X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fjournal%2Fjournald.c;h=ede314a55f204d7c2fead9bcbbe398522e61be81;hb=8725d60ae4f7a8471aa8a0207fa105e335d069a6;hp=9297ca6fb7da390be8877c4b81d6a55308d79fa0;hpb=87d2c1ff6a7375f03476767e6f59454bcc5cd04b;p=elogind.git diff --git a/src/journal/journald.c b/src/journal/journald.c index 9297ca6fb..ede314a55 100644 --- a/src/journal/journald.c +++ b/src/journal/journald.c @@ -25,38 +25,134 @@ #include #include #include +#include +#include #include "hashmap.h" -#include "journal-private.h" +#include "journal-file.h" #include "sd-daemon.h" #include "socket-util.h" +#include "acl-util.h" +#include "cgroup-util.h" typedef struct Server { int syslog_fd; int epoll_fd; int signal_fd; + JournalFile *runtime_journal; JournalFile *system_journal; Hashmap *user_journals; + + uint64_t seqnum; } Server; +static void fix_perms(JournalFile *f, uid_t uid) { + acl_t acl; + acl_entry_t entry; + acl_permset_t permset; + int r; + + assert(f); + + r = fchmod_and_fchown(f->fd, 0640, 0, 0); + if (r < 0) + log_warning("Failed to fix access mode/rights on %s, ignoring: %s", f->path, strerror(-r)); + + if (uid <= 0) + return; + + acl = acl_get_fd(f->fd); + if (!acl) { + log_warning("Failed to read ACL on %s, ignoring: %m", f->path); + return; + } + + r = acl_find_uid(acl, uid, &entry); + if (r <= 0) { + + if (acl_create_entry(&acl, &entry) < 0 || + acl_set_tag_type(entry, ACL_USER) < 0 || + acl_set_qualifier(entry, &uid) < 0) { + log_warning("Failed to patch ACL on %s, ignoring: %m", f->path); + goto finish; + } + } + + if (acl_get_permset(entry, &permset) < 0 || + acl_add_perm(permset, ACL_READ) < 0 || + acl_calc_mask(&acl) < 0) { + log_warning("Failed to patch ACL on %s, ignoring: %m", f->path); + goto finish; + } + + if (acl_set_fd(f->fd, acl) < 0) + log_warning("Failed to set ACL on %s, ignoring: %m", f->path); + +finish: + acl_free(acl); +} + +static JournalFile* find_journal(Server *s, uid_t uid) { + char *p; + int r; + JournalFile *f; + char ids[33]; + sd_id128_t machine; + + assert(s); + + /* We split up user logs only on /var, not on /run */ + if (!s->system_journal) + return s->runtime_journal; + + if (uid <= 0) + return s->system_journal; + + r = sd_id128_get_machine(&machine); + if (r < 0) + return s->system_journal; + + f = hashmap_get(s->user_journals, UINT32_TO_PTR(uid)); + if (f) + return f; + + if (asprintf(&p, "/var/log/journal/%s/user-%lu.journal", sd_id128_to_string(machine, ids), (unsigned long) uid) < 0) + return s->system_journal; + + r = journal_file_open(p, O_RDWR|O_CREAT, 0640, s->system_journal, &f); + free(p); + + if (r < 0) + return s->system_journal; + + fix_perms(f, uid); + + r = hashmap_put(s->user_journals, UINT32_TO_PTR(uid), f); + if (r < 0) { + journal_file_close(f); + return s->system_journal; + } + + return f; +} + static void process_message(Server *s, const char *buf, struct ucred *ucred, struct timeval *tv) { char *message = NULL, *pid = NULL, *uid = NULL, *gid = NULL, *source_time = NULL, *boot_id = NULL, *machine_id = NULL, *comm = NULL, *cmdline = NULL, *hostname = NULL, *audit_session = NULL, *audit_loginuid = NULL, *syslog_priority = NULL, *syslog_facility = NULL, - *exe = NULL; - dual_timestamp ts; - struct iovec iovec[15]; + *exe = NULL, *cgroup = NULL; + struct iovec iovec[16]; unsigned n = 0; char idbuf[33]; sd_id128_t id; int r; char *t; int priority = LOG_USER | LOG_INFO; - - dual_timestamp_get(&ts); + uid_t loginuid = 0; + JournalFile *f; parse_syslog_priority((char**) &buf, &priority); skip_syslog_date((char**) &buf); @@ -73,7 +169,7 @@ static void process_message(Server *s, const char *buf, struct ucred *ucred, str if (ucred) { uint32_t session; - uid_t loginuid; + char *path; if (asprintf(&pid, "PID=%lu", (unsigned long) ucred->pid) >= 0) IOVEC_SET_STRING(iovec[n++], pid); @@ -117,6 +213,14 @@ static void process_message(Server *s, const char *buf, struct ucred *ucred, str if (r >= 0) if (asprintf(&audit_loginuid, "AUDIT_LOGINUID=%lu", (unsigned long) loginuid) >= 0) IOVEC_SET_STRING(iovec[n++], audit_loginuid); + + r = cg_get_by_pid(SYSTEMD_CGROUP_CONTROLLER, ucred->pid, &path); + if (r >= 0) { + cgroup = strappend("SYSTEMD_CGROUP=", path); + if (cgroup) + IOVEC_SET_STRING(iovec[n++], cgroup); + free(path); + } } if (tv) { @@ -125,6 +229,9 @@ static void process_message(Server *s, const char *buf, struct ucred *ucred, str IOVEC_SET_STRING(iovec[n++], source_time); } + /* Note that strictly speaking storing the boot id here is + * redundant since the entry includes this in-line + * anyway. However, we need this indexed, too. */ r = sd_id128_get_boot(&id); if (r >= 0) if (asprintf(&boot_id, "BOOT_ID=%s", sd_id128_to_string(id, idbuf)) >= 0) @@ -143,16 +250,22 @@ static void process_message(Server *s, const char *buf, struct ucred *ucred, str free(t); } - r = journal_file_append_entry(s->system_journal, &ts, iovec, n, NULL, NULL); - if (r < 0) - log_error("Failed to write entry: %s", strerror(-r)); + f = find_journal(s, loginuid); + if (!f) + log_warning("Dropping message, as we can't find a place to store the data."); + else { + r = journal_file_append_entry(f, NULL, iovec, n, &s->seqnum, NULL, NULL); + if (r < 0) + log_error("Failed to write entry, ignoring: %s", strerror(-r)); + } free(message); free(pid); free(uid); free(gid); free(comm); + free(exe); free(cmdline); free(source_time); free(boot_id); @@ -162,6 +275,7 @@ static void process_message(Server *s, const char *buf, struct ucred *ucred, str free(audit_loginuid); free(syslog_facility); free(syslog_priority); + free(cgroup); } static int process_event(Server *s, struct epoll_event *ev) { @@ -191,7 +305,9 @@ static int process_event(Server *s, struct epoll_event *ev) { log_debug("Received SIG%s", signal_to_string(sfsi.ssi_signo)); return 0; - } else { + } + + if (ev->data.fd == s->syslog_fd) { for (;;) { char buf[LINE_MAX+1]; struct msghdr msghdr; @@ -248,22 +364,65 @@ static int process_event(Server *s, struct epoll_event *ev) { process_message(s, strstrip(buf), ucred, tv); } + + return 1; } - return 1; + log_error("Unknown event."); + return 0; } - -static int open_system_journal(JournalFile **f) { +static int system_journal_open(Server *s) { int r; + char *fn; + sd_id128_t machine; + char ids[33]; - r = journal_file_open(NULL, "/var/log/journal/system.journal", O_RDWR|O_CREAT, 0644, f); - if (r == -ENOENT) { - mkdir_p("/run/log/journal", 0755); + r = sd_id128_get_machine(&machine); + if (r < 0) + return r; + + /* First try to create the machine path, but not the prefix */ + fn = strappend("/var/log/journal/", sd_id128_to_string(machine, ids)); + if (!fn) + return -ENOMEM; + (void) mkdir(fn, 0755); + free(fn); - r = journal_file_open(NULL, "/run/log/journal/system.journal", O_RDWR|O_CREAT, 0644, f); + /* The create the system journal file */ + fn = join("/var/log/journal/", ids, "/system.journal", NULL); + if (!fn) + return -ENOMEM; + + r = journal_file_open(fn, O_RDWR|O_CREAT, 0640, NULL, &s->system_journal); + free(fn); + + if (r >= 0) { + fix_perms(s->system_journal, 0); + return r; + } + + if (r < 0 && r != -ENOENT) { + log_error("Failed to open system journal: %s", strerror(-r)); + return r; } + /* /var didn't work, so try /run, but this time we + * create the prefix too */ + fn = join("/run/log/journal/", ids, "/system.journal", NULL); + if (!fn) + return -ENOMEM; + + (void) mkdir_parents(fn, 0755); + r = journal_file_open(fn, O_RDWR|O_CREAT, 0640, NULL, &s->runtime_journal); + free(fn); + + if (r < 0) { + log_error("Failed to open runtime journal: %s", strerror(-r)); + return r; + } + + fix_perms(s->runtime_journal, 0); return r; } @@ -348,11 +507,9 @@ static int server_init(Server *s) { return -ENOMEM; } - r = open_system_journal(&s->system_journal); - if (r < 0) { - log_error("Failed to open journal: %s", strerror(-r)); + r = system_journal_open(s); + if (r < 0) return r; - } assert_se(sigemptyset(&mask) == 0); sigset_add_many(&mask, SIGINT, SIGTERM, -1); @@ -383,6 +540,9 @@ static void server_done(Server *s) { if (s->system_journal) journal_file_close(s->system_journal); + if (s->runtime_journal) + journal_file_close(s->runtime_journal); + while ((f = hashmap_steal_first(s->user_journals))) journal_file_close(f); @@ -412,7 +572,7 @@ int main(int argc, char *argv[]) { return EXIT_FAILURE; } - log_set_target(LOG_TARGET_AUTO); + log_set_target(LOG_TARGET_CONSOLE); log_parse_environment(); log_open(); @@ -427,7 +587,7 @@ int main(int argc, char *argv[]) { sd_notify(false, "READY=1\n" "STATUS=Processing messages..."); - +# for (;;) { struct epoll_event event;