src/shared/condition.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <fnmatch.h>
   6 #include <limits.h>
   7 #include <stdlib.h>
   8 #include <string.h>
   9 #include <sys/stat.h>
  10 #include <sys/types.h>
  11 #include <sys/utsname.h>
  12 #include <time.h>
  13 #include <unistd.h>
  14
  15 #include "sd-id128.h"
  16
  17 #include "alloc-util.h"
  18 #include "apparmor-util.h"
  19 #include "architecture.h"
  20 #include "audit-util.h"
  21 #include "cap-list.h"
  22 #include "cgroup-util.h"
  23 #include "condition.h"
  24 #include "cpu-set-util.h"
  25 #include "efivars.h"
  26 #include "env-file.h"
  27 #include "extract-word.h"
  28 #include "fd-util.h"
  29 #include "fileio.h"
  30 #include "glob-util.h"
  31 #include "hostname-util.h"
  32 #include "ima-util.h"
  33 #include "limits-util.h"
  34 #include "list.h"
  35 #include "macro.h"
  36 #include "mountpoint-util.h"
  37 #include "parse-util.h"
  38 #include "path-util.h"
  39 #include "proc-cmdline.h"
  40 #include "process-util.h"
  41 #include "selinux-util.h"
  42 #include "smack-util.h"
  43 #include "stat-util.h"
  44 #include "string-table.h"
  45 #include "string-util.h"
  46 #include "tomoyo-util.h"
  47 #include "user-util.h"
  48 #include "util.h"
  49 #include "virt.h"
  50
  51 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
  52         Condition *c;
  53
  54         assert(type >= 0);
  55         assert(type < _CONDITION_TYPE_MAX);
  56         assert((!parameter) == (type == CONDITION_NULL));
  57
  58         c = new(Condition, 1);
  59         if (!c)
  60                 return NULL;
  61
  62         *c = (Condition) {
  63                 .type = type,
  64                 .trigger = trigger,
  65                 .negate = negate,
  66         };
  67
  68         if (parameter) {
  69                 c->parameter = strdup(parameter);
  70                 if (!c->parameter)
  71                         return mfree(c);
  72         }
  73
  74         return c;
  75 }
  76
  77 void condition_free(Condition *c) {
  78         assert(c);
  79
  80         free(c->parameter);
  81         free(c);
  82 }
  83
  84 Condition* condition_free_list_type(Condition *head, ConditionType type) {
  85         Condition *c, *n;
  86
  87         LIST_FOREACH_SAFE(conditions, c, n, head)
  88                 if (type < 0 || c->type == type) {
  89                         LIST_REMOVE(conditions, head, c);
  90                         condition_free(c);
  91                 }
  92
  93         assert(type >= 0 || !head);
  94         return head;
  95 }
  96
  97 static int condition_test_kernel_command_line(Condition *c) {
  98         _cleanup_free_ char *line = NULL;
  99         const char *p;
 100         bool equal;
 101         int r;
 102
 103         assert(c);
 104         assert(c->parameter);
 105         assert(c->type == CONDITION_KERNEL_COMMAND_LINE);
 106
 107         r = proc_cmdline(&line);
 108         if (r < 0)
 109                 return r;
 110
 111         equal = strchr(c->parameter, '=');
 112
 113         for (p = line;;) {
 114                 _cleanup_free_ char *word = NULL;
 115                 bool found;
 116
 117                 r = extract_first_word(&p, &word, NULL, EXTRACT_QUOTES|EXTRACT_RELAX);
 118                 if (r < 0)
 119                         return r;
 120                 if (r == 0)
 121                         break;
 122
 123                 if (equal)
 124                         found = streq(word, c->parameter);
 125                 else {
 126                         const char *f;
 127
 128                         f = startswith(word, c->parameter);
 129                         found = f && IN_SET(*f, 0, '=');
 130                 }
 131
 132                 if (found)
 133                         return true;
 134         }
 135
 136         return false;
 137 }
 138
 139 typedef enum {
 140         /* Listed in order of checking. Note that some comparators are prefixes of others, hence the longest
 141          * should be listed first. */
 142         ORDER_LOWER_OR_EQUAL,
 143         ORDER_GREATER_OR_EQUAL,
 144         ORDER_LOWER,
 145         ORDER_GREATER,
 146         ORDER_EQUAL,
 147         ORDER_UNEQUAL,
 148         _ORDER_MAX,
 149         _ORDER_INVALID = -1
 150 } OrderOperator;
 151
 152 static OrderOperator parse_order(const char **s) {
 153
 154         static const char *const prefix[_ORDER_MAX] = {
 155                 [ORDER_LOWER_OR_EQUAL] = "<=",
 156                 [ORDER_GREATER_OR_EQUAL] = ">=",
 157                 [ORDER_LOWER] = "<",
 158                 [ORDER_GREATER] = ">",
 159                 [ORDER_EQUAL] = "=",
 160                 [ORDER_UNEQUAL] = "!=",
 161         };
 162
 163         OrderOperator i;
 164
 165         for (i = 0; i < _ORDER_MAX; i++) {
 166                 const char *e;
 167
 168                 e = startswith(*s, prefix[i]);
 169                 if (e) {
 170                         *s = e;
 171                         return i;
 172                 }
 173         }
 174
 175         return _ORDER_INVALID;
 176 }
 177
 178 static bool test_order(int k, OrderOperator p) {
 179
 180         switch (p) {
 181
 182         case ORDER_LOWER:
 183                 return k < 0;
 184
 185         case ORDER_LOWER_OR_EQUAL:
 186                 return k <= 0;
 187
 188         case ORDER_EQUAL:
 189                 return k == 0;
 190
 191         case ORDER_UNEQUAL:
 192                 return k != 0;
 193
 194         case ORDER_GREATER_OR_EQUAL:
 195                 return k >= 0;
 196
 197         case ORDER_GREATER:
 198                 return k > 0;
 199
 200         default:
 201                 assert_not_reached("unknown order");
 202
 203         }
 204 }
 205
 206 static int condition_test_kernel_version(Condition *c) {
 207         OrderOperator order;
 208         struct utsname u;
 209         const char *p;
 210
 211         assert(c);
 212         assert(c->parameter);
 213         assert(c->type == CONDITION_KERNEL_VERSION);
 214
 215         assert_se(uname(&u) >= 0);
 216
 217         p = c->parameter;
 218         order = parse_order(&p);
 219
 220         /* No prefix? Then treat as glob string */
 221         if (order < 0)
 222                 return fnmatch(skip_leading_chars(c->parameter, NULL), u.release, 0) == 0;
 223
 224         return test_order(str_verscmp(u.release, skip_leading_chars(p, NULL)), order);
 225 }
 226
 227 static int condition_test_memory(Condition *c) {
 228         OrderOperator order;
 229         uint64_t m, k;
 230         const char *p;
 231         int r;
 232
 233         assert(c);
 234         assert(c->parameter);
 235         assert(c->type == CONDITION_MEMORY);
 236
 237         m = physical_memory();
 238
 239         p = c->parameter;
 240         order = parse_order(&p);
 241         if (order < 0)
 242                 order = ORDER_GREATER_OR_EQUAL; /* default to >= check, if nothing is specified. */
 243
 244         r = safe_atou64(p, &k);
 245         if (r < 0)
 246                 return log_debug_errno(r, "Failed to parse size: %m");
 247
 248         return test_order(CMP(m, k), order);
 249 }
 250
 251 static int condition_test_cpus(Condition *c) {
 252         OrderOperator order;
 253         const char *p;
 254         unsigned k;
 255         int r, n;
 256
 257         assert(c);
 258         assert(c->parameter);
 259         assert(c->type == CONDITION_CPUS);
 260
 261         n = cpus_in_affinity_mask();
 262         if (n < 0)
 263                 return log_debug_errno(n, "Failed to determine CPUs in affinity mask: %m");
 264
 265         p = c->parameter;
 266         order = parse_order(&p);
 267         if (order < 0)
 268                 order = ORDER_GREATER_OR_EQUAL; /* default to >= check, if nothing is specified. */
 269
 270         r = safe_atou(p, &k);
 271         if (r < 0)
 272                 return log_debug_errno(r, "Failed to parse number of CPUs: %m");
 273
 274         return test_order(CMP((unsigned) n, k), order);
 275 }
 276
 277 static int condition_test_user(Condition *c) {
 278         uid_t id;
 279         int r;
 280         _cleanup_free_ char *username = NULL;
 281         const char *u;
 282
 283         assert(c);
 284         assert(c->parameter);
 285         assert(c->type == CONDITION_USER);
 286
 287         r = parse_uid(c->parameter, &id);
 288         if (r >= 0)
 289                 return id == getuid() || id == geteuid();
 290
 291         if (streq("@system", c->parameter))
 292                 return uid_is_system(getuid()) || uid_is_system(geteuid());
 293
 294         username = getusername_malloc();
 295         if (!username)
 296                 return -ENOMEM;
 297
 298         if (streq(username, c->parameter))
 299                 return 1;
 300
 301         if (getpid_cached() == 1)
 302                 return streq(c->parameter, "root");
 303
 304         u = c->parameter;
 305         r = get_user_creds(&u, &id, NULL, NULL, NULL, USER_CREDS_ALLOW_MISSING);
 306         if (r < 0)
 307                 return 0;
 308
 309         return id == getuid() || id == geteuid();
 310 }
 311
 312 static int condition_test_control_group_controller(Condition *c) {
 313         int r;
 314         CGroupMask system_mask, wanted_mask = 0;
 315
 316         assert(c);
 317         assert(c->parameter);
 318         assert(c->type == CONDITION_CONTROL_GROUP_CONTROLLER);
 319
 320         r = cg_mask_supported(&system_mask);
 321         if (r < 0)
 322                 return log_debug_errno(r, "Failed to determine supported controllers: %m");
 323
 324         r = cg_mask_from_string(c->parameter, &wanted_mask);
 325         if (r < 0 || wanted_mask <= 0) {
 326                 /* This won't catch the case that we have an unknown controller
 327                  * mixed in with valid ones -- these are only assessed on the
 328                  * validity of the valid controllers found. */
 329                 log_debug("Failed to parse cgroup string: %s", c->parameter);
 330                 return 1;
 331         }
 332
 333         return FLAGS_SET(system_mask, wanted_mask);
 334 }
 335
 336 static int condition_test_group(Condition *c) {
 337         gid_t id;
 338         int r;
 339
 340         assert(c);
 341         assert(c->parameter);
 342         assert(c->type == CONDITION_GROUP);
 343
 344         r = parse_gid(c->parameter, &id);
 345         if (r >= 0)
 346                 return in_gid(id);
 347
 348         /* Avoid any NSS lookups if we are PID1 */
 349         if (getpid_cached() == 1)
 350                 return streq(c->parameter, "root");
 351
 352         return in_group(c->parameter) > 0;
 353 }
 354
 355 static int condition_test_virtualization(Condition *c) {
 356         int b, v;
 357
 358         assert(c);
 359         assert(c->parameter);
 360         assert(c->type == CONDITION_VIRTUALIZATION);
 361
 362         if (streq(c->parameter, "private-users"))
 363                 return running_in_userns();
 364
 365         v = detect_virtualization();
 366         if (v < 0)
 367                 return v;
 368
 369         /* First, compare with yes/no */
 370         b = parse_boolean(c->parameter);
 371         if (b >= 0)
 372                 return b == !!v;
 373
 374         /* Then, compare categorization */
 375         if (streq(c->parameter, "vm"))
 376                 return VIRTUALIZATION_IS_VM(v);
 377
 378         if (streq(c->parameter, "container"))
 379                 return VIRTUALIZATION_IS_CONTAINER(v);
 380
 381         /* Finally compare id */
 382         return v != VIRTUALIZATION_NONE && streq(c->parameter, virtualization_to_string(v));
 383 }
 384
 385 static int condition_test_architecture(Condition *c) {
 386         int a, b;
 387
 388         assert(c);
 389         assert(c->parameter);
 390         assert(c->type == CONDITION_ARCHITECTURE);
 391
 392         a = uname_architecture();
 393         if (a < 0)
 394                 return a;
 395
 396         if (streq(c->parameter, "native"))
 397                 b = native_architecture();
 398         else {
 399                 b = architecture_from_string(c->parameter);
 400                 if (b < 0) /* unknown architecture? Then it's definitely not ours */
 401                         return false;
 402         }
 403
 404         return a == b;
 405 }
 406
 407 static int condition_test_host(Condition *c) {
 408         _cleanup_free_ char *h = NULL;
 409         sd_id128_t x, y;
 410         int r;
 411
 412         assert(c);
 413         assert(c->parameter);
 414         assert(c->type == CONDITION_HOST);
 415
 416         if (sd_id128_from_string(c->parameter, &x) >= 0) {
 417
 418                 r = sd_id128_get_machine(&y);
 419                 if (r < 0)
 420                         return r;
 421
 422                 return sd_id128_equal(x, y);
 423         }
 424
 425         h = gethostname_malloc();
 426         if (!h)
 427                 return -ENOMEM;
 428
 429         return fnmatch(c->parameter, h, FNM_CASEFOLD) == 0;
 430 }
 431
 432 static int condition_test_ac_power(Condition *c) {
 433         int r;
 434
 435         assert(c);
 436         assert(c->parameter);
 437         assert(c->type == CONDITION_AC_POWER);
 438
 439         r = parse_boolean(c->parameter);
 440         if (r < 0)
 441                 return r;
 442
 443         return (on_ac_power() != 0) == !!r;
 444 }
 445
 446 static int condition_test_security(Condition *c) {
 447         assert(c);
 448         assert(c->parameter);
 449         assert(c->type == CONDITION_SECURITY);
 450
 451         if (streq(c->parameter, "selinux"))
 452                 return mac_selinux_use();
 453         if (streq(c->parameter, "smack"))
 454                 return mac_smack_use();
 455         if (streq(c->parameter, "apparmor"))
 456                 return mac_apparmor_use();
 457         if (streq(c->parameter, "audit"))
 458                 return use_audit();
 459         if (streq(c->parameter, "ima"))
 460                 return use_ima();
 461         if (streq(c->parameter, "tomoyo"))
 462                 return mac_tomoyo_use();
 463         if (streq(c->parameter, "uefi-secureboot"))
 464                 return is_efi_secure_boot();
 465
 466         return false;
 467 }
 468
 469 static int condition_test_capability(Condition *c) {
 470         unsigned long long capabilities = (unsigned long long) -1;
 471         _cleanup_fclose_ FILE *f = NULL;
 472         int value, r;
 473
 474         assert(c);
 475         assert(c->parameter);
 476         assert(c->type == CONDITION_CAPABILITY);
 477
 478         /* If it's an invalid capability, we don't have it */
 479         value = capability_from_name(c->parameter);
 480         if (value < 0)
 481                 return -EINVAL;
 482
 483         /* If it's a valid capability we default to assume
 484          * that we have it */
 485
 486         f = fopen("/proc/self/status", "re");
 487         if (!f)
 488                 return -errno;
 489
 490         for (;;) {
 491                 _cleanup_free_ char *line = NULL;
 492                 const char *p;
 493
 494                 r = read_line(f, LONG_LINE_MAX, &line);
 495                 if (r < 0)
 496                         return r;
 497                 if (r == 0)
 498                         break;
 499
 500                 p = startswith(line, "CapBnd:");
 501                 if (p) {
 502                         if (sscanf(line+7, "%llx", &capabilities) != 1)
 503                                 return -EIO;
 504
 505                         break;
 506                 }
 507         }
 508
 509         return !!(capabilities & (1ULL << value));
 510 }
 511
 512 static int condition_test_needs_update(Condition *c) {
 513         const char *p;
 514         struct stat usr, other;
 515
 516         assert(c);
 517         assert(c->parameter);
 518         assert(c->type == CONDITION_NEEDS_UPDATE);
 519
 520         /* If the file system is read-only we shouldn't suggest an update */
 521         if (path_is_read_only_fs(c->parameter) > 0)
 522                 return false;
 523
 524         /* Any other failure means we should allow the condition to be true,
 525          * so that we rather invoke too many update tools than too
 526          * few. */
 527
 528         if (!path_is_absolute(c->parameter))
 529                 return true;
 530
 531         p = strjoina(c->parameter, "/.updated");
 532         if (lstat(p, &other) < 0)
 533                 return true;
 534
 535         if (lstat("/usr/", &usr) < 0)
 536                 return true;
 537
 538         /*
 539          * First, compare seconds as they are always accurate...
 540          */
 541         if (usr.st_mtim.tv_sec != other.st_mtim.tv_sec)
 542                 return usr.st_mtim.tv_sec > other.st_mtim.tv_sec;
 543
 544         /*
 545          * ...then compare nanoseconds.
 546          *
 547          * A false positive is only possible when /usr's nanoseconds > 0
 548          * (otherwise /usr cannot be strictly newer than the target file)
 549          * AND the target file's nanoseconds == 0
 550          * (otherwise the filesystem supports nsec timestamps, see stat(2)).
 551          */
 552         if (usr.st_mtim.tv_nsec > 0 && other.st_mtim.tv_nsec == 0) {
 553                 _cleanup_free_ char *timestamp_str = NULL;
 554                 uint64_t timestamp;
 555                 int r;
 556
 557                 r = parse_env_file(NULL, p, "TIMESTAMP_NSEC", &timestamp_str);
 558                 if (r < 0) {
 559                         log_error_errno(r, "Failed to parse timestamp file '%s', using mtime: %m", p);
 560                         return true;
 561                 } else if (r == 0) {
 562                         log_debug("No data in timestamp file '%s', using mtime", p);
 563                         return true;
 564                 }
 565
 566                 r = safe_atou64(timestamp_str, &timestamp);
 567                 if (r < 0) {
 568                         log_error_errno(r, "Failed to parse timestamp value '%s' in file '%s', using mtime: %m", timestamp_str, p);
 569                         return true;
 570                 }
 571
 572                 timespec_store(&other.st_mtim, timestamp);
 573         }
 574
 575         return usr.st_mtim.tv_nsec > other.st_mtim.tv_nsec;
 576 }
 577
 578 static int condition_test_first_boot(Condition *c) {
 579         int r;
 580
 581         assert(c);
 582         assert(c->parameter);
 583         assert(c->type == CONDITION_FIRST_BOOT);
 584
 585         r = parse_boolean(c->parameter);
 586         if (r < 0)
 587                 return r;
 588
 589         return (access("/run/systemd/first-boot", F_OK) >= 0) == !!r;
 590 }
 591
 592 static int condition_test_path_exists(Condition *c) {
 593         assert(c);
 594         assert(c->parameter);
 595         assert(c->type == CONDITION_PATH_EXISTS);
 596
 597         return access(c->parameter, F_OK) >= 0;
 598 }
 599
 600 static int condition_test_path_exists_glob(Condition *c) {
 601         assert(c);
 602         assert(c->parameter);
 603         assert(c->type == CONDITION_PATH_EXISTS_GLOB);
 604
 605         return glob_exists(c->parameter) > 0;
 606 }
 607
 608 static int condition_test_path_is_directory(Condition *c) {
 609         assert(c);
 610         assert(c->parameter);
 611         assert(c->type == CONDITION_PATH_IS_DIRECTORY);
 612
 613         return is_dir(c->parameter, true) > 0;
 614 }
 615
 616 static int condition_test_path_is_symbolic_link(Condition *c) {
 617         assert(c);
 618         assert(c->parameter);
 619         assert(c->type == CONDITION_PATH_IS_SYMBOLIC_LINK);
 620
 621         return is_symlink(c->parameter) > 0;
 622 }
 623
 624 static int condition_test_path_is_mount_point(Condition *c) {
 625         assert(c);
 626         assert(c->parameter);
 627         assert(c->type == CONDITION_PATH_IS_MOUNT_POINT);
 628
 629         return path_is_mount_point(c->parameter, NULL, AT_SYMLINK_FOLLOW) > 0;
 630 }
 631
 632 static int condition_test_path_is_read_write(Condition *c) {
 633         assert(c);
 634         assert(c->parameter);
 635         assert(c->type == CONDITION_PATH_IS_READ_WRITE);
 636
 637         return path_is_read_only_fs(c->parameter) <= 0;
 638 }
 639
 640 static int condition_test_directory_not_empty(Condition *c) {
 641         int r;
 642
 643         assert(c);
 644         assert(c->parameter);
 645         assert(c->type == CONDITION_DIRECTORY_NOT_EMPTY);
 646
 647         r = dir_is_empty(c->parameter);
 648         return r <= 0 && r != -ENOENT;
 649 }
 650
 651 static int condition_test_file_not_empty(Condition *c) {
 652         struct stat st;
 653
 654         assert(c);
 655         assert(c->parameter);
 656         assert(c->type == CONDITION_FILE_NOT_EMPTY);
 657
 658         return (stat(c->parameter, &st) >= 0 &&
 659                 S_ISREG(st.st_mode) &&
 660                 st.st_size > 0);
 661 }
 662
 663 static int condition_test_file_is_executable(Condition *c) {
 664         struct stat st;
 665
 666         assert(c);
 667         assert(c->parameter);
 668         assert(c->type == CONDITION_FILE_IS_EXECUTABLE);
 669
 670         return (stat(c->parameter, &st) >= 0 &&
 671                 S_ISREG(st.st_mode) &&
 672                 (st.st_mode & 0111));
 673 }
 674
 675 static int condition_test_null(Condition *c) {
 676         assert(c);
 677         assert(c->type == CONDITION_NULL);
 678
 679         /* Note that during parsing we already evaluate the string and
 680          * store it in c->negate */
 681         return true;
 682 }
 683
 684 int condition_test(Condition *c) {
 685
 686         static int (*const condition_tests[_CONDITION_TYPE_MAX])(Condition *c) = {
 687                 [CONDITION_PATH_EXISTS] = condition_test_path_exists,
 688                 [CONDITION_PATH_EXISTS_GLOB] = condition_test_path_exists_glob,
 689                 [CONDITION_PATH_IS_DIRECTORY] = condition_test_path_is_directory,
 690                 [CONDITION_PATH_IS_SYMBOLIC_LINK] = condition_test_path_is_symbolic_link,
 691                 [CONDITION_PATH_IS_MOUNT_POINT] = condition_test_path_is_mount_point,
 692                 [CONDITION_PATH_IS_READ_WRITE] = condition_test_path_is_read_write,
 693                 [CONDITION_DIRECTORY_NOT_EMPTY] = condition_test_directory_not_empty,
 694                 [CONDITION_FILE_NOT_EMPTY] = condition_test_file_not_empty,
 695                 [CONDITION_FILE_IS_EXECUTABLE] = condition_test_file_is_executable,
 696                 [CONDITION_KERNEL_COMMAND_LINE] = condition_test_kernel_command_line,
 697                 [CONDITION_KERNEL_VERSION] = condition_test_kernel_version,
 698                 [CONDITION_VIRTUALIZATION] = condition_test_virtualization,
 699                 [CONDITION_SECURITY] = condition_test_security,
 700                 [CONDITION_CAPABILITY] = condition_test_capability,
 701                 [CONDITION_HOST] = condition_test_host,
 702                 [CONDITION_AC_POWER] = condition_test_ac_power,
 703                 [CONDITION_ARCHITECTURE] = condition_test_architecture,
 704                 [CONDITION_NEEDS_UPDATE] = condition_test_needs_update,
 705                 [CONDITION_FIRST_BOOT] = condition_test_first_boot,
 706                 [CONDITION_USER] = condition_test_user,
 707                 [CONDITION_GROUP] = condition_test_group,
 708                 [CONDITION_CONTROL_GROUP_CONTROLLER] = condition_test_control_group_controller,
 709                 [CONDITION_NULL] = condition_test_null,
 710                 [CONDITION_CPUS] = condition_test_cpus,
 711                 [CONDITION_MEMORY] = condition_test_memory,
 712         };
 713
 714         int r, b;
 715
 716         assert(c);
 717         assert(c->type >= 0);
 718         assert(c->type < _CONDITION_TYPE_MAX);
 719
 720         r = condition_tests[c->type](c);
 721         if (r < 0) {
 722                 c->result = CONDITION_ERROR;
 723                 return r;
 724         }
 725
 726         b = (r > 0) == !c->negate;
 727         c->result = b ? CONDITION_SUCCEEDED : CONDITION_FAILED;
 728         return b;
 729 }
 730
 731 bool condition_test_list(Condition *first, const char *(*to_string)(ConditionType t), condition_test_logger_t logger, void *userdata) {
 732         Condition *c;
 733         int triggered = -1;
 734
 735         assert(!!logger == !!to_string);
 736
 737         /* If the condition list is empty, then it is true */
 738         if (!first)
 739                 return true;
 740
 741         /* Otherwise, if all of the non-trigger conditions apply and
 742          * if any of the trigger conditions apply (unless there are
 743          * none) we return true */
 744         LIST_FOREACH(conditions, c, first) {
 745                 int r;
 746
 747                 r = condition_test(c);
 748
 749                 if (logger) {
 750                         if (r < 0)
 751                                 logger(userdata, LOG_WARNING, r, __FILE__, __LINE__, __func__,
 752                                        "Couldn't determine result for %s=%s%s%s, assuming failed: %m",
 753                                        to_string(c->type),
 754                                        c->trigger ? "|" : "",
 755                                        c->negate ? "!" : "",
 756                                        c->parameter);
 757                         else
 758                                 logger(userdata, LOG_DEBUG, 0, __FILE__, __LINE__, __func__,
 759                                        "%s=%s%s%s %s.",
 760                                        to_string(c->type),
 761                                        c->trigger ? "|" : "",
 762                                        c->negate ? "!" : "",
 763                                        c->parameter,
 764                                        condition_result_to_string(c->result));
 765                 }
 766
 767                 if (!c->trigger && r <= 0)
 768                         return false;
 769
 770                 if (c->trigger && triggered <= 0)
 771                         triggered = r > 0;
 772         }
 773
 774         return triggered != 0;
 775 }
 776
 777 void condition_dump(Condition *c, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 778         assert(c);
 779         assert(f);
 780
 781         prefix = strempty(prefix);
 782
 783         fprintf(f,
 784                 "%s\t%s: %s%s%s %s\n",
 785                 prefix,
 786                 to_string(c->type),
 787                 c->trigger ? "|" : "",
 788                 c->negate ? "!" : "",
 789                 c->parameter,
 790                 condition_result_to_string(c->result));
 791 }
 792
 793 void condition_dump_list(Condition *first, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 794         Condition *c;
 795
 796         LIST_FOREACH(conditions, c, first)
 797                 condition_dump(c, f, prefix, to_string);
 798 }
 799
 800 static const char* const condition_type_table[_CONDITION_TYPE_MAX] = {
 801         [CONDITION_ARCHITECTURE] = "ConditionArchitecture",
 802         [CONDITION_VIRTUALIZATION] = "ConditionVirtualization",
 803         [CONDITION_HOST] = "ConditionHost",
 804         [CONDITION_KERNEL_COMMAND_LINE] = "ConditionKernelCommandLine",
 805         [CONDITION_KERNEL_VERSION] = "ConditionKernelVersion",
 806         [CONDITION_SECURITY] = "ConditionSecurity",
 807         [CONDITION_CAPABILITY] = "ConditionCapability",
 808         [CONDITION_AC_POWER] = "ConditionACPower",
 809         [CONDITION_NEEDS_UPDATE] = "ConditionNeedsUpdate",
 810         [CONDITION_FIRST_BOOT] = "ConditionFirstBoot",
 811         [CONDITION_PATH_EXISTS] = "ConditionPathExists",
 812         [CONDITION_PATH_EXISTS_GLOB] = "ConditionPathExistsGlob",
 813         [CONDITION_PATH_IS_DIRECTORY] = "ConditionPathIsDirectory",
 814         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "ConditionPathIsSymbolicLink",
 815         [CONDITION_PATH_IS_MOUNT_POINT] = "ConditionPathIsMountPoint",
 816         [CONDITION_PATH_IS_READ_WRITE] = "ConditionPathIsReadWrite",
 817         [CONDITION_DIRECTORY_NOT_EMPTY] = "ConditionDirectoryNotEmpty",
 818         [CONDITION_FILE_NOT_EMPTY] = "ConditionFileNotEmpty",
 819         [CONDITION_FILE_IS_EXECUTABLE] = "ConditionFileIsExecutable",
 820         [CONDITION_USER] = "ConditionUser",
 821         [CONDITION_GROUP] = "ConditionGroup",
 822         [CONDITION_CONTROL_GROUP_CONTROLLER] = "ConditionControlGroupController",
 823         [CONDITION_NULL] = "ConditionNull",
 824         [CONDITION_CPUS] = "ConditionCPUs",
 825         [CONDITION_MEMORY] = "ConditionMemory",
 826 };
 827
 828 DEFINE_STRING_TABLE_LOOKUP(condition_type, ConditionType);
 829
 830 static const char* const assert_type_table[_CONDITION_TYPE_MAX] = {
 831         [CONDITION_ARCHITECTURE] = "AssertArchitecture",
 832         [CONDITION_VIRTUALIZATION] = "AssertVirtualization",
 833         [CONDITION_HOST] = "AssertHost",
 834         [CONDITION_KERNEL_COMMAND_LINE] = "AssertKernelCommandLine",
 835         [CONDITION_KERNEL_VERSION] = "AssertKernelVersion",
 836         [CONDITION_SECURITY] = "AssertSecurity",
 837         [CONDITION_CAPABILITY] = "AssertCapability",
 838         [CONDITION_AC_POWER] = "AssertACPower",
 839         [CONDITION_NEEDS_UPDATE] = "AssertNeedsUpdate",
 840         [CONDITION_FIRST_BOOT] = "AssertFirstBoot",
 841         [CONDITION_PATH_EXISTS] = "AssertPathExists",
 842         [CONDITION_PATH_EXISTS_GLOB] = "AssertPathExistsGlob",
 843         [CONDITION_PATH_IS_DIRECTORY] = "AssertPathIsDirectory",
 844         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "AssertPathIsSymbolicLink",
 845         [CONDITION_PATH_IS_MOUNT_POINT] = "AssertPathIsMountPoint",
 846         [CONDITION_PATH_IS_READ_WRITE] = "AssertPathIsReadWrite",
 847         [CONDITION_DIRECTORY_NOT_EMPTY] = "AssertDirectoryNotEmpty",
 848         [CONDITION_FILE_NOT_EMPTY] = "AssertFileNotEmpty",
 849         [CONDITION_FILE_IS_EXECUTABLE] = "AssertFileIsExecutable",
 850         [CONDITION_USER] = "AssertUser",
 851         [CONDITION_GROUP] = "AssertGroup",
 852         [CONDITION_CONTROL_GROUP_CONTROLLER] = "AssertControlGroupController",
 853         [CONDITION_NULL] = "AssertNull",
 854         [CONDITION_CPUS] = "AssertCPUs",
 855         [CONDITION_MEMORY] = "AssertMemory",
 856 };
 857
 858 DEFINE_STRING_TABLE_LOOKUP(assert_type, ConditionType);
 859
 860 static const char* const condition_result_table[_CONDITION_RESULT_MAX] = {
 861         [CONDITION_UNTESTED] = "untested",
 862         [CONDITION_SUCCEEDED] = "succeeded",
 863         [CONDITION_FAILED] = "failed",
 864         [CONDITION_ERROR] = "error",
 865 };
 866
 867 DEFINE_STRING_TABLE_LOOKUP(condition_result, ConditionResult);