src/analyze/analyze.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2 /***
   3   Copyright © 2013 Simon Peeters
   4 ***/
   5
   6 #include <getopt.h>
   7 #include <inttypes.h>
   8 #include <stdio.h>
   9 #include <stdlib.h>
  10 #include <unistd.h>
  11
  12 #include "sd-bus.h"
  13
  14 #include "alloc-util.h"
  15 #include "analyze.h"
  16 #include "analyze-architectures.h"
  17 #include "analyze-blame.h"
  18 #include "analyze-calendar.h"
  19 #include "analyze-capability.h"
  20 #include "analyze-cat-config.h"
  21 #include "analyze-compare-versions.h"
  22 #include "analyze-condition.h"
  23 #include "analyze-critical-chain.h"
  24 #include "analyze-dot.h"
  25 #include "analyze-dump.h"
  26 #include "analyze-exit-status.h"
  27 #include "analyze-fdstore.h"
  28 #include "analyze-filesystems.h"
  29 #include "analyze-image-policy.h"
  30 #include "analyze-inspect-elf.h"
  31 #include "analyze-log-control.h"
  32 #include "analyze-malloc.h"
  33 #include "analyze-pcrs.h"
  34 #include "analyze-plot.h"
  35 #include "analyze-security.h"
  36 #include "analyze-service-watchdogs.h"
  37 #include "analyze-srk.h"
  38 #include "analyze-syscall-filter.h"
  39 #include "analyze-time.h"
  40 #include "analyze-time-data.h"
  41 #include "analyze-timespan.h"
  42 #include "analyze-timestamp.h"
  43 #include "analyze-unit-files.h"
  44 #include "analyze-unit-paths.h"
  45 #include "analyze-verify.h"
  46 #include "build.h"
  47 #include "bus-error.h"
  48 #include "bus-locator.h"
  49 #include "bus-map-properties.h"
  50 #include "bus-unit-util.h"
  51 #include "calendarspec.h"
  52 #include "cap-list.h"
  53 #include "capability-util.h"
  54 #include "conf-files.h"
  55 #include "copy.h"
  56 #include "constants.h"
  57 #include "exit-status.h"
  58 #include "extract-word.h"
  59 #include "fd-util.h"
  60 #include "fileio.h"
  61 #include "filesystems.h"
  62 #include "format-table.h"
  63 #include "glob-util.h"
  64 #include "hashmap.h"
  65 #include "locale-util.h"
  66 #include "log.h"
  67 #include "main-func.h"
  68 #include "mount-util.h"
  69 #include "nulstr-util.h"
  70 #include "pager.h"
  71 #include "parse-argument.h"
  72 #include "parse-util.h"
  73 #include "path-util.h"
  74 #include "pretty-print.h"
  75 #include "rm-rf.h"
  76 #if HAVE_SECCOMP
  77 #  include "seccomp-util.h"
  78 #endif
  79 #include "sort-util.h"
  80 #include "special.h"
  81 #include "stat-util.h"
  82 #include "string-table.h"
  83 #include "strv.h"
  84 #include "strxcpyx.h"
  85 #include "terminal-util.h"
  86 #include "time-util.h"
  87 #include "tmpfile-util.h"
  88 #include "unit-name.h"
  89 #include "verb-log-control.h"
  90 #include "verbs.h"
  91
  92 DotMode arg_dot = DEP_ALL;
  93 char **arg_dot_from_patterns = NULL, **arg_dot_to_patterns = NULL;
  94 usec_t arg_fuzz = 0;
  95 PagerFlags arg_pager_flags = 0;
  96 CatFlags arg_cat_flags = 0;
  97 BusTransport arg_transport = BUS_TRANSPORT_LOCAL;
  98 const char *arg_host = NULL;
  99 RuntimeScope arg_runtime_scope = RUNTIME_SCOPE_SYSTEM;
 100 RecursiveErrors arg_recursive_errors = _RECURSIVE_ERRORS_INVALID;
 101 bool arg_man = true;
 102 bool arg_generators = false;
 103 char *arg_root = NULL;
 104 static char *arg_image = NULL;
 105 char *arg_security_policy = NULL;
 106 bool arg_offline = false;
 107 unsigned arg_threshold = 100;
 108 unsigned arg_iterations = 1;
 109 usec_t arg_base_time = USEC_INFINITY;
 110 char *arg_unit = NULL;
 111 JsonFormatFlags arg_json_format_flags = JSON_FORMAT_OFF;
 112 bool arg_quiet = false;
 113 char *arg_profile = NULL;
 114 bool arg_legend = true;
 115 bool arg_table = false;
 116 ImagePolicy *arg_image_policy = NULL;
 117
 118 STATIC_DESTRUCTOR_REGISTER(arg_dot_from_patterns, strv_freep);
 119 STATIC_DESTRUCTOR_REGISTER(arg_dot_to_patterns, strv_freep);
 120 STATIC_DESTRUCTOR_REGISTER(arg_root, freep);
 121 STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
 122 STATIC_DESTRUCTOR_REGISTER(arg_security_policy, freep);
 123 STATIC_DESTRUCTOR_REGISTER(arg_unit, freep);
 124 STATIC_DESTRUCTOR_REGISTER(arg_profile, freep);
 125 STATIC_DESTRUCTOR_REGISTER(arg_image_policy, image_policy_freep);
 126
 127 int acquire_bus(sd_bus **bus, bool *use_full_bus) {
 128         int r;
 129
 130         if (use_full_bus && *use_full_bus) {
 131                 r = bus_connect_transport(arg_transport, arg_host, arg_runtime_scope, bus);
 132                 if (IN_SET(r, 0, -EHOSTDOWN))
 133                         return r;
 134
 135                 *use_full_bus = false;
 136         }
 137
 138         return bus_connect_transport_systemd(arg_transport, arg_host, arg_runtime_scope, bus);
 139 }
 140
 141 int bus_get_unit_property_strv(sd_bus *bus, const char *path, const char *property, char ***strv) {
 142         _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
 143         int r;
 144
 145         assert(bus);
 146         assert(path);
 147         assert(property);
 148         assert(strv);
 149
 150         r = sd_bus_get_property_strv(
 151                         bus,
 152                         "org.freedesktop.systemd1",
 153                         path,
 154                         "org.freedesktop.systemd1.Unit",
 155                         property,
 156                         &error,
 157                         strv);
 158         if (r < 0)
 159                 return log_error_errno(r, "Failed to get unit property %s: %s", property, bus_error_message(&error, r));
 160
 161         return 0;
 162 }
 163
 164 void time_parsing_hint(const char *p, bool calendar, bool timestamp, bool timespan) {
 165         if (calendar && calendar_spec_from_string(p, NULL) >= 0)
 166                 log_notice("Hint: this expression is a valid calendar specification. "
 167                            "Use 'systemd-analyze calendar \"%s\"' instead?", p);
 168         if (timestamp && parse_timestamp(p, NULL) >= 0)
 169                 log_notice("Hint: this expression is a valid timestamp. "
 170                            "Use 'systemd-analyze timestamp \"%s\"' instead?", p);
 171         if (timespan && parse_time(p, NULL, USEC_PER_SEC) >= 0)
 172                 log_notice("Hint: this expression is a valid timespan. "
 173                            "Use 'systemd-analyze timespan \"%s\"' instead?", p);
 174 }
 175
 176 int dump_fd_reply(sd_bus_message *message) {
 177         int fd, r;
 178
 179         assert(message);
 180
 181         r = sd_bus_message_read(message, "h", &fd);
 182         if (r < 0)
 183                 return bus_log_parse_error(r);
 184
 185         fflush(stdout);
 186         r = copy_bytes(fd, STDOUT_FILENO, UINT64_MAX, 0);
 187         if (r < 0)
 188                 return r;
 189
 190         return 1;  /* Success */
 191 }
 192
 193 static int help(int argc, char *argv[], void *userdata) {
 194         _cleanup_free_ char *link = NULL, *dot_link = NULL;
 195         int r;
 196
 197         pager_open(arg_pager_flags);
 198
 199         r = terminal_urlify_man("systemd-analyze", "1", &link);
 200         if (r < 0)
 201                 return log_oom();
 202
 203         /* Not using terminal_urlify_man() for this, since we don't want the "man page" text suffix in this case. */
 204         r = terminal_urlify("man:dot(1)", "dot(1)", &dot_link);
 205         if (r < 0)
 206                 return log_oom();
 207
 208         printf("%s [OPTIONS...] COMMAND ...\n\n"
 209                "%sProfile systemd, show unit dependencies, check unit files.%s\n"
 210                "\nCommands:\n"
 211                "  [time]                     Print time required to boot the machine\n"
 212                "  blame                      Print list of running units ordered by\n"
 213                "                             time to init\n"
 214                "  critical-chain [UNIT...]   Print a tree of the time critical chain\n"
 215                "                             of units\n"
 216                "  plot                       Output SVG graphic showing service\n"
 217                "                             initialization\n"
 218                "  dot [UNIT...]              Output dependency graph in %s format\n"
 219                "  dump [PATTERN...]          Output state serialization of service\n"
 220                "                             manager\n"
 221                "  cat-config                 Show configuration file and drop-ins\n"
 222                "  unit-files                 List files and symlinks for units\n"
 223                "  unit-paths                 List load directories for units\n"
 224                "  exit-status [STATUS...]    List exit status definitions\n"
 225                "  capability [CAP...]        List capability definitions\n"
 226                "  syscall-filter [NAME...]   List syscalls in seccomp filters\n"
 227                "  filesystems [NAME...]      List known filesystems\n"
 228                "  architectures [NAME...]    List known architectures\n"
 229                "  condition CONDITION...     Evaluate conditions and asserts\n"
 230                "  compare-versions VERSION1 [OP] VERSION2\n"
 231                "                             Compare two version strings\n"
 232                "  verify FILE...             Check unit files for correctness\n"
 233                "  calendar SPEC...           Validate repetitive calendar time\n"
 234                "                             events\n"
 235                "  timestamp TIMESTAMP...     Validate a timestamp\n"
 236                "  timespan SPAN...           Validate a time span\n"
 237                "  security [UNIT...]         Analyze security of unit\n"
 238                "  inspect-elf FILE...        Parse and print ELF package metadata\n"
 239                "  malloc [D-BUS SERVICE...]  Dump malloc stats of a D-Bus service\n"
 240                "  fdstore SERVICE...         Show file descriptor store contents of service\n"
 241                "  pcrs [PCR...]              Show TPM2 PCRs and their names\n"
 242                "  srk > FILE                 Write TPM2 SRK to stdout\n"
 243                "\nOptions:\n"
 244                "     --recursive-errors=MODE Control which units are verified\n"
 245                "     --offline=BOOL          Perform a security review on unit file(s)\n"
 246                "     --threshold=N           Exit with a non-zero status when overall\n"
 247                "                             exposure level is over threshold value\n"
 248                "     --security-policy=PATH  Use custom JSON security policy instead\n"
 249                "                             of built-in one\n"
 250                "     --json=pretty|short|off Generate JSON output of the security\n"
 251                "                             analysis table, or plot's raw time data\n"
 252                "     --no-pager              Do not pipe output into a pager\n"
 253                "     --no-legend             Disable column headers and hints in plot\n"
 254                "                             with either --table or --json=\n"
 255                "     --system                Operate on system systemd instance\n"
 256                "     --user                  Operate on user systemd instance\n"
 257                "     --global                Operate on global user configuration\n"
 258                "  -H --host=[USER@]HOST      Operate on remote host\n"
 259                "  -M --machine=CONTAINER     Operate on local container\n"
 260                "     --order                 Show only order in the graph\n"
 261                "     --require               Show only requirement in the graph\n"
 262                "     --from-pattern=GLOB     Show only origins in the graph\n"
 263                "     --to-pattern=GLOB       Show only destinations in the graph\n"
 264                "     --fuzz=SECONDS          Also print services which finished SECONDS\n"
 265                "                             earlier than the latest in the branch\n"
 266                "     --man[=BOOL]            Do [not] check for existence of man pages\n"
 267                "     --generators[=BOOL]     Do [not] run unit generators\n"
 268                "                             (requires privileges)\n"
 269                "     --iterations=N          Show the specified number of iterations\n"
 270                "     --base-time=TIMESTAMP   Calculate calendar times relative to\n"
 271                "                             specified time\n"
 272                "     --profile=name|PATH     Include the specified profile in the\n"
 273                "                             security review of the unit(s)\n"
 274                "     --table                 Output plot's raw time data as a table\n"
 275                "  -h --help                  Show this help\n"
 276                "     --version               Show package version\n"
 277                "  -q --quiet                 Do not emit hints\n"
 278                "     --tldr                  Skip comments and empty lines\n"
 279                "     --root=PATH             Operate on an alternate filesystem root\n"
 280                "     --image=PATH            Operate on disk image as filesystem root\n"
 281                "     --image-policy=POLICY   Specify disk image dissection policy\n"
 282                "\nSee the %s for details.\n",
 283                program_invocation_short_name,
 284                ansi_highlight(),
 285                ansi_normal(),
 286                dot_link,
 287                link);
 288
 289         /* When updating this list, including descriptions, apply changes to
 290          * shell-completion/bash/systemd-analyze and shell-completion/zsh/_systemd-analyze too. */
 291
 292         return 0;
 293 }
 294
 295 static int parse_argv(int argc, char *argv[]) {
 296         enum {
 297                 ARG_VERSION = 0x100,
 298                 ARG_ORDER,
 299                 ARG_REQUIRE,
 300                 ARG_ROOT,
 301                 ARG_IMAGE,
 302                 ARG_IMAGE_POLICY,
 303                 ARG_SYSTEM,
 304                 ARG_USER,
 305                 ARG_GLOBAL,
 306                 ARG_DOT_FROM_PATTERN,
 307                 ARG_DOT_TO_PATTERN,
 308                 ARG_FUZZ,
 309                 ARG_NO_PAGER,
 310                 ARG_MAN,
 311                 ARG_GENERATORS,
 312                 ARG_ITERATIONS,
 313                 ARG_BASE_TIME,
 314                 ARG_RECURSIVE_ERRORS,
 315                 ARG_OFFLINE,
 316                 ARG_THRESHOLD,
 317                 ARG_SECURITY_POLICY,
 318                 ARG_JSON,
 319                 ARG_PROFILE,
 320                 ARG_TABLE,
 321                 ARG_NO_LEGEND,
 322                 ARG_TLDR,
 323         };
 324
 325         static const struct option options[] = {
 326                 { "help",             no_argument,       NULL, 'h'                  },
 327                 { "version",          no_argument,       NULL, ARG_VERSION          },
 328                 { "quiet",            no_argument,       NULL, 'q'                  },
 329                 { "order",            no_argument,       NULL, ARG_ORDER            },
 330                 { "require",          no_argument,       NULL, ARG_REQUIRE          },
 331                 { "root",             required_argument, NULL, ARG_ROOT             },
 332                 { "image",            required_argument, NULL, ARG_IMAGE            },
 333                 { "image-policy",     required_argument, NULL, ARG_IMAGE_POLICY     },
 334                 { "recursive-errors", required_argument, NULL, ARG_RECURSIVE_ERRORS },
 335                 { "offline",          required_argument, NULL, ARG_OFFLINE          },
 336                 { "threshold",        required_argument, NULL, ARG_THRESHOLD        },
 337                 { "security-policy",  required_argument, NULL, ARG_SECURITY_POLICY  },
 338                 { "system",           no_argument,       NULL, ARG_SYSTEM           },
 339                 { "user",             no_argument,       NULL, ARG_USER             },
 340                 { "global",           no_argument,       NULL, ARG_GLOBAL           },
 341                 { "from-pattern",     required_argument, NULL, ARG_DOT_FROM_PATTERN },
 342                 { "to-pattern",       required_argument, NULL, ARG_DOT_TO_PATTERN   },
 343                 { "fuzz",             required_argument, NULL, ARG_FUZZ             },
 344                 { "no-pager",         no_argument,       NULL, ARG_NO_PAGER         },
 345                 { "man",              optional_argument, NULL, ARG_MAN              },
 346                 { "generators",       optional_argument, NULL, ARG_GENERATORS       },
 347                 { "host",             required_argument, NULL, 'H'                  },
 348                 { "machine",          required_argument, NULL, 'M'                  },
 349                 { "iterations",       required_argument, NULL, ARG_ITERATIONS       },
 350                 { "base-time",        required_argument, NULL, ARG_BASE_TIME        },
 351                 { "unit",             required_argument, NULL, 'U'                  },
 352                 { "json",             required_argument, NULL, ARG_JSON             },
 353                 { "profile",          required_argument, NULL, ARG_PROFILE          },
 354                 { "table",            optional_argument, NULL, ARG_TABLE            },
 355                 { "no-legend",        optional_argument, NULL, ARG_NO_LEGEND        },
 356                 { "tldr",             no_argument,       NULL, ARG_TLDR             },
 357                 {}
 358         };
 359
 360         int r, c;
 361
 362         assert(argc >= 0);
 363         assert(argv);
 364
 365         while ((c = getopt_long(argc, argv, "hH:M:U:", options, NULL)) >= 0)
 366                 switch (c) {
 367
 368                 case 'h':
 369                         return help(0, NULL, NULL);
 370
 371                 case ARG_VERSION:
 372                         return version();
 373
 374                 case 'q':
 375                         arg_quiet = true;
 376                         break;
 377
 378                 case ARG_RECURSIVE_ERRORS:
 379                         if (streq(optarg, "help")) {
 380                                 DUMP_STRING_TABLE(recursive_errors, RecursiveErrors, _RECURSIVE_ERRORS_MAX);
 381                                 return 0;
 382                         }
 383                         r = recursive_errors_from_string(optarg);
 384                         if (r < 0)
 385                                 return log_error_errno(r, "Unknown mode passed to --recursive-errors='%s'.", optarg);
 386
 387                         arg_recursive_errors = r;
 388                         break;
 389
 390                 case ARG_ROOT:
 391                         r = parse_path_argument(optarg, /* suppress_root= */ true, &arg_root);
 392                         if (r < 0)
 393                                 return r;
 394                         break;
 395
 396                 case ARG_IMAGE:
 397                         r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_image);
 398                         if (r < 0)
 399                                 return r;
 400                         break;
 401
 402                 case ARG_IMAGE_POLICY:
 403                         r = parse_image_policy_argument(optarg, &arg_image_policy);
 404                         if (r < 0)
 405                                 return r;
 406                         break;
 407
 408                 case ARG_SYSTEM:
 409                         arg_runtime_scope = RUNTIME_SCOPE_SYSTEM;
 410                         break;
 411
 412                 case ARG_USER:
 413                         arg_runtime_scope = RUNTIME_SCOPE_USER;
 414                         break;
 415
 416                 case ARG_GLOBAL:
 417                         arg_runtime_scope = RUNTIME_SCOPE_GLOBAL;
 418                         break;
 419
 420                 case ARG_ORDER:
 421                         arg_dot = DEP_ORDER;
 422                         break;
 423
 424                 case ARG_REQUIRE:
 425                         arg_dot = DEP_REQUIRE;
 426                         break;
 427
 428                 case ARG_DOT_FROM_PATTERN:
 429                         if (strv_extend(&arg_dot_from_patterns, optarg) < 0)
 430                                 return log_oom();
 431
 432                         break;
 433
 434                 case ARG_DOT_TO_PATTERN:
 435                         if (strv_extend(&arg_dot_to_patterns, optarg) < 0)
 436                                 return log_oom();
 437
 438                         break;
 439
 440                 case ARG_FUZZ:
 441                         r = parse_sec(optarg, &arg_fuzz);
 442                         if (r < 0)
 443                                 return r;
 444                         break;
 445
 446                 case ARG_NO_PAGER:
 447                         arg_pager_flags |= PAGER_DISABLE;
 448                         break;
 449
 450                 case 'H':
 451                         arg_transport = BUS_TRANSPORT_REMOTE;
 452                         arg_host = optarg;
 453                         break;
 454
 455                 case 'M':
 456                         arg_transport = BUS_TRANSPORT_MACHINE;
 457                         arg_host = optarg;
 458                         break;
 459
 460                 case ARG_MAN:
 461                         r = parse_boolean_argument("--man", optarg, &arg_man);
 462                         if (r < 0)
 463                                 return r;
 464                         break;
 465
 466                 case ARG_GENERATORS:
 467                         r = parse_boolean_argument("--generators", optarg, &arg_generators);
 468                         if (r < 0)
 469                                 return r;
 470                         break;
 471
 472                 case ARG_OFFLINE:
 473                         r = parse_boolean_argument("--offline", optarg, &arg_offline);
 474                         if (r < 0)
 475                                 return r;
 476                         break;
 477
 478                 case ARG_THRESHOLD:
 479                         r = safe_atou(optarg, &arg_threshold);
 480                         if (r < 0 || arg_threshold > 100)
 481                                 return log_error_errno(r < 0 ? r : SYNTHETIC_ERRNO(EINVAL), "Failed to parse threshold: %s", optarg);
 482
 483                         break;
 484
 485                 case ARG_SECURITY_POLICY:
 486                         r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_security_policy);
 487                         if (r < 0)
 488                                 return r;
 489                         break;
 490
 491                 case ARG_JSON:
 492                         r = parse_json_argument(optarg, &arg_json_format_flags);
 493                         if (r <= 0)
 494                                 return r;
 495                         break;
 496
 497                 case ARG_ITERATIONS:
 498                         r = safe_atou(optarg, &arg_iterations);
 499                         if (r < 0)
 500                                 return log_error_errno(r, "Failed to parse iterations: %s", optarg);
 501                         break;
 502
 503                 case ARG_BASE_TIME:
 504                         r = parse_timestamp(optarg, &arg_base_time);
 505                         if (r < 0)
 506                                 return log_error_errno(r, "Failed to parse --base-time= parameter: %s", optarg);
 507                         break;
 508
 509                 case ARG_PROFILE:
 510                         if (isempty(optarg))
 511                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Profile file name is empty");
 512
 513                         if (is_path(optarg)) {
 514                                 r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_profile);
 515                                 if (r < 0)
 516                                         return r;
 517                                 if (!endswith(arg_profile, ".conf"))
 518                                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Profile file name must end with .conf: %s", arg_profile);
 519                         } else {
 520                                 r = free_and_strdup(&arg_profile, optarg);
 521                                 if (r < 0)
 522                                         return log_oom();
 523                         }
 524
 525                         break;
 526
 527                 case 'U': {
 528                         _cleanup_free_ char *mangled = NULL;
 529
 530                         r = unit_name_mangle(optarg, UNIT_NAME_MANGLE_WARN, &mangled);
 531                         if (r < 0)
 532                                 return log_error_errno(r, "Failed to mangle unit name %s: %m", optarg);
 533
 534                         free_and_replace(arg_unit, mangled);
 535                         break;
 536                 }
 537
 538                 case ARG_TABLE:
 539                         arg_table = true;
 540                         break;
 541
 542                 case ARG_NO_LEGEND:
 543                         arg_legend = false;
 544                         break;
 545
 546                 case ARG_TLDR:
 547                         arg_cat_flags = CAT_TLDR;
 548                         break;
 549
 550                 case '?':
 551                         return -EINVAL;
 552
 553                 default:
 554                         assert_not_reached();
 555                 }
 556
 557         if (arg_offline && !streq_ptr(argv[optind], "security"))
 558                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 559                                        "Option --offline= is only supported for security right now.");
 560
 561         if (arg_json_format_flags != JSON_FORMAT_OFF && !STRPTR_IN_SET(argv[optind], "security", "inspect-elf", "plot", "fdstore", "pcrs", "architectures"))
 562                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 563                                        "Option --json= is only supported for security, inspect-elf, plot, fdstore, pcrs, architectures right now.");
 564
 565         if (arg_threshold != 100 && !streq_ptr(argv[optind], "security"))
 566                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 567                                        "Option --threshold= is only supported for security right now.");
 568
 569         if (arg_runtime_scope == RUNTIME_SCOPE_GLOBAL &&
 570             !STR_IN_SET(argv[optind] ?: "time", "dot", "unit-paths", "verify"))
 571                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 572                                        "Option --global only makes sense with verbs dot, unit-paths, verify.");
 573
 574         if (streq_ptr(argv[optind], "cat-config") && arg_runtime_scope == RUNTIME_SCOPE_USER)
 575                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 576                                        "Option --user is not supported for cat-config right now.");
 577
 578         if (arg_security_policy && !streq_ptr(argv[optind], "security"))
 579                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 580                                        "Option --security-policy= is only supported for security.");
 581
 582         if ((arg_root || arg_image) && (!STRPTR_IN_SET(argv[optind], "cat-config", "verify", "condition")) &&
 583            (!(streq_ptr(argv[optind], "security") && arg_offline)))
 584                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 585                                        "Options --root= and --image= are only supported for cat-config, verify, condition and security when used with --offline= right now.");
 586
 587         /* Having both an image and a root is not supported by the code */
 588         if (arg_root && arg_image)
 589                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Please specify either --root= or --image=, the combination of both is not supported.");
 590
 591         if (arg_unit && !streq_ptr(argv[optind], "condition"))
 592                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --unit= is only supported for condition");
 593
 594         if (streq_ptr(argv[optind], "condition") && !arg_unit && optind >= argc - 1)
 595                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Too few arguments for condition");
 596
 597         if (streq_ptr(argv[optind], "condition") && arg_unit && optind < argc - 1)
 598                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "No conditions can be passed if --unit= is used.");
 599
 600         if ((!arg_legend && !streq_ptr(argv[optind], "plot")) ||
 601            (streq_ptr(argv[optind], "plot") && !arg_legend && !arg_table && FLAGS_SET(arg_json_format_flags, JSON_FORMAT_OFF)))
 602                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --no-legend is only supported for plot with either --table or --json=.");
 603
 604         if (arg_table && !streq_ptr(argv[optind], "plot"))
 605                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --table is only supported for plot right now.");
 606
 607         if (arg_table && !FLAGS_SET(arg_json_format_flags, JSON_FORMAT_OFF))
 608                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--table and --json= are mutually exclusive.");
 609
 610         return 1; /* work to do */
 611 }
 612
 613 static int run(int argc, char *argv[]) {
 614         _cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
 615         _cleanup_(umount_and_freep) char *mounted_dir = NULL;
 616
 617         static const Verb verbs[] = {
 618                 { "help",              VERB_ANY, VERB_ANY, 0,            help                   },
 619                 { "time",              VERB_ANY, 1,        VERB_DEFAULT, verb_time              },
 620                 { "blame",             VERB_ANY, 1,        0,            verb_blame             },
 621                 { "critical-chain",    VERB_ANY, VERB_ANY, 0,            verb_critical_chain    },
 622                 { "plot",              VERB_ANY, 1,        0,            verb_plot              },
 623                 { "dot",               VERB_ANY, VERB_ANY, 0,            verb_dot               },
 624                 /* ↓ The following seven verbs are deprecated, from here … ↓ */
 625                 { "log-level",         VERB_ANY, 2,        0,            verb_log_control       },
 626                 { "log-target",        VERB_ANY, 2,        0,            verb_log_control       },
 627                 { "set-log-level",     2,        2,        0,            verb_log_control       },
 628                 { "get-log-level",     VERB_ANY, 1,        0,            verb_log_control       },
 629                 { "set-log-target",    2,        2,        0,            verb_log_control       },
 630                 { "get-log-target",    VERB_ANY, 1,        0,            verb_log_control       },
 631                 { "service-watchdogs", VERB_ANY, 2,        0,            verb_service_watchdogs },
 632                 /* ↑ … until here ↑ */
 633                 { "dump",              VERB_ANY, VERB_ANY, 0,            verb_dump              },
 634                 { "cat-config",        2,        VERB_ANY, 0,            verb_cat_config        },
 635                 { "unit-files",        VERB_ANY, VERB_ANY, 0,            verb_unit_files        },
 636                 { "unit-paths",        1,        1,        0,            verb_unit_paths        },
 637                 { "exit-status",       VERB_ANY, VERB_ANY, 0,            verb_exit_status       },
 638                 { "syscall-filter",    VERB_ANY, VERB_ANY, 0,            verb_syscall_filters   },
 639                 { "capability",        VERB_ANY, VERB_ANY, 0,            verb_capabilities      },
 640                 { "filesystems",       VERB_ANY, VERB_ANY, 0,            verb_filesystems       },
 641                 { "condition",         VERB_ANY, VERB_ANY, 0,            verb_condition         },
 642                 { "compare-versions",  3,        4,        0,            verb_compare_versions  },
 643                 { "verify",            2,        VERB_ANY, 0,            verb_verify            },
 644                 { "calendar",          2,        VERB_ANY, 0,            verb_calendar          },
 645                 { "timestamp",         2,        VERB_ANY, 0,            verb_timestamp         },
 646                 { "timespan",          2,        VERB_ANY, 0,            verb_timespan          },
 647                 { "security",          VERB_ANY, VERB_ANY, 0,            verb_security          },
 648                 { "inspect-elf",       2,        VERB_ANY, 0,            verb_elf_inspection    },
 649                 { "malloc",            VERB_ANY, VERB_ANY, 0,            verb_malloc            },
 650                 { "fdstore",           2,        VERB_ANY, 0,            verb_fdstore           },
 651                 { "image-policy",      2,        2,        0,            verb_image_policy      },
 652                 { "pcrs",              VERB_ANY, VERB_ANY, 0,            verb_pcrs              },
 653                 { "srk",               VERB_ANY, 1,        0,            verb_srk               },
 654                 { "architectures",     VERB_ANY, VERB_ANY, 0,            verb_architectures     },
 655                 {}
 656         };
 657
 658         int r;
 659
 660         setlocale(LC_ALL, "");
 661         setlocale(LC_NUMERIC, "C"); /* we want to format/parse floats in C style */
 662
 663         log_setup();
 664
 665         r = parse_argv(argc, argv);
 666         if (r <= 0)
 667                 return r;
 668
 669         /* Open up and mount the image */
 670         if (arg_image) {
 671                 assert(!arg_root);
 672
 673                 r = mount_image_privately_interactively(
 674                                 arg_image,
 675                                 arg_image_policy,
 676                                 DISSECT_IMAGE_GENERIC_ROOT |
 677                                 DISSECT_IMAGE_RELAX_VAR_CHECK |
 678                                 DISSECT_IMAGE_READ_ONLY,
 679                                 &mounted_dir,
 680                                 /* ret_dir_fd= */ NULL,
 681                                 &loop_device);
 682                 if (r < 0)
 683                         return r;
 684
 685                 arg_root = strdup(mounted_dir);
 686                 if (!arg_root)
 687                         return log_oom();
 688         }
 689
 690         return dispatch_verb(argc, argv, verbs, NULL);
 691 }
 692
 693 DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run);