X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fcore%2Fexecute.c;h=02df51b5bb29f6b0b0b05f83c22c6a5c6813a8f0;hp=96cabe6d99c7bb8d5bf95910c18962550cb4fbcf;hb=cd972d6911b0e1403e0a11408be732fc3a513f2b;hpb=a610cc4f18c24a007e5a2cac21b2ecbd81e5f3c3
diff --git a/src/core/execute.c b/src/core/execute.c
index 96cabe6d9..02df51b5b 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -19,8 +19,6 @@
along with systemd; If not, see .
***/
-#include
-#include
#include
#include
#include
@@ -29,19 +27,11 @@
#include
#include
#include
-#include
-#include
#include
#include
-#include
-#include
-#include
-#include
-#include
+#include
#include
#include
-#include
-#undef basename
#ifdef HAVE_PAM
#include
@@ -82,7 +72,13 @@
#include "errno-list.h"
#include "af-list.h"
#include "mkdir.h"
+#include "smack-util.h"
+#include "bus-endpoint.h"
+#include "cap-list.h"
+
+#ifdef HAVE_APPARMOR
#include "apparmor-util.h"
+#endif
#ifdef HAVE_SECCOMP
#include "seccomp-util.h"
@@ -126,7 +122,7 @@ static int shift_fds(int fds[], unsigned n_fds) {
fds[i] = nfd;
/* Hmm, the fd we wanted isn't free? Then
- * let's remember that and try again from here*/
+ * let's remember that and try again from here */
if (nfd != i+3 && restart_from < 0)
restart_from = i;
}
@@ -215,12 +211,52 @@ static int open_null_as(int flags, int nfd) {
return r;
}
-static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
- int fd, r;
+static int connect_journal_socket(int fd, uid_t uid, gid_t gid) {
union sockaddr_union sa = {
.un.sun_family = AF_UNIX,
.un.sun_path = "/run/systemd/journal/stdout",
};
+ uid_t olduid = UID_INVALID;
+ gid_t oldgid = GID_INVALID;
+ int r;
+
+ if (gid != GID_INVALID) {
+ oldgid = getgid();
+
+ r = setegid(gid);
+ if (r < 0)
+ return -errno;
+ }
+
+ if (uid != UID_INVALID) {
+ olduid = getuid();
+
+ r = seteuid(uid);
+ if (r < 0) {
+ r = -errno;
+ goto restore_gid;
+ }
+ }
+
+ r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
+ if (r < 0)
+ r = -errno;
+
+ /* If we fail to restore the uid or gid, things will likely
+ fail later on. This should only happen if an LSM interferes. */
+
+ if (uid != UID_INVALID)
+ (void) seteuid(olduid);
+
+ restore_gid:
+ if (gid != GID_INVALID)
+ (void) setegid(oldgid);
+
+ return r;
+}
+
+static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd, uid_t uid, gid_t gid) {
+ int fd, r;
assert(context);
assert(output < _EXEC_OUTPUT_MAX);
@@ -231,11 +267,9 @@ static int connect_logger_as(const ExecContext *context, ExecOutput output, cons
if (fd < 0)
return -errno;
- r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
- if (r < 0) {
- safe_close(fd);
- return -errno;
- }
+ r = connect_journal_socket(fd, uid, gid);
+ if (r < 0)
+ return r;
if (shutdown(fd, SHUT_RD) < 0) {
safe_close(fd);
@@ -354,7 +388,7 @@ static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty
}
}
-static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
+static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin, uid_t uid, gid_t gid) {
ExecOutput o;
ExecInput i;
int r;
@@ -421,14 +455,15 @@ static int setup_output(const ExecContext *context, int fileno, int socket_fd, c
case EXEC_OUTPUT_KMSG_AND_CONSOLE:
case EXEC_OUTPUT_JOURNAL:
case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
- r = connect_logger_as(context, o, ident, unit_id, fileno);
+ r = connect_logger_as(context, o, ident, unit_id, fileno, uid, gid);
if (r < 0) {
- log_struct_unit(LOG_CRIT, unit_id,
- "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
- fileno == STDOUT_FILENO ? "out" : "err",
- unit_id, strerror(-r),
- "ERRNO=%d", -r,
- NULL);
+ log_unit_struct(unit_id,
+ LOG_ERR,
+ LOG_MESSAGE("Failed to connect %s of %s to the journal socket: %s",
+ fileno == STDOUT_FILENO ? "stdout" : "stderr",
+ unit_id, strerror(-r)),
+ LOG_ERRNO(-r),
+ NULL);
r = open_null_as(O_WRONLY, fileno);
}
return r;
@@ -754,7 +789,7 @@ static int setup_pam(
* daemon. We do things this way to ensure that the main PID
* of the daemon is the one we initially fork()ed. */
- if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
+ if (log_get_max_level() < LOG_DEBUG)
flags |= PAM_SILENT;
pam_code = pam_start(name, user, &conv, &handle);
@@ -819,7 +854,7 @@ static int setup_pam(
* If this fails, ignore the error - but expect sd-pam threads
* to fail to exit normally */
if (setresuid(uid, uid, uid) < 0)
- log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
+ log_error_errno(r, "Error: Failed to setresuid() in sd-pam: %m");
/* Wait until our parent died. This will only work if
* the above setresuid() succeeds, otherwise the kernel
@@ -881,7 +916,7 @@ fail:
log_error("PAM failed: %s", pam_strerror(handle, pam_code));
err = -EPERM; /* PAM errors do not map to errno */
} else {
- log_error("PAM failed: %m");
+ log_error_errno(errno, "PAM failed: %m");
err = -errno;
}
@@ -938,7 +973,7 @@ static void rename_process_from_path(const char *path) {
#ifdef HAVE_SECCOMP
-static int apply_seccomp(ExecContext *c) {
+static int apply_seccomp(const ExecContext *c) {
uint32_t negative_action, action;
scmp_filter_ctx *seccomp;
Iterator i;
@@ -987,7 +1022,7 @@ finish:
return r;
}
-static int apply_address_families(ExecContext *c) {
+static int apply_address_families(const ExecContext *c) {
scmp_filter_ctx *seccomp;
Iterator i;
int r;
@@ -1124,10 +1159,10 @@ static void do_idle_pipe_dance(int idle_pipe[4]) {
if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
/* Signal systemd that we are bored and want to continue. */
- write(idle_pipe[3], "x", 1);
-
- /* Wait for systemd to react to the signal above. */
- fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
+ r = write(idle_pipe[3], "x", 1);
+ if (r > 0)
+ /* Wait for systemd to react to the signal above. */
+ fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
}
safe_close(idle_pipe[0]);
@@ -1223,28 +1258,30 @@ static int build_environment(
return 0;
}
-static int exec_child(ExecCommand *command,
- const ExecContext *context,
- const ExecParameters *params,
- ExecRuntime *runtime,
- char **argv,
- int socket_fd,
- int *fds, unsigned n_fds,
- char **files_env,
- int *error) {
+static int exec_child(
+ ExecCommand *command,
+ const ExecContext *context,
+ const ExecParameters *params,
+ ExecRuntime *runtime,
+ char **argv,
+ int socket_fd,
+ int *fds, unsigned n_fds,
+ char **files_env,
+ int *exit_status) {
_cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
+ _cleanup_free_ char *mac_selinux_context_net = NULL;
const char *username = NULL, *home = NULL, *shell = NULL;
unsigned n_dont_close = 0;
- int dont_close[n_fds + 3];
- uid_t uid = (uid_t) -1;
- gid_t gid = (gid_t) -1;
- int i, err;
+ int dont_close[n_fds + 4];
+ uid_t uid = UID_INVALID;
+ gid_t gid = GID_INVALID;
+ int i, r;
assert(command);
assert(context);
assert(params);
- assert(error);
+ assert(exit_status);
rename_process_from_path(command->path);
@@ -1259,10 +1296,10 @@ static int exec_child(ExecCommand *command,
if (context->ignore_sigpipe)
ignore_signals(SIGPIPE, -1);
- err = reset_signal_mask();
- if (err < 0) {
- *error = EXIT_SIGNAL_MASK;
- return err;
+ r = reset_signal_mask();
+ if (r < 0) {
+ *exit_status = EXIT_SIGNAL_MASK;
+ return r;
}
if (params->idle_pipe)
@@ -1271,6 +1308,7 @@ static int exec_child(ExecCommand *command,
/* Close sockets very early to make sure we don't
* block init reexecution because it cannot bind its
* sockets */
+
log_forget_fds();
if (socket_fd >= 0)
@@ -1279,6 +1317,8 @@ static int exec_child(ExecCommand *command,
memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
n_dont_close += n_fds;
}
+ if (params->bus_endpoint_fd >= 0)
+ dont_close[n_dont_close++] = params->bus_endpoint_fd;
if (runtime) {
if (runtime->netns_storage_socket[0] >= 0)
dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
@@ -1286,15 +1326,15 @@ static int exec_child(ExecCommand *command,
dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
}
- err = close_all_fds(dont_close, n_dont_close);
- if (err < 0) {
- *error = EXIT_FDS;
- return err;
+ r = close_all_fds(dont_close, n_dont_close);
+ if (r < 0) {
+ *exit_status = EXIT_FDS;
+ return r;
}
if (!context->same_pgrp)
if (setsid() < 0) {
- *error = EXIT_SETSID;
+ *exit_status = EXIT_SETSID;
return -errno;
}
@@ -1303,68 +1343,85 @@ static int exec_child(ExecCommand *command,
if (params->confirm_spawn) {
char response;
- err = ask_for_confirmation(&response, argv);
- if (err == -ETIMEDOUT)
+ r = ask_for_confirmation(&response, argv);
+ if (r == -ETIMEDOUT)
write_confirm_message("Confirmation question timed out, assuming positive response.\n");
- else if (err < 0)
- write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
+ else if (r < 0)
+ write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-r));
else if (response == 's') {
write_confirm_message("Skipping execution.\n");
- *error = EXIT_CONFIRM;
+ *exit_status = EXIT_CONFIRM;
return -ECANCELED;
} else if (response == 'n') {
write_confirm_message("Failing execution.\n");
- *error = 0;
+ *exit_status = 0;
return 0;
}
}
+ if (context->user) {
+ username = context->user;
+ r = get_user_creds(&username, &uid, &gid, &home, &shell);
+ if (r < 0) {
+ *exit_status = EXIT_USER;
+ return r;
+ }
+ }
+
/* If a socket is connected to STDIN/STDOUT/STDERR, we
* must sure to drop O_NONBLOCK */
if (socket_fd >= 0)
fd_nonblock(socket_fd, false);
- err = setup_input(context, socket_fd, params->apply_tty_stdin);
- if (err < 0) {
- *error = EXIT_STDIN;
- return err;
+ r = setup_input(context, socket_fd, params->apply_tty_stdin);
+ if (r < 0) {
+ *exit_status = EXIT_STDIN;
+ return r;
}
- err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin);
- if (err < 0) {
- *error = EXIT_STDOUT;
- return err;
+ r = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin, uid, gid);
+ if (r < 0) {
+ *exit_status = EXIT_STDOUT;
+ return r;
}
- err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin);
- if (err < 0) {
- *error = EXIT_STDERR;
- return err;
+ r = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin, uid, gid);
+ if (r < 0) {
+ *exit_status = EXIT_STDERR;
+ return r;
}
if (params->cgroup_path) {
- err = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0);
- if (err < 0) {
- *error = EXIT_CGROUP;
- return err;
+ r = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0, NULL, NULL);
+ if (r < 0) {
+ *exit_status = EXIT_CGROUP;
+ return r;
}
}
if (context->oom_score_adjust_set) {
- char t[16];
+ char t[DECIMAL_STR_MAX(context->oom_score_adjust)];
- snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
- char_array_0(t);
+ /* When we can't make this change due to EPERM, then
+ * let's silently skip over it. User namespaces
+ * prohibit write access to this file, and we
+ * shouldn't trip up over that. */
- if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
- *error = EXIT_OOM_ADJUST;
+ sprintf(t, "%i", context->oom_score_adjust);
+ r = write_string_file("/proc/self/oom_score_adj", t);
+ if (r == -EPERM || r == -EACCES) {
+ log_open();
+ log_unit_debug_errno(params->unit_id, r, "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m");
+ log_close();
+ } else if (r < 0) {
+ *exit_status = EXIT_OOM_ADJUST;
return -errno;
}
}
if (context->nice_set)
if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
- *error = EXIT_NICE;
+ *exit_status = EXIT_NICE;
return -errno;
}
@@ -1373,77 +1430,81 @@ static int exec_child(ExecCommand *command,
.sched_priority = context->cpu_sched_priority,
};
- err = sched_setscheduler(0,
- context->cpu_sched_policy |
- (context->cpu_sched_reset_on_fork ?
- SCHED_RESET_ON_FORK : 0),
- ¶m);
- if (err < 0) {
- *error = EXIT_SETSCHEDULER;
+ r = sched_setscheduler(0,
+ context->cpu_sched_policy |
+ (context->cpu_sched_reset_on_fork ?
+ SCHED_RESET_ON_FORK : 0),
+ ¶m);
+ if (r < 0) {
+ *exit_status = EXIT_SETSCHEDULER;
return -errno;
}
}
if (context->cpuset)
if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
- *error = EXIT_CPUAFFINITY;
+ *exit_status = EXIT_CPUAFFINITY;
return -errno;
}
if (context->ioprio_set)
if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
- *error = EXIT_IOPRIO;
+ *exit_status = EXIT_IOPRIO;
return -errno;
}
if (context->timer_slack_nsec != NSEC_INFINITY)
if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
- *error = EXIT_TIMERSLACK;
+ *exit_status = EXIT_TIMERSLACK;
return -errno;
}
if (context->personality != 0xffffffffUL)
if (personality(context->personality) < 0) {
- *error = EXIT_PERSONALITY;
+ *exit_status = EXIT_PERSONALITY;
return -errno;
}
if (context->utmp_id)
utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
- if (context->user) {
- username = context->user;
- err = get_user_creds(&username, &uid, &gid, &home, &shell);
- if (err < 0) {
- *error = EXIT_USER;
- return err;
+ if (context->user && is_terminal_input(context->std_input)) {
+ r = chown_terminal(STDIN_FILENO, uid);
+ if (r < 0) {
+ *exit_status = EXIT_STDIN;
+ return r;
}
+ }
- if (is_terminal_input(context->std_input)) {
- err = chown_terminal(STDIN_FILENO, uid);
- if (err < 0) {
- *error = EXIT_STDIN;
- return err;
- }
+#ifdef ENABLE_KDBUS
+ if (params->bus_endpoint_fd >= 0 && context->bus_endpoint) {
+ uid_t ep_uid = (uid == UID_INVALID) ? 0 : uid;
+
+ r = bus_kernel_set_endpoint_policy(params->bus_endpoint_fd, ep_uid, context->bus_endpoint);
+ if (r < 0) {
+ *exit_status = EXIT_BUS_ENDPOINT;
+ return r;
}
}
+#endif
-#ifdef HAVE_PAM
- if (params->cgroup_path && context->user && context->pam_name) {
- err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
- if (err < 0) {
- *error = EXIT_CGROUP;
- return err;
+ /* If delegation is enabled we'll pass ownership of the cgroup
+ * (but only in systemd's own controller hierarchy!) to the
+ * user of the new process. */
+ if (params->cgroup_path && context->user && params->cgroup_delegate) {
+ r = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
+ if (r < 0) {
+ *exit_status = EXIT_CGROUP;
+ return r;
}
- err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
- if (err < 0) {
- *error = EXIT_CGROUP;
- return err;
+ r = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
+ if (r < 0) {
+ *exit_status = EXIT_CGROUP;
+ return r;
}
}
-#endif
if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
char **rt;
@@ -1453,23 +1514,23 @@ static int exec_child(ExecCommand *command,
p = strjoin(params->runtime_prefix, "/", *rt, NULL);
if (!p) {
- *error = EXIT_RUNTIME_DIRECTORY;
+ *exit_status = EXIT_RUNTIME_DIRECTORY;
return -ENOMEM;
}
- err = mkdir_safe(p, context->runtime_directory_mode, uid, gid);
- if (err < 0) {
- *error = EXIT_RUNTIME_DIRECTORY;
- return err;
+ r = mkdir_safe_label(p, context->runtime_directory_mode, uid, gid);
+ if (r < 0) {
+ *exit_status = EXIT_RUNTIME_DIRECTORY;
+ return r;
}
}
}
if (params->apply_permissions) {
- err = enforce_groups(context, username, gid);
- if (err < 0) {
- *error = EXIT_GROUP;
- return err;
+ r = enforce_groups(context, username, gid);
+ if (r < 0) {
+ *exit_status = EXIT_GROUP;
+ return r;
}
}
@@ -1477,19 +1538,19 @@ static int exec_child(ExecCommand *command,
#ifdef HAVE_PAM
if (params->apply_permissions && context->pam_name && username) {
- err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
- if (err < 0) {
- *error = EXIT_PAM;
- return err;
+ r = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
+ if (r < 0) {
+ *exit_status = EXIT_PAM;
+ return r;
}
}
#endif
if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
- err = setup_netns(runtime->netns_storage_socket);
- if (err < 0) {
- *error = EXIT_NETWORK;
- return err;
+ r = setup_netns(runtime->netns_storage_socket);
+ if (r < 0) {
+ *exit_status = EXIT_NETWORK;
+ return r;
}
}
@@ -1498,6 +1559,7 @@ static int exec_child(ExecCommand *command,
!strv_isempty(context->inaccessible_dirs) ||
context->mount_flags != 0 ||
(context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
+ params->bus_endpoint_path ||
context->private_devices ||
context->protect_system != PROTECT_SYSTEM_NO ||
context->protect_home != PROTECT_HOME_NO) {
@@ -1512,67 +1574,89 @@ static int exec_child(ExecCommand *command,
if (context->private_tmp && runtime) {
if (runtime->tmp_dir)
- tmp = strappenda(runtime->tmp_dir, "/tmp");
+ tmp = strjoina(runtime->tmp_dir, "/tmp");
if (runtime->var_tmp_dir)
- var = strappenda(runtime->var_tmp_dir, "/tmp");
+ var = strjoina(runtime->var_tmp_dir, "/tmp");
}
- err = setup_namespace(
+ r = setup_namespace(
context->read_write_dirs,
context->read_only_dirs,
context->inaccessible_dirs,
tmp,
var,
- NULL,
+ params->bus_endpoint_path,
context->private_devices,
context->protect_home,
context->protect_system,
context->mount_flags);
- if (err < 0) {
- *error = EXIT_NAMESPACE;
- return err;
+
+ /* If we couldn't set up the namespace this is
+ * probably due to a missing capability. In this case,
+ * silently proceeed. */
+ if (r == -EPERM || r == -EACCES) {
+ log_open();
+ log_unit_debug_errno(params->unit_id, r, "Failed to set up namespace, assuming containerized execution, ignoring: %m");
+ log_close();
+ } else if (r < 0) {
+ *exit_status = EXIT_NAMESPACE;
+ return r;
}
}
if (params->apply_chroot) {
if (context->root_directory)
if (chroot(context->root_directory) < 0) {
- *error = EXIT_CHROOT;
+ *exit_status = EXIT_CHROOT;
return -errno;
}
- if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
- *error = EXIT_CHDIR;
+ if (chdir(context->working_directory ?: "/") < 0 &&
+ !context->working_directory_missing_ok) {
+ *exit_status = EXIT_CHDIR;
return -errno;
}
} else {
_cleanup_free_ char *d = NULL;
if (asprintf(&d, "%s/%s",
- context->root_directory ? context->root_directory : "",
- context->working_directory ? context->working_directory : "") < 0) {
- *error = EXIT_MEMORY;
+ context->root_directory ?: "",
+ context->working_directory ?: "") < 0) {
+ *exit_status = EXIT_MEMORY;
return -ENOMEM;
}
- if (chdir(d) < 0) {
- *error = EXIT_CHDIR;
+ if (chdir(d) < 0 &&
+ !context->working_directory_missing_ok) {
+ *exit_status = EXIT_CHDIR;
return -errno;
}
}
+#ifdef HAVE_SELINUX
+ if (params->apply_permissions && mac_selinux_use() && params->selinux_context_net && socket_fd >= 0) {
+ r = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
+ if (r < 0) {
+ *exit_status = EXIT_SELINUX_CONTEXT;
+ return r;
+ }
+ }
+#endif
+
/* We repeat the fd closing here, to make sure that
* nothing is leaked from the PAM modules. Note that
* we are more aggressive this time since socket_fd
- * and the netns fds we don#t need anymore. */
- err = close_all_fds(fds, n_fds);
- if (err >= 0)
- err = shift_fds(fds, n_fds);
- if (err >= 0)
- err = flags_fds(fds, n_fds, context->non_blocking);
- if (err < 0) {
- *error = EXIT_FDS;
- return err;
+ * and the netns fds we don't need anymore. The custom
+ * endpoint fd was needed to upload the policy and can
+ * now be closed as well. */
+ r = close_all_fds(fds, n_fds);
+ if (r >= 0)
+ r = shift_fds(fds, n_fds);
+ if (r >= 0)
+ r = flags_fds(fds, n_fds, context->non_blocking);
+ if (r < 0) {
+ *exit_status = EXIT_FDS;
+ return r;
}
if (params->apply_permissions) {
@@ -1582,24 +1666,34 @@ static int exec_child(ExecCommand *command,
continue;
if (setrlimit_closest(i, context->rlimit[i]) < 0) {
- *error = EXIT_LIMITS;
+ *exit_status = EXIT_LIMITS;
return -errno;
}
}
if (context->capability_bounding_set_drop) {
- err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
- if (err < 0) {
- *error = EXIT_CAPABILITIES;
- return err;
+ r = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
+ if (r < 0) {
+ *exit_status = EXIT_CAPABILITIES;
+ return r;
}
}
+#ifdef HAVE_SMACK
+ if (context->smack_process_label) {
+ r = mac_smack_apply_pid(0, context->smack_process_label);
+ if (r < 0) {
+ *exit_status = EXIT_SMACK_PROCESS_LABEL;
+ return r;
+ }
+ }
+#endif
+
if (context->user) {
- err = enforce_user(context, uid);
- if (err < 0) {
- *error = EXIT_USER;
- return err;
+ r = enforce_user(context, uid);
+ if (r < 0) {
+ *exit_status = EXIT_USER;
+ return r;
}
}
@@ -1609,68 +1703,72 @@ static int exec_child(ExecCommand *command,
* PR_SET_SECUREBITS unless necessary. */
if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
- *error = EXIT_SECUREBITS;
+ *exit_status = EXIT_SECUREBITS;
return -errno;
}
if (context->capabilities)
if (cap_set_proc(context->capabilities) < 0) {
- *error = EXIT_CAPABILITIES;
+ *exit_status = EXIT_CAPABILITIES;
return -errno;
}
if (context->no_new_privileges)
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
- *error = EXIT_NO_NEW_PRIVILEGES;
+ *exit_status = EXIT_NO_NEW_PRIVILEGES;
return -errno;
}
#ifdef HAVE_SECCOMP
if (context->address_families_whitelist ||
!set_isempty(context->address_families)) {
- err = apply_address_families(context);
- if (err < 0) {
- *error = EXIT_ADDRESS_FAMILIES;
- return err;
+ r = apply_address_families(context);
+ if (r < 0) {
+ *exit_status = EXIT_ADDRESS_FAMILIES;
+ return r;
}
}
if (context->syscall_whitelist ||
!set_isempty(context->syscall_filter) ||
!set_isempty(context->syscall_archs)) {
- err = apply_seccomp(context);
- if (err < 0) {
- *error = EXIT_SECCOMP;
- return err;
+ r = apply_seccomp(context);
+ if (r < 0) {
+ *exit_status = EXIT_SECCOMP;
+ return r;
}
}
#endif
#ifdef HAVE_SELINUX
- if (context->selinux_context && use_selinux()) {
- err = setexeccon(context->selinux_context);
- if (err < 0 && !context->selinux_context_ignore) {
- *error = EXIT_SELINUX_CONTEXT;
- return err;
+ if (mac_selinux_use()) {
+ char *exec_context = mac_selinux_context_net ?: context->selinux_context;
+
+ if (exec_context) {
+ r = setexeccon(exec_context);
+ if (r < 0) {
+ *exit_status = EXIT_SELINUX_CONTEXT;
+ return r;
+ }
}
}
#endif
#ifdef HAVE_APPARMOR
- if (context->apparmor_profile && use_apparmor()) {
- err = aa_change_onexec(context->apparmor_profile);
- if (err < 0 && !context->apparmor_profile_ignore) {
- *error = EXIT_APPARMOR_PROFILE;
- return err;
+ if (context->apparmor_profile && mac_apparmor_use()) {
+ r = aa_change_onexec(context->apparmor_profile);
+ if (r < 0 && !context->apparmor_profile_ignore) {
+ *exit_status = EXIT_APPARMOR_PROFILE;
+ return -errno;
}
}
#endif
}
- err = build_environment(context, n_fds, params->watchdog_usec, home, username, shell, &our_env);
- if (err < 0) {
- *error = EXIT_MEMORY;
- return err;
+ r = build_environment(context, n_fds, params->watchdog_usec, home, username, shell, &our_env);
+ if (r < 0) {
+ *exit_status = EXIT_MEMORY;
+ return r;
}
final_env = strv_env_merge(5,
@@ -1681,34 +1779,34 @@ static int exec_child(ExecCommand *command,
pam_env,
NULL);
if (!final_env) {
- *error = EXIT_MEMORY;
+ *exit_status = EXIT_MEMORY;
return -ENOMEM;
}
final_argv = replace_env_argv(argv, final_env);
if (!final_argv) {
- *error = EXIT_MEMORY;
+ *exit_status = EXIT_MEMORY;
return -ENOMEM;
}
final_env = strv_env_clean(final_env);
- if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
+ if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
_cleanup_free_ char *line;
line = exec_command_line(final_argv);
if (line) {
log_open();
- log_struct_unit(LOG_DEBUG,
- params->unit_id,
+ log_unit_struct(params->unit_id,
+ LOG_DEBUG,
"EXECUTABLE=%s", command->path,
- "MESSAGE=Executing: %s", line,
+ LOG_MESSAGE("Executing: %s", line),
NULL);
log_close();
}
}
execve(command->path, final_argv, final_env);
- *error = EXIT_EXEC;
+ *exit_status = EXIT_EXEC;
return -errno;
}
@@ -1720,10 +1818,10 @@ int exec_spawn(ExecCommand *command,
_cleanup_strv_free_ char **files_env = NULL;
int *fds = NULL; unsigned n_fds = 0;
- char *line, **argv;
- int socket_fd;
+ _cleanup_free_ char *line = NULL;
+ int socket_fd, r;
+ char **argv;
pid_t pid;
- int err;
assert(command);
assert(context);
@@ -1735,8 +1833,10 @@ int exec_spawn(ExecCommand *command,
context->std_output == EXEC_OUTPUT_SOCKET ||
context->std_error == EXEC_OUTPUT_SOCKET) {
- if (params->n_fds != 1)
+ if (params->n_fds != 1) {
+ log_unit_error(params->unit_id, "Got more than one socket.");
return -EINVAL;
+ }
socket_fd = params->fds[0];
} else {
@@ -1745,65 +1845,53 @@ int exec_spawn(ExecCommand *command,
n_fds = params->n_fds;
}
- err = exec_context_load_environment(context, &files_env);
- if (err < 0) {
- log_struct_unit(LOG_ERR,
- params->unit_id,
- "MESSAGE=Failed to load environment files: %s", strerror(-err),
- "ERRNO=%d", -err,
- NULL);
- return err;
- }
+ r = exec_context_load_environment(context, params->unit_id, &files_env);
+ if (r < 0)
+ return log_unit_error_errno(params->unit_id, r, "Failed to load environment files: %m");
argv = params->argv ?: command->argv;
-
line = exec_command_line(argv);
if (!line)
return log_oom();
- log_struct_unit(LOG_DEBUG,
- params->unit_id,
+ log_unit_struct(params->unit_id,
+ LOG_DEBUG,
"EXECUTABLE=%s", command->path,
- "MESSAGE=About to execute: %s", line,
+ LOG_MESSAGE("About to execute: %s", line),
NULL);
- free(line);
-
pid = fork();
if (pid < 0)
- return -errno;
+ return log_unit_error_errno(params->unit_id, r, "Failed to fork: %m");
if (pid == 0) {
- int r;
-
- err = exec_child(command,
- context,
- params,
- runtime,
- argv,
- socket_fd,
- fds, n_fds,
- files_env,
- &r);
- if (r != 0) {
+ int exit_status;
+
+ r = exec_child(command,
+ context,
+ params,
+ runtime,
+ argv,
+ socket_fd,
+ fds, n_fds,
+ files_env,
+ &exit_status);
+ if (r < 0) {
log_open();
- log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
- "EXECUTABLE=%s", command->path,
- "MESSAGE=Failed at step %s spawning %s: %s",
- exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
- command->path, strerror(-err),
- "ERRNO=%d", -err,
- NULL);
- log_close();
+ log_unit_struct(params->unit_id,
+ LOG_ERR,
+ LOG_MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
+ "EXECUTABLE=%s", command->path,
+ LOG_MESSAGE("Failed at step %s spawning %s: %s",
+ exit_status_to_string(exit_status, EXIT_STATUS_SYSTEMD),
+ command->path, strerror(-r)),
+ LOG_ERRNO(r),
+ NULL);
}
- _exit(r);
+ _exit(exit_status);
}
- log_struct_unit(LOG_DEBUG,
- params->unit_id,
- "MESSAGE=Forked %s as "PID_FMT,
- command->path, pid,
- NULL);
+ log_unit_debug(params->unit_id, "Forked %s as "PID_FMT, command->path, pid);
/* We add the new process to the cgroup both in the child (so
* that we can be sure that no user code is ever executed
@@ -1932,7 +2020,7 @@ int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_p
/* We execute this synchronously, since we need to be
* sure this is gone when we start the service
* next. */
- rm_rf_dangerous(p, false, true, false);
+ rm_rf(p, false, true, false);
}
return 0;
@@ -1955,7 +2043,7 @@ void exec_command_done_array(ExecCommand *c, unsigned n) {
exec_command_done(c+i);
}
-void exec_command_free_list(ExecCommand *c) {
+ExecCommand* exec_command_free_list(ExecCommand *c) {
ExecCommand *i;
while ((i = c)) {
@@ -1963,18 +2051,29 @@ void exec_command_free_list(ExecCommand *c) {
exec_command_done(i);
free(i);
}
+
+ return NULL;
}
void exec_command_free_array(ExecCommand **c, unsigned n) {
unsigned i;
- for (i = 0; i < n; i++) {
- exec_command_free_list(c[i]);
- c[i] = NULL;
- }
+ for (i = 0; i < n; i++)
+ c[i] = exec_command_free_list(c[i]);
}
-int exec_context_load_environment(const ExecContext *c, char ***l) {
+typedef struct InvalidEnvInfo {
+ const char *unit_id;
+ const char *path;
+} InvalidEnvInfo;
+
+static void invalid_env(const char *p, void *userdata) {
+ InvalidEnvInfo *info = userdata;
+
+ log_unit_error(info->unit_id, "Ignoring invalid environment assignment '%s': %s", p, info->path);
+}
+
+int exec_context_load_environment(const ExecContext *c, const char *unit_id, char ***l) {
char **i, **r = NULL;
assert(c);
@@ -2030,8 +2129,14 @@ int exec_context_load_environment(const ExecContext *c, char ***l) {
return k;
}
/* Log invalid environment variables with filename */
- if (p)
- p = strv_env_clean_log(p, pglob.gl_pathv[n]);
+ if (p) {
+ InvalidEnvInfo info = {
+ .unit_id = unit_id,
+ .path = pglob.gl_pathv[n]
+ };
+
+ p = strv_env_clean_with_callback(p, invalid_env, &info);
+ }
if (r == NULL)
r = p;
@@ -2245,13 +2350,8 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
fprintf(f, "%sCapabilityBoundingSet:", prefix);
for (l = 0; l <= cap_last_cap(); l++)
- if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
- _cleanup_cap_free_charp_ char *t;
-
- t = cap_to_name(l);
- if (t)
- fprintf(f, " %s", t);
- }
+ if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l)))
+ fprintf(f, " %s", strna(capability_to_name(l)));
fputs("\n", f);
}
@@ -2362,6 +2462,21 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
}
+bool exec_context_maintains_privileges(ExecContext *c) {
+ assert(c);
+
+ /* Returns true if the process forked off would run run under
+ * an unchanged UID or as root. */
+
+ if (!c->user)
+ return true;
+
+ if (streq(c->user, "root") || streq(c->user, "0"))
+ return true;
+
+ return false;
+}
+
void exec_status_start(ExecStatus *s, pid_t pid) {
assert(s);
@@ -2467,7 +2582,7 @@ void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
assert(f);
prefix = strempty(prefix);
- prefix2 = strappenda(prefix, "\t");
+ prefix2 = strjoina(prefix, "\t");
cmd = exec_command_line(c->argv);
fprintf(f,
@@ -2529,6 +2644,29 @@ int exec_command_set(ExecCommand *c, const char *path, ...) {
return 0;
}
+int exec_command_append(ExecCommand *c, const char *path, ...) {
+ _cleanup_strv_free_ char **l = NULL;
+ va_list ap;
+ int r;
+
+ assert(c);
+ assert(path);
+
+ va_start(ap, path);
+ l = strv_new_ap(path, ap);
+ va_end(ap);
+
+ if (!l)
+ return -ENOMEM;
+
+ r = strv_extend_strv(&c->argv, l);
+ if (r < 0)
+ return r;
+
+ return 0;
+}
+
+
static int exec_runtime_allocate(ExecRuntime **rt) {
if (*rt)
@@ -2681,7 +2819,7 @@ int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, co
return r;
if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
- log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
+ log_unit_debug(u->id, "Failed to parse netns socket value %s", value);
else {
safe_close((*rt)->netns_storage_socket[0]);
(*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
@@ -2694,7 +2832,7 @@ int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, co
return r;
if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
- log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
+ log_unit_debug(u->id, "Failed to parse netns socket value %s", value);
else {
safe_close((*rt)->netns_storage_socket[1]);
(*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
@@ -2727,7 +2865,7 @@ void exec_runtime_destroy(ExecRuntime *rt) {
r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
if (r < 0) {
- log_warning("Failed to nuke %s: %s", rt->tmp_dir, strerror(-r));
+ log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
free(rt->tmp_dir);
}
@@ -2739,7 +2877,7 @@ void exec_runtime_destroy(ExecRuntime *rt) {
r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
if (r < 0) {
- log_warning("Failed to nuke %s: %s", rt->var_tmp_dir, strerror(-r));
+ log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
free(rt->var_tmp_dir);
}