tmpfiles: skip mknod() on -EPERM (device cgroup)

[elogind.git] / src / tmpfiles / tmpfiles.c

diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index b80731d470eae158b2158dd58d45790cad48ab38..df52085ff4f7aa49eee3304f70a0ef3bf730c5cb 100644 (file)
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -99,6 +99,7 @@ typedef struct Item {
         bool gid_set:1;
         bool mode_set:1;
         bool age_set:1;
+        bool mask_perms:1;
 
         bool keep_first_level:1;
 
@@ -454,11 +455,29 @@ static int item_set_perms(Item *i, const char *path) {
         assert(path);
 
         /* not using i->path directly because it may be a glob */
-        if (i->mode_set)
-                if (chmod(path, i->mode) < 0) {
+        if (i->mode_set) {
+                mode_t m = i->mode;
+
+                if (i->mask_perms) {
+                        struct stat st;
+
+                        if (stat(path, &st) >= 0) {
+                                if (!(st.st_mode & 0111))
+                                        m &= ~0111;
+                                if (!(st.st_mode & 0222))
+                                        m &= ~0222;
+                                if (!(st.st_mode & 0444))
+                                        m &= ~0444;
+                                if (!S_ISDIR(st.st_mode))
+                                        m &= ~07000; /* remove sticky/sgid/suid bit, unless directory */
+                        }
+                }
+
+                if (chmod(path, m) < 0) {
                         log_error("chmod(%s) failed: %m", path);
                         return -errno;
                 }
+        }
 
         if (i->uid_set || i->gid_set)
                 if (chown(path,
@@ -773,9 +792,17 @@ static int create_item(Item *i) {
                         label_context_clear();
                 }
 
-                if (r < 0 && errno != EEXIST) {
-                        log_error("Failed to create device node %s: %m", i->path);
-                        return -errno;
+                if (r < 0) {
+                        if (errno == EPERM) {
+                                log_debug("We lack permissions, possibly because of cgroup configuration; "
+                                          "skipping creation of device node %s.", i->path);
+                                return 0;
+                        }
+
+                        if (errno != EEXIST) {
+                                log_error("Failed to create device node %s: %m", i->path);
+                                return -errno;
+                        }
                 }
 
                 if (stat(i->path, &st) < 0) {
@@ -1002,7 +1029,9 @@ static int process_item(Item *i) {
 }
 
 static void item_free(Item *i) {
-        assert(i);
+
+        if (!i)
+                return;
 
         free(i->path);
         free(i->argument);
@@ -1056,15 +1085,13 @@ static bool item_equal(Item *a, Item *b) {
 static bool should_include_path(const char *path) {
         char **prefix;
 
-        STRV_FOREACH(prefix, arg_exclude_prefixes) {
+        STRV_FOREACH(prefix, arg_exclude_prefixes)
                 if (path_startswith(path, *prefix))
                         return false;
-        }
 
-        STRV_FOREACH(prefix, arg_include_prefixes) {
+        STRV_FOREACH(prefix, arg_include_prefixes)
                 if (path_startswith(path, *prefix))
                         return true;
-        }
 
         /* no matches, so we should include this path only if we
          * have no whitelist at all */
@@ -1133,7 +1160,7 @@ static int parse_line(const char *fname, unsigned line, const char *buffer) {
                 }
         }
 
-        switch(type) {
+        switch (type) {
 
         case CREATE_FILE:
         case TRUNCATE_FILE:
@@ -1197,7 +1224,7 @@ static int parse_line(const char *fname, unsigned line, const char *buffer) {
         }
 
         default:
-                log_error("[%s:%u] Unknown file type '%c'.", fname, line, type);
+                log_error("[%s:%u] Unknown command type '%c'.", fname, line, type);
                 return -EBADMSG;
         }
 
@@ -1249,9 +1276,15 @@ static int parse_line(const char *fname, unsigned line, const char *buffer) {
         }
 
         if (mode && !streq(mode, "-")) {
+                const char *mm = mode;
                 unsigned m;
 
-                if (sscanf(mode, "%o", &m) != 1) {
+                if (*mm == '~') {
+                        i->mask_perms = true;
+                        mm++;
+                }
+
+                if (sscanf(mm, "%o", &m) != 1) {
                         log_error("[%s:%u] Invalid mode '%s'.", fname, line, mode);
                         return -ENOENT;
                 }
@@ -1390,9 +1423,11 @@ static int parse_argv(int argc, char *argv[]) {
                         break;
 
                 case ARG_ROOT:
+                        free(arg_root);
                         arg_root = path_make_absolute_cwd(optarg);
                         if (!arg_root)
                                 return log_oom();
+
                         path_kill_slashes(arg_root);
                         break;
 
@@ -1490,7 +1525,7 @@ int main(int argc, char *argv[]) {
 
         r = parse_argv(argc, argv);
         if (r <= 0)
-                return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
+                goto finish;
 
         log_set_target(LOG_TARGET_AUTO);
         log_parse_environment();