]>
Commit | Line | Data |
---|---|---|
53e1b683 | 1 | /* SPDX-License-Identifier: LGPL-2.1+ */ |
091a364c | 2 | |
091a364c | 3 | #include "sd-daemon.h" |
b1d4f8e1 LP |
4 | #include "sd-event.h" |
5 | ||
430f0182 | 6 | #include "capability-util.h" |
1e88b819 YW |
7 | #include "daemon-util.h" |
8 | #include "main-func.h" | |
b1d4f8e1 LP |
9 | #include "mkdir.h" |
10 | #include "resolved-conf.h" | |
11 | #include "resolved-manager.h" | |
f8dc7e34 | 12 | #include "resolved-resolv-conf.h" |
d7b8eec7 | 13 | #include "selinux-util.h" |
24882e06 | 14 | #include "signal-util.h" |
b1d4f8e1 | 15 | #include "user-util.h" |
4e945a6f | 16 | |
1e88b819 YW |
17 | static int run(int argc, char *argv[]) { |
18 | _cleanup_(notify_on_cleanup) const char *notify_stop = NULL; | |
74b2466e | 19 | _cleanup_(manager_freep) Manager *m = NULL; |
682265d5 TG |
20 | const char *user = "systemd-resolve"; |
21 | uid_t uid; | |
22 | gid_t gid; | |
091a364c TG |
23 | int r; |
24 | ||
6bf3c61c | 25 | log_setup_service(); |
091a364c | 26 | |
1e88b819 YW |
27 | if (argc != 1) |
28 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "This program takes no arguments."); | |
091a364c | 29 | |
a5a807e6 ZJS |
30 | umask(0022); |
31 | ||
c3dacc8b | 32 | r = mac_selinux_init(); |
1e88b819 YW |
33 | if (r < 0) |
34 | return log_error_errno(r, "SELinux setup failed: %m"); | |
a5a807e6 | 35 | |
fafff8f1 | 36 | r = get_user_creds(&user, &uid, &gid, NULL, NULL, 0); |
1e88b819 YW |
37 | if (r < 0) |
38 | return log_error_errno(r, "Cannot resolve user name %s: %m", user); | |
682265d5 | 39 | |
091a364c | 40 | /* Always create the directory where resolv.conf will live */ |
37c1d5e9 | 41 | r = mkdir_safe_label("/run/systemd/resolve", 0755, uid, gid, MKDIR_WARN_MODE); |
1e88b819 YW |
42 | if (r < 0) |
43 | return log_error_errno(r, "Could not create runtime directory: %m"); | |
682265d5 | 44 | |
8f8112f9 | 45 | /* Drop privileges, but only if we have been started as root. If we are not running as root we assume most |
635f3df5 LP |
46 | * privileges are already dropped. */ |
47 | if (getuid() == 0) { | |
48 | ||
49 | /* Drop privileges, but keep three caps. Note that we drop those too, later on (see below) */ | |
50 | r = drop_privileges(uid, gid, | |
51 | (UINT64_C(1) << CAP_NET_RAW)| /* needed for SO_BINDTODEVICE */ | |
52 | (UINT64_C(1) << CAP_NET_BIND_SERVICE)| /* needed to bind on port 53 */ | |
53 | (UINT64_C(1) << CAP_SETPCAP) /* needed in order to drop the caps later */); | |
54 | if (r < 0) | |
1e88b819 | 55 | return log_error_errno(r, "Failed to drop privileges: %m"); |
635f3df5 | 56 | } |
091a364c | 57 | |
d55b0463 | 58 | assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGUSR1, SIGUSR2, SIGRTMIN+1, -1) >= 0); |
b9e7a9d8 | 59 | |
091a364c | 60 | r = manager_new(&m); |
1e88b819 YW |
61 | if (r < 0) |
62 | return log_error_errno(r, "Could not create manager: %m"); | |
091a364c | 63 | |
edc501d4 | 64 | r = manager_start(m); |
1e88b819 YW |
65 | if (r < 0) |
66 | return log_error_errno(r, "Failed to start manager: %m"); | |
edc501d4 | 67 | |
7207052d LP |
68 | /* Write finish default resolv.conf to avoid a dangling symlink */ |
69 | (void) manager_write_resolv_conf(m); | |
091a364c | 70 | |
f43580f1 YW |
71 | (void) manager_check_resolv_conf(m); |
72 | ||
b30bf55d LP |
73 | /* Let's drop the remaining caps now */ |
74 | r = capability_bounding_set_drop(0, true); | |
1e88b819 YW |
75 | if (r < 0) |
76 | return log_error_errno(r, "Failed to drop remaining caps: %m"); | |
b30bf55d | 77 | |
1e88b819 | 78 | notify_stop = notify_start(NOTIFY_READY, NOTIFY_STOPPING); |
091a364c TG |
79 | |
80 | r = sd_event_loop(m->event); | |
1e88b819 YW |
81 | if (r < 0) |
82 | return log_error_errno(r, "Event loop failed: %m"); | |
091a364c | 83 | |
690f02f4 | 84 | return 0; |
091a364c | 85 | } |
1e88b819 YW |
86 | |
87 | DEFINE_MAIN_FUNCTION(run); |