src/core/execute.h

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 #pragma once
   4
   5 /***
   6   This file is part of systemd.
   7
   8   Copyright 2010 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 ***/
  23
  24 typedef struct ExecStatus ExecStatus;
  25 typedef struct ExecCommand ExecCommand;
  26 typedef struct ExecContext ExecContext;
  27 typedef struct ExecRuntime ExecRuntime;
  28 typedef struct ExecParameters ExecParameters;
  29
  30 #include <sched.h>
  31 #include <stdbool.h>
  32 #include <stdio.h>
  33 #include <sys/capability.h>
  34
  35 #include "bus-endpoint.h"
  36 #include "fdset.h"
  37 #include "list.h"
  38 #include "missing.h"
  39 #include "namespace.h"
  40
  41 typedef enum ExecUtmpMode {
  42         EXEC_UTMP_INIT,
  43         EXEC_UTMP_LOGIN,
  44         EXEC_UTMP_USER,
  45         _EXEC_UTMP_MODE_MAX,
  46         _EXEC_UTMP_MODE_INVALID = -1
  47 } ExecUtmpMode;
  48
  49 typedef enum ExecInput {
  50         EXEC_INPUT_NULL,
  51         EXEC_INPUT_TTY,
  52         EXEC_INPUT_TTY_FORCE,
  53         EXEC_INPUT_TTY_FAIL,
  54         EXEC_INPUT_SOCKET,
  55         _EXEC_INPUT_MAX,
  56         _EXEC_INPUT_INVALID = -1
  57 } ExecInput;
  58
  59 typedef enum ExecOutput {
  60         EXEC_OUTPUT_INHERIT,
  61         EXEC_OUTPUT_NULL,
  62         EXEC_OUTPUT_TTY,
  63         EXEC_OUTPUT_SYSLOG,
  64         EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
  65         EXEC_OUTPUT_KMSG,
  66         EXEC_OUTPUT_KMSG_AND_CONSOLE,
  67         EXEC_OUTPUT_JOURNAL,
  68         EXEC_OUTPUT_JOURNAL_AND_CONSOLE,
  69         EXEC_OUTPUT_SOCKET,
  70         _EXEC_OUTPUT_MAX,
  71         _EXEC_OUTPUT_INVALID = -1
  72 } ExecOutput;
  73
  74 struct ExecStatus {
  75         dual_timestamp start_timestamp;
  76         dual_timestamp exit_timestamp;
  77         pid_t pid;
  78         int code;     /* as in siginfo_t::si_code */
  79         int status;   /* as in sigingo_t::si_status */
  80 };
  81
  82 struct ExecCommand {
  83         char *path;
  84         char **argv;
  85         ExecStatus exec_status;
  86         LIST_FIELDS(ExecCommand, command); /* useful for chaining commands */
  87         bool ignore;
  88 };
  89
  90 struct ExecRuntime {
  91         int n_ref;
  92
  93         char *tmp_dir;
  94         char *var_tmp_dir;
  95
  96         int netns_storage_socket[2];
  97 };
  98
  99 struct ExecContext {
 100         char **environment;
 101         char **environment_files;
 102         char **pass_environment;
 103
 104         struct rlimit *rlimit[_RLIMIT_MAX];
 105         char *working_directory, *root_directory;
 106         bool working_directory_missing_ok;
 107         bool working_directory_home;
 108
 109         mode_t umask;
 110         int oom_score_adjust;
 111         int nice;
 112         int ioprio;
 113         int cpu_sched_policy;
 114         int cpu_sched_priority;
 115
 116         cpu_set_t *cpuset;
 117         unsigned cpuset_ncpus;
 118
 119         ExecInput std_input;
 120         ExecOutput std_output;
 121         ExecOutput std_error;
 122
 123         nsec_t timer_slack_nsec;
 124
 125         char *tty_path;
 126
 127         bool tty_reset;
 128         bool tty_vhangup;
 129         bool tty_vt_disallocate;
 130
 131         bool ignore_sigpipe;
 132
 133         /* Since resolving these names might might involve socket
 134          * connections and we don't want to deadlock ourselves these
 135          * names are resolved on execution only and in the child
 136          * process. */
 137         char *user;
 138         char *group;
 139         char **supplementary_groups;
 140
 141         char *pam_name;
 142
 143         char *utmp_id;
 144         ExecUtmpMode utmp_mode;
 145
 146         bool selinux_context_ignore;
 147         char *selinux_context;
 148
 149         bool apparmor_profile_ignore;
 150         char *apparmor_profile;
 151
 152         bool smack_process_label_ignore;
 153         char *smack_process_label;
 154
 155         char **read_write_dirs, **read_only_dirs, **inaccessible_dirs;
 156         unsigned long mount_flags;
 157
 158         uint64_t capability_bounding_set;
 159
 160         uint64_t capability_ambient_set;
 161
 162         cap_t capabilities;
 163         int secure_bits;
 164
 165         int syslog_priority;
 166         char *syslog_identifier;
 167         bool syslog_level_prefix;
 168
 169         bool cpu_sched_reset_on_fork;
 170         bool non_blocking;
 171         bool private_tmp;
 172         bool private_network;
 173         bool private_devices;
 174         ProtectSystem protect_system;
 175         ProtectHome protect_home;
 176
 177         bool no_new_privileges;
 178
 179         /* This is not exposed to the user but available
 180          * internally. We need it to make sure that whenever we spawn
 181          * /usr/bin/mount it is run in the same process group as us so
 182          * that the autofs logic detects that it belongs to us and we
 183          * don't enter a trigger loop. */
 184         bool same_pgrp;
 185
 186         unsigned long personality;
 187
 188         Set *syscall_filter;
 189         Set *syscall_archs;
 190         int syscall_errno;
 191         bool syscall_whitelist:1;
 192
 193         Set *address_families;
 194         bool address_families_whitelist:1;
 195
 196         char **runtime_directory;
 197         mode_t runtime_directory_mode;
 198
 199         bool oom_score_adjust_set:1;
 200         bool nice_set:1;
 201         bool ioprio_set:1;
 202         bool cpu_sched_set:1;
 203         bool no_new_privileges_set:1;
 204
 205         /* custom dbus enpoint */
 206         BusEndpoint *bus_endpoint;
 207 };
 208
 209 #include "cgroup-util.h"
 210 #include "cgroup.h"
 211
 212 struct ExecParameters {
 213         char **argv;
 214         char **environment;
 215
 216         int *fds;
 217         char **fd_names;
 218         unsigned n_fds;
 219
 220         bool apply_permissions:1;
 221         bool apply_chroot:1;
 222         bool apply_tty_stdin:1;
 223
 224         bool confirm_spawn:1;
 225         bool selinux_context_net:1;
 226
 227         bool cgroup_delegate:1;
 228         CGroupMask cgroup_supported;
 229         const char *cgroup_path;
 230
 231         const char *runtime_prefix;
 232
 233         usec_t watchdog_usec;
 234
 235         int *idle_pipe;
 236
 237         char *bus_endpoint_path;
 238         int bus_endpoint_fd;
 239
 240         int stdin_fd;
 241         int stdout_fd;
 242         int stderr_fd;
 243 };
 244
 245 int exec_spawn(Unit *unit,
 246                ExecCommand *command,
 247                const ExecContext *context,
 248                const ExecParameters *exec_params,
 249                ExecRuntime *runtime,
 250                pid_t *ret);
 251
 252 void exec_command_done(ExecCommand *c);
 253 void exec_command_done_array(ExecCommand *c, unsigned n);
 254
 255 ExecCommand* exec_command_free_list(ExecCommand *c);
 256 void exec_command_free_array(ExecCommand **c, unsigned n);
 257
 258 char *exec_command_line(char **argv);
 259
 260 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix);
 261 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix);
 262 void exec_command_append_list(ExecCommand **l, ExecCommand *e);
 263 int exec_command_set(ExecCommand *c, const char *path, ...);
 264 int exec_command_append(ExecCommand *c, const char *path, ...);
 265
 266 void exec_context_init(ExecContext *c);
 267 void exec_context_done(ExecContext *c);
 268 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix);
 269
 270 int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_root);
 271
 272 int exec_context_load_environment(Unit *unit, const ExecContext *c, char ***l);
 273
 274 bool exec_context_may_touch_console(ExecContext *c);
 275 bool exec_context_maintains_privileges(ExecContext *c);
 276
 277 void exec_status_start(ExecStatus *s, pid_t pid);
 278 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status);
 279 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix);
 280
 281 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id);
 282 ExecRuntime *exec_runtime_ref(ExecRuntime *r);
 283 ExecRuntime *exec_runtime_unref(ExecRuntime *r);
 284
 285 int exec_runtime_serialize(Unit *unit, ExecRuntime *rt, FILE *f, FDSet *fds);
 286 int exec_runtime_deserialize_item(Unit *unit, ExecRuntime **rt, const char *key, const char *value, FDSet *fds);
 287
 288 void exec_runtime_destroy(ExecRuntime *rt);
 289
 290 const char* exec_output_to_string(ExecOutput i) _const_;
 291 ExecOutput exec_output_from_string(const char *s) _pure_;
 292
 293 const char* exec_input_to_string(ExecInput i) _const_;
 294 ExecInput exec_input_from_string(const char *s) _pure_;
 295
 296 const char* exec_utmp_mode_to_string(ExecUtmpMode i) _const_;
 297 ExecUtmpMode exec_utmp_mode_from_string(const char *s) _pure_;