main: added support for loading IMA custom policies

[elogind.git] / src / main.c

diff --git a/src/main.c b/src/main.c
index 94e6ec63ccebd817b722cea2b09f6731e03d15f5..7ae88414a93a74ed7c09791c86646a7c02c8bd25 100644 (file)
--- a/src/main.c
+++ b/src/main.c
@@ -41,6 +41,7 @@
 #include "kmod-setup.h"
 #include "locale-setup.h"
 #include "selinux-setup.h"
+#include "ima-setup.h"
 #include "machine-id-setup.h"
 #include "load-fragment.h"
 #include "fdset.h"
@@ -323,6 +324,26 @@ static int parse_proc_cmdline_word(const char *word) {
                         log_warning("Failed to parse default standard error switch %s. Ignoring.", word + 31);
                 else
                         arg_default_std_error = r;
+        } else if (startswith(word, "systemd.setenv=")) {
+                char *cenv, *eq;
+                int r;
+
+                cenv = strdup(word + 15);
+                if (!cenv)
+                        return -ENOMEM;
+
+                eq = strchr(cenv, '=');
+                if (!eq) {
+                        r = unsetenv(cenv);
+                        if (r < 0)
+                                log_warning("unsetenv failed %s. Ignoring.", strerror(errno));
+                } else {
+                        *eq = 0;
+                        r = setenv(cenv, eq + 1, 1);
+                        if (r < 0)
+                                log_warning("setenv failed %s. Ignoring.", strerror(errno));
+                }
+                free(cenv);
 #ifdef HAVE_SYSV_COMPAT
         } else if (startswith(word, "systemd.sysv_console=")) {
                 int r;
@@ -1138,7 +1159,7 @@ int main(int argc, char *argv[]) {
         bool reexecute = false;
         const char *shutdown_verb = NULL;
         dual_timestamp initrd_timestamp = { 0ULL, 0ULL };
-        char systemd[] = "systemd";
+        static char systemd[] = "systemd";
         bool is_reexec = false;
         int j;
         bool loaded_policy = false;
@@ -1169,9 +1190,9 @@ int main(int argc, char *argv[]) {
            called 'init'. After a subsequent reexecution we are then
            called 'systemd'. That is confusing, hence let's call us
            systemd right-away. */
-
         program_invocation_short_name = systemd;
         prctl(PR_SET_NAME, systemd);
+
         saved_argv = argv;
         saved_argc = argc;
 
@@ -1183,9 +1204,12 @@ int main(int argc, char *argv[]) {
                 arg_running_as = MANAGER_SYSTEM;
                 log_set_target(detect_container(NULL) > 0 ? LOG_TARGET_CONSOLE : LOG_TARGET_JOURNAL_OR_KMSG);
 
-                if (!is_reexec)
+                if (!is_reexec) {
                         if (selinux_setup(&loaded_policy) < 0)
                                 goto finish;
+                        if (ima_setup() < 0)
+                                goto finish;
+                }
 
                 log_open();
 
@@ -1292,7 +1316,11 @@ int main(int argc, char *argv[]) {
 
         /* Set up PATH unless it is already set */
         setenv("PATH",
+#ifdef HAVE_SPLIT_USR
                "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+#else
+               "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin",
+#endif
                arg_running_as == MANAGER_SYSTEM);
 
         if (arg_running_as == MANAGER_SYSTEM) {
@@ -1404,6 +1432,7 @@ int main(int argc, char *argv[]) {
         } else {
                 DBusError error;
                 Unit *target = NULL;
+                Job *default_unit_job;
 
                 dbus_error_init(&error);
 
@@ -1440,11 +1469,13 @@ int main(int argc, char *argv[]) {
                         manager_dump_units(m, stdout, "\t");
                 }
 
-                if ((r = manager_add_job(m, JOB_START, target, JOB_REPLACE, false, &error, NULL)) < 0) {
+                r = manager_add_job(m, JOB_START, target, JOB_REPLACE, false, &error, &default_unit_job);
+                if (r < 0) {
                         log_error("Failed to start default target: %s", bus_error(&error, r));
                         dbus_error_free(&error);
                         goto finish;
                 }
+                m->default_unit_job_id = default_unit_job->id;
 
                 after_startup = now(CLOCK_MONOTONIC);
                 log_full(arg_action == ACTION_TEST ? LOG_INFO : LOG_DEBUG,