src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41 #include <glob.h>
  42 #include <sys/personality.h>
  43 #include <libgen.h>
  44 #undef basename
  45
  46 #ifdef HAVE_PAM
  47 #include <security/pam_appl.h>
  48 #endif
  49
  50 #ifdef HAVE_SELINUX
  51 #include <selinux/selinux.h>
  52 #endif
  53
  54 #ifdef HAVE_SECCOMP
  55 #include <seccomp.h>
  56 #endif
  57
  58 #include "execute.h"
  59 #include "strv.h"
  60 #include "macro.h"
  61 #include "capability.h"
  62 #include "util.h"
  63 #include "log.h"
  64 #include "sd-messages.h"
  65 #include "ioprio.h"
  66 #include "securebits.h"
  67 #include "namespace.h"
  68 #include "tcpwrap.h"
  69 #include "exit-status.h"
  70 #include "missing.h"
  71 #include "utmp-wtmp.h"
  72 #include "def.h"
  73 #include "path-util.h"
  74 #include "env-util.h"
  75 #include "fileio.h"
  76 #include "unit.h"
  77 #include "async.h"
  78 #include "selinux-util.h"
  79 #include "errno-list.h"
  80
  81 #ifdef HAVE_SECCOMP
  82 #include "seccomp-util.h"
  83 #endif
  84
  85 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  86 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
  87
  88 /* This assumes there is a 'tty' group */
  89 #define TTY_MODE 0620
  90
  91 #define SNDBUF_SIZE (8*1024*1024)
  92
  93 static int shift_fds(int fds[], unsigned n_fds) {
  94         int start, restart_from;
  95
  96         if (n_fds <= 0)
  97                 return 0;
  98
  99         /* Modifies the fds array! (sorts it) */
 100
 101         assert(fds);
 102
 103         start = 0;
 104         for (;;) {
 105                 int i;
 106
 107                 restart_from = -1;
 108
 109                 for (i = start; i < (int) n_fds; i++) {
 110                         int nfd;
 111
 112                         /* Already at right index? */
 113                         if (fds[i] == i+3)
 114                                 continue;
 115
 116                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
 117                                 return -errno;
 118
 119                         close_nointr_nofail(fds[i]);
 120                         fds[i] = nfd;
 121
 122                         /* Hmm, the fd we wanted isn't free? Then
 123                          * let's remember that and try again from here*/
 124                         if (nfd != i+3 && restart_from < 0)
 125                                 restart_from = i;
 126                 }
 127
 128                 if (restart_from < 0)
 129                         break;
 130
 131                 start = restart_from;
 132         }
 133
 134         return 0;
 135 }
 136
 137 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 138         unsigned i;
 139         int r;
 140
 141         if (n_fds <= 0)
 142                 return 0;
 143
 144         assert(fds);
 145
 146         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 147
 148         for (i = 0; i < n_fds; i++) {
 149
 150                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 151                         return r;
 152
 153                 /* We unconditionally drop FD_CLOEXEC from the fds,
 154                  * since after all we want to pass these fds to our
 155                  * children */
 156
 157                 if ((r = fd_cloexec(fds[i], false)) < 0)
 158                         return r;
 159         }
 160
 161         return 0;
 162 }
 163
 164 _pure_ static const char *tty_path(const ExecContext *context) {
 165         assert(context);
 166
 167         if (context->tty_path)
 168                 return context->tty_path;
 169
 170         return "/dev/console";
 171 }
 172
 173 static void exec_context_tty_reset(const ExecContext *context) {
 174         assert(context);
 175
 176         if (context->tty_vhangup)
 177                 terminal_vhangup(tty_path(context));
 178
 179         if (context->tty_reset)
 180                 reset_terminal(tty_path(context));
 181
 182         if (context->tty_vt_disallocate && context->tty_path)
 183                 vt_disallocate(context->tty_path);
 184 }
 185
 186 static bool is_terminal_output(ExecOutput o) {
 187         return
 188                 o == EXEC_OUTPUT_TTY ||
 189                 o == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
 190                 o == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
 191                 o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
 192 }
 193
 194 static int open_null_as(int flags, int nfd) {
 195         int fd, r;
 196
 197         assert(nfd >= 0);
 198
 199         fd = open("/dev/null", flags|O_NOCTTY);
 200         if (fd < 0)
 201                 return -errno;
 202
 203         if (fd != nfd) {
 204                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 205                 close_nointr_nofail(fd);
 206         } else
 207                 r = nfd;
 208
 209         return r;
 210 }
 211
 212 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, const char *unit_id, int nfd) {
 213         int fd, r;
 214         union sockaddr_union sa = {
 215                 .un.sun_family = AF_UNIX,
 216                 .un.sun_path = "/run/systemd/journal/stdout",
 217         };
 218
 219         assert(context);
 220         assert(output < _EXEC_OUTPUT_MAX);
 221         assert(ident);
 222         assert(nfd >= 0);
 223
 224         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 225         if (fd < 0)
 226                 return -errno;
 227
 228         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 229         if (r < 0) {
 230                 close_nointr_nofail(fd);
 231                 return -errno;
 232         }
 233
 234         if (shutdown(fd, SHUT_RD) < 0) {
 235                 close_nointr_nofail(fd);
 236                 return -errno;
 237         }
 238
 239         fd_inc_sndbuf(fd, SNDBUF_SIZE);
 240
 241         dprintf(fd,
 242                 "%s\n"
 243                 "%s\n"
 244                 "%i\n"
 245                 "%i\n"
 246                 "%i\n"
 247                 "%i\n"
 248                 "%i\n",
 249                 context->syslog_identifier ? context->syslog_identifier : ident,
 250                 unit_id,
 251                 context->syslog_priority,
 252                 !!context->syslog_level_prefix,
 253                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 254                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 255                 is_terminal_output(output));
 256
 257         if (fd != nfd) {
 258                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 259                 close_nointr_nofail(fd);
 260         } else
 261                 r = nfd;
 262
 263         return r;
 264 }
 265 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 266         int fd, r;
 267
 268         assert(path);
 269         assert(nfd >= 0);
 270
 271         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 272                 return fd;
 273
 274         if (fd != nfd) {
 275                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 276                 close_nointr_nofail(fd);
 277         } else
 278                 r = nfd;
 279
 280         return r;
 281 }
 282
 283 static bool is_terminal_input(ExecInput i) {
 284         return
 285                 i == EXEC_INPUT_TTY ||
 286                 i == EXEC_INPUT_TTY_FORCE ||
 287                 i == EXEC_INPUT_TTY_FAIL;
 288 }
 289
 290 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 291
 292         if (is_terminal_input(std_input) && !apply_tty_stdin)
 293                 return EXEC_INPUT_NULL;
 294
 295         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 296                 return EXEC_INPUT_NULL;
 297
 298         return std_input;
 299 }
 300
 301 static int fixup_output(ExecOutput std_output, int socket_fd) {
 302
 303         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 304                 return EXEC_OUTPUT_INHERIT;
 305
 306         return std_output;
 307 }
 308
 309 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 310         ExecInput i;
 311
 312         assert(context);
 313
 314         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 315
 316         switch (i) {
 317
 318         case EXEC_INPUT_NULL:
 319                 return open_null_as(O_RDONLY, STDIN_FILENO);
 320
 321         case EXEC_INPUT_TTY:
 322         case EXEC_INPUT_TTY_FORCE:
 323         case EXEC_INPUT_TTY_FAIL: {
 324                 int fd, r;
 325
 326                 fd = acquire_terminal(tty_path(context),
 327                                       i == EXEC_INPUT_TTY_FAIL,
 328                                       i == EXEC_INPUT_TTY_FORCE,
 329                                       false,
 330                                       (usec_t) -1);
 331                 if (fd < 0)
 332                         return fd;
 333
 334                 if (fd != STDIN_FILENO) {
 335                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 336                         close_nointr_nofail(fd);
 337                 } else
 338                         r = STDIN_FILENO;
 339
 340                 return r;
 341         }
 342
 343         case EXEC_INPUT_SOCKET:
 344                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 345
 346         default:
 347                 assert_not_reached("Unknown input type");
 348         }
 349 }
 350
 351 static int setup_output(const ExecContext *context, int fileno, int socket_fd, const char *ident, const char *unit_id, bool apply_tty_stdin) {
 352         ExecOutput o;
 353         ExecInput i;
 354         int r;
 355
 356         assert(context);
 357         assert(ident);
 358
 359         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 360         o = fixup_output(context->std_output, socket_fd);
 361
 362         if (fileno == STDERR_FILENO) {
 363                 ExecOutput e;
 364                 e = fixup_output(context->std_error, socket_fd);
 365
 366                 /* This expects the input and output are already set up */
 367
 368                 /* Don't change the stderr file descriptor if we inherit all
 369                  * the way and are not on a tty */
 370                 if (e == EXEC_OUTPUT_INHERIT &&
 371                     o == EXEC_OUTPUT_INHERIT &&
 372                     i == EXEC_INPUT_NULL &&
 373                     !is_terminal_input(context->std_input) &&
 374                     getppid () != 1)
 375                         return fileno;
 376
 377                 /* Duplicate from stdout if possible */
 378                 if (e == o || e == EXEC_OUTPUT_INHERIT)
 379                         return dup2(STDOUT_FILENO, fileno) < 0 ? -errno : fileno;
 380
 381                 o = e;
 382
 383         } else if (o == EXEC_OUTPUT_INHERIT) {
 384                 /* If input got downgraded, inherit the original value */
 385                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 386                         return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 387
 388                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 389                 if (i != EXEC_INPUT_NULL)
 390                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 391
 392                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 393                 if (getppid() != 1)
 394                         return fileno;
 395
 396                 /* We need to open /dev/null here anew, to get the right access mode. */
 397                 return open_null_as(O_WRONLY, fileno);
 398         }
 399
 400         switch (o) {
 401
 402         case EXEC_OUTPUT_NULL:
 403                 return open_null_as(O_WRONLY, fileno);
 404
 405         case EXEC_OUTPUT_TTY:
 406                 if (is_terminal_input(i))
 407                         return dup2(STDIN_FILENO, fileno) < 0 ? -errno : fileno;
 408
 409                 /* We don't reset the terminal if this is just about output */
 410                 return open_terminal_as(tty_path(context), O_WRONLY, fileno);
 411
 412         case EXEC_OUTPUT_SYSLOG:
 413         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 414         case EXEC_OUTPUT_KMSG:
 415         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 416         case EXEC_OUTPUT_JOURNAL:
 417         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 418                 r = connect_logger_as(context, o, ident, unit_id, fileno);
 419                 if (r < 0) {
 420                         log_struct_unit(LOG_CRIT, unit_id,
 421                                 "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
 422                                 fileno == STDOUT_FILENO ? "out" : "err",
 423                                 unit_id, strerror(-r),
 424                                 "ERRNO=%d", -r,
 425                                 NULL);
 426                         r = open_null_as(O_WRONLY, fileno);
 427                 }
 428                 return r;
 429
 430         case EXEC_OUTPUT_SOCKET:
 431                 assert(socket_fd >= 0);
 432                 return dup2(socket_fd, fileno) < 0 ? -errno : fileno;
 433
 434         default:
 435                 assert_not_reached("Unknown error type");
 436         }
 437 }
 438
 439 static int chown_terminal(int fd, uid_t uid) {
 440         struct stat st;
 441
 442         assert(fd >= 0);
 443
 444         /* This might fail. What matters are the results. */
 445         (void) fchown(fd, uid, -1);
 446         (void) fchmod(fd, TTY_MODE);
 447
 448         if (fstat(fd, &st) < 0)
 449                 return -errno;
 450
 451         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 452                 return -EPERM;
 453
 454         return 0;
 455 }
 456
 457 static int setup_confirm_stdio(int *_saved_stdin,
 458                                int *_saved_stdout) {
 459         int fd = -1, saved_stdin, saved_stdout = -1, r;
 460
 461         assert(_saved_stdin);
 462         assert(_saved_stdout);
 463
 464         saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);
 465         if (saved_stdin < 0)
 466                 return -errno;
 467
 468         saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);
 469         if (saved_stdout < 0) {
 470                 r = errno;
 471                 goto fail;
 472         }
 473
 474         fd = acquire_terminal(
 475                         "/dev/console",
 476                         false,
 477                         false,
 478                         false,
 479                         DEFAULT_CONFIRM_USEC);
 480         if (fd < 0) {
 481                 r = fd;
 482                 goto fail;
 483         }
 484
 485         r = chown_terminal(fd, getuid());
 486         if (r < 0)
 487                 goto fail;
 488
 489         if (dup2(fd, STDIN_FILENO) < 0) {
 490                 r = -errno;
 491                 goto fail;
 492         }
 493
 494         if (dup2(fd, STDOUT_FILENO) < 0) {
 495                 r = -errno;
 496                 goto fail;
 497         }
 498
 499         if (fd >= 2)
 500                 close_nointr_nofail(fd);
 501
 502         *_saved_stdin = saved_stdin;
 503         *_saved_stdout = saved_stdout;
 504
 505         return 0;
 506
 507 fail:
 508         if (saved_stdout >= 0)
 509                 close_nointr_nofail(saved_stdout);
 510
 511         if (saved_stdin >= 0)
 512                 close_nointr_nofail(saved_stdin);
 513
 514         if (fd >= 0)
 515                 close_nointr_nofail(fd);
 516
 517         return r;
 518 }
 519
 520 _printf_(1, 2) static int write_confirm_message(const char *format, ...) {
 521         int fd;
 522         va_list ap;
 523
 524         assert(format);
 525
 526         fd = open_terminal("/dev/console", O_WRONLY|O_NOCTTY|O_CLOEXEC);
 527         if (fd < 0)
 528                 return fd;
 529
 530         va_start(ap, format);
 531         vdprintf(fd, format, ap);
 532         va_end(ap);
 533
 534         close_nointr_nofail(fd);
 535
 536         return 0;
 537 }
 538
 539 static int restore_confirm_stdio(int *saved_stdin,
 540                                  int *saved_stdout) {
 541
 542         int r = 0;
 543
 544         assert(saved_stdin);
 545         assert(saved_stdout);
 546
 547         release_terminal();
 548
 549         if (*saved_stdin >= 0)
 550                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 551                         r = -errno;
 552
 553         if (*saved_stdout >= 0)
 554                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 555                         r = -errno;
 556
 557         if (*saved_stdin >= 0)
 558                 close_nointr_nofail(*saved_stdin);
 559
 560         if (*saved_stdout >= 0)
 561                 close_nointr_nofail(*saved_stdout);
 562
 563         return r;
 564 }
 565
 566 static int ask_for_confirmation(char *response, char **argv) {
 567         int saved_stdout = -1, saved_stdin = -1, r;
 568         char *line;
 569
 570         r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
 571         if (r < 0)
 572                 return r;
 573
 574         line = exec_command_line(argv);
 575         if (!line)
 576                 return -ENOMEM;
 577
 578         r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
 579         free(line);
 580
 581         restore_confirm_stdio(&saved_stdin, &saved_stdout);
 582
 583         return r;
 584 }
 585
 586 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 587         bool keep_groups = false;
 588         int r;
 589
 590         assert(context);
 591
 592         /* Lookup and set GID and supplementary group list. Here too
 593          * we avoid NSS lookups for gid=0. */
 594
 595         if (context->group || username) {
 596
 597                 if (context->group) {
 598                         const char *g = context->group;
 599
 600                         if ((r = get_group_creds(&g, &gid)) < 0)
 601                                 return r;
 602                 }
 603
 604                 /* First step, initialize groups from /etc/groups */
 605                 if (username && gid != 0) {
 606                         if (initgroups(username, gid) < 0)
 607                                 return -errno;
 608
 609                         keep_groups = true;
 610                 }
 611
 612                 /* Second step, set our gids */
 613                 if (setresgid(gid, gid, gid) < 0)
 614                         return -errno;
 615         }
 616
 617         if (context->supplementary_groups) {
 618                 int ngroups_max, k;
 619                 gid_t *gids;
 620                 char **i;
 621
 622                 /* Final step, initialize any manually set supplementary groups */
 623                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 624
 625                 if (!(gids = new(gid_t, ngroups_max)))
 626                         return -ENOMEM;
 627
 628                 if (keep_groups) {
 629                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 630                                 free(gids);
 631                                 return -errno;
 632                         }
 633                 } else
 634                         k = 0;
 635
 636                 STRV_FOREACH(i, context->supplementary_groups) {
 637                         const char *g;
 638
 639                         if (k >= ngroups_max) {
 640                                 free(gids);
 641                                 return -E2BIG;
 642                         }
 643
 644                         g = *i;
 645                         r = get_group_creds(&g, gids+k);
 646                         if (r < 0) {
 647                                 free(gids);
 648                                 return r;
 649                         }
 650
 651                         k++;
 652                 }
 653
 654                 if (setgroups(k, gids) < 0) {
 655                         free(gids);
 656                         return -errno;
 657                 }
 658
 659                 free(gids);
 660         }
 661
 662         return 0;
 663 }
 664
 665 static int enforce_user(const ExecContext *context, uid_t uid) {
 666         assert(context);
 667
 668         /* Sets (but doesn't lookup) the uid and make sure we keep the
 669          * capabilities while doing so. */
 670
 671         if (context->capabilities) {
 672                 _cleanup_cap_free_ cap_t d = NULL;
 673                 static const cap_value_t bits[] = {
 674                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 675                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 676                 };
 677
 678                 /* First step: If we need to keep capabilities but
 679                  * drop privileges we need to make sure we keep our
 680                  * caps, while we drop privileges. */
 681                 if (uid != 0) {
 682                         int sb = context->secure_bits | 1<<SECURE_KEEP_CAPS;
 683
 684                         if (prctl(PR_GET_SECUREBITS) != sb)
 685                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 686                                         return -errno;
 687                 }
 688
 689                 /* Second step: set the capabilities. This will reduce
 690                  * the capabilities to the minimum we need. */
 691
 692                 d = cap_dup(context->capabilities);
 693                 if (!d)
 694                         return -errno;
 695
 696                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 697                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0)
 698                         return -errno;
 699
 700                 if (cap_set_proc(d) < 0)
 701                         return -errno;
 702         }
 703
 704         /* Third step: actually set the uids */
 705         if (setresuid(uid, uid, uid) < 0)
 706                 return -errno;
 707
 708         /* At this point we should have all necessary capabilities but
 709            are otherwise a normal user. However, the caps might got
 710            corrupted due to the setresuid() so we need clean them up
 711            later. This is done outside of this call. */
 712
 713         return 0;
 714 }
 715
 716 #ifdef HAVE_PAM
 717
 718 static int null_conv(
 719                 int num_msg,
 720                 const struct pam_message **msg,
 721                 struct pam_response **resp,
 722                 void *appdata_ptr) {
 723
 724         /* We don't support conversations */
 725
 726         return PAM_CONV_ERR;
 727 }
 728
 729 static int setup_pam(
 730                 const char *name,
 731                 const char *user,
 732                 uid_t uid,
 733                 const char *tty,
 734                 char ***pam_env,
 735                 int fds[], unsigned n_fds) {
 736
 737         static const struct pam_conv conv = {
 738                 .conv = null_conv,
 739                 .appdata_ptr = NULL
 740         };
 741
 742         pam_handle_t *handle = NULL;
 743         sigset_t ss, old_ss;
 744         int pam_code = PAM_SUCCESS;
 745         int err;
 746         char **e = NULL;
 747         bool close_session = false;
 748         pid_t pam_pid = 0, parent_pid;
 749         int flags = 0;
 750
 751         assert(name);
 752         assert(user);
 753         assert(pam_env);
 754
 755         /* We set up PAM in the parent process, then fork. The child
 756          * will then stay around until killed via PR_GET_PDEATHSIG or
 757          * systemd via the cgroup logic. It will then remove the PAM
 758          * session again. The parent process will exec() the actual
 759          * daemon. We do things this way to ensure that the main PID
 760          * of the daemon is the one we initially fork()ed. */
 761
 762         if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
 763                 flags |= PAM_SILENT;
 764
 765         pam_code = pam_start(name, user, &conv, &handle);
 766         if (pam_code != PAM_SUCCESS) {
 767                 handle = NULL;
 768                 goto fail;
 769         }
 770
 771         if (tty) {
 772                 pam_code = pam_set_item(handle, PAM_TTY, tty);
 773                 if (pam_code != PAM_SUCCESS)
 774                         goto fail;
 775         }
 776
 777         pam_code = pam_acct_mgmt(handle, flags);
 778         if (pam_code != PAM_SUCCESS)
 779                 goto fail;
 780
 781         pam_code = pam_open_session(handle, flags);
 782         if (pam_code != PAM_SUCCESS)
 783                 goto fail;
 784
 785         close_session = true;
 786
 787         e = pam_getenvlist(handle);
 788         if (!e) {
 789                 pam_code = PAM_BUF_ERR;
 790                 goto fail;
 791         }
 792
 793         /* Block SIGTERM, so that we know that it won't get lost in
 794          * the child */
 795         if (sigemptyset(&ss) < 0 ||
 796             sigaddset(&ss, SIGTERM) < 0 ||
 797             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 798                 goto fail;
 799
 800         parent_pid = getpid();
 801
 802         pam_pid = fork();
 803         if (pam_pid < 0)
 804                 goto fail;
 805
 806         if (pam_pid == 0) {
 807                 int sig;
 808                 int r = EXIT_PAM;
 809
 810                 /* The child's job is to reset the PAM session on
 811                  * termination */
 812
 813                 /* This string must fit in 10 chars (i.e. the length
 814                  * of "/sbin/init"), to look pretty in /bin/ps */
 815                 rename_process("(sd-pam)");
 816
 817                 /* Make sure we don't keep open the passed fds in this
 818                 child. We assume that otherwise only those fds are
 819                 open here that have been opened by PAM. */
 820                 close_many(fds, n_fds);
 821
 822                 /* Drop privileges - we don't need any to pam_close_session
 823                  * and this will make PR_SET_PDEATHSIG work in most cases.
 824                  * If this fails, ignore the error - but expect sd-pam threads
 825                  * to fail to exit normally */
 826                 if (setresuid(uid, uid, uid) < 0)
 827                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 828
 829                 /* Wait until our parent died. This will only work if
 830                  * the above setresuid() succeeds, otherwise the kernel
 831                  * will not allow unprivileged parents kill their privileged
 832                  * children this way. We rely on the control groups kill logic
 833                  * to do the rest for us. */
 834                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 835                         goto child_finish;
 836
 837                 /* Check if our parent process might already have
 838                  * died? */
 839                 if (getppid() == parent_pid) {
 840                         for (;;) {
 841                                 if (sigwait(&ss, &sig) < 0) {
 842                                         if (errno == EINTR)
 843                                                 continue;
 844
 845                                         goto child_finish;
 846                                 }
 847
 848                                 assert(sig == SIGTERM);
 849                                 break;
 850                         }
 851                 }
 852
 853                 /* If our parent died we'll end the session */
 854                 if (getppid() != parent_pid) {
 855                         pam_code = pam_close_session(handle, flags);
 856                         if (pam_code != PAM_SUCCESS)
 857                                 goto child_finish;
 858                 }
 859
 860                 r = 0;
 861
 862         child_finish:
 863                 pam_end(handle, pam_code | flags);
 864                 _exit(r);
 865         }
 866
 867         /* If the child was forked off successfully it will do all the
 868          * cleanups, so forget about the handle here. */
 869         handle = NULL;
 870
 871         /* Unblock SIGTERM again in the parent */
 872         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 873                 goto fail;
 874
 875         /* We close the log explicitly here, since the PAM modules
 876          * might have opened it, but we don't want this fd around. */
 877         closelog();
 878
 879         *pam_env = e;
 880         e = NULL;
 881
 882         return 0;
 883
 884 fail:
 885         if (pam_code != PAM_SUCCESS) {
 886                 log_error("PAM failed: %s", pam_strerror(handle, pam_code));
 887                 err = -EPERM;  /* PAM errors do not map to errno */
 888         } else {
 889                 log_error("PAM failed: %m");
 890                 err = -errno;
 891         }
 892
 893         if (handle) {
 894                 if (close_session)
 895                         pam_code = pam_close_session(handle, flags);
 896
 897                 pam_end(handle, pam_code | flags);
 898         }
 899
 900         strv_free(e);
 901
 902         closelog();
 903
 904         if (pam_pid > 1) {
 905                 kill(pam_pid, SIGTERM);
 906                 kill(pam_pid, SIGCONT);
 907         }
 908
 909         return err;
 910 }
 911 #endif
 912
 913 static void rename_process_from_path(const char *path) {
 914         char process_name[11];
 915         const char *p;
 916         size_t l;
 917
 918         /* This resulting string must fit in 10 chars (i.e. the length
 919          * of "/sbin/init") to look pretty in /bin/ps */
 920
 921         p = basename(path);
 922         if (isempty(p)) {
 923                 rename_process("(...)");
 924                 return;
 925         }
 926
 927         l = strlen(p);
 928         if (l > 8) {
 929                 /* The end of the process name is usually more
 930                  * interesting, since the first bit might just be
 931                  * "systemd-" */
 932                 p = p + l - 8;
 933                 l = 8;
 934         }
 935
 936         process_name[0] = '(';
 937         memcpy(process_name+1, p, l);
 938         process_name[1+l] = ')';
 939         process_name[1+l+1] = 0;
 940
 941         rename_process(process_name);
 942 }
 943
 944 #ifdef HAVE_SECCOMP
 945
 946 static int apply_seccomp(ExecContext *c) {
 947         uint32_t negative_action, action;
 948         scmp_filter_ctx *seccomp;
 949         Iterator i;
 950         void *id;
 951         int r;
 952
 953         assert(c);
 954
 955         negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
 956
 957         seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
 958         if (!seccomp)
 959                 return -ENOMEM;
 960
 961         if (c->syscall_archs) {
 962
 963                 SET_FOREACH(id, c->syscall_archs, i) {
 964                         r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
 965                         if (r == -EEXIST)
 966                                 continue;
 967                         if (r < 0) {
 968                                 seccomp_release(seccomp);
 969                                 return r;
 970                         }
 971                 }
 972         } else {
 973
 974                 r = seccomp_add_secondary_archs(seccomp);
 975                 if (r < 0) {
 976                         seccomp_release(seccomp);
 977                         return r;
 978                 }
 979         }
 980
 981         action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
 982         SET_FOREACH(id, c->syscall_filter, i) {
 983                 r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
 984                 if (r < 0) {
 985                         seccomp_release(seccomp);
 986                         return r;
 987                 }
 988         }
 989
 990         r = seccomp_load(seccomp);
 991         seccomp_release(seccomp);
 992
 993         return r;
 994 }
 995 #endif
 996
 997 static void do_idle_pipe_dance(int idle_pipe[4]) {
 998         assert(idle_pipe);
 999
1000         if (idle_pipe[1] >= 0)
1001                 close_nointr_nofail(idle_pipe[1]);
1002         if (idle_pipe[2] >= 0)
1003                 close_nointr_nofail(idle_pipe[2]);
1004
1005         if (idle_pipe[0] >= 0) {
1006                 int r;
1007
1008                 r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1009
1010                 if (idle_pipe[3] >= 0 && r == 0 /* timeout */) {
1011                         /* Signal systemd that we are bored and want to continue. */
1012                         write(idle_pipe[3], "x", 1);
1013
1014                         /* Wait for systemd to react to the signal above. */
1015                         fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
1016                 }
1017
1018                 close_nointr_nofail(idle_pipe[0]);
1019
1020         }
1021
1022         if (idle_pipe[3] >= 0)
1023                 close_nointr_nofail(idle_pipe[3]);
1024 }
1025
1026 static int build_environment(
1027                 ExecContext *c,
1028                 unsigned n_fds,
1029                 usec_t watchdog_usec,
1030                 const char *home,
1031                 const char *username,
1032                 const char *shell,
1033                 char ***ret) {
1034
1035         _cleanup_strv_free_ char **our_env = NULL;
1036         unsigned n_env = 0;
1037         char *x;
1038
1039         assert(c);
1040         assert(ret);
1041
1042         our_env = new0(char*, 10);
1043         if (!our_env)
1044                 return -ENOMEM;
1045
1046         if (n_fds > 0) {
1047                 if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
1048                         return -ENOMEM;
1049                 our_env[n_env++] = x;
1050
1051                 if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
1052                         return -ENOMEM;
1053                 our_env[n_env++] = x;
1054         }
1055
1056         if (watchdog_usec > 0) {
1057                 if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
1058                         return -ENOMEM;
1059                 our_env[n_env++] = x;
1060
1061                 if (asprintf(&x, "WATCHDOG_USEC=%llu", (unsigned long long) watchdog_usec) < 0)
1062                         return -ENOMEM;
1063                 our_env[n_env++] = x;
1064         }
1065
1066         if (home) {
1067                 x = strappend("HOME=", home);
1068                 if (!x)
1069                         return -ENOMEM;
1070                 our_env[n_env++] = x;
1071         }
1072
1073         if (username) {
1074                 x = strappend("LOGNAME=", username);
1075                 if (!x)
1076                         return -ENOMEM;
1077                 our_env[n_env++] = x;
1078
1079                 x = strappend("USER=", username);
1080                 if (!x)
1081                         return -ENOMEM;
1082                 our_env[n_env++] = x;
1083         }
1084
1085         if (shell) {
1086                 x = strappend("SHELL=", shell);
1087                 if (!x)
1088                         return -ENOMEM;
1089                 our_env[n_env++] = x;
1090         }
1091
1092         if (is_terminal_input(c->std_input) ||
1093             c->std_output == EXEC_OUTPUT_TTY ||
1094             c->std_error == EXEC_OUTPUT_TTY ||
1095             c->tty_path) {
1096
1097                 x = strdup(default_term_for_tty(tty_path(c)));
1098                 if (!x)
1099                         return -ENOMEM;
1100                 our_env[n_env++] = x;
1101         }
1102
1103         our_env[n_env++] = NULL;
1104         assert(n_env <= 10);
1105
1106         *ret = our_env;
1107         our_env = NULL;
1108
1109         return 0;
1110 }
1111
1112 int exec_spawn(ExecCommand *command,
1113                char **argv,
1114                ExecContext *context,
1115                int fds[], unsigned n_fds,
1116                char **environment,
1117                bool apply_permissions,
1118                bool apply_chroot,
1119                bool apply_tty_stdin,
1120                bool confirm_spawn,
1121                CGroupControllerMask cgroup_supported,
1122                const char *cgroup_path,
1123                const char *unit_id,
1124                usec_t watchdog_usec,
1125                int idle_pipe[4],
1126                ExecRuntime *runtime,
1127                pid_t *ret) {
1128
1129         _cleanup_strv_free_ char **files_env = NULL;
1130         int socket_fd;
1131         char *line;
1132         pid_t pid;
1133         int r;
1134
1135         assert(command);
1136         assert(context);
1137         assert(ret);
1138         assert(fds || n_fds <= 0);
1139
1140         if (context->std_input == EXEC_INPUT_SOCKET ||
1141             context->std_output == EXEC_OUTPUT_SOCKET ||
1142             context->std_error == EXEC_OUTPUT_SOCKET) {
1143
1144                 if (n_fds != 1)
1145                         return -EINVAL;
1146
1147                 socket_fd = fds[0];
1148
1149                 fds = NULL;
1150                 n_fds = 0;
1151         } else
1152                 socket_fd = -1;
1153
1154         r = exec_context_load_environment(context, &files_env);
1155         if (r < 0) {
1156                 log_struct_unit(LOG_ERR,
1157                            unit_id,
1158                            "MESSAGE=Failed to load environment files: %s", strerror(-r),
1159                            "ERRNO=%d", -r,
1160                            NULL);
1161                 return r;
1162         }
1163
1164         if (!argv)
1165                 argv = command->argv;
1166
1167         line = exec_command_line(argv);
1168         if (!line)
1169                 return log_oom();
1170
1171         log_struct_unit(LOG_DEBUG,
1172                         unit_id,
1173                         "EXECUTABLE=%s", command->path,
1174                         "MESSAGE=About to execute: %s", line,
1175                         NULL);
1176         free(line);
1177
1178         pid = fork();
1179         if (pid < 0)
1180                 return -errno;
1181
1182         if (pid == 0) {
1183                 _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
1184                 const char *username = NULL, *home = NULL, *shell = NULL;
1185                 unsigned n_dont_close = 0;
1186                 int dont_close[n_fds + 3];
1187                 uid_t uid = (uid_t) -1;
1188                 gid_t gid = (gid_t) -1;
1189                 sigset_t ss;
1190                 int i, err;
1191
1192                 /* child */
1193
1194                 rename_process_from_path(command->path);
1195
1196                 /* We reset exactly these signals, since they are the
1197                  * only ones we set to SIG_IGN in the main daemon. All
1198                  * others we leave untouched because we set them to
1199                  * SIG_DFL or a valid handler initially, both of which
1200                  * will be demoted to SIG_DFL. */
1201                 default_signals(SIGNALS_CRASH_HANDLER,
1202                                 SIGNALS_IGNORE, -1);
1203
1204                 if (context->ignore_sigpipe)
1205                         ignore_signals(SIGPIPE, -1);
1206
1207                 assert_se(sigemptyset(&ss) == 0);
1208                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1209                         err = -errno;
1210                         r = EXIT_SIGNAL_MASK;
1211                         goto fail_child;
1212                 }
1213
1214                 if (idle_pipe)
1215                         do_idle_pipe_dance(idle_pipe);
1216
1217                 /* Close sockets very early to make sure we don't
1218                  * block init reexecution because it cannot bind its
1219                  * sockets */
1220                 log_forget_fds();
1221
1222                 if (socket_fd >= 0)
1223                         dont_close[n_dont_close++] = socket_fd;
1224                 if (n_fds > 0) {
1225                         memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
1226                         n_dont_close += n_fds;
1227                 }
1228                 if (runtime) {
1229                         if (runtime->netns_storage_socket[0] >= 0)
1230                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
1231                         if (runtime->netns_storage_socket[1] >= 0)
1232                                 dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
1233                 }
1234
1235                 err = close_all_fds(dont_close, n_dont_close);
1236                 if (err < 0) {
1237                         r = EXIT_FDS;
1238                         goto fail_child;
1239                 }
1240
1241                 if (!context->same_pgrp)
1242                         if (setsid() < 0) {
1243                                 err = -errno;
1244                                 r = EXIT_SETSID;
1245                                 goto fail_child;
1246                         }
1247
1248                 if (context->tcpwrap_name) {
1249                         if (socket_fd >= 0)
1250                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1251                                         err = -EACCES;
1252                                         r = EXIT_TCPWRAP;
1253                                         goto fail_child;
1254                                 }
1255
1256                         for (i = 0; i < (int) n_fds; i++) {
1257                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1258                                         err = -EACCES;
1259                                         r = EXIT_TCPWRAP;
1260                                         goto fail_child;
1261                                 }
1262                         }
1263                 }
1264
1265                 exec_context_tty_reset(context);
1266
1267                 if (confirm_spawn) {
1268                         char response;
1269
1270                         err = ask_for_confirmation(&response, argv);
1271                         if (err == -ETIMEDOUT)
1272                                 write_confirm_message("Confirmation question timed out, assuming positive response.\n");
1273                         else if (err < 0)
1274                                 write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
1275                         else if (response == 's') {
1276                                 write_confirm_message("Skipping execution.\n");
1277                                 err = -ECANCELED;
1278                                 r = EXIT_CONFIRM;
1279                                 goto fail_child;
1280                         } else if (response == 'n') {
1281                                 write_confirm_message("Failing execution.\n");
1282                                 err = r = 0;
1283                                 goto fail_child;
1284                         }
1285                 }
1286
1287                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1288                  * must sure to drop O_NONBLOCK */
1289                 if (socket_fd >= 0)
1290                         fd_nonblock(socket_fd, false);
1291
1292                 err = setup_input(context, socket_fd, apply_tty_stdin);
1293                 if (err < 0) {
1294                         r = EXIT_STDIN;
1295                         goto fail_child;
1296                 }
1297
1298                 err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1299                 if (err < 0) {
1300                         r = EXIT_STDOUT;
1301                         goto fail_child;
1302                 }
1303
1304                 err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), unit_id, apply_tty_stdin);
1305                 if (err < 0) {
1306                         r = EXIT_STDERR;
1307                         goto fail_child;
1308                 }
1309
1310                 if (cgroup_path) {
1311                         err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
1312                         if (err < 0) {
1313                                 r = EXIT_CGROUP;
1314                                 goto fail_child;
1315                         }
1316                 }
1317
1318                 if (context->oom_score_adjust_set) {
1319                         char t[16];
1320
1321                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1322                         char_array_0(t);
1323
1324                         if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
1325                                 err = -errno;
1326                                 r = EXIT_OOM_ADJUST;
1327                                 goto fail_child;
1328                         }
1329                 }
1330
1331                 if (context->nice_set)
1332                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1333                                 err = -errno;
1334                                 r = EXIT_NICE;
1335                                 goto fail_child;
1336                         }
1337
1338                 if (context->cpu_sched_set) {
1339                         struct sched_param param = {
1340                                 .sched_priority = context->cpu_sched_priority,
1341                         };
1342
1343                         r = sched_setscheduler(0,
1344                                                context->cpu_sched_policy |
1345                                                (context->cpu_sched_reset_on_fork ?
1346                                                 SCHED_RESET_ON_FORK : 0),
1347                                                &param);
1348                         if (r < 0) {
1349                                 err = -errno;
1350                                 r = EXIT_SETSCHEDULER;
1351                                 goto fail_child;
1352                         }
1353                 }
1354
1355                 if (context->cpuset)
1356                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1357                                 err = -errno;
1358                                 r = EXIT_CPUAFFINITY;
1359                                 goto fail_child;
1360                         }
1361
1362                 if (context->ioprio_set)
1363                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1364                                 err = -errno;
1365                                 r = EXIT_IOPRIO;
1366                                 goto fail_child;
1367                         }
1368
1369                 if (context->timer_slack_nsec != (nsec_t) -1)
1370                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1371                                 err = -errno;
1372                                 r = EXIT_TIMERSLACK;
1373                                 goto fail_child;
1374                         }
1375
1376                 if (context->personality != 0xffffffffUL)
1377                         if (personality(context->personality) < 0) {
1378                                 err = -errno;
1379                                 r = EXIT_PERSONALITY;
1380                                 goto fail_child;
1381                         }
1382
1383                 if (context->utmp_id)
1384                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1385
1386                 if (context->user) {
1387                         username = context->user;
1388                         err = get_user_creds(&username, &uid, &gid, &home, &shell);
1389                         if (err < 0) {
1390                                 r = EXIT_USER;
1391                                 goto fail_child;
1392                         }
1393
1394                         if (is_terminal_input(context->std_input)) {
1395                                 err = chown_terminal(STDIN_FILENO, uid);
1396                                 if (err < 0) {
1397                                         r = EXIT_STDIN;
1398                                         goto fail_child;
1399                                 }
1400                         }
1401                 }
1402
1403 #ifdef HAVE_PAM
1404                 if (cgroup_path && context->user && context->pam_name) {
1405                         err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
1406                         if (err < 0) {
1407                                 r = EXIT_CGROUP;
1408                                 goto fail_child;
1409                         }
1410
1411
1412                         err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
1413                         if (err < 0) {
1414                                 r = EXIT_CGROUP;
1415                                 goto fail_child;
1416                         }
1417                 }
1418 #endif
1419
1420                 if (apply_permissions) {
1421                         err = enforce_groups(context, username, gid);
1422                         if (err < 0) {
1423                                 r = EXIT_GROUP;
1424                                 goto fail_child;
1425                         }
1426                 }
1427
1428                 umask(context->umask);
1429
1430 #ifdef HAVE_PAM
1431                 if (apply_permissions && context->pam_name && username) {
1432                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1433                         if (err < 0) {
1434                                 r = EXIT_PAM;
1435                                 goto fail_child;
1436                         }
1437                 }
1438 #endif
1439                 if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
1440                         err = setup_netns(runtime->netns_storage_socket);
1441                         if (err < 0) {
1442                                 r = EXIT_NETWORK;
1443                                 goto fail_child;
1444                         }
1445                 }
1446
1447                 if (!strv_isempty(context->read_write_dirs) ||
1448                     !strv_isempty(context->read_only_dirs) ||
1449                     !strv_isempty(context->inaccessible_dirs) ||
1450                     context->mount_flags != 0 ||
1451                     (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
1452                     context->private_devices) {
1453
1454                         char *tmp = NULL, *var = NULL;
1455
1456                         /* The runtime struct only contains the parent
1457                          * of the private /tmp, which is
1458                          * non-accessible to world users. Inside of it
1459                          * there's a /tmp that is sticky, and that's
1460                          * the one we want to use here. */
1461
1462                         if (context->private_tmp && runtime) {
1463                                 if (runtime->tmp_dir)
1464                                         tmp = strappenda(runtime->tmp_dir, "/tmp");
1465                                 if (runtime->var_tmp_dir)
1466                                         var = strappenda(runtime->var_tmp_dir, "/tmp");
1467                         }
1468
1469                         err = setup_namespace(
1470                                         context->read_write_dirs,
1471                                         context->read_only_dirs,
1472                                         context->inaccessible_dirs,
1473                                         tmp,
1474                                         var,
1475                                         context->private_devices,
1476                                         context->mount_flags);
1477
1478                         if (err < 0) {
1479                                 r = EXIT_NAMESPACE;
1480                                 goto fail_child;
1481                         }
1482                 }
1483
1484                 if (apply_chroot) {
1485                         if (context->root_directory)
1486                                 if (chroot(context->root_directory) < 0) {
1487                                         err = -errno;
1488                                         r = EXIT_CHROOT;
1489                                         goto fail_child;
1490                                 }
1491
1492                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1493                                 err = -errno;
1494                                 r = EXIT_CHDIR;
1495                                 goto fail_child;
1496                         }
1497                 } else {
1498                         _cleanup_free_ char *d = NULL;
1499
1500                         if (asprintf(&d, "%s/%s",
1501                                      context->root_directory ? context->root_directory : "",
1502                                      context->working_directory ? context->working_directory : "") < 0) {
1503                                 err = -ENOMEM;
1504                                 r = EXIT_MEMORY;
1505                                 goto fail_child;
1506                         }
1507
1508                         if (chdir(d) < 0) {
1509                                 err = -errno;
1510                                 r = EXIT_CHDIR;
1511                                 goto fail_child;
1512                         }
1513                 }
1514
1515                 /* We repeat the fd closing here, to make sure that
1516                  * nothing is leaked from the PAM modules */
1517                 err = close_all_fds(fds, n_fds);
1518                 if (err >= 0)
1519                         err = shift_fds(fds, n_fds);
1520                 if (err >= 0)
1521                         err = flags_fds(fds, n_fds, context->non_blocking);
1522                 if (err < 0) {
1523                         r = EXIT_FDS;
1524                         goto fail_child;
1525                 }
1526
1527                 if (apply_permissions) {
1528
1529                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1530                                 if (!context->rlimit[i])
1531                                         continue;
1532
1533                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1534                                         err = -errno;
1535                                         r = EXIT_LIMITS;
1536                                         goto fail_child;
1537                                 }
1538                         }
1539
1540                         if (context->capability_bounding_set_drop) {
1541                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1542                                 if (err < 0) {
1543                                         r = EXIT_CAPABILITIES;
1544                                         goto fail_child;
1545                                 }
1546                         }
1547
1548                         if (context->user) {
1549                                 err = enforce_user(context, uid);
1550                                 if (err < 0) {
1551                                         r = EXIT_USER;
1552                                         goto fail_child;
1553                                 }
1554                         }
1555
1556                         /* PR_GET_SECUREBITS is not privileged, while
1557                          * PR_SET_SECUREBITS is. So to suppress
1558                          * potential EPERMs we'll try not to call
1559                          * PR_SET_SECUREBITS unless necessary. */
1560                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1561                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1562                                         err = -errno;
1563                                         r = EXIT_SECUREBITS;
1564                                         goto fail_child;
1565                                 }
1566
1567                         if (context->capabilities)
1568                                 if (cap_set_proc(context->capabilities) < 0) {
1569                                         err = -errno;
1570                                         r = EXIT_CAPABILITIES;
1571                                         goto fail_child;
1572                                 }
1573
1574                         if (context->no_new_privileges)
1575                                 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
1576                                         err = -errno;
1577                                         r = EXIT_NO_NEW_PRIVILEGES;
1578                                         goto fail_child;
1579                                 }
1580
1581 #ifdef HAVE_SECCOMP
1582                         if (context->syscall_filter || context->syscall_archs) {
1583                                 err = apply_seccomp(context);
1584                                 if (err < 0) {
1585                                         r = EXIT_SECCOMP;
1586                                         goto fail_child;
1587                                 }
1588                         }
1589 #endif
1590
1591 #ifdef HAVE_SELINUX
1592                         if (context->selinux_context && use_selinux()) {
1593                                 err = setexeccon(context->selinux_context);
1594                                 if (err < 0 && !context->selinux_context_ignore) {
1595                                         r = EXIT_SELINUX_CONTEXT;
1596                                         goto fail_child;
1597                                 }
1598                         }
1599 #endif
1600                 }
1601
1602                 err = build_environment(context, n_fds, watchdog_usec, home, username, shell, &our_env);
1603                 if (r < 0) {
1604                         r = EXIT_MEMORY;
1605                         goto fail_child;
1606                 }
1607
1608                 final_env = strv_env_merge(5,
1609                                            environment,
1610                                            our_env,
1611                                            context->environment,
1612                                            files_env,
1613                                            pam_env,
1614                                            NULL);
1615                 if (!final_env) {
1616                         err = -ENOMEM;
1617                         r = EXIT_MEMORY;
1618                         goto fail_child;
1619                 }
1620
1621                 final_argv = replace_env_argv(argv, final_env);
1622                 if (!final_argv) {
1623                         err = -ENOMEM;
1624                         r = EXIT_MEMORY;
1625                         goto fail_child;
1626                 }
1627
1628                 final_env = strv_env_clean(final_env);
1629
1630                 if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
1631                         line = exec_command_line(final_argv);
1632                         if (line) {
1633                                 log_open();
1634                                 log_struct_unit(LOG_DEBUG,
1635                                                 unit_id,
1636                                                 "EXECUTABLE=%s", command->path,
1637                                                 "MESSAGE=Executing: %s", line,
1638                                                 NULL);
1639                                 log_close();
1640                                 free(line);
1641                                 line = NULL;
1642                         }
1643                 }
1644                 execve(command->path, final_argv, final_env);
1645                 err = -errno;
1646                 r = EXIT_EXEC;
1647
1648         fail_child:
1649                 if (r != 0) {
1650                         log_open();
1651                         log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
1652                                    "EXECUTABLE=%s", command->path,
1653                                    "MESSAGE=Failed at step %s spawning %s: %s",
1654                                           exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1655                                           command->path, strerror(-err),
1656                                    "ERRNO=%d", -err,
1657                                    NULL);
1658                         log_close();
1659                 }
1660
1661                 _exit(r);
1662         }
1663
1664         log_struct_unit(LOG_DEBUG,
1665                         unit_id,
1666                         "MESSAGE=Forked %s as "PID_FMT,
1667                         command->path, pid,
1668                         NULL);
1669
1670         /* We add the new process to the cgroup both in the child (so
1671          * that we can be sure that no user code is ever executed
1672          * outside of the cgroup) and in the parent (so that we can be
1673          * sure that when we kill the cgroup the process will be
1674          * killed too). */
1675         if (cgroup_path)
1676                 cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
1677
1678         exec_status_start(&command->exec_status, pid);
1679
1680         *ret = pid;
1681         return 0;
1682 }
1683
1684 void exec_context_init(ExecContext *c) {
1685         assert(c);
1686
1687         c->umask = 0022;
1688         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1689         c->cpu_sched_policy = SCHED_OTHER;
1690         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1691         c->syslog_level_prefix = true;
1692         c->ignore_sigpipe = true;
1693         c->timer_slack_nsec = (nsec_t) -1;
1694         c->personality = 0xffffffffUL;
1695 }
1696
1697 void exec_context_done(ExecContext *c) {
1698         unsigned l;
1699
1700         assert(c);
1701
1702         strv_free(c->environment);
1703         c->environment = NULL;
1704
1705         strv_free(c->environment_files);
1706         c->environment_files = NULL;
1707
1708         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1709                 free(c->rlimit[l]);
1710                 c->rlimit[l] = NULL;
1711         }
1712
1713         free(c->working_directory);
1714         c->working_directory = NULL;
1715         free(c->root_directory);
1716         c->root_directory = NULL;
1717
1718         free(c->tty_path);
1719         c->tty_path = NULL;
1720
1721         free(c->tcpwrap_name);
1722         c->tcpwrap_name = NULL;
1723
1724         free(c->syslog_identifier);
1725         c->syslog_identifier = NULL;
1726
1727         free(c->user);
1728         c->user = NULL;
1729
1730         free(c->group);
1731         c->group = NULL;
1732
1733         strv_free(c->supplementary_groups);
1734         c->supplementary_groups = NULL;
1735
1736         free(c->pam_name);
1737         c->pam_name = NULL;
1738
1739         if (c->capabilities) {
1740                 cap_free(c->capabilities);
1741                 c->capabilities = NULL;
1742         }
1743
1744         strv_free(c->read_only_dirs);
1745         c->read_only_dirs = NULL;
1746
1747         strv_free(c->read_write_dirs);
1748         c->read_write_dirs = NULL;
1749
1750         strv_free(c->inaccessible_dirs);
1751         c->inaccessible_dirs = NULL;
1752
1753         if (c->cpuset)
1754                 CPU_FREE(c->cpuset);
1755
1756         free(c->utmp_id);
1757         c->utmp_id = NULL;
1758
1759         free(c->selinux_context);
1760         c->selinux_context = NULL;
1761
1762 #ifdef HAVE_SECCOMP
1763         set_free(c->syscall_filter);
1764         c->syscall_filter = NULL;
1765
1766         set_free(c->syscall_archs);
1767         c->syscall_archs = NULL;
1768 #endif
1769 }
1770
1771 void exec_command_done(ExecCommand *c) {
1772         assert(c);
1773
1774         free(c->path);
1775         c->path = NULL;
1776
1777         strv_free(c->argv);
1778         c->argv = NULL;
1779 }
1780
1781 void exec_command_done_array(ExecCommand *c, unsigned n) {
1782         unsigned i;
1783
1784         for (i = 0; i < n; i++)
1785                 exec_command_done(c+i);
1786 }
1787
1788 void exec_command_free_list(ExecCommand *c) {
1789         ExecCommand *i;
1790
1791         while ((i = c)) {
1792                 LIST_REMOVE(command, c, i);
1793                 exec_command_done(i);
1794                 free(i);
1795         }
1796 }
1797
1798 void exec_command_free_array(ExecCommand **c, unsigned n) {
1799         unsigned i;
1800
1801         for (i = 0; i < n; i++) {
1802                 exec_command_free_list(c[i]);
1803                 c[i] = NULL;
1804         }
1805 }
1806
1807 int exec_context_load_environment(const ExecContext *c, char ***l) {
1808         char **i, **r = NULL;
1809
1810         assert(c);
1811         assert(l);
1812
1813         STRV_FOREACH(i, c->environment_files) {
1814                 char *fn;
1815                 int k;
1816                 bool ignore = false;
1817                 char **p;
1818                 _cleanup_globfree_ glob_t pglob = {};
1819                 int count, n;
1820
1821                 fn = *i;
1822
1823                 if (fn[0] == '-') {
1824                         ignore = true;
1825                         fn ++;
1826                 }
1827
1828                 if (!path_is_absolute(fn)) {
1829                         if (ignore)
1830                                 continue;
1831
1832                         strv_free(r);
1833                         return -EINVAL;
1834                 }
1835
1836                 /* Filename supports globbing, take all matching files */
1837                 errno = 0;
1838                 if (glob(fn, 0, NULL, &pglob) != 0) {
1839                         if (ignore)
1840                                 continue;
1841
1842                         strv_free(r);
1843                         return errno ? -errno : -EINVAL;
1844                 }
1845                 count = pglob.gl_pathc;
1846                 if (count == 0) {
1847                         if (ignore)
1848                                 continue;
1849
1850                         strv_free(r);
1851                         return -EINVAL;
1852                 }
1853                 for (n = 0; n < count; n++) {
1854                         k = load_env_file(pglob.gl_pathv[n], NULL, &p);
1855                         if (k < 0) {
1856                                 if (ignore)
1857                                         continue;
1858
1859                                 strv_free(r);
1860                                 return k;
1861                         }
1862                         /* Log invalid environment variables with filename */
1863                         if (p)
1864                                 p = strv_env_clean_log(p, pglob.gl_pathv[n]);
1865
1866                         if (r == NULL)
1867                                 r = p;
1868                         else {
1869                                 char **m;
1870
1871                                 m = strv_env_merge(2, r, p);
1872                                 strv_free(r);
1873                                 strv_free(p);
1874                                 if (!m)
1875                                         return -ENOMEM;
1876
1877                                 r = m;
1878                         }
1879                 }
1880         }
1881
1882         *l = r;
1883
1884         return 0;
1885 }
1886
1887 static bool tty_may_match_dev_console(const char *tty) {
1888         char *active = NULL, *console;
1889         bool b;
1890
1891         if (startswith(tty, "/dev/"))
1892                 tty += 5;
1893
1894         /* trivial identity? */
1895         if (streq(tty, "console"))
1896                 return true;
1897
1898         console = resolve_dev_console(&active);
1899         /* if we could not resolve, assume it may */
1900         if (!console)
1901                 return true;
1902
1903         /* "tty0" means the active VC, so it may be the same sometimes */
1904         b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
1905         free(active);
1906
1907         return b;
1908 }
1909
1910 bool exec_context_may_touch_console(ExecContext *ec) {
1911         return (ec->tty_reset || ec->tty_vhangup || ec->tty_vt_disallocate ||
1912                 is_terminal_input(ec->std_input) ||
1913                 is_terminal_output(ec->std_output) ||
1914                 is_terminal_output(ec->std_error)) &&
1915                tty_may_match_dev_console(tty_path(ec));
1916 }
1917
1918 static void strv_fprintf(FILE *f, char **l) {
1919         char **g;
1920
1921         assert(f);
1922
1923         STRV_FOREACH(g, l)
1924                 fprintf(f, " %s", *g);
1925 }
1926
1927 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1928         char **e;
1929         unsigned i;
1930
1931         assert(c);
1932         assert(f);
1933
1934         prefix = strempty(prefix);
1935
1936         fprintf(f,
1937                 "%sUMask: %04o\n"
1938                 "%sWorkingDirectory: %s\n"
1939                 "%sRootDirectory: %s\n"
1940                 "%sNonBlocking: %s\n"
1941                 "%sPrivateTmp: %s\n"
1942                 "%sPrivateNetwork: %s\n"
1943                 "%sPrivateDevices: %s\n"
1944                 "%sIgnoreSIGPIPE: %s\n",
1945                 prefix, c->umask,
1946                 prefix, c->working_directory ? c->working_directory : "/",
1947                 prefix, c->root_directory ? c->root_directory : "/",
1948                 prefix, yes_no(c->non_blocking),
1949                 prefix, yes_no(c->private_tmp),
1950                 prefix, yes_no(c->private_network),
1951                 prefix, yes_no(c->private_devices),
1952                 prefix, yes_no(c->ignore_sigpipe));
1953
1954         STRV_FOREACH(e, c->environment)
1955                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1956
1957         STRV_FOREACH(e, c->environment_files)
1958                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1959
1960         if (c->tcpwrap_name)
1961                 fprintf(f,
1962                         "%sTCPWrapName: %s\n",
1963                         prefix, c->tcpwrap_name);
1964
1965         if (c->nice_set)
1966                 fprintf(f,
1967                         "%sNice: %i\n",
1968                         prefix, c->nice);
1969
1970         if (c->oom_score_adjust_set)
1971                 fprintf(f,
1972                         "%sOOMScoreAdjust: %i\n",
1973                         prefix, c->oom_score_adjust);
1974
1975         for (i = 0; i < RLIM_NLIMITS; i++)
1976                 if (c->rlimit[i])
1977                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1978
1979         if (c->ioprio_set) {
1980                 _cleanup_free_ char *class_str = NULL;
1981
1982                 ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
1983                 fprintf(f,
1984                         "%sIOSchedulingClass: %s\n"
1985                         "%sIOPriority: %i\n",
1986                         prefix, strna(class_str),
1987                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1988         }
1989
1990         if (c->cpu_sched_set) {
1991                 _cleanup_free_ char *policy_str = NULL;
1992
1993                 sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
1994                 fprintf(f,
1995                         "%sCPUSchedulingPolicy: %s\n"
1996                         "%sCPUSchedulingPriority: %i\n"
1997                         "%sCPUSchedulingResetOnFork: %s\n",
1998                         prefix, strna(policy_str),
1999                         prefix, c->cpu_sched_priority,
2000                         prefix, yes_no(c->cpu_sched_reset_on_fork));
2001         }
2002
2003         if (c->cpuset) {
2004                 fprintf(f, "%sCPUAffinity:", prefix);
2005                 for (i = 0; i < c->cpuset_ncpus; i++)
2006                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
2007                                 fprintf(f, " %u", i);
2008                 fputs("\n", f);
2009         }
2010
2011         if (c->timer_slack_nsec != (nsec_t) -1)
2012                 fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
2013
2014         fprintf(f,
2015                 "%sStandardInput: %s\n"
2016                 "%sStandardOutput: %s\n"
2017                 "%sStandardError: %s\n",
2018                 prefix, exec_input_to_string(c->std_input),
2019                 prefix, exec_output_to_string(c->std_output),
2020                 prefix, exec_output_to_string(c->std_error));
2021
2022         if (c->tty_path)
2023                 fprintf(f,
2024                         "%sTTYPath: %s\n"
2025                         "%sTTYReset: %s\n"
2026                         "%sTTYVHangup: %s\n"
2027                         "%sTTYVTDisallocate: %s\n",
2028                         prefix, c->tty_path,
2029                         prefix, yes_no(c->tty_reset),
2030                         prefix, yes_no(c->tty_vhangup),
2031                         prefix, yes_no(c->tty_vt_disallocate));
2032
2033         if (c->std_output == EXEC_OUTPUT_SYSLOG ||
2034             c->std_output == EXEC_OUTPUT_KMSG ||
2035             c->std_output == EXEC_OUTPUT_JOURNAL ||
2036             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2037             c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2038             c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
2039             c->std_error == EXEC_OUTPUT_SYSLOG ||
2040             c->std_error == EXEC_OUTPUT_KMSG ||
2041             c->std_error == EXEC_OUTPUT_JOURNAL ||
2042             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
2043             c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
2044             c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
2045
2046                 _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
2047
2048                 log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
2049                 log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
2050
2051                 fprintf(f,
2052                         "%sSyslogFacility: %s\n"
2053                         "%sSyslogLevel: %s\n",
2054                         prefix, strna(fac_str),
2055                         prefix, strna(lvl_str));
2056         }
2057
2058         if (c->capabilities) {
2059                 _cleanup_cap_free_charp_ char *t;
2060
2061                 t = cap_to_text(c->capabilities, NULL);
2062                 if (t)
2063                         fprintf(f, "%sCapabilities: %s\n", prefix, t);
2064         }
2065
2066         if (c->secure_bits)
2067                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
2068                         prefix,
2069                         (c->secure_bits & 1<<SECURE_KEEP_CAPS) ? " keep-caps" : "",
2070                         (c->secure_bits & 1<<SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
2071                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
2072                         (c->secure_bits & 1<<SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
2073                         (c->secure_bits & 1<<SECURE_NOROOT) ? " noroot" : "",
2074                         (c->secure_bits & 1<<SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
2075
2076         if (c->capability_bounding_set_drop) {
2077                 unsigned long l;
2078                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
2079
2080                 for (l = 0; l <= cap_last_cap(); l++)
2081                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
2082                                 _cleanup_cap_free_charp_ char *t;
2083
2084                                 t = cap_to_name(l);
2085                                 if (t)
2086                                         fprintf(f, " %s", t);
2087                         }
2088
2089                 fputs("\n", f);
2090         }
2091
2092         if (c->user)
2093                 fprintf(f, "%sUser: %s\n", prefix, c->user);
2094         if (c->group)
2095                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
2096
2097         if (strv_length(c->supplementary_groups) > 0) {
2098                 fprintf(f, "%sSupplementaryGroups:", prefix);
2099                 strv_fprintf(f, c->supplementary_groups);
2100                 fputs("\n", f);
2101         }
2102
2103         if (c->pam_name)
2104                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
2105
2106         if (strv_length(c->read_write_dirs) > 0) {
2107                 fprintf(f, "%sReadWriteDirs:", prefix);
2108                 strv_fprintf(f, c->read_write_dirs);
2109                 fputs("\n", f);
2110         }
2111
2112         if (strv_length(c->read_only_dirs) > 0) {
2113                 fprintf(f, "%sReadOnlyDirs:", prefix);
2114                 strv_fprintf(f, c->read_only_dirs);
2115                 fputs("\n", f);
2116         }
2117
2118         if (strv_length(c->inaccessible_dirs) > 0) {
2119                 fprintf(f, "%sInaccessibleDirs:", prefix);
2120                 strv_fprintf(f, c->inaccessible_dirs);
2121                 fputs("\n", f);
2122         }
2123
2124         if (c->utmp_id)
2125                 fprintf(f,
2126                         "%sUtmpIdentifier: %s\n",
2127                         prefix, c->utmp_id);
2128
2129         if (c->selinux_context)
2130                 fprintf(f,
2131                         "%sSELinuxContext: %s%s\n",
2132                         prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
2133
2134         if (c->personality != 0xffffffffUL)
2135                 fprintf(f,
2136                         "%sPersonality: %s\n",
2137                         prefix, strna(personality_to_string(c->personality)));
2138
2139         if (c->syscall_filter) {
2140 #ifdef HAVE_SECCOMP
2141                 Iterator j;
2142                 void *id;
2143                 bool first = true;
2144 #endif
2145
2146                 fprintf(f,
2147                         "%sSystemCallFilter: ",
2148                         prefix);
2149
2150                 if (!c->syscall_whitelist)
2151                         fputc('~', f);
2152
2153 #ifdef HAVE_SECCOMP
2154                 SET_FOREACH(id, c->syscall_filter, j) {
2155                         _cleanup_free_ char *name = NULL;
2156
2157                         if (first)
2158                                 first = false;
2159                         else
2160                                 fputc(' ', f);
2161
2162                         name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
2163                         fputs(strna(name), f);
2164                 }
2165 #endif
2166
2167                 fputc('\n', f);
2168         }
2169
2170         if (c->syscall_archs) {
2171 #ifdef HAVE_SECCOMP
2172                 Iterator j;
2173                 void *id;
2174 #endif
2175
2176                 fprintf(f,
2177                         "%sSystemCallArchitectures:",
2178                         prefix);
2179
2180 #ifdef HAVE_SECCOMP
2181                 SET_FOREACH(id, c->syscall_archs, j)
2182                         fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
2183 #endif
2184                 fputc('\n', f);
2185         }
2186
2187         if (c->syscall_errno != 0)
2188                 fprintf(f,
2189                         "%sSystemCallErrorNumber: %s\n",
2190                         prefix, strna(errno_to_name(c->syscall_errno)));
2191 }
2192
2193 void exec_status_start(ExecStatus *s, pid_t pid) {
2194         assert(s);
2195
2196         zero(*s);
2197         s->pid = pid;
2198         dual_timestamp_get(&s->start_timestamp);
2199 }
2200
2201 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
2202         assert(s);
2203
2204         if (s->pid && s->pid != pid)
2205                 zero(*s);
2206
2207         s->pid = pid;
2208         dual_timestamp_get(&s->exit_timestamp);
2209
2210         s->code = code;
2211         s->status = status;
2212
2213         if (context) {
2214                 if (context->utmp_id)
2215                         utmp_put_dead_process(context->utmp_id, pid, code, status);
2216
2217                 exec_context_tty_reset(context);
2218         }
2219 }
2220
2221 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
2222         char buf[FORMAT_TIMESTAMP_MAX];
2223
2224         assert(s);
2225         assert(f);
2226
2227         if (!prefix)
2228                 prefix = "";
2229
2230         if (s->pid <= 0)
2231                 return;
2232
2233         fprintf(f,
2234                 "%sPID: "PID_FMT"\n",
2235                 prefix, s->pid);
2236
2237         if (s->start_timestamp.realtime > 0)
2238                 fprintf(f,
2239                         "%sStart Timestamp: %s\n",
2240                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
2241
2242         if (s->exit_timestamp.realtime > 0)
2243                 fprintf(f,
2244                         "%sExit Timestamp: %s\n"
2245                         "%sExit Code: %s\n"
2246                         "%sExit Status: %i\n",
2247                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
2248                         prefix, sigchld_code_to_string(s->code),
2249                         prefix, s->status);
2250 }
2251
2252 char *exec_command_line(char **argv) {
2253         size_t k;
2254         char *n, *p, **a;
2255         bool first = true;
2256
2257         assert(argv);
2258
2259         k = 1;
2260         STRV_FOREACH(a, argv)
2261                 k += strlen(*a)+3;
2262
2263         if (!(n = new(char, k)))
2264                 return NULL;
2265
2266         p = n;
2267         STRV_FOREACH(a, argv) {
2268
2269                 if (!first)
2270                         *(p++) = ' ';
2271                 else
2272                         first = false;
2273
2274                 if (strpbrk(*a, WHITESPACE)) {
2275                         *(p++) = '\'';
2276                         p = stpcpy(p, *a);
2277                         *(p++) = '\'';
2278                 } else
2279                         p = stpcpy(p, *a);
2280
2281         }
2282
2283         *p = 0;
2284
2285         /* FIXME: this doesn't really handle arguments that have
2286          * spaces and ticks in them */
2287
2288         return n;
2289 }
2290
2291 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
2292         char *p2;
2293         const char *prefix2;
2294
2295         char *cmd;
2296
2297         assert(c);
2298         assert(f);
2299
2300         if (!prefix)
2301                 prefix = "";
2302         p2 = strappend(prefix, "\t");
2303         prefix2 = p2 ? p2 : prefix;
2304
2305         cmd = exec_command_line(c->argv);
2306
2307         fprintf(f,
2308                 "%sCommand Line: %s\n",
2309                 prefix, cmd ? cmd : strerror(ENOMEM));
2310
2311         free(cmd);
2312
2313         exec_status_dump(&c->exec_status, f, prefix2);
2314
2315         free(p2);
2316 }
2317
2318 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2319         assert(f);
2320
2321         if (!prefix)
2322                 prefix = "";
2323
2324         LIST_FOREACH(command, c, c)
2325                 exec_command_dump(c, f, prefix);
2326 }
2327
2328 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2329         ExecCommand *end;
2330
2331         assert(l);
2332         assert(e);
2333
2334         if (*l) {
2335                 /* It's kind of important, that we keep the order here */
2336                 LIST_FIND_TAIL(command, *l, end);
2337                 LIST_INSERT_AFTER(command, *l, end, e);
2338         } else
2339               *l = e;
2340 }
2341
2342 int exec_command_set(ExecCommand *c, const char *path, ...) {
2343         va_list ap;
2344         char **l, *p;
2345
2346         assert(c);
2347         assert(path);
2348
2349         va_start(ap, path);
2350         l = strv_new_ap(path, ap);
2351         va_end(ap);
2352
2353         if (!l)
2354                 return -ENOMEM;
2355
2356         p = strdup(path);
2357         if (!p) {
2358                 strv_free(l);
2359                 return -ENOMEM;
2360         }
2361
2362         free(c->path);
2363         c->path = p;
2364
2365         strv_free(c->argv);
2366         c->argv = l;
2367
2368         return 0;
2369 }
2370
2371 static int exec_runtime_allocate(ExecRuntime **rt) {
2372
2373         if (*rt)
2374                 return 0;
2375
2376         *rt = new0(ExecRuntime, 1);
2377         if (!*rt)
2378                 return -ENOMEM;
2379
2380         (*rt)->n_ref = 1;
2381         (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
2382
2383         return 0;
2384 }
2385
2386 int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
2387         int r;
2388
2389         assert(rt);
2390         assert(c);
2391         assert(id);
2392
2393         if (*rt)
2394                 return 1;
2395
2396         if (!c->private_network && !c->private_tmp)
2397                 return 0;
2398
2399         r = exec_runtime_allocate(rt);
2400         if (r < 0)
2401                 return r;
2402
2403         if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
2404                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
2405                         return -errno;
2406         }
2407
2408         if (c->private_tmp && !(*rt)->tmp_dir) {
2409                 r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
2410                 if (r < 0)
2411                         return r;
2412         }
2413
2414         return 1;
2415 }
2416
2417 ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
2418         assert(r);
2419         assert(r->n_ref > 0);
2420
2421         r->n_ref++;
2422         return r;
2423 }
2424
2425 ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
2426
2427         if (!r)
2428                 return NULL;
2429
2430         assert(r->n_ref > 0);
2431
2432         r->n_ref--;
2433         if (r->n_ref <= 0) {
2434                 free(r->tmp_dir);
2435                 free(r->var_tmp_dir);
2436                 close_pipe(r->netns_storage_socket);
2437                 free(r);
2438         }
2439
2440         return NULL;
2441 }
2442
2443 int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds) {
2444         assert(u);
2445         assert(f);
2446         assert(fds);
2447
2448         if (!rt)
2449                 return 0;
2450
2451         if (rt->tmp_dir)
2452                 unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
2453
2454         if (rt->var_tmp_dir)
2455                 unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
2456
2457         if (rt->netns_storage_socket[0] >= 0) {
2458                 int copy;
2459
2460                 copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
2461                 if (copy < 0)
2462                         return copy;
2463
2464                 unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
2465         }
2466
2467         if (rt->netns_storage_socket[1] >= 0) {
2468                 int copy;
2469
2470                 copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
2471                 if (copy < 0)
2472                         return copy;
2473
2474                 unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
2475         }
2476
2477         return 0;
2478 }
2479
2480 int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds) {
2481         int r;
2482
2483         assert(rt);
2484         assert(key);
2485         assert(value);
2486
2487         if (streq(key, "tmp-dir")) {
2488                 char *copy;
2489
2490                 r = exec_runtime_allocate(rt);
2491                 if (r < 0)
2492                         return r;
2493
2494                 copy = strdup(value);
2495                 if (!copy)
2496                         return log_oom();
2497
2498                 free((*rt)->tmp_dir);
2499                 (*rt)->tmp_dir = copy;
2500
2501         } else if (streq(key, "var-tmp-dir")) {
2502                 char *copy;
2503
2504                 r = exec_runtime_allocate(rt);
2505                 if (r < 0)
2506                         return r;
2507
2508                 copy = strdup(value);
2509                 if (!copy)
2510                         return log_oom();
2511
2512                 free((*rt)->var_tmp_dir);
2513                 (*rt)->var_tmp_dir = copy;
2514
2515         } else if (streq(key, "netns-socket-0")) {
2516                 int fd;
2517
2518                 r = exec_runtime_allocate(rt);
2519                 if (r < 0)
2520                         return r;
2521
2522                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2523                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2524                 else {
2525                         if ((*rt)->netns_storage_socket[0] >= 0)
2526                                 close_nointr_nofail((*rt)->netns_storage_socket[0]);
2527
2528                         (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
2529                 }
2530         } else if (streq(key, "netns-socket-1")) {
2531                 int fd;
2532
2533                 r = exec_runtime_allocate(rt);
2534                 if (r < 0)
2535                         return r;
2536
2537                 if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
2538                         log_debug_unit(u->id, "Failed to parse netns socket value %s", value);
2539                 else {
2540                         if ((*rt)->netns_storage_socket[1] >= 0)
2541                                 close_nointr_nofail((*rt)->netns_storage_socket[1]);
2542
2543                         (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
2544                 }
2545         } else
2546                 return 0;
2547
2548         return 1;
2549 }
2550
2551 static void *remove_tmpdir_thread(void *p) {
2552         _cleanup_free_ char *path = p;
2553
2554         rm_rf_dangerous(path, false, true, false);
2555         return NULL;
2556 }
2557
2558 void exec_runtime_destroy(ExecRuntime *rt) {
2559         if (!rt)
2560                 return;
2561
2562         /* If there are multiple users of this, let's leave the stuff around */
2563         if (rt->n_ref > 1)
2564                 return;
2565
2566         if (rt->tmp_dir) {
2567                 log_debug("Spawning thread to nuke %s", rt->tmp_dir);
2568                 asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
2569                 rt->tmp_dir = NULL;
2570         }
2571
2572         if (rt->var_tmp_dir) {
2573                 log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
2574                 asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
2575                 rt->var_tmp_dir = NULL;
2576         }
2577
2578         close_pipe(rt->netns_storage_socket);
2579 }
2580
2581 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2582         [EXEC_INPUT_NULL] = "null",
2583         [EXEC_INPUT_TTY] = "tty",
2584         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2585         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2586         [EXEC_INPUT_SOCKET] = "socket"
2587 };
2588
2589 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2590
2591 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2592         [EXEC_OUTPUT_INHERIT] = "inherit",
2593         [EXEC_OUTPUT_NULL] = "null",
2594         [EXEC_OUTPUT_TTY] = "tty",
2595         [EXEC_OUTPUT_SYSLOG] = "syslog",
2596         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2597         [EXEC_OUTPUT_KMSG] = "kmsg",
2598         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2599         [EXEC_OUTPUT_JOURNAL] = "journal",
2600         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2601         [EXEC_OUTPUT_SOCKET] = "socket"
2602 };
2603
2604 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);