]>
Commit | Line | Data |
---|---|---|
db9ecf05 | 1 | /* SPDX-License-Identifier: LGPL-2.1-or-later */ |
2265fbf7 | 2 | /*** |
96b2fb93 | 3 | Copyright © 2013 Simon Peeters |
2265fbf7 SP |
4 | ***/ |
5 | ||
2265fbf7 | 6 | #include <getopt.h> |
4bde8743 | 7 | #include <locale.h> |
3f6fd1ba LP |
8 | #include <stdio.h> |
9 | #include <stdlib.h> | |
2265fbf7 | 10 | |
048ecf5b | 11 | #include "sd-bus.h" |
4bde8743 | 12 | #include "sd-json.h" |
3f6fd1ba | 13 | |
b5efdb8a | 14 | #include "alloc-util.h" |
30bddc06 | 15 | #include "analyze.h" |
fb8cc599 | 16 | #include "analyze-architectures.h" |
113dd9cb | 17 | #include "analyze-blame.h" |
5229b03c | 18 | #include "analyze-calendar.h" |
6488e844 | 19 | #include "analyze-capability.h" |
c649b343 | 20 | #include "analyze-cat-config.h" |
8f114904 | 21 | #include "analyze-chid.h" |
5f43c97c | 22 | #include "analyze-compare-versions.h" |
edfea9fe | 23 | #include "analyze-condition.h" |
ef215fa7 | 24 | #include "analyze-critical-chain.h" |
cccd2af6 | 25 | #include "analyze-dot.h" |
25eb70af | 26 | #include "analyze-dump.h" |
73cb64c4 | 27 | #include "analyze-exit-status.h" |
5f43c97c | 28 | #include "analyze-fdstore.h" |
08e36480 | 29 | #include "analyze-filesystems.h" |
58e35960 | 30 | #include "analyze-has-tpm2.h" |
fb8cc599 | 31 | #include "analyze-image-policy.h" |
2acfc252 | 32 | #include "analyze-inspect-elf.h" |
faaa6ea0 | 33 | #include "analyze-log-control.h" |
f50535af | 34 | #include "analyze-malloc.h" |
f70c90f5 | 35 | #include "analyze-pcrs.h" |
ba474dad | 36 | #include "analyze-plot.h" |
ec16f3b6 | 37 | #include "analyze-security.h" |
2b04e72c | 38 | #include "analyze-service-watchdogs.h" |
8c5045f9 | 39 | #include "analyze-smbios11.h" |
d30693f3 | 40 | #include "analyze-srk.h" |
389638d3 | 41 | #include "analyze-syscall-filter.h" |
f24f8e37 | 42 | #include "analyze-time.h" |
30bddc06 | 43 | #include "analyze-timespan.h" |
503ccaaa | 44 | #include "analyze-timestamp.h" |
0c2d69df | 45 | #include "analyze-unit-files.h" |
36258fbe | 46 | #include "analyze-unit-paths.h" |
9a08000d | 47 | #include "analyze-unit-shell.h" |
3f6fd1ba | 48 | #include "analyze-verify.h" |
a839c4b7 | 49 | #include "analyze-verify-util.h" |
d6b4d1c7 | 50 | #include "build.h" |
048ecf5b | 51 | #include "bus-error.h" |
a839c4b7 | 52 | #include "bus-unit-util.h" |
4bde8743 | 53 | #include "bus-util.h" |
6d86f4bd | 54 | #include "calendarspec.h" |
4bde8743 | 55 | #include "dissect-image.h" |
8aa304d3 | 56 | #include "image-policy.h" |
3f6fd1ba | 57 | #include "log.h" |
4bde8743 | 58 | #include "loop-util.h" |
d665c7b2 | 59 | #include "main-func.h" |
e5ea5c3a | 60 | #include "mount-util.h" |
9ea9d4cf | 61 | #include "pager.h" |
599c7c54 | 62 | #include "parse-argument.h" |
6bedfcbb | 63 | #include "parse-util.h" |
854a42fb | 64 | #include "path-util.h" |
294bf0c3 | 65 | #include "pretty-print.h" |
4bde8743 | 66 | #include "runtime-scope.h" |
3cc3dc77 | 67 | #include "string-table.h" |
4bde8743 | 68 | #include "string-util.h" |
3f6fd1ba | 69 | #include "strv.h" |
760877e9 | 70 | #include "time-util.h" |
a839c4b7 | 71 | #include "unit-def.h" |
3f6fd1ba | 72 | #include "unit-name.h" |
a6bcef29 | 73 | #include "verbs.h" |
2265fbf7 | 74 | |
cccd2af6 | 75 | DotMode arg_dot = DEP_ALL; |
3e7a029c | 76 | CapabilityMode arg_capability = CAPABILITY_LITERAL; |
cccd2af6 | 77 | char **arg_dot_from_patterns = NULL, **arg_dot_to_patterns = NULL; |
ef215fa7 | 78 | usec_t arg_fuzz = 0; |
08e36480 | 79 | PagerFlags arg_pager_flags = 0; |
063c8382 | 80 | CatFlags arg_cat_flags = 0; |
25eb70af | 81 | BusTransport arg_transport = BUS_TRANSPORT_LOCAL; |
ba474dad | 82 | const char *arg_host = NULL; |
4870133b | 83 | RuntimeScope arg_runtime_scope = RUNTIME_SCOPE_SYSTEM; |
cae7c282 | 84 | RecursiveErrors arg_recursive_errors = _RECURSIVE_ERRORS_INVALID; |
57a22a3f LP |
85 | bool arg_man = true; |
86 | bool arg_generators = false; | |
6e4918a9 | 87 | const char *arg_instance = "test_instance"; |
1592d2f9 | 88 | double arg_svg_timescale = 1.0; |
89 | bool arg_detailed_svg = false; | |
c649b343 | 90 | char *arg_root = NULL; |
e5ea5c3a | 91 | static char *arg_image = NULL; |
57a22a3f LP |
92 | char *arg_security_policy = NULL; |
93 | bool arg_offline = false; | |
94 | unsigned arg_threshold = 100; | |
5229b03c LP |
95 | unsigned arg_iterations = 1; |
96 | usec_t arg_base_time = USEC_INFINITY; | |
e82116e5 | 97 | char *arg_unit = NULL; |
309a747f | 98 | sd_json_format_flags_t arg_json_format_flags = SD_JSON_FORMAT_OFF; |
08e36480 | 99 | bool arg_quiet = false; |
57a22a3f | 100 | char *arg_profile = NULL; |
ff46b2f9 JZ |
101 | bool arg_legend = true; |
102 | bool arg_table = false; | |
84be0c71 | 103 | ImagePolicy *arg_image_policy = NULL; |
9fed4ec2 | 104 | char *arg_drm_device_path = NULL; |
bb150966 | 105 | |
d665c7b2 YW |
106 | STATIC_DESTRUCTOR_REGISTER(arg_dot_from_patterns, strv_freep); |
107 | STATIC_DESTRUCTOR_REGISTER(arg_dot_to_patterns, strv_freep); | |
782671bc | 108 | STATIC_DESTRUCTOR_REGISTER(arg_root, freep); |
e5ea5c3a | 109 | STATIC_DESTRUCTOR_REGISTER(arg_image, freep); |
ecfd082b | 110 | STATIC_DESTRUCTOR_REGISTER(arg_security_policy, freep); |
9fed4ec2 | 111 | STATIC_DESTRUCTOR_REGISTER(arg_drm_device_path, freep); |
8de7929d | 112 | STATIC_DESTRUCTOR_REGISTER(arg_unit, freep); |
04469211 | 113 | STATIC_DESTRUCTOR_REGISTER(arg_profile, freep); |
84be0c71 | 114 | STATIC_DESTRUCTOR_REGISTER(arg_image_policy, image_policy_freep); |
d665c7b2 | 115 | |
25eb70af | 116 | int acquire_bus(sd_bus **bus, bool *use_full_bus) { |
fb507898 | 117 | int r; |
5c69b31c | 118 | |
f7e29336 | 119 | if (use_full_bus && *use_full_bus) { |
4870133b | 120 | r = bus_connect_transport(arg_transport, arg_host, arg_runtime_scope, bus); |
fb507898 YW |
121 | if (IN_SET(r, 0, -EHOSTDOWN)) |
122 | return r; | |
5c69b31c GJ |
123 | |
124 | *use_full_bus = false; | |
125 | } | |
126 | ||
4870133b | 127 | return bus_connect_transport_systemd(arg_transport, arg_host, arg_runtime_scope, bus); |
bf0e0a4d ZJS |
128 | } |
129 | ||
cccd2af6 | 130 | int bus_get_unit_property_strv(sd_bus *bus, const char *path, const char *property, char ***strv) { |
4afd3348 | 131 | _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL; |
988b9df2 LP |
132 | int r; |
133 | ||
134 | assert(bus); | |
135 | assert(path); | |
136 | assert(property); | |
137 | assert(strv); | |
138 | ||
139 | r = sd_bus_get_property_strv( | |
140 | bus, | |
141 | "org.freedesktop.systemd1", | |
142 | path, | |
143 | "org.freedesktop.systemd1.Unit", | |
144 | property, | |
145 | &error, | |
146 | strv); | |
4ae25393 | 147 | if (r < 0) |
0ed3da7c | 148 | return log_error_errno(r, "Failed to get unit property %s: %s", property, bus_error_message(&error, r)); |
988b9df2 LP |
149 | |
150 | return 0; | |
151 | } | |
152 | ||
30bddc06 | 153 | void time_parsing_hint(const char *p, bool calendar, bool timestamp, bool timespan) { |
c269607f ZJS |
154 | if (calendar && calendar_spec_from_string(p, NULL) >= 0) |
155 | log_notice("Hint: this expression is a valid calendar specification. " | |
156 | "Use 'systemd-analyze calendar \"%s\"' instead?", p); | |
157 | if (timestamp && parse_timestamp(p, NULL) >= 0) | |
158 | log_notice("Hint: this expression is a valid timestamp. " | |
159 | "Use 'systemd-analyze timestamp \"%s\"' instead?", p); | |
160 | if (timespan && parse_time(p, NULL, USEC_PER_SEC) >= 0) | |
161 | log_notice("Hint: this expression is a valid timespan. " | |
162 | "Use 'systemd-analyze timespan \"%s\"' instead?", p); | |
6d86f4bd LP |
163 | } |
164 | ||
a839c4b7 ZJS |
165 | static int verb_transient_settings(int argc, char *argv[], void *userdata) { |
166 | assert(argc >= 2); | |
167 | ||
168 | pager_open(arg_pager_flags); | |
169 | ||
170 | bool first = true; | |
171 | STRV_FOREACH(arg, strv_skip(argv, 1)) { | |
172 | UnitType t; | |
173 | ||
174 | t = unit_type_from_string(*arg); | |
175 | if (t < 0) | |
176 | return log_error_errno(t, "Invalid unit type '%s'.", *arg); | |
177 | ||
178 | if (!first) | |
179 | puts(""); | |
180 | ||
181 | bus_dump_transient_settings(t); | |
182 | first = false; | |
183 | } | |
184 | ||
185 | return 0; | |
186 | } | |
187 | ||
a6bcef29 | 188 | static int help(int argc, char *argv[], void *userdata) { |
49139a5d | 189 | _cleanup_free_ char *link = NULL, *dot_link = NULL; |
37ec0fdd | 190 | int r; |
9ea9d4cf | 191 | |
384c2c32 | 192 | pager_open(arg_pager_flags); |
9ea9d4cf | 193 | |
37ec0fdd LP |
194 | r = terminal_urlify_man("systemd-analyze", "1", &link); |
195 | if (r < 0) | |
196 | return log_oom(); | |
197 | ||
49139a5d LP |
198 | /* Not using terminal_urlify_man() for this, since we don't want the "man page" text suffix in this case. */ |
199 | r = terminal_urlify("man:dot(1)", "dot(1)", &dot_link); | |
200 | if (r < 0) | |
201 | return log_oom(); | |
202 | ||
fd4b8484 LP |
203 | printf("%1$s [OPTIONS...] COMMAND ...\n\n" |
204 | "%5$sProfile systemd, show unit dependencies, check unit files.%6$s\n" | |
645a3fa9 | 205 | "\n%3$sBoot Analysis:%4$s\n" |
3cc3dc77 MG |
206 | " [time] Print time required to boot the machine\n" |
207 | " blame Print list of running units ordered by\n" | |
208 | " time to init\n" | |
209 | " critical-chain [UNIT...] Print a tree of the time critical chain\n" | |
210 | " of units\n" | |
645a3fa9 | 211 | "\n%3$sDependency Analysis:%4$s\n" |
3cc3dc77 MG |
212 | " plot Output SVG graphic showing service\n" |
213 | " initialization\n" | |
fd4b8484 | 214 | " dot [UNIT...] Output dependency graph in %7$s format\n" |
d1d8786c | 215 | " dump [PATTERN...] Output state serialization of service\n" |
3cc3dc77 | 216 | " manager\n" |
645a3fa9 | 217 | "\n%3$sConfiguration Files and Search Paths:%4$s\n" |
ca029693 | 218 | " cat-config NAME|PATH... Show configuration file and drop-ins\n" |
3cc3dc77 MG |
219 | " unit-files List files and symlinks for units\n" |
220 | " unit-paths List load directories for units\n" | |
645a3fa9 | 221 | "\n%3$sEnumerate OS Concepts:%4$s\n" |
3cc3dc77 MG |
222 | " exit-status [STATUS...] List exit status definitions\n" |
223 | " capability [CAP...] List capability definitions\n" | |
52117f5a ZJS |
224 | " syscall-filter [NAME...] List syscalls in seccomp filters\n" |
225 | " filesystems [NAME...] List known filesystems\n" | |
fb8cc599 | 226 | " architectures [NAME...] List known architectures\n" |
645a3fa9 | 227 | " smbios11 List strings passed via SMBIOS Type #11\n" |
8f114904 | 228 | " chid List local CHIDs\n" |
a839c4b7 | 229 | " transient-settings TYPE... List transient settings for unit TYPE\n" |
645a3fa9 | 230 | "\n%3$sExpression Evaluation:%4$s\n" |
3cc3dc77 | 231 | " condition CONDITION... Evaluate conditions and asserts\n" |
bc012a3e ZJS |
232 | " compare-versions VERSION1 [OP] VERSION2\n" |
233 | " Compare two version strings\n" | |
645a3fa9 LP |
234 | " image-policy POLICY... Analyze image policy string\n" |
235 | "\n%3$sClock & Time:%4$s\n" | |
3cc3dc77 MG |
236 | " calendar SPEC... Validate repetitive calendar time\n" |
237 | " events\n" | |
238 | " timestamp TIMESTAMP... Validate a timestamp\n" | |
239 | " timespan SPAN... Validate a time span\n" | |
645a3fa9 LP |
240 | "\n%3$sUnit & Service Analysis:%4$s\n" |
241 | " verify FILE... Check unit files for correctness\n" | |
3cc3dc77 | 242 | " security [UNIT...] Analyze security of unit\n" |
5f43c97c | 243 | " fdstore SERVICE... Show file descriptor store contents of service\n" |
645a3fa9 | 244 | " malloc [D-BUS SERVICE...] Dump malloc stats of a D-Bus service\n" |
9a08000d Z |
245 | " unit-shell SERVICE [Command]\n" |
246 | " Run command on the namespace of the service\n" | |
645a3fa9 LP |
247 | "\n%3$sExecutable Analysis:%4$s\n" |
248 | " inspect-elf FILE... Parse and print ELF package metadata\n" | |
249 | "\n%3$sTPM Operations:%4$s\n" | |
58e35960 | 250 | " has-tpm2 Report whether TPM2 support is available\n" |
f70c90f5 | 251 | " pcrs [PCR...] Show TPM2 PCRs and their names\n" |
0615abef | 252 | " srk [>FILE] Write TPM2 SRK (to FILE)\n" |
fd4b8484 | 253 | "\n%3$sOptions:%4$s\n" |
3cc3dc77 | 254 | " --recursive-errors=MODE Control which units are verified\n" |
bb43d853 | 255 | " --offline=BOOL Perform a security review on unit file(s)\n" |
dfbda879 MG |
256 | " --threshold=N Exit with a non-zero status when overall\n" |
257 | " exposure level is over threshold value\n" | |
ecfd082b MG |
258 | " --security-policy=PATH Use custom JSON security policy instead\n" |
259 | " of built-in one\n" | |
4b4a8ef7 | 260 | " --json=pretty|short|off Generate JSON output of the security\n" |
ff46b2f9 | 261 | " analysis table, or plot's raw time data\n" |
3cc3dc77 | 262 | " --no-pager Do not pipe output into a pager\n" |
ff46b2f9 JZ |
263 | " --no-legend Disable column headers and hints in plot\n" |
264 | " with either --table or --json=\n" | |
3cc3dc77 MG |
265 | " --system Operate on system systemd instance\n" |
266 | " --user Operate on user systemd instance\n" | |
267 | " --global Operate on global user configuration\n" | |
268 | " -H --host=[USER@]HOST Operate on remote host\n" | |
269 | " -M --machine=CONTAINER Operate on local container\n" | |
270 | " --order Show only order in the graph\n" | |
271 | " --require Show only requirement in the graph\n" | |
272 | " --from-pattern=GLOB Show only origins in the graph\n" | |
273 | " --to-pattern=GLOB Show only destinations in the graph\n" | |
274 | " --fuzz=SECONDS Also print services which finished SECONDS\n" | |
275 | " earlier than the latest in the branch\n" | |
276 | " --man[=BOOL] Do [not] check for existence of man pages\n" | |
277 | " --generators[=BOOL] Do [not] run unit generators\n" | |
278 | " (requires privileges)\n" | |
6e4918a9 | 279 | " --instance=NAME Specify fallback instance name for template units\n" |
3cc3dc77 MG |
280 | " --iterations=N Show the specified number of iterations\n" |
281 | " --base-time=TIMESTAMP Calculate calendar times relative to\n" | |
282 | " specified time\n" | |
04469211 LB |
283 | " --profile=name|PATH Include the specified profile in the\n" |
284 | " security review of the unit(s)\n" | |
5e163285 | 285 | " --unit=UNIT Evaluate conditions and asserts of unit\n" |
ff46b2f9 | 286 | " --table Output plot's raw time data as a table\n" |
1592d2f9 | 287 | " --scale-svg=FACTOR Stretch x-axis of plot by FACTOR (default: 1.0)\n" |
288 | " --detailed Add more details to SVG plot,\n" | |
289 | " e.g. show activation timestamps\n" | |
52117f5a ZJS |
290 | " -h --help Show this help\n" |
291 | " --version Show package version\n" | |
292 | " -q --quiet Do not emit hints\n" | |
063c8382 | 293 | " --tldr Skip comments and empty lines\n" |
9f5b68d6 LP |
294 | " --root=PATH Operate on an alternate filesystem root\n" |
295 | " --image=PATH Operate on disk image as filesystem root\n" | |
84be0c71 | 296 | " --image-policy=POLICY Specify disk image dissection policy\n" |
4d09f976 | 297 | " -m --mask Parse parameter as numeric capability mask\n" |
9fed4ec2 | 298 | " --drm-device=PATH Use this DRM device sysfs path to get EDID\n" |
299 | ||
fd4b8484 | 300 | "\nSee the %2$s for details.\n", |
bc556335 | 301 | program_invocation_short_name, |
fd4b8484 LP |
302 | link, |
303 | ansi_underline(), | |
304 | ansi_normal(), | |
bc556335 DDM |
305 | ansi_highlight(), |
306 | ansi_normal(), | |
fd4b8484 | 307 | dot_link); |
96de7c04 | 308 | |
1ace223c SJ |
309 | /* When updating this list, including descriptions, apply changes to |
310 | * shell-completion/bash/systemd-analyze and shell-completion/zsh/_systemd-analyze too. */ | |
a6bcef29 LP |
311 | |
312 | return 0; | |
2265fbf7 SP |
313 | } |
314 | ||
9ea9d4cf | 315 | static int parse_argv(int argc, char *argv[]) { |
2265fbf7 SP |
316 | enum { |
317 | ARG_VERSION = 0x100, | |
1700761b SP |
318 | ARG_ORDER, |
319 | ARG_REQUIRE, | |
46d8646a | 320 | ARG_ROOT, |
e5ea5c3a | 321 | ARG_IMAGE, |
06e78680 | 322 | ARG_IMAGE_POLICY, |
e55933db | 323 | ARG_SYSTEM, |
28b35ef2 ZJS |
324 | ARG_USER, |
325 | ARG_GLOBAL, | |
e55933db | 326 | ARG_DOT_FROM_PATTERN, |
bb150966 | 327 | ARG_DOT_TO_PATTERN, |
9ea9d4cf | 328 | ARG_FUZZ, |
1d3bc017 | 329 | ARG_NO_PAGER, |
dad29dff | 330 | ARG_MAN, |
641c0fd1 | 331 | ARG_GENERATORS, |
6e4918a9 | 332 | ARG_INSTANCE, |
f2ccf832 | 333 | ARG_ITERATIONS, |
985c1880 | 334 | ARG_BASE_TIME, |
3cc3dc77 | 335 | ARG_RECURSIVE_ERRORS, |
bb43d853 | 336 | ARG_OFFLINE, |
dfbda879 | 337 | ARG_THRESHOLD, |
ecfd082b | 338 | ARG_SECURITY_POLICY, |
4b4a8ef7 | 339 | ARG_JSON, |
04469211 | 340 | ARG_PROFILE, |
ff46b2f9 JZ |
341 | ARG_TABLE, |
342 | ARG_NO_LEGEND, | |
063c8382 | 343 | ARG_TLDR, |
1592d2f9 | 344 | ARG_SCALE_FACTOR_SVG, |
345 | ARG_DETAILED_SVG, | |
9fed4ec2 | 346 | ARG_DRM_DEVICE_PATH, |
2265fbf7 SP |
347 | }; |
348 | ||
349 | static const struct option options[] = { | |
3cc3dc77 MG |
350 | { "help", no_argument, NULL, 'h' }, |
351 | { "version", no_argument, NULL, ARG_VERSION }, | |
52117f5a | 352 | { "quiet", no_argument, NULL, 'q' }, |
3cc3dc77 MG |
353 | { "order", no_argument, NULL, ARG_ORDER }, |
354 | { "require", no_argument, NULL, ARG_REQUIRE }, | |
355 | { "root", required_argument, NULL, ARG_ROOT }, | |
356 | { "image", required_argument, NULL, ARG_IMAGE }, | |
06e78680 | 357 | { "image-policy", required_argument, NULL, ARG_IMAGE_POLICY }, |
3cc3dc77 | 358 | { "recursive-errors", required_argument, NULL, ARG_RECURSIVE_ERRORS }, |
bb43d853 | 359 | { "offline", required_argument, NULL, ARG_OFFLINE }, |
dfbda879 | 360 | { "threshold", required_argument, NULL, ARG_THRESHOLD }, |
ecfd082b | 361 | { "security-policy", required_argument, NULL, ARG_SECURITY_POLICY }, |
3cc3dc77 MG |
362 | { "system", no_argument, NULL, ARG_SYSTEM }, |
363 | { "user", no_argument, NULL, ARG_USER }, | |
364 | { "global", no_argument, NULL, ARG_GLOBAL }, | |
365 | { "from-pattern", required_argument, NULL, ARG_DOT_FROM_PATTERN }, | |
366 | { "to-pattern", required_argument, NULL, ARG_DOT_TO_PATTERN }, | |
367 | { "fuzz", required_argument, NULL, ARG_FUZZ }, | |
368 | { "no-pager", no_argument, NULL, ARG_NO_PAGER }, | |
369 | { "man", optional_argument, NULL, ARG_MAN }, | |
370 | { "generators", optional_argument, NULL, ARG_GENERATORS }, | |
6e4918a9 | 371 | { "instance", required_argument, NULL, ARG_INSTANCE }, |
3cc3dc77 MG |
372 | { "host", required_argument, NULL, 'H' }, |
373 | { "machine", required_argument, NULL, 'M' }, | |
374 | { "iterations", required_argument, NULL, ARG_ITERATIONS }, | |
375 | { "base-time", required_argument, NULL, ARG_BASE_TIME }, | |
8de7929d | 376 | { "unit", required_argument, NULL, 'U' }, |
4b4a8ef7 | 377 | { "json", required_argument, NULL, ARG_JSON }, |
04469211 | 378 | { "profile", required_argument, NULL, ARG_PROFILE }, |
ff46b2f9 JZ |
379 | { "table", optional_argument, NULL, ARG_TABLE }, |
380 | { "no-legend", optional_argument, NULL, ARG_NO_LEGEND }, | |
063c8382 | 381 | { "tldr", no_argument, NULL, ARG_TLDR }, |
3e7a029c | 382 | { "mask", no_argument, NULL, 'm' }, |
1592d2f9 | 383 | { "scale-svg", required_argument, NULL, ARG_SCALE_FACTOR_SVG }, |
384 | { "detailed", no_argument, NULL, ARG_DETAILED_SVG }, | |
9fed4ec2 | 385 | { "drm-device", required_argument, NULL, ARG_DRM_DEVICE_PATH }, |
eb9da376 | 386 | {} |
2265fbf7 SP |
387 | }; |
388 | ||
9a08000d Z |
389 | bool reorder = false; |
390 | int r, c, unit_shell = -1; | |
eb9da376 | 391 | |
2265fbf7 SP |
392 | assert(argc >= 0); |
393 | assert(argv); | |
394 | ||
9a08000d Z |
395 | /* Resetting to 0 forces the invocation of an internal initialization routine of getopt_long() |
396 | * that checks for GNU extensions in optstring ('-' or '+; at the beginning). */ | |
397 | optind = 0; | |
398 | ||
399 | for (;;) { | |
400 | static const char option_string[] = "-hqH:M:U:m"; | |
401 | ||
402 | c = getopt_long(argc, argv, option_string + reorder, options, NULL); | |
403 | if (c < 0) | |
404 | break; | |
405 | ||
eb9da376 | 406 | switch (c) { |
c170f3a4 | 407 | |
9a08000d Z |
408 | case 1: /* getopt_long() returns 1 if "-" was the first character of the option string, and a |
409 | * non-option argument was discovered. */ | |
410 | ||
411 | assert(!reorder); | |
412 | ||
413 | /* We generally are fine with the fact that getopt_long() reorders the command line, and looks | |
414 | * for switches after the main verb. However, for "unit-shell" we really don't want that, since we | |
415 | * want that switches specified after the service name are passed to the program to execute, | |
416 | * and not processed by us. To make this possible, we'll first invoke getopt_long() with | |
417 | * reordering disabled (i.e. with the "-" prefix in the option string), looking for the first | |
418 | * non-option parameter. If it's the verb "unit-shell" we remember its position and continue | |
419 | * processing options. In this case, as soon as we hit the next non-option argument we found | |
420 | * the service name, and stop further processing. If the first non-option argument is any other | |
421 | * verb than "unit-shell" we switch to normal reordering mode and continue processing arguments | |
422 | * normally. */ | |
423 | ||
424 | if (unit_shell >= 0) { | |
f89a52e3 | 425 | optind--; /* don't process this argument, go one step back */ |
9a08000d Z |
426 | goto done; |
427 | } | |
428 | if (streq(optarg, "unit-shell")) | |
429 | /* Remember the position of the "unit_shell" verb, and continue processing normally. */ | |
430 | unit_shell = optind - 1; | |
431 | else { | |
432 | int saved_optind; | |
433 | ||
434 | /* Ok, this is some other verb. In this case, turn on reordering again, and continue | |
435 | * processing normally. */ | |
436 | reorder = true; | |
437 | ||
438 | /* We changed the option string. getopt_long() only looks at it again if we invoke it | |
439 | * at least once with a reset option index. Hence, let's reset the option index here, | |
440 | * then invoke getopt_long() again (ignoring what it has to say, after all we most | |
441 | * likely already processed it), and the bump the option index so that we read the | |
442 | * intended argument again. */ | |
443 | saved_optind = optind; | |
444 | optind = 0; | |
445 | (void) getopt_long(argc, argv, option_string + reorder, options, NULL); | |
446 | optind = saved_optind - 1; /* go one step back, process this argument again */ | |
447 | } | |
448 | ||
449 | break; | |
450 | ||
c170f3a4 | 451 | case 'h': |
a6bcef29 | 452 | return help(0, NULL, NULL); |
c170f3a4 | 453 | |
52117f5a ZJS |
454 | case ARG_VERSION: |
455 | return version(); | |
456 | ||
457 | case 'q': | |
458 | arg_quiet = true; | |
459 | break; | |
460 | ||
3cc3dc77 MG |
461 | case ARG_RECURSIVE_ERRORS: |
462 | if (streq(optarg, "help")) { | |
463 | DUMP_STRING_TABLE(recursive_errors, RecursiveErrors, _RECURSIVE_ERRORS_MAX); | |
464 | return 0; | |
465 | } | |
466 | r = recursive_errors_from_string(optarg); | |
467 | if (r < 0) | |
468 | return log_error_errno(r, "Unknown mode passed to --recursive-errors='%s'.", optarg); | |
469 | ||
470 | arg_recursive_errors = r; | |
471 | break; | |
472 | ||
46d8646a | 473 | case ARG_ROOT: |
782671bc MG |
474 | r = parse_path_argument(optarg, /* suppress_root= */ true, &arg_root); |
475 | if (r < 0) | |
476 | return r; | |
46d8646a ZJS |
477 | break; |
478 | ||
e5ea5c3a MG |
479 | case ARG_IMAGE: |
480 | r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_image); | |
481 | if (r < 0) | |
482 | return r; | |
483 | break; | |
484 | ||
06e78680 YW |
485 | case ARG_IMAGE_POLICY: |
486 | r = parse_image_policy_argument(optarg, &arg_image_policy); | |
487 | if (r < 0) | |
488 | return r; | |
489 | break; | |
490 | ||
28b35ef2 | 491 | case ARG_SYSTEM: |
4870133b | 492 | arg_runtime_scope = RUNTIME_SCOPE_SYSTEM; |
28b35ef2 ZJS |
493 | break; |
494 | ||
c170f3a4 | 495 | case ARG_USER: |
4870133b | 496 | arg_runtime_scope = RUNTIME_SCOPE_USER; |
c170f3a4 LP |
497 | break; |
498 | ||
28b35ef2 | 499 | case ARG_GLOBAL: |
4870133b | 500 | arg_runtime_scope = RUNTIME_SCOPE_GLOBAL; |
c170f3a4 LP |
501 | break; |
502 | ||
503 | case ARG_ORDER: | |
504 | arg_dot = DEP_ORDER; | |
505 | break; | |
506 | ||
507 | case ARG_REQUIRE: | |
508 | arg_dot = DEP_REQUIRE; | |
509 | break; | |
510 | ||
e55933db | 511 | case ARG_DOT_FROM_PATTERN: |
903a0b07 LP |
512 | if (strv_extend(&arg_dot_from_patterns, optarg) < 0) |
513 | return log_oom(); | |
514 | ||
e55933db ŁS |
515 | break; |
516 | ||
517 | case ARG_DOT_TO_PATTERN: | |
903a0b07 LP |
518 | if (strv_extend(&arg_dot_to_patterns, optarg) < 0) |
519 | return log_oom(); | |
520 | ||
e55933db ŁS |
521 | break; |
522 | ||
bb150966 HH |
523 | case ARG_FUZZ: |
524 | r = parse_sec(optarg, &arg_fuzz); | |
525 | if (r < 0) | |
526 | return r; | |
527 | break; | |
528 | ||
9ea9d4cf | 529 | case ARG_NO_PAGER: |
0221d68a | 530 | arg_pager_flags |= PAGER_DISABLE; |
9ea9d4cf LP |
531 | break; |
532 | ||
3cd26e7c LP |
533 | case 'H': |
534 | arg_transport = BUS_TRANSPORT_REMOTE; | |
535 | arg_host = optarg; | |
536 | break; | |
537 | ||
538 | case 'M': | |
a59cc386 MY |
539 | r = parse_machine_argument(optarg, &arg_host, &arg_transport); |
540 | if (r < 0) | |
541 | return r; | |
3cd26e7c LP |
542 | break; |
543 | ||
dad29dff | 544 | case ARG_MAN: |
599c7c54 ZJS |
545 | r = parse_boolean_argument("--man", optarg, &arg_man); |
546 | if (r < 0) | |
547 | return r; | |
1d3bc017 ZJS |
548 | break; |
549 | ||
641c0fd1 | 550 | case ARG_GENERATORS: |
599c7c54 ZJS |
551 | r = parse_boolean_argument("--generators", optarg, &arg_generators); |
552 | if (r < 0) | |
553 | return r; | |
641c0fd1 ZJS |
554 | break; |
555 | ||
6e4918a9 YW |
556 | case ARG_INSTANCE: |
557 | arg_instance = optarg; | |
558 | break; | |
559 | ||
bb43d853 MG |
560 | case ARG_OFFLINE: |
561 | r = parse_boolean_argument("--offline", optarg, &arg_offline); | |
562 | if (r < 0) | |
563 | return r; | |
564 | break; | |
565 | ||
dfbda879 MG |
566 | case ARG_THRESHOLD: |
567 | r = safe_atou(optarg, &arg_threshold); | |
568 | if (r < 0 || arg_threshold > 100) | |
569 | return log_error_errno(r < 0 ? r : SYNTHETIC_ERRNO(EINVAL), "Failed to parse threshold: %s", optarg); | |
570 | ||
571 | break; | |
572 | ||
ecfd082b MG |
573 | case ARG_SECURITY_POLICY: |
574 | r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_security_policy); | |
575 | if (r < 0) | |
576 | return r; | |
577 | break; | |
578 | ||
4b4a8ef7 MG |
579 | case ARG_JSON: |
580 | r = parse_json_argument(optarg, &arg_json_format_flags); | |
581 | if (r <= 0) | |
582 | return r; | |
583 | break; | |
584 | ||
f2ccf832 LP |
585 | case ARG_ITERATIONS: |
586 | r = safe_atou(optarg, &arg_iterations); | |
587 | if (r < 0) | |
588 | return log_error_errno(r, "Failed to parse iterations: %s", optarg); | |
f2ccf832 LP |
589 | break; |
590 | ||
985c1880 LP |
591 | case ARG_BASE_TIME: |
592 | r = parse_timestamp(optarg, &arg_base_time); | |
593 | if (r < 0) | |
594 | return log_error_errno(r, "Failed to parse --base-time= parameter: %s", optarg); | |
985c1880 LP |
595 | break; |
596 | ||
04469211 LB |
597 | case ARG_PROFILE: |
598 | if (isempty(optarg)) | |
599 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Profile file name is empty"); | |
600 | ||
601 | if (is_path(optarg)) { | |
602 | r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_profile); | |
603 | if (r < 0) | |
604 | return r; | |
605 | if (!endswith(arg_profile, ".conf")) | |
606 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Profile file name must end with .conf: %s", arg_profile); | |
607 | } else { | |
608 | r = free_and_strdup(&arg_profile, optarg); | |
609 | if (r < 0) | |
610 | return log_oom(); | |
611 | } | |
612 | ||
613 | break; | |
614 | ||
8de7929d DDM |
615 | case 'U': { |
616 | _cleanup_free_ char *mangled = NULL; | |
617 | ||
618 | r = unit_name_mangle(optarg, UNIT_NAME_MANGLE_WARN, &mangled); | |
619 | if (r < 0) | |
620 | return log_error_errno(r, "Failed to mangle unit name %s: %m", optarg); | |
621 | ||
622 | free_and_replace(arg_unit, mangled); | |
623 | break; | |
624 | } | |
ff46b2f9 JZ |
625 | |
626 | case ARG_TABLE: | |
627 | arg_table = true; | |
628 | break; | |
629 | ||
630 | case ARG_NO_LEGEND: | |
631 | arg_legend = false; | |
632 | break; | |
633 | ||
063c8382 ZJS |
634 | case ARG_TLDR: |
635 | arg_cat_flags = CAT_TLDR; | |
636 | break; | |
637 | ||
3e7a029c IS |
638 | case 'm': |
639 | arg_capability = CAPABILITY_MASK; | |
640 | break; | |
641 | ||
1592d2f9 | 642 | case ARG_SCALE_FACTOR_SVG: |
643 | arg_svg_timescale = strtod(optarg, NULL); | |
644 | break; | |
645 | ||
646 | case ARG_DETAILED_SVG: | |
647 | arg_detailed_svg = true; | |
648 | break; | |
649 | ||
9fed4ec2 | 650 | case ARG_DRM_DEVICE_PATH: |
651 | r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_drm_device_path); | |
652 | if (r < 0) | |
653 | return r; | |
654 | break; | |
655 | ||
c170f3a4 LP |
656 | case '?': |
657 | return -EINVAL; | |
658 | ||
659 | default: | |
04499a70 | 660 | assert_not_reached(); |
2265fbf7 | 661 | } |
9a08000d Z |
662 | } |
663 | ||
664 | done: | |
665 | if (unit_shell >= 0) { | |
666 | char *t; | |
667 | ||
668 | /* We found the "unit-shell" verb while processing the argument list. Since we turned off reordering of the | |
669 | * argument list initially let's readjust it now, and move the "unit-shell" verb to the back. */ | |
670 | ||
671 | optind -= 1; /* place the option index where the "unit-shell" verb will be placed */ | |
672 | ||
673 | t = argv[unit_shell]; | |
674 | for (int i = unit_shell; i < optind; i++) | |
675 | argv[i] = argv[i+1]; | |
676 | argv[optind] = t; | |
677 | } | |
eb9da376 | 678 | |
bb43d853 MG |
679 | if (arg_offline && !streq_ptr(argv[optind], "security")) |
680 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), | |
681 | "Option --offline= is only supported for security right now."); | |
682 | ||
5e163285 AAF |
683 | if (arg_offline && optind >= argc - 1) |
684 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), | |
685 | "Option --offline= requires one or more units to perform a security review."); | |
686 | ||
dfbda879 MG |
687 | if (arg_threshold != 100 && !streq_ptr(argv[optind], "security")) |
688 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), | |
689 | "Option --threshold= is only supported for security right now."); | |
690 | ||
ac970536 | 691 | if (arg_runtime_scope == RUNTIME_SCOPE_GLOBAL && !streq_ptr(argv[optind], "unit-paths")) |
baaa35ad | 692 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), |
ac970536 | 693 | "Option --global only makes sense with verb unit-paths."); |
31a5924e | 694 | |
4870133b | 695 | if (streq_ptr(argv[optind], "cat-config") && arg_runtime_scope == RUNTIME_SCOPE_USER) |
f1d9d36a ZJS |
696 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), |
697 | "Option --user is not supported for cat-config right now."); | |
698 | ||
ecfd082b MG |
699 | if (arg_security_policy && !streq_ptr(argv[optind], "security")) |
700 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), | |
701 | "Option --security-policy= is only supported for security."); | |
702 | ||
68511ceb | 703 | if ((arg_root || arg_image) && (!STRPTR_IN_SET(argv[optind], "cat-config", "verify", "condition", "inspect-elf")) && |
bb43d853 | 704 | (!(streq_ptr(argv[optind], "security") && arg_offline))) |
baaa35ad | 705 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), |
8de7929d | 706 | "Options --root= and --image= are only supported for cat-config, verify, condition and security when used with --offline= right now."); |
e5ea5c3a MG |
707 | |
708 | /* Having both an image and a root is not supported by the code */ | |
709 | if (arg_root && arg_image) | |
710 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Please specify either --root= or --image=, the combination of both is not supported."); | |
46d8646a | 711 | |
8de7929d DDM |
712 | if (arg_unit && !streq_ptr(argv[optind], "condition")) |
713 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --unit= is only supported for condition"); | |
714 | ||
715 | if (streq_ptr(argv[optind], "condition") && !arg_unit && optind >= argc - 1) | |
716 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Too few arguments for condition"); | |
717 | ||
718 | if (streq_ptr(argv[optind], "condition") && arg_unit && optind < argc - 1) | |
719 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "No conditions can be passed if --unit= is used."); | |
720 | ||
ff46b2f9 JZ |
721 | if (arg_table && !streq_ptr(argv[optind], "plot")) |
722 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --table is only supported for plot right now."); | |
723 | ||
23441a3d | 724 | if (arg_table && sd_json_format_enabled(arg_json_format_flags)) |
ff46b2f9 JZ |
725 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--table and --json= are mutually exclusive."); |
726 | ||
3e7a029c IS |
727 | if (arg_capability != CAPABILITY_LITERAL && !streq_ptr(argv[optind], "capability")) |
728 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --mask is only supported for capability."); | |
729 | ||
9fed4ec2 | 730 | if (arg_drm_device_path && !streq_ptr(argv[optind], "chid")) |
731 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --drm-device is only supported for chid right now."); | |
732 | ||
1d3bc017 | 733 | return 1; /* work to do */ |
2265fbf7 SP |
734 | } |
735 | ||
d665c7b2 | 736 | static int run(int argc, char *argv[]) { |
e5ea5c3a | 737 | _cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL; |
a4b3e942 | 738 | _cleanup_(umount_and_freep) char *mounted_dir = NULL; |
a6bcef29 LP |
739 | |
740 | static const Verb verbs[] = { | |
a839c4b7 ZJS |
741 | { "help", VERB_ANY, VERB_ANY, 0, help }, |
742 | { "time", VERB_ANY, 1, VERB_DEFAULT, verb_time }, | |
743 | { "blame", VERB_ANY, 1, 0, verb_blame }, | |
744 | { "critical-chain", VERB_ANY, VERB_ANY, 0, verb_critical_chain }, | |
745 | { "plot", VERB_ANY, 1, 0, verb_plot }, | |
746 | { "dot", VERB_ANY, VERB_ANY, 0, verb_dot }, | |
ab86ccba | 747 | /* ↓ The following seven verbs are deprecated, from here … ↓ */ |
a839c4b7 ZJS |
748 | { "log-level", VERB_ANY, 2, 0, verb_log_control }, |
749 | { "log-target", VERB_ANY, 2, 0, verb_log_control }, | |
750 | { "set-log-level", 2, 2, 0, verb_log_control }, | |
751 | { "get-log-level", VERB_ANY, 1, 0, verb_log_control }, | |
752 | { "set-log-target", 2, 2, 0, verb_log_control }, | |
753 | { "get-log-target", VERB_ANY, 1, 0, verb_log_control }, | |
754 | { "service-watchdogs", VERB_ANY, 2, 0, verb_service_watchdogs }, | |
ab86ccba | 755 | /* ↑ … until here ↑ */ |
a839c4b7 ZJS |
756 | { "dump", VERB_ANY, VERB_ANY, 0, verb_dump }, |
757 | { "cat-config", 2, VERB_ANY, 0, verb_cat_config }, | |
758 | { "unit-files", VERB_ANY, VERB_ANY, 0, verb_unit_files }, | |
759 | { "unit-paths", 1, 1, 0, verb_unit_paths }, | |
9a08000d | 760 | { "unit-shell", 2, VERB_ANY, 0, verb_unit_shell }, |
a839c4b7 ZJS |
761 | { "exit-status", VERB_ANY, VERB_ANY, 0, verb_exit_status }, |
762 | { "syscall-filter", VERB_ANY, VERB_ANY, 0, verb_syscall_filters }, | |
763 | { "capability", VERB_ANY, VERB_ANY, 0, verb_capabilities }, | |
764 | { "filesystems", VERB_ANY, VERB_ANY, 0, verb_filesystems }, | |
765 | { "condition", VERB_ANY, VERB_ANY, 0, verb_condition }, | |
766 | { "compare-versions", 3, 4, 0, verb_compare_versions }, | |
767 | { "verify", 2, VERB_ANY, 0, verb_verify }, | |
768 | { "calendar", 2, VERB_ANY, 0, verb_calendar }, | |
769 | { "timestamp", 2, VERB_ANY, 0, verb_timestamp }, | |
770 | { "timespan", 2, VERB_ANY, 0, verb_timespan }, | |
771 | { "security", VERB_ANY, VERB_ANY, 0, verb_security }, | |
772 | { "inspect-elf", 2, VERB_ANY, 0, verb_elf_inspection }, | |
773 | { "malloc", VERB_ANY, VERB_ANY, 0, verb_malloc }, | |
774 | { "fdstore", 2, VERB_ANY, 0, verb_fdstore }, | |
775 | { "image-policy", 2, 2, 0, verb_image_policy }, | |
776 | { "has-tpm2", VERB_ANY, 1, 0, verb_has_tpm2 }, | |
777 | { "pcrs", VERB_ANY, VERB_ANY, 0, verb_pcrs }, | |
778 | { "srk", VERB_ANY, 1, 0, verb_srk }, | |
779 | { "architectures", VERB_ANY, VERB_ANY, 0, verb_architectures }, | |
780 | { "smbios11", VERB_ANY, 1, 0, verb_smbios11 }, | |
781 | { "chid", VERB_ANY, VERB_ANY, 0, verb_chid }, | |
782 | { "transient-settings", 2, VERB_ANY, 0, verb_transient_settings }, | |
a6bcef29 LP |
783 | {} |
784 | }; | |
785 | ||
5220a6f3 | 786 | int r; |
2265fbf7 SP |
787 | |
788 | setlocale(LC_ALL, ""); | |
c170f3a4 | 789 | setlocale(LC_NUMERIC, "C"); /* we want to format/parse floats in C style */ |
a6bcef29 | 790 | |
d2acb93d | 791 | log_setup(); |
2265fbf7 SP |
792 | |
793 | r = parse_argv(argc, argv); | |
9ea9d4cf | 794 | if (r <= 0) |
d665c7b2 | 795 | return r; |
c170f3a4 | 796 | |
e5ea5c3a MG |
797 | /* Open up and mount the image */ |
798 | if (arg_image) { | |
799 | assert(!arg_root); | |
800 | ||
801 | r = mount_image_privately_interactively( | |
802 | arg_image, | |
84be0c71 | 803 | arg_image_policy, |
e5ea5c3a MG |
804 | DISSECT_IMAGE_GENERIC_ROOT | |
805 | DISSECT_IMAGE_RELAX_VAR_CHECK | | |
f4a63ce2 LP |
806 | DISSECT_IMAGE_READ_ONLY | |
807 | DISSECT_IMAGE_ALLOW_USERSPACE_VERITY, | |
a4b3e942 | 808 | &mounted_dir, |
a133d2c3 | 809 | /* ret_dir_fd= */ NULL, |
e330f97a | 810 | &loop_device); |
e5ea5c3a MG |
811 | if (r < 0) |
812 | return r; | |
813 | ||
a4b3e942 | 814 | arg_root = strdup(mounted_dir); |
e5ea5c3a MG |
815 | if (!arg_root) |
816 | return log_oom(); | |
817 | } | |
818 | ||
d665c7b2 | 819 | return dispatch_verb(argc, argv, verbs, NULL); |
2265fbf7 | 820 | } |
d665c7b2 | 821 | |
fddad5f4 | 822 | DEFINE_MAIN_FUNCTION_WITH_POSITIVE_FAILURE(run); |