src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <linux/seccomp-bpf.h>
  42 #include <glob.h>
  43 #include <libgen.h>
  44 #undef basename
  45
  46 #ifdef HAVE_PAM
  47 #include <security/pam_appl.h>
  48 #endif
  49
  50 #include "execute.h"
  51 #include "strv.h"
  52 #include "macro.h"
  53 #include "capability.h"
  54 #include "util.h"
  55 #include "log.h"
  56 #include "sd-messages.h"
  57 #include "ioprio.h"
  58 #include "securebits.h"
  59 #include "namespace.h"
  60 #include "tcpwrap.h"
  61 #include "exit-status.h"
  62 #include "missing.h"
  63 #include "utmp-wtmp.h"
  64 #include "def.h"
  65 #include "path-util.h"
  66 #include "syscall-list.h"
  67 #include "env-util.h"
  68 #include "fileio.h"
  69 #include "unit.h"
  70 #include "async.h"
  71
  72 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  73 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
  74
  75 /* This assumes there is a 'tty' group */
  76 #define TTY_MODE 0620
  77
  78 static int shift_fds(int fds[], unsigned n_fds) {
  79         int start, restart_from;
  80
  81         if (n_fds <= 0)
  82                 return 0;
  83
  84         /* Modifies the fds array! (sorts it) */
  85
  86         assert(fds);
  87
  88         start = 0;
  89         for (;;) {
  90                 int i;
  91
  92                 restart_from = -1;
  93
  94                 for (i = start; i < (int) n_fds; i++) {
  95                         int nfd;
  96
  97                         /* Already at right index? */
  98                         if (fds[i] == i+3)
  99                                 continue;
 100
 101                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
 102                                 return -errno;
 103
 104                         close_nointr_nofail(fds[i]);
 105                         fds[i] = nfd;
 106
 107                         /* Hmm, the fd we wanted isn't free? Then
 108                          * let's remember that and try again from here*/
 109                         if (nfd != i+3 && restart_from < 0)
 110                                 restart_from = i;
 111                 }
 112
 113                 if (restart_from < 0)
 114                         break;
 115
 116                 start = restart_from;
 117         }
 118
 119         return 0;
 120 }
 121
 122 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 123         unsigned i;
 124         int r;
 125
 126         if (n_fds <= 0)
 127                 return 0;
 128
 129         assert(fds);
 130
 131         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 132
 133         for (i = 0; i < n_fds; i++) {
 134
 135                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 136                         return r;
 137
 138                 /* We unconditionally drop FD_CLOEXEC from the fds,
 139                  * since after all we want to pass these fds to our
 140                  * children */
 141
 142                 if ((r = fd_cloexec(fds[i], false)) < 0)
 143                         return r;
 144         }
 145
 146         return 0;
 147 }
 148
 149 _pure_ static const char *tty_path(const ExecContext *context) {
 150         assert(context);
 151
 152         if (context->tty_path)
 153                 return context->tty_path;
 154
 155         return "/dev/console";
 156 }
 157
 158 static void exec_context_tty_reset(const ExecContext *context) {
 159         assert(context);
 160
 161         if (context->tty_vhangup)
 162                 terminal_vhangup(tty_path(context));
 163
 164         if (context->tty_reset)
 165                 reset_terminal(tty_path(context));
 166
 167         if (context->tty_vt_disallocate && context->tty_path)
 168                 vt_disallocate(context->tty_path);
 169 }
 170
 171 static bool is_terminal_output(ExecOutput o) {
 172         return
 173                 o == EXEC_OUTPUT_TTY ||
 174                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 175                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 176                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 177 }
 178
 179 static int open_null_as(int flags, int nfd) {
 180         int fd, r;
 181
 182         assert(nfd >= 0);
 183
 184         fd = open("/dev/null", flags|O_NOCTTY);
 185         if (fd < 0)
 186                 return -errno;
 187
 188         if (fd != nfd) {
 189                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 190                 close_nointr_nofail(fd);
 191         } else
 192                 r = nfd;
 193
 194         return r;
 195 }
 196
 197 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 198         int fd, r;
 199         union sockaddr_union sa = {
 200                 .un.sun_family = AF_UNIX,
 201                 .un.sun_path = "/run/systemd/journal/stdout",
 202         };
 203
 204         assert(context);
 205         assert(output < _EXEC_OUTPUT_MAX);
 206         assert(ident);
 207         assert(nfd >= 0);
 208
 209         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 210         if (fd < 0)
 211                 return -errno;
 212
 213         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 214         if (r < 0) {
 215                 close_nointr_nofail(fd);
 216                 return -errno;
 217         }
 218
 219         if (shutdown(fd, SHUT_RD) < 0) {
 220                 close_nointr_nofail(fd);
 221                 return -errno;
 222         }
 223
 224         dprintf(fd,
 225                 "%s\n"
 226                 "%s\n"
 227                 "%i\n"
 228                 "%i\n"
 229                 "%i\n"
 230                 "%i\n"
 231                 "%i\n",
 232                 context->syslog_identifier ? context->syslog_identifier : ident,
 233                 unit_id,
 234                 context->syslog_priority,
 235                 !!context->syslog_level_prefix,
 236                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 237                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 238                 is_terminal_output(output));
 239
 240         if (fd != nfd) {
 241                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 242                 close_nointr_nofail(fd);
 243         } else
 244                 r = nfd;
 245
 246         return r;
 247 }
 248 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 249         int fd, r;
 250
 251         assert(path);
 252         assert(nfd >= 0);
 253
 254         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 255                 return fd;
 256
 257         if (fd != nfd) {
 258                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 259                 close_nointr_nofail(fd);
 260         } else
 261                 r = nfd;
 262
 263         return r;
 264 }
 265
 266 static bool is_terminal_input(ExecInput i) {
 267         return
 268                 i == EXEC_INPUT_TTY ||
 269                 i == EXEC_INPUT_TTY_FORCE ||
 270                 i == EXEC_INPUT_TTY_FAIL;
 271 }
 272
 273 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 274
 275         if (is_terminal_input(std_input) && !apply_tty_stdin)
 276                 return EXEC_INPUT_NULL;
 277
 278         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 279                 return EXEC_INPUT_NULL;
 280
 281         return std_input;
 282 }
 283
 284 static int fixup_output(ExecOutput std_output, int socket_fd) {
 285
 286         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 287                 return EXEC_OUTPUT_INHERIT;
 288
 289         return std_output;
 290 }
 291
 292 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 293         ExecInput i;
 294
 295         assert(context);
 296
 297         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 298
 299         switch (i) {
 300
 301         case EXEC_INPUT_NULL:
 302                 return open_null_as(O_RDONLY, STDIN_FILENO);
 303
 304         case EXEC_INPUT_TTY:
 305         case EXEC_INPUT_TTY_FORCE:
 306         case EXEC_INPUT_TTY_FAIL: {
 307                 int fd, r;
 308
 309                 fd = acquire_terminal(tty_path(context),
 310                                       i == EXEC_INPUT_TTY_FAIL,
 311                                       i == EXEC_INPUT_TTY_FORCE,
 312                                       false,
 313                                       (usec_t) -1);
 314                 if (fd < 0)
 315                         return fd;
 316
 317                 if (fd != STDIN_FILENO) {
 318                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 319                         close_nointr_nofail(fd);
 320                 } else
 321                         r = STDIN_FILENO;
 322
 323                 return r;
 324         }
 325
 326         case EXEC_INPUT_SOCKET:
 327                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 328
 329         default:
 330                 assert_not_reached("Unknown input type");
 331         }
 332 }
 333
 334 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 335         ExecOutput o;
 336         ExecInput i;
 337         int r;
 338
 339         assert(context);
 340         assert(ident);
 341
 342         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 343         o = fixup_output(context->std_output, socket_fd);
 344
 345         if (fileno == STDERR_FILENO) {
 346                 ExecOutput e;
 347                 e = fixup_output(context->std_error, socket_fd);
 348
 349                 /* This expects the input and output are already set up */
 350
 351                 /* Don't change the stderr file descriptor if we inherit all
 352                  * the way and are not on a tty */
 353                 if (e == EXEC_OUTPUT_INHERIT &&
 354                     o == EXEC_OUTPUT_INHERIT &&
 355                     i == EXEC_INPUT_NULL &&
 356                     !is_terminal_input(context->std_input) &&
 357                     getppid () != 1)
 358                         return fileno;
 359
 360                 /* Duplicate from stdout if possible */
 361                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 362                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 363
 364                 o = e;
 365
 366         } else if (o == EXEC_OUTPUT_INHERIT) {
 367                 /* If input got downgraded, inherit the original value */
 368                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 369                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 370
 371                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 372                 if (i != EXEC_INPUT_NULL)
 373                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 374
 375                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 376                 if (getppid() != 1)
 377                         return fileno;
 378
 379                 /* We need to open /dev/null here anew, to get the right access mode. */
 380                 return open_null_as(O_WRONLY, fileno);
 381         }
 382
 383         switch (o) {
 384
 385         case EXEC_OUTPUT_NULL:
 386                 return open_null_as(O_WRONLY, fileno);
 387
 388         case EXEC_OUTPUT_TTY:
 389                 if (is_terminal_input(i))
 390                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 391
 392                 /* We don't reset the terminal if this is just about output */
 393                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 394
 395         case EXEC_OUTPUT_SYSLOG:
 396         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 397         case EXEC_OUTPUT_KMSG:
 398         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 399         case EXEC_OUTPUT_JOURNAL:
 400         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 401                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 402                 if (r < 0) {
 403                         log_struct_unit(LOG_CRIT, unit_id,
 404                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 405                                 fileno == STDOUT_FILENO ? "out" : "err",
 406                                 unit_id, strerror(-r),
 407                                 "ERRNO=%d", -r,
 408                                 NULL);
 409                         r = open_null_as(O_WRONLY, fileno);
 410                 }
 411                 return r;
 412
 413         case EXEC_OUTPUT_SOCKET:
 414                 assert(socket_fd >= 0);
 415                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 416
 417         default:
 418                 assert_not_reached("Unknown error type");
 419         }
 420 }
 421
 422 static int chown_terminal(int fd, uid_t uid) {
 423         struct stat st;
 424
 425         assert(fd >= 0);
 426
 427         /* This might fail. What matters are the results. */
 428         (void) fchown(fd, uid, -1);
 429         (void) fchmod(fd, TTY_MODE);
 430
 431         if (fstat(fd, &st) < 0)
 432                 return -errno;
 433
 434         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 435                 return -EPERM;
 436
 437         return 0;
 438 }
 439
 440 static int setup_confirm_stdio(int *_saved_stdin,
 441                                int *_saved_stdout) {
 442         int fd = -1, saved_stdin, saved_stdout = -1, r;
 443
 444         assert(_saved_stdin);
 445         assert(_saved_stdout);
 446
 447         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 448         if (saved_stdin < 0)
 449                 return -errno;
 450
 451         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 452         if (saved_stdout < 0) {
 453                 r = errno;
 454                 goto fail;
 455         }
 456
 457         fd = acquire_terminal(
 458                         "/dev/console",
 459                         false,
 460                         false,
 461                         false,
 462                         DEFAULT_CONFIRM_USEC);
 463         if (fd < 0) {
 464                 r = fd;
 465                 goto fail;
 466         }
 467
 468         r = chown_terminal(fd, getuid());
 469         if (r < 0)
 470                 goto fail;
 471
 472         if (dup2(fd, STDIN_FILENO) < 0) {
 473                 r = -errno;
 474                 goto fail;
 475         }
 476
 477         if (dup2(fd, STDOUT_FILENO) < 0) {
 478                 r = -errno;
 479                 goto fail;
 480         }
 481
 482         if (fd >= 2)
 483                 close_nointr_nofail(fd);
 484
 485         *_saved_stdin = saved_stdin;
 486         *_saved_stdout = saved_stdout;
 487
 488         return 0;
 489
 490 fail:
 491         if (saved_stdout >= 0)
 492                 close_nointr_nofail(saved_stdout);
 493
 494         if (saved_stdin >= 0)
 495                 close_nointr_nofail(saved_stdin);
 496
 497         if (fd >= 0)
 498                 close_nointr_nofail(fd);
 499
 500         return r;
 501 }
 502
 503 _printf_(1, 2) static int write_confirm_message(const char *format, ...) {
 504         int fd;
 505         va_list ap;
 506
 507         assert(format);
 508
 509         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 510         if (fd < 0)
 511                 return fd;
 512
 513         va_start(ap, format);
 514         vdprintf(fd, format, ap);
 515         va_end(ap);
 516
 517         close_nointr_nofail(fd);
 518
 519         return 0;
 520 }
 521
 522 static int restore_confirm_stdio(int *saved_stdin,
 523                                  int *saved_stdout) {
 524
 525         int r = 0;
 526
 527         assert(saved_stdin);
 528         assert(saved_stdout);
 529
 530         release_terminal();
 531
 532         if (*saved_stdin >= 0)
 533                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 534                         r = -errno;
 535
 536         if (*saved_stdout >= 0)
 537                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 538                         r = -errno;
 539
 540         if (*saved_stdin >= 0)
 541                 close_nointr_nofail(*saved_stdin);
 542
 543         if (*saved_stdout >= 0)
 544                 close_nointr_nofail(*saved_stdout);
 545
 546         return r;
 547 }
 548
 549 static int ask_for_confirmation(char *response, char **argv) {
 550         int saved_stdout = -1, saved_stdin = -1, r;
 551         char *line;
 552
 553         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 554         if (r < 0)
 555                 return r;
 556
 557         line = exec_command_line(argv);
 558         if (!line)
 559                 return -ENOMEM;
 560
 561         r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 562         free(line);
 563
 564         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 565
 566         return r;
 567 }
 568
 569 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 570         bool keep_groups = false;
 571         int r;
 572
 573         assert(context);
 574
 575         /* Lookup and set GID and supplementary group list. Here too
 576          * we avoid NSS lookups for gid=0. */
 577
 578         if (context->group || username) {
 579
 580                 if (context->group) {
 581                         const char *g = context->group;
 582
 583                         if ((r = get_group_creds(&g, &gid)) < 0)
 584                                 return r;
 585                 }
 586
 587                 /* First step, initialize groups from /etc/groups */
 588                 if (username && gid != 0) {
 589                         if (initgroups(username, gid) < 0)
 590                                 return -errno;
 591
 592                         keep_groups = true;
 593                 }
 594
 595                 /* Second step, set our gids */
 596                 if (setresgid(gid, gid, gid) < 0)
 597                         return -errno;
 598         }
 599
 600         if (context->supplementary_groups) {
 601                 int ngroups_max, k;
 602                 gid_t *gids;
 603                 char **i;
 604
 605                 /* Final step, initialize any manually set supplementary groups */
 606                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 607
 608                 if (!(gids = new(gid_t, ngroups_max)))
 609                         return -ENOMEM;
 610
 611                 if (keep_groups) {
 612                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 613                                 free(gids);
 614                                 return -errno;
 615                         }
 616                 } else
 617                         k = 0;
 618
 619                 STRV_FOREACH(i, context->supplementary_groups) {
 620                         const char *g;
 621
 622                         if (k >= ngroups_max) {
 623                                 free(gids);
 624                                 return -E2BIG;
 625                         }
 626
 627                         g = *i;
 628                         r = get_group_creds(&g, gids+k);
 629                         if (r < 0) {
 630                                 free(gids);
 631                                 return r;
 632                         }
 633
 634                         k++;
 635                 }
 636
 637                 if (setgroups(k, gids) < 0) {
 638                         free(gids);
 639                         return -errno;
 640                 }
 641
 642                 free(gids);
 643         }
 644
 645         return 0;
 646 }
 647
 648 static int enforce_user(const ExecContext *context, uid_t uid) {
 649         int r;
 650         assert(context);
 651
 652         /* Sets (but doesn't lookup) the uid and make sure we keep the
 653          * capabilities while doing so. */
 654
 655         if (context->capabilities) {
 656                 cap_t d;
 657                 static const cap_value_t bits[] = {
 658                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 659                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 660                 };
 661
 662                 /* First step: If we need to keep capabilities but
 663                  * drop privileges we need to make sure we keep our
 664                  * caps, while we drop privileges. */
 665                 if (uid != 0) {
 666                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 667
 668                         if (prctl(PR_GET_SECUREBITS) != sb)
 669                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 670                                         return -errno;
 671                 }
 672
 673                 /* Second step: set the capabilities. This will reduce
 674                  * the capabilities to the minimum we need. */
 675
 676                 if (!(d = cap_dup(context->capabilities)))
 677                         return -errno;
 678
 679                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 680                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 681                         r = -errno;
 682                         cap_free(d);
 683                         return r;
 684                 }
 685
 686                 if (cap_set_proc(d) < 0) {
 687                         r = -errno;
 688                         cap_free(d);
 689                         return r;
 690                 }
 691
 692                 cap_free(d);
 693         }
 694
 695         /* Third step: actually set the uids */
 696         if (setresuid(uid, uid, uid) < 0)
 697                 return -errno;
 698
 699         /* At this point we should have all necessary capabilities but
 700            are otherwise a normal user. However, the caps might got
 701            corrupted due to the setresuid() so we need clean them up
 702            later. This is done outside of this call. */
 703
 704         return 0;
 705 }
 706
 707 #ifdef HAVE_PAM
 708
 709 static int null_conv(
 710                 int num_msg,
 711                 const struct pam_message **msg,
 712                 struct pam_response **resp,
 713                 void *appdata_ptr) {
 714
 715         /* We don't support conversations */
 716
 717         return PAM_CONV_ERR;
 718 }
 719
 720 static int setup_pam(
 721                 const char *name,
 722                 const char *user,
 723                 uid_t uid,
 724                 const char *tty,
 725                 char ***pam_env,
 726                 int fds[], unsigned n_fds) {
 727
 728         static const struct pam_conv conv = {
 729                 .conv = null_conv,
 730                 .appdata_ptr = NULL
 731         };
 732
 733         pam_handle_t *handle = NULL;
 734         sigset_t ss, old_ss;
 735         int pam_code = PAM_SUCCESS;
 736         int err;
 737         char **e = NULL;
 738         bool close_session = false;
 739         pid_t pam_pid = 0, parent_pid;
 740         int flags = 0;
 741
 742         assert(name);
 743         assert(user);
 744         assert(pam_env);
 745
 746         /* We set up PAM in the parent process, then fork. The child
 747          * will then stay around until killed via PR_GET_PDEATHSIG or
 748          * systemd via the cgroup logic. It will then remove the PAM
 749          * session again. The parent process will exec() the actual
 750          * daemon. We do things this way to ensure that the main PID
 751          * of the daemon is the one we initially fork()ed. */
 752
 753         if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
 754                 flags |= PAM_SILENT;
 755
 756         pam_code = pam_start(name, user, &conv, &handle);
 757         if (pam_code != PAM_SUCCESS) {
 758                 handle = NULL;
 759                 goto fail;
 760         }
 761
 762         if (tty) {
 763                 pam_code = pam_set_item(handle, PAM_TTY, tty);
 764                 if (pam_code != PAM_SUCCESS)
 765                         goto fail;
 766         }
 767
 768         pam_code = pam_acct_mgmt(handle, flags);
 769         if (pam_code != PAM_SUCCESS)
 770                 goto fail;
 771
 772         pam_code = pam_open_session(handle, flags);
 773         if (pam_code != PAM_SUCCESS)
 774                 goto fail;
 775
 776         close_session = true;
 777
 778         e = pam_getenvlist(handle);
 779         if (!e) {
 780                 pam_code = PAM_BUF_ERR;
 781                 goto fail;
 782         }
 783
 784         /* Block SIGTERM, so that we know that it won't get lost in
 785          * the child */
 786         if (sigemptyset(&ss) < 0 ||
 787             sigaddset(&ss, SIGTERM) < 0 ||
 788             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 789                 goto fail;
 790
 791         parent_pid = getpid();
 792
 793         pam_pid = fork();
 794         if (pam_pid < 0)
 795                 goto fail;
 796
 797         if (pam_pid == 0) {
 798                 int sig;
 799                 int r = EXIT_PAM;
 800
 801                 /* The child's job is to reset the PAM session on
 802                  * termination */
 803
 804                 /* This string must fit in 10 chars (i.e. the length
 805                  * of "/sbin/init"), to look pretty in /bin/ps */
 806                 rename_process("(sd-pam)");
 807
 808                 /* Make sure we don't keep open the passed fds in this
 809                 child. We assume that otherwise only those fds are
 810                 open here that have been opened by PAM. */
 811                 close_many(fds, n_fds);
 812
 813                 /* Drop privileges - we don't need any to pam_close_session
 814                  * and this will make PR_SET_PDEATHSIG work in most cases.
 815                  * If this fails, ignore the error - but expect sd-pam threads
 816                  * to fail to exit normally */
 817                 if (setresuid(uid, uid, uid) < 0)
 818                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 819
 820                 /* Wait until our parent died. This will only work if
 821                  * the above setresuid() succeeds, otherwise the kernel
 822                  * will not allow unprivileged parents kill their privileged
 823                  * children this way. We rely on the control groups kill logic
 824                  * to do the rest for us. */
 825                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 826                         goto child_finish;
 827
 828                 /* Check if our parent process might already have
 829                  * died? */
 830                 if (getppid() == parent_pid) {
 831                         for (;;) {
 832                                 if (sigwait(&ss, &sig) < 0) {
 833                                         if (errno == EINTR)
 834                                                 continue;
 835
 836                                         goto child_finish;
 837                                 }
 838
 839                                 assert(sig == SIGTERM);
 840                                 break;
 841                         }
 842                 }
 843
 844                 /* If our parent died we'll end the session */
 845                 if (getppid() != parent_pid) {
 846                         pam_code = pam_close_session(handle, flags);
 847                         if (pam_code != PAM_SUCCESS)
 848                                 goto child_finish;
 849                 }
 850
 851                 r = 0;
 852
 853         child_finish:
 854                 pam_end(handle, pam_code | flags);
 855                 _exit(r);
 856         }
 857
 858         /* If the child was forked off successfully it will do all the
 859          * cleanups, so forget about the handle here. */
 860         handle = NULL;
 861
 862         /* Unblock SIGTERM again in the parent */
 863         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 864                 goto fail;
 865
 866         /* We close the log explicitly here, since the PAM modules
 867          * might have opened it, but we don't want this fd around. */
 868         closelog();
 869
 870         *pam_env = e;
 871         e = NULL;
 872
 873         return 0;
 874
 875 fail:
 876         if (pam_code != PAM_SUCCESS) {
 877                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
 878                 err = -EPERM;  /* PAM errors do not map to errno */
 879         } else {
 880                 log_error("PAM failed: %m");
 881                 err = -errno;
 882         }
 883
 884         if (handle) {
 885                 if (close_session)
 886                         pam_code = pam_close_session(handle, flags);
 887
 888                 pam_end(handle, pam_code | flags);
 889         }
 890
 891         strv_free(e);
 892
 893         closelog();
 894
 895         if (pam_pid > 1) {
 896                 kill(pam_pid, SIGTERM);
 897                 kill(pam_pid, SIGCONT);
 898         }
 899
 900         return err;
 901 }
 902 #endif
 903
 904 static void rename_process_from_path(const char *path) {
 905         char process_name[11];
 906         const char *p;
 907         size_t l;
 908
 909         /* This resulting string must fit in 10 chars (i.e. the length
 910          * of "/sbin/init") to look pretty in /bin/ps */
 911
 912         p = basename(path);
 913         if (isempty(p)) {
 914                 rename_process("(...)");
 915                 return;
 916         }
 917
 918         l = strlen(p);
 919         if (l > 8) {
 920                 /* The end of the process name is usually more
 921                  * interesting, since the first bit might just be
 922                  * "systemd-" */
 923                 p = p + l - 8;
 924                 l = 8;
 925         }
 926
 927         process_name[0] = '(';
 928         memcpy(process_name+1, p, l);
 929         process_name[1+l] = ')';
 930         process_name[1+l+1] = 0;
 931
 932         rename_process(process_name);
 933 }
 934
 935 static int apply_seccomp(uint32_t *syscall_filter) {
 936         static const struct sock_filter header[] = {
 937                 VALIDATE_ARCHITECTURE,
 938                 EXAMINE_SYSCALL
 939         };
 940         static const struct sock_filter footer[] = {
 941                 _KILL_PROCESS
 942         };
 943
 944         int i;
 945         unsigned n;
 946         struct sock_filter *f;
 947         struct sock_fprog prog = {};
 948
 949         assert(syscall_filter);
 950
 951         /* First: count the syscalls to check for */
 952         for (i = 0, n = 0; i < syscall_max(); i++)
 953                 if (syscall_filter[i >> 4] & (1 << (i & 31)))
 954                         n++;
 955
 956         /* Second: build the filter program from a header the syscall
 957          * matches and the footer */
 958         f = alloca(sizeof(struct sock_filter) * (ELEMENTSOF(header) + 2*n + ELEMENTSOF(footer)));
 959         memcpy(f, header, sizeof(header));
 960
 961         for (i = 0, n = 0; i < syscall_max(); i++)
 962                 if (syscall_filter[i >> 4] & (1 << (i & 31))) {
 963                         struct sock_filter item[] = {
 964                                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, INDEX_TO_SYSCALL(i), 0, 1),
 965                                 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 966                         };
 967
 968                         assert_cc(ELEMENTSOF(item) == 2);
 969
 970                         f[ELEMENTSOF(header) + 2*n]  = item[0];
 971                         f[ELEMENTSOF(header) + 2*n+1] = item[1];
 972
 973                         n++;
 974                 }
 975
 976         memcpy(f + (ELEMENTSOF(header) + 2*n), footer, sizeof(footer));
 977
 978         /* Third: install the filter */
 979         prog.len = ELEMENTSOF(header) + ELEMENTSOF(footer) + 2*n;
 980         prog.filter = f;
 981         if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0)
 982                 return -errno;
 983
 984         return 0;
 985 }
 986
 987 static void do_idle_pipe_dance(int idle_pipe[4]) {
 988         assert(idle_pipe);
 989
 990         if (idle_pipe[1] >= 0)
 991                 close_nointr_nofail(idle_pipe[1]);
 992         if (idle_pipe[2] >= 0)
 993                 close_nointr_nofail(idle_pipe[2]);
 994
 995         if (idle_pipe[0] >= 0) {
 996                 int r;
 997
 998                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
 999
1000                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1001                         /* Signal systemd that we are bored and want to continue. */
1002                         write(idle_pipe[3], "x", 1);
1003
1004                         /* Wait for systemd to react to the signal above. */
1005                         fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1006                 }
1007
1008                 close_nointr_nofail(idle_pipe[0]);
1009
1010         }
1011
1012         if (idle_pipe[3] >= 0)
1013                 close_nointr_nofail(idle_pipe[3]);
1014 }
1015
1016 int exec_spawn(ExecCommand *command,
1017                char **argv,
1018                ExecContext *context,
1019                int fds[], unsigned n_fds,
1020                char **environment,
1021                bool apply_permissions,
1022                bool apply_chroot,
1023                bool apply_tty_stdin,
1024                bool confirm_spawn,
1025                CGroupControllerMask cgroup_supported,
1026                const char *cgroup_path,
1027                const char *unit_id,
1028                int idle_pipe[4],
1029                ExecRuntime *runtime,
1030                pid_t *ret) {
1031
1032         _cleanup_strv_free_ char **files_env = NULL;
1033         int socket_fd;
1034         char *line;
1035         pid_t pid;
1036         int r;
1037
1038         assert(command);
1039         assert(context);
1040         assert(ret);
1041         assert(fds || n_fds <= 0);
1042
1043         if (context->std_input == EXEC_INPUT_SOCKET ||
1044             context->std_output == EXEC_OUTPUT_SOCKET ||
1045             context->std_error == EXEC_OUTPUT_SOCKET) {
1046
1047                 if (n_fds != 1)
1048                         return -EINVAL;
1049
1050                 socket_fd = fds[0];
1051
1052                 fds = NULL;
1053                 n_fds = 0;
1054         } else
1055                 socket_fd = -1;
1056
1057         r = exec_context_load_environment(context, &files_env);
1058         if (r < 0) {
1059                 log_struct_unit(LOG_ERR,
1060                            unit_id,
1061                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1062                            "ERRNO=%d", -r,
1063                            NULL);
1064                 return r;
1065         }
1066
1067         if (!argv)
1068                 argv = command->argv;
1069
1070         line = exec_command_line(argv);
1071         if (!line)
1072                 return log_oom();
1073
1074         log_struct_unit(LOG_DEBUG,
1075                         unit_id,
1076                         "EXECUTABLE=%s", command->path,
1077                         "MESSAGE=About to execute: %s", line,
1078                         NULL);
1079         free(line);
1080
1081         pid = fork();
1082         if (pid < 0)
1083                 return -errno;
1084
1085         if (pid == 0) {
1086                 _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
1087                 const char *username = NULL, *home = NULL, *shell = NULL;
1088                 unsigned n_dont_close = 0, n_env = 0;
1089                 int dont_close[n_fds + 3];
1090                 uid_t uid = (uid_t) -1;
1091                 gid_t gid = (gid_t) -1;
1092                 sigset_t ss;
1093                 int i, err;
1094
1095                 /* child */
1096
1097                 rename_process_from_path(command->path);
1098
1099                 /* We reset exactly these signals, since they are the
1100                  * only ones we set to SIG_IGN in the main daemon. All
1101                  * others we leave untouched because we set them to
1102                  * SIG_DFL or a valid handler initially, both of which
1103                  * will be demoted to SIG_DFL. */
1104                 default_signals(SIGNALS_CRASH_HANDLER,
1105                                 SIGNALS_IGNORE, -1);
1106
1107                 if (context->ignore_sigpipe)
1108                         ignore_signals(SIGPIPE, -1);
1109
1110                 assert_se(sigemptyset(&ss) == 0);
1111                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1112                         err = -errno;
1113                         r = EXIT_SIGNAL_MASK;
1114                         goto fail_child;
1115                 }
1116
1117                 if (idle_pipe)
1118                         do_idle_pipe_dance(idle_pipe);
1119
1120                 /* Close sockets very early to make sure we don't
1121                  * block init reexecution because it cannot bind its
1122                  * sockets */
1123                 log_forget_fds();
1124
1125                 if (socket_fd >= 0)
1126                         dont_close[n_dont_close++] = socket_fd;
1127                 if (n_fds > 0) {
1128                         memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1129                         n_dont_close += n_fds;
1130                 }
1131                 if (runtime) {
1132                         if (runtime->netns_storage_socket[0] >= 0)
1133                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
1134                         if (runtime->netns_storage_socket[1] >= 0)
1135                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
1136                 }
1137
1138                 err = close_all_fds(dont_close, n_dont_close);
1139                 if (err < 0) {
1140                         r = EXIT_FDS;
1141                         goto fail_child;
1142                 }
1143
1144                 if (!context->same_pgrp)
1145                         if (setsid() < 0) {
1146                                 err = -errno;
1147                                 r = EXIT_SETSID;
1148                                 goto fail_child;
1149                         }
1150
1151                 if (context->tcpwrap_name) {
1152                         if (socket_fd >= 0)
1153                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1154                                         err = -EACCES;
1155                                         r = EXIT_TCPWRAP;
1156                                         goto fail_child;
1157                                 }
1158
1159                         for (i = 0; i < (int) n_fds; i++) {
1160                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1161                                         err = -EACCES;
1162                                         r = EXIT_TCPWRAP;
1163                                         goto fail_child;
1164                                 }
1165                         }
1166                 }
1167
1168                 exec_context_tty_reset(context);
1169
1170                 if (confirm_spawn) {
1171                         char response;
1172
1173                         err = ask_for_confirmation(&response, argv);
1174                         if (err == -ETIMEDOUT)
1175                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1176                         else if (err < 0)
1177                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1178                         else if (response == 's') {
1179                                 write_confirm_message("Skipping execution.\n");
1180                                 err = -ECANCELED;
1181                                 r = EXIT_CONFIRM;
1182                                 goto fail_child;
1183                         } else if (response == 'n') {
1184                                 write_confirm_message("Failing execution.\n");
1185                                 err = r = 0;
1186                                 goto fail_child;
1187                         }
1188                 }
1189
1190                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1191                  * must sure to drop O_NONBLOCK */
1192                 if (socket_fd >= 0)
1193                         fd_nonblock(socket_fd, false);
1194
1195                 err = setup_input(context, socket_fd, apply_tty_stdin);
1196                 if (err < 0) {
1197                         r = EXIT_STDIN;
1198                         goto fail_child;
1199                 }
1200
1201                 err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1202                 if (err < 0) {
1203                         r = EXIT_STDOUT;
1204                         goto fail_child;
1205                 }
1206
1207                 err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1208                 if (err < 0) {
1209                         r = EXIT_STDERR;
1210                         goto fail_child;
1211                 }
1212
1213                 if (cgroup_path) {
1214                         err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
1215                         if (err < 0) {
1216                                 r = EXIT_CGROUP;
1217                                 goto fail_child;
1218                         }
1219                 }
1220
1221                 if (context->oom_score_adjust_set) {
1222                         char t[16];
1223
1224                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1225                         char_array_0(t);
1226
1227                         if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
1228                                 err = -errno;
1229                                 r = EXIT_OOM_ADJUST;
1230                                 goto fail_child;
1231                         }
1232                 }
1233
1234                 if (context->nice_set)
1235                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1236                                 err = -errno;
1237                                 r = EXIT_NICE;
1238                                 goto fail_child;
1239                         }
1240
1241                 if (context->cpu_sched_set) {
1242                         struct sched_param param = {
1243                                 .sched_priority = context->cpu_sched_priority,
1244                         };
1245
1246                         r = sched_setscheduler(0,
1247                                                context->cpu_sched_policy |
1248                                                (context->cpu_sched_reset_on_fork ?
1249                                                 SCHED_RESET_ON_FORK : 0),
1250                                                &param);
1251                         if (r < 0) {
1252                                 err = -errno;
1253                                 r = EXIT_SETSCHEDULER;
1254                                 goto fail_child;
1255                         }
1256                 }
1257
1258                 if (context->cpuset)
1259                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1260                                 err = -errno;
1261                                 r = EXIT_CPUAFFINITY;
1262                                 goto fail_child;
1263                         }
1264
1265                 if (context->ioprio_set)
1266                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1267                                 err = -errno;
1268                                 r = EXIT_IOPRIO;
1269                                 goto fail_child;
1270                         }
1271
1272                 if (context->timer_slack_nsec != (nsec_t) -1)
1273                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1274                                 err = -errno;
1275                                 r = EXIT_TIMERSLACK;
1276                                 goto fail_child;
1277                         }
1278
1279                 if (context->utmp_id)
1280                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1281
1282                 if (context->user) {
1283                         username = context->user;
1284                         err = get_user_creds(&username, &uid, &gid, &home, &shell);
1285                         if (err < 0) {
1286                                 r = EXIT_USER;
1287                                 goto fail_child;
1288                         }
1289
1290                         if (is_terminal_input(context->std_input)) {
1291                                 err = chown_terminal(STDIN_FILENO, uid);
1292                                 if (err < 0) {
1293                                         r = EXIT_STDIN;
1294                                         goto fail_child;
1295                                 }
1296                         }
1297                 }
1298
1299 #ifdef HAVE_PAM
1300                 if (cgroup_path && context->user && context->pam_name) {
1301                         err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
1302                         if (err < 0) {
1303                                 r = EXIT_CGROUP;
1304                                 goto fail_child;
1305                         }
1306
1307
1308                         err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
1309                         if (err < 0) {
1310                                 r = EXIT_CGROUP;
1311                                 goto fail_child;
1312                         }
1313                 }
1314 #endif
1315
1316                 if (apply_permissions) {
1317                         err = enforce_groups(context, username, gid);
1318                         if (err < 0) {
1319                                 r = EXIT_GROUP;
1320                                 goto fail_child;
1321                         }
1322                 }
1323
1324                 umask(context->umask);
1325
1326 #ifdef HAVE_PAM
1327                 if (apply_permissions && context->pam_name && username) {
1328                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1329                         if (err < 0) {
1330                                 r = EXIT_PAM;
1331                                 goto fail_child;
1332                         }
1333                 }
1334 #endif
1335                 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
1336                         err = setup_netns(runtime->netns_storage_socket);
1337                         if (err < 0) {
1338                                 r = EXIT_NETWORK;
1339                                 goto fail_child;
1340                         }
1341                 }
1342
1343                 if (!strv_isempty(context->read_write_dirs) ||
1344                     !strv_isempty(context->read_only_dirs) ||
1345                     !strv_isempty(context->inaccessible_dirs) ||
1346                     context->mount_flags != 0 ||
1347                     (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))) {
1348
1349                         char *tmp = NULL, *var = NULL;
1350
1351                         /* The runtime struct only contains the parent
1352                          * of the private /tmp, which is
1353                          * non-accessible to world users. Inside of it
1354                          * there's a /tmp that is sticky, and that's
1355                          * the one we want to use here. */
1356
1357                         if (context->private_tmp && runtime) {
1358                                 if (runtime->tmp_dir)
1359                                         tmp = strappenda(runtime->tmp_dir, "/tmp");
1360                                 if (runtime->var_tmp_dir)
1361                                         var = strappenda(runtime->var_tmp_dir, "/tmp");
1362                         }
1363
1364                         err = setup_namespace(
1365                                         context->read_write_dirs,
1366                                         context->read_only_dirs,
1367                                         context->inaccessible_dirs,
1368                                         tmp,
1369                                         var,
1370                                         context->mount_flags);
1371
1372                         if (err < 0) {
1373                                 r = EXIT_NAMESPACE;
1374                                 goto fail_child;
1375                         }
1376                 }
1377
1378                 if (apply_chroot) {
1379                         if (context->root_directory)
1380                                 if (chroot(context->root_directory) < 0) {
1381                                         err = -errno;
1382                                         r = EXIT_CHROOT;
1383                                         goto fail_child;
1384                                 }
1385
1386                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1387                                 err = -errno;
1388                                 r = EXIT_CHDIR;
1389                                 goto fail_child;
1390                         }
1391                 } else {
1392                         _cleanup_free_ char *d = NULL;
1393
1394                         if (asprintf(&d, "%s/%s",
1395                                      context->root_directory ? context->root_directory : "",
1396                                      context->working_directory ? context->working_directory : "") < 0) {
1397                                 err = -ENOMEM;
1398                                 r = EXIT_MEMORY;
1399                                 goto fail_child;
1400                         }
1401
1402                         if (chdir(d) < 0) {
1403                                 err = -errno;
1404                                 r = EXIT_CHDIR;
1405                                 goto fail_child;
1406                         }
1407                 }
1408
1409                 /* We repeat the fd closing here, to make sure that
1410                  * nothing is leaked from the PAM modules */
1411                 err = close_all_fds(fds, n_fds);
1412                 if (err >= 0)
1413                         err = shift_fds(fds, n_fds);
1414                 if (err >= 0)
1415                         err = flags_fds(fds, n_fds, context->non_blocking);
1416                 if (err < 0) {
1417                         r = EXIT_FDS;
1418                         goto fail_child;
1419                 }
1420
1421                 if (apply_permissions) {
1422
1423                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1424                                 if (!context->rlimit[i])
1425                                         continue;
1426
1427                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1428                                         err = -errno;
1429                                         r = EXIT_LIMITS;
1430                                         goto fail_child;
1431                                 }
1432                         }
1433
1434                         if (context->capability_bounding_set_drop) {
1435                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1436                                 if (err < 0) {
1437                                         r = EXIT_CAPABILITIES;
1438                                         goto fail_child;
1439                                 }
1440                         }
1441
1442                         if (context->user) {
1443                                 err = enforce_user(context, uid);
1444                                 if (err < 0) {
1445                                         r = EXIT_USER;
1446                                         goto fail_child;
1447                                 }
1448                         }
1449
1450                         /* PR_GET_SECUREBITS is not privileged, while
1451                          * PR_SET_SECUREBITS is. So to suppress
1452                          * potential EPERMs we'll try not to call
1453                          * PR_SET_SECUREBITS unless necessary. */
1454                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1455                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1456                                         err = -errno;
1457                                         r = EXIT_SECUREBITS;
1458                                         goto fail_child;
1459                                 }
1460
1461                         if (context->capabilities)
1462                                 if (cap_set_proc(context->capabilities) < 0) {
1463                                         err = -errno;
1464                                         r = EXIT_CAPABILITIES;
1465                                         goto fail_child;
1466                                 }
1467
1468                         if (context->no_new_privileges)
1469                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1470                                         err = -errno;
1471                                         r = EXIT_NO_NEW_PRIVILEGES;
1472                                         goto fail_child;
1473                                 }
1474
1475                         if (context->syscall_filter) {
1476                                 err = apply_seccomp(context->syscall_filter);
1477                                 if (err < 0) {
1478                                         r = EXIT_SECCOMP;
1479                                         goto fail_child;
1480                                 }
1481                         }
1482                 }
1483
1484                 our_env = new(char*, 8);
1485                 if (!our_env ||
1486                     (n_fds > 0 && (
1487                             asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1488                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0)) ||
1489                     (home && asprintf(our_env + n_env++, "HOME=%s", home) < 0) ||
1490                     (username && (
1491                             asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1492                             asprintf(our_env + n_env++, "USER=%s", username) < 0)) ||
1493                     (shell && asprintf(our_env + n_env++, "SHELL=%s", shell) < 0) ||
1494                     ((is_terminal_input(context->std_input) ||
1495                       context->std_output == EXEC_OUTPUT_TTY ||
1496                       context->std_error == EXEC_OUTPUT_TTY) && (
1497                               !(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))))) {
1498
1499                         err = -ENOMEM;
1500                         r = EXIT_MEMORY;
1501                         goto fail_child;
1502                 }
1503
1504                 our_env[n_env++] = NULL;
1505                 assert(n_env <= 8);
1506
1507                 final_env = strv_env_merge(5,
1508                                            environment,
1509                                            our_env,
1510                                            context->environment,
1511                                            files_env,
1512                                            pam_env,
1513                                            NULL);
1514                 if (!final_env) {
1515                         err = -ENOMEM;
1516                         r = EXIT_MEMORY;
1517                         goto fail_child;
1518                 }
1519
1520                 final_argv = replace_env_argv(argv, final_env);
1521                 if (!final_argv) {
1522                         err = -ENOMEM;
1523                         r = EXIT_MEMORY;
1524                         goto fail_child;
1525                 }
1526
1527                 final_env = strv_env_clean(final_env);
1528
1529                 if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
1530                         line = exec_command_line(final_argv);
1531                         if (line) {
1532                                 log_open();
1533                                 log_struct_unit(LOG_DEBUG,
1534                                                 unit_id,
1535                                                 "EXECUTABLE=%s", command->path,
1536                                                 "MESSAGE=Executing: %s", line,
1537                                                 NULL);
1538                                 log_close();
1539                                 free(line);
1540                                 line = NULL;
1541                         }
1542                 }
1543                 execve(command->path, final_argv, final_env);
1544                 err = -errno;
1545                 r = EXIT_EXEC;
1546
1547         fail_child:
1548                 if (r != 0) {
1549                         log_open();
1550                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1551                                    "EXECUTABLE=%s", command->path,
1552                                    "MESSAGE=Failed at step %s spawning %s: %s",
1553                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1554                                           command->path, strerror(-err),
1555                                    "ERRNO=%d", -err,
1556                                    NULL);
1557                         log_close();
1558                 }
1559
1560                 _exit(r);
1561         }
1562
1563         log_struct_unit(LOG_DEBUG,
1564                         unit_id,
1565                         "MESSAGE=Forked %s as %lu",
1566                         command->path, (unsigned long) pid,
1567                         NULL);
1568
1569         /* We add the new process to the cgroup both in the child (so
1570          * that we can be sure that no user code is ever executed
1571          * outside of the cgroup) and in the parent (so that we can be
1572          * sure that when we kill the cgroup the process will be
1573          * killed too). */
1574         if (cgroup_path)
1575                 cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
1576
1577         exec_status_start(&command->exec_status, pid);
1578
1579         *ret = pid;
1580         return 0;
1581 }
1582
1583 void exec_context_init(ExecContext *c) {
1584         assert(c);
1585
1586         c->umask = 0022;
1587         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1588         c->cpu_sched_policy = SCHED_OTHER;
1589         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1590         c->syslog_level_prefix = true;
1591         c->ignore_sigpipe = true;
1592         c->timer_slack_nsec = (nsec_t) -1;
1593 }
1594
1595 void exec_context_done(ExecContext *c) {
1596         unsigned l;
1597
1598         assert(c);
1599
1600         strv_free(c->environment);
1601         c->environment = NULL;
1602
1603         strv_free(c->environment_files);
1604         c->environment_files = NULL;
1605
1606         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1607                 free(c->rlimit[l]);
1608                 c->rlimit[l] = NULL;
1609         }
1610
1611         free(c->working_directory);
1612         c->working_directory = NULL;
1613         free(c->root_directory);
1614         c->root_directory = NULL;
1615
1616         free(c->tty_path);
1617         c->tty_path = NULL;
1618
1619         free(c->tcpwrap_name);
1620         c->tcpwrap_name = NULL;
1621
1622         free(c->syslog_identifier);
1623         c->syslog_identifier = NULL;
1624
1625         free(c->user);
1626         c->user = NULL;
1627
1628         free(c->group);
1629         c->group = NULL;
1630
1631         strv_free(c->supplementary_groups);
1632         c->supplementary_groups = NULL;
1633
1634         free(c->pam_name);
1635         c->pam_name = NULL;
1636
1637         if (c->capabilities) {
1638                 cap_free(c->capabilities);
1639                 c->capabilities = NULL;
1640         }
1641
1642         strv_free(c->read_only_dirs);
1643         c->read_only_dirs = NULL;
1644
1645         strv_free(c->read_write_dirs);
1646         c->read_write_dirs = NULL;
1647
1648         strv_free(c->inaccessible_dirs);
1649         c->inaccessible_dirs = NULL;
1650
1651         if (c->cpuset)
1652                 CPU_FREE(c->cpuset);
1653
1654         free(c->utmp_id);
1655         c->utmp_id = NULL;
1656
1657         free(c->syscall_filter);
1658         c->syscall_filter = NULL;
1659 }
1660
1661 void exec_command_done(ExecCommand *c) {
1662         assert(c);
1663
1664         free(c->path);
1665         c->path = NULL;
1666
1667         strv_free(c->argv);
1668         c->argv = NULL;
1669 }
1670
1671 void exec_command_done_array(ExecCommand *c, unsigned n) {
1672         unsigned i;
1673
1674         for (i = 0; i < n; i++)
1675                 exec_command_done(c+i);
1676 }
1677
1678 void exec_command_free_list(ExecCommand *c) {
1679         ExecCommand *i;
1680
1681         while ((i = c)) {
1682                 LIST_REMOVE(command, c, i);
1683                 exec_command_done(i);
1684                 free(i);
1685         }
1686 }
1687
1688 void exec_command_free_array(ExecCommand **c, unsigned n) {
1689         unsigned i;
1690
1691         for (i = 0; i < n; i++) {
1692                 exec_command_free_list(c[i]);
1693                 c[i] = NULL;
1694         }
1695 }
1696
1697 int exec_context_load_environment(const ExecContext *c, char ***l) {
1698         char **i, **r = NULL;
1699
1700         assert(c);
1701         assert(l);
1702
1703         STRV_FOREACH(i, c->environment_files) {
1704                 char *fn;
1705                 int k;
1706                 bool ignore = false;
1707                 char **p;
1708                 _cleanup_globfree_ glob_t pglob = {};
1709                 int count, n;
1710
1711                 fn = *i;
1712
1713                 if (fn[0] == '-') {
1714                         ignore = true;
1715                         fn ++;
1716                 }
1717
1718                 if (!path_is_absolute(fn)) {
1719                         if (ignore)
1720                                 continue;
1721
1722                         strv_free(r);
1723                         return -EINVAL;
1724                 }
1725
1726                 /* Filename supports globbing, take all matching files */
1727                 errno = 0;
1728                 if (glob(fn, 0, NULL, &pglob) != 0) {
1729                         if (ignore)
1730                                 continue;
1731
1732                         strv_free(r);
1733                         return errno ? -errno : -EINVAL;
1734                 }
1735                 count = pglob.gl_pathc;
1736                 if (count == 0) {
1737                         if (ignore)
1738                                 continue;
1739
1740                         strv_free(r);
1741                         return -EINVAL;
1742                 }
1743                 for (n = 0; n < count; n++) {
1744                         k = load_env_file(pglob.gl_pathv[n], NULL, &p);
1745                         if (k < 0) {
1746                                 if (ignore)
1747                                         continue;
1748
1749                                 strv_free(r);
1750                                 return k;
1751                         }
1752                         /* Log invalid environment variables with filename */
1753                         if (p)
1754                                 p = strv_env_clean_log(p, pglob.gl_pathv[n]);
1755
1756                         if (r == NULL)
1757                                 r = p;
1758                         else {
1759                                 char **m;
1760
1761                                 m = strv_env_merge(2, r, p);
1762                                 strv_free(r);
1763                                 strv_free(p);
1764                                 if (!m)
1765                                         return -ENOMEM;
1766
1767                                 r = m;
1768                         }
1769                 }
1770         }
1771
1772         *l = r;
1773
1774         return 0;
1775 }
1776
1777 static bool tty_may_match_dev_console(const char *tty) {
1778         char *active = NULL, *console;
1779         bool b;
1780
1781         if (startswith(tty, "/dev/"))
1782                 tty += 5;
1783
1784         /* trivial identity? */
1785         if (streq(tty, "console"))
1786                 return true;
1787
1788         console = resolve_dev_console(&active);
1789         /* if we could not resolve, assume it may */
1790         if (!console)
1791                 return true;
1792
1793         /* "tty0" means the active VC, so it may be the same sometimes */
1794         b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
1795         free(active);
1796
1797         return b;
1798 }
1799
1800 bool exec_context_may_touch_console(ExecContext *ec) {
1801         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
1802                 is_terminal_input(ec->std_input) ||
1803                 is_terminal_output(ec->std_output) ||
1804                 is_terminal_output(ec->std_error)) &&
1805                tty_may_match_dev_console(tty_path(ec));
1806 }
1807
1808 static void strv_fprintf(FILE *f, char **l) {
1809         char **g;
1810
1811         assert(f);
1812
1813         STRV_FOREACH(g, l)
1814                 fprintf(f, " %s", *g);
1815 }
1816
1817 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1818         char **e;
1819         unsigned i;
1820
1821         assert(c);
1822         assert(f);
1823
1824         prefix = strempty(prefix);
1825
1826         fprintf(f,
1827                 "%sUMask: %04o\n"
1828                 "%sWorkingDirectory: %s\n"
1829                 "%sRootDirectory: %s\n"
1830                 "%sNonBlocking: %s\n"
1831                 "%sPrivateTmp: %s\n"
1832                 "%sPrivateNetwork: %s\n"
1833                 "%sIgnoreSIGPIPE: %s\n",
1834                 prefix, c->umask,
1835                 prefix, c->working_directory ? c->working_directory : "/",
1836                 prefix, c->root_directory ? c->root_directory : "/",
1837                 prefix, yes_no(c->non_blocking),
1838                 prefix, yes_no(c->private_tmp),
1839                 prefix, yes_no(c->private_network),
1840                 prefix, yes_no(c->ignore_sigpipe));
1841
1842         STRV_FOREACH(e, c->environment)
1843                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1844
1845         STRV_FOREACH(e, c->environment_files)
1846                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1847
1848         if (c->tcpwrap_name)
1849                 fprintf(f,
1850                         "%sTCPWrapName: %s\n",
1851                         prefix, c->tcpwrap_name);
1852
1853         if (c->nice_set)
1854                 fprintf(f,
1855                         "%sNice: %i\n",
1856                         prefix, c->nice);
1857
1858         if (c->oom_score_adjust_set)
1859                 fprintf(f,
1860                         "%sOOMScoreAdjust: %i\n",
1861                         prefix, c->oom_score_adjust);
1862
1863         for (i = 0; i < RLIM_NLIMITS; i++)
1864                 if (c->rlimit[i])
1865                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1866
1867         if (c->ioprio_set) {
1868                 char *class_str;
1869                 int r;
1870
1871                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
1872                 if (r < 0)
1873                         class_str = NULL;
1874                 fprintf(f,
1875                         "%sIOSchedulingClass: %s\n"
1876                         "%sIOPriority: %i\n",
1877                         prefix, strna(class_str),
1878                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1879                 free(class_str);
1880         }
1881
1882         if (c->cpu_sched_set) {
1883                 char *policy_str;
1884                 int r;
1885
1886                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
1887                 if (r < 0)
1888                         policy_str = NULL;
1889                 fprintf(f,
1890                         "%sCPUSchedulingPolicy: %s\n"
1891                         "%sCPUSchedulingPriority: %i\n"
1892                         "%sCPUSchedulingResetOnFork: %s\n",
1893                         prefix, strna(policy_str),
1894                         prefix, c->cpu_sched_priority,
1895                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1896                 free(policy_str);
1897         }
1898
1899         if (c->cpuset) {
1900                 fprintf(f, "%sCPUAffinity:", prefix);
1901                 for (i = 0; i < c->cpuset_ncpus; i++)
1902                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1903                                 fprintf(f, " %i", i);
1904                 fputs("\n", f);
1905         }
1906
1907         if (c->timer_slack_nsec != (nsec_t) -1)
1908                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, (unsigned long)c->timer_slack_nsec);
1909
1910         fprintf(f,
1911                 "%sStandardInput: %s\n"
1912                 "%sStandardOutput: %s\n"
1913                 "%sStandardError: %s\n",
1914                 prefix, exec_input_to_string(c->std_input),
1915                 prefix, exec_output_to_string(c->std_output),
1916                 prefix, exec_output_to_string(c->std_error));
1917
1918         if (c->tty_path)
1919                 fprintf(f,
1920                         "%sTTYPath: %s\n"
1921                         "%sTTYReset: %s\n"
1922                         "%sTTYVHangup: %s\n"
1923                         "%sTTYVTDisallocate: %s\n",
1924                         prefix, c->tty_path,
1925                         prefix, yes_no(c->tty_reset),
1926                         prefix, yes_no(c->tty_vhangup),
1927                         prefix, yes_no(c->tty_vt_disallocate));
1928
1929         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1930             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1931             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1932             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
1933                 char *fac_str, *lvl_str;
1934                 int r;
1935
1936                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
1937                 if (r < 0)
1938                         fac_str = NULL;
1939
1940                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
1941                 if (r < 0)
1942                         lvl_str = NULL;
1943
1944                 fprintf(f,
1945                         "%sSyslogFacility: %s\n"
1946                         "%sSyslogLevel: %s\n",
1947                         prefix, strna(fac_str),
1948                         prefix, strna(lvl_str));
1949                 free(lvl_str);
1950                 free(fac_str);
1951         }
1952
1953         if (c->capabilities) {
1954                 char *t;
1955                 if ((t = cap_to_text(c->capabilities, NULL))) {
1956                         fprintf(f, "%sCapabilities: %s\n",
1957                                 prefix, t);
1958                         cap_free(t);
1959                 }
1960         }
1961
1962         if (c->secure_bits)
1963                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1964                         prefix,
1965                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
1966                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1967                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1968                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1969                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
1970                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1971
1972         if (c->capability_bounding_set_drop) {
1973                 unsigned long l;
1974                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1975
1976                 for (l = 0; l <= cap_last_cap(); l++)
1977                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1978                                 char *t;
1979
1980                                 if ((t = cap_to_name(l))) {
1981                                         fprintf(f, " %s", t);
1982                                         cap_free(t);
1983                                 }
1984                         }
1985
1986                 fputs("\n", f);
1987         }
1988
1989         if (c->user)
1990                 fprintf(f, "%sUser: %s\n", prefix, c->user);
1991         if (c->group)
1992                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
1993
1994         if (strv_length(c->supplementary_groups) > 0) {
1995                 fprintf(f, "%sSupplementaryGroups:", prefix);
1996                 strv_fprintf(f, c->supplementary_groups);
1997                 fputs("\n", f);
1998         }
1999
2000         if (c->pam_name)
2001                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
2002
2003         if (strv_length(c->read_write_dirs) > 0) {
2004                 fprintf(f, "%sReadWriteDirs:", prefix);
2005                 strv_fprintf(f, c->read_write_dirs);
2006                 fputs("\n", f);
2007         }
2008
2009         if (strv_length(c->read_only_dirs) > 0) {
2010                 fprintf(f, "%sReadOnlyDirs:", prefix);
2011                 strv_fprintf(f, c->read_only_dirs);
2012                 fputs("\n", f);
2013         }
2014
2015         if (strv_length(c->inaccessible_dirs) > 0) {
2016                 fprintf(f, "%sInaccessibleDirs:", prefix);
2017                 strv_fprintf(f, c->inaccessible_dirs);
2018                 fputs("\n", f);
2019         }
2020
2021         if (c->utmp_id)
2022                 fprintf(f,
2023                         "%sUtmpIdentifier: %s\n",
2024                         prefix, c->utmp_id);
2025 }
2026
2027 void exec_status_start(ExecStatus *s, pid_t pid) {
2028         assert(s);
2029
2030         zero(*s);
2031         s->pid = pid;
2032         dual_timestamp_get(&s->start_timestamp);
2033 }
2034
2035 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2036         assert(s);
2037
2038         if (s->pid && s->pid != pid)
2039                 zero(*s);
2040
2041         s->pid = pid;
2042         dual_timestamp_get(&s->exit_timestamp);
2043
2044         s->code = code;
2045         s->status = status;
2046
2047         if (context) {
2048                 if (context->utmp_id)
2049                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2050
2051                 exec_context_tty_reset(context);
2052         }
2053 }
2054
2055 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2056         char buf[FORMAT_TIMESTAMP_MAX];
2057
2058         assert(s);
2059         assert(f);
2060
2061         if (!prefix)
2062                 prefix = "";
2063
2064         if (s->pid <= 0)
2065                 return;
2066
2067         fprintf(f,
2068                 "%sPID: %lu\n",
2069                 prefix, (unsigned long) s->pid);
2070
2071         if (s->start_timestamp.realtime > 0)
2072                 fprintf(f,
2073                         "%sStart Timestamp: %s\n",
2074                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2075
2076         if (s->exit_timestamp.realtime > 0)
2077                 fprintf(f,
2078                         "%sExit Timestamp: %s\n"
2079                         "%sExit Code: %s\n"
2080                         "%sExit Status: %i\n",
2081                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2082                         prefix, sigchld_code_to_string(s->code),
2083                         prefix, s->status);
2084 }
2085
2086 char *exec_command_line(char **argv) {
2087         size_t k;
2088         char *n, *p, **a;
2089         bool first = true;
2090
2091         assert(argv);
2092
2093         k = 1;
2094         STRV_FOREACH(a, argv)
2095                 k += strlen(*a)+3;
2096
2097         if (!(n = new(char, k)))
2098                 return NULL;
2099
2100         p = n;
2101         STRV_FOREACH(a, argv) {
2102
2103                 if (!first)
2104                         *(p++) = ' ';
2105                 else
2106                         first = false;
2107
2108                 if (strpbrk(*a, WHITESPACE)) {
2109                         *(p++) = '\'';
2110                         p = stpcpy(p, *a);
2111                         *(p++) = '\'';
2112                 } else
2113                         p = stpcpy(p, *a);
2114
2115         }
2116
2117         *p = 0;
2118
2119         /* FIXME: this doesn't really handle arguments that have
2120          * spaces and ticks in them */
2121
2122         return n;
2123 }
2124
2125 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2126         char *p2;
2127         const char *prefix2;
2128
2129         char *cmd;
2130
2131         assert(c);
2132         assert(f);
2133
2134         if (!prefix)
2135                 prefix = "";
2136         p2 = strappend(prefix, "\t");
2137         prefix2 = p2 ? p2 : prefix;
2138
2139         cmd = exec_command_line(c->argv);
2140
2141         fprintf(f,
2142                 "%sCommand Line: %s\n",
2143                 prefix, cmd ? cmd : strerror(ENOMEM));
2144
2145         free(cmd);
2146
2147         exec_status_dump(&c->exec_status, f, prefix2);
2148
2149         free(p2);
2150 }
2151
2152 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2153         assert(f);
2154
2155         if (!prefix)
2156                 prefix = "";
2157
2158         LIST_FOREACH(command, c, c)
2159                 exec_command_dump(c, f, prefix);
2160 }
2161
2162 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2163         ExecCommand *end;
2164
2165         assert(l);
2166         assert(e);
2167
2168         if (*l) {
2169                 /* It's kind of important, that we keep the order here */
2170                 LIST_FIND_TAIL(command, *l, end);
2171                 LIST_INSERT_AFTER(command, *l, end, e);
2172         } else
2173               *l = e;
2174 }
2175
2176 int exec_command_set(ExecCommand *c, const char *path, ...) {
2177         va_list ap;
2178         char **l, *p;
2179
2180         assert(c);
2181         assert(path);
2182
2183         va_start(ap, path);
2184         l = strv_new_ap(path, ap);
2185         va_end(ap);
2186
2187         if (!l)
2188                 return -ENOMEM;
2189
2190         p = strdup(path);
2191         if (!p) {
2192                 strv_free(l);
2193                 return -ENOMEM;
2194         }
2195
2196         free(c->path);
2197         c->path = p;
2198
2199         strv_free(c->argv);
2200         c->argv = l;
2201
2202         return 0;
2203 }
2204
2205 static int exec_runtime_allocate(ExecRuntime **rt) {
2206
2207         if (*rt)
2208                 return 0;
2209
2210         *rt = new0(ExecRuntime, 1);
2211         if (!rt)
2212                 return -ENOMEM;
2213
2214         (*rt)->n_ref = 1;
2215         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
2216
2217         return 0;
2218 }
2219
2220 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
2221         int r;
2222
2223         assert(rt);
2224         assert(c);
2225         assert(id);
2226
2227         if (*rt)
2228                 return 1;
2229
2230         if (!c->private_network && !c->private_tmp)
2231                 return 0;
2232
2233         r = exec_runtime_allocate(rt);
2234         if (r < 0)
2235                 return r;
2236
2237         if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
2238                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
2239                         return -errno;
2240         }
2241
2242         if (c->private_tmp && !(*rt)->tmp_dir) {
2243                 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
2244                 if (r < 0)
2245                         return r;
2246         }
2247
2248         return 1;
2249 }
2250
2251 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
2252         assert(r);
2253         assert(r->n_ref > 0);
2254
2255         r->n_ref++;
2256         return r;
2257 }
2258
2259 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
2260
2261         if (!r)
2262                 return NULL;
2263
2264         assert(r->n_ref > 0);
2265
2266         r->n_ref--;
2267         if (r->n_ref <= 0) {
2268                 free(r->tmp_dir);
2269                 free(r->var_tmp_dir);
2270                 close_pipe(r->netns_storage_socket);
2271                 free(r);
2272         }
2273
2274         return NULL;
2275 }
2276
2277 int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds) {
2278         assert(u);
2279         assert(f);
2280         assert(fds);
2281
2282         if (!rt)
2283                 return 0;
2284
2285         if (rt->tmp_dir)
2286                 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
2287
2288         if (rt->var_tmp_dir)
2289                 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
2290
2291         if (rt->netns_storage_socket[0] >= 0) {
2292                 int copy;
2293
2294                 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
2295                 if (copy < 0)
2296                         return copy;
2297
2298                 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
2299         }
2300
2301         if (rt->netns_storage_socket[1] >= 0) {
2302                 int copy;
2303
2304                 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
2305                 if (copy < 0)
2306                         return copy;
2307
2308                 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
2309         }
2310
2311         return 0;
2312 }
2313
2314 int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds) {
2315         int r;
2316
2317         assert(rt);
2318         assert(key);
2319         assert(value);
2320
2321         if (streq(key, "tmp-dir")) {
2322                 char *copy;
2323
2324                 r = exec_runtime_allocate(rt);
2325                 if (r < 0)
2326                         return r;
2327
2328                 copy = strdup(value);
2329                 if (!copy)
2330                         return log_oom();
2331
2332                 free((*rt)->tmp_dir);
2333                 (*rt)->tmp_dir = copy;
2334
2335         } else if (streq(key, "var-tmp-dir")) {
2336                 char *copy;
2337
2338                 r = exec_runtime_allocate(rt);
2339                 if (r < 0)
2340                         return r;
2341
2342                 copy = strdup(value);
2343                 if (!copy)
2344                         return log_oom();
2345
2346                 free((*rt)->var_tmp_dir);
2347                 (*rt)->var_tmp_dir = copy;
2348
2349         } else if (streq(key, "netns-socket-0")) {
2350                 int fd;
2351
2352                 r = exec_runtime_allocate(rt);
2353                 if (r < 0)
2354                         return r;
2355
2356                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2357                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2358                 else {
2359                         if ((*rt)->netns_storage_socket[0] >= 0)
2360                                 close_nointr_nofail((*rt)->netns_storage_socket[0]);
2361
2362                         (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
2363                 }
2364         } else if (streq(key, "netns-socket-1")) {
2365                 int fd;
2366
2367                 r = exec_runtime_allocate(rt);
2368                 if (r < 0)
2369                         return r;
2370
2371                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2372                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2373                 else {
2374                         if ((*rt)->netns_storage_socket[1] >= 0)
2375                                 close_nointr_nofail((*rt)->netns_storage_socket[1]);
2376
2377                         (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
2378                 }
2379         } else
2380                 return 0;
2381
2382         return 1;
2383 }
2384
2385 static void *remove_tmpdir_thread(void *p) {
2386         _cleanup_free_ char *path = p;
2387
2388         rm_rf_dangerous(path, false, true, false);
2389         return NULL;
2390 }
2391
2392 void exec_runtime_destroy(ExecRuntime *rt) {
2393         if (!rt)
2394                 return;
2395
2396         /* If there are multiple users of this, let's leave the stuff around */
2397         if (rt->n_ref > 1)
2398                 return;
2399
2400         if (rt->tmp_dir) {
2401                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
2402                 asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
2403                 rt->tmp_dir = NULL;
2404         }
2405
2406         if (rt->var_tmp_dir) {
2407                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
2408                 asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
2409                 rt->var_tmp_dir = NULL;
2410         }
2411
2412         close_pipe(rt->netns_storage_socket);
2413 }
2414
2415 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2416         [EXEC_INPUT_NULL] = "null",
2417         [EXEC_INPUT_TTY] = "tty",
2418         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2419         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2420         [EXEC_INPUT_SOCKET] = "socket"
2421 };
2422
2423 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2424
2425 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2426         [EXEC_OUTPUT_INHERIT] = "inherit",
2427         [EXEC_OUTPUT_NULL] = "null",
2428         [EXEC_OUTPUT_TTY] = "tty",
2429         [EXEC_OUTPUT_SYSLOG] = "syslog",
2430         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2431         [EXEC_OUTPUT_KMSG] = "kmsg",
2432         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2433         [EXEC_OUTPUT_JOURNAL] = "journal",
2434         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2435         [EXEC_OUTPUT_SOCKET] = "socket"
2436 };
2437
2438 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);