src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <linux/seccomp-bpf.h>
  42 #include <glob.h>
  43 #include <libgen.h>
  44
  45 #ifdef HAVE_PAM
  46 #include <security/pam_appl.h>
  47 #endif
  48
  49 #include "execute.h"
  50 #include "strv.h"
  51 #include "macro.h"
  52 #include "capability.h"
  53 #include "util.h"
  54 #include "log.h"
  55 #include "sd-messages.h"
  56 #include "ioprio.h"
  57 #include "securebits.h"
  58 #include "cgroup.h"
  59 #include "namespace.h"
  60 #include "tcpwrap.h"
  61 #include "exit-status.h"
  62 #include "missing.h"
  63 #include "utmp-wtmp.h"
  64 #include "def.h"
  65 #include "loopback-setup.h"
  66 #include "path-util.h"
  67 #include "syscall-list.h"
  68 #include "env-util.h"
  69 #include "fileio.h"
  70
  71 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  72
  73 /* This assumes there is a 'tty' group */
  74 #define TTY_MODE 0620
  75
  76 static int shift_fds(int fds[], unsigned n_fds) {
  77         int start, restart_from;
  78
  79         if (n_fds <= 0)
  80                 return 0;
  81
  82         /* Modifies the fds array! (sorts it) */
  83
  84         assert(fds);
  85
  86         start = 0;
  87         for (;;) {
  88                 int i;
  89
  90                 restart_from = -1;
  91
  92                 for (i = start; i < (int) n_fds; i++) {
  93                         int nfd;
  94
  95                         /* Already at right index? */
  96                         if (fds[i] == i+3)
  97                                 continue;
  98
  99                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
 100                                 return -errno;
 101
 102                         close_nointr_nofail(fds[i]);
 103                         fds[i] = nfd;
 104
 105                         /* Hmm, the fd we wanted isn't free? Then
 106                          * let's remember that and try again from here*/
 107                         if (nfd != i+3 && restart_from < 0)
 108                                 restart_from = i;
 109                 }
 110
 111                 if (restart_from < 0)
 112                         break;
 113
 114                 start = restart_from;
 115         }
 116
 117         return 0;
 118 }
 119
 120 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 121         unsigned i;
 122         int r;
 123
 124         if (n_fds <= 0)
 125                 return 0;
 126
 127         assert(fds);
 128
 129         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 130
 131         for (i = 0; i < n_fds; i++) {
 132
 133                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 134                         return r;
 135
 136                 /* We unconditionally drop FD_CLOEXEC from the fds,
 137                  * since after all we want to pass these fds to our
 138                  * children */
 139
 140                 if ((r = fd_cloexec(fds[i], false)) < 0)
 141                         return r;
 142         }
 143
 144         return 0;
 145 }
 146
 147 static const char *tty_path(const ExecContext *context) {
 148         assert(context);
 149
 150         if (context->tty_path)
 151                 return context->tty_path;
 152
 153         return "/dev/console";
 154 }
 155
 156 void exec_context_tty_reset(const ExecContext *context) {
 157         assert(context);
 158
 159         if (context->tty_vhangup)
 160                 terminal_vhangup(tty_path(context));
 161
 162         if (context->tty_reset)
 163                 reset_terminal(tty_path(context));
 164
 165         if (context->tty_vt_disallocate && context->tty_path)
 166                 vt_disallocate(context->tty_path);
 167 }
 168
 169 static bool is_terminal_output(ExecOutput o) {
 170         return
 171                 o == EXEC_OUTPUT_TTY ||
 172                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 173                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 174                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 175 }
 176
 177 void exec_context_serialize(const ExecContext *context, Unit *u, FILE *f) {
 178         assert(context);
 179         assert(u);
 180         assert(f);
 181
 182         if (context->tmp_dir)
 183                 unit_serialize_item(u, f, "tmp-dir", context->tmp_dir);
 184
 185         if (context->var_tmp_dir)
 186                 unit_serialize_item(u, f, "var-tmp-dir", context->var_tmp_dir);
 187 }
 188
 189 static int open_null_as(int flags, int nfd) {
 190         int fd, r;
 191
 192         assert(nfd >= 0);
 193
 194         if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
 195                 return -errno;
 196
 197         if (fd != nfd) {
 198                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 199                 close_nointr_nofail(fd);
 200         } else
 201                 r = nfd;
 202
 203         return r;
 204 }
 205
 206 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 207         int fd, r;
 208         union sockaddr_union sa;
 209
 210         assert(context);
 211         assert(output < _EXEC_OUTPUT_MAX);
 212         assert(ident);
 213         assert(nfd >= 0);
 214
 215         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 216         if (fd < 0)
 217                 return -errno;
 218
 219         zero(sa);
 220         sa.un.sun_family = AF_UNIX;
 221         strncpy(sa.un.sun_path, "/run/systemd/journal/stdout", sizeof(sa.un.sun_path));
 222
 223         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 224         if (r < 0) {
 225                 close_nointr_nofail(fd);
 226                 return -errno;
 227         }
 228
 229         if (shutdown(fd, SHUT_RD) < 0) {
 230                 close_nointr_nofail(fd);
 231                 return -errno;
 232         }
 233
 234         dprintf(fd,
 235                 "%s\n"
 236                 "%s\n"
 237                 "%i\n"
 238                 "%i\n"
 239                 "%i\n"
 240                 "%i\n"
 241                 "%i\n",
 242                 context->syslog_identifier ? context->syslog_identifier : ident,
 243                 unit_id,
 244                 context->syslog_priority,
 245                 !!context->syslog_level_prefix,
 246                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 247                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 248                 is_terminal_output(output));
 249
 250         if (fd != nfd) {
 251                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 252                 close_nointr_nofail(fd);
 253         } else
 254                 r = nfd;
 255
 256         return r;
 257 }
 258 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 259         int fd, r;
 260
 261         assert(path);
 262         assert(nfd >= 0);
 263
 264         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 265                 return fd;
 266
 267         if (fd != nfd) {
 268                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 269                 close_nointr_nofail(fd);
 270         } else
 271                 r = nfd;
 272
 273         return r;
 274 }
 275
 276 static bool is_terminal_input(ExecInput i) {
 277         return
 278                 i == EXEC_INPUT_TTY ||
 279                 i == EXEC_INPUT_TTY_FORCE ||
 280                 i == EXEC_INPUT_TTY_FAIL;
 281 }
 282
 283 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 284
 285         if (is_terminal_input(std_input) && !apply_tty_stdin)
 286                 return EXEC_INPUT_NULL;
 287
 288         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 289                 return EXEC_INPUT_NULL;
 290
 291         return std_input;
 292 }
 293
 294 static int fixup_output(ExecOutput std_output, int socket_fd) {
 295
 296         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 297                 return EXEC_OUTPUT_INHERIT;
 298
 299         return std_output;
 300 }
 301
 302 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 303         ExecInput i;
 304
 305         assert(context);
 306
 307         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 308
 309         switch (i) {
 310
 311         case EXEC_INPUT_NULL:
 312                 return open_null_as(O_RDONLY, STDIN_FILENO);
 313
 314         case EXEC_INPUT_TTY:
 315         case EXEC_INPUT_TTY_FORCE:
 316         case EXEC_INPUT_TTY_FAIL: {
 317                 int fd, r;
 318
 319                 if ((fd = acquire_terminal(
 320                                      tty_path(context),
 321                                      i == EXEC_INPUT_TTY_FAIL,
 322                                      i == EXEC_INPUT_TTY_FORCE,
 323                                      false,
 324                                      (usec_t) -1)) < 0)
 325                         return fd;
 326
 327                 if (fd != STDIN_FILENO) {
 328                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 329                         close_nointr_nofail(fd);
 330                 } else
 331                         r = STDIN_FILENO;
 332
 333                 return r;
 334         }
 335
 336         case EXEC_INPUT_SOCKET:
 337                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 338
 339         default:
 340                 assert_not_reached("Unknown input type");
 341         }
 342 }
 343
 344 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 345         ExecOutput o;
 346         ExecInput i;
 347         int r;
 348
 349         assert(context);
 350         assert(ident);
 351
 352         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 353         o = fixup_output(context->std_output, socket_fd);
 354
 355         if (fileno == STDERR_FILENO) {
 356                 ExecOutput e;
 357                 e = fixup_output(context->std_error, socket_fd);
 358
 359                 /* This expects the input and output are already set up */
 360
 361                 /* Don't change the stderr file descriptor if we inherit all
 362                  * the way and are not on a tty */
 363                 if (e == EXEC_OUTPUT_INHERIT &&
 364                     o == EXEC_OUTPUT_INHERIT &&
 365                     i == EXEC_INPUT_NULL &&
 366                     !is_terminal_input(context->std_input) &&
 367                     getppid () != 1)
 368                         return fileno;
 369
 370                 /* Duplicate from stdout if possible */
 371                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 372                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 373
 374                 o = e;
 375
 376         } else if (o == EXEC_OUTPUT_INHERIT) {
 377                 /* If input got downgraded, inherit the original value */
 378                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 379                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 380
 381                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 382                 if (i != EXEC_INPUT_NULL)
 383                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 384
 385                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 386                 if (getppid() != 1)
 387                         return fileno;
 388
 389                 /* We need to open /dev/null here anew, to get the right access mode. */
 390                 return open_null_as(O_WRONLY, fileno);
 391         }
 392
 393         switch (o) {
 394
 395         case EXEC_OUTPUT_NULL:
 396                 return open_null_as(O_WRONLY, fileno);
 397
 398         case EXEC_OUTPUT_TTY:
 399                 if (is_terminal_input(i))
 400                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 401
 402                 /* We don't reset the terminal if this is just about output */
 403                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 404
 405         case EXEC_OUTPUT_SYSLOG:
 406         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 407         case EXEC_OUTPUT_KMSG:
 408         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 409         case EXEC_OUTPUT_JOURNAL:
 410         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 411                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 412                 if (r < 0) {
 413                         log_struct_unit(LOG_CRIT, unit_id,
 414                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 415                                 fileno == STDOUT_FILENO ? "out" : "err",
 416                                 unit_id, strerror(-r),
 417                                 "ERRNO=%d", -r,
 418                                 NULL);
 419                         r = open_null_as(O_WRONLY, fileno);
 420                 }
 421                 return r;
 422
 423         case EXEC_OUTPUT_SOCKET:
 424                 assert(socket_fd >= 0);
 425                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 426
 427         default:
 428                 assert_not_reached("Unknown error type");
 429         }
 430 }
 431
 432 static int chown_terminal(int fd, uid_t uid) {
 433         struct stat st;
 434
 435         assert(fd >= 0);
 436
 437         /* This might fail. What matters are the results. */
 438         (void) fchown(fd, uid, -1);
 439         (void) fchmod(fd, TTY_MODE);
 440
 441         if (fstat(fd, &st) < 0)
 442                 return -errno;
 443
 444         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 445                 return -EPERM;
 446
 447         return 0;
 448 }
 449
 450 static int setup_confirm_stdio(int *_saved_stdin,
 451                                int *_saved_stdout) {
 452         int fd = -1, saved_stdin, saved_stdout = -1, r;
 453
 454         assert(_saved_stdin);
 455         assert(_saved_stdout);
 456
 457         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 458         if (saved_stdin < 0)
 459                 return -errno;
 460
 461         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 462         if (saved_stdout < 0) {
 463                 r = errno;
 464                 goto fail;
 465         }
 466
 467         fd = acquire_terminal(
 468                         "/dev/console",
 469                         false,
 470                         false,
 471                         false,
 472                         DEFAULT_CONFIRM_USEC);
 473         if (fd < 0) {
 474                 r = fd;
 475                 goto fail;
 476         }
 477
 478         r = chown_terminal(fd, getuid());
 479         if (r < 0)
 480                 goto fail;
 481
 482         if (dup2(fd, STDIN_FILENO) < 0) {
 483                 r = -errno;
 484                 goto fail;
 485         }
 486
 487         if (dup2(fd, STDOUT_FILENO) < 0) {
 488                 r = -errno;
 489                 goto fail;
 490         }
 491
 492         if (fd >= 2)
 493                 close_nointr_nofail(fd);
 494
 495         *_saved_stdin = saved_stdin;
 496         *_saved_stdout = saved_stdout;
 497
 498         return 0;
 499
 500 fail:
 501         if (saved_stdout >= 0)
 502                 close_nointr_nofail(saved_stdout);
 503
 504         if (saved_stdin >= 0)
 505                 close_nointr_nofail(saved_stdin);
 506
 507         if (fd >= 0)
 508                 close_nointr_nofail(fd);
 509
 510         return r;
 511 }
 512
 513 static int write_confirm_message(const char *format, ...) {
 514         int fd;
 515         va_list ap;
 516
 517         assert(format);
 518
 519         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 520         if (fd < 0)
 521                 return fd;
 522
 523         va_start(ap, format);
 524         vdprintf(fd, format, ap);
 525         va_end(ap);
 526
 527         close_nointr_nofail(fd);
 528
 529         return 0;
 530 }
 531
 532 static int restore_confirm_stdio(int *saved_stdin,
 533                                  int *saved_stdout) {
 534
 535         int r = 0;
 536
 537         assert(saved_stdin);
 538         assert(saved_stdout);
 539
 540         release_terminal();
 541
 542         if (*saved_stdin >= 0)
 543                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 544                         r = -errno;
 545
 546         if (*saved_stdout >= 0)
 547                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 548                         r = -errno;
 549
 550         if (*saved_stdin >= 0)
 551                 close_nointr_nofail(*saved_stdin);
 552
 553         if (*saved_stdout >= 0)
 554                 close_nointr_nofail(*saved_stdout);
 555
 556         return r;
 557 }
 558
 559 static int ask_for_confirmation(char *response, char **argv) {
 560         int saved_stdout = -1, saved_stdin = -1, r;
 561         char *line;
 562
 563         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 564         if (r < 0)
 565                 return r;
 566
 567         line = exec_command_line(argv);
 568         if (!line)
 569                 return -ENOMEM;
 570
 571         r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 572         free(line);
 573
 574         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 575
 576         return r;
 577 }
 578
 579 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 580         bool keep_groups = false;
 581         int r;
 582
 583         assert(context);
 584
 585         /* Lookup and set GID and supplementary group list. Here too
 586          * we avoid NSS lookups for gid=0. */
 587
 588         if (context->group || username) {
 589
 590                 if (context->group) {
 591                         const char *g = context->group;
 592
 593                         if ((r = get_group_creds(&g, &gid)) < 0)
 594                                 return r;
 595                 }
 596
 597                 /* First step, initialize groups from /etc/groups */
 598                 if (username && gid != 0) {
 599                         if (initgroups(username, gid) < 0)
 600                                 return -errno;
 601
 602                         keep_groups = true;
 603                 }
 604
 605                 /* Second step, set our gids */
 606                 if (setresgid(gid, gid, gid) < 0)
 607                         return -errno;
 608         }
 609
 610         if (context->supplementary_groups) {
 611                 int ngroups_max, k;
 612                 gid_t *gids;
 613                 char **i;
 614
 615                 /* Final step, initialize any manually set supplementary groups */
 616                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 617
 618                 if (!(gids = new(gid_t, ngroups_max)))
 619                         return -ENOMEM;
 620
 621                 if (keep_groups) {
 622                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 623                                 free(gids);
 624                                 return -errno;
 625                         }
 626                 } else
 627                         k = 0;
 628
 629                 STRV_FOREACH(i, context->supplementary_groups) {
 630                         const char *g;
 631
 632                         if (k >= ngroups_max) {
 633                                 free(gids);
 634                                 return -E2BIG;
 635                         }
 636
 637                         g = *i;
 638                         r = get_group_creds(&g, gids+k);
 639                         if (r < 0) {
 640                                 free(gids);
 641                                 return r;
 642                         }
 643
 644                         k++;
 645                 }
 646
 647                 if (setgroups(k, gids) < 0) {
 648                         free(gids);
 649                         return -errno;
 650                 }
 651
 652                 free(gids);
 653         }
 654
 655         return 0;
 656 }
 657
 658 static int enforce_user(const ExecContext *context, uid_t uid) {
 659         int r;
 660         assert(context);
 661
 662         /* Sets (but doesn't lookup) the uid and make sure we keep the
 663          * capabilities while doing so. */
 664
 665         if (context->capabilities) {
 666                 cap_t d;
 667                 static const cap_value_t bits[] = {
 668                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 669                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 670                 };
 671
 672                 /* First step: If we need to keep capabilities but
 673                  * drop privileges we need to make sure we keep our
 674                  * caps, whiel we drop privileges. */
 675                 if (uid != 0) {
 676                         int sb = context->secure_bits|SECURE_KEEP_CAPS;
 677
 678                         if (prctl(PR_GET_SECUREBITS) != sb)
 679                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 680                                         return -errno;
 681                 }
 682
 683                 /* Second step: set the capabilities. This will reduce
 684                  * the capabilities to the minimum we need. */
 685
 686                 if (!(d = cap_dup(context->capabilities)))
 687                         return -errno;
 688
 689                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 690                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 691                         r = -errno;
 692                         cap_free(d);
 693                         return r;
 694                 }
 695
 696                 if (cap_set_proc(d) < 0) {
 697                         r = -errno;
 698                         cap_free(d);
 699                         return r;
 700                 }
 701
 702                 cap_free(d);
 703         }
 704
 705         /* Third step: actually set the uids */
 706         if (setresuid(uid, uid, uid) < 0)
 707                 return -errno;
 708
 709         /* At this point we should have all necessary capabilities but
 710            are otherwise a normal user. However, the caps might got
 711            corrupted due to the setresuid() so we need clean them up
 712            later. This is done outside of this call. */
 713
 714         return 0;
 715 }
 716
 717 #ifdef HAVE_PAM
 718
 719 static int null_conv(
 720                 int num_msg,
 721                 const struct pam_message **msg,
 722                 struct pam_response **resp,
 723                 void *appdata_ptr) {
 724
 725         /* We don't support conversations */
 726
 727         return PAM_CONV_ERR;
 728 }
 729
 730 static int setup_pam(
 731                 const char *name,
 732                 const char *user,
 733                 uid_t uid,
 734                 const char *tty,
 735                 char ***pam_env,
 736                 int fds[], unsigned n_fds) {
 737
 738         static const struct pam_conv conv = {
 739                 .conv = null_conv,
 740                 .appdata_ptr = NULL
 741         };
 742
 743         pam_handle_t *handle = NULL;
 744         sigset_t ss, old_ss;
 745         int pam_code = PAM_SUCCESS;
 746         int err;
 747         char **e = NULL;
 748         bool close_session = false;
 749         pid_t pam_pid = 0, parent_pid;
 750
 751         assert(name);
 752         assert(user);
 753         assert(pam_env);
 754
 755         /* We set up PAM in the parent process, then fork. The child
 756          * will then stay around until killed via PR_GET_PDEATHSIG or
 757          * systemd via the cgroup logic. It will then remove the PAM
 758          * session again. The parent process will exec() the actual
 759          * daemon. We do things this way to ensure that the main PID
 760          * of the daemon is the one we initially fork()ed. */
 761
 762         if ((pam_code = pam_start(name, user, &conv, &handle)) != PAM_SUCCESS) {
 763                 handle = NULL;
 764                 goto fail;
 765         }
 766
 767         if (tty)
 768                 if ((pam_code = pam_set_item(handle, PAM_TTY, tty)) != PAM_SUCCESS)
 769                         goto fail;
 770
 771         if ((pam_code = pam_acct_mgmt(handle, PAM_SILENT)) != PAM_SUCCESS)
 772                 goto fail;
 773
 774         if ((pam_code = pam_open_session(handle, PAM_SILENT)) != PAM_SUCCESS)
 775                 goto fail;
 776
 777         close_session = true;
 778
 779         if ((!(e = pam_getenvlist(handle)))) {
 780                 pam_code = PAM_BUF_ERR;
 781                 goto fail;
 782         }
 783
 784         /* Block SIGTERM, so that we know that it won't get lost in
 785          * the child */
 786         if (sigemptyset(&ss) < 0 ||
 787             sigaddset(&ss, SIGTERM) < 0 ||
 788             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 789                 goto fail;
 790
 791         parent_pid = getpid();
 792
 793         if ((pam_pid = fork()) < 0)
 794                 goto fail;
 795
 796         if (pam_pid == 0) {
 797                 int sig;
 798                 int r = EXIT_PAM;
 799
 800                 /* The child's job is to reset the PAM session on
 801                  * termination */
 802
 803                 /* This string must fit in 10 chars (i.e. the length
 804                  * of "/sbin/init"), to look pretty in /bin/ps */
 805                 rename_process("(sd-pam)");
 806
 807                 /* Make sure we don't keep open the passed fds in this
 808                 child. We assume that otherwise only those fds are
 809                 open here that have been opened by PAM. */
 810                 close_many(fds, n_fds);
 811
 812                 /* Drop privileges - we don't need any to pam_close_session
 813                  * and this will make PR_SET_PDEATHSIG work in most cases.
 814                  * If this fails, ignore the error - but expect sd-pam threads
 815                  * to fail to exit normally */
 816                 if (setresuid(uid, uid, uid) < 0)
 817                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 818
 819                 /* Wait until our parent died. This will only work if
 820                  * the above setresuid() succeeds, otherwise the kernel
 821                  * will not allow unprivileged parents kill their privileged
 822                  * children this way. We rely on the control groups kill logic
 823                  * to do the rest for us. */
 824                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 825                         goto child_finish;
 826
 827                 /* Check if our parent process might already have
 828                  * died? */
 829                 if (getppid() == parent_pid) {
 830                         for (;;) {
 831                                 if (sigwait(&ss, &sig) < 0) {
 832                                         if (errno == EINTR)
 833                                                 continue;
 834
 835                                         goto child_finish;
 836                                 }
 837
 838                                 assert(sig == SIGTERM);
 839                                 break;
 840                         }
 841                 }
 842
 843                 /* If our parent died we'll end the session */
 844                 if (getppid() != parent_pid)
 845                         if ((pam_code = pam_close_session(handle, PAM_DATA_SILENT)) != PAM_SUCCESS)
 846                                 goto child_finish;
 847
 848                 r = 0;
 849
 850         child_finish:
 851                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 852                 _exit(r);
 853         }
 854
 855         /* If the child was forked off successfully it will do all the
 856          * cleanups, so forget about the handle here. */
 857         handle = NULL;
 858
 859         /* Unblock SIGTERM again in the parent */
 860         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 861                 goto fail;
 862
 863         /* We close the log explicitly here, since the PAM modules
 864          * might have opened it, but we don't want this fd around. */
 865         closelog();
 866
 867         *pam_env = e;
 868         e = NULL;
 869
 870         return 0;
 871
 872 fail:
 873         if (pam_code != PAM_SUCCESS)
 874                 err = -EPERM;  /* PAM errors do not map to errno */
 875         else
 876                 err = -errno;
 877
 878         if (handle) {
 879                 if (close_session)
 880                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
 881
 882                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 883         }
 884
 885         strv_free(e);
 886
 887         closelog();
 888
 889         if (pam_pid > 1) {
 890                 kill(pam_pid, SIGTERM);
 891                 kill(pam_pid, SIGCONT);
 892         }
 893
 894         return err;
 895 }
 896 #endif
 897
 898 static void rename_process_from_path(const char *path) {
 899         char process_name[11];
 900         const char *p;
 901         size_t l;
 902
 903         /* This resulting string must fit in 10 chars (i.e. the length
 904          * of "/sbin/init") to look pretty in /bin/ps */
 905
 906         p = path_get_file_name(path);
 907         if (isempty(p)) {
 908                 rename_process("(...)");
 909                 return;
 910         }
 911
 912         l = strlen(p);
 913         if (l > 8) {
 914                 /* The end of the process name is usually more
 915                  * interesting, since the first bit might just be
 916                  * "systemd-" */
 917                 p = p + l - 8;
 918                 l = 8;
 919         }
 920
 921         process_name[0] = '(';
 922         memcpy(process_name+1, p, l);
 923         process_name[1+l] = ')';
 924         process_name[1+l+1] = 0;
 925
 926         rename_process(process_name);
 927 }
 928
 929 static int apply_seccomp(uint32_t *syscall_filter) {
 930         static const struct sock_filter header[] = {
 931                 VALIDATE_ARCHITECTURE,
 932                 EXAMINE_SYSCALL
 933         };
 934         static const struct sock_filter footer[] = {
 935                 _KILL_PROCESS
 936         };
 937
 938         int i;
 939         unsigned n;
 940         struct sock_filter *f;
 941         struct sock_fprog prog;
 942
 943         assert(syscall_filter);
 944
 945         /* First: count the syscalls to check for */
 946         for (i = 0, n = 0; i < syscall_max(); i++)
 947                 if (syscall_filter[i >> 4] & (1 << (i & 31)))
 948                         n++;
 949
 950         /* Second: build the filter program from a header the syscall
 951          * matches and the footer */
 952         f = alloca(sizeof(struct sock_filter) * (ELEMENTSOF(header) + 2*n + ELEMENTSOF(footer)));
 953         memcpy(f, header, sizeof(header));
 954
 955         for (i = 0, n = 0; i < syscall_max(); i++)
 956                 if (syscall_filter[i >> 4] & (1 << (i & 31))) {
 957                         struct sock_filter item[] = {
 958                                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, INDEX_TO_SYSCALL(i), 0, 1),
 959                                 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 960                         };
 961
 962                         assert_cc(ELEMENTSOF(item) == 2);
 963
 964                         f[ELEMENTSOF(header) + 2*n]  = item[0];
 965                         f[ELEMENTSOF(header) + 2*n+1] = item[1];
 966
 967                         n++;
 968                 }
 969
 970         memcpy(f + (ELEMENTSOF(header) + 2*n), footer, sizeof(footer));
 971
 972         /* Third: install the filter */
 973         zero(prog);
 974         prog.len = ELEMENTSOF(header) + ELEMENTSOF(footer) + 2*n;
 975         prog.filter = f;
 976         if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0)
 977                 return -errno;
 978
 979         return 0;
 980 }
 981
 982 int exec_spawn(ExecCommand *command,
 983                char **argv,
 984                ExecContext *context,
 985                int fds[], unsigned n_fds,
 986                char **environment,
 987                bool apply_permissions,
 988                bool apply_chroot,
 989                bool apply_tty_stdin,
 990                bool confirm_spawn,
 991                CGroupBonding *cgroup_bondings,
 992                CGroupAttribute *cgroup_attributes,
 993                const char *cgroup_suffix,
 994                const char *unit_id,
 995                int idle_pipe[2],
 996                pid_t *ret) {
 997
 998         pid_t pid;
 999         int r;
1000         char *line;
1001         int socket_fd;
1002         char _cleanup_strv_free_ **files_env = NULL;
1003
1004         assert(command);
1005         assert(context);
1006         assert(ret);
1007         assert(fds || n_fds <= 0);
1008
1009         if (context->std_input == EXEC_INPUT_SOCKET ||
1010             context->std_output == EXEC_OUTPUT_SOCKET ||
1011             context->std_error == EXEC_OUTPUT_SOCKET) {
1012
1013                 if (n_fds != 1)
1014                         return -EINVAL;
1015
1016                 socket_fd = fds[0];
1017
1018                 fds = NULL;
1019                 n_fds = 0;
1020         } else
1021                 socket_fd = -1;
1022
1023         r = exec_context_load_environment(context, &files_env);
1024         if (r < 0) {
1025                 log_struct_unit(LOG_ERR,
1026                            unit_id,
1027                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1028                            "ERRNO=%d", -r,
1029                            NULL);
1030                 return r;
1031         }
1032
1033         if (!argv)
1034                 argv = command->argv;
1035
1036         line = exec_command_line(argv);
1037         if (!line)
1038                 return log_oom();
1039
1040         log_struct_unit(LOG_DEBUG,
1041                    unit_id,
1042                    "MESSAGE=About to execute %s", line,
1043                    NULL);
1044         free(line);
1045
1046         r = cgroup_bonding_realize_list(cgroup_bondings);
1047         if (r < 0)
1048                 return r;
1049
1050         cgroup_attribute_apply_list(cgroup_attributes, cgroup_bondings);
1051
1052         if (context->private_tmp && !context->tmp_dir && !context->var_tmp_dir) {
1053                 r = setup_tmpdirs(&context->tmp_dir, &context->var_tmp_dir);
1054                 if (r < 0)
1055                         return r;
1056         }
1057
1058         pid = fork();
1059         if (pid < 0)
1060                 return -errno;
1061
1062         if (pid == 0) {
1063                 int i, err;
1064                 sigset_t ss;
1065                 const char *username = NULL, *home = NULL;
1066                 uid_t uid = (uid_t) -1;
1067                 gid_t gid = (gid_t) -1;
1068                 char _cleanup_strv_free_ **our_env = NULL, **pam_env = NULL,
1069                         **final_env = NULL, **final_argv = NULL;
1070                 unsigned n_env = 0;
1071                 bool set_access = false;
1072
1073                 /* child */
1074
1075                 rename_process_from_path(command->path);
1076
1077                 /* We reset exactly these signals, since they are the
1078                  * only ones we set to SIG_IGN in the main daemon. All
1079                  * others we leave untouched because we set them to
1080                  * SIG_DFL or a valid handler initially, both of which
1081                  * will be demoted to SIG_DFL. */
1082                 default_signals(SIGNALS_CRASH_HANDLER,
1083                                 SIGNALS_IGNORE, -1);
1084
1085                 if (context->ignore_sigpipe)
1086                         ignore_signals(SIGPIPE, -1);
1087
1088                 assert_se(sigemptyset(&ss) == 0);
1089                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1090                         err = -errno;
1091                         r = EXIT_SIGNAL_MASK;
1092                         goto fail_child;
1093                 }
1094
1095                 if (idle_pipe) {
1096                         if (idle_pipe[1] >= 0)
1097                                 close_nointr_nofail(idle_pipe[1]);
1098                         if (idle_pipe[0] >= 0) {
1099                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1100                                 close_nointr_nofail(idle_pipe[0]);
1101                         }
1102                 }
1103
1104                 /* Close sockets very early to make sure we don't
1105                  * block init reexecution because it cannot bind its
1106                  * sockets */
1107                 log_forget_fds();
1108                 err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
1109                                            socket_fd >= 0 ? 1 : n_fds);
1110                 if (err < 0) {
1111                         r = EXIT_FDS;
1112                         goto fail_child;
1113                 }
1114
1115                 if (!context->same_pgrp)
1116                         if (setsid() < 0) {
1117                                 err = -errno;
1118                                 r = EXIT_SETSID;
1119                                 goto fail_child;
1120                         }
1121
1122                 if (context->tcpwrap_name) {
1123                         if (socket_fd >= 0)
1124                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1125                                         err = -EACCES;
1126                                         r = EXIT_TCPWRAP;
1127                                         goto fail_child;
1128                                 }
1129
1130                         for (i = 0; i < (int) n_fds; i++) {
1131                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1132                                         err = -EACCES;
1133                                         r = EXIT_TCPWRAP;
1134                                         goto fail_child;
1135                                 }
1136                         }
1137                 }
1138
1139                 exec_context_tty_reset(context);
1140
1141                 if (confirm_spawn) {
1142                         char response;
1143
1144                         err = ask_for_confirmation(&response, argv);
1145                         if (err == -ETIMEDOUT)
1146                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1147                         else if (err < 0)
1148                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1149                         else if (response == 's') {
1150                                 write_confirm_message("Skipping execution.\n");
1151                                 err = -ECANCELED;
1152                                 r = EXIT_CONFIRM;
1153                                 goto fail_child;
1154                         } else if (response == 'n') {
1155                                 write_confirm_message("Failing execution.\n");
1156                                 err = r = 0;
1157                                 goto fail_child;
1158                         }
1159                 }
1160
1161                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1162                  * must sure to drop O_NONBLOCK */
1163                 if (socket_fd >= 0)
1164                         fd_nonblock(socket_fd, false);
1165
1166                 err = setup_input(context, socket_fd, apply_tty_stdin);
1167                 if (err < 0) {
1168                         r = EXIT_STDIN;
1169                         goto fail_child;
1170                 }
1171
1172                 err = setup_output(context, STDOUT_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1173                 if (err < 0) {
1174                         r = EXIT_STDOUT;
1175                         goto fail_child;
1176                 }
1177
1178                 err = setup_output(context, STDERR_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
1179                 if (err < 0) {
1180                         r = EXIT_STDERR;
1181                         goto fail_child;
1182                 }
1183
1184                 if (cgroup_bondings) {
1185                         err = cgroup_bonding_install_list(cgroup_bondings, 0, cgroup_suffix);
1186                         if (err < 0) {
1187                                 r = EXIT_CGROUP;
1188                                 goto fail_child;
1189                         }
1190                 }
1191
1192                 if (context->oom_score_adjust_set) {
1193                         char t[16];
1194
1195                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1196                         char_array_0(t);
1197
1198                         if (write_one_line_file("/proc/self/oom_score_adj", t) < 0) {
1199                                 err = -errno;
1200                                 r = EXIT_OOM_ADJUST;
1201                                 goto fail_child;
1202                         }
1203                 }
1204
1205                 if (context->nice_set)
1206                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1207                                 err = -errno;
1208                                 r = EXIT_NICE;
1209                                 goto fail_child;
1210                         }
1211
1212                 if (context->cpu_sched_set) {
1213                         struct sched_param param;
1214
1215                         zero(param);
1216                         param.sched_priority = context->cpu_sched_priority;
1217
1218                         if (sched_setscheduler(0, context->cpu_sched_policy |
1219                                                (context->cpu_sched_reset_on_fork ? SCHED_RESET_ON_FORK : 0), &param) < 0) {
1220                                 err = -errno;
1221                                 r = EXIT_SETSCHEDULER;
1222                                 goto fail_child;
1223                         }
1224                 }
1225
1226                 if (context->cpuset)
1227                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1228                                 err = -errno;
1229                                 r = EXIT_CPUAFFINITY;
1230                                 goto fail_child;
1231                         }
1232
1233                 if (context->ioprio_set)
1234                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1235                                 err = -errno;
1236                                 r = EXIT_IOPRIO;
1237                                 goto fail_child;
1238                         }
1239
1240                 if (context->timer_slack_nsec != (nsec_t) -1)
1241                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1242                                 err = -errno;
1243                                 r = EXIT_TIMERSLACK;
1244                                 goto fail_child;
1245                         }
1246
1247                 if (context->utmp_id)
1248                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1249
1250                 if (context->user) {
1251                         username = context->user;
1252                         err = get_user_creds(&username, &uid, &gid, &home, NULL);
1253                         if (err < 0) {
1254                                 r = EXIT_USER;
1255                                 goto fail_child;
1256                         }
1257
1258                         if (is_terminal_input(context->std_input)) {
1259                                 err = chown_terminal(STDIN_FILENO, uid);
1260                                 if (err < 0) {
1261                                         r = EXIT_STDIN;
1262                                         goto fail_child;
1263                                 }
1264                         }
1265
1266                         if (cgroup_bondings && context->control_group_modify) {
1267                                 err = cgroup_bonding_set_group_access_list(cgroup_bondings, 0755, uid, gid);
1268                                 if (err >= 0)
1269                                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, 0644, uid, gid, context->control_group_persistent);
1270                                 if (err < 0) {
1271                                         r = EXIT_CGROUP;
1272                                         goto fail_child;
1273                                 }
1274
1275                                 set_access = true;
1276                         }
1277                 }
1278
1279                 if (cgroup_bondings && !set_access && context->control_group_persistent >= 0)  {
1280                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, (mode_t) -1, (uid_t) -1, (uid_t) -1, context->control_group_persistent);
1281                         if (err < 0) {
1282                                 r = EXIT_CGROUP;
1283                                 goto fail_child;
1284                         }
1285                 }
1286
1287                 if (apply_permissions) {
1288                         err = enforce_groups(context, username, gid);
1289                         if (err < 0) {
1290                                 r = EXIT_GROUP;
1291                                 goto fail_child;
1292                         }
1293                 }
1294
1295                 umask(context->umask);
1296
1297 #ifdef HAVE_PAM
1298                 if (apply_permissions && context->pam_name && username) {
1299                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1300                         if (err < 0) {
1301                                 r = EXIT_PAM;
1302                                 goto fail_child;
1303                         }
1304                 }
1305 #endif
1306                 if (context->private_network) {
1307                         if (unshare(CLONE_NEWNET) < 0) {
1308                                 err = -errno;
1309                                 r = EXIT_NETWORK;
1310                                 goto fail_child;
1311                         }
1312
1313                         loopback_setup();
1314                 }
1315
1316                 if (strv_length(context->read_write_dirs) > 0 ||
1317                     strv_length(context->read_only_dirs) > 0 ||
1318                     strv_length(context->inaccessible_dirs) > 0 ||
1319                     context->mount_flags != 0 ||
1320                     context->private_tmp) {
1321                         err = setup_namespace(context->read_write_dirs,
1322                                               context->read_only_dirs,
1323                                               context->inaccessible_dirs,
1324                                               context->tmp_dir,
1325                                               context->var_tmp_dir,
1326                                               context->private_tmp,
1327                                               context->mount_flags);
1328                         if (err < 0) {
1329                                 r = EXIT_NAMESPACE;
1330                                 goto fail_child;
1331                         }
1332                 }
1333
1334                 if (apply_chroot) {
1335                         if (context->root_directory)
1336                                 if (chroot(context->root_directory) < 0) {
1337                                         err = -errno;
1338                                         r = EXIT_CHROOT;
1339                                         goto fail_child;
1340                                 }
1341
1342                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1343                                 err = -errno;
1344                                 r = EXIT_CHDIR;
1345                                 goto fail_child;
1346                         }
1347                 } else {
1348                         char _cleanup_free_ *d = NULL;
1349
1350                         if (asprintf(&d, "%s/%s",
1351                                      context->root_directory ? context->root_directory : "",
1352                                      context->working_directory ? context->working_directory : "") < 0) {
1353                                 err = -ENOMEM;
1354                                 r = EXIT_MEMORY;
1355                                 goto fail_child;
1356                         }
1357
1358                         if (chdir(d) < 0) {
1359                                 err = -errno;
1360                                 r = EXIT_CHDIR;
1361                                 goto fail_child;
1362                         }
1363                 }
1364
1365                 /* We repeat the fd closing here, to make sure that
1366                  * nothing is leaked from the PAM modules */
1367                 err = close_all_fds(fds, n_fds);
1368                 if (err >= 0)
1369                         err = shift_fds(fds, n_fds);
1370                 if (err >= 0)
1371                         err = flags_fds(fds, n_fds, context->non_blocking);
1372                 if (err < 0) {
1373                         r = EXIT_FDS;
1374                         goto fail_child;
1375                 }
1376
1377                 if (apply_permissions) {
1378
1379                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1380                                 if (!context->rlimit[i])
1381                                         continue;
1382
1383                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1384                                         err = -errno;
1385                                         r = EXIT_LIMITS;
1386                                         goto fail_child;
1387                                 }
1388                         }
1389
1390                         if (context->capability_bounding_set_drop) {
1391                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1392                                 if (err < 0) {
1393                                         r = EXIT_CAPABILITIES;
1394                                         goto fail_child;
1395                                 }
1396                         }
1397
1398                         if (context->user) {
1399                                 err = enforce_user(context, uid);
1400                                 if (err < 0) {
1401                                         r = EXIT_USER;
1402                                         goto fail_child;
1403                                 }
1404                         }
1405
1406                         /* PR_GET_SECUREBITS is not privileged, while
1407                          * PR_SET_SECUREBITS is. So to suppress
1408                          * potential EPERMs we'll try not to call
1409                          * PR_SET_SECUREBITS unless necessary. */
1410                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1411                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1412                                         err = -errno;
1413                                         r = EXIT_SECUREBITS;
1414                                         goto fail_child;
1415                                 }
1416
1417                         if (context->capabilities)
1418                                 if (cap_set_proc(context->capabilities) < 0) {
1419                                         err = -errno;
1420                                         r = EXIT_CAPABILITIES;
1421                                         goto fail_child;
1422                                 }
1423
1424                         if (context->no_new_privileges)
1425                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1426                                         err = -errno;
1427                                         r = EXIT_NO_NEW_PRIVILEGES;
1428                                         goto fail_child;
1429                                 }
1430
1431                         if (context->syscall_filter) {
1432                                 err = apply_seccomp(context->syscall_filter);
1433                                 if (err < 0) {
1434                                         r = EXIT_SECCOMP;
1435                                         goto fail_child;
1436                                 }
1437                         }
1438                 }
1439
1440                 if (!(our_env = new0(char*, 7))) {
1441                         err = -ENOMEM;
1442                         r = EXIT_MEMORY;
1443                         goto fail_child;
1444                 }
1445
1446                 if (n_fds > 0)
1447                         if (asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1448                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0) {
1449                                 err = -ENOMEM;
1450                                 r = EXIT_MEMORY;
1451                                 goto fail_child;
1452                         }
1453
1454                 if (home)
1455                         if (asprintf(our_env + n_env++, "HOME=%s", home) < 0) {
1456                                 err = -ENOMEM;
1457                                 r = EXIT_MEMORY;
1458                                 goto fail_child;
1459                         }
1460
1461                 if (username)
1462                         if (asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1463                             asprintf(our_env + n_env++, "USER=%s", username) < 0) {
1464                                 err = -ENOMEM;
1465                                 r = EXIT_MEMORY;
1466                                 goto fail_child;
1467                         }
1468
1469                 if (is_terminal_input(context->std_input) ||
1470                     context->std_output == EXEC_OUTPUT_TTY ||
1471                     context->std_error == EXEC_OUTPUT_TTY)
1472                         if (!(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))) {
1473                                 err = -ENOMEM;
1474                                 r = EXIT_MEMORY;
1475                                 goto fail_child;
1476                         }
1477
1478                 assert(n_env <= 7);
1479
1480                 if (!(final_env = strv_env_merge(
1481                                       5,
1482                                       environment,
1483                                       our_env,
1484                                       context->environment,
1485                                       files_env,
1486                                       pam_env,
1487                                       NULL))) {
1488                         err = -ENOMEM;
1489                         r = EXIT_MEMORY;
1490                         goto fail_child;
1491                 }
1492
1493                 if (!(final_argv = replace_env_argv(argv, final_env))) {
1494                         err = -ENOMEM;
1495                         r = EXIT_MEMORY;
1496                         goto fail_child;
1497                 }
1498
1499                 final_env = strv_env_clean(final_env);
1500
1501                 execve(command->path, final_argv, final_env);
1502                 err = -errno;
1503                 r = EXIT_EXEC;
1504
1505         fail_child:
1506                 if (r != 0) {
1507                         log_open();
1508                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1509                                    "EXECUTABLE=%s", command->path,
1510                                    "MESSAGE=Failed at step %s spawning %s: %s",
1511                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1512                                           command->path, strerror(-err),
1513                                    "ERRNO=%d", -err,
1514                                    NULL);
1515                         log_close();
1516                 }
1517
1518                 _exit(r);
1519         }
1520
1521         log_struct_unit(LOG_DEBUG,
1522                    unit_id,
1523                    "MESSAGE=Forked %s as %lu",
1524                           command->path, (unsigned long) pid,
1525                    NULL);
1526
1527         /* We add the new process to the cgroup both in the child (so
1528          * that we can be sure that no user code is ever executed
1529          * outside of the cgroup) and in the parent (so that we can be
1530          * sure that when we kill the cgroup the process will be
1531          * killed too). */
1532         if (cgroup_bondings)
1533                 cgroup_bonding_install_list(cgroup_bondings, pid, cgroup_suffix);
1534
1535         exec_status_start(&command->exec_status, pid);
1536
1537         *ret = pid;
1538         return 0;
1539 }
1540
1541 void exec_context_init(ExecContext *c) {
1542         assert(c);
1543
1544         c->umask = 0022;
1545         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1546         c->cpu_sched_policy = SCHED_OTHER;
1547         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1548         c->syslog_level_prefix = true;
1549         c->control_group_persistent = -1;
1550         c->ignore_sigpipe = true;
1551         c->timer_slack_nsec = (nsec_t) -1;
1552 }
1553
1554 void exec_context_tmp_dirs_done(ExecContext *c) {
1555         char* dirs[] = {c->tmp_dir ? c->tmp_dir : c->var_tmp_dir,
1556                         c->tmp_dir ? c->var_tmp_dir : NULL,
1557                         NULL};
1558         char **dirp;
1559
1560         for(dirp = dirs; *dirp; dirp++) {
1561                 char *dir;
1562                 rm_rf_dangerous(*dirp, false, true, false);
1563
1564                 dir = dirname(*dirp);
1565                 rmdir(dir);
1566
1567                 free(*dirp);
1568         }
1569
1570         c->tmp_dir = c->var_tmp_dir = NULL;
1571 }
1572
1573 void exec_context_done(ExecContext *c, bool reloading_or_reexecuting) {
1574         unsigned l;
1575
1576         assert(c);
1577
1578         strv_free(c->environment);
1579         c->environment = NULL;
1580
1581         strv_free(c->environment_files);
1582         c->environment_files = NULL;
1583
1584         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1585                 free(c->rlimit[l]);
1586                 c->rlimit[l] = NULL;
1587         }
1588
1589         free(c->working_directory);
1590         c->working_directory = NULL;
1591         free(c->root_directory);
1592         c->root_directory = NULL;
1593
1594         free(c->tty_path);
1595         c->tty_path = NULL;
1596
1597         free(c->tcpwrap_name);
1598         c->tcpwrap_name = NULL;
1599
1600         free(c->syslog_identifier);
1601         c->syslog_identifier = NULL;
1602
1603         free(c->user);
1604         c->user = NULL;
1605
1606         free(c->group);
1607         c->group = NULL;
1608
1609         strv_free(c->supplementary_groups);
1610         c->supplementary_groups = NULL;
1611
1612         free(c->pam_name);
1613         c->pam_name = NULL;
1614
1615         if (c->capabilities) {
1616                 cap_free(c->capabilities);
1617                 c->capabilities = NULL;
1618         }
1619
1620         strv_free(c->read_only_dirs);
1621         c->read_only_dirs = NULL;
1622
1623         strv_free(c->read_write_dirs);
1624         c->read_write_dirs = NULL;
1625
1626         strv_free(c->inaccessible_dirs);
1627         c->inaccessible_dirs = NULL;
1628
1629         if (c->cpuset)
1630                 CPU_FREE(c->cpuset);
1631
1632         free(c->utmp_id);
1633         c->utmp_id = NULL;
1634
1635         free(c->syscall_filter);
1636         c->syscall_filter = NULL;
1637
1638         if (!reloading_or_reexecuting)
1639                 exec_context_tmp_dirs_done(c);
1640 }
1641
1642 void exec_command_done(ExecCommand *c) {
1643         assert(c);
1644
1645         free(c->path);
1646         c->path = NULL;
1647
1648         strv_free(c->argv);
1649         c->argv = NULL;
1650 }
1651
1652 void exec_command_done_array(ExecCommand *c, unsigned n) {
1653         unsigned i;
1654
1655         for (i = 0; i < n; i++)
1656                 exec_command_done(c+i);
1657 }
1658
1659 void exec_command_free_list(ExecCommand *c) {
1660         ExecCommand *i;
1661
1662         while ((i = c)) {
1663                 LIST_REMOVE(ExecCommand, command, c, i);
1664                 exec_command_done(i);
1665                 free(i);
1666         }
1667 }
1668
1669 void exec_command_free_array(ExecCommand **c, unsigned n) {
1670         unsigned i;
1671
1672         for (i = 0; i < n; i++) {
1673                 exec_command_free_list(c[i]);
1674                 c[i] = NULL;
1675         }
1676 }
1677
1678 int exec_context_load_environment(const ExecContext *c, char ***l) {
1679         char **i, **r = NULL;
1680
1681         assert(c);
1682         assert(l);
1683
1684         STRV_FOREACH(i, c->environment_files) {
1685                 char *fn;
1686                 int k;
1687                 bool ignore = false;
1688                 char **p;
1689                 glob_t pglob;
1690                 int count, n;
1691
1692                 fn = *i;
1693
1694                 if (fn[0] == '-') {
1695                         ignore = true;
1696                         fn ++;
1697                 }
1698
1699                 if (!path_is_absolute(fn)) {
1700
1701                         if (ignore)
1702                                 continue;
1703
1704                         strv_free(r);
1705                         return -EINVAL;
1706                 }
1707
1708                 /* Filename supports globbing, take all matching files */
1709                 zero(pglob);
1710                 errno = 0;
1711                 if (glob(fn, 0, NULL, &pglob) != 0) {
1712                         globfree(&pglob);
1713                         if (ignore)
1714                                 continue;
1715
1716                         strv_free(r);
1717                         return errno ? -errno : -EINVAL;
1718                 }
1719                 count = pglob.gl_pathc;
1720                 if (count == 0) {
1721                         globfree(&pglob);
1722                         if (ignore)
1723                                 continue;
1724
1725                         strv_free(r);
1726                         return -EINVAL;
1727                 }
1728                 for (n = 0; n < count; n++) {
1729                         k = load_env_file(pglob.gl_pathv[n], &p);
1730                         if (k < 0) {
1731                                 if (ignore)
1732                                         continue;
1733
1734                                 strv_free(r);
1735                                 globfree(&pglob);
1736                                 return k;
1737                          }
1738
1739                         if (r == NULL)
1740                                 r = p;
1741                         else {
1742                                 char **m;
1743
1744                                 m = strv_env_merge(2, r, p);
1745                                 strv_free(r);
1746                                 strv_free(p);
1747
1748                                 if (!m) {
1749                                         globfree(&pglob);
1750                                         return -ENOMEM;
1751                                 }
1752
1753                                 r = m;
1754                         }
1755                 }
1756                 globfree(&pglob);
1757         }
1758
1759         *l = r;
1760
1761         return 0;
1762 }
1763
1764 static bool tty_may_match_dev_console(const char *tty) {
1765         char *active = NULL, *console;
1766         bool b;
1767
1768         if (startswith(tty, "/dev/"))
1769                 tty += 5;
1770
1771         /* trivial identity? */
1772         if (streq(tty, "console"))
1773                 return true;
1774
1775         console = resolve_dev_console(&active);
1776         /* if we could not resolve, assume it may */
1777         if (!console)
1778                 return true;
1779
1780         /* "tty0" means the active VC, so it may be the same sometimes */
1781         b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
1782         free(active);
1783
1784         return b;
1785 }
1786
1787 bool exec_context_may_touch_console(ExecContext *ec) {
1788         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
1789                 is_terminal_input(ec->std_input) ||
1790                 is_terminal_output(ec->std_output) ||
1791                 is_terminal_output(ec->std_error)) &&
1792                tty_may_match_dev_console(tty_path(ec));
1793 }
1794
1795 static void strv_fprintf(FILE *f, char **l) {
1796         char **g;
1797
1798         assert(f);
1799
1800         STRV_FOREACH(g, l)
1801                 fprintf(f, " %s", *g);
1802 }
1803
1804 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1805         char ** e;
1806         unsigned i;
1807
1808         assert(c);
1809         assert(f);
1810
1811         if (!prefix)
1812                 prefix = "";
1813
1814         fprintf(f,
1815                 "%sUMask: %04o\n"
1816                 "%sWorkingDirectory: %s\n"
1817                 "%sRootDirectory: %s\n"
1818                 "%sNonBlocking: %s\n"
1819                 "%sPrivateTmp: %s\n"
1820                 "%sControlGroupModify: %s\n"
1821                 "%sControlGroupPersistent: %s\n"
1822                 "%sPrivateNetwork: %s\n"
1823                 "%sIgnoreSIGPIPE: %s\n",
1824                 prefix, c->umask,
1825                 prefix, c->working_directory ? c->working_directory : "/",
1826                 prefix, c->root_directory ? c->root_directory : "/",
1827                 prefix, yes_no(c->non_blocking),
1828                 prefix, yes_no(c->private_tmp),
1829                 prefix, yes_no(c->control_group_modify),
1830                 prefix, yes_no(c->control_group_persistent),
1831                 prefix, yes_no(c->private_network),
1832                 prefix, yes_no(c->ignore_sigpipe));
1833
1834         STRV_FOREACH(e, c->environment)
1835                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1836
1837         STRV_FOREACH(e, c->environment_files)
1838                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1839
1840         if (c->tcpwrap_name)
1841                 fprintf(f,
1842                         "%sTCPWrapName: %s\n",
1843                         prefix, c->tcpwrap_name);
1844
1845         if (c->nice_set)
1846                 fprintf(f,
1847                         "%sNice: %i\n",
1848                         prefix, c->nice);
1849
1850         if (c->oom_score_adjust_set)
1851                 fprintf(f,
1852                         "%sOOMScoreAdjust: %i\n",
1853                         prefix, c->oom_score_adjust);
1854
1855         for (i = 0; i < RLIM_NLIMITS; i++)
1856                 if (c->rlimit[i])
1857                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1858
1859         if (c->ioprio_set) {
1860                 char *class_str;
1861                 int r;
1862
1863                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
1864                 if (r < 0)
1865                         class_str = NULL;
1866                 fprintf(f,
1867                         "%sIOSchedulingClass: %s\n"
1868                         "%sIOPriority: %i\n",
1869                         prefix, strna(class_str),
1870                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1871                 free(class_str);
1872         }
1873
1874         if (c->cpu_sched_set) {
1875                 char *policy_str;
1876                 int r;
1877
1878                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
1879                 if (r < 0)
1880                         policy_str = NULL;
1881                 fprintf(f,
1882                         "%sCPUSchedulingPolicy: %s\n"
1883                         "%sCPUSchedulingPriority: %i\n"
1884                         "%sCPUSchedulingResetOnFork: %s\n",
1885                         prefix, strna(policy_str),
1886                         prefix, c->cpu_sched_priority,
1887                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1888                 free(policy_str);
1889         }
1890
1891         if (c->cpuset) {
1892                 fprintf(f, "%sCPUAffinity:", prefix);
1893                 for (i = 0; i < c->cpuset_ncpus; i++)
1894                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1895                                 fprintf(f, " %i", i);
1896                 fputs("\n", f);
1897         }
1898
1899         if (c->timer_slack_nsec != (nsec_t) -1)
1900                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, (unsigned long)c->timer_slack_nsec);
1901
1902         fprintf(f,
1903                 "%sStandardInput: %s\n"
1904                 "%sStandardOutput: %s\n"
1905                 "%sStandardError: %s\n",
1906                 prefix, exec_input_to_string(c->std_input),
1907                 prefix, exec_output_to_string(c->std_output),
1908                 prefix, exec_output_to_string(c->std_error));
1909
1910         if (c->tty_path)
1911                 fprintf(f,
1912                         "%sTTYPath: %s\n"
1913                         "%sTTYReset: %s\n"
1914                         "%sTTYVHangup: %s\n"
1915                         "%sTTYVTDisallocate: %s\n",
1916                         prefix, c->tty_path,
1917                         prefix, yes_no(c->tty_reset),
1918                         prefix, yes_no(c->tty_vhangup),
1919                         prefix, yes_no(c->tty_vt_disallocate));
1920
1921         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1922             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1923             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1924             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
1925                 char *fac_str, *lvl_str;
1926                 int r;
1927
1928                 r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
1929                 if (r < 0)
1930                         fac_str = NULL;
1931
1932                 r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
1933                 if (r < 0)
1934                         lvl_str = NULL;
1935
1936                 fprintf(f,
1937                         "%sSyslogFacility: %s\n"
1938                         "%sSyslogLevel: %s\n",
1939                         prefix, strna(fac_str),
1940                         prefix, strna(lvl_str));
1941                 free(lvl_str);
1942                 free(fac_str);
1943         }
1944
1945         if (c->capabilities) {
1946                 char *t;
1947                 if ((t = cap_to_text(c->capabilities, NULL))) {
1948                         fprintf(f, "%sCapabilities: %s\n",
1949                                 prefix, t);
1950                         cap_free(t);
1951                 }
1952         }
1953
1954         if (c->secure_bits)
1955                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1956                         prefix,
1957                         (c->secure_bits & SECURE_KEEP_CAPS) ? " keep-caps" : "",
1958                         (c->secure_bits & SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1959                         (c->secure_bits & SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1960                         (c->secure_bits & SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1961                         (c->secure_bits & SECURE_NOROOT) ? " noroot" : "",
1962                         (c->secure_bits & SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1963
1964         if (c->capability_bounding_set_drop) {
1965                 unsigned long l;
1966                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1967
1968                 for (l = 0; l <= cap_last_cap(); l++)
1969                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1970                                 char *t;
1971
1972                                 if ((t = cap_to_name(l))) {
1973                                         fprintf(f, " %s", t);
1974                                         cap_free(t);
1975                                 }
1976                         }
1977
1978                 fputs("\n", f);
1979         }
1980
1981         if (c->user)
1982                 fprintf(f, "%sUser: %s\n", prefix, c->user);
1983         if (c->group)
1984                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
1985
1986         if (strv_length(c->supplementary_groups) > 0) {
1987                 fprintf(f, "%sSupplementaryGroups:", prefix);
1988                 strv_fprintf(f, c->supplementary_groups);
1989                 fputs("\n", f);
1990         }
1991
1992         if (c->pam_name)
1993                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
1994
1995         if (strv_length(c->read_write_dirs) > 0) {
1996                 fprintf(f, "%sReadWriteDirs:", prefix);
1997                 strv_fprintf(f, c->read_write_dirs);
1998                 fputs("\n", f);
1999         }
2000
2001         if (strv_length(c->read_only_dirs) > 0) {
2002                 fprintf(f, "%sReadOnlyDirs:", prefix);
2003                 strv_fprintf(f, c->read_only_dirs);
2004                 fputs("\n", f);
2005         }
2006
2007         if (strv_length(c->inaccessible_dirs) > 0) {
2008                 fprintf(f, "%sInaccessibleDirs:", prefix);
2009                 strv_fprintf(f, c->inaccessible_dirs);
2010                 fputs("\n", f);
2011         }
2012
2013         if (c->utmp_id)
2014                 fprintf(f,
2015                         "%sUtmpIdentifier: %s\n",
2016                         prefix, c->utmp_id);
2017 }
2018
2019 void exec_status_start(ExecStatus *s, pid_t pid) {
2020         assert(s);
2021
2022         zero(*s);
2023         s->pid = pid;
2024         dual_timestamp_get(&s->start_timestamp);
2025 }
2026
2027 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2028         assert(s);
2029
2030         if (s->pid && s->pid != pid)
2031                 zero(*s);
2032
2033         s->pid = pid;
2034         dual_timestamp_get(&s->exit_timestamp);
2035
2036         s->code = code;
2037         s->status = status;
2038
2039         if (context) {
2040                 if (context->utmp_id)
2041                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2042
2043                 exec_context_tty_reset(context);
2044         }
2045 }
2046
2047 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2048         char buf[FORMAT_TIMESTAMP_MAX];
2049
2050         assert(s);
2051         assert(f);
2052
2053         if (!prefix)
2054                 prefix = "";
2055
2056         if (s->pid <= 0)
2057                 return;
2058
2059         fprintf(f,
2060                 "%sPID: %lu\n",
2061                 prefix, (unsigned long) s->pid);
2062
2063         if (s->start_timestamp.realtime > 0)
2064                 fprintf(f,
2065                         "%sStart Timestamp: %s\n",
2066                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2067
2068         if (s->exit_timestamp.realtime > 0)
2069                 fprintf(f,
2070                         "%sExit Timestamp: %s\n"
2071                         "%sExit Code: %s\n"
2072                         "%sExit Status: %i\n",
2073                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2074                         prefix, sigchld_code_to_string(s->code),
2075                         prefix, s->status);
2076 }
2077
2078 char *exec_command_line(char **argv) {
2079         size_t k;
2080         char *n, *p, **a;
2081         bool first = true;
2082
2083         assert(argv);
2084
2085         k = 1;
2086         STRV_FOREACH(a, argv)
2087                 k += strlen(*a)+3;
2088
2089         if (!(n = new(char, k)))
2090                 return NULL;
2091
2092         p = n;
2093         STRV_FOREACH(a, argv) {
2094
2095                 if (!first)
2096                         *(p++) = ' ';
2097                 else
2098                         first = false;
2099
2100                 if (strpbrk(*a, WHITESPACE)) {
2101                         *(p++) = '\'';
2102                         p = stpcpy(p, *a);
2103                         *(p++) = '\'';
2104                 } else
2105                         p = stpcpy(p, *a);
2106
2107         }
2108
2109         *p = 0;
2110
2111         /* FIXME: this doesn't really handle arguments that have
2112          * spaces and ticks in them */
2113
2114         return n;
2115 }
2116
2117 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2118         char *p2;
2119         const char *prefix2;
2120
2121         char *cmd;
2122
2123         assert(c);
2124         assert(f);
2125
2126         if (!prefix)
2127                 prefix = "";
2128         p2 = strappend(prefix, "\t");
2129         prefix2 = p2 ? p2 : prefix;
2130
2131         cmd = exec_command_line(c->argv);
2132
2133         fprintf(f,
2134                 "%sCommand Line: %s\n",
2135                 prefix, cmd ? cmd : strerror(ENOMEM));
2136
2137         free(cmd);
2138
2139         exec_status_dump(&c->exec_status, f, prefix2);
2140
2141         free(p2);
2142 }
2143
2144 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2145         assert(f);
2146
2147         if (!prefix)
2148                 prefix = "";
2149
2150         LIST_FOREACH(command, c, c)
2151                 exec_command_dump(c, f, prefix);
2152 }
2153
2154 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2155         ExecCommand *end;
2156
2157         assert(l);
2158         assert(e);
2159
2160         if (*l) {
2161                 /* It's kind of important, that we keep the order here */
2162                 LIST_FIND_TAIL(ExecCommand, command, *l, end);
2163                 LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
2164         } else
2165               *l = e;
2166 }
2167
2168 int exec_command_set(ExecCommand *c, const char *path, ...) {
2169         va_list ap;
2170         char **l, *p;
2171
2172         assert(c);
2173         assert(path);
2174
2175         va_start(ap, path);
2176         l = strv_new_ap(path, ap);
2177         va_end(ap);
2178
2179         if (!l)
2180                 return -ENOMEM;
2181
2182         if (!(p = strdup(path))) {
2183                 strv_free(l);
2184                 return -ENOMEM;
2185         }
2186
2187         free(c->path);
2188         c->path = p;
2189
2190         strv_free(c->argv);
2191         c->argv = l;
2192
2193         return 0;
2194 }
2195
2196 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2197         [EXEC_INPUT_NULL] = "null",
2198         [EXEC_INPUT_TTY] = "tty",
2199         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2200         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2201         [EXEC_INPUT_SOCKET] = "socket"
2202 };
2203
2204 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2205
2206 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2207         [EXEC_OUTPUT_INHERIT] = "inherit",
2208         [EXEC_OUTPUT_NULL] = "null",
2209         [EXEC_OUTPUT_TTY] = "tty",
2210         [EXEC_OUTPUT_SYSLOG] = "syslog",
2211         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2212         [EXEC_OUTPUT_KMSG] = "kmsg",
2213         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2214         [EXEC_OUTPUT_JOURNAL] = "journal",
2215         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2216         [EXEC_OUTPUT_SOCKET] = "socket"
2217 };
2218
2219 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);