conf-parser: restrict .include usage

Disallow recursive .include, and make it unavailable in anything but
unit files.

diff --git a/TODO b/TODO
index cfd42ce745b1755d33839fda5f8d853ae41dad89..3133ec7bdb9ca0d70bc2487365298bf6b27c6841 100644 (file)
--- a/TODO
+++ b/TODO
@@ -100,10 +100,6 @@ Features:
      /lib/modules/$(uname -r)/modules.devname
   and apply ACLs to them if they have TAG=="uaccess" in udev rules.
 
      /lib/modules/$(uname -r)/modules.devname
   and apply ACLs to them if they have TAG=="uaccess" in udev rules.
 

-* matching against units is currently broken in journalctl. We really
-  need another AND level in the expressions,
-  i.e. sd_journal_add_conjunction().
-

 * add ConditionArchitecture= or so
 
 * teach ConditionKernelCommandLine= globs or regexes (in order to match foobar={no,0,off})
 * add ConditionArchitecture= or so
 
 * teach ConditionKernelCommandLine= globs or regexes (in order to match foobar={no,0,off})


@@ -125,8 +121,6 @@ Features:
 
 * man: remove .include documentation, and instead push people to use .d/*.conf
 
 
 * man: remove .include documentation, and instead push people to use .d/*.conf
 

-* disallow .include from included files
-

 * safe_atod() is too naive, as it is vulnerable to locale parameters, should be locale independent.
 
 * think about requeuing jobs when daemon-reload is issued? usecase:
 * safe_atod() is too naive, as it is vulnerable to locale parameters, should be locale independent.
 
 * think about requeuing jobs when daemon-reload is issued? usecase:

diff --git a/src/bootchart/bootchart.c b/src/bootchart/bootchart.c
index 002f3df8b62059dc92aacccf04a8289d980c5acd..b73319123fffbe6e53d1a0e7af5299d2d86965bc 100644 (file)
--- a/src/bootchart/bootchart.c
+++ b/src/bootchart/bootchart.c
@@ -124,7 +124,7 @@ static void parse_conf(void) {
                 return;
 
         r = config_parse(NULL, BOOTCHART_CONF, f,
                 return;
 
         r = config_parse(NULL, BOOTCHART_CONF, f,

-                         NULL, config_item_table_lookup, (void*) items, true, NULL);
+                         NULL, config_item_table_lookup, (void*) items, true, false, NULL);

         if (r < 0)
                 log_warning("Failed to parse configuration file: %s", strerror(-r));
 
         if (r < 0)
                 log_warning("Failed to parse configuration file: %s", strerror(-r));
 

diff --git a/src/core/load-dropin.c b/src/core/load-dropin.c
index 67774d5238a0ecc0b55d2c96c83e811b6f5d9402..0318296f1fce4d2e296647c47d0c8a411befff53 100644 (file)
--- a/src/core/load-dropin.c
+++ b/src/core/load-dropin.c
@@ -200,7 +200,7 @@ int unit_load_dropin(Unit *u) {
         STRV_FOREACH(f, u->dropin_paths) {
                 r = config_parse(u->id, *f, NULL,
                                  UNIT_VTABLE(u)->sections, config_item_perf_lookup,
         STRV_FOREACH(f, u->dropin_paths) {
                 r = config_parse(u->id, *f, NULL,
                                  UNIT_VTABLE(u)->sections, config_item_perf_lookup,

-                                 (void*) load_fragment_gperf_lookup, false, u);
+                                 (void*) load_fragment_gperf_lookup, false, false, u);

                 if (r < 0)
                         return r;
         }
                 if (r < 0)
                         return r;
         }

diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
index 3d23372630bd9da0556a4ff1e5e97c7f8ec06953..e2015ed58f4699585ec9e0f1cf075c2b9045dad9 100644 (file)
--- a/src/core/load-fragment.c
+++ b/src/core/load-fragment.c
@@ -2270,7 +2270,7 @@ static int load_from_path(Unit *u, const char *path) {
                 /* Now, parse the file contents */
                 r = config_parse(u->id, filename, f, UNIT_VTABLE(u)->sections,
                                  config_item_perf_lookup,
                 /* Now, parse the file contents */
                 r = config_parse(u->id, filename, f, UNIT_VTABLE(u)->sections,
                                  config_item_perf_lookup,

-                                 (void*) load_fragment_gperf_lookup, false, u);
+                                 (void*) load_fragment_gperf_lookup, false, true, u);

                 if (r < 0)
                         goto finish;
 
                 if (r < 0)
                         goto finish;
 

diff --git a/src/core/main.c b/src/core/main.c
index ab2ac00d7636906ec95ecc6bd4c4aeed9812e5d5..695e232514bca043a5b4072620474fe0b7331159 100644 (file)
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -677,7 +677,7 @@ static int parse_config_file(void) {
                 return 0;
         }
 
                 return 0;
         }
 

-        r = config_parse(NULL, fn, f, "Manager\0", config_item_table_lookup, (void*) items, false, NULL);
+        r = config_parse(NULL, fn, f, "Manager\0", config_item_table_lookup, (void*) items, false, false, NULL);

         if (r < 0)
                 log_warning("Failed to parse configuration file: %s", strerror(-r));
 
         if (r < 0)
                 log_warning("Failed to parse configuration file: %s", strerror(-r));
 

diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
index 8eab5ad677a0a0d640cfd75fec086766b7a50ffb..1b5a22b122ae1eab6b14673f6a234808f30fe1d8 100644 (file)
--- a/src/journal/journald-server.c
+++ b/src/journal/journald-server.c
@@ -1271,7 +1271,7 @@ static int server_parse_proc_cmdline(Server *s) {
 }
 
 static int server_parse_config_file(Server *s) {
 }
 
 static int server_parse_config_file(Server *s) {

-        static const char *fn = "/etc/systemd/journald.conf";
+        static const char fn[] = "/etc/systemd/journald.conf";

         _cleanup_fclose_ FILE *f = NULL;
         int r;
 
         _cleanup_fclose_ FILE *f = NULL;
         int r;
 


@@ -1287,7 +1287,7 @@ static int server_parse_config_file(Server *s) {
         }
 
         r = config_parse(NULL, fn, f, "Journal\0", config_item_perf_lookup,
         }
 
         r = config_parse(NULL, fn, f, "Journal\0", config_item_perf_lookup,

-                         (void*) journald_gperf_lookup, false, s);
+                         (void*) journald_gperf_lookup, false, false, s);

         if (r < 0)
                 log_warning("Failed to parse configuration file: %s", strerror(-r));
 
         if (r < 0)
                 log_warning("Failed to parse configuration file: %s", strerror(-r));
 

diff --git a/src/login/logind.c b/src/login/logind.c
index 536612cbd258c6430bb0af3b4fdba470720fbdb8..5a394401dc414e5b09806982b80ca827ad814739 100644 (file)
--- a/src/login/logind.c
+++ b/src/login/logind.c
@@ -1683,13 +1683,12 @@ int manager_run(Manager *m) {
 }
 
 static int manager_parse_config_file(Manager *m) {
 }
 
 static int manager_parse_config_file(Manager *m) {

-        FILE *f;
-        const char *fn;
+        static const char fn[] = "/etc/systemd/logind.conf";
+        _cleanup_fclose_ FILE *f = NULL;

         int r;
 
         assert(m);
 
         int r;
 
         assert(m);
 

-        fn = "/etc/systemd/logind.conf";

         f = fopen(fn, "re");
         if (!f) {
                 if (errno == ENOENT)
         f = fopen(fn, "re");
         if (!f) {
                 if (errno == ENOENT)


@@ -1699,12 +1698,11 @@ static int manager_parse_config_file(Manager *m) {
                 return -errno;
         }
 
                 return -errno;
         }
 

-        r = config_parse(NULL, fn, f, "Login\0", config_item_perf_lookup, (void*) logind_gperf_lookup, false, m);
+        r = config_parse(NULL, fn, f, "Login\0", config_item_perf_lookup,
+                         (void*) logind_gperf_lookup, false, false, m);

         if (r < 0)
                 log_warning("Failed to parse configuration file: %s", strerror(-r));
 
         if (r < 0)
                 log_warning("Failed to parse configuration file: %s", strerror(-r));
 

-        fclose(f);
-

         return r;
 }
 
         return r;
 }
 

diff --git a/src/shared/conf-parser.c b/src/shared/conf-parser.c
index 3d14c58d1386718b49fe2ebc8de2d99571452fe3..2303d9a50b7bb348bba6f2631f0708d40a02022b 100644 (file)
--- a/src/shared/conf-parser.c
+++ b/src/shared/conf-parser.c
@@ -70,7 +70,7 @@ int log_syntax_internal(const char *unit, int level,
                                         "ERRNO=%d", error > 0 ? error : EINVAL,
                                         "MESSAGE=[%s:%u] %s", config_file, config_line, msg,
                                         NULL);
                                         "ERRNO=%d", error > 0 ? error : EINVAL,
                                         "MESSAGE=[%s:%u] %s", config_file, config_line, msg,
                                         NULL);

-        log_info("logged here: '%s': %d", msg, r);
+

         return r;
 }
 
         return r;
 }
 


@@ -199,6 +199,7 @@ static int parse_line(const char* unit,
                       ConfigItemLookup lookup,
                       void *table,
                       bool relaxed,
                       ConfigItemLookup lookup,
                       void *table,
                       bool relaxed,

+                      bool allow_include,

                       char **section,
                       char *l,
                       void *userdata) {
                       char **section,
                       char *l,
                       void *userdata) {


@@ -219,13 +220,19 @@ static int parse_line(const char* unit,
                 return 0;
 
         if (startswith(l, ".include ")) {
                 return 0;
 
         if (startswith(l, ".include ")) {

-                _cleanup_free_ char *fn;
+                _cleanup_free_ char *fn = NULL;
+
+                if (!allow_include) {
+                        log_syntax(unit, LOG_ERR, filename, line, EBADMSG,
+                                   ".include not allowed here. Ignoring.");
+                        return 0;
+                }

 
                 fn = file_in_same_dir(filename, strstrip(l+9));
                 if (!fn)
                         return -ENOMEM;
 
 
                 fn = file_in_same_dir(filename, strstrip(l+9));
                 if (!fn)
                         return -ENOMEM;
 

-                return config_parse(unit, fn, NULL, sections, lookup, table, relaxed, userdata);
+                return config_parse(unit, fn, NULL, sections, lookup, table, relaxed, false, userdata);

         }
 
         if (*l == '[') {
         }
 
         if (*l == '[') {


@@ -299,11 +306,12 @@ int config_parse(const char *unit,
                  ConfigItemLookup lookup,
                  void *table,
                  bool relaxed,
                  ConfigItemLookup lookup,
                  void *table,
                  bool relaxed,

+                 bool allow_include,

                  void *userdata) {
 
                  void *userdata) {
 

-        unsigned line = 0;

         _cleanup_free_ char *section = NULL, *continuation = NULL;
         _cleanup_fclose_ FILE *ours = NULL;
         _cleanup_free_ char *section = NULL, *continuation = NULL;
         _cleanup_fclose_ FILE *ours = NULL;

+        unsigned line = 0;

         int r;
 
         assert(filename);
         int r;
 
         assert(filename);


@@ -370,6 +378,7 @@ int config_parse(const char *unit,
                                lookup,
                                table,
                                relaxed,
                                lookup,
                                table,
                                relaxed,

+                               allow_include,

                                &section,
                                p,
                                userdata);
                                &section,
                                p,
                                userdata);

diff --git a/src/shared/conf-parser.h b/src/shared/conf-parser.h
index 9ea84e652b47b44e70fecbfaf2ccb8743106cb4c..08428a514a9ade97b65ce839ccbb6750b21414df 100644 (file)
--- a/src/shared/conf-parser.h
+++ b/src/shared/conf-parser.h
@@ -87,6 +87,7 @@ int config_parse(const char *unit,
                  ConfigItemLookup lookup,
                  void *table,
                  bool relaxed,
                  ConfigItemLookup lookup,
                  void *table,
                  bool relaxed,

+                 bool allow_include,

                  void *userdata);
 
 /* Generic parsers */
                  void *userdata);
 
 /* Generic parsers */

diff --git a/src/shared/install.c b/src/shared/install.c
index b22019d7b5ddcb24ca9a7967c9280de2d9fa2444..edf4d2a9fe979b8dbc4c7e09e05938a6655dea20 100644 (file)
--- a/src/shared/install.c
+++ b/src/shared/install.c
@@ -1015,7 +1015,7 @@ static int unit_file_load(
         }
 
         r = config_parse(NULL, path, f, NULL,
         }
 
         r = config_parse(NULL, path, f, NULL,

-                         config_item_table_lookup, (void*) items, true, info);
+                         config_item_table_lookup, (void*) items, true, true, info);

         if (r < 0)
                 return r;
 
         if (r < 0)
                 return r;
 

diff --git a/src/tty-ask-password-agent/tty-ask-password-agent.c b/src/tty-ask-password-agent/tty-ask-password-agent.c
index 6888a64d4d5443493e013997aac82b2f508db2b5..f463662d6b2f4e948e8d4b5a6728683d37ac9286 100644 (file)
--- a/src/tty-ask-password-agent/tty-ask-password-agent.c
+++ b/src/tty-ask-password-agent/tty-ask-password-agent.c
@@ -275,7 +275,7 @@ static int parse_password(const char *filename, char **wall) {
                 return -errno;
         }
 
                 return -errno;
         }
 

-        r = config_parse(NULL, filename, f, NULL, config_item_table_lookup, (void*) items, true, NULL);
+        r = config_parse(NULL, filename, f, NULL, config_item_table_lookup, (void*) items, true, false, NULL);

         if (r < 0) {
                 log_error("Failed to parse password file %s: %s", filename, strerror(-r));
                 goto finish;
         if (r < 0) {
                 log_error("Failed to parse password file %s: %s", filename, strerror(-r));
                 goto finish;