X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=execute.c;h=f2f2be74cf8b9a7d4710b465e05d2df5204ae848;hb=9eba9da4bce4778b4d5dd43e2c41756976a1582b;hp=5def5ce1af5c8a553867168d9721ff3a1510852e;hpb=2da3263ab6eed1780b000c09884ba9bf006c4891;p=elogind.git diff --git a/execute.c b/execute.c index 5def5ce1a..f2f2be74c 100644 --- a/execute.c +++ b/execute.c @@ -6,12 +6,16 @@ #include #include #include +#include +#include +#include #include "execute.h" #include "strv.h" #include "macro.h" #include "util.h" #include "log.h" +#include "ioprio.h" static int close_fds(int except[], unsigned n_except) { DIR *d; @@ -104,6 +108,146 @@ static int shift_fds(int fds[], unsigned n_fds) { return 0; } +static int flags_fds(int fds[], unsigned n_fds) { + unsigned i; + + if (n_fds <= 0) + return 0; + + assert(fds); + + /* Drops O_NONBLOCK and FD_CLOEXEC from the file flags */ + + for (i = 0; i < n_fds; i++) { + int flags; + + if ((flags = fcntl(fds[i], F_GETFL, 0)) < 0) + return -errno; + + /* Since we are at it, let's make sure that nobody + * forgot setting O_NONBLOCK for all our fds */ + + if (fcntl(fds[i], F_SETFL, flags &~O_NONBLOCK) < 0) + return -errno; + + if ((flags = fcntl(fds[i], F_GETFD, 0)) < 0) + return -errno; + + /* Also make sure nobody forgot O_CLOEXEC for all our + * fds */ + if (fcntl(fds[i], F_SETFD, flags &~FD_CLOEXEC) < 0) + return -errno; + } + + return 0; +} + +static int replace_null_fd(int fd, int flags) { + int nfd; + assert(fd >= 0); + + close_nointr(fd); + + if ((nfd = open("/dev/null", flags|O_NOCTTY)) < 0) + return -errno; + + if (nfd != fd) { + close_nointr_nofail(nfd); + return -EIO; + } + + return 0; +} + +static int setup_output(const ExecContext *context, const char *ident) { + int r; + + assert(context); + + switch (context->output) { + + case EXEC_CONSOLE: + return 0; + + case EXEC_NULL: + + if ((r = replace_null_fd(STDIN_FILENO, O_RDONLY)) < 0 || + (r = replace_null_fd(STDOUT_FILENO, O_WRONLY)) < 0 || + (r = replace_null_fd(STDERR_FILENO, O_WRONLY)) < 0) + return r; + + return 0; + + case EXEC_KERNEL: + case EXEC_SYSLOG: { + + int fd; + union { + struct sockaddr sa; + struct sockaddr_un un; + } sa; + + if ((r = replace_null_fd(STDIN_FILENO, O_RDONLY)) < 0) + return r; + + close_nointr(STDOUT_FILENO); + close_nointr(STDERR_FILENO); + + if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) + return -errno; + + if (fd != STDOUT_FILENO) { + close_nointr_nofail(fd); + return -EIO; + } + + zero(sa); + sa.sa.sa_family = AF_UNIX; + strncpy(sa.un.sun_path+1, LOGGER_SOCKET, sizeof(sa.un.sun_path)-1); + + if (connect(fd, &sa.sa, sizeof(sa)) < 0) { + close_nointr_nofail(fd); + return -errno; + } + + if (shutdown(fd, SHUT_RD) < 0) { + close_nointr_nofail(fd); + return -errno; + } + + if ((fd = dup(fd)) < 0) { + close_nointr_nofail(fd); + return -errno; + } + + if (fd != STDERR_FILENO) { + close_nointr_nofail(fd); + return -EIO; + } + + /* We speak a very simple protocol between log server + * and client: one line for the log destination (kmsg + * or syslog), followed by the priority field, + * followed by the process name. Since we replaced + * stdin/stderr we simple use stdio to write to + * it. Note that we use stderr, to minimize buffer + * flushing issues. */ + + fprintf(stderr, + "%s\n" + "%i\n" + "%s\n", + context->output == EXEC_KERNEL ? "kmsg" : "syslog", + context->syslog_priority, + context->syslog_identifier ? context->syslog_identifier : ident); + + return 0; + } + } + + assert_not_reached("Unknown logging type"); +} + int exec_spawn(const ExecCommand *command, const ExecContext *context, int *fds, unsigned n_fds, pid_t *ret) { pid_t pid; @@ -120,31 +264,66 @@ int exec_spawn(const ExecCommand *command, const ExecContext *context, int *fds, if (pid == 0) { char **e, **f = NULL; int i, r; - char t[16]; + sigset_t ss; + /* child */ - umask(context->umask); + if (sigemptyset(&ss) < 0 || + sigprocmask(SIG_SETMASK, &ss, NULL) < 0) { + r = EXIT_SIGNAL_MASK; + goto fail; + } - if (chdir(context->directory ? context->directory : "/") < 0) { - r = EXIT_CHDIR; + if (setpgid(0, 0) < 0) { + r = EXIT_PGID; goto fail; } - snprintf(t, sizeof(t), "%i", context->oom_adjust); - char_array_0(t); + umask(context->umask); - if (write_one_line_file("/proc/self/oom_adj", t) < 0) { - r = EXIT_OOM_ADJUST; + if (setup_output(context, file_name_from_path(command->path)) < 0) { + r = EXIT_OUTPUT; goto fail; } - if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) { - r = EXIT_NICE; + if (context->oom_adjust_set) { + char t[16]; + + snprintf(t, sizeof(t), "%i", context->oom_adjust); + char_array_0(t); + + if (write_one_line_file("/proc/self/oom_adj", t) < 0) { + r = EXIT_OOM_ADJUST; + goto fail; + } + } + + if (context->root_directory) + if (chroot(context->root_directory) < 0) { + r = EXIT_CHROOT; + goto fail; + } + + if (chdir(context->working_directory ? context->working_directory : "/") < 0) { + r = EXIT_CHDIR; goto fail; } + if (context->nice_set) + if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) { + r = EXIT_NICE; + goto fail; + } + + if (context->ioprio_set) + if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) { + r = EXIT_IOPRIO; + goto fail; + } + if (close_fds(fds, n_fds) < 0 || - shift_fds(fds, n_fds) < 0) { + shift_fds(fds, n_fds) < 0 || + flags_fds(fds, n_fds) < 0) { r = EXIT_FDS; goto fail; } @@ -205,8 +384,16 @@ void exec_context_init(ExecContext *c) { c->umask = 0002; cap_clear(c->capabilities); + c->capabilities_set = false; c->oom_adjust = 0; + c->oom_adjust_set = false; c->nice = 0; + c->nice_set = false; + c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0); + c->ioprio_set = false; + + c->output = 0; + c->syslog_priority = LOG_DAEMON|LOG_INFO; } void exec_context_done(ExecContext *c) { @@ -222,8 +409,13 @@ void exec_context_done(ExecContext *c) { c->rlimit[l] = NULL; } - free(c->directory); - c->directory = NULL; + free(c->working_directory); + c->working_directory = NULL; + free(c->root_directory); + c->root_directory = NULL; + + free(c->syslog_identifier); + c->syslog_identifier = NULL; free(c->user); c->user = NULL; @@ -257,6 +449,14 @@ void exec_command_free_array(ExecCommand **c, unsigned n) { } void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { + + static const char * const table[] = { + [IOPRIO_CLASS_NONE] = "none", + [IOPRIO_CLASS_RT] = "realtime", + [IOPRIO_CLASS_BE] = "best-effort", + [IOPRIO_CLASS_IDLE] = "idle" + }; + assert(c); assert(f); @@ -265,13 +465,28 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { fprintf(f, "%sUmask: %04o\n" - "%sDirectory: %s\n" - "%sNice: %i\n" - "%sOOMAdjust: %i\n", + "%sWorking Directory: %s\n" + "%sRoot Directory: %s\n", prefix, c->umask, - prefix, c->directory ? c->directory : "/", - prefix, c->nice, - prefix, c->oom_adjust); + prefix, c->working_directory ? c->working_directory : "/", + prefix, c->root_directory ? c->root_directory : "/"); + + if (c->nice_set) + fprintf(f, + "%sNice: %i\n", + prefix, c->nice); + + if (c->oom_adjust_set) + fprintf(f, + "%sOOMAdjust: %i\n", + prefix, c->oom_adjust); + + if (c->ioprio_set) + fprintf(f, + "%sIOSchedulingClass: %s\n" + "%sIOPriority: %i\n", + prefix, table[IOPRIO_PRIO_CLASS(c->ioprio)], + prefix, (int) IOPRIO_PRIO_DATA(c->ioprio)); } void exec_status_fill(ExecStatus *s, pid_t pid, int code, int status) {