src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <linux/seccomp-bpf.h>
  42 #include <glob.h>
  43
  44 #ifdef HAVE_PAM
  45 #include <security/pam_appl.h>
  46 #endif
  47
  48 #include "execute.h"
  49 #include "strv.h"
  50 #include "macro.h"
  51 #include "capability.h"
  52 #include "util.h"
  53 #include "log.h"
  54 #include "sd-messages.h"
  55 #include "ioprio.h"
  56 #include "securebits.h"
  57 #include "cgroup.h"
  58 #include "namespace.h"
  59 #include "tcpwrap.h"
  60 #include "exit-status.h"
  61 #include "missing.h"
  62 #include "utmp-wtmp.h"
  63 #include "def.h"
  64 #include "loopback-setup.h"
  65 #include "path-util.h"
  66 #include "syscall-list.h"
  67 #include "env-util.h"
  68 #include "fileio.h"
  69
  70 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  71
  72 /* This assumes there is a 'tty' group */
  73 #define TTY_MODE 0620
  74
  75 static int shift_fds(int fds[], unsigned n_fds) {
  76         int start, restart_from;
  77
  78         if (n_fds <= 0)
  79                 return 0;
  80
  81         /* Modifies the fds array! (sorts it) */
  82
  83         assert(fds);
  84
  85         start = 0;
  86         for (;;) {
  87                 int i;
  88
  89                 restart_from = -1;
  90
  91                 for (i = start; i < (int) n_fds; i++) {
  92                         int nfd;
  93
  94                         /* Already at right index? */
  95                         if (fds[i] == i+3)
  96                                 continue;
  97
  98                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
  99                                 return -errno;
 100
 101                         close_nointr_nofail(fds[i]);
 102                         fds[i] = nfd;
 103
 104                         /* Hmm, the fd we wanted isn't free? Then
 105                          * let's remember that and try again from here*/
 106                         if (nfd != i+3 && restart_from < 0)
 107                                 restart_from = i;
 108                 }
 109
 110                 if (restart_from < 0)
 111                         break;
 112
 113                 start = restart_from;
 114         }
 115
 116         return 0;
 117 }
 118
 119 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 120         unsigned i;
 121         int r;
 122
 123         if (n_fds <= 0)
 124                 return 0;
 125
 126         assert(fds);
 127
 128         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 129
 130         for (i = 0; i < n_fds; i++) {
 131
 132                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 133                         return r;
 134
 135                 /* We unconditionally drop FD_CLOEXEC from the fds,
 136                  * since after all we want to pass these fds to our
 137                  * children */
 138
 139                 if ((r = fd_cloexec(fds[i], false)) < 0)
 140                         return r;
 141         }
 142
 143         return 0;
 144 }
 145
 146 static const char *tty_path(const ExecContext *context) {
 147         assert(context);
 148
 149         if (context->tty_path)
 150                 return context->tty_path;
 151
 152         return "/dev/console";
 153 }
 154
 155 void exec_context_tty_reset(const ExecContext *context) {
 156         assert(context);
 157
 158         if (context->tty_vhangup)
 159                 terminal_vhangup(tty_path(context));
 160
 161         if (context->tty_reset)
 162                 reset_terminal(tty_path(context));
 163
 164         if (context->tty_vt_disallocate && context->tty_path)
 165                 vt_disallocate(context->tty_path);
 166 }
 167
 168 static bool is_terminal_output(ExecOutput o) {
 169         return
 170                 o == EXEC_OUTPUT_TTY ||
 171                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 172                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 173                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 174 }
 175
 176 void exec_context_serialize(const ExecContext *context, Unit *u, FILE *f) {
 177         assert(context);
 178         assert(u);
 179         assert(f);
 180
 181         if (context->tmp_dir)
 182                 unit_serialize_item(u, f, "tmp-dir", context->tmp_dir);
 183
 184         if (context->var_tmp_dir)
 185                 unit_serialize_item(u, f, "var-tmp-dir", context->var_tmp_dir);
 186 }
 187
 188 static int open_null_as(int flags, int nfd) {
 189         int fd, r;
 190
 191         assert(nfd >= 0);
 192
 193         if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
 194                 return -errno;
 195
 196         if (fd != nfd) {
 197                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 198                 close_nointr_nofail(fd);
 199         } else
 200                 r = nfd;
 201
 202         return r;
 203 }
 204
 205 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 206         int fd, r;
 207         union sockaddr_union sa;
 208
 209         assert(context);
 210         assert(output < _EXEC_OUTPUT_MAX);
 211         assert(ident);
 212         assert(nfd >= 0);
 213
 214         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 215         if (fd < 0)
 216                 return -errno;
 217
 218         zero(sa);
 219         sa.un.sun_family = AF_UNIX;
 220         strncpy(sa.un.sun_path, "/run/systemd/journal/stdout", sizeof(sa.un.sun_path));
 221
 222         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 223         if (r < 0) {
 224                 close_nointr_nofail(fd);
 225                 return -errno;
 226         }
 227
 228         if (shutdown(fd, SHUT_RD) < 0) {
 229                 close_nointr_nofail(fd);
 230                 return -errno;
 231         }
 232
 233         dprintf(fd,
 234                 "%s\n"
 235                 "%s\n"
 236                 "%i\n"
 237                 "%i\n"
 238                 "%i\n"
 239                 "%i\n"
 240                 "%i\n",
 241                 context->syslog_identifier ? context->syslog_identifier : ident,
 242                 unit_id,
 243                 context->syslog_priority,
 244                 !!context->syslog_level_prefix,
 245                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 246                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 247                 is_terminal_output(output));
 248
 249         if (fd != nfd) {
 250                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 251                 close_nointr_nofail(fd);
 252         } else
 253                 r = nfd;
 254
 255         return r;
 256 }
 257 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 258         int fd, r;
 259
 260         assert(path);
 261         assert(nfd >= 0);
 262
 263         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 264                 return fd;
 265
 266         if (fd != nfd) {
 267                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 268                 close_nointr_nofail(fd);
 269         } else
 270                 r = nfd;
 271
 272         return r;
 273 }
 274
 275 static bool is_terminal_input(ExecInput i) {
 276         return
 277                 i == EXEC_INPUT_TTY ||
 278                 i == EXEC_INPUT_TTY_FORCE ||
 279                 i == EXEC_INPUT_TTY_FAIL;
 280 }
 281
 282 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 283
 284         if (is_terminal_input(std_input) && !apply_tty_stdin)
 285                 return EXEC_INPUT_NULL;
 286
 287         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 288                 return EXEC_INPUT_NULL;
 289
 290         return std_input;
 291 }
 292
 293 static int fixup_output(ExecOutput std_output, int socket_fd) {
 294
 295         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 296                 return EXEC_OUTPUT_INHERIT;
 297
 298         return std_output;
 299 }
 300
 301 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 302         ExecInput i;
 303
 304         assert(context);
 305
 306         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 307
 308         switch (i) {
 309
 310         case EXEC_INPUT_NULL:
 311                 return open_null_as(O_RDONLY, STDIN_FILENO);
 312
 313         case EXEC_INPUT_TTY:
 314         case EXEC_INPUT_TTY_FORCE:
 315         case EXEC_INPUT_TTY_FAIL: {
 316                 int fd, r;
 317
 318                 if ((fd = acquire_terminal(
 319                                      tty_path(context),
 320                                      i == EXEC_INPUT_TTY_FAIL,
 321                                      i == EXEC_INPUT_TTY_FORCE,
 322                                      false,
 323                                      (usec_t) -1)) < 0)
 324                         return fd;
 325
 326                 if (fd != STDIN_FILENO) {
 327                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 328                         close_nointr_nofail(fd);
 329                 } else
 330                         r = STDIN_FILENO;
 331
 332                 return r;
 333         }
 334
 335         case EXEC_INPUT_SOCKET:
 336                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 337
 338         default:
 339                 assert_not_reached("Unknown input type");
 340         }
 341 }
 342
 343 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 344         ExecOutput o;
 345         ExecInput i;
 346         int r;
 347
 348         assert(context);
 349         assert(ident);
 350
 351         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 352         o = fixup_output(context->std_output, socket_fd);
 353
 354         if (fileno == STDERR_FILENO) {
 355                 ExecOutput e;
 356                 e = fixup_output(context->std_error, socket_fd);
 357
 358                 /* This expects the input and output are already set up */
 359
 360                 /* Don't change the stderr file descriptor if we inherit all
 361                  * the way and are not on a tty */
 362                 if (e == EXEC_OUTPUT_INHERIT &&
 363                     o == EXEC_OUTPUT_INHERIT &&
 364                     i == EXEC_INPUT_NULL &&
 365                     !is_terminal_input(context->std_input) &&
 366                     getppid () != 1)
 367                         return fileno;
 368
 369                 /* Duplicate from stdout if possible */
 370                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 371                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 372
 373                 o = e;
 374
 375         } else if (o == EXEC_OUTPUT_INHERIT) {
 376                 /* If input got downgraded, inherit the original value */
 377                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 378                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 379
 380                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 381                 if (i != EXEC_INPUT_NULL)
 382                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 383
 384                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 385                 if (getppid() != 1)
 386                         return fileno;
 387
 388                 /* We need to open /dev/null here anew, to get the right access mode. */
 389                 return open_null_as(O_WRONLY, fileno);
 390         }
 391
 392         switch (o) {
 393
 394         case EXEC_OUTPUT_NULL:
 395                 return open_null_as(O_WRONLY, fileno);
 396
 397         case EXEC_OUTPUT_TTY:
 398                 if (is_terminal_input(i))
 399                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 400
 401                 /* We don't reset the terminal if this is just about output */
 402                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 403
 404         case EXEC_OUTPUT_SYSLOG:
 405         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 406         case EXEC_OUTPUT_KMSG:
 407         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 408         case EXEC_OUTPUT_JOURNAL:
 409         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 410                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 411                 if (r < 0) {
 412                         log_struct_unit(LOG_CRIT, unit_id,
 413                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 414                                 fileno == STDOUT_FILENO ? "out" : "err",
 415                                 unit_id, strerror(-r),
 416                                 "ERRNO=%d", -r,
 417                                 NULL);
 418                         r = open_null_as(O_WRONLY, fileno);
 419                 }
 420                 return r;
 421
 422         case EXEC_OUTPUT_SOCKET:
 423                 assert(socket_fd >= 0);
 424                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 425
 426         default:
 427                 assert_not_reached("Unknown error type");
 428         }
 429 }
 430
 431 static int chown_terminal(int fd, uid_t uid) {
 432         struct stat st;
 433
 434         assert(fd >= 0);
 435
 436         /* This might fail. What matters are the results. */
 437         (void) fchown(fd, uid, -1);
 438         (void) fchmod(fd, TTY_MODE);
 439
 440         if (fstat(fd, &st) < 0)
 441                 return -errno;
 442
 443         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 444                 return -EPERM;
 445
 446         return 0;
 447 }
 448
 449 static int setup_confirm_stdio(int *_saved_stdin,
 450                                int *_saved_stdout) {
 451         int fd = -1, saved_stdin, saved_stdout = -1, r;
 452
 453         assert(_saved_stdin);
 454         assert(_saved_stdout);
 455
 456         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 457         if (saved_stdin < 0)
 458                 return -errno;
 459
 460         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 461         if (saved_stdout < 0) {
 462                 r = errno;
 463                 goto fail;
 464         }
 465
 466         fd = acquire_terminal(
 467                         "/dev/console",
 468                         false,
 469                         false,
 470                         false,
 471                         DEFAULT_CONFIRM_USEC);
 472         if (fd < 0) {
 473                 r = fd;
 474                 goto fail;
 475         }
 476
 477         r = chown_terminal(fd, getuid());
 478         if (r < 0)
 479                 goto fail;
 480
 481         if (dup2(fd, STDIN_FILENO) < 0) {
 482                 r = -errno;
 483                 goto fail;
 484         }
 485
 486         if (dup2(fd, STDOUT_FILENO) < 0) {
 487                 r = -errno;
 488                 goto fail;
 489         }
 490
 491         if (fd >= 2)
 492                 close_nointr_nofail(fd);
 493
 494         *_saved_stdin = saved_stdin;
 495         *_saved_stdout = saved_stdout;
 496
 497         return 0;
 498
 499 fail:
 500         if (saved_stdout >= 0)
 501                 close_nointr_nofail(saved_stdout);
 502
 503         if (saved_stdin >= 0)
 504                 close_nointr_nofail(saved_stdin);
 505
 506         if (fd >= 0)
 507                 close_nointr_nofail(fd);
 508
 509         return r;
 510 }
 511
 512 static int write_confirm_message(const char *format, ...) {
 513         int fd;
 514         va_list ap;
 515
 516         assert(format);
 517
 518         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 519         if (fd < 0)
 520                 return fd;
 521
 522         va_start(ap, format);
 523         vdprintf(fd, format, ap);
 524         va_end(ap);
 525
 526         close_nointr_nofail(fd);
 527
 528         return 0;
 529 }
 530
 531 static int restore_confirm_stdio(int *saved_stdin,
 532                                  int *saved_stdout) {
 533
 534         int r = 0;
 535
 536         assert(saved_stdin);
 537         assert(saved_stdout);
 538
 539         release_terminal();
 540
 541         if (*saved_stdin >= 0)
 542                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 543                         r = -errno;
 544
 545         if (*saved_stdout >= 0)
 546                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 547                         r = -errno;
 548
 549         if (*saved_stdin >= 0)
 550                 close_nointr_nofail(*saved_stdin);
 551
 552         if (*saved_stdout >= 0)
 553                 close_nointr_nofail(*saved_stdout);
 554
 555         return r;
 556 }
 557
 558 static int ask_for_confirmation(char *response, char **argv) {
 559         int saved_stdout = -1, saved_stdin = -1, r;
 560         char *line;
 561
 562         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 563         if (r < 0)
 564                 return r;
 565
 566         line = exec_command_line(argv);
 567         if (!line)
 568                 return -ENOMEM;
 569
 570         r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 571         free(line);
 572
 573         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 574
 575         return r;
 576 }
 577
 578 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 579         bool keep_groups = false;
 580         int r;
 581
 582         assert(context);
 583
 584         /* Lookup and set GID and supplementary group list. Here too
 585          * we avoid NSS lookups for gid=0. */
 586
 587         if (context->group || username) {
 588
 589                 if (context->group) {
 590                         const char *g = context->group;
 591
 592                         if ((r = get_group_creds(&g, &gid)) < 0)
 593                                 return r;
 594                 }
 595
 596                 /* First step, initialize groups from /etc/groups */
 597                 if (username && gid != 0) {
 598                         if (initgroups(username, gid) < 0)
 599                                 return -errno;
 600
 601                         keep_groups = true;
 602                 }
 603
 604                 /* Second step, set our gids */
 605                 if (setresgid(gid, gid, gid) < 0)
 606                         return -errno;
 607         }
 608
 609         if (context->supplementary_groups) {
 610                 int ngroups_max, k;
 611                 gid_t *gids;
 612                 char **i;
 613
 614                 /* Final step, initialize any manually set supplementary groups */
 615                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 616
 617                 if (!(gids = new(gid_t, ngroups_max)))
 618                         return -ENOMEM;
 619
 620                 if (keep_groups) {
 621                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 622                                 free(gids);
 623                                 return -errno;
 624                         }
 625                 } else
 626                         k = 0;
 627
 628                 STRV_FOREACH(i, context->supplementary_groups) {
 629                         const char *g;
 630
 631                         if (k >= ngroups_max) {
 632                                 free(gids);
 633                                 return -E2BIG;
 634                         }
 635
 636                         g = *i;
 637                         r = get_group_creds(&g, gids+k);
 638                         if (r < 0) {
 639                                 free(gids);
 640                                 return r;
 641                         }
 642
 643                         k++;
 644                 }
 645
 646                 if (setgroups(k, gids) < 0) {
 647                         free(gids);
 648                         return -errno;
 649                 }
 650
 651                 free(gids);
 652         }
 653
 654         return 0;
 655 }
 656
 657 static int enforce_user(const ExecContext *context, uid_t uid) {
 658         int r;
 659         assert(context);
 660
 661         /* Sets (but doesn't lookup) the uid and make sure we keep the
 662          * capabilities while doing so. */
 663
 664         if (context->capabilities) {
 665                 cap_t d;
 666                 static const cap_value_t bits[] = {
 667                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 668                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 669                 };
 670
 671                 /* First step: If we need to keep capabilities but
 672                  * drop privileges we need to make sure we keep our
 673                  * caps, whiel we drop privileges. */
 674                 if (uid != 0) {
 675                         int sb = context->secure_bits|SECURE_KEEP_CAPS;
 676
 677                         if (prctl(PR_GET_SECUREBITS) != sb)
 678                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 679                                         return -errno;
 680                 }
 681
 682                 /* Second step: set the capabilities. This will reduce
 683                  * the capabilities to the minimum we need. */
 684
 685                 if (!(d = cap_dup(context->capabilities)))
 686                         return -errno;
 687
 688                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 689                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 690                         r = -errno;
 691                         cap_free(d);
 692                         return r;
 693                 }
 694
 695                 if (cap_set_proc(d) < 0) {
 696                         r = -errno;
 697                         cap_free(d);
 698                         return r;
 699                 }
 700
 701                 cap_free(d);
 702         }
 703
 704         /* Third step: actually set the uids */
 705         if (setresuid(uid, uid, uid) < 0)
 706                 return -errno;
 707
 708         /* At this point we should have all necessary capabilities but
 709            are otherwise a normal user. However, the caps might got
 710            corrupted due to the setresuid() so we need clean them up
 711            later. This is done outside of this call. */
 712
 713         return 0;
 714 }
 715
 716 #ifdef HAVE_PAM
 717
 718 static int null_conv(
 719                 int num_msg,
 720                 const struct pam_message **msg,
 721                 struct pam_response **resp,
 722                 void *appdata_ptr) {
 723
 724         /* We don't support conversations */
 725
 726         return PAM_CONV_ERR;
 727 }
 728
 729 static int setup_pam(
 730                 const char *name,
 731                 const char *user,
 732                 uid_t uid,
 733                 const char *tty,
 734                 char ***pam_env,
 735                 int fds[], unsigned n_fds) {
 736
 737         static const struct pam_conv conv = {
 738                 .conv = null_conv,
 739                 .appdata_ptr = NULL
 740         };
 741
 742         pam_handle_t *handle = NULL;
 743         sigset_t ss, old_ss;
 744         int pam_code = PAM_SUCCESS;
 745         int err;
 746         char **e = NULL;
 747         bool close_session = false;
 748         pid_t pam_pid = 0, parent_pid;
 749
 750         assert(name);
 751         assert(user);
 752         assert(pam_env);
 753
 754         /* We set up PAM in the parent process, then fork. The child
 755          * will then stay around until killed via PR_GET_PDEATHSIG or
 756          * systemd via the cgroup logic. It will then remove the PAM
 757          * session again. The parent process will exec() the actual
 758          * daemon. We do things this way to ensure that the main PID
 759          * of the daemon is the one we initially fork()ed. */
 760
 761         if ((pam_code = pam_start(name, user, &conv, &handle)) != PAM_SUCCESS) {
 762                 handle = NULL;
 763                 goto fail;
 764         }
 765
 766         if (tty)
 767                 if ((pam_code = pam_set_item(handle, PAM_TTY, tty)) != PAM_SUCCESS)
 768                         goto fail;
 769
 770         if ((pam_code = pam_acct_mgmt(handle, PAM_SILENT)) != PAM_SUCCESS)
 771                 goto fail;
 772
 773         if ((pam_code = pam_open_session(handle, PAM_SILENT)) != PAM_SUCCESS)
 774                 goto fail;
 775
 776         close_session = true;
 777
 778         if ((!(e = pam_getenvlist(handle)))) {
 779                 pam_code = PAM_BUF_ERR;
 780                 goto fail;
 781         }
 782
 783         /* Block SIGTERM, so that we know that it won't get lost in
 784          * the child */
 785         if (sigemptyset(&ss) < 0 ||
 786             sigaddset(&ss, SIGTERM) < 0 ||
 787             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 788                 goto fail;
 789
 790         parent_pid = getpid();
 791
 792         if ((pam_pid = fork()) < 0)
 793                 goto fail;
 794
 795         if (pam_pid == 0) {
 796                 int sig;
 797                 int r = EXIT_PAM;
 798
 799                 /* The child's job is to reset the PAM session on
 800                  * termination */
 801
 802                 /* This string must fit in 10 chars (i.e. the length
 803                  * of "/sbin/init"), to look pretty in /bin/ps */
 804                 rename_process("(sd-pam)");
 805
 806                 /* Make sure we don't keep open the passed fds in this
 807                 child. We assume that otherwise only those fds are
 808                 open here that have been opened by PAM. */
 809                 close_many(fds, n_fds);
 810
 811                 /* Drop privileges - we don't need any to pam_close_session
 812                  * and this will make PR_SET_PDEATHSIG work in most cases.
 813                  * If this fails, ignore the error - but expect sd-pam threads
 814                  * to fail to exit normally */
 815                 if (setresuid(uid, uid, uid) < 0)
 816                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 817
 818                 /* Wait until our parent died. This will only work if
 819                  * the above setresuid() succeeds, otherwise the kernel
 820                  * will not allow unprivileged parents kill their privileged
 821                  * children this way. We rely on the control groups kill logic
 822                  * to do the rest for us. */
 823                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 824                         goto child_finish;
 825
 826                 /* Check if our parent process might already have
 827                  * died? */
 828                 if (getppid() == parent_pid) {
 829                         for (;;) {
 830                                 if (sigwait(&ss, &sig) < 0) {
 831                                         if (errno == EINTR)
 832                                                 continue;
 833
 834                                         goto child_finish;
 835                                 }
 836
 837                                 assert(sig == SIGTERM);
 838                                 break;
 839                         }
 840                 }
 841
 842                 /* If our parent died we'll end the session */
 843                 if (getppid() != parent_pid)
 844                         if ((pam_code = pam_close_session(handle, PAM_DATA_SILENT)) != PAM_SUCCESS)
 845                                 goto child_finish;
 846
 847                 r = 0;
 848
 849         child_finish:
 850                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 851                 _exit(r);
 852         }
 853
 854         /* If the child was forked off successfully it will do all the
 855          * cleanups, so forget about the handle here. */
 856         handle = NULL;
 857
 858         /* Unblock SIGTERM again in the parent */
 859         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 860                 goto fail;
 861
 862         /* We close the log explicitly here, since the PAM modules
 863          * might have opened it, but we don't want this fd around. */
 864         closelog();
 865
 866         *pam_env = e;
 867         e = NULL;
 868
 869         return 0;
 870
 871 fail:
 872         if (pam_code != PAM_SUCCESS)
 873                 err = -EPERM;  /* PAM errors do not map to errno */
 874         else
 875                 err = -errno;
 876
 877         if (handle) {
 878                 if (close_session)
 879                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
 880
 881                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 882         }
 883
 884         strv_free(e);
 885
 886         closelog();
 887
 888         if (pam_pid > 1) {
 889                 kill(pam_pid, SIGTERM);
 890                 kill(pam_pid, SIGCONT);
 891         }
 892
 893         return err;
 894 }
 895 #endif
 896
 897 static void rename_process_from_path(const char *path) {
 898         char process_name[11];
 899         const char *p;
 900         size_t l;
 901
 902         /* This resulting string must fit in 10 chars (i.e. the length
 903          * of "/sbin/init") to look pretty in /bin/ps */
 904
 905         p = path_get_file_name(path);
 906         if (isempty(p)) {
 907                 rename_process("(...)");
 908                 return;
 909         }
 910
 911         l = strlen(p);
 912         if (l > 8) {
 913                 /* The end of the process name is usually more
 914                  * interesting, since the first bit might just be
 915                  * "systemd-" */
 916                 p = p + l - 8;
 917                 l = 8;
 918         }
 919
 920         process_name[0] = '(';
 921         memcpy(process_name+1, p, l);
 922         process_name[1+l] = ')';
 923         process_name[1+l+1] = 0;
 924
 925         rename_process(process_name);
 926 }
 927
 928 static int apply_seccomp(uint32_t *syscall_filter) {
 929         static const struct sock_filter header[] = {
 930                 VALIDATE_ARCHITECTURE,
 931                 EXAMINE_SYSCALL
 932         };
 933         static const struct sock_filter footer[] = {
 934                 _KILL_PROCESS
 935         };
 936
 937         int i;
 938         unsigned n;
 939         struct sock_filter *f;
 940         struct sock_fprog prog;
 941
 942         assert(syscall_filter);
 943
 944         /* First: count the syscalls to check for */
 945         for (i = 0, n = 0; i < syscall_max(); i++)
 946                 if (syscall_filter[i >> 4] & (1 << (i & 31)))
 947                         n++;
 948
 949         /* Second: build the filter program from a header the syscall
 950          * matches and the footer */
 951         f = alloca(sizeof(struct sock_filter) * (ELEMENTSOF(header) + 2*n + ELEMENTSOF(footer)));
 952         memcpy(f, header, sizeof(header));
 953
 954         for (i = 0, n = 0; i < syscall_max(); i++)
 955                 if (syscall_filter[i >> 4] & (1 << (i & 31))) {
 956                         struct sock_filter item[] = {
 957                                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, INDEX_TO_SYSCALL(i), 0, 1),
 958                                 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 959                         };
 960
 961                         assert_cc(ELEMENTSOF(item) == 2);
 962
 963                         f[ELEMENTSOF(header) + 2*n]  = item[0];
 964                         f[ELEMENTSOF(header) + 2*n+1] = item[1];
 965
 966                         n++;
 967                 }
 968
 969         memcpy(f + (ELEMENTSOF(header) + 2*n), footer, sizeof(footer));
 970
 971         /* Third: install the filter */
 972         zero(prog);
 973         prog.len = ELEMENTSOF(header) + ELEMENTSOF(footer) + 2*n;
 974         prog.filter = f;
 975         if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0)
 976                 return -errno;
 977
 978         return 0;
 979 }
 980
 981 int exec_spawn(ExecCommand *command,
 982                char **argv,
 983                ExecContext *context,
 984                int fds[], unsigned n_fds,
 985                char **environment,
 986                bool apply_permissions,
 987                bool apply_chroot,
 988                bool apply_tty_stdin,
 989                bool confirm_spawn,
 990                CGroupBonding *cgroup_bondings,
 991                CGroupAttribute *cgroup_attributes,
 992                const char *cgroup_suffix,
 993                const char *unit_id,
 994                int idle_pipe[2],
 995                pid_t *ret) {
 996
 997         pid_t pid;
 998         int r;
 999         char *line;
1000         int socket_fd;
1001         char _cleanup_strv_free_ **files_env = NULL;
1002
1003         assert(command);
1004         assert(context);
1005         assert(ret);
1006         assert(fds || n_fds <= 0);
1007
1008         if (context->std_input == EXEC_INPUT_SOCKET ||
1009             context->std_output == EXEC_OUTPUT_SOCKET ||
1010             context->std_error == EXEC_OUTPUT_SOCKET) {
1011
1012                 if (n_fds != 1)
1013                         return -EINVAL;
1014
1015                 socket_fd = fds[0];
1016
1017                 fds = NULL;
1018                 n_fds = 0;
1019         } else
1020                 socket_fd = -1;
1021
1022         r = exec_context_load_environment(context, &files_env);
1023         if (r < 0) {
1024                 log_struct_unit(LOG_ERR,
1025                            unit_id,
1026                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1027                            "ERRNO=%d", -r,
1028                            NULL);
1029                 return r;
1030         }
1031
1032         if (!argv)
1033                 argv = command->argv;
1034
1035         line = exec_command_line(argv);
1036         if (!line)
1037                 return log_oom();
1038
1039         log_struct_unit(LOG_DEBUG,
1040                    unit_id,
1041                    "MESSAGE=About to execute %s", line,
1042                    NULL);
1043         free(line);
1044
1045         r = cgroup_bonding_realize_list(cgroup_bondings);
1046         if (r < 0)
1047                 return r;
1048
1049         cgroup_attribute_apply_list(cgroup_attributes, cgroup_bondings);
1050
1051         if (context->private_tmp && !context->tmp_dir && !context->var_tmp_dir) {
1052                 r = setup_tmpdirs(&context->tmp_dir, &context->var_tmp_dir);
1053                 if (r < 0)
1054                         return r;
1055         }
1056
1057         pid = fork();
1058         if (pid < 0)
1059                 return -errno;
1060
1061         if (pid == 0) {
1062                 int i, err;
1063                 sigset_t ss;
1064                 const char *username = NULL, *home = NULL;
1065                 uid_t uid = (uid_t) -1;
1066                 gid_t gid = (gid_t) -1;
1067                 char _cleanup_strv_free_ **our_env = NULL, **pam_env = NULL,
1068                         **final_env = NULL, **final_argv = NULL;
1069                 unsigned n_env = 0;
1070                 bool set_access = false;
1071
1072                 /* child */
1073
1074                 rename_process_from_path(command->path);
1075
1076                 /* We reset exactly these signals, since they are the
1077                  * only ones we set to SIG_IGN in the main daemon. All
1078                  * others we leave untouched because we set them to
1079                  * SIG_DFL or a valid handler initially, both of which
1080                  * will be demoted to SIG_DFL. */
1081                 default_signals(SIGNALS_CRASH_HANDLER,
1082                                 SIGNALS_IGNORE, -1);
1083
1084                 if (context->ignore_sigpipe)
1085                         ignore_signals(SIGPIPE, -1);
1086
1087                 assert_se(sigemptyset(&ss) == 0);
1088                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1089                         err = -errno;
1090                         r = EXIT_SIGNAL_MASK;
1091                         goto fail_child;
1092                 }
1093
1094                 if (idle_pipe) {
1095                         if (idle_pipe[1] >= 0)
1096                                 close_nointr_nofail(idle_pipe[1]);
1097                         if (idle_pipe[0] >= 0) {
1098                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1099                                 close_nointr_nofail(idle_pipe[0]);
1100                         }
1101                 }
1102
1103                 /* Close sockets very early to make sure we don't
1104                  * block init reexecution because it cannot bind its
1105                  * sockets */
1106                 log_forget_fds();
1107                 err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
1108                                            socket_fd >= 0 ? 1 : n_fds);
1109                 if (err < 0) {
1110                         r = EXIT_FDS;
1111                         goto fail_child;
1112                 }
1113
1114                 if (!context->same_pgrp)
1115                         if (setsid() < 0) {
1116                                 err = -errno;
1117                                 r = EXIT_SETSID;
1118                                 goto fail_child;
1119                         }
1120
1121                 if (context->tcpwrap_name) {
1122                         if (socket_fd >= 0)
1123                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1124                                         err = -EACCES;
1125                                         r = EXIT_TCPWRAP;
1126                                         goto fail_child;
1127                                 }
1128
1129                         for (i = 0; i < (int) n_fds; i++) {
1130                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1131                                         err = -EACCES;
1132                                         r = EXIT_TCPWRAP;
1133                                         goto fail_child;
1134                                 }
1135                         }
1136                 }
1137
1138                 exec_context_tty_reset(context);
1139
1140                 if (confirm_spawn) {
1141                         char response;
1142
1143                         err = ask_for_confirmation(&response, argv);
1144                         if (err == -ETIMEDOUT)
1145                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1146                         else if (err < 0)
1147                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1148                         else if (response == 's') {
1149                                 write_confirm_message("Skipping execution.\n");
1150                                 err = -ECANCELED;
1151                                 r = EXIT_CONFIRM;
1152                                 goto fail_child;
1153                         } else if (response == 'n') {
1154                                 write_confirm_message("Failing execution.\n");
1155                                 err = r = 0;
1156                                 goto fail_child;
1157                         }
1158                 }
1159
1160                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1161                  * must sure to drop O_NONBLOCK */
1162                 if (socket_fd >= 0)
1163                         fd_nonblock(socket_fd, false);
1164
1165                 err = setup_input(context, socket_fd, apply_tty_stdin);
1166                 if (err < 0) {
1167                         r = EXIT_STDIN;
1168                         goto fail_child;
1169                 }
1170
1171                 err = setup_output(context, STDOUT_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1172                 if (err < 0) {
1173                         r = EXIT_STDOUT;
1174                         goto fail_child;
1175                 }
1176
1177                 err = setup_output(context, STDERR_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1178                 if (err < 0) {
1179                         r = EXIT_STDERR;
1180                         goto fail_child;
1181                 }
1182
1183                 if (cgroup_bondings) {
1184                         err = cgroup_bonding_install_list(cgroup_bondings, 0, cgroup_suffix);
1185                         if (err < 0) {
1186                                 r = EXIT_CGROUP;
1187                                 goto fail_child;
1188                         }
1189                 }
1190
1191                 if (context->oom_score_adjust_set) {
1192                         char t[16];
1193
1194                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1195                         char_array_0(t);
1196
1197                         if (write_one_line_file("/proc/self/oom_score_adj", t) < 0) {
1198                                 err = -errno;
1199                                 r = EXIT_OOM_ADJUST;
1200                                 goto fail_child;
1201                         }
1202                 }
1203
1204                 if (context->nice_set)
1205                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1206                                 err = -errno;
1207                                 r = EXIT_NICE;
1208                                 goto fail_child;
1209                         }
1210
1211                 if (context->cpu_sched_set) {
1212                         struct sched_param param;
1213
1214                         zero(param);
1215                         param.sched_priority = context->cpu_sched_priority;
1216
1217                         if (sched_setscheduler(0, context->cpu_sched_policy |
1218                                                (context->cpu_sched_reset_on_fork ? SCHED_RESET_ON_FORK : 0), &param) < 0) {
1219                                 err = -errno;
1220                                 r = EXIT_SETSCHEDULER;
1221                                 goto fail_child;
1222                         }
1223                 }
1224
1225                 if (context->cpuset)
1226                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1227                                 err = -errno;
1228                                 r = EXIT_CPUAFFINITY;
1229                                 goto fail_child;
1230                         }
1231
1232                 if (context->ioprio_set)
1233                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1234                                 err = -errno;
1235                                 r = EXIT_IOPRIO;
1236                                 goto fail_child;
1237                         }
1238
1239                 if (context->timer_slack_nsec != (nsec_t) -1)
1240                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1241                                 err = -errno;
1242                                 r = EXIT_TIMERSLACK;
1243                                 goto fail_child;
1244                         }
1245
1246                 if (context->utmp_id)
1247                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1248
1249                 if (context->user) {
1250                         username = context->user;
1251                         err = get_user_creds(&username, &uid, &gid, &home, NULL);
1252                         if (err < 0) {
1253                                 r = EXIT_USER;
1254                                 goto fail_child;
1255                         }
1256
1257                         if (is_terminal_input(context->std_input)) {
1258                                 err = chown_terminal(STDIN_FILENO, uid);
1259                                 if (err < 0) {
1260                                         r = EXIT_STDIN;
1261                                         goto fail_child;
1262                                 }
1263                         }
1264
1265                         if (cgroup_bondings && context->control_group_modify) {
1266                                 err = cgroup_bonding_set_group_access_list(cgroup_bondings, 0755, uid, gid);
1267                                 if (err >= 0)
1268                                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, 0644, uid, gid, context->control_group_persistent);
1269                                 if (err < 0) {
1270                                         r = EXIT_CGROUP;
1271                                         goto fail_child;
1272                                 }
1273
1274                                 set_access = true;
1275                         }
1276                 }
1277
1278                 if (cgroup_bondings && !set_access && context->control_group_persistent >= 0)  {
1279                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, (mode_t) -1, (uid_t) -1, (uid_t) -1, context->control_group_persistent);
1280                         if (err < 0) {
1281                                 r = EXIT_CGROUP;
1282                                 goto fail_child;
1283                         }
1284                 }
1285
1286                 if (apply_permissions) {
1287                         err = enforce_groups(context, username, gid);
1288                         if (err < 0) {
1289                                 r = EXIT_GROUP;
1290                                 goto fail_child;
1291                         }
1292                 }
1293
1294                 umask(context->umask);
1295
1296 #ifdef HAVE_PAM
1297                 if (apply_permissions && context->pam_name && username) {
1298                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1299                         if (err < 0) {
1300                                 r = EXIT_PAM;
1301                                 goto fail_child;
1302                         }
1303                 }
1304 #endif
1305                 if (context->private_network) {
1306                         if (unshare(CLONE_NEWNET) < 0) {
1307                                 err = -errno;
1308                                 r = EXIT_NETWORK;
1309                                 goto fail_child;
1310                         }
1311
1312                         loopback_setup();
1313                 }
1314
1315                 if (strv_length(context->read_write_dirs) > 0 ||
1316                     strv_length(context->read_only_dirs) > 0 ||
1317                     strv_length(context->inaccessible_dirs) > 0 ||
1318                     context->mount_flags != 0 ||
1319                     context->private_tmp) {
1320                         err = setup_namespace(context->read_write_dirs,
1321                                               context->read_only_dirs,
1322                                               context->inaccessible_dirs,
1323                                               context->tmp_dir,
1324                                               context->var_tmp_dir,
1325                                               context->private_tmp,
1326                                               context->mount_flags);
1327                         if (err < 0) {
1328                                 r = EXIT_NAMESPACE;
1329                                 goto fail_child;
1330                         }
1331                 }
1332
1333                 if (apply_chroot) {
1334                         if (context->root_directory)
1335                                 if (chroot(context->root_directory) < 0) {
1336                                         err = -errno;
1337                                         r = EXIT_CHROOT;
1338                                         goto fail_child;
1339                                 }
1340
1341                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1342                                 err = -errno;
1343                                 r = EXIT_CHDIR;
1344                                 goto fail_child;
1345                         }
1346                 } else {
1347                         char _cleanup_free_ *d = NULL;
1348
1349                         if (asprintf(&d, "%s/%s",
1350                                      context->root_directory ? context->root_directory : "",
1351                                      context->working_directory ? context->working_directory : "") < 0) {
1352                                 err = -ENOMEM;
1353                                 r = EXIT_MEMORY;
1354                                 goto fail_child;
1355                         }
1356
1357                         if (chdir(d) < 0) {
1358                                 err = -errno;
1359                                 r = EXIT_CHDIR;
1360                                 goto fail_child;
1361                         }
1362                 }
1363
1364                 /* We repeat the fd closing here, to make sure that
1365                  * nothing is leaked from the PAM modules */
1366                 err = close_all_fds(fds, n_fds);
1367                 if (err >= 0)
1368                         err = shift_fds(fds, n_fds);
1369                 if (err >= 0)
1370                         err = flags_fds(fds, n_fds, context->non_blocking);
1371                 if (err < 0) {
1372                         r = EXIT_FDS;
1373                         goto fail_child;
1374                 }
1375
1376                 if (apply_permissions) {
1377
1378                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1379                                 if (!context->rlimit[i])
1380                                         continue;
1381
1382                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1383                                         err = -errno;
1384                                         r = EXIT_LIMITS;
1385                                         goto fail_child;
1386                                 }
1387                         }
1388
1389                         if (context->capability_bounding_set_drop) {
1390                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1391                                 if (err < 0) {
1392                                         r = EXIT_CAPABILITIES;
1393                                         goto fail_child;
1394                                 }
1395                         }
1396
1397                         if (context->user) {
1398                                 err = enforce_user(context, uid);
1399                                 if (err < 0) {
1400                                         r = EXIT_USER;
1401                                         goto fail_child;
1402                                 }
1403                         }
1404
1405                         /* PR_GET_SECUREBITS is not privileged, while
1406                          * PR_SET_SECUREBITS is. So to suppress
1407                          * potential EPERMs we'll try not to call
1408                          * PR_SET_SECUREBITS unless necessary. */
1409                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1410                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1411                                         err = -errno;
1412                                         r = EXIT_SECUREBITS;
1413                                         goto fail_child;
1414                                 }
1415
1416                         if (context->capabilities)
1417                                 if (cap_set_proc(context->capabilities) < 0) {
1418                                         err = -errno;
1419                                         r = EXIT_CAPABILITIES;
1420                                         goto fail_child;
1421                                 }
1422
1423                         if (context->no_new_privileges)
1424                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1425                                         err = -errno;
1426                                         r = EXIT_NO_NEW_PRIVILEGES;
1427                                         goto fail_child;
1428                                 }
1429
1430                         if (context->syscall_filter) {
1431                                 err = apply_seccomp(context->syscall_filter);
1432                                 if (err < 0) {
1433                                         r = EXIT_SECCOMP;
1434                                         goto fail_child;
1435                                 }
1436                         }
1437                 }
1438
1439                 if (!(our_env = new0(char*, 7))) {
1440                         err = -ENOMEM;
1441                         r = EXIT_MEMORY;
1442                         goto fail_child;
1443                 }
1444
1445                 if (n_fds > 0)
1446                         if (asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1447                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0) {
1448                                 err = -ENOMEM;
1449                                 r = EXIT_MEMORY;
1450                                 goto fail_child;
1451                         }
1452
1453                 if (home)
1454                         if (asprintf(our_env + n_env++, "HOME=%s", home) < 0) {
1455                                 err = -ENOMEM;
1456                                 r = EXIT_MEMORY;
1457                                 goto fail_child;
1458                         }
1459
1460                 if (username)
1461                         if (asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1462                             asprintf(our_env + n_env++, "USER=%s", username) < 0) {
1463                                 err = -ENOMEM;
1464                                 r = EXIT_MEMORY;
1465                                 goto fail_child;
1466                         }
1467
1468                 if (is_terminal_input(context->std_input) ||
1469                     context->std_output == EXEC_OUTPUT_TTY ||
1470                     context->std_error == EXEC_OUTPUT_TTY)
1471                         if (!(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))) {
1472                                 err = -ENOMEM;
1473                                 r = EXIT_MEMORY;
1474                                 goto fail_child;
1475                         }
1476
1477                 assert(n_env <= 7);
1478
1479                 if (!(final_env = strv_env_merge(
1480                                       5,
1481                                       environment,
1482                                       our_env,
1483                                       context->environment,
1484                                       files_env,
1485                                       pam_env,
1486                                       NULL))) {
1487                         err = -ENOMEM;
1488                         r = EXIT_MEMORY;
1489                         goto fail_child;
1490                 }
1491
1492                 if (!(final_argv = replace_env_argv(argv, final_env))) {
1493                         err = -ENOMEM;
1494                         r = EXIT_MEMORY;
1495                         goto fail_child;
1496                 }
1497
1498                 final_env = strv_env_clean(final_env);
1499
1500                 execve(command->path, final_argv, final_env);
1501                 err = -errno;
1502                 r = EXIT_EXEC;
1503
1504         fail_child:
1505                 if (r != 0) {
1506                         log_open();
1507                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1508                                    "EXECUTABLE=%s", command->path,
1509                                    "MESSAGE=Failed at step %s spawning %s: %s",
1510                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1511                                           command->path, strerror(-err),
1512                                    "ERRNO=%d", -err,
1513                                    NULL);
1514                         log_close();
1515                 }
1516
1517                 _exit(r);
1518         }
1519
1520         log_struct_unit(LOG_DEBUG,
1521                    unit_id,
1522                    "MESSAGE=Forked %s as %lu",
1523                           command->path, (unsigned long) pid,
1524                    NULL);
1525
1526         /* We add the new process to the cgroup both in the child (so
1527          * that we can be sure that no user code is ever executed
1528          * outside of the cgroup) and in the parent (so that we can be
1529          * sure that when we kill the cgroup the process will be
1530          * killed too). */
1531         if (cgroup_bondings)
1532                 cgroup_bonding_install_list(cgroup_bondings, pid, cgroup_suffix);
1533
1534         exec_status_start(&command->exec_status, pid);
1535
1536         *ret = pid;
1537         return 0;
1538 }
1539
1540 void exec_context_init(ExecContext *c) {
1541         assert(c);
1542
1543         c->umask = 0022;
1544         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1545         c->cpu_sched_policy = SCHED_OTHER;
1546         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1547         c->syslog_level_prefix = true;
1548         c->control_group_persistent = -1;
1549         c->ignore_sigpipe = true;
1550         c->timer_slack_nsec = (nsec_t) -1;
1551 }
1552
1553 void exec_context_tmp_dirs_done(ExecContext *c) {
1554         assert(c);
1555
1556         if (c->tmp_dir) {
1557                 rm_rf_dangerous(c->tmp_dir, false, true, false);
1558                 free(c->tmp_dir);
1559                 c->tmp_dir = NULL;
1560         }
1561
1562         if (c->var_tmp_dir) {
1563                 rm_rf_dangerous(c->var_tmp_dir, false, true, false);
1564                 free(c->var_tmp_dir);
1565                 c->var_tmp_dir = NULL;
1566         }
1567 }
1568
1569 void exec_context_done(ExecContext *c, bool reloading_or_reexecuting) {
1570         unsigned l;
1571
1572         assert(c);
1573
1574         strv_free(c->environment);
1575         c->environment = NULL;
1576
1577         strv_free(c->environment_files);
1578         c->environment_files = NULL;
1579
1580         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1581                 free(c->rlimit[l]);
1582                 c->rlimit[l] = NULL;
1583         }
1584
1585         free(c->working_directory);
1586         c->working_directory = NULL;
1587         free(c->root_directory);
1588         c->root_directory = NULL;
1589
1590         free(c->tty_path);
1591         c->tty_path = NULL;
1592
1593         free(c->tcpwrap_name);
1594         c->tcpwrap_name = NULL;
1595
1596         free(c->syslog_identifier);
1597         c->syslog_identifier = NULL;
1598
1599         free(c->user);
1600         c->user = NULL;
1601
1602         free(c->group);
1603         c->group = NULL;
1604
1605         strv_free(c->supplementary_groups);
1606         c->supplementary_groups = NULL;
1607
1608         free(c->pam_name);
1609         c->pam_name = NULL;
1610
1611         if (c->capabilities) {
1612                 cap_free(c->capabilities);
1613                 c->capabilities = NULL;
1614         }
1615
1616         strv_free(c->read_only_dirs);
1617         c->read_only_dirs = NULL;
1618
1619         strv_free(c->read_write_dirs);
1620         c->read_write_dirs = NULL;
1621
1622         strv_free(c->inaccessible_dirs);
1623         c->inaccessible_dirs = NULL;
1624
1625         if (c->cpuset)
1626                 CPU_FREE(c->cpuset);
1627
1628         free(c->utmp_id);
1629         c->utmp_id = NULL;
1630
1631         free(c->syscall_filter);
1632         c->syscall_filter = NULL;
1633
1634         if (!reloading_or_reexecuting)
1635                 exec_context_tmp_dirs_done(c);
1636 }
1637
1638 void exec_command_done(ExecCommand *c) {
1639         assert(c);
1640
1641         free(c->path);
1642         c->path = NULL;
1643
1644         strv_free(c->argv);
1645         c->argv = NULL;
1646 }
1647
1648 void exec_command_done_array(ExecCommand *c, unsigned n) {
1649         unsigned i;
1650
1651         for (i = 0; i < n; i++)
1652                 exec_command_done(c+i);
1653 }
1654
1655 void exec_command_free_list(ExecCommand *c) {
1656         ExecCommand *i;
1657
1658         while ((i = c)) {
1659                 LIST_REMOVE(ExecCommand, command, c, i);
1660                 exec_command_done(i);
1661                 free(i);
1662         }
1663 }
1664
1665 void exec_command_free_array(ExecCommand **c, unsigned n) {
1666         unsigned i;
1667
1668         for (i = 0; i < n; i++) {
1669                 exec_command_free_list(c[i]);
1670                 c[i] = NULL;
1671         }
1672 }
1673
1674 int exec_context_load_environment(const ExecContext *c, char ***l) {
1675         char **i, **r = NULL;
1676
1677         assert(c);
1678         assert(l);
1679
1680         STRV_FOREACH(i, c->environment_files) {
1681                 char *fn;
1682                 int k;
1683                 bool ignore = false;
1684                 char **p;
1685                 glob_t pglob;
1686                 int count, n;
1687
1688                 fn = *i;
1689
1690                 if (fn[0] == '-') {
1691                         ignore = true;
1692                         fn ++;
1693                 }
1694
1695                 if (!path_is_absolute(fn)) {
1696
1697                         if (ignore)
1698                                 continue;
1699
1700                         strv_free(r);
1701                         return -EINVAL;
1702                 }
1703
1704                 /* Filename supports globbing, take all matching files */
1705                 zero(pglob);
1706                 errno = 0;
1707                 if (glob(fn, 0, NULL, &pglob) != 0) {
1708                         globfree(&pglob);
1709                         if (ignore)
1710                                 continue;
1711
1712                         strv_free(r);
1713                         return errno ? -errno : -EINVAL;
1714                 }
1715                 count = pglob.gl_pathc;
1716                 if (count == 0) {
1717                         globfree(&pglob);
1718                         if (ignore)
1719                                 continue;
1720
1721                         strv_free(r);
1722                         return -EINVAL;
1723                 }
1724                 for (n = 0; n < count; n++) {
1725                         k = load_env_file(pglob.gl_pathv[n], &p);
1726                         if (k < 0) {
1727                                 if (ignore)
1728                                         continue;
1729
1730                                 strv_free(r);
1731                                 globfree(&pglob);
1732                                 return k;
1733                          }
1734
1735                         if (r == NULL)
1736                                 r = p;
1737                         else {
1738                                 char **m;
1739
1740                                 m = strv_env_merge(2, r, p);
1741                                 strv_free(r);
1742                                 strv_free(p);
1743
1744                                 if (!m) {
1745                                         globfree(&pglob);
1746                                         return -ENOMEM;
1747                                 }
1748
1749                                 r = m;
1750                         }
1751                 }
1752                 globfree(&pglob);
1753         }
1754
1755         *l = r;
1756
1757         return 0;
1758 }
1759
1760 static bool tty_may_match_dev_console(const char *tty) {
1761         char *active = NULL, *console;
1762         bool b;
1763
1764         if (startswith(tty, "/dev/"))
1765                 tty += 5;
1766
1767         /* trivial identity? */
1768         if (streq(tty, "console"))
1769                 return true;
1770
1771         console = resolve_dev_console(&active);
1772         /* if we could not resolve, assume it may */
1773         if (!console)
1774                 return true;
1775
1776         /* "tty0" means the active VC, so it may be the same sometimes */
1777         b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
1778         free(active);
1779
1780         return b;
1781 }
1782
1783 bool exec_context_may_touch_console(ExecContext *ec) {
1784         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
1785                 is_terminal_input(ec->std_input) ||
1786                 is_terminal_output(ec->std_output) ||
1787                 is_terminal_output(ec->std_error)) &&
1788                tty_may_match_dev_console(tty_path(ec));
1789 }
1790
1791 static void strv_fprintf(FILE *f, char **l) {
1792         char **g;
1793
1794         assert(f);
1795
1796         STRV_FOREACH(g, l)
1797                 fprintf(f, " %s", *g);
1798 }
1799
1800 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1801         char ** e;
1802         unsigned i;
1803
1804         assert(c);
1805         assert(f);
1806
1807         if (!prefix)
1808                 prefix = "";
1809
1810         fprintf(f,
1811                 "%sUMask: %04o\n"
1812                 "%sWorkingDirectory: %s\n"
1813                 "%sRootDirectory: %s\n"
1814                 "%sNonBlocking: %s\n"
1815                 "%sPrivateTmp: %s\n"
1816                 "%sControlGroupModify: %s\n"
1817                 "%sControlGroupPersistent: %s\n"
1818                 "%sPrivateNetwork: %s\n"
1819                 "%sIgnoreSIGPIPE: %s\n",
1820                 prefix, c->umask,
1821                 prefix, c->working_directory ? c->working_directory : "/",
1822                 prefix, c->root_directory ? c->root_directory : "/",
1823                 prefix, yes_no(c->non_blocking),
1824                 prefix, yes_no(c->private_tmp),
1825                 prefix, yes_no(c->control_group_modify),
1826                 prefix, yes_no(c->control_group_persistent),
1827                 prefix, yes_no(c->private_network),
1828                 prefix, yes_no(c->ignore_sigpipe));
1829
1830         STRV_FOREACH(e, c->environment)
1831                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1832
1833         STRV_FOREACH(e, c->environment_files)
1834                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1835
1836         if (c->tcpwrap_name)
1837                 fprintf(f,
1838                         "%sTCPWrapName: %s\n",
1839                         prefix, c->tcpwrap_name);
1840
1841         if (c->nice_set)
1842                 fprintf(f,
1843                         "%sNice: %i\n",
1844                         prefix, c->nice);
1845
1846         if (c->oom_score_adjust_set)
1847                 fprintf(f,
1848                         "%sOOMScoreAdjust: %i\n",
1849                         prefix, c->oom_score_adjust);
1850
1851         for (i = 0; i < RLIM_NLIMITS; i++)
1852                 if (c->rlimit[i])
1853                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1854
1855         if (c->ioprio_set) {
1856                 char *class_str;
1857                 int r;
1858
1859                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
1860                 if (r < 0)
1861                         class_str = NULL;
1862                 fprintf(f,
1863                         "%sIOSchedulingClass: %s\n"
1864                         "%sIOPriority: %i\n",
1865                         prefix, strna(class_str),
1866                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1867                 free(class_str);
1868         }
1869
1870         if (c->cpu_sched_set) {
1871                 char *policy_str;
1872                 int r;
1873
1874                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
1875                 if (r < 0)
1876                         policy_str = NULL;
1877                 fprintf(f,
1878                         "%sCPUSchedulingPolicy: %s\n"
1879                         "%sCPUSchedulingPriority: %i\n"
1880                         "%sCPUSchedulingResetOnFork: %s\n",
1881                         prefix, strna(policy_str),
1882                         prefix, c->cpu_sched_priority,
1883                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1884                 free(policy_str);
1885         }
1886
1887         if (c->cpuset) {
1888                 fprintf(f, "%sCPUAffinity:", prefix);
1889                 for (i = 0; i < c->cpuset_ncpus; i++)
1890                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1891                                 fprintf(f, " %i", i);
1892                 fputs("\n", f);
1893         }
1894
1895         if (c->timer_slack_nsec != (nsec_t) -1)
1896                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, (unsigned long)c->timer_slack_nsec);
1897
1898         fprintf(f,
1899                 "%sStandardInput: %s\n"
1900                 "%sStandardOutput: %s\n"
1901                 "%sStandardError: %s\n",
1902                 prefix, exec_input_to_string(c->std_input),
1903                 prefix, exec_output_to_string(c->std_output),
1904                 prefix, exec_output_to_string(c->std_error));
1905
1906         if (c->tty_path)
1907                 fprintf(f,
1908                         "%sTTYPath: %s\n"
1909                         "%sTTYReset: %s\n"
1910                         "%sTTYVHangup: %s\n"
1911                         "%sTTYVTDisallocate: %s\n",
1912                         prefix, c->tty_path,
1913                         prefix, yes_no(c->tty_reset),
1914                         prefix, yes_no(c->tty_vhangup),
1915                         prefix, yes_no(c->tty_vt_disallocate));
1916
1917         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1918             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1919             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1920             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
1921                 char *fac_str, *lvl_str;
1922                 int r;
1923
1924                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
1925                 if (r < 0)
1926                         fac_str = NULL;
1927
1928                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
1929                 if (r < 0)
1930                         lvl_str = NULL;
1931
1932                 fprintf(f,
1933                         "%sSyslogFacility: %s\n"
1934                         "%sSyslogLevel: %s\n",
1935                         prefix, strna(fac_str),
1936                         prefix, strna(lvl_str));
1937                 free(lvl_str);
1938                 free(fac_str);
1939         }
1940
1941         if (c->capabilities) {
1942                 char *t;
1943                 if ((t = cap_to_text(c->capabilities, NULL))) {
1944                         fprintf(f, "%sCapabilities: %s\n",
1945                                 prefix, t);
1946                         cap_free(t);
1947                 }
1948         }
1949
1950         if (c->secure_bits)
1951                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1952                         prefix,
1953                         (c->secure_bits & SECURE_KEEP_CAPS) ? " keep-caps" : "",
1954                         (c->secure_bits & SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1955                         (c->secure_bits & SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1956                         (c->secure_bits & SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1957                         (c->secure_bits & SECURE_NOROOT) ? " noroot" : "",
1958                         (c->secure_bits & SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1959
1960         if (c->capability_bounding_set_drop) {
1961                 unsigned long l;
1962                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1963
1964                 for (l = 0; l <= cap_last_cap(); l++)
1965                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1966                                 char *t;
1967
1968                                 if ((t = cap_to_name(l))) {
1969                                         fprintf(f, " %s", t);
1970                                         cap_free(t);
1971                                 }
1972                         }
1973
1974                 fputs("\n", f);
1975         }
1976
1977         if (c->user)
1978                 fprintf(f, "%sUser: %s\n", prefix, c->user);
1979         if (c->group)
1980                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
1981
1982         if (strv_length(c->supplementary_groups) > 0) {
1983                 fprintf(f, "%sSupplementaryGroups:", prefix);
1984                 strv_fprintf(f, c->supplementary_groups);
1985                 fputs("\n", f);
1986         }
1987
1988         if (c->pam_name)
1989                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
1990
1991         if (strv_length(c->read_write_dirs) > 0) {
1992                 fprintf(f, "%sReadWriteDirs:", prefix);
1993                 strv_fprintf(f, c->read_write_dirs);
1994                 fputs("\n", f);
1995         }
1996
1997         if (strv_length(c->read_only_dirs) > 0) {
1998                 fprintf(f, "%sReadOnlyDirs:", prefix);
1999                 strv_fprintf(f, c->read_only_dirs);
2000                 fputs("\n", f);
2001         }
2002
2003         if (strv_length(c->inaccessible_dirs) > 0) {
2004                 fprintf(f, "%sInaccessibleDirs:", prefix);
2005                 strv_fprintf(f, c->inaccessible_dirs);
2006                 fputs("\n", f);
2007         }
2008
2009         if (c->utmp_id)
2010                 fprintf(f,
2011                         "%sUtmpIdentifier: %s\n",
2012                         prefix, c->utmp_id);
2013 }
2014
2015 void exec_status_start(ExecStatus *s, pid_t pid) {
2016         assert(s);
2017
2018         zero(*s);
2019         s->pid = pid;
2020         dual_timestamp_get(&s->start_timestamp);
2021 }
2022
2023 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2024         assert(s);
2025
2026         if (s->pid && s->pid != pid)
2027                 zero(*s);
2028
2029         s->pid = pid;
2030         dual_timestamp_get(&s->exit_timestamp);
2031
2032         s->code = code;
2033         s->status = status;
2034
2035         if (context) {
2036                 if (context->utmp_id)
2037                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2038
2039                 exec_context_tty_reset(context);
2040         }
2041 }
2042
2043 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2044         char buf[FORMAT_TIMESTAMP_MAX];
2045
2046         assert(s);
2047         assert(f);
2048
2049         if (!prefix)
2050                 prefix = "";
2051
2052         if (s->pid <= 0)
2053                 return;
2054
2055         fprintf(f,
2056                 "%sPID: %lu\n",
2057                 prefix, (unsigned long) s->pid);
2058
2059         if (s->start_timestamp.realtime > 0)
2060                 fprintf(f,
2061                         "%sStart Timestamp: %s\n",
2062                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2063
2064         if (s->exit_timestamp.realtime > 0)
2065                 fprintf(f,
2066                         "%sExit Timestamp: %s\n"
2067                         "%sExit Code: %s\n"
2068                         "%sExit Status: %i\n",
2069                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2070                         prefix, sigchld_code_to_string(s->code),
2071                         prefix, s->status);
2072 }
2073
2074 char *exec_command_line(char **argv) {
2075         size_t k;
2076         char *n, *p, **a;
2077         bool first = true;
2078
2079         assert(argv);
2080
2081         k = 1;
2082         STRV_FOREACH(a, argv)
2083                 k += strlen(*a)+3;
2084
2085         if (!(n = new(char, k)))
2086                 return NULL;
2087
2088         p = n;
2089         STRV_FOREACH(a, argv) {
2090
2091                 if (!first)
2092                         *(p++) = ' ';
2093                 else
2094                         first = false;
2095
2096                 if (strpbrk(*a, WHITESPACE)) {
2097                         *(p++) = '\'';
2098                         p = stpcpy(p, *a);
2099                         *(p++) = '\'';
2100                 } else
2101                         p = stpcpy(p, *a);
2102
2103         }
2104
2105         *p = 0;
2106
2107         /* FIXME: this doesn't really handle arguments that have
2108          * spaces and ticks in them */
2109
2110         return n;
2111 }
2112
2113 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2114         char *p2;
2115         const char *prefix2;
2116
2117         char *cmd;
2118
2119         assert(c);
2120         assert(f);
2121
2122         if (!prefix)
2123                 prefix = "";
2124         p2 = strappend(prefix, "\t");
2125         prefix2 = p2 ? p2 : prefix;
2126
2127         cmd = exec_command_line(c->argv);
2128
2129         fprintf(f,
2130                 "%sCommand Line: %s\n",
2131                 prefix, cmd ? cmd : strerror(ENOMEM));
2132
2133         free(cmd);
2134
2135         exec_status_dump(&c->exec_status, f, prefix2);
2136
2137         free(p2);
2138 }
2139
2140 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2141         assert(f);
2142
2143         if (!prefix)
2144                 prefix = "";
2145
2146         LIST_FOREACH(command, c, c)
2147                 exec_command_dump(c, f, prefix);
2148 }
2149
2150 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2151         ExecCommand *end;
2152
2153         assert(l);
2154         assert(e);
2155
2156         if (*l) {
2157                 /* It's kind of important, that we keep the order here */
2158                 LIST_FIND_TAIL(ExecCommand, command, *l, end);
2159                 LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
2160         } else
2161               *l = e;
2162 }
2163
2164 int exec_command_set(ExecCommand *c, const char *path, ...) {
2165         va_list ap;
2166         char **l, *p;
2167
2168         assert(c);
2169         assert(path);
2170
2171         va_start(ap, path);
2172         l = strv_new_ap(path, ap);
2173         va_end(ap);
2174
2175         if (!l)
2176                 return -ENOMEM;
2177
2178         if (!(p = strdup(path))) {
2179                 strv_free(l);
2180                 return -ENOMEM;
2181         }
2182
2183         free(c->path);
2184         c->path = p;
2185
2186         strv_free(c->argv);
2187         c->argv = l;
2188
2189         return 0;
2190 }
2191
2192 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2193         [EXEC_INPUT_NULL] = "null",
2194         [EXEC_INPUT_TTY] = "tty",
2195         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2196         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2197         [EXEC_INPUT_SOCKET] = "socket"
2198 };
2199
2200 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2201
2202 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2203         [EXEC_OUTPUT_INHERIT] = "inherit",
2204         [EXEC_OUTPUT_NULL] = "null",
2205         [EXEC_OUTPUT_TTY] = "tty",
2206         [EXEC_OUTPUT_SYSLOG] = "syslog",
2207         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2208         [EXEC_OUTPUT_KMSG] = "kmsg",
2209         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2210         [EXEC_OUTPUT_JOURNAL] = "journal",
2211         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2212         [EXEC_OUTPUT_SOCKET] = "socket"
2213 };
2214
2215 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);