execute.c revision 5c56a259e07661a66e806cc2fbc71de96a75f78e
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt/***
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt This file is part of systemd.
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt Copyright 2010 Lennart Poettering
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt systemd is free software; you can redistribute it and/or modify it
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt under the terms of the GNU Lesser General Public License as published by
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt the Free Software Foundation; either version 2.1 of the License, or
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt (at your option) any later version.
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt systemd is distributed in the hope that it will be useful, but
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt WITHOUT ANY WARRANTY; without even the implied warranty of
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt Lesser General Public License for more details.
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt You should have received a copy of the GNU Lesser General Public License
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt along with systemd; If not, see <http://www.gnu.org/licenses/>.
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt***/
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <assert.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <dirent.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <errno.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <fcntl.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <unistd.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <string.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <signal.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <sys/socket.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <sys/un.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <sys/prctl.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <linux/sched.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <sys/types.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <sys/stat.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <grp.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <pwd.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <sys/mount.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <linux/fs.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <linux/oom.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <sys/poll.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <linux/seccomp-bpf.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <glob.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <libgen.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#undef basename
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#ifdef HAVE_PAM
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <security/pam_appl.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#endif
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#ifdef HAVE_SELINUX
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include <selinux/selinux.h>
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#endif
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "execute.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "strv.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "macro.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "capability.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "util.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "log.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "sd-messages.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "ioprio.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "securebits.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "namespace.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "tcpwrap.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "exit-status.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "missing.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "utmp-wtmp.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "def.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "path-util.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "syscall-list.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "env-util.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "fileio.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "unit.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#include "async.h"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt/* This assumes there is a 'tty' group */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#define TTY_MODE 0620
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt#define SNDBUF_SIZE (8*1024*1024)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidtstatic int shift_fds(int fds[], unsigned n_fds) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int start, restart_from;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (n_fds <= 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Modifies the fds array! (sorts it) */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(fds);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt start = 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt for (;;) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int i;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt restart_from = -1;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt for (i = start; i < (int) n_fds; i++) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int nfd;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Already at right index? */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (fds[i] == i+3)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt continue;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt close_nointr_nofail(fds[i]);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt fds[i] = nfd;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Hmm, the fd we wanted isn't free? Then
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * let's remember that and try again from here*/
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (nfd != i+3 && restart_from < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt restart_from = i;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (restart_from < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt break;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt start = restart_from;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt}
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidtstatic int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt unsigned i;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (n_fds <= 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(fds);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt for (i = 0; i < n_fds; i++) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if ((r = fd_nonblock(fds[i], nonblock)) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* We unconditionally drop FD_CLOEXEC from the fds,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * since after all we want to pass these fds to our
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * children */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if ((r = fd_cloexec(fds[i], false)) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt}
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt_pure_ static const char *tty_path(const ExecContext *context) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(context);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (context->tty_path)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return context->tty_path;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return "/dev/console";
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt}
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidtstatic void exec_context_tty_reset(const ExecContext *context) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(context);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (context->tty_vhangup)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt terminal_vhangup(tty_path(context));
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (context->tty_reset)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt reset_terminal(tty_path(context));
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (context->tty_vt_disallocate && context->tty_path)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt vt_disallocate(context->tty_path);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic bool is_terminal_output(ExecOutput o) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt o == EXEC_OUTPUT_TTY ||
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic int open_null_as(int flags, int nfd) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt int fd, r;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert(nfd >= 0);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt fd = open("/dev/null", flags|O_NOCTTY);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (fd < 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return -errno;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (fd != nfd) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt r = dup2(fd, nfd) < 0 ? -errno : nfd;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt close_nointr_nofail(fd);
7ad63f57b6ce7ae9e3cc19dcb441f0a4494fa3f2Michal Schmidt } else
7ad63f57b6ce7ae9e3cc19dcb441f0a4494fa3f2Michal Schmidt r = nfd;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return r;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt int fd, r;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt union sockaddr_union sa = {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt .un.sun_family = AF_UNIX,
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt .un.sun_path = "/run/systemd/journal/stdout",
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt };
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert(context);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert(output < _EXEC_OUTPUT_MAX);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(ident);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(nfd >= 0);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt fd = socket(AF_UNIX, SOCK_STREAM, 0);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (fd < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (r < 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt close_nointr_nofail(fd);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (shutdown(fd, SHUT_RD) < 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt close_nointr_nofail(fd);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt fd_inc_sndbuf(fd, SNDBUF_SIZE);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt dprintf(fd,
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt "%s\n"
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt "%s\n"
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt "%i\n"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt "%i\n"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt "%i\n"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt "%i\n"
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt "%i\n",
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt context->syslog_identifier ? context->syslog_identifier : ident,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt unit_id,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt context->syslog_priority,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt !!context->syslog_level_prefix,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt is_terminal_output(output));
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (fd != nfd) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt r = dup2(fd, nfd) < 0 ? -errno : nfd;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt close_nointr_nofail(fd);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt } else
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt r = nfd;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return r;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidtstatic int open_terminal_as(const char *path, mode_t mode, int nfd) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int fd, r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(path);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert(nfd >= 0);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return fd;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (fd != nfd) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt r = dup2(fd, nfd) < 0 ? -errno : nfd;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt close_nointr_nofail(fd);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt } else
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt r = nfd;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return r;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic bool is_terminal_input(ExecInput i) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt i == EXEC_INPUT_TTY ||
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt i == EXEC_INPUT_TTY_FORCE ||
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt i == EXEC_INPUT_TTY_FAIL;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (is_terminal_input(std_input) && !apply_tty_stdin)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return EXEC_INPUT_NULL;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return EXEC_INPUT_NULL;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return std_input;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic int fixup_output(ExecOutput std_output, int socket_fd) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return EXEC_OUTPUT_INHERIT;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return std_output;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt ExecInput i;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert(context);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt switch (i) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_INPUT_NULL:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return open_null_as(O_RDONLY, STDIN_FILENO);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_INPUT_TTY:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_INPUT_TTY_FORCE:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_INPUT_TTY_FAIL: {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt int fd, r;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt fd = acquire_terminal(tty_path(context),
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt i == EXEC_INPUT_TTY_FAIL,
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt i == EXEC_INPUT_TTY_FORCE,
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt false,
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt (usec_t) -1);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (fd < 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return fd;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (fd != STDIN_FILENO) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt close_nointr_nofail(fd);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt } else
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt r = STDIN_FILENO;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return r;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt }
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_INPUT_SOCKET:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt default:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert_not_reached("Unknown input type");
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt }
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt ExecOutput o;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt ExecInput i;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt int r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(context);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(ident);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt o = fixup_output(context->std_output, socket_fd);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (fileno == STDERR_FILENO) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt ExecOutput e;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt e = fixup_output(context->std_error, socket_fd);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* This expects the input and output are already set up */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* Don't change the stderr file descriptor if we inherit all
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt * the way and are not on a tty */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (e == EXEC_OUTPUT_INHERIT &&
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt o == EXEC_OUTPUT_INHERIT &&
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt i == EXEC_INPUT_NULL &&
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt !is_terminal_input(context->std_input) &&
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt getppid () != 1)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return fileno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Duplicate from stdout if possible */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (e == o || e == EXEC_OUTPUT_INHERIT)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt o = e;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt } else if (o == EXEC_OUTPUT_INHERIT) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* If input got downgraded, inherit the original value */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return open_terminal_as(tty_path(context), O_WRONLY, fileno);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* If the input is connected to anything that's not a /dev/null, inherit that... */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (i != EXEC_INPUT_NULL)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (getppid() != 1)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return fileno;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* We need to open /dev/null here anew, to get the right access mode. */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return open_null_as(O_WRONLY, fileno);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt }
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt switch (o) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_OUTPUT_NULL:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return open_null_as(O_WRONLY, fileno);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_OUTPUT_TTY:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (is_terminal_input(i))
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* We don't reset the terminal if this is just about output */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return open_terminal_as(tty_path(context), O_WRONLY, fileno);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_OUTPUT_SYSLOG:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_OUTPUT_KMSG:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_OUTPUT_KMSG_AND_CONSOLE:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_OUTPUT_JOURNAL:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt r = connect_logger_as(context, o, ident, unit_id, fileno);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (r < 0) {
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt log_struct_unit(LOG_CRIT, unit_id,
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt fileno == STDOUT_FILENO ? "out" : "err",
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt unit_id, strerror(-r),
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt "ERRNO=%d", -r,
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt NULL);
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt r = open_null_as(O_WRONLY, fileno);
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt }
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt return r;
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt case EXEC_OUTPUT_SOCKET:
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt assert(socket_fd >= 0);
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt default:
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt assert_not_reached("Unknown error type");
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt }
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt}
e1323fbfbe8a574f28b704f2df8ce7f99e3a28f5Michal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidtstatic int chown_terminal(int fd, uid_t uid) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt struct stat st;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(fd >= 0);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* This might fail. What matters are the results. */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt (void) fchown(fd, uid, -1);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt (void) fchmod(fd, TTY_MODE);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (fstat(fd, &st) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -EPERM;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt}
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidtstatic int setup_confirm_stdio(int *_saved_stdin,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int *_saved_stdout) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int fd = -1, saved_stdin, saved_stdout = -1, r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(_saved_stdin);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(_saved_stdout);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (saved_stdin < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (saved_stdout < 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt fd = acquire_terminal(
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt "/dev/console",
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt false,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt false,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt false,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt DEFAULT_CONFIRM_USEC);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (fd < 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = fd;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = chown_terminal(fd, getuid());
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (r < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (dup2(fd, STDIN_FILENO) < 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (dup2(fd, STDOUT_FILENO) < 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (fd >= 2)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt close_nointr_nofail(fd);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt *_saved_stdin = saved_stdin;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt *_saved_stdout = saved_stdout;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return 0;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtfail:
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (saved_stdout >= 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt close_nointr_nofail(saved_stdout);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (saved_stdin >= 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt close_nointr_nofail(saved_stdin);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (fd >= 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt close_nointr_nofail(fd);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt}
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt_printf_(1, 2) static int write_confirm_message(const char *format, ...) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int fd;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt va_list ap;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(format);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (fd < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return fd;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt va_start(ap, format);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt vdprintf(fd, format, ap);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt va_end(ap);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt close_nointr_nofail(fd);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt}
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidtstatic int restore_confirm_stdio(int *saved_stdin,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int *saved_stdout) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int r = 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(saved_stdin);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(saved_stdout);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt release_terminal();
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (*saved_stdin >= 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (dup2(*saved_stdin, STDIN_FILENO) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (*saved_stdout >= 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (*saved_stdin >= 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt close_nointr_nofail(*saved_stdin);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (*saved_stdout >= 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt close_nointr_nofail(*saved_stdout);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt}
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidtstatic int ask_for_confirmation(char *response, char **argv) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int saved_stdout = -1, saved_stdin = -1, r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt char *line;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (r < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt line = exec_command_line(argv);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (!line)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -ENOMEM;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt free(line);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt restore_confirm_stdio(&saved_stdin, &saved_stdout);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt}
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt bool keep_groups = false;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt int r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert(context);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Lookup and set GID and supplementary group list. Here too
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * we avoid NSS lookups for gid=0. */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (context->group || username) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (context->group) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt const char *g = context->group;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if ((r = get_group_creds(&g, &gid)) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return r;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* First step, initialize groups from /etc/groups */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (username && gid != 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (initgroups(username, gid) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt keep_groups = true;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Second step, set our gids */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (setresgid(gid, gid, gid) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (context->supplementary_groups) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int ngroups_max, k;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt gid_t *gids;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt char **i;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Final step, initialize any manually set supplementary groups */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (!(gids = new(gid_t, ngroups_max)))
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return -ENOMEM;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (keep_groups) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if ((k = getgroups(ngroups_max, gids)) < 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt free(gids);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt } else
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt k = 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt STRV_FOREACH(i, context->supplementary_groups) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt const char *g;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (k >= ngroups_max) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt free(gids);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -E2BIG;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt g = *i;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = get_group_creds(&g, gids+k);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (r < 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt free(gids);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return r;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt }
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt k++;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (setgroups(k, gids) < 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt free(gids);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt free(gids);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt return 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt}
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic int enforce_user(const ExecContext *context, uid_t uid) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert(context);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* Sets (but doesn't lookup) the uid and make sure we keep the
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt * capabilities while doing so. */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (context->capabilities) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt _cleanup_cap_free_ cap_t d = NULL;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt static const cap_value_t bits[] = {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt CAP_SETUID, /* Necessary so that we can run setresuid() below */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt CAP_SETPCAP /* Necessary so that we can set PR_SET_SECUREBITS later on */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt };
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* First step: If we need to keep capabilities but
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt * drop privileges we need to make sure we keep our
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt * caps, while we drop privileges. */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (uid != 0) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (prctl(PR_GET_SECUREBITS) != sb)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (prctl(PR_SET_SECUREBITS, sb) < 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return -errno;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt }
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* Second step: set the capabilities. This will reduce
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt * the capabilities to the minimum we need. */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt d = cap_dup(context->capabilities);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (!d)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return -errno;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return -errno;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (cap_set_proc(d) < 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return -errno;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt }
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* Third step: actually set the uids */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (setresuid(uid, uid, uid) < 0)
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return -errno;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* At this point we should have all necessary capabilities but
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt are otherwise a normal user. However, the caps might got
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt corrupted due to the setresuid() so we need clean them up
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt later. This is done outside of this call. */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return 0;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt#ifdef HAVE_PAM
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidtstatic int null_conv(
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int num_msg,
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt const struct pam_message **msg,
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt struct pam_response **resp,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt void *appdata_ptr) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* We don't support conversations */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt return PAM_CONV_ERR;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt}
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidtstatic int setup_pam(
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt const char *name,
ce79279bff6e7a1a17070509a039ab635796f129Michal Schmidt const char *user,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt uid_t uid,
ce79279bff6e7a1a17070509a039ab635796f129Michal Schmidt const char *tty,
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt char ***pam_env,
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int fds[], unsigned n_fds) {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt static const struct pam_conv conv = {
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt .conv = null_conv,
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt .appdata_ptr = NULL
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt };
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt pam_handle_t *handle = NULL;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt sigset_t ss, old_ss;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt int pam_code = PAM_SUCCESS;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt int err;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt char **e = NULL;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt bool close_session = false;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt pid_t pam_pid = 0, parent_pid;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt int flags = 0;
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert(name);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert(user);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert(pam_env);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* We set up PAM in the parent process, then fork. The child
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt * will then stay around until killed via PR_GET_PDEATHSIG or
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt * systemd via the cgroup logic. It will then remove the PAM
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt * session again. The parent process will exec() the actual
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt * daemon. We do things this way to ensure that the main PID
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt * of the daemon is the one we initially fork()ed. */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt flags |= PAM_SILENT;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt pam_code = pam_start(name, user, &conv, &handle);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (pam_code != PAM_SUCCESS) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt handle = NULL;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (tty) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt pam_code = pam_set_item(handle, PAM_TTY, tty);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (pam_code != PAM_SUCCESS)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt pam_code = pam_acct_mgmt(handle, flags);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (pam_code != PAM_SUCCESS)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt pam_code = pam_open_session(handle, flags);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (pam_code != PAM_SUCCESS)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt close_session = true;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt e = pam_getenvlist(handle);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (!e) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt pam_code = PAM_BUF_ERR;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Block SIGTERM, so that we know that it won't get lost in
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * the child */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (sigemptyset(&ss) < 0 ||
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt sigaddset(&ss, SIGTERM) < 0 ||
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt parent_pid = getpid();
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt pam_pid = fork();
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (pam_pid < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (pam_pid == 0) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int sig;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt int r = EXIT_PAM;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* The child's job is to reset the PAM session on
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * termination */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* This string must fit in 10 chars (i.e. the length
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * of "/sbin/init"), to look pretty in /bin/ps */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt rename_process("(sd-pam)");
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Make sure we don't keep open the passed fds in this
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt child. We assume that otherwise only those fds are
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt open here that have been opened by PAM. */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt close_many(fds, n_fds);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Drop privileges - we don't need any to pam_close_session
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * and this will make PR_SET_PDEATHSIG work in most cases.
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * If this fails, ignore the error - but expect sd-pam threads
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * to fail to exit normally */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt if (setresuid(uid, uid, uid) < 0)
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt /* Wait until our parent died. This will only work if
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt * the above setresuid() succeeds, otherwise the kernel
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt * will not allow unprivileged parents kill their privileged
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt * children this way. We rely on the control groups kill logic
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt * to do the rest for us. */
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt goto child_finish;
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt /* Check if our parent process might already have
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt * died? */
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt if (getppid() == parent_pid) {
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt for (;;) {
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt if (sigwait(&ss, &sig) < 0) {
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt if (errno == EINTR)
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt continue;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto child_finish;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt assert(sig == SIGTERM);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt break;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* If our parent died we'll end the session */
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (getppid() != parent_pid) {
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt pam_code = pam_close_session(handle, flags);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt if (pam_code != PAM_SUCCESS)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto child_finish;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt r = 0;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt child_finish:
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt pam_end(handle, pam_code | flags);
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt _exit(r);
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt }
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
9ba81d5a61b7c992a1d2e5e02f334b8e2a0b0c22Michal Schmidt /* If the child was forked off successfully it will do all the
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt * cleanups, so forget about the handle here. */
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt handle = NULL;
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt /* Unblock SIGTERM again in the parent */
8f88aed740ded77af443bb1b7c79bb229b50f8f8Michal Schmidt if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
32a4456cc252689f51f383d150d34ed636bfec4dMichal Schmidt goto fail;
/* We close the log explicitly here, since the PAM modules
* might have opened it, but we don't want this fd around. */
closelog();
*pam_env = e;
e = NULL;
return 0;
fail:
if (pam_code != PAM_SUCCESS) {
log_error("PAM failed: %s", pam_strerror(handle, pam_code));
err = -EPERM; /* PAM errors do not map to errno */
} else {
log_error("PAM failed: %m");
err = -errno;
}
if (handle) {
if (close_session)
pam_code = pam_close_session(handle, flags);
pam_end(handle, pam_code | flags);
}
strv_free(e);
closelog();
if (pam_pid > 1) {
kill(pam_pid, SIGTERM);
kill(pam_pid, SIGCONT);
}
return err;
}
#endif
static void rename_process_from_path(const char *path) {
char process_name[11];
const char *p;
size_t l;
/* This resulting string must fit in 10 chars (i.e. the length
* of "/sbin/init") to look pretty in /bin/ps */
p = basename(path);
if (isempty(p)) {
rename_process("(...)");
return;
}
l = strlen(p);
if (l > 8) {
/* The end of the process name is usually more
* interesting, since the first bit might just be
* "systemd-" */
p = p + l - 8;
l = 8;
}
process_name[0] = '(';
memcpy(process_name+1, p, l);
process_name[1+l] = ')';
process_name[1+l+1] = 0;
rename_process(process_name);
}
static int apply_seccomp(uint32_t *syscall_filter) {
static const struct sock_filter header[] = {
VALIDATE_ARCHITECTURE,
EXAMINE_SYSCALL
};
static const struct sock_filter footer[] = {
_KILL_PROCESS
};
int i;
unsigned n;
struct sock_filter *f;
struct sock_fprog prog = {};
assert(syscall_filter);
/* First: count the syscalls to check for */
for (i = 0, n = 0; i < syscall_max(); i++)
if (syscall_filter[i >> 4] & (1 << (i & 31)))
n++;
/* Second: build the filter program from a header the syscall
* matches and the footer */
f = alloca(sizeof(struct sock_filter) * (ELEMENTSOF(header) + 2*n + ELEMENTSOF(footer)));
memcpy(f, header, sizeof(header));
for (i = 0, n = 0; i < syscall_max(); i++)
if (syscall_filter[i >> 4] & (1 << (i & 31))) {
struct sock_filter item[] = {
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, INDEX_TO_SYSCALL(i), 0, 1),
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
};
assert_cc(ELEMENTSOF(item) == 2);
f[ELEMENTSOF(header) + 2*n] = item[0];
f[ELEMENTSOF(header) + 2*n+1] = item[1];
n++;
}
memcpy(f + (ELEMENTSOF(header) + 2*n), footer, sizeof(footer));
/* Third: install the filter */
prog.len = ELEMENTSOF(header) + ELEMENTSOF(footer) + 2*n;
prog.filter = f;
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0)
return -errno;
return 0;
}
static void do_idle_pipe_dance(int idle_pipe[4]) {
assert(idle_pipe);
if (idle_pipe[1] >= 0)
close_nointr_nofail(idle_pipe[1]);
if (idle_pipe[2] >= 0)
close_nointr_nofail(idle_pipe[2]);
if (idle_pipe[0] >= 0) {
int r;
r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
/* Signal systemd that we are bored and want to continue. */
write(idle_pipe[3], "x", 1);
/* Wait for systemd to react to the signal above. */
fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
}
close_nointr_nofail(idle_pipe[0]);
}
if (idle_pipe[3] >= 0)
close_nointr_nofail(idle_pipe[3]);
}
static int build_environment(
ExecContext *c,
unsigned n_fds,
usec_t watchdog_usec,
const char *home,
const char *username,
const char *shell,
char ***ret) {
_cleanup_strv_free_ char **our_env = NULL;
unsigned n_env = 0;
char *x;
assert(c);
assert(ret);
our_env = new0(char*, 10);
if (!our_env)
return -ENOMEM;
if (n_fds > 0) {
if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
return -ENOMEM;
our_env[n_env++] = x;
if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
return -ENOMEM;
our_env[n_env++] = x;
}
if (watchdog_usec > 0) {
if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
return -ENOMEM;
our_env[n_env++] = x;
if (asprintf(&x, "WATCHDOG_USEC=%llu", (unsigned long long) watchdog_usec) < 0)
return -ENOMEM;
our_env[n_env++] = x;
}
if (home) {
x = strappend("HOME=", home);
if (!x)
return -ENOMEM;
our_env[n_env++] = x;
}
if (username) {
x = strappend("LOGNAME=", username);
if (!x)
return -ENOMEM;
our_env[n_env++] = x;
x = strappend("USER=", username);
if (!x)
return -ENOMEM;
our_env[n_env++] = x;
}
if (shell) {
x = strappend("SHELL=", shell);
if (!x)
return -ENOMEM;
our_env[n_env++] = x;
}
if (is_terminal_input(c->std_input) ||
c->std_output == EXEC_OUTPUT_TTY ||
c->std_error == EXEC_OUTPUT_TTY ||
c->tty_path) {
x = strdup(default_term_for_tty(tty_path(c)));
if (!x)
return -ENOMEM;
our_env[n_env++] = x;
}
our_env[n_env++] = NULL;
assert(n_env <= 10);
*ret = our_env;
our_env = NULL;
return 0;
}
int exec_spawn(ExecCommand *command,
char **argv,
ExecContext *context,
int fds[], unsigned n_fds,
char **environment,
bool apply_permissions,
bool apply_chroot,
bool apply_tty_stdin,
bool confirm_spawn,
CGroupControllerMask cgroup_supported,
const char *cgroup_path,
const char *unit_id,
usec_t watchdog_usec,
int idle_pipe[4],
ExecRuntime *runtime,
pid_t *ret) {
_cleanup_strv_free_ char **files_env = NULL;
int socket_fd;
char *line;
pid_t pid;
int r;
assert(command);
assert(context);
assert(ret);
assert(fds || n_fds <= 0);
if (context->std_input == EXEC_INPUT_SOCKET ||
context->std_output == EXEC_OUTPUT_SOCKET ||
context->std_error == EXEC_OUTPUT_SOCKET) {
if (n_fds != 1)
return -EINVAL;
socket_fd = fds[0];
fds = NULL;
n_fds = 0;
} else
socket_fd = -1;
r = exec_context_load_environment(context, &files_env);
if (r < 0) {
log_struct_unit(LOG_ERR,
unit_id,
"MESSAGE=Failed to load environment files: %s", strerror(-r),
"ERRNO=%d", -r,
NULL);
return r;
}
if (!argv)
argv = command->argv;
line = exec_command_line(argv);
if (!line)
return log_oom();
log_struct_unit(LOG_DEBUG,
unit_id,
"EXECUTABLE=%s", command->path,
"MESSAGE=About to execute: %s", line,
NULL);
free(line);
pid = fork();
if (pid < 0)
return -errno;
if (pid == 0) {
_cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
const char *username = NULL, *home = NULL, *shell = NULL;
unsigned n_dont_close = 0;
int dont_close[n_fds + 3];
uid_t uid = (uid_t) -1;
gid_t gid = (gid_t) -1;
sigset_t ss;
int i, err;
/* child */
rename_process_from_path(command->path);
/* We reset exactly these signals, since they are the
* only ones we set to SIG_IGN in the main daemon. All
* others we leave untouched because we set them to
* SIG_DFL or a valid handler initially, both of which
* will be demoted to SIG_DFL. */
default_signals(SIGNALS_CRASH_HANDLER,
SIGNALS_IGNORE, -1);
if (context->ignore_sigpipe)
ignore_signals(SIGPIPE, -1);
assert_se(sigemptyset(&ss) == 0);
if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
err = -errno;
r = EXIT_SIGNAL_MASK;
goto fail_child;
}
if (idle_pipe)
do_idle_pipe_dance(idle_pipe);
/* Close sockets very early to make sure we don't
* block init reexecution because it cannot bind its
* sockets */
log_forget_fds();
if (socket_fd >= 0)
dont_close[n_dont_close++] = socket_fd;
if (n_fds > 0) {
memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
n_dont_close += n_fds;
}
if (runtime) {
if (runtime->netns_storage_socket[0] >= 0)
dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
if (runtime->netns_storage_socket[1] >= 0)
dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
}
err = close_all_fds(dont_close, n_dont_close);
if (err < 0) {
r = EXIT_FDS;
goto fail_child;
}
if (!context->same_pgrp)
if (setsid() < 0) {
err = -errno;
r = EXIT_SETSID;
goto fail_child;
}
if (context->tcpwrap_name) {
if (socket_fd >= 0)
if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
err = -EACCES;
r = EXIT_TCPWRAP;
goto fail_child;
}
for (i = 0; i < (int) n_fds; i++) {
if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
err = -EACCES;
r = EXIT_TCPWRAP;
goto fail_child;
}
}
}
exec_context_tty_reset(context);
if (confirm_spawn) {
char response;
err = ask_for_confirmation(&response, argv);
if (err == -ETIMEDOUT)
write_confirm_message("Confirmation question timed out, assuming positive response.\n");
else if (err < 0)
write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
else if (response == 's') {
write_confirm_message("Skipping execution.\n");
err = -ECANCELED;
r = EXIT_CONFIRM;
goto fail_child;
} else if (response == 'n') {
write_confirm_message("Failing execution.\n");
err = r = 0;
goto fail_child;
}
}
/* If a socket is connected to STDIN/STDOUT/STDERR, we
* must sure to drop O_NONBLOCK */
if (socket_fd >= 0)
fd_nonblock(socket_fd, false);
err = setup_input(context, socket_fd, apply_tty_stdin);
if (err < 0) {
r = EXIT_STDIN;
goto fail_child;
}
err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
if (err < 0) {
r = EXIT_STDOUT;
goto fail_child;
}
err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
if (err < 0) {
r = EXIT_STDERR;
goto fail_child;
}
if (cgroup_path) {
err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
if (err < 0) {
r = EXIT_CGROUP;
goto fail_child;
}
}
if (context->oom_score_adjust_set) {
char t[16];
snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
char_array_0(t);
if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
err = -errno;
r = EXIT_OOM_ADJUST;
goto fail_child;
}
}
if (context->nice_set)
if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
err = -errno;
r = EXIT_NICE;
goto fail_child;
}
if (context->cpu_sched_set) {
struct sched_param param = {
.sched_priority = context->cpu_sched_priority,
};
r = sched_setscheduler(0,
context->cpu_sched_policy |
(context->cpu_sched_reset_on_fork ?
SCHED_RESET_ON_FORK : 0),
&param);
if (r < 0) {
err = -errno;
r = EXIT_SETSCHEDULER;
goto fail_child;
}
}
if (context->cpuset)
if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
err = -errno;
r = EXIT_CPUAFFINITY;
goto fail_child;
}
if (context->ioprio_set)
if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
err = -errno;
r = EXIT_IOPRIO;
goto fail_child;
}
if (context->timer_slack_nsec != (nsec_t) -1)
if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
err = -errno;
r = EXIT_TIMERSLACK;
goto fail_child;
}
if (context->utmp_id)
utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
if (context->user) {
username = context->user;
err = get_user_creds(&username, &uid, &gid, &home, &shell);
if (err < 0) {
r = EXIT_USER;
goto fail_child;
}
if (is_terminal_input(context->std_input)) {
err = chown_terminal(STDIN_FILENO, uid);
if (err < 0) {
r = EXIT_STDIN;
goto fail_child;
}
}
}
#ifdef HAVE_PAM
if (cgroup_path && context->user && context->pam_name) {
err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
if (err < 0) {
r = EXIT_CGROUP;
goto fail_child;
}
err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
if (err < 0) {
r = EXIT_CGROUP;
goto fail_child;
}
}
#endif
if (apply_permissions) {
err = enforce_groups(context, username, gid);
if (err < 0) {
r = EXIT_GROUP;
goto fail_child;
}
}
umask(context->umask);
#ifdef HAVE_PAM
if (apply_permissions && context->pam_name && username) {
err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
if (err < 0) {
r = EXIT_PAM;
goto fail_child;
}
}
#endif
if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
err = setup_netns(runtime->netns_storage_socket);
if (err < 0) {
r = EXIT_NETWORK;
goto fail_child;
}
}
if (!strv_isempty(context->read_write_dirs) ||
!strv_isempty(context->read_only_dirs) ||
!strv_isempty(context->inaccessible_dirs) ||
context->mount_flags != 0 ||
(context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
context->private_devices) {
char *tmp = NULL, *var = NULL;
/* The runtime struct only contains the parent
* of the private /tmp, which is
* non-accessible to world users. Inside of it
* there's a /tmp that is sticky, and that's
* the one we want to use here. */
if (context->private_tmp && runtime) {
if (runtime->tmp_dir)
tmp = strappenda(runtime->tmp_dir, "/tmp");
if (runtime->var_tmp_dir)
var = strappenda(runtime->var_tmp_dir, "/tmp");
}
err = setup_namespace(
context->read_write_dirs,
context->read_only_dirs,
context->inaccessible_dirs,
tmp,
var,
context->private_devices,
context->mount_flags);
if (err < 0) {
r = EXIT_NAMESPACE;
goto fail_child;
}
}
if (apply_chroot) {
if (context->root_directory)
if (chroot(context->root_directory) < 0) {
err = -errno;
r = EXIT_CHROOT;
goto fail_child;
}
if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
err = -errno;
r = EXIT_CHDIR;
goto fail_child;
}
} else {
_cleanup_free_ char *d = NULL;
if (asprintf(&d, "%s/%s",
context->root_directory ? context->root_directory : "",
context->working_directory ? context->working_directory : "") < 0) {
err = -ENOMEM;
r = EXIT_MEMORY;
goto fail_child;
}
if (chdir(d) < 0) {
err = -errno;
r = EXIT_CHDIR;
goto fail_child;
}
}
/* We repeat the fd closing here, to make sure that
* nothing is leaked from the PAM modules */
err = close_all_fds(fds, n_fds);
if (err >= 0)
err = shift_fds(fds, n_fds);
if (err >= 0)
err = flags_fds(fds, n_fds, context->non_blocking);
if (err < 0) {
r = EXIT_FDS;
goto fail_child;
}
if (apply_permissions) {
for (i = 0; i < RLIMIT_NLIMITS; i++) {
if (!context->rlimit[i])
continue;
if (setrlimit_closest(i, context->rlimit[i]) < 0) {
err = -errno;
r = EXIT_LIMITS;
goto fail_child;
}
}
if (context->capability_bounding_set_drop) {
err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
if (err < 0) {
r = EXIT_CAPABILITIES;
goto fail_child;
}
}
if (context->user) {
err = enforce_user(context, uid);
if (err < 0) {
r = EXIT_USER;
goto fail_child;
}
}
/* PR_GET_SECUREBITS is not privileged, while
* PR_SET_SECUREBITS is. So to suppress
* potential EPERMs we'll try not to call
* PR_SET_SECUREBITS unless necessary. */
if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
err = -errno;
r = EXIT_SECUREBITS;
goto fail_child;
}
if (context->capabilities)
if (cap_set_proc(context->capabilities) < 0) {
err = -errno;
r = EXIT_CAPABILITIES;
goto fail_child;
}
if (context->no_new_privileges)
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
err = -errno;
r = EXIT_NO_NEW_PRIVILEGES;
goto fail_child;
}
if (context->syscall_filter) {
err = apply_seccomp(context->syscall_filter);
if (err < 0) {
r = EXIT_SECCOMP;
goto fail_child;
}
}
#ifdef HAVE_SELINUX
if (context->selinux_context && use_selinux()) {
err = security_check_context(context->selinux_context);
if (err < 0) {
r = EXIT_SELINUX_CONTEXT;
goto fail_child;
}
err = setexeccon(context->selinux_context);
if (err < 0) {
r = EXIT_SELINUX_CONTEXT;
goto fail_child;
}
}
#endif
}
err = build_environment(context, n_fds, watchdog_usec, home, username, shell, &our_env);
if (r < 0) {
r = EXIT_MEMORY;
goto fail_child;
}
final_env = strv_env_merge(5,
environment,
our_env,
context->environment,
files_env,
pam_env,
NULL);
if (!final_env) {
err = -ENOMEM;
r = EXIT_MEMORY;
goto fail_child;
}
final_argv = replace_env_argv(argv, final_env);
if (!final_argv) {
err = -ENOMEM;
r = EXIT_MEMORY;
goto fail_child;
}
final_env = strv_env_clean(final_env);
if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
line = exec_command_line(final_argv);
if (line) {
log_open();
log_struct_unit(LOG_DEBUG,
unit_id,
"EXECUTABLE=%s", command->path,
"MESSAGE=Executing: %s", line,
NULL);
log_close();
free(line);
line = NULL;
}
}
execve(command->path, final_argv, final_env);
err = -errno;
r = EXIT_EXEC;
fail_child:
if (r != 0) {
log_open();
log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
"EXECUTABLE=%s", command->path,
"MESSAGE=Failed at step %s spawning %s: %s",
exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
command->path, strerror(-err),
"ERRNO=%d", -err,
NULL);
log_close();
}
_exit(r);
}
log_struct_unit(LOG_DEBUG,
unit_id,
"MESSAGE=Forked %s as "PID_FMT,
command->path, pid,
NULL);
/* We add the new process to the cgroup both in the child (so
* that we can be sure that no user code is ever executed
* outside of the cgroup) and in the parent (so that we can be
* sure that when we kill the cgroup the process will be
* killed too). */
if (cgroup_path)
cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
exec_status_start(&command->exec_status, pid);
*ret = pid;
return 0;
}
void exec_context_init(ExecContext *c) {
assert(c);
c->umask = 0022;
c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
c->cpu_sched_policy = SCHED_OTHER;
c->syslog_priority = LOG_DAEMON|LOG_INFO;
c->syslog_level_prefix = true;
c->ignore_sigpipe = true;
c->timer_slack_nsec = (nsec_t) -1;
}
void exec_context_done(ExecContext *c) {
unsigned l;
assert(c);
strv_free(c->environment);
c->environment = NULL;
strv_free(c->environment_files);
c->environment_files = NULL;
for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
free(c->rlimit[l]);
c->rlimit[l] = NULL;
}
free(c->working_directory);
c->working_directory = NULL;
free(c->root_directory);
c->root_directory = NULL;
free(c->tty_path);
c->tty_path = NULL;
free(c->tcpwrap_name);
c->tcpwrap_name = NULL;
free(c->syslog_identifier);
c->syslog_identifier = NULL;
free(c->user);
c->user = NULL;
free(c->group);
c->group = NULL;
strv_free(c->supplementary_groups);
c->supplementary_groups = NULL;
free(c->pam_name);
c->pam_name = NULL;
if (c->capabilities) {
cap_free(c->capabilities);
c->capabilities = NULL;
}
strv_free(c->read_only_dirs);
c->read_only_dirs = NULL;
strv_free(c->read_write_dirs);
c->read_write_dirs = NULL;
strv_free(c->inaccessible_dirs);
c->inaccessible_dirs = NULL;
if (c->cpuset)
CPU_FREE(c->cpuset);
free(c->utmp_id);
c->utmp_id = NULL;
free(c->selinux_context);
c->selinux_context = NULL;
free(c->syscall_filter);
c->syscall_filter = NULL;
}
void exec_command_done(ExecCommand *c) {
assert(c);
free(c->path);
c->path = NULL;
strv_free(c->argv);
c->argv = NULL;
}
void exec_command_done_array(ExecCommand *c, unsigned n) {
unsigned i;
for (i = 0; i < n; i++)
exec_command_done(c+i);
}
void exec_command_free_list(ExecCommand *c) {
ExecCommand *i;
while ((i = c)) {
LIST_REMOVE(command, c, i);
exec_command_done(i);
free(i);
}
}
void exec_command_free_array(ExecCommand **c, unsigned n) {
unsigned i;
for (i = 0; i < n; i++) {
exec_command_free_list(c[i]);
c[i] = NULL;
}
}
int exec_context_load_environment(const ExecContext *c, char ***l) {
char **i, **r = NULL;
assert(c);
assert(l);
STRV_FOREACH(i, c->environment_files) {
char *fn;
int k;
bool ignore = false;
char **p;
_cleanup_globfree_ glob_t pglob = {};
int count, n;
fn = *i;
if (fn[0] == '-') {
ignore = true;
fn ++;
}
if (!path_is_absolute(fn)) {
if (ignore)
continue;
strv_free(r);
return -EINVAL;
}
/* Filename supports globbing, take all matching files */
errno = 0;
if (glob(fn, 0, NULL, &pglob) != 0) {
if (ignore)
continue;
strv_free(r);
return errno ? -errno : -EINVAL;
}
count = pglob.gl_pathc;
if (count == 0) {
if (ignore)
continue;
strv_free(r);
return -EINVAL;
}
for (n = 0; n < count; n++) {
k = load_env_file(pglob.gl_pathv[n], NULL, &p);
if (k < 0) {
if (ignore)
continue;
strv_free(r);
return k;
}
/* Log invalid environment variables with filename */
if (p)
p = strv_env_clean_log(p, pglob.gl_pathv[n]);
if (r == NULL)
r = p;
else {
char **m;
m = strv_env_merge(2, r, p);
strv_free(r);
strv_free(p);
if (!m)
return -ENOMEM;
r = m;
}
}
}
*l = r;
return 0;
}
static bool tty_may_match_dev_console(const char *tty) {
char *active = NULL, *console;
bool b;
if (startswith(tty, "/dev/"))
tty += 5;
/* trivial identity? */
if (streq(tty, "console"))
return true;
console = resolve_dev_console(&active);
/* if we could not resolve, assume it may */
if (!console)
return true;
/* "tty0" means the active VC, so it may be the same sometimes */
b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
free(active);
return b;
}
bool exec_context_may_touch_console(ExecContext *ec) {
return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
is_terminal_input(ec->std_input) ||
is_terminal_output(ec->std_output) ||
is_terminal_output(ec->std_error)) &&
tty_may_match_dev_console(tty_path(ec));
}
static void strv_fprintf(FILE *f, char **l) {
char **g;
assert(f);
STRV_FOREACH(g, l)
fprintf(f, " %s", *g);
}
void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
char **e;
unsigned i;
assert(c);
assert(f);
prefix = strempty(prefix);
fprintf(f,
"%sUMask: %04o\n"
"%sWorkingDirectory: %s\n"
"%sRootDirectory: %s\n"
"%sNonBlocking: %s\n"
"%sPrivateTmp: %s\n"
"%sPrivateNetwork: %s\n"
"%sPrivateDevices: %s\n"
"%sIgnoreSIGPIPE: %s\n",
prefix, c->umask,
prefix, c->working_directory ? c->working_directory : "/",
prefix, c->root_directory ? c->root_directory : "/",
prefix, yes_no(c->non_blocking),
prefix, yes_no(c->private_tmp),
prefix, yes_no(c->private_network),
prefix, yes_no(c->private_devices),
prefix, yes_no(c->ignore_sigpipe));
STRV_FOREACH(e, c->environment)
fprintf(f, "%sEnvironment: %s\n", prefix, *e);
STRV_FOREACH(e, c->environment_files)
fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
if (c->tcpwrap_name)
fprintf(f,
"%sTCPWrapName: %s\n",
prefix, c->tcpwrap_name);
if (c->nice_set)
fprintf(f,
"%sNice: %i\n",
prefix, c->nice);
if (c->oom_score_adjust_set)
fprintf(f,
"%sOOMScoreAdjust: %i\n",
prefix, c->oom_score_adjust);
for (i = 0; i < RLIM_NLIMITS; i++)
if (c->rlimit[i])
fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
if (c->ioprio_set) {
char *class_str;
int r;
r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
if (r < 0)
class_str = NULL;
fprintf(f,
"%sIOSchedulingClass: %s\n"
"%sIOPriority: %i\n",
prefix, strna(class_str),
prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
free(class_str);
}
if (c->cpu_sched_set) {
char *policy_str;
int r;
r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
if (r < 0)
policy_str = NULL;
fprintf(f,
"%sCPUSchedulingPolicy: %s\n"
"%sCPUSchedulingPriority: %i\n"
"%sCPUSchedulingResetOnFork: %s\n",
prefix, strna(policy_str),
prefix, c->cpu_sched_priority,
prefix, yes_no(c->cpu_sched_reset_on_fork));
free(policy_str);
}
if (c->cpuset) {
fprintf(f, "%sCPUAffinity:", prefix);
for (i = 0; i < c->cpuset_ncpus; i++)
if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
fprintf(f, " %u", i);
fputs("\n", f);
}
if (c->timer_slack_nsec != (nsec_t) -1)
fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
fprintf(f,
"%sStandardInput: %s\n"
"%sStandardOutput: %s\n"
"%sStandardError: %s\n",
prefix, exec_input_to_string(c->std_input),
prefix, exec_output_to_string(c->std_output),
prefix, exec_output_to_string(c->std_error));
if (c->tty_path)
fprintf(f,
"%sTTYPath: %s\n"
"%sTTYReset: %s\n"
"%sTTYVHangup: %s\n"
"%sTTYVTDisallocate: %s\n",
prefix, c->tty_path,
prefix, yes_no(c->tty_reset),
prefix, yes_no(c->tty_vhangup),
prefix, yes_no(c->tty_vt_disallocate));
if (c->std_output == EXEC_OUTPUT_SYSLOG ||
c->std_output == EXEC_OUTPUT_KMSG ||
c->std_output == EXEC_OUTPUT_JOURNAL ||
c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
c->std_error == EXEC_OUTPUT_SYSLOG ||
c->std_error == EXEC_OUTPUT_KMSG ||
c->std_error == EXEC_OUTPUT_JOURNAL ||
c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
_cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
fprintf(f,
"%sSyslogFacility: %s\n"
"%sSyslogLevel: %s\n",
prefix, strna(fac_str),
prefix, strna(lvl_str));
}
if (c->capabilities) {
_cleanup_cap_free_charp_ char *t;
t = cap_to_text(c->capabilities, NULL);
if (t)
fprintf(f, "%sCapabilities: %s\n", prefix, t);
}
if (c->secure_bits)
fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
prefix,
(c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
(c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
(c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
(c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
(c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
(c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
if (c->capability_bounding_set_drop) {
unsigned long l;
fprintf(f, "%sCapabilityBoundingSet:", prefix);
for (l = 0; l <= cap_last_cap(); l++)
if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
_cleanup_cap_free_charp_ char *t;
t = cap_to_name(l);
if (t)
fprintf(f, " %s", t);
}
fputs("\n", f);
}
if (c->user)
fprintf(f, "%sUser: %s\n", prefix, c->user);
if (c->group)
fprintf(f, "%sGroup: %s\n", prefix, c->group);
if (strv_length(c->supplementary_groups) > 0) {
fprintf(f, "%sSupplementaryGroups:", prefix);
strv_fprintf(f, c->supplementary_groups);
fputs("\n", f);
}
if (c->pam_name)
fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
if (strv_length(c->read_write_dirs) > 0) {
fprintf(f, "%sReadWriteDirs:", prefix);
strv_fprintf(f, c->read_write_dirs);
fputs("\n", f);
}
if (strv_length(c->read_only_dirs) > 0) {
fprintf(f, "%sReadOnlyDirs:", prefix);
strv_fprintf(f, c->read_only_dirs);
fputs("\n", f);
}
if (strv_length(c->inaccessible_dirs) > 0) {
fprintf(f, "%sInaccessibleDirs:", prefix);
strv_fprintf(f, c->inaccessible_dirs);
fputs("\n", f);
}
if (c->utmp_id)
fprintf(f,
"%sUtmpIdentifier: %s\n",
prefix, c->utmp_id);
if (c->selinux_context)
fprintf(f,
"%sSELinuxContext: %s\n",
prefix, c->selinux_context);
}
void exec_status_start(ExecStatus *s, pid_t pid) {
assert(s);
zero(*s);
s->pid = pid;
dual_timestamp_get(&s->start_timestamp);
}
void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
assert(s);
if (s->pid && s->pid != pid)
zero(*s);
s->pid = pid;
dual_timestamp_get(&s->exit_timestamp);
s->code = code;
s->status = status;
if (context) {
if (context->utmp_id)
utmp_put_dead_process(context->utmp_id, pid, code, status);
exec_context_tty_reset(context);
}
}
void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
char buf[FORMAT_TIMESTAMP_MAX];
assert(s);
assert(f);
if (!prefix)
prefix = "";
if (s->pid <= 0)
return;
fprintf(f,
"%sPID: "PID_FMT"\n",
prefix, s->pid);
if (s->start_timestamp.realtime > 0)
fprintf(f,
"%sStart Timestamp: %s\n",
prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
if (s->exit_timestamp.realtime > 0)
fprintf(f,
"%sExit Timestamp: %s\n"
"%sExit Code: %s\n"
"%sExit Status: %i\n",
prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
prefix, sigchld_code_to_string(s->code),
prefix, s->status);
}
char *exec_command_line(char **argv) {
size_t k;
char *n, *p, **a;
bool first = true;
assert(argv);
k = 1;
STRV_FOREACH(a, argv)
k += strlen(*a)+3;
if (!(n = new(char, k)))
return NULL;
p = n;
STRV_FOREACH(a, argv) {
if (!first)
*(p++) = ' ';
else
first = false;
if (strpbrk(*a, WHITESPACE)) {
*(p++) = '\'';
p = stpcpy(p, *a);
*(p++) = '\'';
} else
p = stpcpy(p, *a);
}
*p = 0;
/* FIXME: this doesn't really handle arguments that have
* spaces and ticks in them */
return n;
}
void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
char *p2;
const char *prefix2;
char *cmd;
assert(c);
assert(f);
if (!prefix)
prefix = "";
p2 = strappend(prefix, "\t");
prefix2 = p2 ? p2 : prefix;
cmd = exec_command_line(c->argv);
fprintf(f,
"%sCommand Line: %s\n",
prefix, cmd ? cmd : strerror(ENOMEM));
free(cmd);
exec_status_dump(&c->exec_status, f, prefix2);
free(p2);
}
void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
assert(f);
if (!prefix)
prefix = "";
LIST_FOREACH(command, c, c)
exec_command_dump(c, f, prefix);
}
void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
ExecCommand *end;
assert(l);
assert(e);
if (*l) {
/* It's kind of important, that we keep the order here */
LIST_FIND_TAIL(command, *l, end);
LIST_INSERT_AFTER(command, *l, end, e);
} else
*l = e;
}
int exec_command_set(ExecCommand *c, const char *path, ...) {
va_list ap;
char **l, *p;
assert(c);
assert(path);
va_start(ap, path);
l = strv_new_ap(path, ap);
va_end(ap);
if (!l)
return -ENOMEM;
p = strdup(path);
if (!p) {
strv_free(l);
return -ENOMEM;
}
free(c->path);
c->path = p;
strv_free(c->argv);
c->argv = l;
return 0;
}
static int exec_runtime_allocate(ExecRuntime **rt) {
if (*rt)
return 0;
*rt = new0(ExecRuntime, 1);
if (!*rt)
return -ENOMEM;
(*rt)->n_ref = 1;
(*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
return 0;
}
int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
int r;
assert(rt);
assert(c);
assert(id);
if (*rt)
return 1;
if (!c->private_network && !c->private_tmp)
return 0;
r = exec_runtime_allocate(rt);
if (r < 0)
return r;
if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
return -errno;
}
if (c->private_tmp && !(*rt)->tmp_dir) {
r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
if (r < 0)
return r;
}
return 1;
}
ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
assert(r);
assert(r->n_ref > 0);
r->n_ref++;
return r;
}
ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
if (!r)
return NULL;
assert(r->n_ref > 0);
r->n_ref--;
if (r->n_ref <= 0) {
free(r->tmp_dir);
free(r->var_tmp_dir);
close_pipe(r->netns_storage_socket);
free(r);
}
return NULL;
}
int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds) {
assert(u);
assert(f);
assert(fds);
if (!rt)
return 0;
if (rt->tmp_dir)
unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
if (rt->var_tmp_dir)
unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
if (rt->netns_storage_socket[0] >= 0) {
int copy;
copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
if (copy < 0)
return copy;
unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
}
if (rt->netns_storage_socket[1] >= 0) {
int copy;
copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
if (copy < 0)
return copy;
unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
}
return 0;
}
int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds) {
int r;
assert(rt);
assert(key);
assert(value);
if (streq(key, "tmp-dir")) {
char *copy;
r = exec_runtime_allocate(rt);
if (r < 0)
return r;
copy = strdup(value);
if (!copy)
return log_oom();
free((*rt)->tmp_dir);
(*rt)->tmp_dir = copy;
} else if (streq(key, "var-tmp-dir")) {
char *copy;
r = exec_runtime_allocate(rt);
if (r < 0)
return r;
copy = strdup(value);
if (!copy)
return log_oom();
free((*rt)->var_tmp_dir);
(*rt)->var_tmp_dir = copy;
} else if (streq(key, "netns-socket-0")) {
int fd;
r = exec_runtime_allocate(rt);
if (r < 0)
return r;
if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
else {
if ((*rt)->netns_storage_socket[0] >= 0)
close_nointr_nofail((*rt)->netns_storage_socket[0]);
(*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
}
} else if (streq(key, "netns-socket-1")) {
int fd;
r = exec_runtime_allocate(rt);
if (r < 0)
return r;
if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
else {
if ((*rt)->netns_storage_socket[1] >= 0)
close_nointr_nofail((*rt)->netns_storage_socket[1]);
(*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
}
} else
return 0;
return 1;
}
static void *remove_tmpdir_thread(void *p) {
_cleanup_free_ char *path = p;
rm_rf_dangerous(path, false, true, false);
return NULL;
}
void exec_runtime_destroy(ExecRuntime *rt) {
if (!rt)
return;
/* If there are multiple users of this, let's leave the stuff around */
if (rt->n_ref > 1)
return;
if (rt->tmp_dir) {
log_debug("Spawning thread to nuke %s", rt->tmp_dir);
asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
rt->tmp_dir = NULL;
}
if (rt->var_tmp_dir) {
log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
rt->var_tmp_dir = NULL;
}
close_pipe(rt->netns_storage_socket);
}
static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
[EXEC_INPUT_NULL] = "null",
[EXEC_INPUT_TTY] = "tty",
[EXEC_INPUT_TTY_FORCE] = "tty-force",
[EXEC_INPUT_TTY_FAIL] = "tty-fail",
[EXEC_INPUT_SOCKET] = "socket"
};
DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
[EXEC_OUTPUT_INHERIT] = "inherit",
[EXEC_OUTPUT_NULL] = "null",
[EXEC_OUTPUT_TTY] = "tty",
[EXEC_OUTPUT_SYSLOG] = "syslog",
[EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
[EXEC_OUTPUT_KMSG] = "kmsg",
[EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
[EXEC_OUTPUT_JOURNAL] = "journal",
[EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
[EXEC_OUTPUT_SOCKET] = "socket"
};
DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);