src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <glob.h>
  42 #include <sys/personality.h>
  43 #include <libgen.h>
  44 #undef basename
  45
  46 #ifdef HAVE_PAM
  47 #include <security/pam_appl.h>
  48 #endif
  49
  50 #ifdef HAVE_SELINUX
  51 #include <selinux/selinux.h>
  52 #endif
  53
  54 #ifdef HAVE_SECCOMP
  55 #include <seccomp.h>
  56 #endif
  57
  58 #ifdef HAVE_APPARMOR
  59 #include <sys/apparmor.h>
  60 #endif
  61
  62 #include "execute.h"
  63 #include "strv.h"
  64 #include "macro.h"
  65 #include "capability.h"
  66 #include "util.h"
  67 #include "log.h"
  68 #include "sd-messages.h"
  69 #include "ioprio.h"
  70 #include "securebits.h"
  71 #include "namespace.h"
  72 #include "exit-status.h"
  73 #include "missing.h"
  74 #include "utmp-wtmp.h"
  75 #include "def.h"
  76 #include "path-util.h"
  77 #include "env-util.h"
  78 #include "fileio.h"
  79 #include "unit.h"
  80 #include "async.h"
  81 #include "selinux-util.h"
  82 #include "errno-list.h"
  83 #include "af-list.h"
  84 #include "mkdir.h"
  85 #include "apparmor-util.h"
  86 #include "label.h"
  87
  88 #ifdef HAVE_SECCOMP
  89 #include "seccomp-util.h"
  90 #endif
  91
  92 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  93 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
  94
  95 /* This assumes there is a 'tty' group */
  96 #define TTY_MODE 0620
  97
  98 #define SNDBUF_SIZE (8*1024*1024)
  99
 100 static int shift_fds(int fds[], unsigned n_fds) {
 101         int start, restart_from;
 102
 103         if (n_fds <= 0)
 104                 return 0;
 105
 106         /* Modifies the fds array! (sorts it) */
 107
 108         assert(fds);
 109
 110         start = 0;
 111         for (;;) {
 112                 int i;
 113
 114                 restart_from = -1;
 115
 116                 for (i = start; i < (int) n_fds; i++) {
 117                         int nfd;
 118
 119                         /* Already at right index? */
 120                         if (fds[i] == i+3)
 121                                 continue;
 122
 123                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
 124                                 return -errno;
 125
 126                         safe_close(fds[i]);
 127                         fds[i] = nfd;
 128
 129                         /* Hmm, the fd we wanted isn't free? Then
 130                          * let's remember that and try again from here*/
 131                         if (nfd != i+3 && restart_from < 0)
 132                                 restart_from = i;
 133                 }
 134
 135                 if (restart_from < 0)
 136                         break;
 137
 138                 start = restart_from;
 139         }
 140
 141         return 0;
 142 }
 143
 144 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 145         unsigned i;
 146         int r;
 147
 148         if (n_fds <= 0)
 149                 return 0;
 150
 151         assert(fds);
 152
 153         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 154
 155         for (i = 0; i < n_fds; i++) {
 156
 157                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 158                         return r;
 159
 160                 /* We unconditionally drop FD_CLOEXEC from the fds,
 161                  * since after all we want to pass these fds to our
 162                  * children */
 163
 164                 if ((r = fd_cloexec(fds[i], false)) < 0)
 165                         return r;
 166         }
 167
 168         return 0;
 169 }
 170
 171 _pure_ static const char *tty_path(const ExecContext *context) {
 172         assert(context);
 173
 174         if (context->tty_path)
 175                 return context->tty_path;
 176
 177         return "/dev/console";
 178 }
 179
 180 static void exec_context_tty_reset(const ExecContext *context) {
 181         assert(context);
 182
 183         if (context->tty_vhangup)
 184                 terminal_vhangup(tty_path(context));
 185
 186         if (context->tty_reset)
 187                 reset_terminal(tty_path(context));
 188
 189         if (context->tty_vt_disallocate && context->tty_path)
 190                 vt_disallocate(context->tty_path);
 191 }
 192
 193 static bool is_terminal_output(ExecOutput o) {
 194         return
 195                 o == EXEC_OUTPUT_TTY ||
 196                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 197                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 198                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 199 }
 200
 201 static int open_null_as(int flags, int nfd) {
 202         int fd, r;
 203
 204         assert(nfd >= 0);
 205
 206         fd = open("/dev/null", flags|O_NOCTTY);
 207         if (fd < 0)
 208                 return -errno;
 209
 210         if (fd != nfd) {
 211                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 212                 safe_close(fd);
 213         } else
 214                 r = nfd;
 215
 216         return r;
 217 }
 218
 219 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 220         int fd, r;
 221         union sockaddr_union sa = {
 222                 .un.sun_family = AF_UNIX,
 223                 .un.sun_path = "/run/systemd/journal/stdout",
 224         };
 225
 226         assert(context);
 227         assert(output < _EXEC_OUTPUT_MAX);
 228         assert(ident);
 229         assert(nfd >= 0);
 230
 231         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 232         if (fd < 0)
 233                 return -errno;
 234
 235         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 236         if (r < 0) {
 237                 safe_close(fd);
 238                 return -errno;
 239         }
 240
 241         if (shutdown(fd, SHUT_RD) < 0) {
 242                 safe_close(fd);
 243                 return -errno;
 244         }
 245
 246         fd_inc_sndbuf(fd, SNDBUF_SIZE);
 247
 248         dprintf(fd,
 249                 "%s\n"
 250                 "%s\n"
 251                 "%i\n"
 252                 "%i\n"
 253                 "%i\n"
 254                 "%i\n"
 255                 "%i\n",
 256                 context->syslog_identifier ? context->syslog_identifier : ident,
 257                 unit_id,
 258                 context->syslog_priority,
 259                 !!context->syslog_level_prefix,
 260                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 261                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 262                 is_terminal_output(output));
 263
 264         if (fd != nfd) {
 265                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 266                 safe_close(fd);
 267         } else
 268                 r = nfd;
 269
 270         return r;
 271 }
 272 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 273         int fd, r;
 274
 275         assert(path);
 276         assert(nfd >= 0);
 277
 278         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 279                 return fd;
 280
 281         if (fd != nfd) {
 282                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 283                 safe_close(fd);
 284         } else
 285                 r = nfd;
 286
 287         return r;
 288 }
 289
 290 static bool is_terminal_input(ExecInput i) {
 291         return
 292                 i == EXEC_INPUT_TTY ||
 293                 i == EXEC_INPUT_TTY_FORCE ||
 294                 i == EXEC_INPUT_TTY_FAIL;
 295 }
 296
 297 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 298
 299         if (is_terminal_input(std_input) && !apply_tty_stdin)
 300                 return EXEC_INPUT_NULL;
 301
 302         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 303                 return EXEC_INPUT_NULL;
 304
 305         return std_input;
 306 }
 307
 308 static int fixup_output(ExecOutput std_output, int socket_fd) {
 309
 310         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 311                 return EXEC_OUTPUT_INHERIT;
 312
 313         return std_output;
 314 }
 315
 316 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 317         ExecInput i;
 318
 319         assert(context);
 320
 321         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 322
 323         switch (i) {
 324
 325         case EXEC_INPUT_NULL:
 326                 return open_null_as(O_RDONLY, STDIN_FILENO);
 327
 328         case EXEC_INPUT_TTY:
 329         case EXEC_INPUT_TTY_FORCE:
 330         case EXEC_INPUT_TTY_FAIL: {
 331                 int fd, r;
 332
 333                 fd = acquire_terminal(tty_path(context),
 334                                       i == EXEC_INPUT_TTY_FAIL,
 335                                       i == EXEC_INPUT_TTY_FORCE,
 336                                       false,
 337                                       USEC_INFINITY);
 338                 if (fd < 0)
 339                         return fd;
 340
 341                 if (fd != STDIN_FILENO) {
 342                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 343                         safe_close(fd);
 344                 } else
 345                         r = STDIN_FILENO;
 346
 347                 return r;
 348         }
 349
 350         case EXEC_INPUT_SOCKET:
 351                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 352
 353         default:
 354                 assert_not_reached("Unknown input type");
 355         }
 356 }
 357
 358 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 359         ExecOutput o;
 360         ExecInput i;
 361         int r;
 362
 363         assert(context);
 364         assert(ident);
 365
 366         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 367         o = fixup_output(context->std_output, socket_fd);
 368
 369         if (fileno == STDERR_FILENO) {
 370                 ExecOutput e;
 371                 e = fixup_output(context->std_error, socket_fd);
 372
 373                 /* This expects the input and output are already set up */
 374
 375                 /* Don't change the stderr file descriptor if we inherit all
 376                  * the way and are not on a tty */
 377                 if (e == EXEC_OUTPUT_INHERIT &&
 378                     o == EXEC_OUTPUT_INHERIT &&
 379                     i == EXEC_INPUT_NULL &&
 380                     !is_terminal_input(context->std_input) &&
 381                     getppid () != 1)
 382                         return fileno;
 383
 384                 /* Duplicate from stdout if possible */
 385                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 386                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 387
 388                 o = e;
 389
 390         } else if (o == EXEC_OUTPUT_INHERIT) {
 391                 /* If input got downgraded, inherit the original value */
 392                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 393                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 394
 395                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 396                 if (i != EXEC_INPUT_NULL)
 397                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 398
 399                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 400                 if (getppid() != 1)
 401                         return fileno;
 402
 403                 /* We need to open /dev/null here anew, to get the right access mode. */
 404                 return open_null_as(O_WRONLY, fileno);
 405         }
 406
 407         switch (o) {
 408
 409         case EXEC_OUTPUT_NULL:
 410                 return open_null_as(O_WRONLY, fileno);
 411
 412         case EXEC_OUTPUT_TTY:
 413                 if (is_terminal_input(i))
 414                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 415
 416                 /* We don't reset the terminal if this is just about output */
 417                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 418
 419         case EXEC_OUTPUT_SYSLOG:
 420         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 421         case EXEC_OUTPUT_KMSG:
 422         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 423         case EXEC_OUTPUT_JOURNAL:
 424         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 425                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 426                 if (r < 0) {
 427                         log_struct_unit(LOG_CRIT, unit_id,
 428                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 429                                 fileno == STDOUT_FILENO ? "out" : "err",
 430                                 unit_id, strerror(-r),
 431                                 "ERRNO=%d", -r,
 432                                 NULL);
 433                         r = open_null_as(O_WRONLY, fileno);
 434                 }
 435                 return r;
 436
 437         case EXEC_OUTPUT_SOCKET:
 438                 assert(socket_fd >= 0);
 439                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 440
 441         default:
 442                 assert_not_reached("Unknown error type");
 443         }
 444 }
 445
 446 static int chown_terminal(int fd, uid_t uid) {
 447         struct stat st;
 448
 449         assert(fd >= 0);
 450
 451         /* This might fail. What matters are the results. */
 452         (void) fchown(fd, uid, -1);
 453         (void) fchmod(fd, TTY_MODE);
 454
 455         if (fstat(fd, &st) < 0)
 456                 return -errno;
 457
 458         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 459                 return -EPERM;
 460
 461         return 0;
 462 }
 463
 464 static int setup_confirm_stdio(int *_saved_stdin,
 465                                int *_saved_stdout) {
 466         int fd = -1, saved_stdin, saved_stdout = -1, r;
 467
 468         assert(_saved_stdin);
 469         assert(_saved_stdout);
 470
 471         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 472         if (saved_stdin < 0)
 473                 return -errno;
 474
 475         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 476         if (saved_stdout < 0) {
 477                 r = errno;
 478                 goto fail;
 479         }
 480
 481         fd = acquire_terminal(
 482                         "/dev/console",
 483                         false,
 484                         false,
 485                         false,
 486                         DEFAULT_CONFIRM_USEC);
 487         if (fd < 0) {
 488                 r = fd;
 489                 goto fail;
 490         }
 491
 492         r = chown_terminal(fd, getuid());
 493         if (r < 0)
 494                 goto fail;
 495
 496         if (dup2(fd, STDIN_FILENO) < 0) {
 497                 r = -errno;
 498                 goto fail;
 499         }
 500
 501         if (dup2(fd, STDOUT_FILENO) < 0) {
 502                 r = -errno;
 503                 goto fail;
 504         }
 505
 506         if (fd >= 2)
 507                 safe_close(fd);
 508
 509         *_saved_stdin = saved_stdin;
 510         *_saved_stdout = saved_stdout;
 511
 512         return 0;
 513
 514 fail:
 515         safe_close(saved_stdout);
 516         safe_close(saved_stdin);
 517         safe_close(fd);
 518
 519         return r;
 520 }
 521
 522 _printf_(1, 2) static int write_confirm_message(const char *format, ...) {
 523         _cleanup_close_ int fd = -1;
 524         va_list ap;
 525
 526         assert(format);
 527
 528         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 529         if (fd < 0)
 530                 return fd;
 531
 532         va_start(ap, format);
 533         vdprintf(fd, format, ap);
 534         va_end(ap);
 535
 536         return 0;
 537 }
 538
 539 static int restore_confirm_stdio(int *saved_stdin,
 540                                  int *saved_stdout) {
 541
 542         int r = 0;
 543
 544         assert(saved_stdin);
 545         assert(saved_stdout);
 546
 547         release_terminal();
 548
 549         if (*saved_stdin >= 0)
 550                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 551                         r = -errno;
 552
 553         if (*saved_stdout >= 0)
 554                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 555                         r = -errno;
 556
 557         safe_close(*saved_stdin);
 558         safe_close(*saved_stdout);
 559
 560         return r;
 561 }
 562
 563 static int ask_for_confirmation(char *response, char **argv) {
 564         int saved_stdout = -1, saved_stdin = -1, r;
 565         _cleanup_free_ char *line = NULL;
 566
 567         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 568         if (r < 0)
 569                 return r;
 570
 571         line = exec_command_line(argv);
 572         if (!line)
 573                 return -ENOMEM;
 574
 575         r = ask_char(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 576
 577         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 578
 579         return r;
 580 }
 581
 582 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 583         bool keep_groups = false;
 584         int r;
 585
 586         assert(context);
 587
 588         /* Lookup and set GID and supplementary group list. Here too
 589          * we avoid NSS lookups for gid=0. */
 590
 591         if (context->group || username) {
 592
 593                 if (context->group) {
 594                         const char *g = context->group;
 595
 596                         if ((r = get_group_creds(&g, &gid)) < 0)
 597                                 return r;
 598                 }
 599
 600                 /* First step, initialize groups from /etc/groups */
 601                 if (username && gid != 0) {
 602                         if (initgroups(username, gid) < 0)
 603                                 return -errno;
 604
 605                         keep_groups = true;
 606                 }
 607
 608                 /* Second step, set our gids */
 609                 if (setresgid(gid, gid, gid) < 0)
 610                         return -errno;
 611         }
 612
 613         if (context->supplementary_groups) {
 614                 int ngroups_max, k;
 615                 gid_t *gids;
 616                 char **i;
 617
 618                 /* Final step, initialize any manually set supplementary groups */
 619                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 620
 621                 if (!(gids = new(gid_t, ngroups_max)))
 622                         return -ENOMEM;
 623
 624                 if (keep_groups) {
 625                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 626                                 free(gids);
 627                                 return -errno;
 628                         }
 629                 } else
 630                         k = 0;
 631
 632                 STRV_FOREACH(i, context->supplementary_groups) {
 633                         const char *g;
 634
 635                         if (k >= ngroups_max) {
 636                                 free(gids);
 637                                 return -E2BIG;
 638                         }
 639
 640                         g = *i;
 641                         r = get_group_creds(&g, gids+k);
 642                         if (r < 0) {
 643                                 free(gids);
 644                                 return r;
 645                         }
 646
 647                         k++;
 648                 }
 649
 650                 if (setgroups(k, gids) < 0) {
 651                         free(gids);
 652                         return -errno;
 653                 }
 654
 655                 free(gids);
 656         }
 657
 658         return 0;
 659 }
 660
 661 static int enforce_user(const ExecContext *context, uid_t uid) {
 662         assert(context);
 663
 664         /* Sets (but doesn't lookup) the uid and make sure we keep the
 665          * capabilities while doing so. */
 666
 667         if (context->capabilities) {
 668                 _cleanup_cap_free_ cap_t d = NULL;
 669                 static const cap_value_t bits[] = {
 670                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 671                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 672                 };
 673
 674                 /* First step: If we need to keep capabilities but
 675                  * drop privileges we need to make sure we keep our
 676                  * caps, while we drop privileges. */
 677                 if (uid != 0) {
 678                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 679
 680                         if (prctl(PR_GET_SECUREBITS) != sb)
 681                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 682                                         return -errno;
 683                 }
 684
 685                 /* Second step: set the capabilities. This will reduce
 686                  * the capabilities to the minimum we need. */
 687
 688                 d = cap_dup(context->capabilities);
 689                 if (!d)
 690                         return -errno;
 691
 692                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 693                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0)
 694                         return -errno;
 695
 696                 if (cap_set_proc(d) < 0)
 697                         return -errno;
 698         }
 699
 700         /* Third step: actually set the uids */
 701         if (setresuid(uid, uid, uid) < 0)
 702                 return -errno;
 703
 704         /* At this point we should have all necessary capabilities but
 705            are otherwise a normal user. However, the caps might got
 706            corrupted due to the setresuid() so we need clean them up
 707            later. This is done outside of this call. */
 708
 709         return 0;
 710 }
 711
 712 #ifdef HAVE_PAM
 713
 714 static int null_conv(
 715                 int num_msg,
 716                 const struct pam_message **msg,
 717                 struct pam_response **resp,
 718                 void *appdata_ptr) {
 719
 720         /* We don't support conversations */
 721
 722         return PAM_CONV_ERR;
 723 }
 724
 725 static int setup_pam(
 726                 const char *name,
 727                 const char *user,
 728                 uid_t uid,
 729                 const char *tty,
 730                 char ***pam_env,
 731                 int fds[], unsigned n_fds) {
 732
 733         static const struct pam_conv conv = {
 734                 .conv = null_conv,
 735                 .appdata_ptr = NULL
 736         };
 737
 738         pam_handle_t *handle = NULL;
 739         sigset_t ss, old_ss;
 740         int pam_code = PAM_SUCCESS;
 741         int err;
 742         char **e = NULL;
 743         bool close_session = false;
 744         pid_t pam_pid = 0, parent_pid;
 745         int flags = 0;
 746
 747         assert(name);
 748         assert(user);
 749         assert(pam_env);
 750
 751         /* We set up PAM in the parent process, then fork. The child
 752          * will then stay around until killed via PR_GET_PDEATHSIG or
 753          * systemd via the cgroup logic. It will then remove the PAM
 754          * session again. The parent process will exec() the actual
 755          * daemon. We do things this way to ensure that the main PID
 756          * of the daemon is the one we initially fork()ed. */
 757
 758         if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
 759                 flags |= PAM_SILENT;
 760
 761         pam_code = pam_start(name, user, &conv, &handle);
 762         if (pam_code != PAM_SUCCESS) {
 763                 handle = NULL;
 764                 goto fail;
 765         }
 766
 767         if (tty) {
 768                 pam_code = pam_set_item(handle, PAM_TTY, tty);
 769                 if (pam_code != PAM_SUCCESS)
 770                         goto fail;
 771         }
 772
 773         pam_code = pam_acct_mgmt(handle, flags);
 774         if (pam_code != PAM_SUCCESS)
 775                 goto fail;
 776
 777         pam_code = pam_open_session(handle, flags);
 778         if (pam_code != PAM_SUCCESS)
 779                 goto fail;
 780
 781         close_session = true;
 782
 783         e = pam_getenvlist(handle);
 784         if (!e) {
 785                 pam_code = PAM_BUF_ERR;
 786                 goto fail;
 787         }
 788
 789         /* Block SIGTERM, so that we know that it won't get lost in
 790          * the child */
 791         if (sigemptyset(&ss) < 0 ||
 792             sigaddset(&ss, SIGTERM) < 0 ||
 793             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 794                 goto fail;
 795
 796         parent_pid = getpid();
 797
 798         pam_pid = fork();
 799         if (pam_pid < 0)
 800                 goto fail;
 801
 802         if (pam_pid == 0) {
 803                 int sig;
 804                 int r = EXIT_PAM;
 805
 806                 /* The child's job is to reset the PAM session on
 807                  * termination */
 808
 809                 /* This string must fit in 10 chars (i.e. the length
 810                  * of "/sbin/init"), to look pretty in /bin/ps */
 811                 rename_process("(sd-pam)");
 812
 813                 /* Make sure we don't keep open the passed fds in this
 814                 child. We assume that otherwise only those fds are
 815                 open here that have been opened by PAM. */
 816                 close_many(fds, n_fds);
 817
 818                 /* Drop privileges - we don't need any to pam_close_session
 819                  * and this will make PR_SET_PDEATHSIG work in most cases.
 820                  * If this fails, ignore the error - but expect sd-pam threads
 821                  * to fail to exit normally */
 822                 if (setresuid(uid, uid, uid) < 0)
 823                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 824
 825                 /* Wait until our parent died. This will only work if
 826                  * the above setresuid() succeeds, otherwise the kernel
 827                  * will not allow unprivileged parents kill their privileged
 828                  * children this way. We rely on the control groups kill logic
 829                  * to do the rest for us. */
 830                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 831                         goto child_finish;
 832
 833                 /* Check if our parent process might already have
 834                  * died? */
 835                 if (getppid() == parent_pid) {
 836                         for (;;) {
 837                                 if (sigwait(&ss, &sig) < 0) {
 838                                         if (errno == EINTR)
 839                                                 continue;
 840
 841                                         goto child_finish;
 842                                 }
 843
 844                                 assert(sig == SIGTERM);
 845                                 break;
 846                         }
 847                 }
 848
 849                 /* If our parent died we'll end the session */
 850                 if (getppid() != parent_pid) {
 851                         pam_code = pam_close_session(handle, flags);
 852                         if (pam_code != PAM_SUCCESS)
 853                                 goto child_finish;
 854                 }
 855
 856                 r = 0;
 857
 858         child_finish:
 859                 pam_end(handle, pam_code | flags);
 860                 _exit(r);
 861         }
 862
 863         /* If the child was forked off successfully it will do all the
 864          * cleanups, so forget about the handle here. */
 865         handle = NULL;
 866
 867         /* Unblock SIGTERM again in the parent */
 868         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 869                 goto fail;
 870
 871         /* We close the log explicitly here, since the PAM modules
 872          * might have opened it, but we don't want this fd around. */
 873         closelog();
 874
 875         *pam_env = e;
 876         e = NULL;
 877
 878         return 0;
 879
 880 fail:
 881         if (pam_code != PAM_SUCCESS) {
 882                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
 883                 err = -EPERM;  /* PAM errors do not map to errno */
 884         } else {
 885                 log_error("PAM failed: %m");
 886                 err = -errno;
 887         }
 888
 889         if (handle) {
 890                 if (close_session)
 891                         pam_code = pam_close_session(handle, flags);
 892
 893                 pam_end(handle, pam_code | flags);
 894         }
 895
 896         strv_free(e);
 897
 898         closelog();
 899
 900         if (pam_pid > 1) {
 901                 kill(pam_pid, SIGTERM);
 902                 kill(pam_pid, SIGCONT);
 903         }
 904
 905         return err;
 906 }
 907 #endif
 908
 909 static void rename_process_from_path(const char *path) {
 910         char process_name[11];
 911         const char *p;
 912         size_t l;
 913
 914         /* This resulting string must fit in 10 chars (i.e. the length
 915          * of "/sbin/init") to look pretty in /bin/ps */
 916
 917         p = basename(path);
 918         if (isempty(p)) {
 919                 rename_process("(...)");
 920                 return;
 921         }
 922
 923         l = strlen(p);
 924         if (l > 8) {
 925                 /* The end of the process name is usually more
 926                  * interesting, since the first bit might just be
 927                  * "systemd-" */
 928                 p = p + l - 8;
 929                 l = 8;
 930         }
 931
 932         process_name[0] = '(';
 933         memcpy(process_name+1, p, l);
 934         process_name[1+l] = ')';
 935         process_name[1+l+1] = 0;
 936
 937         rename_process(process_name);
 938 }
 939
 940 #ifdef HAVE_SECCOMP
 941
 942 static int apply_seccomp(ExecContext *c) {
 943         uint32_t negative_action, action;
 944         scmp_filter_ctx *seccomp;
 945         Iterator i;
 946         void *id;
 947         int r;
 948
 949         assert(c);
 950
 951         negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
 952
 953         seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
 954         if (!seccomp)
 955                 return -ENOMEM;
 956
 957         if (c->syscall_archs) {
 958
 959                 SET_FOREACH(id, c->syscall_archs, i) {
 960                         r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
 961                         if (r == -EEXIST)
 962                                 continue;
 963                         if (r < 0)
 964                                 goto finish;
 965                 }
 966
 967         } else {
 968                 r = seccomp_add_secondary_archs(seccomp);
 969                 if (r < 0)
 970                         goto finish;
 971         }
 972
 973         action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
 974         SET_FOREACH(id, c->syscall_filter, i) {
 975                 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
 976                 if (r < 0)
 977                         goto finish;
 978         }
 979
 980         r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
 981         if (r < 0)
 982                 goto finish;
 983
 984         r = seccomp_load(seccomp);
 985
 986 finish:
 987         seccomp_release(seccomp);
 988         return r;
 989 }
 990
 991 static int apply_address_families(ExecContext *c) {
 992         scmp_filter_ctx *seccomp;
 993         Iterator i;
 994         int r;
 995
 996         assert(c);
 997
 998         seccomp = seccomp_init(SCMP_ACT_ALLOW);
 999         if (!seccomp)
1000                 return -ENOMEM;
1001
1002         r = seccomp_add_secondary_archs(seccomp);
1003         if (r < 0)
1004                 goto finish;
1005
1006         if (c->address_families_whitelist) {
1007                 int af, first = 0, last = 0;
1008                 void *afp;
1009
1010                 /* If this is a whitelist, we first block the address
1011                  * families that are out of range and then everything
1012                  * that is not in the set. First, we find the lowest
1013                  * and highest address family in the set. */
1014
1015                 SET_FOREACH(afp, c->address_families, i) {
1016                         af = PTR_TO_INT(afp);
1017
1018                         if (af <= 0 || af >= af_max())
1019                                 continue;
1020
1021                         if (first == 0 || af < first)
1022                                 first = af;
1023
1024                         if (last == 0 || af > last)
1025                                 last = af;
1026                 }
1027
1028                 assert((first == 0) == (last == 0));
1029
1030                 if (first == 0) {
1031
1032                         /* No entries in the valid range, block everything */
1033                         r = seccomp_rule_add(
1034                                         seccomp,
1035                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1036                                         SCMP_SYS(socket),
1037                                         0);
1038                         if (r < 0)
1039                                 goto finish;
1040
1041                 } else {
1042
1043                         /* Block everything below the first entry */
1044                         r = seccomp_rule_add(
1045                                         seccomp,
1046                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1047                                         SCMP_SYS(socket),
1048                                         1,
1049                                         SCMP_A0(SCMP_CMP_LT, first));
1050                         if (r < 0)
1051                                 goto finish;
1052
1053                         /* Block everything above the last entry */
1054                         r = seccomp_rule_add(
1055                                         seccomp,
1056                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1057                                         SCMP_SYS(socket),
1058                                         1,
1059                                         SCMP_A0(SCMP_CMP_GT, last));
1060                         if (r < 0)
1061                                 goto finish;
1062
1063                         /* Block everything between the first and last
1064                          * entry */
1065                         for (af = 1; af < af_max(); af++) {
1066
1067                                 if (set_contains(c->address_families, INT_TO_PTR(af)))
1068                                         continue;
1069
1070                                 r = seccomp_rule_add(
1071                                                 seccomp,
1072                                                 SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1073                                                 SCMP_SYS(socket),
1074                                                 1,
1075                                                 SCMP_A0(SCMP_CMP_EQ, af));
1076                                 if (r < 0)
1077                                         goto finish;
1078                         }
1079                 }
1080
1081         } else {
1082                 void *af;
1083
1084                 /* If this is a blacklist, then generate one rule for
1085                  * each address family that are then combined in OR
1086                  * checks. */
1087
1088                 SET_FOREACH(af, c->address_families, i) {
1089
1090                         r = seccomp_rule_add(
1091                                         seccomp,
1092                                         SCMP_ACT_ERRNO(EPROTONOSUPPORT),
1093                                         SCMP_SYS(socket),
1094                                         1,
1095                                         SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
1096                         if (r < 0)
1097                                 goto finish;
1098                 }
1099         }
1100
1101         r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
1102         if (r < 0)
1103                 goto finish;
1104
1105         r = seccomp_load(seccomp);
1106
1107 finish:
1108         seccomp_release(seccomp);
1109         return r;
1110 }
1111
1112 #endif
1113
1114 static void do_idle_pipe_dance(int idle_pipe[4]) {
1115         assert(idle_pipe);
1116
1117
1118         safe_close(idle_pipe[1]);
1119         safe_close(idle_pipe[2]);
1120
1121         if (idle_pipe[0] >= 0) {
1122                 int r;
1123
1124                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1125
1126                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1127                         /* Signal systemd that we are bored and want to continue. */
1128                         write(idle_pipe[3], "x", 1);
1129
1130                         /* Wait for systemd to react to the signal above. */
1131                         fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1132                 }
1133
1134                 safe_close(idle_pipe[0]);
1135
1136         }
1137
1138         safe_close(idle_pipe[3]);
1139 }
1140
1141 static int build_environment(
1142                 ExecContext *c,
1143                 unsigned n_fds,
1144                 usec_t watchdog_usec,
1145                 const char *home,
1146                 const char *username,
1147                 const char *shell,
1148                 char ***ret) {
1149
1150         _cleanup_strv_free_ char **our_env = NULL;
1151         unsigned n_env = 0;
1152         char *x;
1153
1154         assert(c);
1155         assert(ret);
1156
1157         our_env = new0(char*, 10);
1158         if (!our_env)
1159                 return -ENOMEM;
1160
1161         if (n_fds > 0) {
1162                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
1163                         return -ENOMEM;
1164                 our_env[n_env++] = x;
1165
1166                 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1167                         return -ENOMEM;
1168                 our_env[n_env++] = x;
1169         }
1170
1171         if (watchdog_usec > 0) {
1172                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
1173                         return -ENOMEM;
1174                 our_env[n_env++] = x;
1175
1176                 if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, watchdog_usec) < 0)
1177                         return -ENOMEM;
1178                 our_env[n_env++] = x;
1179         }
1180
1181         if (home) {
1182                 x = strappend("HOME=", home);
1183                 if (!x)
1184                         return -ENOMEM;
1185                 our_env[n_env++] = x;
1186         }
1187
1188         if (username) {
1189                 x = strappend("LOGNAME=", username);
1190                 if (!x)
1191                         return -ENOMEM;
1192                 our_env[n_env++] = x;
1193
1194                 x = strappend("USER=", username);
1195                 if (!x)
1196                         return -ENOMEM;
1197                 our_env[n_env++] = x;
1198         }
1199
1200         if (shell) {
1201                 x = strappend("SHELL=", shell);
1202                 if (!x)
1203                         return -ENOMEM;
1204                 our_env[n_env++] = x;
1205         }
1206
1207         if (is_terminal_input(c->std_input) ||
1208             c->std_output == EXEC_OUTPUT_TTY ||
1209             c->std_error == EXEC_OUTPUT_TTY ||
1210             c->tty_path) {
1211
1212                 x = strdup(default_term_for_tty(tty_path(c)));
1213                 if (!x)
1214                         return -ENOMEM;
1215                 our_env[n_env++] = x;
1216         }
1217
1218         our_env[n_env++] = NULL;
1219         assert(n_env <= 10);
1220
1221         *ret = our_env;
1222         our_env = NULL;
1223
1224         return 0;
1225 }
1226
1227 int exec_spawn(ExecCommand *command,
1228                char **argv,
1229                ExecContext *context,
1230                int fds[], unsigned n_fds,
1231                char **environment,
1232                bool apply_permissions,
1233                bool apply_chroot,
1234                bool apply_tty_stdin,
1235                bool confirm_spawn,
1236                CGroupControllerMask cgroup_supported,
1237                const char *cgroup_path,
1238                const char *runtime_prefix,
1239                const char *unit_id,
1240                usec_t watchdog_usec,
1241                int idle_pipe[4],
1242                ExecRuntime *runtime,
1243                pid_t *ret) {
1244
1245         _cleanup_strv_free_ char **files_env = NULL;
1246         int socket_fd;
1247         char *line;
1248         pid_t pid;
1249         int r;
1250
1251         assert(command);
1252         assert(context);
1253         assert(ret);
1254         assert(fds || n_fds <= 0);
1255
1256         if (context->std_input == EXEC_INPUT_SOCKET ||
1257             context->std_output == EXEC_OUTPUT_SOCKET ||
1258             context->std_error == EXEC_OUTPUT_SOCKET) {
1259
1260                 if (n_fds != 1)
1261                         return -EINVAL;
1262
1263                 socket_fd = fds[0];
1264
1265                 fds = NULL;
1266                 n_fds = 0;
1267         } else
1268                 socket_fd = -1;
1269
1270         r = exec_context_load_environment(context, &files_env);
1271         if (r < 0) {
1272                 log_struct_unit(LOG_ERR,
1273                            unit_id,
1274                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1275                            "ERRNO=%d", -r,
1276                            NULL);
1277                 return r;
1278         }
1279
1280         if (!argv)
1281                 argv = command->argv;
1282
1283         line = exec_command_line(argv);
1284         if (!line)
1285                 return log_oom();
1286
1287         log_struct_unit(LOG_DEBUG,
1288                         unit_id,
1289                         "EXECUTABLE=%s", command->path,
1290                         "MESSAGE=About to execute: %s", line,
1291                         NULL);
1292         free(line);
1293
1294         pid = fork();
1295         if (pid < 0)
1296                 return -errno;
1297
1298         if (pid == 0) {
1299                 _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
1300                 const char *username = NULL, *home = NULL, *shell = NULL;
1301                 unsigned n_dont_close = 0;
1302                 int dont_close[n_fds + 3];
1303                 uid_t uid = (uid_t) -1;
1304                 gid_t gid = (gid_t) -1;
1305                 sigset_t ss;
1306                 int i, err;
1307
1308                 /* child */
1309
1310                 rename_process_from_path(command->path);
1311
1312                 /* We reset exactly these signals, since they are the
1313                  * only ones we set to SIG_IGN in the main daemon. All
1314                  * others we leave untouched because we set them to
1315                  * SIG_DFL or a valid handler initially, both of which
1316                  * will be demoted to SIG_DFL. */
1317                 default_signals(SIGNALS_CRASH_HANDLER,
1318                                 SIGNALS_IGNORE, -1);
1319
1320                 if (context->ignore_sigpipe)
1321                         ignore_signals(SIGPIPE, -1);
1322
1323                 assert_se(sigemptyset(&ss) == 0);
1324                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1325                         err = -errno;
1326                         r = EXIT_SIGNAL_MASK;
1327                         goto fail_child;
1328                 }
1329
1330                 if (idle_pipe)
1331                         do_idle_pipe_dance(idle_pipe);
1332
1333                 /* Close sockets very early to make sure we don't
1334                  * block init reexecution because it cannot bind its
1335                  * sockets */
1336                 log_forget_fds();
1337
1338                 if (socket_fd >= 0)
1339                         dont_close[n_dont_close++] = socket_fd;
1340                 if (n_fds > 0) {
1341                         memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1342                         n_dont_close += n_fds;
1343                 }
1344                 if (runtime) {
1345                         if (runtime->netns_storage_socket[0] >= 0)
1346                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
1347                         if (runtime->netns_storage_socket[1] >= 0)
1348                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
1349                 }
1350
1351                 err = close_all_fds(dont_close, n_dont_close);
1352                 if (err < 0) {
1353                         r = EXIT_FDS;
1354                         goto fail_child;
1355                 }
1356
1357                 if (!context->same_pgrp)
1358                         if (setsid() < 0) {
1359                                 err = -errno;
1360                                 r = EXIT_SETSID;
1361                                 goto fail_child;
1362                         }
1363
1364                 exec_context_tty_reset(context);
1365
1366                 if (confirm_spawn) {
1367                         char response;
1368
1369                         err = ask_for_confirmation(&response, argv);
1370                         if (err == -ETIMEDOUT)
1371                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1372                         else if (err < 0)
1373                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1374                         else if (response == 's') {
1375                                 write_confirm_message("Skipping execution.\n");
1376                                 err = -ECANCELED;
1377                                 r = EXIT_CONFIRM;
1378                                 goto fail_child;
1379                         } else if (response == 'n') {
1380                                 write_confirm_message("Failing execution.\n");
1381                                 err = r = 0;
1382                                 goto fail_child;
1383                         }
1384                 }
1385
1386                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1387                  * must sure to drop O_NONBLOCK */
1388                 if (socket_fd >= 0)
1389                         fd_nonblock(socket_fd, false);
1390
1391                 err = setup_input(context, socket_fd, apply_tty_stdin);
1392                 if (err < 0) {
1393                         r = EXIT_STDIN;
1394                         goto fail_child;
1395                 }
1396
1397                 err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1398                 if (err < 0) {
1399                         r = EXIT_STDOUT;
1400                         goto fail_child;
1401                 }
1402
1403                 err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1404                 if (err < 0) {
1405                         r = EXIT_STDERR;
1406                         goto fail_child;
1407                 }
1408
1409                 if (cgroup_path) {
1410                         err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
1411                         if (err < 0) {
1412                                 r = EXIT_CGROUP;
1413                                 goto fail_child;
1414                         }
1415                 }
1416
1417                 if (context->oom_score_adjust_set) {
1418                         char t[16];
1419
1420                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1421                         char_array_0(t);
1422
1423                         if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
1424                                 err = -errno;
1425                                 r = EXIT_OOM_ADJUST;
1426                                 goto fail_child;
1427                         }
1428                 }
1429
1430                 if (context->nice_set)
1431                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1432                                 err = -errno;
1433                                 r = EXIT_NICE;
1434                                 goto fail_child;
1435                         }
1436
1437                 if (context->cpu_sched_set) {
1438                         struct sched_param param = {
1439                                 .sched_priority = context->cpu_sched_priority,
1440                         };
1441
1442                         r = sched_setscheduler(0,
1443                                                context->cpu_sched_policy |
1444                                                (context->cpu_sched_reset_on_fork ?
1445                                                 SCHED_RESET_ON_FORK : 0),
1446                                                &param);
1447                         if (r < 0) {
1448                                 err = -errno;
1449                                 r = EXIT_SETSCHEDULER;
1450                                 goto fail_child;
1451                         }
1452                 }
1453
1454                 if (context->cpuset)
1455                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1456                                 err = -errno;
1457                                 r = EXIT_CPUAFFINITY;
1458                                 goto fail_child;
1459                         }
1460
1461                 if (context->ioprio_set)
1462                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1463                                 err = -errno;
1464                                 r = EXIT_IOPRIO;
1465                                 goto fail_child;
1466                         }
1467
1468                 if (context->timer_slack_nsec != NSEC_INFINITY)
1469                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1470                                 err = -errno;
1471                                 r = EXIT_TIMERSLACK;
1472                                 goto fail_child;
1473                         }
1474
1475                 if (context->personality != 0xffffffffUL)
1476                         if (personality(context->personality) < 0) {
1477                                 err = -errno;
1478                                 r = EXIT_PERSONALITY;
1479                                 goto fail_child;
1480                         }
1481
1482                 if (context->utmp_id)
1483                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1484
1485                 if (context->user) {
1486                         username = context->user;
1487                         err = get_user_creds(&username, &uid, &gid, &home, &shell);
1488                         if (err < 0) {
1489                                 r = EXIT_USER;
1490                                 goto fail_child;
1491                         }
1492
1493                         if (is_terminal_input(context->std_input)) {
1494                                 err = chown_terminal(STDIN_FILENO, uid);
1495                                 if (err < 0) {
1496                                         r = EXIT_STDIN;
1497                                         goto fail_child;
1498                                 }
1499                         }
1500                 }
1501
1502 #ifdef HAVE_PAM
1503                 if (cgroup_path && context->user && context->pam_name) {
1504                         err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
1505                         if (err < 0) {
1506                                 r = EXIT_CGROUP;
1507                                 goto fail_child;
1508                         }
1509
1510
1511                         err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
1512                         if (err < 0) {
1513                                 r = EXIT_CGROUP;
1514                                 goto fail_child;
1515                         }
1516                 }
1517 #endif
1518
1519                 if (!strv_isempty(context->runtime_directory) && runtime_prefix) {
1520                         char **rt;
1521
1522                         STRV_FOREACH(rt, context->runtime_directory) {
1523                                 _cleanup_free_ char *p;
1524
1525                                 p = strjoin(runtime_prefix, "/", *rt, NULL);
1526                                 if (!p) {
1527                                         r = EXIT_RUNTIME_DIRECTORY;
1528                                         err = -ENOMEM;
1529                                         goto fail_child;
1530                                 }
1531
1532                                 err = mkdir_safe(p, context->runtime_directory_mode, uid, gid);
1533                                 if (err < 0) {
1534                                         r = EXIT_RUNTIME_DIRECTORY;
1535                                         goto fail_child;
1536                                 }
1537                         }
1538                 }
1539
1540                 if (apply_permissions) {
1541                         err = enforce_groups(context, username, gid);
1542                         if (err < 0) {
1543                                 r = EXIT_GROUP;
1544                                 goto fail_child;
1545                         }
1546                 }
1547
1548                 umask(context->umask);
1549
1550 #ifdef HAVE_PAM
1551                 if (apply_permissions && context->pam_name && username) {
1552                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1553                         if (err < 0) {
1554                                 r = EXIT_PAM;
1555                                 goto fail_child;
1556                         }
1557                 }
1558 #endif
1559                 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
1560                         err = setup_netns(runtime->netns_storage_socket);
1561                         if (err < 0) {
1562                                 r = EXIT_NETWORK;
1563                                 goto fail_child;
1564                         }
1565                 }
1566
1567                 if (!strv_isempty(context->read_write_dirs) ||
1568                     !strv_isempty(context->read_only_dirs) ||
1569                     !strv_isempty(context->inaccessible_dirs) ||
1570                     context->mount_flags != 0 ||
1571                     (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
1572                     context->private_devices ||
1573                     context->protect_system != PROTECT_SYSTEM_NO ||
1574                     context->protect_home != PROTECT_HOME_NO) {
1575
1576                         char *tmp = NULL, *var = NULL;
1577
1578                         /* The runtime struct only contains the parent
1579                          * of the private /tmp, which is
1580                          * non-accessible to world users. Inside of it
1581                          * there's a /tmp that is sticky, and that's
1582                          * the one we want to use here. */
1583
1584                         if (context->private_tmp && runtime) {
1585                                 if (runtime->tmp_dir)
1586                                         tmp = strappenda(runtime->tmp_dir, "/tmp");
1587                                 if (runtime->var_tmp_dir)
1588                                         var = strappenda(runtime->var_tmp_dir, "/tmp");
1589                         }
1590
1591                         err = setup_namespace(
1592                                         context->read_write_dirs,
1593                                         context->read_only_dirs,
1594                                         context->inaccessible_dirs,
1595                                         tmp,
1596                                         var,
1597                                         context->private_devices,
1598                                         context->protect_home,
1599                                         context->protect_system,
1600                                         context->mount_flags);
1601                         if (err < 0) {
1602                                 r = EXIT_NAMESPACE;
1603                                 goto fail_child;
1604                         }
1605                 }
1606
1607                 if (apply_chroot) {
1608                         if (context->root_directory)
1609                                 if (chroot(context->root_directory) < 0) {
1610                                         err = -errno;
1611                                         r = EXIT_CHROOT;
1612                                         goto fail_child;
1613                                 }
1614
1615                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1616                                 err = -errno;
1617                                 r = EXIT_CHDIR;
1618                                 goto fail_child;
1619                         }
1620                 } else {
1621                         _cleanup_free_ char *d = NULL;
1622
1623                         if (asprintf(&d, "%s/%s",
1624                                      context->root_directory ? context->root_directory : "",
1625                                      context->working_directory ? context->working_directory : "") < 0) {
1626                                 err = -ENOMEM;
1627                                 r = EXIT_MEMORY;
1628                                 goto fail_child;
1629                         }
1630
1631                         if (chdir(d) < 0) {
1632                                 err = -errno;
1633                                 r = EXIT_CHDIR;
1634                                 goto fail_child;
1635                         }
1636                 }
1637
1638                 /* We repeat the fd closing here, to make sure that
1639                  * nothing is leaked from the PAM modules */
1640                 err = close_all_fds(fds, n_fds);
1641                 if (err >= 0)
1642                         err = shift_fds(fds, n_fds);
1643                 if (err >= 0)
1644                         err = flags_fds(fds, n_fds, context->non_blocking);
1645                 if (err < 0) {
1646                         r = EXIT_FDS;
1647                         goto fail_child;
1648                 }
1649
1650                 if (apply_permissions) {
1651
1652                         for (i = 0; i < _RLIMIT_MAX; i++) {
1653                                 if (!context->rlimit[i])
1654                                         continue;
1655
1656                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1657                                         err = -errno;
1658                                         r = EXIT_LIMITS;
1659                                         goto fail_child;
1660                                 }
1661                         }
1662
1663                         if (context->capability_bounding_set_drop) {
1664                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1665                                 if (err < 0) {
1666                                         r = EXIT_CAPABILITIES;
1667                                         goto fail_child;
1668                                 }
1669                         }
1670
1671                         if (context->user) {
1672                                 err = enforce_user(context, uid);
1673                                 if (err < 0) {
1674                                         r = EXIT_USER;
1675                                         goto fail_child;
1676                                 }
1677                         }
1678
1679                         /* PR_GET_SECUREBITS is not privileged, while
1680                          * PR_SET_SECUREBITS is. So to suppress
1681                          * potential EPERMs we'll try not to call
1682                          * PR_SET_SECUREBITS unless necessary. */
1683                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1684                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1685                                         err = -errno;
1686                                         r = EXIT_SECUREBITS;
1687                                         goto fail_child;
1688                                 }
1689
1690                         if (context->capabilities)
1691                                 if (cap_set_proc(context->capabilities) < 0) {
1692                                         err = -errno;
1693                                         r = EXIT_CAPABILITIES;
1694                                         goto fail_child;
1695                                 }
1696
1697                         if (context->no_new_privileges)
1698                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1699                                         err = -errno;
1700                                         r = EXIT_NO_NEW_PRIVILEGES;
1701                                         goto fail_child;
1702                                 }
1703
1704 #ifdef HAVE_SECCOMP
1705                         if (context->address_families_whitelist ||
1706                             !set_isempty(context->address_families)) {
1707                                 err = apply_address_families(context);
1708                                 if (err < 0) {
1709                                         r = EXIT_ADDRESS_FAMILIES;
1710                                         goto fail_child;
1711                                 }
1712                         }
1713
1714                         if (context->syscall_whitelist ||
1715                             !set_isempty(context->syscall_filter) ||
1716                             !set_isempty(context->syscall_archs)) {
1717                                 err = apply_seccomp(context);
1718                                 if (err < 0) {
1719                                         r = EXIT_SECCOMP;
1720                                         goto fail_child;
1721                                 }
1722                         }
1723 #endif
1724
1725 #ifdef HAVE_SELINUX
1726                         if (context->selinux_context && use_selinux()) {
1727                                 err = setexeccon(context->selinux_context);
1728                                 if (err < 0 && !context->selinux_context_ignore) {
1729                                         r = EXIT_SELINUX_CONTEXT;
1730                                         goto fail_child;
1731                                 }
1732                         }
1733
1734                         if (context->selinux_label_via_net && use_selinux()) {
1735                                 _cleanup_free_ char *label = NULL;
1736
1737                                 err = label_get_child_label(socket_fd, command->path, &label);
1738                                 if (err < 0) {
1739                                         r = EXIT_SELINUX_CONTEXT;
1740                                         goto fail_child;
1741                                 }
1742
1743                                 err = setexeccon(label);
1744                                 if (err < 0) {
1745                                         r = EXIT_SELINUX_CONTEXT;
1746                                         goto fail_child;
1747                                 }
1748                         }
1749 #endif
1750
1751 #ifdef HAVE_APPARMOR
1752                         if (context->apparmor_profile && use_apparmor()) {
1753                                 err = aa_change_onexec(context->apparmor_profile);
1754                                 if (err < 0 && !context->apparmor_profile_ignore) {
1755                                         r = EXIT_APPARMOR_PROFILE;
1756                                         goto fail_child;
1757                                 }
1758                         }
1759 #endif
1760                 }
1761
1762                 err = build_environment(context, n_fds, watchdog_usec, home, username, shell, &our_env);
1763                 if (r < 0) {
1764                         r = EXIT_MEMORY;
1765                         goto fail_child;
1766                 }
1767
1768                 final_env = strv_env_merge(5,
1769                                            environment,
1770                                            our_env,
1771                                            context->environment,
1772                                            files_env,
1773                                            pam_env,
1774                                            NULL);
1775                 if (!final_env) {
1776                         err = -ENOMEM;
1777                         r = EXIT_MEMORY;
1778                         goto fail_child;
1779                 }
1780
1781                 final_argv = replace_env_argv(argv, final_env);
1782                 if (!final_argv) {
1783                         err = -ENOMEM;
1784                         r = EXIT_MEMORY;
1785                         goto fail_child;
1786                 }
1787
1788                 final_env = strv_env_clean(final_env);
1789
1790                 if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
1791                         line = exec_command_line(final_argv);
1792                         if (line) {
1793                                 log_open();
1794                                 log_struct_unit(LOG_DEBUG,
1795                                                 unit_id,
1796                                                 "EXECUTABLE=%s", command->path,
1797                                                 "MESSAGE=Executing: %s", line,
1798                                                 NULL);
1799                                 log_close();
1800                                 free(line);
1801                                 line = NULL;
1802                         }
1803                 }
1804                 execve(command->path, final_argv, final_env);
1805                 err = -errno;
1806                 r = EXIT_EXEC;
1807
1808         fail_child:
1809                 if (r != 0) {
1810                         log_open();
1811                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1812                                    "EXECUTABLE=%s", command->path,
1813                                    "MESSAGE=Failed at step %s spawning %s: %s",
1814                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1815                                           command->path, strerror(-err),
1816                                    "ERRNO=%d", -err,
1817                                    NULL);
1818                         log_close();
1819                 }
1820
1821                 _exit(r);
1822         }
1823
1824         log_struct_unit(LOG_DEBUG,
1825                         unit_id,
1826                         "MESSAGE=Forked %s as "PID_FMT,
1827                         command->path, pid,
1828                         NULL);
1829
1830         /* We add the new process to the cgroup both in the child (so
1831          * that we can be sure that no user code is ever executed
1832          * outside of the cgroup) and in the parent (so that we can be
1833          * sure that when we kill the cgroup the process will be
1834          * killed too). */
1835         if (cgroup_path)
1836                 cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
1837
1838         exec_status_start(&command->exec_status, pid);
1839
1840         *ret = pid;
1841         return 0;
1842 }
1843
1844 void exec_context_init(ExecContext *c) {
1845         assert(c);
1846
1847         c->umask = 0022;
1848         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1849         c->cpu_sched_policy = SCHED_OTHER;
1850         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1851         c->syslog_level_prefix = true;
1852         c->ignore_sigpipe = true;
1853         c->timer_slack_nsec = NSEC_INFINITY;
1854         c->personality = 0xffffffffUL;
1855         c->runtime_directory_mode = 0755;
1856 }
1857
1858 void exec_context_done(ExecContext *c) {
1859         unsigned l;
1860
1861         assert(c);
1862
1863         strv_free(c->environment);
1864         c->environment = NULL;
1865
1866         strv_free(c->environment_files);
1867         c->environment_files = NULL;
1868
1869         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1870                 free(c->rlimit[l]);
1871                 c->rlimit[l] = NULL;
1872         }
1873
1874         free(c->working_directory);
1875         c->working_directory = NULL;
1876         free(c->root_directory);
1877         c->root_directory = NULL;
1878
1879         free(c->tty_path);
1880         c->tty_path = NULL;
1881
1882         free(c->syslog_identifier);
1883         c->syslog_identifier = NULL;
1884
1885         free(c->user);
1886         c->user = NULL;
1887
1888         free(c->group);
1889         c->group = NULL;
1890
1891         strv_free(c->supplementary_groups);
1892         c->supplementary_groups = NULL;
1893
1894         free(c->pam_name);
1895         c->pam_name = NULL;
1896
1897         if (c->capabilities) {
1898                 cap_free(c->capabilities);
1899                 c->capabilities = NULL;
1900         }
1901
1902         strv_free(c->read_only_dirs);
1903         c->read_only_dirs = NULL;
1904
1905         strv_free(c->read_write_dirs);
1906         c->read_write_dirs = NULL;
1907
1908         strv_free(c->inaccessible_dirs);
1909         c->inaccessible_dirs = NULL;
1910
1911         if (c->cpuset)
1912                 CPU_FREE(c->cpuset);
1913
1914         free(c->utmp_id);
1915         c->utmp_id = NULL;
1916
1917         free(c->selinux_context);
1918         c->selinux_context = NULL;
1919
1920         free(c->apparmor_profile);
1921         c->apparmor_profile = NULL;
1922
1923         set_free(c->syscall_filter);
1924         c->syscall_filter = NULL;
1925
1926         set_free(c->syscall_archs);
1927         c->syscall_archs = NULL;
1928
1929         set_free(c->address_families);
1930         c->address_families = NULL;
1931
1932         strv_free(c->runtime_directory);
1933         c->runtime_directory = NULL;
1934 }
1935
1936 int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
1937         char **i;
1938
1939         assert(c);
1940
1941         if (!runtime_prefix)
1942                 return 0;
1943
1944         STRV_FOREACH(i, c->runtime_directory) {
1945                 _cleanup_free_ char *p;
1946
1947                 p = strjoin(runtime_prefix, "/", *i, NULL);
1948                 if (!p)
1949                         return -ENOMEM;
1950
1951                 /* We execute this synchronously, since we need to be
1952                  * sure this is gone when we start the service
1953                  * next. */
1954                 rm_rf_dangerous(p, false, true, false);
1955         }
1956
1957         return 0;
1958 }
1959
1960 void exec_command_done(ExecCommand *c) {
1961         assert(c);
1962
1963         free(c->path);
1964         c->path = NULL;
1965
1966         strv_free(c->argv);
1967         c->argv = NULL;
1968 }
1969
1970 void exec_command_done_array(ExecCommand *c, unsigned n) {
1971         unsigned i;
1972
1973         for (i = 0; i < n; i++)
1974                 exec_command_done(c+i);
1975 }
1976
1977 void exec_command_free_list(ExecCommand *c) {
1978         ExecCommand *i;
1979
1980         while ((i = c)) {
1981                 LIST_REMOVE(command, c, i);
1982                 exec_command_done(i);
1983                 free(i);
1984         }
1985 }
1986
1987 void exec_command_free_array(ExecCommand **c, unsigned n) {
1988         unsigned i;
1989
1990         for (i = 0; i < n; i++) {
1991                 exec_command_free_list(c[i]);
1992                 c[i] = NULL;
1993         }
1994 }
1995
1996 int exec_context_load_environment(const ExecContext *c, char ***l) {
1997         char **i, **r = NULL;
1998
1999         assert(c);
2000         assert(l);
2001
2002         STRV_FOREACH(i, c->environment_files) {
2003                 char *fn;
2004                 int k;
2005                 bool ignore = false;
2006                 char **p;
2007                 _cleanup_globfree_ glob_t pglob = {};
2008                 int count, n;
2009
2010                 fn = *i;
2011
2012                 if (fn[0] == '-') {
2013                         ignore = true;
2014                         fn ++;
2015                 }
2016
2017                 if (!path_is_absolute(fn)) {
2018                         if (ignore)
2019                                 continue;
2020
2021                         strv_free(r);
2022                         return -EINVAL;
2023                 }
2024
2025                 /* Filename supports globbing, take all matching files */
2026                 errno = 0;
2027                 if (glob(fn, 0, NULL, &pglob) != 0) {
2028                         if (ignore)
2029                                 continue;
2030
2031                         strv_free(r);
2032                         return errno ? -errno : -EINVAL;
2033                 }
2034                 count = pglob.gl_pathc;
2035                 if (count == 0) {
2036                         if (ignore)
2037                                 continue;
2038
2039                         strv_free(r);
2040                         return -EINVAL;
2041                 }
2042                 for (n = 0; n < count; n++) {
2043                         k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
2044                         if (k < 0) {
2045                                 if (ignore)
2046                                         continue;
2047
2048                                 strv_free(r);
2049                                 return k;
2050                         }
2051                         /* Log invalid environment variables with filename */
2052                         if (p)
2053                                 p = strv_env_clean_log(p, pglob.gl_pathv[n]);
2054
2055                         if (r == NULL)
2056                                 r = p;
2057                         else {
2058                                 char **m;
2059
2060                                 m = strv_env_merge(2, r, p);
2061                                 strv_free(r);
2062                                 strv_free(p);
2063                                 if (!m)
2064                                         return -ENOMEM;
2065
2066                                 r = m;
2067                         }
2068                 }
2069         }
2070
2071         *l = r;
2072
2073         return 0;
2074 }
2075
2076 static bool tty_may_match_dev_console(const char *tty) {
2077         _cleanup_free_ char *active = NULL;
2078        char *console;
2079
2080         if (startswith(tty, "/dev/"))
2081                 tty += 5;
2082
2083         /* trivial identity? */
2084         if (streq(tty, "console"))
2085                 return true;
2086
2087         console = resolve_dev_console(&active);
2088         /* if we could not resolve, assume it may */
2089         if (!console)
2090                 return true;
2091
2092         /* "tty0" means the active VC, so it may be the same sometimes */
2093         return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
2094 }
2095
2096 bool exec_context_may_touch_console(ExecContext *ec) {
2097         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
2098                 is_terminal_input(ec->std_input) ||
2099                 is_terminal_output(ec->std_output) ||
2100                 is_terminal_output(ec->std_error)) &&
2101                tty_may_match_dev_console(tty_path(ec));
2102 }
2103
2104 static void strv_fprintf(FILE *f, char **l) {
2105         char **g;
2106
2107         assert(f);
2108
2109         STRV_FOREACH(g, l)
2110                 fprintf(f, " %s", *g);
2111 }
2112
2113 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
2114         char **e;
2115         unsigned i;
2116
2117         assert(c);
2118         assert(f);
2119
2120         prefix = strempty(prefix);
2121
2122         fprintf(f,
2123                 "%sUMask: %04o\n"
2124                 "%sWorkingDirectory: %s\n"
2125                 "%sRootDirectory: %s\n"
2126                 "%sNonBlocking: %s\n"
2127                 "%sPrivateTmp: %s\n"
2128                 "%sPrivateNetwork: %s\n"
2129                 "%sPrivateDevices: %s\n"
2130                 "%sProtectHome: %s\n"
2131                 "%sProtectSystem: %s\n"
2132                 "%sIgnoreSIGPIPE: %s\n"
2133                 "%sSELinuxLabelViaNet: %s\n",
2134                 prefix, c->umask,
2135                 prefix, c->working_directory ? c->working_directory : "/",
2136                 prefix, c->root_directory ? c->root_directory : "/",
2137                 prefix, yes_no(c->non_blocking),
2138                 prefix, yes_no(c->private_tmp),
2139                 prefix, yes_no(c->private_network),
2140                 prefix, yes_no(c->private_devices),
2141                 prefix, protect_home_to_string(c->protect_home),
2142                 prefix, protect_system_to_string(c->protect_system),
2143                 prefix, yes_no(c->ignore_sigpipe),
2144                 prefix, yes_no(c->selinux_label_via_net));
2145
2146         STRV_FOREACH(e, c->environment)
2147                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
2148
2149         STRV_FOREACH(e, c->environment_files)
2150                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
2151
2152         if (c->nice_set)
2153                 fprintf(f,
2154                         "%sNice: %i\n",
2155                         prefix, c->nice);
2156
2157         if (c->oom_score_adjust_set)
2158                 fprintf(f,
2159                         "%sOOMScoreAdjust: %i\n",
2160                         prefix, c->oom_score_adjust);
2161
2162         for (i = 0; i < RLIM_NLIMITS; i++)
2163                 if (c->rlimit[i])
2164                         fprintf(f, "%s%s: "RLIM_FMT"\n",
2165                                 prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
2166
2167         if (c->ioprio_set) {
2168                 _cleanup_free_ char *class_str = NULL;
2169
2170                 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
2171                 fprintf(f,
2172                         "%sIOSchedulingClass: %s\n"
2173                         "%sIOPriority: %i\n",
2174                         prefix, strna(class_str),
2175                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
2176         }
2177
2178         if (c->cpu_sched_set) {
2179                 _cleanup_free_ char *policy_str = NULL;
2180
2181                 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
2182                 fprintf(f,
2183                         "%sCPUSchedulingPolicy: %s\n"
2184                         "%sCPUSchedulingPriority: %i\n"
2185                         "%sCPUSchedulingResetOnFork: %s\n",
2186                         prefix, strna(policy_str),
2187                         prefix, c->cpu_sched_priority,
2188                         prefix, yes_no(c->cpu_sched_reset_on_fork));
2189         }
2190
2191         if (c->cpuset) {
2192                 fprintf(f, "%sCPUAffinity:", prefix);
2193                 for (i = 0; i < c->cpuset_ncpus; i++)
2194                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
2195                                 fprintf(f, " %u", i);
2196                 fputs("\n", f);
2197         }
2198
2199         if (c->timer_slack_nsec != NSEC_INFINITY)
2200                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
2201
2202         fprintf(f,
2203                 "%sStandardInput: %s\n"
2204                 "%sStandardOutput: %s\n"
2205                 "%sStandardError: %s\n",
2206                 prefix, exec_input_to_string(c->std_input),
2207                 prefix, exec_output_to_string(c->std_output),
2208                 prefix, exec_output_to_string(c->std_error));
2209
2210         if (c->tty_path)
2211                 fprintf(f,
2212                         "%sTTYPath: %s\n"
2213                         "%sTTYReset: %s\n"
2214                         "%sTTYVHangup: %s\n"
2215                         "%sTTYVTDisallocate: %s\n",
2216                         prefix, c->tty_path,
2217                         prefix, yes_no(c->tty_reset),
2218                         prefix, yes_no(c->tty_vhangup),
2219                         prefix, yes_no(c->tty_vt_disallocate));
2220
2221         if (c->std_output == EXEC_OUTPUT_SYSLOG ||
2222             c->std_output == EXEC_OUTPUT_KMSG ||
2223             c->std_output == EXEC_OUTPUT_JOURNAL ||
2224             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2225             c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2226             c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
2227             c->std_error == EXEC_OUTPUT_SYSLOG ||
2228             c->std_error == EXEC_OUTPUT_KMSG ||
2229             c->std_error == EXEC_OUTPUT_JOURNAL ||
2230             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2231             c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2232             c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
2233
2234                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
2235
2236                 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
2237                 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
2238
2239                 fprintf(f,
2240                         "%sSyslogFacility: %s\n"
2241                         "%sSyslogLevel: %s\n",
2242                         prefix, strna(fac_str),
2243                         prefix, strna(lvl_str));
2244         }
2245
2246         if (c->capabilities) {
2247                 _cleanup_cap_free_charp_ char *t;
2248
2249                 t = cap_to_text(c->capabilities, NULL);
2250                 if (t)
2251                         fprintf(f, "%sCapabilities: %s\n", prefix, t);
2252         }
2253
2254         if (c->secure_bits)
2255                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
2256                         prefix,
2257                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
2258                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
2259                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
2260                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
2261                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
2262                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
2263
2264         if (c->capability_bounding_set_drop) {
2265                 unsigned long l;
2266                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
2267
2268                 for (l = 0; l <= cap_last_cap(); l++)
2269                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
2270                                 _cleanup_cap_free_charp_ char *t;
2271
2272                                 t = cap_to_name(l);
2273                                 if (t)
2274                                         fprintf(f, " %s", t);
2275                         }
2276
2277                 fputs("\n", f);
2278         }
2279
2280         if (c->user)
2281                 fprintf(f, "%sUser: %s\n", prefix, c->user);
2282         if (c->group)
2283                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
2284
2285         if (strv_length(c->supplementary_groups) > 0) {
2286                 fprintf(f, "%sSupplementaryGroups:", prefix);
2287                 strv_fprintf(f, c->supplementary_groups);
2288                 fputs("\n", f);
2289         }
2290
2291         if (c->pam_name)
2292                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
2293
2294         if (strv_length(c->read_write_dirs) > 0) {
2295                 fprintf(f, "%sReadWriteDirs:", prefix);
2296                 strv_fprintf(f, c->read_write_dirs);
2297                 fputs("\n", f);
2298         }
2299
2300         if (strv_length(c->read_only_dirs) > 0) {
2301                 fprintf(f, "%sReadOnlyDirs:", prefix);
2302                 strv_fprintf(f, c->read_only_dirs);
2303                 fputs("\n", f);
2304         }
2305
2306         if (strv_length(c->inaccessible_dirs) > 0) {
2307                 fprintf(f, "%sInaccessibleDirs:", prefix);
2308                 strv_fprintf(f, c->inaccessible_dirs);
2309                 fputs("\n", f);
2310         }
2311
2312         if (c->utmp_id)
2313                 fprintf(f,
2314                         "%sUtmpIdentifier: %s\n",
2315                         prefix, c->utmp_id);
2316
2317         if (c->selinux_context)
2318                 fprintf(f,
2319                         "%sSELinuxContext: %s%s\n",
2320                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
2321
2322         if (c->personality != 0xffffffffUL)
2323                 fprintf(f,
2324                         "%sPersonality: %s\n",
2325                         prefix, strna(personality_to_string(c->personality)));
2326
2327         if (c->syscall_filter) {
2328 #ifdef HAVE_SECCOMP
2329                 Iterator j;
2330                 void *id;
2331                 bool first = true;
2332 #endif
2333
2334                 fprintf(f,
2335                         "%sSystemCallFilter: ",
2336                         prefix);
2337
2338                 if (!c->syscall_whitelist)
2339                         fputc('~', f);
2340
2341 #ifdef HAVE_SECCOMP
2342                 SET_FOREACH(id, c->syscall_filter, j) {
2343                         _cleanup_free_ char *name = NULL;
2344
2345                         if (first)
2346                                 first = false;
2347                         else
2348                                 fputc(' ', f);
2349
2350                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
2351                         fputs(strna(name), f);
2352                 }
2353 #endif
2354
2355                 fputc('\n', f);
2356         }
2357
2358         if (c->syscall_archs) {
2359 #ifdef HAVE_SECCOMP
2360                 Iterator j;
2361                 void *id;
2362 #endif
2363
2364                 fprintf(f,
2365                         "%sSystemCallArchitectures:",
2366                         prefix);
2367
2368 #ifdef HAVE_SECCOMP
2369                 SET_FOREACH(id, c->syscall_archs, j)
2370                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
2371 #endif
2372                 fputc('\n', f);
2373         }
2374
2375         if (c->syscall_errno != 0)
2376                 fprintf(f,
2377                         "%sSystemCallErrorNumber: %s\n",
2378                         prefix, strna(errno_to_name(c->syscall_errno)));
2379
2380         if (c->apparmor_profile)
2381                 fprintf(f,
2382                         "%sAppArmorProfile: %s%s\n",
2383                         prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
2384 }
2385
2386 void exec_status_start(ExecStatus *s, pid_t pid) {
2387         assert(s);
2388
2389         zero(*s);
2390         s->pid = pid;
2391         dual_timestamp_get(&s->start_timestamp);
2392 }
2393
2394 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2395         assert(s);
2396
2397         if (s->pid && s->pid != pid)
2398                 zero(*s);
2399
2400         s->pid = pid;
2401         dual_timestamp_get(&s->exit_timestamp);
2402
2403         s->code = code;
2404         s->status = status;
2405
2406         if (context) {
2407                 if (context->utmp_id)
2408                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2409
2410                 exec_context_tty_reset(context);
2411         }
2412 }
2413
2414 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2415         char buf[FORMAT_TIMESTAMP_MAX];
2416
2417         assert(s);
2418         assert(f);
2419
2420         if (!prefix)
2421                 prefix = "";
2422
2423         if (s->pid <= 0)
2424                 return;
2425
2426         fprintf(f,
2427                 "%sPID: "PID_FMT"\n",
2428                 prefix, s->pid);
2429
2430         if (s->start_timestamp.realtime > 0)
2431                 fprintf(f,
2432                         "%sStart Timestamp: %s\n",
2433                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2434
2435         if (s->exit_timestamp.realtime > 0)
2436                 fprintf(f,
2437                         "%sExit Timestamp: %s\n"
2438                         "%sExit Code: %s\n"
2439                         "%sExit Status: %i\n",
2440                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2441                         prefix, sigchld_code_to_string(s->code),
2442                         prefix, s->status);
2443 }
2444
2445 char *exec_command_line(char **argv) {
2446         size_t k;
2447         char *n, *p, **a;
2448         bool first = true;
2449
2450         assert(argv);
2451
2452         k = 1;
2453         STRV_FOREACH(a, argv)
2454                 k += strlen(*a)+3;
2455
2456         if (!(n = new(char, k)))
2457                 return NULL;
2458
2459         p = n;
2460         STRV_FOREACH(a, argv) {
2461
2462                 if (!first)
2463                         *(p++) = ' ';
2464                 else
2465                         first = false;
2466
2467                 if (strpbrk(*a, WHITESPACE)) {
2468                         *(p++) = '\'';
2469                         p = stpcpy(p, *a);
2470                         *(p++) = '\'';
2471                 } else
2472                         p = stpcpy(p, *a);
2473
2474         }
2475
2476         *p = 0;
2477
2478         /* FIXME: this doesn't really handle arguments that have
2479          * spaces and ticks in them */
2480
2481         return n;
2482 }
2483
2484 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2485         _cleanup_free_ char *p2 = NULL;
2486         const char *prefix2;
2487
2488         _cleanup_free_ char *cmd = NULL;
2489
2490         assert(c);
2491         assert(f);
2492
2493         if (!prefix)
2494                 prefix = "";
2495         p2 = strappend(prefix, "\t");
2496         prefix2 = p2 ? p2 : prefix;
2497
2498         cmd = exec_command_line(c->argv);
2499
2500         fprintf(f,
2501                 "%sCommand Line: %s\n",
2502                 prefix, cmd ? cmd : strerror(ENOMEM));
2503
2504         exec_status_dump(&c->exec_status, f, prefix2);
2505 }
2506
2507 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2508         assert(f);
2509
2510         if (!prefix)
2511                 prefix = "";
2512
2513         LIST_FOREACH(command, c, c)
2514                 exec_command_dump(c, f, prefix);
2515 }
2516
2517 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2518         ExecCommand *end;
2519
2520         assert(l);
2521         assert(e);
2522
2523         if (*l) {
2524                 /* It's kind of important, that we keep the order here */
2525                 LIST_FIND_TAIL(command, *l, end);
2526                 LIST_INSERT_AFTER(command, *l, end, e);
2527         } else
2528               *l = e;
2529 }
2530
2531 int exec_command_set(ExecCommand *c, const char *path, ...) {
2532         va_list ap;
2533         char **l, *p;
2534
2535         assert(c);
2536         assert(path);
2537
2538         va_start(ap, path);
2539         l = strv_new_ap(path, ap);
2540         va_end(ap);
2541
2542         if (!l)
2543                 return -ENOMEM;
2544
2545         p = strdup(path);
2546         if (!p) {
2547                 strv_free(l);
2548                 return -ENOMEM;
2549         }
2550
2551         free(c->path);
2552         c->path = p;
2553
2554         strv_free(c->argv);
2555         c->argv = l;
2556
2557         return 0;
2558 }
2559
2560 static int exec_runtime_allocate(ExecRuntime **rt) {
2561
2562         if (*rt)
2563                 return 0;
2564
2565         *rt = new0(ExecRuntime, 1);
2566         if (!*rt)
2567                 return -ENOMEM;
2568
2569         (*rt)->n_ref = 1;
2570         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
2571
2572         return 0;
2573 }
2574
2575 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
2576         int r;
2577
2578         assert(rt);
2579         assert(c);
2580         assert(id);
2581
2582         if (*rt)
2583                 return 1;
2584
2585         if (!c->private_network && !c->private_tmp)
2586                 return 0;
2587
2588         r = exec_runtime_allocate(rt);
2589         if (r < 0)
2590                 return r;
2591
2592         if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
2593                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
2594                         return -errno;
2595         }
2596
2597         if (c->private_tmp && !(*rt)->tmp_dir) {
2598                 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
2599                 if (r < 0)
2600                         return r;
2601         }
2602
2603         return 1;
2604 }
2605
2606 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
2607         assert(r);
2608         assert(r->n_ref > 0);
2609
2610         r->n_ref++;
2611         return r;
2612 }
2613
2614 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
2615
2616         if (!r)
2617                 return NULL;
2618
2619         assert(r->n_ref > 0);
2620
2621         r->n_ref--;
2622         if (r->n_ref <= 0) {
2623                 free(r->tmp_dir);
2624                 free(r->var_tmp_dir);
2625                 safe_close_pair(r->netns_storage_socket);
2626                 free(r);
2627         }
2628
2629         return NULL;
2630 }
2631
2632 int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds) {
2633         assert(u);
2634         assert(f);
2635         assert(fds);
2636
2637         if (!rt)
2638                 return 0;
2639
2640         if (rt->tmp_dir)
2641                 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
2642
2643         if (rt->var_tmp_dir)
2644                 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
2645
2646         if (rt->netns_storage_socket[0] >= 0) {
2647                 int copy;
2648
2649                 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
2650                 if (copy < 0)
2651                         return copy;
2652
2653                 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
2654         }
2655
2656         if (rt->netns_storage_socket[1] >= 0) {
2657                 int copy;
2658
2659                 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
2660                 if (copy < 0)
2661                         return copy;
2662
2663                 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
2664         }
2665
2666         return 0;
2667 }
2668
2669 int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds) {
2670         int r;
2671
2672         assert(rt);
2673         assert(key);
2674         assert(value);
2675
2676         if (streq(key, "tmp-dir")) {
2677                 char *copy;
2678
2679                 r = exec_runtime_allocate(rt);
2680                 if (r < 0)
2681                         return r;
2682
2683                 copy = strdup(value);
2684                 if (!copy)
2685                         return log_oom();
2686
2687                 free((*rt)->tmp_dir);
2688                 (*rt)->tmp_dir = copy;
2689
2690         } else if (streq(key, "var-tmp-dir")) {
2691                 char *copy;
2692
2693                 r = exec_runtime_allocate(rt);
2694                 if (r < 0)
2695                         return r;
2696
2697                 copy = strdup(value);
2698                 if (!copy)
2699                         return log_oom();
2700
2701                 free((*rt)->var_tmp_dir);
2702                 (*rt)->var_tmp_dir = copy;
2703
2704         } else if (streq(key, "netns-socket-0")) {
2705                 int fd;
2706
2707                 r = exec_runtime_allocate(rt);
2708                 if (r < 0)
2709                         return r;
2710
2711                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2712                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2713                 else {
2714                         safe_close((*rt)->netns_storage_socket[0]);
2715                         (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
2716                 }
2717         } else if (streq(key, "netns-socket-1")) {
2718                 int fd;
2719
2720                 r = exec_runtime_allocate(rt);
2721                 if (r < 0)
2722                         return r;
2723
2724                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2725                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2726                 else {
2727                         safe_close((*rt)->netns_storage_socket[1]);
2728                         (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
2729                 }
2730         } else
2731                 return 0;
2732
2733         return 1;
2734 }
2735
2736 static void *remove_tmpdir_thread(void *p) {
2737         _cleanup_free_ char *path = p;
2738
2739         rm_rf_dangerous(path, false, true, false);
2740         return NULL;
2741 }
2742
2743 void exec_runtime_destroy(ExecRuntime *rt) {
2744         int r;
2745
2746         if (!rt)
2747                 return;
2748
2749         /* If there are multiple users of this, let's leave the stuff around */
2750         if (rt->n_ref > 1)
2751                 return;
2752
2753         if (rt->tmp_dir) {
2754                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
2755
2756                 r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
2757                 if (r < 0) {
2758                         log_warning("Failed to nuke %s: %s", rt->tmp_dir, strerror(-r));
2759                         free(rt->tmp_dir);
2760                 }
2761
2762                 rt->tmp_dir = NULL;
2763         }
2764
2765         if (rt->var_tmp_dir) {
2766                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
2767
2768                 r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
2769                 if (r < 0) {
2770                         log_warning("Failed to nuke %s: %s", rt->var_tmp_dir, strerror(-r));
2771                         free(rt->var_tmp_dir);
2772                 }
2773
2774                 rt->var_tmp_dir = NULL;
2775         }
2776
2777         safe_close_pair(rt->netns_storage_socket);
2778 }
2779
2780 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2781         [EXEC_INPUT_NULL] = "null",
2782         [EXEC_INPUT_TTY] = "tty",
2783         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2784         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2785         [EXEC_INPUT_SOCKET] = "socket"
2786 };
2787
2788 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2789
2790 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2791         [EXEC_OUTPUT_INHERIT] = "inherit",
2792         [EXEC_OUTPUT_NULL] = "null",
2793         [EXEC_OUTPUT_TTY] = "tty",
2794         [EXEC_OUTPUT_SYSLOG] = "syslog",
2795         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2796         [EXEC_OUTPUT_KMSG] = "kmsg",
2797         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2798         [EXEC_OUTPUT_JOURNAL] = "journal",
2799         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2800         [EXEC_OUTPUT_SOCKET] = "socket"
2801 };
2802
2803 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);