src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <linux/seccomp-bpf.h>
  42 #include <glob.h>
  43 #include <libgen.h>
  44
  45 #ifdef HAVE_PAM
  46 #include <security/pam_appl.h>
  47 #endif
  48
  49 #include "execute.h"
  50 #include "strv.h"
  51 #include "macro.h"
  52 #include "capability.h"
  53 #include "util.h"
  54 #include "log.h"
  55 #include "sd-messages.h"
  56 #include "ioprio.h"
  57 #include "securebits.h"
  58 #include "namespace.h"
  59 #include "tcpwrap.h"
  60 #include "exit-status.h"
  61 #include "missing.h"
  62 #include "utmp-wtmp.h"
  63 #include "def.h"
  64 #include "loopback-setup.h"
  65 #include "path-util.h"
  66 #include "syscall-list.h"
  67 #include "env-util.h"
  68 #include "fileio.h"
  69 #include "unit.h"
  70 #include "async.h"
  71
  72 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  73 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
  74
  75 /* This assumes there is a 'tty' group */
  76 #define TTY_MODE 0620
  77
  78 static int shift_fds(int fds[], unsigned n_fds) {
  79         int start, restart_from;
  80
  81         if (n_fds <= 0)
  82                 return 0;
  83
  84         /* Modifies the fds array! (sorts it) */
  85
  86         assert(fds);
  87
  88         start = 0;
  89         for (;;) {
  90                 int i;
  91
  92                 restart_from = -1;
  93
  94                 for (i = start; i < (int) n_fds; i++) {
  95                         int nfd;
  96
  97                         /* Already at right index? */
  98                         if (fds[i] == i+3)
  99                                 continue;
 100
 101                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
 102                                 return -errno;
 103
 104                         close_nointr_nofail(fds[i]);
 105                         fds[i] = nfd;
 106
 107                         /* Hmm, the fd we wanted isn't free? Then
 108                          * let's remember that and try again from here*/
 109                         if (nfd != i+3 && restart_from < 0)
 110                                 restart_from = i;
 111                 }
 112
 113                 if (restart_from < 0)
 114                         break;
 115
 116                 start = restart_from;
 117         }
 118
 119         return 0;
 120 }
 121
 122 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 123         unsigned i;
 124         int r;
 125
 126         if (n_fds <= 0)
 127                 return 0;
 128
 129         assert(fds);
 130
 131         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 132
 133         for (i = 0; i < n_fds; i++) {
 134
 135                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 136                         return r;
 137
 138                 /* We unconditionally drop FD_CLOEXEC from the fds,
 139                  * since after all we want to pass these fds to our
 140                  * children */
 141
 142                 if ((r = fd_cloexec(fds[i], false)) < 0)
 143                         return r;
 144         }
 145
 146         return 0;
 147 }
 148
 149 _pure_ static const char *tty_path(const ExecContext *context) {
 150         assert(context);
 151
 152         if (context->tty_path)
 153                 return context->tty_path;
 154
 155         return "/dev/console";
 156 }
 157
 158 void exec_context_tty_reset(const ExecContext *context) {
 159         assert(context);
 160
 161         if (context->tty_vhangup)
 162                 terminal_vhangup(tty_path(context));
 163
 164         if (context->tty_reset)
 165                 reset_terminal(tty_path(context));
 166
 167         if (context->tty_vt_disallocate && context->tty_path)
 168                 vt_disallocate(context->tty_path);
 169 }
 170
 171 static bool is_terminal_output(ExecOutput o) {
 172         return
 173                 o == EXEC_OUTPUT_TTY ||
 174                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 175                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 176                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 177 }
 178
 179 void exec_context_serialize(const ExecContext *context, Unit *u, FILE *f) {
 180         assert(context);
 181         assert(u);
 182         assert(f);
 183
 184         if (context->tmp_dir)
 185                 unit_serialize_item(u, f, "tmp-dir", context->tmp_dir);
 186
 187         if (context->var_tmp_dir)
 188                 unit_serialize_item(u, f, "var-tmp-dir", context->var_tmp_dir);
 189 }
 190
 191 static int open_null_as(int flags, int nfd) {
 192         int fd, r;
 193
 194         assert(nfd >= 0);
 195
 196         if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
 197                 return -errno;
 198
 199         if (fd != nfd) {
 200                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 201                 close_nointr_nofail(fd);
 202         } else
 203                 r = nfd;
 204
 205         return r;
 206 }
 207
 208 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 209         int fd, r;
 210         union sockaddr_union sa = {
 211                 .un.sun_family = AF_UNIX,
 212                 .un.sun_path = "/run/systemd/journal/stdout",
 213         };
 214
 215         assert(context);
 216         assert(output < _EXEC_OUTPUT_MAX);
 217         assert(ident);
 218         assert(nfd >= 0);
 219
 220         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 221         if (fd < 0)
 222                 return -errno;
 223
 224         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 225         if (r < 0) {
 226                 close_nointr_nofail(fd);
 227                 return -errno;
 228         }
 229
 230         if (shutdown(fd, SHUT_RD) < 0) {
 231                 close_nointr_nofail(fd);
 232                 return -errno;
 233         }
 234
 235         dprintf(fd,
 236                 "%s\n"
 237                 "%s\n"
 238                 "%i\n"
 239                 "%i\n"
 240                 "%i\n"
 241                 "%i\n"
 242                 "%i\n",
 243                 context->syslog_identifier ? context->syslog_identifier : ident,
 244                 unit_id,
 245                 context->syslog_priority,
 246                 !!context->syslog_level_prefix,
 247                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 248                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 249                 is_terminal_output(output));
 250
 251         if (fd != nfd) {
 252                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 253                 close_nointr_nofail(fd);
 254         } else
 255                 r = nfd;
 256
 257         return r;
 258 }
 259 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 260         int fd, r;
 261
 262         assert(path);
 263         assert(nfd >= 0);
 264
 265         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 266                 return fd;
 267
 268         if (fd != nfd) {
 269                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 270                 close_nointr_nofail(fd);
 271         } else
 272                 r = nfd;
 273
 274         return r;
 275 }
 276
 277 static bool is_terminal_input(ExecInput i) {
 278         return
 279                 i == EXEC_INPUT_TTY ||
 280                 i == EXEC_INPUT_TTY_FORCE ||
 281                 i == EXEC_INPUT_TTY_FAIL;
 282 }
 283
 284 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 285
 286         if (is_terminal_input(std_input) && !apply_tty_stdin)
 287                 return EXEC_INPUT_NULL;
 288
 289         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 290                 return EXEC_INPUT_NULL;
 291
 292         return std_input;
 293 }
 294
 295 static int fixup_output(ExecOutput std_output, int socket_fd) {
 296
 297         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 298                 return EXEC_OUTPUT_INHERIT;
 299
 300         return std_output;
 301 }
 302
 303 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 304         ExecInput i;
 305
 306         assert(context);
 307
 308         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 309
 310         switch (i) {
 311
 312         case EXEC_INPUT_NULL:
 313                 return open_null_as(O_RDONLY, STDIN_FILENO);
 314
 315         case EXEC_INPUT_TTY:
 316         case EXEC_INPUT_TTY_FORCE:
 317         case EXEC_INPUT_TTY_FAIL: {
 318                 int fd, r;
 319
 320                 if ((fd = acquire_terminal(
 321                                      tty_path(context),
 322                                      i == EXEC_INPUT_TTY_FAIL,
 323                                      i == EXEC_INPUT_TTY_FORCE,
 324                                      false,
 325                                      (usec_t) -1)) < 0)
 326                         return fd;
 327
 328                 if (fd != STDIN_FILENO) {
 329                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 330                         close_nointr_nofail(fd);
 331                 } else
 332                         r = STDIN_FILENO;
 333
 334                 return r;
 335         }
 336
 337         case EXEC_INPUT_SOCKET:
 338                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 339
 340         default:
 341                 assert_not_reached("Unknown input type");
 342         }
 343 }
 344
 345 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 346         ExecOutput o;
 347         ExecInput i;
 348         int r;
 349
 350         assert(context);
 351         assert(ident);
 352
 353         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 354         o = fixup_output(context->std_output, socket_fd);
 355
 356         if (fileno == STDERR_FILENO) {
 357                 ExecOutput e;
 358                 e = fixup_output(context->std_error, socket_fd);
 359
 360                 /* This expects the input and output are already set up */
 361
 362                 /* Don't change the stderr file descriptor if we inherit all
 363                  * the way and are not on a tty */
 364                 if (e == EXEC_OUTPUT_INHERIT &&
 365                     o == EXEC_OUTPUT_INHERIT &&
 366                     i == EXEC_INPUT_NULL &&
 367                     !is_terminal_input(context->std_input) &&
 368                     getppid () != 1)
 369                         return fileno;
 370
 371                 /* Duplicate from stdout if possible */
 372                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 373                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 374
 375                 o = e;
 376
 377         } else if (o == EXEC_OUTPUT_INHERIT) {
 378                 /* If input got downgraded, inherit the original value */
 379                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 380                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 381
 382                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 383                 if (i != EXEC_INPUT_NULL)
 384                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 385
 386                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 387                 if (getppid() != 1)
 388                         return fileno;
 389
 390                 /* We need to open /dev/null here anew, to get the right access mode. */
 391                 return open_null_as(O_WRONLY, fileno);
 392         }
 393
 394         switch (o) {
 395
 396         case EXEC_OUTPUT_NULL:
 397                 return open_null_as(O_WRONLY, fileno);
 398
 399         case EXEC_OUTPUT_TTY:
 400                 if (is_terminal_input(i))
 401                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 402
 403                 /* We don't reset the terminal if this is just about output */
 404                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 405
 406         case EXEC_OUTPUT_SYSLOG:
 407         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 408         case EXEC_OUTPUT_KMSG:
 409         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 410         case EXEC_OUTPUT_JOURNAL:
 411         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 412                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 413                 if (r < 0) {
 414                         log_struct_unit(LOG_CRIT, unit_id,
 415                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 416                                 fileno == STDOUT_FILENO ? "out" : "err",
 417                                 unit_id, strerror(-r),
 418                                 "ERRNO=%d", -r,
 419                                 NULL);
 420                         r = open_null_as(O_WRONLY, fileno);
 421                 }
 422                 return r;
 423
 424         case EXEC_OUTPUT_SOCKET:
 425                 assert(socket_fd >= 0);
 426                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 427
 428         default:
 429                 assert_not_reached("Unknown error type");
 430         }
 431 }
 432
 433 static int chown_terminal(int fd, uid_t uid) {
 434         struct stat st;
 435
 436         assert(fd >= 0);
 437
 438         /* This might fail. What matters are the results. */
 439         (void) fchown(fd, uid, -1);
 440         (void) fchmod(fd, TTY_MODE);
 441
 442         if (fstat(fd, &st) < 0)
 443                 return -errno;
 444
 445         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 446                 return -EPERM;
 447
 448         return 0;
 449 }
 450
 451 static int setup_confirm_stdio(int *_saved_stdin,
 452                                int *_saved_stdout) {
 453         int fd = -1, saved_stdin, saved_stdout = -1, r;
 454
 455         assert(_saved_stdin);
 456         assert(_saved_stdout);
 457
 458         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 459         if (saved_stdin < 0)
 460                 return -errno;
 461
 462         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 463         if (saved_stdout < 0) {
 464                 r = errno;
 465                 goto fail;
 466         }
 467
 468         fd = acquire_terminal(
 469                         "/dev/console",
 470                         false,
 471                         false,
 472                         false,
 473                         DEFAULT_CONFIRM_USEC);
 474         if (fd < 0) {
 475                 r = fd;
 476                 goto fail;
 477         }
 478
 479         r = chown_terminal(fd, getuid());
 480         if (r < 0)
 481                 goto fail;
 482
 483         if (dup2(fd, STDIN_FILENO) < 0) {
 484                 r = -errno;
 485                 goto fail;
 486         }
 487
 488         if (dup2(fd, STDOUT_FILENO) < 0) {
 489                 r = -errno;
 490                 goto fail;
 491         }
 492
 493         if (fd >= 2)
 494                 close_nointr_nofail(fd);
 495
 496         *_saved_stdin = saved_stdin;
 497         *_saved_stdout = saved_stdout;
 498
 499         return 0;
 500
 501 fail:
 502         if (saved_stdout >= 0)
 503                 close_nointr_nofail(saved_stdout);
 504
 505         if (saved_stdin >= 0)
 506                 close_nointr_nofail(saved_stdin);
 507
 508         if (fd >= 0)
 509                 close_nointr_nofail(fd);
 510
 511         return r;
 512 }
 513
 514 _printf_attr_(1, 2) static int write_confirm_message(const char *format, ...) {
 515         int fd;
 516         va_list ap;
 517
 518         assert(format);
 519
 520         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 521         if (fd < 0)
 522                 return fd;
 523
 524         va_start(ap, format);
 525         vdprintf(fd, format, ap);
 526         va_end(ap);
 527
 528         close_nointr_nofail(fd);
 529
 530         return 0;
 531 }
 532
 533 static int restore_confirm_stdio(int *saved_stdin,
 534                                  int *saved_stdout) {
 535
 536         int r = 0;
 537
 538         assert(saved_stdin);
 539         assert(saved_stdout);
 540
 541         release_terminal();
 542
 543         if (*saved_stdin >= 0)
 544                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 545                         r = -errno;
 546
 547         if (*saved_stdout >= 0)
 548                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 549                         r = -errno;
 550
 551         if (*saved_stdin >= 0)
 552                 close_nointr_nofail(*saved_stdin);
 553
 554         if (*saved_stdout >= 0)
 555                 close_nointr_nofail(*saved_stdout);
 556
 557         return r;
 558 }
 559
 560 static int ask_for_confirmation(char *response, char **argv) {
 561         int saved_stdout = -1, saved_stdin = -1, r;
 562         char *line;
 563
 564         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 565         if (r < 0)
 566                 return r;
 567
 568         line = exec_command_line(argv);
 569         if (!line)
 570                 return -ENOMEM;
 571
 572         r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 573         free(line);
 574
 575         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 576
 577         return r;
 578 }
 579
 580 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 581         bool keep_groups = false;
 582         int r;
 583
 584         assert(context);
 585
 586         /* Lookup and set GID and supplementary group list. Here too
 587          * we avoid NSS lookups for gid=0. */
 588
 589         if (context->group || username) {
 590
 591                 if (context->group) {
 592                         const char *g = context->group;
 593
 594                         if ((r = get_group_creds(&g, &gid)) < 0)
 595                                 return r;
 596                 }
 597
 598                 /* First step, initialize groups from /etc/groups */
 599                 if (username && gid != 0) {
 600                         if (initgroups(username, gid) < 0)
 601                                 return -errno;
 602
 603                         keep_groups = true;
 604                 }
 605
 606                 /* Second step, set our gids */
 607                 if (setresgid(gid, gid, gid) < 0)
 608                         return -errno;
 609         }
 610
 611         if (context->supplementary_groups) {
 612                 int ngroups_max, k;
 613                 gid_t *gids;
 614                 char **i;
 615
 616                 /* Final step, initialize any manually set supplementary groups */
 617                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 618
 619                 if (!(gids = new(gid_t, ngroups_max)))
 620                         return -ENOMEM;
 621
 622                 if (keep_groups) {
 623                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 624                                 free(gids);
 625                                 return -errno;
 626                         }
 627                 } else
 628                         k = 0;
 629
 630                 STRV_FOREACH(i, context->supplementary_groups) {
 631                         const char *g;
 632
 633                         if (k >= ngroups_max) {
 634                                 free(gids);
 635                                 return -E2BIG;
 636                         }
 637
 638                         g = *i;
 639                         r = get_group_creds(&g, gids+k);
 640                         if (r < 0) {
 641                                 free(gids);
 642                                 return r;
 643                         }
 644
 645                         k++;
 646                 }
 647
 648                 if (setgroups(k, gids) < 0) {
 649                         free(gids);
 650                         return -errno;
 651                 }
 652
 653                 free(gids);
 654         }
 655
 656         return 0;
 657 }
 658
 659 static int enforce_user(const ExecContext *context, uid_t uid) {
 660         int r;
 661         assert(context);
 662
 663         /* Sets (but doesn't lookup) the uid and make sure we keep the
 664          * capabilities while doing so. */
 665
 666         if (context->capabilities) {
 667                 cap_t d;
 668                 static const cap_value_t bits[] = {
 669                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 670                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 671                 };
 672
 673                 /* First step: If we need to keep capabilities but
 674                  * drop privileges we need to make sure we keep our
 675                  * caps, while we drop privileges. */
 676                 if (uid != 0) {
 677                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 678
 679                         if (prctl(PR_GET_SECUREBITS) != sb)
 680                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 681                                         return -errno;
 682                 }
 683
 684                 /* Second step: set the capabilities. This will reduce
 685                  * the capabilities to the minimum we need. */
 686
 687                 if (!(d = cap_dup(context->capabilities)))
 688                         return -errno;
 689
 690                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 691                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 692                         r = -errno;
 693                         cap_free(d);
 694                         return r;
 695                 }
 696
 697                 if (cap_set_proc(d) < 0) {
 698                         r = -errno;
 699                         cap_free(d);
 700                         return r;
 701                 }
 702
 703                 cap_free(d);
 704         }
 705
 706         /* Third step: actually set the uids */
 707         if (setresuid(uid, uid, uid) < 0)
 708                 return -errno;
 709
 710         /* At this point we should have all necessary capabilities but
 711            are otherwise a normal user. However, the caps might got
 712            corrupted due to the setresuid() so we need clean them up
 713            later. This is done outside of this call. */
 714
 715         return 0;
 716 }
 717
 718 #ifdef HAVE_PAM
 719
 720 static int null_conv(
 721                 int num_msg,
 722                 const struct pam_message **msg,
 723                 struct pam_response **resp,
 724                 void *appdata_ptr) {
 725
 726         /* We don't support conversations */
 727
 728         return PAM_CONV_ERR;
 729 }
 730
 731 static int setup_pam(
 732                 const char *name,
 733                 const char *user,
 734                 uid_t uid,
 735                 const char *tty,
 736                 char ***pam_env,
 737                 int fds[], unsigned n_fds) {
 738
 739         static const struct pam_conv conv = {
 740                 .conv = null_conv,
 741                 .appdata_ptr = NULL
 742         };
 743
 744         pam_handle_t *handle = NULL;
 745         sigset_t ss, old_ss;
 746         int pam_code = PAM_SUCCESS;
 747         int err;
 748         char **e = NULL;
 749         bool close_session = false;
 750         pid_t pam_pid = 0, parent_pid;
 751
 752         assert(name);
 753         assert(user);
 754         assert(pam_env);
 755
 756         /* We set up PAM in the parent process, then fork. The child
 757          * will then stay around until killed via PR_GET_PDEATHSIG or
 758          * systemd via the cgroup logic. It will then remove the PAM
 759          * session again. The parent process will exec() the actual
 760          * daemon. We do things this way to ensure that the main PID
 761          * of the daemon is the one we initially fork()ed. */
 762
 763         pam_code = pam_start(name, user, &conv, &handle);
 764         if (pam_code != PAM_SUCCESS) {
 765                 handle = NULL;
 766                 goto fail;
 767         }
 768
 769         if (tty) {
 770                 pam_code = pam_set_item(handle, PAM_TTY, tty);
 771                 if (pam_code != PAM_SUCCESS)
 772                         goto fail;
 773         }
 774
 775         pam_code = pam_acct_mgmt(handle, PAM_SILENT);
 776         if (pam_code != PAM_SUCCESS)
 777                 goto fail;
 778
 779         pam_code = pam_open_session(handle, PAM_SILENT);
 780         if (pam_code != PAM_SUCCESS)
 781                 goto fail;
 782
 783         close_session = true;
 784
 785         e = pam_getenvlist(handle);
 786         if (!e) {
 787                 pam_code = PAM_BUF_ERR;
 788                 goto fail;
 789         }
 790
 791         /* Block SIGTERM, so that we know that it won't get lost in
 792          * the child */
 793         if (sigemptyset(&ss) < 0 ||
 794             sigaddset(&ss, SIGTERM) < 0 ||
 795             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 796                 goto fail;
 797
 798         parent_pid = getpid();
 799
 800         pam_pid = fork();
 801         if (pam_pid < 0)
 802                 goto fail;
 803
 804         if (pam_pid == 0) {
 805                 int sig;
 806                 int r = EXIT_PAM;
 807
 808                 /* The child's job is to reset the PAM session on
 809                  * termination */
 810
 811                 /* This string must fit in 10 chars (i.e. the length
 812                  * of "/sbin/init"), to look pretty in /bin/ps */
 813                 rename_process("(sd-pam)");
 814
 815                 /* Make sure we don't keep open the passed fds in this
 816                 child. We assume that otherwise only those fds are
 817                 open here that have been opened by PAM. */
 818                 close_many(fds, n_fds);
 819
 820                 /* Drop privileges - we don't need any to pam_close_session
 821                  * and this will make PR_SET_PDEATHSIG work in most cases.
 822                  * If this fails, ignore the error - but expect sd-pam threads
 823                  * to fail to exit normally */
 824                 if (setresuid(uid, uid, uid) < 0)
 825                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 826
 827                 /* Wait until our parent died. This will only work if
 828                  * the above setresuid() succeeds, otherwise the kernel
 829                  * will not allow unprivileged parents kill their privileged
 830                  * children this way. We rely on the control groups kill logic
 831                  * to do the rest for us. */
 832                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 833                         goto child_finish;
 834
 835                 /* Check if our parent process might already have
 836                  * died? */
 837                 if (getppid() == parent_pid) {
 838                         for (;;) {
 839                                 if (sigwait(&ss, &sig) < 0) {
 840                                         if (errno == EINTR)
 841                                                 continue;
 842
 843                                         goto child_finish;
 844                                 }
 845
 846                                 assert(sig == SIGTERM);
 847                                 break;
 848                         }
 849                 }
 850
 851                 /* If our parent died we'll end the session */
 852                 if (getppid() != parent_pid) {
 853                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
 854                         if (pam_code != PAM_SUCCESS)
 855                                 goto child_finish;
 856                 }
 857
 858                 r = 0;
 859
 860         child_finish:
 861                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 862                 _exit(r);
 863         }
 864
 865         /* If the child was forked off successfully it will do all the
 866          * cleanups, so forget about the handle here. */
 867         handle = NULL;
 868
 869         /* Unblock SIGTERM again in the parent */
 870         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 871                 goto fail;
 872
 873         /* We close the log explicitly here, since the PAM modules
 874          * might have opened it, but we don't want this fd around. */
 875         closelog();
 876
 877         *pam_env = e;
 878         e = NULL;
 879
 880         return 0;
 881
 882 fail:
 883         if (pam_code != PAM_SUCCESS)
 884                 err = -EPERM;  /* PAM errors do not map to errno */
 885         else
 886                 err = -errno;
 887
 888         if (handle) {
 889                 if (close_session)
 890                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
 891
 892                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 893         }
 894
 895         strv_free(e);
 896
 897         closelog();
 898
 899         if (pam_pid > 1) {
 900                 kill(pam_pid, SIGTERM);
 901                 kill(pam_pid, SIGCONT);
 902         }
 903
 904         return err;
 905 }
 906 #endif
 907
 908 static void rename_process_from_path(const char *path) {
 909         char process_name[11];
 910         const char *p;
 911         size_t l;
 912
 913         /* This resulting string must fit in 10 chars (i.e. the length
 914          * of "/sbin/init") to look pretty in /bin/ps */
 915
 916         p = path_get_file_name(path);
 917         if (isempty(p)) {
 918                 rename_process("(...)");
 919                 return;
 920         }
 921
 922         l = strlen(p);
 923         if (l > 8) {
 924                 /* The end of the process name is usually more
 925                  * interesting, since the first bit might just be
 926                  * "systemd-" */
 927                 p = p + l - 8;
 928                 l = 8;
 929         }
 930
 931         process_name[0] = '(';
 932         memcpy(process_name+1, p, l);
 933         process_name[1+l] = ')';
 934         process_name[1+l+1] = 0;
 935
 936         rename_process(process_name);
 937 }
 938
 939 static int apply_seccomp(uint32_t *syscall_filter) {
 940         static const struct sock_filter header[] = {
 941                 VALIDATE_ARCHITECTURE,
 942                 EXAMINE_SYSCALL
 943         };
 944         static const struct sock_filter footer[] = {
 945                 _KILL_PROCESS
 946         };
 947
 948         int i;
 949         unsigned n;
 950         struct sock_filter *f;
 951         struct sock_fprog prog = {};
 952
 953         assert(syscall_filter);
 954
 955         /* First: count the syscalls to check for */
 956         for (i = 0, n = 0; i < syscall_max(); i++)
 957                 if (syscall_filter[i >> 4] & (1 << (i & 31)))
 958                         n++;
 959
 960         /* Second: build the filter program from a header the syscall
 961          * matches and the footer */
 962         f = alloca(sizeof(struct sock_filter) * (ELEMENTSOF(header) + 2*n + ELEMENTSOF(footer)));
 963         memcpy(f, header, sizeof(header));
 964
 965         for (i = 0, n = 0; i < syscall_max(); i++)
 966                 if (syscall_filter[i >> 4] & (1 << (i & 31))) {
 967                         struct sock_filter item[] = {
 968                                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, INDEX_TO_SYSCALL(i), 0, 1),
 969                                 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 970                         };
 971
 972                         assert_cc(ELEMENTSOF(item) == 2);
 973
 974                         f[ELEMENTSOF(header) + 2*n]  = item[0];
 975                         f[ELEMENTSOF(header) + 2*n+1] = item[1];
 976
 977                         n++;
 978                 }
 979
 980         memcpy(f + (ELEMENTSOF(header) + 2*n), footer, sizeof(footer));
 981
 982         /* Third: install the filter */
 983         prog.len = ELEMENTSOF(header) + ELEMENTSOF(footer) + 2*n;
 984         prog.filter = f;
 985         if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0)
 986                 return -errno;
 987
 988         return 0;
 989 }
 990
 991 static void do_idle_pipe_dance(int idle_pipe[4]) {
 992         assert(idle_pipe);
 993
 994         if (idle_pipe[1] >= 0)
 995                 close_nointr_nofail(idle_pipe[1]);
 996         if (idle_pipe[2] >= 0)
 997                 close_nointr_nofail(idle_pipe[2]);
 998
 999         if (idle_pipe[0] >= 0) {
1000                 int r;
1001
1002                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1003
1004                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1005                         /* Signal systemd that we are bored and want to continue. */
1006                         write(idle_pipe[3], "x", 1);
1007
1008                         /* Wait for systemd to react to the signal above. */
1009                         fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1010                 }
1011
1012                 close_nointr_nofail(idle_pipe[0]);
1013
1014         }
1015
1016         if (idle_pipe[3] >= 0)
1017                 close_nointr_nofail(idle_pipe[3]);
1018 }
1019
1020 int exec_spawn(ExecCommand *command,
1021                char **argv,
1022                ExecContext *context,
1023                int fds[], unsigned n_fds,
1024                char **environment,
1025                bool apply_permissions,
1026                bool apply_chroot,
1027                bool apply_tty_stdin,
1028                bool confirm_spawn,
1029                CGroupControllerMask cgroup_supported,
1030                const char *cgroup_path,
1031                const char *unit_id,
1032                int idle_pipe[4],
1033                pid_t *ret) {
1034
1035         _cleanup_strv_free_ char **files_env = NULL;
1036         int socket_fd;
1037         char *line;
1038         pid_t pid;
1039         int r;
1040
1041         assert(command);
1042         assert(context);
1043         assert(ret);
1044         assert(fds || n_fds <= 0);
1045
1046         if (context->std_input == EXEC_INPUT_SOCKET ||
1047             context->std_output == EXEC_OUTPUT_SOCKET ||
1048             context->std_error == EXEC_OUTPUT_SOCKET) {
1049
1050                 if (n_fds != 1)
1051                         return -EINVAL;
1052
1053                 socket_fd = fds[0];
1054
1055                 fds = NULL;
1056                 n_fds = 0;
1057         } else
1058                 socket_fd = -1;
1059
1060         r = exec_context_load_environment(context, &files_env);
1061         if (r < 0) {
1062                 log_struct_unit(LOG_ERR,
1063                            unit_id,
1064                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1065                            "ERRNO=%d", -r,
1066                            NULL);
1067                 return r;
1068         }
1069
1070         if (!argv)
1071                 argv = command->argv;
1072
1073         line = exec_command_line(argv);
1074         if (!line)
1075                 return log_oom();
1076
1077         log_struct_unit(LOG_DEBUG,
1078                         unit_id,
1079                         "EXECUTABLE=%s", command->path,
1080                         "MESSAGE=About to execute: %s", line,
1081                         NULL);
1082         free(line);
1083
1084         if (context->private_tmp && !context->tmp_dir && !context->var_tmp_dir) {
1085                 r = setup_tmpdirs(&context->tmp_dir, &context->var_tmp_dir);
1086                 if (r < 0)
1087                         return r;
1088         }
1089
1090         pid = fork();
1091         if (pid < 0)
1092                 return -errno;
1093
1094         if (pid == 0) {
1095                 int i, err;
1096                 sigset_t ss;
1097                 const char *username = NULL, *home = NULL, *shell = NULL;
1098                 uid_t uid = (uid_t) -1;
1099                 gid_t gid = (gid_t) -1;
1100                 _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL,
1101                         **final_env = NULL, **final_argv = NULL;
1102                 unsigned n_env = 0;
1103
1104                 /* child */
1105
1106                 rename_process_from_path(command->path);
1107
1108                 /* We reset exactly these signals, since they are the
1109                  * only ones we set to SIG_IGN in the main daemon. All
1110                  * others we leave untouched because we set them to
1111                  * SIG_DFL or a valid handler initially, both of which
1112                  * will be demoted to SIG_DFL. */
1113                 default_signals(SIGNALS_CRASH_HANDLER,
1114                                 SIGNALS_IGNORE, -1);
1115
1116                 if (context->ignore_sigpipe)
1117                         ignore_signals(SIGPIPE, -1);
1118
1119                 assert_se(sigemptyset(&ss) == 0);
1120                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1121                         err = -errno;
1122                         r = EXIT_SIGNAL_MASK;
1123                         goto fail_child;
1124                 }
1125
1126                 if (idle_pipe)
1127                         do_idle_pipe_dance(idle_pipe);
1128
1129                 /* Close sockets very early to make sure we don't
1130                  * block init reexecution because it cannot bind its
1131                  * sockets */
1132                 log_forget_fds();
1133                 err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
1134                                            socket_fd >= 0 ? 1 : n_fds);
1135                 if (err < 0) {
1136                         r = EXIT_FDS;
1137                         goto fail_child;
1138                 }
1139
1140                 if (!context->same_pgrp)
1141                         if (setsid() < 0) {
1142                                 err = -errno;
1143                                 r = EXIT_SETSID;
1144                                 goto fail_child;
1145                         }
1146
1147                 if (context->tcpwrap_name) {
1148                         if (socket_fd >= 0)
1149                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1150                                         err = -EACCES;
1151                                         r = EXIT_TCPWRAP;
1152                                         goto fail_child;
1153                                 }
1154
1155                         for (i = 0; i < (int) n_fds; i++) {
1156                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1157                                         err = -EACCES;
1158                                         r = EXIT_TCPWRAP;
1159                                         goto fail_child;
1160                                 }
1161                         }
1162                 }
1163
1164                 exec_context_tty_reset(context);
1165
1166                 if (confirm_spawn) {
1167                         char response;
1168
1169                         err = ask_for_confirmation(&response, argv);
1170                         if (err == -ETIMEDOUT)
1171                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1172                         else if (err < 0)
1173                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1174                         else if (response == 's') {
1175                                 write_confirm_message("Skipping execution.\n");
1176                                 err = -ECANCELED;
1177                                 r = EXIT_CONFIRM;
1178                                 goto fail_child;
1179                         } else if (response == 'n') {
1180                                 write_confirm_message("Failing execution.\n");
1181                                 err = r = 0;
1182                                 goto fail_child;
1183                         }
1184                 }
1185
1186                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1187                  * must sure to drop O_NONBLOCK */
1188                 if (socket_fd >= 0)
1189                         fd_nonblock(socket_fd, false);
1190
1191                 err = setup_input(context, socket_fd, apply_tty_stdin);
1192                 if (err < 0) {
1193                         r = EXIT_STDIN;
1194                         goto fail_child;
1195                 }
1196
1197                 err = setup_output(context, STDOUT_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1198                 if (err < 0) {
1199                         r = EXIT_STDOUT;
1200                         goto fail_child;
1201                 }
1202
1203                 err = setup_output(context, STDERR_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1204                 if (err < 0) {
1205                         r = EXIT_STDERR;
1206                         goto fail_child;
1207                 }
1208
1209                 if (cgroup_path) {
1210                         err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
1211                         if (err < 0) {
1212                                 r = EXIT_CGROUP;
1213                                 goto fail_child;
1214                         }
1215                 }
1216
1217                 if (context->oom_score_adjust_set) {
1218                         char t[16];
1219
1220                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1221                         char_array_0(t);
1222
1223                         if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
1224                                 err = -errno;
1225                                 r = EXIT_OOM_ADJUST;
1226                                 goto fail_child;
1227                         }
1228                 }
1229
1230                 if (context->nice_set)
1231                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1232                                 err = -errno;
1233                                 r = EXIT_NICE;
1234                                 goto fail_child;
1235                         }
1236
1237                 if (context->cpu_sched_set) {
1238                         struct sched_param param = {
1239                                 .sched_priority = context->cpu_sched_priority,
1240                         };
1241
1242                         r = sched_setscheduler(0,
1243                                                context->cpu_sched_policy |
1244                                                (context->cpu_sched_reset_on_fork ?
1245                                                 SCHED_RESET_ON_FORK : 0),
1246                                                &param);
1247                         if (r < 0) {
1248                                 err = -errno;
1249                                 r = EXIT_SETSCHEDULER;
1250                                 goto fail_child;
1251                         }
1252                 }
1253
1254                 if (context->cpuset)
1255                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1256                                 err = -errno;
1257                                 r = EXIT_CPUAFFINITY;
1258                                 goto fail_child;
1259                         }
1260
1261                 if (context->ioprio_set)
1262                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1263                                 err = -errno;
1264                                 r = EXIT_IOPRIO;
1265                                 goto fail_child;
1266                         }
1267
1268                 if (context->timer_slack_nsec != (nsec_t) -1)
1269                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1270                                 err = -errno;
1271                                 r = EXIT_TIMERSLACK;
1272                                 goto fail_child;
1273                         }
1274
1275                 if (context->utmp_id)
1276                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1277
1278                 if (context->user) {
1279                         username = context->user;
1280                         err = get_user_creds(&username, &uid, &gid, &home, &shell);
1281                         if (err < 0) {
1282                                 r = EXIT_USER;
1283                                 goto fail_child;
1284                         }
1285
1286                         if (is_terminal_input(context->std_input)) {
1287                                 err = chown_terminal(STDIN_FILENO, uid);
1288                                 if (err < 0) {
1289                                         r = EXIT_STDIN;
1290                                         goto fail_child;
1291                                 }
1292                         }
1293                 }
1294
1295 #ifdef HAVE_PAM
1296                 if (cgroup_path && context->user && context->pam_name) {
1297                         err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
1298                         if (err < 0) {
1299                                 r = EXIT_CGROUP;
1300                                 goto fail_child;
1301                         }
1302
1303
1304                         err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
1305                         if (err < 0) {
1306                                 r = EXIT_CGROUP;
1307                                 goto fail_child;
1308                         }
1309                 }
1310 #endif
1311
1312                 if (apply_permissions) {
1313                         err = enforce_groups(context, username, gid);
1314                         if (err < 0) {
1315                                 r = EXIT_GROUP;
1316                                 goto fail_child;
1317                         }
1318                 }
1319
1320                 umask(context->umask);
1321
1322 #ifdef HAVE_PAM
1323                 if (apply_permissions && context->pam_name && username) {
1324                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1325                         if (err < 0) {
1326                                 r = EXIT_PAM;
1327                                 goto fail_child;
1328                         }
1329                 }
1330 #endif
1331                 if (context->private_network) {
1332                         if (unshare(CLONE_NEWNET) < 0) {
1333                                 err = -errno;
1334                                 r = EXIT_NETWORK;
1335                                 goto fail_child;
1336                         }
1337
1338                         loopback_setup();
1339                 }
1340
1341                 if (strv_length(context->read_write_dirs) > 0 ||
1342                     strv_length(context->read_only_dirs) > 0 ||
1343                     strv_length(context->inaccessible_dirs) > 0 ||
1344                     context->mount_flags != 0 ||
1345                     context->private_tmp) {
1346                         err = setup_namespace(context->read_write_dirs,
1347                                               context->read_only_dirs,
1348                                               context->inaccessible_dirs,
1349                                               context->tmp_dir,
1350                                               context->var_tmp_dir,
1351                                               context->private_tmp,
1352                                               context->mount_flags);
1353                         if (err < 0) {
1354                                 r = EXIT_NAMESPACE;
1355                                 goto fail_child;
1356                         }
1357                 }
1358
1359                 if (apply_chroot) {
1360                         if (context->root_directory)
1361                                 if (chroot(context->root_directory) < 0) {
1362                                         err = -errno;
1363                                         r = EXIT_CHROOT;
1364                                         goto fail_child;
1365                                 }
1366
1367                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1368                                 err = -errno;
1369                                 r = EXIT_CHDIR;
1370                                 goto fail_child;
1371                         }
1372                 } else {
1373                         _cleanup_free_ char *d = NULL;
1374
1375                         if (asprintf(&d, "%s/%s",
1376                                      context->root_directory ? context->root_directory : "",
1377                                      context->working_directory ? context->working_directory : "") < 0) {
1378                                 err = -ENOMEM;
1379                                 r = EXIT_MEMORY;
1380                                 goto fail_child;
1381                         }
1382
1383                         if (chdir(d) < 0) {
1384                                 err = -errno;
1385                                 r = EXIT_CHDIR;
1386                                 goto fail_child;
1387                         }
1388                 }
1389
1390                 /* We repeat the fd closing here, to make sure that
1391                  * nothing is leaked from the PAM modules */
1392                 err = close_all_fds(fds, n_fds);
1393                 if (err >= 0)
1394                         err = shift_fds(fds, n_fds);
1395                 if (err >= 0)
1396                         err = flags_fds(fds, n_fds, context->non_blocking);
1397                 if (err < 0) {
1398                         r = EXIT_FDS;
1399                         goto fail_child;
1400                 }
1401
1402                 if (apply_permissions) {
1403
1404                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1405                                 if (!context->rlimit[i])
1406                                         continue;
1407
1408                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1409                                         err = -errno;
1410                                         r = EXIT_LIMITS;
1411                                         goto fail_child;
1412                                 }
1413                         }
1414
1415                         if (context->capability_bounding_set_drop) {
1416                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1417                                 if (err < 0) {
1418                                         r = EXIT_CAPABILITIES;
1419                                         goto fail_child;
1420                                 }
1421                         }
1422
1423                         if (context->user) {
1424                                 err = enforce_user(context, uid);
1425                                 if (err < 0) {
1426                                         r = EXIT_USER;
1427                                         goto fail_child;
1428                                 }
1429                         }
1430
1431                         /* PR_GET_SECUREBITS is not privileged, while
1432                          * PR_SET_SECUREBITS is. So to suppress
1433                          * potential EPERMs we'll try not to call
1434                          * PR_SET_SECUREBITS unless necessary. */
1435                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1436                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1437                                         err = -errno;
1438                                         r = EXIT_SECUREBITS;
1439                                         goto fail_child;
1440                                 }
1441
1442                         if (context->capabilities)
1443                                 if (cap_set_proc(context->capabilities) < 0) {
1444                                         err = -errno;
1445                                         r = EXIT_CAPABILITIES;
1446                                         goto fail_child;
1447                                 }
1448
1449                         if (context->no_new_privileges)
1450                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1451                                         err = -errno;
1452                                         r = EXIT_NO_NEW_PRIVILEGES;
1453                                         goto fail_child;
1454                                 }
1455
1456                         if (context->syscall_filter) {
1457                                 err = apply_seccomp(context->syscall_filter);
1458                                 if (err < 0) {
1459                                         r = EXIT_SECCOMP;
1460                                         goto fail_child;
1461                                 }
1462                         }
1463                 }
1464
1465                 our_env = new(char*, 8);
1466                 if (!our_env ||
1467                     (n_fds > 0 && (
1468                             asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1469                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0)) ||
1470                     (home && asprintf(our_env + n_env++, "HOME=%s", home) < 0) ||
1471                     (username && (
1472                             asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1473                             asprintf(our_env + n_env++, "USER=%s", username) < 0)) ||
1474                     (shell && asprintf(our_env + n_env++, "SHELL=%s", shell) < 0) ||
1475                     ((is_terminal_input(context->std_input) ||
1476                       context->std_output == EXEC_OUTPUT_TTY ||
1477                       context->std_error == EXEC_OUTPUT_TTY) && (
1478                               !(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))))) {
1479
1480                         err = -ENOMEM;
1481                         r = EXIT_MEMORY;
1482                         goto fail_child;
1483                 }
1484
1485                 our_env[n_env++] = NULL;
1486                 assert(n_env <= 8);
1487
1488                 final_env = strv_env_merge(5,
1489                                            environment,
1490                                            our_env,
1491                                            context->environment,
1492                                            files_env,
1493                                            pam_env,
1494                                            NULL);
1495                 if (!final_env) {
1496                         err = -ENOMEM;
1497                         r = EXIT_MEMORY;
1498                         goto fail_child;
1499                 }
1500
1501                 final_argv = replace_env_argv(argv, final_env);
1502                 if (!final_argv) {
1503                         err = -ENOMEM;
1504                         r = EXIT_MEMORY;
1505                         goto fail_child;
1506                 }
1507
1508                 final_env = strv_env_clean(final_env);
1509
1510                 if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
1511                         line = exec_command_line(final_argv);
1512                         if (line) {
1513                                 log_open();
1514                                 log_struct_unit(LOG_DEBUG,
1515                                                 unit_id,
1516                                                 "EXECUTABLE=%s", command->path,
1517                                                 "MESSAGE=Executing: %s", line,
1518                                                 NULL);
1519                                 log_close();
1520                                 free(line);
1521                                 line = NULL;
1522                         }
1523                 }
1524                 execve(command->path, final_argv, final_env);
1525                 err = -errno;
1526                 r = EXIT_EXEC;
1527
1528         fail_child:
1529                 if (r != 0) {
1530                         log_open();
1531                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1532                                    "EXECUTABLE=%s", command->path,
1533                                    "MESSAGE=Failed at step %s spawning %s: %s",
1534                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1535                                           command->path, strerror(-err),
1536                                    "ERRNO=%d", -err,
1537                                    NULL);
1538                         log_close();
1539                 }
1540
1541                 _exit(r);
1542         }
1543
1544         log_struct_unit(LOG_DEBUG,
1545                         unit_id,
1546                         "MESSAGE=Forked %s as %lu",
1547                         command->path, (unsigned long) pid,
1548                         NULL);
1549
1550         /* We add the new process to the cgroup both in the child (so
1551          * that we can be sure that no user code is ever executed
1552          * outside of the cgroup) and in the parent (so that we can be
1553          * sure that when we kill the cgroup the process will be
1554          * killed too). */
1555         if (cgroup_path)
1556                 cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
1557
1558         exec_status_start(&command->exec_status, pid);
1559
1560         *ret = pid;
1561         return 0;
1562 }
1563
1564 void exec_context_init(ExecContext *c) {
1565         assert(c);
1566
1567         c->umask = 0022;
1568         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1569         c->cpu_sched_policy = SCHED_OTHER;
1570         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1571         c->syslog_level_prefix = true;
1572         c->ignore_sigpipe = true;
1573         c->timer_slack_nsec = (nsec_t) -1;
1574 }
1575
1576 static void *remove_tmpdir_thread(void *p) {
1577         int r;
1578         _cleanup_free_ char *dirp = p;
1579         char *dir;
1580
1581         assert(dirp);
1582
1583         r = rm_rf_dangerous(dirp, false, true, false);
1584         dir = dirname(dirp);
1585         if (r < 0)
1586                 log_warning("Failed to remove content of temporary directory %s: %s",
1587                             dir, strerror(-r));
1588         else {
1589                 r = rmdir(dir);
1590                 if (r < 0)
1591                         log_warning("Failed to remove temporary directory %s: %s",
1592                                     dir, strerror(-r));
1593         }
1594
1595         return NULL;
1596 }
1597
1598 void exec_context_tmp_dirs_done(ExecContext *c) {
1599         char* dirs[] = {c->tmp_dir ? c->tmp_dir : c->var_tmp_dir,
1600                         c->tmp_dir ? c->var_tmp_dir : NULL,
1601                         NULL};
1602         char **dirp;
1603
1604         for(dirp = dirs; *dirp; dirp++) {
1605                 log_debug("Spawning thread to nuke %s", *dirp);
1606                 asynchronous_job(remove_tmpdir_thread, *dirp);
1607         }
1608
1609         c->tmp_dir = c->var_tmp_dir = NULL;
1610 }
1611
1612 void exec_context_done(ExecContext *c, bool reloading_or_reexecuting) {
1613         unsigned l;
1614
1615         assert(c);
1616
1617         strv_free(c->environment);
1618         c->environment = NULL;
1619
1620         strv_free(c->environment_files);
1621         c->environment_files = NULL;
1622
1623         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1624                 free(c->rlimit[l]);
1625                 c->rlimit[l] = NULL;
1626         }
1627
1628         free(c->working_directory);
1629         c->working_directory = NULL;
1630         free(c->root_directory);
1631         c->root_directory = NULL;
1632
1633         free(c->tty_path);
1634         c->tty_path = NULL;
1635
1636         free(c->tcpwrap_name);
1637         c->tcpwrap_name = NULL;
1638
1639         free(c->syslog_identifier);
1640         c->syslog_identifier = NULL;
1641
1642         free(c->user);
1643         c->user = NULL;
1644
1645         free(c->group);
1646         c->group = NULL;
1647
1648         strv_free(c->supplementary_groups);
1649         c->supplementary_groups = NULL;
1650
1651         free(c->pam_name);
1652         c->pam_name = NULL;
1653
1654         if (c->capabilities) {
1655                 cap_free(c->capabilities);
1656                 c->capabilities = NULL;
1657         }
1658
1659         strv_free(c->read_only_dirs);
1660         c->read_only_dirs = NULL;
1661
1662         strv_free(c->read_write_dirs);
1663         c->read_write_dirs = NULL;
1664
1665         strv_free(c->inaccessible_dirs);
1666         c->inaccessible_dirs = NULL;
1667
1668         if (c->cpuset)
1669                 CPU_FREE(c->cpuset);
1670
1671         free(c->utmp_id);
1672         c->utmp_id = NULL;
1673
1674         free(c->syscall_filter);
1675         c->syscall_filter = NULL;
1676
1677         if (!reloading_or_reexecuting)
1678                 exec_context_tmp_dirs_done(c);
1679 }
1680
1681 void exec_command_done(ExecCommand *c) {
1682         assert(c);
1683
1684         free(c->path);
1685         c->path = NULL;
1686
1687         strv_free(c->argv);
1688         c->argv = NULL;
1689 }
1690
1691 void exec_command_done_array(ExecCommand *c, unsigned n) {
1692         unsigned i;
1693
1694         for (i = 0; i < n; i++)
1695                 exec_command_done(c+i);
1696 }
1697
1698 void exec_command_free_list(ExecCommand *c) {
1699         ExecCommand *i;
1700
1701         while ((i = c)) {
1702                 LIST_REMOVE(ExecCommand, command, c, i);
1703                 exec_command_done(i);
1704                 free(i);
1705         }
1706 }
1707
1708 void exec_command_free_array(ExecCommand **c, unsigned n) {
1709         unsigned i;
1710
1711         for (i = 0; i < n; i++) {
1712                 exec_command_free_list(c[i]);
1713                 c[i] = NULL;
1714         }
1715 }
1716
1717 int exec_context_load_environment(const ExecContext *c, char ***l) {
1718         char **i, **r = NULL;
1719
1720         assert(c);
1721         assert(l);
1722
1723         STRV_FOREACH(i, c->environment_files) {
1724                 char *fn;
1725                 int k;
1726                 bool ignore = false;
1727                 char **p;
1728                 _cleanup_globfree_ glob_t pglob = {};
1729                 int count, n;
1730
1731                 fn = *i;
1732
1733                 if (fn[0] == '-') {
1734                         ignore = true;
1735                         fn ++;
1736                 }
1737
1738                 if (!path_is_absolute(fn)) {
1739                         if (ignore)
1740                                 continue;
1741
1742                         strv_free(r);
1743                         return -EINVAL;
1744                 }
1745
1746                 /* Filename supports globbing, take all matching files */
1747                 errno = 0;
1748                 if (glob(fn, 0, NULL, &pglob) != 0) {
1749                         if (ignore)
1750                                 continue;
1751
1752                         strv_free(r);
1753                         return errno ? -errno : -EINVAL;
1754                 }
1755                 count = pglob.gl_pathc;
1756                 if (count == 0) {
1757                         if (ignore)
1758                                 continue;
1759
1760                         strv_free(r);
1761                         return -EINVAL;
1762                 }
1763                 for (n = 0; n < count; n++) {
1764                         k = load_env_file(pglob.gl_pathv[n], NULL, &p);
1765                         if (k < 0) {
1766                                 if (ignore)
1767                                         continue;
1768
1769                                 strv_free(r);
1770                                 return k;
1771                         }
1772                         /* Log invalid environment variables with filename */
1773                         if (p)
1774                                 p = strv_env_clean_log(p, pglob.gl_pathv[n]);
1775
1776                         if (r == NULL)
1777                                 r = p;
1778                         else {
1779                                 char **m;
1780
1781                                 m = strv_env_merge(2, r, p);
1782                                 strv_free(r);
1783                                 strv_free(p);
1784                                 if (!m)
1785                                         return -ENOMEM;
1786
1787                                 r = m;
1788                         }
1789                 }
1790         }
1791
1792         *l = r;
1793
1794         return 0;
1795 }
1796
1797 static bool tty_may_match_dev_console(const char *tty) {
1798         char *active = NULL, *console;
1799         bool b;
1800
1801         if (startswith(tty, "/dev/"))
1802                 tty += 5;
1803
1804         /* trivial identity? */
1805         if (streq(tty, "console"))
1806                 return true;
1807
1808         console = resolve_dev_console(&active);
1809         /* if we could not resolve, assume it may */
1810         if (!console)
1811                 return true;
1812
1813         /* "tty0" means the active VC, so it may be the same sometimes */
1814         b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
1815         free(active);
1816
1817         return b;
1818 }
1819
1820 bool exec_context_may_touch_console(ExecContext *ec) {
1821         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
1822                 is_terminal_input(ec->std_input) ||
1823                 is_terminal_output(ec->std_output) ||
1824                 is_terminal_output(ec->std_error)) &&
1825                tty_may_match_dev_console(tty_path(ec));
1826 }
1827
1828 static void strv_fprintf(FILE *f, char **l) {
1829         char **g;
1830
1831         assert(f);
1832
1833         STRV_FOREACH(g, l)
1834                 fprintf(f, " %s", *g);
1835 }
1836
1837 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1838         char **e;
1839         unsigned i;
1840
1841         assert(c);
1842         assert(f);
1843
1844         prefix = strempty(prefix);
1845
1846         fprintf(f,
1847                 "%sUMask: %04o\n"
1848                 "%sWorkingDirectory: %s\n"
1849                 "%sRootDirectory: %s\n"
1850                 "%sNonBlocking: %s\n"
1851                 "%sPrivateTmp: %s\n"
1852                 "%sPrivateNetwork: %s\n"
1853                 "%sIgnoreSIGPIPE: %s\n",
1854                 prefix, c->umask,
1855                 prefix, c->working_directory ? c->working_directory : "/",
1856                 prefix, c->root_directory ? c->root_directory : "/",
1857                 prefix, yes_no(c->non_blocking),
1858                 prefix, yes_no(c->private_tmp),
1859                 prefix, yes_no(c->private_network),
1860                 prefix, yes_no(c->ignore_sigpipe));
1861
1862         STRV_FOREACH(e, c->environment)
1863                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1864
1865         STRV_FOREACH(e, c->environment_files)
1866                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1867
1868         if (c->tcpwrap_name)
1869                 fprintf(f,
1870                         "%sTCPWrapName: %s\n",
1871                         prefix, c->tcpwrap_name);
1872
1873         if (c->nice_set)
1874                 fprintf(f,
1875                         "%sNice: %i\n",
1876                         prefix, c->nice);
1877
1878         if (c->oom_score_adjust_set)
1879                 fprintf(f,
1880                         "%sOOMScoreAdjust: %i\n",
1881                         prefix, c->oom_score_adjust);
1882
1883         for (i = 0; i < RLIM_NLIMITS; i++)
1884                 if (c->rlimit[i])
1885                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1886
1887         if (c->ioprio_set) {
1888                 char *class_str;
1889                 int r;
1890
1891                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
1892                 if (r < 0)
1893                         class_str = NULL;
1894                 fprintf(f,
1895                         "%sIOSchedulingClass: %s\n"
1896                         "%sIOPriority: %i\n",
1897                         prefix, strna(class_str),
1898                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1899                 free(class_str);
1900         }
1901
1902         if (c->cpu_sched_set) {
1903                 char *policy_str;
1904                 int r;
1905
1906                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
1907                 if (r < 0)
1908                         policy_str = NULL;
1909                 fprintf(f,
1910                         "%sCPUSchedulingPolicy: %s\n"
1911                         "%sCPUSchedulingPriority: %i\n"
1912                         "%sCPUSchedulingResetOnFork: %s\n",
1913                         prefix, strna(policy_str),
1914                         prefix, c->cpu_sched_priority,
1915                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1916                 free(policy_str);
1917         }
1918
1919         if (c->cpuset) {
1920                 fprintf(f, "%sCPUAffinity:", prefix);
1921                 for (i = 0; i < c->cpuset_ncpus; i++)
1922                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1923                                 fprintf(f, " %i", i);
1924                 fputs("\n", f);
1925         }
1926
1927         if (c->timer_slack_nsec != (nsec_t) -1)
1928                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, (unsigned long)c->timer_slack_nsec);
1929
1930         fprintf(f,
1931                 "%sStandardInput: %s\n"
1932                 "%sStandardOutput: %s\n"
1933                 "%sStandardError: %s\n",
1934                 prefix, exec_input_to_string(c->std_input),
1935                 prefix, exec_output_to_string(c->std_output),
1936                 prefix, exec_output_to_string(c->std_error));
1937
1938         if (c->tty_path)
1939                 fprintf(f,
1940                         "%sTTYPath: %s\n"
1941                         "%sTTYReset: %s\n"
1942                         "%sTTYVHangup: %s\n"
1943                         "%sTTYVTDisallocate: %s\n",
1944                         prefix, c->tty_path,
1945                         prefix, yes_no(c->tty_reset),
1946                         prefix, yes_no(c->tty_vhangup),
1947                         prefix, yes_no(c->tty_vt_disallocate));
1948
1949         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1950             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1951             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1952             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
1953                 char *fac_str, *lvl_str;
1954                 int r;
1955
1956                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
1957                 if (r < 0)
1958                         fac_str = NULL;
1959
1960                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
1961                 if (r < 0)
1962                         lvl_str = NULL;
1963
1964                 fprintf(f,
1965                         "%sSyslogFacility: %s\n"
1966                         "%sSyslogLevel: %s\n",
1967                         prefix, strna(fac_str),
1968                         prefix, strna(lvl_str));
1969                 free(lvl_str);
1970                 free(fac_str);
1971         }
1972
1973         if (c->capabilities) {
1974                 char *t;
1975                 if ((t = cap_to_text(c->capabilities, NULL))) {
1976                         fprintf(f, "%sCapabilities: %s\n",
1977                                 prefix, t);
1978                         cap_free(t);
1979                 }
1980         }
1981
1982         if (c->secure_bits)
1983                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1984                         prefix,
1985                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
1986                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1987                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1988                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1989                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
1990                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1991
1992         if (c->capability_bounding_set_drop) {
1993                 unsigned long l;
1994                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1995
1996                 for (l = 0; l <= cap_last_cap(); l++)
1997                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1998                                 char *t;
1999
2000                                 if ((t = cap_to_name(l))) {
2001                                         fprintf(f, " %s", t);
2002                                         cap_free(t);
2003                                 }
2004                         }
2005
2006                 fputs("\n", f);
2007         }
2008
2009         if (c->user)
2010                 fprintf(f, "%sUser: %s\n", prefix, c->user);
2011         if (c->group)
2012                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
2013
2014         if (strv_length(c->supplementary_groups) > 0) {
2015                 fprintf(f, "%sSupplementaryGroups:", prefix);
2016                 strv_fprintf(f, c->supplementary_groups);
2017                 fputs("\n", f);
2018         }
2019
2020         if (c->pam_name)
2021                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
2022
2023         if (strv_length(c->read_write_dirs) > 0) {
2024                 fprintf(f, "%sReadWriteDirs:", prefix);
2025                 strv_fprintf(f, c->read_write_dirs);
2026                 fputs("\n", f);
2027         }
2028
2029         if (strv_length(c->read_only_dirs) > 0) {
2030                 fprintf(f, "%sReadOnlyDirs:", prefix);
2031                 strv_fprintf(f, c->read_only_dirs);
2032                 fputs("\n", f);
2033         }
2034
2035         if (strv_length(c->inaccessible_dirs) > 0) {
2036                 fprintf(f, "%sInaccessibleDirs:", prefix);
2037                 strv_fprintf(f, c->inaccessible_dirs);
2038                 fputs("\n", f);
2039         }
2040
2041         if (c->utmp_id)
2042                 fprintf(f,
2043                         "%sUtmpIdentifier: %s\n",
2044                         prefix, c->utmp_id);
2045 }
2046
2047 void exec_status_start(ExecStatus *s, pid_t pid) {
2048         assert(s);
2049
2050         zero(*s);
2051         s->pid = pid;
2052         dual_timestamp_get(&s->start_timestamp);
2053 }
2054
2055 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2056         assert(s);
2057
2058         if (s->pid && s->pid != pid)
2059                 zero(*s);
2060
2061         s->pid = pid;
2062         dual_timestamp_get(&s->exit_timestamp);
2063
2064         s->code = code;
2065         s->status = status;
2066
2067         if (context) {
2068                 if (context->utmp_id)
2069                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2070
2071                 exec_context_tty_reset(context);
2072         }
2073 }
2074
2075 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2076         char buf[FORMAT_TIMESTAMP_MAX];
2077
2078         assert(s);
2079         assert(f);
2080
2081         if (!prefix)
2082                 prefix = "";
2083
2084         if (s->pid <= 0)
2085                 return;
2086
2087         fprintf(f,
2088                 "%sPID: %lu\n",
2089                 prefix, (unsigned long) s->pid);
2090
2091         if (s->start_timestamp.realtime > 0)
2092                 fprintf(f,
2093                         "%sStart Timestamp: %s\n",
2094                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2095
2096         if (s->exit_timestamp.realtime > 0)
2097                 fprintf(f,
2098                         "%sExit Timestamp: %s\n"
2099                         "%sExit Code: %s\n"
2100                         "%sExit Status: %i\n",
2101                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2102                         prefix, sigchld_code_to_string(s->code),
2103                         prefix, s->status);
2104 }
2105
2106 char *exec_command_line(char **argv) {
2107         size_t k;
2108         char *n, *p, **a;
2109         bool first = true;
2110
2111         assert(argv);
2112
2113         k = 1;
2114         STRV_FOREACH(a, argv)
2115                 k += strlen(*a)+3;
2116
2117         if (!(n = new(char, k)))
2118                 return NULL;
2119
2120         p = n;
2121         STRV_FOREACH(a, argv) {
2122
2123                 if (!first)
2124                         *(p++) = ' ';
2125                 else
2126                         first = false;
2127
2128                 if (strpbrk(*a, WHITESPACE)) {
2129                         *(p++) = '\'';
2130                         p = stpcpy(p, *a);
2131                         *(p++) = '\'';
2132                 } else
2133                         p = stpcpy(p, *a);
2134
2135         }
2136
2137         *p = 0;
2138
2139         /* FIXME: this doesn't really handle arguments that have
2140          * spaces and ticks in them */
2141
2142         return n;
2143 }
2144
2145 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2146         char *p2;
2147         const char *prefix2;
2148
2149         char *cmd;
2150
2151         assert(c);
2152         assert(f);
2153
2154         if (!prefix)
2155                 prefix = "";
2156         p2 = strappend(prefix, "\t");
2157         prefix2 = p2 ? p2 : prefix;
2158
2159         cmd = exec_command_line(c->argv);
2160
2161         fprintf(f,
2162                 "%sCommand Line: %s\n",
2163                 prefix, cmd ? cmd : strerror(ENOMEM));
2164
2165         free(cmd);
2166
2167         exec_status_dump(&c->exec_status, f, prefix2);
2168
2169         free(p2);
2170 }
2171
2172 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2173         assert(f);
2174
2175         if (!prefix)
2176                 prefix = "";
2177
2178         LIST_FOREACH(command, c, c)
2179                 exec_command_dump(c, f, prefix);
2180 }
2181
2182 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2183         ExecCommand *end;
2184
2185         assert(l);
2186         assert(e);
2187
2188         if (*l) {
2189                 /* It's kind of important, that we keep the order here */
2190                 LIST_FIND_TAIL(ExecCommand, command, *l, end);
2191                 LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
2192         } else
2193               *l = e;
2194 }
2195
2196 int exec_command_set(ExecCommand *c, const char *path, ...) {
2197         va_list ap;
2198         char **l, *p;
2199
2200         assert(c);
2201         assert(path);
2202
2203         va_start(ap, path);
2204         l = strv_new_ap(path, ap);
2205         va_end(ap);
2206
2207         if (!l)
2208                 return -ENOMEM;
2209
2210         if (!(p = strdup(path))) {
2211                 strv_free(l);
2212                 return -ENOMEM;
2213         }
2214
2215         free(c->path);
2216         c->path = p;
2217
2218         strv_free(c->argv);
2219         c->argv = l;
2220
2221         return 0;
2222 }
2223
2224 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2225         [EXEC_INPUT_NULL] = "null",
2226         [EXEC_INPUT_TTY] = "tty",
2227         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2228         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2229         [EXEC_INPUT_SOCKET] = "socket"
2230 };
2231
2232 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2233
2234 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2235         [EXEC_OUTPUT_INHERIT] = "inherit",
2236         [EXEC_OUTPUT_NULL] = "null",
2237         [EXEC_OUTPUT_TTY] = "tty",
2238         [EXEC_OUTPUT_SYSLOG] = "syslog",
2239         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2240         [EXEC_OUTPUT_KMSG] = "kmsg",
2241         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2242         [EXEC_OUTPUT_JOURNAL] = "journal",
2243         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2244         [EXEC_OUTPUT_SOCKET] = "socket"
2245 };
2246
2247 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);