]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/firstboot/firstboot.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
env-util: make write_env_file() optionally take headers
[thirdparty/systemd.git] / src / firstboot / firstboot.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include <fcntl.h>
4 #include <getopt.h>
5 #include <linux/loop.h>
6 #include <unistd.h>
7
8 #include "sd-id128.h"
9
10 #include "alloc-util.h"
11 #include "ask-password-api.h"
12 #include "build.h"
13 #include "bus-error.h"
14 #include "bus-locator.h"
15 #include "bus-unit-util.h"
16 #include "bus-util.h"
17 #include "bus-wait-for-jobs.h"
18 #include "chase.h"
19 #include "copy.h"
20 #include "creds-util.h"
21 #include "dissect-image.h"
22 #include "env-file.h"
23 #include "errno-util.h"
24 #include "fd-util.h"
25 #include "fileio.h"
26 #include "fs-util.h"
27 #include "glyph-util.h"
28 #include "hostname-util.h"
29 #include "kbd-util.h"
30 #include "libcrypt-util.h"
31 #include "locale-util.h"
32 #include "lock-util.h"
33 #include "main-func.h"
34 #include "memory-util.h"
35 #include "mkdir.h"
36 #include "mount-util.h"
37 #include "os-util.h"
38 #include "parse-argument.h"
39 #include "parse-util.h"
40 #include "password-quality-util.h"
41 #include "path-util.h"
42 #include "pretty-print.h"
43 #include "proc-cmdline.h"
44 #include "random-util.h"
45 #include "smack-util.h"
46 #include "string-util.h"
47 #include "strv.h"
48 #include "terminal-util.h"
49 #include "time-util.h"
50 #include "tmpfile-util-label.h"
51 #include "tmpfile-util.h"
52 #include "umask-util.h"
53 #include "user-util.h"
54
55 static char *arg_root = NULL;
56 static char *arg_image = NULL;
57 static char *arg_locale = NULL; /* $LANG */
58 static char *arg_locale_messages = NULL; /* $LC_MESSAGES */
59 static char *arg_keymap = NULL;
60 static char *arg_timezone = NULL;
61 static char *arg_hostname = NULL;
62 static sd_id128_t arg_machine_id = {};
63 static char *arg_root_password = NULL;
64 static char *arg_root_shell = NULL;
65 static char *arg_kernel_cmdline = NULL;
66 static bool arg_prompt_locale = false;
67 static bool arg_prompt_keymap = false;
68 static bool arg_prompt_timezone = false;
69 static bool arg_prompt_hostname = false;
70 static bool arg_prompt_root_password = false;
71 static bool arg_prompt_root_shell = false;
72 static bool arg_copy_locale = false;
73 static bool arg_copy_keymap = false;
74 static bool arg_copy_timezone = false;
75 static bool arg_copy_root_password = false;
76 static bool arg_copy_root_shell = false;
77 static bool arg_force = false;
78 static bool arg_delete_root_password = false;
79 static bool arg_root_password_is_hashed = false;
80 static bool arg_welcome = true;
81 static bool arg_reset = false;
82 static ImagePolicy *arg_image_policy = NULL;
83
84 STATIC_DESTRUCTOR_REGISTER(arg_root, freep);
85 STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
86 STATIC_DESTRUCTOR_REGISTER(arg_locale, freep);
87 STATIC_DESTRUCTOR_REGISTER(arg_locale_messages, freep);
88 STATIC_DESTRUCTOR_REGISTER(arg_keymap, freep);
89 STATIC_DESTRUCTOR_REGISTER(arg_timezone, freep);
90 STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
91 STATIC_DESTRUCTOR_REGISTER(arg_root_password, erase_and_freep);
92 STATIC_DESTRUCTOR_REGISTER(arg_image_policy, image_policy_freep);
93
94 static bool press_any_key(void) {
95 char k = 0;
96 bool need_nl = true;
97
98 printf("-- Press any key to proceed --");
99 fflush(stdout);
100
101 (void) read_one_char(stdin, &k, USEC_INFINITY, &need_nl);
102
103 if (need_nl)
104 putchar('\n');
105
106 return k != 'q';
107 }
108
109 static void print_welcome(int rfd) {
110 _cleanup_free_ char *pretty_name = NULL, *os_name = NULL, *ansi_color = NULL;
111 static bool done = false;
112 const char *pn, *ac;
113 int r;
114
115 assert(rfd >= 0);
116
117 if (!arg_welcome)
118 return;
119
120 if (done)
121 return;
122
123 r = parse_os_release_at(rfd,
124 "PRETTY_NAME", &pretty_name,
125 "NAME", &os_name,
126 "ANSI_COLOR", &ansi_color);
127 if (r < 0)
128 log_full_errno(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, r,
129 "Failed to read os-release file, ignoring: %m");
130
131 pn = os_release_pretty_name(pretty_name, os_name);
132 ac = isempty(ansi_color) ? "0" : ansi_color;
133
134 if (colors_enabled())
135 printf("\nWelcome to your new installation of \x1B[%sm%s\x1B[0m!\n", ac, pn);
136 else
137 printf("\nWelcome to your new installation of %s!\n", pn);
138
139 printf("\nPlease configure your system!\n\n");
140
141 press_any_key();
142
143 done = true;
144 }
145
146 static int show_menu(char **x, unsigned n_columns, unsigned width, unsigned percentage) {
147 unsigned break_lines, break_modulo;
148 size_t n, per_column, i, j;
149
150 assert(n_columns > 0);
151
152 n = strv_length(x);
153 per_column = DIV_ROUND_UP(n, n_columns);
154
155 break_lines = lines();
156 if (break_lines > 2)
157 break_lines--;
158
159 /* The first page gets two extra lines, since we want to show
160 * a title */
161 break_modulo = break_lines;
162 if (break_modulo > 3)
163 break_modulo -= 3;
164
165 for (i = 0; i < per_column; i++) {
166
167 for (j = 0; j < n_columns; j ++) {
168 _cleanup_free_ char *e = NULL;
169
170 if (j * per_column + i >= n)
171 break;
172
173 e = ellipsize(x[j * per_column + i], width, percentage);
174 if (!e)
175 return log_oom();
176
177 printf("%4zu) %-*s", j * per_column + i + 1, (int) width, e);
178 }
179
180 putchar('\n');
181
182 /* on the first screen we reserve 2 extra lines for the title */
183 if (i % break_lines == break_modulo) {
184 if (!press_any_key())
185 return 0;
186 }
187 }
188
189 return 0;
190 }
191
192 static int prompt_loop(const char *text, char **l, unsigned percentage, bool (*is_valid)(const char *name), char **ret) {
193 int r;
194
195 assert(text);
196 assert(is_valid);
197 assert(ret);
198
199 for (;;) {
200 _cleanup_free_ char *p = NULL;
201 unsigned u;
202
203 r = ask_string(&p, "%s %s (empty to skip, \"list\" to list options): ",
204 special_glyph(SPECIAL_GLYPH_TRIANGULAR_BULLET), text);
205 if (r < 0)
206 return log_error_errno(r, "Failed to query user: %m");
207
208 if (isempty(p)) {
209 log_warning("No data entered, skipping.");
210 return 0;
211 }
212
213 if (streq(p, "list")) {
214 r = show_menu(l, 3, 22, percentage);
215 if (r < 0)
216 return r;
217
218 putchar('\n');
219 continue;
220 };
221
222 r = safe_atou(p, &u);
223 if (r >= 0) {
224 if (u <= 0 || u > strv_length(l)) {
225 log_error("Specified entry number out of range.");
226 continue;
227 }
228
229 log_info("Selected '%s'.", l[u-1]);
230 return free_and_strdup_warn(ret, l[u-1]);
231 }
232
233 if (!is_valid(p)) {
234 log_error("Entered data invalid.");
235 continue;
236 }
237
238 return free_and_replace(*ret, p);
239 }
240 }
241
242 static int should_configure(int dir_fd, const char *filename) {
243 _cleanup_fclose_ FILE *passwd = NULL, *shadow = NULL;
244 int r;
245
246 assert(dir_fd >= 0);
247 assert(filename);
248
249 if (streq(filename, "passwd") && !arg_force)
250 /* We may need to do additional checks, so open the file. */
251 r = xfopenat(dir_fd, filename, "re", O_NOFOLLOW, &passwd);
252 else
253 r = RET_NERRNO(faccessat(dir_fd, filename, F_OK, AT_SYMLINK_NOFOLLOW));
254
255 if (r == -ENOENT)
256 return true; /* missing */
257 if (r < 0)
258 return log_error_errno(r, "Failed to access %s: %m", filename);
259 if (arg_force)
260 return true; /* exists, but if --force was given we should still configure the file. */
261
262 if (!passwd)
263 return false;
264
265 /* In case of /etc/passwd, do an additional check for the root password field.
266 * We first check that passwd redirects to shadow, and then we check shadow.
267 */
268 struct passwd *i;
269 while ((r = fgetpwent_sane(passwd, &i)) > 0) {
270 if (!streq(i->pw_name, "root"))
271 continue;
272
273 if (streq_ptr(i->pw_passwd, PASSWORD_SEE_SHADOW))
274 break;
275 log_debug("passwd: root account with non-shadow password found, treating root as configured");
276 return false;
277 }
278 if (r < 0)
279 return log_error_errno(r, "Failed to read %s: %m", filename);
280 if (r == 0) {
281 log_debug("No root account found in %s, assuming root is not configured.", filename);
282 return true;
283 }
284
285 r = xfopenat(dir_fd, "shadow", "re", O_NOFOLLOW, &shadow);
286 if (r == -ENOENT) {
287 log_debug("No shadow file found, assuming root is not configured.");
288 return true; /* missing */
289 }
290 if (r < 0)
291 return log_error_errno(r, "Failed to access shadow: %m");
292
293 struct spwd *j;
294 while ((r = fgetspent_sane(shadow, &j)) > 0) {
295 if (!streq(j->sp_namp, "root"))
296 continue;
297
298 bool unprovisioned = streq_ptr(j->sp_pwdp, PASSWORD_UNPROVISIONED);
299 log_debug("Root account found, %s.",
300 unprovisioned ? "with unprovisioned password, treating root as not configured" :
301 "treating root as configured");
302 return unprovisioned;
303 }
304 if (r < 0)
305 return log_error_errno(r, "Failed to read shadow: %m");
306 assert(r == 0);
307 log_debug("No root account found in shadow, assuming root is not configured.");
308 return true;
309 }
310
311 static bool locale_is_installed_bool(const char *name) {
312 return locale_is_installed(name) > 0;
313 }
314
315 static bool locale_is_ok(int rfd, const char *name) {
316 assert(rfd >= 0);
317
318 return dir_fd_is_root(rfd) ? locale_is_installed_bool(name) : locale_is_valid(name);
319 }
320
321 static int prompt_locale(int rfd) {
322 _cleanup_strv_free_ char **locales = NULL;
323 bool acquired_from_creds = false;
324 int r;
325
326 assert(rfd >= 0);
327
328 if (arg_locale || arg_locale_messages)
329 return 0;
330
331 r = read_credential("firstboot.locale", (void**) &arg_locale, NULL);
332 if (r < 0)
333 log_debug_errno(r, "Failed to read credential firstboot.locale, ignoring: %m");
334 else
335 acquired_from_creds = true;
336
337 r = read_credential("firstboot.locale-messages", (void**) &arg_locale_messages, NULL);
338 if (r < 0)
339 log_debug_errno(r, "Failed to read credential firstboot.locale-messages, ignoring: %m");
340 else
341 acquired_from_creds = true;
342
343 if (acquired_from_creds) {
344 log_debug("Acquired locale from credentials.");
345 return 0;
346 }
347
348 if (!arg_prompt_locale) {
349 log_debug("Prompting for locale was not requested.");
350 return 0;
351 }
352
353 r = get_locales(&locales);
354 if (r < 0)
355 return log_error_errno(r, "Cannot query locales list: %m");
356
357 if (strv_isempty(locales))
358 log_debug("No locales found, skipping locale selection.");
359 else if (strv_length(locales) == 1) {
360
361 if (streq(locales[0], SYSTEMD_DEFAULT_LOCALE))
362 log_debug("Only installed locale is default locale anyway, not setting locale explicitly.");
363 else {
364 log_debug("Only a single locale available (%s), selecting it as default.", locales[0]);
365
366 arg_locale = strdup(locales[0]);
367 if (!arg_locale)
368 return log_oom();
369
370 /* Not setting arg_locale_message here, since it defaults to LANG anyway */
371 }
372 } else {
373 bool (*is_valid)(const char *name) = dir_fd_is_root(rfd) ? locale_is_installed_bool
374 : locale_is_valid;
375
376 print_welcome(rfd);
377
378 r = prompt_loop("Please enter system locale name or number",
379 locales, 60, is_valid, &arg_locale);
380 if (r < 0)
381 return r;
382
383 if (isempty(arg_locale))
384 return 0;
385
386 r = prompt_loop("Please enter system message locale name or number",
387 locales, 60, is_valid, &arg_locale_messages);
388 if (r < 0)
389 return r;
390
391 /* Suppress the messages setting if it's the same as the main locale anyway */
392 if (streq_ptr(arg_locale, arg_locale_messages))
393 arg_locale_messages = mfree(arg_locale_messages);
394 }
395
396 return 0;
397 }
398
399 static int process_locale(int rfd) {
400 _cleanup_close_ int pfd = -EBADF;
401 _cleanup_free_ char *f = NULL;
402 char* locales[3];
403 unsigned i = 0;
404 int r;
405
406 assert(rfd >= 0);
407
408 pfd = chase_and_open_parent_at(rfd, "/etc/locale.conf",
409 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
410 &f);
411 if (pfd < 0)
412 return log_error_errno(pfd, "Failed to chase /etc/locale.conf: %m");
413
414 r = should_configure(pfd, f);
415 if (r == 0)
416 log_debug("Found /etc/locale.conf, assuming locale information has been configured.");
417 if (r <= 0)
418 return r;
419
420 r = dir_fd_is_root(rfd);
421 if (r < 0)
422 return log_error_errno(r, "Failed to check if directory file descriptor is root: %m");
423
424 if (arg_copy_locale && r == 0) {
425 r = copy_file_atomic_at(AT_FDCWD, "/etc/locale.conf", pfd, f, 0644, COPY_REFLINK);
426 if (r != -ENOENT) {
427 if (r < 0)
428 return log_error_errno(r, "Failed to copy host's /etc/locale.conf: %m");
429
430 log_info("Copied host's /etc/locale.conf.");
431 return 0;
432 }
433 }
434
435 r = prompt_locale(rfd);
436 if (r < 0)
437 return r;
438
439 if (!isempty(arg_locale))
440 locales[i++] = strjoina("LANG=", arg_locale);
441 if (!isempty(arg_locale_messages) && !streq_ptr(arg_locale_messages, arg_locale))
442 locales[i++] = strjoina("LC_MESSAGES=", arg_locale_messages);
443
444 if (i == 0)
445 return 0;
446
447 locales[i] = NULL;
448
449 r = write_env_file(pfd, f, NULL, locales);
450 if (r < 0)
451 return log_error_errno(r, "Failed to write /etc/locale.conf: %m");
452
453 log_info("/etc/locale.conf written.");
454 return 1;
455 }
456
457 static int prompt_keymap(int rfd) {
458 _cleanup_strv_free_ char **kmaps = NULL;
459 int r;
460
461 assert(rfd >= 0);
462
463 if (arg_keymap)
464 return 0;
465
466 r = read_credential("firstboot.keymap", (void**) &arg_keymap, NULL);
467 if (r < 0)
468 log_debug_errno(r, "Failed to read credential firstboot.keymap, ignoring: %m");
469 else {
470 log_debug("Acquired keymap from credential.");
471 return 0;
472 }
473
474 if (!arg_prompt_keymap) {
475 log_debug("Prompting for keymap was not requested.");
476 return 0;
477 }
478
479 r = get_keymaps(&kmaps);
480 if (r == -ENOENT) /* no keymaps installed */
481 return log_debug_errno(r, "No keymaps are installed.");
482 if (r < 0)
483 return log_error_errno(r, "Failed to read keymaps: %m");
484
485 print_welcome(rfd);
486
487 return prompt_loop("Please enter system keymap name or number",
488 kmaps, 60, keymap_is_valid, &arg_keymap);
489 }
490
491 static int process_keymap(int rfd) {
492 _cleanup_close_ int pfd = -EBADF;
493 _cleanup_free_ char *f = NULL;
494 char **keymap;
495 int r;
496
497 assert(rfd >= 0);
498
499 pfd = chase_and_open_parent_at(rfd, "/etc/vconsole.conf",
500 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
501 &f);
502 if (pfd < 0)
503 return log_error_errno(pfd, "Failed to chase /etc/vconsole.conf: %m");
504
505 r = should_configure(pfd, f);
506 if (r == 0)
507 log_debug("Found /etc/vconsole.conf, assuming console has been configured.");
508 if (r <= 0)
509 return r;
510
511 r = dir_fd_is_root(rfd);
512 if (r < 0)
513 return log_error_errno(r, "Failed to check if directory file descriptor is root: %m");
514
515 if (arg_copy_keymap && r == 0) {
516 r = copy_file_atomic_at(AT_FDCWD, "/etc/vconsole.conf", pfd, f, 0644, COPY_REFLINK);
517 if (r != -ENOENT) {
518 if (r < 0)
519 return log_error_errno(r, "Failed to copy host's /etc/vconsole.conf: %m");
520
521 log_info("Copied host's /etc/vconsole.conf.");
522 return 0;
523 }
524 }
525
526 r = prompt_keymap(rfd);
527 if (r == -ENOENT)
528 return 0; /* don't fail if no keymaps are installed */
529 if (r < 0)
530 return r;
531
532 if (isempty(arg_keymap))
533 return 0;
534
535 keymap = STRV_MAKE(strjoina("KEYMAP=", arg_keymap));
536
537 r = write_env_file(pfd, f, NULL, keymap);
538 if (r < 0)
539 return log_error_errno(r, "Failed to write /etc/vconsole.conf: %m");
540
541 log_info("/etc/vconsole.conf written.");
542 return 1;
543 }
544
545 static bool timezone_is_valid_log_error(const char *name) {
546 return timezone_is_valid(name, LOG_ERR);
547 }
548
549 static int prompt_timezone(int rfd) {
550 _cleanup_strv_free_ char **zones = NULL;
551 int r;
552
553 assert(rfd >= 0);
554
555 if (arg_timezone)
556 return 0;
557
558 r = read_credential("firstboot.timezone", (void**) &arg_timezone, NULL);
559 if (r < 0)
560 log_debug_errno(r, "Failed to read credential firstboot.timezone, ignoring: %m");
561 else {
562 log_debug("Acquired timezone from credential.");
563 return 0;
564 }
565
566 if (!arg_prompt_timezone) {
567 log_debug("Prompting for timezone was not requested.");
568 return 0;
569 }
570
571 r = get_timezones(&zones);
572 if (r < 0)
573 return log_error_errno(r, "Cannot query timezone list: %m");
574
575 print_welcome(rfd);
576
577 r = prompt_loop("Please enter timezone name or number",
578 zones, 30, timezone_is_valid_log_error, &arg_timezone);
579 if (r < 0)
580 return r;
581
582 return 0;
583 }
584
585 static int process_timezone(int rfd) {
586 _cleanup_close_ int pfd = -EBADF;
587 _cleanup_free_ char *f = NULL;
588 const char *e;
589 int r;
590
591 assert(rfd >= 0);
592
593 pfd = chase_and_open_parent_at(rfd, "/etc/localtime",
594 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
595 &f);
596 if (pfd < 0)
597 return log_error_errno(pfd, "Failed to chase /etc/localtime: %m");
598
599 r = should_configure(pfd, f);
600 if (r == 0)
601 log_debug("Found /etc/localtime, assuming timezone has been configured.");
602 if (r <= 0)
603 return r;
604
605 r = dir_fd_is_root(rfd);
606 if (r < 0)
607 return log_error_errno(r, "Failed to check if directory file descriptor is root: %m");
608
609 if (arg_copy_timezone && r == 0) {
610 _cleanup_free_ char *s = NULL;
611
612 r = readlink_malloc("/etc/localtime", &s);
613 if (r != -ENOENT) {
614 if (r < 0)
615 return log_error_errno(r, "Failed to read host's /etc/localtime: %m");
616
617 r = symlinkat_atomic_full(s, pfd, f, /* make_relative= */ false);
618 if (r < 0)
619 return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
620
621 log_info("Copied host's /etc/localtime.");
622 return 0;
623 }
624 }
625
626 r = prompt_timezone(rfd);
627 if (r < 0)
628 return r;
629
630 if (isempty(arg_timezone))
631 return 0;
632
633 e = strjoina("../usr/share/zoneinfo/", arg_timezone);
634
635 r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
636 if (r < 0)
637 return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
638
639 log_info("/etc/localtime written");
640 return 0;
641 }
642
643 static int prompt_hostname(int rfd) {
644 int r;
645
646 assert(rfd >= 0);
647
648 if (arg_hostname)
649 return 0;
650
651 if (!arg_prompt_hostname) {
652 log_debug("Prompting for hostname was not requested.");
653 return 0;
654 }
655
656 print_welcome(rfd);
657 putchar('\n');
658
659 for (;;) {
660 _cleanup_free_ char *h = NULL;
661
662 r = ask_string(&h, "%s Please enter hostname for new system (empty to skip): ", special_glyph(SPECIAL_GLYPH_TRIANGULAR_BULLET));
663 if (r < 0)
664 return log_error_errno(r, "Failed to query hostname: %m");
665
666 if (isempty(h)) {
667 log_warning("No hostname entered, skipping.");
668 break;
669 }
670
671 if (!hostname_is_valid(h, VALID_HOSTNAME_TRAILING_DOT)) {
672 log_error("Specified hostname invalid.");
673 continue;
674 }
675
676 /* Get rid of the trailing dot that we allow, but don't want to see */
677 arg_hostname = hostname_cleanup(h);
678 h = NULL;
679 break;
680 }
681
682 return 0;
683 }
684
685 static int process_hostname(int rfd) {
686 _cleanup_close_ int pfd = -EBADF;
687 _cleanup_free_ char *f = NULL;
688 int r;
689
690 assert(rfd >= 0);
691
692 pfd = chase_and_open_parent_at(rfd, "/etc/hostname",
693 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN,
694 &f);
695 if (pfd < 0)
696 return log_error_errno(pfd, "Failed to chase /etc/hostname: %m");
697
698 r = should_configure(pfd, f);
699 if (r == 0)
700 log_debug("Found /etc/hostname, assuming hostname has been configured.");
701 if (r <= 0)
702 return r;
703
704 r = prompt_hostname(rfd);
705 if (r < 0)
706 return r;
707
708 if (isempty(arg_hostname))
709 return 0;
710
711 r = write_string_file_at(pfd, f, arg_hostname,
712 WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_SYNC|WRITE_STRING_FILE_ATOMIC);
713 if (r < 0)
714 return log_error_errno(r, "Failed to write /etc/hostname: %m");
715
716 log_info("/etc/hostname written.");
717 return 0;
718 }
719
720 static int process_machine_id(int rfd) {
721 _cleanup_close_ int pfd = -EBADF;
722 _cleanup_free_ char *f = NULL;
723 int r;
724
725 assert(rfd >= 0);
726
727 pfd = chase_and_open_parent_at(rfd, "/etc/machine-id",
728 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
729 &f);
730 if (pfd < 0)
731 return log_error_errno(pfd, "Failed to chase /etc/machine-id: %m");
732
733 r = should_configure(pfd, f);
734 if (r == 0)
735 log_debug("Found /etc/machine-id, assuming machine-id has been configured.");
736 if (r <= 0)
737 return r;
738
739 if (sd_id128_is_null(arg_machine_id)) {
740 log_debug("Initialization of machine-id was not requested, skipping.");
741 return 0;
742 }
743
744 r = write_string_file_at(pfd, "machine-id", SD_ID128_TO_STRING(arg_machine_id),
745 WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_SYNC|WRITE_STRING_FILE_ATOMIC);
746 if (r < 0)
747 return log_error_errno(r, "Failed to write /etc/machine-id: %m");
748
749 log_info("/etc/machine-id written.");
750 return 0;
751 }
752
753 static int prompt_root_password(int rfd) {
754 const char *msg1, *msg2;
755 int r;
756
757 assert(rfd >= 0);
758
759 if (arg_root_password)
760 return 0;
761
762 if (get_credential_user_password("root", &arg_root_password, &arg_root_password_is_hashed) >= 0)
763 return 0;
764
765 if (!arg_prompt_root_password) {
766 log_debug("Prompting for root password was not requested.");
767 return 0;
768 }
769
770 print_welcome(rfd);
771 putchar('\n');
772
773 msg1 = strjoina(special_glyph(SPECIAL_GLYPH_TRIANGULAR_BULLET), " Please enter a new root password (empty to skip):");
774 msg2 = strjoina(special_glyph(SPECIAL_GLYPH_TRIANGULAR_BULLET), " Please enter new root password again:");
775
776 suggest_passwords();
777
778 for (;;) {
779 _cleanup_strv_free_erase_ char **a = NULL, **b = NULL;
780 _cleanup_free_ char *error = NULL;
781
782 r = ask_password_tty(-1, msg1, NULL, 0, 0, NULL, &a);
783 if (r < 0)
784 return log_error_errno(r, "Failed to query root password: %m");
785 if (strv_length(a) != 1)
786 return log_error_errno(SYNTHETIC_ERRNO(EIO),
787 "Received multiple passwords, where we expected one.");
788
789 if (isempty(*a)) {
790 log_warning("No password entered, skipping.");
791 break;
792 }
793
794 r = check_password_quality(*a, /* old */ NULL, "root", &error);
795 if (ERRNO_IS_NEG_NOT_SUPPORTED(r))
796 log_warning("Password quality check is not supported, proceeding anyway.");
797 else if (r < 0)
798 return log_error_errno(r, "Failed to check password quality: %m");
799 else if (r == 0)
800 log_warning("Password is weak, accepting anyway: %s", error);
801
802 r = ask_password_tty(-1, msg2, NULL, 0, 0, NULL, &b);
803 if (r < 0)
804 return log_error_errno(r, "Failed to query root password: %m");
805 if (strv_length(b) != 1)
806 return log_error_errno(SYNTHETIC_ERRNO(EIO),
807 "Received multiple passwords, where we expected one.");
808
809 if (!streq(*a, *b)) {
810 log_error("Entered passwords did not match, please try again.");
811 continue;
812 }
813
814 arg_root_password = TAKE_PTR(*a);
815 break;
816 }
817
818 return 0;
819 }
820
821 static int find_shell(int rfd, const char *path) {
822 int r;
823
824 assert(path);
825
826 if (!valid_shell(path))
827 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "%s is not a valid shell", path);
828
829 r = chaseat(rfd, path, CHASE_AT_RESOLVE_IN_ROOT, NULL, NULL);
830 if (r < 0)
831 return log_error_errno(r, "Failed to resolve shell %s: %m", path);
832
833 return 0;
834 }
835
836 static int prompt_root_shell(int rfd) {
837 int r;
838
839 assert(rfd >= 0);
840
841 if (arg_root_shell)
842 return 0;
843
844 r = read_credential("passwd.shell.root", (void**) &arg_root_shell, NULL);
845 if (r < 0)
846 log_debug_errno(r, "Failed to read credential passwd.shell.root, ignoring: %m");
847 else {
848 log_debug("Acquired root shell from credential.");
849 return 0;
850 }
851
852 if (!arg_prompt_root_shell) {
853 log_debug("Prompting for root shell was not requested.");
854 return 0;
855 }
856
857 print_welcome(rfd);
858 putchar('\n');
859
860 for (;;) {
861 _cleanup_free_ char *s = NULL;
862
863 r = ask_string(&s, "%s Please enter root shell for new system (empty to skip): ", special_glyph(SPECIAL_GLYPH_TRIANGULAR_BULLET));
864 if (r < 0)
865 return log_error_errno(r, "Failed to query root shell: %m");
866
867 if (isempty(s)) {
868 log_warning("No shell entered, skipping.");
869 break;
870 }
871
872 r = find_shell(rfd, s);
873 if (r < 0)
874 continue;
875
876 arg_root_shell = TAKE_PTR(s);
877 break;
878 }
879
880 return 0;
881 }
882
883 static int write_root_passwd(int rfd, int etc_fd, const char *password, const char *shell) {
884 _cleanup_fclose_ FILE *original = NULL, *passwd = NULL;
885 _cleanup_(unlink_and_freep) char *passwd_tmp = NULL;
886 int r;
887
888 assert(password);
889
890 r = fopen_temporary_at_label(etc_fd, "passwd", "passwd", &passwd, &passwd_tmp);
891 if (r < 0)
892 return r;
893
894 r = xfopenat(etc_fd, "passwd", "re", O_NOFOLLOW, &original);
895 if (r < 0 && r != -ENOENT)
896 return r;
897
898 if (original) {
899 struct passwd *i;
900
901 r = copy_rights(fileno(original), fileno(passwd));
902 if (r < 0)
903 return r;
904
905 while ((r = fgetpwent_sane(original, &i)) > 0) {
906
907 if (streq(i->pw_name, "root")) {
908 i->pw_passwd = (char *) password;
909 if (shell)
910 i->pw_shell = (char *) shell;
911 }
912
913 r = putpwent_sane(i, passwd);
914 if (r < 0)
915 return r;
916 }
917 if (r < 0)
918 return r;
919
920 } else {
921 struct passwd root = {
922 .pw_name = (char *) "root",
923 .pw_passwd = (char *) password,
924 .pw_uid = 0,
925 .pw_gid = 0,
926 .pw_gecos = (char *) "Super User",
927 .pw_dir = (char *) "/root",
928 .pw_shell = (char *) (shell ?: default_root_shell_at(rfd)),
929 };
930
931 if (errno != ENOENT)
932 return -errno;
933
934 r = fchmod(fileno(passwd), 0644);
935 if (r < 0)
936 return -errno;
937
938 r = putpwent_sane(&root, passwd);
939 if (r < 0)
940 return r;
941 }
942
943 r = fflush_sync_and_check(passwd);
944 if (r < 0)
945 return r;
946
947 r = renameat_and_apply_smack_floor_label(etc_fd, passwd_tmp, etc_fd, "passwd");
948 if (r < 0)
949 return r;
950
951 return 0;
952 }
953
954 static int write_root_shadow(int etc_fd, const char *hashed_password) {
955 _cleanup_fclose_ FILE *original = NULL, *shadow = NULL;
956 _cleanup_(unlink_and_freep) char *shadow_tmp = NULL;
957 int r;
958
959 assert(hashed_password);
960
961 r = fopen_temporary_at_label(etc_fd, "shadow", "shadow", &shadow, &shadow_tmp);
962 if (r < 0)
963 return r;
964
965 r = xfopenat(etc_fd, "shadow", "re", O_NOFOLLOW, &original);
966 if (r < 0 && r != -ENOENT)
967 return r;
968
969 if (original) {
970 struct spwd *i;
971
972 r = copy_rights(fileno(original), fileno(shadow));
973 if (r < 0)
974 return r;
975
976 while ((r = fgetspent_sane(original, &i)) > 0) {
977
978 if (streq(i->sp_namp, "root")) {
979 i->sp_pwdp = (char *) hashed_password;
980 i->sp_lstchg = (long) (now(CLOCK_REALTIME) / USEC_PER_DAY);
981 }
982
983 r = putspent_sane(i, shadow);
984 if (r < 0)
985 return r;
986 }
987 if (r < 0)
988 return r;
989
990 } else {
991 struct spwd root = {
992 .sp_namp = (char*) "root",
993 .sp_pwdp = (char *) hashed_password,
994 .sp_lstchg = (long) (now(CLOCK_REALTIME) / USEC_PER_DAY),
995 .sp_min = -1,
996 .sp_max = -1,
997 .sp_warn = -1,
998 .sp_inact = -1,
999 .sp_expire = -1,
1000 .sp_flag = ULONG_MAX, /* this appears to be what everybody does ... */
1001 };
1002
1003 if (errno != ENOENT)
1004 return -errno;
1005
1006 r = fchmod(fileno(shadow), 0000);
1007 if (r < 0)
1008 return -errno;
1009
1010 r = putspent_sane(&root, shadow);
1011 if (r < 0)
1012 return r;
1013 }
1014
1015 r = fflush_sync_and_check(shadow);
1016 if (r < 0)
1017 return r;
1018
1019 r = renameat_and_apply_smack_floor_label(etc_fd, shadow_tmp, etc_fd, "shadow");
1020 if (r < 0)
1021 return r;
1022
1023 return 0;
1024 }
1025
1026 static int process_root_account(int rfd) {
1027 _cleanup_close_ int pfd = -EBADF;
1028 _cleanup_(release_lock_file) LockFile lock = LOCK_FILE_INIT;
1029 _cleanup_(erase_and_freep) char *_hashed_password = NULL;
1030 const char *password, *hashed_password;
1031 int k = 0, r;
1032
1033 assert(rfd >= 0);
1034
1035 pfd = chase_and_open_parent_at(rfd, "/etc/passwd",
1036 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
1037 NULL);
1038 if (pfd < 0)
1039 return log_error_errno(pfd, "Failed to chase /etc/passwd: %m");
1040
1041 /* Ensure that passwd and shadow are in the same directory and are not symlinks. */
1042
1043 FOREACH_STRING(s, "passwd", "shadow") {
1044 r = verify_regular_at(pfd, s, /* follow = */ false);
1045 if (IN_SET(r, -EISDIR, -ELOOP, -EBADFD))
1046 return log_error_errno(r, "/etc/%s is not a regular file", s);
1047 if (r < 0 && r != -ENOENT)
1048 return log_error_errno(r, "Failed to check whether /etc/%s is a regular file: %m", s);
1049
1050 r = should_configure(pfd, s);
1051 if (r < 0)
1052 return r;
1053
1054 k += r;
1055 }
1056
1057 if (k == 0) {
1058 log_debug("Found /etc/passwd and /etc/shadow, assuming root account has been initialized.");
1059 return 0;
1060 }
1061
1062 /* Don't create/modify passwd and shadow if not asked */
1063 if (!(arg_root_password || arg_prompt_root_password || arg_copy_root_password || arg_delete_root_password ||
1064 arg_root_shell || arg_prompt_root_shell || arg_copy_root_shell)) {
1065 log_debug("Initialization of root account was not requested, skipping.");
1066 return 0;
1067 }
1068
1069 r = make_lock_file_at(pfd, ETC_PASSWD_LOCK_FILENAME, LOCK_EX, &lock);
1070 if (r < 0)
1071 return log_error_errno(r, "Failed to take a lock on /etc/passwd: %m");
1072
1073 k = dir_fd_is_root(rfd);
1074 if (k < 0)
1075 return log_error_errno(k, "Failed to check if directory file descriptor is root: %m");
1076
1077 if (arg_copy_root_shell && k == 0) {
1078 struct passwd *p;
1079
1080 errno = 0;
1081 p = getpwnam("root");
1082 if (!p)
1083 return log_error_errno(errno_or_else(EIO), "Failed to find passwd entry for root: %m");
1084
1085 r = free_and_strdup(&arg_root_shell, p->pw_shell);
1086 if (r < 0)
1087 return log_oom();
1088 }
1089
1090 r = prompt_root_shell(rfd);
1091 if (r < 0)
1092 return r;
1093
1094 if (arg_copy_root_password && k == 0) {
1095 struct spwd *p;
1096
1097 errno = 0;
1098 p = getspnam("root");
1099 if (!p)
1100 return log_error_errno(errno_or_else(EIO), "Failed to find shadow entry for root: %m");
1101
1102 r = free_and_strdup(&arg_root_password, p->sp_pwdp);
1103 if (r < 0)
1104 return log_oom();
1105
1106 arg_root_password_is_hashed = true;
1107 }
1108
1109 r = prompt_root_password(rfd);
1110 if (r < 0)
1111 return r;
1112
1113 if (arg_root_password && arg_root_password_is_hashed) {
1114 password = PASSWORD_SEE_SHADOW;
1115 hashed_password = arg_root_password;
1116 } else if (arg_root_password) {
1117 r = hash_password(arg_root_password, &_hashed_password);
1118 if (r < 0)
1119 return log_error_errno(r, "Failed to hash password: %m");
1120
1121 password = PASSWORD_SEE_SHADOW;
1122 hashed_password = _hashed_password;
1123
1124 } else if (arg_delete_root_password)
1125 password = hashed_password = PASSWORD_NONE;
1126 else
1127 password = hashed_password = PASSWORD_LOCKED_AND_INVALID;
1128
1129 r = write_root_passwd(rfd, pfd, password, arg_root_shell);
1130 if (r < 0)
1131 return log_error_errno(r, "Failed to write /etc/passwd: %m");
1132
1133 log_info("/etc/passwd written.");
1134
1135 r = write_root_shadow(pfd, hashed_password);
1136 if (r < 0)
1137 return log_error_errno(r, "Failed to write /etc/shadow: %m");
1138
1139 log_info("/etc/shadow written.");
1140 return 0;
1141 }
1142
1143 static int process_kernel_cmdline(int rfd) {
1144 _cleanup_close_ int pfd = -EBADF;
1145 _cleanup_free_ char *f = NULL;
1146 int r;
1147
1148 assert(rfd >= 0);
1149
1150 pfd = chase_and_open_parent_at(rfd, "/etc/kernel/cmdline",
1151 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
1152 &f);
1153 if (pfd < 0)
1154 return log_error_errno(pfd, "Failed to chase /etc/kernel/cmdline: %m");
1155
1156 r = should_configure(pfd, f);
1157 if (r == 0)
1158 log_debug("Found /etc/kernel/cmdline, assuming kernel command line has been configured.");
1159 if (r <= 0)
1160 return r;
1161
1162 if (!arg_kernel_cmdline) {
1163 log_debug("Creation of /etc/kernel/cmdline was not requested, skipping.");
1164 return 0;
1165 }
1166
1167 r = write_string_file_at(pfd, "cmdline", arg_kernel_cmdline,
1168 WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_SYNC|WRITE_STRING_FILE_ATOMIC);
1169 if (r < 0)
1170 return log_error_errno(r, "Failed to write /etc/kernel/cmdline: %m");
1171
1172 log_info("/etc/kernel/cmdline written.");
1173 return 0;
1174 }
1175
1176 static int reset_one(int rfd, const char *path) {
1177 _cleanup_close_ int pfd = -EBADF;
1178 _cleanup_free_ char *f = NULL;
1179
1180 assert(rfd >= 0);
1181 assert(path);
1182
1183 pfd = chase_and_open_parent_at(rfd, path, CHASE_AT_RESOLVE_IN_ROOT|CHASE_WARN|CHASE_NOFOLLOW, &f);
1184 if (pfd == -ENOENT)
1185 return 0;
1186 if (pfd < 0)
1187 return log_error_errno(pfd, "Failed to resolve %s: %m", path);
1188
1189 if (unlinkat(pfd, f, 0) < 0)
1190 return errno == ENOENT ? 0 : log_error_errno(errno, "Failed to remove %s: %m", path);
1191
1192 log_info("Removed %s", path);
1193 return 0;
1194 }
1195
1196 static int process_reset(int rfd) {
1197 int r;
1198
1199 assert(rfd >= 0);
1200
1201 if (!arg_reset)
1202 return 0;
1203
1204 FOREACH_STRING(p,
1205 "/etc/locale.conf",
1206 "/etc/vconsole.conf",
1207 "/etc/hostname",
1208 "/etc/machine-id",
1209 "/etc/kernel/cmdline") {
1210 r = reset_one(rfd, p);
1211 if (r < 0)
1212 return r;
1213 }
1214
1215 return 0;
1216 }
1217
1218 static int help(void) {
1219 _cleanup_free_ char *link = NULL;
1220 int r;
1221
1222 r = terminal_urlify_man("systemd-firstboot", "1", &link);
1223 if (r < 0)
1224 return log_oom();
1225
1226 printf("%s [OPTIONS...]\n\n"
1227 "Configures basic settings of the system.\n\n"
1228 " -h --help Show this help\n"
1229 " --version Show package version\n"
1230 " --root=PATH Operate on an alternate filesystem root\n"
1231 " --image=PATH Operate on disk image as filesystem root\n"
1232 " --image-policy=POLICY Specify disk image dissection policy\n"
1233 " --locale=LOCALE Set primary locale (LANG=)\n"
1234 " --locale-messages=LOCALE Set message locale (LC_MESSAGES=)\n"
1235 " --keymap=KEYMAP Set keymap\n"
1236 " --timezone=TIMEZONE Set timezone\n"
1237 " --hostname=NAME Set hostname\n"
1238 " --setup-machine-id Set a random machine ID\n"
1239 " --machine-ID=ID Set specified machine ID\n"
1240 " --root-password=PASSWORD Set root password from plaintext password\n"
1241 " --root-password-file=FILE Set root password from file\n"
1242 " --root-password-hashed=HASH Set root password from hashed password\n"
1243 " --root-shell=SHELL Set root shell\n"
1244 " --prompt-locale Prompt the user for locale settings\n"
1245 " --prompt-keymap Prompt the user for keymap settings\n"
1246 " --prompt-timezone Prompt the user for timezone\n"
1247 " --prompt-hostname Prompt the user for hostname\n"
1248 " --prompt-root-password Prompt the user for root password\n"
1249 " --prompt-root-shell Prompt the user for root shell\n"
1250 " --prompt Prompt for all of the above\n"
1251 " --copy-locale Copy locale from host\n"
1252 " --copy-keymap Copy keymap from host\n"
1253 " --copy-timezone Copy timezone from host\n"
1254 " --copy-root-password Copy root password from host\n"
1255 " --copy-root-shell Copy root shell from host\n"
1256 " --copy Copy locale, keymap, timezone, root password\n"
1257 " --force Overwrite existing files\n"
1258 " --delete-root-password Delete root password\n"
1259 " --welcome=no Disable the welcome text\n"
1260 " --reset Remove existing files\n"
1261 "\nSee the %s for details.\n",
1262 program_invocation_short_name,
1263 link);
1264
1265 return 0;
1266 }
1267
1268 static int parse_argv(int argc, char *argv[]) {
1269
1270 enum {
1271 ARG_VERSION = 0x100,
1272 ARG_ROOT,
1273 ARG_IMAGE,
1274 ARG_IMAGE_POLICY,
1275 ARG_LOCALE,
1276 ARG_LOCALE_MESSAGES,
1277 ARG_KEYMAP,
1278 ARG_TIMEZONE,
1279 ARG_HOSTNAME,
1280 ARG_SETUP_MACHINE_ID,
1281 ARG_MACHINE_ID,
1282 ARG_ROOT_PASSWORD,
1283 ARG_ROOT_PASSWORD_FILE,
1284 ARG_ROOT_PASSWORD_HASHED,
1285 ARG_ROOT_SHELL,
1286 ARG_KERNEL_COMMAND_LINE,
1287 ARG_PROMPT,
1288 ARG_PROMPT_LOCALE,
1289 ARG_PROMPT_KEYMAP,
1290 ARG_PROMPT_TIMEZONE,
1291 ARG_PROMPT_HOSTNAME,
1292 ARG_PROMPT_ROOT_PASSWORD,
1293 ARG_PROMPT_ROOT_SHELL,
1294 ARG_COPY,
1295 ARG_COPY_LOCALE,
1296 ARG_COPY_KEYMAP,
1297 ARG_COPY_TIMEZONE,
1298 ARG_COPY_ROOT_PASSWORD,
1299 ARG_COPY_ROOT_SHELL,
1300 ARG_FORCE,
1301 ARG_DELETE_ROOT_PASSWORD,
1302 ARG_WELCOME,
1303 ARG_RESET,
1304 };
1305
1306 static const struct option options[] = {
1307 { "help", no_argument, NULL, 'h' },
1308 { "version", no_argument, NULL, ARG_VERSION },
1309 { "root", required_argument, NULL, ARG_ROOT },
1310 { "image", required_argument, NULL, ARG_IMAGE },
1311 { "image-policy", required_argument, NULL, ARG_IMAGE_POLICY },
1312 { "locale", required_argument, NULL, ARG_LOCALE },
1313 { "locale-messages", required_argument, NULL, ARG_LOCALE_MESSAGES },
1314 { "keymap", required_argument, NULL, ARG_KEYMAP },
1315 { "timezone", required_argument, NULL, ARG_TIMEZONE },
1316 { "hostname", required_argument, NULL, ARG_HOSTNAME },
1317 { "setup-machine-id", no_argument, NULL, ARG_SETUP_MACHINE_ID },
1318 { "machine-id", required_argument, NULL, ARG_MACHINE_ID },
1319 { "root-password", required_argument, NULL, ARG_ROOT_PASSWORD },
1320 { "root-password-file", required_argument, NULL, ARG_ROOT_PASSWORD_FILE },
1321 { "root-password-hashed", required_argument, NULL, ARG_ROOT_PASSWORD_HASHED },
1322 { "root-shell", required_argument, NULL, ARG_ROOT_SHELL },
1323 { "kernel-command-line", required_argument, NULL, ARG_KERNEL_COMMAND_LINE },
1324 { "prompt", no_argument, NULL, ARG_PROMPT },
1325 { "prompt-locale", no_argument, NULL, ARG_PROMPT_LOCALE },
1326 { "prompt-keymap", no_argument, NULL, ARG_PROMPT_KEYMAP },
1327 { "prompt-timezone", no_argument, NULL, ARG_PROMPT_TIMEZONE },
1328 { "prompt-hostname", no_argument, NULL, ARG_PROMPT_HOSTNAME },
1329 { "prompt-root-password", no_argument, NULL, ARG_PROMPT_ROOT_PASSWORD },
1330 { "prompt-root-shell", no_argument, NULL, ARG_PROMPT_ROOT_SHELL },
1331 { "copy", no_argument, NULL, ARG_COPY },
1332 { "copy-locale", no_argument, NULL, ARG_COPY_LOCALE },
1333 { "copy-keymap", no_argument, NULL, ARG_COPY_KEYMAP },
1334 { "copy-timezone", no_argument, NULL, ARG_COPY_TIMEZONE },
1335 { "copy-root-password", no_argument, NULL, ARG_COPY_ROOT_PASSWORD },
1336 { "copy-root-shell", no_argument, NULL, ARG_COPY_ROOT_SHELL },
1337 { "force", no_argument, NULL, ARG_FORCE },
1338 { "delete-root-password", no_argument, NULL, ARG_DELETE_ROOT_PASSWORD },
1339 { "welcome", required_argument, NULL, ARG_WELCOME },
1340 { "reset", no_argument, NULL, ARG_RESET },
1341 {}
1342 };
1343
1344 int r, c;
1345
1346 assert(argc >= 0);
1347 assert(argv);
1348
1349 while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0)
1350
1351 switch (c) {
1352
1353 case 'h':
1354 return help();
1355
1356 case ARG_VERSION:
1357 return version();
1358
1359 case ARG_ROOT:
1360 r = parse_path_argument(optarg, true, &arg_root);
1361 if (r < 0)
1362 return r;
1363 break;
1364
1365 case ARG_IMAGE:
1366 r = parse_path_argument(optarg, false, &arg_image);
1367 if (r < 0)
1368 return r;
1369 break;
1370
1371 case ARG_IMAGE_POLICY:
1372 r = parse_image_policy_argument(optarg, &arg_image_policy);
1373 if (r < 0)
1374 return r;
1375 break;
1376
1377 case ARG_LOCALE:
1378 r = free_and_strdup(&arg_locale, optarg);
1379 if (r < 0)
1380 return log_oom();
1381
1382 break;
1383
1384 case ARG_LOCALE_MESSAGES:
1385 r = free_and_strdup(&arg_locale_messages, optarg);
1386 if (r < 0)
1387 return log_oom();
1388
1389 break;
1390
1391 case ARG_KEYMAP:
1392 if (!keymap_is_valid(optarg))
1393 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1394 "Keymap %s is not valid.", optarg);
1395
1396 r = free_and_strdup(&arg_keymap, optarg);
1397 if (r < 0)
1398 return log_oom();
1399
1400 break;
1401
1402 case ARG_TIMEZONE:
1403 if (!timezone_is_valid(optarg, LOG_ERR))
1404 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1405 "Timezone %s is not valid.", optarg);
1406
1407 r = free_and_strdup(&arg_timezone, optarg);
1408 if (r < 0)
1409 return log_oom();
1410
1411 break;
1412
1413 case ARG_ROOT_PASSWORD:
1414 r = free_and_strdup(&arg_root_password, optarg);
1415 if (r < 0)
1416 return log_oom();
1417
1418 arg_root_password_is_hashed = false;
1419 break;
1420
1421 case ARG_ROOT_PASSWORD_FILE:
1422 arg_root_password = mfree(arg_root_password);
1423
1424 r = read_one_line_file(optarg, &arg_root_password);
1425 if (r < 0)
1426 return log_error_errno(r, "Failed to read %s: %m", optarg);
1427
1428 arg_root_password_is_hashed = false;
1429 break;
1430
1431 case ARG_ROOT_PASSWORD_HASHED:
1432 r = free_and_strdup(&arg_root_password, optarg);
1433 if (r < 0)
1434 return log_oom();
1435
1436 arg_root_password_is_hashed = true;
1437 break;
1438
1439 case ARG_ROOT_SHELL:
1440 r = free_and_strdup(&arg_root_shell, optarg);
1441 if (r < 0)
1442 return log_oom();
1443
1444 break;
1445
1446 case ARG_HOSTNAME:
1447 if (!hostname_is_valid(optarg, VALID_HOSTNAME_TRAILING_DOT))
1448 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1449 "Host name %s is not valid.", optarg);
1450
1451 r = free_and_strdup(&arg_hostname, optarg);
1452 if (r < 0)
1453 return log_oom();
1454
1455 hostname_cleanup(arg_hostname);
1456 break;
1457
1458 case ARG_SETUP_MACHINE_ID:
1459 r = sd_id128_randomize(&arg_machine_id);
1460 if (r < 0)
1461 return log_error_errno(r, "Failed to generate randomized machine ID: %m");
1462
1463 break;
1464
1465 case ARG_MACHINE_ID:
1466 r = sd_id128_from_string(optarg, &arg_machine_id);
1467 if (r < 0)
1468 return log_error_errno(r, "Failed to parse machine id %s.", optarg);
1469
1470 break;
1471
1472 case ARG_KERNEL_COMMAND_LINE:
1473 r = free_and_strdup(&arg_kernel_cmdline, optarg);
1474 if (r < 0)
1475 return log_oom();
1476
1477 break;
1478
1479 case ARG_PROMPT:
1480 arg_prompt_locale = arg_prompt_keymap = arg_prompt_timezone = arg_prompt_hostname =
1481 arg_prompt_root_password = arg_prompt_root_shell = true;
1482 break;
1483
1484 case ARG_PROMPT_LOCALE:
1485 arg_prompt_locale = true;
1486 break;
1487
1488 case ARG_PROMPT_KEYMAP:
1489 arg_prompt_keymap = true;
1490 break;
1491
1492 case ARG_PROMPT_TIMEZONE:
1493 arg_prompt_timezone = true;
1494 break;
1495
1496 case ARG_PROMPT_HOSTNAME:
1497 arg_prompt_hostname = true;
1498 break;
1499
1500 case ARG_PROMPT_ROOT_PASSWORD:
1501 arg_prompt_root_password = true;
1502 break;
1503
1504 case ARG_PROMPT_ROOT_SHELL:
1505 arg_prompt_root_shell = true;
1506 break;
1507
1508 case ARG_COPY:
1509 arg_copy_locale = arg_copy_keymap = arg_copy_timezone = arg_copy_root_password =
1510 arg_copy_root_shell = true;
1511 break;
1512
1513 case ARG_COPY_LOCALE:
1514 arg_copy_locale = true;
1515 break;
1516
1517 case ARG_COPY_KEYMAP:
1518 arg_copy_keymap = true;
1519 break;
1520
1521 case ARG_COPY_TIMEZONE:
1522 arg_copy_timezone = true;
1523 break;
1524
1525 case ARG_COPY_ROOT_PASSWORD:
1526 arg_copy_root_password = true;
1527 break;
1528
1529 case ARG_COPY_ROOT_SHELL:
1530 arg_copy_root_shell = true;
1531 break;
1532
1533 case ARG_FORCE:
1534 arg_force = true;
1535 break;
1536
1537 case ARG_DELETE_ROOT_PASSWORD:
1538 arg_delete_root_password = true;
1539 break;
1540
1541 case ARG_WELCOME:
1542 r = parse_boolean(optarg);
1543 if (r < 0)
1544 return log_error_errno(r, "Failed to parse --welcome= argument: %s", optarg);
1545
1546 arg_welcome = r;
1547 break;
1548
1549 case ARG_RESET:
1550 arg_reset = true;
1551 break;
1552
1553 case '?':
1554 return -EINVAL;
1555
1556 default:
1557 assert_not_reached();
1558 }
1559
1560 if (arg_delete_root_password && (arg_copy_root_password || arg_root_password || arg_prompt_root_password))
1561 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1562 "--delete-root-password cannot be combined with other root password options.");
1563
1564 if (arg_image && arg_root)
1565 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1566 "--root= and --image= cannot be used together.");
1567
1568 if (!sd_id128_is_null(arg_machine_id) && !(arg_image || arg_root) && !arg_force)
1569 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1570 "--machine-id=/--setup-machine-id only works with --root= or --image=.");
1571
1572 return 1;
1573 }
1574
1575 static int reload_system_manager(sd_bus **bus) {
1576 int r;
1577
1578 assert(bus);
1579
1580 if (!*bus) {
1581 r = bus_connect_transport_systemd(BUS_TRANSPORT_LOCAL, NULL, RUNTIME_SCOPE_SYSTEM, bus);
1582 if (r < 0)
1583 return bus_log_connect_error(r, BUS_TRANSPORT_LOCAL);
1584 }
1585
1586 r = bus_service_manager_reload(*bus);
1587 if (r < 0)
1588 return r;
1589
1590 log_info("Requested manager reload to apply locale configuration.");
1591 return 0;
1592 }
1593
1594 static int reload_vconsole(sd_bus **bus) {
1595 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1596 _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
1597 _cleanup_(bus_wait_for_jobs_freep) BusWaitForJobs *w = NULL;
1598 const char *object;
1599 int r;
1600
1601 assert(bus);
1602
1603 if (!*bus) {
1604 r = bus_connect_transport_systemd(BUS_TRANSPORT_LOCAL, NULL, RUNTIME_SCOPE_SYSTEM, bus);
1605 if (r < 0)
1606 return bus_log_connect_error(r, BUS_TRANSPORT_LOCAL);
1607 }
1608
1609 r = bus_wait_for_jobs_new(*bus, &w);
1610 if (r < 0)
1611 return log_error_errno(r, "Could not watch jobs: %m");
1612
1613 r = bus_call_method(*bus, bus_systemd_mgr, "RestartUnit", &error, &reply,
1614 "ss", "systemd-vconsole-setup.service", "replace");
1615 if (r < 0)
1616 return log_error_errno(r, "Failed to issue method call: %s", bus_error_message(&error, r));
1617
1618 r = sd_bus_message_read(reply, "o", &object);
1619 if (r < 0)
1620 return bus_log_parse_error(r);
1621
1622 r = bus_wait_for_jobs_one(w, object, false, NULL);
1623 if (r < 0)
1624 return log_error_errno(r, "Failed to wait for systemd-vconsole-setup.service/restart: %m");
1625 return 0;
1626 }
1627
1628 static int run(int argc, char *argv[]) {
1629 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
1630 _cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
1631 _cleanup_(umount_and_freep) char *mounted_dir = NULL;
1632 _cleanup_close_ int rfd = -EBADF;
1633 int r;
1634
1635 r = parse_argv(argc, argv);
1636 if (r <= 0)
1637 return r;
1638
1639 log_setup();
1640
1641 umask(0022);
1642
1643 bool offline = arg_root || arg_image;
1644
1645 if (!offline) {
1646 /* If we are called without --root=/--image= let's honour the systemd.firstboot kernel
1647 * command line option, because we are called to provision the host with basic settings (as
1648 * opposed to some other file system tree/image) */
1649
1650 bool enabled;
1651 r = proc_cmdline_get_bool("systemd.firstboot", /* flags = */ 0, &enabled);
1652 if (r < 0)
1653 return log_error_errno(r, "Failed to parse systemd.firstboot= kernel command line argument, ignoring: %m");
1654 if (r > 0 && !enabled) {
1655 log_debug("Found systemd.firstboot=no kernel command line argument, terminating.");
1656 return 0; /* disabled */
1657 }
1658 }
1659
1660 if (arg_image) {
1661 assert(!arg_root);
1662
1663 r = mount_image_privately_interactively(
1664 arg_image,
1665 arg_image_policy,
1666 DISSECT_IMAGE_GENERIC_ROOT |
1667 DISSECT_IMAGE_REQUIRE_ROOT |
1668 DISSECT_IMAGE_VALIDATE_OS |
1669 DISSECT_IMAGE_RELAX_VAR_CHECK |
1670 DISSECT_IMAGE_FSCK |
1671 DISSECT_IMAGE_GROWFS,
1672 &mounted_dir,
1673 &rfd,
1674 &loop_device);
1675 if (r < 0)
1676 return r;
1677
1678 arg_root = strdup(mounted_dir);
1679 if (!arg_root)
1680 return log_oom();
1681 } else {
1682 rfd = open(empty_to_root(arg_root), O_DIRECTORY|O_CLOEXEC);
1683 if (rfd < 0)
1684 return log_error_errno(errno, "Failed to open %s: %m", empty_to_root(arg_root));
1685 }
1686
1687 LOG_SET_PREFIX(arg_image ?: arg_root);
1688
1689 /* We check these conditions here instead of in parse_argv() so that we can take the root directory
1690 * into account. */
1691
1692 if (arg_locale && !locale_is_ok(rfd, arg_locale))
1693 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Locale %s is not installed.", arg_locale);
1694 if (arg_locale_messages && !locale_is_ok(rfd, arg_locale_messages))
1695 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Locale %s is not installed.", arg_locale_messages);
1696
1697 if (arg_root_shell) {
1698 r = find_shell(rfd, arg_root_shell);
1699 if (r < 0)
1700 return r;
1701 }
1702
1703 r = process_reset(rfd);
1704 if (r < 0)
1705 return r;
1706
1707 r = process_locale(rfd);
1708 if (r < 0)
1709 return r;
1710 if (r > 0 && !offline)
1711 (void) reload_system_manager(&bus);
1712
1713 r = process_keymap(rfd);
1714 if (r < 0)
1715 return r;
1716 if (r > 0 && !offline)
1717 (void) reload_vconsole(&bus);
1718
1719 r = process_timezone(rfd);
1720 if (r < 0)
1721 return r;
1722
1723 r = process_hostname(rfd);
1724 if (r < 0)
1725 return r;
1726
1727 r = process_machine_id(rfd);
1728 if (r < 0)
1729 return r;
1730
1731 r = process_root_account(rfd);
1732 if (r < 0)
1733 return r;
1734
1735 r = process_kernel_cmdline(rfd);
1736 if (r < 0)
1737 return r;
1738
1739 return 0;
1740 }
1741
1742 DEFINE_MAIN_FUNCTION(run);
Unnamed repository; edit this file 'description' to name the repository.