2 This file is part of systemd.
4 Copyright 2010 Lennart Poettering
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
27 #include <sys/personality.h>
28 #include <sys/prctl.h>
29 #include <sys/socket.h>
36 #include <security/pam_appl.h>
40 #include <selinux/selinux.h>
48 #include <sys/apparmor.h>
51 #include "sd-messages.h"
54 #include "alloc-util.h"
56 #include "apparmor-util.h"
60 #include "bus-endpoint.h"
62 #include "capability-util.h"
65 #include "errno-list.h"
67 #include "exit-status.h"
70 #include "formats-util.h"
72 #include "glob-util.h"
79 #include "namespace.h"
80 #include "parse-util.h"
81 #include "path-util.h"
82 #include "process-util.h"
83 #include "rlimit-util.h"
86 #include "seccomp-util.h"
88 #include "securebits.h"
89 #include "selinux-util.h"
90 #include "signal-util.h"
91 #include "smack-util.h"
92 #include "string-table.h"
93 #include "string-util.h"
95 #include "syslog-util.h"
96 #include "terminal-util.h"
98 #include "user-util.h"
100 #include "utmp-wtmp.h"
102 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
103 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
105 /* This assumes there is a 'tty' group */
106 #define TTY_MODE 0620
108 #define SNDBUF_SIZE (8*1024*1024)
110 static int shift_fds(int fds
[], unsigned n_fds
) {
111 int start
, restart_from
;
116 /* Modifies the fds array! (sorts it) */
126 for (i
= start
; i
< (int) n_fds
; i
++) {
129 /* Already at right index? */
133 nfd
= fcntl(fds
[i
], F_DUPFD
, i
+ 3);
140 /* Hmm, the fd we wanted isn't free? Then
141 * let's remember that and try again from here */
142 if (nfd
!= i
+3 && restart_from
< 0)
146 if (restart_from
< 0)
149 start
= restart_from
;
155 static int flags_fds(const int fds
[], unsigned n_fds
, bool nonblock
) {
164 /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
166 for (i
= 0; i
< n_fds
; i
++) {
168 r
= fd_nonblock(fds
[i
], nonblock
);
172 /* We unconditionally drop FD_CLOEXEC from the fds,
173 * since after all we want to pass these fds to our
176 r
= fd_cloexec(fds
[i
], false);
184 static const char *exec_context_tty_path(const ExecContext
*context
) {
187 if (context
->stdio_as_fds
)
190 if (context
->tty_path
)
191 return context
->tty_path
;
193 return "/dev/console";
196 static void exec_context_tty_reset(const ExecContext
*context
, const ExecParameters
*p
) {
201 path
= exec_context_tty_path(context
);
203 if (context
->tty_vhangup
) {
204 if (p
&& p
->stdin_fd
>= 0)
205 (void) terminal_vhangup_fd(p
->stdin_fd
);
207 (void) terminal_vhangup(path
);
210 if (context
->tty_reset
) {
211 if (p
&& p
->stdin_fd
>= 0)
212 (void) reset_terminal_fd(p
->stdin_fd
, true);
214 (void) reset_terminal(path
);
217 if (context
->tty_vt_disallocate
&& path
)
218 (void) vt_disallocate(path
);
221 static bool is_terminal_output(ExecOutput o
) {
223 o
== EXEC_OUTPUT_TTY
||
224 o
== EXEC_OUTPUT_SYSLOG_AND_CONSOLE
||
225 o
== EXEC_OUTPUT_KMSG_AND_CONSOLE
||
226 o
== EXEC_OUTPUT_JOURNAL_AND_CONSOLE
;
229 static int open_null_as(int flags
, int nfd
) {
234 fd
= open("/dev/null", flags
|O_NOCTTY
);
239 r
= dup2(fd
, nfd
) < 0 ? -errno
: nfd
;
247 static int connect_journal_socket(int fd
, uid_t uid
, gid_t gid
) {
248 union sockaddr_union sa
= {
249 .un
.sun_family
= AF_UNIX
,
250 .un
.sun_path
= "/run/systemd/journal/stdout",
252 uid_t olduid
= UID_INVALID
;
253 gid_t oldgid
= GID_INVALID
;
256 if (gid
!= GID_INVALID
) {
264 if (uid
!= UID_INVALID
) {
274 r
= connect(fd
, &sa
.sa
, offsetof(struct sockaddr_un
, sun_path
) + strlen(sa
.un
.sun_path
));
278 /* If we fail to restore the uid or gid, things will likely
279 fail later on. This should only happen if an LSM interferes. */
281 if (uid
!= UID_INVALID
)
282 (void) seteuid(olduid
);
285 if (gid
!= GID_INVALID
)
286 (void) setegid(oldgid
);
291 static int connect_logger_as(const ExecContext
*context
, ExecOutput output
, const char *ident
, const char *unit_id
, int nfd
, uid_t uid
, gid_t gid
) {
295 assert(output
< _EXEC_OUTPUT_MAX
);
299 fd
= socket(AF_UNIX
, SOCK_STREAM
, 0);
303 r
= connect_journal_socket(fd
, uid
, gid
);
307 if (shutdown(fd
, SHUT_RD
) < 0) {
312 fd_inc_sndbuf(fd
, SNDBUF_SIZE
);
322 context
->syslog_identifier
? context
->syslog_identifier
: ident
,
324 context
->syslog_priority
,
325 !!context
->syslog_level_prefix
,
326 output
== EXEC_OUTPUT_SYSLOG
|| output
== EXEC_OUTPUT_SYSLOG_AND_CONSOLE
,
327 output
== EXEC_OUTPUT_KMSG
|| output
== EXEC_OUTPUT_KMSG_AND_CONSOLE
,
328 is_terminal_output(output
));
331 r
= dup2(fd
, nfd
) < 0 ? -errno
: nfd
;
338 static int open_terminal_as(const char *path
, mode_t mode
, int nfd
) {
344 fd
= open_terminal(path
, mode
| O_NOCTTY
);
349 r
= dup2(fd
, nfd
) < 0 ? -errno
: nfd
;
357 static bool is_terminal_input(ExecInput i
) {
359 i
== EXEC_INPUT_TTY
||
360 i
== EXEC_INPUT_TTY_FORCE
||
361 i
== EXEC_INPUT_TTY_FAIL
;
364 static int fixup_input(ExecInput std_input
, int socket_fd
, bool apply_tty_stdin
) {
366 if (is_terminal_input(std_input
) && !apply_tty_stdin
)
367 return EXEC_INPUT_NULL
;
369 if (std_input
== EXEC_INPUT_SOCKET
&& socket_fd
< 0)
370 return EXEC_INPUT_NULL
;
375 static int fixup_output(ExecOutput std_output
, int socket_fd
) {
377 if (std_output
== EXEC_OUTPUT_SOCKET
&& socket_fd
< 0)
378 return EXEC_OUTPUT_INHERIT
;
383 static int setup_input(
384 const ExecContext
*context
,
385 const ExecParameters
*params
,
393 if (params
->stdin_fd
>= 0) {
394 if (dup2(params
->stdin_fd
, STDIN_FILENO
) < 0)
397 /* Try to make this the controlling tty, if it is a tty, and reset it */
398 (void) ioctl(STDIN_FILENO
, TIOCSCTTY
, context
->std_input
== EXEC_INPUT_TTY_FORCE
);
399 (void) reset_terminal_fd(STDIN_FILENO
, true);
404 i
= fixup_input(context
->std_input
, socket_fd
, params
->apply_tty_stdin
);
408 case EXEC_INPUT_NULL
:
409 return open_null_as(O_RDONLY
, STDIN_FILENO
);
412 case EXEC_INPUT_TTY_FORCE
:
413 case EXEC_INPUT_TTY_FAIL
: {
416 fd
= acquire_terminal(exec_context_tty_path(context
),
417 i
== EXEC_INPUT_TTY_FAIL
,
418 i
== EXEC_INPUT_TTY_FORCE
,
424 if (fd
!= STDIN_FILENO
) {
425 r
= dup2(fd
, STDIN_FILENO
) < 0 ? -errno
: STDIN_FILENO
;
433 case EXEC_INPUT_SOCKET
:
434 return dup2(socket_fd
, STDIN_FILENO
) < 0 ? -errno
: STDIN_FILENO
;
437 assert_not_reached("Unknown input type");
441 static int setup_output(
443 const ExecContext
*context
,
444 const ExecParameters
*params
,
448 uid_t uid
, gid_t gid
) {
459 if (fileno
== STDOUT_FILENO
&& params
->stdout_fd
>= 0) {
461 if (dup2(params
->stdout_fd
, STDOUT_FILENO
) < 0)
464 return STDOUT_FILENO
;
467 if (fileno
== STDERR_FILENO
&& params
->stderr_fd
>= 0) {
468 if (dup2(params
->stderr_fd
, STDERR_FILENO
) < 0)
471 return STDERR_FILENO
;
474 i
= fixup_input(context
->std_input
, socket_fd
, params
->apply_tty_stdin
);
475 o
= fixup_output(context
->std_output
, socket_fd
);
477 if (fileno
== STDERR_FILENO
) {
479 e
= fixup_output(context
->std_error
, socket_fd
);
481 /* This expects the input and output are already set up */
483 /* Don't change the stderr file descriptor if we inherit all
484 * the way and are not on a tty */
485 if (e
== EXEC_OUTPUT_INHERIT
&&
486 o
== EXEC_OUTPUT_INHERIT
&&
487 i
== EXEC_INPUT_NULL
&&
488 !is_terminal_input(context
->std_input
) &&
492 /* Duplicate from stdout if possible */
493 if (e
== o
|| e
== EXEC_OUTPUT_INHERIT
)
494 return dup2(STDOUT_FILENO
, fileno
) < 0 ? -errno
: fileno
;
498 } else if (o
== EXEC_OUTPUT_INHERIT
) {
499 /* If input got downgraded, inherit the original value */
500 if (i
== EXEC_INPUT_NULL
&& is_terminal_input(context
->std_input
))
501 return open_terminal_as(exec_context_tty_path(context
), O_WRONLY
, fileno
);
503 /* If the input is connected to anything that's not a /dev/null, inherit that... */
504 if (i
!= EXEC_INPUT_NULL
)
505 return dup2(STDIN_FILENO
, fileno
) < 0 ? -errno
: fileno
;
507 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
511 /* We need to open /dev/null here anew, to get the right access mode. */
512 return open_null_as(O_WRONLY
, fileno
);
517 case EXEC_OUTPUT_NULL
:
518 return open_null_as(O_WRONLY
, fileno
);
520 case EXEC_OUTPUT_TTY
:
521 if (is_terminal_input(i
))
522 return dup2(STDIN_FILENO
, fileno
) < 0 ? -errno
: fileno
;
524 /* We don't reset the terminal if this is just about output */
525 return open_terminal_as(exec_context_tty_path(context
), O_WRONLY
, fileno
);
527 case EXEC_OUTPUT_SYSLOG
:
528 case EXEC_OUTPUT_SYSLOG_AND_CONSOLE
:
529 case EXEC_OUTPUT_KMSG
:
530 case EXEC_OUTPUT_KMSG_AND_CONSOLE
:
531 case EXEC_OUTPUT_JOURNAL
:
532 case EXEC_OUTPUT_JOURNAL_AND_CONSOLE
:
533 r
= connect_logger_as(context
, o
, ident
, unit
->id
, fileno
, uid
, gid
);
535 log_unit_error_errno(unit
, r
, "Failed to connect %s to the journal socket, ignoring: %m", fileno
== STDOUT_FILENO
? "stdout" : "stderr");
536 r
= open_null_as(O_WRONLY
, fileno
);
540 case EXEC_OUTPUT_SOCKET
:
541 assert(socket_fd
>= 0);
542 return dup2(socket_fd
, fileno
) < 0 ? -errno
: fileno
;
545 assert_not_reached("Unknown error type");
549 static int chown_terminal(int fd
, uid_t uid
) {
554 /* This might fail. What matters are the results. */
555 (void) fchown(fd
, uid
, -1);
556 (void) fchmod(fd
, TTY_MODE
);
558 if (fstat(fd
, &st
) < 0)
561 if (st
.st_uid
!= uid
|| (st
.st_mode
& 0777) != TTY_MODE
)
567 static int setup_confirm_stdio(int *_saved_stdin
, int *_saved_stdout
) {
568 _cleanup_close_
int fd
= -1, saved_stdin
= -1, saved_stdout
= -1;
571 assert(_saved_stdin
);
572 assert(_saved_stdout
);
574 saved_stdin
= fcntl(STDIN_FILENO
, F_DUPFD
, 3);
578 saved_stdout
= fcntl(STDOUT_FILENO
, F_DUPFD
, 3);
579 if (saved_stdout
< 0)
582 fd
= acquire_terminal(
587 DEFAULT_CONFIRM_USEC
);
591 r
= chown_terminal(fd
, getuid());
595 r
= reset_terminal_fd(fd
, true);
599 if (dup2(fd
, STDIN_FILENO
) < 0)
602 if (dup2(fd
, STDOUT_FILENO
) < 0)
609 *_saved_stdin
= saved_stdin
;
610 *_saved_stdout
= saved_stdout
;
612 saved_stdin
= saved_stdout
= -1;
617 _printf_(1, 2) static int write_confirm_message(const char *format
, ...) {
618 _cleanup_close_
int fd
= -1;
623 fd
= open_terminal("/dev/console", O_WRONLY
|O_NOCTTY
|O_CLOEXEC
);
627 va_start(ap
, format
);
628 vdprintf(fd
, format
, ap
);
634 static int restore_confirm_stdio(int *saved_stdin
, int *saved_stdout
) {
638 assert(saved_stdout
);
642 if (*saved_stdin
>= 0)
643 if (dup2(*saved_stdin
, STDIN_FILENO
) < 0)
646 if (*saved_stdout
>= 0)
647 if (dup2(*saved_stdout
, STDOUT_FILENO
) < 0)
650 *saved_stdin
= safe_close(*saved_stdin
);
651 *saved_stdout
= safe_close(*saved_stdout
);
656 static int ask_for_confirmation(char *response
, char **argv
) {
657 int saved_stdout
= -1, saved_stdin
= -1, r
;
658 _cleanup_free_
char *line
= NULL
;
660 r
= setup_confirm_stdio(&saved_stdin
, &saved_stdout
);
664 line
= exec_command_line(argv
);
668 r
= ask_char(response
, "yns", "Execute %s? [Yes, No, Skip] ", line
);
670 restore_confirm_stdio(&saved_stdin
, &saved_stdout
);
675 static int enforce_groups(const ExecContext
*context
, const char *username
, gid_t gid
) {
676 bool keep_groups
= false;
681 /* Lookup and set GID and supplementary group list. Here too
682 * we avoid NSS lookups for gid=0. */
684 if (context
->group
|| username
) {
685 /* First step, initialize groups from /etc/groups */
686 if (username
&& gid
!= 0) {
687 if (initgroups(username
, gid
) < 0)
693 /* Second step, set our gids */
694 if (setresgid(gid
, gid
, gid
) < 0)
698 if (context
->supplementary_groups
) {
703 /* Final step, initialize any manually set supplementary groups */
704 assert_se((ngroups_max
= (int) sysconf(_SC_NGROUPS_MAX
)) > 0);
706 if (!(gids
= new(gid_t
, ngroups_max
)))
710 k
= getgroups(ngroups_max
, gids
);
718 STRV_FOREACH(i
, context
->supplementary_groups
) {
721 if (k
>= ngroups_max
) {
727 r
= get_group_creds(&g
, gids
+k
);
736 if (setgroups(k
, gids
) < 0) {
747 static int enforce_user(const ExecContext
*context
, uid_t uid
) {
750 /* Sets (but doesn't lookup) the uid and make sure we keep the
751 * capabilities while doing so. */
753 if (context
->capabilities
|| context
->capability_ambient_set
!= 0) {
755 /* First step: If we need to keep capabilities but
756 * drop privileges we need to make sure we keep our
757 * caps, while we drop privileges. */
759 int sb
= context
->secure_bits
| 1<<SECURE_KEEP_CAPS
;
761 if (prctl(PR_GET_SECUREBITS
) != sb
)
762 if (prctl(PR_SET_SECUREBITS
, sb
) < 0)
766 /* Second step: set the capabilities. This will reduce
767 * the capabilities to the minimum we need. */
769 if (context
->capabilities
) {
770 _cleanup_cap_free_ cap_t d
= NULL
;
771 static const cap_value_t bits
[] = {
772 CAP_SETUID
, /* Necessary so that we can run setresuid() below */
773 CAP_SETPCAP
/* Necessary so that we can set PR_SET_SECUREBITS later on */
776 d
= cap_dup(context
->capabilities
);
780 if (cap_set_flag(d
, CAP_EFFECTIVE
, ELEMENTSOF(bits
), bits
, CAP_SET
) < 0 ||
781 cap_set_flag(d
, CAP_PERMITTED
, ELEMENTSOF(bits
), bits
, CAP_SET
) < 0)
784 if (cap_set_proc(d
) < 0)
789 /* Third step: actually set the uids */
790 if (setresuid(uid
, uid
, uid
) < 0)
793 /* At this point we should have all necessary capabilities but
794 are otherwise a normal user. However, the caps might got
795 corrupted due to the setresuid() so we need clean them up
796 later. This is done outside of this call. */
803 static int null_conv(
805 const struct pam_message
**msg
,
806 struct pam_response
**resp
,
809 /* We don't support conversations */
814 static int setup_pam(
820 int fds
[], unsigned n_fds
) {
822 static const struct pam_conv conv
= {
827 _cleanup_(barrier_destroy
) Barrier barrier
= BARRIER_NULL
;
828 pam_handle_t
*handle
= NULL
;
830 int pam_code
= PAM_SUCCESS
, r
;
832 bool close_session
= false;
833 pid_t pam_pid
= 0, parent_pid
;
840 /* We set up PAM in the parent process, then fork. The child
841 * will then stay around until killed via PR_GET_PDEATHSIG or
842 * systemd via the cgroup logic. It will then remove the PAM
843 * session again. The parent process will exec() the actual
844 * daemon. We do things this way to ensure that the main PID
845 * of the daemon is the one we initially fork()ed. */
847 r
= barrier_create(&barrier
);
851 if (log_get_max_level() < LOG_DEBUG
)
854 pam_code
= pam_start(name
, user
, &conv
, &handle
);
855 if (pam_code
!= PAM_SUCCESS
) {
861 pam_code
= pam_set_item(handle
, PAM_TTY
, tty
);
862 if (pam_code
!= PAM_SUCCESS
)
866 pam_code
= pam_acct_mgmt(handle
, flags
);
867 if (pam_code
!= PAM_SUCCESS
)
870 pam_code
= pam_open_session(handle
, flags
);
871 if (pam_code
!= PAM_SUCCESS
)
874 close_session
= true;
876 e
= pam_getenvlist(handle
);
878 pam_code
= PAM_BUF_ERR
;
882 /* Block SIGTERM, so that we know that it won't get lost in
885 assert_se(sigprocmask_many(SIG_BLOCK
, &old_ss
, SIGTERM
, -1) >= 0);
887 parent_pid
= getpid();
896 int sig
, ret
= EXIT_PAM
;
898 /* The child's job is to reset the PAM session on
900 barrier_set_role(&barrier
, BARRIER_CHILD
);
902 /* This string must fit in 10 chars (i.e. the length
903 * of "/sbin/init"), to look pretty in /bin/ps */
904 rename_process("(sd-pam)");
906 /* Make sure we don't keep open the passed fds in this
907 child. We assume that otherwise only those fds are
908 open here that have been opened by PAM. */
909 close_many(fds
, n_fds
);
911 /* Drop privileges - we don't need any to pam_close_session
912 * and this will make PR_SET_PDEATHSIG work in most cases.
913 * If this fails, ignore the error - but expect sd-pam threads
914 * to fail to exit normally */
915 if (setresuid(uid
, uid
, uid
) < 0)
916 log_error_errno(r
, "Error: Failed to setresuid() in sd-pam: %m");
918 (void) ignore_signals(SIGPIPE
, -1);
920 /* Wait until our parent died. This will only work if
921 * the above setresuid() succeeds, otherwise the kernel
922 * will not allow unprivileged parents kill their privileged
923 * children this way. We rely on the control groups kill logic
924 * to do the rest for us. */
925 if (prctl(PR_SET_PDEATHSIG
, SIGTERM
) < 0)
928 /* Tell the parent that our setup is done. This is especially
929 * important regarding dropping privileges. Otherwise, unit
930 * setup might race against our setresuid(2) call. */
931 barrier_place(&barrier
);
933 /* Check if our parent process might already have
935 if (getppid() == parent_pid
) {
938 assert_se(sigemptyset(&ss
) >= 0);
939 assert_se(sigaddset(&ss
, SIGTERM
) >= 0);
942 if (sigwait(&ss
, &sig
) < 0) {
949 assert(sig
== SIGTERM
);
954 /* If our parent died we'll end the session */
955 if (getppid() != parent_pid
) {
956 pam_code
= pam_close_session(handle
, flags
);
957 if (pam_code
!= PAM_SUCCESS
)
964 pam_end(handle
, pam_code
| flags
);
968 barrier_set_role(&barrier
, BARRIER_PARENT
);
970 /* If the child was forked off successfully it will do all the
971 * cleanups, so forget about the handle here. */
974 /* Unblock SIGTERM again in the parent */
975 assert_se(sigprocmask(SIG_SETMASK
, &old_ss
, NULL
) >= 0);
977 /* We close the log explicitly here, since the PAM modules
978 * might have opened it, but we don't want this fd around. */
981 /* Synchronously wait for the child to initialize. We don't care for
982 * errors as we cannot recover. However, warn loudly if it happens. */
983 if (!barrier_place_and_sync(&barrier
))
984 log_error("PAM initialization failed");
992 if (pam_code
!= PAM_SUCCESS
) {
993 log_error("PAM failed: %s", pam_strerror(handle
, pam_code
));
994 r
= -EPERM
; /* PAM errors do not map to errno */
996 log_error_errno(r
, "PAM failed: %m");
1000 pam_code
= pam_close_session(handle
, flags
);
1002 pam_end(handle
, pam_code
| flags
);
1012 static void rename_process_from_path(const char *path
) {
1013 char process_name
[11];
1017 /* This resulting string must fit in 10 chars (i.e. the length
1018 * of "/sbin/init") to look pretty in /bin/ps */
1022 rename_process("(...)");
1028 /* The end of the process name is usually more
1029 * interesting, since the first bit might just be
1035 process_name
[0] = '(';
1036 memcpy(process_name
+1, p
, l
);
1037 process_name
[1+l
] = ')';
1038 process_name
[1+l
+1] = 0;
1040 rename_process(process_name
);
1045 static int apply_seccomp(const ExecContext
*c
) {
1046 uint32_t negative_action
, action
;
1047 scmp_filter_ctx
*seccomp
;
1054 negative_action
= c
->syscall_errno
== 0 ? SCMP_ACT_KILL
: SCMP_ACT_ERRNO(c
->syscall_errno
);
1056 seccomp
= seccomp_init(c
->syscall_whitelist
? negative_action
: SCMP_ACT_ALLOW
);
1060 if (c
->syscall_archs
) {
1062 SET_FOREACH(id
, c
->syscall_archs
, i
) {
1063 r
= seccomp_arch_add(seccomp
, PTR_TO_UINT32(id
) - 1);
1071 r
= seccomp_add_secondary_archs(seccomp
);
1076 action
= c
->syscall_whitelist
? SCMP_ACT_ALLOW
: negative_action
;
1077 SET_FOREACH(id
, c
->syscall_filter
, i
) {
1078 r
= seccomp_rule_add(seccomp
, action
, PTR_TO_INT(id
) - 1, 0);
1083 r
= seccomp_attr_set(seccomp
, SCMP_FLTATR_CTL_NNP
, 0);
1087 r
= seccomp_load(seccomp
);
1090 seccomp_release(seccomp
);
1094 static int apply_address_families(const ExecContext
*c
) {
1095 scmp_filter_ctx
*seccomp
;
1101 seccomp
= seccomp_init(SCMP_ACT_ALLOW
);
1105 r
= seccomp_add_secondary_archs(seccomp
);
1109 if (c
->address_families_whitelist
) {
1110 int af
, first
= 0, last
= 0;
1113 /* If this is a whitelist, we first block the address
1114 * families that are out of range and then everything
1115 * that is not in the set. First, we find the lowest
1116 * and highest address family in the set. */
1118 SET_FOREACH(afp
, c
->address_families
, i
) {
1119 af
= PTR_TO_INT(afp
);
1121 if (af
<= 0 || af
>= af_max())
1124 if (first
== 0 || af
< first
)
1127 if (last
== 0 || af
> last
)
1131 assert((first
== 0) == (last
== 0));
1135 /* No entries in the valid range, block everything */
1136 r
= seccomp_rule_add(
1138 SCMP_ACT_ERRNO(EPROTONOSUPPORT
),
1146 /* Block everything below the first entry */
1147 r
= seccomp_rule_add(
1149 SCMP_ACT_ERRNO(EPROTONOSUPPORT
),
1152 SCMP_A0(SCMP_CMP_LT
, first
));
1156 /* Block everything above the last entry */
1157 r
= seccomp_rule_add(
1159 SCMP_ACT_ERRNO(EPROTONOSUPPORT
),
1162 SCMP_A0(SCMP_CMP_GT
, last
));
1166 /* Block everything between the first and last
1168 for (af
= 1; af
< af_max(); af
++) {
1170 if (set_contains(c
->address_families
, INT_TO_PTR(af
)))
1173 r
= seccomp_rule_add(
1175 SCMP_ACT_ERRNO(EPROTONOSUPPORT
),
1178 SCMP_A0(SCMP_CMP_EQ
, af
));
1187 /* If this is a blacklist, then generate one rule for
1188 * each address family that are then combined in OR
1191 SET_FOREACH(af
, c
->address_families
, i
) {
1193 r
= seccomp_rule_add(
1195 SCMP_ACT_ERRNO(EPROTONOSUPPORT
),
1198 SCMP_A0(SCMP_CMP_EQ
, PTR_TO_INT(af
)));
1204 r
= seccomp_attr_set(seccomp
, SCMP_FLTATR_CTL_NNP
, 0);
1208 r
= seccomp_load(seccomp
);
1211 seccomp_release(seccomp
);
1217 static void do_idle_pipe_dance(int idle_pipe
[4]) {
1221 idle_pipe
[1] = safe_close(idle_pipe
[1]);
1222 idle_pipe
[2] = safe_close(idle_pipe
[2]);
1224 if (idle_pipe
[0] >= 0) {
1227 r
= fd_wait_for_event(idle_pipe
[0], POLLHUP
, IDLE_TIMEOUT_USEC
);
1229 if (idle_pipe
[3] >= 0 && r
== 0 /* timeout */) {
1232 /* Signal systemd that we are bored and want to continue. */
1233 n
= write(idle_pipe
[3], "x", 1);
1235 /* Wait for systemd to react to the signal above. */
1236 fd_wait_for_event(idle_pipe
[0], POLLHUP
, IDLE_TIMEOUT2_USEC
);
1239 idle_pipe
[0] = safe_close(idle_pipe
[0]);
1243 idle_pipe
[3] = safe_close(idle_pipe
[3]);
1246 static int build_environment(
1247 const ExecContext
*c
,
1248 const ExecParameters
*p
,
1251 const char *username
,
1255 _cleanup_strv_free_
char **our_env
= NULL
;
1262 our_env
= new0(char*, 11);
1267 _cleanup_free_
char *joined
= NULL
;
1269 if (asprintf(&x
, "LISTEN_PID="PID_FMT
, getpid()) < 0)
1271 our_env
[n_env
++] = x
;
1273 if (asprintf(&x
, "LISTEN_FDS=%u", n_fds
) < 0)
1275 our_env
[n_env
++] = x
;
1277 joined
= strv_join(p
->fd_names
, ":");
1281 x
= strjoin("LISTEN_FDNAMES=", joined
, NULL
);
1284 our_env
[n_env
++] = x
;
1287 if (p
->watchdog_usec
> 0) {
1288 if (asprintf(&x
, "WATCHDOG_PID="PID_FMT
, getpid()) < 0)
1290 our_env
[n_env
++] = x
;
1292 if (asprintf(&x
, "WATCHDOG_USEC="USEC_FMT
, p
->watchdog_usec
) < 0)
1294 our_env
[n_env
++] = x
;
1298 x
= strappend("HOME=", home
);
1301 our_env
[n_env
++] = x
;
1305 x
= strappend("LOGNAME=", username
);
1308 our_env
[n_env
++] = x
;
1310 x
= strappend("USER=", username
);
1313 our_env
[n_env
++] = x
;
1317 x
= strappend("SHELL=", shell
);
1320 our_env
[n_env
++] = x
;
1323 if (is_terminal_input(c
->std_input
) ||
1324 c
->std_output
== EXEC_OUTPUT_TTY
||
1325 c
->std_error
== EXEC_OUTPUT_TTY
||
1328 x
= strdup(default_term_for_tty(exec_context_tty_path(c
)));
1331 our_env
[n_env
++] = x
;
1334 our_env
[n_env
++] = NULL
;
1335 assert(n_env
<= 11);
1343 static int build_pass_environment(const ExecContext
*c
, char ***ret
) {
1344 _cleanup_strv_free_
char **pass_env
= NULL
;
1345 size_t n_env
= 0, n_bufsize
= 0;
1348 STRV_FOREACH(i
, c
->pass_environment
) {
1349 _cleanup_free_
char *x
= NULL
;
1355 x
= strjoin(*i
, "=", v
, NULL
);
1358 if (!GREEDY_REALLOC(pass_env
, n_bufsize
, n_env
+ 2))
1360 pass_env
[n_env
++] = x
;
1361 pass_env
[n_env
] = NULL
;
1371 static bool exec_needs_mount_namespace(
1372 const ExecContext
*context
,
1373 const ExecParameters
*params
,
1374 ExecRuntime
*runtime
) {
1379 if (!strv_isempty(context
->read_write_dirs
) ||
1380 !strv_isempty(context
->read_only_dirs
) ||
1381 !strv_isempty(context
->inaccessible_dirs
))
1384 if (context
->mount_flags
!= 0)
1387 if (context
->private_tmp
&& runtime
&& (runtime
->tmp_dir
|| runtime
->var_tmp_dir
))
1390 if (params
->bus_endpoint_path
)
1393 if (context
->private_devices
||
1394 context
->protect_system
!= PROTECT_SYSTEM_NO
||
1395 context
->protect_home
!= PROTECT_HOME_NO
)
1401 static int close_remaining_fds(
1402 const ExecParameters
*params
,
1403 ExecRuntime
*runtime
,
1405 int *fds
, unsigned n_fds
) {
1407 unsigned n_dont_close
= 0;
1408 int dont_close
[n_fds
+ 7];
1412 if (params
->stdin_fd
>= 0)
1413 dont_close
[n_dont_close
++] = params
->stdin_fd
;
1414 if (params
->stdout_fd
>= 0)
1415 dont_close
[n_dont_close
++] = params
->stdout_fd
;
1416 if (params
->stderr_fd
>= 0)
1417 dont_close
[n_dont_close
++] = params
->stderr_fd
;
1420 dont_close
[n_dont_close
++] = socket_fd
;
1422 memcpy(dont_close
+ n_dont_close
, fds
, sizeof(int) * n_fds
);
1423 n_dont_close
+= n_fds
;
1426 if (params
->bus_endpoint_fd
>= 0)
1427 dont_close
[n_dont_close
++] = params
->bus_endpoint_fd
;
1430 if (runtime
->netns_storage_socket
[0] >= 0)
1431 dont_close
[n_dont_close
++] = runtime
->netns_storage_socket
[0];
1432 if (runtime
->netns_storage_socket
[1] >= 0)
1433 dont_close
[n_dont_close
++] = runtime
->netns_storage_socket
[1];
1436 return close_all_fds(dont_close
, n_dont_close
);
1439 static int exec_child(
1441 ExecCommand
*command
,
1442 const ExecContext
*context
,
1443 const ExecParameters
*params
,
1444 ExecRuntime
*runtime
,
1447 int *fds
, unsigned n_fds
,
1451 _cleanup_strv_free_
char **our_env
= NULL
, **pass_env
= NULL
, **pam_env
= NULL
, **final_env
= NULL
, **final_argv
= NULL
;
1452 _cleanup_free_
char *mac_selinux_context_net
= NULL
;
1453 const char *username
= NULL
, *home
= NULL
, *shell
= NULL
, *wd
;
1454 uid_t uid
= UID_INVALID
;
1455 gid_t gid
= GID_INVALID
;
1457 bool needs_mount_namespace
;
1463 assert(exit_status
);
1465 rename_process_from_path(command
->path
);
1467 /* We reset exactly these signals, since they are the
1468 * only ones we set to SIG_IGN in the main daemon. All
1469 * others we leave untouched because we set them to
1470 * SIG_DFL or a valid handler initially, both of which
1471 * will be demoted to SIG_DFL. */
1472 (void) default_signals(SIGNALS_CRASH_HANDLER
,
1473 SIGNALS_IGNORE
, -1);
1475 if (context
->ignore_sigpipe
)
1476 (void) ignore_signals(SIGPIPE
, -1);
1478 r
= reset_signal_mask();
1480 *exit_status
= EXIT_SIGNAL_MASK
;
1484 if (params
->idle_pipe
)
1485 do_idle_pipe_dance(params
->idle_pipe
);
1487 /* Close sockets very early to make sure we don't
1488 * block init reexecution because it cannot bind its
1493 r
= close_remaining_fds(params
, runtime
, socket_fd
, fds
, n_fds
);
1495 *exit_status
= EXIT_FDS
;
1499 if (!context
->same_pgrp
)
1501 *exit_status
= EXIT_SETSID
;
1505 exec_context_tty_reset(context
, params
);
1507 if (params
->confirm_spawn
) {
1510 r
= ask_for_confirmation(&response
, argv
);
1511 if (r
== -ETIMEDOUT
)
1512 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1514 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-r
));
1515 else if (response
== 's') {
1516 write_confirm_message("Skipping execution.\n");
1517 *exit_status
= EXIT_CONFIRM
;
1519 } else if (response
== 'n') {
1520 write_confirm_message("Failing execution.\n");
1526 if (context
->user
) {
1527 username
= context
->user
;
1528 r
= get_user_creds(&username
, &uid
, &gid
, &home
, &shell
);
1530 *exit_status
= EXIT_USER
;
1535 if (context
->group
) {
1536 const char *g
= context
->group
;
1538 r
= get_group_creds(&g
, &gid
);
1540 *exit_status
= EXIT_GROUP
;
1546 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1547 * must sure to drop O_NONBLOCK */
1549 (void) fd_nonblock(socket_fd
, false);
1551 r
= setup_input(context
, params
, socket_fd
);
1553 *exit_status
= EXIT_STDIN
;
1557 r
= setup_output(unit
, context
, params
, STDOUT_FILENO
, socket_fd
, basename(command
->path
), uid
, gid
);
1559 *exit_status
= EXIT_STDOUT
;
1563 r
= setup_output(unit
, context
, params
, STDERR_FILENO
, socket_fd
, basename(command
->path
), uid
, gid
);
1565 *exit_status
= EXIT_STDERR
;
1569 if (params
->cgroup_path
) {
1570 r
= cg_attach_everywhere(params
->cgroup_supported
, params
->cgroup_path
, 0, NULL
, NULL
);
1572 *exit_status
= EXIT_CGROUP
;
1577 if (context
->oom_score_adjust_set
) {
1578 char t
[DECIMAL_STR_MAX(context
->oom_score_adjust
)];
1580 /* When we can't make this change due to EPERM, then
1581 * let's silently skip over it. User namespaces
1582 * prohibit write access to this file, and we
1583 * shouldn't trip up over that. */
1585 sprintf(t
, "%i", context
->oom_score_adjust
);
1586 r
= write_string_file("/proc/self/oom_score_adj", t
, 0);
1587 if (r
== -EPERM
|| r
== -EACCES
) {
1589 log_unit_debug_errno(unit
, r
, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
1592 *exit_status
= EXIT_OOM_ADJUST
;
1597 if (context
->nice_set
)
1598 if (setpriority(PRIO_PROCESS
, 0, context
->nice
) < 0) {
1599 *exit_status
= EXIT_NICE
;
1603 if (context
->cpu_sched_set
) {
1604 struct sched_param param
= {
1605 .sched_priority
= context
->cpu_sched_priority
,
1608 r
= sched_setscheduler(0,
1609 context
->cpu_sched_policy
|
1610 (context
->cpu_sched_reset_on_fork
?
1611 SCHED_RESET_ON_FORK
: 0),
1614 *exit_status
= EXIT_SETSCHEDULER
;
1619 if (context
->cpuset
)
1620 if (sched_setaffinity(0, CPU_ALLOC_SIZE(context
->cpuset_ncpus
), context
->cpuset
) < 0) {
1621 *exit_status
= EXIT_CPUAFFINITY
;
1625 if (context
->ioprio_set
)
1626 if (ioprio_set(IOPRIO_WHO_PROCESS
, 0, context
->ioprio
) < 0) {
1627 *exit_status
= EXIT_IOPRIO
;
1631 if (context
->timer_slack_nsec
!= NSEC_INFINITY
)
1632 if (prctl(PR_SET_TIMERSLACK
, context
->timer_slack_nsec
) < 0) {
1633 *exit_status
= EXIT_TIMERSLACK
;
1637 if (context
->personality
!= PERSONALITY_INVALID
)
1638 if (personality(context
->personality
) < 0) {
1639 *exit_status
= EXIT_PERSONALITY
;
1643 if (context
->utmp_id
)
1644 utmp_put_init_process(context
->utmp_id
, getpid(), getsid(0), context
->tty_path
,
1645 context
->utmp_mode
== EXEC_UTMP_INIT
? INIT_PROCESS
:
1646 context
->utmp_mode
== EXEC_UTMP_LOGIN
? LOGIN_PROCESS
:
1648 username
? "root" : context
->user
);
1650 if (context
->user
&& is_terminal_input(context
->std_input
)) {
1651 r
= chown_terminal(STDIN_FILENO
, uid
);
1653 *exit_status
= EXIT_STDIN
;
1658 if (params
->bus_endpoint_fd
>= 0 && context
->bus_endpoint
) {
1659 uid_t ep_uid
= (uid
== UID_INVALID
) ? 0 : uid
;
1661 r
= bus_kernel_set_endpoint_policy(params
->bus_endpoint_fd
, ep_uid
, context
->bus_endpoint
);
1663 *exit_status
= EXIT_BUS_ENDPOINT
;
1668 /* If delegation is enabled we'll pass ownership of the cgroup
1669 * (but only in systemd's own controller hierarchy!) to the
1670 * user of the new process. */
1671 if (params
->cgroup_path
&& context
->user
&& params
->cgroup_delegate
) {
1672 r
= cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER
, params
->cgroup_path
, 0644, uid
, gid
);
1674 *exit_status
= EXIT_CGROUP
;
1679 r
= cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER
, params
->cgroup_path
, 0755, uid
, gid
);
1681 *exit_status
= EXIT_CGROUP
;
1686 if (!strv_isempty(context
->runtime_directory
) && params
->runtime_prefix
) {
1689 STRV_FOREACH(rt
, context
->runtime_directory
) {
1690 _cleanup_free_
char *p
;
1692 p
= strjoin(params
->runtime_prefix
, "/", *rt
, NULL
);
1694 *exit_status
= EXIT_RUNTIME_DIRECTORY
;
1698 r
= mkdir_p_label(p
, context
->runtime_directory_mode
);
1700 *exit_status
= EXIT_RUNTIME_DIRECTORY
;
1704 r
= chmod_and_chown(p
, context
->runtime_directory_mode
, uid
, gid
);
1706 *exit_status
= EXIT_RUNTIME_DIRECTORY
;
1712 umask(context
->umask
);
1714 if (params
->apply_permissions
) {
1715 r
= enforce_groups(context
, username
, gid
);
1717 *exit_status
= EXIT_GROUP
;
1721 if (context
->smack_process_label
) {
1722 r
= mac_smack_apply_pid(0, context
->smack_process_label
);
1724 *exit_status
= EXIT_SMACK_PROCESS_LABEL
;
1728 #ifdef SMACK_DEFAULT_PROCESS_LABEL
1730 _cleanup_free_
char *exec_label
= NULL
;
1732 r
= mac_smack_read(command
->path
, SMACK_ATTR_EXEC
, &exec_label
);
1733 if (r
< 0 && r
!= -ENODATA
&& r
!= -EOPNOTSUPP
) {
1734 *exit_status
= EXIT_SMACK_PROCESS_LABEL
;
1738 r
= mac_smack_apply_pid(0, exec_label
? : SMACK_DEFAULT_PROCESS_LABEL
);
1740 *exit_status
= EXIT_SMACK_PROCESS_LABEL
;
1747 if (context
->pam_name
&& username
) {
1748 r
= setup_pam(context
->pam_name
, username
, uid
, context
->tty_path
, &pam_env
, fds
, n_fds
);
1750 *exit_status
= EXIT_PAM
;
1757 if (context
->private_network
&& runtime
&& runtime
->netns_storage_socket
[0] >= 0) {
1758 r
= setup_netns(runtime
->netns_storage_socket
);
1760 *exit_status
= EXIT_NETWORK
;
1765 needs_mount_namespace
= exec_needs_mount_namespace(context
, params
, runtime
);
1767 if (needs_mount_namespace
) {
1768 char *tmp
= NULL
, *var
= NULL
;
1770 /* The runtime struct only contains the parent
1771 * of the private /tmp, which is
1772 * non-accessible to world users. Inside of it
1773 * there's a /tmp that is sticky, and that's
1774 * the one we want to use here. */
1776 if (context
->private_tmp
&& runtime
) {
1777 if (runtime
->tmp_dir
)
1778 tmp
= strjoina(runtime
->tmp_dir
, "/tmp");
1779 if (runtime
->var_tmp_dir
)
1780 var
= strjoina(runtime
->var_tmp_dir
, "/tmp");
1783 r
= setup_namespace(
1784 params
->apply_chroot
? context
->root_directory
: NULL
,
1785 context
->read_write_dirs
,
1786 context
->read_only_dirs
,
1787 context
->inaccessible_dirs
,
1790 params
->bus_endpoint_path
,
1791 context
->private_devices
,
1792 context
->protect_home
,
1793 context
->protect_system
,
1794 context
->mount_flags
);
1796 /* If we couldn't set up the namespace this is
1797 * probably due to a missing capability. In this case,
1798 * silently proceeed. */
1799 if (r
== -EPERM
|| r
== -EACCES
) {
1801 log_unit_debug_errno(unit
, r
, "Failed to set up namespace, assuming containerized execution, ignoring: %m");
1804 *exit_status
= EXIT_NAMESPACE
;
1809 if (context
->working_directory_home
)
1811 else if (context
->working_directory
)
1812 wd
= context
->working_directory
;
1816 if (params
->apply_chroot
) {
1817 if (!needs_mount_namespace
&& context
->root_directory
)
1818 if (chroot(context
->root_directory
) < 0) {
1819 *exit_status
= EXIT_CHROOT
;
1823 if (chdir(wd
) < 0 &&
1824 !context
->working_directory_missing_ok
) {
1825 *exit_status
= EXIT_CHDIR
;
1831 d
= strjoina(strempty(context
->root_directory
), "/", strempty(wd
));
1833 !context
->working_directory_missing_ok
) {
1834 *exit_status
= EXIT_CHDIR
;
1840 if (params
->apply_permissions
&& mac_selinux_use() && params
->selinux_context_net
&& socket_fd
>= 0) {
1841 r
= mac_selinux_get_child_mls_label(socket_fd
, command
->path
, context
->selinux_context
, &mac_selinux_context_net
);
1843 *exit_status
= EXIT_SELINUX_CONTEXT
;
1849 /* We repeat the fd closing here, to make sure that
1850 * nothing is leaked from the PAM modules. Note that
1851 * we are more aggressive this time since socket_fd
1852 * and the netns fds we don't need anymore. The custom
1853 * endpoint fd was needed to upload the policy and can
1854 * now be closed as well. */
1855 r
= close_all_fds(fds
, n_fds
);
1857 r
= shift_fds(fds
, n_fds
);
1859 r
= flags_fds(fds
, n_fds
, context
->non_blocking
);
1861 *exit_status
= EXIT_FDS
;
1865 if (params
->apply_permissions
) {
1867 int secure_bits
= context
->secure_bits
;
1869 for (i
= 0; i
< _RLIMIT_MAX
; i
++) {
1870 if (!context
->rlimit
[i
])
1873 if (setrlimit_closest(i
, context
->rlimit
[i
]) < 0) {
1874 *exit_status
= EXIT_LIMITS
;
1879 if (!cap_test_all(context
->capability_bounding_set
)) {
1880 r
= capability_bounding_set_drop(context
->capability_bounding_set
, false);
1882 *exit_status
= EXIT_CAPABILITIES
;
1887 /* This is done before enforce_user, but ambient set
1888 * does not survive over setresuid() if keep_caps is not set. */
1889 if (context
->capability_ambient_set
!= 0) {
1890 r
= capability_ambient_set_apply(context
->capability_ambient_set
, true);
1892 *exit_status
= EXIT_CAPABILITIES
;
1896 if (context
->capabilities
) {
1898 /* The capabilities in ambient set need to be also in the inherited
1899 * set. If they aren't, trying to get them will fail. Add the ambient
1900 * set inherited capabilities to the capability set in the context.
1901 * This is needed because if capabilities are set (using "Capabilities="
1902 * keyword), they will override whatever we set now. */
1904 r
= capability_update_inherited_set(context
->capabilities
, context
->capability_ambient_set
);
1906 *exit_status
= EXIT_CAPABILITIES
;
1912 if (context
->user
) {
1913 r
= enforce_user(context
, uid
);
1915 *exit_status
= EXIT_USER
;
1918 if (context
->capability_ambient_set
!= 0) {
1920 /* Fix the ambient capabilities after user change. */
1921 r
= capability_ambient_set_apply(context
->capability_ambient_set
, false);
1923 *exit_status
= EXIT_CAPABILITIES
;
1927 /* If we were asked to change user and ambient capabilities
1928 * were requested, we had to add keep-caps to the securebits
1929 * so that we would maintain the inherited capability set
1930 * through the setresuid(). Make sure that the bit is added
1931 * also to the context secure_bits so that we don't try to
1932 * drop the bit away next. */
1934 secure_bits
|= 1<<SECURE_KEEP_CAPS
;
1938 /* PR_GET_SECUREBITS is not privileged, while
1939 * PR_SET_SECUREBITS is. So to suppress
1940 * potential EPERMs we'll try not to call
1941 * PR_SET_SECUREBITS unless necessary. */
1942 if (prctl(PR_GET_SECUREBITS
) != secure_bits
)
1943 if (prctl(PR_SET_SECUREBITS
, secure_bits
) < 0) {
1944 *exit_status
= EXIT_SECUREBITS
;
1948 if (context
->capabilities
)
1949 if (cap_set_proc(context
->capabilities
) < 0) {
1950 *exit_status
= EXIT_CAPABILITIES
;
1954 if (context
->no_new_privileges
)
1955 if (prctl(PR_SET_NO_NEW_PRIVS
, 1, 0, 0, 0) < 0) {
1956 *exit_status
= EXIT_NO_NEW_PRIVILEGES
;
1961 if (context
->address_families_whitelist
||
1962 !set_isempty(context
->address_families
)) {
1963 r
= apply_address_families(context
);
1965 *exit_status
= EXIT_ADDRESS_FAMILIES
;
1970 if (context
->syscall_whitelist
||
1971 !set_isempty(context
->syscall_filter
) ||
1972 !set_isempty(context
->syscall_archs
)) {
1973 r
= apply_seccomp(context
);
1975 *exit_status
= EXIT_SECCOMP
;
1982 if (mac_selinux_use()) {
1983 char *exec_context
= mac_selinux_context_net
?: context
->selinux_context
;
1986 r
= setexeccon(exec_context
);
1988 *exit_status
= EXIT_SELINUX_CONTEXT
;
1995 #ifdef HAVE_APPARMOR
1996 if (context
->apparmor_profile
&& mac_apparmor_use()) {
1997 r
= aa_change_onexec(context
->apparmor_profile
);
1998 if (r
< 0 && !context
->apparmor_profile_ignore
) {
1999 *exit_status
= EXIT_APPARMOR_PROFILE
;
2006 r
= build_environment(context
, params
, n_fds
, home
, username
, shell
, &our_env
);
2008 *exit_status
= EXIT_MEMORY
;
2012 r
= build_pass_environment(context
, &pass_env
);
2014 *exit_status
= EXIT_MEMORY
;
2018 final_env
= strv_env_merge(6,
2019 params
->environment
,
2022 context
->environment
,
2027 *exit_status
= EXIT_MEMORY
;
2031 final_argv
= replace_env_argv(argv
, final_env
);
2033 *exit_status
= EXIT_MEMORY
;
2037 final_env
= strv_env_clean(final_env
);
2039 if (_unlikely_(log_get_max_level() >= LOG_DEBUG
)) {
2040 _cleanup_free_
char *line
;
2042 line
= exec_command_line(final_argv
);
2045 log_struct(LOG_DEBUG
,
2047 "EXECUTABLE=%s", command
->path
,
2048 LOG_UNIT_MESSAGE(unit
, "Executing: %s", line
),
2054 execve(command
->path
, final_argv
, final_env
);
2055 *exit_status
= EXIT_EXEC
;
2059 int exec_spawn(Unit
*unit
,
2060 ExecCommand
*command
,
2061 const ExecContext
*context
,
2062 const ExecParameters
*params
,
2063 ExecRuntime
*runtime
,
2066 _cleanup_strv_free_
char **files_env
= NULL
;
2067 int *fds
= NULL
; unsigned n_fds
= 0;
2068 _cleanup_free_
char *line
= NULL
;
2078 assert(params
->fds
|| params
->n_fds
<= 0);
2080 if (context
->std_input
== EXEC_INPUT_SOCKET
||
2081 context
->std_output
== EXEC_OUTPUT_SOCKET
||
2082 context
->std_error
== EXEC_OUTPUT_SOCKET
) {
2084 if (params
->n_fds
!= 1) {
2085 log_unit_error(unit
, "Got more than one socket.");
2089 socket_fd
= params
->fds
[0];
2093 n_fds
= params
->n_fds
;
2096 r
= exec_context_load_environment(unit
, context
, &files_env
);
2098 return log_unit_error_errno(unit
, r
, "Failed to load environment files: %m");
2100 argv
= params
->argv
?: command
->argv
;
2101 line
= exec_command_line(argv
);
2105 log_struct(LOG_DEBUG
,
2107 LOG_UNIT_MESSAGE(unit
, "About to execute: %s", line
),
2108 "EXECUTABLE=%s", command
->path
,
2112 return log_unit_error_errno(unit
, errno
, "Failed to fork: %m");
2117 r
= exec_child(unit
,
2129 log_struct_errno(LOG_ERR
, r
,
2130 LOG_MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED
),
2132 LOG_UNIT_MESSAGE(unit
, "Failed at step %s spawning %s: %m",
2133 exit_status_to_string(exit_status
, EXIT_STATUS_SYSTEMD
),
2135 "EXECUTABLE=%s", command
->path
,
2142 log_unit_debug(unit
, "Forked %s as "PID_FMT
, command
->path
, pid
);
2144 /* We add the new process to the cgroup both in the child (so
2145 * that we can be sure that no user code is ever executed
2146 * outside of the cgroup) and in the parent (so that we can be
2147 * sure that when we kill the cgroup the process will be
2149 if (params
->cgroup_path
)
2150 (void) cg_attach(SYSTEMD_CGROUP_CONTROLLER
, params
->cgroup_path
, pid
);
2152 exec_status_start(&command
->exec_status
, pid
);
2158 void exec_context_init(ExecContext
*c
) {
2162 c
->ioprio
= IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE
, 0);
2163 c
->cpu_sched_policy
= SCHED_OTHER
;
2164 c
->syslog_priority
= LOG_DAEMON
|LOG_INFO
;
2165 c
->syslog_level_prefix
= true;
2166 c
->ignore_sigpipe
= true;
2167 c
->timer_slack_nsec
= NSEC_INFINITY
;
2168 c
->personality
= PERSONALITY_INVALID
;
2169 c
->runtime_directory_mode
= 0755;
2170 c
->capability_bounding_set
= CAP_ALL
;
2173 void exec_context_done(ExecContext
*c
) {
2178 c
->environment
= strv_free(c
->environment
);
2179 c
->environment_files
= strv_free(c
->environment_files
);
2180 c
->pass_environment
= strv_free(c
->pass_environment
);
2182 for (l
= 0; l
< ELEMENTSOF(c
->rlimit
); l
++)
2183 c
->rlimit
[l
] = mfree(c
->rlimit
[l
]);
2185 c
->working_directory
= mfree(c
->working_directory
);
2186 c
->root_directory
= mfree(c
->root_directory
);
2187 c
->tty_path
= mfree(c
->tty_path
);
2188 c
->syslog_identifier
= mfree(c
->syslog_identifier
);
2189 c
->user
= mfree(c
->user
);
2190 c
->group
= mfree(c
->group
);
2192 c
->supplementary_groups
= strv_free(c
->supplementary_groups
);
2194 c
->pam_name
= mfree(c
->pam_name
);
2196 if (c
->capabilities
) {
2197 cap_free(c
->capabilities
);
2198 c
->capabilities
= NULL
;
2201 c
->read_only_dirs
= strv_free(c
->read_only_dirs
);
2202 c
->read_write_dirs
= strv_free(c
->read_write_dirs
);
2203 c
->inaccessible_dirs
= strv_free(c
->inaccessible_dirs
);
2206 CPU_FREE(c
->cpuset
);
2208 c
->utmp_id
= mfree(c
->utmp_id
);
2209 c
->selinux_context
= mfree(c
->selinux_context
);
2210 c
->apparmor_profile
= mfree(c
->apparmor_profile
);
2212 c
->syscall_filter
= set_free(c
->syscall_filter
);
2213 c
->syscall_archs
= set_free(c
->syscall_archs
);
2214 c
->address_families
= set_free(c
->address_families
);
2216 c
->runtime_directory
= strv_free(c
->runtime_directory
);
2218 bus_endpoint_free(c
->bus_endpoint
);
2219 c
->bus_endpoint
= NULL
;
2222 int exec_context_destroy_runtime_directory(ExecContext
*c
, const char *runtime_prefix
) {
2227 if (!runtime_prefix
)
2230 STRV_FOREACH(i
, c
->runtime_directory
) {
2231 _cleanup_free_
char *p
;
2233 p
= strjoin(runtime_prefix
, "/", *i
, NULL
);
2237 /* We execute this synchronously, since we need to be
2238 * sure this is gone when we start the service
2240 (void) rm_rf(p
, REMOVE_ROOT
);
2246 void exec_command_done(ExecCommand
*c
) {
2249 c
->path
= mfree(c
->path
);
2251 c
->argv
= strv_free(c
->argv
);
2254 void exec_command_done_array(ExecCommand
*c
, unsigned n
) {
2257 for (i
= 0; i
< n
; i
++)
2258 exec_command_done(c
+i
);
2261 ExecCommand
* exec_command_free_list(ExecCommand
*c
) {
2265 LIST_REMOVE(command
, c
, i
);
2266 exec_command_done(i
);
2273 void exec_command_free_array(ExecCommand
**c
, unsigned n
) {
2276 for (i
= 0; i
< n
; i
++)
2277 c
[i
] = exec_command_free_list(c
[i
]);
2280 typedef struct InvalidEnvInfo
{
2285 static void invalid_env(const char *p
, void *userdata
) {
2286 InvalidEnvInfo
*info
= userdata
;
2288 log_unit_error(info
->unit
, "Ignoring invalid environment assignment '%s': %s", p
, info
->path
);
2291 int exec_context_load_environment(Unit
*unit
, const ExecContext
*c
, char ***l
) {
2292 char **i
, **r
= NULL
;
2297 STRV_FOREACH(i
, c
->environment_files
) {
2300 bool ignore
= false;
2302 _cleanup_globfree_ glob_t pglob
= {};
2312 if (!path_is_absolute(fn
)) {
2320 /* Filename supports globbing, take all matching files */
2322 if (glob(fn
, 0, NULL
, &pglob
) != 0) {
2327 return errno
> 0 ? -errno
: -EINVAL
;
2329 count
= pglob
.gl_pathc
;
2337 for (n
= 0; n
< count
; n
++) {
2338 k
= load_env_file(NULL
, pglob
.gl_pathv
[n
], NULL
, &p
);
2346 /* Log invalid environment variables with filename */
2348 InvalidEnvInfo info
= {
2350 .path
= pglob
.gl_pathv
[n
]
2353 p
= strv_env_clean_with_callback(p
, invalid_env
, &info
);
2361 m
= strv_env_merge(2, r
, p
);
2377 static bool tty_may_match_dev_console(const char *tty
) {
2378 _cleanup_free_
char *active
= NULL
;
2384 if (startswith(tty
, "/dev/"))
2387 /* trivial identity? */
2388 if (streq(tty
, "console"))
2391 console
= resolve_dev_console(&active
);
2392 /* if we could not resolve, assume it may */
2396 /* "tty0" means the active VC, so it may be the same sometimes */
2397 return streq(console
, tty
) || (streq(console
, "tty0") && tty_is_vc(tty
));
2400 bool exec_context_may_touch_console(ExecContext
*ec
) {
2402 return (ec
->tty_reset
||
2404 ec
->tty_vt_disallocate
||
2405 is_terminal_input(ec
->std_input
) ||
2406 is_terminal_output(ec
->std_output
) ||
2407 is_terminal_output(ec
->std_error
)) &&
2408 tty_may_match_dev_console(exec_context_tty_path(ec
));
2411 static void strv_fprintf(FILE *f
, char **l
) {
2417 fprintf(f
, " %s", *g
);
2420 void exec_context_dump(ExecContext
*c
, FILE* f
, const char *prefix
) {
2427 prefix
= strempty(prefix
);
2431 "%sWorkingDirectory: %s\n"
2432 "%sRootDirectory: %s\n"
2433 "%sNonBlocking: %s\n"
2434 "%sPrivateTmp: %s\n"
2435 "%sPrivateNetwork: %s\n"
2436 "%sPrivateDevices: %s\n"
2437 "%sProtectHome: %s\n"
2438 "%sProtectSystem: %s\n"
2439 "%sIgnoreSIGPIPE: %s\n",
2441 prefix
, c
->working_directory
? c
->working_directory
: "/",
2442 prefix
, c
->root_directory
? c
->root_directory
: "/",
2443 prefix
, yes_no(c
->non_blocking
),
2444 prefix
, yes_no(c
->private_tmp
),
2445 prefix
, yes_no(c
->private_network
),
2446 prefix
, yes_no(c
->private_devices
),
2447 prefix
, protect_home_to_string(c
->protect_home
),
2448 prefix
, protect_system_to_string(c
->protect_system
),
2449 prefix
, yes_no(c
->ignore_sigpipe
));
2451 STRV_FOREACH(e
, c
->environment
)
2452 fprintf(f
, "%sEnvironment: %s\n", prefix
, *e
);
2454 STRV_FOREACH(e
, c
->environment_files
)
2455 fprintf(f
, "%sEnvironmentFile: %s\n", prefix
, *e
);
2457 STRV_FOREACH(e
, c
->pass_environment
)
2458 fprintf(f
, "%sPassEnvironment: %s\n", prefix
, *e
);
2460 fprintf(f
, "%sRuntimeDirectoryMode: %04o\n", prefix
, c
->runtime_directory_mode
);
2462 STRV_FOREACH(d
, c
->runtime_directory
)
2463 fprintf(f
, "%sRuntimeDirectory: %s\n", prefix
, *d
);
2470 if (c
->oom_score_adjust_set
)
2472 "%sOOMScoreAdjust: %i\n",
2473 prefix
, c
->oom_score_adjust
);
2475 for (i
= 0; i
< RLIM_NLIMITS
; i
++)
2477 fprintf(f
, "%s%s: " RLIM_FMT
"\n",
2478 prefix
, rlimit_to_string(i
), c
->rlimit
[i
]->rlim_max
);
2479 fprintf(f
, "%s%sSoft: " RLIM_FMT
"\n",
2480 prefix
, rlimit_to_string(i
), c
->rlimit
[i
]->rlim_cur
);
2483 if (c
->ioprio_set
) {
2484 _cleanup_free_
char *class_str
= NULL
;
2486 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c
->ioprio
), &class_str
);
2488 "%sIOSchedulingClass: %s\n"
2489 "%sIOPriority: %i\n",
2490 prefix
, strna(class_str
),
2491 prefix
, (int) IOPRIO_PRIO_DATA(c
->ioprio
));
2494 if (c
->cpu_sched_set
) {
2495 _cleanup_free_
char *policy_str
= NULL
;
2497 sched_policy_to_string_alloc(c
->cpu_sched_policy
, &policy_str
);
2499 "%sCPUSchedulingPolicy: %s\n"
2500 "%sCPUSchedulingPriority: %i\n"
2501 "%sCPUSchedulingResetOnFork: %s\n",
2502 prefix
, strna(policy_str
),
2503 prefix
, c
->cpu_sched_priority
,
2504 prefix
, yes_no(c
->cpu_sched_reset_on_fork
));
2508 fprintf(f
, "%sCPUAffinity:", prefix
);
2509 for (i
= 0; i
< c
->cpuset_ncpus
; i
++)
2510 if (CPU_ISSET_S(i
, CPU_ALLOC_SIZE(c
->cpuset_ncpus
), c
->cpuset
))
2511 fprintf(f
, " %u", i
);
2515 if (c
->timer_slack_nsec
!= NSEC_INFINITY
)
2516 fprintf(f
, "%sTimerSlackNSec: "NSEC_FMT
"\n", prefix
, c
->timer_slack_nsec
);
2519 "%sStandardInput: %s\n"
2520 "%sStandardOutput: %s\n"
2521 "%sStandardError: %s\n",
2522 prefix
, exec_input_to_string(c
->std_input
),
2523 prefix
, exec_output_to_string(c
->std_output
),
2524 prefix
, exec_output_to_string(c
->std_error
));
2530 "%sTTYVHangup: %s\n"
2531 "%sTTYVTDisallocate: %s\n",
2532 prefix
, c
->tty_path
,
2533 prefix
, yes_no(c
->tty_reset
),
2534 prefix
, yes_no(c
->tty_vhangup
),
2535 prefix
, yes_no(c
->tty_vt_disallocate
));
2537 if (c
->std_output
== EXEC_OUTPUT_SYSLOG
||
2538 c
->std_output
== EXEC_OUTPUT_KMSG
||
2539 c
->std_output
== EXEC_OUTPUT_JOURNAL
||
2540 c
->std_output
== EXEC_OUTPUT_SYSLOG_AND_CONSOLE
||
2541 c
->std_output
== EXEC_OUTPUT_KMSG_AND_CONSOLE
||
2542 c
->std_output
== EXEC_OUTPUT_JOURNAL_AND_CONSOLE
||
2543 c
->std_error
== EXEC_OUTPUT_SYSLOG
||
2544 c
->std_error
== EXEC_OUTPUT_KMSG
||
2545 c
->std_error
== EXEC_OUTPUT_JOURNAL
||
2546 c
->std_error
== EXEC_OUTPUT_SYSLOG_AND_CONSOLE
||
2547 c
->std_error
== EXEC_OUTPUT_KMSG_AND_CONSOLE
||
2548 c
->std_error
== EXEC_OUTPUT_JOURNAL_AND_CONSOLE
) {
2550 _cleanup_free_
char *fac_str
= NULL
, *lvl_str
= NULL
;
2552 log_facility_unshifted_to_string_alloc(c
->syslog_priority
>> 3, &fac_str
);
2553 log_level_to_string_alloc(LOG_PRI(c
->syslog_priority
), &lvl_str
);
2556 "%sSyslogFacility: %s\n"
2557 "%sSyslogLevel: %s\n",
2558 prefix
, strna(fac_str
),
2559 prefix
, strna(lvl_str
));
2562 if (c
->capabilities
) {
2563 _cleanup_cap_free_charp_
char *t
;
2565 t
= cap_to_text(c
->capabilities
, NULL
);
2567 fprintf(f
, "%sCapabilities: %s\n", prefix
, t
);
2571 fprintf(f
, "%sSecure Bits:%s%s%s%s%s%s\n",
2573 (c
->secure_bits
& 1<<SECURE_KEEP_CAPS
) ? " keep-caps" : "",
2574 (c
->secure_bits
& 1<<SECURE_KEEP_CAPS_LOCKED
) ? " keep-caps-locked" : "",
2575 (c
->secure_bits
& 1<<SECURE_NO_SETUID_FIXUP
) ? " no-setuid-fixup" : "",
2576 (c
->secure_bits
& 1<<SECURE_NO_SETUID_FIXUP_LOCKED
) ? " no-setuid-fixup-locked" : "",
2577 (c
->secure_bits
& 1<<SECURE_NOROOT
) ? " noroot" : "",
2578 (c
->secure_bits
& 1<<SECURE_NOROOT_LOCKED
) ? "noroot-locked" : "");
2580 if (c
->capability_bounding_set
!= CAP_ALL
) {
2582 fprintf(f
, "%sCapabilityBoundingSet:", prefix
);
2584 for (l
= 0; l
<= cap_last_cap(); l
++)
2585 if (c
->capability_bounding_set
& (UINT64_C(1) << l
))
2586 fprintf(f
, " %s", strna(capability_to_name(l
)));
2591 if (c
->capability_ambient_set
!= 0) {
2593 fprintf(f
, "%sAmbientCapabilities:", prefix
);
2595 for (l
= 0; l
<= cap_last_cap(); l
++)
2596 if (c
->capability_ambient_set
& (UINT64_C(1) << l
))
2597 fprintf(f
, " %s", strna(capability_to_name(l
)));
2603 fprintf(f
, "%sUser: %s\n", prefix
, c
->user
);
2605 fprintf(f
, "%sGroup: %s\n", prefix
, c
->group
);
2607 if (strv_length(c
->supplementary_groups
) > 0) {
2608 fprintf(f
, "%sSupplementaryGroups:", prefix
);
2609 strv_fprintf(f
, c
->supplementary_groups
);
2614 fprintf(f
, "%sPAMName: %s\n", prefix
, c
->pam_name
);
2616 if (strv_length(c
->read_write_dirs
) > 0) {
2617 fprintf(f
, "%sReadWriteDirs:", prefix
);
2618 strv_fprintf(f
, c
->read_write_dirs
);
2622 if (strv_length(c
->read_only_dirs
) > 0) {
2623 fprintf(f
, "%sReadOnlyDirs:", prefix
);
2624 strv_fprintf(f
, c
->read_only_dirs
);
2628 if (strv_length(c
->inaccessible_dirs
) > 0) {
2629 fprintf(f
, "%sInaccessibleDirs:", prefix
);
2630 strv_fprintf(f
, c
->inaccessible_dirs
);
2636 "%sUtmpIdentifier: %s\n",
2637 prefix
, c
->utmp_id
);
2639 if (c
->selinux_context
)
2641 "%sSELinuxContext: %s%s\n",
2642 prefix
, c
->selinux_context_ignore
? "-" : "", c
->selinux_context
);
2644 if (c
->personality
!= PERSONALITY_INVALID
)
2646 "%sPersonality: %s\n",
2647 prefix
, strna(personality_to_string(c
->personality
)));
2649 if (c
->syscall_filter
) {
2657 "%sSystemCallFilter: ",
2660 if (!c
->syscall_whitelist
)
2664 SET_FOREACH(id
, c
->syscall_filter
, j
) {
2665 _cleanup_free_
char *name
= NULL
;
2672 name
= seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE
, PTR_TO_INT(id
) - 1);
2673 fputs(strna(name
), f
);
2680 if (c
->syscall_archs
) {
2687 "%sSystemCallArchitectures:",
2691 SET_FOREACH(id
, c
->syscall_archs
, j
)
2692 fprintf(f
, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id
) - 1)));
2697 if (c
->syscall_errno
> 0)
2699 "%sSystemCallErrorNumber: %s\n",
2700 prefix
, strna(errno_to_name(c
->syscall_errno
)));
2702 if (c
->apparmor_profile
)
2704 "%sAppArmorProfile: %s%s\n",
2705 prefix
, c
->apparmor_profile_ignore
? "-" : "", c
->apparmor_profile
);
2708 bool exec_context_maintains_privileges(ExecContext
*c
) {
2711 /* Returns true if the process forked off would run run under
2712 * an unchanged UID or as root. */
2717 if (streq(c
->user
, "root") || streq(c
->user
, "0"))
2723 void exec_status_start(ExecStatus
*s
, pid_t pid
) {
2728 dual_timestamp_get(&s
->start_timestamp
);
2731 void exec_status_exit(ExecStatus
*s
, ExecContext
*context
, pid_t pid
, int code
, int status
) {
2734 if (s
->pid
&& s
->pid
!= pid
)
2738 dual_timestamp_get(&s
->exit_timestamp
);
2744 if (context
->utmp_id
)
2745 utmp_put_dead_process(context
->utmp_id
, pid
, code
, status
);
2747 exec_context_tty_reset(context
, NULL
);
2751 void exec_status_dump(ExecStatus
*s
, FILE *f
, const char *prefix
) {
2752 char buf
[FORMAT_TIMESTAMP_MAX
];
2760 prefix
= strempty(prefix
);
2763 "%sPID: "PID_FMT
"\n",
2766 if (s
->start_timestamp
.realtime
> 0)
2768 "%sStart Timestamp: %s\n",
2769 prefix
, format_timestamp(buf
, sizeof(buf
), s
->start_timestamp
.realtime
));
2771 if (s
->exit_timestamp
.realtime
> 0)
2773 "%sExit Timestamp: %s\n"
2775 "%sExit Status: %i\n",
2776 prefix
, format_timestamp(buf
, sizeof(buf
), s
->exit_timestamp
.realtime
),
2777 prefix
, sigchld_code_to_string(s
->code
),
2781 char *exec_command_line(char **argv
) {
2789 STRV_FOREACH(a
, argv
)
2792 if (!(n
= new(char, k
)))
2796 STRV_FOREACH(a
, argv
) {
2803 if (strpbrk(*a
, WHITESPACE
)) {
2814 /* FIXME: this doesn't really handle arguments that have
2815 * spaces and ticks in them */
2820 void exec_command_dump(ExecCommand
*c
, FILE *f
, const char *prefix
) {
2821 _cleanup_free_
char *cmd
= NULL
;
2822 const char *prefix2
;
2827 prefix
= strempty(prefix
);
2828 prefix2
= strjoina(prefix
, "\t");
2830 cmd
= exec_command_line(c
->argv
);
2832 "%sCommand Line: %s\n",
2833 prefix
, cmd
? cmd
: strerror(ENOMEM
));
2835 exec_status_dump(&c
->exec_status
, f
, prefix2
);
2838 void exec_command_dump_list(ExecCommand
*c
, FILE *f
, const char *prefix
) {
2841 prefix
= strempty(prefix
);
2843 LIST_FOREACH(command
, c
, c
)
2844 exec_command_dump(c
, f
, prefix
);
2847 void exec_command_append_list(ExecCommand
**l
, ExecCommand
*e
) {
2854 /* It's kind of important, that we keep the order here */
2855 LIST_FIND_TAIL(command
, *l
, end
);
2856 LIST_INSERT_AFTER(command
, *l
, end
, e
);
2861 int exec_command_set(ExecCommand
*c
, const char *path
, ...) {
2869 l
= strv_new_ap(path
, ap
);
2890 int exec_command_append(ExecCommand
*c
, const char *path
, ...) {
2891 _cleanup_strv_free_
char **l
= NULL
;
2899 l
= strv_new_ap(path
, ap
);
2905 r
= strv_extend_strv(&c
->argv
, l
, false);
2913 static int exec_runtime_allocate(ExecRuntime
**rt
) {
2918 *rt
= new0(ExecRuntime
, 1);
2923 (*rt
)->netns_storage_socket
[0] = (*rt
)->netns_storage_socket
[1] = -1;
2928 int exec_runtime_make(ExecRuntime
**rt
, ExecContext
*c
, const char *id
) {
2938 if (!c
->private_network
&& !c
->private_tmp
)
2941 r
= exec_runtime_allocate(rt
);
2945 if (c
->private_network
&& (*rt
)->netns_storage_socket
[0] < 0) {
2946 if (socketpair(AF_UNIX
, SOCK_DGRAM
, 0, (*rt
)->netns_storage_socket
) < 0)
2950 if (c
->private_tmp
&& !(*rt
)->tmp_dir
) {
2951 r
= setup_tmp_dirs(id
, &(*rt
)->tmp_dir
, &(*rt
)->var_tmp_dir
);
2959 ExecRuntime
*exec_runtime_ref(ExecRuntime
*r
) {
2961 assert(r
->n_ref
> 0);
2967 ExecRuntime
*exec_runtime_unref(ExecRuntime
*r
) {
2972 assert(r
->n_ref
> 0);
2979 free(r
->var_tmp_dir
);
2980 safe_close_pair(r
->netns_storage_socket
);
2986 int exec_runtime_serialize(Unit
*u
, ExecRuntime
*rt
, FILE *f
, FDSet
*fds
) {
2995 unit_serialize_item(u
, f
, "tmp-dir", rt
->tmp_dir
);
2997 if (rt
->var_tmp_dir
)
2998 unit_serialize_item(u
, f
, "var-tmp-dir", rt
->var_tmp_dir
);
3000 if (rt
->netns_storage_socket
[0] >= 0) {
3003 copy
= fdset_put_dup(fds
, rt
->netns_storage_socket
[0]);
3007 unit_serialize_item_format(u
, f
, "netns-socket-0", "%i", copy
);
3010 if (rt
->netns_storage_socket
[1] >= 0) {
3013 copy
= fdset_put_dup(fds
, rt
->netns_storage_socket
[1]);
3017 unit_serialize_item_format(u
, f
, "netns-socket-1", "%i", copy
);
3023 int exec_runtime_deserialize_item(Unit
*u
, ExecRuntime
**rt
, const char *key
, const char *value
, FDSet
*fds
) {
3030 if (streq(key
, "tmp-dir")) {
3033 r
= exec_runtime_allocate(rt
);
3037 copy
= strdup(value
);
3041 free((*rt
)->tmp_dir
);
3042 (*rt
)->tmp_dir
= copy
;
3044 } else if (streq(key
, "var-tmp-dir")) {
3047 r
= exec_runtime_allocate(rt
);
3051 copy
= strdup(value
);
3055 free((*rt
)->var_tmp_dir
);
3056 (*rt
)->var_tmp_dir
= copy
;
3058 } else if (streq(key
, "netns-socket-0")) {
3061 r
= exec_runtime_allocate(rt
);
3065 if (safe_atoi(value
, &fd
) < 0 || !fdset_contains(fds
, fd
))
3066 log_unit_debug(u
, "Failed to parse netns socket value: %s", value
);
3068 safe_close((*rt
)->netns_storage_socket
[0]);
3069 (*rt
)->netns_storage_socket
[0] = fdset_remove(fds
, fd
);
3071 } else if (streq(key
, "netns-socket-1")) {
3074 r
= exec_runtime_allocate(rt
);
3078 if (safe_atoi(value
, &fd
) < 0 || !fdset_contains(fds
, fd
))
3079 log_unit_debug(u
, "Failed to parse netns socket value: %s", value
);
3081 safe_close((*rt
)->netns_storage_socket
[1]);
3082 (*rt
)->netns_storage_socket
[1] = fdset_remove(fds
, fd
);
3090 static void *remove_tmpdir_thread(void *p
) {
3091 _cleanup_free_
char *path
= p
;
3093 (void) rm_rf(path
, REMOVE_ROOT
|REMOVE_PHYSICAL
);
3097 void exec_runtime_destroy(ExecRuntime
*rt
) {
3103 /* If there are multiple users of this, let's leave the stuff around */
3108 log_debug("Spawning thread to nuke %s", rt
->tmp_dir
);
3110 r
= asynchronous_job(remove_tmpdir_thread
, rt
->tmp_dir
);
3112 log_warning_errno(r
, "Failed to nuke %s: %m", rt
->tmp_dir
);
3119 if (rt
->var_tmp_dir
) {
3120 log_debug("Spawning thread to nuke %s", rt
->var_tmp_dir
);
3122 r
= asynchronous_job(remove_tmpdir_thread
, rt
->var_tmp_dir
);
3124 log_warning_errno(r
, "Failed to nuke %s: %m", rt
->var_tmp_dir
);
3125 free(rt
->var_tmp_dir
);
3128 rt
->var_tmp_dir
= NULL
;
3131 safe_close_pair(rt
->netns_storage_socket
);
3134 static const char* const exec_input_table
[_EXEC_INPUT_MAX
] = {
3135 [EXEC_INPUT_NULL
] = "null",
3136 [EXEC_INPUT_TTY
] = "tty",
3137 [EXEC_INPUT_TTY_FORCE
] = "tty-force",
3138 [EXEC_INPUT_TTY_FAIL
] = "tty-fail",
3139 [EXEC_INPUT_SOCKET
] = "socket"
3142 DEFINE_STRING_TABLE_LOOKUP(exec_input
, ExecInput
);
3144 static const char* const exec_output_table
[_EXEC_OUTPUT_MAX
] = {
3145 [EXEC_OUTPUT_INHERIT
] = "inherit",
3146 [EXEC_OUTPUT_NULL
] = "null",
3147 [EXEC_OUTPUT_TTY
] = "tty",
3148 [EXEC_OUTPUT_SYSLOG
] = "syslog",
3149 [EXEC_OUTPUT_SYSLOG_AND_CONSOLE
] = "syslog+console",
3150 [EXEC_OUTPUT_KMSG
] = "kmsg",
3151 [EXEC_OUTPUT_KMSG_AND_CONSOLE
] = "kmsg+console",
3152 [EXEC_OUTPUT_JOURNAL
] = "journal",
3153 [EXEC_OUTPUT_JOURNAL_AND_CONSOLE
] = "journal+console",
3154 [EXEC_OUTPUT_SOCKET
] = "socket"
3157 DEFINE_STRING_TABLE_LOOKUP(exec_output
, ExecOutput
);
3159 static const char* const exec_utmp_mode_table
[_EXEC_UTMP_MODE_MAX
] = {
3160 [EXEC_UTMP_INIT
] = "init",
3161 [EXEC_UTMP_LOGIN
] = "login",
3162 [EXEC_UTMP_USER
] = "user",
3165 DEFINE_STRING_TABLE_LOOKUP(exec_utmp_mode
, ExecUtmpMode
);