}
}
+static int socket_instantiate_service(Socket *s) {
+ char *prefix, *name;
+ int r;
+ Unit *u;
+
+ assert(s);
+
+ /* This fills in s->service if it isn't filled in yet. For
+ * Accept=yes sockets we create the next connection service
+ * here. For Accept=no this is mostly a NOP since the service
+ * is figured out at load time anyway. */
+
+ if (s->service)
+ return 0;
+
+ assert(s->accept);
+
+ if (!(prefix = unit_name_to_prefix(s->meta.id)))
+ return -ENOMEM;
+
+ r = asprintf(&name, "%s@%u.service", prefix, s->n_accepted);
+ free(prefix);
+
+ if (r < 0)
+ return -ENOMEM;
+
+ r = manager_load_unit(s->meta.manager, name, NULL, NULL, &u);
+ free(name);
+
+ if (r < 0)
+ return r;
+
+ s->service = SERVICE(u);
+ return 0;
+}
+
static bool have_non_accept_socket(Socket *s) {
SocketPort *p;
return -EINVAL;
}
+ if (s->accept && have_non_accept_socket(s)) {
+ log_error("%s configured for accepting sockets, but sockets are non-accepting. Refusing.", s->meta.id);
+ return -EINVAL;
+ }
+
if (s->accept && s->max_connections <= 0) {
log_error("%s's MaxConnection setting too small. Refusing.", s->meta.id);
return -EINVAL;
}
- if (s->exec_context.pam_name && s->kill_mode != KILL_CONTROL_GROUP) {
+ if (s->exec_context.pam_name && s->exec_context.kill_mode != KILL_CONTROL_GROUP) {
log_error("%s has PAM enabled. Kill mode must be set to 'control-group'. Refusing.", s->meta.id);
return -EINVAL;
}
"%sSocket State: %s\n"
"%sBindIPv6Only: %s\n"
"%sBacklog: %u\n"
- "%sKillMode: %s\n"
"%sSocketMode: %04o\n"
"%sDirectoryMode: %04o\n"
"%sKeepAlive: %s\n"
prefix, socket_state_to_string(s->state),
prefix, socket_address_bind_ipv6_only_to_string(s->bind_ipv6_only),
prefix, s->backlog,
- prefix, kill_mode_to_string(s->kill_mode),
prefix, s->socket_mode,
prefix, s->directory_mode,
prefix, yes_no(s->keep_alive),
b = ntohl(remote.in.sin_addr.s_addr);
if (asprintf(&r,
- "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
- nr,
+ "%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
ntohs(local.in.sin_port),
b >> 24, (b >> 16) & 0xFF, (b >> 8) & 0xFF, b & 0xFF,
*b = remote.in6.sin6_addr.s6_addr+12;
if (asprintf(&r,
- "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
- nr,
+ "%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
a[0], a[1], a[2], a[3],
ntohs(local.in6.sin6_port),
b[0], b[1], b[2], b[3],
char a[INET6_ADDRSTRLEN], b[INET6_ADDRSTRLEN];
if (asprintf(&r,
- "%u-%s:%u-%s:%u",
- nr,
+ "%s:%u-%s:%u",
inet_ntop(AF_INET6, &local.in6.sin6_addr, a, sizeof(a)),
ntohs(local.in6.sin6_port),
inet_ntop(AF_INET6, &remote.in6.sin6_addr, b, sizeof(b)),
}
}
-static void socket_apply_pipe_options(Socket *s, int fd) {
+static void socket_apply_fifo_options(Socket *s, int fd) {
assert(s);
assert(fd >= 0);
log_warning("F_SETPIPE_SZ: %m");
}
+static int fifo_address_create(
+ const char *path,
+ mode_t directory_mode,
+ mode_t socket_mode,
+ /* FIXME SELINUX: pass SELinux context object here */
+ int *_fd) {
+
+ int fd = -1, r;
+ struct stat st;
+ mode_t old_mask;
+
+ assert(path);
+ assert(_fd);
+
+ mkdir_parents(path, directory_mode);
+
+ /* FIXME SELINUX: The mkfifo here should be done with
+ * the right SELinux context set */
+
+ /* Enforce the right access mode for the fifo */
+ old_mask = umask(~ socket_mode);
+
+ /* Include the original umask in our mask */
+ umask(~socket_mode | old_mask);
+
+ r = mkfifo(path, socket_mode);
+ umask(old_mask);
+
+ if (r < 0) {
+ r = -errno;
+ goto fail;
+ }
+
+ if ((fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW)) < 0) {
+ r = -errno;
+ goto fail;
+ }
+
+ if (fstat(fd, &st) < 0) {
+ r = -errno;
+ goto fail;
+ }
+
+ if (!S_ISFIFO(st.st_mode) ||
+ st.st_mode != (socket_mode & ~old_mask) ||
+ st.st_uid != getuid() ||
+ st.st_gid != getgid()) {
+
+ r = -EEXIST;
+ goto fail;
+ }
+
+ *_fd = fd;
+ return 0;
+
+fail:
+ if (fd >= 0)
+ close_nointr_nofail(fd);
+
+ return r;
+}
+
static int socket_open_fds(Socket *s) {
SocketPort *p;
int r;
assert(s);
+ /* FIXME SELINUX: Somewhere here we must set the the SELinux
+ context for the created sockets and FIFOs. To figure out
+ the executable name for this, use
+ socket_instantiate_service() and then access the executable
+ path name via
+ s->service->exec_command[SERVICE_EXEC_START]->path. Example:
+
+ if ((r = socket_instantiate_service(s)) < 0)
+ return r;
+
+ log_debug("Socket unit %s will spawn service unit %s with executable path %s.",
+ s->meta.id,
+ s->service->meta.id,
+ s->service->exec_command[SERVICE_EXEC_START]->path);
+ */
+
LIST_FOREACH(port, p, s->ports) {
if (p->fd >= 0)
s->free_bind,
s->directory_mode,
s->socket_mode,
+ /* FIXME SELINUX: Pass the SELinux context object here */
&p->fd)) < 0)
goto rollback;
socket_apply_socket_options(s, p->fd);
- } else {
- struct stat st;
- assert(p->type == SOCKET_FIFO);
-
- mkdir_parents(p->path, s->directory_mode);
+ } else if (p->type == SOCKET_FIFO) {
- if (mkfifo(p->path, s->socket_mode) < 0 && errno != EEXIST) {
- r = -errno;
- goto rollback;
- }
-
- if ((p->fd = open(p->path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW)) < 0) {
- r = -errno;
- goto rollback;
- }
-
- if (fstat(p->fd, &st) < 0) {
- r = -errno;
+ if ((r = fifo_address_create(
+ p->path,
+ s->directory_mode,
+ s->socket_mode,
+ /* FIXME SELINUX: Pass the SELinux context object here */
+ &p->fd)) < 0)
goto rollback;
- }
-
- /* FIXME verify user, access mode */
- if (!S_ISFIFO(st.st_mode)) {
- r = -EEXIST;
- goto rollback;
- }
+ socket_apply_fifo_options(s, p->fd);
- socket_apply_pipe_options(s, p->fd);
- }
+ } else
+ assert_not_reached("Unknown port type");
}
return 0;
if (!success)
s->failure = true;
- if (s->kill_mode != KILL_NONE) {
- int sig = (state == SOCKET_STOP_PRE_SIGTERM || state == SOCKET_FINAL_SIGTERM) ? SIGTERM : SIGKILL;
+ if (s->exec_context.kill_mode != KILL_NONE) {
+ int sig = (state == SOCKET_STOP_PRE_SIGTERM || state == SOCKET_FINAL_SIGTERM) ? s->exec_context.kill_signal : SIGKILL;
- if (s->kill_mode == KILL_CONTROL_GROUP) {
+ if (s->exec_context.kill_mode == KILL_CONTROL_GROUP) {
if ((r = cgroup_bonding_kill_list(s->meta.cgroup_bondings, sig)) < 0) {
if (r != -EAGAIN && r != -ESRCH)
}
if (!sent && s->control_pid > 0)
- if (kill(s->kill_mode == KILL_PROCESS ? s->control_pid : -s->control_pid, sig) < 0 && errno != ESRCH) {
+ if (kill(s->exec_context.kill_mode == KILL_PROCESS ? s->control_pid : -s->control_pid, sig) < 0 && errno != ESRCH) {
r = -errno;
goto fail;
}
assert(s);
dbus_error_init(&error);
+ /* We don't take connections anymore if we are supposed to
+ * shut down anyway */
+ if (s->meta.job && s->meta.job->type == JOB_STOP) {
+ if (cfd >= 0)
+ close_nointr_nofail(cfd);
+ else {
+ /* Flush all sockets by closing and reopening them */
+ socket_close_fds(s);
+
+ if ((r = socket_watch_fds(s)) < 0) {
+ log_warning("%s failed to watch sockets: %s", s->meta.id, strerror(-r));
+ socket_enter_stop_pre(s, false);
+ }
+ }
+
+ return;
+ }
+
if (cfd < 0) {
if ((r = manager_add_job(s->meta.manager, JOB_START, UNIT(s->service), JOB_REPLACE, true, &error, NULL)) < 0)
goto fail;
socket_set_state(s, SOCKET_RUNNING);
} else {
- Unit *u;
char *prefix, *instance = NULL, *name;
+ Service *service;
if (s->n_connections >= s->max_connections) {
log_warning("Too many incoming connections (%u)", s->n_connections);
return;
}
- if ((r = instance_from_socket(cfd, s->n_accepted++, &instance)) < 0)
+ if ((r = socket_instantiate_service(s)) < 0)
+ goto fail;
+
+ if ((r = instance_from_socket(cfd, s->n_accepted, &instance)) < 0)
goto fail;
if (!(prefix = unit_name_to_prefix(s->meta.id))) {
goto fail;
}
- r = manager_load_unit(s->meta.manager, name, NULL, NULL, &u);
- free(name);
-
- if (r < 0)
+ if ((r = unit_add_name(UNIT(s->service), name)) < 0) {
+ free(name);
goto fail;
+ }
+
+ service = s->service;
+ s->service = NULL;
+ s->n_accepted ++;
+
+ unit_choose_id(UNIT(service), name);
+ free(name);
- if ((r = service_set_socket_fd(SERVICE(u), cfd, s)) < 0)
+ if ((r = service_set_socket_fd(service, cfd, s)) < 0)
goto fail;
cfd = -1;
-
s->n_connections ++;
- if ((r = manager_add_job(u->meta.manager, JOB_START, u, JOB_REPLACE, true, &error, NULL)) < 0)
+ if ((r = manager_add_job(s->meta.manager, JOB_START, UNIT(service), JOB_REPLACE, true, &error, NULL)) < 0)
goto fail;
}
assert(s);
- /* We cannot fulfill this request right now, try again later
- * please! */
- if (s->state == SOCKET_START_PRE ||
- s->state == SOCKET_START_POST)
- return -EAGAIN;
-
/* Already on it */
if (s->state == SOCKET_STOP_PRE ||
s->state == SOCKET_STOP_PRE_SIGTERM ||
s->state == SOCKET_STOP_PRE_SIGKILL ||
s->state == SOCKET_STOP_POST ||
s->state == SOCKET_FINAL_SIGTERM ||
- s->state == SOCKET_FINAL_SIGTERM)
+ s->state == SOCKET_FINAL_SIGKILL)
return 0;
+ /* If there's already something running we go directly into
+ * kill mode. */
+ if (s->state == SOCKET_START_PRE ||
+ s->state == SOCKET_START_POST) {
+ socket_enter_signal(s, SOCKET_STOP_PRE_SIGTERM, true);
+ return -EAGAIN;
+ }
+
assert(s->state == SOCKET_LISTENING || s->state == SOCKET_RUNNING);
socket_enter_stop_pre(s, true);
s->control_pid = 0;
success = is_clean_exit(code, status);
- s->failure = s->failure || !success;
- if (s->control_command)
+ if (s->control_command) {
exec_status_exit(&s->control_command->exec_status, pid, code, status);
- log_debug("%s control process exited, code=%s status=%i", u->meta.id, sigchld_code_to_string(code), status);
+ if (s->control_command->ignore)
+ success = true;
+ }
+
+ log_full(success ? LOG_DEBUG : LOG_NOTICE,
+ "%s control process exited, code=%s status=%i", u->meta.id, sigchld_code_to_string(code), status);
+ s->failure = s->failure || !success;
if (s->control_command && s->control_command->command_next && success) {
log_debug("%s running next command for state %s", u->meta.id, socket_state_to_string(s->state));
log_debug("%s: One connection closed, %u left.", s->meta.id, s->n_connections);
}
+static void socket_reset_maintenance(Unit *u) {
+ Socket *s = SOCKET(u);
+
+ assert(s);
+
+ if (s->state == SOCKET_MAINTENANCE)
+ socket_set_state(s, SOCKET_DEAD);
+
+ s->failure = false;
+}
+
static const char* const socket_state_table[_SOCKET_STATE_MAX] = {
[SOCKET_DEAD] = "dead",
[SOCKET_START_PRE] = "start-pre",
.sigchld_event = socket_sigchld_event,
.timer_event = socket_timer_event,
+ .reset_maintenance = socket_reset_maintenance,
+
.bus_message_handler = bus_socket_message_handler
};
~ianmdlvl / elogind.git / blobdiff