PIN: %m");
4aa0a8ac 333
7a6abbe9 334 assert_se(unsetenv_erase("PIN") >= 0);
ea086f06 335 return 1;
4aa0a8ac
LP		 336 }
337
7bdbafc2
LP		 338 /* If this is not our own user, then don't use the password cache */
339 if (is_this_me(user_name) <= 0)
340 SET_FLAG(flags, ASK_PASSWORD_ACCEPT_CACHED|ASK_PASSWORD_PUSH_CACHE, false);
341
4aa0a8ac
LP		 342 if (asprintf(&question, "Please enter security token PIN for user %s:", user_name) < 0)
343 return log_oom();
344
ea086f06
LP		 345 r = ask_password_auto(
346 question,
347 /* icon= */ "user-home",
348 NULL,
349 /* key_name= */ "token-pin",
350 /* credential_name= */ "home.token-pin",
351 USEC_INFINITY,
352 flags,
353 &pin);
57bb9bcb
LP		 354 if (r == -EUNATCH) { /* EUNATCH is returned if no PIN was found and asking interactively was disabled
355 * via the flags. Not an error for us. */
356 log_debug_errno(r, "No security token PINs acquired.");
357 return 0;
358 }
4aa0a8ac
LP		 359 if (r < 0)
360 return log_error_errno(r, "Failed to acquire security token PIN: %m");
361
c0bde0d2 362 r = user_record_set_token_pin(hr, pin, false);
4aa0a8ac
LP		 363 if (r < 0)
364 return log_error_errno(r, "Failed to store security token PIN: %m");
365
ea086f06 366 return 1;
4aa0a8ac
LP		 367}
368
369static int handle_generic_user_record_error(
370 const char *user_name,
371 UserRecord *hr,
372 const sd_bus_error *error,
373 int ret,
374 bool emphasize_current_password) {
375 int r;
376
377 assert(user_name);
378 assert(hr);
379
380 if (sd_bus_error_has_name(error, BUS_ERROR_HOME_ABSENT))
381 return log_error_errno(SYNTHETIC_ERRNO(EREMOTE),
36e4a8f2 382 "Home of user %s is currently absent, please plug in the necessary storage device or backing file system.", user_name);
4aa0a8ac
LP		 383
384 else if (sd_bus_error_has_name(error, BUS_ERROR_AUTHENTICATION_LIMIT_HIT))
385 return log_error_errno(SYNTHETIC_ERRNO(ETOOMANYREFS),
386 "Too frequent unsuccessful login attempts for user %s, try again later.", user_name);
387
388 else if (sd_bus_error_has_name(error, BUS_ERROR_BAD_PASSWORD)) {
389
390 if (!strv_isempty(hr->password))
391 log_notice("Password incorrect or not sufficient, please try again.");
392
ea086f06
LP		 393 /* Don't consume cache entries or credentials here, we already tried that unsuccessfully. But
394 * let's push what we acquire here into the cache */
395 r = acquire_existing_password(
396 user_name,
397 hr,
398 emphasize_current_password,
399 ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);
4aa0a8ac
LP		 400 if (r < 0)
401 return r;
402
c7b6051f
LP		 403 } else if (sd_bus_error_has_name(error, BUS_ERROR_BAD_RECOVERY_KEY)) {
404
405 if (!strv_isempty(hr->password))
406 log_notice("Recovery key incorrect or not sufficient, please try again.");
407
408 /* Don't consume cache entries or credentials here, we already tried that unsuccessfully. But
409 * let's push what we acquire here into the cache */
410 r = acquire_recovery_key(
411 user_name,
412 hr,
413 ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);
414 if (r < 0)
415 return r;
416
4aa0a8ac
LP		 417 } else if (sd_bus_error_has_name(error, BUS_ERROR_BAD_PASSWORD_AND_NO_TOKEN)) {
418
419 if (strv_isempty(hr->password))
420 log_notice("Security token not inserted, please enter password.");
421 else
422 log_notice("Password incorrect or not sufficient, and configured security token not inserted, please try again.");
423
ea086f06
LP		 424 r = acquire_existing_password(
425 user_name,
426 hr,
427 emphasize_current_password,
428 ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);
4aa0a8ac
LP		 429 if (r < 0)
430 return r;
431
432 } else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_PIN_NEEDED)) {
433
ea086f06
LP		 434 /* First time the PIN is requested, let's accept cached data, and allow using credential store */
435 r = acquire_token_pin(
436 user_name,
437 hr,
438 ASK_PASSWORD_ACCEPT_CACHED | ASK_PASSWORD_PUSH_CACHE);
4aa0a8ac
LP		 439 if (r < 0)
440 return r;
441
442 } else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_PROTECTED_AUTHENTICATION_PATH_NEEDED)) {
443
f737186a
LP		 444 log_notice("%s%sPlease authenticate physically on security token.",
445 emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "",
446 emoji_enabled() ? " " : "");
4aa0a8ac
LP		 447
448 r = user_record_set_pkcs11_protected_authentication_path_permitted(hr, true);
449 if (r < 0)
450 return log_error_errno(r, "Failed to set PKCS#11 protected authentication path permitted flag: %m");
451
7b78db28
LP		 452 } else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_USER_PRESENCE_NEEDED)) {
453
17e7561a 454 log_notice("%s%sPlease confirm presence on security token.",
7b78db28
LP		 455 emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "",
456 emoji_enabled() ? " " : "");
457
458 r = user_record_set_fido2_user_presence_permitted(hr, true);
459 if (r < 0)
460 return log_error_errno(r, "Failed to set FIDO2 user presence permitted flag: %m");
461
17e7561a
LP		 462 } else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_USER_VERIFICATION_NEEDED)) {
463
464 log_notice("%s%sPlease verify user on security token.",
465 emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "",
466 emoji_enabled() ? " " : "");
467
468 r = user_record_set_fido2_user_verification_permitted(hr, true);
469 if (r < 0)
470 return log_error_errno(r, "Failed to set FIDO2 user verification permitted flag: %m");
471
4aa0a8ac 472 } else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_PIN_LOCKED))
7b78db28 473 return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Security token PIN is locked, please unlock it first. (Hint: Removal and re-insertion might suffice.)");
4aa0a8ac
LP		 474
475 else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_BAD_PIN)) {
476
477 log_notice("Security token PIN incorrect, please try again.");
478
ea086f06
LP		 479 /* If the previous PIN was wrong don't accept cached info anymore, but add to cache. Also, don't use the credential data */
480 r = acquire_token_pin(
481 user_name,
482 hr,
483 ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);
4aa0a8ac
LP		 484 if (r < 0)
485 return r;
486
487 } else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_BAD_PIN_FEW_TRIES_LEFT)) {
488
489 log_notice("Security token PIN incorrect, please try again (only a few tries left!).");
490
ea086f06
LP		 491 r = acquire_token_pin(
492 user_name,
493 hr,
494 ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);
4aa0a8ac
LP		 495 if (r < 0)
496 return r;
497
498 } else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_BAD_PIN_ONE_TRY_LEFT)) {
499
500 log_notice("Security token PIN incorrect, please try again (only one try left!).");
501
ea086f06
LP		 502 r = acquire_token_pin(
503 user_name,
504 hr,
505 ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);
4aa0a8ac
LP		 506 if (r < 0)
507 return r;
508 } else
509 return log_error_errno(ret, "Operation on home %s failed: %s", user_name, bus_error_message(error, ret));
510
511 return 0;
512}
513
57bb9bcb
LP		 514static int acquire_passed_secrets(const char *user_name, UserRecord **ret) {
515 _cleanup_(user_record_unrefp) UserRecord *secret = NULL;
516 int r;
517
518 assert(ret);
519
520 /* Generates an initial secret objects that contains passwords supplied via $PASSWORD, the password
521 * cache or the credentials subsystem, but excluding any interactive stuff. If nothing is passed,
522 * returns an empty secret object. */
523
524 secret = user_record_new();
525 if (!secret)
526 return log_oom();
527
528 r = acquire_existing_password(
529 user_name,
530 secret,
531 /* emphasize_current_password = */ false,
532 ASK_PASSWORD_ACCEPT_CACHED | ASK_PASSWORD_NO_TTY | ASK_PASSWORD_NO_AGENT);
533 if (r < 0)
534 return r;
535
536 r = acquire_token_pin(
537 user_name,
538 secret,
539 ASK_PASSWORD_ACCEPT_CACHED | ASK_PASSWORD_NO_TTY | ASK_PASSWORD_NO_AGENT);
540 if (r < 0)
541 return r;
542
c7b6051f
LP		 543 r = acquire_recovery_key(
544 user_name,
545 secret,
546 ASK_PASSWORD_ACCEPT_CACHED | ASK_PASSWORD_NO_TTY | ASK_PASSWORD_NO_AGENT);
547 if (r < 0)
548 return r;
549
57bb9bcb
LP		 550 *ret = TAKE_PTR(secret);
551 return 0;
552}
553
4aa0a8ac
LP		 554static int activate_home(int argc, char *argv[], void *userdata) {
555 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
556 int r, ret = 0;
557 char **i;
558
559 r = acquire_bus(&bus);
560 if (r < 0)
561 return r;
562
563 STRV_FOREACH(i, strv_skip(argv, 1)) {
564 _cleanup_(user_record_unrefp) UserRecord *secret = NULL;
565
57bb9bcb
LP		 566 r = acquire_passed_secrets(*i, &secret);
567 if (r < 0)
568 return r;
4aa0a8ac
LP		 569
570 for (;;) {
571 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
572 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
573
cc9886bc 574 r = bus_message_new_method_call(bus, &m, bus_mgr, "ActivateHome");
4aa0a8ac
LP		 575 if (r < 0)
576 return bus_log_create_error(r);
577
578 r = sd_bus_message_append(m, "s", *i);
579 if (r < 0)
580 return bus_log_create_error(r);
581
582 r = bus_message_append_secret(m, secret);
583 if (r < 0)
584 return bus_log_create_error(r);
585
586 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
587 if (r < 0) {
ea086f06 588 r = handle_generic_user_record_error(*i, secret, &error, r, /* emphasize_current_password= */ false);
4aa0a8ac
LP		 589 if (r < 0) {
590 if (ret == 0)
591 ret = r;
592
593 break;
594 }
595 } else
596 break;
597 }
598 }
599
600 return ret;
601}
602
603static int deactivate_home(int argc, char *argv[], void *userdata) {
604 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
605 int r, ret = 0;
606 char **i;
607
608 r = acquire_bus(&bus);
609 if (r < 0)
610 return r;
611
612 STRV_FOREACH(i, strv_skip(argv, 1)) {
613 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
614 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
615
cc9886bc 616 r = bus_message_new_method_call(bus, &m, bus_mgr, "DeactivateHome");
4aa0a8ac
LP		 617 if (r < 0)
618 return bus_log_create_error(r);
619
620 r = sd_bus_message_append(m, "s", *i);
621 if (r < 0)
622 return bus_log_create_error(r);
623
624 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
625 if (r < 0) {
626 log_error_errno(r, "Failed to deactivate user home: %s", bus_error_message(&error, r));
627 if (ret == 0)
628 ret = r;
629 }
630 }
631
632 return ret;
633}
634
635static void dump_home_record(UserRecord *hr) {
636 int r;
637
638 assert(hr);
639
640 if (hr->incomplete) {
641 fflush(stdout);
642 log_warning("Warning: lacking rights to acquire privileged fields of user record of '%s', output incomplete.", hr->user_name);
643 }
644
6a01ea4a
LP		 645 if (arg_json_format_flags & JSON_FORMAT_OFF)
646 user_record_show(hr, true);
647 else {
4aa0a8ac
LP		 648 _cleanup_(user_record_unrefp) UserRecord *stripped = NULL;
649
650 if (arg_export_format == EXPORT_FORMAT_STRIPPED)
bfc0cc1a 651 r = user_record_clone(hr, USER_RECORD_EXTRACT_EMBEDDED|USER_RECORD_PERMISSIVE, &stripped);
4aa0a8ac 652 else if (arg_export_format == EXPORT_FORMAT_MINIMAL)
bfc0cc1a 653 r = user_record_clone(hr, USER_RECORD_EXTRACT_SIGNABLE|USER_RECORD_PERMISSIVE, &stripped);
4aa0a8ac
LP		 654 else
655 r = 0;
656 if (r < 0)
657 log_warning_errno(r, "Failed to strip user record, ignoring: %m");
658 if (stripped)
659 hr = stripped;
660
661 json_variant_dump(hr->json, arg_json_format_flags, stdout, NULL);
6a01ea4a 662 }
4aa0a8ac
LP		 663}
664
665static char **mangle_user_list(char **list, char ***ret_allocated) {
666 _cleanup_free_ char *myself = NULL;
667 char **l;
668
669 if (!strv_isempty(list)) {
670 *ret_allocated = NULL;
671 return list;
672 }
673
674 myself = getusername_malloc();
675 if (!myself)
676 return NULL;
677
678 l = new(char*, 2);
679 if (!l)
680 return NULL;
681
682 l[0] = TAKE_PTR(myself);
683 l[1] = NULL;
684
685 *ret_allocated = l;
686 return l;
687}
688
689static int inspect_home(int argc, char *argv[], void *userdata) {
690 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
691 _cleanup_(strv_freep) char **mangled_list = NULL;
692 int r, ret = 0;
693 char **items, **i;
694
384c2c32 695 pager_open(arg_pager_flags);
4aa0a8ac
LP		 696
697 r = acquire_bus(&bus);
698 if (r < 0)
699 return r;
700
701 items = mangle_user_list(strv_skip(argv, 1), &mangled_list);
702 if (!items)
703 return log_oom();
704
705 STRV_FOREACH(i, items) {
706 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
707 _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
708 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
709 _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
710 const char *json;
711 int incomplete;
712 uid_t uid;
713
714 r = parse_uid(*i, &uid);
715 if (r < 0) {
7a8867ab 716 if (!valid_user_group_name(*i, 0)) {
4aa0a8ac
LP		 717 log_error("Invalid user name '%s'.", *i);
718 if (ret == 0)
719 ret = -EINVAL;
720
721 continue;
722 }
723
cc9886bc 724 r = bus_call_method(bus, bus_mgr, "GetUserRecordByName", &error, &reply, "s", *i);
38cd55b0 725 } else
cc9886bc 726 r = bus_call_method(bus, bus_mgr, "GetUserRecordByUID", &error, &reply, "u", (uint32_t) uid);
4aa0a8ac
LP		 727
728 if (r < 0) {
729 log_error_errno(r, "Failed to inspect home: %s", bus_error_message(&error, r));
730 if (ret == 0)
731 ret = r;
732
733 continue;
734 }
735
736 r = sd_bus_message_read(reply, "sbo", &json, &incomplete, NULL);
737 if (r < 0) {
738 bus_log_parse_error(r);
739 if (ret == 0)
740 ret = r;
741
742 continue;
743 }
744
745 r = json_parse(json, JSON_PARSE_SENSITIVE, &v, NULL, NULL);
746 if (r < 0) {
747 log_error_errno(r, "Failed to parse JSON identity: %m");
748 if (ret == 0)
749 ret = r;
750
751 continue;
752 }
753
754 hr = user_record_new();
755 if (!hr)
756 return log_oom();
757
bfc0cc1a 758 r = user_record_load(hr, v, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_LOG|USER_RECORD_PERMISSIVE);
4aa0a8ac
LP		 759 if (r < 0) {
760 if (ret == 0)
761 ret = r;
762
763 continue;
764 }
765
766 hr->incomplete = incomplete;
767 dump_home_record(hr);
768 }
769
770 return ret;
771}
772
773static int authenticate_home(int argc, char *argv[], void *userdata) {
774 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
775 _cleanup_(strv_freep) char **mangled_list = NULL;
776 int r, ret = 0;
777 char **i, **items;
778
779 items = mangle_user_list(strv_skip(argv, 1), &mangled_list);
780 if (!items)
781 return log_oom();
782
783 r = acquire_bus(&bus);
784 if (r < 0)
785 return r;
786
787 (void) polkit_agent_open_if_enabled(arg_transport, arg_ask_password);
788
789 STRV_FOREACH(i, items) {
790 _cleanup_(user_record_unrefp) UserRecord *secret = NULL;
791
57bb9bcb
LP		 792 r = acquire_passed_secrets(*i, &secret);
793 if (r < 0)
794 return r;
4aa0a8ac
LP		 795
796 for (;;) {
797 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
798 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
799
cc9886bc 800 r = bus_message_new_method_call(bus, &m, bus_mgr, "AuthenticateHome");
4aa0a8ac
LP		 801 if (r < 0)
802 return bus_log_create_error(r);
803
804 r = sd_bus_message_append(m, "s", *i);
805 if (r < 0)
806 return bus_log_create_error(r);
807
808 r = bus_message_append_secret(m, secret);
809 if (r < 0)
810 return bus_log_create_error(r);
811
812 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
813 if (r < 0) {
814 r = handle_generic_user_record_error(*i, secret, &error, r, false);
815 if (r < 0) {
816 if (ret == 0)
817 ret = r;
818
819 break;
820 }
821 } else
822 break;
823 }
824 }
825
826 return ret;
827}
828
829static int update_last_change(JsonVariant **v, bool with_password, bool override) {
830 JsonVariant *c;
831 usec_t n;
832 int r;
833
834 assert(v);
835
836 n = now(CLOCK_REALTIME);
837
838 c = json_variant_by_key(*v, "lastChangeUSec");
839 if (c) {
718ca772 840 uint64_t u;
4aa0a8ac
LP		 841
842 if (!override)
843 goto update_password;
844
845 if (!json_variant_is_unsigned(c))
846 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "lastChangeUSec field is not an unsigned integer, refusing.");
847
848 u = json_variant_unsigned(c);
849 if (u >= n)
850 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "lastChangeUSec is from the future, can't update.");
851 }
852
853 r = json_variant_set_field_unsigned(v, "lastChangeUSec", n);
854 if (r < 0)
855 return log_error_errno(r, "Failed to update lastChangeUSec: %m");
856
857update_password:
858 if (!with_password)
859 return 0;
860
861 c = json_variant_by_key(*v, "lastPasswordChangeUSec");
862 if (c) {
718ca772 863 uint64_t u;
4aa0a8ac
LP		 864
865 if (!override)
866 return 0;
867
868 if (!json_variant_is_unsigned(c))
869 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "lastPasswordChangeUSec field is not an unsigned integer, refusing.");
870
871 u = json_variant_unsigned(c);
872 if (u >= n)
873 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "lastPasswordChangeUSec is from the future, can't update.");
874 }
875
876 r = json_variant_set_field_unsigned(v, "lastPasswordChangeUSec", n);
877 if (r < 0)
878 return log_error_errno(r, "Failed to update lastPasswordChangeUSec: %m");
879
880 return 1;
881}
882
883static int apply_identity_changes(JsonVariant **_v) {
884 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
885 int r;
886
887 assert(_v);
888
889 v = json_variant_ref(*_v);
890
891 r = json_variant_filter(&v, arg_identity_filter);
892 if (r < 0)
893 return log_error_errno(r, "Failed to filter identity: %m");
894
895 r = json_variant_merge(&v, arg_identity_extra);
896 if (r < 0)
897 return log_error_errno(r, "Failed to merge identities: %m");
898
899 if (arg_identity_extra_this_machine || !strv_isempty(arg_identity_filter)) {
900 _cleanup_(json_variant_unrefp) JsonVariant *per_machine = NULL, *mmid = NULL;
4aa0a8ac
LP		 901 sd_id128_t mid;
902
903 r = sd_id128_get_machine(&mid);
904 if (r < 0)
905 return log_error_errno(r, "Failed to acquire machine ID: %m");
906
85b55869 907 r = json_variant_new_string(&mmid, SD_ID128_TO_STRING(mid));
4aa0a8ac
LP		 908 if (r < 0)
909 return log_error_errno(r, "Failed to allocate matchMachineId object: %m");
910
911 per_machine = json_variant_ref(json_variant_by_key(v, "perMachine"));
912 if (per_machine) {
913 _cleanup_(json_variant_unrefp) JsonVariant *npm = NULL, *add = NULL;
914 _cleanup_free_ JsonVariant **array = NULL;
915 JsonVariant *z;
916 size_t i = 0;
917
918 if (!json_variant_is_array(per_machine))
919 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "perMachine field is not an array, refusing.");
920
921 array = new(JsonVariant*, json_variant_elements(per_machine) + 1);
922 if (!array)
923 return log_oom();
924
925 JSON_VARIANT_ARRAY_FOREACH(z, per_machine) {
926 JsonVariant *u;
927
928 if (!json_variant_is_object(z))
929 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "perMachine entry is not an object, refusing.");
930
931 array[i++] = z;
932
933 u = json_variant_by_key(z, "matchMachineId");
934 if (!u)
935 continue;
936
937 if (!json_variant_equal(u, mmid))
938 continue;
939
940 r = json_variant_merge(&add, z);
941 if (r < 0)
942 return log_error_errno(r, "Failed to merge perMachine entry: %m");
943
944 i--;
945 }
946
947 r = json_variant_filter(&add, arg_identity_filter);
948 if (r < 0)
949 return log_error_errno(r, "Failed to filter perMachine: %m");
950
951 r = json_variant_merge(&add, arg_identity_extra_this_machine);
952 if (r < 0)
953 return log_error_errno(r, "Failed to merge in perMachine fields: %m");
954
955 if (arg_identity_filter_rlimits || arg_identity_extra_rlimits) {
956 _cleanup_(json_variant_unrefp) JsonVariant *rlv = NULL;
957
958 rlv = json_variant_ref(json_variant_by_key(add, "resourceLimits"));
959
960 r = json_variant_filter(&rlv, arg_identity_filter_rlimits);
961 if (r < 0)
962 return log_error_errno(r, "Failed to filter resource limits: %m");
963
964 r = json_variant_merge(&rlv, arg_identity_extra_rlimits);
965 if (r < 0)
966 return log_error_errno(r, "Failed to set resource limits: %m");
967
968 if (json_variant_is_blank_object(rlv)) {
969 r = json_variant_filter(&add, STRV_MAKE("resourceLimits"));
970 if (r < 0)
971 return log_error_errno(r, "Failed to drop resource limits field from identity: %m");
972 } else {
973 r = json_variant_set_field(&add, "resourceLimits", rlv);
974 if (r < 0)
975 return log_error_errno(r, "Failed to update resource limits of identity: %m");
976 }
977 }
978
979 if (!json_variant_is_blank_object(add)) {
980 r = json_variant_set_field(&add, "matchMachineId", mmid);
981 if (r < 0)
982 return log_error_errno(r, "Failed to set matchMachineId field: %m");
983
984 array[i++] = add;
985 }
986
987 r = json_variant_new_array(&npm, array, i);
988 if (r < 0)
989 return log_error_errno(r, "Failed to allocate new perMachine array: %m");
990
991 json_variant_unref(per_machine);
992 per_machine = TAKE_PTR(npm);
993 } else {
994 _cleanup_(json_variant_unrefp) JsonVariant *item = json_variant_ref(arg_identity_extra_this_machine);
995
996 if (arg_identity_extra_rlimits) {
997 r = json_variant_set_field(&item, "resourceLimits", arg_identity_extra_rlimits);
998 if (r < 0)
999 return log_error_errno(r, "Failed to update resource limits of identity: %m");
1000 }
1001
1002 r = json_variant_set_field(&item, "matchMachineId", mmid);
1003 if (r < 0)
1004 return log_error_errno(r, "Failed to set matchMachineId field: %m");
1005
1006 r = json_variant_append_array(&per_machine, item);
1007 if (r < 0)
1008 return log_error_errno(r, "Failed to append to perMachine array: %m");
1009 }
1010
1011 r = json_variant_set_field(&v, "perMachine", per_machine);
1012 if (r < 0)
1013 return log_error_errno(r, "Failed to update per machine record: %m");
1014 }
1015
1016 if (arg_identity_extra_privileged || arg_identity_filter) {
1017 _cleanup_(json_variant_unrefp) JsonVariant *privileged = NULL;
1018
1019 privileged = json_variant_ref(json_variant_by_key(v, "privileged"));
1020
1021 r = json_variant_filter(&privileged, arg_identity_filter);
1022 if (r < 0)
1023 return log_error_errno(r, "Failed to filter identity (privileged part): %m");
1024
1025 r = json_variant_merge(&privileged, arg_identity_extra_privileged);
1026 if (r < 0)
1027 return log_error_errno(r, "Failed to merge identities (privileged part): %m");
1028
1029 if (json_variant_is_blank_object(privileged)) {
1030 r = json_variant_filter(&v, STRV_MAKE("privileged"));
1031 if (r < 0)
1032 return log_error_errno(r, "Failed to drop privileged part from identity: %m");
1033 } else {
1034 r = json_variant_set_field(&v, "privileged", privileged);
1035 if (r < 0)
1036 return log_error_errno(r, "Failed to update privileged part of identity: %m");
1037 }
1038 }
1039
1040 if (arg_identity_filter_rlimits) {
1041 _cleanup_(json_variant_unrefp) JsonVariant *rlv = NULL;
1042
1043 rlv = json_variant_ref(json_variant_by_key(v, "resourceLimits"));
1044
1045 r = json_variant_filter(&rlv, arg_identity_filter_rlimits);
1046 if (r < 0)
1047 return log_error_errno(r, "Failed to filter resource limits: %m");
1048
1049 /* Note that we only filter resource limits here, but don't apply them. We do that in the perMachine section */
1050
1051 if (json_variant_is_blank_object(rlv)) {
1052 r = json_variant_filter(&v, STRV_MAKE("resourceLimits"));
1053 if (r < 0)
1054 return log_error_errno(r, "Failed to drop resource limits field from identity: %m");
1055 } else {
1056 r = json_variant_set_field(&v, "resourceLimits", rlv);
1057 if (r < 0)
1058 return log_error_errno(r, "Failed to update resource limits of identity: %m");
1059 }
1060 }
1061
1062 json_variant_unref(*_v);
1063 *_v = TAKE_PTR(v);
1064
1065 return 0;
1066}
1067
1068static int add_disposition(JsonVariant **v) {
1069 int r;
1070
1071 assert(v);
1072
1073 if (json_variant_by_key(*v, "disposition"))
1074 return 0;
1075
1076 /* Set the disposition to regular, if not configured explicitly */
1077 r = json_variant_set_field_string(v, "disposition", "regular");
1078 if (r < 0)
1079 return log_error_errno(r, "Failed to set disposition field: %m");
1080
1081 return 1;
1082}
1083
4aa0a8ac
LP		 1084static int acquire_new_home_record(UserRecord **ret) {
1085 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
1086 _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
1087 char **i;
1088 int r;
1089
1090 assert(ret);
1091
1092 if (arg_identity) {
1093 unsigned line, column;
1094
1095 r = json_parse_file(
1096 streq(arg_identity, "-") ? stdin : NULL,
1097 streq(arg_identity, "-") ? "<stdin>" : arg_identity, JSON_PARSE_SENSITIVE, &v, &line, &column);
1098 if (r < 0)
1099 return log_error_errno(r, "Failed to parse identity at %u:%u: %m", line, column);
1100 }
1101
1102 r = apply_identity_changes(&v);
1103 if (r < 0)
1104 return r;
1105
1106 r = add_disposition(&v);
1107 if (r < 0)
1108 return r;
1109
1110 STRV_FOREACH(i, arg_pkcs11_token_uri) {
93295a25 1111 r = identity_add_pkcs11_key_data(&v, *i);
4aa0a8ac
LP		 1112 if (r < 0)
1113 return r;
1114 }
1115
1c0c4a43 1116 STRV_FOREACH(i, arg_fido2_device) {
17e7561a 1117 r = identity_add_fido2_parameters(&v, *i, arg_fido2_lock_with);
1c0c4a43
LP		 1118 if (r < 0)
1119 return r;
1120 }
1121
80c41552
LP		 1122 if (arg_recovery_key) {
1123 r = identity_add_recovery_key(&v);
1124 if (r < 0)
1125 return r;
1126 }
1127
4aa0a8ac
LP		 1128 r = update_last_change(&v, true, false);
1129 if (r < 0)
1130 return r;
1131
1132 if (DEBUG_LOGGING)
1133 json_variant_dump(v, JSON_FORMAT_PRETTY, NULL, NULL);
1134
1135 hr = user_record_new();
1136 if (!hr)
1137 return log_oom();
1138
bfc0cc1a 1139 r = user_record_load(hr, v, USER_RECORD_REQUIRE_REGULAR|USER_RECORD_ALLOW_SECRET|USER_RECORD_ALLOW_PRIVILEGED|USER_RECORD_ALLOW_PER_MACHINE|USER_RECORD_ALLOW_SIGNATURE|USER_RECORD_LOG|USER_RECORD_PERMISSIVE);
4aa0a8ac
LP		 1140 if (r < 0)
1141 return r;
1142
1143 *ret = TAKE_PTR(hr);
1144 return 0;
1145}
1146
1147static int acquire_new_password(
1148 const char *user_name,
1149 UserRecord *hr,
80c41552
LP		 1150 bool suggest,
1151 char **ret) {
4aa0a8ac
LP		 1152
1153 unsigned i = 5;
1154 char *e;
1155 int r;
1156
1157 assert(user_name);
1158 assert(hr);
1159
1160 e = getenv("NEWPASSWORD");
1161 if (e) {
80c41552
LP		 1162 _cleanup_(erase_and_freep) char *copy = NULL;
1163
4aa0a8ac
LP		 1164 /* As above, this is not for use, just for testing */
1165
80c41552
LP		 1166 if (ret) {
1167 copy = strdup(e);
1168 if (!copy)
1169 return log_oom();
1170 }
1171
1172 r = user_record_set_password(hr, STRV_MAKE(e), /* prepend = */ true);
4aa0a8ac
LP		 1173 if (r < 0)
1174 return log_error_errno(r, "Failed to store password: %m");
1175
7a6abbe9 1176 assert_se(unsetenv_erase("NEWPASSWORD") >= 0);
4aa0a8ac 1177
80c41552
LP		 1178 if (ret)
1179 *ret = TAKE_PTR(copy);
1180
4aa0a8ac
LP		 1181 return 0;
1182 }
1183
1184 if (suggest)
1185 (void) suggest_passwords();
1186
1187 for (;;) {
1188 _cleanup_(strv_free_erasep) char **first = NULL, **second = NULL;
1189 _cleanup_free_ char *question = NULL;
1190
1191 if (--i == 0)
1192 return log_error_errno(SYNTHETIC_ERRNO(ENOKEY), "Too many attempts, giving up:");
1193
1194 if (asprintf(&question, "Please enter new password for user %s:", user_name) < 0)
1195 return log_oom();
1196
ea086f06
LP		 1197 r = ask_password_auto(
1198 question,
1199 /* icon= */ "user-home",
1200 NULL,
1201 /* key_name= */ "home-password",
1202 /* credential_name= */ "home.new-password",
1203 USEC_INFINITY,
1204 0, /* no caching, we want to collect a new password here after all */
1205 &first);
4aa0a8ac
LP		 1206 if (r < 0)
1207 return log_error_errno(r, "Failed to acquire password: %m");
1208
1209 question = mfree(question);
1210 if (asprintf(&question, "Please enter new password for user %s (repeat):", user_name) < 0)
1211 return log_oom();
1212
ea086f06
LP		 1213 r = ask_password_auto(
1214 question,
1215 /* icon= */ "user-home",
1216 NULL,
1217 /* key_name= */ "home-password",
1218 /* credential_name= */ "home.new-password",
1219 USEC_INFINITY,
1220 0, /* no caching */
1221 &second);
4aa0a8ac
LP		 1222 if (r < 0)
1223 return log_error_errno(r, "Failed to acquire password: %m");
1224
1225 if (strv_equal(first, second)) {
80c41552
LP		 1226 _cleanup_(erase_and_freep) char *copy = NULL;
1227
1228 if (ret) {
1229 copy = strdup(first[0]);
1230 if (!copy)
1231 return log_oom();
1232 }
1233
1234 r = user_record_set_password(hr, first, /* prepend = */ true);
4aa0a8ac
LP		 1235 if (r < 0)
1236 return log_error_errno(r, "Failed to store password: %m");
1237
80c41552
LP		 1238 if (ret)
1239 *ret = TAKE_PTR(copy);
1240
4aa0a8ac
LP		 1241 return 0;
1242 }
1243
80ace4f2 1244 log_error("Password didn't match, try again.");
4aa0a8ac
LP		 1245 }
1246}
1247
1248static int create_home(int argc, char *argv[], void *userdata) {
1249 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
1250 _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
4aa0a8ac
LP		 1251 int r;
1252
1253 r = acquire_bus(&bus);
1254 if (r < 0)
1255 return r;
1256
1257 (void) polkit_agent_open_if_enabled(arg_transport, arg_ask_password);
1258
1259 if (argc >= 2) {
1260 /* If a username was specified, use it */
1261
7a8867ab 1262 if (valid_user_group_name(argv[1], 0))
4aa0a8ac
LP		 1263 r = json_variant_set_field_string(&arg_identity_extra, "userName", argv[1]);
1264 else {
1265 _cleanup_free_ char *un = NULL, *rr = NULL;
1266
1267 /* Before we consider the user name invalid, let's check if we can split it? */
1268 r = split_user_name_realm(argv[1], &un, &rr);
1269 if (r < 0)
1270 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "User name '%s' is not valid: %m", argv[1]);
1271
1272 if (rr) {
1273 r = json_variant_set_field_string(&arg_identity_extra, "realm", rr);
1274 if (r < 0)
1275 return log_error_errno(r, "Failed to set realm field: %m");
1276 }
1277
1278 r = json_variant_set_field_string(&arg_identity_extra, "userName", un);
1279 }
1280 if (r < 0)
1281 return log_error_errno(r, "Failed to set userName field: %m");
1282 } else {
1283 /* If neither a username nor an identity have been specified we cannot operate. */
1284 if (!arg_identity)
1285 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "User name required.");
1286 }
1287
1288 r = acquire_new_home_record(&hr);
1289 if (r < 0)
1290 return r;
1291
80c41552
LP		 1292 /* If the JSON record carries no plain text password (besides the recovery key), then let's query it
1293 * manually. */
1294 if (strv_length(hr->password) <= arg_recovery_key) {
4aa0a8ac
LP		 1295
1296 if (strv_isempty(hr->hashed_password)) {
80c41552
LP		 1297 _cleanup_(erase_and_freep) char *new_password = NULL;
1298
4aa0a8ac 1299 /* No regular (i.e. non-PKCS#11) hashed passwords set in the record, let's fix that. */
80c41552 1300 r = acquire_new_password(hr->user_name, hr, /* suggest = */ true, &new_password);
4aa0a8ac
LP		 1301 if (r < 0)
1302 return r;
1303
80c41552 1304 r = user_record_make_hashed_password(hr, STRV_MAKE(new_password), /* extend = */ false);
4aa0a8ac
LP		 1305 if (r < 0)
1306 return log_error_errno(r, "Failed to hash password: %m");
1307 } else {
1308 /* There's a hash password set in the record, acquire the unhashed version of it. */
ea086f06
LP		 1309 r = acquire_existing_password(
1310 hr->user_name,
1311 hr,
1312 /* emphasize_current= */ false,
1313 ASK_PASSWORD_ACCEPT_CACHED | ASK_PASSWORD_PUSH_CACHE);
4aa0a8ac
LP		 1314 if (r < 0)
1315 return r;
1316 }
1317 }
1318
1319 if (hr->enforce_password_policy == 0) {
1320 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1321
1322 /* If password quality enforcement is disabled, let's at least warn client side */
1323
679badd7 1324 r = user_record_quality_check_password(hr, hr, &error);
4aa0a8ac
LP		 1325 if (r < 0)
1326 log_warning_errno(r, "Specified password does not pass quality checks (%s), proceeding anyway.", bus_error_message(&error, r));
1327 }
1328
1329 for (;;) {
1330 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1331 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
1332 _cleanup_(erase_and_freep) char *formatted = NULL;
1333
1334 r = json_variant_format(hr->json, 0, &formatted);
1335 if (r < 0)
7b8d55b7 1336 return log_error_errno(r, "Failed to format user record: %m");
4aa0a8ac 1337
cc9886bc 1338 r = bus_message_new_method_call(bus, &m, bus_mgr, "CreateHome");
4aa0a8ac
LP		 1339 if (r < 0)
1340 return bus_log_create_error(r);
1341
2ffee2c9
LP		 1342 (void) sd_bus_message_sensitive(m);
1343
4aa0a8ac
LP		 1344 r = sd_bus_message_append(m, "s", formatted);
1345 if (r < 0)
1346 return bus_log_create_error(r);
1347
1348 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
1349 if (r < 0) {
8e62dfb1 1350 if (sd_bus_error_has_name(&error, BUS_ERROR_LOW_PASSWORD_QUALITY)) {
80c41552
LP		 1351 _cleanup_(erase_and_freep) char *new_password = NULL;
1352
8e62dfb1
LP		 1353 log_error_errno(r, "%s", bus_error_message(&error, r));
1354 log_info("(Use --enforce-password-policy=no to turn off password quality checks for this account.)");
4aa0a8ac 1355
80c41552 1356 r = acquire_new_password(hr->user_name, hr, /* suggest = */ false, &new_password);
8e62dfb1
LP		 1357 if (r < 0)
1358 return r;
4aa0a8ac 1359
80c41552 1360 r = user_record_make_hashed_password(hr, STRV_MAKE(new_password), /* extend = */ false);
8e62dfb1
LP		 1361 if (r < 0)
1362 return log_error_errno(r, "Failed to hash passwords: %m");
1363 } else {
1364 r = handle_generic_user_record_error(hr->user_name, hr, &error, r, false);
1365 if (r < 0)
1366 return r;
1367 }
1368 } else
1369 break; /* done */
4aa0a8ac
LP		 1370 }
1371
1372 return 0;
1373}
1374
1375static int remove_home(int argc, char *argv[], void *userdata) {
1376 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
1377 int r, ret = 0;
1378 char **i;
1379
1380 r = acquire_bus(&bus);
1381 if (r < 0)
1382 return r;
1383
1384 (void) polkit_agent_open_if_enabled(arg_transport, arg_ask_password);
1385
1386 STRV_FOREACH(i, strv_skip(argv, 1)) {
1387 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1388 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
1389
cc9886bc 1390 r = bus_message_new_method_call(bus, &m, bus_mgr, "RemoveHome");
4aa0a8ac
LP		 1391 if (r < 0)
1392 return bus_log_create_error(r);
1393
1394 r = sd_bus_message_append(m, "s", *i);
1395 if (r < 0)
1396 return bus_log_create_error(r);
1397
1398 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
1399 if (r < 0) {
1400 log_error_errno(r, "Failed to remove home: %s", bus_error_message(&error, r));
1401 if (ret == 0)
1402 ret = r;
1403 }
1404 }
1405
1406 return ret;
1407}
1408
1409static int acquire_updated_home_record(
1410 sd_bus *bus,
1411 const char *username,
1412 UserRecord **ret) {
1413
1414 _cleanup_(json_variant_unrefp) JsonVariant *json = NULL;
1415 _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
1416 char **i;
1417 int r;
1418
1419 assert(ret);
1420
1421 if (arg_identity) {
1422 unsigned line, column;
1423 JsonVariant *un;
1424
1425 r = json_parse_file(
1426 streq(arg_identity, "-") ? stdin : NULL,
1427 streq(arg_identity, "-") ? "<stdin>" : arg_identity, JSON_PARSE_SENSITIVE, &json, &line, &column);
1428 if (r < 0)
1429 return log_error_errno(r, "Failed to parse identity at %u:%u: %m", line, column);
1430
1431 un = json_variant_by_key(json, "userName");
1432 if (un) {
1433 if (!json_variant_is_string(un) || (username && !streq(json_variant_string(un), username)))
1434 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "User name specified on command line and in JSON record do not match.");
1435 } else {
1436 if (!username)
1437 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "No username specified.");
1438
1439 r = json_variant_set_field_string(&arg_identity_extra, "userName", username);
1440 if (r < 0)
1441 return log_error_errno(r, "Failed to set userName field: %m");
1442 }
1443
1444 } else {
1445 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1446 _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
1447 int incomplete;
1448 const char *text;
1449
1450 if (!identity_properties_specified())
1451 return log_error_errno(SYNTHETIC_ERRNO(EALREADY), "No field to change specified.");
1452
cc9886bc 1453 r = bus_call_method(bus, bus_mgr, "GetUserRecordByName", &error, &reply, "s", username);
4aa0a8ac
LP		 1454 if (r < 0)
1455 return log_error_errno(r, "Failed to acquire user home record: %s", bus_error_message(&error, r));
1456
1457 r = sd_bus_message_read(reply, "sbo", &text, &incomplete, NULL);
1458 if (r < 0)
1459 return bus_log_parse_error(r);
1460
1461 if (incomplete)
1462 return log_error_errno(SYNTHETIC_ERRNO(EACCES), "Lacking rights to acquire user record including privileged metadata, can't update record.");
1463
1464 r = json_parse(text, JSON_PARSE_SENSITIVE, &json, NULL, NULL);
1465 if (r < 0)
1466 return log_error_errno(r, "Failed to parse JSON identity: %m");
1467
1468 reply = sd_bus_message_unref(reply);
1469
1470 r = json_variant_filter(&json, STRV_MAKE("binding", "status", "signature"));
1471 if (r < 0)
1472 return log_error_errno(r, "Failed to strip binding and status from record to update: %m");
1473 }
1474
1475 r = apply_identity_changes(&json);
1476 if (r < 0)
1477 return r;
1478
1479 STRV_FOREACH(i, arg_pkcs11_token_uri) {
93295a25 1480 r = identity_add_pkcs11_key_data(&json, *i);
4aa0a8ac
LP		 1481 if (r < 0)
1482 return r;
1483 }
1484
1c0c4a43 1485 STRV_FOREACH(i, arg_fido2_device) {
17e7561a 1486 r = identity_add_fido2_parameters(&json, *i, arg_fido2_lock_with);
1c0c4a43
LP		 1487 if (r < 0)
1488 return r;
1489 }
1490
4aa0a8ac
LP		 1491 /* If the user supplied a full record, then add in lastChange, but do not override. Otherwise always
1492 * override. */
1c0c4a43 1493 r = update_last_change(&json, arg_pkcs11_token_uri || arg_fido2_device, !arg_identity);
4aa0a8ac
LP		 1494 if (r < 0)
1495 return r;
1496
1497 if (DEBUG_LOGGING)
1498 json_variant_dump(json, JSON_FORMAT_PRETTY, NULL, NULL);
1499
1500 hr = user_record_new();
1501 if (!hr)
1502 return log_oom();
1503
bfc0cc1a 1504 r = user_record_load(hr, json, USER_RECORD_REQUIRE_REGULAR|USER_RECORD_ALLOW_PRIVILEGED|USER_RECORD_ALLOW_PER_MACHINE|USER_RECORD_ALLOW_SECRET|USER_RECORD_ALLOW_SIGNATURE|USER_RECORD_LOG|USER_RECORD_PERMISSIVE);
4aa0a8ac
LP		 1505 if (r < 0)
1506 return r;
1507
1508 *ret = TAKE_PTR(hr);
1509 return 0;
1510}
1511
c98811d8
LP		 1512static int home_record_reset_human_interaction_permission(UserRecord *hr) {
1513 int r;
1514
1515 assert(hr);
1516
1517 /* When we execute multiple operations one after the other, let's reset the permission to ask the
1518 * user each time, so that if interaction is necessary we will be told so again and thus can print a
1519 * nice message to the user, telling the user so. */
1520
1521 r = user_record_set_pkcs11_protected_authentication_path_permitted(hr, -1);
1522 if (r < 0)
1523 return log_error_errno(r, "Failed to reset PKCS#11 protected authentication path permission flag: %m");
1524
1525 r = user_record_set_fido2_user_presence_permitted(hr, -1);
1526 if (r < 0)
1527 return log_error_errno(r, "Failed to reset FIDO2 user presence permission flag: %m");
1528
17e7561a
LP		 1529 r = user_record_set_fido2_user_verification_permitted(hr, -1);
1530 if (r < 0)
1531 return log_error_errno(r, "Failed to reset FIDO2 user verification permission flag: %m");
1532
c98811d8
LP		 1533 return 0;
1534}
1535
4aa0a8ac
LP		 1536static int update_home(int argc, char *argv[], void *userdata) {
1537 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
1538 _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
1539 _cleanup_free_ char *buffer = NULL;
1540 const char *username;
1541 int r;
1542
1543 if (argc >= 2)
1544 username = argv[1];
1545 else if (!arg_identity) {
1546 buffer = getusername_malloc();
1547 if (!buffer)
1548 return log_oom();
1549
1550 username = buffer;
1551 } else
1552 username = NULL;
1553
1554 r = acquire_bus(&bus);
1555 if (r < 0)
1556 return r;
1557
1558 (void) polkit_agent_open_if_enabled(arg_transport, arg_ask_password);
1559
1560 r = acquire_updated_home_record(bus, username, &hr);
1561 if (r < 0)
1562 return r;
1563
c98811d8
LP		 1564 /* If we do multiple operations, let's output things more verbosely, since otherwise the repeated
1565 * authentication might be confusing. */
1566
1567 if (arg_and_resize || arg_and_change_password)
1568 log_info("Updating home directory.");
1569
4aa0a8ac
LP		 1570 for (;;) {
1571 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1572 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
1573 _cleanup_free_ char *formatted = NULL;
1574
cc9886bc 1575 r = bus_message_new_method_call(bus, &m, bus_mgr, "UpdateHome");
4aa0a8ac
LP		 1576 if (r < 0)
1577 return bus_log_create_error(r);
1578
1579 r = json_variant_format(hr->json, 0, &formatted);
1580 if (r < 0)
7b8d55b7 1581 return log_error_errno(r, "Failed to format user record: %m");
4aa0a8ac 1582
2ffee2c9
LP		 1583 (void) sd_bus_message_sensitive(m);
1584
4aa0a8ac
LP		 1585 r = sd_bus_message_append(m, "s", formatted);
1586 if (r < 0)
1587 return bus_log_create_error(r);
1588
1589 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
1590 if (r < 0) {
1591 if (arg_and_change_password &&
1592 sd_bus_error_has_name(&error, BUS_ERROR_BAD_PASSWORD_AND_NO_TOKEN))
1593 /* In the generic handler we'd ask for a password in this case, but when
1594 * changing passwords that's not sufficient, as we need to acquire all keys
1595 * first. */
1596 return log_error_errno(r, "Security token not inserted, refusing.");
1597
1598 r = handle_generic_user_record_error(hr->user_name, hr, &error, r, false);
1599 if (r < 0)
1600 return r;
1601 } else
1602 break;
1603 }
1604
c98811d8
LP		 1605 if (arg_and_resize)
1606 log_info("Resizing home.");
1607
1608 (void) home_record_reset_human_interaction_permission(hr);
1609
4aa0a8ac
LP		 1610 /* Also sync down disk size to underlying LUKS/fscrypt/quota */
1611 while (arg_and_resize) {
1612 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1613 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
1614
cc9886bc 1615 r = bus_message_new_method_call(bus, &m, bus_mgr, "ResizeHome");
4aa0a8ac
LP		 1616 if (r < 0)
1617 return bus_log_create_error(r);
1618
1619 /* Specify UINT64_MAX as size, in which case the underlying disk size will just be synced */
1620 r = sd_bus_message_append(m, "st", hr->user_name, UINT64_MAX);
1621 if (r < 0)
1622 return bus_log_create_error(r);
1623
1624 r = bus_message_append_secret(m, hr);
1625 if (r < 0)
1626 return bus_log_create_error(r);
1627
1628 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
1629 if (r < 0) {
1630 if (arg_and_change_password &&
1631 sd_bus_error_has_name(&error, BUS_ERROR_BAD_PASSWORD_AND_NO_TOKEN))
1632 return log_error_errno(r, "Security token not inserted, refusing.");
1633
1634 r = handle_generic_user_record_error(hr->user_name, hr, &error, r, false);
1635 if (r < 0)
1636 return r;
1637 } else
1638 break;
1639 }
1640
c98811d8
LP		 1641 if (arg_and_change_password)
1642 log_info("Synchronizing passwords and encryption keys.");
1643
1644 (void) home_record_reset_human_interaction_permission(hr);
1645
4aa0a8ac
LP		 1646 /* Also sync down passwords to underlying LUKS/fscrypt */
1647 while (arg_and_change_password) {
1648 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1649 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
1650
cc9886bc 1651 r = bus_message_new_method_call(bus, &m, bus_mgr, "ChangePasswordHome");
4aa0a8ac
LP		 1652 if (r < 0)
1653 return bus_log_create_error(r);
1654
1655 /* Specify an empty new secret, in which case the underlying LUKS/fscrypt password will just be synced */
1656 r = sd_bus_message_append(m, "ss", hr->user_name, "{}");
1657 if (r < 0)
1658 return bus_log_create_error(r);
1659
1660 r = bus_message_append_secret(m, hr);
1661 if (r < 0)
1662 return bus_log_create_error(r);
1663
1664 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
1665 if (r < 0) {
1666 if (sd_bus_error_has_name(&error, BUS_ERROR_BAD_PASSWORD_AND_NO_TOKEN))
1667 return log_error_errno(r, "Security token not inserted, refusing.");
1668
1669 r = handle_generic_user_record_error(hr->user_name, hr, &error, r, false);
1670 if (r < 0)
1671 return r;
1672 } else
1673 break;
1674 }
1675
1676 return 0;
1677}
1678
1679static int passwd_home(int argc, char *argv[], void *userdata) {
1680 _cleanup_(user_record_unrefp) UserRecord *old_secret = NULL, *new_secret = NULL;
1681 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
1682 _cleanup_free_ char *buffer = NULL;
1683 const char *username;
1684 int r;
1685
1686 if (arg_pkcs11_token_uri)
1687 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "To change the PKCS#11 security token use 'homectl update --pkcs11-token-uri=…'.");
1c0c4a43
LP		 1688 if (arg_fido2_device)
1689 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "To change the FIDO2 security token use 'homectl update --fido2-device=…'.");
4aa0a8ac
LP		 1690 if (identity_properties_specified())
1691 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "The 'passwd' verb does not permit changing other record properties at the same time.");
1692
1693 if (argc >= 2)
1694 username = argv[1];
1695 else {
1696 buffer = getusername_malloc();
1697 if (!buffer)
1698 return log_oom();
1699
1700 username = buffer;
1701 }
1702
1703 r = acquire_bus(&bus);
1704 if (r < 0)
1705 return r;
1706
1707 (void) polkit_agent_open_if_enabled(arg_transport, arg_ask_password);
1708
1709 old_secret = user_record_new();
1710 if (!old_secret)
1711 return log_oom();
1712
1713 new_secret = user_record_new();
1714 if (!new_secret)
1715 return log_oom();
1716
80c41552 1717 r = acquire_new_password(username, new_secret, /* suggest = */ true, NULL);
4aa0a8ac
LP		 1718 if (r < 0)
1719 return r;
1720
1721 for (;;) {
1722 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1723 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
1724
cc9886bc 1725 r = bus_message_new_method_call(bus, &m, bus_mgr, "ChangePasswordHome");
4aa0a8ac
LP		 1726 if (r < 0)
1727 return bus_log_create_error(r);
1728
1729 r = sd_bus_message_append(m, "s", username);
1730 if (r < 0)
1731 return bus_log_create_error(r);
1732
1733 r = bus_message_append_secret(m, new_secret);
1734 if (r < 0)
1735 return bus_log_create_error(r);
1736
1737 r = bus_message_append_secret(m, old_secret);
1738 if (r < 0)
1739 return bus_log_create_error(r);
1740
1741 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
1742 if (r < 0) {
1743 if (sd_bus_error_has_name(&error, BUS_ERROR_LOW_PASSWORD_QUALITY)) {
1744
1745 log_error_errno(r, "%s", bus_error_message(&error, r));
1746
80c41552 1747 r = acquire_new_password(username, new_secret, /* suggest = */ false, NULL);
4aa0a8ac
LP		 1748
1749 } else if (sd_bus_error_has_name(&error, BUS_ERROR_BAD_PASSWORD_AND_NO_TOKEN))
1750
1751 /* In the generic handler we'd ask for a password in this case, but when
1752 * changing passwords that's not sufficeint, as we need to acquire all keys
1753 * first. */
1754 return log_error_errno(r, "Security token not inserted, refusing.");
1755 else
1756 r = handle_generic_user_record_error(username, old_secret, &error, r, true);
1757 if (r < 0)
1758 return r;
1759 } else
1760 break;
1761 }
1762
1763 return 0;
1764}
1765
1766static int resize_home(int argc, char *argv[], void *userdata) {
1767 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
1768 _cleanup_(user_record_unrefp) UserRecord *secret = NULL;
1769 uint64_t ds = UINT64_MAX;
1770 int r;
1771
1772 r = acquire_bus(&bus);
1773 if (r < 0)
1774 return r;
1775
1776 (void) polkit_agent_open_if_enabled(arg_transport, arg_ask_password);
1777
1778 if (arg_disk_size_relative != UINT64_MAX ||
fe845b5e 1779 (argc > 2 && parse_permyriad(argv[2]) >= 0))
4aa0a8ac
LP		 1780 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
1781 "Relative disk size specification currently not supported when resizing.");
1782
1783 if (argc > 2) {
1784 r = parse_size(argv[2], 1024, &ds);
1785 if (r < 0)
1786 return log_error_errno(r, "Failed to parse disk size parameter: %s", argv[2]);
1787 }
1788
1789 if (arg_disk_size != UINT64_MAX) {
1790 if (ds != UINT64_MAX && ds != arg_disk_size)
1791 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Disk size specified twice and doesn't match, refusing.");
1792
1793 ds = arg_disk_size;
1794 }
1795
57bb9bcb
LP		 1796 r = acquire_passed_secrets(argv[1], &secret);
1797 if (r < 0)
1798 return r;
4aa0a8ac
LP		 1799
1800 for (;;) {
1801 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1802 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
1803
cc9886bc 1804 r = bus_message_new_method_call(bus, &m, bus_mgr, "ResizeHome");
4aa0a8ac
LP		 1805 if (r < 0)
1806 return bus_log_create_error(r);
1807
1808 r = sd_bus_message_append(m, "st", argv[1], ds);
1809 if (r < 0)
1810 return bus_log_create_error(r);
1811
1812 r = bus_message_append_secret(m, secret);
1813 if (r < 0)
1814 return bus_log_create_error(r);
1815
1816 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
1817 if (r < 0) {
1818 r = handle_generic_user_record_error(argv[1], secret, &error, r, false);
1819 if (r < 0)
1820 return r;
1821 } else
1822 break;
1823 }
1824
1825 return 0;
1826}
1827
1828static int lock_home(int argc, char *argv[], void *userdata) {
1829 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
1830 int r, ret = 0;
1831 char **i;
1832
1833 r = acquire_bus(&bus);
1834 if (r < 0)
1835 return r;
1836
1837 STRV_FOREACH(i, strv_skip(argv, 1)) {
1838 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1839 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
1840
cc9886bc 1841 r = bus_message_new_method_call(bus, &m, bus_mgr, "LockHome");
4aa0a8ac
LP		 1842 if (r < 0)
1843 return bus_log_create_error(r);
1844
1845 r = sd_bus_message_append(m, "s", *i);
1846 if (r < 0)
1847 return bus_log_create_error(r);
1848
1849 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
1850 if (r < 0) {
1851 log_error_errno(r, "Failed to lock home: %s", bus_error_message(&error, r));
1852 if (ret == 0)
1853 ret = r;
1854 }
1855 }
1856
1857 return ret;
1858}
1859
1860static int unlock_home(int argc, char *argv[], void *userdata) {
1861 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
1862 int r, ret = 0;
1863 char **i;
1864
1865 r = acquire_bus(&bus);
1866 if (r < 0)
1867 return r;
1868
1869 STRV_FOREACH(i, strv_skip(argv, 1)) {
1870 _cleanup_(user_record_unrefp) UserRecord *secret = NULL;
1871
57bb9bcb
LP		 1872 r = acquire_passed_secrets(*i, &secret);
1873 if (r < 0)
1874 return r;
4aa0a8ac
LP		 1875
1876 for (;;) {
1877 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1878 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
1879
cc9886bc 1880 r = bus_message_new_method_call(bus, &m, bus_mgr, "UnlockHome");
4aa0a8ac
LP		 1881 if (r < 0)
1882 return bus_log_create_error(r);
1883
1884 r = sd_bus_message_append(m, "s", *i);
1885 if (r < 0)
1886 return bus_log_create_error(r);
1887
1888 r = bus_message_append_secret(m, secret);
1889 if (r < 0)
1890 return bus_log_create_error(r);
1891
1892 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
1893 if (r < 0) {
1894 r = handle_generic_user_record_error(argv[1], secret, &error, r, false);
1895 if (r < 0) {
1896 if (ret == 0)
1897 ret = r;
1898
1899 break;
1900 }
1901 } else
1902 break;
1903 }
1904 }
1905
1906 return ret;
1907}
1908
1909static int with_home(int argc, char *argv[], void *userdata) {
1910 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1911 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL, *reply = NULL;
1912 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
1913 _cleanup_(user_record_unrefp) UserRecord *secret = NULL;
1914 _cleanup_close_ int acquired_fd = -1;
1915 _cleanup_strv_free_ char **cmdline = NULL;
1916 const char *home;
1917 int r, ret;
1918 pid_t pid;
1919
1920 r = acquire_bus(&bus);
1921 if (r < 0)
1922 return r;
1923
1924 if (argc < 3) {
1925 _cleanup_free_ char *shell = NULL;
1926
1927 /* If no command is specified, spawn a shell */
1928 r = get_shell(&shell);
1929 if (r < 0)
1930 return log_error_errno(r, "Failed to acquire shell: %m");
1931
1932 cmdline = strv_new(shell);
1933 } else
1934 cmdline = strv_copy(argv + 2);
1935 if (!cmdline)
1936 return log_oom();
1937
57bb9bcb
LP		 1938 r = acquire_passed_secrets(argv[1], &secret);
1939 if (r < 0)
1940 return r;
4aa0a8ac
LP		 1941
1942 for (;;) {
cc9886bc 1943 r = bus_message_new_method_call(bus, &m, bus_mgr, "AcquireHome");
4aa0a8ac
LP		 1944 if (r < 0)
1945 return bus_log_create_error(r);
1946
1947 r = sd_bus_message_append(m, "s", argv[1]);
1948 if (r < 0)
1949 return bus_log_create_error(r);
1950
1951 r = bus_message_append_secret(m, secret);
1952 if (r < 0)
1953 return bus_log_create_error(r);
1954
1955 r = sd_bus_message_append(m, "b", /* please_suspend = */ getenv_bool("SYSTEMD_PLEASE_SUSPEND_HOME") > 0);
1956 if (r < 0)
1957 return bus_log_create_error(r);
1958
1959 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, &reply);
1960 m = sd_bus_message_unref(m);
1961 if (r < 0) {
1962 r = handle_generic_user_record_error(argv[1], secret, &error, r, false);
1963 if (r < 0)
1964 return r;
1965
1966 sd_bus_error_free(&error);
1967 } else {
1968 int fd;
1969
1970 r = sd_bus_message_read(reply, "h", &fd);
1971 if (r < 0)
1972 return bus_log_parse_error(r);
1973
1974 acquired_fd = fcntl(fd, F_DUPFD_CLOEXEC, 3);
1975 if (acquired_fd < 0)
1976 return log_error_errno(errno, "Failed to duplicate acquired fd: %m");
1977
1978 reply = sd_bus_message_unref(reply);
1979 break;
1980 }
1981 }
1982
cc9886bc 1983 r = bus_call_method(bus, bus_mgr, "GetHomeByName", &error, &reply, "s", argv[1]);
4aa0a8ac
LP		 1984 if (r < 0)
1985 return log_error_errno(r, "Failed to inspect home: %s", bus_error_message(&error, r));
1986
1987 r = sd_bus_message_read(reply, "usussso", NULL, NULL, NULL, NULL, &home, NULL, NULL);
1988 if (r < 0)
1989 return bus_log_parse_error(r);
1990
1991 r = safe_fork("(with)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG|FORK_LOG|FORK_RLIMIT_NOFILE_SAFE|FORK_REOPEN_LOG, &pid);
1992 if (r < 0)
1993 return r;
1994 if (r == 0) {
1995 if (chdir(home) < 0) {
1996 log_error_errno(errno, "Failed to change to directory %s: %m", home);
1997 _exit(255);
1998 }
1999
2000 execvp(cmdline[0], cmdline);
2001 log_error_errno(errno, "Failed to execute %s: %m", cmdline[0]);
2002 _exit(255);
2003 }
2004
2005 ret = wait_for_terminate_and_check(cmdline[0], pid, WAIT_LOG_ABNORMAL);
2006
2007 /* Close the fd that pings the home now. */
2008 acquired_fd = safe_close(acquired_fd);
2009
cc9886bc 2010 r = bus_message_new_method_call(bus, &m, bus_mgr, "ReleaseHome");
4aa0a8ac
LP		 2011 if (r < 0)
2012 return bus_log_create_error(r);
2013
2014 r = sd_bus_message_append(m, "s", argv[1]);
2015 if (r < 0)
2016 return bus_log_create_error(r);
2017
2018 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
2019 if (r < 0) {
2020 if (sd_bus_error_has_name(&error, BUS_ERROR_HOME_BUSY))
2021 log_notice("Not deactivating home directory of %s, as it is still used.", argv[1]);
2022 else
2023 return log_error_errno(r, "Failed to release user home: %s", bus_error_message(&error, r));
2024 }
2025
2026 return ret;
2027}
2028
2029static int lock_all_homes(int argc, char *argv[], void *userdata) {
2030 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2031 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
2032 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
2033 int r;
2034
2035 r = acquire_bus(&bus);
2036 if (r < 0)
2037 return r;
2038
cc9886bc 2039 r = bus_message_new_method_call(bus, &m, bus_mgr, "LockAllHomes");
4aa0a8ac
LP		 2040 if (r < 0)
2041 return bus_log_create_error(r);
2042
2043 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
2044 if (r < 0)
d1f6e01e
LP		 2045 return log_error_errno(r, "Failed to lock all homes: %s", bus_error_message(&error, r));
2046
2047 return 0;
2048}
2049
2050static int deactivate_all_homes(int argc, char *argv[], void *userdata) {
2051 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
2052 _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
2053 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
2054 int r;
2055
2056 r = acquire_bus(&bus);
2057 if (r < 0)
2058 return r;
2059
2060 r = bus_message_new_method_call(bus, &m, bus_mgr, "DeactivateAllHomes");
2061 if (r < 0)
2062 return bus_log_create_error(r);
2063
2064 r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);
2065 if (r < 0)
2066 return log_error_errno(r, "Failed to deactivate all homes: %s", bus_error_message(&error, r));
4aa0a8ac
LP		 2067
2068 return 0;
2069}
2070
2071static int drop_from_identity(const char *field) {
2072 int r;
2073
2074 assert(field);
2075
2076 /* If we are called to update an identity record and drop some field, let's keep track of what to
2077 * remove from the old record */
2078 r = strv_extend(&arg_identity_filter, field);
2079 if (r < 0)
2080 return log_oom();
2081
2082 /* Let's also drop the field if it was previously set to a new value on the same command line */
2083 r = json_variant_filter(&arg_identity_extra, STRV_MAKE(field));
2084 if (r < 0)
2085 return log_error_errno(r, "Failed to filter JSON identity data: %m");
2086
2087 r = json_variant_filter(&arg_identity_extra_this_machine, STRV_MAKE(field));
2088 if (r < 0)
2089 return log_error_errno(r, "Failed to filter JSON identity data: %m");
2090
2091 r = json_variant_filter(&arg_identity_extra_privileged, STRV_MAKE(field));
2092 if (r < 0)
2093 return log_error_errno(r, "Failed to filter JSON identity data: %m");
2094
2095 return 0;
2096}
2097
2098static int help(int argc, char *argv[], void *userdata) {
2099 _cleanup_free_ char *link = NULL;
2100 int r;
2101
384c2c32 2102 pager_open(arg_pager_flags);
4aa0a8ac
LP		 2103
2104 r = terminal_urlify_man("homectl", "1", &link);
2105 if (r < 0)
2106 return log_oom();
2107
2108 printf("%1$s [OPTIONS...] COMMAND ...\n\n"
2109 "%2$sCreate, manipulate or inspect home directories.%3$s\n"
2110 "\n%4$sCommands:%5$s\n"
4bbafcc3
ZJS		 2111 " list List home areas\n"
2112 " activate USER… Activate a home area\n"
2113 " deactivate USER… Deactivate a home area\n"
2114 " inspect USER… Inspect a home area\n"
2115 " authenticate USER… Authenticate a home area\n"
2116 " create USER Create a home area\n"
2117 " remove USER… Remove a home area\n"
2118 " update USER Update a home area\n"
2119 " passwd USER Change password of a home area\n"
2120 " resize USER SIZE Resize a home area\n"
2121 " lock USER… Temporarily lock an active home area\n"
2122 " unlock USER… Unlock a temporarily locked home area\n"
2123 " lock-all Lock all suitable home areas\n"
2124 " deactivate-all Deactivate all active home areas\n"
2125 " with USER [COMMAND…] Run shell or command with access to a home area\n"
4aa0a8ac 2126 "\n%4$sOptions:%5$s\n"
4bbafcc3
ZJS		 2127 " -h --help Show this help\n"
2128 " --version Show package version\n"
2129 " --no-pager Do not pipe output into a pager\n"
2130 " --no-legend Do not show the headers and footers\n"
2131 " --no-ask-password Do not ask for system passwords\n"
2132 " -H --host=[USER@]HOST Operate on remote host\n"
2133 " -M --machine=CONTAINER Operate on local container\n"
2134 " --identity=PATH Read JSON identity from file\n"
2135 " --json=FORMAT Output inspection data in JSON (takes one of\n"
2136 " pretty, short, off)\n"
2137 " -j Equivalent to --json=pretty (on TTY) or\n"
2138 " --json=short (otherwise)\n"
2139 " --export-format= Strip JSON inspection data (full, stripped,\n"
2140 " minimal)\n"
2141 " -E When specified once equals -j --export-format=\n"
2142 " stripped, when specified twice equals\n"
2143 " -j --export-format=minimal\n"
4aa0a8ac 2144 "\n%4$sGeneral User Record Properties:%5$s\n"
4bbafcc3
ZJS		 2145 " -c --real-name=REALNAME Real name for user\n"
2146 " --realm=REALM Realm to create user in\n"
2147 " --email-address=EMAIL Email address for user\n"
2148 " --location=LOCATION Set location of user on earth\n"
2149 " --icon-name=NAME Icon name for user\n"
2150 " -d --home-dir=PATH Home directory\n"
2151 " -u --uid=UID Numeric UID for user\n"
2152 " -G --member-of=GROUP Add user to group\n"
2153 " --skel=PATH Skeleton directory to use\n"
2154 " --shell=PATH Shell for account\n"
2155 " --setenv=VARIABLE[=VALUE] Set an environment variable at log-in\n"
2156 " --timezone=TIMEZONE Set a time-zone\n"
2157 " --language=LOCALE Set preferred language\n"
4aa0a8ac 2158 " --ssh-authorized-keys=KEYS\n"
4bbafcc3
ZJS		 2159 " Specify SSH public keys\n"
2160 " --pkcs11-token-uri=URI URI to PKCS#11 security token containing\n"
2161 " private key and matching X.509 certificate\n"
2162 " --fido2-device=PATH Path to FIDO2 hidraw device with hmac-secret\n"
2163 " extension\n"
17e7561a 2164 " --fido2-with-client-pin=BOOL\n"
4bbafcc3
ZJS		 2165 " Whether to require entering a PIN to unlock the\n"
2166 " account\n"
17e7561a 2167 " --fido2-with-user-presence=BOOL\n"
4bbafcc3
ZJS		 2168 " Whether to require user presence to unlock the\n"
2169 " account\n"
17e7561a 2170 " --fido2-with-user-verification=BOOL\n"
4bbafcc3
ZJS		 2171 " Whether to require user verification to unlock\n"
2172 " the account\n"
2173 " --recovery-key=BOOL Add a recovery key\n"
2174 "\n%4$sAccount Management User Record Properties:%5$s\n"
2175 " --locked=BOOL Set locked account state\n"
2176 " --not-before=TIMESTAMP Do not allow logins before\n"
2177 " --not-after=TIMESTAMP Do not allow logins after\n"
4aa0a8ac 2178 " --rate-limit-interval=SECS\n"
4bbafcc3 2179 " Login rate-limit interval in seconds\n"
4aa0a8ac 2180 " --rate-limit-burst=NUMBER\n"
4bbafcc3 2181 " Login rate-limit attempts per interval\n"
4aa0a8ac 2182 "\n%4$sPassword Policy User Record Properties:%5$s\n"
4bbafcc3 2183 " --password-hint=HINT Set Password hint\n"
4aa0a8ac 2184 " --enforce-password-policy=BOOL\n"
4bbafcc3
ZJS		 2185 " Control whether to enforce system's password\n"
2186 " policy for this user\n"
2187 " -P Same as --enforce-password-password=no\n"
4aa0a8ac 2188 " --password-change-now=BOOL\n"
4bbafcc3 2189 " Require the password to be changed on next login\n"
4aa0a8ac 2190 " --password-change-min=TIME\n"
4bbafcc3 2191 " Require minimum time between password changes\n"
4aa0a8ac 2192 " --password-change-max=TIME\n"
4bbafcc3 2193 " Require maximum time between password changes\n"
4aa0a8ac 2194 " --password-change-warn=TIME\n"
4bbafcc3 2195 " How much time to warn before password expiry\n"
4aa0a8ac 2196 " --password-change-inactive=TIME\n"
4bbafcc3 2197 " How much time to block password after expiry\n"
4aa0a8ac 2198 "\n%4$sResource Management User Record Properties:%5$s\n"
4bbafcc3
ZJS		 2199 " --disk-size=BYTES Size to assign the user on disk\n"
2200 " --access-mode=MODE User home directory access mode\n"
2201 " --umask=MODE Umask for user when logging in\n"
2202 " --nice=NICE Nice level for user\n"
4aa0a8ac 2203 " --rlimit=LIMIT=VALUE[:VALUE]\n"
4bbafcc3
ZJS		 2204 " Set resource limits\n"
2205 " --tasks-max=MAX Set maximum number of per-user tasks\n"
2206 " --memory-high=BYTES Set high memory threshold in bytes\n"
2207 " --memory-max=BYTES Set maximum memory limit\n"
2208 " --cpu-weight=WEIGHT Set CPU weight\n"
2209 " --io-weight=WEIGHT Set IO weight\n"
4aa0a8ac 2210 "\n%4$sStorage User Record Properties:%5$s\n"
4bbafcc3
ZJS		 2211 " --storage=STORAGE Storage type to use (luks, fscrypt, directory,\n"
2212 " subvolume, cifs)\n"
2213 " --image-path=PATH Path to image file/directory\n"
86019efa 2214 " --drop-caches=BOOL Whether to automatically drop caches on logout\n"
4aa0a8ac 2215 "\n%4$sLUKS Storage User Record Properties:%5$s\n"
4bbafcc3
ZJS		 2216 " --fs-type=TYPE File system type to use in case of luks\n"
2217 " storage (btrfs, ext4, xfs)\n"
2218 " --luks-discard=BOOL Whether to use 'discard' feature of file system\n"
2219 " when activated (mounted)\n"
cba11699 2220 " --luks-offline-discard=BOOL\n"
4bbafcc3
ZJS		 2221 " Whether to trim file on logout\n"
2222 " --luks-cipher=CIPHER Cipher to use for LUKS encryption\n"
2223 " --luks-cipher-mode=MODE Cipher mode to use for LUKS encryption\n"
4aa0a8ac 2224 " --luks-volume-key-size=BITS\n"
4bbafcc3
ZJS		 2225 " Volume key size to use for LUKS encryption\n"
2226 " --luks-pbkdf-type=TYPE Password-based Key Derivation Function to use\n"
4aa0a8ac 2227 " --luks-pbkdf-hash-algorithm=ALGORITHM\n"
4bbafcc3 2228 " PBKDF hash algorithm to use\n"
4aa0a8ac 2229 " --luks-pbkdf-time-cost=SECS\n"
4bbafcc3 2230 " Time cost for PBKDF in seconds\n"
4aa0a8ac 2231 " --luks-pbkdf-memory-cost=BYTES\n"
4bbafcc3 2232 " Memory cost for PBKDF in bytes\n"
4aa0a8ac 2233 " --luks-pbkdf-parallel-threads=NUMBER\n"
4bbafcc3 2234 " Number of parallel threads for PKBDF\n"
edf0c907
LP		 2235 " --luks-extra-mount-options=OPTIONS\n"
2236 " LUKS extra mount options\n"
4aa0a8ac 2237 "\n%4$sMounting User Record Properties:%5$s\n"
4bbafcc3
ZJS		 2238 " --nosuid=BOOL Control the 'nosuid' flag of the home mount\n"
2239 " --nodev=BOOL Control the 'nodev' flag of the home mount\n"
2240 " --noexec=BOOL Control the 'noexec' flag of the home mount\n"
4aa0a8ac 2241 "\n%4$sCIFS User Record Properties:%5$s\n"
4bbafcc3
ZJS		 2242 " --cifs-domain=DOMAIN CIFS (Windows) domain\n"
2243 " --cifs-user-name=USER CIFS (Windows) user name\n"
2244 " --cifs-service=SERVICE CIFS (Windows) service to mount as home area\n"
4c2ee5c7
LP		 2245 " --cifs-extra-mount-options=OPTIONS\n"
2246 " CIFS (Windows) extra mount options\n"
4aa0a8ac 2247 "\n%4$sLogin Behaviour User Record Properties:%5$s\n"
4bbafcc3
ZJS		 2248 " --stop-delay=SECS How long to leave user services running after\n"
2249 " logout\n"
2250 " --kill-processes=BOOL Whether to kill user processes when sessions\n"
2251 " terminate\n"
2252 " --auto-login=BOOL Try to log this user in automatically\n"
bc556335
DDM		 2253 "\nSee the %6$s for details.\n",
2254 program_invocation_short_name,
2255 ansi_highlight(),
2256 ansi_normal(),
2257 ansi_underline(),
2258 ansi_normal(),
2259 link);
4aa0a8ac
LP		 2260
2261 return 0;
2262}
2263
2264static int parse_argv(int argc, char *argv[]) {
2265
2266 enum {
2267 ARG_VERSION = 0x100,
2268 ARG_NO_PAGER,
2269 ARG_NO_LEGEND,
2270 ARG_NO_ASK_PASSWORD,
2271 ARG_REALM,
2272 ARG_EMAIL_ADDRESS,
2273 ARG_DISK_SIZE,
2274 ARG_ACCESS_MODE,
2275 ARG_STORAGE,
2276 ARG_FS_TYPE,
2277 ARG_IMAGE_PATH,
2278 ARG_UMASK,
2279 ARG_LUKS_DISCARD,
cba11699 2280 ARG_LUKS_OFFLINE_DISCARD,
4aa0a8ac
LP		 2281 ARG_JSON,
2282 ARG_SETENV,
2283 ARG_TIMEZONE,
2284 ARG_LANGUAGE,
2285 ARG_LOCKED,
2286 ARG_SSH_AUTHORIZED_KEYS,
2287 ARG_LOCATION,
2288 ARG_ICON_NAME,
2289 ARG_PASSWORD_HINT,
2290 ARG_NICE,
2291 ARG_RLIMIT,
2292 ARG_NOT_BEFORE,
2293 ARG_NOT_AFTER,
2294 ARG_LUKS_CIPHER,
2295 ARG_LUKS_CIPHER_MODE,
2296 ARG_LUKS_VOLUME_KEY_SIZE,
2297 ARG_NOSUID,
2298 ARG_NODEV,
2299 ARG_NOEXEC,
2300 ARG_CIFS_DOMAIN,
2301 ARG_CIFS_USER_NAME,
2302 ARG_CIFS_SERVICE,
4c2ee5c7 2303 ARG_CIFS_EXTRA_MOUNT_OPTIONS,
4aa0a8ac
LP		 2304 ARG_TASKS_MAX,
2305 ARG_MEMORY_HIGH,
2306 ARG_MEMORY_MAX,
2307 ARG_CPU_WEIGHT,
2308 ARG_IO_WEIGHT,
2309 ARG_LUKS_PBKDF_TYPE,
2310 ARG_LUKS_PBKDF_HASH_ALGORITHM,
2311 ARG_LUKS_PBKDF_TIME_COST,
2312 ARG_LUKS_PBKDF_MEMORY_COST,
2313 ARG_LUKS_PBKDF_PARALLEL_THREADS,
2314 ARG_RATE_LIMIT_INTERVAL,
2315 ARG_RATE_LIMIT_BURST,
2316 ARG_STOP_DELAY,
2317 ARG_KILL_PROCESSES,
2318 ARG_ENFORCE_PASSWORD_POLICY,
2319 ARG_PASSWORD_CHANGE_NOW,
2320 ARG_PASSWORD_CHANGE_MIN,
2321 ARG_PASSWORD_CHANGE_MAX,
2322 ARG_PASSWORD_CHANGE_WARN,
2323 ARG_PASSWORD_CHANGE_INACTIVE,
2324 ARG_EXPORT_FORMAT,
2325 ARG_AUTO_LOGIN,
2326 ARG_PKCS11_TOKEN_URI,
1c0c4a43 2327 ARG_FIDO2_DEVICE,
17e7561a
LP		 2328 ARG_FIDO2_WITH_PIN,
2329 ARG_FIDO2_WITH_UP,
2330 ARG_FIDO2_WITH_UV,
80c41552 2331 ARG_RECOVERY_KEY,
4aa0a8ac
LP		 2332 ARG_AND_RESIZE,
2333 ARG_AND_CHANGE_PASSWORD,
86019efa 2334 ARG_DROP_CACHES,
edf0c907 2335 ARG_LUKS_EXTRA_MOUNT_OPTIONS,
4aa0a8ac
LP		 2336 };
2337
2338 static const struct option options[] = {
2339 { "help", no_argument, NULL, 'h' },
2340 { "version", no_argument, NULL, ARG_VERSION },
2341 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
2342 { "no-legend", no_argument, NULL, ARG_NO_LEGEND },
2343 { "no-ask-password", no_argument, NULL, ARG_NO_ASK_PASSWORD },
2344 { "host", required_argument, NULL, 'H' },
2345 { "machine", required_argument, NULL, 'M' },
2346 { "identity", required_argument, NULL, 'I' },
2347 { "real-name", required_argument, NULL, 'c' },
2348 { "comment", required_argument, NULL, 'c' }, /* Compat alias to keep thing in sync with useradd(8) */
2349 { "realm", required_argument, NULL, ARG_REALM },
2350 { "email-address", required_argument, NULL, ARG_EMAIL_ADDRESS },
2351 { "location", required_argument, NULL, ARG_LOCATION },
2352 { "password-hint", required_argument, NULL, ARG_PASSWORD_HINT },
2353 { "icon-name", required_argument, NULL, ARG_ICON_NAME },
2354 { "home-dir", required_argument, NULL, 'd' }, /* Compatible with useradd(8) */
2355 { "uid", required_argument, NULL, 'u' }, /* Compatible with useradd(8) */
2356 { "member-of", required_argument, NULL, 'G' },
2357 { "groups", required_argument, NULL, 'G' }, /* Compat alias to keep thing in sync with useradd(8) */
2358 { "skel", required_argument, NULL, 'k' }, /* Compatible with useradd(8) */
2359 { "shell", required_argument, NULL, 's' }, /* Compatible with useradd(8) */
2360 { "setenv", required_argument, NULL, ARG_SETENV },
2361 { "timezone", required_argument, NULL, ARG_TIMEZONE },
2362 { "language", required_argument, NULL, ARG_LANGUAGE },
2363 { "locked", required_argument, NULL, ARG_LOCKED },
2364 { "not-before", required_argument, NULL, ARG_NOT_BEFORE },
2365 { "not-after", required_argument, NULL, ARG_NOT_AFTER },
2366 { "expiredate", required_argument, NULL, 'e' }, /* Compat alias to keep thing in sync with useradd(8) */
2367 { "ssh-authorized-keys", required_argument, NULL, ARG_SSH_AUTHORIZED_KEYS },
2368 { "disk-size", required_argument, NULL, ARG_DISK_SIZE },
2369 { "access-mode", required_argument, NULL, ARG_ACCESS_MODE },
2370 { "umask", required_argument, NULL, ARG_UMASK },
2371 { "nice", required_argument, NULL, ARG_NICE },
2372 { "rlimit", required_argument, NULL, ARG_RLIMIT },
2373 { "tasks-max", required_argument, NULL, ARG_TASKS_MAX },
2374 { "memory-high", required_argument, NULL, ARG_MEMORY_HIGH },
2375 { "memory-max", required_argument, NULL, ARG_MEMORY_MAX },
2376 { "cpu-weight", required_argument, NULL, ARG_CPU_WEIGHT },
2377 { "io-weight", required_argument, NULL, ARG_IO_WEIGHT },
2378 { "storage", required_argument, NULL, ARG_STORAGE },
2379 { "image-path", required_argument, NULL, ARG_IMAGE_PATH },
2380 { "fs-type", required_argument, NULL, ARG_FS_TYPE },
2381 { "luks-discard", required_argument, NULL, ARG_LUKS_DISCARD },
cba11699 2382 { "luks-offline-discard", required_argument, NULL, ARG_LUKS_OFFLINE_DISCARD },
4aa0a8ac
LP		 2383 { "luks-cipher", required_argument, NULL, ARG_LUKS_CIPHER },
2384 { "luks-cipher-mode", required_argument, NULL, ARG_LUKS_CIPHER_MODE },
2385 { "luks-volume-key-size", required_argument, NULL, ARG_LUKS_VOLUME_KEY_SIZE },
2386 { "luks-pbkdf-type", required_argument, NULL, ARG_LUKS_PBKDF_TYPE },
2387 { "luks-pbkdf-hash-algorithm", required_argument, NULL, ARG_LUKS_PBKDF_HASH_ALGORITHM },
2388 { "luks-pbkdf-time-cost", required_argument, NULL, ARG_LUKS_PBKDF_TIME_COST },
2389 { "luks-pbkdf-memory-cost", required_argument, NULL, ARG_LUKS_PBKDF_MEMORY_COST },
2390 { "luks-pbkdf-parallel-threads", required_argument, NULL, ARG_LUKS_PBKDF_PARALLEL_THREADS },
2391 { "nosuid", required_argument, NULL, ARG_NOSUID },
2392 { "nodev", required_argument, NULL, ARG_NODEV },
2393 { "noexec", required_argument, NULL, ARG_NOEXEC },
2394 { "cifs-user-name", required_argument, NULL, ARG_CIFS_USER_NAME },
2395 { "cifs-domain", required_argument, NULL, ARG_CIFS_DOMAIN },
2396 { "cifs-service", required_argument, NULL, ARG_CIFS_SERVICE },
4c2ee5c7 2397 { "cifs-extra-mount-options", required_argument, NULL, ARG_CIFS_EXTRA_MOUNT_OPTIONS },
4aa0a8ac
LP		 2398 { "rate-limit-interval", required_argument, NULL, ARG_RATE_LIMIT_INTERVAL },
2399 { "rate-limit-burst", required_argument, NULL, ARG_RATE_LIMIT_BURST },
2400 { "stop-delay", required_argument, NULL, ARG_STOP_DELAY },
2401 { "kill-processes", required_argument, NULL, ARG_KILL_PROCESSES },
2402 { "enforce-password-policy", required_argument, NULL, ARG_ENFORCE_PASSWORD_POLICY },
2403 { "password-change-now", required_argument, NULL, ARG_PASSWORD_CHANGE_NOW },
2404 { "password-change-min", required_argument, NULL, ARG_PASSWORD_CHANGE_MIN },
2405 { "password-change-max", required_argument, NULL, ARG_PASSWORD_CHANGE_MAX },
2406 { "password-change-warn", required_argument, NULL, ARG_PASSWORD_CHANGE_WARN },
2407 { "password-change-inactive", required_argument, NULL, ARG_PASSWORD_CHANGE_INACTIVE },
2408 { "auto-login", required_argument, NULL, ARG_AUTO_LOGIN },
2409 { "json", required_argument, NULL, ARG_JSON },
2410 { "export-format", required_argument, NULL, ARG_EXPORT_FORMAT },
2411 { "pkcs11-token-uri", required_argument, NULL, ARG_PKCS11_TOKEN_URI },
1c0c4a43 2412 { "fido2-device", required_argument, NULL, ARG_FIDO2_DEVICE },
17e7561a
LP		 2413 { "fido2-with-client-pin", required_argument, NULL, ARG_FIDO2_WITH_PIN },
2414 { "fido2-with-user-presence", required_argument, NULL, ARG_FIDO2_WITH_UP },
2415 { "fido2-with-user-verification",required_argument, NULL, ARG_FIDO2_WITH_UV },
80c41552 2416 { "recovery-key", required_argument, NULL, ARG_RECOVERY_KEY },
4aa0a8ac
LP		 2417 { "and-resize", required_argument, NULL, ARG_AND_RESIZE },
2418 { "and-change-password", required_argument, NULL, ARG_AND_CHANGE_PASSWORD },
86019efa 2419 { "drop-caches", required_argument, NULL, ARG_DROP_CACHES },
edf0c907 2420 { "luks-extra-mount-options", required_argument, NULL, ARG_LUKS_EXTRA_MOUNT_OPTIONS },
4aa0a8ac
LP		 2421 {}
2422 };
2423
2424 int r;
2425
2426 assert(argc >= 0);
2427 assert(argv);
2428
2429 for (;;) {
2430 int c;
2431
2432 c = getopt_long(argc, argv, "hH:M:I:c:d:u:k:s:e:G:jPE", options, NULL);
2433 if (c < 0)
2434 break;
2435
2436 switch (c) {
2437
2438 case 'h':
2439 return help(0, NULL, NULL);
2440
2441 case ARG_VERSION:
2442 return version();
2443
2444 case ARG_NO_PAGER:
2445 arg_pager_flags |= PAGER_DISABLE;
2446 break;
2447
2448 case ARG_NO_LEGEND:
2449 arg_legend = false;
2450 break;
2451
2452 case ARG_NO_ASK_PASSWORD:
2453 arg_ask_password = false;
2454 break;
2455
2456 case 'H':
2457 arg_transport = BUS_TRANSPORT_REMOTE;
2458 arg_host = optarg;
2459 break;
2460
2461 case 'M':
2462 arg_transport = BUS_TRANSPORT_MACHINE;
2463 arg_host = optarg;
2464 break;
2465
2466 case 'I':
2467 arg_identity = optarg;
2468 break;
2469
2470 case 'c':
2471 if (isempty(optarg)) {
2472 r = drop_from_identity("realName");
2473 if (r < 0)
2474 return r;
2475
2476 break;
2477 }
2478
2479 if (!valid_gecos(optarg))
2480 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Real name '%s' not a valid GECOS field.", optarg);
2481
2482 r = json_variant_set_field_string(&arg_identity_extra, "realName", optarg);
2483 if (r < 0)
2484 return log_error_errno(r, "Failed to set realName field: %m");
2485
2486 break;
2487
2488 case 'd': {
2489 _cleanup_free_ char *hd = NULL;
2490
2491 if (isempty(optarg)) {
2492 r = drop_from_identity("homeDirectory");
2493 if (r < 0)
2494 return r;
2495
2496 break;
2497 }
2498
614b022c 2499 r = parse_path_argument(optarg, false, &hd);
4aa0a8ac
LP		 2500 if (r < 0)
2501 return r;
2502
2503 if (!valid_home(hd))
2504 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Home directory '%s' not valid.", hd);
2505
2506 r = json_variant_set_field_string(&arg_identity_extra, "homeDirectory", hd);
2507 if (r < 0)
2508 return log_error_errno(r, "Failed to set homeDirectory field: %m");
2509
2510 break;
2511 }
2512
2513 case ARG_REALM:
2514 if (isempty(optarg)) {
2515 r = drop_from_identity("realm");
2516 if (r < 0)
2517 return r;
2518
2519 break;
2520 }
2521
2522 r = dns_name_is_valid(optarg);
2523 if (r < 0)
2524 return log_error_errno(r, "Failed to determine whether realm '%s' is a valid DNS domain: %m", optarg);
2525 if (r == 0)
2526 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Realm '%s' is not a valid DNS domain: %m", optarg);
2527
2528 r = json_variant_set_field_string(&arg_identity_extra, "realm", optarg);
2529 if (r < 0)
2530 return log_error_errno(r, "Failed to set realm field: %m");
2531 break;
2532
2533 case ARG_EMAIL_ADDRESS:
2534 case ARG_LOCATION:
2535 case ARG_ICON_NAME:
2536 case ARG_CIFS_USER_NAME:
4c2ee5c7 2537 case ARG_CIFS_DOMAIN:
edf0c907
LP		 2538 case ARG_CIFS_EXTRA_MOUNT_OPTIONS:
2539 case ARG_LUKS_EXTRA_MOUNT_OPTIONS: {
4aa0a8ac
LP		 2540
2541 const char *field =
4c2ee5c7
LP		 2542 c == ARG_EMAIL_ADDRESS ? "emailAddress" :
2543 c == ARG_LOCATION ? "location" :
2544 c == ARG_ICON_NAME ? "iconName" :
2545 c == ARG_CIFS_USER_NAME ? "cifsUserName" :
2546 c == ARG_CIFS_DOMAIN ? "cifsDomain" :
2547 c == ARG_CIFS_EXTRA_MOUNT_OPTIONS ? "cifsExtraMountOptions" :
edf0c907 2548 c == ARG_LUKS_EXTRA_MOUNT_OPTIONS ? "luksExtraMountOptions" :
4c2ee5c7 2549 NULL;
4aa0a8ac
LP		 2550
2551 assert(field);
2552
2553 if (isempty(optarg)) {
2554 r = drop_from_identity(field);
2555 if (r < 0)
2556 return r;
2557
2558 break;
2559 }
2560
2561 r = json_variant_set_field_string(&arg_identity_extra, field, optarg);
2562 if (r < 0)
2563 return log_error_errno(r, "Failed to set %s field: %m", field);
2564
2565 break;
2566 }
2567
16b81da6
LP		 2568 case ARG_CIFS_SERVICE:
2569 if (isempty(optarg)) {
2570 r = drop_from_identity("cifsService");
2571 if (r < 0)
2572 return r;
2573
2574 break;
2575 }
2576
2577 r = parse_cifs_service(optarg, NULL, NULL, NULL);
2578 if (r < 0)
2579 return log_error_errno(r, "Failed to validate CIFS service name: %s", optarg);
2580
2581 r = json_variant_set_field_string(&arg_identity_extra, "cifsService", optarg);
2582 if (r < 0)
2583 return log_error_errno(r, "Failed to set cifsService field: %m");
2584
2585 break;
2586
4aa0a8ac
LP		 2587 case ARG_PASSWORD_HINT:
2588 if (isempty(optarg)) {
2589 r = drop_from_identity("passwordHint");
2590 if (r < 0)
2591 return r;
2592
2593 break;
2594 }
2595
2596 r = json_variant_set_field_string(&arg_identity_extra_privileged, "passwordHint", optarg);
2597 if (r < 0)
2598 return log_error_errno(r, "Failed to set passwordHint field: %m");
2599
2600 string_erase(optarg);
2601 break;
2602
2603 case ARG_NICE: {
2604 int nc;
2605
2606 if (isempty(optarg)) {
2607 r = drop_from_identity("niceLevel");
2608 if (r < 0)
2609 return r;
2610 break;
2611 }
2612
2613 r = parse_nice(optarg, &nc);
2614 if (r < 0)
2615 return log_error_errno(r, "Failed to parse nice level: %s", optarg);
2616
2617 r = json_variant_set_field_integer(&arg_identity_extra, "niceLevel", nc);
2618 if (r < 0)
2619 return log_error_errno(r, "Failed to set niceLevel field: %m");
2620
2621 break;
2622 }
2623
2624 case ARG_RLIMIT: {
2625 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *jcur = NULL, *jmax = NULL;
2626 _cleanup_free_ char *field = NULL, *t = NULL;
2627 const char *eq;
2628 struct rlimit rl;
2629 int l;
2630
2631 if (isempty(optarg)) {
2632 /* Remove all resource limits */
2633
2634 r = drop_from_identity("resourceLimits");
2635 if (r < 0)
2636 return r;
2637
2638 arg_identity_filter_rlimits = strv_free(arg_identity_filter_rlimits);
2639 arg_identity_extra_rlimits = json_variant_unref(arg_identity_extra_rlimits);
2640 break;
2641 }
2642
2643 eq = strchr(optarg, '=');
2644 if (!eq)
2645 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Can't parse resource limit assignment: %s", optarg);
2646
2647 field = strndup(optarg, eq - optarg);
2648 if (!field)
2649 return log_oom();
2650
2651 l = rlimit_from_string_harder(field);
2652 if (l < 0)
7211c853 2653 return log_error_errno(l, "Unknown resource limit type: %s", field);
4aa0a8ac
LP		 2654
2655 if (isempty(eq + 1)) {
2656 /* Remove only the specific rlimit */
2657
2658 r = strv_extend(&arg_identity_filter_rlimits, rlimit_to_string(l));
2659 if (r < 0)
2660 return r;
2661
2662 r = json_variant_filter(&arg_identity_extra_rlimits, STRV_MAKE(field));
2663 if (r < 0)
2664 return log_error_errno(r, "Failed to filter JSON identity data: %m");
2665
2666 break;
2667 }
2668
2669 r = rlimit_parse(l, eq + 1, &rl);
2670 if (r < 0)
2671 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to parse resource limit value: %s", eq + 1);
2672
2673 r = rl.rlim_cur == RLIM_INFINITY ? json_variant_new_null(&jcur) : json_variant_new_unsigned(&jcur, rl.rlim_cur);
2674 if (r < 0)
2675 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to allocate current integer: %m");
2676
2677 r = rl.rlim_max == RLIM_INFINITY ? json_variant_new_null(&jmax) : json_variant_new_unsigned(&jmax, rl.rlim_max);
2678 if (r < 0)
2679 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to allocate maximum integer: %m");
2680
2681 r = json_build(&v,
2682 JSON_BUILD_OBJECT(
2683 JSON_BUILD_PAIR("cur", JSON_BUILD_VARIANT(jcur)),
2684 JSON_BUILD_PAIR("max", JSON_BUILD_VARIANT(jmax))));
2685 if (r < 0)
2686 return log_error_errno(r, "Failed to build resource limit: %m");
2687
2688 t = strjoin("RLIMIT_", rlimit_to_string(l));
2689 if (!t)
2690 return log_oom();
2691
2692 r = json_variant_set_field(&arg_identity_extra_rlimits, t, v);
2693 if (r < 0)
2694 return log_error_errno(r, "Failed to set %s field: %m", rlimit_to_string(l));
2695
2696 break;
2697 }
2698
2699 case 'u': {
2700 uid_t uid;
2701
2702 if (isempty(optarg)) {
2703 r = drop_from_identity("uid");
2704 if (r < 0)
2705 return r;
2706
2707 break;
2708 }
2709
2710 r = parse_uid(optarg, &uid);
2711 if (r < 0)
2712 return log_error_errno(r, "Failed to parse UID '%s'.", optarg);
2713
2714 if (uid_is_system(uid))
2715 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID " UID_FMT " is in system range, refusing.", uid);
2716 if (uid_is_dynamic(uid))
2717 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID " UID_FMT " is in dynamic range, refusing.", uid);
2718 if (uid == UID_NOBODY)
2719 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID " UID_FMT " is nobody UID, refusing.", uid);
2720
2721 r = json_variant_set_field_unsigned(&arg_identity_extra, "uid", uid);
2722 if (r < 0)
2723 return log_error_errno(r, "Failed to set realm field: %m");
2724
2725 break;
2726 }
2727
2728 case 'k':
2729 case ARG_IMAGE_PATH: {
2730 const char *field = c == 'k' ? "skeletonDirectory" : "imagePath";
2731 _cleanup_free_ char *v = NULL;
2732
2733 if (isempty(optarg)) {
2734 r = drop_from_identity(field);
2735 if (r < 0)
2736 return r;
2737
2738 break;
2739 }
2740
614b022c 2741 r = parse_path_argument(optarg, false, &v);
4aa0a8ac
LP		 2742 if (r < 0)
2743 return r;
2744
2745 r = json_variant_set_field_string(&arg_identity_extra_this_machine, field, v);
2746 if (r < 0)
2747 return log_error_errno(r, "Failed to set %s field: %m", v);
2748
2749 break;
2750 }
2751
2752 case 's':
2753 if (isempty(optarg)) {
2754 r = drop_from_identity("shell");
2755 if (r < 0)
2756 return r;
2757
2758 break;
2759 }
2760
2761 if (!valid_shell(optarg))
2762 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Shell '%s' not valid.", optarg);
2763
2764 r = json_variant_set_field_string(&arg_identity_extra, "shell", optarg);
2765 if (r < 0)
2766 return log_error_errno(r, "Failed to set shell field: %m");
2767
2768 break;
2769
2770 case ARG_SETENV: {
aaf057c4 2771 _cleanup_free_ char **l = NULL;
4aa0a8ac
LP		 2772 _cleanup_(json_variant_unrefp) JsonVariant *ne = NULL;
2773 JsonVariant *e;
2774
2775 if (isempty(optarg)) {
2776 r = drop_from_identity("environment");
2777 if (r < 0)
2778 return r;
2779
2780 break;
2781 }
2782
4aa0a8ac
LP		 2783 e = json_variant_by_key(arg_identity_extra, "environment");
2784 if (e) {
2785 r = json_variant_strv(e, &l);
2786 if (r < 0)
2787 return log_error_errno(r, "Failed to parse JSON environment field: %m");
2788 }
2789
4bbafcc3 2790 r = strv_env_replace_strdup_passthrough(&l, optarg);
aaf057c4 2791 if (r < 0)
4bbafcc3 2792 return log_error_errno(r, "Cannot assign environment variable %s: %m", optarg);
4aa0a8ac 2793
aaf057c4 2794 strv_sort(l);
4aa0a8ac 2795
aaf057c4 2796 r = json_variant_new_array_strv(&ne, l);
4aa0a8ac
LP		 2797 if (r < 0)
2798 return log_error_errno(r, "Failed to allocate environment list JSON: %m");
2799
2800 r = json_variant_set_field(&arg_identity_extra, "environment", ne);
2801 if (r < 0)
162392b7 2802 return log_error_errno(r, "Failed to set environment list: %m");
4aa0a8ac
LP		 2803
2804 break;
2805 }
2806
2807 case ARG_TIMEZONE:
2808
2809 if (isempty(optarg)) {
2810 r = drop_from_identity("timeZone");
2811 if (r < 0)
2812 return r;
2813
2814 break;
2815 }
2816
2817 if (!timezone_is_valid(optarg, LOG_DEBUG))
2818 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Timezone '%s' is not valid.", optarg);
2819
2820 r = json_variant_set_field_string(&arg_identity_extra, "timeZone", optarg);
2821 if (r < 0)
2822 return log_error_errno(r, "Failed to set timezone field: %m");
2823
2824 break;
2825
2826 case ARG_LANGUAGE:
2827 if (isempty(optarg)) {
2828 r = drop_from_identity("language");
2829 if (r < 0)
2830 return r;
2831
2832 break;
2833 }
2834
2835 if (!locale_is_valid(optarg))
2836 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Locale '%s' is not valid.", optarg);
2837
a00a78b8
LP		 2838 if (locale_is_installed(optarg) <= 0)
2839 log_warning("Locale '%s' is not installed, accepting anyway.", optarg);
2840
4aa0a8ac
LP		 2841 r = json_variant_set_field_string(&arg_identity_extra, "preferredLanguage", optarg);
2842 if (r < 0)
2843 return log_error_errno(r, "Failed to set preferredLanguage field: %m");
2844
2845 break;
2846
2847 case ARG_NOSUID:
2848 case ARG_NODEV:
2849 case ARG_NOEXEC:
2850 case ARG_LOCKED:
2851 case ARG_KILL_PROCESSES:
2852 case ARG_ENFORCE_PASSWORD_POLICY:
2853 case ARG_AUTO_LOGIN:
2854 case ARG_PASSWORD_CHANGE_NOW: {
2855 const char *field =
2856 c == ARG_LOCKED ? "locked" :
2857 c == ARG_NOSUID ? "mountNoSuid" :
2858 c == ARG_NODEV ? "mountNoDevices" :
2859 c == ARG_NOEXEC ? "mountNoExecute" :
2860 c == ARG_KILL_PROCESSES ? "killProcesses" :
2861 c == ARG_ENFORCE_PASSWORD_POLICY ? "enforcePasswordPolicy" :
2862 c == ARG_AUTO_LOGIN ? "autoLogin" :
2863 c == ARG_PASSWORD_CHANGE_NOW ? "passwordChangeNow" :
2864 NULL;
2865
2866 assert(field);
2867
2868 if (isempty(optarg)) {
2869 r = drop_from_identity(field);
2870 if (r < 0)
2871 return r;
2872
2873 break;
2874 }
2875
2876 r = parse_boolean(optarg);
2877 if (r < 0)
2878 return log_error_errno(r, "Failed to parse %s boolean: %m", field);
2879
2880 r = json_variant_set_field_boolean(&arg_identity_extra, field, r > 0);
2881 if (r < 0)
2882 return log_error_errno(r, "Failed to set %s field: %m", field);
2883
2884 break;
2885 }
2886
2887 case 'P':
2888 r = json_variant_set_field_boolean(&arg_identity_extra, "enforcePasswordPolicy", false);
2889 if (r < 0)
2890 return log_error_errno(r, "Failed to set enforcePasswordPolicy field: %m");
2891
2892 break;
2893
2894 case ARG_DISK_SIZE:
2895 if (isempty(optarg)) {
2896 r = drop_from_identity("diskSize");
2897 if (r < 0)
2898 return r;
2899
2900 r = drop_from_identity("diskSizeRelative");
2901 if (r < 0)
2902 return r;
2903
2904 arg_disk_size = arg_disk_size_relative = UINT64_MAX;
2905 break;
2906 }
2907
fe845b5e 2908 r = parse_permyriad(optarg);
4aa0a8ac
LP		 2909 if (r < 0) {
2910 r = parse_size(optarg, 1024, &arg_disk_size);
2911 if (r < 0)
2912 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Disk size '%s' not valid.", optarg);
2913
2914 r = drop_from_identity("diskSizeRelative");
2915 if (r < 0)
2916 return r;
2917
2918 r = json_variant_set_field_unsigned(&arg_identity_extra_this_machine, "diskSize", arg_disk_size);
2919 if (r < 0)
2920 return log_error_errno(r, "Failed to set diskSize field: %m");
2921
2922 arg_disk_size_relative = UINT64_MAX;
2923 } else {
2924 /* Normalize to UINT32_MAX == 100% */
9cba32bc 2925 arg_disk_size_relative = UINT32_SCALE_FROM_PERMYRIAD(r);
4aa0a8ac
LP		 2926
2927 r = drop_from_identity("diskSize");
2928 if (r < 0)
2929 return r;
2930
2931 r = json_variant_set_field_unsigned(&arg_identity_extra_this_machine, "diskSizeRelative", arg_disk_size_relative);
2932 if (r < 0)
2933 return log_error_errno(r, "Failed to set diskSizeRelative field: %m");
2934
2935 arg_disk_size = UINT64_MAX;
2936 }
2937
2938 break;
2939
2940 case ARG_ACCESS_MODE: {
2941 mode_t mode;
2942
2943 if (isempty(optarg)) {
2944 r = drop_from_identity("accessMode");
2945 if (r < 0)
2946 return r;
2947
2948 break;
2949 }
2950
2951 r = parse_mode(optarg, &mode);
2952 if (r < 0)
2953 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Access mode '%s' not valid.", optarg);
2954
2955 r = json_variant_set_field_unsigned(&arg_identity_extra, "accessMode", mode);
2956 if (r < 0)
2957 return log_error_errno(r, "Failed to set access mode field: %m");
2958
2959 break;
2960 }
2961
2962 case ARG_LUKS_DISCARD:
2963 if (isempty(optarg)) {
2964 r = drop_from_identity("luksDiscard");
2965 if (r < 0)
2966 return r;
2967
2968 break;
2969 }
2970
2971 r = parse_boolean(optarg);
2972 if (r < 0)
2973 return log_error_errno(r, "Failed to parse --luks-discard= parameter: %s", optarg);
2974
2975 r = json_variant_set_field_boolean(&arg_identity_extra, "luksDiscard", r);
2976 if (r < 0)
2977 return log_error_errno(r, "Failed to set discard field: %m");
2978
2979 break;
2980
cba11699
LP		 2981 case ARG_LUKS_OFFLINE_DISCARD:
2982 if (isempty(optarg)) {
2983 r = drop_from_identity("luksOfflineDiscard");
2984 if (r < 0)
2985 return r;
2986
2987 break;
2988 }
2989
2990 r = parse_boolean(optarg);
2991 if (r < 0)
2992 return log_error_errno(r, "Failed to parse --luks-offline-discard= parameter: %s", optarg);
2993
2994 r = json_variant_set_field_boolean(&arg_identity_extra, "luksOfflineDiscard", r);
2995 if (r < 0)
2996 return log_error_errno(r, "Failed to set offline discard field: %m");
2997
2998 break;
2999
4aa0a8ac
LP		 3000 case ARG_LUKS_VOLUME_KEY_SIZE:
3001 case ARG_LUKS_PBKDF_PARALLEL_THREADS:
3002 case ARG_RATE_LIMIT_BURST: {
3003 const char *field =
3004 c == ARG_LUKS_VOLUME_KEY_SIZE ? "luksVolumeKeySize" :
3005 c == ARG_LUKS_PBKDF_PARALLEL_THREADS ? "luksPbkdfParallelThreads" :
3006 c == ARG_RATE_LIMIT_BURST ? "rateLimitBurst" : NULL;
3007 unsigned n;
3008
3009 assert(field);
3010
3011 if (isempty(optarg)) {
3012 r = drop_from_identity(field);
3013 if (r < 0)
3014 return r;
3015 }
3016
3017 r = safe_atou(optarg, &n);
3018 if (r < 0)
3019 return log_error_errno(r, "Failed to parse %s parameter: %s", field, optarg);
3020
3021 r = json_variant_set_field_unsigned(&arg_identity_extra, field, n);
3022 if (r < 0)
3023 return log_error_errno(r, "Failed to set %s field: %m", field);
3024
3025 break;
3026 }
3027
3028 case ARG_UMASK: {
3029 mode_t m;
3030
3031 if (isempty(optarg)) {
3032 r = drop_from_identity("umask");
3033 if (r < 0)
3034 return r;
3035
3036 break;
3037 }
3038
3039 r = parse_mode(optarg, &m);
3040 if (r < 0)
3041 return log_error_errno(r, "Failed to parse umask: %m");
3042
3043 r = json_variant_set_field_integer(&arg_identity_extra, "umask", m);
3044 if (r < 0)
3045 return log_error_errno(r, "Failed to set umask field: %m");
3046
3047 break;
3048 }
3049
3050 case ARG_SSH_AUTHORIZED_KEYS: {
3051 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
3052 _cleanup_(strv_freep) char **l = NULL, **add = NULL;
3053
3054 if (isempty(optarg)) {
3055 r = drop_from_identity("sshAuthorizedKeys");
3056 if (r < 0)
3057 return r;
3058
3059 break;
3060 }
3061
3062 if (optarg[0] == '@') {
3063 _cleanup_fclose_ FILE *f = NULL;
3064
3065 /* If prefixed with '@' read from a file */
3066
3067 f = fopen(optarg+1, "re");
3068 if (!f)
3069 return log_error_errno(errno, "Failed to open '%s': %m", optarg+1);
3070
3071 for (;;) {
3072 _cleanup_free_ char *line = NULL;
3073
3074 r = read_line(f, LONG_LINE_MAX, &line);
3075 if (r < 0)
80ace4f2 3076 return log_error_errno(r, "Failed to read from '%s': %m", optarg+1);
4aa0a8ac
LP		 3077 if (r == 0)
3078 break;
3079
3080 if (isempty(line))
3081 continue;
3082
3083 if (line[0] == '#')
3084 continue;
3085
3086 r = strv_consume(&add, TAKE_PTR(line));
3087 if (r < 0)
3088 return log_oom();
3089 }
3090 } else {
3091 /* Otherwise, assume it's a literal key. Let's do some superficial checks
3092 * before accept it though. */
3093
3094 if (string_has_cc(optarg, NULL))
3095 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Authorized key contains control characters, refusing.");
3096 if (optarg[0] == '#')
3097 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Specified key is a comment?");
3098
3099 add = strv_new(optarg);
3100 if (!add)
3101 return log_oom();
3102 }
3103
3104 v = json_variant_ref(json_variant_by_key(arg_identity_extra_privileged, "sshAuthorizedKeys"));
3105 if (v) {
3106 r = json_variant_strv(v, &l);
3107 if (r < 0)
3108 return log_error_errno(r, "Failed to parse SSH authorized keys list: %m");
3109 }
3110
3111 r = strv_extend_strv(&l, add, true);
3112 if (r < 0)
3113 return log_oom();
3114
3115 v = json_variant_unref(v);
3116
3117 r = json_variant_new_array_strv(&v, l);
3118 if (r < 0)
3119 return log_oom();
3120
3121 r = json_variant_set_field(&arg_identity_extra_privileged, "sshAuthorizedKeys", v);
3122 if (r < 0)
3123 return log_error_errno(r, "Failed to set authorized keys: %m");
3124
3125 break;
3126 }
3127
3128 case ARG_NOT_BEFORE:
3129 case ARG_NOT_AFTER:
3130 case 'e': {
3131 const char *field;
3132 usec_t n;
3133
3134 field = c == ARG_NOT_BEFORE ? "notBeforeUSec" :
3135 IN_SET(c, ARG_NOT_AFTER, 'e') ? "notAfterUSec" : NULL;
3136
3137 assert(field);
3138
3139 if (isempty(optarg)) {
3140 r = drop_from_identity(field);
3141 if (r < 0)
3142 return r;
3143
3144 break;
3145 }
3146
3147 /* Note the minor discrepancy regarding -e parsing here: we support that for compat
3148 * reasons, and in the original useradd(8) implementation it accepts dates in the
3149 * format YYYY-MM-DD. Coincidentally, we accept dates formatted like that too, but
3150 * with greater precision. */
3151 r = parse_timestamp(optarg, &n);
3152 if (r < 0)
3153 return log_error_errno(r, "Failed to parse %s parameter: %m", field);
3154
3155 r = json_variant_set_field_unsigned(&arg_identity_extra, field, n);
3156 if (r < 0)
3157 return log_error_errno(r, "Failed to set %s field: %m", field);
3158 break;
3159 }
3160
3161 case ARG_PASSWORD_CHANGE_MIN:
3162 case ARG_PASSWORD_CHANGE_MAX:
3163 case ARG_PASSWORD_CHANGE_WARN:
3164 case ARG_PASSWORD_CHANGE_INACTIVE: {
3165 const char *field;
3166 usec_t n;
3167
3168 field = c == ARG_PASSWORD_CHANGE_MIN ? "passwordChangeMinUSec" :
3169 c == ARG_PASSWORD_CHANGE_MAX ? "passwordChangeMaxUSec" :
3170 c == ARG_PASSWORD_CHANGE_WARN ? "passwordChangeWarnUSec" :
3171 c == ARG_PASSWORD_CHANGE_INACTIVE ? "passwordChangeInactiveUSec" :
3172 NULL;
3173
3174 assert(field);
3175
3176 if (isempty(optarg)) {
3177 r = drop_from_identity(field);
3178 if (r < 0)
3179 return r;
3180
3181 break;
3182 }
3183
3184 r = parse_sec(optarg, &n);
3185 if (r < 0)
3186 return log_error_errno(r, "Failed to parse %s parameter: %m", field);
3187
3188 r = json_variant_set_field_unsigned(&arg_identity_extra, field, n);
3189 if (r < 0)
3190 return log_error_errno(r, "Failed to set %s field: %m", field);
3191 break;
3192 }
3193
3194 case ARG_STORAGE:
3195 case ARG_FS_TYPE:
3196 case ARG_LUKS_CIPHER:
3197 case ARG_LUKS_CIPHER_MODE:
3198 case ARG_LUKS_PBKDF_TYPE:
3199 case ARG_LUKS_PBKDF_HASH_ALGORITHM: {
3200
3201 const char *field =
3202 c == ARG_STORAGE ? "storage" :
d900701e 3203 c == ARG_FS_TYPE ? "fileSystemType" :
4aa0a8ac
LP		 3204 c == ARG_LUKS_CIPHER ? "luksCipher" :
3205 c == ARG_LUKS_CIPHER_MODE ? "luksCipherMode" :
3206 c == ARG_LUKS_PBKDF_TYPE ? "luksPbkdfType" :
3207 c == ARG_LUKS_PBKDF_HASH_ALGORITHM ? "luksPbkdfHashAlgorithm" : NULL;
3208
3209 assert(field);
3210
3211 if (isempty(optarg)) {
3212 r = drop_from_identity(field);
3213 if (r < 0)
3214 return r;
3215
3216 break;
3217 }
3218
3219 if (!string_is_safe(optarg))
3220 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Parameter for %s field not valid: %s", field, optarg);
3221
3222 r = json_variant_set_field_string(
3223 IN_SET(c, ARG_STORAGE, ARG_FS_TYPE) ?
3224 &arg_identity_extra_this_machine :
3225 &arg_identity_extra, field, optarg);
3226 if (r < 0)
3227 return log_error_errno(r, "Failed to set %s field: %m", field);
3228
3229 break;
3230 }
3231
3232 case ARG_LUKS_PBKDF_TIME_COST:
3233 case ARG_RATE_LIMIT_INTERVAL:
3234 case ARG_STOP_DELAY: {
3235 const char *field =
3236 c == ARG_LUKS_PBKDF_TIME_COST ? "luksPbkdfTimeCostUSec" :
3237 c == ARG_RATE_LIMIT_INTERVAL ? "rateLimitIntervalUSec" :
3238 c == ARG_STOP_DELAY ? "stopDelayUSec" :
3239 NULL;
3240 usec_t t;
3241
3242 assert(field);
3243
3244 if (isempty(optarg)) {
3245 r = drop_from_identity(field);
3246 if (r < 0)
3247 return r;
3248
3249 break;
3250 }
3251
3252 r = parse_sec(optarg, &t);
3253 if (r < 0)
3254 return log_error_errno(r, "Failed to parse %s field: %s", field, optarg);
3255
3256 r = json_variant_set_field_unsigned(&arg_identity_extra, field, t);
3257 if (r < 0)
3258 return log_error_errno(r, "Failed to set %s field: %m", field);
3259
3260 break;
3261 }
3262
3263 case 'G': {
3264 const char *p = optarg;
3265
3266 if (isempty(p)) {
3267 r = drop_from_identity("memberOf");
3268 if (r < 0)
3269 return r;
3270
3271 break;
3272 }
3273
3274 for (;;) {
3275 _cleanup_(json_variant_unrefp) JsonVariant *mo = NULL;
3276 _cleanup_strv_free_ char **list = NULL;
3277 _cleanup_free_ char *word = NULL;
3278
3279 r = extract_first_word(&p, &word, ",", 0);
3280 if (r < 0)
3281 return log_error_errno(r, "Failed to parse group list: %m");
3282 if (r == 0)
3283 break;
3284
7a8867ab 3285 if (!valid_user_group_name(word, 0))
4aa0a8ac
LP		 3286 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid group name %s.", word);
3287
3288 mo = json_variant_ref(json_variant_by_key(arg_identity_extra, "memberOf"));
3289
3290 r = json_variant_strv(mo, &list);
3291 if (r < 0)
3292 return log_error_errno(r, "Failed to parse group list: %m");
3293
3294 r = strv_extend(&list, word);
3295 if (r < 0)
3296 return log_oom();
3297
3298 strv_sort(list);
3299 strv_uniq(list);
3300
3301 mo = json_variant_unref(mo);
3302 r = json_variant_new_array_strv(&mo, list);
3303 if (r < 0)
3304 return log_error_errno(r, "Failed to create group list JSON: %m");
3305
3306 r = json_variant_set_field(&arg_identity_extra, "memberOf", mo);
3307 if (r < 0)
3308 return log_error_errno(r, "Failed to update group list: %m");
3309 }
3310
3311 break;
3312 }
3313
3314 case ARG_TASKS_MAX: {
3315 uint64_t u;
3316
3317 if (isempty(optarg)) {
3318 r = drop_from_identity("tasksMax");
3319 if (r < 0)
3320 return r;
3321 break;
3322 }
3323
3324 r = safe_atou64(optarg, &u);
3325 if (r < 0)
3326 return log_error_errno(r, "Failed to parse --tasks-max= parameter: %s", optarg);
3327
3328 r = json_variant_set_field_unsigned(&arg_identity_extra, "tasksMax", u);
3329 if (r < 0)
3330 return log_error_errno(r, "Failed to set tasksMax field: %m");
3331
3332 break;
3333 }
3334
3335 case ARG_MEMORY_MAX:
3336 case ARG_MEMORY_HIGH:
3337 case ARG_LUKS_PBKDF_MEMORY_COST: {
3338 const char *field =
3339 c == ARG_MEMORY_MAX ? "memoryMax" :
3340 c == ARG_MEMORY_HIGH ? "memoryHigh" :
3341 c == ARG_LUKS_PBKDF_MEMORY_COST ? "luksPbkdfMemoryCost" : NULL;
3342
3343 uint64_t u;
3344
3345 assert(field);
3346
3347 if (isempty(optarg)) {
3348 r = drop_from_identity(field);
3349 if (r < 0)
3350 return r;
3351 break;
3352 }
3353
3354 r = parse_size(optarg, 1024, &u);
3355 if (r < 0)
3356 return log_error_errno(r, "Failed to parse %s parameter: %s", field, optarg);
3357
3358 r = json_variant_set_field_unsigned(&arg_identity_extra_this_machine, field, u);
3359 if (r < 0)
3360 return log_error_errno(r, "Failed to set %s field: %m", field);
3361
3362 break;
3363 }
3364
3365 case ARG_CPU_WEIGHT:
3366 case ARG_IO_WEIGHT: {
3367 const char *field = c == ARG_CPU_WEIGHT ? "cpuWeight" :
3368 c == ARG_IO_WEIGHT ? "ioWeight" : NULL;
3369 uint64_t u;
3370
3371 assert(field);
3372
3373 if (isempty(optarg)) {
3374 r = drop_from_identity(field);
3375 if (r < 0)
3376 return r;
3377 break;
3378 }
3379
3380 r = safe_atou64(optarg, &u);
3381 if (r < 0)
3382 return log_error_errno(r, "Failed to parse --cpu-weight=/--io-weight= parameter: %s", optarg);
3383
3384 if (!CGROUP_WEIGHT_IS_OK(u))
3385 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Weight %" PRIu64 " is out of valid weight range.", u);
3386
3387 r = json_variant_set_field_unsigned(&arg_identity_extra, field, u);
3388 if (r < 0)
3389 return log_error_errno(r, "Failed to set %s field: %m", field);
3390
3391 break;
3392 }
3393
3394 case ARG_PKCS11_TOKEN_URI: {
3395 const char *p;
3396
0eb3be46 3397 if (streq(optarg, "list"))
f240cbb6 3398 return pkcs11_list_tokens();
0eb3be46 3399
4aa0a8ac
LP		 3400 /* If --pkcs11-token-uri= is specified we always drop everything old */
3401 FOREACH_STRING(p, "pkcs11TokenUri", "pkcs11EncryptedKey") {
3402 r = drop_from_identity(p);
3403 if (r < 0)
3404 return r;
3405 }
3406
3407 if (isempty(optarg)) {
3408 arg_pkcs11_token_uri = strv_free(arg_pkcs11_token_uri);
3409 break;
3410 }
3411
0eb3be46
LP		 3412 if (streq(optarg, "auto")) {
3413 _cleanup_free_ char *found = NULL;
4aa0a8ac 3414
f240cbb6 3415 r = pkcs11_find_token_auto(&found);
0eb3be46
LP		 3416 if (r < 0)
3417 return r;
3418 r = strv_consume(&arg_pkcs11_token_uri, TAKE_PTR(found));
3419 } else {
3420 if (!pkcs11_uri_valid(optarg))
3421 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Not a valid PKCS#11 URI: %s", optarg);
3422
3423 r = strv_extend(&arg_pkcs11_token_uri, optarg);
3424 }
4aa0a8ac
LP		 3425 if (r < 0)
3426 return r;
3427
3428 strv_uniq(arg_pkcs11_token_uri);
3429 break;
3430 }
3431
1c0c4a43
LP		 3432 case ARG_FIDO2_DEVICE: {
3433 const char *p;
3434
3435 if (streq(optarg, "list"))
fb2d839c 3436 return fido2_list_devices();
1c0c4a43
LP		 3437
3438 FOREACH_STRING(p, "fido2HmacCredential", "fido2HmacSalt") {
3439 r = drop_from_identity(p);
3440 if (r < 0)
3441 return r;
3442 }
3443
3444 if (isempty(optarg)) {
3445 arg_fido2_device = strv_free(arg_fido2_device);
3446 break;
3447 }
3448
3449 if (streq(optarg, "auto")) {
3450 _cleanup_free_ char *found = NULL;
3451
fb2d839c 3452 r = fido2_find_device_auto(&found);
1c0c4a43
LP		 3453 if (r < 0)
3454 return r;
3455
3456 r = strv_consume(&arg_fido2_device, TAKE_PTR(found));
3457 } else
3458 r = strv_extend(&arg_fido2_device, optarg);
1c0c4a43
LP		 3459 if (r < 0)
3460 return r;
3461
3462 strv_uniq(arg_fido2_device);
3463 break;
3464 }
3465
17e7561a
LP		 3466 case ARG_FIDO2_WITH_PIN: {
3467 bool lock_with_pin;
3468
3469 r = parse_boolean_argument("--fido2-with-client-pin=", optarg, &lock_with_pin);
3470 if (r < 0)
3471 return r;
3472
3473 SET_FLAG(arg_fido2_lock_with, FIDO2ENROLL_PIN, lock_with_pin);
3474 break;
3475 }
3476
3477 case ARG_FIDO2_WITH_UP: {
3478 bool lock_with_up;
3479
3480 r = parse_boolean_argument("--fido2-with-user-presence=", optarg, &lock_with_up);
3481 if (r < 0)
3482 return r;
3483
3484 SET_FLAG(arg_fido2_lock_with, FIDO2ENROLL_UP, lock_with_up);
3485 break;
3486 }
3487
3488 case ARG_FIDO2_WITH_UV: {
3489 bool lock_with_uv;
3490
3491 r = parse_boolean_argument("--fido2-with-user-verification=", optarg, &lock_with_uv);
3492 if (r < 0)
3493 return r;
3494
3495 SET_FLAG(arg_fido2_lock_with, FIDO2ENROLL_UV, lock_with_uv);
3496 break;
3497 }
3498
80c41552
LP		 3499 case ARG_RECOVERY_KEY: {
3500 const char *p;
3501
3502 r = parse_boolean(optarg);
3503 if (r < 0)
3504 return log_error_errno(r, "Failed to parse --recovery-key= argument: %s", optarg);
3505
3506 arg_recovery_key = r;
3507
3508 FOREACH_STRING(p, "recoveryKey", "recoveryKeyType") {
3509 r = drop_from_identity(p);
3510 if (r < 0)
3511 return r;
3512 }
3513
3514 break;
3515 }
3516
4aa0a8ac 3517 case 'j':
4aa0a8ac
LP		 3518 arg_json_format_flags = JSON_FORMAT_PRETTY_AUTO|JSON_FORMAT_COLOR_AUTO;
3519 break;
3520
3521 case ARG_JSON:
b1e8f46c 3522 r = parse_json_argument(optarg, &arg_json_format_flags);
6a01ea4a
LP		 3523 if (r <= 0)
3524 return r;
4aa0a8ac
LP		 3525
3526 break;
3527
3528 case 'E':
3529 if (arg_export_format == EXPORT_FORMAT_FULL)
3530 arg_export_format = EXPORT_FORMAT_STRIPPED;
3531 else if (arg_export_format == EXPORT_FORMAT_STRIPPED)
3532 arg_export_format = EXPORT_FORMAT_MINIMAL;
3533 else
3534 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Specifying -E more than twice is not supported.");
3535
6a01ea4a 3536 arg_json_format_flags &= ~JSON_FORMAT_OFF;
4aa0a8ac
LP		 3537 if (arg_json_format_flags == 0)
3538 arg_json_format_flags = JSON_FORMAT_PRETTY_AUTO|JSON_FORMAT_COLOR_AUTO;
3539 break;
3540
3541 case ARG_EXPORT_FORMAT:
3542 if (streq(optarg, "full"))
3543 arg_export_format = EXPORT_FORMAT_FULL;
3544 else if (streq(optarg, "stripped"))
3545 arg_export_format = EXPORT_FORMAT_STRIPPED;
3546 else if (streq(optarg, "minimal"))
3547 arg_export_format = EXPORT_FORMAT_MINIMAL;
3548 else if (streq(optarg, "help")) {
3549 puts("full\n"
3550 "stripped\n"
3551 "minimal");
3552 return 0;
3553 }
3554
3555 break;
3556
3557 case ARG_AND_RESIZE:
3558 arg_and_resize = true;
3559 break;
3560
3561 case ARG_AND_CHANGE_PASSWORD:
3562 arg_and_change_password = true;
3563 break;
3564
86019efa
LP		 3565 case ARG_DROP_CACHES: {
3566 bool drop_caches;
3567
3568 if (isempty(optarg)) {
3569 r = drop_from_identity("dropCaches");
3570 if (r < 0)
3571 return r;
3572 }
3573
3574 r = parse_boolean_argument("--drop-caches=", optarg, &drop_caches);
3575 if (r < 0)
3576 return r;
3577
3578 r = json_variant_set_field_boolean(&arg_identity_extra, "dropCaches", r);
3579 if (r < 0)
3580 return log_error_errno(r, "Failed to set drop caches field: %m");
3581
3582 break;
3583 }
3584
4aa0a8ac
LP		 3585 case '?':
3586 return -EINVAL;
3587
3588 default:
04499a70 3589 assert_not_reached();
4aa0a8ac
LP		 3590 }
3591 }
3592
1c0c4a43 3593 if (!strv_isempty(arg_pkcs11_token_uri) || !strv_isempty(arg_fido2_device))
4aa0a8ac
LP		 3594 arg_and_change_password = true;
3595
3596 if (arg_disk_size != UINT64_MAX || arg_disk_size_relative != UINT64_MAX)
3597 arg_and_resize = true;
3598
3599 return 1;
3600}
3601
cc9886bc
LP		 3602static int redirect_bus_mgr(void) {
3603 const char *suffix;
3604
3605 /* Talk to a different service if that's requested. (The same env var is also understood by homed, so
3606 * that it is relatively easily possible to invoke a second instance of homed for debug purposes and
3607 * have homectl talk to it, without colliding with the host version. This is handy when operating
3608 * from a homed-managed account.) */
3609
3610 suffix = getenv("SYSTEMD_HOME_DEBUG_SUFFIX");
3611 if (suffix) {
3612 static BusLocator locator = {
3613 .path = "/org/freedesktop/home1",
3614 .interface = "org.freedesktop.home1.Manager",
3615 };
3616
3617 /* Yes, we leak this memory, but there's little point to collect this, given that we only do
3618 * this in a debug environment, do it only once, and the string shall live for out entire
3619 * process runtime. */
3620
3621 locator.destination = strjoin("org.freedesktop.home1.", suffix);
3622 if (!locator.destination)
3623 return log_oom();
3624
3625 bus_mgr = &locator;
3626 } else
3627 bus_mgr = bus_home_mgr;
3628
3629 return 0;
3630}
3631
4aa0a8ac
LP		 3632static int run(int argc, char *argv[]) {
3633 static const Verb verbs[] = {
d1f6e01e
LP		 3634 { "help", VERB_ANY, VERB_ANY, 0, help },
3635 { "list", VERB_ANY, 1, VERB_DEFAULT, list_homes },
3636 { "activate", 2, VERB_ANY, 0, activate_home },
3637 { "deactivate", 2, VERB_ANY, 0, deactivate_home },
3638 { "inspect", VERB_ANY, VERB_ANY, 0, inspect_home },
3639 { "authenticate", VERB_ANY, VERB_ANY, 0, authenticate_home },
3640 { "create", VERB_ANY, 2, 0, create_home },
3641 { "remove", 2, VERB_ANY, 0, remove_home },
3642 { "update", VERB_ANY, 2, 0, update_home },
3643 { "passwd", VERB_ANY, 2, 0, passwd_home },
3644 { "resize", 2, 3, 0, resize_home },
3645 { "lock", 2, VERB_ANY, 0, lock_home },
3646 { "unlock", 2, VERB_ANY, 0, unlock_home },
3647 { "with", 2, VERB_ANY, 0, with_home },
3648 { "lock-all", VERB_ANY, 1, 0, lock_all_homes },
3649 { "deactivate-all", VERB_ANY, 1, 0, deactivate_all_homes },
4aa0a8ac
LP		 3650 {}
3651 };
3652
3653 int r;
3654
d2acb93d 3655 log_setup();
4aa0a8ac 3656
cc9886bc
LP		 3657 r = redirect_bus_mgr();
3658 if (r < 0)
3659 return r;
3660
4aa0a8ac
LP		 3661 r = parse_argv(argc, argv);
3662 if (r <= 0)
3663 return r;
3664
3665 return dispatch_verb(argc, argv, verbs, NULL);
3666}
3667
b9bfa250 3668DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.