systemd: Use systemd functions to consider systemd availability

This is another systemd implementation clean-up.  It was found that
SELinux will block OpenVPN from checking /sys/fs/cgroups.  As OpenVPN
only checked /sys/fs/cgroups and /sys/fs/cgroups/systemd to see if
systemd was available or not, it was considered better to query
systemd directly to see whether or not to query for usernames and
passwords via systemd.

This patch has been compile tested on Fedora 19 and Fedora 21 alpha and
function tested on Fedora 19.

  v2 - Use PKG_CHECK_MODULES() + check for libsystemd before
       libystemd-daemon.  systemd >= 209 use a unified library

Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1412356567-27125-1-git-send-email-openvpn.list@topphemmelig.net>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9072
Signed-off-by: Gert Doering <gert@greenie.muc.de>

diff --git a/configure.ac b/configure.ac
index 6667019d646d32df502bcb95538b12ffee0ebaf8..608ab6d103367b6a8fdaaa74e4521640648bf7ec 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -997,6 +997,28 @@ if test "$enable_lz4" = "yes" && test "$enable_comp_stub" = "no"; then
 fi
 
 
+dnl
+dnl Check for systemd
+dnl
+
+if test "$enable_systemd" = "yes" ; then
+    PKG_CHECK_MODULES([libsystemd], [systemd libsystemd],
+                      [],
+                      [PKG_CHECK_MODULES([libsystemd], [libsystemd-daemon])]
+                      )
+    AC_CHECK_HEADERS(systemd/sd-daemon.h,
+       ,
+       [
+          AC_MSG_ERROR([systemd development headers not found.])
+       ])
+
+    saved_LIBS="${LIBS}"
+    LIBS="${LIBS} ${libsystemd_LIBS}"
+    AC_CHECK_FUNCS([sd_booted], [], [AC_MSG_ERROR([systemd library is missing sd_booted()])])
+    OPTIONAL_SYSTEMD_LIBS="${libsystemd_LIBS}"
+    AC_DEFINE(ENABLE_SYSTEMD, 1, [Enable systemd integration])
+    LIBS="${saved_LIBS}"
+fi
 
 
 AC_MSG_CHECKING([git checkout])
@@ -1037,7 +1059,6 @@ test "${enable_def_auth}" = "yes" && AC_DEFINE([ENABLE_DEF_AUTH], [1], [Enable d
 test "${enable_pf}" = "yes" && AC_DEFINE([ENABLE_PF], [1], [Enable internal packet filter])
 test "${enable_strict_options}" = "yes" && AC_DEFINE([ENABLE_STRICT_OPTIONS_CHECK], [1], [Enable strict options check between peers])
 test "${enable_password_save}" = "yes" && AC_DEFINE([ENABLE_PASSWORD_SAVE], [1], [Allow --askpass and --auth-user-pass passwords to be read from a file])
-test "${enable_systemd}" = "yes" && AC_DEFINE([ENABLE_SYSTEMD], [1], [Enable systemd support])
 
 case "${with_crypto_library}" in
        openssl)
@@ -1170,6 +1191,7 @@ AC_SUBST([OPTIONAL_SNAPPY_CFLAGS])
 AC_SUBST([OPTIONAL_SNAPPY_LIBS])
 AC_SUBST([OPTIONAL_LZ4_CFLAGS])
 AC_SUBST([OPTIONAL_LZ4_LIBS])
+AC_SUBST([OPTIONAL_SYSTEMD_LIBS])
 AC_SUBST([OPTIONAL_PKCS11_HELPER_CFLAGS])
 AC_SUBST([OPTIONAL_PKCS11_HELPER_LIBS])
 

diff --git a/src/openvpn/Makefile.am b/src/openvpn/Makefile.am
index fd593c57ae2e16e198af0da840d8b41c66f0cf9c..d089f50ff1cb9e69105118fb58b42df14c1736ce 100644 (file)
--- a/src/openvpn/Makefile.am
+++ b/src/openvpn/Makefile.am
@@ -126,6 +126,7 @@ openvpn_LDADD = \
        $(OPTIONAL_PKCS11_HELPER_LIBS) \
        $(OPTIONAL_CRYPTO_LIBS) \
        $(OPTIONAL_SELINUX_LIBS) \
+       $(OPTIONAL_SYSTEMD_LIBS) \
        $(OPTIONAL_DL_LIBS)
 if WIN32
 openvpn_SOURCES += openvpn_win32_resources.rc

diff --git a/src/openvpn/console.c b/src/openvpn/console.c
index 337b1bbc54e66ec3d345471f622f7a98a51fc7aa..d66d408721bd2d43a2a21c2b361674ca04e05ba1 100644 (file)
--- a/src/openvpn/console.c
+++ b/src/openvpn/console.c
@@ -34,6 +34,10 @@
 #include "buffer.h"
 #include "misc.h"
 
+#ifdef ENABLE_SYSTEMD
+#include <systemd/sd-daemon.h>
+#endif
+
 #ifdef WIN32
 
 #include "win32.h"
@@ -143,15 +147,13 @@ close_tty (FILE *fp)
 static bool
 check_systemd_running ()
 {
-  struct stat a, b, c;
+  struct stat c;
 
   /* We simply test whether the systemd cgroup hierarchy is
    * mounted, as well as the systemd-ask-password executable
    * being available */
 
-  return (lstat("/sys/fs/cgroup", &a) == 0)
-         && (lstat("/sys/fs/cgroup/systemd", &b) == 0)
-         && (a.st_dev != b.st_dev)
+  return (sd_booted() > 0)
          && (stat(SYSTEMD_ASK_PASSWORD_PATH, &c) == 0);
 
 }