src/shared/condition.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <fnmatch.h>
   6 #include <limits.h>
   7 #include <stdlib.h>
   8 #include <sys/types.h>
   9 #include <sys/utsname.h>
  10 #include <time.h>
  11 #include <unistd.h>
  12
  13 #include "sd-id128.h"
  14
  15 #include "alloc-util.h"
  16 #include "apparmor-util.h"
  17 #include "architecture.h"
  18 #include "audit-util.h"
  19 #include "cap-list.h"
  20 #include "cgroup-util.h"
  21 #include "condition.h"
  22 #include "cpu-set-util.h"
  23 #include "efi-loader.h"
  24 #include "env-file.h"
  25 #include "extract-word.h"
  26 #include "fd-util.h"
  27 #include "fileio.h"
  28 #include "fs-util.h"
  29 #include "glob-util.h"
  30 #include "hostname-util.h"
  31 #include "ima-util.h"
  32 #include "limits-util.h"
  33 #include "list.h"
  34 #include "macro.h"
  35 #include "mountpoint-util.h"
  36 #include "parse-util.h"
  37 #include "path-util.h"
  38 #include "proc-cmdline.h"
  39 #include "process-util.h"
  40 #include "selinux-util.h"
  41 #include "smack-util.h"
  42 #include "stat-util.h"
  43 #include "string-table.h"
  44 #include "string-util.h"
  45 #include "tomoyo-util.h"
  46 #include "user-util.h"
  47 #include "util.h"
  48 #include "virt.h"
  49
  50 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
  51         Condition *c;
  52
  53         assert(type >= 0);
  54         assert(type < _CONDITION_TYPE_MAX);
  55         assert((!parameter) == (type == CONDITION_NULL));
  56
  57         c = new(Condition, 1);
  58         if (!c)
  59                 return NULL;
  60
  61         *c = (Condition) {
  62                 .type = type,
  63                 .trigger = trigger,
  64                 .negate = negate,
  65         };
  66
  67         if (parameter) {
  68                 c->parameter = strdup(parameter);
  69                 if (!c->parameter)
  70                         return mfree(c);
  71         }
  72
  73         return c;
  74 }
  75
  76 Condition* condition_free(Condition *c) {
  77         assert(c);
  78
  79         free(c->parameter);
  80         return mfree(c);
  81 }
  82
  83 Condition* condition_free_list_type(Condition *head, ConditionType type) {
  84         Condition *c, *n;
  85
  86         LIST_FOREACH_SAFE(conditions, c, n, head)
  87                 if (type < 0 || c->type == type) {
  88                         LIST_REMOVE(conditions, head, c);
  89                         condition_free(c);
  90                 }
  91
  92         assert(type >= 0 || !head);
  93         return head;
  94 }
  95
  96 static int condition_test_kernel_command_line(Condition *c, char **env) {
  97         _cleanup_free_ char *line = NULL;
  98         const char *p;
  99         bool equal;
 100         int r;
 101
 102         assert(c);
 103         assert(c->parameter);
 104         assert(c->type == CONDITION_KERNEL_COMMAND_LINE);
 105
 106         r = proc_cmdline(&line);
 107         if (r < 0)
 108                 return r;
 109
 110         equal = strchr(c->parameter, '=');
 111
 112         for (p = line;;) {
 113                 _cleanup_free_ char *word = NULL;
 114                 bool found;
 115
 116                 r = extract_first_word(&p, &word, NULL, EXTRACT_UNQUOTE|EXTRACT_RELAX);
 117                 if (r < 0)
 118                         return r;
 119                 if (r == 0)
 120                         break;
 121
 122                 if (equal)
 123                         found = streq(word, c->parameter);
 124                 else {
 125                         const char *f;
 126
 127                         f = startswith(word, c->parameter);
 128                         found = f && IN_SET(*f, 0, '=');
 129                 }
 130
 131                 if (found)
 132                         return true;
 133         }
 134
 135         return false;
 136 }
 137
 138 typedef enum {
 139         /* Listed in order of checking. Note that some comparators are prefixes of others, hence the longest
 140          * should be listed first. */
 141         ORDER_LOWER_OR_EQUAL,
 142         ORDER_GREATER_OR_EQUAL,
 143         ORDER_LOWER,
 144         ORDER_GREATER,
 145         ORDER_EQUAL,
 146         ORDER_UNEQUAL,
 147         _ORDER_MAX,
 148         _ORDER_INVALID = -1
 149 } OrderOperator;
 150
 151 static OrderOperator parse_order(const char **s) {
 152
 153         static const char *const prefix[_ORDER_MAX] = {
 154                 [ORDER_LOWER_OR_EQUAL] = "<=",
 155                 [ORDER_GREATER_OR_EQUAL] = ">=",
 156                 [ORDER_LOWER] = "<",
 157                 [ORDER_GREATER] = ">",
 158                 [ORDER_EQUAL] = "=",
 159                 [ORDER_UNEQUAL] = "!=",
 160         };
 161
 162         OrderOperator i;
 163
 164         for (i = 0; i < _ORDER_MAX; i++) {
 165                 const char *e;
 166
 167                 e = startswith(*s, prefix[i]);
 168                 if (e) {
 169                         *s = e;
 170                         return i;
 171                 }
 172         }
 173
 174         return _ORDER_INVALID;
 175 }
 176
 177 static bool test_order(int k, OrderOperator p) {
 178
 179         switch (p) {
 180
 181         case ORDER_LOWER:
 182                 return k < 0;
 183
 184         case ORDER_LOWER_OR_EQUAL:
 185                 return k <= 0;
 186
 187         case ORDER_EQUAL:
 188                 return k == 0;
 189
 190         case ORDER_UNEQUAL:
 191                 return k != 0;
 192
 193         case ORDER_GREATER_OR_EQUAL:
 194                 return k >= 0;
 195
 196         case ORDER_GREATER:
 197                 return k > 0;
 198
 199         default:
 200                 assert_not_reached("unknown order");
 201
 202         }
 203 }
 204
 205 static int condition_test_kernel_version(Condition *c, char **env) {
 206         OrderOperator order;
 207         struct utsname u;
 208         const char *p;
 209         bool first = true;
 210
 211         assert(c);
 212         assert(c->parameter);
 213         assert(c->type == CONDITION_KERNEL_VERSION);
 214
 215         assert_se(uname(&u) >= 0);
 216
 217         p = c->parameter;
 218
 219         for (;;) {
 220                 _cleanup_free_ char *word = NULL;
 221                 const char *s;
 222                 int r;
 223
 224                 r = extract_first_word(&p, &word, NULL, EXTRACT_UNQUOTE);
 225                 if (r < 0)
 226                         return log_debug_errno(r, "Failed to parse condition string \"%s\": %m", p);
 227                 if (r == 0)
 228                         break;
 229
 230                 s = strstrip(word);
 231                 order = parse_order(&s);
 232                 if (order >= 0) {
 233                         s += strspn(s, WHITESPACE);
 234                         if (isempty(s)) {
 235                                 if (first) {
 236                                         /* For backwards compatibility, allow whitespace between the operator and
 237                                          * value, without quoting, but only in the first expression. */
 238                                         word = mfree(word);
 239                                         r = extract_first_word(&p, &word, NULL, 0);
 240                                         if (r < 0)
 241                                                 return log_debug_errno(r, "Failed to parse condition string \"%s\": %m", p);
 242                                         if (r == 0)
 243                                                 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected end of expression: %s", p);
 244                                         s = word;
 245                                 } else
 246                                         return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected end of expression: %s", p);
 247                         }
 248
 249                         r = test_order(str_verscmp(u.release, s), order);
 250                 } else
 251                         /* No prefix? Then treat as glob string */
 252                         r = fnmatch(s, u.release, 0) == 0;
 253
 254                 if (r == 0)
 255                         return false;
 256
 257                 first = false;
 258         }
 259
 260         return true;
 261 }
 262
 263 static int condition_test_memory(Condition *c, char **env) {
 264         OrderOperator order;
 265         uint64_t m, k;
 266         const char *p;
 267         int r;
 268
 269         assert(c);
 270         assert(c->parameter);
 271         assert(c->type == CONDITION_MEMORY);
 272
 273         m = physical_memory();
 274
 275         p = c->parameter;
 276         order = parse_order(&p);
 277         if (order < 0)
 278                 order = ORDER_GREATER_OR_EQUAL; /* default to >= check, if nothing is specified. */
 279
 280         r = safe_atou64(p, &k);
 281         if (r < 0)
 282                 return log_debug_errno(r, "Failed to parse size: %m");
 283
 284         return test_order(CMP(m, k), order);
 285 }
 286
 287 static int condition_test_cpus(Condition *c, char **env) {
 288         OrderOperator order;
 289         const char *p;
 290         unsigned k;
 291         int r, n;
 292
 293         assert(c);
 294         assert(c->parameter);
 295         assert(c->type == CONDITION_CPUS);
 296
 297         n = cpus_in_affinity_mask();
 298         if (n < 0)
 299                 return log_debug_errno(n, "Failed to determine CPUs in affinity mask: %m");
 300
 301         p = c->parameter;
 302         order = parse_order(&p);
 303         if (order < 0)
 304                 order = ORDER_GREATER_OR_EQUAL; /* default to >= check, if nothing is specified. */
 305
 306         r = safe_atou(p, &k);
 307         if (r < 0)
 308                 return log_debug_errno(r, "Failed to parse number of CPUs: %m");
 309
 310         return test_order(CMP((unsigned) n, k), order);
 311 }
 312
 313 static int condition_test_user(Condition *c, char **env) {
 314         uid_t id;
 315         int r;
 316         _cleanup_free_ char *username = NULL;
 317         const char *u;
 318
 319         assert(c);
 320         assert(c->parameter);
 321         assert(c->type == CONDITION_USER);
 322
 323         r = parse_uid(c->parameter, &id);
 324         if (r >= 0)
 325                 return id == getuid() || id == geteuid();
 326
 327         if (streq("@system", c->parameter))
 328                 return uid_is_system(getuid()) || uid_is_system(geteuid());
 329
 330         username = getusername_malloc();
 331         if (!username)
 332                 return -ENOMEM;
 333
 334         if (streq(username, c->parameter))
 335                 return 1;
 336
 337         if (getpid_cached() == 1)
 338                 return streq(c->parameter, "root");
 339
 340         u = c->parameter;
 341         r = get_user_creds(&u, &id, NULL, NULL, NULL, USER_CREDS_ALLOW_MISSING);
 342         if (r < 0)
 343                 return 0;
 344
 345         return id == getuid() || id == geteuid();
 346 }
 347
 348 static int condition_test_control_group_controller(Condition *c, char **env) {
 349         int r;
 350         CGroupMask system_mask, wanted_mask = 0;
 351
 352         assert(c);
 353         assert(c->parameter);
 354         assert(c->type == CONDITION_CONTROL_GROUP_CONTROLLER);
 355
 356         r = cg_mask_supported(&system_mask);
 357         if (r < 0)
 358                 return log_debug_errno(r, "Failed to determine supported controllers: %m");
 359
 360         r = cg_mask_from_string(c->parameter, &wanted_mask);
 361         if (r < 0 || wanted_mask <= 0) {
 362                 /* This won't catch the case that we have an unknown controller
 363                  * mixed in with valid ones -- these are only assessed on the
 364                  * validity of the valid controllers found. */
 365                 log_debug("Failed to parse cgroup string: %s", c->parameter);
 366                 return 1;
 367         }
 368
 369         return FLAGS_SET(system_mask, wanted_mask);
 370 }
 371
 372 static int condition_test_group(Condition *c, char **env) {
 373         gid_t id;
 374         int r;
 375
 376         assert(c);
 377         assert(c->parameter);
 378         assert(c->type == CONDITION_GROUP);
 379
 380         r = parse_gid(c->parameter, &id);
 381         if (r >= 0)
 382                 return in_gid(id);
 383
 384         /* Avoid any NSS lookups if we are PID1 */
 385         if (getpid_cached() == 1)
 386                 return streq(c->parameter, "root");
 387
 388         return in_group(c->parameter) > 0;
 389 }
 390
 391 static int condition_test_virtualization(Condition *c, char **env) {
 392         int b, v;
 393
 394         assert(c);
 395         assert(c->parameter);
 396         assert(c->type == CONDITION_VIRTUALIZATION);
 397
 398         if (streq(c->parameter, "private-users"))
 399                 return running_in_userns();
 400
 401         v = detect_virtualization();
 402         if (v < 0)
 403                 return v;
 404
 405         /* First, compare with yes/no */
 406         b = parse_boolean(c->parameter);
 407         if (b >= 0)
 408                 return b == !!v;
 409
 410         /* Then, compare categorization */
 411         if (streq(c->parameter, "vm"))
 412                 return VIRTUALIZATION_IS_VM(v);
 413
 414         if (streq(c->parameter, "container"))
 415                 return VIRTUALIZATION_IS_CONTAINER(v);
 416
 417         /* Finally compare id */
 418         return v != VIRTUALIZATION_NONE && streq(c->parameter, virtualization_to_string(v));
 419 }
 420
 421 static int condition_test_architecture(Condition *c, char **env) {
 422         int a, b;
 423
 424         assert(c);
 425         assert(c->parameter);
 426         assert(c->type == CONDITION_ARCHITECTURE);
 427
 428         a = uname_architecture();
 429         if (a < 0)
 430                 return a;
 431
 432         if (streq(c->parameter, "native"))
 433                 b = native_architecture();
 434         else {
 435                 b = architecture_from_string(c->parameter);
 436                 if (b < 0) /* unknown architecture? Then it's definitely not ours */
 437                         return false;
 438         }
 439
 440         return a == b;
 441 }
 442
 443 static int condition_test_host(Condition *c, char **env) {
 444         _cleanup_free_ char *h = NULL;
 445         sd_id128_t x, y;
 446         int r;
 447
 448         assert(c);
 449         assert(c->parameter);
 450         assert(c->type == CONDITION_HOST);
 451
 452         if (sd_id128_from_string(c->parameter, &x) >= 0) {
 453
 454                 r = sd_id128_get_machine(&y);
 455                 if (r < 0)
 456                         return r;
 457
 458                 return sd_id128_equal(x, y);
 459         }
 460
 461         h = gethostname_malloc();
 462         if (!h)
 463                 return -ENOMEM;
 464
 465         return fnmatch(c->parameter, h, FNM_CASEFOLD) == 0;
 466 }
 467
 468 static int condition_test_ac_power(Condition *c, char **env) {
 469         int r;
 470
 471         assert(c);
 472         assert(c->parameter);
 473         assert(c->type == CONDITION_AC_POWER);
 474
 475         r = parse_boolean(c->parameter);
 476         if (r < 0)
 477                 return r;
 478
 479         return (on_ac_power() != 0) == !!r;
 480 }
 481
 482 static int condition_test_security(Condition *c, char **env) {
 483         assert(c);
 484         assert(c->parameter);
 485         assert(c->type == CONDITION_SECURITY);
 486
 487         if (streq(c->parameter, "selinux"))
 488                 return mac_selinux_use();
 489         if (streq(c->parameter, "smack"))
 490                 return mac_smack_use();
 491         if (streq(c->parameter, "apparmor"))
 492                 return mac_apparmor_use();
 493         if (streq(c->parameter, "audit"))
 494                 return use_audit();
 495         if (streq(c->parameter, "ima"))
 496                 return use_ima();
 497         if (streq(c->parameter, "tomoyo"))
 498                 return mac_tomoyo_use();
 499         if (streq(c->parameter, "uefi-secureboot"))
 500                 return is_efi_secure_boot();
 501
 502         return false;
 503 }
 504
 505 static int condition_test_capability(Condition *c, char **env) {
 506         unsigned long long capabilities = (unsigned long long) -1;
 507         _cleanup_fclose_ FILE *f = NULL;
 508         int value, r;
 509
 510         assert(c);
 511         assert(c->parameter);
 512         assert(c->type == CONDITION_CAPABILITY);
 513
 514         /* If it's an invalid capability, we don't have it */
 515         value = capability_from_name(c->parameter);
 516         if (value < 0)
 517                 return -EINVAL;
 518
 519         /* If it's a valid capability we default to assume
 520          * that we have it */
 521
 522         f = fopen("/proc/self/status", "re");
 523         if (!f)
 524                 return -errno;
 525
 526         for (;;) {
 527                 _cleanup_free_ char *line = NULL;
 528                 const char *p;
 529
 530                 r = read_line(f, LONG_LINE_MAX, &line);
 531                 if (r < 0)
 532                         return r;
 533                 if (r == 0)
 534                         break;
 535
 536                 p = startswith(line, "CapBnd:");
 537                 if (p) {
 538                         if (sscanf(line+7, "%llx", &capabilities) != 1)
 539                                 return -EIO;
 540
 541                         break;
 542                 }
 543         }
 544
 545         return !!(capabilities & (1ULL << value));
 546 }
 547
 548 static int condition_test_needs_update(Condition *c, char **env) {
 549         const char *p;
 550         struct stat usr, other;
 551
 552         assert(c);
 553         assert(c->parameter);
 554         assert(c->type == CONDITION_NEEDS_UPDATE);
 555
 556         /* If the file system is read-only we shouldn't suggest an update */
 557         if (path_is_read_only_fs(c->parameter) > 0)
 558                 return false;
 559
 560         /* Any other failure means we should allow the condition to be true,
 561          * so that we rather invoke too many update tools than too
 562          * few. */
 563
 564         if (!path_is_absolute(c->parameter))
 565                 return true;
 566
 567         p = strjoina(c->parameter, "/.updated");
 568         if (lstat(p, &other) < 0)
 569                 return true;
 570
 571         if (lstat("/usr/", &usr) < 0)
 572                 return true;
 573
 574         /*
 575          * First, compare seconds as they are always accurate...
 576          */
 577         if (usr.st_mtim.tv_sec != other.st_mtim.tv_sec)
 578                 return usr.st_mtim.tv_sec > other.st_mtim.tv_sec;
 579
 580         /*
 581          * ...then compare nanoseconds.
 582          *
 583          * A false positive is only possible when /usr's nanoseconds > 0
 584          * (otherwise /usr cannot be strictly newer than the target file)
 585          * AND the target file's nanoseconds == 0
 586          * (otherwise the filesystem supports nsec timestamps, see stat(2)).
 587          */
 588         if (usr.st_mtim.tv_nsec > 0 && other.st_mtim.tv_nsec == 0) {
 589                 _cleanup_free_ char *timestamp_str = NULL;
 590                 uint64_t timestamp;
 591                 int r;
 592
 593                 r = parse_env_file(NULL, p, "TIMESTAMP_NSEC", &timestamp_str);
 594                 if (r < 0) {
 595                         log_error_errno(r, "Failed to parse timestamp file '%s', using mtime: %m", p);
 596                         return true;
 597                 } else if (r == 0) {
 598                         log_debug("No data in timestamp file '%s', using mtime", p);
 599                         return true;
 600                 }
 601
 602                 r = safe_atou64(timestamp_str, &timestamp);
 603                 if (r < 0) {
 604                         log_error_errno(r, "Failed to parse timestamp value '%s' in file '%s', using mtime: %m", timestamp_str, p);
 605                         return true;
 606                 }
 607
 608                 timespec_store(&other.st_mtim, timestamp);
 609         }
 610
 611         return usr.st_mtim.tv_nsec > other.st_mtim.tv_nsec;
 612 }
 613
 614 static int condition_test_first_boot(Condition *c, char **env) {
 615         int r;
 616
 617         assert(c);
 618         assert(c->parameter);
 619         assert(c->type == CONDITION_FIRST_BOOT);
 620
 621         r = parse_boolean(c->parameter);
 622         if (r < 0)
 623                 return r;
 624
 625         return (access("/run/systemd/first-boot", F_OK) >= 0) == !!r;
 626 }
 627
 628 static int condition_test_environment(Condition *c, char **env) {
 629         bool equal;
 630         char **i;
 631
 632         assert(c);
 633         assert(c->parameter);
 634         assert(c->type == CONDITION_ENVIRONMENT);
 635
 636         equal = strchr(c->parameter, '=');
 637
 638         STRV_FOREACH(i, env) {
 639                 bool found;
 640
 641                 if (equal)
 642                         found = streq(c->parameter, *i);
 643                 else {
 644                         const char *f;
 645
 646                         f = startswith(*i, c->parameter);
 647                         found = f && IN_SET(*f, 0, '=');
 648                 }
 649
 650                 if (found)
 651                         return true;
 652         }
 653
 654         return false;
 655 }
 656
 657 static int condition_test_path_exists(Condition *c, char **env) {
 658         assert(c);
 659         assert(c->parameter);
 660         assert(c->type == CONDITION_PATH_EXISTS);
 661
 662         return access(c->parameter, F_OK) >= 0;
 663 }
 664
 665 static int condition_test_path_exists_glob(Condition *c, char **env) {
 666         assert(c);
 667         assert(c->parameter);
 668         assert(c->type == CONDITION_PATH_EXISTS_GLOB);
 669
 670         return glob_exists(c->parameter) > 0;
 671 }
 672
 673 static int condition_test_path_is_directory(Condition *c, char **env) {
 674         assert(c);
 675         assert(c->parameter);
 676         assert(c->type == CONDITION_PATH_IS_DIRECTORY);
 677
 678         return is_dir(c->parameter, true) > 0;
 679 }
 680
 681 static int condition_test_path_is_symbolic_link(Condition *c, char **env) {
 682         assert(c);
 683         assert(c->parameter);
 684         assert(c->type == CONDITION_PATH_IS_SYMBOLIC_LINK);
 685
 686         return is_symlink(c->parameter) > 0;
 687 }
 688
 689 static int condition_test_path_is_mount_point(Condition *c, char **env) {
 690         assert(c);
 691         assert(c->parameter);
 692         assert(c->type == CONDITION_PATH_IS_MOUNT_POINT);
 693
 694         return path_is_mount_point(c->parameter, NULL, AT_SYMLINK_FOLLOW) > 0;
 695 }
 696
 697 static int condition_test_path_is_read_write(Condition *c, char **env) {
 698         assert(c);
 699         assert(c->parameter);
 700         assert(c->type == CONDITION_PATH_IS_READ_WRITE);
 701
 702         return path_is_read_only_fs(c->parameter) <= 0;
 703 }
 704
 705 static int condition_test_path_is_encrypted(Condition *c, char **env) {
 706         int r;
 707
 708         assert(c);
 709         assert(c->parameter);
 710         assert(c->type == CONDITION_PATH_IS_ENCRYPTED);
 711
 712         r = path_is_encrypted(c->parameter);
 713         if (r < 0 && r != -ENOENT)
 714                 log_debug_errno(r, "Failed to determine if '%s' is encrypted: %m", c->parameter);
 715
 716         return r > 0;
 717 }
 718
 719 static int condition_test_directory_not_empty(Condition *c, char **env) {
 720         int r;
 721
 722         assert(c);
 723         assert(c->parameter);
 724         assert(c->type == CONDITION_DIRECTORY_NOT_EMPTY);
 725
 726         r = dir_is_empty(c->parameter);
 727         return r <= 0 && r != -ENOENT;
 728 }
 729
 730 static int condition_test_file_not_empty(Condition *c, char **env) {
 731         struct stat st;
 732
 733         assert(c);
 734         assert(c->parameter);
 735         assert(c->type == CONDITION_FILE_NOT_EMPTY);
 736
 737         return (stat(c->parameter, &st) >= 0 &&
 738                 S_ISREG(st.st_mode) &&
 739                 st.st_size > 0);
 740 }
 741
 742 static int condition_test_file_is_executable(Condition *c, char **env) {
 743         struct stat st;
 744
 745         assert(c);
 746         assert(c->parameter);
 747         assert(c->type == CONDITION_FILE_IS_EXECUTABLE);
 748
 749         return (stat(c->parameter, &st) >= 0 &&
 750                 S_ISREG(st.st_mode) &&
 751                 (st.st_mode & 0111));
 752 }
 753
 754 static int condition_test_null(Condition *c, char **env) {
 755         assert(c);
 756         assert(c->type == CONDITION_NULL);
 757
 758         /* Note that during parsing we already evaluate the string and
 759          * store it in c->negate */
 760         return true;
 761 }
 762
 763 int condition_test(Condition *c, char **env) {
 764
 765         static int (*const condition_tests[_CONDITION_TYPE_MAX])(Condition *c, char **env) = {
 766                 [CONDITION_PATH_EXISTS]              = condition_test_path_exists,
 767                 [CONDITION_PATH_EXISTS_GLOB]         = condition_test_path_exists_glob,
 768                 [CONDITION_PATH_IS_DIRECTORY]        = condition_test_path_is_directory,
 769                 [CONDITION_PATH_IS_SYMBOLIC_LINK]    = condition_test_path_is_symbolic_link,
 770                 [CONDITION_PATH_IS_MOUNT_POINT]      = condition_test_path_is_mount_point,
 771                 [CONDITION_PATH_IS_READ_WRITE]       = condition_test_path_is_read_write,
 772                 [CONDITION_PATH_IS_ENCRYPTED]        = condition_test_path_is_encrypted,
 773                 [CONDITION_DIRECTORY_NOT_EMPTY]      = condition_test_directory_not_empty,
 774                 [CONDITION_FILE_NOT_EMPTY]           = condition_test_file_not_empty,
 775                 [CONDITION_FILE_IS_EXECUTABLE]       = condition_test_file_is_executable,
 776                 [CONDITION_KERNEL_COMMAND_LINE]      = condition_test_kernel_command_line,
 777                 [CONDITION_KERNEL_VERSION]           = condition_test_kernel_version,
 778                 [CONDITION_VIRTUALIZATION]           = condition_test_virtualization,
 779                 [CONDITION_SECURITY]                 = condition_test_security,
 780                 [CONDITION_CAPABILITY]               = condition_test_capability,
 781                 [CONDITION_HOST]                     = condition_test_host,
 782                 [CONDITION_AC_POWER]                 = condition_test_ac_power,
 783                 [CONDITION_ARCHITECTURE]             = condition_test_architecture,
 784                 [CONDITION_NEEDS_UPDATE]             = condition_test_needs_update,
 785                 [CONDITION_FIRST_BOOT]               = condition_test_first_boot,
 786                 [CONDITION_USER]                     = condition_test_user,
 787                 [CONDITION_GROUP]                    = condition_test_group,
 788                 [CONDITION_CONTROL_GROUP_CONTROLLER] = condition_test_control_group_controller,
 789                 [CONDITION_NULL]                     = condition_test_null,
 790                 [CONDITION_CPUS]                     = condition_test_cpus,
 791                 [CONDITION_MEMORY]                   = condition_test_memory,
 792                 [CONDITION_ENVIRONMENT]              = condition_test_environment,
 793         };
 794
 795         int r, b;
 796
 797         assert(c);
 798         assert(c->type >= 0);
 799         assert(c->type < _CONDITION_TYPE_MAX);
 800
 801         r = condition_tests[c->type](c, env);
 802         if (r < 0) {
 803                 c->result = CONDITION_ERROR;
 804                 return r;
 805         }
 806
 807         b = (r > 0) == !c->negate;
 808         c->result = b ? CONDITION_SUCCEEDED : CONDITION_FAILED;
 809         return b;
 810 }
 811
 812 bool condition_test_list(
 813                 Condition *first,
 814                 char **env,
 815                 condition_to_string_t to_string,
 816                 condition_test_logger_t logger,
 817                 void *userdata) {
 818
 819         Condition *c;
 820         int triggered = -1;
 821
 822         assert(!!logger == !!to_string);
 823
 824         /* If the condition list is empty, then it is true */
 825         if (!first)
 826                 return true;
 827
 828         /* Otherwise, if all of the non-trigger conditions apply and
 829          * if any of the trigger conditions apply (unless there are
 830          * none) we return true */
 831         LIST_FOREACH(conditions, c, first) {
 832                 int r;
 833
 834                 r = condition_test(c, env);
 835
 836                 if (logger) {
 837                         const char *p = c->type == CONDITION_NULL ? "true" : c->parameter;
 838                         assert(p);
 839
 840                         if (r < 0)
 841                                 logger(userdata, LOG_WARNING, r, PROJECT_FILE, __LINE__, __func__,
 842                                        "Couldn't determine result for %s=%s%s%s, assuming failed: %m",
 843                                        to_string(c->type),
 844                                        c->trigger ? "|" : "",
 845                                        c->negate ? "!" : "",
 846                                        p);
 847                         else
 848                                 logger(userdata, LOG_DEBUG, 0, PROJECT_FILE, __LINE__, __func__,
 849                                        "%s=%s%s%s %s.",
 850                                        to_string(c->type),
 851                                        c->trigger ? "|" : "",
 852                                        c->negate ? "!" : "",
 853                                        p,
 854                                        condition_result_to_string(c->result));
 855                 }
 856
 857                 if (!c->trigger && r <= 0)
 858                         return false;
 859
 860                 if (c->trigger && triggered <= 0)
 861                         triggered = r > 0;
 862         }
 863
 864         return triggered != 0;
 865 }
 866
 867 void condition_dump(Condition *c, FILE *f, const char *prefix, condition_to_string_t to_string) {
 868         assert(c);
 869         assert(f);
 870         assert(to_string);
 871
 872         prefix = strempty(prefix);
 873
 874         fprintf(f,
 875                 "%s\t%s: %s%s%s %s\n",
 876                 prefix,
 877                 to_string(c->type),
 878                 c->trigger ? "|" : "",
 879                 c->negate ? "!" : "",
 880                 c->parameter,
 881                 condition_result_to_string(c->result));
 882 }
 883
 884 void condition_dump_list(Condition *first, FILE *f, const char *prefix, condition_to_string_t to_string) {
 885         Condition *c;
 886
 887         LIST_FOREACH(conditions, c, first)
 888                 condition_dump(c, f, prefix, to_string);
 889 }
 890
 891 static const char* const condition_type_table[_CONDITION_TYPE_MAX] = {
 892         [CONDITION_ARCHITECTURE] = "ConditionArchitecture",
 893         [CONDITION_VIRTUALIZATION] = "ConditionVirtualization",
 894         [CONDITION_HOST] = "ConditionHost",
 895         [CONDITION_KERNEL_COMMAND_LINE] = "ConditionKernelCommandLine",
 896         [CONDITION_KERNEL_VERSION] = "ConditionKernelVersion",
 897         [CONDITION_SECURITY] = "ConditionSecurity",
 898         [CONDITION_CAPABILITY] = "ConditionCapability",
 899         [CONDITION_AC_POWER] = "ConditionACPower",
 900         [CONDITION_NEEDS_UPDATE] = "ConditionNeedsUpdate",
 901         [CONDITION_FIRST_BOOT] = "ConditionFirstBoot",
 902         [CONDITION_PATH_EXISTS] = "ConditionPathExists",
 903         [CONDITION_PATH_EXISTS_GLOB] = "ConditionPathExistsGlob",
 904         [CONDITION_PATH_IS_DIRECTORY] = "ConditionPathIsDirectory",
 905         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "ConditionPathIsSymbolicLink",
 906         [CONDITION_PATH_IS_MOUNT_POINT] = "ConditionPathIsMountPoint",
 907         [CONDITION_PATH_IS_READ_WRITE] = "ConditionPathIsReadWrite",
 908         [CONDITION_PATH_IS_ENCRYPTED] = "ConditionPathIsEncrypted",
 909         [CONDITION_DIRECTORY_NOT_EMPTY] = "ConditionDirectoryNotEmpty",
 910         [CONDITION_FILE_NOT_EMPTY] = "ConditionFileNotEmpty",
 911         [CONDITION_FILE_IS_EXECUTABLE] = "ConditionFileIsExecutable",
 912         [CONDITION_USER] = "ConditionUser",
 913         [CONDITION_GROUP] = "ConditionGroup",
 914         [CONDITION_CONTROL_GROUP_CONTROLLER] = "ConditionControlGroupController",
 915         [CONDITION_NULL] = "ConditionNull",
 916         [CONDITION_CPUS] = "ConditionCPUs",
 917         [CONDITION_MEMORY] = "ConditionMemory",
 918         [CONDITION_ENVIRONMENT] = "ConditionEnvironment",
 919 };
 920
 921 DEFINE_STRING_TABLE_LOOKUP(condition_type, ConditionType);
 922
 923 static const char* const assert_type_table[_CONDITION_TYPE_MAX] = {
 924         [CONDITION_ARCHITECTURE] = "AssertArchitecture",
 925         [CONDITION_VIRTUALIZATION] = "AssertVirtualization",
 926         [CONDITION_HOST] = "AssertHost",
 927         [CONDITION_KERNEL_COMMAND_LINE] = "AssertKernelCommandLine",
 928         [CONDITION_KERNEL_VERSION] = "AssertKernelVersion",
 929         [CONDITION_SECURITY] = "AssertSecurity",
 930         [CONDITION_CAPABILITY] = "AssertCapability",
 931         [CONDITION_AC_POWER] = "AssertACPower",
 932         [CONDITION_NEEDS_UPDATE] = "AssertNeedsUpdate",
 933         [CONDITION_FIRST_BOOT] = "AssertFirstBoot",
 934         [CONDITION_PATH_EXISTS] = "AssertPathExists",
 935         [CONDITION_PATH_EXISTS_GLOB] = "AssertPathExistsGlob",
 936         [CONDITION_PATH_IS_DIRECTORY] = "AssertPathIsDirectory",
 937         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "AssertPathIsSymbolicLink",
 938         [CONDITION_PATH_IS_MOUNT_POINT] = "AssertPathIsMountPoint",
 939         [CONDITION_PATH_IS_READ_WRITE] = "AssertPathIsReadWrite",
 940         [CONDITION_PATH_IS_ENCRYPTED] = "AssertPathIsEncrypted",
 941         [CONDITION_DIRECTORY_NOT_EMPTY] = "AssertDirectoryNotEmpty",
 942         [CONDITION_FILE_NOT_EMPTY] = "AssertFileNotEmpty",
 943         [CONDITION_FILE_IS_EXECUTABLE] = "AssertFileIsExecutable",
 944         [CONDITION_USER] = "AssertUser",
 945         [CONDITION_GROUP] = "AssertGroup",
 946         [CONDITION_CONTROL_GROUP_CONTROLLER] = "AssertControlGroupController",
 947         [CONDITION_NULL] = "AssertNull",
 948         [CONDITION_CPUS] = "AssertCPUs",
 949         [CONDITION_MEMORY] = "AssertMemory",
 950         [CONDITION_ENVIRONMENT] = "AssertEnvironment",
 951 };
 952
 953 DEFINE_STRING_TABLE_LOOKUP(assert_type, ConditionType);
 954
 955 static const char* const condition_result_table[_CONDITION_RESULT_MAX] = {
 956         [CONDITION_UNTESTED] = "untested",
 957         [CONDITION_SUCCEEDED] = "succeeded",
 958         [CONDITION_FAILED] = "failed",
 959         [CONDITION_ERROR] = "error",
 960 };
 961
 962 DEFINE_STRING_TABLE_LOOKUP(condition_result, ConditionResult);