X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fjournal%2Fjournald.c;h=39263bfe4c41530e9431396f91886b4f68d95cba;hp=419ce26ada78491d47b9fb17e7dd0136f96042a4;hb=5c3759bf8a3d418fa877e6a278f3150f404745b2;hpb=258cdffc2f9f8cd3d243bd19f507bc73009d77d9

diff --git a/src/journal/journald.c b/src/journal/journald.c
index 419ce26ad..39263bfe4 100644
--- a/src/journal/journald.c
+++ b/src/journal/journald.c
@@ -25,8 +25,6 @@
 #include <sys/signalfd.h>
 #include <unistd.h>
 #include <fcntl.h>
-#include <sys/acl.h>
-#include <acl/libacl.h>
 #include <stddef.h>
 #include <sys/ioctl.h>
 #include <linux/sockios.h>
@@ -40,13 +38,23 @@
 #include "hashmap.h"
 #include "journal-file.h"
 #include "socket-util.h"
-#include "acl-util.h"
 #include "cgroup-util.h"
 #include "list.h"
 #include "journal-rate-limit.h"
 #include "journal-internal.h"
 #include "conf-parser.h"
 #include "journald.h"
+#include "virt.h"
+
+#ifdef HAVE_ACL
+#include <sys/acl.h>
+#include <acl/libacl.h>
+#include "acl-util.h"
+#endif
+
+#ifdef HAVE_SELINUX
+#include <selinux/selinux.h>
+#endif
 
 #define USER_JOURNALS_MAX 1024
 #define STDOUT_STREAMS_MAX 4096
@@ -58,12 +66,14 @@
 
 #define RECHECK_VAR_AVAILABLE_USEC (30*USEC_PER_SEC)
 
-#define SYSLOG_TIMEOUT_USEC (5*USEC_PER_SEC)
+#define SYSLOG_TIMEOUT_USEC (250*USEC_PER_MSEC)
 
-#define N_IOVEC_META_FIELDS 16
+#define N_IOVEC_META_FIELDS 17
+
+#define ENTRY_SIZE_MAX (1024*1024*32)
 
 typedef enum StdoutStreamState {
-        STDOUT_STREAM_TAG,
+        STDOUT_STREAM_IDENTIFIER,
         STDOUT_STREAM_PRIORITY,
         STDOUT_STREAM_LEVEL_PREFIX,
         STDOUT_STREAM_FORWARD_TO_SYSLOG,
@@ -80,7 +90,7 @@ struct StdoutStream {
 
         struct ucred ucred;
 
-        char *tag;
+        char *identifier;
         int priority;
         bool level_prefix:1;
         bool forward_to_syslog:1;
@@ -179,18 +189,42 @@ finish:
         return avail;
 }
 
-static void fix_perms(JournalFile *f, uid_t uid) {
+static void server_read_file_gid(Server *s) {
+        const char *adm = "adm";
+        int r;
+
+        assert(s);
+
+        if (s->file_gid_valid)
+                return;
+
+        r = get_group_creds(&adm, &s->file_gid);
+        if (r < 0)
+                log_warning("Failed to resolve 'adm' group: %s", strerror(-r));
+
+        /* if we couldn't read the gid, then it will be 0, but that's
+         * fine and we shouldn't try to resolve the group again, so
+         * let's just pretend it worked right-away. */
+        s->file_gid_valid = true;
+}
+
+static void server_fix_perms(Server *s, JournalFile *f, uid_t uid) {
+        int r;
+#ifdef HAVE_ACL
         acl_t acl;
         acl_entry_t entry;
         acl_permset_t permset;
-        int r;
+#endif
 
         assert(f);
 
-        r = fchmod_and_fchown(f->fd, 0640, 0, 0);
+        server_read_file_gid(s);
+
+        r = fchmod_and_fchown(f->fd, 0640, 0, s->file_gid);
         if (r < 0)
                 log_warning("Failed to fix access mode/rights on %s, ignoring: %s", f->path, strerror(-r));
 
+#ifdef HAVE_ACL
         if (uid <= 0)
                 return;
 
@@ -223,6 +257,7 @@ static void fix_perms(JournalFile *f, uid_t uid) {
 
 finish:
         acl_free(acl);
+#endif
 }
 
 static JournalFile* find_journal(Server *s, uid_t uid) {
@@ -269,7 +304,7 @@ static JournalFile* find_journal(Server *s, uid_t uid) {
         if (r < 0)
                 return s->system_journal;
 
-        fix_perms(f, uid);
+        server_fix_perms(s, f, uid);
         f->metrics = s->system_metrics;
         f->compress = s->compress;
 
@@ -407,7 +442,7 @@ static void dispatch_message_real(Server *s,
                 *comm = NULL, *cmdline = NULL, *hostname = NULL,
                 *audit_session = NULL, *audit_loginuid = NULL,
                 *exe = NULL, *cgroup = NULL, *session = NULL,
-                *owner_uid = NULL, *unit = NULL;
+                *owner_uid = NULL, *unit = NULL, *selinux_context = NULL;
 
         char idbuf[33];
         sd_id128_t id;
@@ -425,6 +460,9 @@ static void dispatch_message_real(Server *s,
         if (ucred) {
                 uint32_t audit;
                 uid_t owner;
+#ifdef HAVE_SELINUX
+                security_context_t con;
+#endif
 
                 realuid = ucred->uid;
 
@@ -451,7 +489,7 @@ static void dispatch_message_real(Server *s,
                         exe = strappend("_EXE=", t);
                         free(t);
 
-                        if (comm)
+                        if (exe)
                                 IOVEC_SET_STRING(iovec[n++], exe);
                 }
 
@@ -502,6 +540,16 @@ static void dispatch_message_real(Server *s,
                 if (sd_pid_get_owner_uid(ucred->uid, &owner) >= 0)
                         if (asprintf(&owner_uid, "_SYSTEMD_OWNER_UID=%lu", (unsigned long) owner) >= 0)
                                 IOVEC_SET_STRING(iovec[n++], owner_uid);
+
+#ifdef HAVE_SELINUX
+                if (getpidcon(ucred->pid, &con) >= 0) {
+                        selinux_context = strappend("_SELINUX_CONTEXT=", con);
+                        if (selinux_context)
+                                IOVEC_SET_STRING(iovec[n++], selinux_context);
+
+                        freecon(con);
+                }
+#endif
         }
 
         if (tv) {
@@ -573,6 +621,7 @@ retry:
         free(session);
         free(owner_uid);
         free(unit);
+        free(selinux_context);
 }
 
 static void driver_message(Server *s, sd_id128_t message_id, const char *format, ...) {
@@ -705,6 +754,11 @@ static void forward_syslog_iovec(Server *s, const struct iovec *iovec, unsigned
         if (sendmsg(s->syslog_fd, &msghdr, MSG_NOSIGNAL) >= 0)
                 return;
 
+        /* The socket is full? I guess the syslog implementation is
+         * too slow, and we shouldn't wait for that... */
+        if (errno == EAGAIN)
+                return;
+
         if (ucred && errno == ESRCH) {
                 struct ucred u;
 
@@ -718,6 +772,9 @@ static void forward_syslog_iovec(Server *s, const struct iovec *iovec, unsigned
 
                 if (sendmsg(s->syslog_fd, &msghdr, MSG_NOSIGNAL) >= 0)
                         return;
+
+                if (errno == EAGAIN)
+                        return;
         }
 
         log_debug("Failed to forward syslog message: %m");
@@ -733,13 +790,13 @@ static void forward_syslog_raw(Server *s, const char *buffer, struct ucred *ucre
         forward_syslog_iovec(s, &iovec, 1, ucred, tv);
 }
 
-static void forward_syslog(Server *s, int priority, const char *tag, const char *message, struct ucred *ucred, struct timeval *tv) {
+static void forward_syslog(Server *s, int priority, const char *identifier, const char *message, struct ucred *ucred, struct timeval *tv) {
         struct iovec iovec[5];
         char header_priority[6], header_time[64], header_pid[16];
         int n = 0;
         time_t t;
         struct tm *tm;
-        char *tag_buf = NULL;
+        char *ident_buf = NULL;
 
         assert(s);
         assert(priority >= 0);
@@ -760,22 +817,22 @@ static void forward_syslog(Server *s, int priority, const char *tag, const char
                 return;
         IOVEC_SET_STRING(iovec[n++], header_time);
 
-        /* Third: tag and PID */
+        /* Third: identifier and PID */
         if (ucred) {
-                if (!tag) {
-                        get_process_comm(ucred->pid, &tag_buf);
-                        tag = tag_buf;
+                if (!identifier) {
+                        get_process_comm(ucred->pid, &ident_buf);
+                        identifier = ident_buf;
                 }
 
                 snprintf(header_pid, sizeof(header_pid), "[%lu]: ", (unsigned long) ucred->pid);
                 char_array_0(header_pid);
 
-                if (tag)
-                        IOVEC_SET_STRING(iovec[n++], tag);
+                if (identifier)
+                        IOVEC_SET_STRING(iovec[n++], identifier);
 
                 IOVEC_SET_STRING(iovec[n++], header_pid);
-        } else if (tag) {
-                IOVEC_SET_STRING(iovec[n++], tag);
+        } else if (identifier) {
+                IOVEC_SET_STRING(iovec[n++], identifier);
                 IOVEC_SET_STRING(iovec[n++], ": ");
         }
 
@@ -784,7 +841,7 @@ static void forward_syslog(Server *s, int priority, const char *tag, const char
 
         forward_syslog_iovec(s, iovec, n, ucred, tv);
 
-        free(tag_buf);
+        free(ident_buf);
 }
 
 static int fixup_priority(int priority) {
@@ -795,11 +852,11 @@ static int fixup_priority(int priority) {
         return priority;
 }
 
-static void forward_kmsg(Server *s, int priority, const char *tag, const char *message, struct ucred *ucred) {
+static void forward_kmsg(Server *s, int priority, const char *identifier, const char *message, struct ucred *ucred) {
         struct iovec iovec[5];
         char header_priority[6], header_pid[16];
         int n = 0;
-        char *tag_buf = NULL;
+        char *ident_buf = NULL;
         int fd;
 
         assert(s);
@@ -816,22 +873,22 @@ static void forward_kmsg(Server *s, int priority, const char *tag, const char *m
         char_array_0(header_priority);
         IOVEC_SET_STRING(iovec[n++], header_priority);
 
-        /* Second: tag and PID */
+        /* Second: identifier and PID */
         if (ucred) {
-                if (!tag) {
-                        get_process_comm(ucred->pid, &tag_buf);
-                        tag = tag_buf;
+                if (!identifier) {
+                        get_process_comm(ucred->pid, &ident_buf);
+                        identifier = ident_buf;
                 }
 
                 snprintf(header_pid, sizeof(header_pid), "[%lu]: ", (unsigned long) ucred->pid);
                 char_array_0(header_pid);
 
-                if (tag)
-                        IOVEC_SET_STRING(iovec[n++], tag);
+                if (identifier)
+                        IOVEC_SET_STRING(iovec[n++], identifier);
 
                 IOVEC_SET_STRING(iovec[n++], header_pid);
-        } else if (tag) {
-                IOVEC_SET_STRING(iovec[n++], tag);
+        } else if (identifier) {
+                IOVEC_SET_STRING(iovec[n++], identifier);
                 IOVEC_SET_STRING(iovec[n++], ": ");
         }
 
@@ -851,34 +908,34 @@ static void forward_kmsg(Server *s, int priority, const char *tag, const char *m
         close_nointr_nofail(fd);
 
 finish:
-        free(tag_buf);
+        free(ident_buf);
 }
 
-static void forward_console(Server *s, const char *tag, const char *message, struct ucred *ucred) {
+static void forward_console(Server *s, const char *identifier, const char *message, struct ucred *ucred) {
         struct iovec iovec[4];
         char header_pid[16];
         int n = 0, fd;
-        char *tag_buf = NULL;
+        char *ident_buf = NULL;
 
         assert(s);
         assert(message);
 
-        /* First: tag and PID */
+        /* First: identifier and PID */
         if (ucred) {
-                if (!tag) {
-                        get_process_comm(ucred->pid, &tag_buf);
-                        tag = tag_buf;
+                if (!identifier) {
+                        get_process_comm(ucred->pid, &ident_buf);
+                        identifier = ident_buf;
                 }
 
                 snprintf(header_pid, sizeof(header_pid), "[%lu]: ", (unsigned long) ucred->pid);
                 char_array_0(header_pid);
 
-                if (tag)
-                        IOVEC_SET_STRING(iovec[n++], tag);
+                if (identifier)
+                        IOVEC_SET_STRING(iovec[n++], identifier);
 
                 IOVEC_SET_STRING(iovec[n++], header_pid);
-        } else if (tag) {
-                IOVEC_SET_STRING(iovec[n++], tag);
+        } else if (identifier) {
+                IOVEC_SET_STRING(iovec[n++], identifier);
                 IOVEC_SET_STRING(iovec[n++], ": ");
         }
 
@@ -898,16 +955,17 @@ static void forward_console(Server *s, const char *tag, const char *message, str
         close_nointr_nofail(fd);
 
 finish:
-        free(tag_buf);
+        free(ident_buf);
 }
 
-static void read_tag(const char **buf, char **tag) {
+static void read_identifier(const char **buf, char **identifier, char **pid) {
         const char *p;
         char *t;
         size_t l, e;
 
         assert(buf);
-        assert(tag);
+        assert(identifier);
+        assert(pid);
 
         p = *buf;
 
@@ -927,6 +985,10 @@ static void read_tag(const char **buf, char **tag) {
                 for (;;) {
 
                         if (p[k] == '[') {
+                                t = strndup(p+k+1, l-k-2);
+                                if (t)
+                                        *pid = t;
+
                                 l = k;
                                 break;
                         }
@@ -940,18 +1002,18 @@ static void read_tag(const char **buf, char **tag) {
 
         t = strndup(p, l);
         if (t)
-                *tag = t;
+                *identifier = t;
 
         *buf = p + e;
         *buf += strspn(*buf, WHITESPACE);
 }
 
 static void process_syslog_message(Server *s, const char *buf, struct ucred *ucred, struct timeval *tv) {
-        char *message = NULL, *syslog_priority = NULL, *syslog_facility = NULL, *syslog_tag = NULL;
-        struct iovec iovec[N_IOVEC_META_FIELDS + 5];
+        char *message = NULL, *syslog_priority = NULL, *syslog_facility = NULL, *syslog_identifier = NULL, *syslog_pid = NULL;
+        struct iovec iovec[N_IOVEC_META_FIELDS + 6];
         unsigned n = 0;
         int priority = LOG_USER | LOG_INFO;
-        char *tag = NULL;
+        char *identifier = NULL, *pid = NULL;
 
         assert(s);
         assert(buf);
@@ -961,13 +1023,13 @@ static void process_syslog_message(Server *s, const char *buf, struct ucred *ucr
 
         parse_syslog_priority((char**) &buf, &priority);
         skip_syslog_date((char**) &buf);
-        read_tag(&buf, &tag);
+        read_identifier(&buf, &identifier, &pid);
 
         if (s->forward_to_kmsg)
-                forward_kmsg(s, priority, tag, buf, ucred);
+                forward_kmsg(s, priority, identifier, buf, ucred);
 
         if (s->forward_to_console)
-                forward_console(s, tag, buf, ucred);
+                forward_console(s, identifier, buf, ucred);
 
         IOVEC_SET_STRING(iovec[n++], "_TRANSPORT=syslog");
 
@@ -978,10 +1040,16 @@ static void process_syslog_message(Server *s, const char *buf, struct ucred *ucr
                 if (asprintf(&syslog_facility, "SYSLOG_FACILITY=%i", LOG_FAC(priority)) >= 0)
                         IOVEC_SET_STRING(iovec[n++], syslog_facility);
 
-        if (tag) {
-                syslog_tag = strappend("SYSLOG_TAG=", tag);
-                if (syslog_tag)
-                        IOVEC_SET_STRING(iovec[n++], syslog_tag);
+        if (identifier) {
+                syslog_identifier = strappend("SYSLOG_IDENTIFIER=", identifier);
+                if (syslog_identifier)
+                        IOVEC_SET_STRING(iovec[n++], syslog_identifier);
+        }
+
+        if (pid) {
+                syslog_pid = strappend("SYSLOG_PID=", pid);
+                if (syslog_pid)
+                        IOVEC_SET_STRING(iovec[n++], syslog_pid);
         }
 
         message = strappend("MESSAGE=", buf);
@@ -991,10 +1059,11 @@ static void process_syslog_message(Server *s, const char *buf, struct ucred *ucr
         dispatch_message(s, iovec, n, ELEMENTSOF(iovec), ucred, tv, priority);
 
         free(message);
-        free(tag);
+        free(identifier);
+        free(pid);
         free(syslog_priority);
         free(syslog_facility);
-        free(syslog_tag);
+        free(syslog_identifier);
 }
 
 static bool valid_user_field(const char *p, size_t l) {
@@ -1038,7 +1107,7 @@ static void process_native_message(Server *s, const void *buffer, size_t buffer_
         const char *p;
         size_t remaining;
         int priority = LOG_INFO;
-        char *tag = NULL, *message = NULL;
+        char *identifier = NULL, *message = NULL;
 
         assert(s);
         assert(buffer || n == 0);
@@ -1128,13 +1197,13 @@ static void process_native_message(Server *s, const void *buffer, size_t buffer_
                                         priority = (priority & LOG_PRIMASK) | (((p[16] - '0')*10 + (p[17] - '0')) << 3);
 
                                 else if (l >= 12 &&
-                                         memcmp(p, "SYSLOG_TAG=", 11) == 0) {
+                                         memcmp(p, "SYSLOG_IDENTIFIER=", 11) == 0) {
                                         char *t;
 
                                         t = strndup(p + 11, l - 11);
                                         if (t) {
-                                                free(tag);
-                                                tag = t;
+                                                free(identifier);
+                                                identifier = t;
                                         }
                                 } else if (l >= 8 &&
                                            memcmp(p, "MESSAGE=", 8) == 0) {
@@ -1199,13 +1268,13 @@ static void process_native_message(Server *s, const void *buffer, size_t buffer_
 
         if (message) {
                 if (s->forward_to_syslog)
-                        forward_syslog(s, priority, tag, message, ucred, tv);
+                        forward_syslog(s, priority, identifier, message, ucred, tv);
 
                 if (s->forward_to_kmsg)
-                        forward_kmsg(s, priority, tag, message, ucred);
+                        forward_kmsg(s, priority, identifier, message, ucred);
 
                 if (s->forward_to_console)
-                        forward_console(s, tag, message, ucred);
+                        forward_console(s, identifier, message, ucred);
         }
 
         dispatch_message(s, iovec, n, m, ucred, tv, priority);
@@ -1220,32 +1289,81 @@ finish:
                         free(iovec[j].iov_base);
         }
 
-        free(tag);
+        free(identifier);
         free(message);
 }
 
+static void process_native_file(Server *s, int fd, struct ucred *ucred, struct timeval *tv) {
+        struct stat st;
+        void *p;
+        ssize_t n;
+
+        assert(s);
+        assert(fd >= 0);
+
+        /* Data is in the passed file, since it didn't fit in a
+         * datagram. We can't map the file here, since clients might
+         * then truncate it and trigger a SIGBUS for us. So let's
+         * stupidly read it */
+
+        if (fstat(fd, &st) < 0) {
+                log_error("Failed to stat passed file, ignoring: %m");
+                return;
+        }
+
+        if (!S_ISREG(st.st_mode)) {
+                log_error("File passed is not regular. Ignoring.");
+                return;
+        }
+
+        if (st.st_size <= 0)
+                return;
+
+        if (st.st_size > ENTRY_SIZE_MAX) {
+                log_error("File passed too large. Ignoring.");
+                return;
+        }
+
+        p = malloc(st.st_size);
+        if (!p) {
+                log_error("Out of memory");
+                return;
+        }
+
+        n = pread(fd, p, st.st_size, 0);
+        if (n < 0)
+                log_error("Failed to read file, ignoring: %s", strerror(-n));
+        else if (n > 0)
+                process_native_message(s, p, n, ucred, tv);
+
+        free(p);
+}
+
 static int stdout_stream_log(StdoutStream *s, const char *p) {
         struct iovec iovec[N_IOVEC_META_FIELDS + 5];
-        char *message = NULL, *syslog_priority = NULL, *syslog_facility = NULL, *syslog_tag = NULL;
+        char *message = NULL, *syslog_priority = NULL, *syslog_facility = NULL, *syslog_identifier = NULL;
         unsigned n = 0;
         int priority;
 
         assert(s);
         assert(p);
 
+        if (isempty(p))
+                return 0;
+
         priority = s->priority;
 
         if (s->level_prefix)
                 parse_syslog_priority((char**) &p, &priority);
 
         if (s->forward_to_syslog || s->server->forward_to_syslog)
-                forward_syslog(s->server, fixup_priority(priority), s->tag, p, &s->ucred, NULL);
+                forward_syslog(s->server, fixup_priority(priority), s->identifier, p, &s->ucred, NULL);
 
         if (s->forward_to_kmsg || s->server->forward_to_kmsg)
-                forward_kmsg(s->server, priority, s->tag, p, &s->ucred);
+                forward_kmsg(s->server, priority, s->identifier, p, &s->ucred);
 
         if (s->forward_to_console || s->server->forward_to_console)
-                forward_console(s->server, s->tag, p, &s->ucred);
+                forward_console(s->server, s->identifier, p, &s->ucred);
 
         IOVEC_SET_STRING(iovec[n++], "_TRANSPORT=stdout");
 
@@ -1256,10 +1374,10 @@ static int stdout_stream_log(StdoutStream *s, const char *p) {
                 if (asprintf(&syslog_facility, "SYSLOG_FACILITY=%i", LOG_FAC(priority)) >= 0)
                         IOVEC_SET_STRING(iovec[n++], syslog_facility);
 
-        if (s->tag) {
-                syslog_tag = strappend("SYSLOG_TAG=", s->tag);
-                if (syslog_tag)
-                        IOVEC_SET_STRING(iovec[n++], syslog_tag);
+        if (s->identifier) {
+                syslog_identifier = strappend("SYSLOG_IDENTIFIER=", s->identifier);
+                if (syslog_identifier)
+                        IOVEC_SET_STRING(iovec[n++], syslog_identifier);
         }
 
         message = strappend("MESSAGE=", p);
@@ -1271,7 +1389,7 @@ static int stdout_stream_log(StdoutStream *s, const char *p) {
         free(message);
         free(syslog_priority);
         free(syslog_facility);
-        free(syslog_tag);
+        free(syslog_identifier);
 
         return 0;
 }
@@ -1286,9 +1404,9 @@ static int stdout_stream_line(StdoutStream *s, char *p) {
 
         switch (s->state) {
 
-        case STDOUT_STREAM_TAG:
-                s->tag = strdup(p);
-                if (!s->tag) {
+        case STDOUT_STREAM_IDENTIFIER:
+                s->identifier = strdup(p);
+                if (!s->identifier) {
                         log_error("Out of memory");
                         return -ENOMEM;
                 }
@@ -1375,7 +1493,7 @@ static int stdout_stream_scan(StdoutStream *s, bool force_flush) {
                         skip = end - p + 1;
                 else if (remaining >= sizeof(s->buffer) - 1) {
                         end = p + sizeof(s->buffer) - 1;
-                        skip = sizeof(s->buffer) - 1;
+                        skip = remaining;
                 } else
                         break;
 
@@ -1456,7 +1574,7 @@ static void stdout_stream_free(StdoutStream *s) {
                 close_nointr_nofail(s->fd);
         }
 
-        free(s->tag);
+        free(s->identifier);
         free(s);
 }
 
@@ -1525,6 +1643,161 @@ fail:
         return r;
 }
 
+static int parse_kernel_timestamp(char **_p, usec_t *t) {
+        usec_t r;
+        int k, i;
+        char *p;
+
+        assert(_p);
+        assert(*_p);
+        assert(t);
+
+        p = *_p;
+
+        if (strlen(p) < 14 || p[0] != '[' || p[13] != ']' || p[6] != '.')
+                return 0;
+
+        r = 0;
+
+        for (i = 1; i <= 5; i++) {
+                r *= 10;
+
+                if (p[i] == ' ')
+                        continue;
+
+                k = undecchar(p[i]);
+                if (k < 0)
+                        return 0;
+
+                r += k;
+        }
+
+        for (i = 7; i <= 12; i++) {
+                r *= 10;
+
+                k = undecchar(p[i]);
+                if (k < 0)
+                        return 0;
+
+                r += k;
+        }
+
+        *t = r;
+        *_p += 14;
+        *_p += strspn(*_p, WHITESPACE);
+
+        return 1;
+}
+
+static void proc_kmsg_line(Server *s, const char *p) {
+        struct iovec iovec[N_IOVEC_META_FIELDS + 7];
+        char *message = NULL, *syslog_priority = NULL, *syslog_pid = NULL, *syslog_facility = NULL, *syslog_identifier = NULL, *source_time = NULL;
+        int priority = LOG_KERN | LOG_INFO;
+        unsigned n = 0;
+        usec_t usec;
+        char *identifier = NULL, *pid = NULL;
+
+        assert(s);
+        assert(p);
+
+        if (isempty(p))
+                return;
+
+        parse_syslog_priority((char **) &p, &priority);
+
+        if (s->forward_to_kmsg && (priority & LOG_FACMASK) != LOG_KERN)
+                return;
+
+        if (parse_kernel_timestamp((char **) &p, &usec) > 0) {
+                if (asprintf(&source_time, "_SOURCE_MONOTONIC_TIMESTAMP=%llu",
+                             (unsigned long long) usec) >= 0)
+                        IOVEC_SET_STRING(iovec[n++], source_time);
+        }
+
+        IOVEC_SET_STRING(iovec[n++], "_TRANSPORT=kernel");
+
+        if (asprintf(&syslog_priority, "PRIORITY=%i", priority & LOG_PRIMASK) >= 0)
+                IOVEC_SET_STRING(iovec[n++], syslog_priority);
+
+        if ((priority & LOG_FACMASK) == LOG_KERN) {
+
+                if (s->forward_to_syslog)
+                        forward_syslog(s, priority, "kernel", p, NULL, NULL);
+
+                IOVEC_SET_STRING(iovec[n++], "SYSLOG_IDENTIFIER=kernel");
+        } else {
+                read_identifier(&p, &identifier, &pid);
+
+                if (s->forward_to_syslog)
+                        forward_syslog(s, priority, identifier, p, NULL, NULL);
+
+                if (identifier) {
+                        syslog_identifier = strappend("SYSLOG_IDENTIFIER=", identifier);
+                        if (syslog_identifier)
+                                IOVEC_SET_STRING(iovec[n++], syslog_identifier);
+                }
+
+                if (pid) {
+                        syslog_pid = strappend("SYSLOG_PID=", pid);
+                        if (syslog_pid)
+                                IOVEC_SET_STRING(iovec[n++], syslog_pid);
+                }
+
+                if (asprintf(&syslog_facility, "SYSLOG_FACILITY=%i", LOG_FAC(priority)) >= 0)
+                        IOVEC_SET_STRING(iovec[n++], syslog_facility);
+        }
+
+        message = strappend("MESSAGE=", p);
+        if (message)
+                IOVEC_SET_STRING(iovec[n++], message);
+
+        dispatch_message(s, iovec, n, ELEMENTSOF(iovec), NULL, NULL, priority);
+
+        free(message);
+        free(syslog_priority);
+        free(syslog_identifier);
+        free(syslog_pid);
+        free(syslog_facility);
+        free(source_time);
+        free(identifier);
+        free(pid);
+}
+
+static void proc_kmsg_scan(Server *s) {
+        char *p;
+        size_t remaining;
+
+        assert(s);
+
+        p = s->proc_kmsg_buffer;
+        remaining = s->proc_kmsg_length;
+        for (;;) {
+                char *end;
+                size_t skip;
+
+                end = memchr(p, '\n', remaining);
+                if (end)
+                        skip = end - p + 1;
+                else if (remaining >= sizeof(s->proc_kmsg_buffer) - 1) {
+                        end = p + sizeof(s->proc_kmsg_buffer) - 1;
+                        skip = remaining;
+                } else
+                        break;
+
+                *end = 0;
+
+                proc_kmsg_line(s, p);
+
+                remaining -= skip;
+                p += skip;
+        }
+
+        if (p > s->proc_kmsg_buffer) {
+                memmove(s->proc_kmsg_buffer, p, remaining);
+                s->proc_kmsg_length = remaining;
+        }
+}
+
 static int system_journal_open(Server *s) {
         int r;
         char *fn;
@@ -1560,7 +1833,7 @@ static int system_journal_open(Server *s) {
                         s->system_journal->metrics = s->system_metrics;
                         s->system_journal->compress = s->compress;
 
-                        fix_perms(s->system_journal, 0);
+                        server_fix_perms(s, s->system_journal, 0);
                 } else if (r < 0) {
 
                         if (r != -ENOENT && r != -EROFS)
@@ -1613,7 +1886,7 @@ static int system_journal_open(Server *s) {
                         s->runtime_journal->metrics = s->runtime_metrics;
                         s->runtime_journal->compress = s->compress;
 
-                        fix_perms(s->runtime_journal, 0);
+                        server_fix_perms(s, s->runtime_journal, 0);
                 }
         }
 
@@ -1644,6 +1917,8 @@ static int server_flush_to_var(Server *s) {
         if (!s->system_journal)
                 return 0;
 
+        log_info("Flushing to /var...");
+
         r = sd_id128_get_machine(&machine);
         if (r < 0) {
                 log_error("Failed to get machine id: %s", strerror(-r));
@@ -1699,6 +1974,49 @@ finish:
         return r;
 }
 
+static int server_read_proc_kmsg(Server *s) {
+        ssize_t l;
+        assert(s);
+        assert(s->proc_kmsg_fd >= 0);
+
+        l = read(s->proc_kmsg_fd, s->proc_kmsg_buffer + s->proc_kmsg_length, sizeof(s->proc_kmsg_buffer) - 1 - s->proc_kmsg_length);
+        if (l < 0) {
+
+                if (errno == EAGAIN || errno == EINTR)
+                        return 0;
+
+                log_error("Failed to read from kernel: %m");
+                return -errno;
+        }
+
+        s->proc_kmsg_length += l;
+
+        proc_kmsg_scan(s);
+        return 1;
+}
+
+static int server_flush_proc_kmsg(Server *s) {
+        int r;
+
+        assert(s);
+
+        if (s->proc_kmsg_fd < 0)
+                return 0;
+
+        log_info("Flushing /proc/kmsg...");
+
+        for (;;) {
+                r = server_read_proc_kmsg(s);
+                if (r < 0)
+                        return r;
+
+                if (r == 0)
+                        break;
+        }
+
+        return 0;
+}
+
 static int process_event(Server *s, struct epoll_event *ev) {
         assert(s);
 
@@ -1718,7 +2036,7 @@ static int process_event(Server *s, struct epoll_event *ev) {
                                 return -EIO;
 
                         if (errno == EINTR || errno == EAGAIN)
-                                return 0;
+                                return 1;
 
                         return -errno;
                 }
@@ -1731,6 +2049,20 @@ static int process_event(Server *s, struct epoll_event *ev) {
                 log_debug("Received SIG%s", signal_to_string(sfsi.ssi_signo));
                 return 0;
 
+        } else if (ev->data.fd == s->proc_kmsg_fd) {
+                int r;
+
+                if (ev->events != EPOLLIN) {
+                        log_info("Got invalid event from epoll.");
+                        return -EIO;
+                }
+
+                r = server_read_proc_kmsg(s);
+                if (r < 0)
+                        return r;
+
+                return 1;
+
         } else if (ev->data.fd == s->native_fd ||
                    ev->data.fd == s->syslog_fd) {
 
@@ -1748,19 +2080,19 @@ static int process_event(Server *s, struct epoll_event *ev) {
                         union {
                                 struct cmsghdr cmsghdr;
                                 uint8_t buf[CMSG_SPACE(sizeof(struct ucred)) +
-                                            CMSG_SPACE(sizeof(struct timeval))];
+                                            CMSG_SPACE(sizeof(struct timeval)) +
+                                            CMSG_SPACE(sizeof(int))];
                         } control;
                         ssize_t n;
                         int v;
+                        int *fds = NULL;
+                        unsigned n_fds = 0;
 
                         if (ioctl(ev->data.fd, SIOCINQ, &v) < 0) {
                                 log_error("SIOCINQ failed: %m");
                                 return -errno;
                         }
 
-                        if (v <= 0)
-                                return 1;
-
                         if (s->buffer_size < (size_t) v) {
                                 void *b;
                                 size_t l;
@@ -1788,7 +2120,7 @@ static int process_event(Server *s, struct epoll_event *ev) {
                         msghdr.msg_control = &control;
                         msghdr.msg_controllen = sizeof(control);
 
-                        n = recvmsg(ev->data.fd, &msghdr, MSG_DONTWAIT);
+                        n = recvmsg(ev->data.fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
                         if (n < 0) {
 
                                 if (errno == EINTR || errno == EAGAIN)
@@ -1808,20 +2140,37 @@ static int process_event(Server *s, struct epoll_event *ev) {
                                          cmsg->cmsg_type == SO_TIMESTAMP &&
                                          cmsg->cmsg_len == CMSG_LEN(sizeof(struct timeval)))
                                         tv = (struct timeval*) CMSG_DATA(cmsg);
+                                else if (cmsg->cmsg_level == SOL_SOCKET &&
+                                         cmsg->cmsg_type == SCM_RIGHTS) {
+                                        fds = (int*) CMSG_DATA(cmsg);
+                                        n_fds = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
+                                }
                         }
 
                         if (ev->data.fd == s->syslog_fd) {
                                 char *e;
 
-                                e = memchr(s->buffer, '\n', n);
-                                if (e)
-                                        *e = 0;
-                                else
-                                        s->buffer[n] = 0;
+                                if (n > 0 && n_fds == 0) {
+                                        e = memchr(s->buffer, '\n', n);
+                                        if (e)
+                                                *e = 0;
+                                        else
+                                                s->buffer[n] = 0;
+
+                                        process_syslog_message(s, strstrip(s->buffer), ucred, tv);
+                                } else if (n_fds > 0)
+                                        log_warning("Got file descriptors via syslog socket. Ignoring.");
+
+                        } else {
+                                if (n > 0 && n_fds == 0)
+                                        process_native_message(s, s->buffer, n, ucred, tv);
+                                else if (n == 0 && n_fds == 1)
+                                        process_native_file(s, fds[0], ucred, tv);
+                                else if (n_fds > 0)
+                                        log_warning("Got too many file descriptors via native socket. Ignoring.");
+                        }
 
-                                process_syslog_message(s, strstrip(s->buffer), ucred, tv);
-                        } else
-                                process_native_message(s, s->buffer, n, ucred, tv);
+                        close_many(fds, n_fds);
                 }
 
                 return 1;
@@ -1873,7 +2222,7 @@ static int open_syslog_socket(Server *s) {
 
         if (s->syslog_fd < 0) {
 
-                s->syslog_fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0);
+                s->syslog_fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
                 if (s->syslog_fd < 0) {
                         log_error("socket() failed: %m");
                         return -errno;
@@ -1937,7 +2286,7 @@ static int open_native_socket(Server*s) {
 
         if (s->native_fd < 0) {
 
-                s->native_fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0);
+                s->native_fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
                 if (s->native_fd < 0) {
                         log_error("socket() failed: %m");
                         return -errno;
@@ -1992,7 +2341,7 @@ static int open_stdout_socket(Server *s) {
 
         if (s->stdout_fd < 0) {
 
-                s->stdout_fd = socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC, 0);
+                s->stdout_fd = socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
                 if (s->stdout_fd < 0) {
                         log_error("socket() failed: %m");
                         return -errno;
@@ -2029,6 +2378,32 @@ static int open_stdout_socket(Server *s) {
         return 0;
 }
 
+static int open_proc_kmsg(Server *s) {
+        struct epoll_event ev;
+
+        assert(s);
+
+        if (!s->import_proc_kmsg)
+                return 0;
+
+
+        s->proc_kmsg_fd = open("/proc/kmsg", O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
+        if (s->proc_kmsg_fd < 0) {
+                log_warning("Failed to open /proc/kmsg, ignoring: %m");
+                return 0;
+        }
+
+        zero(ev);
+        ev.events = EPOLLIN;
+        ev.data.fd = s->proc_kmsg_fd;
+        if (epoll_ctl(s->epoll_fd, EPOLL_CTL_ADD, s->proc_kmsg_fd, &ev) < 0) {
+                log_error("Failed to add /proc/kmsg fd to epoll object: %m");
+                return -errno;
+        }
+
+        return 0;
+}
+
 static int open_signalfd(Server *s) {
         sigset_t mask;
         struct epoll_event ev;
@@ -2057,6 +2432,59 @@ static int open_signalfd(Server *s) {
         return 0;
 }
 
+static int server_parse_proc_cmdline(Server *s) {
+        char *line, *w, *state;
+        int r;
+        size_t l;
+
+        if (detect_container(NULL) > 0)
+                return 0;
+
+        r = read_one_line_file("/proc/cmdline", &line);
+        if (r < 0) {
+                log_warning("Failed to read /proc/cmdline, ignoring: %s", strerror(-r));
+                return 0;
+        }
+
+        FOREACH_WORD_QUOTED(w, l, line, state) {
+                char *word;
+
+                word = strndup(w, l);
+                if (!word) {
+                        r = -ENOMEM;
+                        goto finish;
+                }
+
+                if (startswith(word, "systemd_journald.forward_to_syslog=")) {
+                        r = parse_boolean(word + 35);
+                        if (r < 0)
+                                log_warning("Failed to parse forward to syslog switch %s. Ignoring.", word + 35);
+                        else
+                                s->forward_to_syslog = r;
+                } else if (startswith(word, "systemd_journald.forward_to_kmsg=")) {
+                        r = parse_boolean(word + 33);
+                        if (r < 0)
+                                log_warning("Failed to parse forward to kmsg switch %s. Ignoring.", word + 33);
+                        else
+                                s->forward_to_kmsg = r;
+                } else if (startswith(word, "systemd_journald.forward_to_console=")) {
+                        r = parse_boolean(word + 36);
+                        if (r < 0)
+                                log_warning("Failed to parse forward to console switch %s. Ignoring.", word + 36);
+                        else
+                                s->forward_to_console = r;
+                }
+
+                free(word);
+        }
+
+        r = 0;
+
+finish:
+        free(line);
+        return r;
+}
+
 static int server_parse_config_file(Server *s) {
         FILE *f;
         const char *fn;
@@ -2089,18 +2517,20 @@ static int server_init(Server *s) {
         assert(s);
 
         zero(*s);
-        s->syslog_fd = s->native_fd = s->stdout_fd = s->signal_fd = s->epoll_fd = -1;
+        s->syslog_fd = s->native_fd = s->stdout_fd = s->signal_fd = s->epoll_fd = s->proc_kmsg_fd = -1;
         s->compress = true;
 
         s->rate_limit_interval = DEFAULT_RATE_LIMIT_INTERVAL;
         s->rate_limit_burst = DEFAULT_RATE_LIMIT_BURST;
 
         s->forward_to_syslog = true;
+        s->import_proc_kmsg = true;
 
         memset(&s->system_metrics, 0xFF, sizeof(s->system_metrics));
         memset(&s->runtime_metrics, 0xFF, sizeof(s->runtime_metrics));
 
         server_parse_config_file(s);
+        server_parse_proc_cmdline(s);
 
         s->user_journals = hashmap_new(trivial_hash_func, trivial_compare_func);
         if (!s->user_journals) {
@@ -2167,6 +2597,10 @@ static int server_init(Server *s) {
         if (r < 0)
                 return r;
 
+        r = open_proc_kmsg(s);
+        if (r < 0)
+                return r;
+
         r = system_journal_open(s);
         if (r < 0)
                 return r;
@@ -2215,6 +2649,9 @@ static void server_done(Server *s) {
         if (s->stdout_fd >= 0)
                 close_nointr_nofail(s->stdout_fd);
 
+        if (s->proc_kmsg_fd >= 0)
+                close_nointr_nofail(s->proc_kmsg_fd);
+
         if (s->rate_limit)
                 journal_rate_limit_free(s->rate_limit);
 
@@ -2247,6 +2684,7 @@ int main(int argc, char *argv[]) {
 
         server_vacuum(&server);
         server_flush_to_var(&server);
+        server_flush_proc_kmsg(&server);
 
         log_debug("systemd-journald running as pid %lu", (unsigned long) getpid());
         driver_message(&server, SD_MESSAGE_JOURNAL_START, "Journal started");