src/tmpfiles/tmpfiles.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering, Kay Sievers
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <unistd.h>
  23 #include <fcntl.h>
  24 #include <errno.h>
  25 #include <string.h>
  26 #include <sys/stat.h>
  27 #include <limits.h>
  28 #include <dirent.h>
  29 #include <grp.h>
  30 #include <pwd.h>
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <stddef.h>
  34 #include <getopt.h>
  35 #include <stdbool.h>
  36 #include <time.h>
  37 #include <sys/types.h>
  38 #include <sys/param.h>
  39 #include <glob.h>
  40 #include <fnmatch.h>
  41 #include <sys/capability.h>
  42
  43 #include "log.h"
  44 #include "util.h"
  45 #include "macro.h"
  46 #include "missing.h"
  47 #include "mkdir.h"
  48 #include "path-util.h"
  49 #include "strv.h"
  50 #include "label.h"
  51 #include "set.h"
  52 #include "conf-files.h"
  53 #include "capability.h"
  54 #include "specifier.h"
  55 #include "build.h"
  56 #include "copy.h"
  57
  58 /* This reads all files listed in /etc/tmpfiles.d/?*.conf and creates
  59  * them in the file system. This is intended to be used to create
  60  * properly owned directories beneath /tmp, /var/tmp, /run, which are
  61  * volatile and hence need to be recreated on bootup. */
  62
  63 typedef enum ItemType {
  64         /* These ones take file names */
  65         CREATE_FILE = 'f',
  66         TRUNCATE_FILE = 'F',
  67         CREATE_DIRECTORY = 'd',
  68         TRUNCATE_DIRECTORY = 'D',
  69         CREATE_FIFO = 'p',
  70         CREATE_SYMLINK = 'L',
  71         CREATE_CHAR_DEVICE = 'c',
  72         CREATE_BLOCK_DEVICE = 'b',
  73         COPY_FILES = 'C',
  74
  75         /* These ones take globs */
  76         WRITE_FILE = 'w',
  77         IGNORE_PATH = 'x',
  78         IGNORE_DIRECTORY_PATH = 'X',
  79         REMOVE_PATH = 'r',
  80         RECURSIVE_REMOVE_PATH = 'R',
  81         ADJUST_MODE = 'm', /* legacy, 'z' is identical to this */
  82         RELABEL_PATH = 'z',
  83         RECURSIVE_RELABEL_PATH = 'Z',
  84 } ItemType;
  85
  86 typedef struct Item {
  87         ItemType type;
  88
  89         char *path;
  90         char *argument;
  91         uid_t uid;
  92         gid_t gid;
  93         mode_t mode;
  94         usec_t age;
  95
  96         dev_t major_minor;
  97
  98         bool uid_set:1;
  99         bool gid_set:1;
 100         bool mode_set:1;
 101         bool age_set:1;
 102         bool mask_perms:1;
 103
 104         bool keep_first_level:1;
 105
 106         bool force:1;
 107
 108         bool done:1;
 109 } Item;
 110
 111 static bool arg_create = false;
 112 static bool arg_clean = false;
 113 static bool arg_remove = false;
 114 static bool arg_boot = false;
 115
 116 static char **arg_include_prefixes = NULL;
 117 static char **arg_exclude_prefixes = NULL;
 118 static char *arg_root = NULL;
 119
 120 static const char conf_file_dirs[] = CONF_DIRS_NULSTR("tmpfiles");
 121
 122 #define MAX_DEPTH 256
 123
 124 static Hashmap *items = NULL, *globs = NULL;
 125 static Set *unix_sockets = NULL;
 126
 127 static bool needs_glob(ItemType t) {
 128         return IN_SET(t,
 129                       WRITE_FILE,
 130                       IGNORE_PATH,
 131                       IGNORE_DIRECTORY_PATH,
 132                       REMOVE_PATH,
 133                       RECURSIVE_REMOVE_PATH,
 134                       ADJUST_MODE,
 135                       RELABEL_PATH,
 136                       RECURSIVE_RELABEL_PATH);
 137 }
 138
 139 static struct Item* find_glob(Hashmap *h, const char *match) {
 140         Item *j;
 141         Iterator i;
 142
 143         HASHMAP_FOREACH(j, h, i)
 144                 if (fnmatch(j->path, match, FNM_PATHNAME|FNM_PERIOD) == 0)
 145                         return j;
 146
 147         return NULL;
 148 }
 149
 150 static void load_unix_sockets(void) {
 151         _cleanup_fclose_ FILE *f = NULL;
 152         char line[LINE_MAX];
 153
 154         if (unix_sockets)
 155                 return;
 156
 157         /* We maintain a cache of the sockets we found in
 158          * /proc/net/unix to speed things up a little. */
 159
 160         unix_sockets = set_new(&string_hash_ops);
 161         if (!unix_sockets)
 162                 return;
 163
 164         f = fopen("/proc/net/unix", "re");
 165         if (!f)
 166                 return;
 167
 168         /* Skip header */
 169         if (!fgets(line, sizeof(line), f))
 170                 goto fail;
 171
 172         for (;;) {
 173                 char *p, *s;
 174                 int k;
 175
 176                 if (!fgets(line, sizeof(line), f))
 177                         break;
 178
 179                 truncate_nl(line);
 180
 181                 p = strchr(line, ':');
 182                 if (!p)
 183                         continue;
 184
 185                 if (strlen(p) < 37)
 186                         continue;
 187
 188                 p += 37;
 189                 p += strspn(p, WHITESPACE);
 190                 p += strcspn(p, WHITESPACE); /* skip one more word */
 191                 p += strspn(p, WHITESPACE);
 192
 193                 if (*p != '/')
 194                         continue;
 195
 196                 s = strdup(p);
 197                 if (!s)
 198                         goto fail;
 199
 200                 path_kill_slashes(s);
 201
 202                 k = set_consume(unix_sockets, s);
 203                 if (k < 0 && k != -EEXIST)
 204                         goto fail;
 205         }
 206
 207         return;
 208
 209 fail:
 210         set_free_free(unix_sockets);
 211         unix_sockets = NULL;
 212 }
 213
 214 static bool unix_socket_alive(const char *fn) {
 215         assert(fn);
 216
 217         load_unix_sockets();
 218
 219         if (unix_sockets)
 220                 return !!set_get(unix_sockets, (char*) fn);
 221
 222         /* We don't know, so assume yes */
 223         return true;
 224 }
 225
 226 static int dir_is_mount_point(DIR *d, const char *subdir) {
 227
 228         union file_handle_union h = {
 229                 .handle.handle_bytes = MAX_HANDLE_SZ
 230         };
 231
 232         int mount_id_parent, mount_id;
 233         int r_p, r;
 234
 235         r_p = name_to_handle_at(dirfd(d), ".", &h.handle, &mount_id_parent, 0);
 236         if (r_p < 0)
 237                 r_p = -errno;
 238
 239         h.handle.handle_bytes = MAX_HANDLE_SZ;
 240         r = name_to_handle_at(dirfd(d), subdir, &h.handle, &mount_id, 0);
 241         if (r < 0)
 242                 r = -errno;
 243
 244         /* got no handle; make no assumptions, return error */
 245         if (r_p < 0 && r < 0)
 246                 return r_p;
 247
 248         /* got both handles; if they differ, it is a mount point */
 249         if (r_p >= 0 && r >= 0)
 250                 return mount_id_parent != mount_id;
 251
 252         /* got only one handle; assume different mount points if one
 253          * of both queries was not supported by the filesystem */
 254         if (r_p == -ENOSYS || r_p == -EOPNOTSUPP || r == -ENOSYS || r == -EOPNOTSUPP)
 255                 return true;
 256
 257         /* return error */
 258         if (r_p < 0)
 259                 return r_p;
 260         return r;
 261 }
 262
 263 static int dir_cleanup(
 264                 Item *i,
 265                 const char *p,
 266                 DIR *d,
 267                 const struct stat *ds,
 268                 usec_t cutoff,
 269                 dev_t rootdev,
 270                 bool mountpoint,
 271                 int maxdepth,
 272                 bool keep_this_level) {
 273
 274         struct dirent *dent;
 275         struct timespec times[2];
 276         bool deleted = false;
 277         int r = 0;
 278
 279         while ((dent = readdir(d))) {
 280                 struct stat s;
 281                 usec_t age;
 282                 _cleanup_free_ char *sub_path = NULL;
 283
 284                 if (streq(dent->d_name, ".") ||
 285                     streq(dent->d_name, ".."))
 286                         continue;
 287
 288                 if (fstatat(dirfd(d), dent->d_name, &s, AT_SYMLINK_NOFOLLOW) < 0) {
 289                         if (errno == ENOENT)
 290                                 continue;
 291
 292                         /* FUSE, NFS mounts, SELinux might return EACCES */
 293                         if (errno == EACCES)
 294                                 log_debug_errno(errno, "stat(%s/%s) failed: %m", p, dent->d_name);
 295                         else
 296                                 log_error_errno(errno, "stat(%s/%s) failed: %m", p, dent->d_name);
 297                         r = -errno;
 298                         continue;
 299                 }
 300
 301                 /* Stay on the same filesystem */
 302                 if (s.st_dev != rootdev)
 303                         continue;
 304
 305                 /* Try to detect bind mounts of the same filesystem instance; they
 306                  * do not differ in device major/minors. This type of query is not
 307                  * supported on all kernels or filesystem types though. */
 308                 if (S_ISDIR(s.st_mode) && dir_is_mount_point(d, dent->d_name) > 0)
 309                         continue;
 310
 311                 /* Do not delete read-only files owned by root */
 312                 if (s.st_uid == 0 && !(s.st_mode & S_IWUSR))
 313                         continue;
 314
 315                 sub_path = strjoin(p, "/", dent->d_name, NULL);
 316                 if (!sub_path) {
 317                         r = log_oom();
 318                         goto finish;
 319                 }
 320
 321                 /* Is there an item configured for this path? */
 322                 if (hashmap_get(items, sub_path))
 323                         continue;
 324
 325                 if (find_glob(globs, sub_path))
 326                         continue;
 327
 328                 if (S_ISDIR(s.st_mode)) {
 329
 330                         if (mountpoint &&
 331                             streq(dent->d_name, "lost+found") &&
 332                             s.st_uid == 0)
 333                                 continue;
 334
 335                         if (maxdepth <= 0)
 336                                 log_warning("Reached max depth on %s.", sub_path);
 337                         else {
 338                                 _cleanup_closedir_ DIR *sub_dir;
 339                                 int q;
 340
 341                                 sub_dir = xopendirat(dirfd(d), dent->d_name, O_NOFOLLOW|O_NOATIME);
 342                                 if (!sub_dir) {
 343                                         if (errno != ENOENT) {
 344                                                 log_error_errno(errno, "opendir(%s/%s) failed: %m", p, dent->d_name);
 345                                                 r = -errno;
 346                                         }
 347
 348                                         continue;
 349                                 }
 350
 351                                 q = dir_cleanup(i, sub_path, sub_dir, &s, cutoff, rootdev, false, maxdepth-1, false);
 352                                 if (q < 0)
 353                                         r = q;
 354                         }
 355
 356                         /* Note: if you are wondering why we don't
 357                          * support the sticky bit for excluding
 358                          * directories from cleaning like we do it for
 359                          * other file system objects: well, the sticky
 360                          * bit already has a meaning for directories,
 361                          * so we don't want to overload that. */
 362
 363                         if (keep_this_level)
 364                                 continue;
 365
 366                         /* Ignore ctime, we change it when deleting */
 367                         age = MAX(timespec_load(&s.st_mtim),
 368                                   timespec_load(&s.st_atim));
 369                         if (age >= cutoff)
 370                                 continue;
 371
 372                         if (i->type != IGNORE_DIRECTORY_PATH || !streq(dent->d_name, p)) {
 373                                 log_debug("rmdir '%s'", sub_path);
 374
 375                                 if (unlinkat(dirfd(d), dent->d_name, AT_REMOVEDIR) < 0) {
 376                                         if (errno != ENOENT && errno != ENOTEMPTY) {
 377                                                 log_error_errno(errno, "rmdir(%s): %m", sub_path);
 378                                                 r = -errno;
 379                                         }
 380                                 }
 381                         }
 382
 383                 } else {
 384                         /* Skip files for which the sticky bit is
 385                          * set. These are semantics we define, and are
 386                          * unknown elsewhere. See XDG_RUNTIME_DIR
 387                          * specification for details. */
 388                         if (s.st_mode & S_ISVTX)
 389                                 continue;
 390
 391                         if (mountpoint && S_ISREG(s.st_mode)) {
 392                                 if (streq(dent->d_name, ".journal") &&
 393                                     s.st_uid == 0)
 394                                         continue;
 395
 396                                 if (streq(dent->d_name, "aquota.user") ||
 397                                     streq(dent->d_name, "aquota.group"))
 398                                         continue;
 399                         }
 400
 401                         /* Ignore sockets that are listed in /proc/net/unix */
 402                         if (S_ISSOCK(s.st_mode) && unix_socket_alive(sub_path))
 403                                 continue;
 404
 405                         /* Ignore device nodes */
 406                         if (S_ISCHR(s.st_mode) || S_ISBLK(s.st_mode))
 407                                 continue;
 408
 409                         /* Keep files on this level around if this is
 410                          * requested */
 411                         if (keep_this_level)
 412                                 continue;
 413
 414                         age = MAX3(timespec_load(&s.st_mtim),
 415                                    timespec_load(&s.st_atim),
 416                                    timespec_load(&s.st_ctim));
 417
 418                         if (age >= cutoff)
 419                                 continue;
 420
 421                         log_debug("unlink '%s'", sub_path);
 422
 423                         if (unlinkat(dirfd(d), dent->d_name, 0) < 0) {
 424                                 if (errno != ENOENT) {
 425                                         log_error_errno(errno, "unlink(%s): %m", sub_path);
 426                                         r = -errno;
 427                                 }
 428                         }
 429
 430                         deleted = true;
 431                 }
 432         }
 433
 434 finish:
 435         if (deleted) {
 436                 /* Restore original directory timestamps */
 437                 times[0] = ds->st_atim;
 438                 times[1] = ds->st_mtim;
 439
 440                 if (futimens(dirfd(d), times) < 0)
 441                         log_error_errno(errno, "utimensat(%s): %m", p);
 442         }
 443
 444         return r;
 445 }
 446
 447 static int item_set_perms(Item *i, const char *path) {
 448         struct stat st;
 449         bool st_valid;
 450
 451         assert(i);
 452         assert(path);
 453
 454         st_valid = stat(path, &st) == 0;
 455
 456         /* not using i->path directly because it may be a glob */
 457         if (i->mode_set) {
 458                 mode_t m = i->mode;
 459
 460                 if (i->mask_perms && st_valid) {
 461                         if (!(st.st_mode & 0111))
 462                                 m &= ~0111;
 463                         if (!(st.st_mode & 0222))
 464                                 m &= ~0222;
 465                         if (!(st.st_mode & 0444))
 466                                 m &= ~0444;
 467                         if (!S_ISDIR(st.st_mode))
 468                                 m &= ~07000; /* remove sticky/sgid/suid bit, unless directory */
 469                 }
 470
 471                 if (!st_valid || m != (st.st_mode & 07777)) {
 472                         if (chmod(path, m) < 0)
 473                                 return log_error_errno(errno, "chmod(%s) failed: %m", path);
 474                 }
 475         }
 476
 477         if ((!st_valid || (i->uid != st.st_uid || i->gid != st.st_gid)) &&
 478             (i->uid_set || i->gid_set))
 479                 if (chown(path,
 480                           i->uid_set ? i->uid : UID_INVALID,
 481                           i->gid_set ? i->gid : GID_INVALID) < 0) {
 482
 483                         log_error_errno(errno, "chown(%s) failed: %m", path);
 484                         return -errno;
 485                 }
 486
 487         return label_fix(path, false, false);
 488 }
 489
 490 static int write_one_file(Item *i, const char *path) {
 491         _cleanup_close_ int fd = -1;
 492         int flags, r = 0;
 493         struct stat st;
 494
 495         assert(i);
 496         assert(path);
 497
 498         flags = i->type == CREATE_FILE ? O_CREAT|O_APPEND|O_NOFOLLOW :
 499                 i->type == TRUNCATE_FILE ? O_CREAT|O_TRUNC|O_NOFOLLOW : 0;
 500
 501         RUN_WITH_UMASK(0000) {
 502                 mac_selinux_create_file_prepare(path, S_IFREG);
 503                 fd = open(path, flags|O_NDELAY|O_CLOEXEC|O_WRONLY|O_NOCTTY, i->mode);
 504                 mac_selinux_create_file_clear();
 505         }
 506
 507         if (fd < 0) {
 508                 if (i->type == WRITE_FILE && errno == ENOENT)
 509                         return 0;
 510
 511                 log_error_errno(errno, "Failed to create file %s: %m", path);
 512                 return -errno;
 513         }
 514
 515         if (i->argument) {
 516                 _cleanup_free_ char *unescaped;
 517                 ssize_t n;
 518                 size_t l;
 519
 520                 unescaped = cunescape(i->argument);
 521                 if (!unescaped)
 522                         return log_oom();
 523
 524                 l = strlen(unescaped);
 525                 n = write(fd, unescaped, l);
 526
 527                 if (n < 0 || (size_t) n < l) {
 528                         log_error("Failed to write file %s: %s", path, n < 0 ? strerror(-n) : "Short write");
 529                         return n < 0 ? n : -EIO;
 530                 }
 531         }
 532
 533         fd = safe_close(fd);
 534
 535         if (stat(path, &st) < 0)
 536                 return log_error_errno(errno, "stat(%s) failed: %m", path);
 537
 538         if (!S_ISREG(st.st_mode)) {
 539                 log_error("%s is not a file.", path);
 540                 return -EEXIST;
 541         }
 542
 543         r = item_set_perms(i, path);
 544         if (r < 0)
 545                 return r;
 546
 547         return 0;
 548 }
 549
 550 static int item_set_perms_children(Item *i, const char *path) {
 551         _cleanup_closedir_ DIR *d;
 552         int r = 0;
 553
 554         assert(i);
 555         assert(path);
 556
 557         /* This returns the first error we run into, but nevertheless
 558          * tries to go on */
 559
 560         d = opendir(path);
 561         if (!d)
 562                 return errno == ENOENT || errno == ENOTDIR ? 0 : -errno;
 563
 564         for (;;) {
 565                 _cleanup_free_ char *p = NULL;
 566                 struct dirent *de;
 567                 int q;
 568
 569                 errno = 0;
 570                 de = readdir(d);
 571                 if (!de) {
 572                         if (errno != 0 && r == 0)
 573                                 r = -errno;
 574
 575                         break;
 576                 }
 577
 578                 if (streq(de->d_name, ".") || streq(de->d_name, ".."))
 579                         continue;
 580
 581                 p = strjoin(path, "/", de->d_name, NULL);
 582                 if (!p)
 583                         return -ENOMEM;
 584
 585                 q = item_set_perms(i, p);
 586                 if (q < 0 && q != -ENOENT && r == 0)
 587                         r = q;
 588
 589                 if (IN_SET(de->d_type, DT_UNKNOWN, DT_DIR)) {
 590                         q = item_set_perms_children(i, p);
 591                         if (q < 0 && r == 0)
 592                                 r = q;
 593                 }
 594         }
 595
 596         return r;
 597 }
 598
 599 static int item_set_perms_recursive(Item *i, const char *path) {
 600         int r, q;
 601
 602         assert(i);
 603         assert(path);
 604
 605         r = item_set_perms(i, path);
 606         if (r < 0)
 607                 return r;
 608
 609         q = item_set_perms_children(i, path);
 610         if (q < 0 && r == 0)
 611                 r = q;
 612
 613         return r;
 614 }
 615
 616 static int glob_item(Item *i, int (*action)(Item *, const char *)) {
 617         _cleanup_globfree_ glob_t g = {};
 618         int r = 0, k;
 619         char **fn;
 620
 621         errno = 0;
 622         k = glob(i->path, GLOB_NOSORT|GLOB_BRACE, NULL, &g);
 623         if (k != 0 && k != GLOB_NOMATCH) {
 624                 if (errno == 0)
 625                         errno = EIO;
 626
 627                 log_error_errno(errno, "glob(%s) failed: %m", i->path);
 628                 return -errno;
 629         }
 630
 631         STRV_FOREACH(fn, g.gl_pathv) {
 632                 k = action(i, *fn);
 633                 if (k < 0 && r == 0)
 634                         r = k;
 635         }
 636
 637         return r;
 638 }
 639
 640 static int create_item(Item *i) {
 641         struct stat st;
 642         int r = 0;
 643
 644         assert(i);
 645
 646         switch (i->type) {
 647
 648         case IGNORE_PATH:
 649         case IGNORE_DIRECTORY_PATH:
 650         case REMOVE_PATH:
 651         case RECURSIVE_REMOVE_PATH:
 652                 return 0;
 653
 654         case CREATE_FILE:
 655         case TRUNCATE_FILE:
 656                 r = write_one_file(i, i->path);
 657                 if (r < 0)
 658                         return r;
 659                 break;
 660
 661         case COPY_FILES:
 662                 r = copy_tree(i->argument, i->path, false);
 663                 if (r < 0) {
 664                         struct stat a, b;
 665
 666                         if (r != -EEXIST)
 667                                 return log_error_errno(r, "Failed to copy files to %s: %m", i->path);
 668
 669                         if (stat(i->argument, &a) < 0)
 670                                 return log_error_errno(errno, "stat(%s) failed: %m", i->argument);
 671
 672                         if (stat(i->path, &b) < 0)
 673                                 return log_error_errno(errno, "stat(%s) failed: %m", i->path);
 674
 675                         if ((a.st_mode ^ b.st_mode) & S_IFMT) {
 676                                 log_debug("Can't copy to %s, file exists already and is of different type", i->path);
 677                                 return 0;
 678                         }
 679                 }
 680
 681                 r = item_set_perms(i, i->path);
 682                 if (r < 0)
 683                         return r;
 684
 685                 break;
 686
 687         case WRITE_FILE:
 688                 r = glob_item(i, write_one_file);
 689                 if (r < 0)
 690                         return r;
 691
 692                 break;
 693
 694         case TRUNCATE_DIRECTORY:
 695         case CREATE_DIRECTORY:
 696
 697                 RUN_WITH_UMASK(0000) {
 698                         mkdir_parents_label(i->path, 0755);
 699                         r = mkdir_label(i->path, i->mode);
 700                 }
 701
 702                 if (r < 0) {
 703                         if (r != -EEXIST)
 704                                 return log_error_errno(r, "Failed to create directory %s: %m", i->path);
 705
 706                         if (stat(i->path, &st) < 0)
 707                                 return log_error_errno(errno, "stat(%s) failed: %m", i->path);
 708
 709                         if (!S_ISDIR(st.st_mode)) {
 710                                 log_debug("%s already exists and is not a directory.", i->path);
 711                                 return 0;
 712                         }
 713                 }
 714
 715                 r = item_set_perms(i, i->path);
 716                 if (r < 0)
 717                         return r;
 718
 719                 break;
 720
 721         case CREATE_FIFO:
 722
 723                 RUN_WITH_UMASK(0000) {
 724                         mac_selinux_create_file_prepare(i->path, S_IFIFO);
 725                         r = mkfifo(i->path, i->mode);
 726                         mac_selinux_create_file_clear();
 727                 }
 728
 729                 if (r < 0) {
 730                         if (errno != EEXIST)
 731                                 return log_error_errno(errno, "Failed to create fifo %s: %m", i->path);
 732
 733                         if (stat(i->path, &st) < 0)
 734                                 return log_error_errno(errno, "stat(%s) failed: %m", i->path);
 735
 736                         if (!S_ISFIFO(st.st_mode)) {
 737
 738                                 if (i->force) {
 739
 740                                         RUN_WITH_UMASK(0000) {
 741                                                 mac_selinux_create_file_prepare(i->path, S_IFIFO);
 742                                                 r = mkfifo_atomic(i->path, i->mode);
 743                                                 mac_selinux_create_file_clear();
 744                                         }
 745
 746                                         if (r < 0)
 747                                                 return log_error_errno(r, "Failed to create fifo %s: %m", i->path);
 748                                 } else {
 749                                         log_debug("%s is not a fifo.", i->path);
 750                                         return 0;
 751                                 }
 752                         }
 753                 }
 754
 755                 r = item_set_perms(i, i->path);
 756                 if (r < 0)
 757                         return r;
 758
 759                 break;
 760
 761         case CREATE_SYMLINK:
 762
 763                 mac_selinux_create_file_prepare(i->path, S_IFLNK);
 764                 r = symlink(i->argument, i->path);
 765                 mac_selinux_create_file_clear();
 766
 767                 if (r < 0) {
 768                         _cleanup_free_ char *x = NULL;
 769
 770                         if (errno != EEXIST)
 771                                 return log_error_errno(errno, "symlink(%s, %s) failed: %m", i->argument, i->path);
 772
 773                         r = readlink_malloc(i->path, &x);
 774                         if (r < 0 || !streq(i->argument, x)) {
 775
 776                                 if (i->force) {
 777                                         mac_selinux_create_file_prepare(i->path, S_IFLNK);
 778                                         r = symlink_atomic(i->argument, i->path);
 779                                         mac_selinux_create_file_clear();
 780
 781                                         if (r < 0)
 782                                                 return log_error_errno(r, "symlink(%s, %s) failed: %m", i->argument, i->path);
 783                                 } else {
 784                                         log_debug("%s is not a symlink or does not point to the correct path.", i->path);
 785                                         return 0;
 786                                 }
 787                         }
 788                 }
 789
 790                 break;
 791
 792         case CREATE_BLOCK_DEVICE:
 793         case CREATE_CHAR_DEVICE: {
 794                 mode_t file_type;
 795
 796                 if (have_effective_cap(CAP_MKNOD) == 0) {
 797                         /* In a container we lack CAP_MKNOD. We
 798                         shouldn't attempt to create the device node in
 799                         that case to avoid noise, and we don't support
 800                         virtualized devices in containers anyway. */
 801
 802                         log_debug("We lack CAP_MKNOD, skipping creation of device node %s.", i->path);
 803                         return 0;
 804                 }
 805
 806                 file_type = i->type == CREATE_BLOCK_DEVICE ? S_IFBLK : S_IFCHR;
 807
 808                 RUN_WITH_UMASK(0000) {
 809                         mac_selinux_create_file_prepare(i->path, file_type);
 810                         r = mknod(i->path, i->mode | file_type, i->major_minor);
 811                         mac_selinux_create_file_clear();
 812                 }
 813
 814                 if (r < 0) {
 815                         if (errno == EPERM) {
 816                                 log_debug("We lack permissions, possibly because of cgroup configuration; "
 817                                           "skipping creation of device node %s.", i->path);
 818                                 return 0;
 819                         }
 820
 821                         if (errno != EEXIST)
 822                                 return log_error_errno(errno, "Failed to create device node %s: %m", i->path);
 823
 824                         if (stat(i->path, &st) < 0)
 825                                 return log_error_errno(errno, "stat(%s) failed: %m", i->path);
 826
 827                         if ((st.st_mode & S_IFMT) != file_type) {
 828
 829                                 if (i->force) {
 830
 831                                         RUN_WITH_UMASK(0000) {
 832                                                 mac_selinux_create_file_prepare(i->path, file_type);
 833                                                 r = mknod_atomic(i->path, i->mode | file_type, i->major_minor);
 834                                                 mac_selinux_create_file_clear();
 835                                         }
 836
 837                                         if (r < 0)
 838                                                 return log_error_errno(r, "Failed to create device node %s: %m", i->path);
 839                                 } else {
 840                                         log_debug("%s is not a device node.", i->path);
 841                                         return 0;
 842                                 }
 843                         }
 844                 }
 845
 846                 r = item_set_perms(i, i->path);
 847                 if (r < 0)
 848                         return r;
 849
 850                 break;
 851         }
 852
 853         case ADJUST_MODE:
 854         case RELABEL_PATH:
 855
 856                 r = glob_item(i, item_set_perms);
 857                 if (r < 0)
 858                         return r;
 859                 break;
 860
 861         case RECURSIVE_RELABEL_PATH:
 862
 863                 r = glob_item(i, item_set_perms_recursive);
 864                 if (r < 0)
 865                         return r;
 866
 867                 break;
 868         }
 869
 870         log_debug("%s created successfully.", i->path);
 871
 872         return 0;
 873 }
 874
 875 static int remove_item_instance(Item *i, const char *instance) {
 876         int r;
 877
 878         assert(i);
 879
 880         switch (i->type) {
 881
 882         case CREATE_FILE:
 883         case TRUNCATE_FILE:
 884         case CREATE_DIRECTORY:
 885         case CREATE_FIFO:
 886         case CREATE_SYMLINK:
 887         case CREATE_BLOCK_DEVICE:
 888         case CREATE_CHAR_DEVICE:
 889         case IGNORE_PATH:
 890         case IGNORE_DIRECTORY_PATH:
 891         case ADJUST_MODE:
 892         case RELABEL_PATH:
 893         case RECURSIVE_RELABEL_PATH:
 894         case WRITE_FILE:
 895         case COPY_FILES:
 896                 break;
 897
 898         case REMOVE_PATH:
 899                 if (remove(instance) < 0 && errno != ENOENT)
 900                         return log_error_errno(errno, "remove(%s): %m", instance);
 901
 902                 break;
 903
 904         case TRUNCATE_DIRECTORY:
 905         case RECURSIVE_REMOVE_PATH:
 906                 /* FIXME: we probably should use dir_cleanup() here
 907                  * instead of rm_rf() so that 'x' is honoured. */
 908                 r = rm_rf_dangerous(instance, false, i->type == RECURSIVE_REMOVE_PATH, false);
 909                 if (r < 0 && r != -ENOENT)
 910                         return log_error_errno(r, "rm_rf(%s): %m", instance);
 911
 912                 break;
 913         }
 914
 915         return 0;
 916 }
 917
 918 static int remove_item(Item *i) {
 919         int r = 0;
 920
 921         assert(i);
 922
 923         switch (i->type) {
 924
 925         case CREATE_FILE:
 926         case TRUNCATE_FILE:
 927         case CREATE_DIRECTORY:
 928         case CREATE_FIFO:
 929         case CREATE_SYMLINK:
 930         case CREATE_CHAR_DEVICE:
 931         case CREATE_BLOCK_DEVICE:
 932         case IGNORE_PATH:
 933         case IGNORE_DIRECTORY_PATH:
 934         case ADJUST_MODE:
 935         case RELABEL_PATH:
 936         case RECURSIVE_RELABEL_PATH:
 937         case WRITE_FILE:
 938         case COPY_FILES:
 939                 break;
 940
 941         case REMOVE_PATH:
 942         case TRUNCATE_DIRECTORY:
 943         case RECURSIVE_REMOVE_PATH:
 944                 r = glob_item(i, remove_item_instance);
 945                 break;
 946         }
 947
 948         return r;
 949 }
 950
 951 static int clean_item_instance(Item *i, const char* instance) {
 952         _cleanup_closedir_ DIR *d = NULL;
 953         struct stat s, ps;
 954         bool mountpoint;
 955         int r;
 956         usec_t cutoff, n;
 957
 958         assert(i);
 959
 960         if (!i->age_set)
 961                 return 0;
 962
 963         n = now(CLOCK_REALTIME);
 964         if (n < i->age)
 965                 return 0;
 966
 967         cutoff = n - i->age;
 968
 969         d = opendir(instance);
 970         if (!d) {
 971                 if (errno == ENOENT || errno == ENOTDIR)
 972                         return 0;
 973
 974                 log_error_errno(errno, "Failed to open directory %s: %m", i->path);
 975                 return -errno;
 976         }
 977
 978         if (fstat(dirfd(d), &s) < 0)
 979                 return log_error_errno(errno, "stat(%s) failed: %m", i->path);
 980
 981         if (!S_ISDIR(s.st_mode)) {
 982                 log_error("%s is not a directory.", i->path);
 983                 return -ENOTDIR;
 984         }
 985
 986         if (fstatat(dirfd(d), "..", &ps, AT_SYMLINK_NOFOLLOW) != 0)
 987                 return log_error_errno(errno, "stat(%s/..) failed: %m", i->path);
 988
 989         mountpoint = s.st_dev != ps.st_dev ||
 990                      (s.st_dev == ps.st_dev && s.st_ino == ps.st_ino);
 991
 992         r = dir_cleanup(i, instance, d, &s, cutoff, s.st_dev, mountpoint,
 993                         MAX_DEPTH, i->keep_first_level);
 994         return r;
 995 }
 996
 997 static int clean_item(Item *i) {
 998         int r = 0;
 999
1000         assert(i);
1001
1002         switch (i->type) {
1003         case CREATE_DIRECTORY:
1004         case TRUNCATE_DIRECTORY:
1005         case IGNORE_PATH:
1006         case COPY_FILES:
1007                 clean_item_instance(i, i->path);
1008                 break;
1009         case IGNORE_DIRECTORY_PATH:
1010                 r = glob_item(i, clean_item_instance);
1011                 break;
1012         default:
1013                 break;
1014         }
1015
1016         return r;
1017 }
1018
1019 static int process_item(Item *i) {
1020         int r, q, p;
1021         _cleanup_free_ char *prefix = NULL;
1022
1023         assert(i);
1024
1025         if (i->done)
1026                 return 0;
1027
1028         i->done = true;
1029
1030         prefix = malloc(strlen(i->path) + 1);
1031         if (!prefix)
1032                 return log_oom();
1033
1034         PATH_FOREACH_PREFIX(prefix, i->path) {
1035                 Item *j;
1036
1037                 j = hashmap_get(items, prefix);
1038                 if (j)
1039                         process_item(j);
1040         }
1041
1042         r = arg_create ? create_item(i) : 0;
1043         q = arg_remove ? remove_item(i) : 0;
1044         p = arg_clean ? clean_item(i) : 0;
1045
1046         if (r < 0)
1047                 return r;
1048
1049         if (q < 0)
1050                 return q;
1051
1052         return p;
1053 }
1054
1055 static void item_free(Item *i) {
1056
1057         if (!i)
1058                 return;
1059
1060         free(i->path);
1061         free(i->argument);
1062         free(i);
1063 }
1064
1065 DEFINE_TRIVIAL_CLEANUP_FUNC(Item*, item_free);
1066
1067 static bool item_equal(Item *a, Item *b) {
1068         assert(a);
1069         assert(b);
1070
1071         if (!streq_ptr(a->path, b->path))
1072                 return false;
1073
1074         if (a->type != b->type)
1075                 return false;
1076
1077         if (a->uid_set != b->uid_set ||
1078             (a->uid_set && a->uid != b->uid))
1079             return false;
1080
1081         if (a->gid_set != b->gid_set ||
1082             (a->gid_set && a->gid != b->gid))
1083             return false;
1084
1085         if (a->mode_set != b->mode_set ||
1086             (a->mode_set && a->mode != b->mode))
1087             return false;
1088
1089         if (a->age_set != b->age_set ||
1090             (a->age_set && a->age != b->age))
1091             return false;
1092
1093         if ((a->type == CREATE_FILE ||
1094              a->type == TRUNCATE_FILE ||
1095              a->type == WRITE_FILE ||
1096              a->type == CREATE_SYMLINK ||
1097              a->type == COPY_FILES) &&
1098             !streq_ptr(a->argument, b->argument))
1099                 return false;
1100
1101         if ((a->type == CREATE_CHAR_DEVICE ||
1102              a->type == CREATE_BLOCK_DEVICE) &&
1103             a->major_minor != b->major_minor)
1104                 return false;
1105
1106         return true;
1107 }
1108
1109 static bool should_include_path(const char *path) {
1110         char **prefix;
1111
1112         STRV_FOREACH(prefix, arg_exclude_prefixes)
1113                 if (path_startswith(path, *prefix))
1114                         return false;
1115
1116         STRV_FOREACH(prefix, arg_include_prefixes)
1117                 if (path_startswith(path, *prefix))
1118                         return true;
1119
1120         /* no matches, so we should include this path only if we
1121          * have no whitelist at all */
1122         return strv_length(arg_include_prefixes) == 0;
1123 }
1124
1125 static int parse_line(const char *fname, unsigned line, const char *buffer) {
1126
1127         static const Specifier specifier_table[] = {
1128                 { 'm', specifier_machine_id, NULL },
1129                 { 'b', specifier_boot_id, NULL },
1130                 { 'H', specifier_host_name, NULL },
1131                 { 'v', specifier_kernel_release, NULL },
1132                 {}
1133         };
1134
1135         _cleanup_free_ char *action = NULL, *mode = NULL, *user = NULL, *group = NULL, *age = NULL, *path = NULL;
1136         _cleanup_(item_freep) Item *i = NULL;
1137         Item *existing;
1138         char type;
1139         Hashmap *h;
1140         int r, n = -1;
1141
1142         assert(fname);
1143         assert(line >= 1);
1144         assert(buffer);
1145
1146         r = sscanf(buffer,
1147                    "%ms %ms %ms %ms %ms %ms %n",
1148                    &action,
1149                    &path,
1150                    &mode,
1151                    &user,
1152                    &group,
1153                    &age,
1154                    &n);
1155         if (r < 2) {
1156                 log_error("[%s:%u] Syntax error.", fname, line);
1157                 return -EIO;
1158         }
1159
1160         if (isempty(action)) {
1161                 log_error("[%s:%u] Command too short '%s'.", fname, line, action);
1162                 return -EINVAL;
1163         }
1164
1165         if (strlen(action) > 1 && !in_charset(action+1, "!+")) {
1166                 log_error("[%s:%u] Unknown modifiers in command '%s'", fname, line, action);
1167                 return -EINVAL;
1168         }
1169
1170         if (strchr(action+1, '!') && !arg_boot)
1171                 return 0;
1172
1173         type = action[0];
1174
1175         i = new0(Item, 1);
1176         if (!i)
1177                 return log_oom();
1178
1179         i->force = !!strchr(action+1, '+');
1180
1181         r = specifier_printf(path, specifier_table, NULL, &i->path);
1182         if (r < 0) {
1183                 log_error("[%s:%u] Failed to replace specifiers: %s", fname, line, path);
1184                 return r;
1185         }
1186
1187         if (n >= 0)  {
1188                 n += strspn(buffer+n, WHITESPACE);
1189                 if (buffer[n] != 0 && (buffer[n] != '-' || buffer[n+1] != 0)) {
1190                         i->argument = unquote(buffer+n, "\"");
1191                         if (!i->argument)
1192                                 return log_oom();
1193                 }
1194         }
1195
1196         switch (type) {
1197
1198         case CREATE_FILE:
1199         case TRUNCATE_FILE:
1200         case CREATE_DIRECTORY:
1201         case TRUNCATE_DIRECTORY:
1202         case CREATE_FIFO:
1203         case IGNORE_PATH:
1204         case IGNORE_DIRECTORY_PATH:
1205         case REMOVE_PATH:
1206         case RECURSIVE_REMOVE_PATH:
1207         case ADJUST_MODE:
1208         case RELABEL_PATH:
1209         case RECURSIVE_RELABEL_PATH:
1210                 break;
1211
1212         case CREATE_SYMLINK:
1213                 if (!i->argument) {
1214                         i->argument = strappend("/usr/share/factory", i->path);
1215                         if (!i->argument)
1216                                 return log_oom();
1217                 }
1218                 break;
1219
1220         case WRITE_FILE:
1221                 if (!i->argument) {
1222                         log_error("[%s:%u] Write file requires argument.", fname, line);
1223                         return -EBADMSG;
1224                 }
1225                 break;
1226
1227         case COPY_FILES:
1228                 if (!i->argument) {
1229                         i->argument = strappend("/usr/share/factory", i->path);
1230                         if (!i->argument)
1231                                 return log_oom();
1232                 }
1233
1234                 if (!path_is_absolute(i->argument)) {
1235                         log_error("[%s:%u] Source path is not absolute.", fname, line);
1236                         return -EBADMSG;
1237                 }
1238
1239                 path_kill_slashes(i->argument);
1240                 break;
1241
1242         case CREATE_CHAR_DEVICE:
1243         case CREATE_BLOCK_DEVICE: {
1244                 unsigned major, minor;
1245
1246                 if (!i->argument) {
1247                         log_error("[%s:%u] Device file requires argument.", fname, line);
1248                         return -EBADMSG;
1249                 }
1250
1251                 if (sscanf(i->argument, "%u:%u", &major, &minor) != 2) {
1252                         log_error("[%s:%u] Can't parse device file major/minor '%s'.", fname, line, i->argument);
1253                         return -EBADMSG;
1254                 }
1255
1256                 i->major_minor = makedev(major, minor);
1257                 break;
1258         }
1259
1260         default:
1261                 log_error("[%s:%u] Unknown command type '%c'.", fname, line, type);
1262                 return -EBADMSG;
1263         }
1264
1265         i->type = type;
1266
1267         if (!path_is_absolute(i->path)) {
1268                 log_error("[%s:%u] Path '%s' not absolute.", fname, line, i->path);
1269                 return -EBADMSG;
1270         }
1271
1272         path_kill_slashes(i->path);
1273
1274         if (!should_include_path(i->path))
1275                 return 0;
1276
1277         if (arg_root) {
1278                 char *p;
1279
1280                 p = strappend(arg_root, i->path);
1281                 if (!p)
1282                         return log_oom();
1283
1284                 free(i->path);
1285                 i->path = p;
1286         }
1287
1288         if (user && !streq(user, "-")) {
1289                 const char *u = user;
1290
1291                 r = get_user_creds(&u, &i->uid, NULL, NULL, NULL);
1292                 if (r < 0) {
1293                         log_error("[%s:%u] Unknown user '%s'.", fname, line, user);
1294                         return r;
1295                 }
1296
1297                 i->uid_set = true;
1298         }
1299
1300         if (group && !streq(group, "-")) {
1301                 const char *g = group;
1302
1303                 r = get_group_creds(&g, &i->gid);
1304                 if (r < 0) {
1305                         log_error("[%s:%u] Unknown group '%s'.", fname, line, group);
1306                         return r;
1307                 }
1308
1309                 i->gid_set = true;
1310         }
1311
1312         if (mode && !streq(mode, "-")) {
1313                 const char *mm = mode;
1314                 unsigned m;
1315
1316                 if (*mm == '~') {
1317                         i->mask_perms = true;
1318                         mm++;
1319                 }
1320
1321                 if (sscanf(mm, "%o", &m) != 1) {
1322                         log_error("[%s:%u] Invalid mode '%s'.", fname, line, mode);
1323                         return -ENOENT;
1324                 }
1325
1326                 i->mode = m;
1327                 i->mode_set = true;
1328         } else
1329                 i->mode =
1330                         i->type == CREATE_DIRECTORY ||
1331                         i->type == TRUNCATE_DIRECTORY ? 0755 : 0644;
1332
1333         if (age && !streq(age, "-")) {
1334                 const char *a = age;
1335
1336                 if (*a == '~') {
1337                         i->keep_first_level = true;
1338                         a++;
1339                 }
1340
1341                 if (parse_sec(a, &i->age) < 0) {
1342                         log_error("[%s:%u] Invalid age '%s'.", fname, line, age);
1343                         return -EBADMSG;
1344                 }
1345
1346                 i->age_set = true;
1347         }
1348
1349         h = needs_glob(i->type) ? globs : items;
1350
1351         existing = hashmap_get(h, i->path);
1352         if (existing) {
1353
1354                 /* Two identical items are fine */
1355                 if (!item_equal(existing, i))
1356                         log_warning("Two or more conflicting lines for %s configured, ignoring.", i->path);
1357
1358                 return 0;
1359         }
1360
1361         r = hashmap_put(h, i->path, i);
1362         if (r < 0)
1363                 return log_error_errno(r, "Failed to insert item %s: %m", i->path);
1364
1365         i = NULL; /* avoid cleanup */
1366
1367         return 0;
1368 }
1369
1370 static void help(void) {
1371         printf("%s [OPTIONS...] [CONFIGURATION FILE...]\n\n"
1372                "Creates, deletes and cleans up volatile and temporary files and directories.\n\n"
1373                "  -h --help                 Show this help\n"
1374                "     --version              Show package version\n"
1375                "     --create               Create marked files/directories\n"
1376                "     --clean                Clean up marked directories\n"
1377                "     --remove               Remove marked files/directories\n"
1378                "     --boot                 Execute actions only safe at boot\n"
1379                "     --prefix=PATH          Only apply rules that apply to paths with the specified prefix\n"
1380                "     --exclude-prefix=PATH  Ignore rules that apply to paths with the specified prefix\n"
1381                "     --root=PATH            Operate on an alternate filesystem root\n",
1382                program_invocation_short_name);
1383 }
1384
1385 static int parse_argv(int argc, char *argv[]) {
1386
1387         enum {
1388                 ARG_VERSION = 0x100,
1389                 ARG_CREATE,
1390                 ARG_CLEAN,
1391                 ARG_REMOVE,
1392                 ARG_BOOT,
1393                 ARG_PREFIX,
1394                 ARG_EXCLUDE_PREFIX,
1395                 ARG_ROOT,
1396         };
1397
1398         static const struct option options[] = {
1399                 { "help",           no_argument,         NULL, 'h'                },
1400                 { "version",        no_argument,         NULL, ARG_VERSION        },
1401                 { "create",         no_argument,         NULL, ARG_CREATE         },
1402                 { "clean",          no_argument,         NULL, ARG_CLEAN          },
1403                 { "remove",         no_argument,         NULL, ARG_REMOVE         },
1404                 { "boot",           no_argument,         NULL, ARG_BOOT           },
1405                 { "prefix",         required_argument,   NULL, ARG_PREFIX         },
1406                 { "exclude-prefix", required_argument,   NULL, ARG_EXCLUDE_PREFIX },
1407                 { "root",           required_argument,   NULL, ARG_ROOT           },
1408                 {}
1409         };
1410
1411         int c;
1412
1413         assert(argc >= 0);
1414         assert(argv);
1415
1416         while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0)
1417
1418                 switch (c) {
1419
1420                 case 'h':
1421                         help();
1422                         return 0;
1423
1424                 case ARG_VERSION:
1425                         puts(PACKAGE_STRING);
1426                         puts(SYSTEMD_FEATURES);
1427                         return 0;
1428
1429                 case ARG_CREATE:
1430                         arg_create = true;
1431                         break;
1432
1433                 case ARG_CLEAN:
1434                         arg_clean = true;
1435                         break;
1436
1437                 case ARG_REMOVE:
1438                         arg_remove = true;
1439                         break;
1440
1441                 case ARG_BOOT:
1442                         arg_boot = true;
1443                         break;
1444
1445                 case ARG_PREFIX:
1446                         if (strv_push(&arg_include_prefixes, optarg) < 0)
1447                                 return log_oom();
1448                         break;
1449
1450                 case ARG_EXCLUDE_PREFIX:
1451                         if (strv_push(&arg_exclude_prefixes, optarg) < 0)
1452                                 return log_oom();
1453                         break;
1454
1455                 case ARG_ROOT:
1456                         free(arg_root);
1457                         arg_root = path_make_absolute_cwd(optarg);
1458                         if (!arg_root)
1459                                 return log_oom();
1460
1461                         path_kill_slashes(arg_root);
1462                         break;
1463
1464                 case '?':
1465                         return -EINVAL;
1466
1467                 default:
1468                         assert_not_reached("Unhandled option");
1469                 }
1470
1471         if (!arg_clean && !arg_create && !arg_remove) {
1472                 log_error("You need to specify at least one of --clean, --create or --remove.");
1473                 return -EINVAL;
1474         }
1475
1476         return 1;
1477 }
1478
1479 static int read_config_file(const char *fn, bool ignore_enoent) {
1480         _cleanup_fclose_ FILE *f = NULL;
1481         char line[LINE_MAX];
1482         Iterator iterator;
1483         unsigned v = 0;
1484         Item *i;
1485         int r;
1486
1487         assert(fn);
1488
1489         r = search_and_fopen_nulstr(fn, "re", arg_root, conf_file_dirs, &f);
1490         if (r < 0) {
1491                 if (ignore_enoent && r == -ENOENT)
1492                         return 0;
1493
1494                 return log_error_errno(r, "Failed to open '%s', ignoring: %m", fn);
1495         }
1496
1497         FOREACH_LINE(line, f, break) {
1498                 char *l;
1499                 int k;
1500
1501                 v++;
1502
1503                 l = strstrip(line);
1504                 if (*l == '#' || *l == 0)
1505                         continue;
1506
1507                 k = parse_line(fn, v, l);
1508                 if (k < 0 && r == 0)
1509                         r = k;
1510         }
1511
1512         /* we have to determine age parameter for each entry of type X */
1513         HASHMAP_FOREACH(i, globs, iterator) {
1514                 Iterator iter;
1515                 Item *j, *candidate_item = NULL;
1516
1517                 if (i->type != IGNORE_DIRECTORY_PATH)
1518                         continue;
1519
1520                 HASHMAP_FOREACH(j, items, iter) {
1521                         if (j->type != CREATE_DIRECTORY && j->type != TRUNCATE_DIRECTORY)
1522                                 continue;
1523
1524                         if (path_equal(j->path, i->path)) {
1525                                 candidate_item = j;
1526                                 break;
1527                         }
1528
1529                         if ((!candidate_item && path_startswith(i->path, j->path)) ||
1530                             (candidate_item && path_startswith(j->path, candidate_item->path) && (fnmatch(i->path, j->path, FNM_PATHNAME | FNM_PERIOD) == 0)))
1531                                 candidate_item = j;
1532                 }
1533
1534                 if (candidate_item && candidate_item->age_set) {
1535                         i->age = candidate_item->age;
1536                         i->age_set = true;
1537                 }
1538         }
1539
1540         if (ferror(f)) {
1541                 log_error_errno(errno, "Failed to read from file %s: %m", fn);
1542                 if (r == 0)
1543                         r = -EIO;
1544         }
1545
1546         return r;
1547 }
1548
1549 int main(int argc, char *argv[]) {
1550         int r, k;
1551         Item *i;
1552         Iterator iterator;
1553
1554         r = parse_argv(argc, argv);
1555         if (r <= 0)
1556                 goto finish;
1557
1558         log_set_target(LOG_TARGET_AUTO);
1559         log_parse_environment();
1560         log_open();
1561
1562         umask(0022);
1563
1564         mac_selinux_init(NULL);
1565
1566         items = hashmap_new(&string_hash_ops);
1567         globs = hashmap_new(&string_hash_ops);
1568
1569         if (!items || !globs) {
1570                 r = log_oom();
1571                 goto finish;
1572         }
1573
1574         r = 0;
1575
1576         if (optind < argc) {
1577                 int j;
1578
1579                 for (j = optind; j < argc; j++) {
1580                         k = read_config_file(argv[j], false);
1581                         if (k < 0 && r == 0)
1582                                 r = k;
1583                 }
1584
1585         } else {
1586                 _cleanup_strv_free_ char **files = NULL;
1587                 char **f;
1588
1589                 r = conf_files_list_nulstr(&files, ".conf", arg_root, conf_file_dirs);
1590                 if (r < 0) {
1591                         log_error_errno(r, "Failed to enumerate tmpfiles.d files: %m");
1592                         goto finish;
1593                 }
1594
1595                 STRV_FOREACH(f, files) {
1596                         k = read_config_file(*f, true);
1597                         if (k < 0 && r == 0)
1598                                 r = k;
1599                 }
1600         }
1601
1602         HASHMAP_FOREACH(i, globs, iterator)
1603                 process_item(i);
1604
1605         HASHMAP_FOREACH(i, items, iterator)
1606                 process_item(i);
1607
1608 finish:
1609         while ((i = hashmap_steal_first(items)))
1610                 item_free(i);
1611
1612         while ((i = hashmap_steal_first(globs)))
1613                 item_free(i);
1614
1615         hashmap_free(items);
1616         hashmap_free(globs);
1617
1618         free(arg_include_prefixes);
1619         free(arg_exclude_prefixes);
1620         free(arg_root);
1621
1622         set_free_free(unix_sockets);
1623
1624         mac_selinux_finish();
1625
1626         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
1627 }