src/resolve/resolved.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2014 Tom Gundersen <teg@jklm.no>
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include "sd-daemon.h"
  22 #include "sd-event.h"
  23
  24 #include "capability-util.h"
  25 #include "mkdir.h"
  26 #include "resolved-conf.h"
  27 #include "resolved-manager.h"
  28 #include "resolved-resolv-conf.h"
  29 #include "selinux-util.h"
  30 #include "signal-util.h"
  31 #include "user-util.h"
  32
  33 int main(int argc, char *argv[]) {
  34         _cleanup_(manager_freep) Manager *m = NULL;
  35         const char *user = "systemd-resolve";
  36         uid_t uid;
  37         gid_t gid;
  38         int r;
  39
  40         log_set_target(LOG_TARGET_AUTO);
  41         log_parse_environment();
  42         log_open();
  43
  44         if (argc != 1) {
  45                 log_error("This program takes no arguments.");
  46                 r = -EINVAL;
  47                 goto finish;
  48         }
  49
  50         umask(0022);
  51
  52         r = mac_selinux_init();
  53         if (r < 0) {
  54                 log_error_errno(r, "SELinux setup failed: %m");
  55                 goto finish;
  56         }
  57
  58         r = get_user_creds(&user, &uid, &gid, NULL, NULL);
  59         if (r < 0) {
  60                 log_error_errno(r, "Cannot resolve user name %s: %m", user);
  61                 goto finish;
  62         }
  63
  64         /* Always create the directory where resolv.conf will live */
  65         r = mkdir_safe_label("/run/systemd/resolve", 0755, uid, gid, false);
  66         if (r < 0) {
  67                 log_error_errno(r, "Could not create runtime directory: %m");
  68                 goto finish;
  69         }
  70
  71         /* Drop privileges, but only if we have been started as root. If we are not running as root we assume all
  72          * privileges are already dropped. */
  73         if (getuid() == 0) {
  74
  75                 /* Drop privileges, but keep three caps. Note that we drop those too, later on (see below) */
  76                 r = drop_privileges(uid, gid,
  77                                     (UINT64_C(1) << CAP_NET_RAW)|          /* needed for SO_BINDTODEVICE */
  78                                     (UINT64_C(1) << CAP_NET_BIND_SERVICE)| /* needed to bind on port 53 */
  79                                     (UINT64_C(1) << CAP_SETPCAP)           /* needed in order to drop the caps later */);
  80                 if (r < 0)
  81                         goto finish;
  82         }
  83
  84         assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGUSR1, SIGUSR2, SIGRTMIN+1, -1) >= 0);
  85
  86         r = manager_new(&m);
  87         if (r < 0) {
  88                 log_error_errno(r, "Could not create manager: %m");
  89                 goto finish;
  90         }
  91
  92         r = manager_start(m);
  93         if (r < 0) {
  94                 log_error_errno(r, "Failed to start manager: %m");
  95                 goto finish;
  96         }
  97
  98         /* Write finish default resolv.conf to avoid a dangling symlink */
  99         (void) manager_write_resolv_conf(m);
 100
 101         /* Let's drop the remaining caps now */
 102         r = capability_bounding_set_drop(0, true);
 103         if (r < 0) {
 104                 log_error_errno(r, "Failed to drop remaining caps: %m");
 105                 goto finish;
 106         }
 107
 108         sd_notify(false,
 109                   "READY=1\n"
 110                   "STATUS=Processing requests...");
 111
 112         r = sd_event_loop(m->event);
 113         if (r < 0) {
 114                 log_error_errno(r, "Event loop failed: %m");
 115                 goto finish;
 116         }
 117
 118         sd_event_get_exit_code(m->event, &r);
 119
 120 finish:
 121         sd_notify(false,
 122                   "STOPPING=1\n"
 123                   "STATUS=Shutting down...");
 124
 125         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
 126 }