1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
10 #include <sys/types.h>
13 #include "conf-files.h"
14 #include "constants.h"
15 #include "creds-util.h"
16 #include "errno-util.h"
19 #include "glob-util.h"
22 #include "main-func.h"
24 #include "path-util.h"
25 #include "pretty-print.h"
26 #include "string-util.h"
28 #include "sysctl-util.h"
30 static char **arg_prefixes
= NULL
;
31 static CatFlags arg_cat_flags
= CAT_CONFIG_OFF
;
32 static bool arg_strict
= false;
33 static PagerFlags arg_pager_flags
= 0;
35 STATIC_DESTRUCTOR_REGISTER(arg_prefixes
, strv_freep
);
37 typedef struct Option
{
43 static Option
*option_free(Option
*o
) {
53 DEFINE_TRIVIAL_CLEANUP_FUNC(Option
*, option_free
);
54 DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(option_hash_ops
, char, string_hash_func
, string_compare_func
, Option
, option_free
);
56 static bool test_prefix(const char *p
) {
57 if (strv_isempty(arg_prefixes
))
60 return path_startswith_strv(p
, arg_prefixes
);
63 static Option
*option_new(
66 bool ignore_failure
) {
68 _cleanup_(option_freep
) Option
*o
= NULL
;
78 .value
= value
? strdup(value
) : NULL
,
79 .ignore_failure
= ignore_failure
,
84 if (value
&& !o
->value
)
90 static int sysctl_write_or_warn(const char *key
, const char *value
, bool ignore_failure
, bool ignore_enoent
) {
93 r
= sysctl_write(key
, value
);
95 /* Proceed without failing if ignore_failure is true.
96 * If the sysctl is not available in the kernel or we are running with reduced privileges and
97 * cannot write it, then log about the issue, and proceed without failing. Unless strict mode
98 * (arg_strict = true) is enabled, in which case we should fail. (EROFS is treated as a
99 * permission problem here, since that's how container managers usually protected their
101 * In all other cases log an error and make the tool fail. */
102 if (ignore_failure
|| (!arg_strict
&& (r
== -EROFS
|| ERRNO_IS_PRIVILEGE(r
))))
103 log_debug_errno(r
, "Couldn't write '%s' to '%s', ignoring: %m", value
, key
);
104 else if (ignore_enoent
&& r
== -ENOENT
)
105 log_warning_errno(r
, "Couldn't write '%s' to '%s', ignoring: %m", value
, key
);
107 return log_error_errno(r
, "Couldn't write '%s' to '%s': %m", value
, key
);
113 static int apply_glob_option_with_prefix(OrderedHashmap
*sysctl_options
, Option
*option
, const char *prefix
) {
114 _cleanup_strv_free_
char **paths
= NULL
;
115 _cleanup_free_
char *pattern
= NULL
;
118 assert(sysctl_options
);
122 _cleanup_free_
char *key
= NULL
;
124 r
= path_glob_can_match(option
->key
, prefix
, &key
);
126 return log_error_errno(r
, "Failed to check if the glob '%s' matches prefix '%s': %m",
127 option
->key
, prefix
);
129 log_debug("The glob '%s' does not match prefix '%s'.", option
->key
, prefix
);
133 log_debug("The glob '%s' is prefixed with '%s': '%s'", option
->key
, prefix
, key
);
135 if (!string_is_glob(key
)) {
136 /* The prefixed pattern is not glob anymore. Let's skip to call glob(). */
137 if (ordered_hashmap_contains(sysctl_options
, key
)) {
138 log_debug("Not setting %s (explicit setting exists).", key
);
142 return sysctl_write_or_warn(key
, option
->value
,
143 /* ignore_failure = */ option
->ignore_failure
,
144 /* ignore_enoent = */ true);
147 pattern
= path_join("/proc/sys", key
);
149 pattern
= path_join("/proc/sys", option
->key
);
153 r
= glob_extend(&paths
, pattern
, GLOB_NOCHECK
);
156 log_debug("No match for glob: %s", option
->key
);
159 if (option
->ignore_failure
|| ERRNO_IS_PRIVILEGE(r
)) {
160 log_debug_errno(r
, "Failed to resolve glob '%s', ignoring: %m", option
->key
);
163 return log_error_errno(r
, "Couldn't resolve glob '%s': %m", option
->key
);
166 STRV_FOREACH(s
, paths
) {
169 assert_se(key
= path_startswith(*s
, "/proc/sys"));
171 if (ordered_hashmap_contains(sysctl_options
, key
)) {
172 log_debug("Not setting %s (explicit setting exists).", key
);
177 sysctl_write_or_warn(key
, option
->value
,
178 /* ignore_failure = */ option
->ignore_failure
,
179 /* ignore_enoent = */ !arg_strict
));
185 static int apply_glob_option(OrderedHashmap
*sysctl_options
, Option
*option
) {
188 if (strv_isempty(arg_prefixes
))
189 return apply_glob_option_with_prefix(sysctl_options
, option
, NULL
);
191 STRV_FOREACH(i
, arg_prefixes
)
192 RET_GATHER(r
, apply_glob_option_with_prefix(sysctl_options
, option
, *i
));
196 static int apply_all(OrderedHashmap
*sysctl_options
) {
200 ORDERED_HASHMAP_FOREACH(option
, sysctl_options
) {
203 /* Ignore "negative match" options, they are there only to exclude stuff from globs. */
207 if (string_is_glob(option
->key
))
208 k
= apply_glob_option(sysctl_options
, option
);
210 k
= sysctl_write_or_warn(option
->key
, option
->value
,
211 /* ignore_failure = */ option
->ignore_failure
,
212 /* ignore_enoent = */ !arg_strict
);
219 static int parse_file(OrderedHashmap
**sysctl_options
, const char *path
, bool ignore_enoent
) {
220 _cleanup_fclose_
FILE *f
= NULL
;
221 _cleanup_free_
char *pp
= NULL
;
227 r
= search_and_fopen(path
, "re", NULL
, (const char**) CONF_PATHS_STRV("sysctl.d"), &f
, &pp
);
229 if (ignore_enoent
&& r
== -ENOENT
)
232 return log_error_errno(r
, "Failed to open file '%s', ignoring: %m", path
);
235 log_debug("Parsing %s", pp
);
237 _cleanup_(option_freep
) Option
*new_option
= NULL
;
238 _cleanup_free_
char *l
= NULL
;
239 bool ignore_failure
= false;
244 k
= read_stripped_line(f
, LONG_LINE_MAX
, &l
);
248 return log_error_errno(k
, "Failed to read file '%s', ignoring: %m", pp
);
254 if (strchr(COMMENTS
, l
[0]))
258 value
= strchr(p
, '=');
261 ignore_failure
= true;
267 value
= strstrip(value
);
271 /* We have a "negative match" option. Let's continue with value==NULL. */
274 log_syntax(NULL
, LOG_WARNING
, pp
, c
, 0,
275 "Line is not an assignment, ignoring: %s", p
);
283 p
= sysctl_normalize(p
);
285 /* We can't filter out globs at this point, we'll need to do that later. */
286 if (!string_is_glob(p
) &&
290 existing
= ordered_hashmap_get(*sysctl_options
, p
);
292 if (streq_ptr(value
, existing
->value
)) {
293 existing
->ignore_failure
= existing
->ignore_failure
|| ignore_failure
;
297 log_debug("Overwriting earlier assignment of %s at '%s:%u'.", p
, pp
, c
);
298 option_free(ordered_hashmap_remove(*sysctl_options
, p
));
301 new_option
= option_new(p
, value
, ignore_failure
);
305 k
= ordered_hashmap_ensure_put(sysctl_options
, &option_hash_ops
, new_option
->key
, new_option
);
307 return log_error_errno(k
, "Failed to add sysctl variable %s to hashmap: %m", p
);
309 TAKE_PTR(new_option
);
315 static int read_credential_lines(OrderedHashmap
**sysctl_options
) {
316 _cleanup_free_
char *j
= NULL
;
320 r
= get_credentials_dir(&d
);
324 return log_error_errno(r
, "Failed to get credentials directory: %m");
326 j
= path_join(d
, "sysctl.extra");
330 (void) parse_file(sysctl_options
, j
, /* ignore_enoent= */ true);
334 static int cat_config(char **files
) {
335 pager_open(arg_pager_flags
);
337 return cat_files(NULL
, files
, arg_cat_flags
);
340 static int help(void) {
341 _cleanup_free_
char *link
= NULL
;
344 r
= terminal_urlify_man("systemd-sysctl.service", "8", &link
);
348 printf("%s [OPTIONS...] [CONFIGURATION FILE...]\n\n"
349 "Applies kernel sysctl settings.\n\n"
350 " -h --help Show this help\n"
351 " --version Show package version\n"
352 " --cat-config Show configuration files\n"
353 " --tldr Show non-comment parts of configuration\n"
354 " --prefix=PATH Only apply rules with the specified prefix\n"
355 " --no-pager Do not pipe output into a pager\n"
356 "\nSee the %s for details.\n",
357 program_invocation_short_name
,
363 static int parse_argv(int argc
, char *argv
[]) {
374 static const struct option options
[] = {
375 { "help", no_argument
, NULL
, 'h' },
376 { "version", no_argument
, NULL
, ARG_VERSION
},
377 { "cat-config", no_argument
, NULL
, ARG_CAT_CONFIG
},
378 { "tldr", no_argument
, NULL
, ARG_TLDR
},
379 { "prefix", required_argument
, NULL
, ARG_PREFIX
},
380 { "no-pager", no_argument
, NULL
, ARG_NO_PAGER
},
381 { "strict", no_argument
, NULL
, ARG_STRICT
},
390 while ((c
= getopt_long(argc
, argv
, "h", options
, NULL
)) >= 0)
401 arg_cat_flags
= CAT_CONFIG_ON
;
405 arg_cat_flags
= CAT_TLDR
;
412 /* We used to require people to specify absolute paths
413 * in /proc/sys in the past. This is kinda useless, but
414 * we need to keep compatibility. We now support any
415 * sysctl name available. */
416 sysctl_normalize(optarg
);
418 s
= path_startswith(optarg
, "/proc/sys");
419 p
= strdup(s
?: optarg
);
423 if (strv_consume(&arg_prefixes
, p
) < 0)
430 arg_pager_flags
|= PAGER_DISABLE
;
441 assert_not_reached();
444 if (arg_cat_flags
!= CAT_CONFIG_OFF
&& argc
> optind
)
445 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
446 "Positional arguments are not allowed with --cat-config/--tldr.");
451 static int run(int argc
, char *argv
[]) {
452 _cleanup_ordered_hashmap_free_ OrderedHashmap
*sysctl_options
= NULL
;
455 r
= parse_argv(argc
, argv
);
466 for (int i
= optind
; i
< argc
; i
++)
467 RET_GATHER(r
, parse_file(&sysctl_options
, argv
[i
], false));
470 _cleanup_strv_free_
char **files
= NULL
;
472 r
= conf_files_list_strv(&files
, ".conf", NULL
, 0, (const char**) CONF_PATHS_STRV("sysctl.d"));
474 return log_error_errno(r
, "Failed to enumerate sysctl.d files: %m");
476 if (arg_cat_flags
!= CAT_CONFIG_OFF
)
477 return cat_config(files
);
479 STRV_FOREACH(f
, files
)
480 RET_GATHER(r
, parse_file(&sysctl_options
, *f
, true));
482 RET_GATHER(r
, read_credential_lines(&sysctl_options
));
485 RET_GATHER(r
, apply_all(sysctl_options
));
490 DEFINE_MAIN_FUNCTION(run
);