X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fcore%2Fexecute.c;h=5083af9aedec5b4011b55a3f6fbe7900d69b21cd;hb=4e6db59202ad2dbbef56a69985643390ffdd57bd;hp=6aa0083bc019f1ef17b3f0a91f2bbb3ffefac15b;hpb=ebf4fb3d368732d9f41cb40e3084182c04e731b2;p=elogind.git diff --git a/src/core/execute.c b/src/core/execute.c index 6aa0083bc..5083af9ae 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -205,7 +205,10 @@ static int open_null_as(int flags, int nfd) { static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) { int fd, r; - union sockaddr_union sa; + union sockaddr_union sa = { + .un.sun_family = AF_UNIX, + .un.sun_path = "/run/systemd/journal/stdout", + }; assert(context); assert(output < _EXEC_OUTPUT_MAX); @@ -216,10 +219,6 @@ static int connect_logger_as(const ExecContext *context, ExecOutput output, cons if (fd < 0) return -errno; - zero(sa); - sa.un.sun_family = AF_UNIX; - strncpy(sa.un.sun_path, "/run/systemd/journal/stdout", sizeof(sa.un.sun_path)); - r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path)); if (r < 0) { close_nointr_nofail(fd); @@ -671,9 +670,9 @@ static int enforce_user(const ExecContext *context, uid_t uid) { /* First step: If we need to keep capabilities but * drop privileges we need to make sure we keep our - * caps, whiel we drop privileges. */ + * caps, while we drop privileges. */ if (uid != 0) { - int sb = context->secure_bits|SECURE_KEEP_CAPS; + int sb = context->secure_bits | 1<private_tmp && !context->tmp_dir && !context->var_tmp_dir) { @@ -1195,7 +1198,7 @@ int exec_spawn(ExecCommand *command, snprintf(t, sizeof(t), "%i", context->oom_score_adjust); char_array_0(t); - if (write_one_line_file("/proc/self/oom_score_adj", t) < 0) { + if (write_string_file("/proc/self/oom_score_adj", t) < 0) { err = -errno; r = EXIT_OOM_ADJUST; goto fail_child; @@ -1210,13 +1213,16 @@ int exec_spawn(ExecCommand *command, } if (context->cpu_sched_set) { - struct sched_param param; - - zero(param); - param.sched_priority = context->cpu_sched_priority; + struct sched_param param = { + .sched_priority = context->cpu_sched_priority, + }; - if (sched_setscheduler(0, context->cpu_sched_policy | - (context->cpu_sched_reset_on_fork ? SCHED_RESET_ON_FORK : 0), ¶m) < 0) { + r = sched_setscheduler(0, + context->cpu_sched_policy | + (context->cpu_sched_reset_on_fork ? + SCHED_RESET_ON_FORK : 0), + ¶m); + if (r < 0) { err = -errno; r = EXIT_SETSCHEDULER; goto fail_child; @@ -1266,7 +1272,12 @@ int exec_spawn(ExecCommand *command, if (cgroup_bondings && context->control_group_modify) { err = cgroup_bonding_set_group_access_list(cgroup_bondings, 0755, uid, gid); if (err >= 0) - err = cgroup_bonding_set_task_access_list(cgroup_bondings, 0644, uid, gid, context->control_group_persistent); + err = cgroup_bonding_set_task_access_list( + cgroup_bondings, + 0644, + uid, + gid, + context->control_group_persistent); if (err < 0) { r = EXIT_CGROUP; goto fail_child; @@ -1277,7 +1288,12 @@ int exec_spawn(ExecCommand *command, } if (cgroup_bondings && !set_access && context->control_group_persistent >= 0) { - err = cgroup_bonding_set_task_access_list(cgroup_bondings, (mode_t) -1, (uid_t) -1, (uid_t) -1, context->control_group_persistent); + err = cgroup_bonding_set_task_access_list( + cgroup_bondings, + (mode_t) -1, + (uid_t) -1, + (uid_t) -1, + context->control_group_persistent); if (err < 0) { r = EXIT_CGROUP; goto fail_child; @@ -1437,7 +1453,8 @@ int exec_spawn(ExecCommand *command, } } - if (!(our_env = new0(char*, 7))) { + our_env = new0(char*, 7); + if (!our_env) { err = -ENOMEM; r = EXIT_MEMORY; goto fail_child; @@ -1477,20 +1494,21 @@ int exec_spawn(ExecCommand *command, assert(n_env <= 7); - if (!(final_env = strv_env_merge( - 5, - environment, - our_env, - context->environment, - files_env, - pam_env, - NULL))) { + final_env = strv_env_merge(5, + environment, + our_env, + context->environment, + files_env, + pam_env, + NULL); + if (!final_env) { err = -ENOMEM; r = EXIT_MEMORY; goto fail_child; } - if (!(final_argv = replace_env_argv(argv, final_env))) { + final_argv = replace_env_argv(argv, final_env); + if (!final_argv) { err = -ENOMEM; r = EXIT_MEMORY; goto fail_child; @@ -1519,18 +1537,17 @@ int exec_spawn(ExecCommand *command, } log_struct_unit(LOG_DEBUG, - unit_id, - "MESSAGE=Forked %s as %lu", - command->path, (unsigned long) pid, - NULL); + unit_id, + "MESSAGE=Forked %s as %lu", + command->path, (unsigned long) pid, + NULL); /* We add the new process to the cgroup both in the child (so * that we can be sure that no user code is ever executed * outside of the cgroup) and in the parent (so that we can be * sure that when we kill the cgroup the process will be * killed too). */ - if (cgroup_bondings) - cgroup_bonding_install_list(cgroup_bondings, pid, cgroup_suffix); + cgroup_bonding_install_list(cgroup_bondings, pid, cgroup_suffix); exec_status_start(&command->exec_status, pid); @@ -1695,7 +1712,7 @@ int exec_context_load_environment(const ExecContext *c, char ***l) { int k; bool ignore = false; char **p; - glob_t pglob; + glob_t _cleanup_globfree_ pglob = {}; int count, n; fn = *i; @@ -1706,7 +1723,6 @@ int exec_context_load_environment(const ExecContext *c, char ***l) { } if (!path_is_absolute(fn)) { - if (ignore) continue; @@ -1715,10 +1731,8 @@ int exec_context_load_environment(const ExecContext *c, char ***l) { } /* Filename supports globbing, take all matching files */ - zero(pglob); errno = 0; if (glob(fn, 0, NULL, &pglob) != 0) { - globfree(&pglob); if (ignore) continue; @@ -1727,7 +1741,6 @@ int exec_context_load_environment(const ExecContext *c, char ***l) { } count = pglob.gl_pathc; if (count == 0) { - globfree(&pglob); if (ignore) continue; @@ -1735,13 +1748,12 @@ int exec_context_load_environment(const ExecContext *c, char ***l) { return -EINVAL; } for (n = 0; n < count; n++) { - k = load_env_file(pglob.gl_pathv[n], &p); + k = load_env_file(pglob.gl_pathv[n], NULL, &p); if (k < 0) { if (ignore) continue; strv_free(r); - globfree(&pglob); return k; } @@ -1753,16 +1765,12 @@ int exec_context_load_environment(const ExecContext *c, char ***l) { m = strv_env_merge(2, r, p); strv_free(r); strv_free(p); - - if (!m) { - globfree(&pglob); + if (!m) return -ENOMEM; - } r = m; } } - globfree(&pglob); } *l = r; @@ -1963,12 +1971,12 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { if (c->secure_bits) fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n", prefix, - (c->secure_bits & SECURE_KEEP_CAPS) ? " keep-caps" : "", - (c->secure_bits & SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "", - (c->secure_bits & SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "", - (c->secure_bits & SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "", - (c->secure_bits & SECURE_NOROOT) ? " noroot" : "", - (c->secure_bits & SECURE_NOROOT_LOCKED) ? "noroot-locked" : ""); + (c->secure_bits & 1<secure_bits & 1<secure_bits & 1<secure_bits & 1<secure_bits & 1<secure_bits & 1<capability_bounding_set_drop) { unsigned long l;