src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <linux/seccomp-bpf.h>
  42 #include <glob.h>
  43 #include <libgen.h>
  44
  45 #ifdef HAVE_PAM
  46 #include <security/pam_appl.h>
  47 #endif
  48
  49 #include "execute.h"
  50 #include "strv.h"
  51 #include "macro.h"
  52 #include "capability.h"
  53 #include "util.h"
  54 #include "log.h"
  55 #include "sd-messages.h"
  56 #include "ioprio.h"
  57 #include "securebits.h"
  58 #include "cgroup.h"
  59 #include "namespace.h"
  60 #include "tcpwrap.h"
  61 #include "exit-status.h"
  62 #include "missing.h"
  63 #include "utmp-wtmp.h"
  64 #include "def.h"
  65 #include "loopback-setup.h"
  66 #include "path-util.h"
  67 #include "syscall-list.h"
  68 #include "env-util.h"
  69 #include "fileio.h"
  70
  71 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  72
  73 /* This assumes there is a 'tty' group */
  74 #define TTY_MODE 0620
  75
  76 static int shift_fds(int fds[], unsigned n_fds) {
  77         int start, restart_from;
  78
  79         if (n_fds <= 0)
  80                 return 0;
  81
  82         /* Modifies the fds array! (sorts it) */
  83
  84         assert(fds);
  85
  86         start = 0;
  87         for (;;) {
  88                 int i;
  89
  90                 restart_from = -1;
  91
  92                 for (i = start; i < (int) n_fds; i++) {
  93                         int nfd;
  94
  95                         /* Already at right index? */
  96                         if (fds[i] == i+3)
  97                                 continue;
  98
  99                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
 100                                 return -errno;
 101
 102                         close_nointr_nofail(fds[i]);
 103                         fds[i] = nfd;
 104
 105                         /* Hmm, the fd we wanted isn't free? Then
 106                          * let's remember that and try again from here*/
 107                         if (nfd != i+3 && restart_from < 0)
 108                                 restart_from = i;
 109                 }
 110
 111                 if (restart_from < 0)
 112                         break;
 113
 114                 start = restart_from;
 115         }
 116
 117         return 0;
 118 }
 119
 120 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 121         unsigned i;
 122         int r;
 123
 124         if (n_fds <= 0)
 125                 return 0;
 126
 127         assert(fds);
 128
 129         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 130
 131         for (i = 0; i < n_fds; i++) {
 132
 133                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 134                         return r;
 135
 136                 /* We unconditionally drop FD_CLOEXEC from the fds,
 137                  * since after all we want to pass these fds to our
 138                  * children */
 139
 140                 if ((r = fd_cloexec(fds[i], false)) < 0)
 141                         return r;
 142         }
 143
 144         return 0;
 145 }
 146
 147 static const char *tty_path(const ExecContext *context) {
 148         assert(context);
 149
 150         if (context->tty_path)
 151                 return context->tty_path;
 152
 153         return "/dev/console";
 154 }
 155
 156 void exec_context_tty_reset(const ExecContext *context) {
 157         assert(context);
 158
 159         if (context->tty_vhangup)
 160                 terminal_vhangup(tty_path(context));
 161
 162         if (context->tty_reset)
 163                 reset_terminal(tty_path(context));
 164
 165         if (context->tty_vt_disallocate && context->tty_path)
 166                 vt_disallocate(context->tty_path);
 167 }
 168
 169 static bool is_terminal_output(ExecOutput o) {
 170         return
 171                 o == EXEC_OUTPUT_TTY ||
 172                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 173                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 174                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 175 }
 176
 177 void exec_context_serialize(const ExecContext *context, Unit *u, FILE *f) {
 178         assert(context);
 179         assert(u);
 180         assert(f);
 181
 182         if (context->tmp_dir)
 183                 unit_serialize_item(u, f, "tmp-dir", context->tmp_dir);
 184
 185         if (context->var_tmp_dir)
 186                 unit_serialize_item(u, f, "var-tmp-dir", context->var_tmp_dir);
 187 }
 188
 189 static int open_null_as(int flags, int nfd) {
 190         int fd, r;
 191
 192         assert(nfd >= 0);
 193
 194         if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
 195                 return -errno;
 196
 197         if (fd != nfd) {
 198                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 199                 close_nointr_nofail(fd);
 200         } else
 201                 r = nfd;
 202
 203         return r;
 204 }
 205
 206 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 207         int fd, r;
 208         union sockaddr_union sa;
 209
 210         assert(context);
 211         assert(output < _EXEC_OUTPUT_MAX);
 212         assert(ident);
 213         assert(nfd >= 0);
 214
 215         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 216         if (fd < 0)
 217                 return -errno;
 218
 219         zero(sa);
 220         sa.un.sun_family = AF_UNIX;
 221         strncpy(sa.un.sun_path, "/run/systemd/journal/stdout", sizeof(sa.un.sun_path));
 222
 223         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 224         if (r < 0) {
 225                 close_nointr_nofail(fd);
 226                 return -errno;
 227         }
 228
 229         if (shutdown(fd, SHUT_RD) < 0) {
 230                 close_nointr_nofail(fd);
 231                 return -errno;
 232         }
 233
 234         dprintf(fd,
 235                 "%s\n"
 236                 "%s\n"
 237                 "%i\n"
 238                 "%i\n"
 239                 "%i\n"
 240                 "%i\n"
 241                 "%i\n",
 242                 context->syslog_identifier ? context->syslog_identifier : ident,
 243                 unit_id,
 244                 context->syslog_priority,
 245                 !!context->syslog_level_prefix,
 246                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 247                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 248                 is_terminal_output(output));
 249
 250         if (fd != nfd) {
 251                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 252                 close_nointr_nofail(fd);
 253         } else
 254                 r = nfd;
 255
 256         return r;
 257 }
 258 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 259         int fd, r;
 260
 261         assert(path);
 262         assert(nfd >= 0);
 263
 264         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 265                 return fd;
 266
 267         if (fd != nfd) {
 268                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 269                 close_nointr_nofail(fd);
 270         } else
 271                 r = nfd;
 272
 273         return r;
 274 }
 275
 276 static bool is_terminal_input(ExecInput i) {
 277         return
 278                 i == EXEC_INPUT_TTY ||
 279                 i == EXEC_INPUT_TTY_FORCE ||
 280                 i == EXEC_INPUT_TTY_FAIL;
 281 }
 282
 283 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 284
 285         if (is_terminal_input(std_input) && !apply_tty_stdin)
 286                 return EXEC_INPUT_NULL;
 287
 288         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 289                 return EXEC_INPUT_NULL;
 290
 291         return std_input;
 292 }
 293
 294 static int fixup_output(ExecOutput std_output, int socket_fd) {
 295
 296         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 297                 return EXEC_OUTPUT_INHERIT;
 298
 299         return std_output;
 300 }
 301
 302 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 303         ExecInput i;
 304
 305         assert(context);
 306
 307         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 308
 309         switch (i) {
 310
 311         case EXEC_INPUT_NULL:
 312                 return open_null_as(O_RDONLY, STDIN_FILENO);
 313
 314         case EXEC_INPUT_TTY:
 315         case EXEC_INPUT_TTY_FORCE:
 316         case EXEC_INPUT_TTY_FAIL: {
 317                 int fd, r;
 318
 319                 if ((fd = acquire_terminal(
 320                                      tty_path(context),
 321                                      i == EXEC_INPUT_TTY_FAIL,
 322                                      i == EXEC_INPUT_TTY_FORCE,
 323                                      false,
 324                                      (usec_t) -1)) < 0)
 325                         return fd;
 326
 327                 if (fd != STDIN_FILENO) {
 328                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 329                         close_nointr_nofail(fd);
 330                 } else
 331                         r = STDIN_FILENO;
 332
 333                 return r;
 334         }
 335
 336         case EXEC_INPUT_SOCKET:
 337                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 338
 339         default:
 340                 assert_not_reached("Unknown input type");
 341         }
 342 }
 343
 344 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 345         ExecOutput o;
 346         ExecInput i;
 347         int r;
 348
 349         assert(context);
 350         assert(ident);
 351
 352         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 353         o = fixup_output(context->std_output, socket_fd);
 354
 355         if (fileno == STDERR_FILENO) {
 356                 ExecOutput e;
 357                 e = fixup_output(context->std_error, socket_fd);
 358
 359                 /* This expects the input and output are already set up */
 360
 361                 /* Don't change the stderr file descriptor if we inherit all
 362                  * the way and are not on a tty */
 363                 if (e == EXEC_OUTPUT_INHERIT &&
 364                     o == EXEC_OUTPUT_INHERIT &&
 365                     i == EXEC_INPUT_NULL &&
 366                     !is_terminal_input(context->std_input) &&
 367                     getppid () != 1)
 368                         return fileno;
 369
 370                 /* Duplicate from stdout if possible */
 371                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 372                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 373
 374                 o = e;
 375
 376         } else if (o == EXEC_OUTPUT_INHERIT) {
 377                 /* If input got downgraded, inherit the original value */
 378                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 379                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 380
 381                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 382                 if (i != EXEC_INPUT_NULL)
 383                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 384
 385                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 386                 if (getppid() != 1)
 387                         return fileno;
 388
 389                 /* We need to open /dev/null here anew, to get the right access mode. */
 390                 return open_null_as(O_WRONLY, fileno);
 391         }
 392
 393         switch (o) {
 394
 395         case EXEC_OUTPUT_NULL:
 396                 return open_null_as(O_WRONLY, fileno);
 397
 398         case EXEC_OUTPUT_TTY:
 399                 if (is_terminal_input(i))
 400                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 401
 402                 /* We don't reset the terminal if this is just about output */
 403                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 404
 405         case EXEC_OUTPUT_SYSLOG:
 406         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 407         case EXEC_OUTPUT_KMSG:
 408         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 409         case EXEC_OUTPUT_JOURNAL:
 410         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 411                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 412                 if (r < 0) {
 413                         log_struct_unit(LOG_CRIT, unit_id,
 414                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 415                                 fileno == STDOUT_FILENO ? "out" : "err",
 416                                 unit_id, strerror(-r),
 417                                 "ERRNO=%d", -r,
 418                                 NULL);
 419                         r = open_null_as(O_WRONLY, fileno);
 420                 }
 421                 return r;
 422
 423         case EXEC_OUTPUT_SOCKET:
 424                 assert(socket_fd >= 0);
 425                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 426
 427         default:
 428                 assert_not_reached("Unknown error type");
 429         }
 430 }
 431
 432 static int chown_terminal(int fd, uid_t uid) {
 433         struct stat st;
 434
 435         assert(fd >= 0);
 436
 437         /* This might fail. What matters are the results. */
 438         (void) fchown(fd, uid, -1);
 439         (void) fchmod(fd, TTY_MODE);
 440
 441         if (fstat(fd, &st) < 0)
 442                 return -errno;
 443
 444         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 445                 return -EPERM;
 446
 447         return 0;
 448 }
 449
 450 static int setup_confirm_stdio(int *_saved_stdin,
 451                                int *_saved_stdout) {
 452         int fd = -1, saved_stdin, saved_stdout = -1, r;
 453
 454         assert(_saved_stdin);
 455         assert(_saved_stdout);
 456
 457         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 458         if (saved_stdin < 0)
 459                 return -errno;
 460
 461         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 462         if (saved_stdout < 0) {
 463                 r = errno;
 464                 goto fail;
 465         }
 466
 467         fd = acquire_terminal(
 468                         "/dev/console",
 469                         false,
 470                         false,
 471                         false,
 472                         DEFAULT_CONFIRM_USEC);
 473         if (fd < 0) {
 474                 r = fd;
 475                 goto fail;
 476         }
 477
 478         r = chown_terminal(fd, getuid());
 479         if (r < 0)
 480                 goto fail;
 481
 482         if (dup2(fd, STDIN_FILENO) < 0) {
 483                 r = -errno;
 484                 goto fail;
 485         }
 486
 487         if (dup2(fd, STDOUT_FILENO) < 0) {
 488                 r = -errno;
 489                 goto fail;
 490         }
 491
 492         if (fd >= 2)
 493                 close_nointr_nofail(fd);
 494
 495         *_saved_stdin = saved_stdin;
 496         *_saved_stdout = saved_stdout;
 497
 498         return 0;
 499
 500 fail:
 501         if (saved_stdout >= 0)
 502                 close_nointr_nofail(saved_stdout);
 503
 504         if (saved_stdin >= 0)
 505                 close_nointr_nofail(saved_stdin);
 506
 507         if (fd >= 0)
 508                 close_nointr_nofail(fd);
 509
 510         return r;
 511 }
 512
 513 static int write_confirm_message(const char *format, ...) {
 514         int fd;
 515         va_list ap;
 516
 517         assert(format);
 518
 519         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 520         if (fd < 0)
 521                 return fd;
 522
 523         va_start(ap, format);
 524         vdprintf(fd, format, ap);
 525         va_end(ap);
 526
 527         close_nointr_nofail(fd);
 528
 529         return 0;
 530 }
 531
 532 static int restore_confirm_stdio(int *saved_stdin,
 533                                  int *saved_stdout) {
 534
 535         int r = 0;
 536
 537         assert(saved_stdin);
 538         assert(saved_stdout);
 539
 540         release_terminal();
 541
 542         if (*saved_stdin >= 0)
 543                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 544                         r = -errno;
 545
 546         if (*saved_stdout >= 0)
 547                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 548                         r = -errno;
 549
 550         if (*saved_stdin >= 0)
 551                 close_nointr_nofail(*saved_stdin);
 552
 553         if (*saved_stdout >= 0)
 554                 close_nointr_nofail(*saved_stdout);
 555
 556         return r;
 557 }
 558
 559 static int ask_for_confirmation(char *response, char **argv) {
 560         int saved_stdout = -1, saved_stdin = -1, r;
 561         char *line;
 562
 563         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 564         if (r < 0)
 565                 return r;
 566
 567         line = exec_command_line(argv);
 568         if (!line)
 569                 return -ENOMEM;
 570
 571         r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 572         free(line);
 573
 574         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 575
 576         return r;
 577 }
 578
 579 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 580         bool keep_groups = false;
 581         int r;
 582
 583         assert(context);
 584
 585         /* Lookup and set GID and supplementary group list. Here too
 586          * we avoid NSS lookups for gid=0. */
 587
 588         if (context->group || username) {
 589
 590                 if (context->group) {
 591                         const char *g = context->group;
 592
 593                         if ((r = get_group_creds(&g, &gid)) < 0)
 594                                 return r;
 595                 }
 596
 597                 /* First step, initialize groups from /etc/groups */
 598                 if (username && gid != 0) {
 599                         if (initgroups(username, gid) < 0)
 600                                 return -errno;
 601
 602                         keep_groups = true;
 603                 }
 604
 605                 /* Second step, set our gids */
 606                 if (setresgid(gid, gid, gid) < 0)
 607                         return -errno;
 608         }
 609
 610         if (context->supplementary_groups) {
 611                 int ngroups_max, k;
 612                 gid_t *gids;
 613                 char **i;
 614
 615                 /* Final step, initialize any manually set supplementary groups */
 616                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 617
 618                 if (!(gids = new(gid_t, ngroups_max)))
 619                         return -ENOMEM;
 620
 621                 if (keep_groups) {
 622                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 623                                 free(gids);
 624                                 return -errno;
 625                         }
 626                 } else
 627                         k = 0;
 628
 629                 STRV_FOREACH(i, context->supplementary_groups) {
 630                         const char *g;
 631
 632                         if (k >= ngroups_max) {
 633                                 free(gids);
 634                                 return -E2BIG;
 635                         }
 636
 637                         g = *i;
 638                         r = get_group_creds(&g, gids+k);
 639                         if (r < 0) {
 640                                 free(gids);
 641                                 return r;
 642                         }
 643
 644                         k++;
 645                 }
 646
 647                 if (setgroups(k, gids) < 0) {
 648                         free(gids);
 649                         return -errno;
 650                 }
 651
 652                 free(gids);
 653         }
 654
 655         return 0;
 656 }
 657
 658 static int enforce_user(const ExecContext *context, uid_t uid) {
 659         int r;
 660         assert(context);
 661
 662         /* Sets (but doesn't lookup) the uid and make sure we keep the
 663          * capabilities while doing so. */
 664
 665         if (context->capabilities) {
 666                 cap_t d;
 667                 static const cap_value_t bits[] = {
 668                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 669                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 670                 };
 671
 672                 /* First step: If we need to keep capabilities but
 673                  * drop privileges we need to make sure we keep our
 674                  * caps, while we drop privileges. */
 675                 if (uid != 0) {
 676                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 677
 678                         if (prctl(PR_GET_SECUREBITS) != sb)
 679                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 680                                         return -errno;
 681                 }
 682
 683                 /* Second step: set the capabilities. This will reduce
 684                  * the capabilities to the minimum we need. */
 685
 686                 if (!(d = cap_dup(context->capabilities)))
 687                         return -errno;
 688
 689                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 690                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 691                         r = -errno;
 692                         cap_free(d);
 693                         return r;
 694                 }
 695
 696                 if (cap_set_proc(d) < 0) {
 697                         r = -errno;
 698                         cap_free(d);
 699                         return r;
 700                 }
 701
 702                 cap_free(d);
 703         }
 704
 705         /* Third step: actually set the uids */
 706         if (setresuid(uid, uid, uid) < 0)
 707                 return -errno;
 708
 709         /* At this point we should have all necessary capabilities but
 710            are otherwise a normal user. However, the caps might got
 711            corrupted due to the setresuid() so we need clean them up
 712            later. This is done outside of this call. */
 713
 714         return 0;
 715 }
 716
 717 #ifdef HAVE_PAM
 718
 719 static int null_conv(
 720                 int num_msg,
 721                 const struct pam_message **msg,
 722                 struct pam_response **resp,
 723                 void *appdata_ptr) {
 724
 725         /* We don't support conversations */
 726
 727         return PAM_CONV_ERR;
 728 }
 729
 730 static int setup_pam(
 731                 const char *name,
 732                 const char *user,
 733                 uid_t uid,
 734                 const char *tty,
 735                 char ***pam_env,
 736                 int fds[], unsigned n_fds) {
 737
 738         static const struct pam_conv conv = {
 739                 .conv = null_conv,
 740                 .appdata_ptr = NULL
 741         };
 742
 743         pam_handle_t *handle = NULL;
 744         sigset_t ss, old_ss;
 745         int pam_code = PAM_SUCCESS;
 746         int err;
 747         char **e = NULL;
 748         bool close_session = false;
 749         pid_t pam_pid = 0, parent_pid;
 750
 751         assert(name);
 752         assert(user);
 753         assert(pam_env);
 754
 755         /* We set up PAM in the parent process, then fork. The child
 756          * will then stay around until killed via PR_GET_PDEATHSIG or
 757          * systemd via the cgroup logic. It will then remove the PAM
 758          * session again. The parent process will exec() the actual
 759          * daemon. We do things this way to ensure that the main PID
 760          * of the daemon is the one we initially fork()ed. */
 761
 762         if ((pam_code = pam_start(name, user, &conv, &handle)) != PAM_SUCCESS) {
 763                 handle = NULL;
 764                 goto fail;
 765         }
 766
 767         if (tty)
 768                 if ((pam_code = pam_set_item(handle, PAM_TTY, tty)) != PAM_SUCCESS)
 769                         goto fail;
 770
 771         if ((pam_code = pam_acct_mgmt(handle, PAM_SILENT)) != PAM_SUCCESS)
 772                 goto fail;
 773
 774         if ((pam_code = pam_open_session(handle, PAM_SILENT)) != PAM_SUCCESS)
 775                 goto fail;
 776
 777         close_session = true;
 778
 779         if ((!(e = pam_getenvlist(handle)))) {
 780                 pam_code = PAM_BUF_ERR;
 781                 goto fail;
 782         }
 783
 784         /* Block SIGTERM, so that we know that it won't get lost in
 785          * the child */
 786         if (sigemptyset(&ss) < 0 ||
 787             sigaddset(&ss, SIGTERM) < 0 ||
 788             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 789                 goto fail;
 790
 791         parent_pid = getpid();
 792
 793         if ((pam_pid = fork()) < 0)
 794                 goto fail;
 795
 796         if (pam_pid == 0) {
 797                 int sig;
 798                 int r = EXIT_PAM;
 799
 800                 /* The child's job is to reset the PAM session on
 801                  * termination */
 802
 803                 /* This string must fit in 10 chars (i.e. the length
 804                  * of "/sbin/init"), to look pretty in /bin/ps */
 805                 rename_process("(sd-pam)");
 806
 807                 /* Make sure we don't keep open the passed fds in this
 808                 child. We assume that otherwise only those fds are
 809                 open here that have been opened by PAM. */
 810                 close_many(fds, n_fds);
 811
 812                 /* Drop privileges - we don't need any to pam_close_session
 813                  * and this will make PR_SET_PDEATHSIG work in most cases.
 814                  * If this fails, ignore the error - but expect sd-pam threads
 815                  * to fail to exit normally */
 816                 if (setresuid(uid, uid, uid) < 0)
 817                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 818
 819                 /* Wait until our parent died. This will only work if
 820                  * the above setresuid() succeeds, otherwise the kernel
 821                  * will not allow unprivileged parents kill their privileged
 822                  * children this way. We rely on the control groups kill logic
 823                  * to do the rest for us. */
 824                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 825                         goto child_finish;
 826
 827                 /* Check if our parent process might already have
 828                  * died? */
 829                 if (getppid() == parent_pid) {
 830                         for (;;) {
 831                                 if (sigwait(&ss, &sig) < 0) {
 832                                         if (errno == EINTR)
 833                                                 continue;
 834
 835                                         goto child_finish;
 836                                 }
 837
 838                                 assert(sig == SIGTERM);
 839                                 break;
 840                         }
 841                 }
 842
 843                 /* If our parent died we'll end the session */
 844                 if (getppid() != parent_pid)
 845                         if ((pam_code = pam_close_session(handle, PAM_DATA_SILENT)) != PAM_SUCCESS)
 846                                 goto child_finish;
 847
 848                 r = 0;
 849
 850         child_finish:
 851                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 852                 _exit(r);
 853         }
 854
 855         /* If the child was forked off successfully it will do all the
 856          * cleanups, so forget about the handle here. */
 857         handle = NULL;
 858
 859         /* Unblock SIGTERM again in the parent */
 860         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 861                 goto fail;
 862
 863         /* We close the log explicitly here, since the PAM modules
 864          * might have opened it, but we don't want this fd around. */
 865         closelog();
 866
 867         *pam_env = e;
 868         e = NULL;
 869
 870         return 0;
 871
 872 fail:
 873         if (pam_code != PAM_SUCCESS)
 874                 err = -EPERM;  /* PAM errors do not map to errno */
 875         else
 876                 err = -errno;
 877
 878         if (handle) {
 879                 if (close_session)
 880                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
 881
 882                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 883         }
 884
 885         strv_free(e);
 886
 887         closelog();
 888
 889         if (pam_pid > 1) {
 890                 kill(pam_pid, SIGTERM);
 891                 kill(pam_pid, SIGCONT);
 892         }
 893
 894         return err;
 895 }
 896 #endif
 897
 898 static void rename_process_from_path(const char *path) {
 899         char process_name[11];
 900         const char *p;
 901         size_t l;
 902
 903         /* This resulting string must fit in 10 chars (i.e. the length
 904          * of "/sbin/init") to look pretty in /bin/ps */
 905
 906         p = path_get_file_name(path);
 907         if (isempty(p)) {
 908                 rename_process("(...)");
 909                 return;
 910         }
 911
 912         l = strlen(p);
 913         if (l > 8) {
 914                 /* The end of the process name is usually more
 915                  * interesting, since the first bit might just be
 916                  * "systemd-" */
 917                 p = p + l - 8;
 918                 l = 8;
 919         }
 920
 921         process_name[0] = '(';
 922         memcpy(process_name+1, p, l);
 923         process_name[1+l] = ')';
 924         process_name[1+l+1] = 0;
 925
 926         rename_process(process_name);
 927 }
 928
 929 static int apply_seccomp(uint32_t *syscall_filter) {
 930         static const struct sock_filter header[] = {
 931                 VALIDATE_ARCHITECTURE,
 932                 EXAMINE_SYSCALL
 933         };
 934         static const struct sock_filter footer[] = {
 935                 _KILL_PROCESS
 936         };
 937
 938         int i;
 939         unsigned n;
 940         struct sock_filter *f;
 941         struct sock_fprog prog;
 942
 943         assert(syscall_filter);
 944
 945         /* First: count the syscalls to check for */
 946         for (i = 0, n = 0; i < syscall_max(); i++)
 947                 if (syscall_filter[i >> 4] & (1 << (i & 31)))
 948                         n++;
 949
 950         /* Second: build the filter program from a header the syscall
 951          * matches and the footer */
 952         f = alloca(sizeof(struct sock_filter) * (ELEMENTSOF(header) + 2*n + ELEMENTSOF(footer)));
 953         memcpy(f, header, sizeof(header));
 954
 955         for (i = 0, n = 0; i < syscall_max(); i++)
 956                 if (syscall_filter[i >> 4] & (1 << (i & 31))) {
 957                         struct sock_filter item[] = {
 958                                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, INDEX_TO_SYSCALL(i), 0, 1),
 959                                 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 960                         };
 961
 962                         assert_cc(ELEMENTSOF(item) == 2);
 963
 964                         f[ELEMENTSOF(header) + 2*n]  = item[0];
 965                         f[ELEMENTSOF(header) + 2*n+1] = item[1];
 966
 967                         n++;
 968                 }
 969
 970         memcpy(f + (ELEMENTSOF(header) + 2*n), footer, sizeof(footer));
 971
 972         /* Third: install the filter */
 973         zero(prog);
 974         prog.len = ELEMENTSOF(header) + ELEMENTSOF(footer) + 2*n;
 975         prog.filter = f;
 976         if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0)
 977                 return -errno;
 978
 979         return 0;
 980 }
 981
 982 int exec_spawn(ExecCommand *command,
 983                char **argv,
 984                ExecContext *context,
 985                int fds[], unsigned n_fds,
 986                char **environment,
 987                bool apply_permissions,
 988                bool apply_chroot,
 989                bool apply_tty_stdin,
 990                bool confirm_spawn,
 991                CGroupBonding *cgroup_bondings,
 992                CGroupAttribute *cgroup_attributes,
 993                const char *cgroup_suffix,
 994                const char *unit_id,
 995                int idle_pipe[2],
 996                pid_t *ret) {
 997
 998         pid_t pid;
 999         int r;
1000         char *line;
1001         int socket_fd;
1002         char _cleanup_strv_free_ **files_env = NULL;
1003
1004         assert(command);
1005         assert(context);
1006         assert(ret);
1007         assert(fds || n_fds <= 0);
1008
1009         if (context->std_input == EXEC_INPUT_SOCKET ||
1010             context->std_output == EXEC_OUTPUT_SOCKET ||
1011             context->std_error == EXEC_OUTPUT_SOCKET) {
1012
1013                 if (n_fds != 1)
1014                         return -EINVAL;
1015
1016                 socket_fd = fds[0];
1017
1018                 fds = NULL;
1019                 n_fds = 0;
1020         } else
1021                 socket_fd = -1;
1022
1023         r = exec_context_load_environment(context, &files_env);
1024         if (r < 0) {
1025                 log_struct_unit(LOG_ERR,
1026                            unit_id,
1027                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1028                            "ERRNO=%d", -r,
1029                            NULL);
1030                 return r;
1031         }
1032
1033         if (!argv)
1034                 argv = command->argv;
1035
1036         line = exec_command_line(argv);
1037         if (!line)
1038                 return log_oom();
1039
1040         log_struct_unit(LOG_DEBUG,
1041                    unit_id,
1042                    "MESSAGE=About to execute %s", line,
1043                    NULL);
1044         free(line);
1045
1046         r = cgroup_bonding_realize_list(cgroup_bondings);
1047         if (r < 0)
1048                 return r;
1049
1050         cgroup_attribute_apply_list(cgroup_attributes, cgroup_bondings);
1051
1052         if (context->private_tmp && !context->tmp_dir && !context->var_tmp_dir) {
1053                 r = setup_tmpdirs(&context->tmp_dir, &context->var_tmp_dir);
1054                 if (r < 0)
1055                         return r;
1056         }
1057
1058         pid = fork();
1059         if (pid < 0)
1060                 return -errno;
1061
1062         if (pid == 0) {
1063                 int i, err;
1064                 sigset_t ss;
1065                 const char *username = NULL, *home = NULL;
1066                 uid_t uid = (uid_t) -1;
1067                 gid_t gid = (gid_t) -1;
1068                 char _cleanup_strv_free_ **our_env = NULL, **pam_env = NULL,
1069                         **final_env = NULL, **final_argv = NULL;
1070                 unsigned n_env = 0;
1071                 bool set_access = false;
1072
1073                 /* child */
1074
1075                 rename_process_from_path(command->path);
1076
1077                 /* We reset exactly these signals, since they are the
1078                  * only ones we set to SIG_IGN in the main daemon. All
1079                  * others we leave untouched because we set them to
1080                  * SIG_DFL or a valid handler initially, both of which
1081                  * will be demoted to SIG_DFL. */
1082                 default_signals(SIGNALS_CRASH_HANDLER,
1083                                 SIGNALS_IGNORE, -1);
1084
1085                 if (context->ignore_sigpipe)
1086                         ignore_signals(SIGPIPE, -1);
1087
1088                 assert_se(sigemptyset(&ss) == 0);
1089                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1090                         err = -errno;
1091                         r = EXIT_SIGNAL_MASK;
1092                         goto fail_child;
1093                 }
1094
1095                 if (idle_pipe) {
1096                         if (idle_pipe[1] >= 0)
1097                                 close_nointr_nofail(idle_pipe[1]);
1098                         if (idle_pipe[0] >= 0) {
1099                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1100                                 close_nointr_nofail(idle_pipe[0]);
1101                         }
1102                 }
1103
1104                 /* Close sockets very early to make sure we don't
1105                  * block init reexecution because it cannot bind its
1106                  * sockets */
1107                 log_forget_fds();
1108                 err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
1109                                            socket_fd >= 0 ? 1 : n_fds);
1110                 if (err < 0) {
1111                         r = EXIT_FDS;
1112                         goto fail_child;
1113                 }
1114
1115                 if (!context->same_pgrp)
1116                         if (setsid() < 0) {
1117                                 err = -errno;
1118                                 r = EXIT_SETSID;
1119                                 goto fail_child;
1120                         }
1121
1122                 if (context->tcpwrap_name) {
1123                         if (socket_fd >= 0)
1124                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1125                                         err = -EACCES;
1126                                         r = EXIT_TCPWRAP;
1127                                         goto fail_child;
1128                                 }
1129
1130                         for (i = 0; i < (int) n_fds; i++) {
1131                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1132                                         err = -EACCES;
1133                                         r = EXIT_TCPWRAP;
1134                                         goto fail_child;
1135                                 }
1136                         }
1137                 }
1138
1139                 exec_context_tty_reset(context);
1140
1141                 if (confirm_spawn) {
1142                         char response;
1143
1144                         err = ask_for_confirmation(&response, argv);
1145                         if (err == -ETIMEDOUT)
1146                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1147                         else if (err < 0)
1148                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1149                         else if (response == 's') {
1150                                 write_confirm_message("Skipping execution.\n");
1151                                 err = -ECANCELED;
1152                                 r = EXIT_CONFIRM;
1153                                 goto fail_child;
1154                         } else if (response == 'n') {
1155                                 write_confirm_message("Failing execution.\n");
1156                                 err = r = 0;
1157                                 goto fail_child;
1158                         }
1159                 }
1160
1161                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1162                  * must sure to drop O_NONBLOCK */
1163                 if (socket_fd >= 0)
1164                         fd_nonblock(socket_fd, false);
1165
1166                 err = setup_input(context, socket_fd, apply_tty_stdin);
1167                 if (err < 0) {
1168                         r = EXIT_STDIN;
1169                         goto fail_child;
1170                 }
1171
1172                 err = setup_output(context, STDOUT_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1173                 if (err < 0) {
1174                         r = EXIT_STDOUT;
1175                         goto fail_child;
1176                 }
1177
1178                 err = setup_output(context, STDERR_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1179                 if (err < 0) {
1180                         r = EXIT_STDERR;
1181                         goto fail_child;
1182                 }
1183
1184                 if (cgroup_bondings) {
1185                         err = cgroup_bonding_install_list(cgroup_bondings, 0, cgroup_suffix);
1186                         if (err < 0) {
1187                                 r = EXIT_CGROUP;
1188                                 goto fail_child;
1189                         }
1190                 }
1191
1192                 if (context->oom_score_adjust_set) {
1193                         char t[16];
1194
1195                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1196                         char_array_0(t);
1197
1198                         if (write_one_line_file("/proc/self/oom_score_adj", t) < 0) {
1199                                 err = -errno;
1200                                 r = EXIT_OOM_ADJUST;
1201                                 goto fail_child;
1202                         }
1203                 }
1204
1205                 if (context->nice_set)
1206                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1207                                 err = -errno;
1208                                 r = EXIT_NICE;
1209                                 goto fail_child;
1210                         }
1211
1212                 if (context->cpu_sched_set) {
1213                         struct sched_param param;
1214
1215                         zero(param);
1216                         param.sched_priority = context->cpu_sched_priority;
1217
1218                         if (sched_setscheduler(0, context->cpu_sched_policy |
1219                                                (context->cpu_sched_reset_on_fork ? SCHED_RESET_ON_FORK : 0), &param) < 0) {
1220                                 err = -errno;
1221                                 r = EXIT_SETSCHEDULER;
1222                                 goto fail_child;
1223                         }
1224                 }
1225
1226                 if (context->cpuset)
1227                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1228                                 err = -errno;
1229                                 r = EXIT_CPUAFFINITY;
1230                                 goto fail_child;
1231                         }
1232
1233                 if (context->ioprio_set)
1234                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1235                                 err = -errno;
1236                                 r = EXIT_IOPRIO;
1237                                 goto fail_child;
1238                         }
1239
1240                 if (context->timer_slack_nsec != (nsec_t) -1)
1241                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1242                                 err = -errno;
1243                                 r = EXIT_TIMERSLACK;
1244                                 goto fail_child;
1245                         }
1246
1247                 if (context->utmp_id)
1248                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1249
1250                 if (context->user) {
1251                         username = context->user;
1252                         err = get_user_creds(&username, &uid, &gid, &home, NULL);
1253                         if (err < 0) {
1254                                 r = EXIT_USER;
1255                                 goto fail_child;
1256                         }
1257
1258                         if (is_terminal_input(context->std_input)) {
1259                                 err = chown_terminal(STDIN_FILENO, uid);
1260                                 if (err < 0) {
1261                                         r = EXIT_STDIN;
1262                                         goto fail_child;
1263                                 }
1264                         }
1265
1266                         if (cgroup_bondings && context->control_group_modify) {
1267                                 err = cgroup_bonding_set_group_access_list(cgroup_bondings, 0755, uid, gid);
1268                                 if (err >= 0)
1269                                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, 0644, uid, gid, context->control_group_persistent);
1270                                 if (err < 0) {
1271                                         r = EXIT_CGROUP;
1272                                         goto fail_child;
1273                                 }
1274
1275                                 set_access = true;
1276                         }
1277                 }
1278
1279                 if (cgroup_bondings && !set_access && context->control_group_persistent >= 0)  {
1280                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, (mode_t) -1, (uid_t) -1, (uid_t) -1, context->control_group_persistent);
1281                         if (err < 0) {
1282                                 r = EXIT_CGROUP;
1283                                 goto fail_child;
1284                         }
1285                 }
1286
1287                 if (apply_permissions) {
1288                         err = enforce_groups(context, username, gid);
1289                         if (err < 0) {
1290                                 r = EXIT_GROUP;
1291                                 goto fail_child;
1292                         }
1293                 }
1294
1295                 umask(context->umask);
1296
1297 #ifdef HAVE_PAM
1298                 if (apply_permissions && context->pam_name && username) {
1299                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1300                         if (err < 0) {
1301                                 r = EXIT_PAM;
1302                                 goto fail_child;
1303                         }
1304                 }
1305 #endif
1306                 if (context->private_network) {
1307                         if (unshare(CLONE_NEWNET) < 0) {
1308                                 err = -errno;
1309                                 r = EXIT_NETWORK;
1310                                 goto fail_child;
1311                         }
1312
1313                         loopback_setup();
1314                 }
1315
1316                 if (strv_length(context->read_write_dirs) > 0 ||
1317                     strv_length(context->read_only_dirs) > 0 ||
1318                     strv_length(context->inaccessible_dirs) > 0 ||
1319                     context->mount_flags != 0 ||
1320                     context->private_tmp) {
1321                         err = setup_namespace(context->read_write_dirs,
1322                                               context->read_only_dirs,
1323                                               context->inaccessible_dirs,
1324                                               context->tmp_dir,
1325                                               context->var_tmp_dir,
1326                                               context->private_tmp,
1327                                               context->mount_flags);
1328                         if (err < 0) {
1329                                 r = EXIT_NAMESPACE;
1330                                 goto fail_child;
1331                         }
1332                 }
1333
1334                 if (apply_chroot) {
1335                         if (context->root_directory)
1336                                 if (chroot(context->root_directory) < 0) {
1337                                         err = -errno;
1338                                         r = EXIT_CHROOT;
1339                                         goto fail_child;
1340                                 }
1341
1342                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1343                                 err = -errno;
1344                                 r = EXIT_CHDIR;
1345                                 goto fail_child;
1346                         }
1347                 } else {
1348                         char _cleanup_free_ *d = NULL;
1349
1350                         if (asprintf(&d, "%s/%s",
1351                                      context->root_directory ? context->root_directory : "",
1352                                      context->working_directory ? context->working_directory : "") < 0) {
1353                                 err = -ENOMEM;
1354                                 r = EXIT_MEMORY;
1355                                 goto fail_child;
1356                         }
1357
1358                         if (chdir(d) < 0) {
1359                                 err = -errno;
1360                                 r = EXIT_CHDIR;
1361                                 goto fail_child;
1362                         }
1363                 }
1364
1365                 /* We repeat the fd closing here, to make sure that
1366                  * nothing is leaked from the PAM modules */
1367                 err = close_all_fds(fds, n_fds);
1368                 if (err >= 0)
1369                         err = shift_fds(fds, n_fds);
1370                 if (err >= 0)
1371                         err = flags_fds(fds, n_fds, context->non_blocking);
1372                 if (err < 0) {
1373                         r = EXIT_FDS;
1374                         goto fail_child;
1375                 }
1376
1377                 if (apply_permissions) {
1378
1379                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1380                                 if (!context->rlimit[i])
1381                                         continue;
1382
1383                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1384                                         err = -errno;
1385                                         r = EXIT_LIMITS;
1386                                         goto fail_child;
1387                                 }
1388                         }
1389
1390                         if (context->capability_bounding_set_drop) {
1391                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1392                                 if (err < 0) {
1393                                         r = EXIT_CAPABILITIES;
1394                                         goto fail_child;
1395                                 }
1396                         }
1397
1398                         if (context->user) {
1399                                 err = enforce_user(context, uid);
1400                                 if (err < 0) {
1401                                         r = EXIT_USER;
1402                                         goto fail_child;
1403                                 }
1404                         }
1405
1406                         /* PR_GET_SECUREBITS is not privileged, while
1407                          * PR_SET_SECUREBITS is. So to suppress
1408                          * potential EPERMs we'll try not to call
1409                          * PR_SET_SECUREBITS unless necessary. */
1410                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1411                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1412                                         err = -errno;
1413                                         r = EXIT_SECUREBITS;
1414                                         goto fail_child;
1415                                 }
1416
1417                         if (context->capabilities)
1418                                 if (cap_set_proc(context->capabilities) < 0) {
1419                                         err = -errno;
1420                                         r = EXIT_CAPABILITIES;
1421                                         goto fail_child;
1422                                 }
1423
1424                         if (context->no_new_privileges)
1425                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1426                                         err = -errno;
1427                                         r = EXIT_NO_NEW_PRIVILEGES;
1428                                         goto fail_child;
1429                                 }
1430
1431                         if (context->syscall_filter) {
1432                                 err = apply_seccomp(context->syscall_filter);
1433                                 if (err < 0) {
1434                                         r = EXIT_SECCOMP;
1435                                         goto fail_child;
1436                                 }
1437                         }
1438                 }
1439
1440                 if (!(our_env = new0(char*, 7))) {
1441                         err = -ENOMEM;
1442                         r = EXIT_MEMORY;
1443                         goto fail_child;
1444                 }
1445
1446                 if (n_fds > 0)
1447                         if (asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1448                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0) {
1449                                 err = -ENOMEM;
1450                                 r = EXIT_MEMORY;
1451                                 goto fail_child;
1452                         }
1453
1454                 if (home)
1455                         if (asprintf(our_env + n_env++, "HOME=%s", home) < 0) {
1456                                 err = -ENOMEM;
1457                                 r = EXIT_MEMORY;
1458                                 goto fail_child;
1459                         }
1460
1461                 if (username)
1462                         if (asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1463                             asprintf(our_env + n_env++, "USER=%s", username) < 0) {
1464                                 err = -ENOMEM;
1465                                 r = EXIT_MEMORY;
1466                                 goto fail_child;
1467                         }
1468
1469                 if (is_terminal_input(context->std_input) ||
1470                     context->std_output == EXEC_OUTPUT_TTY ||
1471                     context->std_error == EXEC_OUTPUT_TTY)
1472                         if (!(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))) {
1473                                 err = -ENOMEM;
1474                                 r = EXIT_MEMORY;
1475                                 goto fail_child;
1476                         }
1477
1478                 assert(n_env <= 7);
1479
1480                 if (!(final_env = strv_env_merge(
1481                                       5,
1482                                       environment,
1483                                       our_env,
1484                                       context->environment,
1485                                       files_env,
1486                                       pam_env,
1487                                       NULL))) {
1488                         err = -ENOMEM;
1489                         r = EXIT_MEMORY;
1490                         goto fail_child;
1491                 }
1492
1493                 if (!(final_argv = replace_env_argv(argv, final_env))) {
1494                         err = -ENOMEM;
1495                         r = EXIT_MEMORY;
1496                         goto fail_child;
1497                 }
1498
1499                 final_env = strv_env_clean(final_env);
1500
1501                 execve(command->path, final_argv, final_env);
1502                 err = -errno;
1503                 r = EXIT_EXEC;
1504
1505         fail_child:
1506                 if (r != 0) {
1507                         log_open();
1508                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1509                                    "EXECUTABLE=%s", command->path,
1510                                    "MESSAGE=Failed at step %s spawning %s: %s",
1511                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1512                                           command->path, strerror(-err),
1513                                    "ERRNO=%d", -err,
1514                                    NULL);
1515                         log_close();
1516                 }
1517
1518                 _exit(r);
1519         }
1520
1521         log_struct_unit(LOG_DEBUG,
1522                    unit_id,
1523                    "MESSAGE=Forked %s as %lu",
1524                           command->path, (unsigned long) pid,
1525                    NULL);
1526
1527         /* We add the new process to the cgroup both in the child (so
1528          * that we can be sure that no user code is ever executed
1529          * outside of the cgroup) and in the parent (so that we can be
1530          * sure that when we kill the cgroup the process will be
1531          * killed too). */
1532         if (cgroup_bondings)
1533                 cgroup_bonding_install_list(cgroup_bondings, pid, cgroup_suffix);
1534
1535         exec_status_start(&command->exec_status, pid);
1536
1537         *ret = pid;
1538         return 0;
1539 }
1540
1541 void exec_context_init(ExecContext *c) {
1542         assert(c);
1543
1544         c->umask = 0022;
1545         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1546         c->cpu_sched_policy = SCHED_OTHER;
1547         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1548         c->syslog_level_prefix = true;
1549         c->control_group_persistent = -1;
1550         c->ignore_sigpipe = true;
1551         c->timer_slack_nsec = (nsec_t) -1;
1552 }
1553
1554 void exec_context_tmp_dirs_done(ExecContext *c) {
1555         char* dirs[] = {c->tmp_dir ? c->tmp_dir : c->var_tmp_dir,
1556                         c->tmp_dir ? c->var_tmp_dir : NULL,
1557                         NULL};
1558         char **dirp;
1559
1560         for(dirp = dirs; *dirp; dirp++) {
1561                 char *dir;
1562                 int r;
1563
1564                 r = rm_rf_dangerous(*dirp, false, true, false);
1565                 dir = dirname(*dirp);
1566                 if (r < 0)
1567                         log_warning("Failed to remove content of temporary directory %s: %s",
1568                                     dir, strerror(-r));
1569                 else {
1570                         r = rmdir(dir);
1571                         if (r < 0)
1572                                 log_warning("Failed to remove  temporary directory %s: %s",
1573                                             dir, strerror(-r));
1574                 }
1575
1576                 free(*dirp);
1577         }
1578
1579         c->tmp_dir = c->var_tmp_dir = NULL;
1580 }
1581
1582 void exec_context_done(ExecContext *c, bool reloading_or_reexecuting) {
1583         unsigned l;
1584
1585         assert(c);
1586
1587         strv_free(c->environment);
1588         c->environment = NULL;
1589
1590         strv_free(c->environment_files);
1591         c->environment_files = NULL;
1592
1593         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1594                 free(c->rlimit[l]);
1595                 c->rlimit[l] = NULL;
1596         }
1597
1598         free(c->working_directory);
1599         c->working_directory = NULL;
1600         free(c->root_directory);
1601         c->root_directory = NULL;
1602
1603         free(c->tty_path);
1604         c->tty_path = NULL;
1605
1606         free(c->tcpwrap_name);
1607         c->tcpwrap_name = NULL;
1608
1609         free(c->syslog_identifier);
1610         c->syslog_identifier = NULL;
1611
1612         free(c->user);
1613         c->user = NULL;
1614
1615         free(c->group);
1616         c->group = NULL;
1617
1618         strv_free(c->supplementary_groups);
1619         c->supplementary_groups = NULL;
1620
1621         free(c->pam_name);
1622         c->pam_name = NULL;
1623
1624         if (c->capabilities) {
1625                 cap_free(c->capabilities);
1626                 c->capabilities = NULL;
1627         }
1628
1629         strv_free(c->read_only_dirs);
1630         c->read_only_dirs = NULL;
1631
1632         strv_free(c->read_write_dirs);
1633         c->read_write_dirs = NULL;
1634
1635         strv_free(c->inaccessible_dirs);
1636         c->inaccessible_dirs = NULL;
1637
1638         if (c->cpuset)
1639                 CPU_FREE(c->cpuset);
1640
1641         free(c->utmp_id);
1642         c->utmp_id = NULL;
1643
1644         free(c->syscall_filter);
1645         c->syscall_filter = NULL;
1646
1647         if (!reloading_or_reexecuting)
1648                 exec_context_tmp_dirs_done(c);
1649 }
1650
1651 void exec_command_done(ExecCommand *c) {
1652         assert(c);
1653
1654         free(c->path);
1655         c->path = NULL;
1656
1657         strv_free(c->argv);
1658         c->argv = NULL;
1659 }
1660
1661 void exec_command_done_array(ExecCommand *c, unsigned n) {
1662         unsigned i;
1663
1664         for (i = 0; i < n; i++)
1665                 exec_command_done(c+i);
1666 }
1667
1668 void exec_command_free_list(ExecCommand *c) {
1669         ExecCommand *i;
1670
1671         while ((i = c)) {
1672                 LIST_REMOVE(ExecCommand, command, c, i);
1673                 exec_command_done(i);
1674                 free(i);
1675         }
1676 }
1677
1678 void exec_command_free_array(ExecCommand **c, unsigned n) {
1679         unsigned i;
1680
1681         for (i = 0; i < n; i++) {
1682                 exec_command_free_list(c[i]);
1683                 c[i] = NULL;
1684         }
1685 }
1686
1687 int exec_context_load_environment(const ExecContext *c, char ***l) {
1688         char **i, **r = NULL;
1689
1690         assert(c);
1691         assert(l);
1692
1693         STRV_FOREACH(i, c->environment_files) {
1694                 char *fn;
1695                 int k;
1696                 bool ignore = false;
1697                 char **p;
1698                 glob_t pglob;
1699                 int count, n;
1700
1701                 fn = *i;
1702
1703                 if (fn[0] == '-') {
1704                         ignore = true;
1705                         fn ++;
1706                 }
1707
1708                 if (!path_is_absolute(fn)) {
1709
1710                         if (ignore)
1711                                 continue;
1712
1713                         strv_free(r);
1714                         return -EINVAL;
1715                 }
1716
1717                 /* Filename supports globbing, take all matching files */
1718                 zero(pglob);
1719                 errno = 0;
1720                 if (glob(fn, 0, NULL, &pglob) != 0) {
1721                         globfree(&pglob);
1722                         if (ignore)
1723                                 continue;
1724
1725                         strv_free(r);
1726                         return errno ? -errno : -EINVAL;
1727                 }
1728                 count = pglob.gl_pathc;
1729                 if (count == 0) {
1730                         globfree(&pglob);
1731                         if (ignore)
1732                                 continue;
1733
1734                         strv_free(r);
1735                         return -EINVAL;
1736                 }
1737                 for (n = 0; n < count; n++) {
1738                         k = load_env_file(pglob.gl_pathv[n], &p);
1739                         if (k < 0) {
1740                                 if (ignore)
1741                                         continue;
1742
1743                                 strv_free(r);
1744                                 globfree(&pglob);
1745                                 return k;
1746                          }
1747
1748                         if (r == NULL)
1749                                 r = p;
1750                         else {
1751                                 char **m;
1752
1753                                 m = strv_env_merge(2, r, p);
1754                                 strv_free(r);
1755                                 strv_free(p);
1756
1757                                 if (!m) {
1758                                         globfree(&pglob);
1759                                         return -ENOMEM;
1760                                 }
1761
1762                                 r = m;
1763                         }
1764                 }
1765                 globfree(&pglob);
1766         }
1767
1768         *l = r;
1769
1770         return 0;
1771 }
1772
1773 static bool tty_may_match_dev_console(const char *tty) {
1774         char *active = NULL, *console;
1775         bool b;
1776
1777         if (startswith(tty, "/dev/"))
1778                 tty += 5;
1779
1780         /* trivial identity? */
1781         if (streq(tty, "console"))
1782                 return true;
1783
1784         console = resolve_dev_console(&active);
1785         /* if we could not resolve, assume it may */
1786         if (!console)
1787                 return true;
1788
1789         /* "tty0" means the active VC, so it may be the same sometimes */
1790         b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
1791         free(active);
1792
1793         return b;
1794 }
1795
1796 bool exec_context_may_touch_console(ExecContext *ec) {
1797         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
1798                 is_terminal_input(ec->std_input) ||
1799                 is_terminal_output(ec->std_output) ||
1800                 is_terminal_output(ec->std_error)) &&
1801                tty_may_match_dev_console(tty_path(ec));
1802 }
1803
1804 static void strv_fprintf(FILE *f, char **l) {
1805         char **g;
1806
1807         assert(f);
1808
1809         STRV_FOREACH(g, l)
1810                 fprintf(f, " %s", *g);
1811 }
1812
1813 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1814         char ** e;
1815         unsigned i;
1816
1817         assert(c);
1818         assert(f);
1819
1820         if (!prefix)
1821                 prefix = "";
1822
1823         fprintf(f,
1824                 "%sUMask: %04o\n"
1825                 "%sWorkingDirectory: %s\n"
1826                 "%sRootDirectory: %s\n"
1827                 "%sNonBlocking: %s\n"
1828                 "%sPrivateTmp: %s\n"
1829                 "%sControlGroupModify: %s\n"
1830                 "%sControlGroupPersistent: %s\n"
1831                 "%sPrivateNetwork: %s\n"
1832                 "%sIgnoreSIGPIPE: %s\n",
1833                 prefix, c->umask,
1834                 prefix, c->working_directory ? c->working_directory : "/",
1835                 prefix, c->root_directory ? c->root_directory : "/",
1836                 prefix, yes_no(c->non_blocking),
1837                 prefix, yes_no(c->private_tmp),
1838                 prefix, yes_no(c->control_group_modify),
1839                 prefix, yes_no(c->control_group_persistent),
1840                 prefix, yes_no(c->private_network),
1841                 prefix, yes_no(c->ignore_sigpipe));
1842
1843         STRV_FOREACH(e, c->environment)
1844                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1845
1846         STRV_FOREACH(e, c->environment_files)
1847                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1848
1849         if (c->tcpwrap_name)
1850                 fprintf(f,
1851                         "%sTCPWrapName: %s\n",
1852                         prefix, c->tcpwrap_name);
1853
1854         if (c->nice_set)
1855                 fprintf(f,
1856                         "%sNice: %i\n",
1857                         prefix, c->nice);
1858
1859         if (c->oom_score_adjust_set)
1860                 fprintf(f,
1861                         "%sOOMScoreAdjust: %i\n",
1862                         prefix, c->oom_score_adjust);
1863
1864         for (i = 0; i < RLIM_NLIMITS; i++)
1865                 if (c->rlimit[i])
1866                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1867
1868         if (c->ioprio_set) {
1869                 char *class_str;
1870                 int r;
1871
1872                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
1873                 if (r < 0)
1874                         class_str = NULL;
1875                 fprintf(f,
1876                         "%sIOSchedulingClass: %s\n"
1877                         "%sIOPriority: %i\n",
1878                         prefix, strna(class_str),
1879                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1880                 free(class_str);
1881         }
1882
1883         if (c->cpu_sched_set) {
1884                 char *policy_str;
1885                 int r;
1886
1887                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
1888                 if (r < 0)
1889                         policy_str = NULL;
1890                 fprintf(f,
1891                         "%sCPUSchedulingPolicy: %s\n"
1892                         "%sCPUSchedulingPriority: %i\n"
1893                         "%sCPUSchedulingResetOnFork: %s\n",
1894                         prefix, strna(policy_str),
1895                         prefix, c->cpu_sched_priority,
1896                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1897                 free(policy_str);
1898         }
1899
1900         if (c->cpuset) {
1901                 fprintf(f, "%sCPUAffinity:", prefix);
1902                 for (i = 0; i < c->cpuset_ncpus; i++)
1903                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1904                                 fprintf(f, " %i", i);
1905                 fputs("\n", f);
1906         }
1907
1908         if (c->timer_slack_nsec != (nsec_t) -1)
1909                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, (unsigned long)c->timer_slack_nsec);
1910
1911         fprintf(f,
1912                 "%sStandardInput: %s\n"
1913                 "%sStandardOutput: %s\n"
1914                 "%sStandardError: %s\n",
1915                 prefix, exec_input_to_string(c->std_input),
1916                 prefix, exec_output_to_string(c->std_output),
1917                 prefix, exec_output_to_string(c->std_error));
1918
1919         if (c->tty_path)
1920                 fprintf(f,
1921                         "%sTTYPath: %s\n"
1922                         "%sTTYReset: %s\n"
1923                         "%sTTYVHangup: %s\n"
1924                         "%sTTYVTDisallocate: %s\n",
1925                         prefix, c->tty_path,
1926                         prefix, yes_no(c->tty_reset),
1927                         prefix, yes_no(c->tty_vhangup),
1928                         prefix, yes_no(c->tty_vt_disallocate));
1929
1930         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1931             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1932             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1933             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
1934                 char *fac_str, *lvl_str;
1935                 int r;
1936
1937                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
1938                 if (r < 0)
1939                         fac_str = NULL;
1940
1941                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
1942                 if (r < 0)
1943                         lvl_str = NULL;
1944
1945                 fprintf(f,
1946                         "%sSyslogFacility: %s\n"
1947                         "%sSyslogLevel: %s\n",
1948                         prefix, strna(fac_str),
1949                         prefix, strna(lvl_str));
1950                 free(lvl_str);
1951                 free(fac_str);
1952         }
1953
1954         if (c->capabilities) {
1955                 char *t;
1956                 if ((t = cap_to_text(c->capabilities, NULL))) {
1957                         fprintf(f, "%sCapabilities: %s\n",
1958                                 prefix, t);
1959                         cap_free(t);
1960                 }
1961         }
1962
1963         if (c->secure_bits)
1964                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1965                         prefix,
1966                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
1967                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1968                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1969                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1970                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
1971                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1972
1973         if (c->capability_bounding_set_drop) {
1974                 unsigned long l;
1975                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1976
1977                 for (l = 0; l <= cap_last_cap(); l++)
1978                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1979                                 char *t;
1980
1981                                 if ((t = cap_to_name(l))) {
1982                                         fprintf(f, " %s", t);
1983                                         cap_free(t);
1984                                 }
1985                         }
1986
1987                 fputs("\n", f);
1988         }
1989
1990         if (c->user)
1991                 fprintf(f, "%sUser: %s\n", prefix, c->user);
1992         if (c->group)
1993                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
1994
1995         if (strv_length(c->supplementary_groups) > 0) {
1996                 fprintf(f, "%sSupplementaryGroups:", prefix);
1997                 strv_fprintf(f, c->supplementary_groups);
1998                 fputs("\n", f);
1999         }
2000
2001         if (c->pam_name)
2002                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
2003
2004         if (strv_length(c->read_write_dirs) > 0) {
2005                 fprintf(f, "%sReadWriteDirs:", prefix);
2006                 strv_fprintf(f, c->read_write_dirs);
2007                 fputs("\n", f);
2008         }
2009
2010         if (strv_length(c->read_only_dirs) > 0) {
2011                 fprintf(f, "%sReadOnlyDirs:", prefix);
2012                 strv_fprintf(f, c->read_only_dirs);
2013                 fputs("\n", f);
2014         }
2015
2016         if (strv_length(c->inaccessible_dirs) > 0) {
2017                 fprintf(f, "%sInaccessibleDirs:", prefix);
2018                 strv_fprintf(f, c->inaccessible_dirs);
2019                 fputs("\n", f);
2020         }
2021
2022         if (c->utmp_id)
2023                 fprintf(f,
2024                         "%sUtmpIdentifier: %s\n",
2025                         prefix, c->utmp_id);
2026 }
2027
2028 void exec_status_start(ExecStatus *s, pid_t pid) {
2029         assert(s);
2030
2031         zero(*s);
2032         s->pid = pid;
2033         dual_timestamp_get(&s->start_timestamp);
2034 }
2035
2036 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2037         assert(s);
2038
2039         if (s->pid && s->pid != pid)
2040                 zero(*s);
2041
2042         s->pid = pid;
2043         dual_timestamp_get(&s->exit_timestamp);
2044
2045         s->code = code;
2046         s->status = status;
2047
2048         if (context) {
2049                 if (context->utmp_id)
2050                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2051
2052                 exec_context_tty_reset(context);
2053         }
2054 }
2055
2056 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2057         char buf[FORMAT_TIMESTAMP_MAX];
2058
2059         assert(s);
2060         assert(f);
2061
2062         if (!prefix)
2063                 prefix = "";
2064
2065         if (s->pid <= 0)
2066                 return;
2067
2068         fprintf(f,
2069                 "%sPID: %lu\n",
2070                 prefix, (unsigned long) s->pid);
2071
2072         if (s->start_timestamp.realtime > 0)
2073                 fprintf(f,
2074                         "%sStart Timestamp: %s\n",
2075                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2076
2077         if (s->exit_timestamp.realtime > 0)
2078                 fprintf(f,
2079                         "%sExit Timestamp: %s\n"
2080                         "%sExit Code: %s\n"
2081                         "%sExit Status: %i\n",
2082                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2083                         prefix, sigchld_code_to_string(s->code),
2084                         prefix, s->status);
2085 }
2086
2087 char *exec_command_line(char **argv) {
2088         size_t k;
2089         char *n, *p, **a;
2090         bool first = true;
2091
2092         assert(argv);
2093
2094         k = 1;
2095         STRV_FOREACH(a, argv)
2096                 k += strlen(*a)+3;
2097
2098         if (!(n = new(char, k)))
2099                 return NULL;
2100
2101         p = n;
2102         STRV_FOREACH(a, argv) {
2103
2104                 if (!first)
2105                         *(p++) = ' ';
2106                 else
2107                         first = false;
2108
2109                 if (strpbrk(*a, WHITESPACE)) {
2110                         *(p++) = '\'';
2111                         p = stpcpy(p, *a);
2112                         *(p++) = '\'';
2113                 } else
2114                         p = stpcpy(p, *a);
2115
2116         }
2117
2118         *p = 0;
2119
2120         /* FIXME: this doesn't really handle arguments that have
2121          * spaces and ticks in them */
2122
2123         return n;
2124 }
2125
2126 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2127         char *p2;
2128         const char *prefix2;
2129
2130         char *cmd;
2131
2132         assert(c);
2133         assert(f);
2134
2135         if (!prefix)
2136                 prefix = "";
2137         p2 = strappend(prefix, "\t");
2138         prefix2 = p2 ? p2 : prefix;
2139
2140         cmd = exec_command_line(c->argv);
2141
2142         fprintf(f,
2143                 "%sCommand Line: %s\n",
2144                 prefix, cmd ? cmd : strerror(ENOMEM));
2145
2146         free(cmd);
2147
2148         exec_status_dump(&c->exec_status, f, prefix2);
2149
2150         free(p2);
2151 }
2152
2153 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2154         assert(f);
2155
2156         if (!prefix)
2157                 prefix = "";
2158
2159         LIST_FOREACH(command, c, c)
2160                 exec_command_dump(c, f, prefix);
2161 }
2162
2163 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2164         ExecCommand *end;
2165
2166         assert(l);
2167         assert(e);
2168
2169         if (*l) {
2170                 /* It's kind of important, that we keep the order here */
2171                 LIST_FIND_TAIL(ExecCommand, command, *l, end);
2172                 LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
2173         } else
2174               *l = e;
2175 }
2176
2177 int exec_command_set(ExecCommand *c, const char *path, ...) {
2178         va_list ap;
2179         char **l, *p;
2180
2181         assert(c);
2182         assert(path);
2183
2184         va_start(ap, path);
2185         l = strv_new_ap(path, ap);
2186         va_end(ap);
2187
2188         if (!l)
2189                 return -ENOMEM;
2190
2191         if (!(p = strdup(path))) {
2192                 strv_free(l);
2193                 return -ENOMEM;
2194         }
2195
2196         free(c->path);
2197         c->path = p;
2198
2199         strv_free(c->argv);
2200         c->argv = l;
2201
2202         return 0;
2203 }
2204
2205 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2206         [EXEC_INPUT_NULL] = "null",
2207         [EXEC_INPUT_TTY] = "tty",
2208         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2209         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2210         [EXEC_INPUT_SOCKET] = "socket"
2211 };
2212
2213 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2214
2215 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2216         [EXEC_OUTPUT_INHERIT] = "inherit",
2217         [EXEC_OUTPUT_NULL] = "null",
2218         [EXEC_OUTPUT_TTY] = "tty",
2219         [EXEC_OUTPUT_SYSLOG] = "syslog",
2220         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2221         [EXEC_OUTPUT_KMSG] = "kmsg",
2222         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2223         [EXEC_OUTPUT_JOURNAL] = "journal",
2224         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2225         [EXEC_OUTPUT_SOCKET] = "socket"
2226 };
2227
2228 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);