src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <glob.h>
  42 #include <sys/personality.h>
  43 #include <libgen.h>
  44 #undef basename
  45
  46 #ifdef HAVE_PAM
  47 #include <security/pam_appl.h>
  48 #endif
  49
  50 #ifdef HAVE_SELINUX
  51 #include <selinux/selinux.h>
  52 #endif
  53
  54 #ifdef HAVE_SECCOMP
  55 #include <seccomp.h>
  56 #endif
  57
  58 #ifdef HAVE_APPARMOR
  59 #include <sys/apparmor.h>
  60 #endif
  61
  62 #include "execute.h"
  63 #include "strv.h"
  64 #include "macro.h"
  65 #include "capability.h"
  66 #include "util.h"
  67 #include "log.h"
  68 #include "sd-messages.h"
  69 #include "ioprio.h"
  70 #include "securebits.h"
  71 #include "namespace.h"
  72 #include "exit-status.h"
  73 #include "missing.h"
  74 #include "utmp-wtmp.h"
  75 #include "def.h"
  76 #include "path-util.h"
  77 #include "env-util.h"
  78 #include "fileio.h"
  79 #include "unit.h"
  80 #include "async.h"
  81 #include "selinux-util.h"
  82 #include "errno-list.h"
  83 #include "af-list.h"
  84 #include "mkdir.h"
  85 #include "apparmor-util.h"
  86
  87 #ifdef HAVE_SECCOMP
  88 #include "seccomp-util.h"
  89 #endif
  90
  91 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  92 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
  93
  94 /* This assumes there is a 'tty' group */
  95 #define TTY_MODE 0620
  96
  97 #define SNDBUF_SIZE (8*1024*1024)
  98
  99 static int shift_fds(int fds[], unsigned n_fds) {
 100         int start, restart_from;
 101
 102         if (n_fds <= 0)
 103                 return 0;
 104
 105         /* Modifies the fds array! (sorts it) */
 106
 107         assert(fds);
 108
 109         start = 0;
 110         for (;;) {
 111                 int i;
 112
 113                 restart_from = -1;
 114
 115                 for (i = start; i < (int) n_fds; i++) {
 116                         int nfd;
 117
 118                         /* Already at right index? */
 119                         if (fds[i] == i+3)
 120                                 continue;
 121
 122                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
 123                                 return -errno;
 124
 125                         safe_close(fds[i]);
 126                         fds[i] = nfd;
 127
 128                         /* Hmm, the fd we wanted isn't free? Then
 129                          * let's remember that and try again from here*/
 130                         if (nfd != i+3 && restart_from < 0)
 131                                 restart_from = i;
 132                 }
 133
 134                 if (restart_from < 0)
 135                         break;
 136
 137                 start = restart_from;
 138         }
 139
 140         return 0;
 141 }
 142
 143 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 144         unsigned i;
 145         int r;
 146
 147         if (n_fds <= 0)
 148                 return 0;
 149
 150         assert(fds);
 151
 152         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 153
 154         for (i = 0; i < n_fds; i++) {
 155
 156                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 157                         return r;
 158
 159                 /* We unconditionally drop FD_CLOEXEC from the fds,
 160                  * since after all we want to pass these fds to our
 161                  * children */
 162
 163                 if ((r = fd_cloexec(fds[i], false)) < 0)
 164                         return r;
 165         }
 166
 167         return 0;
 168 }
 169
 170 _pure_ static const char *tty_path(const ExecContext *context) {
 171         assert(context);
 172
 173         if (context->tty_path)
 174                 return context->tty_path;
 175
 176         return "/dev/console";
 177 }
 178
 179 static void exec_context_tty_reset(const ExecContext *context) {
 180         assert(context);
 181
 182         if (context->tty_vhangup)
 183                 terminal_vhangup(tty_path(context));
 184
 185         if (context->tty_reset)
 186                 reset_terminal(tty_path(context));
 187
 188         if (context->tty_vt_disallocate && context->tty_path)
 189                 vt_disallocate(context->tty_path);
 190 }
 191
 192 static bool is_terminal_output(ExecOutput o) {
 193         return
 194                 o == EXEC_OUTPUT_TTY ||
 195                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 196                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 197                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 198 }
 199
 200 static int open_null_as(int flags, int nfd) {
 201         int fd, r;
 202
 203         assert(nfd >= 0);
 204
 205         fd = open("/dev/null", flags|O_NOCTTY);
 206         if (fd < 0)
 207                 return -errno;
 208
 209         if (fd != nfd) {
 210                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 211                 safe_close(fd);
 212         } else
 213                 r = nfd;
 214
 215         return r;
 216 }
 217
 218 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 219         int fd, r;
 220         union sockaddr_union sa = {
 221                 .un.sun_family = AF_UNIX,
 222                 .un.sun_path = "/run/systemd/journal/stdout",
 223         };
 224
 225         assert(context);
 226         assert(output < _EXEC_OUTPUT_MAX);
 227         assert(ident);
 228         assert(nfd >= 0);
 229
 230         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 231         if (fd < 0)
 232                 return -errno;
 233
 234         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 235         if (r < 0) {
 236                 safe_close(fd);
 237                 return -errno;
 238         }
 239
 240         if (shutdown(fd, SHUT_RD) < 0) {
 241                 safe_close(fd);
 242                 return -errno;
 243         }
 244
 245         fd_inc_sndbuf(fd, SNDBUF_SIZE);
 246
 247         dprintf(fd,
 248                 "%s\n"
 249                 "%s\n"
 250                 "%i\n"
 251                 "%i\n"
 252                 "%i\n"
 253                 "%i\n"
 254                 "%i\n",
 255                 context->syslog_identifier ? context->syslog_identifier : ident,
 256                 unit_id,
 257                 context->syslog_priority,
 258                 !!context->syslog_level_prefix,
 259                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 260                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 261                 is_terminal_output(output));
 262
 263         if (fd != nfd) {
 264                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 265                 safe_close(fd);
 266         } else
 267                 r = nfd;
 268
 269         return r;
 270 }
 271 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 272         int fd, r;
 273
 274         assert(path);
 275         assert(nfd >= 0);
 276
 277         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 278                 return fd;
 279
 280         if (fd != nfd) {
 281                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 282                 safe_close(fd);
 283         } else
 284                 r = nfd;
 285
 286         return r;
 287 }
 288
 289 static bool is_terminal_input(ExecInput i) {
 290         return
 291                 i == EXEC_INPUT_TTY ||
 292                 i == EXEC_INPUT_TTY_FORCE ||
 293                 i == EXEC_INPUT_TTY_FAIL;
 294 }
 295
 296 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 297
 298         if (is_terminal_input(std_input) && !apply_tty_stdin)
 299                 return EXEC_INPUT_NULL;
 300
 301         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 302                 return EXEC_INPUT_NULL;
 303
 304         return std_input;
 305 }
 306
 307 static int fixup_output(ExecOutput std_output, int socket_fd) {
 308
 309         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 310                 return EXEC_OUTPUT_INHERIT;
 311
 312         return std_output;
 313 }
 314
 315 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 316         ExecInput i;
 317
 318         assert(context);
 319
 320         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 321
 322         switch (i) {
 323
 324         case EXEC_INPUT_NULL:
 325                 return open_null_as(O_RDONLY, STDIN_FILENO);
 326
 327         case EXEC_INPUT_TTY:
 328         case EXEC_INPUT_TTY_FORCE:
 329         case EXEC_INPUT_TTY_FAIL: {
 330                 int fd, r;
 331
 332                 fd = acquire_terminal(tty_path(context),
 333                                       i == EXEC_INPUT_TTY_FAIL,
 334                                       i == EXEC_INPUT_TTY_FORCE,
 335                                       false,
 336                                       (usec_t) -1);
 337                 if (fd < 0)
 338                         return fd;
 339
 340                 if (fd != STDIN_FILENO) {
 341                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 342                         safe_close(fd);
 343                 } else
 344                         r = STDIN_FILENO;
 345
 346                 return r;
 347         }
 348
 349         case EXEC_INPUT_SOCKET:
 350                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 351
 352         default:
 353                 assert_not_reached("Unknown input type");
 354         }
 355 }
 356
 357 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 358         ExecOutput o;
 359         ExecInput i;
 360         int r;
 361
 362         assert(context);
 363         assert(ident);
 364
 365         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 366         o = fixup_output(context->std_output, socket_fd);
 367
 368         if (fileno == STDERR_FILENO) {
 369                 ExecOutput e;
 370                 e = fixup_output(context->std_error, socket_fd);
 371
 372                 /* This expects the input and output are already set up */
 373
 374                 /* Don't change the stderr file descriptor if we inherit all
 375                  * the way and are not on a tty */
 376                 if (e == EXEC_OUTPUT_INHERIT &&
 377                     o == EXEC_OUTPUT_INHERIT &&
 378                     i == EXEC_INPUT_NULL &&
 379                     !is_terminal_input(context->std_input) &&
 380                     getppid () != 1)
 381                         return fileno;
 382
 383                 /* Duplicate from stdout if possible */
 384                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 385                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 386
 387                 o = e;
 388
 389         } else if (o == EXEC_OUTPUT_INHERIT) {
 390                 /* If input got downgraded, inherit the original value */
 391                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 392                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 393
 394                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 395                 if (i != EXEC_INPUT_NULL)
 396                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 397
 398                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 399                 if (getppid() != 1)
 400                         return fileno;
 401
 402                 /* We need to open /dev/null here anew, to get the right access mode. */
 403                 return open_null_as(O_WRONLY, fileno);
 404         }
 405
 406         switch (o) {
 407
 408         case EXEC_OUTPUT_NULL:
 409                 return open_null_as(O_WRONLY, fileno);
 410
 411         case EXEC_OUTPUT_TTY:
 412                 if (is_terminal_input(i))
 413                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 414
 415                 /* We don't reset the terminal if this is just about output */
 416                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 417
 418         case EXEC_OUTPUT_SYSLOG:
 419         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 420         case EXEC_OUTPUT_KMSG:
 421         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 422         case EXEC_OUTPUT_JOURNAL:
 423         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 424                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 425                 if (r < 0) {
 426                         log_struct_unit(LOG_CRIT, unit_id,
 427                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 428                                 fileno == STDOUT_FILENO ? "out" : "err",
 429                                 unit_id, strerror(-r),
 430                                 "ERRNO=%d", -r,
 431                                 NULL);
 432                         r = open_null_as(O_WRONLY, fileno);
 433                 }
 434                 return r;
 435
 436         case EXEC_OUTPUT_SOCKET:
 437                 assert(socket_fd >= 0);
 438                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 439
 440         default:
 441                 assert_not_reached("Unknown error type");
 442         }
 443 }
 444
 445 static int chown_terminal(int fd, uid_t uid) {
 446         struct stat st;
 447
 448         assert(fd >= 0);
 449
 450         /* This might fail. What matters are the results. */
 451         (void) fchown(fd, uid, -1);
 452         (void) fchmod(fd, TTY_MODE);
 453
 454         if (fstat(fd, &st) < 0)
 455                 return -errno;
 456
 457         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 458                 return -EPERM;
 459
 460         return 0;
 461 }
 462
 463 static int setup_confirm_stdio(int *_saved_stdin,
 464                                int *_saved_stdout) {
 465         int fd = -1, saved_stdin, saved_stdout = -1, r;
 466
 467         assert(_saved_stdin);
 468         assert(_saved_stdout);
 469
 470         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 471         if (saved_stdin < 0)
 472                 return -errno;
 473
 474         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 475         if (saved_stdout < 0) {
 476                 r = errno;
 477                 goto fail;
 478         }
 479
 480         fd = acquire_terminal(
 481                         "/dev/console",
 482                         false,
 483                         false,
 484                         false,
 485                         DEFAULT_CONFIRM_USEC);
 486         if (fd < 0) {
 487                 r = fd;
 488                 goto fail;
 489         }
 490
 491         r = chown_terminal(fd, getuid());
 492         if (r < 0)
 493                 goto fail;
 494
 495         if (dup2(fd, STDIN_FILENO) < 0) {
 496                 r = -errno;
 497                 goto fail;
 498         }
 499
 500         if (dup2(fd, STDOUT_FILENO) < 0) {
 501                 r = -errno;
 502                 goto fail;
 503         }
 504
 505         if (fd >= 2)
 506                 safe_close(fd);
 507
 508         *_saved_stdin = saved_stdin;
 509         *_saved_stdout = saved_stdout;
 510
 511         return 0;
 512
 513 fail:
 514         safe_close(saved_stdout);
 515         safe_close(saved_stdin);
 516         safe_close(fd);
 517
 518         return r;
 519 }
 520
 521 _printf_(1, 2) static int write_confirm_message(const char *format, ...) {
 522         _cleanup_close_ int fd = -1;
 523         va_list ap;
 524
 525         assert(format);
 526
 527         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 528         if (fd < 0)
 529                 return fd;
 530
 531         va_start(ap, format);
 532         vdprintf(fd, format, ap);
 533         va_end(ap);
 534
 535         return 0;
 536 }
 537
 538 static int restore_confirm_stdio(int *saved_stdin,
 539                                  int *saved_stdout) {
 540
 541         int r = 0;
 542
 543         assert(saved_stdin);
 544         assert(saved_stdout);
 545
 546         release_terminal();
 547
 548         if (*saved_stdin >= 0)
 549                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 550                         r = -errno;
 551
 552         if (*saved_stdout >= 0)
 553                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 554                         r = -errno;
 555
 556         safe_close(*saved_stdin);
 557         safe_close(*saved_stdout);
 558
 559         return r;
 560 }
 561
 562 static int ask_for_confirmation(char *response, char **argv) {
 563         int saved_stdout = -1, saved_stdin = -1, r;
 564         char *line;
 565
 566         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 567         if (r < 0)
 568                 return r;
 569
 570         line = exec_command_line(argv);
 571         if (!line)
 572                 return -ENOMEM;
 573
 574         r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 575         free(line);
 576
 577         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 578
 579         return r;
 580 }
 581
 582 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 583         bool keep_groups = false;
 584         int r;
 585
 586         assert(context);
 587
 588         /* Lookup and set GID and supplementary group list. Here too
 589          * we avoid NSS lookups for gid=0. */
 590
 591         if (context->group || username) {
 592
 593                 if (context->group) {
 594                         const char *g = context->group;
 595
 596                         if ((r = get_group_creds(&g, &gid)) < 0)
 597                                 return r;
 598                 }
 599
 600                 /* First step, initialize groups from /etc/groups */
 601                 if (username && gid != 0) {
 602                         if (initgroups(username, gid) < 0)
 603                                 return -errno;
 604
 605                         keep_groups = true;
 606                 }
 607
 608                 /* Second step, set our gids */
 609                 if (setresgid(gid, gid, gid) < 0)
 610                         return -errno;
 611         }
 612
 613         if (context->supplementary_groups) {
 614                 int ngroups_max, k;
 615                 gid_t *gids;
 616                 char **i;
 617
 618                 /* Final step, initialize any manually set supplementary groups */
 619                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 620
 621                 if (!(gids = new(gid_t, ngroups_max)))
 622                         return -ENOMEM;
 623
 624                 if (keep_groups) {
 625                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 626                                 free(gids);
 627                                 return -errno;
 628                         }
 629                 } else
 630                         k = 0;
 631
 632                 STRV_FOREACH(i, context->supplementary_groups) {
 633                         const char *g;
 634
 635                         if (k >= ngroups_max) {
 636                                 free(gids);
 637                                 return -E2BIG;
 638                         }
 639
 640                         g = *i;
 641                         r = get_group_creds(&g, gids+k);
 642                         if (r < 0) {
 643                                 free(gids);
 644                                 return r;
 645                         }
 646
 647                         k++;
 648                 }
 649
 650                 if (setgroups(k, gids) < 0) {
 651                         free(gids);
 652                         return -errno;
 653                 }
 654
 655                 free(gids);
 656         }
 657
 658         return 0;
 659 }
 660
 661 static int enforce_user(const ExecContext *context, uid_t uid) {
 662         assert(context);
 663
 664         /* Sets (but doesn't lookup) the uid and make sure we keep the
 665          * capabilities while doing so. */
 666
 667         if (context->capabilities) {
 668                 _cleanup_cap_free_ cap_t d = NULL;
 669                 static const cap_value_t bits[] = {
 670                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 671                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 672                 };
 673
 674                 /* First step: If we need to keep capabilities but
 675                  * drop privileges we need to make sure we keep our
 676                  * caps, while we drop privileges. */
 677                 if (uid != 0) {
 678                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 679
 680                         if (prctl(PR_GET_SECUREBITS) != sb)
 681                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 682                                         return -errno;
 683                 }
 684
 685                 /* Second step: set the capabilities. This will reduce
 686                  * the capabilities to the minimum we need. */
 687
 688                 d = cap_dup(context->capabilities);
 689                 if (!d)
 690                         return -errno;
 691
 692                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 693                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0)
 694                         return -errno;
 695
 696                 if (cap_set_proc(d) < 0)
 697                         return -errno;
 698         }
 699
 700         /* Third step: actually set the uids */
 701         if (setresuid(uid, uid, uid) < 0)
 702                 return -errno;
 703
 704         /* At this point we should have all necessary capabilities but
 705            are otherwise a normal user. However, the caps might got
 706            corrupted due to the setresuid() so we need clean them up
 707            later. This is done outside of this call. */
 708
 709         return 0;
 710 }
 711
 712 #ifdef HAVE_PAM
 713
 714 static int null_conv(
 715                 int num_msg,
 716                 const struct pam_message **msg,
 717                 struct pam_response **resp,
 718                 void *appdata_ptr) {
 719
 720         /* We don't support conversations */
 721
 722         return PAM_CONV_ERR;
 723 }
 724
 725 static int setup_pam(
 726                 const char *name,
 727                 const char *user,
 728                 uid_t uid,
 729                 const char *tty,
 730                 char ***pam_env,
 731                 int fds[], unsigned n_fds) {
 732
 733         static const struct pam_conv conv = {
 734                 .conv = null_conv,
 735                 .appdata_ptr = NULL
 736         };
 737
 738         pam_handle_t *handle = NULL;
 739         sigset_t ss, old_ss;
 740         int pam_code = PAM_SUCCESS;
 741         int err;
 742         char **e = NULL;
 743         bool close_session = false;
 744         pid_t pam_pid = 0, parent_pid;
 745         int flags = 0;
 746
 747         assert(name);
 748         assert(user);
 749         assert(pam_env);
 750
 751         /* We set up PAM in the parent process, then fork. The child
 752          * will then stay around until killed via PR_GET_PDEATHSIG or
 753          * systemd via the cgroup logic. It will then remove the PAM
 754          * session again. The parent process will exec() the actual
 755          * daemon. We do things this way to ensure that the main PID
 756          * of the daemon is the one we initially fork()ed. */
 757
 758         if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
 759                 flags |= PAM_SILENT;
 760
 761         pam_code = pam_start(name, user, &conv, &handle);
 762         if (pam_code != PAM_SUCCESS) {
 763                 handle = NULL;
 764                 goto fail;
 765         }
 766
 767         if (tty) {
 768                 pam_code = pam_set_item(handle, PAM_TTY, tty);
 769                 if (pam_code != PAM_SUCCESS)
 770                         goto fail;
 771         }
 772
 773         pam_code = pam_acct_mgmt(handle, flags);
 774         if (pam_code != PAM_SUCCESS)
 775                 goto fail;
 776
 777         pam_code = pam_open_session(handle, flags);
 778         if (pam_code != PAM_SUCCESS)
 779                 goto fail;
 780
 781         close_session = true;
 782
 783         e = pam_getenvlist(handle);
 784         if (!e) {
 785                 pam_code = PAM_BUF_ERR;
 786                 goto fail;
 787         }
 788
 789         /* Block SIGTERM, so that we know that it won't get lost in
 790          * the child */
 791         if (sigemptyset(&ss) < 0 ||
 792             sigaddset(&ss, SIGTERM) < 0 ||
 793             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 794                 goto fail;
 795
 796         parent_pid = getpid();
 797
 798         pam_pid = fork();
 799         if (pam_pid < 0)
 800                 goto fail;
 801
 802         if (pam_pid == 0) {
 803                 int sig;
 804                 int r = EXIT_PAM;
 805
 806                 /* The child's job is to reset the PAM session on
 807                  * termination */
 808
 809                 /* This string must fit in 10 chars (i.e. the length
 810                  * of "/sbin/init"), to look pretty in /bin/ps */
 811                 rename_process("(sd-pam)");
 812
 813                 /* Make sure we don't keep open the passed fds in this
 814                 child. We assume that otherwise only those fds are
 815                 open here that have been opened by PAM. */
 816                 close_many(fds, n_fds);
 817
 818                 /* Drop privileges - we don't need any to pam_close_session
 819                  * and this will make PR_SET_PDEATHSIG work in most cases.
 820                  * If this fails, ignore the error - but expect sd-pam threads
 821                  * to fail to exit normally */
 822                 if (setresuid(uid, uid, uid) < 0)
 823                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 824
 825                 /* Wait until our parent died. This will only work if
 826                  * the above setresuid() succeeds, otherwise the kernel
 827                  * will not allow unprivileged parents kill their privileged
 828                  * children this way. We rely on the control groups kill logic
 829                  * to do the rest for us. */
 830                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 831                         goto child_finish;
 832
 833                 /* Check if our parent process might already have
 834                  * died? */
 835                 if (getppid() == parent_pid) {
 836                         for (;;) {
 837                                 if (sigwait(&ss, &sig) < 0) {
 838                                         if (errno == EINTR)
 839                                                 continue;
 840
 841                                         goto child_finish;
 842                                 }
 843
 844                                 assert(sig == SIGTERM);
 845                                 break;
 846                         }
 847                 }
 848
 849                 /* If our parent died we'll end the session */
 850                 if (getppid() != parent_pid) {
 851                         pam_code = pam_close_session(handle, flags);
 852                         if (pam_code != PAM_SUCCESS)
 853                                 goto child_finish;
 854                 }
 855
 856                 r = 0;
 857
 858         child_finish:
 859                 pam_end(handle, pam_code | flags);
 860                 _exit(r);
 861         }
 862
 863         /* If the child was forked off successfully it will do all the
 864          * cleanups, so forget about the handle here. */
 865         handle = NULL;
 866
 867         /* Unblock SIGTERM again in the parent */
 868         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 869                 goto fail;
 870
 871         /* We close the log explicitly here, since the PAM modules
 872          * might have opened it, but we don't want this fd around. */
 873         closelog();
 874
 875         *pam_env = e;
 876         e = NULL;
 877
 878         return 0;
 879
 880 fail:
 881         if (pam_code != PAM_SUCCESS) {
 882                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
 883                 err = -EPERM;  /* PAM errors do not map to errno */
 884         } else {
 885                 log_error("PAM failed: %m");
 886                 err = -errno;
 887         }
 888
 889         if (handle) {
 890                 if (close_session)
 891                         pam_code = pam_close_session(handle, flags);
 892
 893                 pam_end(handle, pam_code | flags);
 894         }
 895
 896         strv_free(e);
 897
 898         closelog();
 899
 900         if (pam_pid > 1) {
 901                 kill(pam_pid, SIGTERM);
 902                 kill(pam_pid, SIGCONT);
 903         }
 904
 905         return err;
 906 }
 907 #endif
 908
 909 static void rename_process_from_path(const char *path) {
 910         char process_name[11];
 911         const char *p;
 912         size_t l;
 913
 914         /* This resulting string must fit in 10 chars (i.e. the length
 915          * of "/sbin/init") to look pretty in /bin/ps */
 916
 917         p = basename(path);
 918         if (isempty(p)) {
 919                 rename_process("(...)");
 920                 return;
 921         }
 922
 923         l = strlen(p);
 924         if (l > 8) {
 925                 /* The end of the process name is usually more
 926                  * interesting, since the first bit might just be
 927                  * "systemd-" */
 928                 p = p + l - 8;
 929                 l = 8;
 930         }
 931
 932         process_name[0] = '(';
 933         memcpy(process_name+1, p, l);
 934         process_name[1+l] = ')';
 935         process_name[1+l+1] = 0;
 936
 937         rename_process(process_name);
 938 }
 939
 940 #ifdef HAVE_SECCOMP
 941
 942 static int apply_seccomp(ExecContext *c) {
 943         uint32_t negative_action, action;
 944         scmp_filter_ctx *seccomp;
 945         Iterator i;
 946         void *id;
 947         int r;
 948
 949         assert(c);
 950
 951         negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
 952
 953         seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
 954         if (!seccomp)
 955                 return -ENOMEM;
 956
 957         if (c->syscall_archs) {
 958
 959                 SET_FOREACH(id, c->syscall_archs, i) {
 960                         r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
 961                         if (r == -EEXIST)
 962                                 continue;
 963                         if (r < 0)
 964                                 goto finish;
 965                 }
 966
 967         } else {
 968                 r = seccomp_add_secondary_archs(seccomp);
 969                 if (r < 0)
 970                         goto finish;
 971         }
 972
 973         action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
 974         SET_FOREACH(id, c->syscall_filter, i) {
 975                 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
 976                 if (r < 0)
 977                         goto finish;
 978         }
 979
 980         r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
 981         if (r < 0)
 982                 goto finish;
 983
 984         r = seccomp_load(seccomp);
 985
 986 finish:
 987         seccomp_release(seccomp);
 988         return r;
 989 }
 990
 991 static int apply_address_families(ExecContext *c) {
 992         scmp_filter_ctx *seccomp;
 993         Iterator i;
 994         int r;
 995
 996         assert(c);
 997
 998         seccomp = seccomp_init(SCMP_ACT_ALLOW);
 999         if (!seccomp)
1000                 return -ENOMEM;
1001
1002         r = seccomp_add_secondary_archs(seccomp);
1003         if (r < 0)
1004                 goto finish;
1005
1006         if (c->address_families_whitelist) {
1007                 int af, first = 0, last = 0;
1008                 void *afp;
1009
1010                 /* If this is a whitelist, we first block the address
1011                  * families that are out of range and then everything
1012                  * that is not in the set. First, we find the lowest
1013                  * and highest address family in the set. */
1014
1015                 SET_FOREACH(afp, c->address_families, i) {
1016                         af = PTR_TO_INT(afp);
1017
1018                         if (af <= 0 || af >= af_max())
1019                                 continue;
1020
1021                         if (first == 0 || af < first)
1022                                 first = af;
1023
1024                         if (last == 0 || af > last)
1025                                 last = af;
1026                 }
1027
1028                 assert((first == 0) == (last == 0));
1029
1030                 if (first == 0) {
1031
1032                         /* No entries in the valid range, block everything */
1033                         r = seccomp_rule_add(
1034                                         seccomp,
1035                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1036                                         SCMP_SYS(socket),
1037                                         0);
1038                         if (r < 0)
1039                                 goto finish;
1040
1041                 } else {
1042
1043                         /* Block everything below the first entry */
1044                         r = seccomp_rule_add(
1045                                         seccomp,
1046                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1047                                         SCMP_SYS(socket),
1048                                         1,
1049                                         SCMP_A0(SCMP_CMP_LT, first));
1050                         if (r < 0)
1051                                 goto finish;
1052
1053                         /* Block everything above the last entry */
1054                         r = seccomp_rule_add(
1055                                         seccomp,
1056                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1057                                         SCMP_SYS(socket),
1058                                         1,
1059                                         SCMP_A0(SCMP_CMP_GT, last));
1060                         if (r < 0)
1061                                 goto finish;
1062
1063                         /* Block everything between the first and last
1064                          * entry */
1065                         for (af = 1; af < af_max(); af++) {
1066
1067                                 if (set_contains(c->address_families, INT_TO_PTR(af)))
1068                                         continue;
1069
1070                                 r = seccomp_rule_add(
1071                                                 seccomp,
1072                                                 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1073                                                 SCMP_SYS(socket),
1074                                                 1,
1075                                                 SCMP_A0(SCMP_CMP_EQ, af));
1076                                 if (r < 0)
1077                                         goto finish;
1078                         }
1079                 }
1080
1081         } else {
1082                 void *af;
1083
1084                 /* If this is a blacklist, then generate one rule for
1085                  * each address family that are then combined in OR
1086                  * checks. */
1087
1088                 SET_FOREACH(af, c->address_families, i) {
1089
1090                         r = seccomp_rule_add(
1091                                         seccomp,
1092                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1093                                         SCMP_SYS(socket),
1094                                         1,
1095                                         SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
1096                         if (r < 0)
1097                                 goto finish;
1098                 }
1099         }
1100
1101         r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1102         if (r < 0)
1103                 goto finish;
1104
1105         r = seccomp_load(seccomp);
1106
1107 finish:
1108         seccomp_release(seccomp);
1109         return r;
1110 }
1111
1112 #endif
1113
1114 static void do_idle_pipe_dance(int idle_pipe[4]) {
1115         assert(idle_pipe);
1116
1117
1118         safe_close(idle_pipe[1]);
1119         safe_close(idle_pipe[2]);
1120
1121         if (idle_pipe[0] >= 0) {
1122                 int r;
1123
1124                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1125
1126                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1127                         /* Signal systemd that we are bored and want to continue. */
1128                         write(idle_pipe[3], "x", 1);
1129
1130                         /* Wait for systemd to react to the signal above. */
1131                         fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1132                 }
1133
1134                 safe_close(idle_pipe[0]);
1135
1136         }
1137
1138         safe_close(idle_pipe[3]);
1139 }
1140
1141 static int build_environment(
1142                 ExecContext *c,
1143                 unsigned n_fds,
1144                 usec_t watchdog_usec,
1145                 const char *home,
1146                 const char *username,
1147                 const char *shell,
1148                 char ***ret) {
1149
1150         _cleanup_strv_free_ char **our_env = NULL;
1151         unsigned n_env = 0;
1152         char *x;
1153
1154         assert(c);
1155         assert(ret);
1156
1157         our_env = new0(char*, 10);
1158         if (!our_env)
1159                 return -ENOMEM;
1160
1161         if (n_fds > 0) {
1162                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
1163                         return -ENOMEM;
1164                 our_env[n_env++] = x;
1165
1166                 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1167                         return -ENOMEM;
1168                 our_env[n_env++] = x;
1169         }
1170
1171         if (watchdog_usec > 0) {
1172                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
1173                         return -ENOMEM;
1174                 our_env[n_env++] = x;
1175
1176                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, watchdog_usec) < 0)
1177                         return -ENOMEM;
1178                 our_env[n_env++] = x;
1179         }
1180
1181         if (home) {
1182                 x = strappend("HOME=", home);
1183                 if (!x)
1184                         return -ENOMEM;
1185                 our_env[n_env++] = x;
1186         }
1187
1188         if (username) {
1189                 x = strappend("LOGNAME=", username);
1190                 if (!x)
1191                         return -ENOMEM;
1192                 our_env[n_env++] = x;
1193
1194                 x = strappend("USER=", username);
1195                 if (!x)
1196                         return -ENOMEM;
1197                 our_env[n_env++] = x;
1198         }
1199
1200         if (shell) {
1201                 x = strappend("SHELL=", shell);
1202                 if (!x)
1203                         return -ENOMEM;
1204                 our_env[n_env++] = x;
1205         }
1206
1207         if (is_terminal_input(c->std_input) ||
1208             c->std_output == EXEC_OUTPUT_TTY ||
1209             c->std_error == EXEC_OUTPUT_TTY ||
1210             c->tty_path) {
1211
1212                 x = strdup(default_term_for_tty(tty_path(c)));
1213                 if (!x)
1214                         return -ENOMEM;
1215                 our_env[n_env++] = x;
1216         }
1217
1218         our_env[n_env++] = NULL;
1219         assert(n_env <= 10);
1220
1221         *ret = our_env;
1222         our_env = NULL;
1223
1224         return 0;
1225 }
1226
1227 int exec_spawn(ExecCommand *command,
1228                char **argv,
1229                ExecContext *context,
1230                int fds[], unsigned n_fds,
1231                char **environment,
1232                bool apply_permissions,
1233                bool apply_chroot,
1234                bool apply_tty_stdin,
1235                bool confirm_spawn,
1236                CGroupControllerMask cgroup_supported,
1237                const char *cgroup_path,
1238                const char *runtime_prefix,
1239                const char *unit_id,
1240                usec_t watchdog_usec,
1241                int idle_pipe[4],
1242                ExecRuntime *runtime,
1243                pid_t *ret) {
1244
1245         _cleanup_strv_free_ char **files_env = NULL;
1246         int socket_fd;
1247         char *line;
1248         pid_t pid;
1249         int r;
1250
1251         assert(command);
1252         assert(context);
1253         assert(ret);
1254         assert(fds || n_fds <= 0);
1255
1256         if (context->std_input == EXEC_INPUT_SOCKET ||
1257             context->std_output == EXEC_OUTPUT_SOCKET ||
1258             context->std_error == EXEC_OUTPUT_SOCKET) {
1259
1260                 if (n_fds != 1)
1261                         return -EINVAL;
1262
1263                 socket_fd = fds[0];
1264
1265                 fds = NULL;
1266                 n_fds = 0;
1267         } else
1268                 socket_fd = -1;
1269
1270         r = exec_context_load_environment(context, &files_env);
1271         if (r < 0) {
1272                 log_struct_unit(LOG_ERR,
1273                            unit_id,
1274                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1275                            "ERRNO=%d", -r,
1276                            NULL);
1277                 return r;
1278         }
1279
1280         if (!argv)
1281                 argv = command->argv;
1282
1283         line = exec_command_line(argv);
1284         if (!line)
1285                 return log_oom();
1286
1287         log_struct_unit(LOG_DEBUG,
1288                         unit_id,
1289                         "EXECUTABLE=%s", command->path,
1290                         "MESSAGE=About to execute: %s", line,
1291                         NULL);
1292         free(line);
1293
1294         pid = fork();
1295         if (pid < 0)
1296                 return -errno;
1297
1298         if (pid == 0) {
1299                 _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
1300                 const char *username = NULL, *home = NULL, *shell = NULL;
1301                 unsigned n_dont_close = 0;
1302                 int dont_close[n_fds + 3];
1303                 uid_t uid = (uid_t) -1;
1304                 gid_t gid = (gid_t) -1;
1305                 sigset_t ss;
1306                 int i, err;
1307
1308                 /* child */
1309
1310                 rename_process_from_path(command->path);
1311
1312                 /* We reset exactly these signals, since they are the
1313                  * only ones we set to SIG_IGN in the main daemon. All
1314                  * others we leave untouched because we set them to
1315                  * SIG_DFL or a valid handler initially, both of which
1316                  * will be demoted to SIG_DFL. */
1317                 default_signals(SIGNALS_CRASH_HANDLER,
1318                                 SIGNALS_IGNORE, -1);
1319
1320                 if (context->ignore_sigpipe)
1321                         ignore_signals(SIGPIPE, -1);
1322
1323                 assert_se(sigemptyset(&ss) == 0);
1324                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1325                         err = -errno;
1326                         r = EXIT_SIGNAL_MASK;
1327                         goto fail_child;
1328                 }
1329
1330                 if (idle_pipe)
1331                         do_idle_pipe_dance(idle_pipe);
1332
1333                 /* Close sockets very early to make sure we don't
1334                  * block init reexecution because it cannot bind its
1335                  * sockets */
1336                 log_forget_fds();
1337
1338                 if (socket_fd >= 0)
1339                         dont_close[n_dont_close++] = socket_fd;
1340                 if (n_fds > 0) {
1341                         memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1342                         n_dont_close += n_fds;
1343                 }
1344                 if (runtime) {
1345                         if (runtime->netns_storage_socket[0] >= 0)
1346                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
1347                         if (runtime->netns_storage_socket[1] >= 0)
1348                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
1349                 }
1350
1351                 err = close_all_fds(dont_close, n_dont_close);
1352                 if (err < 0) {
1353                         r = EXIT_FDS;
1354                         goto fail_child;
1355                 }
1356
1357                 if (!context->same_pgrp)
1358                         if (setsid() < 0) {
1359                                 err = -errno;
1360                                 r = EXIT_SETSID;
1361                                 goto fail_child;
1362                         }
1363
1364                 exec_context_tty_reset(context);
1365
1366                 if (confirm_spawn) {
1367                         char response;
1368
1369                         err = ask_for_confirmation(&response, argv);
1370                         if (err == -ETIMEDOUT)
1371                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1372                         else if (err < 0)
1373                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1374                         else if (response == 's') {
1375                                 write_confirm_message("Skipping execution.\n");
1376                                 err = -ECANCELED;
1377                                 r = EXIT_CONFIRM;
1378                                 goto fail_child;
1379                         } else if (response == 'n') {
1380                                 write_confirm_message("Failing execution.\n");
1381                                 err = r = 0;
1382                                 goto fail_child;
1383                         }
1384                 }
1385
1386                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1387                  * must sure to drop O_NONBLOCK */
1388                 if (socket_fd >= 0)
1389                         fd_nonblock(socket_fd, false);
1390
1391                 err = setup_input(context, socket_fd, apply_tty_stdin);
1392                 if (err < 0) {
1393                         r = EXIT_STDIN;
1394                         goto fail_child;
1395                 }
1396
1397                 err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1398                 if (err < 0) {
1399                         r = EXIT_STDOUT;
1400                         goto fail_child;
1401                 }
1402
1403                 err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1404                 if (err < 0) {
1405                         r = EXIT_STDERR;
1406                         goto fail_child;
1407                 }
1408
1409                 if (cgroup_path) {
1410                         err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
1411                         if (err < 0) {
1412                                 r = EXIT_CGROUP;
1413                                 goto fail_child;
1414                         }
1415                 }
1416
1417                 if (context->oom_score_adjust_set) {
1418                         char t[16];
1419
1420                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1421                         char_array_0(t);
1422
1423                         if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
1424                                 err = -errno;
1425                                 r = EXIT_OOM_ADJUST;
1426                                 goto fail_child;
1427                         }
1428                 }
1429
1430                 if (context->nice_set)
1431                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1432                                 err = -errno;
1433                                 r = EXIT_NICE;
1434                                 goto fail_child;
1435                         }
1436
1437                 if (context->cpu_sched_set) {
1438                         struct sched_param param = {
1439                                 .sched_priority = context->cpu_sched_priority,
1440                         };
1441
1442                         r = sched_setscheduler(0,
1443                                                context->cpu_sched_policy |
1444                                                (context->cpu_sched_reset_on_fork ?
1445                                                 SCHED_RESET_ON_FORK : 0),
1446                                                &param);
1447                         if (r < 0) {
1448                                 err = -errno;
1449                                 r = EXIT_SETSCHEDULER;
1450                                 goto fail_child;
1451                         }
1452                 }
1453
1454                 if (context->cpuset)
1455                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1456                                 err = -errno;
1457                                 r = EXIT_CPUAFFINITY;
1458                                 goto fail_child;
1459                         }
1460
1461                 if (context->ioprio_set)
1462                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1463                                 err = -errno;
1464                                 r = EXIT_IOPRIO;
1465                                 goto fail_child;
1466                         }
1467
1468                 if (context->timer_slack_nsec != (nsec_t) -1)
1469                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1470                                 err = -errno;
1471                                 r = EXIT_TIMERSLACK;
1472                                 goto fail_child;
1473                         }
1474
1475                 if (context->personality != 0xffffffffUL)
1476                         if (personality(context->personality) < 0) {
1477                                 err = -errno;
1478                                 r = EXIT_PERSONALITY;
1479                                 goto fail_child;
1480                         }
1481
1482                 if (context->utmp_id)
1483                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1484
1485                 if (context->user) {
1486                         username = context->user;
1487                         err = get_user_creds(&username, &uid, &gid, &home, &shell);
1488                         if (err < 0) {
1489                                 r = EXIT_USER;
1490                                 goto fail_child;
1491                         }
1492
1493                         if (is_terminal_input(context->std_input)) {
1494                                 err = chown_terminal(STDIN_FILENO, uid);
1495                                 if (err < 0) {
1496                                         r = EXIT_STDIN;
1497                                         goto fail_child;
1498                                 }
1499                         }
1500                 }
1501
1502 #ifdef HAVE_PAM
1503                 if (cgroup_path && context->user && context->pam_name) {
1504                         err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
1505                         if (err < 0) {
1506                                 r = EXIT_CGROUP;
1507                                 goto fail_child;
1508                         }
1509
1510
1511                         err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
1512                         if (err < 0) {
1513                                 r = EXIT_CGROUP;
1514                                 goto fail_child;
1515                         }
1516                 }
1517 #endif
1518
1519                 if (!strv_isempty(context->runtime_directory) && runtime_prefix) {
1520                         char **rt;
1521
1522                         STRV_FOREACH(rt, context->runtime_directory) {
1523                                 _cleanup_free_ char *p;
1524
1525                                 p = strjoin(runtime_prefix, "/", *rt, NULL);
1526                                 if (!p) {
1527                                         r = EXIT_RUNTIME_DIRECTORY;
1528                                         err = -ENOMEM;
1529                                         goto fail_child;
1530                                 }
1531
1532                                 err = mkdir_safe(p, context->runtime_directory_mode, uid, gid);
1533                                 if (err < 0) {
1534                                         r = EXIT_RUNTIME_DIRECTORY;
1535                                         goto fail_child;
1536                                 }
1537                         }
1538                 }
1539
1540                 if (apply_permissions) {
1541                         err = enforce_groups(context, username, gid);
1542                         if (err < 0) {
1543                                 r = EXIT_GROUP;
1544                                 goto fail_child;
1545                         }
1546                 }
1547
1548                 umask(context->umask);
1549
1550 #ifdef HAVE_PAM
1551                 if (apply_permissions && context->pam_name && username) {
1552                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1553                         if (err < 0) {
1554                                 r = EXIT_PAM;
1555                                 goto fail_child;
1556                         }
1557                 }
1558 #endif
1559                 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
1560                         err = setup_netns(runtime->netns_storage_socket);
1561                         if (err < 0) {
1562                                 r = EXIT_NETWORK;
1563                                 goto fail_child;
1564                         }
1565                 }
1566
1567                 if (!strv_isempty(context->read_write_dirs) ||
1568                     !strv_isempty(context->read_only_dirs) ||
1569                     !strv_isempty(context->inaccessible_dirs) ||
1570                     context->mount_flags != 0 ||
1571                     (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
1572                     context->private_devices ||
1573                     context->protect_system != PROTECT_SYSTEM_NO ||
1574                     context->protect_home != PROTECT_HOME_NO) {
1575
1576                         char *tmp = NULL, *var = NULL;
1577
1578                         /* The runtime struct only contains the parent
1579                          * of the private /tmp, which is
1580                          * non-accessible to world users. Inside of it
1581                          * there's a /tmp that is sticky, and that's
1582                          * the one we want to use here. */
1583
1584                         if (context->private_tmp && runtime) {
1585                                 if (runtime->tmp_dir)
1586                                         tmp = strappenda(runtime->tmp_dir, "/tmp");
1587                                 if (runtime->var_tmp_dir)
1588                                         var = strappenda(runtime->var_tmp_dir, "/tmp");
1589                         }
1590
1591                         err = setup_namespace(
1592                                         context->read_write_dirs,
1593                                         context->read_only_dirs,
1594                                         context->inaccessible_dirs,
1595                                         tmp,
1596                                         var,
1597                                         context->private_devices,
1598                                         context->protect_home,
1599                                         context->protect_system,
1600                                         context->mount_flags);
1601                         if (err < 0) {
1602                                 r = EXIT_NAMESPACE;
1603                                 goto fail_child;
1604                         }
1605                 }
1606
1607                 if (apply_chroot) {
1608                         if (context->root_directory)
1609                                 if (chroot(context->root_directory) < 0) {
1610                                         err = -errno;
1611                                         r = EXIT_CHROOT;
1612                                         goto fail_child;
1613                                 }
1614
1615                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1616                                 err = -errno;
1617                                 r = EXIT_CHDIR;
1618                                 goto fail_child;
1619                         }
1620                 } else {
1621                         _cleanup_free_ char *d = NULL;
1622
1623                         if (asprintf(&d, "%s/%s",
1624                                      context->root_directory ? context->root_directory : "",
1625                                      context->working_directory ? context->working_directory : "") < 0) {
1626                                 err = -ENOMEM;
1627                                 r = EXIT_MEMORY;
1628                                 goto fail_child;
1629                         }
1630
1631                         if (chdir(d) < 0) {
1632                                 err = -errno;
1633                                 r = EXIT_CHDIR;
1634                                 goto fail_child;
1635                         }
1636                 }
1637
1638                 /* We repeat the fd closing here, to make sure that
1639                  * nothing is leaked from the PAM modules */
1640                 err = close_all_fds(fds, n_fds);
1641                 if (err >= 0)
1642                         err = shift_fds(fds, n_fds);
1643                 if (err >= 0)
1644                         err = flags_fds(fds, n_fds, context->non_blocking);
1645                 if (err < 0) {
1646                         r = EXIT_FDS;
1647                         goto fail_child;
1648                 }
1649
1650                 if (apply_permissions) {
1651
1652                         for (i = 0; i < _RLIMIT_MAX; i++) {
1653                                 if (!context->rlimit[i])
1654                                         continue;
1655
1656                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1657                                         err = -errno;
1658                                         r = EXIT_LIMITS;
1659                                         goto fail_child;
1660                                 }
1661                         }
1662
1663                         if (context->capability_bounding_set_drop) {
1664                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1665                                 if (err < 0) {
1666                                         r = EXIT_CAPABILITIES;
1667                                         goto fail_child;
1668                                 }
1669                         }
1670
1671                         if (context->user) {
1672                                 err = enforce_user(context, uid);
1673                                 if (err < 0) {
1674                                         r = EXIT_USER;
1675                                         goto fail_child;
1676                                 }
1677                         }
1678
1679                         /* PR_GET_SECUREBITS is not privileged, while
1680                          * PR_SET_SECUREBITS is. So to suppress
1681                          * potential EPERMs we'll try not to call
1682                          * PR_SET_SECUREBITS unless necessary. */
1683                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1684                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1685                                         err = -errno;
1686                                         r = EXIT_SECUREBITS;
1687                                         goto fail_child;
1688                                 }
1689
1690                         if (context->capabilities)
1691                                 if (cap_set_proc(context->capabilities) < 0) {
1692                                         err = -errno;
1693                                         r = EXIT_CAPABILITIES;
1694                                         goto fail_child;
1695                                 }
1696
1697                         if (context->no_new_privileges)
1698                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1699                                         err = -errno;
1700                                         r = EXIT_NO_NEW_PRIVILEGES;
1701                                         goto fail_child;
1702                                 }
1703
1704 #ifdef HAVE_SECCOMP
1705                         if (context->address_families_whitelist ||
1706                             !set_isempty(context->address_families)) {
1707                                 err = apply_address_families(context);
1708                                 if (err < 0) {
1709                                         r = EXIT_ADDRESS_FAMILIES;
1710                                         goto fail_child;
1711                                 }
1712                         }
1713
1714                         if (context->syscall_whitelist ||
1715                             !set_isempty(context->syscall_filter) ||
1716                             !set_isempty(context->syscall_archs)) {
1717                                 err = apply_seccomp(context);
1718                                 if (err < 0) {
1719                                         r = EXIT_SECCOMP;
1720                                         goto fail_child;
1721                                 }
1722                         }
1723 #endif
1724
1725 #ifdef HAVE_SELINUX
1726                         if (context->selinux_context && use_selinux()) {
1727                                 err = setexeccon(context->selinux_context);
1728                                 if (err < 0 && !context->selinux_context_ignore) {
1729                                         r = EXIT_SELINUX_CONTEXT;
1730                                         goto fail_child;
1731                                 }
1732                         }
1733 #endif
1734
1735 #ifdef HAVE_APPARMOR
1736                         if (context->apparmor_profile && use_apparmor()) {
1737                                 err = aa_change_onexec(context->apparmor_profile);
1738                                 if (err < 0 && !context->apparmor_profile_ignore) {
1739                                         r = EXIT_APPARMOR_PROFILE;
1740                                         goto fail_child;
1741                                 }
1742                         }
1743 #endif
1744                 }
1745
1746                 err = build_environment(context, n_fds, watchdog_usec, home, username, shell, &our_env);
1747                 if (r < 0) {
1748                         r = EXIT_MEMORY;
1749                         goto fail_child;
1750                 }
1751
1752                 final_env = strv_env_merge(5,
1753                                            environment,
1754                                            our_env,
1755                                            context->environment,
1756                                            files_env,
1757                                            pam_env,
1758                                            NULL);
1759                 if (!final_env) {
1760                         err = -ENOMEM;
1761                         r = EXIT_MEMORY;
1762                         goto fail_child;
1763                 }
1764
1765                 final_argv = replace_env_argv(argv, final_env);
1766                 if (!final_argv) {
1767                         err = -ENOMEM;
1768                         r = EXIT_MEMORY;
1769                         goto fail_child;
1770                 }
1771
1772                 final_env = strv_env_clean(final_env);
1773
1774                 if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
1775                         line = exec_command_line(final_argv);
1776                         if (line) {
1777                                 log_open();
1778                                 log_struct_unit(LOG_DEBUG,
1779                                                 unit_id,
1780                                                 "EXECUTABLE=%s", command->path,
1781                                                 "MESSAGE=Executing: %s", line,
1782                                                 NULL);
1783                                 log_close();
1784                                 free(line);
1785                                 line = NULL;
1786                         }
1787                 }
1788                 execve(command->path, final_argv, final_env);
1789                 err = -errno;
1790                 r = EXIT_EXEC;
1791
1792         fail_child:
1793                 if (r != 0) {
1794                         log_open();
1795                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1796                                    "EXECUTABLE=%s", command->path,
1797                                    "MESSAGE=Failed at step %s spawning %s: %s",
1798                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1799                                           command->path, strerror(-err),
1800                                    "ERRNO=%d", -err,
1801                                    NULL);
1802                         log_close();
1803                 }
1804
1805                 _exit(r);
1806         }
1807
1808         log_struct_unit(LOG_DEBUG,
1809                         unit_id,
1810                         "MESSAGE=Forked %s as "PID_FMT,
1811                         command->path, pid,
1812                         NULL);
1813
1814         /* We add the new process to the cgroup both in the child (so
1815          * that we can be sure that no user code is ever executed
1816          * outside of the cgroup) and in the parent (so that we can be
1817          * sure that when we kill the cgroup the process will be
1818          * killed too). */
1819         if (cgroup_path)
1820                 cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
1821
1822         exec_status_start(&command->exec_status, pid);
1823
1824         *ret = pid;
1825         return 0;
1826 }
1827
1828 void exec_context_init(ExecContext *c) {
1829         assert(c);
1830
1831         c->umask = 0022;
1832         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1833         c->cpu_sched_policy = SCHED_OTHER;
1834         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1835         c->syslog_level_prefix = true;
1836         c->ignore_sigpipe = true;
1837         c->timer_slack_nsec = (nsec_t) -1;
1838         c->personality = 0xffffffffUL;
1839         c->runtime_directory_mode = 0755;
1840 }
1841
1842 void exec_context_done(ExecContext *c) {
1843         unsigned l;
1844
1845         assert(c);
1846
1847         strv_free(c->environment);
1848         c->environment = NULL;
1849
1850         strv_free(c->environment_files);
1851         c->environment_files = NULL;
1852
1853         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1854                 free(c->rlimit[l]);
1855                 c->rlimit[l] = NULL;
1856         }
1857
1858         free(c->working_directory);
1859         c->working_directory = NULL;
1860         free(c->root_directory);
1861         c->root_directory = NULL;
1862
1863         free(c->tty_path);
1864         c->tty_path = NULL;
1865
1866         free(c->syslog_identifier);
1867         c->syslog_identifier = NULL;
1868
1869         free(c->user);
1870         c->user = NULL;
1871
1872         free(c->group);
1873         c->group = NULL;
1874
1875         strv_free(c->supplementary_groups);
1876         c->supplementary_groups = NULL;
1877
1878         free(c->pam_name);
1879         c->pam_name = NULL;
1880
1881         if (c->capabilities) {
1882                 cap_free(c->capabilities);
1883                 c->capabilities = NULL;
1884         }
1885
1886         strv_free(c->read_only_dirs);
1887         c->read_only_dirs = NULL;
1888
1889         strv_free(c->read_write_dirs);
1890         c->read_write_dirs = NULL;
1891
1892         strv_free(c->inaccessible_dirs);
1893         c->inaccessible_dirs = NULL;
1894
1895         if (c->cpuset)
1896                 CPU_FREE(c->cpuset);
1897
1898         free(c->utmp_id);
1899         c->utmp_id = NULL;
1900
1901         free(c->selinux_context);
1902         c->selinux_context = NULL;
1903
1904         free(c->apparmor_profile);
1905         c->apparmor_profile = NULL;
1906
1907         set_free(c->syscall_filter);
1908         c->syscall_filter = NULL;
1909
1910         set_free(c->syscall_archs);
1911         c->syscall_archs = NULL;
1912
1913         set_free(c->address_families);
1914         c->address_families = NULL;
1915
1916         strv_free(c->runtime_directory);
1917         c->runtime_directory = NULL;
1918 }
1919
1920 int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
1921         char **i;
1922
1923         assert(c);
1924
1925         if (!runtime_prefix)
1926                 return 0;
1927
1928         STRV_FOREACH(i, c->runtime_directory) {
1929                 _cleanup_free_ char *p;
1930
1931                 p = strjoin(runtime_prefix, "/", *i, NULL);
1932                 if (!p)
1933                         return -ENOMEM;
1934
1935                 /* We execute this synchronously, since we need to be
1936                  * sure this is gone when we start the service
1937                  * next. */
1938                 rm_rf_dangerous(p, false, true, false);
1939         }
1940
1941         return 0;
1942 }
1943
1944 void exec_command_done(ExecCommand *c) {
1945         assert(c);
1946
1947         free(c->path);
1948         c->path = NULL;
1949
1950         strv_free(c->argv);
1951         c->argv = NULL;
1952 }
1953
1954 void exec_command_done_array(ExecCommand *c, unsigned n) {
1955         unsigned i;
1956
1957         for (i = 0; i < n; i++)
1958                 exec_command_done(c+i);
1959 }
1960
1961 void exec_command_free_list(ExecCommand *c) {
1962         ExecCommand *i;
1963
1964         while ((i = c)) {
1965                 LIST_REMOVE(command, c, i);
1966                 exec_command_done(i);
1967                 free(i);
1968         }
1969 }
1970
1971 void exec_command_free_array(ExecCommand **c, unsigned n) {
1972         unsigned i;
1973
1974         for (i = 0; i < n; i++) {
1975                 exec_command_free_list(c[i]);
1976                 c[i] = NULL;
1977         }
1978 }
1979
1980 int exec_context_load_environment(const ExecContext *c, char ***l) {
1981         char **i, **r = NULL;
1982
1983         assert(c);
1984         assert(l);
1985
1986         STRV_FOREACH(i, c->environment_files) {
1987                 char *fn;
1988                 int k;
1989                 bool ignore = false;
1990                 char **p;
1991                 _cleanup_globfree_ glob_t pglob = {};
1992                 int count, n;
1993
1994                 fn = *i;
1995
1996                 if (fn[0] == '-') {
1997                         ignore = true;
1998                         fn ++;
1999                 }
2000
2001                 if (!path_is_absolute(fn)) {
2002                         if (ignore)
2003                                 continue;
2004
2005                         strv_free(r);
2006                         return -EINVAL;
2007                 }
2008
2009                 /* Filename supports globbing, take all matching files */
2010                 errno = 0;
2011                 if (glob(fn, 0, NULL, &pglob) != 0) {
2012                         if (ignore)
2013                                 continue;
2014
2015                         strv_free(r);
2016                         return errno ? -errno : -EINVAL;
2017                 }
2018                 count = pglob.gl_pathc;
2019                 if (count == 0) {
2020                         if (ignore)
2021                                 continue;
2022
2023                         strv_free(r);
2024                         return -EINVAL;
2025                 }
2026                 for (n = 0; n < count; n++) {
2027                         k = load_env_file(pglob.gl_pathv[n], NULL, &p);
2028                         if (k < 0) {
2029                                 if (ignore)
2030                                         continue;
2031
2032                                 strv_free(r);
2033                                 return k;
2034                         }
2035                         /* Log invalid environment variables with filename */
2036                         if (p)
2037                                 p = strv_env_clean_log(p, pglob.gl_pathv[n]);
2038
2039                         if (r == NULL)
2040                                 r = p;
2041                         else {
2042                                 char **m;
2043
2044                                 m = strv_env_merge(2, r, p);
2045                                 strv_free(r);
2046                                 strv_free(p);
2047                                 if (!m)
2048                                         return -ENOMEM;
2049
2050                                 r = m;
2051                         }
2052                 }
2053         }
2054
2055         *l = r;
2056
2057         return 0;
2058 }
2059
2060 static bool tty_may_match_dev_console(const char *tty) {
2061         char *active = NULL, *console;
2062         bool b;
2063
2064         if (startswith(tty, "/dev/"))
2065                 tty += 5;
2066
2067         /* trivial identity? */
2068         if (streq(tty, "console"))
2069                 return true;
2070
2071         console = resolve_dev_console(&active);
2072         /* if we could not resolve, assume it may */
2073         if (!console)
2074                 return true;
2075
2076         /* "tty0" means the active VC, so it may be the same sometimes */
2077         b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
2078         free(active);
2079
2080         return b;
2081 }
2082
2083 bool exec_context_may_touch_console(ExecContext *ec) {
2084         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
2085                 is_terminal_input(ec->std_input) ||
2086                 is_terminal_output(ec->std_output) ||
2087                 is_terminal_output(ec->std_error)) &&
2088                tty_may_match_dev_console(tty_path(ec));
2089 }
2090
2091 static void strv_fprintf(FILE *f, char **l) {
2092         char **g;
2093
2094         assert(f);
2095
2096         STRV_FOREACH(g, l)
2097                 fprintf(f, " %s", *g);
2098 }
2099
2100 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
2101         char **e;
2102         unsigned i;
2103
2104         assert(c);
2105         assert(f);
2106
2107         prefix = strempty(prefix);
2108
2109         fprintf(f,
2110                 "%sUMask: %04o\n"
2111                 "%sWorkingDirectory: %s\n"
2112                 "%sRootDirectory: %s\n"
2113                 "%sNonBlocking: %s\n"
2114                 "%sPrivateTmp: %s\n"
2115                 "%sPrivateNetwork: %s\n"
2116                 "%sPrivateDevices: %s\n"
2117                 "%sProtectHome: %s\n"
2118                 "%sProtectSystem: %s\n"
2119                 "%sIgnoreSIGPIPE: %s\n",
2120                 prefix, c->umask,
2121                 prefix, c->working_directory ? c->working_directory : "/",
2122                 prefix, c->root_directory ? c->root_directory : "/",
2123                 prefix, yes_no(c->non_blocking),
2124                 prefix, yes_no(c->private_tmp),
2125                 prefix, yes_no(c->private_network),
2126                 prefix, yes_no(c->private_devices),
2127                 prefix, protect_home_to_string(c->protect_home),
2128                 prefix, protect_system_to_string(c->protect_system),
2129                 prefix, yes_no(c->ignore_sigpipe));
2130
2131         STRV_FOREACH(e, c->environment)
2132                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
2133
2134         STRV_FOREACH(e, c->environment_files)
2135                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
2136
2137         if (c->nice_set)
2138                 fprintf(f,
2139                         "%sNice: %i\n",
2140                         prefix, c->nice);
2141
2142         if (c->oom_score_adjust_set)
2143                 fprintf(f,
2144                         "%sOOMScoreAdjust: %i\n",
2145                         prefix, c->oom_score_adjust);
2146
2147         for (i = 0; i < RLIM_NLIMITS; i++)
2148                 if (c->rlimit[i])
2149                         fprintf(f, "%s%s: "RLIM_FMT"\n",
2150                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
2151
2152         if (c->ioprio_set) {
2153                 _cleanup_free_ char *class_str = NULL;
2154
2155                 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
2156                 fprintf(f,
2157                         "%sIOSchedulingClass: %s\n"
2158                         "%sIOPriority: %i\n",
2159                         prefix, strna(class_str),
2160                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
2161         }
2162
2163         if (c->cpu_sched_set) {
2164                 _cleanup_free_ char *policy_str = NULL;
2165
2166                 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
2167                 fprintf(f,
2168                         "%sCPUSchedulingPolicy: %s\n"
2169                         "%sCPUSchedulingPriority: %i\n"
2170                         "%sCPUSchedulingResetOnFork: %s\n",
2171                         prefix, strna(policy_str),
2172                         prefix, c->cpu_sched_priority,
2173                         prefix, yes_no(c->cpu_sched_reset_on_fork));
2174         }
2175
2176         if (c->cpuset) {
2177                 fprintf(f, "%sCPUAffinity:", prefix);
2178                 for (i = 0; i < c->cpuset_ncpus; i++)
2179                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
2180                                 fprintf(f, " %u", i);
2181                 fputs("\n", f);
2182         }
2183
2184         if (c->timer_slack_nsec != (nsec_t) -1)
2185                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
2186
2187         fprintf(f,
2188                 "%sStandardInput: %s\n"
2189                 "%sStandardOutput: %s\n"
2190                 "%sStandardError: %s\n",
2191                 prefix, exec_input_to_string(c->std_input),
2192                 prefix, exec_output_to_string(c->std_output),
2193                 prefix, exec_output_to_string(c->std_error));
2194
2195         if (c->tty_path)
2196                 fprintf(f,
2197                         "%sTTYPath: %s\n"
2198                         "%sTTYReset: %s\n"
2199                         "%sTTYVHangup: %s\n"
2200                         "%sTTYVTDisallocate: %s\n",
2201                         prefix, c->tty_path,
2202                         prefix, yes_no(c->tty_reset),
2203                         prefix, yes_no(c->tty_vhangup),
2204                         prefix, yes_no(c->tty_vt_disallocate));
2205
2206         if (c->std_output == EXEC_OUTPUT_SYSLOG ||
2207             c->std_output == EXEC_OUTPUT_KMSG ||
2208             c->std_output == EXEC_OUTPUT_JOURNAL ||
2209             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2210             c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2211             c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
2212             c->std_error == EXEC_OUTPUT_SYSLOG ||
2213             c->std_error == EXEC_OUTPUT_KMSG ||
2214             c->std_error == EXEC_OUTPUT_JOURNAL ||
2215             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2216             c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2217             c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
2218
2219                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
2220
2221                 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
2222                 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
2223
2224                 fprintf(f,
2225                         "%sSyslogFacility: %s\n"
2226                         "%sSyslogLevel: %s\n",
2227                         prefix, strna(fac_str),
2228                         prefix, strna(lvl_str));
2229         }
2230
2231         if (c->capabilities) {
2232                 _cleanup_cap_free_charp_ char *t;
2233
2234                 t = cap_to_text(c->capabilities, NULL);
2235                 if (t)
2236                         fprintf(f, "%sCapabilities: %s\n", prefix, t);
2237         }
2238
2239         if (c->secure_bits)
2240                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
2241                         prefix,
2242                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
2243                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
2244                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
2245                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
2246                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
2247                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
2248
2249         if (c->capability_bounding_set_drop) {
2250                 unsigned long l;
2251                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
2252
2253                 for (l = 0; l <= cap_last_cap(); l++)
2254                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
2255                                 _cleanup_cap_free_charp_ char *t;
2256
2257                                 t = cap_to_name(l);
2258                                 if (t)
2259                                         fprintf(f, " %s", t);
2260                         }
2261
2262                 fputs("\n", f);
2263         }
2264
2265         if (c->user)
2266                 fprintf(f, "%sUser: %s\n", prefix, c->user);
2267         if (c->group)
2268                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
2269
2270         if (strv_length(c->supplementary_groups) > 0) {
2271                 fprintf(f, "%sSupplementaryGroups:", prefix);
2272                 strv_fprintf(f, c->supplementary_groups);
2273                 fputs("\n", f);
2274         }
2275
2276         if (c->pam_name)
2277                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
2278
2279         if (strv_length(c->read_write_dirs) > 0) {
2280                 fprintf(f, "%sReadWriteDirs:", prefix);
2281                 strv_fprintf(f, c->read_write_dirs);
2282                 fputs("\n", f);
2283         }
2284
2285         if (strv_length(c->read_only_dirs) > 0) {
2286                 fprintf(f, "%sReadOnlyDirs:", prefix);
2287                 strv_fprintf(f, c->read_only_dirs);
2288                 fputs("\n", f);
2289         }
2290
2291         if (strv_length(c->inaccessible_dirs) > 0) {
2292                 fprintf(f, "%sInaccessibleDirs:", prefix);
2293                 strv_fprintf(f, c->inaccessible_dirs);
2294                 fputs("\n", f);
2295         }
2296
2297         if (c->utmp_id)
2298                 fprintf(f,
2299                         "%sUtmpIdentifier: %s\n",
2300                         prefix, c->utmp_id);
2301
2302         if (c->selinux_context)
2303                 fprintf(f,
2304                         "%sSELinuxContext: %s%s\n",
2305                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
2306
2307         if (c->personality != 0xffffffffUL)
2308                 fprintf(f,
2309                         "%sPersonality: %s\n",
2310                         prefix, strna(personality_to_string(c->personality)));
2311
2312         if (c->syscall_filter) {
2313 #ifdef HAVE_SECCOMP
2314                 Iterator j;
2315                 void *id;
2316                 bool first = true;
2317 #endif
2318
2319                 fprintf(f,
2320                         "%sSystemCallFilter: ",
2321                         prefix);
2322
2323                 if (!c->syscall_whitelist)
2324                         fputc('~', f);
2325
2326 #ifdef HAVE_SECCOMP
2327                 SET_FOREACH(id, c->syscall_filter, j) {
2328                         _cleanup_free_ char *name = NULL;
2329
2330                         if (first)
2331                                 first = false;
2332                         else
2333                                 fputc(' ', f);
2334
2335                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
2336                         fputs(strna(name), f);
2337                 }
2338 #endif
2339
2340                 fputc('\n', f);
2341         }
2342
2343         if (c->syscall_archs) {
2344 #ifdef HAVE_SECCOMP
2345                 Iterator j;
2346                 void *id;
2347 #endif
2348
2349                 fprintf(f,
2350                         "%sSystemCallArchitectures:",
2351                         prefix);
2352
2353 #ifdef HAVE_SECCOMP
2354                 SET_FOREACH(id, c->syscall_archs, j)
2355                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
2356 #endif
2357                 fputc('\n', f);
2358         }
2359
2360         if (c->syscall_errno != 0)
2361                 fprintf(f,
2362                         "%sSystemCallErrorNumber: %s\n",
2363                         prefix, strna(errno_to_name(c->syscall_errno)));
2364
2365         if (c->apparmor_profile)
2366                 fprintf(f,
2367                         "%sAppArmorProfile: %s%s\n",
2368                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
2369 }
2370
2371 void exec_status_start(ExecStatus *s, pid_t pid) {
2372         assert(s);
2373
2374         zero(*s);
2375         s->pid = pid;
2376         dual_timestamp_get(&s->start_timestamp);
2377 }
2378
2379 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2380         assert(s);
2381
2382         if (s->pid && s->pid != pid)
2383                 zero(*s);
2384
2385         s->pid = pid;
2386         dual_timestamp_get(&s->exit_timestamp);
2387
2388         s->code = code;
2389         s->status = status;
2390
2391         if (context) {
2392                 if (context->utmp_id)
2393                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2394
2395                 exec_context_tty_reset(context);
2396         }
2397 }
2398
2399 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2400         char buf[FORMAT_TIMESTAMP_MAX];
2401
2402         assert(s);
2403         assert(f);
2404
2405         if (!prefix)
2406                 prefix = "";
2407
2408         if (s->pid <= 0)
2409                 return;
2410
2411         fprintf(f,
2412                 "%sPID: "PID_FMT"\n",
2413                 prefix, s->pid);
2414
2415         if (s->start_timestamp.realtime > 0)
2416                 fprintf(f,
2417                         "%sStart Timestamp: %s\n",
2418                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2419
2420         if (s->exit_timestamp.realtime > 0)
2421                 fprintf(f,
2422                         "%sExit Timestamp: %s\n"
2423                         "%sExit Code: %s\n"
2424                         "%sExit Status: %i\n",
2425                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2426                         prefix, sigchld_code_to_string(s->code),
2427                         prefix, s->status);
2428 }
2429
2430 char *exec_command_line(char **argv) {
2431         size_t k;
2432         char *n, *p, **a;
2433         bool first = true;
2434
2435         assert(argv);
2436
2437         k = 1;
2438         STRV_FOREACH(a, argv)
2439                 k += strlen(*a)+3;
2440
2441         if (!(n = new(char, k)))
2442                 return NULL;
2443
2444         p = n;
2445         STRV_FOREACH(a, argv) {
2446
2447                 if (!first)
2448                         *(p++) = ' ';
2449                 else
2450                         first = false;
2451
2452                 if (strpbrk(*a, WHITESPACE)) {
2453                         *(p++) = '\'';
2454                         p = stpcpy(p, *a);
2455                         *(p++) = '\'';
2456                 } else
2457                         p = stpcpy(p, *a);
2458
2459         }
2460
2461         *p = 0;
2462
2463         /* FIXME: this doesn't really handle arguments that have
2464          * spaces and ticks in them */
2465
2466         return n;
2467 }
2468
2469 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2470         char *p2;
2471         const char *prefix2;
2472
2473         char *cmd;
2474
2475         assert(c);
2476         assert(f);
2477
2478         if (!prefix)
2479                 prefix = "";
2480         p2 = strappend(prefix, "\t");
2481         prefix2 = p2 ? p2 : prefix;
2482
2483         cmd = exec_command_line(c->argv);
2484
2485         fprintf(f,
2486                 "%sCommand Line: %s\n",
2487                 prefix, cmd ? cmd : strerror(ENOMEM));
2488
2489         free(cmd);
2490
2491         exec_status_dump(&c->exec_status, f, prefix2);
2492
2493         free(p2);
2494 }
2495
2496 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2497         assert(f);
2498
2499         if (!prefix)
2500                 prefix = "";
2501
2502         LIST_FOREACH(command, c, c)
2503                 exec_command_dump(c, f, prefix);
2504 }
2505
2506 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2507         ExecCommand *end;
2508
2509         assert(l);
2510         assert(e);
2511
2512         if (*l) {
2513                 /* It's kind of important, that we keep the order here */
2514                 LIST_FIND_TAIL(command, *l, end);
2515                 LIST_INSERT_AFTER(command, *l, end, e);
2516         } else
2517               *l = e;
2518 }
2519
2520 int exec_command_set(ExecCommand *c, const char *path, ...) {
2521         va_list ap;
2522         char **l, *p;
2523
2524         assert(c);
2525         assert(path);
2526
2527         va_start(ap, path);
2528         l = strv_new_ap(path, ap);
2529         va_end(ap);
2530
2531         if (!l)
2532                 return -ENOMEM;
2533
2534         p = strdup(path);
2535         if (!p) {
2536                 strv_free(l);
2537                 return -ENOMEM;
2538         }
2539
2540         free(c->path);
2541         c->path = p;
2542
2543         strv_free(c->argv);
2544         c->argv = l;
2545
2546         return 0;
2547 }
2548
2549 static int exec_runtime_allocate(ExecRuntime **rt) {
2550
2551         if (*rt)
2552                 return 0;
2553
2554         *rt = new0(ExecRuntime, 1);
2555         if (!*rt)
2556                 return -ENOMEM;
2557
2558         (*rt)->n_ref = 1;
2559         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
2560
2561         return 0;
2562 }
2563
2564 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
2565         int r;
2566
2567         assert(rt);
2568         assert(c);
2569         assert(id);
2570
2571         if (*rt)
2572                 return 1;
2573
2574         if (!c->private_network && !c->private_tmp)
2575                 return 0;
2576
2577         r = exec_runtime_allocate(rt);
2578         if (r < 0)
2579                 return r;
2580
2581         if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
2582                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
2583                         return -errno;
2584         }
2585
2586         if (c->private_tmp && !(*rt)->tmp_dir) {
2587                 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
2588                 if (r < 0)
2589                         return r;
2590         }
2591
2592         return 1;
2593 }
2594
2595 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
2596         assert(r);
2597         assert(r->n_ref > 0);
2598
2599         r->n_ref++;
2600         return r;
2601 }
2602
2603 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
2604
2605         if (!r)
2606                 return NULL;
2607
2608         assert(r->n_ref > 0);
2609
2610         r->n_ref--;
2611         if (r->n_ref <= 0) {
2612                 free(r->tmp_dir);
2613                 free(r->var_tmp_dir);
2614                 safe_close_pair(r->netns_storage_socket);
2615                 free(r);
2616         }
2617
2618         return NULL;
2619 }
2620
2621 int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds) {
2622         assert(u);
2623         assert(f);
2624         assert(fds);
2625
2626         if (!rt)
2627                 return 0;
2628
2629         if (rt->tmp_dir)
2630                 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
2631
2632         if (rt->var_tmp_dir)
2633                 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
2634
2635         if (rt->netns_storage_socket[0] >= 0) {
2636                 int copy;
2637
2638                 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
2639                 if (copy < 0)
2640                         return copy;
2641
2642                 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
2643         }
2644
2645         if (rt->netns_storage_socket[1] >= 0) {
2646                 int copy;
2647
2648                 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
2649                 if (copy < 0)
2650                         return copy;
2651
2652                 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
2653         }
2654
2655         return 0;
2656 }
2657
2658 int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds) {
2659         int r;
2660
2661         assert(rt);
2662         assert(key);
2663         assert(value);
2664
2665         if (streq(key, "tmp-dir")) {
2666                 char *copy;
2667
2668                 r = exec_runtime_allocate(rt);
2669                 if (r < 0)
2670                         return r;
2671
2672                 copy = strdup(value);
2673                 if (!copy)
2674                         return log_oom();
2675
2676                 free((*rt)->tmp_dir);
2677                 (*rt)->tmp_dir = copy;
2678
2679         } else if (streq(key, "var-tmp-dir")) {
2680                 char *copy;
2681
2682                 r = exec_runtime_allocate(rt);
2683                 if (r < 0)
2684                         return r;
2685
2686                 copy = strdup(value);
2687                 if (!copy)
2688                         return log_oom();
2689
2690                 free((*rt)->var_tmp_dir);
2691                 (*rt)->var_tmp_dir = copy;
2692
2693         } else if (streq(key, "netns-socket-0")) {
2694                 int fd;
2695
2696                 r = exec_runtime_allocate(rt);
2697                 if (r < 0)
2698                         return r;
2699
2700                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2701                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2702                 else {
2703                         safe_close((*rt)->netns_storage_socket[0]);
2704                         (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
2705                 }
2706         } else if (streq(key, "netns-socket-1")) {
2707                 int fd;
2708
2709                 r = exec_runtime_allocate(rt);
2710                 if (r < 0)
2711                         return r;
2712
2713                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2714                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2715                 else {
2716                         safe_close((*rt)->netns_storage_socket[1]);
2717                         (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
2718                 }
2719         } else
2720                 return 0;
2721
2722         return 1;
2723 }
2724
2725 static void *remove_tmpdir_thread(void *p) {
2726         _cleanup_free_ char *path = p;
2727
2728         rm_rf_dangerous(path, false, true, false);
2729         return NULL;
2730 }
2731
2732 void exec_runtime_destroy(ExecRuntime *rt) {
2733         int r;
2734
2735         if (!rt)
2736                 return;
2737
2738         /* If there are multiple users of this, let's leave the stuff around */
2739         if (rt->n_ref > 1)
2740                 return;
2741
2742         if (rt->tmp_dir) {
2743                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
2744
2745                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
2746                 if (r < 0) {
2747                         log_warning("Failed to nuke %s: %s", rt->tmp_dir, strerror(-r));
2748                         free(rt->tmp_dir);
2749                 }
2750
2751                 rt->tmp_dir = NULL;
2752         }
2753
2754         if (rt->var_tmp_dir) {
2755                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
2756
2757                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
2758                 if (r < 0) {
2759                         log_warning("Failed to nuke %s: %s", rt->var_tmp_dir, strerror(-r));
2760                         free(rt->var_tmp_dir);
2761                 }
2762
2763                 rt->var_tmp_dir = NULL;
2764         }
2765
2766         safe_close_pair(rt->netns_storage_socket);
2767 }
2768
2769 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2770         [EXEC_INPUT_NULL] = "null",
2771         [EXEC_INPUT_TTY] = "tty",
2772         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2773         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2774         [EXEC_INPUT_SOCKET] = "socket"
2775 };
2776
2777 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2778
2779 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2780         [EXEC_OUTPUT_INHERIT] = "inherit",
2781         [EXEC_OUTPUT_NULL] = "null",
2782         [EXEC_OUTPUT_TTY] = "tty",
2783         [EXEC_OUTPUT_SYSLOG] = "syslog",
2784         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2785         [EXEC_OUTPUT_KMSG] = "kmsg",
2786         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2787         [EXEC_OUTPUT_JOURNAL] = "journal",
2788         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2789         [EXEC_OUTPUT_SOCKET] = "socket"
2790 };
2791
2792 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);