X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fcore%2Fcondition.c;h=24684580a8326c420f742ffe48469eaa1360285f;hp=e5cda21c37d8e4f8bbae3cbbc7bd3d5178f40e07;hb=4e595329a93ed190795c2e24bf132d5028ec6a72;hpb=c0d6e764d107a81a6439c41edbe92790623ed7de diff --git a/src/core/condition.c b/src/core/condition.c index e5cda21c3..24684580a 100644 --- a/src/core/condition.c +++ b/src/core/condition.c @@ -27,160 +27,55 @@ #include #include -#ifdef HAVE_SELINUX -#include -#endif - #include #include "util.h" #include "condition.h" #include "virt.h" #include "path-util.h" - -Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) { - Condition *c; - - assert(type < _CONDITION_TYPE_MAX); - - c = new0(Condition, 1); - if (!c) - return NULL; - - c->type = type; - c->trigger = trigger; - c->negate = negate; - - if (parameter) { - c->parameter = strdup(parameter); - if (!c->parameter) { - free(c); - return NULL; - } - } - - return c; -} - -void condition_free(Condition *c) { +#include "fileio.h" +#include "unit.h" +#include "smack-util.h" +#include "apparmor-util.h" +#include "ima-util.h" +#include "selinux-util.h" + +static bool condition_test_security(Condition *c) { assert(c); - - free(c->parameter); - free(c); -} - -void condition_free_list(Condition *first) { - Condition *c, *n; - - LIST_FOREACH_SAFE(conditions, c, n, first) - condition_free(c); -} - -static bool test_kernel_command_line(const char *parameter) { - char *line, *w, *state, *word = NULL; - bool equal; - int r; - size_t l, pl; - bool found = false; - - assert(parameter); - - if (detect_container(NULL) > 0) - return false; - - r = read_one_line_file("/proc/cmdline", &line); - if (r < 0) { - log_warning("Failed to read /proc/cmdline, ignoring: %s", strerror(-r)); - return false; - } - - equal = !!strchr(parameter, '='); - pl = strlen(parameter); - - FOREACH_WORD_QUOTED(w, l, line, state) { - - free(word); - word = strndup(w, l); - if (!word) - break; - - if (equal) { - if (streq(word, parameter)) { - found = true; - break; - } - } else { - if (startswith(word, parameter) && (word[pl] == '=' || word[pl] == 0)) { - found = true; - break; - } - } - - } - - free(word); - free(line); - - return found; -} - -static bool test_virtualization(const char *parameter) { - int b; - Virtualization v; - const char *id; - - assert(parameter); - - v = detect_virtualization(&id); - if (v < 0) { - log_warning("Failed to detect virtualization, ignoring: %s", strerror(-v)); - return false; - } - - /* First, compare with yes/no */ - b = parse_boolean(parameter); - - if (v > 0 && b > 0) - return true; - - if (v == 0 && b == 0) - return true; - - /* Then, compare categorization */ - if (v == VIRTUALIZATION_VM && streq(parameter, "vm")) - return true; - - if (v == VIRTUALIZATION_CONTAINER && streq(parameter, "container")) - return true; - - /* Finally compare id */ - return v > 0 && streq(parameter, id); + assert(c->parameter); + assert(c->type == CONDITION_SECURITY); + + if (streq(c->parameter, "selinux")) + return use_selinux() == !c->negate; + if (streq(c->parameter, "apparmor")) + return use_apparmor() == !c->negate; + if (streq(c->parameter, "ima")) + return use_ima() == !c->negate; + if (streq(c->parameter, "smack")) + return use_smack() == !c->negate; + return c->negate; } -static bool test_security(const char *parameter) { -#ifdef HAVE_SELINUX - if (streq(parameter, "selinux")) - return is_selinux_enabled() > 0; -#endif - return false; -} - -static bool test_capability(const char *parameter) { +static bool condition_test_capability(Condition *c) { cap_value_t value; FILE *f; char line[LINE_MAX]; - unsigned long long capabilities = (unsigned long long) -1; + unsigned long long capabilities = -1; + + assert(c); + assert(c->parameter); + assert(c->type == CONDITION_CAPABILITY); /* If it's an invalid capability, we don't have it */ - if (cap_from_name(parameter, &value) < 0) - return false; + if (cap_from_name(c->parameter, &value) < 0) + return c->negate; /* If it's a valid capability we default to assume * that we have it */ f = fopen("/proc/self/status", "re"); if (!f) - return true; + return !c->negate; while (fgets(line, sizeof(line), f)) { truncate_nl(line); @@ -193,35 +88,10 @@ static bool test_capability(const char *parameter) { fclose(f); - return !!(capabilities & (1ULL << value)); -} - -static bool test_host(const char *parameter) { - sd_id128_t x, y; - char *h; - int r; - bool b; - - if (sd_id128_from_string(parameter, &x) >= 0) { - - r = sd_id128_get_machine(&y); - if (r < 0) - return false; - - return sd_id128_equal(x, y); - } - - h = gethostname_malloc(); - if (!h) - return false; - - b = fnmatch(parameter, h, FNM_CASEFOLD) == 0; - free(h); - - return b; + return !!(capabilities & (1ULL << value)) == !c->negate; } -bool condition_test(Condition *c) { +static bool condition_test(Condition *c) { assert(c); switch(c->type) { @@ -261,6 +131,15 @@ bool condition_test(Condition *c) { return !(k == -ENOENT || k > 0) == !c->negate; } + case CONDITION_FILE_NOT_EMPTY: { + struct stat st; + + if (stat(c->parameter, &st) < 0) + return c->negate; + + return (S_ISREG(st.st_mode) && st.st_size > 0) == !c->negate; + } + case CONDITION_FILE_IS_EXECUTABLE: { struct stat st; @@ -271,19 +150,25 @@ bool condition_test(Condition *c) { } case CONDITION_KERNEL_COMMAND_LINE: - return test_kernel_command_line(c->parameter) == !c->negate; + return condition_test_kernel_command_line(c); case CONDITION_VIRTUALIZATION: - return test_virtualization(c->parameter) == !c->negate; + return condition_test_virtualization(c); case CONDITION_SECURITY: - return test_security(c->parameter) == !c->negate; + return condition_test_security(c); case CONDITION_CAPABILITY: - return test_capability(c->parameter) == !c->negate; + return condition_test_capability(c); case CONDITION_HOST: - return test_host(c->parameter) == !c->negate; + return condition_test_host(c); + + case CONDITION_AC_POWER: + return condition_test_ac_power(c); + + case CONDITION_ARCHITECTURE: + return condition_test_architecture(c); case CONDITION_NULL: return !c->negate; @@ -293,7 +178,7 @@ bool condition_test(Condition *c) { } } -bool condition_test_list(Condition *first) { +bool condition_test_list(const char *unit, Condition *first) { Condition *c; int triggered = -1; @@ -308,6 +193,16 @@ bool condition_test_list(Condition *first) { bool b; b = condition_test(c); + if (unit) + log_debug_unit(unit, + "%s=%s%s%s %s for %s.", + condition_type_to_string(c->type), + c->trigger ? "|" : "", + c->negate ? "!" : "", + c->parameter, + b ? "succeeded" : "failed", + unit); + c->state = b ? 1 : -1; if (!c->trigger && !b) return false; @@ -318,43 +213,3 @@ bool condition_test_list(Condition *first) { return triggered != 0; } - -void condition_dump(Condition *c, FILE *f, const char *prefix) { - assert(c); - assert(f); - - if (!prefix) - prefix = ""; - - fprintf(f, - "%s\t%s: %s%s%s\n", - prefix, - condition_type_to_string(c->type), - c->trigger ? "|" : "", - c->negate ? "!" : "", - c->parameter); -} - -void condition_dump_list(Condition *first, FILE *f, const char *prefix) { - Condition *c; - - LIST_FOREACH(conditions, c, first) - condition_dump(c, f, prefix); -} - -static const char* const condition_type_table[_CONDITION_TYPE_MAX] = { - [CONDITION_PATH_EXISTS] = "ConditionPathExists", - [CONDITION_PATH_EXISTS_GLOB] = "ConditionPathExistsGlob", - [CONDITION_PATH_IS_DIRECTORY] = "ConditionPathIsDirectory", - [CONDITION_PATH_IS_SYMBOLIC_LINK] = "ConditionPathIsSymbolicLink", - [CONDITION_PATH_IS_MOUNT_POINT] = "ConditionPathIsMountPoint", - [CONDITION_PATH_IS_READ_WRITE] = "ConditionPathIsReadWrite", - [CONDITION_DIRECTORY_NOT_EMPTY] = "ConditionDirectoryNotEmpty", - [CONDITION_KERNEL_COMMAND_LINE] = "ConditionKernelCommandLine", - [CONDITION_VIRTUALIZATION] = "ConditionVirtualization", - [CONDITION_SECURITY] = "ConditionSecurity", - [CONDITION_HOST] = "ConditionHost", - [CONDITION_NULL] = "ConditionNull" -}; - -DEFINE_STRING_TABLE_LOOKUP(condition_type, ConditionType);