1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
4 This file is part of systemd.
6 Copyright 2011 Lennart Poettering
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
11 (at your option) any later version.
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Lesser General Public License for more details.
18 You should have received a copy of the GNU Lesser General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 #include <sys/epoll.h>
26 #include "socket-util.h"
27 #include "path-util.h"
28 #include "selinux-util.h"
29 #include "journald-server.h"
30 #include "journald-native.h"
31 #include "journald-kmsg.h"
32 #include "journald-console.h"
33 #include "journald-syslog.h"
34 #include "journald-wall.h"
36 bool valid_user_field(const char *p, size_t l, bool allow_protected) {
39 /* We kinda enforce POSIX syntax recommendations for
40 environment variables here, but make a couple of additional
43 http://pubs.opengroup.org/onlinepubs/000095399/basedefs/xbd_chap08.html */
45 /* No empty field names */
49 /* Don't allow names longer than 64 chars */
53 /* Variables starting with an underscore are protected */
54 if (!allow_protected && p[0] == '_')
57 /* Don't allow digits as first character */
58 if (p[0] >= '0' && p[0] <= '9')
61 /* Only allow A-Z0-9 and '_' */
62 for (a = p; a < p + l; a++)
63 if ((*a < 'A' || *a > 'Z') &&
64 (*a < '0' || *a > '9') &&
71 static bool allow_object_pid(struct ucred *ucred) {
72 return ucred && ucred->uid == 0;
75 void server_process_native_message(
77 const void *buffer, size_t buffer_size,
80 const char *label, size_t label_len) {
82 struct iovec *iovec = NULL;
83 unsigned n = 0, j, tn = (unsigned) -1;
85 size_t remaining, m = 0, entry_size = 0;
86 int priority = LOG_INFO;
87 char *identifier = NULL, *message = NULL;
91 assert(buffer || buffer_size == 0);
94 remaining = buffer_size;
96 while (remaining > 0) {
99 e = memchr(p, '\n', remaining);
102 /* Trailing noise, let's ignore it, and flush what we collected */
103 log_debug("Received message with trailing noise, ignoring.");
108 /* Entry separator */
110 if (entry_size + n + 1 > ENTRY_SIZE_MAX) { /* data + separators + trailer */
111 log_debug("Entry is too big with %u properties and %zu bytes, ignoring.",
116 server_dispatch_message(s, iovec, n, m, ucred, tv, label, label_len, NULL, priority, object_pid);
126 if (*p == '.' || *p == '#') {
127 /* Ignore control commands for now, and
129 remaining -= (e - p) + 1;
134 /* A property follows */
136 /* n received properties, +1 for _TRANSPORT */
137 if (!GREEDY_REALLOC(iovec, m, n + 1 + N_IOVEC_META_FIELDS +
138 !!object_pid * N_IOVEC_OBJECT_FIELDS)) {
143 q = memchr(p, '=', e - p);
145 if (valid_user_field(p, q - p, false)) {
150 /* If the field name starts with an
151 * underscore, skip the variable,
152 * since that indidates a trusted
154 iovec[n].iov_base = (char*) p;
155 iovec[n].iov_len = l;
157 entry_size += iovec[n].iov_len;
159 /* We need to determine the priority
160 * of this entry for the rate limiting
163 startswith(p, "PRIORITY=") &&
164 p[9] >= '0' && p[9] <= '9')
165 priority = (priority & LOG_FACMASK) | (p[9] - '0');
168 startswith(p, "SYSLOG_FACILITY=") &&
169 p[16] >= '0' && p[16] <= '9')
170 priority = (priority & LOG_PRIMASK) | ((p[16] - '0') << 3);
173 startswith(p, "SYSLOG_FACILITY=") &&
174 p[16] >= '0' && p[16] <= '9' &&
175 p[17] >= '0' && p[17] <= '9')
176 priority = (priority & LOG_PRIMASK) | (((p[16] - '0')*10 + (p[17] - '0')) << 3);
179 startswith(p, "SYSLOG_IDENTIFIER=")) {
182 t = strndup(p + 18, l - 18);
188 startswith(p, "MESSAGE=")) {
191 t = strndup(p + 8, l - 8);
196 } else if (l > strlen("OBJECT_PID=") &&
197 l < strlen("OBJECT_PID=") + DECIMAL_STR_MAX(pid_t) &&
198 startswith(p, "OBJECT_PID=") &&
199 allow_object_pid(ucred)) {
200 char buf[DECIMAL_STR_MAX(pid_t)];
201 memcpy(buf, p + strlen("OBJECT_PID="), l - strlen("OBJECT_PID="));
205 parse_pid(buf, &object_pid);
209 remaining -= (e - p) + 1;
217 if (remaining < e - p + 1 + sizeof(uint64_t) + 1) {
218 log_debug("Failed to parse message, ignoring.");
222 memcpy(&l_le, e + 1, sizeof(uint64_t));
225 if (l > DATA_SIZE_MAX) {
226 log_debug("Received binary data block of %zu bytes is too large, ignoring.", l);
230 if ((uint64_t) remaining < e - p + 1 + sizeof(uint64_t) + l + 1 ||
231 e[1+sizeof(uint64_t)+l] != '\n') {
232 log_debug("Failed to parse message, ignoring.");
236 k = malloc((e - p) + 1 + l);
244 memcpy(k + (e - p) + 1, e + 1 + sizeof(uint64_t), l);
246 if (valid_user_field(p, e - p, false)) {
247 iovec[n].iov_base = k;
248 iovec[n].iov_len = (e - p) + 1 + l;
250 entry_size += iovec[n].iov_len;
254 remaining -= (e - p) + 1 + sizeof(uint64_t) + l + 1;
255 p = e + 1 + sizeof(uint64_t) + l + 1;
263 IOVEC_SET_STRING(iovec[tn], "_TRANSPORT=journal");
264 entry_size += strlen("_TRANSPORT=journal");
266 if (entry_size + n + 1 > ENTRY_SIZE_MAX) { /* data + separators + trailer */
267 log_debug("Entry is too big with %u properties and %zu bytes, ignoring.",
273 if (s->forward_to_syslog)
274 server_forward_syslog(s, priority, identifier, message, ucred, tv);
276 if (s->forward_to_kmsg)
277 server_forward_kmsg(s, priority, identifier, message, ucred);
279 if (s->forward_to_console)
280 server_forward_console(s, priority, identifier, message, ucred);
282 if (s->forward_to_wall)
283 server_forward_wall(s, priority, identifier, message, ucred);
286 server_dispatch_message(s, iovec, n, m, ucred, tv, label, label_len, NULL, priority, object_pid);
289 for (j = 0; j < n; j++) {
293 if (iovec[j].iov_base < buffer ||
294 (const uint8_t*) iovec[j].iov_base >= (const uint8_t*) buffer + buffer_size)
295 free(iovec[j].iov_base);
303 void server_process_native_file(
308 const char *label, size_t label_len) {
311 _cleanup_free_ void *p = NULL;
318 if (!ucred || ucred->uid != 0) {
319 _cleanup_free_ char *sl = NULL, *k = NULL;
322 if (asprintf(&sl, "/proc/self/fd/%i", fd) < 0) {
327 r = readlink_malloc(sl, &k);
329 log_error("readlink(%s) failed: %m", sl);
333 e = path_startswith(k, "/dev/shm/");
335 e = path_startswith(k, "/tmp/");
337 e = path_startswith(k, "/var/tmp/");
339 log_error("Received file outside of allowed directories. Refusing.");
343 if (!filename_is_safe(e)) {
344 log_error("Received file in subdirectory of allowed directories. Refusing.");
349 /* Data is in the passed file, since it didn't fit in a
350 * datagram. We can't map the file here, since clients might
351 * then truncate it and trigger a SIGBUS for us. So let's
352 * stupidly read it */
354 if (fstat(fd, &st) < 0) {
355 log_error("Failed to stat passed file, ignoring: %m");
359 if (!S_ISREG(st.st_mode)) {
360 log_error("File passed is not regular. Ignoring.");
367 if (st.st_size > ENTRY_SIZE_MAX) {
368 log_error("File passed too large. Ignoring.");
372 p = malloc(st.st_size);
378 n = pread(fd, p, st.st_size, 0);
380 log_error("Failed to read file, ignoring: %s", strerror(-n));
382 server_process_native_message(s, p, n, ucred, tv, label, label_len);
385 int server_open_native_socket(Server*s) {
386 union sockaddr_union sa;
391 if (s->native_fd < 0) {
393 s->native_fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
394 if (s->native_fd < 0) {
395 log_error("socket() failed: %m");
400 sa.un.sun_family = AF_UNIX;
401 strncpy(sa.un.sun_path, "/run/systemd/journal/socket", sizeof(sa.un.sun_path));
403 unlink(sa.un.sun_path);
405 r = bind(s->native_fd, &sa.sa, offsetof(union sockaddr_union, un.sun_path) + strlen(sa.un.sun_path));
407 log_error("bind() failed: %m");
411 chmod(sa.un.sun_path, 0666);
413 fd_nonblock(s->native_fd, 1);
416 r = setsockopt(s->native_fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one));
418 log_error("SO_PASSCRED failed: %m");
425 r = setsockopt(s->native_fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one));
427 log_warning("SO_PASSSEC failed: %m");
432 r = setsockopt(s->native_fd, SOL_SOCKET, SO_TIMESTAMP, &one, sizeof(one));
434 log_error("SO_TIMESTAMP failed: %m");
438 r = sd_event_add_io(s->event, &s->native_event_source, s->native_fd, EPOLLIN, process_datagram, s);
440 log_error("Failed to add native server fd to event loop: %s", strerror(-r));