src/shared/condition.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <fcntl.h>
  22 #include <fnmatch.h>
  23 #include <limits.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/stat.h>
  27 #include <time.h>
  28 #include <unistd.h>
  29
  30 #include "sd-id128.h"
  31
  32 #include "alloc-util.h"
  33 #include "apparmor-util.h"
  34 #include "architecture.h"
  35 #include "audit-util.h"
  36 #include "cap-list.h"
  37 #include "condition.h"
  38 #include "extract-word.h"
  39 #include "fd-util.h"
  40 #include "fileio.h"
  41 #include "glob-util.h"
  42 #include "hostname-util.h"
  43 #include "ima-util.h"
  44 #include "list.h"
  45 #include "macro.h"
  46 #include "mount-util.h"
  47 #include "parse-util.h"
  48 #include "path-util.h"
  49 #include "proc-cmdline.h"
  50 #include "selinux-util.h"
  51 #include "smack-util.h"
  52 #include "stat-util.h"
  53 #include "string-table.h"
  54 #include "string-util.h"
  55 #include "util.h"
  56 #include "virt.h"
  57
  58 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
  59         Condition *c;
  60         int r;
  61
  62         assert(type >= 0);
  63         assert(type < _CONDITION_TYPE_MAX);
  64         assert((!parameter) == (type == CONDITION_NULL));
  65
  66         c = new0(Condition, 1);
  67         if (!c)
  68                 return NULL;
  69
  70         c->type = type;
  71         c->trigger = trigger;
  72         c->negate = negate;
  73
  74         r = free_and_strdup(&c->parameter, parameter);
  75         if (r < 0) {
  76                 free(c);
  77                 return NULL;
  78         }
  79
  80         return c;
  81 }
  82
  83 void condition_free(Condition *c) {
  84         assert(c);
  85
  86         free(c->parameter);
  87         free(c);
  88 }
  89
  90 Condition* condition_free_list(Condition *first) {
  91         Condition *c, *n;
  92
  93         LIST_FOREACH_SAFE(conditions, c, n, first)
  94                 condition_free(c);
  95
  96         return NULL;
  97 }
  98
  99 static int condition_test_kernel_command_line(Condition *c) {
 100         _cleanup_free_ char *line = NULL;
 101         const char *p;
 102         bool equal;
 103         int r;
 104
 105         assert(c);
 106         assert(c->parameter);
 107         assert(c->type == CONDITION_KERNEL_COMMAND_LINE);
 108
 109         r = proc_cmdline(&line);
 110         if (r < 0)
 111                 return r;
 112
 113         equal = !!strchr(c->parameter, '=');
 114         p = line;
 115
 116         for (;;) {
 117                 _cleanup_free_ char *word = NULL;
 118                 bool found;
 119
 120                 r = extract_first_word(&p, &word, NULL, EXTRACT_QUOTES|EXTRACT_RELAX);
 121                 if (r < 0)
 122                         return r;
 123                 if (r == 0)
 124                         break;
 125
 126                 if (equal)
 127                         found = streq(word, c->parameter);
 128                 else {
 129                         const char *f;
 130
 131                         f = startswith(word, c->parameter);
 132                         found = f && (*f == '=' || *f == 0);
 133                 }
 134
 135                 if (found)
 136                         return true;
 137         }
 138
 139         return false;
 140 }
 141
 142 static int condition_test_virtualization(Condition *c) {
 143         int b, v;
 144
 145         assert(c);
 146         assert(c->parameter);
 147         assert(c->type == CONDITION_VIRTUALIZATION);
 148
 149         v = detect_virtualization();
 150         if (v < 0)
 151                 return v;
 152
 153         /* First, compare with yes/no */
 154         b = parse_boolean(c->parameter);
 155
 156         if (v > 0 && b > 0)
 157                 return true;
 158
 159         if (v == 0 && b == 0)
 160                 return true;
 161
 162         /* Then, compare categorization */
 163         if (VIRTUALIZATION_IS_VM(v) && streq(c->parameter, "vm"))
 164                 return true;
 165
 166         if (VIRTUALIZATION_IS_CONTAINER(v) && streq(c->parameter, "container"))
 167                 return true;
 168
 169         /* Finally compare id */
 170         return v != VIRTUALIZATION_NONE && streq(c->parameter, virtualization_to_string(v));
 171 }
 172
 173 static int condition_test_architecture(Condition *c) {
 174         int a, b;
 175
 176         assert(c);
 177         assert(c->parameter);
 178         assert(c->type == CONDITION_ARCHITECTURE);
 179
 180         a = uname_architecture();
 181         if (a < 0)
 182                 return a;
 183
 184         if (streq(c->parameter, "native"))
 185                 b = native_architecture();
 186         else {
 187                 b = architecture_from_string(c->parameter);
 188                 if (b < 0) /* unknown architecture? Then it's definitely not ours */
 189                         return false;
 190         }
 191
 192         return a == b;
 193 }
 194
 195 static int condition_test_host(Condition *c) {
 196         _cleanup_free_ char *h = NULL;
 197         sd_id128_t x, y;
 198         int r;
 199
 200         assert(c);
 201         assert(c->parameter);
 202         assert(c->type == CONDITION_HOST);
 203
 204         if (sd_id128_from_string(c->parameter, &x) >= 0) {
 205
 206                 r = sd_id128_get_machine(&y);
 207                 if (r < 0)
 208                         return r;
 209
 210                 return sd_id128_equal(x, y);
 211         }
 212
 213         h = gethostname_malloc();
 214         if (!h)
 215                 return -ENOMEM;
 216
 217         return fnmatch(c->parameter, h, FNM_CASEFOLD) == 0;
 218 }
 219
 220 static int condition_test_ac_power(Condition *c) {
 221         int r;
 222
 223         assert(c);
 224         assert(c->parameter);
 225         assert(c->type == CONDITION_AC_POWER);
 226
 227         r = parse_boolean(c->parameter);
 228         if (r < 0)
 229                 return r;
 230
 231         return (on_ac_power() != 0) == !!r;
 232 }
 233
 234 static int condition_test_security(Condition *c) {
 235         assert(c);
 236         assert(c->parameter);
 237         assert(c->type == CONDITION_SECURITY);
 238
 239         if (streq(c->parameter, "selinux"))
 240                 return mac_selinux_have();
 241         if (streq(c->parameter, "smack"))
 242                 return mac_smack_use();
 243         if (streq(c->parameter, "apparmor"))
 244                 return mac_apparmor_use();
 245         if (streq(c->parameter, "audit"))
 246                 return use_audit();
 247         if (streq(c->parameter, "ima"))
 248                 return use_ima();
 249
 250         return false;
 251 }
 252
 253 static int condition_test_capability(Condition *c) {
 254         _cleanup_fclose_ FILE *f = NULL;
 255         int value;
 256         char line[LINE_MAX];
 257         unsigned long long capabilities = -1;
 258
 259         assert(c);
 260         assert(c->parameter);
 261         assert(c->type == CONDITION_CAPABILITY);
 262
 263         /* If it's an invalid capability, we don't have it */
 264         value = capability_from_name(c->parameter);
 265         if (value < 0)
 266                 return -EINVAL;
 267
 268         /* If it's a valid capability we default to assume
 269          * that we have it */
 270
 271         f = fopen("/proc/self/status", "re");
 272         if (!f)
 273                 return -errno;
 274
 275         while (fgets(line, sizeof(line), f)) {
 276                 truncate_nl(line);
 277
 278                 if (startswith(line, "CapBnd:")) {
 279                         (void) sscanf(line+7, "%llx", &capabilities);
 280                         break;
 281                 }
 282         }
 283
 284         return !!(capabilities & (1ULL << value));
 285 }
 286
 287 static int condition_test_needs_update(Condition *c) {
 288         const char *p;
 289         struct stat usr, other;
 290
 291         assert(c);
 292         assert(c->parameter);
 293         assert(c->type == CONDITION_NEEDS_UPDATE);
 294
 295         /* If the file system is read-only we shouldn't suggest an update */
 296         if (path_is_read_only_fs(c->parameter) > 0)
 297                 return false;
 298
 299         /* Any other failure means we should allow the condition to be true,
 300          * so that we rather invoke too many update tools than too
 301          * few. */
 302
 303         if (!path_is_absolute(c->parameter))
 304                 return true;
 305
 306         p = strjoina(c->parameter, "/.updated");
 307         if (lstat(p, &other) < 0)
 308                 return true;
 309
 310         if (lstat("/usr/", &usr) < 0)
 311                 return true;
 312
 313         /*
 314          * First, compare seconds as they are always accurate...
 315          */
 316         if (usr.st_mtim.tv_sec != other.st_mtim.tv_sec)
 317                 return usr.st_mtim.tv_sec > other.st_mtim.tv_sec;
 318
 319         /*
 320          * ...then compare nanoseconds.
 321          *
 322          * A false positive is only possible when /usr's nanoseconds > 0
 323          * (otherwise /usr cannot be strictly newer than the target file)
 324          * AND the target file's nanoseconds == 0
 325          * (otherwise the filesystem supports nsec timestamps, see stat(2)).
 326          */
 327         if (usr.st_mtim.tv_nsec > 0 && other.st_mtim.tv_nsec == 0) {
 328                 _cleanup_free_ char *timestamp_str = NULL;
 329                 uint64_t timestamp;
 330                 int r;
 331
 332                 r = parse_env_file(p, NULL, "TIMESTAMP_NSEC", &timestamp_str, NULL);
 333                 if (r < 0) {
 334                         log_error_errno(r, "Failed to parse timestamp file '%s', using mtime: %m", p);
 335                         return true;
 336                 } else if (r == 0) {
 337                         log_debug("No data in timestamp file '%s', using mtime", p);
 338                         return true;
 339                 }
 340
 341                 r = safe_atou64(timestamp_str, &timestamp);
 342                 if (r < 0) {
 343                         log_error_errno(r, "Failed to parse timestamp value '%s' in file '%s', using mtime: %m", timestamp_str, p);
 344                         return true;
 345                 }
 346
 347                 timespec_store(&other.st_mtim, timestamp);
 348         }
 349
 350         return usr.st_mtim.tv_nsec > other.st_mtim.tv_nsec;
 351 }
 352
 353 static int condition_test_first_boot(Condition *c) {
 354         int r;
 355
 356         assert(c);
 357         assert(c->parameter);
 358         assert(c->type == CONDITION_FIRST_BOOT);
 359
 360         r = parse_boolean(c->parameter);
 361         if (r < 0)
 362                 return r;
 363
 364         return (access("/run/systemd/first-boot", F_OK) >= 0) == !!r;
 365 }
 366
 367 static int condition_test_path_exists(Condition *c) {
 368         assert(c);
 369         assert(c->parameter);
 370         assert(c->type == CONDITION_PATH_EXISTS);
 371
 372         return access(c->parameter, F_OK) >= 0;
 373 }
 374
 375 static int condition_test_path_exists_glob(Condition *c) {
 376         assert(c);
 377         assert(c->parameter);
 378         assert(c->type == CONDITION_PATH_EXISTS_GLOB);
 379
 380         return glob_exists(c->parameter) > 0;
 381 }
 382
 383 static int condition_test_path_is_directory(Condition *c) {
 384         assert(c);
 385         assert(c->parameter);
 386         assert(c->type == CONDITION_PATH_IS_DIRECTORY);
 387
 388         return is_dir(c->parameter, true) > 0;
 389 }
 390
 391 static int condition_test_path_is_symbolic_link(Condition *c) {
 392         assert(c);
 393         assert(c->parameter);
 394         assert(c->type == CONDITION_PATH_IS_SYMBOLIC_LINK);
 395
 396         return is_symlink(c->parameter) > 0;
 397 }
 398
 399 static int condition_test_path_is_mount_point(Condition *c) {
 400         assert(c);
 401         assert(c->parameter);
 402         assert(c->type == CONDITION_PATH_IS_MOUNT_POINT);
 403
 404         return path_is_mount_point(c->parameter, AT_SYMLINK_FOLLOW) > 0;
 405 }
 406
 407 static int condition_test_path_is_read_write(Condition *c) {
 408         assert(c);
 409         assert(c->parameter);
 410         assert(c->type == CONDITION_PATH_IS_READ_WRITE);
 411
 412         return path_is_read_only_fs(c->parameter) <= 0;
 413 }
 414
 415 static int condition_test_directory_not_empty(Condition *c) {
 416         int r;
 417
 418         assert(c);
 419         assert(c->parameter);
 420         assert(c->type == CONDITION_DIRECTORY_NOT_EMPTY);
 421
 422         r = dir_is_empty(c->parameter);
 423         return r <= 0 && r != -ENOENT;
 424 }
 425
 426 static int condition_test_file_not_empty(Condition *c) {
 427         struct stat st;
 428
 429         assert(c);
 430         assert(c->parameter);
 431         assert(c->type == CONDITION_FILE_NOT_EMPTY);
 432
 433         return (stat(c->parameter, &st) >= 0 &&
 434                 S_ISREG(st.st_mode) &&
 435                 st.st_size > 0);
 436 }
 437
 438 static int condition_test_file_is_executable(Condition *c) {
 439         struct stat st;
 440
 441         assert(c);
 442         assert(c->parameter);
 443         assert(c->type == CONDITION_FILE_IS_EXECUTABLE);
 444
 445         return (stat(c->parameter, &st) >= 0 &&
 446                 S_ISREG(st.st_mode) &&
 447                 (st.st_mode & 0111));
 448 }
 449
 450 static int condition_test_null(Condition *c) {
 451         assert(c);
 452         assert(c->type == CONDITION_NULL);
 453
 454         /* Note that during parsing we already evaluate the string and
 455          * store it in c->negate */
 456         return true;
 457 }
 458
 459 int condition_test(Condition *c) {
 460
 461         static int (*const condition_tests[_CONDITION_TYPE_MAX])(Condition *c) = {
 462                 [CONDITION_PATH_EXISTS] = condition_test_path_exists,
 463                 [CONDITION_PATH_EXISTS_GLOB] = condition_test_path_exists_glob,
 464                 [CONDITION_PATH_IS_DIRECTORY] = condition_test_path_is_directory,
 465                 [CONDITION_PATH_IS_SYMBOLIC_LINK] = condition_test_path_is_symbolic_link,
 466                 [CONDITION_PATH_IS_MOUNT_POINT] = condition_test_path_is_mount_point,
 467                 [CONDITION_PATH_IS_READ_WRITE] = condition_test_path_is_read_write,
 468                 [CONDITION_DIRECTORY_NOT_EMPTY] = condition_test_directory_not_empty,
 469                 [CONDITION_FILE_NOT_EMPTY] = condition_test_file_not_empty,
 470                 [CONDITION_FILE_IS_EXECUTABLE] = condition_test_file_is_executable,
 471                 [CONDITION_KERNEL_COMMAND_LINE] = condition_test_kernel_command_line,
 472                 [CONDITION_VIRTUALIZATION] = condition_test_virtualization,
 473                 [CONDITION_SECURITY] = condition_test_security,
 474                 [CONDITION_CAPABILITY] = condition_test_capability,
 475                 [CONDITION_HOST] = condition_test_host,
 476                 [CONDITION_AC_POWER] = condition_test_ac_power,
 477                 [CONDITION_ARCHITECTURE] = condition_test_architecture,
 478                 [CONDITION_NEEDS_UPDATE] = condition_test_needs_update,
 479                 [CONDITION_FIRST_BOOT] = condition_test_first_boot,
 480                 [CONDITION_NULL] = condition_test_null,
 481         };
 482
 483         int r, b;
 484
 485         assert(c);
 486         assert(c->type >= 0);
 487         assert(c->type < _CONDITION_TYPE_MAX);
 488
 489         r = condition_tests[c->type](c);
 490         if (r < 0) {
 491                 c->result = CONDITION_ERROR;
 492                 return r;
 493         }
 494
 495         b = (r > 0) == !c->negate;
 496         c->result = b ? CONDITION_SUCCEEDED : CONDITION_FAILED;
 497         return b;
 498 }
 499
 500 void condition_dump(Condition *c, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 501         assert(c);
 502         assert(f);
 503
 504         if (!prefix)
 505                 prefix = "";
 506
 507         fprintf(f,
 508                 "%s\t%s: %s%s%s %s\n",
 509                 prefix,
 510                 to_string(c->type),
 511                 c->trigger ? "|" : "",
 512                 c->negate ? "!" : "",
 513                 c->parameter,
 514                 condition_result_to_string(c->result));
 515 }
 516
 517 void condition_dump_list(Condition *first, FILE *f, const char *prefix, const char *(*to_string)(ConditionType t)) {
 518         Condition *c;
 519
 520         LIST_FOREACH(conditions, c, first)
 521                 condition_dump(c, f, prefix, to_string);
 522 }
 523
 524 static const char* const condition_type_table[_CONDITION_TYPE_MAX] = {
 525         [CONDITION_ARCHITECTURE] = "ConditionArchitecture",
 526         [CONDITION_VIRTUALIZATION] = "ConditionVirtualization",
 527         [CONDITION_HOST] = "ConditionHost",
 528         [CONDITION_KERNEL_COMMAND_LINE] = "ConditionKernelCommandLine",
 529         [CONDITION_SECURITY] = "ConditionSecurity",
 530         [CONDITION_CAPABILITY] = "ConditionCapability",
 531         [CONDITION_AC_POWER] = "ConditionACPower",
 532         [CONDITION_NEEDS_UPDATE] = "ConditionNeedsUpdate",
 533         [CONDITION_FIRST_BOOT] = "ConditionFirstBoot",
 534         [CONDITION_PATH_EXISTS] = "ConditionPathExists",
 535         [CONDITION_PATH_EXISTS_GLOB] = "ConditionPathExistsGlob",
 536         [CONDITION_PATH_IS_DIRECTORY] = "ConditionPathIsDirectory",
 537         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "ConditionPathIsSymbolicLink",
 538         [CONDITION_PATH_IS_MOUNT_POINT] = "ConditionPathIsMountPoint",
 539         [CONDITION_PATH_IS_READ_WRITE] = "ConditionPathIsReadWrite",
 540         [CONDITION_DIRECTORY_NOT_EMPTY] = "ConditionDirectoryNotEmpty",
 541         [CONDITION_FILE_NOT_EMPTY] = "ConditionFileNotEmpty",
 542         [CONDITION_FILE_IS_EXECUTABLE] = "ConditionFileIsExecutable",
 543         [CONDITION_NULL] = "ConditionNull"
 544 };
 545
 546 DEFINE_STRING_TABLE_LOOKUP(condition_type, ConditionType);
 547
 548 static const char* const assert_type_table[_CONDITION_TYPE_MAX] = {
 549         [CONDITION_ARCHITECTURE] = "AssertArchitecture",
 550         [CONDITION_VIRTUALIZATION] = "AssertVirtualization",
 551         [CONDITION_HOST] = "AssertHost",
 552         [CONDITION_KERNEL_COMMAND_LINE] = "AssertKernelCommandLine",
 553         [CONDITION_SECURITY] = "AssertSecurity",
 554         [CONDITION_CAPABILITY] = "AssertCapability",
 555         [CONDITION_AC_POWER] = "AssertACPower",
 556         [CONDITION_NEEDS_UPDATE] = "AssertNeedsUpdate",
 557         [CONDITION_FIRST_BOOT] = "AssertFirstBoot",
 558         [CONDITION_PATH_EXISTS] = "AssertPathExists",
 559         [CONDITION_PATH_EXISTS_GLOB] = "AssertPathExistsGlob",
 560         [CONDITION_PATH_IS_DIRECTORY] = "AssertPathIsDirectory",
 561         [CONDITION_PATH_IS_SYMBOLIC_LINK] = "AssertPathIsSymbolicLink",
 562         [CONDITION_PATH_IS_MOUNT_POINT] = "AssertPathIsMountPoint",
 563         [CONDITION_PATH_IS_READ_WRITE] = "AssertPathIsReadWrite",
 564         [CONDITION_DIRECTORY_NOT_EMPTY] = "AssertDirectoryNotEmpty",
 565         [CONDITION_FILE_NOT_EMPTY] = "AssertFileNotEmpty",
 566         [CONDITION_FILE_IS_EXECUTABLE] = "AssertFileIsExecutable",
 567         [CONDITION_NULL] = "AssertNull"
 568 };
 569
 570 DEFINE_STRING_TABLE_LOOKUP(assert_type, ConditionType);
 571
 572 static const char* const condition_result_table[_CONDITION_RESULT_MAX] = {
 573         [CONDITION_UNTESTED] = "untested",
 574         [CONDITION_SUCCEEDED] = "succeeded",
 575         [CONDITION_FAILED] = "failed",
 576         [CONDITION_ERROR] = "error",
 577 };
 578
 579 DEFINE_STRING_TABLE_LOOKUP(condition_result, ConditionResult);