src/shared/condition.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <fnmatch.h>
   6 #include <limits.h>
   7 #include <stdlib.h>
   8 #include <string.h>
   9 #include <sys/stat.h>
  10 #include <sys/types.h>
  11 #include <sys/utsname.h>
  12 #include <time.h>
  13 #include <unistd.h>
  14
  15 #include "sd-id128.h"
  16
  17 #include "alloc-util.h"
  18 #include "apparmor-util.h"
  19 #include "architecture.h"
  20 #include "audit-util.h"
  21 #include "cap-list.h"
  22 #include "cgroup-util.h"
  23 #include "condition.h"
  24 #include "efivars.h"
  25 #include "extract-word.h"
  26 #include "fd-util.h"
  27 #include "fileio.h"
  28 #include "glob-util.h"
  29 #include "hostname-util.h"
  30 #include "ima-util.h"
  31 #include "list.h"
  32 #include "macro.h"
  33 #include "mount-util.h"
  34 #include "parse-util.h"
  35 #include "path-util.h"
  36 #include "proc-cmdline.h"
  37 #include "process-util.h"
  38 #include "selinux-util.h"
  39 #include "smack-util.h"
  40 #include "stat-util.h"
  41 #include "string-table.h"
  42 #include "string-util.h"
  43 #include "tomoyo-util.h"
  44 #include "user-util.h"
  45 #include "util.h"
  46 #include "virt.h"
  47
  48 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
  49         Condition *c;
  50         int r;
  51
  52         assert(type >= 0);
  53         assert(type < _CONDITION_TYPE_MAX);
  54         assert((!parameter) == (type == CONDITION_NULL));
  55
  56         c = new0(Condition, 1);
  57         if (!c)
  58                 return NULL;
  59
  60         c->type = type;
  61         c->trigger = trigger;
  62         c->negate = negate;
  63
  64         r = free_and_strdup(&c->parameter, parameter);
  65         if (r < 0) {
  66                 return mfree(c);
  67         }
  68
  69         return c;
  70 }
  71
  72 void condition_free(Condition *c) {
  73         assert(c);
  74
  75         free(c->parameter);
  76         free(c);
  77 }
  78
  79 Condition* condition_free_list(Condition *first) {
  80         Condition *c, *n;
  81
  82         LIST_FOREACH_SAFE(conditions, c, n, first)
  83                 condition_free(c);
  84
  85         return NULL;
  86 }
  87
  88 static int condition_test_kernel_command_line(Condition *c) {
  89         _cleanup_free_ char *line = NULL;
  90         const char *p;
  91         bool equal;
  92         int r;
  93
  94         assert(c);
  95         assert(c->parameter);
  96         assert(c->type == CONDITION_KERNEL_COMMAND_LINE);
  97
  98         r = proc_cmdline(&line);
  99         if (r < 0)
 100                 return r;
 101
 102         equal = strchr(c->parameter, '=');
 103
 104         for (p = line;;) {
 105                 _cleanup_free_ char *word = NULL;
 106                 bool found;
 107
 108                 r = extract_first_word(&p, &word, NULL, EXTRACT_QUOTES|EXTRACT_RELAX);
 109                 if (r < 0)
 110                         return r;
 111                 if (r == 0)
 112                         break;
 113
 114                 if (equal)
 115                         found = streq(word, c->parameter);
 116                 else {
 117                         const char *f;
 118
 119                         f = startswith(word, c->parameter);
 120                         found = f && IN_SET(*f, 0, '=');
 121                 }
 122
 123                 if (found)
 124                         return true;
 125         }
 126
 127         return false;
 128 }
 129
 130 static int condition_test_kernel_version(Condition *c) {
 131         enum {
 132                 /* Listed in order of checking. Note that some comparators are prefixes of others, hence the longest
 133                  * should be listed first. */
 134                 LOWER_OR_EQUAL,
 135                 GREATER_OR_EQUAL,
 136                 LOWER,
 137                 GREATER,
 138                 EQUAL,
 139                 _ORDER_MAX,
 140         };
 141
 142         static const char *const prefix[_ORDER_MAX] = {
 143                 [LOWER_OR_EQUAL] = "<=",
 144                 [GREATER_OR_EQUAL] = ">=",
 145                 [LOWER] = "<",
 146                 [GREATER] = ">",
 147                 [EQUAL] = "=",
 148         };
 149         const char *p = NULL;
 150         struct utsname u;
 151         size_t i;
 152         int k;
 153
 154         assert(c);
 155         assert(c->parameter);
 156         assert(c->type == CONDITION_KERNEL_VERSION);
 157
 158         assert_se(uname(&u) >= 0);
 159
 160         for (i = 0; i < _ORDER_MAX; i++) {
 161                 p = startswith(c->parameter, prefix[i]);
 162                 if (p)
 163                         break;
 164         }
 165
 166         /* No prefix? Then treat as glob string */
 167         if (!p)
 168                 return fnmatch(skip_leading_chars(c->parameter, NULL), u.release, 0) == 0;
 169
 170         k = str_verscmp(u.release, skip_leading_chars(p, NULL));
 171
 172         switch (i) {
 173
 174         case LOWER:
 175                 return k < 0;
 176
 177         case LOWER_OR_EQUAL:
 178                 return k <= 0;
 179
 180         case EQUAL:
 181                 return k == 0;
 182
 183         case GREATER_OR_EQUAL:
 184                 return k >= 0;
 185
 186         case GREATER:
 187                 return k > 0;
 188
 189         default:
 190                 assert_not_reached("Can't compare");
 191         }
 192 }
 193
 194 static int condition_test_user(Condition *c) {
 195         uid_t id;
 196         int r;
 197         _cleanup_free_ char *username = NULL;
 198         const char *u;
 199
 200         assert(c);
 201         assert(c->parameter);
 202         assert(c->type == CONDITION_USER);
 203
 204         r = parse_uid(c->parameter, &id);
 205         if (r >= 0)
 206                 return id == getuid() || id == geteuid();
 207
 208         if (streq("@system", c->parameter))
 209                 return uid_is_system(getuid()) || uid_is_system(geteuid());
 210
 211         username = getusername_malloc();
 212         if (!username)
 213                 return -ENOMEM;
 214
 215         if (streq(username, c->parameter))
 216                 return 1;
 217
 218         if (getpid_cached() == 1)
 219                 return streq(c->parameter, "root");
 220
 221         u = c->parameter;
 222         r = get_user_creds(&u, &id, NULL, NULL, NULL, USER_CREDS_ALLOW_MISSING);
 223         if (r < 0)
 224                 return 0;
 225
 226         return id == getuid() || id == geteuid();
 227 }
 228
 229 static int condition_test_control_group_controller(Condition *c) {
 230         int r;
 231         CGroupMask system_mask, wanted_mask = 0;
 232
 233         assert(c);
 234         assert(c->parameter);
 235         assert(c->type == CONDITION_CONTROL_GROUP_CONTROLLER);
 236
 237         r = cg_mask_supported(&system_mask);
 238         if (r < 0)
 239                 return log_debug_errno(r, "Failed to determine supported controllers: %m");
 240
 241         r = cg_mask_from_string(c->parameter, &wanted_mask);
 242         if (r < 0 || wanted_mask <= 0) {
 243                 /* This won't catch the case that we have an unknown controller
 244                  * mixed in with valid ones -- these are only assessed on the
 245                  * validity of the valid controllers found. */
 246                 log_debug("Failed to parse cgroup string: %s", c->parameter);
 247                 return 1;
 248         }
 249
 250         return FLAGS_SET(system_mask, wanted_mask);
 251 }
 252
 253 static int condition_test_group(Condition *c) {
 254         gid_t id;
 255         int r;
 256
 257         assert(c);
 258         assert(c->parameter);
 259         assert(c->type == CONDITION_GROUP);
 260
 261         r = parse_gid(c->parameter, &id);
 262         if (r >= 0)
 263                 return in_gid(id);
 264
 265         /* Avoid any NSS lookups if we are PID1 */
 266         if (getpid_cached() == 1)
 267                 return streq(c->parameter, "root");
 268
 269         return in_group(c->parameter) > 0;
 270 }
 271
 272 static int condition_test_virtualization(Condition *c) {
 273         int b, v;
 274
 275         assert(c);
 276         assert(c->parameter);
 277         assert(c->type == CONDITION_VIRTUALIZATION);
 278
 279         if (streq(c->parameter, "private-users"))
 280                 return running_in_userns();
 281
 282         v = detect_virtualization();
 283         if (v < 0)
 284                 return v;
 285
 286         /* First, compare with yes/no */
 287         b = parse_boolean(c->parameter);
 288         if (b >= 0)
 289                 return b == !!v;
 290
 291         /* Then, compare categorization */
 292         if (streq(c->parameter, "vm"))
 293                 return VIRTUALIZATION_IS_VM(v);
 294
 295         if (streq(c->parameter, "container"))
 296                 return VIRTUALIZATION_IS_CONTAINER(v);
 297
 298         /* Finally compare id */
 299         return v != VIRTUALIZATION_NONE && streq(c->parameter, virtualization_to_string(v));
 300 }
 301
 302 static int condition_test_architecture(Condition *c) {
 303         int a, b;
 304
 305         assert(c);
 306         assert(c->parameter);
 307         assert(c->type == CONDITION_ARCHITECTURE);
 308
 309         a = uname_architecture();
 310         if (a < 0)
 311                 return a;
 312
 313         if (streq(c->parameter, "native"))
 314                 b = native_architecture();
 315         else {
 316                 b = architecture_from_string(c->parameter);
 317                 if (b < 0) /* unknown architecture? Then it's definitely not ours */
 318                         return false;
 319         }
 320
 321         return a == b;
 322 }
 323
 324 static int condition_test_host(Condition *c) {
 325         _cleanup_free_ char *h = NULL;
 326         sd_id128_t x, y;
 327         int r;
 328
 329         assert(c);
 330         assert(c->parameter);
 331         assert(c->type == CONDITION_HOST);
 332
 333         if (sd_id128_from_string(c->parameter, &x) >= 0) {
 334
 335                 r = sd_id128_get_machine(&y);
 336                 if (r < 0)
 337                         return r;
 338
 339                 return sd_id128_equal(x, y);
 340         }
 341
 342         h = gethostname_malloc();
 343         if (!h)
 344                 return -ENOMEM;
 345
 346         return fnmatch(c->parameter, h, FNM_CASEFOLD) == 0;
 347 }
 348
 349 static int condition_test_ac_power(Condition *c) {
 350         int r;
 351
 352         assert(c);
 353         assert(c->parameter);
 354         assert(c->type == CONDITION_AC_POWER);
 355
 356         r = parse_boolean(c->parameter);
 357         if (r < 0)
 358                 return r;
 359
 360         return (on_ac_power() != 0) == !!r;
 361 }
 362
 363 static int condition_test_security(Condition *c) {
 364         assert(c);
 365         assert(c->parameter);
 366         assert(c->type == CONDITION_SECURITY);
 367
 368         if (streq(c->parameter, "selinux"))
 369                 return mac_selinux_use();
 370         if (streq(c->parameter, "smack"))
 371                 return mac_smack_use();
 372         if (streq(c->parameter, "apparmor"))
 373                 return mac_apparmor_use();
 374         if (streq(c->parameter, "audit"))
 375                 return use_audit();
 376         if (streq(c->parameter, "ima"))
 377                 return use_ima();
 378         if (streq(c->parameter, "tomoyo"))
 379                 return mac_tomoyo_use();
 380         if (streq(c->parameter, "uefi-secureboot"))
 381                 return is_efi_secure_boot();
 382
 383         return false;
 384 }
 385
 386 static int condition_test_capability(Condition *c) {
 387         unsigned long long capabilities = (unsigned long long) -1;
 388         _cleanup_fclose_ FILE *f = NULL;
 389         int value, r;
 390
 391         assert(c);
 392         assert(c->parameter);
 393         assert(c->type == CONDITION_CAPABILITY);
 394
 395         /* If it's an invalid capability, we don't have it */
 396         value = capability_from_name(c->parameter);
 397         if (value < 0)
 398                 return -EINVAL;
 399
 400         /* If it's a valid capability we default to assume
 401          * that we have it */
 402
 403         f = fopen("/proc/self/status", "re");
 404         if (!f)
 405                 return -errno;
 406
 407         for (;;) {
 408                 _cleanup_free_ char *line = NULL;
 409                 const char *p;
 410
 411                 r = read_line(f, LONG_LINE_MAX, &line);
 412                 if (r < 0)
 413                         return r;
 414                 if (r == 0)
 415                         break;
 416
 417                 p = startswith(line, "CapBnd:");
 418                 if (p) {
 419                         if (sscanf(line+7, "%llx", &capabilities) != 1)
 420                                 return -EIO;
 421
 422                         break;
 423                 }
 424         }
 425
 426         return !!(capabilities & (1ULL << value));
 427 }
 428
 429 static int condition_test_needs_update(Condition *c) {
 430         const char *p;
 431         struct stat usr, other;
 432
 433         assert(c);
 434         assert(c->parameter);
 435         assert(c->type == CONDITION_NEEDS_UPDATE);
 436
 437         /* If the file system is read-only we shouldn't suggest an update */
 438         if (path_is_read_only_fs(c->parameter) > 0)
 439                 return false;
 440
 441         /* Any other failure means we should allow the condition to be true,
 442          * so that we rather invoke too many update tools than too
 443          * few. */
 444
 445         if (!path_is_absolute(c->parameter))
 446                 return true;
 447
 448         p = strjoina(c->parameter, "/.updated");
 449         if (lstat(p, &other) < 0)
 450                 return true;
 451
 452         if (lstat("/usr/", &usr) < 0)
 453                 return true;
 454
 455         /*
 456          * First, compare seconds as they are always accurate...
 457          */
 458         if (usr.st_mtim.tv_sec != other.st_mtim.tv_sec)
 459                 return usr.st_mtim.tv_sec > other.st_mtim.tv_sec;
 460
 461         /*
 462          * ...then compare nanoseconds.
 463          *
 464          * A false positive is only possible when /usr's nanoseconds > 0
 465          * (otherwise /usr cannot be strictly newer than the target file)
 466          * AND the target file's nanoseconds == 0
 467          * (otherwise the filesystem supports nsec timestamps, see stat(2)).
 468          */
 469         if (usr.st_mtim.tv_nsec > 0 && other.st_mtim.tv_nsec == 0) {
 470                 _cleanup_free_ char *timestamp_str = NULL;
 471                 uint64_t timestamp;
 472                 int r;
 473
 474                 r = parse_env_file(NULL, p, "TIMESTAMP_NSEC", &timestamp_str);
 475                 if (r < 0) {
 476                         log_error_errno(r, "Failed to parse timestamp file '%s', using mtime: %m", p);
 477                         return true;
 478                 } else if (r == 0) {
 479                         log_debug("No data in timestamp file '%s', using mtime", p);
 480                         return true;
 481                 }
 482
 483                 r = safe_atou64(timestamp_str, &timestamp);
 484                 if (r < 0) {
 485                         log_error_errno(r, "Failed to parse timestamp value '%s' in file '%s', using mtime: %m", timestamp_str, p);
 486                         return true;
 487                 }
 488
 489                 timespec_store(&other.st_mtim, timestamp);
 490         }
 491
 492         return usr.st_mtim.tv_nsec > other.st_mtim.tv_nsec;
 493 }
 494
 495 static int condition_test_first_boot(Condition *c) {
 496         int r;
 497
 498         assert(c);
 499         assert(c->parameter);
 500         assert(c->type == CONDITION_FIRST_BOOT);
 501
 502         r = parse_boolean(c->parameter);
 503         if (r < 0)
 504                 return r;
 505
 506         return (access("/run/systemd/first-boot", F_OK) >= 0) == !!r;
 507 }
 508
 509 static int condition_test_path_exists(Condition *c) {
 510         assert(c);
 511         assert(c->parameter);
 512         assert(c->type == CONDITION_PATH_EXISTS);
 513
 514         return access(c->parameter, F_OK) >= 0;
 515 }
 516
 517 static int condition_test_path_exists_glob(Condition *c) {
 518         assert(c);
 519         assert(c->parameter);
 520         assert(c->type == CONDITION_PATH_EXISTS_GLOB);
 521
 522         return glob_exists(c->parameter) > 0;
 523 }
 524
 525 static int condition_test_path_is_directory(Condition *c) {
 526         assert(c);
 527         assert(c->parameter);
 528         assert(c->type == CONDITION_PATH_IS_DIRECTORY);
 529
 530         return is_dir(c->parameter, true) > 0;
 531 }
 532
 533 static int condition_test_path_is_symbolic_link(Condition *c) {
 534         assert(c);
 535         assert(c->parameter);
 536         assert(c->type == CONDITION_PATH_IS_SYMBOLIC_LINK);
 537
 538         return is_symlink(c->parameter) > 0;
 539 }
 540
 541 static int condition_test_path_is_mount_point(Condition *c) {
 542         assert(c);
 543         assert(c->parameter);
 544         assert(c->type == CONDITION_PATH_IS_MOUNT_POINT);
 545
 546         return path_is_mount_point(c->parameter, NULL, AT_SYMLINK_FOLLOW) > 0;
 547 }
 548
 549 static int condition_test_path_is_read_write(Condition *c) {
 550         assert(c);
 551         assert(c->parameter);
 552         assert(c->type == CONDITION_PATH_IS_READ_WRITE);
 553
 554         return path_is_read_only_fs(c->parameter) <= 0;
 555 }
 556
 557 static int condition_test_directory_not_empty(Condition *c) {
 558         int r;
 559
 560         assert(c);
 561         assert(c->parameter);
 562         assert(c->type == CONDITION_DIRECTORY_NOT_EMPTY);
 563
 564         r = dir_is_empty(c->parameter);
 565         return r <= 0 && r != -ENOENT;
 566 }
 567
 568 static int condition_test_file_not_empty(Condition *c) {
 569         struct stat st;
 570
 571         assert(c);
 572         assert(c->parameter);
 573         assert(c->type == CONDITION_FILE_NOT_EMPTY);
 574
 575         return (stat(c->parameter, &st) >= 0 &&
 576                 S_ISREG(st.st_mode) &&
 577                 st.st_size > 0);
 578 }
 579
 580 static int condition_test_file_is_executable(Condition *c) {
 581         struct stat st;
 582
 583         assert(c);
 584         assert(c->parameter);
 585         assert(c->type == CONDITION_FILE_IS_EXECUTABLE);
 586
 587         return (stat(c->parameter, &st) >= 0 &&
 588                 S_ISREG(st.st_mode) &&
 589                 (st.st_mode & 0111));
 590 }
 591
 592 static int condition_test_null(Condition *c) {
 593         assert(c);
 594         assert(c->type == CONDITION_NULL);
 595
 596         /* Note that during parsing we already evaluate the string and
 597          * store it in c->negate */
 598         return true;
 599 }
 600
 601 int condition_test(Condition *c) {
 602
 603         static int (*const condition_tests[_CONDITION_TYPE_MAX])(Condition *c) = {
 604                 [CONDITION_PATH_EXISTS] = condition_test_path_exists,
 605                 [CONDITION_PATH_EXISTS_GLOB] = condition_test_path_exists_glob,
 606                 [CONDITION_PATH_IS_DIRECTORY] = condition_test_path_is_directory,
 607                 [CONDITION_PATH_IS_SYMBOLIC_LINK] = condition_test_path_is_symbolic_link,
 608                 [CONDITION_PATH_IS_MOUNT_POINT] = condition_test_path_is_mount_point,
 609                 [CONDITION_PATH_IS_READ_WRITE] = condition_test_path_is_read_write,
 610                 [CONDITION_DIRECTORY_NOT_EMPTY] = condition_test_directory_not_empty,
 611                 [CONDITION_FILE_NOT_EMPTY] = condition_test_file_not_empty,
 612                 [CONDITION_FILE_IS_EXECUTABLE] = condition_test_file_is_executable,
 613                 [CONDITION_KERNEL_COMMAND_LINE] = condition_test_kernel_command_line,
 614                 [CONDITION_KERNEL_VERSION] = condition_test_kernel_version,
 615                 [CONDITION_VIRTUALIZATION] = condition_test_virtualization,
 616                 [CONDITION_SECURITY] = condition_test_security,
 617                 [CONDITION_CAPABILITY] = condition_test_capability,
 618                 [CONDITION_HOST] = condition_test_host,
 619                 [CONDITION_AC_POWER] = condition_test_ac_power,
 620                 [CONDITION_ARCHITECTURE] = condition_test_architecture,
 621                 [CONDITION_NEEDS_UPDATE] = condition_test_needs_update,
 622                 [CONDITION_FIRST_BOOT] = condition_test_first_boot,
 623                 [CONDITION_USER] = condition_test_user,
 624                 [CONDITION_GROUP] = condition_test_group,
 625                 [CONDITION_CONTROL_GROUP_CONTROLLER] = condition_test_control_group_controller,
 626                 [CONDITION_NULL] = condition_test_null,
 627         };
 628
 629         int r, b;
 630
 631         assert(c);
 632         assert(c->type >= 0);
 633         assert(c->type < _CONDITION_TYPE_MAX);
 634
 635         r = condition_tests[c->type](c);
 636         if (r < 0) {
 637                 c->result = CONDITION_ERROR;
 638                 return r;
 639         }
 640
 641         b = (r > 0) == !c->negate;
 642         c->result = b ? CONDITION_SUCCEEDED : CONDITION_FAILED;
 643         return b;
 644 }
 645
 646 void condition_dump(Condition *c, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 647         assert(c);
 648         assert(f);
 649
 650         prefix = strempty(prefix);
 651
 652         fprintf(f,
 653                 "%s\t%s: %s%s%s %s\n",
 654                 prefix,
 655                 to_string(c->type),
 656                 c->trigger ? "|" : "",
 657                 c->negate ? "!" : "",
 658                 c->parameter,
 659                 condition_result_to_string(c->result));
 660 }
 661
 662 void condition_dump_list(Condition *first, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 663         Condition *c;
 664
 665         LIST_FOREACH(conditions, c, first)
 666                 condition_dump(c, f, prefix, to_string);
 667 }
 668
 669 static const char* const condition_type_table[_CONDITION_TYPE_MAX] = {
 670         [CONDITION_ARCHITECTURE] = "ConditionArchitecture",
 671         [CONDITION_VIRTUALIZATION] = "ConditionVirtualization",
 672         [CONDITION_HOST] = "ConditionHost",
 673         [CONDITION_KERNEL_COMMAND_LINE] = "ConditionKernelCommandLine",
 674         [CONDITION_KERNEL_VERSION] = "ConditionKernelVersion",
 675         [CONDITION_SECURITY] = "ConditionSecurity",
 676         [CONDITION_CAPABILITY] = "ConditionCapability",
 677         [CONDITION_AC_POWER] = "ConditionACPower",
 678         [CONDITION_NEEDS_UPDATE] = "ConditionNeedsUpdate",
 679         [CONDITION_FIRST_BOOT] = "ConditionFirstBoot",
 680         [CONDITION_PATH_EXISTS] = "ConditionPathExists",
 681         [CONDITION_PATH_EXISTS_GLOB] = "ConditionPathExistsGlob",
 682         [CONDITION_PATH_IS_DIRECTORY] = "ConditionPathIsDirectory",
 683         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "ConditionPathIsSymbolicLink",
 684         [CONDITION_PATH_IS_MOUNT_POINT] = "ConditionPathIsMountPoint",
 685         [CONDITION_PATH_IS_READ_WRITE] = "ConditionPathIsReadWrite",
 686         [CONDITION_DIRECTORY_NOT_EMPTY] = "ConditionDirectoryNotEmpty",
 687         [CONDITION_FILE_NOT_EMPTY] = "ConditionFileNotEmpty",
 688         [CONDITION_FILE_IS_EXECUTABLE] = "ConditionFileIsExecutable",
 689         [CONDITION_USER] = "ConditionUser",
 690         [CONDITION_GROUP] = "ConditionGroup",
 691         [CONDITION_CONTROL_GROUP_CONTROLLER] = "ConditionControlGroupController",
 692         [CONDITION_NULL] = "ConditionNull"
 693 };
 694
 695 DEFINE_STRING_TABLE_LOOKUP(condition_type, ConditionType);
 696
 697 static const char* const assert_type_table[_CONDITION_TYPE_MAX] = {
 698         [CONDITION_ARCHITECTURE] = "AssertArchitecture",
 699         [CONDITION_VIRTUALIZATION] = "AssertVirtualization",
 700         [CONDITION_HOST] = "AssertHost",
 701         [CONDITION_KERNEL_COMMAND_LINE] = "AssertKernelCommandLine",
 702         [CONDITION_KERNEL_VERSION] = "AssertKernelVersion",
 703         [CONDITION_SECURITY] = "AssertSecurity",
 704         [CONDITION_CAPABILITY] = "AssertCapability",
 705         [CONDITION_AC_POWER] = "AssertACPower",
 706         [CONDITION_NEEDS_UPDATE] = "AssertNeedsUpdate",
 707         [CONDITION_FIRST_BOOT] = "AssertFirstBoot",
 708         [CONDITION_PATH_EXISTS] = "AssertPathExists",
 709         [CONDITION_PATH_EXISTS_GLOB] = "AssertPathExistsGlob",
 710         [CONDITION_PATH_IS_DIRECTORY] = "AssertPathIsDirectory",
 711         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "AssertPathIsSymbolicLink",
 712         [CONDITION_PATH_IS_MOUNT_POINT] = "AssertPathIsMountPoint",
 713         [CONDITION_PATH_IS_READ_WRITE] = "AssertPathIsReadWrite",
 714         [CONDITION_DIRECTORY_NOT_EMPTY] = "AssertDirectoryNotEmpty",
 715         [CONDITION_FILE_NOT_EMPTY] = "AssertFileNotEmpty",
 716         [CONDITION_FILE_IS_EXECUTABLE] = "AssertFileIsExecutable",
 717         [CONDITION_USER] = "AssertUser",
 718         [CONDITION_GROUP] = "AssertGroup",
 719         [CONDITION_CONTROL_GROUP_CONTROLLER] = "AssertControlGroupController",
 720         [CONDITION_NULL] = "AssertNull"
 721 };
 722
 723 DEFINE_STRING_TABLE_LOOKUP(assert_type, ConditionType);
 724
 725 static const char* const condition_result_table[_CONDITION_RESULT_MAX] = {
 726         [CONDITION_UNTESTED] = "untested",
 727         [CONDITION_SUCCEEDED] = "succeeded",
 728         [CONDITION_FAILED] = "failed",
 729         [CONDITION_ERROR] = "error",
 730 };
 731
 732 DEFINE_STRING_TABLE_LOOKUP(condition_result, ConditionResult);