#include <signal.h>
#include <arpa/inet.h>
#include <mqueue.h>
+#include <attr/xattr.h>
#include "unit.h"
#include "socket.h"
#include "mkdir.h"
#include "path-util.h"
#include "unit-name.h"
+#include "unit-printf.h"
#include "dbus-socket.h"
#include "missing.h"
#include "special.h"
exec_context_init(&s->exec_context);
s->exec_context.std_output = u->manager->default_std_output;
s->exec_context.std_error = u->manager->default_std_error;
+ kill_context_init(&s->kill_context);
s->control_command_id = _SOCKET_EXEC_COMMAND_INVALID;
}
free(s->bind_to_device);
s->bind_to_device = NULL;
+ free(s->smack);
+ free(s->smack_ip_in);
+ free(s->smack_ip_out);
+
unit_unwatch_timer(u, &s->timer_watch);
}
return -EINVAL;
}
- if (s->exec_context.pam_name && s->exec_context.kill_mode != KILL_CONTROL_GROUP) {
+ if (s->exec_context.pam_name && s->kill_context.kill_mode != KILL_CONTROL_GROUP) {
log_error("%s has PAM enabled. Kill mode must be set to 'control-group'. Refusing.", UNIT(s)->id);
return -EINVAL;
}
if (!socket_needs_mount(s, m->where))
return 0;
- if ((r = unit_add_two_dependencies(UNIT(s), UNIT_AFTER, UNIT_REQUIRES, UNIT(m), true)) < 0)
+ r = unit_add_two_dependencies(UNIT(s), UNIT_AFTER, UNIT_REQUIRES, UNIT(m), true);
+ if (r < 0)
return r;
return 0;
assert(s);
- LIST_FOREACH(units_by_type, other, UNIT(s)->manager->units_by_type[UNIT_MOUNT])
- if ((r = socket_add_one_mount_link(s, MOUNT(other))) < 0)
+ LIST_FOREACH(units_by_type, other, UNIT(s)->manager->units_by_type[UNIT_MOUNT]) {
+ r = socket_add_one_mount_link(s, MOUNT(other));
+ if (r < 0)
return r;
+ }
return 0;
}
int r;
assert(s);
- if (UNIT(s)->manager->running_as == MANAGER_SYSTEM) {
+ if (UNIT(s)->manager->running_as == SYSTEMD_SYSTEM) {
if ((r = unit_add_dependency_by_name(UNIT(s), UNIT_BEFORE, SPECIAL_SOCKETS_TARGET, NULL, true)) < 0)
return r;
if (UNIT(s)->default_dependencies)
if ((r = socket_add_default_dependencies(s)) < 0)
return r;
+
+ r = unit_exec_context_defaults(u, &s->exec_context);
+ if (r < 0)
+ return r;
}
return socket_verify(s);
"%sMessageQueueMessageSize: %li\n",
prefix, s->mq_msgsize);
+ if (s->smack)
+ fprintf(f,
+ "%sSmackLabel: %s\n",
+ prefix, s->smack);
+
+ if (s->smack_ip_in)
+ fprintf(f,
+ "%sSmackLabelIPIn: %s\n",
+ prefix, s->smack_ip_in);
+
+ if (s->smack_ip_out)
+ fprintf(f,
+ "%sSmackLabelIPOut: %s\n",
+ prefix, s->smack_ip_out);
+
LIST_FOREACH(port, p, s->ports) {
if (p->type == SOCKET_SOCKET) {
}
exec_context_dump(&s->exec_context, f, prefix);
+ kill_context_dump(&s->kill_context, f, prefix);
for (c = 0; c < _SOCKET_EXEC_COMMAND_MAX; c++) {
if (!s->exec_command[c])
}
case AF_INET6: {
- static const char ipv4_prefix[] = {
+ static const unsigned char ipv4_prefix[] = {
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF
};
if (s->tcp_congestion)
if (setsockopt(fd, SOL_TCP, TCP_CONGESTION, s->tcp_congestion, strlen(s->tcp_congestion)+1) < 0)
log_warning("TCP_CONGESTION failed: %m");
+
+ if (s->smack_ip_in)
+ if (fsetxattr(fd, "security.SMACK64IPIN", s->smack_ip_in, strlen(s->smack_ip_in), 0) < 0)
+ log_error("fsetxattr(\"security.SMACK64IPIN\"): %m");
+
+ if (s->smack_ip_out)
+ if (fsetxattr(fd, "security.SMACK64IPOUT", s->smack_ip_out, strlen(s->smack_ip_out), 0) < 0)
+ log_error("fsetxattr(\"security.SMACK64IPOUT\"): %m");
}
static void socket_apply_fifo_options(Socket *s, int fd) {
if (s->pipe_size > 0)
if (fcntl(fd, F_SETPIPE_SZ, s->pipe_size) < 0)
log_warning("F_SETPIPE_SZ: %m");
+
+ if (s->smack)
+ if (fsetxattr(fd, "security.SMACK64", s->smack, strlen(s->smack), 0) < 0)
+ log_error("fsetxattr(\"security.SMACK64\"): %m");
}
static int fifo_address_create(
assert(path);
assert(_fd);
- mkdir_parents(path, directory_mode);
+ mkdir_parents_label(path, directory_mode);
r = label_context_set(path, S_IFIFO);
if (r < 0)
UNIT(s)->cgroup_bondings,
UNIT(s)->cgroup_attributes,
NULL,
+ UNIT(s)->id,
NULL,
&pid);
if (f != SOCKET_SUCCESS)
s->result = f;
- if (s->exec_context.kill_mode != KILL_NONE) {
- int sig = (state == SOCKET_STOP_PRE_SIGTERM || state == SOCKET_FINAL_SIGTERM) ? s->exec_context.kill_signal : SIGKILL;
+ if (s->kill_context.kill_mode != KILL_NONE) {
+ int sig = (state == SOCKET_STOP_PRE_SIGTERM || state == SOCKET_FINAL_SIGTERM) ? s->kill_context.kill_signal : SIGKILL;
if (s->control_pid > 0) {
if (kill_and_sigcont(s->control_pid, sig) < 0 && errno != ESRCH)
wait_for_exit = true;
}
- if (s->exec_context.kill_mode == KILL_CONTROL_GROUP) {
+ if (s->kill_context.kill_mode == KILL_CONTROL_GROUP) {
if (!(pid_set = set_new(trivial_hash_func, trivial_compare_func))) {
r = -ENOMEM;
if (w->socket_accept) {
for (;;) {
- if ((cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK)) < 0) {
+ cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK);
+ if (cfd < 0) {
if (errno == EINTR)
continue;
s->control_pid = 0;
- if (is_clean_exit(code, status))
+ if (is_clean_exit(code, status, NULL))
f = SOCKET_SUCCESS;
else if (code == CLD_EXITED)
f = SOCKET_FAILURE_EXIT_CODE;
break;
case SOCKET_STOP_PRE_SIGTERM:
- if (s->exec_context.send_sigkill) {
+ if (s->kill_context.send_sigkill) {
log_warning("%s stopping timed out. Killing.", u->id);
socket_enter_signal(s, SOCKET_STOP_PRE_SIGKILL, SOCKET_FAILURE_TIMEOUT);
} else {
break;
case SOCKET_FINAL_SIGTERM:
- if (s->exec_context.send_sigkill) {
+ if (s->kill_context.send_sigkill) {
log_warning("%s stopping timed out (2). Killing.", u->id);
socket_enter_signal(s, SOCKET_FINAL_SIGKILL, SOCKET_FAILURE_TIMEOUT);
} else {
s->result = SOCKET_SUCCESS;
}
-static int socket_kill(Unit *u, KillWho who, KillMode mode, int signo, DBusError *error) {
+static int socket_kill(Unit *u, KillWho who, int signo, DBusError *error) {
Socket *s = SOCKET(u);
int r = 0;
Set *pid_set = NULL;
if (kill(s->control_pid, signo) < 0)
r = -errno;
- if (who == KILL_ALL && mode == KILL_CONTROL_GROUP) {
+ if (who == KILL_ALL) {
int q;
- if (!(pid_set = set_new(trivial_hash_func, trivial_compare_func)))
+ pid_set = set_new(trivial_hash_func, trivial_compare_func);
+ if (!pid_set)
return -ENOMEM;
/* Exclude the control pid from being killed via the cgroup */
- if (s->control_pid > 0)
- if ((q = set_put(pid_set, LONG_TO_PTR(s->control_pid))) < 0) {
+ if (s->control_pid > 0) {
+ q = set_put(pid_set, LONG_TO_PTR(s->control_pid));
+ if (q < 0) {
r = q;
goto finish;
}
+ }
q = cgroup_bonding_kill_list(UNIT(s)->cgroup_bondings, signo, false, false, pid_set, NULL);
- if (q < 0)
- if (q != -EAGAIN && q != -ESRCH && q != -ENOENT)
- r = q;
+ if (q < 0 && q != -EAGAIN && q != -ESRCH && q != -ENOENT)
+ r = q;
}
finish:
DEFINE_STRING_TABLE_LOOKUP(socket_result, SocketResult);
const UnitVTable socket_vtable = {
- .suffix = ".socket",
.object_size = sizeof(Socket),
+ .exec_context_offset = offsetof(Socket, exec_context),
+
.sections =
"Unit\0"
"Socket\0"