X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fcore%2Fexecute.h;h=2c201399e3d987672e9b5cc5249b4b5e1ffd69bb;hp=15574dc97e1766ac6c270c87f4fd51978c60ba95;hb=615938651d3a4fd9253b08da00db22d451a8cef8;hpb=44a6b1b68029833893f6e9cee35aa27a974038f6 diff --git a/src/core/execute.h b/src/core/execute.h index 15574dc97..2c201399e 100644 --- a/src/core/execute.h +++ b/src/core/execute.h @@ -24,6 +24,8 @@ typedef struct ExecStatus ExecStatus; typedef struct ExecCommand ExecCommand; typedef struct ExecContext ExecContext; +typedef struct ExecRuntime ExecRuntime; +typedef struct ExecParameters ExecParameters; #include #include @@ -33,13 +35,13 @@ typedef struct ExecContext ExecContext; #include #include -struct CGroupBonding; -struct CGroupAttribute; - -typedef struct Unit Unit; - #include "list.h" #include "util.h" +#include "set.h" +#include "fdset.h" +#include "missing.h" +#include "namespace.h" +#include "bus-endpoint.h" typedef enum ExecInput { EXEC_INPUT_NULL, @@ -82,11 +84,20 @@ struct ExecCommand { bool ignore; }; +struct ExecRuntime { + int n_ref; + + char *tmp_dir; + char *var_tmp_dir; + + int netns_storage_socket[2]; +}; + struct ExecContext { char **environment; char **environment_files; - struct rlimit *rlimit[RLIMIT_NLIMITS]; + struct rlimit *rlimit[_RLIMIT_MAX]; char *working_directory, *root_directory; mode_t umask; @@ -105,8 +116,6 @@ struct ExecContext { nsec_t timer_slack_nsec; - char *tcpwrap_name; - char *tty_path; bool tty_reset; @@ -127,6 +136,15 @@ struct ExecContext { char *utmp_id; + bool selinux_context_ignore; + char *selinux_context; + + bool apparmor_profile_ignore; + char *apparmor_profile; + + bool smack_process_label_ignore; + char *smack_process_label; + char **read_write_dirs, **read_only_dirs, **inaccessible_dirs; unsigned long mount_flags; @@ -143,14 +161,12 @@ struct ExecContext { bool non_blocking; bool private_tmp; bool private_network; - char *tmp_dir; - char *var_tmp_dir; + bool private_devices; + ProtectSystem protect_system; + ProtectHome protect_home; bool no_new_privileges; - bool control_group_modify; - int control_group_persistent; - /* This is not exposed to the user but available * internally. We need it to make sure that whenever we spawn * /bin/mount it is run in the same process group as us so @@ -158,34 +174,61 @@ struct ExecContext { * don't enter a trigger loop. */ bool same_pgrp; - uint32_t *syscall_filter; + unsigned long personality; + + Set *syscall_filter; + Set *syscall_archs; + int syscall_errno; + bool syscall_whitelist:1; + + Set *address_families; + bool address_families_whitelist:1; + + char **runtime_directory; + mode_t runtime_directory_mode; bool oom_score_adjust_set:1; bool nice_set:1; bool ioprio_set:1; bool cpu_sched_set:1; + bool no_new_privileges_set:1; + + /* custom dbus enpoint */ + BusEndpoint *bus_endpoint; +}; + +#include "cgroup.h" + +struct ExecParameters { + char **argv; + int *fds; unsigned n_fds; + char **environment; + bool apply_permissions; + bool apply_chroot; + bool apply_tty_stdin; + bool confirm_spawn; + bool selinux_context_net; + CGroupControllerMask cgroup_supported; + const char *cgroup_path; + bool cgroup_delegate; + const char *runtime_prefix; + const char *unit_id; + usec_t watchdog_usec; + int *idle_pipe; + char *bus_endpoint_path; + int bus_endpoint_fd; }; int exec_spawn(ExecCommand *command, - char **argv, - ExecContext *context, - int fds[], unsigned n_fds, - char **environment, - bool apply_permissions, - bool apply_chroot, - bool apply_tty_stdin, - bool confirm_spawn, - struct CGroupBonding *cgroup_bondings, - struct CGroupAttribute *cgroup_attributes, - const char *cgroup_suffix, - const char *unit_id, - int pipe_fd[2], + const ExecContext *context, + const ExecParameters *exec_params, + ExecRuntime *runtime, pid_t *ret); void exec_command_done(ExecCommand *c); void exec_command_done_array(ExecCommand *c, unsigned n); -void exec_command_free_list(ExecCommand *c); +ExecCommand* exec_command_free_list(ExecCommand *c); void exec_command_free_array(ExecCommand **c, unsigned n); char *exec_command_line(char **argv); @@ -194,22 +237,32 @@ void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix); void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix); void exec_command_append_list(ExecCommand **l, ExecCommand *e); int exec_command_set(ExecCommand *c, const char *path, ...); +int exec_command_append(ExecCommand *c, const char *path, ...); void exec_context_init(ExecContext *c); -void exec_context_done(ExecContext *c, bool reloading_or_reexecuting); -void exec_context_tmp_dirs_done(ExecContext *c); +void exec_context_done(ExecContext *c); void exec_context_dump(ExecContext *c, FILE* f, const char *prefix); -void exec_context_tty_reset(const ExecContext *context); -int exec_context_load_environment(const ExecContext *c, char ***l); +int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_root); + +int exec_context_load_environment(const ExecContext *c, const char *unit_id, char ***l); bool exec_context_may_touch_console(ExecContext *c); -void exec_context_serialize(const ExecContext *c, Unit *u, FILE *f); +bool exec_context_maintains_privileges(ExecContext *c); void exec_status_start(ExecStatus *s, pid_t pid); void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status); void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix); +int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id); +ExecRuntime *exec_runtime_ref(ExecRuntime *r); +ExecRuntime *exec_runtime_unref(ExecRuntime *r); + +int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds); +int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds); + +void exec_runtime_destroy(ExecRuntime *rt); + const char* exec_output_to_string(ExecOutput i) _const_; ExecOutput exec_output_from_string(const char *s) _pure_;