src/core/execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <glob.h>
   6 #include <grp.h>
   7 #include <poll.h>
   8 #include <signal.h>
   9 #include <string.h>
  10 #include <sys/capability.h>
  11 #include <sys/eventfd.h>
  12 #include <sys/mman.h>
  13 #include <sys/personality.h>
  14 #include <sys/prctl.h>
  15 #include <sys/shm.h>
  16 #include <sys/socket.h>
  17 #include <sys/stat.h>
  18 #include <sys/types.h>
  19 #include <sys/un.h>
  20 #include <unistd.h>
  21 #include <utmpx.h>
  22
  23 #if HAVE_PAM
  24 #include <security/pam_appl.h>
  25 #endif
  26
  27 #if HAVE_SELINUX
  28 #include <selinux/selinux.h>
  29 #endif
  30
  31 #if HAVE_SECCOMP
  32 #include <seccomp.h>
  33 #endif
  34
  35 #if HAVE_APPARMOR
  36 #include <sys/apparmor.h>
  37 #endif
  38
  39 #include "sd-messages.h"
  40
  41 #include "af-list.h"
  42 #include "alloc-util.h"
  43 #if HAVE_APPARMOR
  44 #include "apparmor-util.h"
  45 #endif
  46 #include "async.h"
  47 #include "barrier.h"
  48 #include "cap-list.h"
  49 #include "capability-util.h"
  50 #include "chown-recursive.h"
  51 #include "cpu-set-util.h"
  52 #include "def.h"
  53 #include "env-file.h"
  54 #include "env-util.h"
  55 #include "errno-list.h"
  56 #include "execute.h"
  57 #include "exit-status.h"
  58 #include "fd-util.h"
  59 #include "format-util.h"
  60 #include "fs-util.h"
  61 #include "glob-util.h"
  62 #include "io-util.h"
  63 #include "ioprio.h"
  64 #include "label.h"
  65 #include "log.h"
  66 #include "macro.h"
  67 #include "manager.h"
  68 #include "memory-util.h"
  69 #include "missing.h"
  70 #include "mkdir.h"
  71 #include "namespace.h"
  72 #include "parse-util.h"
  73 #include "path-util.h"
  74 #include "process-util.h"
  75 #include "rlimit-util.h"
  76 #include "rm-rf.h"
  77 #if HAVE_SECCOMP
  78 #include "seccomp-util.h"
  79 #endif
  80 #include "securebits-util.h"
  81 #include "selinux-util.h"
  82 #include "signal-util.h"
  83 #include "smack-util.h"
  84 #include "socket-util.h"
  85 #include "special.h"
  86 #include "stat-util.h"
  87 #include "string-table.h"
  88 #include "string-util.h"
  89 #include "strv.h"
  90 #include "syslog-util.h"
  91 #include "terminal-util.h"
  92 #include "umask-util.h"
  93 #include "unit.h"
  94 #include "user-util.h"
  95 #include "utmp-wtmp.h"
  96
  97 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  98 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
  99
 100 /* This assumes there is a 'tty' group */
 101 #define TTY_MODE 0620
 102
 103 #define SNDBUF_SIZE (8*1024*1024)
 104
 105 static int shift_fds(int fds[], size_t n_fds) {
 106         int start, restart_from;
 107
 108         if (n_fds <= 0)
 109                 return 0;
 110
 111         /* Modifies the fds array! (sorts it) */
 112
 113         assert(fds);
 114
 115         start = 0;
 116         for (;;) {
 117                 int i;
 118
 119                 restart_from = -1;
 120
 121                 for (i = start; i < (int) n_fds; i++) {
 122                         int nfd;
 123
 124                         /* Already at right index? */
 125                         if (fds[i] == i+3)
 126                                 continue;
 127
 128                         nfd = fcntl(fds[i], F_DUPFD, i + 3);
 129                         if (nfd < 0)
 130                                 return -errno;
 131
 132                         safe_close(fds[i]);
 133                         fds[i] = nfd;
 134
 135                         /* Hmm, the fd we wanted isn't free? Then
 136                          * let's remember that and try again from here */
 137                         if (nfd != i+3 && restart_from < 0)
 138                                 restart_from = i;
 139                 }
 140
 141                 if (restart_from < 0)
 142                         break;
 143
 144                 start = restart_from;
 145         }
 146
 147         return 0;
 148 }
 149
 150 static int flags_fds(const int fds[], size_t n_socket_fds, size_t n_storage_fds, bool nonblock) {
 151         size_t i, n_fds;
 152         int r;
 153
 154         n_fds = n_socket_fds + n_storage_fds;
 155         if (n_fds <= 0)
 156                 return 0;
 157
 158         assert(fds);
 159
 160         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags.
 161          * O_NONBLOCK only applies to socket activation though. */
 162
 163         for (i = 0; i < n_fds; i++) {
 164
 165                 if (i < n_socket_fds) {
 166                         r = fd_nonblock(fds[i], nonblock);
 167                         if (r < 0)
 168                                 return r;
 169                 }
 170
 171                 /* We unconditionally drop FD_CLOEXEC from the fds,
 172                  * since after all we want to pass these fds to our
 173                  * children */
 174
 175                 r = fd_cloexec(fds[i], false);
 176                 if (r < 0)
 177                         return r;
 178         }
 179
 180         return 0;
 181 }
 182
 183 static const char *exec_context_tty_path(const ExecContext *context) {
 184         assert(context);
 185
 186         if (context->stdio_as_fds)
 187                 return NULL;
 188
 189         if (context->tty_path)
 190                 return context->tty_path;
 191
 192         return "/dev/console";
 193 }
 194
 195 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
 196         const char *path;
 197
 198         assert(context);
 199
 200         path = exec_context_tty_path(context);
 201
 202         if (context->tty_vhangup) {
 203                 if (p && p->stdin_fd >= 0)
 204                         (void) terminal_vhangup_fd(p->stdin_fd);
 205                 else if (path)
 206                         (void) terminal_vhangup(path);
 207         }
 208
 209         if (context->tty_reset) {
 210                 if (p && p->stdin_fd >= 0)
 211                         (void) reset_terminal_fd(p->stdin_fd, true);
 212                 else if (path)
 213                         (void) reset_terminal(path);
 214         }
 215
 216         if (context->tty_vt_disallocate && path)
 217                 (void) vt_disallocate(path);
 218 }
 219
 220 static bool is_terminal_input(ExecInput i) {
 221         return IN_SET(i,
 222                       EXEC_INPUT_TTY,
 223                       EXEC_INPUT_TTY_FORCE,
 224                       EXEC_INPUT_TTY_FAIL);
 225 }
 226
 227 static bool is_terminal_output(ExecOutput o) {
 228         return IN_SET(o,
 229                       EXEC_OUTPUT_TTY,
 230                       EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 231                       EXEC_OUTPUT_KMSG_AND_CONSOLE,
 232                       EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 233 }
 234
 235 static bool is_syslog_output(ExecOutput o) {
 236         return IN_SET(o,
 237                       EXEC_OUTPUT_SYSLOG,
 238                       EXEC_OUTPUT_SYSLOG_AND_CONSOLE);
 239 }
 240
 241 static bool is_kmsg_output(ExecOutput o) {
 242         return IN_SET(o,
 243                       EXEC_OUTPUT_KMSG,
 244                       EXEC_OUTPUT_KMSG_AND_CONSOLE);
 245 }
 246
 247 static bool exec_context_needs_term(const ExecContext *c) {
 248         assert(c);
 249
 250         /* Return true if the execution context suggests we should set $TERM to something useful. */
 251
 252         if (is_terminal_input(c->std_input))
 253                 return true;
 254
 255         if (is_terminal_output(c->std_output))
 256                 return true;
 257
 258         if (is_terminal_output(c->std_error))
 259                 return true;
 260
 261         return !!c->tty_path;
 262 }
 263
 264 static int open_null_as(int flags, int nfd) {
 265         int fd;
 266
 267         assert(nfd >= 0);
 268
 269         fd = open("/dev/null", flags|O_NOCTTY);
 270         if (fd < 0)
 271                 return -errno;
 272
 273         return move_fd(fd, nfd, false);
 274 }
 275
 276 static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
 277         static const union sockaddr_union sa = {
 278                 .un.sun_family = AF_UNIX,
 279                 .un.sun_path = "/run/systemd/journal/stdout",
 280         };
 281         uid_t olduid = UID_INVALID;
 282         gid_t oldgid = GID_INVALID;
 283         int r;
 284
 285         if (gid_is_valid(gid)) {
 286                 oldgid = getgid();
 287
 288                 if (setegid(gid) < 0)
 289                         return -errno;
 290         }
 291
 292         if (uid_is_valid(uid)) {
 293                 olduid = getuid();
 294
 295                 if (seteuid(uid) < 0) {
 296                         r = -errno;
 297                         goto restore_gid;
 298                 }
 299         }
 300
 301         r = connect(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un)) < 0 ? -errno : 0;
 302
 303         /* If we fail to restore the uid or gid, things will likely
 304            fail later on. This should only happen if an LSM interferes. */
 305
 306         if (uid_is_valid(uid))
 307                 (void) seteuid(olduid);
 308
 309  restore_gid:
 310         if (gid_is_valid(gid))
 311                 (void) setegid(oldgid);
 312
 313         return r;
 314 }
 315
 316 static int connect_logger_as(
 317                 const Unit *unit,
 318                 const ExecContext *context,
 319                 const ExecParameters *params,
 320                 ExecOutput output,
 321                 const char *ident,
 322                 int nfd,
 323                 uid_t uid,
 324                 gid_t gid) {
 325
 326         _cleanup_close_ int fd = -1;
 327         int r;
 328
 329         assert(context);
 330         assert(params);
 331         assert(output < _EXEC_OUTPUT_MAX);
 332         assert(ident);
 333         assert(nfd >= 0);
 334
 335         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 336         if (fd < 0)
 337                 return -errno;
 338
 339         r = connect_journal_socket(fd, uid, gid);
 340         if (r < 0)
 341                 return r;
 342
 343         if (shutdown(fd, SHUT_RD) < 0)
 344                 return -errno;
 345
 346         (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
 347
 348         if (dprintf(fd,
 349                 "%s\n"
 350                 "%s\n"
 351                 "%i\n"
 352                 "%i\n"
 353                 "%i\n"
 354                 "%i\n"
 355                 "%i\n",
 356                 context->syslog_identifier ?: ident,
 357                 params->flags & EXEC_PASS_LOG_UNIT ? unit->id : "",
 358                 context->syslog_priority,
 359                 !!context->syslog_level_prefix,
 360                 is_syslog_output(output),
 361                 is_kmsg_output(output),
 362                 is_terminal_output(output)) < 0)
 363                 return -errno;
 364
 365         return move_fd(TAKE_FD(fd), nfd, false);
 366 }
 367
 368 static int open_terminal_as(const char *path, int flags, int nfd) {
 369         int fd;
 370
 371         assert(path);
 372         assert(nfd >= 0);
 373
 374         fd = open_terminal(path, flags | O_NOCTTY);
 375         if (fd < 0)
 376                 return fd;
 377
 378         return move_fd(fd, nfd, false);
 379 }
 380
 381 static int acquire_path(const char *path, int flags, mode_t mode) {
 382         union sockaddr_union sa = {};
 383         _cleanup_close_ int fd = -1;
 384         int r, salen;
 385
 386         assert(path);
 387
 388         if (IN_SET(flags & O_ACCMODE, O_WRONLY, O_RDWR))
 389                 flags |= O_CREAT;
 390
 391         fd = open(path, flags|O_NOCTTY, mode);
 392         if (fd >= 0)
 393                 return TAKE_FD(fd);
 394
 395         if (errno != ENXIO) /* ENXIO is returned when we try to open() an AF_UNIX file system socket on Linux */
 396                 return -errno;
 397         if (strlen(path) >= sizeof(sa.un.sun_path)) /* Too long, can't be a UNIX socket */
 398                 return -ENXIO;
 399
 400         /* So, it appears the specified path could be an AF_UNIX socket. Let's see if we can connect to it. */
 401
 402         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 403         if (fd < 0)
 404                 return -errno;
 405
 406         salen = sockaddr_un_set_path(&sa.un, path);
 407         if (salen < 0)
 408                 return salen;
 409
 410         if (connect(fd, &sa.sa, salen) < 0)
 411                 return errno == EINVAL ? -ENXIO : -errno; /* Propagate initial error if we get EINVAL, i.e. we have
 412                                                            * indication that his wasn't an AF_UNIX socket after all */
 413
 414         if ((flags & O_ACCMODE) == O_RDONLY)
 415                 r = shutdown(fd, SHUT_WR);
 416         else if ((flags & O_ACCMODE) == O_WRONLY)
 417                 r = shutdown(fd, SHUT_RD);
 418         else
 419                 return TAKE_FD(fd);
 420         if (r < 0)
 421                 return -errno;
 422
 423         return TAKE_FD(fd);
 424 }
 425
 426 static int fixup_input(
 427                 const ExecContext *context,
 428                 int socket_fd,
 429                 bool apply_tty_stdin) {
 430
 431         ExecInput std_input;
 432
 433         assert(context);
 434
 435         std_input = context->std_input;
 436
 437         if (is_terminal_input(std_input) && !apply_tty_stdin)
 438                 return EXEC_INPUT_NULL;
 439
 440         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 441                 return EXEC_INPUT_NULL;
 442
 443         if (std_input == EXEC_INPUT_DATA && context->stdin_data_size == 0)
 444                 return EXEC_INPUT_NULL;
 445
 446         return std_input;
 447 }
 448
 449 static int fixup_output(ExecOutput std_output, int socket_fd) {
 450
 451         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 452                 return EXEC_OUTPUT_INHERIT;
 453
 454         return std_output;
 455 }
 456
 457 static int setup_input(
 458                 const ExecContext *context,
 459                 const ExecParameters *params,
 460                 int socket_fd,
 461                 int named_iofds[3]) {
 462
 463         ExecInput i;
 464
 465         assert(context);
 466         assert(params);
 467
 468         if (params->stdin_fd >= 0) {
 469                 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
 470                         return -errno;
 471
 472                 /* Try to make this the controlling tty, if it is a tty, and reset it */
 473                 if (isatty(STDIN_FILENO)) {
 474                         (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
 475                         (void) reset_terminal_fd(STDIN_FILENO, true);
 476                 }
 477
 478                 return STDIN_FILENO;
 479         }
 480
 481         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 482
 483         switch (i) {
 484
 485         case EXEC_INPUT_NULL:
 486                 return open_null_as(O_RDONLY, STDIN_FILENO);
 487
 488         case EXEC_INPUT_TTY:
 489         case EXEC_INPUT_TTY_FORCE:
 490         case EXEC_INPUT_TTY_FAIL: {
 491                 int fd;
 492
 493                 fd = acquire_terminal(exec_context_tty_path(context),
 494                                       i == EXEC_INPUT_TTY_FAIL  ? ACQUIRE_TERMINAL_TRY :
 495                                       i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE :
 496                                                                   ACQUIRE_TERMINAL_WAIT,
 497                                       USEC_INFINITY);
 498                 if (fd < 0)
 499                         return fd;
 500
 501                 return move_fd(fd, STDIN_FILENO, false);
 502         }
 503
 504         case EXEC_INPUT_SOCKET:
 505                 assert(socket_fd >= 0);
 506
 507                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 508
 509         case EXEC_INPUT_NAMED_FD:
 510                 assert(named_iofds[STDIN_FILENO] >= 0);
 511
 512                 (void) fd_nonblock(named_iofds[STDIN_FILENO], false);
 513                 return dup2(named_iofds[STDIN_FILENO], STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 514
 515         case EXEC_INPUT_DATA: {
 516                 int fd;
 517
 518                 fd = acquire_data_fd(context->stdin_data, context->stdin_data_size, 0);
 519                 if (fd < 0)
 520                         return fd;
 521
 522                 return move_fd(fd, STDIN_FILENO, false);
 523         }
 524
 525         case EXEC_INPUT_FILE: {
 526                 bool rw;
 527                 int fd;
 528
 529                 assert(context->stdio_file[STDIN_FILENO]);
 530
 531                 rw = (context->std_output == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDOUT_FILENO])) ||
 532                         (context->std_error == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDERR_FILENO]));
 533
 534                 fd = acquire_path(context->stdio_file[STDIN_FILENO], rw ? O_RDWR : O_RDONLY, 0666 & ~context->umask);
 535                 if (fd < 0)
 536                         return fd;
 537
 538                 return move_fd(fd, STDIN_FILENO, false);
 539         }
 540
 541         default:
 542                 assert_not_reached("Unknown input type");
 543         }
 544 }
 545
 546 static bool can_inherit_stderr_from_stdout(
 547                 const ExecContext *context,
 548                 ExecOutput o,
 549                 ExecOutput e) {
 550
 551         assert(context);
 552
 553         /* Returns true, if given the specified STDERR and STDOUT output we can directly dup() the stdout fd to the
 554          * stderr fd */
 555
 556         if (e == EXEC_OUTPUT_INHERIT)
 557                 return true;
 558         if (e != o)
 559                 return false;
 560
 561         if (e == EXEC_OUTPUT_NAMED_FD)
 562                 return streq_ptr(context->stdio_fdname[STDOUT_FILENO], context->stdio_fdname[STDERR_FILENO]);
 563
 564         if (IN_SET(e, EXEC_OUTPUT_FILE, EXEC_OUTPUT_FILE_APPEND))
 565                 return streq_ptr(context->stdio_file[STDOUT_FILENO], context->stdio_file[STDERR_FILENO]);
 566
 567         return true;
 568 }
 569
 570 static int setup_output(
 571                 const Unit *unit,
 572                 const ExecContext *context,
 573                 const ExecParameters *params,
 574                 int fileno,
 575                 int socket_fd,
 576                 int named_iofds[3],
 577                 const char *ident,
 578                 uid_t uid,
 579                 gid_t gid,
 580                 dev_t *journal_stream_dev,
 581                 ino_t *journal_stream_ino) {
 582
 583         ExecOutput o;
 584         ExecInput i;
 585         int r;
 586
 587         assert(unit);
 588         assert(context);
 589         assert(params);
 590         assert(ident);
 591         assert(journal_stream_dev);
 592         assert(journal_stream_ino);
 593
 594         if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
 595
 596                 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
 597                         return -errno;
 598
 599                 return STDOUT_FILENO;
 600         }
 601
 602         if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
 603                 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
 604                         return -errno;
 605
 606                 return STDERR_FILENO;
 607         }
 608
 609         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 610         o = fixup_output(context->std_output, socket_fd);
 611
 612         if (fileno == STDERR_FILENO) {
 613                 ExecOutput e;
 614                 e = fixup_output(context->std_error, socket_fd);
 615
 616                 /* This expects the input and output are already set up */
 617
 618                 /* Don't change the stderr file descriptor if we inherit all
 619                  * the way and are not on a tty */
 620                 if (e == EXEC_OUTPUT_INHERIT &&
 621                     o == EXEC_OUTPUT_INHERIT &&
 622                     i == EXEC_INPUT_NULL &&
 623                     !is_terminal_input(context->std_input) &&
 624                     getppid () != 1)
 625                         return fileno;
 626
 627                 /* Duplicate from stdout if possible */
 628                 if (can_inherit_stderr_from_stdout(context, o, e))
 629                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 630
 631                 o = e;
 632
 633         } else if (o == EXEC_OUTPUT_INHERIT) {
 634                 /* If input got downgraded, inherit the original value */
 635                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 636                         return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 637
 638                 /* If the input is connected to anything that's not a /dev/null or a data fd, inherit that... */
 639                 if (!IN_SET(i, EXEC_INPUT_NULL, EXEC_INPUT_DATA))
 640                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 641
 642                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 643                 if (getppid() != 1)
 644                         return fileno;
 645
 646                 /* We need to open /dev/null here anew, to get the right access mode. */
 647                 return open_null_as(O_WRONLY, fileno);
 648         }
 649
 650         switch (o) {
 651
 652         case EXEC_OUTPUT_NULL:
 653                 return open_null_as(O_WRONLY, fileno);
 654
 655         case EXEC_OUTPUT_TTY:
 656                 if (is_terminal_input(i))
 657                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 658
 659                 /* We don't reset the terminal if this is just about output */
 660                 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 661
 662         case EXEC_OUTPUT_SYSLOG:
 663         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 664         case EXEC_OUTPUT_KMSG:
 665         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 666         case EXEC_OUTPUT_JOURNAL:
 667         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 668                 r = connect_logger_as(unit, context, params, o, ident, fileno, uid, gid);
 669                 if (r < 0) {
 670                         log_unit_warning_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
 671                         r = open_null_as(O_WRONLY, fileno);
 672                 } else {
 673                         struct stat st;
 674
 675                         /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
 676                          * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
 677                          * services to detect whether they are connected to the journal or not.
 678                          *
 679                          * If both stdout and stderr are connected to a stream then let's make sure to store the data
 680                          * about STDERR as that's usually the best way to do logging. */
 681
 682                         if (fstat(fileno, &st) >= 0 &&
 683                             (*journal_stream_ino == 0 || fileno == STDERR_FILENO)) {
 684                                 *journal_stream_dev = st.st_dev;
 685                                 *journal_stream_ino = st.st_ino;
 686                         }
 687                 }
 688                 return r;
 689
 690         case EXEC_OUTPUT_SOCKET:
 691                 assert(socket_fd >= 0);
 692
 693                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 694
 695         case EXEC_OUTPUT_NAMED_FD:
 696                 assert(named_iofds[fileno] >= 0);
 697
 698                 (void) fd_nonblock(named_iofds[fileno], false);
 699                 return dup2(named_iofds[fileno], fileno) < 0 ? -errno : fileno;
 700
 701         case EXEC_OUTPUT_FILE:
 702         case EXEC_OUTPUT_FILE_APPEND: {
 703                 bool rw;
 704                 int fd, flags;
 705
 706                 assert(context->stdio_file[fileno]);
 707
 708                 rw = context->std_input == EXEC_INPUT_FILE &&
 709                         streq_ptr(context->stdio_file[fileno], context->stdio_file[STDIN_FILENO]);
 710
 711                 if (rw)
 712                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 713
 714                 flags = O_WRONLY;
 715                 if (o == EXEC_OUTPUT_FILE_APPEND)
 716                         flags |= O_APPEND;
 717
 718                 fd = acquire_path(context->stdio_file[fileno], flags, 0666 & ~context->umask);
 719                 if (fd < 0)
 720                         return fd;
 721
 722                 return move_fd(fd, fileno, 0);
 723         }
 724
 725         default:
 726                 assert_not_reached("Unknown error type");
 727         }
 728 }
 729
 730 static int chown_terminal(int fd, uid_t uid) {
 731         struct stat st;
 732
 733         assert(fd >= 0);
 734
 735         /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
 736         if (isatty(fd) < 1)
 737                 return 0;
 738
 739         /* This might fail. What matters are the results. */
 740         (void) fchown(fd, uid, -1);
 741         (void) fchmod(fd, TTY_MODE);
 742
 743         if (fstat(fd, &st) < 0)
 744                 return -errno;
 745
 746         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 747                 return -EPERM;
 748
 749         return 0;
 750 }
 751
 752 static int setup_confirm_stdio(const char *vc, int *_saved_stdin, int *_saved_stdout) {
 753         _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
 754         int r;
 755
 756         assert(_saved_stdin);
 757         assert(_saved_stdout);
 758
 759         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 760         if (saved_stdin < 0)
 761                 return -errno;
 762
 763         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 764         if (saved_stdout < 0)
 765                 return -errno;
 766
 767         fd = acquire_terminal(vc, ACQUIRE_TERMINAL_WAIT, DEFAULT_CONFIRM_USEC);
 768         if (fd < 0)
 769                 return fd;
 770
 771         r = chown_terminal(fd, getuid());
 772         if (r < 0)
 773                 return r;
 774
 775         r = reset_terminal_fd(fd, true);
 776         if (r < 0)
 777                 return r;
 778
 779         r = rearrange_stdio(fd, fd, STDERR_FILENO);
 780         fd = -1;
 781         if (r < 0)
 782                 return r;
 783
 784         *_saved_stdin = saved_stdin;
 785         *_saved_stdout = saved_stdout;
 786
 787         saved_stdin = saved_stdout = -1;
 788
 789         return 0;
 790 }
 791
 792 static void write_confirm_error_fd(int err, int fd, const Unit *u) {
 793         assert(err < 0);
 794
 795         if (err == -ETIMEDOUT)
 796                 dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);
 797         else {
 798                 errno = -err;
 799                 dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);
 800         }
 801 }
 802
 803 static void write_confirm_error(int err, const char *vc, const Unit *u) {
 804         _cleanup_close_ int fd = -1;
 805
 806         assert(vc);
 807
 808         fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);
 809         if (fd < 0)
 810                 return;
 811
 812         write_confirm_error_fd(err, fd, u);
 813 }
 814
 815 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
 816         int r = 0;
 817
 818         assert(saved_stdin);
 819         assert(saved_stdout);
 820
 821         release_terminal();
 822
 823         if (*saved_stdin >= 0)
 824                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 825                         r = -errno;
 826
 827         if (*saved_stdout >= 0)
 828                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 829                         r = -errno;
 830
 831         *saved_stdin = safe_close(*saved_stdin);
 832         *saved_stdout = safe_close(*saved_stdout);
 833
 834         return r;
 835 }
 836
 837 enum {
 838         CONFIRM_PRETEND_FAILURE = -1,
 839         CONFIRM_PRETEND_SUCCESS =  0,
 840         CONFIRM_EXECUTE = 1,
 841 };
 842
 843 static int ask_for_confirmation(const char *vc, Unit *u, const char *cmdline) {
 844         int saved_stdout = -1, saved_stdin = -1, r;
 845         _cleanup_free_ char *e = NULL;
 846         char c;
 847
 848         /* For any internal errors, assume a positive response. */
 849         r = setup_confirm_stdio(vc, &saved_stdin, &saved_stdout);
 850         if (r < 0) {
 851                 write_confirm_error(r, vc, u);
 852                 return CONFIRM_EXECUTE;
 853         }
 854
 855         /* confirm_spawn might have been disabled while we were sleeping. */
 856         if (manager_is_confirm_spawn_disabled(u->manager)) {
 857                 r = 1;
 858                 goto restore_stdio;
 859         }
 860
 861         e = ellipsize(cmdline, 60, 100);
 862         if (!e) {
 863                 log_oom();
 864                 r = CONFIRM_EXECUTE;
 865                 goto restore_stdio;
 866         }
 867
 868         for (;;) {
 869                 r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);
 870                 if (r < 0) {
 871                         write_confirm_error_fd(r, STDOUT_FILENO, u);
 872                         r = CONFIRM_EXECUTE;
 873                         goto restore_stdio;
 874                 }
 875
 876                 switch (c) {
 877                 case 'c':
 878                         printf("Resuming normal execution.\n");
 879                         manager_disable_confirm_spawn();
 880                         r = 1;
 881                         break;
 882                 case 'D':
 883                         unit_dump(u, stdout, "  ");
 884                         continue; /* ask again */
 885                 case 'f':
 886                         printf("Failing execution.\n");
 887                         r = CONFIRM_PRETEND_FAILURE;
 888                         break;
 889                 case 'h':
 890                         printf("  c - continue, proceed without asking anymore\n"
 891                                "  D - dump, show the state of the unit\n"
 892                                "  f - fail, don't execute the command and pretend it failed\n"
 893                                "  h - help\n"
 894                                "  i - info, show a short summary of the unit\n"
 895                                "  j - jobs, show jobs that are in progress\n"
 896                                "  s - skip, don't execute the command and pretend it succeeded\n"
 897                                "  y - yes, execute the command\n");
 898                         continue; /* ask again */
 899                 case 'i':
 900                         printf("  Description: %s\n"
 901                                "  Unit:        %s\n"
 902                                "  Command:     %s\n",
 903                                u->id, u->description, cmdline);
 904                         continue; /* ask again */
 905                 case 'j':
 906                         manager_dump_jobs(u->manager, stdout, "  ");
 907                         continue; /* ask again */
 908                 case 'n':
 909                         /* 'n' was removed in favor of 'f'. */
 910                         printf("Didn't understand 'n', did you mean 'f'?\n");
 911                         continue; /* ask again */
 912                 case 's':
 913                         printf("Skipping execution.\n");
 914                         r = CONFIRM_PRETEND_SUCCESS;
 915                         break;
 916                 case 'y':
 917                         r = CONFIRM_EXECUTE;
 918                         break;
 919                 default:
 920                         assert_not_reached("Unhandled choice");
 921                 }
 922                 break;
 923         }
 924
 925 restore_stdio:
 926         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 927         return r;
 928 }
 929
 930 static int get_fixed_user(const ExecContext *c, const char **user,
 931                           uid_t *uid, gid_t *gid,
 932                           const char **home, const char **shell) {
 933         int r;
 934         const char *name;
 935
 936         assert(c);
 937
 938         if (!c->user)
 939                 return 0;
 940
 941         /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway
 942          * (i.e. are "/" or "/bin/nologin"). */
 943
 944         name = c->user;
 945         r = get_user_creds(&name, uid, gid, home, shell, USER_CREDS_CLEAN);
 946         if (r < 0)
 947                 return r;
 948
 949         *user = name;
 950         return 0;
 951 }
 952
 953 static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {
 954         int r;
 955         const char *name;
 956
 957         assert(c);
 958
 959         if (!c->group)
 960                 return 0;
 961
 962         name = c->group;
 963         r = get_group_creds(&name, gid, 0);
 964         if (r < 0)
 965                 return r;
 966
 967         *group = name;
 968         return 0;
 969 }
 970
 971 static int get_supplementary_groups(const ExecContext *c, const char *user,
 972                                     const char *group, gid_t gid,
 973                                     gid_t **supplementary_gids, int *ngids) {
 974         char **i;
 975         int r, k = 0;
 976         int ngroups_max;
 977         bool keep_groups = false;
 978         gid_t *groups = NULL;
 979         _cleanup_free_ gid_t *l_gids = NULL;
 980
 981         assert(c);
 982
 983         /*
 984          * If user is given, then lookup GID and supplementary groups list.
 985          * We avoid NSS lookups for gid=0. Also we have to initialize groups
 986          * here and as early as possible so we keep the list of supplementary
 987          * groups of the caller.
 988          */
 989         if (user && gid_is_valid(gid) && gid != 0) {
 990                 /* First step, initialize groups from /etc/groups */
 991                 if (initgroups(user, gid) < 0)
 992                         return -errno;
 993
 994                 keep_groups = true;
 995         }
 996
 997         if (strv_isempty(c->supplementary_groups))
 998                 return 0;
 999
1000         /*
1001          * If SupplementaryGroups= was passed then NGROUPS_MAX has to
1002          * be positive, otherwise fail.
1003          */
1004         errno = 0;
1005         ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
1006         if (ngroups_max <= 0) {
1007                 if (errno > 0)
1008                         return -errno;
1009                 else
1010                         return -EOPNOTSUPP; /* For all other values */
1011         }
1012
1013         l_gids = new(gid_t, ngroups_max);
1014         if (!l_gids)
1015                 return -ENOMEM;
1016
1017         if (keep_groups) {
1018                 /*
1019                  * Lookup the list of groups that the user belongs to, we
1020                  * avoid NSS lookups here too for gid=0.
1021                  */
1022                 k = ngroups_max;
1023                 if (getgrouplist(user, gid, l_gids, &k) < 0)
1024                         return -EINVAL;
1025         } else
1026                 k = 0;
1027
1028         STRV_FOREACH(i, c->supplementary_groups) {
1029                 const char *g;
1030
1031                 if (k >= ngroups_max)
1032                         return -E2BIG;
1033
1034                 g = *i;
1035                 r = get_group_creds(&g, l_gids+k, 0);
1036                 if (r < 0)
1037                         return r;
1038
1039                 k++;
1040         }
1041
1042         /*
1043          * Sets ngids to zero to drop all supplementary groups, happens
1044          * when we are under root and SupplementaryGroups= is empty.
1045          */
1046         if (k == 0) {
1047                 *ngids = 0;
1048                 return 0;
1049         }
1050
1051         /* Otherwise get the final list of supplementary groups */
1052         groups = memdup(l_gids, sizeof(gid_t) * k);
1053         if (!groups)
1054                 return -ENOMEM;
1055
1056         *supplementary_gids = groups;
1057         *ngids = k;
1058
1059         groups = NULL;
1060
1061         return 0;
1062 }
1063
1064 static int enforce_groups(gid_t gid, const gid_t *supplementary_gids, int ngids) {
1065         int r;
1066
1067         /* Handle SupplementaryGroups= if it is not empty */
1068         if (ngids > 0) {
1069                 r = maybe_setgroups(ngids, supplementary_gids);
1070                 if (r < 0)
1071                         return r;
1072         }
1073
1074         if (gid_is_valid(gid)) {
1075                 /* Then set our gids */
1076                 if (setresgid(gid, gid, gid) < 0)
1077                         return -errno;
1078         }
1079
1080         return 0;
1081 }
1082
1083 static int enforce_user(const ExecContext *context, uid_t uid) {
1084         assert(context);
1085
1086         if (!uid_is_valid(uid))
1087                 return 0;
1088
1089         /* Sets (but doesn't look up) the uid and make sure we keep the
1090          * capabilities while doing so. */
1091
1092         if (context->capability_ambient_set != 0) {
1093
1094                 /* First step: If we need to keep capabilities but
1095                  * drop privileges we need to make sure we keep our
1096                  * caps, while we drop privileges. */
1097                 if (uid != 0) {
1098                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
1099
1100                         if (prctl(PR_GET_SECUREBITS) != sb)
1101                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
1102                                         return -errno;
1103                 }
1104         }
1105
1106         /* Second step: actually set the uids */
1107         if (setresuid(uid, uid, uid) < 0)
1108                 return -errno;
1109
1110         /* At this point we should have all necessary capabilities but
1111            are otherwise a normal user. However, the caps might got
1112            corrupted due to the setresuid() so we need clean them up
1113            later. This is done outside of this call. */
1114
1115         return 0;
1116 }
1117
1118 #if HAVE_PAM
1119
1120 static int null_conv(
1121                 int num_msg,
1122                 const struct pam_message **msg,
1123                 struct pam_response **resp,
1124                 void *appdata_ptr) {
1125
1126         /* We don't support conversations */
1127
1128         return PAM_CONV_ERR;
1129 }
1130
1131 #endif
1132
1133 static int setup_pam(
1134                 const char *name,
1135                 const char *user,
1136                 uid_t uid,
1137                 gid_t gid,
1138                 const char *tty,
1139                 char ***env,
1140                 int fds[], size_t n_fds) {
1141
1142 #if HAVE_PAM
1143
1144         static const struct pam_conv conv = {
1145                 .conv = null_conv,
1146                 .appdata_ptr = NULL
1147         };
1148
1149         _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
1150         pam_handle_t *handle = NULL;
1151         sigset_t old_ss;
1152         int pam_code = PAM_SUCCESS, r;
1153         char **nv, **e = NULL;
1154         bool close_session = false;
1155         pid_t pam_pid = 0, parent_pid;
1156         int flags = 0;
1157
1158         assert(name);
1159         assert(user);
1160         assert(env);
1161
1162         /* We set up PAM in the parent process, then fork. The child
1163          * will then stay around until killed via PR_GET_PDEATHSIG or
1164          * systemd via the cgroup logic. It will then remove the PAM
1165          * session again. The parent process will exec() the actual
1166          * daemon. We do things this way to ensure that the main PID
1167          * of the daemon is the one we initially fork()ed. */
1168
1169         r = barrier_create(&barrier);
1170         if (r < 0)
1171                 goto fail;
1172
1173         if (log_get_max_level() < LOG_DEBUG)
1174                 flags |= PAM_SILENT;
1175
1176         pam_code = pam_start(name, user, &conv, &handle);
1177         if (pam_code != PAM_SUCCESS) {
1178                 handle = NULL;
1179                 goto fail;
1180         }
1181
1182         if (!tty) {
1183                 _cleanup_free_ char *q = NULL;
1184
1185                 /* Hmm, so no TTY was explicitly passed, but an fd passed to us directly might be a TTY. Let's figure
1186                  * out if that's the case, and read the TTY off it. */
1187
1188                 if (getttyname_malloc(STDIN_FILENO, &q) >= 0)
1189                         tty = strjoina("/dev/", q);
1190         }
1191
1192         if (tty) {
1193                 pam_code = pam_set_item(handle, PAM_TTY, tty);
1194                 if (pam_code != PAM_SUCCESS)
1195                         goto fail;
1196         }
1197
1198         STRV_FOREACH(nv, *env) {
1199                 pam_code = pam_putenv(handle, *nv);
1200                 if (pam_code != PAM_SUCCESS)
1201                         goto fail;
1202         }
1203
1204         pam_code = pam_acct_mgmt(handle, flags);
1205         if (pam_code != PAM_SUCCESS)
1206                 goto fail;
1207
1208         pam_code = pam_open_session(handle, flags);
1209         if (pam_code != PAM_SUCCESS)
1210                 goto fail;
1211
1212         close_session = true;
1213
1214         e = pam_getenvlist(handle);
1215         if (!e) {
1216                 pam_code = PAM_BUF_ERR;
1217                 goto fail;
1218         }
1219
1220         /* Block SIGTERM, so that we know that it won't get lost in
1221          * the child */
1222
1223         assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
1224
1225         parent_pid = getpid_cached();
1226
1227         r = safe_fork("(sd-pam)", 0, &pam_pid);
1228         if (r < 0)
1229                 goto fail;
1230         if (r == 0) {
1231                 int sig, ret = EXIT_PAM;
1232
1233                 /* The child's job is to reset the PAM session on
1234                  * termination */
1235                 barrier_set_role(&barrier, BARRIER_CHILD);
1236
1237                 /* Make sure we don't keep open the passed fds in this child. We assume that otherwise only those fds
1238                  * are open here that have been opened by PAM. */
1239                 (void) close_many(fds, n_fds);
1240
1241                 /* Drop privileges - we don't need any to pam_close_session
1242                  * and this will make PR_SET_PDEATHSIG work in most cases.
1243                  * If this fails, ignore the error - but expect sd-pam threads
1244                  * to fail to exit normally */
1245
1246                 r = maybe_setgroups(0, NULL);
1247                 if (r < 0)
1248                         log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
1249                 if (setresgid(gid, gid, gid) < 0)
1250                         log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
1251                 if (setresuid(uid, uid, uid) < 0)
1252                         log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m");
1253
1254                 (void) ignore_signals(SIGPIPE, -1);
1255
1256                 /* Wait until our parent died. This will only work if
1257                  * the above setresuid() succeeds, otherwise the kernel
1258                  * will not allow unprivileged parents kill their privileged
1259                  * children this way. We rely on the control groups kill logic
1260                  * to do the rest for us. */
1261                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
1262                         goto child_finish;
1263
1264                 /* Tell the parent that our setup is done. This is especially
1265                  * important regarding dropping privileges. Otherwise, unit
1266                  * setup might race against our setresuid(2) call.
1267                  *
1268                  * If the parent aborted, we'll detect this below, hence ignore
1269                  * return failure here. */
1270                 (void) barrier_place(&barrier);
1271
1272                 /* Check if our parent process might already have died? */
1273                 if (getppid() == parent_pid) {
1274                         sigset_t ss;
1275
1276                         assert_se(sigemptyset(&ss) >= 0);
1277                         assert_se(sigaddset(&ss, SIGTERM) >= 0);
1278
1279                         for (;;) {
1280                                 if (sigwait(&ss, &sig) < 0) {
1281                                         if (errno == EINTR)
1282                                                 continue;
1283
1284                                         goto child_finish;
1285                                 }
1286
1287                                 assert(sig == SIGTERM);
1288                                 break;
1289                         }
1290                 }
1291
1292                 /* If our parent died we'll end the session */
1293                 if (getppid() != parent_pid) {
1294                         pam_code = pam_close_session(handle, flags);
1295                         if (pam_code != PAM_SUCCESS)
1296                                 goto child_finish;
1297                 }
1298
1299                 ret = 0;
1300
1301         child_finish:
1302                 pam_end(handle, pam_code | flags);
1303                 _exit(ret);
1304         }
1305
1306         barrier_set_role(&barrier, BARRIER_PARENT);
1307
1308         /* If the child was forked off successfully it will do all the
1309          * cleanups, so forget about the handle here. */
1310         handle = NULL;
1311
1312         /* Unblock SIGTERM again in the parent */
1313         assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
1314
1315         /* We close the log explicitly here, since the PAM modules
1316          * might have opened it, but we don't want this fd around. */
1317         closelog();
1318
1319         /* Synchronously wait for the child to initialize. We don't care for
1320          * errors as we cannot recover. However, warn loudly if it happens. */
1321         if (!barrier_place_and_sync(&barrier))
1322                 log_error("PAM initialization failed");
1323
1324         return strv_free_and_replace(*env, e);
1325
1326 fail:
1327         if (pam_code != PAM_SUCCESS) {
1328                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1329                 r = -EPERM;  /* PAM errors do not map to errno */
1330         } else
1331                 log_error_errno(r, "PAM failed: %m");
1332
1333         if (handle) {
1334                 if (close_session)
1335                         pam_code = pam_close_session(handle, flags);
1336
1337                 pam_end(handle, pam_code | flags);
1338         }
1339
1340         strv_free(e);
1341         closelog();
1342
1343         return r;
1344 #else
1345         return 0;
1346 #endif
1347 }
1348
1349 static void rename_process_from_path(const char *path) {
1350         char process_name[11];
1351         const char *p;
1352         size_t l;
1353
1354         /* This resulting string must fit in 10 chars (i.e. the length
1355          * of "/sbin/init") to look pretty in /bin/ps */
1356
1357         p = basename(path);
1358         if (isempty(p)) {
1359                 rename_process("(...)");
1360                 return;
1361         }
1362
1363         l = strlen(p);
1364         if (l > 8) {
1365                 /* The end of the process name is usually more
1366                  * interesting, since the first bit might just be
1367                  * "systemd-" */
1368                 p = p + l - 8;
1369                 l = 8;
1370         }
1371
1372         process_name[0] = '(';
1373         memcpy(process_name+1, p, l);
1374         process_name[1+l] = ')';
1375         process_name[1+l+1] = 0;
1376
1377         rename_process(process_name);
1378 }
1379
1380 static bool context_has_address_families(const ExecContext *c) {
1381         assert(c);
1382
1383         return c->address_families_whitelist ||
1384                 !set_isempty(c->address_families);
1385 }
1386
1387 static bool context_has_syscall_filters(const ExecContext *c) {
1388         assert(c);
1389
1390         return c->syscall_whitelist ||
1391                 !hashmap_isempty(c->syscall_filter);
1392 }
1393
1394 static bool context_has_no_new_privileges(const ExecContext *c) {
1395         assert(c);
1396
1397         if (c->no_new_privileges)
1398                 return true;
1399
1400         if (have_effective_cap(CAP_SYS_ADMIN)) /* if we are privileged, we don't need NNP */
1401                 return false;
1402
1403         /* We need NNP if we have any form of seccomp and are unprivileged */
1404         return context_has_address_families(c) ||
1405                 c->memory_deny_write_execute ||
1406                 c->restrict_realtime ||
1407                 c->restrict_suid_sgid ||
1408                 exec_context_restrict_namespaces_set(c) ||
1409                 c->protect_kernel_tunables ||
1410                 c->protect_kernel_modules ||
1411                 c->private_devices ||
1412                 context_has_syscall_filters(c) ||
1413                 !set_isempty(c->syscall_archs) ||
1414                 c->lock_personality ||
1415                 c->protect_hostname;
1416 }
1417
1418 #if HAVE_SECCOMP
1419
1420 static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
1421
1422         if (is_seccomp_available())
1423                 return false;
1424
1425         log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
1426         return true;
1427 }
1428
1429 static int apply_syscall_filter(const Unit* u, const ExecContext *c, bool needs_ambient_hack) {
1430         uint32_t negative_action, default_action, action;
1431         int r;
1432
1433         assert(u);
1434         assert(c);
1435
1436         if (!context_has_syscall_filters(c))
1437                 return 0;
1438
1439         if (skip_seccomp_unavailable(u, "SystemCallFilter="))
1440                 return 0;
1441
1442         negative_action = c->syscall_errno == 0 ? scmp_act_kill_process() : SCMP_ACT_ERRNO(c->syscall_errno);
1443
1444         if (c->syscall_whitelist) {
1445                 default_action = negative_action;
1446                 action = SCMP_ACT_ALLOW;
1447         } else {
1448                 default_action = SCMP_ACT_ALLOW;
1449                 action = negative_action;
1450         }
1451
1452         if (needs_ambient_hack) {
1453                 r = seccomp_filter_set_add(c->syscall_filter, c->syscall_whitelist, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID);
1454                 if (r < 0)
1455                         return r;
1456         }
1457
1458         return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false);
1459 }
1460
1461 static int apply_syscall_archs(const Unit *u, const ExecContext *c) {
1462         assert(u);
1463         assert(c);
1464
1465         if (set_isempty(c->syscall_archs))
1466                 return 0;
1467
1468         if (skip_seccomp_unavailable(u, "SystemCallArchitectures="))
1469                 return 0;
1470
1471         return seccomp_restrict_archs(c->syscall_archs);
1472 }
1473
1474 static int apply_address_families(const Unit* u, const ExecContext *c) {
1475         assert(u);
1476         assert(c);
1477
1478         if (!context_has_address_families(c))
1479                 return 0;
1480
1481         if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1482                 return 0;
1483
1484         return seccomp_restrict_address_families(c->address_families, c->address_families_whitelist);
1485 }
1486
1487 static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
1488         assert(u);
1489         assert(c);
1490
1491         if (!c->memory_deny_write_execute)
1492                 return 0;
1493
1494         if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1495                 return 0;
1496
1497         return seccomp_memory_deny_write_execute();
1498 }
1499
1500 static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
1501         assert(u);
1502         assert(c);
1503
1504         if (!c->restrict_realtime)
1505                 return 0;
1506
1507         if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1508                 return 0;
1509
1510         return seccomp_restrict_realtime();
1511 }
1512
1513 static int apply_restrict_suid_sgid(const Unit* u, const ExecContext *c) {
1514         assert(u);
1515         assert(c);
1516
1517         if (!c->restrict_suid_sgid)
1518                 return 0;
1519
1520         if (skip_seccomp_unavailable(u, "RestrictSUIDSGID="))
1521                 return 0;
1522
1523         return seccomp_restrict_suid_sgid();
1524 }
1525
1526 static int apply_protect_sysctl(const Unit *u, const ExecContext *c) {
1527         assert(u);
1528         assert(c);
1529
1530         /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1531          * let's protect even those systems where this is left on in the kernel. */
1532
1533         if (!c->protect_kernel_tunables)
1534                 return 0;
1535
1536         if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1537                 return 0;
1538
1539         return seccomp_protect_sysctl();
1540 }
1541
1542 static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
1543         assert(u);
1544         assert(c);
1545
1546         /* Turn off module syscalls on ProtectKernelModules=yes */
1547
1548         if (!c->protect_kernel_modules)
1549                 return 0;
1550
1551         if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
1552                 return 0;
1553
1554         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM), false);
1555 }
1556
1557 static int apply_private_devices(const Unit *u, const ExecContext *c) {
1558         assert(u);
1559         assert(c);
1560
1561         /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */
1562
1563         if (!c->private_devices)
1564                 return 0;
1565
1566         if (skip_seccomp_unavailable(u, "PrivateDevices="))
1567                 return 0;
1568
1569         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM), false);
1570 }
1571
1572 static int apply_restrict_namespaces(const Unit *u, const ExecContext *c) {
1573         assert(u);
1574         assert(c);
1575
1576         if (!exec_context_restrict_namespaces_set(c))
1577                 return 0;
1578
1579         if (skip_seccomp_unavailable(u, "RestrictNamespaces="))
1580                 return 0;
1581
1582         return seccomp_restrict_namespaces(c->restrict_namespaces);
1583 }
1584
1585 static int apply_lock_personality(const Unit* u, const ExecContext *c) {
1586         unsigned long personality;
1587         int r;
1588
1589         assert(u);
1590         assert(c);
1591
1592         if (!c->lock_personality)
1593                 return 0;
1594
1595         if (skip_seccomp_unavailable(u, "LockPersonality="))
1596                 return 0;
1597
1598         personality = c->personality;
1599
1600         /* If personality is not specified, use either PER_LINUX or PER_LINUX32 depending on what is currently set. */
1601         if (personality == PERSONALITY_INVALID) {
1602
1603                 r = opinionated_personality(&personality);
1604                 if (r < 0)
1605                         return r;
1606         }
1607
1608         return seccomp_lock_personality(personality);
1609 }
1610
1611 #endif
1612
1613 static void do_idle_pipe_dance(int idle_pipe[static 4]) {
1614         assert(idle_pipe);
1615
1616         idle_pipe[1] = safe_close(idle_pipe[1]);
1617         idle_pipe[2] = safe_close(idle_pipe[2]);
1618
1619         if (idle_pipe[0] >= 0) {
1620                 int r;
1621
1622                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1623
1624                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1625                         ssize_t n;
1626
1627                         /* Signal systemd that we are bored and want to continue. */
1628                         n = write(idle_pipe[3], "x", 1);
1629                         if (n > 0)
1630                                 /* Wait for systemd to react to the signal above. */
1631                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1632                 }
1633
1634                 idle_pipe[0] = safe_close(idle_pipe[0]);
1635
1636         }
1637
1638         idle_pipe[3] = safe_close(idle_pipe[3]);
1639 }
1640
1641 static const char *exec_directory_env_name_to_string(ExecDirectoryType t);
1642
1643 static int build_environment(
1644                 const Unit *u,
1645                 const ExecContext *c,
1646                 const ExecParameters *p,
1647                 size_t n_fds,
1648                 const char *home,
1649                 const char *username,
1650                 const char *shell,
1651                 dev_t journal_stream_dev,
1652                 ino_t journal_stream_ino,
1653                 char ***ret) {
1654
1655         _cleanup_strv_free_ char **our_env = NULL;
1656         ExecDirectoryType t;
1657         size_t n_env = 0;
1658         char *x;
1659
1660         assert(u);
1661         assert(c);
1662         assert(p);
1663         assert(ret);
1664
1665         our_env = new0(char*, 14 + _EXEC_DIRECTORY_TYPE_MAX);
1666         if (!our_env)
1667                 return -ENOMEM;
1668
1669         if (n_fds > 0) {
1670                 _cleanup_free_ char *joined = NULL;
1671
1672                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid_cached()) < 0)
1673                         return -ENOMEM;
1674                 our_env[n_env++] = x;
1675
1676                 if (asprintf(&x, "LISTEN_FDS=%zu", n_fds) < 0)
1677                         return -ENOMEM;
1678                 our_env[n_env++] = x;
1679
1680                 joined = strv_join(p->fd_names, ":");
1681                 if (!joined)
1682                         return -ENOMEM;
1683
1684                 x = strjoin("LISTEN_FDNAMES=", joined);
1685                 if (!x)
1686                         return -ENOMEM;
1687                 our_env[n_env++] = x;
1688         }
1689
1690         if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
1691                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid_cached()) < 0)
1692                         return -ENOMEM;
1693                 our_env[n_env++] = x;
1694
1695                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1696                         return -ENOMEM;
1697                 our_env[n_env++] = x;
1698         }
1699
1700         /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use D-Bus look up dynamic
1701          * users via PID 1, possibly dead-locking the dbus daemon. This way it will not use D-Bus to resolve names, but
1702          * check the database directly. */
1703         if (p->flags & EXEC_NSS_BYPASS_BUS) {
1704                 x = strdup("SYSTEMD_NSS_BYPASS_BUS=1");
1705                 if (!x)
1706                         return -ENOMEM;
1707                 our_env[n_env++] = x;
1708         }
1709
1710         if (home) {
1711                 x = strappend("HOME=", home);
1712                 if (!x)
1713                         return -ENOMEM;
1714
1715                 path_simplify(x + 5, true);
1716                 our_env[n_env++] = x;
1717         }
1718
1719         if (username) {
1720                 x = strappend("LOGNAME=", username);
1721                 if (!x)
1722                         return -ENOMEM;
1723                 our_env[n_env++] = x;
1724
1725                 x = strappend("USER=", username);
1726                 if (!x)
1727                         return -ENOMEM;
1728                 our_env[n_env++] = x;
1729         }
1730
1731         if (shell) {
1732                 x = strappend("SHELL=", shell);
1733                 if (!x)
1734                         return -ENOMEM;
1735
1736                 path_simplify(x + 6, true);
1737                 our_env[n_env++] = x;
1738         }
1739
1740         if (!sd_id128_is_null(u->invocation_id)) {
1741                 if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0)
1742                         return -ENOMEM;
1743
1744                 our_env[n_env++] = x;
1745         }
1746
1747         if (exec_context_needs_term(c)) {
1748                 const char *tty_path, *term = NULL;
1749
1750                 tty_path = exec_context_tty_path(c);
1751
1752                 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try to inherit
1753                  * the $TERM set for PID 1. This is useful for containers so that the $TERM the container manager
1754                  * passes to PID 1 ends up all the way in the console login shown. */
1755
1756                 if (path_equal(tty_path, "/dev/console") && getppid() == 1)
1757                         term = getenv("TERM");
1758                 if (!term)
1759                         term = default_term_for_tty(tty_path);
1760
1761                 x = strappend("TERM=", term);
1762                 if (!x)
1763                         return -ENOMEM;
1764                 our_env[n_env++] = x;
1765         }
1766
1767         if (journal_stream_dev != 0 && journal_stream_ino != 0) {
1768                 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
1769                         return -ENOMEM;
1770
1771                 our_env[n_env++] = x;
1772         }
1773
1774         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
1775                 _cleanup_free_ char *pre = NULL, *joined = NULL;
1776                 const char *n;
1777
1778                 if (!p->prefix[t])
1779                         continue;
1780
1781                 if (strv_isempty(c->directories[t].paths))
1782                         continue;
1783
1784                 n = exec_directory_env_name_to_string(t);
1785                 if (!n)
1786                         continue;
1787
1788                 pre = strjoin(p->prefix[t], "/");
1789                 if (!pre)
1790                         return -ENOMEM;
1791
1792                 joined = strv_join_prefix(c->directories[t].paths, ":", pre);
1793                 if (!joined)
1794                         return -ENOMEM;
1795
1796                 x = strjoin(n, "=", joined);
1797                 if (!x)
1798                         return -ENOMEM;
1799
1800                 our_env[n_env++] = x;
1801         }
1802
1803         our_env[n_env++] = NULL;
1804         assert(n_env <= 14 + _EXEC_DIRECTORY_TYPE_MAX);
1805
1806         *ret = TAKE_PTR(our_env);
1807
1808         return 0;
1809 }
1810
1811 static int build_pass_environment(const ExecContext *c, char ***ret) {
1812         _cleanup_strv_free_ char **pass_env = NULL;
1813         size_t n_env = 0, n_bufsize = 0;
1814         char **i;
1815
1816         STRV_FOREACH(i, c->pass_environment) {
1817                 _cleanup_free_ char *x = NULL;
1818                 char *v;
1819
1820                 v = getenv(*i);
1821                 if (!v)
1822                         continue;
1823                 x = strjoin(*i, "=", v);
1824                 if (!x)
1825                         return -ENOMEM;
1826
1827                 if (!GREEDY_REALLOC(pass_env, n_bufsize, n_env + 2))
1828                         return -ENOMEM;
1829
1830                 pass_env[n_env++] = TAKE_PTR(x);
1831                 pass_env[n_env] = NULL;
1832         }
1833
1834         *ret = TAKE_PTR(pass_env);
1835
1836         return 0;
1837 }
1838
1839 static bool exec_needs_mount_namespace(
1840                 const ExecContext *context,
1841                 const ExecParameters *params,
1842                 const ExecRuntime *runtime) {
1843
1844         assert(context);
1845         assert(params);
1846
1847         if (context->root_image)
1848                 return true;
1849
1850         if (!strv_isempty(context->read_write_paths) ||
1851             !strv_isempty(context->read_only_paths) ||
1852             !strv_isempty(context->inaccessible_paths))
1853                 return true;
1854
1855         if (context->n_bind_mounts > 0)
1856                 return true;
1857
1858         if (context->n_temporary_filesystems > 0)
1859                 return true;
1860
1861         if (!IN_SET(context->mount_flags, 0, MS_SHARED))
1862                 return true;
1863
1864         if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
1865                 return true;
1866
1867         if (context->private_devices ||
1868             context->private_mounts ||
1869             context->protect_system != PROTECT_SYSTEM_NO ||
1870             context->protect_home != PROTECT_HOME_NO ||
1871             context->protect_kernel_tunables ||
1872             context->protect_kernel_modules ||
1873             context->protect_control_groups)
1874                 return true;
1875
1876         if (context->root_directory) {
1877                 ExecDirectoryType t;
1878
1879                 if (context->mount_apivfs)
1880                         return true;
1881
1882                 for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
1883                         if (!params->prefix[t])
1884                                 continue;
1885
1886                         if (!strv_isempty(context->directories[t].paths))
1887                                 return true;
1888                 }
1889         }
1890
1891         if (context->dynamic_user &&
1892             (!strv_isempty(context->directories[EXEC_DIRECTORY_STATE].paths) ||
1893              !strv_isempty(context->directories[EXEC_DIRECTORY_CACHE].paths) ||
1894              !strv_isempty(context->directories[EXEC_DIRECTORY_LOGS].paths)))
1895                 return true;
1896
1897         return false;
1898 }
1899
1900 static int setup_private_users(uid_t uid, gid_t gid) {
1901         _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
1902         _cleanup_close_pair_ int errno_pipe[2] = { -1, -1 };
1903         _cleanup_close_ int unshare_ready_fd = -1;
1904         _cleanup_(sigkill_waitp) pid_t pid = 0;
1905         uint64_t c = 1;
1906         ssize_t n;
1907         int r;
1908
1909         /* Set up a user namespace and map root to root, the selected UID/GID to itself, and everything else to
1910          * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
1911          * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
1912          * which waits for the parent to create the new user namespace while staying in the original namespace. The
1913          * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
1914          * continues execution normally. */
1915
1916         if (uid != 0 && uid_is_valid(uid)) {
1917                 r = asprintf(&uid_map,
1918                              "0 0 1\n"                      /* Map root → root */
1919                              UID_FMT " " UID_FMT " 1\n",    /* Map $UID → $UID */
1920                              uid, uid);
1921                 if (r < 0)
1922                         return -ENOMEM;
1923         } else {
1924                 uid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1925                 if (!uid_map)
1926                         return -ENOMEM;
1927         }
1928
1929         if (gid != 0 && gid_is_valid(gid)) {
1930                 r = asprintf(&gid_map,
1931                              "0 0 1\n"                      /* Map root → root */
1932                              GID_FMT " " GID_FMT " 1\n",    /* Map $GID → $GID */
1933                              gid, gid);
1934                 if (r < 0)
1935                         return -ENOMEM;
1936         } else {
1937                 gid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1938                 if (!gid_map)
1939                         return -ENOMEM;
1940         }
1941
1942         /* Create a communication channel so that the parent can tell the child when it finished creating the user
1943          * namespace. */
1944         unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
1945         if (unshare_ready_fd < 0)
1946                 return -errno;
1947
1948         /* Create a communication channel so that the child can tell the parent a proper error code in case it
1949          * failed. */
1950         if (pipe2(errno_pipe, O_CLOEXEC) < 0)
1951                 return -errno;
1952
1953         r = safe_fork("(sd-userns)", FORK_RESET_SIGNALS|FORK_DEATHSIG, &pid);
1954         if (r < 0)
1955                 return r;
1956         if (r == 0) {
1957                 _cleanup_close_ int fd = -1;
1958                 const char *a;
1959                 pid_t ppid;
1960
1961                 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
1962                  * here, after the parent opened its own user namespace. */
1963
1964                 ppid = getppid();
1965                 errno_pipe[0] = safe_close(errno_pipe[0]);
1966
1967                 /* Wait until the parent unshared the user namespace */
1968                 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
1969                         r = -errno;
1970                         goto child_fail;
1971                 }
1972
1973                 /* Disable the setgroups() system call in the child user namespace, for good. */
1974                 a = procfs_file_alloca(ppid, "setgroups");
1975                 fd = open(a, O_WRONLY|O_CLOEXEC);
1976                 if (fd < 0) {
1977                         if (errno != ENOENT) {
1978                                 r = -errno;
1979                                 goto child_fail;
1980                         }
1981
1982                         /* If the file is missing the kernel is too old, let's continue anyway. */
1983                 } else {
1984                         if (write(fd, "deny\n", 5) < 0) {
1985                                 r = -errno;
1986                                 goto child_fail;
1987                         }
1988
1989                         fd = safe_close(fd);
1990                 }
1991
1992                 /* First write the GID map */
1993                 a = procfs_file_alloca(ppid, "gid_map");
1994                 fd = open(a, O_WRONLY|O_CLOEXEC);
1995                 if (fd < 0) {
1996                         r = -errno;
1997                         goto child_fail;
1998                 }
1999                 if (write(fd, gid_map, strlen(gid_map)) < 0) {
2000                         r = -errno;
2001                         goto child_fail;
2002                 }
2003                 fd = safe_close(fd);
2004
2005                 /* The write the UID map */
2006                 a = procfs_file_alloca(ppid, "uid_map");
2007                 fd = open(a, O_WRONLY|O_CLOEXEC);
2008                 if (fd < 0) {
2009                         r = -errno;
2010                         goto child_fail;
2011                 }
2012                 if (write(fd, uid_map, strlen(uid_map)) < 0) {
2013                         r = -errno;
2014                         goto child_fail;
2015                 }
2016
2017                 _exit(EXIT_SUCCESS);
2018
2019         child_fail:
2020                 (void) write(errno_pipe[1], &r, sizeof(r));
2021                 _exit(EXIT_FAILURE);
2022         }
2023
2024         errno_pipe[1] = safe_close(errno_pipe[1]);
2025
2026         if (unshare(CLONE_NEWUSER) < 0)
2027                 return -errno;
2028
2029         /* Let the child know that the namespace is ready now */
2030         if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
2031                 return -errno;
2032
2033         /* Try to read an error code from the child */
2034         n = read(errno_pipe[0], &r, sizeof(r));
2035         if (n < 0)
2036                 return -errno;
2037         if (n == sizeof(r)) { /* an error code was sent to us */
2038                 if (r < 0)
2039                         return r;
2040                 return -EIO;
2041         }
2042         if (n != 0) /* on success we should have read 0 bytes */
2043                 return -EIO;
2044
2045         r = wait_for_terminate_and_check("(sd-userns)", pid, 0);
2046         pid = 0;
2047         if (r < 0)
2048                 return r;
2049         if (r != EXIT_SUCCESS) /* If something strange happened with the child, let's consider this fatal, too */
2050                 return -EIO;
2051
2052         return 0;
2053 }
2054
2055 static int setup_exec_directory(
2056                 const ExecContext *context,
2057                 const ExecParameters *params,
2058                 uid_t uid,
2059                 gid_t gid,
2060                 ExecDirectoryType type,
2061                 int *exit_status) {
2062
2063         static const int exit_status_table[_EXEC_DIRECTORY_TYPE_MAX] = {
2064                 [EXEC_DIRECTORY_RUNTIME] = EXIT_RUNTIME_DIRECTORY,
2065                 [EXEC_DIRECTORY_STATE] = EXIT_STATE_DIRECTORY,
2066                 [EXEC_DIRECTORY_CACHE] = EXIT_CACHE_DIRECTORY,
2067                 [EXEC_DIRECTORY_LOGS] = EXIT_LOGS_DIRECTORY,
2068                 [EXEC_DIRECTORY_CONFIGURATION] = EXIT_CONFIGURATION_DIRECTORY,
2069         };
2070         char **rt;
2071         int r;
2072
2073         assert(context);
2074         assert(params);
2075         assert(type >= 0 && type < _EXEC_DIRECTORY_TYPE_MAX);
2076         assert(exit_status);
2077
2078         if (!params->prefix[type])
2079                 return 0;
2080
2081         if (params->flags & EXEC_CHOWN_DIRECTORIES) {
2082                 if (!uid_is_valid(uid))
2083                         uid = 0;
2084                 if (!gid_is_valid(gid))
2085                         gid = 0;
2086         }
2087
2088         STRV_FOREACH(rt, context->directories[type].paths) {
2089                 _cleanup_free_ char *p = NULL, *pp = NULL;
2090
2091                 p = path_join(params->prefix[type], *rt);
2092                 if (!p) {
2093                         r = -ENOMEM;
2094                         goto fail;
2095                 }
2096
2097                 r = mkdir_parents_label(p, 0755);
2098                 if (r < 0)
2099                         goto fail;
2100
2101                 if (context->dynamic_user &&
2102                     (!IN_SET(type, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) ||
2103                      (type == EXEC_DIRECTORY_RUNTIME && context->runtime_directory_preserve_mode != EXEC_PRESERVE_NO))) {
2104                         _cleanup_free_ char *private_root = NULL;
2105
2106                         /* So, here's one extra complication when dealing with DynamicUser=1 units. In that case we
2107                          * want to avoid leaving a directory around fully accessible that is owned by a dynamic user
2108                          * whose UID is later on reused. To lock this down we use the same trick used by container
2109                          * managers to prohibit host users to get access to files of the same UID in containers: we
2110                          * place everything inside a directory that has an access mode of 0700 and is owned root:root,
2111                          * so that it acts as security boundary for unprivileged host code. We then use fs namespacing
2112                          * to make this directory permeable for the service itself.
2113                          *
2114                          * Specifically: for a service which wants a special directory "foo/" we first create a
2115                          * directory "private/" with access mode 0700 owned by root:root. Then we place "foo" inside of
2116                          * that directory (i.e. "private/foo/"), and make "foo" a symlink to "private/foo". This way,
2117                          * privileged host users can access "foo/" as usual, but unprivileged host users can't look
2118                          * into it. Inside of the namespaceof the container "private/" is replaced by a more liberally
2119                          * accessible tmpfs, into which the host's "private/foo/" is mounted under the same name, thus
2120                          * disabling the access boundary for the service and making sure it only gets access to the
2121                          * dirs it needs but no others. Tricky? Yes, absolutely, but it works!
2122                          *
2123                          * Note that we don't do this for EXEC_DIRECTORY_CONFIGURATION as that's assumed not to be
2124                          * owned by the service itself.
2125                          * Also, note that we don't do this for EXEC_DIRECTORY_RUNTIME as that's often used for sharing
2126                          * files or sockets with other services. */
2127
2128                         private_root = path_join(params->prefix[type], "private");
2129                         if (!private_root) {
2130                                 r = -ENOMEM;
2131                                 goto fail;
2132                         }
2133
2134                         /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */
2135                         r = mkdir_safe_label(private_root, 0700, 0, 0, MKDIR_WARN_MODE);
2136                         if (r < 0)
2137                                 goto fail;
2138
2139                         pp = path_join(private_root, *rt);
2140                         if (!pp) {
2141                                 r = -ENOMEM;
2142                                 goto fail;
2143                         }
2144
2145                         /* Create all directories between the configured directory and this private root, and mark them 0755 */
2146                         r = mkdir_parents_label(pp, 0755);
2147                         if (r < 0)
2148                                 goto fail;
2149
2150                         if (is_dir(p, false) > 0 &&
2151                             (laccess(pp, F_OK) < 0 && errno == ENOENT)) {
2152
2153                                 /* Hmm, the private directory doesn't exist yet, but the normal one exists? If so, move
2154                                  * it over. Most likely the service has been upgraded from one that didn't use
2155                                  * DynamicUser=1, to one that does. */
2156
2157                                 if (rename(p, pp) < 0) {
2158                                         r = -errno;
2159                                         goto fail;
2160                                 }
2161                         } else {
2162                                 /* Otherwise, create the actual directory for the service */
2163
2164                                 r = mkdir_label(pp, context->directories[type].mode);
2165                                 if (r < 0 && r != -EEXIST)
2166                                         goto fail;
2167                         }
2168
2169                         /* And link it up from the original place */
2170                         r = symlink_idempotent(pp, p, true);
2171                         if (r < 0)
2172                                 goto fail;
2173
2174                 } else {
2175                         r = mkdir_label(p, context->directories[type].mode);
2176                         if (r < 0) {
2177                                 if (r != -EEXIST)
2178                                         goto fail;
2179
2180                                 if (type == EXEC_DIRECTORY_CONFIGURATION) {
2181                                         struct stat st;
2182
2183                                         /* Don't change the owner/access mode of the configuration directory,
2184                                          * as in the common case it is not written to by a service, and shall
2185                                          * not be writable. */
2186
2187                                         if (stat(p, &st) < 0) {
2188                                                 r = -errno;
2189                                                 goto fail;
2190                                         }
2191
2192                                         /* Still complain if the access mode doesn't match */
2193                                         if (((st.st_mode ^ context->directories[type].mode) & 07777) != 0)
2194                                                 log_warning("%s \'%s\' already exists but the mode is different. "
2195                                                             "(File system: %o %sMode: %o)",
2196                                                             exec_directory_type_to_string(type), *rt,
2197                                                             st.st_mode & 07777, exec_directory_type_to_string(type), context->directories[type].mode & 07777);
2198
2199                                         continue;
2200                                 }
2201                         }
2202                 }
2203
2204                 /* Lock down the access mode (we use chmod_and_chown() to make this idempotent. We don't
2205                  * specify UID/GID here, so that path_chown_recursive() can optimize things depending on the
2206                  * current UID/GID ownership.) */
2207                 r = chmod_and_chown(pp ?: p, context->directories[type].mode, UID_INVALID, GID_INVALID);
2208                 if (r < 0)
2209                         goto fail;
2210
2211                 /* Then, change the ownership of the whole tree, if necessary. When dynamic users are used we
2212                  * drop the suid/sgid bits, since we really don't want SUID/SGID files for dynamic UID/GID
2213                  * assignments to exist.*/
2214                 r = path_chown_recursive(pp ?: p, uid, gid, context->dynamic_user ? 01777 : 07777);
2215                 if (r < 0)
2216                         goto fail;
2217         }
2218
2219         return 0;
2220
2221 fail:
2222         *exit_status = exit_status_table[type];
2223         return r;
2224 }
2225
2226 #if ENABLE_SMACK
2227 static int setup_smack(
2228                 const ExecContext *context,
2229                 const ExecCommand *command) {
2230
2231         int r;
2232
2233         assert(context);
2234         assert(command);
2235
2236         if (context->smack_process_label) {
2237                 r = mac_smack_apply_pid(0, context->smack_process_label);
2238                 if (r < 0)
2239                         return r;
2240         }
2241 #ifdef SMACK_DEFAULT_PROCESS_LABEL
2242         else {
2243                 _cleanup_free_ char *exec_label = NULL;
2244
2245                 r = mac_smack_read(command->path, SMACK_ATTR_EXEC, &exec_label);
2246                 if (r < 0 && !IN_SET(r, -ENODATA, -EOPNOTSUPP))
2247                         return r;
2248
2249                 r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
2250                 if (r < 0)
2251                         return r;
2252         }
2253 #endif
2254
2255         return 0;
2256 }
2257 #endif
2258
2259 static int compile_bind_mounts(
2260                 const ExecContext *context,
2261                 const ExecParameters *params,
2262                 BindMount **ret_bind_mounts,
2263                 size_t *ret_n_bind_mounts,
2264                 char ***ret_empty_directories) {
2265
2266         _cleanup_strv_free_ char **empty_directories = NULL;
2267         BindMount *bind_mounts;
2268         size_t n, h = 0, i;
2269         ExecDirectoryType t;
2270         int r;
2271
2272         assert(context);
2273         assert(params);
2274         assert(ret_bind_mounts);
2275         assert(ret_n_bind_mounts);
2276         assert(ret_empty_directories);
2277
2278         n = context->n_bind_mounts;
2279         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2280                 if (!params->prefix[t])
2281                         continue;
2282
2283                 n += strv_length(context->directories[t].paths);
2284         }
2285
2286         if (n <= 0) {
2287                 *ret_bind_mounts = NULL;
2288                 *ret_n_bind_mounts = 0;
2289                 *ret_empty_directories = NULL;
2290                 return 0;
2291         }
2292
2293         bind_mounts = new(BindMount, n);
2294         if (!bind_mounts)
2295                 return -ENOMEM;
2296
2297         for (i = 0; i < context->n_bind_mounts; i++) {
2298                 BindMount *item = context->bind_mounts + i;
2299                 char *s, *d;
2300
2301                 s = strdup(item->source);
2302                 if (!s) {
2303                         r = -ENOMEM;
2304                         goto finish;
2305                 }
2306
2307                 d = strdup(item->destination);
2308                 if (!d) {
2309                         free(s);
2310                         r = -ENOMEM;
2311                         goto finish;
2312                 }
2313
2314                 bind_mounts[h++] = (BindMount) {
2315                         .source = s,
2316                         .destination = d,
2317                         .read_only = item->read_only,
2318                         .recursive = item->recursive,
2319                         .ignore_enoent = item->ignore_enoent,
2320                 };
2321         }
2322
2323         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2324                 char **suffix;
2325
2326                 if (!params->prefix[t])
2327                         continue;
2328
2329                 if (strv_isempty(context->directories[t].paths))
2330                         continue;
2331
2332                 if (context->dynamic_user &&
2333                     !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) &&
2334                     !(context->root_directory || context->root_image)) {
2335                         char *private_root;
2336
2337                         /* So this is for a dynamic user, and we need to make sure the process can access its own
2338                          * directory. For that we overmount the usually inaccessible "private" subdirectory with a
2339                          * tmpfs that makes it accessible and is empty except for the submounts we do this for. */
2340
2341                         private_root = strjoin(params->prefix[t], "/private");
2342                         if (!private_root) {
2343                                 r = -ENOMEM;
2344                                 goto finish;
2345                         }
2346
2347                         r = strv_consume(&empty_directories, private_root);
2348                         if (r < 0)
2349                                 goto finish;
2350                 }
2351
2352                 STRV_FOREACH(suffix, context->directories[t].paths) {
2353                         char *s, *d;
2354
2355                         if (context->dynamic_user &&
2356                             !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION))
2357                                 s = strjoin(params->prefix[t], "/private/", *suffix);
2358                         else
2359                                 s = strjoin(params->prefix[t], "/", *suffix);
2360                         if (!s) {
2361                                 r = -ENOMEM;
2362                                 goto finish;
2363                         }
2364
2365                         if (context->dynamic_user &&
2366                             !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) &&
2367                             (context->root_directory || context->root_image))
2368                                 /* When RootDirectory= or RootImage= are set, then the symbolic link to the private
2369                                  * directory is not created on the root directory. So, let's bind-mount the directory
2370                                  * on the 'non-private' place. */
2371                                 d = strjoin(params->prefix[t], "/", *suffix);
2372                         else
2373                                 d = strdup(s);
2374                         if (!d) {
2375                                 free(s);
2376                                 r = -ENOMEM;
2377                                 goto finish;
2378                         }
2379
2380                         bind_mounts[h++] = (BindMount) {
2381                                 .source = s,
2382                                 .destination = d,
2383                                 .read_only = false,
2384                                 .nosuid = context->dynamic_user, /* don't allow suid/sgid when DynamicUser= is on */
2385                                 .recursive = true,
2386                                 .ignore_enoent = false,
2387                         };
2388                 }
2389         }
2390
2391         assert(h == n);
2392
2393         *ret_bind_mounts = bind_mounts;
2394         *ret_n_bind_mounts = n;
2395         *ret_empty_directories = TAKE_PTR(empty_directories);
2396
2397         return (int) n;
2398
2399 finish:
2400         bind_mount_free_many(bind_mounts, h);
2401         return r;
2402 }
2403
2404 static int apply_mount_namespace(
2405                 const Unit *u,
2406                 const ExecCommand *command,
2407                 const ExecContext *context,
2408                 const ExecParameters *params,
2409                 const ExecRuntime *runtime,
2410                 char **error_path) {
2411
2412         _cleanup_strv_free_ char **empty_directories = NULL;
2413         char *tmp = NULL, *var = NULL;
2414         const char *root_dir = NULL, *root_image = NULL;
2415         NamespaceInfo ns_info;
2416         bool needs_sandboxing;
2417         BindMount *bind_mounts = NULL;
2418         size_t n_bind_mounts = 0;
2419         int r;
2420
2421         assert(context);
2422
2423         /* The runtime struct only contains the parent of the private /tmp,
2424          * which is non-accessible to world users. Inside of it there's a /tmp
2425          * that is sticky, and that's the one we want to use here. */
2426
2427         if (context->private_tmp && runtime) {
2428                 if (runtime->tmp_dir)
2429                         tmp = strjoina(runtime->tmp_dir, "/tmp");
2430                 if (runtime->var_tmp_dir)
2431                         var = strjoina(runtime->var_tmp_dir, "/tmp");
2432         }
2433
2434         if (params->flags & EXEC_APPLY_CHROOT) {
2435                 root_image = context->root_image;
2436
2437                 if (!root_image)
2438                         root_dir = context->root_directory;
2439         }
2440
2441         r = compile_bind_mounts(context, params, &bind_mounts, &n_bind_mounts, &empty_directories);
2442         if (r < 0)
2443                 return r;
2444
2445         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
2446         if (needs_sandboxing)
2447                 ns_info = (NamespaceInfo) {
2448                         .ignore_protect_paths = false,
2449                         .private_dev = context->private_devices,
2450                         .protect_control_groups = context->protect_control_groups,
2451                         .protect_kernel_tunables = context->protect_kernel_tunables,
2452                         .protect_kernel_modules = context->protect_kernel_modules,
2453                         .protect_hostname = context->protect_hostname,
2454                         .mount_apivfs = context->mount_apivfs,
2455                         .private_mounts = context->private_mounts,
2456                 };
2457         else if (!context->dynamic_user && root_dir)
2458                 /*
2459                  * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed
2460                  * sandbox info, otherwise enforce it, don't ignore protected paths and
2461                  * fail if we are enable to apply the sandbox inside the mount namespace.
2462                  */
2463                 ns_info = (NamespaceInfo) {
2464                         .ignore_protect_paths = true,
2465                 };
2466         else
2467                 ns_info = (NamespaceInfo) {};
2468
2469         if (context->mount_flags == MS_SHARED)
2470                 log_unit_debug(u, "shared mount propagation hidden by other fs namespacing unit settings: ignoring");
2471
2472         r = setup_namespace(root_dir, root_image,
2473                             &ns_info, context->read_write_paths,
2474                             needs_sandboxing ? context->read_only_paths : NULL,
2475                             needs_sandboxing ? context->inaccessible_paths : NULL,
2476                             empty_directories,
2477                             bind_mounts,
2478                             n_bind_mounts,
2479                             context->temporary_filesystems,
2480                             context->n_temporary_filesystems,
2481                             tmp,
2482                             var,
2483                             needs_sandboxing ? context->protect_home : PROTECT_HOME_NO,
2484                             needs_sandboxing ? context->protect_system : PROTECT_SYSTEM_NO,
2485                             context->mount_flags,
2486                             DISSECT_IMAGE_DISCARD_ON_LOOP,
2487                             error_path);
2488
2489         bind_mount_free_many(bind_mounts, n_bind_mounts);
2490
2491         /* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports
2492          * that with a special, recognizable error ENOANO. In this case, silently proceed, but only if exclusively
2493          * sandboxing options were used, i.e. nothing such as RootDirectory= or BindMount= that would result in a
2494          * completely different execution environment. */
2495         if (r == -ENOANO) {
2496                 if (n_bind_mounts == 0 &&
2497                     context->n_temporary_filesystems == 0 &&
2498                     !root_dir && !root_image &&
2499                     !context->dynamic_user) {
2500                         log_unit_debug(u, "Failed to set up namespace, assuming containerized execution and ignoring.");
2501                         return 0;
2502                 }
2503
2504                 log_unit_debug(u, "Failed to set up namespace, and refusing to continue since the selected namespacing options alter mount environment non-trivially.\n"
2505                                "Bind mounts: %zu, temporary filesystems: %zu, root directory: %s, root image: %s, dynamic user: %s",
2506                                n_bind_mounts, context->n_temporary_filesystems, yes_no(root_dir), yes_no(root_image), yes_no(context->dynamic_user));
2507
2508                 return -EOPNOTSUPP;
2509         }
2510
2511         return r;
2512 }
2513
2514 static int apply_working_directory(
2515                 const ExecContext *context,
2516                 const ExecParameters *params,
2517                 const char *home,
2518                 const bool needs_mount_ns,
2519                 int *exit_status) {
2520
2521         const char *d, *wd;
2522
2523         assert(context);
2524         assert(exit_status);
2525
2526         if (context->working_directory_home) {
2527
2528                 if (!home) {
2529                         *exit_status = EXIT_CHDIR;
2530                         return -ENXIO;
2531                 }
2532
2533                 wd = home;
2534
2535         } else if (context->working_directory)
2536                 wd = context->working_directory;
2537         else
2538                 wd = "/";
2539
2540         if (params->flags & EXEC_APPLY_CHROOT) {
2541                 if (!needs_mount_ns && context->root_directory)
2542                         if (chroot(context->root_directory) < 0) {
2543                                 *exit_status = EXIT_CHROOT;
2544                                 return -errno;
2545                         }
2546
2547                 d = wd;
2548         } else
2549                 d = prefix_roota(context->root_directory, wd);
2550
2551         if (chdir(d) < 0 && !context->working_directory_missing_ok) {
2552                 *exit_status = EXIT_CHDIR;
2553                 return -errno;
2554         }
2555
2556         return 0;
2557 }
2558
2559 static int setup_keyring(
2560                 const Unit *u,
2561                 const ExecContext *context,
2562                 const ExecParameters *p,
2563                 uid_t uid, gid_t gid) {
2564
2565         key_serial_t keyring;
2566         int r = 0;
2567         uid_t saved_uid;
2568         gid_t saved_gid;
2569
2570         assert(u);
2571         assert(context);
2572         assert(p);
2573
2574         /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that
2575          * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond
2576          * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be
2577          * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in
2578          * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where
2579          * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */
2580
2581         if (context->keyring_mode == EXEC_KEYRING_INHERIT)
2582                 return 0;
2583
2584         /* Acquiring a reference to the user keyring is nasty. We briefly change identity in order to get things set up
2585          * properly by the kernel. If we don't do that then we can't create it atomically, and that sucks for parallel
2586          * execution. This mimics what pam_keyinit does, too. Setting up session keyring, to be owned by the right user
2587          * & group is just as nasty as acquiring a reference to the user keyring. */
2588
2589         saved_uid = getuid();
2590         saved_gid = getgid();
2591
2592         if (gid_is_valid(gid) && gid != saved_gid) {
2593                 if (setregid(gid, -1) < 0)
2594                         return log_unit_error_errno(u, errno, "Failed to change GID for user keyring: %m");
2595         }
2596
2597         if (uid_is_valid(uid) && uid != saved_uid) {
2598                 if (setreuid(uid, -1) < 0) {
2599                         r = log_unit_error_errno(u, errno, "Failed to change UID for user keyring: %m");
2600                         goto out;
2601                 }
2602         }
2603
2604         keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2605         if (keyring == -1) {
2606                 if (errno == ENOSYS)
2607                         log_unit_debug_errno(u, errno, "Kernel keyring not supported, ignoring.");
2608                 else if (IN_SET(errno, EACCES, EPERM))
2609                         log_unit_debug_errno(u, errno, "Kernel keyring access prohibited, ignoring.");
2610                 else if (errno == EDQUOT)
2611                         log_unit_debug_errno(u, errno, "Out of kernel keyrings to allocate, ignoring.");
2612                 else
2613                         r = log_unit_error_errno(u, errno, "Setting up kernel keyring failed: %m");
2614
2615                 goto out;
2616         }
2617
2618         /* When requested link the user keyring into the session keyring. */
2619         if (context->keyring_mode == EXEC_KEYRING_SHARED) {
2620
2621                 if (keyctl(KEYCTL_LINK,
2622                            KEY_SPEC_USER_KEYRING,
2623                            KEY_SPEC_SESSION_KEYRING, 0, 0) < 0) {
2624                         r = log_unit_error_errno(u, errno, "Failed to link user keyring into session keyring: %m");
2625                         goto out;
2626                 }
2627         }
2628
2629         /* Restore uid/gid back */
2630         if (uid_is_valid(uid) && uid != saved_uid) {
2631                 if (setreuid(saved_uid, -1) < 0) {
2632                         r = log_unit_error_errno(u, errno, "Failed to change UID back for user keyring: %m");
2633                         goto out;
2634                 }
2635         }
2636
2637         if (gid_is_valid(gid) && gid != saved_gid) {
2638                 if (setregid(saved_gid, -1) < 0)
2639                         return log_unit_error_errno(u, errno, "Failed to change GID back for user keyring: %m");
2640         }
2641
2642         /* Populate they keyring with the invocation ID by default, as original saved_uid. */
2643         if (!sd_id128_is_null(u->invocation_id)) {
2644                 key_serial_t key;
2645
2646                 key = add_key("user", "invocation_id", &u->invocation_id, sizeof(u->invocation_id), KEY_SPEC_SESSION_KEYRING);
2647                 if (key == -1)
2648                         log_unit_debug_errno(u, errno, "Failed to add invocation ID to keyring, ignoring: %m");
2649                 else {
2650                         if (keyctl(KEYCTL_SETPERM, key,
2651                                    KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH|
2652                                    KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0)
2653                                 r = log_unit_error_errno(u, errno, "Failed to restrict invocation ID permission: %m");
2654                 }
2655         }
2656
2657 out:
2658         /* Revert back uid & gid for the the last time, and exit */
2659         /* no extra logging, as only the first already reported error matters */
2660         if (getuid() != saved_uid)
2661                 (void) setreuid(saved_uid, -1);
2662
2663         if (getgid() != saved_gid)
2664                 (void) setregid(saved_gid, -1);
2665
2666         return r;
2667 }
2668
2669 static void append_socket_pair(int *array, size_t *n, const int pair[static 2]) {
2670         assert(array);
2671         assert(n);
2672
2673         if (!pair)
2674                 return;
2675
2676         if (pair[0] >= 0)
2677                 array[(*n)++] = pair[0];
2678         if (pair[1] >= 0)
2679                 array[(*n)++] = pair[1];
2680 }
2681
2682 static int close_remaining_fds(
2683                 const ExecParameters *params,
2684                 const ExecRuntime *runtime,
2685                 const DynamicCreds *dcreds,
2686                 int user_lookup_fd,
2687                 int socket_fd,
2688                 int exec_fd,
2689                 int *fds, size_t n_fds) {
2690
2691         size_t n_dont_close = 0;
2692         int dont_close[n_fds + 12];
2693
2694         assert(params);
2695
2696         if (params->stdin_fd >= 0)
2697                 dont_close[n_dont_close++] = params->stdin_fd;
2698         if (params->stdout_fd >= 0)
2699                 dont_close[n_dont_close++] = params->stdout_fd;
2700         if (params->stderr_fd >= 0)
2701                 dont_close[n_dont_close++] = params->stderr_fd;
2702
2703         if (socket_fd >= 0)
2704                 dont_close[n_dont_close++] = socket_fd;
2705         if (exec_fd >= 0)
2706                 dont_close[n_dont_close++] = exec_fd;
2707         if (n_fds > 0) {
2708                 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
2709                 n_dont_close += n_fds;
2710         }
2711
2712         if (runtime)
2713                 append_socket_pair(dont_close, &n_dont_close, runtime->netns_storage_socket);
2714
2715         if (dcreds) {
2716                 if (dcreds->user)
2717                         append_socket_pair(dont_close, &n_dont_close, dcreds->user->storage_socket);
2718                 if (dcreds->group)
2719                         append_socket_pair(dont_close, &n_dont_close, dcreds->group->storage_socket);
2720         }
2721
2722         if (user_lookup_fd >= 0)
2723                 dont_close[n_dont_close++] = user_lookup_fd;
2724
2725         return close_all_fds(dont_close, n_dont_close);
2726 }
2727
2728 static int send_user_lookup(
2729                 Unit *unit,
2730                 int user_lookup_fd,
2731                 uid_t uid,
2732                 gid_t gid) {
2733
2734         assert(unit);
2735
2736         /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
2737          * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
2738          * specified. */
2739
2740         if (user_lookup_fd < 0)
2741                 return 0;
2742
2743         if (!uid_is_valid(uid) && !gid_is_valid(gid))
2744                 return 0;
2745
2746         if (writev(user_lookup_fd,
2747                (struct iovec[]) {
2748                            IOVEC_INIT(&uid, sizeof(uid)),
2749                            IOVEC_INIT(&gid, sizeof(gid)),
2750                            IOVEC_INIT_STRING(unit->id) }, 3) < 0)
2751                 return -errno;
2752
2753         return 0;
2754 }
2755
2756 static int acquire_home(const ExecContext *c, uid_t uid, const char** home, char **buf) {
2757         int r;
2758
2759         assert(c);
2760         assert(home);
2761         assert(buf);
2762
2763         /* If WorkingDirectory=~ is set, try to acquire a usable home directory. */
2764
2765         if (*home)
2766                 return 0;
2767
2768         if (!c->working_directory_home)
2769                 return 0;
2770
2771         r = get_home_dir(buf);
2772         if (r < 0)
2773                 return r;
2774
2775         *home = *buf;
2776         return 1;
2777 }
2778
2779 static int compile_suggested_paths(const ExecContext *c, const ExecParameters *p, char ***ret) {
2780         _cleanup_strv_free_ char ** list = NULL;
2781         ExecDirectoryType t;
2782         int r;
2783
2784         assert(c);
2785         assert(p);
2786         assert(ret);
2787
2788         assert(c->dynamic_user);
2789
2790         /* Compile a list of paths that it might make sense to read the owning UID from to use as initial candidate for
2791          * dynamic UID allocation, in order to save us from doing costly recursive chown()s of the special
2792          * directories. */
2793
2794         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2795                 char **i;
2796
2797                 if (t == EXEC_DIRECTORY_CONFIGURATION)
2798                         continue;
2799
2800                 if (!p->prefix[t])
2801                         continue;
2802
2803                 STRV_FOREACH(i, c->directories[t].paths) {
2804                         char *e;
2805
2806                         if (t == EXEC_DIRECTORY_RUNTIME)
2807                                 e = strjoin(p->prefix[t], "/", *i);
2808                         else
2809                                 e = strjoin(p->prefix[t], "/private/", *i);
2810                         if (!e)
2811                                 return -ENOMEM;
2812
2813                         r = strv_consume(&list, e);
2814                         if (r < 0)
2815                                 return r;
2816                 }
2817         }
2818
2819         *ret = TAKE_PTR(list);
2820
2821         return 0;
2822 }
2823
2824 static char *exec_command_line(char **argv);
2825
2826 static int exec_parameters_get_cgroup_path(const ExecParameters *params, char **ret) {
2827         bool using_subcgroup;
2828         char *p;
2829
2830         assert(params);
2831         assert(ret);
2832
2833         if (!params->cgroup_path)
2834                 return -EINVAL;
2835
2836         /* If we are called for a unit where cgroup delegation is on, and the payload created its own populated
2837          * subcgroup (which we expect it to do, after all it asked for delegation), then we cannot place the control
2838          * processes started after the main unit's process in the unit's main cgroup because it is now an inner one,
2839          * and inner cgroups may not contain processes. Hence, if delegation is on, and this is a control process,
2840          * let's use ".control" as subcgroup instead. Note that we do so only for ExecStartPost=, ExecReload=,
2841          * ExecStop=, ExecStopPost=, i.e. for the commands where the main process is already forked. For ExecStartPre=
2842          * this is not necessary, the cgroup is still empty. We distinguish these cases with the EXEC_CONTROL_CGROUP
2843          * flag, which is only passed for the former statements, not for the latter. */
2844
2845         using_subcgroup = FLAGS_SET(params->flags, EXEC_CONTROL_CGROUP|EXEC_CGROUP_DELEGATE|EXEC_IS_CONTROL);
2846         if (using_subcgroup)
2847                 p = strjoin(params->cgroup_path, "/.control");
2848         else
2849                 p = strdup(params->cgroup_path);
2850         if (!p)
2851                 return -ENOMEM;
2852
2853         *ret = p;
2854         return using_subcgroup;
2855 }
2856
2857 static int exec_child(
2858                 Unit *unit,
2859                 const ExecCommand *command,
2860                 const ExecContext *context,
2861                 const ExecParameters *params,
2862                 ExecRuntime *runtime,
2863                 DynamicCreds *dcreds,
2864                 int socket_fd,
2865                 int named_iofds[3],
2866                 int *fds,
2867                 size_t n_socket_fds,
2868                 size_t n_storage_fds,
2869                 char **files_env,
2870                 int user_lookup_fd,
2871                 int *exit_status) {
2872
2873         _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **accum_env = NULL, **replaced_argv = NULL;
2874         int *fds_with_exec_fd, n_fds_with_exec_fd, r, ngids = 0, exec_fd = -1;
2875         _cleanup_free_ gid_t *supplementary_gids = NULL;
2876         const char *username = NULL, *groupname = NULL;
2877         _cleanup_free_ char *home_buffer = NULL;
2878         const char *home = NULL, *shell = NULL;
2879         char **final_argv = NULL;
2880         dev_t journal_stream_dev = 0;
2881         ino_t journal_stream_ino = 0;
2882         bool needs_sandboxing,          /* Do we need to set up full sandboxing? (i.e. all namespacing, all MAC stuff, caps, yadda yadda */
2883                 needs_setuid,           /* Do we need to do the actual setresuid()/setresgid() calls? */
2884                 needs_mount_namespace,  /* Do we need to set up a mount namespace for this kernel? */
2885                 needs_ambient_hack;     /* Do we need to apply the ambient capabilities hack? */
2886 #if HAVE_SELINUX
2887         _cleanup_free_ char *mac_selinux_context_net = NULL;
2888         bool use_selinux = false;
2889 #endif
2890 #if ENABLE_SMACK
2891         bool use_smack = false;
2892 #endif
2893 #if HAVE_APPARMOR
2894         bool use_apparmor = false;
2895 #endif
2896         uid_t uid = UID_INVALID;
2897         gid_t gid = GID_INVALID;
2898         size_t n_fds;
2899         ExecDirectoryType dt;
2900         int secure_bits;
2901
2902         assert(unit);
2903         assert(command);
2904         assert(context);
2905         assert(params);
2906         assert(exit_status);
2907
2908         rename_process_from_path(command->path);
2909
2910         /* We reset exactly these signals, since they are the
2911          * only ones we set to SIG_IGN in the main daemon. All
2912          * others we leave untouched because we set them to
2913          * SIG_DFL or a valid handler initially, both of which
2914          * will be demoted to SIG_DFL. */
2915         (void) default_signals(SIGNALS_CRASH_HANDLER,
2916                                SIGNALS_IGNORE, -1);
2917
2918         if (context->ignore_sigpipe)
2919                 (void) ignore_signals(SIGPIPE, -1);
2920
2921         r = reset_signal_mask();
2922         if (r < 0) {
2923                 *exit_status = EXIT_SIGNAL_MASK;
2924                 return log_unit_error_errno(unit, r, "Failed to set process signal mask: %m");
2925         }
2926
2927         if (params->idle_pipe)
2928                 do_idle_pipe_dance(params->idle_pipe);
2929
2930         /* Close fds we don't need very early to make sure we don't block init reexecution because it cannot bind its
2931          * sockets. Among the fds we close are the logging fds, and we want to keep them closed, so that we don't have
2932          * any fds open we don't really want open during the transition. In order to make logging work, we switch the
2933          * log subsystem into open_when_needed mode, so that it reopens the logs on every single log call. */
2934
2935         log_forget_fds();
2936         log_set_open_when_needed(true);
2937
2938         /* In case anything used libc syslog(), close this here, too */
2939         closelog();
2940
2941         n_fds = n_socket_fds + n_storage_fds;
2942         r = close_remaining_fds(params, runtime, dcreds, user_lookup_fd, socket_fd, params->exec_fd, fds, n_fds);
2943         if (r < 0) {
2944                 *exit_status = EXIT_FDS;
2945                 return log_unit_error_errno(unit, r, "Failed to close unwanted file descriptors: %m");
2946         }
2947
2948         if (!context->same_pgrp)
2949                 if (setsid() < 0) {
2950                         *exit_status = EXIT_SETSID;
2951                         return log_unit_error_errno(unit, errno, "Failed to create new process session: %m");
2952                 }
2953
2954         exec_context_tty_reset(context, params);
2955
2956         if (unit_shall_confirm_spawn(unit)) {
2957                 const char *vc = params->confirm_spawn;
2958                 _cleanup_free_ char *cmdline = NULL;
2959
2960                 cmdline = exec_command_line(command->argv);
2961                 if (!cmdline) {
2962                         *exit_status = EXIT_MEMORY;
2963                         return log_oom();
2964                 }
2965
2966                 r = ask_for_confirmation(vc, unit, cmdline);
2967                 if (r != CONFIRM_EXECUTE) {
2968                         if (r == CONFIRM_PRETEND_SUCCESS) {
2969                                 *exit_status = EXIT_SUCCESS;
2970                                 return 0;
2971                         }
2972                         *exit_status = EXIT_CONFIRM;
2973                         log_unit_error(unit, "Execution cancelled by the user");
2974                         return -ECANCELED;
2975                 }
2976         }
2977
2978         /* We are about to invoke NSS and PAM modules. Let's tell them what we are doing here, maybe they care. This is
2979          * used by nss-resolve to disable itself when we are about to start systemd-resolved, to avoid deadlocks. Note
2980          * that these env vars do not survive the execve(), which means they really only apply to the PAM and NSS
2981          * invocations themselves. Also note that while we'll only invoke NSS modules involved in user management they
2982          * might internally call into other NSS modules that are involved in hostname resolution, we never know. */
2983         if (setenv("SYSTEMD_ACTIVATION_UNIT", unit->id, true) != 0 ||
2984             setenv("SYSTEMD_ACTIVATION_SCOPE", MANAGER_IS_SYSTEM(unit->manager) ? "system" : "user", true) != 0) {
2985                 *exit_status = EXIT_MEMORY;
2986                 return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
2987         }
2988
2989         if (context->dynamic_user && dcreds) {
2990                 _cleanup_strv_free_ char **suggested_paths = NULL;
2991
2992                 /* On top of that, make sure we bypass our own NSS module nss-systemd comprehensively for any NSS
2993                  * checks, if DynamicUser=1 is used, as we shouldn't create a feedback loop with ourselves here.*/
2994                 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
2995                         *exit_status = EXIT_USER;
2996                         return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
2997                 }
2998
2999                 r = compile_suggested_paths(context, params, &suggested_paths);
3000                 if (r < 0) {
3001                         *exit_status = EXIT_MEMORY;
3002                         return log_oom();
3003                 }
3004
3005                 r = dynamic_creds_realize(dcreds, suggested_paths, &uid, &gid);
3006                 if (r < 0) {
3007                         *exit_status = EXIT_USER;
3008                         if (r == -EILSEQ) {
3009                                 log_unit_error(unit, "Failed to update dynamic user credentials: User or group with specified name already exists.");
3010                                 return -EOPNOTSUPP;
3011                         }
3012                         return log_unit_error_errno(unit, r, "Failed to update dynamic user credentials: %m");
3013                 }
3014
3015                 if (!uid_is_valid(uid)) {
3016                         *exit_status = EXIT_USER;
3017                         log_unit_error(unit, "UID validation failed for \""UID_FMT"\"", uid);
3018                         return -ESRCH;
3019                 }
3020
3021                 if (!gid_is_valid(gid)) {
3022                         *exit_status = EXIT_USER;
3023                         log_unit_error(unit, "GID validation failed for \""GID_FMT"\"", gid);
3024                         return -ESRCH;
3025                 }
3026
3027                 if (dcreds->user)
3028                         username = dcreds->user->name;
3029
3030         } else {
3031                 r = get_fixed_user(context, &username, &uid, &gid, &home, &shell);
3032                 if (r < 0) {
3033                         *exit_status = EXIT_USER;
3034                         return log_unit_error_errno(unit, r, "Failed to determine user credentials: %m");
3035                 }
3036
3037                 r = get_fixed_group(context, &groupname, &gid);
3038                 if (r < 0) {
3039                         *exit_status = EXIT_GROUP;
3040                         return log_unit_error_errno(unit, r, "Failed to determine group credentials: %m");
3041                 }
3042         }
3043
3044         /* Initialize user supplementary groups and get SupplementaryGroups= ones */
3045         r = get_supplementary_groups(context, username, groupname, gid,
3046                                      &supplementary_gids, &ngids);
3047         if (r < 0) {
3048                 *exit_status = EXIT_GROUP;
3049                 return log_unit_error_errno(unit, r, "Failed to determine supplementary groups: %m");
3050         }
3051
3052         r = send_user_lookup(unit, user_lookup_fd, uid, gid);
3053         if (r < 0) {
3054                 *exit_status = EXIT_USER;
3055                 return log_unit_error_errno(unit, r, "Failed to send user credentials to PID1: %m");
3056         }
3057
3058         user_lookup_fd = safe_close(user_lookup_fd);
3059
3060         r = acquire_home(context, uid, &home, &home_buffer);
3061         if (r < 0) {
3062                 *exit_status = EXIT_CHDIR;
3063                 return log_unit_error_errno(unit, r, "Failed to determine $HOME for user: %m");
3064         }
3065
3066         /* If a socket is connected to STDIN/STDOUT/STDERR, we
3067          * must sure to drop O_NONBLOCK */
3068         if (socket_fd >= 0)
3069                 (void) fd_nonblock(socket_fd, false);
3070
3071         /* Journald will try to look-up our cgroup in order to populate _SYSTEMD_CGROUP and _SYSTEMD_UNIT fields.
3072          * Hence we need to migrate to the target cgroup from init.scope before connecting to journald */
3073         if (params->cgroup_path) {
3074                 _cleanup_free_ char *p = NULL;
3075
3076                 r = exec_parameters_get_cgroup_path(params, &p);
3077                 if (r < 0) {
3078                         *exit_status = EXIT_CGROUP;
3079                         return log_unit_error_errno(unit, r, "Failed to acquire cgroup path: %m");
3080                 }
3081
3082                 r = cg_attach_everywhere(params->cgroup_supported, p, 0, NULL, NULL);
3083                 if (r < 0) {
3084                         *exit_status = EXIT_CGROUP;
3085                         return log_unit_error_errno(unit, r, "Failed to attach to cgroup %s: %m", p);
3086                 }
3087         }
3088
3089         if (context->network_namespace_path && runtime && runtime->netns_storage_socket[0] >= 0) {
3090                 r = open_netns_path(runtime->netns_storage_socket, context->network_namespace_path);
3091                 if (r < 0) {
3092                         *exit_status = EXIT_NETWORK;
3093                         return log_unit_error_errno(unit, r, "Failed to open network namespace path %s: %m", context->network_namespace_path);
3094                 }
3095         }
3096
3097         r = setup_input(context, params, socket_fd, named_iofds);
3098         if (r < 0) {
3099                 *exit_status = EXIT_STDIN;
3100                 return log_unit_error_errno(unit, r, "Failed to set up standard input: %m");
3101         }
3102
3103         r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
3104         if (r < 0) {
3105                 *exit_status = EXIT_STDOUT;
3106                 return log_unit_error_errno(unit, r, "Failed to set up standard output: %m");
3107         }
3108
3109         r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
3110         if (r < 0) {
3111                 *exit_status = EXIT_STDERR;
3112                 return log_unit_error_errno(unit, r, "Failed to set up standard error output: %m");
3113         }
3114
3115         if (context->oom_score_adjust_set) {
3116                 /* When we can't make this change due to EPERM, then let's silently skip over it. User namespaces
3117                  * prohibit write access to this file, and we shouldn't trip up over that. */
3118                 r = set_oom_score_adjust(context->oom_score_adjust);
3119                 if (IN_SET(r, -EPERM, -EACCES))
3120                         log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
3121                 else if (r < 0) {
3122                         *exit_status = EXIT_OOM_ADJUST;
3123                         return log_unit_error_errno(unit, r, "Failed to adjust OOM setting: %m");
3124                 }
3125         }
3126
3127         if (context->nice_set)
3128                 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
3129                         *exit_status = EXIT_NICE;
3130                         return log_unit_error_errno(unit, errno, "Failed to set up process scheduling priority (nice level): %m");
3131                 }
3132
3133         if (context->cpu_sched_set) {
3134                 struct sched_param param = {
3135                         .sched_priority = context->cpu_sched_priority,
3136                 };
3137
3138                 r = sched_setscheduler(0,
3139                                        context->cpu_sched_policy |
3140                                        (context->cpu_sched_reset_on_fork ?
3141                                         SCHED_RESET_ON_FORK : 0),
3142                                        &param);
3143                 if (r < 0) {
3144                         *exit_status = EXIT_SETSCHEDULER;
3145                         return log_unit_error_errno(unit, errno, "Failed to set up CPU scheduling: %m");
3146                 }
3147         }
3148
3149         if (context->cpuset)
3150                 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
3151                         *exit_status = EXIT_CPUAFFINITY;
3152                         return log_unit_error_errno(unit, errno, "Failed to set up CPU affinity: %m");
3153                 }
3154
3155         if (context->ioprio_set)
3156                 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
3157                         *exit_status = EXIT_IOPRIO;
3158                         return log_unit_error_errno(unit, errno, "Failed to set up IO scheduling priority: %m");
3159                 }
3160
3161         if (context->timer_slack_nsec != NSEC_INFINITY)
3162                 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
3163                         *exit_status = EXIT_TIMERSLACK;
3164                         return log_unit_error_errno(unit, errno, "Failed to set up timer slack: %m");
3165                 }
3166
3167         if (context->personality != PERSONALITY_INVALID) {
3168                 r = safe_personality(context->personality);
3169                 if (r < 0) {
3170                         *exit_status = EXIT_PERSONALITY;
3171                         return log_unit_error_errno(unit, r, "Failed to set up execution domain (personality): %m");
3172                 }
3173         }
3174
3175         if (context->utmp_id)
3176                 utmp_put_init_process(context->utmp_id, getpid_cached(), getsid(0),
3177                                       context->tty_path,
3178                                       context->utmp_mode == EXEC_UTMP_INIT  ? INIT_PROCESS :
3179                                       context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
3180                                       USER_PROCESS,
3181                                       username);
3182
3183         if (uid_is_valid(uid)) {
3184                 r = chown_terminal(STDIN_FILENO, uid);
3185                 if (r < 0) {
3186                         *exit_status = EXIT_STDIN;
3187                         return log_unit_error_errno(unit, r, "Failed to change ownership of terminal: %m");
3188                 }
3189         }
3190
3191         /* If delegation is enabled we'll pass ownership of the cgroup to the user of the new process. On cgroup v1
3192          * this is only about systemd's own hierarchy, i.e. not the controller hierarchies, simply because that's not
3193          * safe. On cgroup v2 there's only one hierarchy anyway, and delegation is safe there, hence in that case only
3194          * touch a single hierarchy too. */
3195         if (params->cgroup_path && context->user && (params->flags & EXEC_CGROUP_DELEGATE)) {
3196                 r = cg_set_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, uid, gid);
3197                 if (r < 0) {
3198                         *exit_status = EXIT_CGROUP;
3199                         return log_unit_error_errno(unit, r, "Failed to adjust control group access: %m");
3200                 }
3201         }
3202
3203         for (dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
3204                 r = setup_exec_directory(context, params, uid, gid, dt, exit_status);
3205                 if (r < 0)
3206                         return log_unit_error_errno(unit, r, "Failed to set up special execution directory in %s: %m", params->prefix[dt]);
3207         }
3208
3209         r = build_environment(
3210                         unit,
3211                         context,
3212                         params,
3213                         n_fds,
3214                         home,
3215                         username,
3216                         shell,
3217                         journal_stream_dev,
3218                         journal_stream_ino,
3219                         &our_env);
3220         if (r < 0) {
3221                 *exit_status = EXIT_MEMORY;
3222                 return log_oom();
3223         }
3224
3225         r = build_pass_environment(context, &pass_env);
3226         if (r < 0) {
3227                 *exit_status = EXIT_MEMORY;
3228                 return log_oom();
3229         }
3230
3231         accum_env = strv_env_merge(5,
3232                                    params->environment,
3233                                    our_env,
3234                                    pass_env,
3235                                    context->environment,
3236                                    files_env,
3237                                    NULL);
3238         if (!accum_env) {
3239                 *exit_status = EXIT_MEMORY;
3240                 return log_oom();
3241         }
3242         accum_env = strv_env_clean(accum_env);
3243
3244         (void) umask(context->umask);
3245
3246         r = setup_keyring(unit, context, params, uid, gid);
3247         if (r < 0) {
3248                 *exit_status = EXIT_KEYRING;
3249                 return log_unit_error_errno(unit, r, "Failed to set up kernel keyring: %m");
3250         }
3251
3252         /* We need sandboxing if the caller asked us to apply it and the command isn't explicitly excepted from it */
3253         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
3254
3255         /* We need the ambient capability hack, if the caller asked us to apply it and the command is marked for it, and the kernel doesn't actually support ambient caps */
3256         needs_ambient_hack = (params->flags & EXEC_APPLY_SANDBOXING) && (command->flags & EXEC_COMMAND_AMBIENT_MAGIC) && !ambient_capabilities_supported();
3257
3258         /* We need setresuid() if the caller asked us to apply sandboxing and the command isn't explicitly excepted from either whole sandboxing or just setresuid() itself, and the ambient hack is not desired */
3259         if (needs_ambient_hack)
3260                 needs_setuid = false;
3261         else
3262                 needs_setuid = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & (EXEC_COMMAND_FULLY_PRIVILEGED|EXEC_COMMAND_NO_SETUID));
3263
3264         if (needs_sandboxing) {
3265                 /* MAC enablement checks need to be done before a new mount ns is created, as they rely on /sys being
3266                  * present. The actual MAC context application will happen later, as late as possible, to avoid
3267                  * impacting our own code paths. */
3268
3269 #if HAVE_SELINUX
3270                 use_selinux = mac_selinux_use();
3271 #endif
3272 #if ENABLE_SMACK
3273                 use_smack = mac_smack_use();
3274 #endif
3275 #if HAVE_APPARMOR
3276                 use_apparmor = mac_apparmor_use();
3277 #endif
3278         }
3279
3280         if (needs_sandboxing) {
3281                 int which_failed;
3282
3283                 /* Let's set the resource limits before we call into PAM, so that pam_limits wins over what
3284                  * is set here. (See below.) */
3285
3286                 r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
3287                 if (r < 0) {
3288                         *exit_status = EXIT_LIMITS;
3289                         return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3290                 }
3291         }
3292
3293         if (needs_setuid) {
3294
3295                 /* Let's call into PAM after we set up our own idea of resource limits to that pam_limits
3296                  * wins here. (See above.) */
3297
3298                 if (context->pam_name && username) {
3299                         r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
3300                         if (r < 0) {
3301                                 *exit_status = EXIT_PAM;
3302                                 return log_unit_error_errno(unit, r, "Failed to set up PAM session: %m");
3303                         }
3304                 }
3305         }
3306
3307         if ((context->private_network || context->network_namespace_path) && runtime && runtime->netns_storage_socket[0] >= 0) {
3308
3309                 if (ns_type_supported(NAMESPACE_NET)) {
3310                         r = setup_netns(runtime->netns_storage_socket);
3311                         if (r < 0) {
3312                                 *exit_status = EXIT_NETWORK;
3313                                 return log_unit_error_errno(unit, r, "Failed to set up network namespacing: %m");
3314                         }
3315                 } else if (context->network_namespace_path) {
3316                         *exit_status = EXIT_NETWORK;
3317                         return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP), "NetworkNamespacePath= is not supported, refusing.");
3318                 } else
3319                         log_unit_warning(unit, "PrivateNetwork=yes is configured, but the kernel does not support network namespaces, ignoring.");
3320         }
3321
3322         needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
3323         if (needs_mount_namespace) {
3324                 _cleanup_free_ char *error_path = NULL;
3325
3326                 r = apply_mount_namespace(unit, command, context, params, runtime, &error_path);
3327                 if (r < 0) {
3328                         *exit_status = EXIT_NAMESPACE;
3329                         return log_unit_error_errno(unit, r, "Failed to set up mount namespacing%s%s: %m",
3330                                                     error_path ? ": " : "", strempty(error_path));
3331                 }
3332         }
3333
3334         if (context->protect_hostname) {
3335                 if (ns_type_supported(NAMESPACE_UTS)) {
3336                         if (unshare(CLONE_NEWUTS) < 0) {
3337                                 *exit_status = EXIT_NAMESPACE;
3338                                 return log_unit_error_errno(unit, errno, "Failed to set up UTS namespacing: %m");
3339                         }
3340                 } else
3341                         log_unit_warning(unit, "ProtectHostname=yes is configured, but the kernel does not support UTS namespaces, ignoring namespace setup.");
3342 #if HAVE_SECCOMP
3343                 r = seccomp_protect_hostname();
3344                 if (r < 0) {
3345                         *exit_status = EXIT_SECCOMP;
3346                         return log_unit_error_errno(unit, r, "Failed to apply hostname restrictions: %m");
3347                 }
3348 #endif
3349         }
3350
3351         /* Drop groups as early as possbile */
3352         if (needs_setuid) {
3353                 r = enforce_groups(gid, supplementary_gids, ngids);
3354                 if (r < 0) {
3355                         *exit_status = EXIT_GROUP;
3356                         return log_unit_error_errno(unit, r, "Changing group credentials failed: %m");
3357                 }
3358         }
3359
3360         if (needs_sandboxing) {
3361 #if HAVE_SELINUX
3362                 if (use_selinux && params->selinux_context_net && socket_fd >= 0) {
3363                         r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
3364                         if (r < 0) {
3365                                 *exit_status = EXIT_SELINUX_CONTEXT;
3366                                 return log_unit_error_errno(unit, r, "Failed to determine SELinux context: %m");
3367                         }
3368                 }
3369 #endif
3370
3371                 if (context->private_users) {
3372                         r = setup_private_users(uid, gid);
3373                         if (r < 0) {
3374                                 *exit_status = EXIT_USER;
3375                                 return log_unit_error_errno(unit, r, "Failed to set up user namespacing: %m");
3376                         }
3377                 }
3378         }
3379
3380         /* We repeat the fd closing here, to make sure that nothing is leaked from the PAM modules. Note that we are
3381          * more aggressive this time since socket_fd and the netns fds we don't need anymore. We do keep the exec_fd
3382          * however if we have it as we want to keep it open until the final execve(). */
3383
3384         if (params->exec_fd >= 0) {
3385                 exec_fd = params->exec_fd;
3386
3387                 if (exec_fd < 3 + (int) n_fds) {
3388                         int moved_fd;
3389
3390                         /* Let's move the exec fd far up, so that it's outside of the fd range we want to pass to the
3391                          * process we are about to execute. */
3392
3393                         moved_fd = fcntl(exec_fd, F_DUPFD_CLOEXEC, 3 + (int) n_fds);
3394                         if (moved_fd < 0) {
3395                                 *exit_status = EXIT_FDS;
3396                                 return log_unit_error_errno(unit, errno, "Couldn't move exec fd up: %m");
3397                         }
3398
3399                         safe_close(exec_fd);
3400                         exec_fd = moved_fd;
3401                 } else {
3402                         /* This fd should be FD_CLOEXEC already, but let's make sure. */
3403                         r = fd_cloexec(exec_fd, true);
3404                         if (r < 0) {
3405                                 *exit_status = EXIT_FDS;
3406                                 return log_unit_error_errno(unit, r, "Failed to make exec fd FD_CLOEXEC: %m");
3407                         }
3408                 }
3409
3410                 fds_with_exec_fd = newa(int, n_fds + 1);
3411                 memcpy_safe(fds_with_exec_fd, fds, n_fds * sizeof(int));
3412                 fds_with_exec_fd[n_fds] = exec_fd;
3413                 n_fds_with_exec_fd = n_fds + 1;
3414         } else {
3415                 fds_with_exec_fd = fds;
3416                 n_fds_with_exec_fd = n_fds;
3417         }
3418
3419         r = close_all_fds(fds_with_exec_fd, n_fds_with_exec_fd);
3420         if (r >= 0)
3421                 r = shift_fds(fds, n_fds);
3422         if (r >= 0)
3423                 r = flags_fds(fds, n_socket_fds, n_storage_fds, context->non_blocking);
3424         if (r < 0) {
3425                 *exit_status = EXIT_FDS;
3426                 return log_unit_error_errno(unit, r, "Failed to adjust passed file descriptors: %m");
3427         }
3428
3429         /* At this point, the fds we want to pass to the program are all ready and set up, with O_CLOEXEC turned off
3430          * and at the right fd numbers. The are no other fds open, with one exception: the exec_fd if it is defined,
3431          * and it has O_CLOEXEC set, after all we want it to be closed by the execve(), so that our parent knows we
3432          * came this far. */
3433
3434         secure_bits = context->secure_bits;
3435
3436         if (needs_sandboxing) {
3437                 uint64_t bset;
3438
3439                 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly
3440                  * requested. (Note this is placed after the general resource limit initialization, see
3441                  * above, in order to take precedence.) */
3442                 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
3443                         if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
3444                                 *exit_status = EXIT_LIMITS;
3445                                 return log_unit_error_errno(unit, errno, "Failed to adjust RLIMIT_RTPRIO resource limit: %m");
3446                         }
3447                 }
3448
3449 #if ENABLE_SMACK
3450                 /* LSM Smack needs the capability CAP_MAC_ADMIN to change the current execution security context of the
3451                  * process. This is the latest place before dropping capabilities. Other MAC context are set later. */
3452                 if (use_smack) {
3453                         r = setup_smack(context, command);
3454                         if (r < 0) {
3455                                 *exit_status = EXIT_SMACK_PROCESS_LABEL;
3456                                 return log_unit_error_errno(unit, r, "Failed to set SMACK process label: %m");
3457                         }
3458                 }
3459 #endif
3460
3461                 bset = context->capability_bounding_set;
3462                 /* If the ambient caps hack is enabled (which means the kernel can't do them, and the user asked for
3463                  * our magic fallback), then let's add some extra caps, so that the service can drop privs of its own,
3464                  * instead of us doing that */
3465                 if (needs_ambient_hack)
3466                         bset |= (UINT64_C(1) << CAP_SETPCAP) |
3467                                 (UINT64_C(1) << CAP_SETUID) |
3468                                 (UINT64_C(1) << CAP_SETGID);
3469
3470                 if (!cap_test_all(bset)) {
3471                         r = capability_bounding_set_drop(bset, false);
3472                         if (r < 0) {
3473                                 *exit_status = EXIT_CAPABILITIES;
3474                                 return log_unit_error_errno(unit, r, "Failed to drop capabilities: %m");
3475                         }
3476                 }
3477
3478                 /* This is done before enforce_user, but ambient set
3479                  * does not survive over setresuid() if keep_caps is not set. */
3480                 if (!needs_ambient_hack &&
3481                     context->capability_ambient_set != 0) {
3482                         r = capability_ambient_set_apply(context->capability_ambient_set, true);
3483                         if (r < 0) {
3484                                 *exit_status = EXIT_CAPABILITIES;
3485                                 return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (before UID change): %m");
3486                         }
3487                 }
3488         }
3489
3490         if (needs_setuid) {
3491                 if (uid_is_valid(uid)) {
3492                         r = enforce_user(context, uid);
3493                         if (r < 0) {
3494                                 *exit_status = EXIT_USER;
3495                                 return log_unit_error_errno(unit, r, "Failed to change UID to " UID_FMT ": %m", uid);
3496                         }
3497
3498                         if (!needs_ambient_hack &&
3499                             context->capability_ambient_set != 0) {
3500
3501                                 /* Fix the ambient capabilities after user change. */
3502                                 r = capability_ambient_set_apply(context->capability_ambient_set, false);
3503                                 if (r < 0) {
3504                                         *exit_status = EXIT_CAPABILITIES;
3505                                         return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (after UID change): %m");
3506                                 }
3507
3508                                 /* If we were asked to change user and ambient capabilities
3509                                  * were requested, we had to add keep-caps to the securebits
3510                                  * so that we would maintain the inherited capability set
3511                                  * through the setresuid(). Make sure that the bit is added
3512                                  * also to the context secure_bits so that we don't try to
3513                                  * drop the bit away next. */
3514
3515                                 secure_bits |= 1<<SECURE_KEEP_CAPS;
3516                         }
3517                 }
3518         }
3519
3520         /* Apply working directory here, because the working directory might be on NFS and only the user running
3521          * this service might have the correct privilege to change to the working directory */
3522         r = apply_working_directory(context, params, home, needs_mount_namespace, exit_status);
3523         if (r < 0)
3524                 return log_unit_error_errno(unit, r, "Changing to the requested working directory failed: %m");
3525
3526         if (needs_sandboxing) {
3527                 /* Apply other MAC contexts late, but before seccomp syscall filtering, as those should really be last to
3528                  * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires
3529                  * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls
3530                  * are restricted. */
3531
3532 #if HAVE_SELINUX
3533                 if (use_selinux) {
3534                         char *exec_context = mac_selinux_context_net ?: context->selinux_context;
3535
3536                         if (exec_context) {
3537                                 r = setexeccon(exec_context);
3538                                 if (r < 0) {
3539                                         *exit_status = EXIT_SELINUX_CONTEXT;
3540                                         return log_unit_error_errno(unit, r, "Failed to change SELinux context to %s: %m", exec_context);
3541                                 }
3542                         }
3543                 }
3544 #endif
3545
3546 #if HAVE_APPARMOR
3547                 if (use_apparmor && context->apparmor_profile) {
3548                         r = aa_change_onexec(context->apparmor_profile);
3549                         if (r < 0 && !context->apparmor_profile_ignore) {
3550                                 *exit_status = EXIT_APPARMOR_PROFILE;
3551                                 return log_unit_error_errno(unit, errno, "Failed to prepare AppArmor profile change to %s: %m", context->apparmor_profile);
3552                         }
3553                 }
3554 #endif
3555
3556                 /* PR_GET_SECUREBITS is not privileged, while PR_SET_SECUREBITS is. So to suppress potential EPERMs
3557                  * we'll try not to call PR_SET_SECUREBITS unless necessary. */
3558                 if (prctl(PR_GET_SECUREBITS) != secure_bits)
3559                         if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
3560                                 *exit_status = EXIT_SECUREBITS;
3561                                 return log_unit_error_errno(unit, errno, "Failed to set process secure bits: %m");
3562                         }
3563
3564                 if (context_has_no_new_privileges(context))
3565                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
3566                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
3567                                 return log_unit_error_errno(unit, errno, "Failed to disable new privileges: %m");
3568                         }
3569
3570 #if HAVE_SECCOMP
3571                 r = apply_address_families(unit, context);
3572                 if (r < 0) {
3573                         *exit_status = EXIT_ADDRESS_FAMILIES;
3574                         return log_unit_error_errno(unit, r, "Failed to restrict address families: %m");
3575                 }
3576
3577                 r = apply_memory_deny_write_execute(unit, context);
3578                 if (r < 0) {
3579                         *exit_status = EXIT_SECCOMP;
3580                         return log_unit_error_errno(unit, r, "Failed to disable writing to executable memory: %m");
3581                 }
3582
3583                 r = apply_restrict_realtime(unit, context);
3584                 if (r < 0) {
3585                         *exit_status = EXIT_SECCOMP;
3586                         return log_unit_error_errno(unit, r, "Failed to apply realtime restrictions: %m");
3587                 }
3588
3589                 r = apply_restrict_suid_sgid(unit, context);
3590                 if (r < 0) {
3591                         *exit_status = EXIT_SECCOMP;
3592                         return log_unit_error_errno(unit, r, "Failed to apply SUID/SGID restrictions: %m");
3593                 }
3594
3595                 r = apply_restrict_namespaces(unit, context);
3596                 if (r < 0) {
3597                         *exit_status = EXIT_SECCOMP;
3598                         return log_unit_error_errno(unit, r, "Failed to apply namespace restrictions: %m");
3599                 }
3600
3601                 r = apply_protect_sysctl(unit, context);
3602                 if (r < 0) {
3603                         *exit_status = EXIT_SECCOMP;
3604                         return log_unit_error_errno(unit, r, "Failed to apply sysctl restrictions: %m");
3605                 }
3606
3607                 r = apply_protect_kernel_modules(unit, context);
3608                 if (r < 0) {
3609                         *exit_status = EXIT_SECCOMP;
3610                         return log_unit_error_errno(unit, r, "Failed to apply module loading restrictions: %m");
3611                 }
3612
3613                 r = apply_private_devices(unit, context);
3614                 if (r < 0) {
3615                         *exit_status = EXIT_SECCOMP;
3616                         return log_unit_error_errno(unit, r, "Failed to set up private devices: %m");
3617                 }
3618
3619                 r = apply_syscall_archs(unit, context);
3620                 if (r < 0) {
3621                         *exit_status = EXIT_SECCOMP;
3622                         return log_unit_error_errno(unit, r, "Failed to apply syscall architecture restrictions: %m");
3623                 }
3624
3625                 r = apply_lock_personality(unit, context);
3626                 if (r < 0) {
3627                         *exit_status = EXIT_SECCOMP;
3628                         return log_unit_error_errno(unit, r, "Failed to lock personalities: %m");
3629                 }
3630
3631                 /* This really should remain the last step before the execve(), to make sure our own code is unaffected
3632                  * by the filter as little as possible. */
3633                 r = apply_syscall_filter(unit, context, needs_ambient_hack);
3634                 if (r < 0) {
3635                         *exit_status = EXIT_SECCOMP;
3636                         return log_unit_error_errno(unit, r, "Failed to apply system call filters: %m");
3637                 }
3638 #endif
3639         }
3640
3641         if (!strv_isempty(context->unset_environment)) {
3642                 char **ee = NULL;
3643
3644                 ee = strv_env_delete(accum_env, 1, context->unset_environment);
3645                 if (!ee) {
3646                         *exit_status = EXIT_MEMORY;
3647                         return log_oom();
3648                 }
3649
3650                 strv_free_and_replace(accum_env, ee);
3651         }
3652
3653         if (!FLAGS_SET(command->flags, EXEC_COMMAND_NO_ENV_EXPAND)) {
3654                 replaced_argv = replace_env_argv(command->argv, accum_env);
3655                 if (!replaced_argv) {
3656                         *exit_status = EXIT_MEMORY;
3657                         return log_oom();
3658                 }
3659                 final_argv = replaced_argv;
3660         } else
3661                 final_argv = command->argv;
3662
3663         if (DEBUG_LOGGING) {
3664                 _cleanup_free_ char *line;
3665
3666                 line = exec_command_line(final_argv);
3667                 if (line)
3668                         log_struct(LOG_DEBUG,
3669                                    "EXECUTABLE=%s", command->path,
3670                                    LOG_UNIT_MESSAGE(unit, "Executing: %s", line),
3671                                    LOG_UNIT_ID(unit),
3672                                    LOG_UNIT_INVOCATION_ID(unit));
3673         }
3674
3675         if (exec_fd >= 0) {
3676                 uint8_t hot = 1;
3677
3678                 /* We have finished with all our initializations. Let's now let the manager know that. From this point
3679                  * on, if the manager sees POLLHUP on the exec_fd, then execve() was successful. */
3680
3681                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
3682                         *exit_status = EXIT_EXEC;
3683                         return log_unit_error_errno(unit, errno, "Failed to enable exec_fd: %m");
3684                 }
3685         }
3686
3687         execve(command->path, final_argv, accum_env);
3688         r = -errno;
3689
3690         if (exec_fd >= 0) {
3691                 uint8_t hot = 0;
3692
3693                 /* The execve() failed. This means the exec_fd is still open. Which means we need to tell the manager
3694                  * that POLLHUP on it no longer means execve() succeeded. */
3695
3696                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
3697                         *exit_status = EXIT_EXEC;
3698                         return log_unit_error_errno(unit, errno, "Failed to disable exec_fd: %m");
3699                 }
3700         }
3701
3702         if (r == -ENOENT && (command->flags & EXEC_COMMAND_IGNORE_FAILURE)) {
3703                 log_struct_errno(LOG_INFO, r,
3704                                  "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
3705                                  LOG_UNIT_ID(unit),
3706                                  LOG_UNIT_INVOCATION_ID(unit),
3707                                  LOG_UNIT_MESSAGE(unit, "Executable %s missing, skipping: %m",
3708                                                   command->path),
3709                                  "EXECUTABLE=%s", command->path);
3710                 return 0;
3711         }
3712
3713         *exit_status = EXIT_EXEC;
3714         return log_unit_error_errno(unit, r, "Failed to execute command: %m");
3715 }
3716
3717 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l);
3718 static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[3]);
3719
3720 int exec_spawn(Unit *unit,
3721                ExecCommand *command,
3722                const ExecContext *context,
3723                const ExecParameters *params,
3724                ExecRuntime *runtime,
3725                DynamicCreds *dcreds,
3726                pid_t *ret) {
3727
3728         int socket_fd, r, named_iofds[3] = { -1, -1, -1 }, *fds = NULL;
3729         _cleanup_free_ char *subcgroup_path = NULL;
3730         _cleanup_strv_free_ char **files_env = NULL;
3731         size_t n_storage_fds = 0, n_socket_fds = 0;
3732         _cleanup_free_ char *line = NULL;
3733         pid_t pid;
3734
3735         assert(unit);
3736         assert(command);
3737         assert(context);
3738         assert(ret);
3739         assert(params);
3740         assert(params->fds || (params->n_socket_fds + params->n_storage_fds <= 0));
3741
3742         if (context->std_input == EXEC_INPUT_SOCKET ||
3743             context->std_output == EXEC_OUTPUT_SOCKET ||
3744             context->std_error == EXEC_OUTPUT_SOCKET) {
3745
3746                 if (params->n_socket_fds > 1) {
3747                         log_unit_error(unit, "Got more than one socket.");
3748                         return -EINVAL;
3749                 }
3750
3751                 if (params->n_socket_fds == 0) {
3752                         log_unit_error(unit, "Got no socket.");
3753                         return -EINVAL;
3754                 }
3755
3756                 socket_fd = params->fds[0];
3757         } else {
3758                 socket_fd = -1;
3759                 fds = params->fds;
3760                 n_socket_fds = params->n_socket_fds;
3761                 n_storage_fds = params->n_storage_fds;
3762         }
3763
3764         r = exec_context_named_iofds(context, params, named_iofds);
3765         if (r < 0)
3766                 return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m");
3767
3768         r = exec_context_load_environment(unit, context, &files_env);
3769         if (r < 0)
3770                 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
3771
3772         line = exec_command_line(command->argv);
3773         if (!line)
3774                 return log_oom();
3775
3776         log_struct(LOG_DEBUG,
3777                    LOG_UNIT_MESSAGE(unit, "About to execute: %s", line),
3778                    "EXECUTABLE=%s", command->path,
3779                    LOG_UNIT_ID(unit),
3780                    LOG_UNIT_INVOCATION_ID(unit));
3781
3782         if (params->cgroup_path) {
3783                 r = exec_parameters_get_cgroup_path(params, &subcgroup_path);
3784                 if (r < 0)
3785                         return log_unit_error_errno(unit, r, "Failed to acquire subcgroup path: %m");
3786                 if (r > 0) { /* We are using a child cgroup */
3787                         r = cg_create(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path);
3788                         if (r < 0)
3789                                 return log_unit_error_errno(unit, r, "Failed to create control group '%s': %m", subcgroup_path);
3790                 }
3791         }
3792
3793         pid = fork();
3794         if (pid < 0)
3795                 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
3796
3797         if (pid == 0) {
3798                 int exit_status = EXIT_SUCCESS;
3799
3800                 r = exec_child(unit,
3801                                command,
3802                                context,
3803                                params,
3804                                runtime,
3805                                dcreds,
3806                                socket_fd,
3807                                named_iofds,
3808                                fds,
3809                                n_socket_fds,
3810                                n_storage_fds,
3811                                files_env,
3812                                unit->manager->user_lookup_fds[1],
3813                                &exit_status);
3814
3815                 if (r < 0)
3816                         log_struct_errno(LOG_ERR, r,
3817                                          "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
3818                                          LOG_UNIT_ID(unit),
3819                                          LOG_UNIT_INVOCATION_ID(unit),
3820                                          LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
3821                                                           exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
3822                                                           command->path),
3823                                          "EXECUTABLE=%s", command->path);
3824
3825                 _exit(exit_status);
3826         }
3827
3828         log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
3829
3830         /* We add the new process to the cgroup both in the child (so that we can be sure that no user code is ever
3831          * executed outside of the cgroup) and in the parent (so that we can be sure that when we kill the cgroup the
3832          * process will be killed too). */
3833         if (subcgroup_path)
3834                 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path, pid);
3835
3836         exec_status_start(&command->exec_status, pid);
3837
3838         *ret = pid;
3839         return 0;
3840 }
3841
3842 void exec_context_init(ExecContext *c) {
3843         ExecDirectoryType i;
3844
3845         assert(c);
3846
3847         c->umask = 0022;
3848         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
3849         c->cpu_sched_policy = SCHED_OTHER;
3850         c->syslog_priority = LOG_DAEMON|LOG_INFO;
3851         c->syslog_level_prefix = true;
3852         c->ignore_sigpipe = true;
3853         c->timer_slack_nsec = NSEC_INFINITY;
3854         c->personality = PERSONALITY_INVALID;
3855         for (i = 0; i < _EXEC_DIRECTORY_TYPE_MAX; i++)
3856                 c->directories[i].mode = 0755;
3857         c->capability_bounding_set = CAP_ALL;
3858         assert_cc(NAMESPACE_FLAGS_INITIAL != NAMESPACE_FLAGS_ALL);
3859         c->restrict_namespaces = NAMESPACE_FLAGS_INITIAL;
3860         c->log_level_max = -1;
3861 }
3862
3863 void exec_context_done(ExecContext *c) {
3864         ExecDirectoryType i;
3865         size_t l;
3866
3867         assert(c);
3868
3869         c->environment = strv_free(c->environment);
3870         c->environment_files = strv_free(c->environment_files);
3871         c->pass_environment = strv_free(c->pass_environment);
3872         c->unset_environment = strv_free(c->unset_environment);
3873
3874         rlimit_free_all(c->rlimit);
3875
3876         for (l = 0; l < 3; l++) {
3877                 c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);
3878                 c->stdio_file[l] = mfree(c->stdio_file[l]);
3879         }
3880
3881         c->working_directory = mfree(c->working_directory);
3882         c->root_directory = mfree(c->root_directory);
3883         c->root_image = mfree(c->root_image);
3884         c->tty_path = mfree(c->tty_path);
3885         c->syslog_identifier = mfree(c->syslog_identifier);
3886         c->user = mfree(c->user);
3887         c->group = mfree(c->group);
3888
3889         c->supplementary_groups = strv_free(c->supplementary_groups);
3890
3891         c->pam_name = mfree(c->pam_name);
3892
3893         c->read_only_paths = strv_free(c->read_only_paths);
3894         c->read_write_paths = strv_free(c->read_write_paths);
3895         c->inaccessible_paths = strv_free(c->inaccessible_paths);
3896
3897         bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
3898         c->bind_mounts = NULL;
3899         c->n_bind_mounts = 0;
3900         temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);
3901         c->temporary_filesystems = NULL;
3902         c->n_temporary_filesystems = 0;
3903
3904         c->cpuset = cpu_set_mfree(c->cpuset);
3905
3906         c->utmp_id = mfree(c->utmp_id);
3907         c->selinux_context = mfree(c->selinux_context);
3908         c->apparmor_profile = mfree(c->apparmor_profile);
3909         c->smack_process_label = mfree(c->smack_process_label);
3910
3911         c->syscall_filter = hashmap_free(c->syscall_filter);
3912         c->syscall_archs = set_free(c->syscall_archs);
3913         c->address_families = set_free(c->address_families);
3914
3915         for (i = 0; i < _EXEC_DIRECTORY_TYPE_MAX; i++)
3916                 c->directories[i].paths = strv_free(c->directories[i].paths);
3917
3918         c->log_level_max = -1;
3919
3920         exec_context_free_log_extra_fields(c);
3921
3922         c->log_rate_limit_interval_usec = 0;
3923         c->log_rate_limit_burst = 0;
3924
3925         c->stdin_data = mfree(c->stdin_data);
3926         c->stdin_data_size = 0;
3927
3928         c->network_namespace_path = mfree(c->network_namespace_path);
3929 }
3930
3931 int exec_context_destroy_runtime_directory(const ExecContext *c, const char *runtime_prefix) {
3932         char **i;
3933
3934         assert(c);
3935
3936         if (!runtime_prefix)
3937                 return 0;
3938
3939         STRV_FOREACH(i, c->directories[EXEC_DIRECTORY_RUNTIME].paths) {
3940                 _cleanup_free_ char *p;
3941
3942                 p = path_join(runtime_prefix, *i);
3943                 if (!p)
3944                         return -ENOMEM;
3945
3946                 /* We execute this synchronously, since we need to be sure this is gone when we start the
3947                  * service next. */
3948                 (void) rm_rf(p, REMOVE_ROOT);
3949         }
3950
3951         return 0;
3952 }
3953
3954 static void exec_command_done(ExecCommand *c) {
3955         assert(c);
3956
3957         c->path = mfree(c->path);
3958         c->argv = strv_free(c->argv);
3959 }
3960
3961 void exec_command_done_array(ExecCommand *c, size_t n) {
3962         size_t i;
3963
3964         for (i = 0; i < n; i++)
3965                 exec_command_done(c+i);
3966 }
3967
3968 ExecCommand* exec_command_free_list(ExecCommand *c) {
3969         ExecCommand *i;
3970
3971         while ((i = c)) {
3972                 LIST_REMOVE(command, c, i);
3973                 exec_command_done(i);
3974                 free(i);
3975         }
3976
3977         return NULL;
3978 }
3979
3980 void exec_command_free_array(ExecCommand **c, size_t n) {
3981         size_t i;
3982
3983         for (i = 0; i < n; i++)
3984                 c[i] = exec_command_free_list(c[i]);
3985 }
3986
3987 void exec_command_reset_status_array(ExecCommand *c, size_t n) {
3988         size_t i;
3989
3990         for (i = 0; i < n; i++)
3991                 exec_status_reset(&c[i].exec_status);
3992 }
3993
3994 void exec_command_reset_status_list_array(ExecCommand **c, size_t n) {
3995         size_t i;
3996
3997         for (i = 0; i < n; i++) {
3998                 ExecCommand *z;
3999
4000                 LIST_FOREACH(command, z, c[i])
4001                         exec_status_reset(&z->exec_status);
4002         }
4003 }
4004
4005 typedef struct InvalidEnvInfo {
4006         const Unit *unit;
4007         const char *path;
4008 } InvalidEnvInfo;
4009
4010 static void invalid_env(const char *p, void *userdata) {
4011         InvalidEnvInfo *info = userdata;
4012
4013         log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
4014 }
4015
4016 const char* exec_context_fdname(const ExecContext *c, int fd_index) {
4017         assert(c);
4018
4019         switch (fd_index) {
4020
4021         case STDIN_FILENO:
4022                 if (c->std_input != EXEC_INPUT_NAMED_FD)
4023                         return NULL;
4024
4025                 return c->stdio_fdname[STDIN_FILENO] ?: "stdin";
4026
4027         case STDOUT_FILENO:
4028                 if (c->std_output != EXEC_OUTPUT_NAMED_FD)
4029                         return NULL;
4030
4031                 return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";
4032
4033         case STDERR_FILENO:
4034                 if (c->std_error != EXEC_OUTPUT_NAMED_FD)
4035                         return NULL;
4036
4037                 return c->stdio_fdname[STDERR_FILENO] ?: "stderr";
4038
4039         default:
4040                 return NULL;
4041         }
4042 }
4043
4044 static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[static 3]) {
4045         size_t i, targets;
4046         const char* stdio_fdname[3];
4047         size_t n_fds;
4048
4049         assert(c);
4050         assert(p);
4051
4052         targets = (c->std_input == EXEC_INPUT_NAMED_FD) +
4053                   (c->std_output == EXEC_OUTPUT_NAMED_FD) +
4054                   (c->std_error == EXEC_OUTPUT_NAMED_FD);
4055
4056         for (i = 0; i < 3; i++)
4057                 stdio_fdname[i] = exec_context_fdname(c, i);
4058
4059         n_fds = p->n_storage_fds + p->n_socket_fds;
4060
4061         for (i = 0; i < n_fds  && targets > 0; i++)
4062                 if (named_iofds[STDIN_FILENO] < 0 &&
4063                     c->std_input == EXEC_INPUT_NAMED_FD &&
4064                     stdio_fdname[STDIN_FILENO] &&
4065                     streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) {
4066
4067                         named_iofds[STDIN_FILENO] = p->fds[i];
4068                         targets--;
4069
4070                 } else if (named_iofds[STDOUT_FILENO] < 0 &&
4071                            c->std_output == EXEC_OUTPUT_NAMED_FD &&
4072                            stdio_fdname[STDOUT_FILENO] &&
4073                            streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) {
4074
4075                         named_iofds[STDOUT_FILENO] = p->fds[i];
4076                         targets--;
4077
4078                 } else if (named_iofds[STDERR_FILENO] < 0 &&
4079                            c->std_error == EXEC_OUTPUT_NAMED_FD &&
4080                            stdio_fdname[STDERR_FILENO] &&
4081                            streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) {
4082
4083                         named_iofds[STDERR_FILENO] = p->fds[i];
4084                         targets--;
4085                 }
4086
4087         return targets == 0 ? 0 : -ENOENT;
4088 }
4089
4090 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l) {
4091         char **i, **r = NULL;
4092
4093         assert(c);
4094         assert(l);
4095
4096         STRV_FOREACH(i, c->environment_files) {
4097                 char *fn;
4098                 int k;
4099                 unsigned n;
4100                 bool ignore = false;
4101                 char **p;
4102                 _cleanup_globfree_ glob_t pglob = {};
4103
4104                 fn = *i;
4105
4106                 if (fn[0] == '-') {
4107                         ignore = true;
4108                         fn++;
4109                 }
4110
4111                 if (!path_is_absolute(fn)) {
4112                         if (ignore)
4113                                 continue;
4114
4115                         strv_free(r);
4116                         return -EINVAL;
4117                 }
4118
4119                 /* Filename supports globbing, take all matching files */
4120                 k = safe_glob(fn, 0, &pglob);
4121                 if (k < 0) {
4122                         if (ignore)
4123                                 continue;
4124
4125                         strv_free(r);
4126                         return k;
4127                 }
4128
4129                 /* When we don't match anything, -ENOENT should be returned */
4130                 assert(pglob.gl_pathc > 0);
4131
4132                 for (n = 0; n < pglob.gl_pathc; n++) {
4133                         k = load_env_file(NULL, pglob.gl_pathv[n], &p);
4134                         if (k < 0) {
4135                                 if (ignore)
4136                                         continue;
4137
4138                                 strv_free(r);
4139                                 return k;
4140                         }
4141                         /* Log invalid environment variables with filename */
4142                         if (p) {
4143                                 InvalidEnvInfo info = {
4144                                         .unit = unit,
4145                                         .path = pglob.gl_pathv[n]
4146                                 };
4147
4148                                 p = strv_env_clean_with_callback(p, invalid_env, &info);
4149                         }
4150
4151                         if (!r)
4152                                 r = p;
4153                         else {
4154                                 char **m;
4155
4156                                 m = strv_env_merge(2, r, p);
4157                                 strv_free(r);
4158                                 strv_free(p);
4159                                 if (!m)
4160                                         return -ENOMEM;
4161
4162                                 r = m;
4163                         }
4164                 }
4165         }
4166
4167         *l = r;
4168
4169         return 0;
4170 }
4171
4172 static bool tty_may_match_dev_console(const char *tty) {
4173         _cleanup_free_ char *resolved = NULL;
4174
4175         if (!tty)
4176                 return true;
4177
4178         tty = skip_dev_prefix(tty);
4179
4180         /* trivial identity? */
4181         if (streq(tty, "console"))
4182                 return true;
4183
4184         if (resolve_dev_console(&resolved) < 0)
4185                 return true; /* if we could not resolve, assume it may */
4186
4187         /* "tty0" means the active VC, so it may be the same sometimes */
4188         return path_equal(resolved, tty) || (streq(resolved, "tty0") && tty_is_vc(tty));
4189 }
4190
4191 static bool exec_context_may_touch_tty(const ExecContext *ec) {
4192         assert(ec);
4193
4194         return ec->tty_reset ||
4195                 ec->tty_vhangup ||
4196                 ec->tty_vt_disallocate ||
4197                 is_terminal_input(ec->std_input) ||
4198                 is_terminal_output(ec->std_output) ||
4199                 is_terminal_output(ec->std_error);
4200 }
4201
4202 bool exec_context_may_touch_console(const ExecContext *ec) {
4203
4204         return exec_context_may_touch_tty(ec) &&
4205                tty_may_match_dev_console(exec_context_tty_path(ec));
4206 }
4207
4208 static void strv_fprintf(FILE *f, char **l) {
4209         char **g;
4210
4211         assert(f);
4212
4213         STRV_FOREACH(g, l)
4214                 fprintf(f, " %s", *g);
4215 }
4216
4217 void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
4218         ExecDirectoryType dt;
4219         char **e, **d;
4220         unsigned i;
4221         int r;
4222
4223         assert(c);
4224         assert(f);
4225
4226         prefix = strempty(prefix);
4227
4228         fprintf(f,
4229                 "%sUMask: %04o\n"
4230                 "%sWorkingDirectory: %s\n"
4231                 "%sRootDirectory: %s\n"
4232                 "%sNonBlocking: %s\n"
4233                 "%sPrivateTmp: %s\n"
4234                 "%sPrivateDevices: %s\n"
4235                 "%sProtectKernelTunables: %s\n"
4236                 "%sProtectKernelModules: %s\n"
4237                 "%sProtectControlGroups: %s\n"
4238                 "%sPrivateNetwork: %s\n"
4239                 "%sPrivateUsers: %s\n"
4240                 "%sProtectHome: %s\n"
4241                 "%sProtectSystem: %s\n"
4242                 "%sMountAPIVFS: %s\n"
4243                 "%sIgnoreSIGPIPE: %s\n"
4244                 "%sMemoryDenyWriteExecute: %s\n"
4245                 "%sRestrictRealtime: %s\n"
4246                 "%sRestrictSUIDSGID: %s\n"
4247                 "%sKeyringMode: %s\n"
4248                 "%sProtectHostname: %s\n",
4249                 prefix, c->umask,
4250                 prefix, c->working_directory ? c->working_directory : "/",
4251                 prefix, c->root_directory ? c->root_directory : "/",
4252                 prefix, yes_no(c->non_blocking),
4253                 prefix, yes_no(c->private_tmp),
4254                 prefix, yes_no(c->private_devices),
4255                 prefix, yes_no(c->protect_kernel_tunables),
4256                 prefix, yes_no(c->protect_kernel_modules),
4257                 prefix, yes_no(c->protect_control_groups),
4258                 prefix, yes_no(c->private_network),
4259                 prefix, yes_no(c->private_users),
4260                 prefix, protect_home_to_string(c->protect_home),
4261                 prefix, protect_system_to_string(c->protect_system),
4262                 prefix, yes_no(c->mount_apivfs),
4263                 prefix, yes_no(c->ignore_sigpipe),
4264                 prefix, yes_no(c->memory_deny_write_execute),
4265                 prefix, yes_no(c->restrict_realtime),
4266                 prefix, yes_no(c->restrict_suid_sgid),
4267                 prefix, exec_keyring_mode_to_string(c->keyring_mode),
4268                 prefix, yes_no(c->protect_hostname));
4269
4270         if (c->root_image)
4271                 fprintf(f, "%sRootImage: %s\n", prefix, c->root_image);
4272
4273         STRV_FOREACH(e, c->environment)
4274                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
4275
4276         STRV_FOREACH(e, c->environment_files)
4277                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
4278
4279         STRV_FOREACH(e, c->pass_environment)
4280                 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
4281
4282         STRV_FOREACH(e, c->unset_environment)
4283                 fprintf(f, "%sUnsetEnvironment: %s\n", prefix, *e);
4284
4285         fprintf(f, "%sRuntimeDirectoryPreserve: %s\n", prefix, exec_preserve_mode_to_string(c->runtime_directory_preserve_mode));
4286
4287         for (dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
4288                 fprintf(f, "%s%sMode: %04o\n", prefix, exec_directory_type_to_string(dt), c->directories[dt].mode);
4289
4290                 STRV_FOREACH(d, c->directories[dt].paths)
4291                         fprintf(f, "%s%s: %s\n", prefix, exec_directory_type_to_string(dt), *d);
4292         }
4293
4294         if (c->nice_set)
4295                 fprintf(f,
4296                         "%sNice: %i\n",
4297                         prefix, c->nice);
4298
4299         if (c->oom_score_adjust_set)
4300                 fprintf(f,
4301                         "%sOOMScoreAdjust: %i\n",
4302                         prefix, c->oom_score_adjust);
4303
4304         for (i = 0; i < RLIM_NLIMITS; i++)
4305                 if (c->rlimit[i]) {
4306                         fprintf(f, "%sLimit%s: " RLIM_FMT "\n",
4307                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
4308                         fprintf(f, "%sLimit%sSoft: " RLIM_FMT "\n",
4309                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
4310                 }
4311
4312         if (c->ioprio_set) {
4313                 _cleanup_free_ char *class_str = NULL;
4314
4315                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
4316                 if (r >= 0)
4317                         fprintf(f, "%sIOSchedulingClass: %s\n", prefix, class_str);
4318
4319                 fprintf(f, "%sIOPriority: %lu\n", prefix, IOPRIO_PRIO_DATA(c->ioprio));
4320         }
4321
4322         if (c->cpu_sched_set) {
4323                 _cleanup_free_ char *policy_str = NULL;
4324
4325                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
4326                 if (r >= 0)
4327                         fprintf(f, "%sCPUSchedulingPolicy: %s\n", prefix, policy_str);
4328
4329                 fprintf(f,
4330                         "%sCPUSchedulingPriority: %i\n"
4331                         "%sCPUSchedulingResetOnFork: %s\n",
4332                         prefix, c->cpu_sched_priority,
4333                         prefix, yes_no(c->cpu_sched_reset_on_fork));
4334         }
4335
4336         if (c->cpuset) {
4337                 fprintf(f, "%sCPUAffinity:", prefix);
4338                 for (i = 0; i < c->cpuset_ncpus; i++)
4339                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
4340                                 fprintf(f, " %u", i);
4341                 fputs("\n", f);
4342         }
4343
4344         if (c->timer_slack_nsec != NSEC_INFINITY)
4345                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
4346
4347         fprintf(f,
4348                 "%sStandardInput: %s\n"
4349                 "%sStandardOutput: %s\n"
4350                 "%sStandardError: %s\n",
4351                 prefix, exec_input_to_string(c->std_input),
4352                 prefix, exec_output_to_string(c->std_output),
4353                 prefix, exec_output_to_string(c->std_error));
4354
4355         if (c->std_input == EXEC_INPUT_NAMED_FD)
4356                 fprintf(f, "%sStandardInputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDIN_FILENO]);
4357         if (c->std_output == EXEC_OUTPUT_NAMED_FD)
4358                 fprintf(f, "%sStandardOutputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDOUT_FILENO]);
4359         if (c->std_error == EXEC_OUTPUT_NAMED_FD)
4360                 fprintf(f, "%sStandardErrorFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDERR_FILENO]);
4361
4362         if (c->std_input == EXEC_INPUT_FILE)
4363                 fprintf(f, "%sStandardInputFile: %s\n", prefix, c->stdio_file[STDIN_FILENO]);
4364         if (c->std_output == EXEC_OUTPUT_FILE)
4365                 fprintf(f, "%sStandardOutputFile: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
4366         if (c->std_output == EXEC_OUTPUT_FILE_APPEND)
4367                 fprintf(f, "%sStandardOutputFileToAppend: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
4368         if (c->std_error == EXEC_OUTPUT_FILE)
4369                 fprintf(f, "%sStandardErrorFile: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
4370         if (c->std_error == EXEC_OUTPUT_FILE_APPEND)
4371                 fprintf(f, "%sStandardErrorFileToAppend: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
4372
4373         if (c->tty_path)
4374                 fprintf(f,
4375                         "%sTTYPath: %s\n"
4376                         "%sTTYReset: %s\n"
4377                         "%sTTYVHangup: %s\n"
4378                         "%sTTYVTDisallocate: %s\n",
4379                         prefix, c->tty_path,
4380                         prefix, yes_no(c->tty_reset),
4381                         prefix, yes_no(c->tty_vhangup),
4382                         prefix, yes_no(c->tty_vt_disallocate));
4383
4384         if (IN_SET(c->std_output,
4385                    EXEC_OUTPUT_SYSLOG,
4386                    EXEC_OUTPUT_KMSG,
4387                    EXEC_OUTPUT_JOURNAL,
4388                    EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
4389                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
4390                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE) ||
4391             IN_SET(c->std_error,
4392                    EXEC_OUTPUT_SYSLOG,
4393                    EXEC_OUTPUT_KMSG,
4394                    EXEC_OUTPUT_JOURNAL,
4395                    EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
4396                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
4397                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE)) {
4398
4399                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
4400
4401                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
4402                 if (r >= 0)
4403                         fprintf(f, "%sSyslogFacility: %s\n", prefix, fac_str);
4404
4405                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
4406                 if (r >= 0)
4407                         fprintf(f, "%sSyslogLevel: %s\n", prefix, lvl_str);
4408         }
4409
4410         if (c->log_level_max >= 0) {
4411                 _cleanup_free_ char *t = NULL;
4412
4413                 (void) log_level_to_string_alloc(c->log_level_max, &t);
4414
4415                 fprintf(f, "%sLogLevelMax: %s\n", prefix, strna(t));
4416         }
4417
4418         if (c->log_rate_limit_interval_usec > 0) {
4419                 char buf_timespan[FORMAT_TIMESPAN_MAX];
4420
4421                 fprintf(f,
4422                         "%sLogRateLimitIntervalSec: %s\n",
4423                         prefix, format_timespan(buf_timespan, sizeof(buf_timespan), c->log_rate_limit_interval_usec, USEC_PER_SEC));
4424         }
4425
4426         if (c->log_rate_limit_burst > 0)
4427                 fprintf(f, "%sLogRateLimitBurst: %u\n", prefix, c->log_rate_limit_burst);
4428
4429         if (c->n_log_extra_fields > 0) {
4430                 size_t j;
4431
4432                 for (j = 0; j < c->n_log_extra_fields; j++) {
4433                         fprintf(f, "%sLogExtraFields: ", prefix);
4434                         fwrite(c->log_extra_fields[j].iov_base,
4435                                1, c->log_extra_fields[j].iov_len,
4436                                f);
4437                         fputc('\n', f);
4438                 }
4439         }
4440
4441         if (c->secure_bits) {
4442                 _cleanup_free_ char *str = NULL;
4443
4444                 r = secure_bits_to_string_alloc(c->secure_bits, &str);
4445                 if (r >= 0)
4446                         fprintf(f, "%sSecure Bits: %s\n", prefix, str);
4447         }
4448
4449         if (c->capability_bounding_set != CAP_ALL) {
4450                 _cleanup_free_ char *str = NULL;
4451
4452                 r = capability_set_to_string_alloc(c->capability_bounding_set, &str);
4453                 if (r >= 0)
4454                         fprintf(f, "%sCapabilityBoundingSet: %s\n", prefix, str);
4455         }
4456
4457         if (c->capability_ambient_set != 0) {
4458                 _cleanup_free_ char *str = NULL;
4459
4460                 r = capability_set_to_string_alloc(c->capability_ambient_set, &str);
4461                 if (r >= 0)
4462                         fprintf(f, "%sAmbientCapabilities: %s\n", prefix, str);
4463         }
4464
4465         if (c->user)
4466                 fprintf(f, "%sUser: %s\n", prefix, c->user);
4467         if (c->group)
4468                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
4469
4470         fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
4471
4472         if (!strv_isempty(c->supplementary_groups)) {
4473                 fprintf(f, "%sSupplementaryGroups:", prefix);
4474                 strv_fprintf(f, c->supplementary_groups);
4475                 fputs("\n", f);
4476         }
4477
4478         if (c->pam_name)
4479                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
4480
4481         if (!strv_isempty(c->read_write_paths)) {
4482                 fprintf(f, "%sReadWritePaths:", prefix);
4483                 strv_fprintf(f, c->read_write_paths);
4484                 fputs("\n", f);
4485         }
4486
4487         if (!strv_isempty(c->read_only_paths)) {
4488                 fprintf(f, "%sReadOnlyPaths:", prefix);
4489                 strv_fprintf(f, c->read_only_paths);
4490                 fputs("\n", f);
4491         }
4492
4493         if (!strv_isempty(c->inaccessible_paths)) {
4494                 fprintf(f, "%sInaccessiblePaths:", prefix);
4495                 strv_fprintf(f, c->inaccessible_paths);
4496                 fputs("\n", f);
4497         }
4498
4499         if (c->n_bind_mounts > 0)
4500                 for (i = 0; i < c->n_bind_mounts; i++)
4501                         fprintf(f, "%s%s: %s%s:%s:%s\n", prefix,
4502                                 c->bind_mounts[i].read_only ? "BindReadOnlyPaths" : "BindPaths",
4503                                 c->bind_mounts[i].ignore_enoent ? "-": "",
4504                                 c->bind_mounts[i].source,
4505                                 c->bind_mounts[i].destination,
4506                                 c->bind_mounts[i].recursive ? "rbind" : "norbind");
4507
4508         if (c->n_temporary_filesystems > 0)
4509                 for (i = 0; i < c->n_temporary_filesystems; i++) {
4510                         TemporaryFileSystem *t = c->temporary_filesystems + i;
4511
4512                         fprintf(f, "%sTemporaryFileSystem: %s%s%s\n", prefix,
4513                                 t->path,
4514                                 isempty(t->options) ? "" : ":",
4515                                 strempty(t->options));
4516                 }
4517
4518         if (c->utmp_id)
4519                 fprintf(f,
4520                         "%sUtmpIdentifier: %s\n",
4521                         prefix, c->utmp_id);
4522
4523         if (c->selinux_context)
4524                 fprintf(f,
4525                         "%sSELinuxContext: %s%s\n",
4526                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
4527
4528         if (c->apparmor_profile)
4529                 fprintf(f,
4530                         "%sAppArmorProfile: %s%s\n",
4531                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
4532
4533         if (c->smack_process_label)
4534                 fprintf(f,
4535                         "%sSmackProcessLabel: %s%s\n",
4536                         prefix, c->smack_process_label_ignore ? "-" : "", c->smack_process_label);
4537
4538         if (c->personality != PERSONALITY_INVALID)
4539                 fprintf(f,
4540                         "%sPersonality: %s\n",
4541                         prefix, strna(personality_to_string(c->personality)));
4542
4543         fprintf(f,
4544                 "%sLockPersonality: %s\n",
4545                 prefix, yes_no(c->lock_personality));
4546
4547         if (c->syscall_filter) {
4548 #if HAVE_SECCOMP
4549                 Iterator j;
4550                 void *id, *val;
4551                 bool first = true;
4552 #endif
4553
4554                 fprintf(f,
4555                         "%sSystemCallFilter: ",
4556                         prefix);
4557
4558                 if (!c->syscall_whitelist)
4559                         fputc('~', f);
4560
4561 #if HAVE_SECCOMP
4562                 HASHMAP_FOREACH_KEY(val, id, c->syscall_filter, j) {
4563                         _cleanup_free_ char *name = NULL;
4564                         const char *errno_name = NULL;
4565                         int num = PTR_TO_INT(val);
4566
4567                         if (first)
4568                                 first = false;
4569                         else
4570                                 fputc(' ', f);
4571
4572                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
4573                         fputs(strna(name), f);
4574
4575                         if (num >= 0) {
4576                                 errno_name = errno_to_name(num);
4577                                 if (errno_name)
4578                                         fprintf(f, ":%s", errno_name);
4579                                 else
4580                                         fprintf(f, ":%d", num);
4581                         }
4582                 }
4583 #endif
4584
4585                 fputc('\n', f);
4586         }
4587
4588         if (c->syscall_archs) {
4589 #if HAVE_SECCOMP
4590                 Iterator j;
4591                 void *id;
4592 #endif
4593
4594                 fprintf(f,
4595                         "%sSystemCallArchitectures:",
4596                         prefix);
4597
4598 #if HAVE_SECCOMP
4599                 SET_FOREACH(id, c->syscall_archs, j)
4600                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
4601 #endif
4602                 fputc('\n', f);
4603         }
4604
4605         if (exec_context_restrict_namespaces_set(c)) {
4606                 _cleanup_free_ char *s = NULL;
4607
4608                 r = namespace_flags_to_string(c->restrict_namespaces, &s);
4609                 if (r >= 0)
4610                         fprintf(f, "%sRestrictNamespaces: %s\n",
4611                                 prefix, s);
4612         }
4613
4614         if (c->network_namespace_path)
4615                 fprintf(f,
4616                         "%sNetworkNamespacePath: %s\n",
4617                         prefix, c->network_namespace_path);
4618
4619         if (c->syscall_errno > 0) {
4620                 const char *errno_name;
4621
4622                 fprintf(f, "%sSystemCallErrorNumber: ", prefix);
4623
4624                 errno_name = errno_to_name(c->syscall_errno);
4625                 if (errno_name)
4626                         fprintf(f, "%s\n", errno_name);
4627                 else
4628                         fprintf(f, "%d\n", c->syscall_errno);
4629         }
4630 }
4631
4632 bool exec_context_maintains_privileges(const ExecContext *c) {
4633         assert(c);
4634
4635         /* Returns true if the process forked off would run under
4636          * an unchanged UID or as root. */
4637
4638         if (!c->user)
4639                 return true;
4640
4641         if (streq(c->user, "root") || streq(c->user, "0"))
4642                 return true;
4643
4644         return false;
4645 }
4646
4647 int exec_context_get_effective_ioprio(const ExecContext *c) {
4648         int p;
4649
4650         assert(c);
4651
4652         if (c->ioprio_set)
4653                 return c->ioprio;
4654
4655         p = ioprio_get(IOPRIO_WHO_PROCESS, 0);
4656         if (p < 0)
4657                 return IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 4);
4658
4659         return p;
4660 }
4661
4662 void exec_context_free_log_extra_fields(ExecContext *c) {
4663         size_t l;
4664
4665         assert(c);
4666
4667         for (l = 0; l < c->n_log_extra_fields; l++)
4668                 free(c->log_extra_fields[l].iov_base);
4669         c->log_extra_fields = mfree(c->log_extra_fields);
4670         c->n_log_extra_fields = 0;
4671 }
4672
4673 void exec_context_revert_tty(ExecContext *c) {
4674         int r;
4675
4676         assert(c);
4677
4678         /* First, reset the TTY (possibly kicking everybody else from the TTY) */
4679         exec_context_tty_reset(c, NULL);
4680
4681         /* And then undo what chown_terminal() did earlier. Note that we only do this if we have a path
4682          * configured. If the TTY was passed to us as file descriptor we assume the TTY is opened and managed
4683          * by whoever passed it to us and thus knows better when and how to chmod()/chown() it back. */
4684
4685         if (exec_context_may_touch_tty(c)) {
4686                 const char *path;
4687
4688                 path = exec_context_tty_path(c);
4689                 if (path) {
4690                         r = chmod_and_chown(path, TTY_MODE, 0, TTY_GID);
4691                         if (r < 0 && r != -ENOENT)
4692                                 log_warning_errno(r, "Failed to reset TTY ownership/access mode of %s, ignoring: %m", path);
4693                 }
4694         }
4695 }
4696
4697 void exec_status_start(ExecStatus *s, pid_t pid) {
4698         assert(s);
4699
4700         *s = (ExecStatus) {
4701                 .pid = pid,
4702         };
4703
4704         dual_timestamp_get(&s->start_timestamp);
4705 }
4706
4707 void exec_status_exit(ExecStatus *s, const ExecContext *context, pid_t pid, int code, int status) {
4708         assert(s);
4709
4710         if (s->pid != pid) {
4711                 *s = (ExecStatus) {
4712                         .pid = pid,
4713                 };
4714         }
4715
4716         dual_timestamp_get(&s->exit_timestamp);
4717
4718         s->code = code;
4719         s->status = status;
4720
4721         if (context && context->utmp_id)
4722                 (void) utmp_put_dead_process(context->utmp_id, pid, code, status);
4723 }
4724
4725 void exec_status_reset(ExecStatus *s) {
4726         assert(s);
4727
4728         *s = (ExecStatus) {};
4729 }
4730
4731 void exec_status_dump(const ExecStatus *s, FILE *f, const char *prefix) {
4732         char buf[FORMAT_TIMESTAMP_MAX];
4733
4734         assert(s);
4735         assert(f);
4736
4737         if (s->pid <= 0)
4738                 return;
4739
4740         prefix = strempty(prefix);
4741
4742         fprintf(f,
4743                 "%sPID: "PID_FMT"\n",
4744                 prefix, s->pid);
4745
4746         if (dual_timestamp_is_set(&s->start_timestamp))
4747                 fprintf(f,
4748                         "%sStart Timestamp: %s\n",
4749                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
4750
4751         if (dual_timestamp_is_set(&s->exit_timestamp))
4752                 fprintf(f,
4753                         "%sExit Timestamp: %s\n"
4754                         "%sExit Code: %s\n"
4755                         "%sExit Status: %i\n",
4756                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
4757                         prefix, sigchld_code_to_string(s->code),
4758                         prefix, s->status);
4759 }
4760
4761 static char *exec_command_line(char **argv) {
4762         size_t k;
4763         char *n, *p, **a;
4764         bool first = true;
4765
4766         assert(argv);
4767
4768         k = 1;
4769         STRV_FOREACH(a, argv)
4770                 k += strlen(*a)+3;
4771
4772         n = new(char, k);
4773         if (!n)
4774                 return NULL;
4775
4776         p = n;
4777         STRV_FOREACH(a, argv) {
4778
4779                 if (!first)
4780                         *(p++) = ' ';
4781                 else
4782                         first = false;
4783
4784                 if (strpbrk(*a, WHITESPACE)) {
4785                         *(p++) = '\'';
4786                         p = stpcpy(p, *a);
4787                         *(p++) = '\'';
4788                 } else
4789                         p = stpcpy(p, *a);
4790
4791         }
4792
4793         *p = 0;
4794
4795         /* FIXME: this doesn't really handle arguments that have
4796          * spaces and ticks in them */
4797
4798         return n;
4799 }
4800
4801 static void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
4802         _cleanup_free_ char *cmd = NULL;
4803         const char *prefix2;
4804
4805         assert(c);
4806         assert(f);
4807
4808         prefix = strempty(prefix);
4809         prefix2 = strjoina(prefix, "\t");
4810
4811         cmd = exec_command_line(c->argv);
4812         fprintf(f,
4813                 "%sCommand Line: %s\n",
4814                 prefix, cmd ? cmd : strerror(ENOMEM));
4815
4816         exec_status_dump(&c->exec_status, f, prefix2);
4817 }
4818
4819 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
4820         assert(f);
4821
4822         prefix = strempty(prefix);
4823
4824         LIST_FOREACH(command, c, c)
4825                 exec_command_dump(c, f, prefix);
4826 }
4827
4828 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
4829         ExecCommand *end;
4830
4831         assert(l);
4832         assert(e);
4833
4834         if (*l) {
4835                 /* It's kind of important, that we keep the order here */
4836                 LIST_FIND_TAIL(command, *l, end);
4837                 LIST_INSERT_AFTER(command, *l, end, e);
4838         } else
4839               *l = e;
4840 }
4841
4842 int exec_command_set(ExecCommand *c, const char *path, ...) {
4843         va_list ap;
4844         char **l, *p;
4845
4846         assert(c);
4847         assert(path);
4848
4849         va_start(ap, path);
4850         l = strv_new_ap(path, ap);
4851         va_end(ap);
4852
4853         if (!l)
4854                 return -ENOMEM;
4855
4856         p = strdup(path);
4857         if (!p) {
4858                 strv_free(l);
4859                 return -ENOMEM;
4860         }
4861
4862         free_and_replace(c->path, p);
4863
4864         return strv_free_and_replace(c->argv, l);
4865 }
4866
4867 int exec_command_append(ExecCommand *c, const char *path, ...) {
4868         _cleanup_strv_free_ char **l = NULL;
4869         va_list ap;
4870         int r;
4871
4872         assert(c);
4873         assert(path);
4874
4875         va_start(ap, path);
4876         l = strv_new_ap(path, ap);
4877         va_end(ap);
4878
4879         if (!l)
4880                 return -ENOMEM;
4881
4882         r = strv_extend_strv(&c->argv, l, false);
4883         if (r < 0)
4884                 return r;
4885
4886         return 0;
4887 }
4888
4889 static void *remove_tmpdir_thread(void *p) {
4890         _cleanup_free_ char *path = p;
4891
4892         (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
4893         return NULL;
4894 }
4895
4896 static ExecRuntime* exec_runtime_free(ExecRuntime *rt, bool destroy) {
4897         int r;
4898
4899         if (!rt)
4900                 return NULL;
4901
4902         if (rt->manager)
4903                 (void) hashmap_remove(rt->manager->exec_runtime_by_id, rt->id);
4904
4905         /* When destroy is true, then rm_rf tmp_dir and var_tmp_dir. */
4906         if (destroy && rt->tmp_dir) {
4907                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
4908
4909                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
4910                 if (r < 0) {
4911                         log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
4912                         free(rt->tmp_dir);
4913                 }
4914
4915                 rt->tmp_dir = NULL;
4916         }
4917
4918         if (destroy && rt->var_tmp_dir) {
4919                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
4920
4921                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
4922                 if (r < 0) {
4923                         log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
4924                         free(rt->var_tmp_dir);
4925                 }
4926
4927                 rt->var_tmp_dir = NULL;
4928         }
4929
4930         rt->id = mfree(rt->id);
4931         rt->tmp_dir = mfree(rt->tmp_dir);
4932         rt->var_tmp_dir = mfree(rt->var_tmp_dir);
4933         safe_close_pair(rt->netns_storage_socket);
4934         return mfree(rt);
4935 }
4936
4937 static void exec_runtime_freep(ExecRuntime **rt) {
4938         (void) exec_runtime_free(*rt, false);
4939 }
4940
4941 static int exec_runtime_allocate(ExecRuntime **ret) {
4942         ExecRuntime *n;
4943
4944         assert(ret);
4945
4946         n = new(ExecRuntime, 1);
4947         if (!n)
4948                 return -ENOMEM;
4949
4950         *n = (ExecRuntime) {
4951                 .netns_storage_socket = { -1, -1 },
4952         };
4953
4954         *ret = n;
4955         return 0;
4956 }
4957
4958 static int exec_runtime_add(
4959                 Manager *m,
4960                 const char *id,
4961                 const char *tmp_dir,
4962                 const char *var_tmp_dir,
4963                 const int netns_storage_socket[2],
4964                 ExecRuntime **ret) {
4965
4966         _cleanup_(exec_runtime_freep) ExecRuntime *rt = NULL;
4967         int r;
4968
4969         assert(m);
4970         assert(id);
4971
4972         r = hashmap_ensure_allocated(&m->exec_runtime_by_id, &string_hash_ops);
4973         if (r < 0)
4974                 return r;
4975
4976         r = exec_runtime_allocate(&rt);
4977         if (r < 0)
4978                 return r;
4979
4980         rt->id = strdup(id);
4981         if (!rt->id)
4982                 return -ENOMEM;
4983
4984         if (tmp_dir) {
4985                 rt->tmp_dir = strdup(tmp_dir);
4986                 if (!rt->tmp_dir)
4987                         return -ENOMEM;
4988
4989                 /* When tmp_dir is set, then we require var_tmp_dir is also set. */
4990                 assert(var_tmp_dir);
4991                 rt->var_tmp_dir = strdup(var_tmp_dir);
4992                 if (!rt->var_tmp_dir)
4993                         return -ENOMEM;
4994         }
4995
4996         if (netns_storage_socket) {
4997                 rt->netns_storage_socket[0] = netns_storage_socket[0];
4998                 rt->netns_storage_socket[1] = netns_storage_socket[1];
4999         }
5000
5001         r = hashmap_put(m->exec_runtime_by_id, rt->id, rt);
5002         if (r < 0)
5003                 return r;
5004
5005         rt->manager = m;
5006
5007         if (ret)
5008                 *ret = rt;
5009
5010         /* do not remove created ExecRuntime object when the operation succeeds. */
5011         rt = NULL;
5012         return 0;
5013 }
5014
5015 static int exec_runtime_make(Manager *m, const ExecContext *c, const char *id, ExecRuntime **ret) {
5016         _cleanup_free_ char *tmp_dir = NULL, *var_tmp_dir = NULL;
5017         _cleanup_close_pair_ int netns_storage_socket[2] = { -1, -1 };
5018         int r;
5019
5020         assert(m);
5021         assert(c);
5022         assert(id);
5023
5024         /* It is not necessary to create ExecRuntime object. */
5025         if (!c->private_network && !c->private_tmp && !c->network_namespace_path)
5026                 return 0;
5027
5028         if (c->private_tmp) {
5029                 r = setup_tmp_dirs(id, &tmp_dir, &var_tmp_dir);
5030                 if (r < 0)
5031                         return r;
5032         }
5033
5034         if (c->private_network || c->network_namespace_path) {
5035                 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, netns_storage_socket) < 0)
5036                         return -errno;
5037         }
5038
5039         r = exec_runtime_add(m, id, tmp_dir, var_tmp_dir, netns_storage_socket, ret);
5040         if (r < 0)
5041                 return r;
5042
5043         /* Avoid cleanup */
5044         netns_storage_socket[0] = netns_storage_socket[1] = -1;
5045         return 1;
5046 }
5047
5048 int exec_runtime_acquire(Manager *m, const ExecContext *c, const char *id, bool create, ExecRuntime **ret) {
5049         ExecRuntime *rt;
5050         int r;
5051
5052         assert(m);
5053         assert(id);
5054         assert(ret);
5055
5056         rt = hashmap_get(m->exec_runtime_by_id, id);
5057         if (rt)
5058                 /* We already have a ExecRuntime object, let's increase the ref count and reuse it */
5059                 goto ref;
5060
5061         if (!create)
5062                 return 0;
5063
5064         /* If not found, then create a new object. */
5065         r = exec_runtime_make(m, c, id, &rt);
5066         if (r <= 0)
5067                 /* When r == 0, it is not necessary to create ExecRuntime object. */
5068                 return r;
5069
5070 ref:
5071         /* increment reference counter. */
5072         rt->n_ref++;
5073         *ret = rt;
5074         return 1;
5075 }
5076
5077 ExecRuntime *exec_runtime_unref(ExecRuntime *rt, bool destroy) {
5078         if (!rt)
5079                 return NULL;
5080
5081         assert(rt->n_ref > 0);
5082
5083         rt->n_ref--;
5084         if (rt->n_ref > 0)
5085                 return NULL;
5086
5087         return exec_runtime_free(rt, destroy);
5088 }
5089
5090 int exec_runtime_serialize(const Manager *m, FILE *f, FDSet *fds) {
5091         ExecRuntime *rt;
5092         Iterator i;
5093
5094         assert(m);
5095         assert(f);
5096         assert(fds);
5097
5098         HASHMAP_FOREACH(rt, m->exec_runtime_by_id, i) {
5099                 fprintf(f, "exec-runtime=%s", rt->id);
5100
5101                 if (rt->tmp_dir)
5102                         fprintf(f, " tmp-dir=%s", rt->tmp_dir);
5103
5104                 if (rt->var_tmp_dir)
5105                         fprintf(f, " var-tmp-dir=%s", rt->var_tmp_dir);
5106
5107                 if (rt->netns_storage_socket[0] >= 0) {
5108                         int copy;
5109
5110                         copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
5111                         if (copy < 0)
5112                                 return copy;
5113
5114                         fprintf(f, " netns-socket-0=%i", copy);
5115                 }
5116
5117                 if (rt->netns_storage_socket[1] >= 0) {
5118                         int copy;
5119
5120                         copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
5121                         if (copy < 0)
5122                                 return copy;
5123
5124                         fprintf(f, " netns-socket-1=%i", copy);
5125                 }
5126
5127                 fputc('\n', f);
5128         }
5129
5130         return 0;
5131 }
5132
5133 int exec_runtime_deserialize_compat(Unit *u, const char *key, const char *value, FDSet *fds) {
5134         _cleanup_(exec_runtime_freep) ExecRuntime *rt_create = NULL;
5135         ExecRuntime *rt;
5136         int r;
5137
5138         /* This is for the migration from old (v237 or earlier) deserialization text.
5139          * Due to the bug #7790, this may not work with the units that use JoinsNamespaceOf=.
5140          * Even if the ExecRuntime object originally created by the other unit, we cannot judge
5141          * so or not from the serialized text, then we always creates a new object owned by this. */
5142
5143         assert(u);
5144         assert(key);
5145         assert(value);
5146
5147         /* Manager manages ExecRuntime objects by the unit id.
5148          * So, we omit the serialized text when the unit does not have id (yet?)... */
5149         if (isempty(u->id)) {
5150                 log_unit_debug(u, "Invocation ID not found. Dropping runtime parameter.");
5151                 return 0;
5152         }
5153
5154         r = hashmap_ensure_allocated(&u->manager->exec_runtime_by_id, &string_hash_ops);
5155         if (r < 0) {
5156                 log_unit_debug_errno(u, r, "Failed to allocate storage for runtime parameter: %m");
5157                 return 0;
5158         }
5159
5160         rt = hashmap_get(u->manager->exec_runtime_by_id, u->id);
5161         if (!rt) {
5162                 r = exec_runtime_allocate(&rt_create);
5163                 if (r < 0)
5164                         return log_oom();
5165
5166                 rt_create->id = strdup(u->id);
5167                 if (!rt_create->id)
5168                         return log_oom();
5169
5170                 rt = rt_create;
5171         }
5172
5173         if (streq(key, "tmp-dir")) {
5174                 char *copy;
5175
5176                 copy = strdup(value);
5177                 if (!copy)
5178                         return log_oom();
5179
5180                 free_and_replace(rt->tmp_dir, copy);
5181
5182         } else if (streq(key, "var-tmp-dir")) {
5183                 char *copy;
5184
5185                 copy = strdup(value);
5186                 if (!copy)
5187                         return log_oom();
5188
5189                 free_and_replace(rt->var_tmp_dir, copy);
5190
5191         } else if (streq(key, "netns-socket-0")) {
5192                 int fd;
5193
5194                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
5195                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
5196                         return 0;
5197                 }
5198
5199                 safe_close(rt->netns_storage_socket[0]);
5200                 rt->netns_storage_socket[0] = fdset_remove(fds, fd);
5201
5202         } else if (streq(key, "netns-socket-1")) {
5203                 int fd;
5204
5205                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
5206                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
5207                         return 0;
5208                 }
5209
5210                 safe_close(rt->netns_storage_socket[1]);
5211                 rt->netns_storage_socket[1] = fdset_remove(fds, fd);
5212         } else
5213                 return 0;
5214
5215         /* If the object is newly created, then put it to the hashmap which manages ExecRuntime objects. */
5216         if (rt_create) {
5217                 r = hashmap_put(u->manager->exec_runtime_by_id, rt_create->id, rt_create);
5218                 if (r < 0) {
5219                         log_unit_debug_errno(u, r, "Failed to put runtime parameter to manager's storage: %m");
5220                         return 0;
5221                 }
5222
5223                 rt_create->manager = u->manager;
5224
5225                 /* Avoid cleanup */
5226                 rt_create = NULL;
5227         }
5228
5229         return 1;
5230 }
5231
5232 void exec_runtime_deserialize_one(Manager *m, const char *value, FDSet *fds) {
5233         char *id = NULL, *tmp_dir = NULL, *var_tmp_dir = NULL;
5234         int r, fd0 = -1, fd1 = -1;
5235         const char *p, *v = value;
5236         size_t n;
5237
5238         assert(m);
5239         assert(value);
5240         assert(fds);
5241
5242         n = strcspn(v, " ");
5243         id = strndupa(v, n);
5244         if (v[n] != ' ')
5245                 goto finalize;
5246         p = v + n + 1;
5247
5248         v = startswith(p, "tmp-dir=");
5249         if (v) {
5250                 n = strcspn(v, " ");
5251                 tmp_dir = strndupa(v, n);
5252                 if (v[n] != ' ')
5253                         goto finalize;
5254                 p = v + n + 1;
5255         }
5256
5257         v = startswith(p, "var-tmp-dir=");
5258         if (v) {
5259                 n = strcspn(v, " ");
5260                 var_tmp_dir = strndupa(v, n);
5261                 if (v[n] != ' ')
5262                         goto finalize;
5263                 p = v + n + 1;
5264         }
5265
5266         v = startswith(p, "netns-socket-0=");
5267         if (v) {
5268                 char *buf;
5269
5270                 n = strcspn(v, " ");
5271                 buf = strndupa(v, n);
5272                 if (safe_atoi(buf, &fd0) < 0 || !fdset_contains(fds, fd0)) {
5273                         log_debug("Unable to process exec-runtime netns fd specification.");
5274                         return;
5275                 }
5276                 fd0 = fdset_remove(fds, fd0);
5277                 if (v[n] != ' ')
5278                         goto finalize;
5279                 p = v + n + 1;
5280         }
5281
5282         v = startswith(p, "netns-socket-1=");
5283         if (v) {
5284                 char *buf;
5285
5286                 n = strcspn(v, " ");
5287                 buf = strndupa(v, n);
5288                 if (safe_atoi(buf, &fd1) < 0 || !fdset_contains(fds, fd1)) {
5289                         log_debug("Unable to process exec-runtime netns fd specification.");
5290                         return;
5291                 }
5292                 fd1 = fdset_remove(fds, fd1);
5293         }
5294
5295 finalize:
5296
5297         r = exec_runtime_add(m, id, tmp_dir, var_tmp_dir, (int[]) { fd0, fd1 }, NULL);
5298         if (r < 0)
5299                 log_debug_errno(r, "Failed to add exec-runtime: %m");
5300 }
5301
5302 void exec_runtime_vacuum(Manager *m) {
5303         ExecRuntime *rt;
5304         Iterator i;
5305
5306         assert(m);
5307
5308         /* Free unreferenced ExecRuntime objects. This is used after manager deserialization process. */
5309
5310         HASHMAP_FOREACH(rt, m->exec_runtime_by_id, i) {
5311                 if (rt->n_ref > 0)
5312                         continue;
5313
5314                 (void) exec_runtime_free(rt, false);
5315         }
5316 }
5317
5318 void exec_params_clear(ExecParameters *p) {
5319         if (!p)
5320                 return;
5321
5322         strv_free(p->environment);
5323 }
5324
5325 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
5326         [EXEC_INPUT_NULL] = "null",
5327         [EXEC_INPUT_TTY] = "tty",
5328         [EXEC_INPUT_TTY_FORCE] = "tty-force",
5329         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
5330         [EXEC_INPUT_SOCKET] = "socket",
5331         [EXEC_INPUT_NAMED_FD] = "fd",
5332         [EXEC_INPUT_DATA] = "data",
5333         [EXEC_INPUT_FILE] = "file",
5334 };
5335
5336 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
5337
5338 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
5339         [EXEC_OUTPUT_INHERIT] = "inherit",
5340         [EXEC_OUTPUT_NULL] = "null",
5341         [EXEC_OUTPUT_TTY] = "tty",
5342         [EXEC_OUTPUT_SYSLOG] = "syslog",
5343         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
5344         [EXEC_OUTPUT_KMSG] = "kmsg",
5345         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
5346         [EXEC_OUTPUT_JOURNAL] = "journal",
5347         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
5348         [EXEC_OUTPUT_SOCKET] = "socket",
5349         [EXEC_OUTPUT_NAMED_FD] = "fd",
5350         [EXEC_OUTPUT_FILE] = "file",
5351         [EXEC_OUTPUT_FILE_APPEND] = "append",
5352 };
5353
5354 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
5355
5356 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
5357         [EXEC_UTMP_INIT] = "init",
5358         [EXEC_UTMP_LOGIN] = "login",
5359         [EXEC_UTMP_USER] = "user",
5360 };
5361
5362 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);
5363
5364 static const char* const exec_preserve_mode_table[_EXEC_PRESERVE_MODE_MAX] = {
5365         [EXEC_PRESERVE_NO] = "no",
5366         [EXEC_PRESERVE_YES] = "yes",
5367         [EXEC_PRESERVE_RESTART] = "restart",
5368 };
5369
5370 DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(exec_preserve_mode, ExecPreserveMode, EXEC_PRESERVE_YES);
5371
5372 static const char* const exec_directory_type_table[_EXEC_DIRECTORY_TYPE_MAX] = {
5373         [EXEC_DIRECTORY_RUNTIME] = "RuntimeDirectory",
5374         [EXEC_DIRECTORY_STATE] = "StateDirectory",
5375         [EXEC_DIRECTORY_CACHE] = "CacheDirectory",
5376         [EXEC_DIRECTORY_LOGS] = "LogsDirectory",
5377         [EXEC_DIRECTORY_CONFIGURATION] = "ConfigurationDirectory",
5378 };
5379
5380 DEFINE_STRING_TABLE_LOOKUP(exec_directory_type, ExecDirectoryType);
5381
5382 static const char* const exec_directory_env_name_table[_EXEC_DIRECTORY_TYPE_MAX] = {
5383         [EXEC_DIRECTORY_RUNTIME] = "RUNTIME_DIRECTORY",
5384         [EXEC_DIRECTORY_STATE] = "STATE_DIRECTORY",
5385         [EXEC_DIRECTORY_CACHE] = "CACHE_DIRECTORY",
5386         [EXEC_DIRECTORY_LOGS] = "LOGS_DIRECTORY",
5387         [EXEC_DIRECTORY_CONFIGURATION] = "CONFIGURATION_DIRECTORY",
5388 };
5389
5390 DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(exec_directory_env_name, ExecDirectoryType);
5391
5392 static const char* const exec_keyring_mode_table[_EXEC_KEYRING_MODE_MAX] = {
5393         [EXEC_KEYRING_INHERIT] = "inherit",
5394         [EXEC_KEYRING_PRIVATE] = "private",
5395         [EXEC_KEYRING_SHARED] = "shared",
5396 };
5397
5398 DEFINE_STRING_TABLE_LOOKUP(exec_keyring_mode, ExecKeyringMode);