src/core/execute.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <glob.h>
  23 #include <grp.h>
  24 #include <poll.h>
  25 #include <signal.h>
  26 #include <string.h>
  27 #include <sys/capability.h>
  28 #include <sys/eventfd.h>
  29 #include <sys/mman.h>
  30 #include <sys/personality.h>
  31 #include <sys/prctl.h>
  32 #include <sys/shm.h>
  33 #include <sys/socket.h>
  34 #include <sys/stat.h>
  35 #include <sys/types.h>
  36 #include <sys/un.h>
  37 #include <unistd.h>
  38 #include <utmpx.h>
  39
  40 #ifdef HAVE_PAM
  41 #include <security/pam_appl.h>
  42 #endif
  43
  44 #ifdef HAVE_SELINUX
  45 #include <selinux/selinux.h>
  46 #endif
  47
  48 #ifdef HAVE_SECCOMP
  49 #include <seccomp.h>
  50 #endif
  51
  52 #ifdef HAVE_APPARMOR
  53 #include <sys/apparmor.h>
  54 #endif
  55
  56 #include "sd-messages.h"
  57
  58 #include "af-list.h"
  59 #include "alloc-util.h"
  60 #ifdef HAVE_APPARMOR
  61 #include "apparmor-util.h"
  62 #endif
  63 #include "async.h"
  64 #include "barrier.h"
  65 #include "cap-list.h"
  66 #include "capability-util.h"
  67 #include "def.h"
  68 #include "env-util.h"
  69 #include "errno-list.h"
  70 #include "execute.h"
  71 #include "exit-status.h"
  72 #include "fd-util.h"
  73 #include "fileio.h"
  74 #include "format-util.h"
  75 #include "fs-util.h"
  76 #include "glob-util.h"
  77 #include "io-util.h"
  78 #include "ioprio.h"
  79 #include "log.h"
  80 #include "macro.h"
  81 #include "missing.h"
  82 #include "mkdir.h"
  83 #include "namespace.h"
  84 #include "parse-util.h"
  85 #include "path-util.h"
  86 #include "process-util.h"
  87 #include "rlimit-util.h"
  88 #include "rm-rf.h"
  89 #ifdef HAVE_SECCOMP
  90 #include "seccomp-util.h"
  91 #endif
  92 #include "securebits.h"
  93 #include "selinux-util.h"
  94 #include "signal-util.h"
  95 #include "smack-util.h"
  96 #include "special.h"
  97 #include "string-table.h"
  98 #include "string-util.h"
  99 #include "strv.h"
 100 #include "syslog-util.h"
 101 #include "terminal-util.h"
 102 #include "unit.h"
 103 #include "user-util.h"
 104 #include "util.h"
 105 #include "utmp-wtmp.h"
 106
 107 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
 108 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
 109
 110 /* This assumes there is a 'tty' group */
 111 #define TTY_MODE 0620
 112
 113 #define SNDBUF_SIZE (8*1024*1024)
 114
 115 static int shift_fds(int fds[], unsigned n_fds) {
 116         int start, restart_from;
 117
 118         if (n_fds <= 0)
 119                 return 0;
 120
 121         /* Modifies the fds array! (sorts it) */
 122
 123         assert(fds);
 124
 125         start = 0;
 126         for (;;) {
 127                 int i;
 128
 129                 restart_from = -1;
 130
 131                 for (i = start; i < (int) n_fds; i++) {
 132                         int nfd;
 133
 134                         /* Already at right index? */
 135                         if (fds[i] == i+3)
 136                                 continue;
 137
 138                         nfd = fcntl(fds[i], F_DUPFD, i + 3);
 139                         if (nfd < 0)
 140                                 return -errno;
 141
 142                         safe_close(fds[i]);
 143                         fds[i] = nfd;
 144
 145                         /* Hmm, the fd we wanted isn't free? Then
 146                          * let's remember that and try again from here */
 147                         if (nfd != i+3 && restart_from < 0)
 148                                 restart_from = i;
 149                 }
 150
 151                 if (restart_from < 0)
 152                         break;
 153
 154                 start = restart_from;
 155         }
 156
 157         return 0;
 158 }
 159
 160 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 161         unsigned i;
 162         int r;
 163
 164         if (n_fds <= 0)
 165                 return 0;
 166
 167         assert(fds);
 168
 169         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 170
 171         for (i = 0; i < n_fds; i++) {
 172
 173                 r = fd_nonblock(fds[i], nonblock);
 174                 if (r < 0)
 175                         return r;
 176
 177                 /* We unconditionally drop FD_CLOEXEC from the fds,
 178                  * since after all we want to pass these fds to our
 179                  * children */
 180
 181                 r = fd_cloexec(fds[i], false);
 182                 if (r < 0)
 183                         return r;
 184         }
 185
 186         return 0;
 187 }
 188
 189 static const char *exec_context_tty_path(const ExecContext *context) {
 190         assert(context);
 191
 192         if (context->stdio_as_fds)
 193                 return NULL;
 194
 195         if (context->tty_path)
 196                 return context->tty_path;
 197
 198         return "/dev/console";
 199 }
 200
 201 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
 202         const char *path;
 203
 204         assert(context);
 205
 206         path = exec_context_tty_path(context);
 207
 208         if (context->tty_vhangup) {
 209                 if (p && p->stdin_fd >= 0)
 210                         (void) terminal_vhangup_fd(p->stdin_fd);
 211                 else if (path)
 212                         (void) terminal_vhangup(path);
 213         }
 214
 215         if (context->tty_reset) {
 216                 if (p && p->stdin_fd >= 0)
 217                         (void) reset_terminal_fd(p->stdin_fd, true);
 218                 else if (path)
 219                         (void) reset_terminal(path);
 220         }
 221
 222         if (context->tty_vt_disallocate && path)
 223                 (void) vt_disallocate(path);
 224 }
 225
 226 static bool is_terminal_input(ExecInput i) {
 227         return IN_SET(i,
 228                       EXEC_INPUT_TTY,
 229                       EXEC_INPUT_TTY_FORCE,
 230                       EXEC_INPUT_TTY_FAIL);
 231 }
 232
 233 static bool is_terminal_output(ExecOutput o) {
 234         return IN_SET(o,
 235                       EXEC_OUTPUT_TTY,
 236                       EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 237                       EXEC_OUTPUT_KMSG_AND_CONSOLE,
 238                       EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 239 }
 240
 241 static bool exec_context_needs_term(const ExecContext *c) {
 242         assert(c);
 243
 244         /* Return true if the execution context suggests we should set $TERM to something useful. */
 245
 246         if (is_terminal_input(c->std_input))
 247                 return true;
 248
 249         if (is_terminal_output(c->std_output))
 250                 return true;
 251
 252         if (is_terminal_output(c->std_error))
 253                 return true;
 254
 255         return !!c->tty_path;
 256 }
 257
 258 static int open_null_as(int flags, int nfd) {
 259         int fd, r;
 260
 261         assert(nfd >= 0);
 262
 263         fd = open("/dev/null", flags|O_NOCTTY);
 264         if (fd < 0)
 265                 return -errno;
 266
 267         if (fd != nfd) {
 268                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 269                 safe_close(fd);
 270         } else
 271                 r = nfd;
 272
 273         return r;
 274 }
 275
 276 static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
 277         union sockaddr_union sa = {
 278                 .un.sun_family = AF_UNIX,
 279                 .un.sun_path = "/run/systemd/journal/stdout",
 280         };
 281         uid_t olduid = UID_INVALID;
 282         gid_t oldgid = GID_INVALID;
 283         int r;
 284
 285         if (gid != GID_INVALID) {
 286                 oldgid = getgid();
 287
 288                 r = setegid(gid);
 289                 if (r < 0)
 290                         return -errno;
 291         }
 292
 293         if (uid != UID_INVALID) {
 294                 olduid = getuid();
 295
 296                 r = seteuid(uid);
 297                 if (r < 0) {
 298                         r = -errno;
 299                         goto restore_gid;
 300                 }
 301         }
 302
 303         r = connect(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
 304         if (r < 0)
 305                 r = -errno;
 306
 307         /* If we fail to restore the uid or gid, things will likely
 308            fail later on. This should only happen if an LSM interferes. */
 309
 310         if (uid != UID_INVALID)
 311                 (void) seteuid(olduid);
 312
 313  restore_gid:
 314         if (gid != GID_INVALID)
 315                 (void) setegid(oldgid);
 316
 317         return r;
 318 }
 319
 320 static int connect_logger_as(
 321                 Unit *unit,
 322                 const ExecContext *context,
 323                 ExecOutput output,
 324                 const char *ident,
 325                 int nfd,
 326                 uid_t uid,
 327                 gid_t gid) {
 328
 329         int fd, r;
 330
 331         assert(context);
 332         assert(output < _EXEC_OUTPUT_MAX);
 333         assert(ident);
 334         assert(nfd >= 0);
 335
 336         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 337         if (fd < 0)
 338                 return -errno;
 339
 340         r = connect_journal_socket(fd, uid, gid);
 341         if (r < 0)
 342                 return r;
 343
 344         if (shutdown(fd, SHUT_RD) < 0) {
 345                 safe_close(fd);
 346                 return -errno;
 347         }
 348
 349         (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
 350
 351         dprintf(fd,
 352                 "%s\n"
 353                 "%s\n"
 354                 "%i\n"
 355                 "%i\n"
 356                 "%i\n"
 357                 "%i\n"
 358                 "%i\n",
 359                 context->syslog_identifier ? context->syslog_identifier : ident,
 360                 unit->id,
 361                 context->syslog_priority,
 362                 !!context->syslog_level_prefix,
 363                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 364                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 365                 is_terminal_output(output));
 366
 367         if (fd == nfd)
 368                 return nfd;
 369
 370         r = dup2(fd, nfd) < 0 ? -errno : nfd;
 371         safe_close(fd);
 372
 373         return r;
 374 }
 375 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 376         int fd, r;
 377
 378         assert(path);
 379         assert(nfd >= 0);
 380
 381         fd = open_terminal(path, mode | O_NOCTTY);
 382         if (fd < 0)
 383                 return fd;
 384
 385         if (fd != nfd) {
 386                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 387                 safe_close(fd);
 388         } else
 389                 r = nfd;
 390
 391         return r;
 392 }
 393
 394 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 395
 396         if (is_terminal_input(std_input) && !apply_tty_stdin)
 397                 return EXEC_INPUT_NULL;
 398
 399         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 400                 return EXEC_INPUT_NULL;
 401
 402         return std_input;
 403 }
 404
 405 static int fixup_output(ExecOutput std_output, int socket_fd) {
 406
 407         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 408                 return EXEC_OUTPUT_INHERIT;
 409
 410         return std_output;
 411 }
 412
 413 static int setup_input(
 414                 const ExecContext *context,
 415                 const ExecParameters *params,
 416                 int socket_fd,
 417                 int named_iofds[3]) {
 418
 419         ExecInput i;
 420
 421         assert(context);
 422         assert(params);
 423
 424         if (params->stdin_fd >= 0) {
 425                 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
 426                         return -errno;
 427
 428                 /* Try to make this the controlling tty, if it is a tty, and reset it */
 429                 (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
 430                 (void) reset_terminal_fd(STDIN_FILENO, true);
 431
 432                 return STDIN_FILENO;
 433         }
 434
 435         i = fixup_input(context->std_input, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 436
 437         switch (i) {
 438
 439         case EXEC_INPUT_NULL:
 440                 return open_null_as(O_RDONLY, STDIN_FILENO);
 441
 442         case EXEC_INPUT_TTY:
 443         case EXEC_INPUT_TTY_FORCE:
 444         case EXEC_INPUT_TTY_FAIL: {
 445                 int fd, r;
 446
 447                 fd = acquire_terminal(exec_context_tty_path(context),
 448                                       i == EXEC_INPUT_TTY_FAIL,
 449                                       i == EXEC_INPUT_TTY_FORCE,
 450                                       false,
 451                                       USEC_INFINITY);
 452                 if (fd < 0)
 453                         return fd;
 454
 455                 if (fd != STDIN_FILENO) {
 456                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 457                         safe_close(fd);
 458                 } else
 459                         r = STDIN_FILENO;
 460
 461                 return r;
 462         }
 463
 464         case EXEC_INPUT_SOCKET:
 465                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 466
 467         case EXEC_INPUT_NAMED_FD:
 468                 (void) fd_nonblock(named_iofds[STDIN_FILENO], false);
 469                 return dup2(named_iofds[STDIN_FILENO], STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 470
 471         default:
 472                 assert_not_reached("Unknown input type");
 473         }
 474 }
 475
 476 static int setup_output(
 477                 Unit *unit,
 478                 const ExecContext *context,
 479                 const ExecParameters *params,
 480                 int fileno,
 481                 int socket_fd,
 482                 int named_iofds[3],
 483                 const char *ident,
 484                 uid_t uid,
 485                 gid_t gid,
 486                 dev_t *journal_stream_dev,
 487                 ino_t *journal_stream_ino) {
 488
 489         ExecOutput o;
 490         ExecInput i;
 491         int r;
 492
 493         assert(unit);
 494         assert(context);
 495         assert(params);
 496         assert(ident);
 497         assert(journal_stream_dev);
 498         assert(journal_stream_ino);
 499
 500         if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
 501
 502                 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
 503                         return -errno;
 504
 505                 return STDOUT_FILENO;
 506         }
 507
 508         if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
 509                 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
 510                         return -errno;
 511
 512                 return STDERR_FILENO;
 513         }
 514
 515         i = fixup_input(context->std_input, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 516         o = fixup_output(context->std_output, socket_fd);
 517
 518         if (fileno == STDERR_FILENO) {
 519                 ExecOutput e;
 520                 e = fixup_output(context->std_error, socket_fd);
 521
 522                 /* This expects the input and output are already set up */
 523
 524                 /* Don't change the stderr file descriptor if we inherit all
 525                  * the way and are not on a tty */
 526                 if (e == EXEC_OUTPUT_INHERIT &&
 527                     o == EXEC_OUTPUT_INHERIT &&
 528                     i == EXEC_INPUT_NULL &&
 529                     !is_terminal_input(context->std_input) &&
 530                     getppid () != 1)
 531                         return fileno;
 532
 533                 /* Duplicate from stdout if possible */
 534                 if ((e == o && e != EXEC_OUTPUT_NAMED_FD) || e == EXEC_OUTPUT_INHERIT)
 535                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 536
 537                 o = e;
 538
 539         } else if (o == EXEC_OUTPUT_INHERIT) {
 540                 /* If input got downgraded, inherit the original value */
 541                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 542                         return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 543
 544                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 545                 if (i != EXEC_INPUT_NULL)
 546                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 547
 548                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 549                 if (getppid() != 1)
 550                         return fileno;
 551
 552                 /* We need to open /dev/null here anew, to get the right access mode. */
 553                 return open_null_as(O_WRONLY, fileno);
 554         }
 555
 556         switch (o) {
 557
 558         case EXEC_OUTPUT_NULL:
 559                 return open_null_as(O_WRONLY, fileno);
 560
 561         case EXEC_OUTPUT_TTY:
 562                 if (is_terminal_input(i))
 563                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 564
 565                 /* We don't reset the terminal if this is just about output */
 566                 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 567
 568         case EXEC_OUTPUT_SYSLOG:
 569         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 570         case EXEC_OUTPUT_KMSG:
 571         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 572         case EXEC_OUTPUT_JOURNAL:
 573         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 574                 r = connect_logger_as(unit, context, o, ident, fileno, uid, gid);
 575                 if (r < 0) {
 576                         log_unit_error_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
 577                         r = open_null_as(O_WRONLY, fileno);
 578                 } else {
 579                         struct stat st;
 580
 581                         /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
 582                          * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
 583                          * services to detect whether they are connected to the journal or not. */
 584
 585                         if (fstat(fileno, &st) >= 0) {
 586                                 *journal_stream_dev = st.st_dev;
 587                                 *journal_stream_ino = st.st_ino;
 588                         }
 589                 }
 590                 return r;
 591
 592         case EXEC_OUTPUT_SOCKET:
 593                 assert(socket_fd >= 0);
 594                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 595
 596         case EXEC_OUTPUT_NAMED_FD:
 597                 (void) fd_nonblock(named_iofds[fileno], false);
 598                 return dup2(named_iofds[fileno], fileno) < 0 ? -errno : fileno;
 599
 600         default:
 601                 assert_not_reached("Unknown error type");
 602         }
 603 }
 604
 605 static int chown_terminal(int fd, uid_t uid) {
 606         struct stat st;
 607
 608         assert(fd >= 0);
 609
 610         /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
 611         if (isatty(fd) < 1)
 612                 return 0;
 613
 614         /* This might fail. What matters are the results. */
 615         (void) fchown(fd, uid, -1);
 616         (void) fchmod(fd, TTY_MODE);
 617
 618         if (fstat(fd, &st) < 0)
 619                 return -errno;
 620
 621         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 622                 return -EPERM;
 623
 624         return 0;
 625 }
 626
 627 static int setup_confirm_stdio(const char *vc, int *_saved_stdin, int *_saved_stdout) {
 628         _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
 629         int r;
 630
 631         assert(_saved_stdin);
 632         assert(_saved_stdout);
 633
 634         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 635         if (saved_stdin < 0)
 636                 return -errno;
 637
 638         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 639         if (saved_stdout < 0)
 640                 return -errno;
 641
 642         fd = acquire_terminal(vc, false, false, false, DEFAULT_CONFIRM_USEC);
 643         if (fd < 0)
 644                 return fd;
 645
 646         r = chown_terminal(fd, getuid());
 647         if (r < 0)
 648                 return r;
 649
 650         r = reset_terminal_fd(fd, true);
 651         if (r < 0)
 652                 return r;
 653
 654         if (dup2(fd, STDIN_FILENO) < 0)
 655                 return -errno;
 656
 657         if (dup2(fd, STDOUT_FILENO) < 0)
 658                 return -errno;
 659
 660         if (fd >= 2)
 661                 safe_close(fd);
 662         fd = -1;
 663
 664         *_saved_stdin = saved_stdin;
 665         *_saved_stdout = saved_stdout;
 666
 667         saved_stdin = saved_stdout = -1;
 668
 669         return 0;
 670 }
 671
 672 static void write_confirm_error_fd(int err, int fd, const Unit *u) {
 673         assert(err < 0);
 674
 675         if (err == -ETIMEDOUT)
 676                 dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);
 677         else {
 678                 errno = -err;
 679                 dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);
 680         }
 681 }
 682
 683 static void write_confirm_error(int err, const char *vc, const Unit *u) {
 684         _cleanup_close_ int fd = -1;
 685
 686         assert(vc);
 687
 688         fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);
 689         if (fd < 0)
 690                 return;
 691
 692         write_confirm_error_fd(err, fd, u);
 693 }
 694
 695 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
 696         int r = 0;
 697
 698         assert(saved_stdin);
 699         assert(saved_stdout);
 700
 701         release_terminal();
 702
 703         if (*saved_stdin >= 0)
 704                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 705                         r = -errno;
 706
 707         if (*saved_stdout >= 0)
 708                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 709                         r = -errno;
 710
 711         *saved_stdin = safe_close(*saved_stdin);
 712         *saved_stdout = safe_close(*saved_stdout);
 713
 714         return r;
 715 }
 716
 717 enum {
 718         CONFIRM_PRETEND_FAILURE = -1,
 719         CONFIRM_PRETEND_SUCCESS =  0,
 720         CONFIRM_EXECUTE = 1,
 721 };
 722
 723 static int ask_for_confirmation(const char *vc, Unit *u, const char *cmdline) {
 724         int saved_stdout = -1, saved_stdin = -1, r;
 725         _cleanup_free_ char *e = NULL;
 726         char c;
 727
 728         /* For any internal errors, assume a positive response. */
 729         r = setup_confirm_stdio(vc, &saved_stdin, &saved_stdout);
 730         if (r < 0) {
 731                 write_confirm_error(r, vc, u);
 732                 return CONFIRM_EXECUTE;
 733         }
 734
 735         /* confirm_spawn might have been disabled while we were sleeping. */
 736         if (manager_is_confirm_spawn_disabled(u->manager)) {
 737                 r = 1;
 738                 goto restore_stdio;
 739         }
 740
 741         e = ellipsize(cmdline, 60, 100);
 742         if (!e) {
 743                 log_oom();
 744                 r = CONFIRM_EXECUTE;
 745                 goto restore_stdio;
 746         }
 747
 748         for (;;) {
 749                 r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);
 750                 if (r < 0) {
 751                         write_confirm_error_fd(r, STDOUT_FILENO, u);
 752                         r = CONFIRM_EXECUTE;
 753                         goto restore_stdio;
 754                 }
 755
 756                 switch (c) {
 757                 case 'c':
 758                         printf("Resuming normal execution.\n");
 759                         manager_disable_confirm_spawn();
 760                         r = 1;
 761                         break;
 762                 case 'D':
 763                         unit_dump(u, stdout, "  ");
 764                         continue; /* ask again */
 765                 case 'f':
 766                         printf("Failing execution.\n");
 767                         r = CONFIRM_PRETEND_FAILURE;
 768                         break;
 769                 case 'h':
 770                         printf("  c - continue, proceed without asking anymore\n"
 771                                "  D - dump, show the state of the unit\n"
 772                                "  f - fail, don't execute the command and pretend it failed\n"
 773                                "  h - help\n"
 774                                "  i - info, show a short summary of the unit\n"
 775                                "  j - jobs, show jobs that are in progress\n"
 776                                "  s - skip, don't execute the command and pretend it succeeded\n"
 777                                "  y - yes, execute the command\n");
 778                         continue; /* ask again */
 779                 case 'i':
 780                         printf("  Description: %s\n"
 781                                "  Unit:        %s\n"
 782                                "  Command:     %s\n",
 783                                u->id, u->description, cmdline);
 784                         continue; /* ask again */
 785                 case 'j':
 786                         manager_dump_jobs(u->manager, stdout, "  ");
 787                         continue; /* ask again */
 788                 case 'n':
 789                         /* 'n' was removed in favor of 'f'. */
 790                         printf("Didn't understand 'n', did you mean 'f'?\n");
 791                         continue; /* ask again */
 792                 case 's':
 793                         printf("Skipping execution.\n");
 794                         r = CONFIRM_PRETEND_SUCCESS;
 795                         break;
 796                 case 'y':
 797                         r = CONFIRM_EXECUTE;
 798                         break;
 799                 default:
 800                         assert_not_reached("Unhandled choice");
 801                 }
 802                 break;
 803         }
 804
 805 restore_stdio:
 806         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 807         return r;
 808 }
 809
 810 static int get_fixed_user(const ExecContext *c, const char **user,
 811                           uid_t *uid, gid_t *gid,
 812                           const char **home, const char **shell) {
 813         int r;
 814         const char *name;
 815
 816         assert(c);
 817
 818         if (!c->user)
 819                 return 0;
 820
 821         /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway
 822          * (i.e. are "/" or "/bin/nologin"). */
 823
 824         name = c->user;
 825         r = get_user_creds_clean(&name, uid, gid, home, shell);
 826         if (r < 0)
 827                 return r;
 828
 829         *user = name;
 830         return 0;
 831 }
 832
 833 static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {
 834         int r;
 835         const char *name;
 836
 837         assert(c);
 838
 839         if (!c->group)
 840                 return 0;
 841
 842         name = c->group;
 843         r = get_group_creds(&name, gid);
 844         if (r < 0)
 845                 return r;
 846
 847         *group = name;
 848         return 0;
 849 }
 850
 851 static int get_supplementary_groups(const ExecContext *c, const char *user,
 852                                     const char *group, gid_t gid,
 853                                     gid_t **supplementary_gids, int *ngids) {
 854         char **i;
 855         int r, k = 0;
 856         int ngroups_max;
 857         bool keep_groups = false;
 858         gid_t *groups = NULL;
 859         _cleanup_free_ gid_t *l_gids = NULL;
 860
 861         assert(c);
 862
 863         /*
 864          * If user is given, then lookup GID and supplementary groups list.
 865          * We avoid NSS lookups for gid=0. Also we have to initialize groups
 866          * here and as early as possible so we keep the list of supplementary
 867          * groups of the caller.
 868          */
 869         if (user && gid_is_valid(gid) && gid != 0) {
 870                 /* First step, initialize groups from /etc/groups */
 871                 if (initgroups(user, gid) < 0)
 872                         return -errno;
 873
 874                 keep_groups = true;
 875         }
 876
 877         if (!c->supplementary_groups)
 878                 return 0;
 879
 880         /*
 881          * If SupplementaryGroups= was passed then NGROUPS_MAX has to
 882          * be positive, otherwise fail.
 883          */
 884         errno = 0;
 885         ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
 886         if (ngroups_max <= 0) {
 887                 if (errno > 0)
 888                         return -errno;
 889                 else
 890                         return -EOPNOTSUPP; /* For all other values */
 891         }
 892
 893         l_gids = new(gid_t, ngroups_max);
 894         if (!l_gids)
 895                 return -ENOMEM;
 896
 897         if (keep_groups) {
 898                 /*
 899                  * Lookup the list of groups that the user belongs to, we
 900                  * avoid NSS lookups here too for gid=0.
 901                  */
 902                 k = ngroups_max;
 903                 if (getgrouplist(user, gid, l_gids, &k) < 0)
 904                         return -EINVAL;
 905         } else
 906                 k = 0;
 907
 908         STRV_FOREACH(i, c->supplementary_groups) {
 909                 const char *g;
 910
 911                 if (k >= ngroups_max)
 912                         return -E2BIG;
 913
 914                 g = *i;
 915                 r = get_group_creds(&g, l_gids+k);
 916                 if (r < 0)
 917                         return r;
 918
 919                 k++;
 920         }
 921
 922         /*
 923          * Sets ngids to zero to drop all supplementary groups, happens
 924          * when we are under root and SupplementaryGroups= is empty.
 925          */
 926         if (k == 0) {
 927                 *ngids = 0;
 928                 return 0;
 929         }
 930
 931         /* Otherwise get the final list of supplementary groups */
 932         groups = memdup(l_gids, sizeof(gid_t) * k);
 933         if (!groups)
 934                 return -ENOMEM;
 935
 936         *supplementary_gids = groups;
 937         *ngids = k;
 938
 939         groups = NULL;
 940
 941         return 0;
 942 }
 943
 944 static int enforce_groups(const ExecContext *context, gid_t gid,
 945                           gid_t *supplementary_gids, int ngids) {
 946         int r;
 947
 948         assert(context);
 949
 950         /* Handle SupplementaryGroups= even if it is empty */
 951         if (context->supplementary_groups) {
 952                 r = maybe_setgroups(ngids, supplementary_gids);
 953                 if (r < 0)
 954                         return r;
 955         }
 956
 957         if (gid_is_valid(gid)) {
 958                 /* Then set our gids */
 959                 if (setresgid(gid, gid, gid) < 0)
 960                         return -errno;
 961         }
 962
 963         return 0;
 964 }
 965
 966 static int enforce_user(const ExecContext *context, uid_t uid) {
 967         assert(context);
 968
 969         if (!uid_is_valid(uid))
 970                 return 0;
 971
 972         /* Sets (but doesn't look up) the uid and make sure we keep the
 973          * capabilities while doing so. */
 974
 975         if (context->capability_ambient_set != 0) {
 976
 977                 /* First step: If we need to keep capabilities but
 978                  * drop privileges we need to make sure we keep our
 979                  * caps, while we drop privileges. */
 980                 if (uid != 0) {
 981                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 982
 983                         if (prctl(PR_GET_SECUREBITS) != sb)
 984                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 985                                         return -errno;
 986                 }
 987         }
 988
 989         /* Second step: actually set the uids */
 990         if (setresuid(uid, uid, uid) < 0)
 991                 return -errno;
 992
 993         /* At this point we should have all necessary capabilities but
 994            are otherwise a normal user. However, the caps might got
 995            corrupted due to the setresuid() so we need clean them up
 996            later. This is done outside of this call. */
 997
 998         return 0;
 999 }
1000
1001 #ifdef HAVE_PAM
1002
1003 static int null_conv(
1004                 int num_msg,
1005                 const struct pam_message **msg,
1006                 struct pam_response **resp,
1007                 void *appdata_ptr) {
1008
1009         /* We don't support conversations */
1010
1011         return PAM_CONV_ERR;
1012 }
1013
1014 #endif
1015
1016 static int setup_pam(
1017                 const char *name,
1018                 const char *user,
1019                 uid_t uid,
1020                 gid_t gid,
1021                 const char *tty,
1022                 char ***env,
1023                 int fds[], unsigned n_fds) {
1024
1025 #ifdef HAVE_PAM
1026
1027         static const struct pam_conv conv = {
1028                 .conv = null_conv,
1029                 .appdata_ptr = NULL
1030         };
1031
1032         _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
1033         pam_handle_t *handle = NULL;
1034         sigset_t old_ss;
1035         int pam_code = PAM_SUCCESS, r;
1036         char **nv, **e = NULL;
1037         bool close_session = false;
1038         pid_t pam_pid = 0, parent_pid;
1039         int flags = 0;
1040
1041         assert(name);
1042         assert(user);
1043         assert(env);
1044
1045         /* We set up PAM in the parent process, then fork. The child
1046          * will then stay around until killed via PR_GET_PDEATHSIG or
1047          * systemd via the cgroup logic. It will then remove the PAM
1048          * session again. The parent process will exec() the actual
1049          * daemon. We do things this way to ensure that the main PID
1050          * of the daemon is the one we initially fork()ed. */
1051
1052         r = barrier_create(&barrier);
1053         if (r < 0)
1054                 goto fail;
1055
1056         if (log_get_max_level() < LOG_DEBUG)
1057                 flags |= PAM_SILENT;
1058
1059         pam_code = pam_start(name, user, &conv, &handle);
1060         if (pam_code != PAM_SUCCESS) {
1061                 handle = NULL;
1062                 goto fail;
1063         }
1064
1065         if (tty) {
1066                 pam_code = pam_set_item(handle, PAM_TTY, tty);
1067                 if (pam_code != PAM_SUCCESS)
1068                         goto fail;
1069         }
1070
1071         STRV_FOREACH(nv, *env) {
1072                 pam_code = pam_putenv(handle, *nv);
1073                 if (pam_code != PAM_SUCCESS)
1074                         goto fail;
1075         }
1076
1077         pam_code = pam_acct_mgmt(handle, flags);
1078         if (pam_code != PAM_SUCCESS)
1079                 goto fail;
1080
1081         pam_code = pam_open_session(handle, flags);
1082         if (pam_code != PAM_SUCCESS)
1083                 goto fail;
1084
1085         close_session = true;
1086
1087         e = pam_getenvlist(handle);
1088         if (!e) {
1089                 pam_code = PAM_BUF_ERR;
1090                 goto fail;
1091         }
1092
1093         /* Block SIGTERM, so that we know that it won't get lost in
1094          * the child */
1095
1096         assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
1097
1098         parent_pid = getpid();
1099
1100         pam_pid = fork();
1101         if (pam_pid < 0) {
1102                 r = -errno;
1103                 goto fail;
1104         }
1105
1106         if (pam_pid == 0) {
1107                 int sig, ret = EXIT_PAM;
1108
1109                 /* The child's job is to reset the PAM session on
1110                  * termination */
1111                 barrier_set_role(&barrier, BARRIER_CHILD);
1112
1113                 /* This string must fit in 10 chars (i.e. the length
1114                  * of "/sbin/init"), to look pretty in /bin/ps */
1115                 rename_process("(sd-pam)");
1116
1117                 /* Make sure we don't keep open the passed fds in this
1118                 child. We assume that otherwise only those fds are
1119                 open here that have been opened by PAM. */
1120                 close_many(fds, n_fds);
1121
1122                 /* Drop privileges - we don't need any to pam_close_session
1123                  * and this will make PR_SET_PDEATHSIG work in most cases.
1124                  * If this fails, ignore the error - but expect sd-pam threads
1125                  * to fail to exit normally */
1126
1127                 r = maybe_setgroups(0, NULL);
1128                 if (r < 0)
1129                         log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
1130                 if (setresgid(gid, gid, gid) < 0)
1131                         log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
1132                 if (setresuid(uid, uid, uid) < 0)
1133                         log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m");
1134
1135                 (void) ignore_signals(SIGPIPE, -1);
1136
1137                 /* Wait until our parent died. This will only work if
1138                  * the above setresuid() succeeds, otherwise the kernel
1139                  * will not allow unprivileged parents kill their privileged
1140                  * children this way. We rely on the control groups kill logic
1141                  * to do the rest for us. */
1142                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
1143                         goto child_finish;
1144
1145                 /* Tell the parent that our setup is done. This is especially
1146                  * important regarding dropping privileges. Otherwise, unit
1147                  * setup might race against our setresuid(2) call.
1148                  *
1149                  * If the parent aborted, we'll detect this below, hence ignore
1150                  * return failure here. */
1151                 (void) barrier_place(&barrier);
1152
1153                 /* Check if our parent process might already have died? */
1154                 if (getppid() == parent_pid) {
1155                         sigset_t ss;
1156
1157                         assert_se(sigemptyset(&ss) >= 0);
1158                         assert_se(sigaddset(&ss, SIGTERM) >= 0);
1159
1160                         for (;;) {
1161                                 if (sigwait(&ss, &sig) < 0) {
1162                                         if (errno == EINTR)
1163                                                 continue;
1164
1165                                         goto child_finish;
1166                                 }
1167
1168                                 assert(sig == SIGTERM);
1169                                 break;
1170                         }
1171                 }
1172
1173                 /* If our parent died we'll end the session */
1174                 if (getppid() != parent_pid) {
1175                         pam_code = pam_close_session(handle, flags);
1176                         if (pam_code != PAM_SUCCESS)
1177                                 goto child_finish;
1178                 }
1179
1180                 ret = 0;
1181
1182         child_finish:
1183                 pam_end(handle, pam_code | flags);
1184                 _exit(ret);
1185         }
1186
1187         barrier_set_role(&barrier, BARRIER_PARENT);
1188
1189         /* If the child was forked off successfully it will do all the
1190          * cleanups, so forget about the handle here. */
1191         handle = NULL;
1192
1193         /* Unblock SIGTERM again in the parent */
1194         assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
1195
1196         /* We close the log explicitly here, since the PAM modules
1197          * might have opened it, but we don't want this fd around. */
1198         closelog();
1199
1200         /* Synchronously wait for the child to initialize. We don't care for
1201          * errors as we cannot recover. However, warn loudly if it happens. */
1202         if (!barrier_place_and_sync(&barrier))
1203                 log_error("PAM initialization failed");
1204
1205         strv_free(*env);
1206         *env = e;
1207
1208         return 0;
1209
1210 fail:
1211         if (pam_code != PAM_SUCCESS) {
1212                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1213                 r = -EPERM;  /* PAM errors do not map to errno */
1214         } else
1215                 log_error_errno(r, "PAM failed: %m");
1216
1217         if (handle) {
1218                 if (close_session)
1219                         pam_code = pam_close_session(handle, flags);
1220
1221                 pam_end(handle, pam_code | flags);
1222         }
1223
1224         strv_free(e);
1225         closelog();
1226
1227         return r;
1228 #else
1229         return 0;
1230 #endif
1231 }
1232
1233 static void rename_process_from_path(const char *path) {
1234         char process_name[11];
1235         const char *p;
1236         size_t l;
1237
1238         /* This resulting string must fit in 10 chars (i.e. the length
1239          * of "/sbin/init") to look pretty in /bin/ps */
1240
1241         p = basename(path);
1242         if (isempty(p)) {
1243                 rename_process("(...)");
1244                 return;
1245         }
1246
1247         l = strlen(p);
1248         if (l > 8) {
1249                 /* The end of the process name is usually more
1250                  * interesting, since the first bit might just be
1251                  * "systemd-" */
1252                 p = p + l - 8;
1253                 l = 8;
1254         }
1255
1256         process_name[0] = '(';
1257         memcpy(process_name+1, p, l);
1258         process_name[1+l] = ')';
1259         process_name[1+l+1] = 0;
1260
1261         rename_process(process_name);
1262 }
1263
1264 static bool context_has_address_families(const ExecContext *c) {
1265         assert(c);
1266
1267         return c->address_families_whitelist ||
1268                 !set_isempty(c->address_families);
1269 }
1270
1271 static bool context_has_syscall_filters(const ExecContext *c) {
1272         assert(c);
1273
1274         return c->syscall_whitelist ||
1275                 !set_isempty(c->syscall_filter);
1276 }
1277
1278 static bool context_has_no_new_privileges(const ExecContext *c) {
1279         assert(c);
1280
1281         if (c->no_new_privileges)
1282                 return true;
1283
1284         if (have_effective_cap(CAP_SYS_ADMIN)) /* if we are privileged, we don't need NNP */
1285                 return false;
1286
1287         /* We need NNP if we have any form of seccomp and are unprivileged */
1288         return context_has_address_families(c) ||
1289                 c->memory_deny_write_execute ||
1290                 c->restrict_realtime ||
1291                 exec_context_restrict_namespaces_set(c) ||
1292                 c->protect_kernel_tunables ||
1293                 c->protect_kernel_modules ||
1294                 c->private_devices ||
1295                 context_has_syscall_filters(c) ||
1296                 !set_isempty(c->syscall_archs);
1297 }
1298
1299 #ifdef HAVE_SECCOMP
1300
1301 static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
1302
1303         if (is_seccomp_available())
1304                 return false;
1305
1306         log_open();
1307         log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
1308         log_close();
1309         return true;
1310 }
1311
1312 static int apply_syscall_filter(const Unit* u, const ExecContext *c) {
1313         uint32_t negative_action, default_action, action;
1314
1315         assert(u);
1316         assert(c);
1317
1318         if (!context_has_syscall_filters(c))
1319                 return 0;
1320
1321         if (skip_seccomp_unavailable(u, "SystemCallFilter="))
1322                 return 0;
1323
1324         negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
1325
1326         if (c->syscall_whitelist) {
1327                 default_action = negative_action;
1328                 action = SCMP_ACT_ALLOW;
1329         } else {
1330                 default_action = SCMP_ACT_ALLOW;
1331                 action = negative_action;
1332         }
1333
1334         return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action);
1335 }
1336
1337 static int apply_syscall_archs(const Unit *u, const ExecContext *c) {
1338         assert(u);
1339         assert(c);
1340
1341         if (set_isempty(c->syscall_archs))
1342                 return 0;
1343
1344         if (skip_seccomp_unavailable(u, "SystemCallArchitectures="))
1345                 return 0;
1346
1347         return seccomp_restrict_archs(c->syscall_archs);
1348 }
1349
1350 static int apply_address_families(const Unit* u, const ExecContext *c) {
1351         assert(u);
1352         assert(c);
1353
1354         if (!context_has_address_families(c))
1355                 return 0;
1356
1357         if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1358                 return 0;
1359
1360         return seccomp_restrict_address_families(c->address_families, c->address_families_whitelist);
1361 }
1362
1363 static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
1364         assert(u);
1365         assert(c);
1366
1367         if (!c->memory_deny_write_execute)
1368                 return 0;
1369
1370         if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1371                 return 0;
1372
1373         return seccomp_memory_deny_write_execute();
1374 }
1375
1376 static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
1377         assert(u);
1378         assert(c);
1379
1380         if (!c->restrict_realtime)
1381                 return 0;
1382
1383         if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1384                 return 0;
1385
1386         return seccomp_restrict_realtime();
1387 }
1388
1389 static int apply_protect_sysctl(const Unit *u, const ExecContext *c) {
1390         assert(u);
1391         assert(c);
1392
1393         /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1394          * let's protect even those systems where this is left on in the kernel. */
1395
1396         if (!c->protect_kernel_tunables)
1397                 return 0;
1398
1399         if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1400                 return 0;
1401
1402         return seccomp_protect_sysctl();
1403 }
1404
1405 static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
1406         assert(u);
1407         assert(c);
1408
1409         /* Turn off module syscalls on ProtectKernelModules=yes */
1410
1411         if (!c->protect_kernel_modules)
1412                 return 0;
1413
1414         if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
1415                 return 0;
1416
1417         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM));
1418 }
1419
1420 static int apply_private_devices(const Unit *u, const ExecContext *c) {
1421         assert(u);
1422         assert(c);
1423
1424         /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */
1425
1426         if (!c->private_devices)
1427                 return 0;
1428
1429         if (skip_seccomp_unavailable(u, "PrivateDevices="))
1430                 return 0;
1431
1432         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM));
1433 }
1434
1435 static int apply_restrict_namespaces(Unit *u, const ExecContext *c) {
1436         assert(u);
1437         assert(c);
1438
1439         if (!exec_context_restrict_namespaces_set(c))
1440                 return 0;
1441
1442         if (skip_seccomp_unavailable(u, "RestrictNamespaces="))
1443                 return 0;
1444
1445         return seccomp_restrict_namespaces(c->restrict_namespaces);
1446 }
1447
1448 #endif
1449
1450 static void do_idle_pipe_dance(int idle_pipe[4]) {
1451         assert(idle_pipe);
1452
1453         idle_pipe[1] = safe_close(idle_pipe[1]);
1454         idle_pipe[2] = safe_close(idle_pipe[2]);
1455
1456         if (idle_pipe[0] >= 0) {
1457                 int r;
1458
1459                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1460
1461                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1462                         ssize_t n;
1463
1464                         /* Signal systemd that we are bored and want to continue. */
1465                         n = write(idle_pipe[3], "x", 1);
1466                         if (n > 0)
1467                                 /* Wait for systemd to react to the signal above. */
1468                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1469                 }
1470
1471                 idle_pipe[0] = safe_close(idle_pipe[0]);
1472
1473         }
1474
1475         idle_pipe[3] = safe_close(idle_pipe[3]);
1476 }
1477
1478 static int build_environment(
1479                 Unit *u,
1480                 const ExecContext *c,
1481                 const ExecParameters *p,
1482                 unsigned n_fds,
1483                 const char *home,
1484                 const char *username,
1485                 const char *shell,
1486                 dev_t journal_stream_dev,
1487                 ino_t journal_stream_ino,
1488                 char ***ret) {
1489
1490         _cleanup_strv_free_ char **our_env = NULL;
1491         unsigned n_env = 0;
1492         char *x;
1493
1494         assert(u);
1495         assert(c);
1496         assert(ret);
1497
1498         our_env = new0(char*, 14);
1499         if (!our_env)
1500                 return -ENOMEM;
1501
1502         if (n_fds > 0) {
1503                 _cleanup_free_ char *joined = NULL;
1504
1505                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
1506                         return -ENOMEM;
1507                 our_env[n_env++] = x;
1508
1509                 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1510                         return -ENOMEM;
1511                 our_env[n_env++] = x;
1512
1513                 joined = strv_join(p->fd_names, ":");
1514                 if (!joined)
1515                         return -ENOMEM;
1516
1517                 x = strjoin("LISTEN_FDNAMES=", joined);
1518                 if (!x)
1519                         return -ENOMEM;
1520                 our_env[n_env++] = x;
1521         }
1522
1523         if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
1524                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
1525                         return -ENOMEM;
1526                 our_env[n_env++] = x;
1527
1528                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1529                         return -ENOMEM;
1530                 our_env[n_env++] = x;
1531         }
1532
1533         /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use D-Bus look up dynamic
1534          * users via PID 1, possibly dead-locking the dbus daemon. This way it will not use D-Bus to resolve names, but
1535          * check the database directly. */
1536         if (unit_has_name(u, SPECIAL_DBUS_SERVICE)) {
1537                 x = strdup("SYSTEMD_NSS_BYPASS_BUS=1");
1538                 if (!x)
1539                         return -ENOMEM;
1540                 our_env[n_env++] = x;
1541         }
1542
1543         if (home) {
1544                 x = strappend("HOME=", home);
1545                 if (!x)
1546                         return -ENOMEM;
1547                 our_env[n_env++] = x;
1548         }
1549
1550         if (username) {
1551                 x = strappend("LOGNAME=", username);
1552                 if (!x)
1553                         return -ENOMEM;
1554                 our_env[n_env++] = x;
1555
1556                 x = strappend("USER=", username);
1557                 if (!x)
1558                         return -ENOMEM;
1559                 our_env[n_env++] = x;
1560         }
1561
1562         if (shell) {
1563                 x = strappend("SHELL=", shell);
1564                 if (!x)
1565                         return -ENOMEM;
1566                 our_env[n_env++] = x;
1567         }
1568
1569         if (!sd_id128_is_null(u->invocation_id)) {
1570                 if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0)
1571                         return -ENOMEM;
1572
1573                 our_env[n_env++] = x;
1574         }
1575
1576         if (exec_context_needs_term(c)) {
1577                 const char *tty_path, *term = NULL;
1578
1579                 tty_path = exec_context_tty_path(c);
1580
1581                 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try to inherit
1582                  * the $TERM set for PID 1. This is useful for containers so that the $TERM the container manager
1583                  * passes to PID 1 ends up all the way in the console login shown. */
1584
1585                 if (path_equal(tty_path, "/dev/console") && getppid() == 1)
1586                         term = getenv("TERM");
1587                 if (!term)
1588                         term = default_term_for_tty(tty_path);
1589
1590                 x = strappend("TERM=", term);
1591                 if (!x)
1592                         return -ENOMEM;
1593                 our_env[n_env++] = x;
1594         }
1595
1596         if (journal_stream_dev != 0 && journal_stream_ino != 0) {
1597                 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
1598                         return -ENOMEM;
1599
1600                 our_env[n_env++] = x;
1601         }
1602
1603         our_env[n_env++] = NULL;
1604         assert(n_env <= 12);
1605
1606         *ret = our_env;
1607         our_env = NULL;
1608
1609         return 0;
1610 }
1611
1612 static int build_pass_environment(const ExecContext *c, char ***ret) {
1613         _cleanup_strv_free_ char **pass_env = NULL;
1614         size_t n_env = 0, n_bufsize = 0;
1615         char **i;
1616
1617         STRV_FOREACH(i, c->pass_environment) {
1618                 _cleanup_free_ char *x = NULL;
1619                 char *v;
1620
1621                 v = getenv(*i);
1622                 if (!v)
1623                         continue;
1624                 x = strjoin(*i, "=", v);
1625                 if (!x)
1626                         return -ENOMEM;
1627                 if (!GREEDY_REALLOC(pass_env, n_bufsize, n_env + 2))
1628                         return -ENOMEM;
1629                 pass_env[n_env++] = x;
1630                 pass_env[n_env] = NULL;
1631                 x = NULL;
1632         }
1633
1634         *ret = pass_env;
1635         pass_env = NULL;
1636
1637         return 0;
1638 }
1639
1640 static bool exec_needs_mount_namespace(
1641                 const ExecContext *context,
1642                 const ExecParameters *params,
1643                 ExecRuntime *runtime) {
1644
1645         assert(context);
1646         assert(params);
1647
1648         if (context->root_image)
1649                 return true;
1650
1651         if (!strv_isempty(context->read_write_paths) ||
1652             !strv_isempty(context->read_only_paths) ||
1653             !strv_isempty(context->inaccessible_paths))
1654                 return true;
1655
1656         if (context->n_bind_mounts > 0)
1657                 return true;
1658
1659         if (context->mount_flags != 0)
1660                 return true;
1661
1662         if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
1663                 return true;
1664
1665         if (context->private_devices ||
1666             context->protect_system != PROTECT_SYSTEM_NO ||
1667             context->protect_home != PROTECT_HOME_NO ||
1668             context->protect_kernel_tunables ||
1669             context->protect_kernel_modules ||
1670             context->protect_control_groups)
1671                 return true;
1672
1673         if (context->mount_apivfs)
1674                 return true;
1675
1676         return false;
1677 }
1678
1679 static int setup_private_users(uid_t uid, gid_t gid) {
1680         _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
1681         _cleanup_close_pair_ int errno_pipe[2] = { -1, -1 };
1682         _cleanup_close_ int unshare_ready_fd = -1;
1683         _cleanup_(sigkill_waitp) pid_t pid = 0;
1684         uint64_t c = 1;
1685         siginfo_t si;
1686         ssize_t n;
1687         int r;
1688
1689         /* Set up a user namespace and map root to root, the selected UID/GID to itself, and everything else to
1690          * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
1691          * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
1692          * which waits for the parent to create the new user namespace while staying in the original namespace. The
1693          * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
1694          * continues execution normally. */
1695
1696         if (uid != 0 && uid_is_valid(uid)) {
1697                 r = asprintf(&uid_map,
1698                              "0 0 1\n"                      /* Map root → root */
1699                              UID_FMT " " UID_FMT " 1\n",    /* Map $UID → $UID */
1700                              uid, uid);
1701                 if (r < 0)
1702                         return -ENOMEM;
1703         } else {
1704                 uid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1705                 if (!uid_map)
1706                         return -ENOMEM;
1707         }
1708
1709         if (gid != 0 && gid_is_valid(gid)) {
1710                 r = asprintf(&gid_map,
1711                              "0 0 1\n"                      /* Map root → root */
1712                              GID_FMT " " GID_FMT " 1\n",    /* Map $GID → $GID */
1713                              gid, gid);
1714                 if (r < 0)
1715                         return -ENOMEM;
1716         } else {
1717                 gid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1718                 if (!gid_map)
1719                         return -ENOMEM;
1720         }
1721
1722         /* Create a communication channel so that the parent can tell the child when it finished creating the user
1723          * namespace. */
1724         unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
1725         if (unshare_ready_fd < 0)
1726                 return -errno;
1727
1728         /* Create a communication channel so that the child can tell the parent a proper error code in case it
1729          * failed. */
1730         if (pipe2(errno_pipe, O_CLOEXEC) < 0)
1731                 return -errno;
1732
1733         pid = fork();
1734         if (pid < 0)
1735                 return -errno;
1736
1737         if (pid == 0) {
1738                 _cleanup_close_ int fd = -1;
1739                 const char *a;
1740                 pid_t ppid;
1741
1742                 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
1743                  * here, after the parent opened its own user namespace. */
1744
1745                 ppid = getppid();
1746                 errno_pipe[0] = safe_close(errno_pipe[0]);
1747
1748                 /* Wait until the parent unshared the user namespace */
1749                 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
1750                         r = -errno;
1751                         goto child_fail;
1752                 }
1753
1754                 /* Disable the setgroups() system call in the child user namespace, for good. */
1755                 a = procfs_file_alloca(ppid, "setgroups");
1756                 fd = open(a, O_WRONLY|O_CLOEXEC);
1757                 if (fd < 0) {
1758                         if (errno != ENOENT) {
1759                                 r = -errno;
1760                                 goto child_fail;
1761                         }
1762
1763                         /* If the file is missing the kernel is too old, let's continue anyway. */
1764                 } else {
1765                         if (write(fd, "deny\n", 5) < 0) {
1766                                 r = -errno;
1767                                 goto child_fail;
1768                         }
1769
1770                         fd = safe_close(fd);
1771                 }
1772
1773                 /* First write the GID map */
1774                 a = procfs_file_alloca(ppid, "gid_map");
1775                 fd = open(a, O_WRONLY|O_CLOEXEC);
1776                 if (fd < 0) {
1777                         r = -errno;
1778                         goto child_fail;
1779                 }
1780                 if (write(fd, gid_map, strlen(gid_map)) < 0) {
1781                         r = -errno;
1782                         goto child_fail;
1783                 }
1784                 fd = safe_close(fd);
1785
1786                 /* The write the UID map */
1787                 a = procfs_file_alloca(ppid, "uid_map");
1788                 fd = open(a, O_WRONLY|O_CLOEXEC);
1789                 if (fd < 0) {
1790                         r = -errno;
1791                         goto child_fail;
1792                 }
1793                 if (write(fd, uid_map, strlen(uid_map)) < 0) {
1794                         r = -errno;
1795                         goto child_fail;
1796                 }
1797
1798                 _exit(EXIT_SUCCESS);
1799
1800         child_fail:
1801                 (void) write(errno_pipe[1], &r, sizeof(r));
1802                 _exit(EXIT_FAILURE);
1803         }
1804
1805         errno_pipe[1] = safe_close(errno_pipe[1]);
1806
1807         if (unshare(CLONE_NEWUSER) < 0)
1808                 return -errno;
1809
1810         /* Let the child know that the namespace is ready now */
1811         if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
1812                 return -errno;
1813
1814         /* Try to read an error code from the child */
1815         n = read(errno_pipe[0], &r, sizeof(r));
1816         if (n < 0)
1817                 return -errno;
1818         if (n == sizeof(r)) { /* an error code was sent to us */
1819                 if (r < 0)
1820                         return r;
1821                 return -EIO;
1822         }
1823         if (n != 0) /* on success we should have read 0 bytes */
1824                 return -EIO;
1825
1826         r = wait_for_terminate(pid, &si);
1827         if (r < 0)
1828                 return r;
1829         pid = 0;
1830
1831         /* If something strange happened with the child, let's consider this fatal, too */
1832         if (si.si_code != CLD_EXITED || si.si_status != 0)
1833                 return -EIO;
1834
1835         return 0;
1836 }
1837
1838 static int setup_runtime_directory(
1839                 const ExecContext *context,
1840                 const ExecParameters *params,
1841                 uid_t uid,
1842                 gid_t gid) {
1843
1844         char **rt;
1845         int r;
1846
1847         assert(context);
1848         assert(params);
1849
1850         STRV_FOREACH(rt, context->runtime_directory) {
1851                 _cleanup_free_ char *p;
1852
1853                 p = strjoin(params->runtime_prefix, "/", *rt);
1854                 if (!p)
1855                         return -ENOMEM;
1856
1857                 r = mkdir_p_label(p, context->runtime_directory_mode);
1858                 if (r < 0)
1859                         return r;
1860
1861                 r = chmod_and_chown(p, context->runtime_directory_mode, uid, gid);
1862                 if (r < 0)
1863                         return r;
1864         }
1865
1866         return 0;
1867 }
1868
1869 static int setup_smack(
1870                 const ExecContext *context,
1871                 const ExecCommand *command) {
1872
1873 #ifdef HAVE_SMACK
1874         int r;
1875
1876         assert(context);
1877         assert(command);
1878
1879         if (!mac_smack_use())
1880                 return 0;
1881
1882         if (context->smack_process_label) {
1883                 r = mac_smack_apply_pid(0, context->smack_process_label);
1884                 if (r < 0)
1885                         return r;
1886         }
1887 #ifdef SMACK_DEFAULT_PROCESS_LABEL
1888         else {
1889                 _cleanup_free_ char *exec_label = NULL;
1890
1891                 r = mac_smack_read(command->path, SMACK_ATTR_EXEC, &exec_label);
1892                 if (r < 0 && r != -ENODATA && r != -EOPNOTSUPP)
1893                         return r;
1894
1895                 r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
1896                 if (r < 0)
1897                         return r;
1898         }
1899 #endif
1900 #endif
1901
1902         return 0;
1903 }
1904
1905 static int compile_read_write_paths(
1906                 const ExecContext *context,
1907                 const ExecParameters *params,
1908                 char ***ret) {
1909
1910         _cleanup_strv_free_ char **l = NULL;
1911         char **rt;
1912
1913         /* Compile the list of writable paths. This is the combination of
1914          * the explicitly configured paths, plus all runtime directories. */
1915
1916         if (strv_isempty(context->read_write_paths) &&
1917             strv_isempty(context->runtime_directory)) {
1918                 *ret = NULL; /* NOP if neither is set */
1919                 return 0;
1920         }
1921
1922         l = strv_copy(context->read_write_paths);
1923         if (!l)
1924                 return -ENOMEM;
1925
1926         STRV_FOREACH(rt, context->runtime_directory) {
1927                 char *s;
1928
1929                 s = strjoin(params->runtime_prefix, "/", *rt);
1930                 if (!s)
1931                         return -ENOMEM;
1932
1933                 if (strv_consume(&l, s) < 0)
1934                         return -ENOMEM;
1935         }
1936
1937         *ret = l;
1938         l = NULL;
1939
1940         return 0;
1941 }
1942
1943 static int apply_mount_namespace(
1944                 Unit *u,
1945                 ExecCommand *command,
1946                 const ExecContext *context,
1947                 const ExecParameters *params,
1948                 ExecRuntime *runtime) {
1949
1950         _cleanup_strv_free_ char **rw = NULL;
1951         char *tmp = NULL, *var = NULL;
1952         const char *root_dir = NULL, *root_image = NULL;
1953         NameSpaceInfo ns_info = {
1954                 .ignore_protect_paths = false,
1955                 .private_dev = context->private_devices,
1956                 .protect_control_groups = context->protect_control_groups,
1957                 .protect_kernel_tunables = context->protect_kernel_tunables,
1958                 .protect_kernel_modules = context->protect_kernel_modules,
1959                 .mount_apivfs = context->mount_apivfs,
1960         };
1961         bool apply_restrictions;
1962         int r;
1963
1964         assert(context);
1965
1966         /* The runtime struct only contains the parent of the private /tmp,
1967          * which is non-accessible to world users. Inside of it there's a /tmp
1968          * that is sticky, and that's the one we want to use here. */
1969
1970         if (context->private_tmp && runtime) {
1971                 if (runtime->tmp_dir)
1972                         tmp = strjoina(runtime->tmp_dir, "/tmp");
1973                 if (runtime->var_tmp_dir)
1974                         var = strjoina(runtime->var_tmp_dir, "/tmp");
1975         }
1976
1977         r = compile_read_write_paths(context, params, &rw);
1978         if (r < 0)
1979                 return r;
1980
1981         if (params->flags & EXEC_APPLY_CHROOT) {
1982                 root_image = context->root_image;
1983
1984                 if (!root_image)
1985                         root_dir = context->root_directory;
1986         }
1987
1988         /*
1989          * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed
1990          * sandbox info, otherwise enforce it, don't ignore protected paths and
1991          * fail if we are enable to apply the sandbox inside the mount namespace.
1992          */
1993         if (!context->dynamic_user && root_dir)
1994                 ns_info.ignore_protect_paths = true;
1995
1996         apply_restrictions = (params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged;
1997
1998         r = setup_namespace(root_dir, root_image,
1999                             &ns_info, rw,
2000                             apply_restrictions ? context->read_only_paths : NULL,
2001                             apply_restrictions ? context->inaccessible_paths : NULL,
2002                             context->bind_mounts,
2003                             context->n_bind_mounts,
2004                             tmp,
2005                             var,
2006                             apply_restrictions ? context->protect_home : PROTECT_HOME_NO,
2007                             apply_restrictions ? context->protect_system : PROTECT_SYSTEM_NO,
2008                             context->mount_flags,
2009                             DISSECT_IMAGE_DISCARD_ON_LOOP);
2010
2011         /* If we couldn't set up the namespace this is probably due to a
2012          * missing capability. In this case, silently proceeed. */
2013         if (IN_SET(r, -EPERM, -EACCES)) {
2014                 log_open();
2015                 log_unit_debug_errno(u, r, "Failed to set up namespace, assuming containerized execution, ignoring: %m");
2016                 log_close();
2017                 r = 0;
2018         }
2019
2020         return r;
2021 }
2022
2023 static int apply_working_directory(
2024                 const ExecContext *context,
2025                 const ExecParameters *params,
2026                 const char *home,
2027                 const bool needs_mount_ns,
2028                 int *exit_status) {
2029
2030         const char *d, *wd;
2031
2032         assert(context);
2033         assert(exit_status);
2034
2035         if (context->working_directory_home) {
2036
2037                 if (!home) {
2038                         *exit_status = EXIT_CHDIR;
2039                         return -ENXIO;
2040                 }
2041
2042                 wd = home;
2043
2044         } else if (context->working_directory)
2045                 wd = context->working_directory;
2046         else
2047                 wd = "/";
2048
2049         if (params->flags & EXEC_APPLY_CHROOT) {
2050                 if (!needs_mount_ns && context->root_directory)
2051                         if (chroot(context->root_directory) < 0) {
2052                                 *exit_status = EXIT_CHROOT;
2053                                 return -errno;
2054                         }
2055
2056                 d = wd;
2057         } else
2058                 d = prefix_roota(context->root_directory, wd);
2059
2060         if (chdir(d) < 0 && !context->working_directory_missing_ok) {
2061                 *exit_status = EXIT_CHDIR;
2062                 return -errno;
2063         }
2064
2065         return 0;
2066 }
2067
2068 static int setup_keyring(Unit *u, const ExecParameters *p, uid_t uid, gid_t gid) {
2069         key_serial_t keyring;
2070
2071         assert(u);
2072         assert(p);
2073
2074         /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that
2075          * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond
2076          * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be
2077          * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in
2078          * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where
2079          * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */
2080
2081         if (!(p->flags & EXEC_NEW_KEYRING))
2082                 return 0;
2083
2084         keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2085         if (keyring == -1) {
2086                 if (errno == ENOSYS)
2087                         log_debug_errno(errno, "Kernel keyring not supported, ignoring.");
2088                 else if (IN_SET(errno, EACCES, EPERM))
2089                         log_debug_errno(errno, "Kernel keyring access prohibited, ignoring.");
2090                 else if (errno == EDQUOT)
2091                         log_debug_errno(errno, "Out of kernel keyrings to allocate, ignoring.");
2092                 else
2093                         return log_error_errno(errno, "Setting up kernel keyring failed: %m");
2094
2095                 return 0;
2096         }
2097
2098         /* Populate they keyring with the invocation ID by default. */
2099         if (!sd_id128_is_null(u->invocation_id)) {
2100                 key_serial_t key;
2101
2102                 key = add_key("user", "invocation_id", &u->invocation_id, sizeof(u->invocation_id), KEY_SPEC_SESSION_KEYRING);
2103                 if (key == -1)
2104                         log_debug_errno(errno, "Failed to add invocation ID to keyring, ignoring: %m");
2105                 else {
2106                         if (keyctl(KEYCTL_SETPERM, key,
2107                                    KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH|
2108                                    KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0)
2109                                 return log_error_errno(errno, "Failed to restrict invocation ID permission: %m");
2110                 }
2111         }
2112
2113         /* And now, make the keyring owned by the service's user */
2114         if (uid_is_valid(uid) || gid_is_valid(gid))
2115                 if (keyctl(KEYCTL_CHOWN, keyring, uid, gid, 0) < 0)
2116                         return log_error_errno(errno, "Failed to change ownership of session keyring: %m");
2117
2118         return 0;
2119 }
2120
2121 static void append_socket_pair(int *array, unsigned *n, int pair[2]) {
2122         assert(array);
2123         assert(n);
2124
2125         if (!pair)
2126                 return;
2127
2128         if (pair[0] >= 0)
2129                 array[(*n)++] = pair[0];
2130         if (pair[1] >= 0)
2131                 array[(*n)++] = pair[1];
2132 }
2133
2134 static int close_remaining_fds(
2135                 const ExecParameters *params,
2136                 ExecRuntime *runtime,
2137                 DynamicCreds *dcreds,
2138                 int user_lookup_fd,
2139                 int socket_fd,
2140                 int *fds, unsigned n_fds) {
2141
2142         unsigned n_dont_close = 0;
2143         int dont_close[n_fds + 12];
2144
2145         assert(params);
2146
2147         if (params->stdin_fd >= 0)
2148                 dont_close[n_dont_close++] = params->stdin_fd;
2149         if (params->stdout_fd >= 0)
2150                 dont_close[n_dont_close++] = params->stdout_fd;
2151         if (params->stderr_fd >= 0)
2152                 dont_close[n_dont_close++] = params->stderr_fd;
2153
2154         if (socket_fd >= 0)
2155                 dont_close[n_dont_close++] = socket_fd;
2156         if (n_fds > 0) {
2157                 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
2158                 n_dont_close += n_fds;
2159         }
2160
2161         if (runtime)
2162                 append_socket_pair(dont_close, &n_dont_close, runtime->netns_storage_socket);
2163
2164         if (dcreds) {
2165                 if (dcreds->user)
2166                         append_socket_pair(dont_close, &n_dont_close, dcreds->user->storage_socket);
2167                 if (dcreds->group)
2168                         append_socket_pair(dont_close, &n_dont_close, dcreds->group->storage_socket);
2169         }
2170
2171         if (user_lookup_fd >= 0)
2172                 dont_close[n_dont_close++] = user_lookup_fd;
2173
2174         return close_all_fds(dont_close, n_dont_close);
2175 }
2176
2177 static int send_user_lookup(
2178                 Unit *unit,
2179                 int user_lookup_fd,
2180                 uid_t uid,
2181                 gid_t gid) {
2182
2183         assert(unit);
2184
2185         /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
2186          * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
2187          * specified. */
2188
2189         if (user_lookup_fd < 0)
2190                 return 0;
2191
2192         if (!uid_is_valid(uid) && !gid_is_valid(gid))
2193                 return 0;
2194
2195         if (writev(user_lookup_fd,
2196                (struct iovec[]) {
2197                            { .iov_base = &uid, .iov_len = sizeof(uid) },
2198                            { .iov_base = &gid, .iov_len = sizeof(gid) },
2199                            { .iov_base = unit->id, .iov_len = strlen(unit->id) }}, 3) < 0)
2200                 return -errno;
2201
2202         return 0;
2203 }
2204
2205 static int acquire_home(const ExecContext *c, uid_t uid, const char** home, char **buf) {
2206         int r;
2207
2208         assert(c);
2209         assert(home);
2210         assert(buf);
2211
2212         /* If WorkingDirectory=~ is set, try to acquire a usable home directory. */
2213
2214         if (*home)
2215                 return 0;
2216
2217         if (!c->working_directory_home)
2218                 return 0;
2219
2220         if (uid == 0) {
2221                 /* Hardcode /root as home directory for UID 0 */
2222                 *home = "/root";
2223                 return 1;
2224         }
2225
2226         r = get_home_dir(buf);
2227         if (r < 0)
2228                 return r;
2229
2230         *home = *buf;
2231         return 1;
2232 }
2233
2234 static int exec_child(
2235                 Unit *unit,
2236                 ExecCommand *command,
2237                 const ExecContext *context,
2238                 const ExecParameters *params,
2239                 ExecRuntime *runtime,
2240                 DynamicCreds *dcreds,
2241                 char **argv,
2242                 int socket_fd,
2243                 int named_iofds[3],
2244                 int *fds, unsigned n_fds,
2245                 char **files_env,
2246                 int user_lookup_fd,
2247                 int *exit_status,
2248                 char **error_message) {
2249
2250         _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **accum_env = NULL, **final_argv = NULL;
2251         _cleanup_free_ char *mac_selinux_context_net = NULL, *home_buffer = NULL;
2252         _cleanup_free_ gid_t *supplementary_gids = NULL;
2253         const char *username = NULL, *groupname = NULL;
2254         const char *home = NULL, *shell = NULL;
2255         dev_t journal_stream_dev = 0;
2256         ino_t journal_stream_ino = 0;
2257         bool needs_mount_namespace;
2258         uid_t uid = UID_INVALID;
2259         gid_t gid = GID_INVALID;
2260         int i, r, ngids = 0;
2261
2262         assert(unit);
2263         assert(command);
2264         assert(context);
2265         assert(params);
2266         assert(exit_status);
2267         assert(error_message);
2268         /* We don't always set error_message, hence it must be initialized */
2269         assert(*error_message == NULL);
2270
2271         rename_process_from_path(command->path);
2272
2273         /* We reset exactly these signals, since they are the
2274          * only ones we set to SIG_IGN in the main daemon. All
2275          * others we leave untouched because we set them to
2276          * SIG_DFL or a valid handler initially, both of which
2277          * will be demoted to SIG_DFL. */
2278         (void) default_signals(SIGNALS_CRASH_HANDLER,
2279                                SIGNALS_IGNORE, -1);
2280
2281         if (context->ignore_sigpipe)
2282                 (void) ignore_signals(SIGPIPE, -1);
2283
2284         r = reset_signal_mask();
2285         if (r < 0) {
2286                 *exit_status = EXIT_SIGNAL_MASK;
2287                 *error_message = strdup("Failed to reset signal mask");
2288                 /* If strdup fails, here and below, we will just print the generic error message. */
2289                 return r;
2290         }
2291
2292         if (params->idle_pipe)
2293                 do_idle_pipe_dance(params->idle_pipe);
2294
2295         /* Close sockets very early to make sure we don't
2296          * block init reexecution because it cannot bind its
2297          * sockets */
2298
2299         log_forget_fds();
2300
2301         r = close_remaining_fds(params, runtime, dcreds, user_lookup_fd, socket_fd, fds, n_fds);
2302         if (r < 0) {
2303                 *exit_status = EXIT_FDS;
2304                 *error_message = strdup("Failed to close remaining fds");
2305                 return r;
2306         }
2307
2308         if (!context->same_pgrp)
2309                 if (setsid() < 0) {
2310                         *exit_status = EXIT_SETSID;
2311                         return -errno;
2312                 }
2313
2314         exec_context_tty_reset(context, params);
2315
2316         if (unit_shall_confirm_spawn(unit)) {
2317                 const char *vc = params->confirm_spawn;
2318                 _cleanup_free_ char *cmdline = NULL;
2319
2320                 cmdline = exec_command_line(argv);
2321                 if (!cmdline) {
2322                         *exit_status = EXIT_CONFIRM;
2323                         return -ENOMEM;
2324                 }
2325
2326                 r = ask_for_confirmation(vc, unit, cmdline);
2327                 if (r != CONFIRM_EXECUTE) {
2328                         if (r == CONFIRM_PRETEND_SUCCESS) {
2329                                 *exit_status = EXIT_SUCCESS;
2330                                 return 0;
2331                         }
2332                         *exit_status = EXIT_CONFIRM;
2333                         *error_message = strdup("Execution cancelled");
2334                         return -ECANCELED;
2335                 }
2336         }
2337
2338         if (context->dynamic_user && dcreds) {
2339
2340                 /* Make sure we bypass our own NSS module for any NSS checks */
2341                 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
2342                         *exit_status = EXIT_USER;
2343                         *error_message = strdup("Failed to update environment");
2344                         return -errno;
2345                 }
2346
2347                 r = dynamic_creds_realize(dcreds, &uid, &gid);
2348                 if (r < 0) {
2349                         *exit_status = EXIT_USER;
2350                         *error_message = strdup("Failed to update dynamic user credentials");
2351                         return r;
2352                 }
2353
2354                 if (!uid_is_valid(uid)) {
2355                         *exit_status = EXIT_USER;
2356                         (void) asprintf(error_message, "UID validation failed for \""UID_FMT"\"", uid);
2357                         /* If asprintf fails, here and below, we will just print the generic error message. */
2358                         return -ESRCH;
2359                 }
2360
2361                 if (!gid_is_valid(gid)) {
2362                         *exit_status = EXIT_USER;
2363                         (void) asprintf(error_message, "GID validation failed for \""GID_FMT"\"", gid);
2364                         return -ESRCH;
2365                 }
2366
2367                 if (dcreds->user)
2368                         username = dcreds->user->name;
2369
2370         } else {
2371                 r = get_fixed_user(context, &username, &uid, &gid, &home, &shell);
2372                 if (r < 0) {
2373                         *exit_status = EXIT_USER;
2374                         *error_message = strdup("Failed to determine user credentials");
2375                         return r;
2376                 }
2377
2378                 r = get_fixed_group(context, &groupname, &gid);
2379                 if (r < 0) {
2380                         *exit_status = EXIT_GROUP;
2381                         *error_message = strdup("Failed to determine group credentials");
2382                         return r;
2383                 }
2384         }
2385
2386         /* Initialize user supplementary groups and get SupplementaryGroups= ones */
2387         r = get_supplementary_groups(context, username, groupname, gid,
2388                                      &supplementary_gids, &ngids);
2389         if (r < 0) {
2390                 *exit_status = EXIT_GROUP;
2391                 *error_message = strdup("Failed to determine supplementary groups");
2392                 return r;
2393         }
2394
2395         r = send_user_lookup(unit, user_lookup_fd, uid, gid);
2396         if (r < 0) {
2397                 *exit_status = EXIT_USER;
2398                 *error_message = strdup("Failed to send user credentials to PID1");
2399                 return r;
2400         }
2401
2402         user_lookup_fd = safe_close(user_lookup_fd);
2403
2404         r = acquire_home(context, uid, &home, &home_buffer);
2405         if (r < 0) {
2406                 *exit_status = EXIT_CHDIR;
2407                 *error_message = strdup("Failed to determine $HOME for user");
2408                 return r;
2409         }
2410
2411         /* If a socket is connected to STDIN/STDOUT/STDERR, we
2412          * must sure to drop O_NONBLOCK */
2413         if (socket_fd >= 0)
2414                 (void) fd_nonblock(socket_fd, false);
2415
2416         r = setup_input(context, params, socket_fd, named_iofds);
2417         if (r < 0) {
2418                 *exit_status = EXIT_STDIN;
2419                 *error_message = strdup("Failed to set up stdin");
2420                 return r;
2421         }
2422
2423         r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
2424         if (r < 0) {
2425                 *exit_status = EXIT_STDOUT;
2426                 *error_message = strdup("Failed to set up stdout");
2427                 return r;
2428         }
2429
2430         r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
2431         if (r < 0) {
2432                 *exit_status = EXIT_STDERR;
2433                 *error_message = strdup("Failed to set up stderr");
2434                 return r;
2435         }
2436
2437         if (params->cgroup_path) {
2438                 r = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0, NULL, NULL);
2439                 if (r < 0) {
2440                         *exit_status = EXIT_CGROUP;
2441                         (void) asprintf(error_message, "Failed to attach to cgroup %s", params->cgroup_path);
2442                         return r;
2443                 }
2444         }
2445
2446         if (context->oom_score_adjust_set) {
2447                 char t[DECIMAL_STR_MAX(context->oom_score_adjust)];
2448
2449                 /* When we can't make this change due to EPERM, then
2450                  * let's silently skip over it. User namespaces
2451                  * prohibit write access to this file, and we
2452                  * shouldn't trip up over that. */
2453
2454                 sprintf(t, "%i", context->oom_score_adjust);
2455                 r = write_string_file("/proc/self/oom_score_adj", t, 0);
2456                 if (r == -EPERM || r == -EACCES) {
2457                         log_open();
2458                         log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
2459                         log_close();
2460                 } else if (r < 0) {
2461                         *exit_status = EXIT_OOM_ADJUST;
2462                         *error_message = strdup("Failed to write /proc/self/oom_score_adj");
2463                         return -errno;
2464                 }
2465         }
2466
2467         if (context->nice_set)
2468                 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
2469                         *exit_status = EXIT_NICE;
2470                         return -errno;
2471                 }
2472
2473         if (context->cpu_sched_set) {
2474                 struct sched_param param = {
2475                         .sched_priority = context->cpu_sched_priority,
2476                 };
2477
2478                 r = sched_setscheduler(0,
2479                                        context->cpu_sched_policy |
2480                                        (context->cpu_sched_reset_on_fork ?
2481                                         SCHED_RESET_ON_FORK : 0),
2482                                        &param);
2483                 if (r < 0) {
2484                         *exit_status = EXIT_SETSCHEDULER;
2485                         return -errno;
2486                 }
2487         }
2488
2489         if (context->cpuset)
2490                 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
2491                         *exit_status = EXIT_CPUAFFINITY;
2492                         return -errno;
2493                 }
2494
2495         if (context->ioprio_set)
2496                 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
2497                         *exit_status = EXIT_IOPRIO;
2498                         return -errno;
2499                 }
2500
2501         if (context->timer_slack_nsec != NSEC_INFINITY)
2502                 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
2503                         *exit_status = EXIT_TIMERSLACK;
2504                         return -errno;
2505                 }
2506
2507         if (context->personality != PERSONALITY_INVALID)
2508                 if (personality(context->personality) < 0) {
2509                         *exit_status = EXIT_PERSONALITY;
2510                         return -errno;
2511                 }
2512
2513         if (context->utmp_id)
2514                 utmp_put_init_process(context->utmp_id, getpid(), getsid(0),
2515                                       context->tty_path,
2516                                       context->utmp_mode == EXEC_UTMP_INIT  ? INIT_PROCESS :
2517                                       context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
2518                                       USER_PROCESS,
2519                                       username);
2520
2521         if (context->user) {
2522                 r = chown_terminal(STDIN_FILENO, uid);
2523                 if (r < 0) {
2524                         *exit_status = EXIT_STDIN;
2525                         return r;
2526                 }
2527         }
2528
2529         /* If delegation is enabled we'll pass ownership of the cgroup
2530          * (but only in systemd's own controller hierarchy!) to the
2531          * user of the new process. */
2532         if (params->cgroup_path && context->user && params->cgroup_delegate) {
2533                 r = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
2534                 if (r < 0) {
2535                         *exit_status = EXIT_CGROUP;
2536                         return r;
2537                 }
2538
2539
2540                 r = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
2541                 if (r < 0) {
2542                         *exit_status = EXIT_CGROUP;
2543                         return r;
2544                 }
2545         }
2546
2547         if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
2548                 r = setup_runtime_directory(context, params, uid, gid);
2549                 if (r < 0) {
2550                         *exit_status = EXIT_RUNTIME_DIRECTORY;
2551                         return r;
2552                 }
2553         }
2554
2555         r = build_environment(
2556                         unit,
2557                         context,
2558                         params,
2559                         n_fds,
2560                         home,
2561                         username,
2562                         shell,
2563                         journal_stream_dev,
2564                         journal_stream_ino,
2565                         &our_env);
2566         if (r < 0) {
2567                 *exit_status = EXIT_MEMORY;
2568                 return r;
2569         }
2570
2571         r = build_pass_environment(context, &pass_env);
2572         if (r < 0) {
2573                 *exit_status = EXIT_MEMORY;
2574                 return r;
2575         }
2576
2577         accum_env = strv_env_merge(5,
2578                                    params->environment,
2579                                    our_env,
2580                                    pass_env,
2581                                    context->environment,
2582                                    files_env,
2583                                    NULL);
2584         if (!accum_env) {
2585                 *exit_status = EXIT_MEMORY;
2586                 return -ENOMEM;
2587         }
2588         accum_env = strv_env_clean(accum_env);
2589
2590         (void) umask(context->umask);
2591
2592         r = setup_keyring(unit, params, uid, gid);
2593         if (r < 0) {
2594                 *exit_status = EXIT_KEYRING;
2595                 return r;
2596         }
2597
2598         if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2599                 if (context->pam_name && username) {
2600                         r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
2601                         if (r < 0) {
2602                                 *exit_status = EXIT_PAM;
2603                                 return r;
2604                         }
2605                 }
2606         }
2607
2608         if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
2609                 r = setup_netns(runtime->netns_storage_socket);
2610                 if (r < 0) {
2611                         *exit_status = EXIT_NETWORK;
2612                         return r;
2613                 }
2614         }
2615
2616         needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
2617         if (needs_mount_namespace) {
2618                 r = apply_mount_namespace(unit, command, context, params, runtime);
2619                 if (r < 0) {
2620                         *exit_status = EXIT_NAMESPACE;
2621                         return r;
2622                 }
2623         }
2624
2625         /* Apply just after mount namespace setup */
2626         r = apply_working_directory(context, params, home, needs_mount_namespace, exit_status);
2627         if (r < 0)
2628                 return r;
2629
2630         /* Drop groups as early as possbile */
2631         if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2632                 r = enforce_groups(context, gid, supplementary_gids, ngids);
2633                 if (r < 0) {
2634                         *exit_status = EXIT_GROUP;
2635                         return r;
2636                 }
2637         }
2638
2639 #ifdef HAVE_SELINUX
2640         if ((params->flags & EXEC_APPLY_PERMISSIONS) &&
2641             mac_selinux_use() &&
2642             params->selinux_context_net &&
2643             socket_fd >= 0 &&
2644             !command->privileged) {
2645
2646                 r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
2647                 if (r < 0) {
2648                         *exit_status = EXIT_SELINUX_CONTEXT;
2649                         return r;
2650                 }
2651         }
2652 #endif
2653
2654         if ((params->flags & EXEC_APPLY_PERMISSIONS) && context->private_users) {
2655                 r = setup_private_users(uid, gid);
2656                 if (r < 0) {
2657                         *exit_status = EXIT_USER;
2658                         return r;
2659                 }
2660         }
2661
2662         /* We repeat the fd closing here, to make sure that
2663          * nothing is leaked from the PAM modules. Note that
2664          * we are more aggressive this time since socket_fd
2665          * and the netns fds we don't need anymore. The custom
2666          * endpoint fd was needed to upload the policy and can
2667          * now be closed as well. */
2668         r = close_all_fds(fds, n_fds);
2669         if (r >= 0)
2670                 r = shift_fds(fds, n_fds);
2671         if (r >= 0)
2672                 r = flags_fds(fds, n_fds, context->non_blocking);
2673         if (r < 0) {
2674                 *exit_status = EXIT_FDS;
2675                 return r;
2676         }
2677
2678         if ((params->flags & EXEC_APPLY_PERMISSIONS) && !command->privileged) {
2679
2680                 int secure_bits = context->secure_bits;
2681
2682                 for (i = 0; i < _RLIMIT_MAX; i++) {
2683
2684                         if (!context->rlimit[i])
2685                                 continue;
2686
2687                         r = setrlimit_closest(i, context->rlimit[i]);
2688                         if (r < 0) {
2689                                 *exit_status = EXIT_LIMITS;
2690                                 return r;
2691                         }
2692                 }
2693
2694                 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. */
2695                 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
2696                         if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
2697                                 *exit_status = EXIT_LIMITS;
2698                                 return -errno;
2699                         }
2700                 }
2701
2702                 if (!cap_test_all(context->capability_bounding_set)) {
2703                         r = capability_bounding_set_drop(context->capability_bounding_set, false);
2704                         if (r < 0) {
2705                                 *exit_status = EXIT_CAPABILITIES;
2706                                 *error_message = strdup("Failed to drop capabilities");
2707                                 return r;
2708                         }
2709                 }
2710
2711                 /* This is done before enforce_user, but ambient set
2712                  * does not survive over setresuid() if keep_caps is not set. */
2713                 if (context->capability_ambient_set != 0) {
2714                         r = capability_ambient_set_apply(context->capability_ambient_set, true);
2715                         if (r < 0) {
2716                                 *exit_status = EXIT_CAPABILITIES;
2717                                 *error_message = strdup("Failed to apply ambient capabilities (before UID change)");
2718                                 return r;
2719                         }
2720                 }
2721
2722                 if (context->user) {
2723                         r = enforce_user(context, uid);
2724                         if (r < 0) {
2725                                 *exit_status = EXIT_USER;
2726                                 (void) asprintf(error_message, "Failed to change UID to "UID_FMT, uid);
2727                                 return r;
2728                         }
2729                         if (context->capability_ambient_set != 0) {
2730
2731                                 /* Fix the ambient capabilities after user change. */
2732                                 r = capability_ambient_set_apply(context->capability_ambient_set, false);
2733                                 if (r < 0) {
2734                                         *exit_status = EXIT_CAPABILITIES;
2735                                         *error_message = strdup("Failed to apply ambient capabilities (after UID change)");
2736                                         return r;
2737                                 }
2738
2739                                 /* If we were asked to change user and ambient capabilities
2740                                  * were requested, we had to add keep-caps to the securebits
2741                                  * so that we would maintain the inherited capability set
2742                                  * through the setresuid(). Make sure that the bit is added
2743                                  * also to the context secure_bits so that we don't try to
2744                                  * drop the bit away next. */
2745
2746                                 secure_bits |= 1<<SECURE_KEEP_CAPS;
2747                         }
2748                 }
2749
2750                 /* Apply the MAC contexts late, but before seccomp syscall filtering, as those should really be last to
2751                  * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires
2752                  * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls
2753                  * are restricted. */
2754
2755 #ifdef HAVE_SELINUX
2756                 if (mac_selinux_use()) {
2757                         char *exec_context = mac_selinux_context_net ?: context->selinux_context;
2758
2759                         if (exec_context) {
2760                                 r = setexeccon(exec_context);
2761                                 if (r < 0) {
2762                                         *exit_status = EXIT_SELINUX_CONTEXT;
2763                                         (void) asprintf(error_message, "Failed to set SELinux context to %s", exec_context);
2764                                         return r;
2765                                 }
2766                         }
2767                 }
2768 #endif
2769
2770                 r = setup_smack(context, command);
2771                 if (r < 0) {
2772                         *exit_status = EXIT_SMACK_PROCESS_LABEL;
2773                         *error_message = strdup("Failed to set SMACK process label");
2774                         return r;
2775                 }
2776
2777 #ifdef HAVE_APPARMOR
2778                 if (context->apparmor_profile && mac_apparmor_use()) {
2779                         r = aa_change_onexec(context->apparmor_profile);
2780                         if (r < 0 && !context->apparmor_profile_ignore) {
2781                                 *exit_status = EXIT_APPARMOR_PROFILE;
2782                                 (void) asprintf(error_message,
2783                                                 "Failed to prepare AppArmor profile change to %s",
2784                                                 context->apparmor_profile);
2785                                 return -errno;
2786                         }
2787                 }
2788 #endif
2789
2790                 /* PR_GET_SECUREBITS is not privileged, while
2791                  * PR_SET_SECUREBITS is. So to suppress
2792                  * potential EPERMs we'll try not to call
2793                  * PR_SET_SECUREBITS unless necessary. */
2794                 if (prctl(PR_GET_SECUREBITS) != secure_bits)
2795                         if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
2796                                 *exit_status = EXIT_SECUREBITS;
2797                                 *error_message = strdup("Failed to set secure bits");
2798                                 return -errno;
2799                         }
2800
2801                 if (context_has_no_new_privileges(context))
2802                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
2803                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
2804                                 *error_message = strdup("Failed to disable new privileges");
2805                                 return -errno;
2806                         }
2807
2808 #ifdef HAVE_SECCOMP
2809                 r = apply_address_families(unit, context);
2810                 if (r < 0) {
2811                         *exit_status = EXIT_ADDRESS_FAMILIES;
2812                         *error_message = strdup("Failed to restrict address families");
2813                         return r;
2814                 }
2815
2816                 r = apply_memory_deny_write_execute(unit, context);
2817                 if (r < 0) {
2818                         *exit_status = EXIT_SECCOMP;
2819                         *error_message = strdup("Failed to disable writing to executable memory");
2820                         return r;
2821                 }
2822
2823                 r = apply_restrict_realtime(unit, context);
2824                 if (r < 0) {
2825                         *exit_status = EXIT_SECCOMP;
2826                         *error_message = strdup("Failed to apply realtime restrictions");
2827                         return r;
2828                 }
2829
2830                 r = apply_restrict_namespaces(unit, context);
2831                 if (r < 0) {
2832                         *exit_status = EXIT_SECCOMP;
2833                         *error_message = strdup("Failed to apply namespace restrictions");
2834                         return r;
2835                 }
2836
2837                 r = apply_protect_sysctl(unit, context);
2838                 if (r < 0) {
2839                         *exit_status = EXIT_SECCOMP;
2840                         *error_message = strdup("Failed to apply sysctl restrictions");
2841                         return r;
2842                 }
2843
2844                 r = apply_protect_kernel_modules(unit, context);
2845                 if (r < 0) {
2846                         *exit_status = EXIT_SECCOMP;
2847                         *error_message = strdup("Failed to apply module loading restrictions");
2848                         return r;
2849                 }
2850
2851                 r = apply_private_devices(unit, context);
2852                 if (r < 0) {
2853                         *exit_status = EXIT_SECCOMP;
2854                         *error_message = strdup("Failed to set up private devices");
2855                         return r;
2856                 }
2857
2858                 r = apply_syscall_archs(unit, context);
2859                 if (r < 0) {
2860                         *exit_status = EXIT_SECCOMP;
2861                         *error_message = strdup("Failed to apply syscall architecture restrictions");
2862                         return r;
2863                 }
2864
2865                 /* This really should remain the last step before the execve(), to make sure our own code is unaffected
2866                  * by the filter as little as possible. */
2867                 r = apply_syscall_filter(unit, context);
2868                 if (r < 0) {
2869                         *exit_status = EXIT_SECCOMP;
2870                         *error_message = strdup("Failed to apply syscall filters");
2871                         return r;
2872                 }
2873 #endif
2874         }
2875
2876         final_argv = replace_env_argv(argv, accum_env);
2877         if (!final_argv) {
2878                 *exit_status = EXIT_MEMORY;
2879                 *error_message = strdup("Failed to prepare process arguments");
2880                 return -ENOMEM;
2881         }
2882
2883         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
2884                 _cleanup_free_ char *line;
2885
2886                 line = exec_command_line(final_argv);
2887                 if (line) {
2888                         log_open();
2889                         log_struct(LOG_DEBUG,
2890                                    "EXECUTABLE=%s", command->path,
2891                                    LOG_UNIT_MESSAGE(unit, "Executing: %s", line),
2892                                    LOG_UNIT_ID(unit),
2893                                    NULL);
2894                         log_close();
2895                 }
2896         }
2897
2898         execve(command->path, final_argv, accum_env);
2899         *exit_status = EXIT_EXEC;
2900         return -errno;
2901 }
2902
2903 int exec_spawn(Unit *unit,
2904                ExecCommand *command,
2905                const ExecContext *context,
2906                const ExecParameters *params,
2907                ExecRuntime *runtime,
2908                DynamicCreds *dcreds,
2909                pid_t *ret) {
2910
2911         _cleanup_strv_free_ char **files_env = NULL;
2912         int *fds = NULL; unsigned n_fds = 0;
2913         _cleanup_free_ char *line = NULL;
2914         int socket_fd, r;
2915         int named_iofds[3] = { -1, -1, -1 };
2916         char **argv;
2917         pid_t pid;
2918
2919         assert(unit);
2920         assert(command);
2921         assert(context);
2922         assert(ret);
2923         assert(params);
2924         assert(params->fds || params->n_fds <= 0);
2925
2926         if (context->std_input == EXEC_INPUT_SOCKET ||
2927             context->std_output == EXEC_OUTPUT_SOCKET ||
2928             context->std_error == EXEC_OUTPUT_SOCKET) {
2929
2930                 if (params->n_fds != 1) {
2931                         log_unit_error(unit, "Got more than one socket.");
2932                         return -EINVAL;
2933                 }
2934
2935                 socket_fd = params->fds[0];
2936         } else {
2937                 socket_fd = -1;
2938                 fds = params->fds;
2939                 n_fds = params->n_fds;
2940         }
2941
2942         r = exec_context_named_iofds(unit, context, params, named_iofds);
2943         if (r < 0)
2944                 return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m");
2945
2946         r = exec_context_load_environment(unit, context, &files_env);
2947         if (r < 0)
2948                 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
2949
2950         argv = params->argv ?: command->argv;
2951         line = exec_command_line(argv);
2952         if (!line)
2953                 return log_oom();
2954
2955         log_struct(LOG_DEBUG,
2956                    LOG_UNIT_MESSAGE(unit, "About to execute: %s", line),
2957                    "EXECUTABLE=%s", command->path,
2958                    LOG_UNIT_ID(unit),
2959                    NULL);
2960         pid = fork();
2961         if (pid < 0)
2962                 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
2963
2964         if (pid == 0) {
2965                 int exit_status;
2966                 _cleanup_free_ char *error_message = NULL;
2967
2968                 r = exec_child(unit,
2969                                command,
2970                                context,
2971                                params,
2972                                runtime,
2973                                dcreds,
2974                                argv,
2975                                socket_fd,
2976                                named_iofds,
2977                                fds, n_fds,
2978                                files_env,
2979                                unit->manager->user_lookup_fds[1],
2980                                &exit_status,
2981                                &error_message);
2982                 if (r < 0) {
2983                         log_open();
2984                         if (error_message)
2985                                 log_struct_errno(LOG_ERR, r,
2986                                                  "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
2987                                                  LOG_UNIT_ID(unit),
2988                                                  LOG_UNIT_MESSAGE(unit, "%s: %m",
2989                                                                   error_message),
2990                                                  "EXECUTABLE=%s", command->path,
2991                                                  NULL);
2992                         else if (r == -ENOENT && command->ignore)
2993                                 log_struct_errno(LOG_INFO, r,
2994                                                  "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
2995                                                  LOG_UNIT_ID(unit),
2996                                                  LOG_UNIT_MESSAGE(unit, "Skipped spawning %s: %m",
2997                                                                   command->path),
2998                                                  "EXECUTABLE=%s", command->path,
2999                                                  NULL);
3000                         else
3001                                 log_struct_errno(LOG_ERR, r,
3002                                                  "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
3003                                                  LOG_UNIT_ID(unit),
3004                                                  LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
3005                                                                   exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
3006                                                                   command->path),
3007                                                  "EXECUTABLE=%s", command->path,
3008                                                  NULL);
3009                 }
3010
3011                 _exit(exit_status);
3012         }
3013
3014         log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
3015
3016         /* We add the new process to the cgroup both in the child (so
3017          * that we can be sure that no user code is ever executed
3018          * outside of the cgroup) and in the parent (so that we can be
3019          * sure that when we kill the cgroup the process will be
3020          * killed too). */
3021         if (params->cgroup_path)
3022                 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
3023
3024         exec_status_start(&command->exec_status, pid);
3025
3026         *ret = pid;
3027         return 0;
3028 }
3029
3030 void exec_context_init(ExecContext *c) {
3031         assert(c);
3032
3033         c->umask = 0022;
3034         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
3035         c->cpu_sched_policy = SCHED_OTHER;
3036         c->syslog_priority = LOG_DAEMON|LOG_INFO;
3037         c->syslog_level_prefix = true;
3038         c->ignore_sigpipe = true;
3039         c->timer_slack_nsec = NSEC_INFINITY;
3040         c->personality = PERSONALITY_INVALID;
3041         c->runtime_directory_mode = 0755;
3042         c->capability_bounding_set = CAP_ALL;
3043         c->restrict_namespaces = NAMESPACE_FLAGS_ALL;
3044 }
3045
3046 void exec_context_done(ExecContext *c) {
3047         unsigned l;
3048
3049         assert(c);
3050
3051         c->environment = strv_free(c->environment);
3052         c->environment_files = strv_free(c->environment_files);
3053         c->pass_environment = strv_free(c->pass_environment);
3054
3055         for (l = 0; l < ELEMENTSOF(c->rlimit); l++)
3056                 c->rlimit[l] = mfree(c->rlimit[l]);
3057
3058         for (l = 0; l < 3; l++)
3059                 c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);
3060
3061         c->working_directory = mfree(c->working_directory);
3062         c->root_directory = mfree(c->root_directory);
3063         c->root_image = mfree(c->root_image);
3064         c->tty_path = mfree(c->tty_path);
3065         c->syslog_identifier = mfree(c->syslog_identifier);
3066         c->user = mfree(c->user);
3067         c->group = mfree(c->group);
3068
3069         c->supplementary_groups = strv_free(c->supplementary_groups);
3070
3071         c->pam_name = mfree(c->pam_name);
3072
3073         c->read_only_paths = strv_free(c->read_only_paths);
3074         c->read_write_paths = strv_free(c->read_write_paths);
3075         c->inaccessible_paths = strv_free(c->inaccessible_paths);
3076
3077         bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
3078
3079         if (c->cpuset)
3080                 CPU_FREE(c->cpuset);
3081
3082         c->utmp_id = mfree(c->utmp_id);
3083         c->selinux_context = mfree(c->selinux_context);
3084         c->apparmor_profile = mfree(c->apparmor_profile);
3085
3086         c->syscall_filter = set_free(c->syscall_filter);
3087         c->syscall_archs = set_free(c->syscall_archs);
3088         c->address_families = set_free(c->address_families);
3089
3090         c->runtime_directory = strv_free(c->runtime_directory);
3091 }
3092
3093 int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
3094         char **i;
3095
3096         assert(c);
3097
3098         if (!runtime_prefix)
3099                 return 0;
3100
3101         STRV_FOREACH(i, c->runtime_directory) {
3102                 _cleanup_free_ char *p;
3103
3104                 p = strjoin(runtime_prefix, "/", *i);
3105                 if (!p)
3106                         return -ENOMEM;
3107
3108                 /* We execute this synchronously, since we need to be
3109                  * sure this is gone when we start the service
3110                  * next. */
3111                 (void) rm_rf(p, REMOVE_ROOT);
3112         }
3113
3114         return 0;
3115 }
3116
3117 void exec_command_done(ExecCommand *c) {
3118         assert(c);
3119
3120         c->path = mfree(c->path);
3121
3122         c->argv = strv_free(c->argv);
3123 }
3124
3125 void exec_command_done_array(ExecCommand *c, unsigned n) {
3126         unsigned i;
3127
3128         for (i = 0; i < n; i++)
3129                 exec_command_done(c+i);
3130 }
3131
3132 ExecCommand* exec_command_free_list(ExecCommand *c) {
3133         ExecCommand *i;
3134
3135         while ((i = c)) {
3136                 LIST_REMOVE(command, c, i);
3137                 exec_command_done(i);
3138                 free(i);
3139         }
3140
3141         return NULL;
3142 }
3143
3144 void exec_command_free_array(ExecCommand **c, unsigned n) {
3145         unsigned i;
3146
3147         for (i = 0; i < n; i++)
3148                 c[i] = exec_command_free_list(c[i]);
3149 }
3150
3151 typedef struct InvalidEnvInfo {
3152         Unit *unit;
3153         const char *path;
3154 } InvalidEnvInfo;
3155
3156 static void invalid_env(const char *p, void *userdata) {
3157         InvalidEnvInfo *info = userdata;
3158
3159         log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
3160 }
3161
3162 const char* exec_context_fdname(const ExecContext *c, int fd_index) {
3163         assert(c);
3164
3165         switch (fd_index) {
3166         case STDIN_FILENO:
3167                 if (c->std_input != EXEC_INPUT_NAMED_FD)
3168                         return NULL;
3169                 return c->stdio_fdname[STDIN_FILENO] ?: "stdin";
3170         case STDOUT_FILENO:
3171                 if (c->std_output != EXEC_OUTPUT_NAMED_FD)
3172                         return NULL;
3173                 return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";
3174         case STDERR_FILENO:
3175                 if (c->std_error != EXEC_OUTPUT_NAMED_FD)
3176                         return NULL;
3177                 return c->stdio_fdname[STDERR_FILENO] ?: "stderr";
3178         default:
3179                 return NULL;
3180         }
3181 }
3182
3183 int exec_context_named_iofds(Unit *unit, const ExecContext *c, const ExecParameters *p, int named_iofds[3]) {
3184         unsigned i, targets;
3185         const char* stdio_fdname[3];
3186
3187         assert(c);
3188         assert(p);
3189
3190         targets = (c->std_input == EXEC_INPUT_NAMED_FD) +
3191                   (c->std_output == EXEC_OUTPUT_NAMED_FD) +
3192                   (c->std_error == EXEC_OUTPUT_NAMED_FD);
3193
3194         for (i = 0; i < 3; i++)
3195                 stdio_fdname[i] = exec_context_fdname(c, i);
3196
3197         for (i = 0; i < p->n_fds && targets > 0; i++)
3198                 if (named_iofds[STDIN_FILENO] < 0 &&
3199                     c->std_input == EXEC_INPUT_NAMED_FD &&
3200                     stdio_fdname[STDIN_FILENO] &&
3201                     streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) {
3202
3203                         named_iofds[STDIN_FILENO] = p->fds[i];
3204                         targets--;
3205
3206                 } else if (named_iofds[STDOUT_FILENO] < 0 &&
3207                            c->std_output == EXEC_OUTPUT_NAMED_FD &&
3208                            stdio_fdname[STDOUT_FILENO] &&
3209                            streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) {
3210
3211                         named_iofds[STDOUT_FILENO] = p->fds[i];
3212                         targets--;
3213
3214                 } else if (named_iofds[STDERR_FILENO] < 0 &&
3215                            c->std_error == EXEC_OUTPUT_NAMED_FD &&
3216                            stdio_fdname[STDERR_FILENO] &&
3217                            streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) {
3218
3219                         named_iofds[STDERR_FILENO] = p->fds[i];
3220                         targets--;
3221                 }
3222
3223         return targets == 0 ? 0 : -ENOENT;
3224 }
3225
3226 int exec_context_load_environment(Unit *unit, const ExecContext *c, char ***l) {
3227         char **i, **r = NULL;
3228
3229         assert(c);
3230         assert(l);
3231
3232         STRV_FOREACH(i, c->environment_files) {
3233                 char *fn;
3234                 int k, n;
3235                 bool ignore = false;
3236                 char **p;
3237                 _cleanup_globfree_ glob_t pglob = {};
3238
3239                 fn = *i;
3240
3241                 if (fn[0] == '-') {
3242                         ignore = true;
3243                         fn++;
3244                 }
3245
3246                 if (!path_is_absolute(fn)) {
3247                         if (ignore)
3248                                 continue;
3249
3250                         strv_free(r);
3251                         return -EINVAL;
3252                 }
3253
3254                 /* Filename supports globbing, take all matching files */
3255                 k = safe_glob(fn, 0, &pglob);
3256                 if (k < 0) {
3257                         if (ignore)
3258                                 continue;
3259
3260                         strv_free(r);
3261                         return k;
3262                 }
3263
3264                 /* When we don't match anything, -ENOENT should be returned */
3265                 assert(pglob.gl_pathc > 0);
3266
3267                 for (n = 0; n < pglob.gl_pathc; n++) {
3268                         k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
3269                         if (k < 0) {
3270                                 if (ignore)
3271                                         continue;
3272
3273                                 strv_free(r);
3274                                 return k;
3275                         }
3276                         /* Log invalid environment variables with filename */
3277                         if (p) {
3278                                 InvalidEnvInfo info = {
3279                                         .unit = unit,
3280                                         .path = pglob.gl_pathv[n]
3281                                 };
3282
3283                                 p = strv_env_clean_with_callback(p, invalid_env, &info);
3284                         }
3285
3286                         if (r == NULL)
3287                                 r = p;
3288                         else {
3289                                 char **m;
3290
3291                                 m = strv_env_merge(2, r, p);
3292                                 strv_free(r);
3293                                 strv_free(p);
3294                                 if (!m)
3295                                         return -ENOMEM;
3296
3297                                 r = m;
3298                         }
3299                 }
3300         }
3301
3302         *l = r;
3303
3304         return 0;
3305 }
3306
3307 static bool tty_may_match_dev_console(const char *tty) {
3308         _cleanup_free_ char *active = NULL;
3309         char *console;
3310
3311         if (!tty)
3312                 return true;
3313
3314         if (startswith(tty, "/dev/"))
3315                 tty += 5;
3316
3317         /* trivial identity? */
3318         if (streq(tty, "console"))
3319                 return true;
3320
3321         console = resolve_dev_console(&active);
3322         /* if we could not resolve, assume it may */
3323         if (!console)
3324                 return true;
3325
3326         /* "tty0" means the active VC, so it may be the same sometimes */
3327         return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
3328 }
3329
3330 bool exec_context_may_touch_console(ExecContext *ec) {
3331
3332         return (ec->tty_reset ||
3333                 ec->tty_vhangup ||
3334                 ec->tty_vt_disallocate ||
3335                 is_terminal_input(ec->std_input) ||
3336                 is_terminal_output(ec->std_output) ||
3337                 is_terminal_output(ec->std_error)) &&
3338                tty_may_match_dev_console(exec_context_tty_path(ec));
3339 }
3340
3341 static void strv_fprintf(FILE *f, char **l) {
3342         char **g;
3343
3344         assert(f);
3345
3346         STRV_FOREACH(g, l)
3347                 fprintf(f, " %s", *g);
3348 }
3349
3350 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
3351         char **e, **d;
3352         unsigned i;
3353         int r;
3354
3355         assert(c);
3356         assert(f);
3357
3358         prefix = strempty(prefix);
3359
3360         fprintf(f,
3361                 "%sUMask: %04o\n"
3362                 "%sWorkingDirectory: %s\n"
3363                 "%sRootDirectory: %s\n"
3364                 "%sNonBlocking: %s\n"
3365                 "%sPrivateTmp: %s\n"
3366                 "%sPrivateDevices: %s\n"
3367                 "%sProtectKernelTunables: %s\n"
3368                 "%sProtectKernelModules: %s\n"
3369                 "%sProtectControlGroups: %s\n"
3370                 "%sPrivateNetwork: %s\n"
3371                 "%sPrivateUsers: %s\n"
3372                 "%sProtectHome: %s\n"
3373                 "%sProtectSystem: %s\n"
3374                 "%sMountAPIVFS: %s\n"
3375                 "%sIgnoreSIGPIPE: %s\n"
3376                 "%sMemoryDenyWriteExecute: %s\n"
3377                 "%sRestrictRealtime: %s\n",
3378                 prefix, c->umask,
3379                 prefix, c->working_directory ? c->working_directory : "/",
3380                 prefix, c->root_directory ? c->root_directory : "/",
3381                 prefix, yes_no(c->non_blocking),
3382                 prefix, yes_no(c->private_tmp),
3383                 prefix, yes_no(c->private_devices),
3384                 prefix, yes_no(c->protect_kernel_tunables),
3385                 prefix, yes_no(c->protect_kernel_modules),
3386                 prefix, yes_no(c->protect_control_groups),
3387                 prefix, yes_no(c->private_network),
3388                 prefix, yes_no(c->private_users),
3389                 prefix, protect_home_to_string(c->protect_home),
3390                 prefix, protect_system_to_string(c->protect_system),
3391                 prefix, yes_no(c->mount_apivfs),
3392                 prefix, yes_no(c->ignore_sigpipe),
3393                 prefix, yes_no(c->memory_deny_write_execute),
3394                 prefix, yes_no(c->restrict_realtime));
3395
3396         if (c->root_image)
3397                 fprintf(f, "%sRootImage: %s\n", prefix, c->root_image);
3398
3399         STRV_FOREACH(e, c->environment)
3400                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
3401
3402         STRV_FOREACH(e, c->environment_files)
3403                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
3404
3405         STRV_FOREACH(e, c->pass_environment)
3406                 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
3407
3408         fprintf(f, "%sRuntimeDirectoryMode: %04o\n", prefix, c->runtime_directory_mode);
3409
3410         STRV_FOREACH(d, c->runtime_directory)
3411                 fprintf(f, "%sRuntimeDirectory: %s\n", prefix, *d);
3412
3413         if (c->nice_set)
3414                 fprintf(f,
3415                         "%sNice: %i\n",
3416                         prefix, c->nice);
3417
3418         if (c->oom_score_adjust_set)
3419                 fprintf(f,
3420                         "%sOOMScoreAdjust: %i\n",
3421                         prefix, c->oom_score_adjust);
3422
3423         for (i = 0; i < RLIM_NLIMITS; i++)
3424                 if (c->rlimit[i]) {
3425                         fprintf(f, "%s%s: " RLIM_FMT "\n",
3426                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
3427                         fprintf(f, "%s%sSoft: " RLIM_FMT "\n",
3428                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
3429                 }
3430
3431         if (c->ioprio_set) {
3432                 _cleanup_free_ char *class_str = NULL;
3433
3434                 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
3435                 fprintf(f,
3436                         "%sIOSchedulingClass: %s\n"
3437                         "%sIOPriority: %i\n",
3438                         prefix, strna(class_str),
3439                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
3440         }
3441
3442         if (c->cpu_sched_set) {
3443                 _cleanup_free_ char *policy_str = NULL;
3444
3445                 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
3446                 fprintf(f,
3447                         "%sCPUSchedulingPolicy: %s\n"
3448                         "%sCPUSchedulingPriority: %i\n"
3449                         "%sCPUSchedulingResetOnFork: %s\n",
3450                         prefix, strna(policy_str),
3451                         prefix, c->cpu_sched_priority,
3452                         prefix, yes_no(c->cpu_sched_reset_on_fork));
3453         }
3454
3455         if (c->cpuset) {
3456                 fprintf(f, "%sCPUAffinity:", prefix);
3457                 for (i = 0; i < c->cpuset_ncpus; i++)
3458                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
3459                                 fprintf(f, " %u", i);
3460                 fputs("\n", f);
3461         }
3462
3463         if (c->timer_slack_nsec != NSEC_INFINITY)
3464                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
3465
3466         fprintf(f,
3467                 "%sStandardInput: %s\n"
3468                 "%sStandardOutput: %s\n"
3469                 "%sStandardError: %s\n",
3470                 prefix, exec_input_to_string(c->std_input),
3471                 prefix, exec_output_to_string(c->std_output),
3472                 prefix, exec_output_to_string(c->std_error));
3473
3474         if (c->tty_path)
3475                 fprintf(f,
3476                         "%sTTYPath: %s\n"
3477                         "%sTTYReset: %s\n"
3478                         "%sTTYVHangup: %s\n"
3479                         "%sTTYVTDisallocate: %s\n",
3480                         prefix, c->tty_path,
3481                         prefix, yes_no(c->tty_reset),
3482                         prefix, yes_no(c->tty_vhangup),
3483                         prefix, yes_no(c->tty_vt_disallocate));
3484
3485         if (c->std_output == EXEC_OUTPUT_SYSLOG ||
3486             c->std_output == EXEC_OUTPUT_KMSG ||
3487             c->std_output == EXEC_OUTPUT_JOURNAL ||
3488             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
3489             c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
3490             c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
3491             c->std_error == EXEC_OUTPUT_SYSLOG ||
3492             c->std_error == EXEC_OUTPUT_KMSG ||
3493             c->std_error == EXEC_OUTPUT_JOURNAL ||
3494             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
3495             c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
3496             c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
3497
3498                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
3499
3500                 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
3501                 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
3502
3503                 fprintf(f,
3504                         "%sSyslogFacility: %s\n"
3505                         "%sSyslogLevel: %s\n",
3506                         prefix, strna(fac_str),
3507                         prefix, strna(lvl_str));
3508         }
3509
3510         if (c->secure_bits)
3511                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
3512                         prefix,
3513                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
3514                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
3515                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
3516                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
3517                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
3518                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
3519
3520         if (c->capability_bounding_set != CAP_ALL) {
3521                 unsigned long l;
3522                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
3523
3524                 for (l = 0; l <= cap_last_cap(); l++)
3525                         if (c->capability_bounding_set & (UINT64_C(1) << l))
3526                                 fprintf(f, " %s", strna(capability_to_name(l)));
3527
3528                 fputs("\n", f);
3529         }
3530
3531         if (c->capability_ambient_set != 0) {
3532                 unsigned long l;
3533                 fprintf(f, "%sAmbientCapabilities:", prefix);
3534
3535                 for (l = 0; l <= cap_last_cap(); l++)
3536                         if (c->capability_ambient_set & (UINT64_C(1) << l))
3537                                 fprintf(f, " %s", strna(capability_to_name(l)));
3538
3539                 fputs("\n", f);
3540         }
3541
3542         if (c->user)
3543                 fprintf(f, "%sUser: %s\n", prefix, c->user);
3544         if (c->group)
3545                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
3546
3547         fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
3548
3549         if (strv_length(c->supplementary_groups) > 0) {
3550                 fprintf(f, "%sSupplementaryGroups:", prefix);
3551                 strv_fprintf(f, c->supplementary_groups);
3552                 fputs("\n", f);
3553         }
3554
3555         if (c->pam_name)
3556                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
3557
3558         if (strv_length(c->read_write_paths) > 0) {
3559                 fprintf(f, "%sReadWritePaths:", prefix);
3560                 strv_fprintf(f, c->read_write_paths);
3561                 fputs("\n", f);
3562         }
3563
3564         if (strv_length(c->read_only_paths) > 0) {
3565                 fprintf(f, "%sReadOnlyPaths:", prefix);
3566                 strv_fprintf(f, c->read_only_paths);
3567                 fputs("\n", f);
3568         }
3569
3570         if (strv_length(c->inaccessible_paths) > 0) {
3571                 fprintf(f, "%sInaccessiblePaths:", prefix);
3572                 strv_fprintf(f, c->inaccessible_paths);
3573                 fputs("\n", f);
3574         }
3575
3576         if (c->n_bind_mounts > 0)
3577                 for (i = 0; i < c->n_bind_mounts; i++) {
3578                         fprintf(f, "%s%s: %s:%s:%s\n", prefix,
3579                                 c->bind_mounts[i].read_only ? "BindReadOnlyPaths" : "BindPaths",
3580                                 c->bind_mounts[i].source,
3581                                 c->bind_mounts[i].destination,
3582                                 c->bind_mounts[i].recursive ? "rbind" : "norbind");
3583                 }
3584
3585         if (c->utmp_id)
3586                 fprintf(f,
3587                         "%sUtmpIdentifier: %s\n",
3588                         prefix, c->utmp_id);
3589
3590         if (c->selinux_context)
3591                 fprintf(f,
3592                         "%sSELinuxContext: %s%s\n",
3593                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
3594
3595         if (c->personality != PERSONALITY_INVALID)
3596                 fprintf(f,
3597                         "%sPersonality: %s\n",
3598                         prefix, strna(personality_to_string(c->personality)));
3599
3600         if (c->syscall_filter) {
3601 #ifdef HAVE_SECCOMP
3602                 Iterator j;
3603                 void *id;
3604                 bool first = true;
3605 #endif
3606
3607                 fprintf(f,
3608                         "%sSystemCallFilter: ",
3609                         prefix);
3610
3611                 if (!c->syscall_whitelist)
3612                         fputc('~', f);
3613
3614 #ifdef HAVE_SECCOMP
3615                 SET_FOREACH(id, c->syscall_filter, j) {
3616                         _cleanup_free_ char *name = NULL;
3617
3618                         if (first)
3619                                 first = false;
3620                         else
3621                                 fputc(' ', f);
3622
3623                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
3624                         fputs(strna(name), f);
3625                 }
3626 #endif
3627
3628                 fputc('\n', f);
3629         }
3630
3631         if (c->syscall_archs) {
3632 #ifdef HAVE_SECCOMP
3633                 Iterator j;
3634                 void *id;
3635 #endif
3636
3637                 fprintf(f,
3638                         "%sSystemCallArchitectures:",
3639                         prefix);
3640
3641 #ifdef HAVE_SECCOMP
3642                 SET_FOREACH(id, c->syscall_archs, j)
3643                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
3644 #endif
3645                 fputc('\n', f);
3646         }
3647
3648         if (exec_context_restrict_namespaces_set(c)) {
3649                 _cleanup_free_ char *s = NULL;
3650
3651                 r = namespace_flag_to_string_many(c->restrict_namespaces, &s);
3652                 if (r >= 0)
3653                         fprintf(f, "%sRestrictNamespaces: %s\n",
3654                                 prefix, s);
3655         }
3656
3657         if (c->syscall_errno > 0)
3658                 fprintf(f,
3659                         "%sSystemCallErrorNumber: %s\n",
3660                         prefix, strna(errno_to_name(c->syscall_errno)));
3661
3662         if (c->apparmor_profile)
3663                 fprintf(f,
3664                         "%sAppArmorProfile: %s%s\n",
3665                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
3666 }
3667
3668 bool exec_context_maintains_privileges(ExecContext *c) {
3669         assert(c);
3670
3671         /* Returns true if the process forked off would run under
3672          * an unchanged UID or as root. */
3673
3674         if (!c->user)
3675                 return true;
3676
3677         if (streq(c->user, "root") || streq(c->user, "0"))
3678                 return true;
3679
3680         return false;
3681 }
3682
3683 void exec_status_start(ExecStatus *s, pid_t pid) {
3684         assert(s);
3685
3686         zero(*s);
3687         s->pid = pid;
3688         dual_timestamp_get(&s->start_timestamp);
3689 }
3690
3691 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
3692         assert(s);
3693
3694         if (s->pid && s->pid != pid)
3695                 zero(*s);
3696
3697         s->pid = pid;
3698         dual_timestamp_get(&s->exit_timestamp);
3699
3700         s->code = code;
3701         s->status = status;
3702
3703         if (context) {
3704                 if (context->utmp_id)
3705                         utmp_put_dead_process(context->utmp_id, pid, code, status);
3706
3707                 exec_context_tty_reset(context, NULL);
3708         }
3709 }
3710
3711 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
3712         char buf[FORMAT_TIMESTAMP_MAX];
3713
3714         assert(s);
3715         assert(f);
3716
3717         if (s->pid <= 0)
3718                 return;
3719
3720         prefix = strempty(prefix);
3721
3722         fprintf(f,
3723                 "%sPID: "PID_FMT"\n",
3724                 prefix, s->pid);
3725
3726         if (dual_timestamp_is_set(&s->start_timestamp))
3727                 fprintf(f,
3728                         "%sStart Timestamp: %s\n",
3729                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
3730
3731         if (dual_timestamp_is_set(&s->exit_timestamp))
3732                 fprintf(f,
3733                         "%sExit Timestamp: %s\n"
3734                         "%sExit Code: %s\n"
3735                         "%sExit Status: %i\n",
3736                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
3737                         prefix, sigchld_code_to_string(s->code),
3738                         prefix, s->status);
3739 }
3740
3741 char *exec_command_line(char **argv) {
3742         size_t k;
3743         char *n, *p, **a;
3744         bool first = true;
3745
3746         assert(argv);
3747
3748         k = 1;
3749         STRV_FOREACH(a, argv)
3750                 k += strlen(*a)+3;
3751
3752         n = new(char, k);
3753         if (!n)
3754                 return NULL;
3755
3756         p = n;
3757         STRV_FOREACH(a, argv) {
3758
3759                 if (!first)
3760                         *(p++) = ' ';
3761                 else
3762                         first = false;
3763
3764                 if (strpbrk(*a, WHITESPACE)) {
3765                         *(p++) = '\'';
3766                         p = stpcpy(p, *a);
3767                         *(p++) = '\'';
3768                 } else
3769                         p = stpcpy(p, *a);
3770
3771         }
3772
3773         *p = 0;
3774
3775         /* FIXME: this doesn't really handle arguments that have
3776          * spaces and ticks in them */
3777
3778         return n;
3779 }
3780
3781 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
3782         _cleanup_free_ char *cmd = NULL;
3783         const char *prefix2;
3784
3785         assert(c);
3786         assert(f);
3787
3788         prefix = strempty(prefix);
3789         prefix2 = strjoina(prefix, "\t");
3790
3791         cmd = exec_command_line(c->argv);
3792         fprintf(f,
3793                 "%sCommand Line: %s\n",
3794                 prefix, cmd ? cmd : strerror(ENOMEM));
3795
3796         exec_status_dump(&c->exec_status, f, prefix2);
3797 }
3798
3799 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
3800         assert(f);
3801
3802         prefix = strempty(prefix);
3803
3804         LIST_FOREACH(command, c, c)
3805                 exec_command_dump(c, f, prefix);
3806 }
3807
3808 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
3809         ExecCommand *end;
3810
3811         assert(l);
3812         assert(e);
3813
3814         if (*l) {
3815                 /* It's kind of important, that we keep the order here */
3816                 LIST_FIND_TAIL(command, *l, end);
3817                 LIST_INSERT_AFTER(command, *l, end, e);
3818         } else
3819               *l = e;
3820 }
3821
3822 int exec_command_set(ExecCommand *c, const char *path, ...) {
3823         va_list ap;
3824         char **l, *p;
3825
3826         assert(c);
3827         assert(path);
3828
3829         va_start(ap, path);
3830         l = strv_new_ap(path, ap);
3831         va_end(ap);
3832
3833         if (!l)
3834                 return -ENOMEM;
3835
3836         p = strdup(path);
3837         if (!p) {
3838                 strv_free(l);
3839                 return -ENOMEM;
3840         }
3841
3842         free(c->path);
3843         c->path = p;
3844
3845         strv_free(c->argv);
3846         c->argv = l;
3847
3848         return 0;
3849 }
3850
3851 int exec_command_append(ExecCommand *c, const char *path, ...) {
3852         _cleanup_strv_free_ char **l = NULL;
3853         va_list ap;
3854         int r;
3855
3856         assert(c);
3857         assert(path);
3858
3859         va_start(ap, path);
3860         l = strv_new_ap(path, ap);
3861         va_end(ap);
3862
3863         if (!l)
3864                 return -ENOMEM;
3865
3866         r = strv_extend_strv(&c->argv, l, false);
3867         if (r < 0)
3868                 return r;
3869
3870         return 0;
3871 }
3872
3873
3874 static int exec_runtime_allocate(ExecRuntime **rt) {
3875
3876         if (*rt)
3877                 return 0;
3878
3879         *rt = new0(ExecRuntime, 1);
3880         if (!*rt)
3881                 return -ENOMEM;
3882
3883         (*rt)->n_ref = 1;
3884         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
3885
3886         return 0;
3887 }
3888
3889 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
3890         int r;
3891
3892         assert(rt);
3893         assert(c);
3894         assert(id);
3895
3896         if (*rt)
3897                 return 1;
3898
3899         if (!c->private_network && !c->private_tmp)
3900                 return 0;
3901
3902         r = exec_runtime_allocate(rt);
3903         if (r < 0)
3904                 return r;
3905
3906         if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
3907                 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, (*rt)->netns_storage_socket) < 0)
3908                         return -errno;
3909         }
3910
3911         if (c->private_tmp && !(*rt)->tmp_dir) {
3912                 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
3913                 if (r < 0)
3914                         return r;
3915         }
3916
3917         return 1;
3918 }
3919
3920 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
3921         assert(r);
3922         assert(r->n_ref > 0);
3923
3924         r->n_ref++;
3925         return r;
3926 }
3927
3928 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
3929
3930         if (!r)
3931                 return NULL;
3932
3933         assert(r->n_ref > 0);
3934
3935         r->n_ref--;
3936         if (r->n_ref > 0)
3937                 return NULL;
3938
3939         free(r->tmp_dir);
3940         free(r->var_tmp_dir);
3941         safe_close_pair(r->netns_storage_socket);
3942         return mfree(r);
3943 }
3944
3945 int exec_runtime_serialize(Unit *u, ExecRuntime *rt, FILE *f, FDSet *fds) {
3946         assert(u);
3947         assert(f);
3948         assert(fds);
3949
3950         if (!rt)
3951                 return 0;
3952
3953         if (rt->tmp_dir)
3954                 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
3955
3956         if (rt->var_tmp_dir)
3957                 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
3958
3959         if (rt->netns_storage_socket[0] >= 0) {
3960                 int copy;
3961
3962                 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
3963                 if (copy < 0)
3964                         return copy;
3965
3966                 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
3967         }
3968
3969         if (rt->netns_storage_socket[1] >= 0) {
3970                 int copy;
3971
3972                 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
3973                 if (copy < 0)
3974                         return copy;
3975
3976                 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
3977         }
3978
3979         return 0;
3980 }
3981
3982 int exec_runtime_deserialize_item(Unit *u, ExecRuntime **rt, const char *key, const char *value, FDSet *fds) {
3983         int r;
3984
3985         assert(rt);
3986         assert(key);
3987         assert(value);
3988
3989         if (streq(key, "tmp-dir")) {
3990                 char *copy;
3991
3992                 r = exec_runtime_allocate(rt);
3993                 if (r < 0)
3994                         return log_oom();
3995
3996                 copy = strdup(value);
3997                 if (!copy)
3998                         return log_oom();
3999
4000                 free((*rt)->tmp_dir);
4001                 (*rt)->tmp_dir = copy;
4002
4003         } else if (streq(key, "var-tmp-dir")) {
4004                 char *copy;
4005
4006                 r = exec_runtime_allocate(rt);
4007                 if (r < 0)
4008                         return log_oom();
4009
4010                 copy = strdup(value);
4011                 if (!copy)
4012                         return log_oom();
4013
4014                 free((*rt)->var_tmp_dir);
4015                 (*rt)->var_tmp_dir = copy;
4016
4017         } else if (streq(key, "netns-socket-0")) {
4018                 int fd;
4019
4020                 r = exec_runtime_allocate(rt);
4021                 if (r < 0)
4022                         return log_oom();
4023
4024                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
4025                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
4026                 else {
4027                         safe_close((*rt)->netns_storage_socket[0]);
4028                         (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
4029                 }
4030         } else if (streq(key, "netns-socket-1")) {
4031                 int fd;
4032
4033                 r = exec_runtime_allocate(rt);
4034                 if (r < 0)
4035                         return log_oom();
4036
4037                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
4038                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
4039                 else {
4040                         safe_close((*rt)->netns_storage_socket[1]);
4041                         (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
4042                 }
4043         } else
4044                 return 0;
4045
4046         return 1;
4047 }
4048
4049 static void *remove_tmpdir_thread(void *p) {
4050         _cleanup_free_ char *path = p;
4051
4052         (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
4053         return NULL;
4054 }
4055
4056 void exec_runtime_destroy(ExecRuntime *rt) {
4057         int r;
4058
4059         if (!rt)
4060                 return;
4061
4062         /* If there are multiple users of this, let's leave the stuff around */
4063         if (rt->n_ref > 1)
4064                 return;
4065
4066         if (rt->tmp_dir) {
4067                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
4068
4069                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
4070                 if (r < 0) {
4071                         log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
4072                         free(rt->tmp_dir);
4073                 }
4074
4075                 rt->tmp_dir = NULL;
4076         }
4077
4078         if (rt->var_tmp_dir) {
4079                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
4080
4081                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
4082                 if (r < 0) {
4083                         log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
4084                         free(rt->var_tmp_dir);
4085                 }
4086
4087                 rt->var_tmp_dir = NULL;
4088         }
4089
4090         safe_close_pair(rt->netns_storage_socket);
4091 }
4092
4093 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
4094         [EXEC_INPUT_NULL] = "null",
4095         [EXEC_INPUT_TTY] = "tty",
4096         [EXEC_INPUT_TTY_FORCE] = "tty-force",
4097         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
4098         [EXEC_INPUT_SOCKET] = "socket",
4099         [EXEC_INPUT_NAMED_FD] = "fd",
4100 };
4101
4102 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
4103
4104 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
4105         [EXEC_OUTPUT_INHERIT] = "inherit",
4106         [EXEC_OUTPUT_NULL] = "null",
4107         [EXEC_OUTPUT_TTY] = "tty",
4108         [EXEC_OUTPUT_SYSLOG] = "syslog",
4109         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
4110         [EXEC_OUTPUT_KMSG] = "kmsg",
4111         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
4112         [EXEC_OUTPUT_JOURNAL] = "journal",
4113         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
4114         [EXEC_OUTPUT_SOCKET] = "socket",
4115         [EXEC_OUTPUT_NAMED_FD] = "fd",
4116 };
4117
4118 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
4119
4120 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
4121         [EXEC_UTMP_INIT] = "init",
4122         [EXEC_UTMP_LOGIN] = "login",
4123         [EXEC_UTMP_USER] = "user",
4124 };
4125
4126 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);