src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <linux/seccomp-bpf.h>
  42 #include <glob.h>
  43 #include <libgen.h>
  44
  45 #ifdef HAVE_PAM
  46 #include <security/pam_appl.h>
  47 #endif
  48
  49 #include "execute.h"
  50 #include "strv.h"
  51 #include "macro.h"
  52 #include "capability.h"
  53 #include "util.h"
  54 #include "log.h"
  55 #include "sd-messages.h"
  56 #include "ioprio.h"
  57 #include "securebits.h"
  58 #include "namespace.h"
  59 #include "tcpwrap.h"
  60 #include "exit-status.h"
  61 #include "missing.h"
  62 #include "utmp-wtmp.h"
  63 #include "def.h"
  64 #include "loopback-setup.h"
  65 #include "path-util.h"
  66 #include "syscall-list.h"
  67 #include "env-util.h"
  68 #include "fileio.h"
  69 #include "unit.h"
  70
  71 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  72
  73 /* This assumes there is a 'tty' group */
  74 #define TTY_MODE 0620
  75
  76 static int shift_fds(int fds[], unsigned n_fds) {
  77         int start, restart_from;
  78
  79         if (n_fds <= 0)
  80                 return 0;
  81
  82         /* Modifies the fds array! (sorts it) */
  83
  84         assert(fds);
  85
  86         start = 0;
  87         for (;;) {
  88                 int i;
  89
  90                 restart_from = -1;
  91
  92                 for (i = start; i < (int) n_fds; i++) {
  93                         int nfd;
  94
  95                         /* Already at right index? */
  96                         if (fds[i] == i+3)
  97                                 continue;
  98
  99                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
 100                                 return -errno;
 101
 102                         close_nointr_nofail(fds[i]);
 103                         fds[i] = nfd;
 104
 105                         /* Hmm, the fd we wanted isn't free? Then
 106                          * let's remember that and try again from here*/
 107                         if (nfd != i+3 && restart_from < 0)
 108                                 restart_from = i;
 109                 }
 110
 111                 if (restart_from < 0)
 112                         break;
 113
 114                 start = restart_from;
 115         }
 116
 117         return 0;
 118 }
 119
 120 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 121         unsigned i;
 122         int r;
 123
 124         if (n_fds <= 0)
 125                 return 0;
 126
 127         assert(fds);
 128
 129         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 130
 131         for (i = 0; i < n_fds; i++) {
 132
 133                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 134                         return r;
 135
 136                 /* We unconditionally drop FD_CLOEXEC from the fds,
 137                  * since after all we want to pass these fds to our
 138                  * children */
 139
 140                 if ((r = fd_cloexec(fds[i], false)) < 0)
 141                         return r;
 142         }
 143
 144         return 0;
 145 }
 146
 147 _pure_ static const char *tty_path(const ExecContext *context) {
 148         assert(context);
 149
 150         if (context->tty_path)
 151                 return context->tty_path;
 152
 153         return "/dev/console";
 154 }
 155
 156 void exec_context_tty_reset(const ExecContext *context) {
 157         assert(context);
 158
 159         if (context->tty_vhangup)
 160                 terminal_vhangup(tty_path(context));
 161
 162         if (context->tty_reset)
 163                 reset_terminal(tty_path(context));
 164
 165         if (context->tty_vt_disallocate && context->tty_path)
 166                 vt_disallocate(context->tty_path);
 167 }
 168
 169 static bool is_terminal_output(ExecOutput o) {
 170         return
 171                 o == EXEC_OUTPUT_TTY ||
 172                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 173                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 174                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 175 }
 176
 177 void exec_context_serialize(const ExecContext *context, Unit *u, FILE *f) {
 178         assert(context);
 179         assert(u);
 180         assert(f);
 181
 182         if (context->tmp_dir)
 183                 unit_serialize_item(u, f, "tmp-dir", context->tmp_dir);
 184
 185         if (context->var_tmp_dir)
 186                 unit_serialize_item(u, f, "var-tmp-dir", context->var_tmp_dir);
 187 }
 188
 189 static int open_null_as(int flags, int nfd) {
 190         int fd, r;
 191
 192         assert(nfd >= 0);
 193
 194         if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
 195                 return -errno;
 196
 197         if (fd != nfd) {
 198                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 199                 close_nointr_nofail(fd);
 200         } else
 201                 r = nfd;
 202
 203         return r;
 204 }
 205
 206 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 207         int fd, r;
 208         union sockaddr_union sa = {
 209                 .un.sun_family = AF_UNIX,
 210                 .un.sun_path = "/run/systemd/journal/stdout",
 211         };
 212
 213         assert(context);
 214         assert(output < _EXEC_OUTPUT_MAX);
 215         assert(ident);
 216         assert(nfd >= 0);
 217
 218         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 219         if (fd < 0)
 220                 return -errno;
 221
 222         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 223         if (r < 0) {
 224                 close_nointr_nofail(fd);
 225                 return -errno;
 226         }
 227
 228         if (shutdown(fd, SHUT_RD) < 0) {
 229                 close_nointr_nofail(fd);
 230                 return -errno;
 231         }
 232
 233         dprintf(fd,
 234                 "%s\n"
 235                 "%s\n"
 236                 "%i\n"
 237                 "%i\n"
 238                 "%i\n"
 239                 "%i\n"
 240                 "%i\n",
 241                 context->syslog_identifier ? context->syslog_identifier : ident,
 242                 unit_id,
 243                 context->syslog_priority,
 244                 !!context->syslog_level_prefix,
 245                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 246                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 247                 is_terminal_output(output));
 248
 249         if (fd != nfd) {
 250                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 251                 close_nointr_nofail(fd);
 252         } else
 253                 r = nfd;
 254
 255         return r;
 256 }
 257 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 258         int fd, r;
 259
 260         assert(path);
 261         assert(nfd >= 0);
 262
 263         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 264                 return fd;
 265
 266         if (fd != nfd) {
 267                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 268                 close_nointr_nofail(fd);
 269         } else
 270                 r = nfd;
 271
 272         return r;
 273 }
 274
 275 static bool is_terminal_input(ExecInput i) {
 276         return
 277                 i == EXEC_INPUT_TTY ||
 278                 i == EXEC_INPUT_TTY_FORCE ||
 279                 i == EXEC_INPUT_TTY_FAIL;
 280 }
 281
 282 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 283
 284         if (is_terminal_input(std_input) && !apply_tty_stdin)
 285                 return EXEC_INPUT_NULL;
 286
 287         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 288                 return EXEC_INPUT_NULL;
 289
 290         return std_input;
 291 }
 292
 293 static int fixup_output(ExecOutput std_output, int socket_fd) {
 294
 295         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 296                 return EXEC_OUTPUT_INHERIT;
 297
 298         return std_output;
 299 }
 300
 301 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 302         ExecInput i;
 303
 304         assert(context);
 305
 306         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 307
 308         switch (i) {
 309
 310         case EXEC_INPUT_NULL:
 311                 return open_null_as(O_RDONLY, STDIN_FILENO);
 312
 313         case EXEC_INPUT_TTY:
 314         case EXEC_INPUT_TTY_FORCE:
 315         case EXEC_INPUT_TTY_FAIL: {
 316                 int fd, r;
 317
 318                 if ((fd = acquire_terminal(
 319                                      tty_path(context),
 320                                      i == EXEC_INPUT_TTY_FAIL,
 321                                      i == EXEC_INPUT_TTY_FORCE,
 322                                      false,
 323                                      (usec_t) -1)) < 0)
 324                         return fd;
 325
 326                 if (fd != STDIN_FILENO) {
 327                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 328                         close_nointr_nofail(fd);
 329                 } else
 330                         r = STDIN_FILENO;
 331
 332                 return r;
 333         }
 334
 335         case EXEC_INPUT_SOCKET:
 336                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 337
 338         default:
 339                 assert_not_reached("Unknown input type");
 340         }
 341 }
 342
 343 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 344         ExecOutput o;
 345         ExecInput i;
 346         int r;
 347
 348         assert(context);
 349         assert(ident);
 350
 351         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 352         o = fixup_output(context->std_output, socket_fd);
 353
 354         if (fileno == STDERR_FILENO) {
 355                 ExecOutput e;
 356                 e = fixup_output(context->std_error, socket_fd);
 357
 358                 /* This expects the input and output are already set up */
 359
 360                 /* Don't change the stderr file descriptor if we inherit all
 361                  * the way and are not on a tty */
 362                 if (e == EXEC_OUTPUT_INHERIT &&
 363                     o == EXEC_OUTPUT_INHERIT &&
 364                     i == EXEC_INPUT_NULL &&
 365                     !is_terminal_input(context->std_input) &&
 366                     getppid () != 1)
 367                         return fileno;
 368
 369                 /* Duplicate from stdout if possible */
 370                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 371                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 372
 373                 o = e;
 374
 375         } else if (o == EXEC_OUTPUT_INHERIT) {
 376                 /* If input got downgraded, inherit the original value */
 377                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 378                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 379
 380                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 381                 if (i != EXEC_INPUT_NULL)
 382                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 383
 384                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 385                 if (getppid() != 1)
 386                         return fileno;
 387
 388                 /* We need to open /dev/null here anew, to get the right access mode. */
 389                 return open_null_as(O_WRONLY, fileno);
 390         }
 391
 392         switch (o) {
 393
 394         case EXEC_OUTPUT_NULL:
 395                 return open_null_as(O_WRONLY, fileno);
 396
 397         case EXEC_OUTPUT_TTY:
 398                 if (is_terminal_input(i))
 399                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 400
 401                 /* We don't reset the terminal if this is just about output */
 402                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 403
 404         case EXEC_OUTPUT_SYSLOG:
 405         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 406         case EXEC_OUTPUT_KMSG:
 407         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 408         case EXEC_OUTPUT_JOURNAL:
 409         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 410                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 411                 if (r < 0) {
 412                         log_struct_unit(LOG_CRIT, unit_id,
 413                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 414                                 fileno == STDOUT_FILENO ? "out" : "err",
 415                                 unit_id, strerror(-r),
 416                                 "ERRNO=%d", -r,
 417                                 NULL);
 418                         r = open_null_as(O_WRONLY, fileno);
 419                 }
 420                 return r;
 421
 422         case EXEC_OUTPUT_SOCKET:
 423                 assert(socket_fd >= 0);
 424                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 425
 426         default:
 427                 assert_not_reached("Unknown error type");
 428         }
 429 }
 430
 431 static int chown_terminal(int fd, uid_t uid) {
 432         struct stat st;
 433
 434         assert(fd >= 0);
 435
 436         /* This might fail. What matters are the results. */
 437         (void) fchown(fd, uid, -1);
 438         (void) fchmod(fd, TTY_MODE);
 439
 440         if (fstat(fd, &st) < 0)
 441                 return -errno;
 442
 443         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 444                 return -EPERM;
 445
 446         return 0;
 447 }
 448
 449 static int setup_confirm_stdio(int *_saved_stdin,
 450                                int *_saved_stdout) {
 451         int fd = -1, saved_stdin, saved_stdout = -1, r;
 452
 453         assert(_saved_stdin);
 454         assert(_saved_stdout);
 455
 456         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 457         if (saved_stdin < 0)
 458                 return -errno;
 459
 460         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 461         if (saved_stdout < 0) {
 462                 r = errno;
 463                 goto fail;
 464         }
 465
 466         fd = acquire_terminal(
 467                         "/dev/console",
 468                         false,
 469                         false,
 470                         false,
 471                         DEFAULT_CONFIRM_USEC);
 472         if (fd < 0) {
 473                 r = fd;
 474                 goto fail;
 475         }
 476
 477         r = chown_terminal(fd, getuid());
 478         if (r < 0)
 479                 goto fail;
 480
 481         if (dup2(fd, STDIN_FILENO) < 0) {
 482                 r = -errno;
 483                 goto fail;
 484         }
 485
 486         if (dup2(fd, STDOUT_FILENO) < 0) {
 487                 r = -errno;
 488                 goto fail;
 489         }
 490
 491         if (fd >= 2)
 492                 close_nointr_nofail(fd);
 493
 494         *_saved_stdin = saved_stdin;
 495         *_saved_stdout = saved_stdout;
 496
 497         return 0;
 498
 499 fail:
 500         if (saved_stdout >= 0)
 501                 close_nointr_nofail(saved_stdout);
 502
 503         if (saved_stdin >= 0)
 504                 close_nointr_nofail(saved_stdin);
 505
 506         if (fd >= 0)
 507                 close_nointr_nofail(fd);
 508
 509         return r;
 510 }
 511
 512 _printf_attr_(1, 2) static int write_confirm_message(const char *format, ...) {
 513         int fd;
 514         va_list ap;
 515
 516         assert(format);
 517
 518         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 519         if (fd < 0)
 520                 return fd;
 521
 522         va_start(ap, format);
 523         vdprintf(fd, format, ap);
 524         va_end(ap);
 525
 526         close_nointr_nofail(fd);
 527
 528         return 0;
 529 }
 530
 531 static int restore_confirm_stdio(int *saved_stdin,
 532                                  int *saved_stdout) {
 533
 534         int r = 0;
 535
 536         assert(saved_stdin);
 537         assert(saved_stdout);
 538
 539         release_terminal();
 540
 541         if (*saved_stdin >= 0)
 542                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 543                         r = -errno;
 544
 545         if (*saved_stdout >= 0)
 546                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 547                         r = -errno;
 548
 549         if (*saved_stdin >= 0)
 550                 close_nointr_nofail(*saved_stdin);
 551
 552         if (*saved_stdout >= 0)
 553                 close_nointr_nofail(*saved_stdout);
 554
 555         return r;
 556 }
 557
 558 static int ask_for_confirmation(char *response, char **argv) {
 559         int saved_stdout = -1, saved_stdin = -1, r;
 560         char *line;
 561
 562         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 563         if (r < 0)
 564                 return r;
 565
 566         line = exec_command_line(argv);
 567         if (!line)
 568                 return -ENOMEM;
 569
 570         r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 571         free(line);
 572
 573         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 574
 575         return r;
 576 }
 577
 578 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 579         bool keep_groups = false;
 580         int r;
 581
 582         assert(context);
 583
 584         /* Lookup and set GID and supplementary group list. Here too
 585          * we avoid NSS lookups for gid=0. */
 586
 587         if (context->group || username) {
 588
 589                 if (context->group) {
 590                         const char *g = context->group;
 591
 592                         if ((r = get_group_creds(&g, &gid)) < 0)
 593                                 return r;
 594                 }
 595
 596                 /* First step, initialize groups from /etc/groups */
 597                 if (username && gid != 0) {
 598                         if (initgroups(username, gid) < 0)
 599                                 return -errno;
 600
 601                         keep_groups = true;
 602                 }
 603
 604                 /* Second step, set our gids */
 605                 if (setresgid(gid, gid, gid) < 0)
 606                         return -errno;
 607         }
 608
 609         if (context->supplementary_groups) {
 610                 int ngroups_max, k;
 611                 gid_t *gids;
 612                 char **i;
 613
 614                 /* Final step, initialize any manually set supplementary groups */
 615                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 616
 617                 if (!(gids = new(gid_t, ngroups_max)))
 618                         return -ENOMEM;
 619
 620                 if (keep_groups) {
 621                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 622                                 free(gids);
 623                                 return -errno;
 624                         }
 625                 } else
 626                         k = 0;
 627
 628                 STRV_FOREACH(i, context->supplementary_groups) {
 629                         const char *g;
 630
 631                         if (k >= ngroups_max) {
 632                                 free(gids);
 633                                 return -E2BIG;
 634                         }
 635
 636                         g = *i;
 637                         r = get_group_creds(&g, gids+k);
 638                         if (r < 0) {
 639                                 free(gids);
 640                                 return r;
 641                         }
 642
 643                         k++;
 644                 }
 645
 646                 if (setgroups(k, gids) < 0) {
 647                         free(gids);
 648                         return -errno;
 649                 }
 650
 651                 free(gids);
 652         }
 653
 654         return 0;
 655 }
 656
 657 static int enforce_user(const ExecContext *context, uid_t uid) {
 658         int r;
 659         assert(context);
 660
 661         /* Sets (but doesn't lookup) the uid and make sure we keep the
 662          * capabilities while doing so. */
 663
 664         if (context->capabilities) {
 665                 cap_t d;
 666                 static const cap_value_t bits[] = {
 667                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 668                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 669                 };
 670
 671                 /* First step: If we need to keep capabilities but
 672                  * drop privileges we need to make sure we keep our
 673                  * caps, while we drop privileges. */
 674                 if (uid != 0) {
 675                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 676
 677                         if (prctl(PR_GET_SECUREBITS) != sb)
 678                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 679                                         return -errno;
 680                 }
 681
 682                 /* Second step: set the capabilities. This will reduce
 683                  * the capabilities to the minimum we need. */
 684
 685                 if (!(d = cap_dup(context->capabilities)))
 686                         return -errno;
 687
 688                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 689                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 690                         r = -errno;
 691                         cap_free(d);
 692                         return r;
 693                 }
 694
 695                 if (cap_set_proc(d) < 0) {
 696                         r = -errno;
 697                         cap_free(d);
 698                         return r;
 699                 }
 700
 701                 cap_free(d);
 702         }
 703
 704         /* Third step: actually set the uids */
 705         if (setresuid(uid, uid, uid) < 0)
 706                 return -errno;
 707
 708         /* At this point we should have all necessary capabilities but
 709            are otherwise a normal user. However, the caps might got
 710            corrupted due to the setresuid() so we need clean them up
 711            later. This is done outside of this call. */
 712
 713         return 0;
 714 }
 715
 716 #ifdef HAVE_PAM
 717
 718 static int null_conv(
 719                 int num_msg,
 720                 const struct pam_message **msg,
 721                 struct pam_response **resp,
 722                 void *appdata_ptr) {
 723
 724         /* We don't support conversations */
 725
 726         return PAM_CONV_ERR;
 727 }
 728
 729 static int setup_pam(
 730                 const char *name,
 731                 const char *user,
 732                 uid_t uid,
 733                 const char *tty,
 734                 char ***pam_env,
 735                 int fds[], unsigned n_fds) {
 736
 737         static const struct pam_conv conv = {
 738                 .conv = null_conv,
 739                 .appdata_ptr = NULL
 740         };
 741
 742         pam_handle_t *handle = NULL;
 743         sigset_t ss, old_ss;
 744         int pam_code = PAM_SUCCESS;
 745         int err;
 746         char **e = NULL;
 747         bool close_session = false;
 748         pid_t pam_pid = 0, parent_pid;
 749
 750         assert(name);
 751         assert(user);
 752         assert(pam_env);
 753
 754         /* We set up PAM in the parent process, then fork. The child
 755          * will then stay around until killed via PR_GET_PDEATHSIG or
 756          * systemd via the cgroup logic. It will then remove the PAM
 757          * session again. The parent process will exec() the actual
 758          * daemon. We do things this way to ensure that the main PID
 759          * of the daemon is the one we initially fork()ed. */
 760
 761         if ((pam_code = pam_start(name, user, &conv, &handle)) != PAM_SUCCESS) {
 762                 handle = NULL;
 763                 goto fail;
 764         }
 765
 766         if (tty)
 767                 if ((pam_code = pam_set_item(handle, PAM_TTY, tty)) != PAM_SUCCESS)
 768                         goto fail;
 769
 770         if ((pam_code = pam_acct_mgmt(handle, PAM_SILENT)) != PAM_SUCCESS)
 771                 goto fail;
 772
 773         if ((pam_code = pam_open_session(handle, PAM_SILENT)) != PAM_SUCCESS)
 774                 goto fail;
 775
 776         close_session = true;
 777
 778         if ((!(e = pam_getenvlist(handle)))) {
 779                 pam_code = PAM_BUF_ERR;
 780                 goto fail;
 781         }
 782
 783         /* Block SIGTERM, so that we know that it won't get lost in
 784          * the child */
 785         if (sigemptyset(&ss) < 0 ||
 786             sigaddset(&ss, SIGTERM) < 0 ||
 787             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 788                 goto fail;
 789
 790         parent_pid = getpid();
 791
 792         if ((pam_pid = fork()) < 0)
 793                 goto fail;
 794
 795         if (pam_pid == 0) {
 796                 int sig;
 797                 int r = EXIT_PAM;
 798
 799                 /* The child's job is to reset the PAM session on
 800                  * termination */
 801
 802                 /* This string must fit in 10 chars (i.e. the length
 803                  * of "/sbin/init"), to look pretty in /bin/ps */
 804                 rename_process("(sd-pam)");
 805
 806                 /* Make sure we don't keep open the passed fds in this
 807                 child. We assume that otherwise only those fds are
 808                 open here that have been opened by PAM. */
 809                 close_many(fds, n_fds);
 810
 811                 /* Drop privileges - we don't need any to pam_close_session
 812                  * and this will make PR_SET_PDEATHSIG work in most cases.
 813                  * If this fails, ignore the error - but expect sd-pam threads
 814                  * to fail to exit normally */
 815                 if (setresuid(uid, uid, uid) < 0)
 816                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 817
 818                 /* Wait until our parent died. This will only work if
 819                  * the above setresuid() succeeds, otherwise the kernel
 820                  * will not allow unprivileged parents kill their privileged
 821                  * children this way. We rely on the control groups kill logic
 822                  * to do the rest for us. */
 823                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 824                         goto child_finish;
 825
 826                 /* Check if our parent process might already have
 827                  * died? */
 828                 if (getppid() == parent_pid) {
 829                         for (;;) {
 830                                 if (sigwait(&ss, &sig) < 0) {
 831                                         if (errno == EINTR)
 832                                                 continue;
 833
 834                                         goto child_finish;
 835                                 }
 836
 837                                 assert(sig == SIGTERM);
 838                                 break;
 839                         }
 840                 }
 841
 842                 /* If our parent died we'll end the session */
 843                 if (getppid() != parent_pid)
 844                         if ((pam_code = pam_close_session(handle, PAM_DATA_SILENT)) != PAM_SUCCESS)
 845                                 goto child_finish;
 846
 847                 r = 0;
 848
 849         child_finish:
 850                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 851                 _exit(r);
 852         }
 853
 854         /* If the child was forked off successfully it will do all the
 855          * cleanups, so forget about the handle here. */
 856         handle = NULL;
 857
 858         /* Unblock SIGTERM again in the parent */
 859         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 860                 goto fail;
 861
 862         /* We close the log explicitly here, since the PAM modules
 863          * might have opened it, but we don't want this fd around. */
 864         closelog();
 865
 866         *pam_env = e;
 867         e = NULL;
 868
 869         return 0;
 870
 871 fail:
 872         if (pam_code != PAM_SUCCESS)
 873                 err = -EPERM;  /* PAM errors do not map to errno */
 874         else
 875                 err = -errno;
 876
 877         if (handle) {
 878                 if (close_session)
 879                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
 880
 881                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 882         }
 883
 884         strv_free(e);
 885
 886         closelog();
 887
 888         if (pam_pid > 1) {
 889                 kill(pam_pid, SIGTERM);
 890                 kill(pam_pid, SIGCONT);
 891         }
 892
 893         return err;
 894 }
 895 #endif
 896
 897 static void rename_process_from_path(const char *path) {
 898         char process_name[11];
 899         const char *p;
 900         size_t l;
 901
 902         /* This resulting string must fit in 10 chars (i.e. the length
 903          * of "/sbin/init") to look pretty in /bin/ps */
 904
 905         p = path_get_file_name(path);
 906         if (isempty(p)) {
 907                 rename_process("(...)");
 908                 return;
 909         }
 910
 911         l = strlen(p);
 912         if (l > 8) {
 913                 /* The end of the process name is usually more
 914                  * interesting, since the first bit might just be
 915                  * "systemd-" */
 916                 p = p + l - 8;
 917                 l = 8;
 918         }
 919
 920         process_name[0] = '(';
 921         memcpy(process_name+1, p, l);
 922         process_name[1+l] = ')';
 923         process_name[1+l+1] = 0;
 924
 925         rename_process(process_name);
 926 }
 927
 928 static int apply_seccomp(uint32_t *syscall_filter) {
 929         static const struct sock_filter header[] = {
 930                 VALIDATE_ARCHITECTURE,
 931                 EXAMINE_SYSCALL
 932         };
 933         static const struct sock_filter footer[] = {
 934                 _KILL_PROCESS
 935         };
 936
 937         int i;
 938         unsigned n;
 939         struct sock_filter *f;
 940         struct sock_fprog prog = {};
 941
 942         assert(syscall_filter);
 943
 944         /* First: count the syscalls to check for */
 945         for (i = 0, n = 0; i < syscall_max(); i++)
 946                 if (syscall_filter[i >> 4] & (1 << (i & 31)))
 947                         n++;
 948
 949         /* Second: build the filter program from a header the syscall
 950          * matches and the footer */
 951         f = alloca(sizeof(struct sock_filter) * (ELEMENTSOF(header) + 2*n + ELEMENTSOF(footer)));
 952         memcpy(f, header, sizeof(header));
 953
 954         for (i = 0, n = 0; i < syscall_max(); i++)
 955                 if (syscall_filter[i >> 4] & (1 << (i & 31))) {
 956                         struct sock_filter item[] = {
 957                                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, INDEX_TO_SYSCALL(i), 0, 1),
 958                                 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 959                         };
 960
 961                         assert_cc(ELEMENTSOF(item) == 2);
 962
 963                         f[ELEMENTSOF(header) + 2*n]  = item[0];
 964                         f[ELEMENTSOF(header) + 2*n+1] = item[1];
 965
 966                         n++;
 967                 }
 968
 969         memcpy(f + (ELEMENTSOF(header) + 2*n), footer, sizeof(footer));
 970
 971         /* Third: install the filter */
 972         prog.len = ELEMENTSOF(header) + ELEMENTSOF(footer) + 2*n;
 973         prog.filter = f;
 974         if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0)
 975                 return -errno;
 976
 977         return 0;
 978 }
 979
 980 int exec_spawn(ExecCommand *command,
 981                char **argv,
 982                ExecContext *context,
 983                int fds[], unsigned n_fds,
 984                char **environment,
 985                bool apply_permissions,
 986                bool apply_chroot,
 987                bool apply_tty_stdin,
 988                bool confirm_spawn,
 989                CGroupControllerMask cgroup_mask,
 990                const char *cgroup_path,
 991                const char *unit_id,
 992                int idle_pipe[2],
 993                pid_t *ret) {
 994
 995         _cleanup_strv_free_ char **files_env = NULL;
 996         int socket_fd;
 997         char *line;
 998         pid_t pid;
 999         int r;
1000
1001         assert(command);
1002         assert(context);
1003         assert(ret);
1004         assert(fds || n_fds <= 0);
1005
1006         if (context->std_input == EXEC_INPUT_SOCKET ||
1007             context->std_output == EXEC_OUTPUT_SOCKET ||
1008             context->std_error == EXEC_OUTPUT_SOCKET) {
1009
1010                 if (n_fds != 1)
1011                         return -EINVAL;
1012
1013                 socket_fd = fds[0];
1014
1015                 fds = NULL;
1016                 n_fds = 0;
1017         } else
1018                 socket_fd = -1;
1019
1020         r = exec_context_load_environment(context, &files_env);
1021         if (r < 0) {
1022                 log_struct_unit(LOG_ERR,
1023                            unit_id,
1024                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1025                            "ERRNO=%d", -r,
1026                            NULL);
1027                 return r;
1028         }
1029
1030         if (!argv)
1031                 argv = command->argv;
1032
1033         line = exec_command_line(argv);
1034         if (!line)
1035                 return log_oom();
1036
1037         log_struct_unit(LOG_DEBUG,
1038                         unit_id,
1039                         "EXECUTABLE=%s", command->path,
1040                         "MESSAGE=About to execute: %s", line,
1041                         NULL);
1042         free(line);
1043
1044         if (context->private_tmp && !context->tmp_dir && !context->var_tmp_dir) {
1045                 r = setup_tmpdirs(&context->tmp_dir, &context->var_tmp_dir);
1046                 if (r < 0)
1047                         return r;
1048         }
1049
1050         pid = fork();
1051         if (pid < 0)
1052                 return -errno;
1053
1054         if (pid == 0) {
1055                 int i, err;
1056                 sigset_t ss;
1057                 const char *username = NULL, *home = NULL;
1058                 uid_t uid = (uid_t) -1;
1059                 gid_t gid = (gid_t) -1;
1060                 _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL,
1061                         **final_env = NULL, **final_argv = NULL;
1062                 unsigned n_env = 0;
1063
1064                 /* child */
1065
1066                 rename_process_from_path(command->path);
1067
1068                 /* We reset exactly these signals, since they are the
1069                  * only ones we set to SIG_IGN in the main daemon. All
1070                  * others we leave untouched because we set them to
1071                  * SIG_DFL or a valid handler initially, both of which
1072                  * will be demoted to SIG_DFL. */
1073                 default_signals(SIGNALS_CRASH_HANDLER,
1074                                 SIGNALS_IGNORE, -1);
1075
1076                 if (context->ignore_sigpipe)
1077                         ignore_signals(SIGPIPE, -1);
1078
1079                 assert_se(sigemptyset(&ss) == 0);
1080                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1081                         err = -errno;
1082                         r = EXIT_SIGNAL_MASK;
1083                         goto fail_child;
1084                 }
1085
1086                 if (idle_pipe) {
1087                         if (idle_pipe[1] >= 0)
1088                                 close_nointr_nofail(idle_pipe[1]);
1089                         if (idle_pipe[0] >= 0) {
1090                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1091                                 close_nointr_nofail(idle_pipe[0]);
1092                         }
1093                 }
1094
1095                 /* Close sockets very early to make sure we don't
1096                  * block init reexecution because it cannot bind its
1097                  * sockets */
1098                 log_forget_fds();
1099                 err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
1100                                            socket_fd >= 0 ? 1 : n_fds);
1101                 if (err < 0) {
1102                         r = EXIT_FDS;
1103                         goto fail_child;
1104                 }
1105
1106                 if (!context->same_pgrp)
1107                         if (setsid() < 0) {
1108                                 err = -errno;
1109                                 r = EXIT_SETSID;
1110                                 goto fail_child;
1111                         }
1112
1113                 if (context->tcpwrap_name) {
1114                         if (socket_fd >= 0)
1115                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1116                                         err = -EACCES;
1117                                         r = EXIT_TCPWRAP;
1118                                         goto fail_child;
1119                                 }
1120
1121                         for (i = 0; i < (int) n_fds; i++) {
1122                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1123                                         err = -EACCES;
1124                                         r = EXIT_TCPWRAP;
1125                                         goto fail_child;
1126                                 }
1127                         }
1128                 }
1129
1130                 exec_context_tty_reset(context);
1131
1132                 if (confirm_spawn) {
1133                         char response;
1134
1135                         err = ask_for_confirmation(&response, argv);
1136                         if (err == -ETIMEDOUT)
1137                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1138                         else if (err < 0)
1139                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1140                         else if (response == 's') {
1141                                 write_confirm_message("Skipping execution.\n");
1142                                 err = -ECANCELED;
1143                                 r = EXIT_CONFIRM;
1144                                 goto fail_child;
1145                         } else if (response == 'n') {
1146                                 write_confirm_message("Failing execution.\n");
1147                                 err = r = 0;
1148                                 goto fail_child;
1149                         }
1150                 }
1151
1152                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1153                  * must sure to drop O_NONBLOCK */
1154                 if (socket_fd >= 0)
1155                         fd_nonblock(socket_fd, false);
1156
1157                 err = setup_input(context, socket_fd, apply_tty_stdin);
1158                 if (err < 0) {
1159                         r = EXIT_STDIN;
1160                         goto fail_child;
1161                 }
1162
1163                 err = setup_output(context, STDOUT_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1164                 if (err < 0) {
1165                         r = EXIT_STDOUT;
1166                         goto fail_child;
1167                 }
1168
1169                 err = setup_output(context, STDERR_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1170                 if (err < 0) {
1171                         r = EXIT_STDERR;
1172                         goto fail_child;
1173                 }
1174
1175                 if (cgroup_path) {
1176                         err = cg_attach_with_mask(cgroup_mask, cgroup_path, 0);
1177                         if (err < 0) {
1178                                 r = EXIT_CGROUP;
1179                                 goto fail_child;
1180                         }
1181                 }
1182
1183                 if (context->oom_score_adjust_set) {
1184                         char t[16];
1185
1186                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1187                         char_array_0(t);
1188
1189                         if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
1190                                 err = -errno;
1191                                 r = EXIT_OOM_ADJUST;
1192                                 goto fail_child;
1193                         }
1194                 }
1195
1196                 if (context->nice_set)
1197                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1198                                 err = -errno;
1199                                 r = EXIT_NICE;
1200                                 goto fail_child;
1201                         }
1202
1203                 if (context->cpu_sched_set) {
1204                         struct sched_param param = {
1205                                 .sched_priority = context->cpu_sched_priority,
1206                         };
1207
1208                         r = sched_setscheduler(0,
1209                                                context->cpu_sched_policy |
1210                                                (context->cpu_sched_reset_on_fork ?
1211                                                 SCHED_RESET_ON_FORK : 0),
1212                                                &param);
1213                         if (r < 0) {
1214                                 err = -errno;
1215                                 r = EXIT_SETSCHEDULER;
1216                                 goto fail_child;
1217                         }
1218                 }
1219
1220                 if (context->cpuset)
1221                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1222                                 err = -errno;
1223                                 r = EXIT_CPUAFFINITY;
1224                                 goto fail_child;
1225                         }
1226
1227                 if (context->ioprio_set)
1228                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1229                                 err = -errno;
1230                                 r = EXIT_IOPRIO;
1231                                 goto fail_child;
1232                         }
1233
1234                 if (context->timer_slack_nsec != (nsec_t) -1)
1235                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1236                                 err = -errno;
1237                                 r = EXIT_TIMERSLACK;
1238                                 goto fail_child;
1239                         }
1240
1241                 if (context->utmp_id)
1242                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1243
1244                 if (context->user) {
1245                         username = context->user;
1246                         err = get_user_creds(&username, &uid, &gid, &home, NULL);
1247                         if (err < 0) {
1248                                 r = EXIT_USER;
1249                                 goto fail_child;
1250                         }
1251
1252                         if (is_terminal_input(context->std_input)) {
1253                                 err = chown_terminal(STDIN_FILENO, uid);
1254                                 if (err < 0) {
1255                                         r = EXIT_STDIN;
1256                                         goto fail_child;
1257                                 }
1258                         }
1259                 }
1260
1261                 if (apply_permissions) {
1262                         err = enforce_groups(context, username, gid);
1263                         if (err < 0) {
1264                                 r = EXIT_GROUP;
1265                                 goto fail_child;
1266                         }
1267                 }
1268
1269                 umask(context->umask);
1270
1271 #ifdef HAVE_PAM
1272                 if (apply_permissions && context->pam_name && username) {
1273                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1274                         if (err < 0) {
1275                                 r = EXIT_PAM;
1276                                 goto fail_child;
1277                         }
1278                 }
1279 #endif
1280                 if (context->private_network) {
1281                         if (unshare(CLONE_NEWNET) < 0) {
1282                                 err = -errno;
1283                                 r = EXIT_NETWORK;
1284                                 goto fail_child;
1285                         }
1286
1287                         loopback_setup();
1288                 }
1289
1290                 if (strv_length(context->read_write_dirs) > 0 ||
1291                     strv_length(context->read_only_dirs) > 0 ||
1292                     strv_length(context->inaccessible_dirs) > 0 ||
1293                     context->mount_flags != 0 ||
1294                     context->private_tmp) {
1295                         err = setup_namespace(context->read_write_dirs,
1296                                               context->read_only_dirs,
1297                                               context->inaccessible_dirs,
1298                                               context->tmp_dir,
1299                                               context->var_tmp_dir,
1300                                               context->private_tmp,
1301                                               context->mount_flags);
1302                         if (err < 0) {
1303                                 r = EXIT_NAMESPACE;
1304                                 goto fail_child;
1305                         }
1306                 }
1307
1308                 if (apply_chroot) {
1309                         if (context->root_directory)
1310                                 if (chroot(context->root_directory) < 0) {
1311                                         err = -errno;
1312                                         r = EXIT_CHROOT;
1313                                         goto fail_child;
1314                                 }
1315
1316                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1317                                 err = -errno;
1318                                 r = EXIT_CHDIR;
1319                                 goto fail_child;
1320                         }
1321                 } else {
1322                         _cleanup_free_ char *d = NULL;
1323
1324                         if (asprintf(&d, "%s/%s",
1325                                      context->root_directory ? context->root_directory : "",
1326                                      context->working_directory ? context->working_directory : "") < 0) {
1327                                 err = -ENOMEM;
1328                                 r = EXIT_MEMORY;
1329                                 goto fail_child;
1330                         }
1331
1332                         if (chdir(d) < 0) {
1333                                 err = -errno;
1334                                 r = EXIT_CHDIR;
1335                                 goto fail_child;
1336                         }
1337                 }
1338
1339                 /* We repeat the fd closing here, to make sure that
1340                  * nothing is leaked from the PAM modules */
1341                 err = close_all_fds(fds, n_fds);
1342                 if (err >= 0)
1343                         err = shift_fds(fds, n_fds);
1344                 if (err >= 0)
1345                         err = flags_fds(fds, n_fds, context->non_blocking);
1346                 if (err < 0) {
1347                         r = EXIT_FDS;
1348                         goto fail_child;
1349                 }
1350
1351                 if (apply_permissions) {
1352
1353                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1354                                 if (!context->rlimit[i])
1355                                         continue;
1356
1357                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1358                                         err = -errno;
1359                                         r = EXIT_LIMITS;
1360                                         goto fail_child;
1361                                 }
1362                         }
1363
1364                         if (context->capability_bounding_set_drop) {
1365                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1366                                 if (err < 0) {
1367                                         r = EXIT_CAPABILITIES;
1368                                         goto fail_child;
1369                                 }
1370                         }
1371
1372                         if (context->user) {
1373                                 err = enforce_user(context, uid);
1374                                 if (err < 0) {
1375                                         r = EXIT_USER;
1376                                         goto fail_child;
1377                                 }
1378                         }
1379
1380                         /* PR_GET_SECUREBITS is not privileged, while
1381                          * PR_SET_SECUREBITS is. So to suppress
1382                          * potential EPERMs we'll try not to call
1383                          * PR_SET_SECUREBITS unless necessary. */
1384                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1385                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1386                                         err = -errno;
1387                                         r = EXIT_SECUREBITS;
1388                                         goto fail_child;
1389                                 }
1390
1391                         if (context->capabilities)
1392                                 if (cap_set_proc(context->capabilities) < 0) {
1393                                         err = -errno;
1394                                         r = EXIT_CAPABILITIES;
1395                                         goto fail_child;
1396                                 }
1397
1398                         if (context->no_new_privileges)
1399                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1400                                         err = -errno;
1401                                         r = EXIT_NO_NEW_PRIVILEGES;
1402                                         goto fail_child;
1403                                 }
1404
1405                         if (context->syscall_filter) {
1406                                 err = apply_seccomp(context->syscall_filter);
1407                                 if (err < 0) {
1408                                         r = EXIT_SECCOMP;
1409                                         goto fail_child;
1410                                 }
1411                         }
1412                 }
1413
1414                 our_env = new0(char*, 7);
1415                 if (!our_env) {
1416                         err = -ENOMEM;
1417                         r = EXIT_MEMORY;
1418                         goto fail_child;
1419                 }
1420
1421                 if (n_fds > 0)
1422                         if (asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1423                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0) {
1424                                 err = -ENOMEM;
1425                                 r = EXIT_MEMORY;
1426                                 goto fail_child;
1427                         }
1428
1429                 if (home)
1430                         if (asprintf(our_env + n_env++, "HOME=%s", home) < 0) {
1431                                 err = -ENOMEM;
1432                                 r = EXIT_MEMORY;
1433                                 goto fail_child;
1434                         }
1435
1436                 if (username)
1437                         if (asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1438                             asprintf(our_env + n_env++, "USER=%s", username) < 0) {
1439                                 err = -ENOMEM;
1440                                 r = EXIT_MEMORY;
1441                                 goto fail_child;
1442                         }
1443
1444                 if (is_terminal_input(context->std_input) ||
1445                     context->std_output == EXEC_OUTPUT_TTY ||
1446                     context->std_error == EXEC_OUTPUT_TTY)
1447                         if (!(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))) {
1448                                 err = -ENOMEM;
1449                                 r = EXIT_MEMORY;
1450                                 goto fail_child;
1451                         }
1452
1453                 assert(n_env <= 7);
1454
1455                 final_env = strv_env_merge(5,
1456                                            environment,
1457                                            our_env,
1458                                            context->environment,
1459                                            files_env,
1460                                            pam_env,
1461                                            NULL);
1462                 if (!final_env) {
1463                         err = -ENOMEM;
1464                         r = EXIT_MEMORY;
1465                         goto fail_child;
1466                 }
1467
1468                 final_argv = replace_env_argv(argv, final_env);
1469                 if (!final_argv) {
1470                         err = -ENOMEM;
1471                         r = EXIT_MEMORY;
1472                         goto fail_child;
1473                 }
1474
1475                 final_env = strv_env_clean(final_env);
1476
1477                 if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
1478                         line = exec_command_line(final_argv);
1479                         if (line) {
1480                                 log_open();
1481                                 log_struct_unit(LOG_DEBUG,
1482                                                 unit_id,
1483                                                 "EXECUTABLE=%s", command->path,
1484                                                 "MESSAGE=Executing: %s", line,
1485                                                 NULL);
1486                                 log_close();
1487                                 free(line);
1488                                 line = NULL;
1489                         }
1490                 }
1491                 execve(command->path, final_argv, final_env);
1492                 err = -errno;
1493                 r = EXIT_EXEC;
1494
1495         fail_child:
1496                 if (r != 0) {
1497                         log_open();
1498                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1499                                    "EXECUTABLE=%s", command->path,
1500                                    "MESSAGE=Failed at step %s spawning %s: %s",
1501                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1502                                           command->path, strerror(-err),
1503                                    "ERRNO=%d", -err,
1504                                    NULL);
1505                         log_close();
1506                 }
1507
1508                 _exit(r);
1509         }
1510
1511         log_struct_unit(LOG_DEBUG,
1512                         unit_id,
1513                         "MESSAGE=Forked %s as %lu",
1514                         command->path, (unsigned long) pid,
1515                         NULL);
1516
1517         /* We add the new process to the cgroup both in the child (so
1518          * that we can be sure that no user code is ever executed
1519          * outside of the cgroup) and in the parent (so that we can be
1520          * sure that when we kill the cgroup the process will be
1521          * killed too). */
1522         if (cgroup_path)
1523                 cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
1524
1525         exec_status_start(&command->exec_status, pid);
1526
1527         *ret = pid;
1528         return 0;
1529 }
1530
1531 void exec_context_init(ExecContext *c) {
1532         assert(c);
1533
1534         c->umask = 0022;
1535         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1536         c->cpu_sched_policy = SCHED_OTHER;
1537         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1538         c->syslog_level_prefix = true;
1539         c->ignore_sigpipe = true;
1540         c->timer_slack_nsec = (nsec_t) -1;
1541 }
1542
1543 void exec_context_tmp_dirs_done(ExecContext *c) {
1544         char* dirs[] = {c->tmp_dir ? c->tmp_dir : c->var_tmp_dir,
1545                         c->tmp_dir ? c->var_tmp_dir : NULL,
1546                         NULL};
1547         char **dirp;
1548
1549         for(dirp = dirs; *dirp; dirp++) {
1550                 char *dir;
1551                 int r;
1552
1553                 r = rm_rf_dangerous(*dirp, false, true, false);
1554                 dir = dirname(*dirp);
1555                 if (r < 0)
1556                         log_warning("Failed to remove content of temporary directory %s: %s",
1557                                     dir, strerror(-r));
1558                 else {
1559                         r = rmdir(dir);
1560                         if (r < 0)
1561                                 log_warning("Failed to remove  temporary directory %s: %s",
1562                                             dir, strerror(-r));
1563                 }
1564
1565                 free(*dirp);
1566         }
1567
1568         c->tmp_dir = c->var_tmp_dir = NULL;
1569 }
1570
1571 void exec_context_done(ExecContext *c, bool reloading_or_reexecuting) {
1572         unsigned l;
1573
1574         assert(c);
1575
1576         strv_free(c->environment);
1577         c->environment = NULL;
1578
1579         strv_free(c->environment_files);
1580         c->environment_files = NULL;
1581
1582         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1583                 free(c->rlimit[l]);
1584                 c->rlimit[l] = NULL;
1585         }
1586
1587         free(c->working_directory);
1588         c->working_directory = NULL;
1589         free(c->root_directory);
1590         c->root_directory = NULL;
1591
1592         free(c->tty_path);
1593         c->tty_path = NULL;
1594
1595         free(c->tcpwrap_name);
1596         c->tcpwrap_name = NULL;
1597
1598         free(c->syslog_identifier);
1599         c->syslog_identifier = NULL;
1600
1601         free(c->user);
1602         c->user = NULL;
1603
1604         free(c->group);
1605         c->group = NULL;
1606
1607         strv_free(c->supplementary_groups);
1608         c->supplementary_groups = NULL;
1609
1610         free(c->pam_name);
1611         c->pam_name = NULL;
1612
1613         if (c->capabilities) {
1614                 cap_free(c->capabilities);
1615                 c->capabilities = NULL;
1616         }
1617
1618         strv_free(c->read_only_dirs);
1619         c->read_only_dirs = NULL;
1620
1621         strv_free(c->read_write_dirs);
1622         c->read_write_dirs = NULL;
1623
1624         strv_free(c->inaccessible_dirs);
1625         c->inaccessible_dirs = NULL;
1626
1627         if (c->cpuset)
1628                 CPU_FREE(c->cpuset);
1629
1630         free(c->utmp_id);
1631         c->utmp_id = NULL;
1632
1633         free(c->syscall_filter);
1634         c->syscall_filter = NULL;
1635
1636         if (!reloading_or_reexecuting)
1637                 exec_context_tmp_dirs_done(c);
1638 }
1639
1640 void exec_command_done(ExecCommand *c) {
1641         assert(c);
1642
1643         free(c->path);
1644         c->path = NULL;
1645
1646         strv_free(c->argv);
1647         c->argv = NULL;
1648 }
1649
1650 void exec_command_done_array(ExecCommand *c, unsigned n) {
1651         unsigned i;
1652
1653         for (i = 0; i < n; i++)
1654                 exec_command_done(c+i);
1655 }
1656
1657 void exec_command_free_list(ExecCommand *c) {
1658         ExecCommand *i;
1659
1660         while ((i = c)) {
1661                 LIST_REMOVE(ExecCommand, command, c, i);
1662                 exec_command_done(i);
1663                 free(i);
1664         }
1665 }
1666
1667 void exec_command_free_array(ExecCommand **c, unsigned n) {
1668         unsigned i;
1669
1670         for (i = 0; i < n; i++) {
1671                 exec_command_free_list(c[i]);
1672                 c[i] = NULL;
1673         }
1674 }
1675
1676 int exec_context_load_environment(const ExecContext *c, char ***l) {
1677         char **i, **r = NULL;
1678
1679         assert(c);
1680         assert(l);
1681
1682         STRV_FOREACH(i, c->environment_files) {
1683                 char *fn;
1684                 int k;
1685                 bool ignore = false;
1686                 char **p;
1687                 _cleanup_globfree_ glob_t pglob = {};
1688                 int count, n;
1689
1690                 fn = *i;
1691
1692                 if (fn[0] == '-') {
1693                         ignore = true;
1694                         fn ++;
1695                 }
1696
1697                 if (!path_is_absolute(fn)) {
1698                         if (ignore)
1699                                 continue;
1700
1701                         strv_free(r);
1702                         return -EINVAL;
1703                 }
1704
1705                 /* Filename supports globbing, take all matching files */
1706                 errno = 0;
1707                 if (glob(fn, 0, NULL, &pglob) != 0) {
1708                         if (ignore)
1709                                 continue;
1710
1711                         strv_free(r);
1712                         return errno ? -errno : -EINVAL;
1713                 }
1714                 count = pglob.gl_pathc;
1715                 if (count == 0) {
1716                         if (ignore)
1717                                 continue;
1718
1719                         strv_free(r);
1720                         return -EINVAL;
1721                 }
1722                 for (n = 0; n < count; n++) {
1723                         k = load_env_file(pglob.gl_pathv[n], NULL, &p);
1724                         if (k < 0) {
1725                                 if (ignore)
1726                                         continue;
1727
1728                                 strv_free(r);
1729                                 return k;
1730                          }
1731                         /* Log invalid environment variables with filename */
1732                         if (p)
1733                                 p = strv_env_clean_log(p, pglob.gl_pathv[n]);
1734
1735                         if (r == NULL)
1736                                 r = p;
1737                         else {
1738                                 char **m;
1739
1740                                 m = strv_env_merge(2, r, p);
1741                                 strv_free(r);
1742                                 strv_free(p);
1743                                 if (!m)
1744                                         return -ENOMEM;
1745
1746                                 r = m;
1747                         }
1748                 }
1749         }
1750
1751         *l = r;
1752
1753         return 0;
1754 }
1755
1756 static bool tty_may_match_dev_console(const char *tty) {
1757         char *active = NULL, *console;
1758         bool b;
1759
1760         if (startswith(tty, "/dev/"))
1761                 tty += 5;
1762
1763         /* trivial identity? */
1764         if (streq(tty, "console"))
1765                 return true;
1766
1767         console = resolve_dev_console(&active);
1768         /* if we could not resolve, assume it may */
1769         if (!console)
1770                 return true;
1771
1772         /* "tty0" means the active VC, so it may be the same sometimes */
1773         b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
1774         free(active);
1775
1776         return b;
1777 }
1778
1779 bool exec_context_may_touch_console(ExecContext *ec) {
1780         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
1781                 is_terminal_input(ec->std_input) ||
1782                 is_terminal_output(ec->std_output) ||
1783                 is_terminal_output(ec->std_error)) &&
1784                tty_may_match_dev_console(tty_path(ec));
1785 }
1786
1787 static void strv_fprintf(FILE *f, char **l) {
1788         char **g;
1789
1790         assert(f);
1791
1792         STRV_FOREACH(g, l)
1793                 fprintf(f, " %s", *g);
1794 }
1795
1796 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1797         char **e;
1798         unsigned i;
1799
1800         assert(c);
1801         assert(f);
1802
1803         prefix = strempty(prefix);
1804
1805         fprintf(f,
1806                 "%sUMask: %04o\n"
1807                 "%sWorkingDirectory: %s\n"
1808                 "%sRootDirectory: %s\n"
1809                 "%sNonBlocking: %s\n"
1810                 "%sPrivateTmp: %s\n"
1811                 "%sPrivateNetwork: %s\n"
1812                 "%sIgnoreSIGPIPE: %s\n",
1813                 prefix, c->umask,
1814                 prefix, c->working_directory ? c->working_directory : "/",
1815                 prefix, c->root_directory ? c->root_directory : "/",
1816                 prefix, yes_no(c->non_blocking),
1817                 prefix, yes_no(c->private_tmp),
1818                 prefix, yes_no(c->private_network),
1819                 prefix, yes_no(c->ignore_sigpipe));
1820
1821         STRV_FOREACH(e, c->environment)
1822                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1823
1824         STRV_FOREACH(e, c->environment_files)
1825                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1826
1827         if (c->tcpwrap_name)
1828                 fprintf(f,
1829                         "%sTCPWrapName: %s\n",
1830                         prefix, c->tcpwrap_name);
1831
1832         if (c->nice_set)
1833                 fprintf(f,
1834                         "%sNice: %i\n",
1835                         prefix, c->nice);
1836
1837         if (c->oom_score_adjust_set)
1838                 fprintf(f,
1839                         "%sOOMScoreAdjust: %i\n",
1840                         prefix, c->oom_score_adjust);
1841
1842         for (i = 0; i < RLIM_NLIMITS; i++)
1843                 if (c->rlimit[i])
1844                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1845
1846         if (c->ioprio_set) {
1847                 char *class_str;
1848                 int r;
1849
1850                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
1851                 if (r < 0)
1852                         class_str = NULL;
1853                 fprintf(f,
1854                         "%sIOSchedulingClass: %s\n"
1855                         "%sIOPriority: %i\n",
1856                         prefix, strna(class_str),
1857                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1858                 free(class_str);
1859         }
1860
1861         if (c->cpu_sched_set) {
1862                 char *policy_str;
1863                 int r;
1864
1865                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
1866                 if (r < 0)
1867                         policy_str = NULL;
1868                 fprintf(f,
1869                         "%sCPUSchedulingPolicy: %s\n"
1870                         "%sCPUSchedulingPriority: %i\n"
1871                         "%sCPUSchedulingResetOnFork: %s\n",
1872                         prefix, strna(policy_str),
1873                         prefix, c->cpu_sched_priority,
1874                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1875                 free(policy_str);
1876         }
1877
1878         if (c->cpuset) {
1879                 fprintf(f, "%sCPUAffinity:", prefix);
1880                 for (i = 0; i < c->cpuset_ncpus; i++)
1881                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1882                                 fprintf(f, " %i", i);
1883                 fputs("\n", f);
1884         }
1885
1886         if (c->timer_slack_nsec != (nsec_t) -1)
1887                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, (unsigned long)c->timer_slack_nsec);
1888
1889         fprintf(f,
1890                 "%sStandardInput: %s\n"
1891                 "%sStandardOutput: %s\n"
1892                 "%sStandardError: %s\n",
1893                 prefix, exec_input_to_string(c->std_input),
1894                 prefix, exec_output_to_string(c->std_output),
1895                 prefix, exec_output_to_string(c->std_error));
1896
1897         if (c->tty_path)
1898                 fprintf(f,
1899                         "%sTTYPath: %s\n"
1900                         "%sTTYReset: %s\n"
1901                         "%sTTYVHangup: %s\n"
1902                         "%sTTYVTDisallocate: %s\n",
1903                         prefix, c->tty_path,
1904                         prefix, yes_no(c->tty_reset),
1905                         prefix, yes_no(c->tty_vhangup),
1906                         prefix, yes_no(c->tty_vt_disallocate));
1907
1908         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1909             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1910             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1911             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
1912                 char *fac_str, *lvl_str;
1913                 int r;
1914
1915                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
1916                 if (r < 0)
1917                         fac_str = NULL;
1918
1919                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
1920                 if (r < 0)
1921                         lvl_str = NULL;
1922
1923                 fprintf(f,
1924                         "%sSyslogFacility: %s\n"
1925                         "%sSyslogLevel: %s\n",
1926                         prefix, strna(fac_str),
1927                         prefix, strna(lvl_str));
1928                 free(lvl_str);
1929                 free(fac_str);
1930         }
1931
1932         if (c->capabilities) {
1933                 char *t;
1934                 if ((t = cap_to_text(c->capabilities, NULL))) {
1935                         fprintf(f, "%sCapabilities: %s\n",
1936                                 prefix, t);
1937                         cap_free(t);
1938                 }
1939         }
1940
1941         if (c->secure_bits)
1942                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1943                         prefix,
1944                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
1945                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1946                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1947                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1948                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
1949                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1950
1951         if (c->capability_bounding_set_drop) {
1952                 unsigned long l;
1953                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1954
1955                 for (l = 0; l <= cap_last_cap(); l++)
1956                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1957                                 char *t;
1958
1959                                 if ((t = cap_to_name(l))) {
1960                                         fprintf(f, " %s", t);
1961                                         cap_free(t);
1962                                 }
1963                         }
1964
1965                 fputs("\n", f);
1966         }
1967
1968         if (c->user)
1969                 fprintf(f, "%sUser: %s\n", prefix, c->user);
1970         if (c->group)
1971                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
1972
1973         if (strv_length(c->supplementary_groups) > 0) {
1974                 fprintf(f, "%sSupplementaryGroups:", prefix);
1975                 strv_fprintf(f, c->supplementary_groups);
1976                 fputs("\n", f);
1977         }
1978
1979         if (c->pam_name)
1980                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
1981
1982         if (strv_length(c->read_write_dirs) > 0) {
1983                 fprintf(f, "%sReadWriteDirs:", prefix);
1984                 strv_fprintf(f, c->read_write_dirs);
1985                 fputs("\n", f);
1986         }
1987
1988         if (strv_length(c->read_only_dirs) > 0) {
1989                 fprintf(f, "%sReadOnlyDirs:", prefix);
1990                 strv_fprintf(f, c->read_only_dirs);
1991                 fputs("\n", f);
1992         }
1993
1994         if (strv_length(c->inaccessible_dirs) > 0) {
1995                 fprintf(f, "%sInaccessibleDirs:", prefix);
1996                 strv_fprintf(f, c->inaccessible_dirs);
1997                 fputs("\n", f);
1998         }
1999
2000         if (c->utmp_id)
2001                 fprintf(f,
2002                         "%sUtmpIdentifier: %s\n",
2003                         prefix, c->utmp_id);
2004 }
2005
2006 void exec_status_start(ExecStatus *s, pid_t pid) {
2007         assert(s);
2008
2009         zero(*s);
2010         s->pid = pid;
2011         dual_timestamp_get(&s->start_timestamp);
2012 }
2013
2014 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2015         assert(s);
2016
2017         if (s->pid && s->pid != pid)
2018                 zero(*s);
2019
2020         s->pid = pid;
2021         dual_timestamp_get(&s->exit_timestamp);
2022
2023         s->code = code;
2024         s->status = status;
2025
2026         if (context) {
2027                 if (context->utmp_id)
2028                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2029
2030                 exec_context_tty_reset(context);
2031         }
2032 }
2033
2034 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2035         char buf[FORMAT_TIMESTAMP_MAX];
2036
2037         assert(s);
2038         assert(f);
2039
2040         if (!prefix)
2041                 prefix = "";
2042
2043         if (s->pid <= 0)
2044                 return;
2045
2046         fprintf(f,
2047                 "%sPID: %lu\n",
2048                 prefix, (unsigned long) s->pid);
2049
2050         if (s->start_timestamp.realtime > 0)
2051                 fprintf(f,
2052                         "%sStart Timestamp: %s\n",
2053                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2054
2055         if (s->exit_timestamp.realtime > 0)
2056                 fprintf(f,
2057                         "%sExit Timestamp: %s\n"
2058                         "%sExit Code: %s\n"
2059                         "%sExit Status: %i\n",
2060                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2061                         prefix, sigchld_code_to_string(s->code),
2062                         prefix, s->status);
2063 }
2064
2065 char *exec_command_line(char **argv) {
2066         size_t k;
2067         char *n, *p, **a;
2068         bool first = true;
2069
2070         assert(argv);
2071
2072         k = 1;
2073         STRV_FOREACH(a, argv)
2074                 k += strlen(*a)+3;
2075
2076         if (!(n = new(char, k)))
2077                 return NULL;
2078
2079         p = n;
2080         STRV_FOREACH(a, argv) {
2081
2082                 if (!first)
2083                         *(p++) = ' ';
2084                 else
2085                         first = false;
2086
2087                 if (strpbrk(*a, WHITESPACE)) {
2088                         *(p++) = '\'';
2089                         p = stpcpy(p, *a);
2090                         *(p++) = '\'';
2091                 } else
2092                         p = stpcpy(p, *a);
2093
2094         }
2095
2096         *p = 0;
2097
2098         /* FIXME: this doesn't really handle arguments that have
2099          * spaces and ticks in them */
2100
2101         return n;
2102 }
2103
2104 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2105         char *p2;
2106         const char *prefix2;
2107
2108         char *cmd;
2109
2110         assert(c);
2111         assert(f);
2112
2113         if (!prefix)
2114                 prefix = "";
2115         p2 = strappend(prefix, "\t");
2116         prefix2 = p2 ? p2 : prefix;
2117
2118         cmd = exec_command_line(c->argv);
2119
2120         fprintf(f,
2121                 "%sCommand Line: %s\n",
2122                 prefix, cmd ? cmd : strerror(ENOMEM));
2123
2124         free(cmd);
2125
2126         exec_status_dump(&c->exec_status, f, prefix2);
2127
2128         free(p2);
2129 }
2130
2131 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2132         assert(f);
2133
2134         if (!prefix)
2135                 prefix = "";
2136
2137         LIST_FOREACH(command, c, c)
2138                 exec_command_dump(c, f, prefix);
2139 }
2140
2141 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2142         ExecCommand *end;
2143
2144         assert(l);
2145         assert(e);
2146
2147         if (*l) {
2148                 /* It's kind of important, that we keep the order here */
2149                 LIST_FIND_TAIL(ExecCommand, command, *l, end);
2150                 LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
2151         } else
2152               *l = e;
2153 }
2154
2155 int exec_command_set(ExecCommand *c, const char *path, ...) {
2156         va_list ap;
2157         char **l, *p;
2158
2159         assert(c);
2160         assert(path);
2161
2162         va_start(ap, path);
2163         l = strv_new_ap(path, ap);
2164         va_end(ap);
2165
2166         if (!l)
2167                 return -ENOMEM;
2168
2169         if (!(p = strdup(path))) {
2170                 strv_free(l);
2171                 return -ENOMEM;
2172         }
2173
2174         free(c->path);
2175         c->path = p;
2176
2177         strv_free(c->argv);
2178         c->argv = l;
2179
2180         return 0;
2181 }
2182
2183 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2184         [EXEC_INPUT_NULL] = "null",
2185         [EXEC_INPUT_TTY] = "tty",
2186         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2187         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2188         [EXEC_INPUT_SOCKET] = "socket"
2189 };
2190
2191 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2192
2193 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2194         [EXEC_OUTPUT_INHERIT] = "inherit",
2195         [EXEC_OUTPUT_NULL] = "null",
2196         [EXEC_OUTPUT_TTY] = "tty",
2197         [EXEC_OUTPUT_SYSLOG] = "syslog",
2198         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2199         [EXEC_OUTPUT_KMSG] = "kmsg",
2200         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2201         [EXEC_OUTPUT_JOURNAL] = "journal",
2202         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2203         [EXEC_OUTPUT_SOCKET] = "socket"
2204 };
2205
2206 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);