chiark / gitweb /
core/smack: downgrade info to debug
[elogind.git] / src / core / main.c
index 5cd012e9571bd5d6f7afa3a2217b8687be71a4b8..7b039835a8cffe03f38164150c1c9b645a6ddfad 100644 (file)
 #include "path-util.h"
 #include "switch-root.h"
 #include "capability.h"
+#include "killall.h"
+#include "env-util.h"
+#include "hwclock.h"
+#include "sd-daemon.h"
 
 #include "mount-setup.h"
 #include "loopback-setup.h"
+#ifdef HAVE_KMOD
 #include "kmod-setup.h"
+#endif
 #include "hostname-setup.h"
 #include "machine-id-setup.h"
 #include "locale-setup.h"
-#include "hwclock.h"
 #include "selinux-setup.h"
 #include "ima-setup.h"
+#include "fileio.h"
+#include "smack-setup.h"
 
 static enum {
         ACTION_RUN,
         ACTION_HELP,
+        ACTION_VERSION,
         ACTION_TEST,
         ACTION_DUMP_CONFIGURATION_ITEMS,
         ACTION_DONE
 } arg_action = ACTION_RUN;
 
 static char *arg_default_unit = NULL;
-static ManagerRunningAs arg_running_as = _MANAGER_RUNNING_AS_INVALID;
+static SystemdRunningAs arg_running_as = _SYSTEMD_RUNNING_AS_INVALID;
 
 static bool arg_dump_core = true;
 static bool arg_crash_shell = false;
@@ -79,9 +87,6 @@ static int arg_crash_chvt = -1;
 static bool arg_confirm_spawn = false;
 static bool arg_show_status = true;
 static bool arg_switched_root = false;
-#ifdef HAVE_SYSV_COMPAT
-static bool arg_sysv_console = true;
-#endif
 static char **arg_default_controllers = NULL;
 static char ***arg_join_controllers = NULL;
 static ExecOutput arg_default_std_output = EXEC_OUTPUT_JOURNAL;
@@ -167,19 +172,14 @@ _noreturn_ static void crash(int sig) {
                 sa.sa_flags = SA_NOCLDSTOP|SA_NOCLDWAIT|SA_RESTART;
                 assert_se(sigaction(SIGCHLD, &sa, NULL) == 0);
 
-                if ((pid = fork()) < 0)
-                        log_error("Failed to fork off crash shell: %s", strerror(errno));
+                pid = fork();
+                if (pid < 0)
+                        log_error("Failed to fork off crash shell: %m");
                 else if (pid == 0) {
-                        int fd, r;
-
-                        if ((fd = acquire_terminal("/dev/console", false, true, true)) < 0)
-                                log_error("Failed to acquire terminal: %s", strerror(-fd));
-                        else if ((r = make_stdio(fd)) < 0)
-                                log_error("Failed to duplicate terminal fd: %s", strerror(-r));
-
+                        make_console_stdio();
                         execl("/bin/sh", "/bin/sh", NULL);
 
-                        log_error("execl() failed: %s", strerror(errno));
+                        log_error("execl() failed: %m");
                         _exit(1);
                 }
 
@@ -345,7 +345,8 @@ static int parse_proc_cmdline_word(const char *word) {
                 else
                         arg_default_std_error = r;
         } else if (startswith(word, "systemd.setenv=")) {
-                char *cenv, *eq;
+                _cleanup_free_ char *cenv = NULL;
+                char *eq;
                 int r;
 
                 cenv = strdup(word + 15);
@@ -354,57 +355,62 @@ static int parse_proc_cmdline_word(const char *word) {
 
                 eq = strchr(cenv, '=');
                 if (!eq) {
-                        r = unsetenv(cenv);
-                        if (r < 0)
-                                log_warning("unsetenv failed %s. Ignoring.", strerror(errno));
+                        if (!env_name_is_valid(cenv))
+                                log_warning("Environment variable name '%s' is not valid. Ignoring.", cenv);
+                        else  {
+                                r = unsetenv(cenv);
+                                if (r < 0)
+                                        log_warning("Unsetting environment variable '%s' failed, ignoring: %m", cenv);
+                        }
                 } else {
-                        *eq = 0;
-                        r = setenv(cenv, eq + 1, 1);
-                        if (r < 0)
-                                log_warning("setenv failed %s. Ignoring.", strerror(errno));
+                        if (!env_assignment_is_valid(cenv))
+                                log_warning("Environment variable assignment '%s' is not valid. Ignoring.", cenv);
+                        else {
+                                *eq = 0;
+                                r = setenv(cenv, eq + 1, 1);
+                                if (r < 0)
+                                        log_warning("Setting environment variable '%s=%s' failed, ignoring: %m", cenv, eq + 1);
+                        }
                 }
-                free(cenv);
-#ifdef HAVE_SYSV_COMPAT
-        } else if (startswith(word, "systemd.sysv_console=")) {
-                int r;
 
-                if ((r = parse_boolean(word + 21)) < 0)
-                        log_warning("Failed to parse SysV console switch %s. Ignoring.", word + 20);
-                else
-                        arg_sysv_console = r;
-#endif
-
-        } else if (startswith(word, "systemd.")) {
-
-                log_warning("Unknown kernel switch %s. Ignoring.", word);
+        } else if (startswith(word, "systemd.") ||
+                   (in_initrd() && startswith(word, "rd.systemd."))) {
+
+                const char *c;
+
+                /* Ignore systemd.journald.xyz and friends */
+                c = word;
+                if (startswith(c, "rd."))
+                        c += 3;
+                if (startswith(c, "systemd."))
+                        c += 8;
+                if (c[strcspn(c, ".=")] != '.')  {
+
+                        log_warning("Unknown kernel switch %s. Ignoring.", word);
+
+                        log_info("Supported kernel switches:\n"
+                                 "systemd.unit=UNIT                        Default unit to start\n"
+                                 "rd.systemd.unit=UNIT                     Default unit to start when run in initrd\n"
+                                 "systemd.dump_core=0|1                    Dump core on crash\n"
+                                 "systemd.crash_shell=0|1                  Run shell on crash\n"
+                                 "systemd.crash_chvt=N                     Change to VT #N on crash\n"
+                                 "systemd.confirm_spawn=0|1                Confirm every process spawn\n"
+                                 "systemd.show_status=0|1                  Show status updates on the console during bootup\n"
+                                 "systemd.log_target=console|kmsg|journal|journal-or-kmsg|syslog|syslog-or-kmsg|null\n"
+                                 "                                         Log target\n"
+                                 "systemd.log_level=LEVEL                  Log level\n"
+                                 "systemd.log_color=0|1                    Highlight important log messages\n"
+                                 "systemd.log_location=0|1                 Include code location in log messages\n"
+                                 "systemd.default_standard_output=null|tty|syslog|syslog+console|kmsg|kmsg+console|journal|journal+console\n"
+                                 "                                         Set default log output for services\n"
+                                 "systemd.default_standard_error=null|tty|syslog|syslog+console|kmsg|kmsg+console|journal|journal+console\n"
+                                 "                                         Set default log error output for services\n"
+                                 "systemd.setenv=ASSIGNMENT                Set an environment variable for all spawned processes\n");
+                }
 
-                log_info("Supported kernel switches:\n"
-                         "systemd.unit=UNIT                        Default unit to start\n"
-                         "rd.systemd.unit=UNIT                     Default unit to start when run in initrd\n"
-                         "systemd.dump_core=0|1                    Dump core on crash\n"
-                         "systemd.crash_shell=0|1                  Run shell on crash\n"
-                         "systemd.crash_chvt=N                     Change to VT #N on crash\n"
-                         "systemd.confirm_spawn=0|1                Confirm every process spawn\n"
-                         "systemd.show_status=0|1                  Show status updates on the console during bootup\n"
-#ifdef HAVE_SYSV_COMPAT
-                         "systemd.sysv_console=0|1                 Connect output of SysV scripts to console\n"
-#endif
-                         "systemd.log_target=console|kmsg|journal|journal-or-kmsg|syslog|syslog-or-kmsg|null\n"
-                         "                                         Log target\n"
-                         "systemd.log_level=LEVEL                  Log level\n"
-                         "systemd.log_color=0|1                    Highlight important log messages\n"
-                         "systemd.log_location=0|1                 Include code location in log messages\n"
-                         "systemd.default_standard_output=null|tty|syslog|syslog+console|kmsg|kmsg+console|journal|journal+console\n"
-                         "                                         Set default log output for services\n"
-                         "systemd.default_standard_error=null|tty|syslog|syslog+console|kmsg|kmsg+console|journal|journal+console\n"
-                         "                                         Set default log error output for services\n");
-
-        } else if (streq(word, "quiet")) {
+        } else if (streq(word, "quiet"))
                 arg_show_status = false;
-#ifdef HAVE_SYSV_COMPAT
-                arg_sysv_console = false;
-#endif
-        } else {
+        else if (!in_initrd()) {
                 unsigned i;
 
                 /* SysV compatibility */
@@ -514,14 +520,14 @@ static int config_parse_cpu_affinity2(
                 unsigned cpu;
 
                 if (!(t = strndup(w, l)))
-                        return -ENOMEM;
+                        return log_oom();
 
                 r = safe_atou(t, &cpu);
                 free(t);
 
                 if (!c)
                         if (!(c = cpu_set_malloc(&ncpus)))
-                                return -ENOMEM;
+                                return log_oom();
 
                 if (r < 0 || cpu >= ncpus) {
                         log_error("[%s:%u] Failed to parse CPU affinity: %s", filename, line, rvalue);
@@ -587,7 +593,7 @@ static int config_parse_join_controllers(
 
                 s = strndup(w, length);
                 if (!s)
-                        return -ENOMEM;
+                        return log_oom();
 
                 l = strv_split(s, ",");
                 free(s);
@@ -603,7 +609,7 @@ static int config_parse_join_controllers(
                         arg_join_controllers = new(char**, 2);
                         if (!arg_join_controllers) {
                                 strv_free(l);
-                                return -ENOMEM;
+                                return log_oom();
                         }
 
                         arg_join_controllers[0] = l;
@@ -617,7 +623,7 @@ static int config_parse_join_controllers(
                         t = new0(char**, n+2);
                         if (!t) {
                                 strv_free(l);
-                                return -ENOMEM;
+                                return log_oom();
                         }
 
                         n = 0;
@@ -631,7 +637,7 @@ static int config_parse_join_controllers(
                                         if (!c) {
                                                 strv_free(l);
                                                 strv_free_free(t);
-                                                return -ENOMEM;
+                                                return log_oom();
                                         }
 
                                         strv_free(l);
@@ -643,7 +649,7 @@ static int config_parse_join_controllers(
                                         if (!c) {
                                                 strv_free(l);
                                                 strv_free_free(t);
-                                                return -ENOMEM;
+                                                return log_oom();
                                         }
 
                                         t[n++] = c;
@@ -670,9 +676,6 @@ static int parse_config_file(void) {
                 { "Manager", "DumpCore",              config_parse_bool,         0, &arg_dump_core           },
                 { "Manager", "CrashShell",            config_parse_bool,         0, &arg_crash_shell         },
                 { "Manager", "ShowStatus",            config_parse_bool,         0, &arg_show_status         },
-#ifdef HAVE_SYSV_COMPAT
-                { "Manager", "SysVConsole",           config_parse_bool,         0, &arg_sysv_console        },
-#endif
                 { "Manager", "CrashChVT",             config_parse_int,          0, &arg_crash_chvt          },
                 { "Manager", "CPUAffinity",           config_parse_cpu_affinity2, 0, NULL                    },
                 { "Manager", "DefaultControllers",    config_parse_strv,         0, &arg_default_controllers },
@@ -706,7 +709,7 @@ static int parse_config_file(void) {
         const char *fn;
         int r;
 
-        fn = arg_running_as == MANAGER_SYSTEM ? SYSTEM_CONFIG_FILE : USER_CONFIG_FILE;
+        fn = arg_running_as == SYSTEMD_SYSTEM ? SYSTEM_CONFIG_FILE : USER_CONFIG_FILE;
         f = fopen(fn, "re");
         if (!f) {
                 if (errno == ENOENT)
@@ -749,10 +752,13 @@ static int parse_proc_cmdline(void) {
                 }
 
                 r = parse_proc_cmdline_word(word);
-                free(word);
-
-                if (r < 0)
+                if (r < 0) {
+                        log_error("Failed on cmdline argument %s: %s", word, strerror(-r));
+                        free(word);
                         goto finish;
+                }
+
+                free(word);
         }
 
         r = 0;
@@ -773,12 +779,12 @@ static int parse_argv(int argc, char *argv[]) {
                 ARG_SYSTEM,
                 ARG_USER,
                 ARG_TEST,
+                ARG_VERSION,
                 ARG_DUMP_CONFIGURATION_ITEMS,
                 ARG_DUMP_CORE,
                 ARG_CRASH_SHELL,
                 ARG_CONFIRM_SPAWN,
                 ARG_SHOW_STATUS,
-                ARG_SYSV_CONSOLE,
                 ARG_DESERIALIZE,
                 ARG_SWITCHED_ROOT,
                 ARG_INTROSPECT,
@@ -796,14 +802,12 @@ static int parse_argv(int argc, char *argv[]) {
                 { "user",                     no_argument,       NULL, ARG_USER                     },
                 { "test",                     no_argument,       NULL, ARG_TEST                     },
                 { "help",                     no_argument,       NULL, 'h'                          },
+                { "version",                  no_argument,       NULL, ARG_VERSION                  },
                 { "dump-configuration-items", no_argument,       NULL, ARG_DUMP_CONFIGURATION_ITEMS },
                 { "dump-core",                optional_argument, NULL, ARG_DUMP_CORE                },
                 { "crash-shell",              optional_argument, NULL, ARG_CRASH_SHELL              },
                 { "confirm-spawn",            optional_argument, NULL, ARG_CONFIRM_SPAWN            },
                 { "show-status",              optional_argument, NULL, ARG_SHOW_STATUS              },
-#ifdef HAVE_SYSV_COMPAT
-                { "sysv-console",             optional_argument, NULL, ARG_SYSV_CONSOLE             },
-#endif
                 { "deserialize",              required_argument, NULL, ARG_DESERIALIZE              },
                 { "switched-root",            no_argument,       NULL, ARG_SWITCHED_ROOT            },
                 { "introspect",               optional_argument, NULL, ARG_INTROSPECT               },
@@ -893,17 +897,21 @@ static int parse_argv(int argc, char *argv[]) {
                         break;
 
                 case ARG_SYSTEM:
-                        arg_running_as = MANAGER_SYSTEM;
+                        arg_running_as = SYSTEMD_SYSTEM;
                         break;
 
                 case ARG_USER:
-                        arg_running_as = MANAGER_USER;
+                        arg_running_as = SYSTEMD_USER;
                         break;
 
                 case ARG_TEST:
                         arg_action = ACTION_TEST;
                         break;
 
+                case ARG_VERSION:
+                        arg_action = ACTION_VERSION;
+                        break;
+
                 case ARG_DUMP_CONFIGURATION_ITEMS:
                         arg_action = ACTION_DUMP_CONFIGURATION_ITEMS;
                         break;
@@ -944,29 +952,22 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_show_status = r;
                         break;
 
-#ifdef HAVE_SYSV_COMPAT
-                case ARG_SYSV_CONSOLE:
-                        r = optarg ? parse_boolean(optarg) : 1;
-                        if (r < 0) {
-                                log_error("Failed to parse SysV console boolean %s.", optarg);
-                                return r;
-                        }
-                        arg_sysv_console = r;
-                        break;
-#endif
-
                 case ARG_DESERIALIZE: {
                         int fd;
                         FILE *f;
 
-                        if ((r = safe_atoi(optarg, &fd)) < 0 || fd < 0) {
+                        r = safe_atoi(optarg, &fd);
+                        if (r < 0 || fd < 0) {
                                 log_error("Failed to parse deserialize option %s.", optarg);
-                                return r;
+                                return r < 0 ? r : -EINVAL;
                         }
 
-                        if (!(f = fdopen(fd, "r"))) {
+                        fd_cloexec(fd, true);
+
+                        f = fdopen(fd, "r");
+                        if (!f) {
                                 log_error("Failed to open serialization fd: %m");
-                                return r;
+                                return -errno;
                         }
 
                         if (serialization)
@@ -1048,8 +1049,10 @@ static int parse_argv(int argc, char *argv[]) {
                  * instead. */
 
                 for (a = argv; a < argv + argc; a++)
-                        if ((r = parse_proc_cmdline_word(*a)) < 0)
+                        if ((r = parse_proc_cmdline_word(*a)) < 0) {
+                                log_error("Failed on cmdline argument %s: %s", *a, strerror(-r));
                                 return r;
+                        }
         }
 
         return 0;
@@ -1070,9 +1073,6 @@ static int help(void) {
                "     --crash-shell[=0|1]         Run shell on crash\n"
                "     --confirm-spawn[=0|1]       Ask for confirmation when spawning processes\n"
                "     --show-status[=0|1]         Show status updates on the console during bootup\n"
-#ifdef HAVE_SYSV_COMPAT
-               "     --sysv-console[=0|1]        Connect output of SysV scripts to console\n"
-#endif
                "     --log-target=TARGET         Set log target (console, journal, syslog, kmsg, journal-or-kmsg, syslog-or-kmsg, null)\n"
                "     --log-level=LEVEL           Set log level (debug, info, notice, warning, err, crit, alert, emerg)\n"
                "     --log-color[=0|1]           Highlight important log messages\n"
@@ -1084,7 +1084,14 @@ static int help(void) {
         return 0;
 }
 
-static int prepare_reexecute(Manager *m, FILE **_f, FDSet **_fds) {
+static int version(void) {
+        puts(PACKAGE_STRING);
+        puts(SYSTEMD_FEATURES);
+
+        return 0;
+}
+
+static int prepare_reexecute(Manager *m, FILE **_f, FDSet **_fds, bool serialize_jobs) {
         FILE *f = NULL;
         FDSet *fds = NULL;
         int r;
@@ -1096,18 +1103,21 @@ static int prepare_reexecute(Manager *m, FILE **_f, FDSet **_fds) {
         /* Make sure nothing is really destructed when we shut down */
         m->n_reloading ++;
 
-        if ((r = manager_open_serialization(m, &f)) < 0) {
+        r = manager_open_serialization(m, &f);
+        if (r < 0) {
                 log_error("Failed to create serialization file: %s", strerror(-r));
                 goto fail;
         }
 
-        if (!(fds = fdset_new())) {
+        fds = fdset_new();
+        if (!fds) {
                 r = -ENOMEM;
                 log_error("Failed to allocate fd set: %s", strerror(-r));
                 goto fail;
         }
 
-        if ((r = manager_serialize(m, f, fds)) < 0) {
+        r = manager_serialize(m, f, fds, serialize_jobs);
+        if (r < 0) {
                 log_error("Failed to serialize state: %s", strerror(-r));
                 goto fail;
         }
@@ -1117,12 +1127,14 @@ static int prepare_reexecute(Manager *m, FILE **_f, FDSet **_fds) {
                 goto fail;
         }
 
-        if ((r = fd_cloexec(fileno(f), false)) < 0) {
+        r = fd_cloexec(fileno(f), false);
+        if (r < 0) {
                 log_error("Failed to disable O_CLOEXEC for serialization: %s", strerror(-r));
                 goto fail;
         }
 
-        if ((r = fdset_cloexec(fds, false)) < 0) {
+        r = fdset_cloexec(fds, false);
+        if (r < 0) {
                 log_error("Failed to disable O_CLOEXEC for serialization fds: %s", strerror(-r));
                 goto fail;
         }
@@ -1141,6 +1153,42 @@ fail:
         return r;
 }
 
+static int bump_rlimit_nofile(struct rlimit *saved_rlimit) {
+        struct rlimit nl;
+        int r;
+
+        assert(saved_rlimit);
+
+        /* Save the original RLIMIT_NOFILE so that we can reset it
+         * later when transitioning from the initrd to the main
+         * systemd or suchlike. */
+        if (getrlimit(RLIMIT_NOFILE, saved_rlimit) < 0) {
+                log_error("Reading RLIMIT_NOFILE failed: %m");
+                return -errno;
+        }
+
+        /* Make sure forked processes get the default kernel setting */
+        if (!arg_default_rlimit[RLIMIT_NOFILE]) {
+                struct rlimit *rl;
+
+                rl = newdup(struct rlimit, saved_rlimit, 1);
+                if (!rl)
+                        return log_oom();
+
+                arg_default_rlimit[RLIMIT_NOFILE] = rl;
+        }
+
+        /* Bump up the resource limit for ourselves substantially */
+        nl.rlim_cur = nl.rlim_max = 64*1024;
+        r = setrlimit_closest(RLIMIT_NOFILE, &nl);
+        if (r < 0) {
+                log_error("Setting RLIMIT_NOFILE failed: %s", strerror(-r));
+                return r;
+        }
+
+        return 0;
+}
+
 static struct dual_timestamp* parse_initrd_timestamp(struct dual_timestamp *t) {
         const char *e;
         unsigned long long a, b;
@@ -1207,6 +1255,28 @@ static void test_cgroups(void) {
         sleep(10);
 }
 
+static int initialize_join_controllers(void) {
+        /* By default, mount "cpu" + "cpuacct" together, and "net_cls"
+         * + "net_prio". We'd like to add "cpuset" to the mix, but
+         * "cpuset" does't really work for groups with no initialized
+         * attributes. */
+
+        arg_join_controllers = new(char**, 3);
+        if (!arg_join_controllers)
+                return -ENOMEM;
+
+        arg_join_controllers[0] = strv_new("cpu", "cpuacct", NULL);
+        if (!arg_join_controllers[0])
+                return -ENOMEM;
+
+        arg_join_controllers[1] = strv_new("net_cls", "net_prio", NULL);
+        if (!arg_join_controllers[1])
+                return -ENOMEM;
+
+        arg_join_controllers[2] = NULL;
+        return 0;
+}
+
 int main(int argc, char *argv[]) {
         Manager *m = NULL;
         int r, retval = EXIT_FAILURE;
@@ -1223,6 +1293,7 @@ int main(int argc, char *argv[]) {
         bool arm_reboot_watchdog = false;
         bool queue_default_job = false;
         char *switch_root_dir = NULL, *switch_root_init = NULL;
+        static struct rlimit saved_rlimit_nofile = { 0, 0 };
 
 #ifdef HAVE_SYSV_COMPAT
         if (getpid() != 1 && strstr(program_invocation_short_name, "init")) {
@@ -1264,10 +1335,15 @@ int main(int argc, char *argv[]) {
         saved_argc = argc;
 
         log_show_color(isatty(STDERR_FILENO) > 0);
-        log_show_location(false);
-        log_set_max_level(LOG_INFO);
 
-        if (getpid() == 1) {
+        if (getpid() == 1 && detect_container(NULL) <= 0) {
+
+                /* Running outside of a container as PID 1 */
+                arg_running_as = SYSTEMD_SYSTEM;
+                make_null_stdio();
+                log_set_target(LOG_TARGET_KMSG);
+                log_open();
+
                 if (in_initrd()) {
                         char *rd_timestamp = NULL;
 
@@ -1281,51 +1357,82 @@ int main(int argc, char *argv[]) {
                         }
                 }
 
-                arg_running_as = MANAGER_SYSTEM;
-                log_set_target(detect_container(NULL) > 0 ? LOG_TARGET_JOURNAL : LOG_TARGET_JOURNAL_OR_KMSG);
-
                 if (!skip_setup) {
+                        mount_setup_early();
                         if (selinux_setup(&loaded_policy) < 0)
                                 goto finish;
                         if (ima_setup() < 0)
                                 goto finish;
+                        if (smack_setup() < 0)
+                                goto finish;
                 }
 
-                log_open();
-
                 if (label_init(NULL) < 0)
                         goto finish;
 
-                if (!skip_setup)
+                if (!skip_setup) {
                         if (hwclock_is_localtime() > 0) {
                                 int min;
 
-                                r = hwclock_apply_localtime_delta(&min);
+                                /* The first-time call to settimeofday() does a time warp in the kernel */
+                                r = hwclock_set_timezone(&min);
                                 if (r < 0)
                                         log_error("Failed to apply local time delta, ignoring: %s", strerror(-r));
                                 else
                                         log_info("RTC configured in localtime, applying delta of %i minutes to system time.", min);
+                        } else if (!in_initrd()) {
+                                /*
+                                 * Do dummy first-time call to seal the kernel's time warp magic
+                                 *
+                                 * Do not call this this from inside the initrd. The initrd might not
+                                 * carry /etc/adjtime with LOCAL, but the real system could be set up
+                                 * that way. In such case, we need to delay the time-warp or the sealing
+                                 * until we reach the real system.
+                                 */
+                                hwclock_reset_timezone();
+
+                                /* Tell the kernel our time zone */
+                                r = hwclock_set_timezone(NULL);
+                                if (r < 0)
+                                        log_error("Failed to set the kernel's time zone, ignoring: %s", strerror(-r));
                         }
+                }
+
+                /* Set the default for later on, but don't actually
+                 * open the logs like this for now. Note that if we
+                 * are transitioning from the initrd there might still
+                 * be journal fd open, and we shouldn't attempt
+                 * opening that before we parsed /proc/cmdline which
+                 * might redirect output elsewhere. */
+                log_set_target(LOG_TARGET_JOURNAL_OR_KMSG);
+
+        } else if (getpid() == 1) {
+
+                /* Running inside a container, as PID 1 */
+                arg_running_as = SYSTEMD_SYSTEM;
+                log_set_target(LOG_TARGET_CONSOLE);
+                log_open();
+
+                /* For the later on, see above... */
+                log_set_target(LOG_TARGET_JOURNAL);
 
         } else {
-                arg_running_as = MANAGER_USER;
+
+                /* Running as user instance */
+                arg_running_as = SYSTEMD_USER;
                 log_set_target(LOG_TARGET_AUTO);
                 log_open();
         }
 
         /* Initialize default unit */
-        if (set_default_unit(SPECIAL_DEFAULT_TARGET) < 0)
-                goto finish;
-
-        /* By default, mount "cpu" and "cpuacct" together */
-        arg_join_controllers = new(char**, 2);
-        if (!arg_join_controllers)
+        r = set_default_unit(SPECIAL_DEFAULT_TARGET);
+        if (r < 0) {
+                log_error("Failed to set default unit %s: %s", SPECIAL_DEFAULT_TARGET, strerror(-r));
                 goto finish;
+        }
 
-        arg_join_controllers[0] = strv_new("cpu", "cpuacct", NULL);
-        arg_join_controllers[1] = NULL;
-
-        if (!arg_join_controllers[0])
+        r = initialize_join_controllers();
+        if (r < 0)
                 goto finish;
 
         /* Mount /proc, /sys and friends, so that /proc/cmdline and
@@ -1345,7 +1452,7 @@ int main(int argc, char *argv[]) {
         if (parse_config_file() < 0)
                 goto finish;
 
-        if (arg_running_as == MANAGER_SYSTEM)
+        if (arg_running_as == SYSTEMD_SYSTEM)
                 if (parse_proc_cmdline() < 0)
                         goto finish;
 
@@ -1354,12 +1461,20 @@ int main(int argc, char *argv[]) {
         if (parse_argv(argc, argv) < 0)
                 goto finish;
 
-        if (arg_action == ACTION_TEST && geteuid() == 0) {
+        if (arg_action == ACTION_TEST &&
+            geteuid() == 0) {
                 log_error("Don't run test mode as root.");
                 goto finish;
         }
 
-        if (arg_running_as == MANAGER_SYSTEM &&
+        if (arg_running_as == SYSTEMD_USER &&
+            arg_action == ACTION_RUN &&
+            sd_booted() <= 0) {
+                log_error("Trying to run as user instance, but the system has not been booted with systemd.");
+                goto finish;
+        }
+
+        if (arg_running_as == SYSTEMD_SYSTEM &&
             arg_action == ACTION_RUN &&
             running_in_chroot() > 0) {
                 log_error("Cannot be run in a chroot() environment.");
@@ -1369,6 +1484,9 @@ int main(int argc, char *argv[]) {
         if (arg_action == ACTION_HELP) {
                 retval = help();
                 goto finish;
+        } else if (arg_action == ACTION_VERSION) {
+                retval = version();
+                goto finish;
         } else if (arg_action == ACTION_DUMP_CONFIGURATION_ITEMS) {
                 unit_dump_config_items(stdout);
                 retval = EXIT_SUCCESS;
@@ -1384,16 +1502,15 @@ int main(int argc, char *argv[]) {
         log_close();
 
         /* Remember open file descriptors for later deserialization */
-        if (serialization) {
-                r = fdset_new_fill(&fds);
-                if (r < 0) {
-                        log_error("Failed to allocate fd set: %s", strerror(-r));
-                        goto finish;
-                }
+        r = fdset_new_fill(&fds);
+        if (r < 0) {
+                log_error("Failed to allocate fd set: %s", strerror(-r));
+                goto finish;
+        } else
+                fdset_cloexec(fds, true);
 
+        if (serialization)
                 assert_se(fdset_remove(fds, fileno(serialization)) >= 0);
-        } else
-                close_all_fds(NULL, 0);
 
         /* Set up PATH unless it is already set */
         setenv("PATH",
@@ -1402,9 +1519,9 @@ int main(int argc, char *argv[]) {
 #else
                "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin",
 #endif
-               arg_running_as == MANAGER_SYSTEM);
+               arg_running_as == SYSTEMD_SYSTEM);
 
-        if (arg_running_as == MANAGER_SYSTEM) {
+        if (arg_running_as == SYSTEMD_SYSTEM) {
                 /* Parse the data passed to us. We leave this
                  * variables set, but the manager later on will not
                  * pass them on to our children. */
@@ -1428,6 +1545,12 @@ int main(int argc, char *argv[]) {
                 unsetenv("USER");
                 unsetenv("LOGNAME");
 
+                /* We suppress the socket activation env vars, as
+                 * we'll try to match *any* open fd to units if
+                 * possible. */
+                unsetenv("LISTEN_FDS");
+                unsetenv("LISTEN_PID");
+
                 /* All other variables are left as is, so that clients
                  * can still read them via /proc/1/environ */
         }
@@ -1435,7 +1558,7 @@ int main(int argc, char *argv[]) {
         /* Move out of the way, so that we won't block unmounts */
         assert_se(chdir("/")  == 0);
 
-        if (arg_running_as == MANAGER_SYSTEM) {
+        if (arg_running_as == SYSTEMD_SYSTEM) {
                 /* Become a session leader if we aren't one yet. */
                 setsid();
 
@@ -1448,10 +1571,8 @@ int main(int argc, char *argv[]) {
 
         /* Reset the console, but only if this is really init and we
          * are freshly booted */
-        if (arg_running_as == MANAGER_SYSTEM && arg_action == ACTION_RUN) {
+        if (arg_running_as == SYSTEMD_SYSTEM && arg_action == ACTION_RUN)
                 console_setup(getpid() == 1 && !skip_setup);
-                make_null_stdio();
-        }
 
         /* Open the logging devices, if possible and necessary */
         log_open();
@@ -1467,16 +1588,30 @@ int main(int argc, char *argv[]) {
                         goto finish;
         }
 
-        log_full(arg_running_as == MANAGER_SYSTEM ? LOG_INFO : LOG_DEBUG,
-                 PACKAGE_STRING " running in %s mode. (" SYSTEMD_FEATURES "; " DISTRIBUTION ")", manager_running_as_to_string(arg_running_as));
+        if (arg_running_as == SYSTEMD_SYSTEM) {
+                const char *virtualization = NULL;
+
+                log_info(PACKAGE_STRING " running in system mode. (" SYSTEMD_FEATURES ")");
+
+                detect_virtualization(&virtualization);
+                if (virtualization)
+                        log_info("Detected virtualization '%s'.", virtualization);
 
-        if (arg_running_as == MANAGER_SYSTEM && !skip_setup) {
+                if (in_initrd())
+                        log_info("Running in initial RAM disk.");
+
+        } else
+                log_debug(PACKAGE_STRING " running in user mode. (" SYSTEMD_FEATURES ")");
+
+        if (arg_running_as == SYSTEMD_SYSTEM && !skip_setup) {
                 locale_setup();
 
                 if (arg_show_status || plymouth_running())
                         status_welcome();
 
+#ifdef HAVE_KMOD
                 kmod_setup();
+#endif
                 hostname_setup();
                 machine_id_setup();
                 loopback_setup();
@@ -1486,7 +1621,7 @@ int main(int argc, char *argv[]) {
                 test_cgroups();
         }
 
-        if (arg_running_as == MANAGER_SYSTEM && arg_runtime_watchdog > 0)
+        if (arg_running_as == SYSTEMD_SYSTEM && arg_runtime_watchdog > 0)
                 watchdog_set_timeout(&arg_runtime_watchdog);
 
         if (arg_timer_slack_nsec != (nsec_t) -1)
@@ -1506,6 +1641,18 @@ int main(int argc, char *argv[]) {
                 }
         }
 
+        if (arg_running_as == SYSTEMD_USER) {
+                /* Become reaper of our children */
+                if (prctl(PR_SET_CHILD_SUBREAPER, 1) < 0) {
+                        log_warning("Failed to make us a subreaper: %m");
+                        if (errno == EINVAL)
+                                log_info("Perhaps the kernel version is too old (< 3.4?)");
+                }
+        }
+
+        if (arg_running_as == SYSTEMD_SYSTEM)
+                bump_rlimit_nofile(&saved_rlimit_nofile);
+
         r = manager_new(arg_running_as, &m);
         if (r < 0) {
                 log_error("Failed to allocate manager object: %s", strerror(-r));
@@ -1513,9 +1660,6 @@ int main(int argc, char *argv[]) {
         }
 
         m->confirm_spawn = arg_confirm_spawn;
-#ifdef HAVE_SYSV_COMPAT
-        m->sysv_console = arg_sysv_console;
-#endif
         m->default_std_output = arg_default_std_output;
         m->default_std_error = arg_default_std_error;
         m->runtime_watchdog = arg_runtime_watchdog;
@@ -1542,10 +1686,7 @@ int main(int argc, char *argv[]) {
 
         /* This will close all file descriptors that were opened, but
          * not claimed by any unit. */
-        if (fds) {
-                fdset_free(fds);
-                fds = NULL;
-        }
+        fdset_free(fds);
 
         if (serialization) {
                 fclose(serialization);
@@ -1594,12 +1735,23 @@ int main(int argc, char *argv[]) {
                         manager_dump_units(m, stdout, "\t");
                 }
 
-                r = manager_add_job(m, JOB_START, target, JOB_REPLACE, false, &error, &default_unit_job);
-                if (r < 0) {
-                        log_error("Failed to start default target: %s", bus_error(&error, r));
+                r = manager_add_job(m, JOB_START, target, JOB_ISOLATE, false, &error, &default_unit_job);
+                if (r == -EPERM) {
+                        log_error("Default target could not be isolated, starting instead: %s", bus_error(&error, r));
+                        dbus_error_free(&error);
+
+                        r = manager_add_job(m, JOB_START, target, JOB_REPLACE, false, &error, &default_unit_job);
+                        if (r < 0) {
+                                log_error("Failed to start default target: %s", bus_error(&error, r));
+                                dbus_error_free(&error);
+                                goto finish;
+                        }
+                } else if (r < 0) {
+                        log_error("Failed to isolate default target: %s", bus_error(&error, r));
                         dbus_error_free(&error);
                         goto finish;
                 }
+
                 m->default_unit_job_id = default_unit_job->id;
 
                 after_startup = now(CLOCK_MONOTONIC);
@@ -1638,7 +1790,7 @@ int main(int argc, char *argv[]) {
 
                 case MANAGER_REEXECUTE:
 
-                        if (prepare_reexecute(m, &serialization, &fds) < 0)
+                        if (prepare_reexecute(m, &serialization, &fds, true) < 0)
                                 goto finish;
 
                         reexecute = true;
@@ -1652,7 +1804,7 @@ int main(int argc, char *argv[]) {
                         m->switch_root = m->switch_root_init = NULL;
 
                         if (!switch_root_init)
-                                if (prepare_reexecute(m, &serialization, &fds) < 0)
+                                if (prepare_reexecute(m, &serialization, &fds, false) < 0)
                                         goto finish;
 
                         reexecute = true;
@@ -1687,7 +1839,7 @@ finish:
                 manager_free(m);
 
         for (j = 0; j < RLIMIT_NLIMITS; j++)
-                free (arg_default_rlimit[j]);
+                free(arg_default_rlimit[j]);
 
         free(arg_default_unit);
         strv_free(arg_default_controllers);
@@ -1705,7 +1857,20 @@ finish:
                  * rebooted while we do that */
                 watchdog_close(true);
 
+                /* Reset the RLIMIT_NOFILE to the kernel default, so
+                 * that the new systemd can pass the kernel default to
+                 * its child processes */
+                if (saved_rlimit_nofile.rlim_cur > 0)
+                        setrlimit(RLIMIT_NOFILE, &saved_rlimit_nofile);
+
                 if (switch_root_dir) {
+                        /* Kill all remaining processes from the
+                         * initrd, but don't wait for them, so that we
+                         * can handle the SIGCHLD for them after
+                         * deserializing. */
+                        broadcast_signal(SIGTERM, false);
+
+                        /* And switch root */
                         r = switch_root(switch_root_dir);
                         if (r < 0)
                                 log_error("Failed to switch root, ignoring: %s", strerror(-r));
@@ -1732,7 +1897,7 @@ finish:
                         args[i++] = SYSTEMD_BINARY_PATH;
                         if (switch_root_dir)
                                 args[i++] = "--switched-root";
-                        args[i++] = arg_running_as == MANAGER_SYSTEM ? "--system" : "--user";
+                        args[i++] = arg_running_as == SYSTEMD_SYSTEM ? "--system" : "--user";
                         args[i++] = "--deserialize";
                         args[i++] = sfd;
                         args[i++] = NULL;
@@ -1757,6 +1922,9 @@ finish:
                         fds = NULL;
                 }
 
+                /* Reopen the console */
+                make_console_stdio();
+
                 for (j = 1, i = 1; j < argc; j++)
                         args[i++] = argv[j];
                 args[i++] = NULL;