1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
4 This file is part of systemd.
6 Copyright 2010 Lennart Poettering
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
26 #include <sys/capability.h>
29 #include <selinux/selinux.h>
33 #include "condition.h"
36 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
39 assert(type < _CONDITION_TYPE_MAX);
41 c = new0(Condition, 1);
50 c->parameter = strdup(parameter);
60 void condition_free(Condition *c) {
67 void condition_free_list(Condition *first) {
70 LIST_FOREACH_SAFE(conditions, c, n, first)
74 static bool test_kernel_command_line(const char *parameter) {
75 char *line, *w, *state, *word = NULL;
83 if (detect_container(NULL) > 0)
86 r = read_one_line_file("/proc/cmdline", &line);
88 log_warning("Failed to read /proc/cmdline, ignoring: %s", strerror(-r));
92 equal = !!strchr(parameter, '=');
93 pl = strlen(parameter);
95 FOREACH_WORD_QUOTED(w, l, line, state) {
103 if (streq(word, parameter)) {
108 if (startswith(word, parameter) && (word[pl] == '=' || word[pl] == 0)) {
122 static bool test_virtualization(const char *parameter) {
129 v = detect_virtualization(&id);
131 log_warning("Failed to detect virtualization, ignoring: %s", strerror(-v));
135 /* First, compare with yes/no */
136 b = parse_boolean(parameter);
141 if (v == 0 && b == 0)
144 /* Then, compare categorization */
145 if (v == VIRTUALIZATION_VM && streq(parameter, "vm"))
148 if (v == VIRTUALIZATION_CONTAINER && streq(parameter, "container"))
151 /* Finally compare id */
152 return v > 0 && streq(parameter, id);
155 static bool test_security(const char *parameter) {
157 if (streq(parameter, "selinux"))
158 return is_selinux_enabled() > 0;
163 static bool test_capability(const char *parameter) {
167 unsigned long long capabilities = (unsigned long long) -1;
169 /* If it's an invalid capability, we don't have it */
171 if (cap_from_name(parameter, &value) < 0)
174 /* If it's a valid capability we default to assume
177 f = fopen("/proc/self/status", "re");
181 while (fgets(line, sizeof(line), f)) {
184 if (startswith(line, "CapBnd:")) {
185 (void) sscanf(line+7, "%llx", &capabilities);
190 return !!(capabilities & (1ULL << value));
193 bool condition_test(Condition *c) {
198 case CONDITION_PATH_EXISTS:
199 return (access(c->parameter, F_OK) >= 0) == !c->negate;
201 case CONDITION_PATH_EXISTS_GLOB:
202 return (glob_exists(c->parameter) > 0) == !c->negate;
204 case CONDITION_PATH_IS_DIRECTORY: {
207 if (stat(c->parameter, &st) < 0)
209 return S_ISDIR(st.st_mode) == !c->negate;
212 case CONDITION_PATH_IS_SYMBOLIC_LINK: {
215 if (lstat(c->parameter, &st) < 0)
217 return S_ISLNK(st.st_mode) == !c->negate;
220 case CONDITION_PATH_IS_MOUNT_POINT:
221 return (path_is_mount_point(c->parameter, true) > 0) == !c->negate;
223 case CONDITION_DIRECTORY_NOT_EMPTY: {
226 k = dir_is_empty(c->parameter);
227 return !(k == -ENOENT || k > 0) == !c->negate;
230 case CONDITION_FILE_IS_EXECUTABLE: {
233 if (stat(c->parameter, &st) < 0)
236 return (S_ISREG(st.st_mode) && (st.st_mode & 0111)) == !c->negate;
239 case CONDITION_KERNEL_COMMAND_LINE:
240 return test_kernel_command_line(c->parameter) == !c->negate;
242 case CONDITION_VIRTUALIZATION:
243 return test_virtualization(c->parameter) == !c->negate;
245 case CONDITION_SECURITY:
246 return test_security(c->parameter) == !c->negate;
248 case CONDITION_CAPABILITY:
249 return test_capability(c->parameter) == !c->negate;
255 assert_not_reached("Invalid condition type.");
259 bool condition_test_list(Condition *first) {
263 /* If the condition list is empty, then it is true */
267 /* Otherwise, if all of the non-trigger conditions apply and
268 * if any of the trigger conditions apply (unless there are
269 * none) we return true */
270 LIST_FOREACH(conditions, c, first) {
273 b = condition_test(c);
275 if (!c->trigger && !b)
278 if (c->trigger && triggered <= 0)
282 return triggered != 0;
285 void condition_dump(Condition *c, FILE *f, const char *prefix) {
295 condition_type_to_string(c->type),
296 c->trigger ? "|" : "",
297 c->negate ? "!" : "",
301 void condition_dump_list(Condition *first, FILE *f, const char *prefix) {
304 LIST_FOREACH(conditions, c, first)
305 condition_dump(c, f, prefix);
308 static const char* const condition_type_table[_CONDITION_TYPE_MAX] = {
309 [CONDITION_PATH_EXISTS] = "ConditionPathExists",
310 [CONDITION_PATH_EXISTS_GLOB] = "ConditionPathExistsGlob",
311 [CONDITION_PATH_IS_DIRECTORY] = "ConditionPathIsDirectory",
312 [CONDITION_PATH_IS_SYMBOLIC_LINK] = "ConditionPathIsSymbolicLink",
313 [CONDITION_PATH_IS_MOUNT_POINT] = "ConditionPathIsMountPoint",
314 [CONDITION_DIRECTORY_NOT_EMPTY] = "ConditionDirectoryNotEmpty",
315 [CONDITION_KERNEL_COMMAND_LINE] = "ConditionKernelCommandLine",
316 [CONDITION_VIRTUALIZATION] = "ConditionVirtualization",
317 [CONDITION_SECURITY] = "ConditionSecurity",
318 [CONDITION_NULL] = "ConditionNull"
321 DEFINE_STRING_TABLE_LOOKUP(condition_type, ConditionType);