]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/firstboot/firstboot.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #32467 from yuwata/network-radv-cleanup
[thirdparty/systemd.git] / src / firstboot / firstboot.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include <fcntl.h>
4 #include <getopt.h>
5 #include <linux/loop.h>
6 #include <unistd.h>
7
8 #include "sd-id128.h"
9
10 #include "alloc-util.h"
11 #include "ask-password-api.h"
12 #include "build.h"
13 #include "bus-error.h"
14 #include "bus-locator.h"
15 #include "bus-unit-util.h"
16 #include "bus-util.h"
17 #include "bus-wait-for-jobs.h"
18 #include "chase.h"
19 #include "copy.h"
20 #include "creds-util.h"
21 #include "dissect-image.h"
22 #include "env-file.h"
23 #include "errno-util.h"
24 #include "fd-util.h"
25 #include "fileio.h"
26 #include "fs-util.h"
27 #include "glyph-util.h"
28 #include "hostname-util.h"
29 #include "kbd-util.h"
30 #include "libcrypt-util.h"
31 #include "locale-util.h"
32 #include "lock-util.h"
33 #include "main-func.h"
34 #include "memory-util.h"
35 #include "mkdir.h"
36 #include "mount-util.h"
37 #include "os-util.h"
38 #include "parse-argument.h"
39 #include "parse-util.h"
40 #include "password-quality-util.h"
41 #include "path-util.h"
42 #include "pretty-print.h"
43 #include "proc-cmdline.h"
44 #include "random-util.h"
45 #include "smack-util.h"
46 #include "string-util.h"
47 #include "strv.h"
48 #include "terminal-util.h"
49 #include "time-util.h"
50 #include "tmpfile-util-label.h"
51 #include "tmpfile-util.h"
52 #include "umask-util.h"
53 #include "user-util.h"
54
55 static char *arg_root = NULL;
56 static char *arg_image = NULL;
57 static char *arg_locale = NULL; /* $LANG */
58 static char *arg_locale_messages = NULL; /* $LC_MESSAGES */
59 static char *arg_keymap = NULL;
60 static char *arg_timezone = NULL;
61 static char *arg_hostname = NULL;
62 static sd_id128_t arg_machine_id = {};
63 static char *arg_root_password = NULL;
64 static char *arg_root_shell = NULL;
65 static char *arg_kernel_cmdline = NULL;
66 static bool arg_prompt_locale = false;
67 static bool arg_prompt_keymap = false;
68 static bool arg_prompt_timezone = false;
69 static bool arg_prompt_hostname = false;
70 static bool arg_prompt_root_password = false;
71 static bool arg_prompt_root_shell = false;
72 static bool arg_copy_locale = false;
73 static bool arg_copy_keymap = false;
74 static bool arg_copy_timezone = false;
75 static bool arg_copy_root_password = false;
76 static bool arg_copy_root_shell = false;
77 static bool arg_force = false;
78 static bool arg_delete_root_password = false;
79 static bool arg_root_password_is_hashed = false;
80 static bool arg_welcome = true;
81 static bool arg_reset = false;
82 static ImagePolicy *arg_image_policy = NULL;
83
84 STATIC_DESTRUCTOR_REGISTER(arg_root, freep);
85 STATIC_DESTRUCTOR_REGISTER(arg_image, freep);
86 STATIC_DESTRUCTOR_REGISTER(arg_locale, freep);
87 STATIC_DESTRUCTOR_REGISTER(arg_locale_messages, freep);
88 STATIC_DESTRUCTOR_REGISTER(arg_keymap, freep);
89 STATIC_DESTRUCTOR_REGISTER(arg_timezone, freep);
90 STATIC_DESTRUCTOR_REGISTER(arg_hostname, freep);
91 STATIC_DESTRUCTOR_REGISTER(arg_root_password, erase_and_freep);
92 STATIC_DESTRUCTOR_REGISTER(arg_root_shell, freep);
93 STATIC_DESTRUCTOR_REGISTER(arg_kernel_cmdline, freep);
94 STATIC_DESTRUCTOR_REGISTER(arg_image_policy, image_policy_freep);
95
96 static bool press_any_key(void) {
97 char k = 0;
98 bool need_nl = true;
99
100 printf("-- Press any key to proceed --");
101 fflush(stdout);
102
103 (void) read_one_char(stdin, &k, USEC_INFINITY, &need_nl);
104
105 if (need_nl)
106 putchar('\n');
107
108 return k != 'q';
109 }
110
111 static void print_welcome(int rfd) {
112 _cleanup_free_ char *pretty_name = NULL, *os_name = NULL, *ansi_color = NULL;
113 static bool done = false;
114 const char *pn, *ac;
115 int r;
116
117 assert(rfd >= 0);
118
119 if (!arg_welcome)
120 return;
121
122 if (done)
123 return;
124
125 r = parse_os_release_at(rfd,
126 "PRETTY_NAME", &pretty_name,
127 "NAME", &os_name,
128 "ANSI_COLOR", &ansi_color);
129 if (r < 0)
130 log_full_errno(r == -ENOENT ? LOG_DEBUG : LOG_WARNING, r,
131 "Failed to read os-release file, ignoring: %m");
132
133 pn = os_release_pretty_name(pretty_name, os_name);
134 ac = isempty(ansi_color) ? "0" : ansi_color;
135
136 (void) reset_terminal_fd(STDIN_FILENO, /* switch_to_text= */ false);
137
138 if (colors_enabled())
139 printf("\nWelcome to your new installation of \x1B[%sm%s\x1B[0m!\n", ac, pn);
140 else
141 printf("\nWelcome to your new installation of %s!\n", pn);
142
143 printf("\nPlease configure your system!\n\n");
144
145 press_any_key();
146
147 done = true;
148 }
149
150 static int show_menu(char **x, unsigned n_columns, unsigned width, unsigned percentage) {
151 unsigned break_lines, break_modulo;
152 size_t n, per_column, i, j;
153
154 assert(n_columns > 0);
155
156 n = strv_length(x);
157 per_column = DIV_ROUND_UP(n, n_columns);
158
159 break_lines = lines();
160 if (break_lines > 2)
161 break_lines--;
162
163 /* The first page gets two extra lines, since we want to show
164 * a title */
165 break_modulo = break_lines;
166 if (break_modulo > 3)
167 break_modulo -= 3;
168
169 for (i = 0; i < per_column; i++) {
170
171 for (j = 0; j < n_columns; j++) {
172 _cleanup_free_ char *e = NULL;
173
174 if (j * per_column + i >= n)
175 break;
176
177 e = ellipsize(x[j * per_column + i], width, percentage);
178 if (!e)
179 return log_oom();
180
181 printf("%4zu) %-*s", j * per_column + i + 1, (int) width, e);
182 }
183
184 putchar('\n');
185
186 /* on the first screen we reserve 2 extra lines for the title */
187 if (i % break_lines == break_modulo) {
188 if (!press_any_key())
189 return 0;
190 }
191 }
192
193 return 0;
194 }
195
196 static int prompt_loop(const char *text, char **l, unsigned percentage, bool (*is_valid)(const char *name), char **ret) {
197 int r;
198
199 assert(text);
200 assert(is_valid);
201 assert(ret);
202
203 for (;;) {
204 _cleanup_free_ char *p = NULL;
205 unsigned u;
206
207 r = ask_string(&p, "%s %s (empty to skip, \"list\" to list options): ",
208 special_glyph(SPECIAL_GLYPH_TRIANGULAR_BULLET), text);
209 if (r < 0)
210 return log_error_errno(r, "Failed to query user: %m");
211
212 if (isempty(p)) {
213 log_warning("No data entered, skipping.");
214 return 0;
215 }
216
217 if (streq(p, "list")) {
218 r = show_menu(l, 3, 22, percentage);
219 if (r < 0)
220 return r;
221
222 putchar('\n');
223 continue;
224 };
225
226 r = safe_atou(p, &u);
227 if (r >= 0) {
228 if (u <= 0 || u > strv_length(l)) {
229 log_error("Specified entry number out of range.");
230 continue;
231 }
232
233 log_info("Selected '%s'.", l[u-1]);
234 return free_and_strdup_warn(ret, l[u-1]);
235 }
236
237 if (!is_valid(p)) {
238 log_error("Entered data invalid.");
239 continue;
240 }
241
242 return free_and_replace(*ret, p);
243 }
244 }
245
246 static int should_configure(int dir_fd, const char *filename) {
247 _cleanup_fclose_ FILE *passwd = NULL, *shadow = NULL;
248 int r;
249
250 assert(dir_fd >= 0);
251 assert(filename);
252
253 if (streq(filename, "passwd") && !arg_force)
254 /* We may need to do additional checks, so open the file. */
255 r = xfopenat(dir_fd, filename, "re", O_NOFOLLOW, &passwd);
256 else
257 r = RET_NERRNO(faccessat(dir_fd, filename, F_OK, AT_SYMLINK_NOFOLLOW));
258
259 if (r == -ENOENT)
260 return true; /* missing */
261 if (r < 0)
262 return log_error_errno(r, "Failed to access %s: %m", filename);
263 if (arg_force)
264 return true; /* exists, but if --force was given we should still configure the file. */
265
266 if (!passwd)
267 return false;
268
269 /* In case of /etc/passwd, do an additional check for the root password field.
270 * We first check that passwd redirects to shadow, and then we check shadow.
271 */
272 struct passwd *i;
273 while ((r = fgetpwent_sane(passwd, &i)) > 0) {
274 if (!streq(i->pw_name, "root"))
275 continue;
276
277 if (streq_ptr(i->pw_passwd, PASSWORD_SEE_SHADOW))
278 break;
279 log_debug("passwd: root account with non-shadow password found, treating root as configured");
280 return false;
281 }
282 if (r < 0)
283 return log_error_errno(r, "Failed to read %s: %m", filename);
284 if (r == 0) {
285 log_debug("No root account found in %s, assuming root is not configured.", filename);
286 return true;
287 }
288
289 r = xfopenat(dir_fd, "shadow", "re", O_NOFOLLOW, &shadow);
290 if (r == -ENOENT) {
291 log_debug("No shadow file found, assuming root is not configured.");
292 return true; /* missing */
293 }
294 if (r < 0)
295 return log_error_errno(r, "Failed to access shadow: %m");
296
297 struct spwd *j;
298 while ((r = fgetspent_sane(shadow, &j)) > 0) {
299 if (!streq(j->sp_namp, "root"))
300 continue;
301
302 bool unprovisioned = streq_ptr(j->sp_pwdp, PASSWORD_UNPROVISIONED);
303 log_debug("Root account found, %s.",
304 unprovisioned ? "with unprovisioned password, treating root as not configured" :
305 "treating root as configured");
306 return unprovisioned;
307 }
308 if (r < 0)
309 return log_error_errno(r, "Failed to read shadow: %m");
310 assert(r == 0);
311 log_debug("No root account found in shadow, assuming root is not configured.");
312 return true;
313 }
314
315 static bool locale_is_installed_bool(const char *name) {
316 return locale_is_installed(name) > 0;
317 }
318
319 static bool locale_is_ok(int rfd, const char *name) {
320 assert(rfd >= 0);
321
322 return dir_fd_is_root(rfd) ? locale_is_installed_bool(name) : locale_is_valid(name);
323 }
324
325 static int prompt_locale(int rfd) {
326 _cleanup_strv_free_ char **locales = NULL;
327 bool acquired_from_creds = false;
328 int r;
329
330 assert(rfd >= 0);
331
332 if (arg_locale || arg_locale_messages)
333 return 0;
334
335 r = read_credential("firstboot.locale", (void**) &arg_locale, NULL);
336 if (r < 0)
337 log_debug_errno(r, "Failed to read credential firstboot.locale, ignoring: %m");
338 else
339 acquired_from_creds = true;
340
341 r = read_credential("firstboot.locale-messages", (void**) &arg_locale_messages, NULL);
342 if (r < 0)
343 log_debug_errno(r, "Failed to read credential firstboot.locale-messages, ignoring: %m");
344 else
345 acquired_from_creds = true;
346
347 if (acquired_from_creds) {
348 log_debug("Acquired locale from credentials.");
349 return 0;
350 }
351
352 if (!arg_prompt_locale) {
353 log_debug("Prompting for locale was not requested.");
354 return 0;
355 }
356
357 r = get_locales(&locales);
358 if (r < 0)
359 return log_error_errno(r, "Cannot query locales list: %m");
360
361 if (strv_isempty(locales))
362 log_debug("No locales found, skipping locale selection.");
363 else if (strv_length(locales) == 1) {
364
365 if (streq(locales[0], SYSTEMD_DEFAULT_LOCALE))
366 log_debug("Only installed locale is default locale anyway, not setting locale explicitly.");
367 else {
368 log_debug("Only a single locale available (%s), selecting it as default.", locales[0]);
369
370 arg_locale = strdup(locales[0]);
371 if (!arg_locale)
372 return log_oom();
373
374 /* Not setting arg_locale_message here, since it defaults to LANG anyway */
375 }
376 } else {
377 bool (*is_valid)(const char *name) = dir_fd_is_root(rfd) ? locale_is_installed_bool
378 : locale_is_valid;
379
380 print_welcome(rfd);
381
382 r = prompt_loop("Please enter system locale name or number",
383 locales, 60, is_valid, &arg_locale);
384 if (r < 0)
385 return r;
386
387 if (isempty(arg_locale))
388 return 0;
389
390 r = prompt_loop("Please enter system message locale name or number",
391 locales, 60, is_valid, &arg_locale_messages);
392 if (r < 0)
393 return r;
394
395 /* Suppress the messages setting if it's the same as the main locale anyway */
396 if (streq_ptr(arg_locale, arg_locale_messages))
397 arg_locale_messages = mfree(arg_locale_messages);
398 }
399
400 return 0;
401 }
402
403 static int process_locale(int rfd) {
404 _cleanup_close_ int pfd = -EBADF;
405 _cleanup_free_ char *f = NULL;
406 char* locales[3];
407 unsigned i = 0;
408 int r;
409
410 assert(rfd >= 0);
411
412 pfd = chase_and_open_parent_at(rfd, "/etc/locale.conf",
413 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
414 &f);
415 if (pfd < 0)
416 return log_error_errno(pfd, "Failed to chase /etc/locale.conf: %m");
417
418 r = should_configure(pfd, f);
419 if (r == 0)
420 log_debug("Found /etc/locale.conf, assuming locale information has been configured.");
421 if (r <= 0)
422 return r;
423
424 r = dir_fd_is_root(rfd);
425 if (r < 0)
426 return log_error_errno(r, "Failed to check if directory file descriptor is root: %m");
427
428 if (arg_copy_locale && r == 0) {
429 r = copy_file_atomic_at(AT_FDCWD, "/etc/locale.conf", pfd, f, 0644, COPY_REFLINK);
430 if (r != -ENOENT) {
431 if (r < 0)
432 return log_error_errno(r, "Failed to copy host's /etc/locale.conf: %m");
433
434 log_info("Copied host's /etc/locale.conf.");
435 return 0;
436 }
437 }
438
439 r = prompt_locale(rfd);
440 if (r < 0)
441 return r;
442
443 if (!isempty(arg_locale))
444 locales[i++] = strjoina("LANG=", arg_locale);
445 if (!isempty(arg_locale_messages) && !streq_ptr(arg_locale_messages, arg_locale))
446 locales[i++] = strjoina("LC_MESSAGES=", arg_locale_messages);
447
448 if (i == 0)
449 return 0;
450
451 locales[i] = NULL;
452
453 r = write_env_file(pfd, f, NULL, locales);
454 if (r < 0)
455 return log_error_errno(r, "Failed to write /etc/locale.conf: %m");
456
457 log_info("/etc/locale.conf written.");
458 return 1;
459 }
460
461 static bool keymap_exists_bool(const char *name) {
462 return keymap_exists(name) > 0;
463 }
464
465 static typeof(&keymap_is_valid) determine_keymap_validity_func(int rfd) {
466 int r;
467
468 r = dir_fd_is_root(rfd);
469 if (r < 0)
470 log_debug_errno(r, "Unable to determine if operating on host root directory, assuming we are: %m");
471
472 return r != 0 ? keymap_exists_bool : keymap_is_valid;
473 }
474
475 static int prompt_keymap(int rfd) {
476 _cleanup_strv_free_ char **kmaps = NULL;
477 int r;
478
479 assert(rfd >= 0);
480
481 if (arg_keymap)
482 return 0;
483
484 r = read_credential("firstboot.keymap", (void**) &arg_keymap, NULL);
485 if (r < 0)
486 log_debug_errno(r, "Failed to read credential firstboot.keymap, ignoring: %m");
487 else {
488 log_debug("Acquired keymap from credential.");
489 return 0;
490 }
491
492 if (!arg_prompt_keymap) {
493 log_debug("Prompting for keymap was not requested.");
494 return 0;
495 }
496
497 r = get_keymaps(&kmaps);
498 if (r == -ENOENT) /* no keymaps installed */
499 return log_debug_errno(r, "No keymaps are installed.");
500 if (r < 0)
501 return log_error_errno(r, "Failed to read keymaps: %m");
502
503 print_welcome(rfd);
504
505 return prompt_loop("Please enter system keymap name or number",
506 kmaps, 60, determine_keymap_validity_func(rfd), &arg_keymap);
507 }
508
509 static int process_keymap(int rfd) {
510 _cleanup_close_ int pfd = -EBADF;
511 _cleanup_free_ char *f = NULL;
512 char **keymap;
513 int r;
514
515 assert(rfd >= 0);
516
517 pfd = chase_and_open_parent_at(rfd, "/etc/vconsole.conf",
518 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
519 &f);
520 if (pfd < 0)
521 return log_error_errno(pfd, "Failed to chase /etc/vconsole.conf: %m");
522
523 r = should_configure(pfd, f);
524 if (r == 0)
525 log_debug("Found /etc/vconsole.conf, assuming console has been configured.");
526 if (r <= 0)
527 return r;
528
529 r = dir_fd_is_root(rfd);
530 if (r < 0)
531 return log_error_errno(r, "Failed to check if directory file descriptor is root: %m");
532
533 if (arg_copy_keymap && r == 0) {
534 r = copy_file_atomic_at(AT_FDCWD, "/etc/vconsole.conf", pfd, f, 0644, COPY_REFLINK);
535 if (r != -ENOENT) {
536 if (r < 0)
537 return log_error_errno(r, "Failed to copy host's /etc/vconsole.conf: %m");
538
539 log_info("Copied host's /etc/vconsole.conf.");
540 return 0;
541 }
542 }
543
544 r = prompt_keymap(rfd);
545 if (r == -ENOENT)
546 return 0; /* don't fail if no keymaps are installed */
547 if (r < 0)
548 return r;
549
550 if (isempty(arg_keymap))
551 return 0;
552
553 keymap = STRV_MAKE(strjoina("KEYMAP=", arg_keymap));
554
555 r = write_vconsole_conf(pfd, f, keymap);
556 if (r < 0)
557 return log_error_errno(r, "Failed to write /etc/vconsole.conf: %m");
558
559 log_info("/etc/vconsole.conf written.");
560 return 1;
561 }
562
563 static bool timezone_is_valid_log_error(const char *name) {
564 return timezone_is_valid(name, LOG_ERR);
565 }
566
567 static int prompt_timezone(int rfd) {
568 _cleanup_strv_free_ char **zones = NULL;
569 int r;
570
571 assert(rfd >= 0);
572
573 if (arg_timezone)
574 return 0;
575
576 r = read_credential("firstboot.timezone", (void**) &arg_timezone, NULL);
577 if (r < 0)
578 log_debug_errno(r, "Failed to read credential firstboot.timezone, ignoring: %m");
579 else {
580 log_debug("Acquired timezone from credential.");
581 return 0;
582 }
583
584 if (!arg_prompt_timezone) {
585 log_debug("Prompting for timezone was not requested.");
586 return 0;
587 }
588
589 r = get_timezones(&zones);
590 if (r < 0)
591 return log_error_errno(r, "Cannot query timezone list: %m");
592
593 print_welcome(rfd);
594
595 r = prompt_loop("Please enter timezone name or number",
596 zones, 30, timezone_is_valid_log_error, &arg_timezone);
597 if (r < 0)
598 return r;
599
600 return 0;
601 }
602
603 static int process_timezone(int rfd) {
604 _cleanup_close_ int pfd = -EBADF;
605 _cleanup_free_ char *f = NULL;
606 const char *e;
607 int r;
608
609 assert(rfd >= 0);
610
611 pfd = chase_and_open_parent_at(rfd, "/etc/localtime",
612 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
613 &f);
614 if (pfd < 0)
615 return log_error_errno(pfd, "Failed to chase /etc/localtime: %m");
616
617 r = should_configure(pfd, f);
618 if (r == 0)
619 log_debug("Found /etc/localtime, assuming timezone has been configured.");
620 if (r <= 0)
621 return r;
622
623 r = dir_fd_is_root(rfd);
624 if (r < 0)
625 return log_error_errno(r, "Failed to check if directory file descriptor is root: %m");
626
627 if (arg_copy_timezone && r == 0) {
628 _cleanup_free_ char *s = NULL;
629
630 r = readlink_malloc("/etc/localtime", &s);
631 if (r != -ENOENT) {
632 if (r < 0)
633 return log_error_errno(r, "Failed to read host's /etc/localtime: %m");
634
635 r = symlinkat_atomic_full(s, pfd, f, /* make_relative= */ false);
636 if (r < 0)
637 return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
638
639 log_info("Copied host's /etc/localtime.");
640 return 0;
641 }
642 }
643
644 r = prompt_timezone(rfd);
645 if (r < 0)
646 return r;
647
648 if (isempty(arg_timezone))
649 return 0;
650
651 e = strjoina("../usr/share/zoneinfo/", arg_timezone);
652
653 r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
654 if (r < 0)
655 return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
656
657 log_info("/etc/localtime written");
658 return 0;
659 }
660
661 static int prompt_hostname(int rfd) {
662 int r;
663
664 assert(rfd >= 0);
665
666 if (arg_hostname)
667 return 0;
668
669 if (!arg_prompt_hostname) {
670 log_debug("Prompting for hostname was not requested.");
671 return 0;
672 }
673
674 print_welcome(rfd);
675 putchar('\n');
676
677 for (;;) {
678 _cleanup_free_ char *h = NULL;
679
680 r = ask_string(&h, "%s Please enter hostname for new system (empty to skip): ", special_glyph(SPECIAL_GLYPH_TRIANGULAR_BULLET));
681 if (r < 0)
682 return log_error_errno(r, "Failed to query hostname: %m");
683
684 if (isempty(h)) {
685 log_warning("No hostname entered, skipping.");
686 break;
687 }
688
689 if (!hostname_is_valid(h, VALID_HOSTNAME_TRAILING_DOT)) {
690 log_error("Specified hostname invalid.");
691 continue;
692 }
693
694 /* Get rid of the trailing dot that we allow, but don't want to see */
695 arg_hostname = hostname_cleanup(h);
696 h = NULL;
697 break;
698 }
699
700 return 0;
701 }
702
703 static int process_hostname(int rfd) {
704 _cleanup_close_ int pfd = -EBADF;
705 _cleanup_free_ char *f = NULL;
706 int r;
707
708 assert(rfd >= 0);
709
710 pfd = chase_and_open_parent_at(rfd, "/etc/hostname",
711 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN,
712 &f);
713 if (pfd < 0)
714 return log_error_errno(pfd, "Failed to chase /etc/hostname: %m");
715
716 r = should_configure(pfd, f);
717 if (r == 0)
718 log_debug("Found /etc/hostname, assuming hostname has been configured.");
719 if (r <= 0)
720 return r;
721
722 r = prompt_hostname(rfd);
723 if (r < 0)
724 return r;
725
726 if (isempty(arg_hostname))
727 return 0;
728
729 r = write_string_file_at(pfd, f, arg_hostname,
730 WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_SYNC|WRITE_STRING_FILE_ATOMIC);
731 if (r < 0)
732 return log_error_errno(r, "Failed to write /etc/hostname: %m");
733
734 log_info("/etc/hostname written.");
735 return 0;
736 }
737
738 static int process_machine_id(int rfd) {
739 _cleanup_close_ int pfd = -EBADF;
740 _cleanup_free_ char *f = NULL;
741 int r;
742
743 assert(rfd >= 0);
744
745 pfd = chase_and_open_parent_at(rfd, "/etc/machine-id",
746 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
747 &f);
748 if (pfd < 0)
749 return log_error_errno(pfd, "Failed to chase /etc/machine-id: %m");
750
751 r = should_configure(pfd, f);
752 if (r == 0)
753 log_debug("Found /etc/machine-id, assuming machine-id has been configured.");
754 if (r <= 0)
755 return r;
756
757 if (sd_id128_is_null(arg_machine_id)) {
758 log_debug("Initialization of machine-id was not requested, skipping.");
759 return 0;
760 }
761
762 r = write_string_file_at(pfd, "machine-id", SD_ID128_TO_STRING(arg_machine_id),
763 WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_SYNC|WRITE_STRING_FILE_ATOMIC);
764 if (r < 0)
765 return log_error_errno(r, "Failed to write /etc/machine-id: %m");
766
767 log_info("/etc/machine-id written.");
768 return 0;
769 }
770
771 static int prompt_root_password(int rfd) {
772 const char *msg1, *msg2;
773 int r;
774
775 assert(rfd >= 0);
776
777 if (arg_root_password)
778 return 0;
779
780 if (get_credential_user_password("root", &arg_root_password, &arg_root_password_is_hashed) >= 0)
781 return 0;
782
783 if (!arg_prompt_root_password) {
784 log_debug("Prompting for root password was not requested.");
785 return 0;
786 }
787
788 print_welcome(rfd);
789 putchar('\n');
790
791 msg1 = strjoina(special_glyph(SPECIAL_GLYPH_TRIANGULAR_BULLET), " Please enter a new root password (empty to skip):");
792 msg2 = strjoina(special_glyph(SPECIAL_GLYPH_TRIANGULAR_BULLET), " Please enter new root password again:");
793
794 suggest_passwords();
795
796 for (;;) {
797 _cleanup_strv_free_erase_ char **a = NULL, **b = NULL;
798 _cleanup_free_ char *error = NULL;
799
800 AskPasswordRequest req = {
801 .message = msg1,
802 };
803
804 r = ask_password_tty(-EBADF, &req, /* until= */ 0, /* flags= */ 0, /* flag_file= */ NULL, &a);
805 if (r < 0)
806 return log_error_errno(r, "Failed to query root password: %m");
807 if (strv_length(a) != 1)
808 return log_error_errno(SYNTHETIC_ERRNO(EIO),
809 "Received multiple passwords, where we expected one.");
810
811 if (isempty(*a)) {
812 log_warning("No password entered, skipping.");
813 break;
814 }
815
816 r = check_password_quality(*a, /* old */ NULL, "root", &error);
817 if (ERRNO_IS_NEG_NOT_SUPPORTED(r))
818 log_warning("Password quality check is not supported, proceeding anyway.");
819 else if (r < 0)
820 return log_error_errno(r, "Failed to check password quality: %m");
821 else if (r == 0)
822 log_warning("Password is weak, accepting anyway: %s", error);
823
824 req.message = msg2;
825
826 r = ask_password_tty(-EBADF, &req, /* until= */ 0, /* flags= */ 0, /* flag_file= */ NULL, &b);
827 if (r < 0)
828 return log_error_errno(r, "Failed to query root password: %m");
829 if (strv_length(b) != 1)
830 return log_error_errno(SYNTHETIC_ERRNO(EIO),
831 "Received multiple passwords, where we expected one.");
832
833 if (!streq(*a, *b)) {
834 log_error("Entered passwords did not match, please try again.");
835 continue;
836 }
837
838 arg_root_password = TAKE_PTR(*a);
839 break;
840 }
841
842 return 0;
843 }
844
845 static int find_shell(int rfd, const char *path) {
846 int r;
847
848 assert(path);
849
850 if (!valid_shell(path))
851 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "%s is not a valid shell", path);
852
853 r = chaseat(rfd, path, CHASE_AT_RESOLVE_IN_ROOT, NULL, NULL);
854 if (r < 0)
855 return log_error_errno(r, "Failed to resolve shell %s: %m", path);
856
857 return 0;
858 }
859
860 static int prompt_root_shell(int rfd) {
861 int r;
862
863 assert(rfd >= 0);
864
865 if (arg_root_shell)
866 return 0;
867
868 r = read_credential("passwd.shell.root", (void**) &arg_root_shell, NULL);
869 if (r < 0)
870 log_debug_errno(r, "Failed to read credential passwd.shell.root, ignoring: %m");
871 else {
872 log_debug("Acquired root shell from credential.");
873 return 0;
874 }
875
876 if (!arg_prompt_root_shell) {
877 log_debug("Prompting for root shell was not requested.");
878 return 0;
879 }
880
881 print_welcome(rfd);
882 putchar('\n');
883
884 for (;;) {
885 _cleanup_free_ char *s = NULL;
886
887 r = ask_string(&s, "%s Please enter root shell for new system (empty to skip): ", special_glyph(SPECIAL_GLYPH_TRIANGULAR_BULLET));
888 if (r < 0)
889 return log_error_errno(r, "Failed to query root shell: %m");
890
891 if (isempty(s)) {
892 log_warning("No shell entered, skipping.");
893 break;
894 }
895
896 r = find_shell(rfd, s);
897 if (r < 0)
898 continue;
899
900 arg_root_shell = TAKE_PTR(s);
901 break;
902 }
903
904 return 0;
905 }
906
907 static int write_root_passwd(int rfd, int etc_fd, const char *password, const char *shell) {
908 _cleanup_fclose_ FILE *original = NULL, *passwd = NULL;
909 _cleanup_(unlink_and_freep) char *passwd_tmp = NULL;
910 int r;
911
912 assert(password);
913
914 r = fopen_temporary_at_label(etc_fd, "passwd", "passwd", &passwd, &passwd_tmp);
915 if (r < 0)
916 return r;
917
918 r = xfopenat(etc_fd, "passwd", "re", O_NOFOLLOW, &original);
919 if (r < 0 && r != -ENOENT)
920 return r;
921
922 if (original) {
923 struct passwd *i;
924
925 r = copy_rights(fileno(original), fileno(passwd));
926 if (r < 0)
927 return r;
928
929 while ((r = fgetpwent_sane(original, &i)) > 0) {
930
931 if (streq(i->pw_name, "root")) {
932 i->pw_passwd = (char *) password;
933 if (shell)
934 i->pw_shell = (char *) shell;
935 }
936
937 r = putpwent_sane(i, passwd);
938 if (r < 0)
939 return r;
940 }
941 if (r < 0)
942 return r;
943
944 } else {
945 struct passwd root = {
946 .pw_name = (char *) "root",
947 .pw_passwd = (char *) password,
948 .pw_uid = 0,
949 .pw_gid = 0,
950 .pw_gecos = (char *) "Super User",
951 .pw_dir = (char *) "/root",
952 .pw_shell = (char *) (shell ?: default_root_shell_at(rfd)),
953 };
954
955 if (errno != ENOENT)
956 return -errno;
957
958 r = fchmod(fileno(passwd), 0644);
959 if (r < 0)
960 return -errno;
961
962 r = putpwent_sane(&root, passwd);
963 if (r < 0)
964 return r;
965 }
966
967 r = fflush_sync_and_check(passwd);
968 if (r < 0)
969 return r;
970
971 r = renameat_and_apply_smack_floor_label(etc_fd, passwd_tmp, etc_fd, "passwd");
972 if (r < 0)
973 return r;
974
975 return 0;
976 }
977
978 static int write_root_shadow(int etc_fd, const char *hashed_password) {
979 _cleanup_fclose_ FILE *original = NULL, *shadow = NULL;
980 _cleanup_(unlink_and_freep) char *shadow_tmp = NULL;
981 int r;
982
983 assert(hashed_password);
984
985 r = fopen_temporary_at_label(etc_fd, "shadow", "shadow", &shadow, &shadow_tmp);
986 if (r < 0)
987 return r;
988
989 r = xfopenat(etc_fd, "shadow", "re", O_NOFOLLOW, &original);
990 if (r < 0 && r != -ENOENT)
991 return r;
992
993 if (original) {
994 struct spwd *i;
995
996 r = copy_rights(fileno(original), fileno(shadow));
997 if (r < 0)
998 return r;
999
1000 while ((r = fgetspent_sane(original, &i)) > 0) {
1001
1002 if (streq(i->sp_namp, "root")) {
1003 i->sp_pwdp = (char *) hashed_password;
1004 i->sp_lstchg = (long) (now(CLOCK_REALTIME) / USEC_PER_DAY);
1005 }
1006
1007 r = putspent_sane(i, shadow);
1008 if (r < 0)
1009 return r;
1010 }
1011 if (r < 0)
1012 return r;
1013
1014 } else {
1015 struct spwd root = {
1016 .sp_namp = (char*) "root",
1017 .sp_pwdp = (char *) hashed_password,
1018 .sp_lstchg = (long) (now(CLOCK_REALTIME) / USEC_PER_DAY),
1019 .sp_min = -1,
1020 .sp_max = -1,
1021 .sp_warn = -1,
1022 .sp_inact = -1,
1023 .sp_expire = -1,
1024 .sp_flag = ULONG_MAX, /* this appears to be what everybody does ... */
1025 };
1026
1027 if (errno != ENOENT)
1028 return -errno;
1029
1030 r = fchmod(fileno(shadow), 0000);
1031 if (r < 0)
1032 return -errno;
1033
1034 r = putspent_sane(&root, shadow);
1035 if (r < 0)
1036 return r;
1037 }
1038
1039 r = fflush_sync_and_check(shadow);
1040 if (r < 0)
1041 return r;
1042
1043 r = renameat_and_apply_smack_floor_label(etc_fd, shadow_tmp, etc_fd, "shadow");
1044 if (r < 0)
1045 return r;
1046
1047 return 0;
1048 }
1049
1050 static int process_root_account(int rfd) {
1051 _cleanup_close_ int pfd = -EBADF;
1052 _cleanup_(release_lock_file) LockFile lock = LOCK_FILE_INIT;
1053 _cleanup_(erase_and_freep) char *_hashed_password = NULL;
1054 const char *password, *hashed_password;
1055 int k = 0, r;
1056
1057 assert(rfd >= 0);
1058
1059 pfd = chase_and_open_parent_at(rfd, "/etc/passwd",
1060 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
1061 NULL);
1062 if (pfd < 0)
1063 return log_error_errno(pfd, "Failed to chase /etc/passwd: %m");
1064
1065 /* Ensure that passwd and shadow are in the same directory and are not symlinks. */
1066
1067 FOREACH_STRING(s, "passwd", "shadow") {
1068 r = verify_regular_at(pfd, s, /* follow = */ false);
1069 if (r < 0 && r != -ENOENT)
1070 return log_error_errno(r, "Verification of /etc/%s being regular file failed: %m", s);
1071
1072 r = should_configure(pfd, s);
1073 if (r < 0)
1074 return r;
1075
1076 k += r;
1077 }
1078
1079 if (k == 0) {
1080 log_debug("Found /etc/passwd and /etc/shadow, assuming root account has been initialized.");
1081 return 0;
1082 }
1083
1084 /* Don't create/modify passwd and shadow if not asked */
1085 if (!(arg_root_password || arg_prompt_root_password || arg_copy_root_password || arg_delete_root_password ||
1086 arg_root_shell || arg_prompt_root_shell || arg_copy_root_shell)) {
1087 log_debug("Initialization of root account was not requested, skipping.");
1088 return 0;
1089 }
1090
1091 r = make_lock_file_at(pfd, ETC_PASSWD_LOCK_FILENAME, LOCK_EX, &lock);
1092 if (r < 0)
1093 return log_error_errno(r, "Failed to take a lock on /etc/passwd: %m");
1094
1095 k = dir_fd_is_root(rfd);
1096 if (k < 0)
1097 return log_error_errno(k, "Failed to check if directory file descriptor is root: %m");
1098
1099 if (arg_copy_root_shell && k == 0) {
1100 _cleanup_free_ struct passwd *p = NULL;
1101
1102 r = getpwnam_malloc("root", &p);
1103 if (r < 0)
1104 return log_error_errno(r, "Failed to find passwd entry for root: %m");
1105
1106 r = free_and_strdup(&arg_root_shell, p->pw_shell);
1107 if (r < 0)
1108 return log_oom();
1109 }
1110
1111 r = prompt_root_shell(rfd);
1112 if (r < 0)
1113 return r;
1114
1115 if (arg_copy_root_password && k == 0) {
1116 struct spwd *p;
1117
1118 errno = 0;
1119 p = getspnam("root");
1120 if (!p)
1121 return log_error_errno(errno_or_else(EIO), "Failed to find shadow entry for root: %m");
1122
1123 r = free_and_strdup(&arg_root_password, p->sp_pwdp);
1124 if (r < 0)
1125 return log_oom();
1126
1127 arg_root_password_is_hashed = true;
1128 }
1129
1130 r = prompt_root_password(rfd);
1131 if (r < 0)
1132 return r;
1133
1134 if (arg_root_password && arg_root_password_is_hashed) {
1135 password = PASSWORD_SEE_SHADOW;
1136 hashed_password = arg_root_password;
1137 } else if (arg_root_password) {
1138 r = hash_password(arg_root_password, &_hashed_password);
1139 if (r < 0)
1140 return log_error_errno(r, "Failed to hash password: %m");
1141
1142 password = PASSWORD_SEE_SHADOW;
1143 hashed_password = _hashed_password;
1144
1145 } else if (arg_delete_root_password)
1146 password = hashed_password = PASSWORD_NONE;
1147 else
1148 password = hashed_password = PASSWORD_LOCKED_AND_INVALID;
1149
1150 r = write_root_passwd(rfd, pfd, password, arg_root_shell);
1151 if (r < 0)
1152 return log_error_errno(r, "Failed to write /etc/passwd: %m");
1153
1154 log_info("/etc/passwd written.");
1155
1156 r = write_root_shadow(pfd, hashed_password);
1157 if (r < 0)
1158 return log_error_errno(r, "Failed to write /etc/shadow: %m");
1159
1160 log_info("/etc/shadow written.");
1161 return 0;
1162 }
1163
1164 static int process_kernel_cmdline(int rfd) {
1165 _cleanup_close_ int pfd = -EBADF;
1166 _cleanup_free_ char *f = NULL;
1167 int r;
1168
1169 assert(rfd >= 0);
1170
1171 pfd = chase_and_open_parent_at(rfd, "/etc/kernel/cmdline",
1172 CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
1173 &f);
1174 if (pfd < 0)
1175 return log_error_errno(pfd, "Failed to chase /etc/kernel/cmdline: %m");
1176
1177 r = should_configure(pfd, f);
1178 if (r == 0)
1179 log_debug("Found /etc/kernel/cmdline, assuming kernel command line has been configured.");
1180 if (r <= 0)
1181 return r;
1182
1183 if (!arg_kernel_cmdline) {
1184 log_debug("Creation of /etc/kernel/cmdline was not requested, skipping.");
1185 return 0;
1186 }
1187
1188 r = write_string_file_at(pfd, "cmdline", arg_kernel_cmdline,
1189 WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_SYNC|WRITE_STRING_FILE_ATOMIC);
1190 if (r < 0)
1191 return log_error_errno(r, "Failed to write /etc/kernel/cmdline: %m");
1192
1193 log_info("/etc/kernel/cmdline written.");
1194 return 0;
1195 }
1196
1197 static int reset_one(int rfd, const char *path) {
1198 _cleanup_close_ int pfd = -EBADF;
1199 _cleanup_free_ char *f = NULL;
1200
1201 assert(rfd >= 0);
1202 assert(path);
1203
1204 pfd = chase_and_open_parent_at(rfd, path, CHASE_AT_RESOLVE_IN_ROOT|CHASE_WARN|CHASE_NOFOLLOW, &f);
1205 if (pfd == -ENOENT)
1206 return 0;
1207 if (pfd < 0)
1208 return log_error_errno(pfd, "Failed to resolve %s: %m", path);
1209
1210 if (unlinkat(pfd, f, 0) < 0)
1211 return errno == ENOENT ? 0 : log_error_errno(errno, "Failed to remove %s: %m", path);
1212
1213 log_info("Removed %s", path);
1214 return 0;
1215 }
1216
1217 static int process_reset(int rfd) {
1218 int r;
1219
1220 assert(rfd >= 0);
1221
1222 if (!arg_reset)
1223 return 0;
1224
1225 FOREACH_STRING(p,
1226 "/etc/locale.conf",
1227 "/etc/vconsole.conf",
1228 "/etc/hostname",
1229 "/etc/machine-id",
1230 "/etc/kernel/cmdline",
1231 "/etc/localtime") {
1232 r = reset_one(rfd, p);
1233 if (r < 0)
1234 return r;
1235 }
1236
1237 return 0;
1238 }
1239
1240 static int help(void) {
1241 _cleanup_free_ char *link = NULL;
1242 int r;
1243
1244 r = terminal_urlify_man("systemd-firstboot", "1", &link);
1245 if (r < 0)
1246 return log_oom();
1247
1248 printf("%s [OPTIONS...]\n\n"
1249 "Configures basic settings of the system.\n\n"
1250 " -h --help Show this help\n"
1251 " --version Show package version\n"
1252 " --root=PATH Operate on an alternate filesystem root\n"
1253 " --image=PATH Operate on disk image as filesystem root\n"
1254 " --image-policy=POLICY Specify disk image dissection policy\n"
1255 " --locale=LOCALE Set primary locale (LANG=)\n"
1256 " --locale-messages=LOCALE Set message locale (LC_MESSAGES=)\n"
1257 " --keymap=KEYMAP Set keymap\n"
1258 " --timezone=TIMEZONE Set timezone\n"
1259 " --hostname=NAME Set hostname\n"
1260 " --setup-machine-id Set a random machine ID\n"
1261 " --machine-id=ID Set specified machine ID\n"
1262 " --root-password=PASSWORD Set root password from plaintext password\n"
1263 " --root-password-file=FILE Set root password from file\n"
1264 " --root-password-hashed=HASH Set root password from hashed password\n"
1265 " --root-shell=SHELL Set root shell\n"
1266 " --kernel-command-line=CMDLINE\n"
1267 " Set kernel command line\n"
1268 " --prompt-locale Prompt the user for locale settings\n"
1269 " --prompt-keymap Prompt the user for keymap settings\n"
1270 " --prompt-timezone Prompt the user for timezone\n"
1271 " --prompt-hostname Prompt the user for hostname\n"
1272 " --prompt-root-password Prompt the user for root password\n"
1273 " --prompt-root-shell Prompt the user for root shell\n"
1274 " --prompt Prompt for all of the above\n"
1275 " --copy-locale Copy locale from host\n"
1276 " --copy-keymap Copy keymap from host\n"
1277 " --copy-timezone Copy timezone from host\n"
1278 " --copy-root-password Copy root password from host\n"
1279 " --copy-root-shell Copy root shell from host\n"
1280 " --copy Copy locale, keymap, timezone, root password\n"
1281 " --force Overwrite existing files\n"
1282 " --delete-root-password Delete root password\n"
1283 " --welcome=no Disable the welcome text\n"
1284 " --reset Remove existing files\n"
1285 "\nSee the %s for details.\n",
1286 program_invocation_short_name,
1287 link);
1288
1289 return 0;
1290 }
1291
1292 static int parse_argv(int argc, char *argv[]) {
1293
1294 enum {
1295 ARG_VERSION = 0x100,
1296 ARG_ROOT,
1297 ARG_IMAGE,
1298 ARG_IMAGE_POLICY,
1299 ARG_LOCALE,
1300 ARG_LOCALE_MESSAGES,
1301 ARG_KEYMAP,
1302 ARG_TIMEZONE,
1303 ARG_HOSTNAME,
1304 ARG_SETUP_MACHINE_ID,
1305 ARG_MACHINE_ID,
1306 ARG_ROOT_PASSWORD,
1307 ARG_ROOT_PASSWORD_FILE,
1308 ARG_ROOT_PASSWORD_HASHED,
1309 ARG_ROOT_SHELL,
1310 ARG_KERNEL_COMMAND_LINE,
1311 ARG_PROMPT,
1312 ARG_PROMPT_LOCALE,
1313 ARG_PROMPT_KEYMAP,
1314 ARG_PROMPT_TIMEZONE,
1315 ARG_PROMPT_HOSTNAME,
1316 ARG_PROMPT_ROOT_PASSWORD,
1317 ARG_PROMPT_ROOT_SHELL,
1318 ARG_COPY,
1319 ARG_COPY_LOCALE,
1320 ARG_COPY_KEYMAP,
1321 ARG_COPY_TIMEZONE,
1322 ARG_COPY_ROOT_PASSWORD,
1323 ARG_COPY_ROOT_SHELL,
1324 ARG_FORCE,
1325 ARG_DELETE_ROOT_PASSWORD,
1326 ARG_WELCOME,
1327 ARG_RESET,
1328 };
1329
1330 static const struct option options[] = {
1331 { "help", no_argument, NULL, 'h' },
1332 { "version", no_argument, NULL, ARG_VERSION },
1333 { "root", required_argument, NULL, ARG_ROOT },
1334 { "image", required_argument, NULL, ARG_IMAGE },
1335 { "image-policy", required_argument, NULL, ARG_IMAGE_POLICY },
1336 { "locale", required_argument, NULL, ARG_LOCALE },
1337 { "locale-messages", required_argument, NULL, ARG_LOCALE_MESSAGES },
1338 { "keymap", required_argument, NULL, ARG_KEYMAP },
1339 { "timezone", required_argument, NULL, ARG_TIMEZONE },
1340 { "hostname", required_argument, NULL, ARG_HOSTNAME },
1341 { "setup-machine-id", no_argument, NULL, ARG_SETUP_MACHINE_ID },
1342 { "machine-id", required_argument, NULL, ARG_MACHINE_ID },
1343 { "root-password", required_argument, NULL, ARG_ROOT_PASSWORD },
1344 { "root-password-file", required_argument, NULL, ARG_ROOT_PASSWORD_FILE },
1345 { "root-password-hashed", required_argument, NULL, ARG_ROOT_PASSWORD_HASHED },
1346 { "root-shell", required_argument, NULL, ARG_ROOT_SHELL },
1347 { "kernel-command-line", required_argument, NULL, ARG_KERNEL_COMMAND_LINE },
1348 { "prompt", no_argument, NULL, ARG_PROMPT },
1349 { "prompt-locale", no_argument, NULL, ARG_PROMPT_LOCALE },
1350 { "prompt-keymap", no_argument, NULL, ARG_PROMPT_KEYMAP },
1351 { "prompt-timezone", no_argument, NULL, ARG_PROMPT_TIMEZONE },
1352 { "prompt-hostname", no_argument, NULL, ARG_PROMPT_HOSTNAME },
1353 { "prompt-root-password", no_argument, NULL, ARG_PROMPT_ROOT_PASSWORD },
1354 { "prompt-root-shell", no_argument, NULL, ARG_PROMPT_ROOT_SHELL },
1355 { "copy", no_argument, NULL, ARG_COPY },
1356 { "copy-locale", no_argument, NULL, ARG_COPY_LOCALE },
1357 { "copy-keymap", no_argument, NULL, ARG_COPY_KEYMAP },
1358 { "copy-timezone", no_argument, NULL, ARG_COPY_TIMEZONE },
1359 { "copy-root-password", no_argument, NULL, ARG_COPY_ROOT_PASSWORD },
1360 { "copy-root-shell", no_argument, NULL, ARG_COPY_ROOT_SHELL },
1361 { "force", no_argument, NULL, ARG_FORCE },
1362 { "delete-root-password", no_argument, NULL, ARG_DELETE_ROOT_PASSWORD },
1363 { "welcome", required_argument, NULL, ARG_WELCOME },
1364 { "reset", no_argument, NULL, ARG_RESET },
1365 {}
1366 };
1367
1368 int r, c;
1369
1370 assert(argc >= 0);
1371 assert(argv);
1372
1373 while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0)
1374
1375 switch (c) {
1376
1377 case 'h':
1378 return help();
1379
1380 case ARG_VERSION:
1381 return version();
1382
1383 case ARG_ROOT:
1384 r = parse_path_argument(optarg, true, &arg_root);
1385 if (r < 0)
1386 return r;
1387 break;
1388
1389 case ARG_IMAGE:
1390 r = parse_path_argument(optarg, false, &arg_image);
1391 if (r < 0)
1392 return r;
1393 break;
1394
1395 case ARG_IMAGE_POLICY:
1396 r = parse_image_policy_argument(optarg, &arg_image_policy);
1397 if (r < 0)
1398 return r;
1399 break;
1400
1401 case ARG_LOCALE:
1402 r = free_and_strdup(&arg_locale, optarg);
1403 if (r < 0)
1404 return log_oom();
1405
1406 break;
1407
1408 case ARG_LOCALE_MESSAGES:
1409 r = free_and_strdup(&arg_locale_messages, optarg);
1410 if (r < 0)
1411 return log_oom();
1412
1413 break;
1414
1415 case ARG_KEYMAP:
1416 if (!keymap_is_valid(optarg))
1417 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1418 "Keymap %s is not valid.", optarg);
1419
1420 r = free_and_strdup(&arg_keymap, optarg);
1421 if (r < 0)
1422 return log_oom();
1423
1424 break;
1425
1426 case ARG_TIMEZONE:
1427 if (!timezone_is_valid(optarg, LOG_ERR))
1428 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1429 "Timezone %s is not valid.", optarg);
1430
1431 r = free_and_strdup(&arg_timezone, optarg);
1432 if (r < 0)
1433 return log_oom();
1434
1435 break;
1436
1437 case ARG_ROOT_PASSWORD:
1438 r = free_and_strdup(&arg_root_password, optarg);
1439 if (r < 0)
1440 return log_oom();
1441
1442 arg_root_password_is_hashed = false;
1443 break;
1444
1445 case ARG_ROOT_PASSWORD_FILE:
1446 arg_root_password = mfree(arg_root_password);
1447
1448 r = read_one_line_file(optarg, &arg_root_password);
1449 if (r < 0)
1450 return log_error_errno(r, "Failed to read %s: %m", optarg);
1451
1452 arg_root_password_is_hashed = false;
1453 break;
1454
1455 case ARG_ROOT_PASSWORD_HASHED:
1456 r = free_and_strdup(&arg_root_password, optarg);
1457 if (r < 0)
1458 return log_oom();
1459
1460 arg_root_password_is_hashed = true;
1461 break;
1462
1463 case ARG_ROOT_SHELL:
1464 r = free_and_strdup(&arg_root_shell, optarg);
1465 if (r < 0)
1466 return log_oom();
1467
1468 break;
1469
1470 case ARG_HOSTNAME:
1471 if (!hostname_is_valid(optarg, VALID_HOSTNAME_TRAILING_DOT))
1472 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1473 "Host name %s is not valid.", optarg);
1474
1475 r = free_and_strdup(&arg_hostname, optarg);
1476 if (r < 0)
1477 return log_oom();
1478
1479 hostname_cleanup(arg_hostname);
1480 break;
1481
1482 case ARG_SETUP_MACHINE_ID:
1483 r = sd_id128_randomize(&arg_machine_id);
1484 if (r < 0)
1485 return log_error_errno(r, "Failed to generate randomized machine ID: %m");
1486
1487 break;
1488
1489 case ARG_MACHINE_ID:
1490 r = sd_id128_from_string(optarg, &arg_machine_id);
1491 if (r < 0)
1492 return log_error_errno(r, "Failed to parse machine id %s.", optarg);
1493
1494 break;
1495
1496 case ARG_KERNEL_COMMAND_LINE:
1497 r = free_and_strdup(&arg_kernel_cmdline, optarg);
1498 if (r < 0)
1499 return log_oom();
1500
1501 break;
1502
1503 case ARG_PROMPT:
1504 arg_prompt_locale = arg_prompt_keymap = arg_prompt_timezone = arg_prompt_hostname =
1505 arg_prompt_root_password = arg_prompt_root_shell = true;
1506 break;
1507
1508 case ARG_PROMPT_LOCALE:
1509 arg_prompt_locale = true;
1510 break;
1511
1512 case ARG_PROMPT_KEYMAP:
1513 arg_prompt_keymap = true;
1514 break;
1515
1516 case ARG_PROMPT_TIMEZONE:
1517 arg_prompt_timezone = true;
1518 break;
1519
1520 case ARG_PROMPT_HOSTNAME:
1521 arg_prompt_hostname = true;
1522 break;
1523
1524 case ARG_PROMPT_ROOT_PASSWORD:
1525 arg_prompt_root_password = true;
1526 break;
1527
1528 case ARG_PROMPT_ROOT_SHELL:
1529 arg_prompt_root_shell = true;
1530 break;
1531
1532 case ARG_COPY:
1533 arg_copy_locale = arg_copy_keymap = arg_copy_timezone = arg_copy_root_password =
1534 arg_copy_root_shell = true;
1535 break;
1536
1537 case ARG_COPY_LOCALE:
1538 arg_copy_locale = true;
1539 break;
1540
1541 case ARG_COPY_KEYMAP:
1542 arg_copy_keymap = true;
1543 break;
1544
1545 case ARG_COPY_TIMEZONE:
1546 arg_copy_timezone = true;
1547 break;
1548
1549 case ARG_COPY_ROOT_PASSWORD:
1550 arg_copy_root_password = true;
1551 break;
1552
1553 case ARG_COPY_ROOT_SHELL:
1554 arg_copy_root_shell = true;
1555 break;
1556
1557 case ARG_FORCE:
1558 arg_force = true;
1559 break;
1560
1561 case ARG_DELETE_ROOT_PASSWORD:
1562 arg_delete_root_password = true;
1563 break;
1564
1565 case ARG_WELCOME:
1566 r = parse_boolean(optarg);
1567 if (r < 0)
1568 return log_error_errno(r, "Failed to parse --welcome= argument: %s", optarg);
1569
1570 arg_welcome = r;
1571 break;
1572
1573 case ARG_RESET:
1574 arg_reset = true;
1575 break;
1576
1577 case '?':
1578 return -EINVAL;
1579
1580 default:
1581 assert_not_reached();
1582 }
1583
1584 if (arg_delete_root_password && (arg_copy_root_password || arg_root_password || arg_prompt_root_password))
1585 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1586 "--delete-root-password cannot be combined with other root password options.");
1587
1588 if (arg_image && arg_root)
1589 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1590 "--root= and --image= cannot be used together.");
1591
1592 if (!sd_id128_is_null(arg_machine_id) && !(arg_image || arg_root) && !arg_force)
1593 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
1594 "--machine-id=/--setup-machine-id only works with --root= or --image=.");
1595
1596 return 1;
1597 }
1598
1599 static int reload_system_manager(sd_bus **bus) {
1600 int r;
1601
1602 assert(bus);
1603
1604 if (!*bus) {
1605 r = bus_connect_transport_systemd(BUS_TRANSPORT_LOCAL, NULL, RUNTIME_SCOPE_SYSTEM, bus);
1606 if (r < 0)
1607 return bus_log_connect_error(r, BUS_TRANSPORT_LOCAL);
1608 }
1609
1610 r = bus_service_manager_reload(*bus);
1611 if (r < 0)
1612 return r;
1613
1614 log_info("Requested manager reload to apply locale configuration.");
1615 return 0;
1616 }
1617
1618 static int reload_vconsole(sd_bus **bus) {
1619 _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
1620 _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
1621 _cleanup_(bus_wait_for_jobs_freep) BusWaitForJobs *w = NULL;
1622 const char *object;
1623 int r;
1624
1625 assert(bus);
1626
1627 if (!*bus) {
1628 r = bus_connect_transport_systemd(BUS_TRANSPORT_LOCAL, NULL, RUNTIME_SCOPE_SYSTEM, bus);
1629 if (r < 0)
1630 return bus_log_connect_error(r, BUS_TRANSPORT_LOCAL);
1631 }
1632
1633 r = bus_wait_for_jobs_new(*bus, &w);
1634 if (r < 0)
1635 return log_error_errno(r, "Could not watch jobs: %m");
1636
1637 r = bus_call_method(*bus, bus_systemd_mgr, "RestartUnit", &error, &reply,
1638 "ss", "systemd-vconsole-setup.service", "replace");
1639 if (r < 0)
1640 return log_error_errno(r, "Failed to issue method call: %s", bus_error_message(&error, r));
1641
1642 r = sd_bus_message_read(reply, "o", &object);
1643 if (r < 0)
1644 return bus_log_parse_error(r);
1645
1646 r = bus_wait_for_jobs_one(w, object, BUS_WAIT_JOBS_LOG_ERROR, NULL);
1647 if (r < 0)
1648 return log_error_errno(r, "Failed to wait for systemd-vconsole-setup.service/restart: %m");
1649 return 0;
1650 }
1651
1652 static int run(int argc, char *argv[]) {
1653 _cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
1654 _cleanup_(loop_device_unrefp) LoopDevice *loop_device = NULL;
1655 _cleanup_(umount_and_freep) char *mounted_dir = NULL;
1656 _cleanup_close_ int rfd = -EBADF;
1657 int r;
1658
1659 r = parse_argv(argc, argv);
1660 if (r <= 0)
1661 return r;
1662
1663 log_setup();
1664
1665 umask(0022);
1666
1667 bool offline = arg_root || arg_image;
1668
1669 if (!offline) {
1670 /* If we are called without --root=/--image= let's honour the systemd.firstboot kernel
1671 * command line option, because we are called to provision the host with basic settings (as
1672 * opposed to some other file system tree/image) */
1673
1674 bool enabled;
1675 r = proc_cmdline_get_bool("systemd.firstboot", /* flags = */ 0, &enabled);
1676 if (r < 0)
1677 return log_error_errno(r, "Failed to parse systemd.firstboot= kernel command line argument, ignoring: %m");
1678 if (r > 0 && !enabled) {
1679 log_debug("Found systemd.firstboot=no kernel command line argument, turning off all prompts.");
1680 arg_prompt_locale = arg_prompt_keymap = arg_prompt_timezone = arg_prompt_hostname = arg_prompt_root_password = arg_prompt_root_shell = false;
1681 }
1682 }
1683
1684 if (arg_image) {
1685 assert(!arg_root);
1686
1687 r = mount_image_privately_interactively(
1688 arg_image,
1689 arg_image_policy,
1690 DISSECT_IMAGE_GENERIC_ROOT |
1691 DISSECT_IMAGE_REQUIRE_ROOT |
1692 DISSECT_IMAGE_VALIDATE_OS |
1693 DISSECT_IMAGE_RELAX_VAR_CHECK |
1694 DISSECT_IMAGE_FSCK |
1695 DISSECT_IMAGE_GROWFS |
1696 DISSECT_IMAGE_ALLOW_USERSPACE_VERITY,
1697 &mounted_dir,
1698 &rfd,
1699 &loop_device);
1700 if (r < 0)
1701 return r;
1702
1703 arg_root = strdup(mounted_dir);
1704 if (!arg_root)
1705 return log_oom();
1706 } else {
1707 rfd = open(empty_to_root(arg_root), O_DIRECTORY|O_CLOEXEC);
1708 if (rfd < 0)
1709 return log_error_errno(errno, "Failed to open %s: %m", empty_to_root(arg_root));
1710 }
1711
1712 LOG_SET_PREFIX(arg_image ?: arg_root);
1713
1714 /* We check these conditions here instead of in parse_argv() so that we can take the root directory
1715 * into account. */
1716
1717 if (arg_keymap && !determine_keymap_validity_func(rfd)(arg_keymap))
1718 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Keymap %s is not installed.", arg_keymap);
1719 if (arg_locale && !locale_is_ok(rfd, arg_locale))
1720 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Locale %s is not installed.", arg_locale);
1721 if (arg_locale_messages && !locale_is_ok(rfd, arg_locale_messages))
1722 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Locale %s is not installed.", arg_locale_messages);
1723
1724 if (arg_root_shell) {
1725 r = find_shell(rfd, arg_root_shell);
1726 if (r < 0)
1727 return r;
1728 }
1729
1730 r = process_reset(rfd);
1731 if (r < 0)
1732 return r;
1733
1734 r = process_locale(rfd);
1735 if (r < 0)
1736 return r;
1737 if (r > 0 && !offline)
1738 (void) reload_system_manager(&bus);
1739
1740 r = process_keymap(rfd);
1741 if (r < 0)
1742 return r;
1743 if (r > 0 && !offline)
1744 (void) reload_vconsole(&bus);
1745
1746 r = process_timezone(rfd);
1747 if (r < 0)
1748 return r;
1749
1750 r = process_hostname(rfd);
1751 if (r < 0)
1752 return r;
1753
1754 r = process_machine_id(rfd);
1755 if (r < 0)
1756 return r;
1757
1758 r = process_root_account(rfd);
1759 if (r < 0)
1760 return r;
1761
1762 r = process_kernel_cmdline(rfd);
1763 if (r < 0)
1764 return r;
1765
1766 return 0;
1767 }
1768
1769 DEFINE_MAIN_FUNCTION(run);
Unnamed repository; edit this file 'description' to name the repository.