]>
Commit | Line | Data |
---|---|---|
52ad194e | 1 | /* SPDX-License-Identifier: LGPL-2.1+ */ |
60f067b4 | 2 | |
60f067b4 | 3 | #include "sd-daemon.h" |
db2df898 MP |
4 | #include "sd-event.h" |
5 | ||
6 | #include "capability-util.h" | |
6e866b33 MB |
7 | #include "daemon-util.h" |
8 | #include "main-func.h" | |
60f067b4 | 9 | #include "mkdir.h" |
db2df898 MP |
10 | #include "resolved-conf.h" |
11 | #include "resolved-manager.h" | |
4c89c718 | 12 | #include "resolved-resolv-conf.h" |
e735f4d4 | 13 | #include "selinux-util.h" |
86f210e9 | 14 | #include "signal-util.h" |
db2df898 | 15 | #include "user-util.h" |
5eef597e | 16 | |
6e866b33 MB |
17 | static int run(int argc, char *argv[]) { |
18 | _cleanup_(notify_on_cleanup) const char *notify_stop = NULL; | |
5eef597e | 19 | _cleanup_(manager_freep) Manager *m = NULL; |
60f067b4 JS |
20 | const char *user = "systemd-resolve"; |
21 | uid_t uid; | |
22 | gid_t gid; | |
23 | int r; | |
24 | ||
6e866b33 | 25 | log_setup_service(); |
60f067b4 | 26 | |
6e866b33 MB |
27 | if (argc != 1) |
28 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "This program takes no arguments."); | |
5eef597e MP |
29 | |
30 | umask(0022); | |
31 | ||
aa27b158 | 32 | r = mac_selinux_init(); |
6e866b33 MB |
33 | if (r < 0) |
34 | return log_error_errno(r, "SELinux setup failed: %m"); | |
60f067b4 | 35 | |
6e866b33 MB |
36 | r = get_user_creds(&user, &uid, &gid, NULL, NULL, 0); |
37 | if (r < 0) | |
38 | return log_error_errno(r, "Cannot resolve user name %s: %m", user); | |
60f067b4 JS |
39 | |
40 | /* Always create the directory where resolv.conf will live */ | |
b012e921 | 41 | r = mkdir_safe_label("/run/systemd/resolve", 0755, uid, gid, MKDIR_WARN_MODE); |
6e866b33 MB |
42 | if (r < 0) |
43 | return log_error_errno(r, "Could not create runtime directory: %m"); | |
60f067b4 | 44 | |
6e866b33 | 45 | /* Drop privileges, but only if we have been started as root. If we are not running as root we assume most |
f5e65279 MB |
46 | * privileges are already dropped. */ |
47 | if (getuid() == 0) { | |
48 | ||
49 | /* Drop privileges, but keep three caps. Note that we drop those too, later on (see below) */ | |
50 | r = drop_privileges(uid, gid, | |
51 | (UINT64_C(1) << CAP_NET_RAW)| /* needed for SO_BINDTODEVICE */ | |
52 | (UINT64_C(1) << CAP_NET_BIND_SERVICE)| /* needed to bind on port 53 */ | |
53 | (UINT64_C(1) << CAP_SETPCAP) /* needed in order to drop the caps later */); | |
54 | if (r < 0) | |
6e866b33 | 55 | return log_error_errno(r, "Failed to drop privileges: %m"); |
f5e65279 | 56 | } |
5eef597e | 57 | |
f5e65279 | 58 | assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGUSR1, SIGUSR2, SIGRTMIN+1, -1) >= 0); |
60f067b4 JS |
59 | |
60 | r = manager_new(&m); | |
6e866b33 MB |
61 | if (r < 0) |
62 | return log_error_errno(r, "Could not create manager: %m"); | |
60f067b4 | 63 | |
5eef597e | 64 | r = manager_start(m); |
6e866b33 MB |
65 | if (r < 0) |
66 | return log_error_errno(r, "Failed to start manager: %m"); | |
60f067b4 | 67 | |
5a920b42 MP |
68 | /* Write finish default resolv.conf to avoid a dangling symlink */ |
69 | (void) manager_write_resolv_conf(m); | |
70 | ||
6e866b33 MB |
71 | (void) manager_check_resolv_conf(m); |
72 | ||
5a920b42 MP |
73 | /* Let's drop the remaining caps now */ |
74 | r = capability_bounding_set_drop(0, true); | |
6e866b33 MB |
75 | if (r < 0) |
76 | return log_error_errno(r, "Failed to drop remaining caps: %m"); | |
5eef597e | 77 | |
6e866b33 | 78 | notify_stop = notify_start(NOTIFY_READY, NOTIFY_STOPPING); |
60f067b4 JS |
79 | |
80 | r = sd_event_loop(m->event); | |
6e866b33 MB |
81 | if (r < 0) |
82 | return log_error_errno(r, "Event loop failed: %m"); | |
60f067b4 | 83 | |
6e866b33 | 84 | (void) sd_event_get_exit_code(m->event, &r); |
5eef597e | 85 | |
6e866b33 | 86 | return r; |
60f067b4 | 87 | } |
6e866b33 MB |
88 | |
89 | DEFINE_MAIN_FUNCTION(run); |