chiark / gitweb /
silence gcc warning on 32 bit
[elogind.git] / src / core / execute.c
1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
2
3 /***
4   This file is part of systemd.
5
6   Copyright 2010 Lennart Poettering
7
8   systemd is free software; you can redistribute it and/or modify it
9   under the terms of the GNU Lesser General Public License as published by
10   the Free Software Foundation; either version 2.1 of the License, or
11   (at your option) any later version.
12
13   systemd is distributed in the hope that it will be useful, but
14   WITHOUT ANY WARRANTY; without even the implied warranty of
15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16   Lesser General Public License for more details.
17
18   You should have received a copy of the GNU Lesser General Public License
19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
20 ***/
21
22 #include <assert.h>
23 #include <dirent.h>
24 #include <errno.h>
25 #include <fcntl.h>
26 #include <unistd.h>
27 #include <string.h>
28 #include <signal.h>
29 #include <sys/socket.h>
30 #include <sys/un.h>
31 #include <sys/prctl.h>
32 #include <linux/sched.h>
33 #include <sys/types.h>
34 #include <sys/stat.h>
35 #include <grp.h>
36 #include <pwd.h>
37 #include <sys/mount.h>
38 #include <linux/fs.h>
39 #include <linux/oom.h>
40 #include <sys/poll.h>
41
42 #ifdef HAVE_PAM
43 #include <security/pam_appl.h>
44 #endif
45
46 #include "execute.h"
47 #include "strv.h"
48 #include "macro.h"
49 #include "capability.h"
50 #include "util.h"
51 #include "log.h"
52 #include "ioprio.h"
53 #include "securebits.h"
54 #include "cgroup.h"
55 #include "namespace.h"
56 #include "tcpwrap.h"
57 #include "exit-status.h"
58 #include "missing.h"
59 #include "utmp-wtmp.h"
60 #include "def.h"
61 #include "loopback-setup.h"
62 #include "path-util.h"
63
64 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
65
66 /* This assumes there is a 'tty' group */
67 #define TTY_MODE 0620
68
69 static int shift_fds(int fds[], unsigned n_fds) {
70         int start, restart_from;
71
72         if (n_fds <= 0)
73                 return 0;
74
75         /* Modifies the fds array! (sorts it) */
76
77         assert(fds);
78
79         start = 0;
80         for (;;) {
81                 int i;
82
83                 restart_from = -1;
84
85                 for (i = start; i < (int) n_fds; i++) {
86                         int nfd;
87
88                         /* Already at right index? */
89                         if (fds[i] == i+3)
90                                 continue;
91
92                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
93                                 return -errno;
94
95                         close_nointr_nofail(fds[i]);
96                         fds[i] = nfd;
97
98                         /* Hmm, the fd we wanted isn't free? Then
99                          * let's remember that and try again from here*/
100                         if (nfd != i+3 && restart_from < 0)
101                                 restart_from = i;
102                 }
103
104                 if (restart_from < 0)
105                         break;
106
107                 start = restart_from;
108         }
109
110         return 0;
111 }
112
113 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
114         unsigned i;
115         int r;
116
117         if (n_fds <= 0)
118                 return 0;
119
120         assert(fds);
121
122         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
123
124         for (i = 0; i < n_fds; i++) {
125
126                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
127                         return r;
128
129                 /* We unconditionally drop FD_CLOEXEC from the fds,
130                  * since after all we want to pass these fds to our
131                  * children */
132
133                 if ((r = fd_cloexec(fds[i], false)) < 0)
134                         return r;
135         }
136
137         return 0;
138 }
139
140 static const char *tty_path(const ExecContext *context) {
141         assert(context);
142
143         if (context->tty_path)
144                 return context->tty_path;
145
146         return "/dev/console";
147 }
148
149 void exec_context_tty_reset(const ExecContext *context) {
150         assert(context);
151
152         if (context->tty_vhangup)
153                 terminal_vhangup(tty_path(context));
154
155         if (context->tty_reset)
156                 reset_terminal(tty_path(context));
157
158         if (context->tty_vt_disallocate && context->tty_path)
159                 vt_disallocate(context->tty_path);
160 }
161
162 static int open_null_as(int flags, int nfd) {
163         int fd, r;
164
165         assert(nfd >= 0);
166
167         if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
168                 return -errno;
169
170         if (fd != nfd) {
171                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
172                 close_nointr_nofail(fd);
173         } else
174                 r = nfd;
175
176         return r;
177 }
178
179 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, int nfd) {
180         int fd, r;
181         union sockaddr_union sa;
182
183         assert(context);
184         assert(output < _EXEC_OUTPUT_MAX);
185         assert(ident);
186         assert(nfd >= 0);
187
188         fd = socket(AF_UNIX, SOCK_STREAM, 0);
189         if (fd < 0)
190                 return -errno;
191
192         zero(sa);
193         sa.un.sun_family = AF_UNIX;
194         strncpy(sa.un.sun_path, "/run/systemd/journal/stdout", sizeof(sa.un.sun_path));
195
196         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
197         if (r < 0) {
198                 close_nointr_nofail(fd);
199                 return -errno;
200         }
201
202         if (shutdown(fd, SHUT_RD) < 0) {
203                 close_nointr_nofail(fd);
204                 return -errno;
205         }
206
207         dprintf(fd,
208                 "%s\n"
209                 "%i\n"
210                 "%i\n"
211                 "%i\n"
212                 "%i\n"
213                 "%i\n",
214                 context->syslog_identifier ? context->syslog_identifier : ident,
215                 context->syslog_priority,
216                 !!context->syslog_level_prefix,
217                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
218                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
219                 output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || output == EXEC_OUTPUT_KMSG_AND_CONSOLE || output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
220
221         if (fd != nfd) {
222                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
223                 close_nointr_nofail(fd);
224         } else
225                 r = nfd;
226
227         return r;
228 }
229 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
230         int fd, r;
231
232         assert(path);
233         assert(nfd >= 0);
234
235         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
236                 return fd;
237
238         if (fd != nfd) {
239                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
240                 close_nointr_nofail(fd);
241         } else
242                 r = nfd;
243
244         return r;
245 }
246
247 static bool is_terminal_input(ExecInput i) {
248         return
249                 i == EXEC_INPUT_TTY ||
250                 i == EXEC_INPUT_TTY_FORCE ||
251                 i == EXEC_INPUT_TTY_FAIL;
252 }
253
254 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
255
256         if (is_terminal_input(std_input) && !apply_tty_stdin)
257                 return EXEC_INPUT_NULL;
258
259         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
260                 return EXEC_INPUT_NULL;
261
262         return std_input;
263 }
264
265 static int fixup_output(ExecOutput std_output, int socket_fd) {
266
267         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
268                 return EXEC_OUTPUT_INHERIT;
269
270         return std_output;
271 }
272
273 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
274         ExecInput i;
275
276         assert(context);
277
278         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
279
280         switch (i) {
281
282         case EXEC_INPUT_NULL:
283                 return open_null_as(O_RDONLY, STDIN_FILENO);
284
285         case EXEC_INPUT_TTY:
286         case EXEC_INPUT_TTY_FORCE:
287         case EXEC_INPUT_TTY_FAIL: {
288                 int fd, r;
289
290                 if ((fd = acquire_terminal(
291                                      tty_path(context),
292                                      i == EXEC_INPUT_TTY_FAIL,
293                                      i == EXEC_INPUT_TTY_FORCE,
294                                      false)) < 0)
295                         return fd;
296
297                 if (fd != STDIN_FILENO) {
298                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
299                         close_nointr_nofail(fd);
300                 } else
301                         r = STDIN_FILENO;
302
303                 return r;
304         }
305
306         case EXEC_INPUT_SOCKET:
307                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
308
309         default:
310                 assert_not_reached("Unknown input type");
311         }
312 }
313
314 static int setup_output(const ExecContext *context, int socket_fd, const char *ident, bool apply_tty_stdin) {
315         ExecOutput o;
316         ExecInput i;
317
318         assert(context);
319         assert(ident);
320
321         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
322         o = fixup_output(context->std_output, socket_fd);
323
324         /* This expects the input is already set up */
325
326         switch (o) {
327
328         case EXEC_OUTPUT_INHERIT:
329
330                 /* If input got downgraded, inherit the original value */
331                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
332                         return open_terminal_as(tty_path(context), O_WRONLY, STDOUT_FILENO);
333
334                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
335                 if (i != EXEC_INPUT_NULL)
336                         return dup2(STDIN_FILENO, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
337
338                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
339                 if (getppid() != 1)
340                         return STDOUT_FILENO;
341
342                 /* We need to open /dev/null here anew, to get the
343                  * right access mode. So we fall through */
344
345         case EXEC_OUTPUT_NULL:
346                 return open_null_as(O_WRONLY, STDOUT_FILENO);
347
348         case EXEC_OUTPUT_TTY:
349                 if (is_terminal_input(i))
350                         return dup2(STDIN_FILENO, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
351
352                 /* We don't reset the terminal if this is just about output */
353                 return open_terminal_as(tty_path(context), O_WRONLY, STDOUT_FILENO);
354
355         case EXEC_OUTPUT_SYSLOG:
356         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
357         case EXEC_OUTPUT_KMSG:
358         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
359         case EXEC_OUTPUT_JOURNAL:
360         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
361                 return connect_logger_as(context, o, ident, STDOUT_FILENO);
362
363         case EXEC_OUTPUT_SOCKET:
364                 assert(socket_fd >= 0);
365                 return dup2(socket_fd, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
366
367         default:
368                 assert_not_reached("Unknown output type");
369         }
370 }
371
372 static int setup_error(const ExecContext *context, int socket_fd, const char *ident, bool apply_tty_stdin) {
373         ExecOutput o, e;
374         ExecInput i;
375
376         assert(context);
377         assert(ident);
378
379         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
380         o = fixup_output(context->std_output, socket_fd);
381         e = fixup_output(context->std_error, socket_fd);
382
383         /* This expects the input and output are already set up */
384
385         /* Don't change the stderr file descriptor if we inherit all
386          * the way and are not on a tty */
387         if (e == EXEC_OUTPUT_INHERIT &&
388             o == EXEC_OUTPUT_INHERIT &&
389             i == EXEC_INPUT_NULL &&
390             !is_terminal_input(context->std_input) &&
391             getppid () != 1)
392                 return STDERR_FILENO;
393
394         /* Duplicate from stdout if possible */
395         if (e == o || e == EXEC_OUTPUT_INHERIT)
396                 return dup2(STDOUT_FILENO, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
397
398         switch (e) {
399
400         case EXEC_OUTPUT_NULL:
401                 return open_null_as(O_WRONLY, STDERR_FILENO);
402
403         case EXEC_OUTPUT_TTY:
404                 if (is_terminal_input(i))
405                         return dup2(STDIN_FILENO, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
406
407                 /* We don't reset the terminal if this is just about output */
408                 return open_terminal_as(tty_path(context), O_WRONLY, STDERR_FILENO);
409
410         case EXEC_OUTPUT_SYSLOG:
411         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
412         case EXEC_OUTPUT_KMSG:
413         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
414         case EXEC_OUTPUT_JOURNAL:
415         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
416                 return connect_logger_as(context, e, ident, STDERR_FILENO);
417
418         case EXEC_OUTPUT_SOCKET:
419                 assert(socket_fd >= 0);
420                 return dup2(socket_fd, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
421
422         default:
423                 assert_not_reached("Unknown error type");
424         }
425 }
426
427 static int chown_terminal(int fd, uid_t uid) {
428         struct stat st;
429
430         assert(fd >= 0);
431
432         /* This might fail. What matters are the results. */
433         (void) fchown(fd, uid, -1);
434         (void) fchmod(fd, TTY_MODE);
435
436         if (fstat(fd, &st) < 0)
437                 return -errno;
438
439         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
440                 return -EPERM;
441
442         return 0;
443 }
444
445 static int setup_confirm_stdio(const ExecContext *context,
446                                int *_saved_stdin,
447                                int *_saved_stdout) {
448         int fd = -1, saved_stdin, saved_stdout = -1, r;
449
450         assert(context);
451         assert(_saved_stdin);
452         assert(_saved_stdout);
453
454         /* This returns positive EXIT_xxx return values instead of
455          * negative errno style values! */
456
457         if ((saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3)) < 0)
458                 return EXIT_STDIN;
459
460         if ((saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3)) < 0) {
461                 r = EXIT_STDOUT;
462                 goto fail;
463         }
464
465         if ((fd = acquire_terminal(
466                              tty_path(context),
467                              context->std_input == EXEC_INPUT_TTY_FAIL,
468                              context->std_input == EXEC_INPUT_TTY_FORCE,
469                              false)) < 0) {
470                 r = EXIT_STDIN;
471                 goto fail;
472         }
473
474         if (chown_terminal(fd, getuid()) < 0) {
475                 r = EXIT_STDIN;
476                 goto fail;
477         }
478
479         if (dup2(fd, STDIN_FILENO) < 0) {
480                 r = EXIT_STDIN;
481                 goto fail;
482         }
483
484         if (dup2(fd, STDOUT_FILENO) < 0) {
485                 r = EXIT_STDOUT;
486                 goto fail;
487         }
488
489         if (fd >= 2)
490                 close_nointr_nofail(fd);
491
492         *_saved_stdin = saved_stdin;
493         *_saved_stdout = saved_stdout;
494
495         return 0;
496
497 fail:
498         if (saved_stdout >= 0)
499                 close_nointr_nofail(saved_stdout);
500
501         if (saved_stdin >= 0)
502                 close_nointr_nofail(saved_stdin);
503
504         if (fd >= 0)
505                 close_nointr_nofail(fd);
506
507         return r;
508 }
509
510 static int restore_confirm_stdio(const ExecContext *context,
511                                  int *saved_stdin,
512                                  int *saved_stdout,
513                                  bool *keep_stdin,
514                                  bool *keep_stdout) {
515
516         assert(context);
517         assert(saved_stdin);
518         assert(*saved_stdin >= 0);
519         assert(saved_stdout);
520         assert(*saved_stdout >= 0);
521
522         /* This returns positive EXIT_xxx return values instead of
523          * negative errno style values! */
524
525         if (is_terminal_input(context->std_input)) {
526
527                 /* The service wants terminal input. */
528
529                 *keep_stdin = true;
530                 *keep_stdout =
531                         context->std_output == EXEC_OUTPUT_INHERIT ||
532                         context->std_output == EXEC_OUTPUT_TTY;
533
534         } else {
535                 /* If the service doesn't want a controlling terminal,
536                  * then we need to get rid entirely of what we have
537                  * already. */
538
539                 if (release_terminal() < 0)
540                         return EXIT_STDIN;
541
542                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
543                         return EXIT_STDIN;
544
545                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
546                         return EXIT_STDOUT;
547
548                 *keep_stdout = *keep_stdin = false;
549         }
550
551         return 0;
552 }
553
554 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
555         bool keep_groups = false;
556         int r;
557
558         assert(context);
559
560         /* Lookup and set GID and supplementary group list. Here too
561          * we avoid NSS lookups for gid=0. */
562
563         if (context->group || username) {
564
565                 if (context->group) {
566                         const char *g = context->group;
567
568                         if ((r = get_group_creds(&g, &gid)) < 0)
569                                 return r;
570                 }
571
572                 /* First step, initialize groups from /etc/groups */
573                 if (username && gid != 0) {
574                         if (initgroups(username, gid) < 0)
575                                 return -errno;
576
577                         keep_groups = true;
578                 }
579
580                 /* Second step, set our gids */
581                 if (setresgid(gid, gid, gid) < 0)
582                         return -errno;
583         }
584
585         if (context->supplementary_groups) {
586                 int ngroups_max, k;
587                 gid_t *gids;
588                 char **i;
589
590                 /* Final step, initialize any manually set supplementary groups */
591                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
592
593                 if (!(gids = new(gid_t, ngroups_max)))
594                         return -ENOMEM;
595
596                 if (keep_groups) {
597                         if ((k = getgroups(ngroups_max, gids)) < 0) {
598                                 free(gids);
599                                 return -errno;
600                         }
601                 } else
602                         k = 0;
603
604                 STRV_FOREACH(i, context->supplementary_groups) {
605                         const char *g;
606
607                         if (k >= ngroups_max) {
608                                 free(gids);
609                                 return -E2BIG;
610                         }
611
612                         g = *i;
613                         r = get_group_creds(&g, gids+k);
614                         if (r < 0) {
615                                 free(gids);
616                                 return r;
617                         }
618
619                         k++;
620                 }
621
622                 if (setgroups(k, gids) < 0) {
623                         free(gids);
624                         return -errno;
625                 }
626
627                 free(gids);
628         }
629
630         return 0;
631 }
632
633 static int enforce_user(const ExecContext *context, uid_t uid) {
634         int r;
635         assert(context);
636
637         /* Sets (but doesn't lookup) the uid and make sure we keep the
638          * capabilities while doing so. */
639
640         if (context->capabilities) {
641                 cap_t d;
642                 static const cap_value_t bits[] = {
643                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
644                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
645                 };
646
647                 /* First step: If we need to keep capabilities but
648                  * drop privileges we need to make sure we keep our
649                  * caps, whiel we drop privileges. */
650                 if (uid != 0) {
651                         int sb = context->secure_bits|SECURE_KEEP_CAPS;
652
653                         if (prctl(PR_GET_SECUREBITS) != sb)
654                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
655                                         return -errno;
656                 }
657
658                 /* Second step: set the capabilities. This will reduce
659                  * the capabilities to the minimum we need. */
660
661                 if (!(d = cap_dup(context->capabilities)))
662                         return -errno;
663
664                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
665                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
666                         r = -errno;
667                         cap_free(d);
668                         return r;
669                 }
670
671                 if (cap_set_proc(d) < 0) {
672                         r = -errno;
673                         cap_free(d);
674                         return r;
675                 }
676
677                 cap_free(d);
678         }
679
680         /* Third step: actually set the uids */
681         if (setresuid(uid, uid, uid) < 0)
682                 return -errno;
683
684         /* At this point we should have all necessary capabilities but
685            are otherwise a normal user. However, the caps might got
686            corrupted due to the setresuid() so we need clean them up
687            later. This is done outside of this call. */
688
689         return 0;
690 }
691
692 #ifdef HAVE_PAM
693
694 static int null_conv(
695                 int num_msg,
696                 const struct pam_message **msg,
697                 struct pam_response **resp,
698                 void *appdata_ptr) {
699
700         /* We don't support conversations */
701
702         return PAM_CONV_ERR;
703 }
704
705 static int setup_pam(
706                 const char *name,
707                 const char *user,
708                 uid_t uid,
709                 const char *tty,
710                 char ***pam_env,
711                 int fds[], unsigned n_fds) {
712
713         static const struct pam_conv conv = {
714                 .conv = null_conv,
715                 .appdata_ptr = NULL
716         };
717
718         pam_handle_t *handle = NULL;
719         sigset_t ss, old_ss;
720         int pam_code = PAM_SUCCESS;
721         int err;
722         char **e = NULL;
723         bool close_session = false;
724         pid_t pam_pid = 0, parent_pid;
725
726         assert(name);
727         assert(user);
728         assert(pam_env);
729
730         /* We set up PAM in the parent process, then fork. The child
731          * will then stay around until killed via PR_GET_PDEATHSIG or
732          * systemd via the cgroup logic. It will then remove the PAM
733          * session again. The parent process will exec() the actual
734          * daemon. We do things this way to ensure that the main PID
735          * of the daemon is the one we initially fork()ed. */
736
737         if ((pam_code = pam_start(name, user, &conv, &handle)) != PAM_SUCCESS) {
738                 handle = NULL;
739                 goto fail;
740         }
741
742         if (tty)
743                 if ((pam_code = pam_set_item(handle, PAM_TTY, tty)) != PAM_SUCCESS)
744                         goto fail;
745
746         if ((pam_code = pam_acct_mgmt(handle, PAM_SILENT)) != PAM_SUCCESS)
747                 goto fail;
748
749         if ((pam_code = pam_open_session(handle, PAM_SILENT)) != PAM_SUCCESS)
750                 goto fail;
751
752         close_session = true;
753
754         if ((!(e = pam_getenvlist(handle)))) {
755                 pam_code = PAM_BUF_ERR;
756                 goto fail;
757         }
758
759         /* Block SIGTERM, so that we know that it won't get lost in
760          * the child */
761         if (sigemptyset(&ss) < 0 ||
762             sigaddset(&ss, SIGTERM) < 0 ||
763             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
764                 goto fail;
765
766         parent_pid = getpid();
767
768         if ((pam_pid = fork()) < 0)
769                 goto fail;
770
771         if (pam_pid == 0) {
772                 int sig;
773                 int r = EXIT_PAM;
774
775                 /* The child's job is to reset the PAM session on
776                  * termination */
777
778                 /* This string must fit in 10 chars (i.e. the length
779                  * of "/sbin/init"), to look pretty in /bin/ps */
780                 rename_process("(sd-pam)");
781
782                 /* Make sure we don't keep open the passed fds in this
783                 child. We assume that otherwise only those fds are
784                 open here that have been opened by PAM. */
785                 close_many(fds, n_fds);
786
787                 /* Drop privileges - we don't need any to pam_close_session
788                  * and this will make PR_SET_PDEATHSIG work in most cases.
789                  * If this fails, ignore the error - but expect sd-pam threads
790                  * to fail to exit normally */
791                 if (setresuid(uid, uid, uid) < 0)
792                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
793
794                 /* Wait until our parent died. This will only work if
795                  * the above setresuid() succeeds, otherwise the kernel
796                  * will not allow unprivileged parents kill their privileged
797                  * children this way. We rely on the control groups kill logic
798                  * to do the rest for us. */
799                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
800                         goto child_finish;
801
802                 /* Check if our parent process might already have
803                  * died? */
804                 if (getppid() == parent_pid) {
805                         for (;;) {
806                                 if (sigwait(&ss, &sig) < 0) {
807                                         if (errno == EINTR)
808                                                 continue;
809
810                                         goto child_finish;
811                                 }
812
813                                 assert(sig == SIGTERM);
814                                 break;
815                         }
816                 }
817
818                 /* If our parent died we'll end the session */
819                 if (getppid() != parent_pid)
820                         if ((pam_code = pam_close_session(handle, PAM_DATA_SILENT)) != PAM_SUCCESS)
821                                 goto child_finish;
822
823                 r = 0;
824
825         child_finish:
826                 pam_end(handle, pam_code | PAM_DATA_SILENT);
827                 _exit(r);
828         }
829
830         /* If the child was forked off successfully it will do all the
831          * cleanups, so forget about the handle here. */
832         handle = NULL;
833
834         /* Unblock SIGTERM again in the parent */
835         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
836                 goto fail;
837
838         /* We close the log explicitly here, since the PAM modules
839          * might have opened it, but we don't want this fd around. */
840         closelog();
841
842         *pam_env = e;
843         e = NULL;
844
845         return 0;
846
847 fail:
848         if (pam_code != PAM_SUCCESS)
849                 err = -EPERM;  /* PAM errors do not map to errno */
850         else
851                 err = -errno;
852
853         if (handle) {
854                 if (close_session)
855                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
856
857                 pam_end(handle, pam_code | PAM_DATA_SILENT);
858         }
859
860         strv_free(e);
861
862         closelog();
863
864         if (pam_pid > 1) {
865                 kill(pam_pid, SIGTERM);
866                 kill(pam_pid, SIGCONT);
867         }
868
869         return err;
870 }
871 #endif
872
873 static void rename_process_from_path(const char *path) {
874         char process_name[11];
875         const char *p;
876         size_t l;
877
878         /* This resulting string must fit in 10 chars (i.e. the length
879          * of "/sbin/init") to look pretty in /bin/ps */
880
881         p = path_get_file_name(path);
882         if (isempty(p)) {
883                 rename_process("(...)");
884                 return;
885         }
886
887         l = strlen(p);
888         if (l > 8) {
889                 /* The end of the process name is usually more
890                  * interesting, since the first bit might just be
891                  * "systemd-" */
892                 p = p + l - 8;
893                 l = 8;
894         }
895
896         process_name[0] = '(';
897         memcpy(process_name+1, p, l);
898         process_name[1+l] = ')';
899         process_name[1+l+1] = 0;
900
901         rename_process(process_name);
902 }
903
904 int exec_spawn(ExecCommand *command,
905                char **argv,
906                const ExecContext *context,
907                int fds[], unsigned n_fds,
908                char **environment,
909                bool apply_permissions,
910                bool apply_chroot,
911                bool apply_tty_stdin,
912                bool confirm_spawn,
913                CGroupBonding *cgroup_bondings,
914                CGroupAttribute *cgroup_attributes,
915                const char *cgroup_suffix,
916                int idle_pipe[2],
917                pid_t *ret) {
918
919         pid_t pid;
920         int r;
921         char *line;
922         int socket_fd;
923         char **files_env = NULL;
924
925         assert(command);
926         assert(context);
927         assert(ret);
928         assert(fds || n_fds <= 0);
929
930         if (context->std_input == EXEC_INPUT_SOCKET ||
931             context->std_output == EXEC_OUTPUT_SOCKET ||
932             context->std_error == EXEC_OUTPUT_SOCKET) {
933
934                 if (n_fds != 1)
935                         return -EINVAL;
936
937                 socket_fd = fds[0];
938
939                 fds = NULL;
940                 n_fds = 0;
941         } else
942                 socket_fd = -1;
943
944         if ((r = exec_context_load_environment(context, &files_env)) < 0) {
945                 log_error("Failed to load environment files: %s", strerror(-r));
946                 return r;
947         }
948
949         if (!argv)
950                 argv = command->argv;
951
952         if (!(line = exec_command_line(argv))) {
953                 r = -ENOMEM;
954                 goto fail_parent;
955         }
956
957         log_debug("About to execute: %s", line);
958         free(line);
959
960         r = cgroup_bonding_realize_list(cgroup_bondings);
961         if (r < 0)
962                 goto fail_parent;
963
964         cgroup_attribute_apply_list(cgroup_attributes, cgroup_bondings);
965
966         if ((pid = fork()) < 0) {
967                 r = -errno;
968                 goto fail_parent;
969         }
970
971         if (pid == 0) {
972                 int i, err;
973                 sigset_t ss;
974                 const char *username = NULL, *home = NULL;
975                 uid_t uid = (uid_t) -1;
976                 gid_t gid = (gid_t) -1;
977                 char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
978                 unsigned n_env = 0;
979                 int saved_stdout = -1, saved_stdin = -1;
980                 bool keep_stdout = false, keep_stdin = false, set_access = false;
981
982                 /* child */
983
984                 rename_process_from_path(command->path);
985
986                 /* We reset exactly these signals, since they are the
987                  * only ones we set to SIG_IGN in the main daemon. All
988                  * others we leave untouched because we set them to
989                  * SIG_DFL or a valid handler initially, both of which
990                  * will be demoted to SIG_DFL. */
991                 default_signals(SIGNALS_CRASH_HANDLER,
992                                 SIGNALS_IGNORE, -1);
993
994                 if (context->ignore_sigpipe)
995                         ignore_signals(SIGPIPE, -1);
996
997                 assert_se(sigemptyset(&ss) == 0);
998                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
999                         err = -errno;
1000                         r = EXIT_SIGNAL_MASK;
1001                         goto fail_child;
1002                 }
1003
1004                 if (idle_pipe) {
1005                         if (idle_pipe[1] >= 0)
1006                                 close_nointr_nofail(idle_pipe[1]);
1007                         if (idle_pipe[0] >= 0) {
1008                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1009                                 close_nointr_nofail(idle_pipe[0]);
1010                         }
1011                 }
1012
1013                 /* Close sockets very early to make sure we don't
1014                  * block init reexecution because it cannot bind its
1015                  * sockets */
1016                 log_forget_fds();
1017                 err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
1018                                            socket_fd >= 0 ? 1 : n_fds);
1019                 if (err < 0) {
1020                         r = EXIT_FDS;
1021                         goto fail_child;
1022                 }
1023
1024                 if (!context->same_pgrp)
1025                         if (setsid() < 0) {
1026                                 err = -errno;
1027                                 r = EXIT_SETSID;
1028                                 goto fail_child;
1029                         }
1030
1031                 if (context->tcpwrap_name) {
1032                         if (socket_fd >= 0)
1033                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1034                                         err = -EACCES;
1035                                         r = EXIT_TCPWRAP;
1036                                         goto fail_child;
1037                                 }
1038
1039                         for (i = 0; i < (int) n_fds; i++) {
1040                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1041                                         err = -EACCES;
1042                                         r = EXIT_TCPWRAP;
1043                                         goto fail_child;
1044                                 }
1045                         }
1046                 }
1047
1048                 exec_context_tty_reset(context);
1049
1050                 /* We skip the confirmation step if we shall not apply the TTY */
1051                 if (confirm_spawn &&
1052                     (!is_terminal_input(context->std_input) || apply_tty_stdin)) {
1053                         char response;
1054
1055                         /* Set up terminal for the question */
1056                         if ((r = setup_confirm_stdio(context,
1057                                                      &saved_stdin, &saved_stdout))) {
1058                                 err = -errno;
1059                                 goto fail_child;
1060                         }
1061
1062                         /* Now ask the question. */
1063                         if (!(line = exec_command_line(argv))) {
1064                                 err = -ENOMEM;
1065                                 r = EXIT_MEMORY;
1066                                 goto fail_child;
1067                         }
1068
1069                         r = ask(&response, "yns", "Execute %s? [Yes, No, Skip] ", line);
1070                         free(line);
1071
1072                         if (r < 0 || response == 'n') {
1073                                 err = -ECANCELED;
1074                                 r = EXIT_CONFIRM;
1075                                 goto fail_child;
1076                         } else if (response == 's') {
1077                                 err = r = 0;
1078                                 goto fail_child;
1079                         }
1080
1081                         /* Release terminal for the question */
1082                         if ((r = restore_confirm_stdio(context,
1083                                                        &saved_stdin, &saved_stdout,
1084                                                        &keep_stdin, &keep_stdout))) {
1085                                 err = -errno;
1086                                 goto fail_child;
1087                         }
1088                 }
1089
1090                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1091                  * must sure to drop O_NONBLOCK */
1092                 if (socket_fd >= 0)
1093                         fd_nonblock(socket_fd, false);
1094
1095                 if (!keep_stdin) {
1096                         err = setup_input(context, socket_fd, apply_tty_stdin);
1097                         if (err < 0) {
1098                                 r = EXIT_STDIN;
1099                                 goto fail_child;
1100                         }
1101                 }
1102
1103                 if (!keep_stdout) {
1104                         err = setup_output(context, socket_fd, path_get_file_name(command->path), apply_tty_stdin);
1105                         if (err < 0) {
1106                                 r = EXIT_STDOUT;
1107                                 goto fail_child;
1108                         }
1109                 }
1110
1111                 err = setup_error(context, socket_fd, path_get_file_name(command->path), apply_tty_stdin);
1112                 if (err < 0) {
1113                         r = EXIT_STDERR;
1114                         goto fail_child;
1115                 }
1116
1117                 if (cgroup_bondings) {
1118                         err = cgroup_bonding_install_list(cgroup_bondings, 0, cgroup_suffix);
1119                         if (err < 0) {
1120                                 r = EXIT_CGROUP;
1121                                 goto fail_child;
1122                         }
1123                 }
1124
1125                 if (context->oom_score_adjust_set) {
1126                         char t[16];
1127
1128                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1129                         char_array_0(t);
1130
1131                         if (write_one_line_file("/proc/self/oom_score_adj", t) < 0) {
1132                                 err = -errno;
1133                                 r = EXIT_OOM_ADJUST;
1134                                 goto fail_child;
1135                         }
1136                 }
1137
1138                 if (context->nice_set)
1139                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1140                                 err = -errno;
1141                                 r = EXIT_NICE;
1142                                 goto fail_child;
1143                         }
1144
1145                 if (context->cpu_sched_set) {
1146                         struct sched_param param;
1147
1148                         zero(param);
1149                         param.sched_priority = context->cpu_sched_priority;
1150
1151                         if (sched_setscheduler(0, context->cpu_sched_policy |
1152                                                (context->cpu_sched_reset_on_fork ? SCHED_RESET_ON_FORK : 0), &param) < 0) {
1153                                 err = -errno;
1154                                 r = EXIT_SETSCHEDULER;
1155                                 goto fail_child;
1156                         }
1157                 }
1158
1159                 if (context->cpuset)
1160                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1161                                 err = -errno;
1162                                 r = EXIT_CPUAFFINITY;
1163                                 goto fail_child;
1164                         }
1165
1166                 if (context->ioprio_set)
1167                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1168                                 err = -errno;
1169                                 r = EXIT_IOPRIO;
1170                                 goto fail_child;
1171                         }
1172
1173                 if (context->timer_slack_nsec != (nsec_t) -1)
1174                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1175                                 err = -errno;
1176                                 r = EXIT_TIMERSLACK;
1177                                 goto fail_child;
1178                         }
1179
1180                 if (context->utmp_id)
1181                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1182
1183                 if (context->user) {
1184                         username = context->user;
1185                         err = get_user_creds(&username, &uid, &gid, &home);
1186                         if (err < 0) {
1187                                 r = EXIT_USER;
1188                                 goto fail_child;
1189                         }
1190
1191                         if (is_terminal_input(context->std_input)) {
1192                                 err = chown_terminal(STDIN_FILENO, uid);
1193                                 if (err < 0) {
1194                                         r = EXIT_STDIN;
1195                                         goto fail_child;
1196                                 }
1197                         }
1198
1199                         if (cgroup_bondings && context->control_group_modify) {
1200                                 err = cgroup_bonding_set_group_access_list(cgroup_bondings, 0755, uid, gid);
1201                                 if (err >= 0)
1202                                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, 0644, uid, gid, context->control_group_persistent);
1203                                 if (err < 0) {
1204                                         r = EXIT_CGROUP;
1205                                         goto fail_child;
1206                                 }
1207
1208                                 set_access = true;
1209                         }
1210                 }
1211
1212                 if (cgroup_bondings && !set_access && context->control_group_persistent >= 0)  {
1213                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, (mode_t) -1, (uid_t) -1, (uid_t) -1, context->control_group_persistent);
1214                         if (err < 0) {
1215                                 r = EXIT_CGROUP;
1216                                 goto fail_child;
1217                         }
1218                 }
1219
1220                 if (apply_permissions) {
1221                         err = enforce_groups(context, username, gid);
1222                         if (err < 0) {
1223                                 r = EXIT_GROUP;
1224                                 goto fail_child;
1225                         }
1226                 }
1227
1228                 umask(context->umask);
1229
1230 #ifdef HAVE_PAM
1231                 if (context->pam_name && username) {
1232                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1233                         if (err < 0) {
1234                                 r = EXIT_PAM;
1235                                 goto fail_child;
1236                         }
1237                 }
1238 #endif
1239                 if (context->private_network) {
1240                         if (unshare(CLONE_NEWNET) < 0) {
1241                                 err = -errno;
1242                                 r = EXIT_NETWORK;
1243                                 goto fail_child;
1244                         }
1245
1246                         loopback_setup();
1247                 }
1248
1249                 if (strv_length(context->read_write_dirs) > 0 ||
1250                     strv_length(context->read_only_dirs) > 0 ||
1251                     strv_length(context->inaccessible_dirs) > 0 ||
1252                     context->mount_flags != MS_SHARED ||
1253                     context->private_tmp) {
1254                         err = setup_namespace(context->read_write_dirs,
1255                                               context->read_only_dirs,
1256                                               context->inaccessible_dirs,
1257                                               context->private_tmp,
1258                                               context->mount_flags);
1259                         if (err < 0) {
1260                                 r = EXIT_NAMESPACE;
1261                                 goto fail_child;
1262                         }
1263                 }
1264
1265                 if (apply_chroot) {
1266                         if (context->root_directory)
1267                                 if (chroot(context->root_directory) < 0) {
1268                                         err = -errno;
1269                                         r = EXIT_CHROOT;
1270                                         goto fail_child;
1271                                 }
1272
1273                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1274                                 err = -errno;
1275                                 r = EXIT_CHDIR;
1276                                 goto fail_child;
1277                         }
1278                 } else {
1279
1280                         char *d;
1281
1282                         if (asprintf(&d, "%s/%s",
1283                                      context->root_directory ? context->root_directory : "",
1284                                      context->working_directory ? context->working_directory : "") < 0) {
1285                                 err = -ENOMEM;
1286                                 r = EXIT_MEMORY;
1287                                 goto fail_child;
1288                         }
1289
1290                         if (chdir(d) < 0) {
1291                                 err = -errno;
1292                                 free(d);
1293                                 r = EXIT_CHDIR;
1294                                 goto fail_child;
1295                         }
1296
1297                         free(d);
1298                 }
1299
1300                 /* We repeat the fd closing here, to make sure that
1301                  * nothing is leaked from the PAM modules */
1302                 err = close_all_fds(fds, n_fds);
1303                 if (err >= 0)
1304                         err = shift_fds(fds, n_fds);
1305                 if (err >= 0)
1306                         err = flags_fds(fds, n_fds, context->non_blocking);
1307                 if (err < 0) {
1308                         r = EXIT_FDS;
1309                         goto fail_child;
1310                 }
1311
1312                 if (apply_permissions) {
1313
1314                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1315                                 if (!context->rlimit[i])
1316                                         continue;
1317
1318                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1319                                         err = -errno;
1320                                         r = EXIT_LIMITS;
1321                                         goto fail_child;
1322                                 }
1323                         }
1324
1325                         if (context->capability_bounding_set_drop) {
1326                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1327                                 if (err < 0) {
1328                                         r = EXIT_CAPABILITIES;
1329                                         goto fail_child;
1330                                 }
1331                         }
1332
1333                         if (context->user) {
1334                                 err = enforce_user(context, uid);
1335                                 if (err < 0) {
1336                                         r = EXIT_USER;
1337                                         goto fail_child;
1338                                 }
1339                         }
1340
1341                         /* PR_GET_SECUREBITS is not privileged, while
1342                          * PR_SET_SECUREBITS is. So to suppress
1343                          * potential EPERMs we'll try not to call
1344                          * PR_SET_SECUREBITS unless necessary. */
1345                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1346                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1347                                         err = -errno;
1348                                         r = EXIT_SECUREBITS;
1349                                         goto fail_child;
1350                                 }
1351
1352                         if (context->capabilities)
1353                                 if (cap_set_proc(context->capabilities) < 0) {
1354                                         err = -errno;
1355                                         r = EXIT_CAPABILITIES;
1356                                         goto fail_child;
1357                                 }
1358                 }
1359
1360                 if (!(our_env = new0(char*, 7))) {
1361                         err = -ENOMEM;
1362                         r = EXIT_MEMORY;
1363                         goto fail_child;
1364                 }
1365
1366                 if (n_fds > 0)
1367                         if (asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1368                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0) {
1369                                 err = -ENOMEM;
1370                                 r = EXIT_MEMORY;
1371                                 goto fail_child;
1372                         }
1373
1374                 if (home)
1375                         if (asprintf(our_env + n_env++, "HOME=%s", home) < 0) {
1376                                 err = -ENOMEM;
1377                                 r = EXIT_MEMORY;
1378                                 goto fail_child;
1379                         }
1380
1381                 if (username)
1382                         if (asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1383                             asprintf(our_env + n_env++, "USER=%s", username) < 0) {
1384                                 err = -ENOMEM;
1385                                 r = EXIT_MEMORY;
1386                                 goto fail_child;
1387                         }
1388
1389                 if (is_terminal_input(context->std_input) ||
1390                     context->std_output == EXEC_OUTPUT_TTY ||
1391                     context->std_error == EXEC_OUTPUT_TTY)
1392                         if (!(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))) {
1393                                 err = -ENOMEM;
1394                                 r = EXIT_MEMORY;
1395                                 goto fail_child;
1396                         }
1397
1398                 assert(n_env <= 7);
1399
1400                 if (!(final_env = strv_env_merge(
1401                                       5,
1402                                       environment,
1403                                       our_env,
1404                                       context->environment,
1405                                       files_env,
1406                                       pam_env,
1407                                       NULL))) {
1408                         err = -ENOMEM;
1409                         r = EXIT_MEMORY;
1410                         goto fail_child;
1411                 }
1412
1413                 if (!(final_argv = replace_env_argv(argv, final_env))) {
1414                         err = -ENOMEM;
1415                         r = EXIT_MEMORY;
1416                         goto fail_child;
1417                 }
1418
1419                 final_env = strv_env_clean(final_env);
1420
1421                 execve(command->path, final_argv, final_env);
1422                 err = -errno;
1423                 r = EXIT_EXEC;
1424
1425         fail_child:
1426                 if (r != 0) {
1427                         log_open();
1428                         log_warning("Failed at step %s spawning %s: %s",
1429                                     exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1430                                     command->path, strerror(-err));
1431                 }
1432
1433                 strv_free(our_env);
1434                 strv_free(final_env);
1435                 strv_free(pam_env);
1436                 strv_free(files_env);
1437                 strv_free(final_argv);
1438
1439                 if (saved_stdin >= 0)
1440                         close_nointr_nofail(saved_stdin);
1441
1442                 if (saved_stdout >= 0)
1443                         close_nointr_nofail(saved_stdout);
1444
1445                 _exit(r);
1446         }
1447
1448         strv_free(files_env);
1449
1450         /* We add the new process to the cgroup both in the child (so
1451          * that we can be sure that no user code is ever executed
1452          * outside of the cgroup) and in the parent (so that we can be
1453          * sure that when we kill the cgroup the process will be
1454          * killed too). */
1455         if (cgroup_bondings)
1456                 cgroup_bonding_install_list(cgroup_bondings, pid, cgroup_suffix);
1457
1458         log_debug("Forked %s as %lu", command->path, (unsigned long) pid);
1459
1460         exec_status_start(&command->exec_status, pid);
1461
1462         *ret = pid;
1463         return 0;
1464
1465 fail_parent:
1466         strv_free(files_env);
1467
1468         return r;
1469 }
1470
1471 void exec_context_init(ExecContext *c) {
1472         assert(c);
1473
1474         c->umask = 0022;
1475         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1476         c->cpu_sched_policy = SCHED_OTHER;
1477         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1478         c->syslog_level_prefix = true;
1479         c->mount_flags = MS_SHARED;
1480         c->kill_signal = SIGTERM;
1481         c->send_sigkill = true;
1482         c->control_group_persistent = -1;
1483         c->ignore_sigpipe = true;
1484         c->timer_slack_nsec = (nsec_t) -1;
1485 }
1486
1487 void exec_context_done(ExecContext *c) {
1488         unsigned l;
1489
1490         assert(c);
1491
1492         strv_free(c->environment);
1493         c->environment = NULL;
1494
1495         strv_free(c->environment_files);
1496         c->environment_files = NULL;
1497
1498         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1499                 free(c->rlimit[l]);
1500                 c->rlimit[l] = NULL;
1501         }
1502
1503         free(c->working_directory);
1504         c->working_directory = NULL;
1505         free(c->root_directory);
1506         c->root_directory = NULL;
1507
1508         free(c->tty_path);
1509         c->tty_path = NULL;
1510
1511         free(c->tcpwrap_name);
1512         c->tcpwrap_name = NULL;
1513
1514         free(c->syslog_identifier);
1515         c->syslog_identifier = NULL;
1516
1517         free(c->user);
1518         c->user = NULL;
1519
1520         free(c->group);
1521         c->group = NULL;
1522
1523         strv_free(c->supplementary_groups);
1524         c->supplementary_groups = NULL;
1525
1526         free(c->pam_name);
1527         c->pam_name = NULL;
1528
1529         if (c->capabilities) {
1530                 cap_free(c->capabilities);
1531                 c->capabilities = NULL;
1532         }
1533
1534         strv_free(c->read_only_dirs);
1535         c->read_only_dirs = NULL;
1536
1537         strv_free(c->read_write_dirs);
1538         c->read_write_dirs = NULL;
1539
1540         strv_free(c->inaccessible_dirs);
1541         c->inaccessible_dirs = NULL;
1542
1543         if (c->cpuset)
1544                 CPU_FREE(c->cpuset);
1545
1546         free(c->utmp_id);
1547         c->utmp_id = NULL;
1548 }
1549
1550 void exec_command_done(ExecCommand *c) {
1551         assert(c);
1552
1553         free(c->path);
1554         c->path = NULL;
1555
1556         strv_free(c->argv);
1557         c->argv = NULL;
1558 }
1559
1560 void exec_command_done_array(ExecCommand *c, unsigned n) {
1561         unsigned i;
1562
1563         for (i = 0; i < n; i++)
1564                 exec_command_done(c+i);
1565 }
1566
1567 void exec_command_free_list(ExecCommand *c) {
1568         ExecCommand *i;
1569
1570         while ((i = c)) {
1571                 LIST_REMOVE(ExecCommand, command, c, i);
1572                 exec_command_done(i);
1573                 free(i);
1574         }
1575 }
1576
1577 void exec_command_free_array(ExecCommand **c, unsigned n) {
1578         unsigned i;
1579
1580         for (i = 0; i < n; i++) {
1581                 exec_command_free_list(c[i]);
1582                 c[i] = NULL;
1583         }
1584 }
1585
1586 int exec_context_load_environment(const ExecContext *c, char ***l) {
1587         char **i, **r = NULL;
1588
1589         assert(c);
1590         assert(l);
1591
1592         STRV_FOREACH(i, c->environment_files) {
1593                 char *fn;
1594                 int k;
1595                 bool ignore = false;
1596                 char **p;
1597
1598                 fn = *i;
1599
1600                 if (fn[0] == '-') {
1601                         ignore = true;
1602                         fn ++;
1603                 }
1604
1605                 if (!path_is_absolute(fn)) {
1606
1607                         if (ignore)
1608                                 continue;
1609
1610                         strv_free(r);
1611                         return -EINVAL;
1612                 }
1613
1614                 if ((k = load_env_file(fn, &p)) < 0) {
1615
1616                         if (ignore)
1617                                 continue;
1618
1619                         strv_free(r);
1620                         return k;
1621                 }
1622
1623                 if (r == NULL)
1624                         r = p;
1625                 else {
1626                         char **m;
1627
1628                         m = strv_env_merge(2, r, p);
1629                         strv_free(r);
1630                         strv_free(p);
1631
1632                         if (!m)
1633                                 return -ENOMEM;
1634
1635                         r = m;
1636                 }
1637         }
1638
1639         *l = r;
1640
1641         return 0;
1642 }
1643
1644 static void strv_fprintf(FILE *f, char **l) {
1645         char **g;
1646
1647         assert(f);
1648
1649         STRV_FOREACH(g, l)
1650                 fprintf(f, " %s", *g);
1651 }
1652
1653 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1654         char ** e;
1655         unsigned i;
1656
1657         assert(c);
1658         assert(f);
1659
1660         if (!prefix)
1661                 prefix = "";
1662
1663         fprintf(f,
1664                 "%sUMask: %04o\n"
1665                 "%sWorkingDirectory: %s\n"
1666                 "%sRootDirectory: %s\n"
1667                 "%sNonBlocking: %s\n"
1668                 "%sPrivateTmp: %s\n"
1669                 "%sControlGroupModify: %s\n"
1670                 "%sControlGroupPersistent: %s\n"
1671                 "%sPrivateNetwork: %s\n",
1672                 prefix, c->umask,
1673                 prefix, c->working_directory ? c->working_directory : "/",
1674                 prefix, c->root_directory ? c->root_directory : "/",
1675                 prefix, yes_no(c->non_blocking),
1676                 prefix, yes_no(c->private_tmp),
1677                 prefix, yes_no(c->control_group_modify),
1678                 prefix, yes_no(c->control_group_persistent),
1679                 prefix, yes_no(c->private_network));
1680
1681         STRV_FOREACH(e, c->environment)
1682                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1683
1684         STRV_FOREACH(e, c->environment_files)
1685                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1686
1687         if (c->tcpwrap_name)
1688                 fprintf(f,
1689                         "%sTCPWrapName: %s\n",
1690                         prefix, c->tcpwrap_name);
1691
1692         if (c->nice_set)
1693                 fprintf(f,
1694                         "%sNice: %i\n",
1695                         prefix, c->nice);
1696
1697         if (c->oom_score_adjust_set)
1698                 fprintf(f,
1699                         "%sOOMScoreAdjust: %i\n",
1700                         prefix, c->oom_score_adjust);
1701
1702         for (i = 0; i < RLIM_NLIMITS; i++)
1703                 if (c->rlimit[i])
1704                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1705
1706         if (c->ioprio_set)
1707                 fprintf(f,
1708                         "%sIOSchedulingClass: %s\n"
1709                         "%sIOPriority: %i\n",
1710                         prefix, ioprio_class_to_string(IOPRIO_PRIO_CLASS(c->ioprio)),
1711                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1712
1713         if (c->cpu_sched_set)
1714                 fprintf(f,
1715                         "%sCPUSchedulingPolicy: %s\n"
1716                         "%sCPUSchedulingPriority: %i\n"
1717                         "%sCPUSchedulingResetOnFork: %s\n",
1718                         prefix, sched_policy_to_string(c->cpu_sched_policy),
1719                         prefix, c->cpu_sched_priority,
1720                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1721
1722         if (c->cpuset) {
1723                 fprintf(f, "%sCPUAffinity:", prefix);
1724                 for (i = 0; i < c->cpuset_ncpus; i++)
1725                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1726                                 fprintf(f, " %i", i);
1727                 fputs("\n", f);
1728         }
1729
1730         if (c->timer_slack_nsec != (nsec_t) -1)
1731                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, (unsigned long)c->timer_slack_nsec);
1732
1733         fprintf(f,
1734                 "%sStandardInput: %s\n"
1735                 "%sStandardOutput: %s\n"
1736                 "%sStandardError: %s\n",
1737                 prefix, exec_input_to_string(c->std_input),
1738                 prefix, exec_output_to_string(c->std_output),
1739                 prefix, exec_output_to_string(c->std_error));
1740
1741         if (c->tty_path)
1742                 fprintf(f,
1743                         "%sTTYPath: %s\n"
1744                         "%sTTYReset: %s\n"
1745                         "%sTTYVHangup: %s\n"
1746                         "%sTTYVTDisallocate: %s\n",
1747                         prefix, c->tty_path,
1748                         prefix, yes_no(c->tty_reset),
1749                         prefix, yes_no(c->tty_vhangup),
1750                         prefix, yes_no(c->tty_vt_disallocate));
1751
1752         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1753             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1754             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1755             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE)
1756                 fprintf(f,
1757                         "%sSyslogFacility: %s\n"
1758                         "%sSyslogLevel: %s\n",
1759                         prefix, log_facility_unshifted_to_string(c->syslog_priority >> 3),
1760                         prefix, log_level_to_string(LOG_PRI(c->syslog_priority)));
1761
1762         if (c->capabilities) {
1763                 char *t;
1764                 if ((t = cap_to_text(c->capabilities, NULL))) {
1765                         fprintf(f, "%sCapabilities: %s\n",
1766                                 prefix, t);
1767                         cap_free(t);
1768                 }
1769         }
1770
1771         if (c->secure_bits)
1772                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1773                         prefix,
1774                         (c->secure_bits & SECURE_KEEP_CAPS) ? " keep-caps" : "",
1775                         (c->secure_bits & SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1776                         (c->secure_bits & SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1777                         (c->secure_bits & SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1778                         (c->secure_bits & SECURE_NOROOT) ? " noroot" : "",
1779                         (c->secure_bits & SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1780
1781         if (c->capability_bounding_set_drop) {
1782                 unsigned long l;
1783                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1784
1785                 for (l = 0; l <= cap_last_cap(); l++)
1786                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1787                                 char *t;
1788
1789                                 if ((t = cap_to_name(l))) {
1790                                         fprintf(f, " %s", t);
1791                                         cap_free(t);
1792                                 }
1793                         }
1794
1795                 fputs("\n", f);
1796         }
1797
1798         if (c->user)
1799                 fprintf(f, "%sUser: %s\n", prefix, c->user);
1800         if (c->group)
1801                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
1802
1803         if (strv_length(c->supplementary_groups) > 0) {
1804                 fprintf(f, "%sSupplementaryGroups:", prefix);
1805                 strv_fprintf(f, c->supplementary_groups);
1806                 fputs("\n", f);
1807         }
1808
1809         if (c->pam_name)
1810                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
1811
1812         if (strv_length(c->read_write_dirs) > 0) {
1813                 fprintf(f, "%sReadWriteDirs:", prefix);
1814                 strv_fprintf(f, c->read_write_dirs);
1815                 fputs("\n", f);
1816         }
1817
1818         if (strv_length(c->read_only_dirs) > 0) {
1819                 fprintf(f, "%sReadOnlyDirs:", prefix);
1820                 strv_fprintf(f, c->read_only_dirs);
1821                 fputs("\n", f);
1822         }
1823
1824         if (strv_length(c->inaccessible_dirs) > 0) {
1825                 fprintf(f, "%sInaccessibleDirs:", prefix);
1826                 strv_fprintf(f, c->inaccessible_dirs);
1827                 fputs("\n", f);
1828         }
1829
1830         fprintf(f,
1831                 "%sKillMode: %s\n"
1832                 "%sKillSignal: SIG%s\n"
1833                 "%sSendSIGKILL: %s\n"
1834                 "%sIgnoreSIGPIPE: %s\n",
1835                 prefix, kill_mode_to_string(c->kill_mode),
1836                 prefix, signal_to_string(c->kill_signal),
1837                 prefix, yes_no(c->send_sigkill),
1838                 prefix, yes_no(c->ignore_sigpipe));
1839
1840         if (c->utmp_id)
1841                 fprintf(f,
1842                         "%sUtmpIdentifier: %s\n",
1843                         prefix, c->utmp_id);
1844 }
1845
1846 void exec_status_start(ExecStatus *s, pid_t pid) {
1847         assert(s);
1848
1849         zero(*s);
1850         s->pid = pid;
1851         dual_timestamp_get(&s->start_timestamp);
1852 }
1853
1854 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
1855         assert(s);
1856
1857         if (s->pid && s->pid != pid)
1858                 zero(*s);
1859
1860         s->pid = pid;
1861         dual_timestamp_get(&s->exit_timestamp);
1862
1863         s->code = code;
1864         s->status = status;
1865
1866         if (context) {
1867                 if (context->utmp_id)
1868                         utmp_put_dead_process(context->utmp_id, pid, code, status);
1869
1870                 exec_context_tty_reset(context);
1871         }
1872 }
1873
1874 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
1875         char buf[FORMAT_TIMESTAMP_MAX];
1876
1877         assert(s);
1878         assert(f);
1879
1880         if (!prefix)
1881                 prefix = "";
1882
1883         if (s->pid <= 0)
1884                 return;
1885
1886         fprintf(f,
1887                 "%sPID: %lu\n",
1888                 prefix, (unsigned long) s->pid);
1889
1890         if (s->start_timestamp.realtime > 0)
1891                 fprintf(f,
1892                         "%sStart Timestamp: %s\n",
1893                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
1894
1895         if (s->exit_timestamp.realtime > 0)
1896                 fprintf(f,
1897                         "%sExit Timestamp: %s\n"
1898                         "%sExit Code: %s\n"
1899                         "%sExit Status: %i\n",
1900                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
1901                         prefix, sigchld_code_to_string(s->code),
1902                         prefix, s->status);
1903 }
1904
1905 char *exec_command_line(char **argv) {
1906         size_t k;
1907         char *n, *p, **a;
1908         bool first = true;
1909
1910         assert(argv);
1911
1912         k = 1;
1913         STRV_FOREACH(a, argv)
1914                 k += strlen(*a)+3;
1915
1916         if (!(n = new(char, k)))
1917                 return NULL;
1918
1919         p = n;
1920         STRV_FOREACH(a, argv) {
1921
1922                 if (!first)
1923                         *(p++) = ' ';
1924                 else
1925                         first = false;
1926
1927                 if (strpbrk(*a, WHITESPACE)) {
1928                         *(p++) = '\'';
1929                         p = stpcpy(p, *a);
1930                         *(p++) = '\'';
1931                 } else
1932                         p = stpcpy(p, *a);
1933
1934         }
1935
1936         *p = 0;
1937
1938         /* FIXME: this doesn't really handle arguments that have
1939          * spaces and ticks in them */
1940
1941         return n;
1942 }
1943
1944 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
1945         char *p2;
1946         const char *prefix2;
1947
1948         char *cmd;
1949
1950         assert(c);
1951         assert(f);
1952
1953         if (!prefix)
1954                 prefix = "";
1955         p2 = strappend(prefix, "\t");
1956         prefix2 = p2 ? p2 : prefix;
1957
1958         cmd = exec_command_line(c->argv);
1959
1960         fprintf(f,
1961                 "%sCommand Line: %s\n",
1962                 prefix, cmd ? cmd : strerror(ENOMEM));
1963
1964         free(cmd);
1965
1966         exec_status_dump(&c->exec_status, f, prefix2);
1967
1968         free(p2);
1969 }
1970
1971 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
1972         assert(f);
1973
1974         if (!prefix)
1975                 prefix = "";
1976
1977         LIST_FOREACH(command, c, c)
1978                 exec_command_dump(c, f, prefix);
1979 }
1980
1981 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
1982         ExecCommand *end;
1983
1984         assert(l);
1985         assert(e);
1986
1987         if (*l) {
1988                 /* It's kind of important, that we keep the order here */
1989                 LIST_FIND_TAIL(ExecCommand, command, *l, end);
1990                 LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
1991         } else
1992               *l = e;
1993 }
1994
1995 int exec_command_set(ExecCommand *c, const char *path, ...) {
1996         va_list ap;
1997         char **l, *p;
1998
1999         assert(c);
2000         assert(path);
2001
2002         va_start(ap, path);
2003         l = strv_new_ap(path, ap);
2004         va_end(ap);
2005
2006         if (!l)
2007                 return -ENOMEM;
2008
2009         if (!(p = strdup(path))) {
2010                 strv_free(l);
2011                 return -ENOMEM;
2012         }
2013
2014         free(c->path);
2015         c->path = p;
2016
2017         strv_free(c->argv);
2018         c->argv = l;
2019
2020         return 0;
2021 }
2022
2023 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2024         [EXEC_INPUT_NULL] = "null",
2025         [EXEC_INPUT_TTY] = "tty",
2026         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2027         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2028         [EXEC_INPUT_SOCKET] = "socket"
2029 };
2030
2031 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2032
2033 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2034         [EXEC_OUTPUT_INHERIT] = "inherit",
2035         [EXEC_OUTPUT_NULL] = "null",
2036         [EXEC_OUTPUT_TTY] = "tty",
2037         [EXEC_OUTPUT_SYSLOG] = "syslog",
2038         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2039         [EXEC_OUTPUT_KMSG] = "kmsg",
2040         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2041         [EXEC_OUTPUT_JOURNAL] = "journal",
2042         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2043         [EXEC_OUTPUT_SOCKET] = "socket"
2044 };
2045
2046 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
2047
2048 static const char* const kill_mode_table[_KILL_MODE_MAX] = {
2049         [KILL_CONTROL_GROUP] = "control-group",
2050         [KILL_PROCESS] = "process",
2051         [KILL_NONE] = "none"
2052 };
2053
2054 DEFINE_STRING_TABLE_LOOKUP(kill_mode, KillMode);
2055
2056 static const char* const kill_who_table[_KILL_WHO_MAX] = {
2057         [KILL_MAIN] = "main",
2058         [KILL_CONTROL] = "control",
2059         [KILL_ALL] = "all"
2060 };
2061
2062 DEFINE_STRING_TABLE_LOOKUP(kill_who, KillWho);