]>
Commit | Line | Data |
---|---|---|
53e1b683 | 1 | /* SPDX-License-Identifier: LGPL-2.1+ */ |
ca78ad1d ZJS |
2 | |
3 | #include <sys/stat.h> | |
4 | #include <sys/types.h> | |
5 | #include <unistd.h> | |
091a364c | 6 | |
091a364c | 7 | #include "sd-daemon.h" |
b1d4f8e1 LP |
8 | #include "sd-event.h" |
9 | ||
430f0182 | 10 | #include "capability-util.h" |
1e88b819 YW |
11 | #include "daemon-util.h" |
12 | #include "main-func.h" | |
b1d4f8e1 LP |
13 | #include "mkdir.h" |
14 | #include "resolved-conf.h" | |
15 | #include "resolved-manager.h" | |
f8dc7e34 | 16 | #include "resolved-resolv-conf.h" |
d7b8eec7 | 17 | #include "selinux-util.h" |
24882e06 | 18 | #include "signal-util.h" |
b1d4f8e1 | 19 | #include "user-util.h" |
4e945a6f | 20 | |
1e88b819 YW |
21 | static int run(int argc, char *argv[]) { |
22 | _cleanup_(notify_on_cleanup) const char *notify_stop = NULL; | |
74b2466e | 23 | _cleanup_(manager_freep) Manager *m = NULL; |
682265d5 TG |
24 | const char *user = "systemd-resolve"; |
25 | uid_t uid; | |
26 | gid_t gid; | |
091a364c TG |
27 | int r; |
28 | ||
6bf3c61c | 29 | log_setup_service(); |
091a364c | 30 | |
1e88b819 YW |
31 | if (argc != 1) |
32 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "This program takes no arguments."); | |
091a364c | 33 | |
a5a807e6 ZJS |
34 | umask(0022); |
35 | ||
c3dacc8b | 36 | r = mac_selinux_init(); |
1e88b819 YW |
37 | if (r < 0) |
38 | return log_error_errno(r, "SELinux setup failed: %m"); | |
a5a807e6 | 39 | |
fafff8f1 | 40 | r = get_user_creds(&user, &uid, &gid, NULL, NULL, 0); |
1e88b819 YW |
41 | if (r < 0) |
42 | return log_error_errno(r, "Cannot resolve user name %s: %m", user); | |
682265d5 | 43 | |
091a364c | 44 | /* Always create the directory where resolv.conf will live */ |
37c1d5e9 | 45 | r = mkdir_safe_label("/run/systemd/resolve", 0755, uid, gid, MKDIR_WARN_MODE); |
1e88b819 YW |
46 | if (r < 0) |
47 | return log_error_errno(r, "Could not create runtime directory: %m"); | |
682265d5 | 48 | |
8f8112f9 | 49 | /* Drop privileges, but only if we have been started as root. If we are not running as root we assume most |
635f3df5 LP |
50 | * privileges are already dropped. */ |
51 | if (getuid() == 0) { | |
52 | ||
53 | /* Drop privileges, but keep three caps. Note that we drop those too, later on (see below) */ | |
54 | r = drop_privileges(uid, gid, | |
55 | (UINT64_C(1) << CAP_NET_RAW)| /* needed for SO_BINDTODEVICE */ | |
56 | (UINT64_C(1) << CAP_NET_BIND_SERVICE)| /* needed to bind on port 53 */ | |
57 | (UINT64_C(1) << CAP_SETPCAP) /* needed in order to drop the caps later */); | |
58 | if (r < 0) | |
1e88b819 | 59 | return log_error_errno(r, "Failed to drop privileges: %m"); |
635f3df5 | 60 | } |
091a364c | 61 | |
d55b0463 | 62 | assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGUSR1, SIGUSR2, SIGRTMIN+1, -1) >= 0); |
b9e7a9d8 | 63 | |
091a364c | 64 | r = manager_new(&m); |
1e88b819 YW |
65 | if (r < 0) |
66 | return log_error_errno(r, "Could not create manager: %m"); | |
091a364c | 67 | |
edc501d4 | 68 | r = manager_start(m); |
1e88b819 YW |
69 | if (r < 0) |
70 | return log_error_errno(r, "Failed to start manager: %m"); | |
edc501d4 | 71 | |
7207052d LP |
72 | /* Write finish default resolv.conf to avoid a dangling symlink */ |
73 | (void) manager_write_resolv_conf(m); | |
091a364c | 74 | |
f43580f1 YW |
75 | (void) manager_check_resolv_conf(m); |
76 | ||
b30bf55d LP |
77 | /* Let's drop the remaining caps now */ |
78 | r = capability_bounding_set_drop(0, true); | |
1e88b819 YW |
79 | if (r < 0) |
80 | return log_error_errno(r, "Failed to drop remaining caps: %m"); | |
b30bf55d | 81 | |
1e88b819 | 82 | notify_stop = notify_start(NOTIFY_READY, NOTIFY_STOPPING); |
091a364c TG |
83 | |
84 | r = sd_event_loop(m->event); | |
1e88b819 YW |
85 | if (r < 0) |
86 | return log_error_errno(r, "Event loop failed: %m"); | |
091a364c | 87 | |
690f02f4 | 88 | return 0; |
091a364c | 89 | } |
1e88b819 YW |
90 | |
91 | DEFINE_MAIN_FUNCTION(run); |