X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fcore%2Fexecute.c;h=5cfd4a1f97537d289fa86a8f8bde972751a0d3e5;hb=adeba5008eac3105ae59256dedd087ebe006a9e6;hp=96cabe6d99c7bb8d5bf95910c18962550cb4fbcf;hpb=a610cc4f18c24a007e5a2cac21b2ecbd81e5f3c3;p=elogind.git diff --git a/src/core/execute.c b/src/core/execute.c index 96cabe6d9..5cfd4a1f9 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -83,6 +83,8 @@ #include "af-list.h" #include "mkdir.h" #include "apparmor-util.h" +#include "bus-kernel.h" +#include "label.h" #ifdef HAVE_SECCOMP #include "seccomp-util.h" @@ -938,7 +940,7 @@ static void rename_process_from_path(const char *path) { #ifdef HAVE_SECCOMP -static int apply_seccomp(ExecContext *c) { +static int apply_seccomp(const ExecContext *c) { uint32_t negative_action, action; scmp_filter_ctx *seccomp; Iterator i; @@ -987,7 +989,7 @@ finish: return r; } -static int apply_address_families(ExecContext *c) { +static int apply_address_families(const ExecContext *c) { scmp_filter_ctx *seccomp; Iterator i; int r; @@ -1236,7 +1238,7 @@ static int exec_child(ExecCommand *command, _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL; const char *username = NULL, *home = NULL, *shell = NULL; unsigned n_dont_close = 0; - int dont_close[n_fds + 3]; + int dont_close[n_fds + 4]; uid_t uid = (uid_t) -1; gid_t gid = (gid_t) -1; int i, err; @@ -1279,6 +1281,8 @@ static int exec_child(ExecCommand *command, memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds); n_dont_close += n_fds; } + if (params->bus_endpoint_fd >= 0) + dont_close[n_dont_close++] = params->bus_endpoint_fd; if (runtime) { if (runtime->netns_storage_socket[0] >= 0) dont_close[n_dont_close++] = runtime->netns_storage_socket[0]; @@ -1428,8 +1432,22 @@ static int exec_child(ExecCommand *command, } } -#ifdef HAVE_PAM - if (params->cgroup_path && context->user && context->pam_name) { +#ifdef ENABLE_KDBUS + if (params->bus_endpoint_fd >= 0 && context->bus_endpoint) { + uid_t ep_uid = (uid == (uid_t) -1) ? 0 : uid; + + err = bus_kernel_set_endpoint_policy(params->bus_endpoint_fd, ep_uid, context->bus_endpoint); + if (err < 0) { + *error = EXIT_BUS_ENDPOINT; + return err; + } + } +#endif + + /* If delegation is enabled we'll pass ownership of the cgroup + * (but only in systemd's own controller hierarchy!) to the + * user of the new process. */ + if (params->cgroup_path && context->user && params->cgroup_delegate) { err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid); if (err < 0) { *error = EXIT_CGROUP; @@ -1443,7 +1461,6 @@ static int exec_child(ExecCommand *command, return err; } } -#endif if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) { char **rt; @@ -1498,6 +1515,7 @@ static int exec_child(ExecCommand *command, !strv_isempty(context->inaccessible_dirs) || context->mount_flags != 0 || (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) || + params->bus_endpoint_path || context->private_devices || context->protect_system != PROTECT_SYSTEM_NO || context->protect_home != PROTECT_HOME_NO) { @@ -1523,12 +1541,15 @@ static int exec_child(ExecCommand *command, context->inaccessible_dirs, tmp, var, - NULL, + params->bus_endpoint_path, context->private_devices, context->protect_home, context->protect_system, context->mount_flags); - if (err < 0) { + + if (err == -EPERM) + log_warning_unit(params->unit_id, "Failed to set up file system namespace due to lack of privileges. Execution sandbox will not be in effect: %s", strerror(-err)); + else if (err < 0) { *error = EXIT_NAMESPACE; return err; } @@ -1564,7 +1585,9 @@ static int exec_child(ExecCommand *command, /* We repeat the fd closing here, to make sure that * nothing is leaked from the PAM modules. Note that * we are more aggressive this time since socket_fd - * and the netns fds we don#t need anymore. */ + * and the netns fds we don't need anymore. The custom + * endpoint fd was needed to upload the policy and can + * now be closed as well. */ err = close_all_fds(fds, n_fds); if (err >= 0) err = shift_fds(fds, n_fds); @@ -1647,21 +1670,39 @@ static int exec_child(ExecCommand *command, #endif #ifdef HAVE_SELINUX - if (context->selinux_context && use_selinux()) { - err = setexeccon(context->selinux_context); - if (err < 0 && !context->selinux_context_ignore) { - *error = EXIT_SELINUX_CONTEXT; - return err; + if (mac_selinux_use()) { + if (context->selinux_context) { + err = setexeccon(context->selinux_context); + if (err < 0 && !context->selinux_context_ignore) { + *error = EXIT_SELINUX_CONTEXT; + return err; + } + } + + if (params->selinux_context_net && socket_fd >= 0) { + _cleanup_free_ char *label = NULL; + + err = mac_selinux_get_child_mls_label(socket_fd, command->path, &label); + if (err < 0) { + *error = EXIT_SELINUX_CONTEXT; + return err; + } + + err = setexeccon(label); + if (err < 0) { + *error = EXIT_SELINUX_CONTEXT; + return err; + } } } #endif #ifdef HAVE_APPARMOR - if (context->apparmor_profile && use_apparmor()) { + if (context->apparmor_profile && mac_apparmor_use()) { err = aa_change_onexec(context->apparmor_profile); if (err < 0 && !context->apparmor_profile_ignore) { *error = EXIT_APPARMOR_PROFILE; - return err; + return -errno; } } #endif @@ -1745,7 +1786,7 @@ int exec_spawn(ExecCommand *command, n_fds = params->n_fds; } - err = exec_context_load_environment(context, &files_env); + err = exec_context_load_environment(context, params->unit_id, &files_env); if (err < 0) { log_struct_unit(LOG_ERR, params->unit_id, @@ -1974,7 +2015,7 @@ void exec_command_free_array(ExecCommand **c, unsigned n) { } } -int exec_context_load_environment(const ExecContext *c, char ***l) { +int exec_context_load_environment(const ExecContext *c, const char *unit_id, char ***l) { char **i, **r = NULL; assert(c); @@ -2031,7 +2072,7 @@ int exec_context_load_environment(const ExecContext *c, char ***l) { } /* Log invalid environment variables with filename */ if (p) - p = strv_env_clean_log(p, pglob.gl_pathv[n]); + p = strv_env_clean_log(p, unit_id, pglob.gl_pathv[n]); if (r == NULL) r = p; @@ -2362,6 +2403,21 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile); } +bool exec_context_maintains_privileges(ExecContext *c) { + assert(c); + + /* Returns true if the process forked off would run run under + * an unchanged UID or as root. */ + + if (!c->user) + return true; + + if (streq(c->user, "root") || streq(c->user, "0")) + return true; + + return false; +} + void exec_status_start(ExecStatus *s, pid_t pid) { assert(s); @@ -2529,6 +2585,29 @@ int exec_command_set(ExecCommand *c, const char *path, ...) { return 0; } +int exec_command_append(ExecCommand *c, const char *path, ...) { + _cleanup_strv_free_ char **l = NULL; + va_list ap; + int r; + + assert(c); + assert(path); + + va_start(ap, path); + l = strv_new_ap(path, ap); + va_end(ap); + + if (!l) + return -ENOMEM; + + r = strv_extend_strv(&c->argv, l); + if (r < 0) + return r; + + return 0; +} + + static int exec_runtime_allocate(ExecRuntime **rt) { if (*rt)