1 /* SPDX-License-Identifier: LGPL-2.1+ */
4 typedef struct ExecStatus ExecStatus
;
5 typedef struct ExecCommand ExecCommand
;
6 typedef struct ExecContext ExecContext
;
7 typedef struct ExecRuntime ExecRuntime
;
8 typedef struct ExecParameters ExecParameters
;
9 typedef struct Manager Manager
;
14 #include <sys/capability.h>
16 #include "cgroup-util.h"
17 #include "coredump-util.h"
18 #include "cpu-set-util.h"
19 #include "exec-util.h"
22 #include "missing_resource.h"
23 #include "namespace.h"
25 #include "numa-util.h"
26 #include "time-util.h"
28 #define EXEC_STDIN_DATA_MAX (64U*1024U*1024U)
30 typedef enum ExecUtmpMode
{
35 _EXEC_UTMP_MODE_INVALID
= -1
38 typedef enum ExecInput
{
48 _EXEC_INPUT_INVALID
= -1
51 typedef enum ExecOutput
{
56 EXEC_OUTPUT_KMSG_AND_CONSOLE
,
58 EXEC_OUTPUT_JOURNAL_AND_CONSOLE
,
62 EXEC_OUTPUT_FILE_APPEND
,
64 _EXEC_OUTPUT_INVALID
= -1
67 typedef enum ExecPreserveMode
{
70 EXEC_PRESERVE_RESTART
,
71 _EXEC_PRESERVE_MODE_MAX
,
72 _EXEC_PRESERVE_MODE_INVALID
= -1
75 typedef enum ExecKeyringMode
{
79 _EXEC_KEYRING_MODE_MAX
,
80 _EXEC_KEYRING_MODE_INVALID
= -1,
83 /* Contains start and exit information about an executed command. */
85 dual_timestamp start_timestamp
;
86 dual_timestamp exit_timestamp
;
88 int code
; /* as in siginfo_t::si_code */
89 int status
; /* as in sigingo_t::si_status */
92 /* Stores information about commands we execute. Covers both configuration settings as well as runtime data. */
96 ExecStatus exec_status
;
97 ExecCommandFlags flags
;
98 LIST_FIELDS(ExecCommand
, command
); /* useful for chaining commands */
101 /* Encapsulates certain aspects of the runtime environment that is to be shared between multiple otherwise separate
102 * invocations of commands. Specifically, this allows sharing of /tmp and /var/tmp data as well as network namespaces
103 * between invocations of commands. This is a reference counted object, with one reference taken by each currently
104 * active command invocation that wants to share this runtime. */
110 char *id
; /* Unit id of the owner */
115 /* An AF_UNIX socket pair, that contains a datagram containing a file descriptor referring to the network
117 int netns_storage_socket
[2];
120 typedef enum ExecDirectoryType
{
121 EXEC_DIRECTORY_RUNTIME
= 0,
122 EXEC_DIRECTORY_STATE
,
123 EXEC_DIRECTORY_CACHE
,
125 EXEC_DIRECTORY_CONFIGURATION
,
126 _EXEC_DIRECTORY_TYPE_MAX
,
127 _EXEC_DIRECTORY_TYPE_INVALID
= -1,
130 typedef struct ExecDirectory
{
135 typedef enum ExecCleanMask
{
136 /* In case you wonder why the bitmask below doesn't use "directory" in its name: we want to keep this
137 * generic so that .timer timestamp files can nicely be covered by this too, and similar. */
138 EXEC_CLEAN_RUNTIME
= 1U << EXEC_DIRECTORY_RUNTIME
,
139 EXEC_CLEAN_STATE
= 1U << EXEC_DIRECTORY_STATE
,
140 EXEC_CLEAN_CACHE
= 1U << EXEC_DIRECTORY_CACHE
,
141 EXEC_CLEAN_LOGS
= 1U << EXEC_DIRECTORY_LOGS
,
142 EXEC_CLEAN_CONFIGURATION
= 1U << EXEC_DIRECTORY_CONFIGURATION
,
144 EXEC_CLEAN_ALL
= (1U << _EXEC_DIRECTORY_TYPE_MAX
) - 1,
145 _EXEC_CLEAN_MASK_INVALID
= -1,
148 /* Encodes configuration parameters applied to invoked commands. Does not carry runtime data, but only configuration
149 * changes sourced from unit files and suchlike. ExecContext objects are usually embedded into Unit objects, and do not
150 * change after being loaded. */
153 char **environment_files
;
154 char **pass_environment
;
155 char **unset_environment
;
157 struct rlimit
*rlimit
[_RLIMIT_MAX
];
158 char *working_directory
, *root_directory
, *root_image
, *root_verity
, *root_hash_path
, *root_hash_sig_path
;
159 void *root_hash
, *root_hash_sig
;
160 size_t root_hash_size
, root_hash_sig_size
;
161 LIST_HEAD(MountOptions
, root_image_options
);
162 bool working_directory_missing_ok
:1;
163 bool working_directory_home
:1;
165 bool oom_score_adjust_set
:1;
166 bool coredump_filter_set
:1;
169 bool cpu_sched_set
:1;
171 /* This is not exposed to the user but available internally. We need it to make sure that whenever we
172 * spawn /usr/bin/mount it is run in the same process group as us so that the autofs logic detects
173 * that it belongs to us and we don't enter a trigger loop. */
176 bool cpu_sched_reset_on_fork
;
180 int oom_score_adjust
;
183 int cpu_sched_policy
;
184 int cpu_sched_priority
;
185 uint64_t coredump_filter
;
188 NUMAPolicy numa_policy
;
189 bool cpu_affinity_from_numa
;
192 ExecOutput std_output
;
193 ExecOutput std_error
;
195 char *stdio_fdname
[3];
199 size_t stdin_data_size
;
201 nsec_t timer_slack_nsec
;
207 bool tty_vt_disallocate
;
211 ExecKeyringMode keyring_mode
;
213 /* Since resolving these names might involve socket
214 * connections and we don't want to deadlock ourselves these
215 * names are resolved on execution only and in the child
219 char **supplementary_groups
;
224 ExecUtmpMode utmp_mode
;
226 bool no_new_privileges
;
228 bool selinux_context_ignore
;
229 bool apparmor_profile_ignore
;
230 bool smack_process_label_ignore
;
232 char *selinux_context
;
233 char *apparmor_profile
;
234 char *smack_process_label
;
236 char **read_write_paths
, **read_only_paths
, **inaccessible_paths
;
237 unsigned long mount_flags
;
238 BindMount
*bind_mounts
;
239 size_t n_bind_mounts
;
240 TemporaryFileSystem
*temporary_filesystems
;
241 size_t n_temporary_filesystems
;
242 MountImage
*mount_images
;
243 size_t n_mount_images
;
245 uint64_t capability_bounding_set
;
246 uint64_t capability_ambient_set
;
250 bool syslog_level_prefix
;
251 char *syslog_identifier
;
253 struct iovec
* log_extra_fields
;
254 size_t n_log_extra_fields
;
256 usec_t log_ratelimit_interval_usec
;
257 unsigned log_ratelimit_burst
;
263 ProtectProc protect_proc
; /* hidepid= */
264 ProcSubset proc_subset
; /* subset= */
267 bool private_network
;
268 bool private_devices
;
271 bool protect_kernel_tunables
;
272 bool protect_kernel_modules
;
273 bool protect_kernel_logs
;
275 bool protect_control_groups
;
276 ProtectSystem protect_system
;
277 ProtectHome protect_home
;
278 bool protect_hostname
;
284 bool memory_deny_write_execute
;
285 bool restrict_realtime
;
286 bool restrict_suid_sgid
;
288 bool lock_personality
;
289 unsigned long personality
;
291 unsigned long restrict_namespaces
; /* The CLONE_NEWxyz flags permitted to the unit's processes */
293 Hashmap
*syscall_filter
;
296 bool syscall_allow_list
:1;
298 bool address_families_allow_list
:1;
299 Set
*address_families
;
301 char *network_namespace_path
;
303 ExecDirectory directories
[_EXEC_DIRECTORY_TYPE_MAX
];
304 ExecPreserveMode runtime_directory_preserve_mode
;
305 usec_t timeout_clean_usec
;
308 static inline bool exec_context_restrict_namespaces_set(const ExecContext
*c
) {
311 return (c
->restrict_namespaces
& NAMESPACE_FLAGS_ALL
) != NAMESPACE_FLAGS_ALL
;
314 typedef enum ExecFlags
{
315 EXEC_APPLY_SANDBOXING
= 1 << 0,
316 EXEC_APPLY_CHROOT
= 1 << 1,
317 EXEC_APPLY_TTY_STDIN
= 1 << 2,
318 EXEC_PASS_LOG_UNIT
= 1 << 3, /* Whether to pass the unit name to the service's journal stream connection */
319 EXEC_CHOWN_DIRECTORIES
= 1 << 4, /* chown() the runtime/state/cache/log directories to the user we run as, under all conditions */
320 EXEC_NSS_BYPASS_BUS
= 1 << 5, /* Set the SYSTEMD_NSS_BYPASS_BUS environment variable, to disable nss-systemd for dbus */
321 EXEC_CGROUP_DELEGATE
= 1 << 6,
322 EXEC_IS_CONTROL
= 1 << 7,
323 EXEC_CONTROL_CGROUP
= 1 << 8, /* Place the process not in the indicated cgroup but in a subcgroup '/.control', but only EXEC_CGROUP_DELEGATE and EXEC_IS_CONTROL is set, too */
325 /* The following are not used by execute.c, but by consumers internally */
326 EXEC_PASS_FDS
= 1 << 9,
327 EXEC_SETENV_RESULT
= 1 << 10,
328 EXEC_SET_WATCHDOG
= 1 << 11,
331 /* Parameters for a specific invocation of a command. This structure is put together right before a command is
333 struct ExecParameters
{
339 size_t n_storage_fds
;
342 bool selinux_context_net
:1;
344 CGroupMask cgroup_supported
;
345 const char *cgroup_path
;
349 const char *confirm_spawn
;
351 usec_t watchdog_usec
;
359 /* An fd that is closed by the execve(), and thus will result in EOF when the execve() is done */
364 #include "dynamic-user.h"
366 int exec_spawn(Unit
*unit
,
367 ExecCommand
*command
,
368 const ExecContext
*context
,
369 const ExecParameters
*exec_params
,
370 ExecRuntime
*runtime
,
371 DynamicCreds
*dynamic_creds
,
374 void exec_command_done_array(ExecCommand
*c
, size_t n
);
375 ExecCommand
* exec_command_free_list(ExecCommand
*c
);
376 void exec_command_free_array(ExecCommand
**c
, size_t n
);
377 void exec_command_reset_status_array(ExecCommand
*c
, size_t n
);
378 void exec_command_reset_status_list_array(ExecCommand
**c
, size_t n
);
379 void exec_command_dump_list(ExecCommand
*c
, FILE *f
, const char *prefix
);
380 void exec_command_append_list(ExecCommand
**l
, ExecCommand
*e
);
381 int exec_command_set(ExecCommand
*c
, const char *path
, ...) _sentinel_
;
382 int exec_command_append(ExecCommand
*c
, const char *path
, ...) _sentinel_
;
384 void exec_context_init(ExecContext
*c
);
385 void exec_context_done(ExecContext
*c
);
386 void exec_context_dump(const ExecContext
*c
, FILE* f
, const char *prefix
);
388 int exec_context_destroy_runtime_directory(const ExecContext
*c
, const char *runtime_root
);
390 const char* exec_context_fdname(const ExecContext
*c
, int fd_index
);
392 bool exec_context_may_touch_console(const ExecContext
*c
);
393 bool exec_context_maintains_privileges(const ExecContext
*c
);
395 int exec_context_get_effective_ioprio(const ExecContext
*c
);
397 void exec_context_free_log_extra_fields(ExecContext
*c
);
399 void exec_context_revert_tty(ExecContext
*c
);
401 int exec_context_get_clean_directories(ExecContext
*c
, char **prefix
, ExecCleanMask mask
, char ***ret
);
402 int exec_context_get_clean_mask(ExecContext
*c
, ExecCleanMask
*ret
);
404 void exec_status_start(ExecStatus
*s
, pid_t pid
);
405 void exec_status_exit(ExecStatus
*s
, const ExecContext
*context
, pid_t pid
, int code
, int status
);
406 void exec_status_dump(const ExecStatus
*s
, FILE *f
, const char *prefix
);
407 void exec_status_reset(ExecStatus
*s
);
409 int exec_runtime_acquire(Manager
*m
, const ExecContext
*c
, const char *name
, bool create
, ExecRuntime
**ret
);
410 ExecRuntime
*exec_runtime_unref(ExecRuntime
*r
, bool destroy
);
412 int exec_runtime_serialize(const Manager
*m
, FILE *f
, FDSet
*fds
);
413 int exec_runtime_deserialize_compat(Unit
*u
, const char *key
, const char *value
, FDSet
*fds
);
414 int exec_runtime_deserialize_one(Manager
*m
, const char *value
, FDSet
*fds
);
415 void exec_runtime_vacuum(Manager
*m
);
417 void exec_params_clear(ExecParameters
*p
);
419 bool exec_context_get_cpu_affinity_from_numa(const ExecContext
*c
);
421 const char* exec_output_to_string(ExecOutput i
) _const_
;
422 ExecOutput
exec_output_from_string(const char *s
) _pure_
;
424 const char* exec_input_to_string(ExecInput i
) _const_
;
425 ExecInput
exec_input_from_string(const char *s
) _pure_
;
427 const char* exec_utmp_mode_to_string(ExecUtmpMode i
) _const_
;
428 ExecUtmpMode
exec_utmp_mode_from_string(const char *s
) _pure_
;
430 const char* exec_preserve_mode_to_string(ExecPreserveMode i
) _const_
;
431 ExecPreserveMode
exec_preserve_mode_from_string(const char *s
) _pure_
;
433 const char* exec_keyring_mode_to_string(ExecKeyringMode i
) _const_
;
434 ExecKeyringMode
exec_keyring_mode_from_string(const char *s
) _pure_
;
436 const char* exec_directory_type_to_string(ExecDirectoryType i
) _const_
;
437 ExecDirectoryType
exec_directory_type_from_string(const char *s
) _pure_
;
439 const char* exec_resource_type_to_string(ExecDirectoryType i
) _const_
;
440 ExecDirectoryType
exec_resource_type_from_string(const char *s
) _pure_
;