src/core/execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <poll.h>
   6 #include <sys/eventfd.h>
   7 #include <sys/ioctl.h>
   8 #include <sys/mman.h>
   9 #include <sys/mount.h>
  10 #include <sys/personality.h>
  11 #include <sys/prctl.h>
  12 #include <sys/shm.h>
  13 #include <sys/types.h>
  14 #include <sys/un.h>
  15 #include <unistd.h>
  16 #include <utmpx.h>
  17
  18 #if HAVE_PAM
  19 #include <security/pam_appl.h>
  20 #endif
  21
  22 #if HAVE_SELINUX
  23 #include <selinux/selinux.h>
  24 #endif
  25
  26 #if HAVE_SECCOMP
  27 #include <seccomp.h>
  28 #endif
  29
  30 #if HAVE_APPARMOR
  31 #include <sys/apparmor.h>
  32 #endif
  33
  34 #include "sd-messages.h"
  35
  36 #include "acl-util.h"
  37 #include "af-list.h"
  38 #include "alloc-util.h"
  39 #if HAVE_APPARMOR
  40 #include "apparmor-util.h"
  41 #endif
  42 #include "argv-util.h"
  43 #include "async.h"
  44 #include "barrier.h"
  45 #include "bpf-lsm.h"
  46 #include "cap-list.h"
  47 #include "capability-util.h"
  48 #include "cgroup-setup.h"
  49 #include "chase.h"
  50 #include "chown-recursive.h"
  51 #include "constants.h"
  52 #include "cpu-set-util.h"
  53 #include "creds-util.h"
  54 #include "data-fd-util.h"
  55 #include "env-file.h"
  56 #include "env-util.h"
  57 #include "errno-list.h"
  58 #include "escape.h"
  59 #include "execute.h"
  60 #include "exit-status.h"
  61 #include "fd-util.h"
  62 #include "fileio.h"
  63 #include "format-util.h"
  64 #include "glob-util.h"
  65 #include "hexdecoct.h"
  66 #include "io-util.h"
  67 #include "ioprio-util.h"
  68 #include "label.h"
  69 #include "log.h"
  70 #include "macro.h"
  71 #include "manager.h"
  72 #include "manager-dump.h"
  73 #include "memory-util.h"
  74 #include "missing_fs.h"
  75 #include "missing_ioprio.h"
  76 #include "missing_prctl.h"
  77 #include "mkdir-label.h"
  78 #include "mount-util.h"
  79 #include "mountpoint-util.h"
  80 #include "namespace.h"
  81 #include "parse-util.h"
  82 #include "path-util.h"
  83 #include "proc-cmdline.h"
  84 #include "process-util.h"
  85 #include "psi-util.h"
  86 #include "random-util.h"
  87 #include "recurse-dir.h"
  88 #include "rlimit-util.h"
  89 #include "rm-rf.h"
  90 #if HAVE_SECCOMP
  91 #include "seccomp-util.h"
  92 #endif
  93 #include "securebits-util.h"
  94 #include "selinux-util.h"
  95 #include "signal-util.h"
  96 #include "smack-util.h"
  97 #include "socket-util.h"
  98 #include "sort-util.h"
  99 #include "special.h"
 100 #include "stat-util.h"
 101 #include "string-table.h"
 102 #include "string-util.h"
 103 #include "strv.h"
 104 #include "syslog-util.h"
 105 #include "terminal-util.h"
 106 #include "tmpfile-util.h"
 107 #include "umask-util.h"
 108 #include "unit-serialize.h"
 109 #include "user-util.h"
 110 #include "utmp-wtmp.h"
 111
 112 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
 113 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
 114
 115 #define SNDBUF_SIZE (8*1024*1024)
 116
 117 static int shift_fds(int fds[], size_t n_fds) {
 118         if (n_fds <= 0)
 119                 return 0;
 120
 121         /* Modifies the fds array! (sorts it) */
 122
 123         assert(fds);
 124
 125         for (int start = 0;;) {
 126                 int restart_from = -1;
 127
 128                 for (int i = start; i < (int) n_fds; i++) {
 129                         int nfd;
 130
 131                         /* Already at right index? */
 132                         if (fds[i] == i+3)
 133                                 continue;
 134
 135                         nfd = fcntl(fds[i], F_DUPFD, i + 3);
 136                         if (nfd < 0)
 137                                 return -errno;
 138
 139                         safe_close(fds[i]);
 140                         fds[i] = nfd;
 141
 142                         /* Hmm, the fd we wanted isn't free? Then
 143                          * let's remember that and try again from here */
 144                         if (nfd != i+3 && restart_from < 0)
 145                                 restart_from = i;
 146                 }
 147
 148                 if (restart_from < 0)
 149                         break;
 150
 151                 start = restart_from;
 152         }
 153
 154         return 0;
 155 }
 156
 157 static int flags_fds(
 158                 const int fds[],
 159                 size_t n_socket_fds,
 160                 size_t n_fds,
 161                 bool nonblock) {
 162
 163         int r;
 164
 165         if (n_fds <= 0)
 166                 return 0;
 167
 168         assert(fds);
 169
 170         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags.
 171          * O_NONBLOCK only applies to socket activation though. */
 172
 173         for (size_t i = 0; i < n_fds; i++) {
 174
 175                 if (i < n_socket_fds) {
 176                         r = fd_nonblock(fds[i], nonblock);
 177                         if (r < 0)
 178                                 return r;
 179                 }
 180
 181                 /* We unconditionally drop FD_CLOEXEC from the fds,
 182                  * since after all we want to pass these fds to our
 183                  * children */
 184
 185                 r = fd_cloexec(fds[i], false);
 186                 if (r < 0)
 187                         return r;
 188         }
 189
 190         return 0;
 191 }
 192
 193 static const char *exec_context_tty_path(const ExecContext *context) {
 194         assert(context);
 195
 196         if (context->stdio_as_fds)
 197                 return NULL;
 198
 199         if (context->tty_path)
 200                 return context->tty_path;
 201
 202         return "/dev/console";
 203 }
 204
 205 static int exec_context_tty_size(const ExecContext *context, unsigned *ret_rows, unsigned *ret_cols) {
 206         _cleanup_free_ char *rowskey = NULL, *rowsvalue = NULL, *colskey = NULL, *colsvalue = NULL;
 207         unsigned rows, cols;
 208         const char *tty;
 209         int r;
 210
 211         assert(context);
 212         assert(ret_rows);
 213         assert(ret_cols);
 214
 215         rows = context->tty_rows;
 216         cols = context->tty_cols;
 217
 218         tty = exec_context_tty_path(context);
 219         if (!tty || (rows != UINT_MAX && cols != UINT_MAX)) {
 220                 *ret_rows = rows;
 221                 *ret_cols = cols;
 222                 return 0;
 223         }
 224
 225         tty = skip_dev_prefix(tty);
 226         if (!in_charset(tty, ALPHANUMERICAL)) {
 227                 log_debug("%s contains non-alphanumeric characters, ignoring", tty);
 228                 *ret_rows = rows;
 229                 *ret_cols = cols;
 230                 return 0;
 231         }
 232
 233         rowskey = strjoin("systemd.tty.rows.", tty);
 234         if (!rowskey)
 235                 return -ENOMEM;
 236
 237         colskey = strjoin("systemd.tty.columns.", tty);
 238         if (!colskey)
 239                 return -ENOMEM;
 240
 241         r = proc_cmdline_get_key_many(/* flags = */ 0,
 242                                       rowskey, &rowsvalue,
 243                                       colskey, &colsvalue);
 244         if (r < 0)
 245                 log_debug_errno(r, "Failed to read TTY size of %s from kernel cmdline, ignoring: %m", tty);
 246
 247         if (rows == UINT_MAX && rowsvalue) {
 248                 r = safe_atou(rowsvalue, &rows);
 249                 if (r < 0)
 250                         log_debug_errno(r, "Failed to parse %s=%s, ignoring: %m", rowskey, rowsvalue);
 251         }
 252
 253         if (cols == UINT_MAX && colsvalue) {
 254                 r = safe_atou(colsvalue, &cols);
 255                 if (r < 0)
 256                         log_debug_errno(r, "Failed to parse %s=%s, ignoring: %m", colskey, colsvalue);
 257         }
 258
 259         *ret_rows = rows;
 260         *ret_cols = cols;
 261
 262         return 0;
 263 }
 264
 265 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
 266         const char *path;
 267
 268         assert(context);
 269
 270         path = exec_context_tty_path(context);
 271
 272         if (context->tty_vhangup) {
 273                 if (p && p->stdin_fd >= 0)
 274                         (void) terminal_vhangup_fd(p->stdin_fd);
 275                 else if (path)
 276                         (void) terminal_vhangup(path);
 277         }
 278
 279         if (context->tty_reset) {
 280                 if (p && p->stdin_fd >= 0)
 281                         (void) reset_terminal_fd(p->stdin_fd, true);
 282                 else if (path)
 283                         (void) reset_terminal(path);
 284         }
 285
 286         if (p && p->stdin_fd >= 0) {
 287                 unsigned rows = context->tty_rows, cols = context->tty_cols;
 288
 289                 (void) exec_context_tty_size(context, &rows, &cols);
 290                 (void) terminal_set_size_fd(p->stdin_fd, path, rows, cols);
 291         }
 292
 293         if (context->tty_vt_disallocate && path)
 294                 (void) vt_disallocate(path);
 295 }
 296
 297 static bool is_terminal_input(ExecInput i) {
 298         return IN_SET(i,
 299                       EXEC_INPUT_TTY,
 300                       EXEC_INPUT_TTY_FORCE,
 301                       EXEC_INPUT_TTY_FAIL);
 302 }
 303
 304 static bool is_terminal_output(ExecOutput o) {
 305         return IN_SET(o,
 306                       EXEC_OUTPUT_TTY,
 307                       EXEC_OUTPUT_KMSG_AND_CONSOLE,
 308                       EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 309 }
 310
 311 static bool is_kmsg_output(ExecOutput o) {
 312         return IN_SET(o,
 313                       EXEC_OUTPUT_KMSG,
 314                       EXEC_OUTPUT_KMSG_AND_CONSOLE);
 315 }
 316
 317 static bool exec_context_needs_term(const ExecContext *c) {
 318         assert(c);
 319
 320         /* Return true if the execution context suggests we should set $TERM to something useful. */
 321
 322         if (is_terminal_input(c->std_input))
 323                 return true;
 324
 325         if (is_terminal_output(c->std_output))
 326                 return true;
 327
 328         if (is_terminal_output(c->std_error))
 329                 return true;
 330
 331         return !!c->tty_path;
 332 }
 333
 334 static int open_null_as(int flags, int nfd) {
 335         int fd;
 336
 337         assert(nfd >= 0);
 338
 339         fd = open("/dev/null", flags|O_NOCTTY);
 340         if (fd < 0)
 341                 return -errno;
 342
 343         return move_fd(fd, nfd, false);
 344 }
 345
 346 static int connect_journal_socket(
 347                 int fd,
 348                 const char *log_namespace,
 349                 uid_t uid,
 350                 gid_t gid) {
 351
 352         uid_t olduid = UID_INVALID;
 353         gid_t oldgid = GID_INVALID;
 354         const char *j;
 355         int r;
 356
 357         j = log_namespace ?
 358                 strjoina("/run/systemd/journal.", log_namespace, "/stdout") :
 359                 "/run/systemd/journal/stdout";
 360
 361         if (gid_is_valid(gid)) {
 362                 oldgid = getgid();
 363
 364                 if (setegid(gid) < 0)
 365                         return -errno;
 366         }
 367
 368         if (uid_is_valid(uid)) {
 369                 olduid = getuid();
 370
 371                 if (seteuid(uid) < 0) {
 372                         r = -errno;
 373                         goto restore_gid;
 374                 }
 375         }
 376
 377         r = connect_unix_path(fd, AT_FDCWD, j);
 378
 379         /* If we fail to restore the uid or gid, things will likely fail later on. This should only happen if
 380            an LSM interferes. */
 381
 382         if (uid_is_valid(uid))
 383                 (void) seteuid(olduid);
 384
 385  restore_gid:
 386         if (gid_is_valid(gid))
 387                 (void) setegid(oldgid);
 388
 389         return r;
 390 }
 391
 392 static int connect_logger_as(
 393                 const Unit *unit,
 394                 const ExecContext *context,
 395                 const ExecParameters *params,
 396                 ExecOutput output,
 397                 const char *ident,
 398                 int nfd,
 399                 uid_t uid,
 400                 gid_t gid) {
 401
 402         _cleanup_close_ int fd = -EBADF;
 403         int r;
 404
 405         assert(context);
 406         assert(params);
 407         assert(output < _EXEC_OUTPUT_MAX);
 408         assert(ident);
 409         assert(nfd >= 0);
 410
 411         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 412         if (fd < 0)
 413                 return -errno;
 414
 415         r = connect_journal_socket(fd, context->log_namespace, uid, gid);
 416         if (r < 0)
 417                 return r;
 418
 419         if (shutdown(fd, SHUT_RD) < 0)
 420                 return -errno;
 421
 422         (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
 423
 424         if (dprintf(fd,
 425                 "%s\n"
 426                 "%s\n"
 427                 "%i\n"
 428                 "%i\n"
 429                 "%i\n"
 430                 "%i\n"
 431                 "%i\n",
 432                 context->syslog_identifier ?: ident,
 433                 params->flags & EXEC_PASS_LOG_UNIT ? unit->id : "",
 434                 context->syslog_priority,
 435                 !!context->syslog_level_prefix,
 436                 false,
 437                 is_kmsg_output(output),
 438                 is_terminal_output(output)) < 0)
 439                 return -errno;
 440
 441         return move_fd(TAKE_FD(fd), nfd, false);
 442 }
 443
 444 static int open_terminal_as(const char *path, int flags, int nfd) {
 445         int fd;
 446
 447         assert(path);
 448         assert(nfd >= 0);
 449
 450         fd = open_terminal(path, flags | O_NOCTTY);
 451         if (fd < 0)
 452                 return fd;
 453
 454         return move_fd(fd, nfd, false);
 455 }
 456
 457 static int acquire_path(const char *path, int flags, mode_t mode) {
 458         _cleanup_close_ int fd = -EBADF;
 459         int r;
 460
 461         assert(path);
 462
 463         if (IN_SET(flags & O_ACCMODE, O_WRONLY, O_RDWR))
 464                 flags |= O_CREAT;
 465
 466         fd = open(path, flags|O_NOCTTY, mode);
 467         if (fd >= 0)
 468                 return TAKE_FD(fd);
 469
 470         if (errno != ENXIO) /* ENXIO is returned when we try to open() an AF_UNIX file system socket on Linux */
 471                 return -errno;
 472
 473         /* So, it appears the specified path could be an AF_UNIX socket. Let's see if we can connect to it. */
 474
 475         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 476         if (fd < 0)
 477                 return -errno;
 478
 479         r = connect_unix_path(fd, AT_FDCWD, path);
 480         if (IN_SET(r, -ENOTSOCK, -EINVAL))
 481                 /* Propagate initial error if we get ENOTSOCK or EINVAL, i.e. we have indication that this
 482                  * wasn't an AF_UNIX socket after all */
 483                 return -ENXIO;
 484         if (r < 0)
 485                 return r;
 486
 487         if ((flags & O_ACCMODE) == O_RDONLY)
 488                 r = shutdown(fd, SHUT_WR);
 489         else if ((flags & O_ACCMODE) == O_WRONLY)
 490                 r = shutdown(fd, SHUT_RD);
 491         else
 492                 r = 0;
 493         if (r < 0)
 494                 return -errno;
 495
 496         return TAKE_FD(fd);
 497 }
 498
 499 static int fixup_input(
 500                 const ExecContext *context,
 501                 int socket_fd,
 502                 bool apply_tty_stdin) {
 503
 504         ExecInput std_input;
 505
 506         assert(context);
 507
 508         std_input = context->std_input;
 509
 510         if (is_terminal_input(std_input) && !apply_tty_stdin)
 511                 return EXEC_INPUT_NULL;
 512
 513         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 514                 return EXEC_INPUT_NULL;
 515
 516         if (std_input == EXEC_INPUT_DATA && context->stdin_data_size == 0)
 517                 return EXEC_INPUT_NULL;
 518
 519         return std_input;
 520 }
 521
 522 static int fixup_output(ExecOutput output, int socket_fd) {
 523
 524         if (output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 525                 return EXEC_OUTPUT_INHERIT;
 526
 527         return output;
 528 }
 529
 530 static int setup_input(
 531                 const ExecContext *context,
 532                 const ExecParameters *params,
 533                 int socket_fd,
 534                 const int named_iofds[static 3]) {
 535
 536         ExecInput i;
 537         int r;
 538
 539         assert(context);
 540         assert(params);
 541         assert(named_iofds);
 542
 543         if (params->stdin_fd >= 0) {
 544                 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
 545                         return -errno;
 546
 547                 /* Try to make this the controlling tty, if it is a tty, and reset it */
 548                 if (isatty(STDIN_FILENO)) {
 549                         unsigned rows = context->tty_rows, cols = context->tty_cols;
 550
 551                         (void) exec_context_tty_size(context, &rows, &cols);
 552                         (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
 553                         (void) reset_terminal_fd(STDIN_FILENO, true);
 554                         (void) terminal_set_size_fd(STDIN_FILENO, NULL, rows, cols);
 555                 }
 556
 557                 return STDIN_FILENO;
 558         }
 559
 560         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 561
 562         switch (i) {
 563
 564         case EXEC_INPUT_NULL:
 565                 return open_null_as(O_RDONLY, STDIN_FILENO);
 566
 567         case EXEC_INPUT_TTY:
 568         case EXEC_INPUT_TTY_FORCE:
 569         case EXEC_INPUT_TTY_FAIL: {
 570                 unsigned rows, cols;
 571                 int fd;
 572
 573                 fd = acquire_terminal(exec_context_tty_path(context),
 574                                       i == EXEC_INPUT_TTY_FAIL  ? ACQUIRE_TERMINAL_TRY :
 575                                       i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE :
 576                                                                   ACQUIRE_TERMINAL_WAIT,
 577                                       USEC_INFINITY);
 578                 if (fd < 0)
 579                         return fd;
 580
 581                 r = exec_context_tty_size(context, &rows, &cols);
 582                 if (r < 0)
 583                         return r;
 584
 585                 r = terminal_set_size_fd(fd, exec_context_tty_path(context), rows, cols);
 586                 if (r < 0)
 587                         return r;
 588
 589                 return move_fd(fd, STDIN_FILENO, false);
 590         }
 591
 592         case EXEC_INPUT_SOCKET:
 593                 assert(socket_fd >= 0);
 594
 595                 return RET_NERRNO(dup2(socket_fd, STDIN_FILENO));
 596
 597         case EXEC_INPUT_NAMED_FD:
 598                 assert(named_iofds[STDIN_FILENO] >= 0);
 599
 600                 (void) fd_nonblock(named_iofds[STDIN_FILENO], false);
 601                 return RET_NERRNO(dup2(named_iofds[STDIN_FILENO], STDIN_FILENO));
 602
 603         case EXEC_INPUT_DATA: {
 604                 int fd;
 605
 606                 fd = acquire_data_fd(context->stdin_data, context->stdin_data_size, 0);
 607                 if (fd < 0)
 608                         return fd;
 609
 610                 return move_fd(fd, STDIN_FILENO, false);
 611         }
 612
 613         case EXEC_INPUT_FILE: {
 614                 bool rw;
 615                 int fd;
 616
 617                 assert(context->stdio_file[STDIN_FILENO]);
 618
 619                 rw = (context->std_output == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDOUT_FILENO])) ||
 620                         (context->std_error == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDERR_FILENO]));
 621
 622                 fd = acquire_path(context->stdio_file[STDIN_FILENO], rw ? O_RDWR : O_RDONLY, 0666 & ~context->umask);
 623                 if (fd < 0)
 624                         return fd;
 625
 626                 return move_fd(fd, STDIN_FILENO, false);
 627         }
 628
 629         default:
 630                 assert_not_reached();
 631         }
 632 }
 633
 634 static bool can_inherit_stderr_from_stdout(
 635                 const ExecContext *context,
 636                 ExecOutput o,
 637                 ExecOutput e) {
 638
 639         assert(context);
 640
 641         /* Returns true, if given the specified STDERR and STDOUT output we can directly dup() the stdout fd to the
 642          * stderr fd */
 643
 644         if (e == EXEC_OUTPUT_INHERIT)
 645                 return true;
 646         if (e != o)
 647                 return false;
 648
 649         if (e == EXEC_OUTPUT_NAMED_FD)
 650                 return streq_ptr(context->stdio_fdname[STDOUT_FILENO], context->stdio_fdname[STDERR_FILENO]);
 651
 652         if (IN_SET(e, EXEC_OUTPUT_FILE, EXEC_OUTPUT_FILE_APPEND, EXEC_OUTPUT_FILE_TRUNCATE))
 653                 return streq_ptr(context->stdio_file[STDOUT_FILENO], context->stdio_file[STDERR_FILENO]);
 654
 655         return true;
 656 }
 657
 658 static int setup_output(
 659                 const Unit *unit,
 660                 const ExecContext *context,
 661                 const ExecParameters *params,
 662                 int fileno,
 663                 int socket_fd,
 664                 const int named_iofds[static 3],
 665                 const char *ident,
 666                 uid_t uid,
 667                 gid_t gid,
 668                 dev_t *journal_stream_dev,
 669                 ino_t *journal_stream_ino) {
 670
 671         ExecOutput o;
 672         ExecInput i;
 673         int r;
 674
 675         assert(unit);
 676         assert(context);
 677         assert(params);
 678         assert(ident);
 679         assert(journal_stream_dev);
 680         assert(journal_stream_ino);
 681
 682         if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
 683
 684                 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
 685                         return -errno;
 686
 687                 return STDOUT_FILENO;
 688         }
 689
 690         if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
 691                 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
 692                         return -errno;
 693
 694                 return STDERR_FILENO;
 695         }
 696
 697         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 698         o = fixup_output(context->std_output, socket_fd);
 699
 700         if (fileno == STDERR_FILENO) {
 701                 ExecOutput e;
 702                 e = fixup_output(context->std_error, socket_fd);
 703
 704                 /* This expects the input and output are already set up */
 705
 706                 /* Don't change the stderr file descriptor if we inherit all
 707                  * the way and are not on a tty */
 708                 if (e == EXEC_OUTPUT_INHERIT &&
 709                     o == EXEC_OUTPUT_INHERIT &&
 710                     i == EXEC_INPUT_NULL &&
 711                     !is_terminal_input(context->std_input) &&
 712                     getppid() != 1)
 713                         return fileno;
 714
 715                 /* Duplicate from stdout if possible */
 716                 if (can_inherit_stderr_from_stdout(context, o, e))
 717                         return RET_NERRNO(dup2(STDOUT_FILENO, fileno));
 718
 719                 o = e;
 720
 721         } else if (o == EXEC_OUTPUT_INHERIT) {
 722                 /* If input got downgraded, inherit the original value */
 723                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 724                         return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 725
 726                 /* If the input is connected to anything that's not a /dev/null or a data fd, inherit that... */
 727                 if (!IN_SET(i, EXEC_INPUT_NULL, EXEC_INPUT_DATA))
 728                         return RET_NERRNO(dup2(STDIN_FILENO, fileno));
 729
 730                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 731                 if (getppid() != 1)
 732                         return fileno;
 733
 734                 /* We need to open /dev/null here anew, to get the right access mode. */
 735                 return open_null_as(O_WRONLY, fileno);
 736         }
 737
 738         switch (o) {
 739
 740         case EXEC_OUTPUT_NULL:
 741                 return open_null_as(O_WRONLY, fileno);
 742
 743         case EXEC_OUTPUT_TTY:
 744                 if (is_terminal_input(i))
 745                         return RET_NERRNO(dup2(STDIN_FILENO, fileno));
 746
 747                 /* We don't reset the terminal if this is just about output */
 748                 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 749
 750         case EXEC_OUTPUT_KMSG:
 751         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 752         case EXEC_OUTPUT_JOURNAL:
 753         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 754                 r = connect_logger_as(unit, context, params, o, ident, fileno, uid, gid);
 755                 if (r < 0) {
 756                         log_unit_warning_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m",
 757                                                fileno == STDOUT_FILENO ? "stdout" : "stderr");
 758                         r = open_null_as(O_WRONLY, fileno);
 759                 } else {
 760                         struct stat st;
 761
 762                         /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
 763                          * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
 764                          * services to detect whether they are connected to the journal or not.
 765                          *
 766                          * If both stdout and stderr are connected to a stream then let's make sure to store the data
 767                          * about STDERR as that's usually the best way to do logging. */
 768
 769                         if (fstat(fileno, &st) >= 0 &&
 770                             (*journal_stream_ino == 0 || fileno == STDERR_FILENO)) {
 771                                 *journal_stream_dev = st.st_dev;
 772                                 *journal_stream_ino = st.st_ino;
 773                         }
 774                 }
 775                 return r;
 776
 777         case EXEC_OUTPUT_SOCKET:
 778                 assert(socket_fd >= 0);
 779
 780                 return RET_NERRNO(dup2(socket_fd, fileno));
 781
 782         case EXEC_OUTPUT_NAMED_FD:
 783                 assert(named_iofds[fileno] >= 0);
 784
 785                 (void) fd_nonblock(named_iofds[fileno], false);
 786                 return RET_NERRNO(dup2(named_iofds[fileno], fileno));
 787
 788         case EXEC_OUTPUT_FILE:
 789         case EXEC_OUTPUT_FILE_APPEND:
 790         case EXEC_OUTPUT_FILE_TRUNCATE: {
 791                 bool rw;
 792                 int fd, flags;
 793
 794                 assert(context->stdio_file[fileno]);
 795
 796                 rw = context->std_input == EXEC_INPUT_FILE &&
 797                         streq_ptr(context->stdio_file[fileno], context->stdio_file[STDIN_FILENO]);
 798
 799                 if (rw)
 800                         return RET_NERRNO(dup2(STDIN_FILENO, fileno));
 801
 802                 flags = O_WRONLY;
 803                 if (o == EXEC_OUTPUT_FILE_APPEND)
 804                         flags |= O_APPEND;
 805                 else if (o == EXEC_OUTPUT_FILE_TRUNCATE)
 806                         flags |= O_TRUNC;
 807
 808                 fd = acquire_path(context->stdio_file[fileno], flags, 0666 & ~context->umask);
 809                 if (fd < 0)
 810                         return fd;
 811
 812                 return move_fd(fd, fileno, 0);
 813         }
 814
 815         default:
 816                 assert_not_reached();
 817         }
 818 }
 819
 820 static int chown_terminal(int fd, uid_t uid) {
 821         int r;
 822
 823         assert(fd >= 0);
 824
 825         /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
 826         if (isatty(fd) < 1) {
 827                 if (IN_SET(errno, EINVAL, ENOTTY))
 828                         return 0; /* not a tty */
 829
 830                 return -errno;
 831         }
 832
 833         /* This might fail. What matters are the results. */
 834         r = fchmod_and_chown(fd, TTY_MODE, uid, GID_INVALID);
 835         if (r < 0)
 836                 return r;
 837
 838         return 1;
 839 }
 840
 841 static int setup_confirm_stdio(
 842                 const ExecContext *context,
 843                 const char *vc,
 844                 int *ret_saved_stdin,
 845                 int *ret_saved_stdout) {
 846
 847         _cleanup_close_ int fd = -EBADF, saved_stdin = -EBADF, saved_stdout = -EBADF;
 848         unsigned rows, cols;
 849         int r;
 850
 851         assert(ret_saved_stdin);
 852         assert(ret_saved_stdout);
 853
 854         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 855         if (saved_stdin < 0)
 856                 return -errno;
 857
 858         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 859         if (saved_stdout < 0)
 860                 return -errno;
 861
 862         fd = acquire_terminal(vc, ACQUIRE_TERMINAL_WAIT, DEFAULT_CONFIRM_USEC);
 863         if (fd < 0)
 864                 return fd;
 865
 866         r = chown_terminal(fd, getuid());
 867         if (r < 0)
 868                 return r;
 869
 870         r = reset_terminal_fd(fd, true);
 871         if (r < 0)
 872                 return r;
 873
 874         r = exec_context_tty_size(context, &rows, &cols);
 875         if (r < 0)
 876                 return r;
 877
 878         r = terminal_set_size_fd(fd, vc, rows, cols);
 879         if (r < 0)
 880                 return r;
 881
 882         r = rearrange_stdio(fd, fd, STDERR_FILENO); /* Invalidates 'fd' also on failure */
 883         TAKE_FD(fd);
 884         if (r < 0)
 885                 return r;
 886
 887         *ret_saved_stdin = TAKE_FD(saved_stdin);
 888         *ret_saved_stdout = TAKE_FD(saved_stdout);
 889         return 0;
 890 }
 891
 892 static void write_confirm_error_fd(int err, int fd, const Unit *u) {
 893         assert(err < 0);
 894
 895         if (err == -ETIMEDOUT)
 896                 dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);
 897         else {
 898                 errno = -err;
 899                 dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);
 900         }
 901 }
 902
 903 static void write_confirm_error(int err, const char *vc, const Unit *u) {
 904         _cleanup_close_ int fd = -EBADF;
 905
 906         assert(vc);
 907
 908         fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);
 909         if (fd < 0)
 910                 return;
 911
 912         write_confirm_error_fd(err, fd, u);
 913 }
 914
 915 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
 916         int r = 0;
 917
 918         assert(saved_stdin);
 919         assert(saved_stdout);
 920
 921         release_terminal();
 922
 923         if (*saved_stdin >= 0)
 924                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 925                         r = -errno;
 926
 927         if (*saved_stdout >= 0)
 928                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 929                         r = -errno;
 930
 931         *saved_stdin = safe_close(*saved_stdin);
 932         *saved_stdout = safe_close(*saved_stdout);
 933
 934         return r;
 935 }
 936
 937 enum {
 938         CONFIRM_PRETEND_FAILURE = -1,
 939         CONFIRM_PRETEND_SUCCESS =  0,
 940         CONFIRM_EXECUTE = 1,
 941 };
 942
 943 static int ask_for_confirmation(const ExecContext *context, const char *vc, Unit *u, const char *cmdline) {
 944         int saved_stdout = -1, saved_stdin = -1, r;
 945         _cleanup_free_ char *e = NULL;
 946         char c;
 947
 948         /* For any internal errors, assume a positive response. */
 949         r = setup_confirm_stdio(context, vc, &saved_stdin, &saved_stdout);
 950         if (r < 0) {
 951                 write_confirm_error(r, vc, u);
 952                 return CONFIRM_EXECUTE;
 953         }
 954
 955         /* confirm_spawn might have been disabled while we were sleeping. */
 956         if (manager_is_confirm_spawn_disabled(u->manager)) {
 957                 r = 1;
 958                 goto restore_stdio;
 959         }
 960
 961         e = ellipsize(cmdline, 60, 100);
 962         if (!e) {
 963                 log_oom();
 964                 r = CONFIRM_EXECUTE;
 965                 goto restore_stdio;
 966         }
 967
 968         for (;;) {
 969                 r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);
 970                 if (r < 0) {
 971                         write_confirm_error_fd(r, STDOUT_FILENO, u);
 972                         r = CONFIRM_EXECUTE;
 973                         goto restore_stdio;
 974                 }
 975
 976                 switch (c) {
 977                 case 'c':
 978                         printf("Resuming normal execution.\n");
 979                         manager_disable_confirm_spawn();
 980                         r = 1;
 981                         break;
 982                 case 'D':
 983                         unit_dump(u, stdout, "  ");
 984                         continue; /* ask again */
 985                 case 'f':
 986                         printf("Failing execution.\n");
 987                         r = CONFIRM_PRETEND_FAILURE;
 988                         break;
 989                 case 'h':
 990                         printf("  c - continue, proceed without asking anymore\n"
 991                                "  D - dump, show the state of the unit\n"
 992                                "  f - fail, don't execute the command and pretend it failed\n"
 993                                "  h - help\n"
 994                                "  i - info, show a short summary of the unit\n"
 995                                "  j - jobs, show jobs that are in progress\n"
 996                                "  s - skip, don't execute the command and pretend it succeeded\n"
 997                                "  y - yes, execute the command\n");
 998                         continue; /* ask again */
 999                 case 'i':
1000                         printf("  Description: %s\n"
1001                                "  Unit:        %s\n"
1002                                "  Command:     %s\n",
1003                                u->id, u->description, cmdline);
1004                         continue; /* ask again */
1005                 case 'j':
1006                         manager_dump_jobs(u->manager, stdout, /* patterns= */ NULL, "  ");
1007                         continue; /* ask again */
1008                 case 'n':
1009                         /* 'n' was removed in favor of 'f'. */
1010                         printf("Didn't understand 'n', did you mean 'f'?\n");
1011                         continue; /* ask again */
1012                 case 's':
1013                         printf("Skipping execution.\n");
1014                         r = CONFIRM_PRETEND_SUCCESS;
1015                         break;
1016                 case 'y':
1017                         r = CONFIRM_EXECUTE;
1018                         break;
1019                 default:
1020                         assert_not_reached();
1021                 }
1022                 break;
1023         }
1024
1025 restore_stdio:
1026         restore_confirm_stdio(&saved_stdin, &saved_stdout);
1027         return r;
1028 }
1029
1030 static int get_fixed_user(const ExecContext *c, const char **user,
1031                           uid_t *uid, gid_t *gid,
1032                           const char **home, const char **shell) {
1033         int r;
1034         const char *name;
1035
1036         assert(c);
1037
1038         if (!c->user)
1039                 return 0;
1040
1041         /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway
1042          * (i.e. are "/" or "/bin/nologin"). */
1043
1044         name = c->user;
1045         r = get_user_creds(&name, uid, gid, home, shell, USER_CREDS_CLEAN);
1046         if (r < 0)
1047                 return r;
1048
1049         *user = name;
1050         return 0;
1051 }
1052
1053 static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {
1054         int r;
1055         const char *name;
1056
1057         assert(c);
1058
1059         if (!c->group)
1060                 return 0;
1061
1062         name = c->group;
1063         r = get_group_creds(&name, gid, 0);
1064         if (r < 0)
1065                 return r;
1066
1067         *group = name;
1068         return 0;
1069 }
1070
1071 static int get_supplementary_groups(const ExecContext *c, const char *user,
1072                                     const char *group, gid_t gid,
1073                                     gid_t **supplementary_gids, int *ngids) {
1074         int r, k = 0;
1075         int ngroups_max;
1076         bool keep_groups = false;
1077         gid_t *groups = NULL;
1078         _cleanup_free_ gid_t *l_gids = NULL;
1079
1080         assert(c);
1081
1082         /*
1083          * If user is given, then lookup GID and supplementary groups list.
1084          * We avoid NSS lookups for gid=0. Also we have to initialize groups
1085          * here and as early as possible so we keep the list of supplementary
1086          * groups of the caller.
1087          */
1088         if (user && gid_is_valid(gid) && gid != 0) {
1089                 /* First step, initialize groups from /etc/groups */
1090                 if (initgroups(user, gid) < 0)
1091                         return -errno;
1092
1093                 keep_groups = true;
1094         }
1095
1096         if (strv_isempty(c->supplementary_groups))
1097                 return 0;
1098
1099         /*
1100          * If SupplementaryGroups= was passed then NGROUPS_MAX has to
1101          * be positive, otherwise fail.
1102          */
1103         errno = 0;
1104         ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
1105         if (ngroups_max <= 0)
1106                 return errno_or_else(EOPNOTSUPP);
1107
1108         l_gids = new(gid_t, ngroups_max);
1109         if (!l_gids)
1110                 return -ENOMEM;
1111
1112         if (keep_groups) {
1113                 /*
1114                  * Lookup the list of groups that the user belongs to, we
1115                  * avoid NSS lookups here too for gid=0.
1116                  */
1117                 k = ngroups_max;
1118                 if (getgrouplist(user, gid, l_gids, &k) < 0)
1119                         return -EINVAL;
1120         } else
1121                 k = 0;
1122
1123         STRV_FOREACH(i, c->supplementary_groups) {
1124                 const char *g;
1125
1126                 if (k >= ngroups_max)
1127                         return -E2BIG;
1128
1129                 g = *i;
1130                 r = get_group_creds(&g, l_gids+k, 0);
1131                 if (r < 0)
1132                         return r;
1133
1134                 k++;
1135         }
1136
1137         /*
1138          * Sets ngids to zero to drop all supplementary groups, happens
1139          * when we are under root and SupplementaryGroups= is empty.
1140          */
1141         if (k == 0) {
1142                 *ngids = 0;
1143                 return 0;
1144         }
1145
1146         /* Otherwise get the final list of supplementary groups */
1147         groups = memdup(l_gids, sizeof(gid_t) * k);
1148         if (!groups)
1149                 return -ENOMEM;
1150
1151         *supplementary_gids = groups;
1152         *ngids = k;
1153
1154         groups = NULL;
1155
1156         return 0;
1157 }
1158
1159 static int enforce_groups(gid_t gid, const gid_t *supplementary_gids, int ngids) {
1160         int r;
1161
1162         /* Handle SupplementaryGroups= if it is not empty */
1163         if (ngids > 0) {
1164                 r = maybe_setgroups(ngids, supplementary_gids);
1165                 if (r < 0)
1166                         return r;
1167         }
1168
1169         if (gid_is_valid(gid)) {
1170                 /* Then set our gids */
1171                 if (setresgid(gid, gid, gid) < 0)
1172                         return -errno;
1173         }
1174
1175         return 0;
1176 }
1177
1178 static int set_securebits(unsigned bits, unsigned mask) {
1179         unsigned applied;
1180         int current;
1181
1182         current = prctl(PR_GET_SECUREBITS);
1183         if (current < 0)
1184                 return -errno;
1185
1186         /* Clear all securebits defined in mask and set bits */
1187         applied = ((unsigned) current & ~mask) | bits;
1188         if ((unsigned) current == applied)
1189                 return 0;
1190
1191         if (prctl(PR_SET_SECUREBITS, applied) < 0)
1192                 return -errno;
1193
1194         return 1;
1195 }
1196
1197 static int enforce_user(
1198                 const ExecContext *context,
1199                 uid_t uid,
1200                 uint64_t capability_ambient_set) {
1201         assert(context);
1202         int r;
1203
1204         if (!uid_is_valid(uid))
1205                 return 0;
1206
1207         /* Sets (but doesn't look up) the UIS and makes sure we keep the capabilities while doing so. For
1208          * setting secure bits the capability CAP_SETPCAP is required, so we also need keep-caps in this
1209          * case. */
1210
1211         if ((capability_ambient_set != 0 || context->secure_bits != 0) && uid != 0) {
1212
1213                 /* First step: If we need to keep capabilities but drop privileges we need to make sure we
1214                  * keep our caps, while we drop privileges. Add KEEP_CAPS to the securebits */
1215                 r = set_securebits(1U << SECURE_KEEP_CAPS, 0);
1216                 if (r < 0)
1217                         return r;
1218         }
1219
1220         /* Second step: actually set the uids */
1221         if (setresuid(uid, uid, uid) < 0)
1222                 return -errno;
1223
1224         /* At this point we should have all necessary capabilities but are otherwise a normal user. However,
1225          * the caps might got corrupted due to the setresuid() so we need clean them up later. This is done
1226          * outside of this call. */
1227         return 0;
1228 }
1229
1230 #if HAVE_PAM
1231
1232 static int null_conv(
1233                 int num_msg,
1234                 const struct pam_message **msg,
1235                 struct pam_response **resp,
1236                 void *appdata_ptr) {
1237
1238         /* We don't support conversations */
1239
1240         return PAM_CONV_ERR;
1241 }
1242
1243 #endif
1244
1245 static int setup_pam(
1246                 const char *name,
1247                 const char *user,
1248                 uid_t uid,
1249                 gid_t gid,
1250                 const char *tty,
1251                 char ***env, /* updated on success */
1252                 const int fds[], size_t n_fds) {
1253
1254 #if HAVE_PAM
1255
1256         static const struct pam_conv conv = {
1257                 .conv = null_conv,
1258                 .appdata_ptr = NULL
1259         };
1260
1261         _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
1262         _cleanup_strv_free_ char **e = NULL;
1263         pam_handle_t *handle = NULL;
1264         sigset_t old_ss;
1265         int pam_code = PAM_SUCCESS, r;
1266         bool close_session = false;
1267         pid_t pam_pid = 0, parent_pid;
1268         int flags = 0;
1269
1270         assert(name);
1271         assert(user);
1272         assert(env);
1273
1274         /* We set up PAM in the parent process, then fork. The child
1275          * will then stay around until killed via PR_GET_PDEATHSIG or
1276          * systemd via the cgroup logic. It will then remove the PAM
1277          * session again. The parent process will exec() the actual
1278          * daemon. We do things this way to ensure that the main PID
1279          * of the daemon is the one we initially fork()ed. */
1280
1281         r = barrier_create(&barrier);
1282         if (r < 0)
1283                 goto fail;
1284
1285         if (log_get_max_level() < LOG_DEBUG)
1286                 flags |= PAM_SILENT;
1287
1288         pam_code = pam_start(name, user, &conv, &handle);
1289         if (pam_code != PAM_SUCCESS) {
1290                 handle = NULL;
1291                 goto fail;
1292         }
1293
1294         if (!tty) {
1295                 _cleanup_free_ char *q = NULL;
1296
1297                 /* Hmm, so no TTY was explicitly passed, but an fd passed to us directly might be a TTY. Let's figure
1298                  * out if that's the case, and read the TTY off it. */
1299
1300                 if (getttyname_malloc(STDIN_FILENO, &q) >= 0)
1301                         tty = strjoina("/dev/", q);
1302         }
1303
1304         if (tty) {
1305                 pam_code = pam_set_item(handle, PAM_TTY, tty);
1306                 if (pam_code != PAM_SUCCESS)
1307                         goto fail;
1308         }
1309
1310         STRV_FOREACH(nv, *env) {
1311                 pam_code = pam_putenv(handle, *nv);
1312                 if (pam_code != PAM_SUCCESS)
1313                         goto fail;
1314         }
1315
1316         pam_code = pam_acct_mgmt(handle, flags);
1317         if (pam_code != PAM_SUCCESS)
1318                 goto fail;
1319
1320         pam_code = pam_setcred(handle, PAM_ESTABLISH_CRED | flags);
1321         if (pam_code != PAM_SUCCESS)
1322                 log_debug("pam_setcred() failed, ignoring: %s", pam_strerror(handle, pam_code));
1323
1324         pam_code = pam_open_session(handle, flags);
1325         if (pam_code != PAM_SUCCESS)
1326                 goto fail;
1327
1328         close_session = true;
1329
1330         e = pam_getenvlist(handle);
1331         if (!e) {
1332                 pam_code = PAM_BUF_ERR;
1333                 goto fail;
1334         }
1335
1336         /* Block SIGTERM, so that we know that it won't get lost in the child */
1337
1338         assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
1339
1340         parent_pid = getpid_cached();
1341
1342         r = safe_fork("(sd-pam)", 0, &pam_pid);
1343         if (r < 0)
1344                 goto fail;
1345         if (r == 0) {
1346                 int sig, ret = EXIT_PAM;
1347
1348                 /* The child's job is to reset the PAM session on termination */
1349                 barrier_set_role(&barrier, BARRIER_CHILD);
1350
1351                 /* Make sure we don't keep open the passed fds in this child. We assume that otherwise only
1352                  * those fds are open here that have been opened by PAM. */
1353                 (void) close_many(fds, n_fds);
1354
1355                 /* Drop privileges - we don't need any to pam_close_session and this will make
1356                  * PR_SET_PDEATHSIG work in most cases.  If this fails, ignore the error - but expect sd-pam
1357                  * threads to fail to exit normally */
1358
1359                 r = maybe_setgroups(0, NULL);
1360                 if (r < 0)
1361                         log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
1362                 if (setresgid(gid, gid, gid) < 0)
1363                         log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
1364                 if (setresuid(uid, uid, uid) < 0)
1365                         log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m");
1366
1367                 (void) ignore_signals(SIGPIPE);
1368
1369                 /* Wait until our parent died. This will only work if the above setresuid() succeeds,
1370                  * otherwise the kernel will not allow unprivileged parents kill their privileged children
1371                  * this way. We rely on the control groups kill logic to do the rest for us. */
1372                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
1373                         goto child_finish;
1374
1375                 /* Tell the parent that our setup is done. This is especially important regarding dropping
1376                  * privileges. Otherwise, unit setup might race against our setresuid(2) call.
1377                  *
1378                  * If the parent aborted, we'll detect this below, hence ignore return failure here. */
1379                 (void) barrier_place(&barrier);
1380
1381                 /* Check if our parent process might already have died? */
1382                 if (getppid() == parent_pid) {
1383                         sigset_t ss;
1384
1385                         assert_se(sigemptyset(&ss) >= 0);
1386                         assert_se(sigaddset(&ss, SIGTERM) >= 0);
1387
1388                         for (;;) {
1389                                 if (sigwait(&ss, &sig) < 0) {
1390                                         if (errno == EINTR)
1391                                                 continue;
1392
1393                                         goto child_finish;
1394                                 }
1395
1396                                 assert(sig == SIGTERM);
1397                                 break;
1398                         }
1399                 }
1400
1401                 pam_code = pam_setcred(handle, PAM_DELETE_CRED | flags);
1402                 if (pam_code != PAM_SUCCESS)
1403                         goto child_finish;
1404
1405                 /* If our parent died we'll end the session */
1406                 if (getppid() != parent_pid) {
1407                         pam_code = pam_close_session(handle, flags);
1408                         if (pam_code != PAM_SUCCESS)
1409                                 goto child_finish;
1410                 }
1411
1412                 ret = 0;
1413
1414         child_finish:
1415                 /* NB: pam_end() when called in child processes should set PAM_DATA_SILENT to let the module
1416                  * know about this. See pam_end(3) */
1417                 (void) pam_end(handle, pam_code | flags | PAM_DATA_SILENT);
1418                 _exit(ret);
1419         }
1420
1421         barrier_set_role(&barrier, BARRIER_PARENT);
1422
1423         /* If the child was forked off successfully it will do all the cleanups, so forget about the handle
1424          * here. */
1425         handle = NULL;
1426
1427         /* Unblock SIGTERM again in the parent */
1428         assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
1429
1430         /* We close the log explicitly here, since the PAM modules might have opened it, but we don't want
1431          * this fd around. */
1432         closelog();
1433
1434         /* Synchronously wait for the child to initialize. We don't care for errors as we cannot
1435          * recover. However, warn loudly if it happens. */
1436         if (!barrier_place_and_sync(&barrier))
1437                 log_error("PAM initialization failed");
1438
1439         return strv_free_and_replace(*env, e);
1440
1441 fail:
1442         if (pam_code != PAM_SUCCESS) {
1443                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1444                 r = -EPERM;  /* PAM errors do not map to errno */
1445         } else
1446                 log_error_errno(r, "PAM failed: %m");
1447
1448         if (handle) {
1449                 if (close_session)
1450                         pam_code = pam_close_session(handle, flags);
1451
1452                 (void) pam_end(handle, pam_code | flags);
1453         }
1454
1455         closelog();
1456         return r;
1457 #else
1458         return 0;
1459 #endif
1460 }
1461
1462 static void rename_process_from_path(const char *path) {
1463         _cleanup_free_ char *buf = NULL;
1464         const char *p;
1465
1466         assert(path);
1467
1468         /* This resulting string must fit in 10 chars (i.e. the length of "/sbin/init") to look pretty in
1469          * /bin/ps */
1470
1471         if (path_extract_filename(path, &buf) < 0) {
1472                 rename_process("(...)");
1473                 return;
1474         }
1475
1476         size_t l = strlen(buf);
1477         if (l > 8) {
1478                 /* The end of the process name is usually more interesting, since the first bit might just be
1479                  * "systemd-" */
1480                 p = buf + l - 8;
1481                 l = 8;
1482         } else
1483                 p = buf;
1484
1485         char process_name[11];
1486         process_name[0] = '(';
1487         memcpy(process_name+1, p, l);
1488         process_name[1+l] = ')';
1489         process_name[1+l+1] = 0;
1490
1491         rename_process(process_name);
1492 }
1493
1494 static bool context_has_address_families(const ExecContext *c) {
1495         assert(c);
1496
1497         return c->address_families_allow_list ||
1498                 !set_isempty(c->address_families);
1499 }
1500
1501 static bool context_has_syscall_filters(const ExecContext *c) {
1502         assert(c);
1503
1504         return c->syscall_allow_list ||
1505                 !hashmap_isempty(c->syscall_filter);
1506 }
1507
1508 static bool context_has_syscall_logs(const ExecContext *c) {
1509         assert(c);
1510
1511         return c->syscall_log_allow_list ||
1512                 !hashmap_isempty(c->syscall_log);
1513 }
1514
1515 static bool context_has_no_new_privileges(const ExecContext *c) {
1516         assert(c);
1517
1518         if (c->no_new_privileges)
1519                 return true;
1520
1521         if (have_effective_cap(CAP_SYS_ADMIN) > 0) /* if we are privileged, we don't need NNP */
1522                 return false;
1523
1524         /* We need NNP if we have any form of seccomp and are unprivileged */
1525         return c->lock_personality ||
1526                 c->memory_deny_write_execute ||
1527                 c->private_devices ||
1528                 c->protect_clock ||
1529                 c->protect_hostname ||
1530                 c->protect_kernel_tunables ||
1531                 c->protect_kernel_modules ||
1532                 c->protect_kernel_logs ||
1533                 context_has_address_families(c) ||
1534                 exec_context_restrict_namespaces_set(c) ||
1535                 c->restrict_realtime ||
1536                 c->restrict_suid_sgid ||
1537                 !set_isempty(c->syscall_archs) ||
1538                 context_has_syscall_filters(c) ||
1539                 context_has_syscall_logs(c);
1540 }
1541
1542 static bool exec_context_has_credentials(const ExecContext *context) {
1543
1544         assert(context);
1545
1546         return !hashmap_isempty(context->set_credentials) ||
1547                 !hashmap_isempty(context->load_credentials);
1548 }
1549
1550 #if HAVE_SECCOMP
1551
1552 static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
1553
1554         if (is_seccomp_available())
1555                 return false;
1556
1557         log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
1558         return true;
1559 }
1560
1561 static int apply_syscall_filter(const Unit* u, const ExecContext *c, bool needs_ambient_hack) {
1562         uint32_t negative_action, default_action, action;
1563         int r;
1564
1565         assert(u);
1566         assert(c);
1567
1568         if (!context_has_syscall_filters(c))
1569                 return 0;
1570
1571         if (skip_seccomp_unavailable(u, "SystemCallFilter="))
1572                 return 0;
1573
1574         negative_action = c->syscall_errno == SECCOMP_ERROR_NUMBER_KILL ? scmp_act_kill_process() : SCMP_ACT_ERRNO(c->syscall_errno);
1575
1576         if (c->syscall_allow_list) {
1577                 default_action = negative_action;
1578                 action = SCMP_ACT_ALLOW;
1579         } else {
1580                 default_action = SCMP_ACT_ALLOW;
1581                 action = negative_action;
1582         }
1583
1584         if (needs_ambient_hack) {
1585                 r = seccomp_filter_set_add(c->syscall_filter, c->syscall_allow_list, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID);
1586                 if (r < 0)
1587                         return r;
1588         }
1589
1590         return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false);
1591 }
1592
1593 static int apply_syscall_log(const Unit* u, const ExecContext *c) {
1594 #ifdef SCMP_ACT_LOG
1595         uint32_t default_action, action;
1596 #endif
1597
1598         assert(u);
1599         assert(c);
1600
1601         if (!context_has_syscall_logs(c))
1602                 return 0;
1603
1604 #ifdef SCMP_ACT_LOG
1605         if (skip_seccomp_unavailable(u, "SystemCallLog="))
1606                 return 0;
1607
1608         if (c->syscall_log_allow_list) {
1609                 /* Log nothing but the ones listed */
1610                 default_action = SCMP_ACT_ALLOW;
1611                 action = SCMP_ACT_LOG;
1612         } else {
1613                 /* Log everything but the ones listed */
1614                 default_action = SCMP_ACT_LOG;
1615                 action = SCMP_ACT_ALLOW;
1616         }
1617
1618         return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_log, action, false);
1619 #else
1620         /* old libseccomp */
1621         log_unit_debug(u, "SECCOMP feature SCMP_ACT_LOG not available, skipping SystemCallLog=");
1622         return 0;
1623 #endif
1624 }
1625
1626 static int apply_syscall_archs(const Unit *u, const ExecContext *c) {
1627         assert(u);
1628         assert(c);
1629
1630         if (set_isempty(c->syscall_archs))
1631                 return 0;
1632
1633         if (skip_seccomp_unavailable(u, "SystemCallArchitectures="))
1634                 return 0;
1635
1636         return seccomp_restrict_archs(c->syscall_archs);
1637 }
1638
1639 static int apply_address_families(const Unit* u, const ExecContext *c) {
1640         assert(u);
1641         assert(c);
1642
1643         if (!context_has_address_families(c))
1644                 return 0;
1645
1646         if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1647                 return 0;
1648
1649         return seccomp_restrict_address_families(c->address_families, c->address_families_allow_list);
1650 }
1651
1652 static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
1653         int r;
1654
1655         assert(u);
1656         assert(c);
1657
1658         if (!c->memory_deny_write_execute)
1659                 return 0;
1660
1661         /* use prctl() if kernel supports it (6.3) */
1662         r = prctl(PR_SET_MDWE, PR_MDWE_REFUSE_EXEC_GAIN, 0, 0, 0);
1663         if (r == 0) {
1664                 log_unit_debug(u, "Enabled MemoryDenyWriteExecute= with PR_SET_MDWE");
1665                 return 0;
1666         }
1667         if (r < 0 && errno != EINVAL)
1668                 return log_unit_debug_errno(u, errno, "Failed to enable MemoryDenyWriteExecute= with PR_SET_MDWE: %m");
1669         /* else use seccomp */
1670         log_unit_debug(u, "Kernel doesn't support PR_SET_MDWE: falling back to seccomp");
1671
1672         if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1673                 return 0;
1674
1675         return seccomp_memory_deny_write_execute();
1676 }
1677
1678 static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
1679         assert(u);
1680         assert(c);
1681
1682         if (!c->restrict_realtime)
1683                 return 0;
1684
1685         if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1686                 return 0;
1687
1688         return seccomp_restrict_realtime();
1689 }
1690
1691 static int apply_restrict_suid_sgid(const Unit* u, const ExecContext *c) {
1692         assert(u);
1693         assert(c);
1694
1695         if (!c->restrict_suid_sgid)
1696                 return 0;
1697
1698         if (skip_seccomp_unavailable(u, "RestrictSUIDSGID="))
1699                 return 0;
1700
1701         return seccomp_restrict_suid_sgid();
1702 }
1703
1704 static int apply_protect_sysctl(const Unit *u, const ExecContext *c) {
1705         assert(u);
1706         assert(c);
1707
1708         /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1709          * let's protect even those systems where this is left on in the kernel. */
1710
1711         if (!c->protect_kernel_tunables)
1712                 return 0;
1713
1714         if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1715                 return 0;
1716
1717         return seccomp_protect_sysctl();
1718 }
1719
1720 static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
1721         assert(u);
1722         assert(c);
1723
1724         /* Turn off module syscalls on ProtectKernelModules=yes */
1725
1726         if (!c->protect_kernel_modules)
1727                 return 0;
1728
1729         if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
1730                 return 0;
1731
1732         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM), false);
1733 }
1734
1735 static int apply_protect_kernel_logs(const Unit *u, const ExecContext *c) {
1736         assert(u);
1737         assert(c);
1738
1739         if (!c->protect_kernel_logs)
1740                 return 0;
1741
1742         if (skip_seccomp_unavailable(u, "ProtectKernelLogs="))
1743                 return 0;
1744
1745         return seccomp_protect_syslog();
1746 }
1747
1748 static int apply_protect_clock(const Unit *u, const ExecContext *c) {
1749         assert(u);
1750         assert(c);
1751
1752         if (!c->protect_clock)
1753                 return 0;
1754
1755         if (skip_seccomp_unavailable(u, "ProtectClock="))
1756                 return 0;
1757
1758         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK, SCMP_ACT_ERRNO(EPERM), false);
1759 }
1760
1761 static int apply_private_devices(const Unit *u, const ExecContext *c) {
1762         assert(u);
1763         assert(c);
1764
1765         /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */
1766
1767         if (!c->private_devices)
1768                 return 0;
1769
1770         if (skip_seccomp_unavailable(u, "PrivateDevices="))
1771                 return 0;
1772
1773         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM), false);
1774 }
1775
1776 static int apply_restrict_namespaces(const Unit *u, const ExecContext *c) {
1777         assert(u);
1778         assert(c);
1779
1780         if (!exec_context_restrict_namespaces_set(c))
1781                 return 0;
1782
1783         if (skip_seccomp_unavailable(u, "RestrictNamespaces="))
1784                 return 0;
1785
1786         return seccomp_restrict_namespaces(c->restrict_namespaces);
1787 }
1788
1789 static int apply_lock_personality(const Unit* u, const ExecContext *c) {
1790         unsigned long personality;
1791         int r;
1792
1793         assert(u);
1794         assert(c);
1795
1796         if (!c->lock_personality)
1797                 return 0;
1798
1799         if (skip_seccomp_unavailable(u, "LockPersonality="))
1800                 return 0;
1801
1802         personality = c->personality;
1803
1804         /* If personality is not specified, use either PER_LINUX or PER_LINUX32 depending on what is currently set. */
1805         if (personality == PERSONALITY_INVALID) {
1806
1807                 r = opinionated_personality(&personality);
1808                 if (r < 0)
1809                         return r;
1810         }
1811
1812         return seccomp_lock_personality(personality);
1813 }
1814
1815 #endif
1816
1817 #if HAVE_LIBBPF
1818 static int apply_restrict_filesystems(Unit *u, const ExecContext *c) {
1819         assert(u);
1820         assert(c);
1821
1822         if (!exec_context_restrict_filesystems_set(c))
1823                 return 0;
1824
1825         if (!u->manager->restrict_fs) {
1826                 /* LSM BPF is unsupported or lsm_bpf_setup failed */
1827                 log_unit_debug(u, "LSM BPF not supported, skipping RestrictFileSystems=");
1828                 return 0;
1829         }
1830
1831         return lsm_bpf_unit_restrict_filesystems(u, c->restrict_filesystems, c->restrict_filesystems_allow_list);
1832 }
1833 #endif
1834
1835 static int apply_protect_hostname(const Unit *u, const ExecContext *c, int *ret_exit_status) {
1836         assert(u);
1837         assert(c);
1838
1839         if (!c->protect_hostname)
1840                 return 0;
1841
1842         if (ns_type_supported(NAMESPACE_UTS)) {
1843                 if (unshare(CLONE_NEWUTS) < 0) {
1844                         if (!ERRNO_IS_NOT_SUPPORTED(errno) && !ERRNO_IS_PRIVILEGE(errno)) {
1845                                 *ret_exit_status = EXIT_NAMESPACE;
1846                                 return log_unit_error_errno(u, errno, "Failed to set up UTS namespacing: %m");
1847                         }
1848
1849                         log_unit_warning(u, "ProtectHostname=yes is configured, but UTS namespace setup is prohibited (container manager?), ignoring namespace setup.");
1850                 }
1851         } else
1852                 log_unit_warning(u, "ProtectHostname=yes is configured, but the kernel does not support UTS namespaces, ignoring namespace setup.");
1853
1854 #if HAVE_SECCOMP
1855         int r;
1856
1857         if (skip_seccomp_unavailable(u, "ProtectHostname="))
1858                 return 0;
1859
1860         r = seccomp_protect_hostname();
1861         if (r < 0) {
1862                 *ret_exit_status = EXIT_SECCOMP;
1863                 return log_unit_error_errno(u, r, "Failed to apply hostname restrictions: %m");
1864         }
1865 #endif
1866
1867         return 0;
1868 }
1869
1870 static void do_idle_pipe_dance(int idle_pipe[static 4]) {
1871         assert(idle_pipe);
1872
1873         idle_pipe[1] = safe_close(idle_pipe[1]);
1874         idle_pipe[2] = safe_close(idle_pipe[2]);
1875
1876         if (idle_pipe[0] >= 0) {
1877                 int r;
1878
1879                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1880
1881                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1882                         ssize_t n;
1883
1884                         /* Signal systemd that we are bored and want to continue. */
1885                         n = write(idle_pipe[3], "x", 1);
1886                         if (n > 0)
1887                                 /* Wait for systemd to react to the signal above. */
1888                                 (void) fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1889                 }
1890
1891                 idle_pipe[0] = safe_close(idle_pipe[0]);
1892
1893         }
1894
1895         idle_pipe[3] = safe_close(idle_pipe[3]);
1896 }
1897
1898 static const char *exec_directory_env_name_to_string(ExecDirectoryType t);
1899
1900 static int build_environment(
1901                 const Unit *u,
1902                 const ExecContext *c,
1903                 const ExecParameters *p,
1904                 const CGroupContext *cgroup_context,
1905                 size_t n_fds,
1906                 char **fdnames,
1907                 const char *home,
1908                 const char *username,
1909                 const char *shell,
1910                 dev_t journal_stream_dev,
1911                 ino_t journal_stream_ino,
1912                 const char *memory_pressure_path,
1913                 char ***ret) {
1914
1915         _cleanup_strv_free_ char **our_env = NULL;
1916         size_t n_env = 0;
1917         char *x;
1918         int r;
1919
1920         assert(u);
1921         assert(c);
1922         assert(p);
1923         assert(ret);
1924
1925 #define N_ENV_VARS 19
1926         our_env = new0(char*, N_ENV_VARS + _EXEC_DIRECTORY_TYPE_MAX);
1927         if (!our_env)
1928                 return -ENOMEM;
1929
1930         if (n_fds > 0) {
1931                 _cleanup_free_ char *joined = NULL;
1932
1933                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid_cached()) < 0)
1934                         return -ENOMEM;
1935                 our_env[n_env++] = x;
1936
1937                 if (asprintf(&x, "LISTEN_FDS=%zu", n_fds) < 0)
1938                         return -ENOMEM;
1939                 our_env[n_env++] = x;
1940
1941                 joined = strv_join(fdnames, ":");
1942                 if (!joined)
1943                         return -ENOMEM;
1944
1945                 x = strjoin("LISTEN_FDNAMES=", joined);
1946                 if (!x)
1947                         return -ENOMEM;
1948                 our_env[n_env++] = x;
1949         }
1950
1951         if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
1952                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid_cached()) < 0)
1953                         return -ENOMEM;
1954                 our_env[n_env++] = x;
1955
1956                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1957                         return -ENOMEM;
1958                 our_env[n_env++] = x;
1959         }
1960
1961         /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use blocking
1962          * Varlink calls back to us for look up dynamic users in PID 1. Break the deadlock between D-Bus and
1963          * PID 1 by disabling use of PID1' NSS interface for looking up dynamic users. */
1964         if (p->flags & EXEC_NSS_DYNAMIC_BYPASS) {
1965                 x = strdup("SYSTEMD_NSS_DYNAMIC_BYPASS=1");
1966                 if (!x)
1967                         return -ENOMEM;
1968                 our_env[n_env++] = x;
1969         }
1970
1971         if (home) {
1972                 x = strjoin("HOME=", home);
1973                 if (!x)
1974                         return -ENOMEM;
1975
1976                 path_simplify(x + 5);
1977                 our_env[n_env++] = x;
1978         }
1979
1980         if (username) {
1981                 x = strjoin("LOGNAME=", username);
1982                 if (!x)
1983                         return -ENOMEM;
1984                 our_env[n_env++] = x;
1985
1986                 x = strjoin("USER=", username);
1987                 if (!x)
1988                         return -ENOMEM;
1989                 our_env[n_env++] = x;
1990         }
1991
1992         if (shell) {
1993                 x = strjoin("SHELL=", shell);
1994                 if (!x)
1995                         return -ENOMEM;
1996
1997                 path_simplify(x + 6);
1998                 our_env[n_env++] = x;
1999         }
2000
2001         if (!sd_id128_is_null(u->invocation_id)) {
2002                 if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0)
2003                         return -ENOMEM;
2004
2005                 our_env[n_env++] = x;
2006         }
2007
2008         if (exec_context_needs_term(c)) {
2009                 _cleanup_free_ char *cmdline = NULL;
2010                 const char *tty_path, *term = NULL;
2011
2012                 tty_path = exec_context_tty_path(c);
2013
2014                 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try
2015                  * to inherit the $TERM set for PID 1. This is useful for containers so that the $TERM the
2016                  * container manager passes to PID 1 ends up all the way in the console login shown. */
2017
2018                 if (path_equal_ptr(tty_path, "/dev/console") && getppid() == 1)
2019                         term = getenv("TERM");
2020                 else if (tty_path && in_charset(skip_dev_prefix(tty_path), ALPHANUMERICAL)) {
2021                         _cleanup_free_ char *key = NULL;
2022
2023                         key = strjoin("systemd.tty.term.", skip_dev_prefix(tty_path));
2024                         if (!key)
2025                                 return -ENOMEM;
2026
2027                         r = proc_cmdline_get_key(key, 0, &cmdline);
2028                         if (r < 0)
2029                                 log_debug_errno(r, "Failed to read %s from kernel cmdline, ignoring: %m", key);
2030                         else if (r > 0)
2031                                 term = cmdline;
2032                 }
2033
2034                 if (!term)
2035                         term = default_term_for_tty(tty_path);
2036
2037                 x = strjoin("TERM=", term);
2038                 if (!x)
2039                         return -ENOMEM;
2040                 our_env[n_env++] = x;
2041         }
2042
2043         if (journal_stream_dev != 0 && journal_stream_ino != 0) {
2044                 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
2045                         return -ENOMEM;
2046
2047                 our_env[n_env++] = x;
2048         }
2049
2050         if (c->log_namespace) {
2051                 x = strjoin("LOG_NAMESPACE=", c->log_namespace);
2052                 if (!x)
2053                         return -ENOMEM;
2054
2055                 our_env[n_env++] = x;
2056         }
2057
2058         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2059                 _cleanup_free_ char *joined = NULL;
2060                 const char *n;
2061
2062                 if (!p->prefix[t])
2063                         continue;
2064
2065                 if (c->directories[t].n_items == 0)
2066                         continue;
2067
2068                 n = exec_directory_env_name_to_string(t);
2069                 if (!n)
2070                         continue;
2071
2072                 for (size_t i = 0; i < c->directories[t].n_items; i++) {
2073                         _cleanup_free_ char *prefixed = NULL;
2074
2075                         prefixed = path_join(p->prefix[t], c->directories[t].items[i].path);
2076                         if (!prefixed)
2077                                 return -ENOMEM;
2078
2079                         if (!strextend_with_separator(&joined, ":", prefixed))
2080                                 return -ENOMEM;
2081                 }
2082
2083                 x = strjoin(n, "=", joined);
2084                 if (!x)
2085                         return -ENOMEM;
2086
2087                 our_env[n_env++] = x;
2088         }
2089
2090         if (exec_context_has_credentials(c) && p->prefix[EXEC_DIRECTORY_RUNTIME]) {
2091                 x = strjoin("CREDENTIALS_DIRECTORY=", p->prefix[EXEC_DIRECTORY_RUNTIME], "/credentials/", u->id);
2092                 if (!x)
2093                         return -ENOMEM;
2094
2095                 our_env[n_env++] = x;
2096         }
2097
2098         if (asprintf(&x, "SYSTEMD_EXEC_PID=" PID_FMT, getpid_cached()) < 0)
2099                 return -ENOMEM;
2100
2101         our_env[n_env++] = x;
2102
2103         if (memory_pressure_path) {
2104                 x = strjoin("MEMORY_PRESSURE_WATCH=", memory_pressure_path);
2105                 if (!x)
2106                         return -ENOMEM;
2107
2108                 our_env[n_env++] = x;
2109
2110                 if (cgroup_context && !path_equal(memory_pressure_path, "/dev/null")) {
2111                         _cleanup_free_ char *b = NULL, *e = NULL;
2112
2113                         if (asprintf(&b, "%s " USEC_FMT " " USEC_FMT,
2114                                      MEMORY_PRESSURE_DEFAULT_TYPE,
2115                                      cgroup_context->memory_pressure_threshold_usec == USEC_INFINITY ? MEMORY_PRESSURE_DEFAULT_THRESHOLD_USEC :
2116                                      CLAMP(cgroup_context->memory_pressure_threshold_usec, 1U, MEMORY_PRESSURE_DEFAULT_WINDOW_USEC),
2117                                      MEMORY_PRESSURE_DEFAULT_WINDOW_USEC) < 0)
2118                                 return -ENOMEM;
2119
2120                         if (base64mem(b, strlen(b) + 1, &e) < 0)
2121                                 return -ENOMEM;
2122
2123                         x = strjoin("MEMORY_PRESSURE_WRITE=", e);
2124                         if (!x)
2125                                 return -ENOMEM;
2126
2127                         our_env[n_env++] = x;
2128                 }
2129         }
2130
2131         assert(n_env < N_ENV_VARS + _EXEC_DIRECTORY_TYPE_MAX);
2132 #undef N_ENV_VARS
2133
2134         *ret = TAKE_PTR(our_env);
2135
2136         return 0;
2137 }
2138
2139 static int build_pass_environment(const ExecContext *c, char ***ret) {
2140         _cleanup_strv_free_ char **pass_env = NULL;
2141         size_t n_env = 0;
2142
2143         STRV_FOREACH(i, c->pass_environment) {
2144                 _cleanup_free_ char *x = NULL;
2145                 char *v;
2146
2147                 v = getenv(*i);
2148                 if (!v)
2149                         continue;
2150                 x = strjoin(*i, "=", v);
2151                 if (!x)
2152                         return -ENOMEM;
2153
2154                 if (!GREEDY_REALLOC(pass_env, n_env + 2))
2155                         return -ENOMEM;
2156
2157                 pass_env[n_env++] = TAKE_PTR(x);
2158                 pass_env[n_env] = NULL;
2159         }
2160
2161         *ret = TAKE_PTR(pass_env);
2162
2163         return 0;
2164 }
2165
2166 bool exec_needs_network_namespace(const ExecContext *context) {
2167         assert(context);
2168
2169         return context->private_network || context->network_namespace_path;
2170 }
2171
2172 static bool exec_needs_ipc_namespace(const ExecContext *context) {
2173         assert(context);
2174
2175         return context->private_ipc || context->ipc_namespace_path;
2176 }
2177
2178 bool exec_needs_mount_namespace(
2179                 const ExecContext *context,
2180                 const ExecParameters *params,
2181                 const ExecSharedRuntime *runtime) {
2182
2183         assert(context);
2184
2185         if (context->root_image)
2186                 return true;
2187
2188         if (!strv_isempty(context->read_write_paths) ||
2189             !strv_isempty(context->read_only_paths) ||
2190             !strv_isempty(context->inaccessible_paths) ||
2191             !strv_isempty(context->exec_paths) ||
2192             !strv_isempty(context->no_exec_paths))
2193                 return true;
2194
2195         if (context->n_bind_mounts > 0)
2196                 return true;
2197
2198         if (context->n_temporary_filesystems > 0)
2199                 return true;
2200
2201         if (context->n_mount_images > 0)
2202                 return true;
2203
2204         if (context->n_extension_images > 0)
2205                 return true;
2206
2207         if (!strv_isempty(context->extension_directories))
2208                 return true;
2209
2210         if (!IN_SET(context->mount_propagation_flag, 0, MS_SHARED))
2211                 return true;
2212
2213         if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
2214                 return true;
2215
2216         if (context->private_devices ||
2217             context->private_mounts > 0 ||
2218             (context->private_mounts < 0 && exec_needs_network_namespace(context)) ||
2219             context->protect_system != PROTECT_SYSTEM_NO ||
2220             context->protect_home != PROTECT_HOME_NO ||
2221             context->protect_kernel_tunables ||
2222             context->protect_kernel_modules ||
2223             context->protect_kernel_logs ||
2224             context->protect_control_groups ||
2225             context->protect_proc != PROTECT_PROC_DEFAULT ||
2226             context->proc_subset != PROC_SUBSET_ALL ||
2227             exec_needs_ipc_namespace(context))
2228                 return true;
2229
2230         if (context->root_directory) {
2231                 if (exec_context_get_effective_mount_apivfs(context))
2232                         return true;
2233
2234                 for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2235                         if (params && !params->prefix[t])
2236                                 continue;
2237
2238                         if (context->directories[t].n_items > 0)
2239                                 return true;
2240                 }
2241         }
2242
2243         if (context->dynamic_user &&
2244             (context->directories[EXEC_DIRECTORY_STATE].n_items > 0 ||
2245              context->directories[EXEC_DIRECTORY_CACHE].n_items > 0 ||
2246              context->directories[EXEC_DIRECTORY_LOGS].n_items > 0))
2247                 return true;
2248
2249         if (context->log_namespace)
2250                 return true;
2251
2252         return false;
2253 }
2254
2255 static int setup_private_users(uid_t ouid, gid_t ogid, uid_t uid, gid_t gid) {
2256         _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
2257         _cleanup_close_pair_ int errno_pipe[2] = PIPE_EBADF;
2258         _cleanup_close_ int unshare_ready_fd = -EBADF;
2259         _cleanup_(sigkill_waitp) pid_t pid = 0;
2260         uint64_t c = 1;
2261         ssize_t n;
2262         int r;
2263
2264         /* Set up a user namespace and map the original UID/GID (IDs from before any user or group changes, i.e.
2265          * the IDs from the user or system manager(s)) to itself, the selected UID/GID to itself, and everything else to
2266          * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
2267          * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
2268          * which waits for the parent to create the new user namespace while staying in the original namespace. The
2269          * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
2270          * continues execution normally.
2271          * For unprivileged users (i.e. without capabilities), the root to root mapping is excluded. As such, it
2272          * does not need CAP_SETUID to write the single line mapping to itself. */
2273
2274         /* Can only set up multiple mappings with CAP_SETUID. */
2275         if (have_effective_cap(CAP_SETUID) > 0 && uid != ouid && uid_is_valid(uid))
2276                 r = asprintf(&uid_map,
2277                              UID_FMT " " UID_FMT " 1\n"     /* Map $OUID → $OUID */
2278                              UID_FMT " " UID_FMT " 1\n",    /* Map $UID → $UID */
2279                              ouid, ouid, uid, uid);
2280         else
2281                 r = asprintf(&uid_map,
2282                              UID_FMT " " UID_FMT " 1\n",    /* Map $OUID → $OUID */
2283                              ouid, ouid);
2284
2285         if (r < 0)
2286                 return -ENOMEM;
2287
2288         /* Can only set up multiple mappings with CAP_SETGID. */
2289         if (have_effective_cap(CAP_SETGID) > 0 && gid != ogid && gid_is_valid(gid))
2290                 r = asprintf(&gid_map,
2291                              GID_FMT " " GID_FMT " 1\n"     /* Map $OGID → $OGID */
2292                              GID_FMT " " GID_FMT " 1\n",    /* Map $GID → $GID */
2293                              ogid, ogid, gid, gid);
2294         else
2295                 r = asprintf(&gid_map,
2296                              GID_FMT " " GID_FMT " 1\n",    /* Map $OGID -> $OGID */
2297                              ogid, ogid);
2298
2299         if (r < 0)
2300                 return -ENOMEM;
2301
2302         /* Create a communication channel so that the parent can tell the child when it finished creating the user
2303          * namespace. */
2304         unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
2305         if (unshare_ready_fd < 0)
2306                 return -errno;
2307
2308         /* Create a communication channel so that the child can tell the parent a proper error code in case it
2309          * failed. */
2310         if (pipe2(errno_pipe, O_CLOEXEC) < 0)
2311                 return -errno;
2312
2313         r = safe_fork("(sd-userns)", FORK_RESET_SIGNALS|FORK_DEATHSIG, &pid);
2314         if (r < 0)
2315                 return r;
2316         if (r == 0) {
2317                 _cleanup_close_ int fd = -EBADF;
2318                 const char *a;
2319                 pid_t ppid;
2320
2321                 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
2322                  * here, after the parent opened its own user namespace. */
2323
2324                 ppid = getppid();
2325                 errno_pipe[0] = safe_close(errno_pipe[0]);
2326
2327                 /* Wait until the parent unshared the user namespace */
2328                 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
2329                         r = -errno;
2330                         goto child_fail;
2331                 }
2332
2333                 /* Disable the setgroups() system call in the child user namespace, for good. */
2334                 a = procfs_file_alloca(ppid, "setgroups");
2335                 fd = open(a, O_WRONLY|O_CLOEXEC);
2336                 if (fd < 0) {
2337                         if (errno != ENOENT) {
2338                                 r = -errno;
2339                                 goto child_fail;
2340                         }
2341
2342                         /* If the file is missing the kernel is too old, let's continue anyway. */
2343                 } else {
2344                         if (write(fd, "deny\n", 5) < 0) {
2345                                 r = -errno;
2346                                 goto child_fail;
2347                         }
2348
2349                         fd = safe_close(fd);
2350                 }
2351
2352                 /* First write the GID map */
2353                 a = procfs_file_alloca(ppid, "gid_map");
2354                 fd = open(a, O_WRONLY|O_CLOEXEC);
2355                 if (fd < 0) {
2356                         r = -errno;
2357                         goto child_fail;
2358                 }
2359                 if (write(fd, gid_map, strlen(gid_map)) < 0) {
2360                         r = -errno;
2361                         goto child_fail;
2362                 }
2363                 fd = safe_close(fd);
2364
2365                 /* The write the UID map */
2366                 a = procfs_file_alloca(ppid, "uid_map");
2367                 fd = open(a, O_WRONLY|O_CLOEXEC);
2368                 if (fd < 0) {
2369                         r = -errno;
2370                         goto child_fail;
2371                 }
2372                 if (write(fd, uid_map, strlen(uid_map)) < 0) {
2373                         r = -errno;
2374                         goto child_fail;
2375                 }
2376
2377                 _exit(EXIT_SUCCESS);
2378
2379         child_fail:
2380                 (void) write(errno_pipe[1], &r, sizeof(r));
2381                 _exit(EXIT_FAILURE);
2382         }
2383
2384         errno_pipe[1] = safe_close(errno_pipe[1]);
2385
2386         if (unshare(CLONE_NEWUSER) < 0)
2387                 return -errno;
2388
2389         /* Let the child know that the namespace is ready now */
2390         if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
2391                 return -errno;
2392
2393         /* Try to read an error code from the child */
2394         n = read(errno_pipe[0], &r, sizeof(r));
2395         if (n < 0)
2396                 return -errno;
2397         if (n == sizeof(r)) { /* an error code was sent to us */
2398                 if (r < 0)
2399                         return r;
2400                 return -EIO;
2401         }
2402         if (n != 0) /* on success we should have read 0 bytes */
2403                 return -EIO;
2404
2405         r = wait_for_terminate_and_check("(sd-userns)", TAKE_PID(pid), 0);
2406         if (r < 0)
2407                 return r;
2408         if (r != EXIT_SUCCESS) /* If something strange happened with the child, let's consider this fatal, too */
2409                 return -EIO;
2410
2411         return 0;
2412 }
2413
2414 static bool exec_directory_is_private(const ExecContext *context, ExecDirectoryType type) {
2415         if (!context->dynamic_user)
2416                 return false;
2417
2418         if (type == EXEC_DIRECTORY_CONFIGURATION)
2419                 return false;
2420
2421         if (type == EXEC_DIRECTORY_RUNTIME && context->runtime_directory_preserve_mode == EXEC_PRESERVE_NO)
2422                 return false;
2423
2424         return true;
2425 }
2426
2427 static int create_many_symlinks(const char *root, const char *source, char **symlinks) {
2428         _cleanup_free_ char *src_abs = NULL;
2429         int r;
2430
2431         assert(source);
2432
2433         src_abs = path_join(root, source);
2434         if (!src_abs)
2435                 return -ENOMEM;
2436
2437         STRV_FOREACH(dst, symlinks) {
2438                 _cleanup_free_ char *dst_abs = NULL;
2439
2440                 dst_abs = path_join(root, *dst);
2441                 if (!dst_abs)
2442                         return -ENOMEM;
2443
2444                 r = mkdir_parents_label(dst_abs, 0755);
2445                 if (r < 0)
2446                         return r;
2447
2448                 r = symlink_idempotent(src_abs, dst_abs, true);
2449                 if (r < 0)
2450                         return r;
2451         }
2452
2453         return 0;
2454 }
2455
2456 static int setup_exec_directory(
2457                 const ExecContext *context,
2458                 const ExecParameters *params,
2459                 uid_t uid,
2460                 gid_t gid,
2461                 ExecDirectoryType type,
2462                 bool needs_mount_namespace,
2463                 int *exit_status) {
2464
2465         static const int exit_status_table[_EXEC_DIRECTORY_TYPE_MAX] = {
2466                 [EXEC_DIRECTORY_RUNTIME] = EXIT_RUNTIME_DIRECTORY,
2467                 [EXEC_DIRECTORY_STATE] = EXIT_STATE_DIRECTORY,
2468                 [EXEC_DIRECTORY_CACHE] = EXIT_CACHE_DIRECTORY,
2469                 [EXEC_DIRECTORY_LOGS] = EXIT_LOGS_DIRECTORY,
2470                 [EXEC_DIRECTORY_CONFIGURATION] = EXIT_CONFIGURATION_DIRECTORY,
2471         };
2472         int r;
2473
2474         assert(context);
2475         assert(params);
2476         assert(type >= 0 && type < _EXEC_DIRECTORY_TYPE_MAX);
2477         assert(exit_status);
2478
2479         if (!params->prefix[type])
2480                 return 0;
2481
2482         if (params->flags & EXEC_CHOWN_DIRECTORIES) {
2483                 if (!uid_is_valid(uid))
2484                         uid = 0;
2485                 if (!gid_is_valid(gid))
2486                         gid = 0;
2487         }
2488
2489         for (size_t i = 0; i < context->directories[type].n_items; i++) {
2490                 _cleanup_free_ char *p = NULL, *pp = NULL;
2491
2492                 p = path_join(params->prefix[type], context->directories[type].items[i].path);
2493                 if (!p) {
2494                         r = -ENOMEM;
2495                         goto fail;
2496                 }
2497
2498                 r = mkdir_parents_label(p, 0755);
2499                 if (r < 0)
2500                         goto fail;
2501
2502                 if (exec_directory_is_private(context, type)) {
2503                         /* So, here's one extra complication when dealing with DynamicUser=1 units. In that
2504                          * case we want to avoid leaving a directory around fully accessible that is owned by
2505                          * a dynamic user whose UID is later on reused. To lock this down we use the same
2506                          * trick used by container managers to prohibit host users to get access to files of
2507                          * the same UID in containers: we place everything inside a directory that has an
2508                          * access mode of 0700 and is owned root:root, so that it acts as security boundary
2509                          * for unprivileged host code. We then use fs namespacing to make this directory
2510                          * permeable for the service itself.
2511                          *
2512                          * Specifically: for a service which wants a special directory "foo/" we first create
2513                          * a directory "private/" with access mode 0700 owned by root:root. Then we place
2514                          * "foo" inside of that directory (i.e. "private/foo/"), and make "foo" a symlink to
2515                          * "private/foo". This way, privileged host users can access "foo/" as usual, but
2516                          * unprivileged host users can't look into it. Inside of the namespace of the unit
2517                          * "private/" is replaced by a more liberally accessible tmpfs, into which the host's
2518                          * "private/foo/" is mounted under the same name, thus disabling the access boundary
2519                          * for the service and making sure it only gets access to the dirs it needs but no
2520                          * others. Tricky? Yes, absolutely, but it works!
2521                          *
2522                          * Note that we don't do this for EXEC_DIRECTORY_CONFIGURATION as that's assumed not
2523                          * to be owned by the service itself.
2524                          *
2525                          * Also, note that we don't do this for EXEC_DIRECTORY_RUNTIME as that's often used
2526                          * for sharing files or sockets with other services. */
2527
2528                         pp = path_join(params->prefix[type], "private");
2529                         if (!pp) {
2530                                 r = -ENOMEM;
2531                                 goto fail;
2532                         }
2533
2534                         /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */
2535                         r = mkdir_safe_label(pp, 0700, 0, 0, MKDIR_WARN_MODE);
2536                         if (r < 0)
2537                                 goto fail;
2538
2539                         if (!path_extend(&pp, context->directories[type].items[i].path)) {
2540                                 r = -ENOMEM;
2541                                 goto fail;
2542                         }
2543
2544                         /* Create all directories between the configured directory and this private root, and mark them 0755 */
2545                         r = mkdir_parents_label(pp, 0755);
2546                         if (r < 0)
2547                                 goto fail;
2548
2549                         if (is_dir(p, false) > 0 &&
2550                             (laccess(pp, F_OK) < 0 && errno == ENOENT)) {
2551
2552                                 /* Hmm, the private directory doesn't exist yet, but the normal one exists? If so, move
2553                                  * it over. Most likely the service has been upgraded from one that didn't use
2554                                  * DynamicUser=1, to one that does. */
2555
2556                                 log_info("Found pre-existing public %s= directory %s, migrating to %s.\n"
2557                                          "Apparently, service previously had DynamicUser= turned off, and has now turned it on.",
2558                                          exec_directory_type_to_string(type), p, pp);
2559
2560                                 if (rename(p, pp) < 0) {
2561                                         r = -errno;
2562                                         goto fail;
2563                                 }
2564                         } else {
2565                                 /* Otherwise, create the actual directory for the service */
2566
2567                                 r = mkdir_label(pp, context->directories[type].mode);
2568                                 if (r < 0 && r != -EEXIST)
2569                                         goto fail;
2570                         }
2571
2572                         if (!context->directories[type].items[i].only_create) {
2573                                 /* And link it up from the original place.
2574                                  * Notes
2575                                  * 1) If a mount namespace is going to be used, then this symlink remains on
2576                                  *    the host, and a new one for the child namespace will be created later.
2577                                  * 2) It is not necessary to create this symlink when one of its parent
2578                                  *    directories is specified and already created. E.g.
2579                                  *        StateDirectory=foo foo/bar
2580                                  *    In that case, the inode points to pp and p for "foo/bar" are the same:
2581                                  *        pp = "/var/lib/private/foo/bar"
2582                                  *        p = "/var/lib/foo/bar"
2583                                  *    and, /var/lib/foo is a symlink to /var/lib/private/foo. So, not only
2584                                  *    we do not need to create the symlink, but we cannot create the symlink.
2585                                  *    See issue #24783. */
2586                                 r = symlink_idempotent(pp, p, true);
2587                                 if (r < 0)
2588                                         goto fail;
2589                         }
2590
2591                 } else {
2592                         _cleanup_free_ char *target = NULL;
2593
2594                         if (type != EXEC_DIRECTORY_CONFIGURATION &&
2595                             readlink_and_make_absolute(p, &target) >= 0) {
2596                                 _cleanup_free_ char *q = NULL, *q_resolved = NULL, *target_resolved = NULL;
2597
2598                                 /* This already exists and is a symlink? Interesting. Maybe it's one created
2599                                  * by DynamicUser=1 (see above)?
2600                                  *
2601                                  * We do this for all directory types except for ConfigurationDirectory=,
2602                                  * since they all support the private/ symlink logic at least in some
2603                                  * configurations, see above. */
2604
2605                                 r = chase(target, NULL, 0, &target_resolved, NULL);
2606                                 if (r < 0)
2607                                         goto fail;
2608
2609                                 q = path_join(params->prefix[type], "private", context->directories[type].items[i].path);
2610                                 if (!q) {
2611                                         r = -ENOMEM;
2612                                         goto fail;
2613                                 }
2614
2615                                 /* /var/lib or friends may be symlinks. So, let's chase them also. */
2616                                 r = chase(q, NULL, CHASE_NONEXISTENT, &q_resolved, NULL);
2617                                 if (r < 0)
2618                                         goto fail;
2619
2620                                 if (path_equal(q_resolved, target_resolved)) {
2621
2622                                         /* Hmm, apparently DynamicUser= was once turned on for this service,
2623                                          * but is no longer. Let's move the directory back up. */
2624
2625                                         log_info("Found pre-existing private %s= directory %s, migrating to %s.\n"
2626                                                  "Apparently, service previously had DynamicUser= turned on, and has now turned it off.",
2627                                                  exec_directory_type_to_string(type), q, p);
2628
2629                                         if (unlink(p) < 0) {
2630                                                 r = -errno;
2631                                                 goto fail;
2632                                         }
2633
2634                                         if (rename(q, p) < 0) {
2635                                                 r = -errno;
2636                                                 goto fail;
2637                                         }
2638                                 }
2639                         }
2640
2641                         r = mkdir_label(p, context->directories[type].mode);
2642                         if (r < 0) {
2643                                 if (r != -EEXIST)
2644                                         goto fail;
2645
2646                                 if (type == EXEC_DIRECTORY_CONFIGURATION) {
2647                                         struct stat st;
2648
2649                                         /* Don't change the owner/access mode of the configuration directory,
2650                                          * as in the common case it is not written to by a service, and shall
2651                                          * not be writable. */
2652
2653                                         if (stat(p, &st) < 0) {
2654                                                 r = -errno;
2655                                                 goto fail;
2656                                         }
2657
2658                                         /* Still complain if the access mode doesn't match */
2659                                         if (((st.st_mode ^ context->directories[type].mode) & 07777) != 0)
2660                                                 log_warning("%s \'%s\' already exists but the mode is different. "
2661                                                             "(File system: %o %sMode: %o)",
2662                                                             exec_directory_type_to_string(type), context->directories[type].items[i].path,
2663                                                             st.st_mode & 07777, exec_directory_type_to_string(type), context->directories[type].mode & 07777);
2664
2665                                         continue;
2666                                 }
2667                         }
2668                 }
2669
2670                 /* Lock down the access mode (we use chmod_and_chown() to make this idempotent. We don't
2671                  * specify UID/GID here, so that path_chown_recursive() can optimize things depending on the
2672                  * current UID/GID ownership.) */
2673                 r = chmod_and_chown(pp ?: p, context->directories[type].mode, UID_INVALID, GID_INVALID);
2674                 if (r < 0)
2675                         goto fail;
2676
2677                 /* Then, change the ownership of the whole tree, if necessary. When dynamic users are used we
2678                  * drop the suid/sgid bits, since we really don't want SUID/SGID files for dynamic UID/GID
2679                  * assignments to exist. */
2680                 r = path_chown_recursive(pp ?: p, uid, gid, context->dynamic_user ? 01777 : 07777);
2681                 if (r < 0)
2682                         goto fail;
2683         }
2684
2685         /* If we are not going to run in a namespace, set up the symlinks - otherwise
2686          * they are set up later, to allow configuring empty var/run/etc. */
2687         if (!needs_mount_namespace)
2688                 for (size_t i = 0; i < context->directories[type].n_items; i++) {
2689                         r = create_many_symlinks(params->prefix[type],
2690                                                  context->directories[type].items[i].path,
2691                                                  context->directories[type].items[i].symlinks);
2692                         if (r < 0)
2693                                 goto fail;
2694                 }
2695
2696         return 0;
2697
2698 fail:
2699         *exit_status = exit_status_table[type];
2700         return r;
2701 }
2702
2703 static int write_credential(
2704                 int dfd,
2705                 const char *id,
2706                 const void *data,
2707                 size_t size,
2708                 uid_t uid,
2709                 bool ownership_ok) {
2710
2711         _cleanup_(unlink_and_freep) char *tmp = NULL;
2712         _cleanup_close_ int fd = -EBADF;
2713         int r;
2714
2715         r = tempfn_random_child("", "cred", &tmp);
2716         if (r < 0)
2717                 return r;
2718
2719         fd = openat(dfd, tmp, O_CREAT|O_RDWR|O_CLOEXEC|O_EXCL|O_NOFOLLOW|O_NOCTTY, 0600);
2720         if (fd < 0) {
2721                 tmp = mfree(tmp);
2722                 return -errno;
2723         }
2724
2725         r = loop_write(fd, data, size, /* do_poll = */ false);
2726         if (r < 0)
2727                 return r;
2728
2729         if (fchmod(fd, 0400) < 0) /* Take away "w" bit */
2730                 return -errno;
2731
2732         if (uid_is_valid(uid) && uid != getuid()) {
2733                 r = fd_add_uid_acl_permission(fd, uid, ACL_READ);
2734                 if (r < 0) {
2735                         if (!ERRNO_IS_NOT_SUPPORTED(r) && !ERRNO_IS_PRIVILEGE(r))
2736                                 return r;
2737
2738                         if (!ownership_ok) /* Ideally we use ACLs, since we can neatly express what we want
2739                                             * to express: that the user gets read access and nothing
2740                                             * else. But if the backing fs can't support that (e.g. ramfs)
2741                                             * then we can use file ownership instead. But that's only safe if
2742                                             * we can then re-mount the whole thing read-only, so that the
2743                                             * user can no longer chmod() the file to gain write access. */
2744                                 return r;
2745
2746                         if (fchown(fd, uid, GID_INVALID) < 0)
2747                                 return -errno;
2748                 }
2749         }
2750
2751         if (renameat(dfd, tmp, dfd, id) < 0)
2752                 return -errno;
2753
2754         tmp = mfree(tmp);
2755         return 0;
2756 }
2757
2758 static char **credential_search_path(
2759                 const ExecParameters *params,
2760                 bool encrypted) {
2761
2762         _cleanup_strv_free_ char **l = NULL;
2763
2764         assert(params);
2765
2766         /* Assemble a search path to find credentials in. We'll look in /etc/credstore/ (and similar
2767          * directories in /usr/lib/ + /run/) for all types of credentials. If we are looking for encrypted
2768          * credentials, also look in /etc/credstore.encrypted/ (and similar dirs). */
2769
2770         if (encrypted) {
2771                 if (strv_extend(&l, params->received_encrypted_credentials_directory) < 0)
2772                         return NULL;
2773
2774                 if (strv_extend_strv(&l, CONF_PATHS_STRV("credstore.encrypted"), /* filter_duplicates= */ true) < 0)
2775                         return NULL;
2776         }
2777
2778         if (params->received_credentials_directory)
2779                 if (strv_extend(&l, params->received_credentials_directory) < 0)
2780                         return NULL;
2781
2782         if (strv_extend_strv(&l, CONF_PATHS_STRV("credstore"), /* filter_duplicates= */ true) < 0)
2783                 return NULL;
2784
2785         if (DEBUG_LOGGING) {
2786                 _cleanup_free_ char *t = strv_join(l, ":");
2787
2788                 log_debug("Credential search path is: %s", t);
2789         }
2790
2791         return TAKE_PTR(l);
2792 }
2793
2794 static int load_credential(
2795                 const ExecContext *context,
2796                 const ExecParameters *params,
2797                 const char *id,
2798                 const char *path,
2799                 bool encrypted,
2800                 const char *unit,
2801                 int read_dfd,
2802                 int write_dfd,
2803                 uid_t uid,
2804                 bool ownership_ok,
2805                 uint64_t *left) {
2806
2807         ReadFullFileFlags flags = READ_FULL_FILE_SECURE|READ_FULL_FILE_FAIL_WHEN_LARGER;
2808         _cleanup_strv_free_ char **search_path = NULL;
2809         _cleanup_(erase_and_freep) char *data = NULL;
2810         _cleanup_free_ char *bindname = NULL;
2811         const char *source = NULL;
2812         bool missing_ok = true;
2813         size_t size, add, maxsz;
2814         int r;
2815
2816         assert(context);
2817         assert(params);
2818         assert(id);
2819         assert(path);
2820         assert(unit);
2821         assert(read_dfd >= 0 || read_dfd == AT_FDCWD);
2822         assert(write_dfd >= 0);
2823         assert(left);
2824
2825         if (read_dfd >= 0) {
2826                 /* If a directory fd is specified, then read the file directly from that dir. In this case we
2827                  * won't do AF_UNIX stuff (we simply don't want to recursively iterate down a tree of AF_UNIX
2828                  * IPC sockets). It's OK if a file vanishes here in the time we enumerate it and intend to
2829                  * open it. */
2830
2831                 if (!filename_is_valid(path)) /* safety check */
2832                         return -EINVAL;
2833
2834                 missing_ok = true;
2835                 source = path;
2836
2837         } else if (path_is_absolute(path)) {
2838                 /* If this is an absolute path, read the data directly from it, and support AF_UNIX
2839                  * sockets */
2840
2841                 if (!path_is_valid(path)) /* safety check */
2842                         return -EINVAL;
2843
2844                 flags |= READ_FULL_FILE_CONNECT_SOCKET;
2845
2846                 /* Pass some minimal info about the unit and the credential name we are looking to acquire
2847                  * via the source socket address in case we read off an AF_UNIX socket. */
2848                 if (asprintf(&bindname, "@%" PRIx64"/unit/%s/%s", random_u64(), unit, id) < 0)
2849                         return -ENOMEM;
2850
2851                 missing_ok = false;
2852                 source = path;
2853
2854         } else if (credential_name_valid(path)) {
2855                 /* If this is a relative path, take it as credential name relative to the credentials
2856                  * directory we received ourselves. We don't support the AF_UNIX stuff in this mode, since we
2857                  * are operating on a credential store, i.e. this is guaranteed to be regular files. */
2858
2859                 search_path = credential_search_path(params, encrypted);
2860                 if (!search_path)
2861                         return -ENOMEM;
2862
2863                 missing_ok = true;
2864         } else
2865                 source = NULL;
2866
2867         if (encrypted)
2868                 flags |= READ_FULL_FILE_UNBASE64;
2869
2870         maxsz = encrypted ? CREDENTIAL_ENCRYPTED_SIZE_MAX : CREDENTIAL_SIZE_MAX;
2871
2872         if (search_path) {
2873                 STRV_FOREACH(d, search_path) {
2874                         _cleanup_free_ char *j = NULL;
2875
2876                         j = path_join(*d, path);
2877                         if (!j)
2878                                 return -ENOMEM;
2879
2880                         r = read_full_file_full(
2881                                         AT_FDCWD, j, /* path is absolute, hence pass AT_FDCWD as nop dir fd here */
2882                                         UINT64_MAX,
2883                                         maxsz,
2884                                         flags,
2885                                         NULL,
2886                                         &data, &size);
2887                         if (r != -ENOENT)
2888                                 break;
2889                 }
2890         } else if (source)
2891                 r = read_full_file_full(
2892                                 read_dfd, source,
2893                                 UINT64_MAX,
2894                                 maxsz,
2895                                 flags,
2896                                 bindname,
2897                                 &data, &size);
2898         else
2899                 r = -ENOENT;
2900
2901         if (r == -ENOENT && (missing_ok || hashmap_contains(context->set_credentials, id))) {
2902                 /* Make a missing inherited credential non-fatal, let's just continue. After all apps
2903                  * will get clear errors if we don't pass such a missing credential on as they
2904                  * themselves will get ENOENT when trying to read them, which should not be much
2905                  * worse than when we handle the error here and make it fatal.
2906                  *
2907                  * Also, if the source file doesn't exist, but a fallback is set via SetCredentials=
2908                  * we are fine, too. */
2909                 log_debug_errno(r, "Couldn't read inherited credential '%s', skipping: %m", path);
2910                 return 0;
2911         }
2912         if (r < 0)
2913                 return log_debug_errno(r, "Failed to read credential '%s': %m", path);
2914
2915         if (encrypted) {
2916                 _cleanup_free_ void *plaintext = NULL;
2917                 size_t plaintext_size = 0;
2918
2919                 r = decrypt_credential_and_warn(id, now(CLOCK_REALTIME), NULL, NULL, data, size, &plaintext, &plaintext_size);
2920                 if (r < 0)
2921                         return r;
2922
2923                 free_and_replace(data, plaintext);
2924                 size = plaintext_size;
2925         }
2926
2927         add = strlen(id) + size;
2928         if (add > *left)
2929                 return -E2BIG;
2930
2931         r = write_credential(write_dfd, id, data, size, uid, ownership_ok);
2932         if (r < 0)
2933                 return log_debug_errno(r, "Failed to write credential '%s': %m", id);
2934
2935         *left -= add;
2936         return 0;
2937 }
2938
2939 struct load_cred_args {
2940         const ExecContext *context;
2941         const ExecParameters *params;
2942         bool encrypted;
2943         const char *unit;
2944         int dfd;
2945         uid_t uid;
2946         bool ownership_ok;
2947         uint64_t *left;
2948 };
2949
2950 static int load_cred_recurse_dir_cb(
2951                 RecurseDirEvent event,
2952                 const char *path,
2953                 int dir_fd,
2954                 int inode_fd,
2955                 const struct dirent *de,
2956                 const struct statx *sx,
2957                 void *userdata) {
2958
2959         struct load_cred_args *args = ASSERT_PTR(userdata);
2960         _cleanup_free_ char *sub_id = NULL;
2961         int r;
2962
2963         if (event != RECURSE_DIR_ENTRY)
2964                 return RECURSE_DIR_CONTINUE;
2965
2966         if (!IN_SET(de->d_type, DT_REG, DT_SOCK))
2967                 return RECURSE_DIR_CONTINUE;
2968
2969         sub_id = strreplace(path, "/", "_");
2970         if (!sub_id)
2971                 return -ENOMEM;
2972
2973         if (!credential_name_valid(sub_id))
2974                 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Credential would get ID %s, which is not valid, refusing", sub_id);
2975
2976         if (faccessat(args->dfd, sub_id, F_OK, AT_SYMLINK_NOFOLLOW) >= 0) {
2977                 log_debug("Skipping credential with duplicated ID %s at %s", sub_id, path);
2978                 return RECURSE_DIR_CONTINUE;
2979         }
2980         if (errno != ENOENT)
2981                 return log_debug_errno(errno, "Failed to test if credential %s exists: %m", sub_id);
2982
2983         r = load_credential(
2984                         args->context,
2985                         args->params,
2986                         sub_id,
2987                         de->d_name,
2988                         args->encrypted,
2989                         args->unit,
2990                         dir_fd,
2991                         args->dfd,
2992                         args->uid,
2993                         args->ownership_ok,
2994                         args->left);
2995         if (r < 0)
2996                 return r;
2997
2998         return RECURSE_DIR_CONTINUE;
2999 }
3000
3001 static int acquire_credentials(
3002                 const ExecContext *context,
3003                 const ExecParameters *params,
3004                 const char *unit,
3005                 const char *p,
3006                 uid_t uid,
3007                 bool ownership_ok) {
3008
3009         uint64_t left = CREDENTIALS_TOTAL_SIZE_MAX;
3010         _cleanup_close_ int dfd = -EBADF;
3011         ExecLoadCredential *lc;
3012         ExecSetCredential *sc;
3013         int r;
3014
3015         assert(context);
3016         assert(p);
3017
3018         dfd = open(p, O_DIRECTORY|O_CLOEXEC);
3019         if (dfd < 0)
3020                 return -errno;
3021
3022         /* First, load credentials off disk (or acquire via AF_UNIX socket) */
3023         HASHMAP_FOREACH(lc, context->load_credentials) {
3024                 _cleanup_close_ int sub_fd = -EBADF;
3025
3026                 /* If this is an absolute path, then try to open it as a directory. If that works, then we'll
3027                  * recurse into it. If it is an absolute path but it isn't a directory, then we'll open it as
3028                  * a regular file. Finally, if it's a relative path we will use it as a credential name to
3029                  * propagate a credential passed to us from further up. */
3030
3031                 if (path_is_absolute(lc->path)) {
3032                         sub_fd = open(lc->path, O_DIRECTORY|O_CLOEXEC|O_RDONLY);
3033                         if (sub_fd < 0 && !IN_SET(errno,
3034                                                   ENOTDIR,  /* Not a directory */
3035                                                   ENOENT))  /* Doesn't exist? */
3036                                 return log_debug_errno(errno, "Failed to open '%s': %m", lc->path);
3037                 }
3038
3039                 if (sub_fd < 0)
3040                         /* Regular file (incl. a credential passed in from higher up) */
3041                         r = load_credential(
3042                                         context,
3043                                         params,
3044                                         lc->id,
3045                                         lc->path,
3046                                         lc->encrypted,
3047                                         unit,
3048                                         AT_FDCWD,
3049                                         dfd,
3050                                         uid,
3051                                         ownership_ok,
3052                                         &left);
3053                 else
3054                         /* Directory */
3055                         r = recurse_dir(
3056                                         sub_fd,
3057                                         /* path= */ lc->id, /* recurse_dir() will suffix the subdir paths from here to the top-level id */
3058                                         /* statx_mask= */ 0,
3059                                         /* n_depth_max= */ UINT_MAX,
3060                                         RECURSE_DIR_SORT|RECURSE_DIR_IGNORE_DOT|RECURSE_DIR_ENSURE_TYPE,
3061                                         load_cred_recurse_dir_cb,
3062                                         &(struct load_cred_args) {
3063                                                 .context = context,
3064                                                 .params = params,
3065                                                 .encrypted = lc->encrypted,
3066                                                 .unit = unit,
3067                                                 .dfd = dfd,
3068                                                 .uid = uid,
3069                                                 .ownership_ok = ownership_ok,
3070                                                 .left = &left,
3071                                         });
3072                 if (r < 0)
3073                         return r;
3074         }
3075
3076         /* Second, we add in literally specified credentials. If the credentials already exist, we'll not add
3077          * them, so that they can act as a "default" if the same credential is specified multiple times. */
3078         HASHMAP_FOREACH(sc, context->set_credentials) {
3079                 _cleanup_(erase_and_freep) void *plaintext = NULL;
3080                 const char *data;
3081                 size_t size, add;
3082
3083                 /* Note that we check ahead of time here instead of relying on O_EXCL|O_CREAT later to return
3084                  * EEXIST if the credential already exists. That's because the TPM2-based decryption is kinda
3085                  * slow and involved, hence it's nice to be able to skip that if the credential already
3086                  * exists anyway. */
3087                 if (faccessat(dfd, sc->id, F_OK, AT_SYMLINK_NOFOLLOW) >= 0)
3088                         continue;
3089                 if (errno != ENOENT)
3090                         return log_debug_errno(errno, "Failed to test if credential %s exists: %m", sc->id);
3091
3092                 if (sc->encrypted) {
3093                         r = decrypt_credential_and_warn(sc->id, now(CLOCK_REALTIME), NULL, NULL, sc->data, sc->size, &plaintext, &size);
3094                         if (r < 0)
3095                                 return r;
3096
3097                         data = plaintext;
3098                 } else {
3099                         data = sc->data;
3100                         size = sc->size;
3101                 }
3102
3103                 add = strlen(sc->id) + size;
3104                 if (add > left)
3105                         return -E2BIG;
3106
3107                 r = write_credential(dfd, sc->id, data, size, uid, ownership_ok);
3108                 if (r < 0)
3109                         return r;
3110
3111                 left -= add;
3112         }
3113
3114         if (fchmod(dfd, 0500) < 0) /* Now take away the "w" bit */
3115                 return -errno;
3116
3117         /* After we created all keys with the right perms, also make sure the credential store as a whole is
3118          * accessible */
3119
3120         if (uid_is_valid(uid) && uid != getuid()) {
3121                 r = fd_add_uid_acl_permission(dfd, uid, ACL_READ | ACL_EXECUTE);
3122                 if (r < 0) {
3123                         if (!ERRNO_IS_NOT_SUPPORTED(r) && !ERRNO_IS_PRIVILEGE(r))
3124                                 return r;
3125
3126                         if (!ownership_ok)
3127                                 return r;
3128
3129                         if (fchown(dfd, uid, GID_INVALID) < 0)
3130                                 return -errno;
3131                 }
3132         }
3133
3134         return 0;
3135 }
3136
3137 static int setup_credentials_internal(
3138                 const ExecContext *context,
3139                 const ExecParameters *params,
3140                 const char *unit,
3141                 const char *final,        /* This is where the credential store shall eventually end up at */
3142                 const char *workspace,    /* This is where we can prepare it before moving it to the final place */
3143                 bool reuse_workspace,     /* Whether to reuse any existing workspace mount if it already is a mount */
3144                 bool must_mount,          /* Whether to require that we mount something, it's not OK to use the plain directory fall back */
3145                 uid_t uid) {
3146
3147         int r, workspace_mounted; /* negative if we don't know yet whether we have/can mount something; true
3148                                    * if we mounted something; false if we definitely can't mount anything */
3149         bool final_mounted;
3150         const char *where;
3151
3152         assert(context);
3153         assert(final);
3154         assert(workspace);
3155
3156         if (reuse_workspace) {
3157                 r = path_is_mount_point(workspace, NULL, 0);
3158                 if (r < 0)
3159                         return r;
3160                 if (r > 0)
3161                         workspace_mounted = true; /* If this is already a mount, and we are supposed to reuse it, let's keep this in mind */
3162                 else
3163                         workspace_mounted = -1; /* We need to figure out if we can mount something to the workspace */
3164         } else
3165                 workspace_mounted = -1; /* ditto */
3166
3167         r = path_is_mount_point(final, NULL, 0);
3168         if (r < 0)
3169                 return r;
3170         if (r > 0) {
3171                 /* If the final place already has something mounted, we use that. If the workspace also has
3172                  * something mounted we assume it's actually the same mount (but with MS_RDONLY
3173                  * different). */
3174                 final_mounted = true;
3175
3176                 if (workspace_mounted < 0) {
3177                         /* If the final place is mounted, but the workspace isn't, then let's bind mount
3178                          * the final version to the workspace, and make it writable, so that we can make
3179                          * changes */
3180
3181                         r = mount_nofollow_verbose(LOG_DEBUG, final, workspace, NULL, MS_BIND|MS_REC, NULL);
3182                         if (r < 0)
3183                                 return r;
3184
3185                         r = mount_nofollow_verbose(LOG_DEBUG, NULL, workspace, NULL, MS_BIND|MS_REMOUNT|MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL);
3186                         if (r < 0)
3187                                 return r;
3188
3189                         workspace_mounted = true;
3190                 }
3191         } else
3192                 final_mounted = false;
3193
3194         if (workspace_mounted < 0) {
3195                 /* Nothing is mounted on the workspace yet, let's try to mount something now */
3196                 for (int try = 0;; try++) {
3197
3198                         if (try == 0) {
3199                                 /* Try "ramfs" first, since it's not swap backed */
3200                                 r = mount_nofollow_verbose(LOG_DEBUG, "ramfs", workspace, "ramfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, "mode=0700");
3201                                 if (r >= 0) {
3202                                         workspace_mounted = true;
3203                                         break;
3204                                 }
3205
3206                         } else if (try == 1) {
3207                                 _cleanup_free_ char *opts = NULL;
3208
3209                                 if (asprintf(&opts, "mode=0700,nr_inodes=1024,size=%zu", (size_t) CREDENTIALS_TOTAL_SIZE_MAX) < 0)
3210                                         return -ENOMEM;
3211
3212                                 /* Fall back to "tmpfs" otherwise */
3213                                 r = mount_nofollow_verbose(LOG_DEBUG, "tmpfs", workspace, "tmpfs", MS_NODEV|MS_NOEXEC|MS_NOSUID, opts);
3214                                 if (r >= 0) {
3215                                         workspace_mounted = true;
3216                                         break;
3217                                 }
3218
3219                         } else {
3220                                 /* If that didn't work, try to make a bind mount from the final to the workspace, so that we can make it writable there. */
3221                                 r = mount_nofollow_verbose(LOG_DEBUG, final, workspace, NULL, MS_BIND|MS_REC, NULL);
3222                                 if (r < 0) {
3223                                         if (!ERRNO_IS_PRIVILEGE(r)) /* Propagate anything that isn't a permission problem */
3224                                                 return r;
3225
3226                                         if (must_mount) /* If we it's not OK to use the plain directory
3227                                                          * fallback, propagate all errors too */
3228                                                 return r;
3229
3230                                         /* If we lack privileges to bind mount stuff, then let's gracefully
3231                                          * proceed for compat with container envs, and just use the final dir
3232                                          * as is. */
3233
3234                                         workspace_mounted = false;
3235                                         break;
3236                                 }
3237
3238                                 /* Make the new bind mount writable (i.e. drop MS_RDONLY) */
3239                                 r = mount_nofollow_verbose(LOG_DEBUG, NULL, workspace, NULL, MS_BIND|MS_REMOUNT|MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL);
3240                                 if (r < 0)
3241                                         return r;
3242
3243                                 workspace_mounted = true;
3244                                 break;
3245                         }
3246                 }
3247         }
3248
3249         assert(!must_mount || workspace_mounted > 0);
3250         where = workspace_mounted ? workspace : final;
3251
3252         (void) label_fix_full(AT_FDCWD, where, final, 0);
3253
3254         r = acquire_credentials(context, params, unit, where, uid, workspace_mounted);
3255         if (r < 0)
3256                 return r;
3257
3258         if (workspace_mounted) {
3259                 /* Make workspace read-only now, so that any bind mount we make from it defaults to read-only too */
3260                 r = mount_nofollow_verbose(LOG_DEBUG, NULL, workspace, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NODEV|MS_NOEXEC|MS_NOSUID, NULL);
3261                 if (r < 0)
3262                         return r;
3263
3264                 /* And mount it to the final place, read-only */
3265                 if (final_mounted)
3266                         r = umount_verbose(LOG_DEBUG, workspace, MNT_DETACH|UMOUNT_NOFOLLOW);
3267                 else
3268                         r = mount_nofollow_verbose(LOG_DEBUG, workspace, final, NULL, MS_MOVE, NULL);
3269                 if (r < 0)
3270                         return r;
3271         } else {
3272                 _cleanup_free_ char *parent = NULL;
3273
3274                 /* If we do not have our own mount put used the plain directory fallback, then we need to
3275                  * open access to the top-level credential directory and the per-service directory now */
3276
3277                 r = path_extract_directory(final, &parent);
3278                 if (r < 0)
3279                         return r;
3280                 if (chmod(parent, 0755) < 0)
3281                         return -errno;
3282         }
3283
3284         return 0;
3285 }
3286
3287 static int setup_credentials(
3288                 const ExecContext *context,
3289                 const ExecParameters *params,
3290                 const char *unit,
3291                 uid_t uid) {
3292
3293         _cleanup_free_ char *p = NULL, *q = NULL;
3294         int r;
3295
3296         assert(context);
3297         assert(params);
3298
3299         if (!exec_context_has_credentials(context))
3300                 return 0;
3301
3302         if (!params->prefix[EXEC_DIRECTORY_RUNTIME])
3303                 return -EINVAL;
3304
3305         /* This where we'll place stuff when we are done; this main credentials directory is world-readable,
3306          * and the subdir we mount over with a read-only file system readable by the service's user */
3307         q = path_join(params->prefix[EXEC_DIRECTORY_RUNTIME], "credentials");
3308         if (!q)
3309                 return -ENOMEM;
3310
3311         r = mkdir_label(q, 0755); /* top-level dir: world readable/searchable */
3312         if (r < 0 && r != -EEXIST)
3313                 return r;
3314
3315         p = path_join(q, unit);
3316         if (!p)
3317                 return -ENOMEM;
3318
3319         r = mkdir_label(p, 0700); /* per-unit dir: private to user */
3320         if (r < 0 && r != -EEXIST)
3321                 return r;
3322
3323         r = safe_fork("(sd-mkdcreds)", FORK_DEATHSIG|FORK_WAIT|FORK_NEW_MOUNTNS, NULL);
3324         if (r < 0) {
3325                 _cleanup_free_ char *t = NULL, *u = NULL;
3326
3327                 /* If this is not a privilege or support issue then propagate the error */
3328                 if (!ERRNO_IS_NOT_SUPPORTED(r) && !ERRNO_IS_PRIVILEGE(r))
3329                         return r;
3330
3331                 /* Temporary workspace, that remains inaccessible all the time. We prepare stuff there before moving
3332                  * it into place, so that users can't access half-initialized credential stores. */
3333                 t = path_join(params->prefix[EXEC_DIRECTORY_RUNTIME], "systemd/temporary-credentials");
3334                 if (!t)
3335                         return -ENOMEM;
3336
3337                 /* We can't set up a mount namespace. In that case operate on a fixed, inaccessible per-unit
3338                  * directory outside of /run/credentials/ first, and then move it over to /run/credentials/
3339                  * after it is fully set up */
3340                 u = path_join(t, unit);
3341                 if (!u)
3342                         return -ENOMEM;
3343
3344                 FOREACH_STRING(i, t, u) {
3345                         r = mkdir_label(i, 0700);
3346                         if (r < 0 && r != -EEXIST)
3347                                 return r;
3348                 }
3349
3350                 r = setup_credentials_internal(
3351                                 context,
3352                                 params,
3353                                 unit,
3354                                 p,       /* final mount point */
3355                                 u,       /* temporary workspace to overmount */
3356                                 true,    /* reuse the workspace if it is already a mount */
3357                                 false,   /* it's OK to fall back to a plain directory if we can't mount anything */
3358                                 uid);
3359
3360                 (void) rmdir(u); /* remove the workspace again if we can. */
3361
3362                 if (r < 0)
3363                         return r;
3364
3365         } else if (r == 0) {
3366
3367                 /* We managed to set up a mount namespace, and are now in a child. That's great. In this case
3368                  * we can use the same directory for all cases, after turning off propagation. Question
3369                  * though is: where do we turn off propagation exactly, and where do we place the workspace
3370                  * directory? We need some place that is guaranteed to be a mount point in the host, and
3371                  * which is guaranteed to have a subdir we can mount over. /run/ is not suitable for this,
3372                  * since we ultimately want to move the resulting file system there, i.e. we need propagation
3373                  * for /run/ eventually. We could use our own /run/systemd/bind mount on itself, but that
3374                  * would be visible in the host mount table all the time, which we want to avoid. Hence, what
3375                  * we do here instead we use /dev/ and /dev/shm/ for our purposes. We know for sure that
3376                  * /dev/ is a mount point and we now for sure that /dev/shm/ exists. Hence we can turn off
3377                  * propagation on the former, and then overmount the latter.
3378                  *
3379                  * Yes it's nasty playing games with /dev/ and /dev/shm/ like this, since it does not exist
3380                  * for this purpose, but there are few other candidates that work equally well for us, and
3381                  * given that the we do this in a privately namespaced short-lived single-threaded process
3382                  * that no one else sees this should be OK to do. */
3383
3384                 r = mount_nofollow_verbose(LOG_DEBUG, NULL, "/dev", NULL, MS_SLAVE|MS_REC, NULL); /* Turn off propagation from our namespace to host */
3385                 if (r < 0)
3386                         goto child_fail;
3387
3388                 r = setup_credentials_internal(
3389                                 context,
3390                                 params,
3391                                 unit,
3392                                 p,           /* final mount point */
3393                                 "/dev/shm",  /* temporary workspace to overmount */
3394                                 false,       /* do not reuse /dev/shm if it is already a mount, under no circumstances */
3395                                 true,        /* insist that something is mounted, do not allow fallback to plain directory */
3396                                 uid);
3397                 if (r < 0)
3398                         goto child_fail;
3399
3400                 _exit(EXIT_SUCCESS);
3401
3402         child_fail:
3403                 _exit(EXIT_FAILURE);
3404         }
3405
3406         return 0;
3407 }
3408
3409 #if ENABLE_SMACK
3410 static int setup_smack(
3411                 const Manager *manager,
3412                 const ExecContext *context,
3413                 int executable_fd) {
3414         int r;
3415
3416         assert(context);
3417         assert(executable_fd >= 0);
3418
3419         if (context->smack_process_label) {
3420                 r = mac_smack_apply_pid(0, context->smack_process_label);
3421                 if (r < 0)
3422                         return r;
3423         } else if (manager->default_smack_process_label) {
3424                 _cleanup_free_ char *exec_label = NULL;
3425
3426                 r = mac_smack_read_fd(executable_fd, SMACK_ATTR_EXEC, &exec_label);
3427                 if (r < 0 && !ERRNO_IS_XATTR_ABSENT(r))
3428                         return r;
3429
3430                 r = mac_smack_apply_pid(0, exec_label ?: manager->default_smack_process_label);
3431                 if (r < 0)
3432                         return r;
3433         }
3434
3435         return 0;
3436 }
3437 #endif
3438
3439 static int compile_bind_mounts(
3440                 const ExecContext *context,
3441                 const ExecParameters *params,
3442                 BindMount **ret_bind_mounts,
3443                 size_t *ret_n_bind_mounts,
3444                 char ***ret_empty_directories) {
3445
3446         _cleanup_strv_free_ char **empty_directories = NULL;
3447         BindMount *bind_mounts;
3448         size_t n, h = 0;
3449         int r;
3450
3451         assert(context);
3452         assert(params);
3453         assert(ret_bind_mounts);
3454         assert(ret_n_bind_mounts);
3455         assert(ret_empty_directories);
3456
3457         n = context->n_bind_mounts;
3458         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
3459                 if (!params->prefix[t])
3460                         continue;
3461
3462                 for (size_t i = 0; i < context->directories[t].n_items; i++)
3463                         n += !context->directories[t].items[i].only_create;
3464         }
3465
3466         if (n <= 0) {
3467                 *ret_bind_mounts = NULL;
3468                 *ret_n_bind_mounts = 0;
3469                 *ret_empty_directories = NULL;
3470                 return 0;
3471         }
3472
3473         bind_mounts = new(BindMount, n);
3474         if (!bind_mounts)
3475                 return -ENOMEM;
3476
3477         for (size_t i = 0; i < context->n_bind_mounts; i++) {
3478                 BindMount *item = context->bind_mounts + i;
3479                 char *s, *d;
3480
3481                 s = strdup(item->source);
3482                 if (!s) {
3483                         r = -ENOMEM;
3484                         goto finish;
3485                 }
3486
3487                 d = strdup(item->destination);
3488                 if (!d) {
3489                         free(s);
3490                         r = -ENOMEM;
3491                         goto finish;
3492                 }
3493
3494                 bind_mounts[h++] = (BindMount) {
3495                         .source = s,
3496                         .destination = d,
3497                         .read_only = item->read_only,
3498                         .recursive = item->recursive,
3499                         .ignore_enoent = item->ignore_enoent,
3500                 };
3501         }
3502
3503         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
3504                 if (!params->prefix[t])
3505                         continue;
3506
3507                 if (context->directories[t].n_items == 0)
3508                         continue;
3509
3510                 if (exec_directory_is_private(context, t) &&
3511                     !exec_context_with_rootfs(context)) {
3512                         char *private_root;
3513
3514                         /* So this is for a dynamic user, and we need to make sure the process can access its own
3515                          * directory. For that we overmount the usually inaccessible "private" subdirectory with a
3516                          * tmpfs that makes it accessible and is empty except for the submounts we do this for. */
3517
3518                         private_root = path_join(params->prefix[t], "private");
3519                         if (!private_root) {
3520                                 r = -ENOMEM;
3521                                 goto finish;
3522                         }
3523
3524                         r = strv_consume(&empty_directories, private_root);
3525                         if (r < 0)
3526                                 goto finish;
3527                 }
3528
3529                 for (size_t i = 0; i < context->directories[t].n_items; i++) {
3530                         char *s, *d;
3531
3532                         /* When one of the parent directories is in the list, we cannot create the symlink
3533                          * for the child directory. See also the comments in setup_exec_directory(). */
3534                         if (context->directories[t].items[i].only_create)
3535                                 continue;
3536
3537                         if (exec_directory_is_private(context, t))
3538                                 s = path_join(params->prefix[t], "private", context->directories[t].items[i].path);
3539                         else
3540                                 s = path_join(params->prefix[t], context->directories[t].items[i].path);
3541                         if (!s) {
3542                                 r = -ENOMEM;
3543                                 goto finish;
3544                         }
3545
3546                         if (exec_directory_is_private(context, t) &&
3547                             exec_context_with_rootfs(context))
3548                                 /* When RootDirectory= or RootImage= are set, then the symbolic link to the private
3549                                  * directory is not created on the root directory. So, let's bind-mount the directory
3550                                  * on the 'non-private' place. */
3551                                 d = path_join(params->prefix[t], context->directories[t].items[i].path);
3552                         else
3553                                 d = strdup(s);
3554                         if (!d) {
3555                                 free(s);
3556                                 r = -ENOMEM;
3557                                 goto finish;
3558                         }
3559
3560                         bind_mounts[h++] = (BindMount) {
3561                                 .source = s,
3562                                 .destination = d,
3563                                 .read_only = false,
3564                                 .nosuid = context->dynamic_user, /* don't allow suid/sgid when DynamicUser= is on */
3565                                 .recursive = true,
3566                                 .ignore_enoent = false,
3567                         };
3568                 }
3569         }
3570
3571         assert(h == n);
3572
3573         *ret_bind_mounts = bind_mounts;
3574         *ret_n_bind_mounts = n;
3575         *ret_empty_directories = TAKE_PTR(empty_directories);
3576
3577         return (int) n;
3578
3579 finish:
3580         bind_mount_free_many(bind_mounts, h);
3581         return r;
3582 }
3583
3584 /* ret_symlinks will contain a list of pairs src:dest that describes
3585  * the symlinks to create later on. For example, the symlinks needed
3586  * to safely give private directories to DynamicUser=1 users. */
3587 static int compile_symlinks(
3588                 const ExecContext *context,
3589                 const ExecParameters *params,
3590                 char ***ret_symlinks) {
3591
3592         _cleanup_strv_free_ char **symlinks = NULL;
3593         int r;
3594
3595         assert(context);
3596         assert(params);
3597         assert(ret_symlinks);
3598
3599         for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
3600                 for (size_t i = 0; i < context->directories[dt].n_items; i++) {
3601                         _cleanup_free_ char *private_path = NULL, *path = NULL;
3602
3603                         STRV_FOREACH(symlink, context->directories[dt].items[i].symlinks) {
3604                                 _cleanup_free_ char *src_abs = NULL, *dst_abs = NULL;
3605
3606                                 src_abs = path_join(params->prefix[dt], context->directories[dt].items[i].path);
3607                                 dst_abs = path_join(params->prefix[dt], *symlink);
3608                                 if (!src_abs || !dst_abs)
3609                                         return -ENOMEM;
3610
3611                                 r = strv_consume_pair(&symlinks, TAKE_PTR(src_abs), TAKE_PTR(dst_abs));
3612                                 if (r < 0)
3613                                         return r;
3614                         }
3615
3616                         if (!exec_directory_is_private(context, dt) ||
3617                             exec_context_with_rootfs(context) ||
3618                             context->directories[dt].items[i].only_create)
3619                                 continue;
3620
3621                         private_path = path_join(params->prefix[dt], "private", context->directories[dt].items[i].path);
3622                         if (!private_path)
3623                                 return -ENOMEM;
3624
3625                         path = path_join(params->prefix[dt], context->directories[dt].items[i].path);
3626                         if (!path)
3627                                 return -ENOMEM;
3628
3629                         r = strv_consume_pair(&symlinks, TAKE_PTR(private_path), TAKE_PTR(path));
3630                         if (r < 0)
3631                                 return r;
3632                 }
3633         }
3634
3635         *ret_symlinks = TAKE_PTR(symlinks);
3636
3637         return 0;
3638 }
3639
3640 static bool insist_on_sandboxing(
3641                 const ExecContext *context,
3642                 const char *root_dir,
3643                 const char *root_image,
3644                 const BindMount *bind_mounts,
3645                 size_t n_bind_mounts) {
3646
3647         assert(context);
3648         assert(n_bind_mounts == 0 || bind_mounts);
3649
3650         /* Checks whether we need to insist on fs namespacing. i.e. whether we have settings configured that
3651          * would alter the view on the file system beyond making things read-only or invisible, i.e. would
3652          * rearrange stuff in a way we cannot ignore gracefully. */
3653
3654         if (context->n_temporary_filesystems > 0)
3655                 return true;
3656
3657         if (root_dir || root_image)
3658                 return true;
3659
3660         if (context->n_mount_images > 0)
3661                 return true;
3662
3663         if (context->dynamic_user)
3664                 return true;
3665
3666         if (context->n_extension_images > 0 || !strv_isempty(context->extension_directories))
3667                 return true;
3668
3669         /* If there are any bind mounts set that don't map back onto themselves, fs namespacing becomes
3670          * essential. */
3671         for (size_t i = 0; i < n_bind_mounts; i++)
3672                 if (!path_equal(bind_mounts[i].source, bind_mounts[i].destination))
3673                         return true;
3674
3675         if (context->log_namespace)
3676                 return true;
3677
3678         return false;
3679 }
3680
3681 static int apply_mount_namespace(
3682                 const Unit *u,
3683                 ExecCommandFlags command_flags,
3684                 const ExecContext *context,
3685                 const ExecParameters *params,
3686                 const ExecSharedRuntime *runtime,
3687                 const char *memory_pressure_path,
3688                 char **error_path) {
3689
3690         _cleanup_strv_free_ char **empty_directories = NULL, **symlinks = NULL,
3691                         **read_write_paths_cleanup = NULL;
3692         const char *tmp_dir = NULL, *var_tmp_dir = NULL;
3693         const char *root_dir = NULL, *root_image = NULL;
3694         _cleanup_free_ char *creds_path = NULL, *incoming_dir = NULL, *propagate_dir = NULL,
3695                         *extension_dir = NULL;
3696         char **read_write_paths;
3697         NamespaceInfo ns_info;
3698         bool needs_sandboxing;
3699         BindMount *bind_mounts = NULL;
3700         size_t n_bind_mounts = 0;
3701         int r;
3702
3703         assert(context);
3704
3705         if (params->flags & EXEC_APPLY_CHROOT) {
3706                 root_image = context->root_image;
3707
3708                 if (!root_image)
3709                         root_dir = context->root_directory;
3710         }
3711
3712         r = compile_bind_mounts(context, params, &bind_mounts, &n_bind_mounts, &empty_directories);
3713         if (r < 0)
3714                 return r;
3715
3716         /* Symlinks for exec dirs are set up after other mounts, before they are made read-only. */
3717         r = compile_symlinks(context, params, &symlinks);
3718         if (r < 0)
3719                 goto finalize;
3720
3721         /* We need to make the pressure path writable even if /sys/fs/cgroups is made read-only, as the
3722          * service will need to write to it in order to start the notifications. */
3723         if (context->protect_control_groups && memory_pressure_path && !streq(memory_pressure_path, "/dev/null")) {
3724                 read_write_paths_cleanup = strv_copy(context->read_write_paths);
3725                 if (!read_write_paths_cleanup) {
3726                         r = -ENOMEM;
3727                         goto finalize;
3728                 }
3729
3730                 r = strv_extend(&read_write_paths_cleanup, memory_pressure_path);
3731                 if (r < 0)
3732                         goto finalize;
3733
3734                 read_write_paths = read_write_paths_cleanup;
3735         } else
3736                 read_write_paths = context->read_write_paths;
3737
3738         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command_flags & EXEC_COMMAND_FULLY_PRIVILEGED);
3739         if (needs_sandboxing) {
3740                 /* The runtime struct only contains the parent of the private /tmp,
3741                  * which is non-accessible to world users. Inside of it there's a /tmp
3742                  * that is sticky, and that's the one we want to use here.
3743                  * This does not apply when we are using /run/systemd/empty as fallback. */
3744
3745                 if (context->private_tmp && runtime) {
3746                         if (streq_ptr(runtime->tmp_dir, RUN_SYSTEMD_EMPTY))
3747                                 tmp_dir = runtime->tmp_dir;
3748                         else if (runtime->tmp_dir)
3749                                 tmp_dir = strjoina(runtime->tmp_dir, "/tmp");
3750
3751                         if (streq_ptr(runtime->var_tmp_dir, RUN_SYSTEMD_EMPTY))
3752                                 var_tmp_dir = runtime->var_tmp_dir;
3753                         else if (runtime->var_tmp_dir)
3754                                 var_tmp_dir = strjoina(runtime->var_tmp_dir, "/tmp");
3755                 }
3756
3757                 ns_info = (NamespaceInfo) {
3758                         .ignore_protect_paths = false,
3759                         .private_dev = context->private_devices,
3760                         .protect_control_groups = context->protect_control_groups,
3761                         .protect_kernel_tunables = context->protect_kernel_tunables,
3762                         .protect_kernel_modules = context->protect_kernel_modules,
3763                         .protect_kernel_logs = context->protect_kernel_logs,
3764                         .protect_hostname = context->protect_hostname,
3765                         .mount_apivfs = exec_context_get_effective_mount_apivfs(context),
3766                         .protect_home = context->protect_home,
3767                         .protect_system = context->protect_system,
3768                         .protect_proc = context->protect_proc,
3769                         .proc_subset = context->proc_subset,
3770                         .private_network = exec_needs_network_namespace(context),
3771                         .private_ipc = exec_needs_ipc_namespace(context),
3772                         /* If NNP is on, we can turn on MS_NOSUID, since it won't have any effect anymore. */
3773                         .mount_nosuid = context->no_new_privileges && !mac_selinux_use(),
3774                 };
3775         } else if (!context->dynamic_user && root_dir)
3776                 /*
3777                  * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed
3778                  * sandbox info, otherwise enforce it, don't ignore protected paths and
3779                  * fail if we are enable to apply the sandbox inside the mount namespace.
3780                  */
3781                 ns_info = (NamespaceInfo) {
3782                         .ignore_protect_paths = true,
3783                 };
3784         else
3785                 ns_info = (NamespaceInfo) {};
3786
3787         if (context->mount_propagation_flag == MS_SHARED)
3788                 log_unit_debug(u, "shared mount propagation hidden by other fs namespacing unit settings: ignoring");
3789
3790         if (exec_context_has_credentials(context) &&
3791             params->prefix[EXEC_DIRECTORY_RUNTIME] &&
3792             FLAGS_SET(params->flags, EXEC_WRITE_CREDENTIALS)) {
3793                 creds_path = path_join(params->prefix[EXEC_DIRECTORY_RUNTIME], "credentials", u->id);
3794                 if (!creds_path) {
3795                         r = -ENOMEM;
3796                         goto finalize;
3797                 }
3798         }
3799
3800         if (MANAGER_IS_SYSTEM(u->manager)) {
3801                 propagate_dir = path_join("/run/systemd/propagate/", u->id);
3802                 if (!propagate_dir) {
3803                         r = -ENOMEM;
3804                         goto finalize;
3805                 }
3806
3807                 incoming_dir = strdup("/run/systemd/incoming");
3808                 if (!incoming_dir) {
3809                         r = -ENOMEM;
3810                         goto finalize;
3811                 }
3812
3813                 extension_dir = strdup("/run/systemd/unit-extensions");
3814                 if (!extension_dir) {
3815                         r = -ENOMEM;
3816                         goto finalize;
3817                 }
3818         } else
3819                 if (asprintf(&extension_dir, "/run/user/" UID_FMT "/systemd/unit-extensions", geteuid()) < 0) {
3820                         r = -ENOMEM;
3821                         goto finalize;
3822                 }
3823
3824         r = setup_namespace(root_dir, root_image, context->root_image_options,
3825                             &ns_info, read_write_paths,
3826                             needs_sandboxing ? context->read_only_paths : NULL,
3827                             needs_sandboxing ? context->inaccessible_paths : NULL,
3828                             needs_sandboxing ? context->exec_paths : NULL,
3829                             needs_sandboxing ? context->no_exec_paths : NULL,
3830                             empty_directories,
3831                             symlinks,
3832                             bind_mounts,
3833                             n_bind_mounts,
3834                             context->temporary_filesystems,
3835                             context->n_temporary_filesystems,
3836                             context->mount_images,
3837                             context->n_mount_images,
3838                             tmp_dir,
3839                             var_tmp_dir,
3840                             creds_path,
3841                             context->log_namespace,
3842                             context->mount_propagation_flag,
3843                             context->root_hash, context->root_hash_size, context->root_hash_path,
3844                             context->root_hash_sig, context->root_hash_sig_size, context->root_hash_sig_path,
3845                             context->root_verity,
3846                             context->extension_images,
3847                             context->n_extension_images,
3848                             context->extension_directories,
3849                             propagate_dir,
3850                             incoming_dir,
3851                             extension_dir,
3852                             root_dir || root_image ? params->notify_socket : NULL,
3853                             error_path);
3854
3855         /* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports
3856          * that with a special, recognizable error ENOANO. In this case, silently proceed, but only if exclusively
3857          * sandboxing options were used, i.e. nothing such as RootDirectory= or BindMount= that would result in a
3858          * completely different execution environment. */
3859         if (r == -ENOANO) {
3860                 if (insist_on_sandboxing(
3861                                     context,
3862                                     root_dir, root_image,
3863                                     bind_mounts,
3864                                     n_bind_mounts)) {
3865                         log_unit_debug(u, "Failed to set up namespace, and refusing to continue since the selected namespacing options alter mount environment non-trivially.\n"
3866                                        "Bind mounts: %zu, temporary filesystems: %zu, root directory: %s, root image: %s, dynamic user: %s",
3867                                        n_bind_mounts, context->n_temporary_filesystems, yes_no(root_dir), yes_no(root_image), yes_no(context->dynamic_user));
3868
3869                         r = -EOPNOTSUPP;
3870                 } else {
3871                         log_unit_debug(u, "Failed to set up namespace, assuming containerized execution and ignoring.");
3872                         r = 0;
3873                 }
3874         }
3875
3876 finalize:
3877         bind_mount_free_many(bind_mounts, n_bind_mounts);
3878         return r;
3879 }
3880
3881 static int apply_working_directory(
3882                 const ExecContext *context,
3883                 const ExecParameters *params,
3884                 const char *home,
3885                 int *exit_status) {
3886
3887         const char *d, *wd;
3888
3889         assert(context);
3890         assert(exit_status);
3891
3892         if (context->working_directory_home) {
3893
3894                 if (!home) {
3895                         *exit_status = EXIT_CHDIR;
3896                         return -ENXIO;
3897                 }
3898
3899                 wd = home;
3900
3901         } else
3902                 wd = empty_to_root(context->working_directory);
3903
3904         if (params->flags & EXEC_APPLY_CHROOT)
3905                 d = wd;
3906         else
3907                 d = prefix_roota(context->root_directory, wd);
3908
3909         if (chdir(d) < 0 && !context->working_directory_missing_ok) {
3910                 *exit_status = EXIT_CHDIR;
3911                 return -errno;
3912         }
3913
3914         return 0;
3915 }
3916
3917 static int apply_root_directory(
3918                 const ExecContext *context,
3919                 const ExecParameters *params,
3920                 const bool needs_mount_ns,
3921                 int *exit_status) {
3922
3923         assert(context);
3924         assert(exit_status);
3925
3926         if (params->flags & EXEC_APPLY_CHROOT)
3927                 if (!needs_mount_ns && context->root_directory)
3928                         if (chroot(context->root_directory) < 0) {
3929                                 *exit_status = EXIT_CHROOT;
3930                                 return -errno;
3931                         }
3932
3933         return 0;
3934 }
3935
3936 static int setup_keyring(
3937                 const Unit *u,
3938                 const ExecContext *context,
3939                 const ExecParameters *p,
3940                 uid_t uid, gid_t gid) {
3941
3942         key_serial_t keyring;
3943         int r = 0;
3944         uid_t saved_uid;
3945         gid_t saved_gid;
3946
3947         assert(u);
3948         assert(context);
3949         assert(p);
3950
3951         /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that
3952          * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond
3953          * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be
3954          * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in
3955          * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where
3956          * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */
3957
3958         if (context->keyring_mode == EXEC_KEYRING_INHERIT)
3959                 return 0;
3960
3961         /* Acquiring a reference to the user keyring is nasty. We briefly change identity in order to get things set up
3962          * properly by the kernel. If we don't do that then we can't create it atomically, and that sucks for parallel
3963          * execution. This mimics what pam_keyinit does, too. Setting up session keyring, to be owned by the right user
3964          * & group is just as nasty as acquiring a reference to the user keyring. */
3965
3966         saved_uid = getuid();
3967         saved_gid = getgid();
3968
3969         if (gid_is_valid(gid) && gid != saved_gid) {
3970                 if (setregid(gid, -1) < 0)
3971                         return log_unit_error_errno(u, errno, "Failed to change GID for user keyring: %m");
3972         }
3973
3974         if (uid_is_valid(uid) && uid != saved_uid) {
3975                 if (setreuid(uid, -1) < 0) {
3976                         r = log_unit_error_errno(u, errno, "Failed to change UID for user keyring: %m");
3977                         goto out;
3978                 }
3979         }
3980
3981         keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
3982         if (keyring == -1) {
3983                 if (errno == ENOSYS)
3984                         log_unit_debug_errno(u, errno, "Kernel keyring not supported, ignoring.");
3985                 else if (ERRNO_IS_PRIVILEGE(errno))
3986                         log_unit_debug_errno(u, errno, "Kernel keyring access prohibited, ignoring.");
3987                 else if (errno == EDQUOT)
3988                         log_unit_debug_errno(u, errno, "Out of kernel keyrings to allocate, ignoring.");
3989                 else
3990                         r = log_unit_error_errno(u, errno, "Setting up kernel keyring failed: %m");
3991
3992                 goto out;
3993         }
3994
3995         /* When requested link the user keyring into the session keyring. */
3996         if (context->keyring_mode == EXEC_KEYRING_SHARED) {
3997
3998                 if (keyctl(KEYCTL_LINK,
3999                            KEY_SPEC_USER_KEYRING,
4000                            KEY_SPEC_SESSION_KEYRING, 0, 0) < 0) {
4001                         r = log_unit_error_errno(u, errno, "Failed to link user keyring into session keyring: %m");
4002                         goto out;
4003                 }
4004         }
4005
4006         /* Restore uid/gid back */
4007         if (uid_is_valid(uid) && uid != saved_uid) {
4008                 if (setreuid(saved_uid, -1) < 0) {
4009                         r = log_unit_error_errno(u, errno, "Failed to change UID back for user keyring: %m");
4010                         goto out;
4011                 }
4012         }
4013
4014         if (gid_is_valid(gid) && gid != saved_gid) {
4015                 if (setregid(saved_gid, -1) < 0)
4016                         return log_unit_error_errno(u, errno, "Failed to change GID back for user keyring: %m");
4017         }
4018
4019         /* Populate they keyring with the invocation ID by default, as original saved_uid. */
4020         if (!sd_id128_is_null(u->invocation_id)) {
4021                 key_serial_t key;
4022
4023                 key = add_key("user", "invocation_id", &u->invocation_id, sizeof(u->invocation_id), KEY_SPEC_SESSION_KEYRING);
4024                 if (key == -1)
4025                         log_unit_debug_errno(u, errno, "Failed to add invocation ID to keyring, ignoring: %m");
4026                 else {
4027                         if (keyctl(KEYCTL_SETPERM, key,
4028                                    KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH|
4029                                    KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0)
4030                                 r = log_unit_error_errno(u, errno, "Failed to restrict invocation ID permission: %m");
4031                 }
4032         }
4033
4034 out:
4035         /* Revert back uid & gid for the last time, and exit */
4036         /* no extra logging, as only the first already reported error matters */
4037         if (getuid() != saved_uid)
4038                 (void) setreuid(saved_uid, -1);
4039
4040         if (getgid() != saved_gid)
4041                 (void) setregid(saved_gid, -1);
4042
4043         return r;
4044 }
4045
4046 static void append_socket_pair(int *array, size_t *n, const int pair[static 2]) {
4047         assert(array);
4048         assert(n);
4049         assert(pair);
4050
4051         if (pair[0] >= 0)
4052                 array[(*n)++] = pair[0];
4053         if (pair[1] >= 0)
4054                 array[(*n)++] = pair[1];
4055 }
4056
4057 static int close_remaining_fds(
4058                 const ExecParameters *params,
4059                 const ExecSharedRuntime *runtime,
4060                 const DynamicCreds *dcreds,
4061                 int user_lookup_fd,
4062                 int socket_fd,
4063                 const int *fds, size_t n_fds) {
4064
4065         size_t n_dont_close = 0;
4066         int dont_close[n_fds + 12];
4067
4068         assert(params);
4069
4070         if (params->stdin_fd >= 0)
4071                 dont_close[n_dont_close++] = params->stdin_fd;
4072         if (params->stdout_fd >= 0)
4073                 dont_close[n_dont_close++] = params->stdout_fd;
4074         if (params->stderr_fd >= 0)
4075                 dont_close[n_dont_close++] = params->stderr_fd;
4076
4077         if (socket_fd >= 0)
4078                 dont_close[n_dont_close++] = socket_fd;
4079         if (n_fds > 0) {
4080                 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
4081                 n_dont_close += n_fds;
4082         }
4083
4084         if (runtime) {
4085                 append_socket_pair(dont_close, &n_dont_close, runtime->netns_storage_socket);
4086                 append_socket_pair(dont_close, &n_dont_close, runtime->ipcns_storage_socket);
4087         }
4088
4089         if (dcreds) {
4090                 if (dcreds->user)
4091                         append_socket_pair(dont_close, &n_dont_close, dcreds->user->storage_socket);
4092                 if (dcreds->group)
4093                         append_socket_pair(dont_close, &n_dont_close, dcreds->group->storage_socket);
4094         }
4095
4096         if (user_lookup_fd >= 0)
4097                 dont_close[n_dont_close++] = user_lookup_fd;
4098
4099         return close_all_fds(dont_close, n_dont_close);
4100 }
4101
4102 static int send_user_lookup(
4103                 Unit *unit,
4104                 int user_lookup_fd,
4105                 uid_t uid,
4106                 gid_t gid) {
4107
4108         assert(unit);
4109
4110         /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
4111          * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
4112          * specified. */
4113
4114         if (user_lookup_fd < 0)
4115                 return 0;
4116
4117         if (!uid_is_valid(uid) && !gid_is_valid(gid))
4118                 return 0;
4119
4120         if (writev(user_lookup_fd,
4121                (struct iovec[]) {
4122                            IOVEC_MAKE(&uid, sizeof(uid)),
4123                            IOVEC_MAKE(&gid, sizeof(gid)),
4124                            IOVEC_MAKE_STRING(unit->id) }, 3) < 0)
4125                 return -errno;
4126
4127         return 0;
4128 }
4129
4130 static int acquire_home(const ExecContext *c, uid_t uid, const char** home, char **buf) {
4131         int r;
4132
4133         assert(c);
4134         assert(home);
4135         assert(buf);
4136
4137         /* If WorkingDirectory=~ is set, try to acquire a usable home directory. */
4138
4139         if (*home)
4140                 return 0;
4141
4142         if (!c->working_directory_home)
4143                 return 0;
4144
4145         r = get_home_dir(buf);
4146         if (r < 0)
4147                 return r;
4148
4149         *home = *buf;
4150         return 1;
4151 }
4152
4153 static int compile_suggested_paths(const ExecContext *c, const ExecParameters *p, char ***ret) {
4154         _cleanup_strv_free_ char ** list = NULL;
4155         int r;
4156
4157         assert(c);
4158         assert(p);
4159         assert(ret);
4160
4161         assert(c->dynamic_user);
4162
4163         /* Compile a list of paths that it might make sense to read the owning UID from to use as initial candidate for
4164          * dynamic UID allocation, in order to save us from doing costly recursive chown()s of the special
4165          * directories. */
4166
4167         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
4168                 if (t == EXEC_DIRECTORY_CONFIGURATION)
4169                         continue;
4170
4171                 if (!p->prefix[t])
4172                         continue;
4173
4174                 for (size_t i = 0; i < c->directories[t].n_items; i++) {
4175                         char *e;
4176
4177                         if (exec_directory_is_private(c, t))
4178                                 e = path_join(p->prefix[t], "private", c->directories[t].items[i].path);
4179                         else
4180                                 e = path_join(p->prefix[t], c->directories[t].items[i].path);
4181                         if (!e)
4182                                 return -ENOMEM;
4183
4184                         r = strv_consume(&list, e);
4185                         if (r < 0)
4186                                 return r;
4187                 }
4188         }
4189
4190         *ret = TAKE_PTR(list);
4191
4192         return 0;
4193 }
4194
4195 static int exec_parameters_get_cgroup_path(const ExecParameters *params, char **ret) {
4196         bool using_subcgroup;
4197         char *p;
4198
4199         assert(params);
4200         assert(ret);
4201
4202         if (!params->cgroup_path)
4203                 return -EINVAL;
4204
4205         /* If we are called for a unit where cgroup delegation is on, and the payload created its own populated
4206          * subcgroup (which we expect it to do, after all it asked for delegation), then we cannot place the control
4207          * processes started after the main unit's process in the unit's main cgroup because it is now an inner one,
4208          * and inner cgroups may not contain processes. Hence, if delegation is on, and this is a control process,
4209          * let's use ".control" as subcgroup instead. Note that we do so only for ExecStartPost=, ExecReload=,
4210          * ExecStop=, ExecStopPost=, i.e. for the commands where the main process is already forked. For ExecStartPre=
4211          * this is not necessary, the cgroup is still empty. We distinguish these cases with the EXEC_CONTROL_CGROUP
4212          * flag, which is only passed for the former statements, not for the latter. */
4213
4214         using_subcgroup = FLAGS_SET(params->flags, EXEC_CONTROL_CGROUP|EXEC_CGROUP_DELEGATE|EXEC_IS_CONTROL);
4215         if (using_subcgroup)
4216                 p = path_join(params->cgroup_path, ".control");
4217         else
4218                 p = strdup(params->cgroup_path);
4219         if (!p)
4220                 return -ENOMEM;
4221
4222         *ret = p;
4223         return using_subcgroup;
4224 }
4225
4226 static int exec_context_cpu_affinity_from_numa(const ExecContext *c, CPUSet *ret) {
4227         _cleanup_(cpu_set_reset) CPUSet s = {};
4228         int r;
4229
4230         assert(c);
4231         assert(ret);
4232
4233         if (!c->numa_policy.nodes.set) {
4234                 log_debug("Can't derive CPU affinity mask from NUMA mask because NUMA mask is not set, ignoring");
4235                 return 0;
4236         }
4237
4238         r = numa_to_cpu_set(&c->numa_policy, &s);
4239         if (r < 0)
4240                 return r;
4241
4242         cpu_set_reset(ret);
4243
4244         return cpu_set_add_all(ret, &s);
4245 }
4246
4247 bool exec_context_get_cpu_affinity_from_numa(const ExecContext *c) {
4248         assert(c);
4249
4250         return c->cpu_affinity_from_numa;
4251 }
4252
4253 static int add_shifted_fd(int *fds, size_t fds_size, size_t *n_fds, int fd, int *ret_fd) {
4254         int r;
4255
4256         assert(fds);
4257         assert(n_fds);
4258         assert(*n_fds < fds_size);
4259         assert(ret_fd);
4260
4261         if (fd < 0) {
4262                 *ret_fd = -EBADF;
4263                 return 0;
4264         }
4265
4266         if (fd < 3 + (int) *n_fds) {
4267                 /* Let's move the fd up, so that it's outside of the fd range we will use to store
4268                  * the fds we pass to the process (or which are closed only during execve). */
4269
4270                 r = fcntl(fd, F_DUPFD_CLOEXEC, 3 + (int) *n_fds);
4271                 if (r < 0)
4272                         return -errno;
4273
4274                 close_and_replace(fd, r);
4275         }
4276
4277         *ret_fd = fds[*n_fds] = fd;
4278         (*n_fds) ++;
4279         return 1;
4280 }
4281
4282 static int connect_unix_harder(Unit *u, const OpenFile *of, int ofd) {
4283         union sockaddr_union addr = {
4284                 .un.sun_family = AF_UNIX,
4285         };
4286         socklen_t sa_len;
4287         static const int socket_types[] = { SOCK_DGRAM, SOCK_STREAM, SOCK_SEQPACKET };
4288         int r;
4289
4290         assert(u);
4291         assert(of);
4292         assert(ofd >= 0);
4293
4294         r = sockaddr_un_set_path(&addr.un, FORMAT_PROC_FD_PATH(ofd));
4295         if (r < 0)
4296                 return log_unit_error_errno(u, r, "Failed to set sockaddr for %s: %m", of->path);
4297
4298         sa_len = r;
4299
4300         for (size_t i = 0; i < ELEMENTSOF(socket_types); i++) {
4301                 _cleanup_close_ int fd = -EBADF;
4302
4303                 fd = socket(AF_UNIX, socket_types[i] | SOCK_CLOEXEC, 0);
4304                 if (fd < 0)
4305                         return log_unit_error_errno(u, errno, "Failed to create socket for %s: %m", of->path);
4306
4307                 r = RET_NERRNO(connect(fd, &addr.sa, sa_len));
4308                 if (r == -EPROTOTYPE)
4309                         continue;
4310                 if (r < 0)
4311                         return log_unit_error_errno(u, r, "Failed to connect socket for %s: %m", of->path);
4312
4313                 return TAKE_FD(fd);
4314         }
4315
4316         return log_unit_error_errno(u, SYNTHETIC_ERRNO(EPROTOTYPE), "Failed to connect socket for \"%s\".", of->path);
4317 }
4318
4319 static int get_open_file_fd(Unit *u, const OpenFile *of) {
4320         struct stat st;
4321         _cleanup_close_ int fd = -EBADF, ofd = -EBADF;
4322
4323         assert(u);
4324         assert(of);
4325
4326         ofd = open(of->path, O_PATH | O_CLOEXEC);
4327         if (ofd < 0)
4328                 return log_unit_error_errno(u, errno, "Could not open \"%s\": %m", of->path);
4329
4330         if (fstat(ofd, &st) < 0)
4331                 return log_unit_error_errno(u, errno, "Failed to stat %s: %m", of->path);
4332
4333         if (S_ISSOCK(st.st_mode)) {
4334                 fd = connect_unix_harder(u, of, ofd);
4335                 if (fd < 0)
4336                         return fd;
4337
4338                 if (FLAGS_SET(of->flags, OPENFILE_READ_ONLY) && shutdown(fd, SHUT_WR) < 0)
4339                         return log_unit_error_errno(u, errno, "Failed to shutdown send for socket %s: %m",
4340                                                     of->path);
4341
4342                 log_unit_debug(u, "socket %s opened (fd=%d)", of->path, fd);
4343         } else {
4344                 int flags = FLAGS_SET(of->flags, OPENFILE_READ_ONLY) ? O_RDONLY : O_RDWR;
4345                 if (FLAGS_SET(of->flags, OPENFILE_APPEND))
4346                         flags |= O_APPEND;
4347                 else if (FLAGS_SET(of->flags, OPENFILE_TRUNCATE))
4348                         flags |= O_TRUNC;
4349
4350                 fd = fd_reopen(ofd, flags | O_CLOEXEC);
4351                 if (fd < 0)
4352                         return log_unit_error_errno(u, fd, "Failed to open file %s: %m", of->path);
4353
4354                 log_unit_debug(u, "file %s opened (fd=%d)", of->path, fd);
4355         }
4356
4357         return TAKE_FD(fd);
4358 }
4359
4360 static int collect_open_file_fds(
4361                 Unit *u,
4362                 OpenFile* open_files,
4363                 int **fds,
4364                 char ***fdnames,
4365                 size_t *n_fds) {
4366         int r;
4367
4368         assert(u);
4369         assert(fds);
4370         assert(fdnames);
4371         assert(n_fds);
4372
4373         LIST_FOREACH(open_files, of, open_files) {
4374                 _cleanup_close_ int fd = -EBADF;
4375
4376                 fd = get_open_file_fd(u, of);
4377                 if (fd < 0) {
4378                         if (FLAGS_SET(of->flags, OPENFILE_GRACEFUL)) {
4379                                 log_unit_debug_errno(u, fd, "Failed to get OpenFile= file descriptor for %s, ignoring: %m", of->path);
4380                                 continue;
4381                         }
4382
4383                         return fd;
4384                 }
4385
4386                 if (!GREEDY_REALLOC(*fds, *n_fds + 1))
4387                         return -ENOMEM;
4388
4389                 r = strv_extend(fdnames, of->fdname);
4390                 if (r < 0)
4391                         return r;
4392
4393                 (*fds)[*n_fds] = TAKE_FD(fd);
4394
4395                 (*n_fds)++;
4396         }
4397
4398         return 0;
4399 }
4400
4401 static int exec_child(
4402                 Unit *unit,
4403                 const ExecCommand *command,
4404                 const ExecContext *context,
4405                 const ExecParameters *params,
4406                 ExecSharedRuntime *runtime,
4407                 DynamicCreds *dcreds,
4408                 const CGroupContext *cgroup_context,
4409                 int socket_fd,
4410                 const int named_iofds[static 3],
4411                 int *params_fds,
4412                 size_t n_socket_fds,
4413                 size_t n_storage_fds,
4414                 char **files_env,
4415                 int user_lookup_fd,
4416                 int *exit_status) {
4417
4418         _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **joined_exec_search_path = NULL, **accum_env = NULL, **replaced_argv = NULL;
4419         int r, ngids = 0, exec_fd;
4420         _cleanup_free_ gid_t *supplementary_gids = NULL;
4421         const char *username = NULL, *groupname = NULL;
4422         _cleanup_free_ char *home_buffer = NULL, *memory_pressure_path = NULL;
4423         const char *home = NULL, *shell = NULL;
4424         char **final_argv = NULL;
4425         dev_t journal_stream_dev = 0;
4426         ino_t journal_stream_ino = 0;
4427         bool userns_set_up = false;
4428         bool needs_sandboxing,          /* Do we need to set up full sandboxing? (i.e. all namespacing, all MAC stuff, caps, yadda yadda */
4429                 needs_setuid,           /* Do we need to do the actual setresuid()/setresgid() calls? */
4430                 needs_mount_namespace,  /* Do we need to set up a mount namespace for this kernel? */
4431                 needs_ambient_hack;     /* Do we need to apply the ambient capabilities hack? */
4432 #if HAVE_SELINUX
4433         _cleanup_free_ char *mac_selinux_context_net = NULL;
4434         bool use_selinux = false;
4435 #endif
4436 #if ENABLE_SMACK
4437         bool use_smack = false;
4438 #endif
4439 #if HAVE_APPARMOR
4440         bool use_apparmor = false;
4441 #endif
4442         uid_t saved_uid = getuid();
4443         gid_t saved_gid = getgid();
4444         uid_t uid = UID_INVALID;
4445         gid_t gid = GID_INVALID;
4446         size_t n_fds = n_socket_fds + n_storage_fds, /* fds to pass to the child */
4447                n_keep_fds; /* total number of fds not to close */
4448         int secure_bits;
4449         _cleanup_free_ gid_t *gids_after_pam = NULL;
4450         int ngids_after_pam = 0;
4451         _cleanup_free_ int *fds = NULL;
4452         _cleanup_strv_free_ char **fdnames = NULL;
4453
4454         assert(unit);
4455         assert(command);
4456         assert(context);
4457         assert(params);
4458         assert(exit_status);
4459
4460         /* Explicitly test for CVE-2021-4034 inspired invocations */
4461         assert(command->path);
4462         assert(!strv_isempty(command->argv));
4463
4464         rename_process_from_path(command->path);
4465
4466         /* We reset exactly these signals, since they are the only ones we set to SIG_IGN in the main
4467          * daemon. All others we leave untouched because we set them to SIG_DFL or a valid handler initially,
4468          * both of which will be demoted to SIG_DFL. */
4469         (void) default_signals(SIGNALS_CRASH_HANDLER,
4470                                SIGNALS_IGNORE);
4471
4472         if (context->ignore_sigpipe)
4473                 (void) ignore_signals(SIGPIPE);
4474
4475         r = reset_signal_mask();
4476         if (r < 0) {
4477                 *exit_status = EXIT_SIGNAL_MASK;
4478                 return log_unit_error_errno(unit, r, "Failed to set process signal mask: %m");
4479         }
4480
4481         if (params->idle_pipe)
4482                 do_idle_pipe_dance(params->idle_pipe);
4483
4484         /* Close fds we don't need very early to make sure we don't block init reexecution because it cannot bind its
4485          * sockets. Among the fds we close are the logging fds, and we want to keep them closed, so that we don't have
4486          * any fds open we don't really want open during the transition. In order to make logging work, we switch the
4487          * log subsystem into open_when_needed mode, so that it reopens the logs on every single log call. */
4488
4489         log_forget_fds();
4490         log_set_open_when_needed(true);
4491         log_settle_target();
4492
4493         /* In case anything used libc syslog(), close this here, too */
4494         closelog();
4495
4496         fds = newdup(int, params_fds, n_fds);
4497         if (!fds) {
4498                 *exit_status = EXIT_MEMORY;
4499                 return log_oom();
4500         }
4501
4502         fdnames = strv_copy((char**) params->fd_names);
4503         if (!fdnames) {
4504                 *exit_status = EXIT_MEMORY;
4505                 return log_oom();
4506         }
4507
4508         r = collect_open_file_fds(unit, params->open_files, &fds, &fdnames, &n_fds);
4509         if (r < 0) {
4510                 *exit_status = EXIT_FDS;
4511                 return log_unit_error_errno(unit, r, "Failed to get OpenFile= file descriptors: %m");
4512         }
4513
4514         int keep_fds[n_fds + 3];
4515         memcpy_safe(keep_fds, fds, n_fds * sizeof(int));
4516         n_keep_fds = n_fds;
4517
4518         r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, params->exec_fd, &exec_fd);
4519         if (r < 0) {
4520                 *exit_status = EXIT_FDS;
4521                 return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m");
4522         }
4523
4524 #if HAVE_LIBBPF
4525         if (unit->manager->restrict_fs) {
4526                 int bpf_map_fd = lsm_bpf_map_restrict_fs_fd(unit);
4527                 if (bpf_map_fd < 0) {
4528                         *exit_status = EXIT_FDS;
4529                         return log_unit_error_errno(unit, bpf_map_fd, "Failed to get restrict filesystems BPF map fd: %m");
4530                 }
4531
4532                 r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, bpf_map_fd, &bpf_map_fd);
4533                 if (r < 0) {
4534                         *exit_status = EXIT_FDS;
4535                         return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m");
4536                 }
4537         }
4538 #endif
4539
4540         r = close_remaining_fds(params, runtime, dcreds, user_lookup_fd, socket_fd, keep_fds, n_keep_fds);
4541         if (r < 0) {
4542                 *exit_status = EXIT_FDS;
4543                 return log_unit_error_errno(unit, r, "Failed to close unwanted file descriptors: %m");
4544         }
4545
4546         if (!context->same_pgrp &&
4547             setsid() < 0) {
4548                 *exit_status = EXIT_SETSID;
4549                 return log_unit_error_errno(unit, errno, "Failed to create new process session: %m");
4550         }
4551
4552         exec_context_tty_reset(context, params);
4553
4554         if (unit_shall_confirm_spawn(unit)) {
4555                 _cleanup_free_ char *cmdline = NULL;
4556
4557                 cmdline = quote_command_line(command->argv, SHELL_ESCAPE_EMPTY);
4558                 if (!cmdline) {
4559                         *exit_status = EXIT_MEMORY;
4560                         return log_oom();
4561                 }
4562
4563                 r = ask_for_confirmation(context, params->confirm_spawn, unit, cmdline);
4564                 if (r != CONFIRM_EXECUTE) {
4565                         if (r == CONFIRM_PRETEND_SUCCESS) {
4566                                 *exit_status = EXIT_SUCCESS;
4567                                 return 0;
4568                         }
4569                         *exit_status = EXIT_CONFIRM;
4570                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ECANCELED),
4571                                                     "Execution cancelled by the user");
4572                 }
4573         }
4574
4575         /* We are about to invoke NSS and PAM modules. Let's tell them what we are doing here, maybe they care. This is
4576          * used by nss-resolve to disable itself when we are about to start systemd-resolved, to avoid deadlocks. Note
4577          * that these env vars do not survive the execve(), which means they really only apply to the PAM and NSS
4578          * invocations themselves. Also note that while we'll only invoke NSS modules involved in user management they
4579          * might internally call into other NSS modules that are involved in hostname resolution, we never know. */
4580         if (setenv("SYSTEMD_ACTIVATION_UNIT", unit->id, true) != 0 ||
4581             setenv("SYSTEMD_ACTIVATION_SCOPE", runtime_scope_to_string(unit->manager->runtime_scope), true) != 0) {
4582                 *exit_status = EXIT_MEMORY;
4583                 return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
4584         }
4585
4586         if (context->dynamic_user && dcreds) {
4587                 _cleanup_strv_free_ char **suggested_paths = NULL;
4588
4589                 /* On top of that, make sure we bypass our own NSS module nss-systemd comprehensively for any NSS
4590                  * checks, if DynamicUser=1 is used, as we shouldn't create a feedback loop with ourselves here. */
4591                 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
4592                         *exit_status = EXIT_USER;
4593                         return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
4594                 }
4595
4596                 r = compile_suggested_paths(context, params, &suggested_paths);
4597                 if (r < 0) {
4598                         *exit_status = EXIT_MEMORY;
4599                         return log_oom();
4600                 }
4601
4602                 r = dynamic_creds_realize(dcreds, suggested_paths, &uid, &gid);
4603                 if (r < 0) {
4604                         *exit_status = EXIT_USER;
4605                         if (r == -EILSEQ)
4606                                 return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP),
4607                                                             "Failed to update dynamic user credentials: User or group with specified name already exists.");
4608                         return log_unit_error_errno(unit, r, "Failed to update dynamic user credentials: %m");
4609                 }
4610
4611                 if (!uid_is_valid(uid)) {
4612                         *exit_status = EXIT_USER;
4613                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ESRCH), "UID validation failed for \""UID_FMT"\"", uid);
4614                 }
4615
4616                 if (!gid_is_valid(gid)) {
4617                         *exit_status = EXIT_USER;
4618                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ESRCH), "GID validation failed for \""GID_FMT"\"", gid);
4619                 }
4620
4621                 if (dcreds->user)
4622                         username = dcreds->user->name;
4623
4624         } else {
4625                 r = get_fixed_user(context, &username, &uid, &gid, &home, &shell);
4626                 if (r < 0) {
4627                         *exit_status = EXIT_USER;
4628                         return log_unit_error_errno(unit, r, "Failed to determine user credentials: %m");
4629                 }
4630
4631                 r = get_fixed_group(context, &groupname, &gid);
4632                 if (r < 0) {
4633                         *exit_status = EXIT_GROUP;
4634                         return log_unit_error_errno(unit, r, "Failed to determine group credentials: %m");
4635                 }
4636         }
4637
4638         /* Initialize user supplementary groups and get SupplementaryGroups= ones */
4639         r = get_supplementary_groups(context, username, groupname, gid,
4640                                      &supplementary_gids, &ngids);
4641         if (r < 0) {
4642                 *exit_status = EXIT_GROUP;
4643                 return log_unit_error_errno(unit, r, "Failed to determine supplementary groups: %m");
4644         }
4645
4646         r = send_user_lookup(unit, user_lookup_fd, uid, gid);
4647         if (r < 0) {
4648                 *exit_status = EXIT_USER;
4649                 return log_unit_error_errno(unit, r, "Failed to send user credentials to PID1: %m");
4650         }
4651
4652         user_lookup_fd = safe_close(user_lookup_fd);
4653
4654         r = acquire_home(context, uid, &home, &home_buffer);
4655         if (r < 0) {
4656                 *exit_status = EXIT_CHDIR;
4657                 return log_unit_error_errno(unit, r, "Failed to determine $HOME for user: %m");
4658         }
4659
4660         /* If a socket is connected to STDIN/STDOUT/STDERR, we
4661          * must sure to drop O_NONBLOCK */
4662         if (socket_fd >= 0)
4663                 (void) fd_nonblock(socket_fd, false);
4664
4665         /* Journald will try to look-up our cgroup in order to populate _SYSTEMD_CGROUP and _SYSTEMD_UNIT fields.
4666          * Hence we need to migrate to the target cgroup from init.scope before connecting to journald */
4667         if (params->cgroup_path) {
4668                 _cleanup_free_ char *p = NULL;
4669
4670                 r = exec_parameters_get_cgroup_path(params, &p);
4671                 if (r < 0) {
4672                         *exit_status = EXIT_CGROUP;
4673                         return log_unit_error_errno(unit, r, "Failed to acquire cgroup path: %m");
4674                 }
4675
4676                 r = cg_attach_everywhere(params->cgroup_supported, p, 0, NULL, NULL);
4677                 if (r == -EUCLEAN) {
4678                         *exit_status = EXIT_CGROUP;
4679                         return log_unit_error_errno(unit, r, "Failed to attach process to cgroup %s "
4680                                                     "because the cgroup or one of its parents or "
4681                                                     "siblings is in the threaded mode: %m", p);
4682                 }
4683                 if (r < 0) {
4684                         *exit_status = EXIT_CGROUP;
4685                         return log_unit_error_errno(unit, r, "Failed to attach to cgroup %s: %m", p);
4686                 }
4687         }
4688
4689         if (context->network_namespace_path && runtime && runtime->netns_storage_socket[0] >= 0) {
4690                 r = open_shareable_ns_path(runtime->netns_storage_socket, context->network_namespace_path, CLONE_NEWNET);
4691                 if (r < 0) {
4692                         *exit_status = EXIT_NETWORK;
4693                         return log_unit_error_errno(unit, r, "Failed to open network namespace path %s: %m", context->network_namespace_path);
4694                 }
4695         }
4696
4697         if (context->ipc_namespace_path && runtime && runtime->ipcns_storage_socket[0] >= 0) {
4698                 r = open_shareable_ns_path(runtime->ipcns_storage_socket, context->ipc_namespace_path, CLONE_NEWIPC);
4699                 if (r < 0) {
4700                         *exit_status = EXIT_NAMESPACE;
4701                         return log_unit_error_errno(unit, r, "Failed to open IPC namespace path %s: %m", context->ipc_namespace_path);
4702                 }
4703         }
4704
4705         r = setup_input(context, params, socket_fd, named_iofds);
4706         if (r < 0) {
4707                 *exit_status = EXIT_STDIN;
4708                 return log_unit_error_errno(unit, r, "Failed to set up standard input: %m");
4709         }
4710
4711         r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
4712         if (r < 0) {
4713                 *exit_status = EXIT_STDOUT;
4714                 return log_unit_error_errno(unit, r, "Failed to set up standard output: %m");
4715         }
4716
4717         r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
4718         if (r < 0) {
4719                 *exit_status = EXIT_STDERR;
4720                 return log_unit_error_errno(unit, r, "Failed to set up standard error output: %m");
4721         }
4722
4723         if (context->oom_score_adjust_set) {
4724                 /* When we can't make this change due to EPERM, then let's silently skip over it. User namespaces
4725                  * prohibit write access to this file, and we shouldn't trip up over that. */
4726                 r = set_oom_score_adjust(context->oom_score_adjust);
4727                 if (ERRNO_IS_PRIVILEGE(r))
4728                         log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
4729                 else if (r < 0) {
4730                         *exit_status = EXIT_OOM_ADJUST;
4731                         return log_unit_error_errno(unit, r, "Failed to adjust OOM setting: %m");
4732                 }
4733         }
4734
4735         if (context->coredump_filter_set) {
4736                 r = set_coredump_filter(context->coredump_filter);
4737                 if (ERRNO_IS_PRIVILEGE(r))
4738                         log_unit_debug_errno(unit, r, "Failed to adjust coredump_filter, ignoring: %m");
4739                 else if (r < 0)
4740                         return log_unit_error_errno(unit, r, "Failed to adjust coredump_filter: %m");
4741         }
4742
4743         if (context->nice_set) {
4744                 r = setpriority_closest(context->nice);
4745                 if (r < 0)
4746                         return log_unit_error_errno(unit, r, "Failed to set up process scheduling priority (nice level): %m");
4747         }
4748
4749         if (context->cpu_sched_set) {
4750                 struct sched_param param = {
4751                         .sched_priority = context->cpu_sched_priority,
4752                 };
4753
4754                 r = sched_setscheduler(0,
4755                                        context->cpu_sched_policy |
4756                                        (context->cpu_sched_reset_on_fork ?
4757                                         SCHED_RESET_ON_FORK : 0),
4758                                        &param);
4759                 if (r < 0) {
4760                         *exit_status = EXIT_SETSCHEDULER;
4761                         return log_unit_error_errno(unit, errno, "Failed to set up CPU scheduling: %m");
4762                 }
4763         }
4764
4765         if (context->cpu_affinity_from_numa || context->cpu_set.set) {
4766                 _cleanup_(cpu_set_reset) CPUSet converted_cpu_set = {};
4767                 const CPUSet *cpu_set;
4768
4769                 if (context->cpu_affinity_from_numa) {
4770                         r = exec_context_cpu_affinity_from_numa(context, &converted_cpu_set);
4771                         if (r < 0) {
4772                                 *exit_status = EXIT_CPUAFFINITY;
4773                                 return log_unit_error_errno(unit, r, "Failed to derive CPU affinity mask from NUMA mask: %m");
4774                         }
4775
4776                         cpu_set = &converted_cpu_set;
4777                 } else
4778                         cpu_set = &context->cpu_set;
4779
4780                 if (sched_setaffinity(0, cpu_set->allocated, cpu_set->set) < 0) {
4781                         *exit_status = EXIT_CPUAFFINITY;
4782                         return log_unit_error_errno(unit, errno, "Failed to set up CPU affinity: %m");
4783                 }
4784         }
4785
4786         if (mpol_is_valid(numa_policy_get_type(&context->numa_policy))) {
4787                 r = apply_numa_policy(&context->numa_policy);
4788                 if (r < 0) {
4789                         if (ERRNO_IS_NOT_SUPPORTED(r))
4790                                 log_unit_debug_errno(unit, r, "NUMA support not available, ignoring.");
4791                         else {
4792                                 *exit_status = EXIT_NUMA_POLICY;
4793                                 return log_unit_error_errno(unit, r, "Failed to set NUMA memory policy: %m");
4794                         }
4795                 }
4796         }
4797
4798         if (context->ioprio_set)
4799                 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
4800                         *exit_status = EXIT_IOPRIO;
4801                         return log_unit_error_errno(unit, errno, "Failed to set up IO scheduling priority: %m");
4802                 }
4803
4804         if (context->timer_slack_nsec != NSEC_INFINITY)
4805                 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
4806                         *exit_status = EXIT_TIMERSLACK;
4807                         return log_unit_error_errno(unit, errno, "Failed to set up timer slack: %m");
4808                 }
4809
4810         if (context->personality != PERSONALITY_INVALID) {
4811                 r = safe_personality(context->personality);
4812                 if (r < 0) {
4813                         *exit_status = EXIT_PERSONALITY;
4814                         return log_unit_error_errno(unit, r, "Failed to set up execution domain (personality): %m");
4815                 }
4816         }
4817
4818         if (context->utmp_id) {
4819                 const char *line = context->tty_path ?
4820                         (path_startswith(context->tty_path, "/dev/") ?: context->tty_path) :
4821                         NULL;
4822                 utmp_put_init_process(context->utmp_id, getpid_cached(), getsid(0),
4823                                       line,
4824                                       context->utmp_mode == EXEC_UTMP_INIT  ? INIT_PROCESS :
4825                                       context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
4826                                       USER_PROCESS,
4827                                       username);
4828         }
4829
4830         if (uid_is_valid(uid)) {
4831                 r = chown_terminal(STDIN_FILENO, uid);
4832                 if (r < 0) {
4833                         *exit_status = EXIT_STDIN;
4834                         return log_unit_error_errno(unit, r, "Failed to change ownership of terminal: %m");
4835                 }
4836         }
4837
4838         if (params->cgroup_path) {
4839                 /* If delegation is enabled we'll pass ownership of the cgroup to the user of the new process. On cgroup v1
4840                  * this is only about systemd's own hierarchy, i.e. not the controller hierarchies, simply because that's not
4841                  * safe. On cgroup v2 there's only one hierarchy anyway, and delegation is safe there, hence in that case only
4842                  * touch a single hierarchy too. */
4843
4844                 if (params->flags & EXEC_CGROUP_DELEGATE) {
4845                         r = cg_set_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, uid, gid);
4846                         if (r < 0) {
4847                                 *exit_status = EXIT_CGROUP;
4848                                 return log_unit_error_errno(unit, r, "Failed to adjust control group access: %m");
4849                         }
4850                 }
4851
4852                 if (cgroup_context && cg_unified() > 0 && is_pressure_supported() > 0) {
4853                         if (cgroup_context_want_memory_pressure(cgroup_context)) {
4854                                 r = cg_get_path("memory", params->cgroup_path, "memory.pressure", &memory_pressure_path);
4855                                 if (r < 0) {
4856                                         *exit_status = EXIT_MEMORY;
4857                                         return log_oom();
4858                                 }
4859
4860                                 r = chmod_and_chown(memory_pressure_path, 0644, uid, gid);
4861                                 if (r < 0) {
4862                                         log_unit_full_errno(unit, r == -ENOENT || ERRNO_IS_PRIVILEGE(r) ? LOG_DEBUG : LOG_WARNING, r,
4863                                                             "Failed to adjust ownership of '%s', ignoring: %m", memory_pressure_path);
4864                                         memory_pressure_path = mfree(memory_pressure_path);
4865                                 }
4866                         } else if (cgroup_context->memory_pressure_watch == CGROUP_PRESSURE_WATCH_OFF) {
4867                                 memory_pressure_path = strdup("/dev/null"); /* /dev/null is explicit indicator for turning of memory pressure watch */
4868                                 if (!memory_pressure_path) {
4869                                         *exit_status = EXIT_MEMORY;
4870                                         return log_oom();
4871                                 }
4872                         }
4873                 }
4874         }
4875
4876         needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
4877
4878         for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
4879                 r = setup_exec_directory(context, params, uid, gid, dt, needs_mount_namespace, exit_status);
4880                 if (r < 0)
4881                         return log_unit_error_errno(unit, r, "Failed to set up special execution directory in %s: %m", params->prefix[dt]);
4882         }
4883
4884         if (FLAGS_SET(params->flags, EXEC_WRITE_CREDENTIALS)) {
4885                 r = setup_credentials(context, params, unit->id, uid);
4886                 if (r < 0) {
4887                         *exit_status = EXIT_CREDENTIALS;
4888                         return log_unit_error_errno(unit, r, "Failed to set up credentials: %m");
4889                 }
4890         }
4891
4892         r = build_environment(
4893                         unit,
4894                         context,
4895                         params,
4896                         cgroup_context,
4897                         n_fds,
4898                         fdnames,
4899                         home,
4900                         username,
4901                         shell,
4902                         journal_stream_dev,
4903                         journal_stream_ino,
4904                         memory_pressure_path,
4905                         &our_env);
4906         if (r < 0) {
4907                 *exit_status = EXIT_MEMORY;
4908                 return log_oom();
4909         }
4910
4911         r = build_pass_environment(context, &pass_env);
4912         if (r < 0) {
4913                 *exit_status = EXIT_MEMORY;
4914                 return log_oom();
4915         }
4916
4917         /* The $PATH variable is set to the default path in params->environment. However, this is overridden
4918          * if user-specified fields have $PATH set. The intention is to also override $PATH if the unit does
4919          * not specify PATH but the unit has ExecSearchPath. */
4920         if (!strv_isempty(context->exec_search_path)) {
4921                 _cleanup_free_ char *joined = NULL;
4922
4923                 joined = strv_join(context->exec_search_path, ":");
4924                 if (!joined) {
4925                         *exit_status = EXIT_MEMORY;
4926                         return log_oom();
4927                 }
4928
4929                 r = strv_env_assign(&joined_exec_search_path, "PATH", joined);
4930                 if (r < 0) {
4931                         *exit_status = EXIT_MEMORY;
4932                         return log_oom();
4933                 }
4934         }
4935
4936         accum_env = strv_env_merge(params->environment,
4937                                    our_env,
4938                                    joined_exec_search_path,
4939                                    pass_env,
4940                                    context->environment,
4941                                    files_env);
4942         if (!accum_env) {
4943                 *exit_status = EXIT_MEMORY;
4944                 return log_oom();
4945         }
4946         accum_env = strv_env_clean(accum_env);
4947
4948         (void) umask(context->umask);
4949
4950         r = setup_keyring(unit, context, params, uid, gid);
4951         if (r < 0) {
4952                 *exit_status = EXIT_KEYRING;
4953                 return log_unit_error_errno(unit, r, "Failed to set up kernel keyring: %m");
4954         }
4955
4956         /* We need sandboxing if the caller asked us to apply it and the command isn't explicitly excepted
4957          * from it. */
4958         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
4959
4960         /* We need the ambient capability hack, if the caller asked us to apply it and the command is marked
4961          * for it, and the kernel doesn't actually support ambient caps. */
4962         needs_ambient_hack = (params->flags & EXEC_APPLY_SANDBOXING) && (command->flags & EXEC_COMMAND_AMBIENT_MAGIC) && !ambient_capabilities_supported();
4963
4964         /* We need setresuid() if the caller asked us to apply sandboxing and the command isn't explicitly
4965          * excepted from either whole sandboxing or just setresuid() itself, and the ambient hack is not
4966          * desired. */
4967         if (needs_ambient_hack)
4968                 needs_setuid = false;
4969         else
4970                 needs_setuid = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & (EXEC_COMMAND_FULLY_PRIVILEGED|EXEC_COMMAND_NO_SETUID));
4971
4972         uint64_t capability_ambient_set = context->capability_ambient_set;
4973
4974         if (needs_sandboxing) {
4975                 /* MAC enablement checks need to be done before a new mount ns is created, as they rely on
4976                  * /sys being present. The actual MAC context application will happen later, as late as
4977                  * possible, to avoid impacting our own code paths. */
4978
4979 #if HAVE_SELINUX
4980                 use_selinux = mac_selinux_use();
4981 #endif
4982 #if ENABLE_SMACK
4983                 use_smack = mac_smack_use();
4984 #endif
4985 #if HAVE_APPARMOR
4986                 use_apparmor = mac_apparmor_use();
4987 #endif
4988         }
4989
4990         if (needs_sandboxing) {
4991                 int which_failed;
4992
4993                 /* Let's set the resource limits before we call into PAM, so that pam_limits wins over what
4994                  * is set here. (See below.) */
4995
4996                 r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
4997                 if (r < 0) {
4998                         *exit_status = EXIT_LIMITS;
4999                         return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
5000                 }
5001         }
5002
5003         if (needs_setuid && context->pam_name && username) {
5004                 /* Let's call into PAM after we set up our own idea of resource limits to that pam_limits
5005                  * wins here. (See above.) */
5006
5007                 /* All fds passed in the fds array will be closed in the pam child process. */
5008                 r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
5009                 if (r < 0) {
5010                         *exit_status = EXIT_PAM;
5011                         return log_unit_error_errno(unit, r, "Failed to set up PAM session: %m");
5012                 }
5013
5014                 if (ambient_capabilities_supported()) {
5015                         uint64_t ambient_after_pam;
5016
5017                         /* PAM modules might have set some ambient caps. Query them here and merge them into
5018                          * the caps we want to set in the end, so that we don't end up unsetting them. */
5019                         r = capability_get_ambient(&ambient_after_pam);
5020                         if (r < 0) {
5021                                 *exit_status = EXIT_CAPABILITIES;
5022                                 return log_unit_error_errno(unit, r, "Failed to query ambient caps: %m");
5023                         }
5024
5025                         capability_ambient_set |= ambient_after_pam;
5026                 }
5027
5028                 ngids_after_pam = getgroups_alloc(&gids_after_pam);
5029                 if (ngids_after_pam < 0) {
5030                         *exit_status = EXIT_MEMORY;
5031                         return log_unit_error_errno(unit, ngids_after_pam, "Failed to obtain groups after setting up PAM: %m");
5032                 }
5033         }
5034
5035         if (needs_sandboxing && context->private_users && have_effective_cap(CAP_SYS_ADMIN) <= 0) {
5036                 /* If we're unprivileged, set up the user namespace first to enable use of the other namespaces.
5037                  * Users with CAP_SYS_ADMIN can set up user namespaces last because they will be able to
5038                  * set up the all of the other namespaces (i.e. network, mount, UTS) without a user namespace. */
5039
5040                 userns_set_up = true;
5041                 r = setup_private_users(saved_uid, saved_gid, uid, gid);
5042                 if (r < 0) {
5043                         *exit_status = EXIT_USER;
5044                         return log_unit_error_errno(unit, r, "Failed to set up user namespacing for unprivileged user: %m");
5045                 }
5046         }
5047
5048         if (exec_needs_network_namespace(context) && runtime && runtime->netns_storage_socket[0] >= 0) {
5049
5050                 if (ns_type_supported(NAMESPACE_NET)) {
5051                         r = setup_shareable_ns(runtime->netns_storage_socket, CLONE_NEWNET);
5052                         if (r < 0) {
5053                                 if (ERRNO_IS_PRIVILEGE(r))
5054                                         log_unit_warning_errno(unit, r,
5055                                                                "PrivateNetwork=yes is configured, but network namespace setup failed, ignoring: %m");
5056                                 else {
5057                                         *exit_status = EXIT_NETWORK;
5058                                         return log_unit_error_errno(unit, r, "Failed to set up network namespacing: %m");
5059                                 }
5060                         }
5061                 } else if (context->network_namespace_path) {
5062                         *exit_status = EXIT_NETWORK;
5063                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP),
5064                                                     "NetworkNamespacePath= is not supported, refusing.");
5065                 } else
5066                         log_unit_warning(unit, "PrivateNetwork=yes is configured, but the kernel does not support network namespaces, ignoring.");
5067         }
5068
5069         if (exec_needs_ipc_namespace(context) && runtime && runtime->ipcns_storage_socket[0] >= 0) {
5070
5071                 if (ns_type_supported(NAMESPACE_IPC)) {
5072                         r = setup_shareable_ns(runtime->ipcns_storage_socket, CLONE_NEWIPC);
5073                         if (r == -EPERM)
5074                                 log_unit_warning_errno(unit, r,
5075                                                        "PrivateIPC=yes is configured, but IPC namespace setup failed, ignoring: %m");
5076                         else if (r < 0) {
5077                                 *exit_status = EXIT_NAMESPACE;
5078                                 return log_unit_error_errno(unit, r, "Failed to set up IPC namespacing: %m");
5079                         }
5080                 } else if (context->ipc_namespace_path) {
5081                         *exit_status = EXIT_NAMESPACE;
5082                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP),
5083                                                     "IPCNamespacePath= is not supported, refusing.");
5084                 } else
5085                         log_unit_warning(unit, "PrivateIPC=yes is configured, but the kernel does not support IPC namespaces, ignoring.");
5086         }
5087
5088         if (needs_mount_namespace) {
5089                 _cleanup_free_ char *error_path = NULL;
5090
5091                 r = apply_mount_namespace(unit, command->flags, context, params, runtime, memory_pressure_path, &error_path);
5092                 if (r < 0) {
5093                         *exit_status = EXIT_NAMESPACE;
5094                         return log_unit_error_errno(unit, r, "Failed to set up mount namespacing%s%s: %m",
5095                                                     error_path ? ": " : "", strempty(error_path));
5096                 }
5097         }
5098
5099         if (needs_sandboxing) {
5100                 r = apply_protect_hostname(unit, context, exit_status);
5101                 if (r < 0)
5102                         return r;
5103         }
5104
5105         /* Drop groups as early as possible.
5106          * This needs to be done after PrivateDevices=y setup as device nodes should be owned by the host's root.
5107          * For non-root in a userns, devices will be owned by the user/group before the group change, and nobody. */
5108         if (needs_setuid) {
5109                 _cleanup_free_ gid_t *gids_to_enforce = NULL;
5110                 int ngids_to_enforce = 0;
5111
5112                 ngids_to_enforce = merge_gid_lists(supplementary_gids,
5113                                                    ngids,
5114                                                    gids_after_pam,
5115                                                    ngids_after_pam,
5116                                                    &gids_to_enforce);
5117                 if (ngids_to_enforce < 0) {
5118                         *exit_status = EXIT_MEMORY;
5119                         return log_unit_error_errno(unit,
5120                                                     ngids_to_enforce,
5121                                                     "Failed to merge group lists. Group membership might be incorrect: %m");
5122                 }
5123
5124                 r = enforce_groups(gid, gids_to_enforce, ngids_to_enforce);
5125                 if (r < 0) {
5126                         *exit_status = EXIT_GROUP;
5127                         return log_unit_error_errno(unit, r, "Changing group credentials failed: %m");
5128                 }
5129         }
5130
5131         /* If the user namespace was not set up above, try to do it now.
5132          * It's preferred to set up the user namespace later (after all other namespaces) so as not to be
5133          * restricted by rules pertaining to combining user namespaces with other namespaces (e.g. in the
5134          * case of mount namespaces being less privileged when the mount point list is copied from a
5135          * different user namespace). */
5136
5137         if (needs_sandboxing && context->private_users && !userns_set_up) {
5138                 r = setup_private_users(saved_uid, saved_gid, uid, gid);
5139                 if (r < 0) {
5140                         *exit_status = EXIT_USER;
5141                         return log_unit_error_errno(unit, r, "Failed to set up user namespacing: %m");
5142                 }
5143         }
5144
5145         /* Now that the mount namespace has been set up and privileges adjusted, let's look for the thing we
5146          * shall execute. */
5147
5148         _cleanup_free_ char *executable = NULL;
5149         _cleanup_close_ int executable_fd = -EBADF;
5150         r = find_executable_full(command->path, /* root= */ NULL, context->exec_search_path, false, &executable, &executable_fd);
5151         if (r < 0) {
5152                 if (r != -ENOMEM && (command->flags & EXEC_COMMAND_IGNORE_FAILURE)) {
5153                         log_unit_struct_errno(unit, LOG_INFO, r,
5154                                               "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
5155                                               LOG_UNIT_INVOCATION_ID(unit),
5156                                               LOG_UNIT_MESSAGE(unit, "Executable %s missing, skipping: %m",
5157                                                                command->path),
5158                                               "EXECUTABLE=%s", command->path);
5159                         return 0;
5160                 }
5161
5162                 *exit_status = EXIT_EXEC;
5163
5164                 return log_unit_struct_errno(unit, LOG_INFO, r,
5165                                              "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
5166                                              LOG_UNIT_INVOCATION_ID(unit),
5167                                              LOG_UNIT_MESSAGE(unit, "Failed to locate executable %s: %m",
5168                                                               command->path),
5169                                              "EXECUTABLE=%s", command->path);
5170         }
5171
5172         r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, executable_fd, &executable_fd);
5173         if (r < 0) {
5174                 *exit_status = EXIT_FDS;
5175                 return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m");
5176         }
5177
5178 #if HAVE_SELINUX
5179         if (needs_sandboxing && use_selinux && params->selinux_context_net) {
5180                 int fd = -EBADF;
5181
5182                 if (socket_fd >= 0)
5183                         fd = socket_fd;
5184                 else if (params->n_socket_fds == 1)
5185                         /* If stdin is not connected to a socket but we are triggered by exactly one socket unit then we
5186                          * use context from that fd to compute the label. */
5187                         fd = params->fds[0];
5188
5189                 if (fd >= 0) {
5190                         r = mac_selinux_get_child_mls_label(fd, executable, context->selinux_context, &mac_selinux_context_net);
5191                         if (r < 0) {
5192                                 if (!context->selinux_context_ignore) {
5193                                         *exit_status = EXIT_SELINUX_CONTEXT;
5194                                         return log_unit_error_errno(unit, r, "Failed to determine SELinux context: %m");
5195                                 }
5196                                 log_unit_debug_errno(unit, r, "Failed to determine SELinux context, ignoring: %m");
5197                         }
5198                 }
5199         }
5200 #endif
5201
5202         /* We repeat the fd closing here, to make sure that nothing is leaked from the PAM modules. Note that we are
5203          * more aggressive this time since socket_fd and the netns and ipcns fds we don't need anymore. We do keep the exec_fd
5204          * however if we have it as we want to keep it open until the final execve(). */
5205
5206         r = close_all_fds(keep_fds, n_keep_fds);
5207         if (r >= 0)
5208                 r = shift_fds(fds, n_fds);
5209         if (r >= 0)
5210                 r = flags_fds(fds, n_socket_fds, n_fds, context->non_blocking);
5211         if (r < 0) {
5212                 *exit_status = EXIT_FDS;
5213                 return log_unit_error_errno(unit, r, "Failed to adjust passed file descriptors: %m");
5214         }
5215
5216         /* At this point, the fds we want to pass to the program are all ready and set up, with O_CLOEXEC turned off
5217          * and at the right fd numbers. The are no other fds open, with one exception: the exec_fd if it is defined,
5218          * and it has O_CLOEXEC set, after all we want it to be closed by the execve(), so that our parent knows we
5219          * came this far. */
5220
5221         secure_bits = context->secure_bits;
5222
5223         if (needs_sandboxing) {
5224                 uint64_t bset;
5225
5226                 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly
5227                  * requested. (Note this is placed after the general resource limit initialization, see
5228                  * above, in order to take precedence.) */
5229                 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
5230                         if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
5231                                 *exit_status = EXIT_LIMITS;
5232                                 return log_unit_error_errno(unit, errno, "Failed to adjust RLIMIT_RTPRIO resource limit: %m");
5233                         }
5234                 }
5235
5236 #if ENABLE_SMACK
5237                 /* LSM Smack needs the capability CAP_MAC_ADMIN to change the current execution security context of the
5238                  * process. This is the latest place before dropping capabilities. Other MAC context are set later. */
5239                 if (use_smack) {
5240                         r = setup_smack(unit->manager, context, executable_fd);
5241                         if (r < 0 && !context->smack_process_label_ignore) {
5242                                 *exit_status = EXIT_SMACK_PROCESS_LABEL;
5243                                 return log_unit_error_errno(unit, r, "Failed to set SMACK process label: %m");
5244                         }
5245                 }
5246 #endif
5247
5248                 bset = context->capability_bounding_set;
5249                 /* If the ambient caps hack is enabled (which means the kernel can't do them, and the user asked for
5250                  * our magic fallback), then let's add some extra caps, so that the service can drop privs of its own,
5251                  * instead of us doing that */
5252                 if (needs_ambient_hack)
5253                         bset |= (UINT64_C(1) << CAP_SETPCAP) |
5254                                 (UINT64_C(1) << CAP_SETUID) |
5255                                 (UINT64_C(1) << CAP_SETGID);
5256
5257                 if (!cap_test_all(bset)) {
5258                         r = capability_bounding_set_drop(bset, /* right_now= */ false);
5259                         if (r < 0) {
5260                                 *exit_status = EXIT_CAPABILITIES;
5261                                 return log_unit_error_errno(unit, r, "Failed to drop capabilities: %m");
5262                         }
5263                 }
5264
5265                 /* Ambient capabilities are cleared during setresuid() (in enforce_user()) even with
5266                  * keep-caps set.
5267                  *
5268                  * To be able to raise the ambient capabilities after setresuid() they have to be added to
5269                  * the inherited set and keep caps has to be set (done in enforce_user()).  After setresuid()
5270                  * the ambient capabilities can be raised as they are present in the permitted and
5271                  * inhertiable set. However it is possible that someone wants to set ambient capabilities
5272                  * without changing the user, so we also set the ambient capabilities here.
5273                  *
5274                  * The requested ambient capabilities are raised in the inheritable set if the second
5275                  * argument is true. */
5276                 if (!needs_ambient_hack) {
5277                         r = capability_ambient_set_apply(capability_ambient_set, /* also_inherit= */ true);
5278                         if (r < 0) {
5279                                 *exit_status = EXIT_CAPABILITIES;
5280                                 return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (before UID change): %m");
5281                         }
5282                 }
5283         }
5284
5285         /* chroot to root directory first, before we lose the ability to chroot */
5286         r = apply_root_directory(context, params, needs_mount_namespace, exit_status);
5287         if (r < 0)
5288                 return log_unit_error_errno(unit, r, "Chrooting to the requested root directory failed: %m");
5289
5290         if (needs_setuid) {
5291                 if (uid_is_valid(uid)) {
5292                         r = enforce_user(context, uid, capability_ambient_set);
5293                         if (r < 0) {
5294                                 *exit_status = EXIT_USER;
5295                                 return log_unit_error_errno(unit, r, "Failed to change UID to " UID_FMT ": %m", uid);
5296                         }
5297
5298                         if (!needs_ambient_hack && capability_ambient_set != 0) {
5299
5300                                 /* Raise the ambient capabilities after user change. */
5301                                 r = capability_ambient_set_apply(capability_ambient_set, /* also_inherit= */ false);
5302                                 if (r < 0) {
5303                                         *exit_status = EXIT_CAPABILITIES;
5304                                         return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (after UID change): %m");
5305                                 }
5306                         }
5307                 }
5308         }
5309
5310         /* Apply working directory here, because the working directory might be on NFS and only the user running
5311          * this service might have the correct privilege to change to the working directory */
5312         r = apply_working_directory(context, params, home, exit_status);
5313         if (r < 0)
5314                 return log_unit_error_errno(unit, r, "Changing to the requested working directory failed: %m");
5315
5316         if (needs_sandboxing) {
5317                 /* Apply other MAC contexts late, but before seccomp syscall filtering, as those should really be last to
5318                  * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires
5319                  * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls
5320                  * are restricted. */
5321
5322 #if HAVE_SELINUX
5323                 if (use_selinux) {
5324                         char *exec_context = mac_selinux_context_net ?: context->selinux_context;
5325
5326                         if (exec_context) {
5327                                 r = setexeccon(exec_context);
5328                                 if (r < 0) {
5329                                         if (!context->selinux_context_ignore) {
5330                                                 *exit_status = EXIT_SELINUX_CONTEXT;
5331                                                 return log_unit_error_errno(unit, r, "Failed to change SELinux context to %s: %m", exec_context);
5332                                         }
5333                                         log_unit_debug_errno(unit, r, "Failed to change SELinux context to %s, ignoring: %m", exec_context);
5334                                 }
5335                         }
5336                 }
5337 #endif
5338
5339 #if HAVE_APPARMOR
5340                 if (use_apparmor && context->apparmor_profile) {
5341                         r = aa_change_onexec(context->apparmor_profile);
5342                         if (r < 0 && !context->apparmor_profile_ignore) {
5343                                 *exit_status = EXIT_APPARMOR_PROFILE;
5344                                 return log_unit_error_errno(unit, errno, "Failed to prepare AppArmor profile change to %s: %m", context->apparmor_profile);
5345                         }
5346                 }
5347 #endif
5348
5349                 /* PR_GET_SECUREBITS is not privileged, while PR_SET_SECUREBITS is. So to suppress potential
5350                  * EPERMs we'll try not to call PR_SET_SECUREBITS unless necessary. Setting securebits
5351                  * requires CAP_SETPCAP. */
5352                 if (prctl(PR_GET_SECUREBITS) != secure_bits) {
5353                         /* CAP_SETPCAP is required to set securebits. This capability is raised into the
5354                          * effective set here.
5355                          *
5356                          * The effective set is overwritten during execve() with the following values:
5357                          *
5358                          * - ambient set (for non-root processes)
5359                          *
5360                          * - (inheritable | bounding) set for root processes)
5361                          *
5362                          * Hence there is no security impact to raise it in the effective set before execve
5363                          */
5364                         r = capability_gain_cap_setpcap(/* return_caps= */ NULL);
5365                         if (r < 0) {
5366                                 *exit_status = EXIT_CAPABILITIES;
5367                                 return log_unit_error_errno(unit, r, "Failed to gain CAP_SETPCAP for setting secure bits");
5368                         }
5369                         if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
5370                                 *exit_status = EXIT_SECUREBITS;
5371                                 return log_unit_error_errno(unit, errno, "Failed to set process secure bits: %m");
5372                         }
5373                 }
5374
5375                 if (context_has_no_new_privileges(context))
5376                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
5377                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
5378                                 return log_unit_error_errno(unit, errno, "Failed to disable new privileges: %m");
5379                         }
5380
5381 #if HAVE_SECCOMP
5382                 r = apply_address_families(unit, context);
5383                 if (r < 0) {
5384                         *exit_status = EXIT_ADDRESS_FAMILIES;
5385                         return log_unit_error_errno(unit, r, "Failed to restrict address families: %m");
5386                 }
5387
5388                 r = apply_memory_deny_write_execute(unit, context);
5389                 if (r < 0) {
5390                         *exit_status = EXIT_SECCOMP;
5391                         return log_unit_error_errno(unit, r, "Failed to disable writing to executable memory: %m");
5392                 }
5393
5394                 r = apply_restrict_realtime(unit, context);
5395                 if (r < 0) {
5396                         *exit_status = EXIT_SECCOMP;
5397                         return log_unit_error_errno(unit, r, "Failed to apply realtime restrictions: %m");
5398                 }
5399
5400                 r = apply_restrict_suid_sgid(unit, context);
5401                 if (r < 0) {
5402                         *exit_status = EXIT_SECCOMP;
5403                         return log_unit_error_errno(unit, r, "Failed to apply SUID/SGID restrictions: %m");
5404                 }
5405
5406                 r = apply_restrict_namespaces(unit, context);
5407                 if (r < 0) {
5408                         *exit_status = EXIT_SECCOMP;
5409                         return log_unit_error_errno(unit, r, "Failed to apply namespace restrictions: %m");
5410                 }
5411
5412                 r = apply_protect_sysctl(unit, context);
5413                 if (r < 0) {
5414                         *exit_status = EXIT_SECCOMP;
5415                         return log_unit_error_errno(unit, r, "Failed to apply sysctl restrictions: %m");
5416                 }
5417
5418                 r = apply_protect_kernel_modules(unit, context);
5419                 if (r < 0) {
5420                         *exit_status = EXIT_SECCOMP;
5421                         return log_unit_error_errno(unit, r, "Failed to apply module loading restrictions: %m");
5422                 }
5423
5424                 r = apply_protect_kernel_logs(unit, context);
5425                 if (r < 0) {
5426                         *exit_status = EXIT_SECCOMP;
5427                         return log_unit_error_errno(unit, r, "Failed to apply kernel log restrictions: %m");
5428                 }
5429
5430                 r = apply_protect_clock(unit, context);
5431                 if (r < 0) {
5432                         *exit_status = EXIT_SECCOMP;
5433                         return log_unit_error_errno(unit, r, "Failed to apply clock restrictions: %m");
5434                 }
5435
5436                 r = apply_private_devices(unit, context);
5437                 if (r < 0) {
5438                         *exit_status = EXIT_SECCOMP;
5439                         return log_unit_error_errno(unit, r, "Failed to set up private devices: %m");
5440                 }
5441
5442                 r = apply_syscall_archs(unit, context);
5443                 if (r < 0) {
5444                         *exit_status = EXIT_SECCOMP;
5445                         return log_unit_error_errno(unit, r, "Failed to apply syscall architecture restrictions: %m");
5446                 }
5447
5448                 r = apply_lock_personality(unit, context);
5449                 if (r < 0) {
5450                         *exit_status = EXIT_SECCOMP;
5451                         return log_unit_error_errno(unit, r, "Failed to lock personalities: %m");
5452                 }
5453
5454                 r = apply_syscall_log(unit, context);
5455                 if (r < 0) {
5456                         *exit_status = EXIT_SECCOMP;
5457                         return log_unit_error_errno(unit, r, "Failed to apply system call log filters: %m");
5458                 }
5459
5460                 /* This really should remain the last step before the execve(), to make sure our own code is unaffected
5461                  * by the filter as little as possible. */
5462                 r = apply_syscall_filter(unit, context, needs_ambient_hack);
5463                 if (r < 0) {
5464                         *exit_status = EXIT_SECCOMP;
5465                         return log_unit_error_errno(unit, r, "Failed to apply system call filters: %m");
5466                 }
5467 #endif
5468
5469 #if HAVE_LIBBPF
5470                 r = apply_restrict_filesystems(unit, context);
5471                 if (r < 0) {
5472                         *exit_status = EXIT_BPF;
5473                         return log_unit_error_errno(unit, r, "Failed to restrict filesystems: %m");
5474                 }
5475 #endif
5476
5477         }
5478
5479         if (!strv_isempty(context->unset_environment)) {
5480                 char **ee = NULL;
5481
5482                 ee = strv_env_delete(accum_env, 1, context->unset_environment);
5483                 if (!ee) {
5484                         *exit_status = EXIT_MEMORY;
5485                         return log_oom();
5486                 }
5487
5488                 strv_free_and_replace(accum_env, ee);
5489         }
5490
5491         if (!FLAGS_SET(command->flags, EXEC_COMMAND_NO_ENV_EXPAND)) {
5492                 replaced_argv = replace_env_argv(command->argv, accum_env);
5493                 if (!replaced_argv) {
5494                         *exit_status = EXIT_MEMORY;
5495                         return log_oom();
5496                 }
5497                 final_argv = replaced_argv;
5498         } else
5499                 final_argv = command->argv;
5500
5501         if (DEBUG_LOGGING) {
5502                 _cleanup_free_ char *line = NULL;
5503
5504                 line = quote_command_line(final_argv, SHELL_ESCAPE_EMPTY);
5505                 if (!line) {
5506                         *exit_status = EXIT_MEMORY;
5507                         return log_oom();
5508                 }
5509
5510                 log_unit_struct(unit, LOG_DEBUG,
5511                                 "EXECUTABLE=%s", executable,
5512                                 LOG_UNIT_MESSAGE(unit, "Executing: %s", line));
5513         }
5514
5515         if (exec_fd >= 0) {
5516                 uint8_t hot = 1;
5517
5518                 /* We have finished with all our initializations. Let's now let the manager know that. From this point
5519                  * on, if the manager sees POLLHUP on the exec_fd, then execve() was successful. */
5520
5521                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
5522                         *exit_status = EXIT_EXEC;
5523                         return log_unit_error_errno(unit, errno, "Failed to enable exec_fd: %m");
5524                 }
5525         }
5526
5527         r = fexecve_or_execve(executable_fd, executable, final_argv, accum_env);
5528
5529         if (exec_fd >= 0) {
5530                 uint8_t hot = 0;
5531
5532                 /* The execve() failed. This means the exec_fd is still open. Which means we need to tell the manager
5533                  * that POLLHUP on it no longer means execve() succeeded. */
5534
5535                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
5536                         *exit_status = EXIT_EXEC;
5537                         return log_unit_error_errno(unit, errno, "Failed to disable exec_fd: %m");
5538                 }
5539         }
5540
5541         *exit_status = EXIT_EXEC;
5542         return log_unit_error_errno(unit, r, "Failed to execute %s: %m", executable);
5543 }
5544
5545 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l);
5546 static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[static 3]);
5547
5548 int exec_spawn(Unit *unit,
5549                ExecCommand *command,
5550                const ExecContext *context,
5551                const ExecParameters *params,
5552                ExecSharedRuntime *runtime,
5553                DynamicCreds *dcreds,
5554                const CGroupContext *cgroup_context,
5555                pid_t *ret) {
5556
5557         int socket_fd, r, named_iofds[3] = { -1, -1, -1 }, *fds = NULL;
5558         _cleanup_free_ char *subcgroup_path = NULL;
5559         _cleanup_strv_free_ char **files_env = NULL;
5560         size_t n_storage_fds = 0, n_socket_fds = 0;
5561         _cleanup_free_ char *line = NULL;
5562         pid_t pid;
5563
5564         assert(unit);
5565         assert(command);
5566         assert(context);
5567         assert(ret);
5568         assert(params);
5569         assert(params->fds || (params->n_socket_fds + params->n_storage_fds <= 0));
5570
5571         LOG_CONTEXT_PUSH_UNIT(unit);
5572
5573         if (context->std_input == EXEC_INPUT_SOCKET ||
5574             context->std_output == EXEC_OUTPUT_SOCKET ||
5575             context->std_error == EXEC_OUTPUT_SOCKET) {
5576
5577                 if (params->n_socket_fds > 1)
5578                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EINVAL), "Got more than one socket.");
5579
5580                 if (params->n_socket_fds == 0)
5581                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EINVAL), "Got no socket.");
5582
5583                 socket_fd = params->fds[0];
5584         } else {
5585                 socket_fd = -EBADF;
5586                 fds = params->fds;
5587                 n_socket_fds = params->n_socket_fds;
5588                 n_storage_fds = params->n_storage_fds;
5589         }
5590
5591         r = exec_context_named_iofds(context, params, named_iofds);
5592         if (r < 0)
5593                 return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m");
5594
5595         r = exec_context_load_environment(unit, context, &files_env);
5596         if (r < 0)
5597                 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
5598
5599         line = quote_command_line(command->argv, SHELL_ESCAPE_EMPTY);
5600         if (!line)
5601                 return log_oom();
5602
5603         /* Fork with up-to-date SELinux label database, so the child inherits the up-to-date db
5604            and, until the next SELinux policy changes, we save further reloads in future children. */
5605         mac_selinux_maybe_reload();
5606
5607         log_unit_struct(unit, LOG_DEBUG,
5608                         LOG_UNIT_MESSAGE(unit, "About to execute %s", line),
5609                         "EXECUTABLE=%s", command->path, /* We won't know the real executable path until we create
5610                                                            the mount namespace in the child, but we want to log
5611                                                            from the parent, so we need to use the (possibly
5612                                                            inaccurate) path here. */
5613                         LOG_UNIT_INVOCATION_ID(unit));
5614
5615         if (params->cgroup_path) {
5616                 r = exec_parameters_get_cgroup_path(params, &subcgroup_path);
5617                 if (r < 0)
5618                         return log_unit_error_errno(unit, r, "Failed to acquire subcgroup path: %m");
5619                 if (r > 0) { /* We are using a child cgroup */
5620                         r = cg_create(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path);
5621                         if (r < 0)
5622                                 return log_unit_error_errno(unit, r, "Failed to create control group '%s': %m", subcgroup_path);
5623
5624                         /* Normally we would not propagate the xattrs to children but since we created this
5625                          * sub-cgroup internally we should do it. */
5626                         cgroup_oomd_xattr_apply(unit, subcgroup_path);
5627                         cgroup_log_xattr_apply(unit, subcgroup_path);
5628                 }
5629         }
5630
5631         pid = fork();
5632         if (pid < 0)
5633                 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
5634
5635         if (pid == 0) {
5636                 int exit_status = EXIT_SUCCESS;
5637
5638                 r = exec_child(unit,
5639                                command,
5640                                context,
5641                                params,
5642                                runtime,
5643                                dcreds,
5644                                cgroup_context,
5645                                socket_fd,
5646                                named_iofds,
5647                                fds,
5648                                n_socket_fds,
5649                                n_storage_fds,
5650                                files_env,
5651                                unit->manager->user_lookup_fds[1],
5652                                &exit_status);
5653
5654                 if (r < 0) {
5655                         const char *status =
5656                                 exit_status_to_string(exit_status,
5657                                                       EXIT_STATUS_LIBC | EXIT_STATUS_SYSTEMD);
5658
5659                         log_unit_struct_errno(unit, LOG_ERR, r,
5660                                               "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
5661                                               LOG_UNIT_INVOCATION_ID(unit),
5662                                               LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
5663                                                                status, command->path),
5664                                               "EXECUTABLE=%s", command->path);
5665                 }
5666
5667                 _exit(exit_status);
5668         }
5669
5670         log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
5671
5672         /* We add the new process to the cgroup both in the child (so that we can be sure that no user code is ever
5673          * executed outside of the cgroup) and in the parent (so that we can be sure that when we kill the cgroup the
5674          * process will be killed too). */
5675         if (subcgroup_path)
5676                 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path, pid);
5677
5678         exec_status_start(&command->exec_status, pid);
5679
5680         *ret = pid;
5681         return 0;
5682 }
5683
5684 void exec_context_init(ExecContext *c) {
5685         assert(c);
5686
5687         c->umask = 0022;
5688         c->ioprio = IOPRIO_DEFAULT_CLASS_AND_PRIO;
5689         c->cpu_sched_policy = SCHED_OTHER;
5690         c->syslog_priority = LOG_DAEMON|LOG_INFO;
5691         c->syslog_level_prefix = true;
5692         c->ignore_sigpipe = true;
5693         c->timer_slack_nsec = NSEC_INFINITY;
5694         c->personality = PERSONALITY_INVALID;
5695         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++)
5696                 c->directories[t].mode = 0755;
5697         c->timeout_clean_usec = USEC_INFINITY;
5698         c->capability_bounding_set = CAP_MASK_UNSET;
5699         assert_cc(NAMESPACE_FLAGS_INITIAL != NAMESPACE_FLAGS_ALL);
5700         c->restrict_namespaces = NAMESPACE_FLAGS_INITIAL;
5701         c->log_level_max = -1;
5702 #if HAVE_SECCOMP
5703         c->syscall_errno = SECCOMP_ERROR_NUMBER_KILL;
5704 #endif
5705         c->tty_rows = UINT_MAX;
5706         c->tty_cols = UINT_MAX;
5707         numa_policy_reset(&c->numa_policy);
5708         c->private_mounts = -1;
5709 }
5710
5711 void exec_context_done(ExecContext *c) {
5712         assert(c);
5713
5714         c->environment = strv_free(c->environment);
5715         c->environment_files = strv_free(c->environment_files);
5716         c->pass_environment = strv_free(c->pass_environment);
5717         c->unset_environment = strv_free(c->unset_environment);
5718
5719         rlimit_free_all(c->rlimit);
5720
5721         for (size_t l = 0; l < 3; l++) {
5722                 c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);
5723                 c->stdio_file[l] = mfree(c->stdio_file[l]);
5724         }
5725
5726         c->working_directory = mfree(c->working_directory);
5727         c->root_directory = mfree(c->root_directory);
5728         c->root_image = mfree(c->root_image);
5729         c->root_image_options = mount_options_free_all(c->root_image_options);
5730         c->root_hash = mfree(c->root_hash);
5731         c->root_hash_size = 0;
5732         c->root_hash_path = mfree(c->root_hash_path);
5733         c->root_hash_sig = mfree(c->root_hash_sig);
5734         c->root_hash_sig_size = 0;
5735         c->root_hash_sig_path = mfree(c->root_hash_sig_path);
5736         c->root_verity = mfree(c->root_verity);
5737         c->extension_images = mount_image_free_many(c->extension_images, &c->n_extension_images);
5738         c->extension_directories = strv_free(c->extension_directories);
5739         c->tty_path = mfree(c->tty_path);
5740         c->syslog_identifier = mfree(c->syslog_identifier);
5741         c->user = mfree(c->user);
5742         c->group = mfree(c->group);
5743
5744         c->supplementary_groups = strv_free(c->supplementary_groups);
5745
5746         c->pam_name = mfree(c->pam_name);
5747
5748         c->read_only_paths = strv_free(c->read_only_paths);
5749         c->read_write_paths = strv_free(c->read_write_paths);
5750         c->inaccessible_paths = strv_free(c->inaccessible_paths);
5751         c->exec_paths = strv_free(c->exec_paths);
5752         c->no_exec_paths = strv_free(c->no_exec_paths);
5753         c->exec_search_path = strv_free(c->exec_search_path);
5754
5755         bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
5756         c->bind_mounts = NULL;
5757         c->n_bind_mounts = 0;
5758         temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);
5759         c->temporary_filesystems = NULL;
5760         c->n_temporary_filesystems = 0;
5761         c->mount_images = mount_image_free_many(c->mount_images, &c->n_mount_images);
5762
5763         cpu_set_reset(&c->cpu_set);
5764         numa_policy_reset(&c->numa_policy);
5765
5766         c->utmp_id = mfree(c->utmp_id);
5767         c->selinux_context = mfree(c->selinux_context);
5768         c->apparmor_profile = mfree(c->apparmor_profile);
5769         c->smack_process_label = mfree(c->smack_process_label);
5770
5771         c->restrict_filesystems = set_free(c->restrict_filesystems);
5772
5773         c->syscall_filter = hashmap_free(c->syscall_filter);
5774         c->syscall_archs = set_free(c->syscall_archs);
5775         c->address_families = set_free(c->address_families);
5776
5777         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++)
5778                 exec_directory_done(&c->directories[t]);
5779
5780         c->log_level_max = -1;
5781
5782         exec_context_free_log_extra_fields(c);
5783         c->log_filter_allowed_patterns = set_free(c->log_filter_allowed_patterns);
5784         c->log_filter_denied_patterns = set_free(c->log_filter_denied_patterns);
5785
5786         c->log_ratelimit_interval_usec = 0;
5787         c->log_ratelimit_burst = 0;
5788
5789         c->stdin_data = mfree(c->stdin_data);
5790         c->stdin_data_size = 0;
5791
5792         c->network_namespace_path = mfree(c->network_namespace_path);
5793         c->ipc_namespace_path = mfree(c->ipc_namespace_path);
5794
5795         c->log_namespace = mfree(c->log_namespace);
5796
5797         c->load_credentials = hashmap_free(c->load_credentials);
5798         c->set_credentials = hashmap_free(c->set_credentials);
5799 }
5800
5801 int exec_context_destroy_runtime_directory(const ExecContext *c, const char *runtime_prefix) {
5802         assert(c);
5803
5804         if (!runtime_prefix)
5805                 return 0;
5806
5807         for (size_t i = 0; i < c->directories[EXEC_DIRECTORY_RUNTIME].n_items; i++) {
5808                 _cleanup_free_ char *p = NULL;
5809
5810                 if (exec_directory_is_private(c, EXEC_DIRECTORY_RUNTIME))
5811                         p = path_join(runtime_prefix, "private", c->directories[EXEC_DIRECTORY_RUNTIME].items[i].path);
5812                 else
5813                         p = path_join(runtime_prefix, c->directories[EXEC_DIRECTORY_RUNTIME].items[i].path);
5814                 if (!p)
5815                         return -ENOMEM;
5816
5817                 /* We execute this synchronously, since we need to be sure this is gone when we start the
5818                  * service next. */
5819                 (void) rm_rf(p, REMOVE_ROOT);
5820
5821                 STRV_FOREACH(symlink, c->directories[EXEC_DIRECTORY_RUNTIME].items[i].symlinks) {
5822                         _cleanup_free_ char *symlink_abs = NULL;
5823
5824                         if (exec_directory_is_private(c, EXEC_DIRECTORY_RUNTIME))
5825                                 symlink_abs = path_join(runtime_prefix, "private", *symlink);
5826                         else
5827                                 symlink_abs = path_join(runtime_prefix, *symlink);
5828                         if (!symlink_abs)
5829                                 return -ENOMEM;
5830
5831                         (void) unlink(symlink_abs);
5832                 }
5833         }
5834
5835         return 0;
5836 }
5837
5838 int exec_context_destroy_credentials(const ExecContext *c, const char *runtime_prefix, const char *unit) {
5839         _cleanup_free_ char *p = NULL;
5840
5841         assert(c);
5842
5843         if (!runtime_prefix || !unit)
5844                 return 0;
5845
5846         p = path_join(runtime_prefix, "credentials", unit);
5847         if (!p)
5848                 return -ENOMEM;
5849
5850         /* This is either a tmpfs/ramfs of its own, or a plain directory. Either way, let's first try to
5851          * unmount it, and afterwards remove the mount point */
5852         (void) umount2(p, MNT_DETACH|UMOUNT_NOFOLLOW);
5853         (void) rm_rf(p, REMOVE_ROOT|REMOVE_CHMOD);
5854
5855         return 0;
5856 }
5857
5858 int exec_context_destroy_mount_ns_dir(Unit *u) {
5859         _cleanup_free_ char *p = NULL;
5860
5861         if (!u || !MANAGER_IS_SYSTEM(u->manager))
5862                 return 0;
5863
5864         p = path_join("/run/systemd/propagate/", u->id);
5865         if (!p)
5866                 return -ENOMEM;
5867
5868         /* This is only filled transiently (see mount_in_namespace()), should be empty or even non-existent*/
5869         if (rmdir(p) < 0 && errno != ENOENT)
5870                 log_unit_debug_errno(u, errno, "Unable to remove propagation dir '%s', ignoring: %m", p);
5871
5872         return 0;
5873 }
5874
5875 static void exec_command_done(ExecCommand *c) {
5876         assert(c);
5877
5878         c->path = mfree(c->path);
5879         c->argv = strv_free(c->argv);
5880 }
5881
5882 void exec_command_done_array(ExecCommand *c, size_t n) {
5883         for (size_t i = 0; i < n; i++)
5884                 exec_command_done(c+i);
5885 }
5886
5887 ExecCommand* exec_command_free_list(ExecCommand *c) {
5888         ExecCommand *i;
5889
5890         while ((i = c)) {
5891                 LIST_REMOVE(command, c, i);
5892                 exec_command_done(i);
5893                 free(i);
5894         }
5895
5896         return NULL;
5897 }
5898
5899 void exec_command_free_array(ExecCommand **c, size_t n) {
5900         for (size_t i = 0; i < n; i++)
5901                 c[i] = exec_command_free_list(c[i]);
5902 }
5903
5904 void exec_command_reset_status_array(ExecCommand *c, size_t n) {
5905         for (size_t i = 0; i < n; i++)
5906                 exec_status_reset(&c[i].exec_status);
5907 }
5908
5909 void exec_command_reset_status_list_array(ExecCommand **c, size_t n) {
5910         for (size_t i = 0; i < n; i++)
5911                 LIST_FOREACH(command, z, c[i])
5912                         exec_status_reset(&z->exec_status);
5913 }
5914
5915 typedef struct InvalidEnvInfo {
5916         const Unit *unit;
5917         const char *path;
5918 } InvalidEnvInfo;
5919
5920 static void invalid_env(const char *p, void *userdata) {
5921         InvalidEnvInfo *info = userdata;
5922
5923         log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
5924 }
5925
5926 const char* exec_context_fdname(const ExecContext *c, int fd_index) {
5927         assert(c);
5928
5929         switch (fd_index) {
5930
5931         case STDIN_FILENO:
5932                 if (c->std_input != EXEC_INPUT_NAMED_FD)
5933                         return NULL;
5934
5935                 return c->stdio_fdname[STDIN_FILENO] ?: "stdin";
5936
5937         case STDOUT_FILENO:
5938                 if (c->std_output != EXEC_OUTPUT_NAMED_FD)
5939                         return NULL;
5940
5941                 return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";
5942
5943         case STDERR_FILENO:
5944                 if (c->std_error != EXEC_OUTPUT_NAMED_FD)
5945                         return NULL;
5946
5947                 return c->stdio_fdname[STDERR_FILENO] ?: "stderr";
5948
5949         default:
5950                 return NULL;
5951         }
5952 }
5953
5954 static int exec_context_named_iofds(
5955                 const ExecContext *c,
5956                 const ExecParameters *p,
5957                 int named_iofds[static 3]) {
5958
5959         size_t targets;
5960         const char* stdio_fdname[3];
5961         size_t n_fds;
5962
5963         assert(c);
5964         assert(p);
5965         assert(named_iofds);
5966
5967         targets = (c->std_input == EXEC_INPUT_NAMED_FD) +
5968                   (c->std_output == EXEC_OUTPUT_NAMED_FD) +
5969                   (c->std_error == EXEC_OUTPUT_NAMED_FD);
5970
5971         for (size_t i = 0; i < 3; i++)
5972                 stdio_fdname[i] = exec_context_fdname(c, i);
5973
5974         n_fds = p->n_storage_fds + p->n_socket_fds;
5975
5976         for (size_t i = 0; i < n_fds  && targets > 0; i++)
5977                 if (named_iofds[STDIN_FILENO] < 0 &&
5978                     c->std_input == EXEC_INPUT_NAMED_FD &&
5979                     stdio_fdname[STDIN_FILENO] &&
5980                     streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) {
5981
5982                         named_iofds[STDIN_FILENO] = p->fds[i];
5983                         targets--;
5984
5985                 } else if (named_iofds[STDOUT_FILENO] < 0 &&
5986                            c->std_output == EXEC_OUTPUT_NAMED_FD &&
5987                            stdio_fdname[STDOUT_FILENO] &&
5988                            streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) {
5989
5990                         named_iofds[STDOUT_FILENO] = p->fds[i];
5991                         targets--;
5992
5993                 } else if (named_iofds[STDERR_FILENO] < 0 &&
5994                            c->std_error == EXEC_OUTPUT_NAMED_FD &&
5995                            stdio_fdname[STDERR_FILENO] &&
5996                            streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) {
5997
5998                         named_iofds[STDERR_FILENO] = p->fds[i];
5999                         targets--;
6000                 }
6001
6002         return targets == 0 ? 0 : -ENOENT;
6003 }
6004
6005 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***ret) {
6006         _cleanup_strv_free_ char **v = NULL;
6007         int r;
6008
6009         assert(c);
6010         assert(ret);
6011
6012         STRV_FOREACH(i, c->environment_files) {
6013                 _cleanup_globfree_ glob_t pglob = {};
6014                 bool ignore = false;
6015                 char *fn = *i;
6016
6017                 if (fn[0] == '-') {
6018                         ignore = true;
6019                         fn++;
6020                 }
6021
6022                 if (!path_is_absolute(fn)) {
6023                         if (ignore)
6024                                 continue;
6025                         return -EINVAL;
6026                 }
6027
6028                 /* Filename supports globbing, take all matching files */
6029                 r = safe_glob(fn, 0, &pglob);
6030                 if (r < 0) {
6031                         if (ignore)
6032                                 continue;
6033                         return r;
6034                 }
6035
6036                 /* When we don't match anything, -ENOENT should be returned */
6037                 assert(pglob.gl_pathc > 0);
6038
6039                 for (unsigned n = 0; n < pglob.gl_pathc; n++) {
6040                         _cleanup_strv_free_ char **p = NULL;
6041
6042                         r = load_env_file(NULL, pglob.gl_pathv[n], &p);
6043                         if (r < 0) {
6044                                 if (ignore)
6045                                         continue;
6046                                 return r;
6047                         }
6048
6049                         /* Log invalid environment variables with filename */
6050                         if (p) {
6051                                 InvalidEnvInfo info = {
6052                                         .unit = unit,
6053                                         .path = pglob.gl_pathv[n]
6054                                 };
6055
6056                                 p = strv_env_clean_with_callback(p, invalid_env, &info);
6057                         }
6058
6059                         if (!v)
6060                                 v = TAKE_PTR(p);
6061                         else {
6062                                 char **m = strv_env_merge(v, p);
6063                                 if (!m)
6064                                         return -ENOMEM;
6065
6066                                 strv_free_and_replace(v, m);
6067                         }
6068                 }
6069         }
6070
6071         *ret = TAKE_PTR(v);
6072
6073         return 0;
6074 }
6075
6076 static bool tty_may_match_dev_console(const char *tty) {
6077         _cleanup_free_ char *resolved = NULL;
6078
6079         if (!tty)
6080                 return true;
6081
6082         tty = skip_dev_prefix(tty);
6083
6084         /* trivial identity? */
6085         if (streq(tty, "console"))
6086                 return true;
6087
6088         if (resolve_dev_console(&resolved) < 0)
6089                 return true; /* if we could not resolve, assume it may */
6090
6091         /* "tty0" means the active VC, so it may be the same sometimes */
6092         return path_equal(resolved, tty) || (streq(resolved, "tty0") && tty_is_vc(tty));
6093 }
6094
6095 static bool exec_context_may_touch_tty(const ExecContext *ec) {
6096         assert(ec);
6097
6098         return ec->tty_reset ||
6099                 ec->tty_vhangup ||
6100                 ec->tty_vt_disallocate ||
6101                 is_terminal_input(ec->std_input) ||
6102                 is_terminal_output(ec->std_output) ||
6103                 is_terminal_output(ec->std_error);
6104 }
6105
6106 bool exec_context_may_touch_console(const ExecContext *ec) {
6107
6108         return exec_context_may_touch_tty(ec) &&
6109                tty_may_match_dev_console(exec_context_tty_path(ec));
6110 }
6111
6112 static void strv_fprintf(FILE *f, char **l) {
6113         assert(f);
6114
6115         STRV_FOREACH(g, l)
6116                 fprintf(f, " %s", *g);
6117 }
6118
6119 static void strv_dump(FILE* f, const char *prefix, const char *name, char **strv) {
6120         assert(f);
6121         assert(prefix);
6122         assert(name);
6123
6124         if (!strv_isempty(strv)) {
6125                 fprintf(f, "%s%s:", prefix, name);
6126                 strv_fprintf(f, strv);
6127                 fputs("\n", f);
6128         }
6129 }
6130
6131 void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
6132         int r;
6133
6134         assert(c);
6135         assert(f);
6136
6137         prefix = strempty(prefix);
6138
6139         fprintf(f,
6140                 "%sUMask: %04o\n"
6141                 "%sWorkingDirectory: %s\n"
6142                 "%sRootDirectory: %s\n"
6143                 "%sNonBlocking: %s\n"
6144                 "%sPrivateTmp: %s\n"
6145                 "%sPrivateDevices: %s\n"
6146                 "%sProtectKernelTunables: %s\n"
6147                 "%sProtectKernelModules: %s\n"
6148                 "%sProtectKernelLogs: %s\n"
6149                 "%sProtectClock: %s\n"
6150                 "%sProtectControlGroups: %s\n"
6151                 "%sPrivateNetwork: %s\n"
6152                 "%sPrivateUsers: %s\n"
6153                 "%sProtectHome: %s\n"
6154                 "%sProtectSystem: %s\n"
6155                 "%sMountAPIVFS: %s\n"
6156                 "%sIgnoreSIGPIPE: %s\n"
6157                 "%sMemoryDenyWriteExecute: %s\n"
6158                 "%sRestrictRealtime: %s\n"
6159                 "%sRestrictSUIDSGID: %s\n"
6160                 "%sKeyringMode: %s\n"
6161                 "%sProtectHostname: %s\n"
6162                 "%sProtectProc: %s\n"
6163                 "%sProcSubset: %s\n",
6164                 prefix, c->umask,
6165                 prefix, empty_to_root(c->working_directory),
6166                 prefix, empty_to_root(c->root_directory),
6167                 prefix, yes_no(c->non_blocking),
6168                 prefix, yes_no(c->private_tmp),
6169                 prefix, yes_no(c->private_devices),
6170                 prefix, yes_no(c->protect_kernel_tunables),
6171                 prefix, yes_no(c->protect_kernel_modules),
6172                 prefix, yes_no(c->protect_kernel_logs),
6173                 prefix, yes_no(c->protect_clock),
6174                 prefix, yes_no(c->protect_control_groups),
6175                 prefix, yes_no(c->private_network),
6176                 prefix, yes_no(c->private_users),
6177                 prefix, protect_home_to_string(c->protect_home),
6178                 prefix, protect_system_to_string(c->protect_system),
6179                 prefix, yes_no(exec_context_get_effective_mount_apivfs(c)),
6180                 prefix, yes_no(c->ignore_sigpipe),
6181                 prefix, yes_no(c->memory_deny_write_execute),
6182                 prefix, yes_no(c->restrict_realtime),
6183                 prefix, yes_no(c->restrict_suid_sgid),
6184                 prefix, exec_keyring_mode_to_string(c->keyring_mode),
6185                 prefix, yes_no(c->protect_hostname),
6186                 prefix, protect_proc_to_string(c->protect_proc),
6187                 prefix, proc_subset_to_string(c->proc_subset));
6188
6189         if (c->root_image)
6190                 fprintf(f, "%sRootImage: %s\n", prefix, c->root_image);
6191
6192         if (c->root_image_options) {
6193                 fprintf(f, "%sRootImageOptions:", prefix);
6194                 LIST_FOREACH(mount_options, o, c->root_image_options)
6195                         if (!isempty(o->options))
6196                                 fprintf(f, " %s:%s",
6197                                         partition_designator_to_string(o->partition_designator),
6198                                         o->options);
6199                 fprintf(f, "\n");
6200         }
6201
6202         if (c->root_hash) {
6203                 _cleanup_free_ char *encoded = NULL;
6204                 encoded = hexmem(c->root_hash, c->root_hash_size);
6205                 if (encoded)
6206                         fprintf(f, "%sRootHash: %s\n", prefix, encoded);
6207         }
6208
6209         if (c->root_hash_path)
6210                 fprintf(f, "%sRootHash: %s\n", prefix, c->root_hash_path);
6211
6212         if (c->root_hash_sig) {
6213                 _cleanup_free_ char *encoded = NULL;
6214                 ssize_t len;
6215                 len = base64mem(c->root_hash_sig, c->root_hash_sig_size, &encoded);
6216                 if (len)
6217                         fprintf(f, "%sRootHashSignature: base64:%s\n", prefix, encoded);
6218         }
6219
6220         if (c->root_hash_sig_path)
6221                 fprintf(f, "%sRootHashSignature: %s\n", prefix, c->root_hash_sig_path);
6222
6223         if (c->root_verity)
6224                 fprintf(f, "%sRootVerity: %s\n", prefix, c->root_verity);
6225
6226         STRV_FOREACH(e, c->environment)
6227                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
6228
6229         STRV_FOREACH(e, c->environment_files)
6230                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
6231
6232         STRV_FOREACH(e, c->pass_environment)
6233                 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
6234
6235         STRV_FOREACH(e, c->unset_environment)
6236                 fprintf(f, "%sUnsetEnvironment: %s\n", prefix, *e);
6237
6238         fprintf(f, "%sRuntimeDirectoryPreserve: %s\n", prefix, exec_preserve_mode_to_string(c->runtime_directory_preserve_mode));
6239
6240         for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
6241                 fprintf(f, "%s%sMode: %04o\n", prefix, exec_directory_type_to_string(dt), c->directories[dt].mode);
6242
6243                 for (size_t i = 0; i < c->directories[dt].n_items; i++) {
6244                         fprintf(f, "%s%s: %s\n", prefix, exec_directory_type_to_string(dt), c->directories[dt].items[i].path);
6245
6246                         STRV_FOREACH(d, c->directories[dt].items[i].symlinks)
6247                                 fprintf(f, "%s%s: %s:%s\n", prefix, exec_directory_type_symlink_to_string(dt), c->directories[dt].items[i].path, *d);
6248                 }
6249         }
6250
6251         fprintf(f, "%sTimeoutCleanSec: %s\n", prefix, FORMAT_TIMESPAN(c->timeout_clean_usec, USEC_PER_SEC));
6252
6253         if (c->nice_set)
6254                 fprintf(f, "%sNice: %i\n", prefix, c->nice);
6255
6256         if (c->oom_score_adjust_set)
6257                 fprintf(f, "%sOOMScoreAdjust: %i\n", prefix, c->oom_score_adjust);
6258
6259         if (c->coredump_filter_set)
6260                 fprintf(f, "%sCoredumpFilter: 0x%"PRIx64"\n", prefix, c->coredump_filter);
6261
6262         for (unsigned i = 0; i < RLIM_NLIMITS; i++)
6263                 if (c->rlimit[i]) {
6264                         fprintf(f, "%sLimit%s: " RLIM_FMT "\n",
6265                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
6266                         fprintf(f, "%sLimit%sSoft: " RLIM_FMT "\n",
6267                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
6268                 }
6269
6270         if (c->ioprio_set) {
6271                 _cleanup_free_ char *class_str = NULL;
6272
6273                 r = ioprio_class_to_string_alloc(ioprio_prio_class(c->ioprio), &class_str);
6274                 if (r >= 0)
6275                         fprintf(f, "%sIOSchedulingClass: %s\n", prefix, class_str);
6276
6277                 fprintf(f, "%sIOPriority: %d\n", prefix, ioprio_prio_data(c->ioprio));
6278         }
6279
6280         if (c->cpu_sched_set) {
6281                 _cleanup_free_ char *policy_str = NULL;
6282
6283                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
6284                 if (r >= 0)
6285                         fprintf(f, "%sCPUSchedulingPolicy: %s\n", prefix, policy_str);
6286
6287                 fprintf(f,
6288                         "%sCPUSchedulingPriority: %i\n"
6289                         "%sCPUSchedulingResetOnFork: %s\n",
6290                         prefix, c->cpu_sched_priority,
6291                         prefix, yes_no(c->cpu_sched_reset_on_fork));
6292         }
6293
6294         if (c->cpu_set.set) {
6295                 _cleanup_free_ char *affinity = NULL;
6296
6297                 affinity = cpu_set_to_range_string(&c->cpu_set);
6298                 fprintf(f, "%sCPUAffinity: %s\n", prefix, affinity);
6299         }
6300
6301         if (mpol_is_valid(numa_policy_get_type(&c->numa_policy))) {
6302                 _cleanup_free_ char *nodes = NULL;
6303
6304                 nodes = cpu_set_to_range_string(&c->numa_policy.nodes);
6305                 fprintf(f, "%sNUMAPolicy: %s\n", prefix, mpol_to_string(numa_policy_get_type(&c->numa_policy)));
6306                 fprintf(f, "%sNUMAMask: %s\n", prefix, strnull(nodes));
6307         }
6308
6309         if (c->timer_slack_nsec != NSEC_INFINITY)
6310                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
6311
6312         fprintf(f,
6313                 "%sStandardInput: %s\n"
6314                 "%sStandardOutput: %s\n"
6315                 "%sStandardError: %s\n",
6316                 prefix, exec_input_to_string(c->std_input),
6317                 prefix, exec_output_to_string(c->std_output),
6318                 prefix, exec_output_to_string(c->std_error));
6319
6320         if (c->std_input == EXEC_INPUT_NAMED_FD)
6321                 fprintf(f, "%sStandardInputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDIN_FILENO]);
6322         if (c->std_output == EXEC_OUTPUT_NAMED_FD)
6323                 fprintf(f, "%sStandardOutputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDOUT_FILENO]);
6324         if (c->std_error == EXEC_OUTPUT_NAMED_FD)
6325                 fprintf(f, "%sStandardErrorFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDERR_FILENO]);
6326
6327         if (c->std_input == EXEC_INPUT_FILE)
6328                 fprintf(f, "%sStandardInputFile: %s\n", prefix, c->stdio_file[STDIN_FILENO]);
6329         if (c->std_output == EXEC_OUTPUT_FILE)
6330                 fprintf(f, "%sStandardOutputFile: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
6331         if (c->std_output == EXEC_OUTPUT_FILE_APPEND)
6332                 fprintf(f, "%sStandardOutputFileToAppend: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
6333         if (c->std_output == EXEC_OUTPUT_FILE_TRUNCATE)
6334                 fprintf(f, "%sStandardOutputFileToTruncate: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
6335         if (c->std_error == EXEC_OUTPUT_FILE)
6336                 fprintf(f, "%sStandardErrorFile: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
6337         if (c->std_error == EXEC_OUTPUT_FILE_APPEND)
6338                 fprintf(f, "%sStandardErrorFileToAppend: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
6339         if (c->std_error == EXEC_OUTPUT_FILE_TRUNCATE)
6340                 fprintf(f, "%sStandardErrorFileToTruncate: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
6341
6342         if (c->tty_path)
6343                 fprintf(f,
6344                         "%sTTYPath: %s\n"
6345                         "%sTTYReset: %s\n"
6346                         "%sTTYVHangup: %s\n"
6347                         "%sTTYVTDisallocate: %s\n"
6348                         "%sTTYRows: %u\n"
6349                         "%sTTYColumns: %u\n",
6350                         prefix, c->tty_path,
6351                         prefix, yes_no(c->tty_reset),
6352                         prefix, yes_no(c->tty_vhangup),
6353                         prefix, yes_no(c->tty_vt_disallocate),
6354                         prefix, c->tty_rows,
6355                         prefix, c->tty_cols);
6356
6357         if (IN_SET(c->std_output,
6358                    EXEC_OUTPUT_KMSG,
6359                    EXEC_OUTPUT_JOURNAL,
6360                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
6361                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE) ||
6362             IN_SET(c->std_error,
6363                    EXEC_OUTPUT_KMSG,
6364                    EXEC_OUTPUT_JOURNAL,
6365                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
6366                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE)) {
6367
6368                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
6369
6370                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
6371                 if (r >= 0)
6372                         fprintf(f, "%sSyslogFacility: %s\n", prefix, fac_str);
6373
6374                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
6375                 if (r >= 0)
6376                         fprintf(f, "%sSyslogLevel: %s\n", prefix, lvl_str);
6377         }
6378
6379         if (c->log_level_max >= 0) {
6380                 _cleanup_free_ char *t = NULL;
6381
6382                 (void) log_level_to_string_alloc(c->log_level_max, &t);
6383
6384                 fprintf(f, "%sLogLevelMax: %s\n", prefix, strna(t));
6385         }
6386
6387         if (c->log_ratelimit_interval_usec > 0)
6388                 fprintf(f,
6389                         "%sLogRateLimitIntervalSec: %s\n",
6390                         prefix, FORMAT_TIMESPAN(c->log_ratelimit_interval_usec, USEC_PER_SEC));
6391
6392         if (c->log_ratelimit_burst > 0)
6393                 fprintf(f, "%sLogRateLimitBurst: %u\n", prefix, c->log_ratelimit_burst);
6394
6395         if (!set_isempty(c->log_filter_allowed_patterns) || !set_isempty(c->log_filter_denied_patterns)) {
6396                 fprintf(f, "%sLogFilterPatterns:", prefix);
6397
6398                 char *pattern;
6399                 SET_FOREACH(pattern, c->log_filter_allowed_patterns)
6400                         fprintf(f, " %s", pattern);
6401                 SET_FOREACH(pattern, c->log_filter_denied_patterns)
6402                         fprintf(f, " ~%s", pattern);
6403                 fputc('\n', f);
6404         }
6405
6406         for (size_t j = 0; j < c->n_log_extra_fields; j++) {
6407                 fprintf(f, "%sLogExtraFields: ", prefix);
6408                 fwrite(c->log_extra_fields[j].iov_base,
6409                        1, c->log_extra_fields[j].iov_len,
6410                        f);
6411                 fputc('\n', f);
6412         }
6413
6414         if (c->log_namespace)
6415                 fprintf(f, "%sLogNamespace: %s\n", prefix, c->log_namespace);
6416
6417         if (c->secure_bits) {
6418                 _cleanup_free_ char *str = NULL;
6419
6420                 r = secure_bits_to_string_alloc(c->secure_bits, &str);
6421                 if (r >= 0)
6422                         fprintf(f, "%sSecure Bits: %s\n", prefix, str);
6423         }
6424
6425         if (c->capability_bounding_set != CAP_MASK_UNSET) {
6426                 _cleanup_free_ char *str = NULL;
6427
6428                 r = capability_set_to_string(c->capability_bounding_set, &str);
6429                 if (r >= 0)
6430                         fprintf(f, "%sCapabilityBoundingSet: %s\n", prefix, str);
6431         }
6432
6433         if (c->capability_ambient_set != 0) {
6434                 _cleanup_free_ char *str = NULL;
6435
6436                 r = capability_set_to_string(c->capability_ambient_set, &str);
6437                 if (r >= 0)
6438                         fprintf(f, "%sAmbientCapabilities: %s\n", prefix, str);
6439         }
6440
6441         if (c->user)
6442                 fprintf(f, "%sUser: %s\n", prefix, c->user);
6443         if (c->group)
6444                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
6445
6446         fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
6447
6448         strv_dump(f, prefix, "SupplementaryGroups", c->supplementary_groups);
6449
6450         if (c->pam_name)
6451                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
6452
6453         strv_dump(f, prefix, "ReadWritePaths", c->read_write_paths);
6454         strv_dump(f, prefix, "ReadOnlyPaths", c->read_only_paths);
6455         strv_dump(f, prefix, "InaccessiblePaths", c->inaccessible_paths);
6456         strv_dump(f, prefix, "ExecPaths", c->exec_paths);
6457         strv_dump(f, prefix, "NoExecPaths", c->no_exec_paths);
6458         strv_dump(f, prefix, "ExecSearchPath", c->exec_search_path);
6459
6460         for (size_t i = 0; i < c->n_bind_mounts; i++)
6461                 fprintf(f, "%s%s: %s%s:%s:%s\n", prefix,
6462                         c->bind_mounts[i].read_only ? "BindReadOnlyPaths" : "BindPaths",
6463                         c->bind_mounts[i].ignore_enoent ? "-": "",
6464                         c->bind_mounts[i].source,
6465                         c->bind_mounts[i].destination,
6466                         c->bind_mounts[i].recursive ? "rbind" : "norbind");
6467
6468         for (size_t i = 0; i < c->n_temporary_filesystems; i++) {
6469                 const TemporaryFileSystem *t = c->temporary_filesystems + i;
6470
6471                 fprintf(f, "%sTemporaryFileSystem: %s%s%s\n", prefix,
6472                         t->path,
6473                         isempty(t->options) ? "" : ":",
6474                         strempty(t->options));
6475         }
6476
6477         if (c->utmp_id)
6478                 fprintf(f,
6479                         "%sUtmpIdentifier: %s\n",
6480                         prefix, c->utmp_id);
6481
6482         if (c->selinux_context)
6483                 fprintf(f,
6484                         "%sSELinuxContext: %s%s\n",
6485                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
6486
6487         if (c->apparmor_profile)
6488                 fprintf(f,
6489                         "%sAppArmorProfile: %s%s\n",
6490                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
6491
6492         if (c->smack_process_label)
6493                 fprintf(f,
6494                         "%sSmackProcessLabel: %s%s\n",
6495                         prefix, c->smack_process_label_ignore ? "-" : "", c->smack_process_label);
6496
6497         if (c->personality != PERSONALITY_INVALID)
6498                 fprintf(f,
6499                         "%sPersonality: %s\n",
6500                         prefix, strna(personality_to_string(c->personality)));
6501
6502         fprintf(f,
6503                 "%sLockPersonality: %s\n",
6504                 prefix, yes_no(c->lock_personality));
6505
6506         if (c->syscall_filter) {
6507                 fprintf(f,
6508                         "%sSystemCallFilter: ",
6509                         prefix);
6510
6511                 if (!c->syscall_allow_list)
6512                         fputc('~', f);
6513
6514 #if HAVE_SECCOMP
6515                 void *id, *val;
6516                 bool first = true;
6517                 HASHMAP_FOREACH_KEY(val, id, c->syscall_filter) {
6518                         _cleanup_free_ char *name = NULL;
6519                         const char *errno_name = NULL;
6520                         int num = PTR_TO_INT(val);
6521
6522                         if (first)
6523                                 first = false;
6524                         else
6525                                 fputc(' ', f);
6526
6527                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
6528                         fputs(strna(name), f);
6529
6530                         if (num >= 0) {
6531                                 errno_name = seccomp_errno_or_action_to_string(num);
6532                                 if (errno_name)
6533                                         fprintf(f, ":%s", errno_name);
6534                                 else
6535                                         fprintf(f, ":%d", num);
6536                         }
6537                 }
6538 #endif
6539
6540                 fputc('\n', f);
6541         }
6542
6543         if (c->syscall_archs) {
6544                 fprintf(f,
6545                         "%sSystemCallArchitectures:",
6546                         prefix);
6547
6548 #if HAVE_SECCOMP
6549                 void *id;
6550                 SET_FOREACH(id, c->syscall_archs)
6551                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
6552 #endif
6553                 fputc('\n', f);
6554         }
6555
6556         if (exec_context_restrict_namespaces_set(c)) {
6557                 _cleanup_free_ char *s = NULL;
6558
6559                 r = namespace_flags_to_string(c->restrict_namespaces, &s);
6560                 if (r >= 0)
6561                         fprintf(f, "%sRestrictNamespaces: %s\n",
6562                                 prefix, strna(s));
6563         }
6564
6565 #if HAVE_LIBBPF
6566         if (exec_context_restrict_filesystems_set(c)) {
6567                 char *fs;
6568                 SET_FOREACH(fs, c->restrict_filesystems)
6569                         fprintf(f, "%sRestrictFileSystems: %s\n", prefix, fs);
6570         }
6571 #endif
6572
6573         if (c->network_namespace_path)
6574                 fprintf(f,
6575                         "%sNetworkNamespacePath: %s\n",
6576                         prefix, c->network_namespace_path);
6577
6578         if (c->syscall_errno > 0) {
6579                 fprintf(f, "%sSystemCallErrorNumber: ", prefix);
6580
6581 #if HAVE_SECCOMP
6582                 const char *errno_name = seccomp_errno_or_action_to_string(c->syscall_errno);
6583                 if (errno_name)
6584                         fputs(errno_name, f);
6585                 else
6586                         fprintf(f, "%d", c->syscall_errno);
6587 #endif
6588                 fputc('\n', f);
6589         }
6590
6591         for (size_t i = 0; i < c->n_mount_images; i++) {
6592                 fprintf(f, "%sMountImages: %s%s:%s", prefix,
6593                         c->mount_images[i].ignore_enoent ? "-": "",
6594                         c->mount_images[i].source,
6595                         c->mount_images[i].destination);
6596                 LIST_FOREACH(mount_options, o, c->mount_images[i].mount_options)
6597                         fprintf(f, ":%s:%s",
6598                                 partition_designator_to_string(o->partition_designator),
6599                                 strempty(o->options));
6600                 fprintf(f, "\n");
6601         }
6602
6603         for (size_t i = 0; i < c->n_extension_images; i++) {
6604                 fprintf(f, "%sExtensionImages: %s%s", prefix,
6605                         c->extension_images[i].ignore_enoent ? "-": "",
6606                         c->extension_images[i].source);
6607                 LIST_FOREACH(mount_options, o, c->extension_images[i].mount_options)
6608                         fprintf(f, ":%s:%s",
6609                                 partition_designator_to_string(o->partition_designator),
6610                                 strempty(o->options));
6611                 fprintf(f, "\n");
6612         }
6613
6614         strv_dump(f, prefix, "ExtensionDirectories", c->extension_directories);
6615 }
6616
6617 bool exec_context_maintains_privileges(const ExecContext *c) {
6618         assert(c);
6619
6620         /* Returns true if the process forked off would run under
6621          * an unchanged UID or as root. */
6622
6623         if (!c->user)
6624                 return true;
6625
6626         if (streq(c->user, "root") || streq(c->user, "0"))
6627                 return true;
6628
6629         return false;
6630 }
6631
6632 int exec_context_get_effective_ioprio(const ExecContext *c) {
6633         int p;
6634
6635         assert(c);
6636
6637         if (c->ioprio_set)
6638                 return c->ioprio;
6639
6640         p = ioprio_get(IOPRIO_WHO_PROCESS, 0);
6641         if (p < 0)
6642                 return IOPRIO_DEFAULT_CLASS_AND_PRIO;
6643
6644         return ioprio_normalize(p);
6645 }
6646
6647 bool exec_context_get_effective_mount_apivfs(const ExecContext *c) {
6648         assert(c);
6649
6650         /* Explicit setting wins */
6651         if (c->mount_apivfs_set)
6652                 return c->mount_apivfs;
6653
6654         /* Default to "yes" if root directory or image are specified */
6655         if (exec_context_with_rootfs(c))
6656                 return true;
6657
6658         return false;
6659 }
6660
6661 void exec_context_free_log_extra_fields(ExecContext *c) {
6662         assert(c);
6663
6664         for (size_t l = 0; l < c->n_log_extra_fields; l++)
6665                 free(c->log_extra_fields[l].iov_base);
6666         c->log_extra_fields = mfree(c->log_extra_fields);
6667         c->n_log_extra_fields = 0;
6668 }
6669
6670 void exec_context_revert_tty(ExecContext *c) {
6671         _cleanup_close_ int fd = -EBADF;
6672         const char *path;
6673         struct stat st;
6674         int r;
6675
6676         assert(c);
6677
6678         /* First, reset the TTY (possibly kicking everybody else from the TTY) */
6679         exec_context_tty_reset(c, NULL);
6680
6681         /* And then undo what chown_terminal() did earlier. Note that we only do this if we have a path
6682          * configured. If the TTY was passed to us as file descriptor we assume the TTY is opened and managed
6683          * by whoever passed it to us and thus knows better when and how to chmod()/chown() it back. */
6684         if (!exec_context_may_touch_tty(c))
6685                 return;
6686
6687         path = exec_context_tty_path(c);
6688         if (!path)
6689                 return;
6690
6691         fd = open(path, O_PATH|O_CLOEXEC);
6692         if (fd < 0)
6693                 return (void) log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno,
6694                                              "Failed to open TTY inode of '%s' to adjust ownership/access mode, ignoring: %m",
6695                                              path);
6696
6697         if (fstat(fd, &st) < 0)
6698                 return (void) log_warning_errno(errno, "Failed to stat TTY '%s', ignoring: %m", path);
6699
6700         /* Let's add a superficial check that we only do this for stuff that looks like a TTY. We only check
6701          * if things are a character device, since a proper check either means we'd have to open the TTY and
6702          * use isatty(), but we'd rather not do that since opening TTYs comes with all kinds of side-effects
6703          * and is slow. Or we'd have to hardcode dev_t major information, which we'd rather avoid. Why bother
6704          * with this at all? → https://github.com/systemd/systemd/issues/19213 */
6705         if (!S_ISCHR(st.st_mode))
6706                 return log_warning("Configured TTY '%s' is not actually a character device, ignoring.", path);
6707
6708         r = fchmod_and_chown(fd, TTY_MODE, 0, TTY_GID);
6709         if (r < 0)
6710                 log_warning_errno(r, "Failed to reset TTY ownership/access mode of %s, ignoring: %m", path);
6711 }
6712
6713 int exec_context_get_clean_directories(
6714                 ExecContext *c,
6715                 char **prefix,
6716                 ExecCleanMask mask,
6717                 char ***ret) {
6718
6719         _cleanup_strv_free_ char **l = NULL;
6720         int r;
6721
6722         assert(c);
6723         assert(prefix);
6724         assert(ret);
6725
6726         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
6727                 if (!FLAGS_SET(mask, 1U << t))
6728                         continue;
6729
6730                 if (!prefix[t])
6731                         continue;
6732
6733                 for (size_t i = 0; i < c->directories[t].n_items; i++) {
6734                         char *j;
6735
6736                         j = path_join(prefix[t], c->directories[t].items[i].path);
6737                         if (!j)
6738                                 return -ENOMEM;
6739
6740                         r = strv_consume(&l, j);
6741                         if (r < 0)
6742                                 return r;
6743
6744                         /* Also remove private directories unconditionally. */
6745                         if (t != EXEC_DIRECTORY_CONFIGURATION) {
6746                                 j = path_join(prefix[t], "private", c->directories[t].items[i].path);
6747                                 if (!j)
6748                                         return -ENOMEM;
6749
6750                                 r = strv_consume(&l, j);
6751                                 if (r < 0)
6752                                         return r;
6753                         }
6754
6755                         STRV_FOREACH(symlink, c->directories[t].items[i].symlinks) {
6756                                 j = path_join(prefix[t], *symlink);
6757                                 if (!j)
6758                                         return -ENOMEM;
6759
6760                                 r = strv_consume(&l, j);
6761                                 if (r < 0)
6762                                         return r;
6763                         }
6764                 }
6765         }
6766
6767         *ret = TAKE_PTR(l);
6768         return 0;
6769 }
6770
6771 int exec_context_get_clean_mask(ExecContext *c, ExecCleanMask *ret) {
6772         ExecCleanMask mask = 0;
6773
6774         assert(c);
6775         assert(ret);
6776
6777         for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++)
6778                 if (c->directories[t].n_items > 0)
6779                         mask |= 1U << t;
6780
6781         *ret = mask;
6782         return 0;
6783 }
6784
6785 bool exec_context_has_encrypted_credentials(ExecContext *c) {
6786         ExecLoadCredential *load_cred;
6787         ExecSetCredential *set_cred;
6788
6789         assert(c);
6790
6791         HASHMAP_FOREACH(load_cred, c->load_credentials)
6792                 if (load_cred->encrypted)
6793                         return true;
6794
6795         HASHMAP_FOREACH(set_cred, c->set_credentials)
6796                 if (set_cred->encrypted)
6797                         return true;
6798
6799         return false;
6800 }
6801
6802 void exec_status_start(ExecStatus *s, pid_t pid) {
6803         assert(s);
6804
6805         *s = (ExecStatus) {
6806                 .pid = pid,
6807         };
6808
6809         dual_timestamp_get(&s->start_timestamp);
6810 }
6811
6812 void exec_status_exit(ExecStatus *s, const ExecContext *context, pid_t pid, int code, int status) {
6813         assert(s);
6814
6815         if (s->pid != pid)
6816                 *s = (ExecStatus) {
6817                         .pid = pid,
6818                 };
6819
6820         dual_timestamp_get(&s->exit_timestamp);
6821
6822         s->code = code;
6823         s->status = status;
6824
6825         if (context && context->utmp_id)
6826                 (void) utmp_put_dead_process(context->utmp_id, pid, code, status);
6827 }
6828
6829 void exec_status_reset(ExecStatus *s) {
6830         assert(s);
6831
6832         *s = (ExecStatus) {};
6833 }
6834
6835 void exec_status_dump(const ExecStatus *s, FILE *f, const char *prefix) {
6836         assert(s);
6837         assert(f);
6838
6839         if (s->pid <= 0)
6840                 return;
6841
6842         prefix = strempty(prefix);
6843
6844         fprintf(f,
6845                 "%sPID: "PID_FMT"\n",
6846                 prefix, s->pid);
6847
6848         if (dual_timestamp_is_set(&s->start_timestamp))
6849                 fprintf(f,
6850                         "%sStart Timestamp: %s\n",
6851                         prefix, FORMAT_TIMESTAMP(s->start_timestamp.realtime));
6852
6853         if (dual_timestamp_is_set(&s->exit_timestamp))
6854                 fprintf(f,
6855                         "%sExit Timestamp: %s\n"
6856                         "%sExit Code: %s\n"
6857                         "%sExit Status: %i\n",
6858                         prefix, FORMAT_TIMESTAMP(s->exit_timestamp.realtime),
6859                         prefix, sigchld_code_to_string(s->code),
6860                         prefix, s->status);
6861 }
6862
6863 static void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
6864         _cleanup_free_ char *cmd = NULL;
6865         const char *prefix2;
6866
6867         assert(c);
6868         assert(f);
6869
6870         prefix = strempty(prefix);
6871         prefix2 = strjoina(prefix, "\t");
6872
6873         cmd = quote_command_line(c->argv, SHELL_ESCAPE_EMPTY);
6874
6875         fprintf(f,
6876                 "%sCommand Line: %s\n",
6877                 prefix, strnull(cmd));
6878
6879         exec_status_dump(&c->exec_status, f, prefix2);
6880 }
6881
6882 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
6883         assert(f);
6884
6885         prefix = strempty(prefix);
6886
6887         LIST_FOREACH(command, i, c)
6888                 exec_command_dump(i, f, prefix);
6889 }
6890
6891 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
6892         ExecCommand *end;
6893
6894         assert(l);
6895         assert(e);
6896
6897         if (*l) {
6898                 /* It's kind of important, that we keep the order here */
6899                 end = LIST_FIND_TAIL(command, *l);
6900                 LIST_INSERT_AFTER(command, *l, end, e);
6901         } else
6902               *l = e;
6903 }
6904
6905 int exec_command_set(ExecCommand *c, const char *path, ...) {
6906         va_list ap;
6907         char **l, *p;
6908
6909         assert(c);
6910         assert(path);
6911
6912         va_start(ap, path);
6913         l = strv_new_ap(path, ap);
6914         va_end(ap);
6915
6916         if (!l)
6917                 return -ENOMEM;
6918
6919         p = strdup(path);
6920         if (!p) {
6921                 strv_free(l);
6922                 return -ENOMEM;
6923         }
6924
6925         free_and_replace(c->path, p);
6926
6927         return strv_free_and_replace(c->argv, l);
6928 }
6929
6930 int exec_command_append(ExecCommand *c, const char *path, ...) {
6931         _cleanup_strv_free_ char **l = NULL;
6932         va_list ap;
6933         int r;
6934
6935         assert(c);
6936         assert(path);
6937
6938         va_start(ap, path);
6939         l = strv_new_ap(path, ap);
6940         va_end(ap);
6941
6942         if (!l)
6943                 return -ENOMEM;
6944
6945         r = strv_extend_strv(&c->argv, l, false);
6946         if (r < 0)
6947                 return r;
6948
6949         return 0;
6950 }
6951
6952 static void *remove_tmpdir_thread(void *p) {
6953         _cleanup_free_ char *path = p;
6954
6955         (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
6956         return NULL;
6957 }
6958
6959 static ExecSharedRuntime* exec_shared_runtime_free(ExecSharedRuntime *rt, bool destroy) {
6960         int r;
6961
6962         if (!rt)
6963                 return NULL;
6964
6965         if (rt->manager)
6966                 (void) hashmap_remove(rt->manager->exec_shared_runtime_by_id, rt->id);
6967
6968         /* When destroy is true, then rm_rf tmp_dir and var_tmp_dir. */
6969
6970         if (destroy && rt->tmp_dir && !streq(rt->tmp_dir, RUN_SYSTEMD_EMPTY)) {
6971                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
6972
6973                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
6974                 if (r < 0)
6975                         log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
6976                 else
6977                         rt->tmp_dir = NULL;
6978         }
6979
6980         if (destroy && rt->var_tmp_dir && !streq(rt->var_tmp_dir, RUN_SYSTEMD_EMPTY)) {
6981                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
6982
6983                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
6984                 if (r < 0)
6985                         log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
6986                 else
6987                         rt->var_tmp_dir = NULL;
6988         }
6989
6990         rt->id = mfree(rt->id);
6991         rt->tmp_dir = mfree(rt->tmp_dir);
6992         rt->var_tmp_dir = mfree(rt->var_tmp_dir);
6993         safe_close_pair(rt->netns_storage_socket);
6994         safe_close_pair(rt->ipcns_storage_socket);
6995         return mfree(rt);
6996 }
6997
6998 static void exec_shared_runtime_freep(ExecSharedRuntime **rt) {
6999         (void) exec_shared_runtime_free(*rt, false);
7000 }
7001
7002 static int exec_shared_runtime_allocate(ExecSharedRuntime **ret, const char *id) {
7003         _cleanup_free_ char *id_copy = NULL;
7004         ExecSharedRuntime *n;
7005
7006         assert(ret);
7007
7008         id_copy = strdup(id);
7009         if (!id_copy)
7010                 return -ENOMEM;
7011
7012         n = new(ExecSharedRuntime, 1);
7013         if (!n)
7014                 return -ENOMEM;
7015
7016         *n = (ExecSharedRuntime) {
7017                 .id = TAKE_PTR(id_copy),
7018                 .netns_storage_socket = PIPE_EBADF,
7019                 .ipcns_storage_socket = PIPE_EBADF,
7020         };
7021
7022         *ret = n;
7023         return 0;
7024 }
7025
7026 static int exec_shared_runtime_add(
7027                 Manager *m,
7028                 const char *id,
7029                 char **tmp_dir,
7030                 char **var_tmp_dir,
7031                 int netns_storage_socket[2],
7032                 int ipcns_storage_socket[2],
7033                 ExecSharedRuntime **ret) {
7034
7035         _cleanup_(exec_shared_runtime_freep) ExecSharedRuntime *rt = NULL;
7036         int r;
7037
7038         assert(m);
7039         assert(id);
7040
7041         /* tmp_dir, var_tmp_dir, {net,ipc}ns_storage_socket fds are donated on success */
7042
7043         r = exec_shared_runtime_allocate(&rt, id);
7044         if (r < 0)
7045                 return r;
7046
7047         r = hashmap_ensure_put(&m->exec_shared_runtime_by_id, &string_hash_ops, rt->id, rt);
7048         if (r < 0)
7049                 return r;
7050
7051         assert(!!rt->tmp_dir == !!rt->var_tmp_dir); /* We require both to be set together */
7052         rt->tmp_dir = TAKE_PTR(*tmp_dir);
7053         rt->var_tmp_dir = TAKE_PTR(*var_tmp_dir);
7054
7055         if (netns_storage_socket) {
7056                 rt->netns_storage_socket[0] = TAKE_FD(netns_storage_socket[0]);
7057                 rt->netns_storage_socket[1] = TAKE_FD(netns_storage_socket[1]);
7058         }
7059
7060         if (ipcns_storage_socket) {
7061                 rt->ipcns_storage_socket[0] = TAKE_FD(ipcns_storage_socket[0]);
7062                 rt->ipcns_storage_socket[1] = TAKE_FD(ipcns_storage_socket[1]);
7063         }
7064
7065         rt->manager = m;
7066
7067         if (ret)
7068                 *ret = rt;
7069         /* do not remove created ExecSharedRuntime object when the operation succeeds. */
7070         TAKE_PTR(rt);
7071         return 0;
7072 }
7073
7074 static int exec_shared_runtime_make(
7075                 Manager *m,
7076                 const ExecContext *c,
7077                 const char *id,
7078                 ExecSharedRuntime **ret) {
7079
7080         _cleanup_(namespace_cleanup_tmpdirp) char *tmp_dir = NULL, *var_tmp_dir = NULL;
7081         _cleanup_close_pair_ int netns_storage_socket[2] = PIPE_EBADF, ipcns_storage_socket[2] = PIPE_EBADF;
7082         int r;
7083
7084         assert(m);
7085         assert(c);
7086         assert(id);
7087
7088         /* It is not necessary to create ExecSharedRuntime object. */
7089         if (!exec_needs_network_namespace(c) && !exec_needs_ipc_namespace(c) && !c->private_tmp) {
7090                 *ret = NULL;
7091                 return 0;
7092         }
7093
7094         if (c->private_tmp &&
7095             !(prefixed_path_strv_contains(c->inaccessible_paths, "/tmp") &&
7096               (prefixed_path_strv_contains(c->inaccessible_paths, "/var/tmp") ||
7097                prefixed_path_strv_contains(c->inaccessible_paths, "/var")))) {
7098                 r = setup_tmp_dirs(id, &tmp_dir, &var_tmp_dir);
7099                 if (r < 0)
7100                         return r;
7101         }
7102
7103         if (exec_needs_network_namespace(c)) {
7104                 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, netns_storage_socket) < 0)
7105                         return -errno;
7106         }
7107
7108         if (exec_needs_ipc_namespace(c)) {
7109                 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, ipcns_storage_socket) < 0)
7110                         return -errno;
7111         }
7112
7113         r = exec_shared_runtime_add(m, id, &tmp_dir, &var_tmp_dir, netns_storage_socket, ipcns_storage_socket, ret);
7114         if (r < 0)
7115                 return r;
7116
7117         return 1;
7118 }
7119
7120 int exec_shared_runtime_acquire(Manager *m, const ExecContext *c, const char *id, bool create, ExecSharedRuntime **ret) {
7121         ExecSharedRuntime *rt;
7122         int r;
7123
7124         assert(m);
7125         assert(id);
7126         assert(ret);
7127
7128         rt = hashmap_get(m->exec_shared_runtime_by_id, id);
7129         if (rt)
7130                 /* We already have an ExecSharedRuntime object, let's increase the ref count and reuse it */
7131                 goto ref;
7132
7133         if (!create) {
7134                 *ret = NULL;
7135                 return 0;
7136         }
7137
7138         /* If not found, then create a new object. */
7139         r = exec_shared_runtime_make(m, c, id, &rt);
7140         if (r < 0)
7141                 return r;
7142         if (r == 0) {
7143                 /* When r == 0, it is not necessary to create ExecSharedRuntime object. */
7144                 *ret = NULL;
7145                 return 0;
7146         }
7147
7148 ref:
7149         /* increment reference counter. */
7150         rt->n_ref++;
7151         *ret = rt;
7152         return 1;
7153 }
7154
7155 ExecSharedRuntime *exec_shared_runtime_unref(ExecSharedRuntime *rt, bool destroy) {
7156         if (!rt)
7157                 return NULL;
7158
7159         assert(rt->n_ref > 0);
7160
7161         rt->n_ref--;
7162         if (rt->n_ref > 0)
7163                 return NULL;
7164
7165         return exec_shared_runtime_free(rt, destroy);
7166 }
7167
7168 int exec_shared_runtime_serialize(const Manager *m, FILE *f, FDSet *fds) {
7169         ExecSharedRuntime *rt;
7170
7171         assert(m);
7172         assert(f);
7173         assert(fds);
7174
7175         HASHMAP_FOREACH(rt, m->exec_shared_runtime_by_id) {
7176                 fprintf(f, "exec-runtime=%s", rt->id);
7177
7178                 if (rt->tmp_dir)
7179                         fprintf(f, " tmp-dir=%s", rt->tmp_dir);
7180
7181                 if (rt->var_tmp_dir)
7182                         fprintf(f, " var-tmp-dir=%s", rt->var_tmp_dir);
7183
7184                 if (rt->netns_storage_socket[0] >= 0) {
7185                         int copy;
7186
7187                         copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
7188                         if (copy < 0)
7189                                 return copy;
7190
7191                         fprintf(f, " netns-socket-0=%i", copy);
7192                 }
7193
7194                 if (rt->netns_storage_socket[1] >= 0) {
7195                         int copy;
7196
7197                         copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
7198                         if (copy < 0)
7199                                 return copy;
7200
7201                         fprintf(f, " netns-socket-1=%i", copy);
7202                 }
7203
7204                 if (rt->ipcns_storage_socket[0] >= 0) {
7205                         int copy;
7206
7207                         copy = fdset_put_dup(fds, rt->ipcns_storage_socket[0]);
7208                         if (copy < 0)
7209                                 return copy;
7210
7211                         fprintf(f, " ipcns-socket-0=%i", copy);
7212                 }
7213
7214                 if (rt->ipcns_storage_socket[1] >= 0) {
7215                         int copy;
7216
7217                         copy = fdset_put_dup(fds, rt->ipcns_storage_socket[1]);
7218                         if (copy < 0)
7219                                 return copy;
7220
7221                         fprintf(f, " ipcns-socket-1=%i", copy);
7222                 }
7223
7224                 fputc('\n', f);
7225         }
7226
7227         return 0;
7228 }
7229
7230 int exec_shared_runtime_deserialize_compat(Unit *u, const char *key, const char *value, FDSet *fds) {
7231         _cleanup_(exec_shared_runtime_freep) ExecSharedRuntime *rt_create = NULL;
7232         ExecSharedRuntime *rt;
7233         int r;
7234
7235         /* This is for the migration from old (v237 or earlier) deserialization text.
7236          * Due to the bug #7790, this may not work with the units that use JoinsNamespaceOf=.
7237          * Even if the ExecSharedRuntime object originally created by the other unit, we cannot judge
7238          * so or not from the serialized text, then we always creates a new object owned by this. */
7239
7240         assert(u);
7241         assert(key);
7242         assert(value);
7243
7244         /* Manager manages ExecSharedRuntime objects by the unit id.
7245          * So, we omit the serialized text when the unit does not have id (yet?)... */
7246         if (isempty(u->id)) {
7247                 log_unit_debug(u, "Invocation ID not found. Dropping runtime parameter.");
7248                 return 0;
7249         }
7250
7251         if (hashmap_ensure_allocated(&u->manager->exec_shared_runtime_by_id, &string_hash_ops) < 0)
7252                 return log_oom();
7253
7254         rt = hashmap_get(u->manager->exec_shared_runtime_by_id, u->id);
7255         if (!rt) {
7256                 if (exec_shared_runtime_allocate(&rt_create, u->id) < 0)
7257                         return log_oom();
7258
7259                 rt = rt_create;
7260         }
7261
7262         if (streq(key, "tmp-dir")) {
7263                 if (free_and_strdup_warn(&rt->tmp_dir, value) < 0)
7264                         return -ENOMEM;
7265
7266         } else if (streq(key, "var-tmp-dir")) {
7267                 if (free_and_strdup_warn(&rt->var_tmp_dir, value) < 0)
7268                         return -ENOMEM;
7269
7270         } else if (streq(key, "netns-socket-0")) {
7271                 int fd;
7272
7273                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
7274                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
7275                         return 0;
7276                 }
7277
7278                 safe_close(rt->netns_storage_socket[0]);
7279                 rt->netns_storage_socket[0] = fdset_remove(fds, fd);
7280
7281         } else if (streq(key, "netns-socket-1")) {
7282                 int fd;
7283
7284                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
7285                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
7286                         return 0;
7287                 }
7288
7289                 safe_close(rt->netns_storage_socket[1]);
7290                 rt->netns_storage_socket[1] = fdset_remove(fds, fd);
7291
7292         } else
7293                 return 0;
7294
7295         /* If the object is newly created, then put it to the hashmap which manages ExecSharedRuntime objects. */
7296         if (rt_create) {
7297                 r = hashmap_put(u->manager->exec_shared_runtime_by_id, rt_create->id, rt_create);
7298                 if (r < 0) {
7299                         log_unit_debug_errno(u, r, "Failed to put runtime parameter to manager's storage: %m");
7300                         return 0;
7301                 }
7302
7303                 rt_create->manager = u->manager;
7304
7305                 /* Avoid cleanup */
7306                 TAKE_PTR(rt_create);
7307         }
7308
7309         return 1;
7310 }
7311
7312 int exec_shared_runtime_deserialize_one(Manager *m, const char *value, FDSet *fds) {
7313         _cleanup_free_ char *tmp_dir = NULL, *var_tmp_dir = NULL;
7314         char *id = NULL;
7315         int r, netns_fdpair[] = {-1, -1}, ipcns_fdpair[] = {-1, -1};
7316         const char *p, *v = ASSERT_PTR(value);
7317         size_t n;
7318
7319         assert(m);
7320         assert(fds);
7321
7322         n = strcspn(v, " ");
7323         id = strndupa_safe(v, n);
7324         if (v[n] != ' ')
7325                 goto finalize;
7326         p = v + n + 1;
7327
7328         v = startswith(p, "tmp-dir=");
7329         if (v) {
7330                 n = strcspn(v, " ");
7331                 tmp_dir = strndup(v, n);
7332                 if (!tmp_dir)
7333                         return log_oom();
7334                 if (v[n] != ' ')
7335                         goto finalize;
7336                 p = v + n + 1;
7337         }
7338
7339         v = startswith(p, "var-tmp-dir=");
7340         if (v) {
7341                 n = strcspn(v, " ");
7342                 var_tmp_dir = strndup(v, n);
7343                 if (!var_tmp_dir)
7344                         return log_oom();
7345                 if (v[n] != ' ')
7346                         goto finalize;
7347                 p = v + n + 1;
7348         }
7349
7350         v = startswith(p, "netns-socket-0=");
7351         if (v) {
7352                 char *buf;
7353
7354                 n = strcspn(v, " ");
7355                 buf = strndupa_safe(v, n);
7356
7357                 r = safe_atoi(buf, &netns_fdpair[0]);
7358                 if (r < 0)
7359                         return log_debug_errno(r, "Unable to parse exec-runtime specification netns-socket-0=%s: %m", buf);
7360                 if (!fdset_contains(fds, netns_fdpair[0]))
7361                         return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
7362                                                "exec-runtime specification netns-socket-0= refers to unknown fd %d: %m", netns_fdpair[0]);
7363                 netns_fdpair[0] = fdset_remove(fds, netns_fdpair[0]);
7364                 if (v[n] != ' ')
7365                         goto finalize;
7366                 p = v + n + 1;
7367         }
7368
7369         v = startswith(p, "netns-socket-1=");
7370         if (v) {
7371                 char *buf;
7372
7373                 n = strcspn(v, " ");
7374                 buf = strndupa_safe(v, n);
7375
7376                 r = safe_atoi(buf, &netns_fdpair[1]);
7377                 if (r < 0)
7378                         return log_debug_errno(r, "Unable to parse exec-runtime specification netns-socket-1=%s: %m", buf);
7379                 if (!fdset_contains(fds, netns_fdpair[1]))
7380                         return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
7381                                                "exec-runtime specification netns-socket-1= refers to unknown fd %d: %m", netns_fdpair[1]);
7382                 netns_fdpair[1] = fdset_remove(fds, netns_fdpair[1]);
7383                 if (v[n] != ' ')
7384                         goto finalize;
7385                 p = v + n + 1;
7386         }
7387
7388         v = startswith(p, "ipcns-socket-0=");
7389         if (v) {
7390                 char *buf;
7391
7392                 n = strcspn(v, " ");
7393                 buf = strndupa_safe(v, n);
7394
7395                 r = safe_atoi(buf, &ipcns_fdpair[0]);
7396                 if (r < 0)
7397                         return log_debug_errno(r, "Unable to parse exec-runtime specification ipcns-socket-0=%s: %m", buf);
7398                 if (!fdset_contains(fds, ipcns_fdpair[0]))
7399                         return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
7400                                                "exec-runtime specification ipcns-socket-0= refers to unknown fd %d: %m", ipcns_fdpair[0]);
7401                 ipcns_fdpair[0] = fdset_remove(fds, ipcns_fdpair[0]);
7402                 if (v[n] != ' ')
7403                         goto finalize;
7404                 p = v + n + 1;
7405         }
7406
7407         v = startswith(p, "ipcns-socket-1=");
7408         if (v) {
7409                 char *buf;
7410
7411                 n = strcspn(v, " ");
7412                 buf = strndupa_safe(v, n);
7413
7414                 r = safe_atoi(buf, &ipcns_fdpair[1]);
7415                 if (r < 0)
7416                         return log_debug_errno(r, "Unable to parse exec-runtime specification ipcns-socket-1=%s: %m", buf);
7417                 if (!fdset_contains(fds, ipcns_fdpair[1]))
7418                         return log_debug_errno(SYNTHETIC_ERRNO(EBADF),
7419                                                "exec-runtime specification ipcns-socket-1= refers to unknown fd %d: %m", ipcns_fdpair[1]);
7420                 ipcns_fdpair[1] = fdset_remove(fds, ipcns_fdpair[1]);
7421         }
7422
7423 finalize:
7424         r = exec_shared_runtime_add(m, id, &tmp_dir, &var_tmp_dir, netns_fdpair, ipcns_fdpair, NULL);
7425         if (r < 0)
7426                 return log_debug_errno(r, "Failed to add exec-runtime: %m");
7427         return 0;
7428 }
7429
7430 void exec_shared_runtime_vacuum(Manager *m) {
7431         ExecSharedRuntime *rt;
7432
7433         assert(m);
7434
7435         /* Free unreferenced ExecSharedRuntime objects. This is used after manager deserialization process. */
7436
7437         HASHMAP_FOREACH(rt, m->exec_shared_runtime_by_id) {
7438                 if (rt->n_ref > 0)
7439                         continue;
7440
7441                 (void) exec_shared_runtime_free(rt, false);
7442         }
7443 }
7444
7445 void exec_params_clear(ExecParameters *p) {
7446         if (!p)
7447                 return;
7448
7449         p->environment = strv_free(p->environment);
7450         p->fd_names = strv_free(p->fd_names);
7451         p->fds = mfree(p->fds);
7452         p->exec_fd = safe_close(p->exec_fd);
7453 }
7454
7455 ExecSetCredential *exec_set_credential_free(ExecSetCredential *sc) {
7456         if (!sc)
7457                 return NULL;
7458
7459         free(sc->id);
7460         free(sc->data);
7461         return mfree(sc);
7462 }
7463
7464 ExecLoadCredential *exec_load_credential_free(ExecLoadCredential *lc) {
7465         if (!lc)
7466                 return NULL;
7467
7468         free(lc->id);
7469         free(lc->path);
7470         return mfree(lc);
7471 }
7472
7473 void exec_directory_done(ExecDirectory *d) {
7474         if (!d)
7475                 return;
7476
7477         for (size_t i = 0; i < d->n_items; i++) {
7478                 free(d->items[i].path);
7479                 strv_free(d->items[i].symlinks);
7480         }
7481
7482         d->items = mfree(d->items);
7483         d->n_items = 0;
7484         d->mode = 0755;
7485 }
7486
7487 static ExecDirectoryItem *exec_directory_find(ExecDirectory *d, const char *path) {
7488         assert(d);
7489         assert(path);
7490
7491         for (size_t i = 0; i < d->n_items; i++)
7492                 if (path_equal(d->items[i].path, path))
7493                         return &d->items[i];
7494
7495         return NULL;
7496 }
7497
7498 int exec_directory_add(ExecDirectory *d, const char *path, const char *symlink) {
7499         _cleanup_strv_free_ char **s = NULL;
7500         _cleanup_free_ char *p = NULL;
7501         ExecDirectoryItem *existing;
7502         int r;
7503
7504         assert(d);
7505         assert(path);
7506
7507         existing = exec_directory_find(d, path);
7508         if (existing) {
7509                 r = strv_extend(&existing->symlinks, symlink);
7510                 if (r < 0)
7511                         return r;
7512
7513                 return 0; /* existing item is updated */
7514         }
7515
7516         p = strdup(path);
7517         if (!p)
7518                 return -ENOMEM;
7519
7520         if (symlink) {
7521                 s = strv_new(symlink);
7522                 if (!s)
7523                         return -ENOMEM;
7524         }
7525
7526         if (!GREEDY_REALLOC(d->items, d->n_items + 1))
7527                 return -ENOMEM;
7528
7529         d->items[d->n_items++] = (ExecDirectoryItem) {
7530                 .path = TAKE_PTR(p),
7531                 .symlinks = TAKE_PTR(s),
7532         };
7533
7534         return 1; /* new item is added */
7535 }
7536
7537 static int exec_directory_item_compare_func(const ExecDirectoryItem *a, const ExecDirectoryItem *b) {
7538         assert(a);
7539         assert(b);
7540
7541         return path_compare(a->path, b->path);
7542 }
7543
7544 void exec_directory_sort(ExecDirectory *d) {
7545         assert(d);
7546
7547         /* Sort the exec directories to make always parent directories processed at first in
7548          * setup_exec_directory(), e.g., even if StateDirectory=foo/bar foo, we need to create foo at first,
7549          * then foo/bar. Also, set .only_create flag if one of the parent directories is contained in the
7550          * list. See also comments in setup_exec_directory() and issue #24783. */
7551
7552         if (d->n_items <= 1)
7553                 return;
7554
7555         typesafe_qsort(d->items, d->n_items, exec_directory_item_compare_func);
7556
7557         for (size_t i = 1; i < d->n_items; i++)
7558                 for (size_t j = 0; j < i; j++)
7559                         if (path_startswith(d->items[i].path, d->items[j].path)) {
7560                                 d->items[i].only_create = true;
7561                                 break;
7562                         }
7563 }
7564
7565 DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(exec_set_credential_hash_ops, char, string_hash_func, string_compare_func, ExecSetCredential, exec_set_credential_free);
7566 DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(exec_load_credential_hash_ops, char, string_hash_func, string_compare_func, ExecLoadCredential, exec_load_credential_free);
7567
7568 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
7569         [EXEC_INPUT_NULL] = "null",
7570         [EXEC_INPUT_TTY] = "tty",
7571         [EXEC_INPUT_TTY_FORCE] = "tty-force",
7572         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
7573         [EXEC_INPUT_SOCKET] = "socket",
7574         [EXEC_INPUT_NAMED_FD] = "fd",
7575         [EXEC_INPUT_DATA] = "data",
7576         [EXEC_INPUT_FILE] = "file",
7577 };
7578
7579 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
7580
7581 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
7582         [EXEC_OUTPUT_INHERIT] = "inherit",
7583         [EXEC_OUTPUT_NULL] = "null",
7584         [EXEC_OUTPUT_TTY] = "tty",
7585         [EXEC_OUTPUT_KMSG] = "kmsg",
7586         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
7587         [EXEC_OUTPUT_JOURNAL] = "journal",
7588         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
7589         [EXEC_OUTPUT_SOCKET] = "socket",
7590         [EXEC_OUTPUT_NAMED_FD] = "fd",
7591         [EXEC_OUTPUT_FILE] = "file",
7592         [EXEC_OUTPUT_FILE_APPEND] = "append",
7593         [EXEC_OUTPUT_FILE_TRUNCATE] = "truncate",
7594 };
7595
7596 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
7597
7598 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
7599         [EXEC_UTMP_INIT] = "init",
7600         [EXEC_UTMP_LOGIN] = "login",
7601         [EXEC_UTMP_USER] = "user",
7602 };
7603
7604 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);
7605
7606 static const char* const exec_preserve_mode_table[_EXEC_PRESERVE_MODE_MAX] = {
7607         [EXEC_PRESERVE_NO] = "no",
7608         [EXEC_PRESERVE_YES] = "yes",
7609         [EXEC_PRESERVE_RESTART] = "restart",
7610 };
7611
7612 DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(exec_preserve_mode, ExecPreserveMode, EXEC_PRESERVE_YES);
7613
7614 /* This table maps ExecDirectoryType to the setting it is configured with in the unit */
7615 static const char* const exec_directory_type_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7616         [EXEC_DIRECTORY_RUNTIME] = "RuntimeDirectory",
7617         [EXEC_DIRECTORY_STATE] = "StateDirectory",
7618         [EXEC_DIRECTORY_CACHE] = "CacheDirectory",
7619         [EXEC_DIRECTORY_LOGS] = "LogsDirectory",
7620         [EXEC_DIRECTORY_CONFIGURATION] = "ConfigurationDirectory",
7621 };
7622
7623 DEFINE_STRING_TABLE_LOOKUP(exec_directory_type, ExecDirectoryType);
7624
7625 /* This table maps ExecDirectoryType to the symlink setting it is configured with in the unit */
7626 static const char* const exec_directory_type_symlink_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7627         [EXEC_DIRECTORY_RUNTIME]       = "RuntimeDirectorySymlink",
7628         [EXEC_DIRECTORY_STATE]         = "StateDirectorySymlink",
7629         [EXEC_DIRECTORY_CACHE]         = "CacheDirectorySymlink",
7630         [EXEC_DIRECTORY_LOGS]          = "LogsDirectorySymlink",
7631         [EXEC_DIRECTORY_CONFIGURATION] = "ConfigurationDirectorySymlink",
7632 };
7633
7634 DEFINE_STRING_TABLE_LOOKUP(exec_directory_type_symlink, ExecDirectoryType);
7635
7636 /* And this table maps ExecDirectoryType too, but to a generic term identifying the type of resource. This
7637  * one is supposed to be generic enough to be used for unit types that don't use ExecContext and per-unit
7638  * directories, specifically .timer units with their timestamp touch file. */
7639 static const char* const exec_resource_type_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7640         [EXEC_DIRECTORY_RUNTIME] = "runtime",
7641         [EXEC_DIRECTORY_STATE] = "state",
7642         [EXEC_DIRECTORY_CACHE] = "cache",
7643         [EXEC_DIRECTORY_LOGS] = "logs",
7644         [EXEC_DIRECTORY_CONFIGURATION] = "configuration",
7645 };
7646
7647 DEFINE_STRING_TABLE_LOOKUP(exec_resource_type, ExecDirectoryType);
7648
7649 /* And this table also maps ExecDirectoryType, to the environment variable we pass the selected directory to
7650  * the service payload in. */
7651 static const char* const exec_directory_env_name_table[_EXEC_DIRECTORY_TYPE_MAX] = {
7652         [EXEC_DIRECTORY_RUNTIME] = "RUNTIME_DIRECTORY",
7653         [EXEC_DIRECTORY_STATE] = "STATE_DIRECTORY",
7654         [EXEC_DIRECTORY_CACHE] = "CACHE_DIRECTORY",
7655         [EXEC_DIRECTORY_LOGS] = "LOGS_DIRECTORY",
7656         [EXEC_DIRECTORY_CONFIGURATION] = "CONFIGURATION_DIRECTORY",
7657 };
7658
7659 DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(exec_directory_env_name, ExecDirectoryType);
7660
7661 static const char* const exec_keyring_mode_table[_EXEC_KEYRING_MODE_MAX] = {
7662         [EXEC_KEYRING_INHERIT] = "inherit",
7663         [EXEC_KEYRING_PRIVATE] = "private",
7664         [EXEC_KEYRING_SHARED] = "shared",
7665 };
7666
7667 DEFINE_STRING_TABLE_LOOKUP(exec_keyring_mode, ExecKeyringMode);