src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41
  42 #ifdef HAVE_PAM
  43 #include <security/pam_appl.h>
  44 #endif
  45
  46 #include "execute.h"
  47 #include "strv.h"
  48 #include "macro.h"
  49 #include "capability.h"
  50 #include "util.h"
  51 #include "log.h"
  52 #include "ioprio.h"
  53 #include "securebits.h"
  54 #include "cgroup.h"
  55 #include "namespace.h"
  56 #include "tcpwrap.h"
  57 #include "exit-status.h"
  58 #include "missing.h"
  59 #include "utmp-wtmp.h"
  60 #include "def.h"
  61 #include "loopback-setup.h"
  62 #include "path-util.h"
  63
  64 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  65
  66 /* This assumes there is a 'tty' group */
  67 #define TTY_MODE 0620
  68
  69 static int shift_fds(int fds[], unsigned n_fds) {
  70         int start, restart_from;
  71
  72         if (n_fds <= 0)
  73                 return 0;
  74
  75         /* Modifies the fds array! (sorts it) */
  76
  77         assert(fds);
  78
  79         start = 0;
  80         for (;;) {
  81                 int i;
  82
  83                 restart_from = -1;
  84
  85                 for (i = start; i < (int) n_fds; i++) {
  86                         int nfd;
  87
  88                         /* Already at right index? */
  89                         if (fds[i] == i+3)
  90                                 continue;
  91
  92                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
  93                                 return -errno;
  94
  95                         close_nointr_nofail(fds[i]);
  96                         fds[i] = nfd;
  97
  98                         /* Hmm, the fd we wanted isn't free? Then
  99                          * let's remember that and try again from here*/
 100                         if (nfd != i+3 && restart_from < 0)
 101                                 restart_from = i;
 102                 }
 103
 104                 if (restart_from < 0)
 105                         break;
 106
 107                 start = restart_from;
 108         }
 109
 110         return 0;
 111 }
 112
 113 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 114         unsigned i;
 115         int r;
 116
 117         if (n_fds <= 0)
 118                 return 0;
 119
 120         assert(fds);
 121
 122         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 123
 124         for (i = 0; i < n_fds; i++) {
 125
 126                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 127                         return r;
 128
 129                 /* We unconditionally drop FD_CLOEXEC from the fds,
 130                  * since after all we want to pass these fds to our
 131                  * children */
 132
 133                 if ((r = fd_cloexec(fds[i], false)) < 0)
 134                         return r;
 135         }
 136
 137         return 0;
 138 }
 139
 140 static const char *tty_path(const ExecContext *context) {
 141         assert(context);
 142
 143         if (context->tty_path)
 144                 return context->tty_path;
 145
 146         return "/dev/console";
 147 }
 148
 149 void exec_context_tty_reset(const ExecContext *context) {
 150         assert(context);
 151
 152         if (context->tty_vhangup)
 153                 terminal_vhangup(tty_path(context));
 154
 155         if (context->tty_reset)
 156                 reset_terminal(tty_path(context));
 157
 158         if (context->tty_vt_disallocate && context->tty_path)
 159                 vt_disallocate(context->tty_path);
 160 }
 161
 162 static int open_null_as(int flags, int nfd) {
 163         int fd, r;
 164
 165         assert(nfd >= 0);
 166
 167         if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
 168                 return -errno;
 169
 170         if (fd != nfd) {
 171                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 172                 close_nointr_nofail(fd);
 173         } else
 174                 r = nfd;
 175
 176         return r;
 177 }
 178
 179 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, int nfd) {
 180         int fd, r;
 181         union sockaddr_union sa;
 182
 183         assert(context);
 184         assert(output < _EXEC_OUTPUT_MAX);
 185         assert(ident);
 186         assert(nfd >= 0);
 187
 188         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 189         if (fd < 0)
 190                 return -errno;
 191
 192         zero(sa);
 193         sa.un.sun_family = AF_UNIX;
 194         strncpy(sa.un.sun_path, "/run/systemd/journal/stdout", sizeof(sa.un.sun_path));
 195
 196         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 197         if (r < 0) {
 198                 close_nointr_nofail(fd);
 199                 return -errno;
 200         }
 201
 202         if (shutdown(fd, SHUT_RD) < 0) {
 203                 close_nointr_nofail(fd);
 204                 return -errno;
 205         }
 206
 207         dprintf(fd,
 208                 "%s\n"
 209                 "%i\n"
 210                 "%i\n"
 211                 "%i\n"
 212                 "%i\n"
 213                 "%i\n",
 214                 context->syslog_identifier ? context->syslog_identifier : ident,
 215                 context->syslog_priority,
 216                 !!context->syslog_level_prefix,
 217                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 218                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 219                 output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || output == EXEC_OUTPUT_KMSG_AND_CONSOLE || output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 220
 221         if (fd != nfd) {
 222                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 223                 close_nointr_nofail(fd);
 224         } else
 225                 r = nfd;
 226
 227         return r;
 228 }
 229 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 230         int fd, r;
 231
 232         assert(path);
 233         assert(nfd >= 0);
 234
 235         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 236                 return fd;
 237
 238         if (fd != nfd) {
 239                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 240                 close_nointr_nofail(fd);
 241         } else
 242                 r = nfd;
 243
 244         return r;
 245 }
 246
 247 static bool is_terminal_input(ExecInput i) {
 248         return
 249                 i == EXEC_INPUT_TTY ||
 250                 i == EXEC_INPUT_TTY_FORCE ||
 251                 i == EXEC_INPUT_TTY_FAIL;
 252 }
 253
 254 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 255
 256         if (is_terminal_input(std_input) && !apply_tty_stdin)
 257                 return EXEC_INPUT_NULL;
 258
 259         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 260                 return EXEC_INPUT_NULL;
 261
 262         return std_input;
 263 }
 264
 265 static int fixup_output(ExecOutput std_output, int socket_fd) {
 266
 267         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 268                 return EXEC_OUTPUT_INHERIT;
 269
 270         return std_output;
 271 }
 272
 273 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 274         ExecInput i;
 275
 276         assert(context);
 277
 278         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 279
 280         switch (i) {
 281
 282         case EXEC_INPUT_NULL:
 283                 return open_null_as(O_RDONLY, STDIN_FILENO);
 284
 285         case EXEC_INPUT_TTY:
 286         case EXEC_INPUT_TTY_FORCE:
 287         case EXEC_INPUT_TTY_FAIL: {
 288                 int fd, r;
 289
 290                 if ((fd = acquire_terminal(
 291                                      tty_path(context),
 292                                      i == EXEC_INPUT_TTY_FAIL,
 293                                      i == EXEC_INPUT_TTY_FORCE,
 294                                      false)) < 0)
 295                         return fd;
 296
 297                 if (fd != STDIN_FILENO) {
 298                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 299                         close_nointr_nofail(fd);
 300                 } else
 301                         r = STDIN_FILENO;
 302
 303                 return r;
 304         }
 305
 306         case EXEC_INPUT_SOCKET:
 307                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 308
 309         default:
 310                 assert_not_reached("Unknown input type");
 311         }
 312 }
 313
 314 static int setup_output(const ExecContext *context, int socket_fd, const char *ident, bool apply_tty_stdin) {
 315         ExecOutput o;
 316         ExecInput i;
 317
 318         assert(context);
 319         assert(ident);
 320
 321         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 322         o = fixup_output(context->std_output, socket_fd);
 323
 324         /* This expects the input is already set up */
 325
 326         switch (o) {
 327
 328         case EXEC_OUTPUT_INHERIT:
 329
 330                 /* If input got downgraded, inherit the original value */
 331                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 332                         return open_terminal_as(tty_path(context), O_WRONLY, STDOUT_FILENO);
 333
 334                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 335                 if (i != EXEC_INPUT_NULL)
 336                         return dup2(STDIN_FILENO, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 337
 338                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 339                 if (getppid() != 1)
 340                         return STDOUT_FILENO;
 341
 342                 /* We need to open /dev/null here anew, to get the
 343                  * right access mode. So we fall through */
 344
 345         case EXEC_OUTPUT_NULL:
 346                 return open_null_as(O_WRONLY, STDOUT_FILENO);
 347
 348         case EXEC_OUTPUT_TTY:
 349                 if (is_terminal_input(i))
 350                         return dup2(STDIN_FILENO, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 351
 352                 /* We don't reset the terminal if this is just about output */
 353                 return open_terminal_as(tty_path(context), O_WRONLY, STDOUT_FILENO);
 354
 355         case EXEC_OUTPUT_SYSLOG:
 356         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 357         case EXEC_OUTPUT_KMSG:
 358         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 359         case EXEC_OUTPUT_JOURNAL:
 360         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 361                 return connect_logger_as(context, o, ident, STDOUT_FILENO);
 362
 363         case EXEC_OUTPUT_SOCKET:
 364                 assert(socket_fd >= 0);
 365                 return dup2(socket_fd, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 366
 367         default:
 368                 assert_not_reached("Unknown output type");
 369         }
 370 }
 371
 372 static int setup_error(const ExecContext *context, int socket_fd, const char *ident, bool apply_tty_stdin) {
 373         ExecOutput o, e;
 374         ExecInput i;
 375
 376         assert(context);
 377         assert(ident);
 378
 379         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 380         o = fixup_output(context->std_output, socket_fd);
 381         e = fixup_output(context->std_error, socket_fd);
 382
 383         /* This expects the input and output are already set up */
 384
 385         /* Don't change the stderr file descriptor if we inherit all
 386          * the way and are not on a tty */
 387         if (e == EXEC_OUTPUT_INHERIT &&
 388             o == EXEC_OUTPUT_INHERIT &&
 389             i == EXEC_INPUT_NULL &&
 390             !is_terminal_input(context->std_input) &&
 391             getppid () != 1)
 392                 return STDERR_FILENO;
 393
 394         /* Duplicate from stdout if possible */
 395         if (e == o || e == EXEC_OUTPUT_INHERIT)
 396                 return dup2(STDOUT_FILENO, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 397
 398         switch (e) {
 399
 400         case EXEC_OUTPUT_NULL:
 401                 return open_null_as(O_WRONLY, STDERR_FILENO);
 402
 403         case EXEC_OUTPUT_TTY:
 404                 if (is_terminal_input(i))
 405                         return dup2(STDIN_FILENO, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 406
 407                 /* We don't reset the terminal if this is just about output */
 408                 return open_terminal_as(tty_path(context), O_WRONLY, STDERR_FILENO);
 409
 410         case EXEC_OUTPUT_SYSLOG:
 411         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 412         case EXEC_OUTPUT_KMSG:
 413         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 414         case EXEC_OUTPUT_JOURNAL:
 415         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 416                 return connect_logger_as(context, e, ident, STDERR_FILENO);
 417
 418         case EXEC_OUTPUT_SOCKET:
 419                 assert(socket_fd >= 0);
 420                 return dup2(socket_fd, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 421
 422         default:
 423                 assert_not_reached("Unknown error type");
 424         }
 425 }
 426
 427 static int chown_terminal(int fd, uid_t uid) {
 428         struct stat st;
 429
 430         assert(fd >= 0);
 431
 432         /* This might fail. What matters are the results. */
 433         (void) fchown(fd, uid, -1);
 434         (void) fchmod(fd, TTY_MODE);
 435
 436         if (fstat(fd, &st) < 0)
 437                 return -errno;
 438
 439         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 440                 return -EPERM;
 441
 442         return 0;
 443 }
 444
 445 static int setup_confirm_stdio(const ExecContext *context,
 446                                int *_saved_stdin,
 447                                int *_saved_stdout) {
 448         int fd = -1, saved_stdin, saved_stdout = -1, r;
 449
 450         assert(context);
 451         assert(_saved_stdin);
 452         assert(_saved_stdout);
 453
 454         /* This returns positive EXIT_xxx return values instead of
 455          * negative errno style values! */
 456
 457         if ((saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3)) < 0)
 458                 return EXIT_STDIN;
 459
 460         if ((saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3)) < 0) {
 461                 r = EXIT_STDOUT;
 462                 goto fail;
 463         }
 464
 465         if ((fd = acquire_terminal(
 466                              tty_path(context),
 467                              context->std_input == EXEC_INPUT_TTY_FAIL,
 468                              context->std_input == EXEC_INPUT_TTY_FORCE,
 469                              false)) < 0) {
 470                 r = EXIT_STDIN;
 471                 goto fail;
 472         }
 473
 474         if (chown_terminal(fd, getuid()) < 0) {
 475                 r = EXIT_STDIN;
 476                 goto fail;
 477         }
 478
 479         if (dup2(fd, STDIN_FILENO) < 0) {
 480                 r = EXIT_STDIN;
 481                 goto fail;
 482         }
 483
 484         if (dup2(fd, STDOUT_FILENO) < 0) {
 485                 r = EXIT_STDOUT;
 486                 goto fail;
 487         }
 488
 489         if (fd >= 2)
 490                 close_nointr_nofail(fd);
 491
 492         *_saved_stdin = saved_stdin;
 493         *_saved_stdout = saved_stdout;
 494
 495         return 0;
 496
 497 fail:
 498         if (saved_stdout >= 0)
 499                 close_nointr_nofail(saved_stdout);
 500
 501         if (saved_stdin >= 0)
 502                 close_nointr_nofail(saved_stdin);
 503
 504         if (fd >= 0)
 505                 close_nointr_nofail(fd);
 506
 507         return r;
 508 }
 509
 510 static int restore_confirm_stdio(const ExecContext *context,
 511                                  int *saved_stdin,
 512                                  int *saved_stdout,
 513                                  bool *keep_stdin,
 514                                  bool *keep_stdout) {
 515
 516         assert(context);
 517         assert(saved_stdin);
 518         assert(*saved_stdin >= 0);
 519         assert(saved_stdout);
 520         assert(*saved_stdout >= 0);
 521
 522         /* This returns positive EXIT_xxx return values instead of
 523          * negative errno style values! */
 524
 525         if (is_terminal_input(context->std_input)) {
 526
 527                 /* The service wants terminal input. */
 528
 529                 *keep_stdin = true;
 530                 *keep_stdout =
 531                         context->std_output == EXEC_OUTPUT_INHERIT ||
 532                         context->std_output == EXEC_OUTPUT_TTY;
 533
 534         } else {
 535                 /* If the service doesn't want a controlling terminal,
 536                  * then we need to get rid entirely of what we have
 537                  * already. */
 538
 539                 if (release_terminal() < 0)
 540                         return EXIT_STDIN;
 541
 542                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 543                         return EXIT_STDIN;
 544
 545                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 546                         return EXIT_STDOUT;
 547
 548                 *keep_stdout = *keep_stdin = false;
 549         }
 550
 551         return 0;
 552 }
 553
 554 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 555         bool keep_groups = false;
 556         int r;
 557
 558         assert(context);
 559
 560         /* Lookup and set GID and supplementary group list. Here too
 561          * we avoid NSS lookups for gid=0. */
 562
 563         if (context->group || username) {
 564
 565                 if (context->group) {
 566                         const char *g = context->group;
 567
 568                         if ((r = get_group_creds(&g, &gid)) < 0)
 569                                 return r;
 570                 }
 571
 572                 /* First step, initialize groups from /etc/groups */
 573                 if (username && gid != 0) {
 574                         if (initgroups(username, gid) < 0)
 575                                 return -errno;
 576
 577                         keep_groups = true;
 578                 }
 579
 580                 /* Second step, set our gids */
 581                 if (setresgid(gid, gid, gid) < 0)
 582                         return -errno;
 583         }
 584
 585         if (context->supplementary_groups) {
 586                 int ngroups_max, k;
 587                 gid_t *gids;
 588                 char **i;
 589
 590                 /* Final step, initialize any manually set supplementary groups */
 591                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 592
 593                 if (!(gids = new(gid_t, ngroups_max)))
 594                         return -ENOMEM;
 595
 596                 if (keep_groups) {
 597                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 598                                 free(gids);
 599                                 return -errno;
 600                         }
 601                 } else
 602                         k = 0;
 603
 604                 STRV_FOREACH(i, context->supplementary_groups) {
 605                         const char *g;
 606
 607                         if (k >= ngroups_max) {
 608                                 free(gids);
 609                                 return -E2BIG;
 610                         }
 611
 612                         g = *i;
 613                         r = get_group_creds(&g, gids+k);
 614                         if (r < 0) {
 615                                 free(gids);
 616                                 return r;
 617                         }
 618
 619                         k++;
 620                 }
 621
 622                 if (setgroups(k, gids) < 0) {
 623                         free(gids);
 624                         return -errno;
 625                 }
 626
 627                 free(gids);
 628         }
 629
 630         return 0;
 631 }
 632
 633 static int enforce_user(const ExecContext *context, uid_t uid) {
 634         int r;
 635         assert(context);
 636
 637         /* Sets (but doesn't lookup) the uid and make sure we keep the
 638          * capabilities while doing so. */
 639
 640         if (context->capabilities) {
 641                 cap_t d;
 642                 static const cap_value_t bits[] = {
 643                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 644                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 645                 };
 646
 647                 /* First step: If we need to keep capabilities but
 648                  * drop privileges we need to make sure we keep our
 649                  * caps, whiel we drop privileges. */
 650                 if (uid != 0) {
 651                         int sb = context->secure_bits|SECURE_KEEP_CAPS;
 652
 653                         if (prctl(PR_GET_SECUREBITS) != sb)
 654                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 655                                         return -errno;
 656                 }
 657
 658                 /* Second step: set the capabilities. This will reduce
 659                  * the capabilities to the minimum we need. */
 660
 661                 if (!(d = cap_dup(context->capabilities)))
 662                         return -errno;
 663
 664                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 665                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 666                         r = -errno;
 667                         cap_free(d);
 668                         return r;
 669                 }
 670
 671                 if (cap_set_proc(d) < 0) {
 672                         r = -errno;
 673                         cap_free(d);
 674                         return r;
 675                 }
 676
 677                 cap_free(d);
 678         }
 679
 680         /* Third step: actually set the uids */
 681         if (setresuid(uid, uid, uid) < 0)
 682                 return -errno;
 683
 684         /* At this point we should have all necessary capabilities but
 685            are otherwise a normal user. However, the caps might got
 686            corrupted due to the setresuid() so we need clean them up
 687            later. This is done outside of this call. */
 688
 689         return 0;
 690 }
 691
 692 #ifdef HAVE_PAM
 693
 694 static int null_conv(
 695                 int num_msg,
 696                 const struct pam_message **msg,
 697                 struct pam_response **resp,
 698                 void *appdata_ptr) {
 699
 700         /* We don't support conversations */
 701
 702         return PAM_CONV_ERR;
 703 }
 704
 705 static int setup_pam(
 706                 const char *name,
 707                 const char *user,
 708                 uid_t uid,
 709                 const char *tty,
 710                 char ***pam_env,
 711                 int fds[], unsigned n_fds) {
 712
 713         static const struct pam_conv conv = {
 714                 .conv = null_conv,
 715                 .appdata_ptr = NULL
 716         };
 717
 718         pam_handle_t *handle = NULL;
 719         sigset_t ss, old_ss;
 720         int pam_code = PAM_SUCCESS;
 721         int err;
 722         char **e = NULL;
 723         bool close_session = false;
 724         pid_t pam_pid = 0, parent_pid;
 725
 726         assert(name);
 727         assert(user);
 728         assert(pam_env);
 729
 730         /* We set up PAM in the parent process, then fork. The child
 731          * will then stay around until killed via PR_GET_PDEATHSIG or
 732          * systemd via the cgroup logic. It will then remove the PAM
 733          * session again. The parent process will exec() the actual
 734          * daemon. We do things this way to ensure that the main PID
 735          * of the daemon is the one we initially fork()ed. */
 736
 737         if ((pam_code = pam_start(name, user, &conv, &handle)) != PAM_SUCCESS) {
 738                 handle = NULL;
 739                 goto fail;
 740         }
 741
 742         if (tty)
 743                 if ((pam_code = pam_set_item(handle, PAM_TTY, tty)) != PAM_SUCCESS)
 744                         goto fail;
 745
 746         if ((pam_code = pam_acct_mgmt(handle, PAM_SILENT)) != PAM_SUCCESS)
 747                 goto fail;
 748
 749         if ((pam_code = pam_open_session(handle, PAM_SILENT)) != PAM_SUCCESS)
 750                 goto fail;
 751
 752         close_session = true;
 753
 754         if ((!(e = pam_getenvlist(handle)))) {
 755                 pam_code = PAM_BUF_ERR;
 756                 goto fail;
 757         }
 758
 759         /* Block SIGTERM, so that we know that it won't get lost in
 760          * the child */
 761         if (sigemptyset(&ss) < 0 ||
 762             sigaddset(&ss, SIGTERM) < 0 ||
 763             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 764                 goto fail;
 765
 766         parent_pid = getpid();
 767
 768         if ((pam_pid = fork()) < 0)
 769                 goto fail;
 770
 771         if (pam_pid == 0) {
 772                 int sig;
 773                 int r = EXIT_PAM;
 774
 775                 /* The child's job is to reset the PAM session on
 776                  * termination */
 777
 778                 /* This string must fit in 10 chars (i.e. the length
 779                  * of "/sbin/init"), to look pretty in /bin/ps */
 780                 rename_process("(sd-pam)");
 781
 782                 /* Make sure we don't keep open the passed fds in this
 783                 child. We assume that otherwise only those fds are
 784                 open here that have been opened by PAM. */
 785                 close_many(fds, n_fds);
 786
 787                 /* Drop privileges - we don't need any to pam_close_session
 788                  * and this will make PR_SET_PDEATHSIG work in most cases.
 789                  * If this fails, ignore the error - but expect sd-pam threads
 790                  * to fail to exit normally */
 791                 if (setresuid(uid, uid, uid) < 0)
 792                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 793
 794                 /* Wait until our parent died. This will only work if
 795                  * the above setresuid() succeeds, otherwise the kernel
 796                  * will not allow unprivileged parents kill their privileged
 797                  * children this way. We rely on the control groups kill logic
 798                  * to do the rest for us. */
 799                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 800                         goto child_finish;
 801
 802                 /* Check if our parent process might already have
 803                  * died? */
 804                 if (getppid() == parent_pid) {
 805                         for (;;) {
 806                                 if (sigwait(&ss, &sig) < 0) {
 807                                         if (errno == EINTR)
 808                                                 continue;
 809
 810                                         goto child_finish;
 811                                 }
 812
 813                                 assert(sig == SIGTERM);
 814                                 break;
 815                         }
 816                 }
 817
 818                 /* If our parent died we'll end the session */
 819                 if (getppid() != parent_pid)
 820                         if ((pam_code = pam_close_session(handle, PAM_DATA_SILENT)) != PAM_SUCCESS)
 821                                 goto child_finish;
 822
 823                 r = 0;
 824
 825         child_finish:
 826                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 827                 _exit(r);
 828         }
 829
 830         /* If the child was forked off successfully it will do all the
 831          * cleanups, so forget about the handle here. */
 832         handle = NULL;
 833
 834         /* Unblock SIGTERM again in the parent */
 835         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 836                 goto fail;
 837
 838         /* We close the log explicitly here, since the PAM modules
 839          * might have opened it, but we don't want this fd around. */
 840         closelog();
 841
 842         *pam_env = e;
 843         e = NULL;
 844
 845         return 0;
 846
 847 fail:
 848         if (pam_code != PAM_SUCCESS)
 849                 err = -EPERM;  /* PAM errors do not map to errno */
 850         else
 851                 err = -errno;
 852
 853         if (handle) {
 854                 if (close_session)
 855                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
 856
 857                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 858         }
 859
 860         strv_free(e);
 861
 862         closelog();
 863
 864         if (pam_pid > 1) {
 865                 kill(pam_pid, SIGTERM);
 866                 kill(pam_pid, SIGCONT);
 867         }
 868
 869         return err;
 870 }
 871 #endif
 872
 873 static void rename_process_from_path(const char *path) {
 874         char process_name[11];
 875         const char *p;
 876         size_t l;
 877
 878         /* This resulting string must fit in 10 chars (i.e. the length
 879          * of "/sbin/init") to look pretty in /bin/ps */
 880
 881         p = path_get_file_name(path);
 882         if (isempty(p)) {
 883                 rename_process("(...)");
 884                 return;
 885         }
 886
 887         l = strlen(p);
 888         if (l > 8) {
 889                 /* The end of the process name is usually more
 890                  * interesting, since the first bit might just be
 891                  * "systemd-" */
 892                 p = p + l - 8;
 893                 l = 8;
 894         }
 895
 896         process_name[0] = '(';
 897         memcpy(process_name+1, p, l);
 898         process_name[1+l] = ')';
 899         process_name[1+l+1] = 0;
 900
 901         rename_process(process_name);
 902 }
 903
 904 int exec_spawn(ExecCommand *command,
 905                char **argv,
 906                const ExecContext *context,
 907                int fds[], unsigned n_fds,
 908                char **environment,
 909                bool apply_permissions,
 910                bool apply_chroot,
 911                bool apply_tty_stdin,
 912                bool confirm_spawn,
 913                CGroupBonding *cgroup_bondings,
 914                CGroupAttribute *cgroup_attributes,
 915                const char *cgroup_suffix,
 916                int idle_pipe[2],
 917                pid_t *ret) {
 918
 919         pid_t pid;
 920         int r;
 921         char *line;
 922         int socket_fd;
 923         char **files_env = NULL;
 924
 925         assert(command);
 926         assert(context);
 927         assert(ret);
 928         assert(fds || n_fds <= 0);
 929
 930         if (context->std_input == EXEC_INPUT_SOCKET ||
 931             context->std_output == EXEC_OUTPUT_SOCKET ||
 932             context->std_error == EXEC_OUTPUT_SOCKET) {
 933
 934                 if (n_fds != 1)
 935                         return -EINVAL;
 936
 937                 socket_fd = fds[0];
 938
 939                 fds = NULL;
 940                 n_fds = 0;
 941         } else
 942                 socket_fd = -1;
 943
 944         if ((r = exec_context_load_environment(context, &files_env)) < 0) {
 945                 log_error("Failed to load environment files: %s", strerror(-r));
 946                 return r;
 947         }
 948
 949         if (!argv)
 950                 argv = command->argv;
 951
 952         if (!(line = exec_command_line(argv))) {
 953                 r = -ENOMEM;
 954                 goto fail_parent;
 955         }
 956
 957         log_debug("About to execute: %s", line);
 958         free(line);
 959
 960         r = cgroup_bonding_realize_list(cgroup_bondings);
 961         if (r < 0)
 962                 goto fail_parent;
 963
 964         cgroup_attribute_apply_list(cgroup_attributes, cgroup_bondings);
 965
 966         if ((pid = fork()) < 0) {
 967                 r = -errno;
 968                 goto fail_parent;
 969         }
 970
 971         if (pid == 0) {
 972                 int i, err;
 973                 sigset_t ss;
 974                 const char *username = NULL, *home = NULL;
 975                 uid_t uid = (uid_t) -1;
 976                 gid_t gid = (gid_t) -1;
 977                 char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
 978                 unsigned n_env = 0;
 979                 int saved_stdout = -1, saved_stdin = -1;
 980                 bool keep_stdout = false, keep_stdin = false, set_access = false;
 981
 982                 /* child */
 983
 984                 rename_process_from_path(command->path);
 985
 986                 /* We reset exactly these signals, since they are the
 987                  * only ones we set to SIG_IGN in the main daemon. All
 988                  * others we leave untouched because we set them to
 989                  * SIG_DFL or a valid handler initially, both of which
 990                  * will be demoted to SIG_DFL. */
 991                 default_signals(SIGNALS_CRASH_HANDLER,
 992                                 SIGNALS_IGNORE, -1);
 993
 994                 if (context->ignore_sigpipe)
 995                         ignore_signals(SIGPIPE, -1);
 996
 997                 assert_se(sigemptyset(&ss) == 0);
 998                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
 999                         err = -errno;
1000                         r = EXIT_SIGNAL_MASK;
1001                         goto fail_child;
1002                 }
1003
1004                 if (idle_pipe) {
1005                         if (idle_pipe[1] >= 0)
1006                                 close_nointr_nofail(idle_pipe[1]);
1007                         if (idle_pipe[0] >= 0) {
1008                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1009                                 close_nointr_nofail(idle_pipe[0]);
1010                         }
1011                 }
1012
1013                 /* Close sockets very early to make sure we don't
1014                  * block init reexecution because it cannot bind its
1015                  * sockets */
1016                 log_forget_fds();
1017                 err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
1018                                            socket_fd >= 0 ? 1 : n_fds);
1019                 if (err < 0) {
1020                         r = EXIT_FDS;
1021                         goto fail_child;
1022                 }
1023
1024                 if (!context->same_pgrp)
1025                         if (setsid() < 0) {
1026                                 err = -errno;
1027                                 r = EXIT_SETSID;
1028                                 goto fail_child;
1029                         }
1030
1031                 if (context->tcpwrap_name) {
1032                         if (socket_fd >= 0)
1033                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1034                                         err = -EACCES;
1035                                         r = EXIT_TCPWRAP;
1036                                         goto fail_child;
1037                                 }
1038
1039                         for (i = 0; i < (int) n_fds; i++) {
1040                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1041                                         err = -EACCES;
1042                                         r = EXIT_TCPWRAP;
1043                                         goto fail_child;
1044                                 }
1045                         }
1046                 }
1047
1048                 exec_context_tty_reset(context);
1049
1050                 /* We skip the confirmation step if we shall not apply the TTY */
1051                 if (confirm_spawn &&
1052                     (!is_terminal_input(context->std_input) || apply_tty_stdin)) {
1053                         char response;
1054
1055                         /* Set up terminal for the question */
1056                         if ((r = setup_confirm_stdio(context,
1057                                                      &saved_stdin, &saved_stdout))) {
1058                                 err = -errno;
1059                                 goto fail_child;
1060                         }
1061
1062                         /* Now ask the question. */
1063                         if (!(line = exec_command_line(argv))) {
1064                                 err = -ENOMEM;
1065                                 r = EXIT_MEMORY;
1066                                 goto fail_child;
1067                         }
1068
1069                         r = ask(&response, "yns", "Execute %s? [Yes, No, Skip] ", line);
1070                         free(line);
1071
1072                         if (r < 0 || response == 'n') {
1073                                 err = -ECANCELED;
1074                                 r = EXIT_CONFIRM;
1075                                 goto fail_child;
1076                         } else if (response == 's') {
1077                                 err = r = 0;
1078                                 goto fail_child;
1079                         }
1080
1081                         /* Release terminal for the question */
1082                         if ((r = restore_confirm_stdio(context,
1083                                                        &saved_stdin, &saved_stdout,
1084                                                        &keep_stdin, &keep_stdout))) {
1085                                 err = -errno;
1086                                 goto fail_child;
1087                         }
1088                 }
1089
1090                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1091                  * must sure to drop O_NONBLOCK */
1092                 if (socket_fd >= 0)
1093                         fd_nonblock(socket_fd, false);
1094
1095                 if (!keep_stdin) {
1096                         err = setup_input(context, socket_fd, apply_tty_stdin);
1097                         if (err < 0) {
1098                                 r = EXIT_STDIN;
1099                                 goto fail_child;
1100                         }
1101                 }
1102
1103                 if (!keep_stdout) {
1104                         err = setup_output(context, socket_fd, path_get_file_name(command->path), apply_tty_stdin);
1105                         if (err < 0) {
1106                                 r = EXIT_STDOUT;
1107                                 goto fail_child;
1108                         }
1109                 }
1110
1111                 err = setup_error(context, socket_fd, path_get_file_name(command->path), apply_tty_stdin);
1112                 if (err < 0) {
1113                         r = EXIT_STDERR;
1114                         goto fail_child;
1115                 }
1116
1117                 if (cgroup_bondings) {
1118                         err = cgroup_bonding_install_list(cgroup_bondings, 0, cgroup_suffix);
1119                         if (err < 0) {
1120                                 r = EXIT_CGROUP;
1121                                 goto fail_child;
1122                         }
1123                 }
1124
1125                 if (context->oom_score_adjust_set) {
1126                         char t[16];
1127
1128                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1129                         char_array_0(t);
1130
1131                         if (write_one_line_file("/proc/self/oom_score_adj", t) < 0) {
1132                                 err = -errno;
1133                                 r = EXIT_OOM_ADJUST;
1134                                 goto fail_child;
1135                         }
1136                 }
1137
1138                 if (context->nice_set)
1139                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1140                                 err = -errno;
1141                                 r = EXIT_NICE;
1142                                 goto fail_child;
1143                         }
1144
1145                 if (context->cpu_sched_set) {
1146                         struct sched_param param;
1147
1148                         zero(param);
1149                         param.sched_priority = context->cpu_sched_priority;
1150
1151                         if (sched_setscheduler(0, context->cpu_sched_policy |
1152                                                (context->cpu_sched_reset_on_fork ? SCHED_RESET_ON_FORK : 0), &param) < 0) {
1153                                 err = -errno;
1154                                 r = EXIT_SETSCHEDULER;
1155                                 goto fail_child;
1156                         }
1157                 }
1158
1159                 if (context->cpuset)
1160                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1161                                 err = -errno;
1162                                 r = EXIT_CPUAFFINITY;
1163                                 goto fail_child;
1164                         }
1165
1166                 if (context->ioprio_set)
1167                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1168                                 err = -errno;
1169                                 r = EXIT_IOPRIO;
1170                                 goto fail_child;
1171                         }
1172
1173                 if (context->timer_slack_nsec != (nsec_t) -1)
1174                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1175                                 err = -errno;
1176                                 r = EXIT_TIMERSLACK;
1177                                 goto fail_child;
1178                         }
1179
1180                 if (context->utmp_id)
1181                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1182
1183                 if (context->user) {
1184                         username = context->user;
1185                         err = get_user_creds(&username, &uid, &gid, &home);
1186                         if (err < 0) {
1187                                 r = EXIT_USER;
1188                                 goto fail_child;
1189                         }
1190
1191                         if (is_terminal_input(context->std_input)) {
1192                                 err = chown_terminal(STDIN_FILENO, uid);
1193                                 if (err < 0) {
1194                                         r = EXIT_STDIN;
1195                                         goto fail_child;
1196                                 }
1197                         }
1198
1199                         if (cgroup_bondings && context->control_group_modify) {
1200                                 err = cgroup_bonding_set_group_access_list(cgroup_bondings, 0755, uid, gid);
1201                                 if (err >= 0)
1202                                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, 0644, uid, gid, context->control_group_persistent);
1203                                 if (err < 0) {
1204                                         r = EXIT_CGROUP;
1205                                         goto fail_child;
1206                                 }
1207
1208                                 set_access = true;
1209                         }
1210                 }
1211
1212                 if (cgroup_bondings && !set_access && context->control_group_persistent >= 0)  {
1213                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, (mode_t) -1, (uid_t) -1, (uid_t) -1, context->control_group_persistent);
1214                         if (err < 0) {
1215                                 r = EXIT_CGROUP;
1216                                 goto fail_child;
1217                         }
1218                 }
1219
1220                 if (apply_permissions) {
1221                         err = enforce_groups(context, username, gid);
1222                         if (err < 0) {
1223                                 r = EXIT_GROUP;
1224                                 goto fail_child;
1225                         }
1226                 }
1227
1228                 umask(context->umask);
1229
1230 #ifdef HAVE_PAM
1231                 if (context->pam_name && username) {
1232                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1233                         if (err < 0) {
1234                                 r = EXIT_PAM;
1235                                 goto fail_child;
1236                         }
1237                 }
1238 #endif
1239                 if (context->private_network) {
1240                         if (unshare(CLONE_NEWNET) < 0) {
1241                                 err = -errno;
1242                                 r = EXIT_NETWORK;
1243                                 goto fail_child;
1244                         }
1245
1246                         loopback_setup();
1247                 }
1248
1249                 if (strv_length(context->read_write_dirs) > 0 ||
1250                     strv_length(context->read_only_dirs) > 0 ||
1251                     strv_length(context->inaccessible_dirs) > 0 ||
1252                     context->mount_flags != MS_SHARED ||
1253                     context->private_tmp) {
1254                         err = setup_namespace(context->read_write_dirs,
1255                                               context->read_only_dirs,
1256                                               context->inaccessible_dirs,
1257                                               context->private_tmp,
1258                                               context->mount_flags);
1259                         if (err < 0) {
1260                                 r = EXIT_NAMESPACE;
1261                                 goto fail_child;
1262                         }
1263                 }
1264
1265                 if (apply_chroot) {
1266                         if (context->root_directory)
1267                                 if (chroot(context->root_directory) < 0) {
1268                                         err = -errno;
1269                                         r = EXIT_CHROOT;
1270                                         goto fail_child;
1271                                 }
1272
1273                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1274                                 err = -errno;
1275                                 r = EXIT_CHDIR;
1276                                 goto fail_child;
1277                         }
1278                 } else {
1279
1280                         char *d;
1281
1282                         if (asprintf(&d, "%s/%s",
1283                                      context->root_directory ? context->root_directory : "",
1284                                      context->working_directory ? context->working_directory : "") < 0) {
1285                                 err = -ENOMEM;
1286                                 r = EXIT_MEMORY;
1287                                 goto fail_child;
1288                         }
1289
1290                         if (chdir(d) < 0) {
1291                                 err = -errno;
1292                                 free(d);
1293                                 r = EXIT_CHDIR;
1294                                 goto fail_child;
1295                         }
1296
1297                         free(d);
1298                 }
1299
1300                 /* We repeat the fd closing here, to make sure that
1301                  * nothing is leaked from the PAM modules */
1302                 err = close_all_fds(fds, n_fds);
1303                 if (err >= 0)
1304                         err = shift_fds(fds, n_fds);
1305                 if (err >= 0)
1306                         err = flags_fds(fds, n_fds, context->non_blocking);
1307                 if (err < 0) {
1308                         r = EXIT_FDS;
1309                         goto fail_child;
1310                 }
1311
1312                 if (apply_permissions) {
1313
1314                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1315                                 if (!context->rlimit[i])
1316                                         continue;
1317
1318                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1319                                         err = -errno;
1320                                         r = EXIT_LIMITS;
1321                                         goto fail_child;
1322                                 }
1323                         }
1324
1325                         if (context->capability_bounding_set_drop) {
1326                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1327                                 if (err < 0) {
1328                                         r = EXIT_CAPABILITIES;
1329                                         goto fail_child;
1330                                 }
1331                         }
1332
1333                         if (context->user) {
1334                                 err = enforce_user(context, uid);
1335                                 if (err < 0) {
1336                                         r = EXIT_USER;
1337                                         goto fail_child;
1338                                 }
1339                         }
1340
1341                         /* PR_GET_SECUREBITS is not privileged, while
1342                          * PR_SET_SECUREBITS is. So to suppress
1343                          * potential EPERMs we'll try not to call
1344                          * PR_SET_SECUREBITS unless necessary. */
1345                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1346                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1347                                         err = -errno;
1348                                         r = EXIT_SECUREBITS;
1349                                         goto fail_child;
1350                                 }
1351
1352                         if (context->capabilities)
1353                                 if (cap_set_proc(context->capabilities) < 0) {
1354                                         err = -errno;
1355                                         r = EXIT_CAPABILITIES;
1356                                         goto fail_child;
1357                                 }
1358                 }
1359
1360                 if (!(our_env = new0(char*, 7))) {
1361                         err = -ENOMEM;
1362                         r = EXIT_MEMORY;
1363                         goto fail_child;
1364                 }
1365
1366                 if (n_fds > 0)
1367                         if (asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1368                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0) {
1369                                 err = -ENOMEM;
1370                                 r = EXIT_MEMORY;
1371                                 goto fail_child;
1372                         }
1373
1374                 if (home)
1375                         if (asprintf(our_env + n_env++, "HOME=%s", home) < 0) {
1376                                 err = -ENOMEM;
1377                                 r = EXIT_MEMORY;
1378                                 goto fail_child;
1379                         }
1380
1381                 if (username)
1382                         if (asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1383                             asprintf(our_env + n_env++, "USER=%s", username) < 0) {
1384                                 err = -ENOMEM;
1385                                 r = EXIT_MEMORY;
1386                                 goto fail_child;
1387                         }
1388
1389                 if (is_terminal_input(context->std_input) ||
1390                     context->std_output == EXEC_OUTPUT_TTY ||
1391                     context->std_error == EXEC_OUTPUT_TTY)
1392                         if (!(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))) {
1393                                 err = -ENOMEM;
1394                                 r = EXIT_MEMORY;
1395                                 goto fail_child;
1396                         }
1397
1398                 assert(n_env <= 7);
1399
1400                 if (!(final_env = strv_env_merge(
1401                                       5,
1402                                       environment,
1403                                       our_env,
1404                                       context->environment,
1405                                       files_env,
1406                                       pam_env,
1407                                       NULL))) {
1408                         err = -ENOMEM;
1409                         r = EXIT_MEMORY;
1410                         goto fail_child;
1411                 }
1412
1413                 if (!(final_argv = replace_env_argv(argv, final_env))) {
1414                         err = -ENOMEM;
1415                         r = EXIT_MEMORY;
1416                         goto fail_child;
1417                 }
1418
1419                 final_env = strv_env_clean(final_env);
1420
1421                 execve(command->path, final_argv, final_env);
1422                 err = -errno;
1423                 r = EXIT_EXEC;
1424
1425         fail_child:
1426                 if (r != 0) {
1427                         log_open();
1428                         log_warning("Failed at step %s spawning %s: %s",
1429                                     exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1430                                     command->path, strerror(-err));
1431                 }
1432
1433                 strv_free(our_env);
1434                 strv_free(final_env);
1435                 strv_free(pam_env);
1436                 strv_free(files_env);
1437                 strv_free(final_argv);
1438
1439                 if (saved_stdin >= 0)
1440                         close_nointr_nofail(saved_stdin);
1441
1442                 if (saved_stdout >= 0)
1443                         close_nointr_nofail(saved_stdout);
1444
1445                 _exit(r);
1446         }
1447
1448         strv_free(files_env);
1449
1450         /* We add the new process to the cgroup both in the child (so
1451          * that we can be sure that no user code is ever executed
1452          * outside of the cgroup) and in the parent (so that we can be
1453          * sure that when we kill the cgroup the process will be
1454          * killed too). */
1455         if (cgroup_bondings)
1456                 cgroup_bonding_install_list(cgroup_bondings, pid, cgroup_suffix);
1457
1458         log_debug("Forked %s as %lu", command->path, (unsigned long) pid);
1459
1460         exec_status_start(&command->exec_status, pid);
1461
1462         *ret = pid;
1463         return 0;
1464
1465 fail_parent:
1466         strv_free(files_env);
1467
1468         return r;
1469 }
1470
1471 void exec_context_init(ExecContext *c) {
1472         assert(c);
1473
1474         c->umask = 0022;
1475         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1476         c->cpu_sched_policy = SCHED_OTHER;
1477         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1478         c->syslog_level_prefix = true;
1479         c->mount_flags = MS_SHARED;
1480         c->kill_signal = SIGTERM;
1481         c->send_sigkill = true;
1482         c->control_group_persistent = -1;
1483         c->ignore_sigpipe = true;
1484         c->timer_slack_nsec = (nsec_t) -1;
1485 }
1486
1487 void exec_context_done(ExecContext *c) {
1488         unsigned l;
1489
1490         assert(c);
1491
1492         strv_free(c->environment);
1493         c->environment = NULL;
1494
1495         strv_free(c->environment_files);
1496         c->environment_files = NULL;
1497
1498         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1499                 free(c->rlimit[l]);
1500                 c->rlimit[l] = NULL;
1501         }
1502
1503         free(c->working_directory);
1504         c->working_directory = NULL;
1505         free(c->root_directory);
1506         c->root_directory = NULL;
1507
1508         free(c->tty_path);
1509         c->tty_path = NULL;
1510
1511         free(c->tcpwrap_name);
1512         c->tcpwrap_name = NULL;
1513
1514         free(c->syslog_identifier);
1515         c->syslog_identifier = NULL;
1516
1517         free(c->user);
1518         c->user = NULL;
1519
1520         free(c->group);
1521         c->group = NULL;
1522
1523         strv_free(c->supplementary_groups);
1524         c->supplementary_groups = NULL;
1525
1526         free(c->pam_name);
1527         c->pam_name = NULL;
1528
1529         if (c->capabilities) {
1530                 cap_free(c->capabilities);
1531                 c->capabilities = NULL;
1532         }
1533
1534         strv_free(c->read_only_dirs);
1535         c->read_only_dirs = NULL;
1536
1537         strv_free(c->read_write_dirs);
1538         c->read_write_dirs = NULL;
1539
1540         strv_free(c->inaccessible_dirs);
1541         c->inaccessible_dirs = NULL;
1542
1543         if (c->cpuset)
1544                 CPU_FREE(c->cpuset);
1545
1546         free(c->utmp_id);
1547         c->utmp_id = NULL;
1548 }
1549
1550 void exec_command_done(ExecCommand *c) {
1551         assert(c);
1552
1553         free(c->path);
1554         c->path = NULL;
1555
1556         strv_free(c->argv);
1557         c->argv = NULL;
1558 }
1559
1560 void exec_command_done_array(ExecCommand *c, unsigned n) {
1561         unsigned i;
1562
1563         for (i = 0; i < n; i++)
1564                 exec_command_done(c+i);
1565 }
1566
1567 void exec_command_free_list(ExecCommand *c) {
1568         ExecCommand *i;
1569
1570         while ((i = c)) {
1571                 LIST_REMOVE(ExecCommand, command, c, i);
1572                 exec_command_done(i);
1573                 free(i);
1574         }
1575 }
1576
1577 void exec_command_free_array(ExecCommand **c, unsigned n) {
1578         unsigned i;
1579
1580         for (i = 0; i < n; i++) {
1581                 exec_command_free_list(c[i]);
1582                 c[i] = NULL;
1583         }
1584 }
1585
1586 int exec_context_load_environment(const ExecContext *c, char ***l) {
1587         char **i, **r = NULL;
1588
1589         assert(c);
1590         assert(l);
1591
1592         STRV_FOREACH(i, c->environment_files) {
1593                 char *fn;
1594                 int k;
1595                 bool ignore = false;
1596                 char **p;
1597
1598                 fn = *i;
1599
1600                 if (fn[0] == '-') {
1601                         ignore = true;
1602                         fn ++;
1603                 }
1604
1605                 if (!path_is_absolute(fn)) {
1606
1607                         if (ignore)
1608                                 continue;
1609
1610                         strv_free(r);
1611                         return -EINVAL;
1612                 }
1613
1614                 if ((k = load_env_file(fn, &p)) < 0) {
1615
1616                         if (ignore)
1617                                 continue;
1618
1619                         strv_free(r);
1620                         return k;
1621                 }
1622
1623                 if (r == NULL)
1624                         r = p;
1625                 else {
1626                         char **m;
1627
1628                         m = strv_env_merge(2, r, p);
1629                         strv_free(r);
1630                         strv_free(p);
1631
1632                         if (!m)
1633                                 return -ENOMEM;
1634
1635                         r = m;
1636                 }
1637         }
1638
1639         *l = r;
1640
1641         return 0;
1642 }
1643
1644 static void strv_fprintf(FILE *f, char **l) {
1645         char **g;
1646
1647         assert(f);
1648
1649         STRV_FOREACH(g, l)
1650                 fprintf(f, " %s", *g);
1651 }
1652
1653 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1654         char ** e;
1655         unsigned i;
1656
1657         assert(c);
1658         assert(f);
1659
1660         if (!prefix)
1661                 prefix = "";
1662
1663         fprintf(f,
1664                 "%sUMask: %04o\n"
1665                 "%sWorkingDirectory: %s\n"
1666                 "%sRootDirectory: %s\n"
1667                 "%sNonBlocking: %s\n"
1668                 "%sPrivateTmp: %s\n"
1669                 "%sControlGroupModify: %s\n"
1670                 "%sControlGroupPersistent: %s\n"
1671                 "%sPrivateNetwork: %s\n",
1672                 prefix, c->umask,
1673                 prefix, c->working_directory ? c->working_directory : "/",
1674                 prefix, c->root_directory ? c->root_directory : "/",
1675                 prefix, yes_no(c->non_blocking),
1676                 prefix, yes_no(c->private_tmp),
1677                 prefix, yes_no(c->control_group_modify),
1678                 prefix, yes_no(c->control_group_persistent),
1679                 prefix, yes_no(c->private_network));
1680
1681         STRV_FOREACH(e, c->environment)
1682                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1683
1684         STRV_FOREACH(e, c->environment_files)
1685                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1686
1687         if (c->tcpwrap_name)
1688                 fprintf(f,
1689                         "%sTCPWrapName: %s\n",
1690                         prefix, c->tcpwrap_name);
1691
1692         if (c->nice_set)
1693                 fprintf(f,
1694                         "%sNice: %i\n",
1695                         prefix, c->nice);
1696
1697         if (c->oom_score_adjust_set)
1698                 fprintf(f,
1699                         "%sOOMScoreAdjust: %i\n",
1700                         prefix, c->oom_score_adjust);
1701
1702         for (i = 0; i < RLIM_NLIMITS; i++)
1703                 if (c->rlimit[i])
1704                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1705
1706         if (c->ioprio_set)
1707                 fprintf(f,
1708                         "%sIOSchedulingClass: %s\n"
1709                         "%sIOPriority: %i\n",
1710                         prefix, ioprio_class_to_string(IOPRIO_PRIO_CLASS(c->ioprio)),
1711                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1712
1713         if (c->cpu_sched_set)
1714                 fprintf(f,
1715                         "%sCPUSchedulingPolicy: %s\n"
1716                         "%sCPUSchedulingPriority: %i\n"
1717                         "%sCPUSchedulingResetOnFork: %s\n",
1718                         prefix, sched_policy_to_string(c->cpu_sched_policy),
1719                         prefix, c->cpu_sched_priority,
1720                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1721
1722         if (c->cpuset) {
1723                 fprintf(f, "%sCPUAffinity:", prefix);
1724                 for (i = 0; i < c->cpuset_ncpus; i++)
1725                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1726                                 fprintf(f, " %i", i);
1727                 fputs("\n", f);
1728         }
1729
1730         if (c->timer_slack_nsec != (nsec_t) -1)
1731                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, c->timer_slack_nsec);
1732
1733         fprintf(f,
1734                 "%sStandardInput: %s\n"
1735                 "%sStandardOutput: %s\n"
1736                 "%sStandardError: %s\n",
1737                 prefix, exec_input_to_string(c->std_input),
1738                 prefix, exec_output_to_string(c->std_output),
1739                 prefix, exec_output_to_string(c->std_error));
1740
1741         if (c->tty_path)
1742                 fprintf(f,
1743                         "%sTTYPath: %s\n"
1744                         "%sTTYReset: %s\n"
1745                         "%sTTYVHangup: %s\n"
1746                         "%sTTYVTDisallocate: %s\n",
1747                         prefix, c->tty_path,
1748                         prefix, yes_no(c->tty_reset),
1749                         prefix, yes_no(c->tty_vhangup),
1750                         prefix, yes_no(c->tty_vt_disallocate));
1751
1752         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1753             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1754             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1755             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE)
1756                 fprintf(f,
1757                         "%sSyslogFacility: %s\n"
1758                         "%sSyslogLevel: %s\n",
1759                         prefix, log_facility_unshifted_to_string(c->syslog_priority >> 3),
1760                         prefix, log_level_to_string(LOG_PRI(c->syslog_priority)));
1761
1762         if (c->capabilities) {
1763                 char *t;
1764                 if ((t = cap_to_text(c->capabilities, NULL))) {
1765                         fprintf(f, "%sCapabilities: %s\n",
1766                                 prefix, t);
1767                         cap_free(t);
1768                 }
1769         }
1770
1771         if (c->secure_bits)
1772                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1773                         prefix,
1774                         (c->secure_bits & SECURE_KEEP_CAPS) ? " keep-caps" : "",
1775                         (c->secure_bits & SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1776                         (c->secure_bits & SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1777                         (c->secure_bits & SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1778                         (c->secure_bits & SECURE_NOROOT) ? " noroot" : "",
1779                         (c->secure_bits & SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1780
1781         if (c->capability_bounding_set_drop) {
1782                 unsigned long l;
1783                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1784
1785                 for (l = 0; l <= cap_last_cap(); l++)
1786                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1787                                 char *t;
1788
1789                                 if ((t = cap_to_name(l))) {
1790                                         fprintf(f, " %s", t);
1791                                         cap_free(t);
1792                                 }
1793                         }
1794
1795                 fputs("\n", f);
1796         }
1797
1798         if (c->user)
1799                 fprintf(f, "%sUser: %s\n", prefix, c->user);
1800         if (c->group)
1801                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
1802
1803         if (strv_length(c->supplementary_groups) > 0) {
1804                 fprintf(f, "%sSupplementaryGroups:", prefix);
1805                 strv_fprintf(f, c->supplementary_groups);
1806                 fputs("\n", f);
1807         }
1808
1809         if (c->pam_name)
1810                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
1811
1812         if (strv_length(c->read_write_dirs) > 0) {
1813                 fprintf(f, "%sReadWriteDirs:", prefix);
1814                 strv_fprintf(f, c->read_write_dirs);
1815                 fputs("\n", f);
1816         }
1817
1818         if (strv_length(c->read_only_dirs) > 0) {
1819                 fprintf(f, "%sReadOnlyDirs:", prefix);
1820                 strv_fprintf(f, c->read_only_dirs);
1821                 fputs("\n", f);
1822         }
1823
1824         if (strv_length(c->inaccessible_dirs) > 0) {
1825                 fprintf(f, "%sInaccessibleDirs:", prefix);
1826                 strv_fprintf(f, c->inaccessible_dirs);
1827                 fputs("\n", f);
1828         }
1829
1830         fprintf(f,
1831                 "%sKillMode: %s\n"
1832                 "%sKillSignal: SIG%s\n"
1833                 "%sSendSIGKILL: %s\n"
1834                 "%sIgnoreSIGPIPE: %s\n",
1835                 prefix, kill_mode_to_string(c->kill_mode),
1836                 prefix, signal_to_string(c->kill_signal),
1837                 prefix, yes_no(c->send_sigkill),
1838                 prefix, yes_no(c->ignore_sigpipe));
1839
1840         if (c->utmp_id)
1841                 fprintf(f,
1842                         "%sUtmpIdentifier: %s\n",
1843                         prefix, c->utmp_id);
1844 }
1845
1846 void exec_status_start(ExecStatus *s, pid_t pid) {
1847         assert(s);
1848
1849         zero(*s);
1850         s->pid = pid;
1851         dual_timestamp_get(&s->start_timestamp);
1852 }
1853
1854 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
1855         assert(s);
1856
1857         if (s->pid && s->pid != pid)
1858                 zero(*s);
1859
1860         s->pid = pid;
1861         dual_timestamp_get(&s->exit_timestamp);
1862
1863         s->code = code;
1864         s->status = status;
1865
1866         if (context) {
1867                 if (context->utmp_id)
1868                         utmp_put_dead_process(context->utmp_id, pid, code, status);
1869
1870                 exec_context_tty_reset(context);
1871         }
1872 }
1873
1874 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
1875         char buf[FORMAT_TIMESTAMP_MAX];
1876
1877         assert(s);
1878         assert(f);
1879
1880         if (!prefix)
1881                 prefix = "";
1882
1883         if (s->pid <= 0)
1884                 return;
1885
1886         fprintf(f,
1887                 "%sPID: %lu\n",
1888                 prefix, (unsigned long) s->pid);
1889
1890         if (s->start_timestamp.realtime > 0)
1891                 fprintf(f,
1892                         "%sStart Timestamp: %s\n",
1893                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
1894
1895         if (s->exit_timestamp.realtime > 0)
1896                 fprintf(f,
1897                         "%sExit Timestamp: %s\n"
1898                         "%sExit Code: %s\n"
1899                         "%sExit Status: %i\n",
1900                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
1901                         prefix, sigchld_code_to_string(s->code),
1902                         prefix, s->status);
1903 }
1904
1905 char *exec_command_line(char **argv) {
1906         size_t k;
1907         char *n, *p, **a;
1908         bool first = true;
1909
1910         assert(argv);
1911
1912         k = 1;
1913         STRV_FOREACH(a, argv)
1914                 k += strlen(*a)+3;
1915
1916         if (!(n = new(char, k)))
1917                 return NULL;
1918
1919         p = n;
1920         STRV_FOREACH(a, argv) {
1921
1922                 if (!first)
1923                         *(p++) = ' ';
1924                 else
1925                         first = false;
1926
1927                 if (strpbrk(*a, WHITESPACE)) {
1928                         *(p++) = '\'';
1929                         p = stpcpy(p, *a);
1930                         *(p++) = '\'';
1931                 } else
1932                         p = stpcpy(p, *a);
1933
1934         }
1935
1936         *p = 0;
1937
1938         /* FIXME: this doesn't really handle arguments that have
1939          * spaces and ticks in them */
1940
1941         return n;
1942 }
1943
1944 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
1945         char *p2;
1946         const char *prefix2;
1947
1948         char *cmd;
1949
1950         assert(c);
1951         assert(f);
1952
1953         if (!prefix)
1954                 prefix = "";
1955         p2 = strappend(prefix, "\t");
1956         prefix2 = p2 ? p2 : prefix;
1957
1958         cmd = exec_command_line(c->argv);
1959
1960         fprintf(f,
1961                 "%sCommand Line: %s\n",
1962                 prefix, cmd ? cmd : strerror(ENOMEM));
1963
1964         free(cmd);
1965
1966         exec_status_dump(&c->exec_status, f, prefix2);
1967
1968         free(p2);
1969 }
1970
1971 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
1972         assert(f);
1973
1974         if (!prefix)
1975                 prefix = "";
1976
1977         LIST_FOREACH(command, c, c)
1978                 exec_command_dump(c, f, prefix);
1979 }
1980
1981 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
1982         ExecCommand *end;
1983
1984         assert(l);
1985         assert(e);
1986
1987         if (*l) {
1988                 /* It's kind of important, that we keep the order here */
1989                 LIST_FIND_TAIL(ExecCommand, command, *l, end);
1990                 LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
1991         } else
1992               *l = e;
1993 }
1994
1995 int exec_command_set(ExecCommand *c, const char *path, ...) {
1996         va_list ap;
1997         char **l, *p;
1998
1999         assert(c);
2000         assert(path);
2001
2002         va_start(ap, path);
2003         l = strv_new_ap(path, ap);
2004         va_end(ap);
2005
2006         if (!l)
2007                 return -ENOMEM;
2008
2009         if (!(p = strdup(path))) {
2010                 strv_free(l);
2011                 return -ENOMEM;
2012         }
2013
2014         free(c->path);
2015         c->path = p;
2016
2017         strv_free(c->argv);
2018         c->argv = l;
2019
2020         return 0;
2021 }
2022
2023 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2024         [EXEC_INPUT_NULL] = "null",
2025         [EXEC_INPUT_TTY] = "tty",
2026         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2027         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2028         [EXEC_INPUT_SOCKET] = "socket"
2029 };
2030
2031 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2032
2033 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2034         [EXEC_OUTPUT_INHERIT] = "inherit",
2035         [EXEC_OUTPUT_NULL] = "null",
2036         [EXEC_OUTPUT_TTY] = "tty",
2037         [EXEC_OUTPUT_SYSLOG] = "syslog",
2038         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2039         [EXEC_OUTPUT_KMSG] = "kmsg",
2040         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2041         [EXEC_OUTPUT_JOURNAL] = "journal",
2042         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2043         [EXEC_OUTPUT_SOCKET] = "socket"
2044 };
2045
2046 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
2047
2048 static const char* const kill_mode_table[_KILL_MODE_MAX] = {
2049         [KILL_CONTROL_GROUP] = "control-group",
2050         [KILL_PROCESS] = "process",
2051         [KILL_NONE] = "none"
2052 };
2053
2054 DEFINE_STRING_TABLE_LOOKUP(kill_mode, KillMode);
2055
2056 static const char* const kill_who_table[_KILL_WHO_MAX] = {
2057         [KILL_MAIN] = "main",
2058         [KILL_CONTROL] = "control",
2059         [KILL_ALL] = "all"
2060 };
2061
2062 DEFINE_STRING_TABLE_LOOKUP(kill_who, KillWho);