nspawn, machine-id-setup: warn if read-only mount call fails

[elogind.git] / src / core / execute.c

diff --git a/src/core/execute.c b/src/core/execute.c
index bc876a32920270febcd25a4c66c0cef3e9f8d2ef..85edca17e331201167d96742d3abe32825878fa7 100644 (file)
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -671,9 +671,9 @@ static int enforce_user(const ExecContext *context, uid_t uid) {
 
                 /* First step: If we need to keep capabilities but
                  * drop privileges we need to make sure we keep our
-                 * caps, whiel we drop privileges. */
+                 * caps, while we drop privileges. */
                 if (uid != 0) {
-                        int sb = context->secure_bits|SECURE_KEEP_CAPS;
+                        int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 
                         if (prctl(PR_GET_SECUREBITS) != sb)
                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
@@ -1559,10 +1559,19 @@ void exec_context_tmp_dirs_done(ExecContext *c) {
 
         for(dirp = dirs; *dirp; dirp++) {
                 char *dir;
-                rm_rf_dangerous(*dirp, false, true, false);
+                int r;
 
+                r = rm_rf_dangerous(*dirp, false, true, false);
                 dir = dirname(*dirp);
-                rmdir(dir);
+                if (r < 0)
+                        log_warning("Failed to remove content of temporary directory %s: %s",
+                                    dir, strerror(-r));
+                else {
+                        r = rmdir(dir);
+                        if (r < 0)
+                                log_warning("Failed to remove  temporary directory %s: %s",
+                                            dir, strerror(-r));
+                }
 
                 free(*dirp);
         }
@@ -1954,12 +1963,12 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
         if (c->secure_bits)
                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
                         prefix,
-                        (c->secure_bits & SECURE_KEEP_CAPS) ? " keep-caps" : "",
-                        (c->secure_bits & SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
-                        (c->secure_bits & SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
-                        (c->secure_bits & SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
-                        (c->secure_bits & SECURE_NOROOT) ? " noroot" : "",
-                        (c->secure_bits & SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
+                        (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
+                        (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
+                        (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
+                        (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
+                        (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
+                        (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
 
         if (c->capability_bounding_set_drop) {
                 unsigned long l;