]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/core/dbus-execute.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
core: do not create symlink to private directory if parent already exists
[thirdparty/systemd.git] / src / core / dbus-execute.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
4139c1b2 2
227b8a76 3#include <sys/mount.h>
82c121a4 4#include <sys/prctl.h>
4139c1b2 5
349cc4a5 6#if HAVE_SECCOMP
57183d11
LP		 7#include <seccomp.h>
8#endif
9
3ffd4af2 10#include "af-list.h"
b5efdb8a 11#include "alloc-util.h"
40af3d02 12#include "bus-get-properties.h"
cffaed83 13#include "cap-list.h"
d3070fbd 14#include "capability-util.h"
501941aa 15#include "cpu-set-util.h"
786d19fd 16#include "creds-util.h"
3ffd4af2 17#include "dbus-execute.h"
7e2a3fcc 18#include "dbus-util.h"
c7040b5d 19#include "env-util.h"
cffaed83 20#include "errno-list.h"
2e59b241 21#include "escape.h"
3ffd4af2
LP		 22#include "execute.h"
23#include "fd-util.h"
24#include "fileio.h"
08f3be7a 25#include "hexdecoct.h"
d3070fbd 26#include "io-util.h"
032b3afb 27#include "ioprio-util.h"
adce225a 28#include "journal-file.h"
5bead76e 29#include "missing_ioprio.h"
049af8ad 30#include "mountpoint-util.h"
417116f2 31#include "namespace.h"
6bedfcbb 32#include "parse-util.h"
9b15b784 33#include "path-util.h"
7b3e062c 34#include "process-util.h"
78f22b97 35#include "rlimit-util.h"
349cc4a5 36#if HAVE_SECCOMP
57183d11
LP		 37#include "seccomp-util.h"
38#endif
cffaed83 39#include "securebits-util.h"
2e59b241 40#include "specifier.h"
cc86a278 41#include "stat-util.h"
6bedfcbb 42#include "strv.h"
7ccbd1ae 43#include "syslog-util.h"
f900f582 44#include "unit-printf.h"
6f3e7985 45#include "user-util.h"
6bedfcbb 46#include "utf8.h"
57183d11 47
718db961 48BUS_DEFINE_PROPERTY_GET_ENUM(bus_property_get_exec_output, exec_output, ExecOutput);
718db961 49static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_input, exec_input, ExecInput);
023a4f67 50static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_utmp_mode, exec_utmp_mode, ExecUtmpMode);
53f47dfc 51static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_preserve_mode, exec_preserve_mode, ExecPreserveMode);
b1edf445 52static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_keyring_mode, exec_keyring_mode, ExecKeyringMode);
4e399953
LP		 53static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_protect_proc, protect_proc, ProtectProc);
54static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_proc_subset, proc_subset, ProcSubset);
73b84e92
YW		 55static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_protect_home, protect_home, ProtectHome);
56static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_protect_system, protect_system, ProtectSystem);
491eecb3 57static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_personality, personality, unsigned long);
019b34ca 58static BUS_DEFINE_PROPERTY_GET(property_get_ioprio, "i", ExecContext, exec_context_get_effective_ioprio);
5e98086d 59static BUS_DEFINE_PROPERTY_GET(property_get_mount_apivfs, "b", ExecContext, exec_context_get_effective_mount_apivfs);
5bead76e
ZJS		 60static BUS_DEFINE_PROPERTY_GET2(property_get_ioprio_class, "i", ExecContext, exec_context_get_effective_ioprio, ioprio_prio_class);
61static BUS_DEFINE_PROPERTY_GET2(property_get_ioprio_priority, "i", ExecContext, exec_context_get_effective_ioprio, ioprio_prio_data);
92c23c5a
YW		 62static BUS_DEFINE_PROPERTY_GET_GLOBAL(property_get_empty_string, "s", NULL);
63static BUS_DEFINE_PROPERTY_GET_REF(property_get_syslog_level, "i", int, LOG_PRI);
64static BUS_DEFINE_PROPERTY_GET_REF(property_get_syslog_facility, "i", int, LOG_FAC);
e2b2fb7f
MS		 65static BUS_DEFINE_PROPERTY_GET(property_get_cpu_affinity_from_numa, "b", ExecContext, exec_context_get_cpu_affinity_from_numa);
66
718db961
LP		 67static int property_get_environment_files(
68 sd_bus *bus,
69 const char *path,
70 const char *interface,
71 const char *property,
72 sd_bus_message *reply,
ebcf1f97
LP		 73 void *userdata,
74 sd_bus_error *error) {
8c7be95e 75
99534007 76 ExecContext *c = ASSERT_PTR(userdata);
718db961 77 int r;
8c7be95e 78
718db961
LP		 79 assert(bus);
80 assert(reply);
718db961
LP		 81
82 r = sd_bus_message_open_container(reply, 'a', "(sb)");
83 if (r < 0)
84 return r;
8c7be95e 85
718db961
LP		 86 STRV_FOREACH(j, c->environment_files) {
87 const char *fn = *j;
8c7be95e 88
718db961
LP		 89 r = sd_bus_message_append(reply, "(sb)", fn[0] == '-' ? fn + 1 : fn, fn[0] == '-');
90 if (r < 0)
91 return r;
8c7be95e
LP		 92 }
93
718db961
LP		 94 return sd_bus_message_close_container(reply);
95}
96
718db961
LP		 97static int property_get_oom_score_adjust(
98 sd_bus *bus,
99 const char *path,
100 const char *interface,
101 const char *property,
102 sd_bus_message *reply,
ebcf1f97
LP		 103 void *userdata,
104 sd_bus_error *error) {
718db961 105
99534007 106 ExecContext *c = ASSERT_PTR(userdata);
2c37c613 107 int r, n;
82c121a4 108
718db961
LP		 109 assert(bus);
110 assert(reply);
82c121a4 111
dd6c17b1
LP		 112 if (c->oom_score_adjust_set)
113 n = c->oom_score_adjust;
82c121a4 114 else {
82c121a4 115 n = 0;
2c37c613 116 r = get_oom_score_adjust(&n);
b94fb74b
ZJS		 117 if (r < 0)
118 log_debug_errno(r, "Failed to read /proc/self/oom_score_adj, ignoring: %m");
82c121a4
LP		 119 }
120
718db961 121 return sd_bus_message_append(reply, "i", n);
82c121a4
LP		 122}
123
ad21e542
ZJS		 124static int property_get_coredump_filter(
125 sd_bus *bus,
126 const char *path,
127 const char *interface,
128 const char *property,
129 sd_bus_message *reply,
130 void *userdata,
131 sd_bus_error *error) {
132
99534007 133 ExecContext *c = ASSERT_PTR(userdata);
ad21e542
ZJS		 134 uint64_t n;
135 int r;
136
137 assert(bus);
138 assert(reply);
ad21e542
ZJS		 139
140 if (c->coredump_filter_set)
141 n = c->coredump_filter;
142 else {
143 _cleanup_free_ char *t = NULL;
144
145 n = COREDUMP_FILTER_MASK_DEFAULT;
146 r = read_one_line_file("/proc/self/coredump_filter", &t);
147 if (r < 0)
148 log_debug_errno(r, "Failed to read /proc/self/coredump_filter, ignoring: %m");
149 else {
150 r = safe_atoux64(t, &n);
151 if (r < 0)
152 log_debug_errno(r, "Failed to parse \"%s\" from /proc/self/coredump_filter, ignoring: %m", t);
153 }
154 }
155
156 return sd_bus_message_append(reply, "t", n);
157}
158
718db961
LP		 159static int property_get_nice(
160 sd_bus *bus,
161 const char *path,
162 const char *interface,
163 const char *property,
164 sd_bus_message *reply,
ebcf1f97
LP		 165 void *userdata,
166 sd_bus_error *error) {
718db961 167
99534007 168 ExecContext *c = ASSERT_PTR(userdata);
82c121a4
LP		 169 int32_t n;
170
718db961
LP		 171 assert(bus);
172 assert(reply);
82c121a4
LP		 173
174 if (c->nice_set)
175 n = c->nice;
718db961
LP		 176 else {
177 errno = 0;
82c121a4 178 n = getpriority(PRIO_PROCESS, 0);
b3267152 179 if (errno > 0)
718db961
LP		 180 n = 0;
181 }
82c121a4 182
718db961 183 return sd_bus_message_append(reply, "i", n);
82c121a4
LP		 184}
185
718db961
LP		 186static int property_get_cpu_sched_policy(
187 sd_bus *bus,
188 const char *path,
189 const char *interface,
190 const char *property,
191 sd_bus_message *reply,
ebcf1f97
LP		 192 void *userdata,
193 sd_bus_error *error) {
718db961 194
99534007 195 ExecContext *c = ASSERT_PTR(userdata);
82c121a4
LP		 196 int32_t n;
197
718db961
LP		 198 assert(bus);
199 assert(reply);
82c121a4
LP		 200
201 if (c->cpu_sched_set)
202 n = c->cpu_sched_policy;
718db961 203 else {
82c121a4 204 n = sched_getscheduler(0);
718db961
LP		 205 if (n < 0)
206 n = SCHED_OTHER;
207 }
82c121a4 208
718db961 209 return sd_bus_message_append(reply, "i", n);
82c121a4
LP		 210}
211
718db961
LP		 212static int property_get_cpu_sched_priority(
213 sd_bus *bus,
214 const char *path,
215 const char *interface,
216 const char *property,
217 sd_bus_message *reply,
ebcf1f97
LP		 218 void *userdata,
219 sd_bus_error *error) {
718db961 220
99534007 221 ExecContext *c = ASSERT_PTR(userdata);
82c121a4
LP		 222 int32_t n;
223
718db961
LP		 224 assert(bus);
225 assert(reply);
82c121a4
LP		 226
227 if (c->cpu_sched_set)
228 n = c->cpu_sched_priority;
229 else {
b92bea5d 230 struct sched_param p = {};
82c121a4 231
82c121a4
LP		 232 if (sched_getparam(0, &p) >= 0)
233 n = p.sched_priority;
e62d8c39
ZJS		 234 else
235 n = 0;
82c121a4
LP		 236 }
237
718db961 238 return sd_bus_message_append(reply, "i", n);
82c121a4
LP		 239}
240
718db961
LP		 241static int property_get_cpu_affinity(
242 sd_bus *bus,
243 const char *path,
244 const char *interface,
245 const char *property,
246 sd_bus_message *reply,
ebcf1f97
LP		 247 void *userdata,
248 sd_bus_error *error) {
82c121a4 249
99534007 250 ExecContext *c = ASSERT_PTR(userdata);
e2b2fb7f 251 _cleanup_(cpu_set_reset) CPUSet s = {};
75e40119
MS		 252 _cleanup_free_ uint8_t *array = NULL;
253 size_t allocated;
82c121a4 254
718db961
LP		 255 assert(bus);
256 assert(reply);
82c121a4 257
e2b2fb7f
MS		 258 if (c->cpu_affinity_from_numa) {
259 int r;
260
261 r = numa_to_cpu_set(&c->numa_policy, &s);
262 if (r < 0)
263 return r;
264 }
265
266 (void) cpu_set_to_dbus(c->cpu_affinity_from_numa ? &s : &c->cpu_set, &array, &allocated);
267
75e40119 268 return sd_bus_message_append_array(reply, 'y', array, allocated);
82c121a4
LP		 269}
270
b070c7c0
MS		 271static int property_get_numa_mask(
272 sd_bus *bus,
273 const char *path,
274 const char *interface,
275 const char *property,
276 sd_bus_message *reply,
277 void *userdata,
278 sd_bus_error *error) {
279
99534007 280 ExecContext *c = ASSERT_PTR(userdata);
b070c7c0
MS		 281 _cleanup_free_ uint8_t *array = NULL;
282 size_t allocated;
283
284 assert(bus);
285 assert(reply);
b070c7c0
MS		 286
287 (void) cpu_set_to_dbus(&c->numa_policy.nodes, &array, &allocated);
288
289 return sd_bus_message_append_array(reply, 'y', array, allocated);
290}
291
292static int property_get_numa_policy(
293 sd_bus *bus,
294 const char *path,
295 const char *interface,
296 const char *property,
297 sd_bus_message *reply,
298 void *userdata,
299 sd_bus_error *error) {
99534007 300 ExecContext *c = ASSERT_PTR(userdata);
b070c7c0
MS		 301 int32_t policy;
302
303 assert(bus);
304 assert(reply);
b070c7c0
MS		 305
306 policy = numa_policy_get_type(&c->numa_policy);
307
308 return sd_bus_message_append_basic(reply, 'i', &policy);
309}
310
718db961
LP		 311static int property_get_timer_slack_nsec(
312 sd_bus *bus,
313 const char *path,
314 const char *interface,
315 const char *property,
316 sd_bus_message *reply,
ebcf1f97
LP		 317 void *userdata,
318 sd_bus_error *error) {
718db961 319
99534007 320 ExecContext *c = ASSERT_PTR(userdata);
82c121a4
LP		 321 uint64_t u;
322
718db961
LP		 323 assert(bus);
324 assert(reply);
82c121a4 325
3a43da28 326 if (c->timer_slack_nsec != NSEC_INFINITY)
03fae018 327 u = (uint64_t) c->timer_slack_nsec;
82c121a4
LP		 328 else
329 u = (uint64_t) prctl(PR_GET_TIMERSLACK);
330
718db961 331 return sd_bus_message_append(reply, "t", u);
82c121a4
LP		 332}
333
718db961
LP		 334static int property_get_syscall_filter(
335 sd_bus *bus,
336 const char *path,
337 const char *interface,
338 const char *property,
339 sd_bus_message *reply,
ebcf1f97
LP		 340 void *userdata,
341 sd_bus_error *error) {
82c121a4 342
99534007 343 ExecContext *c = ASSERT_PTR(userdata);
17df7223 344 _cleanup_strv_free_ char **l = NULL;
57183d11
LP		 345 int r;
346
17df7223
LP		 347 assert(bus);
348 assert(reply);
17df7223 349
57183d11
LP		 350 r = sd_bus_message_open_container(reply, 'r', "bas");
351 if (r < 0)
352 return r;
353
6b000af4 354 r = sd_bus_message_append(reply, "b", c->syscall_allow_list);
57183d11
LP		 355 if (r < 0)
356 return r;
357
349cc4a5 358#if HAVE_SECCOMP
d5a99b7c 359 void *id, *val;
90e74a66 360 HASHMAP_FOREACH_KEY(val, id, c->syscall_filter) {
8cfa775f
YW		 361 _cleanup_free_ char *name = NULL;
362 const char *e = NULL;
363 char *s;
364 int num = PTR_TO_INT(val);
17df7223 365
8c93ebbd
YW		 366 if (c->syscall_allow_list && num >= 0)
367 /* syscall with num >= 0 in allow-list is denied. */
368 continue;
369
17df7223
LP		 370 name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
371 if (!name)
372 continue;
373
8cfa775f 374 if (num >= 0) {
005bfaf1 375 e = seccomp_errno_or_action_to_string(num);
8cfa775f
YW		 376 if (e) {
377 s = strjoin(name, ":", e);
378 if (!s)
379 return -ENOMEM;
380 } else {
381 r = asprintf(&s, "%s:%d", name, num);
382 if (r < 0)
383 return -ENOMEM;
384 }
ae2a15bc
LP		 385 } else
386 s = TAKE_PTR(name);
8cfa775f
YW		 387
388 r = strv_consume(&l, s);
6e18964d
ZJS		 389 if (r < 0)
390 return r;
17df7223 391 }
351a19b1 392#endif
17df7223
LP		 393
394 strv_sort(l);
395
57183d11
LP		 396 r = sd_bus_message_append_strv(reply, l);
397 if (r < 0)
398 return r;
17df7223 399
57183d11
LP		 400 return sd_bus_message_close_container(reply);
401}
17df7223 402
9df2cdd8
TM		 403static int property_get_syscall_log(
404 sd_bus *bus,
405 const char *path,
406 const char *interface,
407 const char *property,
408 sd_bus_message *reply,
409 void *userdata,
410 sd_bus_error *error) {
411
99534007 412 ExecContext *c = ASSERT_PTR(userdata);
9df2cdd8
TM		 413 _cleanup_strv_free_ char **l = NULL;
414 int r;
415
9df2cdd8
TM		 416 assert(bus);
417 assert(reply);
9df2cdd8
TM		 418
419 r = sd_bus_message_open_container(reply, 'r', "bas");
420 if (r < 0)
421 return r;
422
423 r = sd_bus_message_append(reply, "b", c->syscall_log_allow_list);
424 if (r < 0)
425 return r;
426
427#if HAVE_SECCOMP
d5a99b7c 428 void *id, *val;
9df2cdd8
TM		 429 HASHMAP_FOREACH_KEY(val, id, c->syscall_log) {
430 char *name = NULL;
431
432 name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
433 if (!name)
434 continue;
435
436 r = strv_consume(&l, name);
437 if (r < 0)
438 return r;
439 }
440#endif
441
442 strv_sort(l);
443
444 r = sd_bus_message_append_strv(reply, l);
445 if (r < 0)
446 return r;
447
448 return sd_bus_message_close_container(reply);
449}
450
57183d11
LP		 451static int property_get_syscall_archs(
452 sd_bus *bus,
453 const char *path,
454 const char *interface,
455 const char *property,
456 sd_bus_message *reply,
457 void *userdata,
458 sd_bus_error *error) {
459
57183d11
LP		 460 _cleanup_strv_free_ char **l = NULL;
461 int r;
462
57183d11
LP		 463 assert(bus);
464 assert(reply);
17df7223 465
349cc4a5 466#if HAVE_SECCOMP
d5a99b7c 467 void *id;
48b74909 468 SET_FOREACH(id, ASSERT_PTR((ExecContext*) userdata)->syscall_archs) {
57183d11
LP		 469 const char *name;
470
471 name = seccomp_arch_to_string(PTR_TO_UINT32(id) - 1);
472 if (!name)
473 continue;
474
475 r = strv_extend(&l, name);
476 if (r < 0)
477 return -ENOMEM;
17df7223 478 }
57183d11
LP		 479#endif
480
481 strv_sort(l);
482
483 r = sd_bus_message_append_strv(reply, l);
484 if (r < 0)
485 return r;
17df7223 486
57183d11 487 return 0;
17df7223
LP		 488}
489
5f8640fb
LP		 490static int property_get_selinux_context(
491 sd_bus *bus,
492 const char *path,
493 const char *interface,
494 const char *property,
495 sd_bus_message *reply,
496 void *userdata,
497 sd_bus_error *error) {
498
99534007 499 ExecContext *c = ASSERT_PTR(userdata);
5f8640fb
LP		 500
501 assert(bus);
502 assert(reply);
5f8640fb
LP		 503
504 return sd_bus_message_append(reply, "(bs)", c->selinux_context_ignore, c->selinux_context);
505}
506
eef65bf3
MS		 507static int property_get_apparmor_profile(
508 sd_bus *bus,
509 const char *path,
510 const char *interface,
511 const char *property,
512 sd_bus_message *reply,
513 void *userdata,
514 sd_bus_error *error) {
515
99534007 516 ExecContext *c = ASSERT_PTR(userdata);
eef65bf3
MS		 517
518 assert(bus);
519 assert(reply);
eef65bf3
MS		 520
521 return sd_bus_message_append(reply, "(bs)", c->apparmor_profile_ignore, c->apparmor_profile);
522}
523
2ca620c4
WC		 524static int property_get_smack_process_label(
525 sd_bus *bus,
526 const char *path,
527 const char *interface,
528 const char *property,
529 sd_bus_message *reply,
530 void *userdata,
531 sd_bus_error *error) {
532
99534007 533 ExecContext *c = ASSERT_PTR(userdata);
2ca620c4
WC		 534
535 assert(bus);
536 assert(reply);
2ca620c4
WC		 537
538 return sd_bus_message_append(reply, "(bs)", c->smack_process_label_ignore, c->smack_process_label);
539}
540
4298d0b5
LP		 541static int property_get_address_families(
542 sd_bus *bus,
543 const char *path,
544 const char *interface,
545 const char *property,
546 sd_bus_message *reply,
547 void *userdata,
548 sd_bus_error *error) {
549
99534007 550 ExecContext *c = ASSERT_PTR(userdata);
4298d0b5 551 _cleanup_strv_free_ char **l = NULL;
4298d0b5
LP		 552 void *af;
553 int r;
554
555 assert(bus);
556 assert(reply);
4298d0b5
LP		 557
558 r = sd_bus_message_open_container(reply, 'r', "bas");
559 if (r < 0)
560 return r;
561
6b000af4 562 r = sd_bus_message_append(reply, "b", c->address_families_allow_list);
4298d0b5
LP		 563 if (r < 0)
564 return r;
565
90e74a66 566 SET_FOREACH(af, c->address_families) {
4298d0b5
LP		 567 const char *name;
568
569 name = af_to_name(PTR_TO_INT(af));
570 if (!name)
571 continue;
572
573 r = strv_extend(&l, name);
574 if (r < 0)
575 return -ENOMEM;
576 }
577
578 strv_sort(l);
579
580 r = sd_bus_message_append_strv(reply, l);
581 if (r < 0)
582 return r;
583
584 return sd_bus_message_close_container(reply);
585}
586
5f5d8eab
LP		 587static int property_get_working_directory(
588 sd_bus *bus,
589 const char *path,
590 const char *interface,
591 const char *property,
592 sd_bus_message *reply,
593 void *userdata,
594 sd_bus_error *error) {
595
99534007 596 ExecContext *c = ASSERT_PTR(userdata);
5f5d8eab
LP		 597 const char *wd;
598
599 assert(bus);
600 assert(reply);
5f5d8eab
LP		 601
602 if (c->working_directory_home)
603 wd = "~";
604 else
605 wd = c->working_directory;
606
607 if (c->working_directory_missing_ok)
608 wd = strjoina("!", wd);
609
610 return sd_bus_message_append(reply, "s", wd);
611}
612
5073ff6b 613static int property_get_stdio_fdname(
52c239d7
LB		 614 sd_bus *bus,
615 const char *path,
616 const char *interface,
617 const char *property,
618 sd_bus_message *reply,
619 void *userdata,
620 sd_bus_error *error) {
621
99534007 622 ExecContext *c = ASSERT_PTR(userdata);
5073ff6b 623 int fileno;
52c239d7
LB		 624
625 assert(bus);
52c239d7
LB		 626 assert(property);
627 assert(reply);
628
5073ff6b
LP		 629 if (streq(property, "StandardInputFileDescriptorName"))
630 fileno = STDIN_FILENO;
631 else if (streq(property, "StandardOutputFileDescriptorName"))
632 fileno = STDOUT_FILENO;
633 else {
634 assert(streq(property, "StandardErrorFileDescriptorName"));
635 fileno = STDERR_FILENO;
636 }
52c239d7 637
5073ff6b 638 return sd_bus_message_append(reply, "s", exec_context_fdname(c, fileno));
52c239d7
LB		 639}
640
08f3be7a 641static int property_get_input_data(
52c239d7
LB		 642 sd_bus *bus,
643 const char *path,
644 const char *interface,
645 const char *property,
646 sd_bus_message *reply,
647 void *userdata,
648 sd_bus_error *error) {
649
99534007 650 ExecContext *c = ASSERT_PTR(userdata);
52c239d7
LB		 651
652 assert(bus);
52c239d7
LB		 653 assert(property);
654 assert(reply);
655
08f3be7a 656 return sd_bus_message_append_array(reply, 'y', c->stdin_data, c->stdin_data_size);
52c239d7
LB		 657}
658
cc86a278
ILG		 659static int property_get_restrict_filesystems(
660 sd_bus *bus,
661 const char *path,
662 const char *interface,
663 const char *property,
664 sd_bus_message *reply,
665 void *userdata,
666 sd_bus_error *error) {
667
99534007 668 ExecContext *c = ASSERT_PTR(userdata);
cc86a278
ILG		 669 _cleanup_free_ char **l = NULL;
670 int r;
671
672 assert(bus);
673 assert(reply);
cc86a278
ILG		 674
675 r = sd_bus_message_open_container(reply, 'r', "bas");
676 if (r < 0)
677 return r;
678
679 r = sd_bus_message_append(reply, "b", c->restrict_filesystems_allow_list);
680 if (r < 0)
681 return r;
682
683#if HAVE_LIBBPF
684 l = set_get_strv(c->restrict_filesystems);
685 if (!l)
686 return -ENOMEM;
687#endif
688
689 strv_sort(l);
690
691 r = sd_bus_message_append_strv(reply, l);
692 if (r < 0)
693 return r;
694
695 return sd_bus_message_close_container(reply);
696}
697
d2d6c096
LP		 698static int property_get_bind_paths(
699 sd_bus *bus,
700 const char *path,
701 const char *interface,
702 const char *property,
703 sd_bus_message *reply,
704 void *userdata,
705 sd_bus_error *error) {
706
99534007 707 ExecContext *c = ASSERT_PTR(userdata);
d2d6c096
LP		 708 bool ro;
709 int r;
710
711 assert(bus);
d2d6c096
LP		 712 assert(property);
713 assert(reply);
714
5d904a6a 715 ro = strstr(property, "ReadOnly");
d2d6c096
LP		 716
717 r = sd_bus_message_open_container(reply, 'a', "(ssbt)");
718 if (r < 0)
719 return r;
720
fe96c0f8 721 for (size_t i = 0; i < c->n_bind_mounts; i++) {
d2d6c096
LP		 722
723 if (ro != c->bind_mounts[i].read_only)
724 continue;
725
726 r = sd_bus_message_append(
727 reply, "(ssbt)",
728 c->bind_mounts[i].source,
729 c->bind_mounts[i].destination,
730 c->bind_mounts[i].ignore_enoent,
c9b06108 731 c->bind_mounts[i].recursive ? (uint64_t) MS_REC : (uint64_t) 0);
d2d6c096
LP		 732 if (r < 0)
733 return r;
734 }
735
736 return sd_bus_message_close_container(reply);
737}
738
784ad252
YW		 739static int property_get_temporary_filesystems(
740 sd_bus *bus,
741 const char *path,
742 const char *interface,
743 const char *property,
744 sd_bus_message *reply,
745 void *userdata,
746 sd_bus_error *error) {
747
99534007 748 ExecContext *c = ASSERT_PTR(userdata);
784ad252
YW		 749 int r;
750
751 assert(bus);
784ad252
YW		 752 assert(property);
753 assert(reply);
754
755 r = sd_bus_message_open_container(reply, 'a', "(ss)");
756 if (r < 0)
757 return r;
758
fe96c0f8 759 for (unsigned i = 0; i < c->n_temporary_filesystems; i++) {
784ad252
YW		 760 TemporaryFileSystem *t = c->temporary_filesystems + i;
761
762 r = sd_bus_message_append(
763 reply, "(ss)",
764 t->path,
765 t->options);
766 if (r < 0)
767 return r;
768 }
769
770 return sd_bus_message_close_container(reply);
771}
772
d3070fbd
LP		 773static int property_get_log_extra_fields(
774 sd_bus *bus,
775 const char *path,
776 const char *interface,
777 const char *property,
778 sd_bus_message *reply,
779 void *userdata,
780 sd_bus_error *error) {
781
99534007 782 ExecContext *c = ASSERT_PTR(userdata);
d3070fbd
LP		 783 int r;
784
785 assert(bus);
d3070fbd
LP		 786 assert(property);
787 assert(reply);
788
789 r = sd_bus_message_open_container(reply, 'a', "ay");
790 if (r < 0)
791 return r;
792
fe96c0f8 793 for (size_t i = 0; i < c->n_log_extra_fields; i++) {
d3070fbd
LP		 794 r = sd_bus_message_append_array(reply, 'y', c->log_extra_fields[i].iov_base, c->log_extra_fields[i].iov_len);
795 if (r < 0)
796 return r;
797 }
798
799 return sd_bus_message_close_container(reply);
800}
801
bb0c0d6f
LP		 802static int property_get_set_credential(
803 sd_bus *bus,
804 const char *path,
805 const char *interface,
806 const char *property,
807 sd_bus_message *reply,
808 void *userdata,
809 sd_bus_error *error) {
810
99534007 811 ExecContext *c = ASSERT_PTR(userdata);
bb0c0d6f 812 ExecSetCredential *sc;
bb0c0d6f
LP		 813 int r;
814
815 assert(bus);
bb0c0d6f
LP		 816 assert(property);
817 assert(reply);
818
819 r = sd_bus_message_open_container(reply, 'a', "(say)");
820 if (r < 0)
821 return r;
822
90e74a66 823 HASHMAP_FOREACH(sc, c->set_credentials) {
bb0c0d6f 824
43144be4
LP		 825 if (sc->encrypted != streq(property, "SetCredentialEncrypted"))
826 continue;
827
bb0c0d6f
LP		 828 r = sd_bus_message_open_container(reply, 'r', "say");
829 if (r < 0)
830 return r;
831
832 r = sd_bus_message_append(reply, "s", sc->id);
833 if (r < 0)
834 return r;
835
836 r = sd_bus_message_append_array(reply, 'y', sc->data, sc->size);
837 if (r < 0)
838 return r;
839
840 r = sd_bus_message_close_container(reply);
841 if (r < 0)
842 return r;
843 }
844
845 return sd_bus_message_close_container(reply);
846}
847
848static int property_get_load_credential(
849 sd_bus *bus,
850 const char *path,
851 const char *interface,
852 const char *property,
853 sd_bus_message *reply,
854 void *userdata,
855 sd_bus_error *error) {
856
99534007 857 ExecContext *c = ASSERT_PTR(userdata);
43144be4 858 ExecLoadCredential *lc;
bb0c0d6f
LP		 859 int r;
860
861 assert(bus);
bb0c0d6f
LP		 862 assert(property);
863 assert(reply);
864
865 r = sd_bus_message_open_container(reply, 'a', "(ss)");
866 if (r < 0)
867 return r;
868
43144be4
LP		 869 HASHMAP_FOREACH(lc, c->load_credentials) {
870
871 if (lc->encrypted != streq(property, "LoadCredentialEncrypted"))
872 continue;
873
874 r = sd_bus_message_append(reply, "(ss)", lc->id, lc->path);
bb0c0d6f
LP		 875 if (r < 0)
876 return r;
877 }
878
879 return sd_bus_message_close_container(reply);
880}
881
0389f4fa
LB		 882static int property_get_root_hash(
883 sd_bus *bus,
884 const char *path,
885 const char *interface,
886 const char *property,
887 sd_bus_message *reply,
888 void *userdata,
889 sd_bus_error *error) {
890
99534007 891 ExecContext *c = ASSERT_PTR(userdata);
0389f4fa
LB		 892
893 assert(bus);
0389f4fa
LB		 894 assert(property);
895 assert(reply);
896
897 return sd_bus_message_append_array(reply, 'y', c->root_hash, c->root_hash_size);
898}
899
d4d55b0d
LB		 900static int property_get_root_hash_sig(
901 sd_bus *bus,
902 const char *path,
903 const char *interface,
904 const char *property,
905 sd_bus_message *reply,
906 void *userdata,
907 sd_bus_error *error) {
908
99534007 909 ExecContext *c = ASSERT_PTR(userdata);
d4d55b0d
LB		 910
911 assert(bus);
d4d55b0d
LB		 912 assert(property);
913 assert(reply);
914
915 return sd_bus_message_append_array(reply, 'y', c->root_hash_sig, c->root_hash_sig_size);
916}
917
18d73705
LB		 918static int property_get_root_image_options(
919 sd_bus *bus,
920 const char *path,
921 const char *interface,
922 const char *property,
923 sd_bus_message *reply,
924 void *userdata,
925 sd_bus_error *error) {
926
99534007 927 ExecContext *c = ASSERT_PTR(userdata);
18d73705
LB		 928 int r;
929
930 assert(bus);
18d73705
LB		 931 assert(property);
932 assert(reply);
933
9ece6444 934 r = sd_bus_message_open_container(reply, 'a', "(ss)");
18d73705
LB		 935 if (r < 0)
936 return r;
937
938 LIST_FOREACH(mount_options, m, c->root_image_options) {
9ece6444
LB		 939 r = sd_bus_message_append(reply, "(ss)",
940 partition_designator_to_string(m->partition_designator),
941 m->options);
18d73705
LB		 942 if (r < 0)
943 return r;
944 }
945
946 return sd_bus_message_close_container(reply);
947}
948
b3d13314
LB		 949static int property_get_mount_images(
950 sd_bus *bus,
951 const char *path,
952 const char *interface,
953 const char *property,
954 sd_bus_message *reply,
955 void *userdata,
956 sd_bus_error *error) {
957
99534007 958 ExecContext *c = ASSERT_PTR(userdata);
b3d13314
LB		 959 int r;
960
961 assert(bus);
b3d13314
LB		 962 assert(property);
963 assert(reply);
964
427353f6 965 r = sd_bus_message_open_container(reply, 'a', "(ssba(ss))");
b3d13314
LB		 966 if (r < 0)
967 return r;
968
969 for (size_t i = 0; i < c->n_mount_images; i++) {
427353f6
LB		 970 r = sd_bus_message_open_container(reply, SD_BUS_TYPE_STRUCT, "ssba(ss)");
971 if (r < 0)
972 return r;
b3d13314 973 r = sd_bus_message_append(
427353f6 974 reply, "ssb",
b3d13314
LB		 975 c->mount_images[i].source,
976 c->mount_images[i].destination,
977 c->mount_images[i].ignore_enoent);
978 if (r < 0)
979 return r;
427353f6
LB		 980 r = sd_bus_message_open_container(reply, 'a', "(ss)");
981 if (r < 0)
982 return r;
983 LIST_FOREACH(mount_options, m, c->mount_images[i].mount_options) {
984 r = sd_bus_message_append(reply, "(ss)",
985 partition_designator_to_string(m->partition_designator),
986 m->options);
987 if (r < 0)
988 return r;
989 }
990 r = sd_bus_message_close_container(reply);
991 if (r < 0)
992 return r;
993 r = sd_bus_message_close_container(reply);
994 if (r < 0)
995 return r;
b3d13314
LB		 996 }
997
998 return sd_bus_message_close_container(reply);
999}
1000
93f59701
LB		 1001static int property_get_extension_images(
1002 sd_bus *bus,
1003 const char *path,
1004 const char *interface,
1005 const char *property,
1006 sd_bus_message *reply,
1007 void *userdata,
1008 sd_bus_error *error) {
1009
99534007 1010 ExecContext *c = ASSERT_PTR(userdata);
93f59701
LB		 1011 int r;
1012
1013 assert(bus);
93f59701
LB		 1014 assert(property);
1015 assert(reply);
1016
1017 r = sd_bus_message_open_container(reply, 'a', "(sba(ss))");
1018 if (r < 0)
1019 return r;
1020
1021 for (size_t i = 0; i < c->n_extension_images; i++) {
93f59701
LB		 1022 r = sd_bus_message_open_container(reply, SD_BUS_TYPE_STRUCT, "sba(ss)");
1023 if (r < 0)
1024 return r;
1025 r = sd_bus_message_append(
1026 reply, "sb",
1027 c->extension_images[i].source,
1028 c->extension_images[i].ignore_enoent);
1029 if (r < 0)
1030 return r;
1031 r = sd_bus_message_open_container(reply, 'a', "(ss)");
1032 if (r < 0)
1033 return r;
1034 LIST_FOREACH(mount_options, m, c->extension_images[i].mount_options) {
1035 r = sd_bus_message_append(reply, "(ss)",
1036 partition_designator_to_string(m->partition_designator),
1037 m->options);
1038 if (r < 0)
1039 return r;
1040 }
1041 r = sd_bus_message_close_container(reply);
1042 if (r < 0)
1043 return r;
1044 r = sd_bus_message_close_container(reply);
1045 if (r < 0)
1046 return r;
1047 }
1048
1049 return sd_bus_message_close_container(reply);
1050}
1051
211a3d87
LB		 1052static int bus_property_get_exec_dir(
1053 sd_bus *bus,
1054 const char *path,
1055 const char *interface,
1056 const char *property,
1057 sd_bus_message *reply,
1058 void *userdata,
1059 sd_bus_error *error) {
1060
99534007 1061 ExecDirectory *d = ASSERT_PTR(userdata);
211a3d87
LB		 1062 int r;
1063
1064 assert(bus);
211a3d87
LB		 1065 assert(property);
1066 assert(reply);
1067
1068 r = sd_bus_message_open_container(reply, 'a', "s");
1069 if (r < 0)
1070 return r;
1071
1072 for (size_t i = 0; i < d->n_items; i++) {
1073 r = sd_bus_message_append_basic(reply, 's', d->items[i].path);
1074 if (r < 0)
1075 return r;
1076 }
1077
1078 return sd_bus_message_close_container(reply);
1079}
1080
1081static int bus_property_get_exec_dir_symlink(
1082 sd_bus *bus,
1083 const char *path,
1084 const char *interface,
1085 const char *property,
1086 sd_bus_message *reply,
1087 void *userdata,
1088 sd_bus_error *error) {
1089
99534007 1090 ExecDirectory *d = ASSERT_PTR(userdata);
211a3d87
LB		 1091 int r;
1092
1093 assert(bus);
211a3d87
LB		 1094 assert(property);
1095 assert(reply);
1096
1097 r = sd_bus_message_open_container(reply, 'a', "(sst)");
1098 if (r < 0)
1099 return r;
1100
de010b0b 1101 for (size_t i = 0; i < d->n_items; i++)
211a3d87
LB		 1102 STRV_FOREACH(dst, d->items[i].symlinks) {
1103 r = sd_bus_message_append(reply, "(sst)", d->items[i].path, *dst, 0 /* flags, unused for now */);
1104 if (r < 0)
1105 return r;
1106 }
211a3d87
LB		 1107
1108 return sd_bus_message_close_container(reply);
1109}
1110
718db961
LP		 1111const sd_bus_vtable bus_exec_vtable[] = {
1112 SD_BUS_VTABLE_START(0),
556089dc
LP		 1113 SD_BUS_PROPERTY("Environment", "as", NULL, offsetof(ExecContext, environment), SD_BUS_VTABLE_PROPERTY_CONST),
1114 SD_BUS_PROPERTY("EnvironmentFiles", "a(sb)", property_get_environment_files, 0, SD_BUS_VTABLE_PROPERTY_CONST),
b4c14404 1115 SD_BUS_PROPERTY("PassEnvironment", "as", NULL, offsetof(ExecContext, pass_environment), SD_BUS_VTABLE_PROPERTY_CONST),
00819cc1 1116 SD_BUS_PROPERTY("UnsetEnvironment", "as", NULL, offsetof(ExecContext, unset_environment), SD_BUS_VTABLE_PROPERTY_CONST),
556089dc 1117 SD_BUS_PROPERTY("UMask", "u", bus_property_get_mode, offsetof(ExecContext, umask), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1118 SD_BUS_PROPERTY("LimitCPU", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_CPU]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1119 SD_BUS_PROPERTY("LimitCPUSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_CPU]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1120 SD_BUS_PROPERTY("LimitFSIZE", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_FSIZE]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1121 SD_BUS_PROPERTY("LimitFSIZESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_FSIZE]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1122 SD_BUS_PROPERTY("LimitDATA", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_DATA]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1123 SD_BUS_PROPERTY("LimitDATASoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_DATA]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1124 SD_BUS_PROPERTY("LimitSTACK", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_STACK]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1125 SD_BUS_PROPERTY("LimitSTACKSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_STACK]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1126 SD_BUS_PROPERTY("LimitCORE", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_CORE]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1127 SD_BUS_PROPERTY("LimitCORESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_CORE]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1128 SD_BUS_PROPERTY("LimitRSS", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RSS]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1129 SD_BUS_PROPERTY("LimitRSSSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RSS]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1130 SD_BUS_PROPERTY("LimitNOFILE", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NOFILE]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1131 SD_BUS_PROPERTY("LimitNOFILESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NOFILE]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1132 SD_BUS_PROPERTY("LimitAS", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_AS]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1133 SD_BUS_PROPERTY("LimitASSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_AS]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1134 SD_BUS_PROPERTY("LimitNPROC", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NPROC]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1135 SD_BUS_PROPERTY("LimitNPROCSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NPROC]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1136 SD_BUS_PROPERTY("LimitMEMLOCK", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_MEMLOCK]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1137 SD_BUS_PROPERTY("LimitMEMLOCKSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_MEMLOCK]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1138 SD_BUS_PROPERTY("LimitLOCKS", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_LOCKS]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1139 SD_BUS_PROPERTY("LimitLOCKSSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_LOCKS]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1140 SD_BUS_PROPERTY("LimitSIGPENDING", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_SIGPENDING]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1141 SD_BUS_PROPERTY("LimitSIGPENDINGSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_SIGPENDING]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1142 SD_BUS_PROPERTY("LimitMSGQUEUE", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_MSGQUEUE]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1143 SD_BUS_PROPERTY("LimitMSGQUEUESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_MSGQUEUE]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1144 SD_BUS_PROPERTY("LimitNICE", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NICE]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1145 SD_BUS_PROPERTY("LimitNICESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_NICE]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1146 SD_BUS_PROPERTY("LimitRTPRIO", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RTPRIO]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1147 SD_BUS_PROPERTY("LimitRTPRIOSoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RTPRIO]), SD_BUS_VTABLE_PROPERTY_CONST),
c9d031c3 1148 SD_BUS_PROPERTY("LimitRTTIME", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RTTIME]), SD_BUS_VTABLE_PROPERTY_CONST),
147f6858 1149 SD_BUS_PROPERTY("LimitRTTIMESoft", "t", bus_property_get_rlimit, offsetof(ExecContext, rlimit[RLIMIT_RTTIME]), SD_BUS_VTABLE_PROPERTY_CONST),
5f5d8eab 1150 SD_BUS_PROPERTY("WorkingDirectory", "s", property_get_working_directory, 0, SD_BUS_VTABLE_PROPERTY_CONST),
556089dc 1151 SD_BUS_PROPERTY("RootDirectory", "s", NULL, offsetof(ExecContext, root_directory), SD_BUS_VTABLE_PROPERTY_CONST),
915e6d16 1152 SD_BUS_PROPERTY("RootImage", "s", NULL, offsetof(ExecContext, root_image), SD_BUS_VTABLE_PROPERTY_CONST),
9ece6444 1153 SD_BUS_PROPERTY("RootImageOptions", "a(ss)", property_get_root_image_options, 0, SD_BUS_VTABLE_PROPERTY_CONST),
0389f4fa
LB		 1154 SD_BUS_PROPERTY("RootHash", "ay", property_get_root_hash, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1155 SD_BUS_PROPERTY("RootHashPath", "s", NULL, offsetof(ExecContext, root_hash_path), SD_BUS_VTABLE_PROPERTY_CONST),
d4d55b0d
LB		 1156 SD_BUS_PROPERTY("RootHashSignature", "ay", property_get_root_hash_sig, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1157 SD_BUS_PROPERTY("RootHashSignaturePath", "s", NULL, offsetof(ExecContext, root_hash_sig_path), SD_BUS_VTABLE_PROPERTY_CONST),
0389f4fa 1158 SD_BUS_PROPERTY("RootVerity", "s", NULL, offsetof(ExecContext, root_verity), SD_BUS_VTABLE_PROPERTY_CONST),
a07b9926 1159 SD_BUS_PROPERTY("ExtensionDirectories", "as", NULL, offsetof(ExecContext, extension_directories), SD_BUS_VTABLE_PROPERTY_CONST),
93f59701 1160 SD_BUS_PROPERTY("ExtensionImages", "a(sba(ss))", property_get_extension_images, 0, SD_BUS_VTABLE_PROPERTY_CONST),
427353f6 1161 SD_BUS_PROPERTY("MountImages", "a(ssba(ss))", property_get_mount_images, 0, SD_BUS_VTABLE_PROPERTY_CONST),
556089dc 1162 SD_BUS_PROPERTY("OOMScoreAdjust", "i", property_get_oom_score_adjust, 0, SD_BUS_VTABLE_PROPERTY_CONST),
ad21e542 1163 SD_BUS_PROPERTY("CoredumpFilter", "t", property_get_coredump_filter, 0, SD_BUS_VTABLE_PROPERTY_CONST),
556089dc 1164 SD_BUS_PROPERTY("Nice", "i", property_get_nice, 0, SD_BUS_VTABLE_PROPERTY_CONST),
7f452159
LP		 1165 SD_BUS_PROPERTY("IOSchedulingClass", "i", property_get_ioprio_class, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1166 SD_BUS_PROPERTY("IOSchedulingPriority", "i", property_get_ioprio_priority, 0, SD_BUS_VTABLE_PROPERTY_CONST),
556089dc
LP		 1167 SD_BUS_PROPERTY("CPUSchedulingPolicy", "i", property_get_cpu_sched_policy, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1168 SD_BUS_PROPERTY("CPUSchedulingPriority", "i", property_get_cpu_sched_priority, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1169 SD_BUS_PROPERTY("CPUAffinity", "ay", property_get_cpu_affinity, 0, SD_BUS_VTABLE_PROPERTY_CONST),
e2b2fb7f 1170 SD_BUS_PROPERTY("CPUAffinityFromNUMA", "b", property_get_cpu_affinity_from_numa, 0, SD_BUS_VTABLE_PROPERTY_CONST),
b070c7c0
MS		 1171 SD_BUS_PROPERTY("NUMAPolicy", "i", property_get_numa_policy, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1172 SD_BUS_PROPERTY("NUMAMask", "ay", property_get_numa_mask, 0, SD_BUS_VTABLE_PROPERTY_CONST),
556089dc
LP		 1173 SD_BUS_PROPERTY("TimerSlackNSec", "t", property_get_timer_slack_nsec, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1174 SD_BUS_PROPERTY("CPUSchedulingResetOnFork", "b", bus_property_get_bool, offsetof(ExecContext, cpu_sched_reset_on_fork), SD_BUS_VTABLE_PROPERTY_CONST),
1175 SD_BUS_PROPERTY("NonBlocking", "b", bus_property_get_bool, offsetof(ExecContext, non_blocking), SD_BUS_VTABLE_PROPERTY_CONST),
1176 SD_BUS_PROPERTY("StandardInput", "s", property_get_exec_input, offsetof(ExecContext, std_input), SD_BUS_VTABLE_PROPERTY_CONST),
5073ff6b 1177 SD_BUS_PROPERTY("StandardInputFileDescriptorName", "s", property_get_stdio_fdname, 0, SD_BUS_VTABLE_PROPERTY_CONST),
08f3be7a 1178 SD_BUS_PROPERTY("StandardInputData", "ay", property_get_input_data, 0, SD_BUS_VTABLE_PROPERTY_CONST),
556089dc 1179 SD_BUS_PROPERTY("StandardOutput", "s", bus_property_get_exec_output, offsetof(ExecContext, std_output), SD_BUS_VTABLE_PROPERTY_CONST),
5073ff6b 1180 SD_BUS_PROPERTY("StandardOutputFileDescriptorName", "s", property_get_stdio_fdname, 0, SD_BUS_VTABLE_PROPERTY_CONST),
556089dc 1181 SD_BUS_PROPERTY("StandardError", "s", bus_property_get_exec_output, offsetof(ExecContext, std_error), SD_BUS_VTABLE_PROPERTY_CONST),
5073ff6b 1182 SD_BUS_PROPERTY("StandardErrorFileDescriptorName", "s", property_get_stdio_fdname, 0, SD_BUS_VTABLE_PROPERTY_CONST),
556089dc
LP		 1183 SD_BUS_PROPERTY("TTYPath", "s", NULL, offsetof(ExecContext, tty_path), SD_BUS_VTABLE_PROPERTY_CONST),
1184 SD_BUS_PROPERTY("TTYReset", "b", bus_property_get_bool, offsetof(ExecContext, tty_reset), SD_BUS_VTABLE_PROPERTY_CONST),
1185 SD_BUS_PROPERTY("TTYVHangup", "b", bus_property_get_bool, offsetof(ExecContext, tty_vhangup), SD_BUS_VTABLE_PROPERTY_CONST),
1186 SD_BUS_PROPERTY("TTYVTDisallocate", "b", bus_property_get_bool, offsetof(ExecContext, tty_vt_disallocate), SD_BUS_VTABLE_PROPERTY_CONST),
51462135
DDM		 1187 SD_BUS_PROPERTY("TTYRows", "q", bus_property_get_unsigned, offsetof(ExecContext, tty_rows), SD_BUS_VTABLE_PROPERTY_CONST),
1188 SD_BUS_PROPERTY("TTYColumns", "q", bus_property_get_unsigned, offsetof(ExecContext, tty_cols), SD_BUS_VTABLE_PROPERTY_CONST),
556089dc
LP		 1189 SD_BUS_PROPERTY("SyslogPriority", "i", bus_property_get_int, offsetof(ExecContext, syslog_priority), SD_BUS_VTABLE_PROPERTY_CONST),
1190 SD_BUS_PROPERTY("SyslogIdentifier", "s", NULL, offsetof(ExecContext, syslog_identifier), SD_BUS_VTABLE_PROPERTY_CONST),
1191 SD_BUS_PROPERTY("SyslogLevelPrefix", "b", bus_property_get_bool, offsetof(ExecContext, syslog_level_prefix), SD_BUS_VTABLE_PROPERTY_CONST),
9d5527f2
YW		 1192 SD_BUS_PROPERTY("SyslogLevel", "i", property_get_syslog_level, offsetof(ExecContext, syslog_priority), SD_BUS_VTABLE_PROPERTY_CONST),
1193 SD_BUS_PROPERTY("SyslogFacility", "i", property_get_syslog_facility, offsetof(ExecContext, syslog_priority), SD_BUS_VTABLE_PROPERTY_CONST),
d3070fbd 1194 SD_BUS_PROPERTY("LogLevelMax", "i", bus_property_get_int, offsetof(ExecContext, log_level_max), SD_BUS_VTABLE_PROPERTY_CONST),
5ac1530e
ZJS		 1195 SD_BUS_PROPERTY("LogRateLimitIntervalUSec", "t", bus_property_get_usec, offsetof(ExecContext, log_ratelimit_interval_usec), SD_BUS_VTABLE_PROPERTY_CONST),
1196 SD_BUS_PROPERTY("LogRateLimitBurst", "u", bus_property_get_unsigned, offsetof(ExecContext, log_ratelimit_burst), SD_BUS_VTABLE_PROPERTY_CONST),
d3070fbd 1197 SD_BUS_PROPERTY("LogExtraFields", "aay", property_get_log_extra_fields, 0, SD_BUS_VTABLE_PROPERTY_CONST),
91dd5f7c 1198 SD_BUS_PROPERTY("LogNamespace", "s", NULL, offsetof(ExecContext, log_namespace), SD_BUS_VTABLE_PROPERTY_CONST),
556089dc 1199 SD_BUS_PROPERTY("SecureBits", "i", bus_property_get_int, offsetof(ExecContext, secure_bits), SD_BUS_VTABLE_PROPERTY_CONST),
c0159e20
YW		 1200 SD_BUS_PROPERTY("CapabilityBoundingSet", "t", NULL, offsetof(ExecContext, capability_bounding_set), SD_BUS_VTABLE_PROPERTY_CONST),
1201 SD_BUS_PROPERTY("AmbientCapabilities", "t", NULL, offsetof(ExecContext, capability_ambient_set), SD_BUS_VTABLE_PROPERTY_CONST),
556089dc
LP		 1202 SD_BUS_PROPERTY("User", "s", NULL, offsetof(ExecContext, user), SD_BUS_VTABLE_PROPERTY_CONST),
1203 SD_BUS_PROPERTY("Group", "s", NULL, offsetof(ExecContext, group), SD_BUS_VTABLE_PROPERTY_CONST),
29206d46 1204 SD_BUS_PROPERTY("DynamicUser", "b", bus_property_get_bool, offsetof(ExecContext, dynamic_user), SD_BUS_VTABLE_PROPERTY_CONST),
00d9ef85 1205 SD_BUS_PROPERTY("RemoveIPC", "b", bus_property_get_bool, offsetof(ExecContext, remove_ipc), SD_BUS_VTABLE_PROPERTY_CONST),
bb0c0d6f 1206 SD_BUS_PROPERTY("SetCredential", "a(say)", property_get_set_credential, 0, SD_BUS_VTABLE_PROPERTY_CONST),
43144be4 1207 SD_BUS_PROPERTY("SetCredentialEncrypted", "a(say)", property_get_set_credential, 0, SD_BUS_VTABLE_PROPERTY_CONST),
bb0c0d6f 1208 SD_BUS_PROPERTY("LoadCredential", "a(ss)", property_get_load_credential, 0, SD_BUS_VTABLE_PROPERTY_CONST),
43144be4 1209 SD_BUS_PROPERTY("LoadCredentialEncrypted", "a(ss)", property_get_load_credential, 0, SD_BUS_VTABLE_PROPERTY_CONST),
556089dc 1210 SD_BUS_PROPERTY("SupplementaryGroups", "as", NULL, offsetof(ExecContext, supplementary_groups), SD_BUS_VTABLE_PROPERTY_CONST),
556089dc 1211 SD_BUS_PROPERTY("PAMName", "s", NULL, offsetof(ExecContext, pam_name), SD_BUS_VTABLE_PROPERTY_CONST),
2a624c36
AP		 1212 SD_BUS_PROPERTY("ReadWritePaths", "as", NULL, offsetof(ExecContext, read_write_paths), SD_BUS_VTABLE_PROPERTY_CONST),
1213 SD_BUS_PROPERTY("ReadOnlyPaths", "as", NULL, offsetof(ExecContext, read_only_paths), SD_BUS_VTABLE_PROPERTY_CONST),
1214 SD_BUS_PROPERTY("InaccessiblePaths", "as", NULL, offsetof(ExecContext, inaccessible_paths), SD_BUS_VTABLE_PROPERTY_CONST),
ddc155b2
TM		 1215 SD_BUS_PROPERTY("ExecPaths", "as", NULL, offsetof(ExecContext, exec_paths), SD_BUS_VTABLE_PROPERTY_CONST),
1216 SD_BUS_PROPERTY("NoExecPaths", "as", NULL, offsetof(ExecContext, no_exec_paths), SD_BUS_VTABLE_PROPERTY_CONST),
8c35c10d 1217 SD_BUS_PROPERTY("ExecSearchPath", "as", NULL, offsetof(ExecContext, exec_search_path), SD_BUS_VTABLE_PROPERTY_CONST),
556089dc
LP		 1218 SD_BUS_PROPERTY("MountFlags", "t", bus_property_get_ulong, offsetof(ExecContext, mount_flags), SD_BUS_VTABLE_PROPERTY_CONST),
1219 SD_BUS_PROPERTY("PrivateTmp", "b", bus_property_get_bool, offsetof(ExecContext, private_tmp), SD_BUS_VTABLE_PROPERTY_CONST),
7f112f50 1220 SD_BUS_PROPERTY("PrivateDevices", "b", bus_property_get_bool, offsetof(ExecContext, private_devices), SD_BUS_VTABLE_PROPERTY_CONST),
b8b7b838 1221 SD_BUS_PROPERTY("ProtectClock", "b", bus_property_get_bool, offsetof(ExecContext, protect_clock), SD_BUS_VTABLE_PROPERTY_CONST),
59eeb84b 1222 SD_BUS_PROPERTY("ProtectKernelTunables", "b", bus_property_get_bool, offsetof(ExecContext, protect_kernel_tunables), SD_BUS_VTABLE_PROPERTY_CONST),
502d704e 1223 SD_BUS_PROPERTY("ProtectKernelModules", "b", bus_property_get_bool, offsetof(ExecContext, protect_kernel_modules), SD_BUS_VTABLE_PROPERTY_CONST),
84703040 1224 SD_BUS_PROPERTY("ProtectKernelLogs", "b", bus_property_get_bool, offsetof(ExecContext, protect_kernel_logs), SD_BUS_VTABLE_PROPERTY_CONST),
59eeb84b 1225 SD_BUS_PROPERTY("ProtectControlGroups", "b", bus_property_get_bool, offsetof(ExecContext, protect_control_groups), SD_BUS_VTABLE_PROPERTY_CONST),
d251207d
LP		 1226 SD_BUS_PROPERTY("PrivateNetwork", "b", bus_property_get_bool, offsetof(ExecContext, private_network), SD_BUS_VTABLE_PROPERTY_CONST),
1227 SD_BUS_PROPERTY("PrivateUsers", "b", bus_property_get_bool, offsetof(ExecContext, private_users), SD_BUS_VTABLE_PROPERTY_CONST),
228af36f 1228 SD_BUS_PROPERTY("PrivateMounts", "b", bus_property_get_bool, offsetof(ExecContext, private_mounts), SD_BUS_VTABLE_PROPERTY_CONST),
a70581ff 1229 SD_BUS_PROPERTY("PrivateIPC", "b", bus_property_get_bool, offsetof(ExecContext, private_ipc), SD_BUS_VTABLE_PROPERTY_CONST),
73b84e92
YW		 1230 SD_BUS_PROPERTY("ProtectHome", "s", property_get_protect_home, offsetof(ExecContext, protect_home), SD_BUS_VTABLE_PROPERTY_CONST),
1231 SD_BUS_PROPERTY("ProtectSystem", "s", property_get_protect_system, offsetof(ExecContext, protect_system), SD_BUS_VTABLE_PROPERTY_CONST),
556089dc
LP		 1232 SD_BUS_PROPERTY("SameProcessGroup", "b", bus_property_get_bool, offsetof(ExecContext, same_pgrp), SD_BUS_VTABLE_PROPERTY_CONST),
1233 SD_BUS_PROPERTY("UtmpIdentifier", "s", NULL, offsetof(ExecContext, utmp_id), SD_BUS_VTABLE_PROPERTY_CONST),
023a4f67 1234 SD_BUS_PROPERTY("UtmpMode", "s", property_get_exec_utmp_mode, offsetof(ExecContext, utmp_mode), SD_BUS_VTABLE_PROPERTY_CONST),
5f8640fb 1235 SD_BUS_PROPERTY("SELinuxContext", "(bs)", property_get_selinux_context, 0, SD_BUS_VTABLE_PROPERTY_CONST),
eef65bf3 1236 SD_BUS_PROPERTY("AppArmorProfile", "(bs)", property_get_apparmor_profile, 0, SD_BUS_VTABLE_PROPERTY_CONST),
2ca620c4 1237 SD_BUS_PROPERTY("SmackProcessLabel", "(bs)", property_get_smack_process_label, 0, SD_BUS_VTABLE_PROPERTY_CONST),
556089dc
LP		 1238 SD_BUS_PROPERTY("IgnoreSIGPIPE", "b", bus_property_get_bool, offsetof(ExecContext, ignore_sigpipe), SD_BUS_VTABLE_PROPERTY_CONST),
1239 SD_BUS_PROPERTY("NoNewPrivileges", "b", bus_property_get_bool, offsetof(ExecContext, no_new_privileges), SD_BUS_VTABLE_PROPERTY_CONST),
57183d11
LP		 1240 SD_BUS_PROPERTY("SystemCallFilter", "(bas)", property_get_syscall_filter, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1241 SD_BUS_PROPERTY("SystemCallArchitectures", "as", property_get_syscall_archs, 0, SD_BUS_VTABLE_PROPERTY_CONST),
cf9d43a8 1242 SD_BUS_PROPERTY("SystemCallErrorNumber", "i", bus_property_get_int, offsetof(ExecContext, syscall_errno), SD_BUS_VTABLE_PROPERTY_CONST),
9df2cdd8 1243 SD_BUS_PROPERTY("SystemCallLog", "(bas)", property_get_syscall_log, 0, SD_BUS_VTABLE_PROPERTY_CONST),
491eecb3 1244 SD_BUS_PROPERTY("Personality", "s", property_get_personality, offsetof(ExecContext, personality), SD_BUS_VTABLE_PROPERTY_CONST),
78e864e5 1245 SD_BUS_PROPERTY("LockPersonality", "b", bus_property_get_bool, offsetof(ExecContext, lock_personality), SD_BUS_VTABLE_PROPERTY_CONST),
4298d0b5 1246 SD_BUS_PROPERTY("RestrictAddressFamilies", "(bas)", property_get_address_families, 0, SD_BUS_VTABLE_PROPERTY_CONST),
211a3d87 1247 SD_BUS_PROPERTY("RuntimeDirectorySymlink", "a(sst)", bus_property_get_exec_dir_symlink, offsetof(ExecContext, directories[EXEC_DIRECTORY_RUNTIME]), SD_BUS_VTABLE_PROPERTY_CONST),
53f47dfc 1248 SD_BUS_PROPERTY("RuntimeDirectoryPreserve", "s", property_get_exec_preserve_mode, offsetof(ExecContext, runtime_directory_preserve_mode), SD_BUS_VTABLE_PROPERTY_CONST),
3536f49e 1249 SD_BUS_PROPERTY("RuntimeDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, directories[EXEC_DIRECTORY_RUNTIME].mode), SD_BUS_VTABLE_PROPERTY_CONST),
211a3d87
LB		 1250 SD_BUS_PROPERTY("RuntimeDirectory", "as", bus_property_get_exec_dir, offsetof(ExecContext, directories[EXEC_DIRECTORY_RUNTIME]), SD_BUS_VTABLE_PROPERTY_CONST),
1251 SD_BUS_PROPERTY("StateDirectorySymlink", "a(sst)", bus_property_get_exec_dir_symlink, offsetof(ExecContext, directories[EXEC_DIRECTORY_STATE]), SD_BUS_VTABLE_PROPERTY_CONST),
e940c1ef 1252 SD_BUS_PROPERTY("StateDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, directories[EXEC_DIRECTORY_STATE].mode), SD_BUS_VTABLE_PROPERTY_CONST),
211a3d87
LB		 1253 SD_BUS_PROPERTY("StateDirectory", "as", bus_property_get_exec_dir, offsetof(ExecContext, directories[EXEC_DIRECTORY_STATE]), SD_BUS_VTABLE_PROPERTY_CONST),
1254 SD_BUS_PROPERTY("CacheDirectorySymlink", "a(sst)", bus_property_get_exec_dir_symlink, offsetof(ExecContext, directories[EXEC_DIRECTORY_CACHE]), SD_BUS_VTABLE_PROPERTY_CONST),
3536f49e 1255 SD_BUS_PROPERTY("CacheDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, directories[EXEC_DIRECTORY_CACHE].mode), SD_BUS_VTABLE_PROPERTY_CONST),
211a3d87
LB		 1256 SD_BUS_PROPERTY("CacheDirectory", "as", bus_property_get_exec_dir, offsetof(ExecContext, directories[EXEC_DIRECTORY_CACHE]), SD_BUS_VTABLE_PROPERTY_CONST),
1257 SD_BUS_PROPERTY("LogsDirectorySymlink", "a(sst)", bus_property_get_exec_dir_symlink, offsetof(ExecContext, directories[EXEC_DIRECTORY_LOGS]), SD_BUS_VTABLE_PROPERTY_CONST),
3536f49e 1258 SD_BUS_PROPERTY("LogsDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, directories[EXEC_DIRECTORY_LOGS].mode), SD_BUS_VTABLE_PROPERTY_CONST),
211a3d87 1259 SD_BUS_PROPERTY("LogsDirectory", "as", bus_property_get_exec_dir, offsetof(ExecContext, directories[EXEC_DIRECTORY_LOGS]), SD_BUS_VTABLE_PROPERTY_CONST),
3536f49e 1260 SD_BUS_PROPERTY("ConfigurationDirectoryMode", "u", bus_property_get_mode, offsetof(ExecContext, directories[EXEC_DIRECTORY_CONFIGURATION].mode), SD_BUS_VTABLE_PROPERTY_CONST),
211a3d87 1261 SD_BUS_PROPERTY("ConfigurationDirectory", "as", bus_property_get_exec_dir, offsetof(ExecContext, directories[EXEC_DIRECTORY_CONFIGURATION]), SD_BUS_VTABLE_PROPERTY_CONST),
12213aed 1262 SD_BUS_PROPERTY("TimeoutCleanUSec", "t", bus_property_get_usec, offsetof(ExecContext, timeout_clean_usec), SD_BUS_VTABLE_PROPERTY_CONST),
f3e43635 1263 SD_BUS_PROPERTY("MemoryDenyWriteExecute", "b", bus_property_get_bool, offsetof(ExecContext, memory_deny_write_execute), SD_BUS_VTABLE_PROPERTY_CONST),
f4170c67 1264 SD_BUS_PROPERTY("RestrictRealtime", "b", bus_property_get_bool, offsetof(ExecContext, restrict_realtime), SD_BUS_VTABLE_PROPERTY_CONST),
f69567cb 1265 SD_BUS_PROPERTY("RestrictSUIDSGID", "b", bus_property_get_bool, offsetof(ExecContext, restrict_suid_sgid), SD_BUS_VTABLE_PROPERTY_CONST),
6a8c2d59 1266 SD_BUS_PROPERTY("RestrictNamespaces", "t", bus_property_get_ulong, offsetof(ExecContext, restrict_namespaces), SD_BUS_VTABLE_PROPERTY_CONST),
cc86a278 1267 SD_BUS_PROPERTY("RestrictFileSystems", "(bas)", property_get_restrict_filesystems, 0, SD_BUS_VTABLE_PROPERTY_CONST),
d2d6c096
LP		 1268 SD_BUS_PROPERTY("BindPaths", "a(ssbt)", property_get_bind_paths, 0, SD_BUS_VTABLE_PROPERTY_CONST),
1269 SD_BUS_PROPERTY("BindReadOnlyPaths", "a(ssbt)", property_get_bind_paths, 0, SD_BUS_VTABLE_PROPERTY_CONST),
784ad252 1270 SD_BUS_PROPERTY("TemporaryFileSystem", "a(ss)", property_get_temporary_filesystems, 0, SD_BUS_VTABLE_PROPERTY_CONST),
5e98086d 1271 SD_BUS_PROPERTY("MountAPIVFS", "b", property_get_mount_apivfs, 0, SD_BUS_VTABLE_PROPERTY_CONST),
b1edf445 1272 SD_BUS_PROPERTY("KeyringMode", "s", property_get_exec_keyring_mode, offsetof(ExecContext, keyring_mode), SD_BUS_VTABLE_PROPERTY_CONST),
4e399953
LP		 1273 SD_BUS_PROPERTY("ProtectProc", "s", property_get_protect_proc, offsetof(ExecContext, protect_proc), SD_BUS_VTABLE_PROPERTY_CONST),
1274 SD_BUS_PROPERTY("ProcSubset", "s", property_get_proc_subset, offsetof(ExecContext, proc_subset), SD_BUS_VTABLE_PROPERTY_CONST),
aecd5ac6 1275 SD_BUS_PROPERTY("ProtectHostname", "b", bus_property_get_bool, offsetof(ExecContext, protect_hostname), SD_BUS_VTABLE_PROPERTY_CONST),
a8d08f39 1276 SD_BUS_PROPERTY("NetworkNamespacePath", "s", NULL, offsetof(ExecContext, network_namespace_path), SD_BUS_VTABLE_PROPERTY_CONST),
a70581ff 1277 SD_BUS_PROPERTY("IPCNamespacePath", "s", NULL, offsetof(ExecContext, ipc_namespace_path), SD_BUS_VTABLE_PROPERTY_CONST),
7f452159
LP		 1278
1279 /* Obsolete/redundant properties: */
1280 SD_BUS_PROPERTY("Capabilities", "s", property_get_empty_string, 0, SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
1281 SD_BUS_PROPERTY("ReadWriteDirectories", "as", NULL, offsetof(ExecContext, read_write_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
1282 SD_BUS_PROPERTY("ReadOnlyDirectories", "as", NULL, offsetof(ExecContext, read_only_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
1283 SD_BUS_PROPERTY("InaccessibleDirectories", "as", NULL, offsetof(ExecContext, inaccessible_paths), SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
1284 SD_BUS_PROPERTY("IOScheduling", "i", property_get_ioprio, 0, SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
1285
718db961
LP		 1286 SD_BUS_VTABLE_END
1287};
82c121a4 1288
4d4c80d0
LP		 1289static int append_exec_command(sd_bus_message *reply, ExecCommand *c) {
1290 int r;
1291
1292 assert(reply);
1293 assert(c);
1294
1295 if (!c->path)
1296 return 0;
1297
1298 r = sd_bus_message_open_container(reply, 'r', "sasbttttuii");
1299 if (r < 0)
1300 return r;
1301
1302 r = sd_bus_message_append(reply, "s", c->path);
1303 if (r < 0)
1304 return r;
1305
1306 r = sd_bus_message_append_strv(reply, c->argv);
1307 if (r < 0)
1308 return r;
1309
1310 r = sd_bus_message_append(reply, "bttttuii",
3ed0cd26 1311 !!(c->flags & EXEC_COMMAND_IGNORE_FAILURE),
4d4c80d0
LP		 1312 c->exec_status.start_timestamp.realtime,
1313 c->exec_status.start_timestamp.monotonic,
1314 c->exec_status.exit_timestamp.realtime,
1315 c->exec_status.exit_timestamp.monotonic,
1316 (uint32_t) c->exec_status.pid,
1317 (int32_t) c->exec_status.code,
1318 (int32_t) c->exec_status.status);
1319 if (r < 0)
1320 return r;
1321
1322 return sd_bus_message_close_container(reply);
1323}
1324
b3d59367
AZ		 1325static int append_exec_ex_command(sd_bus_message *reply, ExecCommand *c) {
1326 _cleanup_strv_free_ char **ex_opts = NULL;
1327 int r;
1328
1329 assert(reply);
1330 assert(c);
1331
1332 if (!c->path)
1333 return 0;
1334
1335 r = sd_bus_message_open_container(reply, 'r', "sasasttttuii");
1336 if (r < 0)
1337 return r;
1338
1339 r = sd_bus_message_append(reply, "s", c->path);
1340 if (r < 0)
1341 return r;
1342
1343 r = sd_bus_message_append_strv(reply, c->argv);
1344 if (r < 0)
1345 return r;
1346
1347 r = exec_command_flags_to_strv(c->flags, &ex_opts);
1348 if (r < 0)
1349 return r;
1350
1351 r = sd_bus_message_append_strv(reply, ex_opts);
1352 if (r < 0)
1353 return r;
1354
1355 r = sd_bus_message_append(reply, "ttttuii",
1356 c->exec_status.start_timestamp.realtime,
1357 c->exec_status.start_timestamp.monotonic,
1358 c->exec_status.exit_timestamp.realtime,
1359 c->exec_status.exit_timestamp.monotonic,
1360 (uint32_t) c->exec_status.pid,
1361 (int32_t) c->exec_status.code,
1362 (int32_t) c->exec_status.status);
1363 if (r < 0)
1364 return r;
1365
1366 return sd_bus_message_close_container(reply);
1367}
1368
718db961
LP		 1369int bus_property_get_exec_command(
1370 sd_bus *bus,
1371 const char *path,
1372 const char *interface,
1373 const char *property,
1374 sd_bus_message *reply,
ebcf1f97
LP		 1375 void *userdata,
1376 sd_bus_error *ret_error) {
fe68089d 1377
4d4c80d0 1378 ExecCommand *c = (ExecCommand*) userdata;
718db961 1379 int r;
fe68089d 1380
718db961
LP		 1381 assert(bus);
1382 assert(reply);
fe68089d 1383
718db961
LP		 1384 r = sd_bus_message_open_container(reply, 'a', "(sasbttttuii)");
1385 if (r < 0)
1386 return r;
fe68089d 1387
4d4c80d0
LP		 1388 r = append_exec_command(reply, c);
1389 if (r < 0)
1390 return r;
fe68089d 1391
4d4c80d0
LP		 1392 return sd_bus_message_close_container(reply);
1393}
718db961 1394
4d4c80d0
LP		 1395int bus_property_get_exec_command_list(
1396 sd_bus *bus,
1397 const char *path,
1398 const char *interface,
1399 const char *property,
1400 sd_bus_message *reply,
1401 void *userdata,
1402 sd_bus_error *ret_error) {
718db961 1403
03677889 1404 ExecCommand *exec_command = *(ExecCommand**) userdata;
4d4c80d0 1405 int r;
718db961 1406
4d4c80d0
LP		 1407 assert(bus);
1408 assert(reply);
1409
1410 r = sd_bus_message_open_container(reply, 'a', "(sasbttttuii)");
1411 if (r < 0)
1412 return r;
718db961 1413
03677889 1414 LIST_FOREACH(command, c, exec_command) {
4d4c80d0 1415 r = append_exec_command(reply, c);
718db961
LP		 1416 if (r < 0)
1417 return r;
fe68089d
LP		 1418 }
1419
718db961 1420 return sd_bus_message_close_container(reply);
8351ceae 1421}
c7040b5d 1422
b3d59367
AZ		 1423int bus_property_get_exec_ex_command_list(
1424 sd_bus *bus,
1425 const char *path,
1426 const char *interface,
1427 const char *property,
1428 sd_bus_message *reply,
1429 void *userdata,
1430 sd_bus_error *ret_error) {
1431
03677889 1432 ExecCommand *exec_command = *(ExecCommand**) userdata;
b3d59367
AZ		 1433 int r;
1434
1435 assert(bus);
1436 assert(reply);
1437
1438 r = sd_bus_message_open_container(reply, 'a', "(sasasttttuii)");
1439 if (r < 0)
1440 return r;
1441
1442 LIST_FOREACH(command, c, exec_command) {
1443 r = append_exec_ex_command(reply, c);
1444 if (r < 0)
1445 return r;
1446 }
1447
1448 return sd_bus_message_close_container(reply);
1449}
1450
1451static char *exec_command_flags_to_exec_chars(ExecCommandFlags flags) {
a4fc96c8
ZJS		 1452 return strjoin(FLAGS_SET(flags, EXEC_COMMAND_IGNORE_FAILURE) ? "-" : "",
1453 FLAGS_SET(flags, EXEC_COMMAND_NO_ENV_EXPAND) ? ":" : "",
1454 FLAGS_SET(flags, EXEC_COMMAND_FULLY_PRIVILEGED) ? "+" : "",
1455 FLAGS_SET(flags, EXEC_COMMAND_NO_SETUID) ? "!" : "",
1456 FLAGS_SET(flags, EXEC_COMMAND_AMBIENT_MAGIC) ? "!!" : "");
b3d59367
AZ		 1457}
1458
237f7bcb 1459int bus_set_transient_exec_command(
9c0320e7
YW		 1460 Unit *u,
1461 const char *name,
1462 ExecCommand **exec_command,
1463 sd_bus_message *message,
1464 UnitWriteFlags flags,
1465 sd_bus_error *error) {
b3d59367 1466 bool is_ex_prop = endswith(name, "Ex");
9c0320e7
YW		 1467 unsigned n = 0;
1468 int r;
1469
b3d59367 1470 r = sd_bus_message_enter_container(message, 'a', is_ex_prop ? "(sasas)" : "(sasb)");
9c0320e7
YW		 1471 if (r < 0)
1472 return r;
1473
b3d59367
AZ		 1474 while ((r = sd_bus_message_enter_container(message, 'r', is_ex_prop ? "sasas" : "sasb")) > 0) {
1475 _cleanup_strv_free_ char **argv = NULL, **ex_opts = NULL;
9c0320e7
YW		 1476 const char *path;
1477 int b;
1478
1479 r = sd_bus_message_read(message, "s", &path);
1480 if (r < 0)
1481 return r;
1482
8038b99d
ZJS		 1483 if (!path_is_absolute(path) && !filename_is_valid(path))
1484 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS,
1485 "\"%s\" is neither a valid executable name nor an absolute path",
1486 path);
9c0320e7
YW		 1487
1488 r = sd_bus_message_read_strv(message, &argv);
1489 if (r < 0)
1490 return r;
1491
29500cf8
HC		 1492 if (strv_isempty(argv))
1493 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS,
1494 "\"%s\" argv cannot be empty", name);
1495
b3d59367 1496 r = is_ex_prop ? sd_bus_message_read_strv(message, &ex_opts) : sd_bus_message_read(message, "b", &b);
9c0320e7
YW		 1497 if (r < 0)
1498 return r;
1499
1500 r = sd_bus_message_exit_container(message);
1501 if (r < 0)
1502 return r;
1503
1504 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1505 ExecCommand *c;
1506
1507 c = new0(ExecCommand, 1);
1508 if (!c)
1509 return -ENOMEM;
1510
1511 c->path = strdup(path);
1512 if (!c->path) {
1513 free(c);
1514 return -ENOMEM;
1515 }
1516
ae2a15bc 1517 c->argv = TAKE_PTR(argv);
9c0320e7 1518
b3d59367
AZ		 1519 if (is_ex_prop) {
1520 r = exec_command_flags_from_strv(ex_opts, &c->flags);
1521 if (r < 0)
1522 return r;
1523 } else
1524 c->flags = b ? EXEC_COMMAND_IGNORE_FAILURE : 0;
9c0320e7 1525
4ff361cc 1526 path_simplify(c->path);
9c0320e7
YW		 1527 exec_command_append_list(exec_command, c);
1528 }
1529
1530 n++;
1531 }
1532 if (r < 0)
1533 return r;
1534
1535 r = sd_bus_message_exit_container(message);
1536 if (r < 0)
1537 return r;
1538
1539 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1540 _cleanup_free_ char *buf = NULL;
1541 _cleanup_fclose_ FILE *f = NULL;
9c0320e7
YW		 1542 size_t size = 0;
1543
1544 if (n == 0)
1545 *exec_command = exec_command_free_list(*exec_command);
1546
2fe21124 1547 f = open_memstream_unlocked(&buf, &size);
9c0320e7
YW		 1548 if (!f)
1549 return -ENOMEM;
1550
f14bf013 1551 fprintf(f, "%s=\n", name);
9c0320e7
YW		 1552
1553 LIST_FOREACH(command, c, *exec_command) {
540ac933 1554 _cleanup_free_ char *a = NULL, *exec_chars = NULL;
9c0320e7 1555
540ac933
LP		 1556 exec_chars = exec_command_flags_to_exec_chars(c->flags);
1557 if (!exec_chars)
9c0320e7
YW		 1558 return -ENOMEM;
1559
24536beb 1560 a = unit_concat_strv(c->argv, UNIT_ESCAPE_SPECIFIERS|UNIT_ESCAPE_EXEC_SYNTAX);
9c0320e7
YW		 1561 if (!a)
1562 return -ENOMEM;
1563
540ac933
LP		 1564 if (streq_ptr(c->path, c->argv ? c->argv[0] : NULL))
1565 fprintf(f, "%s=%s%s\n", name, exec_chars, a);
1566 else {
1567 _cleanup_free_ char *t = NULL;
1568 const char *p;
1569
24536beb
ZJS		 1570 p = unit_escape_setting(c->path,
1571 UNIT_ESCAPE_SPECIFIERS|UNIT_ESCAPE_EXEC_SYNTAX, &t);
540ac933
LP		 1572 if (!p)
1573 return -ENOMEM;
b3d59367 1574
540ac933
LP		 1575 fprintf(f, "%s=%s@%s %s\n", name, exec_chars, p, a);
1576 }
9c0320e7
YW		 1577 }
1578
1579 r = fflush_and_check(f);
1580 if (r < 0)
1581 return r;
1582
1583 unit_write_setting(u, flags, name, buf);
1584 }
1585
1586 return 1;
1587}
1588
7e2a3fcc
YW		 1589static int parse_personality(const char *s, unsigned long *p) {
1590 unsigned long v;
1591
1592 assert(p);
1593
1594 v = personality_from_string(s);
1595 if (v == PERSONALITY_INVALID)
1596 return -EINVAL;
1597
1598 *p = v;
1599 return 0;
1600}
1601
1602static const char* mount_propagation_flags_to_string_with_check(unsigned long n) {
1603 if (!IN_SET(n, 0, MS_SHARED, MS_PRIVATE, MS_SLAVE))
1604 return NULL;
1605
1606 return mount_propagation_flags_to_string(n);
1607}
1608
1609static BUS_DEFINE_SET_TRANSIENT(nsec, "t", uint64_t, nsec_t, NSEC_FMT);
1610static BUS_DEFINE_SET_TRANSIENT_IS_VALID(log_level, "i", int32_t, int, "%" PRIi32, log_level_is_valid);
aad67b80 1611#if HAVE_SECCOMP
005bfaf1 1612static BUS_DEFINE_SET_TRANSIENT_IS_VALID(errno, "i", int32_t, int, "%" PRIi32, seccomp_errno_or_action_is_valid);
aad67b80 1613#endif
7e2a3fcc
YW		 1614static BUS_DEFINE_SET_TRANSIENT_PARSE(std_input, ExecInput, exec_input_from_string);
1615static BUS_DEFINE_SET_TRANSIENT_PARSE(std_output, ExecOutput, exec_output_from_string);
1616static BUS_DEFINE_SET_TRANSIENT_PARSE(utmp_mode, ExecUtmpMode, exec_utmp_mode_from_string);
1e8c7bd5
YW		 1617static BUS_DEFINE_SET_TRANSIENT_PARSE(protect_system, ProtectSystem, protect_system_from_string);
1618static BUS_DEFINE_SET_TRANSIENT_PARSE(protect_home, ProtectHome, protect_home_from_string);
7e2a3fcc 1619static BUS_DEFINE_SET_TRANSIENT_PARSE(keyring_mode, ExecKeyringMode, exec_keyring_mode_from_string);
4e399953
LP		 1620static BUS_DEFINE_SET_TRANSIENT_PARSE(protect_proc, ProtectProc, protect_proc_from_string);
1621static BUS_DEFINE_SET_TRANSIENT_PARSE(proc_subset, ProcSubset, proc_subset_from_string);
7e2a3fcc
YW		 1622static BUS_DEFINE_SET_TRANSIENT_PARSE(preserve_mode, ExecPreserveMode, exec_preserve_mode_from_string);
1623static BUS_DEFINE_SET_TRANSIENT_PARSE_PTR(personality, unsigned long, parse_personality);
1624static BUS_DEFINE_SET_TRANSIENT_TO_STRING_ALLOC(secure_bits, "i", int32_t, int, "%" PRIi32, secure_bits_to_string_alloc_with_check);
1625static BUS_DEFINE_SET_TRANSIENT_TO_STRING_ALLOC(capability, "t", uint64_t, uint64_t, "%" PRIu64, capability_set_to_string_alloc);
86c2a9f1 1626static BUS_DEFINE_SET_TRANSIENT_TO_STRING_ALLOC(namespace_flag, "t", uint64_t, unsigned long, "%" PRIu64, namespace_flags_to_string);
7e2a3fcc
YW		 1627static BUS_DEFINE_SET_TRANSIENT_TO_STRING(mount_flags, "t", uint64_t, unsigned long, "%" PRIu64, mount_propagation_flags_to_string_with_check);
1628
c7040b5d
LP		 1629int bus_exec_context_set_transient_property(
1630 Unit *u,
1631 ExecContext *c,
1632 const char *name,
1633 sd_bus_message *message,
2e59b241 1634 UnitWriteFlags flags,
c7040b5d
LP		 1635 sd_bus_error *error) {
1636
6550c24c
LP		 1637 const char *suffix;
1638 int r;
c7040b5d
LP		 1639
1640 assert(u);
1641 assert(c);
1642 assert(name);
1643 assert(message);
1644
2e59b241
LP		 1645 flags |= UNIT_PRIVATE;
1646
7e2a3fcc 1647 if (streq(name, "User"))
7a8867ab 1648 return bus_set_transient_user_relaxed(u, name, &c->user, message, flags, error);
c7040b5d 1649
7e2a3fcc 1650 if (streq(name, "Group"))
7a8867ab 1651 return bus_set_transient_user_relaxed(u, name, &c->group, message, flags, error);
c7040b5d 1652
7e2a3fcc
YW		 1653 if (streq(name, "TTYPath"))
1654 return bus_set_transient_path(u, name, &c->tty_path, message, flags, error);
6f3e7985 1655
7e2a3fcc
YW		 1656 if (streq(name, "RootImage"))
1657 return bus_set_transient_path(u, name, &c->root_image, message, flags, error);
76736280 1658
18d73705
LB		 1659 if (streq(name, "RootImageOptions")) {
1660 _cleanup_(mount_options_free_allp) MountOptions *options = NULL;
1661 _cleanup_free_ char *format_str = NULL;
18d73705 1662
988172ce 1663 r = bus_read_mount_options(message, error, &options, &format_str, " ");
18d73705
LB		 1664 if (r < 0)
1665 return r;
1666
1667 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
64903d18 1668 if (options) {
18d73705
LB		 1669 LIST_JOIN(mount_options, c->root_image_options, options);
1670 unit_write_settingf(
1671 u, flags|UNIT_ESCAPE_SPECIFIERS, name,
1672 "%s=%s",
1673 name,
1674 format_str);
64903d18
ZJS		 1675 } else {
1676 c->root_image_options = mount_options_free_all(c->root_image_options);
1677 unit_write_settingf(u, flags, name, "%s=", name);
18d73705
LB		 1678 }
1679 }
1680
1681 return 1;
1682 }
1683
0389f4fa
LB		 1684 if (streq(name, "RootHash")) {
1685 const void *roothash_decoded;
1686 size_t roothash_decoded_size;
1687
1688 r = sd_bus_message_read_array(message, 'y', &roothash_decoded, &roothash_decoded_size);
1689 if (r < 0)
1690 return r;
1691
1692 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1693 _cleanup_free_ char *encoded = NULL;
1694
1695 if (roothash_decoded_size == 0) {
1696 c->root_hash_path = mfree(c->root_hash_path);
1697 c->root_hash = mfree(c->root_hash);
1698 c->root_hash_size = 0;
1699
1700 unit_write_settingf(u, flags, name, "RootHash=");
1701 } else {
c2b2df60 1702 _cleanup_free_ void *p = NULL;
0389f4fa
LB		 1703
1704 encoded = hexmem(roothash_decoded, roothash_decoded_size);
1705 if (!encoded)
1706 return -ENOMEM;
1707
1708 p = memdup(roothash_decoded, roothash_decoded_size);
1709 if (!p)
1710 return -ENOMEM;
1711
1712 free_and_replace(c->root_hash, p);
1713 c->root_hash_size = roothash_decoded_size;
1714 c->root_hash_path = mfree(c->root_hash_path);
1715
1716 unit_write_settingf(u, flags, name, "RootHash=%s", encoded);
1717 }
1718 }
1719
1720 return 1;
1721 }
1722
1723 if (streq(name, "RootHashPath")) {
1724 c->root_hash_size = 0;
1725 c->root_hash = mfree(c->root_hash);
1726
1727 return bus_set_transient_path(u, "RootHash", &c->root_hash_path, message, flags, error);
1728 }
1729
d4d55b0d
LB		 1730 if (streq(name, "RootHashSignature")) {
1731 const void *roothash_sig_decoded;
1732 size_t roothash_sig_decoded_size;
1733
1734 r = sd_bus_message_read_array(message, 'y', &roothash_sig_decoded, &roothash_sig_decoded_size);
1735 if (r < 0)
1736 return r;
1737
1738 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1739 _cleanup_free_ char *encoded = NULL;
1740
1741 if (roothash_sig_decoded_size == 0) {
1742 c->root_hash_sig_path = mfree(c->root_hash_sig_path);
1743 c->root_hash_sig = mfree(c->root_hash_sig);
1744 c->root_hash_sig_size = 0;
1745
1746 unit_write_settingf(u, flags, name, "RootHashSignature=");
1747 } else {
c2b2df60 1748 _cleanup_free_ void *p = NULL;
d4d55b0d
LB		 1749 ssize_t len;
1750
1751 len = base64mem(roothash_sig_decoded, roothash_sig_decoded_size, &encoded);
1752 if (len < 0)
1753 return -ENOMEM;
1754
1755 p = memdup(roothash_sig_decoded, roothash_sig_decoded_size);
1756 if (!p)
1757 return -ENOMEM;
1758
1759 free_and_replace(c->root_hash_sig, p);
1760 c->root_hash_sig_size = roothash_sig_decoded_size;
1761 c->root_hash_sig_path = mfree(c->root_hash_sig_path);
1762
1763 unit_write_settingf(u, flags, name, "RootHashSignature=base64:%s", encoded);
1764 }
1765 }
1766
1767 return 1;
1768 }
1769
1770 if (streq(name, "RootHashSignaturePath")) {
1771 c->root_hash_sig_size = 0;
1772 c->root_hash_sig = mfree(c->root_hash_sig);
1773
1774 return bus_set_transient_path(u, "RootHashSignature", &c->root_hash_sig_path, message, flags, error);
1775 }
1776
0389f4fa
LB		 1777 if (streq(name, "RootVerity"))
1778 return bus_set_transient_path(u, name, &c->root_verity, message, flags, error);
1779
7e2a3fcc
YW		 1780 if (streq(name, "RootDirectory"))
1781 return bus_set_transient_path(u, name, &c->root_directory, message, flags, error);
c7040b5d 1782
7e2a3fcc
YW		 1783 if (streq(name, "SyslogIdentifier"))
1784 return bus_set_transient_string(u, name, &c->syslog_identifier, message, flags, error);
c7040b5d 1785
7e2a3fcc
YW		 1786 if (streq(name, "LogLevelMax"))
1787 return bus_set_transient_log_level(u, name, &c->log_level_max, message, flags, error);
1788
90fc172e 1789 if (streq(name, "LogRateLimitIntervalUSec"))
5ac1530e 1790 return bus_set_transient_usec(u, name, &c->log_ratelimit_interval_usec, message, flags, error);
90fc172e
AZ		 1791
1792 if (streq(name, "LogRateLimitBurst"))
5ac1530e 1793 return bus_set_transient_unsigned(u, name, &c->log_ratelimit_burst, message, flags, error);
90fc172e 1794
7e2a3fcc
YW		 1795 if (streq(name, "Personality"))
1796 return bus_set_transient_personality(u, name, &c->personality, message, flags, error);
1797
7e2a3fcc
YW		 1798 if (streq(name, "StandardInput"))
1799 return bus_set_transient_std_input(u, name, &c->std_input, message, flags, error);
1800
1801 if (streq(name, "StandardOutput"))
1802 return bus_set_transient_std_output(u, name, &c->std_output, message, flags, error);
1803
1804 if (streq(name, "StandardError"))
1805 return bus_set_transient_std_output(u, name, &c->std_error, message, flags, error);
1806
1807 if (streq(name, "IgnoreSIGPIPE"))
1808 return bus_set_transient_bool(u, name, &c->ignore_sigpipe, message, flags, error);
1809
1810 if (streq(name, "TTYVHangup"))
1811 return bus_set_transient_bool(u, name, &c->tty_vhangup, message, flags, error);
1812
1813 if (streq(name, "TTYReset"))
1814 return bus_set_transient_bool(u, name, &c->tty_reset, message, flags, error);
1815
1816 if (streq(name, "TTYVTDisallocate"))
1817 return bus_set_transient_bool(u, name, &c->tty_vt_disallocate, message, flags, error);
51462135
DDM		 1818
1819 if (streq(name, "TTYRows"))
1820 return bus_set_transient_unsigned(u, name, &c->tty_rows, message, flags, error);
1821
1822 if (streq(name, "TTYColumns"))
1823 return bus_set_transient_unsigned(u, name, &c->tty_cols, message, flags, error);
7e2a3fcc
YW		 1824
1825 if (streq(name, "PrivateTmp"))
1826 return bus_set_transient_bool(u, name, &c->private_tmp, message, flags, error);
1827
1828 if (streq(name, "PrivateDevices"))
1829 return bus_set_transient_bool(u, name, &c->private_devices, message, flags, error);
1830
228af36f
LP		 1831 if (streq(name, "PrivateMounts"))
1832 return bus_set_transient_bool(u, name, &c->private_mounts, message, flags, error);
1833
7e2a3fcc
YW		 1834 if (streq(name, "PrivateNetwork"))
1835 return bus_set_transient_bool(u, name, &c->private_network, message, flags, error);
1836
a70581ff
XR		 1837 if (streq(name, "PrivateIPC"))
1838 return bus_set_transient_bool(u, name, &c->private_ipc, message, flags, error);
1839
7e2a3fcc
YW		 1840 if (streq(name, "PrivateUsers"))
1841 return bus_set_transient_bool(u, name, &c->private_users, message, flags, error);
1842
1843 if (streq(name, "NoNewPrivileges"))
1844 return bus_set_transient_bool(u, name, &c->no_new_privileges, message, flags, error);
1845
1846 if (streq(name, "SyslogLevelPrefix"))
1847 return bus_set_transient_bool(u, name, &c->syslog_level_prefix, message, flags, error);
1848
1849 if (streq(name, "MemoryDenyWriteExecute"))
1850 return bus_set_transient_bool(u, name, &c->memory_deny_write_execute, message, flags, error);
1851
1852 if (streq(name, "RestrictRealtime"))
1853 return bus_set_transient_bool(u, name, &c->restrict_realtime, message, flags, error);
1854
f69567cb
LP		 1855 if (streq(name, "RestrictSUIDSGID"))
1856 return bus_set_transient_bool(u, name, &c->restrict_suid_sgid, message, flags, error);
1857
7e2a3fcc
YW		 1858 if (streq(name, "DynamicUser"))
1859 return bus_set_transient_bool(u, name, &c->dynamic_user, message, flags, error);
1860
1861 if (streq(name, "RemoveIPC"))
1862 return bus_set_transient_bool(u, name, &c->remove_ipc, message, flags, error);
1863
1864 if (streq(name, "ProtectKernelTunables"))
1865 return bus_set_transient_bool(u, name, &c->protect_kernel_tunables, message, flags, error);
1866
1867 if (streq(name, "ProtectKernelModules"))
1868 return bus_set_transient_bool(u, name, &c->protect_kernel_modules, message, flags, error);
1869
84703040
KK		 1870 if (streq(name, "ProtectKernelLogs"))
1871 return bus_set_transient_bool(u, name, &c->protect_kernel_logs, message, flags, error);
1872
fc64760d
KK		 1873 if (streq(name, "ProtectClock"))
1874 return bus_set_transient_bool(u, name, &c->protect_clock, message, flags, error);
1875
7e2a3fcc
YW		 1876 if (streq(name, "ProtectControlGroups"))
1877 return bus_set_transient_bool(u, name, &c->protect_control_groups, message, flags, error);
1878
7e2a3fcc
YW		 1879 if (streq(name, "CPUSchedulingResetOnFork"))
1880 return bus_set_transient_bool(u, name, &c->cpu_sched_reset_on_fork, message, flags, error);
1881
1882 if (streq(name, "NonBlocking"))
1883 return bus_set_transient_bool(u, name, &c->non_blocking, message, flags, error);
1884
1885 if (streq(name, "LockPersonality"))
1886 return bus_set_transient_bool(u, name, &c->lock_personality, message, flags, error);
1887
aecd5ac6
TM		 1888 if (streq(name, "ProtectHostname"))
1889 return bus_set_transient_bool(u, name, &c->protect_hostname, message, flags, error);
1890
7e2a3fcc
YW		 1891 if (streq(name, "UtmpIdentifier"))
1892 return bus_set_transient_string(u, name, &c->utmp_id, message, flags, error);
1893
1894 if (streq(name, "UtmpMode"))
1895 return bus_set_transient_utmp_mode(u, name, &c->utmp_mode, message, flags, error);
1896
1897 if (streq(name, "PAMName"))
1898 return bus_set_transient_string(u, name, &c->pam_name, message, flags, error);
1899
1900 if (streq(name, "TimerSlackNSec"))
1901 return bus_set_transient_nsec(u, name, &c->timer_slack_nsec, message, flags, error);
1902
1903 if (streq(name, "ProtectSystem"))
1904 return bus_set_transient_protect_system(u, name, &c->protect_system, message, flags, error);
1905
1906 if (streq(name, "ProtectHome"))
1907 return bus_set_transient_protect_home(u, name, &c->protect_home, message, flags, error);
cffaed83 1908
7e2a3fcc
YW		 1909 if (streq(name, "KeyringMode"))
1910 return bus_set_transient_keyring_mode(u, name, &c->keyring_mode, message, flags, error);
1911
4e399953
LP		 1912 if (streq(name, "ProtectProc"))
1913 return bus_set_transient_protect_proc(u, name, &c->protect_proc, message, flags, error);
1914
1915 if (streq(name, "ProcSubset"))
1916 return bus_set_transient_proc_subset(u, name, &c->proc_subset, message, flags, error);
1917
7e2a3fcc
YW		 1918 if (streq(name, "RuntimeDirectoryPreserve"))
1919 return bus_set_transient_preserve_mode(u, name, &c->runtime_directory_preserve_mode, message, flags, error);
1920
1921 if (streq(name, "UMask"))
1922 return bus_set_transient_mode_t(u, name, &c->umask, message, flags, error);
1923
1924 if (streq(name, "RuntimeDirectoryMode"))
1925 return bus_set_transient_mode_t(u, name, &c->directories[EXEC_DIRECTORY_RUNTIME].mode, message, flags, error);
1926
1927 if (streq(name, "StateDirectoryMode"))
1928 return bus_set_transient_mode_t(u, name, &c->directories[EXEC_DIRECTORY_STATE].mode, message, flags, error);
1929
1930 if (streq(name, "CacheDirectoryMode"))
1931 return bus_set_transient_mode_t(u, name, &c->directories[EXEC_DIRECTORY_CACHE].mode, message, flags, error);
1932
1933 if (streq(name, "LogsDirectoryMode"))
1934 return bus_set_transient_mode_t(u, name, &c->directories[EXEC_DIRECTORY_LOGS].mode, message, flags, error);
1935
1936 if (streq(name, "ConfigurationDirectoryMode"))
1937 return bus_set_transient_mode_t(u, name, &c->directories[EXEC_DIRECTORY_CONFIGURATION].mode, message, flags, error);
1938
1939 if (streq(name, "SELinuxContext"))
1940 return bus_set_transient_string(u, name, &c->selinux_context, message, flags, error);
1941
1942 if (streq(name, "SecureBits"))
1943 return bus_set_transient_secure_bits(u, name, &c->secure_bits, message, flags, error);
1944
1945 if (streq(name, "CapabilityBoundingSet"))
1946 return bus_set_transient_capability(u, name, &c->capability_bounding_set, message, flags, error);
1947
1948 if (streq(name, "AmbientCapabilities"))
1949 return bus_set_transient_capability(u, name, &c->capability_ambient_set, message, flags, error);
1950
7e2a3fcc
YW		 1951 if (streq(name, "RestrictNamespaces"))
1952 return bus_set_transient_namespace_flag(u, name, &c->restrict_namespaces, message, flags, error);
1953
cc86a278
ILG		 1954 if (streq(name, "RestrictFileSystems")) {
1955 int allow_list;
1956 _cleanup_strv_free_ char **l = NULL;
1957
1958 r = sd_bus_message_enter_container(message, 'r', "bas");
1959 if (r < 0)
1960 return r;
1961
1962 r = sd_bus_message_read(message, "b", &allow_list);
1963 if (r < 0)
1964 return r;
1965
1966 r = sd_bus_message_read_strv(message, &l);
1967 if (r < 0)
1968 return r;
1969
1970 r = sd_bus_message_exit_container(message);
1971 if (r < 0)
1972 return r;
1973
1974 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
1975 _cleanup_free_ char *joined = NULL;
1976 FilesystemParseFlags invert_flag = allow_list ? 0 : FILESYSTEM_PARSE_INVERT;
cc86a278
ILG		 1977
1978 if (strv_isempty(l)) {
1979 c->restrict_filesystems_allow_list = false;
1980 c->restrict_filesystems = set_free(c->restrict_filesystems);
1981
1982 unit_write_setting(u, flags, name, "RestrictFileSystems=");
1983 return 1;
1984 }
1985
1986 if (!c->restrict_filesystems)
1987 c->restrict_filesystems_allow_list = allow_list;
1988
1989 STRV_FOREACH(s, l) {
1990 r = lsm_bpf_parse_filesystem(
1991 *s,
1992 &c->restrict_filesystems,
1993 FILESYSTEM_PARSE_LOG|
1994 (invert_flag ? FILESYSTEM_PARSE_INVERT : 0)|
1995 (c->restrict_filesystems_allow_list ? FILESYSTEM_PARSE_ALLOW_LIST : 0),
1996 u->id, NULL, 0);
1997 if (r < 0)
1998 return r;
1999 }
2000
2001 joined = strv_join(l, " ");
2002 if (!joined)
2003 return -ENOMEM;
2004
2005 unit_write_settingf(u, flags, name, "%s=%s%s", name, allow_list ? "" : "~", joined);
2006 }
2007
2008 return 1;
2009 }
2010
7e2a3fcc
YW		 2011 if (streq(name, "MountFlags"))
2012 return bus_set_transient_mount_flags(u, name, &c->mount_flags, message, flags, error);
2013
a8d08f39
LP		 2014 if (streq(name, "NetworkNamespacePath"))
2015 return bus_set_transient_path(u, name, &c->network_namespace_path, message, flags, error);
2016
a70581ff
XR		 2017 if (streq(name, "IPCNamespacePath"))
2018 return bus_set_transient_path(u, name, &c->ipc_namespace_path, message, flags, error);
2019
7e2a3fcc 2020 if (streq(name, "SupplementaryGroups")) {
cffaed83 2021 _cleanup_strv_free_ char **l = NULL;
cffaed83
YW		 2022
2023 r = sd_bus_message_read_strv(message, &l);
2024 if (r < 0)
2025 return r;
2026
d2a23692 2027 STRV_FOREACH(p, l)
7a8867ab 2028 if (!isempty(*p) && !valid_user_group_name(*p, VALID_USER_ALLOW_NUMERIC|VALID_USER_RELAX|VALID_USER_WARN))
d2a23692
ZJS		 2029 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS,
2030 "Invalid supplementary group names");
cffaed83 2031
2e59b241 2032 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
7b943bb7 2033 if (strv_isempty(l)) {
cffaed83 2034 c->supplementary_groups = strv_free(c->supplementary_groups);
2e59b241 2035 unit_write_settingf(u, flags, name, "%s=", name);
cffaed83
YW		 2036 } else {
2037 _cleanup_free_ char *joined = NULL;
2038
2039 r = strv_extend_strv(&c->supplementary_groups, l, true);
2040 if (r < 0)
2041 return -ENOMEM;
2042
2043 joined = strv_join(c->supplementary_groups, " ");
2044 if (!joined)
2045 return -ENOMEM;
2046
2e59b241 2047 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "%s=%s", name, joined);
cffaed83
YW		 2048 }
2049 }
2050
2051 return 1;
2052
43144be4 2053 } else if (STR_IN_SET(name, "SetCredential", "SetCredentialEncrypted")) {
bb0c0d6f
LP		 2054 bool isempty = true;
2055
2056 r = sd_bus_message_enter_container(message, 'a', "(say)");
2057 if (r < 0)
2058 return r;
2059
2060 for (;;) {
2061 const char *id;
2062 const void *p;
2063 size_t sz;
2064
2065 r = sd_bus_message_enter_container(message, 'r', "say");
2066 if (r < 0)
2067 return r;
2068 if (r == 0)
2069 break;
2070
2071 r = sd_bus_message_read(message, "s", &id);
2072 if (r < 0)
2073 return r;
2074
2075 r = sd_bus_message_read_array(message, 'y', &p, &sz);
2076 if (r < 0)
2077 return r;
2078
2079 r = sd_bus_message_exit_container(message);
2080 if (r < 0)
2081 return r;
2082
2083 if (!credential_name_valid(id))
2084 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Credential ID is invalid: %s", id);
2085
2086 isempty = false;
2087
2088 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2089 _cleanup_free_ char *a = NULL, *b = NULL;
2090 _cleanup_free_ void *copy = NULL;
2091 ExecSetCredential *old;
2092
2093 copy = memdup(p, sz);
2094 if (!copy)
2095 return -ENOMEM;
2096
2097 old = hashmap_get(c->set_credentials, id);
2098 if (old) {
2099 free_and_replace(old->data, copy);
2100 old->size = sz;
43144be4 2101 old->encrypted = streq(name, "SetCredentialEncrypted");
bb0c0d6f
LP		 2102 } else {
2103 _cleanup_(exec_set_credential_freep) ExecSetCredential *sc = NULL;
2104
43144be4 2105 sc = new(ExecSetCredential, 1);
bb0c0d6f
LP		 2106 if (!sc)
2107 return -ENOMEM;
2108
43144be4
LP		 2109 *sc = (ExecSetCredential) {
2110 .id = strdup(id),
2111 .data = TAKE_PTR(copy),
2112 .size = sz,
2113 .encrypted = streq(name, "SetCredentialEncrypted"),
2114 };
2115
bb0c0d6f
LP		 2116 if (!sc->id)
2117 return -ENOMEM;
2118
cf55fe4a 2119 r = hashmap_ensure_put(&c->set_credentials, &exec_set_credential_hash_ops, sc->id, sc);
bb0c0d6f
LP		 2120 if (r < 0)
2121 return r;
2122
2123 TAKE_PTR(sc);
2124 }
2125
2126 a = specifier_escape(id);
2127 if (!a)
2128 return -ENOMEM;
2129
2130 b = cescape_length(p, sz);
2131 if (!b)
2132 return -ENOMEM;
2133
2134 (void) unit_write_settingf(u, flags, name, "%s=%s:%s", name, a, b);
2135 }
2136 }
2137
2138 r = sd_bus_message_exit_container(message);
2139 if (r < 0)
2140 return r;
2141
2142 if (!UNIT_WRITE_FLAGS_NOOP(flags) && isempty) {
2143 c->set_credentials = hashmap_free(c->set_credentials);
2144 (void) unit_write_settingf(u, flags, name, "%s=", name);
2145 }
2146
2147 return 1;
2148
43144be4 2149 } else if (STR_IN_SET(name, "LoadCredential", "LoadCredentialEncrypted")) {
bb0c0d6f
LP		 2150 bool isempty = true;
2151
2152 r = sd_bus_message_enter_container(message, 'a', "(ss)");
2153 if (r < 0)
2154 return r;
2155
2156 for (;;) {
2157 const char *id, *source;
2158
2159 r = sd_bus_message_read(message, "(ss)", &id, &source);
2160 if (r < 0)
2161 return r;
2162 if (r == 0)
2163 break;
2164
2165 if (!credential_name_valid(id))
2166 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Credential ID is invalid: %s", id);
2167
2168 if (!(path_is_absolute(source) ? path_is_normalized(source) : credential_name_valid(source)))
2169 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Credential source is invalid: %s", source);
2170
2171 isempty = false;
2172
2173 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
43144be4
LP		 2174 _cleanup_free_ char *copy = NULL;
2175 ExecLoadCredential *old;
2176
2177 copy = strdup(source);
2178 if (!copy)
2179 return -ENOMEM;
2180
2181 old = hashmap_get(c->load_credentials, id);
2182 if (old) {
2183 free_and_replace(old->path, copy);
2184 old->encrypted = streq(name, "LoadCredentialEncrypted");
2185 } else {
2186 _cleanup_(exec_load_credential_freep) ExecLoadCredential *lc = NULL;
2187
2188 lc = new(ExecLoadCredential, 1);
2189 if (!lc)
2190 return -ENOMEM;
2191
2192 *lc = (ExecLoadCredential) {
2193 .id = strdup(id),
2194 .path = TAKE_PTR(copy),
2195 .encrypted = streq(name, "LoadCredentialEncrypted"),
2196 };
2197
2198 if (!lc->id)
2199 return -ENOMEM;
2200
2201 r = hashmap_ensure_put(&c->load_credentials, &exec_load_credential_hash_ops, lc->id, lc);
2202 if (r < 0)
2203 return r;
2204
2205 TAKE_PTR(lc);
2206 }
bb0c0d6f
LP		 2207
2208 (void) unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "%s=%s:%s", name, id, source);
2209 }
2210 }
2211
2212 r = sd_bus_message_exit_container(message);
2213 if (r < 0)
2214 return r;
2215
2216 if (!UNIT_WRITE_FLAGS_NOOP(flags) && isempty) {
43144be4 2217 c->load_credentials = hashmap_free(c->load_credentials);
bb0c0d6f
LP		 2218 (void) unit_write_settingf(u, flags, name, "%s=", name);
2219 }
2220
2221 return 1;
2222
a8a13575 2223 } else if (streq(name, "SyslogLevel")) {
8d1dd6ab 2224 int32_t level;
a8a13575
EV		 2225
2226 r = sd_bus_message_read(message, "i", &level);
2227 if (r < 0)
2228 return r;
2229
e0d6e0fa 2230 if (!log_level_is_valid(level))
1b09b81c 2231 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Log level value out of range");
e0d6e0fa 2232
2e59b241 2233 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
a8a13575 2234 c->syslog_priority = (c->syslog_priority & LOG_FACMASK) | level;
2e59b241 2235 unit_write_settingf(u, flags, name, "SyslogLevel=%i", level);
a8a13575
EV		 2236 }
2237
460ed929 2238 return 1;
7e2a3fcc 2239
460ed929 2240 } else if (streq(name, "SyslogFacility")) {
8d1dd6ab 2241 int32_t facility;
460ed929
EV		 2242
2243 r = sd_bus_message_read(message, "i", &facility);
2244 if (r < 0)
2245 return r;
2246
e0d6e0fa 2247 if (!log_facility_unshifted_is_valid(facility))
1b09b81c 2248 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Log facility value out of range");
e0d6e0fa 2249
2e59b241 2250 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
460ed929 2251 c->syslog_priority = (facility << 3) | LOG_PRI(c->syslog_priority);
2e59b241 2252 unit_write_settingf(u, flags, name, "SyslogFacility=%i", facility);
460ed929
EV		 2253 }
2254
cffaed83 2255 return 1;
d3070fbd 2256
91dd5f7c
LP		 2257 } else if (streq(name, "LogNamespace")) {
2258 const char *n;
2259
2260 r = sd_bus_message_read(message, "s", &n);
2261 if (r < 0)
2262 return r;
2263
2264 if (!isempty(n) && !log_namespace_name_valid(n))
1b09b81c 2265 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Log namespace name not valid");
91dd5f7c
LP		 2266
2267 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2268
2269 if (isempty(n)) {
2270 c->log_namespace = mfree(c->log_namespace);
2271 unit_write_settingf(u, flags, name, "%s=", name);
2272 } else {
2273 r = free_and_strdup(&c->log_namespace, n);
2274 if (r < 0)
2275 return r;
2276
2277 unit_write_settingf(u, flags, name, "%s=%s", name, n);
2278 }
2279 }
2280
2281 return 1;
2282
d3070fbd
LP		 2283 } else if (streq(name, "LogExtraFields")) {
2284 size_t n = 0;
2285
2286 r = sd_bus_message_enter_container(message, 'a', "ay");
2287 if (r < 0)
2288 return r;
2289
2290 for (;;) {
2291 _cleanup_free_ void *copy = NULL;
2292 struct iovec *t;
2293 const char *eq;
2294 const void *p;
2295 size_t sz;
2296
2297 /* Note that we expect a byte array for each field, instead of a string. That's because on the
2298 * lower-level journal fields can actually contain binary data and are not restricted to text,
2299 * and we should not "lose precision" in our types on the way. That said, I am pretty sure
2300 * actually encoding binary data as unit metadata is not a good idea. Hence we actually refuse
2301 * any actual binary data, and only accept UTF-8. This allows us to eventually lift this
2302 * limitation, should a good, valid usecase arise. */
2303
2304 r = sd_bus_message_read_array(message, 'y', &p, &sz);
2305 if (r < 0)
2306 return r;
2307 if (r == 0)
2308 break;
2309
2310 if (memchr(p, 0, sz))
1b09b81c 2311 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Journal field contains zero byte");
d3070fbd
LP		 2312
2313 eq = memchr(p, '=', sz);
2314 if (!eq)
1b09b81c 2315 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Journal field contains no '=' character");
d3070fbd 2316 if (!journal_field_valid(p, eq - (const char*) p, false))
1b09b81c 2317 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Journal field invalid");
d3070fbd 2318
2e59b241 2319 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
aa484f35 2320 t = reallocarray(c->log_extra_fields, c->n_log_extra_fields+1, sizeof(struct iovec));
d3070fbd
LP		 2321 if (!t)
2322 return -ENOMEM;
2323 c->log_extra_fields = t;
2324 }
2325
2326 copy = malloc(sz + 1);
2327 if (!copy)
2328 return -ENOMEM;
2329
2330 memcpy(copy, p, sz);
2331 ((uint8_t*) copy)[sz] = 0;
2332
2333 if (!utf8_is_valid(copy))
1b09b81c 2334 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Journal field is not valid UTF-8");
d3070fbd 2335
2e59b241 2336 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
d3070fbd 2337 c->log_extra_fields[c->n_log_extra_fields++] = IOVEC_MAKE(copy, sz);
2e59b241 2338 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS|UNIT_ESCAPE_C, name, "LogExtraFields=%s", (char*) copy);
d3070fbd
LP		 2339
2340 copy = NULL;
2341 }
2342
2343 n++;
2344 }
2345
2346 r = sd_bus_message_exit_container(message);
2347 if (r < 0)
2348 return r;
2349
2e59b241 2350 if (!UNIT_WRITE_FLAGS_NOOP(flags) && n == 0) {
d3070fbd 2351 exec_context_free_log_extra_fields(c);
2e59b241 2352 unit_write_setting(u, flags, name, "LogExtraFields=");
d3070fbd
LP		 2353 }
2354
2355 return 1;
7e2a3fcc 2356 }
cffaed83 2357
349cc4a5 2358#if HAVE_SECCOMP
cffaed83 2359
7e2a3fcc
YW		 2360 if (streq(name, "SystemCallErrorNumber"))
2361 return bus_set_transient_errno(u, name, &c->syscall_errno, message, flags, error);
2362
2363 if (streq(name, "SystemCallFilter")) {
6b000af4 2364 int allow_list;
3f856a28 2365 _cleanup_strv_free_ char **l = NULL;
cffaed83
YW		 2366
2367 r = sd_bus_message_enter_container(message, 'r', "bas");
2368 if (r < 0)
2369 return r;
2370
6b000af4 2371 r = sd_bus_message_read(message, "b", &allow_list);
cffaed83
YW		 2372 if (r < 0)
2373 return r;
2374
2375 r = sd_bus_message_read_strv(message, &l);
2376 if (r < 0)
2377 return r;
2378
2379 r = sd_bus_message_exit_container(message);
2380 if (r < 0)
2381 return r;
2382
2e59b241 2383 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
cffaed83 2384 _cleanup_free_ char *joined = NULL;
6b000af4 2385 SeccompParseFlags invert_flag = allow_list ? 0 : SECCOMP_PARSE_INVERT;
cffaed83 2386
7b943bb7 2387 if (strv_isempty(l)) {
6b000af4 2388 c->syscall_allow_list = false;
8cfa775f 2389 c->syscall_filter = hashmap_free(c->syscall_filter);
cffaed83 2390
898748d8
YW		 2391 unit_write_settingf(u, flags, name, "SystemCallFilter=");
2392 return 1;
2393 }
cffaed83 2394
898748d8
YW		 2395 if (!c->syscall_filter) {
2396 c->syscall_filter = hashmap_new(NULL);
2397 if (!c->syscall_filter)
2398 return log_oom();
cffaed83 2399
6b000af4 2400 c->syscall_allow_list = allow_list;
8cfa775f 2401
6b000af4 2402 if (c->syscall_allow_list) {
e7ccdfa8
ZJS		 2403 r = seccomp_parse_syscall_filter("@default",
2404 -1,
2405 c->syscall_filter,
72545ae0 2406 SECCOMP_PARSE_PERMISSIVE |
1008d415 2407 SECCOMP_PARSE_ALLOW_LIST,
58f6ab44
ZJS		 2408 u->id,
2409 NULL, 0);
8cfa775f
YW		 2410 if (r < 0)
2411 return r;
898748d8
YW		 2412 }
2413 }
8cfa775f 2414
898748d8
YW		 2415 STRV_FOREACH(s, l) {
2416 _cleanup_free_ char *n = NULL;
2417 int e;
cffaed83 2418
898748d8
YW		 2419 r = parse_syscall_and_errno(*s, &n, &e);
2420 if (r < 0)
2421 return r;
cffaed83 2422
084a46d7
YW		 2423 if (allow_list && e >= 0)
2424 return -EINVAL;
2425
e7ccdfa8
ZJS		 2426 r = seccomp_parse_syscall_filter(n,
2427 e,
2428 c->syscall_filter,
72545ae0
AZ		 2429 SECCOMP_PARSE_LOG | SECCOMP_PARSE_PERMISSIVE |
2430 invert_flag |
6b000af4 2431 (c->syscall_allow_list ? SECCOMP_PARSE_ALLOW_LIST : 0),
58f6ab44
ZJS		 2432 u->id,
2433 NULL, 0);
898748d8
YW		 2434 if (r < 0)
2435 return r;
cffaed83
YW		 2436 }
2437
2438 joined = strv_join(l, " ");
2439 if (!joined)
2440 return -ENOMEM;
2441
6b000af4 2442 unit_write_settingf(u, flags, name, "SystemCallFilter=%s%s", allow_list ? "" : "~", joined);
cffaed83
YW		 2443 }
2444
2445 return 1;
2446
9df2cdd8
TM		 2447 } else if (streq(name, "SystemCallLog")) {
2448 int allow_list;
2449 _cleanup_strv_free_ char **l = NULL;
2450
2451 r = sd_bus_message_enter_container(message, 'r', "bas");
2452 if (r < 0)
2453 return r;
2454
2455 r = sd_bus_message_read(message, "b", &allow_list);
2456 if (r < 0)
2457 return r;
2458
2459 r = sd_bus_message_read_strv(message, &l);
2460 if (r < 0)
2461 return r;
2462
2463 r = sd_bus_message_exit_container(message);
2464 if (r < 0)
2465 return r;
2466
2467 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2468 _cleanup_free_ char *joined = NULL;
2469 SeccompParseFlags invert_flag = allow_list ? 0 : SECCOMP_PARSE_INVERT;
9df2cdd8
TM		 2470
2471 if (strv_isempty(l)) {
2472 c->syscall_log_allow_list = false;
2473 c->syscall_log = hashmap_free(c->syscall_log);
2474
2475 unit_write_settingf(u, flags, name, "SystemCallLog=");
2476 return 1;
2477 }
2478
2479 if (!c->syscall_log) {
2480 c->syscall_log = hashmap_new(NULL);
2481 if (!c->syscall_log)
2482 return log_oom();
2483
2484 c->syscall_log_allow_list = allow_list;
2485 }
2486
2487 STRV_FOREACH(s, l) {
696a13ba
YW		 2488 r = seccomp_parse_syscall_filter(*s,
2489 -1, /* errno not used */
9df2cdd8
TM		 2490 c->syscall_log,
2491 SECCOMP_PARSE_LOG | SECCOMP_PARSE_PERMISSIVE |
2492 invert_flag |
2493 (c->syscall_log_allow_list ? SECCOMP_PARSE_ALLOW_LIST : 0),
2494 u->id,
2495 NULL, 0);
2496 if (r < 0)
2497 return r;
2498 }
2499
2500 joined = strv_join(l, " ");
2501 if (!joined)
2502 return -ENOMEM;
2503
2504 unit_write_settingf(u, flags, name, "SystemCallLog=%s%s", allow_list ? "" : "~", joined);
2505 }
2506
2507 return 1;
2508
cffaed83
YW		 2509 } else if (streq(name, "SystemCallArchitectures")) {
2510 _cleanup_strv_free_ char **l = NULL;
2511
2512 r = sd_bus_message_read_strv(message, &l);
2513 if (r < 0)
2514 return r;
2515
2e59b241 2516 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
cffaed83
YW		 2517 _cleanup_free_ char *joined = NULL;
2518
7b943bb7 2519 if (strv_isempty(l))
cffaed83 2520 c->syscall_archs = set_free(c->syscall_archs);
de010b0b 2521 else
cffaed83
YW		 2522 STRV_FOREACH(s, l) {
2523 uint32_t a;
2524
2525 r = seccomp_arch_from_string(*s, &a);
2526 if (r < 0)
2527 return r;
2528
de7fef4b 2529 r = set_ensure_put(&c->syscall_archs, NULL, UINT32_TO_PTR(a + 1));
cffaed83
YW		 2530 if (r < 0)
2531 return r;
2532 }
2533
cffaed83
YW		 2534 joined = strv_join(l, " ");
2535 if (!joined)
2536 return -ENOMEM;
2537
2e59b241 2538 unit_write_settingf(u, flags, name, "%s=%s", name, joined);
cffaed83
YW		 2539 }
2540
2541 return 1;
2542
cffaed83 2543 } else if (streq(name, "RestrictAddressFamilies")) {
3f856a28 2544 _cleanup_strv_free_ char **l = NULL;
4e6c50a5 2545 int allow_list;
cffaed83
YW		 2546
2547 r = sd_bus_message_enter_container(message, 'r', "bas");
2548 if (r < 0)
2549 return r;
2550
6b000af4 2551 r = sd_bus_message_read(message, "b", &allow_list);
cffaed83
YW		 2552 if (r < 0)
2553 return r;
2554
2555 r = sd_bus_message_read_strv(message, &l);
2556 if (r < 0)
2557 return r;
2558
2559 r = sd_bus_message_exit_container(message);
2560 if (r < 0)
2561 return r;
2562
2e59b241 2563 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
cffaed83
YW		 2564 _cleanup_free_ char *joined = NULL;
2565
7b943bb7 2566 if (strv_isempty(l)) {
4e6c50a5 2567 c->address_families_allow_list = allow_list;
cffaed83 2568 c->address_families = set_free(c->address_families);
cffaed83 2569
4e6c50a5
YW		 2570 unit_write_settingf(u, flags, name, "RestrictAddressFamilies=%s",
2571 allow_list ? "none" : "");
9ee896d5
YW		 2572 return 1;
2573 }
cffaed83 2574
9ee896d5
YW		 2575 if (!c->address_families) {
2576 c->address_families = set_new(NULL);
2577 if (!c->address_families)
2578 return log_oom();
cffaed83 2579
6b000af4 2580 c->address_families_allow_list = allow_list;
9ee896d5
YW		 2581 }
2582
2583 STRV_FOREACH(s, l) {
2584 int af;
cffaed83 2585
9ee896d5 2586 af = af_from_name(*s);
acf4d158
YW		 2587 if (af < 0)
2588 return af;
cffaed83 2589
6b000af4 2590 if (allow_list == c->address_families_allow_list) {
cffaed83
YW		 2591 r = set_put(c->address_families, INT_TO_PTR(af));
2592 if (r < 0)
2593 return r;
9ee896d5 2594 } else
4e6c50a5 2595 set_remove(c->address_families, INT_TO_PTR(af));
cffaed83
YW		 2596 }
2597
2598 joined = strv_join(l, " ");
2599 if (!joined)
2600 return -ENOMEM;
2601
6b000af4 2602 unit_write_settingf(u, flags, name, "RestrictAddressFamilies=%s%s", allow_list ? "" : "~", joined);
cffaed83
YW		 2603 }
2604
2605 return 1;
7e2a3fcc 2606 }
cffaed83 2607#endif
b070c7c0 2608 if (STR_IN_SET(name, "CPUAffinity", "NUMAMask")) {
cffaed83 2609 const void *a;
bd0abfae 2610 size_t n;
b070c7c0 2611 bool affinity = streq(name, "CPUAffinity");
c367f996 2612 _cleanup_(cpu_set_reset) CPUSet set = {};
cffaed83
YW		 2613
2614 r = sd_bus_message_read_array(message, 'y', &a, &n);
2615 if (r < 0)
2616 return r;
2617
c367f996
MS		 2618 r = cpu_set_from_dbus(a, n, &set);
2619 if (r < 0)
2620 return r;
2621
2e59b241 2622 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
cffaed83 2623 if (n == 0) {
b070c7c0 2624 cpu_set_reset(affinity ? &c->cpu_set : &c->numa_policy.nodes);
2e59b241 2625 unit_write_settingf(u, flags, name, "%s=", name);
cffaed83
YW		 2626 } else {
2627 _cleanup_free_ char *str = NULL;
cffaed83 2628
0985c7c4 2629 str = cpu_set_to_string(&set);
a832893f
ZJS		 2630 if (!str)
2631 return -ENOMEM;
cffaed83 2632
0985c7c4
ZJS		 2633 /* We forego any optimizations here, and always create the structure using
2634 * cpu_set_add_all(), because we don't want to care if the existing size we
2635 * got over dbus is appropriate. */
b070c7c0 2636 r = cpu_set_add_all(affinity ? &c->cpu_set : &c->numa_policy.nodes, &set);
0985c7c4
ZJS		 2637 if (r < 0)
2638 return r;
501941aa 2639
2e59b241 2640 unit_write_settingf(u, flags, name, "%s=%s", name, str);
cffaed83
YW		 2641 }
2642 }
2643
c7040b5d
LP		 2644 return 1;
2645
e2b2fb7f
MS		 2646 } else if (streq(name, "CPUAffinityFromNUMA")) {
2647 int q;
2648
2649 r = sd_bus_message_read_basic(message, 'b', &q);
2650 if (r < 0)
2651 return r;
2652
2653 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2654 c->cpu_affinity_from_numa = q;
2655 unit_write_settingf(u, flags, name, "%s=%s", "CPUAffinity", "numa");
2656 }
2657
2658 return 1;
2659
b070c7c0
MS		 2660 } else if (streq(name, "NUMAPolicy")) {
2661 int32_t type;
2662
2663 r = sd_bus_message_read(message, "i", &type);
2664 if (r < 0)
2665 return r;
2666
2667 if (!mpol_is_valid(type))
2668 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid NUMAPolicy value: %i", type);
2669
2670 if (!UNIT_WRITE_FLAGS_NOOP(flags))
2671 c->numa_policy.type = type;
2672
2673 return 1;
e2b2fb7f 2674
c250bf67
YW		 2675 } else if (streq(name, "Nice")) {
2676 int32_t q;
2677
2678 r = sd_bus_message_read(message, "i", &q);
2679 if (r < 0)
2680 return r;
2681
2682 if (!nice_is_valid(q))
2683 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid Nice value: %i", q);
2684
2685 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2686 c->nice = q;
2687 c->nice_set = true;
2688
2689 unit_write_settingf(u, flags, name, "Nice=%i", q);
2690 }
2691
2692 return 1;
2693
2694 } else if (streq(name, "CPUSchedulingPolicy")) {
2695 int32_t q;
2696
2697 r = sd_bus_message_read(message, "i", &q);
2698 if (r < 0)
2699 return r;
2700
2701 if (!sched_policy_is_valid(q))
2702 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid CPU scheduling policy: %i", q);
2703
2704 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2705 _cleanup_free_ char *s = NULL;
2706
2707 r = sched_policy_to_string_alloc(q, &s);
2708 if (r < 0)
2709 return r;
2710
2711 c->cpu_sched_policy = q;
2712 c->cpu_sched_priority = CLAMP(c->cpu_sched_priority, sched_get_priority_min(q), sched_get_priority_max(q));
2713 c->cpu_sched_set = true;
2714
2715 unit_write_settingf(u, flags, name, "CPUSchedulingPolicy=%s", s);
2716 }
2717
2718 return 1;
2719
2720 } else if (streq(name, "CPUSchedulingPriority")) {
2721 int32_t p, min, max;
2722
2723 r = sd_bus_message_read(message, "i", &p);
2724 if (r < 0)
2725 return r;
2726
2727 min = sched_get_priority_min(c->cpu_sched_policy);
2728 max = sched_get_priority_max(c->cpu_sched_policy);
2729 if (p < min || p > max)
2730 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid CPU scheduling priority: %i", p);
2731
2732 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2733 c->cpu_sched_priority = p;
2734 c->cpu_sched_set = true;
2735
2736 unit_write_settingf(u, flags, name, "CPUSchedulingPriority=%i", p);
2737 }
2738
2739 return 1;
2740
7f452159
LP		 2741 } else if (streq(name, "IOSchedulingClass")) {
2742 int32_t q;
2743
2744 r = sd_bus_message_read(message, "i", &q);
2745 if (r < 0)
2746 return r;
2747
2748 if (!ioprio_class_is_valid(q))
2749 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid IO scheduling class: %i", q);
2750
2e59b241 2751 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
7f452159
LP		 2752 _cleanup_free_ char *s = NULL;
2753
2754 r = ioprio_class_to_string_alloc(q, &s);
2755 if (r < 0)
2756 return r;
2757
ba7772fe 2758 c->ioprio = ioprio_normalize(ioprio_prio_value(q, ioprio_prio_data(c->ioprio)));
7f452159
LP		 2759 c->ioprio_set = true;
2760
2e59b241 2761 unit_write_settingf(u, flags, name, "IOSchedulingClass=%s", s);
7f452159
LP		 2762 }
2763
2764 return 1;
2765
2766 } else if (streq(name, "IOSchedulingPriority")) {
2767 int32_t p;
2768
2769 r = sd_bus_message_read(message, "i", &p);
2770 if (r < 0)
2771 return r;
2772
2773 if (!ioprio_priority_is_valid(p))
2774 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid IO scheduling priority: %i", p);
2775
2e59b241 2776 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
ba7772fe 2777 c->ioprio = ioprio_normalize(ioprio_prio_value(ioprio_prio_class(c->ioprio), p));
7f452159
LP		 2778 c->ioprio_set = true;
2779
2e59b241 2780 unit_write_settingf(u, flags, name, "IOSchedulingPriority=%i", p);
7f452159
LP		 2781 }
2782
2783 return 1;
2784
5e98086d
ZJS		 2785 } else if (streq(name, "MountAPIVFS")) {
2786 bool b;
2787
2788 r = bus_set_transient_bool(u, name, &b, message, flags, error);
2789 if (r < 0)
2790 return r;
2791
2792 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2793 c->mount_apivfs = b;
2794 c->mount_apivfs_set = true;
2795 }
2796
2797 return 1;
2798
5f5d8eab
LP		 2799 } else if (streq(name, "WorkingDirectory")) {
2800 const char *s;
2801 bool missing_ok;
2802
2803 r = sd_bus_message_read(message, "s", &s);
2804 if (r < 0)
2805 return r;
2806
2807 if (s[0] == '-') {
2808 missing_ok = true;
2809 s++;
2810 } else
2811 missing_ok = false;
2812
d6ff82d3 2813 if (!isempty(s) && !streq(s, "~") && !path_is_absolute(s))
1b09b81c 2814 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "WorkingDirectory= expects an absolute path or '~'");
5f5d8eab 2815
2e59b241 2816 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
5f5d8eab
LP		 2817 if (streq(s, "~")) {
2818 c->working_directory = mfree(c->working_directory);
2819 c->working_directory_home = true;
2820 } else {
d6ff82d3 2821 r = free_and_strdup(&c->working_directory, empty_to_null(s));
5f5d8eab
LP		 2822 if (r < 0)
2823 return r;
2824
2825 c->working_directory_home = false;
2826 }
2827
2828 c->working_directory_missing_ok = missing_ok;
2e59b241 2829 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "WorkingDirectory=%s%s", missing_ok ? "-" : "", s);
5f5d8eab
LP		 2830 }
2831
2832 return 1;
2833
52c239d7
LB		 2834 } else if (STR_IN_SET(name,
2835 "StandardInputFileDescriptorName", "StandardOutputFileDescriptorName", "StandardErrorFileDescriptorName")) {
2836 const char *s;
2837
2838 r = sd_bus_message_read(message, "s", &s);
2839 if (r < 0)
2840 return r;
2841
d6ff82d3 2842 if (!isempty(s) && !fdname_is_valid(s))
1b09b81c 2843 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid file descriptor name");
52c239d7 2844
2e59b241 2845 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
5073ff6b 2846
52c239d7 2847 if (streq(name, "StandardInputFileDescriptorName")) {
d6ff82d3 2848 r = free_and_strdup(c->stdio_fdname + STDIN_FILENO, empty_to_null(s));
52c239d7
LB		 2849 if (r < 0)
2850 return r;
5073ff6b 2851
0664775c 2852 c->std_input = EXEC_INPUT_NAMED_FD;
2e59b241 2853 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardInput=fd:%s", exec_context_fdname(c, STDIN_FILENO));
5073ff6b 2854
52c239d7 2855 } else if (streq(name, "StandardOutputFileDescriptorName")) {
d6ff82d3 2856 r = free_and_strdup(c->stdio_fdname + STDOUT_FILENO, empty_to_null(s));
52c239d7
LB		 2857 if (r < 0)
2858 return r;
5073ff6b 2859
52c239d7 2860 c->std_output = EXEC_OUTPUT_NAMED_FD;
2e59b241 2861 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardOutput=fd:%s", exec_context_fdname(c, STDOUT_FILENO));
0664775c
LP		 2862
2863 } else {
2864 assert(streq(name, "StandardErrorFileDescriptorName"));
5073ff6b 2865
d6ff82d3 2866 r = free_and_strdup(&c->stdio_fdname[STDERR_FILENO], empty_to_null(s));
52c239d7
LB		 2867 if (r < 0)
2868 return r;
5073ff6b 2869
52c239d7 2870 c->std_error = EXEC_OUTPUT_NAMED_FD;
2e59b241 2871 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardError=fd:%s", exec_context_fdname(c, STDERR_FILENO));
52c239d7
LB		 2872 }
2873 }
2874
2875 return 1;
2876
566b7d23
ZD		 2877 } else if (STR_IN_SET(name,
2878 "StandardInputFile",
8d7dab1f
LW		 2879 "StandardOutputFile", "StandardOutputFileToAppend", "StandardOutputFileToTruncate",
2880 "StandardErrorFile", "StandardErrorFileToAppend", "StandardErrorFileToTruncate")) {
2038c3f5
LP		 2881 const char *s;
2882
2883 r = sd_bus_message_read(message, "s", &s);
2884 if (r < 0)
2885 return r;
2886
d6ff82d3
YW		 2887 if (!isempty(s)) {
2888 if (!path_is_absolute(s))
2889 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Path %s is not absolute", s);
2890 if (!path_is_normalized(s))
2891 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Path %s is not normalized", s);
2892 }
2038c3f5 2893
2e59b241 2894 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2038c3f5
LP		 2895
2896 if (streq(name, "StandardInputFile")) {
d6ff82d3 2897 r = free_and_strdup(&c->stdio_file[STDIN_FILENO], empty_to_null(s));
52c239d7
LB		 2898 if (r < 0)
2899 return r;
2038c3f5
LP		 2900
2901 c->std_input = EXEC_INPUT_FILE;
2e59b241 2902 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardInput=file:%s", s);
2038c3f5 2903
8d7dab1f 2904 } else if (STR_IN_SET(name, "StandardOutputFile", "StandardOutputFileToAppend", "StandardOutputFileToTruncate")) {
d6ff82d3 2905 r = free_and_strdup(&c->stdio_file[STDOUT_FILENO], empty_to_null(s));
2038c3f5
LP		 2906 if (r < 0)
2907 return r;
2908
566b7d23
ZD		 2909 if (streq(name, "StandardOutputFile")) {
2910 c->std_output = EXEC_OUTPUT_FILE;
2911 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardOutput=file:%s", s);
8d7dab1f 2912 } else if (streq(name, "StandardOutputFileToAppend")) {
566b7d23
ZD		 2913 c->std_output = EXEC_OUTPUT_FILE_APPEND;
2914 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardOutput=append:%s", s);
8d7dab1f
LW		 2915 } else {
2916 assert(streq(name, "StandardOutputFileToTruncate"));
2917 c->std_output = EXEC_OUTPUT_FILE_TRUNCATE;
2918 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardOutput=truncate:%s", s);
566b7d23 2919 }
2038c3f5 2920 } else {
8d7dab1f 2921 assert(STR_IN_SET(name, "StandardErrorFile", "StandardErrorFileToAppend", "StandardErrorFileToTruncate"));
2038c3f5 2922
d6ff82d3 2923 r = free_and_strdup(&c->stdio_file[STDERR_FILENO], empty_to_null(s));
2038c3f5
LP		 2924 if (r < 0)
2925 return r;
2926
566b7d23
ZD		 2927 if (streq(name, "StandardErrorFile")) {
2928 c->std_error = EXEC_OUTPUT_FILE;
1704fba9 2929 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardError=file:%s", s);
8d7dab1f 2930 } else if (streq(name, "StandardErrorFileToAppend")) {
dbe6c4b6 2931 c->std_error = EXEC_OUTPUT_FILE_APPEND;
1704fba9 2932 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardError=append:%s", s);
8d7dab1f
LW		 2933 } else {
2934 assert(streq(name, "StandardErrorFileToTruncate"));
2935 c->std_error = EXEC_OUTPUT_FILE_TRUNCATE;
2936 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "StandardError=truncate:%s", s);
566b7d23 2937 }
2038c3f5
LP		 2938 }
2939 }
2940
2941 return 1;
2942
08f3be7a
LP		 2943 } else if (streq(name, "StandardInputData")) {
2944 const void *p;
2945 size_t sz;
2946
2947 r = sd_bus_message_read_array(message, 'y', &p, &sz);
2948 if (r < 0)
2949 return r;
2950
2e59b241 2951 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
08f3be7a
LP		 2952 _cleanup_free_ char *encoded = NULL;
2953
2954 if (sz == 0) {
2955 c->stdin_data = mfree(c->stdin_data);
2956 c->stdin_data_size = 0;
2957
2e59b241 2958 unit_write_settingf(u, flags, name, "StandardInputData=");
08f3be7a
LP		 2959 } else {
2960 void *q;
2961 ssize_t n;
2962
2963 if (c->stdin_data_size + sz < c->stdin_data_size || /* check for overflow */
2964 c->stdin_data_size + sz > EXEC_STDIN_DATA_MAX)
2965 return -E2BIG;
2966
2967 n = base64mem(p, sz, &encoded);
2968 if (n < 0)
2969 return (int) n;
2970
2971 q = realloc(c->stdin_data, c->stdin_data_size + sz);
2972 if (!q)
2973 return -ENOMEM;
2974
2975 memcpy((uint8_t*) q + c->stdin_data_size, p, sz);
2976
2977 c->stdin_data = q;
2978 c->stdin_data_size += sz;
2979
2e59b241 2980 unit_write_settingf(u, flags, name, "StandardInputData=%s", encoded);
52c239d7
LB		 2981 }
2982 }
2983
2984 return 1;
2985
c7040b5d
LP		 2986 } else if (streq(name, "Environment")) {
2987
6171b822 2988 _cleanup_strv_free_ char **l = NULL;
c7040b5d
LP		 2989
2990 r = sd_bus_message_read_strv(message, &l);
2991 if (r < 0)
2992 return r;
2993
6171b822 2994 if (!strv_env_is_valid(l))
1b09b81c 2995 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment block.");
1c68232e 2996
2e59b241 2997 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
7b943bb7 2998 if (strv_isempty(l)) {
e9876fc9 2999 c->environment = strv_free(c->environment);
2e59b241 3000 unit_write_setting(u, flags, name, "Environment=");
e9876fc9 3001 } else {
f900f582
ZJS		 3002 _cleanup_free_ char *joined = NULL;
3003 char **e;
3004
2e59b241
LP		 3005 joined = unit_concat_strv(l, UNIT_ESCAPE_SPECIFIERS|UNIT_ESCAPE_C);
3006 if (!joined)
3007 return -ENOMEM;
3008
4ab3d29f 3009 e = strv_env_merge(c->environment, l);
e9876fc9
EV		 3010 if (!e)
3011 return -ENOMEM;
c7040b5d 3012
130d3d22 3013 strv_free_and_replace(c->environment, e);
2e59b241 3014 unit_write_settingf(u, flags, name, "Environment=%s", joined);
e9876fc9 3015 }
c7040b5d
LP		 3016 }
3017
d584f638
LP		 3018 return 1;
3019
00819cc1
LP		 3020 } else if (streq(name, "UnsetEnvironment")) {
3021
6171b822 3022 _cleanup_strv_free_ char **l = NULL;
00819cc1
LP		 3023
3024 r = sd_bus_message_read_strv(message, &l);
3025 if (r < 0)
3026 return r;
3027
6171b822 3028 if (!strv_env_name_or_assignment_is_valid(l))
1b09b81c 3029 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid UnsetEnvironment= list.");
00819cc1 3030
2e59b241 3031 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
7b943bb7 3032 if (strv_isempty(l)) {
00819cc1 3033 c->unset_environment = strv_free(c->unset_environment);
2e59b241 3034 unit_write_setting(u, flags, name, "UnsetEnvironment=");
00819cc1
LP		 3035 } else {
3036 _cleanup_free_ char *joined = NULL;
3037 char **e;
3038
2e59b241
LP		 3039 joined = unit_concat_strv(l, UNIT_ESCAPE_SPECIFIERS|UNIT_ESCAPE_C);
3040 if (!joined)
3041 return -ENOMEM;
3042
4ab3d29f 3043 e = strv_env_merge(c->unset_environment, l);
00819cc1
LP		 3044 if (!e)
3045 return -ENOMEM;
3046
130d3d22 3047 strv_free_and_replace(c->unset_environment, e);
2e59b241 3048 unit_write_settingf(u, flags, name, "UnsetEnvironment=%s", joined);
00819cc1
LP		 3049 }
3050 }
3051
3052 return 1;
3053
6b862936
EV		 3054 } else if (streq(name, "OOMScoreAdjust")) {
3055 int oa;
3056
3057 r = sd_bus_message_read(message, "i", &oa);
3058 if (r < 0)
3059 return r;
3060
3061 if (!oom_score_adjust_is_valid(oa))
1b09b81c 3062 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "OOM score adjust value out of range");
6b862936 3063
2e59b241 3064 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
6b862936
EV		 3065 c->oom_score_adjust = oa;
3066 c->oom_score_adjust_set = true;
2e59b241 3067 unit_write_settingf(u, flags, name, "OOMScoreAdjust=%i", oa);
6b862936
EV		 3068 }
3069
3070 return 1;
3071
ad21e542
ZJS		 3072 } else if (streq(name, "CoredumpFilter")) {
3073 uint64_t f;
3074
3075 r = sd_bus_message_read(message, "t", &f);
3076 if (r < 0)
3077 return r;
3078
3079 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3080 c->coredump_filter = f;
3081 c->coredump_filter_set = true;
3082 unit_write_settingf(u, flags, name, "CoredumpFilter=0x%"PRIx64, f);
3083 }
3084
3085 return 1;
3086
ceb728cf
NC		 3087 } else if (streq(name, "EnvironmentFiles")) {
3088
3089 _cleanup_free_ char *joined = NULL;
3090 _cleanup_fclose_ FILE *f = NULL;
9b531f04 3091 _cleanup_strv_free_ char **l = NULL;
ceb728cf 3092 size_t size = 0;
ceb728cf
NC		 3093
3094 r = sd_bus_message_enter_container(message, 'a', "(sb)");
3095 if (r < 0)
3096 return r;
3097
2fe21124 3098 f = open_memstream_unlocked(&joined, &size);
ceb728cf
NC		 3099 if (!f)
3100 return -ENOMEM;
3101
2e59b241
LP		 3102 fputs("EnvironmentFile=\n", f);
3103
3104 STRV_FOREACH(i, c->environment_files) {
3105 _cleanup_free_ char *q = NULL;
3106
3107 q = specifier_escape(*i);
3108 if (!q)
3109 return -ENOMEM;
3110
3111 fprintf(f, "EnvironmentFile=%s\n", q);
3112 }
ceb728cf
NC		 3113
3114 while ((r = sd_bus_message_enter_container(message, 'r', "sb")) > 0) {
3115 const char *path;
3116 int b;
3117
ceb728cf
NC		 3118 r = sd_bus_message_read(message, "sb", &path, &b);
3119 if (r < 0)
3120 return r;
3121
3122 r = sd_bus_message_exit_container(message);
3123 if (r < 0)
3124 return r;
3125
d2d6c096
LP		 3126 if (!path_is_absolute(path))
3127 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Path %s is not absolute.", path);
ceb728cf 3128
2e59b241 3129 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
6abdec98 3130 _cleanup_free_ char *q = NULL, *buf = NULL;
ceb728cf 3131
605405c6 3132 buf = strjoin(b ? "-" : "", path);
2229f656 3133 if (!buf)
ceb728cf
NC		 3134 return -ENOMEM;
3135
2e59b241 3136 q = specifier_escape(buf);
6abdec98 3137 if (!q)
2e59b241 3138 return -ENOMEM;
2e59b241
LP		 3139
3140 fprintf(f, "EnvironmentFile=%s\n", q);
ceb728cf 3141
6abdec98 3142 r = strv_consume(&l, TAKE_PTR(buf));
ceb728cf
NC		 3143 if (r < 0)
3144 return r;
3145 }
3146 }
3147 if (r < 0)
3148 return r;
3149
b0830e21
LP		 3150 r = sd_bus_message_exit_container(message);
3151 if (r < 0)
3152 return r;
3153
2229f656
LP		 3154 r = fflush_and_check(f);
3155 if (r < 0)
3156 return r;
ceb728cf 3157
2e59b241 3158 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
2229f656
LP		 3159 if (strv_isempty(l)) {
3160 c->environment_files = strv_free(c->environment_files);
2e59b241 3161 unit_write_setting(u, flags, name, "EnvironmentFile=");
2229f656
LP		 3162 } else {
3163 r = strv_extend_strv(&c->environment_files, l, true);
3164 if (r < 0)
3165 return r;
3166
2e59b241 3167 unit_write_setting(u, flags, name, joined);
2229f656
LP		 3168 }
3169 }
ceb728cf 3170
ceb728cf
NC		 3171 return 1;
3172
b4c14404
FB		 3173 } else if (streq(name, "PassEnvironment")) {
3174
6171b822 3175 _cleanup_strv_free_ char **l = NULL;
b4c14404
FB		 3176
3177 r = sd_bus_message_read_strv(message, &l);
3178 if (r < 0)
3179 return r;
3180
6171b822 3181 if (!strv_env_name_is_valid(l))
1b09b81c 3182 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid PassEnvironment= block.");
b4c14404 3183
2e59b241 3184 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
b4c14404
FB		 3185 if (strv_isempty(l)) {
3186 c->pass_environment = strv_free(c->pass_environment);
2e59b241 3187 unit_write_setting(u, flags, name, "PassEnvironment=");
b4c14404
FB		 3188 } else {
3189 _cleanup_free_ char *joined = NULL;
3190
9d4f242a
YW		 3191 r = strv_extend_strv(&c->pass_environment, l, true);
3192 if (r < 0)
3193 return r;
3194
41de9cc2 3195 /* We write just the new settings out to file, with unresolved specifiers. */
2e59b241 3196 joined = unit_concat_strv(l, UNIT_ESCAPE_SPECIFIERS);
b4c14404
FB		 3197 if (!joined)
3198 return -ENOMEM;
3199
2e59b241 3200 unit_write_settingf(u, flags, name, "PassEnvironment=%s", joined);
b4c14404
FB		 3201 }
3202 }
3203
3204 return 1;
3205
2a624c36 3206 } else if (STR_IN_SET(name, "ReadWriteDirectories", "ReadOnlyDirectories", "InaccessibleDirectories",
a07b9926
LB		 3207 "ReadWritePaths", "ReadOnlyPaths", "InaccessiblePaths", "ExecPaths", "NoExecPaths",
3208 "ExtensionDirectories")) {
08596068
EV		 3209 _cleanup_strv_free_ char **l = NULL;
3210 char ***dirs;
08596068
EV		 3211
3212 r = sd_bus_message_read_strv(message, &l);
3213 if (r < 0)
3214 return r;
3215
3216 STRV_FOREACH(p, l) {
e7bcff4e 3217 char *i = *p;
20b7a007
LP		 3218 size_t offset;
3219
20b7a007
LP		 3220 offset = i[0] == '-';
3221 offset += i[offset] == '+';
3222 if (!path_is_absolute(i + offset))
08596068 3223 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid %s", name);
e7bcff4e 3224
4ff361cc 3225 path_simplify(i + offset);
08596068
EV		 3226 }
3227
2e59b241 3228 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
c4b41707
AP		 3229 if (STR_IN_SET(name, "ReadWriteDirectories", "ReadWritePaths"))
3230 dirs = &c->read_write_paths;
3231 else if (STR_IN_SET(name, "ReadOnlyDirectories", "ReadOnlyPaths"))
3232 dirs = &c->read_only_paths;
ddc155b2
TM		 3233 else if (streq(name, "ExecPaths"))
3234 dirs = &c->exec_paths;
3235 else if (streq(name, "NoExecPaths"))
3236 dirs = &c->no_exec_paths;
a07b9926
LB		 3237 else if (streq(name, "ExtensionDirectories"))
3238 dirs = &c->extension_directories;
c4b41707
AP		 3239 else /* "InaccessiblePaths" */
3240 dirs = &c->inaccessible_paths;
08596068 3241
7b943bb7 3242 if (strv_isempty(l)) {
08596068 3243 *dirs = strv_free(*dirs);
2e59b241 3244 unit_write_settingf(u, flags, name, "%s=", name);
08596068 3245 } else {
2e59b241 3246 _cleanup_free_ char *joined = NULL;
08596068 3247
2e59b241 3248 joined = unit_concat_strv(l, UNIT_ESCAPE_SPECIFIERS);
08596068
EV		 3249 if (!joined)
3250 return -ENOMEM;
3251
2e59b241
LP		 3252 r = strv_extend_strv(dirs, l, true);
3253 if (r < 0)
3254 return -ENOMEM;
08596068 3255
2e59b241
LP		 3256 unit_write_settingf(u, flags, name, "%s=%s", name, joined);
3257 }
08596068
EV		 3258 }
3259
3260 return 1;
3261
8c35c10d 3262 } else if (streq(name, "ExecSearchPath")) {
3263 _cleanup_strv_free_ char **l = NULL;
8c35c10d 3264
3265 r = sd_bus_message_read_strv(message, &l);
3266 if (r < 0)
3267 return r;
3268
de010b0b 3269 STRV_FOREACH(p, l)
8c35c10d 3270 if (!path_is_absolute(*p) || !path_is_normalized(*p) || strchr(*p, ':'))
3271 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid %s", name);
de010b0b 3272
8c35c10d 3273 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3274 if (strv_isempty(l)) {
3275 c->exec_search_path = strv_free(c->exec_search_path);
3276 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "ExecSearchPath=");
3277 } else {
3278 _cleanup_free_ char *joined = NULL;
3279 r = strv_extend_strv(&c->exec_search_path, l, true);
3280 if (r < 0)
3281 return -ENOMEM;
3282 joined = strv_join(c->exec_search_path, ":");
3283 if (!joined)
3284 return log_oom();
3285 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "ExecSearchPath=%s", joined);
3286 }
3287 }
3288
3289 return 1;
3290
3536f49e 3291 } else if (STR_IN_SET(name, "RuntimeDirectory", "StateDirectory", "CacheDirectory", "LogsDirectory", "ConfigurationDirectory")) {
fa21b5e3 3292 _cleanup_strv_free_ char **l = NULL;
fa21b5e3
EV		 3293
3294 r = sd_bus_message_read_strv(message, &l);
3295 if (r < 0)
3296 return r;
3297
3298 STRV_FOREACH(p, l) {
8994a117
YW		 3299 if (!path_is_normalized(*p))
3300 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "%s= path is not normalized: %s", name, *p);
3301
3302 if (path_is_absolute(*p))
3303 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "%s= path is absolute: %s", name, *p);
3304
3305 if (path_startswith(*p, "private"))
3306 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "%s= path can't be 'private': %s", name, *p);
fa21b5e3
EV		 3307 }
3308
2e59b241 3309 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3536f49e 3310 ExecDirectoryType i;
b1ea85dc 3311 ExecDirectory *d;
3536f49e 3312
b1ea85dc
LP		 3313 assert_se((i = exec_directory_type_from_string(name)) >= 0);
3314 d = c->directories + i;
fa21b5e3
EV		 3315
3316 if (strv_isempty(l)) {
211a3d87 3317 exec_directory_done(d);
2e59b241 3318 unit_write_settingf(u, flags, name, "%s=", name);
fa21b5e3 3319 } else {
2e59b241
LP		 3320 _cleanup_free_ char *joined = NULL;
3321
211a3d87 3322 STRV_FOREACH(source, l) {
564e5c98 3323 r = exec_directory_add(d, *source, NULL);
211a3d87
LB		 3324 if (r < 0)
3325 return log_oom();
3326 }
a2ab603c 3327 exec_directory_sort(d);
fa21b5e3 3328
2e59b241 3329 joined = unit_concat_strv(l, UNIT_ESCAPE_SPECIFIERS);
fa21b5e3
EV		 3330 if (!joined)
3331 return -ENOMEM;
3332
2e59b241 3333 unit_write_settingf(u, flags, name, "%s=%s", name, joined);
fa21b5e3
EV		 3334 }
3335 }
3336
3337 return 1;
3338
cffaed83
YW		 3339 } else if (STR_IN_SET(name, "AppArmorProfile", "SmackProcessLabel")) {
3340 int ignore;
3341 const char *s;
3342
280921f2 3343 r = sd_bus_message_read(message, "(bs)", &ignore, &s);
cffaed83
YW		 3344 if (r < 0)
3345 return r;
3346
2e59b241 3347 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
cffaed83
YW		 3348 char **p;
3349 bool *b;
3350
3351 if (streq(name, "AppArmorProfile")) {
3352 p = &c->apparmor_profile;
3353 b = &c->apparmor_profile_ignore;
3354 } else { /* "SmackProcessLabel" */
3355 p = &c->smack_process_label;
3356 b = &c->smack_process_label_ignore;
3357 }
3358
3359 if (isempty(s)) {
3360 *p = mfree(*p);
3361 *b = false;
3362 } else {
3363 if (free_and_strdup(p, s) < 0)
3364 return -ENOMEM;
3365 *b = ignore;
3366 }
3367
2e59b241 3368 unit_write_settingf(u, flags|UNIT_ESCAPE_SPECIFIERS, name, "%s=%s%s", name, ignore ? "-" : "", strempty(s));
cffaed83
YW		 3369 }
3370
3371 return 1;
3372
d2d6c096 3373 } else if (STR_IN_SET(name, "BindPaths", "BindReadOnlyPaths")) {
ec04aef4 3374 char *source, *destination;
4ff4c98a
YW		 3375 int ignore_enoent;
3376 uint64_t mount_flags;
3377 bool empty = true;
d2d6c096
LP		 3378
3379 r = sd_bus_message_enter_container(message, 'a', "(ssbt)");
3380 if (r < 0)
3381 return r;
3382
4ff4c98a 3383 while ((r = sd_bus_message_read(message, "(ssbt)", &source, &destination, &ignore_enoent, &mount_flags)) > 0) {
d2d6c096
LP		 3384
3385 if (!path_is_absolute(source))
3386 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not absolute.", source);
3387 if (!path_is_absolute(destination))
91d910e3 3388 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is not absolute.", destination);
d2d6c096 3389 if (!IN_SET(mount_flags, 0, MS_REC))
1b09b81c 3390 return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Unknown mount flags.");
d2d6c096 3391
2e59b241 3392 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
d2d6c096
LP		 3393 r = bind_mount_add(&c->bind_mounts, &c->n_bind_mounts,
3394 &(BindMount) {
ec04aef4
TM		 3395 .source = source,
3396 .destination = destination,
d2d6c096
LP		 3397 .read_only = !!strstr(name, "ReadOnly"),
3398 .recursive = !!(mount_flags & MS_REC),
3399 .ignore_enoent = ignore_enoent,
3400 });
3401 if (r < 0)
3402 return r;
3403
2e59b241
LP		 3404 unit_write_settingf(
3405 u, flags|UNIT_ESCAPE_SPECIFIERS, name,
d2d6c096
LP		 3406 "%s=%s%s:%s:%s",
3407 name,
3408 ignore_enoent ? "-" : "",
3409 source,
3410 destination,
3411 (mount_flags & MS_REC) ? "rbind" : "norbind");
3412 }
3413
3414 empty = false;
3415 }
3416 if (r < 0)
3417 return r;
3418
3419 r = sd_bus_message_exit_container(message);
3420 if (r < 0)
3421 return r;
3422
3423 if (empty) {
3424 bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
3425 c->bind_mounts = NULL;
3426 c->n_bind_mounts = 0;
2e59b241
LP		 3427
3428 unit_write_settingf(u, flags, name, "%s=", name);
d2d6c096
LP		 3429 }
3430
784ad252
YW		 3431 return 1;
3432
3433 } else if (streq(name, "TemporaryFileSystem")) {
3434 const char *path, *options;
3435 bool empty = true;
3436
3437 r = sd_bus_message_enter_container(message, 'a', "(ss)");
3438 if (r < 0)
3439 return r;
3440
3441 while ((r = sd_bus_message_read(message, "(ss)", &path, &options)) > 0) {
3442
3443 if (!path_is_absolute(path))
3444 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Mount point %s is not absolute.", path);
3445
3446 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3447 r = temporary_filesystem_add(&c->temporary_filesystems, &c->n_temporary_filesystems, path, options);
3448 if (r < 0)
3449 return r;
3450
3451 unit_write_settingf(
3452 u, flags|UNIT_ESCAPE_SPECIFIERS, name,
3453 "%s=%s:%s",
3454 name,
3455 path,
3456 options);
3457 }
3458
3459 empty = false;
3460 }
3461 if (r < 0)
3462 return r;
3463
3464 r = sd_bus_message_exit_container(message);
3465 if (r < 0)
3466 return r;
3467
3468 if (empty) {
3469 temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);
3470 c->temporary_filesystems = NULL;
3471 c->n_temporary_filesystems = 0;
3472
3473 unit_write_settingf(u, flags, name, "%s=", name);
3474 }
3475
83555251 3476 return 1;
d2d6c096 3477
6550c24c
LP		 3478 } else if ((suffix = startswith(name, "Limit"))) {
3479 const char *soft = NULL;
3480 int ri;
cab2aca3 3481
6550c24c
LP		 3482 ri = rlimit_from_string(suffix);
3483 if (ri < 0) {
3484 soft = endswith(suffix, "Soft");
3485 if (soft) {
3486 const char *n;
cab2aca3 3487
2f82562b 3488 n = strndupa_safe(suffix, soft - suffix);
6550c24c
LP		 3489 ri = rlimit_from_string(n);
3490 if (ri >= 0)
3491 name = strjoina("Limit", n);
3492 }
cab2aca3 3493 }
d584f638 3494
6550c24c
LP		 3495 if (ri >= 0) {
3496 uint64_t rl;
3497 rlim_t x;
d584f638 3498
6550c24c 3499 r = sd_bus_message_read(message, "t", &rl);
cab2aca3
LP		 3500 if (r < 0)
3501 return r;
d584f638 3502
f5fbe71d 3503 if (rl == UINT64_MAX)
6550c24c 3504 x = RLIM_INFINITY;
cab2aca3 3505 else {
6550c24c
LP		 3506 x = (rlim_t) rl;
3507
3508 if ((uint64_t) x != rl)
3509 return -ERANGE;
d584f638
LP		 3510 }
3511
6550c24c
LP		 3512 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3513 _cleanup_free_ char *f = NULL;
3514 struct rlimit nl;
3515
3516 if (c->rlimit[ri]) {
3517 nl = *c->rlimit[ri];
3518
3519 if (soft)
3520 nl.rlim_cur = x;
3521 else
3522 nl.rlim_max = x;
3523 } else
3524 /* When the resource limit is not initialized yet, then assign the value to both fields */
3525 nl = (struct rlimit) {
3526 .rlim_cur = x,
3527 .rlim_max = x,
3528 };
3529
3530 r = rlimit_format(&nl, &f);
3531 if (r < 0)
3532 return r;
3533
3534 if (c->rlimit[ri])
3535 *c->rlimit[ri] = nl;
3536 else {
3537 c->rlimit[ri] = newdup(struct rlimit, &nl, 1);
3538 if (!c->rlimit[ri])
3539 return -ENOMEM;
3540 }
3541
3542 unit_write_settingf(u, flags, name, "%s=%s", name, f);
3543 }
3544
3545 return 1;
d584f638
LP		 3546 }
3547
b3d13314
LB		 3548 } else if (streq(name, "MountImages")) {
3549 _cleanup_free_ char *format_str = NULL;
3550 MountImage *mount_images = NULL;
3551 size_t n_mount_images = 0;
3552 char *source, *destination;
3553 int permissive;
3554
427353f6 3555 r = sd_bus_message_enter_container(message, 'a', "(ssba(ss))");
b3d13314
LB		 3556 if (r < 0)
3557 return r;
3558
427353f6
LB		 3559 for (;;) {
3560 _cleanup_(mount_options_free_allp) MountOptions *options = NULL;
3561 _cleanup_free_ char *source_escaped = NULL, *destination_escaped = NULL;
b3d13314
LB		 3562 char *tuple;
3563
427353f6
LB		 3564 r = sd_bus_message_enter_container(message, 'r', "ssba(ss)");
3565 if (r < 0)
3566 return r;
3567
3568 r = sd_bus_message_read(message, "ssb", &source, &destination, &permissive);
3569 if (r <= 0)
3570 break;
3571
b3d13314
LB		 3572 if (!path_is_absolute(source))
3573 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not absolute.", source);
3574 if (!path_is_normalized(source))
3575 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not normalized.", source);
3576 if (!path_is_absolute(destination))
3577 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is not absolute.", destination);
3578 if (!path_is_normalized(destination))
3579 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is not normalized.", destination);
3580
427353f6
LB		 3581 /* Need to store them in the unit with the escapes, so that they can be parsed again */
3582 source_escaped = shell_escape(source, ":");
3583 if (!source_escaped)
3584 return -ENOMEM;
3585 destination_escaped = shell_escape(destination, ":");
3586 if (!destination_escaped)
3587 return -ENOMEM;
3588
3589 tuple = strjoin(format_str,
3590 format_str ? " " : "",
3591 permissive ? "-" : "",
3592 source_escaped,
3593 ":",
3594 destination_escaped);
b3d13314
LB		 3595 if (!tuple)
3596 return -ENOMEM;
3597 free_and_replace(format_str, tuple);
3598
988172ce 3599 r = bus_read_mount_options(message, error, &options, &format_str, ":");
427353f6
LB		 3600 if (r < 0)
3601 return r;
3602
3603 r = sd_bus_message_exit_container(message);
3604 if (r < 0)
3605 return r;
3606
b3d13314
LB		 3607 r = mount_image_add(&mount_images, &n_mount_images,
3608 &(MountImage) {
3609 .source = source,
3610 .destination = destination,
427353f6 3611 .mount_options = options,
b3d13314 3612 .ignore_enoent = permissive,
93f59701 3613 .type = MOUNT_IMAGE_DISCRETE,
b3d13314
LB		 3614 });
3615 if (r < 0)
3616 return r;
3617 }
3618 if (r < 0)
3619 return r;
3620
3621 r = sd_bus_message_exit_container(message);
3622 if (r < 0)
3623 return r;
3624
3625 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3626 if (n_mount_images == 0) {
3627 c->mount_images = mount_image_free_many(c->mount_images, &c->n_mount_images);
3628
3629 unit_write_settingf(u, flags, name, "%s=", name);
3630 } else {
3631 for (size_t i = 0; i < n_mount_images; ++i) {
3632 r = mount_image_add(&c->mount_images, &c->n_mount_images, &mount_images[i]);
3633 if (r < 0)
3634 return r;
3635 }
3636
3637 unit_write_settingf(u, flags|UNIT_ESCAPE_C|UNIT_ESCAPE_SPECIFIERS,
3638 name,
3639 "%s=%s",
3640 name,
3641 format_str);
3642 }
3643 }
3644
3645 mount_images = mount_image_free_many(mount_images, &n_mount_images);
3646
93f59701
LB		 3647 return 1;
3648 } else if (streq(name, "ExtensionImages")) {
3649 _cleanup_free_ char *format_str = NULL;
3650 MountImage *extension_images = NULL;
3651 size_t n_extension_images = 0;
3652
3653 r = sd_bus_message_enter_container(message, 'a', "(sba(ss))");
3654 if (r < 0)
3655 return r;
3656
3657 for (;;) {
3658 _cleanup_(mount_options_free_allp) MountOptions *options = NULL;
3659 _cleanup_free_ char *source_escaped = NULL;
3660 char *source, *tuple;
3661 int permissive;
3662
3663 r = sd_bus_message_enter_container(message, 'r', "sba(ss)");
3664 if (r < 0)
3665 return r;
3666
3667 r = sd_bus_message_read(message, "sb", &source, &permissive);
3668 if (r <= 0)
3669 break;
3670
3671 if (!path_is_absolute(source))
3672 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not absolute.", source);
3673 if (!path_is_normalized(source))
3674 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not normalized.", source);
3675
3676 /* Need to store them in the unit with the escapes, so that they can be parsed again */
3677 source_escaped = shell_escape(source, ":");
3678 if (!source_escaped)
3679 return -ENOMEM;
3680
3681 tuple = strjoin(format_str,
3682 format_str ? " " : "",
3683 permissive ? "-" : "",
3684 source_escaped);
3685 if (!tuple)
3686 return -ENOMEM;
3687 free_and_replace(format_str, tuple);
3688
3689 r = bus_read_mount_options(message, error, &options, &format_str, ":");
3690 if (r < 0)
3691 return r;
3692
3693 r = sd_bus_message_exit_container(message);
3694 if (r < 0)
3695 return r;
3696
3697 r = mount_image_add(&extension_images, &n_extension_images,
3698 &(MountImage) {
3699 .source = source,
3700 .mount_options = options,
3701 .ignore_enoent = permissive,
3702 .type = MOUNT_IMAGE_EXTENSION,
3703 });
3704 if (r < 0)
3705 return r;
3706 }
3707 if (r < 0)
3708 return r;
3709
3710 r = sd_bus_message_exit_container(message);
3711 if (r < 0)
3712 return r;
3713
3714 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3715 if (n_extension_images == 0) {
3716 c->extension_images = mount_image_free_many(c->extension_images, &c->n_extension_images);
3717
3718 unit_write_settingf(u, flags, name, "%s=", name);
3719 } else {
3720 for (size_t i = 0; i < n_extension_images; ++i) {
3721 r = mount_image_add(&c->extension_images, &c->n_extension_images, &extension_images[i]);
3722 if (r < 0)
3723 return r;
3724 }
3725
3726 unit_write_settingf(u, flags|UNIT_ESCAPE_C|UNIT_ESCAPE_SPECIFIERS,
3727 name,
3728 "%s=%s",
3729 name,
3730 format_str);
3731 }
3732 }
3733
3734 extension_images = mount_image_free_many(extension_images, &n_extension_images);
3735
b3d13314 3736 return 1;
211a3d87
LB		 3737
3738 } else if (STR_IN_SET(name, "StateDirectorySymlink", "RuntimeDirectorySymlink", "CacheDirectorySymlink", "LogsDirectorySymlink")) {
3739 char *source, *destination;
3740 ExecDirectory *directory;
3741 uint64_t symlink_flags; /* No flags for now, reserved for future uses. */
3742 ExecDirectoryType i;
3743
3744 assert_se((i = exec_directory_type_symlink_from_string(name)) >= 0);
3745 directory = c->directories + i;
3746
3747 r = sd_bus_message_enter_container(message, 'a', "(sst)");
3748 if (r < 0)
3749 return r;
3750
3751 while ((r = sd_bus_message_read(message, "(sst)", &source, &destination, &symlink_flags)) > 0) {
3752 if (!path_is_valid(source))
3753 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not valid.", source);
3754 if (path_is_absolute(source))
3755 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is absolute.", source);
3756 if (!path_is_normalized(source))
3757 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Source path %s is not normalized.", source);
3758 if (!path_is_valid(destination))
3759 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is not valid.", destination);
3760 if (path_is_absolute(destination))
3761 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is absolute.", destination);
3762 if (!path_is_normalized(destination))
3763 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path %s is not normalized.", destination);
3764 if (symlink_flags != 0)
3765 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Flags must be zero.");
3766
3767 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
3768 _cleanup_free_ char *destination_escaped = NULL, *source_escaped = NULL;
564e5c98
YW		 3769
3770 r = exec_directory_add(directory, source, destination);
211a3d87
LB		 3771 if (r < 0)
3772 return r;
3773
3774 /* Need to store them in the unit with the escapes, so that they can be parsed again */
3775 source_escaped = xescape(source, ":");
3776 destination_escaped = xescape(destination, ":");
3777 if (!source_escaped || !destination_escaped)
3778 return -ENOMEM;
3779
3780 unit_write_settingf(
3781 u, flags|UNIT_ESCAPE_SPECIFIERS, exec_directory_type_to_string(i),
3782 "%s=%s:%s",
3783 exec_directory_type_to_string(i),
3784 source_escaped,
3785 destination_escaped);
3786 }
3787 }
3788 if (r < 0)
3789 return r;
3790
a2ab603c
YW		 3791 exec_directory_sort(directory);
3792
211a3d87
LB		 3793 r = sd_bus_message_exit_container(message);
3794 if (r < 0)
3795 return r;
3796
3797 return 1;
3798
c7040b5d
LP		 3799 }
3800
3801 return 0;
3802}
Unnamed repository; edit this file 'description' to name the repository.