1 /* SPDX-License-Identifier: LGPL-2.1+ */
7 #include "sd-messages.h"
9 #include "alloc-util.h"
11 #include "format-util.h"
13 #include "journald-console.h"
14 #include "journald-kmsg.h"
15 #include "journald-server.h"
16 #include "journald-syslog.h"
17 #include "journald-wall.h"
18 #include "process-util.h"
19 #include "selinux-util.h"
20 #include "socket-util.h"
21 #include "stdio-util.h"
22 #include "string-util.h"
23 #include "syslog-util.h"
25 /* Warn once every 30s if we missed syslog message */
26 #define WARN_FORWARD_SYSLOG_MISSED_USEC (30 * USEC_PER_SEC)
28 static void forward_syslog_iovec(Server
*s
, const struct iovec
*iovec
, unsigned n_iovec
, const struct ucred
*ucred
, const struct timeval
*tv
) {
30 static const union sockaddr_union sa
= {
31 .un
.sun_family
= AF_UNIX
,
32 .un
.sun_path
= "/run/systemd/journal/syslog",
34 struct msghdr msghdr
= {
35 .msg_iov
= (struct iovec
*) iovec
,
36 .msg_iovlen
= n_iovec
,
37 .msg_name
= (struct sockaddr
*) &sa
.sa
,
38 .msg_namelen
= SOCKADDR_UN_LEN(sa
.un
),
42 struct cmsghdr cmsghdr
;
43 uint8_t buf
[CMSG_SPACE(sizeof(struct ucred
))];
52 msghdr
.msg_control
= &control
;
53 msghdr
.msg_controllen
= sizeof(control
);
55 cmsg
= CMSG_FIRSTHDR(&msghdr
);
56 cmsg
->cmsg_level
= SOL_SOCKET
;
57 cmsg
->cmsg_type
= SCM_CREDENTIALS
;
58 cmsg
->cmsg_len
= CMSG_LEN(sizeof(struct ucred
));
59 memcpy(CMSG_DATA(cmsg
), ucred
, sizeof(struct ucred
));
60 msghdr
.msg_controllen
= cmsg
->cmsg_len
;
63 /* Forward the syslog message we received via /dev/log to
64 * /run/systemd/syslog. Unfortunately we currently can't set
65 * the SO_TIMESTAMP auxiliary data, and hence we don't. */
67 if (sendmsg(s
->syslog_fd
, &msghdr
, MSG_NOSIGNAL
) >= 0)
70 /* The socket is full? I guess the syslog implementation is
71 * too slow, and we shouldn't wait for that... */
72 if (errno
== EAGAIN
) {
73 s
->n_forward_syslog_missed
++;
77 if (ucred
&& IN_SET(errno
, ESRCH
, EPERM
)) {
80 /* Hmm, presumably the sender process vanished
81 * by now, or we don't have CAP_SYS_AMDIN, so
82 * let's fix it as good as we can, and retry */
85 u
.pid
= getpid_cached();
86 memcpy(CMSG_DATA(cmsg
), &u
, sizeof(struct ucred
));
88 if (sendmsg(s
->syslog_fd
, &msghdr
, MSG_NOSIGNAL
) >= 0)
91 if (errno
== EAGAIN
) {
92 s
->n_forward_syslog_missed
++;
98 log_debug_errno(errno
, "Failed to forward syslog message: %m");
101 static void forward_syslog_raw(Server
*s
, int priority
, const char *buffer
, size_t buffer_len
, const struct ucred
*ucred
, const struct timeval
*tv
) {
107 if (LOG_PRI(priority
) > s
->max_level_syslog
)
110 iovec
= IOVEC_MAKE((char *) buffer
, buffer_len
);
111 forward_syslog_iovec(s
, &iovec
, 1, ucred
, tv
);
114 void server_forward_syslog(Server
*s
, int priority
, const char *identifier
, const char *message
, const struct ucred
*ucred
, const struct timeval
*tv
) {
115 struct iovec iovec
[5];
116 char header_priority
[DECIMAL_STR_MAX(priority
) + 3], header_time
[64],
117 header_pid
[STRLEN("[]: ") + DECIMAL_STR_MAX(pid_t
) + 1];
121 _cleanup_free_
char *ident_buf
= NULL
;
124 assert(priority
>= 0);
125 assert(priority
<= 999);
128 if (LOG_PRI(priority
) > s
->max_level_syslog
)
131 /* First: priority field */
132 xsprintf(header_priority
, "<%i>", priority
);
133 iovec
[n
++] = IOVEC_MAKE_STRING(header_priority
);
135 /* Second: timestamp */
136 t
= tv
? tv
->tv_sec
: ((time_t) (now(CLOCK_REALTIME
) / USEC_PER_SEC
));
137 if (!localtime_r(&t
, &tm
))
139 if (strftime(header_time
, sizeof(header_time
), "%h %e %T ", &tm
) <= 0)
141 iovec
[n
++] = IOVEC_MAKE_STRING(header_time
);
143 /* Third: identifier and PID */
146 get_process_comm(ucred
->pid
, &ident_buf
);
147 identifier
= ident_buf
;
150 xsprintf(header_pid
, "["PID_FMT
"]: ", ucred
->pid
);
153 iovec
[n
++] = IOVEC_MAKE_STRING(identifier
);
155 iovec
[n
++] = IOVEC_MAKE_STRING(header_pid
);
156 } else if (identifier
) {
157 iovec
[n
++] = IOVEC_MAKE_STRING(identifier
);
158 iovec
[n
++] = IOVEC_MAKE_STRING(": ");
161 /* Fourth: message */
162 iovec
[n
++] = IOVEC_MAKE_STRING(message
);
164 forward_syslog_iovec(s
, iovec
, n
, ucred
, tv
);
167 int syslog_fixup_facility(int priority
) {
169 if ((priority
& LOG_FACMASK
) == 0)
170 return (priority
& LOG_PRIMASK
) | LOG_USER
;
175 size_t syslog_parse_identifier(const char **buf
, char **identifier
, char **pid
) {
186 p
+= strspn(p
, WHITESPACE
);
187 l
= strcspn(p
, WHITESPACE
);
202 t
= strndup(p
+k
+1, l
-k
-2);
221 if (strchr(WHITESPACE
, p
[e
]))
227 static void syslog_skip_date(char **buf
) {
235 LETTER
, LETTER
, LETTER
,
237 SPACE_OR_NUMBER
, NUMBER
,
239 SPACE_OR_NUMBER
, NUMBER
,
241 SPACE_OR_NUMBER
, NUMBER
,
243 SPACE_OR_NUMBER
, NUMBER
,
255 for (i
= 0; i
< ELEMENTSOF(sequence
); i
++, p
++) {
260 switch (sequence
[i
]) {
267 case SPACE_OR_NUMBER
:
273 if (*p
< '0' || *p
> '9')
279 if (!(*p
>= 'A' && *p
<= 'Z') &&
280 !(*p
>= 'a' && *p
<= 'z'))
296 void server_process_syslog_message(
300 const struct ucred
*ucred
,
301 const struct timeval
*tv
,
305 char syslog_priority
[sizeof("PRIORITY=") + DECIMAL_STR_MAX(int)],
306 syslog_facility
[sizeof("SYSLOG_FACILITY=") + DECIMAL_STR_MAX(int)], *msg
;
307 const char *message
= NULL
, *syslog_identifier
= NULL
, *syslog_pid
= NULL
;
308 _cleanup_free_
char *identifier
= NULL
, *pid
= NULL
;
309 int priority
= LOG_USER
| LOG_INFO
, r
;
310 ClientContext
*context
= NULL
;
317 if (ucred
&& pid_is_valid(ucred
->pid
)) {
318 r
= client_context_get(s
, ucred
->pid
, ucred
, label
, label_len
, NULL
, &context
);
320 log_warning_errno(r
, "Failed to retrieve credentials for PID " PID_FMT
", ignoring: %m", ucred
->pid
);
323 /* We are creating copy of the message because we want to forward original message verbatim to the legacy
324 syslog implementation */
325 for (i
= buf_len
; i
> 0; i
--)
326 if (!strchr(WHITESPACE
, buf
[i
-1]))
329 msg
= newa(char, i
+ 1);
330 *((char *) mempcpy(msg
, buf
, i
)) = 0;
331 msg
= skip_leading_chars(msg
, WHITESPACE
);
333 syslog_parse_priority((const char **)&msg
, &priority
, true);
335 if (!client_context_test_priority(context
, priority
))
338 if (s
->forward_to_syslog
)
339 forward_syslog_raw(s
, priority
, buf
, buf_len
, ucred
, tv
);
341 syslog_skip_date(&msg
);
342 syslog_parse_identifier((const char**)&msg
, &identifier
, &pid
);
344 if (s
->forward_to_kmsg
)
345 server_forward_kmsg(s
, priority
, identifier
, msg
, ucred
);
347 if (s
->forward_to_console
)
348 server_forward_console(s
, priority
, identifier
, msg
, ucred
);
350 if (s
->forward_to_wall
)
351 server_forward_wall(s
, priority
, identifier
, msg
, ucred
);
353 m
= N_IOVEC_META_FIELDS
+ 6 + client_context_extra_fields_n_iovec(context
);
354 iovec
= newa(struct iovec
, m
);
356 iovec
[n
++] = IOVEC_MAKE_STRING("_TRANSPORT=syslog");
358 xsprintf(syslog_priority
, "PRIORITY=%i", priority
& LOG_PRIMASK
);
359 iovec
[n
++] = IOVEC_MAKE_STRING(syslog_priority
);
361 if (priority
& LOG_FACMASK
) {
362 xsprintf(syslog_facility
, "SYSLOG_FACILITY=%i", LOG_FAC(priority
));
363 iovec
[n
++] = IOVEC_MAKE_STRING(syslog_facility
);
367 syslog_identifier
= strjoina("SYSLOG_IDENTIFIER=", identifier
);
368 iovec
[n
++] = IOVEC_MAKE_STRING(syslog_identifier
);
372 syslog_pid
= strjoina("SYSLOG_PID=", pid
);
373 iovec
[n
++] = IOVEC_MAKE_STRING(syslog_pid
);
376 message
= strjoina("MESSAGE=", msg
);
378 iovec
[n
++] = IOVEC_MAKE_STRING(message
);
380 server_dispatch_message(s
, iovec
, n
, m
, context
, tv
, priority
, 0);
383 int server_open_syslog_socket(Server
*s
) {
385 static const union sockaddr_union sa
= {
386 .un
.sun_family
= AF_UNIX
,
387 .un
.sun_path
= "/run/systemd/journal/dev-log",
389 static const int one
= 1;
394 if (s
->syslog_fd
< 0) {
395 s
->syslog_fd
= socket(AF_UNIX
, SOCK_DGRAM
|SOCK_CLOEXEC
|SOCK_NONBLOCK
, 0);
396 if (s
->syslog_fd
< 0)
397 return log_error_errno(errno
, "socket() failed: %m");
399 (void) unlink(sa
.un
.sun_path
);
401 r
= bind(s
->syslog_fd
, &sa
.sa
, SOCKADDR_UN_LEN(sa
.un
));
403 return log_error_errno(errno
, "bind(%s) failed: %m", sa
.un
.sun_path
);
405 (void) chmod(sa
.un
.sun_path
, 0666);
407 fd_nonblock(s
->syslog_fd
, 1);
409 r
= setsockopt(s
->syslog_fd
, SOL_SOCKET
, SO_PASSCRED
, &one
, sizeof(one
));
411 return log_error_errno(errno
, "SO_PASSCRED failed: %m");
414 if (mac_selinux_use()) {
415 r
= setsockopt(s
->syslog_fd
, SOL_SOCKET
, SO_PASSSEC
, &one
, sizeof(one
));
417 log_warning_errno(errno
, "SO_PASSSEC failed: %m");
421 r
= setsockopt(s
->syslog_fd
, SOL_SOCKET
, SO_TIMESTAMP
, &one
, sizeof(one
));
423 return log_error_errno(errno
, "SO_TIMESTAMP failed: %m");
425 r
= sd_event_add_io(s
->event
, &s
->syslog_event_source
, s
->syslog_fd
, EPOLLIN
, server_process_datagram
, s
);
427 return log_error_errno(r
, "Failed to add syslog server fd to event loop: %m");
429 r
= sd_event_source_set_priority(s
->syslog_event_source
, SD_EVENT_PRIORITY_NORMAL
+5);
431 return log_error_errno(r
, "Failed to adjust syslog event source priority: %m");
436 void server_maybe_warn_forward_syslog_missed(Server
*s
) {
441 if (s
->n_forward_syslog_missed
<= 0)
444 n
= now(CLOCK_MONOTONIC
);
445 if (s
->last_warn_forward_syslog_missed
+ WARN_FORWARD_SYSLOG_MISSED_USEC
> n
)
448 server_driver_message(s
, 0,
449 "MESSAGE_ID=" SD_MESSAGE_FORWARD_SYSLOG_MISSED_STR
,
450 LOG_MESSAGE("Forwarding to syslog missed %u messages.",
451 s
->n_forward_syslog_missed
),
454 s
->n_forward_syslog_missed
= 0;
455 s
->last_warn_forward_syslog_missed
= n
;