src/shared/condition.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <fnmatch.h>
  23 #include <limits.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/stat.h>
  27 #include <sys/types.h>
  28 #include <time.h>
  29 #include <unistd.h>
  30
  31 #include "sd-id128.h"
  32
  33 #include "alloc-util.h"
  34 #include "apparmor-util.h"
  35 #include "architecture.h"
  36 #include "audit-util.h"
  37 #include "cap-list.h"
  38 #include "condition.h"
  39 #include "extract-word.h"
  40 #include "fd-util.h"
  41 #include "fileio.h"
  42 #include "glob-util.h"
  43 #include "hostname-util.h"
  44 #include "ima-util.h"
  45 #include "list.h"
  46 #include "macro.h"
  47 #include "mount-util.h"
  48 #include "parse-util.h"
  49 #include "path-util.h"
  50 #include "proc-cmdline.h"
  51 #include "process-util.h"
  52 #include "selinux-util.h"
  53 #include "smack-util.h"
  54 #include "stat-util.h"
  55 #include "string-table.h"
  56 #include "string-util.h"
  57 #include "user-util.h"
  58 #include "util.h"
  59 #include "virt.h"
  60
  61 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
  62         Condition *c;
  63         int r;
  64
  65         assert(type >= 0);
  66         assert(type < _CONDITION_TYPE_MAX);
  67         assert((!parameter) == (type == CONDITION_NULL));
  68
  69         c = new0(Condition, 1);
  70         if (!c)
  71                 return NULL;
  72
  73         c->type = type;
  74         c->trigger = trigger;
  75         c->negate = negate;
  76
  77         r = free_and_strdup(&c->parameter, parameter);
  78         if (r < 0) {
  79                 free(c);
  80                 return NULL;
  81         }
  82
  83         return c;
  84 }
  85
  86 void condition_free(Condition *c) {
  87         assert(c);
  88
  89         free(c->parameter);
  90         free(c);
  91 }
  92
  93 Condition* condition_free_list(Condition *first) {
  94         Condition *c, *n;
  95
  96         LIST_FOREACH_SAFE(conditions, c, n, first)
  97                 condition_free(c);
  98
  99         return NULL;
 100 }
 101
 102 static int condition_test_kernel_command_line(Condition *c) {
 103         _cleanup_free_ char *line = NULL;
 104         const char *p;
 105         bool equal;
 106         int r;
 107
 108         assert(c);
 109         assert(c->parameter);
 110         assert(c->type == CONDITION_KERNEL_COMMAND_LINE);
 111
 112         r = proc_cmdline(&line);
 113         if (r < 0)
 114                 return r;
 115
 116         equal = !!strchr(c->parameter, '=');
 117
 118         for (p = line;;) {
 119                 _cleanup_free_ char *word = NULL;
 120                 bool found;
 121
 122                 r = extract_first_word(&p, &word, NULL, EXTRACT_QUOTES|EXTRACT_RELAX);
 123                 if (r < 0)
 124                         return r;
 125                 if (r == 0)
 126                         break;
 127
 128                 if (equal)
 129                         found = streq(word, c->parameter);
 130                 else {
 131                         const char *f;
 132
 133                         f = startswith(word, c->parameter);
 134                         found = f && IN_SET(*f, 0, '=');
 135                 }
 136
 137                 if (found)
 138                         return true;
 139         }
 140
 141         return false;
 142 }
 143
 144 static int condition_test_user(Condition *c) {
 145         uid_t id;
 146         int r;
 147         _cleanup_free_ char *username = NULL;
 148         const char *u;
 149
 150         assert(c);
 151         assert(c->parameter);
 152         assert(c->type == CONDITION_USER);
 153
 154         r = parse_uid(c->parameter, &id);
 155         if (r >= 0)
 156                 return id == getuid() || id == geteuid();
 157
 158         if (streq("@system", c->parameter))
 159                 return getuid() <= SYSTEM_UID_MAX || geteuid() <= SYSTEM_UID_MAX;
 160
 161         username = getusername_malloc();
 162         if (!username)
 163                 return -ENOMEM;
 164
 165         if (streq(username, c->parameter))
 166                 return 1;
 167
 168         if (getpid_cached() == 1)
 169                 return streq(c->parameter, "root");
 170
 171         u = c->parameter;
 172         r = get_user_creds(&u, &id, NULL, NULL, NULL);
 173         if (r < 0)
 174                 return 0;
 175
 176         return id == getuid() || id == geteuid();
 177 }
 178
 179 static int condition_test_group(Condition *c) {
 180         gid_t id;
 181         int r;
 182
 183         assert(c);
 184         assert(c->parameter);
 185         assert(c->type == CONDITION_GROUP);
 186
 187         r = parse_gid(c->parameter, &id);
 188         if (r >= 0)
 189                 return in_gid(id);
 190
 191         /* Avoid any NSS lookups if we are PID1 */
 192         if (getpid_cached() == 1)
 193                 return streq(c->parameter, "root");
 194
 195         return in_group(c->parameter) > 0;
 196 }
 197
 198 static int condition_test_virtualization(Condition *c) {
 199         int b, v;
 200
 201         assert(c);
 202         assert(c->parameter);
 203         assert(c->type == CONDITION_VIRTUALIZATION);
 204
 205         if (streq(c->parameter, "private-users"))
 206                 return running_in_userns();
 207
 208         v = detect_virtualization();
 209         if (v < 0)
 210                 return v;
 211
 212         /* First, compare with yes/no */
 213         b = parse_boolean(c->parameter);
 214         if (b >= 0)
 215                 return b == !!v;
 216
 217         /* Then, compare categorization */
 218         if (streq(c->parameter, "vm"))
 219                 return VIRTUALIZATION_IS_VM(v);
 220
 221         if (streq(c->parameter, "container"))
 222                 return VIRTUALIZATION_IS_CONTAINER(v);
 223
 224         /* Finally compare id */
 225         return v != VIRTUALIZATION_NONE && streq(c->parameter, virtualization_to_string(v));
 226 }
 227
 228 static int condition_test_architecture(Condition *c) {
 229         int a, b;
 230
 231         assert(c);
 232         assert(c->parameter);
 233         assert(c->type == CONDITION_ARCHITECTURE);
 234
 235         a = uname_architecture();
 236         if (a < 0)
 237                 return a;
 238
 239         if (streq(c->parameter, "native"))
 240                 b = native_architecture();
 241         else {
 242                 b = architecture_from_string(c->parameter);
 243                 if (b < 0) /* unknown architecture? Then it's definitely not ours */
 244                         return false;
 245         }
 246
 247         return a == b;
 248 }
 249
 250 static int condition_test_host(Condition *c) {
 251         _cleanup_free_ char *h = NULL;
 252         sd_id128_t x, y;
 253         int r;
 254
 255         assert(c);
 256         assert(c->parameter);
 257         assert(c->type == CONDITION_HOST);
 258
 259         if (sd_id128_from_string(c->parameter, &x) >= 0) {
 260
 261                 r = sd_id128_get_machine(&y);
 262                 if (r < 0)
 263                         return r;
 264
 265                 return sd_id128_equal(x, y);
 266         }
 267
 268         h = gethostname_malloc();
 269         if (!h)
 270                 return -ENOMEM;
 271
 272         return fnmatch(c->parameter, h, FNM_CASEFOLD) == 0;
 273 }
 274
 275 static int condition_test_ac_power(Condition *c) {
 276         int r;
 277
 278         assert(c);
 279         assert(c->parameter);
 280         assert(c->type == CONDITION_AC_POWER);
 281
 282         r = parse_boolean(c->parameter);
 283         if (r < 0)
 284                 return r;
 285
 286         return (on_ac_power() != 0) == !!r;
 287 }
 288
 289 static int condition_test_security(Condition *c) {
 290         assert(c);
 291         assert(c->parameter);
 292         assert(c->type == CONDITION_SECURITY);
 293
 294         if (streq(c->parameter, "selinux"))
 295                 return mac_selinux_use();
 296         if (streq(c->parameter, "smack"))
 297                 return mac_smack_use();
 298         if (streq(c->parameter, "apparmor"))
 299                 return mac_apparmor_use();
 300         if (streq(c->parameter, "audit"))
 301                 return use_audit();
 302         if (streq(c->parameter, "ima"))
 303                 return use_ima();
 304
 305         return false;
 306 }
 307
 308 static int condition_test_capability(Condition *c) {
 309         _cleanup_fclose_ FILE *f = NULL;
 310         int value;
 311         char line[LINE_MAX];
 312         unsigned long long capabilities = -1;
 313
 314         assert(c);
 315         assert(c->parameter);
 316         assert(c->type == CONDITION_CAPABILITY);
 317
 318         /* If it's an invalid capability, we don't have it */
 319         value = capability_from_name(c->parameter);
 320         if (value < 0)
 321                 return -EINVAL;
 322
 323         /* If it's a valid capability we default to assume
 324          * that we have it */
 325
 326         f = fopen("/proc/self/status", "re");
 327         if (!f)
 328                 return -errno;
 329
 330         while (fgets(line, sizeof(line), f)) {
 331                 truncate_nl(line);
 332
 333                 if (startswith(line, "CapBnd:")) {
 334                         (void) sscanf(line+7, "%llx", &capabilities);
 335                         break;
 336                 }
 337         }
 338
 339         return !!(capabilities & (1ULL << value));
 340 }
 341
 342 static int condition_test_needs_update(Condition *c) {
 343         const char *p;
 344         struct stat usr, other;
 345
 346         assert(c);
 347         assert(c->parameter);
 348         assert(c->type == CONDITION_NEEDS_UPDATE);
 349
 350         /* If the file system is read-only we shouldn't suggest an update */
 351         if (path_is_read_only_fs(c->parameter) > 0)
 352                 return false;
 353
 354         /* Any other failure means we should allow the condition to be true,
 355          * so that we rather invoke too many update tools than too
 356          * few. */
 357
 358         if (!path_is_absolute(c->parameter))
 359                 return true;
 360
 361         p = strjoina(c->parameter, "/.updated");
 362         if (lstat(p, &other) < 0)
 363                 return true;
 364
 365         if (lstat("/usr/", &usr) < 0)
 366                 return true;
 367
 368         /*
 369          * First, compare seconds as they are always accurate...
 370          */
 371         if (usr.st_mtim.tv_sec != other.st_mtim.tv_sec)
 372                 return usr.st_mtim.tv_sec > other.st_mtim.tv_sec;
 373
 374         /*
 375          * ...then compare nanoseconds.
 376          *
 377          * A false positive is only possible when /usr's nanoseconds > 0
 378          * (otherwise /usr cannot be strictly newer than the target file)
 379          * AND the target file's nanoseconds == 0
 380          * (otherwise the filesystem supports nsec timestamps, see stat(2)).
 381          */
 382         if (usr.st_mtim.tv_nsec > 0 && other.st_mtim.tv_nsec == 0) {
 383                 _cleanup_free_ char *timestamp_str = NULL;
 384                 uint64_t timestamp;
 385                 int r;
 386
 387                 r = parse_env_file(p, NULL, "TIMESTAMP_NSEC", &timestamp_str, NULL);
 388                 if (r < 0) {
 389                         log_error_errno(r, "Failed to parse timestamp file '%s', using mtime: %m", p);
 390                         return true;
 391                 } else if (r == 0) {
 392                         log_debug("No data in timestamp file '%s', using mtime", p);
 393                         return true;
 394                 }
 395
 396                 r = safe_atou64(timestamp_str, &timestamp);
 397                 if (r < 0) {
 398                         log_error_errno(r, "Failed to parse timestamp value '%s' in file '%s', using mtime: %m", timestamp_str, p);
 399                         return true;
 400                 }
 401
 402                 timespec_store(&other.st_mtim, timestamp);
 403         }
 404
 405         return usr.st_mtim.tv_nsec > other.st_mtim.tv_nsec;
 406 }
 407
 408 static int condition_test_first_boot(Condition *c) {
 409         int r;
 410
 411         assert(c);
 412         assert(c->parameter);
 413         assert(c->type == CONDITION_FIRST_BOOT);
 414
 415         r = parse_boolean(c->parameter);
 416         if (r < 0)
 417                 return r;
 418
 419         return (access("/run/systemd/first-boot", F_OK) >= 0) == !!r;
 420 }
 421
 422 static int condition_test_path_exists(Condition *c) {
 423         assert(c);
 424         assert(c->parameter);
 425         assert(c->type == CONDITION_PATH_EXISTS);
 426
 427         return access(c->parameter, F_OK) >= 0;
 428 }
 429
 430 static int condition_test_path_exists_glob(Condition *c) {
 431         assert(c);
 432         assert(c->parameter);
 433         assert(c->type == CONDITION_PATH_EXISTS_GLOB);
 434
 435         return glob_exists(c->parameter) > 0;
 436 }
 437
 438 static int condition_test_path_is_directory(Condition *c) {
 439         assert(c);
 440         assert(c->parameter);
 441         assert(c->type == CONDITION_PATH_IS_DIRECTORY);
 442
 443         return is_dir(c->parameter, true) > 0;
 444 }
 445
 446 static int condition_test_path_is_symbolic_link(Condition *c) {
 447         assert(c);
 448         assert(c->parameter);
 449         assert(c->type == CONDITION_PATH_IS_SYMBOLIC_LINK);
 450
 451         return is_symlink(c->parameter) > 0;
 452 }
 453
 454 static int condition_test_path_is_mount_point(Condition *c) {
 455         assert(c);
 456         assert(c->parameter);
 457         assert(c->type == CONDITION_PATH_IS_MOUNT_POINT);
 458
 459         return path_is_mount_point(c->parameter, NULL, AT_SYMLINK_FOLLOW) > 0;
 460 }
 461
 462 static int condition_test_path_is_read_write(Condition *c) {
 463         assert(c);
 464         assert(c->parameter);
 465         assert(c->type == CONDITION_PATH_IS_READ_WRITE);
 466
 467         return path_is_read_only_fs(c->parameter) <= 0;
 468 }
 469
 470 static int condition_test_directory_not_empty(Condition *c) {
 471         int r;
 472
 473         assert(c);
 474         assert(c->parameter);
 475         assert(c->type == CONDITION_DIRECTORY_NOT_EMPTY);
 476
 477         r = dir_is_empty(c->parameter);
 478         return r <= 0 && r != -ENOENT;
 479 }
 480
 481 static int condition_test_file_not_empty(Condition *c) {
 482         struct stat st;
 483
 484         assert(c);
 485         assert(c->parameter);
 486         assert(c->type == CONDITION_FILE_NOT_EMPTY);
 487
 488         return (stat(c->parameter, &st) >= 0 &&
 489                 S_ISREG(st.st_mode) &&
 490                 st.st_size > 0);
 491 }
 492
 493 static int condition_test_file_is_executable(Condition *c) {
 494         struct stat st;
 495
 496         assert(c);
 497         assert(c->parameter);
 498         assert(c->type == CONDITION_FILE_IS_EXECUTABLE);
 499
 500         return (stat(c->parameter, &st) >= 0 &&
 501                 S_ISREG(st.st_mode) &&
 502                 (st.st_mode & 0111));
 503 }
 504
 505 static int condition_test_null(Condition *c) {
 506         assert(c);
 507         assert(c->type == CONDITION_NULL);
 508
 509         /* Note that during parsing we already evaluate the string and
 510          * store it in c->negate */
 511         return true;
 512 }
 513
 514 int condition_test(Condition *c) {
 515
 516         static int (*const condition_tests[_CONDITION_TYPE_MAX])(Condition *c) = {
 517                 [CONDITION_PATH_EXISTS] = condition_test_path_exists,
 518                 [CONDITION_PATH_EXISTS_GLOB] = condition_test_path_exists_glob,
 519                 [CONDITION_PATH_IS_DIRECTORY] = condition_test_path_is_directory,
 520                 [CONDITION_PATH_IS_SYMBOLIC_LINK] = condition_test_path_is_symbolic_link,
 521                 [CONDITION_PATH_IS_MOUNT_POINT] = condition_test_path_is_mount_point,
 522                 [CONDITION_PATH_IS_READ_WRITE] = condition_test_path_is_read_write,
 523                 [CONDITION_DIRECTORY_NOT_EMPTY] = condition_test_directory_not_empty,
 524                 [CONDITION_FILE_NOT_EMPTY] = condition_test_file_not_empty,
 525                 [CONDITION_FILE_IS_EXECUTABLE] = condition_test_file_is_executable,
 526                 [CONDITION_KERNEL_COMMAND_LINE] = condition_test_kernel_command_line,
 527                 [CONDITION_VIRTUALIZATION] = condition_test_virtualization,
 528                 [CONDITION_SECURITY] = condition_test_security,
 529                 [CONDITION_CAPABILITY] = condition_test_capability,
 530                 [CONDITION_HOST] = condition_test_host,
 531                 [CONDITION_AC_POWER] = condition_test_ac_power,
 532                 [CONDITION_ARCHITECTURE] = condition_test_architecture,
 533                 [CONDITION_NEEDS_UPDATE] = condition_test_needs_update,
 534                 [CONDITION_FIRST_BOOT] = condition_test_first_boot,
 535                 [CONDITION_USER] = condition_test_user,
 536                 [CONDITION_GROUP] = condition_test_group,
 537                 [CONDITION_NULL] = condition_test_null,
 538         };
 539
 540         int r, b;
 541
 542         assert(c);
 543         assert(c->type >= 0);
 544         assert(c->type < _CONDITION_TYPE_MAX);
 545
 546         r = condition_tests[c->type](c);
 547         if (r < 0) {
 548                 c->result = CONDITION_ERROR;
 549                 return r;
 550         }
 551
 552         b = (r > 0) == !c->negate;
 553         c->result = b ? CONDITION_SUCCEEDED : CONDITION_FAILED;
 554         return b;
 555 }
 556
 557 void condition_dump(Condition *c, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 558         assert(c);
 559         assert(f);
 560
 561         if (!prefix)
 562                 prefix = "";
 563
 564         fprintf(f,
 565                 "%s\t%s: %s%s%s %s\n",
 566                 prefix,
 567                 to_string(c->type),
 568                 c->trigger ? "|" : "",
 569                 c->negate ? "!" : "",
 570                 c->parameter,
 571                 condition_result_to_string(c->result));
 572 }
 573
 574 void condition_dump_list(Condition *first, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 575         Condition *c;
 576
 577         LIST_FOREACH(conditions, c, first)
 578                 condition_dump(c, f, prefix, to_string);
 579 }
 580
 581 static const char* const condition_type_table[_CONDITION_TYPE_MAX] = {
 582         [CONDITION_ARCHITECTURE] = "ConditionArchitecture",
 583         [CONDITION_VIRTUALIZATION] = "ConditionVirtualization",
 584         [CONDITION_HOST] = "ConditionHost",
 585         [CONDITION_KERNEL_COMMAND_LINE] = "ConditionKernelCommandLine",
 586         [CONDITION_SECURITY] = "ConditionSecurity",
 587         [CONDITION_CAPABILITY] = "ConditionCapability",
 588         [CONDITION_AC_POWER] = "ConditionACPower",
 589         [CONDITION_NEEDS_UPDATE] = "ConditionNeedsUpdate",
 590         [CONDITION_FIRST_BOOT] = "ConditionFirstBoot",
 591         [CONDITION_PATH_EXISTS] = "ConditionPathExists",
 592         [CONDITION_PATH_EXISTS_GLOB] = "ConditionPathExistsGlob",
 593         [CONDITION_PATH_IS_DIRECTORY] = "ConditionPathIsDirectory",
 594         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "ConditionPathIsSymbolicLink",
 595         [CONDITION_PATH_IS_MOUNT_POINT] = "ConditionPathIsMountPoint",
 596         [CONDITION_PATH_IS_READ_WRITE] = "ConditionPathIsReadWrite",
 597         [CONDITION_DIRECTORY_NOT_EMPTY] = "ConditionDirectoryNotEmpty",
 598         [CONDITION_FILE_NOT_EMPTY] = "ConditionFileNotEmpty",
 599         [CONDITION_FILE_IS_EXECUTABLE] = "ConditionFileIsExecutable",
 600         [CONDITION_USER] = "ConditionUser",
 601         [CONDITION_GROUP] = "ConditionGroup",
 602         [CONDITION_NULL] = "ConditionNull"
 603 };
 604
 605 DEFINE_STRING_TABLE_LOOKUP(condition_type, ConditionType);
 606
 607 static const char* const assert_type_table[_CONDITION_TYPE_MAX] = {
 608         [CONDITION_ARCHITECTURE] = "AssertArchitecture",
 609         [CONDITION_VIRTUALIZATION] = "AssertVirtualization",
 610         [CONDITION_HOST] = "AssertHost",
 611         [CONDITION_KERNEL_COMMAND_LINE] = "AssertKernelCommandLine",
 612         [CONDITION_SECURITY] = "AssertSecurity",
 613         [CONDITION_CAPABILITY] = "AssertCapability",
 614         [CONDITION_AC_POWER] = "AssertACPower",
 615         [CONDITION_NEEDS_UPDATE] = "AssertNeedsUpdate",
 616         [CONDITION_FIRST_BOOT] = "AssertFirstBoot",
 617         [CONDITION_PATH_EXISTS] = "AssertPathExists",
 618         [CONDITION_PATH_EXISTS_GLOB] = "AssertPathExistsGlob",
 619         [CONDITION_PATH_IS_DIRECTORY] = "AssertPathIsDirectory",
 620         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "AssertPathIsSymbolicLink",
 621         [CONDITION_PATH_IS_MOUNT_POINT] = "AssertPathIsMountPoint",
 622         [CONDITION_PATH_IS_READ_WRITE] = "AssertPathIsReadWrite",
 623         [CONDITION_DIRECTORY_NOT_EMPTY] = "AssertDirectoryNotEmpty",
 624         [CONDITION_FILE_NOT_EMPTY] = "AssertFileNotEmpty",
 625         [CONDITION_FILE_IS_EXECUTABLE] = "AssertFileIsExecutable",
 626         [CONDITION_USER] = "AssertUser",
 627         [CONDITION_GROUP] = "AssertGroup",
 628         [CONDITION_NULL] = "AssertNull"
 629 };
 630
 631 DEFINE_STRING_TABLE_LOOKUP(assert_type, ConditionType);
 632
 633 static const char* const condition_result_table[_CONDITION_RESULT_MAX] = {
 634         [CONDITION_UNTESTED] = "untested",
 635         [CONDITION_SUCCEEDED] = "succeeded",
 636         [CONDITION_FAILED] = "failed",
 637         [CONDITION_ERROR] = "error",
 638 };
 639
 640 DEFINE_STRING_TABLE_LOOKUP(condition_result, ConditionResult);