src/core/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40 #include <sys/poll.h>
  41
  42 #ifdef HAVE_PAM
  43 #include <security/pam_appl.h>
  44 #endif
  45
  46 #include "execute.h"
  47 #include "strv.h"
  48 #include "macro.h"
  49 #include "capability.h"
  50 #include "util.h"
  51 #include "log.h"
  52 #include "ioprio.h"
  53 #include "securebits.h"
  54 #include "cgroup.h"
  55 #include "namespace.h"
  56 #include "tcpwrap.h"
  57 #include "exit-status.h"
  58 #include "missing.h"
  59 #include "utmp-wtmp.h"
  60 #include "def.h"
  61 #include "loopback-setup.h"
  62 #include "path-util.h"
  63
  64 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
  65
  66 /* This assumes there is a 'tty' group */
  67 #define TTY_MODE 0620
  68
  69 static int shift_fds(int fds[], unsigned n_fds) {
  70         int start, restart_from;
  71
  72         if (n_fds <= 0)
  73                 return 0;
  74
  75         /* Modifies the fds array! (sorts it) */
  76
  77         assert(fds);
  78
  79         start = 0;
  80         for (;;) {
  81                 int i;
  82
  83                 restart_from = -1;
  84
  85                 for (i = start; i < (int) n_fds; i++) {
  86                         int nfd;
  87
  88                         /* Already at right index? */
  89                         if (fds[i] == i+3)
  90                                 continue;
  91
  92                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
  93                                 return -errno;
  94
  95                         close_nointr_nofail(fds[i]);
  96                         fds[i] = nfd;
  97
  98                         /* Hmm, the fd we wanted isn't free? Then
  99                          * let's remember that and try again from here*/
 100                         if (nfd != i+3 && restart_from < 0)
 101                                 restart_from = i;
 102                 }
 103
 104                 if (restart_from < 0)
 105                         break;
 106
 107                 start = restart_from;
 108         }
 109
 110         return 0;
 111 }
 112
 113 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 114         unsigned i;
 115         int r;
 116
 117         if (n_fds <= 0)
 118                 return 0;
 119
 120         assert(fds);
 121
 122         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 123
 124         for (i = 0; i < n_fds; i++) {
 125
 126                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 127                         return r;
 128
 129                 /* We unconditionally drop FD_CLOEXEC from the fds,
 130                  * since after all we want to pass these fds to our
 131                  * children */
 132
 133                 if ((r = fd_cloexec(fds[i], false)) < 0)
 134                         return r;
 135         }
 136
 137         return 0;
 138 }
 139
 140 static const char *tty_path(const ExecContext *context) {
 141         assert(context);
 142
 143         if (context->tty_path)
 144                 return context->tty_path;
 145
 146         return "/dev/console";
 147 }
 148
 149 void exec_context_tty_reset(const ExecContext *context) {
 150         assert(context);
 151
 152         if (context->tty_vhangup)
 153                 terminal_vhangup(tty_path(context));
 154
 155         if (context->tty_reset)
 156                 reset_terminal(tty_path(context));
 157
 158         if (context->tty_vt_disallocate && context->tty_path)
 159                 vt_disallocate(context->tty_path);
 160 }
 161
 162 static int open_null_as(int flags, int nfd) {
 163         int fd, r;
 164
 165         assert(nfd >= 0);
 166
 167         if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
 168                 return -errno;
 169
 170         if (fd != nfd) {
 171                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 172                 close_nointr_nofail(fd);
 173         } else
 174                 r = nfd;
 175
 176         return r;
 177 }
 178
 179 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, int nfd) {
 180         int fd, r;
 181         union sockaddr_union sa;
 182
 183         assert(context);
 184         assert(output < _EXEC_OUTPUT_MAX);
 185         assert(ident);
 186         assert(nfd >= 0);
 187
 188         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 189         if (fd < 0)
 190                 return -errno;
 191
 192         zero(sa);
 193         sa.un.sun_family = AF_UNIX;
 194         strncpy(sa.un.sun_path, "/run/systemd/journal/stdout", sizeof(sa.un.sun_path));
 195
 196         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 197         if (r < 0) {
 198                 close_nointr_nofail(fd);
 199                 return -errno;
 200         }
 201
 202         if (shutdown(fd, SHUT_RD) < 0) {
 203                 close_nointr_nofail(fd);
 204                 return -errno;
 205         }
 206
 207         dprintf(fd,
 208                 "%s\n"
 209                 "%i\n"
 210                 "%i\n"
 211                 "%i\n"
 212                 "%i\n"
 213                 "%i\n",
 214                 context->syslog_identifier ? context->syslog_identifier : ident,
 215                 context->syslog_priority,
 216                 !!context->syslog_level_prefix,
 217                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 218                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 219                 output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || output == EXEC_OUTPUT_KMSG_AND_CONSOLE || output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 220
 221         if (fd != nfd) {
 222                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 223                 close_nointr_nofail(fd);
 224         } else
 225                 r = nfd;
 226
 227         return r;
 228 }
 229 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 230         int fd, r;
 231
 232         assert(path);
 233         assert(nfd >= 0);
 234
 235         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 236                 return fd;
 237
 238         if (fd != nfd) {
 239                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 240                 close_nointr_nofail(fd);
 241         } else
 242                 r = nfd;
 243
 244         return r;
 245 }
 246
 247 static bool is_terminal_input(ExecInput i) {
 248         return
 249                 i == EXEC_INPUT_TTY ||
 250                 i == EXEC_INPUT_TTY_FORCE ||
 251                 i == EXEC_INPUT_TTY_FAIL;
 252 }
 253
 254 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 255
 256         if (is_terminal_input(std_input) && !apply_tty_stdin)
 257                 return EXEC_INPUT_NULL;
 258
 259         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 260                 return EXEC_INPUT_NULL;
 261
 262         return std_input;
 263 }
 264
 265 static int fixup_output(ExecOutput std_output, int socket_fd) {
 266
 267         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 268                 return EXEC_OUTPUT_INHERIT;
 269
 270         return std_output;
 271 }
 272
 273 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 274         ExecInput i;
 275
 276         assert(context);
 277
 278         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 279
 280         switch (i) {
 281
 282         case EXEC_INPUT_NULL:
 283                 return open_null_as(O_RDONLY, STDIN_FILENO);
 284
 285         case EXEC_INPUT_TTY:
 286         case EXEC_INPUT_TTY_FORCE:
 287         case EXEC_INPUT_TTY_FAIL: {
 288                 int fd, r;
 289
 290                 if ((fd = acquire_terminal(
 291                                      tty_path(context),
 292                                      i == EXEC_INPUT_TTY_FAIL,
 293                                      i == EXEC_INPUT_TTY_FORCE,
 294                                      false)) < 0)
 295                         return fd;
 296
 297                 if (fd != STDIN_FILENO) {
 298                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 299                         close_nointr_nofail(fd);
 300                 } else
 301                         r = STDIN_FILENO;
 302
 303                 return r;
 304         }
 305
 306         case EXEC_INPUT_SOCKET:
 307                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 308
 309         default:
 310                 assert_not_reached("Unknown input type");
 311         }
 312 }
 313
 314 static int setup_output(const ExecContext *context, int socket_fd, const char *ident, bool apply_tty_stdin) {
 315         ExecOutput o;
 316         ExecInput i;
 317
 318         assert(context);
 319         assert(ident);
 320
 321         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 322         o = fixup_output(context->std_output, socket_fd);
 323
 324         /* This expects the input is already set up */
 325
 326         switch (o) {
 327
 328         case EXEC_OUTPUT_INHERIT:
 329
 330                 /* If input got downgraded, inherit the original value */
 331                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 332                         return open_terminal_as(tty_path(context), O_WRONLY, STDOUT_FILENO);
 333
 334                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 335                 if (i != EXEC_INPUT_NULL)
 336                         return dup2(STDIN_FILENO, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 337
 338                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 339                 if (getppid() != 1)
 340                         return STDOUT_FILENO;
 341
 342                 /* We need to open /dev/null here anew, to get the
 343                  * right access mode. So we fall through */
 344
 345         case EXEC_OUTPUT_NULL:
 346                 return open_null_as(O_WRONLY, STDOUT_FILENO);
 347
 348         case EXEC_OUTPUT_TTY:
 349                 if (is_terminal_input(i))
 350                         return dup2(STDIN_FILENO, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 351
 352                 /* We don't reset the terminal if this is just about output */
 353                 return open_terminal_as(tty_path(context), O_WRONLY, STDOUT_FILENO);
 354
 355         case EXEC_OUTPUT_SYSLOG:
 356         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 357         case EXEC_OUTPUT_KMSG:
 358         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 359         case EXEC_OUTPUT_JOURNAL:
 360         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 361                 return connect_logger_as(context, o, ident, STDOUT_FILENO);
 362
 363         case EXEC_OUTPUT_SOCKET:
 364                 assert(socket_fd >= 0);
 365                 return dup2(socket_fd, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 366
 367         default:
 368                 assert_not_reached("Unknown output type");
 369         }
 370 }
 371
 372 static int setup_error(const ExecContext *context, int socket_fd, const char *ident, bool apply_tty_stdin) {
 373         ExecOutput o, e;
 374         ExecInput i;
 375
 376         assert(context);
 377         assert(ident);
 378
 379         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 380         o = fixup_output(context->std_output, socket_fd);
 381         e = fixup_output(context->std_error, socket_fd);
 382
 383         /* This expects the input and output are already set up */
 384
 385         /* Don't change the stderr file descriptor if we inherit all
 386          * the way and are not on a tty */
 387         if (e == EXEC_OUTPUT_INHERIT &&
 388             o == EXEC_OUTPUT_INHERIT &&
 389             i == EXEC_INPUT_NULL &&
 390             !is_terminal_input(context->std_input) &&
 391             getppid () != 1)
 392                 return STDERR_FILENO;
 393
 394         /* Duplicate from stdout if possible */
 395         if (e == o || e == EXEC_OUTPUT_INHERIT)
 396                 return dup2(STDOUT_FILENO, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 397
 398         switch (e) {
 399
 400         case EXEC_OUTPUT_NULL:
 401                 return open_null_as(O_WRONLY, STDERR_FILENO);
 402
 403         case EXEC_OUTPUT_TTY:
 404                 if (is_terminal_input(i))
 405                         return dup2(STDIN_FILENO, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 406
 407                 /* We don't reset the terminal if this is just about output */
 408                 return open_terminal_as(tty_path(context), O_WRONLY, STDERR_FILENO);
 409
 410         case EXEC_OUTPUT_SYSLOG:
 411         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 412         case EXEC_OUTPUT_KMSG:
 413         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 414         case EXEC_OUTPUT_JOURNAL:
 415         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 416                 return connect_logger_as(context, e, ident, STDERR_FILENO);
 417
 418         case EXEC_OUTPUT_SOCKET:
 419                 assert(socket_fd >= 0);
 420                 return dup2(socket_fd, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 421
 422         default:
 423                 assert_not_reached("Unknown error type");
 424         }
 425 }
 426
 427 static int chown_terminal(int fd, uid_t uid) {
 428         struct stat st;
 429
 430         assert(fd >= 0);
 431
 432         /* This might fail. What matters are the results. */
 433         (void) fchown(fd, uid, -1);
 434         (void) fchmod(fd, TTY_MODE);
 435
 436         if (fstat(fd, &st) < 0)
 437                 return -errno;
 438
 439         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 440                 return -EPERM;
 441
 442         return 0;
 443 }
 444
 445 static int setup_confirm_stdio(const ExecContext *context,
 446                                int *_saved_stdin,
 447                                int *_saved_stdout) {
 448         int fd = -1, saved_stdin, saved_stdout = -1, r;
 449
 450         assert(context);
 451         assert(_saved_stdin);
 452         assert(_saved_stdout);
 453
 454         /* This returns positive EXIT_xxx return values instead of
 455          * negative errno style values! */
 456
 457         if ((saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3)) < 0)
 458                 return EXIT_STDIN;
 459
 460         if ((saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3)) < 0) {
 461                 r = EXIT_STDOUT;
 462                 goto fail;
 463         }
 464
 465         if ((fd = acquire_terminal(
 466                              tty_path(context),
 467                              context->std_input == EXEC_INPUT_TTY_FAIL,
 468                              context->std_input == EXEC_INPUT_TTY_FORCE,
 469                              false)) < 0) {
 470                 r = EXIT_STDIN;
 471                 goto fail;
 472         }
 473
 474         if (chown_terminal(fd, getuid()) < 0) {
 475                 r = EXIT_STDIN;
 476                 goto fail;
 477         }
 478
 479         if (dup2(fd, STDIN_FILENO) < 0) {
 480                 r = EXIT_STDIN;
 481                 goto fail;
 482         }
 483
 484         if (dup2(fd, STDOUT_FILENO) < 0) {
 485                 r = EXIT_STDOUT;
 486                 goto fail;
 487         }
 488
 489         if (fd >= 2)
 490                 close_nointr_nofail(fd);
 491
 492         *_saved_stdin = saved_stdin;
 493         *_saved_stdout = saved_stdout;
 494
 495         return 0;
 496
 497 fail:
 498         if (saved_stdout >= 0)
 499                 close_nointr_nofail(saved_stdout);
 500
 501         if (saved_stdin >= 0)
 502                 close_nointr_nofail(saved_stdin);
 503
 504         if (fd >= 0)
 505                 close_nointr_nofail(fd);
 506
 507         return r;
 508 }
 509
 510 static int restore_confirm_stdio(const ExecContext *context,
 511                                  int *saved_stdin,
 512                                  int *saved_stdout,
 513                                  bool *keep_stdin,
 514                                  bool *keep_stdout) {
 515
 516         assert(context);
 517         assert(saved_stdin);
 518         assert(*saved_stdin >= 0);
 519         assert(saved_stdout);
 520         assert(*saved_stdout >= 0);
 521
 522         /* This returns positive EXIT_xxx return values instead of
 523          * negative errno style values! */
 524
 525         if (is_terminal_input(context->std_input)) {
 526
 527                 /* The service wants terminal input. */
 528
 529                 *keep_stdin = true;
 530                 *keep_stdout =
 531                         context->std_output == EXEC_OUTPUT_INHERIT ||
 532                         context->std_output == EXEC_OUTPUT_TTY;
 533
 534         } else {
 535                 /* If the service doesn't want a controlling terminal,
 536                  * then we need to get rid entirely of what we have
 537                  * already. */
 538
 539                 if (release_terminal() < 0)
 540                         return EXIT_STDIN;
 541
 542                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 543                         return EXIT_STDIN;
 544
 545                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 546                         return EXIT_STDOUT;
 547
 548                 *keep_stdout = *keep_stdin = false;
 549         }
 550
 551         return 0;
 552 }
 553
 554 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 555         bool keep_groups = false;
 556         int r;
 557
 558         assert(context);
 559
 560         /* Lookup and set GID and supplementary group list. Here too
 561          * we avoid NSS lookups for gid=0. */
 562
 563         if (context->group || username) {
 564
 565                 if (context->group) {
 566                         const char *g = context->group;
 567
 568                         if ((r = get_group_creds(&g, &gid)) < 0)
 569                                 return r;
 570                 }
 571
 572                 /* First step, initialize groups from /etc/groups */
 573                 if (username && gid != 0) {
 574                         if (initgroups(username, gid) < 0)
 575                                 return -errno;
 576
 577                         keep_groups = true;
 578                 }
 579
 580                 /* Second step, set our gids */
 581                 if (setresgid(gid, gid, gid) < 0)
 582                         return -errno;
 583         }
 584
 585         if (context->supplementary_groups) {
 586                 int ngroups_max, k;
 587                 gid_t *gids;
 588                 char **i;
 589
 590                 /* Final step, initialize any manually set supplementary groups */
 591                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 592
 593                 if (!(gids = new(gid_t, ngroups_max)))
 594                         return -ENOMEM;
 595
 596                 if (keep_groups) {
 597                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 598                                 free(gids);
 599                                 return -errno;
 600                         }
 601                 } else
 602                         k = 0;
 603
 604                 STRV_FOREACH(i, context->supplementary_groups) {
 605                         const char *g;
 606
 607                         if (k >= ngroups_max) {
 608                                 free(gids);
 609                                 return -E2BIG;
 610                         }
 611
 612                         g = *i;
 613                         r = get_group_creds(&g, gids+k);
 614                         if (r < 0) {
 615                                 free(gids);
 616                                 return r;
 617                         }
 618
 619                         k++;
 620                 }
 621
 622                 if (setgroups(k, gids) < 0) {
 623                         free(gids);
 624                         return -errno;
 625                 }
 626
 627                 free(gids);
 628         }
 629
 630         return 0;
 631 }
 632
 633 static int enforce_user(const ExecContext *context, uid_t uid) {
 634         int r;
 635         assert(context);
 636
 637         /* Sets (but doesn't lookup) the uid and make sure we keep the
 638          * capabilities while doing so. */
 639
 640         if (context->capabilities) {
 641                 cap_t d;
 642                 static const cap_value_t bits[] = {
 643                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 644                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 645                 };
 646
 647                 /* First step: If we need to keep capabilities but
 648                  * drop privileges we need to make sure we keep our
 649                  * caps, whiel we drop privileges. */
 650                 if (uid != 0) {
 651                         int sb = context->secure_bits|SECURE_KEEP_CAPS;
 652
 653                         if (prctl(PR_GET_SECUREBITS) != sb)
 654                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 655                                         return -errno;
 656                 }
 657
 658                 /* Second step: set the capabilities. This will reduce
 659                  * the capabilities to the minimum we need. */
 660
 661                 if (!(d = cap_dup(context->capabilities)))
 662                         return -errno;
 663
 664                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 665                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 666                         r = -errno;
 667                         cap_free(d);
 668                         return r;
 669                 }
 670
 671                 if (cap_set_proc(d) < 0) {
 672                         r = -errno;
 673                         cap_free(d);
 674                         return r;
 675                 }
 676
 677                 cap_free(d);
 678         }
 679
 680         /* Third step: actually set the uids */
 681         if (setresuid(uid, uid, uid) < 0)
 682                 return -errno;
 683
 684         /* At this point we should have all necessary capabilities but
 685            are otherwise a normal user. However, the caps might got
 686            corrupted due to the setresuid() so we need clean them up
 687            later. This is done outside of this call. */
 688
 689         return 0;
 690 }
 691
 692 #ifdef HAVE_PAM
 693
 694 static int null_conv(
 695                 int num_msg,
 696                 const struct pam_message **msg,
 697                 struct pam_response **resp,
 698                 void *appdata_ptr) {
 699
 700         /* We don't support conversations */
 701
 702         return PAM_CONV_ERR;
 703 }
 704
 705 static int setup_pam(
 706                 const char *name,
 707                 const char *user,
 708                 uid_t uid,
 709                 const char *tty,
 710                 char ***pam_env,
 711                 int fds[], unsigned n_fds) {
 712
 713         static const struct pam_conv conv = {
 714                 .conv = null_conv,
 715                 .appdata_ptr = NULL
 716         };
 717
 718         pam_handle_t *handle = NULL;
 719         sigset_t ss, old_ss;
 720         int pam_code = PAM_SUCCESS;
 721         int err;
 722         char **e = NULL;
 723         bool close_session = false;
 724         pid_t pam_pid = 0, parent_pid;
 725
 726         assert(name);
 727         assert(user);
 728         assert(pam_env);
 729
 730         /* We set up PAM in the parent process, then fork. The child
 731          * will then stay around until killed via PR_GET_PDEATHSIG or
 732          * systemd via the cgroup logic. It will then remove the PAM
 733          * session again. The parent process will exec() the actual
 734          * daemon. We do things this way to ensure that the main PID
 735          * of the daemon is the one we initially fork()ed. */
 736
 737         if ((pam_code = pam_start(name, user, &conv, &handle)) != PAM_SUCCESS) {
 738                 handle = NULL;
 739                 goto fail;
 740         }
 741
 742         if (tty)
 743                 if ((pam_code = pam_set_item(handle, PAM_TTY, tty)) != PAM_SUCCESS)
 744                         goto fail;
 745
 746         if ((pam_code = pam_acct_mgmt(handle, PAM_SILENT)) != PAM_SUCCESS)
 747                 goto fail;
 748
 749         if ((pam_code = pam_open_session(handle, PAM_SILENT)) != PAM_SUCCESS)
 750                 goto fail;
 751
 752         close_session = true;
 753
 754         if ((!(e = pam_getenvlist(handle)))) {
 755                 pam_code = PAM_BUF_ERR;
 756                 goto fail;
 757         }
 758
 759         /* Block SIGTERM, so that we know that it won't get lost in
 760          * the child */
 761         if (sigemptyset(&ss) < 0 ||
 762             sigaddset(&ss, SIGTERM) < 0 ||
 763             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 764                 goto fail;
 765
 766         parent_pid = getpid();
 767
 768         if ((pam_pid = fork()) < 0)
 769                 goto fail;
 770
 771         if (pam_pid == 0) {
 772                 int sig;
 773                 int r = EXIT_PAM;
 774
 775                 /* The child's job is to reset the PAM session on
 776                  * termination */
 777
 778                 /* This string must fit in 10 chars (i.e. the length
 779                  * of "/sbin/init"), to look pretty in /bin/ps */
 780                 rename_process("(sd-pam)");
 781
 782                 /* Make sure we don't keep open the passed fds in this
 783                 child. We assume that otherwise only those fds are
 784                 open here that have been opened by PAM. */
 785                 close_many(fds, n_fds);
 786
 787                 /* Drop privileges - we don't need any to pam_close_session
 788                  * and this will make PR_SET_PDEATHSIG work in most cases.
 789                  * If this fails, ignore the error - but expect sd-pam threads
 790                  * to fail to exit normally */
 791                 if (setresuid(uid, uid, uid) < 0)
 792                         log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
 793
 794                 /* Wait until our parent died. This will only work if
 795                  * the above setresuid() succeeds, otherwise the kernel
 796                  * will not allow unprivileged parents kill their privileged
 797                  * children this way. We rely on the control groups kill logic
 798                  * to do the rest for us. */
 799                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 800                         goto child_finish;
 801
 802                 /* Check if our parent process might already have
 803                  * died? */
 804                 if (getppid() == parent_pid) {
 805                         for (;;) {
 806                                 if (sigwait(&ss, &sig) < 0) {
 807                                         if (errno == EINTR)
 808                                                 continue;
 809
 810                                         goto child_finish;
 811                                 }
 812
 813                                 assert(sig == SIGTERM);
 814                                 break;
 815                         }
 816                 }
 817
 818                 /* If our parent died we'll end the session */
 819                 if (getppid() != parent_pid)
 820                         if ((pam_code = pam_close_session(handle, PAM_DATA_SILENT)) != PAM_SUCCESS)
 821                                 goto child_finish;
 822
 823                 r = 0;
 824
 825         child_finish:
 826                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 827                 _exit(r);
 828         }
 829
 830         /* If the child was forked off successfully it will do all the
 831          * cleanups, so forget about the handle here. */
 832         handle = NULL;
 833
 834         /* Unblock SIGTERM again in the parent */
 835         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 836                 goto fail;
 837
 838         /* We close the log explicitly here, since the PAM modules
 839          * might have opened it, but we don't want this fd around. */
 840         closelog();
 841
 842         *pam_env = e;
 843         e = NULL;
 844
 845         return 0;
 846
 847 fail:
 848         if (pam_code != PAM_SUCCESS)
 849                 err = -EPERM;  /* PAM errors do not map to errno */
 850         else
 851                 err = -errno;
 852
 853         if (handle) {
 854                 if (close_session)
 855                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
 856
 857                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 858         }
 859
 860         strv_free(e);
 861
 862         closelog();
 863
 864         if (pam_pid > 1) {
 865                 kill(pam_pid, SIGTERM);
 866                 kill(pam_pid, SIGCONT);
 867         }
 868
 869         return err;
 870 }
 871 #endif
 872
 873 static void rename_process_from_path(const char *path) {
 874         char process_name[11];
 875         const char *p;
 876         size_t l;
 877
 878         /* This resulting string must fit in 10 chars (i.e. the length
 879          * of "/sbin/init") to look pretty in /bin/ps */
 880
 881         p = path_get_file_name(path);
 882         if (isempty(p)) {
 883                 rename_process("(...)");
 884                 return;
 885         }
 886
 887         l = strlen(p);
 888         if (l > 8) {
 889                 /* The end of the process name is usually more
 890                  * interesting, since the first bit might just be
 891                  * "systemd-" */
 892                 p = p + l - 8;
 893                 l = 8;
 894         }
 895
 896         process_name[0] = '(';
 897         memcpy(process_name+1, p, l);
 898         process_name[1+l] = ')';
 899         process_name[1+l+1] = 0;
 900
 901         rename_process(process_name);
 902 }
 903
 904 int exec_spawn(ExecCommand *command,
 905                char **argv,
 906                const ExecContext *context,
 907                int fds[], unsigned n_fds,
 908                char **environment,
 909                bool apply_permissions,
 910                bool apply_chroot,
 911                bool apply_tty_stdin,
 912                bool confirm_spawn,
 913                CGroupBonding *cgroup_bondings,
 914                CGroupAttribute *cgroup_attributes,
 915                const char *cgroup_suffix,
 916                int idle_pipe[2],
 917                pid_t *ret) {
 918
 919         pid_t pid;
 920         int r;
 921         char *line;
 922         int socket_fd;
 923         char **files_env = NULL;
 924
 925         assert(command);
 926         assert(context);
 927         assert(ret);
 928         assert(fds || n_fds <= 0);
 929
 930         if (context->std_input == EXEC_INPUT_SOCKET ||
 931             context->std_output == EXEC_OUTPUT_SOCKET ||
 932             context->std_error == EXEC_OUTPUT_SOCKET) {
 933
 934                 if (n_fds != 1)
 935                         return -EINVAL;
 936
 937                 socket_fd = fds[0];
 938
 939                 fds = NULL;
 940                 n_fds = 0;
 941         } else
 942                 socket_fd = -1;
 943
 944         if ((r = exec_context_load_environment(context, &files_env)) < 0) {
 945                 log_error("Failed to load environment files: %s", strerror(-r));
 946                 return r;
 947         }
 948
 949         if (!argv)
 950                 argv = command->argv;
 951
 952         if (!(line = exec_command_line(argv))) {
 953                 r = -ENOMEM;
 954                 goto fail_parent;
 955         }
 956
 957         log_debug("About to execute: %s", line);
 958         free(line);
 959
 960         r = cgroup_bonding_realize_list(cgroup_bondings);
 961         if (r < 0)
 962                 goto fail_parent;
 963
 964         cgroup_attribute_apply_list(cgroup_attributes, cgroup_bondings);
 965
 966         if ((pid = fork()) < 0) {
 967                 r = -errno;
 968                 goto fail_parent;
 969         }
 970
 971         if (pid == 0) {
 972                 int i, err;
 973                 sigset_t ss;
 974                 const char *username = NULL, *home = NULL;
 975                 uid_t uid = (uid_t) -1;
 976                 gid_t gid = (gid_t) -1;
 977                 char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
 978                 unsigned n_env = 0;
 979                 int saved_stdout = -1, saved_stdin = -1;
 980                 bool keep_stdout = false, keep_stdin = false, set_access = false;
 981
 982                 /* child */
 983
 984                 rename_process_from_path(command->path);
 985
 986                 /* We reset exactly these signals, since they are the
 987                  * only ones we set to SIG_IGN in the main daemon. All
 988                  * others we leave untouched because we set them to
 989                  * SIG_DFL or a valid handler initially, both of which
 990                  * will be demoted to SIG_DFL. */
 991                 default_signals(SIGNALS_CRASH_HANDLER,
 992                                 SIGNALS_IGNORE, -1);
 993
 994                 if (context->ignore_sigpipe)
 995                         ignore_signals(SIGPIPE, -1);
 996
 997                 assert_se(sigemptyset(&ss) == 0);
 998                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
 999                         err = -errno;
1000                         r = EXIT_SIGNAL_MASK;
1001                         goto fail_child;
1002                 }
1003
1004                 if (idle_pipe) {
1005                         if (idle_pipe[1] >= 0)
1006                                 close_nointr_nofail(idle_pipe[1]);
1007                         if (idle_pipe[0] >= 0) {
1008                                 fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC);
1009                                 close_nointr_nofail(idle_pipe[0]);
1010                         }
1011                 }
1012
1013                 /* Close sockets very early to make sure we don't
1014                  * block init reexecution because it cannot bind its
1015                  * sockets */
1016                 log_forget_fds();
1017                 err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
1018                                            socket_fd >= 0 ? 1 : n_fds);
1019                 if (err < 0) {
1020                         r = EXIT_FDS;
1021                         goto fail_child;
1022                 }
1023
1024                 if (!context->same_pgrp)
1025                         if (setsid() < 0) {
1026                                 err = -errno;
1027                                 r = EXIT_SETSID;
1028                                 goto fail_child;
1029                         }
1030
1031                 if (context->tcpwrap_name) {
1032                         if (socket_fd >= 0)
1033                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1034                                         err = -EACCES;
1035                                         r = EXIT_TCPWRAP;
1036                                         goto fail_child;
1037                                 }
1038
1039                         for (i = 0; i < (int) n_fds; i++) {
1040                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1041                                         err = -EACCES;
1042                                         r = EXIT_TCPWRAP;
1043                                         goto fail_child;
1044                                 }
1045                         }
1046                 }
1047
1048                 exec_context_tty_reset(context);
1049
1050                 /* We skip the confirmation step if we shall not apply the TTY */
1051                 if (confirm_spawn &&
1052                     (!is_terminal_input(context->std_input) || apply_tty_stdin)) {
1053                         char response;
1054
1055                         /* Set up terminal for the question */
1056                         if ((r = setup_confirm_stdio(context,
1057                                                      &saved_stdin, &saved_stdout))) {
1058                                 err = -errno;
1059                                 goto fail_child;
1060                         }
1061
1062                         /* Now ask the question. */
1063                         if (!(line = exec_command_line(argv))) {
1064                                 err = -ENOMEM;
1065                                 r = EXIT_MEMORY;
1066                                 goto fail_child;
1067                         }
1068
1069                         r = ask(&response, "yns", "Execute %s? [Yes, No, Skip] ", line);
1070                         free(line);
1071
1072                         if (r < 0 || response == 'n') {
1073                                 err = -ECANCELED;
1074                                 r = EXIT_CONFIRM;
1075                                 goto fail_child;
1076                         } else if (response == 's') {
1077                                 err = r = 0;
1078                                 goto fail_child;
1079                         }
1080
1081                         /* Release terminal for the question */
1082                         if ((r = restore_confirm_stdio(context,
1083                                                        &saved_stdin, &saved_stdout,
1084                                                        &keep_stdin, &keep_stdout))) {
1085                                 err = -errno;
1086                                 goto fail_child;
1087                         }
1088                 }
1089
1090                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1091                  * must sure to drop O_NONBLOCK */
1092                 if (socket_fd >= 0)
1093                         fd_nonblock(socket_fd, false);
1094
1095                 if (!keep_stdin) {
1096                         err = setup_input(context, socket_fd, apply_tty_stdin);
1097                         if (err < 0) {
1098                                 r = EXIT_STDIN;
1099                                 goto fail_child;
1100                         }
1101                 }
1102
1103                 if (!keep_stdout) {
1104                         err = setup_output(context, socket_fd, path_get_file_name(command->path), apply_tty_stdin);
1105                         if (err < 0) {
1106                                 r = EXIT_STDOUT;
1107                                 goto fail_child;
1108                         }
1109                 }
1110
1111                 err = setup_error(context, socket_fd, path_get_file_name(command->path), apply_tty_stdin);
1112                 if (err < 0) {
1113                         r = EXIT_STDERR;
1114                         goto fail_child;
1115                 }
1116
1117                 if (cgroup_bondings) {
1118                         err = cgroup_bonding_install_list(cgroup_bondings, 0, cgroup_suffix);
1119                         if (err < 0) {
1120                                 r = EXIT_CGROUP;
1121                                 goto fail_child;
1122                         }
1123                 }
1124
1125                 if (context->oom_score_adjust_set) {
1126                         char t[16];
1127
1128                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1129                         char_array_0(t);
1130
1131                         if (write_one_line_file("/proc/self/oom_score_adj", t) < 0) {
1132                                 /* Compatibility with Linux <= 2.6.35 */
1133
1134                                 int adj;
1135
1136                                 adj = (context->oom_score_adjust * -OOM_DISABLE) / OOM_SCORE_ADJ_MAX;
1137                                 adj = CLAMP(adj, OOM_DISABLE, OOM_ADJUST_MAX);
1138
1139                                 snprintf(t, sizeof(t), "%i", adj);
1140                                 char_array_0(t);
1141
1142                                 if (write_one_line_file("/proc/self/oom_adj", t) < 0
1143                                     && errno != EACCES) {
1144                                         err = -errno;
1145                                         r = EXIT_OOM_ADJUST;
1146                                         goto fail_child;
1147                                 }
1148                         }
1149                 }
1150
1151                 if (context->nice_set)
1152                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1153                                 err = -errno;
1154                                 r = EXIT_NICE;
1155                                 goto fail_child;
1156                         }
1157
1158                 if (context->cpu_sched_set) {
1159                         struct sched_param param;
1160
1161                         zero(param);
1162                         param.sched_priority = context->cpu_sched_priority;
1163
1164                         if (sched_setscheduler(0, context->cpu_sched_policy |
1165                                                (context->cpu_sched_reset_on_fork ? SCHED_RESET_ON_FORK : 0), &param) < 0) {
1166                                 err = -errno;
1167                                 r = EXIT_SETSCHEDULER;
1168                                 goto fail_child;
1169                         }
1170                 }
1171
1172                 if (context->cpuset)
1173                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1174                                 err = -errno;
1175                                 r = EXIT_CPUAFFINITY;
1176                                 goto fail_child;
1177                         }
1178
1179                 if (context->ioprio_set)
1180                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1181                                 err = -errno;
1182                                 r = EXIT_IOPRIO;
1183                                 goto fail_child;
1184                         }
1185
1186                 if (context->timer_slack_nsec != (nsec_t) -1)
1187                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1188                                 err = -errno;
1189                                 r = EXIT_TIMERSLACK;
1190                                 goto fail_child;
1191                         }
1192
1193                 if (context->utmp_id)
1194                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1195
1196                 if (context->user) {
1197                         username = context->user;
1198                         err = get_user_creds(&username, &uid, &gid, &home);
1199                         if (err < 0) {
1200                                 r = EXIT_USER;
1201                                 goto fail_child;
1202                         }
1203
1204                         if (is_terminal_input(context->std_input)) {
1205                                 err = chown_terminal(STDIN_FILENO, uid);
1206                                 if (err < 0) {
1207                                         r = EXIT_STDIN;
1208                                         goto fail_child;
1209                                 }
1210                         }
1211
1212                         if (cgroup_bondings && context->control_group_modify) {
1213                                 err = cgroup_bonding_set_group_access_list(cgroup_bondings, 0755, uid, gid);
1214                                 if (err >= 0)
1215                                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, 0644, uid, gid, context->control_group_persistent);
1216                                 if (err < 0) {
1217                                         r = EXIT_CGROUP;
1218                                         goto fail_child;
1219                                 }
1220
1221                                 set_access = true;
1222                         }
1223                 }
1224
1225                 if (cgroup_bondings && !set_access && context->control_group_persistent >= 0)  {
1226                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, (mode_t) -1, (uid_t) -1, (uid_t) -1, context->control_group_persistent);
1227                         if (err < 0) {
1228                                 r = EXIT_CGROUP;
1229                                 goto fail_child;
1230                         }
1231                 }
1232
1233                 if (apply_permissions) {
1234                         err = enforce_groups(context, username, gid);
1235                         if (err < 0) {
1236                                 r = EXIT_GROUP;
1237                                 goto fail_child;
1238                         }
1239                 }
1240
1241                 umask(context->umask);
1242
1243 #ifdef HAVE_PAM
1244                 if (context->pam_name && username) {
1245                         err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
1246                         if (err < 0) {
1247                                 r = EXIT_PAM;
1248                                 goto fail_child;
1249                         }
1250                 }
1251 #endif
1252                 if (context->private_network) {
1253                         if (unshare(CLONE_NEWNET) < 0) {
1254                                 err = -errno;
1255                                 r = EXIT_NETWORK;
1256                                 goto fail_child;
1257                         }
1258
1259                         loopback_setup();
1260                 }
1261
1262                 if (strv_length(context->read_write_dirs) > 0 ||
1263                     strv_length(context->read_only_dirs) > 0 ||
1264                     strv_length(context->inaccessible_dirs) > 0 ||
1265                     context->mount_flags != MS_SHARED ||
1266                     context->private_tmp) {
1267                         err = setup_namespace(context->read_write_dirs,
1268                                               context->read_only_dirs,
1269                                               context->inaccessible_dirs,
1270                                               context->private_tmp,
1271                                               context->mount_flags);
1272                         if (err < 0) {
1273                                 r = EXIT_NAMESPACE;
1274                                 goto fail_child;
1275                         }
1276                 }
1277
1278                 if (apply_chroot) {
1279                         if (context->root_directory)
1280                                 if (chroot(context->root_directory) < 0) {
1281                                         err = -errno;
1282                                         r = EXIT_CHROOT;
1283                                         goto fail_child;
1284                                 }
1285
1286                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1287                                 err = -errno;
1288                                 r = EXIT_CHDIR;
1289                                 goto fail_child;
1290                         }
1291                 } else {
1292
1293                         char *d;
1294
1295                         if (asprintf(&d, "%s/%s",
1296                                      context->root_directory ? context->root_directory : "",
1297                                      context->working_directory ? context->working_directory : "") < 0) {
1298                                 err = -ENOMEM;
1299                                 r = EXIT_MEMORY;
1300                                 goto fail_child;
1301                         }
1302
1303                         if (chdir(d) < 0) {
1304                                 err = -errno;
1305                                 free(d);
1306                                 r = EXIT_CHDIR;
1307                                 goto fail_child;
1308                         }
1309
1310                         free(d);
1311                 }
1312
1313                 /* We repeat the fd closing here, to make sure that
1314                  * nothing is leaked from the PAM modules */
1315                 err = close_all_fds(fds, n_fds);
1316                 if (err >= 0)
1317                         err = shift_fds(fds, n_fds);
1318                 if (err >= 0)
1319                         err = flags_fds(fds, n_fds, context->non_blocking);
1320                 if (err < 0) {
1321                         r = EXIT_FDS;
1322                         goto fail_child;
1323                 }
1324
1325                 if (apply_permissions) {
1326
1327                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1328                                 if (!context->rlimit[i])
1329                                         continue;
1330
1331                                 if (setrlimit_closest(i, context->rlimit[i]) < 0) {
1332                                         err = -errno;
1333                                         r = EXIT_LIMITS;
1334                                         goto fail_child;
1335                                 }
1336                         }
1337
1338                         if (context->capability_bounding_set_drop) {
1339                                 err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
1340                                 if (err < 0) {
1341                                         r = EXIT_CAPABILITIES;
1342                                         goto fail_child;
1343                                 }
1344                         }
1345
1346                         if (context->user) {
1347                                 err = enforce_user(context, uid);
1348                                 if (err < 0) {
1349                                         r = EXIT_USER;
1350                                         goto fail_child;
1351                                 }
1352                         }
1353
1354                         /* PR_GET_SECUREBITS is not privileged, while
1355                          * PR_SET_SECUREBITS is. So to suppress
1356                          * potential EPERMs we'll try not to call
1357                          * PR_SET_SECUREBITS unless necessary. */
1358                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1359                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1360                                         err = -errno;
1361                                         r = EXIT_SECUREBITS;
1362                                         goto fail_child;
1363                                 }
1364
1365                         if (context->capabilities)
1366                                 if (cap_set_proc(context->capabilities) < 0) {
1367                                         err = -errno;
1368                                         r = EXIT_CAPABILITIES;
1369                                         goto fail_child;
1370                                 }
1371                 }
1372
1373                 if (!(our_env = new0(char*, 7))) {
1374                         err = -ENOMEM;
1375                         r = EXIT_MEMORY;
1376                         goto fail_child;
1377                 }
1378
1379                 if (n_fds > 0)
1380                         if (asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1381                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0) {
1382                                 err = -ENOMEM;
1383                                 r = EXIT_MEMORY;
1384                                 goto fail_child;
1385                         }
1386
1387                 if (home)
1388                         if (asprintf(our_env + n_env++, "HOME=%s", home) < 0) {
1389                                 err = -ENOMEM;
1390                                 r = EXIT_MEMORY;
1391                                 goto fail_child;
1392                         }
1393
1394                 if (username)
1395                         if (asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1396                             asprintf(our_env + n_env++, "USER=%s", username) < 0) {
1397                                 err = -ENOMEM;
1398                                 r = EXIT_MEMORY;
1399                                 goto fail_child;
1400                         }
1401
1402                 if (is_terminal_input(context->std_input) ||
1403                     context->std_output == EXEC_OUTPUT_TTY ||
1404                     context->std_error == EXEC_OUTPUT_TTY)
1405                         if (!(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))) {
1406                                 err = -ENOMEM;
1407                                 r = EXIT_MEMORY;
1408                                 goto fail_child;
1409                         }
1410
1411                 assert(n_env <= 7);
1412
1413                 if (!(final_env = strv_env_merge(
1414                                       5,
1415                                       environment,
1416                                       our_env,
1417                                       context->environment,
1418                                       files_env,
1419                                       pam_env,
1420                                       NULL))) {
1421                         err = -ENOMEM;
1422                         r = EXIT_MEMORY;
1423                         goto fail_child;
1424                 }
1425
1426                 if (!(final_argv = replace_env_argv(argv, final_env))) {
1427                         err = -ENOMEM;
1428                         r = EXIT_MEMORY;
1429                         goto fail_child;
1430                 }
1431
1432                 final_env = strv_env_clean(final_env);
1433
1434                 execve(command->path, final_argv, final_env);
1435                 err = -errno;
1436                 r = EXIT_EXEC;
1437
1438         fail_child:
1439                 if (r != 0) {
1440                         log_open();
1441                         log_warning("Failed at step %s spawning %s: %s",
1442                                     exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1443                                     command->path, strerror(-err));
1444                 }
1445
1446                 strv_free(our_env);
1447                 strv_free(final_env);
1448                 strv_free(pam_env);
1449                 strv_free(files_env);
1450                 strv_free(final_argv);
1451
1452                 if (saved_stdin >= 0)
1453                         close_nointr_nofail(saved_stdin);
1454
1455                 if (saved_stdout >= 0)
1456                         close_nointr_nofail(saved_stdout);
1457
1458                 _exit(r);
1459         }
1460
1461         strv_free(files_env);
1462
1463         /* We add the new process to the cgroup both in the child (so
1464          * that we can be sure that no user code is ever executed
1465          * outside of the cgroup) and in the parent (so that we can be
1466          * sure that when we kill the cgroup the process will be
1467          * killed too). */
1468         if (cgroup_bondings)
1469                 cgroup_bonding_install_list(cgroup_bondings, pid, cgroup_suffix);
1470
1471         log_debug("Forked %s as %lu", command->path, (unsigned long) pid);
1472
1473         exec_status_start(&command->exec_status, pid);
1474
1475         *ret = pid;
1476         return 0;
1477
1478 fail_parent:
1479         strv_free(files_env);
1480
1481         return r;
1482 }
1483
1484 void exec_context_init(ExecContext *c) {
1485         assert(c);
1486
1487         c->umask = 0022;
1488         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1489         c->cpu_sched_policy = SCHED_OTHER;
1490         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1491         c->syslog_level_prefix = true;
1492         c->mount_flags = MS_SHARED;
1493         c->kill_signal = SIGTERM;
1494         c->send_sigkill = true;
1495         c->control_group_persistent = -1;
1496         c->ignore_sigpipe = true;
1497         c->timer_slack_nsec = (nsec_t) -1;
1498 }
1499
1500 void exec_context_done(ExecContext *c) {
1501         unsigned l;
1502
1503         assert(c);
1504
1505         strv_free(c->environment);
1506         c->environment = NULL;
1507
1508         strv_free(c->environment_files);
1509         c->environment_files = NULL;
1510
1511         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1512                 free(c->rlimit[l]);
1513                 c->rlimit[l] = NULL;
1514         }
1515
1516         free(c->working_directory);
1517         c->working_directory = NULL;
1518         free(c->root_directory);
1519         c->root_directory = NULL;
1520
1521         free(c->tty_path);
1522         c->tty_path = NULL;
1523
1524         free(c->tcpwrap_name);
1525         c->tcpwrap_name = NULL;
1526
1527         free(c->syslog_identifier);
1528         c->syslog_identifier = NULL;
1529
1530         free(c->user);
1531         c->user = NULL;
1532
1533         free(c->group);
1534         c->group = NULL;
1535
1536         strv_free(c->supplementary_groups);
1537         c->supplementary_groups = NULL;
1538
1539         free(c->pam_name);
1540         c->pam_name = NULL;
1541
1542         if (c->capabilities) {
1543                 cap_free(c->capabilities);
1544                 c->capabilities = NULL;
1545         }
1546
1547         strv_free(c->read_only_dirs);
1548         c->read_only_dirs = NULL;
1549
1550         strv_free(c->read_write_dirs);
1551         c->read_write_dirs = NULL;
1552
1553         strv_free(c->inaccessible_dirs);
1554         c->inaccessible_dirs = NULL;
1555
1556         if (c->cpuset)
1557                 CPU_FREE(c->cpuset);
1558
1559         free(c->utmp_id);
1560         c->utmp_id = NULL;
1561 }
1562
1563 void exec_command_done(ExecCommand *c) {
1564         assert(c);
1565
1566         free(c->path);
1567         c->path = NULL;
1568
1569         strv_free(c->argv);
1570         c->argv = NULL;
1571 }
1572
1573 void exec_command_done_array(ExecCommand *c, unsigned n) {
1574         unsigned i;
1575
1576         for (i = 0; i < n; i++)
1577                 exec_command_done(c+i);
1578 }
1579
1580 void exec_command_free_list(ExecCommand *c) {
1581         ExecCommand *i;
1582
1583         while ((i = c)) {
1584                 LIST_REMOVE(ExecCommand, command, c, i);
1585                 exec_command_done(i);
1586                 free(i);
1587         }
1588 }
1589
1590 void exec_command_free_array(ExecCommand **c, unsigned n) {
1591         unsigned i;
1592
1593         for (i = 0; i < n; i++) {
1594                 exec_command_free_list(c[i]);
1595                 c[i] = NULL;
1596         }
1597 }
1598
1599 int exec_context_load_environment(const ExecContext *c, char ***l) {
1600         char **i, **r = NULL;
1601
1602         assert(c);
1603         assert(l);
1604
1605         STRV_FOREACH(i, c->environment_files) {
1606                 char *fn;
1607                 int k;
1608                 bool ignore = false;
1609                 char **p;
1610
1611                 fn = *i;
1612
1613                 if (fn[0] == '-') {
1614                         ignore = true;
1615                         fn ++;
1616                 }
1617
1618                 if (!path_is_absolute(fn)) {
1619
1620                         if (ignore)
1621                                 continue;
1622
1623                         strv_free(r);
1624                         return -EINVAL;
1625                 }
1626
1627                 if ((k = load_env_file(fn, &p)) < 0) {
1628
1629                         if (ignore)
1630                                 continue;
1631
1632                         strv_free(r);
1633                         return k;
1634                 }
1635
1636                 if (r == NULL)
1637                         r = p;
1638                 else {
1639                         char **m;
1640
1641                         m = strv_env_merge(2, r, p);
1642                         strv_free(r);
1643                         strv_free(p);
1644
1645                         if (!m)
1646                                 return -ENOMEM;
1647
1648                         r = m;
1649                 }
1650         }
1651
1652         *l = r;
1653
1654         return 0;
1655 }
1656
1657 static void strv_fprintf(FILE *f, char **l) {
1658         char **g;
1659
1660         assert(f);
1661
1662         STRV_FOREACH(g, l)
1663                 fprintf(f, " %s", *g);
1664 }
1665
1666 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1667         char ** e;
1668         unsigned i;
1669
1670         assert(c);
1671         assert(f);
1672
1673         if (!prefix)
1674                 prefix = "";
1675
1676         fprintf(f,
1677                 "%sUMask: %04o\n"
1678                 "%sWorkingDirectory: %s\n"
1679                 "%sRootDirectory: %s\n"
1680                 "%sNonBlocking: %s\n"
1681                 "%sPrivateTmp: %s\n"
1682                 "%sControlGroupModify: %s\n"
1683                 "%sControlGroupPersistent: %s\n"
1684                 "%sPrivateNetwork: %s\n",
1685                 prefix, c->umask,
1686                 prefix, c->working_directory ? c->working_directory : "/",
1687                 prefix, c->root_directory ? c->root_directory : "/",
1688                 prefix, yes_no(c->non_blocking),
1689                 prefix, yes_no(c->private_tmp),
1690                 prefix, yes_no(c->control_group_modify),
1691                 prefix, yes_no(c->control_group_persistent),
1692                 prefix, yes_no(c->private_network));
1693
1694         STRV_FOREACH(e, c->environment)
1695                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1696
1697         STRV_FOREACH(e, c->environment_files)
1698                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1699
1700         if (c->tcpwrap_name)
1701                 fprintf(f,
1702                         "%sTCPWrapName: %s\n",
1703                         prefix, c->tcpwrap_name);
1704
1705         if (c->nice_set)
1706                 fprintf(f,
1707                         "%sNice: %i\n",
1708                         prefix, c->nice);
1709
1710         if (c->oom_score_adjust_set)
1711                 fprintf(f,
1712                         "%sOOMScoreAdjust: %i\n",
1713                         prefix, c->oom_score_adjust);
1714
1715         for (i = 0; i < RLIM_NLIMITS; i++)
1716                 if (c->rlimit[i])
1717                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1718
1719         if (c->ioprio_set)
1720                 fprintf(f,
1721                         "%sIOSchedulingClass: %s\n"
1722                         "%sIOPriority: %i\n",
1723                         prefix, ioprio_class_to_string(IOPRIO_PRIO_CLASS(c->ioprio)),
1724                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1725
1726         if (c->cpu_sched_set)
1727                 fprintf(f,
1728                         "%sCPUSchedulingPolicy: %s\n"
1729                         "%sCPUSchedulingPriority: %i\n"
1730                         "%sCPUSchedulingResetOnFork: %s\n",
1731                         prefix, sched_policy_to_string(c->cpu_sched_policy),
1732                         prefix, c->cpu_sched_priority,
1733                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1734
1735         if (c->cpuset) {
1736                 fprintf(f, "%sCPUAffinity:", prefix);
1737                 for (i = 0; i < c->cpuset_ncpus; i++)
1738                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1739                                 fprintf(f, " %i", i);
1740                 fputs("\n", f);
1741         }
1742
1743         if (c->timer_slack_nsec != (nsec_t) -1)
1744                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, c->timer_slack_nsec);
1745
1746         fprintf(f,
1747                 "%sStandardInput: %s\n"
1748                 "%sStandardOutput: %s\n"
1749                 "%sStandardError: %s\n",
1750                 prefix, exec_input_to_string(c->std_input),
1751                 prefix, exec_output_to_string(c->std_output),
1752                 prefix, exec_output_to_string(c->std_error));
1753
1754         if (c->tty_path)
1755                 fprintf(f,
1756                         "%sTTYPath: %s\n"
1757                         "%sTTYReset: %s\n"
1758                         "%sTTYVHangup: %s\n"
1759                         "%sTTYVTDisallocate: %s\n",
1760                         prefix, c->tty_path,
1761                         prefix, yes_no(c->tty_reset),
1762                         prefix, yes_no(c->tty_vhangup),
1763                         prefix, yes_no(c->tty_vt_disallocate));
1764
1765         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1766             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1767             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1768             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE)
1769                 fprintf(f,
1770                         "%sSyslogFacility: %s\n"
1771                         "%sSyslogLevel: %s\n",
1772                         prefix, log_facility_unshifted_to_string(c->syslog_priority >> 3),
1773                         prefix, log_level_to_string(LOG_PRI(c->syslog_priority)));
1774
1775         if (c->capabilities) {
1776                 char *t;
1777                 if ((t = cap_to_text(c->capabilities, NULL))) {
1778                         fprintf(f, "%sCapabilities: %s\n",
1779                                 prefix, t);
1780                         cap_free(t);
1781                 }
1782         }
1783
1784         if (c->secure_bits)
1785                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1786                         prefix,
1787                         (c->secure_bits & SECURE_KEEP_CAPS) ? " keep-caps" : "",
1788                         (c->secure_bits & SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1789                         (c->secure_bits & SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1790                         (c->secure_bits & SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1791                         (c->secure_bits & SECURE_NOROOT) ? " noroot" : "",
1792                         (c->secure_bits & SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1793
1794         if (c->capability_bounding_set_drop) {
1795                 unsigned long l;
1796                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1797
1798                 for (l = 0; l <= cap_last_cap(); l++)
1799                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1800                                 char *t;
1801
1802                                 if ((t = cap_to_name(l))) {
1803                                         fprintf(f, " %s", t);
1804                                         cap_free(t);
1805                                 }
1806                         }
1807
1808                 fputs("\n", f);
1809         }
1810
1811         if (c->user)
1812                 fprintf(f, "%sUser: %s\n", prefix, c->user);
1813         if (c->group)
1814                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
1815
1816         if (strv_length(c->supplementary_groups) > 0) {
1817                 fprintf(f, "%sSupplementaryGroups:", prefix);
1818                 strv_fprintf(f, c->supplementary_groups);
1819                 fputs("\n", f);
1820         }
1821
1822         if (c->pam_name)
1823                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
1824
1825         if (strv_length(c->read_write_dirs) > 0) {
1826                 fprintf(f, "%sReadWriteDirs:", prefix);
1827                 strv_fprintf(f, c->read_write_dirs);
1828                 fputs("\n", f);
1829         }
1830
1831         if (strv_length(c->read_only_dirs) > 0) {
1832                 fprintf(f, "%sReadOnlyDirs:", prefix);
1833                 strv_fprintf(f, c->read_only_dirs);
1834                 fputs("\n", f);
1835         }
1836
1837         if (strv_length(c->inaccessible_dirs) > 0) {
1838                 fprintf(f, "%sInaccessibleDirs:", prefix);
1839                 strv_fprintf(f, c->inaccessible_dirs);
1840                 fputs("\n", f);
1841         }
1842
1843         fprintf(f,
1844                 "%sKillMode: %s\n"
1845                 "%sKillSignal: SIG%s\n"
1846                 "%sSendSIGKILL: %s\n"
1847                 "%sIgnoreSIGPIPE: %s\n",
1848                 prefix, kill_mode_to_string(c->kill_mode),
1849                 prefix, signal_to_string(c->kill_signal),
1850                 prefix, yes_no(c->send_sigkill),
1851                 prefix, yes_no(c->ignore_sigpipe));
1852
1853         if (c->utmp_id)
1854                 fprintf(f,
1855                         "%sUtmpIdentifier: %s\n",
1856                         prefix, c->utmp_id);
1857 }
1858
1859 void exec_status_start(ExecStatus *s, pid_t pid) {
1860         assert(s);
1861
1862         zero(*s);
1863         s->pid = pid;
1864         dual_timestamp_get(&s->start_timestamp);
1865 }
1866
1867 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
1868         assert(s);
1869
1870         if (s->pid && s->pid != pid)
1871                 zero(*s);
1872
1873         s->pid = pid;
1874         dual_timestamp_get(&s->exit_timestamp);
1875
1876         s->code = code;
1877         s->status = status;
1878
1879         if (context) {
1880                 if (context->utmp_id)
1881                         utmp_put_dead_process(context->utmp_id, pid, code, status);
1882
1883                 exec_context_tty_reset(context);
1884         }
1885 }
1886
1887 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
1888         char buf[FORMAT_TIMESTAMP_MAX];
1889
1890         assert(s);
1891         assert(f);
1892
1893         if (!prefix)
1894                 prefix = "";
1895
1896         if (s->pid <= 0)
1897                 return;
1898
1899         fprintf(f,
1900                 "%sPID: %lu\n",
1901                 prefix, (unsigned long) s->pid);
1902
1903         if (s->start_timestamp.realtime > 0)
1904                 fprintf(f,
1905                         "%sStart Timestamp: %s\n",
1906                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
1907
1908         if (s->exit_timestamp.realtime > 0)
1909                 fprintf(f,
1910                         "%sExit Timestamp: %s\n"
1911                         "%sExit Code: %s\n"
1912                         "%sExit Status: %i\n",
1913                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
1914                         prefix, sigchld_code_to_string(s->code),
1915                         prefix, s->status);
1916 }
1917
1918 char *exec_command_line(char **argv) {
1919         size_t k;
1920         char *n, *p, **a;
1921         bool first = true;
1922
1923         assert(argv);
1924
1925         k = 1;
1926         STRV_FOREACH(a, argv)
1927                 k += strlen(*a)+3;
1928
1929         if (!(n = new(char, k)))
1930                 return NULL;
1931
1932         p = n;
1933         STRV_FOREACH(a, argv) {
1934
1935                 if (!first)
1936                         *(p++) = ' ';
1937                 else
1938                         first = false;
1939
1940                 if (strpbrk(*a, WHITESPACE)) {
1941                         *(p++) = '\'';
1942                         p = stpcpy(p, *a);
1943                         *(p++) = '\'';
1944                 } else
1945                         p = stpcpy(p, *a);
1946
1947         }
1948
1949         *p = 0;
1950
1951         /* FIXME: this doesn't really handle arguments that have
1952          * spaces and ticks in them */
1953
1954         return n;
1955 }
1956
1957 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
1958         char *p2;
1959         const char *prefix2;
1960
1961         char *cmd;
1962
1963         assert(c);
1964         assert(f);
1965
1966         if (!prefix)
1967                 prefix = "";
1968         p2 = strappend(prefix, "\t");
1969         prefix2 = p2 ? p2 : prefix;
1970
1971         cmd = exec_command_line(c->argv);
1972
1973         fprintf(f,
1974                 "%sCommand Line: %s\n",
1975                 prefix, cmd ? cmd : strerror(ENOMEM));
1976
1977         free(cmd);
1978
1979         exec_status_dump(&c->exec_status, f, prefix2);
1980
1981         free(p2);
1982 }
1983
1984 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
1985         assert(f);
1986
1987         if (!prefix)
1988                 prefix = "";
1989
1990         LIST_FOREACH(command, c, c)
1991                 exec_command_dump(c, f, prefix);
1992 }
1993
1994 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
1995         ExecCommand *end;
1996
1997         assert(l);
1998         assert(e);
1999
2000         if (*l) {
2001                 /* It's kind of important, that we keep the order here */
2002                 LIST_FIND_TAIL(ExecCommand, command, *l, end);
2003                 LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
2004         } else
2005               *l = e;
2006 }
2007
2008 int exec_command_set(ExecCommand *c, const char *path, ...) {
2009         va_list ap;
2010         char **l, *p;
2011
2012         assert(c);
2013         assert(path);
2014
2015         va_start(ap, path);
2016         l = strv_new_ap(path, ap);
2017         va_end(ap);
2018
2019         if (!l)
2020                 return -ENOMEM;
2021
2022         if (!(p = strdup(path))) {
2023                 strv_free(l);
2024                 return -ENOMEM;
2025         }
2026
2027         free(c->path);
2028         c->path = p;
2029
2030         strv_free(c->argv);
2031         c->argv = l;
2032
2033         return 0;
2034 }
2035
2036 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2037         [EXEC_INPUT_NULL] = "null",
2038         [EXEC_INPUT_TTY] = "tty",
2039         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2040         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2041         [EXEC_INPUT_SOCKET] = "socket"
2042 };
2043
2044 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2045
2046 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2047         [EXEC_OUTPUT_INHERIT] = "inherit",
2048         [EXEC_OUTPUT_NULL] = "null",
2049         [EXEC_OUTPUT_TTY] = "tty",
2050         [EXEC_OUTPUT_SYSLOG] = "syslog",
2051         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2052         [EXEC_OUTPUT_KMSG] = "kmsg",
2053         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2054         [EXEC_OUTPUT_JOURNAL] = "journal",
2055         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2056         [EXEC_OUTPUT_SOCKET] = "socket"
2057 };
2058
2059 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
2060
2061 static const char* const kill_mode_table[_KILL_MODE_MAX] = {
2062         [KILL_CONTROL_GROUP] = "control-group",
2063         [KILL_PROCESS] = "process",
2064         [KILL_NONE] = "none"
2065 };
2066
2067 DEFINE_STRING_TABLE_LOOKUP(kill_mode, KillMode);
2068
2069 static const char* const kill_who_table[_KILL_WHO_MAX] = {
2070         [KILL_MAIN] = "main",
2071         [KILL_CONTROL] = "control",
2072         [KILL_ALL] = "all"
2073 };
2074
2075 DEFINE_STRING_TABLE_LOOKUP(kill_who, KillWho);