src/core/execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <poll.h>
   6 #include <sys/eventfd.h>
   7 #include <sys/ioctl.h>
   8 #include <sys/mman.h>
   9 #include <sys/mount.h>
  10 #include <sys/personality.h>
  11 #include <sys/prctl.h>
  12 #include <sys/shm.h>
  13 #include <sys/types.h>
  14 #include <sys/un.h>
  15 #include <unistd.h>
  16 #include <utmpx.h>
  17
  18 #if HAVE_PAM
  19 #include <security/pam_appl.h>
  20 #endif
  21
  22 #if HAVE_SELINUX
  23 #include <selinux/selinux.h>
  24 #endif
  25
  26 #if HAVE_SECCOMP
  27 #include <seccomp.h>
  28 #endif
  29
  30 #if HAVE_APPARMOR
  31 #include <sys/apparmor.h>
  32 #endif
  33
  34 #include "sd-messages.h"
  35
  36 #include "acl-util.h"
  37 #include "af-list.h"
  38 #include "alloc-util.h"
  39 #if HAVE_APPARMOR
  40 #include "apparmor-util.h"
  41 #endif
  42 #include "argv-util.h"
  43 #include "async.h"
  44 #include "barrier.h"
  45 #include "bpf-lsm.h"
  46 #include "cap-list.h"
  47 #include "capability-util.h"
  48 #include "cgroup-setup.h"
  49 #include "chase.h"
  50 #include "chown-recursive.h"
  51 #include "constants.h"
  52 #include "cpu-set-util.h"
  53 #include "creds-util.h"
  54 #include "data-fd-util.h"
  55 #include "env-file.h"
  56 #include "env-util.h"
  57 #include "errno-list.h"
  58 #include "escape.h"
  59 #include "execute.h"
  60 #include "exit-status.h"
  61 #include "fd-util.h"
  62 #include "fileio.h"
  63 #include "format-util.h"
  64 #include "glob-util.h"
  65 #include "hexdecoct.h"
  66 #include "io-util.h"
  67 #include "ioprio-util.h"
  68 #include "label-util.h"
  69 #include "log.h"
  70 #include "macro.h"
  71 #include "manager.h"
  72 #include "manager-dump.h"
  73 #include "memory-util.h"
  74 #include "missing_fs.h"
  75 #include "missing_ioprio.h"
  76 #include "missing_prctl.h"
  77 #include "mkdir-label.h"
  78 #include "mount-util.h"
  79 #include "mountpoint-util.h"
  80 #include "namespace.h"
  81 #include "parse-util.h"
  82 #include "path-util.h"
  83 #include "proc-cmdline.h"
  84 #include "process-util.h"
  85 #include "psi-util.h"
  86 #include "random-util.h"
  87 #include "recurse-dir.h"
  88 #include "rlimit-util.h"
  89 #include "rm-rf.h"
  90 #if HAVE_SECCOMP
  91 #include "seccomp-util.h"
  92 #endif
  93 #include "securebits-util.h"
  94 #include "selinux-util.h"
  95 #include "signal-util.h"
  96 #include "smack-util.h"
  97 #include "socket-util.h"
  98 #include "sort-util.h"
  99 #include "special.h"
 100 #include "stat-util.h"
 101 #include "string-table.h"
 102 #include "string-util.h"
 103 #include "strv.h"
 104 #include "syslog-util.h"
 105 #include "terminal-util.h"
 106 #include "tmpfile-util.h"
 107 #include "umask-util.h"
 108 #include "unit-serialize.h"
 109 #include "user-util.h"
 110 #include "utmp-wtmp.h"
 111
 112 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
 113 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
 114
 115 #define SNDBUF_SIZE (8*1024*1024)
 116
 117 static int shift_fds(int fds[], size_t n_fds) {
 118         if (n_fds <= 0)
 119                 return 0;
 120
 121         /* Modifies the fds array! (sorts it) */
 122
 123         assert(fds);
 124
 125         for (int start = 0;;) {
 126                 int restart_from = -1;
 127
 128                 for (int i = start; i < (int) n_fds; i++) {
 129                         int nfd;
 130
 131                         /* Already at right index? */
 132                         if (fds[i] == i+3)
 133                                 continue;
 134
 135                         nfd = fcntl(fds[i], F_DUPFD, i + 3);
 136                         if (nfd < 0)
 137                                 return -errno;
 138
 139                         safe_close(fds[i]);
 140                         fds[i] = nfd;
 141
 142                         /* Hmm, the fd we wanted isn't free? Then
 143                          * let's remember that and try again from here */
 144                         if (nfd != i+3 && restart_from < 0)
 145                                 restart_from = i;
 146                 }
 147
 148                 if (restart_from < 0)
 149                         break;
 150
 151                 start = restart_from;
 152         }
 153
 154         return 0;
 155 }
 156
 157 static int flags_fds(
 158                 const int fds[],
 159                 size_t n_socket_fds,
 160                 size_t n_fds,
 161                 bool nonblock) {
 162
 163         int r;
 164
 165         if (n_fds <= 0)
 166                 return 0;
 167
 168         assert(fds);
 169
 170         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags.
 171          * O_NONBLOCK only applies to socket activation though. */
 172
 173         for (size_t i = 0; i < n_fds; i++) {
 174
 175                 if (i < n_socket_fds) {
 176                         r = fd_nonblock(fds[i], nonblock);
 177                         if (r < 0)
 178                                 return r;
 179                 }
 180
 181                 /* We unconditionally drop FD_CLOEXEC from the fds,
 182                  * since after all we want to pass these fds to our
 183                  * children */
 184
 185                 r = fd_cloexec(fds[i], false);
 186                 if (r < 0)
 187                         return r;
 188         }
 189
 190         return 0;
 191 }
 192
 193 static const char *exec_context_tty_path(const ExecContext *context) {
 194         assert(context);
 195
 196         if (context->stdio_as_fds)
 197                 return NULL;
 198
 199         if (context->tty_path)
 200                 return context->tty_path;
 201
 202         return "/dev/console";
 203 }
 204
 205 static int exec_context_tty_size(const ExecContext *context, unsigned *ret_rows, unsigned *ret_cols) {
 206         _cleanup_free_ char *rowskey = NULL, *rowsvalue = NULL, *colskey = NULL, *colsvalue = NULL;
 207         unsigned rows, cols;
 208         const char *tty;
 209         int r;
 210
 211         assert(context);
 212         assert(ret_rows);
 213         assert(ret_cols);
 214
 215         rows = context->tty_rows;
 216         cols = context->tty_cols;
 217
 218         tty = exec_context_tty_path(context);
 219         if (!tty || (rows != UINT_MAX && cols != UINT_MAX)) {
 220                 *ret_rows = rows;
 221                 *ret_cols = cols;
 222                 return 0;
 223         }
 224
 225         tty = skip_dev_prefix(tty);
 226         if (!in_charset(tty, ALPHANUMERICAL)) {
 227                 log_debug("%s contains non-alphanumeric characters, ignoring", tty);
 228                 *ret_rows = rows;
 229                 *ret_cols = cols;
 230                 return 0;
 231         }
 232
 233         rowskey = strjoin("systemd.tty.rows.", tty);
 234         if (!rowskey)
 235                 return -ENOMEM;
 236
 237         colskey = strjoin("systemd.tty.columns.", tty);
 238         if (!colskey)
 239                 return -ENOMEM;
 240
 241         r = proc_cmdline_get_key_many(/* flags = */ 0,
 242                                       rowskey, &rowsvalue,
 243                                       colskey, &colsvalue);
 244         if (r < 0)
 245                 log_debug_errno(r, "Failed to read TTY size of %s from kernel cmdline, ignoring: %m", tty);
 246
 247         if (rows == UINT_MAX && rowsvalue) {
 248                 r = safe_atou(rowsvalue, &rows);
 249                 if (r < 0)
 250                         log_debug_errno(r, "Failed to parse %s=%s, ignoring: %m", rowskey, rowsvalue);
 251         }
 252
 253         if (cols == UINT_MAX && colsvalue) {
 254                 r = safe_atou(colsvalue, &cols);
 255                 if (r < 0)
 256                         log_debug_errno(r, "Failed to parse %s=%s, ignoring: %m", colskey, colsvalue);
 257         }
 258
 259         *ret_rows = rows;
 260         *ret_cols = cols;
 261
 262         return 0;
 263 }
 264
 265 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
 266         const char *path;
 267
 268         assert(context);
 269
 270         path = exec_context_tty_path(context);
 271
 272         if (context->tty_vhangup) {
 273                 if (p && p->stdin_fd >= 0)
 274                         (void) terminal_vhangup_fd(p->stdin_fd);
 275                 else if (path)
 276                         (void) terminal_vhangup(path);
 277         }
 278
 279         if (context->tty_reset) {
 280                 if (p && p->stdin_fd >= 0)
 281                         (void) reset_terminal_fd(p->stdin_fd, true);
 282                 else if (path)
 283                         (void) reset_terminal(path);
 284         }
 285
 286         if (p && p->stdin_fd >= 0) {
 287                 unsigned rows = context->tty_rows, cols = context->tty_cols;
 288
 289                 (void) exec_context_tty_size(context, &rows, &cols);
 290                 (void) terminal_set_size_fd(p->stdin_fd, path, rows, cols);
 291         }
 292
 293         if (context->tty_vt_disallocate && path)
 294                 (void) vt_disallocate(path);
 295 }
 296
 297 static bool is_terminal_input(ExecInput i) {
 298         return IN_SET(i,
 299                       EXEC_INPUT_TTY,
 300                       EXEC_INPUT_TTY_FORCE,
 301                       EXEC_INPUT_TTY_FAIL);
 302 }
 303
 304 static bool is_terminal_output(ExecOutput o) {
 305         return IN_SET(o,
 306                       EXEC_OUTPUT_TTY,
 307                       EXEC_OUTPUT_KMSG_AND_CONSOLE,
 308                       EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 309 }
 310
 311 static bool is_kmsg_output(ExecOutput o) {
 312         return IN_SET(o,
 313                       EXEC_OUTPUT_KMSG,
 314                       EXEC_OUTPUT_KMSG_AND_CONSOLE);
 315 }
 316
 317 static bool exec_context_needs_term(const ExecContext *c) {
 318         assert(c);
 319
 320         /* Return true if the execution context suggests we should set $TERM to something useful. */
 321
 322         if (is_terminal_input(c->std_input))
 323                 return true;
 324
 325         if (is_terminal_output(c->std_output))
 326                 return true;
 327
 328         if (is_terminal_output(c->std_error))
 329                 return true;
 330
 331         return !!c->tty_path;
 332 }
 333
 334 static int open_null_as(int flags, int nfd) {
 335         int fd;
 336
 337         assert(nfd >= 0);
 338
 339         fd = open("/dev/null", flags|O_NOCTTY);
 340         if (fd < 0)
 341                 return -errno;
 342
 343         return move_fd(fd, nfd, false);
 344 }
 345
 346 static int connect_journal_socket(
 347                 int fd,
 348                 const char *log_namespace,
 349                 uid_t uid,
 350                 gid_t gid) {
 351
 352         uid_t olduid = UID_INVALID;
 353         gid_t oldgid = GID_INVALID;
 354         const char *j;
 355         int r;
 356
 357         j = log_namespace ?
 358                 strjoina("/run/systemd/journal.", log_namespace, "/stdout") :
 359                 "/run/systemd/journal/stdout";
 360
 361         if (gid_is_valid(gid)) {
 362                 oldgid = getgid();
 363
 364                 if (setegid(gid) < 0)
 365                         return -errno;
 366         }
 367
 368         if (uid_is_valid(uid)) {
 369                 olduid = getuid();
 370
 371                 if (seteuid(uid) < 0) {
 372                         r = -errno;
 373                         goto restore_gid;
 374                 }
 375         }
 376
 377         r = connect_unix_path(fd, AT_FDCWD, j);
 378
 379         /* If we fail to restore the uid or gid, things will likely fail later on. This should only happen if
 380            an LSM interferes. */
 381
 382         if (uid_is_valid(uid))
 383                 (void) seteuid(olduid);
 384
 385  restore_gid:
 386         if (gid_is_valid(gid))
 387                 (void) setegid(oldgid);
 388
 389         return r;
 390 }
 391
 392 static int connect_logger_as(
 393                 const Unit *unit,
 394                 const ExecContext *context,
 395                 const ExecParameters *params,
 396                 ExecOutput output,
 397                 const char *ident,
 398                 int nfd,
 399                 uid_t uid,
 400                 gid_t gid) {
 401
 402         _cleanup_close_ int fd = -EBADF;
 403         int r;
 404
 405         assert(context);
 406         assert(params);
 407         assert(output < _EXEC_OUTPUT_MAX);
 408         assert(ident);
 409         assert(nfd >= 0);
 410
 411         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 412         if (fd < 0)
 413                 return -errno;
 414
 415         r = connect_journal_socket(fd, context->log_namespace, uid, gid);
 416         if (r < 0)
 417                 return r;
 418
 419         if (shutdown(fd, SHUT_RD) < 0)
 420                 return -errno;
 421
 422         (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
 423
 424         if (dprintf(fd,
 425                 "%s\n"
 426                 "%s\n"
 427                 "%i\n"
 428                 "%i\n"
 429                 "%i\n"
 430                 "%i\n"
 431                 "%i\n",
 432                 context->syslog_identifier ?: ident,
 433                 params->flags & EXEC_PASS_LOG_UNIT ? unit->id : "",
 434                 context->syslog_priority,
 435                 !!context->syslog_level_prefix,
 436                 false,
 437                 is_kmsg_output(output),
 438                 is_terminal_output(output)) < 0)
 439                 return -errno;
 440
 441         return move_fd(TAKE_FD(fd), nfd, false);
 442 }
 443
 444 static int open_terminal_as(const char *path, int flags, int nfd) {
 445         int fd;
 446
 447         assert(path);
 448         assert(nfd >= 0);
 449
 450         fd = open_terminal(path, flags | O_NOCTTY);
 451         if (fd < 0)
 452                 return fd;
 453
 454         return move_fd(fd, nfd, false);
 455 }
 456
 457 static int acquire_path(const char *path, int flags, mode_t mode) {
 458         _cleanup_close_ int fd = -EBADF;
 459         int r;
 460
 461         assert(path);
 462
 463         if (IN_SET(flags & O_ACCMODE, O_WRONLY, O_RDWR))
 464                 flags |= O_CREAT;
 465
 466         fd = open(path, flags|O_NOCTTY, mode);
 467         if (fd >= 0)
 468                 return TAKE_FD(fd);
 469
 470         if (errno != ENXIO) /* ENXIO is returned when we try to open() an AF_UNIX file system socket on Linux */
 471                 return -errno;
 472
 473         /* So, it appears the specified path could be an AF_UNIX socket. Let's see if we can connect to it. */
 474
 475         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 476         if (fd < 0)
 477                 return -errno;
 478
 479         r = connect_unix_path(fd, AT_FDCWD, path);
 480         if (IN_SET(r, -ENOTSOCK, -EINVAL))
 481                 /* Propagate initial error if we get ENOTSOCK or EINVAL, i.e. we have indication that this
 482                  * wasn't an AF_UNIX socket after all */
 483                 return -ENXIO;
 484         if (r < 0)
 485                 return r;
 486
 487         if ((flags & O_ACCMODE) == O_RDONLY)
 488                 r = shutdown(fd, SHUT_WR);
 489         else if ((flags & O_ACCMODE) == O_WRONLY)
 490                 r = shutdown(fd, SHUT_RD);
 491         else
 492                 r = 0;
 493         if (r < 0)
 494                 return -errno;
 495
 496         return TAKE_FD(fd);
 497 }
 498
 499 static int fixup_input(
 500                 const ExecContext *context,
 501                 int socket_fd,
 502                 bool apply_tty_stdin) {
 503
 504         ExecInput std_input;
 505
 506         assert(context);
 507
 508         std_input = context->std_input;
 509
 510         if (is_terminal_input(std_input) && !apply_tty_stdin)
 511                 return EXEC_INPUT_NULL;
 512
 513         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 514                 return EXEC_INPUT_NULL;
 515
 516         if (std_input == EXEC_INPUT_DATA && context->stdin_data_size == 0)
 517                 return EXEC_INPUT_NULL;
 518
 519         return std_input;
 520 }
 521
 522 static int fixup_output(ExecOutput output, int socket_fd) {
 523
 524         if (output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 525                 return EXEC_OUTPUT_INHERIT;
 526
 527         return output;
 528 }
 529
 530 static int setup_input(
 531                 const ExecContext *context,
 532                 const ExecParameters *params,
 533                 int socket_fd,
 534                 const int named_iofds[static 3]) {
 535
 536         ExecInput i;
 537         int r;
 538
 539         assert(context);
 540         assert(params);
 541         assert(named_iofds);
 542
 543         if (params->stdin_fd >= 0) {
 544                 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
 545                         return -errno;
 546
 547                 /* Try to make this the controlling tty, if it is a tty, and reset it */
 548                 if (isatty(STDIN_FILENO)) {
 549                         unsigned rows = context->tty_rows, cols = context->tty_cols;
 550
 551                         (void) exec_context_tty_size(context, &rows, &cols);
 552                         (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
 553                         (void) reset_terminal_fd(STDIN_FILENO, true);
 554                         (void) terminal_set_size_fd(STDIN_FILENO, NULL, rows, cols);
 555                 }
 556
 557                 return STDIN_FILENO;
 558         }
 559
 560         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 561
 562         switch (i) {
 563
 564         case EXEC_INPUT_NULL:
 565                 return open_null_as(O_RDONLY, STDIN_FILENO);
 566
 567         case EXEC_INPUT_TTY:
 568         case EXEC_INPUT_TTY_FORCE:
 569         case EXEC_INPUT_TTY_FAIL: {
 570                 unsigned rows, cols;
 571                 int fd;
 572
 573                 fd = acquire_terminal(exec_context_tty_path(context),
 574                                       i == EXEC_INPUT_TTY_FAIL  ? ACQUIRE_TERMINAL_TRY :
 575                                       i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE :
 576                                                                   ACQUIRE_TERMINAL_WAIT,
 577                                       USEC_INFINITY);
 578                 if (fd < 0)
 579                         return fd;
 580
 581                 r = exec_context_tty_size(context, &rows, &cols);
 582                 if (r < 0)
 583                         return r;
 584
 585                 r = terminal_set_size_fd(fd, exec_context_tty_path(context), rows, cols);
 586                 if (r < 0)
 587                         return r;
 588
 589                 return move_fd(fd, STDIN_FILENO, false);
 590         }
 591
 592         case EXEC_INPUT_SOCKET:
 593                 assert(socket_fd >= 0);
 594
 595                 return RET_NERRNO(dup2(socket_fd, STDIN_FILENO));
 596
 597         case EXEC_INPUT_NAMED_FD:
 598                 assert(named_iofds[STDIN_FILENO] >= 0);
 599
 600                 (void) fd_nonblock(named_iofds[STDIN_FILENO], false);
 601                 return RET_NERRNO(dup2(named_iofds[STDIN_FILENO], STDIN_FILENO));
 602
 603         case EXEC_INPUT_DATA: {
 604                 int fd;
 605
 606                 fd = acquire_data_fd(context->stdin_data, context->stdin_data_size, 0);
 607                 if (fd < 0)
 608                         return fd;
 609
 610                 return move_fd(fd, STDIN_FILENO, false);
 611         }
 612
 613         case EXEC_INPUT_FILE: {
 614                 bool rw;
 615                 int fd;
 616
 617                 assert(context->stdio_file[STDIN_FILENO]);
 618
 619                 rw = (context->std_output == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDOUT_FILENO])) ||
 620                         (context->std_error == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDERR_FILENO]));
 621
 622                 fd = acquire_path(context->stdio_file[STDIN_FILENO], rw ? O_RDWR : O_RDONLY, 0666 & ~context->umask);
 623                 if (fd < 0)
 624                         return fd;
 625
 626                 return move_fd(fd, STDIN_FILENO, false);
 627         }
 628
 629         default:
 630                 assert_not_reached();
 631         }
 632 }
 633
 634 static bool can_inherit_stderr_from_stdout(
 635                 const ExecContext *context,
 636                 ExecOutput o,
 637                 ExecOutput e) {
 638
 639         assert(context);
 640
 641         /* Returns true, if given the specified STDERR and STDOUT output we can directly dup() the stdout fd to the
 642          * stderr fd */
 643
 644         if (e == EXEC_OUTPUT_INHERIT)
 645                 return true;
 646         if (e != o)
 647                 return false;
 648
 649         if (e == EXEC_OUTPUT_NAMED_FD)
 650                 return streq_ptr(context->stdio_fdname[STDOUT_FILENO], context->stdio_fdname[STDERR_FILENO]);
 651
 652         if (IN_SET(e, EXEC_OUTPUT_FILE, EXEC_OUTPUT_FILE_APPEND, EXEC_OUTPUT_FILE_TRUNCATE))
 653                 return streq_ptr(context->stdio_file[STDOUT_FILENO], context->stdio_file[STDERR_FILENO]);
 654
 655         return true;
 656 }
 657
 658 static int setup_output(
 659                 const Unit *unit,
 660                 const ExecContext *context,
 661                 const ExecParameters *params,
 662                 int fileno,
 663                 int socket_fd,
 664                 const int named_iofds[static 3],
 665                 const char *ident,
 666                 uid_t uid,
 667                 gid_t gid,
 668                 dev_t *journal_stream_dev,
 669                 ino_t *journal_stream_ino) {
 670
 671         ExecOutput o;
 672         ExecInput i;
 673         int r;
 674
 675         assert(unit);
 676         assert(context);
 677         assert(params);
 678         assert(ident);
 679         assert(journal_stream_dev);
 680         assert(journal_stream_ino);
 681
 682         if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
 683
 684                 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
 685                         return -errno;
 686
 687                 return STDOUT_FILENO;
 688         }
 689
 690         if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
 691                 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
 692                         return -errno;
 693
 694                 return STDERR_FILENO;
 695         }
 696
 697         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 698         o = fixup_output(context->std_output, socket_fd);
 699
 700         if (fileno == STDERR_FILENO) {
 701                 ExecOutput e;
 702                 e = fixup_output(context->std_error, socket_fd);
 703
 704                 /* This expects the input and output are already set up */
 705
 706                 /* Don't change the stderr file descriptor if we inherit all
 707                  * the way and are not on a tty */
 708                 if (e == EXEC_OUTPUT_INHERIT &&
 709                     o == EXEC_OUTPUT_INHERIT &&
 710                     i == EXEC_INPUT_NULL &&
 711                     !is_terminal_input(context->std_input) &&
 712                     getppid() != 1)
 713                         return fileno;
 714
 715                 /* Duplicate from stdout if possible */
 716                 if (can_inherit_stderr_from_stdout(context, o, e))
 717                         return RET_NERRNO(dup2(STDOUT_FILENO, fileno));
 718
 719                 o = e;
 720
 721         } else if (o == EXEC_OUTPUT_INHERIT) {
 722                 /* If input got downgraded, inherit the original value */
 723                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 724                         return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 725
 726                 /* If the input is connected to anything that's not a /dev/null or a data fd, inherit that... */
 727                 if (!IN_SET(i, EXEC_INPUT_NULL, EXEC_INPUT_DATA))
 728                         return RET_NERRNO(dup2(STDIN_FILENO, fileno));
 729
 730                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 731                 if (getppid() != 1)
 732                         return fileno;
 733
 734                 /* We need to open /dev/null here anew, to get the right access mode. */
 735                 return open_null_as(O_WRONLY, fileno);
 736         }
 737
 738         switch (o) {
 739
 740         case EXEC_OUTPUT_NULL:
 741                 return open_null_as(O_WRONLY, fileno);
 742
 743         case EXEC_OUTPUT_TTY:
 744                 if (is_terminal_input(i))
 745                         return RET_NERRNO(dup2(STDIN_FILENO, fileno));
 746
 747                 /* We don't reset the terminal if this is just about output */
 748                 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 749
 750         case EXEC_OUTPUT_KMSG:
 751         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 752         case EXEC_OUTPUT_JOURNAL:
 753         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 754                 r = connect_logger_as(unit, context, params, o, ident, fileno, uid, gid);
 755                 if (r < 0) {
 756                         log_unit_warning_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m",
 757                                                fileno == STDOUT_FILENO ? "stdout" : "stderr");
 758                         r = open_null_as(O_WRONLY, fileno);
 759                 } else {
 760                         struct stat st;
 761
 762                         /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
 763                          * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
 764                          * services to detect whether they are connected to the journal or not.
 765                          *
 766                          * If both stdout and stderr are connected to a stream then let's make sure to store the data
 767                          * about STDERR as that's usually the best way to do logging. */
 768
 769                         if (fstat(fileno, &st) >= 0 &&
 770                             (*journal_stream_ino == 0 || fileno == STDERR_FILENO)) {
 771                                 *journal_stream_dev = st.st_dev;
 772                                 *journal_stream_ino = st.st_ino;
 773                         }
 774                 }
 775                 return r;
 776
 777         case EXEC_OUTPUT_SOCKET:
 778                 assert(socket_fd >= 0);
 779
 780                 return RET_NERRNO(dup2(socket_fd, fileno));
 781
 782         case EXEC_OUTPUT_NAMED_FD:
 783                 assert(named_iofds[fileno] >= 0);
 784
 785                 (void) fd_nonblock(named_iofds[fileno], false);
 786                 return RET_NERRNO(dup2(named_iofds[fileno], fileno));
 787
 788         case EXEC_OUTPUT_FILE:
 789         case EXEC_OUTPUT_FILE_APPEND:
 790         case EXEC_OUTPUT_FILE_TRUNCATE: {
 791                 bool rw;
 792                 int fd, flags;
 793
 794                 assert(context->stdio_file[fileno]);
 795
 796                 rw = context->std_input == EXEC_INPUT_FILE &&
 797                         streq_ptr(context->stdio_file[fileno], context->stdio_file[STDIN_FILENO]);
 798
 799                 if (rw)
 800                         return RET_NERRNO(dup2(STDIN_FILENO, fileno));
 801
 802                 flags = O_WRONLY;
 803                 if (o == EXEC_OUTPUT_FILE_APPEND)
 804                         flags |= O_APPEND;
 805                 else if (o == EXEC_OUTPUT_FILE_TRUNCATE)
 806                         flags |= O_TRUNC;
 807
 808                 fd = acquire_path(context->stdio_file[fileno], flags, 0666 & ~context->umask);
 809                 if (fd < 0)
 810                         return fd;
 811
 812                 return move_fd(fd, fileno, 0);
 813         }
 814
 815         default:
 816                 assert_not_reached();
 817         }
 818 }
 819
 820 static int chown_terminal(int fd, uid_t uid) {
 821         int r;
 822
 823         assert(fd >= 0);
 824
 825         /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
 826         if (isatty(fd) < 1) {
 827                 if (IN_SET(errno, EINVAL, ENOTTY))
 828                         return 0; /* not a tty */
 829
 830                 return -errno;
 831         }
 832
 833         /* This might fail. What matters are the results. */
 834         r = fchmod_and_chown(fd, TTY_MODE, uid, GID_INVALID);
 835         if (r < 0)
 836                 return r;
 837
 838         return 1;
 839 }
 840
 841 static int setup_confirm_stdio(
 842                 const ExecContext *context,
 843                 const char *vc,
 844                 int *ret_saved_stdin,
 845                 int *ret_saved_stdout) {
 846
 847         _cleanup_close_ int fd = -EBADF, saved_stdin = -EBADF, saved_stdout = -EBADF;
 848         unsigned rows, cols;
 849         int r;
 850
 851         assert(ret_saved_stdin);
 852         assert(ret_saved_stdout);
 853
 854         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 855         if (saved_stdin < 0)
 856                 return -errno;
 857
 858         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 859         if (saved_stdout < 0)
 860                 return -errno;
 861
 862         fd = acquire_terminal(vc, ACQUIRE_TERMINAL_WAIT, DEFAULT_CONFIRM_USEC);
 863         if (fd < 0)
 864                 return fd;
 865
 866         r = chown_terminal(fd, getuid());
 867         if (r < 0)
 868                 return r;
 869
 870         r = reset_terminal_fd(fd, true);
 871         if (r < 0)
 872                 return r;
 873
 874         r = exec_context_tty_size(context, &rows, &cols);
 875         if (r < 0)
 876                 return r;
 877
 878         r = terminal_set_size_fd(fd, vc, rows, cols);
 879         if (r < 0)
 880                 return r;
 881
 882         r = rearrange_stdio(fd, fd, STDERR_FILENO); /* Invalidates 'fd' also on failure */
 883         TAKE_FD(fd);
 884         if (r < 0)
 885                 return r;
 886
 887         *ret_saved_stdin = TAKE_FD(saved_stdin);
 888         *ret_saved_stdout = TAKE_FD(saved_stdout);
 889         return 0;
 890 }
 891
 892 static void write_confirm_error_fd(int err, int fd, const Unit *u) {
 893         assert(err < 0);
 894
 895         if (err == -ETIMEDOUT)
 896                 dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);
 897         else {
 898                 errno = -err;
 899                 dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);
 900         }
 901 }
 902
 903 static void write_confirm_error(int err, const char *vc, const Unit *u) {
 904         _cleanup_close_ int fd = -EBADF;
 905
 906         assert(vc);
 907
 908         fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);
 909         if (fd < 0)
 910                 return;
 911
 912         write_confirm_error_fd(err, fd, u);
 913 }
 914
 915 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
 916         int r = 0;
 917
 918         assert(saved_stdin);
 919         assert(saved_stdout);
 920
 921         release_terminal();
 922
 923         if (*saved_stdin >= 0)
 924                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 925                         r = -errno;
 926
 927         if (*saved_stdout >= 0)
 928                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 929                         r = -errno;
 930
 931         *saved_stdin = safe_close(*saved_stdin);
 932         *saved_stdout = safe_close(*saved_stdout);
 933
 934         return r;
 935 }
 936
 937 enum {
 938         CONFIRM_PRETEND_FAILURE = -1,
 939         CONFIRM_PRETEND_SUCCESS =  0,
 940         CONFIRM_EXECUTE = 1,
 941 };
 942
 943 static int ask_for_confirmation(const ExecContext *context, const char *vc, Unit *u, const char *cmdline) {
 944         int saved_stdout = -1, saved_stdin = -1, r;
 945         _cleanup_free_ char *e = NULL;
 946         char c;
 947
 948         /* For any internal errors, assume a positive response. */
 949         r = setup_confirm_stdio(context, vc, &saved_stdin, &saved_stdout);
 950         if (r < 0) {
 951                 write_confirm_error(r, vc, u);
 952                 return CONFIRM_EXECUTE;
 953         }
 954
 955         /* confirm_spawn might have been disabled while we were sleeping. */
 956         if (manager_is_confirm_spawn_disabled(u->manager)) {
 957                 r = 1;
 958                 goto restore_stdio;
 959         }
 960
 961         e = ellipsize(cmdline, 60, 100);
 962         if (!e) {
 963                 log_oom();
 964                 r = CONFIRM_EXECUTE;
 965                 goto restore_stdio;
 966         }
 967
 968         for (;;) {
 969                 r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);
 970                 if (r < 0) {
 971                         write_confirm_error_fd(r, STDOUT_FILENO, u);
 972                         r = CONFIRM_EXECUTE;
 973                         goto restore_stdio;
 974                 }
 975
 976                 switch (c) {
 977                 case 'c':
 978                         printf("Resuming normal execution.\n");
 979                         manager_disable_confirm_spawn();
 980                         r = 1;
 981                         break;
 982                 case 'D':
 983                         unit_dump(u, stdout, "  ");
 984                         continue; /* ask again */
 985                 case 'f':
 986                         printf("Failing execution.\n");
 987                         r = CONFIRM_PRETEND_FAILURE;
 988                         break;
 989                 case 'h':
 990                         printf("  c - continue, proceed without asking anymore\n"
 991                                "  D - dump, show the state of the unit\n"
 992                                "  f - fail, don't execute the command and pretend it failed\n"
 993                                "  h - help\n"
 994                                "  i - info, show a short summary of the unit\n"
 995                                "  j - jobs, show jobs that are in progress\n"
 996                                "  s - skip, don't execute the command and pretend it succeeded\n"
 997                                "  y - yes, execute the command\n");
 998                         continue; /* ask again */
 999                 case 'i':
1000                         printf("  Description: %s\n"
1001                                "  Unit:        %s\n"
1002                                "  Command:     %s\n",
1003                                u->id, u->description, cmdline);
1004                         continue; /* ask again */
1005                 case 'j':
1006                         manager_dump_jobs(u->manager, stdout, /* patterns= */ NULL, "  ");
1007                         continue; /* ask again */
1008                 case 'n':
1009                         /* 'n' was removed in favor of 'f'. */
1010                         printf("Didn't understand 'n', did you mean 'f'?\n");
1011                         continue; /* ask again */
1012                 case 's':
1013                         printf("Skipping execution.\n");
1014                         r = CONFIRM_PRETEND_SUCCESS;
1015                         break;
1016                 case 'y':
1017                         r = CONFIRM_EXECUTE;
1018                         break;
1019                 default:
1020                         assert_not_reached();
1021                 }
1022                 break;
1023         }
1024
1025 restore_stdio:
1026         restore_confirm_stdio(&saved_stdin, &saved_stdout);
1027         return r;
1028 }
1029
1030 static int get_fixed_user(const ExecContext *c, const char **user,
1031                           uid_t *uid, gid_t *gid,
1032                           const char **home, const char **shell) {
1033         int r;
1034         const char *name;
1035
1036         assert(c);
1037
1038         if (!c->user)
1039                 return 0;
1040
1041         /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway
1042          * (i.e. are "/" or "/bin/nologin"). */
1043
1044         name = c->user;
1045         r = get_user_creds(&name, uid, gid, home, shell, USER_CREDS_CLEAN);
1046         if (r < 0)
1047                 return r;
1048
1049         *user = name;
1050         return 0;
1051 }
1052
1053 static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {
1054         int r;
1055         const char *name;
1056
1057         assert(c);
1058
1059         if (!c->group)
1060                 return 0;
1061
1062         name = c->group;
1063         r = get_group_creds(&name, gid, 0);
1064         if (r < 0)
1065                 return r;
1066
1067         *group = name;
1068         return 0;
1069 }
1070
1071 static int get_supplementary_groups(const ExecContext *c, const char *user,
1072                                     const char *group, gid_t gid,
1073                                     gid_t **supplementary_gids, int *ngids) {
1074         int r, k = 0;
1075         int ngroups_max;
1076         bool keep_groups = false;
1077         gid_t *groups = NULL;
1078         _cleanup_free_ gid_t *l_gids = NULL;
1079
1080         assert(c);
1081
1082         /*
1083          * If user is given, then lookup GID and supplementary groups list.
1084          * We avoid NSS lookups for gid=0. Also we have to initialize groups
1085          * here and as early as possible so we keep the list of supplementary
1086          * groups of the caller.
1087          */
1088         if (user && gid_is_valid(gid) && gid != 0) {
1089                 /* First step, initialize groups from /etc/groups */
1090                 if (initgroups(user, gid) < 0)
1091                         return -errno;
1092
1093                 keep_groups = true;
1094         }
1095
1096         if (strv_isempty(c->supplementary_groups))
1097                 return 0;
1098
1099         /*
1100          * If SupplementaryGroups= was passed then NGROUPS_MAX has to
1101          * be positive, otherwise fail.
1102          */
1103         errno = 0;
1104         ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
1105         if (ngroups_max <= 0)
1106                 return errno_or_else(EOPNOTSUPP);
1107
1108         l_gids = new(gid_t, ngroups_max);
1109         if (!l_gids)
1110                 return -ENOMEM;
1111
1112         if (keep_groups) {
1113                 /*
1114                  * Lookup the list of groups that the user belongs to, we
1115                  * avoid NSS lookups here too for gid=0.
1116                  */
1117                 k = ngroups_max;
1118                 if (getgrouplist(user, gid, l_gids, &k) < 0)
1119                         return -EINVAL;
1120         } else
1121                 k = 0;
1122
1123         STRV_FOREACH(i, c->supplementary_groups) {
1124                 const char *g;
1125
1126                 if (k >= ngroups_max)
1127                         return -E2BIG;
1128
1129                 g = *i;
1130                 r = get_group_creds(&g, l_gids+k, 0);
1131                 if (r < 0)
1132                         return r;
1133
1134                 k++;
1135         }
1136
1137         /*
1138          * Sets ngids to zero to drop all supplementary groups, happens
1139          * when we are under root and SupplementaryGroups= is empty.
1140          */
1141         if (k == 0) {
1142                 *ngids = 0;
1143                 return 0;
1144         }
1145
1146         /* Otherwise get the final list of supplementary groups */
1147         groups = memdup(l_gids, sizeof(gid_t) * k);
1148         if (!groups)
1149                 return -ENOMEM;
1150
1151         *supplementary_gids = groups;
1152         *ngids = k;
1153
1154         groups = NULL;
1155
1156         return 0;
1157 }
1158
1159 static int enforce_groups(gid_t gid, const gid_t *supplementary_gids, int ngids) {
1160         int r;
1161
1162         /* Handle SupplementaryGroups= if it is not empty */
1163         if (ngids > 0) {
1164                 r = maybe_setgroups(ngids, supplementary_gids);
1165                 if (r < 0)
1166                         return r;
1167         }
1168
1169         if (gid_is_valid(gid)) {
1170                 /* Then set our gids */
1171                 if (setresgid(gid, gid, gid) < 0)
1172                         return -errno;
1173         }
1174
1175         return 0;
1176 }
1177
1178 static int set_securebits(unsigned bits, unsigned mask) {
1179         unsigned applied;
1180         int current;
1181
1182         current = prctl(PR_GET_SECUREBITS);
1183         if (current < 0)
1184                 return -errno;
1185
1186         /* Clear all securebits defined in mask and set bits */
1187         applied = ((unsigned) current & ~mask) | bits;
1188         if ((unsigned) current == applied)
1189                 return 0;
1190
1191         if (prctl(PR_SET_SECUREBITS, applied) < 0)
1192                 return -errno;
1193
1194         return 1;
1195 }
1196
1197 static int enforce_user(
1198                 const ExecContext *context,
1199                 uid_t uid,
1200                 uint64_t capability_ambient_set) {
1201         assert(context);
1202         int r;
1203
1204         if (!uid_is_valid(uid))
1205                 return 0;
1206
1207         /* Sets (but doesn't look up) the UIS and makes sure we keep the capabilities while doing so. For
1208          * setting secure bits the capability CAP_SETPCAP is required, so we also need keep-caps in this
1209          * case. */
1210
1211         if ((capability_ambient_set != 0 || context->secure_bits != 0) && uid != 0) {
1212
1213                 /* First step: If we need to keep capabilities but drop privileges we need to make sure we
1214                  * keep our caps, while we drop privileges. Add KEEP_CAPS to the securebits */
1215                 r = set_securebits(1U << SECURE_KEEP_CAPS, 0);
1216                 if (r < 0)
1217                         return r;
1218         }
1219
1220         /* Second step: actually set the uids */
1221         if (setresuid(uid, uid, uid) < 0)
1222                 return -errno;
1223
1224         /* At this point we should have all necessary capabilities but are otherwise a normal user. However,
1225          * the caps might got corrupted due to the setresuid() so we need clean them up later. This is done
1226          * outside of this call. */
1227         return 0;
1228 }
1229
1230 #if HAVE_PAM
1231
1232 static int null_conv(
1233                 int num_msg,
1234                 const struct pam_message **msg,
1235                 struct pam_response **resp,
1236                 void *appdata_ptr) {
1237
1238         /* We don't support conversations */
1239
1240         return PAM_CONV_ERR;
1241 }
1242
1243 #endif
1244
1245 static int setup_pam(
1246                 const char *name,
1247                 const char *user,
1248                 uid_t uid,
1249                 gid_t gid,
1250                 const char *tty,
1251                 char ***env, /* updated on success */
1252                 const int fds[], size_t n_fds) {
1253
1254 #if HAVE_PAM
1255
1256         static const struct pam_conv conv = {
1257                 .conv = null_conv,
1258                 .appdata_ptr = NULL
1259         };
1260
1261         _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
1262         _cleanup_strv_free_ char **e = NULL;
1263         pam_handle_t *handle = NULL;
1264         sigset_t old_ss;
1265         int pam_code = PAM_SUCCESS, r;
1266         bool close_session = false;
1267         pid_t pam_pid = 0, parent_pid;
1268         int flags = 0;
1269
1270         assert(name);
1271         assert(user);
1272         assert(env);
1273
1274         /* We set up PAM in the parent process, then fork. The child
1275          * will then stay around until killed via PR_GET_PDEATHSIG or
1276          * systemd via the cgroup logic. It will then remove the PAM
1277          * session again. The parent process will exec() the actual
1278          * daemon. We do things this way to ensure that the main PID
1279          * of the daemon is the one we initially fork()ed. */
1280
1281         r = barrier_create(&barrier);
1282         if (r < 0)
1283                 goto fail;
1284
1285         if (log_get_max_level() < LOG_DEBUG)
1286                 flags |= PAM_SILENT;
1287
1288         pam_code = pam_start(name, user, &conv, &handle);
1289         if (pam_code != PAM_SUCCESS) {
1290                 handle = NULL;
1291                 goto fail;
1292         }
1293
1294         if (!tty) {
1295                 _cleanup_free_ char *q = NULL;
1296
1297                 /* Hmm, so no TTY was explicitly passed, but an fd passed to us directly might be a TTY. Let's figure
1298                  * out if that's the case, and read the TTY off it. */
1299
1300                 if (getttyname_malloc(STDIN_FILENO, &q) >= 0)
1301                         tty = strjoina("/dev/", q);
1302         }
1303
1304         if (tty) {
1305                 pam_code = pam_set_item(handle, PAM_TTY, tty);
1306                 if (pam_code != PAM_SUCCESS)
1307                         goto fail;
1308         }
1309
1310         STRV_FOREACH(nv, *env) {
1311                 pam_code = pam_putenv(handle, *nv);
1312                 if (pam_code != PAM_SUCCESS)
1313                         goto fail;
1314         }
1315
1316         pam_code = pam_acct_mgmt(handle, flags);
1317         if (pam_code != PAM_SUCCESS)
1318                 goto fail;
1319
1320         pam_code = pam_setcred(handle, PAM_ESTABLISH_CRED | flags);
1321         if (pam_code != PAM_SUCCESS)
1322                 log_debug("pam_setcred() failed, ignoring: %s", pam_strerror(handle, pam_code));
1323
1324         pam_code = pam_open_session(handle, flags);
1325         if (pam_code != PAM_SUCCESS)
1326                 goto fail;
1327
1328         close_session = true;
1329
1330         e = pam_getenvlist(handle);
1331         if (!e) {
1332                 pam_code = PAM_BUF_ERR;
1333                 goto fail;
1334         }
1335
1336         /* Block SIGTERM, so that we know that it won't get lost in the child */
1337
1338         assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
1339
1340         parent_pid = getpid_cached();
1341
1342         r = safe_fork("(sd-pam)", 0, &pam_pid);
1343         if (r < 0)
1344                 goto fail;
1345         if (r == 0) {
1346                 int sig, ret = EXIT_PAM;
1347
1348                 /* The child's job is to reset the PAM session on termination */
1349                 barrier_set_role(&barrier, BARRIER_CHILD);
1350
1351                 /* Make sure we don't keep open the passed fds in this child. We assume that otherwise only
1352                  * those fds are open here that have been opened by PAM. */
1353                 (void) close_many(fds, n_fds);
1354
1355                 /* Drop privileges - we don't need any to pam_close_session and this will make
1356                  * PR_SET_PDEATHSIG work in most cases.  If this fails, ignore the error - but expect sd-pam
1357                  * threads to fail to exit normally */
1358
1359                 r = maybe_setgroups(0, NULL);
1360                 if (r < 0)
1361                         log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
1362                 if (setresgid(gid, gid, gid) < 0)
1363                         log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
1364                 if (setresuid(uid, uid, uid) < 0)
1365                         log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m");
1366
1367                 (void) ignore_signals(SIGPIPE);
1368
1369                 /* Wait until our parent died. This will only work if the above setresuid() succeeds,
1370                  * otherwise the kernel will not allow unprivileged parents kill their privileged children
1371                  * this way. We rely on the control groups kill logic to do the rest for us. */
1372                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
1373                         goto child_finish;
1374
1375                 /* Tell the parent that our setup is done. This is especially important regarding dropping
1376                  * privileges. Otherwise, unit setup might race against our setresuid(2) call.
1377                  *
1378                  * If the parent aborted, we'll detect this below, hence ignore return failure here. */
1379                 (void) barrier_place(&barrier);
1380
1381                 /* Check if our parent process might already have died? */
1382                 if (getppid() == parent_pid) {
1383                         sigset_t ss;
1384
1385                         assert_se(sigemptyset(&ss) >= 0);
1386                         assert_se(sigaddset(&ss, SIGTERM) >= 0);
1387
1388                         for (;;) {
1389                                 if (sigwait(&ss, &sig) < 0) {
1390                                         if (errno == EINTR)
1391                                                 continue;
1392
1393                                         goto child_finish;
1394                                 }
1395
1396                                 assert(sig == SIGTERM);
1397                                 break;
1398                         }
1399                 }
1400
1401                 pam_code = pam_setcred(handle, PAM_DELETE_CRED | flags);
1402                 if (pam_code != PAM_SUCCESS)
1403                         goto child_finish;
1404
1405                 /* If our parent died we'll end the session */
1406                 if (getppid() != parent_pid) {
1407                         pam_code = pam_close_session(handle, flags);
1408                         if (pam_code != PAM_SUCCESS)
1409                                 goto child_finish;
1410                 }
1411
1412                 ret = 0;
1413
1414         child_finish:
1415                 /* NB: pam_end() when called in child processes should set PAM_DATA_SILENT to let the module
1416                  * know about this. See pam_end(3) */
1417                 (void) pam_end(handle, pam_code | flags | PAM_DATA_SILENT);
1418                 _exit(ret);
1419         }
1420
1421         barrier_set_role(&barrier, BARRIER_PARENT);
1422
1423         /* If the child was forked off successfully it will do all the cleanups, so forget about the handle
1424          * here. */
1425         handle = NULL;
1426
1427         /* Unblock SIGTERM again in the parent */
1428         assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
1429
1430         /* We close the log explicitly here, since the PAM modules might have opened it, but we don't want
1431          * this fd around. */
1432         closelog();
1433
1434         /* Synchronously wait for the child to initialize. We don't care for errors as we cannot
1435          * recover. However, warn loudly if it happens. */
1436         if (!barrier_place_and_sync(&barrier))
1437                 log_error("PAM initialization failed");
1438
1439         return strv_free_and_replace(*env, e);
1440
1441 fail:
1442         if (pam_code != PAM_SUCCESS) {
1443                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1444                 r = -EPERM;  /* PAM errors do not map to errno */
1445         } else
1446                 log_error_errno(r, "PAM failed: %m");
1447
1448         if (handle) {
1449                 if (close_session)
1450                         pam_code = pam_close_session(handle, flags);
1451
1452                 (void) pam_end(handle, pam_code | flags);
1453         }
1454
1455         closelog();
1456         return r;
1457 #else
1458         return 0;
1459 #endif
1460 }
1461
1462 static void rename_process_from_path(const char *path) {
1463         _cleanup_free_ char *buf = NULL;
1464         const char *p;
1465
1466         assert(path);
1467
1468         /* This resulting string must fit in 10 chars (i.e. the length of "/sbin/init") to look pretty in
1469          * /bin/ps */
1470
1471         if (path_extract_filename(path, &buf) < 0) {
1472                 rename_process("(...)");
1473                 return;
1474         }
1475
1476         size_t l = strlen(buf);
1477         if (l > 8) {
1478                 /* The end of the process name is usually more interesting, since the first bit might just be
1479                  * "systemd-" */
1480                 p = buf + l - 8;
1481                 l = 8;
1482         } else
1483                 p = buf;
1484
1485         char process_name[11];
1486         process_name[0] = '(';
1487         memcpy(process_name+1, p, l);
1488         process_name[1+l] = ')';
1489         process_name[1+l+1] = 0;
1490
1491         rename_process(process_name);
1492 }
1493
1494 static bool context_has_address_families(const ExecContext *c) {
1495         assert(c);
1496
1497         return c->address_families_allow_list ||
1498                 !set_isempty(c->address_families);
1499 }
1500
1501 static bool context_has_syscall_filters(const ExecContext *c) {
1502         assert(c);
1503
1504         return c->syscall_allow_list ||
1505                 !hashmap_isempty(c->syscall_filter);
1506 }
1507
1508 static bool context_has_syscall_logs(const ExecContext *c) {
1509         assert(c);
1510
1511         return c->syscall_log_allow_list ||
1512                 !hashmap_isempty(c->syscall_log);
1513 }
1514
1515 static bool context_has_no_new_privileges(const ExecContext *c) {
1516         assert(c);
1517
1518         if (c->no_new_privileges)
1519                 return true;
1520
1521         if (have_effective_cap(CAP_SYS_ADMIN) > 0) /* if we are privileged, we don't need NNP */
1522                 return false;
1523
1524         /* We need NNP if we have any form of seccomp and are unprivileged */
1525         return c->lock_personality ||
1526                 c->memory_deny_write_execute ||
1527                 c->private_devices ||
1528                 c->protect_clock ||
1529                 c->protect_hostname ||
1530                 c->protect_kernel_tunables ||
1531                 c->protect_kernel_modules ||
1532                 c->protect_kernel_logs ||
1533                 context_has_address_families(c) ||
1534                 exec_context_restrict_namespaces_set(c) ||
1535                 c->restrict_realtime ||
1536                 c->restrict_suid_sgid ||
1537                 !set_isempty(c->syscall_archs) ||
1538                 context_has_syscall_filters(c) ||
1539                 context_has_syscall_logs(c);
1540 }
1541
1542 bool exec_context_has_credentials(const ExecContext *context) {
1543
1544         assert(context);
1545
1546         return !hashmap_isempty(context->set_credentials) ||
1547                 !hashmap_isempty(context->load_credentials);
1548 }
1549
1550 #if HAVE_SECCOMP
1551
1552 static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
1553
1554         if (is_seccomp_available())
1555                 return false;
1556
1557         log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
1558         return true;
1559 }
1560
1561 static int apply_syscall_filter(const Unit* u, const ExecContext *c, bool needs_ambient_hack) {
1562         uint32_t negative_action, default_action, action;
1563         int r;
1564
1565         assert(u);
1566         assert(c);
1567
1568         if (!context_has_syscall_filters(c))
1569                 return 0;
1570
1571         if (skip_seccomp_unavailable(u, "SystemCallFilter="))
1572                 return 0;
1573
1574         negative_action = c->syscall_errno == SECCOMP_ERROR_NUMBER_KILL ? scmp_act_kill_process() : SCMP_ACT_ERRNO(c->syscall_errno);
1575
1576         if (c->syscall_allow_list) {
1577                 default_action = negative_action;
1578                 action = SCMP_ACT_ALLOW;
1579         } else {
1580                 default_action = SCMP_ACT_ALLOW;
1581                 action = negative_action;
1582         }
1583
1584         if (needs_ambient_hack) {
1585                 r = seccomp_filter_set_add(c->syscall_filter, c->syscall_allow_list, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID);
1586                 if (r < 0)
1587                         return r;
1588         }
1589
1590         return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false);
1591 }
1592
1593 static int apply_syscall_log(const Unit* u, const ExecContext *c) {
1594 #ifdef SCMP_ACT_LOG
1595         uint32_t default_action, action;
1596 #endif
1597
1598         assert(u);
1599         assert(c);
1600
1601         if (!context_has_syscall_logs(c))
1602                 return 0;
1603
1604 #ifdef SCMP_ACT_LOG
1605         if (skip_seccomp_unavailable(u, "SystemCallLog="))
1606                 return 0;
1607
1608         if (c->syscall_log_allow_list) {
1609                 /* Log nothing but the ones listed */
1610                 default_action = SCMP_ACT_ALLOW;
1611                 action = SCMP_ACT_LOG;
1612         } else {
1613                 /* Log everything but the ones listed */
1614                 default_action = SCMP_ACT_LOG;
1615                 action = SCMP_ACT_ALLOW;
1616         }
1617
1618         return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_log, action, false);
1619 #else
1620         /* old libseccomp */
1621         log_unit_debug(u, "SECCOMP feature SCMP_ACT_LOG not available, skipping SystemCallLog=");
1622         return 0;
1623 #endif
1624 }
1625
1626 static int apply_syscall_archs(const Unit *u, const ExecContext *c) {
1627         assert(u);
1628         assert(c);
1629
1630         if (set_isempty(c->syscall_archs))
1631                 return 0;
1632
1633         if (skip_seccomp_unavailable(u, "SystemCallArchitectures="))
1634                 return 0;
1635
1636         return seccomp_restrict_archs(c->syscall_archs);
1637 }
1638
1639 static int apply_address_families(const Unit* u, const ExecContext *c) {
1640         assert(u);
1641         assert(c);
1642
1643         if (!context_has_address_families(c))
1644                 return 0;
1645
1646         if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1647                 return 0;
1648
1649         return seccomp_restrict_address_families(c->address_families, c->address_families_allow_list);
1650 }
1651
1652 static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
1653         int r;
1654
1655         assert(u);
1656         assert(c);
1657
1658         if (!c->memory_deny_write_execute)
1659                 return 0;
1660
1661         /* use prctl() if kernel supports it (6.3) */
1662         r = prctl(PR_SET_MDWE, PR_MDWE_REFUSE_EXEC_GAIN, 0, 0, 0);
1663         if (r == 0) {
1664                 log_unit_debug(u, "Enabled MemoryDenyWriteExecute= with PR_SET_MDWE");
1665                 return 0;
1666         }
1667         if (r < 0 && errno != EINVAL)
1668                 return log_unit_debug_errno(u, errno, "Failed to enable MemoryDenyWriteExecute= with PR_SET_MDWE: %m");
1669         /* else use seccomp */
1670         log_unit_debug(u, "Kernel doesn't support PR_SET_MDWE: falling back to seccomp");
1671
1672         if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1673                 return 0;
1674
1675         return seccomp_memory_deny_write_execute();
1676 }
1677
1678 static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
1679         assert(u);
1680         assert(c);
1681
1682         if (!c->restrict_realtime)
1683                 return 0;
1684
1685         if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1686                 return 0;
1687
1688         return seccomp_restrict_realtime();
1689 }
1690
1691 static int apply_restrict_suid_sgid(const Unit* u, const ExecContext *c) {
1692         assert(u);
1693         assert(c);
1694
1695         if (!c->restrict_suid_sgid)
1696                 return 0;
1697
1698         if (skip_seccomp_unavailable(u, "RestrictSUIDSGID="))
1699                 return 0;
1700
1701         return seccomp_restrict_suid_sgid();
1702 }
1703
1704 static int apply_protect_sysctl(const Unit *u, const ExecContext *c) {
1705         assert(u);
1706         assert(c);
1707
1708         /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1709          * let's protect even those systems where this is left on in the kernel. */
1710
1711         if (!c->protect_kernel_tunables)
1712                 return 0;
1713
1714         if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1715                 return 0;
1716
1717         return seccomp_protect_sysctl();
1718 }
1719
1720 static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
1721         assert(u);
1722         assert(c);
1723
1724         /* Turn off module syscalls on ProtectKernelModules=yes */
1725
1726         if (!c->protect_kernel_modules)
1727                 return 0;
1728
1729         if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
1730                 return 0;
1731
1732         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM), false);
1733 }
1734
1735 static int apply_protect_kernel_logs(const Unit *u, const ExecContext *c) {
1736         assert(u);
1737         assert(c);
1738
1739         if (!c->protect_kernel_logs)
1740                 return 0;
1741
1742         if (skip_seccomp_unavailable(u, "ProtectKernelLogs="))
1743                 return 0;
1744
1745         return seccomp_protect_syslog();
1746 }
1747
1748 static int apply_protect_clock(const Unit *u, const ExecContext *c) {
1749         assert(u);
1750         assert(c);
1751
1752         if (!c->protect_clock)
1753                 return 0;
1754
1755         if (skip_seccomp_unavailable(u, "ProtectClock="))
1756                 return 0;
1757
1758         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK, SCMP_ACT_ERRNO(EPERM), false);
1759 }
1760
1761 static int apply_private_devices(const Unit *u, const ExecContext *c) {
1762         assert(u);
1763         assert(c);
1764
1765         /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */
1766
1767         if (!c->private_devices)
1768                 return 0;
1769
1770         if (skip_seccomp_unavailable(u, "PrivateDevices="))
1771                 return 0;
1772
1773         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM), false);
1774 }
1775
1776 static int apply_restrict_namespaces(const Unit *u, const ExecContext *c) {
1777         assert(u);
1778         assert(c);
1779
1780         if (!exec_context_restrict_namespaces_set(c))
1781                 return 0;
1782
1783         if (skip_seccomp_unavailable(u, "RestrictNamespaces="))
1784                 return 0;
1785
1786         return seccomp_restrict_namespaces(c->restrict_namespaces);
1787 }
1788
1789 static int apply_lock_personality(const Unit* u, const ExecContext *c) {
1790         unsigned long personality;
1791         int r;
1792
1793         assert(u);
1794         assert(c);
1795
1796         if (!c->lock_personality)
1797                 return 0;
1798
1799         if (skip_seccomp_unavailable(u, "LockPersonality="))
1800                 return 0;
1801
1802         personality = c->personality;
1803
1804         /* If personality is not specified, use either PER_LINUX or PER_LINUX32 depending on what is currently set. */
1805         if (personality == PERSONALITY_INVALID) {
1806
1807                 r = opinionated_personality(&personality);
1808                 if (r < 0)
1809                         return r;
1810         }
1811
1812         return seccomp_lock_personality(personality);
1813 }
1814
1815 #endif
1816
1817 #if HAVE_LIBBPF
1818 static int apply_restrict_filesystems(Unit *u, const ExecContext *c) {
1819         assert(u);
1820         assert(c);
1821
1822         if (!exec_context_restrict_filesystems_set(c))
1823                 return 0;
1824
1825         if (!u->manager->restrict_fs) {
1826                 /* LSM BPF is unsupported or lsm_bpf_setup failed */
1827                 log_unit_debug(u, "LSM BPF not supported, skipping RestrictFileSystems=");
1828                 return 0;
1829         }
1830
1831         return lsm_bpf_unit_restrict_filesystems(u, c->restrict_filesystems, c->restrict_filesystems_allow_list);
1832 }
1833 #endif
1834
1835 static int apply_protect_hostname(const Unit *u, const ExecContext *c, int *ret_exit_status) {
1836         assert(u);
1837         assert(c);
1838
1839         if (!c->protect_hostname)
1840                 return 0;
1841
1842         if (ns_type_supported(NAMESPACE_UTS)) {
1843                 if (unshare(CLONE_NEWUTS) < 0) {
1844                         if (!ERRNO_IS_NOT_SUPPORTED(errno) && !ERRNO_IS_PRIVILEGE(errno)) {
1845                                 *ret_exit_status = EXIT_NAMESPACE;
1846                                 return log_unit_error_errno(u, errno, "Failed to set up UTS namespacing: %m");
1847                         }
1848
1849                         log_unit_warning(u, "ProtectHostname=yes is configured, but UTS namespace setup is prohibited (container manager?), ignoring namespace setup.");
1850                 }
1851         } else
1852                 log_unit_warning(u, "ProtectHostname=yes is configured, but the kernel does not support UTS namespaces, ignoring namespace setup.");
1853
1854 #if HAVE_SECCOMP
1855         int r;
1856
1857         if (skip_seccomp_unavailable(u, "ProtectHostname="))
1858                 return 0;
1859
1860         r = seccomp_protect_hostname();
1861         if (r < 0) {
1862                 *ret_exit_status = EXIT_SECCOMP;
1863                 return log_unit_error_errno(u, r, "Failed to apply hostname restrictions: %m");
1864         }
1865 #endif
1866
1867         return 0;
1868 }
1869
1870 static void do_idle_pipe_dance(int idle_pipe[static 4]) {
1871         assert(idle_pipe);
1872
1873         idle_pipe[1] = safe_close(idle_pipe[1]);
1874         idle_pipe[2] = safe_close(idle_pipe[2]);
1875
1876         if (idle_pipe[0] >= 0) {
1877                 int r;
1878
1879                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1880
1881                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1882                         ssize_t n;
1883
1884                         /* Signal systemd that we are bored and want to continue. */
1885                         n = write(idle_pipe[3], "x", 1);
1886                         if (n > 0)
1887                                 /* Wait for systemd to react to the signal above. */
1888                                 (void) fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1889                 }
1890
1891                 idle_pipe[0] = safe_close(idle_pipe[0]);
1892
1893         }
1894
1895         idle_pipe[3] = safe_close(idle_pipe[3]);
1896 }
1897
1898 static const char *exec_directory_env_name_to_string(ExecDirectoryType t);
1899
1900 static int build_environment(
1901                 const Unit *u,
1902                 const ExecContext *c,
1903                 const ExecParameters *p,
1904                 const CGroupContext *cgroup_context,
1905                 size_t n_fds,
1906                 char **fdnames,
1907                 const char *home,
1908                 const char *username,
1909                 const char *shell,
1910                 dev_t journal_stream_dev,
1911                 ino_t journal_stream_ino,
1912                 const char *memory_pressure_path,
1913                 char ***ret) {
1914
1915         _cleanup_strv_free_ char **our_env = NULL;
1916         size_t n_env = 0;
1917         char *x;
1918         int r;
1919
1920         assert(u);
1921         assert(c);
1922         assert(p);
1923         assert(ret);
1924
1925 #define N_ENV_VARS 19
1926         our_env = new0(char*, N_ENV_VARS + _EXEC_DIRECTORY_TYPE_MAX);
1927         if (!our_env)
1928                 return -ENOMEM;
1929
1930         if (n_fds > 0) {
1931                 _cleanup_free_ char *joined = NULL;
1932
1933                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid_cached()) < 0)
1934                         return -ENOMEM;
1935                 our_env[n_env++] = x;
1936
1937                 if (asprintf(&x, "LISTEN_FDS=%zu", n_fds) < 0)
1938                         return -ENOMEM;
1939                 our_env[n_env++] = x;
1940
1941                 joined = strv_join(fdnames, ":");
1942                 if (!joined)
1943                         return -ENOMEM;
1944
1945                 x = strjoin("LISTEN_FDNAMES=", joined);
1946                 if (!x)
1947                         return -ENOMEM;
1948                 our_env[n_env++] = x;
1949         }
1950
1951         if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
1952                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid_cached()) < 0)
1953                         return -ENOMEM;
1954                 our_env[n_env++] = x;
1955
1956                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1957                         return -ENOMEM;
1958                 our_env[n_env++] = x;
1959         }
1960
1961         /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use blocking
1962          * Varlink calls back to us for look up dynamic users in PID 1. Break the deadlock between D-Bus and
1963          * PID 1 by disabling use of PID1' NSS interface for looking up dynamic users. */
1964         if (p->flags & EXEC_NSS_DYNAMIC_BYPASS) {
1965                 x = strdup("SYSTEMD_NSS_DYNAMIC_BYPASS=1");
1966                 if (!x)
1967                         return -ENOMEM;
1968                 our_env[n_env++] = x;
1969         }
1970
1971         if (home) {
1972                 x = strjoin("HOME=", home);
1973                 if (!x)
1974                         return -ENOMEM;
1975
1976                 path_simplify(x + 5);
1977                 our_env[n_env++] = x;
1978         }
1979
1980         if (username) {
1981                 x = strjoin("LOGNAME=", username);
1982                 if (!x)
1983                         return -ENOMEM;
1984                 our_env[n_env++] = x;
1985
1986                 x = strjoin("USER=", username);
1987                 if (!x)
1988                         return -ENOMEM;
1989                 our_env[n_env++] = x;
1990         }
1991
1992         if (shell) {
1993                 x = strjoin("SHELL=", shell);
1994                 if (!x)
1995                         return -ENOMEM;
1996
1997                 path_simplify(x + 6);
1998                 our_env[n_env++] = x;
1999         }
2000
2001         if (!sd_id128_is_null(u->invocation_id)) {
2002                 if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0)
2003                         return -ENOMEM;
2004
2005                 our_env[n_env++] = x;
2006         }
2007
2008         if (exec_context_needs_term(c)) {
2009                 _cleanup_free_ char *cmdline = NULL;
2010                 const char *tty_path, *term = NULL;
2011
2012                 tty_path = exec_context_tty_path(c);
2013
2014                 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try
2015                  * to inherit the $TERM set for PID 1. This is useful for containers so that the $TERM the
2016                  * container manager passes to PID 1 ends up all the way in the console login shown. */
2017
2018                 if (path_equal_ptr(tty_path, "/dev/console") && getppid() == 1)
2019                         term = getenv("TERM");
2020                 else if (tty_path && in_charset(skip_dev_prefix(tty_path), ALPHANUMERICAL)) {
2021                         _cleanup_free_ char *key = NULL;
2022
2023                         key = strjoin("systemd.tty.term.", skip_dev_prefix(tty_path));
2024                         if (!key)
2025                                 return -ENOMEM;
2026
2027                         r = proc_cmdline_get_key(key, 0, &cmdline);
2028                         if (r < 0)
2029                                 log_debug_errno(r, "Failed to read %s from kernel cmdline, ignoring: %m", key);
2030                         else if (r > 0)
2031                                 term = cmdline;
2032                 }
2033
2034                 if (!term)
2035                         term = default_term_for_tty(tty_path);
2036
2037                 x = strjoin("TERM=", term);
2038                 if (!x)
2039                         return -ENOMEM;
2040                 our_env[n_env++] = x;
2041         }
2042
2043         if (journal_stream_dev != 0 && journal_stream_ino != 0) {
2044                 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
2045                         return -ENOMEM;
2046
2047                 our_env[n_env++] = x;
2048         }
2049
2050         if (c->log_namespace) {
2051                 x = strjoin("LOG_NAMESPACE=", c->log_namespace);
2052                 if (!x)
2053                         return -ENOMEM;
2054
2055                 our_env[n_env++] = x;
2056         }
2057
2058         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2059                 _cleanup_free_ char *joined = NULL;
2060                 const char *n;
2061
2062                 if (!p->prefix[t])
2063                         continue;
2064
2065                 if (c->directories[t].n_items == 0)
2066                         continue;
2067
2068                 n = exec_directory_env_name_to_string(t);
2069                 if (!n)
2070                         continue;
2071
2072                 for (size_t i = 0; i < c->directories[t].n_items; i++) {
2073                         _cleanup_free_ char *prefixed = NULL;
2074
2075                         prefixed = path_join(p->prefix[t], c->directories[t].items[i].path);
2076                         if (!prefixed)
2077                                 return -ENOMEM;
2078
2079                         if (!strextend_with_separator(&joined, ":", prefixed))
2080                                 return -ENOMEM;
2081                 }
2082
2083                 x = strjoin(n, "=", joined);
2084                 if (!x)
2085                         return -ENOMEM;
2086
2087                 our_env[n_env++] = x;
2088         }
2089
2090         if (exec_context_has_credentials(c) && p->prefix[EXEC_DIRECTORY_RUNTIME]) {
2091                 x = strjoin("CREDENTIALS_DIRECTORY=", p->prefix[EXEC_DIRECTORY_RUNTIME], "/credentials/", u->id);
2092                 if (!x)
2093                         return -ENOMEM;
2094
2095                 our_env[n_env++] = x;
2096         }
2097
2098         if (asprintf(&x, "SYSTEMD_EXEC_PID=" PID_FMT, getpid_cached()) < 0)
2099                 return -ENOMEM;
2100
2101         our_env[n_env++] = x;
2102
2103         if (memory_pressure_path) {
2104                 x = strjoin("MEMORY_PRESSURE_WATCH=", memory_pressure_path);
2105                 if (!x)
2106                         return -ENOMEM;
2107
2108                 our_env[n_env++] = x;
2109
2110                 if (cgroup_context && !path_equal(memory_pressure_path, "/dev/null")) {
2111                         _cleanup_free_ char *b = NULL, *e = NULL;
2112
2113                         if (asprintf(&b, "%s " USEC_FMT " " USEC_FMT,
2114                                      MEMORY_PRESSURE_DEFAULT_TYPE,
2115                                      cgroup_context->memory_pressure_threshold_usec == USEC_INFINITY ? MEMORY_PRESSURE_DEFAULT_THRESHOLD_USEC :
2116                                      CLAMP(cgroup_context->memory_pressure_threshold_usec, 1U, MEMORY_PRESSURE_DEFAULT_WINDOW_USEC),
2117                                      MEMORY_PRESSURE_DEFAULT_WINDOW_USEC) < 0)
2118                                 return -ENOMEM;
2119
2120                         if (base64mem(b, strlen(b) + 1, &e) < 0)
2121                                 return -ENOMEM;
2122
2123                         x = strjoin("MEMORY_PRESSURE_WRITE=", e);
2124                         if (!x)
2125                                 return -ENOMEM;
2126
2127                         our_env[n_env++] = x;
2128                 }
2129         }
2130
2131         assert(n_env < N_ENV_VARS + _EXEC_DIRECTORY_TYPE_MAX);
2132 #undef N_ENV_VARS
2133
2134         *ret = TAKE_PTR(our_env);
2135
2136         return 0;
2137 }
2138
2139 static int build_pass_environment(const ExecContext *c, char ***ret) {
2140         _cleanup_strv_free_ char **pass_env = NULL;
2141         size_t n_env = 0;
2142
2143         STRV_FOREACH(i, c->pass_environment) {
2144                 _cleanup_free_ char *x = NULL;
2145                 char *v;
2146
2147                 v = getenv(*i);
2148                 if (!v)
2149                         continue;
2150                 x = strjoin(*i, "=", v);
2151                 if (!x)
2152                         return -ENOMEM;
2153
2154                 if (!GREEDY_REALLOC(pass_env, n_env + 2))
2155                         return -ENOMEM;
2156
2157                 pass_env[n_env++] = TAKE_PTR(x);
2158                 pass_env[n_env] = NULL;
2159         }
2160
2161         *ret = TAKE_PTR(pass_env);
2162
2163         return 0;
2164 }
2165
2166 bool exec_needs_network_namespace(const ExecContext *context) {
2167         assert(context);
2168
2169         return context->private_network || context->network_namespace_path;
2170 }
2171
2172 static bool exec_needs_ipc_namespace(const ExecContext *context) {
2173         assert(context);
2174
2175         return context->private_ipc || context->ipc_namespace_path;
2176 }
2177
2178 bool exec_needs_mount_namespace(
2179                 const ExecContext *context,
2180                 const ExecParameters *params,
2181                 const ExecRuntime *runtime) {
2182
2183         assert(context);
2184
2185         if (context->root_image)
2186                 return true;
2187
2188         if (!strv_isempty(context->read_write_paths) ||
2189             !strv_isempty(context->read_only_paths) ||
2190             !strv_isempty(context->inaccessible_paths) ||
2191             !strv_isempty(context->exec_paths) ||
2192             !strv_isempty(context->no_exec_paths))
2193                 return true;
2194
2195         if (context->n_bind_mounts > 0)
2196                 return true;
2197
2198         if (context->n_temporary_filesystems > 0)
2199                 return true;
2200
2201         if (context->n_mount_images > 0)
2202                 return true;
2203
2204         if (context->n_extension_images > 0)
2205                 return true;
2206
2207         if (!strv_isempty(context->extension_directories))
2208                 return true;
2209
2210         if (!IN_SET(context->mount_propagation_flag, 0, MS_SHARED))
2211                 return true;
2212
2213         if (context->private_tmp && runtime && runtime->shared && (runtime->shared->tmp_dir || runtime->shared->var_tmp_dir))
2214                 return true;
2215
2216         if (context->private_devices ||
2217             context->private_mounts > 0 ||
2218             (context->private_mounts < 0 && exec_needs_network_namespace(context)) ||
2219             context->protect_system != PROTECT_SYSTEM_NO ||
2220             context->protect_home != PROTECT_HOME_NO ||
2221             context->protect_kernel_tunables ||
2222             context->protect_kernel_modules ||
2223             context->protect_kernel_logs ||
2224             context->protect_control_groups ||
2225             context->protect_proc != PROTECT_PROC_DEFAULT ||
2226             context->proc_subset != PROC_SUBSET_ALL ||
2227             exec_needs_ipc_namespace(context))
2228                 return true;
2229
2230         if (context->root_directory) {
2231                 if (exec_context_get_effective_mount_apivfs(context))
2232                         return true;
2233
2234                 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2235                         if (params && !params->prefix[t])
2236                                 continue;
2237
2238                         if (context->directories[t].n_items > 0)
2239                                 return true;
2240                 }
2241         }
2242
2243         if (context->dynamic_user &&
2244             (context->directories[EXEC_DIRECTORY_STATE].n_items > 0 ||
2245              context->directories[EXEC_DIRECTORY_CACHE].n_items > 0 ||
2246              context->directories[EXEC_DIRECTORY_LOGS].n_items > 0))
2247                 return true;
2248
2249         if (context->log_namespace)
2250                 return true;
2251
2252         return false;
2253 }
2254
2255 static int setup_private_users(uid_t ouid, gid_t ogid, uid_t uid, gid_t gid) {
2256         _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
2257         _cleanup_close_pair_ int errno_pipe[2] = PIPE_EBADF;
2258         _cleanup_close_ int unshare_ready_fd = -EBADF;
2259         _cleanup_(sigkill_waitp) pid_t pid = 0;
2260         uint64_t c = 1;
2261         ssize_t n;
2262         int r;
2263
2264         /* Set up a user namespace and map the original UID/GID (IDs from before any user or group changes, i.e.
2265          * the IDs from the user or system manager(s)) to itself, the selected UID/GID to itself, and everything else to
2266          * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
2267          * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
2268          * which waits for the parent to create the new user namespace while staying in the original namespace. The
2269          * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
2270          * continues execution normally.
2271          * For unprivileged users (i.e. without capabilities), the root to root mapping is excluded. As such, it
2272          * does not need CAP_SETUID to write the single line mapping to itself. */
2273
2274         /* Can only set up multiple mappings with CAP_SETUID. */
2275         if (have_effective_cap(CAP_SETUID) > 0 && uid != ouid && uid_is_valid(uid))
2276                 r = asprintf(&uid_map,
2277                              UID_FMT " " UID_FMT " 1\n"     /* Map $OUID → $OUID */
2278                              UID_FMT " " UID_FMT " 1\n",    /* Map $UID → $UID */
2279                              ouid, ouid, uid, uid);
2280         else
2281                 r = asprintf(&uid_map,
2282                              UID_FMT " " UID_FMT " 1\n",    /* Map $OUID → $OUID */
2283                              ouid, ouid);
2284
2285         if (r < 0)
2286                 return -ENOMEM;
2287
2288         /* Can only set up multiple mappings with CAP_SETGID. */
2289         if (have_effective_cap(CAP_SETGID) > 0 && gid != ogid && gid_is_valid(gid))
2290                 r = asprintf(&gid_map,
2291                              GID_FMT " " GID_FMT " 1\n"     /* Map $OGID → $OGID */
2292                              GID_FMT " " GID_FMT " 1\n",    /* Map $GID → $GID */
2293                              ogid, ogid, gid, gid);
2294         else
2295                 r = asprintf(&gid_map,
2296                              GID_FMT " " GID_FMT " 1\n",    /* Map $OGID -> $OGID */
2297                              ogid, ogid);
2298
2299         if (r < 0)
2300                 return -ENOMEM;
2301
2302         /* Create a communication channel so that the parent can tell the child when it finished creating the user
2303          * namespace. */
2304         unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
2305         if (unshare_ready_fd < 0)
2306                 return -errno;
2307
2308         /* Create a communication channel so that the child can tell the parent a proper error code in case it
2309          * failed. */
2310         if (pipe2(errno_pipe, O_CLOEXEC) < 0)
2311                 return -errno;
2312
2313         r = safe_fork("(sd-userns)", FORK_RESET_SIGNALS|FORK_DEATHSIG, &pid);
2314         if (r < 0)
2315                 return r;
2316         if (r == 0) {
2317                 _cleanup_close_ int fd = -EBADF;
2318                 const char *a;
2319                 pid_t ppid;
2320
2321                 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
2322                  * here, after the parent opened its own user namespace. */
2323
2324                 ppid = getppid();
2325                 errno_pipe[0] = safe_close(errno_pipe[0]);
2326
2327                 /* Wait until the parent unshared the user namespace */
2328                 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
2329                         r = -errno;
2330                         goto child_fail;
2331                 }
2332
2333                 /* Disable the setgroups() system call in the child user namespace, for good. */
2334                 a = procfs_file_alloca(ppid, "setgroups");
2335                 fd = open(a, O_WRONLY|O_CLOEXEC);
2336                 if (fd < 0) {
2337                         if (errno != ENOENT) {
2338                                 r = -errno;
2339                                 goto child_fail;
2340                         }
2341
2342                         /* If the file is missing the kernel is too old, let's continue anyway. */
2343                 } else {
2344                         if (write(fd, "deny\n", 5) < 0) {
2345                                 r = -errno;
2346                                 goto child_fail;
2347                         }
2348
2349                         fd = safe_close(fd);
2350                 }
2351
2352                 /* First write the GID map */
2353                 a = procfs_file_alloca(ppid, "gid_map");
2354                 fd = open(a, O_WRONLY|O_CLOEXEC);
2355                 if (fd < 0) {
2356                         r = -errno;
2357                         goto child_fail;
2358                 }
2359                 if (write(fd, gid_map, strlen(gid_map)) < 0) {
2360                         r = -errno;
2361                         goto child_fail;
2362                 }
2363                 fd = safe_close(fd);
2364
2365                 /* The write the UID map */
2366                 a = procfs_file_alloca(ppid, "uid_map");
2367                 fd = open(a, O_WRONLY|O_CLOEXEC);
2368                 if (fd < 0) {
2369                         r = -errno;
2370                         goto child_fail;
2371                 }
2372                 if (write(fd, uid_map, strlen(uid_map)) < 0) {
2373                         r = -errno;
2374                         goto child_fail;
2375                 }
2376
2377                 _exit(EXIT_SUCCESS);
2378
2379         child_fail:
2380                 (void) write(errno_pipe[1], &r, sizeof(r));
2381                 _exit(EXIT_FAILURE);
2382         }
2383
2384         errno_pipe[1] = safe_close(errno_pipe[1]);
2385
2386         if (unshare(CLONE_NEWUSER) < 0)
2387                 return -errno;
2388
2389         /* Let the child know that the namespace is ready now */
2390         if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
2391                 return -errno;
2392
2393         /* Try to read an error code from the child */
2394         n = read(errno_pipe[0], &r, sizeof(r));
2395         if (n < 0)
2396                 return -errno;
2397         if (n == sizeof(r)) { /* an error code was sent to us */
2398                 if (r < 0)
2399                         return r;
2400                 return -EIO;
2401         }
2402         if (n != 0) /* on success we should have read 0 bytes */
2403                 return -EIO;
2404
2405         r = wait_for_terminate_and_check("(sd-userns)", TAKE_PID(pid), 0);
2406         if (r < 0)
2407                 return r;
2408         if (r != EXIT_SUCCESS) /* If something strange happened with the child, let's consider this fatal, too */
2409                 return -EIO;
2410
2411         return 0;
2412 }
2413
2414 static bool exec_directory_is_private(const ExecContext *context, ExecDirectoryType type) {
2415         assert(context);
2416
2417         if (!context->dynamic_user)
2418                 return false;
2419
2420         if (type == EXEC_DIRECTORY_CONFIGURATION)
2421                 return false;
2422
2423         if (type == EXEC_DIRECTORY_RUNTIME && context->runtime_directory_preserve_mode == EXEC_PRESERVE_NO)
2424                 return false;
2425
2426         return true;
2427 }
2428
2429 static int create_many_symlinks(const char *root, const char *source, char **symlinks) {
2430         _cleanup_free_ char *src_abs = NULL;
2431         int r;
2432
2433         assert(source);
2434
2435         src_abs = path_join(root, source);
2436         if (!src_abs)
2437                 return -ENOMEM;
2438
2439         STRV_FOREACH(dst, symlinks) {
2440                 _cleanup_free_ char *dst_abs = NULL;
2441
2442                 dst_abs = path_join(root, *dst);
2443                 if (!dst_abs)
2444                         return -ENOMEM;
2445
2446                 r = mkdir_parents_label(dst_abs, 0755);
2447                 if (r < 0)
2448                         return r;
2449
2450                 r = symlink_idempotent(src_abs, dst_abs, true);
2451                 if (r < 0)
2452                         return r;
2453         }
2454
2455         return 0;
2456 }
2457
2458 static int setup_exec_directory(
2459                 const ExecContext *context,
2460                 const ExecParameters *params,
2461                 uid_t uid,
2462                 gid_t gid,
2463                 ExecDirectoryType type,
2464                 bool needs_mount_namespace,
2465                 int *exit_status) {
2466
2467         static const int exit_status_table[_EXEC_DIRECTORY_TYPE_MAX] = {
2468                 [EXEC_DIRECTORY_RUNTIME] = EXIT_RUNTIME_DIRECTORY,
2469                 [EXEC_DIRECTORY_STATE] = EXIT_STATE_DIRECTORY,
2470                 [EXEC_DIRECTORY_CACHE] = EXIT_CACHE_DIRECTORY,
2471                 [EXEC_DIRECTORY_LOGS] = EXIT_LOGS_DIRECTORY,
2472                 [EXEC_DIRECTORY_CONFIGURATION] = EXIT_CONFIGURATION_DIRECTORY,
2473         };
2474         int r;
2475
2476         assert(context);
2477         assert(params);
2478         assert(type >= 0 && type < _EXEC_DIRECTORY_TYPE_MAX);
2479         assert(exit_status);
2480
2481         if (!params->prefix[type])
2482                 return 0;
2483
2484         if (params->flags & EXEC_CHOWN_DIRECTORIES) {
2485                 if (!uid_is_valid(uid))
2486                         uid = 0;
2487                 if (!gid_is_valid(gid))
2488                         gid = 0;
2489         }
2490
2491         for (size_t i = 0; i < context->directories[type].n_items; i++) {
2492                 _cleanup_free_ char *p = NULL, *pp = NULL;
2493
2494                 p = path_join(params->prefix[type], context->directories[type].items[i].path);
2495                 if (!p) {
2496                         r = -ENOMEM;
2497                         goto fail;
2498                 }
2499
2500                 r = mkdir_parents_label(p, 0755);
2501                 if (r < 0)
2502                         goto fail;
2503
2504                 if (exec_directory_is_private(context, type)) {
2505                         /* So, here's one extra complication when dealing with DynamicUser=1 units. In that
2506                          * case we want to avoid leaving a directory around fully accessible that is owned by
2507                          * a dynamic user whose UID is later on reused. To lock this down we use the same
2508                          * trick used by container managers to prohibit host users to get access to files of
2509                          * the same UID in containers: we place everything inside a directory that has an
2510                          * access mode of 0700 and is owned root:root, so that it acts as security boundary
2511                          * for unprivileged host code. We then use fs namespacing to make this directory
2512                          * permeable for the service itself.
2513                          *
2514                          * Specifically: for a service which wants a special directory "foo/" we first create
2515                          * a directory "private/" with access mode 0700 owned by root:root. Then we place
2516                          * "foo" inside of that directory (i.e. "private/foo/"), and make "foo" a symlink to
2517                          * "private/foo". This way, privileged host users can access "foo/" as usual, but
2518                          * unprivileged host users can't look into it. Inside of the namespace of the unit
2519                          * "private/" is replaced by a more liberally accessible tmpfs, into which the host's
2520                          * "private/foo/" is mounted under the same name, thus disabling the access boundary
2521                          * for the service and making sure it only gets access to the dirs it needs but no
2522                          * others. Tricky? Yes, absolutely, but it works!
2523                          *
2524                          * Note that we don't do this for EXEC_DIRECTORY_CONFIGURATION as that's assumed not
2525                          * to be owned by the service itself.
2526                          *
2527                          * Also, note that we don't do this for EXEC_DIRECTORY_RUNTIME as that's often used
2528                          * for sharing files or sockets with other services. */
2529
2530                         pp = path_join(params->prefix[type], "private");
2531                         if (!pp) {
2532                                 r = -ENOMEM;
2533                                 goto fail;
2534                         }
2535
2536                         /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */
2537                         r = mkdir_safe_label(pp, 0700, 0, 0, MKDIR_WARN_MODE);
2538                         if (r < 0)
2539                                 goto fail;
2540
2541                         if (!path_extend(&pp, context->directories[type].items[i].path)) {
2542                                 r = -ENOMEM;
2543                                 goto fail;
2544                         }
2545
2546                         /* Create all directories between the configured directory and this private root, and mark them 0755 */
2547                         r = mkdir_parents_label(pp, 0755);
2548                         if (r < 0)
2549                                 goto fail;
2550
2551                         if (is_dir(p, false) > 0 &&
2552                             (laccess(pp, F_OK) < 0 && errno == ENOENT)) {
2553
2554                                 /* Hmm, the private directory doesn't exist yet, but the normal one exists? If so, move
2555                                  * it over. Most likely the service has been upgraded from one that didn't use
2556                                  * DynamicUser=1, to one that does. */
2557
2558                                 log_info("Found pre-existing public %s= directory %s, migrating to %s.\n"
2559                                          "Apparently, service previously had DynamicUser= turned off, and has now turned it on.",
2560                                          exec_directory_type_to_string(type), p, pp);
2561
2562                                 if (rename(p, pp) < 0) {
2563                                         r = -errno;
2564                                         goto fail;
2565                                 }
2566                         } else {
2567                                 /* Otherwise, create the actual directory for the service */
2568
2569                                 r = mkdir_label(pp, context->directories[type].mode);
2570                                 if (r < 0 && r != -EEXIST)
2571                                         goto fail;
2572                         }
2573
2574                         if (!context->directories[type].items[i].only_create) {
2575                                 /* And link it up from the original place.
2576                                  * Notes
2577                                  * 1) If a mount namespace is going to be used, then this symlink remains on
2578                                  *    the host, and a new one for the child namespace will be created later.
2579                                  * 2) It is not necessary to create this symlink when one of its parent
2580                                  *    directories is specified and already created. E.g.
2581                                  *        StateDirectory=foo foo/bar
2582                                  *    In that case, the inode points to pp and p for "foo/bar" are the same:
2583                                  *        pp = "/var/lib/private/foo/bar"
2584                                  *        p = "/var/lib/foo/bar"
2585                                  *    and, /var/lib/foo is a symlink to /var/lib/private/foo. So, not only
2586                                  *    we do not need to create the symlink, but we cannot create the symlink.
2587                                  *    See issue #24783. */
2588                                 r = symlink_idempotent(pp, p, true);
2589                                 if (r < 0)
2590                                         goto fail;
2591                         }
2592
2593                 } else {
2594                         _cleanup_free_ char *target = NULL;
2595
2596                         if (type != EXEC_DIRECTORY_CONFIGURATION &&
2597                             readlink_and_make_absolute(p, &target) >= 0) {
2598                                 _cleanup_free_ char *q = NULL, *q_resolved = NULL, *target_resolved = NULL;
2599
2600                                 /* This already exists and is a symlink? Interesting. Maybe it's one created
2601                                  * by DynamicUser=1 (see above)?
2602                                  *
2603                                  * We do this for all directory types except for ConfigurationDirectory=,
2604                                  * since they all support the private/ symlink logic at least in some
2605                                  * configurations, see above. */
2606
2607                                 r = chase(target, NULL, 0, &target_resolved, NULL);
2608                                 if (r < 0)
2609                                         goto fail;
2610
2611                                 q = path_join(params->prefix[type], "private", context->directories[type].items[i].path);
2612                                 if (!q) {
2613                                         r = -ENOMEM;
2614                                         goto fail;
2615                                 }
2616
2617                                 /* /var/lib or friends may be symlinks. So, let's chase them also. */
2618                                 r = chase(q, NULL, CHASE_NONEXISTENT, &q_resolved, NULL);
2619                                 if (r < 0)
2620                                         goto fail;
2621
2622                                 if (path_equal(q_resolved, target_resolved)) {
2623
2624                                         /* Hmm, apparently DynamicUser= was once turned on for this service,
2625                                          * but is no longer. Let's move the directory back up. */
2626
2627                                         log_info("Found pre-existing private %s= directory %s, migrating to %s.\n"
2628                                                  "Apparently, service previously had DynamicUser= turned on, and has now turned it off.",
2629                                                  exec_directory_type_to_string(type), q, p);
2630
2631                                         if (unlink(p) < 0) {
2632                                                 r = -errno;
2633                                                 goto fail;
2634                                         }
2635
2636                                         if (rename(q, p) < 0) {
2637                                                 r = -errno;
2638                                                 goto fail;
2639                                         }
2640                                 }
2641                         }
2642
2643                         r = mkdir_label(p, context->directories[type].mode);
2644                         if (r < 0) {
2645                                 if (r != -EEXIST)
2646                                         goto fail;
2647
2648                                 if (type == EXEC_DIRECTORY_CONFIGURATION) {
2649                                         struct stat st;
2650
2651                                         /* Don't change the owner/access mode of the configuration directory,
2652                                          * as in the common case it is not written to by a service, and shall
2653                                          * not be writable. */
2654
2655                                         if (stat(p, &st) < 0) {
2656                                                 r = -errno;
2657                                                 goto fail;
2658                                         }
2659
2660                                         /* Still complain if the access mode doesn't match */
2661                                         if (((st.st_mode ^ context->directories[type].mode) & 07777) != 0)
2662                                                 log_warning("%s \'%s\' already exists but the mode is different. "
2663                                                             "(File system: %o %sMode: %o)",
2664                                                             exec_directory_type_to_string(type), context->directories[type].items[i].path,
2665                                                             st.st_mode & 07777, exec_directory_type_to_string(type), context->directories[type].mode & 07777);
2666
2667                                         continue;
2668                                 }
2669                         }
2670                 }
2671
2672                 /* Lock down the access mode (we use chmod_and_chown() to make this idempotent. We don't
2673                  * specify UID/GID here, so that path_chown_recursive() can optimize things depending on the
2674                  * current UID/GID ownership.) */
2675                 r = chmod_and_chown(pp ?: p, context->directories[type].mode, UID_INVALID, GID_INVALID);
2676                 if (r < 0)
2677                         goto fail;
2678
2679                 /* Then, change the ownership of the whole tree, if necessary. When dynamic users are used we
2680                  * drop the suid/sgid bits, since we really don't want SUID/SGID files for dynamic UID/GID
2681                  * assignments to exist. */
2682                 r = path_chown_recursive(pp ?: p, uid, gid, context->dynamic_user ? 01777 : 07777);
2683                 if (r < 0)
2684                         goto fail;
2685         }
2686
2687         /* If we are not going to run in a namespace, set up the symlinks - otherwise
2688          * they are set up later, to allow configuring empty var/run/etc. */
2689         if (!needs_mount_namespace)
2690                 for (size_t i = 0; i < context->directories[type].n_items; i++) {
2691                         r = create_many_symlinks(params->prefix[type],
2692                                                  context->directories[type].items[i].path,
2693                                                  context->directories[type].items[i].symlinks);
2694                         if (r < 0)
2695                                 goto fail;
2696                 }
2697
2698         return 0;
2699
2700 fail:
2701         *exit_status = exit_status_table[type];
2702         return r;
2703 }
2704
2705 static int write_credential(
2706                 int dfd,
2707                 const char *id,
2708                 const void *data,
2709                 size_t size,
2710                 uid_t uid,
2711                 bool ownership_ok) {
2712
2713         _cleanup_(unlink_and_freep) char *tmp = NULL;
2714         _cleanup_close_ int fd = -EBADF;
2715         int r;
2716
2717         r = tempfn_random_child("", "cred", &tmp);
2718         if (r < 0)
2719                 return r;
2720
2721         fd = openat(dfd, tmp, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL|O_NOFOLLOW|O_NOCTTY, 0600);
2722         if (fd < 0) {
2723                 tmp = mfree(tmp);
2724                 return -errno;
2725         }
2726
2727         r = loop_write(fd, data, size, /* do_poll = */ false);
2728         if (r < 0)
2729                 return r;
2730
2731         if (fchmod(fd, 0400) < 0) /* Take away "w" bit */
2732                 return -errno;
2733
2734         if (uid_is_valid(uid) && uid != getuid()) {
2735                 r = fd_add_uid_acl_permission(fd, uid, ACL_READ);
2736                 if (r < 0) {
2737                         if (!ERRNO_IS_NOT_SUPPORTED(r) && !ERRNO_IS_PRIVILEGE(r))
2738                                 return r;
2739
2740                         if (!ownership_ok) /* Ideally we use ACLs, since we can neatly express what we want
2741                                             * to express: that the user gets read access and nothing
2742                                             * else. But if the backing fs can't support that (e.g. ramfs)
2743                                             * then we can use file ownership instead. But that's only safe if
2744                                             * we can then re-mount the whole thing read-only, so that the
2745                                             * user can no longer chmod() the file to gain write access. */
2746                                 return r;
2747
2748                         if (fchown(fd, uid, GID_INVALID) < 0)
2749                                 return -errno;
2750                 }
2751         }
2752
2753         if (renameat(dfd, tmp, dfd, id) < 0)
2754                 return -errno;
2755
2756         tmp = mfree(tmp);
2757         return 0;
2758 }
2759
2760 static char **credential_search_path(
2761                 const ExecParameters *params,
2762                 bool encrypted) {
2763
2764         _cleanup_strv_free_ char **l = NULL;
2765
2766         assert(params);
2767
2768         /* Assemble a search path to find credentials in. We'll look in /etc/credstore/ (and similar
2769          * directories in /usr/lib/ + /run/) for all types of credentials. If we are looking for encrypted
2770          * credentials, also look in /etc/credstore.encrypted/ (and similar dirs). */
2771
2772         if (encrypted) {
2773                 if (strv_extend(&l, params->received_encrypted_credentials_directory) < 0)
2774                         return NULL;
2775
2776                 if (strv_extend_strv(&l, CONF_PATHS_STRV("credstore.encrypted"), /* filter_duplicates= */ true) < 0)
2777                         return NULL;
2778         }
2779
2780         if (params->received_credentials_directory)
2781                 if (strv_extend(&l, params->received_credentials_directory) < 0)
2782                         return NULL;
2783
2784         if (strv_extend_strv(&l, CONF_PATHS_STRV("credstore"), /* filter_duplicates= */ true) < 0)
2785                 return NULL;
2786
2787         if (DEBUG_LOGGING) {
2788                 _cleanup_free_ char *t = strv_join(l, ":");
2789
2790                 log_debug("Credential search path is: %s", strempty(t));
2791         }
2792
2793         return TAKE_PTR(l);
2794 }
2795
2796 static int load_credential(
2797                 const ExecContext *context,
2798                 const ExecParameters *params,
2799                 const char *id,
2800                 const char *path,
2801                 bool encrypted,
2802                 const char *unit,
2803                 int read_dfd,
2804                 int write_dfd,
2805                 uid_t uid,
2806                 bool ownership_ok,
2807                 uint64_t *left) {
2808
2809         ReadFullFileFlags flags = READ_FULL_FILE_SECURE|READ_FULL_FILE_FAIL_WHEN_LARGER;
2810         _cleanup_strv_free_ char **search_path = NULL;
2811         _cleanup_(erase_and_freep) char *data = NULL;
2812         _cleanup_free_ char *bindname = NULL;
2813         const char *source = NULL;
2814         bool missing_ok = true;
2815         size_t size, add, maxsz;
2816         int r;
2817
2818         assert(context);
2819         assert(params);
2820         assert(id);
2821         assert(path);
2822         assert(unit);
2823         assert(read_dfd >= 0 || read_dfd == AT_FDCWD);
2824         assert(write_dfd >= 0);
2825         assert(left);
2826
2827         if (read_dfd >= 0) {
2828                 /* If a directory fd is specified, then read the file directly from that dir. In this case we
2829                  * won't do AF_UNIX stuff (we simply don't want to recursively iterate down a tree of AF_UNIX
2830                  * IPC sockets). It's OK if a file vanishes here in the time we enumerate it and intend to
2831                  * open it. */
2832
2833                 if (!filename_is_valid(path)) /* safety check */
2834                         return -EINVAL;
2835
2836                 missing_ok = true;
2837                 source = path;
2838
2839         } else if (path_is_absolute(path)) {
2840                 /* If this is an absolute path, read the data directly from it, and support AF_UNIX
2841                  * sockets */
2842
2843                 if (!path_is_valid(path)) /* safety check */
2844                         return -EINVAL;
2845
2846                 flags |= READ_FULL_FILE_CONNECT_SOCKET;
2847
2848                 /* Pass some minimal info about the unit and the credential name we are looking to acquire
2849                  * via the source socket address in case we read off an AF_UNIX socket. */
2850                 if (asprintf(&bindname, "@%" PRIx64"/unit/%s/%s", random_u64(), unit, id) < 0)
2851                         return -ENOMEM;
2852
2853                 missing_ok = false;
2854                 source = path;
2855
2856         } else if (credential_name_valid(path)) {
2857                 /* If this is a relative path, take it as credential name relative to the credentials
2858                  * directory we received ourselves. We don't support the AF_UNIX stuff in this mode, since we
2859                  * are operating on a credential store, i.e. this is guaranteed to be regular files. */
2860
2861                 search_path = credential_search_path(params, encrypted);
2862                 if (!search_path)
2863                         return -ENOMEM;
2864
2865                 missing_ok = true;
2866         } else
2867                 source = NULL;
2868
2869         if (encrypted)
2870                 flags |= READ_FULL_FILE_UNBASE64;
2871
2872         maxsz = encrypted ? CREDENTIAL_ENCRYPTED_SIZE_MAX : CREDENTIAL_SIZE_MAX;
2873
2874         if (search_path) {
2875                 STRV_FOREACH(d, search_path) {
2876                         _cleanup_free_ char *j = NULL;
2877
2878                         j = path_join(*d, path);
2879                         if (!j)
2880                                 return -ENOMEM;
2881
2882                         r = read_full_file_full(
2883                                         AT_FDCWD, j, /* path is absolute, hence pass AT_FDCWD as nop dir fd here */
2884                                         UINT64_MAX,
2885                                         maxsz,
2886                                         flags,
2887                                         NULL,
2888                                         &data, &size);
2889                         if (r != -ENOENT)
2890                                 break;
2891                 }
2892         } else if (source)
2893                 r = read_full_file_full(
2894                                 read_dfd, source,
2895                                 UINT64_MAX,
2896                                 maxsz,
2897                                 flags,
2898                                 bindname,
2899                                 &data, &size);
2900         else
2901                 r = -ENOENT;
2902
2903         if (r == -ENOENT && (missing_ok || hashmap_contains(context->set_credentials, id))) {
2904                 /* Make a missing inherited credential non-fatal, let's just continue. After all apps
2905                  * will get clear errors if we don't pass such a missing credential on as they
2906                  * themselves will get ENOENT when trying to read them, which should not be much
2907                  * worse than when we handle the error here and make it fatal.
2908                  *
2909                  * Also, if the source file doesn't exist, but a fallback is set via SetCredentials=
2910                  * we are fine, too. */
2911                 log_debug_errno(r, "Couldn't read inherited credential '%s', skipping: %m", path);
2912                 return 0;
2913         }
2914         if (r < 0)
2915                 return log_debug_errno(r, "Failed to read credential '%s': %m", path);
2916
2917         if (encrypted) {
2918                 _cleanup_free_ void *plaintext = NULL;
2919                 size_t plaintext_size = 0;
2920
2921                 r = decrypt_credential_and_warn(id, now(CLOCK_REALTIME), NULL, NULL, data, size, &plaintext, &plaintext_size);
2922                 if (r < 0)
2923                         return r;
2924
2925                 free_and_replace(data, plaintext);
2926                 size = plaintext_size;
2927         }
2928
2929         add = strlen(id) + size;
2930         if (add > *left)
2931                 return -E2BIG;
2932
2933         r = write_credential(write_dfd, id, data, size, uid, ownership_ok);
2934         if (r < 0)
2935                 return log_debug_errno(r, "Failed to write credential '%s': %m", id);
2936
2937         *left -= add;
2938         return 0;
2939 }
2940
2941 struct load_cred_args {
2942         const ExecContext *context;
2943         const ExecParameters *params;
2944         bool encrypted;
2945         const char *unit;
2946         int dfd;
2947         uid_t uid;
2948         bool ownership_ok;
2949         uint64_t *left;
2950 };
2951
2952 static int load_cred_recurse_dir_cb(
2953                 RecurseDirEvent event,
2954                 const char *path,
2955                 int dir_fd,
2956                 int inode_fd,
2957                 const struct dirent *de,
2958                 const struct statx *sx,
2959                 void *userdata) {
2960
2961         struct load_cred_args *args = ASSERT_PTR(userdata);
2962         _cleanup_free_ char *sub_id = NULL;
2963         int r;
2964
2965         if (event != RECURSE_DIR_ENTRY)
2966                 return RECURSE_DIR_CONTINUE;
2967
2968         if (!IN_SET(de->d_type, DT_REG, DT_SOCK))
2969                 return RECURSE_DIR_CONTINUE;
2970
2971         sub_id = strreplace(path, "/", "_");
2972         if (!sub_id)
2973                 return -ENOMEM;
2974
2975         if (!credential_name_valid(sub_id))
2976                 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Credential would get ID %s, which is not valid, refusing", sub_id);
2977
2978         if (faccessat(args->dfd, sub_id, F_OK, AT_SYMLINK_NOFOLLOW) >= 0) {
2979                 log_debug("Skipping credential with duplicated ID %s at %s", sub_id, path);
2980                 return RECURSE_DIR_CONTINUE;
2981         }
2982         if (errno != ENOENT)
2983                 return log_debug_errno(errno, "Failed to test if credential %s exists: %m", sub_id);
2984
2985         r = load_credential(
2986                         args->context,
2987                         args->params,
2988                         sub_id,
2989                         de->d_name,
2990                         args->encrypted,
2991                         args->unit,
2992                         dir_fd,
2993                         args->dfd,
2994                         args->uid,
2995                         args->ownership_ok,
2996                         args->left);
2997         if (r < 0)
2998                 return r;
2999
3000         return RECURSE_DIR_CONTINUE;
3001 }
3002
3003 static int acquire_credentials(
3004                 const ExecContext *context,
3005                 const ExecParameters *params,
3006                 const char *unit,
3007                 const char *p,
3008                 uid_t uid,
3009                 bool ownership_ok) {
3010
3011         uint64_t left = CREDENTIALS_TOTAL_SIZE_MAX;
3012         _cleanup_close_ int dfd = -EBADF;
3013         ExecLoadCredential *lc;
3014         ExecSetCredential *sc;
3015         int r;
3016
3017         assert(context);
3018         assert(p);
3019
3020         dfd = open(p, O_DIRECTORY|O_CLOEXEC);
3021         if (dfd < 0)
3022                 return -errno;
3023
3024         /* First, load credentials off disk (or acquire via AF_UNIX socket) */
3025         HASHMAP_FOREACH(lc, context->load_credentials) {
3026                 _cleanup_close_ int sub_fd = -EBADF;
3027
3028                 /* If this is an absolute path, then try to open it as a directory. If that works, then we'll
3029                  * recurse into it. If it is an absolute path but it isn't a directory, then we'll open it as
3030                  * a regular file. Finally, if it's a relative path we will use it as a credential name to
3031                  * propagate a credential passed to us from further up. */
3032
3033                 if (path_is_absolute(lc->path)) {
3034                         sub_fd = open(lc->path, O_DIRECTORY|O_CLOEXEC|O_RDONLY);
3035                         if (sub_fd < 0 && !IN_SET(errno,
3036                                                   ENOTDIR,  /* Not a directory */
3037                                                   ENOENT))  /* Doesn't exist? */
3038                                 return log_debug_errno(errno, "Failed to open '%s': %m", lc->path);
3039                 }
3040
3041                 if (sub_fd < 0)
3042                         /* Regular file (incl. a credential passed in from higher up) */
3043                         r = load_credential(
3044                                         context,
3045                                         params,
3046                                         lc->id,
3047                                         lc->path,
3048                                         lc->encrypted,
3049                                         unit,
3050                                         AT_FDCWD,
3051                                         dfd,
3052                                         uid,
3053                                         ownership_ok,
3054                                         &left);
3055                 else
3056                         /* Directory */
3057                         r = recurse_dir(
3058                                         sub_fd,
3059                                         /* path= */ lc->id, /* recurse_dir() will suffix the subdir paths from here to the top-level id */
3060                                         /* statx_mask= */ 0,
3061                                         /* n_depth_max= */ UINT_MAX,
3062                                         RECURSE_DIR_SORT|RECURSE_DIR_IGNORE_DOT|RECURSE_DIR_ENSURE_TYPE,
3063                                         load_cred_recurse_dir_cb,
3064                                         &(struct load_cred_args) {
3065                                                 .context = context,
3066                                                 .params = params,
3067                                                 .encrypted = lc->encrypted,
3068                                                 .unit = unit,
3069                                                 .dfd = dfd,
3070                                                 .uid = uid,
3071                                                 .ownership_ok = ownership_ok,
3072                                                 .left = &left,
3073                                         });
3074                 if (r < 0)
3075                         return r;
3076         }
3077
3078         /* Second, we add in literally specified credentials. If the credentials already exist, we'll not add
3079          * them, so that they can act as a "default" if the same credential is specified multiple times. */
3080         HASHMAP_FOREACH(sc, context->set_credentials) {
3081                 _cleanup_(erase_and_freep) void *plaintext = NULL;
3082                 const char *data;
3083                 size_t size, add;
3084
3085                 /* Note that we check ahead of time here instead of relying on O_EXCL|O_CREAT later to return
3086                  * EEXIST if the credential already exists. That's because the TPM2-based decryption is kinda
3087                  * slow and involved, hence it's nice to be able to skip that if the credential already
3088                  * exists anyway. */
3089                 if (faccessat(dfd, sc->id, F_OK, AT_SYMLINK_NOFOLLOW) >= 0)
3090                         continue;
3091                 if (errno != ENOENT)
3092                         return log_debug_errno(errno, "Failed to test if credential %s exists: %m", sc->id);
3093
3094                 if (sc->encrypted) {
3095                         r = decrypt_credential_and_warn(sc->id, now(CLOCK_REALTIME), NULL, NULL, sc->data, sc->size, &plaintext, &size);
3096                         if (r < 0)
3097                                 return r;
3098
3099                         data = plaintext;
3100                 } else {
3101                         data = sc->data;
3102                         size = sc->size;
3103                 }
3104
3105                 add = strlen(sc->id) + size;
3106                 if (add > left)
3107                         return -E2BIG;
3108
3109                 r = write_credential(dfd, sc->id, data, size, uid, ownership_ok);
3110                 if (r < 0)
3111                         return r;
3112
3113                 left -= add;
3114         }
3115
3116         if (fchmod(dfd, 0500) < 0) /* Now take away the "w" bit */
3117                 return -errno;
3118
3119         /* After we created all keys with the right perms, also make sure the credential store as a whole is
3120          * accessible */
3121
3122         if (uid_is_valid(uid) && uid != getuid()) {
3123                 r = fd_add_uid_acl_permission(dfd, uid, ACL_READ | ACL_EXECUTE);
3124                 if (r < 0) {
3125                         if (!ERRNO_IS_NOT_SUPPORTED(r) && !ERRNO_IS_PRIVILEGE(r))
3126                                 return r;
3127
3128                         if (!ownership_ok)
3129                                 return r;
3130
3131                         if (fchown(dfd, uid, GID_INVALID) < 0)
3132                                 return -errno;
3133                 }
3134         }
3135
3136         return 0;
3137 }
3138
3139 static int setup_credentials_internal(
3140                 const ExecContext *context,
3141                 const ExecParameters *params,
3142                 const char *unit,
3143                 const char *final,        /* This is where the credential store shall eventually end up at */
3144                 const char *workspace,    /* This is where we can prepare it before moving it to the final place */
3145                 bool reuse_workspace,     /* Whether to reuse any existing workspace mount if it already is a mount */
3146                 bool must_mount,          /* Whether to require that we mount something, it's not OK to use the plain directory fall back */
3147                 uid_t uid) {
3148
3149         int r, workspace_mounted; /* negative if we don't know yet whether we have/can mount something; true
3150                                    * if we mounted something; false if we definitely can't mount anything */
3151         bool final_mounted;
3152         const char *where;
3153
3154         assert(context);
3155         assert(final);
3156         assert(workspace);
3157
3158         if (reuse_workspace) {
3159                 r = path_is_mount_point(workspace, NULL, 0);
3160                 if (r < 0)
3161                         return r;
3162                 if (r > 0)
3163                         workspace_mounted = true; /* If this is already a mount, and we are supposed to reuse it, let's keep this in mind */
3164                 else
3165                         workspace_mounted = -1; /* We need to figure out if we can mount something to the workspace */
3166         } else
3167                 workspace_mounted = -1; /* ditto */
3168
3169         r = path_is_mount_point(final, NULL, 0);
3170         if (r < 0)
3171                 return r;
3172         if (r > 0) {
3173                 /* If the final place already has something mounted, we use that. If the workspace also has
3174                  * something mounted we assume it's actually the same mount (but with MS_RDONLY
3175                  * different). */
3176                 final_mounted = true;
3177
3178                 if (workspace_mounted < 0) {
3179                         /* If the final place is mounted, but the workspace isn't, then let's bind mount
3180                          * the final version to the workspace, and make it writable, so that we can make
3181                          * changes */
3182
3183                         r = mount_nofollow_verbose(LOG_DEBUG, final, workspace, NULL, MS_BIND|MS_REC, NULL);
3184                         if (r < 0)
3185                                 return r;
3186
3187                         r = mount_nofollow_verbose(LOG_DEBUG, NULL, workspace, NULL, MS_BIND|MS_REMOUNT|MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL);
3188                         if (r < 0)
3189                                 return r;
3190
3191                         workspace_mounted = true;
3192                 }
3193         } else
3194                 final_mounted = false;
3195
3196         if (workspace_mounted < 0) {
3197                 /* Nothing is mounted on the workspace yet, let's try to mount something now */
3198                 for (int try = 0;; try++) {
3199
3200                         if (try == 0) {
3201                                 /* Try "ramfs" first, since it's not swap backed */
3202                                 r = mount_nofollow_verbose(LOG_DEBUG, "ramfs", workspace, "ramfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, "mode=0700");
3203                                 if (r >= 0) {
3204                                         workspace_mounted = true;
3205                                         break;
3206                                 }
3207
3208                         } else if (try == 1) {
3209                                 _cleanup_free_ char *opts = NULL;
3210
3211                                 if (asprintf(&opts, "mode=0700,nr_inodes=1024,size=%zu", (size_t) CREDENTIALS_TOTAL_SIZE_MAX) < 0)
3212                                         return -ENOMEM;
3213
3214                                 /* Fall back to "tmpfs" otherwise */
3215                                 r = mount_nofollow_verbose(LOG_DEBUG, "tmpfs", workspace, "tmpfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, opts);
3216                                 if (r >= 0) {
3217                                         workspace_mounted = true;
3218                                         break;
3219                                 }
3220
3221                         } else {
3222                                 /* If that didn't work, try to make a bind mount from the final to the workspace, so that we can make it writable there. */
3223                                 r = mount_nofollow_verbose(LOG_DEBUG, final, workspace, NULL, MS_BIND|MS_REC, NULL);
3224                                 if (r < 0) {
3225                                         if (!ERRNO_IS_PRIVILEGE(r)) /* Propagate anything that isn't a permission problem */
3226                                                 return r;
3227
3228                                         if (must_mount) /* If we it's not OK to use the plain directory
3229                                                          * fallback, propagate all errors too */
3230                                                 return r;
3231
3232                                         /* If we lack privileges to bind mount stuff, then let's gracefully
3233                                          * proceed for compat with container envs, and just use the final dir
3234                                          * as is. */
3235
3236                                         workspace_mounted = false;
3237                                         break;
3238                                 }
3239
3240                                 /* Make the new bind mount writable (i.e. drop MS_RDONLY) */
3241                                 r = mount_nofollow_verbose(LOG_DEBUG, NULL, workspace, NULL, MS_BIND|MS_REMOUNT|MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL);
3242                                 if (r < 0)
3243                                         return r;
3244
3245                                 workspace_mounted = true;
3246                                 break;
3247                         }
3248                 }
3249         }
3250
3251         assert(!must_mount || workspace_mounted > 0);
3252         where = workspace_mounted ? workspace : final;
3253
3254         (void) label_fix_full(AT_FDCWD, where, final, 0);
3255
3256         r = acquire_credentials(context, params, unit, where, uid, workspace_mounted);
3257         if (r < 0)
3258                 return r;
3259
3260         if (workspace_mounted) {
3261                 bool install;
3262
3263                 /* Determine if we should actually install the prepared mount in the final location by bind
3264                  * mounting it there. We do so only if the mount is not established there already, and if the
3265                  * mount is actually non-empty (i.e. carries at least one credential). Not that in the best
3266                  * case we are doing all this in a mount namespace, thus no one else will see that we
3267                  * allocated a file system we are getting rid of again here. */
3268                 if (final_mounted)
3269                         install = false; /* already installed */
3270                 else {
3271                         r = dir_is_empty(where, /* ignore_hidden_or_backup= */ false);
3272                         if (r < 0)
3273                                 return r;
3274
3275                         install = r == 0; /* install only if non-empty */
3276                 }
3277
3278                 if (install) {
3279                         /* Make workspace read-only now, so that any bind mount we make from it defaults to read-only too */
3280                         r = mount_nofollow_verbose(LOG_DEBUG, NULL, workspace, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL);
3281                         if (r < 0)
3282                                 return r;
3283
3284                         /* And mount it to the final place, read-only */
3285                         r = mount_nofollow_verbose(LOG_DEBUG, workspace, final, NULL, MS_MOVE, NULL);
3286                 } else
3287                         /* Otherwise get rid of it */
3288                         r = umount_verbose(LOG_DEBUG, workspace, MNT_DETACH|UMOUNT_NOFOLLOW);
3289                 if (r < 0)
3290                         return r;
3291         } else {
3292                 _cleanup_free_ char *parent = NULL;
3293
3294                 /* If we do not have our own mount put used the plain directory fallback, then we need to
3295                  * open access to the top-level credential directory and the per-service directory now */
3296
3297                 r = path_extract_directory(final, &parent);
3298                 if (r < 0)
3299                         return r;
3300                 if (chmod(parent, 0755) < 0)
3301                         return -errno;
3302         }
3303
3304         return 0;
3305 }
3306
3307 static int setup_credentials(
3308                 const ExecContext *context,
3309                 const ExecParameters *params,
3310                 const char *unit,
3311                 uid_t uid) {
3312
3313         _cleanup_free_ char *p = NULL, *q = NULL;
3314         int r;
3315
3316         assert(context);
3317         assert(params);
3318
3319         if (!exec_context_has_credentials(context))
3320                 return 0;
3321
3322         if (!params->prefix[EXEC_DIRECTORY_RUNTIME])
3323                 return -EINVAL;
3324
3325         /* This where we'll place stuff when we are done; this main credentials directory is world-readable,
3326          * and the subdir we mount over with a read-only file system readable by the service's user */
3327         q = path_join(params->prefix[EXEC_DIRECTORY_RUNTIME], "credentials");
3328         if (!q)
3329                 return -ENOMEM;
3330
3331         r = mkdir_label(q, 0755); /* top-level dir: world readable/searchable */
3332         if (r < 0 && r != -EEXIST)
3333                 return r;
3334
3335         p = path_join(q, unit);
3336         if (!p)
3337                 return -ENOMEM;
3338
3339         r = mkdir_label(p, 0700); /* per-unit dir: private to user */
3340         if (r < 0 && r != -EEXIST)
3341                 return r;
3342
3343         r = safe_fork("(sd-mkdcreds)", FORK_DEATHSIG|FORK_WAIT|FORK_NEW_MOUNTNS, NULL);
3344         if (r < 0) {
3345                 _cleanup_free_ char *t = NULL, *u = NULL;
3346
3347                 /* If this is not a privilege or support issue then propagate the error */
3348                 if (!ERRNO_IS_NOT_SUPPORTED(r) && !ERRNO_IS_PRIVILEGE(r))
3349                         return r;
3350
3351                 /* Temporary workspace, that remains inaccessible all the time. We prepare stuff there before moving
3352                  * it into place, so that users can't access half-initialized credential stores. */
3353                 t = path_join(params->prefix[EXEC_DIRECTORY_RUNTIME], "systemd/temporary-credentials");
3354                 if (!t)
3355                         return -ENOMEM;
3356
3357                 /* We can't set up a mount namespace. In that case operate on a fixed, inaccessible per-unit
3358                  * directory outside of /run/credentials/ first, and then move it over to /run/credentials/
3359                  * after it is fully set up */
3360                 u = path_join(t, unit);
3361                 if (!u)
3362                         return -ENOMEM;
3363
3364                 FOREACH_STRING(i, t, u) {
3365                         r = mkdir_label(i, 0700);
3366                         if (r < 0 && r != -EEXIST)
3367                                 return r;
3368                 }
3369
3370                 r = setup_credentials_internal(
3371                                 context,
3372                                 params,
3373                                 unit,
3374                                 p,       /* final mount point */
3375                                 u,       /* temporary workspace to overmount */
3376                                 true,    /* reuse the workspace if it is already a mount */
3377                                 false,   /* it's OK to fall back to a plain directory if we can't mount anything */
3378                                 uid);
3379
3380                 (void) rmdir(u); /* remove the workspace again if we can. */
3381
3382                 if (r < 0)
3383                         return r;
3384
3385         } else if (r == 0) {
3386
3387                 /* We managed to set up a mount namespace, and are now in a child. That's great. In this case
3388                  * we can use the same directory for all cases, after turning off propagation. Question
3389                  * though is: where do we turn off propagation exactly, and where do we place the workspace
3390                  * directory? We need some place that is guaranteed to be a mount point in the host, and
3391                  * which is guaranteed to have a subdir we can mount over. /run/ is not suitable for this,
3392                  * since we ultimately want to move the resulting file system there, i.e. we need propagation
3393                  * for /run/ eventually. We could use our own /run/systemd/bind mount on itself, but that
3394                  * would be visible in the host mount table all the time, which we want to avoid. Hence, what
3395                  * we do here instead we use /dev/ and /dev/shm/ for our purposes. We know for sure that
3396                  * /dev/ is a mount point and we now for sure that /dev/shm/ exists. Hence we can turn off
3397                  * propagation on the former, and then overmount the latter.
3398                  *
3399                  * Yes it's nasty playing games with /dev/ and /dev/shm/ like this, since it does not exist
3400                  * for this purpose, but there are few other candidates that work equally well for us, and
3401                  * given that the we do this in a privately namespaced short-lived single-threaded process
3402                  * that no one else sees this should be OK to do. */
3403
3404                 r = mount_nofollow_verbose(LOG_DEBUG, NULL, "/dev", NULL, MS_SLAVE|MS_REC, NULL); /* Turn off propagation from our namespace to host */
3405                 if (r < 0)
3406                         goto child_fail;
3407
3408                 r = setup_credentials_internal(
3409                                 context,
3410                                 params,
3411                                 unit,
3412                                 p,           /* final mount point */
3413                                 "/dev/shm",  /* temporary workspace to overmount */
3414                                 false,       /* do not reuse /dev/shm if it is already a mount, under no circumstances */
3415                                 true,        /* insist that something is mounted, do not allow fallback to plain directory */
3416                                 uid);
3417                 if (r < 0)
3418                         goto child_fail;
3419
3420                 _exit(EXIT_SUCCESS);
3421
3422         child_fail:
3423                 _exit(EXIT_FAILURE);
3424         }
3425
3426         /* If the credentials dir is empty and not a mount point, then there's no point in having it. Let's
3427          * try to remove it. This matters in particular if we created the dir as mount point but then didn't
3428          * actually end up mounting anything on it. In that case we'd rather have ENOENT than EACCESS being
3429          * seen by users when trying access this inode. */
3430         (void) rmdir(p);
3431         return 0;
3432 }
3433
3434 #if ENABLE_SMACK
3435 static int setup_smack(
3436                 const Manager *manager,
3437                 const ExecContext *context,
3438                 int executable_fd) {
3439         int r;
3440
3441         assert(context);
3442         assert(executable_fd >= 0);
3443
3444         if (context->smack_process_label) {
3445                 r = mac_smack_apply_pid(0, context->smack_process_label);
3446                 if (r < 0)
3447                         return r;
3448         } else if (manager->default_smack_process_label) {
3449                 _cleanup_free_ char *exec_label = NULL;
3450
3451                 r = mac_smack_read_fd(executable_fd, SMACK_ATTR_EXEC, &exec_label);
3452                 if (r < 0 && !ERRNO_IS_XATTR_ABSENT(r))
3453                         return r;
3454
3455                 r = mac_smack_apply_pid(0, exec_label ?: manager->default_smack_process_label);
3456                 if (r < 0)
3457                         return r;
3458         }
3459
3460         return 0;
3461 }
3462 #endif
3463
3464 static int compile_bind_mounts(
3465                 const ExecContext *context,
3466                 const ExecParameters *params,
3467                 BindMount **ret_bind_mounts,
3468                 size_t *ret_n_bind_mounts,
3469                 char ***ret_empty_directories) {
3470
3471         _cleanup_strv_free_ char **empty_directories = NULL;
3472         BindMount *bind_mounts = NULL;
3473         size_t n, h = 0;
3474         int r;
3475
3476         assert(context);
3477         assert(params);
3478         assert(ret_bind_mounts);
3479         assert(ret_n_bind_mounts);
3480         assert(ret_empty_directories);
3481
3482         CLEANUP_ARRAY(bind_mounts, h, bind_mount_free_many);
3483
3484         n = context->n_bind_mounts;
3485         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
3486                 if (!params->prefix[t])
3487                         continue;
3488
3489                 for (size_t i = 0; i < context->directories[t].n_items; i++)
3490                         n += !context->directories[t].items[i].only_create;
3491         }
3492
3493         if (n <= 0) {
3494                 *ret_bind_mounts = NULL;
3495                 *ret_n_bind_mounts = 0;
3496                 *ret_empty_directories = NULL;
3497                 return 0;
3498         }
3499
3500         bind_mounts = new(BindMount, n);
3501         if (!bind_mounts)
3502                 return -ENOMEM;
3503
3504         for (size_t i = 0; i < context->n_bind_mounts; i++) {
3505                 BindMount *item = context->bind_mounts + i;
3506                 _cleanup_free_ char *s = NULL, *d = NULL;
3507
3508                 s = strdup(item->source);
3509                 if (!s)
3510                         return -ENOMEM;
3511
3512                 d = strdup(item->destination);
3513                 if (!d)
3514                         return -ENOMEM;
3515
3516                 bind_mounts[h++] = (BindMount) {
3517                         .source = TAKE_PTR(s),
3518                         .destination = TAKE_PTR(d),
3519                         .read_only = item->read_only,
3520                         .recursive = item->recursive,
3521                         .ignore_enoent = item->ignore_enoent,
3522                 };
3523         }
3524
3525         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
3526                 if (!params->prefix[t])
3527                         continue;
3528
3529                 if (context->directories[t].n_items == 0)
3530                         continue;
3531
3532                 if (exec_directory_is_private(context, t) &&
3533                     !exec_context_with_rootfs(context)) {
3534                         char *private_root;
3535
3536                         /* So this is for a dynamic user, and we need to make sure the process can access its own
3537                          * directory. For that we overmount the usually inaccessible "private" subdirectory with a
3538                          * tmpfs that makes it accessible and is empty except for the submounts we do this for. */
3539
3540                         private_root = path_join(params->prefix[t], "private");
3541                         if (!private_root)
3542                                 return -ENOMEM;
3543
3544                         r = strv_consume(&empty_directories, private_root);
3545                         if (r < 0)
3546                                 return r;
3547                 }
3548
3549                 for (size_t i = 0; i < context->directories[t].n_items; i++) {
3550                         _cleanup_free_ char *s = NULL, *d = NULL;
3551
3552                         /* When one of the parent directories is in the list, we cannot create the symlink
3553                          * for the child directory. See also the comments in setup_exec_directory(). */
3554                         if (context->directories[t].items[i].only_create)
3555                                 continue;
3556
3557                         if (exec_directory_is_private(context, t))
3558                                 s = path_join(params->prefix[t], "private", context->directories[t].items[i].path);
3559                         else
3560                                 s = path_join(params->prefix[t], context->directories[t].items[i].path);
3561                         if (!s)
3562                                 return -ENOMEM;
3563
3564                         if (exec_directory_is_private(context, t) &&
3565                             exec_context_with_rootfs(context))
3566                                 /* When RootDirectory= or RootImage= are set, then the symbolic link to the private
3567                                  * directory is not created on the root directory. So, let's bind-mount the directory
3568                                  * on the 'non-private' place. */
3569                                 d = path_join(params->prefix[t], context->directories[t].items[i].path);
3570                         else
3571                                 d = strdup(s);
3572                         if (!d)
3573                                 return -ENOMEM;
3574
3575                         bind_mounts[h++] = (BindMount) {
3576                                 .source = TAKE_PTR(s),
3577                                 .destination = TAKE_PTR(d),
3578                                 .read_only = false,
3579                                 .nosuid = context->dynamic_user, /* don't allow suid/sgid when DynamicUser= is on */
3580                                 .recursive = true,
3581                                 .ignore_enoent = false,
3582                         };
3583                 }
3584         }
3585
3586         assert(h == n);
3587
3588         *ret_bind_mounts = TAKE_PTR(bind_mounts);
3589         *ret_n_bind_mounts = n;
3590         *ret_empty_directories = TAKE_PTR(empty_directories);
3591
3592         return (int) n;
3593 }
3594
3595 /* ret_symlinks will contain a list of pairs src:dest that describes
3596  * the symlinks to create later on. For example, the symlinks needed
3597  * to safely give private directories to DynamicUser=1 users. */
3598 static int compile_symlinks(
3599                 const ExecContext *context,
3600                 const ExecParameters *params,
3601                 char ***ret_symlinks) {
3602
3603         _cleanup_strv_free_ char **symlinks = NULL;
3604         int r;
3605
3606         assert(context);
3607         assert(params);
3608         assert(ret_symlinks);
3609
3610         for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
3611                 for (size_t i = 0; i < context->directories[dt].n_items; i++) {
3612                         _cleanup_free_ char *private_path = NULL, *path = NULL;
3613
3614                         STRV_FOREACH(symlink, context->directories[dt].items[i].symlinks) {
3615                                 _cleanup_free_ char *src_abs = NULL, *dst_abs = NULL;
3616
3617                                 src_abs = path_join(params->prefix[dt], context->directories[dt].items[i].path);
3618                                 dst_abs = path_join(params->prefix[dt], *symlink);
3619                                 if (!src_abs || !dst_abs)
3620                                         return -ENOMEM;
3621
3622                                 r = strv_consume_pair(&symlinks, TAKE_PTR(src_abs), TAKE_PTR(dst_abs));
3623                                 if (r < 0)
3624                                         return r;
3625                         }
3626
3627                         if (!exec_directory_is_private(context, dt) ||
3628                             exec_context_with_rootfs(context) ||
3629                             context->directories[dt].items[i].only_create)
3630                                 continue;
3631
3632                         private_path = path_join(params->prefix[dt], "private", context->directories[dt].items[i].path);
3633                         if (!private_path)
3634                                 return -ENOMEM;
3635
3636                         path = path_join(params->prefix[dt], context->directories[dt].items[i].path);
3637                         if (!path)
3638                                 return -ENOMEM;
3639
3640                         r = strv_consume_pair(&symlinks, TAKE_PTR(private_path), TAKE_PTR(path));
3641                         if (r < 0)
3642                                 return r;
3643                 }
3644         }
3645
3646         *ret_symlinks = TAKE_PTR(symlinks);
3647
3648         return 0;
3649 }
3650
3651 static bool insist_on_sandboxing(
3652                 const ExecContext *context,
3653                 const char *root_dir,
3654                 const char *root_image,
3655                 const BindMount *bind_mounts,
3656                 size_t n_bind_mounts) {
3657
3658         assert(context);
3659         assert(n_bind_mounts == 0 || bind_mounts);
3660
3661         /* Checks whether we need to insist on fs namespacing. i.e. whether we have settings configured that
3662          * would alter the view on the file system beyond making things read-only or invisible, i.e. would
3663          * rearrange stuff in a way we cannot ignore gracefully. */
3664
3665         if (context->n_temporary_filesystems > 0)
3666                 return true;
3667
3668         if (root_dir || root_image)
3669                 return true;
3670
3671         if (context->n_mount_images > 0)
3672                 return true;
3673
3674         if (context->dynamic_user)
3675                 return true;
3676
3677         if (context->n_extension_images > 0 || !strv_isempty(context->extension_directories))
3678                 return true;
3679
3680         /* If there are any bind mounts set that don't map back onto themselves, fs namespacing becomes
3681          * essential. */
3682         for (size_t i = 0; i < n_bind_mounts; i++)
3683                 if (!path_equal(bind_mounts[i].source, bind_mounts[i].destination))
3684                         return true;
3685
3686         if (context->log_namespace)
3687                 return true;
3688
3689         return false;
3690 }
3691
3692 static int apply_mount_namespace(
3693                 const Unit *u,
3694                 ExecCommandFlags command_flags,
3695                 const ExecContext *context,
3696                 const ExecParameters *params,
3697                 const ExecRuntime *runtime,
3698                 const char *memory_pressure_path,
3699                 char **error_path) {
3700
3701         _cleanup_strv_free_ char **empty_directories = NULL, **symlinks = NULL,
3702                         **read_write_paths_cleanup = NULL;
3703         const char *tmp_dir = NULL, *var_tmp_dir = NULL;
3704         const char *root_dir = NULL, *root_image = NULL;
3705         _cleanup_free_ char *creds_path = NULL, *incoming_dir = NULL, *propagate_dir = NULL,
3706                         *extension_dir = NULL;
3707         char **read_write_paths;
3708         NamespaceInfo ns_info;
3709         bool needs_sandboxing;
3710         BindMount *bind_mounts = NULL;
3711         size_t n_bind_mounts = 0;
3712         int r;
3713
3714         assert(context);
3715
3716         CLEANUP_ARRAY(bind_mounts, n_bind_mounts, bind_mount_free_many);
3717
3718         if (params->flags & EXEC_APPLY_CHROOT) {
3719                 root_image = context->root_image;
3720
3721                 if (!root_image)
3722                         root_dir = context->root_directory;
3723         }
3724
3725         r = compile_bind_mounts(context, params, &bind_mounts, &n_bind_mounts, &empty_directories);
3726         if (r < 0)
3727                 return r;
3728
3729         /* Symlinks for exec dirs are set up after other mounts, before they are made read-only. */
3730         r = compile_symlinks(context, params, &symlinks);
3731         if (r < 0)
3732                 return r;
3733
3734         /* We need to make the pressure path writable even if /sys/fs/cgroups is made read-only, as the
3735          * service will need to write to it in order to start the notifications. */
3736         if (context->protect_control_groups && memory_pressure_path && !streq(memory_pressure_path, "/dev/null")) {
3737                 read_write_paths_cleanup = strv_copy(context->read_write_paths);
3738                 if (!read_write_paths_cleanup)
3739                         return -ENOMEM;
3740
3741                 r = strv_extend(&read_write_paths_cleanup, memory_pressure_path);
3742                 if (r < 0)
3743                         return r;
3744
3745                 read_write_paths = read_write_paths_cleanup;
3746         } else
3747                 read_write_paths = context->read_write_paths;
3748
3749         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command_flags & EXEC_COMMAND_FULLY_PRIVILEGED);
3750         if (needs_sandboxing) {
3751                 /* The runtime struct only contains the parent of the private /tmp,
3752                  * which is non-accessible to world users. Inside of it there's a /tmp
3753                  * that is sticky, and that's the one we want to use here.
3754                  * This does not apply when we are using /run/systemd/empty as fallback. */
3755
3756                 if (context->private_tmp && runtime && runtime->shared) {
3757                         if (streq_ptr(runtime->shared->tmp_dir, RUN_SYSTEMD_EMPTY))
3758                                 tmp_dir = runtime->shared->tmp_dir;
3759                         else if (runtime->shared->tmp_dir)
3760                                 tmp_dir = strjoina(runtime->shared->tmp_dir, "/tmp");
3761
3762                         if (streq_ptr(runtime->shared->var_tmp_dir, RUN_SYSTEMD_EMPTY))
3763                                 var_tmp_dir = runtime->shared->var_tmp_dir;
3764                         else if (runtime->shared->var_tmp_dir)
3765                                 var_tmp_dir = strjoina(runtime->shared->var_tmp_dir, "/tmp");
3766                 }
3767
3768                 ns_info = (NamespaceInfo) {
3769                         .ignore_protect_paths = false,
3770                         .private_dev = context->private_devices,
3771                         .protect_control_groups = context->protect_control_groups,
3772                         .protect_kernel_tunables = context->protect_kernel_tunables,
3773                         .protect_kernel_modules = context->protect_kernel_modules,
3774                         .protect_kernel_logs = context->protect_kernel_logs,
3775                         .protect_hostname = context->protect_hostname,
3776                         .mount_apivfs = exec_context_get_effective_mount_apivfs(context),
3777                         .protect_home = context->protect_home,
3778                         .protect_system = context->protect_system,
3779                         .protect_proc = context->protect_proc,
3780                         .proc_subset = context->proc_subset,
3781                         .private_network = exec_needs_network_namespace(context),
3782                         .private_ipc = exec_needs_ipc_namespace(context),
3783                         /* If NNP is on, we can turn on MS_NOSUID, since it won't have any effect anymore. */
3784                         .mount_nosuid = context->no_new_privileges && !mac_selinux_use(),
3785                 };
3786         } else if (!context->dynamic_user && root_dir)
3787                 /*
3788                  * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed
3789                  * sandbox info, otherwise enforce it, don't ignore protected paths and
3790                  * fail if we are enable to apply the sandbox inside the mount namespace.
3791                  */
3792                 ns_info = (NamespaceInfo) {
3793                         .ignore_protect_paths = true,
3794                 };
3795         else
3796                 ns_info = (NamespaceInfo) {};
3797
3798         if (context->mount_propagation_flag == MS_SHARED)
3799                 log_unit_debug(u, "shared mount propagation hidden by other fs namespacing unit settings: ignoring");
3800
3801         if (exec_context_has_credentials(context) &&
3802             params->prefix[EXEC_DIRECTORY_RUNTIME] &&
3803             FLAGS_SET(params->flags, EXEC_WRITE_CREDENTIALS)) {
3804                 creds_path = path_join(params->prefix[EXEC_DIRECTORY_RUNTIME], "credentials", u->id);
3805                 if (!creds_path)
3806                         return -ENOMEM;
3807         }
3808
3809         if (MANAGER_IS_SYSTEM(u->manager)) {
3810                 propagate_dir = path_join("/run/systemd/propagate/", u->id);
3811                 if (!propagate_dir)
3812                         return -ENOMEM;
3813
3814                 incoming_dir = strdup("/run/systemd/incoming");
3815                 if (!incoming_dir)
3816                         return -ENOMEM;
3817
3818                 extension_dir = strdup("/run/systemd/unit-extensions");
3819                 if (!extension_dir)
3820                         return -ENOMEM;
3821         } else
3822                 if (asprintf(&extension_dir, "/run/user/" UID_FMT "/systemd/unit-extensions", geteuid()) < 0)
3823                         return -ENOMEM;
3824
3825         r = setup_namespace(
3826                         root_dir,
3827                         root_image,
3828                         context->root_image_options,
3829                         context->root_image_policy ?: &image_policy_service,
3830                         &ns_info,
3831                         read_write_paths,
3832                         needs_sandboxing ? context->read_only_paths : NULL,
3833                         needs_sandboxing ? context->inaccessible_paths : NULL,
3834                         needs_sandboxing ? context->exec_paths : NULL,
3835                         needs_sandboxing ? context->no_exec_paths : NULL,
3836                         empty_directories,
3837                         symlinks,
3838                         bind_mounts,
3839                         n_bind_mounts,
3840                         context->temporary_filesystems,
3841                         context->n_temporary_filesystems,
3842                         context->mount_images,
3843                         context->n_mount_images,
3844                         context->mount_image_policy ?: &image_policy_service,
3845                         tmp_dir,
3846                         var_tmp_dir,
3847                         creds_path,
3848                         context->log_namespace,
3849                         context->mount_propagation_flag,
3850                         context->root_hash, context->root_hash_size, context->root_hash_path,
3851                         context->root_hash_sig, context->root_hash_sig_size, context->root_hash_sig_path,
3852                         context->root_verity,
3853                         context->extension_images,
3854                         context->n_extension_images,
3855                         context->extension_image_policy ?: &image_policy_sysext,
3856                         context->extension_directories,
3857                         propagate_dir,
3858                         incoming_dir,
3859                         extension_dir,
3860                         root_dir || root_image ? params->notify_socket : NULL,
3861                         error_path);
3862
3863         /* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports
3864          * that with a special, recognizable error ENOANO. In this case, silently proceed, but only if exclusively
3865          * sandboxing options were used, i.e. nothing such as RootDirectory= or BindMount= that would result in a
3866          * completely different execution environment. */
3867         if (r == -ENOANO) {
3868                 if (insist_on_sandboxing(
3869                                     context,
3870                                     root_dir, root_image,
3871                                     bind_mounts,
3872                                     n_bind_mounts))
3873                         return log_unit_debug_errno(u,
3874                                                     SYNTHETIC_ERRNO(EOPNOTSUPP),
3875                                                     "Failed to set up namespace, and refusing to continue since "
3876                                                     "the selected namespacing options alter mount environment non-trivially.\n"
3877                                                     "Bind mounts: %zu, temporary filesystems: %zu, root directory: %s, root image: %s, dynamic user: %s",
3878                                                     n_bind_mounts,
3879                                                     context->n_temporary_filesystems,
3880                                                     yes_no(root_dir),
3881                                                     yes_no(root_image),
3882                                                     yes_no(context->dynamic_user));
3883
3884                 log_unit_debug(u, "Failed to set up namespace, assuming containerized execution and ignoring.");
3885                 return 0;
3886         }
3887
3888         return r;
3889 }
3890
3891 static int apply_working_directory(
3892                 const ExecContext *context,
3893                 const ExecParameters *params,
3894                 const char *home,
3895                 int *exit_status) {
3896
3897         const char *d, *wd;
3898
3899         assert(context);
3900         assert(exit_status);
3901
3902         if (context->working_directory_home) {
3903
3904                 if (!home) {
3905                         *exit_status = EXIT_CHDIR;
3906                         return -ENXIO;
3907                 }
3908
3909                 wd = home;
3910
3911         } else
3912                 wd = empty_to_root(context->working_directory);
3913
3914         if (params->flags & EXEC_APPLY_CHROOT)
3915                 d = wd;
3916         else
3917                 d = prefix_roota(context->root_directory, wd);
3918
3919         if (chdir(d) < 0 && !context->working_directory_missing_ok) {
3920                 *exit_status = EXIT_CHDIR;
3921                 return -errno;
3922         }
3923
3924         return 0;
3925 }
3926
3927 static int apply_root_directory(
3928                 const ExecContext *context,
3929                 const ExecParameters *params,
3930                 const bool needs_mount_ns,
3931                 int *exit_status) {
3932
3933         assert(context);
3934         assert(exit_status);
3935
3936         if (params->flags & EXEC_APPLY_CHROOT)
3937                 if (!needs_mount_ns && context->root_directory)
3938                         if (chroot(context->root_directory) < 0) {
3939                                 *exit_status = EXIT_CHROOT;
3940                                 return -errno;
3941                         }
3942
3943         return 0;
3944 }
3945
3946 static int setup_keyring(
3947                 const Unit *u,
3948                 const ExecContext *context,
3949                 const ExecParameters *p,
3950                 uid_t uid, gid_t gid) {
3951
3952         key_serial_t keyring;
3953         int r = 0;
3954         uid_t saved_uid;
3955         gid_t saved_gid;
3956
3957         assert(u);
3958         assert(context);
3959         assert(p);
3960
3961         /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that
3962          * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond
3963          * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be
3964          * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in
3965          * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where
3966          * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */
3967
3968         if (context->keyring_mode == EXEC_KEYRING_INHERIT)
3969                 return 0;
3970
3971         /* Acquiring a reference to the user keyring is nasty. We briefly change identity in order to get things set up
3972          * properly by the kernel. If we don't do that then we can't create it atomically, and that sucks for parallel
3973          * execution. This mimics what pam_keyinit does, too. Setting up session keyring, to be owned by the right user
3974          * & group is just as nasty as acquiring a reference to the user keyring. */
3975
3976         saved_uid = getuid();
3977         saved_gid = getgid();
3978
3979         if (gid_is_valid(gid) && gid != saved_gid) {
3980                 if (setregid(gid, -1) < 0)
3981                         return log_unit_error_errno(u, errno, "Failed to change GID for user keyring: %m");
3982         }
3983
3984         if (uid_is_valid(uid) && uid != saved_uid) {
3985                 if (setreuid(uid, -1) < 0) {
3986                         r = log_unit_error_errno(u, errno, "Failed to change UID for user keyring: %m");
3987                         goto out;
3988                 }
3989         }
3990
3991         keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
3992         if (keyring == -1) {
3993                 if (errno == ENOSYS)
3994                         log_unit_debug_errno(u, errno, "Kernel keyring not supported, ignoring.");
3995                 else if (ERRNO_IS_PRIVILEGE(errno))
3996                         log_unit_debug_errno(u, errno, "Kernel keyring access prohibited, ignoring.");
3997                 else if (errno == EDQUOT)
3998                         log_unit_debug_errno(u, errno, "Out of kernel keyrings to allocate, ignoring.");
3999                 else
4000                         r = log_unit_error_errno(u, errno, "Setting up kernel keyring failed: %m");
4001
4002                 goto out;
4003         }
4004
4005         /* When requested link the user keyring into the session keyring. */
4006         if (context->keyring_mode == EXEC_KEYRING_SHARED) {
4007
4008                 if (keyctl(KEYCTL_LINK,
4009                            KEY_SPEC_USER_KEYRING,
4010                            KEY_SPEC_SESSION_KEYRING, 0, 0) < 0) {
4011                         r = log_unit_error_errno(u, errno, "Failed to link user keyring into session keyring: %m");
4012                         goto out;
4013                 }
4014         }
4015
4016         /* Restore uid/gid back */
4017         if (uid_is_valid(uid) && uid != saved_uid) {
4018                 if (setreuid(saved_uid, -1) < 0) {
4019                         r = log_unit_error_errno(u, errno, "Failed to change UID back for user keyring: %m");
4020                         goto out;
4021                 }
4022         }
4023
4024         if (gid_is_valid(gid) && gid != saved_gid) {
4025                 if (setregid(saved_gid, -1) < 0)
4026                         return log_unit_error_errno(u, errno, "Failed to change GID back for user keyring: %m");
4027         }
4028
4029         /* Populate they keyring with the invocation ID by default, as original saved_uid. */
4030         if (!sd_id128_is_null(u->invocation_id)) {
4031                 key_serial_t key;
4032
4033                 key = add_key("user", "invocation_id", &u->invocation_id, sizeof(u->invocation_id), KEY_SPEC_SESSION_KEYRING);
4034                 if (key == -1)
4035                         log_unit_debug_errno(u, errno, "Failed to add invocation ID to keyring, ignoring: %m");
4036                 else {
4037                         if (keyctl(KEYCTL_SETPERM, key,
4038                                    KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH|
4039                                    KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0)
4040                                 r = log_unit_error_errno(u, errno, "Failed to restrict invocation ID permission: %m");
4041                 }
4042         }
4043
4044 out:
4045         /* Revert back uid & gid for the last time, and exit */
4046         /* no extra logging, as only the first already reported error matters */
4047         if (getuid() != saved_uid)
4048                 (void) setreuid(saved_uid, -1);
4049
4050         if (getgid() != saved_gid)
4051                 (void) setregid(saved_gid, -1);
4052
4053         return r;
4054 }
4055
4056 static void append_socket_pair(int *array, size_t *n, const int pair[static 2]) {
4057         assert(array);
4058         assert(n);
4059         assert(pair);
4060
4061         if (pair[0] >= 0)
4062                 array[(*n)++] = pair[0];
4063         if (pair[1] >= 0)
4064                 array[(*n)++] = pair[1];
4065 }
4066
4067 static int close_remaining_fds(
4068                 const ExecParameters *params,
4069                 const ExecRuntime *runtime,
4070                 int user_lookup_fd,
4071                 int socket_fd,
4072                 const int *fds, size_t n_fds) {
4073
4074         size_t n_dont_close = 0;
4075         int dont_close[n_fds + 12];
4076
4077         assert(params);
4078
4079         if (params->stdin_fd >= 0)
4080                 dont_close[n_dont_close++] = params->stdin_fd;
4081         if (params->stdout_fd >= 0)
4082                 dont_close[n_dont_close++] = params->stdout_fd;
4083         if (params->stderr_fd >= 0)
4084                 dont_close[n_dont_close++] = params->stderr_fd;
4085
4086         if (socket_fd >= 0)
4087                 dont_close[n_dont_close++] = socket_fd;
4088         if (n_fds > 0) {
4089                 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
4090                 n_dont_close += n_fds;
4091         }
4092
4093         if (runtime && runtime->shared) {
4094                 append_socket_pair(dont_close, &n_dont_close, runtime->shared->netns_storage_socket);
4095                 append_socket_pair(dont_close, &n_dont_close, runtime->shared->ipcns_storage_socket);
4096         }
4097
4098         if (runtime && runtime->dynamic_creds) {
4099                 if (runtime->dynamic_creds->user)
4100                         append_socket_pair(dont_close, &n_dont_close, runtime->dynamic_creds->user->storage_socket);
4101                 if (runtime->dynamic_creds->group)
4102                         append_socket_pair(dont_close, &n_dont_close, runtime->dynamic_creds->group->storage_socket);
4103         }
4104
4105         if (user_lookup_fd >= 0)
4106                 dont_close[n_dont_close++] = user_lookup_fd;
4107
4108         return close_all_fds(dont_close, n_dont_close);
4109 }
4110
4111 static int send_user_lookup(
4112                 Unit *unit,
4113                 int user_lookup_fd,
4114                 uid_t uid,
4115                 gid_t gid) {
4116
4117         assert(unit);
4118
4119         /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
4120          * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
4121          * specified. */
4122
4123         if (user_lookup_fd < 0)
4124                 return 0;
4125
4126         if (!uid_is_valid(uid) && !gid_is_valid(gid))
4127                 return 0;
4128
4129         if (writev(user_lookup_fd,
4130                (struct iovec[]) {
4131                            IOVEC_MAKE(&uid, sizeof(uid)),
4132                            IOVEC_MAKE(&gid, sizeof(gid)),
4133                            IOVEC_MAKE_STRING(unit->id) }, 3) < 0)
4134                 return -errno;
4135
4136         return 0;
4137 }
4138
4139 static int acquire_home(const ExecContext *c, uid_t uid, const char** home, char **buf) {
4140         int r;
4141
4142         assert(c);
4143         assert(home);
4144         assert(buf);
4145
4146         /* If WorkingDirectory=~ is set, try to acquire a usable home directory. */
4147
4148         if (*home)
4149                 return 0;
4150
4151         if (!c->working_directory_home)
4152                 return 0;
4153
4154         r = get_home_dir(buf);
4155         if (r < 0)
4156                 return r;
4157
4158         *home = *buf;
4159         return 1;
4160 }
4161
4162 static int compile_suggested_paths(const ExecContext *c, const ExecParameters *p, char ***ret) {
4163         _cleanup_strv_free_ char ** list = NULL;
4164         int r;
4165
4166         assert(c);
4167         assert(p);
4168         assert(ret);
4169
4170         assert(c->dynamic_user);
4171
4172         /* Compile a list of paths that it might make sense to read the owning UID from to use as initial candidate for
4173          * dynamic UID allocation, in order to save us from doing costly recursive chown()s of the special
4174          * directories. */
4175
4176         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
4177                 if (t == EXEC_DIRECTORY_CONFIGURATION)
4178                         continue;
4179
4180                 if (!p->prefix[t])
4181                         continue;
4182
4183                 for (size_t i = 0; i < c->directories[t].n_items; i++) {
4184                         char *e;
4185
4186                         if (exec_directory_is_private(c, t))
4187                                 e = path_join(p->prefix[t], "private", c->directories[t].items[i].path);
4188                         else
4189                                 e = path_join(p->prefix[t], c->directories[t].items[i].path);
4190                         if (!e)
4191                                 return -ENOMEM;
4192
4193                         r = strv_consume(&list, e);
4194                         if (r < 0)
4195                                 return r;
4196                 }
4197         }
4198
4199         *ret = TAKE_PTR(list);
4200
4201         return 0;
4202 }
4203
4204 static int exec_parameters_get_cgroup_path(
4205                 const ExecParameters *params,
4206                 const CGroupContext *c,
4207                 char **ret) {
4208
4209         const char *subgroup = NULL;
4210         char *p;
4211
4212         assert(params);
4213         assert(ret);
4214
4215         if (!params->cgroup_path)
4216                 return -EINVAL;
4217
4218         /* If we are called for a unit where cgroup delegation is on, and the payload created its own populated
4219          * subcgroup (which we expect it to do, after all it asked for delegation), then we cannot place the control
4220          * processes started after the main unit's process in the unit's main cgroup because it is now an inner one,
4221          * and inner cgroups may not contain processes. Hence, if delegation is on, and this is a control process,
4222          * let's use ".control" as subcgroup instead. Note that we do so only for ExecStartPost=, ExecReload=,
4223          * ExecStop=, ExecStopPost=, i.e. for the commands where the main process is already forked. For ExecStartPre=
4224          * this is not necessary, the cgroup is still empty. We distinguish these cases with the EXEC_CONTROL_CGROUP
4225          * flag, which is only passed for the former statements, not for the latter. */
4226
4227         if (FLAGS_SET(params->flags, EXEC_CGROUP_DELEGATE) && (FLAGS_SET(params->flags, EXEC_CONTROL_CGROUP) || c->delegate_subgroup)) {
4228                 if (FLAGS_SET(params->flags, EXEC_IS_CONTROL))
4229                         subgroup = ".control";
4230                 else
4231                         subgroup = c->delegate_subgroup;
4232         }
4233
4234         if (subgroup)
4235                 p = path_join(params->cgroup_path, subgroup);
4236         else
4237                 p = strdup(params->cgroup_path);
4238         if (!p)
4239                 return -ENOMEM;
4240
4241         *ret = p;
4242         return !!subgroup;
4243 }
4244
4245 static int exec_context_cpu_affinity_from_numa(const ExecContext *c, CPUSet *ret) {
4246         _cleanup_(cpu_set_reset) CPUSet s = {};
4247         int r;
4248
4249         assert(c);
4250         assert(ret);
4251
4252         if (!c->numa_policy.nodes.set) {
4253                 log_debug("Can't derive CPU affinity mask from NUMA mask because NUMA mask is not set, ignoring");
4254                 return 0;
4255         }
4256
4257         r = numa_to_cpu_set(&c->numa_policy, &s);
4258         if (r < 0)
4259                 return r;
4260
4261         cpu_set_reset(ret);
4262
4263         return cpu_set_add_all(ret, &s);
4264 }
4265
4266 bool exec_context_get_cpu_affinity_from_numa(const ExecContext *c) {
4267         assert(c);
4268
4269         return c->cpu_affinity_from_numa;
4270 }
4271
4272 static int add_shifted_fd(int *fds, size_t fds_size, size_t *n_fds, int fd, int *ret_fd) {
4273         int r;
4274
4275         assert(fds);
4276         assert(n_fds);
4277         assert(*n_fds < fds_size);
4278         assert(ret_fd);
4279
4280         if (fd < 0) {
4281                 *ret_fd = -EBADF;
4282                 return 0;
4283         }
4284
4285         if (fd < 3 + (int) *n_fds) {
4286                 /* Let's move the fd up, so that it's outside of the fd range we will use to store
4287                  * the fds we pass to the process (or which are closed only during execve). */
4288
4289                 r = fcntl(fd, F_DUPFD_CLOEXEC, 3 + (int) *n_fds);
4290                 if (r < 0)
4291                         return -errno;
4292
4293                 close_and_replace(fd, r);
4294         }
4295
4296         *ret_fd = fds[*n_fds] = fd;
4297         (*n_fds) ++;
4298         return 1;
4299 }
4300
4301 static int connect_unix_harder(Unit *u, const OpenFile *of, int ofd) {
4302         union sockaddr_union addr = {
4303                 .un.sun_family = AF_UNIX,
4304         };
4305         socklen_t sa_len;
4306         static const int socket_types[] = { SOCK_DGRAM, SOCK_STREAM, SOCK_SEQPACKET };
4307         int r;
4308
4309         assert(u);
4310         assert(of);
4311         assert(ofd >= 0);
4312
4313         r = sockaddr_un_set_path(&addr.un, FORMAT_PROC_FD_PATH(ofd));
4314         if (r < 0)
4315                 return log_unit_error_errno(u, r, "Failed to set sockaddr for %s: %m", of->path);
4316
4317         sa_len = r;
4318
4319         for (size_t i = 0; i < ELEMENTSOF(socket_types); i++) {
4320                 _cleanup_close_ int fd = -EBADF;
4321
4322                 fd = socket(AF_UNIX, socket_types[i] | SOCK_CLOEXEC, 0);
4323                 if (fd < 0)
4324                         return log_unit_error_errno(u, errno, "Failed to create socket for %s: %m", of->path);
4325
4326                 r = RET_NERRNO(connect(fd, &addr.sa, sa_len));
4327                 if (r == -EPROTOTYPE)
4328                         continue;
4329                 if (r < 0)
4330                         return log_unit_error_errno(u, r, "Failed to connect socket for %s: %m", of->path);
4331
4332                 return TAKE_FD(fd);
4333         }
4334
4335         return log_unit_error_errno(u, SYNTHETIC_ERRNO(EPROTOTYPE), "Failed to connect socket for \"%s\".", of->path);
4336 }
4337
4338 static int get_open_file_fd(Unit *u, const OpenFile *of) {
4339         struct stat st;
4340         _cleanup_close_ int fd = -EBADF, ofd = -EBADF;
4341
4342         assert(u);
4343         assert(of);
4344
4345         ofd = open(of->path, O_PATH | O_CLOEXEC);
4346         if (ofd < 0)
4347                 return log_unit_error_errno(u, errno, "Could not open \"%s\": %m", of->path);
4348
4349         if (fstat(ofd, &st) < 0)
4350                 return log_unit_error_errno(u, errno, "Failed to stat %s: %m", of->path);
4351
4352         if (S_ISSOCK(st.st_mode)) {
4353                 fd = connect_unix_harder(u, of, ofd);
4354                 if (fd < 0)
4355                         return fd;
4356
4357                 if (FLAGS_SET(of->flags, OPENFILE_READ_ONLY) && shutdown(fd, SHUT_WR) < 0)
4358                         return log_unit_error_errno(u, errno, "Failed to shutdown send for socket %s: %m",
4359                                                     of->path);
4360
4361                 log_unit_debug(u, "socket %s opened (fd=%d)", of->path, fd);
4362         } else {
4363                 int flags = FLAGS_SET(of->flags, OPENFILE_READ_ONLY) ? O_RDONLY : O_RDWR;
4364                 if (FLAGS_SET(of->flags, OPENFILE_APPEND))
4365                         flags |= O_APPEND;
4366                 else if (FLAGS_SET(of->flags, OPENFILE_TRUNCATE))
4367                         flags |= O_TRUNC;
4368
4369                 fd = fd_reopen(ofd, flags | O_CLOEXEC);
4370                 if (fd < 0)
4371                         return log_unit_error_errno(u, fd, "Failed to open file %s: %m", of->path);
4372
4373                 log_unit_debug(u, "file %s opened (fd=%d)", of->path, fd);
4374         }
4375
4376         return TAKE_FD(fd);
4377 }
4378
4379 static int collect_open_file_fds(
4380                 Unit *u,
4381                 OpenFile* open_files,
4382                 int **fds,
4383                 char ***fdnames,
4384                 size_t *n_fds) {
4385         int r;
4386
4387         assert(u);
4388         assert(fds);
4389         assert(fdnames);
4390         assert(n_fds);
4391
4392         LIST_FOREACH(open_files, of, open_files) {
4393                 _cleanup_close_ int fd = -EBADF;
4394
4395                 fd = get_open_file_fd(u, of);
4396                 if (fd < 0) {
4397                         if (FLAGS_SET(of->flags, OPENFILE_GRACEFUL)) {
4398                                 log_unit_debug_errno(u, fd, "Failed to get OpenFile= file descriptor for %s, ignoring: %m", of->path);
4399                                 continue;
4400                         }
4401
4402                         return fd;
4403                 }
4404
4405                 if (!GREEDY_REALLOC(*fds, *n_fds + 1))
4406                         return -ENOMEM;
4407
4408                 r = strv_extend(fdnames, of->fdname);
4409                 if (r < 0)
4410                         return r;
4411
4412                 (*fds)[*n_fds] = TAKE_FD(fd);
4413
4414                 (*n_fds)++;
4415         }
4416
4417         return 0;
4418 }
4419
4420 static void log_command_line(Unit *unit, const char *msg, const char *executable, char **argv) {
4421         assert(unit);
4422         assert(msg);
4423         assert(executable);
4424
4425         if (!DEBUG_LOGGING)
4426                 return;
4427
4428         _cleanup_free_ char *cmdline = quote_command_line(argv, SHELL_ESCAPE_EMPTY);
4429
4430         log_unit_struct(unit, LOG_DEBUG,
4431                         "EXECUTABLE=%s", executable,
4432                         LOG_UNIT_MESSAGE(unit, "%s: %s", msg, strnull(cmdline)),
4433                         LOG_UNIT_INVOCATION_ID(unit));
4434 }
4435
4436 static bool exec_context_need_unprivileged_private_users(const ExecContext *context, const Manager *manager) {
4437         assert(context);
4438         assert(manager);
4439
4440         /* These options require PrivateUsers= when used in user units, as we need to be in a user namespace
4441          * to have permission to enable them when not running as root. If we have effective CAP_SYS_ADMIN
4442          * (system manager) then we have privileges and don't need this. */
4443         if (MANAGER_IS_SYSTEM(manager))
4444                 return false;
4445
4446         return context->private_users ||
4447                context->private_tmp ||
4448                context->private_devices ||
4449                context->private_network ||
4450                context->network_namespace_path ||
4451                context->private_ipc ||
4452                context->ipc_namespace_path ||
4453                context->private_mounts ||
4454                context->mount_apivfs ||
4455                context->n_bind_mounts > 0 ||
4456                context->n_temporary_filesystems > 0 ||
4457                context->root_directory ||
4458                !strv_isempty(context->extension_directories) ||
4459                context->protect_system != PROTECT_SYSTEM_NO ||
4460                context->protect_home != PROTECT_HOME_NO ||
4461                context->protect_kernel_tunables ||
4462                context->protect_kernel_modules ||
4463                context->protect_kernel_logs ||
4464                context->protect_control_groups ||
4465                context->protect_clock ||
4466                context->protect_hostname ||
4467                !strv_isempty(context->read_write_paths) ||
4468                !strv_isempty(context->read_only_paths) ||
4469                !strv_isempty(context->inaccessible_paths) ||
4470                !strv_isempty(context->exec_paths) ||
4471                !strv_isempty(context->no_exec_paths);
4472 }
4473
4474 static int exec_child(
4475                 Unit *unit,
4476                 const ExecCommand *command,
4477                 const ExecContext *context,
4478                 const ExecParameters *params,
4479                 ExecRuntime *runtime,
4480                 const CGroupContext *cgroup_context,
4481                 int socket_fd,
4482                 const int named_iofds[static 3],
4483                 int *params_fds,
4484                 size_t n_socket_fds,
4485                 size_t n_storage_fds,
4486                 char **files_env,
4487                 int user_lookup_fd,
4488                 int *exit_status) {
4489
4490         _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **joined_exec_search_path = NULL, **accum_env = NULL, **replaced_argv = NULL;
4491         int r, ngids = 0, exec_fd;
4492         _cleanup_free_ gid_t *supplementary_gids = NULL;
4493         const char *username = NULL, *groupname = NULL;
4494         _cleanup_free_ char *home_buffer = NULL, *memory_pressure_path = NULL;
4495         const char *home = NULL, *shell = NULL;
4496         char **final_argv = NULL;
4497         dev_t journal_stream_dev = 0;
4498         ino_t journal_stream_ino = 0;
4499         bool userns_set_up = false;
4500         bool needs_sandboxing,          /* Do we need to set up full sandboxing? (i.e. all namespacing, all MAC stuff, caps, yadda yadda */
4501                 needs_setuid,           /* Do we need to do the actual setresuid()/setresgid() calls? */
4502                 needs_mount_namespace,  /* Do we need to set up a mount namespace for this kernel? */
4503                 needs_ambient_hack;     /* Do we need to apply the ambient capabilities hack? */
4504 #if HAVE_SELINUX
4505         _cleanup_free_ char *mac_selinux_context_net = NULL;
4506         bool use_selinux = false;
4507 #endif
4508 #if ENABLE_SMACK
4509         bool use_smack = false;
4510 #endif
4511 #if HAVE_APPARMOR
4512         bool use_apparmor = false;
4513 #endif
4514         uid_t saved_uid = getuid();
4515         gid_t saved_gid = getgid();
4516         uid_t uid = UID_INVALID;
4517         gid_t gid = GID_INVALID;
4518         size_t n_fds = n_socket_fds + n_storage_fds, /* fds to pass to the child */
4519                n_keep_fds; /* total number of fds not to close */
4520         int secure_bits;
4521         _cleanup_free_ gid_t *gids_after_pam = NULL;
4522         int ngids_after_pam = 0;
4523         _cleanup_free_ int *fds = NULL;
4524         _cleanup_strv_free_ char **fdnames = NULL;
4525
4526         assert(unit);
4527         assert(command);
4528         assert(context);
4529         assert(params);
4530         assert(exit_status);
4531
4532         /* Explicitly test for CVE-2021-4034 inspired invocations */
4533         assert(command->path);
4534         assert(!strv_isempty(command->argv));
4535
4536         rename_process_from_path(command->path);
4537
4538         /* We reset exactly these signals, since they are the only ones we set to SIG_IGN in the main
4539          * daemon. All others we leave untouched because we set them to SIG_DFL or a valid handler initially,
4540          * both of which will be demoted to SIG_DFL. */
4541         (void) default_signals(SIGNALS_CRASH_HANDLER,
4542                                SIGNALS_IGNORE);
4543
4544         if (context->ignore_sigpipe)
4545                 (void) ignore_signals(SIGPIPE);
4546
4547         r = reset_signal_mask();
4548         if (r < 0) {
4549                 *exit_status = EXIT_SIGNAL_MASK;
4550                 return log_unit_error_errno(unit, r, "Failed to set process signal mask: %m");
4551         }
4552
4553         if (params->idle_pipe)
4554                 do_idle_pipe_dance(params->idle_pipe);
4555
4556         /* Close fds we don't need very early to make sure we don't block init reexecution because it cannot bind its
4557          * sockets. Among the fds we close are the logging fds, and we want to keep them closed, so that we don't have
4558          * any fds open we don't really want open during the transition. In order to make logging work, we switch the
4559          * log subsystem into open_when_needed mode, so that it reopens the logs on every single log call. */
4560
4561         log_forget_fds();
4562         log_set_open_when_needed(true);
4563         log_settle_target();
4564
4565         /* In case anything used libc syslog(), close this here, too */
4566         closelog();
4567
4568         fds = newdup(int, params_fds, n_fds);
4569         if (!fds) {
4570                 *exit_status = EXIT_MEMORY;
4571                 return log_oom();
4572         }
4573
4574         fdnames = strv_copy((char**) params->fd_names);
4575         if (!fdnames) {
4576                 *exit_status = EXIT_MEMORY;
4577                 return log_oom();
4578         }
4579
4580         r = collect_open_file_fds(unit, params->open_files, &fds, &fdnames, &n_fds);
4581         if (r < 0) {
4582                 *exit_status = EXIT_FDS;
4583                 return log_unit_error_errno(unit, r, "Failed to get OpenFile= file descriptors: %m");
4584         }
4585
4586         int keep_fds[n_fds + 3];
4587         memcpy_safe(keep_fds, fds, n_fds * sizeof(int));
4588         n_keep_fds = n_fds;
4589
4590         r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, params->exec_fd, &exec_fd);
4591         if (r < 0) {
4592                 *exit_status = EXIT_FDS;
4593                 return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m");
4594         }
4595
4596 #if HAVE_LIBBPF
4597         if (unit->manager->restrict_fs) {
4598                 int bpf_map_fd = lsm_bpf_map_restrict_fs_fd(unit);
4599                 if (bpf_map_fd < 0) {
4600                         *exit_status = EXIT_FDS;
4601                         return log_unit_error_errno(unit, bpf_map_fd, "Failed to get restrict filesystems BPF map fd: %m");
4602                 }
4603
4604                 r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, bpf_map_fd, &bpf_map_fd);
4605                 if (r < 0) {
4606                         *exit_status = EXIT_FDS;
4607                         return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m");
4608                 }
4609         }
4610 #endif
4611
4612         r = close_remaining_fds(params, runtime, user_lookup_fd, socket_fd, keep_fds, n_keep_fds);
4613         if (r < 0) {
4614                 *exit_status = EXIT_FDS;
4615                 return log_unit_error_errno(unit, r, "Failed to close unwanted file descriptors: %m");
4616         }
4617
4618         if (!context->same_pgrp &&
4619             setsid() < 0) {
4620                 *exit_status = EXIT_SETSID;
4621                 return log_unit_error_errno(unit, errno, "Failed to create new process session: %m");
4622         }
4623
4624         exec_context_tty_reset(context, params);
4625
4626         if (unit_shall_confirm_spawn(unit)) {
4627                 _cleanup_free_ char *cmdline = NULL;
4628
4629                 cmdline = quote_command_line(command->argv, SHELL_ESCAPE_EMPTY);
4630                 if (!cmdline) {
4631                         *exit_status = EXIT_MEMORY;
4632                         return log_oom();
4633                 }
4634
4635                 r = ask_for_confirmation(context, params->confirm_spawn, unit, cmdline);
4636                 if (r != CONFIRM_EXECUTE) {
4637                         if (r == CONFIRM_PRETEND_SUCCESS) {
4638                                 *exit_status = EXIT_SUCCESS;
4639                                 return 0;
4640                         }
4641                         *exit_status = EXIT_CONFIRM;
4642                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ECANCELED),
4643                                                     "Execution cancelled by the user");
4644                 }
4645         }
4646
4647         /* We are about to invoke NSS and PAM modules. Let's tell them what we are doing here, maybe they care. This is
4648          * used by nss-resolve to disable itself when we are about to start systemd-resolved, to avoid deadlocks. Note
4649          * that these env vars do not survive the execve(), which means they really only apply to the PAM and NSS
4650          * invocations themselves. Also note that while we'll only invoke NSS modules involved in user management they
4651          * might internally call into other NSS modules that are involved in hostname resolution, we never know. */
4652         if (setenv("SYSTEMD_ACTIVATION_UNIT", unit->id, true) != 0 ||
4653             setenv("SYSTEMD_ACTIVATION_SCOPE", runtime_scope_to_string(unit->manager->runtime_scope), true) != 0) {
4654                 *exit_status = EXIT_MEMORY;
4655                 return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
4656         }
4657
4658         if (context->dynamic_user && runtime && runtime->dynamic_creds) {
4659                 _cleanup_strv_free_ char **suggested_paths = NULL;
4660
4661                 /* On top of that, make sure we bypass our own NSS module nss-systemd comprehensively for any NSS
4662                  * checks, if DynamicUser=1 is used, as we shouldn't create a feedback loop with ourselves here. */
4663                 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
4664                         *exit_status = EXIT_USER;
4665                         return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
4666                 }
4667
4668                 r = compile_suggested_paths(context, params, &suggested_paths);
4669                 if (r < 0) {
4670                         *exit_status = EXIT_MEMORY;
4671                         return log_oom();
4672                 }
4673
4674                 r = dynamic_creds_realize(runtime->dynamic_creds, suggested_paths, &uid, &gid);
4675                 if (r < 0) {
4676                         *exit_status = EXIT_USER;
4677                         if (r == -EILSEQ)
4678                                 return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP),
4679                                                             "Failed to update dynamic user credentials: User or group with specified name already exists.");
4680                         return log_unit_error_errno(unit, r, "Failed to update dynamic user credentials: %m");
4681                 }
4682
4683                 if (!uid_is_valid(uid)) {
4684                         *exit_status = EXIT_USER;
4685                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ESRCH), "UID validation failed for \""UID_FMT"\"", uid);
4686                 }
4687
4688                 if (!gid_is_valid(gid)) {
4689                         *exit_status = EXIT_USER;
4690                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ESRCH), "GID validation failed for \""GID_FMT"\"", gid);
4691                 }
4692
4693                 if (runtime->dynamic_creds->user)
4694                         username = runtime->dynamic_creds->user->name;
4695
4696         } else {
4697                 r = get_fixed_user(context, &username, &uid, &gid, &home, &shell);
4698                 if (r < 0) {
4699                         *exit_status = EXIT_USER;
4700                         return log_unit_error_errno(unit, r, "Failed to determine user credentials: %m");
4701                 }
4702
4703                 r = get_fixed_group(context, &groupname, &gid);
4704                 if (r < 0) {
4705                         *exit_status = EXIT_GROUP;
4706                         return log_unit_error_errno(unit, r, "Failed to determine group credentials: %m");
4707                 }
4708         }
4709
4710         /* Initialize user supplementary groups and get SupplementaryGroups= ones */
4711         r = get_supplementary_groups(context, username, groupname, gid,
4712                                      &supplementary_gids, &ngids);
4713         if (r < 0) {
4714                 *exit_status = EXIT_GROUP;
4715                 return log_unit_error_errno(unit, r, "Failed to determine supplementary groups: %m");
4716         }
4717
4718         r = send_user_lookup(unit, user_lookup_fd, uid, gid);
4719         if (r < 0) {
4720                 *exit_status = EXIT_USER;
4721                 return log_unit_error_errno(unit, r, "Failed to send user credentials to PID1: %m");
4722         }
4723
4724         user_lookup_fd = safe_close(user_lookup_fd);
4725
4726         r = acquire_home(context, uid, &home, &home_buffer);
4727         if (r < 0) {
4728                 *exit_status = EXIT_CHDIR;
4729                 return log_unit_error_errno(unit, r, "Failed to determine $HOME for user: %m");
4730         }
4731
4732         /* If a socket is connected to STDIN/STDOUT/STDERR, we must drop O_NONBLOCK */
4733         if (socket_fd >= 0)
4734                 (void) fd_nonblock(socket_fd, false);
4735
4736         /* Journald will try to look-up our cgroup in order to populate _SYSTEMD_CGROUP and _SYSTEMD_UNIT fields.
4737          * Hence we need to migrate to the target cgroup from init.scope before connecting to journald */
4738         if (params->cgroup_path) {
4739                 _cleanup_free_ char *p = NULL;
4740
4741                 r = exec_parameters_get_cgroup_path(params, cgroup_context, &p);
4742                 if (r < 0) {
4743                         *exit_status = EXIT_CGROUP;
4744                         return log_unit_error_errno(unit, r, "Failed to acquire cgroup path: %m");
4745                 }
4746
4747                 r = cg_attach_everywhere(params->cgroup_supported, p, 0, NULL, NULL);
4748                 if (r == -EUCLEAN) {
4749                         *exit_status = EXIT_CGROUP;
4750                         return log_unit_error_errno(unit, r, "Failed to attach process to cgroup %s "
4751                                                     "because the cgroup or one of its parents or "
4752                                                     "siblings is in the threaded mode: %m", p);
4753                 }
4754                 if (r < 0) {
4755                         *exit_status = EXIT_CGROUP;
4756                         return log_unit_error_errno(unit, r, "Failed to attach to cgroup %s: %m", p);
4757                 }
4758         }
4759
4760         if (context->network_namespace_path && runtime && runtime->shared && runtime->shared->netns_storage_socket[0] >= 0) {
4761                 r = open_shareable_ns_path(runtime->shared->netns_storage_socket, context->network_namespace_path, CLONE_NEWNET);
4762                 if (r < 0) {
4763                         *exit_status = EXIT_NETWORK;
4764                         return log_unit_error_errno(unit, r, "Failed to open network namespace path %s: %m", context->network_namespace_path);
4765                 }
4766         }
4767
4768         if (context->ipc_namespace_path && runtime && runtime->shared && runtime->shared->ipcns_storage_socket[0] >= 0) {
4769                 r = open_shareable_ns_path(runtime->shared->ipcns_storage_socket, context->ipc_namespace_path, CLONE_NEWIPC);
4770                 if (r < 0) {
4771                         *exit_status = EXIT_NAMESPACE;
4772                         return log_unit_error_errno(unit, r, "Failed to open IPC namespace path %s: %m", context->ipc_namespace_path);
4773                 }
4774         }
4775
4776         r = setup_input(context, params, socket_fd, named_iofds);
4777         if (r < 0) {
4778                 *exit_status = EXIT_STDIN;
4779                 return log_unit_error_errno(unit, r, "Failed to set up standard input: %m");
4780         }
4781
4782         r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
4783         if (r < 0) {
4784                 *exit_status = EXIT_STDOUT;
4785                 return log_unit_error_errno(unit, r, "Failed to set up standard output: %m");
4786         }
4787
4788         r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
4789         if (r < 0) {
4790                 *exit_status = EXIT_STDERR;
4791                 return log_unit_error_errno(unit, r, "Failed to set up standard error output: %m");
4792         }
4793
4794         if (context->oom_score_adjust_set) {
4795                 /* When we can't make this change due to EPERM, then let's silently skip over it. User namespaces
4796                  * prohibit write access to this file, and we shouldn't trip up over that. */
4797                 r = set_oom_score_adjust(context->oom_score_adjust);
4798                 if (ERRNO_IS_PRIVILEGE(r))
4799                         log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
4800                 else if (r < 0) {
4801                         *exit_status = EXIT_OOM_ADJUST;
4802                         return log_unit_error_errno(unit, r, "Failed to adjust OOM setting: %m");
4803                 }
4804         }
4805
4806         if (context->coredump_filter_set) {
4807                 r = set_coredump_filter(context->coredump_filter);
4808                 if (ERRNO_IS_PRIVILEGE(r))
4809                         log_unit_debug_errno(unit, r, "Failed to adjust coredump_filter, ignoring: %m");
4810                 else if (r < 0)
4811                         return log_unit_error_errno(unit, r, "Failed to adjust coredump_filter: %m");
4812         }
4813
4814         if (context->nice_set) {
4815                 r = setpriority_closest(context->nice);
4816                 if (r < 0)
4817                         return log_unit_error_errno(unit, r, "Failed to set up process scheduling priority (nice level): %m");
4818         }
4819
4820         if (context->cpu_sched_set) {
4821                 struct sched_param param = {
4822                         .sched_priority = context->cpu_sched_priority,
4823                 };
4824
4825                 r = sched_setscheduler(0,
4826                                        context->cpu_sched_policy |
4827                                        (context->cpu_sched_reset_on_fork ?
4828                                         SCHED_RESET_ON_FORK : 0),
4829                                        &param);
4830                 if (r < 0) {
4831                         *exit_status = EXIT_SETSCHEDULER;
4832                         return log_unit_error_errno(unit, errno, "Failed to set up CPU scheduling: %m");
4833                 }
4834         }
4835
4836         if (context->cpu_affinity_from_numa || context->cpu_set.set) {
4837                 _cleanup_(cpu_set_reset) CPUSet converted_cpu_set = {};
4838                 const CPUSet *cpu_set;
4839
4840                 if (context->cpu_affinity_from_numa) {
4841                         r = exec_context_cpu_affinity_from_numa(context, &converted_cpu_set);
4842                         if (r < 0) {
4843                                 *exit_status = EXIT_CPUAFFINITY;
4844                                 return log_unit_error_errno(unit, r, "Failed to derive CPU affinity mask from NUMA mask: %m");
4845                         }
4846
4847                         cpu_set = &converted_cpu_set;
4848                 } else
4849                         cpu_set = &context->cpu_set;
4850
4851                 if (sched_setaffinity(0, cpu_set->allocated, cpu_set->set) < 0) {
4852                         *exit_status = EXIT_CPUAFFINITY;
4853                         return log_unit_error_errno(unit, errno, "Failed to set up CPU affinity: %m");
4854                 }
4855         }
4856
4857         if (mpol_is_valid(numa_policy_get_type(&context->numa_policy))) {
4858                 r = apply_numa_policy(&context->numa_policy);
4859                 if (r < 0) {
4860                         if (ERRNO_IS_NOT_SUPPORTED(r))
4861                                 log_unit_debug_errno(unit, r, "NUMA support not available, ignoring.");
4862                         else {
4863                                 *exit_status = EXIT_NUMA_POLICY;
4864                                 return log_unit_error_errno(unit, r, "Failed to set NUMA memory policy: %m");
4865                         }
4866                 }
4867         }
4868
4869         if (context->ioprio_set)
4870                 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
4871                         *exit_status = EXIT_IOPRIO;
4872                         return log_unit_error_errno(unit, errno, "Failed to set up IO scheduling priority: %m");
4873                 }
4874
4875         if (context->timer_slack_nsec != NSEC_INFINITY)
4876                 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
4877                         *exit_status = EXIT_TIMERSLACK;
4878                         return log_unit_error_errno(unit, errno, "Failed to set up timer slack: %m");
4879                 }
4880
4881         if (context->personality != PERSONALITY_INVALID) {
4882                 r = safe_personality(context->personality);
4883                 if (r < 0) {
4884                         *exit_status = EXIT_PERSONALITY;
4885                         return log_unit_error_errno(unit, r, "Failed to set up execution domain (personality): %m");
4886                 }
4887         }
4888
4889         if (context->utmp_id) {
4890                 const char *line = context->tty_path ?
4891                         (path_startswith(context->tty_path, "/dev/") ?: context->tty_path) :
4892                         NULL;
4893                 utmp_put_init_process(context->utmp_id, getpid_cached(), getsid(0),
4894                                       line,
4895                                       context->utmp_mode == EXEC_UTMP_INIT  ? INIT_PROCESS :
4896                                       context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
4897                                       USER_PROCESS,
4898                                       username);
4899         }
4900
4901         if (uid_is_valid(uid)) {
4902                 r = chown_terminal(STDIN_FILENO, uid);
4903                 if (r < 0) {
4904                         *exit_status = EXIT_STDIN;
4905                         return log_unit_error_errno(unit, r, "Failed to change ownership of terminal: %m");
4906                 }
4907         }
4908
4909         if (params->cgroup_path) {
4910                 /* If delegation is enabled we'll pass ownership of the cgroup to the user of the new process. On cgroup v1
4911                  * this is only about systemd's own hierarchy, i.e. not the controller hierarchies, simply because that's not
4912                  * safe. On cgroup v2 there's only one hierarchy anyway, and delegation is safe there, hence in that case only
4913                  * touch a single hierarchy too. */
4914
4915                 if (params->flags & EXEC_CGROUP_DELEGATE) {
4916                         _cleanup_free_ char *p = NULL;
4917
4918                         r = cg_set_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, uid, gid);
4919                         if (r < 0) {
4920                                 *exit_status = EXIT_CGROUP;
4921                                 return log_unit_error_errno(unit, r, "Failed to adjust control group access: %m");
4922                         }
4923
4924                         r = exec_parameters_get_cgroup_path(params, cgroup_context, &p);
4925                         if (r < 0) {
4926                                 *exit_status = EXIT_CGROUP;
4927                                 return log_unit_error_errno(unit, r, "Failed to acquire cgroup path: %m");
4928                         }
4929                         if (r > 0) {
4930                                 r = cg_set_access_recursive(SYSTEMD_CGROUP_CONTROLLER, p, uid, gid);
4931                                 if (r < 0) {
4932                                         *exit_status = EXIT_CGROUP;
4933                                         return log_unit_error_errno(unit, r, "Failed to adjust control subgroup access: %m");
4934                                 }
4935                         }
4936                 }
4937
4938                 if (cgroup_context && cg_unified() > 0 && is_pressure_supported() > 0) {
4939                         if (cgroup_context_want_memory_pressure(cgroup_context)) {
4940                                 r = cg_get_path("memory", params->cgroup_path, "memory.pressure", &memory_pressure_path);
4941                                 if (r < 0) {
4942                                         *exit_status = EXIT_MEMORY;
4943                                         return log_oom();
4944                                 }
4945
4946                                 r = chmod_and_chown(memory_pressure_path, 0644, uid, gid);
4947                                 if (r < 0) {
4948                                         log_unit_full_errno(unit, r == -ENOENT || ERRNO_IS_PRIVILEGE(r) ? LOG_DEBUG : LOG_WARNING, r,
4949                                                             "Failed to adjust ownership of '%s', ignoring: %m", memory_pressure_path);
4950                                         memory_pressure_path = mfree(memory_pressure_path);
4951                                 }
4952                         } else if (cgroup_context->memory_pressure_watch == CGROUP_PRESSURE_WATCH_OFF) {
4953                                 memory_pressure_path = strdup("/dev/null"); /* /dev/null is explicit indicator for turning of memory pressure watch */
4954                                 if (!memory_pressure_path) {
4955                                         *exit_status = EXIT_MEMORY;
4956                                         return log_oom();
4957                                 }
4958                         }
4959                 }
4960         }
4961
4962         needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
4963
4964         for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
4965                 r = setup_exec_directory(context, params, uid, gid, dt, needs_mount_namespace, exit_status);
4966                 if (r < 0)
4967                         return log_unit_error_errno(unit, r, "Failed to set up special execution directory in %s: %m", params->prefix[dt]);
4968         }
4969
4970         if (FLAGS_SET(params->flags, EXEC_WRITE_CREDENTIALS)) {
4971                 r = setup_credentials(context, params, unit->id, uid);
4972                 if (r < 0) {
4973                         *exit_status = EXIT_CREDENTIALS;
4974                         return log_unit_error_errno(unit, r, "Failed to set up credentials: %m");
4975                 }
4976         }
4977
4978         r = build_environment(
4979                         unit,
4980                         context,
4981                         params,
4982                         cgroup_context,
4983                         n_fds,
4984                         fdnames,
4985                         home,
4986                         username,
4987                         shell,
4988                         journal_stream_dev,
4989                         journal_stream_ino,
4990                         memory_pressure_path,
4991                         &our_env);
4992         if (r < 0) {
4993                 *exit_status = EXIT_MEMORY;
4994                 return log_oom();
4995         }
4996
4997         r = build_pass_environment(context, &pass_env);
4998         if (r < 0) {
4999                 *exit_status = EXIT_MEMORY;
5000                 return log_oom();
5001         }
5002
5003         /* The $PATH variable is set to the default path in params->environment. However, this is overridden
5004          * if user-specified fields have $PATH set. The intention is to also override $PATH if the unit does
5005          * not specify PATH but the unit has ExecSearchPath. */
5006         if (!strv_isempty(context->exec_search_path)) {
5007                 _cleanup_free_ char *joined = NULL;
5008
5009                 joined = strv_join(context->exec_search_path, ":");
5010                 if (!joined) {
5011                         *exit_status = EXIT_MEMORY;
5012                         return log_oom();
5013                 }
5014
5015                 r = strv_env_assign(&joined_exec_search_path, "PATH", joined);
5016                 if (r < 0) {
5017                         *exit_status = EXIT_MEMORY;
5018                         return log_oom();
5019                 }
5020         }
5021
5022         accum_env = strv_env_merge(params->environment,
5023                                    our_env,
5024                                    joined_exec_search_path,
5025                                    pass_env,
5026                                    context->environment,
5027                                    files_env);
5028         if (!accum_env) {
5029                 *exit_status = EXIT_MEMORY;
5030                 return log_oom();
5031         }
5032         accum_env = strv_env_clean(accum_env);
5033
5034         (void) umask(context->umask);
5035
5036         r = setup_keyring(unit, context, params, uid, gid);
5037         if (r < 0) {
5038                 *exit_status = EXIT_KEYRING;
5039                 return log_unit_error_errno(unit, r, "Failed to set up kernel keyring: %m");
5040         }
5041
5042         /* We need sandboxing if the caller asked us to apply it and the command isn't explicitly excepted
5043          * from it. */
5044         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
5045
5046         /* We need the ambient capability hack, if the caller asked us to apply it and the command is marked
5047          * for it, and the kernel doesn't actually support ambient caps. */
5048         needs_ambient_hack = (params->flags & EXEC_APPLY_SANDBOXING) && (command->flags & EXEC_COMMAND_AMBIENT_MAGIC) && !ambient_capabilities_supported();
5049
5050         /* We need setresuid() if the caller asked us to apply sandboxing and the command isn't explicitly
5051          * excepted from either whole sandboxing or just setresuid() itself, and the ambient hack is not
5052          * desired. */
5053         if (needs_ambient_hack)
5054                 needs_setuid = false;
5055         else
5056                 needs_setuid = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & (EXEC_COMMAND_FULLY_PRIVILEGED|EXEC_COMMAND_NO_SETUID));
5057
5058         uint64_t capability_ambient_set = context->capability_ambient_set;
5059
5060         if (needs_sandboxing) {
5061                 /* MAC enablement checks need to be done before a new mount ns is created, as they rely on
5062                  * /sys being present. The actual MAC context application will happen later, as late as
5063                  * possible, to avoid impacting our own code paths. */
5064
5065 #if HAVE_SELINUX
5066                 use_selinux = mac_selinux_use();
5067 #endif
5068 #if ENABLE_SMACK
5069                 use_smack = mac_smack_use();
5070 #endif
5071 #if HAVE_APPARMOR
5072                 use_apparmor = mac_apparmor_use();
5073 #endif
5074         }
5075
5076         if (needs_sandboxing) {
5077                 int which_failed;
5078
5079                 /* Let's set the resource limits before we call into PAM, so that pam_limits wins over what
5080                  * is set here. (See below.) */
5081
5082                 r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
5083                 if (r < 0) {
5084                         *exit_status = EXIT_LIMITS;
5085                         return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
5086                 }
5087         }
5088
5089         if (needs_setuid && context->pam_name && username) {
5090                 /* Let's call into PAM after we set up our own idea of resource limits to that pam_limits
5091                  * wins here. (See above.) */
5092
5093                 /* All fds passed in the fds array will be closed in the pam child process. */
5094                 r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
5095                 if (r < 0) {
5096                         *exit_status = EXIT_PAM;
5097                         return log_unit_error_errno(unit, r, "Failed to set up PAM session: %m");
5098                 }
5099
5100                 if (ambient_capabilities_supported()) {
5101                         uint64_t ambient_after_pam;
5102
5103                         /* PAM modules might have set some ambient caps. Query them here and merge them into
5104                          * the caps we want to set in the end, so that we don't end up unsetting them. */
5105                         r = capability_get_ambient(&ambient_after_pam);
5106                         if (r < 0) {
5107                                 *exit_status = EXIT_CAPABILITIES;
5108                                 return log_unit_error_errno(unit, r, "Failed to query ambient caps: %m");
5109                         }
5110
5111                         capability_ambient_set |= ambient_after_pam;
5112                 }
5113
5114                 ngids_after_pam = getgroups_alloc(&gids_after_pam);
5115                 if (ngids_after_pam < 0) {
5116                         *exit_status = EXIT_MEMORY;
5117                         return log_unit_error_errno(unit, ngids_after_pam, "Failed to obtain groups after setting up PAM: %m");
5118                 }
5119         }
5120
5121         if (needs_sandboxing && exec_context_need_unprivileged_private_users(context, unit->manager)) {
5122                 /* If we're unprivileged, set up the user namespace first to enable use of the other namespaces.
5123                  * Users with CAP_SYS_ADMIN can set up user namespaces last because they will be able to
5124                  * set up the all of the other namespaces (i.e. network, mount, UTS) without a user namespace. */
5125
5126                 r = setup_private_users(saved_uid, saved_gid, uid, gid);
5127                 /* If it was requested explicitly and we can't set it up, fail early. Otherwise, continue and let
5128                  * the actual requested operations fail (or silently continue). */
5129                 if (r < 0 && context->private_users) {
5130                         *exit_status = EXIT_USER;
5131                         return log_unit_error_errno(unit, r, "Failed to set up user namespacing for unprivileged user: %m");
5132                 }
5133                 if (r < 0)
5134                         log_unit_info_errno(unit, r, "Failed to set up user namespacing for unprivileged user, ignoring: %m");
5135                 else
5136                         userns_set_up = true;
5137         }
5138
5139         if (exec_needs_network_namespace(context) && runtime && runtime->shared && runtime->shared->netns_storage_socket[0] >= 0) {
5140
5141                 if (ns_type_supported(NAMESPACE_NET)) {
5142                         r = setup_shareable_ns(runtime->shared->netns_storage_socket, CLONE_NEWNET);
5143                         if (r < 0) {
5144                                 if (ERRNO_IS_PRIVILEGE(r))
5145                                         log_unit_warning_errno(unit, r,
5146                                                                "PrivateNetwork=yes is configured, but network namespace setup failed, ignoring: %m");
5147                                 else {
5148                                         *exit_status = EXIT_NETWORK;
5149                                         return log_unit_error_errno(unit, r, "Failed to set up network namespacing: %m");
5150                                 }
5151                         }
5152                 } else if (context->network_namespace_path) {
5153                         *exit_status = EXIT_NETWORK;
5154                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP),
5155                                                     "NetworkNamespacePath= is not supported, refusing.");
5156                 } else
5157                         log_unit_warning(unit, "PrivateNetwork=yes is configured, but the kernel does not support network namespaces, ignoring.");
5158         }
5159
5160         if (exec_needs_ipc_namespace(context) && runtime && runtime->shared && runtime->shared->ipcns_storage_socket[0] >= 0) {
5161
5162                 if (ns_type_supported(NAMESPACE_IPC)) {
5163                         r = setup_shareable_ns(runtime->shared->ipcns_storage_socket, CLONE_NEWIPC);
5164                         if (r == -EPERM)
5165                                 log_unit_warning_errno(unit, r,
5166                                                        "PrivateIPC=yes is configured, but IPC namespace setup failed, ignoring: %m");
5167                         else if (r < 0) {
5168                                 *exit_status = EXIT_NAMESPACE;
5169                                 return log_unit_error_errno(unit, r, "Failed to set up IPC namespacing: %m");
5170                         }
5171                 } else if (context->ipc_namespace_path) {
5172                         *exit_status = EXIT_NAMESPACE;
5173                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP),
5174                                                     "IPCNamespacePath= is not supported, refusing.");
5175                 } else
5176                         log_unit_warning(unit, "PrivateIPC=yes is configured, but the kernel does not support IPC namespaces, ignoring.");
5177         }
5178
5179         if (needs_mount_namespace) {
5180                 _cleanup_free_ char *error_path = NULL;
5181
5182                 r = apply_mount_namespace(unit, command->flags, context, params, runtime, memory_pressure_path, &error_path);
5183                 if (r < 0) {
5184                         *exit_status = EXIT_NAMESPACE;
5185                         return log_unit_error_errno(unit, r, "Failed to set up mount namespacing%s%s: %m",
5186                                                     error_path ? ": " : "", strempty(error_path));
5187                 }
5188         }
5189
5190         if (needs_sandboxing) {
5191                 r = apply_protect_hostname(unit, context, exit_status);
5192                 if (r < 0)
5193                         return r;
5194         }
5195
5196         if (context->memory_ksm >= 0)
5197                 if (prctl(PR_SET_MEMORY_MERGE, context->memory_ksm) < 0) {
5198                         if (ERRNO_IS_NOT_SUPPORTED(errno))
5199                                 log_unit_debug_errno(unit, errno, "KSM support not available, ignoring.");
5200                         else {
5201                                 *exit_status = EXIT_KSM;
5202                                 return log_unit_error_errno(unit, errno, "Failed to set KSM: %m");
5203                         }
5204                 }
5205
5206         /* Drop groups as early as possible.
5207          * This needs to be done after PrivateDevices=y setup as device nodes should be owned by the host's root.
5208          * For non-root in a userns, devices will be owned by the user/group before the group change, and nobody. */
5209         if (needs_setuid) {
5210                 _cleanup_free_ gid_t *gids_to_enforce = NULL;
5211                 int ngids_to_enforce = 0;
5212
5213                 ngids_to_enforce = merge_gid_lists(supplementary_gids,
5214                                                    ngids,
5215                                                    gids_after_pam,
5216                                                    ngids_after_pam,
5217                                                    &gids_to_enforce);
5218                 if (ngids_to_enforce < 0) {
5219                         *exit_status = EXIT_MEMORY;
5220                         return log_unit_error_errno(unit,
5221                                                     ngids_to_enforce,
5222                                                     "Failed to merge group lists. Group membership might be incorrect: %m");
5223                 }
5224
5225                 r = enforce_groups(gid, gids_to_enforce, ngids_to_enforce);
5226                 if (r < 0) {
5227                         *exit_status = EXIT_GROUP;
5228                         return log_unit_error_errno(unit, r, "Changing group credentials failed: %m");
5229                 }
5230         }
5231
5232         /* If the user namespace was not set up above, try to do it now.
5233          * It's preferred to set up the user namespace later (after all other namespaces) so as not to be
5234          * restricted by rules pertaining to combining user namespaces with other namespaces (e.g. in the
5235          * case of mount namespaces being less privileged when the mount point list is copied from a
5236          * different user namespace). */
5237
5238         if (needs_sandboxing && context->private_users && !userns_set_up) {
5239                 r = setup_private_users(saved_uid, saved_gid, uid, gid);
5240                 if (r < 0) {
5241                         *exit_status = EXIT_USER;
5242                         return log_unit_error_errno(unit, r, "Failed to set up user namespacing: %m");
5243                 }
5244         }
5245
5246         /* Now that the mount namespace has been set up and privileges adjusted, let's look for the thing we
5247          * shall execute. */
5248
5249         _cleanup_free_ char *executable = NULL;
5250         _cleanup_close_ int executable_fd = -EBADF;
5251         r = find_executable_full(command->path, /* root= */ NULL, context->exec_search_path, false, &executable, &executable_fd);
5252         if (r < 0) {
5253                 if (r != -ENOMEM && (command->flags & EXEC_COMMAND_IGNORE_FAILURE)) {
5254                         log_unit_struct_errno(unit, LOG_INFO, r,
5255                                               "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
5256                                               LOG_UNIT_INVOCATION_ID(unit),
5257                                               LOG_UNIT_MESSAGE(unit, "Executable %s missing, skipping: %m",
5258                                                                command->path),
5259                                               "EXECUTABLE=%s", command->path);
5260                         return 0;
5261                 }
5262
5263                 *exit_status = EXIT_EXEC;
5264
5265                 return log_unit_struct_errno(unit, LOG_INFO, r,
5266                                              "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
5267                                              LOG_UNIT_INVOCATION_ID(unit),
5268                                              LOG_UNIT_MESSAGE(unit, "Failed to locate executable %s: %m",
5269                                                               command->path),
5270                                              "EXECUTABLE=%s", command->path);
5271         }
5272
5273         r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, executable_fd, &executable_fd);
5274         if (r < 0) {
5275                 *exit_status = EXIT_FDS;
5276                 return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m");
5277         }
5278
5279 #if HAVE_SELINUX
5280         if (needs_sandboxing && use_selinux && params->selinux_context_net) {
5281                 int fd = -EBADF;
5282
5283                 if (socket_fd >= 0)
5284                         fd = socket_fd;
5285                 else if (params->n_socket_fds == 1)
5286                         /* If stdin is not connected to a socket but we are triggered by exactly one socket unit then we
5287                          * use context from that fd to compute the label. */
5288                         fd = params->fds[0];
5289
5290                 if (fd >= 0) {
5291                         r = mac_selinux_get_child_mls_label(fd, executable, context->selinux_context, &mac_selinux_context_net);
5292                         if (r < 0) {
5293                                 if (!context->selinux_context_ignore) {
5294                                         *exit_status = EXIT_SELINUX_CONTEXT;
5295                                         return log_unit_error_errno(unit, r, "Failed to determine SELinux context: %m");
5296                                 }
5297                                 log_unit_debug_errno(unit, r, "Failed to determine SELinux context, ignoring: %m");
5298                         }
5299                 }
5300         }
5301 #endif
5302
5303         /* We repeat the fd closing here, to make sure that nothing is leaked from the PAM modules. Note that
5304          * we are more aggressive this time, since we don't need socket_fd and the netns and ipcns fds any
5305          * more. We do keep exec_fd however, if we have it, since we need to keep it open until the final
5306          * execve(). */
5307
5308         r = close_all_fds(keep_fds, n_keep_fds);
5309         if (r >= 0)
5310                 r = shift_fds(fds, n_fds);
5311         if (r >= 0)
5312                 r = flags_fds(fds, n_socket_fds, n_fds, context->non_blocking);
5313         if (r < 0) {
5314                 *exit_status = EXIT_FDS;
5315                 return log_unit_error_errno(unit, r, "Failed to adjust passed file descriptors: %m");
5316         }
5317
5318         /* At this point, the fds we want to pass to the program are all ready and set up, with O_CLOEXEC turned off
5319          * and at the right fd numbers. The are no other fds open, with one exception: the exec_fd if it is defined,
5320          * and it has O_CLOEXEC set, after all we want it to be closed by the execve(), so that our parent knows we
5321          * came this far. */
5322
5323         secure_bits = context->secure_bits;
5324
5325         if (needs_sandboxing) {
5326                 uint64_t bset;
5327
5328                 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested.
5329                  * (Note this is placed after the general resource limit initialization, see above, in order
5330                  * to take precedence.) */
5331                 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
5332                         if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
5333                                 *exit_status = EXIT_LIMITS;
5334                                 return log_unit_error_errno(unit, errno, "Failed to adjust RLIMIT_RTPRIO resource limit: %m");
5335                         }
5336                 }
5337
5338 #if ENABLE_SMACK
5339                 /* LSM Smack needs the capability CAP_MAC_ADMIN to change the current execution security context of the
5340                  * process. This is the latest place before dropping capabilities. Other MAC context are set later. */
5341                 if (use_smack) {
5342                         r = setup_smack(unit->manager, context, executable_fd);
5343                         if (r < 0 && !context->smack_process_label_ignore) {
5344                                 *exit_status = EXIT_SMACK_PROCESS_LABEL;
5345                                 return log_unit_error_errno(unit, r, "Failed to set SMACK process label: %m");
5346                         }
5347                 }
5348 #endif
5349
5350                 bset = context->capability_bounding_set;
5351                 /* If the ambient caps hack is enabled (which means the kernel can't do them, and the user asked for
5352                  * our magic fallback), then let's add some extra caps, so that the service can drop privs of its own,
5353                  * instead of us doing that */
5354                 if (needs_ambient_hack)
5355                         bset |= (UINT64_C(1) << CAP_SETPCAP) |
5356                                 (UINT64_C(1) << CAP_SETUID) |
5357                                 (UINT64_C(1) << CAP_SETGID);
5358
5359                 if (!cap_test_all(bset)) {
5360                         r = capability_bounding_set_drop(bset, /* right_now= */ false);
5361                         if (r < 0) {
5362                                 *exit_status = EXIT_CAPABILITIES;
5363                                 return log_unit_error_errno(unit, r, "Failed to drop capabilities: %m");
5364                         }
5365                 }
5366
5367                 /* Ambient capabilities are cleared during setresuid() (in enforce_user()) even with
5368                  * keep-caps set.
5369                  *
5370                  * To be able to raise the ambient capabilities after setresuid() they have to be added to
5371                  * the inherited set and keep caps has to be set (done in enforce_user()).  After setresuid()
5372                  * the ambient capabilities can be raised as they are present in the permitted and
5373                  * inhertiable set. However it is possible that someone wants to set ambient capabilities
5374                  * without changing the user, so we also set the ambient capabilities here.
5375                  *
5376                  * The requested ambient capabilities are raised in the inheritable set if the second
5377                  * argument is true. */
5378                 if (!needs_ambient_hack) {
5379                         r = capability_ambient_set_apply(capability_ambient_set, /* also_inherit= */ true);
5380                         if (r < 0) {
5381                                 *exit_status = EXIT_CAPABILITIES;
5382                                 return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (before UID change): %m");
5383                         }
5384                 }
5385         }
5386
5387         /* chroot to root directory first, before we lose the ability to chroot */
5388         r = apply_root_directory(context, params, needs_mount_namespace, exit_status);
5389         if (r < 0)
5390                 return log_unit_error_errno(unit, r, "Chrooting to the requested root directory failed: %m");
5391
5392         if (needs_setuid) {
5393                 if (uid_is_valid(uid)) {
5394                         r = enforce_user(context, uid, capability_ambient_set);
5395                         if (r < 0) {
5396                                 *exit_status = EXIT_USER;
5397                                 return log_unit_error_errno(unit, r, "Failed to change UID to " UID_FMT ": %m", uid);
5398                         }
5399
5400                         if (!needs_ambient_hack && capability_ambient_set != 0) {
5401
5402                                 /* Raise the ambient capabilities after user change. */
5403                                 r = capability_ambient_set_apply(capability_ambient_set, /* also_inherit= */ false);
5404                                 if (r < 0) {
5405                                         *exit_status = EXIT_CAPABILITIES;
5406                                         return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (after UID change): %m");
5407                                 }
5408                         }
5409                 }
5410         }
5411
5412         /* Apply working directory here, because the working directory might be on NFS and only the user running
5413          * this service might have the correct privilege to change to the working directory */
5414         r = apply_working_directory(context, params, home, exit_status);
5415         if (r < 0)
5416                 return log_unit_error_errno(unit, r, "Changing to the requested working directory failed: %m");
5417
5418         if (needs_sandboxing) {
5419                 /* Apply other MAC contexts late, but before seccomp syscall filtering, as those should really be last to
5420                  * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires
5421                  * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls
5422                  * are restricted. */
5423
5424 #if HAVE_SELINUX
5425                 if (use_selinux) {
5426                         char *exec_context = mac_selinux_context_net ?: context->selinux_context;
5427
5428                         if (exec_context) {
5429                                 r = setexeccon(exec_context);
5430                                 if (r < 0) {
5431                                         if (!context->selinux_context_ignore) {
5432                                                 *exit_status = EXIT_SELINUX_CONTEXT;
5433                                                 return log_unit_error_errno(unit, r, "Failed to change SELinux context to %s: %m", exec_context);
5434                                         }
5435                                         log_unit_debug_errno(unit, r, "Failed to change SELinux context to %s, ignoring: %m", exec_context);
5436                                 }
5437                         }
5438                 }
5439 #endif
5440
5441 #if HAVE_APPARMOR
5442                 if (use_apparmor && context->apparmor_profile) {
5443                         r = aa_change_onexec(context->apparmor_profile);
5444                         if (r < 0 && !context->apparmor_profile_ignore) {
5445                                 *exit_status = EXIT_APPARMOR_PROFILE;
5446                                 return log_unit_error_errno(unit, errno, "Failed to prepare AppArmor profile change to %s: %m", context->apparmor_profile);
5447                         }
5448                 }
5449 #endif
5450
5451                 /* PR_GET_SECUREBITS is not privileged, while PR_SET_SECUREBITS is. So to suppress potential
5452                  * EPERMs we'll try not to call PR_SET_SECUREBITS unless necessary. Setting securebits
5453                  * requires CAP_SETPCAP. */
5454                 if (prctl(PR_GET_SECUREBITS) != secure_bits) {
5455                         /* CAP_SETPCAP is required to set securebits. This capability is raised into the
5456                          * effective set here.
5457                          *
5458                          * The effective set is overwritten during execve() with the following values:
5459                          *
5460                          * - ambient set (for non-root processes)
5461                          *
5462                          * - (inheritable | bounding) set for root processes)
5463                          *
5464                          * Hence there is no security impact to raise it in the effective set before execve
5465                          */
5466                         r = capability_gain_cap_setpcap(/* return_caps= */ NULL);
5467                         if (r < 0) {
5468                                 *exit_status = EXIT_CAPABILITIES;
5469                                 return log_unit_error_errno(unit, r, "Failed to gain CAP_SETPCAP for setting secure bits");
5470                         }
5471                         if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
5472                                 *exit_status = EXIT_SECUREBITS;
5473                                 return log_unit_error_errno(unit, errno, "Failed to set process secure bits: %m");
5474                         }
5475                 }
5476
5477                 if (context_has_no_new_privileges(context))
5478                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
5479                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
5480                                 return log_unit_error_errno(unit, errno, "Failed to disable new privileges: %m");
5481                         }
5482
5483 #if HAVE_SECCOMP
5484                 r = apply_address_families(unit, context);
5485                 if (r < 0) {
5486                         *exit_status = EXIT_ADDRESS_FAMILIES;
5487                         return log_unit_error_errno(unit, r, "Failed to restrict address families: %m");
5488                 }
5489
5490                 r = apply_memory_deny_write_execute(unit, context);
5491                 if (r < 0) {
5492                         *exit_status = EXIT_SECCOMP;
5493                         return log_unit_error_errno(unit, r, "Failed to disable writing to executable memory: %m");
5494                 }
5495
5496                 r = apply_restrict_realtime(unit, context);
5497                 if (r < 0) {
5498                         *exit_status = EXIT_SECCOMP;
5499                         return log_unit_error_errno(unit, r, "Failed to apply realtime restrictions: %m");
5500                 }
5501
5502                 r = apply_restrict_suid_sgid(unit, context);
5503                 if (r < 0) {
5504                         *exit_status = EXIT_SECCOMP;
5505                         return log_unit_error_errno(unit, r, "Failed to apply SUID/SGID restrictions: %m");
5506                 }
5507
5508                 r = apply_restrict_namespaces(unit, context);
5509                 if (r < 0) {
5510                         *exit_status = EXIT_SECCOMP;
5511                         return log_unit_error_errno(unit, r, "Failed to apply namespace restrictions: %m");
5512                 }
5513
5514                 r = apply_protect_sysctl(unit, context);
5515                 if (r < 0) {
5516                         *exit_status = EXIT_SECCOMP;
5517                         return log_unit_error_errno(unit, r, "Failed to apply sysctl restrictions: %m");
5518                 }
5519
5520                 r = apply_protect_kernel_modules(unit, context);
5521                 if (r < 0) {
5522                         *exit_status = EXIT_SECCOMP;
5523                         return log_unit_error_errno(unit, r, "Failed to apply module loading restrictions: %m");
5524                 }
5525
5526                 r = apply_protect_kernel_logs(unit, context);
5527                 if (r < 0) {
5528                         *exit_status = EXIT_SECCOMP;
5529                         return log_unit_error_errno(unit, r, "Failed to apply kernel log restrictions: %m");
5530                 }
5531
5532                 r = apply_protect_clock(unit, context);
5533                 if (r < 0) {
5534                         *exit_status = EXIT_SECCOMP;
5535                         return log_unit_error_errno(unit, r, "Failed to apply clock restrictions: %m");
5536                 }
5537
5538                 r = apply_private_devices(unit, context);
5539                 if (r < 0) {
5540                         *exit_status = EXIT_SECCOMP;
5541                         return log_unit_error_errno(unit, r, "Failed to set up private devices: %m");
5542                 }
5543
5544                 r = apply_syscall_archs(unit, context);
5545                 if (r < 0) {
5546                         *exit_status = EXIT_SECCOMP;
5547                         return log_unit_error_errno(unit, r, "Failed to apply syscall architecture restrictions: %m");
5548                 }
5549
5550                 r = apply_lock_personality(unit, context);
5551                 if (r < 0) {
5552                         *exit_status = EXIT_SECCOMP;
5553                         return log_unit_error_errno(unit, r, "Failed to lock personalities: %m");
5554                 }
5555
5556                 r = apply_syscall_log(unit, context);
5557                 if (r < 0) {
5558                         *exit_status = EXIT_SECCOMP;
5559                         return log_unit_error_errno(unit, r, "Failed to apply system call log filters: %m");
5560                 }
5561
5562                 /* This really should remain the last step before the execve(), to make sure our own code is unaffected
5563                  * by the filter as little as possible. */
5564                 r = apply_syscall_filter(unit, context, needs_ambient_hack);
5565                 if (r < 0) {
5566                         *exit_status = EXIT_SECCOMP;
5567                         return log_unit_error_errno(unit, r, "Failed to apply system call filters: %m");
5568                 }
5569 #endif
5570
5571 #if HAVE_LIBBPF
5572                 r = apply_restrict_filesystems(unit, context);
5573                 if (r < 0) {
5574                         *exit_status = EXIT_BPF;
5575                         return log_unit_error_errno(unit, r, "Failed to restrict filesystems: %m");
5576                 }
5577 #endif
5578
5579         }
5580
5581         if (!strv_isempty(context->unset_environment)) {
5582                 char **ee = NULL;
5583
5584                 ee = strv_env_delete(accum_env, 1, context->unset_environment);
5585                 if (!ee) {
5586                         *exit_status = EXIT_MEMORY;
5587                         return log_oom();
5588                 }
5589
5590                 strv_free_and_replace(accum_env, ee);
5591         }
5592
5593         if (!FLAGS_SET(command->flags, EXEC_COMMAND_NO_ENV_EXPAND)) {
5594                 replaced_argv = replace_env_argv(command->argv, accum_env);
5595                 if (!replaced_argv) {
5596                         *exit_status = EXIT_MEMORY;
5597                         return log_oom();
5598                 }
5599                 final_argv = replaced_argv;
5600         } else
5601                 final_argv = command->argv;
5602
5603         log_command_line(unit, "Executing", executable, final_argv);
5604
5605         if (exec_fd >= 0) {
5606                 uint8_t hot = 1;
5607
5608                 /* We have finished with all our initializations. Let's now let the manager know that. From this point
5609                  * on, if the manager sees POLLHUP on the exec_fd, then execve() was successful. */
5610
5611                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
5612                         *exit_status = EXIT_EXEC;
5613                         return log_unit_error_errno(unit, errno, "Failed to enable exec_fd: %m");
5614                 }
5615         }
5616
5617         r = fexecve_or_execve(executable_fd, executable, final_argv, accum_env);
5618
5619         if (exec_fd >= 0) {
5620                 uint8_t hot = 0;
5621
5622                 /* The execve() failed. This means the exec_fd is still open. Which means we need to tell the manager
5623                  * that POLLHUP on it no longer means execve() succeeded. */
5624
5625                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
5626                         *exit_status = EXIT_EXEC;
5627                         return log_unit_error_errno(unit, errno, "Failed to disable exec_fd: %m");
5628                 }
5629         }
5630
5631         *exit_status = EXIT_EXEC;
5632         return log_unit_error_errno(unit, r, "Failed to execute %s: %m", executable);
5633 }
5634
5635 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l);
5636 static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[static 3]);
5637
5638 int exec_spawn(Unit *unit,
5639                ExecCommand *command,
5640                const ExecContext *context,
5641                const ExecParameters *params,
5642                ExecRuntime *runtime,
5643                const CGroupContext *cgroup_context,
5644                pid_t *ret) {
5645
5646         int socket_fd, r, named_iofds[3] = { -1, -1, -1 }, *fds = NULL;
5647         _cleanup_free_ char *subcgroup_path = NULL;
5648         _cleanup_strv_free_ char **files_env = NULL;
5649         size_t n_storage_fds = 0, n_socket_fds = 0;
5650         pid_t pid;
5651
5652         assert(unit);
5653         assert(command);
5654         assert(context);
5655         assert(ret);
5656         assert(params);
5657         assert(params->fds || (params->n_socket_fds + params->n_storage_fds <= 0));
5658
5659         LOG_CONTEXT_PUSH_UNIT(unit);
5660
5661         if (context->std_input == EXEC_INPUT_SOCKET ||
5662             context->std_output == EXEC_OUTPUT_SOCKET ||
5663             context->std_error == EXEC_OUTPUT_SOCKET) {
5664
5665                 if (params->n_socket_fds > 1)
5666                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EINVAL), "Got more than one socket.");
5667
5668                 if (params->n_socket_fds == 0)
5669                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EINVAL), "Got no socket.");
5670
5671                 socket_fd = params->fds[0];
5672         } else {
5673                 socket_fd = -EBADF;
5674                 fds = params->fds;
5675                 n_socket_fds = params->n_socket_fds;
5676                 n_storage_fds = params->n_storage_fds;
5677         }
5678
5679         r = exec_context_named_iofds(context, params, named_iofds);
5680         if (r < 0)
5681                 return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m");
5682
5683         r = exec_context_load_environment(unit, context, &files_env);
5684         if (r < 0)
5685                 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
5686
5687         /* Fork with up-to-date SELinux label database, so the child inherits the up-to-date db
5688            and, until the next SELinux policy changes, we save further reloads in future children. */
5689         mac_selinux_maybe_reload();
5690
5691         /* We won't know the real executable path until we create the mount namespace in the child, but we
5692            want to log from the parent, so we use the possibly inaccurate path here. */
5693         log_command_line(unit, "About to execute", command->path, command->argv);
5694
5695         if (params->cgroup_path) {
5696                 r = exec_parameters_get_cgroup_path(params, cgroup_context, &subcgroup_path);
5697                 if (r < 0)
5698                         return log_unit_error_errno(unit, r, "Failed to acquire subcgroup path: %m");
5699                 if (r > 0) {
5700                         /* If there's a subcgroup, then let's create it here now (the main cgroup was already
5701                          * realized by the unit logic) */
5702
5703                         r = cg_create(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path);
5704                         if (r < 0)
5705                                 return log_unit_error_errno(unit, r, "Failed to create subcgroup '%s': %m", subcgroup_path);
5706                 }
5707         }
5708
5709         pid = fork();
5710         if (pid < 0)
5711                 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
5712
5713         if (pid == 0) {
5714                 int exit_status = EXIT_SUCCESS;
5715
5716                 r = exec_child(unit,
5717                                command,
5718                                context,
5719                                params,
5720                                runtime,
5721                                cgroup_context,
5722                                socket_fd,
5723                                named_iofds,
5724                                fds,
5725                                n_socket_fds,
5726                                n_storage_fds,
5727                                files_env,
5728                                unit->manager->user_lookup_fds[1],
5729                                &exit_status);
5730
5731                 if (r < 0) {
5732                         const char *status =
5733                                 exit_status_to_string(exit_status,
5734                                                       EXIT_STATUS_LIBC | EXIT_STATUS_SYSTEMD);
5735
5736                         log_unit_struct_errno(unit, LOG_ERR, r,
5737                                               "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
5738                                               LOG_UNIT_INVOCATION_ID(unit),
5739                                               LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
5740                                                                status, command->path),
5741                                               "EXECUTABLE=%s", command->path);
5742                 }
5743
5744                 _exit(exit_status);
5745         }
5746
5747         log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
5748
5749         /* We add the new process to the cgroup both in the child (so that we can be sure that no user code is ever
5750          * executed outside of the cgroup) and in the parent (so that we can be sure that when we kill the cgroup the
5751          * process will be killed too). */
5752         if (subcgroup_path)
5753                 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path, pid);
5754
5755         exec_status_start(&command->exec_status, pid);
5756
5757         *ret = pid;
5758         return 0;
5759 }
5760
5761 void exec_context_init(ExecContext *c) {
5762         assert(c);
5763
5764         c->umask = 0022;
5765         c->ioprio = IOPRIO_DEFAULT_CLASS_AND_PRIO;
5766         c->cpu_sched_policy = SCHED_OTHER;
5767         c->syslog_priority = LOG_DAEMON|LOG_INFO;
5768         c->syslog_level_prefix = true;
5769         c->ignore_sigpipe = true;
5770         c->timer_slack_nsec = NSEC_INFINITY;
5771         c->personality = PERSONALITY_INVALID;
5772         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++)
5773                 c->directories[t].mode = 0755;
5774         c->timeout_clean_usec = USEC_INFINITY;
5775         c->capability_bounding_set = CAP_MASK_UNSET;
5776         assert_cc(NAMESPACE_FLAGS_INITIAL != NAMESPACE_FLAGS_ALL);
5777         c->restrict_namespaces = NAMESPACE_FLAGS_INITIAL;
5778         c->log_level_max = -1;
5779 #if HAVE_SECCOMP
5780         c->syscall_errno = SECCOMP_ERROR_NUMBER_KILL;
5781 #endif
5782         c->tty_rows = UINT_MAX;
5783         c->tty_cols = UINT_MAX;
5784         numa_policy_reset(&c->numa_policy);
5785         c->private_mounts = -1;
5786         c->memory_ksm = -1;
5787 }
5788
5789 void exec_context_done(ExecContext *c) {
5790         assert(c);
5791
5792         c->environment = strv_free(c->environment);
5793         c->environment_files = strv_free(c->environment_files);
5794         c->pass_environment = strv_free(c->pass_environment);
5795         c->unset_environment = strv_free(c->unset_environment);
5796
5797         rlimit_free_all(c->rlimit);
5798
5799         for (size_t l = 0; l < 3; l++) {
5800                 c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);
5801                 c->stdio_file[l] = mfree(c->stdio_file[l]);
5802         }
5803
5804         c->working_directory = mfree(c->working_directory);
5805         c->root_directory = mfree(c->root_directory);
5806         c->root_image = mfree(c->root_image);
5807         c->root_image_options = mount_options_free_all(c->root_image_options);
5808         c->root_hash = mfree(c->root_hash);
5809         c->root_hash_size = 0;
5810         c->root_hash_path = mfree(c->root_hash_path);
5811         c->root_hash_sig = mfree(c->root_hash_sig);
5812         c->root_hash_sig_size = 0;
5813         c->root_hash_sig_path = mfree(c->root_hash_sig_path);
5814         c->root_verity = mfree(c->root_verity);
5815         c->extension_images = mount_image_free_many(c->extension_images, &c->n_extension_images);
5816         c->extension_directories = strv_free(c->extension_directories);
5817         c->tty_path = mfree(c->tty_path);
5818         c->syslog_identifier = mfree(c->syslog_identifier);
5819         c->user = mfree(c->user);
5820         c->group = mfree(c->group);
5821
5822         c->supplementary_groups = strv_free(c->supplementary_groups);
5823
5824         c->pam_name = mfree(c->pam_name);
5825
5826         c->read_only_paths = strv_free(c->read_only_paths);
5827         c->read_write_paths = strv_free(c->read_write_paths);
5828         c->inaccessible_paths = strv_free(c->inaccessible_paths);
5829         c->exec_paths = strv_free(c->exec_paths);
5830         c->no_exec_paths = strv_free(c->no_exec_paths);
5831         c->exec_search_path = strv_free(c->exec_search_path);
5832
5833         bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
5834         c->bind_mounts = NULL;
5835         c->n_bind_mounts = 0;
5836         temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);
5837         c->temporary_filesystems = NULL;
5838         c->n_temporary_filesystems = 0;
5839         c->mount_images = mount_image_free_many(c->mount_images, &c->n_mount_images);
5840
5841         cpu_set_reset(&c->cpu_set);
5842         numa_policy_reset(&c->numa_policy);
5843
5844         c->utmp_id = mfree(c->utmp_id);
5845         c->selinux_context = mfree(c->selinux_context);
5846         c->apparmor_profile = mfree(c->apparmor_profile);
5847         c->smack_process_label = mfree(c->smack_process_label);
5848
5849         c->restrict_filesystems = set_free(c->restrict_filesystems);
5850
5851         c->syscall_filter = hashmap_free(c->syscall_filter);
5852         c->syscall_archs = set_free(c->syscall_archs);
5853         c->address_families = set_free(c->address_families);
5854
5855         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++)
5856                 exec_directory_done(&c->directories[t]);
5857
5858         c->log_level_max = -1;
5859
5860         exec_context_free_log_extra_fields(c);
5861         c->log_filter_allowed_patterns = set_free(c->log_filter_allowed_patterns);
5862         c->log_filter_denied_patterns = set_free(c->log_filter_denied_patterns);
5863
5864         c->log_ratelimit_interval_usec = 0;
5865         c->log_ratelimit_burst = 0;
5866
5867         c->stdin_data = mfree(c->stdin_data);
5868         c->stdin_data_size = 0;
5869
5870         c->network_namespace_path = mfree(c->network_namespace_path);
5871         c->ipc_namespace_path = mfree(c->ipc_namespace_path);
5872
5873         c->log_namespace = mfree(c->log_namespace);
5874
5875         c->load_credentials = hashmap_free(c->load_credentials);
5876         c->set_credentials = hashmap_free(c->set_credentials);
5877
5878         c->root_image_policy = image_policy_free(c->root_image_policy);
5879         c->mount_image_policy = image_policy_free(c->mount_image_policy);
5880         c->extension_image_policy = image_policy_free(c->extension_image_policy);
5881 }
5882
5883 int exec_context_destroy_runtime_directory(const ExecContext *c, const char *runtime_prefix) {
5884         assert(c);
5885
5886         if (!runtime_prefix)
5887                 return 0;
5888
5889         for (size_t i = 0; i < c->directories[EXEC_DIRECTORY_RUNTIME].n_items; i++) {
5890                 _cleanup_free_ char *p = NULL;
5891
5892                 if (exec_directory_is_private(c, EXEC_DIRECTORY_RUNTIME))
5893                         p = path_join(runtime_prefix, "private", c->directories[EXEC_DIRECTORY_RUNTIME].items[i].path);
5894                 else
5895                         p = path_join(runtime_prefix, c->directories[EXEC_DIRECTORY_RUNTIME].items[i].path);
5896                 if (!p)
5897                         return -ENOMEM;
5898
5899                 /* We execute this synchronously, since we need to be sure this is gone when we start the
5900                  * service next. */
5901                 (void) rm_rf(p, REMOVE_ROOT);
5902
5903                 STRV_FOREACH(symlink, c->directories[EXEC_DIRECTORY_RUNTIME].items[i].symlinks) {
5904                         _cleanup_free_ char *symlink_abs = NULL;
5905
5906                         if (exec_directory_is_private(c, EXEC_DIRECTORY_RUNTIME))
5907                                 symlink_abs = path_join(runtime_prefix, "private", *symlink);
5908                         else
5909                                 symlink_abs = path_join(runtime_prefix, *symlink);
5910                         if (!symlink_abs)
5911                                 return -ENOMEM;
5912
5913                         (void) unlink(symlink_abs);
5914                 }
5915         }
5916
5917         return 0;
5918 }
5919
5920 int exec_context_destroy_credentials(const ExecContext *c, const char *runtime_prefix, const char *unit) {
5921         _cleanup_free_ char *p = NULL;
5922
5923         assert(c);
5924
5925         if (!runtime_prefix || !unit)
5926                 return 0;
5927
5928         p = path_join(runtime_prefix, "credentials", unit);
5929         if (!p)
5930                 return -ENOMEM;
5931
5932         /* This is either a tmpfs/ramfs of its own, or a plain directory. Either way, let's first try to
5933          * unmount it, and afterwards remove the mount point */
5934         (void) umount2(p, MNT_DETACH|UMOUNT_NOFOLLOW);
5935         (void) rm_rf(p, REMOVE_ROOT|REMOVE_CHMOD);
5936
5937         return 0;
5938 }
5939
5940 int exec_context_destroy_mount_ns_dir(Unit *u) {
5941         _cleanup_free_ char *p = NULL;
5942
5943         if (!u || !MANAGER_IS_SYSTEM(u->manager))
5944                 return 0;
5945
5946         p = path_join("/run/systemd/propagate/", u->id);
5947         if (!p)
5948                 return -ENOMEM;
5949
5950         /* This is only filled transiently (see mount_in_namespace()), should be empty or even non-existent*/
5951         if (rmdir(p) < 0 && errno != ENOENT)
5952                 log_unit_debug_errno(u, errno, "Unable to remove propagation dir '%s', ignoring: %m", p);
5953
5954         return 0;
5955 }
5956
5957 static void exec_command_done(ExecCommand *c) {
5958         assert(c);
5959
5960         c->path = mfree(c->path);
5961         c->argv = strv_free(c->argv);
5962 }
5963
5964 void exec_command_done_array(ExecCommand *c, size_t n) {
5965         for (size_t i = 0; i < n; i++)
5966                 exec_command_done(c+i);
5967 }
5968
5969 ExecCommand* exec_command_free_list(ExecCommand *c) {
5970         ExecCommand *i;
5971
5972         while ((i = c)) {
5973                 LIST_REMOVE(command, c, i);
5974                 exec_command_done(i);
5975                 free(i);
5976         }
5977
5978         return NULL;
5979 }
5980
5981 void exec_command_free_array(ExecCommand **c, size_t n) {
5982         for (size_t i = 0; i < n; i++)
5983                 c[i] = exec_command_free_list(c[i]);
5984 }
5985
5986 void exec_command_reset_status_array(ExecCommand *c, size_t n) {
5987         for (size_t i = 0; i < n; i++)
5988                 exec_status_reset(&c[i].exec_status);
5989 }
5990
5991 void exec_command_reset_status_list_array(ExecCommand **c, size_t n) {
5992         for (size_t i = 0; i < n; i++)
5993                 LIST_FOREACH(command, z, c[i])
5994                         exec_status_reset(&z->exec_status);
5995 }
5996
5997 typedef struct InvalidEnvInfo {
5998         const Unit *unit;
5999         const char *path;
6000 } InvalidEnvInfo;
6001
6002 static void invalid_env(const char *p, void *userdata) {
6003         InvalidEnvInfo *info = userdata;
6004
6005         log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
6006 }
6007
6008 const char* exec_context_fdname(const ExecContext *c, int fd_index) {
6009         assert(c);
6010
6011         switch (fd_index) {
6012
6013         case STDIN_FILENO:
6014                 if (c->std_input != EXEC_INPUT_NAMED_FD)
6015                         return NULL;
6016
6017                 return c->stdio_fdname[STDIN_FILENO] ?: "stdin";
6018
6019         case STDOUT_FILENO:
6020                 if (c->std_output != EXEC_OUTPUT_NAMED_FD)
6021                         return NULL;
6022
6023                 return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";
6024
6025         case STDERR_FILENO:
6026                 if (c->std_error != EXEC_OUTPUT_NAMED_FD)
6027                         return NULL;
6028
6029                 return c->stdio_fdname[STDERR_FILENO] ?: "stderr";
6030
6031         default:
6032                 return NULL;
6033         }
6034 }
6035
6036 static int exec_context_named_iofds(
6037                 const ExecContext *c,
6038                 const ExecParameters *p,
6039                 int named_iofds[static 3]) {
6040
6041         size_t targets;
6042         const char* stdio_fdname[3];
6043         size_t n_fds;
6044
6045         assert(c);
6046         assert(p);
6047         assert(named_iofds);
6048
6049         targets = (c->std_input == EXEC_INPUT_NAMED_FD) +
6050                   (c->std_output == EXEC_OUTPUT_NAMED_FD) +
6051                   (c->std_error == EXEC_OUTPUT_NAMED_FD);
6052
6053         for (size_t i = 0; i < 3; i++)
6054                 stdio_fdname[i] = exec_context_fdname(c, i);
6055
6056         n_fds = p->n_storage_fds + p->n_socket_fds;
6057
6058         for (size_t i = 0; i < n_fds  && targets > 0; i++)
6059                 if (named_iofds[STDIN_FILENO] < 0 &&
6060                     c->std_input == EXEC_INPUT_NAMED_FD &&
6061                     stdio_fdname[STDIN_FILENO] &&
6062                     streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) {
6063
6064                         named_iofds[STDIN_FILENO] = p->fds[i];
6065                         targets--;
6066
6067                 } else if (named_iofds[STDOUT_FILENO] < 0 &&
6068                            c->std_output == EXEC_OUTPUT_NAMED_FD &&
6069                            stdio_fdname[STDOUT_FILENO] &&
6070                            streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) {
6071
6072                         named_iofds[STDOUT_FILENO] = p->fds[i];
6073                         targets--;
6074
6075                 } else if (named_iofds[STDERR_FILENO] < 0 &&
6076                            c->std_error == EXEC_OUTPUT_NAMED_FD &&
6077                            stdio_fdname[STDERR_FILENO] &&
6078                            streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) {
6079
6080                         named_iofds[STDERR_FILENO] = p->fds[i];
6081                         targets--;
6082                 }
6083
6084         return targets == 0 ? 0 : -ENOENT;
6085 }
6086
6087 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***ret) {
6088         _cleanup_strv_free_ char **v = NULL;
6089         int r;
6090
6091         assert(c);
6092         assert(ret);
6093
6094         STRV_FOREACH(i, c->environment_files) {
6095                 _cleanup_globfree_ glob_t pglob = {};
6096                 bool ignore = false;
6097                 char *fn = *i;
6098
6099                 if (fn[0] == '-') {
6100                         ignore = true;
6101                         fn++;
6102                 }
6103
6104                 if (!path_is_absolute(fn)) {
6105                         if (ignore)
6106                                 continue;
6107                         return -EINVAL;
6108                 }
6109
6110                 /* Filename supports globbing, take all matching files */
6111                 r = safe_glob(fn, 0, &pglob);
6112                 if (r < 0) {
6113                         if (ignore)
6114                                 continue;
6115                         return r;
6116                 }
6117
6118                 /* When we don't match anything, -ENOENT should be returned */
6119                 assert(pglob.gl_pathc > 0);
6120
6121                 for (unsigned n = 0; n < pglob.gl_pathc; n++) {
6122                         _cleanup_strv_free_ char **p = NULL;
6123
6124                         r = load_env_file(NULL, pglob.gl_pathv[n], &p);
6125                         if (r < 0) {
6126                                 if (ignore)
6127                                         continue;
6128                                 return r;
6129                         }
6130
6131                         /* Log invalid environment variables with filename */
6132                         if (p) {
6133                                 InvalidEnvInfo info = {
6134                                         .unit = unit,
6135                                         .path = pglob.gl_pathv[n]
6136                                 };
6137
6138                                 p = strv_env_clean_with_callback(p, invalid_env, &info);
6139                         }
6140
6141                         if (!v)
6142                                 v = TAKE_PTR(p);
6143                         else {
6144                                 char **m = strv_env_merge(v, p);
6145                                 if (!m)
6146                                         return -ENOMEM;
6147
6148                                 strv_free_and_replace(v, m);
6149                         }
6150                 }
6151         }
6152
6153         *ret = TAKE_PTR(v);
6154
6155         return 0;
6156 }
6157
6158 static bool tty_may_match_dev_console(const char *tty) {
6159         _cleanup_free_ char *resolved = NULL;
6160
6161         if (!tty)
6162                 return true;
6163
6164         tty = skip_dev_prefix(tty);
6165
6166         /* trivial identity? */
6167         if (streq(tty, "console"))
6168                 return true;
6169
6170         if (resolve_dev_console(&resolved) < 0)
6171                 return true; /* if we could not resolve, assume it may */
6172
6173         /* "tty0" means the active VC, so it may be the same sometimes */
6174         return path_equal(resolved, tty) || (streq(resolved, "tty0") && tty_is_vc(tty));
6175 }
6176
6177 static bool exec_context_may_touch_tty(const ExecContext *ec) {
6178         assert(ec);
6179
6180         return ec->tty_reset ||
6181                 ec->tty_vhangup ||
6182                 ec->tty_vt_disallocate ||
6183                 is_terminal_input(ec->std_input) ||
6184                 is_terminal_output(ec->std_output) ||
6185                 is_terminal_output(ec->std_error);
6186 }
6187
6188 bool exec_context_may_touch_console(const ExecContext *ec) {
6189
6190         return exec_context_may_touch_tty(ec) &&
6191                tty_may_match_dev_console(exec_context_tty_path(ec));
6192 }
6193
6194 static void strv_fprintf(FILE *f, char **l) {
6195         assert(f);
6196
6197         STRV_FOREACH(g, l)
6198                 fprintf(f, " %s", *g);
6199 }
6200
6201 static void strv_dump(FILE* f, const char *prefix, const char *name, char **strv) {
6202         assert(f);
6203         assert(prefix);
6204         assert(name);
6205
6206         if (!strv_isempty(strv)) {
6207                 fprintf(f, "%s%s:", prefix, name);
6208                 strv_fprintf(f, strv);
6209                 fputs("\n", f);
6210         }
6211 }
6212
6213 void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
6214         int r;
6215
6216         assert(c);
6217         assert(f);
6218
6219         prefix = strempty(prefix);
6220
6221         fprintf(f,
6222                 "%sUMask: %04o\n"
6223                 "%sWorkingDirectory: %s\n"
6224                 "%sRootDirectory: %s\n"
6225                 "%sNonBlocking: %s\n"
6226                 "%sPrivateTmp: %s\n"
6227                 "%sPrivateDevices: %s\n"
6228                 "%sProtectKernelTunables: %s\n"
6229                 "%sProtectKernelModules: %s\n"
6230                 "%sProtectKernelLogs: %s\n"
6231                 "%sProtectClock: %s\n"
6232                 "%sProtectControlGroups: %s\n"
6233                 "%sPrivateNetwork: %s\n"
6234                 "%sPrivateUsers: %s\n"
6235                 "%sProtectHome: %s\n"
6236                 "%sProtectSystem: %s\n"
6237                 "%sMountAPIVFS: %s\n"
6238                 "%sIgnoreSIGPIPE: %s\n"
6239                 "%sMemoryDenyWriteExecute: %s\n"
6240                 "%sRestrictRealtime: %s\n"
6241                 "%sRestrictSUIDSGID: %s\n"
6242                 "%sKeyringMode: %s\n"
6243                 "%sProtectHostname: %s\n"
6244                 "%sProtectProc: %s\n"
6245                 "%sProcSubset: %s\n",
6246                 prefix, c->umask,
6247                 prefix, empty_to_root(c->working_directory),
6248                 prefix, empty_to_root(c->root_directory),
6249                 prefix, yes_no(c->non_blocking),
6250                 prefix, yes_no(c->private_tmp),
6251                 prefix, yes_no(c->private_devices),
6252                 prefix, yes_no(c->protect_kernel_tunables),
6253                 prefix, yes_no(c->protect_kernel_modules),
6254                 prefix, yes_no(c->protect_kernel_logs),
6255                 prefix, yes_no(c->protect_clock),
6256                 prefix, yes_no(c->protect_control_groups),
6257                 prefix, yes_no(c->private_network),
6258                 prefix, yes_no(c->private_users),
6259                 prefix, protect_home_to_string(c->protect_home),
6260                 prefix, protect_system_to_string(c->protect_system),
6261                 prefix, yes_no(exec_context_get_effective_mount_apivfs(c)),
6262                 prefix, yes_no(c->ignore_sigpipe),
6263                 prefix, yes_no(c->memory_deny_write_execute),
6264                 prefix, yes_no(c->restrict_realtime),
6265                 prefix, yes_no(c->restrict_suid_sgid),
6266                 prefix, exec_keyring_mode_to_string(c->keyring_mode),
6267                 prefix, yes_no(c->protect_hostname),
6268                 prefix, protect_proc_to_string(c->protect_proc),
6269                 prefix, proc_subset_to_string(c->proc_subset));
6270
6271         if (c->root_image)
6272                 fprintf(f, "%sRootImage: %s\n", prefix, c->root_image);
6273
6274         if (c->root_image_options) {
6275                 fprintf(f, "%sRootImageOptions:", prefix);
6276                 LIST_FOREACH(mount_options, o, c->root_image_options)
6277                         if (!isempty(o->options))
6278                                 fprintf(f, " %s:%s",
6279                                         partition_designator_to_string(o->partition_designator),
6280                                         o->options);
6281                 fprintf(f, "\n");
6282         }
6283
6284         if (c->root_hash) {
6285                 _cleanup_free_ char *encoded = NULL;
6286                 encoded = hexmem(c->root_hash, c->root_hash_size);
6287                 if (encoded)
6288                         fprintf(f, "%sRootHash: %s\n", prefix, encoded);
6289         }
6290
6291         if (c->root_hash_path)
6292                 fprintf(f, "%sRootHash: %s\n", prefix, c->root_hash_path);
6293
6294         if (c->root_hash_sig) {
6295                 _cleanup_free_ char *encoded = NULL;
6296                 ssize_t len;
6297                 len = base64mem(c->root_hash_sig, c->root_hash_sig_size, &encoded);
6298                 if (len)
6299                         fprintf(f, "%sRootHashSignature: base64:%s\n", prefix, encoded);
6300         }
6301
6302         if (c->root_hash_sig_path)
6303                 fprintf(f, "%sRootHashSignature: %s\n", prefix, c->root_hash_sig_path);
6304
6305         if (c->root_verity)
6306                 fprintf(f, "%sRootVerity: %s\n", prefix, c->root_verity);
6307
6308         STRV_FOREACH(e, c->environment)
6309                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
6310
6311         STRV_FOREACH(e, c->environment_files)
6312                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
6313
6314         STRV_FOREACH(e, c->pass_environment)
6315                 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
6316
6317         STRV_FOREACH(e, c->unset_environment)
6318                 fprintf(f, "%sUnsetEnvironment: %s\n", prefix, *e);
6319
6320         fprintf(f, "%sRuntimeDirectoryPreserve: %s\n", prefix, exec_preserve_mode_to_string(c->runtime_directory_preserve_mode));
6321
6322         for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
6323                 fprintf(f, "%s%sMode: %04o\n", prefix, exec_directory_type_to_string(dt), c->directories[dt].mode);
6324
6325                 for (size_t i = 0; i < c->directories[dt].n_items; i++) {
6326                         fprintf(f, "%s%s: %s\n", prefix, exec_directory_type_to_string(dt), c->directories[dt].items[i].path);
6327
6328                         STRV_FOREACH(d, c->directories[dt].items[i].symlinks)
6329                                 fprintf(f, "%s%s: %s:%s\n", prefix, exec_directory_type_symlink_to_string(dt), c->directories[dt].items[i].path, *d);
6330                 }
6331         }
6332
6333         fprintf(f, "%sTimeoutCleanSec: %s\n", prefix, FORMAT_TIMESPAN(c->timeout_clean_usec, USEC_PER_SEC));
6334
6335         if (c->nice_set)
6336                 fprintf(f, "%sNice: %i\n", prefix, c->nice);
6337
6338         if (c->oom_score_adjust_set)
6339                 fprintf(f, "%sOOMScoreAdjust: %i\n", prefix, c->oom_score_adjust);
6340
6341         if (c->coredump_filter_set)
6342                 fprintf(f, "%sCoredumpFilter: 0x%"PRIx64"\n", prefix, c->coredump_filter);
6343
6344         for (unsigned i = 0; i < RLIM_NLIMITS; i++)
6345                 if (c->rlimit[i]) {
6346                         fprintf(f, "%sLimit%s: " RLIM_FMT "\n",
6347                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
6348                         fprintf(f, "%sLimit%sSoft: " RLIM_FMT "\n",
6349                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
6350                 }
6351
6352         if (c->ioprio_set) {
6353                 _cleanup_free_ char *class_str = NULL;
6354
6355                 r = ioprio_class_to_string_alloc(ioprio_prio_class(c->ioprio), &class_str);
6356                 if (r >= 0)
6357                         fprintf(f, "%sIOSchedulingClass: %s\n", prefix, class_str);
6358
6359                 fprintf(f, "%sIOPriority: %d\n", prefix, ioprio_prio_data(c->ioprio));
6360         }
6361
6362         if (c->cpu_sched_set) {
6363                 _cleanup_free_ char *policy_str = NULL;
6364
6365                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
6366                 if (r >= 0)
6367                         fprintf(f, "%sCPUSchedulingPolicy: %s\n", prefix, policy_str);
6368
6369                 fprintf(f,
6370                         "%sCPUSchedulingPriority: %i\n"
6371                         "%sCPUSchedulingResetOnFork: %s\n",
6372                         prefix, c->cpu_sched_priority,
6373                         prefix, yes_no(c->cpu_sched_reset_on_fork));
6374         }
6375
6376         if (c->cpu_set.set) {
6377                 _cleanup_free_ char *affinity = NULL;
6378
6379                 affinity = cpu_set_to_range_string(&c->cpu_set);
6380                 fprintf(f, "%sCPUAffinity: %s\n", prefix, affinity);
6381         }
6382
6383         if (mpol_is_valid(numa_policy_get_type(&c->numa_policy))) {
6384                 _cleanup_free_ char *nodes = NULL;
6385
6386                 nodes = cpu_set_to_range_string(&c->numa_policy.nodes);
6387                 fprintf(f, "%sNUMAPolicy: %s\n", prefix, mpol_to_string(numa_policy_get_type(&c->numa_policy)));
6388                 fprintf(f, "%sNUMAMask: %s\n", prefix, strnull(nodes));
6389         }
6390
6391         if (c->timer_slack_nsec != NSEC_INFINITY)
6392                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
6393
6394         fprintf(f,
6395                 "%sStandardInput: %s\n"
6396                 "%sStandardOutput: %s\n"
6397                 "%sStandardError: %s\n",
6398                 prefix, exec_input_to_string(c->std_input),
6399                 prefix, exec_output_to_string(c->std_output),
6400                 prefix, exec_output_to_string(c->std_error));
6401
6402         if (c->std_input == EXEC_INPUT_NAMED_FD)
6403                 fprintf(f, "%sStandardInputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDIN_FILENO]);
6404         if (c->std_output == EXEC_OUTPUT_NAMED_FD)
6405                 fprintf(f, "%sStandardOutputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDOUT_FILENO]);
6406         if (c->std_error == EXEC_OUTPUT_NAMED_FD)
6407                 fprintf(f, "%sStandardErrorFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDERR_FILENO]);
6408
6409         if (c->std_input == EXEC_INPUT_FILE)
6410                 fprintf(f, "%sStandardInputFile: %s\n", prefix, c->stdio_file[STDIN_FILENO]);
6411         if (c->std_output == EXEC_OUTPUT_FILE)
6412                 fprintf(f, "%sStandardOutputFile: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
6413         if (c->std_output == EXEC_OUTPUT_FILE_APPEND)
6414                 fprintf(f, "%sStandardOutputFileToAppend: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
6415         if (c->std_output == EXEC_OUTPUT_FILE_TRUNCATE)
6416                 fprintf(f, "%sStandardOutputFileToTruncate: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
6417         if (c->std_error == EXEC_OUTPUT_FILE)
6418                 fprintf(f, "%sStandardErrorFile: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
6419         if (c->std_error == EXEC_OUTPUT_FILE_APPEND)
6420                 fprintf(f, "%sStandardErrorFileToAppend: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
6421         if (c->std_error == EXEC_OUTPUT_FILE_TRUNCATE)
6422                 fprintf(f, "%sStandardErrorFileToTruncate: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
6423
6424         if (c->tty_path)
6425                 fprintf(f,
6426                         "%sTTYPath: %s\n"
6427                         "%sTTYReset: %s\n"
6428                         "%sTTYVHangup: %s\n"
6429                         "%sTTYVTDisallocate: %s\n"
6430                         "%sTTYRows: %u\n"
6431                         "%sTTYColumns: %u\n",
6432                         prefix, c->tty_path,
6433                         prefix, yes_no(c->tty_reset),
6434                         prefix, yes_no(c->tty_vhangup),
6435                         prefix, yes_no(c->tty_vt_disallocate),
6436                         prefix, c->tty_rows,
6437                         prefix, c->tty_cols);
6438
6439         if (IN_SET(c->std_output,
6440                    EXEC_OUTPUT_KMSG,
6441                    EXEC_OUTPUT_JOURNAL,
6442                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
6443                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE) ||
6444             IN_SET(c->std_error,
6445                    EXEC_OUTPUT_KMSG,
6446                    EXEC_OUTPUT_JOURNAL,
6447                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
6448                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE)) {
6449
6450                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
6451
6452                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
6453                 if (r >= 0)
6454                         fprintf(f, "%sSyslogFacility: %s\n", prefix, fac_str);
6455
6456                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
6457                 if (r >= 0)
6458                         fprintf(f, "%sSyslogLevel: %s\n", prefix, lvl_str);
6459         }
6460
6461         if (c->log_level_max >= 0) {
6462                 _cleanup_free_ char *t = NULL;
6463
6464                 (void) log_level_to_string_alloc(c->log_level_max, &t);
6465
6466                 fprintf(f, "%sLogLevelMax: %s\n", prefix, strna(t));
6467         }
6468
6469         if (c->log_ratelimit_interval_usec > 0)
6470                 fprintf(f,
6471                         "%sLogRateLimitIntervalSec: %s\n",
6472                         prefix, FORMAT_TIMESPAN(c->log_ratelimit_interval_usec, USEC_PER_SEC));
6473
6474         if (c->log_ratelimit_burst > 0)
6475                 fprintf(f, "%sLogRateLimitBurst: %u\n", prefix, c->log_ratelimit_burst);
6476
6477         if (!set_isempty(c->log_filter_allowed_patterns) || !set_isempty(c->log_filter_denied_patterns)) {
6478                 fprintf(f, "%sLogFilterPatterns:", prefix);
6479
6480                 char *pattern;
6481                 SET_FOREACH(pattern, c->log_filter_allowed_patterns)
6482                         fprintf(f, " %s", pattern);
6483                 SET_FOREACH(pattern, c->log_filter_denied_patterns)
6484                         fprintf(f, " ~%s", pattern);
6485                 fputc('\n', f);
6486         }
6487
6488         for (size_t j = 0; j < c->n_log_extra_fields; j++) {
6489                 fprintf(f, "%sLogExtraFields: ", prefix);
6490                 fwrite(c->log_extra_fields[j].iov_base,
6491                        1, c->log_extra_fields[j].iov_len,
6492                        f);
6493                 fputc('\n', f);
6494         }
6495
6496         if (c->log_namespace)
6497                 fprintf(f, "%sLogNamespace: %s\n", prefix, c->log_namespace);
6498
6499         if (c->secure_bits) {
6500                 _cleanup_free_ char *str = NULL;
6501
6502                 r = secure_bits_to_string_alloc(c->secure_bits, &str);
6503                 if (r >= 0)
6504                         fprintf(f, "%sSecure Bits: %s\n", prefix, str);
6505         }
6506
6507         if (c->capability_bounding_set != CAP_MASK_UNSET) {
6508                 _cleanup_free_ char *str = NULL;
6509
6510                 r = capability_set_to_string(c->capability_bounding_set, &str);
6511                 if (r >= 0)
6512                         fprintf(f, "%sCapabilityBoundingSet: %s\n", prefix, str);
6513         }
6514
6515         if (c->capability_ambient_set != 0) {
6516                 _cleanup_free_ char *str = NULL;
6517
6518                 r = capability_set_to_string(c->capability_ambient_set, &str);
6519                 if (r >= 0)
6520                         fprintf(f, "%sAmbientCapabilities: %s\n", prefix, str);
6521         }
6522
6523         if (c->user)
6524                 fprintf(f, "%sUser: %s\n", prefix, c->user);
6525         if (c->group)
6526                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
6527
6528         fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
6529
6530         strv_dump(f, prefix, "SupplementaryGroups", c->supplementary_groups);
6531
6532         if (c->pam_name)
6533                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
6534
6535         strv_dump(f, prefix, "ReadWritePaths", c->read_write_paths);
6536         strv_dump(f, prefix, "ReadOnlyPaths", c->read_only_paths);
6537         strv_dump(f, prefix, "InaccessiblePaths", c->inaccessible_paths);
6538         strv_dump(f, prefix, "ExecPaths", c->exec_paths);
6539         strv_dump(f, prefix, "NoExecPaths", c->no_exec_paths);
6540         strv_dump(f, prefix, "ExecSearchPath", c->exec_search_path);
6541
6542         for (size_t i = 0; i < c->n_bind_mounts; i++)
6543                 fprintf(f, "%s%s: %s%s:%s:%s\n", prefix,
6544                         c->bind_mounts[i].read_only ? "BindReadOnlyPaths" : "BindPaths",
6545                         c->bind_mounts[i].ignore_enoent ? "-": "",
6546                         c->bind_mounts[i].source,
6547                         c->bind_mounts[i].destination,
6548                         c->bind_mounts[i].recursive ? "rbind" : "norbind");
6549
6550         for (size_t i = 0; i < c->n_temporary_filesystems; i++) {
6551                 const TemporaryFileSystem *t = c->temporary_filesystems + i;
6552
6553                 fprintf(f, "%sTemporaryFileSystem: %s%s%s\n", prefix,
6554                         t->path,
6555                         isempty(t->options) ? "" : ":",
6556                         strempty(t->options));
6557         }
6558
6559         if (c->utmp_id)
6560                 fprintf(f,
6561                         "%sUtmpIdentifier: %s\n",
6562                         prefix, c->utmp_id);
6563
6564         if (c->selinux_context)
6565                 fprintf(f,
6566                         "%sSELinuxContext: %s%s\n",
6567                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
6568
6569         if (c->apparmor_profile)
6570                 fprintf(f,
6571                         "%sAppArmorProfile: %s%s\n",
6572                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
6573
6574         if (c->smack_process_label)
6575                 fprintf(f,
6576                         "%sSmackProcessLabel: %s%s\n",
6577                         prefix, c->smack_process_label_ignore ? "-" : "", c->smack_process_label);
6578
6579         if (c->personality != PERSONALITY_INVALID)
6580                 fprintf(f,
6581                         "%sPersonality: %s\n",
6582                         prefix, strna(personality_to_string(c->personality)));
6583
6584         fprintf(f,
6585                 "%sLockPersonality: %s\n",
6586                 prefix, yes_no(c->lock_personality));
6587
6588         if (c->syscall_filter) {
6589                 fprintf(f,
6590                         "%sSystemCallFilter: ",
6591                         prefix);
6592
6593                 if (!c->syscall_allow_list)
6594                         fputc('~', f);
6595
6596 #if HAVE_SECCOMP
6597                 void *id, *val;
6598                 bool first = true;
6599                 HASHMAP_FOREACH_KEY(val, id, c->syscall_filter) {
6600                         _cleanup_free_ char *name = NULL;
6601                         const char *errno_name = NULL;
6602                         int num = PTR_TO_INT(val);
6603
6604                         if (first)
6605                                 first = false;
6606                         else
6607                                 fputc(' ', f);
6608
6609                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
6610                         fputs(strna(name), f);
6611
6612                         if (num >= 0) {
6613                                 errno_name = seccomp_errno_or_action_to_string(num);
6614                                 if (errno_name)
6615                                         fprintf(f, ":%s", errno_name);
6616                                 else
6617                                         fprintf(f, ":%d", num);
6618                         }
6619                 }
6620 #endif
6621
6622                 fputc('\n', f);
6623         }
6624
6625         if (c->syscall_archs) {
6626                 fprintf(f,
6627                         "%sSystemCallArchitectures:",
6628                         prefix);
6629
6630 #if HAVE_SECCOMP
6631                 void *id;
6632                 SET_FOREACH(id, c->syscall_archs)
6633                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
6634 #endif
6635                 fputc('\n', f);
6636         }
6637
6638         if (exec_context_restrict_namespaces_set(c)) {
6639                 _cleanup_free_ char *s = NULL;
6640
6641                 r = namespace_flags_to_string(c->restrict_namespaces, &s);
6642                 if (r >= 0)
6643                         fprintf(f, "%sRestrictNamespaces: %s\n",
6644                                 prefix, strna(s));
6645         }
6646
6647 #if HAVE_LIBBPF
6648         if (exec_context_restrict_filesystems_set(c)) {
6649                 char *fs;
6650                 SET_FOREACH(fs, c->restrict_filesystems)
6651                         fprintf(f, "%sRestrictFileSystems: %s\n", prefix, fs);
6652         }
6653 #endif
6654
6655         if (c->network_namespace_path)
6656                 fprintf(f,
6657                         "%sNetworkNamespacePath: %s\n",
6658                         prefix, c->network_namespace_path);
6659
6660         if (c->syscall_errno > 0) {
6661                 fprintf(f, "%sSystemCallErrorNumber: ", prefix);
6662
6663 #if HAVE_SECCOMP
6664                 const char *errno_name = seccomp_errno_or_action_to_string(c->syscall_errno);
6665                 if (errno_name)
6666                         fputs(errno_name, f);
6667                 else
6668                         fprintf(f, "%d", c->syscall_errno);
6669 #endif
6670                 fputc('\n', f);
6671         }
6672
6673         for (size_t i = 0; i < c->n_mount_images; i++) {
6674                 fprintf(f, "%sMountImages: %s%s:%s", prefix,
6675                         c->mount_images[i].ignore_enoent ? "-": "",
6676                         c->mount_images[i].source,
6677                         c->mount_images[i].destination);
6678                 LIST_FOREACH(mount_options, o, c->mount_images[i].mount_options)
6679                         fprintf(f, ":%s:%s",
6680                                 partition_designator_to_string(o->partition_designator),
6681                                 strempty(o->options));
6682                 fprintf(f, "\n");
6683         }
6684
6685         for (size_t i = 0; i < c->n_extension_images; i++) {
6686                 fprintf(f, "%sExtensionImages: %s%s", prefix,
6687                         c->extension_images[i].ignore_enoent ? "-": "",
6688                         c->extension_images[i].source);
6689                 LIST_FOREACH(mount_options, o, c->extension_images[i].mount_options)
6690                         fprintf(f, ":%s:%s",
6691                                 partition_designator_to_string(o->partition_designator),
6692                                 strempty(o->options));
6693                 fprintf(f, "\n");
6694         }
6695
6696         strv_dump(f, prefix, "ExtensionDirectories", c->extension_directories);
6697 }
6698
6699 bool exec_context_maintains_privileges(const ExecContext *c) {
6700         assert(c);
6701
6702         /* Returns true if the process forked off would run under
6703          * an unchanged UID or as root. */
6704
6705         if (!c->user)
6706                 return true;
6707
6708         if (streq(c->user, "root") || streq(c->user, "0"))
6709                 return true;
6710
6711         return false;
6712 }
6713
6714 int exec_context_get_effective_ioprio(const ExecContext *c) {
6715         int p;
6716
6717         assert(c);
6718
6719         if (c->ioprio_set)
6720                 return c->ioprio;
6721
6722         p = ioprio_get(IOPRIO_WHO_PROCESS, 0);
6723         if (p < 0)
6724                 return IOPRIO_DEFAULT_CLASS_AND_PRIO;
6725
6726         return ioprio_normalize(p);
6727 }
6728
6729 bool exec_context_get_effective_mount_apivfs(const ExecContext *c) {
6730         assert(c);
6731
6732         /* Explicit setting wins */
6733         if (c->mount_apivfs_set)
6734                 return c->mount_apivfs;
6735
6736         /* Default to "yes" if root directory or image are specified */
6737         if (exec_context_with_rootfs(c))
6738                 return true;
6739
6740         return false;
6741 }
6742
6743 void exec_context_free_log_extra_fields(ExecContext *c) {
6744         assert(c);
6745
6746         for (size_t l = 0; l < c->n_log_extra_fields; l++)
6747                 free(c->log_extra_fields[l].iov_base);
6748         c->log_extra_fields = mfree(c->log_extra_fields);
6749         c->n_log_extra_fields = 0;
6750 }
6751
6752 void exec_context_revert_tty(ExecContext *c) {
6753         _cleanup_close_ int fd = -EBADF;
6754         const char *path;
6755         struct stat st;
6756         int r;
6757
6758         assert(c);
6759
6760         /* First, reset the TTY (possibly kicking everybody else from the TTY) */
6761         exec_context_tty_reset(c, NULL);
6762
6763         /* And then undo what chown_terminal() did earlier. Note that we only do this if we have a path
6764          * configured. If the TTY was passed to us as file descriptor we assume the TTY is opened and managed
6765          * by whoever passed it to us and thus knows better when and how to chmod()/chown() it back. */
6766         if (!exec_context_may_touch_tty(c))
6767                 return;
6768
6769         path = exec_context_tty_path(c);
6770         if (!path)
6771                 return;
6772
6773         fd = open(path, O_PATH|O_CLOEXEC);
6774         if (fd < 0)
6775                 return (void) log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno,
6776                                              "Failed to open TTY inode of '%s' to adjust ownership/access mode, ignoring: %m",
6777                                              path);
6778
6779         if (fstat(fd, &st) < 0)
6780                 return (void) log_warning_errno(errno, "Failed to stat TTY '%s', ignoring: %m", path);
6781
6782         /* Let's add a superficial check that we only do this for stuff that looks like a TTY. We only check
6783          * if things are a character device, since a proper check either means we'd have to open the TTY and
6784          * use isatty(), but we'd rather not do that since opening TTYs comes with all kinds of side-effects
6785          * and is slow. Or we'd have to hardcode dev_t major information, which we'd rather avoid. Why bother
6786          * with this at all? → https://github.com/systemd/systemd/issues/19213 */
6787         if (!S_ISCHR(st.st_mode))
6788                 return log_warning("Configured TTY '%s' is not actually a character device, ignoring.", path);
6789
6790         r = fchmod_and_chown(fd, TTY_MODE, 0, TTY_GID);
6791         if (r < 0)
6792                 log_warning_errno(r, "Failed to reset TTY ownership/access mode of %s, ignoring: %m", path);
6793 }
6794
6795 int exec_context_get_clean_directories(
6796                 ExecContext *c,
6797                 char **prefix,
6798                 ExecCleanMask mask,
6799                 char ***ret) {
6800
6801         _cleanup_strv_free_ char **l = NULL;
6802         int r;
6803
6804         assert(c);
6805         assert(prefix);
6806         assert(ret);
6807
6808         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
6809                 if (!FLAGS_SET(mask, 1U << t))
6810                         continue;
6811
6812                 if (!prefix[t])
6813                         continue;
6814
6815                 for (size_t i = 0; i < c->directories[t].n_items; i++) {
6816                         char *j;
6817
6818                         j = path_join(prefix[t], c->directories[t].items[i].path);
6819                         if (!j)
6820                                 return -ENOMEM;
6821
6822                         r = strv_consume(&l, j);
6823                         if (r < 0)
6824                                 return r;
6825
6826                         /* Also remove private directories unconditionally. */
6827                         if (t != EXEC_DIRECTORY_CONFIGURATION) {
6828                                 j = path_join(prefix[t], "private", c->directories[t].items[i].path);
6829                                 if (!j)
6830                                         return -ENOMEM;
6831
6832                                 r = strv_consume(&l, j);
6833                                 if (r < 0)
6834                                         return r;
6835                         }
6836
6837                         STRV_FOREACH(symlink, c->directories[t].items[i].symlinks) {
6838                                 j = path_join(prefix[t], *symlink);
6839                                 if (!j)
6840                                         return -ENOMEM;
6841
6842                                 r = strv_consume(&l, j);
6843                                 if (r < 0)
6844                                         return r;
6845                         }
6846                 }
6847         }
6848
6849         *ret = TAKE_PTR(l);
6850         return 0;
6851 }
6852
6853 int exec_context_get_clean_mask(ExecContext *c, ExecCleanMask *ret) {
6854         ExecCleanMask mask = 0;
6855
6856         assert(c);
6857         assert(ret);
6858
6859         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++)
6860                 if (c->directories[t].n_items > 0)
6861                         mask |= 1U << t;
6862
6863         *ret = mask;
6864         return 0;
6865 }
6866
6867 bool exec_context_has_encrypted_credentials(ExecContext *c) {
6868         ExecLoadCredential *load_cred;
6869         ExecSetCredential *set_cred;
6870
6871         assert(c);
6872
6873         HASHMAP_FOREACH(load_cred, c->load_credentials)
6874                 if (load_cred->encrypted)
6875                         return true;
6876
6877         HASHMAP_FOREACH(set_cred, c->set_credentials)
6878                 if (set_cred->encrypted)
6879                         return true;
6880
6881         return false;
6882 }
6883
6884 int exec_context_add_default_dependencies(Unit *u, const ExecContext *c) {
6885         assert(u);
6886         assert(u->default_dependencies);
6887
6888         if (c && exec_context_needs_term(c))
6889                 return unit_add_dependency_by_name(u, UNIT_AFTER, SPECIAL_VCONSOLE_SETUP_SERVICE,
6890                                                    /* add_reference= */ true, UNIT_DEPENDENCY_DEFAULT);
6891         return 0;
6892 }
6893
6894 void exec_status_start(ExecStatus *s, pid_t pid) {
6895         assert(s);
6896
6897         *s = (ExecStatus) {
6898                 .pid = pid,
6899         };
6900
6901         dual_timestamp_get(&s->start_timestamp);
6902 }
6903
6904 void exec_status_exit(ExecStatus *s, const ExecContext *context, pid_t pid, int code, int status) {
6905         assert(s);
6906
6907         if (s->pid != pid)
6908                 *s = (ExecStatus) {
6909                         .pid = pid,
6910                 };
6911
6912         dual_timestamp_get(&s->exit_timestamp);
6913
6914         s->code = code;
6915         s->status = status;
6916
6917         if (context && context->utmp_id)
6918                 (void) utmp_put_dead_process(context->utmp_id, pid, code, status);
6919 }
6920
6921 void exec_status_reset(ExecStatus *s) {
6922         assert(s);
6923
6924         *s = (ExecStatus) {};
6925 }
6926
6927 void exec_status_dump(const ExecStatus *s, FILE *f, const char *prefix) {
6928         assert(s);
6929         assert(f);
6930
6931         if (s->pid <= 0)
6932                 return;
6933
6934         prefix = strempty(prefix);
6935
6936         fprintf(f,
6937                 "%sPID: "PID_FMT"\n",
6938                 prefix, s->pid);
6939
6940         if (dual_timestamp_is_set(&s->start_timestamp))
6941                 fprintf(f,
6942                         "%sStart Timestamp: %s\n",
6943                         prefix, FORMAT_TIMESTAMP(s->start_timestamp.realtime));
6944
6945         if (dual_timestamp_is_set(&s->exit_timestamp))
6946                 fprintf(f,
6947                         "%sExit Timestamp: %s\n"
6948                         "%sExit Code: %s\n"
6949                         "%sExit Status: %i\n",
6950                         prefix, FORMAT_TIMESTAMP(s->exit_timestamp.realtime),
6951                         prefix, sigchld_code_to_string(s->code),
6952                         prefix, s->status);
6953 }
6954
6955 static void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
6956         _cleanup_free_ char *cmd = NULL;
6957         const char *prefix2;
6958
6959         assert(c);
6960         assert(f);
6961
6962         prefix = strempty(prefix);
6963         prefix2 = strjoina(prefix, "\t");
6964
6965         cmd = quote_command_line(c->argv, SHELL_ESCAPE_EMPTY);
6966
6967         fprintf(f,
6968                 "%sCommand Line: %s\n",
6969                 prefix, strnull(cmd));
6970
6971         exec_status_dump(&c->exec_status, f, prefix2);
6972 }
6973
6974 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
6975         assert(f);
6976
6977         prefix = strempty(prefix);
6978
6979         LIST_FOREACH(command, i, c)
6980                 exec_command_dump(i, f, prefix);
6981 }
6982
6983 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
6984         ExecCommand *end;
6985
6986         assert(l);
6987         assert(e);
6988
6989         if (*l) {
6990                 /* It's kind of important, that we keep the order here */
6991                 end = LIST_FIND_TAIL(command, *l);
6992                 LIST_INSERT_AFTER(command, *l, end, e);
6993         } else
6994                 *l = e;
6995 }
6996
6997 int exec_command_set(ExecCommand *c, const char *path, ...) {
6998         va_list ap;
6999         char **l, *p;
7000
7001         assert(c);
7002         assert(path);
7003
7004         va_start(ap, path);
7005         l = strv_new_ap(path, ap);
7006         va_end(ap);
7007
7008         if (!l)
7009                 return -ENOMEM;
7010
7011         p = strdup(path);
7012         if (!p) {
7013                 strv_free(l);
7014                 return -ENOMEM;
7015         }
7016
7017         free_and_replace(c->path, p);
7018
7019         return strv_free_and_replace(c->argv, l);
7020 }
7021
7022 int exec_command_append(ExecCommand *c, const char *path, ...) {
7023         _cleanup_strv_free_ char **l = NULL;
7024         va_list ap;
7025         int r;
7026
7027         assert(c);
7028         assert(path);
7029
7030         va_start(ap, path);
7031         l = strv_new_ap(path, ap);
7032         va_end(ap);
7033
7034         if (!l)
7035                 return -ENOMEM;
7036
7037         r = strv_extend_strv(&c->argv, l, false);
7038         if (r < 0)
7039                 return r;
7040
7041         return 0;
7042 }
7043
7044 static void *remove_tmpdir_thread(void *p) {
7045         _cleanup_free_ char *path = p;
7046
7047         (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
7048         return NULL;
7049 }
7050
7051 static ExecSharedRuntime* exec_shared_runtime_free(ExecSharedRuntime *rt) {
7052         if (!rt)
7053                 return NULL;
7054
7055         if (rt->manager)
7056                 (void) hashmap_remove(rt->manager->exec_shared_runtime_by_id, rt->id);
7057
7058         rt->id = mfree(rt->id);
7059         rt->tmp_dir = mfree(rt->tmp_dir);
7060         rt->var_tmp_dir = mfree(rt->var_tmp_dir);
7061         safe_close_pair(rt->netns_storage_socket);
7062         safe_close_pair(rt->ipcns_storage_socket);
7063         return mfree(rt);
7064 }
7065
7066 DEFINE_TRIVIAL_UNREF_FUNC(ExecSharedRuntime, exec_shared_runtime, exec_shared_runtime_free);
7067 DEFINE_TRIVIAL_CLEANUP_FUNC(ExecSharedRuntime*, exec_shared_runtime_free);
7068
7069 ExecSharedRuntime* exec_shared_runtime_destroy(ExecSharedRuntime *rt) {
7070         int r;
7071
7072         if (!rt)
7073                 return NULL;
7074
7075         assert(rt->n_ref > 0);
7076         rt->n_ref--;
7077
7078         if (rt->n_ref > 0)
7079                 return NULL;
7080
7081         if (rt->tmp_dir && !streq(rt->tmp_dir, RUN_SYSTEMD_EMPTY)) {
7082                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
7083
7084                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
7085                 if (r < 0)
7086                         log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
7087                 else
7088                         rt->tmp_dir = NULL;
7089         }
7090
7091         if (rt->var_tmp_dir && !streq(rt->var_tmp_dir, RUN_SYSTEMD_EMPTY)) {
7092                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
7093
7094                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
7095                 if (r < 0)
7096                         log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
7097                 else
7098                         rt->var_tmp_dir = NULL;
7099         }
7100
7101         return exec_shared_runtime_free(rt);
7102 }
7103
7104 static int exec_shared_runtime_allocate(ExecSharedRuntime **ret, const char *id) {
7105         _cleanup_free_ char *id_copy = NULL;
7106         ExecSharedRuntime *n;
7107
7108         assert(ret);
7109
7110         id_copy = strdup(id);
7111         if (!id_copy)
7112                 return -ENOMEM;
7113
7114         n = new(ExecSharedRuntime, 1);
7115         if (!n)
7116                 return -ENOMEM;
7117
7118         *n = (ExecSharedRuntime) {
7119                 .id = TAKE_PTR(id_copy),
7120                 .netns_storage_socket = PIPE_EBADF,
7121                 .ipcns_storage_socket = PIPE_EBADF,
7122         };
7123
7124         *ret = n;
7125         return 0;
7126 }
7127
7128 static int exec_shared_runtime_add(
7129                 Manager *m,
7130                 const char *id,
7131                 char **tmp_dir,
7132                 char **var_tmp_dir,
7133                 int netns_storage_socket[2],
7134                 int ipcns_storage_socket[2],
7135                 ExecSharedRuntime **ret) {
7136
7137         _cleanup_(exec_shared_runtime_freep) ExecSharedRuntime *rt = NULL;
7138         int r;
7139
7140         assert(m);
7141         assert(id);
7142
7143         /* tmp_dir, var_tmp_dir, {net,ipc}ns_storage_socket fds are donated on success */
7144
7145         r = exec_shared_runtime_allocate(&rt, id);
7146         if (r < 0)
7147                 return r;
7148
7149         r = hashmap_ensure_put(&m->exec_shared_runtime_by_id, &string_hash_ops, rt->id, rt);
7150         if (r < 0)
7151                 return r;
7152
7153         assert(!!rt->tmp_dir == !!rt->var_tmp_dir); /* We require both to be set together */
7154         rt->tmp_dir = TAKE_PTR(*tmp_dir);
7155         rt->var_tmp_dir = TAKE_PTR(*var_tmp_dir);
7156
7157         if (netns_storage_socket) {
7158                 rt->netns_storage_socket[0] = TAKE_FD(netns_storage_socket[0]);
7159                 rt->netns_storage_socket[1] = TAKE_FD(netns_storage_socket[1]);
7160         }
7161
7162         if (ipcns_storage_socket) {
7163                 rt->ipcns_storage_socket[0] = TAKE_FD(ipcns_storage_socket[0]);
7164                 rt->ipcns_storage_socket[1] = TAKE_FD(ipcns_storage_socket[1]);
7165         }
7166
7167         rt->manager = m;
7168
7169         if (ret)
7170                 *ret = rt;
7171         /* do not remove created ExecSharedRuntime object when the operation succeeds. */
7172         TAKE_PTR(rt);
7173         return 0;
7174 }
7175
7176 static int exec_shared_runtime_make(
7177                 Manager *m,
7178                 const ExecContext *c,
7179                 const char *id,
7180                 ExecSharedRuntime **ret) {
7181
7182         _cleanup_(namespace_cleanup_tmpdirp) char *tmp_dir = NULL, *var_tmp_dir = NULL;
7183         _cleanup_close_pair_ int netns_storage_socket[2] = PIPE_EBADF, ipcns_storage_socket[2] = PIPE_EBADF;
7184         int r;
7185
7186         assert(m);
7187         assert(c);
7188         assert(id);
7189
7190         /* It is not necessary to create ExecSharedRuntime object. */
7191         if (!exec_needs_network_namespace(c) && !exec_needs_ipc_namespace(c) && !c->private_tmp) {
7192                 *ret = NULL;
7193                 return 0;
7194         }
7195
7196         if (c->private_tmp &&
7197             !(prefixed_path_strv_contains(c->inaccessible_paths, "/tmp") &&
7198               (prefixed_path_strv_contains(c->inaccessible_paths, "/var/tmp") ||
7199                prefixed_path_strv_contains(c->inaccessible_paths, "/var")))) {
7200                 r = setup_tmp_dirs(id, &tmp_dir, &var_tmp_dir);
7201                 if (r < 0)
7202                         return r;
7203         }
7204
7205         if (exec_needs_network_namespace(c)) {
7206                 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, netns_storage_socket) < 0)
7207                         return -errno;
7208         }
7209
7210         if (exec_needs_ipc_namespace(c)) {
7211                 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, ipcns_storage_socket) < 0)
7212                         return -errno;
7213         }
7214
7215         r = exec_shared_runtime_add(m, id, &tmp_dir, &var_tmp_dir, netns_storage_socket, ipcns_storage_socket, ret);
7216         if (r < 0)
7217                 return r;
7218
7219         return 1;
7220 }
7221
7222 int exec_shared_runtime_acquire(Manager *m, const ExecContext *c, const char *id, bool create, ExecSharedRuntime **ret) {
7223         ExecSharedRuntime *rt;
7224         int r;
7225
7226         assert(m);
7227         assert(id);
7228         assert(ret);
7229
7230         rt = hashmap_get(m->exec_shared_runtime_by_id, id);
7231         if (rt)
7232                 /* We already have an ExecSharedRuntime object, let's increase the ref count and reuse it */
7233                 goto ref;
7234
7235         if (!create) {
7236                 *ret = NULL;
7237                 return 0;
7238         }
7239
7240         /* If not found, then create a new object. */
7241         r = exec_shared_runtime_make(m, c, id, &rt);
7242         if (r < 0)
7243                 return r;
7244         if (r == 0) {
7245                 /* When r == 0, it is not necessary to create ExecSharedRuntime object. */
7246                 *ret = NULL;
7247                 return 0;
7248         }
7249
7250 ref:
7251         /* increment reference counter. */
7252         rt->n_ref++;
7253         *ret = rt;
7254         return 1;
7255 }
7256
7257 int exec_shared_runtime_serialize(const Manager *m, FILE *f, FDSet *fds) {
7258         ExecSharedRuntime *rt;
7259
7260         assert(m);
7261         assert(f);
7262         assert(fds);
7263
7264         HASHMAP_FOREACH(rt, m->exec_shared_runtime_by_id) {
7265                 fprintf(f, "exec-runtime=%s", rt->id);
7266
7267                 if (rt->tmp_dir)
7268                         fprintf(f, " tmp-dir=%s", rt->tmp_dir);
7269
7270                 if (rt->var_tmp_dir)
7271                         fprintf(f, " var-tmp-dir=%s", rt->var_tmp_dir);
7272
7273                 if (rt->netns_storage_socket[0] >= 0) {
7274                         int copy;
7275
7276                         copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
7277                         if (copy < 0)
7278                                 return copy;
7279
7280                         fprintf(f, " netns-socket-0=%i", copy);
7281                 }
7282
7283                 if (rt->netns_storage_socket[1] >= 0) {
7284                         int copy;
7285
7286                         copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
7287                         if (copy < 0)
7288                                 return copy;
7289
7290                         fprintf(f, " netns-socket-1=%i", copy);
7291                 }
7292
7293                 if (rt->ipcns_storage_socket[0] >= 0) {
7294                         int copy;
7295
7296                         copy = fdset_put_dup(fds, rt->ipcns_storage_socket[0]);
7297                         if (copy < 0)
7298                                 return copy;
7299
7300                         fprintf(f, " ipcns-socket-0=%i", copy);
7301                 }
7302
7303                 if (rt->ipcns_storage_socket[1] >= 0) {
7304                         int copy;
7305
7306                         copy = fdset_put_dup(fds, rt->ipcns_storage_socket[1]);
7307                         if (copy < 0)
7308                                 return copy;
7309
7310                         fprintf(f, " ipcns-socket-1=%i", copy);
7311                 }
7312
7313                 fputc('\n', f);
7314         }
7315
7316         return 0;
7317 }
7318
7319 int exec_shared_runtime_deserialize_compat(Unit *u, const char *key, const char *value, FDSet *fds) {
7320         _cleanup_(exec_shared_runtime_freep) ExecSharedRuntime *rt_create = NULL;
7321         ExecSharedRuntime *rt;
7322         int r;
7323
7324         /* This is for the migration from old (v237 or earlier) deserialization text.
7325          * Due to the bug #7790, this may not work with the units that use JoinsNamespaceOf=.
7326          * Even if the ExecSharedRuntime object originally created by the other unit, we cannot judge
7327          * so or not from the serialized text, then we always creates a new object owned by this. */
7328
7329         assert(u);
7330         assert(key);
7331         assert(value);
7332
7333         /* Manager manages ExecSharedRuntime objects by the unit id.
7334          * So, we omit the serialized text when the unit does not have id (yet?)... */
7335         if (isempty(u->id)) {
7336                 log_unit_debug(u, "Invocation ID not found. Dropping runtime parameter.");
7337                 return 0;
7338         }
7339
7340         if (hashmap_ensure_allocated(&u->manager->exec_shared_runtime_by_id, &string_hash_ops) < 0)
7341                 return log_oom();
7342
7343         rt = hashmap_get(u->manager->exec_shared_runtime_by_id, u->id);
7344         if (!rt) {
7345                 if (exec_shared_runtime_allocate(&rt_create, u->id) < 0)
7346                         return log_oom();
7347
7348                 rt = rt_create;
7349         }
7350
7351         if (streq(key, "tmp-dir")) {
7352                 if (free_and_strdup_warn(&rt->tmp_dir, value) < 0)
7353                         return -ENOMEM;
7354
7355         } else if (streq(key, "var-tmp-dir")) {
7356                 if (free_and_strdup_warn(&rt->var_tmp_dir, value) < 0)
7357                         return -ENOMEM;
7358
7359         } else if (streq(key, "netns-socket-0")) {
7360                 int fd;
7361
7362                 if ((fd = parse_fd(value)) < 0 || !fdset_contains(fds, fd)) {
7363                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
7364                         return 0;
7365                 }
7366
7367                 safe_close(rt->netns_storage_socket[0]);
7368                 rt->netns_storage_socket[0] = fdset_remove(fds, fd);
7369
7370         } else if (streq(key, "netns-socket-1")) {
7371                 int fd;
7372
7373                 if ((fd = parse_fd(value)) < 0 || !fdset_contains(fds, fd)) {
7374                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
7375                         return 0;
7376                 }
7377
7378                 safe_close(rt->netns_storage_socket[1]);
7379                 rt->netns_storage_socket[1] = fdset_remove(fds, fd);
7380
7381         } else
7382                 return 0;
7383
7384         /* If the object is newly created, then put it to the hashmap which manages ExecSharedRuntime objects. */
7385         if (rt_create) {
7386                 r = hashmap_put(u->manager->exec_shared_runtime_by_id, rt_create->id, rt_create);
7387                 if (r < 0) {
7388                         log_unit_debug_errno(u, r, "Failed to put runtime parameter to manager's storage: %m");
7389                         return 0;
7390                 }
7391
7392                 rt_create->manager = u->manager;
7393
7394                 /* Avoid cleanup */
7395                 TAKE_PTR(rt_create);
7396         }
7397
7398         return 1;
7399 }
7400
7401 int exec_shared_runtime_deserialize_one(Manager *m, const char *value, FDSet *fds) {
7402         _cleanup_free_ char *tmp_dir = NULL, *var_tmp_dir = NULL;
7403         char *id = NULL;
7404         int r, netns_fdpair[] = {-1, -1}, ipcns_fdpair[] = {-1, -1};
7405         const char *p, *v = ASSERT_PTR(value);
7406         size_t n;
7407
7408         assert(m);
7409         assert(fds);
7410
7411         n = strcspn(v, " ");
7412         id = strndupa_safe(v, n);
7413         if (v[n] != ' ')
7414                 goto finalize;
7415         p = v + n + 1;
7416
7417         v = startswith(p, "tmp-dir=");
7418         if (v) {
7419                 n = strcspn(v, " ");
7420                 tmp_dir = strndup(v, n);
7421                 if (!tmp_dir)
7422                         return log_oom();
7423                 if (v[n] != ' ')
7424                         goto finalize;
7425                 p = v + n + 1;
7426         }
7427
7428         v = startswith(p, "var-tmp-dir=");
7429         if (v) {
7430                 n = strcspn(v, " ");
7431                 var_tmp_dir = strndup(v, n);
7432                 if (!var_tmp_dir)
7433                         return log_oom();
7434                 if (v[n] != ' ')
7435                         goto finalize;
7436                 p = v + n + 1;
7437         }
7438
7439         v = startswith(p, "netns-socket-0=");
7440         if (v) {
7441                 char *buf;
7442
7443                 n = strcspn(v, " ");
7444                 buf = strndupa_safe(v, n);
7445
7446                 netns_fdpair[0] = parse_fd(buf);
7447                 if (netns_fdpair[0] < 0)
7448                         return log_debug_errno(netns_fdpair[0], "Unable to parse exec-runtime specification netns-socket-0=%s: %m", buf);
7449                 if (!fdset_contains(fds, netns_fdpair[0]))
7450                         return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
7451                                                "exec-runtime specification netns-socket-0= refers to unknown fd %d: %m", netns_fdpair[0]);
7452                 netns_fdpair[0] = fdset_remove(fds, netns_fdpair[0]);
7453                 if (v[n] != ' ')
7454                         goto finalize;
7455                 p = v + n + 1;
7456         }
7457
7458         v = startswith(p, "netns-socket-1=");
7459         if (v) {
7460                 char *buf;
7461
7462                 n = strcspn(v, " ");
7463                 buf = strndupa_safe(v, n);
7464
7465                 netns_fdpair[1] = parse_fd(buf);
7466                 if (netns_fdpair[1] < 0)
7467                         return log_debug_errno(netns_fdpair[1], "Unable to parse exec-runtime specification netns-socket-1=%s: %m", buf);
7468                 if (!fdset_contains(fds, netns_fdpair[1]))
7469                         return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
7470                                                "exec-runtime specification netns-socket-1= refers to unknown fd %d: %m", netns_fdpair[1]);
7471                 netns_fdpair[1] = fdset_remove(fds, netns_fdpair[1]);
7472                 if (v[n] != ' ')
7473                         goto finalize;
7474                 p = v + n + 1;
7475         }
7476
7477         v = startswith(p, "ipcns-socket-0=");
7478         if (v) {
7479                 char *buf;
7480
7481                 n = strcspn(v, " ");
7482                 buf = strndupa_safe(v, n);
7483
7484                 ipcns_fdpair[0] = parse_fd(buf);
7485                 if (ipcns_fdpair[0] < 0)
7486                         return log_debug_errno(ipcns_fdpair[0], "Unable to parse exec-runtime specification ipcns-socket-0=%s: %m", buf);
7487                 if (!fdset_contains(fds, ipcns_fdpair[0]))
7488                         return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
7489                                                "exec-runtime specification ipcns-socket-0= refers to unknown fd %d: %m", ipcns_fdpair[0]);
7490                 ipcns_fdpair[0] = fdset_remove(fds, ipcns_fdpair[0]);
7491                 if (v[n] != ' ')
7492                         goto finalize;
7493                 p = v + n + 1;
7494         }
7495
7496         v = startswith(p, "ipcns-socket-1=");
7497         if (v) {
7498                 char *buf;
7499
7500                 n = strcspn(v, " ");
7501                 buf = strndupa_safe(v, n);
7502
7503                 ipcns_fdpair[1] = parse_fd(buf);
7504                 if (ipcns_fdpair[1] < 0)
7505                         return log_debug_errno(ipcns_fdpair[1], "Unable to parse exec-runtime specification ipcns-socket-1=%s: %m", buf);
7506                 if (!fdset_contains(fds, ipcns_fdpair[1]))
7507                         return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
7508                                                "exec-runtime specification ipcns-socket-1= refers to unknown fd %d: %m", ipcns_fdpair[1]);
7509                 ipcns_fdpair[1] = fdset_remove(fds, ipcns_fdpair[1]);
7510         }
7511
7512 finalize:
7513         r = exec_shared_runtime_add(m, id, &tmp_dir, &var_tmp_dir, netns_fdpair, ipcns_fdpair, NULL);
7514         if (r < 0)
7515                 return log_debug_errno(r, "Failed to add exec-runtime: %m");
7516         return 0;
7517 }
7518
7519 void exec_shared_runtime_vacuum(Manager *m) {
7520         ExecSharedRuntime *rt;
7521
7522         assert(m);
7523
7524         /* Free unreferenced ExecSharedRuntime objects. This is used after manager deserialization process. */
7525
7526         HASHMAP_FOREACH(rt, m->exec_shared_runtime_by_id) {
7527                 if (rt->n_ref > 0)
7528                         continue;
7529
7530                 (void) exec_shared_runtime_free(rt);
7531         }
7532 }
7533
7534 int exec_runtime_make(ExecSharedRuntime *shared, DynamicCreds *creds, ExecRuntime **ret) {
7535         _cleanup_(exec_runtime_freep) ExecRuntime *rt = NULL;
7536
7537         assert(ret);
7538
7539         if (!shared && !creds) {
7540                 *ret = NULL;
7541                 return 0;
7542         }
7543
7544         rt = new(ExecRuntime, 1);
7545         if (!rt)
7546                 return -ENOMEM;
7547
7548         *rt = (ExecRuntime) {
7549                 .shared = shared,
7550                 .dynamic_creds = creds,
7551         };
7552
7553         *ret = TAKE_PTR(rt);
7554         return 1;
7555 }
7556
7557 ExecRuntime* exec_runtime_free(ExecRuntime *rt) {
7558         if (!rt)
7559                 return NULL;
7560
7561         exec_shared_runtime_unref(rt->shared);
7562         dynamic_creds_unref(rt->dynamic_creds);
7563         return mfree(rt);
7564 }
7565
7566 ExecRuntime* exec_runtime_destroy(ExecRuntime *rt) {
7567         if (!rt)
7568                 return NULL;
7569
7570         rt->shared = exec_shared_runtime_destroy(rt->shared);
7571         rt->dynamic_creds = dynamic_creds_destroy(rt->dynamic_creds);
7572         return exec_runtime_free(rt);
7573 }
7574
7575 void exec_params_clear(ExecParameters *p) {
7576         if (!p)
7577                 return;
7578
7579         p->environment = strv_free(p->environment);
7580         p->fd_names = strv_free(p->fd_names);
7581         p->fds = mfree(p->fds);
7582         p->exec_fd = safe_close(p->exec_fd);
7583 }
7584
7585 ExecSetCredential *exec_set_credential_free(ExecSetCredential *sc) {
7586         if (!sc)
7587                 return NULL;
7588
7589         free(sc->id);
7590         free(sc->data);
7591         return mfree(sc);
7592 }
7593
7594 ExecLoadCredential *exec_load_credential_free(ExecLoadCredential *lc) {
7595         if (!lc)
7596                 return NULL;
7597
7598         free(lc->id);
7599         free(lc->path);
7600         return mfree(lc);
7601 }
7602
7603 void exec_directory_done(ExecDirectory *d) {
7604         if (!d)
7605                 return;
7606
7607         for (size_t i = 0; i < d->n_items; i++) {
7608                 free(d->items[i].path);
7609                 strv_free(d->items[i].symlinks);
7610         }
7611
7612         d->items = mfree(d->items);
7613         d->n_items = 0;
7614         d->mode = 0755;
7615 }
7616
7617 static ExecDirectoryItem *exec_directory_find(ExecDirectory *d, const char *path) {
7618         assert(d);
7619         assert(path);
7620
7621         for (size_t i = 0; i < d->n_items; i++)
7622                 if (path_equal(d->items[i].path, path))
7623                         return &d->items[i];
7624
7625         return NULL;
7626 }
7627
7628 int exec_directory_add(ExecDirectory *d, const char *path, const char *symlink) {
7629         _cleanup_strv_free_ char **s = NULL;
7630         _cleanup_free_ char *p = NULL;
7631         ExecDirectoryItem *existing;
7632         int r;
7633
7634         assert(d);
7635         assert(path);
7636
7637         existing = exec_directory_find(d, path);
7638         if (existing) {
7639                 r = strv_extend(&existing->symlinks, symlink);
7640                 if (r < 0)
7641                         return r;
7642
7643                 return 0; /* existing item is updated */
7644         }
7645
7646         p = strdup(path);
7647         if (!p)
7648                 return -ENOMEM;
7649
7650         if (symlink) {
7651                 s = strv_new(symlink);
7652                 if (!s)
7653                         return -ENOMEM;
7654         }
7655
7656         if (!GREEDY_REALLOC(d->items, d->n_items + 1))
7657                 return -ENOMEM;
7658
7659         d->items[d->n_items++] = (ExecDirectoryItem) {
7660                 .path = TAKE_PTR(p),
7661                 .symlinks = TAKE_PTR(s),
7662         };
7663
7664         return 1; /* new item is added */
7665 }
7666
7667 static int exec_directory_item_compare_func(const ExecDirectoryItem *a, const ExecDirectoryItem *b) {
7668         assert(a);
7669         assert(b);
7670
7671         return path_compare(a->path, b->path);
7672 }
7673
7674 void exec_directory_sort(ExecDirectory *d) {
7675         assert(d);
7676
7677         /* Sort the exec directories to make always parent directories processed at first in
7678          * setup_exec_directory(), e.g., even if StateDirectory=foo/bar foo, we need to create foo at first,
7679          * then foo/bar. Also, set .only_create flag if one of the parent directories is contained in the
7680          * list. See also comments in setup_exec_directory() and issue #24783. */
7681
7682         if (d->n_items <= 1)
7683                 return;
7684
7685         typesafe_qsort(d->items, d->n_items, exec_directory_item_compare_func);
7686
7687         for (size_t i = 1; i < d->n_items; i++)
7688                 for (size_t j = 0; j < i; j++)
7689                         if (path_startswith(d->items[i].path, d->items[j].path)) {
7690                                 d->items[i].only_create = true;
7691                                 break;
7692                         }
7693 }
7694
7695 ExecCleanMask exec_clean_mask_from_string(const char *s) {
7696         ExecDirectoryType t;
7697
7698         assert(s);
7699
7700         if (streq(s, "all"))
7701                 return EXEC_CLEAN_ALL;
7702         if (streq(s, "fdstore"))
7703                 return EXEC_CLEAN_FDSTORE;
7704
7705         t = exec_resource_type_from_string(s);
7706         if (t < 0)
7707                 return (ExecCleanMask) t;
7708
7709         return 1U << t;
7710 }
7711
7712 DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(exec_set_credential_hash_ops, char, string_hash_func, string_compare_func, ExecSetCredential, exec_set_credential_free);
7713 DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(exec_load_credential_hash_ops, char, string_hash_func, string_compare_func, ExecLoadCredential, exec_load_credential_free);
7714
7715 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
7716         [EXEC_INPUT_NULL] = "null",
7717         [EXEC_INPUT_TTY] = "tty",
7718         [EXEC_INPUT_TTY_FORCE] = "tty-force",
7719         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
7720         [EXEC_INPUT_SOCKET] = "socket",
7721         [EXEC_INPUT_NAMED_FD] = "fd",
7722         [EXEC_INPUT_DATA] = "data",
7723         [EXEC_INPUT_FILE] = "file",
7724 };
7725
7726 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
7727
7728 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
7729         [EXEC_OUTPUT_INHERIT] = "inherit",
7730         [EXEC_OUTPUT_NULL] = "null",
7731         [EXEC_OUTPUT_TTY] = "tty",
7732         [EXEC_OUTPUT_KMSG] = "kmsg",
7733         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
7734         [EXEC_OUTPUT_JOURNAL] = "journal",
7735         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
7736         [EXEC_OUTPUT_SOCKET] = "socket",
7737         [EXEC_OUTPUT_NAMED_FD] = "fd",
7738         [EXEC_OUTPUT_FILE] = "file",
7739         [EXEC_OUTPUT_FILE_APPEND] = "append",
7740         [EXEC_OUTPUT_FILE_TRUNCATE] = "truncate",
7741 };
7742
7743 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
7744
7745 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
7746         [EXEC_UTMP_INIT] = "init",
7747         [EXEC_UTMP_LOGIN] = "login",
7748         [EXEC_UTMP_USER] = "user",
7749 };
7750
7751 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);
7752
7753 static const char* const exec_preserve_mode_table[_EXEC_PRESERVE_MODE_MAX] = {
7754         [EXEC_PRESERVE_NO] = "no",
7755         [EXEC_PRESERVE_YES] = "yes",
7756         [EXEC_PRESERVE_RESTART] = "restart",
7757 };
7758
7759 DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(exec_preserve_mode, ExecPreserveMode, EXEC_PRESERVE_YES);
7760
7761 /* This table maps ExecDirectoryType to the setting it is configured with in the unit */
7762 static const char* const exec_directory_type_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7763         [EXEC_DIRECTORY_RUNTIME] = "RuntimeDirectory",
7764         [EXEC_DIRECTORY_STATE] = "StateDirectory",
7765         [EXEC_DIRECTORY_CACHE] = "CacheDirectory",
7766         [EXEC_DIRECTORY_LOGS] = "LogsDirectory",
7767         [EXEC_DIRECTORY_CONFIGURATION] = "ConfigurationDirectory",
7768 };
7769
7770 DEFINE_STRING_TABLE_LOOKUP(exec_directory_type, ExecDirectoryType);
7771
7772 /* This table maps ExecDirectoryType to the symlink setting it is configured with in the unit */
7773 static const char* const exec_directory_type_symlink_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7774         [EXEC_DIRECTORY_RUNTIME]       = "RuntimeDirectorySymlink",
7775         [EXEC_DIRECTORY_STATE]         = "StateDirectorySymlink",
7776         [EXEC_DIRECTORY_CACHE]         = "CacheDirectorySymlink",
7777         [EXEC_DIRECTORY_LOGS]          = "LogsDirectorySymlink",
7778         [EXEC_DIRECTORY_CONFIGURATION] = "ConfigurationDirectorySymlink",
7779 };
7780
7781 DEFINE_STRING_TABLE_LOOKUP(exec_directory_type_symlink, ExecDirectoryType);
7782
7783 /* And this table maps ExecDirectoryType too, but to a generic term identifying the type of resource. This
7784  * one is supposed to be generic enough to be used for unit types that don't use ExecContext and per-unit
7785  * directories, specifically .timer units with their timestamp touch file. */
7786 static const char* const exec_resource_type_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7787         [EXEC_DIRECTORY_RUNTIME] = "runtime",
7788         [EXEC_DIRECTORY_STATE] = "state",
7789         [EXEC_DIRECTORY_CACHE] = "cache",
7790         [EXEC_DIRECTORY_LOGS] = "logs",
7791         [EXEC_DIRECTORY_CONFIGURATION] = "configuration",
7792 };
7793
7794 DEFINE_STRING_TABLE_LOOKUP(exec_resource_type, ExecDirectoryType);
7795
7796 /* And this table also maps ExecDirectoryType, to the environment variable we pass the selected directory to
7797  * the service payload in. */
7798 static const char* const exec_directory_env_name_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7799         [EXEC_DIRECTORY_RUNTIME] = "RUNTIME_DIRECTORY",
7800         [EXEC_DIRECTORY_STATE] = "STATE_DIRECTORY",
7801         [EXEC_DIRECTORY_CACHE] = "CACHE_DIRECTORY",
7802         [EXEC_DIRECTORY_LOGS] = "LOGS_DIRECTORY",
7803         [EXEC_DIRECTORY_CONFIGURATION] = "CONFIGURATION_DIRECTORY",
7804 };
7805
7806 DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(exec_directory_env_name, ExecDirectoryType);
7807
7808 static const char* const exec_keyring_mode_table[_EXEC_KEYRING_MODE_MAX] = {
7809         [EXEC_KEYRING_INHERIT] = "inherit",
7810         [EXEC_KEYRING_PRIVATE] = "private",
7811         [EXEC_KEYRING_SHARED] = "shared",
7812 };
7813
7814 DEFINE_STRING_TABLE_LOOKUP(exec_keyring_mode, ExecKeyringMode);