src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <linux/seccomp-bpf.h>
  42 #include <glob.h>
  43 #include <libgen.h>
  44 #undef basename
  45
  46 #ifdef HAVE_PAM
  47 #include <security/pam_appl.h>
  48 #endif
  49
  50 #include "execute.h"
  51 #include "strv.h"
  52 #include "macro.h"
  53 #include "capability.h"
  54 #include "util.h"
  55 #include "log.h"
  56 #include "sd-messages.h"
  57 #include "ioprio.h"
  58 #include "securebits.h"
  59 #include "namespace.h"
  60 #include "tcpwrap.h"
  61 #include "exit-status.h"
  62 #include "missing.h"
  63 #include "utmp-wtmp.h"
  64 #include "def.h"
  65 #include "path-util.h"
  66 #include "syscall-list.h"
  67 #include "env-util.h"
  68 #include "fileio.h"
  69 #include "unit.h"
  70 #include "async.h"
  71
  72 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  73 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
  74
  75 /* This assumes there is a 'tty' group */
  76 #define TTY_MODE 0620
  77
  78 #define SNDBUF_SIZE (8*1024*1024)
  79
  80 static int shift_fds(int fds[], unsigned n_fds) {
  81         int start, restart_from;
  82
  83         if (n_fds <= 0)
  84                 return 0;
  85
  86         /* Modifies the fds array! (sorts it) */
  87
  88         assert(fds);
  89
  90         start = 0;
  91         for (;;) {
  92                 int i;
  93
  94                 restart_from = -1;
  95
  96                 for (i = start; i < (int) n_fds; i++) {
  97                         int nfd;
  98
  99                         /* Already at right index? */
 100                         if (fds[i] == i+3)
 101                                 continue;
 102
 103                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
 104                                 return -errno;
 105
 106                         close_nointr_nofail(fds[i]);
 107                         fds[i] = nfd;
 108
 109                         /* Hmm, the fd we wanted isn't free? Then
 110                          * let's remember that and try again from here*/
 111                         if (nfd != i+3 && restart_from < 0)
 112                                 restart_from = i;
 113                 }
 114
 115                 if (restart_from < 0)
 116                         break;
 117
 118                 start = restart_from;
 119         }
 120
 121         return 0;
 122 }
 123
 124 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 125         unsigned i;
 126         int r;
 127
 128         if (n_fds <= 0)
 129                 return 0;
 130
 131         assert(fds);
 132
 133         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 134
 135         for (i = 0; i < n_fds; i++) {
 136
 137                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 138                         return r;
 139
 140                 /* We unconditionally drop FD_CLOEXEC from the fds,
 141                  * since after all we want to pass these fds to our
 142                  * children */
 143
 144                 if ((r = fd_cloexec(fds[i], false)) < 0)
 145                         return r;
 146         }
 147
 148         return 0;
 149 }
 150
 151 _pure_ static const char *tty_path(const ExecContext *context) {
 152         assert(context);
 153
 154         if (context->tty_path)
 155                 return context->tty_path;
 156
 157         return "/dev/console";
 158 }
 159
 160 static void exec_context_tty_reset(const ExecContext *context) {
 161         assert(context);
 162
 163         if (context->tty_vhangup)
 164                 terminal_vhangup(tty_path(context));
 165
 166         if (context->tty_reset)
 167                 reset_terminal(tty_path(context));
 168
 169         if (context->tty_vt_disallocate && context->tty_path)
 170                 vt_disallocate(context->tty_path);
 171 }
 172
 173 static bool is_terminal_output(ExecOutput o) {
 174         return
 175                 o == EXEC_OUTPUT_TTY ||
 176                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 177                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 178                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 179 }
 180
 181 static int open_null_as(int flags, int nfd) {
 182         int fd, r;
 183
 184         assert(nfd >= 0);
 185
 186         fd = open("/dev/null", flags|O_NOCTTY);
 187         if (fd < 0)
 188                 return -errno;
 189
 190         if (fd != nfd) {
 191                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 192                 close_nointr_nofail(fd);
 193         } else
 194                 r = nfd;
 195
 196         return r;
 197 }
 198
 199 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 200         int fd, r;
 201         union sockaddr_union sa = {
 202                 .un.sun_family = AF_UNIX,
 203                 .un.sun_path = "/run/systemd/journal/stdout",
 204         };
 205
 206         assert(context);
 207         assert(output < _EXEC_OUTPUT_MAX);
 208         assert(ident);
 209         assert(nfd >= 0);
 210
 211         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 212         if (fd < 0)
 213                 return -errno;
 214
 215         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 216         if (r < 0) {
 217                 close_nointr_nofail(fd);
 218                 return -errno;
 219         }
 220
 221         if (shutdown(fd, SHUT_RD) < 0) {
 222                 close_nointr_nofail(fd);
 223                 return -errno;
 224         }
 225
 226         fd_inc_sndbuf(fd, SNDBUF_SIZE);
 227
 228         dprintf(fd,
 229                 "%s\n"
 230                 "%s\n"
 231                 "%i\n"
 232                 "%i\n"
 233                 "%i\n"
 234                 "%i\n"
 235                 "%i\n",
 236                 context->syslog_identifier ? context->syslog_identifier : ident,
 237                 unit_id,
 238                 context->syslog_priority,
 239                 !!context->syslog_level_prefix,
 240                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 241                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 242                 is_terminal_output(output));
 243
 244         if (fd != nfd) {
 245                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 246                 close_nointr_nofail(fd);
 247         } else
 248                 r = nfd;
 249
 250         return r;
 251 }
 252 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 253         int fd, r;
 254
 255         assert(path);
 256         assert(nfd >= 0);
 257
 258         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 259                 return fd;
 260
 261         if (fd != nfd) {
 262                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 263                 close_nointr_nofail(fd);
 264         } else
 265                 r = nfd;
 266
 267         return r;
 268 }
 269
 270 static bool is_terminal_input(ExecInput i) {
 271         return
 272                 i == EXEC_INPUT_TTY ||
 273                 i == EXEC_INPUT_TTY_FORCE ||
 274                 i == EXEC_INPUT_TTY_FAIL;
 275 }
 276
 277 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 278
 279         if (is_terminal_input(std_input) && !apply_tty_stdin)
 280                 return EXEC_INPUT_NULL;
 281
 282         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 283                 return EXEC_INPUT_NULL;
 284
 285         return std_input;
 286 }
 287
 288 static int fixup_output(ExecOutput std_output, int socket_fd) {
 289
 290         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 291                 return EXEC_OUTPUT_INHERIT;
 292
 293         return std_output;
 294 }
 295
 296 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 297         ExecInput i;
 298
 299         assert(context);
 300
 301         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 302
 303         switch (i) {
 304
 305         case EXEC_INPUT_NULL:
 306                 return open_null_as(O_RDONLY, STDIN_FILENO);
 307
 308         case EXEC_INPUT_TTY:
 309         case EXEC_INPUT_TTY_FORCE:
 310         case EXEC_INPUT_TTY_FAIL: {
 311                 int fd, r;
 312
 313                 fd = acquire_terminal(tty_path(context),
 314                                       i == EXEC_INPUT_TTY_FAIL,
 315                                       i == EXEC_INPUT_TTY_FORCE,
 316                                       false,
 317                                       (usec_t) -1);
 318                 if (fd < 0)
 319                         return fd;
 320
 321                 if (fd != STDIN_FILENO) {
 322                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 323                         close_nointr_nofail(fd);
 324                 } else
 325                         r = STDIN_FILENO;
 326
 327                 return r;
 328         }
 329
 330         case EXEC_INPUT_SOCKET:
 331                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 332
 333         default:
 334                 assert_not_reached("Unknown input type");
 335         }
 336 }
 337
 338 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 339         ExecOutput o;
 340         ExecInput i;
 341         int r;
 342
 343         assert(context);
 344         assert(ident);
 345
 346         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 347         o = fixup_output(context->std_output, socket_fd);
 348
 349         if (fileno == STDERR_FILENO) {
 350                 ExecOutput e;
 351                 e = fixup_output(context->std_error, socket_fd);
 352
 353                 /* This expects the input and output are already set up */
 354
 355                 /* Don't change the stderr file descriptor if we inherit all
 356                  * the way and are not on a tty */
 357                 if (e == EXEC_OUTPUT_INHERIT &&
 358                     o == EXEC_OUTPUT_INHERIT &&
 359                     i == EXEC_INPUT_NULL &&
 360                     !is_terminal_input(context->std_input) &&
 361                     getppid () != 1)
 362                         return fileno;
 363
 364                 /* Duplicate from stdout if possible */
 365                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 366                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 367
 368                 o = e;
 369
 370         } else if (o == EXEC_OUTPUT_INHERIT) {
 371                 /* If input got downgraded, inherit the original value */
 372                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 373                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 374
 375                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 376                 if (i != EXEC_INPUT_NULL)
 377                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 378
 379                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 380                 if (getppid() != 1)
 381                         return fileno;
 382
 383                 /* We need to open /dev/null here anew, to get the right access mode. */
 384                 return open_null_as(O_WRONLY, fileno);
 385         }
 386
 387         switch (o) {
 388
 389         case EXEC_OUTPUT_NULL:
 390                 return open_null_as(O_WRONLY, fileno);
 391
 392         case EXEC_OUTPUT_TTY:
 393                 if (is_terminal_input(i))
 394                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 395
 396                 /* We don't reset the terminal if this is just about output */
 397                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 398
 399         case EXEC_OUTPUT_SYSLOG:
 400         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 401         case EXEC_OUTPUT_KMSG:
 402         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 403         case EXEC_OUTPUT_JOURNAL:
 404         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 405                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 406                 if (r < 0) {
 407                         log_struct_unit(LOG_CRIT, unit_id,
 408                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 409                                 fileno == STDOUT_FILENO ? "out" : "err",
 410                                 unit_id, strerror(-r),
 411                                 "ERRNO=%d", -r,
 412                                 NULL);
 413                         r = open_null_as(O_WRONLY, fileno);
 414                 }
 415                 return r;
 416
 417         case EXEC_OUTPUT_SOCKET:
 418                 assert(socket_fd >= 0);
 419                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 420
 421         default:
 422                 assert_not_reached("Unknown error type");
 423         }
 424 }
 425
 426 static int chown_terminal(int fd, uid_t uid) {
 427         struct stat st;
 428
 429         assert(fd >= 0);
 430
 431         /* This might fail. What matters are the results. */
 432         (void) fchown(fd, uid, -1);
 433         (void) fchmod(fd, TTY_MODE);
 434
 435         if (fstat(fd, &st) < 0)
 436                 return -errno;
 437
 438         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 439                 return -EPERM;
 440
 441         return 0;
 442 }
 443
 444 static int setup_confirm_stdio(int *_saved_stdin,
 445                                int *_saved_stdout) {
 446         int fd = -1, saved_stdin, saved_stdout = -1, r;
 447
 448         assert(_saved_stdin);
 449         assert(_saved_stdout);
 450
 451         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 452         if (saved_stdin < 0)
 453                 return -errno;
 454
 455         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 456         if (saved_stdout < 0) {
 457                 r = errno;
 458                 goto fail;
 459         }
 460
 461         fd = acquire_terminal(
 462                         "/dev/console",
 463                         false,
 464                         false,
 465                         false,
 466                         DEFAULT_CONFIRM_USEC);
 467         if (fd < 0) {
 468                 r = fd;
 469                 goto fail;
 470         }
 471
 472         r = chown_terminal(fd, getuid());
 473         if (r < 0)
 474                 goto fail;
 475
 476         if (dup2(fd, STDIN_FILENO) < 0) {
 477                 r = -errno;
 478                 goto fail;
 479         }
 480
 481         if (dup2(fd, STDOUT_FILENO) < 0) {
 482                 r = -errno;
 483                 goto fail;
 484         }
 485
 486         if (fd >= 2)
 487                 close_nointr_nofail(fd);
 488
 489         *_saved_stdin = saved_stdin;
 490         *_saved_stdout = saved_stdout;
 491
 492         return 0;
 493
 494 fail:
 495         if (saved_stdout >= 0)
 496                 close_nointr_nofail(saved_stdout);
 497
 498         if (saved_stdin >= 0)
 499                 close_nointr_nofail(saved_stdin);
 500
 501         if (fd >= 0)
 502                 close_nointr_nofail(fd);
 503
 504         return r;
 505 }
 506
 507 _printf_(1, 2) static int write_confirm_message(const char *format, ...) {
 508         int fd;
 509         va_list ap;
 510
 511         assert(format);
 512
 513         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 514         if (fd < 0)
 515                 return fd;
 516
 517         va_start(ap, format);
 518         vdprintf(fd, format, ap);
 519         va_end(ap);
 520
 521         close_nointr_nofail(fd);
 522
 523         return 0;
 524 }
 525
 526 static int restore_confirm_stdio(int *saved_stdin,
 527                                  int *saved_stdout) {
 528
 529         int r = 0;
 530
 531         assert(saved_stdin);
 532         assert(saved_stdout);
 533
 534         release_terminal();
 535
 536         if (*saved_stdin >= 0)
 537                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 538                         r = -errno;
 539
 540         if (*saved_stdout >= 0)
 541                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 542                         r = -errno;
 543
 544         if (*saved_stdin >= 0)
 545                 close_nointr_nofail(*saved_stdin);
 546
 547         if (*saved_stdout >= 0)
 548                 close_nointr_nofail(*saved_stdout);
 549
 550         return r;
 551 }
 552
 553 static int ask_for_confirmation(char *response, char **argv) {
 554         int saved_stdout = -1, saved_stdin = -1, r;
 555         char *line;
 556
 557         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 558         if (r < 0)
 559                 return r;
 560
 561         line = exec_command_line(argv);
 562         if (!line)
 563                 return -ENOMEM;
 564
 565         r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 566         free(line);
 567
 568         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 569
 570         return r;
 571 }
 572
 573 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 574         bool keep_groups = false;
 575         int r;
 576
 577         assert(context);
 578
 579         /* Lookup and set GID and supplementary group list. Here too
 580          * we avoid NSS lookups for gid=0. */
 581
 582         if (context->group || username) {
 583
 584                 if (context->group) {
 585                         const char *g = context->group;
 586
 587                         if ((r = get_group_creds(&g, &gid)) < 0)
 588                                 return r;
 589                 }
 590
 591                 /* First step, initialize groups from /etc/groups */
 592                 if (username && gid != 0) {
 593                         if (initgroups(username, gid) < 0)
 594                                 return -errno;
 595
 596                         keep_groups = true;
 597                 }
 598
 599                 /* Second step, set our gids */
 600                 if (setresgid(gid, gid, gid) < 0)
 601                         return -errno;
 602         }
 603
 604         if (context->supplementary_groups) {
 605                 int ngroups_max, k;
 606                 gid_t *gids;
 607                 char **i;
 608
 609                 /* Final step, initialize any manually set supplementary groups */
 610                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 611
 612                 if (!(gids = new(gid_t, ngroups_max)))
 613                         return -ENOMEM;
 614
 615                 if (keep_groups) {
 616                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 617                                 free(gids);
 618                                 return -errno;
 619                         }
 620                 } else
 621                         k = 0;
 622
 623                 STRV_FOREACH(i, context->supplementary_groups) {
 624                         const char *g;
 625
 626                         if (k >= ngroups_max) {
 627                                 free(gids);
 628                                 return -E2BIG;
 629                         }
 630
 631                         g = *i;
 632                         r = get_group_creds(&g, gids+k);
 633                         if (r < 0) {
 634                                 free(gids);
 635                                 return r;
 636                         }
 637
 638                         k++;
 639                 }
 640
 641                 if (setgroups(k, gids) < 0) {
 642                         free(gids);
 643                         return -errno;
 644                 }
 645
 646                 free(gids);
 647         }
 648
 649         return 0;
 650 }
 651
 652 static int enforce_user(const ExecContext *context, uid_t uid) {
 653         int r;
 654         assert(context);
 655
 656         /* Sets (but doesn't lookup) the uid and make sure we keep the
 657          * capabilities while doing so. */
 658
 659         if (context->capabilities) {
 660                 cap_t d;
 661                 static const cap_value_t bits[] = {
 662                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 663                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 664                 };
 665
 666                 /* First step: If we need to keep capabilities but
 667                  * drop privileges we need to make sure we keep our
 668                  * caps, while we drop privileges. */
 669                 if (uid != 0) {
 670                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 671
 672                         if (prctl(PR_GET_SECUREBITS) != sb)
 673                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 674                                         return -errno;
 675                 }
 676
 677                 /* Second step: set the capabilities. This will reduce
 678                  * the capabilities to the minimum we need. */
 679
 680                 if (!(d = cap_dup(context->capabilities)))
 681                         return -errno;
 682
 683                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 684                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 685                         r = -errno;
 686                         cap_free(d);
 687                         return r;
 688                 }
 689
 690                 if (cap_set_proc(d) < 0) {
 691                         r = -errno;
 692                         cap_free(d);
 693                         return r;
 694                 }
 695
 696                 cap_free(d);
 697         }
 698
 699         /* Third step: actually set the uids */
 700         if (setresuid(uid, uid, uid) < 0)
 701                 return -errno;
 702
 703         /* At this point we should have all necessary capabilities but
 704            are otherwise a normal user. However, the caps might got
 705            corrupted due to the setresuid() so we need clean them up
 706            later. This is done outside of this call. */
 707
 708         return 0;
 709 }
 710
 711 #ifdef HAVE_PAM
 712
 713 static int null_conv(
 714                 int num_msg,
 715                 const struct pam_message **msg,
 716                 struct pam_response **resp,
 717                 void *appdata_ptr) {
 718
 719         /* We don't support conversations */
 720
 721         return PAM_CONV_ERR;
 722 }
 723
 724 static int setup_pam(
 725                 const char *name,
 726                 const char *user,
 727                 uid_t uid,
 728                 const char *tty,
 729                 char ***pam_env,
 730                 int fds[], unsigned n_fds) {
 731
 732         static const struct pam_conv conv = {
 733                 .conv = null_conv,
 734                 .appdata_ptr = NULL
 735         };
 736
 737         pam_handle_t *handle = NULL;
 738         sigset_t ss, old_ss;
 739         int pam_code = PAM_SUCCESS;
 740         int err;
 741         char **e = NULL;
 742         bool close_session = false;
 743         pid_t pam_pid = 0, parent_pid;
 744         int flags = 0;
 745
 746         assert(name);
 747         assert(user);
 748         assert(pam_env);
 749
 750         /* We set up PAM in the parent process, then fork. The child
 751          * will then stay around until killed via PR_GET_PDEATHSIG or
 752          * systemd via the cgroup logic. It will then remove the PAM
 753          * session again. The parent process will exec() the actual
 754          * daemon. We do things this way to ensure that the main PID
 755          * of the daemon is the one we initially fork()ed. */
 756
 757         if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
 758                 flags |= PAM_SILENT;
 759
 760         pam_code = pam_start(name, user, &conv, &handle);
 761         if (pam_code != PAM_SUCCESS) {
 762                 handle = NULL;
 763                 goto fail;
 764         }
 765
 766         if (tty) {
 767                 pam_code = pam_set_item(handle, PAM_TTY, tty);
 768                 if (pam_code != PAM_SUCCESS)
 769                         goto fail;
 770         }
 771
 772         pam_code = pam_acct_mgmt(handle, flags);
 773         if (pam_code != PAM_SUCCESS)
 774                 goto fail;
 775
 776         pam_code = pam_open_session(handle, flags);
 777         if (pam_code != PAM_SUCCESS)
 778                 goto fail;
 779
 780         close_session = true;
 781
 782         e = pam_getenvlist(handle);
 783         if (!e) {
 784                 pam_code = PAM_BUF_ERR;
 785                 goto fail;
 786         }
 787
 788         /* Block SIGTERM, so that we know that it won't get lost in
 789          * the child */
 790         if (sigemptyset(&ss) < 0 ||
 791             sigaddset(&ss, SIGTERM) < 0 ||
 792             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 793                 goto fail;
 794
 795         parent_pid = getpid();
 796
 797         pam_pid = fork();
 798         if (pam_pid < 0)
 799                 goto fail;
 800
 801         if (pam_pid == 0) {
 802                 int sig;
 803                 int r = EXIT_PAM;
 804
 805                 /* The child's job is to reset the PAM session on
 806                  * termination */
 807
 808                 /* This string must fit in 10 chars (i.e. the length
 809                  * of "/sbin/init"), to look pretty in /bin/ps */
 810                 rename_process("(sd-pam)");
 811
 812                 /* Make sure we don't keep open the passed fds in this
 813                 child. We assume that otherwise only those fds are
 814                 open here that have been opened by PAM. */
 815                 close_many(fds, n_fds);
 816
 817                 /* Drop privileges - we don't need any to pam_close_session
 818                  * and this will make PR_SET_PDEATHSIG work in most cases.
 819                  * If this fails, ignore the error - but expect sd-pam threads
 820                  * to fail to exit normally */
 821                 if (setresuid(uid, uid, uid) < 0)
 822                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 823
 824                 /* Wait until our parent died. This will only work if
 825                  * the above setresuid() succeeds, otherwise the kernel
 826                  * will not allow unprivileged parents kill their privileged
 827                  * children this way. We rely on the control groups kill logic
 828                  * to do the rest for us. */
 829                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 830                         goto child_finish;
 831
 832                 /* Check if our parent process might already have
 833                  * died? */
 834                 if (getppid() == parent_pid) {
 835                         for (;;) {
 836                                 if (sigwait(&ss, &sig) < 0) {
 837                                         if (errno == EINTR)
 838                                                 continue;
 839
 840                                         goto child_finish;
 841                                 }
 842
 843                                 assert(sig == SIGTERM);
 844                                 break;
 845                         }
 846                 }
 847
 848                 /* If our parent died we'll end the session */
 849                 if (getppid() != parent_pid) {
 850                         pam_code = pam_close_session(handle, flags);
 851                         if (pam_code != PAM_SUCCESS)
 852                                 goto child_finish;
 853                 }
 854
 855                 r = 0;
 856
 857         child_finish:
 858                 pam_end(handle, pam_code | flags);
 859                 _exit(r);
 860         }
 861
 862         /* If the child was forked off successfully it will do all the
 863          * cleanups, so forget about the handle here. */
 864         handle = NULL;
 865
 866         /* Unblock SIGTERM again in the parent */
 867         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 868                 goto fail;
 869
 870         /* We close the log explicitly here, since the PAM modules
 871          * might have opened it, but we don't want this fd around. */
 872         closelog();
 873
 874         *pam_env = e;
 875         e = NULL;
 876
 877         return 0;
 878
 879 fail:
 880         if (pam_code != PAM_SUCCESS) {
 881                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
 882                 err = -EPERM;  /* PAM errors do not map to errno */
 883         } else {
 884                 log_error("PAM failed: %m");
 885                 err = -errno;
 886         }
 887
 888         if (handle) {
 889                 if (close_session)
 890                         pam_code = pam_close_session(handle, flags);
 891
 892                 pam_end(handle, pam_code | flags);
 893         }
 894
 895         strv_free(e);
 896
 897         closelog();
 898
 899         if (pam_pid > 1) {
 900                 kill(pam_pid, SIGTERM);
 901                 kill(pam_pid, SIGCONT);
 902         }
 903
 904         return err;
 905 }
 906 #endif
 907
 908 static void rename_process_from_path(const char *path) {
 909         char process_name[11];
 910         const char *p;
 911         size_t l;
 912
 913         /* This resulting string must fit in 10 chars (i.e. the length
 914          * of "/sbin/init") to look pretty in /bin/ps */
 915
 916         p = basename(path);
 917         if (isempty(p)) {
 918                 rename_process("(...)");
 919                 return;
 920         }
 921
 922         l = strlen(p);
 923         if (l > 8) {
 924                 /* The end of the process name is usually more
 925                  * interesting, since the first bit might just be
 926                  * "systemd-" */
 927                 p = p + l - 8;
 928                 l = 8;
 929         }
 930
 931         process_name[0] = '(';
 932         memcpy(process_name+1, p, l);
 933         process_name[1+l] = ')';
 934         process_name[1+l+1] = 0;
 935
 936         rename_process(process_name);
 937 }
 938
 939 static int apply_seccomp(uint32_t *syscall_filter) {
 940         static const struct sock_filter header[] = {
 941                 VALIDATE_ARCHITECTURE,
 942                 EXAMINE_SYSCALL
 943         };
 944         static const struct sock_filter footer[] = {
 945                 _KILL_PROCESS
 946         };
 947
 948         int i;
 949         unsigned n;
 950         struct sock_filter *f;
 951         struct sock_fprog prog = {};
 952
 953         assert(syscall_filter);
 954
 955         /* First: count the syscalls to check for */
 956         for (i = 0, n = 0; i < syscall_max(); i++)
 957                 if (syscall_filter[i >> 4] & (1 << (i & 31)))
 958                         n++;
 959
 960         /* Second: build the filter program from a header the syscall
 961          * matches and the footer */
 962         f = alloca(sizeof(struct sock_filter) * (ELEMENTSOF(header) + 2*n + ELEMENTSOF(footer)));
 963         memcpy(f, header, sizeof(header));
 964
 965         for (i = 0, n = 0; i < syscall_max(); i++)
 966                 if (syscall_filter[i >> 4] & (1 << (i & 31))) {
 967                         struct sock_filter item[] = {
 968                                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, INDEX_TO_SYSCALL(i), 0, 1),
 969                                 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 970                         };
 971
 972                         assert_cc(ELEMENTSOF(item) == 2);
 973
 974                         f[ELEMENTSOF(header) + 2*n]  = item[0];
 975                         f[ELEMENTSOF(header) + 2*n+1] = item[1];
 976
 977                         n++;
 978                 }
 979
 980         memcpy(f + (ELEMENTSOF(header) + 2*n), footer, sizeof(footer));
 981
 982         /* Third: install the filter */
 983         prog.len = ELEMENTSOF(header) + ELEMENTSOF(footer) + 2*n;
 984         prog.filter = f;
 985         if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0)
 986                 return -errno;
 987
 988         return 0;
 989 }
 990
 991 static void do_idle_pipe_dance(int idle_pipe[4]) {
 992         assert(idle_pipe);
 993
 994         if (idle_pipe[1] >= 0)
 995                 close_nointr_nofail(idle_pipe[1]);
 996         if (idle_pipe[2] >= 0)
 997                 close_nointr_nofail(idle_pipe[2]);
 998
 999         if (idle_pipe[0] >= 0) {
1000                 int r;
1001
1002                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1003
1004                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1005                         /* Signal systemd that we are bored and want to continue. */
1006                         write(idle_pipe[3], "x", 1);
1007
1008                         /* Wait for systemd to react to the signal above. */
1009                         fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1010                 }
1011
1012                 close_nointr_nofail(idle_pipe[0]);
1013
1014         }
1015
1016         if (idle_pipe[3] >= 0)
1017                 close_nointr_nofail(idle_pipe[3]);
1018 }
1019
1020 static int build_environment(
1021                 ExecContext *c,
1022                 unsigned n_fds,
1023                 const char *home,
1024                 const char *username,
1025                 const char *shell,
1026                 char ***ret) {
1027
1028         _cleanup_strv_free_ char **our_env = NULL;
1029         unsigned n_env = 0;
1030         char *x;
1031
1032         assert(c);
1033         assert(ret);
1034
1035         our_env = new(char*, 8);
1036         if (!our_env)
1037                 return -ENOMEM;
1038
1039         if (n_fds > 0) {
1040                 if (asprintf(&x, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0)
1041                         return -ENOMEM;
1042                 our_env[n_env++] = x;
1043
1044                 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1045                         return -ENOMEM;
1046                 our_env[n_env++] = x;
1047         }
1048
1049         if (home) {
1050                 x = strappend("HOME=", home);
1051                 if (!x)
1052                         return -ENOMEM;
1053                 our_env[n_env++] = x;
1054         }
1055
1056         if (username) {
1057                 x = strappend("LOGNAME=", username);
1058                 if (!x)
1059                         return -ENOMEM;
1060                 our_env[n_env++] = x;
1061
1062                 x = strappend("USER=", username);
1063                 if (!x)
1064                         return -ENOMEM;
1065                 our_env[n_env++] = x;
1066         }
1067
1068         if (shell) {
1069                 x = strappend("SHELL=", shell);
1070                 if (!x)
1071                         return -ENOMEM;
1072                 our_env[n_env++] = x;
1073         }
1074
1075         if (is_terminal_input(c->std_input) ||
1076             c->std_output == EXEC_OUTPUT_TTY ||
1077             c->std_error == EXEC_OUTPUT_TTY ||
1078             c->tty_path) {
1079
1080                 x = strdup(default_term_for_tty(tty_path(c)));
1081                 if (!x)
1082                         return -ENOMEM;
1083                 our_env[n_env++] = x;
1084         }
1085
1086         our_env[n_env++] = NULL;
1087         assert(n_env <= 8);
1088
1089         *ret = our_env;
1090         our_env = NULL;
1091
1092         return 0;
1093 }
1094
1095 int exec_spawn(ExecCommand *command,
1096                char **argv,
1097                ExecContext *context,
1098                int fds[], unsigned n_fds,
1099                char **environment,
1100                bool apply_permissions,
1101                bool apply_chroot,
1102                bool apply_tty_stdin,
1103                bool confirm_spawn,
1104                CGroupControllerMask cgroup_supported,
1105                const char *cgroup_path,
1106                const char *unit_id,
1107                int idle_pipe[4],
1108                ExecRuntime *runtime,
1109                pid_t *ret) {
1110
1111         _cleanup_strv_free_ char **files_env = NULL;
1112         int socket_fd;
1113         char *line;
1114         pid_t pid;
1115         int r;
1116
1117         assert(command);
1118         assert(context);
1119         assert(ret);
1120         assert(fds || n_fds <= 0);
1121
1122         if (context->std_input == EXEC_INPUT_SOCKET ||
1123             context->std_output == EXEC_OUTPUT_SOCKET ||
1124             context->std_error == EXEC_OUTPUT_SOCKET) {
1125
1126                 if (n_fds != 1)
1127                         return -EINVAL;
1128
1129                 socket_fd = fds[0];
1130
1131                 fds = NULL;
1132                 n_fds = 0;
1133         } else
1134                 socket_fd = -1;
1135
1136         r = exec_context_load_environment(context, &files_env);
1137         if (r < 0) {
1138                 log_struct_unit(LOG_ERR,
1139                            unit_id,
1140                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1141                            "ERRNO=%d", -r,
1142                            NULL);
1143                 return r;
1144         }
1145
1146         if (!argv)
1147                 argv = command->argv;
1148
1149         line = exec_command_line(argv);
1150         if (!line)
1151                 return log_oom();
1152
1153         log_struct_unit(LOG_DEBUG,
1154                         unit_id,
1155                         "EXECUTABLE=%s", command->path,
1156                         "MESSAGE=About to execute: %s", line,
1157                         NULL);
1158         free(line);
1159
1160         pid = fork();
1161         if (pid < 0)
1162                 return -errno;
1163
1164         if (pid == 0) {
1165                 _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
1166                 const char *username = NULL, *home = NULL, *shell = NULL;
1167                 unsigned n_dont_close = 0;
1168                 int dont_close[n_fds + 3];
1169                 uid_t uid = (uid_t) -1;
1170                 gid_t gid = (gid_t) -1;
1171                 sigset_t ss;
1172                 int i, err;
1173
1174                 /* child */
1175
1176                 rename_process_from_path(command->path);
1177
1178                 /* We reset exactly these signals, since they are the
1179                  * only ones we set to SIG_IGN in the main daemon. All
1180                  * others we leave untouched because we set them to
1181                  * SIG_DFL or a valid handler initially, both of which
1182                  * will be demoted to SIG_DFL. */
1183                 default_signals(SIGNALS_CRASH_HANDLER,
1184                                 SIGNALS_IGNORE, -1);
1185
1186                 if (context->ignore_sigpipe)
1187                         ignore_signals(SIGPIPE, -1);
1188
1189                 assert_se(sigemptyset(&ss) == 0);
1190                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1191                         err = -errno;
1192                         r = EXIT_SIGNAL_MASK;
1193                         goto fail_child;
1194                 }
1195
1196                 if (idle_pipe)
1197                         do_idle_pipe_dance(idle_pipe);
1198
1199                 /* Close sockets very early to make sure we don't
1200                  * block init reexecution because it cannot bind its
1201                  * sockets */
1202                 log_forget_fds();
1203
1204                 if (socket_fd >= 0)
1205                         dont_close[n_dont_close++] = socket_fd;
1206                 if (n_fds > 0) {
1207                         memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1208                         n_dont_close += n_fds;
1209                 }
1210                 if (runtime) {
1211                         if (runtime->netns_storage_socket[0] >= 0)
1212                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
1213                         if (runtime->netns_storage_socket[1] >= 0)
1214                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
1215                 }
1216
1217                 err = close_all_fds(dont_close, n_dont_close);
1218                 if (err < 0) {
1219                         r = EXIT_FDS;
1220                         goto fail_child;
1221                 }
1222
1223                 if (!context->same_pgrp)
1224                         if (setsid() < 0) {
1225                                 err = -errno;
1226                                 r = EXIT_SETSID;
1227                                 goto fail_child;
1228                         }
1229
1230                 if (context->tcpwrap_name) {
1231                         if (socket_fd >= 0)
1232                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1233                                         err = -EACCES;
1234                                         r = EXIT_TCPWRAP;
1235                                         goto fail_child;
1236                                 }
1237
1238                         for (i = 0; i < (int) n_fds; i++) {
1239                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1240                                         err = -EACCES;
1241                                         r = EXIT_TCPWRAP;
1242                                         goto fail_child;
1243                                 }
1244                         }
1245                 }
1246
1247                 exec_context_tty_reset(context);
1248
1249                 if (confirm_spawn) {
1250                         char response;
1251
1252                         err = ask_for_confirmation(&response, argv);
1253                         if (err == -ETIMEDOUT)
1254                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1255                         else if (err < 0)
1256                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1257                         else if (response == 's') {
1258                                 write_confirm_message("Skipping execution.\n");
1259                                 err = -ECANCELED;
1260                                 r = EXIT_CONFIRM;
1261                                 goto fail_child;
1262                         } else if (response == 'n') {
1263                                 write_confirm_message("Failing execution.\n");
1264                                 err = r = 0;
1265                                 goto fail_child;
1266                         }
1267                 }
1268
1269                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1270                  * must sure to drop O_NONBLOCK */
1271                 if (socket_fd >= 0)
1272                         fd_nonblock(socket_fd, false);
1273
1274                 err = setup_input(context, socket_fd, apply_tty_stdin);
1275                 if (err < 0) {
1276                         r = EXIT_STDIN;
1277                         goto fail_child;
1278                 }
1279
1280                 err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1281                 if (err < 0) {
1282                         r = EXIT_STDOUT;
1283                         goto fail_child;
1284                 }
1285
1286                 err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1287                 if (err < 0) {
1288                         r = EXIT_STDERR;
1289                         goto fail_child;
1290                 }
1291
1292                 if (cgroup_path) {
1293                         err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
1294                         if (err < 0) {
1295                                 r = EXIT_CGROUP;
1296                                 goto fail_child;
1297                         }
1298                 }
1299
1300                 if (context->oom_score_adjust_set) {
1301                         char t[16];
1302
1303                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1304                         char_array_0(t);
1305
1306                         if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
1307                                 err = -errno;
1308                                 r = EXIT_OOM_ADJUST;
1309                                 goto fail_child;
1310                         }
1311                 }
1312
1313                 if (context->nice_set)
1314                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1315                                 err = -errno;
1316                                 r = EXIT_NICE;
1317                                 goto fail_child;
1318                         }
1319
1320                 if (context->cpu_sched_set) {
1321                         struct sched_param param = {
1322                                 .sched_priority = context->cpu_sched_priority,
1323                         };
1324
1325                         r = sched_setscheduler(0,
1326                                                context->cpu_sched_policy |
1327                                                (context->cpu_sched_reset_on_fork ?
1328                                                 SCHED_RESET_ON_FORK : 0),
1329                                                &param);
1330                         if (r < 0) {
1331                                 err = -errno;
1332                                 r = EXIT_SETSCHEDULER;
1333                                 goto fail_child;
1334                         }
1335                 }
1336
1337                 if (context->cpuset)
1338                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1339                                 err = -errno;
1340                                 r = EXIT_CPUAFFINITY;
1341                                 goto fail_child;
1342                         }
1343
1344                 if (context->ioprio_set)
1345                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1346                                 err = -errno;
1347                                 r = EXIT_IOPRIO;
1348                                 goto fail_child;
1349                         }
1350
1351                 if (context->timer_slack_nsec != (nsec_t) -1)
1352                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1353                                 err = -errno;
1354                                 r = EXIT_TIMERSLACK;
1355                                 goto fail_child;
1356                         }
1357
1358                 if (context->utmp_id)
1359                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1360
1361                 if (context->user) {
1362                         username = context->user;
1363                         err = get_user_creds(&username, &uid, &gid, &home, &shell);
1364                         if (err < 0) {
1365                                 r = EXIT_USER;
1366                                 goto fail_child;
1367                         }
1368
1369                         if (is_terminal_input(context->std_input)) {
1370                                 err = chown_terminal(STDIN_FILENO, uid);
1371                                 if (err < 0) {
1372                                         r = EXIT_STDIN;
1373                                         goto fail_child;
1374                                 }
1375                         }
1376                 }
1377
1378 #ifdef HAVE_PAM
1379                 if (cgroup_path && context->user && context->pam_name) {
1380                         err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
1381                         if (err < 0) {
1382                                 r = EXIT_CGROUP;
1383                                 goto fail_child;
1384                         }
1385
1386
1387                         err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
1388                         if (err < 0) {
1389                                 r = EXIT_CGROUP;
1390                                 goto fail_child;
1391                         }
1392                 }
1393 #endif
1394
1395                 if (apply_permissions) {
1396                         err = enforce_groups(context, username, gid);
1397                         if (err < 0) {
1398                                 r = EXIT_GROUP;
1399                                 goto fail_child;
1400                         }
1401                 }
1402
1403                 umask(context->umask);
1404
1405 #ifdef HAVE_PAM
1406                 if (apply_permissions && context->pam_name && username) {
1407                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1408                         if (err < 0) {
1409                                 r = EXIT_PAM;
1410                                 goto fail_child;
1411                         }
1412                 }
1413 #endif
1414                 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
1415                         err = setup_netns(runtime->netns_storage_socket);
1416                         if (err < 0) {
1417                                 r = EXIT_NETWORK;
1418                                 goto fail_child;
1419                         }
1420                 }
1421
1422                 if (!strv_isempty(context->read_write_dirs) ||
1423                     !strv_isempty(context->read_only_dirs) ||
1424                     !strv_isempty(context->inaccessible_dirs) ||
1425                     context->mount_flags != 0 ||
1426                     (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))) {
1427
1428                         char *tmp = NULL, *var = NULL;
1429
1430                         /* The runtime struct only contains the parent
1431                          * of the private /tmp, which is
1432                          * non-accessible to world users. Inside of it
1433                          * there's a /tmp that is sticky, and that's
1434                          * the one we want to use here. */
1435
1436                         if (context->private_tmp && runtime) {
1437                                 if (runtime->tmp_dir)
1438                                         tmp = strappenda(runtime->tmp_dir, "/tmp");
1439                                 if (runtime->var_tmp_dir)
1440                                         var = strappenda(runtime->var_tmp_dir, "/tmp");
1441                         }
1442
1443                         err = setup_namespace(
1444                                         context->read_write_dirs,
1445                                         context->read_only_dirs,
1446                                         context->inaccessible_dirs,
1447                                         tmp,
1448                                         var,
1449                                         context->mount_flags);
1450
1451                         if (err < 0) {
1452                                 r = EXIT_NAMESPACE;
1453                                 goto fail_child;
1454                         }
1455                 }
1456
1457                 if (apply_chroot) {
1458                         if (context->root_directory)
1459                                 if (chroot(context->root_directory) < 0) {
1460                                         err = -errno;
1461                                         r = EXIT_CHROOT;
1462                                         goto fail_child;
1463                                 }
1464
1465                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1466                                 err = -errno;
1467                                 r = EXIT_CHDIR;
1468                                 goto fail_child;
1469                         }
1470                 } else {
1471                         _cleanup_free_ char *d = NULL;
1472
1473                         if (asprintf(&d, "%s/%s",
1474                                      context->root_directory ? context->root_directory : "",
1475                                      context->working_directory ? context->working_directory : "") < 0) {
1476                                 err = -ENOMEM;
1477                                 r = EXIT_MEMORY;
1478                                 goto fail_child;
1479                         }
1480
1481                         if (chdir(d) < 0) {
1482                                 err = -errno;
1483                                 r = EXIT_CHDIR;
1484                                 goto fail_child;
1485                         }
1486                 }
1487
1488                 /* We repeat the fd closing here, to make sure that
1489                  * nothing is leaked from the PAM modules */
1490                 err = close_all_fds(fds, n_fds);
1491                 if (err >= 0)
1492                         err = shift_fds(fds, n_fds);
1493                 if (err >= 0)
1494                         err = flags_fds(fds, n_fds, context->non_blocking);
1495                 if (err < 0) {
1496                         r = EXIT_FDS;
1497                         goto fail_child;
1498                 }
1499
1500                 if (apply_permissions) {
1501
1502                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1503                                 if (!context->rlimit[i])
1504                                         continue;
1505
1506                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1507                                         err = -errno;
1508                                         r = EXIT_LIMITS;
1509                                         goto fail_child;
1510                                 }
1511                         }
1512
1513                         if (context->capability_bounding_set_drop) {
1514                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1515                                 if (err < 0) {
1516                                         r = EXIT_CAPABILITIES;
1517                                         goto fail_child;
1518                                 }
1519                         }
1520
1521                         if (context->user) {
1522                                 err = enforce_user(context, uid);
1523                                 if (err < 0) {
1524                                         r = EXIT_USER;
1525                                         goto fail_child;
1526                                 }
1527                         }
1528
1529                         /* PR_GET_SECUREBITS is not privileged, while
1530                          * PR_SET_SECUREBITS is. So to suppress
1531                          * potential EPERMs we'll try not to call
1532                          * PR_SET_SECUREBITS unless necessary. */
1533                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1534                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1535                                         err = -errno;
1536                                         r = EXIT_SECUREBITS;
1537                                         goto fail_child;
1538                                 }
1539
1540                         if (context->capabilities)
1541                                 if (cap_set_proc(context->capabilities) < 0) {
1542                                         err = -errno;
1543                                         r = EXIT_CAPABILITIES;
1544                                         goto fail_child;
1545                                 }
1546
1547                         if (context->no_new_privileges)
1548                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1549                                         err = -errno;
1550                                         r = EXIT_NO_NEW_PRIVILEGES;
1551                                         goto fail_child;
1552                                 }
1553
1554                         if (context->syscall_filter) {
1555                                 err = apply_seccomp(context->syscall_filter);
1556                                 if (err < 0) {
1557                                         r = EXIT_SECCOMP;
1558                                         goto fail_child;
1559                                 }
1560                         }
1561                 }
1562
1563                 err = build_environment(context, n_fds, home, username, shell, &our_env);
1564                 if (r < 0) {
1565                         r = EXIT_MEMORY;
1566                         goto fail_child;
1567                 }
1568
1569                 final_env = strv_env_merge(5,
1570                                            environment,
1571                                            our_env,
1572                                            context->environment,
1573                                            files_env,
1574                                            pam_env,
1575                                            NULL);
1576                 if (!final_env) {
1577                         err = -ENOMEM;
1578                         r = EXIT_MEMORY;
1579                         goto fail_child;
1580                 }
1581
1582                 final_argv = replace_env_argv(argv, final_env);
1583                 if (!final_argv) {
1584                         err = -ENOMEM;
1585                         r = EXIT_MEMORY;
1586                         goto fail_child;
1587                 }
1588
1589                 final_env = strv_env_clean(final_env);
1590
1591                 if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
1592                         line = exec_command_line(final_argv);
1593                         if (line) {
1594                                 log_open();
1595                                 log_struct_unit(LOG_DEBUG,
1596                                                 unit_id,
1597                                                 "EXECUTABLE=%s", command->path,
1598                                                 "MESSAGE=Executing: %s", line,
1599                                                 NULL);
1600                                 log_close();
1601                                 free(line);
1602                                 line = NULL;
1603                         }
1604                 }
1605                 execve(command->path, final_argv, final_env);
1606                 err = -errno;
1607                 r = EXIT_EXEC;
1608
1609         fail_child:
1610                 if (r != 0) {
1611                         log_open();
1612                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1613                                    "EXECUTABLE=%s", command->path,
1614                                    "MESSAGE=Failed at step %s spawning %s: %s",
1615                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1616                                           command->path, strerror(-err),
1617                                    "ERRNO=%d", -err,
1618                                    NULL);
1619                         log_close();
1620                 }
1621
1622                 _exit(r);
1623         }
1624
1625         log_struct_unit(LOG_DEBUG,
1626                         unit_id,
1627                         "MESSAGE=Forked %s as %lu",
1628                         command->path, (unsigned long) pid,
1629                         NULL);
1630
1631         /* We add the new process to the cgroup both in the child (so
1632          * that we can be sure that no user code is ever executed
1633          * outside of the cgroup) and in the parent (so that we can be
1634          * sure that when we kill the cgroup the process will be
1635          * killed too). */
1636         if (cgroup_path)
1637                 cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
1638
1639         exec_status_start(&command->exec_status, pid);
1640
1641         *ret = pid;
1642         return 0;
1643 }
1644
1645 void exec_context_init(ExecContext *c) {
1646         assert(c);
1647
1648         c->umask = 0022;
1649         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1650         c->cpu_sched_policy = SCHED_OTHER;
1651         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1652         c->syslog_level_prefix = true;
1653         c->ignore_sigpipe = true;
1654         c->timer_slack_nsec = (nsec_t) -1;
1655 }
1656
1657 void exec_context_done(ExecContext *c) {
1658         unsigned l;
1659
1660         assert(c);
1661
1662         strv_free(c->environment);
1663         c->environment = NULL;
1664
1665         strv_free(c->environment_files);
1666         c->environment_files = NULL;
1667
1668         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1669                 free(c->rlimit[l]);
1670                 c->rlimit[l] = NULL;
1671         }
1672
1673         free(c->working_directory);
1674         c->working_directory = NULL;
1675         free(c->root_directory);
1676         c->root_directory = NULL;
1677
1678         free(c->tty_path);
1679         c->tty_path = NULL;
1680
1681         free(c->tcpwrap_name);
1682         c->tcpwrap_name = NULL;
1683
1684         free(c->syslog_identifier);
1685         c->syslog_identifier = NULL;
1686
1687         free(c->user);
1688         c->user = NULL;
1689
1690         free(c->group);
1691         c->group = NULL;
1692
1693         strv_free(c->supplementary_groups);
1694         c->supplementary_groups = NULL;
1695
1696         free(c->pam_name);
1697         c->pam_name = NULL;
1698
1699         if (c->capabilities) {
1700                 cap_free(c->capabilities);
1701                 c->capabilities = NULL;
1702         }
1703
1704         strv_free(c->read_only_dirs);
1705         c->read_only_dirs = NULL;
1706
1707         strv_free(c->read_write_dirs);
1708         c->read_write_dirs = NULL;
1709
1710         strv_free(c->inaccessible_dirs);
1711         c->inaccessible_dirs = NULL;
1712
1713         if (c->cpuset)
1714                 CPU_FREE(c->cpuset);
1715
1716         free(c->utmp_id);
1717         c->utmp_id = NULL;
1718
1719         free(c->syscall_filter);
1720         c->syscall_filter = NULL;
1721 }
1722
1723 void exec_command_done(ExecCommand *c) {
1724         assert(c);
1725
1726         free(c->path);
1727         c->path = NULL;
1728
1729         strv_free(c->argv);
1730         c->argv = NULL;
1731 }
1732
1733 void exec_command_done_array(ExecCommand *c, unsigned n) {
1734         unsigned i;
1735
1736         for (i = 0; i < n; i++)
1737                 exec_command_done(c+i);
1738 }
1739
1740 void exec_command_free_list(ExecCommand *c) {
1741         ExecCommand *i;
1742
1743         while ((i = c)) {
1744                 LIST_REMOVE(command, c, i);
1745                 exec_command_done(i);
1746                 free(i);
1747         }
1748 }
1749
1750 void exec_command_free_array(ExecCommand **c, unsigned n) {
1751         unsigned i;
1752
1753         for (i = 0; i < n; i++) {
1754                 exec_command_free_list(c[i]);
1755                 c[i] = NULL;
1756         }
1757 }
1758
1759 int exec_context_load_environment(const ExecContext *c, char ***l) {
1760         char **i, **r = NULL;
1761
1762         assert(c);
1763         assert(l);
1764
1765         STRV_FOREACH(i, c->environment_files) {
1766                 char *fn;
1767                 int k;
1768                 bool ignore = false;
1769                 char **p;
1770                 _cleanup_globfree_ glob_t pglob = {};
1771                 int count, n;
1772
1773                 fn = *i;
1774
1775                 if (fn[0] == '-') {
1776                         ignore = true;
1777                         fn ++;
1778                 }
1779
1780                 if (!path_is_absolute(fn)) {
1781                         if (ignore)
1782                                 continue;
1783
1784                         strv_free(r);
1785                         return -EINVAL;
1786                 }
1787
1788                 /* Filename supports globbing, take all matching files */
1789                 errno = 0;
1790                 if (glob(fn, 0, NULL, &pglob) != 0) {
1791                         if (ignore)
1792                                 continue;
1793
1794                         strv_free(r);
1795                         return errno ? -errno : -EINVAL;
1796                 }
1797                 count = pglob.gl_pathc;
1798                 if (count == 0) {
1799                         if (ignore)
1800                                 continue;
1801
1802                         strv_free(r);
1803                         return -EINVAL;
1804                 }
1805                 for (n = 0; n < count; n++) {
1806                         k = load_env_file(pglob.gl_pathv[n], NULL, &p);
1807                         if (k < 0) {
1808                                 if (ignore)
1809                                         continue;
1810
1811                                 strv_free(r);
1812                                 return k;
1813                         }
1814                         /* Log invalid environment variables with filename */
1815                         if (p)
1816                                 p = strv_env_clean_log(p, pglob.gl_pathv[n]);
1817
1818                         if (r == NULL)
1819                                 r = p;
1820                         else {
1821                                 char **m;
1822
1823                                 m = strv_env_merge(2, r, p);
1824                                 strv_free(r);
1825                                 strv_free(p);
1826                                 if (!m)
1827                                         return -ENOMEM;
1828
1829                                 r = m;
1830                         }
1831                 }
1832         }
1833
1834         *l = r;
1835
1836         return 0;
1837 }
1838
1839 static bool tty_may_match_dev_console(const char *tty) {
1840         char *active = NULL, *console;
1841         bool b;
1842
1843         if (startswith(tty, "/dev/"))
1844                 tty += 5;
1845
1846         /* trivial identity? */
1847         if (streq(tty, "console"))
1848                 return true;
1849
1850         console = resolve_dev_console(&active);
1851         /* if we could not resolve, assume it may */
1852         if (!console)
1853                 return true;
1854
1855         /* "tty0" means the active VC, so it may be the same sometimes */
1856         b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
1857         free(active);
1858
1859         return b;
1860 }
1861
1862 bool exec_context_may_touch_console(ExecContext *ec) {
1863         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
1864                 is_terminal_input(ec->std_input) ||
1865                 is_terminal_output(ec->std_output) ||
1866                 is_terminal_output(ec->std_error)) &&
1867                tty_may_match_dev_console(tty_path(ec));
1868 }
1869
1870 static void strv_fprintf(FILE *f, char **l) {
1871         char **g;
1872
1873         assert(f);
1874
1875         STRV_FOREACH(g, l)
1876                 fprintf(f, " %s", *g);
1877 }
1878
1879 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1880         char **e;
1881         unsigned i;
1882
1883         assert(c);
1884         assert(f);
1885
1886         prefix = strempty(prefix);
1887
1888         fprintf(f,
1889                 "%sUMask: %04o\n"
1890                 "%sWorkingDirectory: %s\n"
1891                 "%sRootDirectory: %s\n"
1892                 "%sNonBlocking: %s\n"
1893                 "%sPrivateTmp: %s\n"
1894                 "%sPrivateNetwork: %s\n"
1895                 "%sIgnoreSIGPIPE: %s\n",
1896                 prefix, c->umask,
1897                 prefix, c->working_directory ? c->working_directory : "/",
1898                 prefix, c->root_directory ? c->root_directory : "/",
1899                 prefix, yes_no(c->non_blocking),
1900                 prefix, yes_no(c->private_tmp),
1901                 prefix, yes_no(c->private_network),
1902                 prefix, yes_no(c->ignore_sigpipe));
1903
1904         STRV_FOREACH(e, c->environment)
1905                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1906
1907         STRV_FOREACH(e, c->environment_files)
1908                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1909
1910         if (c->tcpwrap_name)
1911                 fprintf(f,
1912                         "%sTCPWrapName: %s\n",
1913                         prefix, c->tcpwrap_name);
1914
1915         if (c->nice_set)
1916                 fprintf(f,
1917                         "%sNice: %i\n",
1918                         prefix, c->nice);
1919
1920         if (c->oom_score_adjust_set)
1921                 fprintf(f,
1922                         "%sOOMScoreAdjust: %i\n",
1923                         prefix, c->oom_score_adjust);
1924
1925         for (i = 0; i < RLIM_NLIMITS; i++)
1926                 if (c->rlimit[i])
1927                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1928
1929         if (c->ioprio_set) {
1930                 char *class_str;
1931                 int r;
1932
1933                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
1934                 if (r < 0)
1935                         class_str = NULL;
1936                 fprintf(f,
1937                         "%sIOSchedulingClass: %s\n"
1938                         "%sIOPriority: %i\n",
1939                         prefix, strna(class_str),
1940                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1941                 free(class_str);
1942         }
1943
1944         if (c->cpu_sched_set) {
1945                 char *policy_str;
1946                 int r;
1947
1948                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
1949                 if (r < 0)
1950                         policy_str = NULL;
1951                 fprintf(f,
1952                         "%sCPUSchedulingPolicy: %s\n"
1953                         "%sCPUSchedulingPriority: %i\n"
1954                         "%sCPUSchedulingResetOnFork: %s\n",
1955                         prefix, strna(policy_str),
1956                         prefix, c->cpu_sched_priority,
1957                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1958                 free(policy_str);
1959         }
1960
1961         if (c->cpuset) {
1962                 fprintf(f, "%sCPUAffinity:", prefix);
1963                 for (i = 0; i < c->cpuset_ncpus; i++)
1964                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1965                                 fprintf(f, " %i", i);
1966                 fputs("\n", f);
1967         }
1968
1969         if (c->timer_slack_nsec != (nsec_t) -1)
1970                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, (unsigned long)c->timer_slack_nsec);
1971
1972         fprintf(f,
1973                 "%sStandardInput: %s\n"
1974                 "%sStandardOutput: %s\n"
1975                 "%sStandardError: %s\n",
1976                 prefix, exec_input_to_string(c->std_input),
1977                 prefix, exec_output_to_string(c->std_output),
1978                 prefix, exec_output_to_string(c->std_error));
1979
1980         if (c->tty_path)
1981                 fprintf(f,
1982                         "%sTTYPath: %s\n"
1983                         "%sTTYReset: %s\n"
1984                         "%sTTYVHangup: %s\n"
1985                         "%sTTYVTDisallocate: %s\n",
1986                         prefix, c->tty_path,
1987                         prefix, yes_no(c->tty_reset),
1988                         prefix, yes_no(c->tty_vhangup),
1989                         prefix, yes_no(c->tty_vt_disallocate));
1990
1991         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1992             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1993             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1994             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
1995                 char *fac_str, *lvl_str;
1996                 int r;
1997
1998                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
1999                 if (r < 0)
2000                         fac_str = NULL;
2001
2002                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
2003                 if (r < 0)
2004                         lvl_str = NULL;
2005
2006                 fprintf(f,
2007                         "%sSyslogFacility: %s\n"
2008                         "%sSyslogLevel: %s\n",
2009                         prefix, strna(fac_str),
2010                         prefix, strna(lvl_str));
2011                 free(lvl_str);
2012                 free(fac_str);
2013         }
2014
2015         if (c->capabilities) {
2016                 char *t;
2017                 if ((t = cap_to_text(c->capabilities, NULL))) {
2018                         fprintf(f, "%sCapabilities: %s\n",
2019                                 prefix, t);
2020                         cap_free(t);
2021                 }
2022         }
2023
2024         if (c->secure_bits)
2025                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
2026                         prefix,
2027                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
2028                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
2029                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
2030                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
2031                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
2032                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
2033
2034         if (c->capability_bounding_set_drop) {
2035                 unsigned long l;
2036                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
2037
2038                 for (l = 0; l <= cap_last_cap(); l++)
2039                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
2040                                 char *t;
2041
2042                                 if ((t = cap_to_name(l))) {
2043                                         fprintf(f, " %s", t);
2044                                         cap_free(t);
2045                                 }
2046                         }
2047
2048                 fputs("\n", f);
2049         }
2050
2051         if (c->user)
2052                 fprintf(f, "%sUser: %s\n", prefix, c->user);
2053         if (c->group)
2054                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
2055
2056         if (strv_length(c->supplementary_groups) > 0) {
2057                 fprintf(f, "%sSupplementaryGroups:", prefix);
2058                 strv_fprintf(f, c->supplementary_groups);
2059                 fputs("\n", f);
2060         }
2061
2062         if (c->pam_name)
2063                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
2064
2065         if (strv_length(c->read_write_dirs) > 0) {
2066                 fprintf(f, "%sReadWriteDirs:", prefix);
2067                 strv_fprintf(f, c->read_write_dirs);
2068                 fputs("\n", f);
2069         }
2070
2071         if (strv_length(c->read_only_dirs) > 0) {
2072                 fprintf(f, "%sReadOnlyDirs:", prefix);
2073                 strv_fprintf(f, c->read_only_dirs);
2074                 fputs("\n", f);
2075         }
2076
2077         if (strv_length(c->inaccessible_dirs) > 0) {
2078                 fprintf(f, "%sInaccessibleDirs:", prefix);
2079                 strv_fprintf(f, c->inaccessible_dirs);
2080                 fputs("\n", f);
2081         }
2082
2083         if (c->utmp_id)
2084                 fprintf(f,
2085                         "%sUtmpIdentifier: %s\n",
2086                         prefix, c->utmp_id);
2087 }
2088
2089 void exec_status_start(ExecStatus *s, pid_t pid) {
2090         assert(s);
2091
2092         zero(*s);
2093         s->pid = pid;
2094         dual_timestamp_get(&s->start_timestamp);
2095 }
2096
2097 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2098         assert(s);
2099
2100         if (s->pid && s->pid != pid)
2101                 zero(*s);
2102
2103         s->pid = pid;
2104         dual_timestamp_get(&s->exit_timestamp);
2105
2106         s->code = code;
2107         s->status = status;
2108
2109         if (context) {
2110                 if (context->utmp_id)
2111                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2112
2113                 exec_context_tty_reset(context);
2114         }
2115 }
2116
2117 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2118         char buf[FORMAT_TIMESTAMP_MAX];
2119
2120         assert(s);
2121         assert(f);
2122
2123         if (!prefix)
2124                 prefix = "";
2125
2126         if (s->pid <= 0)
2127                 return;
2128
2129         fprintf(f,
2130                 "%sPID: %lu\n",
2131                 prefix, (unsigned long) s->pid);
2132
2133         if (s->start_timestamp.realtime > 0)
2134                 fprintf(f,
2135                         "%sStart Timestamp: %s\n",
2136                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2137
2138         if (s->exit_timestamp.realtime > 0)
2139                 fprintf(f,
2140                         "%sExit Timestamp: %s\n"
2141                         "%sExit Code: %s\n"
2142                         "%sExit Status: %i\n",
2143                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2144                         prefix, sigchld_code_to_string(s->code),
2145                         prefix, s->status);
2146 }
2147
2148 char *exec_command_line(char **argv) {
2149         size_t k;
2150         char *n, *p, **a;
2151         bool first = true;
2152
2153         assert(argv);
2154
2155         k = 1;
2156         STRV_FOREACH(a, argv)
2157                 k += strlen(*a)+3;
2158
2159         if (!(n = new(char, k)))
2160                 return NULL;
2161
2162         p = n;
2163         STRV_FOREACH(a, argv) {
2164
2165                 if (!first)
2166                         *(p++) = ' ';
2167                 else
2168                         first = false;
2169
2170                 if (strpbrk(*a, WHITESPACE)) {
2171                         *(p++) = '\'';
2172                         p = stpcpy(p, *a);
2173                         *(p++) = '\'';
2174                 } else
2175                         p = stpcpy(p, *a);
2176
2177         }
2178
2179         *p = 0;
2180
2181         /* FIXME: this doesn't really handle arguments that have
2182          * spaces and ticks in them */
2183
2184         return n;
2185 }
2186
2187 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2188         char *p2;
2189         const char *prefix2;
2190
2191         char *cmd;
2192
2193         assert(c);
2194         assert(f);
2195
2196         if (!prefix)
2197                 prefix = "";
2198         p2 = strappend(prefix, "\t");
2199         prefix2 = p2 ? p2 : prefix;
2200
2201         cmd = exec_command_line(c->argv);
2202
2203         fprintf(f,
2204                 "%sCommand Line: %s\n",
2205                 prefix, cmd ? cmd : strerror(ENOMEM));
2206
2207         free(cmd);
2208
2209         exec_status_dump(&c->exec_status, f, prefix2);
2210
2211         free(p2);
2212 }
2213
2214 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2215         assert(f);
2216
2217         if (!prefix)
2218                 prefix = "";
2219
2220         LIST_FOREACH(command, c, c)
2221                 exec_command_dump(c, f, prefix);
2222 }
2223
2224 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2225         ExecCommand *end;
2226
2227         assert(l);
2228         assert(e);
2229
2230         if (*l) {
2231                 /* It's kind of important, that we keep the order here */
2232                 LIST_FIND_TAIL(command, *l, end);
2233                 LIST_INSERT_AFTER(command, *l, end, e);
2234         } else
2235               *l = e;
2236 }
2237
2238 int exec_command_set(ExecCommand *c, const char *path, ...) {
2239         va_list ap;
2240         char **l, *p;
2241
2242         assert(c);
2243         assert(path);
2244
2245         va_start(ap, path);
2246         l = strv_new_ap(path, ap);
2247         va_end(ap);
2248
2249         if (!l)
2250                 return -ENOMEM;
2251
2252         p = strdup(path);
2253         if (!p) {
2254                 strv_free(l);
2255                 return -ENOMEM;
2256         }
2257
2258         free(c->path);
2259         c->path = p;
2260
2261         strv_free(c->argv);
2262         c->argv = l;
2263
2264         return 0;
2265 }
2266
2267 static int exec_runtime_allocate(ExecRuntime **rt) {
2268
2269         if (*rt)
2270                 return 0;
2271
2272         *rt = new0(ExecRuntime, 1);
2273         if (!rt)
2274                 return -ENOMEM;
2275
2276         (*rt)->n_ref = 1;
2277         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
2278
2279         return 0;
2280 }
2281
2282 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
2283         int r;
2284
2285         assert(rt);
2286         assert(c);
2287         assert(id);
2288
2289         if (*rt)
2290                 return 1;
2291
2292         if (!c->private_network && !c->private_tmp)
2293                 return 0;
2294
2295         r = exec_runtime_allocate(rt);
2296         if (r < 0)
2297                 return r;
2298
2299         if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
2300                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
2301                         return -errno;
2302         }
2303
2304         if (c->private_tmp && !(*rt)->tmp_dir) {
2305                 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
2306                 if (r < 0)
2307                         return r;
2308         }
2309
2310         return 1;
2311 }
2312
2313 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
2314         assert(r);
2315         assert(r->n_ref > 0);
2316
2317         r->n_ref++;
2318         return r;
2319 }
2320
2321 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
2322
2323         if (!r)
2324                 return NULL;
2325
2326         assert(r->n_ref > 0);
2327
2328         r->n_ref--;
2329         if (r->n_ref <= 0) {
2330                 free(r->tmp_dir);
2331                 free(r->var_tmp_dir);
2332                 close_pipe(r->netns_storage_socket);
2333                 free(r);
2334         }
2335
2336         return NULL;
2337 }
2338
2339 int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds) {
2340         assert(u);
2341         assert(f);
2342         assert(fds);
2343
2344         if (!rt)
2345                 return 0;
2346
2347         if (rt->tmp_dir)
2348                 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
2349
2350         if (rt->var_tmp_dir)
2351                 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
2352
2353         if (rt->netns_storage_socket[0] >= 0) {
2354                 int copy;
2355
2356                 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
2357                 if (copy < 0)
2358                         return copy;
2359
2360                 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
2361         }
2362
2363         if (rt->netns_storage_socket[1] >= 0) {
2364                 int copy;
2365
2366                 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
2367                 if (copy < 0)
2368                         return copy;
2369
2370                 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
2371         }
2372
2373         return 0;
2374 }
2375
2376 int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds) {
2377         int r;
2378
2379         assert(rt);
2380         assert(key);
2381         assert(value);
2382
2383         if (streq(key, "tmp-dir")) {
2384                 char *copy;
2385
2386                 r = exec_runtime_allocate(rt);
2387                 if (r < 0)
2388                         return r;
2389
2390                 copy = strdup(value);
2391                 if (!copy)
2392                         return log_oom();
2393
2394                 free((*rt)->tmp_dir);
2395                 (*rt)->tmp_dir = copy;
2396
2397         } else if (streq(key, "var-tmp-dir")) {
2398                 char *copy;
2399
2400                 r = exec_runtime_allocate(rt);
2401                 if (r < 0)
2402                         return r;
2403
2404                 copy = strdup(value);
2405                 if (!copy)
2406                         return log_oom();
2407
2408                 free((*rt)->var_tmp_dir);
2409                 (*rt)->var_tmp_dir = copy;
2410
2411         } else if (streq(key, "netns-socket-0")) {
2412                 int fd;
2413
2414                 r = exec_runtime_allocate(rt);
2415                 if (r < 0)
2416                         return r;
2417
2418                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2419                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2420                 else {
2421                         if ((*rt)->netns_storage_socket[0] >= 0)
2422                                 close_nointr_nofail((*rt)->netns_storage_socket[0]);
2423
2424                         (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
2425                 }
2426         } else if (streq(key, "netns-socket-1")) {
2427                 int fd;
2428
2429                 r = exec_runtime_allocate(rt);
2430                 if (r < 0)
2431                         return r;
2432
2433                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2434                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2435                 else {
2436                         if ((*rt)->netns_storage_socket[1] >= 0)
2437                                 close_nointr_nofail((*rt)->netns_storage_socket[1]);
2438
2439                         (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
2440                 }
2441         } else
2442                 return 0;
2443
2444         return 1;
2445 }
2446
2447 static void *remove_tmpdir_thread(void *p) {
2448         _cleanup_free_ char *path = p;
2449
2450         rm_rf_dangerous(path, false, true, false);
2451         return NULL;
2452 }
2453
2454 void exec_runtime_destroy(ExecRuntime *rt) {
2455         if (!rt)
2456                 return;
2457
2458         /* If there are multiple users of this, let's leave the stuff around */
2459         if (rt->n_ref > 1)
2460                 return;
2461
2462         if (rt->tmp_dir) {
2463                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
2464                 asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
2465                 rt->tmp_dir = NULL;
2466         }
2467
2468         if (rt->var_tmp_dir) {
2469                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
2470                 asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
2471                 rt->var_tmp_dir = NULL;
2472         }
2473
2474         close_pipe(rt->netns_storage_socket);
2475 }
2476
2477 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2478         [EXEC_INPUT_NULL] = "null",
2479         [EXEC_INPUT_TTY] = "tty",
2480         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2481         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2482         [EXEC_INPUT_SOCKET] = "socket"
2483 };
2484
2485 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2486
2487 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2488         [EXEC_OUTPUT_INHERIT] = "inherit",
2489         [EXEC_OUTPUT_NULL] = "null",
2490         [EXEC_OUTPUT_TTY] = "tty",
2491         [EXEC_OUTPUT_SYSLOG] = "syslog",
2492         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2493         [EXEC_OUTPUT_KMSG] = "kmsg",
2494         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2495         [EXEC_OUTPUT_JOURNAL] = "journal",
2496         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2497         [EXEC_OUTPUT_SOCKET] = "socket"
2498 };
2499
2500 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);