src/shared/condition.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <fnmatch.h>
  23 #include <limits.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/stat.h>
  27 #include <time.h>
  28 #include <unistd.h>
  29
  30 #include "sd-id128.h"
  31
  32 #include "alloc-util.h"
  33 #include "apparmor-util.h"
  34 #include "architecture.h"
  35 #include "audit-util.h"
  36 #include "cap-list.h"
  37 #include "condition.h"
  38 #include "extract-word.h"
  39 #include "fd-util.h"
  40 #include "glob-util.h"
  41 #include "hostname-util.h"
  42 #include "ima-util.h"
  43 #include "list.h"
  44 #include "macro.h"
  45 #include "mount-util.h"
  46 #include "parse-util.h"
  47 #include "path-util.h"
  48 #include "proc-cmdline.h"
  49 #include "selinux-util.h"
  50 #include "smack-util.h"
  51 #include "stat-util.h"
  52 #include "string-table.h"
  53 #include "string-util.h"
  54 #include "util.h"
  55 #include "virt.h"
  56
  57 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
  58         Condition *c;
  59         int r;
  60
  61         assert(type >= 0);
  62         assert(type < _CONDITION_TYPE_MAX);
  63         assert((!parameter) == (type == CONDITION_NULL));
  64
  65         c = new0(Condition, 1);
  66         if (!c)
  67                 return NULL;
  68
  69         c->type = type;
  70         c->trigger = trigger;
  71         c->negate = negate;
  72
  73         r = free_and_strdup(&c->parameter, parameter);
  74         if (r < 0) {
  75                 free(c);
  76                 return NULL;
  77         }
  78
  79         return c;
  80 }
  81
  82 void condition_free(Condition *c) {
  83         assert(c);
  84
  85         free(c->parameter);
  86         free(c);
  87 }
  88
  89 Condition* condition_free_list(Condition *first) {
  90         Condition *c, *n;
  91
  92         LIST_FOREACH_SAFE(conditions, c, n, first)
  93                 condition_free(c);
  94
  95         return NULL;
  96 }
  97
  98 static int condition_test_kernel_command_line(Condition *c) {
  99         _cleanup_free_ char *line = NULL;
 100         const char *p;
 101         bool equal;
 102         int r;
 103
 104         assert(c);
 105         assert(c->parameter);
 106         assert(c->type == CONDITION_KERNEL_COMMAND_LINE);
 107
 108         r = proc_cmdline(&line);
 109         if (r < 0)
 110                 return r;
 111
 112         equal = !!strchr(c->parameter, '=');
 113         p = line;
 114
 115         for (;;) {
 116                 _cleanup_free_ char *word = NULL;
 117                 bool found;
 118
 119                 r = extract_first_word(&p, &word, NULL, EXTRACT_QUOTES|EXTRACT_RELAX);
 120                 if (r < 0)
 121                         return r;
 122                 if (r == 0)
 123                         break;
 124
 125                 if (equal)
 126                         found = streq(word, c->parameter);
 127                 else {
 128                         const char *f;
 129
 130                         f = startswith(word, c->parameter);
 131                         found = f && (*f == '=' || *f == 0);
 132                 }
 133
 134                 if (found)
 135                         return true;
 136         }
 137
 138         return false;
 139 }
 140
 141 static int condition_test_virtualization(Condition *c) {
 142         int b, v;
 143
 144         assert(c);
 145         assert(c->parameter);
 146         assert(c->type == CONDITION_VIRTUALIZATION);
 147
 148         v = detect_virtualization();
 149         if (v < 0)
 150                 return v;
 151
 152         /* First, compare with yes/no */
 153         b = parse_boolean(c->parameter);
 154
 155         if (v > 0 && b > 0)
 156                 return true;
 157
 158         if (v == 0 && b == 0)
 159                 return true;
 160
 161         /* Then, compare categorization */
 162         if (VIRTUALIZATION_IS_VM(v) && streq(c->parameter, "vm"))
 163                 return true;
 164
 165         if (VIRTUALIZATION_IS_CONTAINER(v) && streq(c->parameter, "container"))
 166                 return true;
 167
 168         /* Finally compare id */
 169         return v != VIRTUALIZATION_NONE && streq(c->parameter, virtualization_to_string(v));
 170 }
 171
 172 static int condition_test_architecture(Condition *c) {
 173         int a, b;
 174
 175         assert(c);
 176         assert(c->parameter);
 177         assert(c->type == CONDITION_ARCHITECTURE);
 178
 179         a = uname_architecture();
 180         if (a < 0)
 181                 return a;
 182
 183         if (streq(c->parameter, "native"))
 184                 b = native_architecture();
 185         else {
 186                 b = architecture_from_string(c->parameter);
 187                 if (b < 0) /* unknown architecture? Then it's definitely not ours */
 188                         return false;
 189         }
 190
 191         return a == b;
 192 }
 193
 194 static int condition_test_host(Condition *c) {
 195         _cleanup_free_ char *h = NULL;
 196         sd_id128_t x, y;
 197         int r;
 198
 199         assert(c);
 200         assert(c->parameter);
 201         assert(c->type == CONDITION_HOST);
 202
 203         if (sd_id128_from_string(c->parameter, &x) >= 0) {
 204
 205                 r = sd_id128_get_machine(&y);
 206                 if (r < 0)
 207                         return r;
 208
 209                 return sd_id128_equal(x, y);
 210         }
 211
 212         h = gethostname_malloc();
 213         if (!h)
 214                 return -ENOMEM;
 215
 216         return fnmatch(c->parameter, h, FNM_CASEFOLD) == 0;
 217 }
 218
 219 static int condition_test_ac_power(Condition *c) {
 220         int r;
 221
 222         assert(c);
 223         assert(c->parameter);
 224         assert(c->type == CONDITION_AC_POWER);
 225
 226         r = parse_boolean(c->parameter);
 227         if (r < 0)
 228                 return r;
 229
 230         return (on_ac_power() != 0) == !!r;
 231 }
 232
 233 static int condition_test_security(Condition *c) {
 234         assert(c);
 235         assert(c->parameter);
 236         assert(c->type == CONDITION_SECURITY);
 237
 238         if (streq(c->parameter, "selinux"))
 239                 return mac_selinux_have();
 240         if (streq(c->parameter, "smack"))
 241                 return mac_smack_use();
 242         if (streq(c->parameter, "apparmor"))
 243                 return mac_apparmor_use();
 244         if (streq(c->parameter, "audit"))
 245                 return use_audit();
 246         if (streq(c->parameter, "ima"))
 247                 return use_ima();
 248
 249         return false;
 250 }
 251
 252 static int condition_test_capability(Condition *c) {
 253         _cleanup_fclose_ FILE *f = NULL;
 254         int value;
 255         char line[LINE_MAX];
 256         unsigned long long capabilities = -1;
 257
 258         assert(c);
 259         assert(c->parameter);
 260         assert(c->type == CONDITION_CAPABILITY);
 261
 262         /* If it's an invalid capability, we don't have it */
 263         value = capability_from_name(c->parameter);
 264         if (value < 0)
 265                 return -EINVAL;
 266
 267         /* If it's a valid capability we default to assume
 268          * that we have it */
 269
 270         f = fopen("/proc/self/status", "re");
 271         if (!f)
 272                 return -errno;
 273
 274         while (fgets(line, sizeof(line), f)) {
 275                 truncate_nl(line);
 276
 277                 if (startswith(line, "CapBnd:")) {
 278                         (void) sscanf(line+7, "%llx", &capabilities);
 279                         break;
 280                 }
 281         }
 282
 283         return !!(capabilities & (1ULL << value));
 284 }
 285
 286 static int condition_test_needs_update(Condition *c) {
 287         const char *p;
 288         struct stat usr, other;
 289
 290         assert(c);
 291         assert(c->parameter);
 292         assert(c->type == CONDITION_NEEDS_UPDATE);
 293
 294         /* If the file system is read-only we shouldn't suggest an update */
 295         if (path_is_read_only_fs(c->parameter) > 0)
 296                 return false;
 297
 298         /* Any other failure means we should allow the condition to be true,
 299          * so that we rather invoke too many update tools than too
 300          * few. */
 301
 302         if (!path_is_absolute(c->parameter))
 303                 return true;
 304
 305         p = strjoina(c->parameter, "/.updated");
 306         if (lstat(p, &other) < 0)
 307                 return true;
 308
 309         if (lstat("/usr/", &usr) < 0)
 310                 return true;
 311
 312         return usr.st_mtim.tv_sec > other.st_mtim.tv_sec ||
 313                 (usr.st_mtim.tv_sec == other.st_mtim.tv_sec && usr.st_mtim.tv_nsec > other.st_mtim.tv_nsec);
 314 }
 315
 316 static int condition_test_first_boot(Condition *c) {
 317         int r;
 318
 319         assert(c);
 320         assert(c->parameter);
 321         assert(c->type == CONDITION_FIRST_BOOT);
 322
 323         r = parse_boolean(c->parameter);
 324         if (r < 0)
 325                 return r;
 326
 327         return (access("/run/systemd/first-boot", F_OK) >= 0) == !!r;
 328 }
 329
 330 static int condition_test_path_exists(Condition *c) {
 331         assert(c);
 332         assert(c->parameter);
 333         assert(c->type == CONDITION_PATH_EXISTS);
 334
 335         return access(c->parameter, F_OK) >= 0;
 336 }
 337
 338 static int condition_test_path_exists_glob(Condition *c) {
 339         assert(c);
 340         assert(c->parameter);
 341         assert(c->type == CONDITION_PATH_EXISTS_GLOB);
 342
 343         return glob_exists(c->parameter) > 0;
 344 }
 345
 346 static int condition_test_path_is_directory(Condition *c) {
 347         assert(c);
 348         assert(c->parameter);
 349         assert(c->type == CONDITION_PATH_IS_DIRECTORY);
 350
 351         return is_dir(c->parameter, true) > 0;
 352 }
 353
 354 static int condition_test_path_is_symbolic_link(Condition *c) {
 355         assert(c);
 356         assert(c->parameter);
 357         assert(c->type == CONDITION_PATH_IS_SYMBOLIC_LINK);
 358
 359         return is_symlink(c->parameter) > 0;
 360 }
 361
 362 static int condition_test_path_is_mount_point(Condition *c) {
 363         assert(c);
 364         assert(c->parameter);
 365         assert(c->type == CONDITION_PATH_IS_MOUNT_POINT);
 366
 367         return path_is_mount_point(c->parameter, AT_SYMLINK_FOLLOW) > 0;
 368 }
 369
 370 static int condition_test_path_is_read_write(Condition *c) {
 371         assert(c);
 372         assert(c->parameter);
 373         assert(c->type == CONDITION_PATH_IS_READ_WRITE);
 374
 375         return path_is_read_only_fs(c->parameter) <= 0;
 376 }
 377
 378 static int condition_test_directory_not_empty(Condition *c) {
 379         int r;
 380
 381         assert(c);
 382         assert(c->parameter);
 383         assert(c->type == CONDITION_DIRECTORY_NOT_EMPTY);
 384
 385         r = dir_is_empty(c->parameter);
 386         return r <= 0 && r != -ENOENT;
 387 }
 388
 389 static int condition_test_file_not_empty(Condition *c) {
 390         struct stat st;
 391
 392         assert(c);
 393         assert(c->parameter);
 394         assert(c->type == CONDITION_FILE_NOT_EMPTY);
 395
 396         return (stat(c->parameter, &st) >= 0 &&
 397                 S_ISREG(st.st_mode) &&
 398                 st.st_size > 0);
 399 }
 400
 401 static int condition_test_file_is_executable(Condition *c) {
 402         struct stat st;
 403
 404         assert(c);
 405         assert(c->parameter);
 406         assert(c->type == CONDITION_FILE_IS_EXECUTABLE);
 407
 408         return (stat(c->parameter, &st) >= 0 &&
 409                 S_ISREG(st.st_mode) &&
 410                 (st.st_mode & 0111));
 411 }
 412
 413 static int condition_test_null(Condition *c) {
 414         assert(c);
 415         assert(c->type == CONDITION_NULL);
 416
 417         /* Note that during parsing we already evaluate the string and
 418          * store it in c->negate */
 419         return true;
 420 }
 421
 422 int condition_test(Condition *c) {
 423
 424         static int (*const condition_tests[_CONDITION_TYPE_MAX])(Condition *c) = {
 425                 [CONDITION_PATH_EXISTS] = condition_test_path_exists,
 426                 [CONDITION_PATH_EXISTS_GLOB] = condition_test_path_exists_glob,
 427                 [CONDITION_PATH_IS_DIRECTORY] = condition_test_path_is_directory,
 428                 [CONDITION_PATH_IS_SYMBOLIC_LINK] = condition_test_path_is_symbolic_link,
 429                 [CONDITION_PATH_IS_MOUNT_POINT] = condition_test_path_is_mount_point,
 430                 [CONDITION_PATH_IS_READ_WRITE] = condition_test_path_is_read_write,
 431                 [CONDITION_DIRECTORY_NOT_EMPTY] = condition_test_directory_not_empty,
 432                 [CONDITION_FILE_NOT_EMPTY] = condition_test_file_not_empty,
 433                 [CONDITION_FILE_IS_EXECUTABLE] = condition_test_file_is_executable,
 434                 [CONDITION_KERNEL_COMMAND_LINE] = condition_test_kernel_command_line,
 435                 [CONDITION_VIRTUALIZATION] = condition_test_virtualization,
 436                 [CONDITION_SECURITY] = condition_test_security,
 437                 [CONDITION_CAPABILITY] = condition_test_capability,
 438                 [CONDITION_HOST] = condition_test_host,
 439                 [CONDITION_AC_POWER] = condition_test_ac_power,
 440                 [CONDITION_ARCHITECTURE] = condition_test_architecture,
 441                 [CONDITION_NEEDS_UPDATE] = condition_test_needs_update,
 442                 [CONDITION_FIRST_BOOT] = condition_test_first_boot,
 443                 [CONDITION_NULL] = condition_test_null,
 444         };
 445
 446         int r, b;
 447
 448         assert(c);
 449         assert(c->type >= 0);
 450         assert(c->type < _CONDITION_TYPE_MAX);
 451
 452         r = condition_tests[c->type](c);
 453         if (r < 0) {
 454                 c->result = CONDITION_ERROR;
 455                 return r;
 456         }
 457
 458         b = (r > 0) == !c->negate;
 459         c->result = b ? CONDITION_SUCCEEDED : CONDITION_FAILED;
 460         return b;
 461 }
 462
 463 void condition_dump(Condition *c, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 464         assert(c);
 465         assert(f);
 466
 467         if (!prefix)
 468                 prefix = "";
 469
 470         fprintf(f,
 471                 "%s\t%s: %s%s%s %s\n",
 472                 prefix,
 473                 to_string(c->type),
 474                 c->trigger ? "|" : "",
 475                 c->negate ? "!" : "",
 476                 c->parameter,
 477                 condition_result_to_string(c->result));
 478 }
 479
 480 void condition_dump_list(Condition *first, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 481         Condition *c;
 482
 483         LIST_FOREACH(conditions, c, first)
 484                 condition_dump(c, f, prefix, to_string);
 485 }
 486
 487 static const char* const condition_type_table[_CONDITION_TYPE_MAX] = {
 488         [CONDITION_ARCHITECTURE] = "ConditionArchitecture",
 489         [CONDITION_VIRTUALIZATION] = "ConditionVirtualization",
 490         [CONDITION_HOST] = "ConditionHost",
 491         [CONDITION_KERNEL_COMMAND_LINE] = "ConditionKernelCommandLine",
 492         [CONDITION_SECURITY] = "ConditionSecurity",
 493         [CONDITION_CAPABILITY] = "ConditionCapability",
 494         [CONDITION_AC_POWER] = "ConditionACPower",
 495         [CONDITION_NEEDS_UPDATE] = "ConditionNeedsUpdate",
 496         [CONDITION_FIRST_BOOT] = "ConditionFirstBoot",
 497         [CONDITION_PATH_EXISTS] = "ConditionPathExists",
 498         [CONDITION_PATH_EXISTS_GLOB] = "ConditionPathExistsGlob",
 499         [CONDITION_PATH_IS_DIRECTORY] = "ConditionPathIsDirectory",
 500         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "ConditionPathIsSymbolicLink",
 501         [CONDITION_PATH_IS_MOUNT_POINT] = "ConditionPathIsMountPoint",
 502         [CONDITION_PATH_IS_READ_WRITE] = "ConditionPathIsReadWrite",
 503         [CONDITION_DIRECTORY_NOT_EMPTY] = "ConditionDirectoryNotEmpty",
 504         [CONDITION_FILE_NOT_EMPTY] = "ConditionFileNotEmpty",
 505         [CONDITION_FILE_IS_EXECUTABLE] = "ConditionFileIsExecutable",
 506         [CONDITION_NULL] = "ConditionNull"
 507 };
 508
 509 DEFINE_STRING_TABLE_LOOKUP(condition_type, ConditionType);
 510
 511 static const char* const assert_type_table[_CONDITION_TYPE_MAX] = {
 512         [CONDITION_ARCHITECTURE] = "AssertArchitecture",
 513         [CONDITION_VIRTUALIZATION] = "AssertVirtualization",
 514         [CONDITION_HOST] = "AssertHost",
 515         [CONDITION_KERNEL_COMMAND_LINE] = "AssertKernelCommandLine",
 516         [CONDITION_SECURITY] = "AssertSecurity",
 517         [CONDITION_CAPABILITY] = "AssertCapability",
 518         [CONDITION_AC_POWER] = "AssertACPower",
 519         [CONDITION_NEEDS_UPDATE] = "AssertNeedsUpdate",
 520         [CONDITION_FIRST_BOOT] = "AssertFirstBoot",
 521         [CONDITION_PATH_EXISTS] = "AssertPathExists",
 522         [CONDITION_PATH_EXISTS_GLOB] = "AssertPathExistsGlob",
 523         [CONDITION_PATH_IS_DIRECTORY] = "AssertPathIsDirectory",
 524         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "AssertPathIsSymbolicLink",
 525         [CONDITION_PATH_IS_MOUNT_POINT] = "AssertPathIsMountPoint",
 526         [CONDITION_PATH_IS_READ_WRITE] = "AssertPathIsReadWrite",
 527         [CONDITION_DIRECTORY_NOT_EMPTY] = "AssertDirectoryNotEmpty",
 528         [CONDITION_FILE_NOT_EMPTY] = "AssertFileNotEmpty",
 529         [CONDITION_FILE_IS_EXECUTABLE] = "AssertFileIsExecutable",
 530         [CONDITION_NULL] = "AssertNull"
 531 };
 532
 533 DEFINE_STRING_TABLE_LOOKUP(assert_type, ConditionType);
 534
 535 static const char* const condition_result_table[_CONDITION_RESULT_MAX] = {
 536         [CONDITION_UNTESTED] = "untested",
 537         [CONDITION_SUCCEEDED] = "succeeded",
 538         [CONDITION_FAILED] = "failed",
 539         [CONDITION_ERROR] = "error",
 540 };
 541
 542 DEFINE_STRING_TABLE_LOOKUP(condition_result, ConditionResult);