core: rework how we match mount units against each other

[elogind.git] / src / core / execute.c

diff --git a/src/core/execute.c b/src/core/execute.c
index cbeb0caf262967f58189bcdcf11938b1d5707772..a53ef48ef83305ce231e4112574ea4c5922a63e0 100644 (file)
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -67,8 +67,10 @@
 #include "env-util.h"
 #include "fileio.h"
 #include "unit.h"
+#include "async.h"
 
 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
+#define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
 
 /* This assumes there is a 'tty' group */
 #define TTY_MODE 0620
@@ -758,24 +760,30 @@ static int setup_pam(
          * daemon. We do things this way to ensure that the main PID
          * of the daemon is the one we initially fork()ed. */
 
-        if ((pam_code = pam_start(name, user, &conv, &handle)) != PAM_SUCCESS) {
+        pam_code = pam_start(name, user, &conv, &handle);
+        if (pam_code != PAM_SUCCESS) {
                 handle = NULL;
                 goto fail;
         }
 
-        if (tty)
-                if ((pam_code = pam_set_item(handle, PAM_TTY, tty)) != PAM_SUCCESS)
+        if (tty) {
+                pam_code = pam_set_item(handle, PAM_TTY, tty);
+                if (pam_code != PAM_SUCCESS)
                         goto fail;
+        }
 
-        if ((pam_code = pam_acct_mgmt(handle, PAM_SILENT)) != PAM_SUCCESS)
+        pam_code = pam_acct_mgmt(handle, PAM_SILENT);
+        if (pam_code != PAM_SUCCESS)
                 goto fail;
 
-        if ((pam_code = pam_open_session(handle, PAM_SILENT)) != PAM_SUCCESS)
+        pam_code = pam_open_session(handle, PAM_SILENT);
+        if (pam_code != PAM_SUCCESS)
                 goto fail;
 
         close_session = true;
 
-        if ((!(e = pam_getenvlist(handle)))) {
+        e = pam_getenvlist(handle);
+        if (!e) {
                 pam_code = PAM_BUF_ERR;
                 goto fail;
         }
@@ -789,7 +797,8 @@ static int setup_pam(
 
         parent_pid = getpid();
 
-        if ((pam_pid = fork()) < 0)
+        pam_pid = fork();
+        if (pam_pid < 0)
                 goto fail;
 
         if (pam_pid == 0) {
@@ -840,9 +849,11 @@ static int setup_pam(
                 }
 
                 /* If our parent died we'll end the session */
-                if (getppid() != parent_pid)
-                        if ((pam_code = pam_close_session(handle, PAM_DATA_SILENT)) != PAM_SUCCESS)
+                if (getppid() != parent_pid) {
+                        pam_code = pam_close_session(handle, PAM_DATA_SILENT);
+                        if (pam_code != PAM_SUCCESS)
                                 goto child_finish;
+                }
 
                 r = 0;
 
@@ -977,6 +988,35 @@ static int apply_seccomp(uint32_t *syscall_filter) {
         return 0;
 }
 
+static void do_idle_pipe_dance(int idle_pipe[4]) {
+        assert(idle_pipe);
+
+        if (idle_pipe[1] >= 0)
+                close_nointr_nofail(idle_pipe[1]);
+        if (idle_pipe[2] >= 0)
+                close_nointr_nofail(idle_pipe[2]);
+
+        if (idle_pipe[0] >= 0) {
+                int r;
+
+                r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
+
+                if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
+                        /* Signal systemd that we are bored and want to continue. */
+                        write(idle_pipe[3], "x", 1);
+
+                        /* Wait for systemd to react to the signal above. */
+                        fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
+                }
+
+                close_nointr_nofail(idle_pipe[0]);
+
+        }
+
+        if (idle_pipe[3] >= 0)
+                close_nointr_nofail(idle_pipe[3]);
+}
+
 int exec_spawn(ExecCommand *command,
                char **argv,
                ExecContext *context,
@@ -986,10 +1026,10 @@ int exec_spawn(ExecCommand *command,
                bool apply_chroot,
                bool apply_tty_stdin,
                bool confirm_spawn,
-               CGroupControllerMask cgroup_mask,
+               CGroupControllerMask cgroup_supported,
                const char *cgroup_path,
                const char *unit_id,
-               int idle_pipe[2],
+               int idle_pipe[4],
                pid_t *ret) {
 
         _cleanup_strv_free_ char **files_env = NULL;
@@ -1083,14 +1123,8 @@ int exec_spawn(ExecCommand *command,
                         goto fail_child;
                 }
 
-                if (idle_pipe) {
-                        if (idle_pipe[1] >= 0)
-                                close_nointr_nofail(idle_pipe[1]);
-                        if (idle_pipe[0] >= 0) {
-                                fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
-                                close_nointr_nofail(idle_pipe[0]);
-                        }
-                }
+                if (idle_pipe)
+                        do_idle_pipe_dance(idle_pipe);
 
                 /* Close sockets very early to make sure we don't
                  * block init reexecution because it cannot bind its
@@ -1173,7 +1207,7 @@ int exec_spawn(ExecCommand *command,
                 }
 
                 if (cgroup_path) {
-                        err = cg_attach_with_mask(cgroup_mask, cgroup_path, 0);
+                        err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
                         if (err < 0) {
                                 r = EXIT_CGROUP;
                                 goto fail_child;
@@ -1258,6 +1292,23 @@ int exec_spawn(ExecCommand *command,
                         }
                 }
 
+#ifdef HAVE_PAM
+                if (cgroup_path && context->user && context->pam_name) {
+                        err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
+                        if (err < 0) {
+                                r = EXIT_CGROUP;
+                                goto fail_child;
+                        }
+
+
+                        err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
+                        if (err < 0) {
+                                r = EXIT_CGROUP;
+                                goto fail_child;
+                        }
+                }
+#endif
+
                 if (apply_permissions) {
                         err = enforce_groups(context, username, gid);
                         if (err < 0) {
@@ -1540,6 +1591,28 @@ void exec_context_init(ExecContext *c) {
         c->timer_slack_nsec = (nsec_t) -1;
 }
 
+static void *remove_tmpdir_thread(void *p) {
+        int r;
+        _cleanup_free_ char *dirp = p;
+        char *dir;
+
+        assert(dirp);
+
+        r = rm_rf_dangerous(dirp, false, true, false);
+        dir = dirname(dirp);
+        if (r < 0)
+                log_warning("Failed to remove content of temporary directory %s: %s",
+                            dir, strerror(-r));
+        else {
+                r = rmdir(dir);
+                if (r < 0)
+                        log_warning("Failed to remove temporary directory %s: %s",
+                                    dir, strerror(-r));
+        }
+
+        return NULL;
+}
+
 void exec_context_tmp_dirs_done(ExecContext *c) {
         char* dirs[] = {c->tmp_dir ? c->tmp_dir : c->var_tmp_dir,
                         c->tmp_dir ? c->var_tmp_dir : NULL,
@@ -1547,22 +1620,8 @@ void exec_context_tmp_dirs_done(ExecContext *c) {
         char **dirp;
 
         for(dirp = dirs; *dirp; dirp++) {
-                char *dir;
-                int r;
-
-                r = rm_rf_dangerous(*dirp, false, true, false);
-                dir = dirname(*dirp);
-                if (r < 0)
-                        log_warning("Failed to remove content of temporary directory %s: %s",
-                                    dir, strerror(-r));
-                else {
-                        r = rmdir(dir);
-                        if (r < 0)
-                                log_warning("Failed to remove  temporary directory %s: %s",
-                                            dir, strerror(-r));
-                }
-
-                free(*dirp);
+                log_debug("Spawning thread to nuke %s", *dirp);
+                asynchronous_job(remove_tmpdir_thread, *dirp);
         }
 
         c->tmp_dir = c->var_tmp_dir = NULL;