src/shared/condition.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2010 Lennart Poettering
   6 ***/
   7
   8 #include <errno.h>
   9 #include <fcntl.h>
  10 #include <fnmatch.h>
  11 #include <limits.h>
  12 #include <stdlib.h>
  13 #include <string.h>
  14 #include <sys/stat.h>
  15 #include <sys/types.h>
  16 #include <sys/utsname.h>
  17 #include <time.h>
  18 #include <unistd.h>
  19
  20 #include "sd-id128.h"
  21
  22 #include "alloc-util.h"
  23 #include "apparmor-util.h"
  24 #include "architecture.h"
  25 #include "audit-util.h"
  26 #include "cap-list.h"
  27 #include "cgroup-util.h"
  28 #include "condition.h"
  29 #include "extract-word.h"
  30 #include "fd-util.h"
  31 #include "fileio.h"
  32 #include "glob-util.h"
  33 #include "hostname-util.h"
  34 #include "ima-util.h"
  35 #include "list.h"
  36 #include "macro.h"
  37 #include "mount-util.h"
  38 #include "parse-util.h"
  39 #include "path-util.h"
  40 #include "proc-cmdline.h"
  41 #include "process-util.h"
  42 #include "selinux-util.h"
  43 #include "smack-util.h"
  44 #include "stat-util.h"
  45 #include "string-table.h"
  46 #include "string-util.h"
  47 #include "tomoyo-util.h"
  48 #include "user-util.h"
  49 #include "util.h"
  50 #include "virt.h"
  51
  52 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
  53         Condition *c;
  54         int r;
  55
  56         assert(type >= 0);
  57         assert(type < _CONDITION_TYPE_MAX);
  58         assert((!parameter) == (type == CONDITION_NULL));
  59
  60         c = new0(Condition, 1);
  61         if (!c)
  62                 return NULL;
  63
  64         c->type = type;
  65         c->trigger = trigger;
  66         c->negate = negate;
  67
  68         r = free_and_strdup(&c->parameter, parameter);
  69         if (r < 0) {
  70                 return mfree(c);
  71         }
  72
  73         return c;
  74 }
  75
  76 void condition_free(Condition *c) {
  77         assert(c);
  78
  79         free(c->parameter);
  80         free(c);
  81 }
  82
  83 Condition* condition_free_list(Condition *first) {
  84         Condition *c, *n;
  85
  86         LIST_FOREACH_SAFE(conditions, c, n, first)
  87                 condition_free(c);
  88
  89         return NULL;
  90 }
  91
  92 static int condition_test_kernel_command_line(Condition *c) {
  93         _cleanup_free_ char *line = NULL;
  94         const char *p;
  95         bool equal;
  96         int r;
  97
  98         assert(c);
  99         assert(c->parameter);
 100         assert(c->type == CONDITION_KERNEL_COMMAND_LINE);
 101
 102         r = proc_cmdline(&line);
 103         if (r < 0)
 104                 return r;
 105
 106         equal = strchr(c->parameter, '=');
 107
 108         for (p = line;;) {
 109                 _cleanup_free_ char *word = NULL;
 110                 bool found;
 111
 112                 r = extract_first_word(&p, &word, NULL, EXTRACT_QUOTES|EXTRACT_RELAX);
 113                 if (r < 0)
 114                         return r;
 115                 if (r == 0)
 116                         break;
 117
 118                 if (equal)
 119                         found = streq(word, c->parameter);
 120                 else {
 121                         const char *f;
 122
 123                         f = startswith(word, c->parameter);
 124                         found = f && IN_SET(*f, 0, '=');
 125                 }
 126
 127                 if (found)
 128                         return true;
 129         }
 130
 131         return false;
 132 }
 133
 134 static int condition_test_kernel_version(Condition *c) {
 135         enum {
 136                 /* Listed in order of checking. Note that some comparators are prefixes of others, hence the longest
 137                  * should be listed first. */
 138                 LOWER_OR_EQUAL,
 139                 GREATER_OR_EQUAL,
 140                 LOWER,
 141                 GREATER,
 142                 EQUAL,
 143                 _ORDER_MAX,
 144         };
 145
 146         static const char *const prefix[_ORDER_MAX] = {
 147                 [LOWER_OR_EQUAL] = "<=",
 148                 [GREATER_OR_EQUAL] = ">=",
 149                 [LOWER] = "<",
 150                 [GREATER] = ">",
 151                 [EQUAL] = "=",
 152         };
 153         const char *p = NULL;
 154         struct utsname u;
 155         size_t i;
 156         int k;
 157
 158         assert(c);
 159         assert(c->parameter);
 160         assert(c->type == CONDITION_KERNEL_VERSION);
 161
 162         assert_se(uname(&u) >= 0);
 163
 164         for (i = 0; i < _ORDER_MAX; i++) {
 165                 p = startswith(c->parameter, prefix[i]);
 166                 if (p)
 167                         break;
 168         }
 169
 170         /* No prefix? Then treat as glob string */
 171         if (!p)
 172                 return fnmatch(skip_leading_chars(c->parameter, NULL), u.release, 0) == 0;
 173
 174         k = str_verscmp(u.release, skip_leading_chars(p, NULL));
 175
 176         switch (i) {
 177
 178         case LOWER:
 179                 return k < 0;
 180
 181         case LOWER_OR_EQUAL:
 182                 return k <= 0;
 183
 184         case EQUAL:
 185                 return k == 0;
 186
 187         case GREATER_OR_EQUAL:
 188                 return k >= 0;
 189
 190         case GREATER:
 191                 return k > 0;
 192
 193         default:
 194                 assert_not_reached("Can't compare");
 195         }
 196 }
 197
 198 static int condition_test_user(Condition *c) {
 199         uid_t id;
 200         int r;
 201         _cleanup_free_ char *username = NULL;
 202         const char *u;
 203
 204         assert(c);
 205         assert(c->parameter);
 206         assert(c->type == CONDITION_USER);
 207
 208         r = parse_uid(c->parameter, &id);
 209         if (r >= 0)
 210                 return id == getuid() || id == geteuid();
 211
 212         if (streq("@system", c->parameter))
 213                 return uid_is_system(getuid()) || uid_is_system(geteuid());
 214
 215         username = getusername_malloc();
 216         if (!username)
 217                 return -ENOMEM;
 218
 219         if (streq(username, c->parameter))
 220                 return 1;
 221
 222         if (getpid_cached() == 1)
 223                 return streq(c->parameter, "root");
 224
 225         u = c->parameter;
 226         r = get_user_creds(&u, &id, NULL, NULL, NULL);
 227         if (r < 0)
 228                 return 0;
 229
 230         return id == getuid() || id == geteuid();
 231 }
 232
 233 static int condition_test_control_group_controller(Condition *c) {
 234         int r;
 235         CGroupMask system_mask, wanted_mask = 0;
 236
 237         assert(c);
 238         assert(c->parameter);
 239         assert(c->type == CONDITION_CONTROL_GROUP_CONTROLLER);
 240
 241         r = cg_mask_supported(&system_mask);
 242         if (r < 0)
 243                 return log_debug_errno(r, "Failed to determine supported controllers: %m");
 244
 245         r = cg_mask_from_string(c->parameter, &wanted_mask);
 246         if (r < 0 || wanted_mask <= 0) {
 247                 /* This won't catch the case that we have an unknown controller
 248                  * mixed in with valid ones -- these are only assessed on the
 249                  * validity of the valid controllers found. */
 250                 log_debug("Failed to parse cgroup string: %s", c->parameter);
 251                 return 1;
 252         }
 253
 254         return FLAGS_SET(system_mask, wanted_mask);
 255 }
 256
 257 static int condition_test_group(Condition *c) {
 258         gid_t id;
 259         int r;
 260
 261         assert(c);
 262         assert(c->parameter);
 263         assert(c->type == CONDITION_GROUP);
 264
 265         r = parse_gid(c->parameter, &id);
 266         if (r >= 0)
 267                 return in_gid(id);
 268
 269         /* Avoid any NSS lookups if we are PID1 */
 270         if (getpid_cached() == 1)
 271                 return streq(c->parameter, "root");
 272
 273         return in_group(c->parameter) > 0;
 274 }
 275
 276 static int condition_test_virtualization(Condition *c) {
 277         int b, v;
 278
 279         assert(c);
 280         assert(c->parameter);
 281         assert(c->type == CONDITION_VIRTUALIZATION);
 282
 283         if (streq(c->parameter, "private-users"))
 284                 return running_in_userns();
 285
 286         v = detect_virtualization();
 287         if (v < 0)
 288                 return v;
 289
 290         /* First, compare with yes/no */
 291         b = parse_boolean(c->parameter);
 292         if (b >= 0)
 293                 return b == !!v;
 294
 295         /* Then, compare categorization */
 296         if (streq(c->parameter, "vm"))
 297                 return VIRTUALIZATION_IS_VM(v);
 298
 299         if (streq(c->parameter, "container"))
 300                 return VIRTUALIZATION_IS_CONTAINER(v);
 301
 302         /* Finally compare id */
 303         return v != VIRTUALIZATION_NONE && streq(c->parameter, virtualization_to_string(v));
 304 }
 305
 306 static int condition_test_architecture(Condition *c) {
 307         int a, b;
 308
 309         assert(c);
 310         assert(c->parameter);
 311         assert(c->type == CONDITION_ARCHITECTURE);
 312
 313         a = uname_architecture();
 314         if (a < 0)
 315                 return a;
 316
 317         if (streq(c->parameter, "native"))
 318                 b = native_architecture();
 319         else {
 320                 b = architecture_from_string(c->parameter);
 321                 if (b < 0) /* unknown architecture? Then it's definitely not ours */
 322                         return false;
 323         }
 324
 325         return a == b;
 326 }
 327
 328 static int condition_test_host(Condition *c) {
 329         _cleanup_free_ char *h = NULL;
 330         sd_id128_t x, y;
 331         int r;
 332
 333         assert(c);
 334         assert(c->parameter);
 335         assert(c->type == CONDITION_HOST);
 336
 337         if (sd_id128_from_string(c->parameter, &x) >= 0) {
 338
 339                 r = sd_id128_get_machine(&y);
 340                 if (r < 0)
 341                         return r;
 342
 343                 return sd_id128_equal(x, y);
 344         }
 345
 346         h = gethostname_malloc();
 347         if (!h)
 348                 return -ENOMEM;
 349
 350         return fnmatch(c->parameter, h, FNM_CASEFOLD) == 0;
 351 }
 352
 353 static int condition_test_ac_power(Condition *c) {
 354         int r;
 355
 356         assert(c);
 357         assert(c->parameter);
 358         assert(c->type == CONDITION_AC_POWER);
 359
 360         r = parse_boolean(c->parameter);
 361         if (r < 0)
 362                 return r;
 363
 364         return (on_ac_power() != 0) == !!r;
 365 }
 366
 367 static int condition_test_security(Condition *c) {
 368         assert(c);
 369         assert(c->parameter);
 370         assert(c->type == CONDITION_SECURITY);
 371
 372         if (streq(c->parameter, "selinux"))
 373                 return mac_selinux_use();
 374         if (streq(c->parameter, "smack"))
 375                 return mac_smack_use();
 376         if (streq(c->parameter, "apparmor"))
 377                 return mac_apparmor_use();
 378         if (streq(c->parameter, "audit"))
 379                 return use_audit();
 380         if (streq(c->parameter, "ima"))
 381                 return use_ima();
 382         if (streq(c->parameter, "tomoyo"))
 383                 return mac_tomoyo_use();
 384
 385         return false;
 386 }
 387
 388 static int condition_test_capability(Condition *c) {
 389         _cleanup_fclose_ FILE *f = NULL;
 390         int value;
 391         char line[LINE_MAX];
 392         unsigned long long capabilities = -1;
 393
 394         assert(c);
 395         assert(c->parameter);
 396         assert(c->type == CONDITION_CAPABILITY);
 397
 398         /* If it's an invalid capability, we don't have it */
 399         value = capability_from_name(c->parameter);
 400         if (value < 0)
 401                 return -EINVAL;
 402
 403         /* If it's a valid capability we default to assume
 404          * that we have it */
 405
 406         f = fopen("/proc/self/status", "re");
 407         if (!f)
 408                 return -errno;
 409
 410         while (fgets(line, sizeof(line), f)) {
 411                 truncate_nl(line);
 412
 413                 if (startswith(line, "CapBnd:")) {
 414                         (void) sscanf(line+7, "%llx", &capabilities);
 415                         break;
 416                 }
 417         }
 418
 419         return !!(capabilities & (1ULL << value));
 420 }
 421
 422 static int condition_test_needs_update(Condition *c) {
 423         const char *p;
 424         struct stat usr, other;
 425
 426         assert(c);
 427         assert(c->parameter);
 428         assert(c->type == CONDITION_NEEDS_UPDATE);
 429
 430         /* If the file system is read-only we shouldn't suggest an update */
 431         if (path_is_read_only_fs(c->parameter) > 0)
 432                 return false;
 433
 434         /* Any other failure means we should allow the condition to be true,
 435          * so that we rather invoke too many update tools than too
 436          * few. */
 437
 438         if (!path_is_absolute(c->parameter))
 439                 return true;
 440
 441         p = strjoina(c->parameter, "/.updated");
 442         if (lstat(p, &other) < 0)
 443                 return true;
 444
 445         if (lstat("/usr/", &usr) < 0)
 446                 return true;
 447
 448         /*
 449          * First, compare seconds as they are always accurate...
 450          */
 451         if (usr.st_mtim.tv_sec != other.st_mtim.tv_sec)
 452                 return usr.st_mtim.tv_sec > other.st_mtim.tv_sec;
 453
 454         /*
 455          * ...then compare nanoseconds.
 456          *
 457          * A false positive is only possible when /usr's nanoseconds > 0
 458          * (otherwise /usr cannot be strictly newer than the target file)
 459          * AND the target file's nanoseconds == 0
 460          * (otherwise the filesystem supports nsec timestamps, see stat(2)).
 461          */
 462         if (usr.st_mtim.tv_nsec > 0 && other.st_mtim.tv_nsec == 0) {
 463                 _cleanup_free_ char *timestamp_str = NULL;
 464                 uint64_t timestamp;
 465                 int r;
 466
 467                 r = parse_env_file(NULL, p, NULL, "TIMESTAMP_NSEC", &timestamp_str, NULL);
 468                 if (r < 0) {
 469                         log_error_errno(r, "Failed to parse timestamp file '%s', using mtime: %m", p);
 470                         return true;
 471                 } else if (r == 0) {
 472                         log_debug("No data in timestamp file '%s', using mtime", p);
 473                         return true;
 474                 }
 475
 476                 r = safe_atou64(timestamp_str, &timestamp);
 477                 if (r < 0) {
 478                         log_error_errno(r, "Failed to parse timestamp value '%s' in file '%s', using mtime: %m", timestamp_str, p);
 479                         return true;
 480                 }
 481
 482                 timespec_store(&other.st_mtim, timestamp);
 483         }
 484
 485         return usr.st_mtim.tv_nsec > other.st_mtim.tv_nsec;
 486 }
 487
 488 static int condition_test_first_boot(Condition *c) {
 489         int r;
 490
 491         assert(c);
 492         assert(c->parameter);
 493         assert(c->type == CONDITION_FIRST_BOOT);
 494
 495         r = parse_boolean(c->parameter);
 496         if (r < 0)
 497                 return r;
 498
 499         return (access("/run/systemd/first-boot", F_OK) >= 0) == !!r;
 500 }
 501
 502 static int condition_test_path_exists(Condition *c) {
 503         assert(c);
 504         assert(c->parameter);
 505         assert(c->type == CONDITION_PATH_EXISTS);
 506
 507         return access(c->parameter, F_OK) >= 0;
 508 }
 509
 510 static int condition_test_path_exists_glob(Condition *c) {
 511         assert(c);
 512         assert(c->parameter);
 513         assert(c->type == CONDITION_PATH_EXISTS_GLOB);
 514
 515         return glob_exists(c->parameter) > 0;
 516 }
 517
 518 static int condition_test_path_is_directory(Condition *c) {
 519         assert(c);
 520         assert(c->parameter);
 521         assert(c->type == CONDITION_PATH_IS_DIRECTORY);
 522
 523         return is_dir(c->parameter, true) > 0;
 524 }
 525
 526 static int condition_test_path_is_symbolic_link(Condition *c) {
 527         assert(c);
 528         assert(c->parameter);
 529         assert(c->type == CONDITION_PATH_IS_SYMBOLIC_LINK);
 530
 531         return is_symlink(c->parameter) > 0;
 532 }
 533
 534 static int condition_test_path_is_mount_point(Condition *c) {
 535         assert(c);
 536         assert(c->parameter);
 537         assert(c->type == CONDITION_PATH_IS_MOUNT_POINT);
 538
 539         return path_is_mount_point(c->parameter, NULL, AT_SYMLINK_FOLLOW) > 0;
 540 }
 541
 542 static int condition_test_path_is_read_write(Condition *c) {
 543         assert(c);
 544         assert(c->parameter);
 545         assert(c->type == CONDITION_PATH_IS_READ_WRITE);
 546
 547         return path_is_read_only_fs(c->parameter) <= 0;
 548 }
 549
 550 static int condition_test_directory_not_empty(Condition *c) {
 551         int r;
 552
 553         assert(c);
 554         assert(c->parameter);
 555         assert(c->type == CONDITION_DIRECTORY_NOT_EMPTY);
 556
 557         r = dir_is_empty(c->parameter);
 558         return r <= 0 && r != -ENOENT;
 559 }
 560
 561 static int condition_test_file_not_empty(Condition *c) {
 562         struct stat st;
 563
 564         assert(c);
 565         assert(c->parameter);
 566         assert(c->type == CONDITION_FILE_NOT_EMPTY);
 567
 568         return (stat(c->parameter, &st) >= 0 &&
 569                 S_ISREG(st.st_mode) &&
 570                 st.st_size > 0);
 571 }
 572
 573 static int condition_test_file_is_executable(Condition *c) {
 574         struct stat st;
 575
 576         assert(c);
 577         assert(c->parameter);
 578         assert(c->type == CONDITION_FILE_IS_EXECUTABLE);
 579
 580         return (stat(c->parameter, &st) >= 0 &&
 581                 S_ISREG(st.st_mode) &&
 582                 (st.st_mode & 0111));
 583 }
 584
 585 static int condition_test_null(Condition *c) {
 586         assert(c);
 587         assert(c->type == CONDITION_NULL);
 588
 589         /* Note that during parsing we already evaluate the string and
 590          * store it in c->negate */
 591         return true;
 592 }
 593
 594 int condition_test(Condition *c) {
 595
 596         static int (*const condition_tests[_CONDITION_TYPE_MAX])(Condition *c) = {
 597                 [CONDITION_PATH_EXISTS] = condition_test_path_exists,
 598                 [CONDITION_PATH_EXISTS_GLOB] = condition_test_path_exists_glob,
 599                 [CONDITION_PATH_IS_DIRECTORY] = condition_test_path_is_directory,
 600                 [CONDITION_PATH_IS_SYMBOLIC_LINK] = condition_test_path_is_symbolic_link,
 601                 [CONDITION_PATH_IS_MOUNT_POINT] = condition_test_path_is_mount_point,
 602                 [CONDITION_PATH_IS_READ_WRITE] = condition_test_path_is_read_write,
 603                 [CONDITION_DIRECTORY_NOT_EMPTY] = condition_test_directory_not_empty,
 604                 [CONDITION_FILE_NOT_EMPTY] = condition_test_file_not_empty,
 605                 [CONDITION_FILE_IS_EXECUTABLE] = condition_test_file_is_executable,
 606                 [CONDITION_KERNEL_COMMAND_LINE] = condition_test_kernel_command_line,
 607                 [CONDITION_KERNEL_VERSION] = condition_test_kernel_version,
 608                 [CONDITION_VIRTUALIZATION] = condition_test_virtualization,
 609                 [CONDITION_SECURITY] = condition_test_security,
 610                 [CONDITION_CAPABILITY] = condition_test_capability,
 611                 [CONDITION_HOST] = condition_test_host,
 612                 [CONDITION_AC_POWER] = condition_test_ac_power,
 613                 [CONDITION_ARCHITECTURE] = condition_test_architecture,
 614                 [CONDITION_NEEDS_UPDATE] = condition_test_needs_update,
 615                 [CONDITION_FIRST_BOOT] = condition_test_first_boot,
 616                 [CONDITION_USER] = condition_test_user,
 617                 [CONDITION_GROUP] = condition_test_group,
 618                 [CONDITION_CONTROL_GROUP_CONTROLLER] = condition_test_control_group_controller,
 619                 [CONDITION_NULL] = condition_test_null,
 620         };
 621
 622         int r, b;
 623
 624         assert(c);
 625         assert(c->type >= 0);
 626         assert(c->type < _CONDITION_TYPE_MAX);
 627
 628         r = condition_tests[c->type](c);
 629         if (r < 0) {
 630                 c->result = CONDITION_ERROR;
 631                 return r;
 632         }
 633
 634         b = (r > 0) == !c->negate;
 635         c->result = b ? CONDITION_SUCCEEDED : CONDITION_FAILED;
 636         return b;
 637 }
 638
 639 void condition_dump(Condition *c, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 640         assert(c);
 641         assert(f);
 642
 643         prefix = strempty(prefix);
 644
 645         fprintf(f,
 646                 "%s\t%s: %s%s%s %s\n",
 647                 prefix,
 648                 to_string(c->type),
 649                 c->trigger ? "|" : "",
 650                 c->negate ? "!" : "",
 651                 c->parameter,
 652                 condition_result_to_string(c->result));
 653 }
 654
 655 void condition_dump_list(Condition *first, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 656         Condition *c;
 657
 658         LIST_FOREACH(conditions, c, first)
 659                 condition_dump(c, f, prefix, to_string);
 660 }
 661
 662 static const char* const condition_type_table[_CONDITION_TYPE_MAX] = {
 663         [CONDITION_ARCHITECTURE] = "ConditionArchitecture",
 664         [CONDITION_VIRTUALIZATION] = "ConditionVirtualization",
 665         [CONDITION_HOST] = "ConditionHost",
 666         [CONDITION_KERNEL_COMMAND_LINE] = "ConditionKernelCommandLine",
 667         [CONDITION_KERNEL_VERSION] = "ConditionKernelVersion",
 668         [CONDITION_SECURITY] = "ConditionSecurity",
 669         [CONDITION_CAPABILITY] = "ConditionCapability",
 670         [CONDITION_AC_POWER] = "ConditionACPower",
 671         [CONDITION_NEEDS_UPDATE] = "ConditionNeedsUpdate",
 672         [CONDITION_FIRST_BOOT] = "ConditionFirstBoot",
 673         [CONDITION_PATH_EXISTS] = "ConditionPathExists",
 674         [CONDITION_PATH_EXISTS_GLOB] = "ConditionPathExistsGlob",
 675         [CONDITION_PATH_IS_DIRECTORY] = "ConditionPathIsDirectory",
 676         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "ConditionPathIsSymbolicLink",
 677         [CONDITION_PATH_IS_MOUNT_POINT] = "ConditionPathIsMountPoint",
 678         [CONDITION_PATH_IS_READ_WRITE] = "ConditionPathIsReadWrite",
 679         [CONDITION_DIRECTORY_NOT_EMPTY] = "ConditionDirectoryNotEmpty",
 680         [CONDITION_FILE_NOT_EMPTY] = "ConditionFileNotEmpty",
 681         [CONDITION_FILE_IS_EXECUTABLE] = "ConditionFileIsExecutable",
 682         [CONDITION_USER] = "ConditionUser",
 683         [CONDITION_GROUP] = "ConditionGroup",
 684         [CONDITION_CONTROL_GROUP_CONTROLLER] = "ConditionControlGroupController",
 685         [CONDITION_NULL] = "ConditionNull"
 686 };
 687
 688 DEFINE_STRING_TABLE_LOOKUP(condition_type, ConditionType);
 689
 690 static const char* const assert_type_table[_CONDITION_TYPE_MAX] = {
 691         [CONDITION_ARCHITECTURE] = "AssertArchitecture",
 692         [CONDITION_VIRTUALIZATION] = "AssertVirtualization",
 693         [CONDITION_HOST] = "AssertHost",
 694         [CONDITION_KERNEL_COMMAND_LINE] = "AssertKernelCommandLine",
 695         [CONDITION_KERNEL_VERSION] = "AssertKernelVersion",
 696         [CONDITION_SECURITY] = "AssertSecurity",
 697         [CONDITION_CAPABILITY] = "AssertCapability",
 698         [CONDITION_AC_POWER] = "AssertACPower",
 699         [CONDITION_NEEDS_UPDATE] = "AssertNeedsUpdate",
 700         [CONDITION_FIRST_BOOT] = "AssertFirstBoot",
 701         [CONDITION_PATH_EXISTS] = "AssertPathExists",
 702         [CONDITION_PATH_EXISTS_GLOB] = "AssertPathExistsGlob",
 703         [CONDITION_PATH_IS_DIRECTORY] = "AssertPathIsDirectory",
 704         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "AssertPathIsSymbolicLink",
 705         [CONDITION_PATH_IS_MOUNT_POINT] = "AssertPathIsMountPoint",
 706         [CONDITION_PATH_IS_READ_WRITE] = "AssertPathIsReadWrite",
 707         [CONDITION_DIRECTORY_NOT_EMPTY] = "AssertDirectoryNotEmpty",
 708         [CONDITION_FILE_NOT_EMPTY] = "AssertFileNotEmpty",
 709         [CONDITION_FILE_IS_EXECUTABLE] = "AssertFileIsExecutable",
 710         [CONDITION_USER] = "AssertUser",
 711         [CONDITION_GROUP] = "AssertGroup",
 712         [CONDITION_CONTROL_GROUP_CONTROLLER] = "AssertControlGroupController",
 713         [CONDITION_NULL] = "AssertNull"
 714 };
 715
 716 DEFINE_STRING_TABLE_LOOKUP(assert_type, ConditionType);
 717
 718 static const char* const condition_result_table[_CONDITION_RESULT_MAX] = {
 719         [CONDITION_UNTESTED] = "untested",
 720         [CONDITION_SUCCEEDED] = "succeeded",
 721         [CONDITION_FAILED] = "failed",
 722         [CONDITION_ERROR] = "error",
 723 };
 724
 725 DEFINE_STRING_TABLE_LOOKUP(condition_result, ConditionResult);