src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41
  42 #ifdef HAVE_PAM
  43 #include <security/pam_appl.h>
  44 #endif
  45
  46 #include "execute.h"
  47 #include "strv.h"
  48 #include "macro.h"
  49 #include "capability.h"
  50 #include "util.h"
  51 #include "log.h"
  52 #include "ioprio.h"
  53 #include "securebits.h"
  54 #include "cgroup.h"
  55 #include "namespace.h"
  56 #include "tcpwrap.h"
  57 #include "exit-status.h"
  58 #include "missing.h"
  59 #include "utmp-wtmp.h"
  60 #include "def.h"
  61 #include "loopback-setup.h"
  62 #include "path-util.h"
  63
  64 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  65
  66 /* This assumes there is a 'tty' group */
  67 #define TTY_MODE 0620
  68
  69 static int shift_fds(int fds[], unsigned n_fds) {
  70         int start, restart_from;
  71
  72         if (n_fds <= 0)
  73                 return 0;
  74
  75         /* Modifies the fds array! (sorts it) */
  76
  77         assert(fds);
  78
  79         start = 0;
  80         for (;;) {
  81                 int i;
  82
  83                 restart_from = -1;
  84
  85                 for (i = start; i < (int) n_fds; i++) {
  86                         int nfd;
  87
  88                         /* Already at right index? */
  89                         if (fds[i] == i+3)
  90                                 continue;
  91
  92                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
  93                                 return -errno;
  94
  95                         close_nointr_nofail(fds[i]);
  96                         fds[i] = nfd;
  97
  98                         /* Hmm, the fd we wanted isn't free? Then
  99                          * let's remember that and try again from here*/
 100                         if (nfd != i+3 && restart_from < 0)
 101                                 restart_from = i;
 102                 }
 103
 104                 if (restart_from < 0)
 105                         break;
 106
 107                 start = restart_from;
 108         }
 109
 110         return 0;
 111 }
 112
 113 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 114         unsigned i;
 115         int r;
 116
 117         if (n_fds <= 0)
 118                 return 0;
 119
 120         assert(fds);
 121
 122         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 123
 124         for (i = 0; i < n_fds; i++) {
 125
 126                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 127                         return r;
 128
 129                 /* We unconditionally drop FD_CLOEXEC from the fds,
 130                  * since after all we want to pass these fds to our
 131                  * children */
 132
 133                 if ((r = fd_cloexec(fds[i], false)) < 0)
 134                         return r;
 135         }
 136
 137         return 0;
 138 }
 139
 140 static const char *tty_path(const ExecContext *context) {
 141         assert(context);
 142
 143         if (context->tty_path)
 144                 return context->tty_path;
 145
 146         return "/dev/console";
 147 }
 148
 149 void exec_context_tty_reset(const ExecContext *context) {
 150         assert(context);
 151
 152         if (context->tty_vhangup)
 153                 terminal_vhangup(tty_path(context));
 154
 155         if (context->tty_reset)
 156                 reset_terminal(tty_path(context));
 157
 158         if (context->tty_vt_disallocate && context->tty_path)
 159                 vt_disallocate(context->tty_path);
 160 }
 161
 162 static int open_null_as(int flags, int nfd) {
 163         int fd, r;
 164
 165         assert(nfd >= 0);
 166
 167         if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
 168                 return -errno;
 169
 170         if (fd != nfd) {
 171                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 172                 close_nointr_nofail(fd);
 173         } else
 174                 r = nfd;
 175
 176         return r;
 177 }
 178
 179 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 180         int fd, r;
 181         union sockaddr_union sa;
 182
 183         assert(context);
 184         assert(output < _EXEC_OUTPUT_MAX);
 185         assert(ident);
 186         assert(nfd >= 0);
 187
 188         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 189         if (fd < 0)
 190                 return -errno;
 191
 192         zero(sa);
 193         sa.un.sun_family = AF_UNIX;
 194         strncpy(sa.un.sun_path, "/run/systemd/journal/stdout", sizeof(sa.un.sun_path));
 195
 196         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 197         if (r < 0) {
 198                 close_nointr_nofail(fd);
 199                 return -errno;
 200         }
 201
 202         if (shutdown(fd, SHUT_RD) < 0) {
 203                 close_nointr_nofail(fd);
 204                 return -errno;
 205         }
 206
 207         dprintf(fd,
 208                 "%s\n"
 209                 "%s\n"
 210                 "%i\n"
 211                 "%i\n"
 212                 "%i\n"
 213                 "%i\n"
 214                 "%i\n",
 215                 context->syslog_identifier ? context->syslog_identifier : ident,
 216                 unit_id,
 217                 context->syslog_priority,
 218                 !!context->syslog_level_prefix,
 219                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 220                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 221                 output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || output == EXEC_OUTPUT_KMSG_AND_CONSOLE || output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 222
 223         if (fd != nfd) {
 224                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 225                 close_nointr_nofail(fd);
 226         } else
 227                 r = nfd;
 228
 229         return r;
 230 }
 231 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 232         int fd, r;
 233
 234         assert(path);
 235         assert(nfd >= 0);
 236
 237         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 238                 return fd;
 239
 240         if (fd != nfd) {
 241                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 242                 close_nointr_nofail(fd);
 243         } else
 244                 r = nfd;
 245
 246         return r;
 247 }
 248
 249 static bool is_terminal_input(ExecInput i) {
 250         return
 251                 i == EXEC_INPUT_TTY ||
 252                 i == EXEC_INPUT_TTY_FORCE ||
 253                 i == EXEC_INPUT_TTY_FAIL;
 254 }
 255
 256 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 257
 258         if (is_terminal_input(std_input) && !apply_tty_stdin)
 259                 return EXEC_INPUT_NULL;
 260
 261         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 262                 return EXEC_INPUT_NULL;
 263
 264         return std_input;
 265 }
 266
 267 static int fixup_output(ExecOutput std_output, int socket_fd) {
 268
 269         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 270                 return EXEC_OUTPUT_INHERIT;
 271
 272         return std_output;
 273 }
 274
 275 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 276         ExecInput i;
 277
 278         assert(context);
 279
 280         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 281
 282         switch (i) {
 283
 284         case EXEC_INPUT_NULL:
 285                 return open_null_as(O_RDONLY, STDIN_FILENO);
 286
 287         case EXEC_INPUT_TTY:
 288         case EXEC_INPUT_TTY_FORCE:
 289         case EXEC_INPUT_TTY_FAIL: {
 290                 int fd, r;
 291
 292                 if ((fd = acquire_terminal(
 293                                      tty_path(context),
 294                                      i == EXEC_INPUT_TTY_FAIL,
 295                                      i == EXEC_INPUT_TTY_FORCE,
 296                                      false)) < 0)
 297                         return fd;
 298
 299                 if (fd != STDIN_FILENO) {
 300                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 301                         close_nointr_nofail(fd);
 302                 } else
 303                         r = STDIN_FILENO;
 304
 305                 return r;
 306         }
 307
 308         case EXEC_INPUT_SOCKET:
 309                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 310
 311         default:
 312                 assert_not_reached("Unknown input type");
 313         }
 314 }
 315
 316 static int setup_output(const ExecContext *context, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 317         ExecOutput o;
 318         ExecInput i;
 319
 320         assert(context);
 321         assert(ident);
 322
 323         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 324         o = fixup_output(context->std_output, socket_fd);
 325
 326         /* This expects the input is already set up */
 327
 328         switch (o) {
 329
 330         case EXEC_OUTPUT_INHERIT:
 331
 332                 /* If input got downgraded, inherit the original value */
 333                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 334                         return open_terminal_as(tty_path(context), O_WRONLY, STDOUT_FILENO);
 335
 336                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 337                 if (i != EXEC_INPUT_NULL)
 338                         return dup2(STDIN_FILENO, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 339
 340                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 341                 if (getppid() != 1)
 342                         return STDOUT_FILENO;
 343
 344                 /* We need to open /dev/null here anew, to get the
 345                  * right access mode. So we fall through */
 346
 347         case EXEC_OUTPUT_NULL:
 348                 return open_null_as(O_WRONLY, STDOUT_FILENO);
 349
 350         case EXEC_OUTPUT_TTY:
 351                 if (is_terminal_input(i))
 352                         return dup2(STDIN_FILENO, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 353
 354                 /* We don't reset the terminal if this is just about output */
 355                 return open_terminal_as(tty_path(context), O_WRONLY, STDOUT_FILENO);
 356
 357         case EXEC_OUTPUT_SYSLOG:
 358         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 359         case EXEC_OUTPUT_KMSG:
 360         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 361         case EXEC_OUTPUT_JOURNAL:
 362         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 363                 return connect_logger_as(context, o, ident, unit_id, STDOUT_FILENO);
 364
 365         case EXEC_OUTPUT_SOCKET:
 366                 assert(socket_fd >= 0);
 367                 return dup2(socket_fd, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 368
 369         default:
 370                 assert_not_reached("Unknown output type");
 371         }
 372 }
 373
 374 static int setup_error(const ExecContext *context, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 375         ExecOutput o, e;
 376         ExecInput i;
 377
 378         assert(context);
 379         assert(ident);
 380
 381         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 382         o = fixup_output(context->std_output, socket_fd);
 383         e = fixup_output(context->std_error, socket_fd);
 384
 385         /* This expects the input and output are already set up */
 386
 387         /* Don't change the stderr file descriptor if we inherit all
 388          * the way and are not on a tty */
 389         if (e == EXEC_OUTPUT_INHERIT &&
 390             o == EXEC_OUTPUT_INHERIT &&
 391             i == EXEC_INPUT_NULL &&
 392             !is_terminal_input(context->std_input) &&
 393             getppid () != 1)
 394                 return STDERR_FILENO;
 395
 396         /* Duplicate from stdout if possible */
 397         if (e == o || e == EXEC_OUTPUT_INHERIT)
 398                 return dup2(STDOUT_FILENO, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 399
 400         switch (e) {
 401
 402         case EXEC_OUTPUT_NULL:
 403                 return open_null_as(O_WRONLY, STDERR_FILENO);
 404
 405         case EXEC_OUTPUT_TTY:
 406                 if (is_terminal_input(i))
 407                         return dup2(STDIN_FILENO, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 408
 409                 /* We don't reset the terminal if this is just about output */
 410                 return open_terminal_as(tty_path(context), O_WRONLY, STDERR_FILENO);
 411
 412         case EXEC_OUTPUT_SYSLOG:
 413         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 414         case EXEC_OUTPUT_KMSG:
 415         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 416         case EXEC_OUTPUT_JOURNAL:
 417         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 418                 return connect_logger_as(context, e, ident, unit_id, STDERR_FILENO);
 419
 420         case EXEC_OUTPUT_SOCKET:
 421                 assert(socket_fd >= 0);
 422                 return dup2(socket_fd, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 423
 424         default:
 425                 assert_not_reached("Unknown error type");
 426         }
 427 }
 428
 429 static int chown_terminal(int fd, uid_t uid) {
 430         struct stat st;
 431
 432         assert(fd >= 0);
 433
 434         /* This might fail. What matters are the results. */
 435         (void) fchown(fd, uid, -1);
 436         (void) fchmod(fd, TTY_MODE);
 437
 438         if (fstat(fd, &st) < 0)
 439                 return -errno;
 440
 441         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 442                 return -EPERM;
 443
 444         return 0;
 445 }
 446
 447 static int setup_confirm_stdio(const ExecContext *context,
 448                                int *_saved_stdin,
 449                                int *_saved_stdout) {
 450         int fd = -1, saved_stdin, saved_stdout = -1, r;
 451
 452         assert(context);
 453         assert(_saved_stdin);
 454         assert(_saved_stdout);
 455
 456         /* This returns positive EXIT_xxx return values instead of
 457          * negative errno style values! */
 458
 459         if ((saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3)) < 0)
 460                 return EXIT_STDIN;
 461
 462         if ((saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3)) < 0) {
 463                 r = EXIT_STDOUT;
 464                 goto fail;
 465         }
 466
 467         if ((fd = acquire_terminal(
 468                              tty_path(context),
 469                              context->std_input == EXEC_INPUT_TTY_FAIL,
 470                              context->std_input == EXEC_INPUT_TTY_FORCE,
 471                              false)) < 0) {
 472                 r = EXIT_STDIN;
 473                 goto fail;
 474         }
 475
 476         if (chown_terminal(fd, getuid()) < 0) {
 477                 r = EXIT_STDIN;
 478                 goto fail;
 479         }
 480
 481         if (dup2(fd, STDIN_FILENO) < 0) {
 482                 r = EXIT_STDIN;
 483                 goto fail;
 484         }
 485
 486         if (dup2(fd, STDOUT_FILENO) < 0) {
 487                 r = EXIT_STDOUT;
 488                 goto fail;
 489         }
 490
 491         if (fd >= 2)
 492                 close_nointr_nofail(fd);
 493
 494         *_saved_stdin = saved_stdin;
 495         *_saved_stdout = saved_stdout;
 496
 497         return 0;
 498
 499 fail:
 500         if (saved_stdout >= 0)
 501                 close_nointr_nofail(saved_stdout);
 502
 503         if (saved_stdin >= 0)
 504                 close_nointr_nofail(saved_stdin);
 505
 506         if (fd >= 0)
 507                 close_nointr_nofail(fd);
 508
 509         return r;
 510 }
 511
 512 static int restore_confirm_stdio(const ExecContext *context,
 513                                  int *saved_stdin,
 514                                  int *saved_stdout,
 515                                  bool *keep_stdin,
 516                                  bool *keep_stdout) {
 517
 518         assert(context);
 519         assert(saved_stdin);
 520         assert(*saved_stdin >= 0);
 521         assert(saved_stdout);
 522         assert(*saved_stdout >= 0);
 523
 524         /* This returns positive EXIT_xxx return values instead of
 525          * negative errno style values! */
 526
 527         if (is_terminal_input(context->std_input)) {
 528
 529                 /* The service wants terminal input. */
 530
 531                 *keep_stdin = true;
 532                 *keep_stdout =
 533                         context->std_output == EXEC_OUTPUT_INHERIT ||
 534                         context->std_output == EXEC_OUTPUT_TTY;
 535
 536         } else {
 537                 /* If the service doesn't want a controlling terminal,
 538                  * then we need to get rid entirely of what we have
 539                  * already. */
 540
 541                 if (release_terminal() < 0)
 542                         return EXIT_STDIN;
 543
 544                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 545                         return EXIT_STDIN;
 546
 547                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 548                         return EXIT_STDOUT;
 549
 550                 *keep_stdout = *keep_stdin = false;
 551         }
 552
 553         return 0;
 554 }
 555
 556 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 557         bool keep_groups = false;
 558         int r;
 559
 560         assert(context);
 561
 562         /* Lookup and set GID and supplementary group list. Here too
 563          * we avoid NSS lookups for gid=0. */
 564
 565         if (context->group || username) {
 566
 567                 if (context->group) {
 568                         const char *g = context->group;
 569
 570                         if ((r = get_group_creds(&g, &gid)) < 0)
 571                                 return r;
 572                 }
 573
 574                 /* First step, initialize groups from /etc/groups */
 575                 if (username && gid != 0) {
 576                         if (initgroups(username, gid) < 0)
 577                                 return -errno;
 578
 579                         keep_groups = true;
 580                 }
 581
 582                 /* Second step, set our gids */
 583                 if (setresgid(gid, gid, gid) < 0)
 584                         return -errno;
 585         }
 586
 587         if (context->supplementary_groups) {
 588                 int ngroups_max, k;
 589                 gid_t *gids;
 590                 char **i;
 591
 592                 /* Final step, initialize any manually set supplementary groups */
 593                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 594
 595                 if (!(gids = new(gid_t, ngroups_max)))
 596                         return -ENOMEM;
 597
 598                 if (keep_groups) {
 599                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 600                                 free(gids);
 601                                 return -errno;
 602                         }
 603                 } else
 604                         k = 0;
 605
 606                 STRV_FOREACH(i, context->supplementary_groups) {
 607                         const char *g;
 608
 609                         if (k >= ngroups_max) {
 610                                 free(gids);
 611                                 return -E2BIG;
 612                         }
 613
 614                         g = *i;
 615                         r = get_group_creds(&g, gids+k);
 616                         if (r < 0) {
 617                                 free(gids);
 618                                 return r;
 619                         }
 620
 621                         k++;
 622                 }
 623
 624                 if (setgroups(k, gids) < 0) {
 625                         free(gids);
 626                         return -errno;
 627                 }
 628
 629                 free(gids);
 630         }
 631
 632         return 0;
 633 }
 634
 635 static int enforce_user(const ExecContext *context, uid_t uid) {
 636         int r;
 637         assert(context);
 638
 639         /* Sets (but doesn't lookup) the uid and make sure we keep the
 640          * capabilities while doing so. */
 641
 642         if (context->capabilities) {
 643                 cap_t d;
 644                 static const cap_value_t bits[] = {
 645                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 646                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 647                 };
 648
 649                 /* First step: If we need to keep capabilities but
 650                  * drop privileges we need to make sure we keep our
 651                  * caps, whiel we drop privileges. */
 652                 if (uid != 0) {
 653                         int sb = context->secure_bits|SECURE_KEEP_CAPS;
 654
 655                         if (prctl(PR_GET_SECUREBITS) != sb)
 656                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 657                                         return -errno;
 658                 }
 659
 660                 /* Second step: set the capabilities. This will reduce
 661                  * the capabilities to the minimum we need. */
 662
 663                 if (!(d = cap_dup(context->capabilities)))
 664                         return -errno;
 665
 666                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 667                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 668                         r = -errno;
 669                         cap_free(d);
 670                         return r;
 671                 }
 672
 673                 if (cap_set_proc(d) < 0) {
 674                         r = -errno;
 675                         cap_free(d);
 676                         return r;
 677                 }
 678
 679                 cap_free(d);
 680         }
 681
 682         /* Third step: actually set the uids */
 683         if (setresuid(uid, uid, uid) < 0)
 684                 return -errno;
 685
 686         /* At this point we should have all necessary capabilities but
 687            are otherwise a normal user. However, the caps might got
 688            corrupted due to the setresuid() so we need clean them up
 689            later. This is done outside of this call. */
 690
 691         return 0;
 692 }
 693
 694 #ifdef HAVE_PAM
 695
 696 static int null_conv(
 697                 int num_msg,
 698                 const struct pam_message **msg,
 699                 struct pam_response **resp,
 700                 void *appdata_ptr) {
 701
 702         /* We don't support conversations */
 703
 704         return PAM_CONV_ERR;
 705 }
 706
 707 static int setup_pam(
 708                 const char *name,
 709                 const char *user,
 710                 uid_t uid,
 711                 const char *tty,
 712                 char ***pam_env,
 713                 int fds[], unsigned n_fds) {
 714
 715         static const struct pam_conv conv = {
 716                 .conv = null_conv,
 717                 .appdata_ptr = NULL
 718         };
 719
 720         pam_handle_t *handle = NULL;
 721         sigset_t ss, old_ss;
 722         int pam_code = PAM_SUCCESS;
 723         int err;
 724         char **e = NULL;
 725         bool close_session = false;
 726         pid_t pam_pid = 0, parent_pid;
 727
 728         assert(name);
 729         assert(user);
 730         assert(pam_env);
 731
 732         /* We set up PAM in the parent process, then fork. The child
 733          * will then stay around until killed via PR_GET_PDEATHSIG or
 734          * systemd via the cgroup logic. It will then remove the PAM
 735          * session again. The parent process will exec() the actual
 736          * daemon. We do things this way to ensure that the main PID
 737          * of the daemon is the one we initially fork()ed. */
 738
 739         if ((pam_code = pam_start(name, user, &conv, &handle)) != PAM_SUCCESS) {
 740                 handle = NULL;
 741                 goto fail;
 742         }
 743
 744         if (tty)
 745                 if ((pam_code = pam_set_item(handle, PAM_TTY, tty)) != PAM_SUCCESS)
 746                         goto fail;
 747
 748         if ((pam_code = pam_acct_mgmt(handle, PAM_SILENT)) != PAM_SUCCESS)
 749                 goto fail;
 750
 751         if ((pam_code = pam_open_session(handle, PAM_SILENT)) != PAM_SUCCESS)
 752                 goto fail;
 753
 754         close_session = true;
 755
 756         if ((!(e = pam_getenvlist(handle)))) {
 757                 pam_code = PAM_BUF_ERR;
 758                 goto fail;
 759         }
 760
 761         /* Block SIGTERM, so that we know that it won't get lost in
 762          * the child */
 763         if (sigemptyset(&ss) < 0 ||
 764             sigaddset(&ss, SIGTERM) < 0 ||
 765             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 766                 goto fail;
 767
 768         parent_pid = getpid();
 769
 770         if ((pam_pid = fork()) < 0)
 771                 goto fail;
 772
 773         if (pam_pid == 0) {
 774                 int sig;
 775                 int r = EXIT_PAM;
 776
 777                 /* The child's job is to reset the PAM session on
 778                  * termination */
 779
 780                 /* This string must fit in 10 chars (i.e. the length
 781                  * of "/sbin/init"), to look pretty in /bin/ps */
 782                 rename_process("(sd-pam)");
 783
 784                 /* Make sure we don't keep open the passed fds in this
 785                 child. We assume that otherwise only those fds are
 786                 open here that have been opened by PAM. */
 787                 close_many(fds, n_fds);
 788
 789                 /* Drop privileges - we don't need any to pam_close_session
 790                  * and this will make PR_SET_PDEATHSIG work in most cases.
 791                  * If this fails, ignore the error - but expect sd-pam threads
 792                  * to fail to exit normally */
 793                 if (setresuid(uid, uid, uid) < 0)
 794                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 795
 796                 /* Wait until our parent died. This will only work if
 797                  * the above setresuid() succeeds, otherwise the kernel
 798                  * will not allow unprivileged parents kill their privileged
 799                  * children this way. We rely on the control groups kill logic
 800                  * to do the rest for us. */
 801                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 802                         goto child_finish;
 803
 804                 /* Check if our parent process might already have
 805                  * died? */
 806                 if (getppid() == parent_pid) {
 807                         for (;;) {
 808                                 if (sigwait(&ss, &sig) < 0) {
 809                                         if (errno == EINTR)
 810                                                 continue;
 811
 812                                         goto child_finish;
 813                                 }
 814
 815                                 assert(sig == SIGTERM);
 816                                 break;
 817                         }
 818                 }
 819
 820                 /* If our parent died we'll end the session */
 821                 if (getppid() != parent_pid)
 822                         if ((pam_code = pam_close_session(handle, PAM_DATA_SILENT)) != PAM_SUCCESS)
 823                                 goto child_finish;
 824
 825                 r = 0;
 826
 827         child_finish:
 828                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 829                 _exit(r);
 830         }
 831
 832         /* If the child was forked off successfully it will do all the
 833          * cleanups, so forget about the handle here. */
 834         handle = NULL;
 835
 836         /* Unblock SIGTERM again in the parent */
 837         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 838                 goto fail;
 839
 840         /* We close the log explicitly here, since the PAM modules
 841          * might have opened it, but we don't want this fd around. */
 842         closelog();
 843
 844         *pam_env = e;
 845         e = NULL;
 846
 847         return 0;
 848
 849 fail:
 850         if (pam_code != PAM_SUCCESS)
 851                 err = -EPERM;  /* PAM errors do not map to errno */
 852         else
 853                 err = -errno;
 854
 855         if (handle) {
 856                 if (close_session)
 857                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
 858
 859                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 860         }
 861
 862         strv_free(e);
 863
 864         closelog();
 865
 866         if (pam_pid > 1) {
 867                 kill(pam_pid, SIGTERM);
 868                 kill(pam_pid, SIGCONT);
 869         }
 870
 871         return err;
 872 }
 873 #endif
 874
 875 static void rename_process_from_path(const char *path) {
 876         char process_name[11];
 877         const char *p;
 878         size_t l;
 879
 880         /* This resulting string must fit in 10 chars (i.e. the length
 881          * of "/sbin/init") to look pretty in /bin/ps */
 882
 883         p = path_get_file_name(path);
 884         if (isempty(p)) {
 885                 rename_process("(...)");
 886                 return;
 887         }
 888
 889         l = strlen(p);
 890         if (l > 8) {
 891                 /* The end of the process name is usually more
 892                  * interesting, since the first bit might just be
 893                  * "systemd-" */
 894                 p = p + l - 8;
 895                 l = 8;
 896         }
 897
 898         process_name[0] = '(';
 899         memcpy(process_name+1, p, l);
 900         process_name[1+l] = ')';
 901         process_name[1+l+1] = 0;
 902
 903         rename_process(process_name);
 904 }
 905
 906 int exec_spawn(ExecCommand *command,
 907                char **argv,
 908                const ExecContext *context,
 909                int fds[], unsigned n_fds,
 910                char **environment,
 911                bool apply_permissions,
 912                bool apply_chroot,
 913                bool apply_tty_stdin,
 914                bool confirm_spawn,
 915                CGroupBonding *cgroup_bondings,
 916                CGroupAttribute *cgroup_attributes,
 917                const char *cgroup_suffix,
 918                const char *unit_id,
 919                int idle_pipe[2],
 920                pid_t *ret) {
 921
 922         pid_t pid;
 923         int r;
 924         char *line;
 925         int socket_fd;
 926         char **files_env = NULL;
 927
 928         assert(command);
 929         assert(context);
 930         assert(ret);
 931         assert(fds || n_fds <= 0);
 932
 933         if (context->std_input == EXEC_INPUT_SOCKET ||
 934             context->std_output == EXEC_OUTPUT_SOCKET ||
 935             context->std_error == EXEC_OUTPUT_SOCKET) {
 936
 937                 if (n_fds != 1)
 938                         return -EINVAL;
 939
 940                 socket_fd = fds[0];
 941
 942                 fds = NULL;
 943                 n_fds = 0;
 944         } else
 945                 socket_fd = -1;
 946
 947         if ((r = exec_context_load_environment(context, &files_env)) < 0) {
 948                 log_error("Failed to load environment files: %s", strerror(-r));
 949                 return r;
 950         }
 951
 952         if (!argv)
 953                 argv = command->argv;
 954
 955         if (!(line = exec_command_line(argv))) {
 956                 r = -ENOMEM;
 957                 goto fail_parent;
 958         }
 959
 960         log_debug("About to execute: %s", line);
 961         free(line);
 962
 963         r = cgroup_bonding_realize_list(cgroup_bondings);
 964         if (r < 0)
 965                 goto fail_parent;
 966
 967         cgroup_attribute_apply_list(cgroup_attributes, cgroup_bondings);
 968
 969         if ((pid = fork()) < 0) {
 970                 r = -errno;
 971                 goto fail_parent;
 972         }
 973
 974         if (pid == 0) {
 975                 int i, err;
 976                 sigset_t ss;
 977                 const char *username = NULL, *home = NULL;
 978                 uid_t uid = (uid_t) -1;
 979                 gid_t gid = (gid_t) -1;
 980                 char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
 981                 unsigned n_env = 0;
 982                 int saved_stdout = -1, saved_stdin = -1;
 983                 bool keep_stdout = false, keep_stdin = false, set_access = false;
 984
 985                 /* child */
 986
 987                 rename_process_from_path(command->path);
 988
 989                 /* We reset exactly these signals, since they are the
 990                  * only ones we set to SIG_IGN in the main daemon. All
 991                  * others we leave untouched because we set them to
 992                  * SIG_DFL or a valid handler initially, both of which
 993                  * will be demoted to SIG_DFL. */
 994                 default_signals(SIGNALS_CRASH_HANDLER,
 995                                 SIGNALS_IGNORE, -1);
 996
 997                 if (context->ignore_sigpipe)
 998                         ignore_signals(SIGPIPE, -1);
 999
1000                 assert_se(sigemptyset(&ss) == 0);
1001                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1002                         err = -errno;
1003                         r = EXIT_SIGNAL_MASK;
1004                         goto fail_child;
1005                 }
1006
1007                 if (idle_pipe) {
1008                         if (idle_pipe[1] >= 0)
1009                                 close_nointr_nofail(idle_pipe[1]);
1010                         if (idle_pipe[0] >= 0) {
1011                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1012                                 close_nointr_nofail(idle_pipe[0]);
1013                         }
1014                 }
1015
1016                 /* Close sockets very early to make sure we don't
1017                  * block init reexecution because it cannot bind its
1018                  * sockets */
1019                 log_forget_fds();
1020                 err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
1021                                            socket_fd >= 0 ? 1 : n_fds);
1022                 if (err < 0) {
1023                         r = EXIT_FDS;
1024                         goto fail_child;
1025                 }
1026
1027                 if (!context->same_pgrp)
1028                         if (setsid() < 0) {
1029                                 err = -errno;
1030                                 r = EXIT_SETSID;
1031                                 goto fail_child;
1032                         }
1033
1034                 if (context->tcpwrap_name) {
1035                         if (socket_fd >= 0)
1036                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1037                                         err = -EACCES;
1038                                         r = EXIT_TCPWRAP;
1039                                         goto fail_child;
1040                                 }
1041
1042                         for (i = 0; i < (int) n_fds; i++) {
1043                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1044                                         err = -EACCES;
1045                                         r = EXIT_TCPWRAP;
1046                                         goto fail_child;
1047                                 }
1048                         }
1049                 }
1050
1051                 exec_context_tty_reset(context);
1052
1053                 /* We skip the confirmation step if we shall not apply the TTY */
1054                 if (confirm_spawn &&
1055                     (!is_terminal_input(context->std_input) || apply_tty_stdin)) {
1056                         char response;
1057
1058                         /* Set up terminal for the question */
1059                         if ((r = setup_confirm_stdio(context,
1060                                                      &saved_stdin, &saved_stdout))) {
1061                                 err = -errno;
1062                                 goto fail_child;
1063                         }
1064
1065                         /* Now ask the question. */
1066                         if (!(line = exec_command_line(argv))) {
1067                                 err = -ENOMEM;
1068                                 r = EXIT_MEMORY;
1069                                 goto fail_child;
1070                         }
1071
1072                         r = ask(&response, "yns", "Execute %s? [Yes, No, Skip] ", line);
1073                         free(line);
1074
1075                         if (r < 0 || response == 'n') {
1076                                 err = -ECANCELED;
1077                                 r = EXIT_CONFIRM;
1078                                 goto fail_child;
1079                         } else if (response == 's') {
1080                                 err = r = 0;
1081                                 goto fail_child;
1082                         }
1083
1084                         /* Release terminal for the question */
1085                         if ((r = restore_confirm_stdio(context,
1086                                                        &saved_stdin, &saved_stdout,
1087                                                        &keep_stdin, &keep_stdout))) {
1088                                 err = -errno;
1089                                 goto fail_child;
1090                         }
1091                 }
1092
1093                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1094                  * must sure to drop O_NONBLOCK */
1095                 if (socket_fd >= 0)
1096                         fd_nonblock(socket_fd, false);
1097
1098                 if (!keep_stdin) {
1099                         err = setup_input(context, socket_fd, apply_tty_stdin);
1100                         if (err < 0) {
1101                                 r = EXIT_STDIN;
1102                                 goto fail_child;
1103                         }
1104                 }
1105
1106                 if (!keep_stdout) {
1107                         err = setup_output(context, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1108                         if (err < 0) {
1109                                 r = EXIT_STDOUT;
1110                                 goto fail_child;
1111                         }
1112                 }
1113
1114                 err = setup_error(context, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1115                 if (err < 0) {
1116                         r = EXIT_STDERR;
1117                         goto fail_child;
1118                 }
1119
1120                 if (cgroup_bondings) {
1121                         err = cgroup_bonding_install_list(cgroup_bondings, 0, cgroup_suffix);
1122                         if (err < 0) {
1123                                 r = EXIT_CGROUP;
1124                                 goto fail_child;
1125                         }
1126                 }
1127
1128                 if (context->oom_score_adjust_set) {
1129                         char t[16];
1130
1131                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1132                         char_array_0(t);
1133
1134                         if (write_one_line_file("/proc/self/oom_score_adj", t) < 0) {
1135                                 err = -errno;
1136                                 r = EXIT_OOM_ADJUST;
1137                                 goto fail_child;
1138                         }
1139                 }
1140
1141                 if (context->nice_set)
1142                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1143                                 err = -errno;
1144                                 r = EXIT_NICE;
1145                                 goto fail_child;
1146                         }
1147
1148                 if (context->cpu_sched_set) {
1149                         struct sched_param param;
1150
1151                         zero(param);
1152                         param.sched_priority = context->cpu_sched_priority;
1153
1154                         if (sched_setscheduler(0, context->cpu_sched_policy |
1155                                                (context->cpu_sched_reset_on_fork ? SCHED_RESET_ON_FORK : 0), &param) < 0) {
1156                                 err = -errno;
1157                                 r = EXIT_SETSCHEDULER;
1158                                 goto fail_child;
1159                         }
1160                 }
1161
1162                 if (context->cpuset)
1163                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1164                                 err = -errno;
1165                                 r = EXIT_CPUAFFINITY;
1166                                 goto fail_child;
1167                         }
1168
1169                 if (context->ioprio_set)
1170                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1171                                 err = -errno;
1172                                 r = EXIT_IOPRIO;
1173                                 goto fail_child;
1174                         }
1175
1176                 if (context->timer_slack_nsec != (nsec_t) -1)
1177                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1178                                 err = -errno;
1179                                 r = EXIT_TIMERSLACK;
1180                                 goto fail_child;
1181                         }
1182
1183                 if (context->utmp_id)
1184                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1185
1186                 if (context->user) {
1187                         username = context->user;
1188                         err = get_user_creds(&username, &uid, &gid, &home);
1189                         if (err < 0) {
1190                                 r = EXIT_USER;
1191                                 goto fail_child;
1192                         }
1193
1194                         if (is_terminal_input(context->std_input)) {
1195                                 err = chown_terminal(STDIN_FILENO, uid);
1196                                 if (err < 0) {
1197                                         r = EXIT_STDIN;
1198                                         goto fail_child;
1199                                 }
1200                         }
1201
1202                         if (cgroup_bondings && context->control_group_modify) {
1203                                 err = cgroup_bonding_set_group_access_list(cgroup_bondings, 0755, uid, gid);
1204                                 if (err >= 0)
1205                                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, 0644, uid, gid, context->control_group_persistent);
1206                                 if (err < 0) {
1207                                         r = EXIT_CGROUP;
1208                                         goto fail_child;
1209                                 }
1210
1211                                 set_access = true;
1212                         }
1213                 }
1214
1215                 if (cgroup_bondings && !set_access && context->control_group_persistent >= 0)  {
1216                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, (mode_t) -1, (uid_t) -1, (uid_t) -1, context->control_group_persistent);
1217                         if (err < 0) {
1218                                 r = EXIT_CGROUP;
1219                                 goto fail_child;
1220                         }
1221                 }
1222
1223                 if (apply_permissions) {
1224                         err = enforce_groups(context, username, gid);
1225                         if (err < 0) {
1226                                 r = EXIT_GROUP;
1227                                 goto fail_child;
1228                         }
1229                 }
1230
1231                 umask(context->umask);
1232
1233 #ifdef HAVE_PAM
1234                 if (context->pam_name && username) {
1235                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1236                         if (err < 0) {
1237                                 r = EXIT_PAM;
1238                                 goto fail_child;
1239                         }
1240                 }
1241 #endif
1242                 if (context->private_network) {
1243                         if (unshare(CLONE_NEWNET) < 0) {
1244                                 err = -errno;
1245                                 r = EXIT_NETWORK;
1246                                 goto fail_child;
1247                         }
1248
1249                         loopback_setup();
1250                 }
1251
1252                 if (strv_length(context->read_write_dirs) > 0 ||
1253                     strv_length(context->read_only_dirs) > 0 ||
1254                     strv_length(context->inaccessible_dirs) > 0 ||
1255                     context->mount_flags != MS_SHARED ||
1256                     context->private_tmp) {
1257                         err = setup_namespace(context->read_write_dirs,
1258                                               context->read_only_dirs,
1259                                               context->inaccessible_dirs,
1260                                               context->private_tmp,
1261                                               context->mount_flags);
1262                         if (err < 0) {
1263                                 r = EXIT_NAMESPACE;
1264                                 goto fail_child;
1265                         }
1266                 }
1267
1268                 if (apply_chroot) {
1269                         if (context->root_directory)
1270                                 if (chroot(context->root_directory) < 0) {
1271                                         err = -errno;
1272                                         r = EXIT_CHROOT;
1273                                         goto fail_child;
1274                                 }
1275
1276                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1277                                 err = -errno;
1278                                 r = EXIT_CHDIR;
1279                                 goto fail_child;
1280                         }
1281                 } else {
1282
1283                         char *d;
1284
1285                         if (asprintf(&d, "%s/%s",
1286                                      context->root_directory ? context->root_directory : "",
1287                                      context->working_directory ? context->working_directory : "") < 0) {
1288                                 err = -ENOMEM;
1289                                 r = EXIT_MEMORY;
1290                                 goto fail_child;
1291                         }
1292
1293                         if (chdir(d) < 0) {
1294                                 err = -errno;
1295                                 free(d);
1296                                 r = EXIT_CHDIR;
1297                                 goto fail_child;
1298                         }
1299
1300                         free(d);
1301                 }
1302
1303                 /* We repeat the fd closing here, to make sure that
1304                  * nothing is leaked from the PAM modules */
1305                 err = close_all_fds(fds, n_fds);
1306                 if (err >= 0)
1307                         err = shift_fds(fds, n_fds);
1308                 if (err >= 0)
1309                         err = flags_fds(fds, n_fds, context->non_blocking);
1310                 if (err < 0) {
1311                         r = EXIT_FDS;
1312                         goto fail_child;
1313                 }
1314
1315                 if (apply_permissions) {
1316
1317                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1318                                 if (!context->rlimit[i])
1319                                         continue;
1320
1321                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1322                                         err = -errno;
1323                                         r = EXIT_LIMITS;
1324                                         goto fail_child;
1325                                 }
1326                         }
1327
1328                         if (context->capability_bounding_set_drop) {
1329                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1330                                 if (err < 0) {
1331                                         r = EXIT_CAPABILITIES;
1332                                         goto fail_child;
1333                                 }
1334                         }
1335
1336                         if (context->user) {
1337                                 err = enforce_user(context, uid);
1338                                 if (err < 0) {
1339                                         r = EXIT_USER;
1340                                         goto fail_child;
1341                                 }
1342                         }
1343
1344                         /* PR_GET_SECUREBITS is not privileged, while
1345                          * PR_SET_SECUREBITS is. So to suppress
1346                          * potential EPERMs we'll try not to call
1347                          * PR_SET_SECUREBITS unless necessary. */
1348                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1349                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1350                                         err = -errno;
1351                                         r = EXIT_SECUREBITS;
1352                                         goto fail_child;
1353                                 }
1354
1355                         if (context->capabilities)
1356                                 if (cap_set_proc(context->capabilities) < 0) {
1357                                         err = -errno;
1358                                         r = EXIT_CAPABILITIES;
1359                                         goto fail_child;
1360                                 }
1361                 }
1362
1363                 if (!(our_env = new0(char*, 7))) {
1364                         err = -ENOMEM;
1365                         r = EXIT_MEMORY;
1366                         goto fail_child;
1367                 }
1368
1369                 if (n_fds > 0)
1370                         if (asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1371                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0) {
1372                                 err = -ENOMEM;
1373                                 r = EXIT_MEMORY;
1374                                 goto fail_child;
1375                         }
1376
1377                 if (home)
1378                         if (asprintf(our_env + n_env++, "HOME=%s", home) < 0) {
1379                                 err = -ENOMEM;
1380                                 r = EXIT_MEMORY;
1381                                 goto fail_child;
1382                         }
1383
1384                 if (username)
1385                         if (asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1386                             asprintf(our_env + n_env++, "USER=%s", username) < 0) {
1387                                 err = -ENOMEM;
1388                                 r = EXIT_MEMORY;
1389                                 goto fail_child;
1390                         }
1391
1392                 if (is_terminal_input(context->std_input) ||
1393                     context->std_output == EXEC_OUTPUT_TTY ||
1394                     context->std_error == EXEC_OUTPUT_TTY)
1395                         if (!(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))) {
1396                                 err = -ENOMEM;
1397                                 r = EXIT_MEMORY;
1398                                 goto fail_child;
1399                         }
1400
1401                 assert(n_env <= 7);
1402
1403                 if (!(final_env = strv_env_merge(
1404                                       5,
1405                                       environment,
1406                                       our_env,
1407                                       context->environment,
1408                                       files_env,
1409                                       pam_env,
1410                                       NULL))) {
1411                         err = -ENOMEM;
1412                         r = EXIT_MEMORY;
1413                         goto fail_child;
1414                 }
1415
1416                 if (!(final_argv = replace_env_argv(argv, final_env))) {
1417                         err = -ENOMEM;
1418                         r = EXIT_MEMORY;
1419                         goto fail_child;
1420                 }
1421
1422                 final_env = strv_env_clean(final_env);
1423
1424                 execve(command->path, final_argv, final_env);
1425                 err = -errno;
1426                 r = EXIT_EXEC;
1427
1428         fail_child:
1429                 if (r != 0) {
1430                         log_open();
1431                         log_warning("Failed at step %s spawning %s: %s",
1432                                     exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1433                                     command->path, strerror(-err));
1434                 }
1435
1436                 strv_free(our_env);
1437                 strv_free(final_env);
1438                 strv_free(pam_env);
1439                 strv_free(files_env);
1440                 strv_free(final_argv);
1441
1442                 if (saved_stdin >= 0)
1443                         close_nointr_nofail(saved_stdin);
1444
1445                 if (saved_stdout >= 0)
1446                         close_nointr_nofail(saved_stdout);
1447
1448                 _exit(r);
1449         }
1450
1451         strv_free(files_env);
1452
1453         /* We add the new process to the cgroup both in the child (so
1454          * that we can be sure that no user code is ever executed
1455          * outside of the cgroup) and in the parent (so that we can be
1456          * sure that when we kill the cgroup the process will be
1457          * killed too). */
1458         if (cgroup_bondings)
1459                 cgroup_bonding_install_list(cgroup_bondings, pid, cgroup_suffix);
1460
1461         log_debug("Forked %s as %lu", command->path, (unsigned long) pid);
1462
1463         exec_status_start(&command->exec_status, pid);
1464
1465         *ret = pid;
1466         return 0;
1467
1468 fail_parent:
1469         strv_free(files_env);
1470
1471         return r;
1472 }
1473
1474 void exec_context_init(ExecContext *c) {
1475         assert(c);
1476
1477         c->umask = 0022;
1478         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1479         c->cpu_sched_policy = SCHED_OTHER;
1480         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1481         c->syslog_level_prefix = true;
1482         c->mount_flags = MS_SHARED;
1483         c->kill_signal = SIGTERM;
1484         c->send_sigkill = true;
1485         c->control_group_persistent = -1;
1486         c->ignore_sigpipe = true;
1487         c->timer_slack_nsec = (nsec_t) -1;
1488 }
1489
1490 void exec_context_done(ExecContext *c) {
1491         unsigned l;
1492
1493         assert(c);
1494
1495         strv_free(c->environment);
1496         c->environment = NULL;
1497
1498         strv_free(c->environment_files);
1499         c->environment_files = NULL;
1500
1501         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1502                 free(c->rlimit[l]);
1503                 c->rlimit[l] = NULL;
1504         }
1505
1506         free(c->working_directory);
1507         c->working_directory = NULL;
1508         free(c->root_directory);
1509         c->root_directory = NULL;
1510
1511         free(c->tty_path);
1512         c->tty_path = NULL;
1513
1514         free(c->tcpwrap_name);
1515         c->tcpwrap_name = NULL;
1516
1517         free(c->syslog_identifier);
1518         c->syslog_identifier = NULL;
1519
1520         free(c->user);
1521         c->user = NULL;
1522
1523         free(c->group);
1524         c->group = NULL;
1525
1526         strv_free(c->supplementary_groups);
1527         c->supplementary_groups = NULL;
1528
1529         free(c->pam_name);
1530         c->pam_name = NULL;
1531
1532         if (c->capabilities) {
1533                 cap_free(c->capabilities);
1534                 c->capabilities = NULL;
1535         }
1536
1537         strv_free(c->read_only_dirs);
1538         c->read_only_dirs = NULL;
1539
1540         strv_free(c->read_write_dirs);
1541         c->read_write_dirs = NULL;
1542
1543         strv_free(c->inaccessible_dirs);
1544         c->inaccessible_dirs = NULL;
1545
1546         if (c->cpuset)
1547                 CPU_FREE(c->cpuset);
1548
1549         free(c->utmp_id);
1550         c->utmp_id = NULL;
1551 }
1552
1553 void exec_command_done(ExecCommand *c) {
1554         assert(c);
1555
1556         free(c->path);
1557         c->path = NULL;
1558
1559         strv_free(c->argv);
1560         c->argv = NULL;
1561 }
1562
1563 void exec_command_done_array(ExecCommand *c, unsigned n) {
1564         unsigned i;
1565
1566         for (i = 0; i < n; i++)
1567                 exec_command_done(c+i);
1568 }
1569
1570 void exec_command_free_list(ExecCommand *c) {
1571         ExecCommand *i;
1572
1573         while ((i = c)) {
1574                 LIST_REMOVE(ExecCommand, command, c, i);
1575                 exec_command_done(i);
1576                 free(i);
1577         }
1578 }
1579
1580 void exec_command_free_array(ExecCommand **c, unsigned n) {
1581         unsigned i;
1582
1583         for (i = 0; i < n; i++) {
1584                 exec_command_free_list(c[i]);
1585                 c[i] = NULL;
1586         }
1587 }
1588
1589 int exec_context_load_environment(const ExecContext *c, char ***l) {
1590         char **i, **r = NULL;
1591
1592         assert(c);
1593         assert(l);
1594
1595         STRV_FOREACH(i, c->environment_files) {
1596                 char *fn;
1597                 int k;
1598                 bool ignore = false;
1599                 char **p;
1600
1601                 fn = *i;
1602
1603                 if (fn[0] == '-') {
1604                         ignore = true;
1605                         fn ++;
1606                 }
1607
1608                 if (!path_is_absolute(fn)) {
1609
1610                         if (ignore)
1611                                 continue;
1612
1613                         strv_free(r);
1614                         return -EINVAL;
1615                 }
1616
1617                 if ((k = load_env_file(fn, &p)) < 0) {
1618
1619                         if (ignore)
1620                                 continue;
1621
1622                         strv_free(r);
1623                         return k;
1624                 }
1625
1626                 if (r == NULL)
1627                         r = p;
1628                 else {
1629                         char **m;
1630
1631                         m = strv_env_merge(2, r, p);
1632                         strv_free(r);
1633                         strv_free(p);
1634
1635                         if (!m)
1636                                 return -ENOMEM;
1637
1638                         r = m;
1639                 }
1640         }
1641
1642         *l = r;
1643
1644         return 0;
1645 }
1646
1647 static void strv_fprintf(FILE *f, char **l) {
1648         char **g;
1649
1650         assert(f);
1651
1652         STRV_FOREACH(g, l)
1653                 fprintf(f, " %s", *g);
1654 }
1655
1656 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1657         char ** e;
1658         unsigned i;
1659
1660         assert(c);
1661         assert(f);
1662
1663         if (!prefix)
1664                 prefix = "";
1665
1666         fprintf(f,
1667                 "%sUMask: %04o\n"
1668                 "%sWorkingDirectory: %s\n"
1669                 "%sRootDirectory: %s\n"
1670                 "%sNonBlocking: %s\n"
1671                 "%sPrivateTmp: %s\n"
1672                 "%sControlGroupModify: %s\n"
1673                 "%sControlGroupPersistent: %s\n"
1674                 "%sPrivateNetwork: %s\n",
1675                 prefix, c->umask,
1676                 prefix, c->working_directory ? c->working_directory : "/",
1677                 prefix, c->root_directory ? c->root_directory : "/",
1678                 prefix, yes_no(c->non_blocking),
1679                 prefix, yes_no(c->private_tmp),
1680                 prefix, yes_no(c->control_group_modify),
1681                 prefix, yes_no(c->control_group_persistent),
1682                 prefix, yes_no(c->private_network));
1683
1684         STRV_FOREACH(e, c->environment)
1685                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1686
1687         STRV_FOREACH(e, c->environment_files)
1688                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1689
1690         if (c->tcpwrap_name)
1691                 fprintf(f,
1692                         "%sTCPWrapName: %s\n",
1693                         prefix, c->tcpwrap_name);
1694
1695         if (c->nice_set)
1696                 fprintf(f,
1697                         "%sNice: %i\n",
1698                         prefix, c->nice);
1699
1700         if (c->oom_score_adjust_set)
1701                 fprintf(f,
1702                         "%sOOMScoreAdjust: %i\n",
1703                         prefix, c->oom_score_adjust);
1704
1705         for (i = 0; i < RLIM_NLIMITS; i++)
1706                 if (c->rlimit[i])
1707                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1708
1709         if (c->ioprio_set)
1710                 fprintf(f,
1711                         "%sIOSchedulingClass: %s\n"
1712                         "%sIOPriority: %i\n",
1713                         prefix, ioprio_class_to_string(IOPRIO_PRIO_CLASS(c->ioprio)),
1714                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1715
1716         if (c->cpu_sched_set)
1717                 fprintf(f,
1718                         "%sCPUSchedulingPolicy: %s\n"
1719                         "%sCPUSchedulingPriority: %i\n"
1720                         "%sCPUSchedulingResetOnFork: %s\n",
1721                         prefix, sched_policy_to_string(c->cpu_sched_policy),
1722                         prefix, c->cpu_sched_priority,
1723                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1724
1725         if (c->cpuset) {
1726                 fprintf(f, "%sCPUAffinity:", prefix);
1727                 for (i = 0; i < c->cpuset_ncpus; i++)
1728                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1729                                 fprintf(f, " %i", i);
1730                 fputs("\n", f);
1731         }
1732
1733         if (c->timer_slack_nsec != (nsec_t) -1)
1734                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, (unsigned long)c->timer_slack_nsec);
1735
1736         fprintf(f,
1737                 "%sStandardInput: %s\n"
1738                 "%sStandardOutput: %s\n"
1739                 "%sStandardError: %s\n",
1740                 prefix, exec_input_to_string(c->std_input),
1741                 prefix, exec_output_to_string(c->std_output),
1742                 prefix, exec_output_to_string(c->std_error));
1743
1744         if (c->tty_path)
1745                 fprintf(f,
1746                         "%sTTYPath: %s\n"
1747                         "%sTTYReset: %s\n"
1748                         "%sTTYVHangup: %s\n"
1749                         "%sTTYVTDisallocate: %s\n",
1750                         prefix, c->tty_path,
1751                         prefix, yes_no(c->tty_reset),
1752                         prefix, yes_no(c->tty_vhangup),
1753                         prefix, yes_no(c->tty_vt_disallocate));
1754
1755         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1756             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1757             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1758             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE)
1759                 fprintf(f,
1760                         "%sSyslogFacility: %s\n"
1761                         "%sSyslogLevel: %s\n",
1762                         prefix, log_facility_unshifted_to_string(c->syslog_priority >> 3),
1763                         prefix, log_level_to_string(LOG_PRI(c->syslog_priority)));
1764
1765         if (c->capabilities) {
1766                 char *t;
1767                 if ((t = cap_to_text(c->capabilities, NULL))) {
1768                         fprintf(f, "%sCapabilities: %s\n",
1769                                 prefix, t);
1770                         cap_free(t);
1771                 }
1772         }
1773
1774         if (c->secure_bits)
1775                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1776                         prefix,
1777                         (c->secure_bits & SECURE_KEEP_CAPS) ? " keep-caps" : "",
1778                         (c->secure_bits & SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1779                         (c->secure_bits & SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1780                         (c->secure_bits & SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1781                         (c->secure_bits & SECURE_NOROOT) ? " noroot" : "",
1782                         (c->secure_bits & SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1783
1784         if (c->capability_bounding_set_drop) {
1785                 unsigned long l;
1786                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1787
1788                 for (l = 0; l <= cap_last_cap(); l++)
1789                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1790                                 char *t;
1791
1792                                 if ((t = cap_to_name(l))) {
1793                                         fprintf(f, " %s", t);
1794                                         cap_free(t);
1795                                 }
1796                         }
1797
1798                 fputs("\n", f);
1799         }
1800
1801         if (c->user)
1802                 fprintf(f, "%sUser: %s\n", prefix, c->user);
1803         if (c->group)
1804                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
1805
1806         if (strv_length(c->supplementary_groups) > 0) {
1807                 fprintf(f, "%sSupplementaryGroups:", prefix);
1808                 strv_fprintf(f, c->supplementary_groups);
1809                 fputs("\n", f);
1810         }
1811
1812         if (c->pam_name)
1813                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
1814
1815         if (strv_length(c->read_write_dirs) > 0) {
1816                 fprintf(f, "%sReadWriteDirs:", prefix);
1817                 strv_fprintf(f, c->read_write_dirs);
1818                 fputs("\n", f);
1819         }
1820
1821         if (strv_length(c->read_only_dirs) > 0) {
1822                 fprintf(f, "%sReadOnlyDirs:", prefix);
1823                 strv_fprintf(f, c->read_only_dirs);
1824                 fputs("\n", f);
1825         }
1826
1827         if (strv_length(c->inaccessible_dirs) > 0) {
1828                 fprintf(f, "%sInaccessibleDirs:", prefix);
1829                 strv_fprintf(f, c->inaccessible_dirs);
1830                 fputs("\n", f);
1831         }
1832
1833         fprintf(f,
1834                 "%sKillMode: %s\n"
1835                 "%sKillSignal: SIG%s\n"
1836                 "%sSendSIGKILL: %s\n"
1837                 "%sIgnoreSIGPIPE: %s\n",
1838                 prefix, kill_mode_to_string(c->kill_mode),
1839                 prefix, signal_to_string(c->kill_signal),
1840                 prefix, yes_no(c->send_sigkill),
1841                 prefix, yes_no(c->ignore_sigpipe));
1842
1843         if (c->utmp_id)
1844                 fprintf(f,
1845                         "%sUtmpIdentifier: %s\n",
1846                         prefix, c->utmp_id);
1847 }
1848
1849 void exec_status_start(ExecStatus *s, pid_t pid) {
1850         assert(s);
1851
1852         zero(*s);
1853         s->pid = pid;
1854         dual_timestamp_get(&s->start_timestamp);
1855 }
1856
1857 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
1858         assert(s);
1859
1860         if (s->pid && s->pid != pid)
1861                 zero(*s);
1862
1863         s->pid = pid;
1864         dual_timestamp_get(&s->exit_timestamp);
1865
1866         s->code = code;
1867         s->status = status;
1868
1869         if (context) {
1870                 if (context->utmp_id)
1871                         utmp_put_dead_process(context->utmp_id, pid, code, status);
1872
1873                 exec_context_tty_reset(context);
1874         }
1875 }
1876
1877 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
1878         char buf[FORMAT_TIMESTAMP_MAX];
1879
1880         assert(s);
1881         assert(f);
1882
1883         if (!prefix)
1884                 prefix = "";
1885
1886         if (s->pid <= 0)
1887                 return;
1888
1889         fprintf(f,
1890                 "%sPID: %lu\n",
1891                 prefix, (unsigned long) s->pid);
1892
1893         if (s->start_timestamp.realtime > 0)
1894                 fprintf(f,
1895                         "%sStart Timestamp: %s\n",
1896                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
1897
1898         if (s->exit_timestamp.realtime > 0)
1899                 fprintf(f,
1900                         "%sExit Timestamp: %s\n"
1901                         "%sExit Code: %s\n"
1902                         "%sExit Status: %i\n",
1903                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
1904                         prefix, sigchld_code_to_string(s->code),
1905                         prefix, s->status);
1906 }
1907
1908 char *exec_command_line(char **argv) {
1909         size_t k;
1910         char *n, *p, **a;
1911         bool first = true;
1912
1913         assert(argv);
1914
1915         k = 1;
1916         STRV_FOREACH(a, argv)
1917                 k += strlen(*a)+3;
1918
1919         if (!(n = new(char, k)))
1920                 return NULL;
1921
1922         p = n;
1923         STRV_FOREACH(a, argv) {
1924
1925                 if (!first)
1926                         *(p++) = ' ';
1927                 else
1928                         first = false;
1929
1930                 if (strpbrk(*a, WHITESPACE)) {
1931                         *(p++) = '\'';
1932                         p = stpcpy(p, *a);
1933                         *(p++) = '\'';
1934                 } else
1935                         p = stpcpy(p, *a);
1936
1937         }
1938
1939         *p = 0;
1940
1941         /* FIXME: this doesn't really handle arguments that have
1942          * spaces and ticks in them */
1943
1944         return n;
1945 }
1946
1947 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
1948         char *p2;
1949         const char *prefix2;
1950
1951         char *cmd;
1952
1953         assert(c);
1954         assert(f);
1955
1956         if (!prefix)
1957                 prefix = "";
1958         p2 = strappend(prefix, "\t");
1959         prefix2 = p2 ? p2 : prefix;
1960
1961         cmd = exec_command_line(c->argv);
1962
1963         fprintf(f,
1964                 "%sCommand Line: %s\n",
1965                 prefix, cmd ? cmd : strerror(ENOMEM));
1966
1967         free(cmd);
1968
1969         exec_status_dump(&c->exec_status, f, prefix2);
1970
1971         free(p2);
1972 }
1973
1974 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
1975         assert(f);
1976
1977         if (!prefix)
1978                 prefix = "";
1979
1980         LIST_FOREACH(command, c, c)
1981                 exec_command_dump(c, f, prefix);
1982 }
1983
1984 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
1985         ExecCommand *end;
1986
1987         assert(l);
1988         assert(e);
1989
1990         if (*l) {
1991                 /* It's kind of important, that we keep the order here */
1992                 LIST_FIND_TAIL(ExecCommand, command, *l, end);
1993                 LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
1994         } else
1995               *l = e;
1996 }
1997
1998 int exec_command_set(ExecCommand *c, const char *path, ...) {
1999         va_list ap;
2000         char **l, *p;
2001
2002         assert(c);
2003         assert(path);
2004
2005         va_start(ap, path);
2006         l = strv_new_ap(path, ap);
2007         va_end(ap);
2008
2009         if (!l)
2010                 return -ENOMEM;
2011
2012         if (!(p = strdup(path))) {
2013                 strv_free(l);
2014                 return -ENOMEM;
2015         }
2016
2017         free(c->path);
2018         c->path = p;
2019
2020         strv_free(c->argv);
2021         c->argv = l;
2022
2023         return 0;
2024 }
2025
2026 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2027         [EXEC_INPUT_NULL] = "null",
2028         [EXEC_INPUT_TTY] = "tty",
2029         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2030         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2031         [EXEC_INPUT_SOCKET] = "socket"
2032 };
2033
2034 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2035
2036 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2037         [EXEC_OUTPUT_INHERIT] = "inherit",
2038         [EXEC_OUTPUT_NULL] = "null",
2039         [EXEC_OUTPUT_TTY] = "tty",
2040         [EXEC_OUTPUT_SYSLOG] = "syslog",
2041         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2042         [EXEC_OUTPUT_KMSG] = "kmsg",
2043         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2044         [EXEC_OUTPUT_JOURNAL] = "journal",
2045         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2046         [EXEC_OUTPUT_SOCKET] = "socket"
2047 };
2048
2049 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
2050
2051 static const char* const kill_mode_table[_KILL_MODE_MAX] = {
2052         [KILL_CONTROL_GROUP] = "control-group",
2053         [KILL_PROCESS] = "process",
2054         [KILL_NONE] = "none"
2055 };
2056
2057 DEFINE_STRING_TABLE_LOOKUP(kill_mode, KillMode);
2058
2059 static const char* const kill_who_table[_KILL_WHO_MAX] = {
2060         [KILL_MAIN] = "main",
2061         [KILL_CONTROL] = "control",
2062         [KILL_ALL] = "all"
2063 };
2064
2065 DEFINE_STRING_TABLE_LOOKUP(kill_who, KillWho);