src/basic/socket-label.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2010 Lennart Poettering
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include <errno.h>
  22 #include <netinet/in.h>
  23 #include <stdbool.h>
  24 #include <stddef.h>
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <sys/un.h>
  28 #include <unistd.h>
  29
  30 #include "alloc-util.h"
  31 #include "fd-util.h"
  32 #include "fs-util.h"
  33 #include "log.h"
  34 #include "macro.h"
  35 #include "missing.h"
  36 #include "mkdir.h"
  37 #include "selinux-util.h"
  38 #include "socket-util.h"
  39 #include "umask-util.h"
  40
  41 int socket_address_listen(
  42                 const SocketAddress *a,
  43                 int flags,
  44                 int backlog,
  45                 SocketAddressBindIPv6Only only,
  46                 const char *bind_to_device,
  47                 bool reuse_port,
  48                 bool free_bind,
  49                 bool transparent,
  50                 mode_t directory_mode,
  51                 mode_t socket_mode,
  52                 const char *label) {
  53
  54         _cleanup_close_ int fd = -1;
  55         const char *p;
  56         int r, one;
  57
  58         assert(a);
  59
  60         r = socket_address_verify(a);
  61         if (r < 0)
  62                 return r;
  63
  64         if (socket_address_family(a) == AF_INET6 && !socket_ipv6_is_supported())
  65                 return -EAFNOSUPPORT;
  66
  67         if (label) {
  68                 r = mac_selinux_create_socket_prepare(label);
  69                 if (r < 0)
  70                         return r;
  71         }
  72
  73         fd = socket(socket_address_family(a), a->type | flags, a->protocol);
  74         r = fd < 0 ? -errno : 0;
  75
  76         if (label)
  77                 mac_selinux_create_socket_clear();
  78
  79         if (r < 0)
  80                 return r;
  81
  82         if (socket_address_family(a) == AF_INET6 && only != SOCKET_ADDRESS_DEFAULT) {
  83                 int flag = only == SOCKET_ADDRESS_IPV6_ONLY;
  84
  85                 if (setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &flag, sizeof(flag)) < 0)
  86                         return -errno;
  87         }
  88
  89         if (IN_SET(socket_address_family(a), AF_INET, AF_INET6)) {
  90                 if (bind_to_device)
  91                         if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, bind_to_device, strlen(bind_to_device)+1) < 0)
  92                                 return -errno;
  93
  94                 if (reuse_port) {
  95                         one = 1;
  96                         if (setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one)) < 0)
  97                                 log_warning_errno(errno, "SO_REUSEPORT failed: %m");
  98                 }
  99
 100                 if (free_bind) {
 101                         one = 1;
 102                         if (setsockopt(fd, IPPROTO_IP, IP_FREEBIND, &one, sizeof(one)) < 0)
 103                                 log_warning_errno(errno, "IP_FREEBIND failed: %m");
 104                 }
 105
 106                 if (transparent) {
 107                         one = 1;
 108                         if (setsockopt(fd, IPPROTO_IP, IP_TRANSPARENT, &one, sizeof(one)) < 0)
 109                                 log_warning_errno(errno, "IP_TRANSPARENT failed: %m");
 110                 }
 111         }
 112
 113         one = 1;
 114         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)) < 0)
 115                 return -errno;
 116
 117         p = socket_address_get_path(a);
 118         if (p) {
 119                 /* Create parents */
 120                 (void) mkdir_parents_label(p, directory_mode);
 121
 122                 /* Enforce the right access mode for the socket */
 123                 RUN_WITH_UMASK(~socket_mode) {
 124                         r = mac_selinux_bind(fd, &a->sockaddr.sa, a->size);
 125                         if (r == -EADDRINUSE) {
 126                                 /* Unlink and try again */
 127
 128                                 if (unlink(p) < 0)
 129                                         return r; /* didn't work, return original error */
 130
 131                                 r = mac_selinux_bind(fd, &a->sockaddr.sa, a->size);
 132                         }
 133                         if (r < 0)
 134                                 return r;
 135                 }
 136         } else {
 137                 if (bind(fd, &a->sockaddr.sa, a->size) < 0)
 138                         return -errno;
 139         }
 140
 141         if (socket_address_can_accept(a))
 142                 if (listen(fd, backlog) < 0)
 143                         return -errno;
 144
 145         /* Let's trigger an inotify event on the socket node, so that anyone waiting for this socket to be connectable
 146          * gets notified */
 147         if (p)
 148                 (void) touch(p);
 149
 150         r = fd;
 151         fd = -1;
 152
 153         return r;
 154 }
 155
 156 int make_socket_fd(int log_level, const char* address, int type, int flags) {
 157         SocketAddress a;
 158         int fd, r;
 159
 160         r = socket_address_parse(&a, address);
 161         if (r < 0)
 162                 return log_error_errno(r, "Failed to parse socket address \"%s\": %m", address);
 163
 164         a.type = type;
 165
 166         fd = socket_address_listen(&a, type | flags, SOMAXCONN, SOCKET_ADDRESS_DEFAULT,
 167                                    NULL, false, false, false, 0755, 0644, NULL);
 168         if (fd < 0 || log_get_max_level() >= log_level) {
 169                 _cleanup_free_ char *p = NULL;
 170
 171                 r = socket_address_print(&a, &p);
 172                 if (r < 0)
 173                         return log_error_errno(r, "socket_address_print(): %m");
 174
 175                 if (fd < 0)
 176                         log_error_errno(fd, "Failed to listen on %s: %m", p);
 177                 else
 178                         log_full(log_level, "Listening on %s", p);
 179         }
 180
 181         return fd;
 182 }