]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/tmpfiles/tmpfiles.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Fail on unknown (alphanumerical) specifiers
[thirdparty/systemd.git] / src / tmpfiles / tmpfiles.c
CommitLineData
53e1b683 1/* SPDX-License-Identifier: LGPL-2.1+ */
5008d581
LP		 2/***
3 This file is part of systemd.
4
3b63d2d3 5 Copyright 2010 Lennart Poettering, Kay Sievers
3f93da98 6 Copyright 2015 Zbigniew Jędrzejewski-Szmek
5008d581
LP		 7
8 systemd is free software; you can redistribute it and/or modify it
5430f7f2
LP		 9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
5008d581
LP		 11 (at your option) any later version.
12
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2 16 Lesser General Public License for more details.
5008d581 17
5430f7f2 18 You should have received a copy of the GNU Lesser General Public License
5008d581
LP		 19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
20***/
21
5008d581 22#include <errno.h>
3f6fd1ba
LP		 23#include <fcntl.h>
24#include <fnmatch.h>
25#include <getopt.h>
26#include <glob.h>
5008d581 27#include <limits.h>
3f6fd1ba
LP		 28#include <linux/fs.h>
29#include <stdbool.h>
30#include <stddef.h>
3b63d2d3
LP		 31#include <stdio.h>
32#include <stdlib.h>
3f6fd1ba 33#include <string.h>
505ef0e3 34#include <sys/stat.h>
ebf4e801 35#include <sys/xattr.h>
d9daae55 36#include <sysexits.h>
3f6fd1ba
LP		 37#include <time.h>
38#include <unistd.h>
5008d581 39
3f6fd1ba 40#include "acl-util.h"
b5efdb8a 41#include "alloc-util.h"
3f6fd1ba 42#include "btrfs-util.h"
430f0182 43#include "capability-util.h"
c8b3094d 44#include "chattr-util.h"
3f6fd1ba
LP		 45#include "conf-files.h"
46#include "copy.h"
a0f29c76 47#include "def.h"
8fb3f009 48#include "dirent-util.h"
4f5dd394 49#include "escape.h"
3ffd4af2 50#include "fd-util.h"
0d39fa9c 51#include "fileio.h"
f97b34a6 52#include "format-util.h"
f4f15635 53#include "fs-util.h"
7d50b32a 54#include "glob-util.h"
c004493c 55#include "io-util.h"
3f6fd1ba 56#include "label.h"
5008d581 57#include "log.h"
54693d9b 58#include "macro.h"
d39efe74 59#include "missing.h"
49e942b2 60#include "mkdir.h"
4e036b7a 61#include "mount-util.h"
6bedfcbb 62#include "parse-util.h"
9eb977db 63#include "path-util.h"
c6878637 64#include "rm-rf.h"
d7b8eec7 65#include "selinux-util.h"
3f6fd1ba
LP		 66#include "set.h"
67#include "specifier.h"
8fcde012 68#include "stat-util.h"
15a5e950 69#include "stdio-util.h"
8b43440b 70#include "string-table.h"
07630cea 71#include "string-util.h"
3f6fd1ba 72#include "strv.h"
affb60b1 73#include "umask-util.h"
b1d4f8e1 74#include "user-util.h"
3f6fd1ba 75#include "util.h"
5008d581 76
01000479 77/* This reads all files listed in /etc/tmpfiles.d/?*.conf and creates
5008d581 78 * them in the file system. This is intended to be used to create
db019b8d
KS		 79 * properly owned directories beneath /tmp, /var/tmp, /run, which are
80 * volatile and hence need to be recreated on bootup. */
5008d581 81
66ccd038 82typedef enum ItemType {
b8bb3e8f 83 /* These ones take file names */
3b63d2d3
LP		 84 CREATE_FILE = 'f',
85 TRUNCATE_FILE = 'F',
86 CREATE_DIRECTORY = 'd',
87 TRUNCATE_DIRECTORY = 'D',
d7b8eec7 88 CREATE_SUBVOLUME = 'v',
5fb13eb5
LP		 89 CREATE_SUBVOLUME_INHERIT_QUOTA = 'q',
90 CREATE_SUBVOLUME_NEW_QUOTA = 'Q',
ee17ee7c 91 CREATE_FIFO = 'p',
468d726b
LP		 92 CREATE_SYMLINK = 'L',
93 CREATE_CHAR_DEVICE = 'c',
94 CREATE_BLOCK_DEVICE = 'b',
849958d1 95 COPY_FILES = 'C',
b8bb3e8f
LP		 96
97 /* These ones take globs */
17493fa5 98 WRITE_FILE = 'w',
df8dee85 99 EMPTY_DIRECTORY = 'e',
b705ab6a
ZJS		 100 SET_XATTR = 't',
101 RECURSIVE_SET_XATTR = 'T',
102 SET_ACL = 'a',
103 RECURSIVE_SET_ACL = 'A',
17493fa5
LP		 104 SET_ATTRIBUTE = 'h',
105 RECURSIVE_SET_ATTRIBUTE = 'H',
3b63d2d3 106 IGNORE_PATH = 'x',
78a92a5a 107 IGNORE_DIRECTORY_PATH = 'X',
3b63d2d3 108 REMOVE_PATH = 'r',
a8d88783 109 RECURSIVE_REMOVE_PATH = 'R',
777b87e7 110 RELABEL_PATH = 'z',
e73a03e0 111 RECURSIVE_RELABEL_PATH = 'Z',
17493fa5 112 ADJUST_MODE = 'm', /* legacy, 'z' is identical to this */
66ccd038 113} ItemType;
3b63d2d3
LP		 114
115typedef struct Item {
66ccd038 116 ItemType type;
3b63d2d3
LP		 117
118 char *path;
468d726b 119 char *argument;
ebf4e801 120 char **xattrs;
349cc4a5 121#if HAVE_ACL
f8eeeaf9
ZJS		 122 acl_t acl_access;
123 acl_t acl_default;
124#endif
5008d581
LP		 125 uid_t uid;
126 gid_t gid;
3b63d2d3
LP		 127 mode_t mode;
128 usec_t age;
129
468d726b 130 dev_t major_minor;
88ec4dfa
LP		 131 unsigned attribute_value;
132 unsigned attribute_mask;
468d726b 133
3b63d2d3
LP		 134 bool uid_set:1;
135 bool gid_set:1;
136 bool mode_set:1;
137 bool age_set:1;
abef3f91 138 bool mask_perms:1;
88ec4dfa 139 bool attribute_set:1;
24f3a374
LP		 140
141 bool keep_first_level:1;
1910cd0e 142
2e78fa79
LP		 143 bool force:1;
144
1910cd0e 145 bool done:1;
3b63d2d3
LP		 146} Item;
147
3f93da98
ZJS		 148typedef struct ItemArray {
149 Item *items;
150 size_t count;
151 size_t size;
152} ItemArray;
153
3b63d2d3
LP		 154static bool arg_create = false;
155static bool arg_clean = false;
156static bool arg_remove = false;
81815651 157static bool arg_boot = false;
3b63d2d3 158
7bc040fa
LP		 159static char **arg_include_prefixes = NULL;
160static char **arg_exclude_prefixes = NULL;
cf9a4abd 161static char *arg_root = NULL;
fba6e687 162
75eb6154 163static const char conf_file_dirs[] = CONF_PATHS_NULSTR("tmpfiles.d");
9125670f 164
3b63d2d3
LP		 165#define MAX_DEPTH 256
166
ef43a391 167static OrderedHashmap *items = NULL, *globs = NULL;
7bc040fa
LP		 168static Set *unix_sockets = NULL;
169
4cef1923
FB		 170static int specifier_machine_id_safe(char specifier, void *data, void *userdata, char **ret);
171
bd550f78 172static const Specifier specifier_table[] = {
4cef1923 173 { 'm', specifier_machine_id_safe, NULL },
bd550f78
LP		 174 { 'b', specifier_boot_id, NULL },
175 { 'H', specifier_host_name, NULL },
176 { 'v', specifier_kernel_release, NULL },
177 {}
178};
179
4cef1923
FB		 180static int specifier_machine_id_safe(char specifier, void *data, void *userdata, char **ret) {
181 int r;
182
183 /* If /etc/machine_id is missing (e.g. in a chroot environment), returns
184 * a recognizable error so that the caller can skip the rule
185 * gracefully. */
186
187 r = specifier_machine_id(specifier, data, userdata, ret);
188 if (r == -ENOENT)
189 return -ENOKEY;
190
191 return r;
192}
193
194static int log_unresolvable_specifier(const char *filename, unsigned line) {
195 static bool notified = false;
196
197 /* This is called when /etc is not fully initialized (e.g. in a chroot
198 * environment) where some specifiers are unresolvable. These cases are
199 * not considered as an error so log at LOG_NOTICE only for the first
200 * time and then downgrade this to LOG_DEBUG for the rest. */
201
202 log_full(notified ? LOG_DEBUG : LOG_NOTICE,
203 "[%s:%u] Failed to resolve specifier: uninitialized /etc detected, skipping",
204 filename, line);
205
206 if (!notified)
207 log_notice("All rules containing unresolvable specifiers will be skipped.");
208
209 notified = true;
210 return 0;
211}
212
66ccd038 213static bool needs_glob(ItemType t) {
cde684a2
LP		 214 return IN_SET(t,
215 WRITE_FILE,
216 IGNORE_PATH,
217 IGNORE_DIRECTORY_PATH,
218 REMOVE_PATH,
219 RECURSIVE_REMOVE_PATH,
df8dee85 220 EMPTY_DIRECTORY,
e73a03e0 221 ADJUST_MODE,
cde684a2 222 RELABEL_PATH,
b705ab6a
ZJS		 223 RECURSIVE_RELABEL_PATH,
224 SET_XATTR,
225 RECURSIVE_SET_XATTR,
226 SET_ACL,
34f64536
LP		 227 RECURSIVE_SET_ACL,
228 SET_ATTRIBUTE,
229 RECURSIVE_SET_ATTRIBUTE);
b8bb3e8f
LP		 230}
231
3f93da98
ZJS		 232static bool takes_ownership(ItemType t) {
233 return IN_SET(t,
234 CREATE_FILE,
235 TRUNCATE_FILE,
236 CREATE_DIRECTORY,
df8dee85 237 EMPTY_DIRECTORY,
3f93da98
ZJS		 238 TRUNCATE_DIRECTORY,
239 CREATE_SUBVOLUME,
5fb13eb5
LP		 240 CREATE_SUBVOLUME_INHERIT_QUOTA,
241 CREATE_SUBVOLUME_NEW_QUOTA,
3f93da98
ZJS		 242 CREATE_FIFO,
243 CREATE_SYMLINK,
244 CREATE_CHAR_DEVICE,
245 CREATE_BLOCK_DEVICE,
246 COPY_FILES,
3f93da98
ZJS		 247 WRITE_FILE,
248 IGNORE_PATH,
249 IGNORE_DIRECTORY_PATH,
250 REMOVE_PATH,
251 RECURSIVE_REMOVE_PATH);
252}
253
ef43a391 254static struct Item* find_glob(OrderedHashmap *h, const char *match) {
3f93da98 255 ItemArray *j;
b8bb3e8f
LP		 256 Iterator i;
257
ef43a391 258 ORDERED_HASHMAP_FOREACH(j, h, i) {
3f93da98
ZJS		 259 unsigned n;
260
261 for (n = 0; n < j->count; n++) {
262 Item *item = j->items + n;
263
264 if (fnmatch(item->path, match, FNM_PATHNAME|FNM_PERIOD) == 0)
265 return item;
266 }
267 }
b8bb3e8f
LP		 268
269 return NULL;
270}
271
17b90525 272static void load_unix_sockets(void) {
7fd1b19b 273 _cleanup_fclose_ FILE *f = NULL;
17b90525
LP		 274 char line[LINE_MAX];
275
276 if (unix_sockets)
277 return;
278
279 /* We maintain a cache of the sockets we found in
280 * /proc/net/unix to speed things up a little. */
281
d5099efc 282 unix_sockets = set_new(&string_hash_ops);
fdcad0c2 283 if (!unix_sockets)
17b90525
LP		 284 return;
285
fdcad0c2
LP		 286 f = fopen("/proc/net/unix", "re");
287 if (!f)
17b90525
LP		 288 return;
289
fdcad0c2
LP		 290 /* Skip header */
291 if (!fgets(line, sizeof(line), f))
17b90525
LP		 292 goto fail;
293
294 for (;;) {
295 char *p, *s;
296 int k;
297
fdcad0c2 298 if (!fgets(line, sizeof(line), f))
17b90525
LP		 299 break;
300
301 truncate_nl(line);
302
fdcad0c2
LP		 303 p = strchr(line, ':');
304 if (!p)
305 continue;
306
307 if (strlen(p) < 37)
17b90525
LP		 308 continue;
309
fdcad0c2 310 p += 37;
17b90525 311 p += strspn(p, WHITESPACE);
fdcad0c2 312 p += strcspn(p, WHITESPACE); /* skip one more word */
17b90525
LP		 313 p += strspn(p, WHITESPACE);
314
315 if (*p != '/')
316 continue;
317
fdcad0c2
LP		 318 s = strdup(p);
319 if (!s)
17b90525
LP		 320 goto fail;
321
4ff21d85
LP		 322 path_kill_slashes(s);
323
ef42202a
ZJS		 324 k = set_consume(unix_sockets, s);
325 if (k < 0 && k != -EEXIST)
326 goto fail;
17b90525
LP		 327 }
328
329 return;
330
331fail:
332 set_free_free(unix_sockets);
333 unix_sockets = NULL;
17b90525
LP		 334}
335
336static bool unix_socket_alive(const char *fn) {
337 assert(fn);
338
339 load_unix_sockets();
340
341 if (unix_sockets)
342 return !!set_get(unix_sockets, (char*) fn);
343
344 /* We don't know, so assume yes */
345 return true;
346}
347
99d680ac 348static int dir_is_mount_point(DIR *d, const char *subdir) {
cde684a2 349
99d680ac
KS		 350 int mount_id_parent, mount_id;
351 int r_p, r;
352
cbfb8679 353 r_p = name_to_handle_at_loop(dirfd(d), ".", NULL, &mount_id_parent, 0);
99d680ac
KS		 354 if (r_p < 0)
355 r_p = -errno;
356
cbfb8679 357 r = name_to_handle_at_loop(dirfd(d), subdir, NULL, &mount_id, 0);
99d680ac
KS		 358 if (r < 0)
359 r = -errno;
360
361 /* got no handle; make no assumptions, return error */
362 if (r_p < 0 && r < 0)
363 return r_p;
364
365 /* got both handles; if they differ, it is a mount point */
366 if (r_p >= 0 && r >= 0)
367 return mount_id_parent != mount_id;
368
369 /* got only one handle; assume different mount points if one
370 * of both queries was not supported by the filesystem */
4c701096 371 if (IN_SET(r_p, -ENOSYS, -EOPNOTSUPP) || IN_SET(r, -ENOSYS, -EOPNOTSUPP))
99d680ac
KS		 372 return true;
373
374 /* return error */
375 if (r_p < 0)
376 return r_p;
377 return r;
378}
379
df99a9ef
ZJS		 380static DIR* xopendirat_nomod(int dirfd, const char *path) {
381 DIR *dir;
382
383 dir = xopendirat(dirfd, path, O_NOFOLLOW|O_NOATIME);
1532227a
LP		 384 if (dir)
385 return dir;
386
387 log_debug_errno(errno, "Cannot open %sdirectory \"%s\": %m", dirfd == AT_FDCWD ? "" : "sub", path);
388 if (errno != EPERM)
389 return NULL;
390
391 dir = xopendirat(dirfd, path, O_NOFOLLOW);
392 if (!dir)
393 log_debug_errno(errno, "Cannot open %sdirectory \"%s\": %m", dirfd == AT_FDCWD ? "" : "sub", path);
df99a9ef
ZJS		 394
395 return dir;
396}
397
398static DIR* opendir_nomod(const char *path) {
399 return xopendirat_nomod(AT_FDCWD, path);
400}
401
3b63d2d3 402static int dir_cleanup(
78a92a5a 403 Item *i,
3b63d2d3
LP		 404 const char *p,
405 DIR *d,
406 const struct stat *ds,
407 usec_t cutoff,
408 dev_t rootdev,
409 bool mountpoint,
24f3a374 410 int maxdepth,
265ffa1e
LP		 411 bool keep_this_level) {
412
3b63d2d3
LP		 413 struct dirent *dent;
414 struct timespec times[2];
415 bool deleted = false;
3b63d2d3
LP		 416 int r = 0;
417
8fb3f009 418 FOREACH_DIRENT_ALL(dent, d, break) {
3b63d2d3
LP		 419 struct stat s;
420 usec_t age;
7fd1b19b 421 _cleanup_free_ char *sub_path = NULL;
3b63d2d3 422
49bfc877 423 if (dot_or_dot_dot(dent->d_name))
3b63d2d3 424 continue;
5008d581 425
3b63d2d3 426 if (fstatat(dirfd(d), dent->d_name, &s, AT_SYMLINK_NOFOLLOW) < 0) {
ca2f4176
KS		 427 if (errno == ENOENT)
428 continue;
5008d581 429
ca2f4176
KS		 430 /* FUSE, NFS mounts, SELinux might return EACCES */
431 if (errno == EACCES)
56f64d95 432 log_debug_errno(errno, "stat(%s/%s) failed: %m", p, dent->d_name);
ca2f4176 433 else
56f64d95 434 log_error_errno(errno, "stat(%s/%s) failed: %m", p, dent->d_name);
ca2f4176 435 r = -errno;
3b63d2d3
LP		 436 continue;
437 }
438
439 /* Stay on the same filesystem */
582deb84
ZJS		 440 if (s.st_dev != rootdev) {
441 log_debug("Ignoring \"%s/%s\": different filesystem.", p, dent->d_name);
3b63d2d3 442 continue;
582deb84 443 }
3b63d2d3 444
99d680ac
KS		 445 /* Try to detect bind mounts of the same filesystem instance; they
446 * do not differ in device major/minors. This type of query is not
447 * supported on all kernels or filesystem types though. */
582deb84
ZJS		 448 if (S_ISDIR(s.st_mode) && dir_is_mount_point(d, dent->d_name) > 0) {
449 log_debug("Ignoring \"%s/%s\": different mount of the same filesystem.",
450 p, dent->d_name);
99d680ac 451 continue;
582deb84 452 }
99d680ac 453
3b63d2d3 454 /* Do not delete read-only files owned by root */
582deb84
ZJS		 455 if (s.st_uid == 0 && !(s.st_mode & S_IWUSR)) {
456 log_debug("Ignoring \"%s/%s\": read-only and owner by root.", p, dent->d_name);
3b63d2d3 457 continue;
582deb84 458 }
3b63d2d3 459
605405c6 460 sub_path = strjoin(p, "/", dent->d_name);
cde684a2 461 if (!sub_path) {
0d0f0c50 462 r = log_oom();
3b63d2d3
LP		 463 goto finish;
464 }
465
466 /* Is there an item configured for this path? */
ef43a391 467 if (ordered_hashmap_get(items, sub_path)) {
582deb84 468 log_debug("Ignoring \"%s\": a separate entry exists.", sub_path);
3b63d2d3 469 continue;
582deb84 470 }
3b63d2d3 471
582deb84
ZJS		 472 if (find_glob(globs, sub_path)) {
473 log_debug("Ignoring \"%s\": a separate glob exists.", sub_path);
b8bb3e8f 474 continue;
582deb84 475 }
b8bb3e8f 476
3b63d2d3
LP		 477 if (S_ISDIR(s.st_mode)) {
478
479 if (mountpoint &&
480 streq(dent->d_name, "lost+found") &&
582deb84
ZJS		 481 s.st_uid == 0) {
482 log_debug("Ignoring \"%s\".", sub_path);
3b63d2d3 483 continue;
582deb84 484 }
3b63d2d3
LP		 485
486 if (maxdepth <= 0)
582deb84 487 log_warning("Reached max depth on \"%s\".", sub_path);
3b63d2d3 488 else {
7fd1b19b 489 _cleanup_closedir_ DIR *sub_dir;
3b63d2d3
LP		 490 int q;
491
df99a9ef 492 sub_dir = xopendirat_nomod(dirfd(d), dent->d_name);
cde684a2 493 if (!sub_dir) {
582deb84
ZJS		 494 if (errno != ENOENT)
495 r = log_error_errno(errno, "opendir(%s) failed: %m", sub_path);
3b63d2d3
LP		 496
497 continue;
498 }
499
78a92a5a 500 q = dir_cleanup(i, sub_path, sub_dir, &s, cutoff, rootdev, false, maxdepth-1, false);
3b63d2d3
LP		 501 if (q < 0)
502 r = q;
503 }
504
24f3a374
LP		 505 /* Note: if you are wondering why we don't
506 * support the sticky bit for excluding
507 * directories from cleaning like we do it for
508 * other file system objects: well, the sticky
509 * bit already has a meaning for directories,
510 * so we don't want to overload that. */
511
582deb84
ZJS		 512 if (keep_this_level) {
513 log_debug("Keeping \"%s\".", sub_path);
24f3a374 514 continue;
582deb84 515 }
24f3a374 516
3b63d2d3 517 /* Ignore ctime, we change it when deleting */
582deb84
ZJS		 518 age = timespec_load(&s.st_mtim);
519 if (age >= cutoff) {
520 char a[FORMAT_TIMESTAMP_MAX];
521 /* Follows spelling in stat(1). */
522 log_debug("Directory \"%s\": modify time %s is too new.",
523 sub_path,
524 format_timestamp_us(a, sizeof(a), age));
3b63d2d3 525 continue;
582deb84
ZJS		 526 }
527
528 age = timespec_load(&s.st_atim);
529 if (age >= cutoff) {
530 char a[FORMAT_TIMESTAMP_MAX];
531 log_debug("Directory \"%s\": access time %s is too new.",
532 sub_path,
533 format_timestamp_us(a, sizeof(a), age));
534 continue;
535 }
3b63d2d3 536
61253220
ZJS		 537 log_debug("Removing directory \"%s\".", sub_path);
538 if (unlinkat(dirfd(d), dent->d_name, AT_REMOVEDIR) < 0)
4c701096 539 if (!IN_SET(errno, ENOENT, ENOTEMPTY)) {
61253220
ZJS		 540 log_error_errno(errno, "rmdir(%s): %m", sub_path);
541 r = -errno;
3b63d2d3 542 }
3b63d2d3
LP		 543
544 } else {
9c73736d
LP		 545 /* Skip files for which the sticky bit is
546 * set. These are semantics we define, and are
547 * unknown elsewhere. See XDG_RUNTIME_DIR
548 * specification for details. */
582deb84
ZJS		 549 if (s.st_mode & S_ISVTX) {
550 log_debug("Skipping \"%s\": sticky bit set.", sub_path);
9c73736d 551 continue;
582deb84 552 }
9c73736d 553
582deb84 554 if (mountpoint && S_ISREG(s.st_mode))
1542c01b
ZJS		 555 if (s.st_uid == 0 && STR_IN_SET(dent->d_name,
556 ".journal",
557 "aquota.user",
558 "aquota.group")) {
582deb84 559 log_debug("Skipping \"%s\".", sub_path);
3b63d2d3 560 continue;
582deb84 561 }
3b63d2d3 562
17b90525 563 /* Ignore sockets that are listed in /proc/net/unix */
582deb84
ZJS		 564 if (S_ISSOCK(s.st_mode) && unix_socket_alive(sub_path)) {
565 log_debug("Skipping \"%s\": live socket.", sub_path);
17b90525 566 continue;
582deb84 567 }
17b90525 568
78ab08eb 569 /* Ignore device nodes */
582deb84
ZJS		 570 if (S_ISCHR(s.st_mode) || S_ISBLK(s.st_mode)) {
571 log_debug("Skipping \"%s\": a device.", sub_path);
78ab08eb 572 continue;
582deb84 573 }
78ab08eb 574
24f3a374
LP		 575 /* Keep files on this level around if this is
576 * requested */
582deb84
ZJS		 577 if (keep_this_level) {
578 log_debug("Keeping \"%s\".", sub_path);
24f3a374 579 continue;
582deb84 580 }
24f3a374 581
582deb84
ZJS		 582 age = timespec_load(&s.st_mtim);
583 if (age >= cutoff) {
584 char a[FORMAT_TIMESTAMP_MAX];
585 /* Follows spelling in stat(1). */
586 log_debug("File \"%s\": modify time %s is too new.",
587 sub_path,
588 format_timestamp_us(a, sizeof(a), age));
3b63d2d3 589 continue;
582deb84 590 }
3b63d2d3 591
582deb84
ZJS		 592 age = timespec_load(&s.st_atim);
593 if (age >= cutoff) {
594 char a[FORMAT_TIMESTAMP_MAX];
595 log_debug("File \"%s\": access time %s is too new.",
596 sub_path,
597 format_timestamp_us(a, sizeof(a), age));
598 continue;
599 }
3b63d2d3 600
582deb84
ZJS		 601 age = timespec_load(&s.st_ctim);
602 if (age >= cutoff) {
603 char a[FORMAT_TIMESTAMP_MAX];
604 log_debug("File \"%s\": change time %s is too new.",
605 sub_path,
606 format_timestamp_us(a, sizeof(a), age));
607 continue;
3b63d2d3
LP		 608 }
609
582deb84
ZJS		 610 log_debug("unlink \"%s\"", sub_path);
611
612 if (unlinkat(dirfd(d), dent->d_name, 0) < 0)
613 if (errno != ENOENT)
614 r = log_error_errno(errno, "unlink(%s): %m", sub_path);
615
3b63d2d3
LP		 616 deleted = true;
617 }
618 }
619
620finish:
621 if (deleted) {
582deb84
ZJS		 622 usec_t age1, age2;
623 char a[FORMAT_TIMESTAMP_MAX], b[FORMAT_TIMESTAMP_MAX];
624
3b63d2d3
LP		 625 /* Restore original directory timestamps */
626 times[0] = ds->st_atim;
627 times[1] = ds->st_mtim;
628
582deb84
ZJS		 629 age1 = timespec_load(&ds->st_atim);
630 age2 = timespec_load(&ds->st_mtim);
631 log_debug("Restoring access and modification time on \"%s\": %s, %s",
632 p,
633 format_timestamp_us(a, sizeof(a), age1),
634 format_timestamp_us(b, sizeof(b), age2));
3b63d2d3 635 if (futimens(dirfd(d), times) < 0)
56f64d95 636 log_error_errno(errno, "utimensat(%s): %m", p);
3b63d2d3
LP		 637 }
638
3b63d2d3
LP		 639 return r;
640}
641
b705ab6a 642static int path_set_perms(Item *i, const char *path) {
48b8aaa8 643 _cleanup_close_ int fd = -1;
1924a97d 644 struct stat st;
1924a97d 645
cde684a2
LP		 646 assert(i);
647 assert(path);
648
48b8aaa8
LP		 649 /* We open the file with O_PATH here, to make the operation
650 * somewhat atomic. Also there's unfortunately no fchmodat()
651 * with AT_SYMLINK_NOFOLLOW, hence we emulate it here via
652 * O_PATH. */
653
c4b69156 654 fd = open(path, O_NOFOLLOW|O_CLOEXEC|O_PATH);
780e2ee1
MS		 655 if (fd < 0) {
656 int level = LOG_ERR, r = -errno;
657
658 /* Option "e" operates only on existing objects. Do not
659 * print errors about non-existent files or directories */
660 if (i->type == EMPTY_DIRECTORY && errno == ENOENT) {
661 level = LOG_DEBUG;
662 r = 0;
663 }
664
665 log_full_errno(level, errno, "Adjusting owner and mode for %s failed: %m", path);
666
667 return r;
668 }
48b8aaa8
LP		 669
670 if (fstatat(fd, "", &st, AT_EMPTY_PATH) < 0)
671 return log_error_errno(errno, "Failed to fstat() file %s: %m", path);
1924a97d 672
48b8aaa8
LP		 673 if (S_ISLNK(st.st_mode))
674 log_debug("Skipping mode an owner fix for symlink %s.", path);
675 else {
676 char fn[strlen("/proc/self/fd/") + DECIMAL_STR_MAX(int)];
677 xsprintf(fn, "/proc/self/fd/%i", fd);
abef3f91 678
48b8aaa8
LP		 679 /* not using i->path directly because it may be a glob */
680 if (i->mode_set) {
681 mode_t m = i->mode;
682
683 if (i->mask_perms) {
684 if (!(st.st_mode & 0111))
685 m &= ~0111;
686 if (!(st.st_mode & 0222))
7d6884b6 687 m &= ~0222;
48b8aaa8
LP		 688 if (!(st.st_mode & 0444))
689 m &= ~0444;
690 if (!S_ISDIR(st.st_mode))
691 m &= ~07000; /* remove sticky/sgid/suid bit, unless directory */
692 }
abef3f91 693
48b8aaa8
LP		 694 if (m == (st.st_mode & 07777))
695 log_debug("\"%s\" has right mode %o", path, st.st_mode);
696 else {
697 log_debug("chmod \"%s\" to mode %o", path, m);
698 if (chmod(fn, m) < 0)
e0bc1d70 699 return log_error_errno(errno, "chmod() of %s via %s failed: %m", path, fn);
48b8aaa8 700 }
062e01bb 701 }
062e01bb 702
48b8aaa8
LP		 703 if ((i->uid != st.st_uid || i->gid != st.st_gid) &&
704 (i->uid_set || i->gid_set)) {
705 log_debug("chown \"%s\" to "UID_FMT"."GID_FMT,
706 path,
707 i->uid_set ? i->uid : UID_INVALID,
708 i->gid_set ? i->gid : GID_INVALID);
709 if (chown(fn,
710 i->uid_set ? i->uid : UID_INVALID,
711 i->gid_set ? i->gid : GID_INVALID) < 0)
e0bc1d70 712 return log_error_errno(errno, "chown() of %s via %s failed: %m", path, fn);
48b8aaa8 713 }
582deb84 714 }
062e01bb 715
48b8aaa8
LP		 716 fd = safe_close(fd);
717
9855d6c7 718 return label_fix(path, false, false);
062e01bb
MS		 719}
720
bd550f78 721static int parse_xattrs_from_arg(Item *i) {
ebf4e801
MW		 722 const char *p;
723 int r;
724
725 assert(i);
505ef0e3 726 assert(i->argument);
ebf4e801 727
ebf4e801
MW		 728 p = i->argument;
729
4034a06d 730 for (;;) {
4cef1923 731 _cleanup_free_ char *name = NULL, *value = NULL, *xattr = NULL;
4034a06d 732
12ba2c44 733 r = extract_first_word(&p, &xattr, NULL, EXTRACT_QUOTES|EXTRACT_CUNESCAPE);
4034a06d 734 if (r < 0)
bd550f78 735 log_warning_errno(r, "Failed to parse extended attribute '%s', ignoring: %m", p);
4034a06d
LP		 736 if (r <= 0)
737 break;
505ef0e3 738
4cef1923 739 r = split_pair(xattr, "=", &name, &value);
ebf4e801 740 if (r < 0) {
4034a06d 741 log_warning_errno(r, "Failed to parse extended attribute, ignoring: %s", xattr);
ebf4e801
MW		 742 continue;
743 }
505ef0e3 744
4034a06d 745 if (isempty(name) || isempty(value)) {
bd550f78 746 log_warning("Malformed extended attribute found, ignoring: %s", xattr);
ebf4e801
MW		 747 continue;
748 }
505ef0e3 749
4034a06d 750 if (strv_push_pair(&i->xattrs, name, value) < 0)
ebf4e801 751 return log_oom();
505ef0e3 752
4034a06d 753 name = value = NULL;
ebf4e801
MW		 754 }
755
4034a06d 756 return 0;
ebf4e801
MW		 757}
758
b705ab6a 759static int path_set_xattrs(Item *i, const char *path) {
ebf4e801
MW		 760 char **name, **value;
761
762 assert(i);
763 assert(path);
764
ebf4e801
MW		 765 STRV_FOREACH_PAIR(name, value, i->xattrs) {
766 int n;
505ef0e3 767
ebf4e801 768 n = strlen(*value);
bd550f78 769 log_debug("Setting extended attribute '%s=%s' on %s.", *name, *value, path);
25f027c5
ZJS		 770 if (lsetxattr(path, *name, *value, n, 0) < 0)
771 return log_error_errno(errno, "Setting extended attribute %s=%s on %s failed: %m",
772 *name, *value, path);
ebf4e801
MW		 773 }
774 return 0;
775}
776
bd550f78 777static int parse_acls_from_arg(Item *item) {
349cc4a5 778#if HAVE_ACL
f8eeeaf9 779 int r;
f8eeeaf9
ZJS		 780
781 assert(item);
782
50d9e46d
ZJS		 783 /* If force (= modify) is set, we will not modify the acl
784 * afterwards, so the mask can be added now if necessary. */
bd550f78 785
50d9e46d 786 r = parse_acl(item->argument, &item->acl_access, &item->acl_default, !item->force);
f8eeeaf9 787 if (r < 0)
4034a06d 788 log_warning_errno(r, "Failed to parse ACL \"%s\": %m. Ignoring", item->argument);
f8eeeaf9
ZJS		 789#else
790 log_warning_errno(ENOSYS, "ACLs are not supported. Ignoring");
791#endif
792
793 return 0;
794}
795
349cc4a5 796#if HAVE_ACL
48b8aaa8
LP		 797static int path_set_acl(const char *path, const char *pretty, acl_type_t type, acl_t acl, bool modify) {
798 _cleanup_(acl_free_charpp) char *t = NULL;
dd4105b0 799 _cleanup_(acl_freep) acl_t dup = NULL;
50d9e46d
ZJS		 800 int r;
801
d873e877
HPD		 802 /* Returns 0 for success, positive error if already warned,
803 * negative error otherwise. */
804
50d9e46d 805 if (modify) {
dd4105b0 806 r = acls_for_file(path, type, acl, &dup);
50d9e46d
ZJS		 807 if (r < 0)
808 return r;
50d9e46d 809
dd4105b0
ZJS		 810 r = calc_acl_mask_if_needed(&dup);
811 if (r < 0)
812 return r;
813 } else {
814 dup = acl_dup(acl);
815 if (!dup)
816 return -errno;
817
818 /* the mask was already added earlier if needed */
819 }
820
821 r = add_base_acls_if_needed(&dup, path);
822 if (r < 0)
823 return r;
824
582deb84 825 t = acl_to_any_text(dup, NULL, ',', TEXT_ABBREVIATE);
48b8aaa8 826 log_debug("Setting %s ACL %s on %s.",
582deb84 827 type == ACL_TYPE_ACCESS ? "access" : "default",
48b8aaa8 828 strna(t), pretty);
50d9e46d 829
582deb84
ZJS		 830 r = acl_set_file(path, type, dup);
831 if (r < 0)
3ea40b78
LP		 832 /* Return positive to indicate we already warned */
833 return -log_error_errno(errno,
834 "Setting %s ACL \"%s\" on %s failed: %m",
835 type == ACL_TYPE_ACCESS ? "access" : "default",
48b8aaa8 836 strna(t), pretty);
d873e877 837
582deb84 838 return 0;
50d9e46d 839}
35888b67 840#endif
50d9e46d 841
b705ab6a 842static int path_set_acls(Item *item, const char *path) {
d873e877 843 int r = 0;
349cc4a5 844#if HAVE_ACL
48b8aaa8
LP		 845 char fn[strlen("/proc/self/fd/") + DECIMAL_STR_MAX(int)];
846 _cleanup_close_ int fd = -1;
847 struct stat st;
848
f8eeeaf9
ZJS		 849 assert(item);
850 assert(path);
851
c4b69156 852 fd = open(path, O_NOFOLLOW|O_CLOEXEC|O_PATH);
48b8aaa8
LP		 853 if (fd < 0)
854 return log_error_errno(errno, "Adjusting ACL of %s failed: %m", path);
855
856 if (fstatat(fd, "", &st, AT_EMPTY_PATH) < 0)
857 return log_error_errno(errno, "Failed to fstat() file %s: %m", path);
858
859 if (S_ISLNK(st.st_mode)) {
860 log_debug("Skipping ACL fix for symlink %s.", path);
861 return 0;
862 }
863
864 xsprintf(fn, "/proc/self/fd/%i", fd);
865
d873e877 866 if (item->acl_access)
48b8aaa8 867 r = path_set_acl(fn, path, ACL_TYPE_ACCESS, item->acl_access, item->force);
f8eeeaf9 868
d873e877 869 if (r == 0 && item->acl_default)
48b8aaa8 870 r = path_set_acl(fn, path, ACL_TYPE_DEFAULT, item->acl_default, item->force);
f8eeeaf9 871
d873e877
HPD		 872 if (r > 0)
873 return -r; /* already warned */
15411c0c 874 else if (r == -EOPNOTSUPP) {
d873e877
HPD		 875 log_debug_errno(r, "ACLs not supported by file system at %s", path);
876 return 0;
877 } else if (r < 0)
878 log_error_errno(r, "ACL operation on \"%s\" failed: %m", path);
879#endif
880 return r;
f8eeeaf9
ZJS		 881}
882
88ec4dfa
LP		 883#define ATTRIBUTES_ALL \
884 (FS_NOATIME_FL | \
885 FS_SYNC_FL | \
886 FS_DIRSYNC_FL | \
887 FS_APPEND_FL | \
888 FS_COMPR_FL | \
889 FS_NODUMP_FL | \
890 FS_EXTENT_FL | \
891 FS_IMMUTABLE_FL | \
892 FS_JOURNAL_DATA_FL | \
893 FS_SECRM_FL | \
894 FS_UNRM_FL | \
895 FS_NOTAIL_FL | \
896 FS_TOPDIR_FL | \
897 FS_NOCOW_FL)
898
bd550f78 899static int parse_attribute_from_arg(Item *item) {
88ec4dfa
LP		 900
901 static const struct {
902 char character;
903 unsigned value;
904 } attributes[] = {
905 { 'A', FS_NOATIME_FL }, /* do not update atime */
906 { 'S', FS_SYNC_FL }, /* Synchronous updates */
907 { 'D', FS_DIRSYNC_FL }, /* dirsync behaviour (directories only) */
908 { 'a', FS_APPEND_FL }, /* writes to file may only append */
909 { 'c', FS_COMPR_FL }, /* Compress file */
910 { 'd', FS_NODUMP_FL }, /* do not dump file */
8c35b2ca 911 { 'e', FS_EXTENT_FL }, /* Extents */
88ec4dfa
LP		 912 { 'i', FS_IMMUTABLE_FL }, /* Immutable file */
913 { 'j', FS_JOURNAL_DATA_FL }, /* Reserved for ext3 */
914 { 's', FS_SECRM_FL }, /* Secure deletion */
915 { 'u', FS_UNRM_FL }, /* Undelete */
916 { 't', FS_NOTAIL_FL }, /* file tail should not be merged */
13e785f7 917 { 'T', FS_TOPDIR_FL }, /* Top of directory hierarchies */
88ec4dfa 918 { 'C', FS_NOCOW_FL }, /* Do not cow file */
22c3a6ca 919 };
88ec4dfa 920
22c3a6ca
GB		 921 enum {
922 MODE_ADD,
923 MODE_DEL,
924 MODE_SET
925 } mode = MODE_ADD;
22c3a6ca 926
88ec4dfa
LP		 927 unsigned value = 0, mask = 0;
928 const char *p;
22c3a6ca 929
88ec4dfa
LP		 930 assert(item);
931
932 p = item->argument;
933 if (p) {
934 if (*p == '+') {
935 mode = MODE_ADD;
936 p++;
937 } else if (*p == '-') {
938 mode = MODE_DEL;
939 p++;
940 } else if (*p == '=') {
941 mode = MODE_SET;
942 p++;
943 }
22c3a6ca
GB		 944 }
945
88ec4dfa
LP		 946 if (isempty(p) && mode != MODE_SET) {
947 log_error("Setting file attribute on '%s' needs an attribute specification.", item->path);
22c3a6ca
GB		 948 return -EINVAL;
949 }
88ec4dfa
LP		 950
951 for (; p && *p ; p++) {
952 unsigned i, v;
953
954 for (i = 0; i < ELEMENTSOF(attributes); i++)
955 if (*p == attributes[i].character)
956 break;
957
958 if (i >= ELEMENTSOF(attributes)) {
959 log_error("Unknown file attribute '%c' on '%s'.", *p, item->path);
22c3a6ca
GB		 960 return -EINVAL;
961 }
88ec4dfa
LP		 962
963 v = attributes[i].value;
964
3742095b 965 SET_FLAG(value, v, IN_SET(mode, MODE_ADD, MODE_SET));
88ec4dfa
LP		 966
967 mask |= v;
22c3a6ca
GB		 968 }
969
970 if (mode == MODE_SET)
88ec4dfa 971 mask |= ATTRIBUTES_ALL;
22c3a6ca 972
88ec4dfa 973 assert(mask != 0);
22c3a6ca 974
88ec4dfa
LP		 975 item->attribute_mask = mask;
976 item->attribute_value = value;
977 item->attribute_set = true;
22c3a6ca
GB		 978
979 return 0;
22c3a6ca
GB		 980}
981
88ec4dfa 982static int path_set_attribute(Item *item, const char *path) {
22c3a6ca 983 _cleanup_close_ int fd = -1;
22c3a6ca 984 struct stat st;
88ec4dfa
LP		 985 unsigned f;
986 int r;
22c3a6ca 987
88ec4dfa 988 if (!item->attribute_set || item->attribute_mask == 0)
22c3a6ca 989 return 0;
22c3a6ca 990
48b8aaa8
LP		 991 fd = open(path, O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_NOATIME|O_NOFOLLOW);
992 if (fd < 0) {
993 if (errno == ELOOP)
994 return log_error_errno(errno, "Skipping file attributes adjustment on symlink %s.", path);
995
88ec4dfa 996 return log_error_errno(errno, "Cannot open '%s': %m", path);
48b8aaa8 997 }
22c3a6ca 998
88ec4dfa
LP		 999 if (fstat(fd, &st) < 0)
1000 return log_error_errno(errno, "Cannot stat '%s': %m", path);
1001
1002 /* Issuing the file attribute ioctls on device nodes is not
1003 * safe, as that will be delivered to the drivers, not the
1004 * file system containing the device node. */
1005 if (!S_ISREG(st.st_mode) && !S_ISDIR(st.st_mode)) {
1006 log_error("Setting file flags is only supported on regular files and directories, cannot set on '%s'.", path);
1007 return -EINVAL;
1008 }
1009
1010 f = item->attribute_value & item->attribute_mask;
1011
1012 /* Mask away directory-specific flags */
22c3a6ca
GB		 1013 if (!S_ISDIR(st.st_mode))
1014 f &= ~FS_DIRSYNC_FL;
88ec4dfa
LP		 1015
1016 r = chattr_fd(fd, f, item->attribute_mask);
22c3a6ca 1017 if (r < 0)
4c701096 1018 log_full_errno(IN_SET(r, -ENOTTY, -EOPNOTSUPP) ? LOG_DEBUG : LOG_WARNING,
ad75a97f
LP		 1019 r,
1020 "Cannot set file attribute for '%s', value=0x%08x, mask=0x%08x: %m",
1021 path, item->attribute_value, item->attribute_mask);
22c3a6ca
GB		 1022
1023 return 0;
1024}
1025
d4e9eb91 1026static int write_one_file(Item *i, const char *path) {
43ad6e31
LP		 1027 _cleanup_close_ int fd = -1;
1028 int flags, r = 0;
d4e9eb91 1029 struct stat st;
d4e9eb91 1030
874f1947
LP		 1031 assert(i);
1032 assert(path);
1033
43ad6e31
LP		 1034 flags = i->type == CREATE_FILE ? O_CREAT|O_APPEND|O_NOFOLLOW :
1035 i->type == TRUNCATE_FILE ? O_CREAT|O_TRUNC|O_NOFOLLOW : 0;
d4e9eb91 1036
43ad6e31 1037 RUN_WITH_UMASK(0000) {
ecabcf8b 1038 mac_selinux_create_file_prepare(path, S_IFREG);
43ad6e31 1039 fd = open(path, flags|O_NDELAY|O_CLOEXEC|O_WRONLY|O_NOCTTY, i->mode);
ecabcf8b 1040 mac_selinux_create_file_clear();
5c0d398d 1041 }
d4e9eb91
DR		 1042
1043 if (fd < 0) {
582deb84
ZJS		 1044 if (i->type == WRITE_FILE && errno == ENOENT) {
1045 log_debug_errno(errno, "Not writing \"%s\": %m", path);
d4e9eb91 1046 return 0;
582deb84 1047 }
d4e9eb91 1048
f44b28fd
MO		 1049 r = -errno;
1050 if (!i->argument && errno == EROFS && stat(path, &st) == 0 &&
1051 (i->type == CREATE_FILE || st.st_size == 0))
1052 goto check_mode;
1053
1054 return log_error_errno(r, "Failed to create file %s: %m", path);
d4e9eb91
DR		 1055 }
1056
1057 if (i->argument) {
4034a06d 1058 log_debug("%s to \"%s\".", i->type == CREATE_FILE ? "Appending" : "Writing", path);
d4e9eb91 1059
4cef1923 1060 r = loop_write(fd, i->argument, strlen(i->argument), false);
582deb84
ZJS		 1061 if (r < 0)
1062 return log_error_errno(r, "Failed to write file \"%s\": %m", path);
1063 } else
1064 log_debug("\"%s\" has been created.", path);
d4e9eb91 1065
43ad6e31 1066 fd = safe_close(fd);
3612fbc1 1067
4a62c710
MS		 1068 if (stat(path, &st) < 0)
1069 return log_error_errno(errno, "stat(%s) failed: %m", path);
d4e9eb91 1070
f44b28fd 1071 check_mode:
d4e9eb91
DR		 1072 if (!S_ISREG(st.st_mode)) {
1073 log_error("%s is not a file.", path);
1074 return -EEXIST;
1075 }
1076
b705ab6a 1077 r = path_set_perms(i, path);
d4e9eb91
DR		 1078 if (r < 0)
1079 return r;
1080
1081 return 0;
1082}
1083
081043cf
ZJS		 1084typedef int (*action_t)(Item *, const char *);
1085
1086static int item_do_children(Item *i, const char *path, action_t action) {
7fd1b19b 1087 _cleanup_closedir_ DIR *d;
8fb3f009 1088 struct dirent *de;
e73a03e0
LP		 1089 int r = 0;
1090
1091 assert(i);
1092 assert(path);
a8d88783
MS		 1093
1094 /* This returns the first error we run into, but nevertheless
1095 * tries to go on */
1096
df99a9ef
ZJS		 1097 d = opendir_nomod(path);
1098 if (!d)
3d22bc86 1099 return IN_SET(errno, ENOENT, ENOTDIR, ELOOP) ? 0 : -errno;
a8d88783 1100
8fb3f009 1101 FOREACH_DIRENT_ALL(de, d, r = -errno) {
e73a03e0 1102 _cleanup_free_ char *p = NULL;
e73a03e0 1103 int q;
a8d88783 1104
49bfc877 1105 if (dot_or_dot_dot(de->d_name))
a8d88783
MS		 1106 continue;
1107
605405c6 1108 p = strjoin(path, "/", de->d_name);
e73a03e0
LP		 1109 if (!p)
1110 return -ENOMEM;
a8d88783 1111
081043cf 1112 q = action(i, p);
e73a03e0
LP		 1113 if (q < 0 && q != -ENOENT && r == 0)
1114 r = q;
a8d88783 1115
e73a03e0 1116 if (IN_SET(de->d_type, DT_UNKNOWN, DT_DIR)) {
081043cf 1117 q = item_do_children(i, p, action);
e73a03e0
LP		 1118 if (q < 0 && r == 0)
1119 r = q;
a8d88783 1120 }
a8d88783
MS		 1121 }
1122
e73a03e0 1123 return r;
a8d88783
MS		 1124}
1125
081043cf 1126static int glob_item(Item *i, action_t action, bool recursive) {
df99a9ef 1127 _cleanup_globfree_ glob_t g = {
ebf31a1f 1128 .gl_opendir = (void *(*)(const char *)) opendir_nomod,
df99a9ef 1129 };
e73a03e0 1130 int r = 0, k;
99e68c0b
MS		 1131 char **fn;
1132
84e72b5e
ZJS		 1133 k = safe_glob(i->path, GLOB_NOSORT|GLOB_BRACE, &g);
1134 if (k < 0 && k != -ENOENT)
1135 return log_error_errno(k, "glob(%s) failed: %m", i->path);
99e68c0b 1136
c84a9488
ZJS		 1137 STRV_FOREACH(fn, g.gl_pathv) {
1138 k = action(i, *fn);
e73a03e0 1139 if (k < 0 && r == 0)
99e68c0b 1140 r = k;
081043cf
ZJS		 1141
1142 if (recursive) {
1143 k = item_do_children(i, *fn, action);
1144 if (k < 0 && r == 0)
1145 r = k;
1146 }
c84a9488 1147 }
99e68c0b 1148
99e68c0b
MS		 1149 return r;
1150}
1151
294929f8
ZJS		 1152typedef enum {
1153 CREATION_NORMAL,
1154 CREATION_EXISTING,
1155 CREATION_FORCE,
7a7d5db7
LP		 1156 _CREATION_MODE_MAX,
1157 _CREATION_MODE_INVALID = -1
294929f8
ZJS		 1158} CreationMode;
1159
7a7d5db7
LP		 1160static const char *creation_mode_verb_table[_CREATION_MODE_MAX] = {
1161 [CREATION_NORMAL] = "Created",
1162 [CREATION_EXISTING] = "Found existing",
1163 [CREATION_FORCE] = "Created replacement",
1164};
1165
1166DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(creation_mode_verb, CreationMode);
294929f8 1167
3b63d2d3 1168static int create_item(Item *i) {
3b63d2d3 1169 struct stat st;
df28bc08 1170 int r = 0;
114a17d2 1171 int q = 0;
294929f8 1172 CreationMode creation;
5008d581 1173
3b63d2d3 1174 assert(i);
5008d581 1175
582deb84
ZJS		 1176 log_debug("Running create action for entry %c %s", (char) i->type, i->path);
1177
3b63d2d3
LP		 1178 switch (i->type) {
1179
1180 case IGNORE_PATH:
78a92a5a 1181 case IGNORE_DIRECTORY_PATH:
3b63d2d3
LP		 1182 case REMOVE_PATH:
1183 case RECURSIVE_REMOVE_PATH:
1184 return 0;
5008d581 1185
3b63d2d3 1186 case CREATE_FILE:
31ed59c5 1187 case TRUNCATE_FILE:
1845fdd9
DR		 1188 r = write_one_file(i, i->path);
1189 if (r < 0)
1190 return r;
1191 break;
265ffa1e 1192
5c5ccf12 1193 case COPY_FILES: {
4cef1923
FB		 1194 log_debug("Copying tree \"%s\" to \"%s\".", i->argument, i->path);
1195 r = copy_tree(i->argument, i->path, i->uid_set ? i->uid : UID_INVALID, i->gid_set ? i->gid : GID_INVALID, COPY_REFLINK);
f44b28fd
MO		 1196
1197 if (r == -EROFS && stat(i->path, &st) == 0)
1198 r = -EEXIST;
1199
849958d1 1200 if (r < 0) {
e156347e
LP		 1201 struct stat a, b;
1202
8d3d7072
MS		 1203 if (r != -EEXIST)
1204 return log_error_errno(r, "Failed to copy files to %s: %m", i->path);
e156347e 1205
4cef1923
FB		 1206 if (stat(i->argument, &a) < 0)
1207 return log_error_errno(errno, "stat(%s) failed: %m", i->argument);
e156347e 1208
4a62c710
MS		 1209 if (stat(i->path, &b) < 0)
1210 return log_error_errno(errno, "stat(%s) failed: %m", i->path);
e156347e
LP		 1211
1212 if ((a.st_mode ^ b.st_mode) & S_IFMT) {
1213 log_debug("Can't copy to %s, file exists already and is of different type", i->path);
1214 return 0;
1215 }
849958d1
LP		 1216 }
1217
b705ab6a 1218 r = path_set_perms(i, i->path);
849958d1
LP		 1219 if (r < 0)
1220 return r;
1221
1222 break;
1223
d4e9eb91 1224 case WRITE_FILE:
081043cf 1225 r = glob_item(i, write_one_file, false);
f05bc3f7
MS		 1226 if (r < 0)
1227 return r;
5008d581 1228
3b63d2d3
LP		 1229 break;
1230
3b63d2d3 1231 case CREATE_DIRECTORY:
d7b8eec7
LP		 1232 case TRUNCATE_DIRECTORY:
1233 case CREATE_SUBVOLUME:
5fb13eb5
LP		 1234 case CREATE_SUBVOLUME_INHERIT_QUOTA:
1235 case CREATE_SUBVOLUME_NEW_QUOTA:
d7b8eec7 1236 RUN_WITH_UMASK(0000)
5c0d398d 1237 mkdir_parents_label(i->path, 0755);
d7b8eec7 1238
5fb13eb5 1239 if (IN_SET(i->type, CREATE_SUBVOLUME, CREATE_SUBVOLUME_INHERIT_QUOTA, CREATE_SUBVOLUME_NEW_QUOTA)) {
2904e949
LP		 1240
1241 if (btrfs_is_subvol(isempty(arg_root) ? "/" : arg_root) <= 0)
1242
1243 /* Don't create a subvolume unless the
1244 * root directory is one, too. We do
1245 * this under the assumption that if
1246 * the root directory is just a plain
1247 * directory (i.e. very light-weight),
1248 * we shouldn't try to split it up
1249 * into subvolumes (i.e. more
1250 * heavy-weight). Thus, chroot()
1251 * environments and suchlike will get
1252 * a full brtfs subvolume set up below
1253 * their tree only if they
1254 * specifically set up a btrfs
1255 * subvolume for the root dir too. */
1256
1257 r = -ENOTTY;
1258 else {
1259 RUN_WITH_UMASK((~i->mode) & 0777)
1260 r = btrfs_subvol_make(i->path);
1261 }
5fb13eb5 1262 } else
d7b8eec7
LP		 1263 r = 0;
1264
582deb84 1265 if (IN_SET(i->type, CREATE_DIRECTORY, TRUNCATE_DIRECTORY) || r == -ENOTTY)
d7b8eec7
LP		 1266 RUN_WITH_UMASK(0000)
1267 r = mkdir_label(i->path, i->mode);
5008d581 1268
e156347e 1269 if (r < 0) {
7b135a73 1270 int k;
5008d581 1271
4c701096 1272 if (!IN_SET(r, -EEXIST, -EROFS))
7b135a73 1273 return log_error_errno(r, "Failed to create directory or subvolume \"%s\": %m", i->path);
5008d581 1274
7b135a73
LP		 1275 k = is_dir(i->path, false);
1276 if (k == -ENOENT && r == -EROFS)
1277 return log_error_errno(r, "%s does not exist and cannot be created as the file system is read-only.", i->path);
1278 if (k < 0)
1279 return log_error_errno(k, "Failed to check if %s exists: %m", i->path);
1280 if (!k) {
1281 log_warning("\"%s\" already exists and is not a directory.", i->path);
e156347e
LP		 1282 return 0;
1283 }
294929f8
ZJS		 1284
1285 creation = CREATION_EXISTING;
1286 } else
1287 creation = CREATION_NORMAL;
7b135a73 1288
7a7d5db7 1289 log_debug("%s directory \"%s\".", creation_mode_verb_to_string(creation), i->path);
5008d581 1290
5fb13eb5
LP		 1291 if (IN_SET(i->type, CREATE_SUBVOLUME_NEW_QUOTA, CREATE_SUBVOLUME_INHERIT_QUOTA)) {
1292 r = btrfs_subvol_auto_qgroup(i->path, 0, i->type == CREATE_SUBVOLUME_NEW_QUOTA);
114a17d2 1293 if (r == -ENOTTY)
022ffe4c 1294 log_debug_errno(r, "Couldn't adjust quota for subvolume \"%s\" (unsupported fs or dir not a subvolume): %m", i->path);
114a17d2 1295 else if (r == -EROFS)
022ffe4c 1296 log_debug_errno(r, "Couldn't adjust quota for subvolume \"%s\" (fs is read-only).", i->path);
114a17d2 1297 else if (r == -ENOPROTOOPT)
022ffe4c 1298 log_debug_errno(r, "Couldn't adjust quota for subvolume \"%s\" (quota support is disabled).", i->path);
114a17d2
EV		 1299 else if (r < 0)
1300 q = log_error_errno(r, "Failed to adjust quota for subvolume \"%s\": %m", i->path);
1301 else if (r > 0)
5fb13eb5 1302 log_debug("Adjusted quota for subvolume \"%s\".", i->path);
114a17d2 1303 else if (r == 0)
5fb13eb5
LP		 1304 log_debug("Quota for subvolume \"%s\" already in place, no change made.", i->path);
1305 }
1306
4831981d 1307 _fallthrough_;
df8dee85 1308 case EMPTY_DIRECTORY:
b705ab6a 1309 r = path_set_perms(i, i->path);
114a17d2
EV		 1310 if (q < 0)
1311 return q;
f05bc3f7
MS		 1312 if (r < 0)
1313 return r;
3b63d2d3
LP		 1314
1315 break;
ee17ee7c
LP		 1316
1317 case CREATE_FIFO:
5c0d398d 1318 RUN_WITH_UMASK(0000) {
ecabcf8b 1319 mac_selinux_create_file_prepare(i->path, S_IFIFO);
5c0d398d 1320 r = mkfifo(i->path, i->mode);
ecabcf8b 1321 mac_selinux_create_file_clear();
5c0d398d 1322 }
ee17ee7c 1323
1554afae 1324 if (r < 0) {
4a62c710
MS		 1325 if (errno != EEXIST)
1326 return log_error_errno(errno, "Failed to create fifo %s: %m", i->path);
ee17ee7c 1327
a542c4dc 1328 if (lstat(i->path, &st) < 0)
4a62c710 1329 return log_error_errno(errno, "stat(%s) failed: %m", i->path);
ee17ee7c 1330
1554afae
LP		 1331 if (!S_ISFIFO(st.st_mode)) {
1332
1333 if (i->force) {
1554afae 1334 RUN_WITH_UMASK(0000) {
ecabcf8b 1335 mac_selinux_create_file_prepare(i->path, S_IFIFO);
1554afae 1336 r = mkfifo_atomic(i->path, i->mode);
ecabcf8b 1337 mac_selinux_create_file_clear();
1554afae
LP		 1338 }
1339
f647962d
MS		 1340 if (r < 0)
1341 return log_error_errno(r, "Failed to create fifo %s: %m", i->path);
294929f8 1342 creation = CREATION_FORCE;
1554afae 1343 } else {
a542c4dc 1344 log_warning("\"%s\" already exists and is not a fifo.", i->path);
1554afae
LP		 1345 return 0;
1346 }
294929f8
ZJS		 1347 } else
1348 creation = CREATION_EXISTING;
1349 } else
1350 creation = CREATION_NORMAL;
7a7d5db7 1351 log_debug("%s fifo \"%s\".", creation_mode_verb_to_string(creation), i->path);
ee17ee7c 1352
b705ab6a 1353 r = path_set_perms(i, i->path);
f05bc3f7
MS		 1354 if (r < 0)
1355 return r;
ee17ee7c
LP		 1356
1357 break;
5c5ccf12 1358 }
a8d88783 1359
5c5ccf12 1360 case CREATE_SYMLINK: {
ecabcf8b 1361 mac_selinux_create_file_prepare(i->path, S_IFLNK);
4cef1923 1362 r = symlink(i->argument, i->path);
ecabcf8b 1363 mac_selinux_create_file_clear();
e9a5ef7c 1364
468d726b 1365 if (r < 0) {
2e78fa79 1366 _cleanup_free_ char *x = NULL;
468d726b 1367
4a62c710 1368 if (errno != EEXIST)
4cef1923 1369 return log_error_errno(errno, "symlink(%s, %s) failed: %m", i->argument, i->path);
2e78fa79
LP		 1370
1371 r = readlink_malloc(i->path, &x);
4cef1923 1372 if (r < 0 || !streq(i->argument, x)) {
2e78fa79
LP		 1373
1374 if (i->force) {
ecabcf8b 1375 mac_selinux_create_file_prepare(i->path, S_IFLNK);
4cef1923 1376 r = symlink_atomic(i->argument, i->path);
ecabcf8b 1377 mac_selinux_create_file_clear();
2e78fa79 1378
b3f5897f
WD		 1379 if (IN_SET(r, -EEXIST, -ENOTEMPTY)) {
1380 r = rm_rf(i->path, REMOVE_ROOT|REMOVE_PHYSICAL);
1381 if (r < 0)
1382 return log_error_errno(r, "rm -fr %s failed: %m", i->path);
1383
1384 mac_selinux_create_file_prepare(i->path, S_IFLNK);
4cef1923 1385 r = symlink(i->argument, i->path) < 0 ? -errno : 0;
b3f5897f
WD		 1386 mac_selinux_create_file_clear();
1387 }
f647962d 1388 if (r < 0)
4cef1923 1389 return log_error_errno(r, "symlink(%s, %s) failed: %m", i->argument, i->path);
a542c4dc 1390
294929f8 1391 creation = CREATION_FORCE;
1554afae 1392 } else {
582deb84 1393 log_debug("\"%s\" is not a symlink or does not point to the correct path.", i->path);
1554afae
LP		 1394 return 0;
1395 }
294929f8
ZJS		 1396 } else
1397 creation = CREATION_EXISTING;
1398 } else
a542c4dc 1399
294929f8 1400 creation = CREATION_NORMAL;
7a7d5db7 1401 log_debug("%s symlink \"%s\".", creation_mode_verb_to_string(creation), i->path);
468d726b 1402 break;
5c5ccf12 1403 }
468d726b
LP		 1404
1405 case CREATE_BLOCK_DEVICE:
1406 case CREATE_CHAR_DEVICE: {
cb7ed9df
LP		 1407 mode_t file_type;
1408
1409 if (have_effective_cap(CAP_MKNOD) == 0) {
1410 /* In a container we lack CAP_MKNOD. We
ab06eef8 1411 shouldn't attempt to create the device node in
cb7ed9df
LP		 1412 that case to avoid noise, and we don't support
1413 virtualized devices in containers anyway. */
1414
1415 log_debug("We lack CAP_MKNOD, skipping creation of device node %s.", i->path);
1416 return 0;
1417 }
1418
1554afae 1419 file_type = i->type == CREATE_BLOCK_DEVICE ? S_IFBLK : S_IFCHR;
468d726b 1420
5c0d398d 1421 RUN_WITH_UMASK(0000) {
ecabcf8b 1422 mac_selinux_create_file_prepare(i->path, file_type);
5c0d398d 1423 r = mknod(i->path, i->mode | file_type, i->major_minor);
ecabcf8b 1424 mac_selinux_create_file_clear();
5c0d398d 1425 }
468d726b 1426
6555ad8e
KS		 1427 if (r < 0) {
1428 if (errno == EPERM) {
1429 log_debug("We lack permissions, possibly because of cgroup configuration; "
1430 "skipping creation of device node %s.", i->path);
1431 return 0;
1432 }
1433
4a62c710
MS		 1434 if (errno != EEXIST)
1435 return log_error_errno(errno, "Failed to create device node %s: %m", i->path);
468d726b 1436
a542c4dc 1437 if (lstat(i->path, &st) < 0)
4a62c710 1438 return log_error_errno(errno, "stat(%s) failed: %m", i->path);
468d726b 1439
1554afae
LP		 1440 if ((st.st_mode & S_IFMT) != file_type) {
1441
1442 if (i->force) {
1443
1444 RUN_WITH_UMASK(0000) {
ecabcf8b 1445 mac_selinux_create_file_prepare(i->path, file_type);
1554afae 1446 r = mknod_atomic(i->path, i->mode | file_type, i->major_minor);
ecabcf8b 1447 mac_selinux_create_file_clear();
1554afae
LP		 1448 }
1449
f647962d 1450 if (r < 0)
294929f8
ZJS		 1451 return log_error_errno(r, "Failed to create device node \"%s\": %m", i->path);
1452 creation = CREATION_FORCE;
1554afae
LP		 1453 } else {
1454 log_debug("%s is not a device node.", i->path);
1455 return 0;
1456 }
294929f8
ZJS		 1457 } else
1458 creation = CREATION_EXISTING;
1459 } else
1460 creation = CREATION_NORMAL;
a542c4dc 1461
294929f8 1462 log_debug("%s %s device node \"%s\" %u:%u.",
7a7d5db7 1463 creation_mode_verb_to_string(creation),
582deb84
ZJS		 1464 i->type == CREATE_BLOCK_DEVICE ? "block" : "char",
1465 i->path, major(i->mode), minor(i->mode));
468d726b 1466
b705ab6a 1467 r = path_set_perms(i, i->path);
468d726b
LP		 1468 if (r < 0)
1469 return r;
1470
1471 break;
1472 }
1473
e73a03e0 1474 case ADJUST_MODE:
777b87e7 1475 case RELABEL_PATH:
b705ab6a 1476 r = glob_item(i, path_set_perms, false);
777b87e7 1477 if (r < 0)
96ca8194 1478 return r;
777b87e7
MS		 1479 break;
1480
a8d88783 1481 case RECURSIVE_RELABEL_PATH:
b705ab6a 1482 r = glob_item(i, path_set_perms, true);
a8d88783
MS		 1483 if (r < 0)
1484 return r;
ebf4e801 1485 break;
e73a03e0 1486
ebf4e801 1487 case SET_XATTR:
b705ab6a
ZJS		 1488 r = glob_item(i, path_set_xattrs, false);
1489 if (r < 0)
1490 return r;
1491 break;
1492
1493 case RECURSIVE_SET_XATTR:
1494 r = glob_item(i, path_set_xattrs, true);
ebf4e801
MW		 1495 if (r < 0)
1496 return r;
e73a03e0 1497 break;
f8eeeaf9
ZJS		 1498
1499 case SET_ACL:
b705ab6a 1500 r = glob_item(i, path_set_acls, false);
f8eeeaf9
ZJS		 1501 if (r < 0)
1502 return r;
b705ab6a
ZJS		 1503 break;
1504
1505 case RECURSIVE_SET_ACL:
1506 r = glob_item(i, path_set_acls, true);
1507 if (r < 0)
1508 return r;
1509 break;
22c3a6ca 1510
88ec4dfa
LP		 1511 case SET_ATTRIBUTE:
1512 r = glob_item(i, path_set_attribute, false);
22c3a6ca
GB		 1513 if (r < 0)
1514 return r;
1515 break;
1516
88ec4dfa
LP		 1517 case RECURSIVE_SET_ATTRIBUTE:
1518 r = glob_item(i, path_set_attribute, true);
22c3a6ca
GB		 1519 if (r < 0)
1520 return r;
1521 break;
3b63d2d3
LP		 1522 }
1523
f05bc3f7 1524 return 0;
3b63d2d3
LP		 1525}
1526
a0896123 1527static int remove_item_instance(Item *i, const char *instance) {
3b63d2d3
LP		 1528 int r;
1529
1530 assert(i);
1531
1532 switch (i->type) {
1533
3b63d2d3 1534 case REMOVE_PATH:
4a62c710 1535 if (remove(instance) < 0 && errno != ENOENT)
3f93da98 1536 return log_error_errno(errno, "rm(%s): %m", instance);
3b63d2d3
LP		 1537
1538 break;
1539
1540 case TRUNCATE_DIRECTORY:
1541 case RECURSIVE_REMOVE_PATH:
d139b24a
LP		 1542 /* FIXME: we probably should use dir_cleanup() here
1543 * instead of rm_rf() so that 'x' is honoured. */
582deb84 1544 log_debug("rm -rf \"%s\"", instance);
1b26f09e 1545 r = rm_rf(instance, (i->type == RECURSIVE_REMOVE_PATH ? REMOVE_ROOT|REMOVE_SUBVOLUME : 0) | REMOVE_PHYSICAL);
f647962d
MS		 1546 if (r < 0 && r != -ENOENT)
1547 return log_error_errno(r, "rm_rf(%s): %m", instance);
3b63d2d3
LP		 1548
1549 break;
7fcb4b9b
ZJS		 1550
1551 default:
1552 assert_not_reached("wut?");
3b63d2d3
LP		 1553 }
1554
1555 return 0;
1556}
1557
a0896123 1558static int remove_item(Item *i) {
b8bb3e8f
LP		 1559 assert(i);
1560
582deb84
ZJS		 1561 log_debug("Running remove action for entry %c %s", (char) i->type, i->path);
1562
b8bb3e8f
LP		 1563 switch (i->type) {
1564
b8bb3e8f
LP		 1565 case REMOVE_PATH:
1566 case TRUNCATE_DIRECTORY:
99e68c0b 1567 case RECURSIVE_REMOVE_PATH:
df8dee85 1568 return glob_item(i, remove_item_instance, false);
b8bb3e8f 1569
df8dee85
ZJS		 1570 default:
1571 return 0;
1572 }
b8bb3e8f
LP		 1573}
1574
78a92a5a 1575static int clean_item_instance(Item *i, const char* instance) {
7fd1b19b 1576 _cleanup_closedir_ DIR *d = NULL;
78a92a5a
MS		 1577 struct stat s, ps;
1578 bool mountpoint;
78a92a5a 1579 usec_t cutoff, n;
582deb84 1580 char timestamp[FORMAT_TIMESTAMP_MAX];
78a92a5a
MS		 1581
1582 assert(i);
1583
1584 if (!i->age_set)
1585 return 0;
1586
1587 n = now(CLOCK_REALTIME);
1588 if (n < i->age)
1589 return 0;
1590
1591 cutoff = n - i->age;
1592
df99a9ef 1593 d = opendir_nomod(instance);
78a92a5a 1594 if (!d) {
d710aaf7 1595 if (IN_SET(errno, ENOENT, ENOTDIR)) {
582deb84 1596 log_debug_errno(errno, "Directory \"%s\": %m", instance);
78a92a5a 1597 return 0;
582deb84 1598 }
78a92a5a 1599
d710aaf7 1600 return log_error_errno(errno, "Failed to open directory %s: %m", instance);
78a92a5a
MS		 1601 }
1602
4a62c710
MS		 1603 if (fstat(dirfd(d), &s) < 0)
1604 return log_error_errno(errno, "stat(%s) failed: %m", i->path);
78a92a5a
MS		 1605
1606 if (!S_ISDIR(s.st_mode)) {
1607 log_error("%s is not a directory.", i->path);
19fbec19 1608 return -ENOTDIR;
78a92a5a
MS		 1609 }
1610
4a62c710
MS		 1611 if (fstatat(dirfd(d), "..", &ps, AT_SYMLINK_NOFOLLOW) != 0)
1612 return log_error_errno(errno, "stat(%s/..) failed: %m", i->path);
78a92a5a 1613
2bb158c1 1614 mountpoint = s.st_dev != ps.st_dev || s.st_ino == ps.st_ino;
78a92a5a 1615
582deb84
ZJS		 1616 log_debug("Cleanup threshold for %s \"%s\" is %s",
1617 mountpoint ? "mount point" : "directory",
1618 instance,
1619 format_timestamp_us(timestamp, sizeof(timestamp), cutoff));
1620
1621 return dir_cleanup(i, instance, d, &s, cutoff, s.st_dev, mountpoint,
1622 MAX_DEPTH, i->keep_first_level);
78a92a5a
MS		 1623}
1624
1625static int clean_item(Item *i) {
78a92a5a
MS		 1626 assert(i);
1627
582deb84
ZJS		 1628 log_debug("Running clean action for entry %c %s", (char) i->type, i->path);
1629
78a92a5a
MS		 1630 switch (i->type) {
1631 case CREATE_DIRECTORY:
d7b8eec7 1632 case CREATE_SUBVOLUME:
5fb13eb5
LP		 1633 case CREATE_SUBVOLUME_INHERIT_QUOTA:
1634 case CREATE_SUBVOLUME_NEW_QUOTA:
df8dee85 1635 case EMPTY_DIRECTORY:
78a92a5a
MS		 1636 case TRUNCATE_DIRECTORY:
1637 case IGNORE_PATH:
849958d1 1638 case COPY_FILES:
78a92a5a 1639 clean_item_instance(i, i->path);
df8dee85 1640 return 0;
78a92a5a 1641 case IGNORE_DIRECTORY_PATH:
df8dee85 1642 return glob_item(i, clean_item_instance, false);
78a92a5a 1643 default:
df8dee85 1644 return 0;
78a92a5a 1645 }
78a92a5a
MS		 1646}
1647
3f93da98
ZJS		 1648static int process_item_array(ItemArray *array);
1649
3b63d2d3 1650static int process_item(Item *i) {
1e95893a 1651 int r, q, p, t = 0;
9348f0e6 1652 _cleanup_free_ char *prefix = NULL;
3b63d2d3
LP		 1653
1654 assert(i);
1655
1910cd0e
LP		 1656 if (i->done)
1657 return 0;
1658
1659 i->done = true;
1660
9348f0e6
ZJS		 1661 prefix = malloc(strlen(i->path) + 1);
1662 if (!prefix)
1663 return log_oom();
1664
1910cd0e 1665 PATH_FOREACH_PREFIX(prefix, i->path) {
3f93da98 1666 ItemArray *j;
1910cd0e 1667
ef43a391 1668 j = ordered_hashmap_get(items, prefix);
1db50423
ZJS		 1669 if (j) {
1670 int s;
1671
3f93da98 1672 s = process_item_array(j);
1db50423
ZJS		 1673 if (s < 0 && t == 0)
1674 t = s;
1675 }
1910cd0e
LP		 1676 }
1677
655f2da0
N		 1678 if (chase_symlinks(i->path, NULL, CHASE_NO_AUTOFS, NULL) == -EREMOTE)
1679 return t;
1680
3b63d2d3 1681 r = arg_create ? create_item(i) : 0;
a0896123 1682 q = arg_remove ? remove_item(i) : 0;
3b63d2d3
LP		 1683 p = arg_clean ? clean_item(i) : 0;
1684
1db50423
ZJS		 1685 return t < 0 ? t :
1686 r < 0 ? r :
1687 q < 0 ? q :
1688 p;
3b63d2d3
LP		 1689}
1690
3f93da98
ZJS		 1691static int process_item_array(ItemArray *array) {
1692 unsigned n;
1693 int r = 0, k;
753615e8 1694
3f93da98
ZJS		 1695 assert(array);
1696
1697 for (n = 0; n < array->count; n++) {
1698 k = process_item(array->items + n);
1699 if (k < 0 && r == 0)
1700 r = k;
1701 }
1702
1703 return r;
1704}
3b63d2d3 1705
3f93da98
ZJS		 1706static void item_free_contents(Item *i) {
1707 assert(i);
3b63d2d3 1708 free(i->path);
468d726b 1709 free(i->argument);
ebf4e801 1710 strv_free(i->xattrs);
f8eeeaf9 1711
349cc4a5 1712#if HAVE_ACL
f8eeeaf9
ZJS		 1713 acl_free(i->acl_access);
1714 acl_free(i->acl_default);
1715#endif
3b63d2d3
LP		 1716}
1717
3f93da98
ZJS		 1718static void item_array_free(ItemArray *a) {
1719 unsigned n;
1720
1721 if (!a)
1722 return;
1723
1724 for (n = 0; n < a->count; n++)
1725 item_free_contents(a->items + n);
1726 free(a->items);
1727 free(a);
1728}
e2f2fb78 1729
17493fa5
LP		 1730static int item_compare(const void *a, const void *b) {
1731 const Item *x = a, *y = b;
1732
1733 /* Make sure that the ownership taking item is put first, so
1734 * that we first create the node, and then can adjust it */
1735
1736 if (takes_ownership(x->type) && !takes_ownership(y->type))
1737 return -1;
1738 if (!takes_ownership(x->type) && takes_ownership(y->type))
1739 return 1;
1740
1741 return (int) x->type - (int) y->type;
1742}
1743
3f93da98 1744static bool item_compatible(Item *a, Item *b) {
bfe95f35
LP		 1745 assert(a);
1746 assert(b);
3f93da98 1747 assert(streq(a->path, b->path));
bfe95f35 1748
3f93da98
ZJS		 1749 if (takes_ownership(a->type) && takes_ownership(b->type))
1750 /* check if the items are the same */
1751 return streq_ptr(a->argument, b->argument) &&
bfe95f35 1752
3f93da98
ZJS		 1753 a->uid_set == b->uid_set &&
1754 a->uid == b->uid &&
bfe95f35 1755
3f93da98
ZJS		 1756 a->gid_set == b->gid_set &&
1757 a->gid == b->gid &&
bfe95f35 1758
3f93da98
ZJS		 1759 a->mode_set == b->mode_set &&
1760 a->mode == b->mode &&
bfe95f35 1761
3f93da98
ZJS		 1762 a->age_set == b->age_set &&
1763 a->age == b->age &&
bfe95f35 1764
3f93da98 1765 a->mask_perms == b->mask_perms &&
bfe95f35 1766
3f93da98 1767 a->keep_first_level == b->keep_first_level &&
468d726b 1768
3f93da98 1769 a->major_minor == b->major_minor;
468d726b 1770
bfe95f35
LP		 1771 return true;
1772}
1773
a2aced4a
DR		 1774static bool should_include_path(const char *path) {
1775 char **prefix;
1776
abef3f91 1777 STRV_FOREACH(prefix, arg_exclude_prefixes)
582deb84
ZJS		 1778 if (path_startswith(path, *prefix)) {
1779 log_debug("Entry \"%s\" matches exclude prefix \"%s\", skipping.",
1780 path, *prefix);
5c795114 1781 return false;
582deb84 1782 }
a2aced4a 1783
abef3f91 1784 STRV_FOREACH(prefix, arg_include_prefixes)
582deb84
ZJS		 1785 if (path_startswith(path, *prefix)) {
1786 log_debug("Entry \"%s\" matches include prefix \"%s\".", path, *prefix);
a2aced4a 1787 return true;
582deb84 1788 }
a2aced4a 1789
5c795114
DR		 1790 /* no matches, so we should include this path only if we
1791 * have no whitelist at all */
7b943bb7 1792 if (strv_isempty(arg_include_prefixes))
582deb84
ZJS		 1793 return true;
1794
1795 log_debug("Entry \"%s\" does not match any include prefix, skipping.", path);
1796 return false;
a2aced4a
DR		 1797}
1798
4cef1923
FB		 1799static int specifier_expansion_from_arg(Item *i) {
1800 _cleanup_free_ char *unescaped = NULL, *resolved = NULL;
1801 char **xattr;
1802 int r;
1803
1804 assert(i);
1805
1806 if (i->argument == NULL)
1807 return 0;
1808
1809 switch (i->type) {
1810 case COPY_FILES:
1811 case CREATE_SYMLINK:
1812 case CREATE_FILE:
1813 case TRUNCATE_FILE:
1814 case WRITE_FILE:
1815 r = cunescape(i->argument, 0, &unescaped);
1816 if (r < 0)
1817 return log_error_errno(r, "Failed to unescape parameter to write: %s", i->argument);
1818
1819 r = specifier_printf(unescaped, specifier_table, NULL, &resolved);
1820 if (r < 0)
1821 return r;
1822
1823 free_and_replace(i->argument, resolved);
1824 break;
1825
1826 case SET_XATTR:
1827 case RECURSIVE_SET_XATTR:
1828 assert(i->xattrs);
1829
1830 STRV_FOREACH (xattr, i->xattrs) {
1831 r = specifier_printf(*xattr, specifier_table, NULL, &resolved);
1832 if (r < 0)
1833 return r;
1834
1835 free_and_replace(*xattr, resolved);
1836 }
1837 break;
1838
1839 default:
1840 break;
1841 }
1842 return 0;
1843}
1844
d9daae55 1845static int parse_line(const char *fname, unsigned line, const char *buffer, bool *invalid_config) {
1731e34a 1846
cde684a2 1847 _cleanup_free_ char *action = NULL, *mode = NULL, *user = NULL, *group = NULL, *age = NULL, *path = NULL;
3f93da98
ZJS		 1848 _cleanup_(item_free_contents) Item i = {};
1849 ItemArray *existing;
ef43a391 1850 OrderedHashmap *h;
657cf7f4 1851 int r, pos;
5f255144 1852 bool force = false, boot = false;
3b63d2d3
LP		 1853
1854 assert(fname);
1855 assert(line >= 1);
1856 assert(buffer);
1857
68685607 1858 r = extract_many_words(
4034a06d 1859 &buffer,
68685607 1860 NULL,
12ba2c44 1861 EXTRACT_QUOTES,
4034a06d
LP		 1862 &action,
1863 &path,
1864 &mode,
1865 &user,
1866 &group,
1867 &age,
1868 NULL);
d9daae55 1869 if (r < 0) {
751223fe
ZJS		 1870 if (IN_SET(r, -EINVAL, -EBADSLT))
1871 /* invalid quoting and such or an unknown specifier */
d9daae55 1872 *invalid_config = true;
657cf7f4 1873 return log_error_errno(r, "[%s:%u] Failed to parse line: %m", fname, line);
d9daae55
ZJS		 1874 }
1875
657cf7f4 1876 else if (r < 2) {
d9daae55 1877 *invalid_config = true;
3b63d2d3 1878 log_error("[%s:%u] Syntax error.", fname, line);
7f2c1f4d 1879 return -EIO;
5008d581
LP		 1880 }
1881
aa5f6817 1882 if (!isempty(buffer) && !streq(buffer, "-")) {
4034a06d
LP		 1883 i.argument = strdup(buffer);
1884 if (!i.argument)
1885 return log_oom();
1886 }
1887
2e78fa79 1888 if (isempty(action)) {
d9daae55 1889 *invalid_config = true;
2e78fa79 1890 log_error("[%s:%u] Command too short '%s'.", fname, line, action);
c4708f13 1891 return -EINVAL;
2e78fa79
LP		 1892 }
1893
5f255144
ZJS		 1894 for (pos = 1; action[pos]; pos++) {
1895 if (action[pos] == '!' && !boot)
1896 boot = true;
1897 else if (action[pos] == '+' && !force)
1898 force = true;
1899 else {
d9daae55 1900 *invalid_config = true;
5f255144
ZJS		 1901 log_error("[%s:%u] Unknown modifiers in command '%s'",
1902 fname, line, action);
1903 return -EINVAL;
1904 }
2e78fa79
LP		 1905 }
1906
582deb84
ZJS		 1907 if (boot && !arg_boot) {
1908 log_debug("Ignoring entry %s \"%s\" because --boot is not specified.",
1909 action, path);
c4708f13 1910 return 0;
582deb84 1911 }
c4708f13 1912
3f93da98
ZJS		 1913 i.type = action[0];
1914 i.force = force;
2e78fa79 1915
3f93da98 1916 r = specifier_printf(path, specifier_table, NULL, &i.path);
4cef1923
FB		 1917 if (r == -ENOKEY)
1918 return log_unresolvable_specifier(fname, line);
d9daae55 1919 if (r < 0) {
751223fe
ZJS		 1920 if (IN_SET(r, -EINVAL, -EBADSLT))
1921 *invalid_config = true;
4cef1923 1922 return log_error_errno(r, "[%s:%u] Failed to replace specifiers: %s", fname, line, path);
d9daae55 1923 }
1731e34a 1924
3f93da98 1925 switch (i.type) {
468d726b 1926
777b87e7 1927 case CREATE_DIRECTORY:
d7b8eec7 1928 case CREATE_SUBVOLUME:
5fb13eb5
LP		 1929 case CREATE_SUBVOLUME_INHERIT_QUOTA:
1930 case CREATE_SUBVOLUME_NEW_QUOTA:
df8dee85 1931 case EMPTY_DIRECTORY:
777b87e7
MS		 1932 case TRUNCATE_DIRECTORY:
1933 case CREATE_FIFO:
1934 case IGNORE_PATH:
78a92a5a 1935 case IGNORE_DIRECTORY_PATH:
777b87e7
MS		 1936 case REMOVE_PATH:
1937 case RECURSIVE_REMOVE_PATH:
e73a03e0 1938 case ADJUST_MODE:
777b87e7
MS		 1939 case RELABEL_PATH:
1940 case RECURSIVE_RELABEL_PATH:
c82500c6 1941 if (i.argument)
bd550f78 1942 log_warning("[%s:%u] %c lines don't take argument fields, ignoring.", fname, line, i.type);
c82500c6
LP		 1943
1944 break;
1945
1946 case CREATE_FILE:
1947 case TRUNCATE_FILE:
777b87e7 1948 break;
468d726b
LP		 1949
1950 case CREATE_SYMLINK:
3f93da98
ZJS		 1951 if (!i.argument) {
1952 i.argument = strappend("/usr/share/factory/", i.path);
1953 if (!i.argument)
2f3b873a 1954 return log_oom();
468d726b
LP		 1955 }
1956 break;
1957
31ed59c5 1958 case WRITE_FILE:
3f93da98 1959 if (!i.argument) {
d9daae55 1960 *invalid_config = true;
31ed59c5 1961 log_error("[%s:%u] Write file requires argument.", fname, line);
7f2c1f4d 1962 return -EBADMSG;
31ed59c5
LP		 1963 }
1964 break;
1965
849958d1 1966 case COPY_FILES:
3f93da98
ZJS		 1967 if (!i.argument) {
1968 i.argument = strappend("/usr/share/factory/", i.path);
1969 if (!i.argument)
2f3b873a 1970 return log_oom();
3f93da98 1971 } else if (!path_is_absolute(i.argument)) {
d9daae55 1972 *invalid_config = true;
849958d1
LP		 1973 log_error("[%s:%u] Source path is not absolute.", fname, line);
1974 return -EBADMSG;
1975 }
1976
3f93da98 1977 path_kill_slashes(i.argument);
849958d1
LP		 1978 break;
1979
468d726b
LP		 1980 case CREATE_CHAR_DEVICE:
1981 case CREATE_BLOCK_DEVICE: {
1982 unsigned major, minor;
1983
3f93da98 1984 if (!i.argument) {
d9daae55 1985 *invalid_config = true;
468d726b 1986 log_error("[%s:%u] Device file requires argument.", fname, line);
7f2c1f4d 1987 return -EBADMSG;
468d726b
LP		 1988 }
1989
3f93da98 1990 if (sscanf(i.argument, "%u:%u", &major, &minor) != 2) {
d9daae55 1991 *invalid_config = true;
3f93da98 1992 log_error("[%s:%u] Can't parse device file major/minor '%s'.", fname, line, i.argument);
7f2c1f4d 1993 return -EBADMSG;
468d726b
LP		 1994 }
1995
3f93da98 1996 i.major_minor = makedev(major, minor);
468d726b
LP		 1997 break;
1998 }
1999
ebf4e801 2000 case SET_XATTR:
b705ab6a 2001 case RECURSIVE_SET_XATTR:
3f93da98 2002 if (!i.argument) {
d9daae55 2003 *invalid_config = true;
ebf4e801
MW		 2004 log_error("[%s:%u] Set extended attribute requires argument.", fname, line);
2005 return -EBADMSG;
2006 }
bd550f78 2007 r = parse_xattrs_from_arg(&i);
ebf4e801
MW		 2008 if (r < 0)
2009 return r;
2010 break;
2011
f8eeeaf9 2012 case SET_ACL:
b705ab6a 2013 case RECURSIVE_SET_ACL:
f8eeeaf9 2014 if (!i.argument) {
d9daae55 2015 *invalid_config = true;
f8eeeaf9
ZJS		 2016 log_error("[%s:%u] Set ACLs requires argument.", fname, line);
2017 return -EBADMSG;
2018 }
bd550f78 2019 r = parse_acls_from_arg(&i);
f8eeeaf9
ZJS		 2020 if (r < 0)
2021 return r;
2022 break;
2023
88ec4dfa
LP		 2024 case SET_ATTRIBUTE:
2025 case RECURSIVE_SET_ATTRIBUTE:
22c3a6ca 2026 if (!i.argument) {
d9daae55 2027 *invalid_config = true;
88ec4dfa 2028 log_error("[%s:%u] Set file attribute requires argument.", fname, line);
22c3a6ca
GB		 2029 return -EBADMSG;
2030 }
bd550f78 2031 r = parse_attribute_from_arg(&i);
751223fe 2032 if (IN_SET(r, -EINVAL, -EBADSLT))
d9daae55 2033 *invalid_config = true;
22c3a6ca
GB		 2034 if (r < 0)
2035 return r;
2036 break;
2037
777b87e7 2038 default:
582deb84 2039 log_error("[%s:%u] Unknown command type '%c'.", fname, line, (char) i.type);
d9daae55 2040 *invalid_config = true;
7f2c1f4d 2041 return -EBADMSG;
3b63d2d3 2042 }
468d726b 2043
3f93da98
ZJS		 2044 if (!path_is_absolute(i.path)) {
2045 log_error("[%s:%u] Path '%s' not absolute.", fname, line, i.path);
d9daae55 2046 *invalid_config = true;
7f2c1f4d 2047 return -EBADMSG;
3b63d2d3
LP		 2048 }
2049
3f93da98 2050 path_kill_slashes(i.path);
3b63d2d3 2051
3f93da98 2052 if (!should_include_path(i.path))
7f2c1f4d 2053 return 0;
5008d581 2054
4cef1923
FB		 2055 r = specifier_expansion_from_arg(&i);
2056 if (r == -ENOKEY)
2057 return log_unresolvable_specifier(fname, line);
751223fe
ZJS		 2058 if (r < 0) {
2059 if (IN_SET(r, -EINVAL, -EBADSLT))
2060 *invalid_config = true;
4cef1923
FB		 2061 return log_error_errno(r, "[%s:%u] Failed to substitute specifiers in argument: %m",
2062 fname, line);
751223fe 2063 }
4cef1923 2064
cf9a4abd 2065 if (arg_root) {
cde684a2
LP		 2066 char *p;
2067
1d13f648 2068 p = prefix_root(arg_root, i.path);
cf9a4abd
MM		 2069 if (!p)
2070 return log_oom();
2071
3f93da98
ZJS		 2072 free(i.path);
2073 i.path = p;
cf9a4abd
MM		 2074 }
2075
90937fe3 2076 if (!isempty(user) && !streq(user, "-")) {
4b67834e
LP		 2077 const char *u = user;
2078
3f93da98 2079 r = get_user_creds(&u, &i.uid, NULL, NULL, NULL);
4b67834e 2080 if (r < 0) {
d9daae55
ZJS		 2081 *invalid_config = true;
2082 return log_error_errno(r, "[%s:%u] Unknown user '%s'.", fname, line, user);
3b63d2d3
LP		 2083 }
2084
3f93da98 2085 i.uid_set = true;
3b63d2d3
LP		 2086 }
2087
90937fe3 2088 if (!isempty(group) && !streq(group, "-")) {
4b67834e
LP		 2089 const char *g = group;
2090
3f93da98 2091 r = get_group_creds(&g, &i.gid);
4b67834e 2092 if (r < 0) {
d9daae55 2093 *invalid_config = true;
3b63d2d3 2094 log_error("[%s:%u] Unknown group '%s'.", fname, line, group);
7f2c1f4d 2095 return r;
3b63d2d3
LP		 2096 }
2097
3f93da98 2098 i.gid_set = true;
3b63d2d3
LP		 2099 }
2100
90937fe3 2101 if (!isempty(mode) && !streq(mode, "-")) {
abef3f91 2102 const char *mm = mode;
3b63d2d3
LP		 2103 unsigned m;
2104
abef3f91 2105 if (*mm == '~') {
3f93da98 2106 i.mask_perms = true;
abef3f91
LP		 2107 mm++;
2108 }
2109
2ff7b0a5 2110 if (parse_mode(mm, &m) < 0) {
d9daae55 2111 *invalid_config = true;
3b63d2d3 2112 log_error("[%s:%u] Invalid mode '%s'.", fname, line, mode);
2ff7b0a5 2113 return -EBADMSG;
3b63d2d3
LP		 2114 }
2115
3f93da98
ZJS		 2116 i.mode = m;
2117 i.mode_set = true;
3b63d2d3 2118 } else
5fb13eb5 2119 i.mode = IN_SET(i.type, CREATE_DIRECTORY, TRUNCATE_DIRECTORY, CREATE_SUBVOLUME, CREATE_SUBVOLUME_INHERIT_QUOTA, CREATE_SUBVOLUME_NEW_QUOTA) ? 0755 : 0644;
3b63d2d3 2120
90937fe3 2121 if (!isempty(age) && !streq(age, "-")) {
24f3a374
LP		 2122 const char *a = age;
2123
2124 if (*a == '~') {
3f93da98 2125 i.keep_first_level = true;
24f3a374
LP		 2126 a++;
2127 }
2128
3f93da98 2129 if (parse_sec(a, &i.age) < 0) {
d9daae55 2130 *invalid_config = true;
3b63d2d3 2131 log_error("[%s:%u] Invalid age '%s'.", fname, line, age);
7f2c1f4d 2132 return -EBADMSG;
3b63d2d3
LP		 2133 }
2134
3f93da98 2135 i.age_set = true;
3b63d2d3
LP		 2136 }
2137
3f93da98 2138 h = needs_glob(i.type) ? globs : items;
bfe95f35 2139
ef43a391 2140 existing = ordered_hashmap_get(h, i.path);
468d726b 2141 if (existing) {
3f93da98
ZJS		 2142 unsigned n;
2143
2144 for (n = 0; n < existing->count; n++) {
6487ada8 2145 if (!item_compatible(existing->items + n, &i)) {
505ef0e3 2146 log_warning("[%s:%u] Duplicate line for path \"%s\", ignoring.",
3f93da98 2147 fname, line, i.path);
6487ada8
MP		 2148 return 0;
2149 }
ebf4e801
MW		 2150 }
2151 } else {
3f93da98 2152 existing = new0(ItemArray, 1);
ef43a391 2153 r = ordered_hashmap_put(h, i.path, existing);
3f93da98
ZJS		 2154 if (r < 0)
2155 return log_oom();
bfe95f35
LP		 2156 }
2157
3f93da98
ZJS		 2158 if (!GREEDY_REALLOC(existing->items, existing->size, existing->count + 1))
2159 return log_oom();
5008d581 2160
3f93da98 2161 memcpy(existing->items + existing->count++, &i, sizeof(i));
dd449aca
ZJS		 2162
2163 /* Sort item array, to enforce stable ordering of application */
2164 qsort_safe(existing->items, existing->count, sizeof(Item), item_compare);
17493fa5 2165
3f93da98 2166 zero(i);
7f2c1f4d 2167 return 0;
5008d581
LP		 2168}
2169
601185b4 2170static void help(void) {
522d4a49
LP		 2171 printf("%s [OPTIONS...] [CONFIGURATION FILE...]\n\n"
2172 "Creates, deletes and cleans up volatile and temporary files and directories.\n\n"
5c795114 2173 " -h --help Show this help\n"
eb9da376 2174 " --version Show package version\n"
5c795114
DR		 2175 " --create Create marked files/directories\n"
2176 " --clean Clean up marked directories\n"
2177 " --remove Remove marked files/directories\n"
81815651 2178 " --boot Execute actions only safe at boot\n"
79ca888f
ZJS		 2179 " --prefix=PATH Only apply rules with the specified prefix\n"
2180 " --exclude-prefix=PATH Ignore rules with the specified prefix\n"
d9daae55
ZJS		 2181 " --root=PATH Operate on an alternate filesystem root\n"
2182 , program_invocation_short_name);
3b63d2d3
LP		 2183}
2184
2185static int parse_argv(int argc, char *argv[]) {
2186
2187 enum {
eb9da376 2188 ARG_VERSION = 0x100,
3b63d2d3
LP		 2189 ARG_CREATE,
2190 ARG_CLEAN,
fba6e687 2191 ARG_REMOVE,
81815651 2192 ARG_BOOT,
5c795114
DR		 2193 ARG_PREFIX,
2194 ARG_EXCLUDE_PREFIX,
cf9a4abd 2195 ARG_ROOT,
3b63d2d3
LP		 2196 };
2197
2198 static const struct option options[] = {
5c795114 2199 { "help", no_argument, NULL, 'h' },
eb9da376 2200 { "version", no_argument, NULL, ARG_VERSION },
5c795114
DR		 2201 { "create", no_argument, NULL, ARG_CREATE },
2202 { "clean", no_argument, NULL, ARG_CLEAN },
2203 { "remove", no_argument, NULL, ARG_REMOVE },
81815651 2204 { "boot", no_argument, NULL, ARG_BOOT },
5c795114
DR		 2205 { "prefix", required_argument, NULL, ARG_PREFIX },
2206 { "exclude-prefix", required_argument, NULL, ARG_EXCLUDE_PREFIX },
cf9a4abd 2207 { "root", required_argument, NULL, ARG_ROOT },
eb9da376 2208 {}
3b63d2d3
LP		 2209 };
2210
0f474365 2211 int c, r;
3b63d2d3
LP		 2212
2213 assert(argc >= 0);
2214 assert(argv);
2215
601185b4 2216 while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0)
3b63d2d3
LP		 2217
2218 switch (c) {
2219
2220 case 'h':
601185b4
ZJS		 2221 help();
2222 return 0;
eb9da376
LP		 2223
2224 case ARG_VERSION:
3f6fd1ba 2225 return version();
3b63d2d3
LP		 2226
2227 case ARG_CREATE:
2228 arg_create = true;
2229 break;
2230
2231 case ARG_CLEAN:
2232 arg_clean = true;
2233 break;
2234
2235 case ARG_REMOVE:
2236 arg_remove = true;
2237 break;
2238
81815651
ZJS		 2239 case ARG_BOOT:
2240 arg_boot = true;
c4708f13
ZJS		 2241 break;
2242
fba6e687 2243 case ARG_PREFIX:
7bc040fa 2244 if (strv_push(&arg_include_prefixes, optarg) < 0)
a2aced4a 2245 return log_oom();
fba6e687
LP		 2246 break;
2247
5c795114 2248 case ARG_EXCLUDE_PREFIX:
7bc040fa 2249 if (strv_push(&arg_exclude_prefixes, optarg) < 0)
5c795114
DR		 2250 return log_oom();
2251 break;
2252
cf9a4abd 2253 case ARG_ROOT:
0f03c2a4 2254 r = parse_path_argument_and_warn(optarg, true, &arg_root);
0f474365 2255 if (r < 0)
0f03c2a4 2256 return r;
cf9a4abd
MM		 2257 break;
2258
3b63d2d3
LP		 2259 case '?':
2260 return -EINVAL;
2261
2262 default:
eb9da376 2263 assert_not_reached("Unhandled option");
3b63d2d3 2264 }
3b63d2d3
LP		 2265
2266 if (!arg_clean && !arg_create && !arg_remove) {
35b8ca3a 2267 log_error("You need to specify at least one of --clean, --create or --remove.");
3b63d2d3
LP		 2268 return -EINVAL;
2269 }
2270
2271 return 1;
2272}
2273
d9daae55 2274static int read_config_file(const char *fn, bool ignore_enoent, bool *invalid_config) {
f7ac1ed2
ZJS		 2275 _cleanup_fclose_ FILE *_f = NULL;
2276 FILE *f;
1731e34a 2277 char line[LINE_MAX];
78a92a5a 2278 Iterator iterator;
1731e34a 2279 unsigned v = 0;
78a92a5a 2280 Item *i;
4e68ec18 2281 int r = 0;
fba6e687
LP		 2282
2283 assert(fn);
2284
f7ac1ed2
ZJS		 2285 if (streq(fn, "-")) {
2286 log_debug("Reading config from stdin.");
2287 fn = "<stdin>";
2288 f = stdin;
2289 } else {
2290 r = search_and_fopen_nulstr(fn, "re", arg_root, conf_file_dirs, &_f);
2291 if (r < 0) {
2292 if (ignore_enoent && r == -ENOENT) {
2293 log_debug_errno(r, "Failed to open \"%s\", ignoring: %m", fn);
2294 return 0;
2295 }
fba6e687 2296
f7ac1ed2
ZJS		 2297 return log_error_errno(r, "Failed to open '%s': %m", fn);
2298 }
2299 log_debug("Reading config file \"%s\".", fn);
2300 f = _f;
fba6e687
LP		 2301 }
2302
1731e34a
LP		 2303 FOREACH_LINE(line, f, break) {
2304 char *l;
fba6e687 2305 int k;
d9daae55 2306 bool invalid_line = false;
fba6e687 2307
fba6e687
LP		 2308 v++;
2309
2310 l = strstrip(line);
4c701096 2311 if (IN_SET(*l, 0, '#'))
fba6e687
LP		 2312 continue;
2313
d9daae55
ZJS		 2314 k = parse_line(fn, v, l, &invalid_line);
2315 if (k < 0) {
2316 if (invalid_line)
2317 /* Allow reporting with a special code if the caller requested this */
2318 *invalid_config = true;
2319 else if (r == 0)
2320 /* The first error becomes our return value */
2321 r = k;
2322 }
fba6e687
LP		 2323 }
2324
78a92a5a 2325 /* we have to determine age parameter for each entry of type X */
ef43a391 2326 ORDERED_HASHMAP_FOREACH(i, globs, iterator) {
78a92a5a
MS		 2327 Iterator iter;
2328 Item *j, *candidate_item = NULL;
2329
2330 if (i->type != IGNORE_DIRECTORY_PATH)
2331 continue;
2332
ef43a391 2333 ORDERED_HASHMAP_FOREACH(j, items, iter) {
5fb13eb5 2334 if (!IN_SET(j->type, CREATE_DIRECTORY, TRUNCATE_DIRECTORY, CREATE_SUBVOLUME, CREATE_SUBVOLUME_INHERIT_QUOTA, CREATE_SUBVOLUME_NEW_QUOTA))
78a92a5a
MS		 2335 continue;
2336
2337 if (path_equal(j->path, i->path)) {
2338 candidate_item = j;
2339 break;
2340 }
2341
2342 if ((!candidate_item && path_startswith(i->path, j->path)) ||
2343 (candidate_item && path_startswith(j->path, candidate_item->path) && (fnmatch(i->path, j->path, FNM_PATHNAME | FNM_PERIOD) == 0)))
2344 candidate_item = j;
2345 }
2346
9ed2a35e 2347 if (candidate_item && candidate_item->age_set) {
78a92a5a
MS		 2348 i->age = candidate_item->age;
2349 i->age_set = true;
2350 }
2351 }
2352
fba6e687 2353 if (ferror(f)) {
56f64d95 2354 log_error_errno(errno, "Failed to read from file %s: %m", fn);
fba6e687
LP		 2355 if (r == 0)
2356 r = -EIO;
2357 }
2358
fba6e687
LP		 2359 return r;
2360}
2361
5008d581 2362int main(int argc, char *argv[]) {
fabe5c0e 2363 int r, k;
3f93da98 2364 ItemArray *a;
3b63d2d3 2365 Iterator iterator;
d9daae55 2366 bool invalid_config = false;
3b63d2d3 2367
fdcad0c2
LP		 2368 r = parse_argv(argc, argv);
2369 if (r <= 0)
753615e8 2370 goto finish;
5008d581 2371
eb0ca9eb 2372 log_set_target(LOG_TARGET_AUTO);
5008d581
LP		 2373 log_parse_environment();
2374 log_open();
2375
4c12626c
LP		 2376 umask(0022);
2377
c3dacc8b 2378 mac_selinux_init();
5008d581 2379
ef43a391
LP		 2380 items = ordered_hashmap_new(&string_hash_ops);
2381 globs = ordered_hashmap_new(&string_hash_ops);
b8bb3e8f
LP		 2382
2383 if (!items || !globs) {
fabe5c0e 2384 r = log_oom();
3b63d2d3
LP		 2385 goto finish;
2386 }
2387
fabe5c0e 2388 r = 0;
5008d581 2389
fba6e687
LP		 2390 if (optind < argc) {
2391 int j;
5008d581 2392
9125670f 2393 for (j = optind; j < argc; j++) {
d9daae55 2394 k = read_config_file(argv[j], false, &invalid_config);
fabe5c0e
LP		 2395 if (k < 0 && r == 0)
2396 r = k;
9125670f 2397 }
5008d581 2398
fba6e687 2399 } else {
fabe5c0e
LP		 2400 _cleanup_strv_free_ char **files = NULL;
2401 char **f;
5008d581 2402
b5084605 2403 r = conf_files_list_nulstr(&files, ".conf", arg_root, 0, conf_file_dirs);
44143309 2404 if (r < 0) {
da927ba9 2405 log_error_errno(r, "Failed to enumerate tmpfiles.d files: %m");
44143309
KS		 2406 goto finish;
2407 }
3b63d2d3 2408
772f8371 2409 STRV_FOREACH(f, files) {
d9daae55 2410 k = read_config_file(*f, true, &invalid_config);
fabe5c0e
LP		 2411 if (k < 0 && r == 0)
2412 r = k;
5008d581 2413 }
772f8371 2414 }
5008d581 2415
17493fa5
LP		 2416 /* The non-globbing ones usually create things, hence we apply
2417 * them first */
ef43a391 2418 ORDERED_HASHMAP_FOREACH(a, items, iterator) {
3f93da98 2419 k = process_item_array(a);
1db50423
ZJS		 2420 if (k < 0 && r == 0)
2421 r = k;
2422 }
b8bb3e8f 2423
17493fa5
LP		 2424 /* The globbing ones usually alter things, hence we apply them
2425 * second. */
ef43a391 2426 ORDERED_HASHMAP_FOREACH(a, globs, iterator) {
3f93da98 2427 k = process_item_array(a);
1db50423
ZJS		 2428 if (k < 0 && r == 0)
2429 r = k;
2430 }
3b63d2d3 2431
5008d581 2432finish:
224b0e7a
ZJS		 2433 ordered_hashmap_free_with_destructor(items, item_array_free);
2434 ordered_hashmap_free_with_destructor(globs, item_array_free);
5008d581 2435
7bc040fa
LP		 2436 free(arg_include_prefixes);
2437 free(arg_exclude_prefixes);
cf9a4abd 2438 free(arg_root);
a2aced4a 2439
17b90525
LP		 2440 set_free_free(unix_sockets);
2441
cc56fafe 2442 mac_selinux_finish();
29003cff 2443
d9daae55
ZJS		 2444 if (r < 0)
2445 return EXIT_FAILURE;
2446 else if (invalid_config)
2447 return EX_DATAERR;
2448 else
2449 return EXIT_SUCCESS;
5008d581 2450}
Unnamed repository; edit this file 'description' to name the repository.