]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/core/execute.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
exit-status: add new exit code for custom endpoint errors
[thirdparty/systemd.git] / src / core / execute.c
CommitLineData
d6c9574f 1/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
5cb5a6ff 2
a7334b09
LP		 3/***
4 This file is part of systemd.
5
6 Copyright 2010 Lennart Poettering
7
8 systemd is free software; you can redistribute it and/or modify it
5430f7f2
LP		 9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
a7334b09
LP		 11 (at your option) any later version.
12
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2 16 Lesser General Public License for more details.
a7334b09 17
5430f7f2 18 You should have received a copy of the GNU Lesser General Public License
a7334b09
LP		 19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
20***/
21
5cb5a6ff 22#include <assert.h>
034c6ed7
LP		 23#include <dirent.h>
24#include <errno.h>
25#include <fcntl.h>
26#include <unistd.h>
44d8db9e 27#include <string.h>
309bff19 28#include <signal.h>
071830ff
LP		 29#include <sys/socket.h>
30#include <sys/un.h>
94f04347 31#include <sys/prctl.h>
66ee3769 32#include <linux/sched.h>
451a074f
LP		 33#include <sys/types.h>
34#include <sys/stat.h>
81a2b7ce
LP		 35#include <grp.h>
36#include <pwd.h>
15ae422b 37#include <sys/mount.h>
25e870b5 38#include <linux/fs.h>
dd6c17b1 39#include <linux/oom.h>
f2b68789 40#include <sys/poll.h>
2bef10ab 41#include <glob.h>
ac45f971 42#include <sys/personality.h>
d34cd374 43#include <libgen.h>
2b6bf07d 44#undef basename
5cb5a6ff 45
5b6319dc
LP		 46#ifdef HAVE_PAM
47#include <security/pam_appl.h>
48#endif
49
7b52a628
MS		 50#ifdef HAVE_SELINUX
51#include <selinux/selinux.h>
52#endif
53
17df7223
LP		 54#ifdef HAVE_SECCOMP
55#include <seccomp.h>
56#endif
57
eef65bf3
MS		 58#ifdef HAVE_APPARMOR
59#include <sys/apparmor.h>
60#endif
61
5cb5a6ff
LP		 62#include "execute.h"
63#include "strv.h"
64#include "macro.h"
d7832d2c 65#include "capability.h"
5cb5a6ff 66#include "util.h"
acbb0225 67#include "log.h"
20ad4cfd 68#include "sd-messages.h"
9eba9da4 69#include "ioprio.h"
94f04347 70#include "securebits.h"
15ae422b 71#include "namespace.h"
d06dacd0 72#include "exit-status.h"
dd6c17b1 73#include "missing.h"
169c1bda 74#include "utmp-wtmp.h"
f6a6225e 75#include "def.h"
9eb977db 76#include "path-util.h"
4d1a6904 77#include "env-util.h"
a5c32cff 78#include "fileio.h"
4ad49000 79#include "unit.h"
f485606b 80#include "async.h"
0d3f7bb3 81#include "selinux-util.h"
17df7223 82#include "errno-list.h"
4298d0b5 83#include "af-list.h"
e66cf1a3 84#include "mkdir.h"
eef65bf3 85#include "apparmor-util.h"
5cb5a6ff 86
57183d11
LP		 87#ifdef HAVE_SECCOMP
88#include "seccomp-util.h"
89#endif
90
e056b01d 91#define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
31a7eb86 92#define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
e6a26745 93
02a51aba
LP		 94/* This assumes there is a 'tty' group */
95#define TTY_MODE 0620
96
531dca78
LP		 97#define SNDBUF_SIZE (8*1024*1024)
98
034c6ed7
LP		 99static int shift_fds(int fds[], unsigned n_fds) {
100 int start, restart_from;
101
102 if (n_fds <= 0)
103 return 0;
104
a0d40ac5
LP		 105 /* Modifies the fds array! (sorts it) */
106
034c6ed7
LP		 107 assert(fds);
108
109 start = 0;
110 for (;;) {
111 int i;
112
113 restart_from = -1;
114
115 for (i = start; i < (int) n_fds; i++) {
116 int nfd;
117
118 /* Already at right index? */
119 if (fds[i] == i+3)
120 continue;
121
122 if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
123 return -errno;
124
03e334a1 125 safe_close(fds[i]);
034c6ed7
LP		 126 fds[i] = nfd;
127
128 /* Hmm, the fd we wanted isn't free? Then
129 * let's remember that and try again from here*/
130 if (nfd != i+3 && restart_from < 0)
131 restart_from = i;
132 }
133
134 if (restart_from < 0)
135 break;
136
137 start = restart_from;
138 }
139
140 return 0;
141}
142
c2748801 143static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
47a71eed 144 unsigned i;
e2c76839 145 int r;
47a71eed
LP		 146
147 if (n_fds <= 0)
148 return 0;
149
150 assert(fds);
151
451a074f 152 /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
47a71eed
LP		 153
154 for (i = 0; i < n_fds; i++) {
47a71eed 155
e2c76839
LP		 156 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
157 return r;
47a71eed 158
451a074f
LP		 159 /* We unconditionally drop FD_CLOEXEC from the fds,
160 * since after all we want to pass these fds to our
161 * children */
47a71eed 162
e2c76839
LP		 163 if ((r = fd_cloexec(fds[i], false)) < 0)
164 return r;
47a71eed
LP		 165 }
166
167 return 0;
168}
169
44a6b1b6 170_pure_ static const char *tty_path(const ExecContext *context) {
80876c20
LP		 171 assert(context);
172
173 if (context->tty_path)
174 return context->tty_path;
175
176 return "/dev/console";
177}
178
9588bc32 179static void exec_context_tty_reset(const ExecContext *context) {
6ea832a2
LP		 180 assert(context);
181
182 if (context->tty_vhangup)
183 terminal_vhangup(tty_path(context));
184
185 if (context->tty_reset)
186 reset_terminal(tty_path(context));
187
188 if (context->tty_vt_disallocate && context->tty_path)
189 vt_disallocate(context->tty_path);
190}
191
3a1286b6
MS		 192static bool is_terminal_output(ExecOutput o) {
193 return
194 o == EXEC_OUTPUT_TTY ||
195 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
196 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
197 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
198}
199
80876c20
LP		 200static int open_null_as(int flags, int nfd) {
201 int fd, r;
071830ff 202
80876c20 203 assert(nfd >= 0);
071830ff 204
613b411c
LP		 205 fd = open("/dev/null", flags|O_NOCTTY);
206 if (fd < 0)
071830ff
LP		 207 return -errno;
208
80876c20
LP		 209 if (fd != nfd) {
210 r = dup2(fd, nfd) < 0 ? -errno : nfd;
03e334a1 211 safe_close(fd);
80876c20
LP		 212 } else
213 r = nfd;
071830ff 214
80876c20 215 return r;
071830ff
LP		 216}
217
62bca2c6 218static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
80876c20 219 int fd, r;
b92bea5d
ZJS		 220 union sockaddr_union sa = {
221 .un.sun_family = AF_UNIX,
222 .un.sun_path = "/run/systemd/journal/stdout",
223 };
071830ff
LP		 224
225 assert(context);
80876c20
LP		 226 assert(output < _EXEC_OUTPUT_MAX);
227 assert(ident);
228 assert(nfd >= 0);
071830ff 229
54fe0cdb
LP		 230 fd = socket(AF_UNIX, SOCK_STREAM, 0);
231 if (fd < 0)
80876c20 232 return -errno;
071830ff 233
54fe0cdb
LP		 234 r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
235 if (r < 0) {
03e334a1 236 safe_close(fd);
80876c20
LP		 237 return -errno;
238 }
071830ff 239
80876c20 240 if (shutdown(fd, SHUT_RD) < 0) {
03e334a1 241 safe_close(fd);
80876c20
LP		 242 return -errno;
243 }
071830ff 244
531dca78
LP		 245 fd_inc_sndbuf(fd, SNDBUF_SIZE);
246
80876c20 247 dprintf(fd,
62bca2c6 248 "%s\n"
80876c20
LP		 249 "%s\n"
250 "%i\n"
54fe0cdb
LP		 251 "%i\n"
252 "%i\n"
253 "%i\n"
4f4a1dbf 254 "%i\n",
4f4a1dbf 255 context->syslog_identifier ? context->syslog_identifier : ident,
62bca2c6 256 unit_id,
54fe0cdb
LP		 257 context->syslog_priority,
258 !!context->syslog_level_prefix,
259 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
260 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
3a1286b6 261 is_terminal_output(output));
80876c20
LP		 262
263 if (fd != nfd) {
264 r = dup2(fd, nfd) < 0 ? -errno : nfd;
03e334a1 265 safe_close(fd);
80876c20
LP		 266 } else
267 r = nfd;
071830ff 268
80876c20
LP		 269 return r;
270}
271static int open_terminal_as(const char *path, mode_t mode, int nfd) {
272 int fd, r;
071830ff 273
80876c20
LP		 274 assert(path);
275 assert(nfd >= 0);
071830ff 276
80876c20
LP		 277 if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
278 return fd;
071830ff 279
80876c20
LP		 280 if (fd != nfd) {
281 r = dup2(fd, nfd) < 0 ? -errno : nfd;
03e334a1 282 safe_close(fd);
80876c20
LP		 283 } else
284 r = nfd;
071830ff 285
80876c20
LP		 286 return r;
287}
071830ff 288
80876c20
LP		 289static bool is_terminal_input(ExecInput i) {
290 return
291 i == EXEC_INPUT_TTY ||
292 i == EXEC_INPUT_TTY_FORCE ||
293 i == EXEC_INPUT_TTY_FAIL;
294}
071830ff 295
1e3ad081
LP		 296static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
297
298 if (is_terminal_input(std_input) && !apply_tty_stdin)
299 return EXEC_INPUT_NULL;
071830ff 300
03fd9c49 301 if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
4f2d528d
LP		 302 return EXEC_INPUT_NULL;
303
03fd9c49 304 return std_input;
4f2d528d
LP		 305}
306
03fd9c49 307static int fixup_output(ExecOutput std_output, int socket_fd) {
4f2d528d 308
03fd9c49 309 if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
4f2d528d
LP		 310 return EXEC_OUTPUT_INHERIT;
311
03fd9c49 312 return std_output;
4f2d528d
LP		 313}
314
1e3ad081 315static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
4f2d528d
LP		 316 ExecInput i;
317
318 assert(context);
319
1e3ad081 320 i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
4f2d528d
LP		 321
322 switch (i) {
071830ff 323
80876c20
LP		 324 case EXEC_INPUT_NULL:
325 return open_null_as(O_RDONLY, STDIN_FILENO);
326
327 case EXEC_INPUT_TTY:
328 case EXEC_INPUT_TTY_FORCE:
329 case EXEC_INPUT_TTY_FAIL: {
330 int fd, r;
071830ff 331
970edce6
ZJS		 332 fd = acquire_terminal(tty_path(context),
333 i == EXEC_INPUT_TTY_FAIL,
334 i == EXEC_INPUT_TTY_FORCE,
335 false,
3a43da28 336 USEC_INFINITY);
970edce6 337 if (fd < 0)
80876c20
LP		 338 return fd;
339
340 if (fd != STDIN_FILENO) {
341 r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
03e334a1 342 safe_close(fd);
80876c20
LP		 343 } else
344 r = STDIN_FILENO;
345
346 return r;
347 }
348
4f2d528d
LP		 349 case EXEC_INPUT_SOCKET:
350 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
351
80876c20
LP		 352 default:
353 assert_not_reached("Unknown input type");
354 }
355}
356
eb17e935 357static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
4f2d528d
LP		 358 ExecOutput o;
359 ExecInput i;
47c1d80d 360 int r;
4f2d528d 361
80876c20
LP		 362 assert(context);
363 assert(ident);
364
1e3ad081 365 i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
03fd9c49 366 o = fixup_output(context->std_output, socket_fd);
4f2d528d 367
eb17e935
MS		 368 if (fileno == STDERR_FILENO) {
369 ExecOutput e;
370 e = fixup_output(context->std_error, socket_fd);
80876c20 371
eb17e935
MS		 372 /* This expects the input and output are already set up */
373
374 /* Don't change the stderr file descriptor if we inherit all
375 * the way and are not on a tty */
376 if (e == EXEC_OUTPUT_INHERIT &&
377 o == EXEC_OUTPUT_INHERIT &&
378 i == EXEC_INPUT_NULL &&
379 !is_terminal_input(context->std_input) &&
380 getppid () != 1)
381 return fileno;
382
383 /* Duplicate from stdout if possible */
384 if (e == o || e == EXEC_OUTPUT_INHERIT)
385 return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
071830ff 386
eb17e935 387 o = e;
80876c20 388
eb17e935 389 } else if (o == EXEC_OUTPUT_INHERIT) {
21d21ea4
LP		 390 /* If input got downgraded, inherit the original value */
391 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
eb17e935 392 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
21d21ea4 393
acb591e4 394 /* If the input is connected to anything that's not a /dev/null, inherit that... */
ff876e28 395 if (i != EXEC_INPUT_NULL)
eb17e935 396 return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
071830ff 397
acb591e4
LP		 398 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
399 if (getppid() != 1)
eb17e935 400 return fileno;
94f04347 401
eb17e935
MS		 402 /* We need to open /dev/null here anew, to get the right access mode. */
403 return open_null_as(O_WRONLY, fileno);
071830ff 404 }
94f04347 405
eb17e935 406 switch (o) {
80876c20
LP		 407
408 case EXEC_OUTPUT_NULL:
eb17e935 409 return open_null_as(O_WRONLY, fileno);
80876c20
LP		 410
411 case EXEC_OUTPUT_TTY:
4f2d528d 412 if (is_terminal_input(i))
eb17e935 413 return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
80876c20
LP		 414
415 /* We don't reset the terminal if this is just about output */
eb17e935 416 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
80876c20
LP		 417
418 case EXEC_OUTPUT_SYSLOG:
28dbc1e8 419 case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
9a6bca7a 420 case EXEC_OUTPUT_KMSG:
28dbc1e8 421 case EXEC_OUTPUT_KMSG_AND_CONSOLE:
706343f4
LP		 422 case EXEC_OUTPUT_JOURNAL:
423 case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
eb17e935 424 r = connect_logger_as(context, o, ident, unit_id, fileno);
47c1d80d 425 if (r < 0) {
80cbda35
MS		 426 log_struct_unit(LOG_CRIT, unit_id,
427 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
eb17e935 428 fileno == STDOUT_FILENO ? "out" : "err",
80cbda35
MS		 429 unit_id, strerror(-r),
430 "ERRNO=%d", -r,
431 NULL);
eb17e935 432 r = open_null_as(O_WRONLY, fileno);
47c1d80d
MS		 433 }
434 return r;
4f2d528d
LP		 435
436 case EXEC_OUTPUT_SOCKET:
437 assert(socket_fd >= 0);
eb17e935 438 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
94f04347
LP		 439
440 default:
80876c20 441 assert_not_reached("Unknown error type");
94f04347 442 }
071830ff
LP		 443}
444
02a51aba
LP		 445static int chown_terminal(int fd, uid_t uid) {
446 struct stat st;
447
448 assert(fd >= 0);
02a51aba
LP		 449
450 /* This might fail. What matters are the results. */
bab45044
LP		 451 (void) fchown(fd, uid, -1);
452 (void) fchmod(fd, TTY_MODE);
02a51aba
LP		 453
454 if (fstat(fd, &st) < 0)
455 return -errno;
456
d8b4e2e9 457 if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
02a51aba
LP		 458 return -EPERM;
459
460 return 0;
461}
462
af6da548 463static int setup_confirm_stdio(int *_saved_stdin,
80876c20
LP		 464 int *_saved_stdout) {
465 int fd = -1, saved_stdin, saved_stdout = -1, r;
466
80876c20
LP		 467 assert(_saved_stdin);
468 assert(_saved_stdout);
469
af6da548
LP		 470 saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
471 if (saved_stdin < 0)
472 return -errno;
80876c20 473
af6da548
LP		 474 saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
475 if (saved_stdout < 0) {
476 r = errno;
80876c20
LP		 477 goto fail;
478 }
479
af6da548
LP		 480 fd = acquire_terminal(
481 "/dev/console",
482 false,
483 false,
484 false,
485 DEFAULT_CONFIRM_USEC);
486 if (fd < 0) {
487 r = fd;
80876c20
LP		 488 goto fail;
489 }
490
af6da548
LP		 491 r = chown_terminal(fd, getuid());
492 if (r < 0)
02a51aba 493 goto fail;
02a51aba 494
80876c20 495 if (dup2(fd, STDIN_FILENO) < 0) {
af6da548 496 r = -errno;
80876c20
LP		 497 goto fail;
498 }
499
500 if (dup2(fd, STDOUT_FILENO) < 0) {
af6da548 501 r = -errno;
80876c20
LP		 502 goto fail;
503 }
504
505 if (fd >= 2)
03e334a1 506 safe_close(fd);
80876c20
LP		 507
508 *_saved_stdin = saved_stdin;
509 *_saved_stdout = saved_stdout;
510
511 return 0;
512
513fail:
03e334a1
LP		 514 safe_close(saved_stdout);
515 safe_close(saved_stdin);
516 safe_close(fd);
80876c20
LP		 517
518 return r;
519}
520
44b601bc 521_printf_(1, 2) static int write_confirm_message(const char *format, ...) {
03e334a1 522 _cleanup_close_ int fd = -1;
af6da548 523 va_list ap;
80876c20 524
af6da548 525 assert(format);
80876c20 526
af6da548
LP		 527 fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
528 if (fd < 0)
529 return fd;
80876c20 530
af6da548
LP		 531 va_start(ap, format);
532 vdprintf(fd, format, ap);
533 va_end(ap);
80876c20 534
af6da548
LP		 535 return 0;
536}
80876c20 537
af6da548
LP		 538static int restore_confirm_stdio(int *saved_stdin,
539 int *saved_stdout) {
80876c20 540
af6da548 541 int r = 0;
80876c20 542
af6da548
LP		 543 assert(saved_stdin);
544 assert(saved_stdout);
545
546 release_terminal();
547
548 if (*saved_stdin >= 0)
80876c20 549 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
af6da548 550 r = -errno;
80876c20 551
af6da548 552 if (*saved_stdout >= 0)
80876c20 553 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
af6da548 554 r = -errno;
80876c20 555
03e334a1
LP		 556 safe_close(*saved_stdin);
557 safe_close(*saved_stdout);
af6da548
LP		 558
559 return r;
560}
561
562static int ask_for_confirmation(char *response, char **argv) {
563 int saved_stdout = -1, saved_stdin = -1, r;
e1d75803 564 _cleanup_free_ char *line = NULL;
af6da548
LP		 565
566 r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
567 if (r < 0)
568 return r;
569
570 line = exec_command_line(argv);
571 if (!line)
572 return -ENOMEM;
573
418b9be5 574 r = ask_char(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
af6da548
LP		 575
576 restore_confirm_stdio(&saved_stdin, &saved_stdout);
577
578 return r;
80876c20
LP		 579}
580
81a2b7ce
LP		 581static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
582 bool keep_groups = false;
583 int r;
584
585 assert(context);
586
35b8ca3a 587 /* Lookup and set GID and supplementary group list. Here too
81a2b7ce
LP		 588 * we avoid NSS lookups for gid=0. */
589
590 if (context->group || username) {
591
4b67834e
LP		 592 if (context->group) {
593 const char *g = context->group;
594
595 if ((r = get_group_creds(&g, &gid)) < 0)
81a2b7ce 596 return r;
4b67834e 597 }
81a2b7ce
LP		 598
599 /* First step, initialize groups from /etc/groups */
600 if (username && gid != 0) {
601 if (initgroups(username, gid) < 0)
602 return -errno;
603
604 keep_groups = true;
605 }
606
607 /* Second step, set our gids */
608 if (setresgid(gid, gid, gid) < 0)
609 return -errno;
610 }
611
612 if (context->supplementary_groups) {
613 int ngroups_max, k;
614 gid_t *gids;
615 char **i;
616
617 /* Final step, initialize any manually set supplementary groups */
da19d5c1 618 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
81a2b7ce
LP		 619
620 if (!(gids = new(gid_t, ngroups_max)))
621 return -ENOMEM;
622
623 if (keep_groups) {
624 if ((k = getgroups(ngroups_max, gids)) < 0) {
625 free(gids);
626 return -errno;
627 }
628 } else
629 k = 0;
630
631 STRV_FOREACH(i, context->supplementary_groups) {
4b67834e 632 const char *g;
81a2b7ce
LP		 633
634 if (k >= ngroups_max) {
635 free(gids);
636 return -E2BIG;
637 }
638
4b67834e
LP		 639 g = *i;
640 r = get_group_creds(&g, gids+k);
641 if (r < 0) {
81a2b7ce
LP		 642 free(gids);
643 return r;
644 }
645
646 k++;
647 }
648
649 if (setgroups(k, gids) < 0) {
650 free(gids);
651 return -errno;
652 }
653
654 free(gids);
655 }
656
657 return 0;
658}
659
660static int enforce_user(const ExecContext *context, uid_t uid) {
81a2b7ce
LP		 661 assert(context);
662
663 /* Sets (but doesn't lookup) the uid and make sure we keep the
664 * capabilities while doing so. */
665
666 if (context->capabilities) {
5ce70e5b 667 _cleanup_cap_free_ cap_t d = NULL;
81a2b7ce
LP		 668 static const cap_value_t bits[] = {
669 CAP_SETUID, /* Necessary so that we can run setresuid() below */
670 CAP_SETPCAP /* Necessary so that we can set PR_SET_SECUREBITS later on */
671 };
672
673 /* First step: If we need to keep capabilities but
674 * drop privileges we need to make sure we keep our
cbb21cca 675 * caps, while we drop privileges. */
693ced48 676 if (uid != 0) {
cbb21cca 677 int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
693ced48
LP		 678
679 if (prctl(PR_GET_SECUREBITS) != sb)
680 if (prctl(PR_SET_SECUREBITS, sb) < 0)
681 return -errno;
682 }
81a2b7ce 683
35b8ca3a 684 /* Second step: set the capabilities. This will reduce
81a2b7ce
LP		 685 * the capabilities to the minimum we need. */
686
5ce70e5b
ZJS		 687 d = cap_dup(context->capabilities);
688 if (!d)
81a2b7ce
LP		 689 return -errno;
690
691 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
5ce70e5b
ZJS		 692 cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0)
693 return -errno;
81a2b7ce 694
5ce70e5b
ZJS		 695 if (cap_set_proc(d) < 0)
696 return -errno;
81a2b7ce
LP		 697 }
698
699 /* Third step: actually set the uids */
700 if (setresuid(uid, uid, uid) < 0)
701 return -errno;
702
703 /* At this point we should have all necessary capabilities but
704 are otherwise a normal user. However, the caps might got
705 corrupted due to the setresuid() so we need clean them up
706 later. This is done outside of this call. */
707
708 return 0;
709}
710
5b6319dc
LP		 711#ifdef HAVE_PAM
712
713static int null_conv(
714 int num_msg,
715 const struct pam_message **msg,
716 struct pam_response **resp,
717 void *appdata_ptr) {
718
719 /* We don't support conversations */
720
721 return PAM_CONV_ERR;
722}
723
724static int setup_pam(
725 const char *name,
726 const char *user,
940c5210 727 uid_t uid,
5b6319dc
LP		 728 const char *tty,
729 char ***pam_env,
730 int fds[], unsigned n_fds) {
731
732 static const struct pam_conv conv = {
733 .conv = null_conv,
734 .appdata_ptr = NULL
735 };
736
737 pam_handle_t *handle = NULL;
738 sigset_t ss, old_ss;
739 int pam_code = PAM_SUCCESS;
9ba35398 740 int err;
5b6319dc
LP		 741 char **e = NULL;
742 bool close_session = false;
743 pid_t pam_pid = 0, parent_pid;
970edce6 744 int flags = 0;
5b6319dc
LP		 745
746 assert(name);
747 assert(user);
748 assert(pam_env);
749
750 /* We set up PAM in the parent process, then fork. The child
35b8ca3a 751 * will then stay around until killed via PR_GET_PDEATHSIG or
5b6319dc
LP		 752 * systemd via the cgroup logic. It will then remove the PAM
753 * session again. The parent process will exec() the actual
754 * daemon. We do things this way to ensure that the main PID
755 * of the daemon is the one we initially fork()ed. */
756
970edce6
ZJS		 757 if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
758 flags |= PAM_SILENT;
759
f546241b
ZJS		 760 pam_code = pam_start(name, user, &conv, &handle);
761 if (pam_code != PAM_SUCCESS) {
5b6319dc
LP		 762 handle = NULL;
763 goto fail;
764 }
765
f546241b
ZJS		 766 if (tty) {
767 pam_code = pam_set_item(handle, PAM_TTY, tty);
768 if (pam_code != PAM_SUCCESS)
5b6319dc 769 goto fail;
f546241b 770 }
5b6319dc 771
970edce6 772 pam_code = pam_acct_mgmt(handle, flags);
f546241b 773 if (pam_code != PAM_SUCCESS)
5b6319dc
LP		 774 goto fail;
775
970edce6 776 pam_code = pam_open_session(handle, flags);
f546241b 777 if (pam_code != PAM_SUCCESS)
5b6319dc
LP		 778 goto fail;
779
780 close_session = true;
781
f546241b
ZJS		 782 e = pam_getenvlist(handle);
783 if (!e) {
5b6319dc
LP		 784 pam_code = PAM_BUF_ERR;
785 goto fail;
786 }
787
788 /* Block SIGTERM, so that we know that it won't get lost in
789 * the child */
790 if (sigemptyset(&ss) < 0 ||
791 sigaddset(&ss, SIGTERM) < 0 ||
792 sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
793 goto fail;
794
795 parent_pid = getpid();
796
f546241b
ZJS		 797 pam_pid = fork();
798 if (pam_pid < 0)
5b6319dc
LP		 799 goto fail;
800
801 if (pam_pid == 0) {
802 int sig;
803 int r = EXIT_PAM;
804
805 /* The child's job is to reset the PAM session on
806 * termination */
807
808 /* This string must fit in 10 chars (i.e. the length
5d6b1584
LP		 809 * of "/sbin/init"), to look pretty in /bin/ps */
810 rename_process("(sd-pam)");
5b6319dc
LP		 811
812 /* Make sure we don't keep open the passed fds in this
813 child. We assume that otherwise only those fds are
814 open here that have been opened by PAM. */
815 close_many(fds, n_fds);
816
940c5210
AK		 817 /* Drop privileges - we don't need any to pam_close_session
818 * and this will make PR_SET_PDEATHSIG work in most cases.
819 * If this fails, ignore the error - but expect sd-pam threads
820 * to fail to exit normally */
821 if (setresuid(uid, uid, uid) < 0)
822 log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
823
824 /* Wait until our parent died. This will only work if
825 * the above setresuid() succeeds, otherwise the kernel
826 * will not allow unprivileged parents kill their privileged
827 * children this way. We rely on the control groups kill logic
5b6319dc
LP		 828 * to do the rest for us. */
829 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
830 goto child_finish;
831
832 /* Check if our parent process might already have
833 * died? */
834 if (getppid() == parent_pid) {
3dead8d9
LP		 835 for (;;) {
836 if (sigwait(&ss, &sig) < 0) {
837 if (errno == EINTR)
838 continue;
839
840 goto child_finish;
841 }
5b6319dc 842
3dead8d9
LP		 843 assert(sig == SIGTERM);
844 break;
845 }
5b6319dc
LP		 846 }
847
3dead8d9 848 /* If our parent died we'll end the session */
f546241b 849 if (getppid() != parent_pid) {
970edce6 850 pam_code = pam_close_session(handle, flags);
f546241b 851 if (pam_code != PAM_SUCCESS)
5b6319dc 852 goto child_finish;
f546241b 853 }
5b6319dc
LP		 854
855 r = 0;
856
857 child_finish:
970edce6 858 pam_end(handle, pam_code | flags);
5b6319dc
LP		 859 _exit(r);
860 }
861
862 /* If the child was forked off successfully it will do all the
863 * cleanups, so forget about the handle here. */
864 handle = NULL;
865
3b8bddde 866 /* Unblock SIGTERM again in the parent */
5b6319dc
LP		 867 if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
868 goto fail;
869
870 /* We close the log explicitly here, since the PAM modules
871 * might have opened it, but we don't want this fd around. */
872 closelog();
873
aa87e624
LP		 874 *pam_env = e;
875 e = NULL;
876
5b6319dc
LP		 877 return 0;
878
879fail:
970edce6
ZJS		 880 if (pam_code != PAM_SUCCESS) {
881 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
9ba35398 882 err = -EPERM; /* PAM errors do not map to errno */
970edce6
ZJS		 883 } else {
884 log_error("PAM failed: %m");
9ba35398 885 err = -errno;
970edce6 886 }
9ba35398 887
5b6319dc
LP		 888 if (handle) {
889 if (close_session)
970edce6 890 pam_code = pam_close_session(handle, flags);
5b6319dc 891
970edce6 892 pam_end(handle, pam_code | flags);
5b6319dc
LP		 893 }
894
895 strv_free(e);
896
897 closelog();
898
430c18ed 899 if (pam_pid > 1) {
5b6319dc 900 kill(pam_pid, SIGTERM);
430c18ed
LP		 901 kill(pam_pid, SIGCONT);
902 }
5b6319dc 903
9ba35398 904 return err;
5b6319dc
LP		 905}
906#endif
907
5d6b1584
LP		 908static void rename_process_from_path(const char *path) {
909 char process_name[11];
910 const char *p;
911 size_t l;
912
913 /* This resulting string must fit in 10 chars (i.e. the length
914 * of "/sbin/init") to look pretty in /bin/ps */
915
2b6bf07d 916 p = basename(path);
5d6b1584
LP		 917 if (isempty(p)) {
918 rename_process("(...)");
919 return;
920 }
921
922 l = strlen(p);
923 if (l > 8) {
924 /* The end of the process name is usually more
925 * interesting, since the first bit might just be
926 * "systemd-" */
927 p = p + l - 8;
928 l = 8;
929 }
930
931 process_name[0] = '(';
932 memcpy(process_name+1, p, l);
933 process_name[1+l] = ')';
934 process_name[1+l+1] = 0;
935
936 rename_process(process_name);
937}
938
c0467cf3 939#ifdef HAVE_SECCOMP
17df7223 940
c0467cf3 941static int apply_seccomp(ExecContext *c) {
17df7223
LP		 942 uint32_t negative_action, action;
943 scmp_filter_ctx *seccomp;
c0467cf3
RC		 944 Iterator i;
945 void *id;
17df7223 946 int r;
8351ceae 947
c0467cf3 948 assert(c);
8351ceae 949
17df7223
LP		 950 negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
951
952 seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
953 if (!seccomp)
954 return -ENOMEM;
8351ceae 955
e9642be2
LP		 956 if (c->syscall_archs) {
957
958 SET_FOREACH(id, c->syscall_archs, i) {
959 r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
960 if (r == -EEXIST)
961 continue;
7c66bae2
LP		 962 if (r < 0)
963 goto finish;
e9642be2 964 }
e9642be2 965
7c66bae2 966 } else {
e9642be2 967 r = seccomp_add_secondary_archs(seccomp);
7c66bae2
LP		 968 if (r < 0)
969 goto finish;
57183d11 970 }
8351ceae 971
57183d11 972 action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
17df7223
LP		 973 SET_FOREACH(id, c->syscall_filter, i) {
974 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
7c66bae2
LP		 975 if (r < 0)
976 goto finish;
c0467cf3 977 }
8351ceae 978
7c66bae2
LP		 979 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
980 if (r < 0)
981 goto finish;
982
17df7223 983 r = seccomp_load(seccomp);
7c66bae2
LP		 984
985finish:
17df7223 986 seccomp_release(seccomp);
4298d0b5
LP		 987 return r;
988}
989
990static int apply_address_families(ExecContext *c) {
991 scmp_filter_ctx *seccomp;
992 Iterator i;
993 int r;
994
995 assert(c);
996
997 seccomp = seccomp_init(SCMP_ACT_ALLOW);
998 if (!seccomp)
999 return -ENOMEM;
1000
1001 r = seccomp_add_secondary_archs(seccomp);
1002 if (r < 0)
1003 goto finish;
1004
1005 if (c->address_families_whitelist) {
1006 int af, first = 0, last = 0;
1007 void *afp;
1008
1009 /* If this is a whitelist, we first block the address
1010 * families that are out of range and then everything
1011 * that is not in the set. First, we find the lowest
1012 * and highest address family in the set. */
1013
1014 SET_FOREACH(afp, c->address_families, i) {
1015 af = PTR_TO_INT(afp);
17df7223 1016
4298d0b5
LP		 1017 if (af <= 0 || af >= af_max())
1018 continue;
1019
1020 if (first == 0 || af < first)
1021 first = af;
1022
1023 if (last == 0 || af > last)
1024 last = af;
1025 }
1026
1027 assert((first == 0) == (last == 0));
1028
1029 if (first == 0) {
1030
1031 /* No entries in the valid range, block everything */
1032 r = seccomp_rule_add(
1033 seccomp,
1034 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1035 SCMP_SYS(socket),
1036 0);
1037 if (r < 0)
1038 goto finish;
1039
1040 } else {
1041
1042 /* Block everything below the first entry */
1043 r = seccomp_rule_add(
1044 seccomp,
1045 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1046 SCMP_SYS(socket),
1047 1,
1048 SCMP_A0(SCMP_CMP_LT, first));
1049 if (r < 0)
1050 goto finish;
1051
1052 /* Block everything above the last entry */
1053 r = seccomp_rule_add(
1054 seccomp,
1055 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1056 SCMP_SYS(socket),
1057 1,
1058 SCMP_A0(SCMP_CMP_GT, last));
1059 if (r < 0)
1060 goto finish;
1061
1062 /* Block everything between the first and last
1063 * entry */
1064 for (af = 1; af < af_max(); af++) {
1065
1066 if (set_contains(c->address_families, INT_TO_PTR(af)))
1067 continue;
1068
1069 r = seccomp_rule_add(
1070 seccomp,
1071 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1072 SCMP_SYS(socket),
1073 1,
1074 SCMP_A0(SCMP_CMP_EQ, af));
1075 if (r < 0)
1076 goto finish;
1077 }
1078 }
1079
1080 } else {
1081 void *af;
1082
1083 /* If this is a blacklist, then generate one rule for
1084 * each address family that are then combined in OR
1085 * checks. */
1086
1087 SET_FOREACH(af, c->address_families, i) {
1088
1089 r = seccomp_rule_add(
1090 seccomp,
1091 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1092 SCMP_SYS(socket),
1093 1,
1094 SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
1095 if (r < 0)
1096 goto finish;
1097 }
1098 }
1099
1100 r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1101 if (r < 0)
1102 goto finish;
1103
1104 r = seccomp_load(seccomp);
1105
1106finish:
1107 seccomp_release(seccomp);
17df7223 1108 return r;
8351ceae 1109}
4298d0b5 1110
c0467cf3 1111#endif
8351ceae 1112
31a7eb86
ZJS		 1113static void do_idle_pipe_dance(int idle_pipe[4]) {
1114 assert(idle_pipe);
1115
03e334a1
LP		 1116
1117 safe_close(idle_pipe[1]);
1118 safe_close(idle_pipe[2]);
31a7eb86
ZJS		 1119
1120 if (idle_pipe[0] >= 0) {
1121 int r;
1122
1123 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1124
1125 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1126 /* Signal systemd that we are bored and want to continue. */
1127 write(idle_pipe[3], "x", 1);
1128
1129 /* Wait for systemd to react to the signal above. */
1130 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1131 }
1132
03e334a1 1133 safe_close(idle_pipe[0]);
31a7eb86
ZJS		 1134
1135 }
1136
03e334a1 1137 safe_close(idle_pipe[3]);
31a7eb86
ZJS		 1138}
1139
7cae38c4 1140static int build_environment(
9fa95f85 1141 const ExecContext *c,
7cae38c4 1142 unsigned n_fds,
09812eb7 1143 usec_t watchdog_usec,
7cae38c4
LP		 1144 const char *home,
1145 const char *username,
1146 const char *shell,
1147 char ***ret) {
1148
1149 _cleanup_strv_free_ char **our_env = NULL;
1150 unsigned n_env = 0;
1151 char *x;
1152
1153 assert(c);
1154 assert(ret);
1155
09812eb7 1156 our_env = new0(char*, 10);
7cae38c4
LP		 1157 if (!our_env)
1158 return -ENOMEM;
1159
1160 if (n_fds > 0) {
ccd06097 1161 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
7cae38c4
LP		 1162 return -ENOMEM;
1163 our_env[n_env++] = x;
1164
1165 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1166 return -ENOMEM;
1167 our_env[n_env++] = x;
1168 }
1169
09812eb7 1170 if (watchdog_usec > 0) {
ccd06097 1171 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
09812eb7
LP		 1172 return -ENOMEM;
1173 our_env[n_env++] = x;
1174
de0671ee 1175 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, watchdog_usec) < 0)
09812eb7
LP		 1176 return -ENOMEM;
1177 our_env[n_env++] = x;
1178 }
1179
7cae38c4
LP		 1180 if (home) {
1181 x = strappend("HOME=", home);
1182 if (!x)
1183 return -ENOMEM;
1184 our_env[n_env++] = x;
1185 }
1186
1187 if (username) {
1188 x = strappend("LOGNAME=", username);
1189 if (!x)
1190 return -ENOMEM;
1191 our_env[n_env++] = x;
1192
1193 x = strappend("USER=", username);
1194 if (!x)
1195 return -ENOMEM;
1196 our_env[n_env++] = x;
1197 }
1198
1199 if (shell) {
1200 x = strappend("SHELL=", shell);
1201 if (!x)
1202 return -ENOMEM;
1203 our_env[n_env++] = x;
1204 }
1205
1206 if (is_terminal_input(c->std_input) ||
1207 c->std_output == EXEC_OUTPUT_TTY ||
1208 c->std_error == EXEC_OUTPUT_TTY ||
1209 c->tty_path) {
1210
1211 x = strdup(default_term_for_tty(tty_path(c)));
1212 if (!x)
1213 return -ENOMEM;
1214 our_env[n_env++] = x;
1215 }
1216
1217 our_env[n_env++] = NULL;
09812eb7 1218 assert(n_env <= 10);
7cae38c4
LP		 1219
1220 *ret = our_env;
1221 our_env = NULL;
1222
1223 return 0;
1224}
1225
d35fbf6b
DM		 1226static int exec_child(ExecCommand *command,
1227 const ExecContext *context,
1228 const ExecParameters *params,
1229 ExecRuntime *runtime,
1230 char **argv,
1231 int socket_fd,
1232 int *fds, unsigned n_fds,
1233 char **files_env,
1234 int *error) {
1235
1236 _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
1237 const char *username = NULL, *home = NULL, *shell = NULL;
1238 unsigned n_dont_close = 0;
1239 int dont_close[n_fds + 3];
1240 uid_t uid = (uid_t) -1;
1241 gid_t gid = (gid_t) -1;
1242 int i, err;
034c6ed7 1243
5cb5a6ff
LP		 1244 assert(command);
1245 assert(context);
d35fbf6b
DM		 1246 assert(params);
1247 assert(error);
1248
1249 rename_process_from_path(command->path);
1250
1251 /* We reset exactly these signals, since they are the
1252 * only ones we set to SIG_IGN in the main daemon. All
1253 * others we leave untouched because we set them to
1254 * SIG_DFL or a valid handler initially, both of which
1255 * will be demoted to SIG_DFL. */
1256 default_signals(SIGNALS_CRASH_HANDLER,
1257 SIGNALS_IGNORE, -1);
1258
1259 if (context->ignore_sigpipe)
1260 ignore_signals(SIGPIPE, -1);
1261
1262 err = reset_signal_mask();
1263 if (err < 0) {
1264 *error = EXIT_SIGNAL_MASK;
1265 return err;
1266 }
034c6ed7 1267
d35fbf6b
DM		 1268 if (params->idle_pipe)
1269 do_idle_pipe_dance(params->idle_pipe);
4f2d528d 1270
d35fbf6b
DM		 1271 /* Close sockets very early to make sure we don't
1272 * block init reexecution because it cannot bind its
1273 * sockets */
1274 log_forget_fds();
4f2d528d 1275
d35fbf6b
DM		 1276 if (socket_fd >= 0)
1277 dont_close[n_dont_close++] = socket_fd;
1278 if (n_fds > 0) {
1279 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1280 n_dont_close += n_fds;
1281 }
1282 if (runtime) {
1283 if (runtime->netns_storage_socket[0] >= 0)
1284 dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
1285 if (runtime->netns_storage_socket[1] >= 0)
1286 dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
9fa95f85 1287 }
4f2d528d 1288
d35fbf6b
DM		 1289 err = close_all_fds(dont_close, n_dont_close);
1290 if (err < 0) {
1291 *error = EXIT_FDS;
1292 return err;
8c7be95e
LP		 1293 }
1294
d35fbf6b
DM		 1295 if (!context->same_pgrp)
1296 if (setsid() < 0) {
1297 *error = EXIT_SETSID;
1298 return -errno;
1299 }
9e2f7c11 1300
d35fbf6b
DM		 1301 exec_context_tty_reset(context);
1302
1303 if (params->confirm_spawn) {
1304 char response;
1305
1306 err = ask_for_confirmation(&response, argv);
1307 if (err == -ETIMEDOUT)
1308 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1309 else if (err < 0)
1310 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1311 else if (response == 's') {
1312 write_confirm_message("Skipping execution.\n");
1313 *error = EXIT_CONFIRM;
1314 return -ECANCELED;
1315 } else if (response == 'n') {
1316 write_confirm_message("Failing execution.\n");
1317 *error = 0;
1318 return 0;
1319 }
1320 }
1a63a750 1321
d35fbf6b
DM		 1322 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1323 * must sure to drop O_NONBLOCK */
1324 if (socket_fd >= 0)
1325 fd_nonblock(socket_fd, false);
acbb0225 1326
d35fbf6b
DM		 1327 err = setup_input(context, socket_fd, params->apply_tty_stdin);
1328 if (err < 0) {
1329 *error = EXIT_STDIN;
1330 return err;
1331 }
034c6ed7 1332
d35fbf6b
DM		 1333 err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin);
1334 if (err < 0) {
1335 *error = EXIT_STDOUT;
1336 return err;
1337 }
1338
1339 err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin);
1340 if (err < 0) {
1341 *error = EXIT_STDERR;
1342 return err;
1343 }
1344
1345 if (params->cgroup_path) {
1346 err = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0);
1b6d7fa7 1347 if (err < 0) {
d35fbf6b
DM		 1348 *error = EXIT_CGROUP;
1349 return err;
309bff19 1350 }
d35fbf6b 1351 }
309bff19 1352
d35fbf6b
DM		 1353 if (context->oom_score_adjust_set) {
1354 char t[16];
f2b68789 1355
d35fbf6b
DM		 1356 snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1357 char_array_0(t);
613b411c 1358
d35fbf6b
DM		 1359 if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
1360 *error = EXIT_OOM_ADJUST;
1361 return -errno;
613b411c 1362 }
d35fbf6b
DM		 1363 }
1364
1365 if (context->nice_set)
1366 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1367 *error = EXIT_NICE;
1368 return -errno;
613b411c
LP		 1369 }
1370
d35fbf6b
DM		 1371 if (context->cpu_sched_set) {
1372 struct sched_param param = {
1373 .sched_priority = context->cpu_sched_priority,
1374 };
1375
1376 err = sched_setscheduler(0,
1377 context->cpu_sched_policy |
1378 (context->cpu_sched_reset_on_fork ?
1379 SCHED_RESET_ON_FORK : 0),
1380 &param);
4c2630eb 1381 if (err < 0) {
d35fbf6b
DM		 1382 *error = EXIT_SETSCHEDULER;
1383 return -errno;
fc9b2a84 1384 }
d35fbf6b 1385 }
fc9b2a84 1386
d35fbf6b
DM		 1387 if (context->cpuset)
1388 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1389 *error = EXIT_CPUAFFINITY;
1390 return -errno;
034c6ed7
LP		 1391 }
1392
d35fbf6b
DM		 1393 if (context->ioprio_set)
1394 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1395 *error = EXIT_IOPRIO;
1396 return -errno;
1397 }
da726a4d 1398
d35fbf6b
DM		 1399 if (context->timer_slack_nsec != NSEC_INFINITY)
1400 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1401 *error = EXIT_TIMERSLACK;
1402 return -errno;
4c2630eb 1403 }
9eba9da4 1404
d35fbf6b
DM		 1405 if (context->personality != 0xffffffffUL)
1406 if (personality(context->personality) < 0) {
1407 *error = EXIT_PERSONALITY;
1408 return -errno;
4c2630eb 1409 }
94f04347 1410
d35fbf6b
DM		 1411 if (context->utmp_id)
1412 utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1413
1414 if (context->user) {
1415 username = context->user;
1416 err = get_user_creds(&username, &uid, &gid, &home, &shell);
4c2630eb 1417 if (err < 0) {
d35fbf6b
DM		 1418 *error = EXIT_USER;
1419 return err;
071830ff
LP		 1420 }
1421
d35fbf6b
DM		 1422 if (is_terminal_input(context->std_input)) {
1423 err = chown_terminal(STDIN_FILENO, uid);
4c2630eb 1424 if (err < 0) {
d35fbf6b
DM		 1425 *error = EXIT_STDIN;
1426 return err;
8e274523 1427 }
4c2630eb 1428 }
d35fbf6b 1429 }
8e274523 1430
d35fbf6b
DM		 1431#ifdef HAVE_PAM
1432 if (params->cgroup_path && context->user && context->pam_name) {
1433 err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
1434 if (err < 0) {
1435 *error = EXIT_CGROUP;
1436 return err;
1437 }
034c6ed7 1438
034c6ed7 1439
d35fbf6b
DM		 1440 err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
1441 if (err < 0) {
1442 *error = EXIT_CGROUP;
1443 return err;
034c6ed7 1444 }
d35fbf6b
DM		 1445 }
1446#endif
034c6ed7 1447
d35fbf6b
DM		 1448 if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
1449 char **rt;
fb33a393 1450
d35fbf6b
DM		 1451 STRV_FOREACH(rt, context->runtime_directory) {
1452 _cleanup_free_ char *p;
94f04347 1453
d35fbf6b
DM		 1454 p = strjoin(params->runtime_prefix, "/", *rt, NULL);
1455 if (!p) {
1456 *error = EXIT_RUNTIME_DIRECTORY;
1457 return -ENOMEM;
94f04347 1458 }
94f04347 1459
d35fbf6b
DM		 1460 err = mkdir_safe(p, context->runtime_directory_mode, uid, gid);
1461 if (err < 0) {
1462 *error = EXIT_RUNTIME_DIRECTORY;
1463 return err;
94f04347 1464 }
d35fbf6b
DM		 1465 }
1466 }
94f04347 1467
d35fbf6b
DM		 1468 if (params->apply_permissions) {
1469 err = enforce_groups(context, username, gid);
1470 if (err < 0) {
1471 *error = EXIT_GROUP;
1472 return err;
1473 }
1474 }
9eba9da4 1475
d35fbf6b 1476 umask(context->umask);
94f04347 1477
d35fbf6b
DM		 1478#ifdef HAVE_PAM
1479 if (params->apply_permissions && context->pam_name && username) {
1480 err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1481 if (err < 0) {
1482 *error = EXIT_PAM;
1483 return err;
1484 }
1485 }
1486#endif
ac45f971 1487
d35fbf6b
DM		 1488 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
1489 err = setup_netns(runtime->netns_storage_socket);
1490 if (err < 0) {
1491 *error = EXIT_NETWORK;
1492 return err;
1493 }
1494 }
169c1bda 1495
d35fbf6b
DM		 1496 if (!strv_isempty(context->read_write_dirs) ||
1497 !strv_isempty(context->read_only_dirs) ||
1498 !strv_isempty(context->inaccessible_dirs) ||
1499 context->mount_flags != 0 ||
1500 (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
1501 context->private_devices ||
1502 context->protect_system != PROTECT_SYSTEM_NO ||
1503 context->protect_home != PROTECT_HOME_NO) {
1504
1505 char *tmp = NULL, *var = NULL;
1506
1507 /* The runtime struct only contains the parent
1508 * of the private /tmp, which is
1509 * non-accessible to world users. Inside of it
1510 * there's a /tmp that is sticky, and that's
1511 * the one we want to use here. */
1512
1513 if (context->private_tmp && runtime) {
1514 if (runtime->tmp_dir)
1515 tmp = strappenda(runtime->tmp_dir, "/tmp");
1516 if (runtime->var_tmp_dir)
1517 var = strappenda(runtime->var_tmp_dir, "/tmp");
1518 }
d8b4e2e9 1519
d35fbf6b
DM		 1520 err = setup_namespace(
1521 context->read_write_dirs,
1522 context->read_only_dirs,
1523 context->inaccessible_dirs,
1524 tmp,
1525 var,
a610cc4f 1526 NULL,
d35fbf6b
DM		 1527 context->private_devices,
1528 context->protect_home,
1529 context->protect_system,
1530 context->mount_flags);
1531 if (err < 0) {
1532 *error = EXIT_NAMESPACE;
1533 return err;
81a2b7ce 1534 }
d35fbf6b 1535 }
81a2b7ce 1536
d35fbf6b
DM		 1537 if (params->apply_chroot) {
1538 if (context->root_directory)
1539 if (chroot(context->root_directory) < 0) {
1540 *error = EXIT_CHROOT;
1541 return -errno;
8aa75193
LP		 1542 }
1543
d35fbf6b
DM		 1544 if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1545 *error = EXIT_CHDIR;
1546 return -errno;
1547 }
1548 } else {
1549 _cleanup_free_ char *d = NULL;
8aa75193 1550
d35fbf6b
DM		 1551 if (asprintf(&d, "%s/%s",
1552 context->root_directory ? context->root_directory : "",
1553 context->working_directory ? context->working_directory : "") < 0) {
1554 *error = EXIT_MEMORY;
1555 return -ENOMEM;
8aa75193 1556 }
8aa75193 1557
d35fbf6b
DM		 1558 if (chdir(d) < 0) {
1559 *error = EXIT_CHDIR;
1560 return -errno;
1561 }
1562 }
e66cf1a3 1563
d35fbf6b
DM		 1564 /* We repeat the fd closing here, to make sure that
1565 * nothing is leaked from the PAM modules. Note that
1566 * we are more aggressive this time since socket_fd
1567 * and the netns fds we don#t need anymore. */
1568 err = close_all_fds(fds, n_fds);
1569 if (err >= 0)
1570 err = shift_fds(fds, n_fds);
1571 if (err >= 0)
1572 err = flags_fds(fds, n_fds, context->non_blocking);
1573 if (err < 0) {
1574 *error = EXIT_FDS;
1575 return err;
1576 }
e66cf1a3 1577
d35fbf6b 1578 if (params->apply_permissions) {
e66cf1a3 1579
d35fbf6b
DM		 1580 for (i = 0; i < _RLIMIT_MAX; i++) {
1581 if (!context->rlimit[i])
1582 continue;
1583
1584 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1585 *error = EXIT_LIMITS;
1586 return -errno;
e66cf1a3
LP		 1587 }
1588 }
1589
d35fbf6b
DM		 1590 if (context->capability_bounding_set_drop) {
1591 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
4c2630eb 1592 if (err < 0) {
d35fbf6b
DM		 1593 *error = EXIT_CAPABILITIES;
1594 return err;
3b8bddde 1595 }
4c2630eb 1596 }
3b8bddde 1597
d35fbf6b
DM		 1598 if (context->user) {
1599 err = enforce_user(context, uid);
4c2630eb 1600 if (err < 0) {
d35fbf6b
DM		 1601 *error = EXIT_USER;
1602 return err;
5b6319dc
LP		 1603 }
1604 }
d35fbf6b
DM		 1605
1606 /* PR_GET_SECUREBITS is not privileged, while
1607 * PR_SET_SECUREBITS is. So to suppress
1608 * potential EPERMs we'll try not to call
1609 * PR_SET_SECUREBITS unless necessary. */
1610 if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1611 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1612 *error = EXIT_SECUREBITS;
1613 return -errno;
ff01d048 1614 }
5b6319dc 1615
d35fbf6b
DM		 1616 if (context->capabilities)
1617 if (cap_set_proc(context->capabilities) < 0) {
1618 *error = EXIT_CAPABILITIES;
1619 return -errno;
613b411c
LP		 1620 }
1621
d35fbf6b
DM		 1622 if (context->no_new_privileges)
1623 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1624 *error = EXIT_NO_NEW_PRIVILEGES;
1625 return -errno;
1626 }
1627
1628#ifdef HAVE_SECCOMP
1629 if (context->address_families_whitelist ||
1630 !set_isempty(context->address_families)) {
1631 err = apply_address_families(context);
4c2630eb 1632 if (err < 0) {
d35fbf6b
DM		 1633 *error = EXIT_ADDRESS_FAMILIES;
1634 return err;
4c2630eb
MS		 1635 }
1636 }
04aa0cb9 1637
d35fbf6b
DM		 1638 if (context->syscall_whitelist ||
1639 !set_isempty(context->syscall_filter) ||
1640 !set_isempty(context->syscall_archs)) {
1641 err = apply_seccomp(context);
1642 if (err < 0) {
1643 *error = EXIT_SECCOMP;
1644 return err;
81a2b7ce 1645 }
d35fbf6b
DM		 1646 }
1647#endif
81a2b7ce 1648
d35fbf6b
DM		 1649#ifdef HAVE_SELINUX
1650 if (context->selinux_context && use_selinux()) {
1651 err = setexeccon(context->selinux_context);
1652 if (err < 0 && !context->selinux_context_ignore) {
1653 *error = EXIT_SELINUX_CONTEXT;
1654 return err;
81a2b7ce 1655 }
81a2b7ce 1656 }
d35fbf6b 1657#endif
81a2b7ce 1658
d35fbf6b
DM		 1659#ifdef HAVE_APPARMOR
1660 if (context->apparmor_profile && use_apparmor()) {
1661 err = aa_change_onexec(context->apparmor_profile);
1662 if (err < 0 && !context->apparmor_profile_ignore) {
1663 *error = EXIT_APPARMOR_PROFILE;
1664 return err;
1665 }
034c6ed7 1666 }
d35fbf6b
DM		 1667#endif
1668 }
034c6ed7 1669
d35fbf6b
DM		 1670 err = build_environment(context, n_fds, params->watchdog_usec, home, username, shell, &our_env);
1671 if (err < 0) {
1672 *error = EXIT_MEMORY;
1673 return err;
1674 }
034c6ed7 1675
d35fbf6b
DM		 1676 final_env = strv_env_merge(5,
1677 params->environment,
1678 our_env,
1679 context->environment,
1680 files_env,
1681 pam_env,
1682 NULL);
1683 if (!final_env) {
1684 *error = EXIT_MEMORY;
1685 return -ENOMEM;
1686 }
81a2b7ce 1687
d35fbf6b
DM		 1688 final_argv = replace_env_argv(argv, final_env);
1689 if (!final_argv) {
1690 *error = EXIT_MEMORY;
1691 return -ENOMEM;
1692 }
034c6ed7 1693
d35fbf6b 1694 final_env = strv_env_clean(final_env);
260abb78 1695
d35fbf6b
DM		 1696 if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
1697 _cleanup_free_ char *line;
81a2b7ce 1698
d35fbf6b
DM		 1699 line = exec_command_line(final_argv);
1700 if (line) {
1701 log_open();
1702 log_struct_unit(LOG_DEBUG,
1703 params->unit_id,
1704 "EXECUTABLE=%s", command->path,
1705 "MESSAGE=Executing: %s", line,
1706 NULL);
1707 log_close();
1708 }
1709 }
1710 execve(command->path, final_argv, final_env);
1711 *error = EXIT_EXEC;
1712 return -errno;
1713}
81a2b7ce 1714
d35fbf6b
DM		 1715int exec_spawn(ExecCommand *command,
1716 const ExecContext *context,
1717 const ExecParameters *params,
1718 ExecRuntime *runtime,
1719 pid_t *ret) {
8351ceae 1720
d35fbf6b
DM		 1721 _cleanup_strv_free_ char **files_env = NULL;
1722 int *fds = NULL; unsigned n_fds = 0;
1723 char *line, **argv;
1724 int socket_fd;
1725 pid_t pid;
1726 int err;
8351ceae 1727
d35fbf6b
DM		 1728 assert(command);
1729 assert(context);
1730 assert(ret);
1731 assert(params);
1732 assert(params->fds || params->n_fds <= 0);
4298d0b5 1733
d35fbf6b
DM		 1734 if (context->std_input == EXEC_INPUT_SOCKET ||
1735 context->std_output == EXEC_OUTPUT_SOCKET ||
1736 context->std_error == EXEC_OUTPUT_SOCKET) {
17df7223 1737
d35fbf6b
DM		 1738 if (params->n_fds != 1)
1739 return -EINVAL;
eef65bf3 1740
d35fbf6b
DM		 1741 socket_fd = params->fds[0];
1742 } else {
1743 socket_fd = -1;
1744 fds = params->fds;
1745 n_fds = params->n_fds;
1746 }
94f04347 1747
d35fbf6b
DM		 1748 err = exec_context_load_environment(context, &files_env);
1749 if (err < 0) {
1750 log_struct_unit(LOG_ERR,
1751 params->unit_id,
1752 "MESSAGE=Failed to load environment files: %s", strerror(-err),
1753 "ERRNO=%d", -err,
1754 NULL);
1755 return err;
1756 }
034c6ed7 1757
d35fbf6b 1758 argv = params->argv ?: command->argv;
034c6ed7 1759
d35fbf6b
DM		 1760 line = exec_command_line(argv);
1761 if (!line)
1762 return log_oom();
fab56fc5 1763
d35fbf6b
DM		 1764 log_struct_unit(LOG_DEBUG,
1765 params->unit_id,
1766 "EXECUTABLE=%s", command->path,
1767 "MESSAGE=About to execute: %s", line,
1768 NULL);
1769 free(line);
1770
1771 pid = fork();
1772 if (pid < 0)
1773 return -errno;
1774
1775 if (pid == 0) {
1776 int r;
034c6ed7 1777
d35fbf6b
DM		 1778 err = exec_child(command,
1779 context,
1780 params,
1781 runtime,
1782 argv,
1783 socket_fd,
1784 fds, n_fds,
1785 files_env,
1786 &r);
4c2630eb
MS		 1787 if (r != 0) {
1788 log_open();
23635a85
ZJS		 1789 log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1790 "EXECUTABLE=%s", command->path,
1791 "MESSAGE=Failed at step %s spawning %s: %s",
1792 exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1793 command->path, strerror(-err),
1794 "ERRNO=%d", -err,
1795 NULL);
1796 log_close();
4c2630eb
MS		 1797 }
1798
034c6ed7
LP		 1799 _exit(r);
1800 }
1801
bbc9006e 1802 log_struct_unit(LOG_DEBUG,
d35fbf6b 1803 params->unit_id,
ccd06097
ZJS		 1804 "MESSAGE=Forked %s as "PID_FMT,
1805 command->path, pid,
e62d8c39 1806 NULL);
23635a85 1807
80876c20
LP		 1808 /* We add the new process to the cgroup both in the child (so
1809 * that we can be sure that no user code is ever executed
1810 * outside of the cgroup) and in the parent (so that we can be
1811 * sure that when we kill the cgroup the process will be
1812 * killed too). */
d35fbf6b
DM		 1813 if (params->cgroup_path)
1814 cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
2da3263a 1815
b58b4116 1816 exec_status_start(&command->exec_status, pid);
9fb86720 1817
034c6ed7 1818 *ret = pid;
5cb5a6ff
LP		 1819 return 0;
1820}
1821
034c6ed7
LP		 1822void exec_context_init(ExecContext *c) {
1823 assert(c);
1824
4c12626c 1825 c->umask = 0022;
9eba9da4 1826 c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
94f04347 1827 c->cpu_sched_policy = SCHED_OTHER;
071830ff 1828 c->syslog_priority = LOG_DAEMON|LOG_INFO;
74922904 1829 c->syslog_level_prefix = true;
353e12c2 1830 c->ignore_sigpipe = true;
3a43da28 1831 c->timer_slack_nsec = NSEC_INFINITY;
ac45f971 1832 c->personality = 0xffffffffUL;
e66cf1a3 1833 c->runtime_directory_mode = 0755;
034c6ed7
LP		 1834}
1835
613b411c 1836void exec_context_done(ExecContext *c) {
5cb5a6ff
LP		 1837 unsigned l;
1838
1839 assert(c);
1840
1841 strv_free(c->environment);
034c6ed7 1842 c->environment = NULL;
5cb5a6ff 1843
8c7be95e
LP		 1844 strv_free(c->environment_files);
1845 c->environment_files = NULL;
1846
034c6ed7 1847 for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
5cb5a6ff 1848 free(c->rlimit[l]);
034c6ed7
LP		 1849 c->rlimit[l] = NULL;
1850 }
1851
9eba9da4
LP		 1852 free(c->working_directory);
1853 c->working_directory = NULL;
1854 free(c->root_directory);
1855 c->root_directory = NULL;
5cb5a6ff 1856
80876c20
LP		 1857 free(c->tty_path);
1858 c->tty_path = NULL;
1859
071830ff
LP		 1860 free(c->syslog_identifier);
1861 c->syslog_identifier = NULL;
1862
5cb5a6ff 1863 free(c->user);
034c6ed7
LP		 1864 c->user = NULL;
1865
5cb5a6ff 1866 free(c->group);
034c6ed7
LP		 1867 c->group = NULL;
1868
1869 strv_free(c->supplementary_groups);
1870 c->supplementary_groups = NULL;
94f04347 1871
5b6319dc
LP		 1872 free(c->pam_name);
1873 c->pam_name = NULL;
1874
94f04347
LP		 1875 if (c->capabilities) {
1876 cap_free(c->capabilities);
1877 c->capabilities = NULL;
1878 }
15ae422b
LP		 1879
1880 strv_free(c->read_only_dirs);
1881 c->read_only_dirs = NULL;
1882
1883 strv_free(c->read_write_dirs);
1884 c->read_write_dirs = NULL;
1885
1886 strv_free(c->inaccessible_dirs);
1887 c->inaccessible_dirs = NULL;
82c121a4
LP		 1888
1889 if (c->cpuset)
1890 CPU_FREE(c->cpuset);
86a3475b
LP		 1891
1892 free(c->utmp_id);
1893 c->utmp_id = NULL;
b9a0e010 1894
7b52a628
MS		 1895 free(c->selinux_context);
1896 c->selinux_context = NULL;
1897
eef65bf3
MS		 1898 free(c->apparmor_profile);
1899 c->apparmor_profile = NULL;
1900
17df7223
LP		 1901 set_free(c->syscall_filter);
1902 c->syscall_filter = NULL;
57183d11
LP		 1903
1904 set_free(c->syscall_archs);
1905 c->syscall_archs = NULL;
4298d0b5
LP		 1906
1907 set_free(c->address_families);
1908 c->address_families = NULL;
e66cf1a3
LP		 1909
1910 strv_free(c->runtime_directory);
1911 c->runtime_directory = NULL;
bb7dd0b0
DM		 1912
1913 bus_endpoint_free(c->bus_endpoint);
1914 c->bus_endpoint = NULL;
e66cf1a3
LP		 1915}
1916
1917int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
1918 char **i;
1919
1920 assert(c);
1921
1922 if (!runtime_prefix)
1923 return 0;
1924
1925 STRV_FOREACH(i, c->runtime_directory) {
1926 _cleanup_free_ char *p;
1927
1928 p = strjoin(runtime_prefix, "/", *i, NULL);
1929 if (!p)
1930 return -ENOMEM;
1931
1932 /* We execute this synchronously, since we need to be
1933 * sure this is gone when we start the service
1934 * next. */
1935 rm_rf_dangerous(p, false, true, false);
1936 }
1937
1938 return 0;
5cb5a6ff
LP		 1939}
1940
43d0fcbd
LP		 1941void exec_command_done(ExecCommand *c) {
1942 assert(c);
1943
1944 free(c->path);
1945 c->path = NULL;
1946
1947 strv_free(c->argv);
1948 c->argv = NULL;
1949}
1950
1951void exec_command_done_array(ExecCommand *c, unsigned n) {
1952 unsigned i;
1953
1954 for (i = 0; i < n; i++)
1955 exec_command_done(c+i);
1956}
1957
5cb5a6ff
LP		 1958void exec_command_free_list(ExecCommand *c) {
1959 ExecCommand *i;
1960
1961 while ((i = c)) {
71fda00f 1962 LIST_REMOVE(command, c, i);
43d0fcbd 1963 exec_command_done(i);
5cb5a6ff
LP		 1964 free(i);
1965 }
1966}
1967
034c6ed7
LP		 1968void exec_command_free_array(ExecCommand **c, unsigned n) {
1969 unsigned i;
1970
1971 for (i = 0; i < n; i++) {
1972 exec_command_free_list(c[i]);
1973 c[i] = NULL;
1974 }
1975}
1976
8c7be95e
LP		 1977int exec_context_load_environment(const ExecContext *c, char ***l) {
1978 char **i, **r = NULL;
1979
1980 assert(c);
1981 assert(l);
1982
1983 STRV_FOREACH(i, c->environment_files) {
1984 char *fn;
1985 int k;
1986 bool ignore = false;
1987 char **p;
7fd1b19b 1988 _cleanup_globfree_ glob_t pglob = {};
2bef10ab 1989 int count, n;
8c7be95e
LP		 1990
1991 fn = *i;
1992
1993 if (fn[0] == '-') {
1994 ignore = true;
1995 fn ++;
1996 }
1997
1998 if (!path_is_absolute(fn)) {
8c7be95e
LP		 1999 if (ignore)
2000 continue;
2001
2002 strv_free(r);
2003 return -EINVAL;
2004 }
2005
2bef10ab 2006 /* Filename supports globbing, take all matching files */
2bef10ab
PL		 2007 errno = 0;
2008 if (glob(fn, 0, NULL, &pglob) != 0) {
2bef10ab
PL		 2009 if (ignore)
2010 continue;
8c7be95e 2011
2bef10ab
PL		 2012 strv_free(r);
2013 return errno ? -errno : -EINVAL;
2014 }
2015 count = pglob.gl_pathc;
2016 if (count == 0) {
8c7be95e
LP		 2017 if (ignore)
2018 continue;
2019
2020 strv_free(r);
2bef10ab 2021 return -EINVAL;
8c7be95e 2022 }
2bef10ab 2023 for (n = 0; n < count; n++) {
717603e3 2024 k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
2bef10ab
PL		 2025 if (k < 0) {
2026 if (ignore)
2027 continue;
8c7be95e 2028
2bef10ab 2029 strv_free(r);
2bef10ab 2030 return k;
e9c1ea9d 2031 }
ebc05a09 2032 /* Log invalid environment variables with filename */
e9c1ea9d
JSJ		 2033 if (p)
2034 p = strv_env_clean_log(p, pglob.gl_pathv[n]);
8c7be95e 2035
2bef10ab
PL		 2036 if (r == NULL)
2037 r = p;
2038 else {
2039 char **m;
8c7be95e 2040
2bef10ab
PL		 2041 m = strv_env_merge(2, r, p);
2042 strv_free(r);
2043 strv_free(p);
c84a9488 2044 if (!m)
2bef10ab 2045 return -ENOMEM;
2bef10ab
PL		 2046
2047 r = m;
2048 }
8c7be95e
LP		 2049 }
2050 }
2051
2052 *l = r;
2053
2054 return 0;
2055}
2056
6ac8fdc9 2057static bool tty_may_match_dev_console(const char *tty) {
e1d75803
RC		 2058 _cleanup_free_ char *active = NULL;
2059 char *console;
6ac8fdc9
MS		 2060
2061 if (startswith(tty, "/dev/"))
2062 tty += 5;
2063
2064 /* trivial identity? */
2065 if (streq(tty, "console"))
2066 return true;
2067
2068 console = resolve_dev_console(&active);
2069 /* if we could not resolve, assume it may */
2070 if (!console)
2071 return true;
2072
2073 /* "tty0" means the active VC, so it may be the same sometimes */
e1d75803 2074 return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
6ac8fdc9
MS		 2075}
2076
2077bool exec_context_may_touch_console(ExecContext *ec) {
2078 return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
2079 is_terminal_input(ec->std_input) ||
2080 is_terminal_output(ec->std_output) ||
2081 is_terminal_output(ec->std_error)) &&
2082 tty_may_match_dev_console(tty_path(ec));
2083}
2084
15ae422b
LP		 2085static void strv_fprintf(FILE *f, char **l) {
2086 char **g;
2087
2088 assert(f);
2089
2090 STRV_FOREACH(g, l)
2091 fprintf(f, " %s", *g);
2092}
2093
5cb5a6ff 2094void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
507f22bd 2095 char **e;
94f04347 2096 unsigned i;
9eba9da4 2097
5cb5a6ff
LP		 2098 assert(c);
2099 assert(f);
2100
4ad49000 2101 prefix = strempty(prefix);
5cb5a6ff
LP		 2102
2103 fprintf(f,
94f04347
LP		 2104 "%sUMask: %04o\n"
2105 "%sWorkingDirectory: %s\n"
451a074f 2106 "%sRootDirectory: %s\n"
15ae422b 2107 "%sNonBlocking: %s\n"
64747e2d 2108 "%sPrivateTmp: %s\n"
4819ff03 2109 "%sPrivateNetwork: %s\n"
7f112f50 2110 "%sPrivateDevices: %s\n"
1b8689f9
LP		 2111 "%sProtectHome: %s\n"
2112 "%sProtectSystem: %s\n"
3bb07b76 2113 "%sIgnoreSIGPIPE: %s\n",
5cb5a6ff 2114 prefix, c->umask,
9eba9da4 2115 prefix, c->working_directory ? c->working_directory : "/",
451a074f 2116 prefix, c->root_directory ? c->root_directory : "/",
15ae422b 2117 prefix, yes_no(c->non_blocking),
64747e2d 2118 prefix, yes_no(c->private_tmp),
4819ff03 2119 prefix, yes_no(c->private_network),
7f112f50 2120 prefix, yes_no(c->private_devices),
1b8689f9
LP		 2121 prefix, protect_home_to_string(c->protect_home),
2122 prefix, protect_system_to_string(c->protect_system),
3bb07b76 2123 prefix, yes_no(c->ignore_sigpipe));
fb33a393 2124
8c7be95e
LP		 2125 STRV_FOREACH(e, c->environment)
2126 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
2127
2128 STRV_FOREACH(e, c->environment_files)
2129 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
94f04347 2130
fb33a393
LP		 2131 if (c->nice_set)
2132 fprintf(f,
2133 "%sNice: %i\n",
2134 prefix, c->nice);
2135
dd6c17b1 2136 if (c->oom_score_adjust_set)
fb33a393 2137 fprintf(f,
dd6c17b1
LP		 2138 "%sOOMScoreAdjust: %i\n",
2139 prefix, c->oom_score_adjust);
9eba9da4 2140
94f04347
LP		 2141 for (i = 0; i < RLIM_NLIMITS; i++)
2142 if (c->rlimit[i])
de0671ee
ZJS		 2143 fprintf(f, "%s%s: "RLIM_FMT"\n",
2144 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
94f04347 2145
f8b69d1d 2146 if (c->ioprio_set) {
1756a011 2147 _cleanup_free_ char *class_str = NULL;
f8b69d1d 2148
1756a011 2149 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
9eba9da4
LP		 2150 fprintf(f,
2151 "%sIOSchedulingClass: %s\n"
2152 "%sIOPriority: %i\n",
f8b69d1d 2153 prefix, strna(class_str),
9eba9da4 2154 prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
f8b69d1d 2155 }
94f04347 2156
f8b69d1d 2157 if (c->cpu_sched_set) {
1756a011 2158 _cleanup_free_ char *policy_str = NULL;
f8b69d1d 2159
1756a011 2160 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
94f04347
LP		 2161 fprintf(f,
2162 "%sCPUSchedulingPolicy: %s\n"
38b48754
LP		 2163 "%sCPUSchedulingPriority: %i\n"
2164 "%sCPUSchedulingResetOnFork: %s\n",
f8b69d1d 2165 prefix, strna(policy_str),
38b48754
LP		 2166 prefix, c->cpu_sched_priority,
2167 prefix, yes_no(c->cpu_sched_reset_on_fork));
b929bf04 2168 }
94f04347 2169
82c121a4 2170 if (c->cpuset) {
94f04347 2171 fprintf(f, "%sCPUAffinity:", prefix);
82c121a4
LP		 2172 for (i = 0; i < c->cpuset_ncpus; i++)
2173 if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
43a99a7a 2174 fprintf(f, " %u", i);
94f04347
LP		 2175 fputs("\n", f);
2176 }
2177
3a43da28 2178 if (c->timer_slack_nsec != NSEC_INFINITY)
ccd06097 2179 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
94f04347
LP		 2180
2181 fprintf(f,
80876c20
LP		 2182 "%sStandardInput: %s\n"
2183 "%sStandardOutput: %s\n"
2184 "%sStandardError: %s\n",
2185 prefix, exec_input_to_string(c->std_input),
2186 prefix, exec_output_to_string(c->std_output),
2187 prefix, exec_output_to_string(c->std_error));
2188
2189 if (c->tty_path)
2190 fprintf(f,
6ea832a2
LP		 2191 "%sTTYPath: %s\n"
2192 "%sTTYReset: %s\n"
2193 "%sTTYVHangup: %s\n"
2194 "%sTTYVTDisallocate: %s\n",
2195 prefix, c->tty_path,
2196 prefix, yes_no(c->tty_reset),
2197 prefix, yes_no(c->tty_vhangup),
2198 prefix, yes_no(c->tty_vt_disallocate));
94f04347 2199
5ce70e5b
ZJS		 2200 if (c->std_output == EXEC_OUTPUT_SYSLOG ||
2201 c->std_output == EXEC_OUTPUT_KMSG ||
2202 c->std_output == EXEC_OUTPUT_JOURNAL ||
2203 c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2204 c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2205 c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
2206 c->std_error == EXEC_OUTPUT_SYSLOG ||
2207 c->std_error == EXEC_OUTPUT_KMSG ||
2208 c->std_error == EXEC_OUTPUT_JOURNAL ||
2209 c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2210 c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2211 c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
f8b69d1d 2212
5ce70e5b 2213 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
f8b69d1d 2214
5ce70e5b
ZJS		 2215 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
2216 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
f8b69d1d 2217
94f04347
LP		 2218 fprintf(f,
2219 "%sSyslogFacility: %s\n"
2220 "%sSyslogLevel: %s\n",
f8b69d1d
MS		 2221 prefix, strna(fac_str),
2222 prefix, strna(lvl_str));
f8b69d1d 2223 }
94f04347
LP		 2224
2225 if (c->capabilities) {
5ce70e5b
ZJS		 2226 _cleanup_cap_free_charp_ char *t;
2227
2228 t = cap_to_text(c->capabilities, NULL);
2229 if (t)
2230 fprintf(f, "%sCapabilities: %s\n", prefix, t);
94f04347
LP		 2231 }
2232
2233 if (c->secure_bits)
2234 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
2235 prefix,
cbb21cca
ZJS		 2236 (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
2237 (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
2238 (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
2239 (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
2240 (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
2241 (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
94f04347
LP		 2242
2243 if (c->capability_bounding_set_drop) {
ae556c21 2244 unsigned long l;
260abb78 2245 fprintf(f, "%sCapabilityBoundingSet:", prefix);
94f04347 2246
64685e0c 2247 for (l = 0; l <= cap_last_cap(); l++)
ae556c21 2248 if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
5ce70e5b 2249 _cleanup_cap_free_charp_ char *t;
94f04347 2250
5ce70e5b
ZJS		 2251 t = cap_to_name(l);
2252 if (t)
94f04347 2253 fprintf(f, " %s", t);
94f04347
LP		 2254 }
2255
2256 fputs("\n", f);
2257 }
2258
2259 if (c->user)
f2d3769a 2260 fprintf(f, "%sUser: %s\n", prefix, c->user);
94f04347 2261 if (c->group)
f2d3769a 2262 fprintf(f, "%sGroup: %s\n", prefix, c->group);
94f04347 2263
15ae422b 2264 if (strv_length(c->supplementary_groups) > 0) {
94f04347 2265 fprintf(f, "%sSupplementaryGroups:", prefix);
15ae422b
LP		 2266 strv_fprintf(f, c->supplementary_groups);
2267 fputs("\n", f);
2268 }
94f04347 2269
5b6319dc 2270 if (c->pam_name)
f2d3769a 2271 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
5b6319dc 2272
15ae422b
LP		 2273 if (strv_length(c->read_write_dirs) > 0) {
2274 fprintf(f, "%sReadWriteDirs:", prefix);
2275 strv_fprintf(f, c->read_write_dirs);
2276 fputs("\n", f);
2277 }
2278
2279 if (strv_length(c->read_only_dirs) > 0) {
2280 fprintf(f, "%sReadOnlyDirs:", prefix);
2281 strv_fprintf(f, c->read_only_dirs);
2282 fputs("\n", f);
2283 }
94f04347 2284
15ae422b
LP		 2285 if (strv_length(c->inaccessible_dirs) > 0) {
2286 fprintf(f, "%sInaccessibleDirs:", prefix);
2287 strv_fprintf(f, c->inaccessible_dirs);
94f04347
LP		 2288 fputs("\n", f);
2289 }
2e22afe9 2290
169c1bda
LP		 2291 if (c->utmp_id)
2292 fprintf(f,
2293 "%sUtmpIdentifier: %s\n",
2294 prefix, c->utmp_id);
7b52a628
MS		 2295
2296 if (c->selinux_context)
2297 fprintf(f,
5f8640fb
LP		 2298 "%sSELinuxContext: %s%s\n",
2299 prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
17df7223 2300
ac45f971
LP		 2301 if (c->personality != 0xffffffffUL)
2302 fprintf(f,
2303 "%sPersonality: %s\n",
2304 prefix, strna(personality_to_string(c->personality)));
2305
17df7223 2306 if (c->syscall_filter) {
351a19b1 2307#ifdef HAVE_SECCOMP
17df7223
LP		 2308 Iterator j;
2309 void *id;
2310 bool first = true;
351a19b1 2311#endif
17df7223
LP		 2312
2313 fprintf(f,
57183d11 2314 "%sSystemCallFilter: ",
17df7223
LP		 2315 prefix);
2316
2317 if (!c->syscall_whitelist)
2318 fputc('~', f);
2319
351a19b1 2320#ifdef HAVE_SECCOMP
17df7223
LP		 2321 SET_FOREACH(id, c->syscall_filter, j) {
2322 _cleanup_free_ char *name = NULL;
2323
2324 if (first)
2325 first = false;
2326 else
2327 fputc(' ', f);
2328
57183d11 2329 name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
17df7223
LP		 2330 fputs(strna(name), f);
2331 }
351a19b1 2332#endif
17df7223
LP		 2333
2334 fputc('\n', f);
2335 }
2336
57183d11
LP		 2337 if (c->syscall_archs) {
2338#ifdef HAVE_SECCOMP
2339 Iterator j;
2340 void *id;
2341#endif
2342
2343 fprintf(f,
2344 "%sSystemCallArchitectures:",
2345 prefix);
2346
2347#ifdef HAVE_SECCOMP
2348 SET_FOREACH(id, c->syscall_archs, j)
2349 fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
2350#endif
2351 fputc('\n', f);
2352 }
2353
17df7223
LP		 2354 if (c->syscall_errno != 0)
2355 fprintf(f,
2356 "%sSystemCallErrorNumber: %s\n",
2357 prefix, strna(errno_to_name(c->syscall_errno)));
eef65bf3
MS		 2358
2359 if (c->apparmor_profile)
2360 fprintf(f,
2361 "%sAppArmorProfile: %s%s\n",
2362 prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
5cb5a6ff
LP		 2363}
2364
b58b4116 2365void exec_status_start(ExecStatus *s, pid_t pid) {
034c6ed7 2366 assert(s);
5cb5a6ff 2367
b58b4116
LP		 2368 zero(*s);
2369 s->pid = pid;
2370 dual_timestamp_get(&s->start_timestamp);
2371}
2372
6ea832a2 2373void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
b58b4116
LP		 2374 assert(s);
2375
0b1f4ae6 2376 if (s->pid && s->pid != pid)
b58b4116
LP		 2377 zero(*s);
2378
034c6ed7 2379 s->pid = pid;
63983207 2380 dual_timestamp_get(&s->exit_timestamp);
9fb86720 2381
034c6ed7
LP		 2382 s->code = code;
2383 s->status = status;
169c1bda 2384
6ea832a2
LP		 2385 if (context) {
2386 if (context->utmp_id)
2387 utmp_put_dead_process(context->utmp_id, pid, code, status);
2388
2389 exec_context_tty_reset(context);
2390 }
9fb86720
LP		 2391}
2392
2393void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2394 char buf[FORMAT_TIMESTAMP_MAX];
2395
2396 assert(s);
2397 assert(f);
2398
9fb86720
LP		 2399 if (s->pid <= 0)
2400 return;
2401
4c940960
LP		 2402 prefix = strempty(prefix);
2403
9fb86720 2404 fprintf(f,
ccd06097
ZJS		 2405 "%sPID: "PID_FMT"\n",
2406 prefix, s->pid);
9fb86720 2407
63983207 2408 if (s->start_timestamp.realtime > 0)
9fb86720
LP		 2409 fprintf(f,
2410 "%sStart Timestamp: %s\n",
63983207 2411 prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
9fb86720 2412
63983207 2413 if (s->exit_timestamp.realtime > 0)
9fb86720
LP		 2414 fprintf(f,
2415 "%sExit Timestamp: %s\n"
2416 "%sExit Code: %s\n"
2417 "%sExit Status: %i\n",
63983207 2418 prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
9fb86720
LP		 2419 prefix, sigchld_code_to_string(s->code),
2420 prefix, s->status);
5cb5a6ff 2421}
44d8db9e 2422
9e2f7c11 2423char *exec_command_line(char **argv) {
44d8db9e
LP		 2424 size_t k;
2425 char *n, *p, **a;
2426 bool first = true;
2427
9e2f7c11 2428 assert(argv);
44d8db9e 2429
9164977d 2430 k = 1;
9e2f7c11 2431 STRV_FOREACH(a, argv)
44d8db9e
LP		 2432 k += strlen(*a)+3;
2433
2434 if (!(n = new(char, k)))
2435 return NULL;
2436
2437 p = n;
9e2f7c11 2438 STRV_FOREACH(a, argv) {
44d8db9e
LP		 2439
2440 if (!first)
2441 *(p++) = ' ';
2442 else
2443 first = false;
2444
2445 if (strpbrk(*a, WHITESPACE)) {
2446 *(p++) = '\'';
2447 p = stpcpy(p, *a);
2448 *(p++) = '\'';
2449 } else
2450 p = stpcpy(p, *a);
2451
2452 }
2453
9164977d
LP		 2454 *p = 0;
2455
44d8db9e
LP		 2456 /* FIXME: this doesn't really handle arguments that have
2457 * spaces and ticks in them */
2458
2459 return n;
2460}
2461
2462void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
e1d75803 2463 _cleanup_free_ char *cmd = NULL;
4c940960 2464 const char *prefix2;
44d8db9e
LP		 2465
2466 assert(c);
2467 assert(f);
2468
4c940960
LP		 2469 prefix = strempty(prefix);
2470 prefix2 = strappenda(prefix, "\t");
44d8db9e 2471
9e2f7c11 2472 cmd = exec_command_line(c->argv);
44d8db9e
LP		 2473 fprintf(f,
2474 "%sCommand Line: %s\n",
2475 prefix, cmd ? cmd : strerror(ENOMEM));
2476
9fb86720 2477 exec_status_dump(&c->exec_status, f, prefix2);
44d8db9e
LP		 2478}
2479
2480void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2481 assert(f);
2482
4c940960 2483 prefix = strempty(prefix);
44d8db9e
LP		 2484
2485 LIST_FOREACH(command, c, c)
2486 exec_command_dump(c, f, prefix);
2487}
94f04347 2488
a6a80b4f
LP		 2489void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2490 ExecCommand *end;
2491
2492 assert(l);
2493 assert(e);
2494
2495 if (*l) {
35b8ca3a 2496 /* It's kind of important, that we keep the order here */
71fda00f
LP		 2497 LIST_FIND_TAIL(command, *l, end);
2498 LIST_INSERT_AFTER(command, *l, end, e);
a6a80b4f
LP		 2499 } else
2500 *l = e;
2501}
2502
26fd040d
LP		 2503int exec_command_set(ExecCommand *c, const char *path, ...) {
2504 va_list ap;
2505 char **l, *p;
2506
2507 assert(c);
2508 assert(path);
2509
2510 va_start(ap, path);
2511 l = strv_new_ap(path, ap);
2512 va_end(ap);
2513
2514 if (!l)
2515 return -ENOMEM;
2516
250a918d
LP		 2517 p = strdup(path);
2518 if (!p) {
26fd040d
LP		 2519 strv_free(l);
2520 return -ENOMEM;
2521 }
2522
2523 free(c->path);
2524 c->path = p;
2525
2526 strv_free(c->argv);
2527 c->argv = l;
2528
2529 return 0;
2530}
2531
613b411c
LP		 2532static int exec_runtime_allocate(ExecRuntime **rt) {
2533
2534 if (*rt)
2535 return 0;
2536
2537 *rt = new0(ExecRuntime, 1);
f146f5e1 2538 if (!*rt)
613b411c
LP		 2539 return -ENOMEM;
2540
2541 (*rt)->n_ref = 1;
2542 (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
2543
2544 return 0;
2545}
2546
2547int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
2548 int r;
2549
2550 assert(rt);
2551 assert(c);
2552 assert(id);
2553
2554 if (*rt)
2555 return 1;
2556
2557 if (!c->private_network && !c->private_tmp)
2558 return 0;
2559
2560 r = exec_runtime_allocate(rt);
2561 if (r < 0)
2562 return r;
2563
2564 if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
2565 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
2566 return -errno;
2567 }
2568
2569 if (c->private_tmp && !(*rt)->tmp_dir) {
2570 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
2571 if (r < 0)
2572 return r;
2573 }
2574
2575 return 1;
2576}
2577
2578ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
2579 assert(r);
2580 assert(r->n_ref > 0);
2581
2582 r->n_ref++;
2583 return r;
2584}
2585
2586ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
2587
2588 if (!r)
2589 return NULL;
2590
2591 assert(r->n_ref > 0);
2592
2593 r->n_ref--;
2594 if (r->n_ref <= 0) {
2595 free(r->tmp_dir);
2596 free(r->var_tmp_dir);
3d94f76c 2597 safe_close_pair(r->netns_storage_socket);
613b411c
LP		 2598 free(r);
2599 }
2600
2601 return NULL;
2602}
2603
2604int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds) {
2605 assert(u);
2606 assert(f);
2607 assert(fds);
2608
2609 if (!rt)
2610 return 0;
2611
2612 if (rt->tmp_dir)
2613 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
2614
2615 if (rt->var_tmp_dir)
2616 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
2617
2618 if (rt->netns_storage_socket[0] >= 0) {
2619 int copy;
2620
2621 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
2622 if (copy < 0)
2623 return copy;
2624
2625 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
2626 }
2627
2628 if (rt->netns_storage_socket[1] >= 0) {
2629 int copy;
2630
2631 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
2632 if (copy < 0)
2633 return copy;
2634
2635 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
2636 }
2637
2638 return 0;
2639}
2640
2641int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds) {
2642 int r;
2643
2644 assert(rt);
2645 assert(key);
2646 assert(value);
2647
2648 if (streq(key, "tmp-dir")) {
2649 char *copy;
2650
2651 r = exec_runtime_allocate(rt);
2652 if (r < 0)
2653 return r;
2654
2655 copy = strdup(value);
2656 if (!copy)
2657 return log_oom();
2658
2659 free((*rt)->tmp_dir);
2660 (*rt)->tmp_dir = copy;
2661
2662 } else if (streq(key, "var-tmp-dir")) {
2663 char *copy;
2664
2665 r = exec_runtime_allocate(rt);
2666 if (r < 0)
2667 return r;
2668
2669 copy = strdup(value);
2670 if (!copy)
2671 return log_oom();
2672
2673 free((*rt)->var_tmp_dir);
2674 (*rt)->var_tmp_dir = copy;
2675
2676 } else if (streq(key, "netns-socket-0")) {
2677 int fd;
2678
2679 r = exec_runtime_allocate(rt);
2680 if (r < 0)
2681 return r;
2682
2683 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2684 log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2685 else {
03e334a1 2686 safe_close((*rt)->netns_storage_socket[0]);
613b411c
LP		 2687 (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
2688 }
2689 } else if (streq(key, "netns-socket-1")) {
2690 int fd;
2691
2692 r = exec_runtime_allocate(rt);
2693 if (r < 0)
2694 return r;
2695
2696 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2697 log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2698 else {
03e334a1 2699 safe_close((*rt)->netns_storage_socket[1]);
613b411c
LP		 2700 (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
2701 }
2702 } else
2703 return 0;
2704
2705 return 1;
2706}
2707
2708static void *remove_tmpdir_thread(void *p) {
2709 _cleanup_free_ char *path = p;
2710
2711 rm_rf_dangerous(path, false, true, false);
2712 return NULL;
2713}
2714
2715void exec_runtime_destroy(ExecRuntime *rt) {
98b47d54
LP		 2716 int r;
2717
613b411c
LP		 2718 if (!rt)
2719 return;
2720
2721 /* If there are multiple users of this, let's leave the stuff around */
2722 if (rt->n_ref > 1)
2723 return;
2724
2725 if (rt->tmp_dir) {
2726 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
98b47d54
LP		 2727
2728 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
2729 if (r < 0) {
2730 log_warning("Failed to nuke %s: %s", rt->tmp_dir, strerror(-r));
2731 free(rt->tmp_dir);
2732 }
2733
613b411c
LP		 2734 rt->tmp_dir = NULL;
2735 }
2736
2737 if (rt->var_tmp_dir) {
2738 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
98b47d54
LP		 2739
2740 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
2741 if (r < 0) {
2742 log_warning("Failed to nuke %s: %s", rt->var_tmp_dir, strerror(-r));
2743 free(rt->var_tmp_dir);
2744 }
2745
613b411c
LP		 2746 rt->var_tmp_dir = NULL;
2747 }
2748
3d94f76c 2749 safe_close_pair(rt->netns_storage_socket);
613b411c
LP		 2750}
2751
80876c20
LP		 2752static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2753 [EXEC_INPUT_NULL] = "null",
2754 [EXEC_INPUT_TTY] = "tty",
2755 [EXEC_INPUT_TTY_FORCE] = "tty-force",
4f2d528d
LP		 2756 [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2757 [EXEC_INPUT_SOCKET] = "socket"
80876c20
LP		 2758};
2759
8a0867d6
LP		 2760DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2761
94f04347 2762static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
80876c20 2763 [EXEC_OUTPUT_INHERIT] = "inherit",
94f04347 2764 [EXEC_OUTPUT_NULL] = "null",
80876c20 2765 [EXEC_OUTPUT_TTY] = "tty",
94f04347 2766 [EXEC_OUTPUT_SYSLOG] = "syslog",
28dbc1e8 2767 [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
9a6bca7a 2768 [EXEC_OUTPUT_KMSG] = "kmsg",
28dbc1e8 2769 [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
706343f4
LP		 2770 [EXEC_OUTPUT_JOURNAL] = "journal",
2771 [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
4f2d528d 2772 [EXEC_OUTPUT_SOCKET] = "socket"
94f04347
LP		 2773};
2774
2775DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
Unnamed repository; edit this file 'description' to name the repository.