log: rearrange log function naming

[elogind.git] / src / core / execute.c

diff --git a/src/core/execute.c b/src/core/execute.c
index 43f2764a49db32cbe6f0e504b138cbf89b2c0283..dd182f55644bc57331ba862844b2a82eb070567a 100644 (file)
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -83,6 +83,7 @@
 #include "af-list.h"
 #include "mkdir.h"
 #include "apparmor-util.h"
+#include "smack-util.h"
 #include "bus-kernel.h"
 #include "label.h"
 
@@ -425,7 +426,7 @@ static int setup_output(const ExecContext *context, int fileno, int socket_fd, c
         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
                 r = connect_logger_as(context, o, ident, unit_id, fileno);
                 if (r < 0) {
-                        log_struct_unit(LOG_CRIT, unit_id,
+                        log_unit_struct(LOG_CRIT, unit_id,
                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
                                 fileno == STDOUT_FILENO ? "out" : "err",
                                 unit_id, strerror(-r),
@@ -1444,8 +1445,10 @@ static int exec_child(ExecCommand *command,
         }
 #endif
 
-#ifdef HAVE_PAM
-        if (params->cgroup_path && context->user && context->pam_name) {
+        /* If delegation is enabled we'll pass ownership of the cgroup
+         * (but only in systemd's own controller hierarchy!) to the
+         * user of the new process. */
+        if (params->cgroup_path && context->user && params->cgroup_delegate) {
                 err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
                 if (err < 0) {
                         *error = EXIT_CGROUP;
@@ -1459,7 +1462,6 @@ static int exec_child(ExecCommand *command,
                         return err;
                 }
         }
-#endif
 
         if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
                 char **rt;
@@ -1547,7 +1549,7 @@ static int exec_child(ExecCommand *command,
                                 context->mount_flags);
 
                 if (err == -EPERM)
-                        log_error_unit(params->unit_id, "Failed to setup namespace, ignoring: %s", strerror(-err));
+                        log_unit_warning(params->unit_id, "Failed to set up file system namespace due to lack of privileges. Execution sandbox will not be in effect: %s", strerror(-err));
                 else if (err < 0) {
                         *error = EXIT_NAMESPACE;
                         return err;
@@ -1617,6 +1619,16 @@ static int exec_child(ExecCommand *command,
                         }
                 }
 
+#ifdef HAVE_SMACK
+                if (context->smack_process_label) {
+                        err = mac_smack_apply_pid(0, context->smack_process_label);
+                        if (err < 0) {
+                                *error = EXIT_SMACK_PROCESS_LABEL;
+                                return err;
+                        }
+                }
+#endif
+
                 if (context->user) {
                         err = enforce_user(context, uid);
                         if (err < 0) {
@@ -1669,7 +1681,7 @@ static int exec_child(ExecCommand *command,
 #endif
 
 #ifdef HAVE_SELINUX
-                if (use_selinux()) {
+                if (mac_selinux_use()) {
                         if (context->selinux_context) {
                                 err = setexeccon(context->selinux_context);
                                 if (err < 0 && !context->selinux_context_ignore) {
@@ -1681,7 +1693,7 @@ static int exec_child(ExecCommand *command,
                         if (params->selinux_context_net && socket_fd >= 0) {
                                 _cleanup_free_ char *label = NULL;
 
-                                err = label_get_child_mls_label(socket_fd, command->path, &label);
+                                err = mac_selinux_get_child_mls_label(socket_fd, command->path, &label);
                                 if (err < 0) {
                                         *error = EXIT_SELINUX_CONTEXT;
                                         return err;
@@ -1697,7 +1709,7 @@ static int exec_child(ExecCommand *command,
 #endif
 
 #ifdef HAVE_APPARMOR
-                if (context->apparmor_profile && use_apparmor()) {
+                if (context->apparmor_profile && mac_apparmor_use()) {
                         err = aa_change_onexec(context->apparmor_profile);
                         if (err < 0 && !context->apparmor_profile_ignore) {
                                 *error = EXIT_APPARMOR_PROFILE;
@@ -1739,7 +1751,7 @@ static int exec_child(ExecCommand *command,
                 line = exec_command_line(final_argv);
                 if (line) {
                         log_open();
-                        log_struct_unit(LOG_DEBUG,
+                        log_unit_struct(LOG_DEBUG,
                                         params->unit_id,
                                         "EXECUTABLE=%s", command->path,
                                         "MESSAGE=Executing: %s", line,
@@ -1785,9 +1797,9 @@ int exec_spawn(ExecCommand *command,
                 n_fds = params->n_fds;
         }
 
-        err = exec_context_load_environment(context, &files_env);
+        err = exec_context_load_environment(context, params->unit_id, &files_env);
         if (err < 0) {
-                log_struct_unit(LOG_ERR,
+                log_unit_struct(LOG_ERR,
                            params->unit_id,
                            "MESSAGE=Failed to load environment files: %s", strerror(-err),
                            "ERRNO=%d", -err,
@@ -1801,7 +1813,7 @@ int exec_spawn(ExecCommand *command,
         if (!line)
                 return log_oom();
 
-        log_struct_unit(LOG_DEBUG,
+        log_unit_struct(LOG_DEBUG,
                         params->unit_id,
                         "EXECUTABLE=%s", command->path,
                         "MESSAGE=About to execute: %s", line,
@@ -1839,7 +1851,7 @@ int exec_spawn(ExecCommand *command,
                 _exit(r);
         }
 
-        log_struct_unit(LOG_DEBUG,
+        log_unit_struct(LOG_DEBUG,
                         params->unit_id,
                         "MESSAGE=Forked %s as "PID_FMT,
                         command->path, pid,
@@ -2014,7 +2026,7 @@ void exec_command_free_array(ExecCommand **c, unsigned n) {
         }
 }
 
-int exec_context_load_environment(const ExecContext *c, char ***l) {
+int exec_context_load_environment(const ExecContext *c, const char *unit_id, char ***l) {
         char **i, **r = NULL;
 
         assert(c);
@@ -2071,7 +2083,7 @@ int exec_context_load_environment(const ExecContext *c, char ***l) {
                         }
                         /* Log invalid environment variables with filename */
                         if (p)
-                                p = strv_env_clean_log(p, pglob.gl_pathv[n]);
+                                p = strv_env_clean_log(p, unit_id, pglob.gl_pathv[n]);
 
                         if (r == NULL)
                                 r = p;
@@ -2402,6 +2414,21 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
 }
 
+bool exec_context_maintains_privileges(ExecContext *c) {
+        assert(c);
+
+        /* Returns true if the process forked off would run run under
+         * an unchanged UID or as root. */
+
+        if (!c->user)
+                return true;
+
+        if (streq(c->user, "root") || streq(c->user, "0"))
+                return true;
+
+        return false;
+}
+
 void exec_status_start(ExecStatus *s, pid_t pid) {
         assert(s);
 
@@ -2744,7 +2771,7 @@ int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, co
                         return r;
 
                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
-                        log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
+                        log_unit_debug(u->id, "Failed to parse netns socket value %s", value);
                 else {
                         safe_close((*rt)->netns_storage_socket[0]);
                         (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
@@ -2757,7 +2784,7 @@ int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, co
                         return r;
 
                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
-                        log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
+                        log_unit_debug(u->id, "Failed to parse netns socket value %s", value);
                 else {
                         safe_close((*rt)->netns_storage_socket[1]);
                         (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);