src/core/execute.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <glob.h>
  23 #include <grp.h>
  24 #include <poll.h>
  25 #include <signal.h>
  26 #include <string.h>
  27 #include <sys/capability.h>
  28 #include <sys/mman.h>
  29 #include <sys/personality.h>
  30 #include <sys/prctl.h>
  31 #include <sys/socket.h>
  32 #include <sys/stat.h>
  33 #include <sys/un.h>
  34 #include <unistd.h>
  35 #include <utmpx.h>
  36
  37 #ifdef HAVE_PAM
  38 #include <security/pam_appl.h>
  39 #endif
  40
  41 #ifdef HAVE_SELINUX
  42 #include <selinux/selinux.h>
  43 #endif
  44
  45 #ifdef HAVE_SECCOMP
  46 #include <seccomp.h>
  47 #endif
  48
  49 #ifdef HAVE_APPARMOR
  50 #include <sys/apparmor.h>
  51 #endif
  52
  53 #include "sd-messages.h"
  54
  55 #include "af-list.h"
  56 #include "alloc-util.h"
  57 #ifdef HAVE_APPARMOR
  58 #include "apparmor-util.h"
  59 #endif
  60 #include "async.h"
  61 #include "barrier.h"
  62 #include "cap-list.h"
  63 #include "capability-util.h"
  64 #include "def.h"
  65 #include "env-util.h"
  66 #include "errno-list.h"
  67 #include "execute.h"
  68 #include "exit-status.h"
  69 #include "fd-util.h"
  70 #include "fileio.h"
  71 #include "formats-util.h"
  72 #include "fs-util.h"
  73 #include "glob-util.h"
  74 #include "io-util.h"
  75 #include "ioprio.h"
  76 #include "log.h"
  77 #include "macro.h"
  78 #include "missing.h"
  79 #include "mkdir.h"
  80 #include "namespace.h"
  81 #include "parse-util.h"
  82 #include "path-util.h"
  83 #include "process-util.h"
  84 #include "rlimit-util.h"
  85 #include "rm-rf.h"
  86 #ifdef HAVE_SECCOMP
  87 #include "seccomp-util.h"
  88 #endif
  89 #include "securebits.h"
  90 #include "selinux-util.h"
  91 #include "signal-util.h"
  92 #include "smack-util.h"
  93 #include "string-table.h"
  94 #include "string-util.h"
  95 #include "strv.h"
  96 #include "syslog-util.h"
  97 #include "terminal-util.h"
  98 #include "unit.h"
  99 #include "user-util.h"
 100 #include "util.h"
 101 #include "utmp-wtmp.h"
 102
 103 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
 104 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
 105
 106 /* This assumes there is a 'tty' group */
 107 #define TTY_MODE 0620
 108
 109 #define SNDBUF_SIZE (8*1024*1024)
 110
 111 static int shift_fds(int fds[], unsigned n_fds) {
 112         int start, restart_from;
 113
 114         if (n_fds <= 0)
 115                 return 0;
 116
 117         /* Modifies the fds array! (sorts it) */
 118
 119         assert(fds);
 120
 121         start = 0;
 122         for (;;) {
 123                 int i;
 124
 125                 restart_from = -1;
 126
 127                 for (i = start; i < (int) n_fds; i++) {
 128                         int nfd;
 129
 130                         /* Already at right index? */
 131                         if (fds[i] == i+3)
 132                                 continue;
 133
 134                         nfd = fcntl(fds[i], F_DUPFD, i + 3);
 135                         if (nfd < 0)
 136                                 return -errno;
 137
 138                         safe_close(fds[i]);
 139                         fds[i] = nfd;
 140
 141                         /* Hmm, the fd we wanted isn't free? Then
 142                          * let's remember that and try again from here */
 143                         if (nfd != i+3 && restart_from < 0)
 144                                 restart_from = i;
 145                 }
 146
 147                 if (restart_from < 0)
 148                         break;
 149
 150                 start = restart_from;
 151         }
 152
 153         return 0;
 154 }
 155
 156 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 157         unsigned i;
 158         int r;
 159
 160         if (n_fds <= 0)
 161                 return 0;
 162
 163         assert(fds);
 164
 165         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 166
 167         for (i = 0; i < n_fds; i++) {
 168
 169                 r = fd_nonblock(fds[i], nonblock);
 170                 if (r < 0)
 171                         return r;
 172
 173                 /* We unconditionally drop FD_CLOEXEC from the fds,
 174                  * since after all we want to pass these fds to our
 175                  * children */
 176
 177                 r = fd_cloexec(fds[i], false);
 178                 if (r < 0)
 179                         return r;
 180         }
 181
 182         return 0;
 183 }
 184
 185 static const char *exec_context_tty_path(const ExecContext *context) {
 186         assert(context);
 187
 188         if (context->stdio_as_fds)
 189                 return NULL;
 190
 191         if (context->tty_path)
 192                 return context->tty_path;
 193
 194         return "/dev/console";
 195 }
 196
 197 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
 198         const char *path;
 199
 200         assert(context);
 201
 202         path = exec_context_tty_path(context);
 203
 204         if (context->tty_vhangup) {
 205                 if (p && p->stdin_fd >= 0)
 206                         (void) terminal_vhangup_fd(p->stdin_fd);
 207                 else if (path)
 208                         (void) terminal_vhangup(path);
 209         }
 210
 211         if (context->tty_reset) {
 212                 if (p && p->stdin_fd >= 0)
 213                         (void) reset_terminal_fd(p->stdin_fd, true);
 214                 else if (path)
 215                         (void) reset_terminal(path);
 216         }
 217
 218         if (context->tty_vt_disallocate && path)
 219                 (void) vt_disallocate(path);
 220 }
 221
 222 static bool is_terminal_output(ExecOutput o) {
 223         return
 224                 o == EXEC_OUTPUT_TTY ||
 225                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 226                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 227                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 228 }
 229
 230 static int open_null_as(int flags, int nfd) {
 231         int fd, r;
 232
 233         assert(nfd >= 0);
 234
 235         fd = open("/dev/null", flags|O_NOCTTY);
 236         if (fd < 0)
 237                 return -errno;
 238
 239         if (fd != nfd) {
 240                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 241                 safe_close(fd);
 242         } else
 243                 r = nfd;
 244
 245         return r;
 246 }
 247
 248 static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
 249         union sockaddr_union sa = {
 250                 .un.sun_family = AF_UNIX,
 251                 .un.sun_path = "/run/systemd/journal/stdout",
 252         };
 253         uid_t olduid = UID_INVALID;
 254         gid_t oldgid = GID_INVALID;
 255         int r;
 256
 257         if (gid != GID_INVALID) {
 258                 oldgid = getgid();
 259
 260                 r = setegid(gid);
 261                 if (r < 0)
 262                         return -errno;
 263         }
 264
 265         if (uid != UID_INVALID) {
 266                 olduid = getuid();
 267
 268                 r = seteuid(uid);
 269                 if (r < 0) {
 270                         r = -errno;
 271                         goto restore_gid;
 272                 }
 273         }
 274
 275         r = connect(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
 276         if (r < 0)
 277                 r = -errno;
 278
 279         /* If we fail to restore the uid or gid, things will likely
 280            fail later on. This should only happen if an LSM interferes. */
 281
 282         if (uid != UID_INVALID)
 283                 (void) seteuid(olduid);
 284
 285  restore_gid:
 286         if (gid != GID_INVALID)
 287                 (void) setegid(oldgid);
 288
 289         return r;
 290 }
 291
 292 static int connect_logger_as(
 293                 const ExecContext *context,
 294                 ExecOutput output,
 295                 const char *ident,
 296                 const char *unit_id,
 297                 int nfd,
 298                 uid_t uid,
 299                 gid_t gid) {
 300
 301         int fd, r;
 302
 303         assert(context);
 304         assert(output < _EXEC_OUTPUT_MAX);
 305         assert(ident);
 306         assert(nfd >= 0);
 307
 308         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 309         if (fd < 0)
 310                 return -errno;
 311
 312         r = connect_journal_socket(fd, uid, gid);
 313         if (r < 0)
 314                 return r;
 315
 316         if (shutdown(fd, SHUT_RD) < 0) {
 317                 safe_close(fd);
 318                 return -errno;
 319         }
 320
 321         (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
 322
 323         dprintf(fd,
 324                 "%s\n"
 325                 "%s\n"
 326                 "%i\n"
 327                 "%i\n"
 328                 "%i\n"
 329                 "%i\n"
 330                 "%i\n",
 331                 context->syslog_identifier ? context->syslog_identifier : ident,
 332                 unit_id,
 333                 context->syslog_priority,
 334                 !!context->syslog_level_prefix,
 335                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 336                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 337                 is_terminal_output(output));
 338
 339         if (fd == nfd)
 340                 return nfd;
 341
 342         r = dup2(fd, nfd) < 0 ? -errno : nfd;
 343         safe_close(fd);
 344
 345         return r;
 346 }
 347 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 348         int fd, r;
 349
 350         assert(path);
 351         assert(nfd >= 0);
 352
 353         fd = open_terminal(path, mode | O_NOCTTY);
 354         if (fd < 0)
 355                 return fd;
 356
 357         if (fd != nfd) {
 358                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 359                 safe_close(fd);
 360         } else
 361                 r = nfd;
 362
 363         return r;
 364 }
 365
 366 static bool is_terminal_input(ExecInput i) {
 367         return
 368                 i == EXEC_INPUT_TTY ||
 369                 i == EXEC_INPUT_TTY_FORCE ||
 370                 i == EXEC_INPUT_TTY_FAIL;
 371 }
 372
 373 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 374
 375         if (is_terminal_input(std_input) && !apply_tty_stdin)
 376                 return EXEC_INPUT_NULL;
 377
 378         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 379                 return EXEC_INPUT_NULL;
 380
 381         return std_input;
 382 }
 383
 384 static int fixup_output(ExecOutput std_output, int socket_fd) {
 385
 386         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 387                 return EXEC_OUTPUT_INHERIT;
 388
 389         return std_output;
 390 }
 391
 392 static int setup_input(
 393                 const ExecContext *context,
 394                 const ExecParameters *params,
 395                 int socket_fd) {
 396
 397         ExecInput i;
 398
 399         assert(context);
 400         assert(params);
 401
 402         if (params->stdin_fd >= 0) {
 403                 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
 404                         return -errno;
 405
 406                 /* Try to make this the controlling tty, if it is a tty, and reset it */
 407                 (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
 408                 (void) reset_terminal_fd(STDIN_FILENO, true);
 409
 410                 return STDIN_FILENO;
 411         }
 412
 413         i = fixup_input(context->std_input, socket_fd, params->apply_tty_stdin);
 414
 415         switch (i) {
 416
 417         case EXEC_INPUT_NULL:
 418                 return open_null_as(O_RDONLY, STDIN_FILENO);
 419
 420         case EXEC_INPUT_TTY:
 421         case EXEC_INPUT_TTY_FORCE:
 422         case EXEC_INPUT_TTY_FAIL: {
 423                 int fd, r;
 424
 425                 fd = acquire_terminal(exec_context_tty_path(context),
 426                                       i == EXEC_INPUT_TTY_FAIL,
 427                                       i == EXEC_INPUT_TTY_FORCE,
 428                                       false,
 429                                       USEC_INFINITY);
 430                 if (fd < 0)
 431                         return fd;
 432
 433                 if (fd != STDIN_FILENO) {
 434                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 435                         safe_close(fd);
 436                 } else
 437                         r = STDIN_FILENO;
 438
 439                 return r;
 440         }
 441
 442         case EXEC_INPUT_SOCKET:
 443                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 444
 445         default:
 446                 assert_not_reached("Unknown input type");
 447         }
 448 }
 449
 450 static int setup_output(
 451                 Unit *unit,
 452                 const ExecContext *context,
 453                 const ExecParameters *params,
 454                 int fileno,
 455                 int socket_fd,
 456                 const char *ident,
 457                 uid_t uid,
 458                 gid_t gid,
 459                 dev_t *journal_stream_dev,
 460                 ino_t *journal_stream_ino) {
 461
 462         ExecOutput o;
 463         ExecInput i;
 464         int r;
 465
 466         assert(unit);
 467         assert(context);
 468         assert(params);
 469         assert(ident);
 470         assert(journal_stream_dev);
 471         assert(journal_stream_ino);
 472
 473         if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
 474
 475                 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
 476                         return -errno;
 477
 478                 return STDOUT_FILENO;
 479         }
 480
 481         if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
 482                 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
 483                         return -errno;
 484
 485                 return STDERR_FILENO;
 486         }
 487
 488         i = fixup_input(context->std_input, socket_fd, params->apply_tty_stdin);
 489         o = fixup_output(context->std_output, socket_fd);
 490
 491         if (fileno == STDERR_FILENO) {
 492                 ExecOutput e;
 493                 e = fixup_output(context->std_error, socket_fd);
 494
 495                 /* This expects the input and output are already set up */
 496
 497                 /* Don't change the stderr file descriptor if we inherit all
 498                  * the way and are not on a tty */
 499                 if (e == EXEC_OUTPUT_INHERIT &&
 500                     o == EXEC_OUTPUT_INHERIT &&
 501                     i == EXEC_INPUT_NULL &&
 502                     !is_terminal_input(context->std_input) &&
 503                     getppid () != 1)
 504                         return fileno;
 505
 506                 /* Duplicate from stdout if possible */
 507                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 508                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 509
 510                 o = e;
 511
 512         } else if (o == EXEC_OUTPUT_INHERIT) {
 513                 /* If input got downgraded, inherit the original value */
 514                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 515                         return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 516
 517                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 518                 if (i != EXEC_INPUT_NULL)
 519                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 520
 521                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 522                 if (getppid() != 1)
 523                         return fileno;
 524
 525                 /* We need to open /dev/null here anew, to get the right access mode. */
 526                 return open_null_as(O_WRONLY, fileno);
 527         }
 528
 529         switch (o) {
 530
 531         case EXEC_OUTPUT_NULL:
 532                 return open_null_as(O_WRONLY, fileno);
 533
 534         case EXEC_OUTPUT_TTY:
 535                 if (is_terminal_input(i))
 536                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 537
 538                 /* We don't reset the terminal if this is just about output */
 539                 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 540
 541         case EXEC_OUTPUT_SYSLOG:
 542         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 543         case EXEC_OUTPUT_KMSG:
 544         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 545         case EXEC_OUTPUT_JOURNAL:
 546         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 547                 r = connect_logger_as(context, o, ident, unit->id, fileno, uid, gid);
 548                 if (r < 0) {
 549                         log_unit_error_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
 550                         r = open_null_as(O_WRONLY, fileno);
 551                 } else {
 552                         struct stat st;
 553
 554                         /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
 555                          * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
 556                          * services to detect whether they are connected to the journal or not. */
 557
 558                         if (fstat(fileno, &st) >= 0) {
 559                                 *journal_stream_dev = st.st_dev;
 560                                 *journal_stream_ino = st.st_ino;
 561                         }
 562                 }
 563                 return r;
 564
 565         case EXEC_OUTPUT_SOCKET:
 566                 assert(socket_fd >= 0);
 567                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 568
 569         default:
 570                 assert_not_reached("Unknown error type");
 571         }
 572 }
 573
 574 static int chown_terminal(int fd, uid_t uid) {
 575         struct stat st;
 576
 577         assert(fd >= 0);
 578
 579         /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
 580         if (isatty(fd) < 1)
 581                 return 0;
 582
 583         /* This might fail. What matters are the results. */
 584         (void) fchown(fd, uid, -1);
 585         (void) fchmod(fd, TTY_MODE);
 586
 587         if (fstat(fd, &st) < 0)
 588                 return -errno;
 589
 590         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 591                 return -EPERM;
 592
 593         return 0;
 594 }
 595
 596 static int setup_confirm_stdio(int *_saved_stdin, int *_saved_stdout) {
 597         _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
 598         int r;
 599
 600         assert(_saved_stdin);
 601         assert(_saved_stdout);
 602
 603         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 604         if (saved_stdin < 0)
 605                 return -errno;
 606
 607         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 608         if (saved_stdout < 0)
 609                 return -errno;
 610
 611         fd = acquire_terminal(
 612                         "/dev/console",
 613                         false,
 614                         false,
 615                         false,
 616                         DEFAULT_CONFIRM_USEC);
 617         if (fd < 0)
 618                 return fd;
 619
 620         r = chown_terminal(fd, getuid());
 621         if (r < 0)
 622                 return r;
 623
 624         r = reset_terminal_fd(fd, true);
 625         if (r < 0)
 626                 return r;
 627
 628         if (dup2(fd, STDIN_FILENO) < 0)
 629                 return -errno;
 630
 631         if (dup2(fd, STDOUT_FILENO) < 0)
 632                 return -errno;
 633
 634         if (fd >= 2)
 635                 safe_close(fd);
 636         fd = -1;
 637
 638         *_saved_stdin = saved_stdin;
 639         *_saved_stdout = saved_stdout;
 640
 641         saved_stdin = saved_stdout = -1;
 642
 643         return 0;
 644 }
 645
 646 _printf_(1, 2) static int write_confirm_message(const char *format, ...) {
 647         _cleanup_close_ int fd = -1;
 648         va_list ap;
 649
 650         assert(format);
 651
 652         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 653         if (fd < 0)
 654                 return fd;
 655
 656         va_start(ap, format);
 657         vdprintf(fd, format, ap);
 658         va_end(ap);
 659
 660         return 0;
 661 }
 662
 663 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
 664         int r = 0;
 665
 666         assert(saved_stdin);
 667         assert(saved_stdout);
 668
 669         release_terminal();
 670
 671         if (*saved_stdin >= 0)
 672                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 673                         r = -errno;
 674
 675         if (*saved_stdout >= 0)
 676                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 677                         r = -errno;
 678
 679         *saved_stdin = safe_close(*saved_stdin);
 680         *saved_stdout = safe_close(*saved_stdout);
 681
 682         return r;
 683 }
 684
 685 static int ask_for_confirmation(char *response, char **argv) {
 686         int saved_stdout = -1, saved_stdin = -1, r;
 687         _cleanup_free_ char *line = NULL;
 688
 689         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 690         if (r < 0)
 691                 return r;
 692
 693         line = exec_command_line(argv);
 694         if (!line)
 695                 return -ENOMEM;
 696
 697         r = ask_char(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 698
 699         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 700
 701         return r;
 702 }
 703
 704 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 705         bool keep_groups = false;
 706         int r;
 707
 708         assert(context);
 709
 710         /* Lookup and set GID and supplementary group list. Here too
 711          * we avoid NSS lookups for gid=0. */
 712
 713         if (context->group || username) {
 714                 /* First step, initialize groups from /etc/groups */
 715                 if (username && gid != 0) {
 716                         if (initgroups(username, gid) < 0)
 717                                 return -errno;
 718
 719                         keep_groups = true;
 720                 }
 721
 722                 /* Second step, set our gids */
 723                 if (setresgid(gid, gid, gid) < 0)
 724                         return -errno;
 725         }
 726
 727         if (context->supplementary_groups) {
 728                 int ngroups_max, k;
 729                 gid_t *gids;
 730                 char **i;
 731
 732                 /* Final step, initialize any manually set supplementary groups */
 733                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 734
 735                 if (!(gids = new(gid_t, ngroups_max)))
 736                         return -ENOMEM;
 737
 738                 if (keep_groups) {
 739                         k = getgroups(ngroups_max, gids);
 740                         if (k < 0) {
 741                                 free(gids);
 742                                 return -errno;
 743                         }
 744                 } else
 745                         k = 0;
 746
 747                 STRV_FOREACH(i, context->supplementary_groups) {
 748                         const char *g;
 749
 750                         if (k >= ngroups_max) {
 751                                 free(gids);
 752                                 return -E2BIG;
 753                         }
 754
 755                         g = *i;
 756                         r = get_group_creds(&g, gids+k);
 757                         if (r < 0) {
 758                                 free(gids);
 759                                 return r;
 760                         }
 761
 762                         k++;
 763                 }
 764
 765                 if (setgroups(k, gids) < 0) {
 766                         free(gids);
 767                         return -errno;
 768                 }
 769
 770                 free(gids);
 771         }
 772
 773         return 0;
 774 }
 775
 776 static int enforce_user(const ExecContext *context, uid_t uid) {
 777         assert(context);
 778
 779         /* Sets (but doesn't look up) the uid and make sure we keep the
 780          * capabilities while doing so. */
 781
 782         if (context->capability_ambient_set != 0) {
 783
 784                 /* First step: If we need to keep capabilities but
 785                  * drop privileges we need to make sure we keep our
 786                  * caps, while we drop privileges. */
 787                 if (uid != 0) {
 788                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 789
 790                         if (prctl(PR_GET_SECUREBITS) != sb)
 791                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 792                                         return -errno;
 793                 }
 794         }
 795
 796         /* Second step: actually set the uids */
 797         if (setresuid(uid, uid, uid) < 0)
 798                 return -errno;
 799
 800         /* At this point we should have all necessary capabilities but
 801            are otherwise a normal user. However, the caps might got
 802            corrupted due to the setresuid() so we need clean them up
 803            later. This is done outside of this call. */
 804
 805         return 0;
 806 }
 807
 808 #ifdef HAVE_PAM
 809
 810 static int null_conv(
 811                 int num_msg,
 812                 const struct pam_message **msg,
 813                 struct pam_response **resp,
 814                 void *appdata_ptr) {
 815
 816         /* We don't support conversations */
 817
 818         return PAM_CONV_ERR;
 819 }
 820
 821 static int setup_pam(
 822                 const char *name,
 823                 const char *user,
 824                 uid_t uid,
 825                 const char *tty,
 826                 char ***env,
 827                 int fds[], unsigned n_fds) {
 828
 829         static const struct pam_conv conv = {
 830                 .conv = null_conv,
 831                 .appdata_ptr = NULL
 832         };
 833
 834         _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
 835         pam_handle_t *handle = NULL;
 836         sigset_t old_ss;
 837         int pam_code = PAM_SUCCESS, r;
 838         char **e = NULL;
 839         bool close_session = false;
 840         pid_t pam_pid = 0, parent_pid;
 841         int flags = 0;
 842
 843         assert(name);
 844         assert(user);
 845         assert(env);
 846
 847         /* We set up PAM in the parent process, then fork. The child
 848          * will then stay around until killed via PR_GET_PDEATHSIG or
 849          * systemd via the cgroup logic. It will then remove the PAM
 850          * session again. The parent process will exec() the actual
 851          * daemon. We do things this way to ensure that the main PID
 852          * of the daemon is the one we initially fork()ed. */
 853
 854         r = barrier_create(&barrier);
 855         if (r < 0)
 856                 goto fail;
 857
 858         if (log_get_max_level() < LOG_DEBUG)
 859                 flags |= PAM_SILENT;
 860
 861         pam_code = pam_start(name, user, &conv, &handle);
 862         if (pam_code != PAM_SUCCESS) {
 863                 handle = NULL;
 864                 goto fail;
 865         }
 866
 867         if (tty) {
 868                 pam_code = pam_set_item(handle, PAM_TTY, tty);
 869                 if (pam_code != PAM_SUCCESS)
 870                         goto fail;
 871         }
 872
 873         STRV_FOREACH(e, *env) {
 874                 pam_code = pam_putenv(handle, *e);
 875                 if (pam_code != PAM_SUCCESS)
 876                         goto fail;
 877         }
 878
 879         pam_code = pam_acct_mgmt(handle, flags);
 880         if (pam_code != PAM_SUCCESS)
 881                 goto fail;
 882
 883         pam_code = pam_open_session(handle, flags);
 884         if (pam_code != PAM_SUCCESS)
 885                 goto fail;
 886
 887         close_session = true;
 888
 889         e = pam_getenvlist(handle);
 890         if (!e) {
 891                 pam_code = PAM_BUF_ERR;
 892                 goto fail;
 893         }
 894
 895         /* Block SIGTERM, so that we know that it won't get lost in
 896          * the child */
 897
 898         assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
 899
 900         parent_pid = getpid();
 901
 902         pam_pid = fork();
 903         if (pam_pid < 0) {
 904                 r = -errno;
 905                 goto fail;
 906         }
 907
 908         if (pam_pid == 0) {
 909                 int sig, ret = EXIT_PAM;
 910
 911                 /* The child's job is to reset the PAM session on
 912                  * termination */
 913                 barrier_set_role(&barrier, BARRIER_CHILD);
 914
 915                 /* This string must fit in 10 chars (i.e. the length
 916                  * of "/sbin/init"), to look pretty in /bin/ps */
 917                 rename_process("(sd-pam)");
 918
 919                 /* Make sure we don't keep open the passed fds in this
 920                 child. We assume that otherwise only those fds are
 921                 open here that have been opened by PAM. */
 922                 close_many(fds, n_fds);
 923
 924                 /* Drop privileges - we don't need any to pam_close_session
 925                  * and this will make PR_SET_PDEATHSIG work in most cases.
 926                  * If this fails, ignore the error - but expect sd-pam threads
 927                  * to fail to exit normally */
 928                 if (setresuid(uid, uid, uid) < 0)
 929                         log_error_errno(r, "Error: Failed to setresuid() in sd-pam: %m");
 930
 931                 (void) ignore_signals(SIGPIPE, -1);
 932
 933                 /* Wait until our parent died. This will only work if
 934                  * the above setresuid() succeeds, otherwise the kernel
 935                  * will not allow unprivileged parents kill their privileged
 936                  * children this way. We rely on the control groups kill logic
 937                  * to do the rest for us. */
 938                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 939                         goto child_finish;
 940
 941                 /* Tell the parent that our setup is done. This is especially
 942                  * important regarding dropping privileges. Otherwise, unit
 943                  * setup might race against our setresuid(2) call. */
 944                 barrier_place(&barrier);
 945
 946                 /* Check if our parent process might already have
 947                  * died? */
 948                 if (getppid() == parent_pid) {
 949                         sigset_t ss;
 950
 951                         assert_se(sigemptyset(&ss) >= 0);
 952                         assert_se(sigaddset(&ss, SIGTERM) >= 0);
 953
 954                         for (;;) {
 955                                 if (sigwait(&ss, &sig) < 0) {
 956                                         if (errno == EINTR)
 957                                                 continue;
 958
 959                                         goto child_finish;
 960                                 }
 961
 962                                 assert(sig == SIGTERM);
 963                                 break;
 964                         }
 965                 }
 966
 967                 /* If our parent died we'll end the session */
 968                 if (getppid() != parent_pid) {
 969                         pam_code = pam_close_session(handle, flags);
 970                         if (pam_code != PAM_SUCCESS)
 971                                 goto child_finish;
 972                 }
 973
 974                 ret = 0;
 975
 976         child_finish:
 977                 pam_end(handle, pam_code | flags);
 978                 _exit(ret);
 979         }
 980
 981         barrier_set_role(&barrier, BARRIER_PARENT);
 982
 983         /* If the child was forked off successfully it will do all the
 984          * cleanups, so forget about the handle here. */
 985         handle = NULL;
 986
 987         /* Unblock SIGTERM again in the parent */
 988         assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
 989
 990         /* We close the log explicitly here, since the PAM modules
 991          * might have opened it, but we don't want this fd around. */
 992         closelog();
 993
 994         /* Synchronously wait for the child to initialize. We don't care for
 995          * errors as we cannot recover. However, warn loudly if it happens. */
 996         if (!barrier_place_and_sync(&barrier))
 997                 log_error("PAM initialization failed");
 998
 999         strv_free(*env);
1000         *env = e;
1001
1002         return 0;
1003
1004 fail:
1005         if (pam_code != PAM_SUCCESS) {
1006                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1007                 r = -EPERM;  /* PAM errors do not map to errno */
1008         } else
1009                 log_error_errno(r, "PAM failed: %m");
1010
1011         if (handle) {
1012                 if (close_session)
1013                         pam_code = pam_close_session(handle, flags);
1014
1015                 pam_end(handle, pam_code | flags);
1016         }
1017
1018         strv_free(e);
1019         closelog();
1020
1021         return r;
1022 }
1023 #endif
1024
1025 static void rename_process_from_path(const char *path) {
1026         char process_name[11];
1027         const char *p;
1028         size_t l;
1029
1030         /* This resulting string must fit in 10 chars (i.e. the length
1031          * of "/sbin/init") to look pretty in /bin/ps */
1032
1033         p = basename(path);
1034         if (isempty(p)) {
1035                 rename_process("(...)");
1036                 return;
1037         }
1038
1039         l = strlen(p);
1040         if (l > 8) {
1041                 /* The end of the process name is usually more
1042                  * interesting, since the first bit might just be
1043                  * "systemd-" */
1044                 p = p + l - 8;
1045                 l = 8;
1046         }
1047
1048         process_name[0] = '(';
1049         memcpy(process_name+1, p, l);
1050         process_name[1+l] = ')';
1051         process_name[1+l+1] = 0;
1052
1053         rename_process(process_name);
1054 }
1055
1056 #ifdef HAVE_SECCOMP
1057
1058 static int apply_seccomp(const ExecContext *c) {
1059         uint32_t negative_action, action;
1060         scmp_filter_ctx *seccomp;
1061         Iterator i;
1062         void *id;
1063         int r;
1064
1065         assert(c);
1066
1067         negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
1068
1069         seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
1070         if (!seccomp)
1071                 return -ENOMEM;
1072
1073         if (c->syscall_archs) {
1074
1075                 SET_FOREACH(id, c->syscall_archs, i) {
1076                         r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
1077                         if (r == -EEXIST)
1078                                 continue;
1079                         if (r < 0)
1080                                 goto finish;
1081                 }
1082
1083         } else {
1084                 r = seccomp_add_secondary_archs(seccomp);
1085                 if (r < 0)
1086                         goto finish;
1087         }
1088
1089         action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
1090         SET_FOREACH(id, c->syscall_filter, i) {
1091                 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
1092                 if (r < 0)
1093                         goto finish;
1094         }
1095
1096         r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1097         if (r < 0)
1098                 goto finish;
1099
1100         r = seccomp_load(seccomp);
1101
1102 finish:
1103         seccomp_release(seccomp);
1104         return r;
1105 }
1106
1107 static int apply_address_families(const ExecContext *c) {
1108         scmp_filter_ctx *seccomp;
1109         Iterator i;
1110         int r;
1111
1112         assert(c);
1113
1114         seccomp = seccomp_init(SCMP_ACT_ALLOW);
1115         if (!seccomp)
1116                 return -ENOMEM;
1117
1118         r = seccomp_add_secondary_archs(seccomp);
1119         if (r < 0)
1120                 goto finish;
1121
1122         if (c->address_families_whitelist) {
1123                 int af, first = 0, last = 0;
1124                 void *afp;
1125
1126                 /* If this is a whitelist, we first block the address
1127                  * families that are out of range and then everything
1128                  * that is not in the set. First, we find the lowest
1129                  * and highest address family in the set. */
1130
1131                 SET_FOREACH(afp, c->address_families, i) {
1132                         af = PTR_TO_INT(afp);
1133
1134                         if (af <= 0 || af >= af_max())
1135                                 continue;
1136
1137                         if (first == 0 || af < first)
1138                                 first = af;
1139
1140                         if (last == 0 || af > last)
1141                                 last = af;
1142                 }
1143
1144                 assert((first == 0) == (last == 0));
1145
1146                 if (first == 0) {
1147
1148                         /* No entries in the valid range, block everything */
1149                         r = seccomp_rule_add(
1150                                         seccomp,
1151                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1152                                         SCMP_SYS(socket),
1153                                         0);
1154                         if (r < 0)
1155                                 goto finish;
1156
1157                 } else {
1158
1159                         /* Block everything below the first entry */
1160                         r = seccomp_rule_add(
1161                                         seccomp,
1162                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1163                                         SCMP_SYS(socket),
1164                                         1,
1165                                         SCMP_A0(SCMP_CMP_LT, first));
1166                         if (r < 0)
1167                                 goto finish;
1168
1169                         /* Block everything above the last entry */
1170                         r = seccomp_rule_add(
1171                                         seccomp,
1172                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1173                                         SCMP_SYS(socket),
1174                                         1,
1175                                         SCMP_A0(SCMP_CMP_GT, last));
1176                         if (r < 0)
1177                                 goto finish;
1178
1179                         /* Block everything between the first and last
1180                          * entry */
1181                         for (af = 1; af < af_max(); af++) {
1182
1183                                 if (set_contains(c->address_families, INT_TO_PTR(af)))
1184                                         continue;
1185
1186                                 r = seccomp_rule_add(
1187                                                 seccomp,
1188                                                 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1189                                                 SCMP_SYS(socket),
1190                                                 1,
1191                                                 SCMP_A0(SCMP_CMP_EQ, af));
1192                                 if (r < 0)
1193                                         goto finish;
1194                         }
1195                 }
1196
1197         } else {
1198                 void *af;
1199
1200                 /* If this is a blacklist, then generate one rule for
1201                  * each address family that are then combined in OR
1202                  * checks. */
1203
1204                 SET_FOREACH(af, c->address_families, i) {
1205
1206                         r = seccomp_rule_add(
1207                                         seccomp,
1208                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1209                                         SCMP_SYS(socket),
1210                                         1,
1211                                         SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
1212                         if (r < 0)
1213                                 goto finish;
1214                 }
1215         }
1216
1217         r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1218         if (r < 0)
1219                 goto finish;
1220
1221         r = seccomp_load(seccomp);
1222
1223 finish:
1224         seccomp_release(seccomp);
1225         return r;
1226 }
1227
1228 static int apply_memory_deny_write_execute(const ExecContext *c) {
1229         scmp_filter_ctx *seccomp;
1230         int r;
1231
1232         assert(c);
1233
1234         seccomp = seccomp_init(SCMP_ACT_ALLOW);
1235         if (!seccomp)
1236                 return -ENOMEM;
1237
1238         r = seccomp_rule_add(
1239                         seccomp,
1240                         SCMP_ACT_KILL,
1241                         SCMP_SYS(mmap),
1242                         1,
1243                         SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC|PROT_WRITE, PROT_EXEC|PROT_WRITE));
1244         if (r < 0)
1245                 goto finish;
1246
1247         r = seccomp_rule_add(
1248                         seccomp,
1249                         SCMP_ACT_KILL,
1250                         SCMP_SYS(mprotect),
1251                         1,
1252                         SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC, PROT_EXEC));
1253         if (r < 0)
1254                 goto finish;
1255
1256         r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1257         if (r < 0)
1258                 goto finish;
1259
1260         r = seccomp_load(seccomp);
1261
1262 finish:
1263         seccomp_release(seccomp);
1264         return r;
1265 }
1266
1267 #endif
1268
1269 static void do_idle_pipe_dance(int idle_pipe[4]) {
1270         assert(idle_pipe);
1271
1272
1273         idle_pipe[1] = safe_close(idle_pipe[1]);
1274         idle_pipe[2] = safe_close(idle_pipe[2]);
1275
1276         if (idle_pipe[0] >= 0) {
1277                 int r;
1278
1279                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1280
1281                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1282                         ssize_t n;
1283
1284                         /* Signal systemd that we are bored and want to continue. */
1285                         n = write(idle_pipe[3], "x", 1);
1286                         if (n > 0)
1287                                 /* Wait for systemd to react to the signal above. */
1288                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1289                 }
1290
1291                 idle_pipe[0] = safe_close(idle_pipe[0]);
1292
1293         }
1294
1295         idle_pipe[3] = safe_close(idle_pipe[3]);
1296 }
1297
1298 static int build_environment(
1299                 const ExecContext *c,
1300                 const ExecParameters *p,
1301                 unsigned n_fds,
1302                 const char *home,
1303                 const char *username,
1304                 const char *shell,
1305                 dev_t journal_stream_dev,
1306                 ino_t journal_stream_ino,
1307                 char ***ret) {
1308
1309         _cleanup_strv_free_ char **our_env = NULL;
1310         unsigned n_env = 0;
1311         char *x;
1312
1313         assert(c);
1314         assert(ret);
1315
1316         our_env = new0(char*, 12);
1317         if (!our_env)
1318                 return -ENOMEM;
1319
1320         if (n_fds > 0) {
1321                 _cleanup_free_ char *joined = NULL;
1322
1323                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
1324                         return -ENOMEM;
1325                 our_env[n_env++] = x;
1326
1327                 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1328                         return -ENOMEM;
1329                 our_env[n_env++] = x;
1330
1331                 joined = strv_join(p->fd_names, ":");
1332                 if (!joined)
1333                         return -ENOMEM;
1334
1335                 x = strjoin("LISTEN_FDNAMES=", joined, NULL);
1336                 if (!x)
1337                         return -ENOMEM;
1338                 our_env[n_env++] = x;
1339         }
1340
1341         if (p->watchdog_usec > 0) {
1342                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
1343                         return -ENOMEM;
1344                 our_env[n_env++] = x;
1345
1346                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1347                         return -ENOMEM;
1348                 our_env[n_env++] = x;
1349         }
1350
1351         if (home) {
1352                 x = strappend("HOME=", home);
1353                 if (!x)
1354                         return -ENOMEM;
1355                 our_env[n_env++] = x;
1356         }
1357
1358         if (username) {
1359                 x = strappend("LOGNAME=", username);
1360                 if (!x)
1361                         return -ENOMEM;
1362                 our_env[n_env++] = x;
1363
1364                 x = strappend("USER=", username);
1365                 if (!x)
1366                         return -ENOMEM;
1367                 our_env[n_env++] = x;
1368         }
1369
1370         if (shell) {
1371                 x = strappend("SHELL=", shell);
1372                 if (!x)
1373                         return -ENOMEM;
1374                 our_env[n_env++] = x;
1375         }
1376
1377         if (is_terminal_input(c->std_input) ||
1378             c->std_output == EXEC_OUTPUT_TTY ||
1379             c->std_error == EXEC_OUTPUT_TTY ||
1380             c->tty_path) {
1381
1382                 x = strdup(default_term_for_tty(exec_context_tty_path(c)));
1383                 if (!x)
1384                         return -ENOMEM;
1385                 our_env[n_env++] = x;
1386         }
1387
1388         if (journal_stream_dev != 0 && journal_stream_ino != 0) {
1389                 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
1390                         return -ENOMEM;
1391
1392                 our_env[n_env++] = x;
1393         }
1394
1395         our_env[n_env++] = NULL;
1396         assert(n_env <= 12);
1397
1398         *ret = our_env;
1399         our_env = NULL;
1400
1401         return 0;
1402 }
1403
1404 static int build_pass_environment(const ExecContext *c, char ***ret) {
1405         _cleanup_strv_free_ char **pass_env = NULL;
1406         size_t n_env = 0, n_bufsize = 0;
1407         char **i;
1408
1409         STRV_FOREACH(i, c->pass_environment) {
1410                 _cleanup_free_ char *x = NULL;
1411                 char *v;
1412
1413                 v = getenv(*i);
1414                 if (!v)
1415                         continue;
1416                 x = strjoin(*i, "=", v, NULL);
1417                 if (!x)
1418                         return -ENOMEM;
1419                 if (!GREEDY_REALLOC(pass_env, n_bufsize, n_env + 2))
1420                         return -ENOMEM;
1421                 pass_env[n_env++] = x;
1422                 pass_env[n_env] = NULL;
1423                 x = NULL;
1424         }
1425
1426         *ret = pass_env;
1427         pass_env = NULL;
1428
1429         return 0;
1430 }
1431
1432 static bool exec_needs_mount_namespace(
1433                 const ExecContext *context,
1434                 const ExecParameters *params,
1435                 ExecRuntime *runtime) {
1436
1437         assert(context);
1438         assert(params);
1439
1440         if (!strv_isempty(context->read_write_dirs) ||
1441             !strv_isempty(context->read_only_dirs) ||
1442             !strv_isempty(context->inaccessible_dirs))
1443                 return true;
1444
1445         if (context->mount_flags != 0)
1446                 return true;
1447
1448         if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
1449                 return true;
1450
1451         if (context->private_devices ||
1452             context->protect_system != PROTECT_SYSTEM_NO ||
1453             context->protect_home != PROTECT_HOME_NO)
1454                 return true;
1455
1456         return false;
1457 }
1458
1459 static int close_remaining_fds(
1460                 const ExecParameters *params,
1461                 ExecRuntime *runtime,
1462                 int socket_fd,
1463                 int *fds, unsigned n_fds) {
1464
1465         unsigned n_dont_close = 0;
1466         int dont_close[n_fds + 7];
1467
1468         assert(params);
1469
1470         if (params->stdin_fd >= 0)
1471                 dont_close[n_dont_close++] = params->stdin_fd;
1472         if (params->stdout_fd >= 0)
1473                 dont_close[n_dont_close++] = params->stdout_fd;
1474         if (params->stderr_fd >= 0)
1475                 dont_close[n_dont_close++] = params->stderr_fd;
1476
1477         if (socket_fd >= 0)
1478                 dont_close[n_dont_close++] = socket_fd;
1479         if (n_fds > 0) {
1480                 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1481                 n_dont_close += n_fds;
1482         }
1483
1484         if (runtime) {
1485                 if (runtime->netns_storage_socket[0] >= 0)
1486                         dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
1487                 if (runtime->netns_storage_socket[1] >= 0)
1488                         dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
1489         }
1490
1491         return close_all_fds(dont_close, n_dont_close);
1492 }
1493
1494 static int exec_child(
1495                 Unit *unit,
1496                 ExecCommand *command,
1497                 const ExecContext *context,
1498                 const ExecParameters *params,
1499                 ExecRuntime *runtime,
1500                 char **argv,
1501                 int socket_fd,
1502                 int *fds, unsigned n_fds,
1503                 char **files_env,
1504                 int *exit_status) {
1505
1506         _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **accum_env = NULL, **final_argv = NULL;
1507         _cleanup_free_ char *mac_selinux_context_net = NULL;
1508         const char *username = NULL, *home = NULL, *shell = NULL, *wd;
1509         dev_t journal_stream_dev = 0;
1510         ino_t journal_stream_ino = 0;
1511         bool needs_mount_namespace;
1512         uid_t uid = UID_INVALID;
1513         gid_t gid = GID_INVALID;
1514         int i, r;
1515
1516         assert(unit);
1517         assert(command);
1518         assert(context);
1519         assert(params);
1520         assert(exit_status);
1521
1522         rename_process_from_path(command->path);
1523
1524         /* We reset exactly these signals, since they are the
1525          * only ones we set to SIG_IGN in the main daemon. All
1526          * others we leave untouched because we set them to
1527          * SIG_DFL or a valid handler initially, both of which
1528          * will be demoted to SIG_DFL. */
1529         (void) default_signals(SIGNALS_CRASH_HANDLER,
1530                                SIGNALS_IGNORE, -1);
1531
1532         if (context->ignore_sigpipe)
1533                 (void) ignore_signals(SIGPIPE, -1);
1534
1535         r = reset_signal_mask();
1536         if (r < 0) {
1537                 *exit_status = EXIT_SIGNAL_MASK;
1538                 return r;
1539         }
1540
1541         if (params->idle_pipe)
1542                 do_idle_pipe_dance(params->idle_pipe);
1543
1544         /* Close sockets very early to make sure we don't
1545          * block init reexecution because it cannot bind its
1546          * sockets */
1547
1548         log_forget_fds();
1549
1550         r = close_remaining_fds(params, runtime, socket_fd, fds, n_fds);
1551         if (r < 0) {
1552                 *exit_status = EXIT_FDS;
1553                 return r;
1554         }
1555
1556         if (!context->same_pgrp)
1557                 if (setsid() < 0) {
1558                         *exit_status = EXIT_SETSID;
1559                         return -errno;
1560                 }
1561
1562         exec_context_tty_reset(context, params);
1563
1564         if (params->confirm_spawn) {
1565                 char response;
1566
1567                 r = ask_for_confirmation(&response, argv);
1568                 if (r == -ETIMEDOUT)
1569                         write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1570                 else if (r < 0)
1571                         write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-r));
1572                 else if (response == 's') {
1573                         write_confirm_message("Skipping execution.\n");
1574                         *exit_status = EXIT_CONFIRM;
1575                         return -ECANCELED;
1576                 } else if (response == 'n') {
1577                         write_confirm_message("Failing execution.\n");
1578                         *exit_status = 0;
1579                         return 0;
1580                 }
1581         }
1582
1583         if (context->user) {
1584                 username = context->user;
1585                 r = get_user_creds(&username, &uid, &gid, &home, &shell);
1586                 if (r < 0) {
1587                         *exit_status = EXIT_USER;
1588                         return r;
1589                 }
1590         }
1591
1592         if (context->group) {
1593                 const char *g = context->group;
1594
1595                 r = get_group_creds(&g, &gid);
1596                 if (r < 0) {
1597                         *exit_status = EXIT_GROUP;
1598                         return r;
1599                 }
1600         }
1601
1602
1603         /* If a socket is connected to STDIN/STDOUT/STDERR, we
1604          * must sure to drop O_NONBLOCK */
1605         if (socket_fd >= 0)
1606                 (void) fd_nonblock(socket_fd, false);
1607
1608         r = setup_input(context, params, socket_fd);
1609         if (r < 0) {
1610                 *exit_status = EXIT_STDIN;
1611                 return r;
1612         }
1613
1614         r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
1615         if (r < 0) {
1616                 *exit_status = EXIT_STDOUT;
1617                 return r;
1618         }
1619
1620         r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
1621         if (r < 0) {
1622                 *exit_status = EXIT_STDERR;
1623                 return r;
1624         }
1625
1626         if (params->cgroup_path) {
1627                 r = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0, NULL, NULL);
1628                 if (r < 0) {
1629                         *exit_status = EXIT_CGROUP;
1630                         return r;
1631                 }
1632         }
1633
1634         if (context->oom_score_adjust_set) {
1635                 char t[DECIMAL_STR_MAX(context->oom_score_adjust)];
1636
1637                 /* When we can't make this change due to EPERM, then
1638                  * let's silently skip over it. User namespaces
1639                  * prohibit write access to this file, and we
1640                  * shouldn't trip up over that. */
1641
1642                 sprintf(t, "%i", context->oom_score_adjust);
1643                 r = write_string_file("/proc/self/oom_score_adj", t, 0);
1644                 if (r == -EPERM || r == -EACCES) {
1645                         log_open();
1646                         log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
1647                         log_close();
1648                 } else if (r < 0) {
1649                         *exit_status = EXIT_OOM_ADJUST;
1650                         return -errno;
1651                 }
1652         }
1653
1654         if (context->nice_set)
1655                 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1656                         *exit_status = EXIT_NICE;
1657                         return -errno;
1658                 }
1659
1660         if (context->cpu_sched_set) {
1661                 struct sched_param param = {
1662                         .sched_priority = context->cpu_sched_priority,
1663                 };
1664
1665                 r = sched_setscheduler(0,
1666                                        context->cpu_sched_policy |
1667                                        (context->cpu_sched_reset_on_fork ?
1668                                         SCHED_RESET_ON_FORK : 0),
1669                                        &param);
1670                 if (r < 0) {
1671                         *exit_status = EXIT_SETSCHEDULER;
1672                         return -errno;
1673                 }
1674         }
1675
1676         if (context->cpuset)
1677                 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1678                         *exit_status = EXIT_CPUAFFINITY;
1679                         return -errno;
1680                 }
1681
1682         if (context->ioprio_set)
1683                 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1684                         *exit_status = EXIT_IOPRIO;
1685                         return -errno;
1686                 }
1687
1688         if (context->timer_slack_nsec != NSEC_INFINITY)
1689                 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1690                         *exit_status = EXIT_TIMERSLACK;
1691                         return -errno;
1692                 }
1693
1694         if (context->personality != PERSONALITY_INVALID)
1695                 if (personality(context->personality) < 0) {
1696                         *exit_status = EXIT_PERSONALITY;
1697                         return -errno;
1698                 }
1699
1700         if (context->utmp_id)
1701                 utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path,
1702                                       context->utmp_mode == EXEC_UTMP_INIT  ? INIT_PROCESS :
1703                                       context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
1704                                       USER_PROCESS,
1705                                       username ? "root" : context->user);
1706
1707         if (context->user && is_terminal_input(context->std_input)) {
1708                 r = chown_terminal(STDIN_FILENO, uid);
1709                 if (r < 0) {
1710                         *exit_status = EXIT_STDIN;
1711                         return r;
1712                 }
1713         }
1714
1715         /* If delegation is enabled we'll pass ownership of the cgroup
1716          * (but only in systemd's own controller hierarchy!) to the
1717          * user of the new process. */
1718         if (params->cgroup_path && context->user && params->cgroup_delegate) {
1719                 r = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
1720                 if (r < 0) {
1721                         *exit_status = EXIT_CGROUP;
1722                         return r;
1723                 }
1724
1725
1726                 r = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
1727                 if (r < 0) {
1728                         *exit_status = EXIT_CGROUP;
1729                         return r;
1730                 }
1731         }
1732
1733         if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
1734                 char **rt;
1735
1736                 STRV_FOREACH(rt, context->runtime_directory) {
1737                         _cleanup_free_ char *p;
1738
1739                         p = strjoin(params->runtime_prefix, "/", *rt, NULL);
1740                         if (!p) {
1741                                 *exit_status = EXIT_RUNTIME_DIRECTORY;
1742                                 return -ENOMEM;
1743                         }
1744
1745                         r = mkdir_p_label(p, context->runtime_directory_mode);
1746                         if (r < 0) {
1747                                 *exit_status = EXIT_RUNTIME_DIRECTORY;
1748                                 return r;
1749                         }
1750
1751                         r = chmod_and_chown(p, context->runtime_directory_mode, uid, gid);
1752                         if (r < 0) {
1753                                 *exit_status = EXIT_RUNTIME_DIRECTORY;
1754                                 return r;
1755                         }
1756                 }
1757         }
1758
1759         r = build_environment(
1760                         context,
1761                         params,
1762                         n_fds,
1763                         home,
1764                         username,
1765                         shell,
1766                         journal_stream_dev,
1767                         journal_stream_ino,
1768                         &our_env);
1769         if (r < 0) {
1770                 *exit_status = EXIT_MEMORY;
1771                 return r;
1772         }
1773
1774         r = build_pass_environment(context, &pass_env);
1775         if (r < 0) {
1776                 *exit_status = EXIT_MEMORY;
1777                 return r;
1778         }
1779
1780         accum_env = strv_env_merge(5,
1781                                    params->environment,
1782                                    our_env,
1783                                    pass_env,
1784                                    context->environment,
1785                                    files_env,
1786                                    NULL);
1787         if (!accum_env) {
1788                 *exit_status = EXIT_MEMORY;
1789                 return -ENOMEM;
1790         }
1791
1792         umask(context->umask);
1793
1794         if (params->apply_permissions && !command->privileged) {
1795                 r = enforce_groups(context, username, gid);
1796                 if (r < 0) {
1797                         *exit_status = EXIT_GROUP;
1798                         return r;
1799                 }
1800 #ifdef HAVE_SMACK
1801                 if (context->smack_process_label) {
1802                         r = mac_smack_apply_pid(0, context->smack_process_label);
1803                         if (r < 0) {
1804                                 *exit_status = EXIT_SMACK_PROCESS_LABEL;
1805                                 return r;
1806                         }
1807                 }
1808 #ifdef SMACK_DEFAULT_PROCESS_LABEL
1809                 else {
1810                         _cleanup_free_ char *exec_label = NULL;
1811
1812                         r = mac_smack_read(command->path, SMACK_ATTR_EXEC, &exec_label);
1813                         if (r < 0 && r != -ENODATA && r != -EOPNOTSUPP) {
1814                                 *exit_status = EXIT_SMACK_PROCESS_LABEL;
1815                                 return r;
1816                         }
1817
1818                         r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
1819                         if (r < 0) {
1820                                 *exit_status = EXIT_SMACK_PROCESS_LABEL;
1821                                 return r;
1822                         }
1823                 }
1824 #endif
1825 #endif
1826 #ifdef HAVE_PAM
1827                 if (context->pam_name && username) {
1828                         r = setup_pam(context->pam_name, username, uid, context->tty_path, &accum_env, fds, n_fds);
1829                         if (r < 0) {
1830                                 *exit_status = EXIT_PAM;
1831                                 return r;
1832                         }
1833                 }
1834 #endif
1835         }
1836
1837         if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
1838                 r = setup_netns(runtime->netns_storage_socket);
1839                 if (r < 0) {
1840                         *exit_status = EXIT_NETWORK;
1841                         return r;
1842                 }
1843         }
1844
1845         needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
1846
1847         if (needs_mount_namespace) {
1848                 char *tmp = NULL, *var = NULL;
1849
1850                 /* The runtime struct only contains the parent
1851                  * of the private /tmp, which is
1852                  * non-accessible to world users. Inside of it
1853                  * there's a /tmp that is sticky, and that's
1854                  * the one we want to use here. */
1855
1856                 if (context->private_tmp && runtime) {
1857                         if (runtime->tmp_dir)
1858                                 tmp = strjoina(runtime->tmp_dir, "/tmp");
1859                         if (runtime->var_tmp_dir)
1860                                 var = strjoina(runtime->var_tmp_dir, "/tmp");
1861                 }
1862
1863                 r = setup_namespace(
1864                                 params->apply_chroot ? context->root_directory : NULL,
1865                                 context->read_write_dirs,
1866                                 context->read_only_dirs,
1867                                 context->inaccessible_dirs,
1868                                 tmp,
1869                                 var,
1870                                 context->private_devices,
1871                                 context->protect_home,
1872                                 context->protect_system,
1873                                 context->mount_flags);
1874
1875                 /* If we couldn't set up the namespace this is
1876                  * probably due to a missing capability. In this case,
1877                  * silently proceeed. */
1878                 if (r == -EPERM || r == -EACCES) {
1879                         log_open();
1880                         log_unit_debug_errno(unit, r, "Failed to set up namespace, assuming containerized execution, ignoring: %m");
1881                         log_close();
1882                 } else if (r < 0) {
1883                         *exit_status = EXIT_NAMESPACE;
1884                         return r;
1885                 }
1886         }
1887
1888         if (context->working_directory_home)
1889                 wd = home;
1890         else if (context->working_directory)
1891                 wd = context->working_directory;
1892         else
1893                 wd = "/";
1894
1895         if (params->apply_chroot) {
1896                 if (!needs_mount_namespace && context->root_directory)
1897                         if (chroot(context->root_directory) < 0) {
1898                                 *exit_status = EXIT_CHROOT;
1899                                 return -errno;
1900                         }
1901
1902                 if (chdir(wd) < 0 &&
1903                     !context->working_directory_missing_ok) {
1904                         *exit_status = EXIT_CHDIR;
1905                         return -errno;
1906                 }
1907         } else {
1908                 const char *d;
1909
1910                 d = strjoina(strempty(context->root_directory), "/", strempty(wd));
1911                 if (chdir(d) < 0 &&
1912                     !context->working_directory_missing_ok) {
1913                         *exit_status = EXIT_CHDIR;
1914                         return -errno;
1915                 }
1916         }
1917
1918 #ifdef HAVE_SELINUX
1919         if (params->apply_permissions && mac_selinux_use() && params->selinux_context_net && socket_fd >= 0 && !command->privileged) {
1920                 r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
1921                 if (r < 0) {
1922                         *exit_status = EXIT_SELINUX_CONTEXT;
1923                         return r;
1924                 }
1925         }
1926 #endif
1927
1928         /* We repeat the fd closing here, to make sure that
1929          * nothing is leaked from the PAM modules. Note that
1930          * we are more aggressive this time since socket_fd
1931          * and the netns fds we don't need anymore. The custom
1932          * endpoint fd was needed to upload the policy and can
1933          * now be closed as well. */
1934         r = close_all_fds(fds, n_fds);
1935         if (r >= 0)
1936                 r = shift_fds(fds, n_fds);
1937         if (r >= 0)
1938                 r = flags_fds(fds, n_fds, context->non_blocking);
1939         if (r < 0) {
1940                 *exit_status = EXIT_FDS;
1941                 return r;
1942         }
1943
1944         if (params->apply_permissions && !command->privileged) {
1945
1946                 bool use_address_families = context->address_families_whitelist ||
1947                         !set_isempty(context->address_families);
1948                 bool use_syscall_filter = context->syscall_whitelist ||
1949                         !set_isempty(context->syscall_filter) ||
1950                         !set_isempty(context->syscall_archs);
1951                 int secure_bits = context->secure_bits;
1952
1953                 for (i = 0; i < _RLIMIT_MAX; i++) {
1954                         if (!context->rlimit[i])
1955                                 continue;
1956
1957                         if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1958                                 *exit_status = EXIT_LIMITS;
1959                                 return -errno;
1960                         }
1961                 }
1962
1963                 if (!cap_test_all(context->capability_bounding_set)) {
1964                         r = capability_bounding_set_drop(context->capability_bounding_set, false);
1965                         if (r < 0) {
1966                                 *exit_status = EXIT_CAPABILITIES;
1967                                 return r;
1968                         }
1969                 }
1970
1971                 /* This is done before enforce_user, but ambient set
1972                  * does not survive over setresuid() if keep_caps is not set. */
1973                 if (context->capability_ambient_set != 0) {
1974                         r = capability_ambient_set_apply(context->capability_ambient_set, true);
1975                         if (r < 0) {
1976                                 *exit_status = EXIT_CAPABILITIES;
1977                                 return r;
1978                         }
1979                 }
1980
1981                 if (context->user) {
1982                         r = enforce_user(context, uid);
1983                         if (r < 0) {
1984                                 *exit_status = EXIT_USER;
1985                                 return r;
1986                         }
1987                         if (context->capability_ambient_set != 0) {
1988
1989                                 /* Fix the ambient capabilities after user change. */
1990                                 r = capability_ambient_set_apply(context->capability_ambient_set, false);
1991                                 if (r < 0) {
1992                                         *exit_status = EXIT_CAPABILITIES;
1993                                         return r;
1994                                 }
1995
1996                                 /* If we were asked to change user and ambient capabilities
1997                                  * were requested, we had to add keep-caps to the securebits
1998                                  * so that we would maintain the inherited capability set
1999                                  * through the setresuid(). Make sure that the bit is added
2000                                  * also to the context secure_bits so that we don't try to
2001                                  * drop the bit away next. */
2002
2003                                 secure_bits |= 1<<SECURE_KEEP_CAPS;
2004                         }
2005                 }
2006
2007                 /* PR_GET_SECUREBITS is not privileged, while
2008                  * PR_SET_SECUREBITS is. So to suppress
2009                  * potential EPERMs we'll try not to call
2010                  * PR_SET_SECUREBITS unless necessary. */
2011                 if (prctl(PR_GET_SECUREBITS) != secure_bits)
2012                         if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
2013                                 *exit_status = EXIT_SECUREBITS;
2014                                 return -errno;
2015                         }
2016
2017                 if (context->no_new_privileges ||
2018                     (!have_effective_cap(CAP_SYS_ADMIN) && (use_address_families || use_syscall_filter)))
2019                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
2020                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
2021                                 return -errno;
2022                         }
2023
2024 #ifdef HAVE_SECCOMP
2025                 if (use_address_families) {
2026                         r = apply_address_families(context);
2027                         if (r < 0) {
2028                                 *exit_status = EXIT_ADDRESS_FAMILIES;
2029                                 return r;
2030                         }
2031                 }
2032
2033                 if (context->memory_deny_write_execute) {
2034                         r = apply_memory_deny_write_execute(context);
2035                         if (r < 0) {
2036                                 *exit_status = EXIT_SECCOMP;
2037                                 return r;
2038                         }
2039                 }
2040                 if (use_syscall_filter) {
2041                         r = apply_seccomp(context);
2042                         if (r < 0) {
2043                                 *exit_status = EXIT_SECCOMP;
2044                                 return r;
2045                         }
2046                 }
2047 #endif
2048
2049 #ifdef HAVE_SELINUX
2050                 if (mac_selinux_use()) {
2051                         char *exec_context = mac_selinux_context_net ?: context->selinux_context;
2052
2053                         if (exec_context) {
2054                                 r = setexeccon(exec_context);
2055                                 if (r < 0) {
2056                                         *exit_status = EXIT_SELINUX_CONTEXT;
2057                                         return r;
2058                                 }
2059                         }
2060                 }
2061 #endif
2062
2063 #ifdef HAVE_APPARMOR
2064                 if (context->apparmor_profile && mac_apparmor_use()) {
2065                         r = aa_change_onexec(context->apparmor_profile);
2066                         if (r < 0 && !context->apparmor_profile_ignore) {
2067                                 *exit_status = EXIT_APPARMOR_PROFILE;
2068                                 return -errno;
2069                         }
2070                 }
2071 #endif
2072         }
2073
2074         final_argv = replace_env_argv(argv, accum_env);
2075         if (!final_argv) {
2076                 *exit_status = EXIT_MEMORY;
2077                 return -ENOMEM;
2078         }
2079
2080         accum_env = strv_env_clean(accum_env);
2081
2082         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
2083                 _cleanup_free_ char *line;
2084
2085                 line = exec_command_line(final_argv);
2086                 if (line) {
2087                         log_open();
2088                         log_struct(LOG_DEBUG,
2089                                    LOG_UNIT_ID(unit),
2090                                    "EXECUTABLE=%s", command->path,
2091                                    LOG_UNIT_MESSAGE(unit, "Executing: %s", line),
2092                                    NULL);
2093                         log_close();
2094                 }
2095         }
2096
2097         execve(command->path, final_argv, accum_env);
2098         *exit_status = EXIT_EXEC;
2099         return -errno;
2100 }
2101
2102 int exec_spawn(Unit *unit,
2103                ExecCommand *command,
2104                const ExecContext *context,
2105                const ExecParameters *params,
2106                ExecRuntime *runtime,
2107                pid_t *ret) {
2108
2109         _cleanup_strv_free_ char **files_env = NULL;
2110         int *fds = NULL; unsigned n_fds = 0;
2111         _cleanup_free_ char *line = NULL;
2112         int socket_fd, r;
2113         char **argv;
2114         pid_t pid;
2115
2116         assert(unit);
2117         assert(command);
2118         assert(context);
2119         assert(ret);
2120         assert(params);
2121         assert(params->fds || params->n_fds <= 0);
2122
2123         if (context->std_input == EXEC_INPUT_SOCKET ||
2124             context->std_output == EXEC_OUTPUT_SOCKET ||
2125             context->std_error == EXEC_OUTPUT_SOCKET) {
2126
2127                 if (params->n_fds != 1) {
2128                         log_unit_error(unit, "Got more than one socket.");
2129                         return -EINVAL;
2130                 }
2131
2132                 socket_fd = params->fds[0];
2133         } else {
2134                 socket_fd = -1;
2135                 fds = params->fds;
2136                 n_fds = params->n_fds;
2137         }
2138
2139         r = exec_context_load_environment(unit, context, &files_env);
2140         if (r < 0)
2141                 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
2142
2143         argv = params->argv ?: command->argv;
2144         line = exec_command_line(argv);
2145         if (!line)
2146                 return log_oom();
2147
2148         log_struct(LOG_DEBUG,
2149                    LOG_UNIT_ID(unit),
2150                    LOG_UNIT_MESSAGE(unit, "About to execute: %s", line),
2151                    "EXECUTABLE=%s", command->path,
2152                    NULL);
2153         pid = fork();
2154         if (pid < 0)
2155                 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
2156
2157         if (pid == 0) {
2158                 int exit_status;
2159
2160                 r = exec_child(unit,
2161                                command,
2162                                context,
2163                                params,
2164                                runtime,
2165                                argv,
2166                                socket_fd,
2167                                fds, n_fds,
2168                                files_env,
2169                                &exit_status);
2170                 if (r < 0) {
2171                         log_open();
2172                         log_struct_errno(LOG_ERR, r,
2173                                          LOG_MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
2174                                          LOG_UNIT_ID(unit),
2175                                          LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
2176                                                           exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
2177                                                           command->path),
2178                                          "EXECUTABLE=%s", command->path,
2179                                          NULL);
2180                 }
2181
2182                 _exit(exit_status);
2183         }
2184
2185         log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
2186
2187         /* We add the new process to the cgroup both in the child (so
2188          * that we can be sure that no user code is ever executed
2189          * outside of the cgroup) and in the parent (so that we can be
2190          * sure that when we kill the cgroup the process will be
2191          * killed too). */
2192         if (params->cgroup_path)
2193                 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
2194
2195         exec_status_start(&command->exec_status, pid);
2196
2197         *ret = pid;
2198         return 0;
2199 }
2200
2201 void exec_context_init(ExecContext *c) {
2202         assert(c);
2203
2204         c->umask = 0022;
2205         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
2206         c->cpu_sched_policy = SCHED_OTHER;
2207         c->syslog_priority = LOG_DAEMON|LOG_INFO;
2208         c->syslog_level_prefix = true;
2209         c->ignore_sigpipe = true;
2210         c->timer_slack_nsec = NSEC_INFINITY;
2211         c->personality = PERSONALITY_INVALID;
2212         c->runtime_directory_mode = 0755;
2213         c->capability_bounding_set = CAP_ALL;
2214 }
2215
2216 void exec_context_done(ExecContext *c) {
2217         unsigned l;
2218
2219         assert(c);
2220
2221         c->environment = strv_free(c->environment);
2222         c->environment_files = strv_free(c->environment_files);
2223         c->pass_environment = strv_free(c->pass_environment);
2224
2225         for (l = 0; l < ELEMENTSOF(c->rlimit); l++)
2226                 c->rlimit[l] = mfree(c->rlimit[l]);
2227
2228         c->working_directory = mfree(c->working_directory);
2229         c->root_directory = mfree(c->root_directory);
2230         c->tty_path = mfree(c->tty_path);
2231         c->syslog_identifier = mfree(c->syslog_identifier);
2232         c->user = mfree(c->user);
2233         c->group = mfree(c->group);
2234
2235         c->supplementary_groups = strv_free(c->supplementary_groups);
2236
2237         c->pam_name = mfree(c->pam_name);
2238
2239         c->read_only_dirs = strv_free(c->read_only_dirs);
2240         c->read_write_dirs = strv_free(c->read_write_dirs);
2241         c->inaccessible_dirs = strv_free(c->inaccessible_dirs);
2242
2243         if (c->cpuset)
2244                 CPU_FREE(c->cpuset);
2245
2246         c->utmp_id = mfree(c->utmp_id);
2247         c->selinux_context = mfree(c->selinux_context);
2248         c->apparmor_profile = mfree(c->apparmor_profile);
2249
2250         c->syscall_filter = set_free(c->syscall_filter);
2251         c->syscall_archs = set_free(c->syscall_archs);
2252         c->address_families = set_free(c->address_families);
2253
2254         c->runtime_directory = strv_free(c->runtime_directory);
2255 }
2256
2257 int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
2258         char **i;
2259
2260         assert(c);
2261
2262         if (!runtime_prefix)
2263                 return 0;
2264
2265         STRV_FOREACH(i, c->runtime_directory) {
2266                 _cleanup_free_ char *p;
2267
2268                 p = strjoin(runtime_prefix, "/", *i, NULL);
2269                 if (!p)
2270                         return -ENOMEM;
2271
2272                 /* We execute this synchronously, since we need to be
2273                  * sure this is gone when we start the service
2274                  * next. */
2275                 (void) rm_rf(p, REMOVE_ROOT);
2276         }
2277
2278         return 0;
2279 }
2280
2281 void exec_command_done(ExecCommand *c) {
2282         assert(c);
2283
2284         c->path = mfree(c->path);
2285
2286         c->argv = strv_free(c->argv);
2287 }
2288
2289 void exec_command_done_array(ExecCommand *c, unsigned n) {
2290         unsigned i;
2291
2292         for (i = 0; i < n; i++)
2293                 exec_command_done(c+i);
2294 }
2295
2296 ExecCommand* exec_command_free_list(ExecCommand *c) {
2297         ExecCommand *i;
2298
2299         while ((i = c)) {
2300                 LIST_REMOVE(command, c, i);
2301                 exec_command_done(i);
2302                 free(i);
2303         }
2304
2305         return NULL;
2306 }
2307
2308 void exec_command_free_array(ExecCommand **c, unsigned n) {
2309         unsigned i;
2310
2311         for (i = 0; i < n; i++)
2312                 c[i] = exec_command_free_list(c[i]);
2313 }
2314
2315 typedef struct InvalidEnvInfo {
2316         Unit *unit;
2317         const char *path;
2318 } InvalidEnvInfo;
2319
2320 static void invalid_env(const char *p, void *userdata) {
2321         InvalidEnvInfo *info = userdata;
2322
2323         log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
2324 }
2325
2326 int exec_context_load_environment(Unit *unit, const ExecContext *c, char ***l) {
2327         char **i, **r = NULL;
2328
2329         assert(c);
2330         assert(l);
2331
2332         STRV_FOREACH(i, c->environment_files) {
2333                 char *fn;
2334                 int k;
2335                 bool ignore = false;
2336                 char **p;
2337                 _cleanup_globfree_ glob_t pglob = {};
2338                 int count, n;
2339
2340                 fn = *i;
2341
2342                 if (fn[0] == '-') {
2343                         ignore = true;
2344                         fn++;
2345                 }
2346
2347                 if (!path_is_absolute(fn)) {
2348                         if (ignore)
2349                                 continue;
2350
2351                         strv_free(r);
2352                         return -EINVAL;
2353                 }
2354
2355                 /* Filename supports globbing, take all matching files */
2356                 errno = 0;
2357                 if (glob(fn, 0, NULL, &pglob) != 0) {
2358                         if (ignore)
2359                                 continue;
2360
2361                         strv_free(r);
2362                         return errno > 0 ? -errno : -EINVAL;
2363                 }
2364                 count = pglob.gl_pathc;
2365                 if (count == 0) {
2366                         if (ignore)
2367                                 continue;
2368
2369                         strv_free(r);
2370                         return -EINVAL;
2371                 }
2372                 for (n = 0; n < count; n++) {
2373                         k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
2374                         if (k < 0) {
2375                                 if (ignore)
2376                                         continue;
2377
2378                                 strv_free(r);
2379                                 return k;
2380                         }
2381                         /* Log invalid environment variables with filename */
2382                         if (p) {
2383                                 InvalidEnvInfo info = {
2384                                         .unit = unit,
2385                                         .path = pglob.gl_pathv[n]
2386                                 };
2387
2388                                 p = strv_env_clean_with_callback(p, invalid_env, &info);
2389                         }
2390
2391                         if (r == NULL)
2392                                 r = p;
2393                         else {
2394                                 char **m;
2395
2396                                 m = strv_env_merge(2, r, p);
2397                                 strv_free(r);
2398                                 strv_free(p);
2399                                 if (!m)
2400                                         return -ENOMEM;
2401
2402                                 r = m;
2403                         }
2404                 }
2405         }
2406
2407         *l = r;
2408
2409         return 0;
2410 }
2411
2412 static bool tty_may_match_dev_console(const char *tty) {
2413         _cleanup_free_ char *active = NULL;
2414         char *console;
2415
2416         if (!tty)
2417                 return true;
2418
2419         if (startswith(tty, "/dev/"))
2420                 tty += 5;
2421
2422         /* trivial identity? */
2423         if (streq(tty, "console"))
2424                 return true;
2425
2426         console = resolve_dev_console(&active);
2427         /* if we could not resolve, assume it may */
2428         if (!console)
2429                 return true;
2430
2431         /* "tty0" means the active VC, so it may be the same sometimes */
2432         return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
2433 }
2434
2435 bool exec_context_may_touch_console(ExecContext *ec) {
2436
2437         return (ec->tty_reset ||
2438                 ec->tty_vhangup ||
2439                 ec->tty_vt_disallocate ||
2440                 is_terminal_input(ec->std_input) ||
2441                 is_terminal_output(ec->std_output) ||
2442                 is_terminal_output(ec->std_error)) &&
2443                tty_may_match_dev_console(exec_context_tty_path(ec));
2444 }
2445
2446 static void strv_fprintf(FILE *f, char **l) {
2447         char **g;
2448
2449         assert(f);
2450
2451         STRV_FOREACH(g, l)
2452                 fprintf(f, " %s", *g);
2453 }
2454
2455 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
2456         char **e, **d;
2457         unsigned i;
2458
2459         assert(c);
2460         assert(f);
2461
2462         prefix = strempty(prefix);
2463
2464         fprintf(f,
2465                 "%sUMask: %04o\n"
2466                 "%sWorkingDirectory: %s\n"
2467                 "%sRootDirectory: %s\n"
2468                 "%sNonBlocking: %s\n"
2469                 "%sPrivateTmp: %s\n"
2470                 "%sPrivateNetwork: %s\n"
2471                 "%sPrivateDevices: %s\n"
2472                 "%sProtectHome: %s\n"
2473                 "%sProtectSystem: %s\n"
2474                 "%sIgnoreSIGPIPE: %s\n"
2475                 "%sMemoryDenyWriteExecute: %s\n",
2476                 prefix, c->umask,
2477                 prefix, c->working_directory ? c->working_directory : "/",
2478                 prefix, c->root_directory ? c->root_directory : "/",
2479                 prefix, yes_no(c->non_blocking),
2480                 prefix, yes_no(c->private_tmp),
2481                 prefix, yes_no(c->private_network),
2482                 prefix, yes_no(c->private_devices),
2483                 prefix, protect_home_to_string(c->protect_home),
2484                 prefix, protect_system_to_string(c->protect_system),
2485                 prefix, yes_no(c->ignore_sigpipe),
2486                 prefix, yes_no(c->memory_deny_write_execute));
2487
2488         STRV_FOREACH(e, c->environment)
2489                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
2490
2491         STRV_FOREACH(e, c->environment_files)
2492                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
2493
2494         STRV_FOREACH(e, c->pass_environment)
2495                 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
2496
2497         fprintf(f, "%sRuntimeDirectoryMode: %04o\n", prefix, c->runtime_directory_mode);
2498
2499         STRV_FOREACH(d, c->runtime_directory)
2500                 fprintf(f, "%sRuntimeDirectory: %s\n", prefix, *d);
2501
2502         if (c->nice_set)
2503                 fprintf(f,
2504                         "%sNice: %i\n",
2505                         prefix, c->nice);
2506
2507         if (c->oom_score_adjust_set)
2508                 fprintf(f,
2509                         "%sOOMScoreAdjust: %i\n",
2510                         prefix, c->oom_score_adjust);
2511
2512         for (i = 0; i < RLIM_NLIMITS; i++)
2513                 if (c->rlimit[i]) {
2514                         fprintf(f, "%s%s: " RLIM_FMT "\n",
2515                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
2516                         fprintf(f, "%s%sSoft: " RLIM_FMT "\n",
2517                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
2518                 }
2519
2520         if (c->ioprio_set) {
2521                 _cleanup_free_ char *class_str = NULL;
2522
2523                 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
2524                 fprintf(f,
2525                         "%sIOSchedulingClass: %s\n"
2526                         "%sIOPriority: %i\n",
2527                         prefix, strna(class_str),
2528                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
2529         }
2530
2531         if (c->cpu_sched_set) {
2532                 _cleanup_free_ char *policy_str = NULL;
2533
2534                 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
2535                 fprintf(f,
2536                         "%sCPUSchedulingPolicy: %s\n"
2537                         "%sCPUSchedulingPriority: %i\n"
2538                         "%sCPUSchedulingResetOnFork: %s\n",
2539                         prefix, strna(policy_str),
2540                         prefix, c->cpu_sched_priority,
2541                         prefix, yes_no(c->cpu_sched_reset_on_fork));
2542         }
2543
2544         if (c->cpuset) {
2545                 fprintf(f, "%sCPUAffinity:", prefix);
2546                 for (i = 0; i < c->cpuset_ncpus; i++)
2547                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
2548                                 fprintf(f, " %u", i);
2549                 fputs("\n", f);
2550         }
2551
2552         if (c->timer_slack_nsec != NSEC_INFINITY)
2553                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
2554
2555         fprintf(f,
2556                 "%sStandardInput: %s\n"
2557                 "%sStandardOutput: %s\n"
2558                 "%sStandardError: %s\n",
2559                 prefix, exec_input_to_string(c->std_input),
2560                 prefix, exec_output_to_string(c->std_output),
2561                 prefix, exec_output_to_string(c->std_error));
2562
2563         if (c->tty_path)
2564                 fprintf(f,
2565                         "%sTTYPath: %s\n"
2566                         "%sTTYReset: %s\n"
2567                         "%sTTYVHangup: %s\n"
2568                         "%sTTYVTDisallocate: %s\n",
2569                         prefix, c->tty_path,
2570                         prefix, yes_no(c->tty_reset),
2571                         prefix, yes_no(c->tty_vhangup),
2572                         prefix, yes_no(c->tty_vt_disallocate));
2573
2574         if (c->std_output == EXEC_OUTPUT_SYSLOG ||
2575             c->std_output == EXEC_OUTPUT_KMSG ||
2576             c->std_output == EXEC_OUTPUT_JOURNAL ||
2577             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2578             c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2579             c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
2580             c->std_error == EXEC_OUTPUT_SYSLOG ||
2581             c->std_error == EXEC_OUTPUT_KMSG ||
2582             c->std_error == EXEC_OUTPUT_JOURNAL ||
2583             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2584             c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2585             c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
2586
2587                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
2588
2589                 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
2590                 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
2591
2592                 fprintf(f,
2593                         "%sSyslogFacility: %s\n"
2594                         "%sSyslogLevel: %s\n",
2595                         prefix, strna(fac_str),
2596                         prefix, strna(lvl_str));
2597         }
2598
2599         if (c->secure_bits)
2600                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
2601                         prefix,
2602                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
2603                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
2604                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
2605                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
2606                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
2607                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
2608
2609         if (c->capability_bounding_set != CAP_ALL) {
2610                 unsigned long l;
2611                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
2612
2613                 for (l = 0; l <= cap_last_cap(); l++)
2614                         if (c->capability_bounding_set & (UINT64_C(1) << l))
2615                                 fprintf(f, " %s", strna(capability_to_name(l)));
2616
2617                 fputs("\n", f);
2618         }
2619
2620         if (c->capability_ambient_set != 0) {
2621                 unsigned long l;
2622                 fprintf(f, "%sAmbientCapabilities:", prefix);
2623
2624                 for (l = 0; l <= cap_last_cap(); l++)
2625                         if (c->capability_ambient_set & (UINT64_C(1) << l))
2626                                 fprintf(f, " %s", strna(capability_to_name(l)));
2627
2628                 fputs("\n", f);
2629         }
2630
2631         if (c->user)
2632                 fprintf(f, "%sUser: %s\n", prefix, c->user);
2633         if (c->group)
2634                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
2635
2636         if (strv_length(c->supplementary_groups) > 0) {
2637                 fprintf(f, "%sSupplementaryGroups:", prefix);
2638                 strv_fprintf(f, c->supplementary_groups);
2639                 fputs("\n", f);
2640         }
2641
2642         if (c->pam_name)
2643                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
2644
2645         if (strv_length(c->read_write_dirs) > 0) {
2646                 fprintf(f, "%sReadWriteDirs:", prefix);
2647                 strv_fprintf(f, c->read_write_dirs);
2648                 fputs("\n", f);
2649         }
2650
2651         if (strv_length(c->read_only_dirs) > 0) {
2652                 fprintf(f, "%sReadOnlyDirs:", prefix);
2653                 strv_fprintf(f, c->read_only_dirs);
2654                 fputs("\n", f);
2655         }
2656
2657         if (strv_length(c->inaccessible_dirs) > 0) {
2658                 fprintf(f, "%sInaccessibleDirs:", prefix);
2659                 strv_fprintf(f, c->inaccessible_dirs);
2660                 fputs("\n", f);
2661         }
2662
2663         if (c->utmp_id)
2664                 fprintf(f,
2665                         "%sUtmpIdentifier: %s\n",
2666                         prefix, c->utmp_id);
2667
2668         if (c->selinux_context)
2669                 fprintf(f,
2670                         "%sSELinuxContext: %s%s\n",
2671                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
2672
2673         if (c->personality != PERSONALITY_INVALID)
2674                 fprintf(f,
2675                         "%sPersonality: %s\n",
2676                         prefix, strna(personality_to_string(c->personality)));
2677
2678         if (c->syscall_filter) {
2679 #ifdef HAVE_SECCOMP
2680                 Iterator j;
2681                 void *id;
2682                 bool first = true;
2683 #endif
2684
2685                 fprintf(f,
2686                         "%sSystemCallFilter: ",
2687                         prefix);
2688
2689                 if (!c->syscall_whitelist)
2690                         fputc('~', f);
2691
2692 #ifdef HAVE_SECCOMP
2693                 SET_FOREACH(id, c->syscall_filter, j) {
2694                         _cleanup_free_ char *name = NULL;
2695
2696                         if (first)
2697                                 first = false;
2698                         else
2699                                 fputc(' ', f);
2700
2701                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
2702                         fputs(strna(name), f);
2703                 }
2704 #endif
2705
2706                 fputc('\n', f);
2707         }
2708
2709         if (c->syscall_archs) {
2710 #ifdef HAVE_SECCOMP
2711                 Iterator j;
2712                 void *id;
2713 #endif
2714
2715                 fprintf(f,
2716                         "%sSystemCallArchitectures:",
2717                         prefix);
2718
2719 #ifdef HAVE_SECCOMP
2720                 SET_FOREACH(id, c->syscall_archs, j)
2721                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
2722 #endif
2723                 fputc('\n', f);
2724         }
2725
2726         if (c->syscall_errno > 0)
2727                 fprintf(f,
2728                         "%sSystemCallErrorNumber: %s\n",
2729                         prefix, strna(errno_to_name(c->syscall_errno)));
2730
2731         if (c->apparmor_profile)
2732                 fprintf(f,
2733                         "%sAppArmorProfile: %s%s\n",
2734                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
2735 }
2736
2737 bool exec_context_maintains_privileges(ExecContext *c) {
2738         assert(c);
2739
2740         /* Returns true if the process forked off would run run under
2741          * an unchanged UID or as root. */
2742
2743         if (!c->user)
2744                 return true;
2745
2746         if (streq(c->user, "root") || streq(c->user, "0"))
2747                 return true;
2748
2749         return false;
2750 }
2751
2752 void exec_status_start(ExecStatus *s, pid_t pid) {
2753         assert(s);
2754
2755         zero(*s);
2756         s->pid = pid;
2757         dual_timestamp_get(&s->start_timestamp);
2758 }
2759
2760 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2761         assert(s);
2762
2763         if (s->pid && s->pid != pid)
2764                 zero(*s);
2765
2766         s->pid = pid;
2767         dual_timestamp_get(&s->exit_timestamp);
2768
2769         s->code = code;
2770         s->status = status;
2771
2772         if (context) {
2773                 if (context->utmp_id)
2774                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2775
2776                 exec_context_tty_reset(context, NULL);
2777         }
2778 }
2779
2780 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2781         char buf[FORMAT_TIMESTAMP_MAX];
2782
2783         assert(s);
2784         assert(f);
2785
2786         if (s->pid <= 0)
2787                 return;
2788
2789         prefix = strempty(prefix);
2790
2791         fprintf(f,
2792                 "%sPID: "PID_FMT"\n",
2793                 prefix, s->pid);
2794
2795         if (s->start_timestamp.realtime > 0)
2796                 fprintf(f,
2797                         "%sStart Timestamp: %s\n",
2798                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2799
2800         if (s->exit_timestamp.realtime > 0)
2801                 fprintf(f,
2802                         "%sExit Timestamp: %s\n"
2803                         "%sExit Code: %s\n"
2804                         "%sExit Status: %i\n",
2805                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2806                         prefix, sigchld_code_to_string(s->code),
2807                         prefix, s->status);
2808 }
2809
2810 char *exec_command_line(char **argv) {
2811         size_t k;
2812         char *n, *p, **a;
2813         bool first = true;
2814
2815         assert(argv);
2816
2817         k = 1;
2818         STRV_FOREACH(a, argv)
2819                 k += strlen(*a)+3;
2820
2821         if (!(n = new(char, k)))
2822                 return NULL;
2823
2824         p = n;
2825         STRV_FOREACH(a, argv) {
2826
2827                 if (!first)
2828                         *(p++) = ' ';
2829                 else
2830                         first = false;
2831
2832                 if (strpbrk(*a, WHITESPACE)) {
2833                         *(p++) = '\'';
2834                         p = stpcpy(p, *a);
2835                         *(p++) = '\'';
2836                 } else
2837                         p = stpcpy(p, *a);
2838
2839         }
2840
2841         *p = 0;
2842
2843         /* FIXME: this doesn't really handle arguments that have
2844          * spaces and ticks in them */
2845
2846         return n;
2847 }
2848
2849 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2850         _cleanup_free_ char *cmd = NULL;
2851         const char *prefix2;
2852
2853         assert(c);
2854         assert(f);
2855
2856         prefix = strempty(prefix);
2857         prefix2 = strjoina(prefix, "\t");
2858
2859         cmd = exec_command_line(c->argv);
2860         fprintf(f,
2861                 "%sCommand Line: %s\n",
2862                 prefix, cmd ? cmd : strerror(ENOMEM));
2863
2864         exec_status_dump(&c->exec_status, f, prefix2);
2865 }
2866
2867 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2868         assert(f);
2869
2870         prefix = strempty(prefix);
2871
2872         LIST_FOREACH(command, c, c)
2873                 exec_command_dump(c, f, prefix);
2874 }
2875
2876 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2877         ExecCommand *end;
2878
2879         assert(l);
2880         assert(e);
2881
2882         if (*l) {
2883                 /* It's kind of important, that we keep the order here */
2884                 LIST_FIND_TAIL(command, *l, end);
2885                 LIST_INSERT_AFTER(command, *l, end, e);
2886         } else
2887               *l = e;
2888 }
2889
2890 int exec_command_set(ExecCommand *c, const char *path, ...) {
2891         va_list ap;
2892         char **l, *p;
2893
2894         assert(c);
2895         assert(path);
2896
2897         va_start(ap, path);
2898         l = strv_new_ap(path, ap);
2899         va_end(ap);
2900
2901         if (!l)
2902                 return -ENOMEM;
2903
2904         p = strdup(path);
2905         if (!p) {
2906                 strv_free(l);
2907                 return -ENOMEM;
2908         }
2909
2910         free(c->path);
2911         c->path = p;
2912
2913         strv_free(c->argv);
2914         c->argv = l;
2915
2916         return 0;
2917 }
2918
2919 int exec_command_append(ExecCommand *c, const char *path, ...) {
2920         _cleanup_strv_free_ char **l = NULL;
2921         va_list ap;
2922         int r;
2923
2924         assert(c);
2925         assert(path);
2926
2927         va_start(ap, path);
2928         l = strv_new_ap(path, ap);
2929         va_end(ap);
2930
2931         if (!l)
2932                 return -ENOMEM;
2933
2934         r = strv_extend_strv(&c->argv, l, false);
2935         if (r < 0)
2936                 return r;
2937
2938         return 0;
2939 }
2940
2941
2942 static int exec_runtime_allocate(ExecRuntime **rt) {
2943
2944         if (*rt)
2945                 return 0;
2946
2947         *rt = new0(ExecRuntime, 1);
2948         if (!*rt)
2949                 return -ENOMEM;
2950
2951         (*rt)->n_ref = 1;
2952         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
2953
2954         return 0;
2955 }
2956
2957 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
2958         int r;
2959
2960         assert(rt);
2961         assert(c);
2962         assert(id);
2963
2964         if (*rt)
2965                 return 1;
2966
2967         if (!c->private_network && !c->private_tmp)
2968                 return 0;
2969
2970         r = exec_runtime_allocate(rt);
2971         if (r < 0)
2972                 return r;
2973
2974         if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
2975                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
2976                         return -errno;
2977         }
2978
2979         if (c->private_tmp && !(*rt)->tmp_dir) {
2980                 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
2981                 if (r < 0)
2982                         return r;
2983         }
2984
2985         return 1;
2986 }
2987
2988 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
2989         assert(r);
2990         assert(r->n_ref > 0);
2991
2992         r->n_ref++;
2993         return r;
2994 }
2995
2996 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
2997
2998         if (!r)
2999                 return NULL;
3000
3001         assert(r->n_ref > 0);
3002
3003         r->n_ref--;
3004         if (r->n_ref > 0)
3005                 return NULL;
3006
3007         free(r->tmp_dir);
3008         free(r->var_tmp_dir);
3009         safe_close_pair(r->netns_storage_socket);
3010         free(r);
3011
3012         return NULL;
3013 }
3014
3015 int exec_runtime_serialize(Unit *u, ExecRuntime *rt, FILE *f, FDSet *fds) {
3016         assert(u);
3017         assert(f);
3018         assert(fds);
3019
3020         if (!rt)
3021                 return 0;
3022
3023         if (rt->tmp_dir)
3024                 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
3025
3026         if (rt->var_tmp_dir)
3027                 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
3028
3029         if (rt->netns_storage_socket[0] >= 0) {
3030                 int copy;
3031
3032                 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
3033                 if (copy < 0)
3034                         return copy;
3035
3036                 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
3037         }
3038
3039         if (rt->netns_storage_socket[1] >= 0) {
3040                 int copy;
3041
3042                 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
3043                 if (copy < 0)
3044                         return copy;
3045
3046                 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
3047         }
3048
3049         return 0;
3050 }
3051
3052 int exec_runtime_deserialize_item(Unit *u, ExecRuntime **rt, const char *key, const char *value, FDSet *fds) {
3053         int r;
3054
3055         assert(rt);
3056         assert(key);
3057         assert(value);
3058
3059         if (streq(key, "tmp-dir")) {
3060                 char *copy;
3061
3062                 r = exec_runtime_allocate(rt);
3063                 if (r < 0)
3064                         return log_oom();
3065
3066                 copy = strdup(value);
3067                 if (!copy)
3068                         return log_oom();
3069
3070                 free((*rt)->tmp_dir);
3071                 (*rt)->tmp_dir = copy;
3072
3073         } else if (streq(key, "var-tmp-dir")) {
3074                 char *copy;
3075
3076                 r = exec_runtime_allocate(rt);
3077                 if (r < 0)
3078                         return log_oom();
3079
3080                 copy = strdup(value);
3081                 if (!copy)
3082                         return log_oom();
3083
3084                 free((*rt)->var_tmp_dir);
3085                 (*rt)->var_tmp_dir = copy;
3086
3087         } else if (streq(key, "netns-socket-0")) {
3088                 int fd;
3089
3090                 r = exec_runtime_allocate(rt);
3091                 if (r < 0)
3092                         return log_oom();
3093
3094                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
3095                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
3096                 else {
3097                         safe_close((*rt)->netns_storage_socket[0]);
3098                         (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
3099                 }
3100         } else if (streq(key, "netns-socket-1")) {
3101                 int fd;
3102
3103                 r = exec_runtime_allocate(rt);
3104                 if (r < 0)
3105                         return log_oom();
3106
3107                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
3108                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
3109                 else {
3110                         safe_close((*rt)->netns_storage_socket[1]);
3111                         (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
3112                 }
3113         } else
3114                 return 0;
3115
3116         return 1;
3117 }
3118
3119 static void *remove_tmpdir_thread(void *p) {
3120         _cleanup_free_ char *path = p;
3121
3122         (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
3123         return NULL;
3124 }
3125
3126 void exec_runtime_destroy(ExecRuntime *rt) {
3127         int r;
3128
3129         if (!rt)
3130                 return;
3131
3132         /* If there are multiple users of this, let's leave the stuff around */
3133         if (rt->n_ref > 1)
3134                 return;
3135
3136         if (rt->tmp_dir) {
3137                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
3138
3139                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
3140                 if (r < 0) {
3141                         log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
3142                         free(rt->tmp_dir);
3143                 }
3144
3145                 rt->tmp_dir = NULL;
3146         }
3147
3148         if (rt->var_tmp_dir) {
3149                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
3150
3151                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
3152                 if (r < 0) {
3153                         log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
3154                         free(rt->var_tmp_dir);
3155                 }
3156
3157                 rt->var_tmp_dir = NULL;
3158         }
3159
3160         safe_close_pair(rt->netns_storage_socket);
3161 }
3162
3163 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
3164         [EXEC_INPUT_NULL] = "null",
3165         [EXEC_INPUT_TTY] = "tty",
3166         [EXEC_INPUT_TTY_FORCE] = "tty-force",
3167         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
3168         [EXEC_INPUT_SOCKET] = "socket"
3169 };
3170
3171 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
3172
3173 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
3174         [EXEC_OUTPUT_INHERIT] = "inherit",
3175         [EXEC_OUTPUT_NULL] = "null",
3176         [EXEC_OUTPUT_TTY] = "tty",
3177         [EXEC_OUTPUT_SYSLOG] = "syslog",
3178         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
3179         [EXEC_OUTPUT_KMSG] = "kmsg",
3180         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
3181         [EXEC_OUTPUT_JOURNAL] = "journal",
3182         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
3183         [EXEC_OUTPUT_SOCKET] = "socket"
3184 };
3185
3186 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
3187
3188 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
3189         [EXEC_UTMP_INIT] = "init",
3190         [EXEC_UTMP_LOGIN] = "login",
3191         [EXEC_UTMP_USER] = "user",
3192 };
3193
3194 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);