along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/
-#include <assert.h>
-#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <sys/prctl.h>
-#include <linux/sched.h>
-#include <sys/types.h>
#include <sys/stat.h>
#include <grp.h>
-#include <pwd.h>
-#include <sys/mount.h>
-#include <linux/fs.h>
-#include <linux/oom.h>
-#include <sys/poll.h>
+#include <poll.h>
#include <glob.h>
#include <sys/personality.h>
-#include <libgen.h>
-#undef basename
#ifdef HAVE_PAM
#include <security/pam_appl.h>
#include "ioprio.h"
#include "securebits.h"
#include "namespace.h"
-#include "tcpwrap.h"
#include "exit-status.h"
#include "missing.h"
#include "utmp-wtmp.h"
#include "async.h"
#include "selinux-util.h"
#include "errno-list.h"
+#include "af-list.h"
+#include "mkdir.h"
+#include "smack-util.h"
+#include "bus-endpoint.h"
+#include "cap-list.h"
+
+#ifdef HAVE_APPARMOR
#include "apparmor-util.h"
+#endif
#ifdef HAVE_SECCOMP
#include "seccomp-util.h"
if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
return -errno;
- close_nointr_nofail(fds[i]);
+ safe_close(fds[i]);
fds[i] = nfd;
/* Hmm, the fd we wanted isn't free? Then
- * let's remember that and try again from here*/
+ * let's remember that and try again from here */
if (nfd != i+3 && restart_from < 0)
restart_from = i;
}
if (fd != nfd) {
r = dup2(fd, nfd) < 0 ? -errno : nfd;
- close_nointr_nofail(fd);
+ safe_close(fd);
} else
r = nfd;
return r;
}
-static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
- int fd, r;
+static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
union sockaddr_union sa = {
.un.sun_family = AF_UNIX,
.un.sun_path = "/run/systemd/journal/stdout",
};
+ uid_t olduid = UID_INVALID;
+ gid_t oldgid = GID_INVALID;
+ int r;
+
+ if (gid != GID_INVALID) {
+ oldgid = getgid();
+
+ r = setegid(gid);
+ if (r < 0)
+ return -errno;
+ }
+
+ if (uid != UID_INVALID) {
+ olduid = getuid();
+
+ r = seteuid(uid);
+ if (r < 0) {
+ r = -errno;
+ goto restore_gid;
+ }
+ }
+
+ r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
+ if (r < 0)
+ r = -errno;
+
+ /* If we fail to restore the uid or gid, things will likely
+ fail later on. This should only happen if an LSM interferes. */
+
+ if (uid != UID_INVALID)
+ (void) seteuid(olduid);
+
+ restore_gid:
+ if (gid != GID_INVALID)
+ (void) setegid(oldgid);
+
+ return r;
+}
+
+static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd, uid_t uid, gid_t gid) {
+ int fd, r;
assert(context);
assert(output < _EXEC_OUTPUT_MAX);
if (fd < 0)
return -errno;
- r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
- if (r < 0) {
- close_nointr_nofail(fd);
- return -errno;
- }
+ r = connect_journal_socket(fd, uid, gid);
+ if (r < 0)
+ return r;
if (shutdown(fd, SHUT_RD) < 0) {
- close_nointr_nofail(fd);
+ safe_close(fd);
return -errno;
}
if (fd != nfd) {
r = dup2(fd, nfd) < 0 ? -errno : nfd;
- close_nointr_nofail(fd);
+ safe_close(fd);
} else
r = nfd;
if (fd != nfd) {
r = dup2(fd, nfd) < 0 ? -errno : nfd;
- close_nointr_nofail(fd);
+ safe_close(fd);
} else
r = nfd;
i == EXEC_INPUT_TTY_FAIL,
i == EXEC_INPUT_TTY_FORCE,
false,
- (usec_t) -1);
+ USEC_INFINITY);
if (fd < 0)
return fd;
if (fd != STDIN_FILENO) {
r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
- close_nointr_nofail(fd);
+ safe_close(fd);
} else
r = STDIN_FILENO;
}
}
-static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
+static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin, uid_t uid, gid_t gid) {
ExecOutput o;
ExecInput i;
int r;
case EXEC_OUTPUT_KMSG_AND_CONSOLE:
case EXEC_OUTPUT_JOURNAL:
case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
- r = connect_logger_as(context, o, ident, unit_id, fileno);
+ r = connect_logger_as(context, o, ident, unit_id, fileno, uid, gid);
if (r < 0) {
- log_struct_unit(LOG_CRIT, unit_id,
- "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
- fileno == STDOUT_FILENO ? "out" : "err",
- unit_id, strerror(-r),
- "ERRNO=%d", -r,
- NULL);
+ log_unit_struct(unit_id,
+ LOG_ERR,
+ LOG_MESSAGE("Failed to connect %s of %s to the journal socket: %s",
+ fileno == STDOUT_FILENO ? "stdout" : "stderr",
+ unit_id, strerror(-r)),
+ LOG_ERRNO(-r),
+ NULL);
r = open_null_as(O_WRONLY, fileno);
}
return r;
}
if (fd >= 2)
- close_nointr_nofail(fd);
+ safe_close(fd);
*_saved_stdin = saved_stdin;
*_saved_stdout = saved_stdout;
return 0;
fail:
- if (saved_stdout >= 0)
- close_nointr_nofail(saved_stdout);
-
- if (saved_stdin >= 0)
- close_nointr_nofail(saved_stdin);
-
- if (fd >= 0)
- close_nointr_nofail(fd);
+ safe_close(saved_stdout);
+ safe_close(saved_stdin);
+ safe_close(fd);
return r;
}
_printf_(1, 2) static int write_confirm_message(const char *format, ...) {
- int fd;
+ _cleanup_close_ int fd = -1;
va_list ap;
assert(format);
vdprintf(fd, format, ap);
va_end(ap);
- close_nointr_nofail(fd);
-
return 0;
}
if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
r = -errno;
- if (*saved_stdin >= 0)
- close_nointr_nofail(*saved_stdin);
-
- if (*saved_stdout >= 0)
- close_nointr_nofail(*saved_stdout);
+ safe_close(*saved_stdin);
+ safe_close(*saved_stdout);
return r;
}
static int ask_for_confirmation(char *response, char **argv) {
int saved_stdout = -1, saved_stdin = -1, r;
- char *line;
+ _cleanup_free_ char *line = NULL;
r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
if (r < 0)
if (!line)
return -ENOMEM;
- r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
- free(line);
+ r = ask_char(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
restore_confirm_stdio(&saved_stdin, &saved_stdout);
* daemon. We do things this way to ensure that the main PID
* of the daemon is the one we initially fork()ed. */
- if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
+ if (log_get_max_level() < LOG_DEBUG)
flags |= PAM_SILENT;
pam_code = pam_start(name, user, &conv, &handle);
* If this fails, ignore the error - but expect sd-pam threads
* to fail to exit normally */
if (setresuid(uid, uid, uid) < 0)
- log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
+ log_error_errno(r, "Error: Failed to setresuid() in sd-pam: %m");
/* Wait until our parent died. This will only work if
* the above setresuid() succeeds, otherwise the kernel
log_error("PAM failed: %s", pam_strerror(handle, pam_code));
err = -EPERM; /* PAM errors do not map to errno */
} else {
- log_error("PAM failed: %m");
+ log_error_errno(errno, "PAM failed: %m");
err = -errno;
}
#ifdef HAVE_SECCOMP
-static int apply_seccomp(ExecContext *c) {
+static int apply_seccomp(const ExecContext *c) {
uint32_t negative_action, action;
scmp_filter_ctx *seccomp;
Iterator i;
r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
if (r == -EEXIST)
continue;
- if (r < 0) {
- seccomp_release(seccomp);
- return r;
- }
+ if (r < 0)
+ goto finish;
}
- } else {
+ } else {
r = seccomp_add_secondary_archs(seccomp);
- if (r < 0) {
- seccomp_release(seccomp);
- return r;
- }
+ if (r < 0)
+ goto finish;
}
action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
SET_FOREACH(id, c->syscall_filter, i) {
r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
- if (r < 0) {
- seccomp_release(seccomp);
- return r;
- }
+ if (r < 0)
+ goto finish;
}
+ r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
+ if (r < 0)
+ goto finish;
+
r = seccomp_load(seccomp);
+
+finish:
seccomp_release(seccomp);
+ return r;
+}
+
+static int apply_address_families(const ExecContext *c) {
+ scmp_filter_ctx *seccomp;
+ Iterator i;
+ int r;
+
+ assert(c);
+
+ seccomp = seccomp_init(SCMP_ACT_ALLOW);
+ if (!seccomp)
+ return -ENOMEM;
+
+ r = seccomp_add_secondary_archs(seccomp);
+ if (r < 0)
+ goto finish;
+ if (c->address_families_whitelist) {
+ int af, first = 0, last = 0;
+ void *afp;
+
+ /* If this is a whitelist, we first block the address
+ * families that are out of range and then everything
+ * that is not in the set. First, we find the lowest
+ * and highest address family in the set. */
+
+ SET_FOREACH(afp, c->address_families, i) {
+ af = PTR_TO_INT(afp);
+
+ if (af <= 0 || af >= af_max())
+ continue;
+
+ if (first == 0 || af < first)
+ first = af;
+
+ if (last == 0 || af > last)
+ last = af;
+ }
+
+ assert((first == 0) == (last == 0));
+
+ if (first == 0) {
+
+ /* No entries in the valid range, block everything */
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPROTONOSUPPORT),
+ SCMP_SYS(socket),
+ 0);
+ if (r < 0)
+ goto finish;
+
+ } else {
+
+ /* Block everything below the first entry */
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPROTONOSUPPORT),
+ SCMP_SYS(socket),
+ 1,
+ SCMP_A0(SCMP_CMP_LT, first));
+ if (r < 0)
+ goto finish;
+
+ /* Block everything above the last entry */
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPROTONOSUPPORT),
+ SCMP_SYS(socket),
+ 1,
+ SCMP_A0(SCMP_CMP_GT, last));
+ if (r < 0)
+ goto finish;
+
+ /* Block everything between the first and last
+ * entry */
+ for (af = 1; af < af_max(); af++) {
+
+ if (set_contains(c->address_families, INT_TO_PTR(af)))
+ continue;
+
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPROTONOSUPPORT),
+ SCMP_SYS(socket),
+ 1,
+ SCMP_A0(SCMP_CMP_EQ, af));
+ if (r < 0)
+ goto finish;
+ }
+ }
+
+ } else {
+ void *af;
+
+ /* If this is a blacklist, then generate one rule for
+ * each address family that are then combined in OR
+ * checks. */
+
+ SET_FOREACH(af, c->address_families, i) {
+
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPROTONOSUPPORT),
+ SCMP_SYS(socket),
+ 1,
+ SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
+ if (r < 0)
+ goto finish;
+ }
+ }
+
+ r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
+ if (r < 0)
+ goto finish;
+
+ r = seccomp_load(seccomp);
+
+finish:
+ seccomp_release(seccomp);
return r;
}
+
#endif
static void do_idle_pipe_dance(int idle_pipe[4]) {
assert(idle_pipe);
- if (idle_pipe[1] >= 0)
- close_nointr_nofail(idle_pipe[1]);
- if (idle_pipe[2] >= 0)
- close_nointr_nofail(idle_pipe[2]);
+
+ safe_close(idle_pipe[1]);
+ safe_close(idle_pipe[2]);
if (idle_pipe[0] >= 0) {
int r;
if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
/* Signal systemd that we are bored and want to continue. */
- write(idle_pipe[3], "x", 1);
-
- /* Wait for systemd to react to the signal above. */
- fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
+ r = write(idle_pipe[3], "x", 1);
+ if (r > 0)
+ /* Wait for systemd to react to the signal above. */
+ fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
}
- close_nointr_nofail(idle_pipe[0]);
+ safe_close(idle_pipe[0]);
}
- if (idle_pipe[3] >= 0)
- close_nointr_nofail(idle_pipe[3]);
+ safe_close(idle_pipe[3]);
}
static int build_environment(
- ExecContext *c,
+ const ExecContext *c,
unsigned n_fds,
usec_t watchdog_usec,
const char *home,
return -ENOMEM;
our_env[n_env++] = x;
- if (asprintf(&x, "WATCHDOG_USEC=%llu", (unsigned long long) watchdog_usec) < 0)
+ if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, watchdog_usec) < 0)
return -ENOMEM;
our_env[n_env++] = x;
}
return 0;
}
-int exec_spawn(ExecCommand *command,
- char **argv,
- ExecContext *context,
- int fds[], unsigned n_fds,
- char **environment,
- bool apply_permissions,
- bool apply_chroot,
- bool apply_tty_stdin,
- bool confirm_spawn,
- CGroupControllerMask cgroup_supported,
- const char *cgroup_path,
- const char *unit_id,
- usec_t watchdog_usec,
- int idle_pipe[4],
- ExecRuntime *runtime,
- pid_t *ret) {
-
- _cleanup_strv_free_ char **files_env = NULL;
- int socket_fd;
- char *line;
- pid_t pid;
- int r;
+static int exec_child(
+ ExecCommand *command,
+ const ExecContext *context,
+ const ExecParameters *params,
+ ExecRuntime *runtime,
+ char **argv,
+ int socket_fd,
+ int *fds, unsigned n_fds,
+ char **files_env,
+ int *exit_status) {
+
+ _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
+ _cleanup_free_ char *mac_selinux_context_net = NULL;
+ const char *username = NULL, *home = NULL, *shell = NULL;
+ unsigned n_dont_close = 0;
+ int dont_close[n_fds + 4];
+ uid_t uid = UID_INVALID;
+ gid_t gid = GID_INVALID;
+ int i, r;
assert(command);
assert(context);
- assert(ret);
- assert(fds || n_fds <= 0);
+ assert(params);
+ assert(exit_status);
- if (context->std_input == EXEC_INPUT_SOCKET ||
- context->std_output == EXEC_OUTPUT_SOCKET ||
- context->std_error == EXEC_OUTPUT_SOCKET) {
+ rename_process_from_path(command->path);
- if (n_fds != 1)
- return -EINVAL;
-
- socket_fd = fds[0];
+ /* We reset exactly these signals, since they are the
+ * only ones we set to SIG_IGN in the main daemon. All
+ * others we leave untouched because we set them to
+ * SIG_DFL or a valid handler initially, both of which
+ * will be demoted to SIG_DFL. */
+ default_signals(SIGNALS_CRASH_HANDLER,
+ SIGNALS_IGNORE, -1);
- fds = NULL;
- n_fds = 0;
- } else
- socket_fd = -1;
+ if (context->ignore_sigpipe)
+ ignore_signals(SIGPIPE, -1);
- r = exec_context_load_environment(context, &files_env);
+ r = reset_signal_mask();
if (r < 0) {
- log_struct_unit(LOG_ERR,
- unit_id,
- "MESSAGE=Failed to load environment files: %s", strerror(-r),
- "ERRNO=%d", -r,
- NULL);
+ *exit_status = EXIT_SIGNAL_MASK;
return r;
}
- if (!argv)
- argv = command->argv;
-
- line = exec_command_line(argv);
- if (!line)
- return log_oom();
-
- log_struct_unit(LOG_DEBUG,
- unit_id,
- "EXECUTABLE=%s", command->path,
- "MESSAGE=About to execute: %s", line,
- NULL);
- free(line);
+ if (params->idle_pipe)
+ do_idle_pipe_dance(params->idle_pipe);
- pid = fork();
- if (pid < 0)
- return -errno;
+ /* Close sockets very early to make sure we don't
+ * block init reexecution because it cannot bind its
+ * sockets */
- if (pid == 0) {
- _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
- const char *username = NULL, *home = NULL, *shell = NULL;
- unsigned n_dont_close = 0;
- int dont_close[n_fds + 3];
- uid_t uid = (uid_t) -1;
- gid_t gid = (gid_t) -1;
- sigset_t ss;
- int i, err;
-
- /* child */
-
- rename_process_from_path(command->path);
-
- /* We reset exactly these signals, since they are the
- * only ones we set to SIG_IGN in the main daemon. All
- * others we leave untouched because we set them to
- * SIG_DFL or a valid handler initially, both of which
- * will be demoted to SIG_DFL. */
- default_signals(SIGNALS_CRASH_HANDLER,
- SIGNALS_IGNORE, -1);
-
- if (context->ignore_sigpipe)
- ignore_signals(SIGPIPE, -1);
-
- assert_se(sigemptyset(&ss) == 0);
- if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
- err = -errno;
- r = EXIT_SIGNAL_MASK;
- goto fail_child;
- }
+ log_forget_fds();
- if (idle_pipe)
- do_idle_pipe_dance(idle_pipe);
+ if (socket_fd >= 0)
+ dont_close[n_dont_close++] = socket_fd;
+ if (n_fds > 0) {
+ memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
+ n_dont_close += n_fds;
+ }
+ if (params->bus_endpoint_fd >= 0)
+ dont_close[n_dont_close++] = params->bus_endpoint_fd;
+ if (runtime) {
+ if (runtime->netns_storage_socket[0] >= 0)
+ dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
+ if (runtime->netns_storage_socket[1] >= 0)
+ dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
+ }
- /* Close sockets very early to make sure we don't
- * block init reexecution because it cannot bind its
- * sockets */
- log_forget_fds();
+ r = close_all_fds(dont_close, n_dont_close);
+ if (r < 0) {
+ *exit_status = EXIT_FDS;
+ return r;
+ }
- if (socket_fd >= 0)
- dont_close[n_dont_close++] = socket_fd;
- if (n_fds > 0) {
- memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
- n_dont_close += n_fds;
+ if (!context->same_pgrp)
+ if (setsid() < 0) {
+ *exit_status = EXIT_SETSID;
+ return -errno;
}
- if (runtime) {
- if (runtime->netns_storage_socket[0] >= 0)
- dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
- if (runtime->netns_storage_socket[1] >= 0)
- dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
+
+ exec_context_tty_reset(context);
+
+ if (params->confirm_spawn) {
+ char response;
+
+ r = ask_for_confirmation(&response, argv);
+ if (r == -ETIMEDOUT)
+ write_confirm_message("Confirmation question timed out, assuming positive response.\n");
+ else if (r < 0)
+ write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-r));
+ else if (response == 's') {
+ write_confirm_message("Skipping execution.\n");
+ *exit_status = EXIT_CONFIRM;
+ return -ECANCELED;
+ } else if (response == 'n') {
+ write_confirm_message("Failing execution.\n");
+ *exit_status = 0;
+ return 0;
}
+ }
- err = close_all_fds(dont_close, n_dont_close);
- if (err < 0) {
- r = EXIT_FDS;
- goto fail_child;
+ if (context->user) {
+ username = context->user;
+ r = get_user_creds(&username, &uid, &gid, &home, &shell);
+ if (r < 0) {
+ *exit_status = EXIT_USER;
+ return r;
}
+ }
- if (!context->same_pgrp)
- if (setsid() < 0) {
- err = -errno;
- r = EXIT_SETSID;
- goto fail_child;
- }
+ /* If a socket is connected to STDIN/STDOUT/STDERR, we
+ * must sure to drop O_NONBLOCK */
+ if (socket_fd >= 0)
+ fd_nonblock(socket_fd, false);
- if (context->tcpwrap_name) {
- if (socket_fd >= 0)
- if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
- err = -EACCES;
- r = EXIT_TCPWRAP;
- goto fail_child;
- }
+ r = setup_input(context, socket_fd, params->apply_tty_stdin);
+ if (r < 0) {
+ *exit_status = EXIT_STDIN;
+ return r;
+ }
- for (i = 0; i < (int) n_fds; i++) {
- if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
- err = -EACCES;
- r = EXIT_TCPWRAP;
- goto fail_child;
- }
- }
- }
+ r = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin, uid, gid);
+ if (r < 0) {
+ *exit_status = EXIT_STDOUT;
+ return r;
+ }
- exec_context_tty_reset(context);
+ r = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin, uid, gid);
+ if (r < 0) {
+ *exit_status = EXIT_STDERR;
+ return r;
+ }
- if (confirm_spawn) {
- char response;
-
- err = ask_for_confirmation(&response, argv);
- if (err == -ETIMEDOUT)
- write_confirm_message("Confirmation question timed out, assuming positive response.\n");
- else if (err < 0)
- write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
- else if (response == 's') {
- write_confirm_message("Skipping execution.\n");
- err = -ECANCELED;
- r = EXIT_CONFIRM;
- goto fail_child;
- } else if (response == 'n') {
- write_confirm_message("Failing execution.\n");
- err = r = 0;
- goto fail_child;
- }
+ if (params->cgroup_path) {
+ r = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0, NULL, NULL);
+ if (r < 0) {
+ *exit_status = EXIT_CGROUP;
+ return r;
}
+ }
+
+ if (context->oom_score_adjust_set) {
+ char t[DECIMAL_STR_MAX(context->oom_score_adjust)];
- /* If a socket is connected to STDIN/STDOUT/STDERR, we
- * must sure to drop O_NONBLOCK */
- if (socket_fd >= 0)
- fd_nonblock(socket_fd, false);
+ /* When we can't make this change due to EPERM, then
+ * let's silently skip over it. User namespaces
+ * prohibit write access to this file, and we
+ * shouldn't trip up over that. */
- err = setup_input(context, socket_fd, apply_tty_stdin);
- if (err < 0) {
- r = EXIT_STDIN;
- goto fail_child;
+ sprintf(t, "%i", context->oom_score_adjust);
+ r = write_string_file("/proc/self/oom_score_adj", t);
+ if (r == -EPERM || r == -EACCES) {
+ log_open();
+ log_unit_debug_errno(params->unit_id, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
+ log_close();
+ } else if (r < 0) {
+ *exit_status = EXIT_OOM_ADJUST;
+ return -errno;
}
+ }
- err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
- if (err < 0) {
- r = EXIT_STDOUT;
- goto fail_child;
+ if (context->nice_set)
+ if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
+ *exit_status = EXIT_NICE;
+ return -errno;
}
- err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
- if (err < 0) {
- r = EXIT_STDERR;
- goto fail_child;
+ if (context->cpu_sched_set) {
+ struct sched_param param = {
+ .sched_priority = context->cpu_sched_priority,
+ };
+
+ r = sched_setscheduler(0,
+ context->cpu_sched_policy |
+ (context->cpu_sched_reset_on_fork ?
+ SCHED_RESET_ON_FORK : 0),
+ ¶m);
+ if (r < 0) {
+ *exit_status = EXIT_SETSCHEDULER;
+ return -errno;
}
+ }
- if (cgroup_path) {
- err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
- if (err < 0) {
- r = EXIT_CGROUP;
- goto fail_child;
- }
+ if (context->cpuset)
+ if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
+ *exit_status = EXIT_CPUAFFINITY;
+ return -errno;
}
- if (context->oom_score_adjust_set) {
- char t[16];
+ if (context->ioprio_set)
+ if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
+ *exit_status = EXIT_IOPRIO;
+ return -errno;
+ }
- snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
- char_array_0(t);
+ if (context->timer_slack_nsec != NSEC_INFINITY)
+ if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
+ *exit_status = EXIT_TIMERSLACK;
+ return -errno;
+ }
- if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
- err = -errno;
- r = EXIT_OOM_ADJUST;
- goto fail_child;
- }
+ if (context->personality != 0xffffffffUL)
+ if (personality(context->personality) < 0) {
+ *exit_status = EXIT_PERSONALITY;
+ return -errno;
}
- if (context->nice_set)
- if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
- err = -errno;
- r = EXIT_NICE;
- goto fail_child;
- }
+ if (context->utmp_id)
+ utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
- if (context->cpu_sched_set) {
- struct sched_param param = {
- .sched_priority = context->cpu_sched_priority,
- };
+ if (context->user && is_terminal_input(context->std_input)) {
+ r = chown_terminal(STDIN_FILENO, uid);
+ if (r < 0) {
+ *exit_status = EXIT_STDIN;
+ return r;
+ }
+ }
- r = sched_setscheduler(0,
- context->cpu_sched_policy |
- (context->cpu_sched_reset_on_fork ?
- SCHED_RESET_ON_FORK : 0),
- ¶m);
- if (r < 0) {
- err = -errno;
- r = EXIT_SETSCHEDULER;
- goto fail_child;
- }
+#ifdef ENABLE_KDBUS
+ if (params->bus_endpoint_fd >= 0 && context->bus_endpoint) {
+ uid_t ep_uid = (uid == UID_INVALID) ? 0 : uid;
+
+ r = bus_kernel_set_endpoint_policy(params->bus_endpoint_fd, ep_uid, context->bus_endpoint);
+ if (r < 0) {
+ *exit_status = EXIT_BUS_ENDPOINT;
+ return r;
}
+ }
+#endif
- if (context->cpuset)
- if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
- err = -errno;
- r = EXIT_CPUAFFINITY;
- goto fail_child;
- }
+ /* If delegation is enabled we'll pass ownership of the cgroup
+ * (but only in systemd's own controller hierarchy!) to the
+ * user of the new process. */
+ if (params->cgroup_path && context->user && params->cgroup_delegate) {
+ r = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
+ if (r < 0) {
+ *exit_status = EXIT_CGROUP;
+ return r;
+ }
- if (context->ioprio_set)
- if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
- err = -errno;
- r = EXIT_IOPRIO;
- goto fail_child;
- }
- if (context->timer_slack_nsec != (nsec_t) -1)
- if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
- err = -errno;
- r = EXIT_TIMERSLACK;
- goto fail_child;
- }
+ r = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
+ if (r < 0) {
+ *exit_status = EXIT_CGROUP;
+ return r;
+ }
+ }
- if (context->personality != 0xffffffffUL)
- if (personality(context->personality) < 0) {
- err = -errno;
- r = EXIT_PERSONALITY;
- goto fail_child;
- }
+ if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
+ char **rt;
- if (context->utmp_id)
- utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
+ STRV_FOREACH(rt, context->runtime_directory) {
+ _cleanup_free_ char *p;
- if (context->user) {
- username = context->user;
- err = get_user_creds(&username, &uid, &gid, &home, &shell);
- if (err < 0) {
- r = EXIT_USER;
- goto fail_child;
+ p = strjoin(params->runtime_prefix, "/", *rt, NULL);
+ if (!p) {
+ *exit_status = EXIT_RUNTIME_DIRECTORY;
+ return -ENOMEM;
}
- if (is_terminal_input(context->std_input)) {
- err = chown_terminal(STDIN_FILENO, uid);
- if (err < 0) {
- r = EXIT_STDIN;
- goto fail_child;
- }
+ r = mkdir_safe_label(p, context->runtime_directory_mode, uid, gid);
+ if (r < 0) {
+ *exit_status = EXIT_RUNTIME_DIRECTORY;
+ return r;
}
}
+ }
-#ifdef HAVE_PAM
- if (cgroup_path && context->user && context->pam_name) {
- err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
- if (err < 0) {
- r = EXIT_CGROUP;
- goto fail_child;
- }
+ if (params->apply_permissions) {
+ r = enforce_groups(context, username, gid);
+ if (r < 0) {
+ *exit_status = EXIT_GROUP;
+ return r;
+ }
+ }
+ umask(context->umask);
- err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
- if (err < 0) {
- r = EXIT_CGROUP;
- goto fail_child;
- }
+#ifdef HAVE_PAM
+ if (params->apply_permissions && context->pam_name && username) {
+ r = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
+ if (r < 0) {
+ *exit_status = EXIT_PAM;
+ return r;
}
+ }
#endif
- if (apply_permissions) {
- err = enforce_groups(context, username, gid);
- if (err < 0) {
- r = EXIT_GROUP;
- goto fail_child;
- }
+ if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
+ r = setup_netns(runtime->netns_storage_socket);
+ if (r < 0) {
+ *exit_status = EXIT_NETWORK;
+ return r;
}
+ }
- umask(context->umask);
-
-#ifdef HAVE_PAM
- if (apply_permissions && context->pam_name && username) {
- err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
- if (err < 0) {
- r = EXIT_PAM;
- goto fail_child;
- }
+ if (!strv_isempty(context->read_write_dirs) ||
+ !strv_isempty(context->read_only_dirs) ||
+ !strv_isempty(context->inaccessible_dirs) ||
+ context->mount_flags != 0 ||
+ (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
+ params->bus_endpoint_path ||
+ context->private_devices ||
+ context->protect_system != PROTECT_SYSTEM_NO ||
+ context->protect_home != PROTECT_HOME_NO) {
+
+ char *tmp = NULL, *var = NULL;
+
+ /* The runtime struct only contains the parent
+ * of the private /tmp, which is
+ * non-accessible to world users. Inside of it
+ * there's a /tmp that is sticky, and that's
+ * the one we want to use here. */
+
+ if (context->private_tmp && runtime) {
+ if (runtime->tmp_dir)
+ tmp = strjoina(runtime->tmp_dir, "/tmp");
+ if (runtime->var_tmp_dir)
+ var = strjoina(runtime->var_tmp_dir, "/tmp");
}
-#endif
- if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
- err = setup_netns(runtime->netns_storage_socket);
- if (err < 0) {
- r = EXIT_NETWORK;
- goto fail_child;
- }
+
+ r = setup_namespace(
+ context->read_write_dirs,
+ context->read_only_dirs,
+ context->inaccessible_dirs,
+ tmp,
+ var,
+ params->bus_endpoint_path,
+ context->private_devices,
+ context->protect_home,
+ context->protect_system,
+ context->mount_flags);
+
+ /* If we couldn't set up the namespace this is
+ * probably due to a missing capability. In this case,
+ * silently proceeed. */
+ if (r == -EPERM || r == -EACCES) {
+ log_open();
+ log_unit_debug_errno(params->unit_id, r, "Failed to set up namespace, assuming containerized execution, ignoring: %m");
+ log_close();
+ } else if (r < 0) {
+ *exit_status = EXIT_NAMESPACE;
+ return r;
}
+ }
- if (!strv_isempty(context->read_write_dirs) ||
- !strv_isempty(context->read_only_dirs) ||
- !strv_isempty(context->inaccessible_dirs) ||
- context->mount_flags != 0 ||
- (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
- context->private_devices) {
-
- char *tmp = NULL, *var = NULL;
-
- /* The runtime struct only contains the parent
- * of the private /tmp, which is
- * non-accessible to world users. Inside of it
- * there's a /tmp that is sticky, and that's
- * the one we want to use here. */
-
- if (context->private_tmp && runtime) {
- if (runtime->tmp_dir)
- tmp = strappenda(runtime->tmp_dir, "/tmp");
- if (runtime->var_tmp_dir)
- var = strappenda(runtime->var_tmp_dir, "/tmp");
+ if (params->apply_chroot) {
+ if (context->root_directory)
+ if (chroot(context->root_directory) < 0) {
+ *exit_status = EXIT_CHROOT;
+ return -errno;
}
- err = setup_namespace(
- context->read_write_dirs,
- context->read_only_dirs,
- context->inaccessible_dirs,
- tmp,
- var,
- context->private_devices,
- context->mount_flags);
-
- if (err < 0) {
- r = EXIT_NAMESPACE;
- goto fail_child;
- }
+ if (chdir(context->working_directory ?: "/") < 0 &&
+ !context->working_directory_missing_ok) {
+ *exit_status = EXIT_CHDIR;
+ return -errno;
}
+ } else {
+ _cleanup_free_ char *d = NULL;
- if (apply_chroot) {
- if (context->root_directory)
- if (chroot(context->root_directory) < 0) {
- err = -errno;
- r = EXIT_CHROOT;
- goto fail_child;
- }
-
- if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
- err = -errno;
- r = EXIT_CHDIR;
- goto fail_child;
- }
- } else {
- _cleanup_free_ char *d = NULL;
-
- if (asprintf(&d, "%s/%s",
- context->root_directory ? context->root_directory : "",
- context->working_directory ? context->working_directory : "") < 0) {
- err = -ENOMEM;
- r = EXIT_MEMORY;
- goto fail_child;
- }
+ if (asprintf(&d, "%s/%s",
+ context->root_directory ?: "",
+ context->working_directory ?: "") < 0) {
+ *exit_status = EXIT_MEMORY;
+ return -ENOMEM;
+ }
- if (chdir(d) < 0) {
- err = -errno;
- r = EXIT_CHDIR;
- goto fail_child;
- }
+ if (chdir(d) < 0 &&
+ !context->working_directory_missing_ok) {
+ *exit_status = EXIT_CHDIR;
+ return -errno;
}
+ }
- /* We repeat the fd closing here, to make sure that
- * nothing is leaked from the PAM modules */
- err = close_all_fds(fds, n_fds);
- if (err >= 0)
- err = shift_fds(fds, n_fds);
- if (err >= 0)
- err = flags_fds(fds, n_fds, context->non_blocking);
- if (err < 0) {
- r = EXIT_FDS;
- goto fail_child;
+#ifdef HAVE_SELINUX
+ if (params->apply_permissions && mac_selinux_use() && params->selinux_context_net && socket_fd >= 0) {
+ r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
+ if (r < 0) {
+ *exit_status = EXIT_SELINUX_CONTEXT;
+ return r;
}
+ }
+#endif
- if (apply_permissions) {
+ /* We repeat the fd closing here, to make sure that
+ * nothing is leaked from the PAM modules. Note that
+ * we are more aggressive this time since socket_fd
+ * and the netns fds we don't need anymore. The custom
+ * endpoint fd was needed to upload the policy and can
+ * now be closed as well. */
+ r = close_all_fds(fds, n_fds);
+ if (r >= 0)
+ r = shift_fds(fds, n_fds);
+ if (r >= 0)
+ r = flags_fds(fds, n_fds, context->non_blocking);
+ if (r < 0) {
+ *exit_status = EXIT_FDS;
+ return r;
+ }
- for (i = 0; i < RLIMIT_NLIMITS; i++) {
- if (!context->rlimit[i])
- continue;
+ if (params->apply_permissions) {
- if (setrlimit_closest(i, context->rlimit[i]) < 0) {
- err = -errno;
- r = EXIT_LIMITS;
- goto fail_child;
- }
+ for (i = 0; i < _RLIMIT_MAX; i++) {
+ if (!context->rlimit[i])
+ continue;
+
+ if (setrlimit_closest(i, context->rlimit[i]) < 0) {
+ *exit_status = EXIT_LIMITS;
+ return -errno;
}
+ }
- if (context->capability_bounding_set_drop) {
- err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
- if (err < 0) {
- r = EXIT_CAPABILITIES;
- goto fail_child;
- }
+ if (context->capability_bounding_set_drop) {
+ r = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
+ if (r < 0) {
+ *exit_status = EXIT_CAPABILITIES;
+ return r;
}
+ }
- if (context->user) {
- err = enforce_user(context, uid);
- if (err < 0) {
- r = EXIT_USER;
- goto fail_child;
- }
+#ifdef HAVE_SMACK
+ if (context->smack_process_label) {
+ r = mac_smack_apply_pid(0, context->smack_process_label);
+ if (r < 0) {
+ *exit_status = EXIT_SMACK_PROCESS_LABEL;
+ return r;
}
+ }
+#endif
- /* PR_GET_SECUREBITS is not privileged, while
- * PR_SET_SECUREBITS is. So to suppress
- * potential EPERMs we'll try not to call
- * PR_SET_SECUREBITS unless necessary. */
- if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
- if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
- err = -errno;
- r = EXIT_SECUREBITS;
- goto fail_child;
- }
+ if (context->user) {
+ r = enforce_user(context, uid);
+ if (r < 0) {
+ *exit_status = EXIT_USER;
+ return r;
+ }
+ }
- if (context->capabilities)
- if (cap_set_proc(context->capabilities) < 0) {
- err = -errno;
- r = EXIT_CAPABILITIES;
- goto fail_child;
- }
+ /* PR_GET_SECUREBITS is not privileged, while
+ * PR_SET_SECUREBITS is. So to suppress
+ * potential EPERMs we'll try not to call
+ * PR_SET_SECUREBITS unless necessary. */
+ if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
+ if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
+ *exit_status = EXIT_SECUREBITS;
+ return -errno;
+ }
- if (context->no_new_privileges)
- if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
- err = -errno;
- r = EXIT_NO_NEW_PRIVILEGES;
- goto fail_child;
- }
+ if (context->capabilities)
+ if (cap_set_proc(context->capabilities) < 0) {
+ *exit_status = EXIT_CAPABILITIES;
+ return -errno;
+ }
+
+ if (context->no_new_privileges)
+ if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+ *exit_status = EXIT_NO_NEW_PRIVILEGES;
+ return -errno;
+ }
#ifdef HAVE_SECCOMP
- if (context->syscall_filter || context->syscall_archs) {
- err = apply_seccomp(context);
- if (err < 0) {
- r = EXIT_SECCOMP;
- goto fail_child;
- }
+ if (context->address_families_whitelist ||
+ !set_isempty(context->address_families)) {
+ r = apply_address_families(context);
+ if (r < 0) {
+ *exit_status = EXIT_ADDRESS_FAMILIES;
+ return r;
+ }
+ }
+
+ if (context->syscall_whitelist ||
+ !set_isempty(context->syscall_filter) ||
+ !set_isempty(context->syscall_archs)) {
+ r = apply_seccomp(context);
+ if (r < 0) {
+ *exit_status = EXIT_SECCOMP;
+ return r;
}
+ }
#endif
#ifdef HAVE_SELINUX
- if (context->selinux_context && use_selinux()) {
- err = setexeccon(context->selinux_context);
- if (err < 0 && !context->selinux_context_ignore) {
- r = EXIT_SELINUX_CONTEXT;
- goto fail_child;
+ if (mac_selinux_use()) {
+ char *exec_context = mac_selinux_context_net ?: context->selinux_context;
+
+ if (exec_context) {
+ r = setexeccon(exec_context);
+ if (r < 0) {
+ *exit_status = EXIT_SELINUX_CONTEXT;
+ return r;
}
}
+ }
#endif
#ifdef HAVE_APPARMOR
- if (context->apparmor_profile && use_apparmor()) {
- err = aa_change_onexec(context->apparmor_profile);
- if (err < 0 && !context->apparmor_profile_ignore) {
- r = EXIT_APPARMOR_PROFILE;
- goto fail_child;
- }
+ if (context->apparmor_profile && mac_apparmor_use()) {
+ r = aa_change_onexec(context->apparmor_profile);
+ if (r < 0 && !context->apparmor_profile_ignore) {
+ *exit_status = EXIT_APPARMOR_PROFILE;
+ return -errno;
}
-#endif
}
+#endif
+ }
- err = build_environment(context, n_fds, watchdog_usec, home, username, shell, &our_env);
- if (r < 0) {
- r = EXIT_MEMORY;
- goto fail_child;
- }
+ r = build_environment(context, n_fds, params->watchdog_usec, home, username, shell, &our_env);
+ if (r < 0) {
+ *exit_status = EXIT_MEMORY;
+ return r;
+ }
- final_env = strv_env_merge(5,
- environment,
- our_env,
- context->environment,
- files_env,
- pam_env,
- NULL);
- if (!final_env) {
- err = -ENOMEM;
- r = EXIT_MEMORY;
- goto fail_child;
- }
+ final_env = strv_env_merge(5,
+ params->environment,
+ our_env,
+ context->environment,
+ files_env,
+ pam_env,
+ NULL);
+ if (!final_env) {
+ *exit_status = EXIT_MEMORY;
+ return -ENOMEM;
+ }
- final_argv = replace_env_argv(argv, final_env);
- if (!final_argv) {
- err = -ENOMEM;
- r = EXIT_MEMORY;
- goto fail_child;
- }
+ final_argv = replace_env_argv(argv, final_env);
+ if (!final_argv) {
+ *exit_status = EXIT_MEMORY;
+ return -ENOMEM;
+ }
- final_env = strv_env_clean(final_env);
-
- if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
- line = exec_command_line(final_argv);
- if (line) {
- log_open();
- log_struct_unit(LOG_DEBUG,
- unit_id,
- "EXECUTABLE=%s", command->path,
- "MESSAGE=Executing: %s", line,
- NULL);
- log_close();
- free(line);
- line = NULL;
- }
- }
- execve(command->path, final_argv, final_env);
- err = -errno;
- r = EXIT_EXEC;
+ final_env = strv_env_clean(final_env);
+
+ if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
+ _cleanup_free_ char *line;
- fail_child:
- if (r != 0) {
+ line = exec_command_line(final_argv);
+ if (line) {
log_open();
- log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
- "EXECUTABLE=%s", command->path,
- "MESSAGE=Failed at step %s spawning %s: %s",
- exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
- command->path, strerror(-err),
- "ERRNO=%d", -err,
- NULL);
+ log_unit_struct(params->unit_id,
+ LOG_DEBUG,
+ "EXECUTABLE=%s", command->path,
+ LOG_MESSAGE("Executing: %s", line),
+ NULL);
log_close();
}
+ }
+ execve(command->path, final_argv, final_env);
+ *exit_status = EXIT_EXEC;
+ return -errno;
+}
- _exit(r);
+int exec_spawn(ExecCommand *command,
+ const ExecContext *context,
+ const ExecParameters *params,
+ ExecRuntime *runtime,
+ pid_t *ret) {
+
+ _cleanup_strv_free_ char **files_env = NULL;
+ int *fds = NULL; unsigned n_fds = 0;
+ _cleanup_free_ char *line = NULL;
+ int socket_fd, r;
+ char **argv;
+ pid_t pid;
+
+ assert(command);
+ assert(context);
+ assert(ret);
+ assert(params);
+ assert(params->fds || params->n_fds <= 0);
+
+ if (context->std_input == EXEC_INPUT_SOCKET ||
+ context->std_output == EXEC_OUTPUT_SOCKET ||
+ context->std_error == EXEC_OUTPUT_SOCKET) {
+
+ if (params->n_fds != 1) {
+ log_unit_error(params->unit_id, "Got more than one socket.");
+ return -EINVAL;
+ }
+
+ socket_fd = params->fds[0];
+ } else {
+ socket_fd = -1;
+ fds = params->fds;
+ n_fds = params->n_fds;
}
- log_struct_unit(LOG_DEBUG,
- unit_id,
- "MESSAGE=Forked %s as "PID_FMT,
- command->path, pid,
+ r = exec_context_load_environment(context, params->unit_id, &files_env);
+ if (r < 0)
+ return log_unit_error_errno(params->unit_id, r, "Failed to load environment files: %m");
+
+ argv = params->argv ?: command->argv;
+ line = exec_command_line(argv);
+ if (!line)
+ return log_oom();
+
+ log_unit_struct(params->unit_id,
+ LOG_DEBUG,
+ "EXECUTABLE=%s", command->path,
+ LOG_MESSAGE("About to execute: %s", line),
NULL);
+ pid = fork();
+ if (pid < 0)
+ return log_unit_error_errno(params->unit_id, r, "Failed to fork: %m");
+
+ if (pid == 0) {
+ int exit_status;
+
+ r = exec_child(command,
+ context,
+ params,
+ runtime,
+ argv,
+ socket_fd,
+ fds, n_fds,
+ files_env,
+ &exit_status);
+ if (r < 0) {
+ log_open();
+ log_unit_struct(params->unit_id,
+ LOG_ERR,
+ LOG_MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
+ "EXECUTABLE=%s", command->path,
+ LOG_MESSAGE("Failed at step %s spawning %s: %s",
+ exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
+ command->path, strerror(-r)),
+ LOG_ERRNO(r),
+ NULL);
+ }
+
+ _exit(exit_status);
+ }
+
+ log_unit_debug(params->unit_id, "Forked %s as "PID_FMT, command->path, pid);
/* We add the new process to the cgroup both in the child (so
* that we can be sure that no user code is ever executed
* outside of the cgroup) and in the parent (so that we can be
* sure that when we kill the cgroup the process will be
* killed too). */
- if (cgroup_path)
- cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
+ if (params->cgroup_path)
+ cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
exec_status_start(&command->exec_status, pid);
c->syslog_priority = LOG_DAEMON|LOG_INFO;
c->syslog_level_prefix = true;
c->ignore_sigpipe = true;
- c->timer_slack_nsec = (nsec_t) -1;
+ c->timer_slack_nsec = NSEC_INFINITY;
c->personality = 0xffffffffUL;
+ c->runtime_directory_mode = 0755;
}
void exec_context_done(ExecContext *c) {
free(c->tty_path);
c->tty_path = NULL;
- free(c->tcpwrap_name);
- c->tcpwrap_name = NULL;
-
free(c->syslog_identifier);
c->syslog_identifier = NULL;
free(c->apparmor_profile);
c->apparmor_profile = NULL;
-#ifdef HAVE_SECCOMP
set_free(c->syscall_filter);
c->syscall_filter = NULL;
set_free(c->syscall_archs);
c->syscall_archs = NULL;
-#endif
+
+ set_free(c->address_families);
+ c->address_families = NULL;
+
+ strv_free(c->runtime_directory);
+ c->runtime_directory = NULL;
+
+ bus_endpoint_free(c->bus_endpoint);
+ c->bus_endpoint = NULL;
+}
+
+int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
+ char **i;
+
+ assert(c);
+
+ if (!runtime_prefix)
+ return 0;
+
+ STRV_FOREACH(i, c->runtime_directory) {
+ _cleanup_free_ char *p;
+
+ p = strjoin(runtime_prefix, "/", *i, NULL);
+ if (!p)
+ return -ENOMEM;
+
+ /* We execute this synchronously, since we need to be
+ * sure this is gone when we start the service
+ * next. */
+ rm_rf(p, false, true, false);
+ }
+
+ return 0;
}
void exec_command_done(ExecCommand *c) {
exec_command_done(c+i);
}
-void exec_command_free_list(ExecCommand *c) {
+ExecCommand* exec_command_free_list(ExecCommand *c) {
ExecCommand *i;
while ((i = c)) {
exec_command_done(i);
free(i);
}
+
+ return NULL;
}
void exec_command_free_array(ExecCommand **c, unsigned n) {
unsigned i;
- for (i = 0; i < n; i++) {
- exec_command_free_list(c[i]);
- c[i] = NULL;
- }
+ for (i = 0; i < n; i++)
+ c[i] = exec_command_free_list(c[i]);
}
-int exec_context_load_environment(const ExecContext *c, char ***l) {
+typedef struct InvalidEnvInfo {
+ const char *unit_id;
+ const char *path;
+} InvalidEnvInfo;
+
+static void invalid_env(const char *p, void *userdata) {
+ InvalidEnvInfo *info = userdata;
+
+ log_unit_error(info->unit_id, "Ignoring invalid environment assignment '%s': %s", p, info->path);
+}
+
+int exec_context_load_environment(const ExecContext *c, const char *unit_id, char ***l) {
char **i, **r = NULL;
assert(c);
return -EINVAL;
}
for (n = 0; n < count; n++) {
- k = load_env_file(pglob.gl_pathv[n], NULL, &p);
+ k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
if (k < 0) {
if (ignore)
continue;
return k;
}
/* Log invalid environment variables with filename */
- if (p)
- p = strv_env_clean_log(p, pglob.gl_pathv[n]);
+ if (p) {
+ InvalidEnvInfo info = {
+ .unit_id = unit_id,
+ .path = pglob.gl_pathv[n]
+ };
+
+ p = strv_env_clean_with_callback(p, invalid_env, &info);
+ }
if (r == NULL)
r = p;
}
static bool tty_may_match_dev_console(const char *tty) {
- char *active = NULL, *console;
- bool b;
+ _cleanup_free_ char *active = NULL;
+ char *console;
if (startswith(tty, "/dev/"))
tty += 5;
return true;
/* "tty0" means the active VC, so it may be the same sometimes */
- b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
- free(active);
-
- return b;
+ return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
}
bool exec_context_may_touch_console(ExecContext *ec) {
"%sPrivateTmp: %s\n"
"%sPrivateNetwork: %s\n"
"%sPrivateDevices: %s\n"
+ "%sProtectHome: %s\n"
+ "%sProtectSystem: %s\n"
"%sIgnoreSIGPIPE: %s\n",
prefix, c->umask,
prefix, c->working_directory ? c->working_directory : "/",
prefix, yes_no(c->private_tmp),
prefix, yes_no(c->private_network),
prefix, yes_no(c->private_devices),
+ prefix, protect_home_to_string(c->protect_home),
+ prefix, protect_system_to_string(c->protect_system),
prefix, yes_no(c->ignore_sigpipe));
STRV_FOREACH(e, c->environment)
STRV_FOREACH(e, c->environment_files)
fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
- if (c->tcpwrap_name)
- fprintf(f,
- "%sTCPWrapName: %s\n",
- prefix, c->tcpwrap_name);
-
if (c->nice_set)
fprintf(f,
"%sNice: %i\n",
for (i = 0; i < RLIM_NLIMITS; i++)
if (c->rlimit[i])
- fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
+ fprintf(f, "%s%s: "RLIM_FMT"\n",
+ prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
if (c->ioprio_set) {
_cleanup_free_ char *class_str = NULL;
fputs("\n", f);
}
- if (c->timer_slack_nsec != (nsec_t) -1)
+ if (c->timer_slack_nsec != NSEC_INFINITY)
fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
fprintf(f,
fprintf(f, "%sCapabilityBoundingSet:", prefix);
for (l = 0; l <= cap_last_cap(); l++)
- if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
- _cleanup_cap_free_charp_ char *t;
-
- t = cap_to_name(l);
- if (t)
- fprintf(f, " %s", t);
- }
+ if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l)))
+ fprintf(f, " %s", strna(capability_to_name(l)));
fputs("\n", f);
}
prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
}
+bool exec_context_maintains_privileges(ExecContext *c) {
+ assert(c);
+
+ /* Returns true if the process forked off would run run under
+ * an unchanged UID or as root. */
+
+ if (!c->user)
+ return true;
+
+ if (streq(c->user, "root") || streq(c->user, "0"))
+ return true;
+
+ return false;
+}
+
void exec_status_start(ExecStatus *s, pid_t pid) {
assert(s);
assert(s);
assert(f);
- if (!prefix)
- prefix = "";
-
if (s->pid <= 0)
return;
+ prefix = strempty(prefix);
+
fprintf(f,
"%sPID: "PID_FMT"\n",
prefix, s->pid);
}
void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
- char *p2;
+ _cleanup_free_ char *cmd = NULL;
const char *prefix2;
- char *cmd;
-
assert(c);
assert(f);
- if (!prefix)
- prefix = "";
- p2 = strappend(prefix, "\t");
- prefix2 = p2 ? p2 : prefix;
+ prefix = strempty(prefix);
+ prefix2 = strjoina(prefix, "\t");
cmd = exec_command_line(c->argv);
-
fprintf(f,
"%sCommand Line: %s\n",
prefix, cmd ? cmd : strerror(ENOMEM));
- free(cmd);
-
exec_status_dump(&c->exec_status, f, prefix2);
-
- free(p2);
}
void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
assert(f);
- if (!prefix)
- prefix = "";
+ prefix = strempty(prefix);
LIST_FOREACH(command, c, c)
exec_command_dump(c, f, prefix);
return 0;
}
+int exec_command_append(ExecCommand *c, const char *path, ...) {
+ _cleanup_strv_free_ char **l = NULL;
+ va_list ap;
+ int r;
+
+ assert(c);
+ assert(path);
+
+ va_start(ap, path);
+ l = strv_new_ap(path, ap);
+ va_end(ap);
+
+ if (!l)
+ return -ENOMEM;
+
+ r = strv_extend_strv(&c->argv, l);
+ if (r < 0)
+ return r;
+
+ return 0;
+}
+
+
static int exec_runtime_allocate(ExecRuntime **rt) {
if (*rt)
if (r->n_ref <= 0) {
free(r->tmp_dir);
free(r->var_tmp_dir);
- close_pipe(r->netns_storage_socket);
+ safe_close_pair(r->netns_storage_socket);
free(r);
}
return r;
if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
- log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
+ log_unit_debug(u->id, "Failed to parse netns socket value %s", value);
else {
- if ((*rt)->netns_storage_socket[0] >= 0)
- close_nointr_nofail((*rt)->netns_storage_socket[0]);
-
+ safe_close((*rt)->netns_storage_socket[0]);
(*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
}
} else if (streq(key, "netns-socket-1")) {
return r;
if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
- log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
+ log_unit_debug(u->id, "Failed to parse netns socket value %s", value);
else {
- if ((*rt)->netns_storage_socket[1] >= 0)
- close_nointr_nofail((*rt)->netns_storage_socket[1]);
-
+ safe_close((*rt)->netns_storage_socket[1]);
(*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
}
} else
}
void exec_runtime_destroy(ExecRuntime *rt) {
+ int r;
+
if (!rt)
return;
if (rt->tmp_dir) {
log_debug("Spawning thread to nuke %s", rt->tmp_dir);
- asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
+
+ r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
+ if (r < 0) {
+ log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
+ free(rt->tmp_dir);
+ }
+
rt->tmp_dir = NULL;
}
if (rt->var_tmp_dir) {
log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
- asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
+
+ r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
+ if (r < 0) {
+ log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
+ free(rt->var_tmp_dir);
+ }
+
rt->var_tmp_dir = NULL;
}
- close_pipe(rt->netns_storage_socket);
+ safe_close_pair(rt->netns_storage_socket);
}
static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
~ianmdlvl / elogind.git / blobdiff