src/journal/journald-syslog.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2011 Lennart Poettering
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include <stddef.h>
  22 #include <sys/epoll.h>
  23 #include <unistd.h>
  24
  25 #include "sd-messages.h"
  26
  27 #include "alloc-util.h"
  28 #include "fd-util.h"
  29 #include "format-util.h"
  30 #include "io-util.h"
  31 #include "journald-console.h"
  32 #include "journald-kmsg.h"
  33 #include "journald-server.h"
  34 #include "journald-syslog.h"
  35 #include "journald-wall.h"
  36 #include "process-util.h"
  37 #include "selinux-util.h"
  38 #include "socket-util.h"
  39 #include "stdio-util.h"
  40 #include "string-util.h"
  41 #include "syslog-util.h"
  42
  43 /* Warn once every 30s if we missed syslog message */
  44 #define WARN_FORWARD_SYSLOG_MISSED_USEC (30 * USEC_PER_SEC)
  45
  46 static void forward_syslog_iovec(Server *s, const struct iovec *iovec, unsigned n_iovec, const struct ucred *ucred, const struct timeval *tv) {
  47
  48         static const union sockaddr_union sa = {
  49                 .un.sun_family = AF_UNIX,
  50                 .un.sun_path = "/run/systemd/journal/syslog",
  51         };
  52         struct msghdr msghdr = {
  53                 .msg_iov = (struct iovec *) iovec,
  54                 .msg_iovlen = n_iovec,
  55                 .msg_name = (struct sockaddr*) &sa.sa,
  56                 .msg_namelen = SOCKADDR_UN_LEN(sa.un),
  57         };
  58         struct cmsghdr *cmsg;
  59         union {
  60                 struct cmsghdr cmsghdr;
  61                 uint8_t buf[CMSG_SPACE(sizeof(struct ucred))];
  62         } control;
  63
  64         assert(s);
  65         assert(iovec);
  66         assert(n_iovec > 0);
  67
  68         if (ucred) {
  69                 zero(control);
  70                 msghdr.msg_control = &control;
  71                 msghdr.msg_controllen = sizeof(control);
  72
  73                 cmsg = CMSG_FIRSTHDR(&msghdr);
  74                 cmsg->cmsg_level = SOL_SOCKET;
  75                 cmsg->cmsg_type = SCM_CREDENTIALS;
  76                 cmsg->cmsg_len = CMSG_LEN(sizeof(struct ucred));
  77                 memcpy(CMSG_DATA(cmsg), ucred, sizeof(struct ucred));
  78                 msghdr.msg_controllen = cmsg->cmsg_len;
  79         }
  80
  81         /* Forward the syslog message we received via /dev/log to
  82          * /run/systemd/syslog. Unfortunately we currently can't set
  83          * the SO_TIMESTAMP auxiliary data, and hence we don't. */
  84
  85         if (sendmsg(s->syslog_fd, &msghdr, MSG_NOSIGNAL) >= 0)
  86                 return;
  87
  88         /* The socket is full? I guess the syslog implementation is
  89          * too slow, and we shouldn't wait for that... */
  90         if (errno == EAGAIN) {
  91                 s->n_forward_syslog_missed++;
  92                 return;
  93         }
  94
  95         if (ucred && IN_SET(errno, ESRCH, EPERM)) {
  96                 struct ucred u;
  97
  98                 /* Hmm, presumably the sender process vanished
  99                  * by now, or we don't have CAP_SYS_AMDIN, so
 100                  * let's fix it as good as we can, and retry */
 101
 102                 u = *ucred;
 103                 u.pid = getpid_cached();
 104                 memcpy(CMSG_DATA(cmsg), &u, sizeof(struct ucred));
 105
 106                 if (sendmsg(s->syslog_fd, &msghdr, MSG_NOSIGNAL) >= 0)
 107                         return;
 108
 109                 if (errno == EAGAIN) {
 110                         s->n_forward_syslog_missed++;
 111                         return;
 112                 }
 113         }
 114
 115         if (errno != ENOENT)
 116                 log_debug_errno(errno, "Failed to forward syslog message: %m");
 117 }
 118
 119 static void forward_syslog_raw(Server *s, int priority, const char *buffer, const struct ucred *ucred, const struct timeval *tv) {
 120         struct iovec iovec;
 121
 122         assert(s);
 123         assert(buffer);
 124
 125         if (LOG_PRI(priority) > s->max_level_syslog)
 126                 return;
 127
 128         iovec = IOVEC_MAKE_STRING(buffer);
 129         forward_syslog_iovec(s, &iovec, 1, ucred, tv);
 130 }
 131
 132 void server_forward_syslog(Server *s, int priority, const char *identifier, const char *message, const struct ucred *ucred, const struct timeval *tv) {
 133         struct iovec iovec[5];
 134         char header_priority[DECIMAL_STR_MAX(priority) + 3], header_time[64],
 135              header_pid[sizeof("[]: ")-1 + DECIMAL_STR_MAX(pid_t) + 1];
 136         int n = 0;
 137         time_t t;
 138         struct tm *tm;
 139         _cleanup_free_ char *ident_buf = NULL;
 140
 141         assert(s);
 142         assert(priority >= 0);
 143         assert(priority <= 999);
 144         assert(message);
 145
 146         if (LOG_PRI(priority) > s->max_level_syslog)
 147                 return;
 148
 149         /* First: priority field */
 150         xsprintf(header_priority, "<%i>", priority);
 151         iovec[n++] = IOVEC_MAKE_STRING(header_priority);
 152
 153         /* Second: timestamp */
 154         t = tv ? tv->tv_sec : ((time_t) (now(CLOCK_REALTIME) / USEC_PER_SEC));
 155         tm = localtime(&t);
 156         if (!tm)
 157                 return;
 158         if (strftime(header_time, sizeof(header_time), "%h %e %T ", tm) <= 0)
 159                 return;
 160         iovec[n++] = IOVEC_MAKE_STRING(header_time);
 161
 162         /* Third: identifier and PID */
 163         if (ucred) {
 164                 if (!identifier) {
 165                         get_process_comm(ucred->pid, &ident_buf);
 166                         identifier = ident_buf;
 167                 }
 168
 169                 xsprintf(header_pid, "["PID_FMT"]: ", ucred->pid);
 170
 171                 if (identifier)
 172                         iovec[n++] = IOVEC_MAKE_STRING(identifier);
 173
 174                 iovec[n++] = IOVEC_MAKE_STRING(header_pid);
 175         } else if (identifier) {
 176                 iovec[n++] = IOVEC_MAKE_STRING(identifier);
 177                 iovec[n++] = IOVEC_MAKE_STRING(": ");
 178         }
 179
 180         /* Fourth: message */
 181         iovec[n++] = IOVEC_MAKE_STRING(message);
 182
 183         forward_syslog_iovec(s, iovec, n, ucred, tv);
 184 }
 185
 186 int syslog_fixup_facility(int priority) {
 187
 188         if ((priority & LOG_FACMASK) == 0)
 189                 return (priority & LOG_PRIMASK) | LOG_USER;
 190
 191         return priority;
 192 }
 193
 194 size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid) {
 195         const char *p;
 196         char *t;
 197         size_t l, e;
 198
 199         assert(buf);
 200         assert(identifier);
 201         assert(pid);
 202
 203         p = *buf;
 204
 205         p += strspn(p, WHITESPACE);
 206         l = strcspn(p, WHITESPACE);
 207
 208         if (l <= 0 ||
 209             p[l-1] != ':')
 210                 return 0;
 211
 212         e = l;
 213         l--;
 214
 215         if (p[l-1] == ']') {
 216                 size_t k = l-1;
 217
 218                 for (;;) {
 219
 220                         if (p[k] == '[') {
 221                                 t = strndup(p+k+1, l-k-2);
 222                                 if (t)
 223                                         *pid = t;
 224
 225                                 l = k;
 226                                 break;
 227                         }
 228
 229                         if (k == 0)
 230                                 break;
 231
 232                         k--;
 233                 }
 234         }
 235
 236         t = strndup(p, l);
 237         if (t)
 238                 *identifier = t;
 239
 240         if (strchr(WHITESPACE, p[e]))
 241                 e++;
 242         *buf = p + e;
 243         return e;
 244 }
 245
 246 static void syslog_skip_date(char **buf) {
 247         enum {
 248                 LETTER,
 249                 SPACE,
 250                 NUMBER,
 251                 SPACE_OR_NUMBER,
 252                 COLON
 253         } sequence[] = {
 254                 LETTER, LETTER, LETTER,
 255                 SPACE,
 256                 SPACE_OR_NUMBER, NUMBER,
 257                 SPACE,
 258                 SPACE_OR_NUMBER, NUMBER,
 259                 COLON,
 260                 SPACE_OR_NUMBER, NUMBER,
 261                 COLON,
 262                 SPACE_OR_NUMBER, NUMBER,
 263                 SPACE
 264         };
 265
 266         char *p;
 267         unsigned i;
 268
 269         assert(buf);
 270         assert(*buf);
 271
 272         p = *buf;
 273
 274         for (i = 0; i < ELEMENTSOF(sequence); i++, p++) {
 275
 276                 if (!*p)
 277                         return;
 278
 279                 switch (sequence[i]) {
 280
 281                 case SPACE:
 282                         if (*p != ' ')
 283                                 return;
 284                         break;
 285
 286                 case SPACE_OR_NUMBER:
 287                         if (*p == ' ')
 288                                 break;
 289
 290                         _fallthrough_;
 291                 case NUMBER:
 292                         if (*p < '0' || *p > '9')
 293                                 return;
 294
 295                         break;
 296
 297                 case LETTER:
 298                         if (!(*p >= 'A' && *p <= 'Z') &&
 299                             !(*p >= 'a' && *p <= 'z'))
 300                                 return;
 301
 302                         break;
 303
 304                 case COLON:
 305                         if (*p != ':')
 306                                 return;
 307                         break;
 308
 309                 }
 310         }
 311
 312         *buf = p;
 313 }
 314
 315 void server_process_syslog_message(
 316                 Server *s,
 317                 const char *buf,
 318                 const struct ucred *ucred,
 319                 const struct timeval *tv,
 320                 const char *label,
 321                 size_t label_len) {
 322
 323         char syslog_priority[sizeof("PRIORITY=") + DECIMAL_STR_MAX(int)],
 324              syslog_facility[sizeof("SYSLOG_FACILITY=") + DECIMAL_STR_MAX(int)];
 325         const char *message = NULL, *syslog_identifier = NULL, *syslog_pid = NULL;
 326         _cleanup_free_ char *identifier = NULL, *pid = NULL;
 327         int priority = LOG_USER | LOG_INFO, r;
 328         ClientContext *context = NULL;
 329         struct iovec *iovec;
 330         const char *orig;
 331         size_t n = 0, m;
 332
 333         assert(s);
 334         assert(buf);
 335
 336         if (ucred && pid_is_valid(ucred->pid)) {
 337                 r = client_context_get(s, ucred->pid, ucred, label, label_len, NULL, &context);
 338                 if (r < 0)
 339                         log_warning_errno(r, "Failed to retrieve credentials for PID " PID_FMT ", ignoring: %m", ucred->pid);
 340         }
 341
 342         orig = buf;
 343         syslog_parse_priority(&buf, &priority, true);
 344
 345         if (!client_context_test_priority(context, priority))
 346                 return;
 347
 348         if (s->forward_to_syslog)
 349                 forward_syslog_raw(s, priority, orig, ucred, tv);
 350
 351         syslog_skip_date((char**) &buf);
 352         syslog_parse_identifier(&buf, &identifier, &pid);
 353
 354         if (s->forward_to_kmsg)
 355                 server_forward_kmsg(s, priority, identifier, buf, ucred);
 356
 357         if (s->forward_to_console)
 358                 server_forward_console(s, priority, identifier, buf, ucred);
 359
 360         if (s->forward_to_wall)
 361                 server_forward_wall(s, priority, identifier, buf, ucred);
 362
 363         m = N_IOVEC_META_FIELDS + 6 + client_context_extra_fields_n_iovec(context);
 364         iovec = newa(struct iovec, m);
 365
 366         iovec[n++] = IOVEC_MAKE_STRING("_TRANSPORT=syslog");
 367
 368         xsprintf(syslog_priority, "PRIORITY=%i", priority & LOG_PRIMASK);
 369         iovec[n++] = IOVEC_MAKE_STRING(syslog_priority);
 370
 371         if (priority & LOG_FACMASK) {
 372                 xsprintf(syslog_facility, "SYSLOG_FACILITY=%i", LOG_FAC(priority));
 373                 iovec[n++] = IOVEC_MAKE_STRING(syslog_facility);
 374         }
 375
 376         if (identifier) {
 377                 syslog_identifier = strjoina("SYSLOG_IDENTIFIER=", identifier);
 378                 iovec[n++] = IOVEC_MAKE_STRING(syslog_identifier);
 379         }
 380
 381         if (pid) {
 382                 syslog_pid = strjoina("SYSLOG_PID=", pid);
 383                 iovec[n++] = IOVEC_MAKE_STRING(syslog_pid);
 384         }
 385
 386         message = strjoina("MESSAGE=", buf);
 387         if (message)
 388                 iovec[n++] = IOVEC_MAKE_STRING(message);
 389
 390         server_dispatch_message(s, iovec, n, m, context, tv, priority, 0);
 391 }
 392
 393 int server_open_syslog_socket(Server *s) {
 394
 395         static const union sockaddr_union sa = {
 396                 .un.sun_family = AF_UNIX,
 397                 .un.sun_path = "/run/systemd/journal/dev-log",
 398         };
 399         static const int one = 1;
 400         int r;
 401
 402         assert(s);
 403
 404         if (s->syslog_fd < 0) {
 405                 s->syslog_fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 406                 if (s->syslog_fd < 0)
 407                         return log_error_errno(errno, "socket() failed: %m");
 408
 409                 (void) unlink(sa.un.sun_path);
 410
 411                 r = bind(s->syslog_fd, &sa.sa, SOCKADDR_UN_LEN(sa.un));
 412                 if (r < 0)
 413                         return log_error_errno(errno, "bind(%s) failed: %m", sa.un.sun_path);
 414
 415                 (void) chmod(sa.un.sun_path, 0666);
 416         } else
 417                 fd_nonblock(s->syslog_fd, 1);
 418
 419         r = setsockopt(s->syslog_fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one));
 420         if (r < 0)
 421                 return log_error_errno(errno, "SO_PASSCRED failed: %m");
 422
 423 #if HAVE_SELINUX
 424         if (mac_selinux_use()) {
 425                 r = setsockopt(s->syslog_fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one));
 426                 if (r < 0)
 427                         log_warning_errno(errno, "SO_PASSSEC failed: %m");
 428         }
 429 #endif
 430
 431         r = setsockopt(s->syslog_fd, SOL_SOCKET, SO_TIMESTAMP, &one, sizeof(one));
 432         if (r < 0)
 433                 return log_error_errno(errno, "SO_TIMESTAMP failed: %m");
 434
 435         r = sd_event_add_io(s->event, &s->syslog_event_source, s->syslog_fd, EPOLLIN, server_process_datagram, s);
 436         if (r < 0)
 437                 return log_error_errno(r, "Failed to add syslog server fd to event loop: %m");
 438
 439         r = sd_event_source_set_priority(s->syslog_event_source, SD_EVENT_PRIORITY_NORMAL+5);
 440         if (r < 0)
 441                 return log_error_errno(r, "Failed to adjust syslog event source priority: %m");
 442
 443         return 0;
 444 }
 445
 446 void server_maybe_warn_forward_syslog_missed(Server *s) {
 447         usec_t n;
 448
 449         assert(s);
 450
 451         if (s->n_forward_syslog_missed <= 0)
 452                 return;
 453
 454         n = now(CLOCK_MONOTONIC);
 455         if (s->last_warn_forward_syslog_missed + WARN_FORWARD_SYSLOG_MISSED_USEC > n)
 456                 return;
 457
 458         server_driver_message(s, 0,
 459                               "MESSAGE_ID=" SD_MESSAGE_FORWARD_SYSLOG_MISSED_STR,
 460                               LOG_MESSAGE("Forwarding to syslog missed %u messages.",
 461                                           s->n_forward_syslog_missed),
 462                               NULL);
 463
 464         s->n_forward_syslog_missed = 0;
 465         s->last_warn_forward_syslog_missed = n;
 466 }