src/core/execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <glob.h>
   6 #include <grp.h>
   7 #include <poll.h>
   8 #include <signal.h>
   9 #include <string.h>
  10 #include <sys/capability.h>
  11 #include <sys/eventfd.h>
  12 #include <sys/mman.h>
  13 #include <sys/personality.h>
  14 #include <sys/prctl.h>
  15 #include <sys/shm.h>
  16 #include <sys/socket.h>
  17 #include <sys/stat.h>
  18 #include <sys/types.h>
  19 #include <sys/un.h>
  20 #include <unistd.h>
  21 #include <utmpx.h>
  22
  23 #if HAVE_PAM
  24 #include <security/pam_appl.h>
  25 #endif
  26
  27 #if HAVE_SELINUX
  28 #include <selinux/selinux.h>
  29 #endif
  30
  31 #if HAVE_SECCOMP
  32 #include <seccomp.h>
  33 #endif
  34
  35 #if HAVE_APPARMOR
  36 #include <sys/apparmor.h>
  37 #endif
  38
  39 #include "sd-messages.h"
  40
  41 #include "af-list.h"
  42 #include "alloc-util.h"
  43 #if HAVE_APPARMOR
  44 #include "apparmor-util.h"
  45 #endif
  46 #include "async.h"
  47 #include "barrier.h"
  48 #include "cap-list.h"
  49 #include "capability-util.h"
  50 #include "chown-recursive.h"
  51 #include "cpu-set-util.h"
  52 #include "def.h"
  53 #include "env-file.h"
  54 #include "env-util.h"
  55 #include "errno-list.h"
  56 #include "execute.h"
  57 #include "exit-status.h"
  58 #include "fd-util.h"
  59 #include "format-util.h"
  60 #include "fs-util.h"
  61 #include "glob-util.h"
  62 #include "io-util.h"
  63 #include "ioprio.h"
  64 #include "label.h"
  65 #include "log.h"
  66 #include "macro.h"
  67 #include "manager.h"
  68 #include "missing.h"
  69 #include "mkdir.h"
  70 #include "namespace.h"
  71 #include "parse-util.h"
  72 #include "path-util.h"
  73 #include "process-util.h"
  74 #include "rlimit-util.h"
  75 #include "rm-rf.h"
  76 #if HAVE_SECCOMP
  77 #include "seccomp-util.h"
  78 #endif
  79 #include "securebits-util.h"
  80 #include "selinux-util.h"
  81 #include "signal-util.h"
  82 #include "smack-util.h"
  83 #include "socket-util.h"
  84 #include "special.h"
  85 #include "stat-util.h"
  86 #include "string-table.h"
  87 #include "string-util.h"
  88 #include "strv.h"
  89 #include "syslog-util.h"
  90 #include "terminal-util.h"
  91 #include "umask-util.h"
  92 #include "unit.h"
  93 #include "user-util.h"
  94 #include "util.h"
  95 #include "utmp-wtmp.h"
  96
  97 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  98 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
  99
 100 /* This assumes there is a 'tty' group */
 101 #define TTY_MODE 0620
 102
 103 #define SNDBUF_SIZE (8*1024*1024)
 104
 105 static int shift_fds(int fds[], size_t n_fds) {
 106         int start, restart_from;
 107
 108         if (n_fds <= 0)
 109                 return 0;
 110
 111         /* Modifies the fds array! (sorts it) */
 112
 113         assert(fds);
 114
 115         start = 0;
 116         for (;;) {
 117                 int i;
 118
 119                 restart_from = -1;
 120
 121                 for (i = start; i < (int) n_fds; i++) {
 122                         int nfd;
 123
 124                         /* Already at right index? */
 125                         if (fds[i] == i+3)
 126                                 continue;
 127
 128                         nfd = fcntl(fds[i], F_DUPFD, i + 3);
 129                         if (nfd < 0)
 130                                 return -errno;
 131
 132                         safe_close(fds[i]);
 133                         fds[i] = nfd;
 134
 135                         /* Hmm, the fd we wanted isn't free? Then
 136                          * let's remember that and try again from here */
 137                         if (nfd != i+3 && restart_from < 0)
 138                                 restart_from = i;
 139                 }
 140
 141                 if (restart_from < 0)
 142                         break;
 143
 144                 start = restart_from;
 145         }
 146
 147         return 0;
 148 }
 149
 150 static int flags_fds(const int fds[], size_t n_socket_fds, size_t n_storage_fds, bool nonblock) {
 151         size_t i, n_fds;
 152         int r;
 153
 154         n_fds = n_socket_fds + n_storage_fds;
 155         if (n_fds <= 0)
 156                 return 0;
 157
 158         assert(fds);
 159
 160         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags.
 161          * O_NONBLOCK only applies to socket activation though. */
 162
 163         for (i = 0; i < n_fds; i++) {
 164
 165                 if (i < n_socket_fds) {
 166                         r = fd_nonblock(fds[i], nonblock);
 167                         if (r < 0)
 168                                 return r;
 169                 }
 170
 171                 /* We unconditionally drop FD_CLOEXEC from the fds,
 172                  * since after all we want to pass these fds to our
 173                  * children */
 174
 175                 r = fd_cloexec(fds[i], false);
 176                 if (r < 0)
 177                         return r;
 178         }
 179
 180         return 0;
 181 }
 182
 183 static const char *exec_context_tty_path(const ExecContext *context) {
 184         assert(context);
 185
 186         if (context->stdio_as_fds)
 187                 return NULL;
 188
 189         if (context->tty_path)
 190                 return context->tty_path;
 191
 192         return "/dev/console";
 193 }
 194
 195 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
 196         const char *path;
 197
 198         assert(context);
 199
 200         path = exec_context_tty_path(context);
 201
 202         if (context->tty_vhangup) {
 203                 if (p && p->stdin_fd >= 0)
 204                         (void) terminal_vhangup_fd(p->stdin_fd);
 205                 else if (path)
 206                         (void) terminal_vhangup(path);
 207         }
 208
 209         if (context->tty_reset) {
 210                 if (p && p->stdin_fd >= 0)
 211                         (void) reset_terminal_fd(p->stdin_fd, true);
 212                 else if (path)
 213                         (void) reset_terminal(path);
 214         }
 215
 216         if (context->tty_vt_disallocate && path)
 217                 (void) vt_disallocate(path);
 218 }
 219
 220 static bool is_terminal_input(ExecInput i) {
 221         return IN_SET(i,
 222                       EXEC_INPUT_TTY,
 223                       EXEC_INPUT_TTY_FORCE,
 224                       EXEC_INPUT_TTY_FAIL);
 225 }
 226
 227 static bool is_terminal_output(ExecOutput o) {
 228         return IN_SET(o,
 229                       EXEC_OUTPUT_TTY,
 230                       EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 231                       EXEC_OUTPUT_KMSG_AND_CONSOLE,
 232                       EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 233 }
 234
 235 static bool is_syslog_output(ExecOutput o) {
 236         return IN_SET(o,
 237                       EXEC_OUTPUT_SYSLOG,
 238                       EXEC_OUTPUT_SYSLOG_AND_CONSOLE);
 239 }
 240
 241 static bool is_kmsg_output(ExecOutput o) {
 242         return IN_SET(o,
 243                       EXEC_OUTPUT_KMSG,
 244                       EXEC_OUTPUT_KMSG_AND_CONSOLE);
 245 }
 246
 247 static bool exec_context_needs_term(const ExecContext *c) {
 248         assert(c);
 249
 250         /* Return true if the execution context suggests we should set $TERM to something useful. */
 251
 252         if (is_terminal_input(c->std_input))
 253                 return true;
 254
 255         if (is_terminal_output(c->std_output))
 256                 return true;
 257
 258         if (is_terminal_output(c->std_error))
 259                 return true;
 260
 261         return !!c->tty_path;
 262 }
 263
 264 static int open_null_as(int flags, int nfd) {
 265         int fd;
 266
 267         assert(nfd >= 0);
 268
 269         fd = open("/dev/null", flags|O_NOCTTY);
 270         if (fd < 0)
 271                 return -errno;
 272
 273         return move_fd(fd, nfd, false);
 274 }
 275
 276 static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
 277         static const union sockaddr_union sa = {
 278                 .un.sun_family = AF_UNIX,
 279                 .un.sun_path = "/run/systemd/journal/stdout",
 280         };
 281         uid_t olduid = UID_INVALID;
 282         gid_t oldgid = GID_INVALID;
 283         int r;
 284
 285         if (gid_is_valid(gid)) {
 286                 oldgid = getgid();
 287
 288                 if (setegid(gid) < 0)
 289                         return -errno;
 290         }
 291
 292         if (uid_is_valid(uid)) {
 293                 olduid = getuid();
 294
 295                 if (seteuid(uid) < 0) {
 296                         r = -errno;
 297                         goto restore_gid;
 298                 }
 299         }
 300
 301         r = connect(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un)) < 0 ? -errno : 0;
 302
 303         /* If we fail to restore the uid or gid, things will likely
 304            fail later on. This should only happen if an LSM interferes. */
 305
 306         if (uid_is_valid(uid))
 307                 (void) seteuid(olduid);
 308
 309  restore_gid:
 310         if (gid_is_valid(gid))
 311                 (void) setegid(oldgid);
 312
 313         return r;
 314 }
 315
 316 static int connect_logger_as(
 317                 const Unit *unit,
 318                 const ExecContext *context,
 319                 const ExecParameters *params,
 320                 ExecOutput output,
 321                 const char *ident,
 322                 int nfd,
 323                 uid_t uid,
 324                 gid_t gid) {
 325
 326         _cleanup_close_ int fd = -1;
 327         int r;
 328
 329         assert(context);
 330         assert(params);
 331         assert(output < _EXEC_OUTPUT_MAX);
 332         assert(ident);
 333         assert(nfd >= 0);
 334
 335         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 336         if (fd < 0)
 337                 return -errno;
 338
 339         r = connect_journal_socket(fd, uid, gid);
 340         if (r < 0)
 341                 return r;
 342
 343         if (shutdown(fd, SHUT_RD) < 0)
 344                 return -errno;
 345
 346         (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
 347
 348         if (dprintf(fd,
 349                 "%s\n"
 350                 "%s\n"
 351                 "%i\n"
 352                 "%i\n"
 353                 "%i\n"
 354                 "%i\n"
 355                 "%i\n",
 356                 context->syslog_identifier ?: ident,
 357                 params->flags & EXEC_PASS_LOG_UNIT ? unit->id : "",
 358                 context->syslog_priority,
 359                 !!context->syslog_level_prefix,
 360                 is_syslog_output(output),
 361                 is_kmsg_output(output),
 362                 is_terminal_output(output)) < 0)
 363                 return -errno;
 364
 365         return move_fd(TAKE_FD(fd), nfd, false);
 366 }
 367
 368 static int open_terminal_as(const char *path, int flags, int nfd) {
 369         int fd;
 370
 371         assert(path);
 372         assert(nfd >= 0);
 373
 374         fd = open_terminal(path, flags | O_NOCTTY);
 375         if (fd < 0)
 376                 return fd;
 377
 378         return move_fd(fd, nfd, false);
 379 }
 380
 381 static int acquire_path(const char *path, int flags, mode_t mode) {
 382         union sockaddr_union sa = {};
 383         _cleanup_close_ int fd = -1;
 384         int r, salen;
 385
 386         assert(path);
 387
 388         if (IN_SET(flags & O_ACCMODE, O_WRONLY, O_RDWR))
 389                 flags |= O_CREAT;
 390
 391         fd = open(path, flags|O_NOCTTY, mode);
 392         if (fd >= 0)
 393                 return TAKE_FD(fd);
 394
 395         if (errno != ENXIO) /* ENXIO is returned when we try to open() an AF_UNIX file system socket on Linux */
 396                 return -errno;
 397         if (strlen(path) >= sizeof(sa.un.sun_path)) /* Too long, can't be a UNIX socket */
 398                 return -ENXIO;
 399
 400         /* So, it appears the specified path could be an AF_UNIX socket. Let's see if we can connect to it. */
 401
 402         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 403         if (fd < 0)
 404                 return -errno;
 405
 406         salen = sockaddr_un_set_path(&sa.un, path);
 407         if (salen < 0)
 408                 return salen;
 409
 410         if (connect(fd, &sa.sa, salen) < 0)
 411                 return errno == EINVAL ? -ENXIO : -errno; /* Propagate initial error if we get EINVAL, i.e. we have
 412                                                            * indication that his wasn't an AF_UNIX socket after all */
 413
 414         if ((flags & O_ACCMODE) == O_RDONLY)
 415                 r = shutdown(fd, SHUT_WR);
 416         else if ((flags & O_ACCMODE) == O_WRONLY)
 417                 r = shutdown(fd, SHUT_RD);
 418         else
 419                 return TAKE_FD(fd);
 420         if (r < 0)
 421                 return -errno;
 422
 423         return TAKE_FD(fd);
 424 }
 425
 426 static int fixup_input(
 427                 const ExecContext *context,
 428                 int socket_fd,
 429                 bool apply_tty_stdin) {
 430
 431         ExecInput std_input;
 432
 433         assert(context);
 434
 435         std_input = context->std_input;
 436
 437         if (is_terminal_input(std_input) && !apply_tty_stdin)
 438                 return EXEC_INPUT_NULL;
 439
 440         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 441                 return EXEC_INPUT_NULL;
 442
 443         if (std_input == EXEC_INPUT_DATA && context->stdin_data_size == 0)
 444                 return EXEC_INPUT_NULL;
 445
 446         return std_input;
 447 }
 448
 449 static int fixup_output(ExecOutput std_output, int socket_fd) {
 450
 451         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 452                 return EXEC_OUTPUT_INHERIT;
 453
 454         return std_output;
 455 }
 456
 457 static int setup_input(
 458                 const ExecContext *context,
 459                 const ExecParameters *params,
 460                 int socket_fd,
 461                 int named_iofds[3]) {
 462
 463         ExecInput i;
 464
 465         assert(context);
 466         assert(params);
 467
 468         if (params->stdin_fd >= 0) {
 469                 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
 470                         return -errno;
 471
 472                 /* Try to make this the controlling tty, if it is a tty, and reset it */
 473                 if (isatty(STDIN_FILENO)) {
 474                         (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
 475                         (void) reset_terminal_fd(STDIN_FILENO, true);
 476                 }
 477
 478                 return STDIN_FILENO;
 479         }
 480
 481         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 482
 483         switch (i) {
 484
 485         case EXEC_INPUT_NULL:
 486                 return open_null_as(O_RDONLY, STDIN_FILENO);
 487
 488         case EXEC_INPUT_TTY:
 489         case EXEC_INPUT_TTY_FORCE:
 490         case EXEC_INPUT_TTY_FAIL: {
 491                 int fd;
 492
 493                 fd = acquire_terminal(exec_context_tty_path(context),
 494                                       i == EXEC_INPUT_TTY_FAIL  ? ACQUIRE_TERMINAL_TRY :
 495                                       i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE :
 496                                                                   ACQUIRE_TERMINAL_WAIT,
 497                                       USEC_INFINITY);
 498                 if (fd < 0)
 499                         return fd;
 500
 501                 return move_fd(fd, STDIN_FILENO, false);
 502         }
 503
 504         case EXEC_INPUT_SOCKET:
 505                 assert(socket_fd >= 0);
 506
 507                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 508
 509         case EXEC_INPUT_NAMED_FD:
 510                 assert(named_iofds[STDIN_FILENO] >= 0);
 511
 512                 (void) fd_nonblock(named_iofds[STDIN_FILENO], false);
 513                 return dup2(named_iofds[STDIN_FILENO], STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 514
 515         case EXEC_INPUT_DATA: {
 516                 int fd;
 517
 518                 fd = acquire_data_fd(context->stdin_data, context->stdin_data_size, 0);
 519                 if (fd < 0)
 520                         return fd;
 521
 522                 return move_fd(fd, STDIN_FILENO, false);
 523         }
 524
 525         case EXEC_INPUT_FILE: {
 526                 bool rw;
 527                 int fd;
 528
 529                 assert(context->stdio_file[STDIN_FILENO]);
 530
 531                 rw = (context->std_output == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDOUT_FILENO])) ||
 532                         (context->std_error == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDERR_FILENO]));
 533
 534                 fd = acquire_path(context->stdio_file[STDIN_FILENO], rw ? O_RDWR : O_RDONLY, 0666 & ~context->umask);
 535                 if (fd < 0)
 536                         return fd;
 537
 538                 return move_fd(fd, STDIN_FILENO, false);
 539         }
 540
 541         default:
 542                 assert_not_reached("Unknown input type");
 543         }
 544 }
 545
 546 static bool can_inherit_stderr_from_stdout(
 547                 const ExecContext *context,
 548                 ExecOutput o,
 549                 ExecOutput e) {
 550
 551         assert(context);
 552
 553         /* Returns true, if given the specified STDERR and STDOUT output we can directly dup() the stdout fd to the
 554          * stderr fd */
 555
 556         if (e == EXEC_OUTPUT_INHERIT)
 557                 return true;
 558         if (e != o)
 559                 return false;
 560
 561         if (e == EXEC_OUTPUT_NAMED_FD)
 562                 return streq_ptr(context->stdio_fdname[STDOUT_FILENO], context->stdio_fdname[STDERR_FILENO]);
 563
 564         if (IN_SET(e, EXEC_OUTPUT_FILE, EXEC_OUTPUT_FILE_APPEND))
 565                 return streq_ptr(context->stdio_file[STDOUT_FILENO], context->stdio_file[STDERR_FILENO]);
 566
 567         return true;
 568 }
 569
 570 static int setup_output(
 571                 const Unit *unit,
 572                 const ExecContext *context,
 573                 const ExecParameters *params,
 574                 int fileno,
 575                 int socket_fd,
 576                 int named_iofds[3],
 577                 const char *ident,
 578                 uid_t uid,
 579                 gid_t gid,
 580                 dev_t *journal_stream_dev,
 581                 ino_t *journal_stream_ino) {
 582
 583         ExecOutput o;
 584         ExecInput i;
 585         int r;
 586
 587         assert(unit);
 588         assert(context);
 589         assert(params);
 590         assert(ident);
 591         assert(journal_stream_dev);
 592         assert(journal_stream_ino);
 593
 594         if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
 595
 596                 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
 597                         return -errno;
 598
 599                 return STDOUT_FILENO;
 600         }
 601
 602         if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
 603                 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
 604                         return -errno;
 605
 606                 return STDERR_FILENO;
 607         }
 608
 609         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 610         o = fixup_output(context->std_output, socket_fd);
 611
 612         if (fileno == STDERR_FILENO) {
 613                 ExecOutput e;
 614                 e = fixup_output(context->std_error, socket_fd);
 615
 616                 /* This expects the input and output are already set up */
 617
 618                 /* Don't change the stderr file descriptor if we inherit all
 619                  * the way and are not on a tty */
 620                 if (e == EXEC_OUTPUT_INHERIT &&
 621                     o == EXEC_OUTPUT_INHERIT &&
 622                     i == EXEC_INPUT_NULL &&
 623                     !is_terminal_input(context->std_input) &&
 624                     getppid () != 1)
 625                         return fileno;
 626
 627                 /* Duplicate from stdout if possible */
 628                 if (can_inherit_stderr_from_stdout(context, o, e))
 629                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 630
 631                 o = e;
 632
 633         } else if (o == EXEC_OUTPUT_INHERIT) {
 634                 /* If input got downgraded, inherit the original value */
 635                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 636                         return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 637
 638                 /* If the input is connected to anything that's not a /dev/null or a data fd, inherit that... */
 639                 if (!IN_SET(i, EXEC_INPUT_NULL, EXEC_INPUT_DATA))
 640                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 641
 642                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 643                 if (getppid() != 1)
 644                         return fileno;
 645
 646                 /* We need to open /dev/null here anew, to get the right access mode. */
 647                 return open_null_as(O_WRONLY, fileno);
 648         }
 649
 650         switch (o) {
 651
 652         case EXEC_OUTPUT_NULL:
 653                 return open_null_as(O_WRONLY, fileno);
 654
 655         case EXEC_OUTPUT_TTY:
 656                 if (is_terminal_input(i))
 657                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 658
 659                 /* We don't reset the terminal if this is just about output */
 660                 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 661
 662         case EXEC_OUTPUT_SYSLOG:
 663         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 664         case EXEC_OUTPUT_KMSG:
 665         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 666         case EXEC_OUTPUT_JOURNAL:
 667         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 668                 r = connect_logger_as(unit, context, params, o, ident, fileno, uid, gid);
 669                 if (r < 0) {
 670                         log_unit_warning_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
 671                         r = open_null_as(O_WRONLY, fileno);
 672                 } else {
 673                         struct stat st;
 674
 675                         /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
 676                          * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
 677                          * services to detect whether they are connected to the journal or not.
 678                          *
 679                          * If both stdout and stderr are connected to a stream then let's make sure to store the data
 680                          * about STDERR as that's usually the best way to do logging. */
 681
 682                         if (fstat(fileno, &st) >= 0 &&
 683                             (*journal_stream_ino == 0 || fileno == STDERR_FILENO)) {
 684                                 *journal_stream_dev = st.st_dev;
 685                                 *journal_stream_ino = st.st_ino;
 686                         }
 687                 }
 688                 return r;
 689
 690         case EXEC_OUTPUT_SOCKET:
 691                 assert(socket_fd >= 0);
 692
 693                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 694
 695         case EXEC_OUTPUT_NAMED_FD:
 696                 assert(named_iofds[fileno] >= 0);
 697
 698                 (void) fd_nonblock(named_iofds[fileno], false);
 699                 return dup2(named_iofds[fileno], fileno) < 0 ? -errno : fileno;
 700
 701         case EXEC_OUTPUT_FILE:
 702         case EXEC_OUTPUT_FILE_APPEND: {
 703                 bool rw;
 704                 int fd, flags;
 705
 706                 assert(context->stdio_file[fileno]);
 707
 708                 rw = context->std_input == EXEC_INPUT_FILE &&
 709                         streq_ptr(context->stdio_file[fileno], context->stdio_file[STDIN_FILENO]);
 710
 711                 if (rw)
 712                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 713
 714                 flags = O_WRONLY;
 715                 if (o == EXEC_OUTPUT_FILE_APPEND)
 716                         flags |= O_APPEND;
 717
 718                 fd = acquire_path(context->stdio_file[fileno], flags, 0666 & ~context->umask);
 719                 if (fd < 0)
 720                         return fd;
 721
 722                 return move_fd(fd, fileno, 0);
 723         }
 724
 725         default:
 726                 assert_not_reached("Unknown error type");
 727         }
 728 }
 729
 730 static int chown_terminal(int fd, uid_t uid) {
 731         struct stat st;
 732
 733         assert(fd >= 0);
 734
 735         /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
 736         if (isatty(fd) < 1)
 737                 return 0;
 738
 739         /* This might fail. What matters are the results. */
 740         (void) fchown(fd, uid, -1);
 741         (void) fchmod(fd, TTY_MODE);
 742
 743         if (fstat(fd, &st) < 0)
 744                 return -errno;
 745
 746         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 747                 return -EPERM;
 748
 749         return 0;
 750 }
 751
 752 static int setup_confirm_stdio(const char *vc, int *_saved_stdin, int *_saved_stdout) {
 753         _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
 754         int r;
 755
 756         assert(_saved_stdin);
 757         assert(_saved_stdout);
 758
 759         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 760         if (saved_stdin < 0)
 761                 return -errno;
 762
 763         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 764         if (saved_stdout < 0)
 765                 return -errno;
 766
 767         fd = acquire_terminal(vc, ACQUIRE_TERMINAL_WAIT, DEFAULT_CONFIRM_USEC);
 768         if (fd < 0)
 769                 return fd;
 770
 771         r = chown_terminal(fd, getuid());
 772         if (r < 0)
 773                 return r;
 774
 775         r = reset_terminal_fd(fd, true);
 776         if (r < 0)
 777                 return r;
 778
 779         r = rearrange_stdio(fd, fd, STDERR_FILENO);
 780         fd = -1;
 781         if (r < 0)
 782                 return r;
 783
 784         *_saved_stdin = saved_stdin;
 785         *_saved_stdout = saved_stdout;
 786
 787         saved_stdin = saved_stdout = -1;
 788
 789         return 0;
 790 }
 791
 792 static void write_confirm_error_fd(int err, int fd, const Unit *u) {
 793         assert(err < 0);
 794
 795         if (err == -ETIMEDOUT)
 796                 dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);
 797         else {
 798                 errno = -err;
 799                 dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);
 800         }
 801 }
 802
 803 static void write_confirm_error(int err, const char *vc, const Unit *u) {
 804         _cleanup_close_ int fd = -1;
 805
 806         assert(vc);
 807
 808         fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);
 809         if (fd < 0)
 810                 return;
 811
 812         write_confirm_error_fd(err, fd, u);
 813 }
 814
 815 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
 816         int r = 0;
 817
 818         assert(saved_stdin);
 819         assert(saved_stdout);
 820
 821         release_terminal();
 822
 823         if (*saved_stdin >= 0)
 824                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 825                         r = -errno;
 826
 827         if (*saved_stdout >= 0)
 828                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 829                         r = -errno;
 830
 831         *saved_stdin = safe_close(*saved_stdin);
 832         *saved_stdout = safe_close(*saved_stdout);
 833
 834         return r;
 835 }
 836
 837 enum {
 838         CONFIRM_PRETEND_FAILURE = -1,
 839         CONFIRM_PRETEND_SUCCESS =  0,
 840         CONFIRM_EXECUTE = 1,
 841 };
 842
 843 static int ask_for_confirmation(const char *vc, Unit *u, const char *cmdline) {
 844         int saved_stdout = -1, saved_stdin = -1, r;
 845         _cleanup_free_ char *e = NULL;
 846         char c;
 847
 848         /* For any internal errors, assume a positive response. */
 849         r = setup_confirm_stdio(vc, &saved_stdin, &saved_stdout);
 850         if (r < 0) {
 851                 write_confirm_error(r, vc, u);
 852                 return CONFIRM_EXECUTE;
 853         }
 854
 855         /* confirm_spawn might have been disabled while we were sleeping. */
 856         if (manager_is_confirm_spawn_disabled(u->manager)) {
 857                 r = 1;
 858                 goto restore_stdio;
 859         }
 860
 861         e = ellipsize(cmdline, 60, 100);
 862         if (!e) {
 863                 log_oom();
 864                 r = CONFIRM_EXECUTE;
 865                 goto restore_stdio;
 866         }
 867
 868         for (;;) {
 869                 r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);
 870                 if (r < 0) {
 871                         write_confirm_error_fd(r, STDOUT_FILENO, u);
 872                         r = CONFIRM_EXECUTE;
 873                         goto restore_stdio;
 874                 }
 875
 876                 switch (c) {
 877                 case 'c':
 878                         printf("Resuming normal execution.\n");
 879                         manager_disable_confirm_spawn();
 880                         r = 1;
 881                         break;
 882                 case 'D':
 883                         unit_dump(u, stdout, "  ");
 884                         continue; /* ask again */
 885                 case 'f':
 886                         printf("Failing execution.\n");
 887                         r = CONFIRM_PRETEND_FAILURE;
 888                         break;
 889                 case 'h':
 890                         printf("  c - continue, proceed without asking anymore\n"
 891                                "  D - dump, show the state of the unit\n"
 892                                "  f - fail, don't execute the command and pretend it failed\n"
 893                                "  h - help\n"
 894                                "  i - info, show a short summary of the unit\n"
 895                                "  j - jobs, show jobs that are in progress\n"
 896                                "  s - skip, don't execute the command and pretend it succeeded\n"
 897                                "  y - yes, execute the command\n");
 898                         continue; /* ask again */
 899                 case 'i':
 900                         printf("  Description: %s\n"
 901                                "  Unit:        %s\n"
 902                                "  Command:     %s\n",
 903                                u->id, u->description, cmdline);
 904                         continue; /* ask again */
 905                 case 'j':
 906                         manager_dump_jobs(u->manager, stdout, "  ");
 907                         continue; /* ask again */
 908                 case 'n':
 909                         /* 'n' was removed in favor of 'f'. */
 910                         printf("Didn't understand 'n', did you mean 'f'?\n");
 911                         continue; /* ask again */
 912                 case 's':
 913                         printf("Skipping execution.\n");
 914                         r = CONFIRM_PRETEND_SUCCESS;
 915                         break;
 916                 case 'y':
 917                         r = CONFIRM_EXECUTE;
 918                         break;
 919                 default:
 920                         assert_not_reached("Unhandled choice");
 921                 }
 922                 break;
 923         }
 924
 925 restore_stdio:
 926         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 927         return r;
 928 }
 929
 930 static int get_fixed_user(const ExecContext *c, const char **user,
 931                           uid_t *uid, gid_t *gid,
 932                           const char **home, const char **shell) {
 933         int r;
 934         const char *name;
 935
 936         assert(c);
 937
 938         if (!c->user)
 939                 return 0;
 940
 941         /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway
 942          * (i.e. are "/" or "/bin/nologin"). */
 943
 944         name = c->user;
 945         r = get_user_creds(&name, uid, gid, home, shell, USER_CREDS_CLEAN);
 946         if (r < 0)
 947                 return r;
 948
 949         *user = name;
 950         return 0;
 951 }
 952
 953 static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {
 954         int r;
 955         const char *name;
 956
 957         assert(c);
 958
 959         if (!c->group)
 960                 return 0;
 961
 962         name = c->group;
 963         r = get_group_creds(&name, gid, 0);
 964         if (r < 0)
 965                 return r;
 966
 967         *group = name;
 968         return 0;
 969 }
 970
 971 static int get_supplementary_groups(const ExecContext *c, const char *user,
 972                                     const char *group, gid_t gid,
 973                                     gid_t **supplementary_gids, int *ngids) {
 974         char **i;
 975         int r, k = 0;
 976         int ngroups_max;
 977         bool keep_groups = false;
 978         gid_t *groups = NULL;
 979         _cleanup_free_ gid_t *l_gids = NULL;
 980
 981         assert(c);
 982
 983         /*
 984          * If user is given, then lookup GID and supplementary groups list.
 985          * We avoid NSS lookups for gid=0. Also we have to initialize groups
 986          * here and as early as possible so we keep the list of supplementary
 987          * groups of the caller.
 988          */
 989         if (user && gid_is_valid(gid) && gid != 0) {
 990                 /* First step, initialize groups from /etc/groups */
 991                 if (initgroups(user, gid) < 0)
 992                         return -errno;
 993
 994                 keep_groups = true;
 995         }
 996
 997         if (strv_isempty(c->supplementary_groups))
 998                 return 0;
 999
1000         /*
1001          * If SupplementaryGroups= was passed then NGROUPS_MAX has to
1002          * be positive, otherwise fail.
1003          */
1004         errno = 0;
1005         ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
1006         if (ngroups_max <= 0) {
1007                 if (errno > 0)
1008                         return -errno;
1009                 else
1010                         return -EOPNOTSUPP; /* For all other values */
1011         }
1012
1013         l_gids = new(gid_t, ngroups_max);
1014         if (!l_gids)
1015                 return -ENOMEM;
1016
1017         if (keep_groups) {
1018                 /*
1019                  * Lookup the list of groups that the user belongs to, we
1020                  * avoid NSS lookups here too for gid=0.
1021                  */
1022                 k = ngroups_max;
1023                 if (getgrouplist(user, gid, l_gids, &k) < 0)
1024                         return -EINVAL;
1025         } else
1026                 k = 0;
1027
1028         STRV_FOREACH(i, c->supplementary_groups) {
1029                 const char *g;
1030
1031                 if (k >= ngroups_max)
1032                         return -E2BIG;
1033
1034                 g = *i;
1035                 r = get_group_creds(&g, l_gids+k, 0);
1036                 if (r < 0)
1037                         return r;
1038
1039                 k++;
1040         }
1041
1042         /*
1043          * Sets ngids to zero to drop all supplementary groups, happens
1044          * when we are under root and SupplementaryGroups= is empty.
1045          */
1046         if (k == 0) {
1047                 *ngids = 0;
1048                 return 0;
1049         }
1050
1051         /* Otherwise get the final list of supplementary groups */
1052         groups = memdup(l_gids, sizeof(gid_t) * k);
1053         if (!groups)
1054                 return -ENOMEM;
1055
1056         *supplementary_gids = groups;
1057         *ngids = k;
1058
1059         groups = NULL;
1060
1061         return 0;
1062 }
1063
1064 static int enforce_groups(gid_t gid, const gid_t *supplementary_gids, int ngids) {
1065         int r;
1066
1067         /* Handle SupplementaryGroups= if it is not empty */
1068         if (ngids > 0) {
1069                 r = maybe_setgroups(ngids, supplementary_gids);
1070                 if (r < 0)
1071                         return r;
1072         }
1073
1074         if (gid_is_valid(gid)) {
1075                 /* Then set our gids */
1076                 if (setresgid(gid, gid, gid) < 0)
1077                         return -errno;
1078         }
1079
1080         return 0;
1081 }
1082
1083 static int enforce_user(const ExecContext *context, uid_t uid) {
1084         assert(context);
1085
1086         if (!uid_is_valid(uid))
1087                 return 0;
1088
1089         /* Sets (but doesn't look up) the uid and make sure we keep the
1090          * capabilities while doing so. */
1091
1092         if (context->capability_ambient_set != 0) {
1093
1094                 /* First step: If we need to keep capabilities but
1095                  * drop privileges we need to make sure we keep our
1096                  * caps, while we drop privileges. */
1097                 if (uid != 0) {
1098                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
1099
1100                         if (prctl(PR_GET_SECUREBITS) != sb)
1101                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
1102                                         return -errno;
1103                 }
1104         }
1105
1106         /* Second step: actually set the uids */
1107         if (setresuid(uid, uid, uid) < 0)
1108                 return -errno;
1109
1110         /* At this point we should have all necessary capabilities but
1111            are otherwise a normal user. However, the caps might got
1112            corrupted due to the setresuid() so we need clean them up
1113            later. This is done outside of this call. */
1114
1115         return 0;
1116 }
1117
1118 #if HAVE_PAM
1119
1120 static int null_conv(
1121                 int num_msg,
1122                 const struct pam_message **msg,
1123                 struct pam_response **resp,
1124                 void *appdata_ptr) {
1125
1126         /* We don't support conversations */
1127
1128         return PAM_CONV_ERR;
1129 }
1130
1131 #endif
1132
1133 static int setup_pam(
1134                 const char *name,
1135                 const char *user,
1136                 uid_t uid,
1137                 gid_t gid,
1138                 const char *tty,
1139                 char ***env,
1140                 int fds[], size_t n_fds) {
1141
1142 #if HAVE_PAM
1143
1144         static const struct pam_conv conv = {
1145                 .conv = null_conv,
1146                 .appdata_ptr = NULL
1147         };
1148
1149         _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
1150         pam_handle_t *handle = NULL;
1151         sigset_t old_ss;
1152         int pam_code = PAM_SUCCESS, r;
1153         char **nv, **e = NULL;
1154         bool close_session = false;
1155         pid_t pam_pid = 0, parent_pid;
1156         int flags = 0;
1157
1158         assert(name);
1159         assert(user);
1160         assert(env);
1161
1162         /* We set up PAM in the parent process, then fork. The child
1163          * will then stay around until killed via PR_GET_PDEATHSIG or
1164          * systemd via the cgroup logic. It will then remove the PAM
1165          * session again. The parent process will exec() the actual
1166          * daemon. We do things this way to ensure that the main PID
1167          * of the daemon is the one we initially fork()ed. */
1168
1169         r = barrier_create(&barrier);
1170         if (r < 0)
1171                 goto fail;
1172
1173         if (log_get_max_level() < LOG_DEBUG)
1174                 flags |= PAM_SILENT;
1175
1176         pam_code = pam_start(name, user, &conv, &handle);
1177         if (pam_code != PAM_SUCCESS) {
1178                 handle = NULL;
1179                 goto fail;
1180         }
1181
1182         if (!tty) {
1183                 _cleanup_free_ char *q = NULL;
1184
1185                 /* Hmm, so no TTY was explicitly passed, but an fd passed to us directly might be a TTY. Let's figure
1186                  * out if that's the case, and read the TTY off it. */
1187
1188                 if (getttyname_malloc(STDIN_FILENO, &q) >= 0)
1189                         tty = strjoina("/dev/", q);
1190         }
1191
1192         if (tty) {
1193                 pam_code = pam_set_item(handle, PAM_TTY, tty);
1194                 if (pam_code != PAM_SUCCESS)
1195                         goto fail;
1196         }
1197
1198         STRV_FOREACH(nv, *env) {
1199                 pam_code = pam_putenv(handle, *nv);
1200                 if (pam_code != PAM_SUCCESS)
1201                         goto fail;
1202         }
1203
1204         pam_code = pam_acct_mgmt(handle, flags);
1205         if (pam_code != PAM_SUCCESS)
1206                 goto fail;
1207
1208         pam_code = pam_open_session(handle, flags);
1209         if (pam_code != PAM_SUCCESS)
1210                 goto fail;
1211
1212         close_session = true;
1213
1214         e = pam_getenvlist(handle);
1215         if (!e) {
1216                 pam_code = PAM_BUF_ERR;
1217                 goto fail;
1218         }
1219
1220         /* Block SIGTERM, so that we know that it won't get lost in
1221          * the child */
1222
1223         assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
1224
1225         parent_pid = getpid_cached();
1226
1227         r = safe_fork("(sd-pam)", 0, &pam_pid);
1228         if (r < 0)
1229                 goto fail;
1230         if (r == 0) {
1231                 int sig, ret = EXIT_PAM;
1232
1233                 /* The child's job is to reset the PAM session on
1234                  * termination */
1235                 barrier_set_role(&barrier, BARRIER_CHILD);
1236
1237                 /* Make sure we don't keep open the passed fds in this child. We assume that otherwise only those fds
1238                  * are open here that have been opened by PAM. */
1239                 (void) close_many(fds, n_fds);
1240
1241                 /* Drop privileges - we don't need any to pam_close_session
1242                  * and this will make PR_SET_PDEATHSIG work in most cases.
1243                  * If this fails, ignore the error - but expect sd-pam threads
1244                  * to fail to exit normally */
1245
1246                 r = maybe_setgroups(0, NULL);
1247                 if (r < 0)
1248                         log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
1249                 if (setresgid(gid, gid, gid) < 0)
1250                         log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
1251                 if (setresuid(uid, uid, uid) < 0)
1252                         log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m");
1253
1254                 (void) ignore_signals(SIGPIPE, -1);
1255
1256                 /* Wait until our parent died. This will only work if
1257                  * the above setresuid() succeeds, otherwise the kernel
1258                  * will not allow unprivileged parents kill their privileged
1259                  * children this way. We rely on the control groups kill logic
1260                  * to do the rest for us. */
1261                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
1262                         goto child_finish;
1263
1264                 /* Tell the parent that our setup is done. This is especially
1265                  * important regarding dropping privileges. Otherwise, unit
1266                  * setup might race against our setresuid(2) call.
1267                  *
1268                  * If the parent aborted, we'll detect this below, hence ignore
1269                  * return failure here. */
1270                 (void) barrier_place(&barrier);
1271
1272                 /* Check if our parent process might already have died? */
1273                 if (getppid() == parent_pid) {
1274                         sigset_t ss;
1275
1276                         assert_se(sigemptyset(&ss) >= 0);
1277                         assert_se(sigaddset(&ss, SIGTERM) >= 0);
1278
1279                         for (;;) {
1280                                 if (sigwait(&ss, &sig) < 0) {
1281                                         if (errno == EINTR)
1282                                                 continue;
1283
1284                                         goto child_finish;
1285                                 }
1286
1287                                 assert(sig == SIGTERM);
1288                                 break;
1289                         }
1290                 }
1291
1292                 /* If our parent died we'll end the session */
1293                 if (getppid() != parent_pid) {
1294                         pam_code = pam_close_session(handle, flags);
1295                         if (pam_code != PAM_SUCCESS)
1296                                 goto child_finish;
1297                 }
1298
1299                 ret = 0;
1300
1301         child_finish:
1302                 pam_end(handle, pam_code | flags);
1303                 _exit(ret);
1304         }
1305
1306         barrier_set_role(&barrier, BARRIER_PARENT);
1307
1308         /* If the child was forked off successfully it will do all the
1309          * cleanups, so forget about the handle here. */
1310         handle = NULL;
1311
1312         /* Unblock SIGTERM again in the parent */
1313         assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
1314
1315         /* We close the log explicitly here, since the PAM modules
1316          * might have opened it, but we don't want this fd around. */
1317         closelog();
1318
1319         /* Synchronously wait for the child to initialize. We don't care for
1320          * errors as we cannot recover. However, warn loudly if it happens. */
1321         if (!barrier_place_and_sync(&barrier))
1322                 log_error("PAM initialization failed");
1323
1324         return strv_free_and_replace(*env, e);
1325
1326 fail:
1327         if (pam_code != PAM_SUCCESS) {
1328                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1329                 r = -EPERM;  /* PAM errors do not map to errno */
1330         } else
1331                 log_error_errno(r, "PAM failed: %m");
1332
1333         if (handle) {
1334                 if (close_session)
1335                         pam_code = pam_close_session(handle, flags);
1336
1337                 pam_end(handle, pam_code | flags);
1338         }
1339
1340         strv_free(e);
1341         closelog();
1342
1343         return r;
1344 #else
1345         return 0;
1346 #endif
1347 }
1348
1349 static void rename_process_from_path(const char *path) {
1350         char process_name[11];
1351         const char *p;
1352         size_t l;
1353
1354         /* This resulting string must fit in 10 chars (i.e. the length
1355          * of "/sbin/init") to look pretty in /bin/ps */
1356
1357         p = basename(path);
1358         if (isempty(p)) {
1359                 rename_process("(...)");
1360                 return;
1361         }
1362
1363         l = strlen(p);
1364         if (l > 8) {
1365                 /* The end of the process name is usually more
1366                  * interesting, since the first bit might just be
1367                  * "systemd-" */
1368                 p = p + l - 8;
1369                 l = 8;
1370         }
1371
1372         process_name[0] = '(';
1373         memcpy(process_name+1, p, l);
1374         process_name[1+l] = ')';
1375         process_name[1+l+1] = 0;
1376
1377         rename_process(process_name);
1378 }
1379
1380 static bool context_has_address_families(const ExecContext *c) {
1381         assert(c);
1382
1383         return c->address_families_whitelist ||
1384                 !set_isempty(c->address_families);
1385 }
1386
1387 static bool context_has_syscall_filters(const ExecContext *c) {
1388         assert(c);
1389
1390         return c->syscall_whitelist ||
1391                 !hashmap_isempty(c->syscall_filter);
1392 }
1393
1394 static bool context_has_no_new_privileges(const ExecContext *c) {
1395         assert(c);
1396
1397         if (c->no_new_privileges)
1398                 return true;
1399
1400         if (have_effective_cap(CAP_SYS_ADMIN)) /* if we are privileged, we don't need NNP */
1401                 return false;
1402
1403         /* We need NNP if we have any form of seccomp and are unprivileged */
1404         return context_has_address_families(c) ||
1405                 c->memory_deny_write_execute ||
1406                 c->restrict_realtime ||
1407                 exec_context_restrict_namespaces_set(c) ||
1408                 c->protect_kernel_tunables ||
1409                 c->protect_kernel_modules ||
1410                 c->private_devices ||
1411                 context_has_syscall_filters(c) ||
1412                 !set_isempty(c->syscall_archs) ||
1413                 c->lock_personality;
1414 }
1415
1416 #if HAVE_SECCOMP
1417
1418 static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
1419
1420         if (is_seccomp_available())
1421                 return false;
1422
1423         log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
1424         return true;
1425 }
1426
1427 static int apply_syscall_filter(const Unit* u, const ExecContext *c, bool needs_ambient_hack) {
1428         uint32_t negative_action, default_action, action;
1429         int r;
1430
1431         assert(u);
1432         assert(c);
1433
1434         if (!context_has_syscall_filters(c))
1435                 return 0;
1436
1437         if (skip_seccomp_unavailable(u, "SystemCallFilter="))
1438                 return 0;
1439
1440         negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
1441
1442         if (c->syscall_whitelist) {
1443                 default_action = negative_action;
1444                 action = SCMP_ACT_ALLOW;
1445         } else {
1446                 default_action = SCMP_ACT_ALLOW;
1447                 action = negative_action;
1448         }
1449
1450         if (needs_ambient_hack) {
1451                 r = seccomp_filter_set_add(c->syscall_filter, c->syscall_whitelist, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID);
1452                 if (r < 0)
1453                         return r;
1454         }
1455
1456         return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false);
1457 }
1458
1459 static int apply_syscall_archs(const Unit *u, const ExecContext *c) {
1460         assert(u);
1461         assert(c);
1462
1463         if (set_isempty(c->syscall_archs))
1464                 return 0;
1465
1466         if (skip_seccomp_unavailable(u, "SystemCallArchitectures="))
1467                 return 0;
1468
1469         return seccomp_restrict_archs(c->syscall_archs);
1470 }
1471
1472 static int apply_address_families(const Unit* u, const ExecContext *c) {
1473         assert(u);
1474         assert(c);
1475
1476         if (!context_has_address_families(c))
1477                 return 0;
1478
1479         if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1480                 return 0;
1481
1482         return seccomp_restrict_address_families(c->address_families, c->address_families_whitelist);
1483 }
1484
1485 static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
1486         assert(u);
1487         assert(c);
1488
1489         if (!c->memory_deny_write_execute)
1490                 return 0;
1491
1492         if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1493                 return 0;
1494
1495         return seccomp_memory_deny_write_execute();
1496 }
1497
1498 static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
1499         assert(u);
1500         assert(c);
1501
1502         if (!c->restrict_realtime)
1503                 return 0;
1504
1505         if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1506                 return 0;
1507
1508         return seccomp_restrict_realtime();
1509 }
1510
1511 static int apply_protect_sysctl(const Unit *u, const ExecContext *c) {
1512         assert(u);
1513         assert(c);
1514
1515         /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1516          * let's protect even those systems where this is left on in the kernel. */
1517
1518         if (!c->protect_kernel_tunables)
1519                 return 0;
1520
1521         if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1522                 return 0;
1523
1524         return seccomp_protect_sysctl();
1525 }
1526
1527 static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
1528         assert(u);
1529         assert(c);
1530
1531         /* Turn off module syscalls on ProtectKernelModules=yes */
1532
1533         if (!c->protect_kernel_modules)
1534                 return 0;
1535
1536         if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
1537                 return 0;
1538
1539         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM), false);
1540 }
1541
1542 static int apply_private_devices(const Unit *u, const ExecContext *c) {
1543         assert(u);
1544         assert(c);
1545
1546         /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */
1547
1548         if (!c->private_devices)
1549                 return 0;
1550
1551         if (skip_seccomp_unavailable(u, "PrivateDevices="))
1552                 return 0;
1553
1554         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM), false);
1555 }
1556
1557 static int apply_restrict_namespaces(const Unit *u, const ExecContext *c) {
1558         assert(u);
1559         assert(c);
1560
1561         if (!exec_context_restrict_namespaces_set(c))
1562                 return 0;
1563
1564         if (skip_seccomp_unavailable(u, "RestrictNamespaces="))
1565                 return 0;
1566
1567         return seccomp_restrict_namespaces(c->restrict_namespaces);
1568 }
1569
1570 static int apply_lock_personality(const Unit* u, const ExecContext *c) {
1571         unsigned long personality;
1572         int r;
1573
1574         assert(u);
1575         assert(c);
1576
1577         if (!c->lock_personality)
1578                 return 0;
1579
1580         if (skip_seccomp_unavailable(u, "LockPersonality="))
1581                 return 0;
1582
1583         personality = c->personality;
1584
1585         /* If personality is not specified, use either PER_LINUX or PER_LINUX32 depending on what is currently set. */
1586         if (personality == PERSONALITY_INVALID) {
1587
1588                 r = opinionated_personality(&personality);
1589                 if (r < 0)
1590                         return r;
1591         }
1592
1593         return seccomp_lock_personality(personality);
1594 }
1595
1596 #endif
1597
1598 static void do_idle_pipe_dance(int idle_pipe[static 4]) {
1599         assert(idle_pipe);
1600
1601         idle_pipe[1] = safe_close(idle_pipe[1]);
1602         idle_pipe[2] = safe_close(idle_pipe[2]);
1603
1604         if (idle_pipe[0] >= 0) {
1605                 int r;
1606
1607                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1608
1609                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1610                         ssize_t n;
1611
1612                         /* Signal systemd that we are bored and want to continue. */
1613                         n = write(idle_pipe[3], "x", 1);
1614                         if (n > 0)
1615                                 /* Wait for systemd to react to the signal above. */
1616                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1617                 }
1618
1619                 idle_pipe[0] = safe_close(idle_pipe[0]);
1620
1621         }
1622
1623         idle_pipe[3] = safe_close(idle_pipe[3]);
1624 }
1625
1626 static const char *exec_directory_env_name_to_string(ExecDirectoryType t);
1627
1628 static int build_environment(
1629                 const Unit *u,
1630                 const ExecContext *c,
1631                 const ExecParameters *p,
1632                 size_t n_fds,
1633                 const char *home,
1634                 const char *username,
1635                 const char *shell,
1636                 dev_t journal_stream_dev,
1637                 ino_t journal_stream_ino,
1638                 char ***ret) {
1639
1640         _cleanup_strv_free_ char **our_env = NULL;
1641         ExecDirectoryType t;
1642         size_t n_env = 0;
1643         char *x;
1644
1645         assert(u);
1646         assert(c);
1647         assert(p);
1648         assert(ret);
1649
1650         our_env = new0(char*, 14 + _EXEC_DIRECTORY_TYPE_MAX);
1651         if (!our_env)
1652                 return -ENOMEM;
1653
1654         if (n_fds > 0) {
1655                 _cleanup_free_ char *joined = NULL;
1656
1657                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid_cached()) < 0)
1658                         return -ENOMEM;
1659                 our_env[n_env++] = x;
1660
1661                 if (asprintf(&x, "LISTEN_FDS=%zu", n_fds) < 0)
1662                         return -ENOMEM;
1663                 our_env[n_env++] = x;
1664
1665                 joined = strv_join(p->fd_names, ":");
1666                 if (!joined)
1667                         return -ENOMEM;
1668
1669                 x = strjoin("LISTEN_FDNAMES=", joined);
1670                 if (!x)
1671                         return -ENOMEM;
1672                 our_env[n_env++] = x;
1673         }
1674
1675         if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
1676                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid_cached()) < 0)
1677                         return -ENOMEM;
1678                 our_env[n_env++] = x;
1679
1680                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1681                         return -ENOMEM;
1682                 our_env[n_env++] = x;
1683         }
1684
1685         /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use D-Bus look up dynamic
1686          * users via PID 1, possibly dead-locking the dbus daemon. This way it will not use D-Bus to resolve names, but
1687          * check the database directly. */
1688         if (p->flags & EXEC_NSS_BYPASS_BUS) {
1689                 x = strdup("SYSTEMD_NSS_BYPASS_BUS=1");
1690                 if (!x)
1691                         return -ENOMEM;
1692                 our_env[n_env++] = x;
1693         }
1694
1695         if (home) {
1696                 x = strappend("HOME=", home);
1697                 if (!x)
1698                         return -ENOMEM;
1699                 our_env[n_env++] = x;
1700         }
1701
1702         if (username) {
1703                 x = strappend("LOGNAME=", username);
1704                 if (!x)
1705                         return -ENOMEM;
1706                 our_env[n_env++] = x;
1707
1708                 x = strappend("USER=", username);
1709                 if (!x)
1710                         return -ENOMEM;
1711                 our_env[n_env++] = x;
1712         }
1713
1714         if (shell) {
1715                 x = strappend("SHELL=", shell);
1716                 if (!x)
1717                         return -ENOMEM;
1718                 our_env[n_env++] = x;
1719         }
1720
1721         if (!sd_id128_is_null(u->invocation_id)) {
1722                 if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0)
1723                         return -ENOMEM;
1724
1725                 our_env[n_env++] = x;
1726         }
1727
1728         if (exec_context_needs_term(c)) {
1729                 const char *tty_path, *term = NULL;
1730
1731                 tty_path = exec_context_tty_path(c);
1732
1733                 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try to inherit
1734                  * the $TERM set for PID 1. This is useful for containers so that the $TERM the container manager
1735                  * passes to PID 1 ends up all the way in the console login shown. */
1736
1737                 if (path_equal(tty_path, "/dev/console") && getppid() == 1)
1738                         term = getenv("TERM");
1739                 if (!term)
1740                         term = default_term_for_tty(tty_path);
1741
1742                 x = strappend("TERM=", term);
1743                 if (!x)
1744                         return -ENOMEM;
1745                 our_env[n_env++] = x;
1746         }
1747
1748         if (journal_stream_dev != 0 && journal_stream_ino != 0) {
1749                 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
1750                         return -ENOMEM;
1751
1752                 our_env[n_env++] = x;
1753         }
1754
1755         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
1756                 _cleanup_free_ char *pre = NULL, *joined = NULL;
1757                 const char *n;
1758
1759                 if (!p->prefix[t])
1760                         continue;
1761
1762                 if (strv_isempty(c->directories[t].paths))
1763                         continue;
1764
1765                 n = exec_directory_env_name_to_string(t);
1766                 if (!n)
1767                         continue;
1768
1769                 pre = strjoin(p->prefix[t], "/");
1770                 if (!pre)
1771                         return -ENOMEM;
1772
1773                 joined = strv_join_prefix(c->directories[t].paths, ":", pre);
1774                 if (!joined)
1775                         return -ENOMEM;
1776
1777                 x = strjoin(n, "=", joined);
1778                 if (!x)
1779                         return -ENOMEM;
1780
1781                 our_env[n_env++] = x;
1782         }
1783
1784         our_env[n_env++] = NULL;
1785         assert(n_env <= 14 + _EXEC_DIRECTORY_TYPE_MAX);
1786
1787         *ret = TAKE_PTR(our_env);
1788
1789         return 0;
1790 }
1791
1792 static int build_pass_environment(const ExecContext *c, char ***ret) {
1793         _cleanup_strv_free_ char **pass_env = NULL;
1794         size_t n_env = 0, n_bufsize = 0;
1795         char **i;
1796
1797         STRV_FOREACH(i, c->pass_environment) {
1798                 _cleanup_free_ char *x = NULL;
1799                 char *v;
1800
1801                 v = getenv(*i);
1802                 if (!v)
1803                         continue;
1804                 x = strjoin(*i, "=", v);
1805                 if (!x)
1806                         return -ENOMEM;
1807
1808                 if (!GREEDY_REALLOC(pass_env, n_bufsize, n_env + 2))
1809                         return -ENOMEM;
1810
1811                 pass_env[n_env++] = TAKE_PTR(x);
1812                 pass_env[n_env] = NULL;
1813         }
1814
1815         *ret = TAKE_PTR(pass_env);
1816
1817         return 0;
1818 }
1819
1820 static bool exec_needs_mount_namespace(
1821                 const ExecContext *context,
1822                 const ExecParameters *params,
1823                 const ExecRuntime *runtime) {
1824
1825         assert(context);
1826         assert(params);
1827
1828         if (context->root_image)
1829                 return true;
1830
1831         if (!strv_isempty(context->read_write_paths) ||
1832             !strv_isempty(context->read_only_paths) ||
1833             !strv_isempty(context->inaccessible_paths))
1834                 return true;
1835
1836         if (context->n_bind_mounts > 0)
1837                 return true;
1838
1839         if (context->n_temporary_filesystems > 0)
1840                 return true;
1841
1842         if (context->mount_flags != 0)
1843                 return true;
1844
1845         if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
1846                 return true;
1847
1848         if (context->private_devices ||
1849             context->private_mounts ||
1850             context->protect_system != PROTECT_SYSTEM_NO ||
1851             context->protect_home != PROTECT_HOME_NO ||
1852             context->protect_kernel_tunables ||
1853             context->protect_kernel_modules ||
1854             context->protect_control_groups)
1855                 return true;
1856
1857         if (context->root_directory) {
1858                 ExecDirectoryType t;
1859
1860                 if (context->mount_apivfs)
1861                         return true;
1862
1863                 for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
1864                         if (!params->prefix[t])
1865                                 continue;
1866
1867                         if (!strv_isempty(context->directories[t].paths))
1868                                 return true;
1869                 }
1870         }
1871
1872         if (context->dynamic_user &&
1873             (!strv_isempty(context->directories[EXEC_DIRECTORY_STATE].paths) ||
1874              !strv_isempty(context->directories[EXEC_DIRECTORY_CACHE].paths) ||
1875              !strv_isempty(context->directories[EXEC_DIRECTORY_LOGS].paths)))
1876                 return true;
1877
1878         return false;
1879 }
1880
1881 static int setup_private_users(uid_t uid, gid_t gid) {
1882         _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
1883         _cleanup_close_pair_ int errno_pipe[2] = { -1, -1 };
1884         _cleanup_close_ int unshare_ready_fd = -1;
1885         _cleanup_(sigkill_waitp) pid_t pid = 0;
1886         uint64_t c = 1;
1887         ssize_t n;
1888         int r;
1889
1890         /* Set up a user namespace and map root to root, the selected UID/GID to itself, and everything else to
1891          * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
1892          * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
1893          * which waits for the parent to create the new user namespace while staying in the original namespace. The
1894          * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
1895          * continues execution normally. */
1896
1897         if (uid != 0 && uid_is_valid(uid)) {
1898                 r = asprintf(&uid_map,
1899                              "0 0 1\n"                      /* Map root → root */
1900                              UID_FMT " " UID_FMT " 1\n",    /* Map $UID → $UID */
1901                              uid, uid);
1902                 if (r < 0)
1903                         return -ENOMEM;
1904         } else {
1905                 uid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1906                 if (!uid_map)
1907                         return -ENOMEM;
1908         }
1909
1910         if (gid != 0 && gid_is_valid(gid)) {
1911                 r = asprintf(&gid_map,
1912                              "0 0 1\n"                      /* Map root → root */
1913                              GID_FMT " " GID_FMT " 1\n",    /* Map $GID → $GID */
1914                              gid, gid);
1915                 if (r < 0)
1916                         return -ENOMEM;
1917         } else {
1918                 gid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1919                 if (!gid_map)
1920                         return -ENOMEM;
1921         }
1922
1923         /* Create a communication channel so that the parent can tell the child when it finished creating the user
1924          * namespace. */
1925         unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
1926         if (unshare_ready_fd < 0)
1927                 return -errno;
1928
1929         /* Create a communication channel so that the child can tell the parent a proper error code in case it
1930          * failed. */
1931         if (pipe2(errno_pipe, O_CLOEXEC) < 0)
1932                 return -errno;
1933
1934         r = safe_fork("(sd-userns)", FORK_RESET_SIGNALS|FORK_DEATHSIG, &pid);
1935         if (r < 0)
1936                 return r;
1937         if (r == 0) {
1938                 _cleanup_close_ int fd = -1;
1939                 const char *a;
1940                 pid_t ppid;
1941
1942                 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
1943                  * here, after the parent opened its own user namespace. */
1944
1945                 ppid = getppid();
1946                 errno_pipe[0] = safe_close(errno_pipe[0]);
1947
1948                 /* Wait until the parent unshared the user namespace */
1949                 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
1950                         r = -errno;
1951                         goto child_fail;
1952                 }
1953
1954                 /* Disable the setgroups() system call in the child user namespace, for good. */
1955                 a = procfs_file_alloca(ppid, "setgroups");
1956                 fd = open(a, O_WRONLY|O_CLOEXEC);
1957                 if (fd < 0) {
1958                         if (errno != ENOENT) {
1959                                 r = -errno;
1960                                 goto child_fail;
1961                         }
1962
1963                         /* If the file is missing the kernel is too old, let's continue anyway. */
1964                 } else {
1965                         if (write(fd, "deny\n", 5) < 0) {
1966                                 r = -errno;
1967                                 goto child_fail;
1968                         }
1969
1970                         fd = safe_close(fd);
1971                 }
1972
1973                 /* First write the GID map */
1974                 a = procfs_file_alloca(ppid, "gid_map");
1975                 fd = open(a, O_WRONLY|O_CLOEXEC);
1976                 if (fd < 0) {
1977                         r = -errno;
1978                         goto child_fail;
1979                 }
1980                 if (write(fd, gid_map, strlen(gid_map)) < 0) {
1981                         r = -errno;
1982                         goto child_fail;
1983                 }
1984                 fd = safe_close(fd);
1985
1986                 /* The write the UID map */
1987                 a = procfs_file_alloca(ppid, "uid_map");
1988                 fd = open(a, O_WRONLY|O_CLOEXEC);
1989                 if (fd < 0) {
1990                         r = -errno;
1991                         goto child_fail;
1992                 }
1993                 if (write(fd, uid_map, strlen(uid_map)) < 0) {
1994                         r = -errno;
1995                         goto child_fail;
1996                 }
1997
1998                 _exit(EXIT_SUCCESS);
1999
2000         child_fail:
2001                 (void) write(errno_pipe[1], &r, sizeof(r));
2002                 _exit(EXIT_FAILURE);
2003         }
2004
2005         errno_pipe[1] = safe_close(errno_pipe[1]);
2006
2007         if (unshare(CLONE_NEWUSER) < 0)
2008                 return -errno;
2009
2010         /* Let the child know that the namespace is ready now */
2011         if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
2012                 return -errno;
2013
2014         /* Try to read an error code from the child */
2015         n = read(errno_pipe[0], &r, sizeof(r));
2016         if (n < 0)
2017                 return -errno;
2018         if (n == sizeof(r)) { /* an error code was sent to us */
2019                 if (r < 0)
2020                         return r;
2021                 return -EIO;
2022         }
2023         if (n != 0) /* on success we should have read 0 bytes */
2024                 return -EIO;
2025
2026         r = wait_for_terminate_and_check("(sd-userns)", pid, 0);
2027         pid = 0;
2028         if (r < 0)
2029                 return r;
2030         if (r != EXIT_SUCCESS) /* If something strange happened with the child, let's consider this fatal, too */
2031                 return -EIO;
2032
2033         return 0;
2034 }
2035
2036 static int setup_exec_directory(
2037                 const ExecContext *context,
2038                 const ExecParameters *params,
2039                 uid_t uid,
2040                 gid_t gid,
2041                 ExecDirectoryType type,
2042                 int *exit_status) {
2043
2044         static const int exit_status_table[_EXEC_DIRECTORY_TYPE_MAX] = {
2045                 [EXEC_DIRECTORY_RUNTIME] = EXIT_RUNTIME_DIRECTORY,
2046                 [EXEC_DIRECTORY_STATE] = EXIT_STATE_DIRECTORY,
2047                 [EXEC_DIRECTORY_CACHE] = EXIT_CACHE_DIRECTORY,
2048                 [EXEC_DIRECTORY_LOGS] = EXIT_LOGS_DIRECTORY,
2049                 [EXEC_DIRECTORY_CONFIGURATION] = EXIT_CONFIGURATION_DIRECTORY,
2050         };
2051         char **rt;
2052         int r;
2053
2054         assert(context);
2055         assert(params);
2056         assert(type >= 0 && type < _EXEC_DIRECTORY_TYPE_MAX);
2057         assert(exit_status);
2058
2059         if (!params->prefix[type])
2060                 return 0;
2061
2062         if (params->flags & EXEC_CHOWN_DIRECTORIES) {
2063                 if (!uid_is_valid(uid))
2064                         uid = 0;
2065                 if (!gid_is_valid(gid))
2066                         gid = 0;
2067         }
2068
2069         STRV_FOREACH(rt, context->directories[type].paths) {
2070                 _cleanup_free_ char *p = NULL, *pp = NULL;
2071
2072                 p = strjoin(params->prefix[type], "/", *rt);
2073                 if (!p) {
2074                         r = -ENOMEM;
2075                         goto fail;
2076                 }
2077
2078                 r = mkdir_parents_label(p, 0755);
2079                 if (r < 0)
2080                         goto fail;
2081
2082                 if (context->dynamic_user &&
2083                     !IN_SET(type, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION)) {
2084                         _cleanup_free_ char *private_root = NULL;
2085
2086                         /* So, here's one extra complication when dealing with DynamicUser=1 units. In that case we
2087                          * want to avoid leaving a directory around fully accessible that is owned by a dynamic user
2088                          * whose UID is later on reused. To lock this down we use the same trick used by container
2089                          * managers to prohibit host users to get access to files of the same UID in containers: we
2090                          * place everything inside a directory that has an access mode of 0700 and is owned root:root,
2091                          * so that it acts as security boundary for unprivileged host code. We then use fs namespacing
2092                          * to make this directory permeable for the service itself.
2093                          *
2094                          * Specifically: for a service which wants a special directory "foo/" we first create a
2095                          * directory "private/" with access mode 0700 owned by root:root. Then we place "foo" inside of
2096                          * that directory (i.e. "private/foo/"), and make "foo" a symlink to "private/foo". This way,
2097                          * privileged host users can access "foo/" as usual, but unprivileged host users can't look
2098                          * into it. Inside of the namespaceof the container "private/" is replaced by a more liberally
2099                          * accessible tmpfs, into which the host's "private/foo/" is mounted under the same name, thus
2100                          * disabling the access boundary for the service and making sure it only gets access to the
2101                          * dirs it needs but no others. Tricky? Yes, absolutely, but it works!
2102                          *
2103                          * Note that we don't do this for EXEC_DIRECTORY_CONFIGURATION as that's assumed not to be
2104                          * owned by the service itself.
2105                          * Also, note that we don't do this for EXEC_DIRECTORY_RUNTIME as that's often used for sharing
2106                          * files or sockets with other services. */
2107
2108                         private_root = strjoin(params->prefix[type], "/private");
2109                         if (!private_root) {
2110                                 r = -ENOMEM;
2111                                 goto fail;
2112                         }
2113
2114                         /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */
2115                         r = mkdir_safe_label(private_root, 0700, 0, 0, MKDIR_WARN_MODE);
2116                         if (r < 0)
2117                                 goto fail;
2118
2119                         pp = strjoin(private_root, "/", *rt);
2120                         if (!pp) {
2121                                 r = -ENOMEM;
2122                                 goto fail;
2123                         }
2124
2125                         /* Create all directories between the configured directory and this private root, and mark them 0755 */
2126                         r = mkdir_parents_label(pp, 0755);
2127                         if (r < 0)
2128                                 goto fail;
2129
2130                         if (is_dir(p, false) > 0 &&
2131                             (laccess(pp, F_OK) < 0 && errno == ENOENT)) {
2132
2133                                 /* Hmm, the private directory doesn't exist yet, but the normal one exists? If so, move
2134                                  * it over. Most likely the service has been upgraded from one that didn't use
2135                                  * DynamicUser=1, to one that does. */
2136
2137                                 if (rename(p, pp) < 0) {
2138                                         r = -errno;
2139                                         goto fail;
2140                                 }
2141                         } else {
2142                                 /* Otherwise, create the actual directory for the service */
2143
2144                                 r = mkdir_label(pp, context->directories[type].mode);
2145                                 if (r < 0 && r != -EEXIST)
2146                                         goto fail;
2147                         }
2148
2149                         /* And link it up from the original place */
2150                         r = symlink_idempotent(pp, p, true);
2151                         if (r < 0)
2152                                 goto fail;
2153
2154                         /* Lock down the access mode */
2155                         if (chmod(pp, context->directories[type].mode) < 0) {
2156                                 r = -errno;
2157                                 goto fail;
2158                         }
2159                 } else {
2160                         r = mkdir_label(p, context->directories[type].mode);
2161                         if (r < 0 && r != -EEXIST)
2162                                 goto fail;
2163                         if (r == -EEXIST) {
2164                                 struct stat st;
2165
2166                                 if (stat(p, &st) < 0) {
2167                                         r = -errno;
2168                                         goto fail;
2169                                 }
2170                                 if (((st.st_mode ^ context->directories[type].mode) & 07777) != 0)
2171                                         log_warning("%s \'%s\' already exists but the mode is different. "
2172                                                     "(filesystem: %o %sMode: %o)",
2173                                                     exec_directory_type_to_string(type), *rt,
2174                                                     st.st_mode & 07777, exec_directory_type_to_string(type), context->directories[type].mode & 07777);
2175                                 if (!context->dynamic_user)
2176                                         continue;
2177                         }
2178                 }
2179
2180                 /* Don't change the owner of the configuration directory, as in the common case it is not written to by
2181                  * a service, and shall not be writable. */
2182                 if (type == EXEC_DIRECTORY_CONFIGURATION)
2183                         continue;
2184
2185                 /* Then, change the ownership of the whole tree, if necessary */
2186                 r = path_chown_recursive(pp ?: p, uid, gid);
2187                 if (r < 0)
2188                         goto fail;
2189         }
2190
2191         return 0;
2192
2193 fail:
2194         *exit_status = exit_status_table[type];
2195         return r;
2196 }
2197
2198 #if ENABLE_SMACK
2199 static int setup_smack(
2200                 const ExecContext *context,
2201                 const ExecCommand *command) {
2202
2203         int r;
2204
2205         assert(context);
2206         assert(command);
2207
2208         if (context->smack_process_label) {
2209                 r = mac_smack_apply_pid(0, context->smack_process_label);
2210                 if (r < 0)
2211                         return r;
2212         }
2213 #ifdef SMACK_DEFAULT_PROCESS_LABEL
2214         else {
2215                 _cleanup_free_ char *exec_label = NULL;
2216
2217                 r = mac_smack_read(command->path, SMACK_ATTR_EXEC, &exec_label);
2218                 if (r < 0 && !IN_SET(r, -ENODATA, -EOPNOTSUPP))
2219                         return r;
2220
2221                 r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
2222                 if (r < 0)
2223                         return r;
2224         }
2225 #endif
2226
2227         return 0;
2228 }
2229 #endif
2230
2231 static int compile_bind_mounts(
2232                 const ExecContext *context,
2233                 const ExecParameters *params,
2234                 BindMount **ret_bind_mounts,
2235                 size_t *ret_n_bind_mounts,
2236                 char ***ret_empty_directories) {
2237
2238         _cleanup_strv_free_ char **empty_directories = NULL;
2239         BindMount *bind_mounts;
2240         size_t n, h = 0, i;
2241         ExecDirectoryType t;
2242         int r;
2243
2244         assert(context);
2245         assert(params);
2246         assert(ret_bind_mounts);
2247         assert(ret_n_bind_mounts);
2248         assert(ret_empty_directories);
2249
2250         n = context->n_bind_mounts;
2251         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2252                 if (!params->prefix[t])
2253                         continue;
2254
2255                 n += strv_length(context->directories[t].paths);
2256         }
2257
2258         if (n <= 0) {
2259                 *ret_bind_mounts = NULL;
2260                 *ret_n_bind_mounts = 0;
2261                 *ret_empty_directories = NULL;
2262                 return 0;
2263         }
2264
2265         bind_mounts = new(BindMount, n);
2266         if (!bind_mounts)
2267                 return -ENOMEM;
2268
2269         for (i = 0; i < context->n_bind_mounts; i++) {
2270                 BindMount *item = context->bind_mounts + i;
2271                 char *s, *d;
2272
2273                 s = strdup(item->source);
2274                 if (!s) {
2275                         r = -ENOMEM;
2276                         goto finish;
2277                 }
2278
2279                 d = strdup(item->destination);
2280                 if (!d) {
2281                         free(s);
2282                         r = -ENOMEM;
2283                         goto finish;
2284                 }
2285
2286                 bind_mounts[h++] = (BindMount) {
2287                         .source = s,
2288                         .destination = d,
2289                         .read_only = item->read_only,
2290                         .recursive = item->recursive,
2291                         .ignore_enoent = item->ignore_enoent,
2292                 };
2293         }
2294
2295         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2296                 char **suffix;
2297
2298                 if (!params->prefix[t])
2299                         continue;
2300
2301                 if (strv_isempty(context->directories[t].paths))
2302                         continue;
2303
2304                 if (context->dynamic_user &&
2305                     !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) &&
2306                     !(context->root_directory || context->root_image)) {
2307                         char *private_root;
2308
2309                         /* So this is for a dynamic user, and we need to make sure the process can access its own
2310                          * directory. For that we overmount the usually inaccessible "private" subdirectory with a
2311                          * tmpfs that makes it accessible and is empty except for the submounts we do this for. */
2312
2313                         private_root = strjoin(params->prefix[t], "/private");
2314                         if (!private_root) {
2315                                 r = -ENOMEM;
2316                                 goto finish;
2317                         }
2318
2319                         r = strv_consume(&empty_directories, private_root);
2320                         if (r < 0)
2321                                 goto finish;
2322                 }
2323
2324                 STRV_FOREACH(suffix, context->directories[t].paths) {
2325                         char *s, *d;
2326
2327                         if (context->dynamic_user &&
2328                             !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION))
2329                                 s = strjoin(params->prefix[t], "/private/", *suffix);
2330                         else
2331                                 s = strjoin(params->prefix[t], "/", *suffix);
2332                         if (!s) {
2333                                 r = -ENOMEM;
2334                                 goto finish;
2335                         }
2336
2337                         if (context->dynamic_user &&
2338                             !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) &&
2339                             (context->root_directory || context->root_image))
2340                                 /* When RootDirectory= or RootImage= are set, then the symbolic link to the private
2341                                  * directory is not created on the root directory. So, let's bind-mount the directory
2342                                  * on the 'non-private' place. */
2343                                 d = strjoin(params->prefix[t], "/", *suffix);
2344                         else
2345                                 d = strdup(s);
2346                         if (!d) {
2347                                 free(s);
2348                                 r = -ENOMEM;
2349                                 goto finish;
2350                         }
2351
2352                         bind_mounts[h++] = (BindMount) {
2353                                 .source = s,
2354                                 .destination = d,
2355                                 .read_only = false,
2356                                 .recursive = true,
2357                                 .ignore_enoent = false,
2358                         };
2359                 }
2360         }
2361
2362         assert(h == n);
2363
2364         *ret_bind_mounts = bind_mounts;
2365         *ret_n_bind_mounts = n;
2366         *ret_empty_directories = TAKE_PTR(empty_directories);
2367
2368         return (int) n;
2369
2370 finish:
2371         bind_mount_free_many(bind_mounts, h);
2372         return r;
2373 }
2374
2375 static int apply_mount_namespace(
2376                 const Unit *u,
2377                 const ExecCommand *command,
2378                 const ExecContext *context,
2379                 const ExecParameters *params,
2380                 const ExecRuntime *runtime) {
2381
2382         _cleanup_strv_free_ char **empty_directories = NULL;
2383         char *tmp = NULL, *var = NULL;
2384         const char *root_dir = NULL, *root_image = NULL;
2385         NamespaceInfo ns_info;
2386         bool needs_sandboxing;
2387         BindMount *bind_mounts = NULL;
2388         size_t n_bind_mounts = 0;
2389         int r;
2390
2391         assert(context);
2392
2393         /* The runtime struct only contains the parent of the private /tmp,
2394          * which is non-accessible to world users. Inside of it there's a /tmp
2395          * that is sticky, and that's the one we want to use here. */
2396
2397         if (context->private_tmp && runtime) {
2398                 if (runtime->tmp_dir)
2399                         tmp = strjoina(runtime->tmp_dir, "/tmp");
2400                 if (runtime->var_tmp_dir)
2401                         var = strjoina(runtime->var_tmp_dir, "/tmp");
2402         }
2403
2404         if (params->flags & EXEC_APPLY_CHROOT) {
2405                 root_image = context->root_image;
2406
2407                 if (!root_image)
2408                         root_dir = context->root_directory;
2409         }
2410
2411         r = compile_bind_mounts(context, params, &bind_mounts, &n_bind_mounts, &empty_directories);
2412         if (r < 0)
2413                 return r;
2414
2415         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
2416         if (needs_sandboxing)
2417                 ns_info = (NamespaceInfo) {
2418                         .ignore_protect_paths = false,
2419                         .private_dev = context->private_devices,
2420                         .protect_control_groups = context->protect_control_groups,
2421                         .protect_kernel_tunables = context->protect_kernel_tunables,
2422                         .protect_kernel_modules = context->protect_kernel_modules,
2423                         .mount_apivfs = context->mount_apivfs,
2424                         .private_mounts = context->private_mounts,
2425                 };
2426         else if (!context->dynamic_user && root_dir)
2427                 /*
2428                  * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed
2429                  * sandbox info, otherwise enforce it, don't ignore protected paths and
2430                  * fail if we are enable to apply the sandbox inside the mount namespace.
2431                  */
2432                 ns_info = (NamespaceInfo) {
2433                         .ignore_protect_paths = true,
2434                 };
2435         else
2436                 ns_info = (NamespaceInfo) {};
2437
2438         r = setup_namespace(root_dir, root_image,
2439                             &ns_info, context->read_write_paths,
2440                             needs_sandboxing ? context->read_only_paths : NULL,
2441                             needs_sandboxing ? context->inaccessible_paths : NULL,
2442                             empty_directories,
2443                             bind_mounts,
2444                             n_bind_mounts,
2445                             context->temporary_filesystems,
2446                             context->n_temporary_filesystems,
2447                             tmp,
2448                             var,
2449                             needs_sandboxing ? context->protect_home : PROTECT_HOME_NO,
2450                             needs_sandboxing ? context->protect_system : PROTECT_SYSTEM_NO,
2451                             context->mount_flags,
2452                             DISSECT_IMAGE_DISCARD_ON_LOOP);
2453
2454         bind_mount_free_many(bind_mounts, n_bind_mounts);
2455
2456         /* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports
2457          * that with a special, recognizable error ENOANO. In this case, silently proceeed, but only if exclusively
2458          * sandboxing options were used, i.e. nothing such as RootDirectory= or BindMount= that would result in a
2459          * completely different execution environment. */
2460         if (r == -ENOANO) {
2461                 if (n_bind_mounts == 0 &&
2462                     context->n_temporary_filesystems == 0 &&
2463                     !root_dir && !root_image &&
2464                     !context->dynamic_user) {
2465                         log_unit_debug(u, "Failed to set up namespace, assuming containerized execution and ignoring.");
2466                         return 0;
2467                 }
2468
2469                 log_unit_debug(u, "Failed to set up namespace, and refusing to continue since the selected namespacing options alter mount environment non-trivially.\n"
2470                                "Bind mounts: %zu, temporary filesystems: %zu, root directory: %s, root image: %s, dynamic user: %s",
2471                                n_bind_mounts, context->n_temporary_filesystems, yes_no(root_dir), yes_no(root_image), yes_no(context->dynamic_user));
2472
2473                 return -EOPNOTSUPP;
2474         }
2475
2476         return r;
2477 }
2478
2479 static int apply_working_directory(
2480                 const ExecContext *context,
2481                 const ExecParameters *params,
2482                 const char *home,
2483                 const bool needs_mount_ns,
2484                 int *exit_status) {
2485
2486         const char *d, *wd;
2487
2488         assert(context);
2489         assert(exit_status);
2490
2491         if (context->working_directory_home) {
2492
2493                 if (!home) {
2494                         *exit_status = EXIT_CHDIR;
2495                         return -ENXIO;
2496                 }
2497
2498                 wd = home;
2499
2500         } else if (context->working_directory)
2501                 wd = context->working_directory;
2502         else
2503                 wd = "/";
2504
2505         if (params->flags & EXEC_APPLY_CHROOT) {
2506                 if (!needs_mount_ns && context->root_directory)
2507                         if (chroot(context->root_directory) < 0) {
2508                                 *exit_status = EXIT_CHROOT;
2509                                 return -errno;
2510                         }
2511
2512                 d = wd;
2513         } else
2514                 d = prefix_roota(context->root_directory, wd);
2515
2516         if (chdir(d) < 0 && !context->working_directory_missing_ok) {
2517                 *exit_status = EXIT_CHDIR;
2518                 return -errno;
2519         }
2520
2521         return 0;
2522 }
2523
2524 static int setup_keyring(
2525                 const Unit *u,
2526                 const ExecContext *context,
2527                 const ExecParameters *p,
2528                 uid_t uid, gid_t gid) {
2529
2530         key_serial_t keyring;
2531         int r = 0;
2532         uid_t saved_uid;
2533         gid_t saved_gid;
2534
2535         assert(u);
2536         assert(context);
2537         assert(p);
2538
2539         /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that
2540          * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond
2541          * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be
2542          * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in
2543          * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where
2544          * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */
2545
2546         if (context->keyring_mode == EXEC_KEYRING_INHERIT)
2547                 return 0;
2548
2549         /* Acquiring a reference to the user keyring is nasty. We briefly change identity in order to get things set up
2550          * properly by the kernel. If we don't do that then we can't create it atomically, and that sucks for parallel
2551          * execution. This mimics what pam_keyinit does, too. Setting up session keyring, to be owned by the right user
2552          * & group is just as nasty as acquiring a reference to the user keyring. */
2553
2554         saved_uid = getuid();
2555         saved_gid = getgid();
2556
2557         if (gid_is_valid(gid) && gid != saved_gid) {
2558                 if (setregid(gid, -1) < 0)
2559                         return log_unit_error_errno(u, errno, "Failed to change GID for user keyring: %m");
2560         }
2561
2562         if (uid_is_valid(uid) && uid != saved_uid) {
2563                 if (setreuid(uid, -1) < 0) {
2564                         r = log_unit_error_errno(u, errno, "Failed to change UID for user keyring: %m");
2565                         goto out;
2566                 }
2567         }
2568
2569         keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2570         if (keyring == -1) {
2571                 if (errno == ENOSYS)
2572                         log_unit_debug_errno(u, errno, "Kernel keyring not supported, ignoring.");
2573                 else if (IN_SET(errno, EACCES, EPERM))
2574                         log_unit_debug_errno(u, errno, "Kernel keyring access prohibited, ignoring.");
2575                 else if (errno == EDQUOT)
2576                         log_unit_debug_errno(u, errno, "Out of kernel keyrings to allocate, ignoring.");
2577                 else
2578                         r = log_unit_error_errno(u, errno, "Setting up kernel keyring failed: %m");
2579
2580                 goto out;
2581         }
2582
2583         /* When requested link the user keyring into the session keyring. */
2584         if (context->keyring_mode == EXEC_KEYRING_SHARED) {
2585
2586                 if (keyctl(KEYCTL_LINK,
2587                            KEY_SPEC_USER_KEYRING,
2588                            KEY_SPEC_SESSION_KEYRING, 0, 0) < 0) {
2589                         r = log_unit_error_errno(u, errno, "Failed to link user keyring into session keyring: %m");
2590                         goto out;
2591                 }
2592         }
2593
2594         /* Restore uid/gid back */
2595         if (uid_is_valid(uid) && uid != saved_uid) {
2596                 if (setreuid(saved_uid, -1) < 0) {
2597                         r = log_unit_error_errno(u, errno, "Failed to change UID back for user keyring: %m");
2598                         goto out;
2599                 }
2600         }
2601
2602         if (gid_is_valid(gid) && gid != saved_gid) {
2603                 if (setregid(saved_gid, -1) < 0)
2604                         return log_unit_error_errno(u, errno, "Failed to change GID back for user keyring: %m");
2605         }
2606
2607         /* Populate they keyring with the invocation ID by default, as original saved_uid. */
2608         if (!sd_id128_is_null(u->invocation_id)) {
2609                 key_serial_t key;
2610
2611                 key = add_key("user", "invocation_id", &u->invocation_id, sizeof(u->invocation_id), KEY_SPEC_SESSION_KEYRING);
2612                 if (key == -1)
2613                         log_unit_debug_errno(u, errno, "Failed to add invocation ID to keyring, ignoring: %m");
2614                 else {
2615                         if (keyctl(KEYCTL_SETPERM, key,
2616                                    KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH|
2617                                    KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0)
2618                                 r = log_unit_error_errno(u, errno, "Failed to restrict invocation ID permission: %m");
2619                 }
2620         }
2621
2622 out:
2623         /* Revert back uid & gid for the the last time, and exit */
2624         /* no extra logging, as only the first already reported error matters */
2625         if (getuid() != saved_uid)
2626                 (void) setreuid(saved_uid, -1);
2627
2628         if (getgid() != saved_gid)
2629                 (void) setregid(saved_gid, -1);
2630
2631         return r;
2632 }
2633
2634 static void append_socket_pair(int *array, size_t *n, const int pair[static 2]) {
2635         assert(array);
2636         assert(n);
2637
2638         if (!pair)
2639                 return;
2640
2641         if (pair[0] >= 0)
2642                 array[(*n)++] = pair[0];
2643         if (pair[1] >= 0)
2644                 array[(*n)++] = pair[1];
2645 }
2646
2647 static int close_remaining_fds(
2648                 const ExecParameters *params,
2649                 const ExecRuntime *runtime,
2650                 const DynamicCreds *dcreds,
2651                 int user_lookup_fd,
2652                 int socket_fd,
2653                 int exec_fd,
2654                 int *fds, size_t n_fds) {
2655
2656         size_t n_dont_close = 0;
2657         int dont_close[n_fds + 12];
2658
2659         assert(params);
2660
2661         if (params->stdin_fd >= 0)
2662                 dont_close[n_dont_close++] = params->stdin_fd;
2663         if (params->stdout_fd >= 0)
2664                 dont_close[n_dont_close++] = params->stdout_fd;
2665         if (params->stderr_fd >= 0)
2666                 dont_close[n_dont_close++] = params->stderr_fd;
2667
2668         if (socket_fd >= 0)
2669                 dont_close[n_dont_close++] = socket_fd;
2670         if (exec_fd >= 0)
2671                 dont_close[n_dont_close++] = exec_fd;
2672         if (n_fds > 0) {
2673                 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
2674                 n_dont_close += n_fds;
2675         }
2676
2677         if (runtime)
2678                 append_socket_pair(dont_close, &n_dont_close, runtime->netns_storage_socket);
2679
2680         if (dcreds) {
2681                 if (dcreds->user)
2682                         append_socket_pair(dont_close, &n_dont_close, dcreds->user->storage_socket);
2683                 if (dcreds->group)
2684                         append_socket_pair(dont_close, &n_dont_close, dcreds->group->storage_socket);
2685         }
2686
2687         if (user_lookup_fd >= 0)
2688                 dont_close[n_dont_close++] = user_lookup_fd;
2689
2690         return close_all_fds(dont_close, n_dont_close);
2691 }
2692
2693 static int send_user_lookup(
2694                 Unit *unit,
2695                 int user_lookup_fd,
2696                 uid_t uid,
2697                 gid_t gid) {
2698
2699         assert(unit);
2700
2701         /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
2702          * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
2703          * specified. */
2704
2705         if (user_lookup_fd < 0)
2706                 return 0;
2707
2708         if (!uid_is_valid(uid) && !gid_is_valid(gid))
2709                 return 0;
2710
2711         if (writev(user_lookup_fd,
2712                (struct iovec[]) {
2713                            IOVEC_INIT(&uid, sizeof(uid)),
2714                            IOVEC_INIT(&gid, sizeof(gid)),
2715                            IOVEC_INIT_STRING(unit->id) }, 3) < 0)
2716                 return -errno;
2717
2718         return 0;
2719 }
2720
2721 static int acquire_home(const ExecContext *c, uid_t uid, const char** home, char **buf) {
2722         int r;
2723
2724         assert(c);
2725         assert(home);
2726         assert(buf);
2727
2728         /* If WorkingDirectory=~ is set, try to acquire a usable home directory. */
2729
2730         if (*home)
2731                 return 0;
2732
2733         if (!c->working_directory_home)
2734                 return 0;
2735
2736         if (uid == 0) {
2737                 /* Hardcode /root as home directory for UID 0 */
2738                 *home = "/root";
2739                 return 1;
2740         }
2741
2742         r = get_home_dir(buf);
2743         if (r < 0)
2744                 return r;
2745
2746         *home = *buf;
2747         return 1;
2748 }
2749
2750 static int compile_suggested_paths(const ExecContext *c, const ExecParameters *p, char ***ret) {
2751         _cleanup_strv_free_ char ** list = NULL;
2752         ExecDirectoryType t;
2753         int r;
2754
2755         assert(c);
2756         assert(p);
2757         assert(ret);
2758
2759         assert(c->dynamic_user);
2760
2761         /* Compile a list of paths that it might make sense to read the owning UID from to use as initial candidate for
2762          * dynamic UID allocation, in order to save us from doing costly recursive chown()s of the special
2763          * directories. */
2764
2765         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2766                 char **i;
2767
2768                 if (t == EXEC_DIRECTORY_CONFIGURATION)
2769                         continue;
2770
2771                 if (!p->prefix[t])
2772                         continue;
2773
2774                 STRV_FOREACH(i, c->directories[t].paths) {
2775                         char *e;
2776
2777                         if (t == EXEC_DIRECTORY_RUNTIME)
2778                                 e = strjoin(p->prefix[t], "/", *i);
2779                         else
2780                                 e = strjoin(p->prefix[t], "/private/", *i);
2781                         if (!e)
2782                                 return -ENOMEM;
2783
2784                         r = strv_consume(&list, e);
2785                         if (r < 0)
2786                                 return r;
2787                 }
2788         }
2789
2790         *ret = TAKE_PTR(list);
2791
2792         return 0;
2793 }
2794
2795 static char *exec_command_line(char **argv);
2796
2797 static int exec_parameters_get_cgroup_path(const ExecParameters *params, char **ret) {
2798         bool using_subcgroup;
2799         char *p;
2800
2801         assert(params);
2802         assert(ret);
2803
2804         if (!params->cgroup_path)
2805                 return -EINVAL;
2806
2807         /* If we are called for a unit where cgroup delegation is on, and the payload created its own populated
2808          * subcgroup (which we expect it to do, after all it asked for delegation), then we cannot place the control
2809          * processes started after the main unit's process in the unit's main cgroup because it is now an inner one,
2810          * and inner cgroups may not contain processes. Hence, if delegation is on, and this is a control process,
2811          * let's use ".control" as subcgroup instead. Note that we do so only for ExecStartPost=, ExecReload=,
2812          * ExecStop=, ExecStopPost=, i.e. for the commands where the main process is already forked. For ExecStartPre=
2813          * this is not necessary, the cgroup is still empty. We distinguish these cases with the EXEC_CONTROL_CGROUP
2814          * flag, which is only passed for the former statements, not for the latter. */
2815
2816         using_subcgroup = FLAGS_SET(params->flags, EXEC_CONTROL_CGROUP|EXEC_CGROUP_DELEGATE|EXEC_IS_CONTROL);
2817         if (using_subcgroup)
2818                 p = strjoin(params->cgroup_path, "/.control");
2819         else
2820                 p = strdup(params->cgroup_path);
2821         if (!p)
2822                 return -ENOMEM;
2823
2824         *ret = p;
2825         return using_subcgroup;
2826 }
2827
2828 static int exec_child(
2829                 Unit *unit,
2830                 const ExecCommand *command,
2831                 const ExecContext *context,
2832                 const ExecParameters *params,
2833                 ExecRuntime *runtime,
2834                 DynamicCreds *dcreds,
2835                 int socket_fd,
2836                 int named_iofds[3],
2837                 int *fds,
2838                 size_t n_socket_fds,
2839                 size_t n_storage_fds,
2840                 char **files_env,
2841                 int user_lookup_fd,
2842                 int *exit_status) {
2843
2844         _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **accum_env = NULL, **final_argv = NULL;
2845         int *fds_with_exec_fd, n_fds_with_exec_fd, r, ngids = 0, exec_fd = -1;
2846         _cleanup_free_ gid_t *supplementary_gids = NULL;
2847         const char *username = NULL, *groupname = NULL;
2848         _cleanup_free_ char *home_buffer = NULL;
2849         const char *home = NULL, *shell = NULL;
2850         dev_t journal_stream_dev = 0;
2851         ino_t journal_stream_ino = 0;
2852         bool needs_sandboxing,          /* Do we need to set up full sandboxing? (i.e. all namespacing, all MAC stuff, caps, yadda yadda */
2853                 needs_setuid,           /* Do we need to do the actual setresuid()/setresgid() calls? */
2854                 needs_mount_namespace,  /* Do we need to set up a mount namespace for this kernel? */
2855                 needs_ambient_hack;     /* Do we need to apply the ambient capabilities hack? */
2856 #if HAVE_SELINUX
2857         _cleanup_free_ char *mac_selinux_context_net = NULL;
2858         bool use_selinux = false;
2859 #endif
2860 #if ENABLE_SMACK
2861         bool use_smack = false;
2862 #endif
2863 #if HAVE_APPARMOR
2864         bool use_apparmor = false;
2865 #endif
2866         uid_t uid = UID_INVALID;
2867         gid_t gid = GID_INVALID;
2868         size_t n_fds;
2869         ExecDirectoryType dt;
2870         int secure_bits;
2871
2872         assert(unit);
2873         assert(command);
2874         assert(context);
2875         assert(params);
2876         assert(exit_status);
2877
2878         rename_process_from_path(command->path);
2879
2880         /* We reset exactly these signals, since they are the
2881          * only ones we set to SIG_IGN in the main daemon. All
2882          * others we leave untouched because we set them to
2883          * SIG_DFL or a valid handler initially, both of which
2884          * will be demoted to SIG_DFL. */
2885         (void) default_signals(SIGNALS_CRASH_HANDLER,
2886                                SIGNALS_IGNORE, -1);
2887
2888         if (context->ignore_sigpipe)
2889                 (void) ignore_signals(SIGPIPE, -1);
2890
2891         r = reset_signal_mask();
2892         if (r < 0) {
2893                 *exit_status = EXIT_SIGNAL_MASK;
2894                 return log_unit_error_errno(unit, r, "Failed to set process signal mask: %m");
2895         }
2896
2897         if (params->idle_pipe)
2898                 do_idle_pipe_dance(params->idle_pipe);
2899
2900         /* Close fds we don't need very early to make sure we don't block init reexecution because it cannot bind its
2901          * sockets. Among the fds we close are the logging fds, and we want to keep them closed, so that we don't have
2902          * any fds open we don't really want open during the transition. In order to make logging work, we switch the
2903          * log subsystem into open_when_needed mode, so that it reopens the logs on every single log call. */
2904
2905         log_forget_fds();
2906         log_set_open_when_needed(true);
2907
2908         /* In case anything used libc syslog(), close this here, too */
2909         closelog();
2910
2911         n_fds = n_socket_fds + n_storage_fds;
2912         r = close_remaining_fds(params, runtime, dcreds, user_lookup_fd, socket_fd, params->exec_fd, fds, n_fds);
2913         if (r < 0) {
2914                 *exit_status = EXIT_FDS;
2915                 return log_unit_error_errno(unit, r, "Failed to close unwanted file descriptors: %m");
2916         }
2917
2918         if (!context->same_pgrp)
2919                 if (setsid() < 0) {
2920                         *exit_status = EXIT_SETSID;
2921                         return log_unit_error_errno(unit, errno, "Failed to create new process session: %m");
2922                 }
2923
2924         exec_context_tty_reset(context, params);
2925
2926         if (unit_shall_confirm_spawn(unit)) {
2927                 const char *vc = params->confirm_spawn;
2928                 _cleanup_free_ char *cmdline = NULL;
2929
2930                 cmdline = exec_command_line(command->argv);
2931                 if (!cmdline) {
2932                         *exit_status = EXIT_MEMORY;
2933                         return log_oom();
2934                 }
2935
2936                 r = ask_for_confirmation(vc, unit, cmdline);
2937                 if (r != CONFIRM_EXECUTE) {
2938                         if (r == CONFIRM_PRETEND_SUCCESS) {
2939                                 *exit_status = EXIT_SUCCESS;
2940                                 return 0;
2941                         }
2942                         *exit_status = EXIT_CONFIRM;
2943                         log_unit_error(unit, "Execution cancelled by the user");
2944                         return -ECANCELED;
2945                 }
2946         }
2947
2948         /* We are about to invoke NSS and PAM modules. Let's tell them what we are doing here, maybe they care. This is
2949          * used by nss-resolve to disable itself when we are about to start systemd-resolved, to avoid deadlocks. Note
2950          * that these env vars do not survive the execve(), which means they really only apply to the PAM and NSS
2951          * invocations themselves. Also note that while we'll only invoke NSS modules involved in user management they
2952          * might internally call into other NSS modules that are involved in hostname resolution, we never know. */
2953         if (setenv("SYSTEMD_ACTIVATION_UNIT", unit->id, true) != 0 ||
2954             setenv("SYSTEMD_ACTIVATION_SCOPE", MANAGER_IS_SYSTEM(unit->manager) ? "system" : "user", true) != 0) {
2955                 *exit_status = EXIT_MEMORY;
2956                 return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
2957         }
2958
2959         if (context->dynamic_user && dcreds) {
2960                 _cleanup_strv_free_ char **suggested_paths = NULL;
2961
2962                 /* On top of that, make sure we bypass our own NSS module nss-systemd comprehensively for any NSS
2963                  * checks, if DynamicUser=1 is used, as we shouldn't create a feedback loop with ourselves here.*/
2964                 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
2965                         *exit_status = EXIT_USER;
2966                         return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
2967                 }
2968
2969                 r = compile_suggested_paths(context, params, &suggested_paths);
2970                 if (r < 0) {
2971                         *exit_status = EXIT_MEMORY;
2972                         return log_oom();
2973                 }
2974
2975                 r = dynamic_creds_realize(dcreds, suggested_paths, &uid, &gid);
2976                 if (r < 0) {
2977                         *exit_status = EXIT_USER;
2978                         if (r == -EILSEQ) {
2979                                 log_unit_error(unit, "Failed to update dynamic user credentials: User or group with specified name already exists.");
2980                                 return -EOPNOTSUPP;
2981                         }
2982                         return log_unit_error_errno(unit, r, "Failed to update dynamic user credentials: %m");
2983                 }
2984
2985                 if (!uid_is_valid(uid)) {
2986                         *exit_status = EXIT_USER;
2987                         log_unit_error(unit, "UID validation failed for \""UID_FMT"\"", uid);
2988                         return -ESRCH;
2989                 }
2990
2991                 if (!gid_is_valid(gid)) {
2992                         *exit_status = EXIT_USER;
2993                         log_unit_error(unit, "GID validation failed for \""GID_FMT"\"", gid);
2994                         return -ESRCH;
2995                 }
2996
2997                 if (dcreds->user)
2998                         username = dcreds->user->name;
2999
3000         } else {
3001                 r = get_fixed_user(context, &username, &uid, &gid, &home, &shell);
3002                 if (r < 0) {
3003                         *exit_status = EXIT_USER;
3004                         return log_unit_error_errno(unit, r, "Failed to determine user credentials: %m");
3005                 }
3006
3007                 r = get_fixed_group(context, &groupname, &gid);
3008                 if (r < 0) {
3009                         *exit_status = EXIT_GROUP;
3010                         return log_unit_error_errno(unit, r, "Failed to determine group credentials: %m");
3011                 }
3012         }
3013
3014         /* Initialize user supplementary groups and get SupplementaryGroups= ones */
3015         r = get_supplementary_groups(context, username, groupname, gid,
3016                                      &supplementary_gids, &ngids);
3017         if (r < 0) {
3018                 *exit_status = EXIT_GROUP;
3019                 return log_unit_error_errno(unit, r, "Failed to determine supplementary groups: %m");
3020         }
3021
3022         r = send_user_lookup(unit, user_lookup_fd, uid, gid);
3023         if (r < 0) {
3024                 *exit_status = EXIT_USER;
3025                 return log_unit_error_errno(unit, r, "Failed to send user credentials to PID1: %m");
3026         }
3027
3028         user_lookup_fd = safe_close(user_lookup_fd);
3029
3030         r = acquire_home(context, uid, &home, &home_buffer);
3031         if (r < 0) {
3032                 *exit_status = EXIT_CHDIR;
3033                 return log_unit_error_errno(unit, r, "Failed to determine $HOME for user: %m");
3034         }
3035
3036         /* If a socket is connected to STDIN/STDOUT/STDERR, we
3037          * must sure to drop O_NONBLOCK */
3038         if (socket_fd >= 0)
3039                 (void) fd_nonblock(socket_fd, false);
3040
3041         /* Journald will try to look-up our cgroup in order to populate _SYSTEMD_CGROUP and _SYSTEMD_UNIT fields.
3042          * Hence we need to migrate to the target cgroup from init.scope before connecting to journald */
3043         if (params->cgroup_path) {
3044                 _cleanup_free_ char *p = NULL;
3045
3046                 r = exec_parameters_get_cgroup_path(params, &p);
3047                 if (r < 0) {
3048                         *exit_status = EXIT_CGROUP;
3049                         return log_unit_error_errno(unit, r, "Failed to acquire cgroup path: %m");
3050                 }
3051
3052                 r = cg_attach_everywhere(params->cgroup_supported, p, 0, NULL, NULL);
3053                 if (r < 0) {
3054                         *exit_status = EXIT_CGROUP;
3055                         return log_unit_error_errno(unit, r, "Failed to attach to cgroup %s: %m", p);
3056                 }
3057         }
3058
3059         r = setup_input(context, params, socket_fd, named_iofds);
3060         if (r < 0) {
3061                 *exit_status = EXIT_STDIN;
3062                 return log_unit_error_errno(unit, r, "Failed to set up standard input: %m");
3063         }
3064
3065         r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
3066         if (r < 0) {
3067                 *exit_status = EXIT_STDOUT;
3068                 return log_unit_error_errno(unit, r, "Failed to set up standard output: %m");
3069         }
3070
3071         r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
3072         if (r < 0) {
3073                 *exit_status = EXIT_STDERR;
3074                 return log_unit_error_errno(unit, r, "Failed to set up standard error output: %m");
3075         }
3076
3077         if (context->oom_score_adjust_set) {
3078                 /* When we can't make this change due to EPERM, then let's silently skip over it. User namespaces
3079                  * prohibit write access to this file, and we shouldn't trip up over that. */
3080                 r = set_oom_score_adjust(context->oom_score_adjust);
3081                 if (IN_SET(r, -EPERM, -EACCES))
3082                         log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
3083                 else if (r < 0) {
3084                         *exit_status = EXIT_OOM_ADJUST;
3085                         return log_unit_error_errno(unit, r, "Failed to adjust OOM setting: %m");
3086                 }
3087         }
3088
3089         if (context->nice_set)
3090                 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
3091                         *exit_status = EXIT_NICE;
3092                         return log_unit_error_errno(unit, errno, "Failed to set up process scheduling priority (nice level): %m");
3093                 }
3094
3095         if (context->cpu_sched_set) {
3096                 struct sched_param param = {
3097                         .sched_priority = context->cpu_sched_priority,
3098                 };
3099
3100                 r = sched_setscheduler(0,
3101                                        context->cpu_sched_policy |
3102                                        (context->cpu_sched_reset_on_fork ?
3103                                         SCHED_RESET_ON_FORK : 0),
3104                                        &param);
3105                 if (r < 0) {
3106                         *exit_status = EXIT_SETSCHEDULER;
3107                         return log_unit_error_errno(unit, errno, "Failed to set up CPU scheduling: %m");
3108                 }
3109         }
3110
3111         if (context->cpuset)
3112                 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
3113                         *exit_status = EXIT_CPUAFFINITY;
3114                         return log_unit_error_errno(unit, errno, "Failed to set up CPU affinity: %m");
3115                 }
3116
3117         if (context->ioprio_set)
3118                 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
3119                         *exit_status = EXIT_IOPRIO;
3120                         return log_unit_error_errno(unit, errno, "Failed to set up IO scheduling priority: %m");
3121                 }
3122
3123         if (context->timer_slack_nsec != NSEC_INFINITY)
3124                 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
3125                         *exit_status = EXIT_TIMERSLACK;
3126                         return log_unit_error_errno(unit, errno, "Failed to set up timer slack: %m");
3127                 }
3128
3129         if (context->personality != PERSONALITY_INVALID) {
3130                 r = safe_personality(context->personality);
3131                 if (r < 0) {
3132                         *exit_status = EXIT_PERSONALITY;
3133                         return log_unit_error_errno(unit, r, "Failed to set up execution domain (personality): %m");
3134                 }
3135         }
3136
3137         if (context->utmp_id)
3138                 utmp_put_init_process(context->utmp_id, getpid_cached(), getsid(0),
3139                                       context->tty_path,
3140                                       context->utmp_mode == EXEC_UTMP_INIT  ? INIT_PROCESS :
3141                                       context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
3142                                       USER_PROCESS,
3143                                       username);
3144
3145         if (context->user) {
3146                 r = chown_terminal(STDIN_FILENO, uid);
3147                 if (r < 0) {
3148                         *exit_status = EXIT_STDIN;
3149                         return log_unit_error_errno(unit, r, "Failed to change ownership of terminal: %m");
3150                 }
3151         }
3152
3153         /* If delegation is enabled we'll pass ownership of the cgroup to the user of the new process. On cgroup v1
3154          * this is only about systemd's own hierarchy, i.e. not the controller hierarchies, simply because that's not
3155          * safe. On cgroup v2 there's only one hierarchy anyway, and delegation is safe there, hence in that case only
3156          * touch a single hierarchy too. */
3157         if (params->cgroup_path && context->user && (params->flags & EXEC_CGROUP_DELEGATE)) {
3158                 r = cg_set_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, uid, gid);
3159                 if (r < 0) {
3160                         *exit_status = EXIT_CGROUP;
3161                         return log_unit_error_errno(unit, r, "Failed to adjust control group access: %m");
3162                 }
3163         }
3164
3165         for (dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
3166                 r = setup_exec_directory(context, params, uid, gid, dt, exit_status);
3167                 if (r < 0)
3168                         return log_unit_error_errno(unit, r, "Failed to set up special execution directory in %s: %m", params->prefix[dt]);
3169         }
3170
3171         r = build_environment(
3172                         unit,
3173                         context,
3174                         params,
3175                         n_fds,
3176                         home,
3177                         username,
3178                         shell,
3179                         journal_stream_dev,
3180                         journal_stream_ino,
3181                         &our_env);
3182         if (r < 0) {
3183                 *exit_status = EXIT_MEMORY;
3184                 return log_oom();
3185         }
3186
3187         r = build_pass_environment(context, &pass_env);
3188         if (r < 0) {
3189                 *exit_status = EXIT_MEMORY;
3190                 return log_oom();
3191         }
3192
3193         accum_env = strv_env_merge(5,
3194                                    params->environment,
3195                                    our_env,
3196                                    pass_env,
3197                                    context->environment,
3198                                    files_env,
3199                                    NULL);
3200         if (!accum_env) {
3201                 *exit_status = EXIT_MEMORY;
3202                 return log_oom();
3203         }
3204         accum_env = strv_env_clean(accum_env);
3205
3206         (void) umask(context->umask);
3207
3208         r = setup_keyring(unit, context, params, uid, gid);
3209         if (r < 0) {
3210                 *exit_status = EXIT_KEYRING;
3211                 return log_unit_error_errno(unit, r, "Failed to set up kernel keyring: %m");
3212         }
3213
3214         /* We need sandboxing if the caller asked us to apply it and the command isn't explicitly excepted from it */
3215         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
3216
3217         /* We need the ambient capability hack, if the caller asked us to apply it and the command is marked for it, and the kernel doesn't actually support ambient caps */
3218         needs_ambient_hack = (params->flags & EXEC_APPLY_SANDBOXING) && (command->flags & EXEC_COMMAND_AMBIENT_MAGIC) && !ambient_capabilities_supported();
3219
3220         /* We need setresuid() if the caller asked us to apply sandboxing and the command isn't explicitly excepted from either whole sandboxing or just setresuid() itself, and the ambient hack is not desired */
3221         if (needs_ambient_hack)
3222                 needs_setuid = false;
3223         else
3224                 needs_setuid = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & (EXEC_COMMAND_FULLY_PRIVILEGED|EXEC_COMMAND_NO_SETUID));
3225
3226         if (needs_sandboxing) {
3227                 /* MAC enablement checks need to be done before a new mount ns is created, as they rely on /sys being
3228                  * present. The actual MAC context application will happen later, as late as possible, to avoid
3229                  * impacting our own code paths. */
3230
3231 #if HAVE_SELINUX
3232                 use_selinux = mac_selinux_use();
3233 #endif
3234 #if ENABLE_SMACK
3235                 use_smack = mac_smack_use();
3236 #endif
3237 #if HAVE_APPARMOR
3238                 use_apparmor = mac_apparmor_use();
3239 #endif
3240         }
3241
3242         if (needs_sandboxing) {
3243                 int which_failed;
3244
3245                 /* Let's set the resource limits before we call into PAM, so that pam_limits wins over what
3246                  * is set here. (See below.) */
3247
3248                 r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
3249                 if (r < 0) {
3250                         *exit_status = EXIT_LIMITS;
3251                         return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3252                 }
3253         }
3254
3255         if (needs_setuid) {
3256
3257                 /* Let's call into PAM after we set up our own idea of resource limits to that pam_limits
3258                  * wins here. (See above.) */
3259
3260                 if (context->pam_name && username) {
3261                         r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
3262                         if (r < 0) {
3263                                 *exit_status = EXIT_PAM;
3264                                 return log_unit_error_errno(unit, r, "Failed to set up PAM session: %m");
3265                         }
3266                 }
3267         }
3268
3269         if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
3270                 if (ns_type_supported(NAMESPACE_NET)) {
3271                         r = setup_netns(runtime->netns_storage_socket);
3272                         if (r < 0) {
3273                                 *exit_status = EXIT_NETWORK;
3274                                 return log_unit_error_errno(unit, r, "Failed to set up network namespacing: %m");
3275                         }
3276                 } else
3277                         log_unit_warning(unit, "PrivateNetwork=yes is configured, but the kernel does not support network namespaces, ignoring.");
3278         }
3279
3280         needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
3281         if (needs_mount_namespace) {
3282                 r = apply_mount_namespace(unit, command, context, params, runtime);
3283                 if (r < 0) {
3284                         *exit_status = EXIT_NAMESPACE;
3285                         return log_unit_error_errno(unit, r, "Failed to set up mount namespacing: %m");
3286                 }
3287         }
3288
3289         /* Drop groups as early as possbile */
3290         if (needs_setuid) {
3291                 r = enforce_groups(gid, supplementary_gids, ngids);
3292                 if (r < 0) {
3293                         *exit_status = EXIT_GROUP;
3294                         return log_unit_error_errno(unit, r, "Changing group credentials failed: %m");
3295                 }
3296         }
3297
3298         if (needs_sandboxing) {
3299 #if HAVE_SELINUX
3300                 if (use_selinux && params->selinux_context_net && socket_fd >= 0) {
3301                         r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
3302                         if (r < 0) {
3303                                 *exit_status = EXIT_SELINUX_CONTEXT;
3304                                 return log_unit_error_errno(unit, r, "Failed to determine SELinux context: %m");
3305                         }
3306                 }
3307 #endif
3308
3309                 if (context->private_users) {
3310                         r = setup_private_users(uid, gid);
3311                         if (r < 0) {
3312                                 *exit_status = EXIT_USER;
3313                                 return log_unit_error_errno(unit, r, "Failed to set up user namespacing: %m");
3314                         }
3315                 }
3316         }
3317
3318         /* We repeat the fd closing here, to make sure that nothing is leaked from the PAM modules. Note that we are
3319          * more aggressive this time since socket_fd and the netns fds we don't need anymore. We do keep the exec_fd
3320          * however if we have it as we want to keep it open until the final execve(). */
3321
3322         if (params->exec_fd >= 0) {
3323                 exec_fd = params->exec_fd;
3324
3325                 if (exec_fd < 3 + (int) n_fds) {
3326                         int moved_fd;
3327
3328                         /* Let's move the exec fd far up, so that it's outside of the fd range we want to pass to the
3329                          * process we are about to execute. */
3330
3331                         moved_fd = fcntl(exec_fd, F_DUPFD_CLOEXEC, 3 + (int) n_fds);
3332                         if (moved_fd < 0) {
3333                                 *exit_status = EXIT_FDS;
3334                                 return log_unit_error_errno(unit, errno, "Couldn't move exec fd up: %m");
3335                         }
3336
3337                         safe_close(exec_fd);
3338                         exec_fd = moved_fd;
3339                 } else {
3340                         /* This fd should be FD_CLOEXEC already, but let's make sure. */
3341                         r = fd_cloexec(exec_fd, true);
3342                         if (r < 0) {
3343                                 *exit_status = EXIT_FDS;
3344                                 return log_unit_error_errno(unit, r, "Failed to make exec fd FD_CLOEXEC: %m");
3345                         }
3346                 }
3347
3348                 fds_with_exec_fd = newa(int, n_fds + 1);
3349                 memcpy_safe(fds_with_exec_fd, fds, n_fds * sizeof(int));
3350                 fds_with_exec_fd[n_fds] = exec_fd;
3351                 n_fds_with_exec_fd = n_fds + 1;
3352         } else {
3353                 fds_with_exec_fd = fds;
3354                 n_fds_with_exec_fd = n_fds;
3355         }
3356
3357         r = close_all_fds(fds_with_exec_fd, n_fds_with_exec_fd);
3358         if (r >= 0)
3359                 r = shift_fds(fds, n_fds);
3360         if (r >= 0)
3361                 r = flags_fds(fds, n_socket_fds, n_storage_fds, context->non_blocking);
3362         if (r < 0) {
3363                 *exit_status = EXIT_FDS;
3364                 return log_unit_error_errno(unit, r, "Failed to adjust passed file descriptors: %m");
3365         }
3366
3367         /* At this point, the fds we want to pass to the program are all ready and set up, with O_CLOEXEC turned off
3368          * and at the right fd numbers. The are no other fds open, with one exception: the exec_fd if it is defined,
3369          * and it has O_CLOEXEC set, after all we want it to be closed by the execve(), so that our parent knows we
3370          * came this far. */
3371
3372         secure_bits = context->secure_bits;
3373
3374         if (needs_sandboxing) {
3375                 uint64_t bset;
3376
3377                 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly
3378                  * requested. (Note this is placed after the general resource limit initialization, see
3379                  * above, in order to take precedence.) */
3380                 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
3381                         if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
3382                                 *exit_status = EXIT_LIMITS;
3383                                 return log_unit_error_errno(unit, errno, "Failed to adjust RLIMIT_RTPRIO resource limit: %m");
3384                         }
3385                 }
3386
3387 #if ENABLE_SMACK
3388                 /* LSM Smack needs the capability CAP_MAC_ADMIN to change the current execution security context of the
3389                  * process. This is the latest place before dropping capabilities. Other MAC context are set later. */
3390                 if (use_smack) {
3391                         r = setup_smack(context, command);
3392                         if (r < 0) {
3393                                 *exit_status = EXIT_SMACK_PROCESS_LABEL;
3394                                 return log_unit_error_errno(unit, r, "Failed to set SMACK process label: %m");
3395                         }
3396                 }
3397 #endif
3398
3399                 bset = context->capability_bounding_set;
3400                 /* If the ambient caps hack is enabled (which means the kernel can't do them, and the user asked for
3401                  * our magic fallback), then let's add some extra caps, so that the service can drop privs of its own,
3402                  * instead of us doing that */
3403                 if (needs_ambient_hack)
3404                         bset |= (UINT64_C(1) << CAP_SETPCAP) |
3405                                 (UINT64_C(1) << CAP_SETUID) |
3406                                 (UINT64_C(1) << CAP_SETGID);
3407
3408                 if (!cap_test_all(bset)) {
3409                         r = capability_bounding_set_drop(bset, false);
3410                         if (r < 0) {
3411                                 *exit_status = EXIT_CAPABILITIES;
3412                                 return log_unit_error_errno(unit, r, "Failed to drop capabilities: %m");
3413                         }
3414                 }
3415
3416                 /* This is done before enforce_user, but ambient set
3417                  * does not survive over setresuid() if keep_caps is not set. */
3418                 if (!needs_ambient_hack &&
3419                     context->capability_ambient_set != 0) {
3420                         r = capability_ambient_set_apply(context->capability_ambient_set, true);
3421                         if (r < 0) {
3422                                 *exit_status = EXIT_CAPABILITIES;
3423                                 return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (before UID change): %m");
3424                         }
3425                 }
3426         }
3427
3428         if (needs_setuid) {
3429                 if (context->user) {
3430                         r = enforce_user(context, uid);
3431                         if (r < 0) {
3432                                 *exit_status = EXIT_USER;
3433                                 return log_unit_error_errno(unit, r, "Failed to change UID to " UID_FMT ": %m", uid);
3434                         }
3435
3436                         if (!needs_ambient_hack &&
3437                             context->capability_ambient_set != 0) {
3438
3439                                 /* Fix the ambient capabilities after user change. */
3440                                 r = capability_ambient_set_apply(context->capability_ambient_set, false);
3441                                 if (r < 0) {
3442                                         *exit_status = EXIT_CAPABILITIES;
3443                                         return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (after UID change): %m");
3444                                 }
3445
3446                                 /* If we were asked to change user and ambient capabilities
3447                                  * were requested, we had to add keep-caps to the securebits
3448                                  * so that we would maintain the inherited capability set
3449                                  * through the setresuid(). Make sure that the bit is added
3450                                  * also to the context secure_bits so that we don't try to
3451                                  * drop the bit away next. */
3452
3453                                 secure_bits |= 1<<SECURE_KEEP_CAPS;
3454                         }
3455                 }
3456         }
3457
3458         /* Apply working directory here, because the working directory might be on NFS and only the user running
3459          * this service might have the correct privilege to change to the working directory */
3460         r = apply_working_directory(context, params, home, needs_mount_namespace, exit_status);
3461         if (r < 0)
3462                 return log_unit_error_errno(unit, r, "Changing to the requested working directory failed: %m");
3463
3464         if (needs_sandboxing) {
3465                 /* Apply other MAC contexts late, but before seccomp syscall filtering, as those should really be last to
3466                  * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires
3467                  * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls
3468                  * are restricted. */
3469
3470 #if HAVE_SELINUX
3471                 if (use_selinux) {
3472                         char *exec_context = mac_selinux_context_net ?: context->selinux_context;
3473
3474                         if (exec_context) {
3475                                 r = setexeccon(exec_context);
3476                                 if (r < 0) {
3477                                         *exit_status = EXIT_SELINUX_CONTEXT;
3478                                         return log_unit_error_errno(unit, r, "Failed to change SELinux context to %s: %m", exec_context);
3479                                 }
3480                         }
3481                 }
3482 #endif
3483
3484 #if HAVE_APPARMOR
3485                 if (use_apparmor && context->apparmor_profile) {
3486                         r = aa_change_onexec(context->apparmor_profile);
3487                         if (r < 0 && !context->apparmor_profile_ignore) {
3488                                 *exit_status = EXIT_APPARMOR_PROFILE;
3489                                 return log_unit_error_errno(unit, errno, "Failed to prepare AppArmor profile change to %s: %m", context->apparmor_profile);
3490                         }
3491                 }
3492 #endif
3493
3494                 /* PR_GET_SECUREBITS is not privileged, while PR_SET_SECUREBITS is. So to suppress potential EPERMs
3495                  * we'll try not to call PR_SET_SECUREBITS unless necessary. */
3496                 if (prctl(PR_GET_SECUREBITS) != secure_bits)
3497                         if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
3498                                 *exit_status = EXIT_SECUREBITS;
3499                                 return log_unit_error_errno(unit, errno, "Failed to set process secure bits: %m");
3500                         }
3501
3502                 if (context_has_no_new_privileges(context))
3503                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
3504                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
3505                                 return log_unit_error_errno(unit, errno, "Failed to disable new privileges: %m");
3506                         }
3507
3508 #if HAVE_SECCOMP
3509                 r = apply_address_families(unit, context);
3510                 if (r < 0) {
3511                         *exit_status = EXIT_ADDRESS_FAMILIES;
3512                         return log_unit_error_errno(unit, r, "Failed to restrict address families: %m");
3513                 }
3514
3515                 r = apply_memory_deny_write_execute(unit, context);
3516                 if (r < 0) {
3517                         *exit_status = EXIT_SECCOMP;
3518                         return log_unit_error_errno(unit, r, "Failed to disable writing to executable memory: %m");
3519                 }
3520
3521                 r = apply_restrict_realtime(unit, context);
3522                 if (r < 0) {
3523                         *exit_status = EXIT_SECCOMP;
3524                         return log_unit_error_errno(unit, r, "Failed to apply realtime restrictions: %m");
3525                 }
3526
3527                 r = apply_restrict_namespaces(unit, context);
3528                 if (r < 0) {
3529                         *exit_status = EXIT_SECCOMP;
3530                         return log_unit_error_errno(unit, r, "Failed to apply namespace restrictions: %m");
3531                 }
3532
3533                 r = apply_protect_sysctl(unit, context);
3534                 if (r < 0) {
3535                         *exit_status = EXIT_SECCOMP;
3536                         return log_unit_error_errno(unit, r, "Failed to apply sysctl restrictions: %m");
3537                 }
3538
3539                 r = apply_protect_kernel_modules(unit, context);
3540                 if (r < 0) {
3541                         *exit_status = EXIT_SECCOMP;
3542                         return log_unit_error_errno(unit, r, "Failed to apply module loading restrictions: %m");
3543                 }
3544
3545                 r = apply_private_devices(unit, context);
3546                 if (r < 0) {
3547                         *exit_status = EXIT_SECCOMP;
3548                         return log_unit_error_errno(unit, r, "Failed to set up private devices: %m");
3549                 }
3550
3551                 r = apply_syscall_archs(unit, context);
3552                 if (r < 0) {
3553                         *exit_status = EXIT_SECCOMP;
3554                         return log_unit_error_errno(unit, r, "Failed to apply syscall architecture restrictions: %m");
3555                 }
3556
3557                 r = apply_lock_personality(unit, context);
3558                 if (r < 0) {
3559                         *exit_status = EXIT_SECCOMP;
3560                         return log_unit_error_errno(unit, r, "Failed to lock personalities: %m");
3561                 }
3562
3563                 /* This really should remain the last step before the execve(), to make sure our own code is unaffected
3564                  * by the filter as little as possible. */
3565                 r = apply_syscall_filter(unit, context, needs_ambient_hack);
3566                 if (r < 0) {
3567                         *exit_status = EXIT_SECCOMP;
3568                         return log_unit_error_errno(unit, r, "Failed to apply system call filters: %m");
3569                 }
3570 #endif
3571         }
3572
3573         if (!strv_isempty(context->unset_environment)) {
3574                 char **ee = NULL;
3575
3576                 ee = strv_env_delete(accum_env, 1, context->unset_environment);
3577                 if (!ee) {
3578                         *exit_status = EXIT_MEMORY;
3579                         return log_oom();
3580                 }
3581
3582                 strv_free_and_replace(accum_env, ee);
3583         }
3584
3585         final_argv = replace_env_argv(command->argv, accum_env);
3586         if (!final_argv) {
3587                 *exit_status = EXIT_MEMORY;
3588                 return log_oom();
3589         }
3590
3591         if (DEBUG_LOGGING) {
3592                 _cleanup_free_ char *line;
3593
3594                 line = exec_command_line(final_argv);
3595                 if (line)
3596                         log_struct(LOG_DEBUG,
3597                                    "EXECUTABLE=%s", command->path,
3598                                    LOG_UNIT_MESSAGE(unit, "Executing: %s", line),
3599                                    LOG_UNIT_ID(unit),
3600                                    LOG_UNIT_INVOCATION_ID(unit));
3601         }
3602
3603         if (exec_fd >= 0) {
3604                 uint8_t hot = 1;
3605
3606                 /* We have finished with all our initializations. Let's now let the manager know that. From this point
3607                  * on, if the manager sees POLLHUP on the exec_fd, then execve() was successful. */
3608
3609                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
3610                         *exit_status = EXIT_EXEC;
3611                         return log_unit_error_errno(unit, errno, "Failed to enable exec_fd: %m");
3612                 }
3613         }
3614
3615         execve(command->path, final_argv, accum_env);
3616         r = -errno;
3617
3618         if (exec_fd >= 0) {
3619                 uint8_t hot = 0;
3620
3621                 /* The execve() failed. This means the exec_fd is still open. Which means we need to tell the manager
3622                  * that POLLHUP on it no longer means execve() succeeded. */
3623
3624                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
3625                         *exit_status = EXIT_EXEC;
3626                         return log_unit_error_errno(unit, errno, "Failed to disable exec_fd: %m");
3627                 }
3628         }
3629
3630         if (r == -ENOENT && (command->flags & EXEC_COMMAND_IGNORE_FAILURE)) {
3631                 log_struct_errno(LOG_INFO, r,
3632                                  "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
3633                                  LOG_UNIT_ID(unit),
3634                                  LOG_UNIT_INVOCATION_ID(unit),
3635                                  LOG_UNIT_MESSAGE(unit, "Executable %s missing, skipping: %m",
3636                                                   command->path),
3637                                  "EXECUTABLE=%s", command->path);
3638                 return 0;
3639         }
3640
3641         *exit_status = EXIT_EXEC;
3642         return log_unit_error_errno(unit, r, "Failed to execute command: %m");
3643 }
3644
3645 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l);
3646 static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[3]);
3647
3648 int exec_spawn(Unit *unit,
3649                ExecCommand *command,
3650                const ExecContext *context,
3651                const ExecParameters *params,
3652                ExecRuntime *runtime,
3653                DynamicCreds *dcreds,
3654                pid_t *ret) {
3655
3656         int socket_fd, r, named_iofds[3] = { -1, -1, -1 }, *fds = NULL;
3657         _cleanup_free_ char *subcgroup_path = NULL;
3658         _cleanup_strv_free_ char **files_env = NULL;
3659         size_t n_storage_fds = 0, n_socket_fds = 0;
3660         _cleanup_free_ char *line = NULL;
3661         pid_t pid;
3662
3663         assert(unit);
3664         assert(command);
3665         assert(context);
3666         assert(ret);
3667         assert(params);
3668         assert(params->fds || (params->n_socket_fds + params->n_storage_fds <= 0));
3669
3670         if (context->std_input == EXEC_INPUT_SOCKET ||
3671             context->std_output == EXEC_OUTPUT_SOCKET ||
3672             context->std_error == EXEC_OUTPUT_SOCKET) {
3673
3674                 if (params->n_socket_fds > 1) {
3675                         log_unit_error(unit, "Got more than one socket.");
3676                         return -EINVAL;
3677                 }
3678
3679                 if (params->n_socket_fds == 0) {
3680                         log_unit_error(unit, "Got no socket.");
3681                         return -EINVAL;
3682                 }
3683
3684                 socket_fd = params->fds[0];
3685         } else {
3686                 socket_fd = -1;
3687                 fds = params->fds;
3688                 n_socket_fds = params->n_socket_fds;
3689                 n_storage_fds = params->n_storage_fds;
3690         }
3691
3692         r = exec_context_named_iofds(context, params, named_iofds);
3693         if (r < 0)
3694                 return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m");
3695
3696         r = exec_context_load_environment(unit, context, &files_env);
3697         if (r < 0)
3698                 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
3699
3700         line = exec_command_line(command->argv);
3701         if (!line)
3702                 return log_oom();
3703
3704         log_struct(LOG_DEBUG,
3705                    LOG_UNIT_MESSAGE(unit, "About to execute: %s", line),
3706                    "EXECUTABLE=%s", command->path,
3707                    LOG_UNIT_ID(unit),
3708                    LOG_UNIT_INVOCATION_ID(unit));
3709
3710         if (params->cgroup_path) {
3711                 r = exec_parameters_get_cgroup_path(params, &subcgroup_path);
3712                 if (r < 0)
3713                         return log_unit_error_errno(unit, r, "Failed to acquire subcgroup path: %m");
3714                 if (r > 0) { /* We are using a child cgroup */
3715                         r = cg_create(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path);
3716                         if (r < 0)
3717                                 return log_unit_error_errno(unit, r, "Failed to create control group '%s': %m", subcgroup_path);
3718                 }
3719         }
3720
3721         pid = fork();
3722         if (pid < 0)
3723                 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
3724
3725         if (pid == 0) {
3726                 int exit_status = EXIT_SUCCESS;
3727
3728                 r = exec_child(unit,
3729                                command,
3730                                context,
3731                                params,
3732                                runtime,
3733                                dcreds,
3734                                socket_fd,
3735                                named_iofds,
3736                                fds,
3737                                n_socket_fds,
3738                                n_storage_fds,
3739                                files_env,
3740                                unit->manager->user_lookup_fds[1],
3741                                &exit_status);
3742
3743                 if (r < 0)
3744                         log_struct_errno(LOG_ERR, r,
3745                                          "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
3746                                          LOG_UNIT_ID(unit),
3747                                          LOG_UNIT_INVOCATION_ID(unit),
3748                                          LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
3749                                                           exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
3750                                                           command->path),
3751                                          "EXECUTABLE=%s", command->path);
3752
3753                 _exit(exit_status);
3754         }
3755
3756         log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
3757
3758         /* We add the new process to the cgroup both in the child (so that we can be sure that no user code is ever
3759          * executed outside of the cgroup) and in the parent (so that we can be sure that when we kill the cgroup the
3760          * process will be killed too). */
3761         if (subcgroup_path)
3762                 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path, pid);
3763
3764         exec_status_start(&command->exec_status, pid);
3765
3766         *ret = pid;
3767         return 0;
3768 }
3769
3770 void exec_context_init(ExecContext *c) {
3771         ExecDirectoryType i;
3772
3773         assert(c);
3774
3775         c->umask = 0022;
3776         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
3777         c->cpu_sched_policy = SCHED_OTHER;
3778         c->syslog_priority = LOG_DAEMON|LOG_INFO;
3779         c->syslog_level_prefix = true;
3780         c->ignore_sigpipe = true;
3781         c->timer_slack_nsec = NSEC_INFINITY;
3782         c->personality = PERSONALITY_INVALID;
3783         for (i = 0; i < _EXEC_DIRECTORY_TYPE_MAX; i++)
3784                 c->directories[i].mode = 0755;
3785         c->capability_bounding_set = CAP_ALL;
3786         assert_cc(NAMESPACE_FLAGS_INITIAL != NAMESPACE_FLAGS_ALL);
3787         c->restrict_namespaces = NAMESPACE_FLAGS_INITIAL;
3788         c->log_level_max = -1;
3789 }
3790
3791 void exec_context_done(ExecContext *c) {
3792         ExecDirectoryType i;
3793         size_t l;
3794
3795         assert(c);
3796
3797         c->environment = strv_free(c->environment);
3798         c->environment_files = strv_free(c->environment_files);
3799         c->pass_environment = strv_free(c->pass_environment);
3800         c->unset_environment = strv_free(c->unset_environment);
3801
3802         rlimit_free_all(c->rlimit);
3803
3804         for (l = 0; l < 3; l++) {
3805                 c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);
3806                 c->stdio_file[l] = mfree(c->stdio_file[l]);
3807         }
3808
3809         c->working_directory = mfree(c->working_directory);
3810         c->root_directory = mfree(c->root_directory);
3811         c->root_image = mfree(c->root_image);
3812         c->tty_path = mfree(c->tty_path);
3813         c->syslog_identifier = mfree(c->syslog_identifier);
3814         c->user = mfree(c->user);
3815         c->group = mfree(c->group);
3816
3817         c->supplementary_groups = strv_free(c->supplementary_groups);
3818
3819         c->pam_name = mfree(c->pam_name);
3820
3821         c->read_only_paths = strv_free(c->read_only_paths);
3822         c->read_write_paths = strv_free(c->read_write_paths);
3823         c->inaccessible_paths = strv_free(c->inaccessible_paths);
3824
3825         bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
3826         c->bind_mounts = NULL;
3827         c->n_bind_mounts = 0;
3828         temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);
3829         c->temporary_filesystems = NULL;
3830         c->n_temporary_filesystems = 0;
3831
3832         c->cpuset = cpu_set_mfree(c->cpuset);
3833
3834         c->utmp_id = mfree(c->utmp_id);
3835         c->selinux_context = mfree(c->selinux_context);
3836         c->apparmor_profile = mfree(c->apparmor_profile);
3837         c->smack_process_label = mfree(c->smack_process_label);
3838
3839         c->syscall_filter = hashmap_free(c->syscall_filter);
3840         c->syscall_archs = set_free(c->syscall_archs);
3841         c->address_families = set_free(c->address_families);
3842
3843         for (i = 0; i < _EXEC_DIRECTORY_TYPE_MAX; i++)
3844                 c->directories[i].paths = strv_free(c->directories[i].paths);
3845
3846         c->log_level_max = -1;
3847
3848         exec_context_free_log_extra_fields(c);
3849
3850         c->log_rate_limit_interval_usec = 0;
3851         c->log_rate_limit_burst = 0;
3852
3853         c->stdin_data = mfree(c->stdin_data);
3854         c->stdin_data_size = 0;
3855 }
3856
3857 int exec_context_destroy_runtime_directory(const ExecContext *c, const char *runtime_prefix) {
3858         char **i;
3859
3860         assert(c);
3861
3862         if (!runtime_prefix)
3863                 return 0;
3864
3865         STRV_FOREACH(i, c->directories[EXEC_DIRECTORY_RUNTIME].paths) {
3866                 _cleanup_free_ char *p;
3867
3868                 p = strjoin(runtime_prefix, "/", *i);
3869                 if (!p)
3870                         return -ENOMEM;
3871
3872                 /* We execute this synchronously, since we need to be sure this is gone when we start the service
3873                  * next. */
3874                 (void) rm_rf(p, REMOVE_ROOT);
3875         }
3876
3877         return 0;
3878 }
3879
3880 static void exec_command_done(ExecCommand *c) {
3881         assert(c);
3882
3883         c->path = mfree(c->path);
3884         c->argv = strv_free(c->argv);
3885 }
3886
3887 void exec_command_done_array(ExecCommand *c, size_t n) {
3888         size_t i;
3889
3890         for (i = 0; i < n; i++)
3891                 exec_command_done(c+i);
3892 }
3893
3894 ExecCommand* exec_command_free_list(ExecCommand *c) {
3895         ExecCommand *i;
3896
3897         while ((i = c)) {
3898                 LIST_REMOVE(command, c, i);
3899                 exec_command_done(i);
3900                 free(i);
3901         }
3902
3903         return NULL;
3904 }
3905
3906 void exec_command_free_array(ExecCommand **c, size_t n) {
3907         size_t i;
3908
3909         for (i = 0; i < n; i++)
3910                 c[i] = exec_command_free_list(c[i]);
3911 }
3912
3913 void exec_command_reset_status_array(ExecCommand *c, size_t n) {
3914         size_t i;
3915
3916         for (i = 0; i < n; i++)
3917                 exec_status_reset(&c[i].exec_status);
3918 }
3919
3920 void exec_command_reset_status_list_array(ExecCommand **c, size_t n) {
3921         size_t i;
3922
3923         for (i = 0; i < n; i++) {
3924                 ExecCommand *z;
3925
3926                 LIST_FOREACH(command, z, c[i])
3927                         exec_status_reset(&z->exec_status);
3928         }
3929 }
3930
3931 typedef struct InvalidEnvInfo {
3932         const Unit *unit;
3933         const char *path;
3934 } InvalidEnvInfo;
3935
3936 static void invalid_env(const char *p, void *userdata) {
3937         InvalidEnvInfo *info = userdata;
3938
3939         log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
3940 }
3941
3942 const char* exec_context_fdname(const ExecContext *c, int fd_index) {
3943         assert(c);
3944
3945         switch (fd_index) {
3946
3947         case STDIN_FILENO:
3948                 if (c->std_input != EXEC_INPUT_NAMED_FD)
3949                         return NULL;
3950
3951                 return c->stdio_fdname[STDIN_FILENO] ?: "stdin";
3952
3953         case STDOUT_FILENO:
3954                 if (c->std_output != EXEC_OUTPUT_NAMED_FD)
3955                         return NULL;
3956
3957                 return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";
3958
3959         case STDERR_FILENO:
3960                 if (c->std_error != EXEC_OUTPUT_NAMED_FD)
3961                         return NULL;
3962
3963                 return c->stdio_fdname[STDERR_FILENO] ?: "stderr";
3964
3965         default:
3966                 return NULL;
3967         }
3968 }
3969
3970 static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[static 3]) {
3971         size_t i, targets;
3972         const char* stdio_fdname[3];
3973         size_t n_fds;
3974
3975         assert(c);
3976         assert(p);
3977
3978         targets = (c->std_input == EXEC_INPUT_NAMED_FD) +
3979                   (c->std_output == EXEC_OUTPUT_NAMED_FD) +
3980                   (c->std_error == EXEC_OUTPUT_NAMED_FD);
3981
3982         for (i = 0; i < 3; i++)
3983                 stdio_fdname[i] = exec_context_fdname(c, i);
3984
3985         n_fds = p->n_storage_fds + p->n_socket_fds;
3986
3987         for (i = 0; i < n_fds  && targets > 0; i++)
3988                 if (named_iofds[STDIN_FILENO] < 0 &&
3989                     c->std_input == EXEC_INPUT_NAMED_FD &&
3990                     stdio_fdname[STDIN_FILENO] &&
3991                     streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) {
3992
3993                         named_iofds[STDIN_FILENO] = p->fds[i];
3994                         targets--;
3995
3996                 } else if (named_iofds[STDOUT_FILENO] < 0 &&
3997                            c->std_output == EXEC_OUTPUT_NAMED_FD &&
3998                            stdio_fdname[STDOUT_FILENO] &&
3999                            streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) {
4000
4001                         named_iofds[STDOUT_FILENO] = p->fds[i];
4002                         targets--;
4003
4004                 } else if (named_iofds[STDERR_FILENO] < 0 &&
4005                            c->std_error == EXEC_OUTPUT_NAMED_FD &&
4006                            stdio_fdname[STDERR_FILENO] &&
4007                            streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) {
4008
4009                         named_iofds[STDERR_FILENO] = p->fds[i];
4010                         targets--;
4011                 }
4012
4013         return targets == 0 ? 0 : -ENOENT;
4014 }
4015
4016 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l) {
4017         char **i, **r = NULL;
4018
4019         assert(c);
4020         assert(l);
4021
4022         STRV_FOREACH(i, c->environment_files) {
4023                 char *fn;
4024                 int k;
4025                 unsigned n;
4026                 bool ignore = false;
4027                 char **p;
4028                 _cleanup_globfree_ glob_t pglob = {};
4029
4030                 fn = *i;
4031
4032                 if (fn[0] == '-') {
4033                         ignore = true;
4034                         fn++;
4035                 }
4036
4037                 if (!path_is_absolute(fn)) {
4038                         if (ignore)
4039                                 continue;
4040
4041                         strv_free(r);
4042                         return -EINVAL;
4043                 }
4044
4045                 /* Filename supports globbing, take all matching files */
4046                 k = safe_glob(fn, 0, &pglob);
4047                 if (k < 0) {
4048                         if (ignore)
4049                                 continue;
4050
4051                         strv_free(r);
4052                         return k;
4053                 }
4054
4055                 /* When we don't match anything, -ENOENT should be returned */
4056                 assert(pglob.gl_pathc > 0);
4057
4058                 for (n = 0; n < pglob.gl_pathc; n++) {
4059                         k = load_env_file(NULL, pglob.gl_pathv[n], &p);
4060                         if (k < 0) {
4061                                 if (ignore)
4062                                         continue;
4063
4064                                 strv_free(r);
4065                                 return k;
4066                         }
4067                         /* Log invalid environment variables with filename */
4068                         if (p) {
4069                                 InvalidEnvInfo info = {
4070                                         .unit = unit,
4071                                         .path = pglob.gl_pathv[n]
4072                                 };
4073
4074                                 p = strv_env_clean_with_callback(p, invalid_env, &info);
4075                         }
4076
4077                         if (!r)
4078                                 r = p;
4079                         else {
4080                                 char **m;
4081
4082                                 m = strv_env_merge(2, r, p);
4083                                 strv_free(r);
4084                                 strv_free(p);
4085                                 if (!m)
4086                                         return -ENOMEM;
4087
4088                                 r = m;
4089                         }
4090                 }
4091         }
4092
4093         *l = r;
4094
4095         return 0;
4096 }
4097
4098 static bool tty_may_match_dev_console(const char *tty) {
4099         _cleanup_free_ char *resolved = NULL;
4100
4101         if (!tty)
4102                 return true;
4103
4104         tty = skip_dev_prefix(tty);
4105
4106         /* trivial identity? */
4107         if (streq(tty, "console"))
4108                 return true;
4109
4110         if (resolve_dev_console(&resolved) < 0)
4111                 return true; /* if we could not resolve, assume it may */
4112
4113         /* "tty0" means the active VC, so it may be the same sometimes */
4114         return streq(resolved, tty) || (streq(resolved, "tty0") && tty_is_vc(tty));
4115 }
4116
4117 bool exec_context_may_touch_console(const ExecContext *ec) {
4118
4119         return (ec->tty_reset ||
4120                 ec->tty_vhangup ||
4121                 ec->tty_vt_disallocate ||
4122                 is_terminal_input(ec->std_input) ||
4123                 is_terminal_output(ec->std_output) ||
4124                 is_terminal_output(ec->std_error)) &&
4125                tty_may_match_dev_console(exec_context_tty_path(ec));
4126 }
4127
4128 static void strv_fprintf(FILE *f, char **l) {
4129         char **g;
4130
4131         assert(f);
4132
4133         STRV_FOREACH(g, l)
4134                 fprintf(f, " %s", *g);
4135 }
4136
4137 void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
4138         ExecDirectoryType dt;
4139         char **e, **d;
4140         unsigned i;
4141         int r;
4142
4143         assert(c);
4144         assert(f);
4145
4146         prefix = strempty(prefix);
4147
4148         fprintf(f,
4149                 "%sUMask: %04o\n"
4150                 "%sWorkingDirectory: %s\n"
4151                 "%sRootDirectory: %s\n"
4152                 "%sNonBlocking: %s\n"
4153                 "%sPrivateTmp: %s\n"
4154                 "%sPrivateDevices: %s\n"
4155                 "%sProtectKernelTunables: %s\n"
4156                 "%sProtectKernelModules: %s\n"
4157                 "%sProtectControlGroups: %s\n"
4158                 "%sPrivateNetwork: %s\n"
4159                 "%sPrivateUsers: %s\n"
4160                 "%sProtectHome: %s\n"
4161                 "%sProtectSystem: %s\n"
4162                 "%sMountAPIVFS: %s\n"
4163                 "%sIgnoreSIGPIPE: %s\n"
4164                 "%sMemoryDenyWriteExecute: %s\n"
4165                 "%sRestrictRealtime: %s\n"
4166                 "%sKeyringMode: %s\n",
4167                 prefix, c->umask,
4168                 prefix, c->working_directory ? c->working_directory : "/",
4169                 prefix, c->root_directory ? c->root_directory : "/",
4170                 prefix, yes_no(c->non_blocking),
4171                 prefix, yes_no(c->private_tmp),
4172                 prefix, yes_no(c->private_devices),
4173                 prefix, yes_no(c->protect_kernel_tunables),
4174                 prefix, yes_no(c->protect_kernel_modules),
4175                 prefix, yes_no(c->protect_control_groups),
4176                 prefix, yes_no(c->private_network),
4177                 prefix, yes_no(c->private_users),
4178                 prefix, protect_home_to_string(c->protect_home),
4179                 prefix, protect_system_to_string(c->protect_system),
4180                 prefix, yes_no(c->mount_apivfs),
4181                 prefix, yes_no(c->ignore_sigpipe),
4182                 prefix, yes_no(c->memory_deny_write_execute),
4183                 prefix, yes_no(c->restrict_realtime),
4184                 prefix, exec_keyring_mode_to_string(c->keyring_mode));
4185
4186         if (c->root_image)
4187                 fprintf(f, "%sRootImage: %s\n", prefix, c->root_image);
4188
4189         STRV_FOREACH(e, c->environment)
4190                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
4191
4192         STRV_FOREACH(e, c->environment_files)
4193                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
4194
4195         STRV_FOREACH(e, c->pass_environment)
4196                 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
4197
4198         STRV_FOREACH(e, c->unset_environment)
4199                 fprintf(f, "%sUnsetEnvironment: %s\n", prefix, *e);
4200
4201         fprintf(f, "%sRuntimeDirectoryPreserve: %s\n", prefix, exec_preserve_mode_to_string(c->runtime_directory_preserve_mode));
4202
4203         for (dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
4204                 fprintf(f, "%s%sMode: %04o\n", prefix, exec_directory_type_to_string(dt), c->directories[dt].mode);
4205
4206                 STRV_FOREACH(d, c->directories[dt].paths)
4207                         fprintf(f, "%s%s: %s\n", prefix, exec_directory_type_to_string(dt), *d);
4208         }
4209
4210         if (c->nice_set)
4211                 fprintf(f,
4212                         "%sNice: %i\n",
4213                         prefix, c->nice);
4214
4215         if (c->oom_score_adjust_set)
4216                 fprintf(f,
4217                         "%sOOMScoreAdjust: %i\n",
4218                         prefix, c->oom_score_adjust);
4219
4220         for (i = 0; i < RLIM_NLIMITS; i++)
4221                 if (c->rlimit[i]) {
4222                         fprintf(f, "%sLimit%s: " RLIM_FMT "\n",
4223                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
4224                         fprintf(f, "%sLimit%sSoft: " RLIM_FMT "\n",
4225                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
4226                 }
4227
4228         if (c->ioprio_set) {
4229                 _cleanup_free_ char *class_str = NULL;
4230
4231                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
4232                 if (r >= 0)
4233                         fprintf(f, "%sIOSchedulingClass: %s\n", prefix, class_str);
4234
4235                 fprintf(f, "%sIOPriority: %lu\n", prefix, IOPRIO_PRIO_DATA(c->ioprio));
4236         }
4237
4238         if (c->cpu_sched_set) {
4239                 _cleanup_free_ char *policy_str = NULL;
4240
4241                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
4242                 if (r >= 0)
4243                         fprintf(f, "%sCPUSchedulingPolicy: %s\n", prefix, policy_str);
4244
4245                 fprintf(f,
4246                         "%sCPUSchedulingPriority: %i\n"
4247                         "%sCPUSchedulingResetOnFork: %s\n",
4248                         prefix, c->cpu_sched_priority,
4249                         prefix, yes_no(c->cpu_sched_reset_on_fork));
4250         }
4251
4252         if (c->cpuset) {
4253                 fprintf(f, "%sCPUAffinity:", prefix);
4254                 for (i = 0; i < c->cpuset_ncpus; i++)
4255                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
4256                                 fprintf(f, " %u", i);
4257                 fputs("\n", f);
4258         }
4259
4260         if (c->timer_slack_nsec != NSEC_INFINITY)
4261                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
4262
4263         fprintf(f,
4264                 "%sStandardInput: %s\n"
4265                 "%sStandardOutput: %s\n"
4266                 "%sStandardError: %s\n",
4267                 prefix, exec_input_to_string(c->std_input),
4268                 prefix, exec_output_to_string(c->std_output),
4269                 prefix, exec_output_to_string(c->std_error));
4270
4271         if (c->std_input == EXEC_INPUT_NAMED_FD)
4272                 fprintf(f, "%sStandardInputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDIN_FILENO]);
4273         if (c->std_output == EXEC_OUTPUT_NAMED_FD)
4274                 fprintf(f, "%sStandardOutputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDOUT_FILENO]);
4275         if (c->std_error == EXEC_OUTPUT_NAMED_FD)
4276                 fprintf(f, "%sStandardErrorFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDERR_FILENO]);
4277
4278         if (c->std_input == EXEC_INPUT_FILE)
4279                 fprintf(f, "%sStandardInputFile: %s\n", prefix, c->stdio_file[STDIN_FILENO]);
4280         if (c->std_output == EXEC_OUTPUT_FILE)
4281                 fprintf(f, "%sStandardOutputFile: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
4282         if (c->std_output == EXEC_OUTPUT_FILE_APPEND)
4283                 fprintf(f, "%sStandardOutputFileToAppend: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
4284         if (c->std_error == EXEC_OUTPUT_FILE)
4285                 fprintf(f, "%sStandardErrorFile: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
4286         if (c->std_error == EXEC_OUTPUT_FILE_APPEND)
4287                 fprintf(f, "%sStandardErrorFileToAppend: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
4288
4289         if (c->tty_path)
4290                 fprintf(f,
4291                         "%sTTYPath: %s\n"
4292                         "%sTTYReset: %s\n"
4293                         "%sTTYVHangup: %s\n"
4294                         "%sTTYVTDisallocate: %s\n",
4295                         prefix, c->tty_path,
4296                         prefix, yes_no(c->tty_reset),
4297                         prefix, yes_no(c->tty_vhangup),
4298                         prefix, yes_no(c->tty_vt_disallocate));
4299
4300         if (IN_SET(c->std_output,
4301                    EXEC_OUTPUT_SYSLOG,
4302                    EXEC_OUTPUT_KMSG,
4303                    EXEC_OUTPUT_JOURNAL,
4304                    EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
4305                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
4306                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE) ||
4307             IN_SET(c->std_error,
4308                    EXEC_OUTPUT_SYSLOG,
4309                    EXEC_OUTPUT_KMSG,
4310                    EXEC_OUTPUT_JOURNAL,
4311                    EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
4312                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
4313                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE)) {
4314
4315                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
4316
4317                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
4318                 if (r >= 0)
4319                         fprintf(f, "%sSyslogFacility: %s\n", prefix, fac_str);
4320
4321                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
4322                 if (r >= 0)
4323                         fprintf(f, "%sSyslogLevel: %s\n", prefix, lvl_str);
4324         }
4325
4326         if (c->log_level_max >= 0) {
4327                 _cleanup_free_ char *t = NULL;
4328
4329                 (void) log_level_to_string_alloc(c->log_level_max, &t);
4330
4331                 fprintf(f, "%sLogLevelMax: %s\n", prefix, strna(t));
4332         }
4333
4334         if (c->log_rate_limit_interval_usec > 0) {
4335                 char buf_timespan[FORMAT_TIMESPAN_MAX];
4336
4337                 fprintf(f,
4338                         "%sLogRateLimitIntervalSec: %s\n",
4339                         prefix, format_timespan(buf_timespan, sizeof(buf_timespan), c->log_rate_limit_interval_usec, USEC_PER_SEC));
4340         }
4341
4342         if (c->log_rate_limit_burst > 0)
4343                 fprintf(f, "%sLogRateLimitBurst: %u\n", prefix, c->log_rate_limit_burst);
4344
4345         if (c->n_log_extra_fields > 0) {
4346                 size_t j;
4347
4348                 for (j = 0; j < c->n_log_extra_fields; j++) {
4349                         fprintf(f, "%sLogExtraFields: ", prefix);
4350                         fwrite(c->log_extra_fields[j].iov_base,
4351                                1, c->log_extra_fields[j].iov_len,
4352                                f);
4353                         fputc('\n', f);
4354                 }
4355         }
4356
4357         if (c->secure_bits) {
4358                 _cleanup_free_ char *str = NULL;
4359
4360                 r = secure_bits_to_string_alloc(c->secure_bits, &str);
4361                 if (r >= 0)
4362                         fprintf(f, "%sSecure Bits: %s\n", prefix, str);
4363         }
4364
4365         if (c->capability_bounding_set != CAP_ALL) {
4366                 _cleanup_free_ char *str = NULL;
4367
4368                 r = capability_set_to_string_alloc(c->capability_bounding_set, &str);
4369                 if (r >= 0)
4370                         fprintf(f, "%sCapabilityBoundingSet: %s\n", prefix, str);
4371         }
4372
4373         if (c->capability_ambient_set != 0) {
4374                 _cleanup_free_ char *str = NULL;
4375
4376                 r = capability_set_to_string_alloc(c->capability_ambient_set, &str);
4377                 if (r >= 0)
4378                         fprintf(f, "%sAmbientCapabilities: %s\n", prefix, str);
4379         }
4380
4381         if (c->user)
4382                 fprintf(f, "%sUser: %s\n", prefix, c->user);
4383         if (c->group)
4384                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
4385
4386         fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
4387
4388         if (!strv_isempty(c->supplementary_groups)) {
4389                 fprintf(f, "%sSupplementaryGroups:", prefix);
4390                 strv_fprintf(f, c->supplementary_groups);
4391                 fputs("\n", f);
4392         }
4393
4394         if (c->pam_name)
4395                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
4396
4397         if (!strv_isempty(c->read_write_paths)) {
4398                 fprintf(f, "%sReadWritePaths:", prefix);
4399                 strv_fprintf(f, c->read_write_paths);
4400                 fputs("\n", f);
4401         }
4402
4403         if (!strv_isempty(c->read_only_paths)) {
4404                 fprintf(f, "%sReadOnlyPaths:", prefix);
4405                 strv_fprintf(f, c->read_only_paths);
4406                 fputs("\n", f);
4407         }
4408
4409         if (!strv_isempty(c->inaccessible_paths)) {
4410                 fprintf(f, "%sInaccessiblePaths:", prefix);
4411                 strv_fprintf(f, c->inaccessible_paths);
4412                 fputs("\n", f);
4413         }
4414
4415         if (c->n_bind_mounts > 0)
4416                 for (i = 0; i < c->n_bind_mounts; i++)
4417                         fprintf(f, "%s%s: %s%s:%s:%s\n", prefix,
4418                                 c->bind_mounts[i].read_only ? "BindReadOnlyPaths" : "BindPaths",
4419                                 c->bind_mounts[i].ignore_enoent ? "-": "",
4420                                 c->bind_mounts[i].source,
4421                                 c->bind_mounts[i].destination,
4422                                 c->bind_mounts[i].recursive ? "rbind" : "norbind");
4423
4424         if (c->n_temporary_filesystems > 0)
4425                 for (i = 0; i < c->n_temporary_filesystems; i++) {
4426                         TemporaryFileSystem *t = c->temporary_filesystems + i;
4427
4428                         fprintf(f, "%sTemporaryFileSystem: %s%s%s\n", prefix,
4429                                 t->path,
4430                                 isempty(t->options) ? "" : ":",
4431                                 strempty(t->options));
4432                 }
4433
4434         if (c->utmp_id)
4435                 fprintf(f,
4436                         "%sUtmpIdentifier: %s\n",
4437                         prefix, c->utmp_id);
4438
4439         if (c->selinux_context)
4440                 fprintf(f,
4441                         "%sSELinuxContext: %s%s\n",
4442                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
4443
4444         if (c->apparmor_profile)
4445                 fprintf(f,
4446                         "%sAppArmorProfile: %s%s\n",
4447                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
4448
4449         if (c->smack_process_label)
4450                 fprintf(f,
4451                         "%sSmackProcessLabel: %s%s\n",
4452                         prefix, c->smack_process_label_ignore ? "-" : "", c->smack_process_label);
4453
4454         if (c->personality != PERSONALITY_INVALID)
4455                 fprintf(f,
4456                         "%sPersonality: %s\n",
4457                         prefix, strna(personality_to_string(c->personality)));
4458
4459         fprintf(f,
4460                 "%sLockPersonality: %s\n",
4461                 prefix, yes_no(c->lock_personality));
4462
4463         if (c->syscall_filter) {
4464 #if HAVE_SECCOMP
4465                 Iterator j;
4466                 void *id, *val;
4467                 bool first = true;
4468 #endif
4469
4470                 fprintf(f,
4471                         "%sSystemCallFilter: ",
4472                         prefix);
4473
4474                 if (!c->syscall_whitelist)
4475                         fputc('~', f);
4476
4477 #if HAVE_SECCOMP
4478                 HASHMAP_FOREACH_KEY(val, id, c->syscall_filter, j) {
4479                         _cleanup_free_ char *name = NULL;
4480                         const char *errno_name = NULL;
4481                         int num = PTR_TO_INT(val);
4482
4483                         if (first)
4484                                 first = false;
4485                         else
4486                                 fputc(' ', f);
4487
4488                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
4489                         fputs(strna(name), f);
4490
4491                         if (num >= 0) {
4492                                 errno_name = errno_to_name(num);
4493                                 if (errno_name)
4494                                         fprintf(f, ":%s", errno_name);
4495                                 else
4496                                         fprintf(f, ":%d", num);
4497                         }
4498                 }
4499 #endif
4500
4501                 fputc('\n', f);
4502         }
4503
4504         if (c->syscall_archs) {
4505 #if HAVE_SECCOMP
4506                 Iterator j;
4507                 void *id;
4508 #endif
4509
4510                 fprintf(f,
4511                         "%sSystemCallArchitectures:",
4512                         prefix);
4513
4514 #if HAVE_SECCOMP
4515                 SET_FOREACH(id, c->syscall_archs, j)
4516                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
4517 #endif
4518                 fputc('\n', f);
4519         }
4520
4521         if (exec_context_restrict_namespaces_set(c)) {
4522                 _cleanup_free_ char *s = NULL;
4523
4524                 r = namespace_flags_to_string(c->restrict_namespaces, &s);
4525                 if (r >= 0)
4526                         fprintf(f, "%sRestrictNamespaces: %s\n",
4527                                 prefix, s);
4528         }
4529
4530         if (c->syscall_errno > 0) {
4531                 const char *errno_name;
4532
4533                 fprintf(f, "%sSystemCallErrorNumber: ", prefix);
4534
4535                 errno_name = errno_to_name(c->syscall_errno);
4536                 if (errno_name)
4537                         fprintf(f, "%s\n", errno_name);
4538                 else
4539                         fprintf(f, "%d\n", c->syscall_errno);
4540         }
4541
4542         if (c->apparmor_profile)
4543                 fprintf(f,
4544                         "%sAppArmorProfile: %s%s\n",
4545                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
4546 }
4547
4548 bool exec_context_maintains_privileges(const ExecContext *c) {
4549         assert(c);
4550
4551         /* Returns true if the process forked off would run under
4552          * an unchanged UID or as root. */
4553
4554         if (!c->user)
4555                 return true;
4556
4557         if (streq(c->user, "root") || streq(c->user, "0"))
4558                 return true;
4559
4560         return false;
4561 }
4562
4563 int exec_context_get_effective_ioprio(const ExecContext *c) {
4564         int p;
4565
4566         assert(c);
4567
4568         if (c->ioprio_set)
4569                 return c->ioprio;
4570
4571         p = ioprio_get(IOPRIO_WHO_PROCESS, 0);
4572         if (p < 0)
4573                 return IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 4);
4574
4575         return p;
4576 }
4577
4578 void exec_context_free_log_extra_fields(ExecContext *c) {
4579         size_t l;
4580
4581         assert(c);
4582
4583         for (l = 0; l < c->n_log_extra_fields; l++)
4584                 free(c->log_extra_fields[l].iov_base);
4585         c->log_extra_fields = mfree(c->log_extra_fields);
4586         c->n_log_extra_fields = 0;
4587 }
4588
4589 void exec_status_start(ExecStatus *s, pid_t pid) {
4590         assert(s);
4591
4592         *s = (ExecStatus) {
4593                 .pid = pid,
4594         };
4595
4596         dual_timestamp_get(&s->start_timestamp);
4597 }
4598
4599 void exec_status_exit(ExecStatus *s, const ExecContext *context, pid_t pid, int code, int status) {
4600         assert(s);
4601
4602         if (s->pid != pid) {
4603                 *s = (ExecStatus) {
4604                         .pid = pid,
4605                 };
4606         }
4607
4608         dual_timestamp_get(&s->exit_timestamp);
4609
4610         s->code = code;
4611         s->status = status;
4612
4613         if (context) {
4614                 if (context->utmp_id)
4615                         (void) utmp_put_dead_process(context->utmp_id, pid, code, status);
4616
4617                 exec_context_tty_reset(context, NULL);
4618         }
4619 }
4620
4621 void exec_status_reset(ExecStatus *s) {
4622         assert(s);
4623
4624         *s = (ExecStatus) {};
4625 }
4626
4627 void exec_status_dump(const ExecStatus *s, FILE *f, const char *prefix) {
4628         char buf[FORMAT_TIMESTAMP_MAX];
4629
4630         assert(s);
4631         assert(f);
4632
4633         if (s->pid <= 0)
4634                 return;
4635
4636         prefix = strempty(prefix);
4637
4638         fprintf(f,
4639                 "%sPID: "PID_FMT"\n",
4640                 prefix, s->pid);
4641
4642         if (dual_timestamp_is_set(&s->start_timestamp))
4643                 fprintf(f,
4644                         "%sStart Timestamp: %s\n",
4645                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
4646
4647         if (dual_timestamp_is_set(&s->exit_timestamp))
4648                 fprintf(f,
4649                         "%sExit Timestamp: %s\n"
4650                         "%sExit Code: %s\n"
4651                         "%sExit Status: %i\n",
4652                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
4653                         prefix, sigchld_code_to_string(s->code),
4654                         prefix, s->status);
4655 }
4656
4657 static char *exec_command_line(char **argv) {
4658         size_t k;
4659         char *n, *p, **a;
4660         bool first = true;
4661
4662         assert(argv);
4663
4664         k = 1;
4665         STRV_FOREACH(a, argv)
4666                 k += strlen(*a)+3;
4667
4668         n = new(char, k);
4669         if (!n)
4670                 return NULL;
4671
4672         p = n;
4673         STRV_FOREACH(a, argv) {
4674
4675                 if (!first)
4676                         *(p++) = ' ';
4677                 else
4678                         first = false;
4679
4680                 if (strpbrk(*a, WHITESPACE)) {
4681                         *(p++) = '\'';
4682                         p = stpcpy(p, *a);
4683                         *(p++) = '\'';
4684                 } else
4685                         p = stpcpy(p, *a);
4686
4687         }
4688
4689         *p = 0;
4690
4691         /* FIXME: this doesn't really handle arguments that have
4692          * spaces and ticks in them */
4693
4694         return n;
4695 }
4696
4697 static void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
4698         _cleanup_free_ char *cmd = NULL;
4699         const char *prefix2;
4700
4701         assert(c);
4702         assert(f);
4703
4704         prefix = strempty(prefix);
4705         prefix2 = strjoina(prefix, "\t");
4706
4707         cmd = exec_command_line(c->argv);
4708         fprintf(f,
4709                 "%sCommand Line: %s\n",
4710                 prefix, cmd ? cmd : strerror(ENOMEM));
4711
4712         exec_status_dump(&c->exec_status, f, prefix2);
4713 }
4714
4715 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
4716         assert(f);
4717
4718         prefix = strempty(prefix);
4719
4720         LIST_FOREACH(command, c, c)
4721                 exec_command_dump(c, f, prefix);
4722 }
4723
4724 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
4725         ExecCommand *end;
4726
4727         assert(l);
4728         assert(e);
4729
4730         if (*l) {
4731                 /* It's kind of important, that we keep the order here */
4732                 LIST_FIND_TAIL(command, *l, end);
4733                 LIST_INSERT_AFTER(command, *l, end, e);
4734         } else
4735               *l = e;
4736 }
4737
4738 int exec_command_set(ExecCommand *c, const char *path, ...) {
4739         va_list ap;
4740         char **l, *p;
4741
4742         assert(c);
4743         assert(path);
4744
4745         va_start(ap, path);
4746         l = strv_new_ap(path, ap);
4747         va_end(ap);
4748
4749         if (!l)
4750                 return -ENOMEM;
4751
4752         p = strdup(path);
4753         if (!p) {
4754                 strv_free(l);
4755                 return -ENOMEM;
4756         }
4757
4758         free_and_replace(c->path, p);
4759
4760         return strv_free_and_replace(c->argv, l);
4761 }
4762
4763 int exec_command_append(ExecCommand *c, const char *path, ...) {
4764         _cleanup_strv_free_ char **l = NULL;
4765         va_list ap;
4766         int r;
4767
4768         assert(c);
4769         assert(path);
4770
4771         va_start(ap, path);
4772         l = strv_new_ap(path, ap);
4773         va_end(ap);
4774
4775         if (!l)
4776                 return -ENOMEM;
4777
4778         r = strv_extend_strv(&c->argv, l, false);
4779         if (r < 0)
4780                 return r;
4781
4782         return 0;
4783 }
4784
4785 static void *remove_tmpdir_thread(void *p) {
4786         _cleanup_free_ char *path = p;
4787
4788         (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
4789         return NULL;
4790 }
4791
4792 static ExecRuntime* exec_runtime_free(ExecRuntime *rt, bool destroy) {
4793         int r;
4794
4795         if (!rt)
4796                 return NULL;
4797
4798         if (rt->manager)
4799                 (void) hashmap_remove(rt->manager->exec_runtime_by_id, rt->id);
4800
4801         /* When destroy is true, then rm_rf tmp_dir and var_tmp_dir. */
4802         if (destroy && rt->tmp_dir) {
4803                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
4804
4805                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
4806                 if (r < 0) {
4807                         log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
4808                         free(rt->tmp_dir);
4809                 }
4810
4811                 rt->tmp_dir = NULL;
4812         }
4813
4814         if (destroy && rt->var_tmp_dir) {
4815                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
4816
4817                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
4818                 if (r < 0) {
4819                         log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
4820                         free(rt->var_tmp_dir);
4821                 }
4822
4823                 rt->var_tmp_dir = NULL;
4824         }
4825
4826         rt->id = mfree(rt->id);
4827         rt->tmp_dir = mfree(rt->tmp_dir);
4828         rt->var_tmp_dir = mfree(rt->var_tmp_dir);
4829         safe_close_pair(rt->netns_storage_socket);
4830         return mfree(rt);
4831 }
4832
4833 static void exec_runtime_freep(ExecRuntime **rt) {
4834         if (*rt)
4835                 (void) exec_runtime_free(*rt, false);
4836 }
4837
4838 static int exec_runtime_allocate(ExecRuntime **rt) {
4839         assert(rt);
4840
4841         *rt = new0(ExecRuntime, 1);
4842         if (!*rt)
4843                 return -ENOMEM;
4844
4845         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
4846         return 0;
4847 }
4848
4849 static int exec_runtime_add(
4850                 Manager *m,
4851                 const char *id,
4852                 const char *tmp_dir,
4853                 const char *var_tmp_dir,
4854                 const int netns_storage_socket[2],
4855                 ExecRuntime **ret) {
4856
4857         _cleanup_(exec_runtime_freep) ExecRuntime *rt = NULL;
4858         int r;
4859
4860         assert(m);
4861         assert(id);
4862
4863         r = hashmap_ensure_allocated(&m->exec_runtime_by_id, &string_hash_ops);
4864         if (r < 0)
4865                 return r;
4866
4867         r = exec_runtime_allocate(&rt);
4868         if (r < 0)
4869                 return r;
4870
4871         rt->id = strdup(id);
4872         if (!rt->id)
4873                 return -ENOMEM;
4874
4875         if (tmp_dir) {
4876                 rt->tmp_dir = strdup(tmp_dir);
4877                 if (!rt->tmp_dir)
4878                         return -ENOMEM;
4879
4880                 /* When tmp_dir is set, then we require var_tmp_dir is also set. */
4881                 assert(var_tmp_dir);
4882                 rt->var_tmp_dir = strdup(var_tmp_dir);
4883                 if (!rt->var_tmp_dir)
4884                         return -ENOMEM;
4885         }
4886
4887         if (netns_storage_socket) {
4888                 rt->netns_storage_socket[0] = netns_storage_socket[0];
4889                 rt->netns_storage_socket[1] = netns_storage_socket[1];
4890         }
4891
4892         r = hashmap_put(m->exec_runtime_by_id, rt->id, rt);
4893         if (r < 0)
4894                 return r;
4895
4896         rt->manager = m;
4897
4898         if (ret)
4899                 *ret = rt;
4900
4901         /* do not remove created ExecRuntime object when the operation succeeds. */
4902         rt = NULL;
4903         return 0;
4904 }
4905
4906 static int exec_runtime_make(Manager *m, const ExecContext *c, const char *id, ExecRuntime **ret) {
4907         _cleanup_free_ char *tmp_dir = NULL, *var_tmp_dir = NULL;
4908         _cleanup_close_pair_ int netns_storage_socket[2] = {-1, -1};
4909         int r;
4910
4911         assert(m);
4912         assert(c);
4913         assert(id);
4914
4915         /* It is not necessary to create ExecRuntime object. */
4916         if (!c->private_network && !c->private_tmp)
4917                 return 0;
4918
4919         if (c->private_tmp) {
4920                 r = setup_tmp_dirs(id, &tmp_dir, &var_tmp_dir);
4921                 if (r < 0)
4922                         return r;
4923         }
4924
4925         if (c->private_network) {
4926                 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, netns_storage_socket) < 0)
4927                         return -errno;
4928         }
4929
4930         r = exec_runtime_add(m, id, tmp_dir, var_tmp_dir, netns_storage_socket, ret);
4931         if (r < 0)
4932                 return r;
4933
4934         /* Avoid cleanup */
4935         netns_storage_socket[0] = -1;
4936         netns_storage_socket[1] = -1;
4937         return 1;
4938 }
4939
4940 int exec_runtime_acquire(Manager *m, const ExecContext *c, const char *id, bool create, ExecRuntime **ret) {
4941         ExecRuntime *rt;
4942         int r;
4943
4944         assert(m);
4945         assert(id);
4946         assert(ret);
4947
4948         rt = hashmap_get(m->exec_runtime_by_id, id);
4949         if (rt)
4950                 /* We already have a ExecRuntime object, let's increase the ref count and reuse it */
4951                 goto ref;
4952
4953         if (!create)
4954                 return 0;
4955
4956         /* If not found, then create a new object. */
4957         r = exec_runtime_make(m, c, id, &rt);
4958         if (r <= 0)
4959                 /* When r == 0, it is not necessary to create ExecRuntime object. */
4960                 return r;
4961
4962 ref:
4963         /* increment reference counter. */
4964         rt->n_ref++;
4965         *ret = rt;
4966         return 1;
4967 }
4968
4969 ExecRuntime *exec_runtime_unref(ExecRuntime *rt, bool destroy) {
4970         if (!rt)
4971                 return NULL;
4972
4973         assert(rt->n_ref > 0);
4974
4975         rt->n_ref--;
4976         if (rt->n_ref > 0)
4977                 return NULL;
4978
4979         return exec_runtime_free(rt, destroy);
4980 }
4981
4982 int exec_runtime_serialize(const Manager *m, FILE *f, FDSet *fds) {
4983         ExecRuntime *rt;
4984         Iterator i;
4985
4986         assert(m);
4987         assert(f);
4988         assert(fds);
4989
4990         HASHMAP_FOREACH(rt, m->exec_runtime_by_id, i) {
4991                 fprintf(f, "exec-runtime=%s", rt->id);
4992
4993                 if (rt->tmp_dir)
4994                         fprintf(f, " tmp-dir=%s", rt->tmp_dir);
4995
4996                 if (rt->var_tmp_dir)
4997                         fprintf(f, " var-tmp-dir=%s", rt->var_tmp_dir);
4998
4999                 if (rt->netns_storage_socket[0] >= 0) {
5000                         int copy;
5001
5002                         copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
5003                         if (copy < 0)
5004                                 return copy;
5005
5006                         fprintf(f, " netns-socket-0=%i", copy);
5007                 }
5008
5009                 if (rt->netns_storage_socket[1] >= 0) {
5010                         int copy;
5011
5012                         copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
5013                         if (copy < 0)
5014                                 return copy;
5015
5016                         fprintf(f, " netns-socket-1=%i", copy);
5017                 }
5018
5019                 fputc('\n', f);
5020         }
5021
5022         return 0;
5023 }
5024
5025 int exec_runtime_deserialize_compat(Unit *u, const char *key, const char *value, FDSet *fds) {
5026         _cleanup_(exec_runtime_freep) ExecRuntime *rt_create = NULL;
5027         ExecRuntime *rt;
5028         int r;
5029
5030         /* This is for the migration from old (v237 or earlier) deserialization text.
5031          * Due to the bug #7790, this may not work with the units that use JoinsNamespaceOf=.
5032          * Even if the ExecRuntime object originally created by the other unit, we cannot judge
5033          * so or not from the serialized text, then we always creates a new object owned by this. */
5034
5035         assert(u);
5036         assert(key);
5037         assert(value);
5038
5039         /* Manager manages ExecRuntime objects by the unit id.
5040          * So, we omit the serialized text when the unit does not have id (yet?)... */
5041         if (isempty(u->id)) {
5042                 log_unit_debug(u, "Invocation ID not found. Dropping runtime parameter.");
5043                 return 0;
5044         }
5045
5046         r = hashmap_ensure_allocated(&u->manager->exec_runtime_by_id, &string_hash_ops);
5047         if (r < 0) {
5048                 log_unit_debug_errno(u, r, "Failed to allocate storage for runtime parameter: %m");
5049                 return 0;
5050         }
5051
5052         rt = hashmap_get(u->manager->exec_runtime_by_id, u->id);
5053         if (!rt) {
5054                 r = exec_runtime_allocate(&rt_create);
5055                 if (r < 0)
5056                         return log_oom();
5057
5058                 rt_create->id = strdup(u->id);
5059                 if (!rt_create->id)
5060                         return log_oom();
5061
5062                 rt = rt_create;
5063         }
5064
5065         if (streq(key, "tmp-dir")) {
5066                 char *copy;
5067
5068                 copy = strdup(value);
5069                 if (!copy)
5070                         return log_oom();
5071
5072                 free_and_replace(rt->tmp_dir, copy);
5073
5074         } else if (streq(key, "var-tmp-dir")) {
5075                 char *copy;
5076
5077                 copy = strdup(value);
5078                 if (!copy)
5079                         return log_oom();
5080
5081                 free_and_replace(rt->var_tmp_dir, copy);
5082
5083         } else if (streq(key, "netns-socket-0")) {
5084                 int fd;
5085
5086                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
5087                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
5088                         return 0;
5089                 }
5090
5091                 safe_close(rt->netns_storage_socket[0]);
5092                 rt->netns_storage_socket[0] = fdset_remove(fds, fd);
5093
5094         } else if (streq(key, "netns-socket-1")) {
5095                 int fd;
5096
5097                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
5098                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
5099                         return 0;
5100                 }
5101
5102                 safe_close(rt->netns_storage_socket[1]);
5103                 rt->netns_storage_socket[1] = fdset_remove(fds, fd);
5104         } else
5105                 return 0;
5106
5107         /* If the object is newly created, then put it to the hashmap which manages ExecRuntime objects. */
5108         if (rt_create) {
5109                 r = hashmap_put(u->manager->exec_runtime_by_id, rt_create->id, rt_create);
5110                 if (r < 0) {
5111                         log_unit_debug_errno(u, r, "Failed to put runtime parameter to manager's storage: %m");
5112                         return 0;
5113                 }
5114
5115                 rt_create->manager = u->manager;
5116
5117                 /* Avoid cleanup */
5118                 rt_create = NULL;
5119         }
5120
5121         return 1;
5122 }
5123
5124 void exec_runtime_deserialize_one(Manager *m, const char *value, FDSet *fds) {
5125         char *id = NULL, *tmp_dir = NULL, *var_tmp_dir = NULL;
5126         int r, fd0 = -1, fd1 = -1;
5127         const char *p, *v = value;
5128         size_t n;
5129
5130         assert(m);
5131         assert(value);
5132         assert(fds);
5133
5134         n = strcspn(v, " ");
5135         id = strndupa(v, n);
5136         if (v[n] != ' ')
5137                 goto finalize;
5138         p = v + n + 1;
5139
5140         v = startswith(p, "tmp-dir=");
5141         if (v) {
5142                 n = strcspn(v, " ");
5143                 tmp_dir = strndupa(v, n);
5144                 if (v[n] != ' ')
5145                         goto finalize;
5146                 p = v + n + 1;
5147         }
5148
5149         v = startswith(p, "var-tmp-dir=");
5150         if (v) {
5151                 n = strcspn(v, " ");
5152                 var_tmp_dir = strndupa(v, n);
5153                 if (v[n] != ' ')
5154                         goto finalize;
5155                 p = v + n + 1;
5156         }
5157
5158         v = startswith(p, "netns-socket-0=");
5159         if (v) {
5160                 char *buf;
5161
5162                 n = strcspn(v, " ");
5163                 buf = strndupa(v, n);
5164                 if (safe_atoi(buf, &fd0) < 0 || !fdset_contains(fds, fd0)) {
5165                         log_debug("Unable to process exec-runtime netns fd specification.");
5166                         return;
5167                 }
5168                 fd0 = fdset_remove(fds, fd0);
5169                 if (v[n] != ' ')
5170                         goto finalize;
5171                 p = v + n + 1;
5172         }
5173
5174         v = startswith(p, "netns-socket-1=");
5175         if (v) {
5176                 char *buf;
5177
5178                 n = strcspn(v, " ");
5179                 buf = strndupa(v, n);
5180                 if (safe_atoi(buf, &fd1) < 0 || !fdset_contains(fds, fd1)) {
5181                         log_debug("Unable to process exec-runtime netns fd specification.");
5182                         return;
5183                 }
5184                 fd1 = fdset_remove(fds, fd1);
5185         }
5186
5187 finalize:
5188
5189         r = exec_runtime_add(m, id, tmp_dir, var_tmp_dir, (int[]) { fd0, fd1 }, NULL);
5190         if (r < 0)
5191                 log_debug_errno(r, "Failed to add exec-runtime: %m");
5192 }
5193
5194 void exec_runtime_vacuum(Manager *m) {
5195         ExecRuntime *rt;
5196         Iterator i;
5197
5198         assert(m);
5199
5200         /* Free unreferenced ExecRuntime objects. This is used after manager deserialization process. */
5201
5202         HASHMAP_FOREACH(rt, m->exec_runtime_by_id, i) {
5203                 if (rt->n_ref > 0)
5204                         continue;
5205
5206                 (void) exec_runtime_free(rt, false);
5207         }
5208 }
5209
5210 void exec_params_clear(ExecParameters *p) {
5211         if (!p)
5212                 return;
5213
5214         strv_free(p->environment);
5215 }
5216
5217 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
5218         [EXEC_INPUT_NULL] = "null",
5219         [EXEC_INPUT_TTY] = "tty",
5220         [EXEC_INPUT_TTY_FORCE] = "tty-force",
5221         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
5222         [EXEC_INPUT_SOCKET] = "socket",
5223         [EXEC_INPUT_NAMED_FD] = "fd",
5224         [EXEC_INPUT_DATA] = "data",
5225         [EXEC_INPUT_FILE] = "file",
5226 };
5227
5228 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
5229
5230 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
5231         [EXEC_OUTPUT_INHERIT] = "inherit",
5232         [EXEC_OUTPUT_NULL] = "null",
5233         [EXEC_OUTPUT_TTY] = "tty",
5234         [EXEC_OUTPUT_SYSLOG] = "syslog",
5235         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
5236         [EXEC_OUTPUT_KMSG] = "kmsg",
5237         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
5238         [EXEC_OUTPUT_JOURNAL] = "journal",
5239         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
5240         [EXEC_OUTPUT_SOCKET] = "socket",
5241         [EXEC_OUTPUT_NAMED_FD] = "fd",
5242         [EXEC_OUTPUT_FILE] = "file",
5243         [EXEC_OUTPUT_FILE_APPEND] = "append",
5244 };
5245
5246 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
5247
5248 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
5249         [EXEC_UTMP_INIT] = "init",
5250         [EXEC_UTMP_LOGIN] = "login",
5251         [EXEC_UTMP_USER] = "user",
5252 };
5253
5254 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);
5255
5256 static const char* const exec_preserve_mode_table[_EXEC_PRESERVE_MODE_MAX] = {
5257         [EXEC_PRESERVE_NO] = "no",
5258         [EXEC_PRESERVE_YES] = "yes",
5259         [EXEC_PRESERVE_RESTART] = "restart",
5260 };
5261
5262 DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(exec_preserve_mode, ExecPreserveMode, EXEC_PRESERVE_YES);
5263
5264 static const char* const exec_directory_type_table[_EXEC_DIRECTORY_TYPE_MAX] = {
5265         [EXEC_DIRECTORY_RUNTIME] = "RuntimeDirectory",
5266         [EXEC_DIRECTORY_STATE] = "StateDirectory",
5267         [EXEC_DIRECTORY_CACHE] = "CacheDirectory",
5268         [EXEC_DIRECTORY_LOGS] = "LogsDirectory",
5269         [EXEC_DIRECTORY_CONFIGURATION] = "ConfigurationDirectory",
5270 };
5271
5272 DEFINE_STRING_TABLE_LOOKUP(exec_directory_type, ExecDirectoryType);
5273
5274 static const char* const exec_directory_env_name_table[_EXEC_DIRECTORY_TYPE_MAX] = {
5275         [EXEC_DIRECTORY_RUNTIME] = "RUNTIME_DIRECTORY",
5276         [EXEC_DIRECTORY_STATE] = "STATE_DIRECTORY",
5277         [EXEC_DIRECTORY_CACHE] = "CACHE_DIRECTORY",
5278         [EXEC_DIRECTORY_LOGS] = "LOGS_DIRECTORY",
5279         [EXEC_DIRECTORY_CONFIGURATION] = "CONFIGURATION_DIRECTORY",
5280 };
5281
5282 DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(exec_directory_env_name, ExecDirectoryType);
5283
5284 static const char* const exec_keyring_mode_table[_EXEC_KEYRING_MODE_MAX] = {
5285         [EXEC_KEYRING_INHERIT] = "inherit",
5286         [EXEC_KEYRING_PRIVATE] = "private",
5287         [EXEC_KEYRING_SHARED] = "shared",
5288 };
5289
5290 DEFINE_STRING_TABLE_LOOKUP(exec_keyring_mode, ExecKeyringMode);