src/core/execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <glob.h>
   6 #include <grp.h>
   7 #include <poll.h>
   8 #include <signal.h>
   9 #include <string.h>
  10 #include <sys/capability.h>
  11 #include <sys/eventfd.h>
  12 #include <sys/mman.h>
  13 #include <sys/personality.h>
  14 #include <sys/prctl.h>
  15 #include <sys/shm.h>
  16 #include <sys/socket.h>
  17 #include <sys/stat.h>
  18 #include <sys/types.h>
  19 #include <sys/un.h>
  20 #include <unistd.h>
  21 #include <utmpx.h>
  22
  23 #if HAVE_PAM
  24 #include <security/pam_appl.h>
  25 #endif
  26
  27 #if HAVE_SELINUX
  28 #include <selinux/selinux.h>
  29 #endif
  30
  31 #if HAVE_SECCOMP
  32 #include <seccomp.h>
  33 #endif
  34
  35 #if HAVE_APPARMOR
  36 #include <sys/apparmor.h>
  37 #endif
  38
  39 #include "sd-messages.h"
  40
  41 #include "af-list.h"
  42 #include "alloc-util.h"
  43 #if HAVE_APPARMOR
  44 #include "apparmor-util.h"
  45 #endif
  46 #include "async.h"
  47 #include "barrier.h"
  48 #include "cap-list.h"
  49 #include "capability-util.h"
  50 #include "chown-recursive.h"
  51 #include "cpu-set-util.h"
  52 #include "def.h"
  53 #include "env-file.h"
  54 #include "env-util.h"
  55 #include "errno-list.h"
  56 #include "execute.h"
  57 #include "exit-status.h"
  58 #include "fd-util.h"
  59 #include "format-util.h"
  60 #include "fs-util.h"
  61 #include "glob-util.h"
  62 #include "io-util.h"
  63 #include "ioprio.h"
  64 #include "label.h"
  65 #include "log.h"
  66 #include "macro.h"
  67 #include "manager.h"
  68 #include "missing.h"
  69 #include "mkdir.h"
  70 #include "namespace.h"
  71 #include "parse-util.h"
  72 #include "path-util.h"
  73 #include "process-util.h"
  74 #include "rlimit-util.h"
  75 #include "rm-rf.h"
  76 #if HAVE_SECCOMP
  77 #include "seccomp-util.h"
  78 #endif
  79 #include "securebits-util.h"
  80 #include "selinux-util.h"
  81 #include "signal-util.h"
  82 #include "smack-util.h"
  83 #include "socket-util.h"
  84 #include "special.h"
  85 #include "stat-util.h"
  86 #include "string-table.h"
  87 #include "string-util.h"
  88 #include "strv.h"
  89 #include "syslog-util.h"
  90 #include "terminal-util.h"
  91 #include "umask-util.h"
  92 #include "unit.h"
  93 #include "user-util.h"
  94 #include "util.h"
  95 #include "utmp-wtmp.h"
  96
  97 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  98 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
  99
 100 /* This assumes there is a 'tty' group */
 101 #define TTY_MODE 0620
 102
 103 #define SNDBUF_SIZE (8*1024*1024)
 104
 105 static int shift_fds(int fds[], size_t n_fds) {
 106         int start, restart_from;
 107
 108         if (n_fds <= 0)
 109                 return 0;
 110
 111         /* Modifies the fds array! (sorts it) */
 112
 113         assert(fds);
 114
 115         start = 0;
 116         for (;;) {
 117                 int i;
 118
 119                 restart_from = -1;
 120
 121                 for (i = start; i < (int) n_fds; i++) {
 122                         int nfd;
 123
 124                         /* Already at right index? */
 125                         if (fds[i] == i+3)
 126                                 continue;
 127
 128                         nfd = fcntl(fds[i], F_DUPFD, i + 3);
 129                         if (nfd < 0)
 130                                 return -errno;
 131
 132                         safe_close(fds[i]);
 133                         fds[i] = nfd;
 134
 135                         /* Hmm, the fd we wanted isn't free? Then
 136                          * let's remember that and try again from here */
 137                         if (nfd != i+3 && restart_from < 0)
 138                                 restart_from = i;
 139                 }
 140
 141                 if (restart_from < 0)
 142                         break;
 143
 144                 start = restart_from;
 145         }
 146
 147         return 0;
 148 }
 149
 150 static int flags_fds(const int fds[], size_t n_socket_fds, size_t n_storage_fds, bool nonblock) {
 151         size_t i, n_fds;
 152         int r;
 153
 154         n_fds = n_socket_fds + n_storage_fds;
 155         if (n_fds <= 0)
 156                 return 0;
 157
 158         assert(fds);
 159
 160         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags.
 161          * O_NONBLOCK only applies to socket activation though. */
 162
 163         for (i = 0; i < n_fds; i++) {
 164
 165                 if (i < n_socket_fds) {
 166                         r = fd_nonblock(fds[i], nonblock);
 167                         if (r < 0)
 168                                 return r;
 169                 }
 170
 171                 /* We unconditionally drop FD_CLOEXEC from the fds,
 172                  * since after all we want to pass these fds to our
 173                  * children */
 174
 175                 r = fd_cloexec(fds[i], false);
 176                 if (r < 0)
 177                         return r;
 178         }
 179
 180         return 0;
 181 }
 182
 183 static const char *exec_context_tty_path(const ExecContext *context) {
 184         assert(context);
 185
 186         if (context->stdio_as_fds)
 187                 return NULL;
 188
 189         if (context->tty_path)
 190                 return context->tty_path;
 191
 192         return "/dev/console";
 193 }
 194
 195 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
 196         const char *path;
 197
 198         assert(context);
 199
 200         path = exec_context_tty_path(context);
 201
 202         if (context->tty_vhangup) {
 203                 if (p && p->stdin_fd >= 0)
 204                         (void) terminal_vhangup_fd(p->stdin_fd);
 205                 else if (path)
 206                         (void) terminal_vhangup(path);
 207         }
 208
 209         if (context->tty_reset) {
 210                 if (p && p->stdin_fd >= 0)
 211                         (void) reset_terminal_fd(p->stdin_fd, true);
 212                 else if (path)
 213                         (void) reset_terminal(path);
 214         }
 215
 216         if (context->tty_vt_disallocate && path)
 217                 (void) vt_disallocate(path);
 218 }
 219
 220 static bool is_terminal_input(ExecInput i) {
 221         return IN_SET(i,
 222                       EXEC_INPUT_TTY,
 223                       EXEC_INPUT_TTY_FORCE,
 224                       EXEC_INPUT_TTY_FAIL);
 225 }
 226
 227 static bool is_terminal_output(ExecOutput o) {
 228         return IN_SET(o,
 229                       EXEC_OUTPUT_TTY,
 230                       EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 231                       EXEC_OUTPUT_KMSG_AND_CONSOLE,
 232                       EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 233 }
 234
 235 static bool is_syslog_output(ExecOutput o) {
 236         return IN_SET(o,
 237                       EXEC_OUTPUT_SYSLOG,
 238                       EXEC_OUTPUT_SYSLOG_AND_CONSOLE);
 239 }
 240
 241 static bool is_kmsg_output(ExecOutput o) {
 242         return IN_SET(o,
 243                       EXEC_OUTPUT_KMSG,
 244                       EXEC_OUTPUT_KMSG_AND_CONSOLE);
 245 }
 246
 247 static bool exec_context_needs_term(const ExecContext *c) {
 248         assert(c);
 249
 250         /* Return true if the execution context suggests we should set $TERM to something useful. */
 251
 252         if (is_terminal_input(c->std_input))
 253                 return true;
 254
 255         if (is_terminal_output(c->std_output))
 256                 return true;
 257
 258         if (is_terminal_output(c->std_error))
 259                 return true;
 260
 261         return !!c->tty_path;
 262 }
 263
 264 static int open_null_as(int flags, int nfd) {
 265         int fd;
 266
 267         assert(nfd >= 0);
 268
 269         fd = open("/dev/null", flags|O_NOCTTY);
 270         if (fd < 0)
 271                 return -errno;
 272
 273         return move_fd(fd, nfd, false);
 274 }
 275
 276 static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
 277         static const union sockaddr_union sa = {
 278                 .un.sun_family = AF_UNIX,
 279                 .un.sun_path = "/run/systemd/journal/stdout",
 280         };
 281         uid_t olduid = UID_INVALID;
 282         gid_t oldgid = GID_INVALID;
 283         int r;
 284
 285         if (gid_is_valid(gid)) {
 286                 oldgid = getgid();
 287
 288                 if (setegid(gid) < 0)
 289                         return -errno;
 290         }
 291
 292         if (uid_is_valid(uid)) {
 293                 olduid = getuid();
 294
 295                 if (seteuid(uid) < 0) {
 296                         r = -errno;
 297                         goto restore_gid;
 298                 }
 299         }
 300
 301         r = connect(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un)) < 0 ? -errno : 0;
 302
 303         /* If we fail to restore the uid or gid, things will likely
 304            fail later on. This should only happen if an LSM interferes. */
 305
 306         if (uid_is_valid(uid))
 307                 (void) seteuid(olduid);
 308
 309  restore_gid:
 310         if (gid_is_valid(gid))
 311                 (void) setegid(oldgid);
 312
 313         return r;
 314 }
 315
 316 static int connect_logger_as(
 317                 const Unit *unit,
 318                 const ExecContext *context,
 319                 const ExecParameters *params,
 320                 ExecOutput output,
 321                 const char *ident,
 322                 int nfd,
 323                 uid_t uid,
 324                 gid_t gid) {
 325
 326         _cleanup_close_ int fd = -1;
 327         int r;
 328
 329         assert(context);
 330         assert(params);
 331         assert(output < _EXEC_OUTPUT_MAX);
 332         assert(ident);
 333         assert(nfd >= 0);
 334
 335         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 336         if (fd < 0)
 337                 return -errno;
 338
 339         r = connect_journal_socket(fd, uid, gid);
 340         if (r < 0)
 341                 return r;
 342
 343         if (shutdown(fd, SHUT_RD) < 0)
 344                 return -errno;
 345
 346         (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
 347
 348         if (dprintf(fd,
 349                 "%s\n"
 350                 "%s\n"
 351                 "%i\n"
 352                 "%i\n"
 353                 "%i\n"
 354                 "%i\n"
 355                 "%i\n",
 356                 context->syslog_identifier ?: ident,
 357                 params->flags & EXEC_PASS_LOG_UNIT ? unit->id : "",
 358                 context->syslog_priority,
 359                 !!context->syslog_level_prefix,
 360                 is_syslog_output(output),
 361                 is_kmsg_output(output),
 362                 is_terminal_output(output)) < 0)
 363                 return -errno;
 364
 365         return move_fd(TAKE_FD(fd), nfd, false);
 366 }
 367
 368 static int open_terminal_as(const char *path, int flags, int nfd) {
 369         int fd;
 370
 371         assert(path);
 372         assert(nfd >= 0);
 373
 374         fd = open_terminal(path, flags | O_NOCTTY);
 375         if (fd < 0)
 376                 return fd;
 377
 378         return move_fd(fd, nfd, false);
 379 }
 380
 381 static int acquire_path(const char *path, int flags, mode_t mode) {
 382         union sockaddr_union sa = {};
 383         _cleanup_close_ int fd = -1;
 384         int r, salen;
 385
 386         assert(path);
 387
 388         if (IN_SET(flags & O_ACCMODE, O_WRONLY, O_RDWR))
 389                 flags |= O_CREAT;
 390
 391         fd = open(path, flags|O_NOCTTY, mode);
 392         if (fd >= 0)
 393                 return TAKE_FD(fd);
 394
 395         if (errno != ENXIO) /* ENXIO is returned when we try to open() an AF_UNIX file system socket on Linux */
 396                 return -errno;
 397         if (strlen(path) >= sizeof(sa.un.sun_path)) /* Too long, can't be a UNIX socket */
 398                 return -ENXIO;
 399
 400         /* So, it appears the specified path could be an AF_UNIX socket. Let's see if we can connect to it. */
 401
 402         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 403         if (fd < 0)
 404                 return -errno;
 405
 406         salen = sockaddr_un_set_path(&sa.un, path);
 407         if (salen < 0)
 408                 return salen;
 409
 410         if (connect(fd, &sa.sa, salen) < 0)
 411                 return errno == EINVAL ? -ENXIO : -errno; /* Propagate initial error if we get EINVAL, i.e. we have
 412                                                            * indication that his wasn't an AF_UNIX socket after all */
 413
 414         if ((flags & O_ACCMODE) == O_RDONLY)
 415                 r = shutdown(fd, SHUT_WR);
 416         else if ((flags & O_ACCMODE) == O_WRONLY)
 417                 r = shutdown(fd, SHUT_RD);
 418         else
 419                 return TAKE_FD(fd);
 420         if (r < 0)
 421                 return -errno;
 422
 423         return TAKE_FD(fd);
 424 }
 425
 426 static int fixup_input(
 427                 const ExecContext *context,
 428                 int socket_fd,
 429                 bool apply_tty_stdin) {
 430
 431         ExecInput std_input;
 432
 433         assert(context);
 434
 435         std_input = context->std_input;
 436
 437         if (is_terminal_input(std_input) && !apply_tty_stdin)
 438                 return EXEC_INPUT_NULL;
 439
 440         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 441                 return EXEC_INPUT_NULL;
 442
 443         if (std_input == EXEC_INPUT_DATA && context->stdin_data_size == 0)
 444                 return EXEC_INPUT_NULL;
 445
 446         return std_input;
 447 }
 448
 449 static int fixup_output(ExecOutput std_output, int socket_fd) {
 450
 451         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 452                 return EXEC_OUTPUT_INHERIT;
 453
 454         return std_output;
 455 }
 456
 457 static int setup_input(
 458                 const ExecContext *context,
 459                 const ExecParameters *params,
 460                 int socket_fd,
 461                 int named_iofds[3]) {
 462
 463         ExecInput i;
 464
 465         assert(context);
 466         assert(params);
 467
 468         if (params->stdin_fd >= 0) {
 469                 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
 470                         return -errno;
 471
 472                 /* Try to make this the controlling tty, if it is a tty, and reset it */
 473                 if (isatty(STDIN_FILENO)) {
 474                         (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
 475                         (void) reset_terminal_fd(STDIN_FILENO, true);
 476                 }
 477
 478                 return STDIN_FILENO;
 479         }
 480
 481         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 482
 483         switch (i) {
 484
 485         case EXEC_INPUT_NULL:
 486                 return open_null_as(O_RDONLY, STDIN_FILENO);
 487
 488         case EXEC_INPUT_TTY:
 489         case EXEC_INPUT_TTY_FORCE:
 490         case EXEC_INPUT_TTY_FAIL: {
 491                 int fd;
 492
 493                 fd = acquire_terminal(exec_context_tty_path(context),
 494                                       i == EXEC_INPUT_TTY_FAIL  ? ACQUIRE_TERMINAL_TRY :
 495                                       i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE :
 496                                                                   ACQUIRE_TERMINAL_WAIT,
 497                                       USEC_INFINITY);
 498                 if (fd < 0)
 499                         return fd;
 500
 501                 return move_fd(fd, STDIN_FILENO, false);
 502         }
 503
 504         case EXEC_INPUT_SOCKET:
 505                 assert(socket_fd >= 0);
 506
 507                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 508
 509         case EXEC_INPUT_NAMED_FD:
 510                 assert(named_iofds[STDIN_FILENO] >= 0);
 511
 512                 (void) fd_nonblock(named_iofds[STDIN_FILENO], false);
 513                 return dup2(named_iofds[STDIN_FILENO], STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 514
 515         case EXEC_INPUT_DATA: {
 516                 int fd;
 517
 518                 fd = acquire_data_fd(context->stdin_data, context->stdin_data_size, 0);
 519                 if (fd < 0)
 520                         return fd;
 521
 522                 return move_fd(fd, STDIN_FILENO, false);
 523         }
 524
 525         case EXEC_INPUT_FILE: {
 526                 bool rw;
 527                 int fd;
 528
 529                 assert(context->stdio_file[STDIN_FILENO]);
 530
 531                 rw = (context->std_output == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDOUT_FILENO])) ||
 532                         (context->std_error == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDERR_FILENO]));
 533
 534                 fd = acquire_path(context->stdio_file[STDIN_FILENO], rw ? O_RDWR : O_RDONLY, 0666 & ~context->umask);
 535                 if (fd < 0)
 536                         return fd;
 537
 538                 return move_fd(fd, STDIN_FILENO, false);
 539         }
 540
 541         default:
 542                 assert_not_reached("Unknown input type");
 543         }
 544 }
 545
 546 static bool can_inherit_stderr_from_stdout(
 547                 const ExecContext *context,
 548                 ExecOutput o,
 549                 ExecOutput e) {
 550
 551         assert(context);
 552
 553         /* Returns true, if given the specified STDERR and STDOUT output we can directly dup() the stdout fd to the
 554          * stderr fd */
 555
 556         if (e == EXEC_OUTPUT_INHERIT)
 557                 return true;
 558         if (e != o)
 559                 return false;
 560
 561         if (e == EXEC_OUTPUT_NAMED_FD)
 562                 return streq_ptr(context->stdio_fdname[STDOUT_FILENO], context->stdio_fdname[STDERR_FILENO]);
 563
 564         if (IN_SET(e, EXEC_OUTPUT_FILE, EXEC_OUTPUT_FILE_APPEND))
 565                 return streq_ptr(context->stdio_file[STDOUT_FILENO], context->stdio_file[STDERR_FILENO]);
 566
 567         return true;
 568 }
 569
 570 static int setup_output(
 571                 const Unit *unit,
 572                 const ExecContext *context,
 573                 const ExecParameters *params,
 574                 int fileno,
 575                 int socket_fd,
 576                 int named_iofds[3],
 577                 const char *ident,
 578                 uid_t uid,
 579                 gid_t gid,
 580                 dev_t *journal_stream_dev,
 581                 ino_t *journal_stream_ino) {
 582
 583         ExecOutput o;
 584         ExecInput i;
 585         int r;
 586
 587         assert(unit);
 588         assert(context);
 589         assert(params);
 590         assert(ident);
 591         assert(journal_stream_dev);
 592         assert(journal_stream_ino);
 593
 594         if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
 595
 596                 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
 597                         return -errno;
 598
 599                 return STDOUT_FILENO;
 600         }
 601
 602         if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
 603                 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
 604                         return -errno;
 605
 606                 return STDERR_FILENO;
 607         }
 608
 609         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 610         o = fixup_output(context->std_output, socket_fd);
 611
 612         if (fileno == STDERR_FILENO) {
 613                 ExecOutput e;
 614                 e = fixup_output(context->std_error, socket_fd);
 615
 616                 /* This expects the input and output are already set up */
 617
 618                 /* Don't change the stderr file descriptor if we inherit all
 619                  * the way and are not on a tty */
 620                 if (e == EXEC_OUTPUT_INHERIT &&
 621                     o == EXEC_OUTPUT_INHERIT &&
 622                     i == EXEC_INPUT_NULL &&
 623                     !is_terminal_input(context->std_input) &&
 624                     getppid () != 1)
 625                         return fileno;
 626
 627                 /* Duplicate from stdout if possible */
 628                 if (can_inherit_stderr_from_stdout(context, o, e))
 629                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 630
 631                 o = e;
 632
 633         } else if (o == EXEC_OUTPUT_INHERIT) {
 634                 /* If input got downgraded, inherit the original value */
 635                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 636                         return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 637
 638                 /* If the input is connected to anything that's not a /dev/null or a data fd, inherit that... */
 639                 if (!IN_SET(i, EXEC_INPUT_NULL, EXEC_INPUT_DATA))
 640                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 641
 642                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 643                 if (getppid() != 1)
 644                         return fileno;
 645
 646                 /* We need to open /dev/null here anew, to get the right access mode. */
 647                 return open_null_as(O_WRONLY, fileno);
 648         }
 649
 650         switch (o) {
 651
 652         case EXEC_OUTPUT_NULL:
 653                 return open_null_as(O_WRONLY, fileno);
 654
 655         case EXEC_OUTPUT_TTY:
 656                 if (is_terminal_input(i))
 657                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 658
 659                 /* We don't reset the terminal if this is just about output */
 660                 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 661
 662         case EXEC_OUTPUT_SYSLOG:
 663         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 664         case EXEC_OUTPUT_KMSG:
 665         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 666         case EXEC_OUTPUT_JOURNAL:
 667         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 668                 r = connect_logger_as(unit, context, params, o, ident, fileno, uid, gid);
 669                 if (r < 0) {
 670                         log_unit_warning_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
 671                         r = open_null_as(O_WRONLY, fileno);
 672                 } else {
 673                         struct stat st;
 674
 675                         /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
 676                          * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
 677                          * services to detect whether they are connected to the journal or not.
 678                          *
 679                          * If both stdout and stderr are connected to a stream then let's make sure to store the data
 680                          * about STDERR as that's usually the best way to do logging. */
 681
 682                         if (fstat(fileno, &st) >= 0 &&
 683                             (*journal_stream_ino == 0 || fileno == STDERR_FILENO)) {
 684                                 *journal_stream_dev = st.st_dev;
 685                                 *journal_stream_ino = st.st_ino;
 686                         }
 687                 }
 688                 return r;
 689
 690         case EXEC_OUTPUT_SOCKET:
 691                 assert(socket_fd >= 0);
 692
 693                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 694
 695         case EXEC_OUTPUT_NAMED_FD:
 696                 assert(named_iofds[fileno] >= 0);
 697
 698                 (void) fd_nonblock(named_iofds[fileno], false);
 699                 return dup2(named_iofds[fileno], fileno) < 0 ? -errno : fileno;
 700
 701         case EXEC_OUTPUT_FILE:
 702         case EXEC_OUTPUT_FILE_APPEND: {
 703                 bool rw;
 704                 int fd, flags;
 705
 706                 assert(context->stdio_file[fileno]);
 707
 708                 rw = context->std_input == EXEC_INPUT_FILE &&
 709                         streq_ptr(context->stdio_file[fileno], context->stdio_file[STDIN_FILENO]);
 710
 711                 if (rw)
 712                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 713
 714                 flags = O_WRONLY;
 715                 if (o == EXEC_OUTPUT_FILE_APPEND)
 716                         flags |= O_APPEND;
 717
 718                 fd = acquire_path(context->stdio_file[fileno], flags, 0666 & ~context->umask);
 719                 if (fd < 0)
 720                         return fd;
 721
 722                 return move_fd(fd, fileno, 0);
 723         }
 724
 725         default:
 726                 assert_not_reached("Unknown error type");
 727         }
 728 }
 729
 730 static int chown_terminal(int fd, uid_t uid) {
 731         struct stat st;
 732
 733         assert(fd >= 0);
 734
 735         /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
 736         if (isatty(fd) < 1)
 737                 return 0;
 738
 739         /* This might fail. What matters are the results. */
 740         (void) fchown(fd, uid, -1);
 741         (void) fchmod(fd, TTY_MODE);
 742
 743         if (fstat(fd, &st) < 0)
 744                 return -errno;
 745
 746         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 747                 return -EPERM;
 748
 749         return 0;
 750 }
 751
 752 static int setup_confirm_stdio(const char *vc, int *_saved_stdin, int *_saved_stdout) {
 753         _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
 754         int r;
 755
 756         assert(_saved_stdin);
 757         assert(_saved_stdout);
 758
 759         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 760         if (saved_stdin < 0)
 761                 return -errno;
 762
 763         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 764         if (saved_stdout < 0)
 765                 return -errno;
 766
 767         fd = acquire_terminal(vc, ACQUIRE_TERMINAL_WAIT, DEFAULT_CONFIRM_USEC);
 768         if (fd < 0)
 769                 return fd;
 770
 771         r = chown_terminal(fd, getuid());
 772         if (r < 0)
 773                 return r;
 774
 775         r = reset_terminal_fd(fd, true);
 776         if (r < 0)
 777                 return r;
 778
 779         r = rearrange_stdio(fd, fd, STDERR_FILENO);
 780         fd = -1;
 781         if (r < 0)
 782                 return r;
 783
 784         *_saved_stdin = saved_stdin;
 785         *_saved_stdout = saved_stdout;
 786
 787         saved_stdin = saved_stdout = -1;
 788
 789         return 0;
 790 }
 791
 792 static void write_confirm_error_fd(int err, int fd, const Unit *u) {
 793         assert(err < 0);
 794
 795         if (err == -ETIMEDOUT)
 796                 dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);
 797         else {
 798                 errno = -err;
 799                 dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);
 800         }
 801 }
 802
 803 static void write_confirm_error(int err, const char *vc, const Unit *u) {
 804         _cleanup_close_ int fd = -1;
 805
 806         assert(vc);
 807
 808         fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);
 809         if (fd < 0)
 810                 return;
 811
 812         write_confirm_error_fd(err, fd, u);
 813 }
 814
 815 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
 816         int r = 0;
 817
 818         assert(saved_stdin);
 819         assert(saved_stdout);
 820
 821         release_terminal();
 822
 823         if (*saved_stdin >= 0)
 824                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 825                         r = -errno;
 826
 827         if (*saved_stdout >= 0)
 828                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 829                         r = -errno;
 830
 831         *saved_stdin = safe_close(*saved_stdin);
 832         *saved_stdout = safe_close(*saved_stdout);
 833
 834         return r;
 835 }
 836
 837 enum {
 838         CONFIRM_PRETEND_FAILURE = -1,
 839         CONFIRM_PRETEND_SUCCESS =  0,
 840         CONFIRM_EXECUTE = 1,
 841 };
 842
 843 static int ask_for_confirmation(const char *vc, Unit *u, const char *cmdline) {
 844         int saved_stdout = -1, saved_stdin = -1, r;
 845         _cleanup_free_ char *e = NULL;
 846         char c;
 847
 848         /* For any internal errors, assume a positive response. */
 849         r = setup_confirm_stdio(vc, &saved_stdin, &saved_stdout);
 850         if (r < 0) {
 851                 write_confirm_error(r, vc, u);
 852                 return CONFIRM_EXECUTE;
 853         }
 854
 855         /* confirm_spawn might have been disabled while we were sleeping. */
 856         if (manager_is_confirm_spawn_disabled(u->manager)) {
 857                 r = 1;
 858                 goto restore_stdio;
 859         }
 860
 861         e = ellipsize(cmdline, 60, 100);
 862         if (!e) {
 863                 log_oom();
 864                 r = CONFIRM_EXECUTE;
 865                 goto restore_stdio;
 866         }
 867
 868         for (;;) {
 869                 r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);
 870                 if (r < 0) {
 871                         write_confirm_error_fd(r, STDOUT_FILENO, u);
 872                         r = CONFIRM_EXECUTE;
 873                         goto restore_stdio;
 874                 }
 875
 876                 switch (c) {
 877                 case 'c':
 878                         printf("Resuming normal execution.\n");
 879                         manager_disable_confirm_spawn();
 880                         r = 1;
 881                         break;
 882                 case 'D':
 883                         unit_dump(u, stdout, "  ");
 884                         continue; /* ask again */
 885                 case 'f':
 886                         printf("Failing execution.\n");
 887                         r = CONFIRM_PRETEND_FAILURE;
 888                         break;
 889                 case 'h':
 890                         printf("  c - continue, proceed without asking anymore\n"
 891                                "  D - dump, show the state of the unit\n"
 892                                "  f - fail, don't execute the command and pretend it failed\n"
 893                                "  h - help\n"
 894                                "  i - info, show a short summary of the unit\n"
 895                                "  j - jobs, show jobs that are in progress\n"
 896                                "  s - skip, don't execute the command and pretend it succeeded\n"
 897                                "  y - yes, execute the command\n");
 898                         continue; /* ask again */
 899                 case 'i':
 900                         printf("  Description: %s\n"
 901                                "  Unit:        %s\n"
 902                                "  Command:     %s\n",
 903                                u->id, u->description, cmdline);
 904                         continue; /* ask again */
 905                 case 'j':
 906                         manager_dump_jobs(u->manager, stdout, "  ");
 907                         continue; /* ask again */
 908                 case 'n':
 909                         /* 'n' was removed in favor of 'f'. */
 910                         printf("Didn't understand 'n', did you mean 'f'?\n");
 911                         continue; /* ask again */
 912                 case 's':
 913                         printf("Skipping execution.\n");
 914                         r = CONFIRM_PRETEND_SUCCESS;
 915                         break;
 916                 case 'y':
 917                         r = CONFIRM_EXECUTE;
 918                         break;
 919                 default:
 920                         assert_not_reached("Unhandled choice");
 921                 }
 922                 break;
 923         }
 924
 925 restore_stdio:
 926         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 927         return r;
 928 }
 929
 930 static int get_fixed_user(const ExecContext *c, const char **user,
 931                           uid_t *uid, gid_t *gid,
 932                           const char **home, const char **shell) {
 933         int r;
 934         const char *name;
 935
 936         assert(c);
 937
 938         if (!c->user)
 939                 return 0;
 940
 941         /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway
 942          * (i.e. are "/" or "/bin/nologin"). */
 943
 944         name = c->user;
 945         r = get_user_creds(&name, uid, gid, home, shell, USER_CREDS_CLEAN);
 946         if (r < 0)
 947                 return r;
 948
 949         *user = name;
 950         return 0;
 951 }
 952
 953 static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {
 954         int r;
 955         const char *name;
 956
 957         assert(c);
 958
 959         if (!c->group)
 960                 return 0;
 961
 962         name = c->group;
 963         r = get_group_creds(&name, gid, 0);
 964         if (r < 0)
 965                 return r;
 966
 967         *group = name;
 968         return 0;
 969 }
 970
 971 static int get_supplementary_groups(const ExecContext *c, const char *user,
 972                                     const char *group, gid_t gid,
 973                                     gid_t **supplementary_gids, int *ngids) {
 974         char **i;
 975         int r, k = 0;
 976         int ngroups_max;
 977         bool keep_groups = false;
 978         gid_t *groups = NULL;
 979         _cleanup_free_ gid_t *l_gids = NULL;
 980
 981         assert(c);
 982
 983         /*
 984          * If user is given, then lookup GID and supplementary groups list.
 985          * We avoid NSS lookups for gid=0. Also we have to initialize groups
 986          * here and as early as possible so we keep the list of supplementary
 987          * groups of the caller.
 988          */
 989         if (user && gid_is_valid(gid) && gid != 0) {
 990                 /* First step, initialize groups from /etc/groups */
 991                 if (initgroups(user, gid) < 0)
 992                         return -errno;
 993
 994                 keep_groups = true;
 995         }
 996
 997         if (strv_isempty(c->supplementary_groups))
 998                 return 0;
 999
1000         /*
1001          * If SupplementaryGroups= was passed then NGROUPS_MAX has to
1002          * be positive, otherwise fail.
1003          */
1004         errno = 0;
1005         ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
1006         if (ngroups_max <= 0) {
1007                 if (errno > 0)
1008                         return -errno;
1009                 else
1010                         return -EOPNOTSUPP; /* For all other values */
1011         }
1012
1013         l_gids = new(gid_t, ngroups_max);
1014         if (!l_gids)
1015                 return -ENOMEM;
1016
1017         if (keep_groups) {
1018                 /*
1019                  * Lookup the list of groups that the user belongs to, we
1020                  * avoid NSS lookups here too for gid=0.
1021                  */
1022                 k = ngroups_max;
1023                 if (getgrouplist(user, gid, l_gids, &k) < 0)
1024                         return -EINVAL;
1025         } else
1026                 k = 0;
1027
1028         STRV_FOREACH(i, c->supplementary_groups) {
1029                 const char *g;
1030
1031                 if (k >= ngroups_max)
1032                         return -E2BIG;
1033
1034                 g = *i;
1035                 r = get_group_creds(&g, l_gids+k, 0);
1036                 if (r < 0)
1037                         return r;
1038
1039                 k++;
1040         }
1041
1042         /*
1043          * Sets ngids to zero to drop all supplementary groups, happens
1044          * when we are under root and SupplementaryGroups= is empty.
1045          */
1046         if (k == 0) {
1047                 *ngids = 0;
1048                 return 0;
1049         }
1050
1051         /* Otherwise get the final list of supplementary groups */
1052         groups = memdup(l_gids, sizeof(gid_t) * k);
1053         if (!groups)
1054                 return -ENOMEM;
1055
1056         *supplementary_gids = groups;
1057         *ngids = k;
1058
1059         groups = NULL;
1060
1061         return 0;
1062 }
1063
1064 static int enforce_groups(gid_t gid, const gid_t *supplementary_gids, int ngids) {
1065         int r;
1066
1067         /* Handle SupplementaryGroups= if it is not empty */
1068         if (ngids > 0) {
1069                 r = maybe_setgroups(ngids, supplementary_gids);
1070                 if (r < 0)
1071                         return r;
1072         }
1073
1074         if (gid_is_valid(gid)) {
1075                 /* Then set our gids */
1076                 if (setresgid(gid, gid, gid) < 0)
1077                         return -errno;
1078         }
1079
1080         return 0;
1081 }
1082
1083 static int enforce_user(const ExecContext *context, uid_t uid) {
1084         assert(context);
1085
1086         if (!uid_is_valid(uid))
1087                 return 0;
1088
1089         /* Sets (but doesn't look up) the uid and make sure we keep the
1090          * capabilities while doing so. */
1091
1092         if (context->capability_ambient_set != 0) {
1093
1094                 /* First step: If we need to keep capabilities but
1095                  * drop privileges we need to make sure we keep our
1096                  * caps, while we drop privileges. */
1097                 if (uid != 0) {
1098                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
1099
1100                         if (prctl(PR_GET_SECUREBITS) != sb)
1101                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
1102                                         return -errno;
1103                 }
1104         }
1105
1106         /* Second step: actually set the uids */
1107         if (setresuid(uid, uid, uid) < 0)
1108                 return -errno;
1109
1110         /* At this point we should have all necessary capabilities but
1111            are otherwise a normal user. However, the caps might got
1112            corrupted due to the setresuid() so we need clean them up
1113            later. This is done outside of this call. */
1114
1115         return 0;
1116 }
1117
1118 #if HAVE_PAM
1119
1120 static int null_conv(
1121                 int num_msg,
1122                 const struct pam_message **msg,
1123                 struct pam_response **resp,
1124                 void *appdata_ptr) {
1125
1126         /* We don't support conversations */
1127
1128         return PAM_CONV_ERR;
1129 }
1130
1131 #endif
1132
1133 static int setup_pam(
1134                 const char *name,
1135                 const char *user,
1136                 uid_t uid,
1137                 gid_t gid,
1138                 const char *tty,
1139                 char ***env,
1140                 int fds[], size_t n_fds) {
1141
1142 #if HAVE_PAM
1143
1144         static const struct pam_conv conv = {
1145                 .conv = null_conv,
1146                 .appdata_ptr = NULL
1147         };
1148
1149         _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
1150         pam_handle_t *handle = NULL;
1151         sigset_t old_ss;
1152         int pam_code = PAM_SUCCESS, r;
1153         char **nv, **e = NULL;
1154         bool close_session = false;
1155         pid_t pam_pid = 0, parent_pid;
1156         int flags = 0;
1157
1158         assert(name);
1159         assert(user);
1160         assert(env);
1161
1162         /* We set up PAM in the parent process, then fork. The child
1163          * will then stay around until killed via PR_GET_PDEATHSIG or
1164          * systemd via the cgroup logic. It will then remove the PAM
1165          * session again. The parent process will exec() the actual
1166          * daemon. We do things this way to ensure that the main PID
1167          * of the daemon is the one we initially fork()ed. */
1168
1169         r = barrier_create(&barrier);
1170         if (r < 0)
1171                 goto fail;
1172
1173         if (log_get_max_level() < LOG_DEBUG)
1174                 flags |= PAM_SILENT;
1175
1176         pam_code = pam_start(name, user, &conv, &handle);
1177         if (pam_code != PAM_SUCCESS) {
1178                 handle = NULL;
1179                 goto fail;
1180         }
1181
1182         if (!tty) {
1183                 _cleanup_free_ char *q = NULL;
1184
1185                 /* Hmm, so no TTY was explicitly passed, but an fd passed to us directly might be a TTY. Let's figure
1186                  * out if that's the case, and read the TTY off it. */
1187
1188                 if (getttyname_malloc(STDIN_FILENO, &q) >= 0)
1189                         tty = strjoina("/dev/", q);
1190         }
1191
1192         if (tty) {
1193                 pam_code = pam_set_item(handle, PAM_TTY, tty);
1194                 if (pam_code != PAM_SUCCESS)
1195                         goto fail;
1196         }
1197
1198         STRV_FOREACH(nv, *env) {
1199                 pam_code = pam_putenv(handle, *nv);
1200                 if (pam_code != PAM_SUCCESS)
1201                         goto fail;
1202         }
1203
1204         pam_code = pam_acct_mgmt(handle, flags);
1205         if (pam_code != PAM_SUCCESS)
1206                 goto fail;
1207
1208         pam_code = pam_open_session(handle, flags);
1209         if (pam_code != PAM_SUCCESS)
1210                 goto fail;
1211
1212         close_session = true;
1213
1214         e = pam_getenvlist(handle);
1215         if (!e) {
1216                 pam_code = PAM_BUF_ERR;
1217                 goto fail;
1218         }
1219
1220         /* Block SIGTERM, so that we know that it won't get lost in
1221          * the child */
1222
1223         assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
1224
1225         parent_pid = getpid_cached();
1226
1227         r = safe_fork("(sd-pam)", 0, &pam_pid);
1228         if (r < 0)
1229                 goto fail;
1230         if (r == 0) {
1231                 int sig, ret = EXIT_PAM;
1232
1233                 /* The child's job is to reset the PAM session on
1234                  * termination */
1235                 barrier_set_role(&barrier, BARRIER_CHILD);
1236
1237                 /* Make sure we don't keep open the passed fds in this child. We assume that otherwise only those fds
1238                  * are open here that have been opened by PAM. */
1239                 (void) close_many(fds, n_fds);
1240
1241                 /* Drop privileges - we don't need any to pam_close_session
1242                  * and this will make PR_SET_PDEATHSIG work in most cases.
1243                  * If this fails, ignore the error - but expect sd-pam threads
1244                  * to fail to exit normally */
1245
1246                 r = maybe_setgroups(0, NULL);
1247                 if (r < 0)
1248                         log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
1249                 if (setresgid(gid, gid, gid) < 0)
1250                         log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
1251                 if (setresuid(uid, uid, uid) < 0)
1252                         log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m");
1253
1254                 (void) ignore_signals(SIGPIPE, -1);
1255
1256                 /* Wait until our parent died. This will only work if
1257                  * the above setresuid() succeeds, otherwise the kernel
1258                  * will not allow unprivileged parents kill their privileged
1259                  * children this way. We rely on the control groups kill logic
1260                  * to do the rest for us. */
1261                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
1262                         goto child_finish;
1263
1264                 /* Tell the parent that our setup is done. This is especially
1265                  * important regarding dropping privileges. Otherwise, unit
1266                  * setup might race against our setresuid(2) call.
1267                  *
1268                  * If the parent aborted, we'll detect this below, hence ignore
1269                  * return failure here. */
1270                 (void) barrier_place(&barrier);
1271
1272                 /* Check if our parent process might already have died? */
1273                 if (getppid() == parent_pid) {
1274                         sigset_t ss;
1275
1276                         assert_se(sigemptyset(&ss) >= 0);
1277                         assert_se(sigaddset(&ss, SIGTERM) >= 0);
1278
1279                         for (;;) {
1280                                 if (sigwait(&ss, &sig) < 0) {
1281                                         if (errno == EINTR)
1282                                                 continue;
1283
1284                                         goto child_finish;
1285                                 }
1286
1287                                 assert(sig == SIGTERM);
1288                                 break;
1289                         }
1290                 }
1291
1292                 /* If our parent died we'll end the session */
1293                 if (getppid() != parent_pid) {
1294                         pam_code = pam_close_session(handle, flags);
1295                         if (pam_code != PAM_SUCCESS)
1296                                 goto child_finish;
1297                 }
1298
1299                 ret = 0;
1300
1301         child_finish:
1302                 pam_end(handle, pam_code | flags);
1303                 _exit(ret);
1304         }
1305
1306         barrier_set_role(&barrier, BARRIER_PARENT);
1307
1308         /* If the child was forked off successfully it will do all the
1309          * cleanups, so forget about the handle here. */
1310         handle = NULL;
1311
1312         /* Unblock SIGTERM again in the parent */
1313         assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
1314
1315         /* We close the log explicitly here, since the PAM modules
1316          * might have opened it, but we don't want this fd around. */
1317         closelog();
1318
1319         /* Synchronously wait for the child to initialize. We don't care for
1320          * errors as we cannot recover. However, warn loudly if it happens. */
1321         if (!barrier_place_and_sync(&barrier))
1322                 log_error("PAM initialization failed");
1323
1324         return strv_free_and_replace(*env, e);
1325
1326 fail:
1327         if (pam_code != PAM_SUCCESS) {
1328                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1329                 r = -EPERM;  /* PAM errors do not map to errno */
1330         } else
1331                 log_error_errno(r, "PAM failed: %m");
1332
1333         if (handle) {
1334                 if (close_session)
1335                         pam_code = pam_close_session(handle, flags);
1336
1337                 pam_end(handle, pam_code | flags);
1338         }
1339
1340         strv_free(e);
1341         closelog();
1342
1343         return r;
1344 #else
1345         return 0;
1346 #endif
1347 }
1348
1349 static void rename_process_from_path(const char *path) {
1350         char process_name[11];
1351         const char *p;
1352         size_t l;
1353
1354         /* This resulting string must fit in 10 chars (i.e. the length
1355          * of "/sbin/init") to look pretty in /bin/ps */
1356
1357         p = basename(path);
1358         if (isempty(p)) {
1359                 rename_process("(...)");
1360                 return;
1361         }
1362
1363         l = strlen(p);
1364         if (l > 8) {
1365                 /* The end of the process name is usually more
1366                  * interesting, since the first bit might just be
1367                  * "systemd-" */
1368                 p = p + l - 8;
1369                 l = 8;
1370         }
1371
1372         process_name[0] = '(';
1373         memcpy(process_name+1, p, l);
1374         process_name[1+l] = ')';
1375         process_name[1+l+1] = 0;
1376
1377         rename_process(process_name);
1378 }
1379
1380 static bool context_has_address_families(const ExecContext *c) {
1381         assert(c);
1382
1383         return c->address_families_whitelist ||
1384                 !set_isempty(c->address_families);
1385 }
1386
1387 static bool context_has_syscall_filters(const ExecContext *c) {
1388         assert(c);
1389
1390         return c->syscall_whitelist ||
1391                 !hashmap_isempty(c->syscall_filter);
1392 }
1393
1394 static bool context_has_no_new_privileges(const ExecContext *c) {
1395         assert(c);
1396
1397         if (c->no_new_privileges)
1398                 return true;
1399
1400         if (have_effective_cap(CAP_SYS_ADMIN)) /* if we are privileged, we don't need NNP */
1401                 return false;
1402
1403         /* We need NNP if we have any form of seccomp and are unprivileged */
1404         return context_has_address_families(c) ||
1405                 c->memory_deny_write_execute ||
1406                 c->restrict_realtime ||
1407                 exec_context_restrict_namespaces_set(c) ||
1408                 c->protect_kernel_tunables ||
1409                 c->protect_kernel_modules ||
1410                 c->private_devices ||
1411                 context_has_syscall_filters(c) ||
1412                 !set_isempty(c->syscall_archs) ||
1413                 c->lock_personality ||
1414                 c->protect_hostname;
1415 }
1416
1417 #if HAVE_SECCOMP
1418
1419 static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
1420
1421         if (is_seccomp_available())
1422                 return false;
1423
1424         log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
1425         return true;
1426 }
1427
1428 static int apply_syscall_filter(const Unit* u, const ExecContext *c, bool needs_ambient_hack) {
1429         uint32_t negative_action, default_action, action;
1430         int r;
1431
1432         assert(u);
1433         assert(c);
1434
1435         if (!context_has_syscall_filters(c))
1436                 return 0;
1437
1438         if (skip_seccomp_unavailable(u, "SystemCallFilter="))
1439                 return 0;
1440
1441         negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
1442
1443         if (c->syscall_whitelist) {
1444                 default_action = negative_action;
1445                 action = SCMP_ACT_ALLOW;
1446         } else {
1447                 default_action = SCMP_ACT_ALLOW;
1448                 action = negative_action;
1449         }
1450
1451         if (needs_ambient_hack) {
1452                 r = seccomp_filter_set_add(c->syscall_filter, c->syscall_whitelist, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID);
1453                 if (r < 0)
1454                         return r;
1455         }
1456
1457         return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false);
1458 }
1459
1460 static int apply_syscall_archs(const Unit *u, const ExecContext *c) {
1461         assert(u);
1462         assert(c);
1463
1464         if (set_isempty(c->syscall_archs))
1465                 return 0;
1466
1467         if (skip_seccomp_unavailable(u, "SystemCallArchitectures="))
1468                 return 0;
1469
1470         return seccomp_restrict_archs(c->syscall_archs);
1471 }
1472
1473 static int apply_address_families(const Unit* u, const ExecContext *c) {
1474         assert(u);
1475         assert(c);
1476
1477         if (!context_has_address_families(c))
1478                 return 0;
1479
1480         if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1481                 return 0;
1482
1483         return seccomp_restrict_address_families(c->address_families, c->address_families_whitelist);
1484 }
1485
1486 static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
1487         assert(u);
1488         assert(c);
1489
1490         if (!c->memory_deny_write_execute)
1491                 return 0;
1492
1493         if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1494                 return 0;
1495
1496         return seccomp_memory_deny_write_execute();
1497 }
1498
1499 static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
1500         assert(u);
1501         assert(c);
1502
1503         if (!c->restrict_realtime)
1504                 return 0;
1505
1506         if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1507                 return 0;
1508
1509         return seccomp_restrict_realtime();
1510 }
1511
1512 static int apply_protect_sysctl(const Unit *u, const ExecContext *c) {
1513         assert(u);
1514         assert(c);
1515
1516         /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1517          * let's protect even those systems where this is left on in the kernel. */
1518
1519         if (!c->protect_kernel_tunables)
1520                 return 0;
1521
1522         if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1523                 return 0;
1524
1525         return seccomp_protect_sysctl();
1526 }
1527
1528 static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
1529         assert(u);
1530         assert(c);
1531
1532         /* Turn off module syscalls on ProtectKernelModules=yes */
1533
1534         if (!c->protect_kernel_modules)
1535                 return 0;
1536
1537         if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
1538                 return 0;
1539
1540         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM), false);
1541 }
1542
1543 static int apply_private_devices(const Unit *u, const ExecContext *c) {
1544         assert(u);
1545         assert(c);
1546
1547         /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */
1548
1549         if (!c->private_devices)
1550                 return 0;
1551
1552         if (skip_seccomp_unavailable(u, "PrivateDevices="))
1553                 return 0;
1554
1555         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM), false);
1556 }
1557
1558 static int apply_restrict_namespaces(const Unit *u, const ExecContext *c) {
1559         assert(u);
1560         assert(c);
1561
1562         if (!exec_context_restrict_namespaces_set(c))
1563                 return 0;
1564
1565         if (skip_seccomp_unavailable(u, "RestrictNamespaces="))
1566                 return 0;
1567
1568         return seccomp_restrict_namespaces(c->restrict_namespaces);
1569 }
1570
1571 static int apply_lock_personality(const Unit* u, const ExecContext *c) {
1572         unsigned long personality;
1573         int r;
1574
1575         assert(u);
1576         assert(c);
1577
1578         if (!c->lock_personality)
1579                 return 0;
1580
1581         if (skip_seccomp_unavailable(u, "LockPersonality="))
1582                 return 0;
1583
1584         personality = c->personality;
1585
1586         /* If personality is not specified, use either PER_LINUX or PER_LINUX32 depending on what is currently set. */
1587         if (personality == PERSONALITY_INVALID) {
1588
1589                 r = opinionated_personality(&personality);
1590                 if (r < 0)
1591                         return r;
1592         }
1593
1594         return seccomp_lock_personality(personality);
1595 }
1596
1597 #endif
1598
1599 static void do_idle_pipe_dance(int idle_pipe[static 4]) {
1600         assert(idle_pipe);
1601
1602         idle_pipe[1] = safe_close(idle_pipe[1]);
1603         idle_pipe[2] = safe_close(idle_pipe[2]);
1604
1605         if (idle_pipe[0] >= 0) {
1606                 int r;
1607
1608                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1609
1610                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1611                         ssize_t n;
1612
1613                         /* Signal systemd that we are bored and want to continue. */
1614                         n = write(idle_pipe[3], "x", 1);
1615                         if (n > 0)
1616                                 /* Wait for systemd to react to the signal above. */
1617                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1618                 }
1619
1620                 idle_pipe[0] = safe_close(idle_pipe[0]);
1621
1622         }
1623
1624         idle_pipe[3] = safe_close(idle_pipe[3]);
1625 }
1626
1627 static const char *exec_directory_env_name_to_string(ExecDirectoryType t);
1628
1629 static int build_environment(
1630                 const Unit *u,
1631                 const ExecContext *c,
1632                 const ExecParameters *p,
1633                 size_t n_fds,
1634                 const char *home,
1635                 const char *username,
1636                 const char *shell,
1637                 dev_t journal_stream_dev,
1638                 ino_t journal_stream_ino,
1639                 char ***ret) {
1640
1641         _cleanup_strv_free_ char **our_env = NULL;
1642         ExecDirectoryType t;
1643         size_t n_env = 0;
1644         char *x;
1645
1646         assert(u);
1647         assert(c);
1648         assert(p);
1649         assert(ret);
1650
1651         our_env = new0(char*, 14 + _EXEC_DIRECTORY_TYPE_MAX);
1652         if (!our_env)
1653                 return -ENOMEM;
1654
1655         if (n_fds > 0) {
1656                 _cleanup_free_ char *joined = NULL;
1657
1658                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid_cached()) < 0)
1659                         return -ENOMEM;
1660                 our_env[n_env++] = x;
1661
1662                 if (asprintf(&x, "LISTEN_FDS=%zu", n_fds) < 0)
1663                         return -ENOMEM;
1664                 our_env[n_env++] = x;
1665
1666                 joined = strv_join(p->fd_names, ":");
1667                 if (!joined)
1668                         return -ENOMEM;
1669
1670                 x = strjoin("LISTEN_FDNAMES=", joined);
1671                 if (!x)
1672                         return -ENOMEM;
1673                 our_env[n_env++] = x;
1674         }
1675
1676         if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
1677                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid_cached()) < 0)
1678                         return -ENOMEM;
1679                 our_env[n_env++] = x;
1680
1681                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1682                         return -ENOMEM;
1683                 our_env[n_env++] = x;
1684         }
1685
1686         /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use D-Bus look up dynamic
1687          * users via PID 1, possibly dead-locking the dbus daemon. This way it will not use D-Bus to resolve names, but
1688          * check the database directly. */
1689         if (p->flags & EXEC_NSS_BYPASS_BUS) {
1690                 x = strdup("SYSTEMD_NSS_BYPASS_BUS=1");
1691                 if (!x)
1692                         return -ENOMEM;
1693                 our_env[n_env++] = x;
1694         }
1695
1696         if (home) {
1697                 x = strappend("HOME=", home);
1698                 if (!x)
1699                         return -ENOMEM;
1700                 our_env[n_env++] = x;
1701         }
1702
1703         if (username) {
1704                 x = strappend("LOGNAME=", username);
1705                 if (!x)
1706                         return -ENOMEM;
1707                 our_env[n_env++] = x;
1708
1709                 x = strappend("USER=", username);
1710                 if (!x)
1711                         return -ENOMEM;
1712                 our_env[n_env++] = x;
1713         }
1714
1715         if (shell) {
1716                 x = strappend("SHELL=", shell);
1717                 if (!x)
1718                         return -ENOMEM;
1719                 our_env[n_env++] = x;
1720         }
1721
1722         if (!sd_id128_is_null(u->invocation_id)) {
1723                 if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0)
1724                         return -ENOMEM;
1725
1726                 our_env[n_env++] = x;
1727         }
1728
1729         if (exec_context_needs_term(c)) {
1730                 const char *tty_path, *term = NULL;
1731
1732                 tty_path = exec_context_tty_path(c);
1733
1734                 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try to inherit
1735                  * the $TERM set for PID 1. This is useful for containers so that the $TERM the container manager
1736                  * passes to PID 1 ends up all the way in the console login shown. */
1737
1738                 if (path_equal(tty_path, "/dev/console") && getppid() == 1)
1739                         term = getenv("TERM");
1740                 if (!term)
1741                         term = default_term_for_tty(tty_path);
1742
1743                 x = strappend("TERM=", term);
1744                 if (!x)
1745                         return -ENOMEM;
1746                 our_env[n_env++] = x;
1747         }
1748
1749         if (journal_stream_dev != 0 && journal_stream_ino != 0) {
1750                 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
1751                         return -ENOMEM;
1752
1753                 our_env[n_env++] = x;
1754         }
1755
1756         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
1757                 _cleanup_free_ char *pre = NULL, *joined = NULL;
1758                 const char *n;
1759
1760                 if (!p->prefix[t])
1761                         continue;
1762
1763                 if (strv_isempty(c->directories[t].paths))
1764                         continue;
1765
1766                 n = exec_directory_env_name_to_string(t);
1767                 if (!n)
1768                         continue;
1769
1770                 pre = strjoin(p->prefix[t], "/");
1771                 if (!pre)
1772                         return -ENOMEM;
1773
1774                 joined = strv_join_prefix(c->directories[t].paths, ":", pre);
1775                 if (!joined)
1776                         return -ENOMEM;
1777
1778                 x = strjoin(n, "=", joined);
1779                 if (!x)
1780                         return -ENOMEM;
1781
1782                 our_env[n_env++] = x;
1783         }
1784
1785         our_env[n_env++] = NULL;
1786         assert(n_env <= 14 + _EXEC_DIRECTORY_TYPE_MAX);
1787
1788         *ret = TAKE_PTR(our_env);
1789
1790         return 0;
1791 }
1792
1793 static int build_pass_environment(const ExecContext *c, char ***ret) {
1794         _cleanup_strv_free_ char **pass_env = NULL;
1795         size_t n_env = 0, n_bufsize = 0;
1796         char **i;
1797
1798         STRV_FOREACH(i, c->pass_environment) {
1799                 _cleanup_free_ char *x = NULL;
1800                 char *v;
1801
1802                 v = getenv(*i);
1803                 if (!v)
1804                         continue;
1805                 x = strjoin(*i, "=", v);
1806                 if (!x)
1807                         return -ENOMEM;
1808
1809                 if (!GREEDY_REALLOC(pass_env, n_bufsize, n_env + 2))
1810                         return -ENOMEM;
1811
1812                 pass_env[n_env++] = TAKE_PTR(x);
1813                 pass_env[n_env] = NULL;
1814         }
1815
1816         *ret = TAKE_PTR(pass_env);
1817
1818         return 0;
1819 }
1820
1821 static bool exec_needs_mount_namespace(
1822                 const ExecContext *context,
1823                 const ExecParameters *params,
1824                 const ExecRuntime *runtime) {
1825
1826         assert(context);
1827         assert(params);
1828
1829         if (context->root_image)
1830                 return true;
1831
1832         if (!strv_isempty(context->read_write_paths) ||
1833             !strv_isempty(context->read_only_paths) ||
1834             !strv_isempty(context->inaccessible_paths))
1835                 return true;
1836
1837         if (context->n_bind_mounts > 0)
1838                 return true;
1839
1840         if (context->n_temporary_filesystems > 0)
1841                 return true;
1842
1843         if (!IN_SET(context->mount_flags, 0, MS_SHARED))
1844                 return true;
1845
1846         if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
1847                 return true;
1848
1849         if (context->private_devices ||
1850             context->private_mounts ||
1851             context->protect_system != PROTECT_SYSTEM_NO ||
1852             context->protect_home != PROTECT_HOME_NO ||
1853             context->protect_kernel_tunables ||
1854             context->protect_kernel_modules ||
1855             context->protect_control_groups)
1856                 return true;
1857
1858         if (context->root_directory) {
1859                 ExecDirectoryType t;
1860
1861                 if (context->mount_apivfs)
1862                         return true;
1863
1864                 for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
1865                         if (!params->prefix[t])
1866                                 continue;
1867
1868                         if (!strv_isempty(context->directories[t].paths))
1869                                 return true;
1870                 }
1871         }
1872
1873         if (context->dynamic_user &&
1874             (!strv_isempty(context->directories[EXEC_DIRECTORY_STATE].paths) ||
1875              !strv_isempty(context->directories[EXEC_DIRECTORY_CACHE].paths) ||
1876              !strv_isempty(context->directories[EXEC_DIRECTORY_LOGS].paths)))
1877                 return true;
1878
1879         return false;
1880 }
1881
1882 static int setup_private_users(uid_t uid, gid_t gid) {
1883         _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
1884         _cleanup_close_pair_ int errno_pipe[2] = { -1, -1 };
1885         _cleanup_close_ int unshare_ready_fd = -1;
1886         _cleanup_(sigkill_waitp) pid_t pid = 0;
1887         uint64_t c = 1;
1888         ssize_t n;
1889         int r;
1890
1891         /* Set up a user namespace and map root to root, the selected UID/GID to itself, and everything else to
1892          * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
1893          * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
1894          * which waits for the parent to create the new user namespace while staying in the original namespace. The
1895          * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
1896          * continues execution normally. */
1897
1898         if (uid != 0 && uid_is_valid(uid)) {
1899                 r = asprintf(&uid_map,
1900                              "0 0 1\n"                      /* Map root → root */
1901                              UID_FMT " " UID_FMT " 1\n",    /* Map $UID → $UID */
1902                              uid, uid);
1903                 if (r < 0)
1904                         return -ENOMEM;
1905         } else {
1906                 uid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1907                 if (!uid_map)
1908                         return -ENOMEM;
1909         }
1910
1911         if (gid != 0 && gid_is_valid(gid)) {
1912                 r = asprintf(&gid_map,
1913                              "0 0 1\n"                      /* Map root → root */
1914                              GID_FMT " " GID_FMT " 1\n",    /* Map $GID → $GID */
1915                              gid, gid);
1916                 if (r < 0)
1917                         return -ENOMEM;
1918         } else {
1919                 gid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1920                 if (!gid_map)
1921                         return -ENOMEM;
1922         }
1923
1924         /* Create a communication channel so that the parent can tell the child when it finished creating the user
1925          * namespace. */
1926         unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
1927         if (unshare_ready_fd < 0)
1928                 return -errno;
1929
1930         /* Create a communication channel so that the child can tell the parent a proper error code in case it
1931          * failed. */
1932         if (pipe2(errno_pipe, O_CLOEXEC) < 0)
1933                 return -errno;
1934
1935         r = safe_fork("(sd-userns)", FORK_RESET_SIGNALS|FORK_DEATHSIG, &pid);
1936         if (r < 0)
1937                 return r;
1938         if (r == 0) {
1939                 _cleanup_close_ int fd = -1;
1940                 const char *a;
1941                 pid_t ppid;
1942
1943                 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
1944                  * here, after the parent opened its own user namespace. */
1945
1946                 ppid = getppid();
1947                 errno_pipe[0] = safe_close(errno_pipe[0]);
1948
1949                 /* Wait until the parent unshared the user namespace */
1950                 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
1951                         r = -errno;
1952                         goto child_fail;
1953                 }
1954
1955                 /* Disable the setgroups() system call in the child user namespace, for good. */
1956                 a = procfs_file_alloca(ppid, "setgroups");
1957                 fd = open(a, O_WRONLY|O_CLOEXEC);
1958                 if (fd < 0) {
1959                         if (errno != ENOENT) {
1960                                 r = -errno;
1961                                 goto child_fail;
1962                         }
1963
1964                         /* If the file is missing the kernel is too old, let's continue anyway. */
1965                 } else {
1966                         if (write(fd, "deny\n", 5) < 0) {
1967                                 r = -errno;
1968                                 goto child_fail;
1969                         }
1970
1971                         fd = safe_close(fd);
1972                 }
1973
1974                 /* First write the GID map */
1975                 a = procfs_file_alloca(ppid, "gid_map");
1976                 fd = open(a, O_WRONLY|O_CLOEXEC);
1977                 if (fd < 0) {
1978                         r = -errno;
1979                         goto child_fail;
1980                 }
1981                 if (write(fd, gid_map, strlen(gid_map)) < 0) {
1982                         r = -errno;
1983                         goto child_fail;
1984                 }
1985                 fd = safe_close(fd);
1986
1987                 /* The write the UID map */
1988                 a = procfs_file_alloca(ppid, "uid_map");
1989                 fd = open(a, O_WRONLY|O_CLOEXEC);
1990                 if (fd < 0) {
1991                         r = -errno;
1992                         goto child_fail;
1993                 }
1994                 if (write(fd, uid_map, strlen(uid_map)) < 0) {
1995                         r = -errno;
1996                         goto child_fail;
1997                 }
1998
1999                 _exit(EXIT_SUCCESS);
2000
2001         child_fail:
2002                 (void) write(errno_pipe[1], &r, sizeof(r));
2003                 _exit(EXIT_FAILURE);
2004         }
2005
2006         errno_pipe[1] = safe_close(errno_pipe[1]);
2007
2008         if (unshare(CLONE_NEWUSER) < 0)
2009                 return -errno;
2010
2011         /* Let the child know that the namespace is ready now */
2012         if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
2013                 return -errno;
2014
2015         /* Try to read an error code from the child */
2016         n = read(errno_pipe[0], &r, sizeof(r));
2017         if (n < 0)
2018                 return -errno;
2019         if (n == sizeof(r)) { /* an error code was sent to us */
2020                 if (r < 0)
2021                         return r;
2022                 return -EIO;
2023         }
2024         if (n != 0) /* on success we should have read 0 bytes */
2025                 return -EIO;
2026
2027         r = wait_for_terminate_and_check("(sd-userns)", pid, 0);
2028         pid = 0;
2029         if (r < 0)
2030                 return r;
2031         if (r != EXIT_SUCCESS) /* If something strange happened with the child, let's consider this fatal, too */
2032                 return -EIO;
2033
2034         return 0;
2035 }
2036
2037 static int setup_exec_directory(
2038                 const ExecContext *context,
2039                 const ExecParameters *params,
2040                 uid_t uid,
2041                 gid_t gid,
2042                 ExecDirectoryType type,
2043                 int *exit_status) {
2044
2045         static const int exit_status_table[_EXEC_DIRECTORY_TYPE_MAX] = {
2046                 [EXEC_DIRECTORY_RUNTIME] = EXIT_RUNTIME_DIRECTORY,
2047                 [EXEC_DIRECTORY_STATE] = EXIT_STATE_DIRECTORY,
2048                 [EXEC_DIRECTORY_CACHE] = EXIT_CACHE_DIRECTORY,
2049                 [EXEC_DIRECTORY_LOGS] = EXIT_LOGS_DIRECTORY,
2050                 [EXEC_DIRECTORY_CONFIGURATION] = EXIT_CONFIGURATION_DIRECTORY,
2051         };
2052         char **rt;
2053         int r;
2054
2055         assert(context);
2056         assert(params);
2057         assert(type >= 0 && type < _EXEC_DIRECTORY_TYPE_MAX);
2058         assert(exit_status);
2059
2060         if (!params->prefix[type])
2061                 return 0;
2062
2063         if (params->flags & EXEC_CHOWN_DIRECTORIES) {
2064                 if (!uid_is_valid(uid))
2065                         uid = 0;
2066                 if (!gid_is_valid(gid))
2067                         gid = 0;
2068         }
2069
2070         STRV_FOREACH(rt, context->directories[type].paths) {
2071                 _cleanup_free_ char *p = NULL, *pp = NULL;
2072
2073                 p = strjoin(params->prefix[type], "/", *rt);
2074                 if (!p) {
2075                         r = -ENOMEM;
2076                         goto fail;
2077                 }
2078
2079                 r = mkdir_parents_label(p, 0755);
2080                 if (r < 0)
2081                         goto fail;
2082
2083                 if (context->dynamic_user &&
2084                     !IN_SET(type, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION)) {
2085                         _cleanup_free_ char *private_root = NULL;
2086
2087                         /* So, here's one extra complication when dealing with DynamicUser=1 units. In that case we
2088                          * want to avoid leaving a directory around fully accessible that is owned by a dynamic user
2089                          * whose UID is later on reused. To lock this down we use the same trick used by container
2090                          * managers to prohibit host users to get access to files of the same UID in containers: we
2091                          * place everything inside a directory that has an access mode of 0700 and is owned root:root,
2092                          * so that it acts as security boundary for unprivileged host code. We then use fs namespacing
2093                          * to make this directory permeable for the service itself.
2094                          *
2095                          * Specifically: for a service which wants a special directory "foo/" we first create a
2096                          * directory "private/" with access mode 0700 owned by root:root. Then we place "foo" inside of
2097                          * that directory (i.e. "private/foo/"), and make "foo" a symlink to "private/foo". This way,
2098                          * privileged host users can access "foo/" as usual, but unprivileged host users can't look
2099                          * into it. Inside of the namespaceof the container "private/" is replaced by a more liberally
2100                          * accessible tmpfs, into which the host's "private/foo/" is mounted under the same name, thus
2101                          * disabling the access boundary for the service and making sure it only gets access to the
2102                          * dirs it needs but no others. Tricky? Yes, absolutely, but it works!
2103                          *
2104                          * Note that we don't do this for EXEC_DIRECTORY_CONFIGURATION as that's assumed not to be
2105                          * owned by the service itself.
2106                          * Also, note that we don't do this for EXEC_DIRECTORY_RUNTIME as that's often used for sharing
2107                          * files or sockets with other services. */
2108
2109                         private_root = strjoin(params->prefix[type], "/private");
2110                         if (!private_root) {
2111                                 r = -ENOMEM;
2112                                 goto fail;
2113                         }
2114
2115                         /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */
2116                         r = mkdir_safe_label(private_root, 0700, 0, 0, MKDIR_WARN_MODE);
2117                         if (r < 0)
2118                                 goto fail;
2119
2120                         pp = strjoin(private_root, "/", *rt);
2121                         if (!pp) {
2122                                 r = -ENOMEM;
2123                                 goto fail;
2124                         }
2125
2126                         /* Create all directories between the configured directory and this private root, and mark them 0755 */
2127                         r = mkdir_parents_label(pp, 0755);
2128                         if (r < 0)
2129                                 goto fail;
2130
2131                         if (is_dir(p, false) > 0 &&
2132                             (laccess(pp, F_OK) < 0 && errno == ENOENT)) {
2133
2134                                 /* Hmm, the private directory doesn't exist yet, but the normal one exists? If so, move
2135                                  * it over. Most likely the service has been upgraded from one that didn't use
2136                                  * DynamicUser=1, to one that does. */
2137
2138                                 if (rename(p, pp) < 0) {
2139                                         r = -errno;
2140                                         goto fail;
2141                                 }
2142                         } else {
2143                                 /* Otherwise, create the actual directory for the service */
2144
2145                                 r = mkdir_label(pp, context->directories[type].mode);
2146                                 if (r < 0 && r != -EEXIST)
2147                                         goto fail;
2148                         }
2149
2150                         /* And link it up from the original place */
2151                         r = symlink_idempotent(pp, p, true);
2152                         if (r < 0)
2153                                 goto fail;
2154
2155                         /* Lock down the access mode */
2156                         if (chmod(pp, context->directories[type].mode) < 0) {
2157                                 r = -errno;
2158                                 goto fail;
2159                         }
2160                 } else {
2161                         r = mkdir_label(p, context->directories[type].mode);
2162                         if (r < 0 && r != -EEXIST)
2163                                 goto fail;
2164                         if (r == -EEXIST) {
2165                                 struct stat st;
2166
2167                                 if (stat(p, &st) < 0) {
2168                                         r = -errno;
2169                                         goto fail;
2170                                 }
2171                                 if (((st.st_mode ^ context->directories[type].mode) & 07777) != 0)
2172                                         log_warning("%s \'%s\' already exists but the mode is different. "
2173                                                     "(filesystem: %o %sMode: %o)",
2174                                                     exec_directory_type_to_string(type), *rt,
2175                                                     st.st_mode & 07777, exec_directory_type_to_string(type), context->directories[type].mode & 07777);
2176                                 if (!context->dynamic_user)
2177                                         continue;
2178                         }
2179                 }
2180
2181                 /* Don't change the owner of the configuration directory, as in the common case it is not written to by
2182                  * a service, and shall not be writable. */
2183                 if (type == EXEC_DIRECTORY_CONFIGURATION)
2184                         continue;
2185
2186                 /* Then, change the ownership of the whole tree, if necessary */
2187                 r = path_chown_recursive(pp ?: p, uid, gid);
2188                 if (r < 0)
2189                         goto fail;
2190         }
2191
2192         return 0;
2193
2194 fail:
2195         *exit_status = exit_status_table[type];
2196         return r;
2197 }
2198
2199 #if ENABLE_SMACK
2200 static int setup_smack(
2201                 const ExecContext *context,
2202                 const ExecCommand *command) {
2203
2204         int r;
2205
2206         assert(context);
2207         assert(command);
2208
2209         if (context->smack_process_label) {
2210                 r = mac_smack_apply_pid(0, context->smack_process_label);
2211                 if (r < 0)
2212                         return r;
2213         }
2214 #ifdef SMACK_DEFAULT_PROCESS_LABEL
2215         else {
2216                 _cleanup_free_ char *exec_label = NULL;
2217
2218                 r = mac_smack_read(command->path, SMACK_ATTR_EXEC, &exec_label);
2219                 if (r < 0 && !IN_SET(r, -ENODATA, -EOPNOTSUPP))
2220                         return r;
2221
2222                 r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
2223                 if (r < 0)
2224                         return r;
2225         }
2226 #endif
2227
2228         return 0;
2229 }
2230 #endif
2231
2232 static int compile_bind_mounts(
2233                 const ExecContext *context,
2234                 const ExecParameters *params,
2235                 BindMount **ret_bind_mounts,
2236                 size_t *ret_n_bind_mounts,
2237                 char ***ret_empty_directories) {
2238
2239         _cleanup_strv_free_ char **empty_directories = NULL;
2240         BindMount *bind_mounts;
2241         size_t n, h = 0, i;
2242         ExecDirectoryType t;
2243         int r;
2244
2245         assert(context);
2246         assert(params);
2247         assert(ret_bind_mounts);
2248         assert(ret_n_bind_mounts);
2249         assert(ret_empty_directories);
2250
2251         n = context->n_bind_mounts;
2252         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2253                 if (!params->prefix[t])
2254                         continue;
2255
2256                 n += strv_length(context->directories[t].paths);
2257         }
2258
2259         if (n <= 0) {
2260                 *ret_bind_mounts = NULL;
2261                 *ret_n_bind_mounts = 0;
2262                 *ret_empty_directories = NULL;
2263                 return 0;
2264         }
2265
2266         bind_mounts = new(BindMount, n);
2267         if (!bind_mounts)
2268                 return -ENOMEM;
2269
2270         for (i = 0; i < context->n_bind_mounts; i++) {
2271                 BindMount *item = context->bind_mounts + i;
2272                 char *s, *d;
2273
2274                 s = strdup(item->source);
2275                 if (!s) {
2276                         r = -ENOMEM;
2277                         goto finish;
2278                 }
2279
2280                 d = strdup(item->destination);
2281                 if (!d) {
2282                         free(s);
2283                         r = -ENOMEM;
2284                         goto finish;
2285                 }
2286
2287                 bind_mounts[h++] = (BindMount) {
2288                         .source = s,
2289                         .destination = d,
2290                         .read_only = item->read_only,
2291                         .recursive = item->recursive,
2292                         .ignore_enoent = item->ignore_enoent,
2293                 };
2294         }
2295
2296         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2297                 char **suffix;
2298
2299                 if (!params->prefix[t])
2300                         continue;
2301
2302                 if (strv_isempty(context->directories[t].paths))
2303                         continue;
2304
2305                 if (context->dynamic_user &&
2306                     !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) &&
2307                     !(context->root_directory || context->root_image)) {
2308                         char *private_root;
2309
2310                         /* So this is for a dynamic user, and we need to make sure the process can access its own
2311                          * directory. For that we overmount the usually inaccessible "private" subdirectory with a
2312                          * tmpfs that makes it accessible and is empty except for the submounts we do this for. */
2313
2314                         private_root = strjoin(params->prefix[t], "/private");
2315                         if (!private_root) {
2316                                 r = -ENOMEM;
2317                                 goto finish;
2318                         }
2319
2320                         r = strv_consume(&empty_directories, private_root);
2321                         if (r < 0)
2322                                 goto finish;
2323                 }
2324
2325                 STRV_FOREACH(suffix, context->directories[t].paths) {
2326                         char *s, *d;
2327
2328                         if (context->dynamic_user &&
2329                             !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION))
2330                                 s = strjoin(params->prefix[t], "/private/", *suffix);
2331                         else
2332                                 s = strjoin(params->prefix[t], "/", *suffix);
2333                         if (!s) {
2334                                 r = -ENOMEM;
2335                                 goto finish;
2336                         }
2337
2338                         if (context->dynamic_user &&
2339                             !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) &&
2340                             (context->root_directory || context->root_image))
2341                                 /* When RootDirectory= or RootImage= are set, then the symbolic link to the private
2342                                  * directory is not created on the root directory. So, let's bind-mount the directory
2343                                  * on the 'non-private' place. */
2344                                 d = strjoin(params->prefix[t], "/", *suffix);
2345                         else
2346                                 d = strdup(s);
2347                         if (!d) {
2348                                 free(s);
2349                                 r = -ENOMEM;
2350                                 goto finish;
2351                         }
2352
2353                         bind_mounts[h++] = (BindMount) {
2354                                 .source = s,
2355                                 .destination = d,
2356                                 .read_only = false,
2357                                 .recursive = true,
2358                                 .ignore_enoent = false,
2359                         };
2360                 }
2361         }
2362
2363         assert(h == n);
2364
2365         *ret_bind_mounts = bind_mounts;
2366         *ret_n_bind_mounts = n;
2367         *ret_empty_directories = TAKE_PTR(empty_directories);
2368
2369         return (int) n;
2370
2371 finish:
2372         bind_mount_free_many(bind_mounts, h);
2373         return r;
2374 }
2375
2376 static int apply_mount_namespace(
2377                 const Unit *u,
2378                 const ExecCommand *command,
2379                 const ExecContext *context,
2380                 const ExecParameters *params,
2381                 const ExecRuntime *runtime) {
2382
2383         _cleanup_strv_free_ char **empty_directories = NULL;
2384         char *tmp = NULL, *var = NULL;
2385         const char *root_dir = NULL, *root_image = NULL;
2386         NamespaceInfo ns_info;
2387         bool needs_sandboxing;
2388         BindMount *bind_mounts = NULL;
2389         size_t n_bind_mounts = 0;
2390         int r;
2391
2392         assert(context);
2393
2394         /* The runtime struct only contains the parent of the private /tmp,
2395          * which is non-accessible to world users. Inside of it there's a /tmp
2396          * that is sticky, and that's the one we want to use here. */
2397
2398         if (context->private_tmp && runtime) {
2399                 if (runtime->tmp_dir)
2400                         tmp = strjoina(runtime->tmp_dir, "/tmp");
2401                 if (runtime->var_tmp_dir)
2402                         var = strjoina(runtime->var_tmp_dir, "/tmp");
2403         }
2404
2405         if (params->flags & EXEC_APPLY_CHROOT) {
2406                 root_image = context->root_image;
2407
2408                 if (!root_image)
2409                         root_dir = context->root_directory;
2410         }
2411
2412         r = compile_bind_mounts(context, params, &bind_mounts, &n_bind_mounts, &empty_directories);
2413         if (r < 0)
2414                 return r;
2415
2416         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
2417         if (needs_sandboxing)
2418                 ns_info = (NamespaceInfo) {
2419                         .ignore_protect_paths = false,
2420                         .private_dev = context->private_devices,
2421                         .protect_control_groups = context->protect_control_groups,
2422                         .protect_kernel_tunables = context->protect_kernel_tunables,
2423                         .protect_kernel_modules = context->protect_kernel_modules,
2424                         .protect_hostname = context->protect_hostname,
2425                         .mount_apivfs = context->mount_apivfs,
2426                         .private_mounts = context->private_mounts,
2427                 };
2428         else if (!context->dynamic_user && root_dir)
2429                 /*
2430                  * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed
2431                  * sandbox info, otherwise enforce it, don't ignore protected paths and
2432                  * fail if we are enable to apply the sandbox inside the mount namespace.
2433                  */
2434                 ns_info = (NamespaceInfo) {
2435                         .ignore_protect_paths = true,
2436                 };
2437         else
2438                 ns_info = (NamespaceInfo) {};
2439
2440         if (context->mount_flags == MS_SHARED)
2441                 log_unit_debug(u, "shared mount propagation hidden by other fs namespacing unit settings: ignoring");
2442
2443         r = setup_namespace(root_dir, root_image,
2444                             &ns_info, context->read_write_paths,
2445                             needs_sandboxing ? context->read_only_paths : NULL,
2446                             needs_sandboxing ? context->inaccessible_paths : NULL,
2447                             empty_directories,
2448                             bind_mounts,
2449                             n_bind_mounts,
2450                             context->temporary_filesystems,
2451                             context->n_temporary_filesystems,
2452                             tmp,
2453                             var,
2454                             needs_sandboxing ? context->protect_home : PROTECT_HOME_NO,
2455                             needs_sandboxing ? context->protect_system : PROTECT_SYSTEM_NO,
2456                             context->mount_flags,
2457                             DISSECT_IMAGE_DISCARD_ON_LOOP);
2458
2459         bind_mount_free_many(bind_mounts, n_bind_mounts);
2460
2461         /* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports
2462          * that with a special, recognizable error ENOANO. In this case, silently proceeed, but only if exclusively
2463          * sandboxing options were used, i.e. nothing such as RootDirectory= or BindMount= that would result in a
2464          * completely different execution environment. */
2465         if (r == -ENOANO) {
2466                 if (n_bind_mounts == 0 &&
2467                     context->n_temporary_filesystems == 0 &&
2468                     !root_dir && !root_image &&
2469                     !context->dynamic_user) {
2470                         log_unit_debug(u, "Failed to set up namespace, assuming containerized execution and ignoring.");
2471                         return 0;
2472                 }
2473
2474                 log_unit_debug(u, "Failed to set up namespace, and refusing to continue since the selected namespacing options alter mount environment non-trivially.\n"
2475                                "Bind mounts: %zu, temporary filesystems: %zu, root directory: %s, root image: %s, dynamic user: %s",
2476                                n_bind_mounts, context->n_temporary_filesystems, yes_no(root_dir), yes_no(root_image), yes_no(context->dynamic_user));
2477
2478                 return -EOPNOTSUPP;
2479         }
2480
2481         return r;
2482 }
2483
2484 static int apply_working_directory(
2485                 const ExecContext *context,
2486                 const ExecParameters *params,
2487                 const char *home,
2488                 const bool needs_mount_ns,
2489                 int *exit_status) {
2490
2491         const char *d, *wd;
2492
2493         assert(context);
2494         assert(exit_status);
2495
2496         if (context->working_directory_home) {
2497
2498                 if (!home) {
2499                         *exit_status = EXIT_CHDIR;
2500                         return -ENXIO;
2501                 }
2502
2503                 wd = home;
2504
2505         } else if (context->working_directory)
2506                 wd = context->working_directory;
2507         else
2508                 wd = "/";
2509
2510         if (params->flags & EXEC_APPLY_CHROOT) {
2511                 if (!needs_mount_ns && context->root_directory)
2512                         if (chroot(context->root_directory) < 0) {
2513                                 *exit_status = EXIT_CHROOT;
2514                                 return -errno;
2515                         }
2516
2517                 d = wd;
2518         } else
2519                 d = prefix_roota(context->root_directory, wd);
2520
2521         if (chdir(d) < 0 && !context->working_directory_missing_ok) {
2522                 *exit_status = EXIT_CHDIR;
2523                 return -errno;
2524         }
2525
2526         return 0;
2527 }
2528
2529 static int setup_keyring(
2530                 const Unit *u,
2531                 const ExecContext *context,
2532                 const ExecParameters *p,
2533                 uid_t uid, gid_t gid) {
2534
2535         key_serial_t keyring;
2536         int r = 0;
2537         uid_t saved_uid;
2538         gid_t saved_gid;
2539
2540         assert(u);
2541         assert(context);
2542         assert(p);
2543
2544         /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that
2545          * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond
2546          * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be
2547          * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in
2548          * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where
2549          * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */
2550
2551         if (context->keyring_mode == EXEC_KEYRING_INHERIT)
2552                 return 0;
2553
2554         /* Acquiring a reference to the user keyring is nasty. We briefly change identity in order to get things set up
2555          * properly by the kernel. If we don't do that then we can't create it atomically, and that sucks for parallel
2556          * execution. This mimics what pam_keyinit does, too. Setting up session keyring, to be owned by the right user
2557          * & group is just as nasty as acquiring a reference to the user keyring. */
2558
2559         saved_uid = getuid();
2560         saved_gid = getgid();
2561
2562         if (gid_is_valid(gid) && gid != saved_gid) {
2563                 if (setregid(gid, -1) < 0)
2564                         return log_unit_error_errno(u, errno, "Failed to change GID for user keyring: %m");
2565         }
2566
2567         if (uid_is_valid(uid) && uid != saved_uid) {
2568                 if (setreuid(uid, -1) < 0) {
2569                         r = log_unit_error_errno(u, errno, "Failed to change UID for user keyring: %m");
2570                         goto out;
2571                 }
2572         }
2573
2574         keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2575         if (keyring == -1) {
2576                 if (errno == ENOSYS)
2577                         log_unit_debug_errno(u, errno, "Kernel keyring not supported, ignoring.");
2578                 else if (IN_SET(errno, EACCES, EPERM))
2579                         log_unit_debug_errno(u, errno, "Kernel keyring access prohibited, ignoring.");
2580                 else if (errno == EDQUOT)
2581                         log_unit_debug_errno(u, errno, "Out of kernel keyrings to allocate, ignoring.");
2582                 else
2583                         r = log_unit_error_errno(u, errno, "Setting up kernel keyring failed: %m");
2584
2585                 goto out;
2586         }
2587
2588         /* When requested link the user keyring into the session keyring. */
2589         if (context->keyring_mode == EXEC_KEYRING_SHARED) {
2590
2591                 if (keyctl(KEYCTL_LINK,
2592                            KEY_SPEC_USER_KEYRING,
2593                            KEY_SPEC_SESSION_KEYRING, 0, 0) < 0) {
2594                         r = log_unit_error_errno(u, errno, "Failed to link user keyring into session keyring: %m");
2595                         goto out;
2596                 }
2597         }
2598
2599         /* Restore uid/gid back */
2600         if (uid_is_valid(uid) && uid != saved_uid) {
2601                 if (setreuid(saved_uid, -1) < 0) {
2602                         r = log_unit_error_errno(u, errno, "Failed to change UID back for user keyring: %m");
2603                         goto out;
2604                 }
2605         }
2606
2607         if (gid_is_valid(gid) && gid != saved_gid) {
2608                 if (setregid(saved_gid, -1) < 0)
2609                         return log_unit_error_errno(u, errno, "Failed to change GID back for user keyring: %m");
2610         }
2611
2612         /* Populate they keyring with the invocation ID by default, as original saved_uid. */
2613         if (!sd_id128_is_null(u->invocation_id)) {
2614                 key_serial_t key;
2615
2616                 key = add_key("user", "invocation_id", &u->invocation_id, sizeof(u->invocation_id), KEY_SPEC_SESSION_KEYRING);
2617                 if (key == -1)
2618                         log_unit_debug_errno(u, errno, "Failed to add invocation ID to keyring, ignoring: %m");
2619                 else {
2620                         if (keyctl(KEYCTL_SETPERM, key,
2621                                    KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH|
2622                                    KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0)
2623                                 r = log_unit_error_errno(u, errno, "Failed to restrict invocation ID permission: %m");
2624                 }
2625         }
2626
2627 out:
2628         /* Revert back uid & gid for the the last time, and exit */
2629         /* no extra logging, as only the first already reported error matters */
2630         if (getuid() != saved_uid)
2631                 (void) setreuid(saved_uid, -1);
2632
2633         if (getgid() != saved_gid)
2634                 (void) setregid(saved_gid, -1);
2635
2636         return r;
2637 }
2638
2639 static void append_socket_pair(int *array, size_t *n, const int pair[static 2]) {
2640         assert(array);
2641         assert(n);
2642
2643         if (!pair)
2644                 return;
2645
2646         if (pair[0] >= 0)
2647                 array[(*n)++] = pair[0];
2648         if (pair[1] >= 0)
2649                 array[(*n)++] = pair[1];
2650 }
2651
2652 static int close_remaining_fds(
2653                 const ExecParameters *params,
2654                 const ExecRuntime *runtime,
2655                 const DynamicCreds *dcreds,
2656                 int user_lookup_fd,
2657                 int socket_fd,
2658                 int exec_fd,
2659                 int *fds, size_t n_fds) {
2660
2661         size_t n_dont_close = 0;
2662         int dont_close[n_fds + 12];
2663
2664         assert(params);
2665
2666         if (params->stdin_fd >= 0)
2667                 dont_close[n_dont_close++] = params->stdin_fd;
2668         if (params->stdout_fd >= 0)
2669                 dont_close[n_dont_close++] = params->stdout_fd;
2670         if (params->stderr_fd >= 0)
2671                 dont_close[n_dont_close++] = params->stderr_fd;
2672
2673         if (socket_fd >= 0)
2674                 dont_close[n_dont_close++] = socket_fd;
2675         if (exec_fd >= 0)
2676                 dont_close[n_dont_close++] = exec_fd;
2677         if (n_fds > 0) {
2678                 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
2679                 n_dont_close += n_fds;
2680         }
2681
2682         if (runtime)
2683                 append_socket_pair(dont_close, &n_dont_close, runtime->netns_storage_socket);
2684
2685         if (dcreds) {
2686                 if (dcreds->user)
2687                         append_socket_pair(dont_close, &n_dont_close, dcreds->user->storage_socket);
2688                 if (dcreds->group)
2689                         append_socket_pair(dont_close, &n_dont_close, dcreds->group->storage_socket);
2690         }
2691
2692         if (user_lookup_fd >= 0)
2693                 dont_close[n_dont_close++] = user_lookup_fd;
2694
2695         return close_all_fds(dont_close, n_dont_close);
2696 }
2697
2698 static int send_user_lookup(
2699                 Unit *unit,
2700                 int user_lookup_fd,
2701                 uid_t uid,
2702                 gid_t gid) {
2703
2704         assert(unit);
2705
2706         /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
2707          * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
2708          * specified. */
2709
2710         if (user_lookup_fd < 0)
2711                 return 0;
2712
2713         if (!uid_is_valid(uid) && !gid_is_valid(gid))
2714                 return 0;
2715
2716         if (writev(user_lookup_fd,
2717                (struct iovec[]) {
2718                            IOVEC_INIT(&uid, sizeof(uid)),
2719                            IOVEC_INIT(&gid, sizeof(gid)),
2720                            IOVEC_INIT_STRING(unit->id) }, 3) < 0)
2721                 return -errno;
2722
2723         return 0;
2724 }
2725
2726 static int acquire_home(const ExecContext *c, uid_t uid, const char** home, char **buf) {
2727         int r;
2728
2729         assert(c);
2730         assert(home);
2731         assert(buf);
2732
2733         /* If WorkingDirectory=~ is set, try to acquire a usable home directory. */
2734
2735         if (*home)
2736                 return 0;
2737
2738         if (!c->working_directory_home)
2739                 return 0;
2740
2741         if (uid == 0) {
2742                 /* Hardcode /root as home directory for UID 0 */
2743                 *home = "/root";
2744                 return 1;
2745         }
2746
2747         r = get_home_dir(buf);
2748         if (r < 0)
2749                 return r;
2750
2751         *home = *buf;
2752         return 1;
2753 }
2754
2755 static int compile_suggested_paths(const ExecContext *c, const ExecParameters *p, char ***ret) {
2756         _cleanup_strv_free_ char ** list = NULL;
2757         ExecDirectoryType t;
2758         int r;
2759
2760         assert(c);
2761         assert(p);
2762         assert(ret);
2763
2764         assert(c->dynamic_user);
2765
2766         /* Compile a list of paths that it might make sense to read the owning UID from to use as initial candidate for
2767          * dynamic UID allocation, in order to save us from doing costly recursive chown()s of the special
2768          * directories. */
2769
2770         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2771                 char **i;
2772
2773                 if (t == EXEC_DIRECTORY_CONFIGURATION)
2774                         continue;
2775
2776                 if (!p->prefix[t])
2777                         continue;
2778
2779                 STRV_FOREACH(i, c->directories[t].paths) {
2780                         char *e;
2781
2782                         if (t == EXEC_DIRECTORY_RUNTIME)
2783                                 e = strjoin(p->prefix[t], "/", *i);
2784                         else
2785                                 e = strjoin(p->prefix[t], "/private/", *i);
2786                         if (!e)
2787                                 return -ENOMEM;
2788
2789                         r = strv_consume(&list, e);
2790                         if (r < 0)
2791                                 return r;
2792                 }
2793         }
2794
2795         *ret = TAKE_PTR(list);
2796
2797         return 0;
2798 }
2799
2800 static char *exec_command_line(char **argv);
2801
2802 static int exec_parameters_get_cgroup_path(const ExecParameters *params, char **ret) {
2803         bool using_subcgroup;
2804         char *p;
2805
2806         assert(params);
2807         assert(ret);
2808
2809         if (!params->cgroup_path)
2810                 return -EINVAL;
2811
2812         /* If we are called for a unit where cgroup delegation is on, and the payload created its own populated
2813          * subcgroup (which we expect it to do, after all it asked for delegation), then we cannot place the control
2814          * processes started after the main unit's process in the unit's main cgroup because it is now an inner one,
2815          * and inner cgroups may not contain processes. Hence, if delegation is on, and this is a control process,
2816          * let's use ".control" as subcgroup instead. Note that we do so only for ExecStartPost=, ExecReload=,
2817          * ExecStop=, ExecStopPost=, i.e. for the commands where the main process is already forked. For ExecStartPre=
2818          * this is not necessary, the cgroup is still empty. We distinguish these cases with the EXEC_CONTROL_CGROUP
2819          * flag, which is only passed for the former statements, not for the latter. */
2820
2821         using_subcgroup = FLAGS_SET(params->flags, EXEC_CONTROL_CGROUP|EXEC_CGROUP_DELEGATE|EXEC_IS_CONTROL);
2822         if (using_subcgroup)
2823                 p = strjoin(params->cgroup_path, "/.control");
2824         else
2825                 p = strdup(params->cgroup_path);
2826         if (!p)
2827                 return -ENOMEM;
2828
2829         *ret = p;
2830         return using_subcgroup;
2831 }
2832
2833 static int exec_child(
2834                 Unit *unit,
2835                 const ExecCommand *command,
2836                 const ExecContext *context,
2837                 const ExecParameters *params,
2838                 ExecRuntime *runtime,
2839                 DynamicCreds *dcreds,
2840                 int socket_fd,
2841                 int named_iofds[3],
2842                 int *fds,
2843                 size_t n_socket_fds,
2844                 size_t n_storage_fds,
2845                 char **files_env,
2846                 int user_lookup_fd,
2847                 int *exit_status) {
2848
2849         _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **accum_env = NULL, **replaced_argv = NULL;
2850         int *fds_with_exec_fd, n_fds_with_exec_fd, r, ngids = 0, exec_fd = -1;
2851         _cleanup_free_ gid_t *supplementary_gids = NULL;
2852         const char *username = NULL, *groupname = NULL;
2853         _cleanup_free_ char *home_buffer = NULL;
2854         const char *home = NULL, *shell = NULL;
2855         char **final_argv = NULL;
2856         dev_t journal_stream_dev = 0;
2857         ino_t journal_stream_ino = 0;
2858         bool needs_sandboxing,          /* Do we need to set up full sandboxing? (i.e. all namespacing, all MAC stuff, caps, yadda yadda */
2859                 needs_setuid,           /* Do we need to do the actual setresuid()/setresgid() calls? */
2860                 needs_mount_namespace,  /* Do we need to set up a mount namespace for this kernel? */
2861                 needs_ambient_hack;     /* Do we need to apply the ambient capabilities hack? */
2862 #if HAVE_SELINUX
2863         _cleanup_free_ char *mac_selinux_context_net = NULL;
2864         bool use_selinux = false;
2865 #endif
2866 #if ENABLE_SMACK
2867         bool use_smack = false;
2868 #endif
2869 #if HAVE_APPARMOR
2870         bool use_apparmor = false;
2871 #endif
2872         uid_t uid = UID_INVALID;
2873         gid_t gid = GID_INVALID;
2874         size_t n_fds;
2875         ExecDirectoryType dt;
2876         int secure_bits;
2877
2878         assert(unit);
2879         assert(command);
2880         assert(context);
2881         assert(params);
2882         assert(exit_status);
2883
2884         rename_process_from_path(command->path);
2885
2886         /* We reset exactly these signals, since they are the
2887          * only ones we set to SIG_IGN in the main daemon. All
2888          * others we leave untouched because we set them to
2889          * SIG_DFL or a valid handler initially, both of which
2890          * will be demoted to SIG_DFL. */
2891         (void) default_signals(SIGNALS_CRASH_HANDLER,
2892                                SIGNALS_IGNORE, -1);
2893
2894         if (context->ignore_sigpipe)
2895                 (void) ignore_signals(SIGPIPE, -1);
2896
2897         r = reset_signal_mask();
2898         if (r < 0) {
2899                 *exit_status = EXIT_SIGNAL_MASK;
2900                 return log_unit_error_errno(unit, r, "Failed to set process signal mask: %m");
2901         }
2902
2903         if (params->idle_pipe)
2904                 do_idle_pipe_dance(params->idle_pipe);
2905
2906         /* Close fds we don't need very early to make sure we don't block init reexecution because it cannot bind its
2907          * sockets. Among the fds we close are the logging fds, and we want to keep them closed, so that we don't have
2908          * any fds open we don't really want open during the transition. In order to make logging work, we switch the
2909          * log subsystem into open_when_needed mode, so that it reopens the logs on every single log call. */
2910
2911         log_forget_fds();
2912         log_set_open_when_needed(true);
2913
2914         /* In case anything used libc syslog(), close this here, too */
2915         closelog();
2916
2917         n_fds = n_socket_fds + n_storage_fds;
2918         r = close_remaining_fds(params, runtime, dcreds, user_lookup_fd, socket_fd, params->exec_fd, fds, n_fds);
2919         if (r < 0) {
2920                 *exit_status = EXIT_FDS;
2921                 return log_unit_error_errno(unit, r, "Failed to close unwanted file descriptors: %m");
2922         }
2923
2924         if (!context->same_pgrp)
2925                 if (setsid() < 0) {
2926                         *exit_status = EXIT_SETSID;
2927                         return log_unit_error_errno(unit, errno, "Failed to create new process session: %m");
2928                 }
2929
2930         exec_context_tty_reset(context, params);
2931
2932         if (unit_shall_confirm_spawn(unit)) {
2933                 const char *vc = params->confirm_spawn;
2934                 _cleanup_free_ char *cmdline = NULL;
2935
2936                 cmdline = exec_command_line(command->argv);
2937                 if (!cmdline) {
2938                         *exit_status = EXIT_MEMORY;
2939                         return log_oom();
2940                 }
2941
2942                 r = ask_for_confirmation(vc, unit, cmdline);
2943                 if (r != CONFIRM_EXECUTE) {
2944                         if (r == CONFIRM_PRETEND_SUCCESS) {
2945                                 *exit_status = EXIT_SUCCESS;
2946                                 return 0;
2947                         }
2948                         *exit_status = EXIT_CONFIRM;
2949                         log_unit_error(unit, "Execution cancelled by the user");
2950                         return -ECANCELED;
2951                 }
2952         }
2953
2954         /* We are about to invoke NSS and PAM modules. Let's tell them what we are doing here, maybe they care. This is
2955          * used by nss-resolve to disable itself when we are about to start systemd-resolved, to avoid deadlocks. Note
2956          * that these env vars do not survive the execve(), which means they really only apply to the PAM and NSS
2957          * invocations themselves. Also note that while we'll only invoke NSS modules involved in user management they
2958          * might internally call into other NSS modules that are involved in hostname resolution, we never know. */
2959         if (setenv("SYSTEMD_ACTIVATION_UNIT", unit->id, true) != 0 ||
2960             setenv("SYSTEMD_ACTIVATION_SCOPE", MANAGER_IS_SYSTEM(unit->manager) ? "system" : "user", true) != 0) {
2961                 *exit_status = EXIT_MEMORY;
2962                 return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
2963         }
2964
2965         if (context->dynamic_user && dcreds) {
2966                 _cleanup_strv_free_ char **suggested_paths = NULL;
2967
2968                 /* On top of that, make sure we bypass our own NSS module nss-systemd comprehensively for any NSS
2969                  * checks, if DynamicUser=1 is used, as we shouldn't create a feedback loop with ourselves here.*/
2970                 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
2971                         *exit_status = EXIT_USER;
2972                         return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
2973                 }
2974
2975                 r = compile_suggested_paths(context, params, &suggested_paths);
2976                 if (r < 0) {
2977                         *exit_status = EXIT_MEMORY;
2978                         return log_oom();
2979                 }
2980
2981                 r = dynamic_creds_realize(dcreds, suggested_paths, &uid, &gid);
2982                 if (r < 0) {
2983                         *exit_status = EXIT_USER;
2984                         if (r == -EILSEQ) {
2985                                 log_unit_error(unit, "Failed to update dynamic user credentials: User or group with specified name already exists.");
2986                                 return -EOPNOTSUPP;
2987                         }
2988                         return log_unit_error_errno(unit, r, "Failed to update dynamic user credentials: %m");
2989                 }
2990
2991                 if (!uid_is_valid(uid)) {
2992                         *exit_status = EXIT_USER;
2993                         log_unit_error(unit, "UID validation failed for \""UID_FMT"\"", uid);
2994                         return -ESRCH;
2995                 }
2996
2997                 if (!gid_is_valid(gid)) {
2998                         *exit_status = EXIT_USER;
2999                         log_unit_error(unit, "GID validation failed for \""GID_FMT"\"", gid);
3000                         return -ESRCH;
3001                 }
3002
3003                 if (dcreds->user)
3004                         username = dcreds->user->name;
3005
3006         } else {
3007                 r = get_fixed_user(context, &username, &uid, &gid, &home, &shell);
3008                 if (r < 0) {
3009                         *exit_status = EXIT_USER;
3010                         return log_unit_error_errno(unit, r, "Failed to determine user credentials: %m");
3011                 }
3012
3013                 r = get_fixed_group(context, &groupname, &gid);
3014                 if (r < 0) {
3015                         *exit_status = EXIT_GROUP;
3016                         return log_unit_error_errno(unit, r, "Failed to determine group credentials: %m");
3017                 }
3018         }
3019
3020         /* Initialize user supplementary groups and get SupplementaryGroups= ones */
3021         r = get_supplementary_groups(context, username, groupname, gid,
3022                                      &supplementary_gids, &ngids);
3023         if (r < 0) {
3024                 *exit_status = EXIT_GROUP;
3025                 return log_unit_error_errno(unit, r, "Failed to determine supplementary groups: %m");
3026         }
3027
3028         r = send_user_lookup(unit, user_lookup_fd, uid, gid);
3029         if (r < 0) {
3030                 *exit_status = EXIT_USER;
3031                 return log_unit_error_errno(unit, r, "Failed to send user credentials to PID1: %m");
3032         }
3033
3034         user_lookup_fd = safe_close(user_lookup_fd);
3035
3036         r = acquire_home(context, uid, &home, &home_buffer);
3037         if (r < 0) {
3038                 *exit_status = EXIT_CHDIR;
3039                 return log_unit_error_errno(unit, r, "Failed to determine $HOME for user: %m");
3040         }
3041
3042         /* If a socket is connected to STDIN/STDOUT/STDERR, we
3043          * must sure to drop O_NONBLOCK */
3044         if (socket_fd >= 0)
3045                 (void) fd_nonblock(socket_fd, false);
3046
3047         /* Journald will try to look-up our cgroup in order to populate _SYSTEMD_CGROUP and _SYSTEMD_UNIT fields.
3048          * Hence we need to migrate to the target cgroup from init.scope before connecting to journald */
3049         if (params->cgroup_path) {
3050                 _cleanup_free_ char *p = NULL;
3051
3052                 r = exec_parameters_get_cgroup_path(params, &p);
3053                 if (r < 0) {
3054                         *exit_status = EXIT_CGROUP;
3055                         return log_unit_error_errno(unit, r, "Failed to acquire cgroup path: %m");
3056                 }
3057
3058                 r = cg_attach_everywhere(params->cgroup_supported, p, 0, NULL, NULL);
3059                 if (r < 0) {
3060                         *exit_status = EXIT_CGROUP;
3061                         return log_unit_error_errno(unit, r, "Failed to attach to cgroup %s: %m", p);
3062                 }
3063         }
3064
3065         r = setup_input(context, params, socket_fd, named_iofds);
3066         if (r < 0) {
3067                 *exit_status = EXIT_STDIN;
3068                 return log_unit_error_errno(unit, r, "Failed to set up standard input: %m");
3069         }
3070
3071         r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
3072         if (r < 0) {
3073                 *exit_status = EXIT_STDOUT;
3074                 return log_unit_error_errno(unit, r, "Failed to set up standard output: %m");
3075         }
3076
3077         r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
3078         if (r < 0) {
3079                 *exit_status = EXIT_STDERR;
3080                 return log_unit_error_errno(unit, r, "Failed to set up standard error output: %m");
3081         }
3082
3083         if (context->oom_score_adjust_set) {
3084                 /* When we can't make this change due to EPERM, then let's silently skip over it. User namespaces
3085                  * prohibit write access to this file, and we shouldn't trip up over that. */
3086                 r = set_oom_score_adjust(context->oom_score_adjust);
3087                 if (IN_SET(r, -EPERM, -EACCES))
3088                         log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
3089                 else if (r < 0) {
3090                         *exit_status = EXIT_OOM_ADJUST;
3091                         return log_unit_error_errno(unit, r, "Failed to adjust OOM setting: %m");
3092                 }
3093         }
3094
3095         if (context->nice_set)
3096                 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
3097                         *exit_status = EXIT_NICE;
3098                         return log_unit_error_errno(unit, errno, "Failed to set up process scheduling priority (nice level): %m");
3099                 }
3100
3101         if (context->cpu_sched_set) {
3102                 struct sched_param param = {
3103                         .sched_priority = context->cpu_sched_priority,
3104                 };
3105
3106                 r = sched_setscheduler(0,
3107                                        context->cpu_sched_policy |
3108                                        (context->cpu_sched_reset_on_fork ?
3109                                         SCHED_RESET_ON_FORK : 0),
3110                                        &param);
3111                 if (r < 0) {
3112                         *exit_status = EXIT_SETSCHEDULER;
3113                         return log_unit_error_errno(unit, errno, "Failed to set up CPU scheduling: %m");
3114                 }
3115         }
3116
3117         if (context->cpuset)
3118                 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
3119                         *exit_status = EXIT_CPUAFFINITY;
3120                         return log_unit_error_errno(unit, errno, "Failed to set up CPU affinity: %m");
3121                 }
3122
3123         if (context->ioprio_set)
3124                 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
3125                         *exit_status = EXIT_IOPRIO;
3126                         return log_unit_error_errno(unit, errno, "Failed to set up IO scheduling priority: %m");
3127                 }
3128
3129         if (context->timer_slack_nsec != NSEC_INFINITY)
3130                 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
3131                         *exit_status = EXIT_TIMERSLACK;
3132                         return log_unit_error_errno(unit, errno, "Failed to set up timer slack: %m");
3133                 }
3134
3135         if (context->personality != PERSONALITY_INVALID) {
3136                 r = safe_personality(context->personality);
3137                 if (r < 0) {
3138                         *exit_status = EXIT_PERSONALITY;
3139                         return log_unit_error_errno(unit, r, "Failed to set up execution domain (personality): %m");
3140                 }
3141         }
3142
3143         if (context->utmp_id)
3144                 utmp_put_init_process(context->utmp_id, getpid_cached(), getsid(0),
3145                                       context->tty_path,
3146                                       context->utmp_mode == EXEC_UTMP_INIT  ? INIT_PROCESS :
3147                                       context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
3148                                       USER_PROCESS,
3149                                       username);
3150
3151         if (context->user) {
3152                 r = chown_terminal(STDIN_FILENO, uid);
3153                 if (r < 0) {
3154                         *exit_status = EXIT_STDIN;
3155                         return log_unit_error_errno(unit, r, "Failed to change ownership of terminal: %m");
3156                 }
3157         }
3158
3159         /* If delegation is enabled we'll pass ownership of the cgroup to the user of the new process. On cgroup v1
3160          * this is only about systemd's own hierarchy, i.e. not the controller hierarchies, simply because that's not
3161          * safe. On cgroup v2 there's only one hierarchy anyway, and delegation is safe there, hence in that case only
3162          * touch a single hierarchy too. */
3163         if (params->cgroup_path && context->user && (params->flags & EXEC_CGROUP_DELEGATE)) {
3164                 r = cg_set_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, uid, gid);
3165                 if (r < 0) {
3166                         *exit_status = EXIT_CGROUP;
3167                         return log_unit_error_errno(unit, r, "Failed to adjust control group access: %m");
3168                 }
3169         }
3170
3171         for (dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
3172                 r = setup_exec_directory(context, params, uid, gid, dt, exit_status);
3173                 if (r < 0)
3174                         return log_unit_error_errno(unit, r, "Failed to set up special execution directory in %s: %m", params->prefix[dt]);
3175         }
3176
3177         r = build_environment(
3178                         unit,
3179                         context,
3180                         params,
3181                         n_fds,
3182                         home,
3183                         username,
3184                         shell,
3185                         journal_stream_dev,
3186                         journal_stream_ino,
3187                         &our_env);
3188         if (r < 0) {
3189                 *exit_status = EXIT_MEMORY;
3190                 return log_oom();
3191         }
3192
3193         r = build_pass_environment(context, &pass_env);
3194         if (r < 0) {
3195                 *exit_status = EXIT_MEMORY;
3196                 return log_oom();
3197         }
3198
3199         accum_env = strv_env_merge(5,
3200                                    params->environment,
3201                                    our_env,
3202                                    pass_env,
3203                                    context->environment,
3204                                    files_env,
3205                                    NULL);
3206         if (!accum_env) {
3207                 *exit_status = EXIT_MEMORY;
3208                 return log_oom();
3209         }
3210         accum_env = strv_env_clean(accum_env);
3211
3212         (void) umask(context->umask);
3213
3214         r = setup_keyring(unit, context, params, uid, gid);
3215         if (r < 0) {
3216                 *exit_status = EXIT_KEYRING;
3217                 return log_unit_error_errno(unit, r, "Failed to set up kernel keyring: %m");
3218         }
3219
3220         /* We need sandboxing if the caller asked us to apply it and the command isn't explicitly excepted from it */
3221         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
3222
3223         /* We need the ambient capability hack, if the caller asked us to apply it and the command is marked for it, and the kernel doesn't actually support ambient caps */
3224         needs_ambient_hack = (params->flags & EXEC_APPLY_SANDBOXING) && (command->flags & EXEC_COMMAND_AMBIENT_MAGIC) && !ambient_capabilities_supported();
3225
3226         /* We need setresuid() if the caller asked us to apply sandboxing and the command isn't explicitly excepted from either whole sandboxing or just setresuid() itself, and the ambient hack is not desired */
3227         if (needs_ambient_hack)
3228                 needs_setuid = false;
3229         else
3230                 needs_setuid = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & (EXEC_COMMAND_FULLY_PRIVILEGED|EXEC_COMMAND_NO_SETUID));
3231
3232         if (needs_sandboxing) {
3233                 /* MAC enablement checks need to be done before a new mount ns is created, as they rely on /sys being
3234                  * present. The actual MAC context application will happen later, as late as possible, to avoid
3235                  * impacting our own code paths. */
3236
3237 #if HAVE_SELINUX
3238                 use_selinux = mac_selinux_use();
3239 #endif
3240 #if ENABLE_SMACK
3241                 use_smack = mac_smack_use();
3242 #endif
3243 #if HAVE_APPARMOR
3244                 use_apparmor = mac_apparmor_use();
3245 #endif
3246         }
3247
3248         if (needs_sandboxing) {
3249                 int which_failed;
3250
3251                 /* Let's set the resource limits before we call into PAM, so that pam_limits wins over what
3252                  * is set here. (See below.) */
3253
3254                 r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
3255                 if (r < 0) {
3256                         *exit_status = EXIT_LIMITS;
3257                         return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3258                 }
3259         }
3260
3261         if (needs_setuid) {
3262
3263                 /* Let's call into PAM after we set up our own idea of resource limits to that pam_limits
3264                  * wins here. (See above.) */
3265
3266                 if (context->pam_name && username) {
3267                         r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
3268                         if (r < 0) {
3269                                 *exit_status = EXIT_PAM;
3270                                 return log_unit_error_errno(unit, r, "Failed to set up PAM session: %m");
3271                         }
3272                 }
3273         }
3274
3275         if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
3276                 if (ns_type_supported(NAMESPACE_NET)) {
3277                         r = setup_netns(runtime->netns_storage_socket);
3278                         if (r < 0) {
3279                                 *exit_status = EXIT_NETWORK;
3280                                 return log_unit_error_errno(unit, r, "Failed to set up network namespacing: %m");
3281                         }
3282                 } else
3283                         log_unit_warning(unit, "PrivateNetwork=yes is configured, but the kernel does not support network namespaces, ignoring.");
3284         }
3285
3286         needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
3287         if (needs_mount_namespace) {
3288                 r = apply_mount_namespace(unit, command, context, params, runtime);
3289                 if (r < 0) {
3290                         *exit_status = EXIT_NAMESPACE;
3291                         return log_unit_error_errno(unit, r, "Failed to set up mount namespacing: %m");
3292                 }
3293         }
3294
3295         if (context->protect_hostname) {
3296                 if (ns_type_supported(NAMESPACE_UTS)) {
3297                         if (unshare(CLONE_NEWUTS) < 0) {
3298                                 *exit_status = EXIT_NAMESPACE;
3299                                 return log_unit_error_errno(unit, errno, "Failed to set up UTS namespacing: %m");
3300                         }
3301                 } else
3302                         log_unit_warning(unit, "ProtectHostname=yes is configured, but the kernel does not support UTS namespaces, ignoring namespace setup.");
3303 #if HAVE_SECCOMP
3304                 r = seccomp_protect_hostname();
3305                 if (r < 0) {
3306                         *exit_status = EXIT_SECCOMP;
3307                         return log_unit_error_errno(unit, r, "Failed to apply hostname restrictions: %m");
3308                 }
3309 #endif
3310         }
3311
3312         /* Drop groups as early as possbile */
3313         if (needs_setuid) {
3314                 r = enforce_groups(gid, supplementary_gids, ngids);
3315                 if (r < 0) {
3316                         *exit_status = EXIT_GROUP;
3317                         return log_unit_error_errno(unit, r, "Changing group credentials failed: %m");
3318                 }
3319         }
3320
3321         if (needs_sandboxing) {
3322 #if HAVE_SELINUX
3323                 if (use_selinux && params->selinux_context_net && socket_fd >= 0) {
3324                         r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
3325                         if (r < 0) {
3326                                 *exit_status = EXIT_SELINUX_CONTEXT;
3327                                 return log_unit_error_errno(unit, r, "Failed to determine SELinux context: %m");
3328                         }
3329                 }
3330 #endif
3331
3332                 if (context->private_users) {
3333                         r = setup_private_users(uid, gid);
3334                         if (r < 0) {
3335                                 *exit_status = EXIT_USER;
3336                                 return log_unit_error_errno(unit, r, "Failed to set up user namespacing: %m");
3337                         }
3338                 }
3339         }
3340
3341         /* We repeat the fd closing here, to make sure that nothing is leaked from the PAM modules. Note that we are
3342          * more aggressive this time since socket_fd and the netns fds we don't need anymore. We do keep the exec_fd
3343          * however if we have it as we want to keep it open until the final execve(). */
3344
3345         if (params->exec_fd >= 0) {
3346                 exec_fd = params->exec_fd;
3347
3348                 if (exec_fd < 3 + (int) n_fds) {
3349                         int moved_fd;
3350
3351                         /* Let's move the exec fd far up, so that it's outside of the fd range we want to pass to the
3352                          * process we are about to execute. */
3353
3354                         moved_fd = fcntl(exec_fd, F_DUPFD_CLOEXEC, 3 + (int) n_fds);
3355                         if (moved_fd < 0) {
3356                                 *exit_status = EXIT_FDS;
3357                                 return log_unit_error_errno(unit, errno, "Couldn't move exec fd up: %m");
3358                         }
3359
3360                         safe_close(exec_fd);
3361                         exec_fd = moved_fd;
3362                 } else {
3363                         /* This fd should be FD_CLOEXEC already, but let's make sure. */
3364                         r = fd_cloexec(exec_fd, true);
3365                         if (r < 0) {
3366                                 *exit_status = EXIT_FDS;
3367                                 return log_unit_error_errno(unit, r, "Failed to make exec fd FD_CLOEXEC: %m");
3368                         }
3369                 }
3370
3371                 fds_with_exec_fd = newa(int, n_fds + 1);
3372                 memcpy_safe(fds_with_exec_fd, fds, n_fds * sizeof(int));
3373                 fds_with_exec_fd[n_fds] = exec_fd;
3374                 n_fds_with_exec_fd = n_fds + 1;
3375         } else {
3376                 fds_with_exec_fd = fds;
3377                 n_fds_with_exec_fd = n_fds;
3378         }
3379
3380         r = close_all_fds(fds_with_exec_fd, n_fds_with_exec_fd);
3381         if (r >= 0)
3382                 r = shift_fds(fds, n_fds);
3383         if (r >= 0)
3384                 r = flags_fds(fds, n_socket_fds, n_storage_fds, context->non_blocking);
3385         if (r < 0) {
3386                 *exit_status = EXIT_FDS;
3387                 return log_unit_error_errno(unit, r, "Failed to adjust passed file descriptors: %m");
3388         }
3389
3390         /* At this point, the fds we want to pass to the program are all ready and set up, with O_CLOEXEC turned off
3391          * and at the right fd numbers. The are no other fds open, with one exception: the exec_fd if it is defined,
3392          * and it has O_CLOEXEC set, after all we want it to be closed by the execve(), so that our parent knows we
3393          * came this far. */
3394
3395         secure_bits = context->secure_bits;
3396
3397         if (needs_sandboxing) {
3398                 uint64_t bset;
3399
3400                 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly
3401                  * requested. (Note this is placed after the general resource limit initialization, see
3402                  * above, in order to take precedence.) */
3403                 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
3404                         if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
3405                                 *exit_status = EXIT_LIMITS;
3406                                 return log_unit_error_errno(unit, errno, "Failed to adjust RLIMIT_RTPRIO resource limit: %m");
3407                         }
3408                 }
3409
3410 #if ENABLE_SMACK
3411                 /* LSM Smack needs the capability CAP_MAC_ADMIN to change the current execution security context of the
3412                  * process. This is the latest place before dropping capabilities. Other MAC context are set later. */
3413                 if (use_smack) {
3414                         r = setup_smack(context, command);
3415                         if (r < 0) {
3416                                 *exit_status = EXIT_SMACK_PROCESS_LABEL;
3417                                 return log_unit_error_errno(unit, r, "Failed to set SMACK process label: %m");
3418                         }
3419                 }
3420 #endif
3421
3422                 bset = context->capability_bounding_set;
3423                 /* If the ambient caps hack is enabled (which means the kernel can't do them, and the user asked for
3424                  * our magic fallback), then let's add some extra caps, so that the service can drop privs of its own,
3425                  * instead of us doing that */
3426                 if (needs_ambient_hack)
3427                         bset |= (UINT64_C(1) << CAP_SETPCAP) |
3428                                 (UINT64_C(1) << CAP_SETUID) |
3429                                 (UINT64_C(1) << CAP_SETGID);
3430
3431                 if (!cap_test_all(bset)) {
3432                         r = capability_bounding_set_drop(bset, false);
3433                         if (r < 0) {
3434                                 *exit_status = EXIT_CAPABILITIES;
3435                                 return log_unit_error_errno(unit, r, "Failed to drop capabilities: %m");
3436                         }
3437                 }
3438
3439                 /* This is done before enforce_user, but ambient set
3440                  * does not survive over setresuid() if keep_caps is not set. */
3441                 if (!needs_ambient_hack &&
3442                     context->capability_ambient_set != 0) {
3443                         r = capability_ambient_set_apply(context->capability_ambient_set, true);
3444                         if (r < 0) {
3445                                 *exit_status = EXIT_CAPABILITIES;
3446                                 return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (before UID change): %m");
3447                         }
3448                 }
3449         }
3450
3451         if (needs_setuid) {
3452                 if (context->user) {
3453                         r = enforce_user(context, uid);
3454                         if (r < 0) {
3455                                 *exit_status = EXIT_USER;
3456                                 return log_unit_error_errno(unit, r, "Failed to change UID to " UID_FMT ": %m", uid);
3457                         }
3458
3459                         if (!needs_ambient_hack &&
3460                             context->capability_ambient_set != 0) {
3461
3462                                 /* Fix the ambient capabilities after user change. */
3463                                 r = capability_ambient_set_apply(context->capability_ambient_set, false);
3464                                 if (r < 0) {
3465                                         *exit_status = EXIT_CAPABILITIES;
3466                                         return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (after UID change): %m");
3467                                 }
3468
3469                                 /* If we were asked to change user and ambient capabilities
3470                                  * were requested, we had to add keep-caps to the securebits
3471                                  * so that we would maintain the inherited capability set
3472                                  * through the setresuid(). Make sure that the bit is added
3473                                  * also to the context secure_bits so that we don't try to
3474                                  * drop the bit away next. */
3475
3476                                 secure_bits |= 1<<SECURE_KEEP_CAPS;
3477                         }
3478                 }
3479         }
3480
3481         /* Apply working directory here, because the working directory might be on NFS and only the user running
3482          * this service might have the correct privilege to change to the working directory */
3483         r = apply_working_directory(context, params, home, needs_mount_namespace, exit_status);
3484         if (r < 0)
3485                 return log_unit_error_errno(unit, r, "Changing to the requested working directory failed: %m");
3486
3487         if (needs_sandboxing) {
3488                 /* Apply other MAC contexts late, but before seccomp syscall filtering, as those should really be last to
3489                  * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires
3490                  * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls
3491                  * are restricted. */
3492
3493 #if HAVE_SELINUX
3494                 if (use_selinux) {
3495                         char *exec_context = mac_selinux_context_net ?: context->selinux_context;
3496
3497                         if (exec_context) {
3498                                 r = setexeccon(exec_context);
3499                                 if (r < 0) {
3500                                         *exit_status = EXIT_SELINUX_CONTEXT;
3501                                         return log_unit_error_errno(unit, r, "Failed to change SELinux context to %s: %m", exec_context);
3502                                 }
3503                         }
3504                 }
3505 #endif
3506
3507 #if HAVE_APPARMOR
3508                 if (use_apparmor && context->apparmor_profile) {
3509                         r = aa_change_onexec(context->apparmor_profile);
3510                         if (r < 0 && !context->apparmor_profile_ignore) {
3511                                 *exit_status = EXIT_APPARMOR_PROFILE;
3512                                 return log_unit_error_errno(unit, errno, "Failed to prepare AppArmor profile change to %s: %m", context->apparmor_profile);
3513                         }
3514                 }
3515 #endif
3516
3517                 /* PR_GET_SECUREBITS is not privileged, while PR_SET_SECUREBITS is. So to suppress potential EPERMs
3518                  * we'll try not to call PR_SET_SECUREBITS unless necessary. */
3519                 if (prctl(PR_GET_SECUREBITS) != secure_bits)
3520                         if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
3521                                 *exit_status = EXIT_SECUREBITS;
3522                                 return log_unit_error_errno(unit, errno, "Failed to set process secure bits: %m");
3523                         }
3524
3525                 if (context_has_no_new_privileges(context))
3526                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
3527                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
3528                                 return log_unit_error_errno(unit, errno, "Failed to disable new privileges: %m");
3529                         }
3530
3531 #if HAVE_SECCOMP
3532                 r = apply_address_families(unit, context);
3533                 if (r < 0) {
3534                         *exit_status = EXIT_ADDRESS_FAMILIES;
3535                         return log_unit_error_errno(unit, r, "Failed to restrict address families: %m");
3536                 }
3537
3538                 r = apply_memory_deny_write_execute(unit, context);
3539                 if (r < 0) {
3540                         *exit_status = EXIT_SECCOMP;
3541                         return log_unit_error_errno(unit, r, "Failed to disable writing to executable memory: %m");
3542                 }
3543
3544                 r = apply_restrict_realtime(unit, context);
3545                 if (r < 0) {
3546                         *exit_status = EXIT_SECCOMP;
3547                         return log_unit_error_errno(unit, r, "Failed to apply realtime restrictions: %m");
3548                 }
3549
3550                 r = apply_restrict_namespaces(unit, context);
3551                 if (r < 0) {
3552                         *exit_status = EXIT_SECCOMP;
3553                         return log_unit_error_errno(unit, r, "Failed to apply namespace restrictions: %m");
3554                 }
3555
3556                 r = apply_protect_sysctl(unit, context);
3557                 if (r < 0) {
3558                         *exit_status = EXIT_SECCOMP;
3559                         return log_unit_error_errno(unit, r, "Failed to apply sysctl restrictions: %m");
3560                 }
3561
3562                 r = apply_protect_kernel_modules(unit, context);
3563                 if (r < 0) {
3564                         *exit_status = EXIT_SECCOMP;
3565                         return log_unit_error_errno(unit, r, "Failed to apply module loading restrictions: %m");
3566                 }
3567
3568                 r = apply_private_devices(unit, context);
3569                 if (r < 0) {
3570                         *exit_status = EXIT_SECCOMP;
3571                         return log_unit_error_errno(unit, r, "Failed to set up private devices: %m");
3572                 }
3573
3574                 r = apply_syscall_archs(unit, context);
3575                 if (r < 0) {
3576                         *exit_status = EXIT_SECCOMP;
3577                         return log_unit_error_errno(unit, r, "Failed to apply syscall architecture restrictions: %m");
3578                 }
3579
3580                 r = apply_lock_personality(unit, context);
3581                 if (r < 0) {
3582                         *exit_status = EXIT_SECCOMP;
3583                         return log_unit_error_errno(unit, r, "Failed to lock personalities: %m");
3584                 }
3585
3586                 /* This really should remain the last step before the execve(), to make sure our own code is unaffected
3587                  * by the filter as little as possible. */
3588                 r = apply_syscall_filter(unit, context, needs_ambient_hack);
3589                 if (r < 0) {
3590                         *exit_status = EXIT_SECCOMP;
3591                         return log_unit_error_errno(unit, r, "Failed to apply system call filters: %m");
3592                 }
3593 #endif
3594         }
3595
3596         if (!strv_isempty(context->unset_environment)) {
3597                 char **ee = NULL;
3598
3599                 ee = strv_env_delete(accum_env, 1, context->unset_environment);
3600                 if (!ee) {
3601                         *exit_status = EXIT_MEMORY;
3602                         return log_oom();
3603                 }
3604
3605                 strv_free_and_replace(accum_env, ee);
3606         }
3607
3608         if (!FLAGS_SET(command->flags, EXEC_COMMAND_NO_ENV_EXPAND)) {
3609                 replaced_argv = replace_env_argv(command->argv, accum_env);
3610                 if (!replaced_argv) {
3611                         *exit_status = EXIT_MEMORY;
3612                         return log_oom();
3613                 }
3614                 final_argv = replaced_argv;
3615         } else
3616                 final_argv = command->argv;
3617
3618         if (DEBUG_LOGGING) {
3619                 _cleanup_free_ char *line;
3620
3621                 line = exec_command_line(final_argv);
3622                 if (line)
3623                         log_struct(LOG_DEBUG,
3624                                    "EXECUTABLE=%s", command->path,
3625                                    LOG_UNIT_MESSAGE(unit, "Executing: %s", line),
3626                                    LOG_UNIT_ID(unit),
3627                                    LOG_UNIT_INVOCATION_ID(unit));
3628         }
3629
3630         if (exec_fd >= 0) {
3631                 uint8_t hot = 1;
3632
3633                 /* We have finished with all our initializations. Let's now let the manager know that. From this point
3634                  * on, if the manager sees POLLHUP on the exec_fd, then execve() was successful. */
3635
3636                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
3637                         *exit_status = EXIT_EXEC;
3638                         return log_unit_error_errno(unit, errno, "Failed to enable exec_fd: %m");
3639                 }
3640         }
3641
3642         execve(command->path, final_argv, accum_env);
3643         r = -errno;
3644
3645         if (exec_fd >= 0) {
3646                 uint8_t hot = 0;
3647
3648                 /* The execve() failed. This means the exec_fd is still open. Which means we need to tell the manager
3649                  * that POLLHUP on it no longer means execve() succeeded. */
3650
3651                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
3652                         *exit_status = EXIT_EXEC;
3653                         return log_unit_error_errno(unit, errno, "Failed to disable exec_fd: %m");
3654                 }
3655         }
3656
3657         if (r == -ENOENT && (command->flags & EXEC_COMMAND_IGNORE_FAILURE)) {
3658                 log_struct_errno(LOG_INFO, r,
3659                                  "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
3660                                  LOG_UNIT_ID(unit),
3661                                  LOG_UNIT_INVOCATION_ID(unit),
3662                                  LOG_UNIT_MESSAGE(unit, "Executable %s missing, skipping: %m",
3663                                                   command->path),
3664                                  "EXECUTABLE=%s", command->path);
3665                 return 0;
3666         }
3667
3668         *exit_status = EXIT_EXEC;
3669         return log_unit_error_errno(unit, r, "Failed to execute command: %m");
3670 }
3671
3672 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l);
3673 static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[3]);
3674
3675 int exec_spawn(Unit *unit,
3676                ExecCommand *command,
3677                const ExecContext *context,
3678                const ExecParameters *params,
3679                ExecRuntime *runtime,
3680                DynamicCreds *dcreds,
3681                pid_t *ret) {
3682
3683         int socket_fd, r, named_iofds[3] = { -1, -1, -1 }, *fds = NULL;
3684         _cleanup_free_ char *subcgroup_path = NULL;
3685         _cleanup_strv_free_ char **files_env = NULL;
3686         size_t n_storage_fds = 0, n_socket_fds = 0;
3687         _cleanup_free_ char *line = NULL;
3688         pid_t pid;
3689
3690         assert(unit);
3691         assert(command);
3692         assert(context);
3693         assert(ret);
3694         assert(params);
3695         assert(params->fds || (params->n_socket_fds + params->n_storage_fds <= 0));
3696
3697         if (context->std_input == EXEC_INPUT_SOCKET ||
3698             context->std_output == EXEC_OUTPUT_SOCKET ||
3699             context->std_error == EXEC_OUTPUT_SOCKET) {
3700
3701                 if (params->n_socket_fds > 1) {
3702                         log_unit_error(unit, "Got more than one socket.");
3703                         return -EINVAL;
3704                 }
3705
3706                 if (params->n_socket_fds == 0) {
3707                         log_unit_error(unit, "Got no socket.");
3708                         return -EINVAL;
3709                 }
3710
3711                 socket_fd = params->fds[0];
3712         } else {
3713                 socket_fd = -1;
3714                 fds = params->fds;
3715                 n_socket_fds = params->n_socket_fds;
3716                 n_storage_fds = params->n_storage_fds;
3717         }
3718
3719         r = exec_context_named_iofds(context, params, named_iofds);
3720         if (r < 0)
3721                 return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m");
3722
3723         r = exec_context_load_environment(unit, context, &files_env);
3724         if (r < 0)
3725                 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
3726
3727         line = exec_command_line(command->argv);
3728         if (!line)
3729                 return log_oom();
3730
3731         log_struct(LOG_DEBUG,
3732                    LOG_UNIT_MESSAGE(unit, "About to execute: %s", line),
3733                    "EXECUTABLE=%s", command->path,
3734                    LOG_UNIT_ID(unit),
3735                    LOG_UNIT_INVOCATION_ID(unit));
3736
3737         if (params->cgroup_path) {
3738                 r = exec_parameters_get_cgroup_path(params, &subcgroup_path);
3739                 if (r < 0)
3740                         return log_unit_error_errno(unit, r, "Failed to acquire subcgroup path: %m");
3741                 if (r > 0) { /* We are using a child cgroup */
3742                         r = cg_create(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path);
3743                         if (r < 0)
3744                                 return log_unit_error_errno(unit, r, "Failed to create control group '%s': %m", subcgroup_path);
3745                 }
3746         }
3747
3748         pid = fork();
3749         if (pid < 0)
3750                 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
3751
3752         if (pid == 0) {
3753                 int exit_status = EXIT_SUCCESS;
3754
3755                 r = exec_child(unit,
3756                                command,
3757                                context,
3758                                params,
3759                                runtime,
3760                                dcreds,
3761                                socket_fd,
3762                                named_iofds,
3763                                fds,
3764                                n_socket_fds,
3765                                n_storage_fds,
3766                                files_env,
3767                                unit->manager->user_lookup_fds[1],
3768                                &exit_status);
3769
3770                 if (r < 0)
3771                         log_struct_errno(LOG_ERR, r,
3772                                          "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
3773                                          LOG_UNIT_ID(unit),
3774                                          LOG_UNIT_INVOCATION_ID(unit),
3775                                          LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
3776                                                           exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
3777                                                           command->path),
3778                                          "EXECUTABLE=%s", command->path);
3779
3780                 _exit(exit_status);
3781         }
3782
3783         log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
3784
3785         /* We add the new process to the cgroup both in the child (so that we can be sure that no user code is ever
3786          * executed outside of the cgroup) and in the parent (so that we can be sure that when we kill the cgroup the
3787          * process will be killed too). */
3788         if (subcgroup_path)
3789                 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path, pid);
3790
3791         exec_status_start(&command->exec_status, pid);
3792
3793         *ret = pid;
3794         return 0;
3795 }
3796
3797 void exec_context_init(ExecContext *c) {
3798         ExecDirectoryType i;
3799
3800         assert(c);
3801
3802         c->umask = 0022;
3803         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
3804         c->cpu_sched_policy = SCHED_OTHER;
3805         c->syslog_priority = LOG_DAEMON|LOG_INFO;
3806         c->syslog_level_prefix = true;
3807         c->ignore_sigpipe = true;
3808         c->timer_slack_nsec = NSEC_INFINITY;
3809         c->personality = PERSONALITY_INVALID;
3810         for (i = 0; i < _EXEC_DIRECTORY_TYPE_MAX; i++)
3811                 c->directories[i].mode = 0755;
3812         c->capability_bounding_set = CAP_ALL;
3813         assert_cc(NAMESPACE_FLAGS_INITIAL != NAMESPACE_FLAGS_ALL);
3814         c->restrict_namespaces = NAMESPACE_FLAGS_INITIAL;
3815         c->log_level_max = -1;
3816 }
3817
3818 void exec_context_done(ExecContext *c) {
3819         ExecDirectoryType i;
3820         size_t l;
3821
3822         assert(c);
3823
3824         c->environment = strv_free(c->environment);
3825         c->environment_files = strv_free(c->environment_files);
3826         c->pass_environment = strv_free(c->pass_environment);
3827         c->unset_environment = strv_free(c->unset_environment);
3828
3829         rlimit_free_all(c->rlimit);
3830
3831         for (l = 0; l < 3; l++) {
3832                 c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);
3833                 c->stdio_file[l] = mfree(c->stdio_file[l]);
3834         }
3835
3836         c->working_directory = mfree(c->working_directory);
3837         c->root_directory = mfree(c->root_directory);
3838         c->root_image = mfree(c->root_image);
3839         c->tty_path = mfree(c->tty_path);
3840         c->syslog_identifier = mfree(c->syslog_identifier);
3841         c->user = mfree(c->user);
3842         c->group = mfree(c->group);
3843
3844         c->supplementary_groups = strv_free(c->supplementary_groups);
3845
3846         c->pam_name = mfree(c->pam_name);
3847
3848         c->read_only_paths = strv_free(c->read_only_paths);
3849         c->read_write_paths = strv_free(c->read_write_paths);
3850         c->inaccessible_paths = strv_free(c->inaccessible_paths);
3851
3852         bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
3853         c->bind_mounts = NULL;
3854         c->n_bind_mounts = 0;
3855         temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);
3856         c->temporary_filesystems = NULL;
3857         c->n_temporary_filesystems = 0;
3858
3859         c->cpuset = cpu_set_mfree(c->cpuset);
3860
3861         c->utmp_id = mfree(c->utmp_id);
3862         c->selinux_context = mfree(c->selinux_context);
3863         c->apparmor_profile = mfree(c->apparmor_profile);
3864         c->smack_process_label = mfree(c->smack_process_label);
3865
3866         c->syscall_filter = hashmap_free(c->syscall_filter);
3867         c->syscall_archs = set_free(c->syscall_archs);
3868         c->address_families = set_free(c->address_families);
3869
3870         for (i = 0; i < _EXEC_DIRECTORY_TYPE_MAX; i++)
3871                 c->directories[i].paths = strv_free(c->directories[i].paths);
3872
3873         c->log_level_max = -1;
3874
3875         exec_context_free_log_extra_fields(c);
3876
3877         c->log_rate_limit_interval_usec = 0;
3878         c->log_rate_limit_burst = 0;
3879
3880         c->stdin_data = mfree(c->stdin_data);
3881         c->stdin_data_size = 0;
3882 }
3883
3884 int exec_context_destroy_runtime_directory(const ExecContext *c, const char *runtime_prefix) {
3885         char **i;
3886
3887         assert(c);
3888
3889         if (!runtime_prefix)
3890                 return 0;
3891
3892         STRV_FOREACH(i, c->directories[EXEC_DIRECTORY_RUNTIME].paths) {
3893                 _cleanup_free_ char *p;
3894
3895                 p = strjoin(runtime_prefix, "/", *i);
3896                 if (!p)
3897                         return -ENOMEM;
3898
3899                 /* We execute this synchronously, since we need to be sure this is gone when we start the service
3900                  * next. */
3901                 (void) rm_rf(p, REMOVE_ROOT);
3902         }
3903
3904         return 0;
3905 }
3906
3907 static void exec_command_done(ExecCommand *c) {
3908         assert(c);
3909
3910         c->path = mfree(c->path);
3911         c->argv = strv_free(c->argv);
3912 }
3913
3914 void exec_command_done_array(ExecCommand *c, size_t n) {
3915         size_t i;
3916
3917         for (i = 0; i < n; i++)
3918                 exec_command_done(c+i);
3919 }
3920
3921 ExecCommand* exec_command_free_list(ExecCommand *c) {
3922         ExecCommand *i;
3923
3924         while ((i = c)) {
3925                 LIST_REMOVE(command, c, i);
3926                 exec_command_done(i);
3927                 free(i);
3928         }
3929
3930         return NULL;
3931 }
3932
3933 void exec_command_free_array(ExecCommand **c, size_t n) {
3934         size_t i;
3935
3936         for (i = 0; i < n; i++)
3937                 c[i] = exec_command_free_list(c[i]);
3938 }
3939
3940 void exec_command_reset_status_array(ExecCommand *c, size_t n) {
3941         size_t i;
3942
3943         for (i = 0; i < n; i++)
3944                 exec_status_reset(&c[i].exec_status);
3945 }
3946
3947 void exec_command_reset_status_list_array(ExecCommand **c, size_t n) {
3948         size_t i;
3949
3950         for (i = 0; i < n; i++) {
3951                 ExecCommand *z;
3952
3953                 LIST_FOREACH(command, z, c[i])
3954                         exec_status_reset(&z->exec_status);
3955         }
3956 }
3957
3958 typedef struct InvalidEnvInfo {
3959         const Unit *unit;
3960         const char *path;
3961 } InvalidEnvInfo;
3962
3963 static void invalid_env(const char *p, void *userdata) {
3964         InvalidEnvInfo *info = userdata;
3965
3966         log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
3967 }
3968
3969 const char* exec_context_fdname(const ExecContext *c, int fd_index) {
3970         assert(c);
3971
3972         switch (fd_index) {
3973
3974         case STDIN_FILENO:
3975                 if (c->std_input != EXEC_INPUT_NAMED_FD)
3976                         return NULL;
3977
3978                 return c->stdio_fdname[STDIN_FILENO] ?: "stdin";
3979
3980         case STDOUT_FILENO:
3981                 if (c->std_output != EXEC_OUTPUT_NAMED_FD)
3982                         return NULL;
3983
3984                 return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";
3985
3986         case STDERR_FILENO:
3987                 if (c->std_error != EXEC_OUTPUT_NAMED_FD)
3988                         return NULL;
3989
3990                 return c->stdio_fdname[STDERR_FILENO] ?: "stderr";
3991
3992         default:
3993                 return NULL;
3994         }
3995 }
3996
3997 static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[static 3]) {
3998         size_t i, targets;
3999         const char* stdio_fdname[3];
4000         size_t n_fds;
4001
4002         assert(c);
4003         assert(p);
4004
4005         targets = (c->std_input == EXEC_INPUT_NAMED_FD) +
4006                   (c->std_output == EXEC_OUTPUT_NAMED_FD) +
4007                   (c->std_error == EXEC_OUTPUT_NAMED_FD);
4008
4009         for (i = 0; i < 3; i++)
4010                 stdio_fdname[i] = exec_context_fdname(c, i);
4011
4012         n_fds = p->n_storage_fds + p->n_socket_fds;
4013
4014         for (i = 0; i < n_fds  && targets > 0; i++)
4015                 if (named_iofds[STDIN_FILENO] < 0 &&
4016                     c->std_input == EXEC_INPUT_NAMED_FD &&
4017                     stdio_fdname[STDIN_FILENO] &&
4018                     streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) {
4019
4020                         named_iofds[STDIN_FILENO] = p->fds[i];
4021                         targets--;
4022
4023                 } else if (named_iofds[STDOUT_FILENO] < 0 &&
4024                            c->std_output == EXEC_OUTPUT_NAMED_FD &&
4025                            stdio_fdname[STDOUT_FILENO] &&
4026                            streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) {
4027
4028                         named_iofds[STDOUT_FILENO] = p->fds[i];
4029                         targets--;
4030
4031                 } else if (named_iofds[STDERR_FILENO] < 0 &&
4032                            c->std_error == EXEC_OUTPUT_NAMED_FD &&
4033                            stdio_fdname[STDERR_FILENO] &&
4034                            streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) {
4035
4036                         named_iofds[STDERR_FILENO] = p->fds[i];
4037                         targets--;
4038                 }
4039
4040         return targets == 0 ? 0 : -ENOENT;
4041 }
4042
4043 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l) {
4044         char **i, **r = NULL;
4045
4046         assert(c);
4047         assert(l);
4048
4049         STRV_FOREACH(i, c->environment_files) {
4050                 char *fn;
4051                 int k;
4052                 unsigned n;
4053                 bool ignore = false;
4054                 char **p;
4055                 _cleanup_globfree_ glob_t pglob = {};
4056
4057                 fn = *i;
4058
4059                 if (fn[0] == '-') {
4060                         ignore = true;
4061                         fn++;
4062                 }
4063
4064                 if (!path_is_absolute(fn)) {
4065                         if (ignore)
4066                                 continue;
4067
4068                         strv_free(r);
4069                         return -EINVAL;
4070                 }
4071
4072                 /* Filename supports globbing, take all matching files */
4073                 k = safe_glob(fn, 0, &pglob);
4074                 if (k < 0) {
4075                         if (ignore)
4076                                 continue;
4077
4078                         strv_free(r);
4079                         return k;
4080                 }
4081
4082                 /* When we don't match anything, -ENOENT should be returned */
4083                 assert(pglob.gl_pathc > 0);
4084
4085                 for (n = 0; n < pglob.gl_pathc; n++) {
4086                         k = load_env_file(NULL, pglob.gl_pathv[n], &p);
4087                         if (k < 0) {
4088                                 if (ignore)
4089                                         continue;
4090
4091                                 strv_free(r);
4092                                 return k;
4093                         }
4094                         /* Log invalid environment variables with filename */
4095                         if (p) {
4096                                 InvalidEnvInfo info = {
4097                                         .unit = unit,
4098                                         .path = pglob.gl_pathv[n]
4099                                 };
4100
4101                                 p = strv_env_clean_with_callback(p, invalid_env, &info);
4102                         }
4103
4104                         if (!r)
4105                                 r = p;
4106                         else {
4107                                 char **m;
4108
4109                                 m = strv_env_merge(2, r, p);
4110                                 strv_free(r);
4111                                 strv_free(p);
4112                                 if (!m)
4113                                         return -ENOMEM;
4114
4115                                 r = m;
4116                         }
4117                 }
4118         }
4119
4120         *l = r;
4121
4122         return 0;
4123 }
4124
4125 static bool tty_may_match_dev_console(const char *tty) {
4126         _cleanup_free_ char *resolved = NULL;
4127
4128         if (!tty)
4129                 return true;
4130
4131         tty = skip_dev_prefix(tty);
4132
4133         /* trivial identity? */
4134         if (streq(tty, "console"))
4135                 return true;
4136
4137         if (resolve_dev_console(&resolved) < 0)
4138                 return true; /* if we could not resolve, assume it may */
4139
4140         /* "tty0" means the active VC, so it may be the same sometimes */
4141         return streq(resolved, tty) || (streq(resolved, "tty0") && tty_is_vc(tty));
4142 }
4143
4144 bool exec_context_may_touch_console(const ExecContext *ec) {
4145
4146         return (ec->tty_reset ||
4147                 ec->tty_vhangup ||
4148                 ec->tty_vt_disallocate ||
4149                 is_terminal_input(ec->std_input) ||
4150                 is_terminal_output(ec->std_output) ||
4151                 is_terminal_output(ec->std_error)) &&
4152                tty_may_match_dev_console(exec_context_tty_path(ec));
4153 }
4154
4155 static void strv_fprintf(FILE *f, char **l) {
4156         char **g;
4157
4158         assert(f);
4159
4160         STRV_FOREACH(g, l)
4161                 fprintf(f, " %s", *g);
4162 }
4163
4164 void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
4165         ExecDirectoryType dt;
4166         char **e, **d;
4167         unsigned i;
4168         int r;
4169
4170         assert(c);
4171         assert(f);
4172
4173         prefix = strempty(prefix);
4174
4175         fprintf(f,
4176                 "%sUMask: %04o\n"
4177                 "%sWorkingDirectory: %s\n"
4178                 "%sRootDirectory: %s\n"
4179                 "%sNonBlocking: %s\n"
4180                 "%sPrivateTmp: %s\n"
4181                 "%sPrivateDevices: %s\n"
4182                 "%sProtectKernelTunables: %s\n"
4183                 "%sProtectKernelModules: %s\n"
4184                 "%sProtectControlGroups: %s\n"
4185                 "%sPrivateNetwork: %s\n"
4186                 "%sPrivateUsers: %s\n"
4187                 "%sProtectHome: %s\n"
4188                 "%sProtectSystem: %s\n"
4189                 "%sMountAPIVFS: %s\n"
4190                 "%sIgnoreSIGPIPE: %s\n"
4191                 "%sMemoryDenyWriteExecute: %s\n"
4192                 "%sRestrictRealtime: %s\n"
4193                 "%sKeyringMode: %s\n"
4194                 "%sProtectHostname: %s\n",
4195                 prefix, c->umask,
4196                 prefix, c->working_directory ? c->working_directory : "/",
4197                 prefix, c->root_directory ? c->root_directory : "/",
4198                 prefix, yes_no(c->non_blocking),
4199                 prefix, yes_no(c->private_tmp),
4200                 prefix, yes_no(c->private_devices),
4201                 prefix, yes_no(c->protect_kernel_tunables),
4202                 prefix, yes_no(c->protect_kernel_modules),
4203                 prefix, yes_no(c->protect_control_groups),
4204                 prefix, yes_no(c->private_network),
4205                 prefix, yes_no(c->private_users),
4206                 prefix, protect_home_to_string(c->protect_home),
4207                 prefix, protect_system_to_string(c->protect_system),
4208                 prefix, yes_no(c->mount_apivfs),
4209                 prefix, yes_no(c->ignore_sigpipe),
4210                 prefix, yes_no(c->memory_deny_write_execute),
4211                 prefix, yes_no(c->restrict_realtime),
4212                 prefix, exec_keyring_mode_to_string(c->keyring_mode),
4213                 prefix, yes_no(c->protect_hostname));
4214
4215         if (c->root_image)
4216                 fprintf(f, "%sRootImage: %s\n", prefix, c->root_image);
4217
4218         STRV_FOREACH(e, c->environment)
4219                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
4220
4221         STRV_FOREACH(e, c->environment_files)
4222                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
4223
4224         STRV_FOREACH(e, c->pass_environment)
4225                 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
4226
4227         STRV_FOREACH(e, c->unset_environment)
4228                 fprintf(f, "%sUnsetEnvironment: %s\n", prefix, *e);
4229
4230         fprintf(f, "%sRuntimeDirectoryPreserve: %s\n", prefix, exec_preserve_mode_to_string(c->runtime_directory_preserve_mode));
4231
4232         for (dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
4233                 fprintf(f, "%s%sMode: %04o\n", prefix, exec_directory_type_to_string(dt), c->directories[dt].mode);
4234
4235                 STRV_FOREACH(d, c->directories[dt].paths)
4236                         fprintf(f, "%s%s: %s\n", prefix, exec_directory_type_to_string(dt), *d);
4237         }
4238
4239         if (c->nice_set)
4240                 fprintf(f,
4241                         "%sNice: %i\n",
4242                         prefix, c->nice);
4243
4244         if (c->oom_score_adjust_set)
4245                 fprintf(f,
4246                         "%sOOMScoreAdjust: %i\n",
4247                         prefix, c->oom_score_adjust);
4248
4249         for (i = 0; i < RLIM_NLIMITS; i++)
4250                 if (c->rlimit[i]) {
4251                         fprintf(f, "%sLimit%s: " RLIM_FMT "\n",
4252                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
4253                         fprintf(f, "%sLimit%sSoft: " RLIM_FMT "\n",
4254                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
4255                 }
4256
4257         if (c->ioprio_set) {
4258                 _cleanup_free_ char *class_str = NULL;
4259
4260                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
4261                 if (r >= 0)
4262                         fprintf(f, "%sIOSchedulingClass: %s\n", prefix, class_str);
4263
4264                 fprintf(f, "%sIOPriority: %lu\n", prefix, IOPRIO_PRIO_DATA(c->ioprio));
4265         }
4266
4267         if (c->cpu_sched_set) {
4268                 _cleanup_free_ char *policy_str = NULL;
4269
4270                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
4271                 if (r >= 0)
4272                         fprintf(f, "%sCPUSchedulingPolicy: %s\n", prefix, policy_str);
4273
4274                 fprintf(f,
4275                         "%sCPUSchedulingPriority: %i\n"
4276                         "%sCPUSchedulingResetOnFork: %s\n",
4277                         prefix, c->cpu_sched_priority,
4278                         prefix, yes_no(c->cpu_sched_reset_on_fork));
4279         }
4280
4281         if (c->cpuset) {
4282                 fprintf(f, "%sCPUAffinity:", prefix);
4283                 for (i = 0; i < c->cpuset_ncpus; i++)
4284                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
4285                                 fprintf(f, " %u", i);
4286                 fputs("\n", f);
4287         }
4288
4289         if (c->timer_slack_nsec != NSEC_INFINITY)
4290                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
4291
4292         fprintf(f,
4293                 "%sStandardInput: %s\n"
4294                 "%sStandardOutput: %s\n"
4295                 "%sStandardError: %s\n",
4296                 prefix, exec_input_to_string(c->std_input),
4297                 prefix, exec_output_to_string(c->std_output),
4298                 prefix, exec_output_to_string(c->std_error));
4299
4300         if (c->std_input == EXEC_INPUT_NAMED_FD)
4301                 fprintf(f, "%sStandardInputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDIN_FILENO]);
4302         if (c->std_output == EXEC_OUTPUT_NAMED_FD)
4303                 fprintf(f, "%sStandardOutputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDOUT_FILENO]);
4304         if (c->std_error == EXEC_OUTPUT_NAMED_FD)
4305                 fprintf(f, "%sStandardErrorFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDERR_FILENO]);
4306
4307         if (c->std_input == EXEC_INPUT_FILE)
4308                 fprintf(f, "%sStandardInputFile: %s\n", prefix, c->stdio_file[STDIN_FILENO]);
4309         if (c->std_output == EXEC_OUTPUT_FILE)
4310                 fprintf(f, "%sStandardOutputFile: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
4311         if (c->std_output == EXEC_OUTPUT_FILE_APPEND)
4312                 fprintf(f, "%sStandardOutputFileToAppend: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
4313         if (c->std_error == EXEC_OUTPUT_FILE)
4314                 fprintf(f, "%sStandardErrorFile: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
4315         if (c->std_error == EXEC_OUTPUT_FILE_APPEND)
4316                 fprintf(f, "%sStandardErrorFileToAppend: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
4317
4318         if (c->tty_path)
4319                 fprintf(f,
4320                         "%sTTYPath: %s\n"
4321                         "%sTTYReset: %s\n"
4322                         "%sTTYVHangup: %s\n"
4323                         "%sTTYVTDisallocate: %s\n",
4324                         prefix, c->tty_path,
4325                         prefix, yes_no(c->tty_reset),
4326                         prefix, yes_no(c->tty_vhangup),
4327                         prefix, yes_no(c->tty_vt_disallocate));
4328
4329         if (IN_SET(c->std_output,
4330                    EXEC_OUTPUT_SYSLOG,
4331                    EXEC_OUTPUT_KMSG,
4332                    EXEC_OUTPUT_JOURNAL,
4333                    EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
4334                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
4335                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE) ||
4336             IN_SET(c->std_error,
4337                    EXEC_OUTPUT_SYSLOG,
4338                    EXEC_OUTPUT_KMSG,
4339                    EXEC_OUTPUT_JOURNAL,
4340                    EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
4341                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
4342                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE)) {
4343
4344                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
4345
4346                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
4347                 if (r >= 0)
4348                         fprintf(f, "%sSyslogFacility: %s\n", prefix, fac_str);
4349
4350                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
4351                 if (r >= 0)
4352                         fprintf(f, "%sSyslogLevel: %s\n", prefix, lvl_str);
4353         }
4354
4355         if (c->log_level_max >= 0) {
4356                 _cleanup_free_ char *t = NULL;
4357
4358                 (void) log_level_to_string_alloc(c->log_level_max, &t);
4359
4360                 fprintf(f, "%sLogLevelMax: %s\n", prefix, strna(t));
4361         }
4362
4363         if (c->log_rate_limit_interval_usec > 0) {
4364                 char buf_timespan[FORMAT_TIMESPAN_MAX];
4365
4366                 fprintf(f,
4367                         "%sLogRateLimitIntervalSec: %s\n",
4368                         prefix, format_timespan(buf_timespan, sizeof(buf_timespan), c->log_rate_limit_interval_usec, USEC_PER_SEC));
4369         }
4370
4371         if (c->log_rate_limit_burst > 0)
4372                 fprintf(f, "%sLogRateLimitBurst: %u\n", prefix, c->log_rate_limit_burst);
4373
4374         if (c->n_log_extra_fields > 0) {
4375                 size_t j;
4376
4377                 for (j = 0; j < c->n_log_extra_fields; j++) {
4378                         fprintf(f, "%sLogExtraFields: ", prefix);
4379                         fwrite(c->log_extra_fields[j].iov_base,
4380                                1, c->log_extra_fields[j].iov_len,
4381                                f);
4382                         fputc('\n', f);
4383                 }
4384         }
4385
4386         if (c->secure_bits) {
4387                 _cleanup_free_ char *str = NULL;
4388
4389                 r = secure_bits_to_string_alloc(c->secure_bits, &str);
4390                 if (r >= 0)
4391                         fprintf(f, "%sSecure Bits: %s\n", prefix, str);
4392         }
4393
4394         if (c->capability_bounding_set != CAP_ALL) {
4395                 _cleanup_free_ char *str = NULL;
4396
4397                 r = capability_set_to_string_alloc(c->capability_bounding_set, &str);
4398                 if (r >= 0)
4399                         fprintf(f, "%sCapabilityBoundingSet: %s\n", prefix, str);
4400         }
4401
4402         if (c->capability_ambient_set != 0) {
4403                 _cleanup_free_ char *str = NULL;
4404
4405                 r = capability_set_to_string_alloc(c->capability_ambient_set, &str);
4406                 if (r >= 0)
4407                         fprintf(f, "%sAmbientCapabilities: %s\n", prefix, str);
4408         }
4409
4410         if (c->user)
4411                 fprintf(f, "%sUser: %s\n", prefix, c->user);
4412         if (c->group)
4413                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
4414
4415         fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
4416
4417         if (!strv_isempty(c->supplementary_groups)) {
4418                 fprintf(f, "%sSupplementaryGroups:", prefix);
4419                 strv_fprintf(f, c->supplementary_groups);
4420                 fputs("\n", f);
4421         }
4422
4423         if (c->pam_name)
4424                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
4425
4426         if (!strv_isempty(c->read_write_paths)) {
4427                 fprintf(f, "%sReadWritePaths:", prefix);
4428                 strv_fprintf(f, c->read_write_paths);
4429                 fputs("\n", f);
4430         }
4431
4432         if (!strv_isempty(c->read_only_paths)) {
4433                 fprintf(f, "%sReadOnlyPaths:", prefix);
4434                 strv_fprintf(f, c->read_only_paths);
4435                 fputs("\n", f);
4436         }
4437
4438         if (!strv_isempty(c->inaccessible_paths)) {
4439                 fprintf(f, "%sInaccessiblePaths:", prefix);
4440                 strv_fprintf(f, c->inaccessible_paths);
4441                 fputs("\n", f);
4442         }
4443
4444         if (c->n_bind_mounts > 0)
4445                 for (i = 0; i < c->n_bind_mounts; i++)
4446                         fprintf(f, "%s%s: %s%s:%s:%s\n", prefix,
4447                                 c->bind_mounts[i].read_only ? "BindReadOnlyPaths" : "BindPaths",
4448                                 c->bind_mounts[i].ignore_enoent ? "-": "",
4449                                 c->bind_mounts[i].source,
4450                                 c->bind_mounts[i].destination,
4451                                 c->bind_mounts[i].recursive ? "rbind" : "norbind");
4452
4453         if (c->n_temporary_filesystems > 0)
4454                 for (i = 0; i < c->n_temporary_filesystems; i++) {
4455                         TemporaryFileSystem *t = c->temporary_filesystems + i;
4456
4457                         fprintf(f, "%sTemporaryFileSystem: %s%s%s\n", prefix,
4458                                 t->path,
4459                                 isempty(t->options) ? "" : ":",
4460                                 strempty(t->options));
4461                 }
4462
4463         if (c->utmp_id)
4464                 fprintf(f,
4465                         "%sUtmpIdentifier: %s\n",
4466                         prefix, c->utmp_id);
4467
4468         if (c->selinux_context)
4469                 fprintf(f,
4470                         "%sSELinuxContext: %s%s\n",
4471                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
4472
4473         if (c->apparmor_profile)
4474                 fprintf(f,
4475                         "%sAppArmorProfile: %s%s\n",
4476                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
4477
4478         if (c->smack_process_label)
4479                 fprintf(f,
4480                         "%sSmackProcessLabel: %s%s\n",
4481                         prefix, c->smack_process_label_ignore ? "-" : "", c->smack_process_label);
4482
4483         if (c->personality != PERSONALITY_INVALID)
4484                 fprintf(f,
4485                         "%sPersonality: %s\n",
4486                         prefix, strna(personality_to_string(c->personality)));
4487
4488         fprintf(f,
4489                 "%sLockPersonality: %s\n",
4490                 prefix, yes_no(c->lock_personality));
4491
4492         if (c->syscall_filter) {
4493 #if HAVE_SECCOMP
4494                 Iterator j;
4495                 void *id, *val;
4496                 bool first = true;
4497 #endif
4498
4499                 fprintf(f,
4500                         "%sSystemCallFilter: ",
4501                         prefix);
4502
4503                 if (!c->syscall_whitelist)
4504                         fputc('~', f);
4505
4506 #if HAVE_SECCOMP
4507                 HASHMAP_FOREACH_KEY(val, id, c->syscall_filter, j) {
4508                         _cleanup_free_ char *name = NULL;
4509                         const char *errno_name = NULL;
4510                         int num = PTR_TO_INT(val);
4511
4512                         if (first)
4513                                 first = false;
4514                         else
4515                                 fputc(' ', f);
4516
4517                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
4518                         fputs(strna(name), f);
4519
4520                         if (num >= 0) {
4521                                 errno_name = errno_to_name(num);
4522                                 if (errno_name)
4523                                         fprintf(f, ":%s", errno_name);
4524                                 else
4525                                         fprintf(f, ":%d", num);
4526                         }
4527                 }
4528 #endif
4529
4530                 fputc('\n', f);
4531         }
4532
4533         if (c->syscall_archs) {
4534 #if HAVE_SECCOMP
4535                 Iterator j;
4536                 void *id;
4537 #endif
4538
4539                 fprintf(f,
4540                         "%sSystemCallArchitectures:",
4541                         prefix);
4542
4543 #if HAVE_SECCOMP
4544                 SET_FOREACH(id, c->syscall_archs, j)
4545                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
4546 #endif
4547                 fputc('\n', f);
4548         }
4549
4550         if (exec_context_restrict_namespaces_set(c)) {
4551                 _cleanup_free_ char *s = NULL;
4552
4553                 r = namespace_flags_to_string(c->restrict_namespaces, &s);
4554                 if (r >= 0)
4555                         fprintf(f, "%sRestrictNamespaces: %s\n",
4556                                 prefix, s);
4557         }
4558
4559         if (c->syscall_errno > 0) {
4560                 const char *errno_name;
4561
4562                 fprintf(f, "%sSystemCallErrorNumber: ", prefix);
4563
4564                 errno_name = errno_to_name(c->syscall_errno);
4565                 if (errno_name)
4566                         fprintf(f, "%s\n", errno_name);
4567                 else
4568                         fprintf(f, "%d\n", c->syscall_errno);
4569         }
4570
4571         if (c->apparmor_profile)
4572                 fprintf(f,
4573                         "%sAppArmorProfile: %s%s\n",
4574                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
4575 }
4576
4577 bool exec_context_maintains_privileges(const ExecContext *c) {
4578         assert(c);
4579
4580         /* Returns true if the process forked off would run under
4581          * an unchanged UID or as root. */
4582
4583         if (!c->user)
4584                 return true;
4585
4586         if (streq(c->user, "root") || streq(c->user, "0"))
4587                 return true;
4588
4589         return false;
4590 }
4591
4592 int exec_context_get_effective_ioprio(const ExecContext *c) {
4593         int p;
4594
4595         assert(c);
4596
4597         if (c->ioprio_set)
4598                 return c->ioprio;
4599
4600         p = ioprio_get(IOPRIO_WHO_PROCESS, 0);
4601         if (p < 0)
4602                 return IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 4);
4603
4604         return p;
4605 }
4606
4607 void exec_context_free_log_extra_fields(ExecContext *c) {
4608         size_t l;
4609
4610         assert(c);
4611
4612         for (l = 0; l < c->n_log_extra_fields; l++)
4613                 free(c->log_extra_fields[l].iov_base);
4614         c->log_extra_fields = mfree(c->log_extra_fields);
4615         c->n_log_extra_fields = 0;
4616 }
4617
4618 void exec_status_start(ExecStatus *s, pid_t pid) {
4619         assert(s);
4620
4621         *s = (ExecStatus) {
4622                 .pid = pid,
4623         };
4624
4625         dual_timestamp_get(&s->start_timestamp);
4626 }
4627
4628 void exec_status_exit(ExecStatus *s, const ExecContext *context, pid_t pid, int code, int status) {
4629         assert(s);
4630
4631         if (s->pid != pid) {
4632                 *s = (ExecStatus) {
4633                         .pid = pid,
4634                 };
4635         }
4636
4637         dual_timestamp_get(&s->exit_timestamp);
4638
4639         s->code = code;
4640         s->status = status;
4641
4642         if (context) {
4643                 if (context->utmp_id)
4644                         (void) utmp_put_dead_process(context->utmp_id, pid, code, status);
4645
4646                 exec_context_tty_reset(context, NULL);
4647         }
4648 }
4649
4650 void exec_status_reset(ExecStatus *s) {
4651         assert(s);
4652
4653         *s = (ExecStatus) {};
4654 }
4655
4656 void exec_status_dump(const ExecStatus *s, FILE *f, const char *prefix) {
4657         char buf[FORMAT_TIMESTAMP_MAX];
4658
4659         assert(s);
4660         assert(f);
4661
4662         if (s->pid <= 0)
4663                 return;
4664
4665         prefix = strempty(prefix);
4666
4667         fprintf(f,
4668                 "%sPID: "PID_FMT"\n",
4669                 prefix, s->pid);
4670
4671         if (dual_timestamp_is_set(&s->start_timestamp))
4672                 fprintf(f,
4673                         "%sStart Timestamp: %s\n",
4674                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
4675
4676         if (dual_timestamp_is_set(&s->exit_timestamp))
4677                 fprintf(f,
4678                         "%sExit Timestamp: %s\n"
4679                         "%sExit Code: %s\n"
4680                         "%sExit Status: %i\n",
4681                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
4682                         prefix, sigchld_code_to_string(s->code),
4683                         prefix, s->status);
4684 }
4685
4686 static char *exec_command_line(char **argv) {
4687         size_t k;
4688         char *n, *p, **a;
4689         bool first = true;
4690
4691         assert(argv);
4692
4693         k = 1;
4694         STRV_FOREACH(a, argv)
4695                 k += strlen(*a)+3;
4696
4697         n = new(char, k);
4698         if (!n)
4699                 return NULL;
4700
4701         p = n;
4702         STRV_FOREACH(a, argv) {
4703
4704                 if (!first)
4705                         *(p++) = ' ';
4706                 else
4707                         first = false;
4708
4709                 if (strpbrk(*a, WHITESPACE)) {
4710                         *(p++) = '\'';
4711                         p = stpcpy(p, *a);
4712                         *(p++) = '\'';
4713                 } else
4714                         p = stpcpy(p, *a);
4715
4716         }
4717
4718         *p = 0;
4719
4720         /* FIXME: this doesn't really handle arguments that have
4721          * spaces and ticks in them */
4722
4723         return n;
4724 }
4725
4726 static void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
4727         _cleanup_free_ char *cmd = NULL;
4728         const char *prefix2;
4729
4730         assert(c);
4731         assert(f);
4732
4733         prefix = strempty(prefix);
4734         prefix2 = strjoina(prefix, "\t");
4735
4736         cmd = exec_command_line(c->argv);
4737         fprintf(f,
4738                 "%sCommand Line: %s\n",
4739                 prefix, cmd ? cmd : strerror(ENOMEM));
4740
4741         exec_status_dump(&c->exec_status, f, prefix2);
4742 }
4743
4744 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
4745         assert(f);
4746
4747         prefix = strempty(prefix);
4748
4749         LIST_FOREACH(command, c, c)
4750                 exec_command_dump(c, f, prefix);
4751 }
4752
4753 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
4754         ExecCommand *end;
4755
4756         assert(l);
4757         assert(e);
4758
4759         if (*l) {
4760                 /* It's kind of important, that we keep the order here */
4761                 LIST_FIND_TAIL(command, *l, end);
4762                 LIST_INSERT_AFTER(command, *l, end, e);
4763         } else
4764               *l = e;
4765 }
4766
4767 int exec_command_set(ExecCommand *c, const char *path, ...) {
4768         va_list ap;
4769         char **l, *p;
4770
4771         assert(c);
4772         assert(path);
4773
4774         va_start(ap, path);
4775         l = strv_new_ap(path, ap);
4776         va_end(ap);
4777
4778         if (!l)
4779                 return -ENOMEM;
4780
4781         p = strdup(path);
4782         if (!p) {
4783                 strv_free(l);
4784                 return -ENOMEM;
4785         }
4786
4787         free_and_replace(c->path, p);
4788
4789         return strv_free_and_replace(c->argv, l);
4790 }
4791
4792 int exec_command_append(ExecCommand *c, const char *path, ...) {
4793         _cleanup_strv_free_ char **l = NULL;
4794         va_list ap;
4795         int r;
4796
4797         assert(c);
4798         assert(path);
4799
4800         va_start(ap, path);
4801         l = strv_new_ap(path, ap);
4802         va_end(ap);
4803
4804         if (!l)
4805                 return -ENOMEM;
4806
4807         r = strv_extend_strv(&c->argv, l, false);
4808         if (r < 0)
4809                 return r;
4810
4811         return 0;
4812 }
4813
4814 static void *remove_tmpdir_thread(void *p) {
4815         _cleanup_free_ char *path = p;
4816
4817         (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
4818         return NULL;
4819 }
4820
4821 static ExecRuntime* exec_runtime_free(ExecRuntime *rt, bool destroy) {
4822         int r;
4823
4824         if (!rt)
4825                 return NULL;
4826
4827         if (rt->manager)
4828                 (void) hashmap_remove(rt->manager->exec_runtime_by_id, rt->id);
4829
4830         /* When destroy is true, then rm_rf tmp_dir and var_tmp_dir. */
4831         if (destroy && rt->tmp_dir) {
4832                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
4833
4834                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
4835                 if (r < 0) {
4836                         log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
4837                         free(rt->tmp_dir);
4838                 }
4839
4840                 rt->tmp_dir = NULL;
4841         }
4842
4843         if (destroy && rt->var_tmp_dir) {
4844                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
4845
4846                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
4847                 if (r < 0) {
4848                         log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
4849                         free(rt->var_tmp_dir);
4850                 }
4851
4852                 rt->var_tmp_dir = NULL;
4853         }
4854
4855         rt->id = mfree(rt->id);
4856         rt->tmp_dir = mfree(rt->tmp_dir);
4857         rt->var_tmp_dir = mfree(rt->var_tmp_dir);
4858         safe_close_pair(rt->netns_storage_socket);
4859         return mfree(rt);
4860 }
4861
4862 static void exec_runtime_freep(ExecRuntime **rt) {
4863         if (*rt)
4864                 (void) exec_runtime_free(*rt, false);
4865 }
4866
4867 static int exec_runtime_allocate(ExecRuntime **rt) {
4868         assert(rt);
4869
4870         *rt = new0(ExecRuntime, 1);
4871         if (!*rt)
4872                 return -ENOMEM;
4873
4874         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
4875         return 0;
4876 }
4877
4878 static int exec_runtime_add(
4879                 Manager *m,
4880                 const char *id,
4881                 const char *tmp_dir,
4882                 const char *var_tmp_dir,
4883                 const int netns_storage_socket[2],
4884                 ExecRuntime **ret) {
4885
4886         _cleanup_(exec_runtime_freep) ExecRuntime *rt = NULL;
4887         int r;
4888
4889         assert(m);
4890         assert(id);
4891
4892         r = hashmap_ensure_allocated(&m->exec_runtime_by_id, &string_hash_ops);
4893         if (r < 0)
4894                 return r;
4895
4896         r = exec_runtime_allocate(&rt);
4897         if (r < 0)
4898                 return r;
4899
4900         rt->id = strdup(id);
4901         if (!rt->id)
4902                 return -ENOMEM;
4903
4904         if (tmp_dir) {
4905                 rt->tmp_dir = strdup(tmp_dir);
4906                 if (!rt->tmp_dir)
4907                         return -ENOMEM;
4908
4909                 /* When tmp_dir is set, then we require var_tmp_dir is also set. */
4910                 assert(var_tmp_dir);
4911                 rt->var_tmp_dir = strdup(var_tmp_dir);
4912                 if (!rt->var_tmp_dir)
4913                         return -ENOMEM;
4914         }
4915
4916         if (netns_storage_socket) {
4917                 rt->netns_storage_socket[0] = netns_storage_socket[0];
4918                 rt->netns_storage_socket[1] = netns_storage_socket[1];
4919         }
4920
4921         r = hashmap_put(m->exec_runtime_by_id, rt->id, rt);
4922         if (r < 0)
4923                 return r;
4924
4925         rt->manager = m;
4926
4927         if (ret)
4928                 *ret = rt;
4929
4930         /* do not remove created ExecRuntime object when the operation succeeds. */
4931         rt = NULL;
4932         return 0;
4933 }
4934
4935 static int exec_runtime_make(Manager *m, const ExecContext *c, const char *id, ExecRuntime **ret) {
4936         _cleanup_free_ char *tmp_dir = NULL, *var_tmp_dir = NULL;
4937         _cleanup_close_pair_ int netns_storage_socket[2] = {-1, -1};
4938         int r;
4939
4940         assert(m);
4941         assert(c);
4942         assert(id);
4943
4944         /* It is not necessary to create ExecRuntime object. */
4945         if (!c->private_network && !c->private_tmp)
4946                 return 0;
4947
4948         if (c->private_tmp) {
4949                 r = setup_tmp_dirs(id, &tmp_dir, &var_tmp_dir);
4950                 if (r < 0)
4951                         return r;
4952         }
4953
4954         if (c->private_network) {
4955                 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, netns_storage_socket) < 0)
4956                         return -errno;
4957         }
4958
4959         r = exec_runtime_add(m, id, tmp_dir, var_tmp_dir, netns_storage_socket, ret);
4960         if (r < 0)
4961                 return r;
4962
4963         /* Avoid cleanup */
4964         netns_storage_socket[0] = -1;
4965         netns_storage_socket[1] = -1;
4966         return 1;
4967 }
4968
4969 int exec_runtime_acquire(Manager *m, const ExecContext *c, const char *id, bool create, ExecRuntime **ret) {
4970         ExecRuntime *rt;
4971         int r;
4972
4973         assert(m);
4974         assert(id);
4975         assert(ret);
4976
4977         rt = hashmap_get(m->exec_runtime_by_id, id);
4978         if (rt)
4979                 /* We already have a ExecRuntime object, let's increase the ref count and reuse it */
4980                 goto ref;
4981
4982         if (!create)
4983                 return 0;
4984
4985         /* If not found, then create a new object. */
4986         r = exec_runtime_make(m, c, id, &rt);
4987         if (r <= 0)
4988                 /* When r == 0, it is not necessary to create ExecRuntime object. */
4989                 return r;
4990
4991 ref:
4992         /* increment reference counter. */
4993         rt->n_ref++;
4994         *ret = rt;
4995         return 1;
4996 }
4997
4998 ExecRuntime *exec_runtime_unref(ExecRuntime *rt, bool destroy) {
4999         if (!rt)
5000                 return NULL;
5001
5002         assert(rt->n_ref > 0);
5003
5004         rt->n_ref--;
5005         if (rt->n_ref > 0)
5006                 return NULL;
5007
5008         return exec_runtime_free(rt, destroy);
5009 }
5010
5011 int exec_runtime_serialize(const Manager *m, FILE *f, FDSet *fds) {
5012         ExecRuntime *rt;
5013         Iterator i;
5014
5015         assert(m);
5016         assert(f);
5017         assert(fds);
5018
5019         HASHMAP_FOREACH(rt, m->exec_runtime_by_id, i) {
5020                 fprintf(f, "exec-runtime=%s", rt->id);
5021
5022                 if (rt->tmp_dir)
5023                         fprintf(f, " tmp-dir=%s", rt->tmp_dir);
5024
5025                 if (rt->var_tmp_dir)
5026                         fprintf(f, " var-tmp-dir=%s", rt->var_tmp_dir);
5027
5028                 if (rt->netns_storage_socket[0] >= 0) {
5029                         int copy;
5030
5031                         copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
5032                         if (copy < 0)
5033                                 return copy;
5034
5035                         fprintf(f, " netns-socket-0=%i", copy);
5036                 }
5037
5038                 if (rt->netns_storage_socket[1] >= 0) {
5039                         int copy;
5040
5041                         copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
5042                         if (copy < 0)
5043                                 return copy;
5044
5045                         fprintf(f, " netns-socket-1=%i", copy);
5046                 }
5047
5048                 fputc('\n', f);
5049         }
5050
5051         return 0;
5052 }
5053
5054 int exec_runtime_deserialize_compat(Unit *u, const char *key, const char *value, FDSet *fds) {
5055         _cleanup_(exec_runtime_freep) ExecRuntime *rt_create = NULL;
5056         ExecRuntime *rt;
5057         int r;
5058
5059         /* This is for the migration from old (v237 or earlier) deserialization text.
5060          * Due to the bug #7790, this may not work with the units that use JoinsNamespaceOf=.
5061          * Even if the ExecRuntime object originally created by the other unit, we cannot judge
5062          * so or not from the serialized text, then we always creates a new object owned by this. */
5063
5064         assert(u);
5065         assert(key);
5066         assert(value);
5067
5068         /* Manager manages ExecRuntime objects by the unit id.
5069          * So, we omit the serialized text when the unit does not have id (yet?)... */
5070         if (isempty(u->id)) {
5071                 log_unit_debug(u, "Invocation ID not found. Dropping runtime parameter.");
5072                 return 0;
5073         }
5074
5075         r = hashmap_ensure_allocated(&u->manager->exec_runtime_by_id, &string_hash_ops);
5076         if (r < 0) {
5077                 log_unit_debug_errno(u, r, "Failed to allocate storage for runtime parameter: %m");
5078                 return 0;
5079         }
5080
5081         rt = hashmap_get(u->manager->exec_runtime_by_id, u->id);
5082         if (!rt) {
5083                 r = exec_runtime_allocate(&rt_create);
5084                 if (r < 0)
5085                         return log_oom();
5086
5087                 rt_create->id = strdup(u->id);
5088                 if (!rt_create->id)
5089                         return log_oom();
5090
5091                 rt = rt_create;
5092         }
5093
5094         if (streq(key, "tmp-dir")) {
5095                 char *copy;
5096
5097                 copy = strdup(value);
5098                 if (!copy)
5099                         return log_oom();
5100
5101                 free_and_replace(rt->tmp_dir, copy);
5102
5103         } else if (streq(key, "var-tmp-dir")) {
5104                 char *copy;
5105
5106                 copy = strdup(value);
5107                 if (!copy)
5108                         return log_oom();
5109
5110                 free_and_replace(rt->var_tmp_dir, copy);
5111
5112         } else if (streq(key, "netns-socket-0")) {
5113                 int fd;
5114
5115                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
5116                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
5117                         return 0;
5118                 }
5119
5120                 safe_close(rt->netns_storage_socket[0]);
5121                 rt->netns_storage_socket[0] = fdset_remove(fds, fd);
5122
5123         } else if (streq(key, "netns-socket-1")) {
5124                 int fd;
5125
5126                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
5127                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
5128                         return 0;
5129                 }
5130
5131                 safe_close(rt->netns_storage_socket[1]);
5132                 rt->netns_storage_socket[1] = fdset_remove(fds, fd);
5133         } else
5134                 return 0;
5135
5136         /* If the object is newly created, then put it to the hashmap which manages ExecRuntime objects. */
5137         if (rt_create) {
5138                 r = hashmap_put(u->manager->exec_runtime_by_id, rt_create->id, rt_create);
5139                 if (r < 0) {
5140                         log_unit_debug_errno(u, r, "Failed to put runtime parameter to manager's storage: %m");
5141                         return 0;
5142                 }
5143
5144                 rt_create->manager = u->manager;
5145
5146                 /* Avoid cleanup */
5147                 rt_create = NULL;
5148         }
5149
5150         return 1;
5151 }
5152
5153 void exec_runtime_deserialize_one(Manager *m, const char *value, FDSet *fds) {
5154         char *id = NULL, *tmp_dir = NULL, *var_tmp_dir = NULL;
5155         int r, fd0 = -1, fd1 = -1;
5156         const char *p, *v = value;
5157         size_t n;
5158
5159         assert(m);
5160         assert(value);
5161         assert(fds);
5162
5163         n = strcspn(v, " ");
5164         id = strndupa(v, n);
5165         if (v[n] != ' ')
5166                 goto finalize;
5167         p = v + n + 1;
5168
5169         v = startswith(p, "tmp-dir=");
5170         if (v) {
5171                 n = strcspn(v, " ");
5172                 tmp_dir = strndupa(v, n);
5173                 if (v[n] != ' ')
5174                         goto finalize;
5175                 p = v + n + 1;
5176         }
5177
5178         v = startswith(p, "var-tmp-dir=");
5179         if (v) {
5180                 n = strcspn(v, " ");
5181                 var_tmp_dir = strndupa(v, n);
5182                 if (v[n] != ' ')
5183                         goto finalize;
5184                 p = v + n + 1;
5185         }
5186
5187         v = startswith(p, "netns-socket-0=");
5188         if (v) {
5189                 char *buf;
5190
5191                 n = strcspn(v, " ");
5192                 buf = strndupa(v, n);
5193                 if (safe_atoi(buf, &fd0) < 0 || !fdset_contains(fds, fd0)) {
5194                         log_debug("Unable to process exec-runtime netns fd specification.");
5195                         return;
5196                 }
5197                 fd0 = fdset_remove(fds, fd0);
5198                 if (v[n] != ' ')
5199                         goto finalize;
5200                 p = v + n + 1;
5201         }
5202
5203         v = startswith(p, "netns-socket-1=");
5204         if (v) {
5205                 char *buf;
5206
5207                 n = strcspn(v, " ");
5208                 buf = strndupa(v, n);
5209                 if (safe_atoi(buf, &fd1) < 0 || !fdset_contains(fds, fd1)) {
5210                         log_debug("Unable to process exec-runtime netns fd specification.");
5211                         return;
5212                 }
5213                 fd1 = fdset_remove(fds, fd1);
5214         }
5215
5216 finalize:
5217
5218         r = exec_runtime_add(m, id, tmp_dir, var_tmp_dir, (int[]) { fd0, fd1 }, NULL);
5219         if (r < 0)
5220                 log_debug_errno(r, "Failed to add exec-runtime: %m");
5221 }
5222
5223 void exec_runtime_vacuum(Manager *m) {
5224         ExecRuntime *rt;
5225         Iterator i;
5226
5227         assert(m);
5228
5229         /* Free unreferenced ExecRuntime objects. This is used after manager deserialization process. */
5230
5231         HASHMAP_FOREACH(rt, m->exec_runtime_by_id, i) {
5232                 if (rt->n_ref > 0)
5233                         continue;
5234
5235                 (void) exec_runtime_free(rt, false);
5236         }
5237 }
5238
5239 void exec_params_clear(ExecParameters *p) {
5240         if (!p)
5241                 return;
5242
5243         strv_free(p->environment);
5244 }
5245
5246 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
5247         [EXEC_INPUT_NULL] = "null",
5248         [EXEC_INPUT_TTY] = "tty",
5249         [EXEC_INPUT_TTY_FORCE] = "tty-force",
5250         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
5251         [EXEC_INPUT_SOCKET] = "socket",
5252         [EXEC_INPUT_NAMED_FD] = "fd",
5253         [EXEC_INPUT_DATA] = "data",
5254         [EXEC_INPUT_FILE] = "file",
5255 };
5256
5257 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
5258
5259 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
5260         [EXEC_OUTPUT_INHERIT] = "inherit",
5261         [EXEC_OUTPUT_NULL] = "null",
5262         [EXEC_OUTPUT_TTY] = "tty",
5263         [EXEC_OUTPUT_SYSLOG] = "syslog",
5264         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
5265         [EXEC_OUTPUT_KMSG] = "kmsg",
5266         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
5267         [EXEC_OUTPUT_JOURNAL] = "journal",
5268         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
5269         [EXEC_OUTPUT_SOCKET] = "socket",
5270         [EXEC_OUTPUT_NAMED_FD] = "fd",
5271         [EXEC_OUTPUT_FILE] = "file",
5272         [EXEC_OUTPUT_FILE_APPEND] = "append",
5273 };
5274
5275 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
5276
5277 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
5278         [EXEC_UTMP_INIT] = "init",
5279         [EXEC_UTMP_LOGIN] = "login",
5280         [EXEC_UTMP_USER] = "user",
5281 };
5282
5283 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);
5284
5285 static const char* const exec_preserve_mode_table[_EXEC_PRESERVE_MODE_MAX] = {
5286         [EXEC_PRESERVE_NO] = "no",
5287         [EXEC_PRESERVE_YES] = "yes",
5288         [EXEC_PRESERVE_RESTART] = "restart",
5289 };
5290
5291 DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(exec_preserve_mode, ExecPreserveMode, EXEC_PRESERVE_YES);
5292
5293 static const char* const exec_directory_type_table[_EXEC_DIRECTORY_TYPE_MAX] = {
5294         [EXEC_DIRECTORY_RUNTIME] = "RuntimeDirectory",
5295         [EXEC_DIRECTORY_STATE] = "StateDirectory",
5296         [EXEC_DIRECTORY_CACHE] = "CacheDirectory",
5297         [EXEC_DIRECTORY_LOGS] = "LogsDirectory",
5298         [EXEC_DIRECTORY_CONFIGURATION] = "ConfigurationDirectory",
5299 };
5300
5301 DEFINE_STRING_TABLE_LOOKUP(exec_directory_type, ExecDirectoryType);
5302
5303 static const char* const exec_directory_env_name_table[_EXEC_DIRECTORY_TYPE_MAX] = {
5304         [EXEC_DIRECTORY_RUNTIME] = "RUNTIME_DIRECTORY",
5305         [EXEC_DIRECTORY_STATE] = "STATE_DIRECTORY",
5306         [EXEC_DIRECTORY_CACHE] = "CACHE_DIRECTORY",
5307         [EXEC_DIRECTORY_LOGS] = "LOGS_DIRECTORY",
5308         [EXEC_DIRECTORY_CONFIGURATION] = "CONFIGURATION_DIRECTORY",
5309 };
5310
5311 DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(exec_directory_env_name, ExecDirectoryType);
5312
5313 static const char* const exec_keyring_mode_table[_EXEC_KEYRING_MODE_MAX] = {
5314         [EXEC_KEYRING_INHERIT] = "inherit",
5315         [EXEC_KEYRING_PRIVATE] = "private",
5316         [EXEC_KEYRING_SHARED] = "shared",
5317 };
5318
5319 DEFINE_STRING_TABLE_LOOKUP(exec_keyring_mode, ExecKeyringMode);