src/core/execute.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <glob.h>
   6 #include <grp.h>
   7 #include <poll.h>
   8 #include <signal.h>
   9 #include <string.h>
  10 #include <sys/capability.h>
  11 #include <sys/eventfd.h>
  12 #include <sys/mman.h>
  13 #include <sys/personality.h>
  14 #include <sys/prctl.h>
  15 #include <sys/shm.h>
  16 #include <sys/socket.h>
  17 #include <sys/stat.h>
  18 #include <sys/types.h>
  19 #include <sys/un.h>
  20 #include <unistd.h>
  21 #include <utmpx.h>
  22
  23 #if HAVE_PAM
  24 #include <security/pam_appl.h>
  25 #endif
  26
  27 #if HAVE_SELINUX
  28 #include <selinux/selinux.h>
  29 #endif
  30
  31 #if HAVE_SECCOMP
  32 #include <seccomp.h>
  33 #endif
  34
  35 #if HAVE_APPARMOR
  36 #include <sys/apparmor.h>
  37 #endif
  38
  39 #include "sd-messages.h"
  40
  41 #include "af-list.h"
  42 #include "alloc-util.h"
  43 #if HAVE_APPARMOR
  44 #include "apparmor-util.h"
  45 #endif
  46 #include "async.h"
  47 #include "barrier.h"
  48 #include "cap-list.h"
  49 #include "capability-util.h"
  50 #include "chown-recursive.h"
  51 #include "cpu-set-util.h"
  52 #include "def.h"
  53 #include "env-util.h"
  54 #include "errno-list.h"
  55 #include "execute.h"
  56 #include "exit-status.h"
  57 #include "fd-util.h"
  58 #include "fileio.h"
  59 #include "format-util.h"
  60 #include "fs-util.h"
  61 #include "glob-util.h"
  62 #include "io-util.h"
  63 #include "ioprio.h"
  64 #include "label.h"
  65 #include "log.h"
  66 #include "macro.h"
  67 #include "manager.h"
  68 #include "missing.h"
  69 #include "mkdir.h"
  70 #include "namespace.h"
  71 #include "parse-util.h"
  72 #include "path-util.h"
  73 #include "process-util.h"
  74 #include "rlimit-util.h"
  75 #include "rm-rf.h"
  76 #if HAVE_SECCOMP
  77 #include "seccomp-util.h"
  78 #endif
  79 #include "securebits.h"
  80 #include "securebits-util.h"
  81 #include "selinux-util.h"
  82 #include "signal-util.h"
  83 #include "smack-util.h"
  84 #include "socket-util.h"
  85 #include "special.h"
  86 #include "stat-util.h"
  87 #include "string-table.h"
  88 #include "string-util.h"
  89 #include "strv.h"
  90 #include "syslog-util.h"
  91 #include "terminal-util.h"
  92 #include "umask-util.h"
  93 #include "unit.h"
  94 #include "user-util.h"
  95 #include "util.h"
  96 #include "utmp-wtmp.h"
  97
  98 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  99 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
 100
 101 /* This assumes there is a 'tty' group */
 102 #define TTY_MODE 0620
 103
 104 #define SNDBUF_SIZE (8*1024*1024)
 105
 106 static int shift_fds(int fds[], size_t n_fds) {
 107         int start, restart_from;
 108
 109         if (n_fds <= 0)
 110                 return 0;
 111
 112         /* Modifies the fds array! (sorts it) */
 113
 114         assert(fds);
 115
 116         start = 0;
 117         for (;;) {
 118                 int i;
 119
 120                 restart_from = -1;
 121
 122                 for (i = start; i < (int) n_fds; i++) {
 123                         int nfd;
 124
 125                         /* Already at right index? */
 126                         if (fds[i] == i+3)
 127                                 continue;
 128
 129                         nfd = fcntl(fds[i], F_DUPFD, i + 3);
 130                         if (nfd < 0)
 131                                 return -errno;
 132
 133                         safe_close(fds[i]);
 134                         fds[i] = nfd;
 135
 136                         /* Hmm, the fd we wanted isn't free? Then
 137                          * let's remember that and try again from here */
 138                         if (nfd != i+3 && restart_from < 0)
 139                                 restart_from = i;
 140                 }
 141
 142                 if (restart_from < 0)
 143                         break;
 144
 145                 start = restart_from;
 146         }
 147
 148         return 0;
 149 }
 150
 151 static int flags_fds(const int fds[], size_t n_socket_fds, size_t n_storage_fds, bool nonblock) {
 152         size_t i, n_fds;
 153         int r;
 154
 155         n_fds = n_socket_fds + n_storage_fds;
 156         if (n_fds <= 0)
 157                 return 0;
 158
 159         assert(fds);
 160
 161         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags.
 162          * O_NONBLOCK only applies to socket activation though. */
 163
 164         for (i = 0; i < n_fds; i++) {
 165
 166                 if (i < n_socket_fds) {
 167                         r = fd_nonblock(fds[i], nonblock);
 168                         if (r < 0)
 169                                 return r;
 170                 }
 171
 172                 /* We unconditionally drop FD_CLOEXEC from the fds,
 173                  * since after all we want to pass these fds to our
 174                  * children */
 175
 176                 r = fd_cloexec(fds[i], false);
 177                 if (r < 0)
 178                         return r;
 179         }
 180
 181         return 0;
 182 }
 183
 184 static const char *exec_context_tty_path(const ExecContext *context) {
 185         assert(context);
 186
 187         if (context->stdio_as_fds)
 188                 return NULL;
 189
 190         if (context->tty_path)
 191                 return context->tty_path;
 192
 193         return "/dev/console";
 194 }
 195
 196 static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {
 197         const char *path;
 198
 199         assert(context);
 200
 201         path = exec_context_tty_path(context);
 202
 203         if (context->tty_vhangup) {
 204                 if (p && p->stdin_fd >= 0)
 205                         (void) terminal_vhangup_fd(p->stdin_fd);
 206                 else if (path)
 207                         (void) terminal_vhangup(path);
 208         }
 209
 210         if (context->tty_reset) {
 211                 if (p && p->stdin_fd >= 0)
 212                         (void) reset_terminal_fd(p->stdin_fd, true);
 213                 else if (path)
 214                         (void) reset_terminal(path);
 215         }
 216
 217         if (context->tty_vt_disallocate && path)
 218                 (void) vt_disallocate(path);
 219 }
 220
 221 static bool is_terminal_input(ExecInput i) {
 222         return IN_SET(i,
 223                       EXEC_INPUT_TTY,
 224                       EXEC_INPUT_TTY_FORCE,
 225                       EXEC_INPUT_TTY_FAIL);
 226 }
 227
 228 static bool is_terminal_output(ExecOutput o) {
 229         return IN_SET(o,
 230                       EXEC_OUTPUT_TTY,
 231                       EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 232                       EXEC_OUTPUT_KMSG_AND_CONSOLE,
 233                       EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 234 }
 235
 236 static bool is_syslog_output(ExecOutput o) {
 237         return IN_SET(o,
 238                       EXEC_OUTPUT_SYSLOG,
 239                       EXEC_OUTPUT_SYSLOG_AND_CONSOLE);
 240 }
 241
 242 static bool is_kmsg_output(ExecOutput o) {
 243         return IN_SET(o,
 244                       EXEC_OUTPUT_KMSG,
 245                       EXEC_OUTPUT_KMSG_AND_CONSOLE);
 246 }
 247
 248 static bool exec_context_needs_term(const ExecContext *c) {
 249         assert(c);
 250
 251         /* Return true if the execution context suggests we should set $TERM to something useful. */
 252
 253         if (is_terminal_input(c->std_input))
 254                 return true;
 255
 256         if (is_terminal_output(c->std_output))
 257                 return true;
 258
 259         if (is_terminal_output(c->std_error))
 260                 return true;
 261
 262         return !!c->tty_path;
 263 }
 264
 265 static int open_null_as(int flags, int nfd) {
 266         int fd;
 267
 268         assert(nfd >= 0);
 269
 270         fd = open("/dev/null", flags|O_NOCTTY);
 271         if (fd < 0)
 272                 return -errno;
 273
 274         return move_fd(fd, nfd, false);
 275 }
 276
 277 static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
 278         static const union sockaddr_union sa = {
 279                 .un.sun_family = AF_UNIX,
 280                 .un.sun_path = "/run/systemd/journal/stdout",
 281         };
 282         uid_t olduid = UID_INVALID;
 283         gid_t oldgid = GID_INVALID;
 284         int r;
 285
 286         if (gid_is_valid(gid)) {
 287                 oldgid = getgid();
 288
 289                 if (setegid(gid) < 0)
 290                         return -errno;
 291         }
 292
 293         if (uid_is_valid(uid)) {
 294                 olduid = getuid();
 295
 296                 if (seteuid(uid) < 0) {
 297                         r = -errno;
 298                         goto restore_gid;
 299                 }
 300         }
 301
 302         r = connect(fd, &sa.sa, SOCKADDR_UN_LEN(sa.un)) < 0 ? -errno : 0;
 303
 304         /* If we fail to restore the uid or gid, things will likely
 305            fail later on. This should only happen if an LSM interferes. */
 306
 307         if (uid_is_valid(uid))
 308                 (void) seteuid(olduid);
 309
 310  restore_gid:
 311         if (gid_is_valid(gid))
 312                 (void) setegid(oldgid);
 313
 314         return r;
 315 }
 316
 317 static int connect_logger_as(
 318                 const Unit *unit,
 319                 const ExecContext *context,
 320                 const ExecParameters *params,
 321                 ExecOutput output,
 322                 const char *ident,
 323                 int nfd,
 324                 uid_t uid,
 325                 gid_t gid) {
 326
 327         _cleanup_close_ int fd = -1;
 328         int r;
 329
 330         assert(context);
 331         assert(params);
 332         assert(output < _EXEC_OUTPUT_MAX);
 333         assert(ident);
 334         assert(nfd >= 0);
 335
 336         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 337         if (fd < 0)
 338                 return -errno;
 339
 340         r = connect_journal_socket(fd, uid, gid);
 341         if (r < 0)
 342                 return r;
 343
 344         if (shutdown(fd, SHUT_RD) < 0)
 345                 return -errno;
 346
 347         (void) fd_inc_sndbuf(fd, SNDBUF_SIZE);
 348
 349         if (dprintf(fd,
 350                 "%s\n"
 351                 "%s\n"
 352                 "%i\n"
 353                 "%i\n"
 354                 "%i\n"
 355                 "%i\n"
 356                 "%i\n",
 357                 context->syslog_identifier ?: ident,
 358                 params->flags & EXEC_PASS_LOG_UNIT ? unit->id : "",
 359                 context->syslog_priority,
 360                 !!context->syslog_level_prefix,
 361                 is_syslog_output(output),
 362                 is_kmsg_output(output),
 363                 is_terminal_output(output)) < 0)
 364                 return -errno;
 365
 366         return move_fd(TAKE_FD(fd), nfd, false);
 367 }
 368
 369 static int open_terminal_as(const char *path, int flags, int nfd) {
 370         int fd;
 371
 372         assert(path);
 373         assert(nfd >= 0);
 374
 375         fd = open_terminal(path, flags | O_NOCTTY);
 376         if (fd < 0)
 377                 return fd;
 378
 379         return move_fd(fd, nfd, false);
 380 }
 381
 382 static int acquire_path(const char *path, int flags, mode_t mode) {
 383         union sockaddr_union sa = {};
 384         _cleanup_close_ int fd = -1;
 385         int r, salen;
 386
 387         assert(path);
 388
 389         if (IN_SET(flags & O_ACCMODE, O_WRONLY, O_RDWR))
 390                 flags |= O_CREAT;
 391
 392         fd = open(path, flags|O_NOCTTY, mode);
 393         if (fd >= 0)
 394                 return TAKE_FD(fd);
 395
 396         if (errno != ENXIO) /* ENXIO is returned when we try to open() an AF_UNIX file system socket on Linux */
 397                 return -errno;
 398         if (strlen(path) >= sizeof(sa.un.sun_path)) /* Too long, can't be a UNIX socket */
 399                 return -ENXIO;
 400
 401         /* So, it appears the specified path could be an AF_UNIX socket. Let's see if we can connect to it. */
 402
 403         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 404         if (fd < 0)
 405                 return -errno;
 406
 407         salen = sockaddr_un_set_path(&sa.un, path);
 408         if (salen < 0)
 409                 return salen;
 410
 411         if (connect(fd, &sa.sa, salen) < 0)
 412                 return errno == EINVAL ? -ENXIO : -errno; /* Propagate initial error if we get EINVAL, i.e. we have
 413                                                            * indication that his wasn't an AF_UNIX socket after all */
 414
 415         if ((flags & O_ACCMODE) == O_RDONLY)
 416                 r = shutdown(fd, SHUT_WR);
 417         else if ((flags & O_ACCMODE) == O_WRONLY)
 418                 r = shutdown(fd, SHUT_RD);
 419         else
 420                 return TAKE_FD(fd);
 421         if (r < 0)
 422                 return -errno;
 423
 424         return TAKE_FD(fd);
 425 }
 426
 427 static int fixup_input(
 428                 const ExecContext *context,
 429                 int socket_fd,
 430                 bool apply_tty_stdin) {
 431
 432         ExecInput std_input;
 433
 434         assert(context);
 435
 436         std_input = context->std_input;
 437
 438         if (is_terminal_input(std_input) && !apply_tty_stdin)
 439                 return EXEC_INPUT_NULL;
 440
 441         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 442                 return EXEC_INPUT_NULL;
 443
 444         if (std_input == EXEC_INPUT_DATA && context->stdin_data_size == 0)
 445                 return EXEC_INPUT_NULL;
 446
 447         return std_input;
 448 }
 449
 450 static int fixup_output(ExecOutput std_output, int socket_fd) {
 451
 452         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 453                 return EXEC_OUTPUT_INHERIT;
 454
 455         return std_output;
 456 }
 457
 458 static int setup_input(
 459                 const ExecContext *context,
 460                 const ExecParameters *params,
 461                 int socket_fd,
 462                 int named_iofds[3]) {
 463
 464         ExecInput i;
 465
 466         assert(context);
 467         assert(params);
 468
 469         if (params->stdin_fd >= 0) {
 470                 if (dup2(params->stdin_fd, STDIN_FILENO) < 0)
 471                         return -errno;
 472
 473                 /* Try to make this the controlling tty, if it is a tty, and reset it */
 474                 if (isatty(STDIN_FILENO)) {
 475                         (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);
 476                         (void) reset_terminal_fd(STDIN_FILENO, true);
 477                 }
 478
 479                 return STDIN_FILENO;
 480         }
 481
 482         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 483
 484         switch (i) {
 485
 486         case EXEC_INPUT_NULL:
 487                 return open_null_as(O_RDONLY, STDIN_FILENO);
 488
 489         case EXEC_INPUT_TTY:
 490         case EXEC_INPUT_TTY_FORCE:
 491         case EXEC_INPUT_TTY_FAIL: {
 492                 int fd;
 493
 494                 fd = acquire_terminal(exec_context_tty_path(context),
 495                                       i == EXEC_INPUT_TTY_FAIL  ? ACQUIRE_TERMINAL_TRY :
 496                                       i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE :
 497                                                                   ACQUIRE_TERMINAL_WAIT,
 498                                       USEC_INFINITY);
 499                 if (fd < 0)
 500                         return fd;
 501
 502                 return move_fd(fd, STDIN_FILENO, false);
 503         }
 504
 505         case EXEC_INPUT_SOCKET:
 506                 assert(socket_fd >= 0);
 507
 508                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 509
 510         case EXEC_INPUT_NAMED_FD:
 511                 assert(named_iofds[STDIN_FILENO] >= 0);
 512
 513                 (void) fd_nonblock(named_iofds[STDIN_FILENO], false);
 514                 return dup2(named_iofds[STDIN_FILENO], STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 515
 516         case EXEC_INPUT_DATA: {
 517                 int fd;
 518
 519                 fd = acquire_data_fd(context->stdin_data, context->stdin_data_size, 0);
 520                 if (fd < 0)
 521                         return fd;
 522
 523                 return move_fd(fd, STDIN_FILENO, false);
 524         }
 525
 526         case EXEC_INPUT_FILE: {
 527                 bool rw;
 528                 int fd;
 529
 530                 assert(context->stdio_file[STDIN_FILENO]);
 531
 532                 rw = (context->std_output == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDOUT_FILENO])) ||
 533                         (context->std_error == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDERR_FILENO]));
 534
 535                 fd = acquire_path(context->stdio_file[STDIN_FILENO], rw ? O_RDWR : O_RDONLY, 0666 & ~context->umask);
 536                 if (fd < 0)
 537                         return fd;
 538
 539                 return move_fd(fd, STDIN_FILENO, false);
 540         }
 541
 542         default:
 543                 assert_not_reached("Unknown input type");
 544         }
 545 }
 546
 547 static int setup_output(
 548                 const Unit *unit,
 549                 const ExecContext *context,
 550                 const ExecParameters *params,
 551                 int fileno,
 552                 int socket_fd,
 553                 int named_iofds[3],
 554                 const char *ident,
 555                 uid_t uid,
 556                 gid_t gid,
 557                 dev_t *journal_stream_dev,
 558                 ino_t *journal_stream_ino) {
 559
 560         ExecOutput o;
 561         ExecInput i;
 562         int r;
 563
 564         assert(unit);
 565         assert(context);
 566         assert(params);
 567         assert(ident);
 568         assert(journal_stream_dev);
 569         assert(journal_stream_ino);
 570
 571         if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {
 572
 573                 if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)
 574                         return -errno;
 575
 576                 return STDOUT_FILENO;
 577         }
 578
 579         if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {
 580                 if (dup2(params->stderr_fd, STDERR_FILENO) < 0)
 581                         return -errno;
 582
 583                 return STDERR_FILENO;
 584         }
 585
 586         i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);
 587         o = fixup_output(context->std_output, socket_fd);
 588
 589         if (fileno == STDERR_FILENO) {
 590                 ExecOutput e;
 591                 e = fixup_output(context->std_error, socket_fd);
 592
 593                 /* This expects the input and output are already set up */
 594
 595                 /* Don't change the stderr file descriptor if we inherit all
 596                  * the way and are not on a tty */
 597                 if (e == EXEC_OUTPUT_INHERIT &&
 598                     o == EXEC_OUTPUT_INHERIT &&
 599                     i == EXEC_INPUT_NULL &&
 600                     !is_terminal_input(context->std_input) &&
 601                     getppid () != 1)
 602                         return fileno;
 603
 604                 /* Duplicate from stdout if possible */
 605                 if ((e == o && e != EXEC_OUTPUT_NAMED_FD) || e == EXEC_OUTPUT_INHERIT)
 606                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 607
 608                 o = e;
 609
 610         } else if (o == EXEC_OUTPUT_INHERIT) {
 611                 /* If input got downgraded, inherit the original value */
 612                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 613                         return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 614
 615                 /* If the input is connected to anything that's not a /dev/null or a data fd, inherit that... */
 616                 if (!IN_SET(i, EXEC_INPUT_NULL, EXEC_INPUT_DATA))
 617                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 618
 619                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 620                 if (getppid() != 1)
 621                         return fileno;
 622
 623                 /* We need to open /dev/null here anew, to get the right access mode. */
 624                 return open_null_as(O_WRONLY, fileno);
 625         }
 626
 627         switch (o) {
 628
 629         case EXEC_OUTPUT_NULL:
 630                 return open_null_as(O_WRONLY, fileno);
 631
 632         case EXEC_OUTPUT_TTY:
 633                 if (is_terminal_input(i))
 634                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 635
 636                 /* We don't reset the terminal if this is just about output */
 637                 return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);
 638
 639         case EXEC_OUTPUT_SYSLOG:
 640         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 641         case EXEC_OUTPUT_KMSG:
 642         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 643         case EXEC_OUTPUT_JOURNAL:
 644         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 645                 r = connect_logger_as(unit, context, params, o, ident, fileno, uid, gid);
 646                 if (r < 0) {
 647                         log_unit_warning_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", fileno == STDOUT_FILENO ? "stdout" : "stderr");
 648                         r = open_null_as(O_WRONLY, fileno);
 649                 } else {
 650                         struct stat st;
 651
 652                         /* If we connected this fd to the journal via a stream, patch the device/inode into the passed
 653                          * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits
 654                          * services to detect whether they are connected to the journal or not.
 655                          *
 656                          * If both stdout and stderr are connected to a stream then let's make sure to store the data
 657                          * about STDERR as that's usually the best way to do logging. */
 658
 659                         if (fstat(fileno, &st) >= 0 &&
 660                             (*journal_stream_ino == 0 || fileno == STDERR_FILENO)) {
 661                                 *journal_stream_dev = st.st_dev;
 662                                 *journal_stream_ino = st.st_ino;
 663                         }
 664                 }
 665                 return r;
 666
 667         case EXEC_OUTPUT_SOCKET:
 668                 assert(socket_fd >= 0);
 669
 670                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 671
 672         case EXEC_OUTPUT_NAMED_FD:
 673                 assert(named_iofds[fileno] >= 0);
 674
 675                 (void) fd_nonblock(named_iofds[fileno], false);
 676                 return dup2(named_iofds[fileno], fileno) < 0 ? -errno : fileno;
 677
 678         case EXEC_OUTPUT_FILE:
 679         case EXEC_OUTPUT_FILE_APPEND: {
 680                 bool rw;
 681                 int fd, flags;
 682
 683                 assert(context->stdio_file[fileno]);
 684
 685                 rw = context->std_input == EXEC_INPUT_FILE &&
 686                         streq_ptr(context->stdio_file[fileno], context->stdio_file[STDIN_FILENO]);
 687
 688                 if (rw)
 689                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 690
 691                 flags = O_WRONLY;
 692                 if (o == EXEC_OUTPUT_FILE_APPEND)
 693                         flags |= O_APPEND;
 694
 695                 fd = acquire_path(context->stdio_file[fileno], flags, 0666 & ~context->umask);
 696
 697                 if (fd < 0)
 698                         return fd;
 699
 700                 return move_fd(fd, fileno, 0);
 701         }
 702
 703         default:
 704                 assert_not_reached("Unknown error type");
 705         }
 706 }
 707
 708 static int chown_terminal(int fd, uid_t uid) {
 709         struct stat st;
 710
 711         assert(fd >= 0);
 712
 713         /* Before we chown/chmod the TTY, let's ensure this is actually a tty */
 714         if (isatty(fd) < 1)
 715                 return 0;
 716
 717         /* This might fail. What matters are the results. */
 718         (void) fchown(fd, uid, -1);
 719         (void) fchmod(fd, TTY_MODE);
 720
 721         if (fstat(fd, &st) < 0)
 722                 return -errno;
 723
 724         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 725                 return -EPERM;
 726
 727         return 0;
 728 }
 729
 730 static int setup_confirm_stdio(const char *vc, int *_saved_stdin, int *_saved_stdout) {
 731         _cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;
 732         int r;
 733
 734         assert(_saved_stdin);
 735         assert(_saved_stdout);
 736
 737         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 738         if (saved_stdin < 0)
 739                 return -errno;
 740
 741         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 742         if (saved_stdout < 0)
 743                 return -errno;
 744
 745         fd = acquire_terminal(vc, ACQUIRE_TERMINAL_WAIT, DEFAULT_CONFIRM_USEC);
 746         if (fd < 0)
 747                 return fd;
 748
 749         r = chown_terminal(fd, getuid());
 750         if (r < 0)
 751                 return r;
 752
 753         r = reset_terminal_fd(fd, true);
 754         if (r < 0)
 755                 return r;
 756
 757         r = rearrange_stdio(fd, fd, STDERR_FILENO);
 758         fd = -1;
 759         if (r < 0)
 760                 return r;
 761
 762         *_saved_stdin = saved_stdin;
 763         *_saved_stdout = saved_stdout;
 764
 765         saved_stdin = saved_stdout = -1;
 766
 767         return 0;
 768 }
 769
 770 static void write_confirm_error_fd(int err, int fd, const Unit *u) {
 771         assert(err < 0);
 772
 773         if (err == -ETIMEDOUT)
 774                 dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);
 775         else {
 776                 errno = -err;
 777                 dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);
 778         }
 779 }
 780
 781 static void write_confirm_error(int err, const char *vc, const Unit *u) {
 782         _cleanup_close_ int fd = -1;
 783
 784         assert(vc);
 785
 786         fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);
 787         if (fd < 0)
 788                 return;
 789
 790         write_confirm_error_fd(err, fd, u);
 791 }
 792
 793 static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {
 794         int r = 0;
 795
 796         assert(saved_stdin);
 797         assert(saved_stdout);
 798
 799         release_terminal();
 800
 801         if (*saved_stdin >= 0)
 802                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 803                         r = -errno;
 804
 805         if (*saved_stdout >= 0)
 806                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 807                         r = -errno;
 808
 809         *saved_stdin = safe_close(*saved_stdin);
 810         *saved_stdout = safe_close(*saved_stdout);
 811
 812         return r;
 813 }
 814
 815 enum {
 816         CONFIRM_PRETEND_FAILURE = -1,
 817         CONFIRM_PRETEND_SUCCESS =  0,
 818         CONFIRM_EXECUTE = 1,
 819 };
 820
 821 static int ask_for_confirmation(const char *vc, Unit *u, const char *cmdline) {
 822         int saved_stdout = -1, saved_stdin = -1, r;
 823         _cleanup_free_ char *e = NULL;
 824         char c;
 825
 826         /* For any internal errors, assume a positive response. */
 827         r = setup_confirm_stdio(vc, &saved_stdin, &saved_stdout);
 828         if (r < 0) {
 829                 write_confirm_error(r, vc, u);
 830                 return CONFIRM_EXECUTE;
 831         }
 832
 833         /* confirm_spawn might have been disabled while we were sleeping. */
 834         if (manager_is_confirm_spawn_disabled(u->manager)) {
 835                 r = 1;
 836                 goto restore_stdio;
 837         }
 838
 839         e = ellipsize(cmdline, 60, 100);
 840         if (!e) {
 841                 log_oom();
 842                 r = CONFIRM_EXECUTE;
 843                 goto restore_stdio;
 844         }
 845
 846         for (;;) {
 847                 r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);
 848                 if (r < 0) {
 849                         write_confirm_error_fd(r, STDOUT_FILENO, u);
 850                         r = CONFIRM_EXECUTE;
 851                         goto restore_stdio;
 852                 }
 853
 854                 switch (c) {
 855                 case 'c':
 856                         printf("Resuming normal execution.\n");
 857                         manager_disable_confirm_spawn();
 858                         r = 1;
 859                         break;
 860                 case 'D':
 861                         unit_dump(u, stdout, "  ");
 862                         continue; /* ask again */
 863                 case 'f':
 864                         printf("Failing execution.\n");
 865                         r = CONFIRM_PRETEND_FAILURE;
 866                         break;
 867                 case 'h':
 868                         printf("  c - continue, proceed without asking anymore\n"
 869                                "  D - dump, show the state of the unit\n"
 870                                "  f - fail, don't execute the command and pretend it failed\n"
 871                                "  h - help\n"
 872                                "  i - info, show a short summary of the unit\n"
 873                                "  j - jobs, show jobs that are in progress\n"
 874                                "  s - skip, don't execute the command and pretend it succeeded\n"
 875                                "  y - yes, execute the command\n");
 876                         continue; /* ask again */
 877                 case 'i':
 878                         printf("  Description: %s\n"
 879                                "  Unit:        %s\n"
 880                                "  Command:     %s\n",
 881                                u->id, u->description, cmdline);
 882                         continue; /* ask again */
 883                 case 'j':
 884                         manager_dump_jobs(u->manager, stdout, "  ");
 885                         continue; /* ask again */
 886                 case 'n':
 887                         /* 'n' was removed in favor of 'f'. */
 888                         printf("Didn't understand 'n', did you mean 'f'?\n");
 889                         continue; /* ask again */
 890                 case 's':
 891                         printf("Skipping execution.\n");
 892                         r = CONFIRM_PRETEND_SUCCESS;
 893                         break;
 894                 case 'y':
 895                         r = CONFIRM_EXECUTE;
 896                         break;
 897                 default:
 898                         assert_not_reached("Unhandled choice");
 899                 }
 900                 break;
 901         }
 902
 903 restore_stdio:
 904         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 905         return r;
 906 }
 907
 908 static int get_fixed_user(const ExecContext *c, const char **user,
 909                           uid_t *uid, gid_t *gid,
 910                           const char **home, const char **shell) {
 911         int r;
 912         const char *name;
 913
 914         assert(c);
 915
 916         if (!c->user)
 917                 return 0;
 918
 919         /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway
 920          * (i.e. are "/" or "/bin/nologin"). */
 921
 922         name = c->user;
 923         r = get_user_creds(&name, uid, gid, home, shell, USER_CREDS_CLEAN);
 924         if (r < 0)
 925                 return r;
 926
 927         *user = name;
 928         return 0;
 929 }
 930
 931 static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {
 932         int r;
 933         const char *name;
 934
 935         assert(c);
 936
 937         if (!c->group)
 938                 return 0;
 939
 940         name = c->group;
 941         r = get_group_creds(&name, gid, 0);
 942         if (r < 0)
 943                 return r;
 944
 945         *group = name;
 946         return 0;
 947 }
 948
 949 static int get_supplementary_groups(const ExecContext *c, const char *user,
 950                                     const char *group, gid_t gid,
 951                                     gid_t **supplementary_gids, int *ngids) {
 952         char **i;
 953         int r, k = 0;
 954         int ngroups_max;
 955         bool keep_groups = false;
 956         gid_t *groups = NULL;
 957         _cleanup_free_ gid_t *l_gids = NULL;
 958
 959         assert(c);
 960
 961         /*
 962          * If user is given, then lookup GID and supplementary groups list.
 963          * We avoid NSS lookups for gid=0. Also we have to initialize groups
 964          * here and as early as possible so we keep the list of supplementary
 965          * groups of the caller.
 966          */
 967         if (user && gid_is_valid(gid) && gid != 0) {
 968                 /* First step, initialize groups from /etc/groups */
 969                 if (initgroups(user, gid) < 0)
 970                         return -errno;
 971
 972                 keep_groups = true;
 973         }
 974
 975         if (strv_isempty(c->supplementary_groups))
 976                 return 0;
 977
 978         /*
 979          * If SupplementaryGroups= was passed then NGROUPS_MAX has to
 980          * be positive, otherwise fail.
 981          */
 982         errno = 0;
 983         ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
 984         if (ngroups_max <= 0) {
 985                 if (errno > 0)
 986                         return -errno;
 987                 else
 988                         return -EOPNOTSUPP; /* For all other values */
 989         }
 990
 991         l_gids = new(gid_t, ngroups_max);
 992         if (!l_gids)
 993                 return -ENOMEM;
 994
 995         if (keep_groups) {
 996                 /*
 997                  * Lookup the list of groups that the user belongs to, we
 998                  * avoid NSS lookups here too for gid=0.
 999                  */
1000                 k = ngroups_max;
1001                 if (getgrouplist(user, gid, l_gids, &k) < 0)
1002                         return -EINVAL;
1003         } else
1004                 k = 0;
1005
1006         STRV_FOREACH(i, c->supplementary_groups) {
1007                 const char *g;
1008
1009                 if (k >= ngroups_max)
1010                         return -E2BIG;
1011
1012                 g = *i;
1013                 r = get_group_creds(&g, l_gids+k, 0);
1014                 if (r < 0)
1015                         return r;
1016
1017                 k++;
1018         }
1019
1020         /*
1021          * Sets ngids to zero to drop all supplementary groups, happens
1022          * when we are under root and SupplementaryGroups= is empty.
1023          */
1024         if (k == 0) {
1025                 *ngids = 0;
1026                 return 0;
1027         }
1028
1029         /* Otherwise get the final list of supplementary groups */
1030         groups = memdup(l_gids, sizeof(gid_t) * k);
1031         if (!groups)
1032                 return -ENOMEM;
1033
1034         *supplementary_gids = groups;
1035         *ngids = k;
1036
1037         groups = NULL;
1038
1039         return 0;
1040 }
1041
1042 static int enforce_groups(gid_t gid, const gid_t *supplementary_gids, int ngids) {
1043         int r;
1044
1045         /* Handle SupplementaryGroups= if it is not empty */
1046         if (ngids > 0) {
1047                 r = maybe_setgroups(ngids, supplementary_gids);
1048                 if (r < 0)
1049                         return r;
1050         }
1051
1052         if (gid_is_valid(gid)) {
1053                 /* Then set our gids */
1054                 if (setresgid(gid, gid, gid) < 0)
1055                         return -errno;
1056         }
1057
1058         return 0;
1059 }
1060
1061 static int enforce_user(const ExecContext *context, uid_t uid) {
1062         assert(context);
1063
1064         if (!uid_is_valid(uid))
1065                 return 0;
1066
1067         /* Sets (but doesn't look up) the uid and make sure we keep the
1068          * capabilities while doing so. */
1069
1070         if (context->capability_ambient_set != 0) {
1071
1072                 /* First step: If we need to keep capabilities but
1073                  * drop privileges we need to make sure we keep our
1074                  * caps, while we drop privileges. */
1075                 if (uid != 0) {
1076                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
1077
1078                         if (prctl(PR_GET_SECUREBITS) != sb)
1079                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
1080                                         return -errno;
1081                 }
1082         }
1083
1084         /* Second step: actually set the uids */
1085         if (setresuid(uid, uid, uid) < 0)
1086                 return -errno;
1087
1088         /* At this point we should have all necessary capabilities but
1089            are otherwise a normal user. However, the caps might got
1090            corrupted due to the setresuid() so we need clean them up
1091            later. This is done outside of this call. */
1092
1093         return 0;
1094 }
1095
1096 #if HAVE_PAM
1097
1098 static int null_conv(
1099                 int num_msg,
1100                 const struct pam_message **msg,
1101                 struct pam_response **resp,
1102                 void *appdata_ptr) {
1103
1104         /* We don't support conversations */
1105
1106         return PAM_CONV_ERR;
1107 }
1108
1109 #endif
1110
1111 static int setup_pam(
1112                 const char *name,
1113                 const char *user,
1114                 uid_t uid,
1115                 gid_t gid,
1116                 const char *tty,
1117                 char ***env,
1118                 int fds[], size_t n_fds) {
1119
1120 #if HAVE_PAM
1121
1122         static const struct pam_conv conv = {
1123                 .conv = null_conv,
1124                 .appdata_ptr = NULL
1125         };
1126
1127         _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
1128         pam_handle_t *handle = NULL;
1129         sigset_t old_ss;
1130         int pam_code = PAM_SUCCESS, r;
1131         char **nv, **e = NULL;
1132         bool close_session = false;
1133         pid_t pam_pid = 0, parent_pid;
1134         int flags = 0;
1135
1136         assert(name);
1137         assert(user);
1138         assert(env);
1139
1140         /* We set up PAM in the parent process, then fork. The child
1141          * will then stay around until killed via PR_GET_PDEATHSIG or
1142          * systemd via the cgroup logic. It will then remove the PAM
1143          * session again. The parent process will exec() the actual
1144          * daemon. We do things this way to ensure that the main PID
1145          * of the daemon is the one we initially fork()ed. */
1146
1147         r = barrier_create(&barrier);
1148         if (r < 0)
1149                 goto fail;
1150
1151         if (log_get_max_level() < LOG_DEBUG)
1152                 flags |= PAM_SILENT;
1153
1154         pam_code = pam_start(name, user, &conv, &handle);
1155         if (pam_code != PAM_SUCCESS) {
1156                 handle = NULL;
1157                 goto fail;
1158         }
1159
1160         if (!tty) {
1161                 _cleanup_free_ char *q = NULL;
1162
1163                 /* Hmm, so no TTY was explicitly passed, but an fd passed to us directly might be a TTY. Let's figure
1164                  * out if that's the case, and read the TTY off it. */
1165
1166                 if (getttyname_malloc(STDIN_FILENO, &q) >= 0)
1167                         tty = strjoina("/dev/", q);
1168         }
1169
1170         if (tty) {
1171                 pam_code = pam_set_item(handle, PAM_TTY, tty);
1172                 if (pam_code != PAM_SUCCESS)
1173                         goto fail;
1174         }
1175
1176         STRV_FOREACH(nv, *env) {
1177                 pam_code = pam_putenv(handle, *nv);
1178                 if (pam_code != PAM_SUCCESS)
1179                         goto fail;
1180         }
1181
1182         pam_code = pam_acct_mgmt(handle, flags);
1183         if (pam_code != PAM_SUCCESS)
1184                 goto fail;
1185
1186         pam_code = pam_open_session(handle, flags);
1187         if (pam_code != PAM_SUCCESS)
1188                 goto fail;
1189
1190         close_session = true;
1191
1192         e = pam_getenvlist(handle);
1193         if (!e) {
1194                 pam_code = PAM_BUF_ERR;
1195                 goto fail;
1196         }
1197
1198         /* Block SIGTERM, so that we know that it won't get lost in
1199          * the child */
1200
1201         assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0);
1202
1203         parent_pid = getpid_cached();
1204
1205         r = safe_fork("(sd-pam)", 0, &pam_pid);
1206         if (r < 0)
1207                 goto fail;
1208         if (r == 0) {
1209                 int sig, ret = EXIT_PAM;
1210
1211                 /* The child's job is to reset the PAM session on
1212                  * termination */
1213                 barrier_set_role(&barrier, BARRIER_CHILD);
1214
1215                 /* Make sure we don't keep open the passed fds in this child. We assume that otherwise only those fds
1216                  * are open here that have been opened by PAM. */
1217                 (void) close_many(fds, n_fds);
1218
1219                 /* Drop privileges - we don't need any to pam_close_session
1220                  * and this will make PR_SET_PDEATHSIG work in most cases.
1221                  * If this fails, ignore the error - but expect sd-pam threads
1222                  * to fail to exit normally */
1223
1224                 r = maybe_setgroups(0, NULL);
1225                 if (r < 0)
1226                         log_warning_errno(r, "Failed to setgroups() in sd-pam: %m");
1227                 if (setresgid(gid, gid, gid) < 0)
1228                         log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m");
1229                 if (setresuid(uid, uid, uid) < 0)
1230                         log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m");
1231
1232                 (void) ignore_signals(SIGPIPE, -1);
1233
1234                 /* Wait until our parent died. This will only work if
1235                  * the above setresuid() succeeds, otherwise the kernel
1236                  * will not allow unprivileged parents kill their privileged
1237                  * children this way. We rely on the control groups kill logic
1238                  * to do the rest for us. */
1239                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
1240                         goto child_finish;
1241
1242                 /* Tell the parent that our setup is done. This is especially
1243                  * important regarding dropping privileges. Otherwise, unit
1244                  * setup might race against our setresuid(2) call.
1245                  *
1246                  * If the parent aborted, we'll detect this below, hence ignore
1247                  * return failure here. */
1248                 (void) barrier_place(&barrier);
1249
1250                 /* Check if our parent process might already have died? */
1251                 if (getppid() == parent_pid) {
1252                         sigset_t ss;
1253
1254                         assert_se(sigemptyset(&ss) >= 0);
1255                         assert_se(sigaddset(&ss, SIGTERM) >= 0);
1256
1257                         for (;;) {
1258                                 if (sigwait(&ss, &sig) < 0) {
1259                                         if (errno == EINTR)
1260                                                 continue;
1261
1262                                         goto child_finish;
1263                                 }
1264
1265                                 assert(sig == SIGTERM);
1266                                 break;
1267                         }
1268                 }
1269
1270                 /* If our parent died we'll end the session */
1271                 if (getppid() != parent_pid) {
1272                         pam_code = pam_close_session(handle, flags);
1273                         if (pam_code != PAM_SUCCESS)
1274                                 goto child_finish;
1275                 }
1276
1277                 ret = 0;
1278
1279         child_finish:
1280                 pam_end(handle, pam_code | flags);
1281                 _exit(ret);
1282         }
1283
1284         barrier_set_role(&barrier, BARRIER_PARENT);
1285
1286         /* If the child was forked off successfully it will do all the
1287          * cleanups, so forget about the handle here. */
1288         handle = NULL;
1289
1290         /* Unblock SIGTERM again in the parent */
1291         assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0);
1292
1293         /* We close the log explicitly here, since the PAM modules
1294          * might have opened it, but we don't want this fd around. */
1295         closelog();
1296
1297         /* Synchronously wait for the child to initialize. We don't care for
1298          * errors as we cannot recover. However, warn loudly if it happens. */
1299         if (!barrier_place_and_sync(&barrier))
1300                 log_error("PAM initialization failed");
1301
1302         return strv_free_and_replace(*env, e);
1303
1304 fail:
1305         if (pam_code != PAM_SUCCESS) {
1306                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
1307                 r = -EPERM;  /* PAM errors do not map to errno */
1308         } else
1309                 log_error_errno(r, "PAM failed: %m");
1310
1311         if (handle) {
1312                 if (close_session)
1313                         pam_code = pam_close_session(handle, flags);
1314
1315                 pam_end(handle, pam_code | flags);
1316         }
1317
1318         strv_free(e);
1319         closelog();
1320
1321         return r;
1322 #else
1323         return 0;
1324 #endif
1325 }
1326
1327 static void rename_process_from_path(const char *path) {
1328         char process_name[11];
1329         const char *p;
1330         size_t l;
1331
1332         /* This resulting string must fit in 10 chars (i.e. the length
1333          * of "/sbin/init") to look pretty in /bin/ps */
1334
1335         p = basename(path);
1336         if (isempty(p)) {
1337                 rename_process("(...)");
1338                 return;
1339         }
1340
1341         l = strlen(p);
1342         if (l > 8) {
1343                 /* The end of the process name is usually more
1344                  * interesting, since the first bit might just be
1345                  * "systemd-" */
1346                 p = p + l - 8;
1347                 l = 8;
1348         }
1349
1350         process_name[0] = '(';
1351         memcpy(process_name+1, p, l);
1352         process_name[1+l] = ')';
1353         process_name[1+l+1] = 0;
1354
1355         rename_process(process_name);
1356 }
1357
1358 static bool context_has_address_families(const ExecContext *c) {
1359         assert(c);
1360
1361         return c->address_families_whitelist ||
1362                 !set_isempty(c->address_families);
1363 }
1364
1365 static bool context_has_syscall_filters(const ExecContext *c) {
1366         assert(c);
1367
1368         return c->syscall_whitelist ||
1369                 !hashmap_isempty(c->syscall_filter);
1370 }
1371
1372 static bool context_has_no_new_privileges(const ExecContext *c) {
1373         assert(c);
1374
1375         if (c->no_new_privileges)
1376                 return true;
1377
1378         if (have_effective_cap(CAP_SYS_ADMIN)) /* if we are privileged, we don't need NNP */
1379                 return false;
1380
1381         /* We need NNP if we have any form of seccomp and are unprivileged */
1382         return context_has_address_families(c) ||
1383                 c->memory_deny_write_execute ||
1384                 c->restrict_realtime ||
1385                 exec_context_restrict_namespaces_set(c) ||
1386                 c->protect_kernel_tunables ||
1387                 c->protect_kernel_modules ||
1388                 c->private_devices ||
1389                 context_has_syscall_filters(c) ||
1390                 !set_isempty(c->syscall_archs) ||
1391                 c->lock_personality;
1392 }
1393
1394 #if HAVE_SECCOMP
1395
1396 static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
1397
1398         if (is_seccomp_available())
1399                 return false;
1400
1401         log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
1402         return true;
1403 }
1404
1405 static int apply_syscall_filter(const Unit* u, const ExecContext *c, bool needs_ambient_hack) {
1406         uint32_t negative_action, default_action, action;
1407         int r;
1408
1409         assert(u);
1410         assert(c);
1411
1412         if (!context_has_syscall_filters(c))
1413                 return 0;
1414
1415         if (skip_seccomp_unavailable(u, "SystemCallFilter="))
1416                 return 0;
1417
1418         negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
1419
1420         if (c->syscall_whitelist) {
1421                 default_action = negative_action;
1422                 action = SCMP_ACT_ALLOW;
1423         } else {
1424                 default_action = SCMP_ACT_ALLOW;
1425                 action = negative_action;
1426         }
1427
1428         if (needs_ambient_hack) {
1429                 r = seccomp_filter_set_add(c->syscall_filter, c->syscall_whitelist, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID);
1430                 if (r < 0)
1431                         return r;
1432         }
1433
1434         return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false);
1435 }
1436
1437 static int apply_syscall_archs(const Unit *u, const ExecContext *c) {
1438         assert(u);
1439         assert(c);
1440
1441         if (set_isempty(c->syscall_archs))
1442                 return 0;
1443
1444         if (skip_seccomp_unavailable(u, "SystemCallArchitectures="))
1445                 return 0;
1446
1447         return seccomp_restrict_archs(c->syscall_archs);
1448 }
1449
1450 static int apply_address_families(const Unit* u, const ExecContext *c) {
1451         assert(u);
1452         assert(c);
1453
1454         if (!context_has_address_families(c))
1455                 return 0;
1456
1457         if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
1458                 return 0;
1459
1460         return seccomp_restrict_address_families(c->address_families, c->address_families_whitelist);
1461 }
1462
1463 static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
1464         assert(u);
1465         assert(c);
1466
1467         if (!c->memory_deny_write_execute)
1468                 return 0;
1469
1470         if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute="))
1471                 return 0;
1472
1473         return seccomp_memory_deny_write_execute();
1474 }
1475
1476 static int apply_restrict_realtime(const Unit* u, const ExecContext *c) {
1477         assert(u);
1478         assert(c);
1479
1480         if (!c->restrict_realtime)
1481                 return 0;
1482
1483         if (skip_seccomp_unavailable(u, "RestrictRealtime="))
1484                 return 0;
1485
1486         return seccomp_restrict_realtime();
1487 }
1488
1489 static int apply_protect_sysctl(const Unit *u, const ExecContext *c) {
1490         assert(u);
1491         assert(c);
1492
1493         /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but
1494          * let's protect even those systems where this is left on in the kernel. */
1495
1496         if (!c->protect_kernel_tunables)
1497                 return 0;
1498
1499         if (skip_seccomp_unavailable(u, "ProtectKernelTunables="))
1500                 return 0;
1501
1502         return seccomp_protect_sysctl();
1503 }
1504
1505 static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) {
1506         assert(u);
1507         assert(c);
1508
1509         /* Turn off module syscalls on ProtectKernelModules=yes */
1510
1511         if (!c->protect_kernel_modules)
1512                 return 0;
1513
1514         if (skip_seccomp_unavailable(u, "ProtectKernelModules="))
1515                 return 0;
1516
1517         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM), false);
1518 }
1519
1520 static int apply_private_devices(const Unit *u, const ExecContext *c) {
1521         assert(u);
1522         assert(c);
1523
1524         /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */
1525
1526         if (!c->private_devices)
1527                 return 0;
1528
1529         if (skip_seccomp_unavailable(u, "PrivateDevices="))
1530                 return 0;
1531
1532         return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM), false);
1533 }
1534
1535 static int apply_restrict_namespaces(const Unit *u, const ExecContext *c) {
1536         assert(u);
1537         assert(c);
1538
1539         if (!exec_context_restrict_namespaces_set(c))
1540                 return 0;
1541
1542         if (skip_seccomp_unavailable(u, "RestrictNamespaces="))
1543                 return 0;
1544
1545         return seccomp_restrict_namespaces(c->restrict_namespaces);
1546 }
1547
1548 static int apply_lock_personality(const Unit* u, const ExecContext *c) {
1549         unsigned long personality;
1550         int r;
1551
1552         assert(u);
1553         assert(c);
1554
1555         if (!c->lock_personality)
1556                 return 0;
1557
1558         if (skip_seccomp_unavailable(u, "LockPersonality="))
1559                 return 0;
1560
1561         personality = c->personality;
1562
1563         /* If personality is not specified, use either PER_LINUX or PER_LINUX32 depending on what is currently set. */
1564         if (personality == PERSONALITY_INVALID) {
1565
1566                 r = opinionated_personality(&personality);
1567                 if (r < 0)
1568                         return r;
1569         }
1570
1571         return seccomp_lock_personality(personality);
1572 }
1573
1574 #endif
1575
1576 static void do_idle_pipe_dance(int idle_pipe[4]) {
1577         assert(idle_pipe);
1578
1579         idle_pipe[1] = safe_close(idle_pipe[1]);
1580         idle_pipe[2] = safe_close(idle_pipe[2]);
1581
1582         if (idle_pipe[0] >= 0) {
1583                 int r;
1584
1585                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1586
1587                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1588                         ssize_t n;
1589
1590                         /* Signal systemd that we are bored and want to continue. */
1591                         n = write(idle_pipe[3], "x", 1);
1592                         if (n > 0)
1593                                 /* Wait for systemd to react to the signal above. */
1594                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1595                 }
1596
1597                 idle_pipe[0] = safe_close(idle_pipe[0]);
1598
1599         }
1600
1601         idle_pipe[3] = safe_close(idle_pipe[3]);
1602 }
1603
1604 static const char *exec_directory_env_name_to_string(ExecDirectoryType t);
1605
1606 static int build_environment(
1607                 const Unit *u,
1608                 const ExecContext *c,
1609                 const ExecParameters *p,
1610                 size_t n_fds,
1611                 const char *home,
1612                 const char *username,
1613                 const char *shell,
1614                 dev_t journal_stream_dev,
1615                 ino_t journal_stream_ino,
1616                 char ***ret) {
1617
1618         _cleanup_strv_free_ char **our_env = NULL;
1619         ExecDirectoryType t;
1620         size_t n_env = 0;
1621         char *x;
1622
1623         assert(u);
1624         assert(c);
1625         assert(p);
1626         assert(ret);
1627
1628         our_env = new0(char*, 14 + _EXEC_DIRECTORY_TYPE_MAX);
1629         if (!our_env)
1630                 return -ENOMEM;
1631
1632         if (n_fds > 0) {
1633                 _cleanup_free_ char *joined = NULL;
1634
1635                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid_cached()) < 0)
1636                         return -ENOMEM;
1637                 our_env[n_env++] = x;
1638
1639                 if (asprintf(&x, "LISTEN_FDS=%zu", n_fds) < 0)
1640                         return -ENOMEM;
1641                 our_env[n_env++] = x;
1642
1643                 joined = strv_join(p->fd_names, ":");
1644                 if (!joined)
1645                         return -ENOMEM;
1646
1647                 x = strjoin("LISTEN_FDNAMES=", joined);
1648                 if (!x)
1649                         return -ENOMEM;
1650                 our_env[n_env++] = x;
1651         }
1652
1653         if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) {
1654                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid_cached()) < 0)
1655                         return -ENOMEM;
1656                 our_env[n_env++] = x;
1657
1658                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0)
1659                         return -ENOMEM;
1660                 our_env[n_env++] = x;
1661         }
1662
1663         /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use D-Bus look up dynamic
1664          * users via PID 1, possibly dead-locking the dbus daemon. This way it will not use D-Bus to resolve names, but
1665          * check the database directly. */
1666         if (p->flags & EXEC_NSS_BYPASS_BUS) {
1667                 x = strdup("SYSTEMD_NSS_BYPASS_BUS=1");
1668                 if (!x)
1669                         return -ENOMEM;
1670                 our_env[n_env++] = x;
1671         }
1672
1673         if (home) {
1674                 x = strappend("HOME=", home);
1675                 if (!x)
1676                         return -ENOMEM;
1677                 our_env[n_env++] = x;
1678         }
1679
1680         if (username) {
1681                 x = strappend("LOGNAME=", username);
1682                 if (!x)
1683                         return -ENOMEM;
1684                 our_env[n_env++] = x;
1685
1686                 x = strappend("USER=", username);
1687                 if (!x)
1688                         return -ENOMEM;
1689                 our_env[n_env++] = x;
1690         }
1691
1692         if (shell) {
1693                 x = strappend("SHELL=", shell);
1694                 if (!x)
1695                         return -ENOMEM;
1696                 our_env[n_env++] = x;
1697         }
1698
1699         if (!sd_id128_is_null(u->invocation_id)) {
1700                 if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0)
1701                         return -ENOMEM;
1702
1703                 our_env[n_env++] = x;
1704         }
1705
1706         if (exec_context_needs_term(c)) {
1707                 const char *tty_path, *term = NULL;
1708
1709                 tty_path = exec_context_tty_path(c);
1710
1711                 /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try to inherit
1712                  * the $TERM set for PID 1. This is useful for containers so that the $TERM the container manager
1713                  * passes to PID 1 ends up all the way in the console login shown. */
1714
1715                 if (path_equal(tty_path, "/dev/console") && getppid() == 1)
1716                         term = getenv("TERM");
1717                 if (!term)
1718                         term = default_term_for_tty(tty_path);
1719
1720                 x = strappend("TERM=", term);
1721                 if (!x)
1722                         return -ENOMEM;
1723                 our_env[n_env++] = x;
1724         }
1725
1726         if (journal_stream_dev != 0 && journal_stream_ino != 0) {
1727                 if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0)
1728                         return -ENOMEM;
1729
1730                 our_env[n_env++] = x;
1731         }
1732
1733         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
1734                 _cleanup_free_ char *pre = NULL, *joined = NULL;
1735                 const char *n;
1736
1737                 if (!p->prefix[t])
1738                         continue;
1739
1740                 if (strv_isempty(c->directories[t].paths))
1741                         continue;
1742
1743                 n = exec_directory_env_name_to_string(t);
1744                 if (!n)
1745                         continue;
1746
1747                 pre = strjoin(p->prefix[t], "/");
1748                 if (!pre)
1749                         return -ENOMEM;
1750
1751                 joined = strv_join_prefix(c->directories[t].paths, ":", pre);
1752                 if (!joined)
1753                         return -ENOMEM;
1754
1755                 x = strjoin(n, "=", joined);
1756                 if (!x)
1757                         return -ENOMEM;
1758
1759                 our_env[n_env++] = x;
1760         }
1761
1762         our_env[n_env++] = NULL;
1763         assert(n_env <= 14 + _EXEC_DIRECTORY_TYPE_MAX);
1764
1765         *ret = TAKE_PTR(our_env);
1766
1767         return 0;
1768 }
1769
1770 static int build_pass_environment(const ExecContext *c, char ***ret) {
1771         _cleanup_strv_free_ char **pass_env = NULL;
1772         size_t n_env = 0, n_bufsize = 0;
1773         char **i;
1774
1775         STRV_FOREACH(i, c->pass_environment) {
1776                 _cleanup_free_ char *x = NULL;
1777                 char *v;
1778
1779                 v = getenv(*i);
1780                 if (!v)
1781                         continue;
1782                 x = strjoin(*i, "=", v);
1783                 if (!x)
1784                         return -ENOMEM;
1785
1786                 if (!GREEDY_REALLOC(pass_env, n_bufsize, n_env + 2))
1787                         return -ENOMEM;
1788
1789                 pass_env[n_env++] = TAKE_PTR(x);
1790                 pass_env[n_env] = NULL;
1791         }
1792
1793         *ret = TAKE_PTR(pass_env);
1794
1795         return 0;
1796 }
1797
1798 static bool exec_needs_mount_namespace(
1799                 const ExecContext *context,
1800                 const ExecParameters *params,
1801                 const ExecRuntime *runtime) {
1802
1803         assert(context);
1804         assert(params);
1805
1806         if (context->root_image)
1807                 return true;
1808
1809         if (!strv_isempty(context->read_write_paths) ||
1810             !strv_isempty(context->read_only_paths) ||
1811             !strv_isempty(context->inaccessible_paths))
1812                 return true;
1813
1814         if (context->n_bind_mounts > 0)
1815                 return true;
1816
1817         if (context->n_temporary_filesystems > 0)
1818                 return true;
1819
1820         if (context->mount_flags != 0)
1821                 return true;
1822
1823         if (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))
1824                 return true;
1825
1826         if (context->private_devices ||
1827             context->private_mounts ||
1828             context->protect_system != PROTECT_SYSTEM_NO ||
1829             context->protect_home != PROTECT_HOME_NO ||
1830             context->protect_kernel_tunables ||
1831             context->protect_kernel_modules ||
1832             context->protect_control_groups)
1833                 return true;
1834
1835         if (context->root_directory) {
1836                 ExecDirectoryType t;
1837
1838                 if (context->mount_apivfs)
1839                         return true;
1840
1841                 for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
1842                         if (!params->prefix[t])
1843                                 continue;
1844
1845                         if (!strv_isempty(context->directories[t].paths))
1846                                 return true;
1847                 }
1848         }
1849
1850         if (context->dynamic_user &&
1851             (!strv_isempty(context->directories[EXEC_DIRECTORY_STATE].paths) ||
1852              !strv_isempty(context->directories[EXEC_DIRECTORY_CACHE].paths) ||
1853              !strv_isempty(context->directories[EXEC_DIRECTORY_LOGS].paths)))
1854                 return true;
1855
1856         return false;
1857 }
1858
1859 static int setup_private_users(uid_t uid, gid_t gid) {
1860         _cleanup_free_ char *uid_map = NULL, *gid_map = NULL;
1861         _cleanup_close_pair_ int errno_pipe[2] = { -1, -1 };
1862         _cleanup_close_ int unshare_ready_fd = -1;
1863         _cleanup_(sigkill_waitp) pid_t pid = 0;
1864         uint64_t c = 1;
1865         ssize_t n;
1866         int r;
1867
1868         /* Set up a user namespace and map root to root, the selected UID/GID to itself, and everything else to
1869          * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which
1870          * we however lack after opening the user namespace. To work around this we fork() a temporary child process,
1871          * which waits for the parent to create the new user namespace while staying in the original namespace. The
1872          * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and
1873          * continues execution normally. */
1874
1875         if (uid != 0 && uid_is_valid(uid)) {
1876                 r = asprintf(&uid_map,
1877                              "0 0 1\n"                      /* Map root → root */
1878                              UID_FMT " " UID_FMT " 1\n",    /* Map $UID → $UID */
1879                              uid, uid);
1880                 if (r < 0)
1881                         return -ENOMEM;
1882         } else {
1883                 uid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1884                 if (!uid_map)
1885                         return -ENOMEM;
1886         }
1887
1888         if (gid != 0 && gid_is_valid(gid)) {
1889                 r = asprintf(&gid_map,
1890                              "0 0 1\n"                      /* Map root → root */
1891                              GID_FMT " " GID_FMT " 1\n",    /* Map $GID → $GID */
1892                              gid, gid);
1893                 if (r < 0)
1894                         return -ENOMEM;
1895         } else {
1896                 gid_map = strdup("0 0 1\n");            /* The case where the above is the same */
1897                 if (!gid_map)
1898                         return -ENOMEM;
1899         }
1900
1901         /* Create a communication channel so that the parent can tell the child when it finished creating the user
1902          * namespace. */
1903         unshare_ready_fd = eventfd(0, EFD_CLOEXEC);
1904         if (unshare_ready_fd < 0)
1905                 return -errno;
1906
1907         /* Create a communication channel so that the child can tell the parent a proper error code in case it
1908          * failed. */
1909         if (pipe2(errno_pipe, O_CLOEXEC) < 0)
1910                 return -errno;
1911
1912         r = safe_fork("(sd-userns)", FORK_RESET_SIGNALS|FORK_DEATHSIG, &pid);
1913         if (r < 0)
1914                 return r;
1915         if (r == 0) {
1916                 _cleanup_close_ int fd = -1;
1917                 const char *a;
1918                 pid_t ppid;
1919
1920                 /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from
1921                  * here, after the parent opened its own user namespace. */
1922
1923                 ppid = getppid();
1924                 errno_pipe[0] = safe_close(errno_pipe[0]);
1925
1926                 /* Wait until the parent unshared the user namespace */
1927                 if (read(unshare_ready_fd, &c, sizeof(c)) < 0) {
1928                         r = -errno;
1929                         goto child_fail;
1930                 }
1931
1932                 /* Disable the setgroups() system call in the child user namespace, for good. */
1933                 a = procfs_file_alloca(ppid, "setgroups");
1934                 fd = open(a, O_WRONLY|O_CLOEXEC);
1935                 if (fd < 0) {
1936                         if (errno != ENOENT) {
1937                                 r = -errno;
1938                                 goto child_fail;
1939                         }
1940
1941                         /* If the file is missing the kernel is too old, let's continue anyway. */
1942                 } else {
1943                         if (write(fd, "deny\n", 5) < 0) {
1944                                 r = -errno;
1945                                 goto child_fail;
1946                         }
1947
1948                         fd = safe_close(fd);
1949                 }
1950
1951                 /* First write the GID map */
1952                 a = procfs_file_alloca(ppid, "gid_map");
1953                 fd = open(a, O_WRONLY|O_CLOEXEC);
1954                 if (fd < 0) {
1955                         r = -errno;
1956                         goto child_fail;
1957                 }
1958                 if (write(fd, gid_map, strlen(gid_map)) < 0) {
1959                         r = -errno;
1960                         goto child_fail;
1961                 }
1962                 fd = safe_close(fd);
1963
1964                 /* The write the UID map */
1965                 a = procfs_file_alloca(ppid, "uid_map");
1966                 fd = open(a, O_WRONLY|O_CLOEXEC);
1967                 if (fd < 0) {
1968                         r = -errno;
1969                         goto child_fail;
1970                 }
1971                 if (write(fd, uid_map, strlen(uid_map)) < 0) {
1972                         r = -errno;
1973                         goto child_fail;
1974                 }
1975
1976                 _exit(EXIT_SUCCESS);
1977
1978         child_fail:
1979                 (void) write(errno_pipe[1], &r, sizeof(r));
1980                 _exit(EXIT_FAILURE);
1981         }
1982
1983         errno_pipe[1] = safe_close(errno_pipe[1]);
1984
1985         if (unshare(CLONE_NEWUSER) < 0)
1986                 return -errno;
1987
1988         /* Let the child know that the namespace is ready now */
1989         if (write(unshare_ready_fd, &c, sizeof(c)) < 0)
1990                 return -errno;
1991
1992         /* Try to read an error code from the child */
1993         n = read(errno_pipe[0], &r, sizeof(r));
1994         if (n < 0)
1995                 return -errno;
1996         if (n == sizeof(r)) { /* an error code was sent to us */
1997                 if (r < 0)
1998                         return r;
1999                 return -EIO;
2000         }
2001         if (n != 0) /* on success we should have read 0 bytes */
2002                 return -EIO;
2003
2004         r = wait_for_terminate_and_check("(sd-userns)", pid, 0);
2005         pid = 0;
2006         if (r < 0)
2007                 return r;
2008         if (r != EXIT_SUCCESS) /* If something strange happened with the child, let's consider this fatal, too */
2009                 return -EIO;
2010
2011         return 0;
2012 }
2013
2014 static int setup_exec_directory(
2015                 const ExecContext *context,
2016                 const ExecParameters *params,
2017                 uid_t uid,
2018                 gid_t gid,
2019                 ExecDirectoryType type,
2020                 int *exit_status) {
2021
2022         static const int exit_status_table[_EXEC_DIRECTORY_TYPE_MAX] = {
2023                 [EXEC_DIRECTORY_RUNTIME] = EXIT_RUNTIME_DIRECTORY,
2024                 [EXEC_DIRECTORY_STATE] = EXIT_STATE_DIRECTORY,
2025                 [EXEC_DIRECTORY_CACHE] = EXIT_CACHE_DIRECTORY,
2026                 [EXEC_DIRECTORY_LOGS] = EXIT_LOGS_DIRECTORY,
2027                 [EXEC_DIRECTORY_CONFIGURATION] = EXIT_CONFIGURATION_DIRECTORY,
2028         };
2029         char **rt;
2030         int r;
2031
2032         assert(context);
2033         assert(params);
2034         assert(type >= 0 && type < _EXEC_DIRECTORY_TYPE_MAX);
2035         assert(exit_status);
2036
2037         if (!params->prefix[type])
2038                 return 0;
2039
2040         if (params->flags & EXEC_CHOWN_DIRECTORIES) {
2041                 if (!uid_is_valid(uid))
2042                         uid = 0;
2043                 if (!gid_is_valid(gid))
2044                         gid = 0;
2045         }
2046
2047         STRV_FOREACH(rt, context->directories[type].paths) {
2048                 _cleanup_free_ char *p = NULL, *pp = NULL;
2049
2050                 p = strjoin(params->prefix[type], "/", *rt);
2051                 if (!p) {
2052                         r = -ENOMEM;
2053                         goto fail;
2054                 }
2055
2056                 r = mkdir_parents_label(p, 0755);
2057                 if (r < 0)
2058                         goto fail;
2059
2060                 if (context->dynamic_user &&
2061                     !IN_SET(type, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION)) {
2062                         _cleanup_free_ char *private_root = NULL;
2063
2064                         /* So, here's one extra complication when dealing with DynamicUser=1 units. In that case we
2065                          * want to avoid leaving a directory around fully accessible that is owned by a dynamic user
2066                          * whose UID is later on reused. To lock this down we use the same trick used by container
2067                          * managers to prohibit host users to get access to files of the same UID in containers: we
2068                          * place everything inside a directory that has an access mode of 0700 and is owned root:root,
2069                          * so that it acts as security boundary for unprivileged host code. We then use fs namespacing
2070                          * to make this directory permeable for the service itself.
2071                          *
2072                          * Specifically: for a service which wants a special directory "foo/" we first create a
2073                          * directory "private/" with access mode 0700 owned by root:root. Then we place "foo" inside of
2074                          * that directory (i.e. "private/foo/"), and make "foo" a symlink to "private/foo". This way,
2075                          * privileged host users can access "foo/" as usual, but unprivileged host users can't look
2076                          * into it. Inside of the namespaceof the container "private/" is replaced by a more liberally
2077                          * accessible tmpfs, into which the host's "private/foo/" is mounted under the same name, thus
2078                          * disabling the access boundary for the service and making sure it only gets access to the
2079                          * dirs it needs but no others. Tricky? Yes, absolutely, but it works!
2080                          *
2081                          * Note that we don't do this for EXEC_DIRECTORY_CONFIGURATION as that's assumed not to be
2082                          * owned by the service itself.
2083                          * Also, note that we don't do this for EXEC_DIRECTORY_RUNTIME as that's often used for sharing
2084                          * files or sockets with other services. */
2085
2086                         private_root = strjoin(params->prefix[type], "/private");
2087                         if (!private_root) {
2088                                 r = -ENOMEM;
2089                                 goto fail;
2090                         }
2091
2092                         /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */
2093                         r = mkdir_safe_label(private_root, 0700, 0, 0, MKDIR_WARN_MODE);
2094                         if (r < 0)
2095                                 goto fail;
2096
2097                         pp = strjoin(private_root, "/", *rt);
2098                         if (!pp) {
2099                                 r = -ENOMEM;
2100                                 goto fail;
2101                         }
2102
2103                         /* Create all directories between the configured directory and this private root, and mark them 0755 */
2104                         r = mkdir_parents_label(pp, 0755);
2105                         if (r < 0)
2106                                 goto fail;
2107
2108                         if (is_dir(p, false) > 0 &&
2109                             (laccess(pp, F_OK) < 0 && errno == ENOENT)) {
2110
2111                                 /* Hmm, the private directory doesn't exist yet, but the normal one exists? If so, move
2112                                  * it over. Most likely the service has been upgraded from one that didn't use
2113                                  * DynamicUser=1, to one that does. */
2114
2115                                 if (rename(p, pp) < 0) {
2116                                         r = -errno;
2117                                         goto fail;
2118                                 }
2119                         } else {
2120                                 /* Otherwise, create the actual directory for the service */
2121
2122                                 r = mkdir_label(pp, context->directories[type].mode);
2123                                 if (r < 0 && r != -EEXIST)
2124                                         goto fail;
2125                         }
2126
2127                         /* And link it up from the original place */
2128                         r = symlink_idempotent(pp, p, true);
2129                         if (r < 0)
2130                                 goto fail;
2131
2132                         /* Lock down the access mode */
2133                         if (chmod(pp, context->directories[type].mode) < 0) {
2134                                 r = -errno;
2135                                 goto fail;
2136                         }
2137                 } else {
2138                         r = mkdir_label(p, context->directories[type].mode);
2139                         if (r < 0 && r != -EEXIST)
2140                                 goto fail;
2141                         if (r == -EEXIST && !context->dynamic_user)
2142                                 continue;
2143                 }
2144
2145                 /* Don't change the owner of the configuration directory, as in the common case it is not written to by
2146                  * a service, and shall not be writable. */
2147                 if (type == EXEC_DIRECTORY_CONFIGURATION)
2148                         continue;
2149
2150                 /* Then, change the ownership of the whole tree, if necessary */
2151                 r = path_chown_recursive(pp ?: p, uid, gid);
2152                 if (r < 0)
2153                         goto fail;
2154         }
2155
2156         return 0;
2157
2158 fail:
2159         *exit_status = exit_status_table[type];
2160         return r;
2161 }
2162
2163 #if ENABLE_SMACK
2164 static int setup_smack(
2165                 const ExecContext *context,
2166                 const ExecCommand *command) {
2167
2168         int r;
2169
2170         assert(context);
2171         assert(command);
2172
2173         if (context->smack_process_label) {
2174                 r = mac_smack_apply_pid(0, context->smack_process_label);
2175                 if (r < 0)
2176                         return r;
2177         }
2178 #ifdef SMACK_DEFAULT_PROCESS_LABEL
2179         else {
2180                 _cleanup_free_ char *exec_label = NULL;
2181
2182                 r = mac_smack_read(command->path, SMACK_ATTR_EXEC, &exec_label);
2183                 if (r < 0 && !IN_SET(r, -ENODATA, -EOPNOTSUPP))
2184                         return r;
2185
2186                 r = mac_smack_apply_pid(0, exec_label ? : SMACK_DEFAULT_PROCESS_LABEL);
2187                 if (r < 0)
2188                         return r;
2189         }
2190 #endif
2191
2192         return 0;
2193 }
2194 #endif
2195
2196 static int compile_bind_mounts(
2197                 const ExecContext *context,
2198                 const ExecParameters *params,
2199                 BindMount **ret_bind_mounts,
2200                 size_t *ret_n_bind_mounts,
2201                 char ***ret_empty_directories) {
2202
2203         _cleanup_strv_free_ char **empty_directories = NULL;
2204         BindMount *bind_mounts;
2205         size_t n, h = 0, i;
2206         ExecDirectoryType t;
2207         int r;
2208
2209         assert(context);
2210         assert(params);
2211         assert(ret_bind_mounts);
2212         assert(ret_n_bind_mounts);
2213         assert(ret_empty_directories);
2214
2215         n = context->n_bind_mounts;
2216         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2217                 if (!params->prefix[t])
2218                         continue;
2219
2220                 n += strv_length(context->directories[t].paths);
2221         }
2222
2223         if (n <= 0) {
2224                 *ret_bind_mounts = NULL;
2225                 *ret_n_bind_mounts = 0;
2226                 *ret_empty_directories = NULL;
2227                 return 0;
2228         }
2229
2230         bind_mounts = new(BindMount, n);
2231         if (!bind_mounts)
2232                 return -ENOMEM;
2233
2234         for (i = 0; i < context->n_bind_mounts; i++) {
2235                 BindMount *item = context->bind_mounts + i;
2236                 char *s, *d;
2237
2238                 s = strdup(item->source);
2239                 if (!s) {
2240                         r = -ENOMEM;
2241                         goto finish;
2242                 }
2243
2244                 d = strdup(item->destination);
2245                 if (!d) {
2246                         free(s);
2247                         r = -ENOMEM;
2248                         goto finish;
2249                 }
2250
2251                 bind_mounts[h++] = (BindMount) {
2252                         .source = s,
2253                         .destination = d,
2254                         .read_only = item->read_only,
2255                         .recursive = item->recursive,
2256                         .ignore_enoent = item->ignore_enoent,
2257                 };
2258         }
2259
2260         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2261                 char **suffix;
2262
2263                 if (!params->prefix[t])
2264                         continue;
2265
2266                 if (strv_isempty(context->directories[t].paths))
2267                         continue;
2268
2269                 if (context->dynamic_user &&
2270                     !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) &&
2271                     !(context->root_directory || context->root_image)) {
2272                         char *private_root;
2273
2274                         /* So this is for a dynamic user, and we need to make sure the process can access its own
2275                          * directory. For that we overmount the usually inaccessible "private" subdirectory with a
2276                          * tmpfs that makes it accessible and is empty except for the submounts we do this for. */
2277
2278                         private_root = strjoin(params->prefix[t], "/private");
2279                         if (!private_root) {
2280                                 r = -ENOMEM;
2281                                 goto finish;
2282                         }
2283
2284                         r = strv_consume(&empty_directories, private_root);
2285                         if (r < 0)
2286                                 goto finish;
2287                 }
2288
2289                 STRV_FOREACH(suffix, context->directories[t].paths) {
2290                         char *s, *d;
2291
2292                         if (context->dynamic_user &&
2293                             !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION))
2294                                 s = strjoin(params->prefix[t], "/private/", *suffix);
2295                         else
2296                                 s = strjoin(params->prefix[t], "/", *suffix);
2297                         if (!s) {
2298                                 r = -ENOMEM;
2299                                 goto finish;
2300                         }
2301
2302                         if (context->dynamic_user &&
2303                             !IN_SET(t, EXEC_DIRECTORY_RUNTIME, EXEC_DIRECTORY_CONFIGURATION) &&
2304                             (context->root_directory || context->root_image))
2305                                 /* When RootDirectory= or RootImage= are set, then the symbolic link to the private
2306                                  * directory is not created on the root directory. So, let's bind-mount the directory
2307                                  * on the 'non-private' place. */
2308                                 d = strjoin(params->prefix[t], "/", *suffix);
2309                         else
2310                                 d = strdup(s);
2311                         if (!d) {
2312                                 free(s);
2313                                 r = -ENOMEM;
2314                                 goto finish;
2315                         }
2316
2317                         bind_mounts[h++] = (BindMount) {
2318                                 .source = s,
2319                                 .destination = d,
2320                                 .read_only = false,
2321                                 .recursive = true,
2322                                 .ignore_enoent = false,
2323                         };
2324                 }
2325         }
2326
2327         assert(h == n);
2328
2329         *ret_bind_mounts = bind_mounts;
2330         *ret_n_bind_mounts = n;
2331         *ret_empty_directories = TAKE_PTR(empty_directories);
2332
2333         return (int) n;
2334
2335 finish:
2336         bind_mount_free_many(bind_mounts, h);
2337         return r;
2338 }
2339
2340 static int apply_mount_namespace(
2341                 const Unit *u,
2342                 const ExecCommand *command,
2343                 const ExecContext *context,
2344                 const ExecParameters *params,
2345                 const ExecRuntime *runtime) {
2346
2347         _cleanup_strv_free_ char **empty_directories = NULL;
2348         char *tmp = NULL, *var = NULL;
2349         const char *root_dir = NULL, *root_image = NULL;
2350         NamespaceInfo ns_info;
2351         bool needs_sandboxing;
2352         BindMount *bind_mounts = NULL;
2353         size_t n_bind_mounts = 0;
2354         int r;
2355
2356         assert(context);
2357
2358         /* The runtime struct only contains the parent of the private /tmp,
2359          * which is non-accessible to world users. Inside of it there's a /tmp
2360          * that is sticky, and that's the one we want to use here. */
2361
2362         if (context->private_tmp && runtime) {
2363                 if (runtime->tmp_dir)
2364                         tmp = strjoina(runtime->tmp_dir, "/tmp");
2365                 if (runtime->var_tmp_dir)
2366                         var = strjoina(runtime->var_tmp_dir, "/tmp");
2367         }
2368
2369         if (params->flags & EXEC_APPLY_CHROOT) {
2370                 root_image = context->root_image;
2371
2372                 if (!root_image)
2373                         root_dir = context->root_directory;
2374         }
2375
2376         r = compile_bind_mounts(context, params, &bind_mounts, &n_bind_mounts, &empty_directories);
2377         if (r < 0)
2378                 return r;
2379
2380         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
2381         if (needs_sandboxing)
2382                 ns_info = (NamespaceInfo) {
2383                         .ignore_protect_paths = false,
2384                         .private_dev = context->private_devices,
2385                         .protect_control_groups = context->protect_control_groups,
2386                         .protect_kernel_tunables = context->protect_kernel_tunables,
2387                         .protect_kernel_modules = context->protect_kernel_modules,
2388                         .mount_apivfs = context->mount_apivfs,
2389                         .private_mounts = context->private_mounts,
2390                 };
2391         else if (!context->dynamic_user && root_dir)
2392                 /*
2393                  * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed
2394                  * sandbox info, otherwise enforce it, don't ignore protected paths and
2395                  * fail if we are enable to apply the sandbox inside the mount namespace.
2396                  */
2397                 ns_info = (NamespaceInfo) {
2398                         .ignore_protect_paths = true,
2399                 };
2400         else
2401                 ns_info = (NamespaceInfo) {};
2402
2403         r = setup_namespace(root_dir, root_image,
2404                             &ns_info, context->read_write_paths,
2405                             needs_sandboxing ? context->read_only_paths : NULL,
2406                             needs_sandboxing ? context->inaccessible_paths : NULL,
2407                             empty_directories,
2408                             bind_mounts,
2409                             n_bind_mounts,
2410                             context->temporary_filesystems,
2411                             context->n_temporary_filesystems,
2412                             tmp,
2413                             var,
2414                             needs_sandboxing ? context->protect_home : PROTECT_HOME_NO,
2415                             needs_sandboxing ? context->protect_system : PROTECT_SYSTEM_NO,
2416                             context->mount_flags,
2417                             DISSECT_IMAGE_DISCARD_ON_LOOP);
2418
2419         bind_mount_free_many(bind_mounts, n_bind_mounts);
2420
2421         /* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports
2422          * that with a special, recognizable error ENOANO. In this case, silently proceeed, but only if exclusively
2423          * sandboxing options were used, i.e. nothing such as RootDirectory= or BindMount= that would result in a
2424          * completely different execution environment. */
2425         if (r == -ENOANO) {
2426                 if (n_bind_mounts == 0 &&
2427                     context->n_temporary_filesystems == 0 &&
2428                     !root_dir && !root_image &&
2429                     !context->dynamic_user) {
2430                         log_unit_debug(u, "Failed to set up namespace, assuming containerized execution and ignoring.");
2431                         return 0;
2432                 }
2433
2434                 log_unit_debug(u, "Failed to set up namespace, and refusing to continue since the selected namespacing options alter mount environment non-trivially.\n"
2435                                "Bind mounts: %zu, temporary filesystems: %zu, root directory: %s, root image: %s, dynamic user: %s",
2436                                n_bind_mounts, context->n_temporary_filesystems, yes_no(root_dir), yes_no(root_image), yes_no(context->dynamic_user));
2437
2438                 return -EOPNOTSUPP;
2439         }
2440
2441         return r;
2442 }
2443
2444 static int apply_working_directory(
2445                 const ExecContext *context,
2446                 const ExecParameters *params,
2447                 const char *home,
2448                 const bool needs_mount_ns,
2449                 int *exit_status) {
2450
2451         const char *d, *wd;
2452
2453         assert(context);
2454         assert(exit_status);
2455
2456         if (context->working_directory_home) {
2457
2458                 if (!home) {
2459                         *exit_status = EXIT_CHDIR;
2460                         return -ENXIO;
2461                 }
2462
2463                 wd = home;
2464
2465         } else if (context->working_directory)
2466                 wd = context->working_directory;
2467         else
2468                 wd = "/";
2469
2470         if (params->flags & EXEC_APPLY_CHROOT) {
2471                 if (!needs_mount_ns && context->root_directory)
2472                         if (chroot(context->root_directory) < 0) {
2473                                 *exit_status = EXIT_CHROOT;
2474                                 return -errno;
2475                         }
2476
2477                 d = wd;
2478         } else
2479                 d = prefix_roota(context->root_directory, wd);
2480
2481         if (chdir(d) < 0 && !context->working_directory_missing_ok) {
2482                 *exit_status = EXIT_CHDIR;
2483                 return -errno;
2484         }
2485
2486         return 0;
2487 }
2488
2489 static int setup_keyring(
2490                 const Unit *u,
2491                 const ExecContext *context,
2492                 const ExecParameters *p,
2493                 uid_t uid, gid_t gid) {
2494
2495         key_serial_t keyring;
2496         int r = 0;
2497         uid_t saved_uid;
2498         gid_t saved_gid;
2499
2500         assert(u);
2501         assert(context);
2502         assert(p);
2503
2504         /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that
2505          * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond
2506          * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be
2507          * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in
2508          * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where
2509          * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */
2510
2511         if (!(p->flags & EXEC_NEW_KEYRING))
2512                 return 0;
2513
2514         if (context->keyring_mode == EXEC_KEYRING_INHERIT)
2515                 return 0;
2516
2517         /* Acquiring a reference to the user keyring is nasty. We briefly change identity in order to get things set up
2518          * properly by the kernel. If we don't do that then we can't create it atomically, and that sucks for parallel
2519          * execution. This mimics what pam_keyinit does, too. Setting up session keyring, to be owned by the right user
2520          * & group is just as nasty as acquiring a reference to the user keyring. */
2521
2522         saved_uid = getuid();
2523         saved_gid = getgid();
2524
2525         if (gid_is_valid(gid) && gid != saved_gid) {
2526                 if (setregid(gid, -1) < 0)
2527                         return log_unit_error_errno(u, errno, "Failed to change GID for user keyring: %m");
2528         }
2529
2530         if (uid_is_valid(uid) && uid != saved_uid) {
2531                 if (setreuid(uid, -1) < 0) {
2532                         r = log_unit_error_errno(u, errno, "Failed to change UID for user keyring: %m");
2533                         goto out;
2534                 }
2535         }
2536
2537         keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
2538         if (keyring == -1) {
2539                 if (errno == ENOSYS)
2540                         log_unit_debug_errno(u, errno, "Kernel keyring not supported, ignoring.");
2541                 else if (IN_SET(errno, EACCES, EPERM))
2542                         log_unit_debug_errno(u, errno, "Kernel keyring access prohibited, ignoring.");
2543                 else if (errno == EDQUOT)
2544                         log_unit_debug_errno(u, errno, "Out of kernel keyrings to allocate, ignoring.");
2545                 else
2546                         r = log_unit_error_errno(u, errno, "Setting up kernel keyring failed: %m");
2547
2548                 goto out;
2549         }
2550
2551         /* When requested link the user keyring into the session keyring. */
2552         if (context->keyring_mode == EXEC_KEYRING_SHARED) {
2553
2554                 if (keyctl(KEYCTL_LINK,
2555                            KEY_SPEC_USER_KEYRING,
2556                            KEY_SPEC_SESSION_KEYRING, 0, 0) < 0) {
2557                         r = log_unit_error_errno(u, errno, "Failed to link user keyring into session keyring: %m");
2558                         goto out;
2559                 }
2560         }
2561
2562         /* Restore uid/gid back */
2563         if (uid_is_valid(uid) && uid != saved_uid) {
2564                 if (setreuid(saved_uid, -1) < 0) {
2565                         r = log_unit_error_errno(u, errno, "Failed to change UID back for user keyring: %m");
2566                         goto out;
2567                 }
2568         }
2569
2570         if (gid_is_valid(gid) && gid != saved_gid) {
2571                 if (setregid(saved_gid, -1) < 0)
2572                         return log_unit_error_errno(u, errno, "Failed to change GID back for user keyring: %m");
2573         }
2574
2575         /* Populate they keyring with the invocation ID by default, as original saved_uid. */
2576         if (!sd_id128_is_null(u->invocation_id)) {
2577                 key_serial_t key;
2578
2579                 key = add_key("user", "invocation_id", &u->invocation_id, sizeof(u->invocation_id), KEY_SPEC_SESSION_KEYRING);
2580                 if (key == -1)
2581                         log_unit_debug_errno(u, errno, "Failed to add invocation ID to keyring, ignoring: %m");
2582                 else {
2583                         if (keyctl(KEYCTL_SETPERM, key,
2584                                    KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH|
2585                                    KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0)
2586                                 r = log_unit_error_errno(u, errno, "Failed to restrict invocation ID permission: %m");
2587                 }
2588         }
2589
2590 out:
2591         /* Revert back uid & gid for the the last time, and exit */
2592         /* no extra logging, as only the first already reported error matters */
2593         if (getuid() != saved_uid)
2594                 (void) setreuid(saved_uid, -1);
2595
2596         if (getgid() != saved_gid)
2597                 (void) setregid(saved_gid, -1);
2598
2599         return r;
2600 }
2601
2602 static void append_socket_pair(int *array, size_t *n, const int pair[2]) {
2603         assert(array);
2604         assert(n);
2605
2606         if (!pair)
2607                 return;
2608
2609         if (pair[0] >= 0)
2610                 array[(*n)++] = pair[0];
2611         if (pair[1] >= 0)
2612                 array[(*n)++] = pair[1];
2613 }
2614
2615 static int close_remaining_fds(
2616                 const ExecParameters *params,
2617                 const ExecRuntime *runtime,
2618                 const DynamicCreds *dcreds,
2619                 int user_lookup_fd,
2620                 int socket_fd,
2621                 int exec_fd,
2622                 int *fds, size_t n_fds) {
2623
2624         size_t n_dont_close = 0;
2625         int dont_close[n_fds + 12];
2626
2627         assert(params);
2628
2629         if (params->stdin_fd >= 0)
2630                 dont_close[n_dont_close++] = params->stdin_fd;
2631         if (params->stdout_fd >= 0)
2632                 dont_close[n_dont_close++] = params->stdout_fd;
2633         if (params->stderr_fd >= 0)
2634                 dont_close[n_dont_close++] = params->stderr_fd;
2635
2636         if (socket_fd >= 0)
2637                 dont_close[n_dont_close++] = socket_fd;
2638         if (exec_fd >= 0)
2639                 dont_close[n_dont_close++] = exec_fd;
2640         if (n_fds > 0) {
2641                 memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
2642                 n_dont_close += n_fds;
2643         }
2644
2645         if (runtime)
2646                 append_socket_pair(dont_close, &n_dont_close, runtime->netns_storage_socket);
2647
2648         if (dcreds) {
2649                 if (dcreds->user)
2650                         append_socket_pair(dont_close, &n_dont_close, dcreds->user->storage_socket);
2651                 if (dcreds->group)
2652                         append_socket_pair(dont_close, &n_dont_close, dcreds->group->storage_socket);
2653         }
2654
2655         if (user_lookup_fd >= 0)
2656                 dont_close[n_dont_close++] = user_lookup_fd;
2657
2658         return close_all_fds(dont_close, n_dont_close);
2659 }
2660
2661 static int send_user_lookup(
2662                 Unit *unit,
2663                 int user_lookup_fd,
2664                 uid_t uid,
2665                 gid_t gid) {
2666
2667         assert(unit);
2668
2669         /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID
2670          * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was
2671          * specified. */
2672
2673         if (user_lookup_fd < 0)
2674                 return 0;
2675
2676         if (!uid_is_valid(uid) && !gid_is_valid(gid))
2677                 return 0;
2678
2679         if (writev(user_lookup_fd,
2680                (struct iovec[]) {
2681                            IOVEC_INIT(&uid, sizeof(uid)),
2682                            IOVEC_INIT(&gid, sizeof(gid)),
2683                            IOVEC_INIT_STRING(unit->id) }, 3) < 0)
2684                 return -errno;
2685
2686         return 0;
2687 }
2688
2689 static int acquire_home(const ExecContext *c, uid_t uid, const char** home, char **buf) {
2690         int r;
2691
2692         assert(c);
2693         assert(home);
2694         assert(buf);
2695
2696         /* If WorkingDirectory=~ is set, try to acquire a usable home directory. */
2697
2698         if (*home)
2699                 return 0;
2700
2701         if (!c->working_directory_home)
2702                 return 0;
2703
2704         if (uid == 0) {
2705                 /* Hardcode /root as home directory for UID 0 */
2706                 *home = "/root";
2707                 return 1;
2708         }
2709
2710         r = get_home_dir(buf);
2711         if (r < 0)
2712                 return r;
2713
2714         *home = *buf;
2715         return 1;
2716 }
2717
2718 static int compile_suggested_paths(const ExecContext *c, const ExecParameters *p, char ***ret) {
2719         _cleanup_strv_free_ char ** list = NULL;
2720         ExecDirectoryType t;
2721         int r;
2722
2723         assert(c);
2724         assert(p);
2725         assert(ret);
2726
2727         assert(c->dynamic_user);
2728
2729         /* Compile a list of paths that it might make sense to read the owning UID from to use as initial candidate for
2730          * dynamic UID allocation, in order to save us from doing costly recursive chown()s of the special
2731          * directories. */
2732
2733         for (t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
2734                 char **i;
2735
2736                 if (t == EXEC_DIRECTORY_CONFIGURATION)
2737                         continue;
2738
2739                 if (!p->prefix[t])
2740                         continue;
2741
2742                 STRV_FOREACH(i, c->directories[t].paths) {
2743                         char *e;
2744
2745                         if (t == EXEC_DIRECTORY_RUNTIME)
2746                                 e = strjoin(p->prefix[t], "/", *i);
2747                         else
2748                                 e = strjoin(p->prefix[t], "/private/", *i);
2749                         if (!e)
2750                                 return -ENOMEM;
2751
2752                         r = strv_consume(&list, e);
2753                         if (r < 0)
2754                                 return r;
2755                 }
2756         }
2757
2758         *ret = TAKE_PTR(list);
2759
2760         return 0;
2761 }
2762
2763 static char *exec_command_line(char **argv);
2764
2765 static int exec_child(
2766                 Unit *unit,
2767                 const ExecCommand *command,
2768                 const ExecContext *context,
2769                 const ExecParameters *params,
2770                 ExecRuntime *runtime,
2771                 DynamicCreds *dcreds,
2772                 int socket_fd,
2773                 int named_iofds[3],
2774                 int *fds,
2775                 size_t n_socket_fds,
2776                 size_t n_storage_fds,
2777                 char **files_env,
2778                 int user_lookup_fd,
2779                 int *exit_status) {
2780
2781         _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **accum_env = NULL, **final_argv = NULL;
2782         int *fds_with_exec_fd, n_fds_with_exec_fd, r, ngids = 0, exec_fd = -1;
2783         _cleanup_free_ gid_t *supplementary_gids = NULL;
2784         const char *username = NULL, *groupname = NULL;
2785         _cleanup_free_ char *home_buffer = NULL;
2786         const char *home = NULL, *shell = NULL;
2787         dev_t journal_stream_dev = 0;
2788         ino_t journal_stream_ino = 0;
2789         bool needs_sandboxing,          /* Do we need to set up full sandboxing? (i.e. all namespacing, all MAC stuff, caps, yadda yadda */
2790                 needs_setuid,           /* Do we need to do the actual setresuid()/setresgid() calls? */
2791                 needs_mount_namespace,  /* Do we need to set up a mount namespace for this kernel? */
2792                 needs_ambient_hack;     /* Do we need to apply the ambient capabilities hack? */
2793 #if HAVE_SELINUX
2794         _cleanup_free_ char *mac_selinux_context_net = NULL;
2795         bool use_selinux = false;
2796 #endif
2797 #if ENABLE_SMACK
2798         bool use_smack = false;
2799 #endif
2800 #if HAVE_APPARMOR
2801         bool use_apparmor = false;
2802 #endif
2803         uid_t uid = UID_INVALID;
2804         gid_t gid = GID_INVALID;
2805         size_t n_fds;
2806         ExecDirectoryType dt;
2807         int secure_bits;
2808
2809         assert(unit);
2810         assert(command);
2811         assert(context);
2812         assert(params);
2813         assert(exit_status);
2814
2815         rename_process_from_path(command->path);
2816
2817         /* We reset exactly these signals, since they are the
2818          * only ones we set to SIG_IGN in the main daemon. All
2819          * others we leave untouched because we set them to
2820          * SIG_DFL or a valid handler initially, both of which
2821          * will be demoted to SIG_DFL. */
2822         (void) default_signals(SIGNALS_CRASH_HANDLER,
2823                                SIGNALS_IGNORE, -1);
2824
2825         if (context->ignore_sigpipe)
2826                 (void) ignore_signals(SIGPIPE, -1);
2827
2828         r = reset_signal_mask();
2829         if (r < 0) {
2830                 *exit_status = EXIT_SIGNAL_MASK;
2831                 return log_unit_error_errno(unit, r, "Failed to set process signal mask: %m");
2832         }
2833
2834         if (params->idle_pipe)
2835                 do_idle_pipe_dance(params->idle_pipe);
2836
2837         /* Close fds we don't need very early to make sure we don't block init reexecution because it cannot bind its
2838          * sockets. Among the fds we close are the logging fds, and we want to keep them closed, so that we don't have
2839          * any fds open we don't really want open during the transition. In order to make logging work, we switch the
2840          * log subsystem into open_when_needed mode, so that it reopens the logs on every single log call. */
2841
2842         log_forget_fds();
2843         log_set_open_when_needed(true);
2844
2845         /* In case anything used libc syslog(), close this here, too */
2846         closelog();
2847
2848         n_fds = n_socket_fds + n_storage_fds;
2849         r = close_remaining_fds(params, runtime, dcreds, user_lookup_fd, socket_fd, params->exec_fd, fds, n_fds);
2850         if (r < 0) {
2851                 *exit_status = EXIT_FDS;
2852                 return log_unit_error_errno(unit, r, "Failed to close unwanted file descriptors: %m");
2853         }
2854
2855         if (!context->same_pgrp)
2856                 if (setsid() < 0) {
2857                         *exit_status = EXIT_SETSID;
2858                         return log_unit_error_errno(unit, errno, "Failed to create new process session: %m");
2859                 }
2860
2861         exec_context_tty_reset(context, params);
2862
2863         if (unit_shall_confirm_spawn(unit)) {
2864                 const char *vc = params->confirm_spawn;
2865                 _cleanup_free_ char *cmdline = NULL;
2866
2867                 cmdline = exec_command_line(command->argv);
2868                 if (!cmdline) {
2869                         *exit_status = EXIT_MEMORY;
2870                         return log_oom();
2871                 }
2872
2873                 r = ask_for_confirmation(vc, unit, cmdline);
2874                 if (r != CONFIRM_EXECUTE) {
2875                         if (r == CONFIRM_PRETEND_SUCCESS) {
2876                                 *exit_status = EXIT_SUCCESS;
2877                                 return 0;
2878                         }
2879                         *exit_status = EXIT_CONFIRM;
2880                         log_unit_error(unit, "Execution cancelled by the user");
2881                         return -ECANCELED;
2882                 }
2883         }
2884
2885         /* We are about to invoke NSS and PAM modules. Let's tell them what we are doing here, maybe they care. This is
2886          * used by nss-resolve to disable itself when we are about to start systemd-resolved, to avoid deadlocks. Note
2887          * that these env vars do not survive the execve(), which means they really only apply to the PAM and NSS
2888          * invocations themselves. Also note that while we'll only invoke NSS modules involved in user management they
2889          * might internally call into other NSS modules that are involved in hostname resolution, we never know. */
2890         if (setenv("SYSTEMD_ACTIVATION_UNIT", unit->id, true) != 0 ||
2891             setenv("SYSTEMD_ACTIVATION_SCOPE", MANAGER_IS_SYSTEM(unit->manager) ? "system" : "user", true) != 0) {
2892                 *exit_status = EXIT_MEMORY;
2893                 return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
2894         }
2895
2896         if (context->dynamic_user && dcreds) {
2897                 _cleanup_strv_free_ char **suggested_paths = NULL;
2898
2899                 /* On top of that, make sure we bypass our own NSS module nss-systemd comprehensively for any NSS
2900                  * checks, if DynamicUser=1 is used, as we shouldn't create a feedback loop with ourselves here.*/
2901                 if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) {
2902                         *exit_status = EXIT_USER;
2903                         return log_unit_error_errno(unit, errno, "Failed to update environment: %m");
2904                 }
2905
2906                 r = compile_suggested_paths(context, params, &suggested_paths);
2907                 if (r < 0) {
2908                         *exit_status = EXIT_MEMORY;
2909                         return log_oom();
2910                 }
2911
2912                 r = dynamic_creds_realize(dcreds, suggested_paths, &uid, &gid);
2913                 if (r < 0) {
2914                         *exit_status = EXIT_USER;
2915                         if (r == -EILSEQ) {
2916                                 log_unit_error(unit, "Failed to update dynamic user credentials: User or group with specified name already exists.");
2917                                 return -EOPNOTSUPP;
2918                         }
2919                         return log_unit_error_errno(unit, r, "Failed to update dynamic user credentials: %m");
2920                 }
2921
2922                 if (!uid_is_valid(uid)) {
2923                         *exit_status = EXIT_USER;
2924                         log_unit_error(unit, "UID validation failed for \""UID_FMT"\"", uid);
2925                         return -ESRCH;
2926                 }
2927
2928                 if (!gid_is_valid(gid)) {
2929                         *exit_status = EXIT_USER;
2930                         log_unit_error(unit, "GID validation failed for \""GID_FMT"\"", gid);
2931                         return -ESRCH;
2932                 }
2933
2934                 if (dcreds->user)
2935                         username = dcreds->user->name;
2936
2937         } else {
2938                 r = get_fixed_user(context, &username, &uid, &gid, &home, &shell);
2939                 if (r < 0) {
2940                         *exit_status = EXIT_USER;
2941                         return log_unit_error_errno(unit, r, "Failed to determine user credentials: %m");
2942                 }
2943
2944                 r = get_fixed_group(context, &groupname, &gid);
2945                 if (r < 0) {
2946                         *exit_status = EXIT_GROUP;
2947                         return log_unit_error_errno(unit, r, "Failed to determine group credentials: %m");
2948                 }
2949         }
2950
2951         /* Initialize user supplementary groups and get SupplementaryGroups= ones */
2952         r = get_supplementary_groups(context, username, groupname, gid,
2953                                      &supplementary_gids, &ngids);
2954         if (r < 0) {
2955                 *exit_status = EXIT_GROUP;
2956                 return log_unit_error_errno(unit, r, "Failed to determine supplementary groups: %m");
2957         }
2958
2959         r = send_user_lookup(unit, user_lookup_fd, uid, gid);
2960         if (r < 0) {
2961                 *exit_status = EXIT_USER;
2962                 return log_unit_error_errno(unit, r, "Failed to send user credentials to PID1: %m");
2963         }
2964
2965         user_lookup_fd = safe_close(user_lookup_fd);
2966
2967         r = acquire_home(context, uid, &home, &home_buffer);
2968         if (r < 0) {
2969                 *exit_status = EXIT_CHDIR;
2970                 return log_unit_error_errno(unit, r, "Failed to determine $HOME for user: %m");
2971         }
2972
2973         /* If a socket is connected to STDIN/STDOUT/STDERR, we
2974          * must sure to drop O_NONBLOCK */
2975         if (socket_fd >= 0)
2976                 (void) fd_nonblock(socket_fd, false);
2977
2978         r = setup_input(context, params, socket_fd, named_iofds);
2979         if (r < 0) {
2980                 *exit_status = EXIT_STDIN;
2981                 return log_unit_error_errno(unit, r, "Failed to set up standard input: %m");
2982         }
2983
2984         r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
2985         if (r < 0) {
2986                 *exit_status = EXIT_STDOUT;
2987                 return log_unit_error_errno(unit, r, "Failed to set up standard output: %m");
2988         }
2989
2990         r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino);
2991         if (r < 0) {
2992                 *exit_status = EXIT_STDERR;
2993                 return log_unit_error_errno(unit, r, "Failed to set up standard error output: %m");
2994         }
2995
2996         if (params->cgroup_path) {
2997                 r = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0, NULL, NULL);
2998                 if (r < 0) {
2999                         *exit_status = EXIT_CGROUP;
3000                         return log_unit_error_errno(unit, r, "Failed to attach to cgroup %s: %m", params->cgroup_path);
3001                 }
3002         }
3003
3004         if (context->oom_score_adjust_set) {
3005                 /* When we can't make this change due to EPERM, then let's silently skip over it. User namespaces
3006                  * prohibit write access to this file, and we shouldn't trip up over that. */
3007                 r = set_oom_score_adjust(context->oom_score_adjust);
3008                 if (IN_SET(r, -EPERM, -EACCES))
3009                         log_unit_debug_errno(unit, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
3010                 else if (r < 0) {
3011                         *exit_status = EXIT_OOM_ADJUST;
3012                         return log_unit_error_errno(unit, r, "Failed to adjust OOM setting: %m");
3013                 }
3014         }
3015
3016         if (context->nice_set)
3017                 if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
3018                         *exit_status = EXIT_NICE;
3019                         return log_unit_error_errno(unit, errno, "Failed to set up process scheduling priority (nice level): %m");
3020                 }
3021
3022         if (context->cpu_sched_set) {
3023                 struct sched_param param = {
3024                         .sched_priority = context->cpu_sched_priority,
3025                 };
3026
3027                 r = sched_setscheduler(0,
3028                                        context->cpu_sched_policy |
3029                                        (context->cpu_sched_reset_on_fork ?
3030                                         SCHED_RESET_ON_FORK : 0),
3031                                        &param);
3032                 if (r < 0) {
3033                         *exit_status = EXIT_SETSCHEDULER;
3034                         return log_unit_error_errno(unit, errno, "Failed to set up CPU scheduling: %m");
3035                 }
3036         }
3037
3038         if (context->cpuset)
3039                 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
3040                         *exit_status = EXIT_CPUAFFINITY;
3041                         return log_unit_error_errno(unit, errno, "Failed to set up CPU affinity: %m");
3042                 }
3043
3044         if (context->ioprio_set)
3045                 if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
3046                         *exit_status = EXIT_IOPRIO;
3047                         return log_unit_error_errno(unit, errno, "Failed to set up IO scheduling priority: %m");
3048                 }
3049
3050         if (context->timer_slack_nsec != NSEC_INFINITY)
3051                 if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
3052                         *exit_status = EXIT_TIMERSLACK;
3053                         return log_unit_error_errno(unit, errno, "Failed to set up timer slack: %m");
3054                 }
3055
3056         if (context->personality != PERSONALITY_INVALID) {
3057                 r = safe_personality(context->personality);
3058                 if (r < 0) {
3059                         *exit_status = EXIT_PERSONALITY;
3060                         return log_unit_error_errno(unit, r, "Failed to set up execution domain (personality): %m");
3061                 }
3062         }
3063
3064         if (context->utmp_id)
3065                 utmp_put_init_process(context->utmp_id, getpid_cached(), getsid(0),
3066                                       context->tty_path,
3067                                       context->utmp_mode == EXEC_UTMP_INIT  ? INIT_PROCESS :
3068                                       context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS :
3069                                       USER_PROCESS,
3070                                       username);
3071
3072         if (context->user) {
3073                 r = chown_terminal(STDIN_FILENO, uid);
3074                 if (r < 0) {
3075                         *exit_status = EXIT_STDIN;
3076                         return log_unit_error_errno(unit, r, "Failed to change ownership of terminal: %m");
3077                 }
3078         }
3079
3080         /* If delegation is enabled we'll pass ownership of the cgroup to the user of the new process. On cgroupsv1
3081          * this is only about systemd's own hierarchy, i.e. not the controller hierarchies, simply because that's not
3082          * safe. On cgroupsv2 there's only one hierarchy anyway, and delegation is safe there, hence in that case only
3083          * touch a single hierarchy too. */
3084         if (params->cgroup_path && context->user && (params->flags & EXEC_CGROUP_DELEGATE)) {
3085                 r = cg_set_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, uid, gid);
3086                 if (r < 0) {
3087                         *exit_status = EXIT_CGROUP;
3088                         return log_unit_error_errno(unit, r, "Failed to adjust control group access: %m");
3089                 }
3090         }
3091
3092         for (dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
3093                 r = setup_exec_directory(context, params, uid, gid, dt, exit_status);
3094                 if (r < 0)
3095                         return log_unit_error_errno(unit, r, "Failed to set up special execution directory in %s: %m", params->prefix[dt]);
3096         }
3097
3098         r = build_environment(
3099                         unit,
3100                         context,
3101                         params,
3102                         n_fds,
3103                         home,
3104                         username,
3105                         shell,
3106                         journal_stream_dev,
3107                         journal_stream_ino,
3108                         &our_env);
3109         if (r < 0) {
3110                 *exit_status = EXIT_MEMORY;
3111                 return log_oom();
3112         }
3113
3114         r = build_pass_environment(context, &pass_env);
3115         if (r < 0) {
3116                 *exit_status = EXIT_MEMORY;
3117                 return log_oom();
3118         }
3119
3120         accum_env = strv_env_merge(5,
3121                                    params->environment,
3122                                    our_env,
3123                                    pass_env,
3124                                    context->environment,
3125                                    files_env,
3126                                    NULL);
3127         if (!accum_env) {
3128                 *exit_status = EXIT_MEMORY;
3129                 return log_oom();
3130         }
3131         accum_env = strv_env_clean(accum_env);
3132
3133         (void) umask(context->umask);
3134
3135         r = setup_keyring(unit, context, params, uid, gid);
3136         if (r < 0) {
3137                 *exit_status = EXIT_KEYRING;
3138                 return log_unit_error_errno(unit, r, "Failed to set up kernel keyring: %m");
3139         }
3140
3141         /* We need sandboxing if the caller asked us to apply it and the command isn't explicitly excepted from it */
3142         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
3143
3144         /* We need the ambient capability hack, if the caller asked us to apply it and the command is marked for it, and the kernel doesn't actually support ambient caps */
3145         needs_ambient_hack = (params->flags & EXEC_APPLY_SANDBOXING) && (command->flags & EXEC_COMMAND_AMBIENT_MAGIC) && !ambient_capabilities_supported();
3146
3147         /* We need setresuid() if the caller asked us to apply sandboxing and the command isn't explicitly excepted from either whole sandboxing or just setresuid() itself, and the ambient hack is not desired */
3148         if (needs_ambient_hack)
3149                 needs_setuid = false;
3150         else
3151                 needs_setuid = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & (EXEC_COMMAND_FULLY_PRIVILEGED|EXEC_COMMAND_NO_SETUID));
3152
3153         if (needs_sandboxing) {
3154                 /* MAC enablement checks need to be done before a new mount ns is created, as they rely on /sys being
3155                  * present. The actual MAC context application will happen later, as late as possible, to avoid
3156                  * impacting our own code paths. */
3157
3158 #if HAVE_SELINUX
3159                 use_selinux = mac_selinux_use();
3160 #endif
3161 #if ENABLE_SMACK
3162                 use_smack = mac_smack_use();
3163 #endif
3164 #if HAVE_APPARMOR
3165                 use_apparmor = mac_apparmor_use();
3166 #endif
3167         }
3168
3169         if (needs_setuid) {
3170                 if (context->pam_name && username) {
3171                         r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
3172                         if (r < 0) {
3173                                 *exit_status = EXIT_PAM;
3174                                 return log_unit_error_errno(unit, r, "Failed to set up PAM session: %m");
3175                         }
3176                 }
3177         }
3178
3179         if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
3180                 if (ns_type_supported(NAMESPACE_NET)) {
3181                         r = setup_netns(runtime->netns_storage_socket);
3182                         if (r < 0) {
3183                                 *exit_status = EXIT_NETWORK;
3184                                 return log_unit_error_errno(unit, r, "Failed to set up network namespacing: %m");
3185                         }
3186                 } else
3187                         log_unit_warning(unit, "PrivateNetwork=yes is configured, but the kernel does not support network namespaces, ignoring.");
3188         }
3189
3190         needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime);
3191         if (needs_mount_namespace) {
3192                 r = apply_mount_namespace(unit, command, context, params, runtime);
3193                 if (r < 0) {
3194                         *exit_status = EXIT_NAMESPACE;
3195                         return log_unit_error_errno(unit, r, "Failed to set up mount namespacing: %m");
3196                 }
3197         }
3198
3199         /* Apply just after mount namespace setup */
3200         r = apply_working_directory(context, params, home, needs_mount_namespace, exit_status);
3201         if (r < 0)
3202                 return log_unit_error_errno(unit, r, "Changing to the requested working directory failed: %m");
3203
3204         /* Drop groups as early as possbile */
3205         if (needs_setuid) {
3206                 r = enforce_groups(gid, supplementary_gids, ngids);
3207                 if (r < 0) {
3208                         *exit_status = EXIT_GROUP;
3209                         return log_unit_error_errno(unit, r, "Changing group credentials failed: %m");
3210                 }
3211         }
3212
3213         if (needs_sandboxing) {
3214 #if HAVE_SELINUX
3215                 if (use_selinux && params->selinux_context_net && socket_fd >= 0) {
3216                         r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
3217                         if (r < 0) {
3218                                 *exit_status = EXIT_SELINUX_CONTEXT;
3219                                 return log_unit_error_errno(unit, r, "Failed to determine SELinux context: %m");
3220                         }
3221                 }
3222 #endif
3223
3224                 if (context->private_users) {
3225                         r = setup_private_users(uid, gid);
3226                         if (r < 0) {
3227                                 *exit_status = EXIT_USER;
3228                                 return log_unit_error_errno(unit, r, "Failed to set up user namespacing: %m");
3229                         }
3230                 }
3231         }
3232
3233         /* We repeat the fd closing here, to make sure that nothing is leaked from the PAM modules. Note that we are
3234          * more aggressive this time since socket_fd and the netns fds we don't need anymore. We do keep the exec_fd
3235          * however if we have it as we want to keep it open until the final execve(). */
3236
3237         if (params->exec_fd >= 0) {
3238                 exec_fd = params->exec_fd;
3239
3240                 if (exec_fd < 3 + (int) n_fds) {
3241                         int moved_fd;
3242
3243                         /* Let's move the exec fd far up, so that it's outside of the fd range we want to pass to the
3244                          * process we are about to execute. */
3245
3246                         moved_fd = fcntl(exec_fd, F_DUPFD_CLOEXEC, 3 + (int) n_fds);
3247                         if (moved_fd < 0) {
3248                                 *exit_status = EXIT_FDS;
3249                                 return log_unit_error_errno(unit, errno, "Couldn't move exec fd up: %m");
3250                         }
3251
3252                         safe_close(exec_fd);
3253                         exec_fd = moved_fd;
3254                 } else {
3255                         /* This fd should be FD_CLOEXEC already, but let's make sure. */
3256                         r = fd_cloexec(exec_fd, true);
3257                         if (r < 0) {
3258                                 *exit_status = EXIT_FDS;
3259                                 return log_unit_error_errno(unit, r, "Failed to make exec fd FD_CLOEXEC: %m");
3260                         }
3261                 }
3262
3263                 fds_with_exec_fd = newa(int, n_fds + 1);
3264                 memcpy_safe(fds_with_exec_fd, fds, n_fds * sizeof(int));
3265                 fds_with_exec_fd[n_fds] = exec_fd;
3266                 n_fds_with_exec_fd = n_fds + 1;
3267         } else {
3268                 fds_with_exec_fd = fds;
3269                 n_fds_with_exec_fd = n_fds;
3270         }
3271
3272         r = close_all_fds(fds_with_exec_fd, n_fds_with_exec_fd);
3273         if (r >= 0)
3274                 r = shift_fds(fds, n_fds);
3275         if (r >= 0)
3276                 r = flags_fds(fds, n_socket_fds, n_storage_fds, context->non_blocking);
3277         if (r < 0) {
3278                 *exit_status = EXIT_FDS;
3279                 return log_unit_error_errno(unit, r, "Failed to adjust passed file descriptors: %m");
3280         }
3281
3282         /* At this point, the fds we want to pass to the program are all ready and set up, with O_CLOEXEC turned off
3283          * and at the right fd numbers. The are no other fds open, with one exception: the exec_fd if it is defined,
3284          * and it has O_CLOEXEC set, after all we want it to be closed by the execve(), so that our parent knows we
3285          * came this far. */
3286
3287         secure_bits = context->secure_bits;
3288
3289         if (needs_sandboxing) {
3290                 uint64_t bset;
3291                 int which_failed;
3292
3293                 r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
3294                 if (r < 0) {
3295                         *exit_status = EXIT_LIMITS;
3296                         return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
3297                 }
3298
3299                 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. */
3300                 if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
3301                         if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
3302                                 *exit_status = EXIT_LIMITS;
3303                                 return log_unit_error_errno(unit, errno, "Failed to adjust RLIMIT_RTPRIO resource limit: %m");
3304                         }
3305                 }
3306
3307 #if ENABLE_SMACK
3308                 /* LSM Smack needs the capability CAP_MAC_ADMIN to change the current execution security context of the
3309                  * process. This is the latest place before dropping capabilities. Other MAC context are set later. */
3310                 if (use_smack) {
3311                         r = setup_smack(context, command);
3312                         if (r < 0) {
3313                                 *exit_status = EXIT_SMACK_PROCESS_LABEL;
3314                                 return log_unit_error_errno(unit, r, "Failed to set SMACK process label: %m");
3315                         }
3316                 }
3317 #endif
3318
3319                 bset = context->capability_bounding_set;
3320                 /* If the ambient caps hack is enabled (which means the kernel can't do them, and the user asked for
3321                  * our magic fallback), then let's add some extra caps, so that the service can drop privs of its own,
3322                  * instead of us doing that */
3323                 if (needs_ambient_hack)
3324                         bset |= (UINT64_C(1) << CAP_SETPCAP) |
3325                                 (UINT64_C(1) << CAP_SETUID) |
3326                                 (UINT64_C(1) << CAP_SETGID);
3327
3328                 if (!cap_test_all(bset)) {
3329                         r = capability_bounding_set_drop(bset, false);
3330                         if (r < 0) {
3331                                 *exit_status = EXIT_CAPABILITIES;
3332                                 return log_unit_error_errno(unit, r, "Failed to drop capabilities: %m");
3333                         }
3334                 }
3335
3336                 /* This is done before enforce_user, but ambient set
3337                  * does not survive over setresuid() if keep_caps is not set. */
3338                 if (!needs_ambient_hack &&
3339                     context->capability_ambient_set != 0) {
3340                         r = capability_ambient_set_apply(context->capability_ambient_set, true);
3341                         if (r < 0) {
3342                                 *exit_status = EXIT_CAPABILITIES;
3343                                 return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (before UID change): %m");
3344                         }
3345                 }
3346         }
3347
3348         if (needs_setuid) {
3349                 if (context->user) {
3350                         r = enforce_user(context, uid);
3351                         if (r < 0) {
3352                                 *exit_status = EXIT_USER;
3353                                 return log_unit_error_errno(unit, r, "Failed to change UID to " UID_FMT ": %m", uid);
3354                         }
3355
3356                         if (!needs_ambient_hack &&
3357                             context->capability_ambient_set != 0) {
3358
3359                                 /* Fix the ambient capabilities after user change. */
3360                                 r = capability_ambient_set_apply(context->capability_ambient_set, false);
3361                                 if (r < 0) {
3362                                         *exit_status = EXIT_CAPABILITIES;
3363                                         return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (after UID change): %m");
3364                                 }
3365
3366                                 /* If we were asked to change user and ambient capabilities
3367                                  * were requested, we had to add keep-caps to the securebits
3368                                  * so that we would maintain the inherited capability set
3369                                  * through the setresuid(). Make sure that the bit is added
3370                                  * also to the context secure_bits so that we don't try to
3371                                  * drop the bit away next. */
3372
3373                                 secure_bits |= 1<<SECURE_KEEP_CAPS;
3374                         }
3375                 }
3376         }
3377
3378         if (needs_sandboxing) {
3379                 /* Apply other MAC contexts late, but before seccomp syscall filtering, as those should really be last to
3380                  * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires
3381                  * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls
3382                  * are restricted. */
3383
3384 #if HAVE_SELINUX
3385                 if (use_selinux) {
3386                         char *exec_context = mac_selinux_context_net ?: context->selinux_context;
3387
3388                         if (exec_context) {
3389                                 r = setexeccon(exec_context);
3390                                 if (r < 0) {
3391                                         *exit_status = EXIT_SELINUX_CONTEXT;
3392                                         return log_unit_error_errno(unit, r, "Failed to change SELinux context to %s: %m", exec_context);
3393                                 }
3394                         }
3395                 }
3396 #endif
3397
3398 #if HAVE_APPARMOR
3399                 if (use_apparmor && context->apparmor_profile) {
3400                         r = aa_change_onexec(context->apparmor_profile);
3401                         if (r < 0 && !context->apparmor_profile_ignore) {
3402                                 *exit_status = EXIT_APPARMOR_PROFILE;
3403                                 return log_unit_error_errno(unit, errno, "Failed to prepare AppArmor profile change to %s: %m", context->apparmor_profile);
3404                         }
3405                 }
3406 #endif
3407
3408                 /* PR_GET_SECUREBITS is not privileged, while PR_SET_SECUREBITS is. So to suppress potential EPERMs
3409                  * we'll try not to call PR_SET_SECUREBITS unless necessary. */
3410                 if (prctl(PR_GET_SECUREBITS) != secure_bits)
3411                         if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) {
3412                                 *exit_status = EXIT_SECUREBITS;
3413                                 return log_unit_error_errno(unit, errno, "Failed to set process secure bits: %m");
3414                         }
3415
3416                 if (context_has_no_new_privileges(context))
3417                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
3418                                 *exit_status = EXIT_NO_NEW_PRIVILEGES;
3419                                 return log_unit_error_errno(unit, errno, "Failed to disable new privileges: %m");
3420                         }
3421
3422 #if HAVE_SECCOMP
3423                 r = apply_address_families(unit, context);
3424                 if (r < 0) {
3425                         *exit_status = EXIT_ADDRESS_FAMILIES;
3426                         return log_unit_error_errno(unit, r, "Failed to restrict address families: %m");
3427                 }
3428
3429                 r = apply_memory_deny_write_execute(unit, context);
3430                 if (r < 0) {
3431                         *exit_status = EXIT_SECCOMP;
3432                         return log_unit_error_errno(unit, r, "Failed to disable writing to executable memory: %m");
3433                 }
3434
3435                 r = apply_restrict_realtime(unit, context);
3436                 if (r < 0) {
3437                         *exit_status = EXIT_SECCOMP;
3438                         return log_unit_error_errno(unit, r, "Failed to apply realtime restrictions: %m");
3439                 }
3440
3441                 r = apply_restrict_namespaces(unit, context);
3442                 if (r < 0) {
3443                         *exit_status = EXIT_SECCOMP;
3444                         return log_unit_error_errno(unit, r, "Failed to apply namespace restrictions: %m");
3445                 }
3446
3447                 r = apply_protect_sysctl(unit, context);
3448                 if (r < 0) {
3449                         *exit_status = EXIT_SECCOMP;
3450                         return log_unit_error_errno(unit, r, "Failed to apply sysctl restrictions: %m");
3451                 }
3452
3453                 r = apply_protect_kernel_modules(unit, context);
3454                 if (r < 0) {
3455                         *exit_status = EXIT_SECCOMP;
3456                         return log_unit_error_errno(unit, r, "Failed to apply module loading restrictions: %m");
3457                 }
3458
3459                 r = apply_private_devices(unit, context);
3460                 if (r < 0) {
3461                         *exit_status = EXIT_SECCOMP;
3462                         return log_unit_error_errno(unit, r, "Failed to set up private devices: %m");
3463                 }
3464
3465                 r = apply_syscall_archs(unit, context);
3466                 if (r < 0) {
3467                         *exit_status = EXIT_SECCOMP;
3468                         return log_unit_error_errno(unit, r, "Failed to apply syscall architecture restrictions: %m");
3469                 }
3470
3471                 r = apply_lock_personality(unit, context);
3472                 if (r < 0) {
3473                         *exit_status = EXIT_SECCOMP;
3474                         return log_unit_error_errno(unit, r, "Failed to lock personalities: %m");
3475                 }
3476
3477                 /* This really should remain the last step before the execve(), to make sure our own code is unaffected
3478                  * by the filter as little as possible. */
3479                 r = apply_syscall_filter(unit, context, needs_ambient_hack);
3480                 if (r < 0) {
3481                         *exit_status = EXIT_SECCOMP;
3482                         return log_unit_error_errno(unit, r, "Failed to apply system call filters: %m");
3483                 }
3484 #endif
3485         }
3486
3487         if (!strv_isempty(context->unset_environment)) {
3488                 char **ee = NULL;
3489
3490                 ee = strv_env_delete(accum_env, 1, context->unset_environment);
3491                 if (!ee) {
3492                         *exit_status = EXIT_MEMORY;
3493                         return log_oom();
3494                 }
3495
3496                 strv_free_and_replace(accum_env, ee);
3497         }
3498
3499         final_argv = replace_env_argv(command->argv, accum_env);
3500         if (!final_argv) {
3501                 *exit_status = EXIT_MEMORY;
3502                 return log_oom();
3503         }
3504
3505         if (DEBUG_LOGGING) {
3506                 _cleanup_free_ char *line;
3507
3508                 line = exec_command_line(final_argv);
3509                 if (line)
3510                         log_struct(LOG_DEBUG,
3511                                    "EXECUTABLE=%s", command->path,
3512                                    LOG_UNIT_MESSAGE(unit, "Executing: %s", line),
3513                                    LOG_UNIT_ID(unit),
3514                                    LOG_UNIT_INVOCATION_ID(unit));
3515         }
3516
3517         if (exec_fd >= 0) {
3518                 uint8_t hot = 1;
3519
3520                 /* We have finished with all our initializations. Let's now let the manager know that. From this point
3521                  * on, if the manager sees POLLHUP on the exec_fd, then execve() was successful. */
3522
3523                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
3524                         *exit_status = EXIT_EXEC;
3525                         return log_unit_error_errno(unit, errno, "Failed to enable exec_fd: %m");
3526                 }
3527         }
3528
3529         execve(command->path, final_argv, accum_env);
3530         r = -errno;
3531
3532         if (exec_fd >= 0) {
3533                 uint8_t hot = 0;
3534
3535                 /* The execve() failed. This means the exec_fd is still open. Which means we need to tell the manager
3536                  * that POLLHUP on it no longer means execve() succeeded. */
3537
3538                 if (write(exec_fd, &hot, sizeof(hot)) < 0) {
3539                         *exit_status = EXIT_EXEC;
3540                         return log_unit_error_errno(unit, errno, "Failed to disable exec_fd: %m");
3541                 }
3542         }
3543
3544         if (r == -ENOENT && (command->flags & EXEC_COMMAND_IGNORE_FAILURE)) {
3545                 log_struct_errno(LOG_INFO, r,
3546                                  "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
3547                                  LOG_UNIT_ID(unit),
3548                                  LOG_UNIT_INVOCATION_ID(unit),
3549                                  LOG_UNIT_MESSAGE(unit, "Executable %s missing, skipping: %m",
3550                                                   command->path),
3551                                  "EXECUTABLE=%s", command->path);
3552                 return 0;
3553         }
3554
3555         *exit_status = EXIT_EXEC;
3556         return log_unit_error_errno(unit, r, "Failed to execute command: %m");
3557 }
3558
3559 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l);
3560 static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[3]);
3561
3562 int exec_spawn(Unit *unit,
3563                ExecCommand *command,
3564                const ExecContext *context,
3565                const ExecParameters *params,
3566                ExecRuntime *runtime,
3567                DynamicCreds *dcreds,
3568                pid_t *ret) {
3569
3570         int socket_fd, r, named_iofds[3] = { -1, -1, -1 }, *fds = NULL;
3571         _cleanup_strv_free_ char **files_env = NULL;
3572         size_t n_storage_fds = 0, n_socket_fds = 0;
3573         _cleanup_free_ char *line = NULL;
3574         pid_t pid;
3575
3576         assert(unit);
3577         assert(command);
3578         assert(context);
3579         assert(ret);
3580         assert(params);
3581         assert(params->fds || (params->n_socket_fds + params->n_storage_fds <= 0));
3582
3583         if (context->std_input == EXEC_INPUT_SOCKET ||
3584             context->std_output == EXEC_OUTPUT_SOCKET ||
3585             context->std_error == EXEC_OUTPUT_SOCKET) {
3586
3587                 if (params->n_socket_fds > 1) {
3588                         log_unit_error(unit, "Got more than one socket.");
3589                         return -EINVAL;
3590                 }
3591
3592                 if (params->n_socket_fds == 0) {
3593                         log_unit_error(unit, "Got no socket.");
3594                         return -EINVAL;
3595                 }
3596
3597                 socket_fd = params->fds[0];
3598         } else {
3599                 socket_fd = -1;
3600                 fds = params->fds;
3601                 n_socket_fds = params->n_socket_fds;
3602                 n_storage_fds = params->n_storage_fds;
3603         }
3604
3605         r = exec_context_named_iofds(context, params, named_iofds);
3606         if (r < 0)
3607                 return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m");
3608
3609         r = exec_context_load_environment(unit, context, &files_env);
3610         if (r < 0)
3611                 return log_unit_error_errno(unit, r, "Failed to load environment files: %m");
3612
3613         line = exec_command_line(command->argv);
3614         if (!line)
3615                 return log_oom();
3616
3617         log_struct(LOG_DEBUG,
3618                    LOG_UNIT_MESSAGE(unit, "About to execute: %s", line),
3619                    "EXECUTABLE=%s", command->path,
3620                    LOG_UNIT_ID(unit),
3621                    LOG_UNIT_INVOCATION_ID(unit));
3622
3623         pid = fork();
3624         if (pid < 0)
3625                 return log_unit_error_errno(unit, errno, "Failed to fork: %m");
3626
3627         if (pid == 0) {
3628                 int exit_status = EXIT_SUCCESS;
3629
3630                 r = exec_child(unit,
3631                                command,
3632                                context,
3633                                params,
3634                                runtime,
3635                                dcreds,
3636                                socket_fd,
3637                                named_iofds,
3638                                fds,
3639                                n_socket_fds,
3640                                n_storage_fds,
3641                                files_env,
3642                                unit->manager->user_lookup_fds[1],
3643                                &exit_status);
3644
3645                 if (r < 0)
3646                         log_struct_errno(LOG_ERR, r,
3647                                          "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR,
3648                                          LOG_UNIT_ID(unit),
3649                                          LOG_UNIT_INVOCATION_ID(unit),
3650                                          LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m",
3651                                                           exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
3652                                                           command->path),
3653                                          "EXECUTABLE=%s", command->path);
3654
3655                 _exit(exit_status);
3656         }
3657
3658         log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);
3659
3660         /* We add the new process to the cgroup both in the child (so
3661          * that we can be sure that no user code is ever executed
3662          * outside of the cgroup) and in the parent (so that we can be
3663          * sure that when we kill the cgroup the process will be
3664          * killed too). */
3665         if (params->cgroup_path)
3666                 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
3667
3668         exec_status_start(&command->exec_status, pid);
3669
3670         *ret = pid;
3671         return 0;
3672 }
3673
3674 void exec_context_init(ExecContext *c) {
3675         ExecDirectoryType i;
3676
3677         assert(c);
3678
3679         c->umask = 0022;
3680         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
3681         c->cpu_sched_policy = SCHED_OTHER;
3682         c->syslog_priority = LOG_DAEMON|LOG_INFO;
3683         c->syslog_level_prefix = true;
3684         c->ignore_sigpipe = true;
3685         c->timer_slack_nsec = NSEC_INFINITY;
3686         c->personality = PERSONALITY_INVALID;
3687         for (i = 0; i < _EXEC_DIRECTORY_TYPE_MAX; i++)
3688                 c->directories[i].mode = 0755;
3689         c->capability_bounding_set = CAP_ALL;
3690         assert_cc(NAMESPACE_FLAGS_INITIAL != NAMESPACE_FLAGS_ALL);
3691         c->restrict_namespaces = NAMESPACE_FLAGS_INITIAL;
3692         c->log_level_max = -1;
3693 }
3694
3695 void exec_context_done(ExecContext *c) {
3696         ExecDirectoryType i;
3697         size_t l;
3698
3699         assert(c);
3700
3701         c->environment = strv_free(c->environment);
3702         c->environment_files = strv_free(c->environment_files);
3703         c->pass_environment = strv_free(c->pass_environment);
3704         c->unset_environment = strv_free(c->unset_environment);
3705
3706         rlimit_free_all(c->rlimit);
3707
3708         for (l = 0; l < 3; l++) {
3709                 c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);
3710                 c->stdio_file[l] = mfree(c->stdio_file[l]);
3711         }
3712
3713         c->working_directory = mfree(c->working_directory);
3714         c->root_directory = mfree(c->root_directory);
3715         c->root_image = mfree(c->root_image);
3716         c->tty_path = mfree(c->tty_path);
3717         c->syslog_identifier = mfree(c->syslog_identifier);
3718         c->user = mfree(c->user);
3719         c->group = mfree(c->group);
3720
3721         c->supplementary_groups = strv_free(c->supplementary_groups);
3722
3723         c->pam_name = mfree(c->pam_name);
3724
3725         c->read_only_paths = strv_free(c->read_only_paths);
3726         c->read_write_paths = strv_free(c->read_write_paths);
3727         c->inaccessible_paths = strv_free(c->inaccessible_paths);
3728
3729         bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
3730         c->bind_mounts = NULL;
3731         c->n_bind_mounts = 0;
3732         temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);
3733         c->temporary_filesystems = NULL;
3734         c->n_temporary_filesystems = 0;
3735
3736         c->cpuset = cpu_set_mfree(c->cpuset);
3737
3738         c->utmp_id = mfree(c->utmp_id);
3739         c->selinux_context = mfree(c->selinux_context);
3740         c->apparmor_profile = mfree(c->apparmor_profile);
3741         c->smack_process_label = mfree(c->smack_process_label);
3742
3743         c->syscall_filter = hashmap_free(c->syscall_filter);
3744         c->syscall_archs = set_free(c->syscall_archs);
3745         c->address_families = set_free(c->address_families);
3746
3747         for (i = 0; i < _EXEC_DIRECTORY_TYPE_MAX; i++)
3748                 c->directories[i].paths = strv_free(c->directories[i].paths);
3749
3750         c->log_level_max = -1;
3751
3752         exec_context_free_log_extra_fields(c);
3753
3754         c->log_rate_limit_interval_usec = 0;
3755         c->log_rate_limit_burst = 0;
3756
3757         c->stdin_data = mfree(c->stdin_data);
3758         c->stdin_data_size = 0;
3759 }
3760
3761 int exec_context_destroy_runtime_directory(const ExecContext *c, const char *runtime_prefix) {
3762         char **i;
3763
3764         assert(c);
3765
3766         if (!runtime_prefix)
3767                 return 0;
3768
3769         STRV_FOREACH(i, c->directories[EXEC_DIRECTORY_RUNTIME].paths) {
3770                 _cleanup_free_ char *p;
3771
3772                 p = strjoin(runtime_prefix, "/", *i);
3773                 if (!p)
3774                         return -ENOMEM;
3775
3776                 /* We execute this synchronously, since we need to be sure this is gone when we start the service
3777                  * next. */
3778                 (void) rm_rf(p, REMOVE_ROOT);
3779         }
3780
3781         return 0;
3782 }
3783
3784 static void exec_command_done(ExecCommand *c) {
3785         assert(c);
3786
3787         c->path = mfree(c->path);
3788         c->argv = strv_free(c->argv);
3789 }
3790
3791 void exec_command_done_array(ExecCommand *c, size_t n) {
3792         size_t i;
3793
3794         for (i = 0; i < n; i++)
3795                 exec_command_done(c+i);
3796 }
3797
3798 ExecCommand* exec_command_free_list(ExecCommand *c) {
3799         ExecCommand *i;
3800
3801         while ((i = c)) {
3802                 LIST_REMOVE(command, c, i);
3803                 exec_command_done(i);
3804                 free(i);
3805         }
3806
3807         return NULL;
3808 }
3809
3810 void exec_command_free_array(ExecCommand **c, size_t n) {
3811         size_t i;
3812
3813         for (i = 0; i < n; i++)
3814                 c[i] = exec_command_free_list(c[i]);
3815 }
3816
3817 void exec_command_reset_status_array(ExecCommand *c, size_t n) {
3818         size_t i;
3819
3820         for (i = 0; i < n; i++)
3821                 exec_status_reset(&c[i].exec_status);
3822 }
3823
3824 void exec_command_reset_status_list_array(ExecCommand **c, size_t n) {
3825         size_t i;
3826
3827         for (i = 0; i < n; i++) {
3828                 ExecCommand *z;
3829
3830                 LIST_FOREACH(command, z, c[i])
3831                         exec_status_reset(&z->exec_status);
3832         }
3833 }
3834
3835 typedef struct InvalidEnvInfo {
3836         const Unit *unit;
3837         const char *path;
3838 } InvalidEnvInfo;
3839
3840 static void invalid_env(const char *p, void *userdata) {
3841         InvalidEnvInfo *info = userdata;
3842
3843         log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);
3844 }
3845
3846 const char* exec_context_fdname(const ExecContext *c, int fd_index) {
3847         assert(c);
3848
3849         switch (fd_index) {
3850
3851         case STDIN_FILENO:
3852                 if (c->std_input != EXEC_INPUT_NAMED_FD)
3853                         return NULL;
3854
3855                 return c->stdio_fdname[STDIN_FILENO] ?: "stdin";
3856
3857         case STDOUT_FILENO:
3858                 if (c->std_output != EXEC_OUTPUT_NAMED_FD)
3859                         return NULL;
3860
3861                 return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";
3862
3863         case STDERR_FILENO:
3864                 if (c->std_error != EXEC_OUTPUT_NAMED_FD)
3865                         return NULL;
3866
3867                 return c->stdio_fdname[STDERR_FILENO] ?: "stderr";
3868
3869         default:
3870                 return NULL;
3871         }
3872 }
3873
3874 static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[3]) {
3875         size_t i, targets;
3876         const char* stdio_fdname[3];
3877         size_t n_fds;
3878
3879         assert(c);
3880         assert(p);
3881
3882         targets = (c->std_input == EXEC_INPUT_NAMED_FD) +
3883                   (c->std_output == EXEC_OUTPUT_NAMED_FD) +
3884                   (c->std_error == EXEC_OUTPUT_NAMED_FD);
3885
3886         for (i = 0; i < 3; i++)
3887                 stdio_fdname[i] = exec_context_fdname(c, i);
3888
3889         n_fds = p->n_storage_fds + p->n_socket_fds;
3890
3891         for (i = 0; i < n_fds  && targets > 0; i++)
3892                 if (named_iofds[STDIN_FILENO] < 0 &&
3893                     c->std_input == EXEC_INPUT_NAMED_FD &&
3894                     stdio_fdname[STDIN_FILENO] &&
3895                     streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) {
3896
3897                         named_iofds[STDIN_FILENO] = p->fds[i];
3898                         targets--;
3899
3900                 } else if (named_iofds[STDOUT_FILENO] < 0 &&
3901                            c->std_output == EXEC_OUTPUT_NAMED_FD &&
3902                            stdio_fdname[STDOUT_FILENO] &&
3903                            streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) {
3904
3905                         named_iofds[STDOUT_FILENO] = p->fds[i];
3906                         targets--;
3907
3908                 } else if (named_iofds[STDERR_FILENO] < 0 &&
3909                            c->std_error == EXEC_OUTPUT_NAMED_FD &&
3910                            stdio_fdname[STDERR_FILENO] &&
3911                            streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) {
3912
3913                         named_iofds[STDERR_FILENO] = p->fds[i];
3914                         targets--;
3915                 }
3916
3917         return targets == 0 ? 0 : -ENOENT;
3918 }
3919
3920 static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l) {
3921         char **i, **r = NULL;
3922
3923         assert(c);
3924         assert(l);
3925
3926         STRV_FOREACH(i, c->environment_files) {
3927                 char *fn;
3928                 int k;
3929                 unsigned n;
3930                 bool ignore = false;
3931                 char **p;
3932                 _cleanup_globfree_ glob_t pglob = {};
3933
3934                 fn = *i;
3935
3936                 if (fn[0] == '-') {
3937                         ignore = true;
3938                         fn++;
3939                 }
3940
3941                 if (!path_is_absolute(fn)) {
3942                         if (ignore)
3943                                 continue;
3944
3945                         strv_free(r);
3946                         return -EINVAL;
3947                 }
3948
3949                 /* Filename supports globbing, take all matching files */
3950                 k = safe_glob(fn, 0, &pglob);
3951                 if (k < 0) {
3952                         if (ignore)
3953                                 continue;
3954
3955                         strv_free(r);
3956                         return k;
3957                 }
3958
3959                 /* When we don't match anything, -ENOENT should be returned */
3960                 assert(pglob.gl_pathc > 0);
3961
3962                 for (n = 0; n < pglob.gl_pathc; n++) {
3963                         k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
3964                         if (k < 0) {
3965                                 if (ignore)
3966                                         continue;
3967
3968                                 strv_free(r);
3969                                 return k;
3970                         }
3971                         /* Log invalid environment variables with filename */
3972                         if (p) {
3973                                 InvalidEnvInfo info = {
3974                                         .unit = unit,
3975                                         .path = pglob.gl_pathv[n]
3976                                 };
3977
3978                                 p = strv_env_clean_with_callback(p, invalid_env, &info);
3979                         }
3980
3981                         if (!r)
3982                                 r = p;
3983                         else {
3984                                 char **m;
3985
3986                                 m = strv_env_merge(2, r, p);
3987                                 strv_free(r);
3988                                 strv_free(p);
3989                                 if (!m)
3990                                         return -ENOMEM;
3991
3992                                 r = m;
3993                         }
3994                 }
3995         }
3996
3997         *l = r;
3998
3999         return 0;
4000 }
4001
4002 static bool tty_may_match_dev_console(const char *tty) {
4003         _cleanup_free_ char *resolved = NULL;
4004
4005         if (!tty)
4006                 return true;
4007
4008         tty = skip_dev_prefix(tty);
4009
4010         /* trivial identity? */
4011         if (streq(tty, "console"))
4012                 return true;
4013
4014         if (resolve_dev_console(&resolved) < 0)
4015                 return true; /* if we could not resolve, assume it may */
4016
4017         /* "tty0" means the active VC, so it may be the same sometimes */
4018         return streq(resolved, tty) || (streq(resolved, "tty0") && tty_is_vc(tty));
4019 }
4020
4021 bool exec_context_may_touch_console(const ExecContext *ec) {
4022
4023         return (ec->tty_reset ||
4024                 ec->tty_vhangup ||
4025                 ec->tty_vt_disallocate ||
4026                 is_terminal_input(ec->std_input) ||
4027                 is_terminal_output(ec->std_output) ||
4028                 is_terminal_output(ec->std_error)) &&
4029                tty_may_match_dev_console(exec_context_tty_path(ec));
4030 }
4031
4032 static void strv_fprintf(FILE *f, char **l) {
4033         char **g;
4034
4035         assert(f);
4036
4037         STRV_FOREACH(g, l)
4038                 fprintf(f, " %s", *g);
4039 }
4040
4041 void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
4042         ExecDirectoryType dt;
4043         char **e, **d;
4044         unsigned i;
4045         int r;
4046
4047         assert(c);
4048         assert(f);
4049
4050         prefix = strempty(prefix);
4051
4052         fprintf(f,
4053                 "%sUMask: %04o\n"
4054                 "%sWorkingDirectory: %s\n"
4055                 "%sRootDirectory: %s\n"
4056                 "%sNonBlocking: %s\n"
4057                 "%sPrivateTmp: %s\n"
4058                 "%sPrivateDevices: %s\n"
4059                 "%sProtectKernelTunables: %s\n"
4060                 "%sProtectKernelModules: %s\n"
4061                 "%sProtectControlGroups: %s\n"
4062                 "%sPrivateNetwork: %s\n"
4063                 "%sPrivateUsers: %s\n"
4064                 "%sProtectHome: %s\n"
4065                 "%sProtectSystem: %s\n"
4066                 "%sMountAPIVFS: %s\n"
4067                 "%sIgnoreSIGPIPE: %s\n"
4068                 "%sMemoryDenyWriteExecute: %s\n"
4069                 "%sRestrictRealtime: %s\n"
4070                 "%sKeyringMode: %s\n",
4071                 prefix, c->umask,
4072                 prefix, c->working_directory ? c->working_directory : "/",
4073                 prefix, c->root_directory ? c->root_directory : "/",
4074                 prefix, yes_no(c->non_blocking),
4075                 prefix, yes_no(c->private_tmp),
4076                 prefix, yes_no(c->private_devices),
4077                 prefix, yes_no(c->protect_kernel_tunables),
4078                 prefix, yes_no(c->protect_kernel_modules),
4079                 prefix, yes_no(c->protect_control_groups),
4080                 prefix, yes_no(c->private_network),
4081                 prefix, yes_no(c->private_users),
4082                 prefix, protect_home_to_string(c->protect_home),
4083                 prefix, protect_system_to_string(c->protect_system),
4084                 prefix, yes_no(c->mount_apivfs),
4085                 prefix, yes_no(c->ignore_sigpipe),
4086                 prefix, yes_no(c->memory_deny_write_execute),
4087                 prefix, yes_no(c->restrict_realtime),
4088                 prefix, exec_keyring_mode_to_string(c->keyring_mode));
4089
4090         if (c->root_image)
4091                 fprintf(f, "%sRootImage: %s\n", prefix, c->root_image);
4092
4093         STRV_FOREACH(e, c->environment)
4094                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
4095
4096         STRV_FOREACH(e, c->environment_files)
4097                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
4098
4099         STRV_FOREACH(e, c->pass_environment)
4100                 fprintf(f, "%sPassEnvironment: %s\n", prefix, *e);
4101
4102         STRV_FOREACH(e, c->unset_environment)
4103                 fprintf(f, "%sUnsetEnvironment: %s\n", prefix, *e);
4104
4105         fprintf(f, "%sRuntimeDirectoryPreserve: %s\n", prefix, exec_preserve_mode_to_string(c->runtime_directory_preserve_mode));
4106
4107         for (dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) {
4108                 fprintf(f, "%s%sMode: %04o\n", prefix, exec_directory_type_to_string(dt), c->directories[dt].mode);
4109
4110                 STRV_FOREACH(d, c->directories[dt].paths)
4111                         fprintf(f, "%s%s: %s\n", prefix, exec_directory_type_to_string(dt), *d);
4112         }
4113
4114         if (c->nice_set)
4115                 fprintf(f,
4116                         "%sNice: %i\n",
4117                         prefix, c->nice);
4118
4119         if (c->oom_score_adjust_set)
4120                 fprintf(f,
4121                         "%sOOMScoreAdjust: %i\n",
4122                         prefix, c->oom_score_adjust);
4123
4124         for (i = 0; i < RLIM_NLIMITS; i++)
4125                 if (c->rlimit[i]) {
4126                         fprintf(f, "%sLimit%s: " RLIM_FMT "\n",
4127                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
4128                         fprintf(f, "%sLimit%sSoft: " RLIM_FMT "\n",
4129                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_cur);
4130                 }
4131
4132         if (c->ioprio_set) {
4133                 _cleanup_free_ char *class_str = NULL;
4134
4135                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
4136                 if (r >= 0)
4137                         fprintf(f, "%sIOSchedulingClass: %s\n", prefix, class_str);
4138
4139                 fprintf(f, "%sIOPriority: %lu\n", prefix, IOPRIO_PRIO_DATA(c->ioprio));
4140         }
4141
4142         if (c->cpu_sched_set) {
4143                 _cleanup_free_ char *policy_str = NULL;
4144
4145                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
4146                 if (r >= 0)
4147                         fprintf(f, "%sCPUSchedulingPolicy: %s\n", prefix, policy_str);
4148
4149                 fprintf(f,
4150                         "%sCPUSchedulingPriority: %i\n"
4151                         "%sCPUSchedulingResetOnFork: %s\n",
4152                         prefix, c->cpu_sched_priority,
4153                         prefix, yes_no(c->cpu_sched_reset_on_fork));
4154         }
4155
4156         if (c->cpuset) {
4157                 fprintf(f, "%sCPUAffinity:", prefix);
4158                 for (i = 0; i < c->cpuset_ncpus; i++)
4159                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
4160                                 fprintf(f, " %u", i);
4161                 fputs("\n", f);
4162         }
4163
4164         if (c->timer_slack_nsec != NSEC_INFINITY)
4165                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
4166
4167         fprintf(f,
4168                 "%sStandardInput: %s\n"
4169                 "%sStandardOutput: %s\n"
4170                 "%sStandardError: %s\n",
4171                 prefix, exec_input_to_string(c->std_input),
4172                 prefix, exec_output_to_string(c->std_output),
4173                 prefix, exec_output_to_string(c->std_error));
4174
4175         if (c->std_input == EXEC_INPUT_NAMED_FD)
4176                 fprintf(f, "%sStandardInputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDIN_FILENO]);
4177         if (c->std_output == EXEC_OUTPUT_NAMED_FD)
4178                 fprintf(f, "%sStandardOutputFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDOUT_FILENO]);
4179         if (c->std_error == EXEC_OUTPUT_NAMED_FD)
4180                 fprintf(f, "%sStandardErrorFileDescriptorName: %s\n", prefix, c->stdio_fdname[STDERR_FILENO]);
4181
4182         if (c->std_input == EXEC_INPUT_FILE)
4183                 fprintf(f, "%sStandardInputFile: %s\n", prefix, c->stdio_file[STDIN_FILENO]);
4184         if (c->std_output == EXEC_OUTPUT_FILE)
4185                 fprintf(f, "%sStandardOutputFile: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
4186         if (c->std_output == EXEC_OUTPUT_FILE_APPEND)
4187                 fprintf(f, "%sStandardOutputFileToAppend: %s\n", prefix, c->stdio_file[STDOUT_FILENO]);
4188         if (c->std_error == EXEC_OUTPUT_FILE)
4189                 fprintf(f, "%sStandardErrorFile: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
4190         if (c->std_error == EXEC_OUTPUT_FILE_APPEND)
4191                 fprintf(f, "%sStandardErrorFileToAppend: %s\n", prefix, c->stdio_file[STDERR_FILENO]);
4192
4193         if (c->tty_path)
4194                 fprintf(f,
4195                         "%sTTYPath: %s\n"
4196                         "%sTTYReset: %s\n"
4197                         "%sTTYVHangup: %s\n"
4198                         "%sTTYVTDisallocate: %s\n",
4199                         prefix, c->tty_path,
4200                         prefix, yes_no(c->tty_reset),
4201                         prefix, yes_no(c->tty_vhangup),
4202                         prefix, yes_no(c->tty_vt_disallocate));
4203
4204         if (IN_SET(c->std_output,
4205                    EXEC_OUTPUT_SYSLOG,
4206                    EXEC_OUTPUT_KMSG,
4207                    EXEC_OUTPUT_JOURNAL,
4208                    EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
4209                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
4210                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE) ||
4211             IN_SET(c->std_error,
4212                    EXEC_OUTPUT_SYSLOG,
4213                    EXEC_OUTPUT_KMSG,
4214                    EXEC_OUTPUT_JOURNAL,
4215                    EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
4216                    EXEC_OUTPUT_KMSG_AND_CONSOLE,
4217                    EXEC_OUTPUT_JOURNAL_AND_CONSOLE)) {
4218
4219                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
4220
4221                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
4222                 if (r >= 0)
4223                         fprintf(f, "%sSyslogFacility: %s\n", prefix, fac_str);
4224
4225                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
4226                 if (r >= 0)
4227                         fprintf(f, "%sSyslogLevel: %s\n", prefix, lvl_str);
4228         }
4229
4230         if (c->log_level_max >= 0) {
4231                 _cleanup_free_ char *t = NULL;
4232
4233                 (void) log_level_to_string_alloc(c->log_level_max, &t);
4234
4235                 fprintf(f, "%sLogLevelMax: %s\n", prefix, strna(t));
4236         }
4237
4238         if (c->log_rate_limit_interval_usec > 0) {
4239                 char buf_timespan[FORMAT_TIMESPAN_MAX];
4240
4241                 fprintf(f,
4242                         "%sLogRateLimitIntervalSec: %s\n",
4243                         prefix, format_timespan(buf_timespan, sizeof(buf_timespan), c->log_rate_limit_interval_usec, USEC_PER_SEC));
4244         }
4245
4246         if (c->log_rate_limit_burst > 0)
4247                 fprintf(f, "%sLogRateLimitBurst: %u\n", prefix, c->log_rate_limit_burst);
4248
4249         if (c->n_log_extra_fields > 0) {
4250                 size_t j;
4251
4252                 for (j = 0; j < c->n_log_extra_fields; j++) {
4253                         fprintf(f, "%sLogExtraFields: ", prefix);
4254                         fwrite(c->log_extra_fields[j].iov_base,
4255                                1, c->log_extra_fields[j].iov_len,
4256                                f);
4257                         fputc('\n', f);
4258                 }
4259         }
4260
4261         if (c->secure_bits) {
4262                 _cleanup_free_ char *str = NULL;
4263
4264                 r = secure_bits_to_string_alloc(c->secure_bits, &str);
4265                 if (r >= 0)
4266                         fprintf(f, "%sSecure Bits: %s\n", prefix, str);
4267         }
4268
4269         if (c->capability_bounding_set != CAP_ALL) {
4270                 _cleanup_free_ char *str = NULL;
4271
4272                 r = capability_set_to_string_alloc(c->capability_bounding_set, &str);
4273                 if (r >= 0)
4274                         fprintf(f, "%sCapabilityBoundingSet: %s\n", prefix, str);
4275         }
4276
4277         if (c->capability_ambient_set != 0) {
4278                 _cleanup_free_ char *str = NULL;
4279
4280                 r = capability_set_to_string_alloc(c->capability_ambient_set, &str);
4281                 if (r >= 0)
4282                         fprintf(f, "%sAmbientCapabilities: %s\n", prefix, str);
4283         }
4284
4285         if (c->user)
4286                 fprintf(f, "%sUser: %s\n", prefix, c->user);
4287         if (c->group)
4288                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
4289
4290         fprintf(f, "%sDynamicUser: %s\n", prefix, yes_no(c->dynamic_user));
4291
4292         if (!strv_isempty(c->supplementary_groups)) {
4293                 fprintf(f, "%sSupplementaryGroups:", prefix);
4294                 strv_fprintf(f, c->supplementary_groups);
4295                 fputs("\n", f);
4296         }
4297
4298         if (c->pam_name)
4299                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
4300
4301         if (!strv_isempty(c->read_write_paths)) {
4302                 fprintf(f, "%sReadWritePaths:", prefix);
4303                 strv_fprintf(f, c->read_write_paths);
4304                 fputs("\n", f);
4305         }
4306
4307         if (!strv_isempty(c->read_only_paths)) {
4308                 fprintf(f, "%sReadOnlyPaths:", prefix);
4309                 strv_fprintf(f, c->read_only_paths);
4310                 fputs("\n", f);
4311         }
4312
4313         if (!strv_isempty(c->inaccessible_paths)) {
4314                 fprintf(f, "%sInaccessiblePaths:", prefix);
4315                 strv_fprintf(f, c->inaccessible_paths);
4316                 fputs("\n", f);
4317         }
4318
4319         if (c->n_bind_mounts > 0)
4320                 for (i = 0; i < c->n_bind_mounts; i++)
4321                         fprintf(f, "%s%s: %s%s:%s:%s\n", prefix,
4322                                 c->bind_mounts[i].read_only ? "BindReadOnlyPaths" : "BindPaths",
4323                                 c->bind_mounts[i].ignore_enoent ? "-": "",
4324                                 c->bind_mounts[i].source,
4325                                 c->bind_mounts[i].destination,
4326                                 c->bind_mounts[i].recursive ? "rbind" : "norbind");
4327
4328         if (c->n_temporary_filesystems > 0)
4329                 for (i = 0; i < c->n_temporary_filesystems; i++) {
4330                         TemporaryFileSystem *t = c->temporary_filesystems + i;
4331
4332                         fprintf(f, "%sTemporaryFileSystem: %s%s%s\n", prefix,
4333                                 t->path,
4334                                 isempty(t->options) ? "" : ":",
4335                                 strempty(t->options));
4336                 }
4337
4338         if (c->utmp_id)
4339                 fprintf(f,
4340                         "%sUtmpIdentifier: %s\n",
4341                         prefix, c->utmp_id);
4342
4343         if (c->selinux_context)
4344                 fprintf(f,
4345                         "%sSELinuxContext: %s%s\n",
4346                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
4347
4348         if (c->apparmor_profile)
4349                 fprintf(f,
4350                         "%sAppArmorProfile: %s%s\n",
4351                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
4352
4353         if (c->smack_process_label)
4354                 fprintf(f,
4355                         "%sSmackProcessLabel: %s%s\n",
4356                         prefix, c->smack_process_label_ignore ? "-" : "", c->smack_process_label);
4357
4358         if (c->personality != PERSONALITY_INVALID)
4359                 fprintf(f,
4360                         "%sPersonality: %s\n",
4361                         prefix, strna(personality_to_string(c->personality)));
4362
4363         fprintf(f,
4364                 "%sLockPersonality: %s\n",
4365                 prefix, yes_no(c->lock_personality));
4366
4367         if (c->syscall_filter) {
4368 #if HAVE_SECCOMP
4369                 Iterator j;
4370                 void *id, *val;
4371                 bool first = true;
4372 #endif
4373
4374                 fprintf(f,
4375                         "%sSystemCallFilter: ",
4376                         prefix);
4377
4378                 if (!c->syscall_whitelist)
4379                         fputc('~', f);
4380
4381 #if HAVE_SECCOMP
4382                 HASHMAP_FOREACH_KEY(val, id, c->syscall_filter, j) {
4383                         _cleanup_free_ char *name = NULL;
4384                         const char *errno_name = NULL;
4385                         int num = PTR_TO_INT(val);
4386
4387                         if (first)
4388                                 first = false;
4389                         else
4390                                 fputc(' ', f);
4391
4392                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
4393                         fputs(strna(name), f);
4394
4395                         if (num >= 0) {
4396                                 errno_name = errno_to_name(num);
4397                                 if (errno_name)
4398                                         fprintf(f, ":%s", errno_name);
4399                                 else
4400                                         fprintf(f, ":%d", num);
4401                         }
4402                 }
4403 #endif
4404
4405                 fputc('\n', f);
4406         }
4407
4408         if (c->syscall_archs) {
4409 #if HAVE_SECCOMP
4410                 Iterator j;
4411                 void *id;
4412 #endif
4413
4414                 fprintf(f,
4415                         "%sSystemCallArchitectures:",
4416                         prefix);
4417
4418 #if HAVE_SECCOMP
4419                 SET_FOREACH(id, c->syscall_archs, j)
4420                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
4421 #endif
4422                 fputc('\n', f);
4423         }
4424
4425         if (exec_context_restrict_namespaces_set(c)) {
4426                 _cleanup_free_ char *s = NULL;
4427
4428                 r = namespace_flags_to_string(c->restrict_namespaces, &s);
4429                 if (r >= 0)
4430                         fprintf(f, "%sRestrictNamespaces: %s\n",
4431                                 prefix, s);
4432         }
4433
4434         if (c->syscall_errno > 0) {
4435                 const char *errno_name;
4436
4437                 fprintf(f, "%sSystemCallErrorNumber: ", prefix);
4438
4439                 errno_name = errno_to_name(c->syscall_errno);
4440                 if (errno_name)
4441                         fprintf(f, "%s\n", errno_name);
4442                 else
4443                         fprintf(f, "%d\n", c->syscall_errno);
4444         }
4445
4446         if (c->apparmor_profile)
4447                 fprintf(f,
4448                         "%sAppArmorProfile: %s%s\n",
4449                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
4450 }
4451
4452 bool exec_context_maintains_privileges(const ExecContext *c) {
4453         assert(c);
4454
4455         /* Returns true if the process forked off would run under
4456          * an unchanged UID or as root. */
4457
4458         if (!c->user)
4459                 return true;
4460
4461         if (streq(c->user, "root") || streq(c->user, "0"))
4462                 return true;
4463
4464         return false;
4465 }
4466
4467 int exec_context_get_effective_ioprio(const ExecContext *c) {
4468         int p;
4469
4470         assert(c);
4471
4472         if (c->ioprio_set)
4473                 return c->ioprio;
4474
4475         p = ioprio_get(IOPRIO_WHO_PROCESS, 0);
4476         if (p < 0)
4477                 return IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 4);
4478
4479         return p;
4480 }
4481
4482 void exec_context_free_log_extra_fields(ExecContext *c) {
4483         size_t l;
4484
4485         assert(c);
4486
4487         for (l = 0; l < c->n_log_extra_fields; l++)
4488                 free(c->log_extra_fields[l].iov_base);
4489         c->log_extra_fields = mfree(c->log_extra_fields);
4490         c->n_log_extra_fields = 0;
4491 }
4492
4493 void exec_status_start(ExecStatus *s, pid_t pid) {
4494         assert(s);
4495
4496         *s = (ExecStatus) {
4497                 .pid = pid,
4498         };
4499
4500         dual_timestamp_get(&s->start_timestamp);
4501 }
4502
4503 void exec_status_exit(ExecStatus *s, const ExecContext *context, pid_t pid, int code, int status) {
4504         assert(s);
4505
4506         if (s->pid != pid) {
4507                 *s = (ExecStatus) {
4508                         .pid = pid,
4509                 };
4510         }
4511
4512         dual_timestamp_get(&s->exit_timestamp);
4513
4514         s->code = code;
4515         s->status = status;
4516
4517         if (context) {
4518                 if (context->utmp_id)
4519                         (void) utmp_put_dead_process(context->utmp_id, pid, code, status);
4520
4521                 exec_context_tty_reset(context, NULL);
4522         }
4523 }
4524
4525 void exec_status_reset(ExecStatus *s) {
4526         assert(s);
4527
4528         *s = (ExecStatus) {};
4529 }
4530
4531 void exec_status_dump(const ExecStatus *s, FILE *f, const char *prefix) {
4532         char buf[FORMAT_TIMESTAMP_MAX];
4533
4534         assert(s);
4535         assert(f);
4536
4537         if (s->pid <= 0)
4538                 return;
4539
4540         prefix = strempty(prefix);
4541
4542         fprintf(f,
4543                 "%sPID: "PID_FMT"\n",
4544                 prefix, s->pid);
4545
4546         if (dual_timestamp_is_set(&s->start_timestamp))
4547                 fprintf(f,
4548                         "%sStart Timestamp: %s\n",
4549                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
4550
4551         if (dual_timestamp_is_set(&s->exit_timestamp))
4552                 fprintf(f,
4553                         "%sExit Timestamp: %s\n"
4554                         "%sExit Code: %s\n"
4555                         "%sExit Status: %i\n",
4556                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
4557                         prefix, sigchld_code_to_string(s->code),
4558                         prefix, s->status);
4559 }
4560
4561 static char *exec_command_line(char **argv) {
4562         size_t k;
4563         char *n, *p, **a;
4564         bool first = true;
4565
4566         assert(argv);
4567
4568         k = 1;
4569         STRV_FOREACH(a, argv)
4570                 k += strlen(*a)+3;
4571
4572         n = new(char, k);
4573         if (!n)
4574                 return NULL;
4575
4576         p = n;
4577         STRV_FOREACH(a, argv) {
4578
4579                 if (!first)
4580                         *(p++) = ' ';
4581                 else
4582                         first = false;
4583
4584                 if (strpbrk(*a, WHITESPACE)) {
4585                         *(p++) = '\'';
4586                         p = stpcpy(p, *a);
4587                         *(p++) = '\'';
4588                 } else
4589                         p = stpcpy(p, *a);
4590
4591         }
4592
4593         *p = 0;
4594
4595         /* FIXME: this doesn't really handle arguments that have
4596          * spaces and ticks in them */
4597
4598         return n;
4599 }
4600
4601 static void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
4602         _cleanup_free_ char *cmd = NULL;
4603         const char *prefix2;
4604
4605         assert(c);
4606         assert(f);
4607
4608         prefix = strempty(prefix);
4609         prefix2 = strjoina(prefix, "\t");
4610
4611         cmd = exec_command_line(c->argv);
4612         fprintf(f,
4613                 "%sCommand Line: %s\n",
4614                 prefix, cmd ? cmd : strerror(ENOMEM));
4615
4616         exec_status_dump(&c->exec_status, f, prefix2);
4617 }
4618
4619 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
4620         assert(f);
4621
4622         prefix = strempty(prefix);
4623
4624         LIST_FOREACH(command, c, c)
4625                 exec_command_dump(c, f, prefix);
4626 }
4627
4628 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
4629         ExecCommand *end;
4630
4631         assert(l);
4632         assert(e);
4633
4634         if (*l) {
4635                 /* It's kind of important, that we keep the order here */
4636                 LIST_FIND_TAIL(command, *l, end);
4637                 LIST_INSERT_AFTER(command, *l, end, e);
4638         } else
4639               *l = e;
4640 }
4641
4642 int exec_command_set(ExecCommand *c, const char *path, ...) {
4643         va_list ap;
4644         char **l, *p;
4645
4646         assert(c);
4647         assert(path);
4648
4649         va_start(ap, path);
4650         l = strv_new_ap(path, ap);
4651         va_end(ap);
4652
4653         if (!l)
4654                 return -ENOMEM;
4655
4656         p = strdup(path);
4657         if (!p) {
4658                 strv_free(l);
4659                 return -ENOMEM;
4660         }
4661
4662         free(c->path);
4663         c->path = p;
4664
4665         return strv_free_and_replace(c->argv, l);
4666 }
4667
4668 int exec_command_append(ExecCommand *c, const char *path, ...) {
4669         _cleanup_strv_free_ char **l = NULL;
4670         va_list ap;
4671         int r;
4672
4673         assert(c);
4674         assert(path);
4675
4676         va_start(ap, path);
4677         l = strv_new_ap(path, ap);
4678         va_end(ap);
4679
4680         if (!l)
4681                 return -ENOMEM;
4682
4683         r = strv_extend_strv(&c->argv, l, false);
4684         if (r < 0)
4685                 return r;
4686
4687         return 0;
4688 }
4689
4690 static void *remove_tmpdir_thread(void *p) {
4691         _cleanup_free_ char *path = p;
4692
4693         (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL);
4694         return NULL;
4695 }
4696
4697 static ExecRuntime* exec_runtime_free(ExecRuntime *rt, bool destroy) {
4698         int r;
4699
4700         if (!rt)
4701                 return NULL;
4702
4703         if (rt->manager)
4704                 (void) hashmap_remove(rt->manager->exec_runtime_by_id, rt->id);
4705
4706         /* When destroy is true, then rm_rf tmp_dir and var_tmp_dir. */
4707         if (destroy && rt->tmp_dir) {
4708                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
4709
4710                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
4711                 if (r < 0) {
4712                         log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
4713                         free(rt->tmp_dir);
4714                 }
4715
4716                 rt->tmp_dir = NULL;
4717         }
4718
4719         if (destroy && rt->var_tmp_dir) {
4720                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
4721
4722                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
4723                 if (r < 0) {
4724                         log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
4725                         free(rt->var_tmp_dir);
4726                 }
4727
4728                 rt->var_tmp_dir = NULL;
4729         }
4730
4731         rt->id = mfree(rt->id);
4732         rt->tmp_dir = mfree(rt->tmp_dir);
4733         rt->var_tmp_dir = mfree(rt->var_tmp_dir);
4734         safe_close_pair(rt->netns_storage_socket);
4735         return mfree(rt);
4736 }
4737
4738 static void exec_runtime_freep(ExecRuntime **rt) {
4739         if (*rt)
4740                 (void) exec_runtime_free(*rt, false);
4741 }
4742
4743 static int exec_runtime_allocate(ExecRuntime **rt) {
4744         assert(rt);
4745
4746         *rt = new0(ExecRuntime, 1);
4747         if (!*rt)
4748                 return -ENOMEM;
4749
4750         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
4751         return 0;
4752 }
4753
4754 static int exec_runtime_add(
4755                 Manager *m,
4756                 const char *id,
4757                 const char *tmp_dir,
4758                 const char *var_tmp_dir,
4759                 const int netns_storage_socket[2],
4760                 ExecRuntime **ret) {
4761
4762         _cleanup_(exec_runtime_freep) ExecRuntime *rt = NULL;
4763         int r;
4764
4765         assert(m);
4766         assert(id);
4767
4768         r = hashmap_ensure_allocated(&m->exec_runtime_by_id, &string_hash_ops);
4769         if (r < 0)
4770                 return r;
4771
4772         r = exec_runtime_allocate(&rt);
4773         if (r < 0)
4774                 return r;
4775
4776         rt->id = strdup(id);
4777         if (!rt->id)
4778                 return -ENOMEM;
4779
4780         if (tmp_dir) {
4781                 rt->tmp_dir = strdup(tmp_dir);
4782                 if (!rt->tmp_dir)
4783                         return -ENOMEM;
4784
4785                 /* When tmp_dir is set, then we require var_tmp_dir is also set. */
4786                 assert(var_tmp_dir);
4787                 rt->var_tmp_dir = strdup(var_tmp_dir);
4788                 if (!rt->var_tmp_dir)
4789                         return -ENOMEM;
4790         }
4791
4792         if (netns_storage_socket) {
4793                 rt->netns_storage_socket[0] = netns_storage_socket[0];
4794                 rt->netns_storage_socket[1] = netns_storage_socket[1];
4795         }
4796
4797         r = hashmap_put(m->exec_runtime_by_id, rt->id, rt);
4798         if (r < 0)
4799                 return r;
4800
4801         rt->manager = m;
4802
4803         if (ret)
4804                 *ret = rt;
4805
4806         /* do not remove created ExecRuntime object when the operation succeeds. */
4807         rt = NULL;
4808         return 0;
4809 }
4810
4811 static int exec_runtime_make(Manager *m, const ExecContext *c, const char *id, ExecRuntime **ret) {
4812         _cleanup_free_ char *tmp_dir = NULL, *var_tmp_dir = NULL;
4813         _cleanup_close_pair_ int netns_storage_socket[2] = {-1, -1};
4814         int r;
4815
4816         assert(m);
4817         assert(c);
4818         assert(id);
4819
4820         /* It is not necessary to create ExecRuntime object. */
4821         if (!c->private_network && !c->private_tmp)
4822                 return 0;
4823
4824         if (c->private_tmp) {
4825                 r = setup_tmp_dirs(id, &tmp_dir, &var_tmp_dir);
4826                 if (r < 0)
4827                         return r;
4828         }
4829
4830         if (c->private_network) {
4831                 if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, netns_storage_socket) < 0)
4832                         return -errno;
4833         }
4834
4835         r = exec_runtime_add(m, id, tmp_dir, var_tmp_dir, netns_storage_socket, ret);
4836         if (r < 0)
4837                 return r;
4838
4839         /* Avoid cleanup */
4840         netns_storage_socket[0] = -1;
4841         netns_storage_socket[1] = -1;
4842         return 1;
4843 }
4844
4845 int exec_runtime_acquire(Manager *m, const ExecContext *c, const char *id, bool create, ExecRuntime **ret) {
4846         ExecRuntime *rt;
4847         int r;
4848
4849         assert(m);
4850         assert(id);
4851         assert(ret);
4852
4853         rt = hashmap_get(m->exec_runtime_by_id, id);
4854         if (rt)
4855                 /* We already have a ExecRuntime object, let's increase the ref count and reuse it */
4856                 goto ref;
4857
4858         if (!create)
4859                 return 0;
4860
4861         /* If not found, then create a new object. */
4862         r = exec_runtime_make(m, c, id, &rt);
4863         if (r <= 0)
4864                 /* When r == 0, it is not necessary to create ExecRuntime object. */
4865                 return r;
4866
4867 ref:
4868         /* increment reference counter. */
4869         rt->n_ref++;
4870         *ret = rt;
4871         return 1;
4872 }
4873
4874 ExecRuntime *exec_runtime_unref(ExecRuntime *rt, bool destroy) {
4875         if (!rt)
4876                 return NULL;
4877
4878         assert(rt->n_ref > 0);
4879
4880         rt->n_ref--;
4881         if (rt->n_ref > 0)
4882                 return NULL;
4883
4884         return exec_runtime_free(rt, destroy);
4885 }
4886
4887 int exec_runtime_serialize(const Manager *m, FILE *f, FDSet *fds) {
4888         ExecRuntime *rt;
4889         Iterator i;
4890
4891         assert(m);
4892         assert(f);
4893         assert(fds);
4894
4895         HASHMAP_FOREACH(rt, m->exec_runtime_by_id, i) {
4896                 fprintf(f, "exec-runtime=%s", rt->id);
4897
4898                 if (rt->tmp_dir)
4899                         fprintf(f, " tmp-dir=%s", rt->tmp_dir);
4900
4901                 if (rt->var_tmp_dir)
4902                         fprintf(f, " var-tmp-dir=%s", rt->var_tmp_dir);
4903
4904                 if (rt->netns_storage_socket[0] >= 0) {
4905                         int copy;
4906
4907                         copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
4908                         if (copy < 0)
4909                                 return copy;
4910
4911                         fprintf(f, " netns-socket-0=%i", copy);
4912                 }
4913
4914                 if (rt->netns_storage_socket[1] >= 0) {
4915                         int copy;
4916
4917                         copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
4918                         if (copy < 0)
4919                                 return copy;
4920
4921                         fprintf(f, " netns-socket-1=%i", copy);
4922                 }
4923
4924                 fputc('\n', f);
4925         }
4926
4927         return 0;
4928 }
4929
4930 int exec_runtime_deserialize_compat(Unit *u, const char *key, const char *value, FDSet *fds) {
4931         _cleanup_(exec_runtime_freep) ExecRuntime *rt_create = NULL;
4932         ExecRuntime *rt;
4933         int r;
4934
4935         /* This is for the migration from old (v237 or earlier) deserialization text.
4936          * Due to the bug #7790, this may not work with the units that use JoinsNamespaceOf=.
4937          * Even if the ExecRuntime object originally created by the other unit, we cannot judge
4938          * so or not from the serialized text, then we always creates a new object owned by this. */
4939
4940         assert(u);
4941         assert(key);
4942         assert(value);
4943
4944         /* Manager manages ExecRuntime objects by the unit id.
4945          * So, we omit the serialized text when the unit does not have id (yet?)... */
4946         if (isempty(u->id)) {
4947                 log_unit_debug(u, "Invocation ID not found. Dropping runtime parameter.");
4948                 return 0;
4949         }
4950
4951         r = hashmap_ensure_allocated(&u->manager->exec_runtime_by_id, &string_hash_ops);
4952         if (r < 0) {
4953                 log_unit_debug_errno(u, r, "Failed to allocate storage for runtime parameter: %m");
4954                 return 0;
4955         }
4956
4957         rt = hashmap_get(u->manager->exec_runtime_by_id, u->id);
4958         if (!rt) {
4959                 r = exec_runtime_allocate(&rt_create);
4960                 if (r < 0)
4961                         return log_oom();
4962
4963                 rt_create->id = strdup(u->id);
4964                 if (!rt_create->id)
4965                         return log_oom();
4966
4967                 rt = rt_create;
4968         }
4969
4970         if (streq(key, "tmp-dir")) {
4971                 char *copy;
4972
4973                 copy = strdup(value);
4974                 if (!copy)
4975                         return log_oom();
4976
4977                 free_and_replace(rt->tmp_dir, copy);
4978
4979         } else if (streq(key, "var-tmp-dir")) {
4980                 char *copy;
4981
4982                 copy = strdup(value);
4983                 if (!copy)
4984                         return log_oom();
4985
4986                 free_and_replace(rt->var_tmp_dir, copy);
4987
4988         } else if (streq(key, "netns-socket-0")) {
4989                 int fd;
4990
4991                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
4992                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
4993                         return 0;
4994                 }
4995
4996                 safe_close(rt->netns_storage_socket[0]);
4997                 rt->netns_storage_socket[0] = fdset_remove(fds, fd);
4998
4999         } else if (streq(key, "netns-socket-1")) {
5000                 int fd;
5001
5002                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd)) {
5003                         log_unit_debug(u, "Failed to parse netns socket value: %s", value);
5004                         return 0;
5005                 }
5006
5007                 safe_close(rt->netns_storage_socket[1]);
5008                 rt->netns_storage_socket[1] = fdset_remove(fds, fd);
5009         } else
5010                 return 0;
5011
5012         /* If the object is newly created, then put it to the hashmap which manages ExecRuntime objects. */
5013         if (rt_create) {
5014                 r = hashmap_put(u->manager->exec_runtime_by_id, rt_create->id, rt_create);
5015                 if (r < 0) {
5016                         log_unit_debug_errno(u, r, "Failed to put runtime parameter to manager's storage: %m");
5017                         return 0;
5018                 }
5019
5020                 rt_create->manager = u->manager;
5021
5022                 /* Avoid cleanup */
5023                 rt_create = NULL;
5024         }
5025
5026         return 1;
5027 }
5028
5029 void exec_runtime_deserialize_one(Manager *m, const char *value, FDSet *fds) {
5030         char *id = NULL, *tmp_dir = NULL, *var_tmp_dir = NULL;
5031         int r, fd0 = -1, fd1 = -1;
5032         const char *p, *v = value;
5033         size_t n;
5034
5035         assert(m);
5036         assert(value);
5037         assert(fds);
5038
5039         n = strcspn(v, " ");
5040         id = strndupa(v, n);
5041         if (v[n] != ' ')
5042                 goto finalize;
5043         p = v + n + 1;
5044
5045         v = startswith(p, "tmp-dir=");
5046         if (v) {
5047                 n = strcspn(v, " ");
5048                 tmp_dir = strndupa(v, n);
5049                 if (v[n] != ' ')
5050                         goto finalize;
5051                 p = v + n + 1;
5052         }
5053
5054         v = startswith(p, "var-tmp-dir=");
5055         if (v) {
5056                 n = strcspn(v, " ");
5057                 var_tmp_dir = strndupa(v, n);
5058                 if (v[n] != ' ')
5059                         goto finalize;
5060                 p = v + n + 1;
5061         }
5062
5063         v = startswith(p, "netns-socket-0=");
5064         if (v) {
5065                 char *buf;
5066
5067                 n = strcspn(v, " ");
5068                 buf = strndupa(v, n);
5069                 if (safe_atoi(buf, &fd0) < 0 || !fdset_contains(fds, fd0)) {
5070                         log_debug("Unable to process exec-runtime netns fd specification.");
5071                         return;
5072                 }
5073                 fd0 = fdset_remove(fds, fd0);
5074                 if (v[n] != ' ')
5075                         goto finalize;
5076                 p = v + n + 1;
5077         }
5078
5079         v = startswith(p, "netns-socket-1=");
5080         if (v) {
5081                 char *buf;
5082
5083                 n = strcspn(v, " ");
5084                 buf = strndupa(v, n);
5085                 if (safe_atoi(buf, &fd1) < 0 || !fdset_contains(fds, fd1)) {
5086                         log_debug("Unable to process exec-runtime netns fd specification.");
5087                         return;
5088                 }
5089                 fd1 = fdset_remove(fds, fd1);
5090         }
5091
5092 finalize:
5093
5094         r = exec_runtime_add(m, id, tmp_dir, var_tmp_dir, (int[]) { fd0, fd1 }, NULL);
5095         if (r < 0)
5096                 log_debug_errno(r, "Failed to add exec-runtime: %m");
5097 }
5098
5099 void exec_runtime_vacuum(Manager *m) {
5100         ExecRuntime *rt;
5101         Iterator i;
5102
5103         assert(m);
5104
5105         /* Free unreferenced ExecRuntime objects. This is used after manager deserialization process. */
5106
5107         HASHMAP_FOREACH(rt, m->exec_runtime_by_id, i) {
5108                 if (rt->n_ref > 0)
5109                         continue;
5110
5111                 (void) exec_runtime_free(rt, false);
5112         }
5113 }
5114
5115 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
5116         [EXEC_INPUT_NULL] = "null",
5117         [EXEC_INPUT_TTY] = "tty",
5118         [EXEC_INPUT_TTY_FORCE] = "tty-force",
5119         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
5120         [EXEC_INPUT_SOCKET] = "socket",
5121         [EXEC_INPUT_NAMED_FD] = "fd",
5122         [EXEC_INPUT_DATA] = "data",
5123         [EXEC_INPUT_FILE] = "file",
5124 };
5125
5126 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
5127
5128 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
5129         [EXEC_OUTPUT_INHERIT] = "inherit",
5130         [EXEC_OUTPUT_NULL] = "null",
5131         [EXEC_OUTPUT_TTY] = "tty",
5132         [EXEC_OUTPUT_SYSLOG] = "syslog",
5133         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
5134         [EXEC_OUTPUT_KMSG] = "kmsg",
5135         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
5136         [EXEC_OUTPUT_JOURNAL] = "journal",
5137         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
5138         [EXEC_OUTPUT_SOCKET] = "socket",
5139         [EXEC_OUTPUT_NAMED_FD] = "fd",
5140         [EXEC_OUTPUT_FILE] = "file",
5141         [EXEC_OUTPUT_FILE_APPEND] = "append",
5142 };
5143
5144 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
5145
5146 static const char* const exec_utmp_mode_table[_EXEC_UTMP_MODE_MAX] = {
5147         [EXEC_UTMP_INIT] = "init",
5148         [EXEC_UTMP_LOGIN] = "login",
5149         [EXEC_UTMP_USER] = "user",
5150 };
5151
5152 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode, ExecUtmpMode);
5153
5154 static const char* const exec_preserve_mode_table[_EXEC_PRESERVE_MODE_MAX] = {
5155         [EXEC_PRESERVE_NO] = "no",
5156         [EXEC_PRESERVE_YES] = "yes",
5157         [EXEC_PRESERVE_RESTART] = "restart",
5158 };
5159
5160 DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(exec_preserve_mode, ExecPreserveMode, EXEC_PRESERVE_YES);
5161
5162 static const char* const exec_directory_type_table[_EXEC_DIRECTORY_TYPE_MAX] = {
5163         [EXEC_DIRECTORY_RUNTIME] = "RuntimeDirectory",
5164         [EXEC_DIRECTORY_STATE] = "StateDirectory",
5165         [EXEC_DIRECTORY_CACHE] = "CacheDirectory",
5166         [EXEC_DIRECTORY_LOGS] = "LogsDirectory",
5167         [EXEC_DIRECTORY_CONFIGURATION] = "ConfigurationDirectory",
5168 };
5169
5170 DEFINE_STRING_TABLE_LOOKUP(exec_directory_type, ExecDirectoryType);
5171
5172 static const char* const exec_directory_env_name_table[_EXEC_DIRECTORY_TYPE_MAX] = {
5173         [EXEC_DIRECTORY_RUNTIME] = "RUNTIME_DIRECTORY",
5174         [EXEC_DIRECTORY_STATE] = "STATE_DIRECTORY",
5175         [EXEC_DIRECTORY_CACHE] = "CACHE_DIRECTORY",
5176         [EXEC_DIRECTORY_LOGS] = "LOGS_DIRECTORY",
5177         [EXEC_DIRECTORY_CONFIGURATION] = "CONFIGURATION_DIRECTORY",
5178 };
5179
5180 DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(exec_directory_env_name, ExecDirectoryType);
5181
5182 static const char* const exec_keyring_mode_table[_EXEC_KEYRING_MODE_MAX] = {
5183         [EXEC_KEYRING_INHERIT] = "inherit",
5184         [EXEC_KEYRING_PRIVATE] = "private",
5185         [EXEC_KEYRING_SHARED] = "shared",
5186 };
5187
5188 DEFINE_STRING_TABLE_LOOKUP(exec_keyring_mode, ExecKeyringMode);