X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Ftmpfiles%2Ftmpfiles.c;h=3c8993e8942f7b6736cac91d9a958021621941bc;hp=cbad78aea5dd145c097eede3569396bbbfb21a95;hb=50d9e46dbb8400d4570781728c63b151d9ca982b;hpb=e156347e0480d3eee4877463297149ae96e34f8c diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c index cbad78aea..3c8993e89 100644 --- a/src/tmpfiles/tmpfiles.c +++ b/src/tmpfiles/tmpfiles.c @@ -4,6 +4,7 @@ This file is part of systemd. Copyright 2010 Lennart Poettering, Kay Sievers + Copyright 2015 Zbigniew Jędrzejewski-Szmek systemd is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by @@ -23,7 +24,6 @@ #include #include #include -#include #include #include #include @@ -34,11 +34,12 @@ #include #include #include -#include -#include #include #include -#include +#include +#include +#include +#include #include "log.h" #include "util.h" @@ -54,6 +55,9 @@ #include "specifier.h" #include "build.h" #include "copy.h" +#include "selinux-util.h" +#include "btrfs-util.h" +#include "acl-util.h" /* This reads all files listed in /etc/tmpfiles.d/?*.conf and creates * them in the file system. This is intended to be used to create @@ -66,6 +70,7 @@ typedef enum ItemType { TRUNCATE_FILE = 'F', CREATE_DIRECTORY = 'd', TRUNCATE_DIRECTORY = 'D', + CREATE_SUBVOLUME = 'v', CREATE_FIFO = 'p', CREATE_SYMLINK = 'L', CREATE_CHAR_DEVICE = 'c', @@ -73,6 +78,10 @@ typedef enum ItemType { COPY_FILES = 'C', /* These ones take globs */ + SET_XATTR = 't', + RECURSIVE_SET_XATTR = 'T', + SET_ACL = 'a', + RECURSIVE_SET_ACL = 'A', WRITE_FILE = 'w', IGNORE_PATH = 'x', IGNORE_DIRECTORY_PATH = 'X', @@ -88,6 +97,11 @@ typedef struct Item { char *path; char *argument; + char **xattrs; +#ifdef HAVE_ACL + acl_t acl_access; + acl_t acl_default; +#endif uid_t uid; gid_t gid; mode_t mode; @@ -108,6 +122,12 @@ typedef struct Item { bool done:1; } Item; +typedef struct ItemArray { + Item *items; + size_t count; + size_t size; +} ItemArray; + static bool arg_create = false; static bool arg_clean = false; static bool arg_remove = false; @@ -117,15 +137,7 @@ static char **arg_include_prefixes = NULL; static char **arg_exclude_prefixes = NULL; static char *arg_root = NULL; -static const char conf_file_dirs[] = - "/etc/tmpfiles.d\0" - "/run/tmpfiles.d\0" - "/usr/local/lib/tmpfiles.d\0" - "/usr/lib/tmpfiles.d\0" -#ifdef HAVE_SPLIT_USR - "/lib/tmpfiles.d\0" -#endif - ; +static const char conf_file_dirs[] = CONF_DIRS_NULSTR("tmpfiles"); #define MAX_DEPTH 256 @@ -141,16 +153,47 @@ static bool needs_glob(ItemType t) { RECURSIVE_REMOVE_PATH, ADJUST_MODE, RELABEL_PATH, - RECURSIVE_RELABEL_PATH); + RECURSIVE_RELABEL_PATH, + SET_XATTR, + RECURSIVE_SET_XATTR, + SET_ACL, + RECURSIVE_SET_ACL); +} + +static bool takes_ownership(ItemType t) { + return IN_SET(t, + CREATE_FILE, + TRUNCATE_FILE, + CREATE_DIRECTORY, + TRUNCATE_DIRECTORY, + CREATE_SUBVOLUME, + CREATE_FIFO, + CREATE_SYMLINK, + CREATE_CHAR_DEVICE, + CREATE_BLOCK_DEVICE, + COPY_FILES, + + WRITE_FILE, + IGNORE_PATH, + IGNORE_DIRECTORY_PATH, + REMOVE_PATH, + RECURSIVE_REMOVE_PATH); } static struct Item* find_glob(Hashmap *h, const char *match) { - Item *j; + ItemArray *j; Iterator i; - HASHMAP_FOREACH(j, h, i) - if (fnmatch(j->path, match, FNM_PATHNAME|FNM_PERIOD) == 0) - return j; + HASHMAP_FOREACH(j, h, i) { + unsigned n; + + for (n = 0; n < j->count; n++) { + Item *item = j->items + n; + + if (fnmatch(item->path, match, FNM_PATHNAME|FNM_PERIOD) == 0) + return item; + } + } return NULL; } @@ -165,7 +208,7 @@ static void load_unix_sockets(void) { /* We maintain a cache of the sockets we found in * /proc/net/unix to speed things up a little. */ - unix_sockets = set_new(string_hash_func, string_compare_func); + unix_sockets = set_new(&string_hash_ops); if (!unix_sockets) return; @@ -233,10 +276,7 @@ static bool unix_socket_alive(const char *fn) { static int dir_is_mount_point(DIR *d, const char *subdir) { - union file_handle_union h = { - .handle.handle_bytes = MAX_HANDLE_SZ - }; - + union file_handle_union h = FILE_HANDLE_INIT; int mount_id_parent, mount_id; int r_p, r; @@ -259,7 +299,7 @@ static int dir_is_mount_point(DIR *d, const char *subdir) { /* got only one handle; assume different mount points if one * of both queries was not supported by the filesystem */ - if (r_p == -ENOSYS || r_p == -ENOTSUP || r == -ENOSYS || r == -ENOTSUP) + if (r_p == -ENOSYS || r_p == -EOPNOTSUPP || r == -ENOSYS || r == -EOPNOTSUPP) return true; /* return error */ @@ -299,9 +339,9 @@ static int dir_cleanup( /* FUSE, NFS mounts, SELinux might return EACCES */ if (errno == EACCES) - log_debug("stat(%s/%s) failed: %m", p, dent->d_name); + log_debug_errno(errno, "stat(%s/%s) failed: %m", p, dent->d_name); else - log_error("stat(%s/%s) failed: %m", p, dent->d_name); + log_error_errno(errno, "stat(%s/%s) failed: %m", p, dent->d_name); r = -errno; continue; } @@ -349,7 +389,7 @@ static int dir_cleanup( sub_dir = xopendirat(dirfd(d), dent->d_name, O_NOFOLLOW|O_NOATIME); if (!sub_dir) { if (errno != ENOENT) { - log_error("opendir(%s/%s) failed: %m", p, dent->d_name); + log_error_errno(errno, "opendir(%s/%s) failed: %m", p, dent->d_name); r = -errno; } @@ -382,7 +422,7 @@ static int dir_cleanup( if (unlinkat(dirfd(d), dent->d_name, AT_REMOVEDIR) < 0) { if (errno != ENOENT && errno != ENOTEMPTY) { - log_error("rmdir(%s): %m", sub_path); + log_error_errno(errno, "rmdir(%s): %m", sub_path); r = -errno; } } @@ -430,7 +470,7 @@ static int dir_cleanup( if (unlinkat(dirfd(d), dent->d_name, 0) < 0) { if (errno != ENOENT) { - log_error("unlink(%s): %m", sub_path); + log_error_errno(errno, "unlink(%s): %m", sub_path); r = -errno; } } @@ -446,51 +486,180 @@ finish: times[1] = ds->st_mtim; if (futimens(dirfd(d), times) < 0) - log_error("utimensat(%s): %m", p); + log_error_errno(errno, "utimensat(%s): %m", p); } return r; } -static int item_set_perms(Item *i, const char *path) { +static int path_set_perms(Item *i, const char *path) { + struct stat st; + bool st_valid; + assert(i); assert(path); + st_valid = stat(path, &st) == 0; + /* not using i->path directly because it may be a glob */ if (i->mode_set) { mode_t m = i->mode; - if (i->mask_perms) { - struct stat st; - - if (stat(path, &st) >= 0) { - if (!(st.st_mode & 0111)) - m &= ~0111; - if (!(st.st_mode & 0222)) - m &= ~0222; - if (!(st.st_mode & 0444)) - m &= ~0444; - if (!S_ISDIR(st.st_mode)) - m &= ~07000; /* remove sticky/sgid/suid bit, unless directory */ - } + if (i->mask_perms && st_valid) { + if (!(st.st_mode & 0111)) + m &= ~0111; + if (!(st.st_mode & 0222)) + m &= ~0222; + if (!(st.st_mode & 0444)) + m &= ~0444; + if (!S_ISDIR(st.st_mode)) + m &= ~07000; /* remove sticky/sgid/suid bit, unless directory */ } - if (chmod(path, m) < 0) { - log_error("chmod(%s) failed: %m", path); - return -errno; + if (!st_valid || m != (st.st_mode & 07777)) { + if (chmod(path, m) < 0) + return log_error_errno(errno, "chmod(%s) failed: %m", path); } } - if (i->uid_set || i->gid_set) + if ((!st_valid || (i->uid != st.st_uid || i->gid != st.st_gid)) && + (i->uid_set || i->gid_set)) if (chown(path, - i->uid_set ? i->uid : (uid_t) -1, - i->gid_set ? i->gid : (gid_t) -1) < 0) { + i->uid_set ? i->uid : UID_INVALID, + i->gid_set ? i->gid : GID_INVALID) < 0) + + return log_error_errno(errno, "chown(%s) failed: %m", path); + + return label_fix(path, false, false); +} + +static int get_xattrs_from_arg(Item *i) { + char *xattr; + const char *p; + int r; + + assert(i); + assert(i->argument); + + p = i->argument; + + while ((r = unquote_first_word(&p, &xattr, false)) > 0) { + _cleanup_free_ char *tmp = NULL, *name = NULL, + *value = NULL, *value2 = NULL, *_xattr = xattr; + + r = split_pair(xattr, "=", &name, &value); + if (r < 0) { + log_warning("Illegal xattr found: \"%s\" - ignoring.", xattr); + continue; + } + + if (strempty(name) || strempty(value)) { + log_warning("Malformed xattr found: \"%s\" - ignoring.", xattr); + continue; + } + + tmp = unquote(value, "\""); + if (!tmp) + return log_oom(); + + value2 = cunescape(tmp); + if (!value2) + return log_oom(); + + if (strv_push_pair(&i->xattrs, name, value2) < 0) + return log_oom(); + name = value2 = NULL; + } + + return r; +} + +static int path_set_xattrs(Item *i, const char *path) { + char **name, **value; + + assert(i); + assert(path); - log_error("chown(%s) failed: %m", path); + STRV_FOREACH_PAIR(name, value, i->xattrs) { + int n; + + n = strlen(*value); + if (lsetxattr(path, *name, *value, n, 0) < 0) { + log_error("Setting extended attribute %s=%s on %s failed: %m", + *name, *value, path); return -errno; } + } + return 0; +} - return label_fix(path, false, false); +static int get_acls_from_arg(Item *item) { +#ifdef HAVE_ACL + int r; + _cleanup_(acl_freep) acl_t a = NULL, d = NULL; + + assert(item); + + /* If force (= modify) is set, we will not modify the acl + * afterwards, so the mask can be added now if necessary. */ + r = parse_acl(item->argument, &item->acl_access, &item->acl_default, !item->force); + if (r < 0) + log_warning_errno(errno, "Failed to parse ACL \"%s\": %m. Ignoring", + item->argument); +#else + log_warning_errno(ENOSYS, "ACLs are not supported. Ignoring"); +#endif + + return 0; +} + +static int path_set_acl(const char *path, acl_type_t type, acl_t acl, bool modify) { + _cleanup_(acl_freep) acl_t cleanme = NULL; + int r; + + if (modify) { + r = acls_for_file(path, type, acl, &cleanme); + if (r < 0) + return r; + acl = cleanme; + }; + + r = acl_set_file(path, type, acl); + if (r < 0) { + _cleanup_(acl_free_charpp) char *t; + + r = -errno; + t = acl_to_any_text(acl, NULL, ',', TEXT_ABBREVIATE); + log_error_errno(r, + "Setting %s ACL \"%s\" on %s failed: %m", + type == ACL_TYPE_ACCESS ? "access" : "default", + strna(t), path); + } + + return r; +} + +static int path_set_acls(Item *item, const char *path) { +#ifdef HAVE_ACL + int r; + + assert(item); + assert(path); + + if (item->acl_access) { + r = path_set_acl(path, ACL_TYPE_ACCESS, item->acl_access, item->force); + if (r < 0) + return r; + } + + if (item->acl_default) { + r = path_set_acl(path, ACL_TYPE_DEFAULT, item->acl_default, item->force); + if (r < 0) + return r; + } +#endif + + return 0; } static int write_one_file(Item *i, const char *path) { @@ -505,16 +674,16 @@ static int write_one_file(Item *i, const char *path) { i->type == TRUNCATE_FILE ? O_CREAT|O_TRUNC|O_NOFOLLOW : 0; RUN_WITH_UMASK(0000) { - label_context_set(path, S_IFREG); + mac_selinux_create_file_prepare(path, S_IFREG); fd = open(path, flags|O_NDELAY|O_CLOEXEC|O_WRONLY|O_NOCTTY, i->mode); - label_context_clear(); + mac_selinux_create_file_clear(); } if (fd < 0) { if (i->type == WRITE_FILE && errno == ENOENT) return 0; - log_error("Failed to create file %s: %m", path); + log_error_errno(errno, "Failed to create file %s: %m", path); return -errno; } @@ -538,24 +707,24 @@ static int write_one_file(Item *i, const char *path) { fd = safe_close(fd); - if (stat(path, &st) < 0) { - log_error("stat(%s) failed: %m", path); - return -errno; - } + if (stat(path, &st) < 0) + return log_error_errno(errno, "stat(%s) failed: %m", path); if (!S_ISREG(st.st_mode)) { log_error("%s is not a file.", path); return -EEXIST; } - r = item_set_perms(i, path); + r = path_set_perms(i, path); if (r < 0) return r; return 0; } -static int item_set_perms_children(Item *i, const char *path) { +typedef int (*action_t)(Item *, const char *); + +static int item_do_children(Item *i, const char *path, action_t action) { _cleanup_closedir_ DIR *d; int r = 0; @@ -590,12 +759,12 @@ static int item_set_perms_children(Item *i, const char *path) { if (!p) return -ENOMEM; - q = item_set_perms(i, p); + q = action(i, p); if (q < 0 && q != -ENOENT && r == 0) r = q; if (IN_SET(de->d_type, DT_UNKNOWN, DT_DIR)) { - q = item_set_perms_children(i, p); + q = item_do_children(i, p, action); if (q < 0 && r == 0) r = q; } @@ -604,42 +773,26 @@ static int item_set_perms_children(Item *i, const char *path) { return r; } -static int item_set_perms_recursive(Item *i, const char *path) { - int r, q; - - assert(i); - assert(path); - - r = item_set_perms(i, path); - if (r < 0) - return r; - - q = item_set_perms_children(i, path); - if (q < 0 && r == 0) - r = q; - - return r; -} - -static int glob_item(Item *i, int (*action)(Item *, const char *)) { +static int glob_item(Item *i, action_t action, bool recursive) { _cleanup_globfree_ glob_t g = {}; int r = 0, k; char **fn; errno = 0; k = glob(i->path, GLOB_NOSORT|GLOB_BRACE, NULL, &g); - if (k != 0 && k != GLOB_NOMATCH) { - if (errno == 0) - errno = EIO; - - log_error("glob(%s) failed: %m", i->path); - return -errno; - } + if (k != 0 && k != GLOB_NOMATCH) + return log_error_errno(errno ?: EIO, "glob(%s) failed: %m", i->path); STRV_FOREACH(fn, g.gl_pathv) { k = action(i, *fn); if (k < 0 && r == 0) r = k; + + if (recursive) { + k = item_do_children(i, *fn, action); + if (k < 0 && r == 0) + r = k; + } } return r; @@ -671,20 +824,14 @@ static int create_item(Item *i) { if (r < 0) { struct stat a, b; - if (r != -EEXIST) { - log_error("Failed to copy files to %s: %s", i->path, strerror(-r)); - return -r; - } + if (r != -EEXIST) + return log_error_errno(r, "Failed to copy files to %s: %m", i->path); - if (stat(i->argument, &a) < 0) { - log_error("stat(%s) failed: %m", i->argument); - return -errno; - } + if (stat(i->argument, &a) < 0) + return log_error_errno(errno, "stat(%s) failed: %m", i->argument); - if (stat(i->path, &b) < 0) { - log_error("stat(%s) failed: %m", i->path); - return -errno; - } + if (stat(i->path, &b) < 0) + return log_error_errno(errno, "stat(%s) failed: %m", i->path); if ((a.st_mode ^ b.st_mode) & S_IFMT) { log_debug("Can't copy to %s, file exists already and is of different type", i->path); @@ -692,37 +839,43 @@ static int create_item(Item *i) { } } - r = item_set_perms(i, i->path); + r = path_set_perms(i, i->path); if (r < 0) return r; break; case WRITE_FILE: - r = glob_item(i, write_one_file); + r = glob_item(i, write_one_file, false); if (r < 0) return r; break; - case TRUNCATE_DIRECTORY: case CREATE_DIRECTORY: + case TRUNCATE_DIRECTORY: + case CREATE_SUBVOLUME: - RUN_WITH_UMASK(0000) { + RUN_WITH_UMASK(0000) mkdir_parents_label(i->path, 0755); - r = mkdir_label(i->path, i->mode); + + if (i->type == CREATE_SUBVOLUME) { + RUN_WITH_UMASK((~i->mode) & 0777) + r = btrfs_subvol_make(i->path); + } else + r = 0; + + if (IN_SET(i->type, CREATE_DIRECTORY, TRUNCATE_DIRECTORY) || r == -ENOTTY) { + RUN_WITH_UMASK(0000) + r = mkdir_label(i->path, i->mode); } if (r < 0) { - if (r != -EEXIST) { - log_error("Failed to create directory %s: %s", i->path, strerror(-r)); - return r; - } + if (r != -EEXIST) + return log_error_errno(r, "Failed to create directory or subvolume %s: %m", i->path); - if (stat(i->path, &st) < 0) { - log_error("stat(%s) failed: %m", i->path); - return -errno; - } + if (stat(i->path, &st) < 0) + return log_error_errno(errno, "stat(%s) failed: %m", i->path); if (!S_ISDIR(st.st_mode)) { log_debug("%s already exists and is not a directory.", i->path); @@ -730,7 +883,7 @@ static int create_item(Item *i) { } } - r = item_set_perms(i, i->path); + r = path_set_perms(i, i->path); if (r < 0) return r; @@ -739,36 +892,30 @@ static int create_item(Item *i) { case CREATE_FIFO: RUN_WITH_UMASK(0000) { - label_context_set(i->path, S_IFIFO); + mac_selinux_create_file_prepare(i->path, S_IFIFO); r = mkfifo(i->path, i->mode); - label_context_clear(); + mac_selinux_create_file_clear(); } if (r < 0) { - if (errno != EEXIST) { - log_error("Failed to create fifo %s: %m", i->path); - return -errno; - } + if (errno != EEXIST) + return log_error_errno(errno, "Failed to create fifo %s: %m", i->path); - if (stat(i->path, &st) < 0) { - log_error("stat(%s) failed: %m", i->path); - return -errno; - } + if (stat(i->path, &st) < 0) + return log_error_errno(errno, "stat(%s) failed: %m", i->path); if (!S_ISFIFO(st.st_mode)) { if (i->force) { RUN_WITH_UMASK(0000) { - label_context_set(i->path, S_IFIFO); + mac_selinux_create_file_prepare(i->path, S_IFIFO); r = mkfifo_atomic(i->path, i->mode); - label_context_clear(); + mac_selinux_create_file_clear(); } - if (r < 0) { - log_error("Failed to create fifo %s: %s", i->path, strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to create fifo %s: %m", i->path); } else { log_debug("%s is not a fifo.", i->path); return 0; @@ -776,7 +923,7 @@ static int create_item(Item *i) { } } - r = item_set_perms(i, i->path); + r = path_set_perms(i, i->path); if (r < 0) return r; @@ -784,30 +931,26 @@ static int create_item(Item *i) { case CREATE_SYMLINK: - label_context_set(i->path, S_IFLNK); + mac_selinux_create_file_prepare(i->path, S_IFLNK); r = symlink(i->argument, i->path); - label_context_clear(); + mac_selinux_create_file_clear(); if (r < 0) { _cleanup_free_ char *x = NULL; - if (errno != EEXIST) { - log_error("symlink(%s, %s) failed: %m", i->argument, i->path); - return -errno; - } + if (errno != EEXIST) + return log_error_errno(errno, "symlink(%s, %s) failed: %m", i->argument, i->path); r = readlink_malloc(i->path, &x); if (r < 0 || !streq(i->argument, x)) { if (i->force) { - label_context_set(i->path, S_IFLNK); + mac_selinux_create_file_prepare(i->path, S_IFLNK); r = symlink_atomic(i->argument, i->path); - label_context_clear(); + mac_selinux_create_file_clear(); - if (r < 0) { - log_error("symlink(%s, %s) failed: %s", i->argument, i->path, strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "symlink(%s, %s) failed: %m", i->argument, i->path); } else { log_debug("%s is not a symlink or does not point to the correct path.", i->path); return 0; @@ -834,9 +977,9 @@ static int create_item(Item *i) { file_type = i->type == CREATE_BLOCK_DEVICE ? S_IFBLK : S_IFCHR; RUN_WITH_UMASK(0000) { - label_context_set(i->path, file_type); + mac_selinux_create_file_prepare(i->path, file_type); r = mknod(i->path, i->mode | file_type, i->major_minor); - label_context_clear(); + mac_selinux_create_file_clear(); } if (r < 0) { @@ -846,30 +989,24 @@ static int create_item(Item *i) { return 0; } - if (errno != EEXIST) { - log_error("Failed to create device node %s: %m", i->path); - return -errno; - } + if (errno != EEXIST) + return log_error_errno(errno, "Failed to create device node %s: %m", i->path); - if (stat(i->path, &st) < 0) { - log_error("stat(%s) failed: %m", i->path); - return -errno; - } + if (stat(i->path, &st) < 0) + return log_error_errno(errno, "stat(%s) failed: %m", i->path); if ((st.st_mode & S_IFMT) != file_type) { if (i->force) { RUN_WITH_UMASK(0000) { - label_context_set(i->path, file_type); + mac_selinux_create_file_prepare(i->path, file_type); r = mknod_atomic(i->path, i->mode | file_type, i->major_minor); - label_context_clear(); + mac_selinux_create_file_clear(); } - if (r < 0) { - log_error("Failed to create device node %s: %s", i->path, strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to create device node %s: %m", i->path); } else { log_debug("%s is not a device node.", i->path); return 0; @@ -877,7 +1014,7 @@ static int create_item(Item *i) { } } - r = item_set_perms(i, i->path); + r = path_set_perms(i, i->path); if (r < 0) return r; @@ -886,18 +1023,39 @@ static int create_item(Item *i) { case ADJUST_MODE: case RELABEL_PATH: - - r = glob_item(i, item_set_perms); + r = glob_item(i, path_set_perms, false); if (r < 0) return r; break; case RECURSIVE_RELABEL_PATH: + r = glob_item(i, path_set_perms, true); + if (r < 0) + return r; + break; - r = glob_item(i, item_set_perms_recursive); + case SET_XATTR: + r = glob_item(i, path_set_xattrs, false); if (r < 0) return r; + break; + case RECURSIVE_SET_XATTR: + r = glob_item(i, path_set_xattrs, true); + if (r < 0) + return r; + break; + + case SET_ACL: + r = glob_item(i, path_set_acls, false); + if (r < 0) + return r; + break; + + case RECURSIVE_SET_ACL: + r = glob_item(i, path_set_acls, true); + if (r < 0) + return r; break; } @@ -916,6 +1074,7 @@ static int remove_item_instance(Item *i, const char *instance) { case CREATE_FILE: case TRUNCATE_FILE: case CREATE_DIRECTORY: + case CREATE_SUBVOLUME: case CREATE_FIFO: case CREATE_SYMLINK: case CREATE_BLOCK_DEVICE: @@ -927,13 +1086,15 @@ static int remove_item_instance(Item *i, const char *instance) { case RECURSIVE_RELABEL_PATH: case WRITE_FILE: case COPY_FILES: + case SET_XATTR: + case RECURSIVE_SET_XATTR: + case SET_ACL: + case RECURSIVE_SET_ACL: break; case REMOVE_PATH: - if (remove(instance) < 0 && errno != ENOENT) { - log_error("remove(%s): %m", instance); - return -errno; - } + if (remove(instance) < 0 && errno != ENOENT) + return log_error_errno(errno, "rm(%s): %m", instance); break; @@ -942,10 +1103,8 @@ static int remove_item_instance(Item *i, const char *instance) { /* FIXME: we probably should use dir_cleanup() here * instead of rm_rf() so that 'x' is honoured. */ r = rm_rf_dangerous(instance, false, i->type == RECURSIVE_REMOVE_PATH, false); - if (r < 0 && r != -ENOENT) { - log_error("rm_rf(%s): %s", instance, strerror(-r)); - return r; - } + if (r < 0 && r != -ENOENT) + return log_error_errno(r, "rm_rf(%s): %m", instance); break; } @@ -963,6 +1122,7 @@ static int remove_item(Item *i) { case CREATE_FILE: case TRUNCATE_FILE: case CREATE_DIRECTORY: + case CREATE_SUBVOLUME: case CREATE_FIFO: case CREATE_SYMLINK: case CREATE_CHAR_DEVICE: @@ -974,12 +1134,16 @@ static int remove_item(Item *i) { case RECURSIVE_RELABEL_PATH: case WRITE_FILE: case COPY_FILES: + case SET_XATTR: + case RECURSIVE_SET_XATTR: + case SET_ACL: + case RECURSIVE_SET_ACL: break; case REMOVE_PATH: case TRUNCATE_DIRECTORY: case RECURSIVE_REMOVE_PATH: - r = glob_item(i, remove_item_instance); + r = glob_item(i, remove_item_instance, false); break; } @@ -1009,24 +1173,20 @@ static int clean_item_instance(Item *i, const char* instance) { if (errno == ENOENT || errno == ENOTDIR) return 0; - log_error("Failed to open directory %s: %m", i->path); + log_error_errno(errno, "Failed to open directory %s: %m", i->path); return -errno; } - if (fstat(dirfd(d), &s) < 0) { - log_error("stat(%s) failed: %m", i->path); - return -errno; - } + if (fstat(dirfd(d), &s) < 0) + return log_error_errno(errno, "stat(%s) failed: %m", i->path); if (!S_ISDIR(s.st_mode)) { log_error("%s is not a directory.", i->path); return -ENOTDIR; } - if (fstatat(dirfd(d), "..", &ps, AT_SYMLINK_NOFOLLOW) != 0) { - log_error("stat(%s/..) failed: %m", i->path); - return -errno; - } + if (fstatat(dirfd(d), "..", &ps, AT_SYMLINK_NOFOLLOW) != 0) + return log_error_errno(errno, "stat(%s/..) failed: %m", i->path); mountpoint = s.st_dev != ps.st_dev || (s.st_dev == ps.st_dev && s.st_ino == ps.st_ino); @@ -1043,13 +1203,14 @@ static int clean_item(Item *i) { switch (i->type) { case CREATE_DIRECTORY: + case CREATE_SUBVOLUME: case TRUNCATE_DIRECTORY: case IGNORE_PATH: case COPY_FILES: clean_item_instance(i, i->path); break; case IGNORE_DIRECTORY_PATH: - r = glob_item(i, clean_item_instance); + r = glob_item(i, clean_item_instance, false); break; default: break; @@ -1058,9 +1219,11 @@ static int clean_item(Item *i) { return r; } +static int process_item_array(ItemArray *array); + static int process_item(Item *i) { - int r, q, p; - char prefix[PATH_MAX]; + int r, q, p, t = 0; + _cleanup_free_ char *prefix = NULL; assert(i); @@ -1069,77 +1232,98 @@ static int process_item(Item *i) { i->done = true; + prefix = malloc(strlen(i->path) + 1); + if (!prefix) + return log_oom(); + PATH_FOREACH_PREFIX(prefix, i->path) { - Item *j; + ItemArray *j; j = hashmap_get(items, prefix); - if (j) - process_item(j); + if (j) { + int s; + + s = process_item_array(j); + if (s < 0 && t == 0) + t = s; + } } r = arg_create ? create_item(i) : 0; q = arg_remove ? remove_item(i) : 0; p = arg_clean ? clean_item(i) : 0; - if (r < 0) - return r; + return t < 0 ? t : + r < 0 ? r : + q < 0 ? q : + p; +} - if (q < 0) - return q; +static int process_item_array(ItemArray *array) { + unsigned n; + int r = 0, k; - return p; -} + assert(array); -static void item_free(Item *i) { + for (n = 0; n < array->count; n++) { + k = process_item(array->items + n); + if (k < 0 && r == 0) + r = k; + } - if (!i) - return; + return r; +} +static void item_free_contents(Item *i) { + assert(i); free(i->path); free(i->argument); - free(i); + strv_free(i->xattrs); + +#ifdef HAVE_ACL + acl_free(i->acl_access); + acl_free(i->acl_default); +#endif } -DEFINE_TRIVIAL_CLEANUP_FUNC(Item*, item_free); +static void item_array_free(ItemArray *a) { + unsigned n; + + if (!a) + return; -static bool item_equal(Item *a, Item *b) { + for (n = 0; n < a->count; n++) + item_free_contents(a->items + n); + free(a->items); + free(a); +} + +static bool item_compatible(Item *a, Item *b) { assert(a); assert(b); + assert(streq(a->path, b->path)); - if (!streq_ptr(a->path, b->path)) - return false; + if (takes_ownership(a->type) && takes_ownership(b->type)) + /* check if the items are the same */ + return streq_ptr(a->argument, b->argument) && - if (a->type != b->type) - return false; + a->uid_set == b->uid_set && + a->uid == b->uid && - if (a->uid_set != b->uid_set || - (a->uid_set && a->uid != b->uid)) - return false; + a->gid_set == b->gid_set && + a->gid == b->gid && - if (a->gid_set != b->gid_set || - (a->gid_set && a->gid != b->gid)) - return false; + a->mode_set == b->mode_set && + a->mode == b->mode && - if (a->mode_set != b->mode_set || - (a->mode_set && a->mode != b->mode)) - return false; + a->age_set == b->age_set && + a->age == b->age && - if (a->age_set != b->age_set || - (a->age_set && a->age != b->age)) - return false; + a->mask_perms == b->mask_perms && - if ((a->type == CREATE_FILE || - a->type == TRUNCATE_FILE || - a->type == WRITE_FILE || - a->type == CREATE_SYMLINK || - a->type == COPY_FILES) && - !streq_ptr(a->argument, b->argument)) - return false; + a->keep_first_level == b->keep_first_level && - if ((a->type == CREATE_CHAR_DEVICE || - a->type == CREATE_BLOCK_DEVICE) && - a->major_minor != b->major_minor) - return false; + a->major_minor == b->major_minor; return true; } @@ -1171,11 +1355,11 @@ static int parse_line(const char *fname, unsigned line, const char *buffer) { }; _cleanup_free_ char *action = NULL, *mode = NULL, *user = NULL, *group = NULL, *age = NULL, *path = NULL; - _cleanup_(item_freep) Item *i = NULL; - Item *existing; - char type; + _cleanup_(item_free_contents) Item i = {}; + ItemArray *existing; Hashmap *h; - int r, n = -1; + int r, c = -1, pos; + bool force = false, boot = false; assert(fname); assert(line >= 1); @@ -1189,7 +1373,7 @@ static int parse_line(const char *fname, unsigned line, const char *buffer) { &user, &group, &age, - &n); + &c); if (r < 2) { log_error("[%s:%u] Syntax error.", fname, line); return -EIO; @@ -1200,42 +1384,45 @@ static int parse_line(const char *fname, unsigned line, const char *buffer) { return -EINVAL; } - if (strlen(action) > 1 && !in_charset(action+1, "!+")) { - log_error("[%s:%u] Unknown modifiers in command '%s'", fname, line, action); - return -EINVAL; + for (pos = 1; action[pos]; pos++) { + if (action[pos] == '!' && !boot) + boot = true; + else if (action[pos] == '+' && !force) + force = true; + else { + log_error("[%s:%u] Unknown modifiers in command '%s'", + fname, line, action); + return -EINVAL; + } } - if (strchr(action+1, '!') && !arg_boot) + if (boot && !arg_boot) return 0; - type = action[0]; - - i = new0(Item, 1); - if (!i) - return log_oom(); - - i->force = !!strchr(action+1, '+'); + i.type = action[0]; + i.force = force; - r = specifier_printf(path, specifier_table, NULL, &i->path); + r = specifier_printf(path, specifier_table, NULL, &i.path); if (r < 0) { log_error("[%s:%u] Failed to replace specifiers: %s", fname, line, path); return r; } - if (n >= 0) { - n += strspn(buffer+n, WHITESPACE); - if (buffer[n] != 0 && (buffer[n] != '-' || buffer[n+1] != 0)) { - i->argument = unquote(buffer+n, "\""); - if (!i->argument) + if (c >= 0) { + c += strspn(buffer+c, WHITESPACE); + if (buffer[c] != 0 && (buffer[c] != '-' || buffer[c+1] != 0)) { + i.argument = unquote(buffer+c, "\""); + if (!i.argument) return log_oom(); } } - switch (type) { + switch (i.type) { case CREATE_FILE: case TRUNCATE_FILE: case CREATE_DIRECTORY: + case CREATE_SUBVOLUME: case TRUNCATE_DIRECTORY: case CREATE_FIFO: case IGNORE_PATH: @@ -1248,102 +1435,121 @@ static int parse_line(const char *fname, unsigned line, const char *buffer) { break; case CREATE_SYMLINK: - if (!i->argument) { - log_error("[%s:%u] Symlink file requires argument.", fname, line); - return -EBADMSG; + if (!i.argument) { + i.argument = strappend("/usr/share/factory/", i.path); + if (!i.argument) + return log_oom(); } - break; case WRITE_FILE: - if (!i->argument) { + if (!i.argument) { log_error("[%s:%u] Write file requires argument.", fname, line); return -EBADMSG; } break; case COPY_FILES: - if (!i->argument) { - log_error("[%s:%u] Copy files requires argument.", fname, line); - return -EBADMSG; - } - - if (!path_is_absolute(i->argument)) { + if (!i.argument) { + i.argument = strappend("/usr/share/factory/", i.path); + if (!i.argument) + return log_oom(); + } else if (!path_is_absolute(i.argument)) { log_error("[%s:%u] Source path is not absolute.", fname, line); return -EBADMSG; } - path_kill_slashes(i->argument); + path_kill_slashes(i.argument); break; case CREATE_CHAR_DEVICE: case CREATE_BLOCK_DEVICE: { unsigned major, minor; - if (!i->argument) { + if (!i.argument) { log_error("[%s:%u] Device file requires argument.", fname, line); return -EBADMSG; } - if (sscanf(i->argument, "%u:%u", &major, &minor) != 2) { - log_error("[%s:%u] Can't parse device file major/minor '%s'.", fname, line, i->argument); + if (sscanf(i.argument, "%u:%u", &major, &minor) != 2) { + log_error("[%s:%u] Can't parse device file major/minor '%s'.", fname, line, i.argument); return -EBADMSG; } - i->major_minor = makedev(major, minor); + i.major_minor = makedev(major, minor); break; } + case SET_XATTR: + case RECURSIVE_SET_XATTR: + if (!i.argument) { + log_error("[%s:%u] Set extended attribute requires argument.", fname, line); + return -EBADMSG; + } + r = get_xattrs_from_arg(&i); + if (r < 0) + return r; + break; + + case SET_ACL: + case RECURSIVE_SET_ACL: + if (!i.argument) { + log_error("[%s:%u] Set ACLs requires argument.", fname, line); + return -EBADMSG; + } + r = get_acls_from_arg(&i); + if (r < 0) + return r; + break; + default: - log_error("[%s:%u] Unknown command type '%c'.", fname, line, type); + log_error("[%s:%u] Unknown command type '%c'.", fname, line, i.type); return -EBADMSG; } - i->type = type; - - if (!path_is_absolute(i->path)) { - log_error("[%s:%u] Path '%s' not absolute.", fname, line, i->path); + if (!path_is_absolute(i.path)) { + log_error("[%s:%u] Path '%s' not absolute.", fname, line, i.path); return -EBADMSG; } - path_kill_slashes(i->path); + path_kill_slashes(i.path); - if (!should_include_path(i->path)) + if (!should_include_path(i.path)) return 0; if (arg_root) { char *p; - p = strappend(arg_root, i->path); + p = strappend(arg_root, i.path); if (!p) return log_oom(); - free(i->path); - i->path = p; + free(i.path); + i.path = p; } if (user && !streq(user, "-")) { const char *u = user; - r = get_user_creds(&u, &i->uid, NULL, NULL, NULL); + r = get_user_creds(&u, &i.uid, NULL, NULL, NULL); if (r < 0) { log_error("[%s:%u] Unknown user '%s'.", fname, line, user); return r; } - i->uid_set = true; + i.uid_set = true; } if (group && !streq(group, "-")) { const char *g = group; - r = get_group_creds(&g, &i->gid); + r = get_group_creds(&g, &i.gid); if (r < 0) { log_error("[%s:%u] Unknown group '%s'.", fname, line, group); return r; } - i->gid_set = true; + i.gid_set = true; } if (mode && !streq(mode, "-")) { @@ -1351,7 +1557,7 @@ static int parse_line(const char *fname, unsigned line, const char *buffer) { unsigned m; if (*mm == '~') { - i->mask_perms = true; + i.mask_perms = true; mm++; } @@ -1360,54 +1566,55 @@ static int parse_line(const char *fname, unsigned line, const char *buffer) { return -ENOENT; } - i->mode = m; - i->mode_set = true; + i.mode = m; + i.mode_set = true; } else - i->mode = - i->type == CREATE_DIRECTORY || - i->type == TRUNCATE_DIRECTORY ? 0755 : 0644; + i.mode = IN_SET(i.type, CREATE_DIRECTORY, CREATE_SUBVOLUME, TRUNCATE_DIRECTORY) + ? 0755 : 0644; if (age && !streq(age, "-")) { const char *a = age; if (*a == '~') { - i->keep_first_level = true; + i.keep_first_level = true; a++; } - if (parse_sec(a, &i->age) < 0) { + if (parse_sec(a, &i.age) < 0) { log_error("[%s:%u] Invalid age '%s'.", fname, line, age); return -EBADMSG; } - i->age_set = true; + i.age_set = true; } - h = needs_glob(i->type) ? globs : items; + h = needs_glob(i.type) ? globs : items; - existing = hashmap_get(h, i->path); + existing = hashmap_get(h, i.path); if (existing) { + unsigned n; - /* Two identical items are fine */ - if (!item_equal(existing, i)) - log_warning("Two or more conflicting lines for %s configured, ignoring.", i->path); - - return 0; - } - - r = hashmap_put(h, i->path, i); - if (r < 0) { - log_error("Failed to insert item %s: %s", i->path, strerror(-r)); - return r; + for (n = 0; n < existing->count; n++) { + if (!item_compatible(existing->items + n, &i)) + log_warning("[%s:%u] Duplicate line for path \"%s\", ignoring.", + fname, line, i.path); + } + } else { + existing = new0(ItemArray, 1); + r = hashmap_put(h, i.path, existing); + if (r < 0) + return log_oom(); } - i = NULL; /* avoid cleanup */ + if (!GREEDY_REALLOC(existing->items, existing->size, existing->count + 1)) + return log_oom(); + memcpy(existing->items + existing->count++, &i, sizeof(i)); + zero(i); return 0; } -static int help(void) { - +static void help(void) { printf("%s [OPTIONS...] [CONFIGURATION FILE...]\n\n" "Creates, deletes and cleans up volatile and temporary files and directories.\n\n" " -h --help Show this help\n" @@ -1420,8 +1627,6 @@ static int help(void) { " --exclude-prefix=PATH Ignore rules that apply to paths with the specified prefix\n" " --root=PATH Operate on an alternate filesystem root\n", program_invocation_short_name); - - return 0; } static int parse_argv(int argc, char *argv[]) { @@ -1455,12 +1660,13 @@ static int parse_argv(int argc, char *argv[]) { assert(argc >= 0); assert(argv); - while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0) { + while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0) switch (c) { case 'h': - return help(); + help(); + return 0; case ARG_VERSION: puts(PACKAGE_STRING); @@ -1508,7 +1714,6 @@ static int parse_argv(int argc, char *argv[]) { default: assert_not_reached("Unhandled option"); } - } if (!arg_clean && !arg_create && !arg_remove) { log_error("You need to specify at least one of --clean, --create or --remove."); @@ -1533,8 +1738,7 @@ static int read_config_file(const char *fn, bool ignore_enoent) { if (ignore_enoent && r == -ENOENT) return 0; - log_error("Failed to open '%s', ignoring: %s", fn, strerror(-r)); - return r; + return log_error_errno(r, "Failed to open '%s', ignoring: %m", fn); } FOREACH_LINE(line, f, break) { @@ -1561,7 +1765,7 @@ static int read_config_file(const char *fn, bool ignore_enoent) { continue; HASHMAP_FOREACH(j, items, iter) { - if (j->type != CREATE_DIRECTORY && j->type != TRUNCATE_DIRECTORY) + if (j->type != CREATE_DIRECTORY && j->type != TRUNCATE_DIRECTORY && j->type != CREATE_SUBVOLUME) continue; if (path_equal(j->path, i->path)) { @@ -1574,14 +1778,14 @@ static int read_config_file(const char *fn, bool ignore_enoent) { candidate_item = j; } - if (candidate_item) { + if (candidate_item && candidate_item->age_set) { i->age = candidate_item->age; i->age_set = true; } } if (ferror(f)) { - log_error("Failed to read from file %s: %m", fn); + log_error_errno(errno, "Failed to read from file %s: %m", fn); if (r == 0) r = -EIO; } @@ -1591,7 +1795,7 @@ static int read_config_file(const char *fn, bool ignore_enoent) { int main(int argc, char *argv[]) { int r, k; - Item *i; + ItemArray *a; Iterator iterator; r = parse_argv(argc, argv); @@ -1604,10 +1808,10 @@ int main(int argc, char *argv[]) { umask(0022); - label_init(NULL); + mac_selinux_init(NULL); - items = hashmap_new(string_hash_func, string_compare_func); - globs = hashmap_new(string_hash_func, string_compare_func); + items = hashmap_new(&string_hash_ops); + globs = hashmap_new(&string_hash_ops); if (!items || !globs) { r = log_oom(); @@ -1631,7 +1835,7 @@ int main(int argc, char *argv[]) { r = conf_files_list_nulstr(&files, ".conf", arg_root, conf_file_dirs); if (r < 0) { - log_error("Failed to enumerate tmpfiles.d files: %s", strerror(-r)); + log_error_errno(r, "Failed to enumerate tmpfiles.d files: %m"); goto finish; } @@ -1642,18 +1846,24 @@ int main(int argc, char *argv[]) { } } - HASHMAP_FOREACH(i, globs, iterator) - process_item(i); + HASHMAP_FOREACH(a, globs, iterator) { + k = process_item_array(a); + if (k < 0 && r == 0) + r = k; + } - HASHMAP_FOREACH(i, items, iterator) - process_item(i); + HASHMAP_FOREACH(a, items, iterator) { + k = process_item_array(a); + if (k < 0 && r == 0) + r = k; + } finish: - while ((i = hashmap_steal_first(items))) - item_free(i); + while ((a = hashmap_steal_first(items))) + item_array_free(a); - while ((i = hashmap_steal_first(globs))) - item_free(i); + while ((a = hashmap_steal_first(globs))) + item_array_free(a); hashmap_free(items); hashmap_free(globs); @@ -1664,7 +1874,7 @@ finish: set_free_free(unix_sockets); - label_finish(); + mac_selinux_finish(); return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS; }