1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
3 Copyright © 2013 Simon Peeters
14 #include "alloc-util.h"
16 #include "analyze-architectures.h"
17 #include "analyze-blame.h"
18 #include "analyze-calendar.h"
19 #include "analyze-capability.h"
20 #include "analyze-cat-config.h"
21 #include "analyze-chid.h"
22 #include "analyze-compare-versions.h"
23 #include "analyze-condition.h"
24 #include "analyze-critical-chain.h"
25 #include "analyze-dot.h"
26 #include "analyze-dump.h"
27 #include "analyze-exit-status.h"
28 #include "analyze-fdstore.h"
29 #include "analyze-filesystems.h"
30 #include "analyze-has-tpm2.h"
31 #include "analyze-image-policy.h"
32 #include "analyze-inspect-elf.h"
33 #include "analyze-log-control.h"
34 #include "analyze-malloc.h"
35 #include "analyze-pcrs.h"
36 #include "analyze-plot.h"
37 #include "analyze-security.h"
38 #include "analyze-service-watchdogs.h"
39 #include "analyze-smbios11.h"
40 #include "analyze-srk.h"
41 #include "analyze-syscall-filter.h"
42 #include "analyze-time.h"
43 #include "analyze-timespan.h"
44 #include "analyze-timestamp.h"
45 #include "analyze-unit-files.h"
46 #include "analyze-unit-paths.h"
47 #include "analyze-unit-shell.h"
48 #include "analyze-verify.h"
49 #include "analyze-verify-util.h"
51 #include "bus-error.h"
52 #include "bus-unit-util.h"
54 #include "calendarspec.h"
55 #include "dissect-image.h"
56 #include "image-policy.h"
58 #include "loop-util.h"
59 #include "main-func.h"
60 #include "mount-util.h"
62 #include "parse-argument.h"
63 #include "parse-util.h"
64 #include "path-util.h"
65 #include "pretty-print.h"
66 #include "runtime-scope.h"
67 #include "string-table.h"
68 #include "string-util.h"
70 #include "time-util.h"
72 #include "unit-name.h"
75 DotMode arg_dot
= DEP_ALL
;
76 CapabilityMode arg_capability
= CAPABILITY_LITERAL
;
77 char **arg_dot_from_patterns
= NULL
, **arg_dot_to_patterns
= NULL
;
79 PagerFlags arg_pager_flags
= 0;
80 CatFlags arg_cat_flags
= 0;
81 BusTransport arg_transport
= BUS_TRANSPORT_LOCAL
;
82 const char *arg_host
= NULL
;
83 RuntimeScope arg_runtime_scope
= RUNTIME_SCOPE_SYSTEM
;
84 RecursiveErrors arg_recursive_errors
= _RECURSIVE_ERRORS_INVALID
;
86 bool arg_generators
= false;
87 const char *arg_instance
= "test_instance";
88 double arg_svg_timescale
= 1.0;
89 bool arg_detailed_svg
= false;
90 char *arg_root
= NULL
;
91 static char *arg_image
= NULL
;
92 char *arg_security_policy
= NULL
;
93 bool arg_offline
= false;
94 unsigned arg_threshold
= 100;
95 unsigned arg_iterations
= 1;
96 usec_t arg_base_time
= USEC_INFINITY
;
97 char *arg_unit
= NULL
;
98 sd_json_format_flags_t arg_json_format_flags
= SD_JSON_FORMAT_OFF
;
99 bool arg_quiet
= false;
100 char *arg_profile
= NULL
;
101 bool arg_legend
= true;
102 bool arg_table
= false;
103 ImagePolicy
*arg_image_policy
= NULL
;
104 char *arg_drm_device_path
= NULL
;
106 STATIC_DESTRUCTOR_REGISTER(arg_dot_from_patterns
, strv_freep
);
107 STATIC_DESTRUCTOR_REGISTER(arg_dot_to_patterns
, strv_freep
);
108 STATIC_DESTRUCTOR_REGISTER(arg_root
, freep
);
109 STATIC_DESTRUCTOR_REGISTER(arg_image
, freep
);
110 STATIC_DESTRUCTOR_REGISTER(arg_security_policy
, freep
);
111 STATIC_DESTRUCTOR_REGISTER(arg_drm_device_path
, freep
);
112 STATIC_DESTRUCTOR_REGISTER(arg_unit
, freep
);
113 STATIC_DESTRUCTOR_REGISTER(arg_profile
, freep
);
114 STATIC_DESTRUCTOR_REGISTER(arg_image_policy
, image_policy_freep
);
116 int acquire_bus(sd_bus
**bus
, bool *use_full_bus
) {
119 if (use_full_bus
&& *use_full_bus
) {
120 r
= bus_connect_transport(arg_transport
, arg_host
, arg_runtime_scope
, bus
);
121 if (IN_SET(r
, 0, -EHOSTDOWN
))
124 *use_full_bus
= false;
127 return bus_connect_transport_systemd(arg_transport
, arg_host
, arg_runtime_scope
, bus
);
130 int bus_get_unit_property_strv(sd_bus
*bus
, const char *path
, const char *property
, char ***strv
) {
131 _cleanup_(sd_bus_error_free
) sd_bus_error error
= SD_BUS_ERROR_NULL
;
139 r
= sd_bus_get_property_strv(
141 "org.freedesktop.systemd1",
143 "org.freedesktop.systemd1.Unit",
148 return log_error_errno(r
, "Failed to get unit property %s: %s", property
, bus_error_message(&error
, r
));
153 void time_parsing_hint(const char *p
, bool calendar
, bool timestamp
, bool timespan
) {
154 if (calendar
&& calendar_spec_from_string(p
, NULL
) >= 0)
155 log_notice("Hint: this expression is a valid calendar specification. "
156 "Use 'systemd-analyze calendar \"%s\"' instead?", p
);
157 if (timestamp
&& parse_timestamp(p
, NULL
) >= 0)
158 log_notice("Hint: this expression is a valid timestamp. "
159 "Use 'systemd-analyze timestamp \"%s\"' instead?", p
);
160 if (timespan
&& parse_time(p
, NULL
, USEC_PER_SEC
) >= 0)
161 log_notice("Hint: this expression is a valid timespan. "
162 "Use 'systemd-analyze timespan \"%s\"' instead?", p
);
165 static int verb_transient_settings(int argc
, char *argv
[], void *userdata
) {
168 pager_open(arg_pager_flags
);
171 STRV_FOREACH(arg
, strv_skip(argv
, 1)) {
174 t
= unit_type_from_string(*arg
);
176 return log_error_errno(t
, "Invalid unit type '%s'.", *arg
);
181 bus_dump_transient_settings(t
);
188 static int help(int argc
, char *argv
[], void *userdata
) {
189 _cleanup_free_
char *link
= NULL
, *dot_link
= NULL
;
192 pager_open(arg_pager_flags
);
194 r
= terminal_urlify_man("systemd-analyze", "1", &link
);
198 /* Not using terminal_urlify_man() for this, since we don't want the "man page" text suffix in this case. */
199 r
= terminal_urlify("man:dot(1)", "dot(1)", &dot_link
);
203 printf("%1$s [OPTIONS...] COMMAND ...\n\n"
204 "%5$sProfile systemd, show unit dependencies, check unit files.%6$s\n"
205 "\n%3$sBoot Analysis:%4$s\n"
206 " [time] Print time required to boot the machine\n"
207 " blame Print list of running units ordered by\n"
209 " critical-chain [UNIT...] Print a tree of the time critical chain\n"
211 "\n%3$sDependency Analysis:%4$s\n"
212 " plot Output SVG graphic showing service\n"
214 " dot [UNIT...] Output dependency graph in %7$s format\n"
215 " dump [PATTERN...] Output state serialization of service\n"
217 "\n%3$sConfiguration Files and Search Paths:%4$s\n"
218 " cat-config NAME|PATH... Show configuration file and drop-ins\n"
219 " unit-files List files and symlinks for units\n"
220 " unit-paths List load directories for units\n"
221 "\n%3$sEnumerate OS Concepts:%4$s\n"
222 " exit-status [STATUS...] List exit status definitions\n"
223 " capability [CAP...] List capability definitions\n"
224 " syscall-filter [NAME...] List syscalls in seccomp filters\n"
225 " filesystems [NAME...] List known filesystems\n"
226 " architectures [NAME...] List known architectures\n"
227 " smbios11 List strings passed via SMBIOS Type #11\n"
228 " chid List local CHIDs\n"
229 " transient-settings TYPE... List transient settings for unit TYPE\n"
230 "\n%3$sExpression Evaluation:%4$s\n"
231 " condition CONDITION... Evaluate conditions and asserts\n"
232 " compare-versions VERSION1 [OP] VERSION2\n"
233 " Compare two version strings\n"
234 " image-policy POLICY... Analyze image policy string\n"
235 "\n%3$sClock & Time:%4$s\n"
236 " calendar SPEC... Validate repetitive calendar time\n"
238 " timestamp TIMESTAMP... Validate a timestamp\n"
239 " timespan SPAN... Validate a time span\n"
240 "\n%3$sUnit & Service Analysis:%4$s\n"
241 " verify FILE... Check unit files for correctness\n"
242 " security [UNIT...] Analyze security of unit\n"
243 " fdstore SERVICE... Show file descriptor store contents of service\n"
244 " malloc [D-BUS SERVICE...] Dump malloc stats of a D-Bus service\n"
245 " unit-shell SERVICE [Command]\n"
246 " Run command on the namespace of the service\n"
247 "\n%3$sExecutable Analysis:%4$s\n"
248 " inspect-elf FILE... Parse and print ELF package metadata\n"
249 "\n%3$sTPM Operations:%4$s\n"
250 " has-tpm2 Report whether TPM2 support is available\n"
251 " pcrs [PCR...] Show TPM2 PCRs and their names\n"
252 " srk [>FILE] Write TPM2 SRK (to FILE)\n"
253 "\n%3$sOptions:%4$s\n"
254 " --recursive-errors=MODE Control which units are verified\n"
255 " --offline=BOOL Perform a security review on unit file(s)\n"
256 " --threshold=N Exit with a non-zero status when overall\n"
257 " exposure level is over threshold value\n"
258 " --security-policy=PATH Use custom JSON security policy instead\n"
260 " --json=pretty|short|off Generate JSON output of the security\n"
261 " analysis table, or plot's raw time data\n"
262 " --no-pager Do not pipe output into a pager\n"
263 " --no-legend Disable column headers and hints in plot\n"
264 " with either --table or --json=\n"
265 " --system Operate on system systemd instance\n"
266 " --user Operate on user systemd instance\n"
267 " --global Operate on global user configuration\n"
268 " -H --host=[USER@]HOST Operate on remote host\n"
269 " -M --machine=CONTAINER Operate on local container\n"
270 " --order Show only order in the graph\n"
271 " --require Show only requirement in the graph\n"
272 " --from-pattern=GLOB Show only origins in the graph\n"
273 " --to-pattern=GLOB Show only destinations in the graph\n"
274 " --fuzz=SECONDS Also print services which finished SECONDS\n"
275 " earlier than the latest in the branch\n"
276 " --man[=BOOL] Do [not] check for existence of man pages\n"
277 " --generators[=BOOL] Do [not] run unit generators\n"
278 " (requires privileges)\n"
279 " --instance=NAME Specify fallback instance name for template units\n"
280 " --iterations=N Show the specified number of iterations\n"
281 " --base-time=TIMESTAMP Calculate calendar times relative to\n"
283 " --profile=name|PATH Include the specified profile in the\n"
284 " security review of the unit(s)\n"
285 " --unit=UNIT Evaluate conditions and asserts of unit\n"
286 " --table Output plot's raw time data as a table\n"
287 " --scale-svg=FACTOR Stretch x-axis of plot by FACTOR (default: 1.0)\n"
288 " --detailed Add more details to SVG plot,\n"
289 " e.g. show activation timestamps\n"
290 " -h --help Show this help\n"
291 " --version Show package version\n"
292 " -q --quiet Do not emit hints\n"
293 " --tldr Skip comments and empty lines\n"
294 " --root=PATH Operate on an alternate filesystem root\n"
295 " --image=PATH Operate on disk image as filesystem root\n"
296 " --image-policy=POLICY Specify disk image dissection policy\n"
297 " -m --mask Parse parameter as numeric capability mask\n"
298 " --drm-device=PATH Use this DRM device sysfs path to get EDID\n"
300 "\nSee the %2$s for details.\n",
301 program_invocation_short_name
,
309 /* When updating this list, including descriptions, apply changes to
310 * shell-completion/bash/systemd-analyze and shell-completion/zsh/_systemd-analyze too. */
315 static int parse_argv(int argc
, char *argv
[]) {
326 ARG_DOT_FROM_PATTERN
,
335 ARG_RECURSIVE_ERRORS
,
344 ARG_SCALE_FACTOR_SVG
,
349 static const struct option options
[] = {
350 { "help", no_argument
, NULL
, 'h' },
351 { "version", no_argument
, NULL
, ARG_VERSION
},
352 { "quiet", no_argument
, NULL
, 'q' },
353 { "order", no_argument
, NULL
, ARG_ORDER
},
354 { "require", no_argument
, NULL
, ARG_REQUIRE
},
355 { "root", required_argument
, NULL
, ARG_ROOT
},
356 { "image", required_argument
, NULL
, ARG_IMAGE
},
357 { "image-policy", required_argument
, NULL
, ARG_IMAGE_POLICY
},
358 { "recursive-errors", required_argument
, NULL
, ARG_RECURSIVE_ERRORS
},
359 { "offline", required_argument
, NULL
, ARG_OFFLINE
},
360 { "threshold", required_argument
, NULL
, ARG_THRESHOLD
},
361 { "security-policy", required_argument
, NULL
, ARG_SECURITY_POLICY
},
362 { "system", no_argument
, NULL
, ARG_SYSTEM
},
363 { "user", no_argument
, NULL
, ARG_USER
},
364 { "global", no_argument
, NULL
, ARG_GLOBAL
},
365 { "from-pattern", required_argument
, NULL
, ARG_DOT_FROM_PATTERN
},
366 { "to-pattern", required_argument
, NULL
, ARG_DOT_TO_PATTERN
},
367 { "fuzz", required_argument
, NULL
, ARG_FUZZ
},
368 { "no-pager", no_argument
, NULL
, ARG_NO_PAGER
},
369 { "man", optional_argument
, NULL
, ARG_MAN
},
370 { "generators", optional_argument
, NULL
, ARG_GENERATORS
},
371 { "instance", required_argument
, NULL
, ARG_INSTANCE
},
372 { "host", required_argument
, NULL
, 'H' },
373 { "machine", required_argument
, NULL
, 'M' },
374 { "iterations", required_argument
, NULL
, ARG_ITERATIONS
},
375 { "base-time", required_argument
, NULL
, ARG_BASE_TIME
},
376 { "unit", required_argument
, NULL
, 'U' },
377 { "json", required_argument
, NULL
, ARG_JSON
},
378 { "profile", required_argument
, NULL
, ARG_PROFILE
},
379 { "table", optional_argument
, NULL
, ARG_TABLE
},
380 { "no-legend", optional_argument
, NULL
, ARG_NO_LEGEND
},
381 { "tldr", no_argument
, NULL
, ARG_TLDR
},
382 { "mask", no_argument
, NULL
, 'm' },
383 { "scale-svg", required_argument
, NULL
, ARG_SCALE_FACTOR_SVG
},
384 { "detailed", no_argument
, NULL
, ARG_DETAILED_SVG
},
385 { "drm-device", required_argument
, NULL
, ARG_DRM_DEVICE_PATH
},
389 bool reorder
= false;
390 int r
, c
, unit_shell
= -1;
395 /* Resetting to 0 forces the invocation of an internal initialization routine of getopt_long()
396 * that checks for GNU extensions in optstring ('-' or '+; at the beginning). */
400 static const char option_string
[] = "-hqH:M:U:m";
402 c
= getopt_long(argc
, argv
, option_string
+ reorder
, options
, NULL
);
408 case 1: /* getopt_long() returns 1 if "-" was the first character of the option string, and a
409 * non-option argument was discovered. */
413 /* We generally are fine with the fact that getopt_long() reorders the command line, and looks
414 * for switches after the main verb. However, for "unit-shell" we really don't want that, since we
415 * want that switches specified after the service name are passed to the program to execute,
416 * and not processed by us. To make this possible, we'll first invoke getopt_long() with
417 * reordering disabled (i.e. with the "-" prefix in the option string), looking for the first
418 * non-option parameter. If it's the verb "unit-shell" we remember its position and continue
419 * processing options. In this case, as soon as we hit the next non-option argument we found
420 * the service name, and stop further processing. If the first non-option argument is any other
421 * verb than "unit-shell" we switch to normal reordering mode and continue processing arguments
424 if (unit_shell
>= 0) {
425 optind
--; /* don't process this argument, go one step back */
428 if (streq(optarg
, "unit-shell"))
429 /* Remember the position of the "unit_shell" verb, and continue processing normally. */
430 unit_shell
= optind
- 1;
434 /* Ok, this is some other verb. In this case, turn on reordering again, and continue
435 * processing normally. */
438 /* We changed the option string. getopt_long() only looks at it again if we invoke it
439 * at least once with a reset option index. Hence, let's reset the option index here,
440 * then invoke getopt_long() again (ignoring what it has to say, after all we most
441 * likely already processed it), and the bump the option index so that we read the
442 * intended argument again. */
443 saved_optind
= optind
;
445 (void) getopt_long(argc
, argv
, option_string
+ reorder
, options
, NULL
);
446 optind
= saved_optind
- 1; /* go one step back, process this argument again */
452 return help(0, NULL
, NULL
);
461 case ARG_RECURSIVE_ERRORS
:
462 if (streq(optarg
, "help")) {
463 DUMP_STRING_TABLE(recursive_errors
, RecursiveErrors
, _RECURSIVE_ERRORS_MAX
);
466 r
= recursive_errors_from_string(optarg
);
468 return log_error_errno(r
, "Unknown mode passed to --recursive-errors='%s'.", optarg
);
470 arg_recursive_errors
= r
;
474 r
= parse_path_argument(optarg
, /* suppress_root= */ true, &arg_root
);
480 r
= parse_path_argument(optarg
, /* suppress_root= */ false, &arg_image
);
485 case ARG_IMAGE_POLICY
:
486 r
= parse_image_policy_argument(optarg
, &arg_image_policy
);
492 arg_runtime_scope
= RUNTIME_SCOPE_SYSTEM
;
496 arg_runtime_scope
= RUNTIME_SCOPE_USER
;
500 arg_runtime_scope
= RUNTIME_SCOPE_GLOBAL
;
508 arg_dot
= DEP_REQUIRE
;
511 case ARG_DOT_FROM_PATTERN
:
512 if (strv_extend(&arg_dot_from_patterns
, optarg
) < 0)
517 case ARG_DOT_TO_PATTERN
:
518 if (strv_extend(&arg_dot_to_patterns
, optarg
) < 0)
524 r
= parse_sec(optarg
, &arg_fuzz
);
530 arg_pager_flags
|= PAGER_DISABLE
;
534 arg_transport
= BUS_TRANSPORT_REMOTE
;
539 r
= parse_machine_argument(optarg
, &arg_host
, &arg_transport
);
545 r
= parse_boolean_argument("--man", optarg
, &arg_man
);
551 r
= parse_boolean_argument("--generators", optarg
, &arg_generators
);
557 arg_instance
= optarg
;
561 r
= parse_boolean_argument("--offline", optarg
, &arg_offline
);
567 r
= safe_atou(optarg
, &arg_threshold
);
568 if (r
< 0 || arg_threshold
> 100)
569 return log_error_errno(r
< 0 ? r
: SYNTHETIC_ERRNO(EINVAL
), "Failed to parse threshold: %s", optarg
);
573 case ARG_SECURITY_POLICY
:
574 r
= parse_path_argument(optarg
, /* suppress_root= */ false, &arg_security_policy
);
580 r
= parse_json_argument(optarg
, &arg_json_format_flags
);
586 r
= safe_atou(optarg
, &arg_iterations
);
588 return log_error_errno(r
, "Failed to parse iterations: %s", optarg
);
592 r
= parse_timestamp(optarg
, &arg_base_time
);
594 return log_error_errno(r
, "Failed to parse --base-time= parameter: %s", optarg
);
599 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Profile file name is empty");
601 if (is_path(optarg
)) {
602 r
= parse_path_argument(optarg
, /* suppress_root= */ false, &arg_profile
);
605 if (!endswith(arg_profile
, ".conf"))
606 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Profile file name must end with .conf: %s", arg_profile
);
608 r
= free_and_strdup(&arg_profile
, optarg
);
616 _cleanup_free_
char *mangled
= NULL
;
618 r
= unit_name_mangle(optarg
, UNIT_NAME_MANGLE_WARN
, &mangled
);
620 return log_error_errno(r
, "Failed to mangle unit name %s: %m", optarg
);
622 free_and_replace(arg_unit
, mangled
);
635 arg_cat_flags
= CAT_TLDR
;
639 arg_capability
= CAPABILITY_MASK
;
642 case ARG_SCALE_FACTOR_SVG
:
643 arg_svg_timescale
= strtod(optarg
, NULL
);
646 case ARG_DETAILED_SVG
:
647 arg_detailed_svg
= true;
650 case ARG_DRM_DEVICE_PATH
:
651 r
= parse_path_argument(optarg
, /* suppress_root= */ false, &arg_drm_device_path
);
660 assert_not_reached();
665 if (unit_shell
>= 0) {
668 /* We found the "unit-shell" verb while processing the argument list. Since we turned off reordering of the
669 * argument list initially let's readjust it now, and move the "unit-shell" verb to the back. */
671 optind
-= 1; /* place the option index where the "unit-shell" verb will be placed */
673 t
= argv
[unit_shell
];
674 for (int i
= unit_shell
; i
< optind
; i
++)
679 if (arg_offline
&& !streq_ptr(argv
[optind
], "security"))
680 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
681 "Option --offline= is only supported for security right now.");
683 if (arg_offline
&& optind
>= argc
- 1)
684 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
685 "Option --offline= requires one or more units to perform a security review.");
687 if (arg_threshold
!= 100 && !streq_ptr(argv
[optind
], "security"))
688 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
689 "Option --threshold= is only supported for security right now.");
691 if (arg_runtime_scope
== RUNTIME_SCOPE_GLOBAL
&& !streq_ptr(argv
[optind
], "unit-paths"))
692 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
693 "Option --global only makes sense with verb unit-paths.");
695 if (streq_ptr(argv
[optind
], "cat-config") && arg_runtime_scope
== RUNTIME_SCOPE_USER
)
696 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
697 "Option --user is not supported for cat-config right now.");
699 if (arg_security_policy
&& !streq_ptr(argv
[optind
], "security"))
700 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
701 "Option --security-policy= is only supported for security.");
703 if ((arg_root
|| arg_image
) && (!STRPTR_IN_SET(argv
[optind
], "cat-config", "verify", "condition", "inspect-elf")) &&
704 (!(streq_ptr(argv
[optind
], "security") && arg_offline
)))
705 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
706 "Options --root= and --image= are only supported for cat-config, verify, condition and security when used with --offline= right now.");
708 /* Having both an image and a root is not supported by the code */
709 if (arg_root
&& arg_image
)
710 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Please specify either --root= or --image=, the combination of both is not supported.");
712 if (arg_unit
&& !streq_ptr(argv
[optind
], "condition"))
713 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Option --unit= is only supported for condition");
715 if (streq_ptr(argv
[optind
], "condition") && !arg_unit
&& optind
>= argc
- 1)
716 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Too few arguments for condition");
718 if (streq_ptr(argv
[optind
], "condition") && arg_unit
&& optind
< argc
- 1)
719 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "No conditions can be passed if --unit= is used.");
721 if (arg_table
&& !streq_ptr(argv
[optind
], "plot"))
722 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Option --table is only supported for plot right now.");
724 if (arg_table
&& sd_json_format_enabled(arg_json_format_flags
))
725 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "--table and --json= are mutually exclusive.");
727 if (arg_capability
!= CAPABILITY_LITERAL
&& !streq_ptr(argv
[optind
], "capability"))
728 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Option --mask is only supported for capability.");
730 if (arg_drm_device_path
&& !streq_ptr(argv
[optind
], "chid"))
731 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Option --drm-device is only supported for chid right now.");
733 return 1; /* work to do */
736 static int run(int argc
, char *argv
[]) {
737 _cleanup_(loop_device_unrefp
) LoopDevice
*loop_device
= NULL
;
738 _cleanup_(umount_and_freep
) char *mounted_dir
= NULL
;
740 static const Verb verbs
[] = {
741 { "help", VERB_ANY
, VERB_ANY
, 0, help
},
742 { "time", VERB_ANY
, 1, VERB_DEFAULT
, verb_time
},
743 { "blame", VERB_ANY
, 1, 0, verb_blame
},
744 { "critical-chain", VERB_ANY
, VERB_ANY
, 0, verb_critical_chain
},
745 { "plot", VERB_ANY
, 1, 0, verb_plot
},
746 { "dot", VERB_ANY
, VERB_ANY
, 0, verb_dot
},
747 /* ↓ The following seven verbs are deprecated, from here … ↓ */
748 { "log-level", VERB_ANY
, 2, 0, verb_log_control
},
749 { "log-target", VERB_ANY
, 2, 0, verb_log_control
},
750 { "set-log-level", 2, 2, 0, verb_log_control
},
751 { "get-log-level", VERB_ANY
, 1, 0, verb_log_control
},
752 { "set-log-target", 2, 2, 0, verb_log_control
},
753 { "get-log-target", VERB_ANY
, 1, 0, verb_log_control
},
754 { "service-watchdogs", VERB_ANY
, 2, 0, verb_service_watchdogs
},
755 /* ↑ … until here ↑ */
756 { "dump", VERB_ANY
, VERB_ANY
, 0, verb_dump
},
757 { "cat-config", 2, VERB_ANY
, 0, verb_cat_config
},
758 { "unit-files", VERB_ANY
, VERB_ANY
, 0, verb_unit_files
},
759 { "unit-paths", 1, 1, 0, verb_unit_paths
},
760 { "unit-shell", 2, VERB_ANY
, 0, verb_unit_shell
},
761 { "exit-status", VERB_ANY
, VERB_ANY
, 0, verb_exit_status
},
762 { "syscall-filter", VERB_ANY
, VERB_ANY
, 0, verb_syscall_filters
},
763 { "capability", VERB_ANY
, VERB_ANY
, 0, verb_capabilities
},
764 { "filesystems", VERB_ANY
, VERB_ANY
, 0, verb_filesystems
},
765 { "condition", VERB_ANY
, VERB_ANY
, 0, verb_condition
},
766 { "compare-versions", 3, 4, 0, verb_compare_versions
},
767 { "verify", 2, VERB_ANY
, 0, verb_verify
},
768 { "calendar", 2, VERB_ANY
, 0, verb_calendar
},
769 { "timestamp", 2, VERB_ANY
, 0, verb_timestamp
},
770 { "timespan", 2, VERB_ANY
, 0, verb_timespan
},
771 { "security", VERB_ANY
, VERB_ANY
, 0, verb_security
},
772 { "inspect-elf", 2, VERB_ANY
, 0, verb_elf_inspection
},
773 { "malloc", VERB_ANY
, VERB_ANY
, 0, verb_malloc
},
774 { "fdstore", 2, VERB_ANY
, 0, verb_fdstore
},
775 { "image-policy", 2, 2, 0, verb_image_policy
},
776 { "has-tpm2", VERB_ANY
, 1, 0, verb_has_tpm2
},
777 { "pcrs", VERB_ANY
, VERB_ANY
, 0, verb_pcrs
},
778 { "srk", VERB_ANY
, 1, 0, verb_srk
},
779 { "architectures", VERB_ANY
, VERB_ANY
, 0, verb_architectures
},
780 { "smbios11", VERB_ANY
, 1, 0, verb_smbios11
},
781 { "chid", VERB_ANY
, VERB_ANY
, 0, verb_chid
},
782 { "transient-settings", 2, VERB_ANY
, 0, verb_transient_settings
},
788 setlocale(LC_ALL
, "");
789 setlocale(LC_NUMERIC
, "C"); /* we want to format/parse floats in C style */
793 r
= parse_argv(argc
, argv
);
797 /* Open up and mount the image */
801 r
= mount_image_privately_interactively(
804 DISSECT_IMAGE_GENERIC_ROOT
|
805 DISSECT_IMAGE_RELAX_VAR_CHECK
|
806 DISSECT_IMAGE_READ_ONLY
|
807 DISSECT_IMAGE_ALLOW_USERSPACE_VERITY
,
809 /* ret_dir_fd= */ NULL
,
814 arg_root
= strdup(mounted_dir
);
819 return dispatch_verb(argc
, argv
, verbs
, NULL
);
822 DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run
);