X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fjournal%2Fjournald.c;h=d6db9b1c55b55e694a189a6e45a9659c62ccc966;hb=ed49ef3f349bcd4f0483ba8254a2537fe8e9cd17;hp=9297ca6fb7da390be8877c4b81d6a55308d79fa0;hpb=87d2c1ff6a7375f03476767e6f59454bcc5cd04b;p=elogind.git diff --git a/src/journal/journald.c b/src/journal/journald.c index 9297ca6fb..d6db9b1c5 100644 --- a/src/journal/journald.c +++ b/src/journal/journald.c @@ -25,21 +25,109 @@ #include #include #include +#include +#include #include "hashmap.h" -#include "journal-private.h" +#include "journal-file.h" #include "sd-daemon.h" #include "socket-util.h" +#include "acl-util.h" typedef struct Server { int syslog_fd; int epoll_fd; int signal_fd; + JournalFile *runtime_journal; JournalFile *system_journal; Hashmap *user_journals; } Server; +static void fix_perms(JournalFile *f, uid_t uid) { + acl_t acl; + acl_entry_t entry; + acl_permset_t permset; + int r; + + assert(f); + + r = fchmod_and_fchown(f->fd, 0640, 0, 0); + if (r < 0) + log_warning("Failed to fix access mode/rights on %s, ignoring: %s", f->path, strerror(-r)); + + if (uid <= 0) + return; + + acl = acl_get_fd(f->fd); + if (!acl) { + log_warning("Failed to read ACL on %s, ignoring: %m", f->path); + return; + } + + r = acl_find_uid(acl, uid, &entry); + if (r <= 0) { + + if (acl_create_entry(&acl, &entry) < 0 || + acl_set_tag_type(entry, ACL_USER) < 0 || + acl_set_qualifier(entry, &uid) < 0) { + log_warning("Failed to patch ACL on %s, ignoring: %m", f->path); + goto finish; + } + } + + if (acl_get_permset(entry, &permset) < 0 || + acl_add_perm(permset, ACL_READ) < 0 || + acl_calc_mask(&acl) < 0) { + log_warning("Failed to patch ACL on %s, ignoring: %m", f->path); + goto finish; + } + + if (acl_set_fd(f->fd, acl) < 0) + log_warning("Failed to set ACL on %s, ignoring: %m", f->path); + +finish: + acl_free(acl); +} + +static JournalFile* find_journal(Server *s, uid_t uid) { + char *p; + int r; + JournalFile *f; + + assert(s); + + /* We split up user logs only on /var, not on /run */ + if (!s->system_journal) + return s->runtime_journal; + + if (uid <= 0) + return s->system_journal; + + f = hashmap_get(s->user_journals, UINT32_TO_PTR(uid)); + if (f) + return f; + + if (asprintf(&p, "/var/log/journal/%lu.journal", (unsigned long) uid) < 0) + return s->system_journal; + + r = journal_file_open(p, O_RDWR|O_CREAT, 0640, &f); + free(p); + + if (r < 0) + return s->system_journal; + + fix_perms(f, uid); + + r = hashmap_put(s->user_journals, UINT32_TO_PTR(uid), f); + if (r < 0) { + journal_file_close(f); + return s->system_journal; + } + + return f; +} + static void process_message(Server *s, const char *buf, struct ucred *ucred, struct timeval *tv) { char *message = NULL, *pid = NULL, *uid = NULL, *gid = NULL, *source_time = NULL, *boot_id = NULL, *machine_id = NULL, @@ -47,7 +135,6 @@ static void process_message(Server *s, const char *buf, struct ucred *ucred, str *audit_session = NULL, *audit_loginuid = NULL, *syslog_priority = NULL, *syslog_facility = NULL, *exe = NULL; - dual_timestamp ts; struct iovec iovec[15]; unsigned n = 0; char idbuf[33]; @@ -55,8 +142,8 @@ static void process_message(Server *s, const char *buf, struct ucred *ucred, str int r; char *t; int priority = LOG_USER | LOG_INFO; - - dual_timestamp_get(&ts); + uid_t loginuid = 0; + JournalFile *f; parse_syslog_priority((char**) &buf, &priority); skip_syslog_date((char**) &buf); @@ -73,7 +160,6 @@ static void process_message(Server *s, const char *buf, struct ucred *ucred, str if (ucred) { uint32_t session; - uid_t loginuid; if (asprintf(&pid, "PID=%lu", (unsigned long) ucred->pid) >= 0) IOVEC_SET_STRING(iovec[n++], pid); @@ -125,6 +211,9 @@ static void process_message(Server *s, const char *buf, struct ucred *ucred, str IOVEC_SET_STRING(iovec[n++], source_time); } + /* Note that strictly speaking storing the boot id here is + * redundant since the entry includes this in-line + * anyway. However, we need this indexed, too. */ r = sd_id128_get_boot(&id); if (r >= 0) if (asprintf(&boot_id, "BOOT_ID=%s", sd_id128_to_string(id, idbuf)) >= 0) @@ -143,10 +232,15 @@ static void process_message(Server *s, const char *buf, struct ucred *ucred, str free(t); } - r = journal_file_append_entry(s->system_journal, &ts, iovec, n, NULL, NULL); - if (r < 0) - log_error("Failed to write entry: %s", strerror(-r)); + f = find_journal(s, loginuid); + if (!f) + log_warning("Dropping message, as we can't find a place to store the data."); + else { + r = journal_file_append_entry(f, NULL, iovec, n, NULL, NULL); + if (r < 0) + log_error("Failed to write entry, ignoring: %s", strerror(-r)); + } free(message); free(pid); @@ -191,7 +285,9 @@ static int process_event(Server *s, struct epoll_event *ev) { log_debug("Received SIG%s", signal_to_string(sfsi.ssi_signo)); return 0; - } else { + } + + if (ev->data.fd == s->syslog_fd) { for (;;) { char buf[LINE_MAX+1]; struct msghdr msghdr; @@ -248,23 +344,68 @@ static int process_event(Server *s, struct epoll_event *ev) { process_message(s, strstrip(buf), ucred, tv); } + + return 1; } - return 1; + log_error("Unknown event."); + return 0; } - -static int open_system_journal(JournalFile **f) { +static int system_journal_open(Server *s) { int r; + char *fn; + sd_id128_t machine; + char ids[33]; - r = journal_file_open(NULL, "/var/log/journal/system.journal", O_RDWR|O_CREAT, 0644, f); - if (r == -ENOENT) { - mkdir_p("/run/log/journal", 0755); + r = sd_id128_get_machine(&machine); + if (r < 0) + return r; - r = journal_file_open(NULL, "/run/log/journal/system.journal", O_RDWR|O_CREAT, 0644, f); + /* First try to create the machine path, but not the prefix */ + fn = join("/var/log/journal/", sd_id128_to_string(machine, ids), NULL); + if (!fn) + return -ENOMEM; + (void) mkdir(fn, 0755); + free(fn); + + /* The create the system journal file */ + fn = join("/var/log/journal/", ids, "/system.journal", NULL); + if (!fn) + return -ENOMEM; + + r = journal_file_open(fn, O_RDWR|O_CREAT, 0640, &s->system_journal); + free(fn); + + if (r >= 0) + fix_perms(s->system_journal, 0); + else if (r == -ENOENT) { + + /* /var didn't work, so try /run, but this time we + * create the prefix too */ + fn = join("/run/log/journal/", ids, NULL); + if (!fn) + return -ENOMEM; + (void) mkdir_p(fn, 0755); + free(fn); + + /* Then create the runtime journal file */ + fn = join("/run/log/journal/", ids, "/system.journal", NULL); + if (!fn) + return -ENOMEM; + r = journal_file_open(fn, O_RDWR|O_CREAT, 0640, &s->runtime_journal); + free(fn); + + if (r >= 0) + fix_perms(s->runtime_journal, 0); } - return r; + if (r < 0 && r != -ENOENT) { + log_error("Failed to open journal: %s", strerror(-r)); + return r; + } + + return 0; } static int server_init(Server *s) { @@ -348,11 +489,9 @@ static int server_init(Server *s) { return -ENOMEM; } - r = open_system_journal(&s->system_journal); - if (r < 0) { - log_error("Failed to open journal: %s", strerror(-r)); + r = system_journal_open(s); + if (r < 0) return r; - } assert_se(sigemptyset(&mask) == 0); sigset_add_many(&mask, SIGINT, SIGTERM, -1); @@ -383,6 +522,9 @@ static void server_done(Server *s) { if (s->system_journal) journal_file_close(s->system_journal); + if (s->runtime_journal) + journal_file_close(s->runtime_journal); + while ((f = hashmap_steal_first(s->user_journals))) journal_file_close(f); @@ -412,7 +554,7 @@ int main(int argc, char *argv[]) { return EXIT_FAILURE; } - log_set_target(LOG_TARGET_AUTO); + log_set_target(LOG_TARGET_CONSOLE); log_parse_environment(); log_open();