src/basic/socket-label.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2010 Lennart Poettering
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include <errno.h>
  22 #include <netinet/in.h>
  23 #include <stdbool.h>
  24 #include <stddef.h>
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <sys/un.h>
  28 #include <unistd.h>
  29
  30 #include "alloc-util.h"
  31 #include "fd-util.h"
  32 #include "log.h"
  33 #include "macro.h"
  34 #include "missing.h"
  35 #include "mkdir.h"
  36 #include "selinux-util.h"
  37 #include "socket-util.h"
  38 #include "umask-util.h"
  39
  40 int socket_address_listen(
  41                 const SocketAddress *a,
  42                 int flags,
  43                 int backlog,
  44                 SocketAddressBindIPv6Only only,
  45                 const char *bind_to_device,
  46                 bool reuse_port,
  47                 bool free_bind,
  48                 bool transparent,
  49                 mode_t directory_mode,
  50                 mode_t socket_mode,
  51                 const char *label) {
  52
  53         _cleanup_close_ int fd = -1;
  54         int r, one;
  55
  56         assert(a);
  57
  58         r = socket_address_verify(a);
  59         if (r < 0)
  60                 return r;
  61
  62         if (socket_address_family(a) == AF_INET6 && !socket_ipv6_is_supported())
  63                 return -EAFNOSUPPORT;
  64
  65         if (label) {
  66                 r = mac_selinux_create_socket_prepare(label);
  67                 if (r < 0)
  68                         return r;
  69         }
  70
  71         fd = socket(socket_address_family(a), a->type | flags, a->protocol);
  72         r = fd < 0 ? -errno : 0;
  73
  74         if (label)
  75                 mac_selinux_create_socket_clear();
  76
  77         if (r < 0)
  78                 return r;
  79
  80         if (socket_address_family(a) == AF_INET6 && only != SOCKET_ADDRESS_DEFAULT) {
  81                 int flag = only == SOCKET_ADDRESS_IPV6_ONLY;
  82
  83                 if (setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &flag, sizeof(flag)) < 0)
  84                         return -errno;
  85         }
  86
  87         if (IN_SET(socket_address_family(a), AF_INET, AF_INET6)) {
  88                 if (bind_to_device)
  89                         if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, bind_to_device, strlen(bind_to_device)+1) < 0)
  90                                 return -errno;
  91
  92                 if (reuse_port) {
  93                         one = 1;
  94                         if (setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one)) < 0)
  95                                 log_warning_errno(errno, "SO_REUSEPORT failed: %m");
  96                 }
  97
  98                 if (free_bind) {
  99                         one = 1;
 100                         if (setsockopt(fd, IPPROTO_IP, IP_FREEBIND, &one, sizeof(one)) < 0)
 101                                 log_warning_errno(errno, "IP_FREEBIND failed: %m");
 102                 }
 103
 104                 if (transparent) {
 105                         one = 1;
 106                         if (setsockopt(fd, IPPROTO_IP, IP_TRANSPARENT, &one, sizeof(one)) < 0)
 107                                 log_warning_errno(errno, "IP_TRANSPARENT failed: %m");
 108                 }
 109         }
 110
 111         one = 1;
 112         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) < 0)
 113                 return -errno;
 114
 115         if (socket_address_family(a) == AF_UNIX && a->sockaddr.un.sun_path[0] != 0) {
 116                 /* Create parents */
 117                 (void) mkdir_parents_label(a->sockaddr.un.sun_path, directory_mode);
 118
 119                 /* Enforce the right access mode for the socket */
 120                 RUN_WITH_UMASK(~socket_mode) {
 121                         r = mac_selinux_bind(fd, &a->sockaddr.sa, a->size);
 122                         if (r == -EADDRINUSE) {
 123                                 /* Unlink and try again */
 124                                 unlink(a->sockaddr.un.sun_path);
 125                                 if (bind(fd, &a->sockaddr.sa, a->size) < 0)
 126                                         return -errno;
 127                         } else if (r < 0)
 128                                 return r;
 129                 }
 130         } else {
 131                 if (bind(fd, &a->sockaddr.sa, a->size) < 0)
 132                         return -errno;
 133         }
 134
 135         if (socket_address_can_accept(a))
 136                 if (listen(fd, backlog) < 0)
 137                         return -errno;
 138
 139         r = fd;
 140         fd = -1;
 141
 142         return r;
 143 }
 144
 145 int make_socket_fd(int log_level, const char* address, int type, int flags) {
 146         SocketAddress a;
 147         int fd, r;
 148
 149         r = socket_address_parse(&a, address);
 150         if (r < 0)
 151                 return log_error_errno(r, "Failed to parse socket address \"%s\": %m", address);
 152
 153         a.type = type;
 154
 155         fd = socket_address_listen(&a, type | flags, SOMAXCONN, SOCKET_ADDRESS_DEFAULT,
 156                                    NULL, false, false, false, 0755, 0644, NULL);
 157         if (fd < 0 || log_get_max_level() >= log_level) {
 158                 _cleanup_free_ char *p = NULL;
 159
 160                 r = socket_address_print(&a, &p);
 161                 if (r < 0)
 162                         return log_error_errno(r, "socket_address_print(): %m");
 163
 164                 if (fd < 0)
 165                         log_error_errno(fd, "Failed to listen on %s: %m", p);
 166                 else
 167                         log_full(log_level, "Listening on %s", p);
 168         }
 169
 170         return fd;
 171 }