]> git.ipfire.org Git - thirdparty/systemd.git/blame_incremental - src/analyze/analyze.c
projects / thirdparty / systemd.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
userdb: suppress creation of empty userdb dirs
[thirdparty/systemd.git] / src / analyze / analyze.c
... / ...
CommitLineData
1/* SPDX-License-Identifier: LGPL-2.1-or-later */
2/***
3 Copyright © 2013 Simon Peeters
4***/
5
6#include <getopt.h>
7#include <locale.h>
8#include <stdio.h>
9#include <stdlib.h>
10
11#include "sd-bus.h"
12#include "sd-json.h"
13
14#include "alloc-util.h"
15#include "analyze.h"
16#include "analyze-architectures.h"
17#include "analyze-blame.h"
18#include "analyze-calendar.h"
19#include "analyze-capability.h"
20#include "analyze-cat-config.h"
21#include "analyze-chid.h"
22#include "analyze-compare-versions.h"
23#include "analyze-condition.h"
24#include "analyze-critical-chain.h"
25#include "analyze-dot.h"
26#include "analyze-dump.h"
27#include "analyze-exit-status.h"
28#include "analyze-fdstore.h"
29#include "analyze-filesystems.h"
30#include "analyze-has-tpm2.h"
31#include "analyze-image-policy.h"
32#include "analyze-inspect-elf.h"
33#include "analyze-log-control.h"
34#include "analyze-malloc.h"
35#include "analyze-pcrs.h"
36#include "analyze-plot.h"
37#include "analyze-security.h"
38#include "analyze-service-watchdogs.h"
39#include "analyze-smbios11.h"
40#include "analyze-srk.h"
41#include "analyze-syscall-filter.h"
42#include "analyze-time.h"
43#include "analyze-timespan.h"
44#include "analyze-timestamp.h"
45#include "analyze-unit-files.h"
46#include "analyze-unit-gdb.h"
47#include "analyze-unit-paths.h"
48#include "analyze-unit-shell.h"
49#include "analyze-verify.h"
50#include "analyze-verify-util.h"
51#include "build.h"
52#include "bus-error.h"
53#include "bus-unit-util.h"
54#include "bus-util.h"
55#include "calendarspec.h"
56#include "dissect-image.h"
57#include "extract-word.h"
58#include "image-policy.h"
59#include "log.h"
60#include "loop-util.h"
61#include "main-func.h"
62#include "mount-util.h"
63#include "pager.h"
64#include "parse-argument.h"
65#include "parse-util.h"
66#include "path-util.h"
67#include "pretty-print.h"
68#include "runtime-scope.h"
69#include "string-table.h"
70#include "string-util.h"
71#include "strv.h"
72#include "time-util.h"
73#include "unit-def.h"
74#include "unit-name.h"
75#include "verbs.h"
76
77DotMode arg_dot = DEP_ALL;
78CapabilityMode arg_capability = CAPABILITY_LITERAL;
79char **arg_dot_from_patterns = NULL, **arg_dot_to_patterns = NULL;
80usec_t arg_fuzz = 0;
81PagerFlags arg_pager_flags = 0;
82CatFlags arg_cat_flags = 0;
83BusTransport arg_transport = BUS_TRANSPORT_LOCAL;
84char *arg_debugger = NULL;
85char **arg_debugger_args = NULL;
86const char *arg_host = NULL;
87RuntimeScope arg_runtime_scope = RUNTIME_SCOPE_SYSTEM;
88RecursiveErrors arg_recursive_errors = _RECURSIVE_ERRORS_INVALID;
89bool arg_man = true;
90bool arg_generators = false;
91const char *arg_instance = "test_instance";
92double arg_svg_timescale = 1.0;
93bool arg_detailed_svg = false;
94char *arg_root = NULL;
95static char *arg_image = NULL;
96char *arg_security_policy = NULL;
97bool arg_offline = false;
98unsigned arg_threshold = 100;
99unsigned arg_iterations = 1;
100usec_t arg_base_time = USEC_INFINITY;
101char *arg_unit = NULL;
102sd_json_format_flags_t arg_json_format_flags = SD_JSON_FORMAT_OFF;
103bool arg_quiet = false;
104char *arg_profile = NULL;
105bool arg_legend = true;
106bool arg_table = false;
107ImagePolicy *arg_image_policy = NULL;
108char *arg_drm_device_path = NULL;
109
110STATIC_DESTRUCTOR_REGISTER(arg_dot_from_patterns, strv_freep);
111STATIC_DESTRUCTOR_REGISTER(arg_dot_to_patterns, strv_freep);
112STATIC_DESTRUCTOR_REGISTER(arg_debugger, freep);
113STATIC_DESTRUCTOR_REGISTER(arg_debugger_args, strv_freep);
114STATIC_DESTRUCTOR_REGISTER(arg_root, freep);
115STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
116STATIC_DESTRUCTOR_REGISTER(arg_security_policy, freep);
117STATIC_DESTRUCTOR_REGISTER(arg_drm_device_path, freep);
118STATIC_DESTRUCTOR_REGISTER(arg_unit, freep);
119STATIC_DESTRUCTOR_REGISTER(arg_profile, freep);
120STATIC_DESTRUCTOR_REGISTER(arg_image_policy, image_policy_freep);
121
122int acquire_bus(sd_bus **bus, bool *use_full_bus) {
123 int r;
124
125 if (use_full_bus && *use_full_bus) {
126 r = bus_connect_transport(arg_transport, arg_host, arg_runtime_scope, bus);
127 if (IN_SET(r, 0, -EHOSTDOWN))
128 return r;
129
130 *use_full_bus = false;
131 }
132
133 return bus_connect_transport_systemd(arg_transport, arg_host, arg_runtime_scope, bus);
134}
135
136int bus_get_unit_property_strv(sd_bus *bus, const char *path, const char *property, char ***strv) {
137 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
138 int r;
139
140 assert(bus);
141 assert(path);
142 assert(property);
143 assert(strv);
144
145 r = sd_bus_get_property_strv(
146 bus,
147 "org.freedesktop.systemd1",
148 path,
149 "org.freedesktop.systemd1.Unit",
150 property,
151 &error,
152 strv);
153 if (r < 0)
154 return log_error_errno(r, "Failed to get unit property %s: %s", property, bus_error_message(&error, r));
155
156 return 0;
157}
158
159void time_parsing_hint(const char *p, bool calendar, bool timestamp, bool timespan) {
160 if (calendar && calendar_spec_from_string(p, NULL) >= 0)
161 log_notice("Hint: this expression is a valid calendar specification. "
162 "Use 'systemd-analyze calendar \"%s\"' instead?", p);
163 if (timestamp && parse_timestamp(p, NULL) >= 0)
164 log_notice("Hint: this expression is a valid timestamp. "
165 "Use 'systemd-analyze timestamp \"%s\"' instead?", p);
166 if (timespan && parse_time(p, NULL, USEC_PER_SEC) >= 0)
167 log_notice("Hint: this expression is a valid timespan. "
168 "Use 'systemd-analyze timespan \"%s\"' instead?", p);
169}
170
171static int verb_transient_settings(int argc, char *argv[], void *userdata) {
172 assert(argc >= 2);
173
174 pager_open(arg_pager_flags);
175
176 bool first = true;
177 STRV_FOREACH(arg, strv_skip(argv, 1)) {
178 UnitType t;
179
180 t = unit_type_from_string(*arg);
181 if (t < 0)
182 return log_error_errno(t, "Invalid unit type '%s'.", *arg);
183
184 if (!first)
185 puts("");
186
187 bus_dump_transient_settings(t);
188 first = false;
189 }
190
191 return 0;
192}
193
194static int help(int argc, char *argv[], void *userdata) {
195 _cleanup_free_ char *link = NULL, *dot_link = NULL;
196 int r;
197
198 pager_open(arg_pager_flags);
199
200 r = terminal_urlify_man("systemd-analyze", "1", &link);
201 if (r < 0)
202 return log_oom();
203
204 /* Not using terminal_urlify_man() for this, since we don't want the "man page" text suffix in this case. */
205 r = terminal_urlify("man:dot(1)", "dot(1)", &dot_link);
206 if (r < 0)
207 return log_oom();
208
209 printf("%1$s [OPTIONS...] COMMAND ...\n\n"
210 "%5$sProfile systemd, show unit dependencies, check unit files.%6$s\n"
211 "\n%3$sBoot Analysis:%4$s\n"
212 " [time] Print time required to boot the machine\n"
213 " blame Print list of running units ordered by\n"
214 " time to init\n"
215 " critical-chain [UNIT...] Print a tree of the time critical chain\n"
216 " of units\n"
217 "\n%3$sDependency Analysis:%4$s\n"
218 " plot Output SVG graphic showing service\n"
219 " initialization\n"
220 " dot [UNIT...] Output dependency graph in %7$s format\n"
221 " dump [PATTERN...] Output state serialization of service\n"
222 " manager\n"
223 "\n%3$sConfiguration Files and Search Paths:%4$s\n"
224 " cat-config NAME|PATH... Show configuration file and drop-ins\n"
225 " unit-files List files and symlinks for units\n"
226 " unit-paths List load directories for units\n"
227 "\n%3$sEnumerate OS Concepts:%4$s\n"
228 " exit-status [STATUS...] List exit status definitions\n"
229 " capability [CAP...] List capability definitions\n"
230 " syscall-filter [NAME...] List syscalls in seccomp filters\n"
231 " filesystems [NAME...] List known filesystems\n"
232 " architectures [NAME...] List known architectures\n"
233 " smbios11 List strings passed via SMBIOS Type #11\n"
234 " chid List local CHIDs\n"
235 " transient-settings TYPE... List transient settings for unit TYPE\n"
236 "\n%3$sExpression Evaluation:%4$s\n"
237 " condition CONDITION... Evaluate conditions and asserts\n"
238 " compare-versions VERSION1 [OP] VERSION2\n"
239 " Compare two version strings\n"
240 " image-policy POLICY... Analyze image policy string\n"
241 "\n%3$sClock & Time:%4$s\n"
242 " calendar SPEC... Validate repetitive calendar time\n"
243 " events\n"
244 " timestamp TIMESTAMP... Validate a timestamp\n"
245 " timespan SPAN... Validate a time span\n"
246 "\n%3$sUnit & Service Analysis:%4$s\n"
247 " verify FILE... Check unit files for correctness\n"
248 " security [UNIT...] Analyze security of unit\n"
249 " fdstore SERVICE... Show file descriptor store contents of service\n"
250 " malloc [D-BUS SERVICE...] Dump malloc stats of a D-Bus service\n"
251 " unit-gdb SERVICE Attach a debugger to the given running service\n"
252 " unit-shell SERVICE [Command]\n"
253 " Run command on the namespace of the service\n"
254 "\n%3$sExecutable Analysis:%4$s\n"
255 " inspect-elf FILE... Parse and print ELF package metadata\n"
256 "\n%3$sTPM Operations:%4$s\n"
257 " has-tpm2 Report whether TPM2 support is available\n"
258 " pcrs [PCR...] Show TPM2 PCRs and their names\n"
259 " srk [>FILE] Write TPM2 SRK (to FILE)\n"
260 "\n%3$sOptions:%4$s\n"
261 " --recursive-errors=MODE Control which units are verified\n"
262 " --offline=BOOL Perform a security review on unit file(s)\n"
263 " --threshold=N Exit with a non-zero status when overall\n"
264 " exposure level is over threshold value\n"
265 " --security-policy=PATH Use custom JSON security policy instead\n"
266 " of built-in one\n"
267 " --json=pretty|short|off Generate JSON output of the security\n"
268 " analysis table, or plot's raw time data\n"
269 " --no-pager Do not pipe output into a pager\n"
270 " --no-legend Disable column headers and hints in plot\n"
271 " with either --table or --json=\n"
272 " --system Operate on system systemd instance\n"
273 " --user Operate on user systemd instance\n"
274 " --global Operate on global user configuration\n"
275 " -H --host=[USER@]HOST Operate on remote host\n"
276 " -M --machine=CONTAINER Operate on local container\n"
277 " --order Show only order in the graph\n"
278 " --require Show only requirement in the graph\n"
279 " --from-pattern=GLOB Show only origins in the graph\n"
280 " --to-pattern=GLOB Show only destinations in the graph\n"
281 " --fuzz=SECONDS Also print services which finished SECONDS\n"
282 " earlier than the latest in the branch\n"
283 " --man[=BOOL] Do [not] check for existence of man pages\n"
284 " --generators[=BOOL] Do [not] run unit generators\n"
285 " (requires privileges)\n"
286 " --instance=NAME Specify fallback instance name for template units\n"
287 " --iterations=N Show the specified number of iterations\n"
288 " --base-time=TIMESTAMP Calculate calendar times relative to\n"
289 " specified time\n"
290 " --profile=name|PATH Include the specified profile in the\n"
291 " security review of the unit(s)\n"
292 " --unit=UNIT Evaluate conditions and asserts of unit\n"
293 " --table Output plot's raw time data as a table\n"
294 " --scale-svg=FACTOR Stretch x-axis of plot by FACTOR (default: 1.0)\n"
295 " --detailed Add more details to SVG plot,\n"
296 " e.g. show activation timestamps\n"
297 " -h --help Show this help\n"
298 " --version Show package version\n"
299 " -q --quiet Do not emit hints\n"
300 " --tldr Skip comments and empty lines\n"
301 " --root=PATH Operate on an alternate filesystem root\n"
302 " --image=PATH Operate on disk image as filesystem root\n"
303 " --image-policy=POLICY Specify disk image dissection policy\n"
304 " -m --mask Parse parameter as numeric capability mask\n"
305 " --drm-device=PATH Use this DRM device sysfs path to get EDID\n"
306 " --debugger=DEBUGGER Use the given debugger\n"
307 " -A --debugger-arguments=ARGS\n"
308 " Pass the given arguments to the debugger\n"
309
310 "\nSee the %2$s for details.\n",
311 program_invocation_short_name,
312 link,
313 ansi_underline(),
314 ansi_normal(),
315 ansi_highlight(),
316 ansi_normal(),
317 dot_link);
318
319 /* When updating this list, including descriptions, apply changes to
320 * shell-completion/bash/systemd-analyze and shell-completion/zsh/_systemd-analyze too. */
321
322 return 0;
323}
324
325static int parse_argv(int argc, char *argv[]) {
326 enum {
327 ARG_VERSION = 0x100,
328 ARG_ORDER,
329 ARG_REQUIRE,
330 ARG_ROOT,
331 ARG_IMAGE,
332 ARG_IMAGE_POLICY,
333 ARG_SYSTEM,
334 ARG_USER,
335 ARG_GLOBAL,
336 ARG_DOT_FROM_PATTERN,
337 ARG_DOT_TO_PATTERN,
338 ARG_FUZZ,
339 ARG_NO_PAGER,
340 ARG_MAN,
341 ARG_GENERATORS,
342 ARG_INSTANCE,
343 ARG_ITERATIONS,
344 ARG_BASE_TIME,
345 ARG_RECURSIVE_ERRORS,
346 ARG_OFFLINE,
347 ARG_THRESHOLD,
348 ARG_SECURITY_POLICY,
349 ARG_JSON,
350 ARG_PROFILE,
351 ARG_TABLE,
352 ARG_NO_LEGEND,
353 ARG_TLDR,
354 ARG_SCALE_FACTOR_SVG,
355 ARG_DETAILED_SVG,
356 ARG_DRM_DEVICE_PATH,
357 ARG_DEBUGGER,
358 };
359
360 static const struct option options[] = {
361 { "help", no_argument, NULL, 'h' },
362 { "version", no_argument, NULL, ARG_VERSION },
363 { "quiet", no_argument, NULL, 'q' },
364 { "order", no_argument, NULL, ARG_ORDER },
365 { "require", no_argument, NULL, ARG_REQUIRE },
366 { "root", required_argument, NULL, ARG_ROOT },
367 { "image", required_argument, NULL, ARG_IMAGE },
368 { "image-policy", required_argument, NULL, ARG_IMAGE_POLICY },
369 { "recursive-errors" , required_argument, NULL, ARG_RECURSIVE_ERRORS },
370 { "offline", required_argument, NULL, ARG_OFFLINE },
371 { "threshold", required_argument, NULL, ARG_THRESHOLD },
372 { "security-policy", required_argument, NULL, ARG_SECURITY_POLICY },
373 { "system", no_argument, NULL, ARG_SYSTEM },
374 { "user", no_argument, NULL, ARG_USER },
375 { "global", no_argument, NULL, ARG_GLOBAL },
376 { "from-pattern", required_argument, NULL, ARG_DOT_FROM_PATTERN },
377 { "to-pattern", required_argument, NULL, ARG_DOT_TO_PATTERN },
378 { "fuzz", required_argument, NULL, ARG_FUZZ },
379 { "no-pager", no_argument, NULL, ARG_NO_PAGER },
380 { "man", optional_argument, NULL, ARG_MAN },
381 { "generators", optional_argument, NULL, ARG_GENERATORS },
382 { "instance", required_argument, NULL, ARG_INSTANCE },
383 { "host", required_argument, NULL, 'H' },
384 { "machine", required_argument, NULL, 'M' },
385 { "iterations", required_argument, NULL, ARG_ITERATIONS },
386 { "base-time", required_argument, NULL, ARG_BASE_TIME },
387 { "unit", required_argument, NULL, 'U' },
388 { "json", required_argument, NULL, ARG_JSON },
389 { "profile", required_argument, NULL, ARG_PROFILE },
390 { "table", optional_argument, NULL, ARG_TABLE },
391 { "no-legend", optional_argument, NULL, ARG_NO_LEGEND },
392 { "tldr", no_argument, NULL, ARG_TLDR },
393 { "mask", no_argument, NULL, 'm' },
394 { "scale-svg", required_argument, NULL, ARG_SCALE_FACTOR_SVG },
395 { "detailed", no_argument, NULL, ARG_DETAILED_SVG },
396 { "drm-device", required_argument, NULL, ARG_DRM_DEVICE_PATH },
397 { "debugger", required_argument, NULL, ARG_DEBUGGER },
398 { "debugger-arguments", required_argument, NULL, 'A' },
399 {}
400 };
401
402 bool reorder = false;
403 int r, c, unit_shell = -1;
404
405 assert(argc >= 0);
406 assert(argv);
407
408 /* Resetting to 0 forces the invocation of an internal initialization routine of getopt_long()
409 * that checks for GNU extensions in optstring ('-' or '+; at the beginning). */
410 optind = 0;
411
412 for (;;) {
413 static const char option_string[] = "-hqH:M:U:mA:";
414
415 c = getopt_long(argc, argv, option_string + reorder, options, NULL);
416 if (c < 0)
417 break;
418
419 switch (c) {
420
421 case 1: /* getopt_long() returns 1 if "-" was the first character of the option string, and a
422 * non-option argument was discovered. */
423
424 assert(!reorder);
425
426 /* We generally are fine with the fact that getopt_long() reorders the command line, and looks
427 * for switches after the main verb. However, for "unit-shell" we really don't want that, since we
428 * want that switches specified after the service name are passed to the program to execute,
429 * and not processed by us. To make this possible, we'll first invoke getopt_long() with
430 * reordering disabled (i.e. with the "-" prefix in the option string), looking for the first
431 * non-option parameter. If it's the verb "unit-shell" we remember its position and continue
432 * processing options. In this case, as soon as we hit the next non-option argument we found
433 * the service name, and stop further processing. If the first non-option argument is any other
434 * verb than "unit-shell" we switch to normal reordering mode and continue processing arguments
435 * normally. */
436
437 if (unit_shell >= 0) {
438 optind--; /* don't process this argument, go one step back */
439 goto done;
440 }
441 if (streq(optarg, "unit-shell"))
442 /* Remember the position of the "unit_shell" verb, and continue processing normally. */
443 unit_shell = optind - 1;
444 else {
445 int saved_optind;
446
447 /* Ok, this is some other verb. In this case, turn on reordering again, and continue
448 * processing normally. */
449 reorder = true;
450
451 /* We changed the option string. getopt_long() only looks at it again if we invoke it
452 * at least once with a reset option index. Hence, let's reset the option index here,
453 * then invoke getopt_long() again (ignoring what it has to say, after all we most
454 * likely already processed it), and the bump the option index so that we read the
455 * intended argument again. */
456 saved_optind = optind;
457 optind = 0;
458 (void) getopt_long(argc, argv, option_string + reorder, options, NULL);
459 optind = saved_optind - 1; /* go one step back, process this argument again */
460 }
461
462 break;
463
464 case 'h':
465 return help(0, NULL, NULL);
466
467 case ARG_VERSION:
468 return version();
469
470 case 'q':
471 arg_quiet = true;
472 break;
473
474 case ARG_RECURSIVE_ERRORS:
475 if (streq(optarg, "help")) {
476 DUMP_STRING_TABLE(recursive_errors, RecursiveErrors, _RECURSIVE_ERRORS_MAX);
477 return 0;
478 }
479 r = recursive_errors_from_string(optarg);
480 if (r < 0)
481 return log_error_errno(r, "Unknown mode passed to --recursive-errors='%s'.", optarg);
482
483 arg_recursive_errors = r;
484 break;
485
486 case ARG_ROOT:
487 r = parse_path_argument(optarg, /* suppress_root= */ true, &arg_root);
488 if (r < 0)
489 return r;
490 break;
491
492 case ARG_IMAGE:
493 r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_image);
494 if (r < 0)
495 return r;
496 break;
497
498 case ARG_IMAGE_POLICY:
499 r = parse_image_policy_argument(optarg, &arg_image_policy);
500 if (r < 0)
501 return r;
502 break;
503
504 case ARG_SYSTEM:
505 arg_runtime_scope = RUNTIME_SCOPE_SYSTEM;
506 break;
507
508 case ARG_USER:
509 arg_runtime_scope = RUNTIME_SCOPE_USER;
510 break;
511
512 case ARG_GLOBAL:
513 arg_runtime_scope = RUNTIME_SCOPE_GLOBAL;
514 break;
515
516 case ARG_ORDER:
517 arg_dot = DEP_ORDER;
518 break;
519
520 case ARG_REQUIRE:
521 arg_dot = DEP_REQUIRE;
522 break;
523
524 case ARG_DOT_FROM_PATTERN:
525 if (strv_extend(&arg_dot_from_patterns, optarg) < 0)
526 return log_oom();
527
528 break;
529
530 case ARG_DOT_TO_PATTERN:
531 if (strv_extend(&arg_dot_to_patterns, optarg) < 0)
532 return log_oom();
533
534 break;
535
536 case ARG_FUZZ:
537 r = parse_sec(optarg, &arg_fuzz);
538 if (r < 0)
539 return r;
540 break;
541
542 case ARG_NO_PAGER:
543 arg_pager_flags |= PAGER_DISABLE;
544 break;
545
546 case 'H':
547 arg_transport = BUS_TRANSPORT_REMOTE;
548 arg_host = optarg;
549 break;
550
551 case 'M':
552 r = parse_machine_argument(optarg, &arg_host, &arg_transport);
553 if (r < 0)
554 return r;
555 break;
556
557 case ARG_MAN:
558 r = parse_boolean_argument("--man", optarg, &arg_man);
559 if (r < 0)
560 return r;
561 break;
562
563 case ARG_GENERATORS:
564 r = parse_boolean_argument("--generators", optarg, &arg_generators);
565 if (r < 0)
566 return r;
567 break;
568
569 case ARG_INSTANCE:
570 arg_instance = optarg;
571 break;
572
573 case ARG_OFFLINE:
574 r = parse_boolean_argument("--offline", optarg, &arg_offline);
575 if (r < 0)
576 return r;
577 break;
578
579 case ARG_THRESHOLD:
580 r = safe_atou(optarg, &arg_threshold);
581 if (r < 0 || arg_threshold > 100)
582 return log_error_errno(r < 0 ? r : SYNTHETIC_ERRNO(EINVAL), "Failed to parse threshold: %s", optarg);
583
584 break;
585
586 case ARG_SECURITY_POLICY:
587 r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_security_policy);
588 if (r < 0)
589 return r;
590 break;
591
592 case ARG_JSON:
593 r = parse_json_argument(optarg, &arg_json_format_flags);
594 if (r <= 0)
595 return r;
596 break;
597
598 case ARG_ITERATIONS:
599 r = safe_atou(optarg, &arg_iterations);
600 if (r < 0)
601 return log_error_errno(r, "Failed to parse iterations: %s", optarg);
602 break;
603
604 case ARG_BASE_TIME:
605 r = parse_timestamp(optarg, &arg_base_time);
606 if (r < 0)
607 return log_error_errno(r, "Failed to parse --base-time= parameter: %s", optarg);
608 break;
609
610 case ARG_PROFILE:
611 if (isempty(optarg))
612 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Profile file name is empty");
613
614 if (is_path(optarg)) {
615 r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_profile);
616 if (r < 0)
617 return r;
618 if (!endswith(arg_profile, ".conf"))
619 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Profile file name must end with .conf: %s", arg_profile);
620 } else {
621 r = free_and_strdup(&arg_profile, optarg);
622 if (r < 0)
623 return log_oom();
624 }
625
626 break;
627
628 case 'U': {
629 _cleanup_free_ char *mangled = NULL;
630
631 r = unit_name_mangle(optarg, UNIT_NAME_MANGLE_WARN, &mangled);
632 if (r < 0)
633 return log_error_errno(r, "Failed to mangle unit name %s: %m", optarg);
634
635 free_and_replace(arg_unit, mangled);
636 break;
637 }
638
639 case ARG_TABLE:
640 arg_table = true;
641 break;
642
643 case ARG_NO_LEGEND:
644 arg_legend = false;
645 break;
646
647 case ARG_TLDR:
648 arg_cat_flags = CAT_TLDR;
649 break;
650
651 case 'm':
652 arg_capability = CAPABILITY_MASK;
653 break;
654
655 case ARG_SCALE_FACTOR_SVG:
656 arg_svg_timescale = strtod(optarg, NULL);
657 break;
658
659 case ARG_DETAILED_SVG:
660 arg_detailed_svg = true;
661 break;
662
663 case ARG_DRM_DEVICE_PATH:
664 r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_drm_device_path);
665 if (r < 0)
666 return r;
667 break;
668
669 case ARG_DEBUGGER:
670 r = free_and_strdup_warn(&arg_debugger, optarg);
671 if (r < 0)
672 return r;
673 break;
674
675 case 'A': {
676 _cleanup_strv_free_ char **l = NULL;
677 r = strv_split_full(&l, optarg, WHITESPACE, EXTRACT_UNQUOTE);
678 if (r < 0)
679 return log_error_errno(r, "Failed to parse debugger arguments '%s': %m", optarg);
680 strv_free_and_replace(arg_debugger_args, l);
681 break;
682 }
683
684 case '?':
685 return -EINVAL;
686
687 default:
688 assert_not_reached();
689 }
690 }
691
692done:
693 if (unit_shell >= 0) {
694 char *t;
695
696 /* We found the "unit-shell" verb while processing the argument list. Since we turned off reordering of the
697 * argument list initially let's readjust it now, and move the "unit-shell" verb to the back. */
698
699 optind -= 1; /* place the option index where the "unit-shell" verb will be placed */
700
701 t = argv[unit_shell];
702 for (int i = unit_shell; i < optind; i++)
703 argv[i] = argv[i+1];
704 argv[optind] = t;
705 }
706
707 if (arg_offline && !streq_ptr(argv[optind], "security"))
708 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
709 "Option --offline= is only supported for security right now.");
710
711 if (arg_offline && optind >= argc - 1)
712 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
713 "Option --offline= requires one or more units to perform a security review.");
714
715 if (arg_threshold != 100 && !streq_ptr(argv[optind], "security"))
716 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
717 "Option --threshold= is only supported for security right now.");
718
719 if (arg_runtime_scope == RUNTIME_SCOPE_GLOBAL && !streq_ptr(argv[optind], "unit-paths"))
720 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
721 "Option --global only makes sense with verb unit-paths.");
722
723 if (streq_ptr(argv[optind], "cat-config") && arg_runtime_scope == RUNTIME_SCOPE_USER)
724 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
725 "Option --user is not supported for cat-config right now.");
726
727 if (arg_security_policy && !streq_ptr(argv[optind], "security"))
728 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
729 "Option --security-policy= is only supported for security.");
730
731 if ((arg_root || arg_image) && (!STRPTR_IN_SET(argv[optind], "cat-config", "verify", "condition", "inspect-elf", "unit-gdb")) &&
732 (!(streq_ptr(argv[optind], "security") && arg_offline)))
733 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
734 "Options --root= and --image= are only supported for cat-config, verify, condition, unit-gdb, and security when used with --offline= right now.");
735
736 /* Having both an image and a root is not supported by the code */
737 if (arg_root && arg_image)
738 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Please specify either --root= or --image=, the combination of both is not supported.");
739
740 if (arg_unit && !streq_ptr(argv[optind], "condition"))
741 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --unit= is only supported for condition");
742
743 if (streq_ptr(argv[optind], "condition") && !arg_unit && optind >= argc - 1)
744 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Too few arguments for condition");
745
746 if (streq_ptr(argv[optind], "condition") && arg_unit && optind < argc - 1)
747 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "No conditions can be passed if --unit= is used.");
748
749 if (arg_table && !streq_ptr(argv[optind], "plot"))
750 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --table is only supported for plot right now.");
751
752 if (arg_table && sd_json_format_enabled(arg_json_format_flags))
753 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--table and --json= are mutually exclusive.");
754
755 if (arg_capability != CAPABILITY_LITERAL && !streq_ptr(argv[optind], "capability"))
756 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --mask is only supported for capability.");
757
758 if (arg_drm_device_path && !streq_ptr(argv[optind], "chid"))
759 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --drm-device is only supported for chid right now.");
760
761 return 1; /* work to do */
762}
763
764static int run(int argc, char *argv[]) {
765 _cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
766 _cleanup_(umount_and_freep) char *mounted_dir = NULL;
767
768 static const Verb verbs[] = {
769 { "help", VERB_ANY, VERB_ANY, 0, help },
770 { "time", VERB_ANY, 1, VERB_DEFAULT, verb_time },
771 { "blame", VERB_ANY, 1, 0, verb_blame },
772 { "critical-chain", VERB_ANY, VERB_ANY, 0, verb_critical_chain },
773 { "plot", VERB_ANY, 1, 0, verb_plot },
774 { "dot", VERB_ANY, VERB_ANY, 0, verb_dot },
775 /* ↓ The following seven verbs are deprecated, from here … ↓ */
776 { "log-level", VERB_ANY, 2, 0, verb_log_control },
777 { "log-target", VERB_ANY, 2, 0, verb_log_control },
778 { "set-log-level", 2, 2, 0, verb_log_control },
779 { "get-log-level", VERB_ANY, 1, 0, verb_log_control },
780 { "set-log-target", 2, 2, 0, verb_log_control },
781 { "get-log-target", VERB_ANY, 1, 0, verb_log_control },
782 { "service-watchdogs", VERB_ANY, 2, 0, verb_service_watchdogs },
783 /* ↑ … until here ↑ */
784 { "dump", VERB_ANY, VERB_ANY, 0, verb_dump },
785 { "cat-config", 2, VERB_ANY, 0, verb_cat_config },
786 { "unit-files", VERB_ANY, VERB_ANY, 0, verb_unit_files },
787 { "unit-gdb", 2, VERB_ANY, 0, verb_unit_gdb },
788 { "unit-paths", 1, 1, 0, verb_unit_paths },
789 { "unit-shell", 2, VERB_ANY, 0, verb_unit_shell },
790 { "exit-status", VERB_ANY, VERB_ANY, 0, verb_exit_status },
791 { "syscall-filter", VERB_ANY, VERB_ANY, 0, verb_syscall_filters },
792 { "capability", VERB_ANY, VERB_ANY, 0, verb_capabilities },
793 { "filesystems", VERB_ANY, VERB_ANY, 0, verb_filesystems },
794 { "condition", VERB_ANY, VERB_ANY, 0, verb_condition },
795 { "compare-versions", 3, 4, 0, verb_compare_versions },
796 { "verify", 2, VERB_ANY, 0, verb_verify },
797 { "calendar", 2, VERB_ANY, 0, verb_calendar },
798 { "timestamp", 2, VERB_ANY, 0, verb_timestamp },
799 { "timespan", 2, VERB_ANY, 0, verb_timespan },
800 { "security", VERB_ANY, VERB_ANY, 0, verb_security },
801 { "inspect-elf", 2, VERB_ANY, 0, verb_elf_inspection },
802 { "malloc", VERB_ANY, VERB_ANY, 0, verb_malloc },
803 { "fdstore", 2, VERB_ANY, 0, verb_fdstore },
804 { "image-policy", 2, 2, 0, verb_image_policy },
805 { "has-tpm2", VERB_ANY, 1, 0, verb_has_tpm2 },
806 { "pcrs", VERB_ANY, VERB_ANY, 0, verb_pcrs },
807 { "srk", VERB_ANY, 1, 0, verb_srk },
808 { "architectures", VERB_ANY, VERB_ANY, 0, verb_architectures },
809 { "smbios11", VERB_ANY, 1, 0, verb_smbios11 },
810 { "chid", VERB_ANY, VERB_ANY, 0, verb_chid },
811 { "transient-settings", 2, VERB_ANY, 0, verb_transient_settings },
812 {}
813 };
814
815 int r;
816
817 setlocale(LC_ALL, "");
818 setlocale(LC_NUMERIC, "C"); /* we want to format/parse floats in C style */
819
820 log_setup();
821
822 r = parse_argv(argc, argv);
823 if (r <= 0)
824 return r;
825
826 /* Open up and mount the image */
827 if (arg_image) {
828 assert(!arg_root);
829
830 r = mount_image_privately_interactively(
831 arg_image,
832 arg_image_policy,
833 DISSECT_IMAGE_GENERIC_ROOT |
834 DISSECT_IMAGE_RELAX_VAR_CHECK |
835 DISSECT_IMAGE_READ_ONLY |
836 DISSECT_IMAGE_ALLOW_USERSPACE_VERITY,
837 &mounted_dir,
838 /* ret_dir_fd= */ NULL,
839 &loop_device);
840 if (r < 0)
841 return r;
842
843 arg_root = strdup(mounted_dir);
844 if (!arg_root)
845 return log_oom();
846 }
847
848 return dispatch_verb(argc, argv, verbs, NULL);
849}
850
851DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);
Unnamed repository; edit this file 'description' to name the repository.