src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <glob.h>
  42 #include <libgen.h>
  43 #undef basename
  44
  45 #ifdef HAVE_PAM
  46 #include <security/pam_appl.h>
  47 #endif
  48
  49 #ifdef HAVE_SELINUX
  50 #include <selinux/selinux.h>
  51 #endif
  52
  53 #ifdef HAVE_SECCOMP
  54 #include <seccomp.h>
  55 #endif
  56
  57 #include "execute.h"
  58 #include "strv.h"
  59 #include "macro.h"
  60 #include "capability.h"
  61 #include "util.h"
  62 #include "log.h"
  63 #include "sd-messages.h"
  64 #include "ioprio.h"
  65 #include "securebits.h"
  66 #include "namespace.h"
  67 #include "tcpwrap.h"
  68 #include "exit-status.h"
  69 #include "missing.h"
  70 #include "utmp-wtmp.h"
  71 #include "def.h"
  72 #include "path-util.h"
  73 #include "env-util.h"
  74 #include "fileio.h"
  75 #include "unit.h"
  76 #include "async.h"
  77 #include "selinux-util.h"
  78 #include "errno-list.h"
  79
  80 #ifdef HAVE_SECCOMP
  81 #include "seccomp-util.h"
  82 #endif
  83
  84 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  85 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
  86
  87 /* This assumes there is a 'tty' group */
  88 #define TTY_MODE 0620
  89
  90 #define SNDBUF_SIZE (8*1024*1024)
  91
  92 static int shift_fds(int fds[], unsigned n_fds) {
  93         int start, restart_from;
  94
  95         if (n_fds <= 0)
  96                 return 0;
  97
  98         /* Modifies the fds array! (sorts it) */
  99
 100         assert(fds);
 101
 102         start = 0;
 103         for (;;) {
 104                 int i;
 105
 106                 restart_from = -1;
 107
 108                 for (i = start; i < (int) n_fds; i++) {
 109                         int nfd;
 110
 111                         /* Already at right index? */
 112                         if (fds[i] == i+3)
 113                                 continue;
 114
 115                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
 116                                 return -errno;
 117
 118                         close_nointr_nofail(fds[i]);
 119                         fds[i] = nfd;
 120
 121                         /* Hmm, the fd we wanted isn't free? Then
 122                          * let's remember that and try again from here*/
 123                         if (nfd != i+3 && restart_from < 0)
 124                                 restart_from = i;
 125                 }
 126
 127                 if (restart_from < 0)
 128                         break;
 129
 130                 start = restart_from;
 131         }
 132
 133         return 0;
 134 }
 135
 136 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 137         unsigned i;
 138         int r;
 139
 140         if (n_fds <= 0)
 141                 return 0;
 142
 143         assert(fds);
 144
 145         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 146
 147         for (i = 0; i < n_fds; i++) {
 148
 149                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 150                         return r;
 151
 152                 /* We unconditionally drop FD_CLOEXEC from the fds,
 153                  * since after all we want to pass these fds to our
 154                  * children */
 155
 156                 if ((r = fd_cloexec(fds[i], false)) < 0)
 157                         return r;
 158         }
 159
 160         return 0;
 161 }
 162
 163 _pure_ static const char *tty_path(const ExecContext *context) {
 164         assert(context);
 165
 166         if (context->tty_path)
 167                 return context->tty_path;
 168
 169         return "/dev/console";
 170 }
 171
 172 static void exec_context_tty_reset(const ExecContext *context) {
 173         assert(context);
 174
 175         if (context->tty_vhangup)
 176                 terminal_vhangup(tty_path(context));
 177
 178         if (context->tty_reset)
 179                 reset_terminal(tty_path(context));
 180
 181         if (context->tty_vt_disallocate && context->tty_path)
 182                 vt_disallocate(context->tty_path);
 183 }
 184
 185 static bool is_terminal_output(ExecOutput o) {
 186         return
 187                 o == EXEC_OUTPUT_TTY ||
 188                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 189                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 190                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 191 }
 192
 193 static int open_null_as(int flags, int nfd) {
 194         int fd, r;
 195
 196         assert(nfd >= 0);
 197
 198         fd = open("/dev/null", flags|O_NOCTTY);
 199         if (fd < 0)
 200                 return -errno;
 201
 202         if (fd != nfd) {
 203                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 204                 close_nointr_nofail(fd);
 205         } else
 206                 r = nfd;
 207
 208         return r;
 209 }
 210
 211 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 212         int fd, r;
 213         union sockaddr_union sa = {
 214                 .un.sun_family = AF_UNIX,
 215                 .un.sun_path = "/run/systemd/journal/stdout",
 216         };
 217
 218         assert(context);
 219         assert(output < _EXEC_OUTPUT_MAX);
 220         assert(ident);
 221         assert(nfd >= 0);
 222
 223         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 224         if (fd < 0)
 225                 return -errno;
 226
 227         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 228         if (r < 0) {
 229                 close_nointr_nofail(fd);
 230                 return -errno;
 231         }
 232
 233         if (shutdown(fd, SHUT_RD) < 0) {
 234                 close_nointr_nofail(fd);
 235                 return -errno;
 236         }
 237
 238         fd_inc_sndbuf(fd, SNDBUF_SIZE);
 239
 240         dprintf(fd,
 241                 "%s\n"
 242                 "%s\n"
 243                 "%i\n"
 244                 "%i\n"
 245                 "%i\n"
 246                 "%i\n"
 247                 "%i\n",
 248                 context->syslog_identifier ? context->syslog_identifier : ident,
 249                 unit_id,
 250                 context->syslog_priority,
 251                 !!context->syslog_level_prefix,
 252                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 253                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 254                 is_terminal_output(output));
 255
 256         if (fd != nfd) {
 257                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 258                 close_nointr_nofail(fd);
 259         } else
 260                 r = nfd;
 261
 262         return r;
 263 }
 264 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 265         int fd, r;
 266
 267         assert(path);
 268         assert(nfd >= 0);
 269
 270         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 271                 return fd;
 272
 273         if (fd != nfd) {
 274                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 275                 close_nointr_nofail(fd);
 276         } else
 277                 r = nfd;
 278
 279         return r;
 280 }
 281
 282 static bool is_terminal_input(ExecInput i) {
 283         return
 284                 i == EXEC_INPUT_TTY ||
 285                 i == EXEC_INPUT_TTY_FORCE ||
 286                 i == EXEC_INPUT_TTY_FAIL;
 287 }
 288
 289 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 290
 291         if (is_terminal_input(std_input) && !apply_tty_stdin)
 292                 return EXEC_INPUT_NULL;
 293
 294         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 295                 return EXEC_INPUT_NULL;
 296
 297         return std_input;
 298 }
 299
 300 static int fixup_output(ExecOutput std_output, int socket_fd) {
 301
 302         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 303                 return EXEC_OUTPUT_INHERIT;
 304
 305         return std_output;
 306 }
 307
 308 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 309         ExecInput i;
 310
 311         assert(context);
 312
 313         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 314
 315         switch (i) {
 316
 317         case EXEC_INPUT_NULL:
 318                 return open_null_as(O_RDONLY, STDIN_FILENO);
 319
 320         case EXEC_INPUT_TTY:
 321         case EXEC_INPUT_TTY_FORCE:
 322         case EXEC_INPUT_TTY_FAIL: {
 323                 int fd, r;
 324
 325                 fd = acquire_terminal(tty_path(context),
 326                                       i == EXEC_INPUT_TTY_FAIL,
 327                                       i == EXEC_INPUT_TTY_FORCE,
 328                                       false,
 329                                       (usec_t) -1);
 330                 if (fd < 0)
 331                         return fd;
 332
 333                 if (fd != STDIN_FILENO) {
 334                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 335                         close_nointr_nofail(fd);
 336                 } else
 337                         r = STDIN_FILENO;
 338
 339                 return r;
 340         }
 341
 342         case EXEC_INPUT_SOCKET:
 343                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 344
 345         default:
 346                 assert_not_reached("Unknown input type");
 347         }
 348 }
 349
 350 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 351         ExecOutput o;
 352         ExecInput i;
 353         int r;
 354
 355         assert(context);
 356         assert(ident);
 357
 358         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 359         o = fixup_output(context->std_output, socket_fd);
 360
 361         if (fileno == STDERR_FILENO) {
 362                 ExecOutput e;
 363                 e = fixup_output(context->std_error, socket_fd);
 364
 365                 /* This expects the input and output are already set up */
 366
 367                 /* Don't change the stderr file descriptor if we inherit all
 368                  * the way and are not on a tty */
 369                 if (e == EXEC_OUTPUT_INHERIT &&
 370                     o == EXEC_OUTPUT_INHERIT &&
 371                     i == EXEC_INPUT_NULL &&
 372                     !is_terminal_input(context->std_input) &&
 373                     getppid () != 1)
 374                         return fileno;
 375
 376                 /* Duplicate from stdout if possible */
 377                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 378                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 379
 380                 o = e;
 381
 382         } else if (o == EXEC_OUTPUT_INHERIT) {
 383                 /* If input got downgraded, inherit the original value */
 384                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 385                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 386
 387                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 388                 if (i != EXEC_INPUT_NULL)
 389                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 390
 391                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 392                 if (getppid() != 1)
 393                         return fileno;
 394
 395                 /* We need to open /dev/null here anew, to get the right access mode. */
 396                 return open_null_as(O_WRONLY, fileno);
 397         }
 398
 399         switch (o) {
 400
 401         case EXEC_OUTPUT_NULL:
 402                 return open_null_as(O_WRONLY, fileno);
 403
 404         case EXEC_OUTPUT_TTY:
 405                 if (is_terminal_input(i))
 406                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 407
 408                 /* We don't reset the terminal if this is just about output */
 409                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 410
 411         case EXEC_OUTPUT_SYSLOG:
 412         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 413         case EXEC_OUTPUT_KMSG:
 414         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 415         case EXEC_OUTPUT_JOURNAL:
 416         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 417                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 418                 if (r < 0) {
 419                         log_struct_unit(LOG_CRIT, unit_id,
 420                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 421                                 fileno == STDOUT_FILENO ? "out" : "err",
 422                                 unit_id, strerror(-r),
 423                                 "ERRNO=%d", -r,
 424                                 NULL);
 425                         r = open_null_as(O_WRONLY, fileno);
 426                 }
 427                 return r;
 428
 429         case EXEC_OUTPUT_SOCKET:
 430                 assert(socket_fd >= 0);
 431                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 432
 433         default:
 434                 assert_not_reached("Unknown error type");
 435         }
 436 }
 437
 438 static int chown_terminal(int fd, uid_t uid) {
 439         struct stat st;
 440
 441         assert(fd >= 0);
 442
 443         /* This might fail. What matters are the results. */
 444         (void) fchown(fd, uid, -1);
 445         (void) fchmod(fd, TTY_MODE);
 446
 447         if (fstat(fd, &st) < 0)
 448                 return -errno;
 449
 450         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 451                 return -EPERM;
 452
 453         return 0;
 454 }
 455
 456 static int setup_confirm_stdio(int *_saved_stdin,
 457                                int *_saved_stdout) {
 458         int fd = -1, saved_stdin, saved_stdout = -1, r;
 459
 460         assert(_saved_stdin);
 461         assert(_saved_stdout);
 462
 463         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 464         if (saved_stdin < 0)
 465                 return -errno;
 466
 467         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 468         if (saved_stdout < 0) {
 469                 r = errno;
 470                 goto fail;
 471         }
 472
 473         fd = acquire_terminal(
 474                         "/dev/console",
 475                         false,
 476                         false,
 477                         false,
 478                         DEFAULT_CONFIRM_USEC);
 479         if (fd < 0) {
 480                 r = fd;
 481                 goto fail;
 482         }
 483
 484         r = chown_terminal(fd, getuid());
 485         if (r < 0)
 486                 goto fail;
 487
 488         if (dup2(fd, STDIN_FILENO) < 0) {
 489                 r = -errno;
 490                 goto fail;
 491         }
 492
 493         if (dup2(fd, STDOUT_FILENO) < 0) {
 494                 r = -errno;
 495                 goto fail;
 496         }
 497
 498         if (fd >= 2)
 499                 close_nointr_nofail(fd);
 500
 501         *_saved_stdin = saved_stdin;
 502         *_saved_stdout = saved_stdout;
 503
 504         return 0;
 505
 506 fail:
 507         if (saved_stdout >= 0)
 508                 close_nointr_nofail(saved_stdout);
 509
 510         if (saved_stdin >= 0)
 511                 close_nointr_nofail(saved_stdin);
 512
 513         if (fd >= 0)
 514                 close_nointr_nofail(fd);
 515
 516         return r;
 517 }
 518
 519 _printf_(1, 2) static int write_confirm_message(const char *format, ...) {
 520         int fd;
 521         va_list ap;
 522
 523         assert(format);
 524
 525         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 526         if (fd < 0)
 527                 return fd;
 528
 529         va_start(ap, format);
 530         vdprintf(fd, format, ap);
 531         va_end(ap);
 532
 533         close_nointr_nofail(fd);
 534
 535         return 0;
 536 }
 537
 538 static int restore_confirm_stdio(int *saved_stdin,
 539                                  int *saved_stdout) {
 540
 541         int r = 0;
 542
 543         assert(saved_stdin);
 544         assert(saved_stdout);
 545
 546         release_terminal();
 547
 548         if (*saved_stdin >= 0)
 549                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 550                         r = -errno;
 551
 552         if (*saved_stdout >= 0)
 553                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 554                         r = -errno;
 555
 556         if (*saved_stdin >= 0)
 557                 close_nointr_nofail(*saved_stdin);
 558
 559         if (*saved_stdout >= 0)
 560                 close_nointr_nofail(*saved_stdout);
 561
 562         return r;
 563 }
 564
 565 static int ask_for_confirmation(char *response, char **argv) {
 566         int saved_stdout = -1, saved_stdin = -1, r;
 567         char *line;
 568
 569         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 570         if (r < 0)
 571                 return r;
 572
 573         line = exec_command_line(argv);
 574         if (!line)
 575                 return -ENOMEM;
 576
 577         r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 578         free(line);
 579
 580         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 581
 582         return r;
 583 }
 584
 585 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 586         bool keep_groups = false;
 587         int r;
 588
 589         assert(context);
 590
 591         /* Lookup and set GID and supplementary group list. Here too
 592          * we avoid NSS lookups for gid=0. */
 593
 594         if (context->group || username) {
 595
 596                 if (context->group) {
 597                         const char *g = context->group;
 598
 599                         if ((r = get_group_creds(&g, &gid)) < 0)
 600                                 return r;
 601                 }
 602
 603                 /* First step, initialize groups from /etc/groups */
 604                 if (username && gid != 0) {
 605                         if (initgroups(username, gid) < 0)
 606                                 return -errno;
 607
 608                         keep_groups = true;
 609                 }
 610
 611                 /* Second step, set our gids */
 612                 if (setresgid(gid, gid, gid) < 0)
 613                         return -errno;
 614         }
 615
 616         if (context->supplementary_groups) {
 617                 int ngroups_max, k;
 618                 gid_t *gids;
 619                 char **i;
 620
 621                 /* Final step, initialize any manually set supplementary groups */
 622                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 623
 624                 if (!(gids = new(gid_t, ngroups_max)))
 625                         return -ENOMEM;
 626
 627                 if (keep_groups) {
 628                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 629                                 free(gids);
 630                                 return -errno;
 631                         }
 632                 } else
 633                         k = 0;
 634
 635                 STRV_FOREACH(i, context->supplementary_groups) {
 636                         const char *g;
 637
 638                         if (k >= ngroups_max) {
 639                                 free(gids);
 640                                 return -E2BIG;
 641                         }
 642
 643                         g = *i;
 644                         r = get_group_creds(&g, gids+k);
 645                         if (r < 0) {
 646                                 free(gids);
 647                                 return r;
 648                         }
 649
 650                         k++;
 651                 }
 652
 653                 if (setgroups(k, gids) < 0) {
 654                         free(gids);
 655                         return -errno;
 656                 }
 657
 658                 free(gids);
 659         }
 660
 661         return 0;
 662 }
 663
 664 static int enforce_user(const ExecContext *context, uid_t uid) {
 665         assert(context);
 666
 667         /* Sets (but doesn't lookup) the uid and make sure we keep the
 668          * capabilities while doing so. */
 669
 670         if (context->capabilities) {
 671                 _cleanup_cap_free_ cap_t d = NULL;
 672                 static const cap_value_t bits[] = {
 673                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 674                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 675                 };
 676
 677                 /* First step: If we need to keep capabilities but
 678                  * drop privileges we need to make sure we keep our
 679                  * caps, while we drop privileges. */
 680                 if (uid != 0) {
 681                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 682
 683                         if (prctl(PR_GET_SECUREBITS) != sb)
 684                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 685                                         return -errno;
 686                 }
 687
 688                 /* Second step: set the capabilities. This will reduce
 689                  * the capabilities to the minimum we need. */
 690
 691                 d = cap_dup(context->capabilities);
 692                 if (!d)
 693                         return -errno;
 694
 695                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 696                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0)
 697                         return -errno;
 698
 699                 if (cap_set_proc(d) < 0)
 700                         return -errno;
 701         }
 702
 703         /* Third step: actually set the uids */
 704         if (setresuid(uid, uid, uid) < 0)
 705                 return -errno;
 706
 707         /* At this point we should have all necessary capabilities but
 708            are otherwise a normal user. However, the caps might got
 709            corrupted due to the setresuid() so we need clean them up
 710            later. This is done outside of this call. */
 711
 712         return 0;
 713 }
 714
 715 #ifdef HAVE_PAM
 716
 717 static int null_conv(
 718                 int num_msg,
 719                 const struct pam_message **msg,
 720                 struct pam_response **resp,
 721                 void *appdata_ptr) {
 722
 723         /* We don't support conversations */
 724
 725         return PAM_CONV_ERR;
 726 }
 727
 728 static int setup_pam(
 729                 const char *name,
 730                 const char *user,
 731                 uid_t uid,
 732                 const char *tty,
 733                 char ***pam_env,
 734                 int fds[], unsigned n_fds) {
 735
 736         static const struct pam_conv conv = {
 737                 .conv = null_conv,
 738                 .appdata_ptr = NULL
 739         };
 740
 741         pam_handle_t *handle = NULL;
 742         sigset_t ss, old_ss;
 743         int pam_code = PAM_SUCCESS;
 744         int err;
 745         char **e = NULL;
 746         bool close_session = false;
 747         pid_t pam_pid = 0, parent_pid;
 748         int flags = 0;
 749
 750         assert(name);
 751         assert(user);
 752         assert(pam_env);
 753
 754         /* We set up PAM in the parent process, then fork. The child
 755          * will then stay around until killed via PR_GET_PDEATHSIG or
 756          * systemd via the cgroup logic. It will then remove the PAM
 757          * session again. The parent process will exec() the actual
 758          * daemon. We do things this way to ensure that the main PID
 759          * of the daemon is the one we initially fork()ed. */
 760
 761         if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
 762                 flags |= PAM_SILENT;
 763
 764         pam_code = pam_start(name, user, &conv, &handle);
 765         if (pam_code != PAM_SUCCESS) {
 766                 handle = NULL;
 767                 goto fail;
 768         }
 769
 770         if (tty) {
 771                 pam_code = pam_set_item(handle, PAM_TTY, tty);
 772                 if (pam_code != PAM_SUCCESS)
 773                         goto fail;
 774         }
 775
 776         pam_code = pam_acct_mgmt(handle, flags);
 777         if (pam_code != PAM_SUCCESS)
 778                 goto fail;
 779
 780         pam_code = pam_open_session(handle, flags);
 781         if (pam_code != PAM_SUCCESS)
 782                 goto fail;
 783
 784         close_session = true;
 785
 786         e = pam_getenvlist(handle);
 787         if (!e) {
 788                 pam_code = PAM_BUF_ERR;
 789                 goto fail;
 790         }
 791
 792         /* Block SIGTERM, so that we know that it won't get lost in
 793          * the child */
 794         if (sigemptyset(&ss) < 0 ||
 795             sigaddset(&ss, SIGTERM) < 0 ||
 796             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 797                 goto fail;
 798
 799         parent_pid = getpid();
 800
 801         pam_pid = fork();
 802         if (pam_pid < 0)
 803                 goto fail;
 804
 805         if (pam_pid == 0) {
 806                 int sig;
 807                 int r = EXIT_PAM;
 808
 809                 /* The child's job is to reset the PAM session on
 810                  * termination */
 811
 812                 /* This string must fit in 10 chars (i.e. the length
 813                  * of "/sbin/init"), to look pretty in /bin/ps */
 814                 rename_process("(sd-pam)");
 815
 816                 /* Make sure we don't keep open the passed fds in this
 817                 child. We assume that otherwise only those fds are
 818                 open here that have been opened by PAM. */
 819                 close_many(fds, n_fds);
 820
 821                 /* Drop privileges - we don't need any to pam_close_session
 822                  * and this will make PR_SET_PDEATHSIG work in most cases.
 823                  * If this fails, ignore the error - but expect sd-pam threads
 824                  * to fail to exit normally */
 825                 if (setresuid(uid, uid, uid) < 0)
 826                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 827
 828                 /* Wait until our parent died. This will only work if
 829                  * the above setresuid() succeeds, otherwise the kernel
 830                  * will not allow unprivileged parents kill their privileged
 831                  * children this way. We rely on the control groups kill logic
 832                  * to do the rest for us. */
 833                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 834                         goto child_finish;
 835
 836                 /* Check if our parent process might already have
 837                  * died? */
 838                 if (getppid() == parent_pid) {
 839                         for (;;) {
 840                                 if (sigwait(&ss, &sig) < 0) {
 841                                         if (errno == EINTR)
 842                                                 continue;
 843
 844                                         goto child_finish;
 845                                 }
 846
 847                                 assert(sig == SIGTERM);
 848                                 break;
 849                         }
 850                 }
 851
 852                 /* If our parent died we'll end the session */
 853                 if (getppid() != parent_pid) {
 854                         pam_code = pam_close_session(handle, flags);
 855                         if (pam_code != PAM_SUCCESS)
 856                                 goto child_finish;
 857                 }
 858
 859                 r = 0;
 860
 861         child_finish:
 862                 pam_end(handle, pam_code | flags);
 863                 _exit(r);
 864         }
 865
 866         /* If the child was forked off successfully it will do all the
 867          * cleanups, so forget about the handle here. */
 868         handle = NULL;
 869
 870         /* Unblock SIGTERM again in the parent */
 871         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 872                 goto fail;
 873
 874         /* We close the log explicitly here, since the PAM modules
 875          * might have opened it, but we don't want this fd around. */
 876         closelog();
 877
 878         *pam_env = e;
 879         e = NULL;
 880
 881         return 0;
 882
 883 fail:
 884         if (pam_code != PAM_SUCCESS) {
 885                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
 886                 err = -EPERM;  /* PAM errors do not map to errno */
 887         } else {
 888                 log_error("PAM failed: %m");
 889                 err = -errno;
 890         }
 891
 892         if (handle) {
 893                 if (close_session)
 894                         pam_code = pam_close_session(handle, flags);
 895
 896                 pam_end(handle, pam_code | flags);
 897         }
 898
 899         strv_free(e);
 900
 901         closelog();
 902
 903         if (pam_pid > 1) {
 904                 kill(pam_pid, SIGTERM);
 905                 kill(pam_pid, SIGCONT);
 906         }
 907
 908         return err;
 909 }
 910 #endif
 911
 912 static void rename_process_from_path(const char *path) {
 913         char process_name[11];
 914         const char *p;
 915         size_t l;
 916
 917         /* This resulting string must fit in 10 chars (i.e. the length
 918          * of "/sbin/init") to look pretty in /bin/ps */
 919
 920         p = basename(path);
 921         if (isempty(p)) {
 922                 rename_process("(...)");
 923                 return;
 924         }
 925
 926         l = strlen(p);
 927         if (l > 8) {
 928                 /* The end of the process name is usually more
 929                  * interesting, since the first bit might just be
 930                  * "systemd-" */
 931                 p = p + l - 8;
 932                 l = 8;
 933         }
 934
 935         process_name[0] = '(';
 936         memcpy(process_name+1, p, l);
 937         process_name[1+l] = ')';
 938         process_name[1+l+1] = 0;
 939
 940         rename_process(process_name);
 941 }
 942
 943 #ifdef HAVE_SECCOMP
 944
 945 static int apply_seccomp(ExecContext *c) {
 946         uint32_t negative_action, action;
 947         scmp_filter_ctx *seccomp;
 948         Iterator i;
 949         void *id;
 950         int r;
 951
 952         assert(c);
 953
 954         negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
 955
 956         seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
 957         if (!seccomp)
 958                 return -ENOMEM;
 959
 960         SET_FOREACH(id, c->syscall_archs, i) {
 961                 r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
 962                 if (r == -EEXIST)
 963                         continue;
 964                 if (r < 0) {
 965                         seccomp_release(seccomp);
 966                         return r;
 967                 }
 968         }
 969
 970         action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
 971         SET_FOREACH(id, c->syscall_filter, i) {
 972                 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
 973                 if (r < 0) {
 974                         seccomp_release(seccomp);
 975                         return r;
 976                 }
 977         }
 978
 979         r = seccomp_load(seccomp);
 980         seccomp_release(seccomp);
 981
 982         return r;
 983 }
 984 #endif
 985
 986 static void do_idle_pipe_dance(int idle_pipe[4]) {
 987         assert(idle_pipe);
 988
 989         if (idle_pipe[1] >= 0)
 990                 close_nointr_nofail(idle_pipe[1]);
 991         if (idle_pipe[2] >= 0)
 992                 close_nointr_nofail(idle_pipe[2]);
 993
 994         if (idle_pipe[0] >= 0) {
 995                 int r;
 996
 997                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
 998
 999                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1000                         /* Signal systemd that we are bored and want to continue. */
1001                         write(idle_pipe[3], "x", 1);
1002
1003                         /* Wait for systemd to react to the signal above. */
1004                         fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1005                 }
1006
1007                 close_nointr_nofail(idle_pipe[0]);
1008
1009         }
1010
1011         if (idle_pipe[3] >= 0)
1012                 close_nointr_nofail(idle_pipe[3]);
1013 }
1014
1015 static int build_environment(
1016                 ExecContext *c,
1017                 unsigned n_fds,
1018                 usec_t watchdog_usec,
1019                 const char *home,
1020                 const char *username,
1021                 const char *shell,
1022                 char ***ret) {
1023
1024         _cleanup_strv_free_ char **our_env = NULL;
1025         unsigned n_env = 0;
1026         char *x;
1027
1028         assert(c);
1029         assert(ret);
1030
1031         our_env = new0(char*, 10);
1032         if (!our_env)
1033                 return -ENOMEM;
1034
1035         if (n_fds > 0) {
1036                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
1037                         return -ENOMEM;
1038                 our_env[n_env++] = x;
1039
1040                 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1041                         return -ENOMEM;
1042                 our_env[n_env++] = x;
1043         }
1044
1045         if (watchdog_usec > 0) {
1046                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
1047                         return -ENOMEM;
1048                 our_env[n_env++] = x;
1049
1050                 if (asprintf(&x, "WATCHDOG_USEC=%llu", (unsigned long long) watchdog_usec) < 0)
1051                         return -ENOMEM;
1052                 our_env[n_env++] = x;
1053         }
1054
1055         if (home) {
1056                 x = strappend("HOME=", home);
1057                 if (!x)
1058                         return -ENOMEM;
1059                 our_env[n_env++] = x;
1060         }
1061
1062         if (username) {
1063                 x = strappend("LOGNAME=", username);
1064                 if (!x)
1065                         return -ENOMEM;
1066                 our_env[n_env++] = x;
1067
1068                 x = strappend("USER=", username);
1069                 if (!x)
1070                         return -ENOMEM;
1071                 our_env[n_env++] = x;
1072         }
1073
1074         if (shell) {
1075                 x = strappend("SHELL=", shell);
1076                 if (!x)
1077                         return -ENOMEM;
1078                 our_env[n_env++] = x;
1079         }
1080
1081         if (is_terminal_input(c->std_input) ||
1082             c->std_output == EXEC_OUTPUT_TTY ||
1083             c->std_error == EXEC_OUTPUT_TTY ||
1084             c->tty_path) {
1085
1086                 x = strdup(default_term_for_tty(tty_path(c)));
1087                 if (!x)
1088                         return -ENOMEM;
1089                 our_env[n_env++] = x;
1090         }
1091
1092         our_env[n_env++] = NULL;
1093         assert(n_env <= 10);
1094
1095         *ret = our_env;
1096         our_env = NULL;
1097
1098         return 0;
1099 }
1100
1101 int exec_spawn(ExecCommand *command,
1102                char **argv,
1103                ExecContext *context,
1104                int fds[], unsigned n_fds,
1105                char **environment,
1106                bool apply_permissions,
1107                bool apply_chroot,
1108                bool apply_tty_stdin,
1109                bool confirm_spawn,
1110                CGroupControllerMask cgroup_supported,
1111                const char *cgroup_path,
1112                const char *unit_id,
1113                usec_t watchdog_usec,
1114                int idle_pipe[4],
1115                ExecRuntime *runtime,
1116                pid_t *ret) {
1117
1118         _cleanup_strv_free_ char **files_env = NULL;
1119         int socket_fd;
1120         char *line;
1121         pid_t pid;
1122         int r;
1123
1124         assert(command);
1125         assert(context);
1126         assert(ret);
1127         assert(fds || n_fds <= 0);
1128
1129         if (context->std_input == EXEC_INPUT_SOCKET ||
1130             context->std_output == EXEC_OUTPUT_SOCKET ||
1131             context->std_error == EXEC_OUTPUT_SOCKET) {
1132
1133                 if (n_fds != 1)
1134                         return -EINVAL;
1135
1136                 socket_fd = fds[0];
1137
1138                 fds = NULL;
1139                 n_fds = 0;
1140         } else
1141                 socket_fd = -1;
1142
1143         r = exec_context_load_environment(context, &files_env);
1144         if (r < 0) {
1145                 log_struct_unit(LOG_ERR,
1146                            unit_id,
1147                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1148                            "ERRNO=%d", -r,
1149                            NULL);
1150                 return r;
1151         }
1152
1153         if (!argv)
1154                 argv = command->argv;
1155
1156         line = exec_command_line(argv);
1157         if (!line)
1158                 return log_oom();
1159
1160         log_struct_unit(LOG_DEBUG,
1161                         unit_id,
1162                         "EXECUTABLE=%s", command->path,
1163                         "MESSAGE=About to execute: %s", line,
1164                         NULL);
1165         free(line);
1166
1167         pid = fork();
1168         if (pid < 0)
1169                 return -errno;
1170
1171         if (pid == 0) {
1172                 _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
1173                 const char *username = NULL, *home = NULL, *shell = NULL;
1174                 unsigned n_dont_close = 0;
1175                 int dont_close[n_fds + 3];
1176                 uid_t uid = (uid_t) -1;
1177                 gid_t gid = (gid_t) -1;
1178                 sigset_t ss;
1179                 int i, err;
1180
1181                 /* child */
1182
1183                 rename_process_from_path(command->path);
1184
1185                 /* We reset exactly these signals, since they are the
1186                  * only ones we set to SIG_IGN in the main daemon. All
1187                  * others we leave untouched because we set them to
1188                  * SIG_DFL or a valid handler initially, both of which
1189                  * will be demoted to SIG_DFL. */
1190                 default_signals(SIGNALS_CRASH_HANDLER,
1191                                 SIGNALS_IGNORE, -1);
1192
1193                 if (context->ignore_sigpipe)
1194                         ignore_signals(SIGPIPE, -1);
1195
1196                 assert_se(sigemptyset(&ss) == 0);
1197                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1198                         err = -errno;
1199                         r = EXIT_SIGNAL_MASK;
1200                         goto fail_child;
1201                 }
1202
1203                 if (idle_pipe)
1204                         do_idle_pipe_dance(idle_pipe);
1205
1206                 /* Close sockets very early to make sure we don't
1207                  * block init reexecution because it cannot bind its
1208                  * sockets */
1209                 log_forget_fds();
1210
1211                 if (socket_fd >= 0)
1212                         dont_close[n_dont_close++] = socket_fd;
1213                 if (n_fds > 0) {
1214                         memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1215                         n_dont_close += n_fds;
1216                 }
1217                 if (runtime) {
1218                         if (runtime->netns_storage_socket[0] >= 0)
1219                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
1220                         if (runtime->netns_storage_socket[1] >= 0)
1221                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
1222                 }
1223
1224                 err = close_all_fds(dont_close, n_dont_close);
1225                 if (err < 0) {
1226                         r = EXIT_FDS;
1227                         goto fail_child;
1228                 }
1229
1230                 if (!context->same_pgrp)
1231                         if (setsid() < 0) {
1232                                 err = -errno;
1233                                 r = EXIT_SETSID;
1234                                 goto fail_child;
1235                         }
1236
1237                 if (context->tcpwrap_name) {
1238                         if (socket_fd >= 0)
1239                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1240                                         err = -EACCES;
1241                                         r = EXIT_TCPWRAP;
1242                                         goto fail_child;
1243                                 }
1244
1245                         for (i = 0; i < (int) n_fds; i++) {
1246                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1247                                         err = -EACCES;
1248                                         r = EXIT_TCPWRAP;
1249                                         goto fail_child;
1250                                 }
1251                         }
1252                 }
1253
1254                 exec_context_tty_reset(context);
1255
1256                 if (confirm_spawn) {
1257                         char response;
1258
1259                         err = ask_for_confirmation(&response, argv);
1260                         if (err == -ETIMEDOUT)
1261                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1262                         else if (err < 0)
1263                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1264                         else if (response == 's') {
1265                                 write_confirm_message("Skipping execution.\n");
1266                                 err = -ECANCELED;
1267                                 r = EXIT_CONFIRM;
1268                                 goto fail_child;
1269                         } else if (response == 'n') {
1270                                 write_confirm_message("Failing execution.\n");
1271                                 err = r = 0;
1272                                 goto fail_child;
1273                         }
1274                 }
1275
1276                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1277                  * must sure to drop O_NONBLOCK */
1278                 if (socket_fd >= 0)
1279                         fd_nonblock(socket_fd, false);
1280
1281                 err = setup_input(context, socket_fd, apply_tty_stdin);
1282                 if (err < 0) {
1283                         r = EXIT_STDIN;
1284                         goto fail_child;
1285                 }
1286
1287                 err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1288                 if (err < 0) {
1289                         r = EXIT_STDOUT;
1290                         goto fail_child;
1291                 }
1292
1293                 err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1294                 if (err < 0) {
1295                         r = EXIT_STDERR;
1296                         goto fail_child;
1297                 }
1298
1299                 if (cgroup_path) {
1300                         err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
1301                         if (err < 0) {
1302                                 r = EXIT_CGROUP;
1303                                 goto fail_child;
1304                         }
1305                 }
1306
1307                 if (context->oom_score_adjust_set) {
1308                         char t[16];
1309
1310                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1311                         char_array_0(t);
1312
1313                         if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
1314                                 err = -errno;
1315                                 r = EXIT_OOM_ADJUST;
1316                                 goto fail_child;
1317                         }
1318                 }
1319
1320                 if (context->nice_set)
1321                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1322                                 err = -errno;
1323                                 r = EXIT_NICE;
1324                                 goto fail_child;
1325                         }
1326
1327                 if (context->cpu_sched_set) {
1328                         struct sched_param param = {
1329                                 .sched_priority = context->cpu_sched_priority,
1330                         };
1331
1332                         r = sched_setscheduler(0,
1333                                                context->cpu_sched_policy |
1334                                                (context->cpu_sched_reset_on_fork ?
1335                                                 SCHED_RESET_ON_FORK : 0),
1336                                                &param);
1337                         if (r < 0) {
1338                                 err = -errno;
1339                                 r = EXIT_SETSCHEDULER;
1340                                 goto fail_child;
1341                         }
1342                 }
1343
1344                 if (context->cpuset)
1345                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1346                                 err = -errno;
1347                                 r = EXIT_CPUAFFINITY;
1348                                 goto fail_child;
1349                         }
1350
1351                 if (context->ioprio_set)
1352                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1353                                 err = -errno;
1354                                 r = EXIT_IOPRIO;
1355                                 goto fail_child;
1356                         }
1357
1358                 if (context->timer_slack_nsec != (nsec_t) -1)
1359                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1360                                 err = -errno;
1361                                 r = EXIT_TIMERSLACK;
1362                                 goto fail_child;
1363                         }
1364
1365                 if (context->utmp_id)
1366                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1367
1368                 if (context->user) {
1369                         username = context->user;
1370                         err = get_user_creds(&username, &uid, &gid, &home, &shell);
1371                         if (err < 0) {
1372                                 r = EXIT_USER;
1373                                 goto fail_child;
1374                         }
1375
1376                         if (is_terminal_input(context->std_input)) {
1377                                 err = chown_terminal(STDIN_FILENO, uid);
1378                                 if (err < 0) {
1379                                         r = EXIT_STDIN;
1380                                         goto fail_child;
1381                                 }
1382                         }
1383                 }
1384
1385 #ifdef HAVE_PAM
1386                 if (cgroup_path && context->user && context->pam_name) {
1387                         err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
1388                         if (err < 0) {
1389                                 r = EXIT_CGROUP;
1390                                 goto fail_child;
1391                         }
1392
1393
1394                         err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
1395                         if (err < 0) {
1396                                 r = EXIT_CGROUP;
1397                                 goto fail_child;
1398                         }
1399                 }
1400 #endif
1401
1402                 if (apply_permissions) {
1403                         err = enforce_groups(context, username, gid);
1404                         if (err < 0) {
1405                                 r = EXIT_GROUP;
1406                                 goto fail_child;
1407                         }
1408                 }
1409
1410                 umask(context->umask);
1411
1412 #ifdef HAVE_PAM
1413                 if (apply_permissions && context->pam_name && username) {
1414                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1415                         if (err < 0) {
1416                                 r = EXIT_PAM;
1417                                 goto fail_child;
1418                         }
1419                 }
1420 #endif
1421                 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
1422                         err = setup_netns(runtime->netns_storage_socket);
1423                         if (err < 0) {
1424                                 r = EXIT_NETWORK;
1425                                 goto fail_child;
1426                         }
1427                 }
1428
1429                 if (!strv_isempty(context->read_write_dirs) ||
1430                     !strv_isempty(context->read_only_dirs) ||
1431                     !strv_isempty(context->inaccessible_dirs) ||
1432                     context->mount_flags != 0 ||
1433                     (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
1434                     context->private_devices) {
1435
1436                         char *tmp = NULL, *var = NULL;
1437
1438                         /* The runtime struct only contains the parent
1439                          * of the private /tmp, which is
1440                          * non-accessible to world users. Inside of it
1441                          * there's a /tmp that is sticky, and that's
1442                          * the one we want to use here. */
1443
1444                         if (context->private_tmp && runtime) {
1445                                 if (runtime->tmp_dir)
1446                                         tmp = strappenda(runtime->tmp_dir, "/tmp");
1447                                 if (runtime->var_tmp_dir)
1448                                         var = strappenda(runtime->var_tmp_dir, "/tmp");
1449                         }
1450
1451                         err = setup_namespace(
1452                                         context->read_write_dirs,
1453                                         context->read_only_dirs,
1454                                         context->inaccessible_dirs,
1455                                         tmp,
1456                                         var,
1457                                         context->private_devices,
1458                                         context->mount_flags);
1459
1460                         if (err < 0) {
1461                                 r = EXIT_NAMESPACE;
1462                                 goto fail_child;
1463                         }
1464                 }
1465
1466                 if (apply_chroot) {
1467                         if (context->root_directory)
1468                                 if (chroot(context->root_directory) < 0) {
1469                                         err = -errno;
1470                                         r = EXIT_CHROOT;
1471                                         goto fail_child;
1472                                 }
1473
1474                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1475                                 err = -errno;
1476                                 r = EXIT_CHDIR;
1477                                 goto fail_child;
1478                         }
1479                 } else {
1480                         _cleanup_free_ char *d = NULL;
1481
1482                         if (asprintf(&d, "%s/%s",
1483                                      context->root_directory ? context->root_directory : "",
1484                                      context->working_directory ? context->working_directory : "") < 0) {
1485                                 err = -ENOMEM;
1486                                 r = EXIT_MEMORY;
1487                                 goto fail_child;
1488                         }
1489
1490                         if (chdir(d) < 0) {
1491                                 err = -errno;
1492                                 r = EXIT_CHDIR;
1493                                 goto fail_child;
1494                         }
1495                 }
1496
1497                 /* We repeat the fd closing here, to make sure that
1498                  * nothing is leaked from the PAM modules */
1499                 err = close_all_fds(fds, n_fds);
1500                 if (err >= 0)
1501                         err = shift_fds(fds, n_fds);
1502                 if (err >= 0)
1503                         err = flags_fds(fds, n_fds, context->non_blocking);
1504                 if (err < 0) {
1505                         r = EXIT_FDS;
1506                         goto fail_child;
1507                 }
1508
1509                 if (apply_permissions) {
1510
1511                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1512                                 if (!context->rlimit[i])
1513                                         continue;
1514
1515                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1516                                         err = -errno;
1517                                         r = EXIT_LIMITS;
1518                                         goto fail_child;
1519                                 }
1520                         }
1521
1522                         if (context->capability_bounding_set_drop) {
1523                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1524                                 if (err < 0) {
1525                                         r = EXIT_CAPABILITIES;
1526                                         goto fail_child;
1527                                 }
1528                         }
1529
1530                         if (context->user) {
1531                                 err = enforce_user(context, uid);
1532                                 if (err < 0) {
1533                                         r = EXIT_USER;
1534                                         goto fail_child;
1535                                 }
1536                         }
1537
1538                         /* PR_GET_SECUREBITS is not privileged, while
1539                          * PR_SET_SECUREBITS is. So to suppress
1540                          * potential EPERMs we'll try not to call
1541                          * PR_SET_SECUREBITS unless necessary. */
1542                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1543                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1544                                         err = -errno;
1545                                         r = EXIT_SECUREBITS;
1546                                         goto fail_child;
1547                                 }
1548
1549                         if (context->capabilities)
1550                                 if (cap_set_proc(context->capabilities) < 0) {
1551                                         err = -errno;
1552                                         r = EXIT_CAPABILITIES;
1553                                         goto fail_child;
1554                                 }
1555
1556                         if (context->no_new_privileges)
1557                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1558                                         err = -errno;
1559                                         r = EXIT_NO_NEW_PRIVILEGES;
1560                                         goto fail_child;
1561                                 }
1562
1563 #ifdef HAVE_SECCOMP
1564                         if (context->syscall_filter || context->syscall_archs) {
1565                                 err = apply_seccomp(context);
1566                                 if (err < 0) {
1567                                         r = EXIT_SECCOMP;
1568                                         goto fail_child;
1569                                 }
1570                         }
1571 #endif
1572
1573 #ifdef HAVE_SELINUX
1574                         if (context->selinux_context && use_selinux()) {
1575                                 err = setexeccon(context->selinux_context);
1576                                 if (err < 0 && !context->selinux_context_ignore) {
1577                                         r = EXIT_SELINUX_CONTEXT;
1578                                         goto fail_child;
1579                                 }
1580                         }
1581 #endif
1582                 }
1583
1584                 err = build_environment(context, n_fds, watchdog_usec, home, username, shell, &our_env);
1585                 if (r < 0) {
1586                         r = EXIT_MEMORY;
1587                         goto fail_child;
1588                 }
1589
1590                 final_env = strv_env_merge(5,
1591                                            environment,
1592                                            our_env,
1593                                            context->environment,
1594                                            files_env,
1595                                            pam_env,
1596                                            NULL);
1597                 if (!final_env) {
1598                         err = -ENOMEM;
1599                         r = EXIT_MEMORY;
1600                         goto fail_child;
1601                 }
1602
1603                 final_argv = replace_env_argv(argv, final_env);
1604                 if (!final_argv) {
1605                         err = -ENOMEM;
1606                         r = EXIT_MEMORY;
1607                         goto fail_child;
1608                 }
1609
1610                 final_env = strv_env_clean(final_env);
1611
1612                 if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
1613                         line = exec_command_line(final_argv);
1614                         if (line) {
1615                                 log_open();
1616                                 log_struct_unit(LOG_DEBUG,
1617                                                 unit_id,
1618                                                 "EXECUTABLE=%s", command->path,
1619                                                 "MESSAGE=Executing: %s", line,
1620                                                 NULL);
1621                                 log_close();
1622                                 free(line);
1623                                 line = NULL;
1624                         }
1625                 }
1626                 execve(command->path, final_argv, final_env);
1627                 err = -errno;
1628                 r = EXIT_EXEC;
1629
1630         fail_child:
1631                 if (r != 0) {
1632                         log_open();
1633                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1634                                    "EXECUTABLE=%s", command->path,
1635                                    "MESSAGE=Failed at step %s spawning %s: %s",
1636                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1637                                           command->path, strerror(-err),
1638                                    "ERRNO=%d", -err,
1639                                    NULL);
1640                         log_close();
1641                 }
1642
1643                 _exit(r);
1644         }
1645
1646         log_struct_unit(LOG_DEBUG,
1647                         unit_id,
1648                         "MESSAGE=Forked %s as "PID_FMT,
1649                         command->path, pid,
1650                         NULL);
1651
1652         /* We add the new process to the cgroup both in the child (so
1653          * that we can be sure that no user code is ever executed
1654          * outside of the cgroup) and in the parent (so that we can be
1655          * sure that when we kill the cgroup the process will be
1656          * killed too). */
1657         if (cgroup_path)
1658                 cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
1659
1660         exec_status_start(&command->exec_status, pid);
1661
1662         *ret = pid;
1663         return 0;
1664 }
1665
1666 void exec_context_init(ExecContext *c) {
1667         assert(c);
1668
1669         c->umask = 0022;
1670         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1671         c->cpu_sched_policy = SCHED_OTHER;
1672         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1673         c->syslog_level_prefix = true;
1674         c->ignore_sigpipe = true;
1675         c->timer_slack_nsec = (nsec_t) -1;
1676 }
1677
1678 void exec_context_done(ExecContext *c) {
1679         unsigned l;
1680
1681         assert(c);
1682
1683         strv_free(c->environment);
1684         c->environment = NULL;
1685
1686         strv_free(c->environment_files);
1687         c->environment_files = NULL;
1688
1689         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1690                 free(c->rlimit[l]);
1691                 c->rlimit[l] = NULL;
1692         }
1693
1694         free(c->working_directory);
1695         c->working_directory = NULL;
1696         free(c->root_directory);
1697         c->root_directory = NULL;
1698
1699         free(c->tty_path);
1700         c->tty_path = NULL;
1701
1702         free(c->tcpwrap_name);
1703         c->tcpwrap_name = NULL;
1704
1705         free(c->syslog_identifier);
1706         c->syslog_identifier = NULL;
1707
1708         free(c->user);
1709         c->user = NULL;
1710
1711         free(c->group);
1712         c->group = NULL;
1713
1714         strv_free(c->supplementary_groups);
1715         c->supplementary_groups = NULL;
1716
1717         free(c->pam_name);
1718         c->pam_name = NULL;
1719
1720         if (c->capabilities) {
1721                 cap_free(c->capabilities);
1722                 c->capabilities = NULL;
1723         }
1724
1725         strv_free(c->read_only_dirs);
1726         c->read_only_dirs = NULL;
1727
1728         strv_free(c->read_write_dirs);
1729         c->read_write_dirs = NULL;
1730
1731         strv_free(c->inaccessible_dirs);
1732         c->inaccessible_dirs = NULL;
1733
1734         if (c->cpuset)
1735                 CPU_FREE(c->cpuset);
1736
1737         free(c->utmp_id);
1738         c->utmp_id = NULL;
1739
1740         free(c->selinux_context);
1741         c->selinux_context = NULL;
1742
1743 #ifdef HAVE_SECCOMP
1744         set_free(c->syscall_filter);
1745         c->syscall_filter = NULL;
1746
1747         set_free(c->syscall_archs);
1748         c->syscall_archs = NULL;
1749 #endif
1750 }
1751
1752 void exec_command_done(ExecCommand *c) {
1753         assert(c);
1754
1755         free(c->path);
1756         c->path = NULL;
1757
1758         strv_free(c->argv);
1759         c->argv = NULL;
1760 }
1761
1762 void exec_command_done_array(ExecCommand *c, unsigned n) {
1763         unsigned i;
1764
1765         for (i = 0; i < n; i++)
1766                 exec_command_done(c+i);
1767 }
1768
1769 void exec_command_free_list(ExecCommand *c) {
1770         ExecCommand *i;
1771
1772         while ((i = c)) {
1773                 LIST_REMOVE(command, c, i);
1774                 exec_command_done(i);
1775                 free(i);
1776         }
1777 }
1778
1779 void exec_command_free_array(ExecCommand **c, unsigned n) {
1780         unsigned i;
1781
1782         for (i = 0; i < n; i++) {
1783                 exec_command_free_list(c[i]);
1784                 c[i] = NULL;
1785         }
1786 }
1787
1788 int exec_context_load_environment(const ExecContext *c, char ***l) {
1789         char **i, **r = NULL;
1790
1791         assert(c);
1792         assert(l);
1793
1794         STRV_FOREACH(i, c->environment_files) {
1795                 char *fn;
1796                 int k;
1797                 bool ignore = false;
1798                 char **p;
1799                 _cleanup_globfree_ glob_t pglob = {};
1800                 int count, n;
1801
1802                 fn = *i;
1803
1804                 if (fn[0] == '-') {
1805                         ignore = true;
1806                         fn ++;
1807                 }
1808
1809                 if (!path_is_absolute(fn)) {
1810                         if (ignore)
1811                                 continue;
1812
1813                         strv_free(r);
1814                         return -EINVAL;
1815                 }
1816
1817                 /* Filename supports globbing, take all matching files */
1818                 errno = 0;
1819                 if (glob(fn, 0, NULL, &pglob) != 0) {
1820                         if (ignore)
1821                                 continue;
1822
1823                         strv_free(r);
1824                         return errno ? -errno : -EINVAL;
1825                 }
1826                 count = pglob.gl_pathc;
1827                 if (count == 0) {
1828                         if (ignore)
1829                                 continue;
1830
1831                         strv_free(r);
1832                         return -EINVAL;
1833                 }
1834                 for (n = 0; n < count; n++) {
1835                         k = load_env_file(pglob.gl_pathv[n], NULL, &p);
1836                         if (k < 0) {
1837                                 if (ignore)
1838                                         continue;
1839
1840                                 strv_free(r);
1841                                 return k;
1842                         }
1843                         /* Log invalid environment variables with filename */
1844                         if (p)
1845                                 p = strv_env_clean_log(p, pglob.gl_pathv[n]);
1846
1847                         if (r == NULL)
1848                                 r = p;
1849                         else {
1850                                 char **m;
1851
1852                                 m = strv_env_merge(2, r, p);
1853                                 strv_free(r);
1854                                 strv_free(p);
1855                                 if (!m)
1856                                         return -ENOMEM;
1857
1858                                 r = m;
1859                         }
1860                 }
1861         }
1862
1863         *l = r;
1864
1865         return 0;
1866 }
1867
1868 static bool tty_may_match_dev_console(const char *tty) {
1869         char *active = NULL, *console;
1870         bool b;
1871
1872         if (startswith(tty, "/dev/"))
1873                 tty += 5;
1874
1875         /* trivial identity? */
1876         if (streq(tty, "console"))
1877                 return true;
1878
1879         console = resolve_dev_console(&active);
1880         /* if we could not resolve, assume it may */
1881         if (!console)
1882                 return true;
1883
1884         /* "tty0" means the active VC, so it may be the same sometimes */
1885         b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
1886         free(active);
1887
1888         return b;
1889 }
1890
1891 bool exec_context_may_touch_console(ExecContext *ec) {
1892         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
1893                 is_terminal_input(ec->std_input) ||
1894                 is_terminal_output(ec->std_output) ||
1895                 is_terminal_output(ec->std_error)) &&
1896                tty_may_match_dev_console(tty_path(ec));
1897 }
1898
1899 static void strv_fprintf(FILE *f, char **l) {
1900         char **g;
1901
1902         assert(f);
1903
1904         STRV_FOREACH(g, l)
1905                 fprintf(f, " %s", *g);
1906 }
1907
1908 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1909         char **e;
1910         unsigned i;
1911
1912         assert(c);
1913         assert(f);
1914
1915         prefix = strempty(prefix);
1916
1917         fprintf(f,
1918                 "%sUMask: %04o\n"
1919                 "%sWorkingDirectory: %s\n"
1920                 "%sRootDirectory: %s\n"
1921                 "%sNonBlocking: %s\n"
1922                 "%sPrivateTmp: %s\n"
1923                 "%sPrivateNetwork: %s\n"
1924                 "%sPrivateDevices: %s\n"
1925                 "%sIgnoreSIGPIPE: %s\n",
1926                 prefix, c->umask,
1927                 prefix, c->working_directory ? c->working_directory : "/",
1928                 prefix, c->root_directory ? c->root_directory : "/",
1929                 prefix, yes_no(c->non_blocking),
1930                 prefix, yes_no(c->private_tmp),
1931                 prefix, yes_no(c->private_network),
1932                 prefix, yes_no(c->private_devices),
1933                 prefix, yes_no(c->ignore_sigpipe));
1934
1935         STRV_FOREACH(e, c->environment)
1936                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1937
1938         STRV_FOREACH(e, c->environment_files)
1939                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1940
1941         if (c->tcpwrap_name)
1942                 fprintf(f,
1943                         "%sTCPWrapName: %s\n",
1944                         prefix, c->tcpwrap_name);
1945
1946         if (c->nice_set)
1947                 fprintf(f,
1948                         "%sNice: %i\n",
1949                         prefix, c->nice);
1950
1951         if (c->oom_score_adjust_set)
1952                 fprintf(f,
1953                         "%sOOMScoreAdjust: %i\n",
1954                         prefix, c->oom_score_adjust);
1955
1956         for (i = 0; i < RLIM_NLIMITS; i++)
1957                 if (c->rlimit[i])
1958                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1959
1960         if (c->ioprio_set) {
1961                 char *class_str;
1962                 int r;
1963
1964                 r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
1965                 if (r < 0)
1966                         class_str = NULL;
1967                 fprintf(f,
1968                         "%sIOSchedulingClass: %s\n"
1969                         "%sIOPriority: %i\n",
1970                         prefix, strna(class_str),
1971                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1972                 free(class_str);
1973         }
1974
1975         if (c->cpu_sched_set) {
1976                 char *policy_str;
1977                 int r;
1978
1979                 r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
1980                 if (r < 0)
1981                         policy_str = NULL;
1982                 fprintf(f,
1983                         "%sCPUSchedulingPolicy: %s\n"
1984                         "%sCPUSchedulingPriority: %i\n"
1985                         "%sCPUSchedulingResetOnFork: %s\n",
1986                         prefix, strna(policy_str),
1987                         prefix, c->cpu_sched_priority,
1988                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1989                 free(policy_str);
1990         }
1991
1992         if (c->cpuset) {
1993                 fprintf(f, "%sCPUAffinity:", prefix);
1994                 for (i = 0; i < c->cpuset_ncpus; i++)
1995                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1996                                 fprintf(f, " %u", i);
1997                 fputs("\n", f);
1998         }
1999
2000         if (c->timer_slack_nsec != (nsec_t) -1)
2001                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
2002
2003         fprintf(f,
2004                 "%sStandardInput: %s\n"
2005                 "%sStandardOutput: %s\n"
2006                 "%sStandardError: %s\n",
2007                 prefix, exec_input_to_string(c->std_input),
2008                 prefix, exec_output_to_string(c->std_output),
2009                 prefix, exec_output_to_string(c->std_error));
2010
2011         if (c->tty_path)
2012                 fprintf(f,
2013                         "%sTTYPath: %s\n"
2014                         "%sTTYReset: %s\n"
2015                         "%sTTYVHangup: %s\n"
2016                         "%sTTYVTDisallocate: %s\n",
2017                         prefix, c->tty_path,
2018                         prefix, yes_no(c->tty_reset),
2019                         prefix, yes_no(c->tty_vhangup),
2020                         prefix, yes_no(c->tty_vt_disallocate));
2021
2022         if (c->std_output == EXEC_OUTPUT_SYSLOG ||
2023             c->std_output == EXEC_OUTPUT_KMSG ||
2024             c->std_output == EXEC_OUTPUT_JOURNAL ||
2025             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2026             c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2027             c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
2028             c->std_error == EXEC_OUTPUT_SYSLOG ||
2029             c->std_error == EXEC_OUTPUT_KMSG ||
2030             c->std_error == EXEC_OUTPUT_JOURNAL ||
2031             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2032             c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2033             c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
2034
2035                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
2036
2037                 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
2038                 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
2039
2040                 fprintf(f,
2041                         "%sSyslogFacility: %s\n"
2042                         "%sSyslogLevel: %s\n",
2043                         prefix, strna(fac_str),
2044                         prefix, strna(lvl_str));
2045         }
2046
2047         if (c->capabilities) {
2048                 _cleanup_cap_free_charp_ char *t;
2049
2050                 t = cap_to_text(c->capabilities, NULL);
2051                 if (t)
2052                         fprintf(f, "%sCapabilities: %s\n", prefix, t);
2053         }
2054
2055         if (c->secure_bits)
2056                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
2057                         prefix,
2058                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
2059                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
2060                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
2061                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
2062                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
2063                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
2064
2065         if (c->capability_bounding_set_drop) {
2066                 unsigned long l;
2067                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
2068
2069                 for (l = 0; l <= cap_last_cap(); l++)
2070                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
2071                                 _cleanup_cap_free_charp_ char *t;
2072
2073                                 t = cap_to_name(l);
2074                                 if (t)
2075                                         fprintf(f, " %s", t);
2076                         }
2077
2078                 fputs("\n", f);
2079         }
2080
2081         if (c->user)
2082                 fprintf(f, "%sUser: %s\n", prefix, c->user);
2083         if (c->group)
2084                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
2085
2086         if (strv_length(c->supplementary_groups) > 0) {
2087                 fprintf(f, "%sSupplementaryGroups:", prefix);
2088                 strv_fprintf(f, c->supplementary_groups);
2089                 fputs("\n", f);
2090         }
2091
2092         if (c->pam_name)
2093                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
2094
2095         if (strv_length(c->read_write_dirs) > 0) {
2096                 fprintf(f, "%sReadWriteDirs:", prefix);
2097                 strv_fprintf(f, c->read_write_dirs);
2098                 fputs("\n", f);
2099         }
2100
2101         if (strv_length(c->read_only_dirs) > 0) {
2102                 fprintf(f, "%sReadOnlyDirs:", prefix);
2103                 strv_fprintf(f, c->read_only_dirs);
2104                 fputs("\n", f);
2105         }
2106
2107         if (strv_length(c->inaccessible_dirs) > 0) {
2108                 fprintf(f, "%sInaccessibleDirs:", prefix);
2109                 strv_fprintf(f, c->inaccessible_dirs);
2110                 fputs("\n", f);
2111         }
2112
2113         if (c->utmp_id)
2114                 fprintf(f,
2115                         "%sUtmpIdentifier: %s\n",
2116                         prefix, c->utmp_id);
2117
2118         if (c->selinux_context)
2119                 fprintf(f,
2120                         "%sSELinuxContext: %s%s\n",
2121                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
2122
2123         if (c->syscall_filter) {
2124 #ifdef HAVE_SECCOMP
2125                 Iterator j;
2126                 void *id;
2127                 bool first = true;
2128 #endif
2129
2130                 fprintf(f,
2131                         "%sSystemCallFilter: ",
2132                         prefix);
2133
2134                 if (!c->syscall_whitelist)
2135                         fputc('~', f);
2136
2137 #ifdef HAVE_SECCOMP
2138                 SET_FOREACH(id, c->syscall_filter, j) {
2139                         _cleanup_free_ char *name = NULL;
2140
2141                         if (first)
2142                                 first = false;
2143                         else
2144                                 fputc(' ', f);
2145
2146                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
2147                         fputs(strna(name), f);
2148                 }
2149 #endif
2150
2151                 fputc('\n', f);
2152         }
2153
2154         if (c->syscall_archs) {
2155 #ifdef HAVE_SECCOMP
2156                 Iterator j;
2157                 void *id;
2158 #endif
2159
2160                 fprintf(f,
2161                         "%sSystemCallArchitectures:",
2162                         prefix);
2163
2164 #ifdef HAVE_SECCOMP
2165                 SET_FOREACH(id, c->syscall_archs, j)
2166                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
2167 #endif
2168                 fputc('\n', f);
2169         }
2170
2171         if (c->syscall_errno != 0)
2172                 fprintf(f,
2173                         "%sSystemCallErrorNumber: %s\n",
2174                         prefix, strna(errno_to_name(c->syscall_errno)));
2175 }
2176
2177 void exec_status_start(ExecStatus *s, pid_t pid) {
2178         assert(s);
2179
2180         zero(*s);
2181         s->pid = pid;
2182         dual_timestamp_get(&s->start_timestamp);
2183 }
2184
2185 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2186         assert(s);
2187
2188         if (s->pid && s->pid != pid)
2189                 zero(*s);
2190
2191         s->pid = pid;
2192         dual_timestamp_get(&s->exit_timestamp);
2193
2194         s->code = code;
2195         s->status = status;
2196
2197         if (context) {
2198                 if (context->utmp_id)
2199                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2200
2201                 exec_context_tty_reset(context);
2202         }
2203 }
2204
2205 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2206         char buf[FORMAT_TIMESTAMP_MAX];
2207
2208         assert(s);
2209         assert(f);
2210
2211         if (!prefix)
2212                 prefix = "";
2213
2214         if (s->pid <= 0)
2215                 return;
2216
2217         fprintf(f,
2218                 "%sPID: "PID_FMT"\n",
2219                 prefix, s->pid);
2220
2221         if (s->start_timestamp.realtime > 0)
2222                 fprintf(f,
2223                         "%sStart Timestamp: %s\n",
2224                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2225
2226         if (s->exit_timestamp.realtime > 0)
2227                 fprintf(f,
2228                         "%sExit Timestamp: %s\n"
2229                         "%sExit Code: %s\n"
2230                         "%sExit Status: %i\n",
2231                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2232                         prefix, sigchld_code_to_string(s->code),
2233                         prefix, s->status);
2234 }
2235
2236 char *exec_command_line(char **argv) {
2237         size_t k;
2238         char *n, *p, **a;
2239         bool first = true;
2240
2241         assert(argv);
2242
2243         k = 1;
2244         STRV_FOREACH(a, argv)
2245                 k += strlen(*a)+3;
2246
2247         if (!(n = new(char, k)))
2248                 return NULL;
2249
2250         p = n;
2251         STRV_FOREACH(a, argv) {
2252
2253                 if (!first)
2254                         *(p++) = ' ';
2255                 else
2256                         first = false;
2257
2258                 if (strpbrk(*a, WHITESPACE)) {
2259                         *(p++) = '\'';
2260                         p = stpcpy(p, *a);
2261                         *(p++) = '\'';
2262                 } else
2263                         p = stpcpy(p, *a);
2264
2265         }
2266
2267         *p = 0;
2268
2269         /* FIXME: this doesn't really handle arguments that have
2270          * spaces and ticks in them */
2271
2272         return n;
2273 }
2274
2275 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2276         char *p2;
2277         const char *prefix2;
2278
2279         char *cmd;
2280
2281         assert(c);
2282         assert(f);
2283
2284         if (!prefix)
2285                 prefix = "";
2286         p2 = strappend(prefix, "\t");
2287         prefix2 = p2 ? p2 : prefix;
2288
2289         cmd = exec_command_line(c->argv);
2290
2291         fprintf(f,
2292                 "%sCommand Line: %s\n",
2293                 prefix, cmd ? cmd : strerror(ENOMEM));
2294
2295         free(cmd);
2296
2297         exec_status_dump(&c->exec_status, f, prefix2);
2298
2299         free(p2);
2300 }
2301
2302 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2303         assert(f);
2304
2305         if (!prefix)
2306                 prefix = "";
2307
2308         LIST_FOREACH(command, c, c)
2309                 exec_command_dump(c, f, prefix);
2310 }
2311
2312 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2313         ExecCommand *end;
2314
2315         assert(l);
2316         assert(e);
2317
2318         if (*l) {
2319                 /* It's kind of important, that we keep the order here */
2320                 LIST_FIND_TAIL(command, *l, end);
2321                 LIST_INSERT_AFTER(command, *l, end, e);
2322         } else
2323               *l = e;
2324 }
2325
2326 int exec_command_set(ExecCommand *c, const char *path, ...) {
2327         va_list ap;
2328         char **l, *p;
2329
2330         assert(c);
2331         assert(path);
2332
2333         va_start(ap, path);
2334         l = strv_new_ap(path, ap);
2335         va_end(ap);
2336
2337         if (!l)
2338                 return -ENOMEM;
2339
2340         p = strdup(path);
2341         if (!p) {
2342                 strv_free(l);
2343                 return -ENOMEM;
2344         }
2345
2346         free(c->path);
2347         c->path = p;
2348
2349         strv_free(c->argv);
2350         c->argv = l;
2351
2352         return 0;
2353 }
2354
2355 static int exec_runtime_allocate(ExecRuntime **rt) {
2356
2357         if (*rt)
2358                 return 0;
2359
2360         *rt = new0(ExecRuntime, 1);
2361         if (!*rt)
2362                 return -ENOMEM;
2363
2364         (*rt)->n_ref = 1;
2365         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
2366
2367         return 0;
2368 }
2369
2370 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
2371         int r;
2372
2373         assert(rt);
2374         assert(c);
2375         assert(id);
2376
2377         if (*rt)
2378                 return 1;
2379
2380         if (!c->private_network && !c->private_tmp)
2381                 return 0;
2382
2383         r = exec_runtime_allocate(rt);
2384         if (r < 0)
2385                 return r;
2386
2387         if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
2388                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
2389                         return -errno;
2390         }
2391
2392         if (c->private_tmp && !(*rt)->tmp_dir) {
2393                 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
2394                 if (r < 0)
2395                         return r;
2396         }
2397
2398         return 1;
2399 }
2400
2401 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
2402         assert(r);
2403         assert(r->n_ref > 0);
2404
2405         r->n_ref++;
2406         return r;
2407 }
2408
2409 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
2410
2411         if (!r)
2412                 return NULL;
2413
2414         assert(r->n_ref > 0);
2415
2416         r->n_ref--;
2417         if (r->n_ref <= 0) {
2418                 free(r->tmp_dir);
2419                 free(r->var_tmp_dir);
2420                 close_pipe(r->netns_storage_socket);
2421                 free(r);
2422         }
2423
2424         return NULL;
2425 }
2426
2427 int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds) {
2428         assert(u);
2429         assert(f);
2430         assert(fds);
2431
2432         if (!rt)
2433                 return 0;
2434
2435         if (rt->tmp_dir)
2436                 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
2437
2438         if (rt->var_tmp_dir)
2439                 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
2440
2441         if (rt->netns_storage_socket[0] >= 0) {
2442                 int copy;
2443
2444                 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
2445                 if (copy < 0)
2446                         return copy;
2447
2448                 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
2449         }
2450
2451         if (rt->netns_storage_socket[1] >= 0) {
2452                 int copy;
2453
2454                 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
2455                 if (copy < 0)
2456                         return copy;
2457
2458                 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
2459         }
2460
2461         return 0;
2462 }
2463
2464 int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds) {
2465         int r;
2466
2467         assert(rt);
2468         assert(key);
2469         assert(value);
2470
2471         if (streq(key, "tmp-dir")) {
2472                 char *copy;
2473
2474                 r = exec_runtime_allocate(rt);
2475                 if (r < 0)
2476                         return r;
2477
2478                 copy = strdup(value);
2479                 if (!copy)
2480                         return log_oom();
2481
2482                 free((*rt)->tmp_dir);
2483                 (*rt)->tmp_dir = copy;
2484
2485         } else if (streq(key, "var-tmp-dir")) {
2486                 char *copy;
2487
2488                 r = exec_runtime_allocate(rt);
2489                 if (r < 0)
2490                         return r;
2491
2492                 copy = strdup(value);
2493                 if (!copy)
2494                         return log_oom();
2495
2496                 free((*rt)->var_tmp_dir);
2497                 (*rt)->var_tmp_dir = copy;
2498
2499         } else if (streq(key, "netns-socket-0")) {
2500                 int fd;
2501
2502                 r = exec_runtime_allocate(rt);
2503                 if (r < 0)
2504                         return r;
2505
2506                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2507                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2508                 else {
2509                         if ((*rt)->netns_storage_socket[0] >= 0)
2510                                 close_nointr_nofail((*rt)->netns_storage_socket[0]);
2511
2512                         (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
2513                 }
2514         } else if (streq(key, "netns-socket-1")) {
2515                 int fd;
2516
2517                 r = exec_runtime_allocate(rt);
2518                 if (r < 0)
2519                         return r;
2520
2521                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2522                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2523                 else {
2524                         if ((*rt)->netns_storage_socket[1] >= 0)
2525                                 close_nointr_nofail((*rt)->netns_storage_socket[1]);
2526
2527                         (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
2528                 }
2529         } else
2530                 return 0;
2531
2532         return 1;
2533 }
2534
2535 static void *remove_tmpdir_thread(void *p) {
2536         _cleanup_free_ char *path = p;
2537
2538         rm_rf_dangerous(path, false, true, false);
2539         return NULL;
2540 }
2541
2542 void exec_runtime_destroy(ExecRuntime *rt) {
2543         if (!rt)
2544                 return;
2545
2546         /* If there are multiple users of this, let's leave the stuff around */
2547         if (rt->n_ref > 1)
2548                 return;
2549
2550         if (rt->tmp_dir) {
2551                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
2552                 asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
2553                 rt->tmp_dir = NULL;
2554         }
2555
2556         if (rt->var_tmp_dir) {
2557                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
2558                 asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
2559                 rt->var_tmp_dir = NULL;
2560         }
2561
2562         close_pipe(rt->netns_storage_socket);
2563 }
2564
2565 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2566         [EXEC_INPUT_NULL] = "null",
2567         [EXEC_INPUT_TTY] = "tty",
2568         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2569         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2570         [EXEC_INPUT_SOCKET] = "socket"
2571 };
2572
2573 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2574
2575 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2576         [EXEC_OUTPUT_INHERIT] = "inherit",
2577         [EXEC_OUTPUT_NULL] = "null",
2578         [EXEC_OUTPUT_TTY] = "tty",
2579         [EXEC_OUTPUT_SYSLOG] = "syslog",
2580         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2581         [EXEC_OUTPUT_KMSG] = "kmsg",
2582         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2583         [EXEC_OUTPUT_JOURNAL] = "journal",
2584         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2585         [EXEC_OUTPUT_SOCKET] = "socket"
2586 };
2587
2588 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);