src/execute.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU General Public License as published by
  10   the Free Software Foundation; either version 2 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   General Public License for more details.
  17
  18   You should have received a copy of the GNU General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <assert.h>
  23 #include <dirent.h>
  24 #include <errno.h>
  25 #include <fcntl.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <signal.h>
  29 #include <sys/socket.h>
  30 #include <sys/un.h>
  31 #include <sys/prctl.h>
  32 #include <linux/sched.h>
  33 #include <sys/types.h>
  34 #include <sys/stat.h>
  35 #include <grp.h>
  36 #include <pwd.h>
  37 #include <sys/mount.h>
  38 #include <linux/fs.h>
  39 #include <linux/oom.h>
  40
  41 #ifdef HAVE_PAM
  42 #include <security/pam_appl.h>
  43 #endif
  44
  45 #include "execute.h"
  46 #include "strv.h"
  47 #include "macro.h"
  48 #include "capability.h"
  49 #include "util.h"
  50 #include "log.h"
  51 #include "ioprio.h"
  52 #include "securebits.h"
  53 #include "cgroup.h"
  54 #include "namespace.h"
  55 #include "tcpwrap.h"
  56 #include "exit-status.h"
  57 #include "missing.h"
  58 #include "utmp-wtmp.h"
  59 #include "def.h"
  60 #include "loopback-setup.h"
  61
  62 /* This assumes there is a 'tty' group */
  63 #define TTY_MODE 0620
  64
  65 static int shift_fds(int fds[], unsigned n_fds) {
  66         int start, restart_from;
  67
  68         if (n_fds <= 0)
  69                 return 0;
  70
  71         /* Modifies the fds array! (sorts it) */
  72
  73         assert(fds);
  74
  75         start = 0;
  76         for (;;) {
  77                 int i;
  78
  79                 restart_from = -1;
  80
  81                 for (i = start; i < (int) n_fds; i++) {
  82                         int nfd;
  83
  84                         /* Already at right index? */
  85                         if (fds[i] == i+3)
  86                                 continue;
  87
  88                         if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
  89                                 return -errno;
  90
  91                         close_nointr_nofail(fds[i]);
  92                         fds[i] = nfd;
  93
  94                         /* Hmm, the fd we wanted isn't free? Then
  95                          * let's remember that and try again from here*/
  96                         if (nfd != i+3 && restart_from < 0)
  97                                 restart_from = i;
  98                 }
  99
 100                 if (restart_from < 0)
 101                         break;
 102
 103                 start = restart_from;
 104         }
 105
 106         return 0;
 107 }
 108
 109 static int flags_fds(const int fds[], unsigned n_fds, bool nonblock) {
 110         unsigned i;
 111         int r;
 112
 113         if (n_fds <= 0)
 114                 return 0;
 115
 116         assert(fds);
 117
 118         /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags */
 119
 120         for (i = 0; i < n_fds; i++) {
 121
 122                 if ((r = fd_nonblock(fds[i], nonblock)) < 0)
 123                         return r;
 124
 125                 /* We unconditionally drop FD_CLOEXEC from the fds,
 126                  * since after all we want to pass these fds to our
 127                  * children */
 128
 129                 if ((r = fd_cloexec(fds[i], false)) < 0)
 130                         return r;
 131         }
 132
 133         return 0;
 134 }
 135
 136 static const char *tty_path(const ExecContext *context) {
 137         assert(context);
 138
 139         if (context->tty_path)
 140                 return context->tty_path;
 141
 142         return "/dev/console";
 143 }
 144
 145 void exec_context_tty_reset(const ExecContext *context) {
 146         assert(context);
 147
 148         if (context->tty_vhangup)
 149                 terminal_vhangup(tty_path(context));
 150
 151         if (context->tty_reset)
 152                 reset_terminal(tty_path(context));
 153
 154         if (context->tty_vt_disallocate && context->tty_path)
 155                 vt_disallocate(context->tty_path);
 156 }
 157
 158 static int open_null_as(int flags, int nfd) {
 159         int fd, r;
 160
 161         assert(nfd >= 0);
 162
 163         if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
 164                 return -errno;
 165
 166         if (fd != nfd) {
 167                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 168                 close_nointr_nofail(fd);
 169         } else
 170                 r = nfd;
 171
 172         return r;
 173 }
 174
 175 static int connect_logger_as(const ExecContext *context, ExecOutput output, const char *ident, int nfd) {
 176         int fd, r;
 177         union sockaddr_union sa;
 178
 179         assert(context);
 180         assert(output < _EXEC_OUTPUT_MAX);
 181         assert(ident);
 182         assert(nfd >= 0);
 183
 184         fd = socket(AF_UNIX, SOCK_STREAM, 0);
 185         if (fd < 0)
 186                 return -errno;
 187
 188         zero(sa);
 189         sa.un.sun_family = AF_UNIX;
 190         strncpy(sa.un.sun_path, "/run/systemd/journal/stdout", sizeof(sa.un.sun_path));
 191
 192         r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
 193         if (r < 0) {
 194                 close_nointr_nofail(fd);
 195                 return -errno;
 196         }
 197
 198         if (shutdown(fd, SHUT_RD) < 0) {
 199                 close_nointr_nofail(fd);
 200                 return -errno;
 201         }
 202
 203         dprintf(fd,
 204                 "%s\n"
 205                 "%i\n"
 206                 "%i\n"
 207                 "%i\n"
 208                 "%i\n"
 209                 "%i\n",
 210                 context->syslog_identifier ? context->syslog_identifier : ident,
 211                 context->syslog_priority,
 212                 !!context->syslog_level_prefix,
 213                 output == EXEC_OUTPUT_SYSLOG || output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE,
 214                 output == EXEC_OUTPUT_KMSG || output == EXEC_OUTPUT_KMSG_AND_CONSOLE,
 215                 output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || output == EXEC_OUTPUT_KMSG_AND_CONSOLE || output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE);
 216
 217         if (fd != nfd) {
 218                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 219                 close_nointr_nofail(fd);
 220         } else
 221                 r = nfd;
 222
 223         return r;
 224 }
 225 static int open_terminal_as(const char *path, mode_t mode, int nfd) {
 226         int fd, r;
 227
 228         assert(path);
 229         assert(nfd >= 0);
 230
 231         if ((fd = open_terminal(path, mode | O_NOCTTY)) < 0)
 232                 return fd;
 233
 234         if (fd != nfd) {
 235                 r = dup2(fd, nfd) < 0 ? -errno : nfd;
 236                 close_nointr_nofail(fd);
 237         } else
 238                 r = nfd;
 239
 240         return r;
 241 }
 242
 243 static bool is_terminal_input(ExecInput i) {
 244         return
 245                 i == EXEC_INPUT_TTY ||
 246                 i == EXEC_INPUT_TTY_FORCE ||
 247                 i == EXEC_INPUT_TTY_FAIL;
 248 }
 249
 250 static int fixup_input(ExecInput std_input, int socket_fd, bool apply_tty_stdin) {
 251
 252         if (is_terminal_input(std_input) && !apply_tty_stdin)
 253                 return EXEC_INPUT_NULL;
 254
 255         if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)
 256                 return EXEC_INPUT_NULL;
 257
 258         return std_input;
 259 }
 260
 261 static int fixup_output(ExecOutput std_output, int socket_fd) {
 262
 263         if (std_output == EXEC_OUTPUT_SOCKET && socket_fd < 0)
 264                 return EXEC_OUTPUT_INHERIT;
 265
 266         return std_output;
 267 }
 268
 269 static int setup_input(const ExecContext *context, int socket_fd, bool apply_tty_stdin) {
 270         ExecInput i;
 271
 272         assert(context);
 273
 274         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 275
 276         switch (i) {
 277
 278         case EXEC_INPUT_NULL:
 279                 return open_null_as(O_RDONLY, STDIN_FILENO);
 280
 281         case EXEC_INPUT_TTY:
 282         case EXEC_INPUT_TTY_FORCE:
 283         case EXEC_INPUT_TTY_FAIL: {
 284                 int fd, r;
 285
 286                 if ((fd = acquire_terminal(
 287                                      tty_path(context),
 288                                      i == EXEC_INPUT_TTY_FAIL,
 289                                      i == EXEC_INPUT_TTY_FORCE,
 290                                      false)) < 0)
 291                         return fd;
 292
 293                 if (fd != STDIN_FILENO) {
 294                         r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 295                         close_nointr_nofail(fd);
 296                 } else
 297                         r = STDIN_FILENO;
 298
 299                 return r;
 300         }
 301
 302         case EXEC_INPUT_SOCKET:
 303                 return dup2(socket_fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
 304
 305         default:
 306                 assert_not_reached("Unknown input type");
 307         }
 308 }
 309
 310 static int setup_output(const ExecContext *context, int socket_fd, const char *ident, bool apply_tty_stdin) {
 311         ExecOutput o;
 312         ExecInput i;
 313
 314         assert(context);
 315         assert(ident);
 316
 317         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 318         o = fixup_output(context->std_output, socket_fd);
 319
 320         /* This expects the input is already set up */
 321
 322         switch (o) {
 323
 324         case EXEC_OUTPUT_INHERIT:
 325
 326                 /* If input got downgraded, inherit the original value */
 327                 if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))
 328                         return open_terminal_as(tty_path(context), O_WRONLY, STDOUT_FILENO);
 329
 330                 /* If the input is connected to anything that's not a /dev/null, inherit that... */
 331                 if (i != EXEC_INPUT_NULL)
 332                         return dup2(STDIN_FILENO, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 333
 334                 /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */
 335                 if (getppid() != 1)
 336                         return STDOUT_FILENO;
 337
 338                 /* We need to open /dev/null here anew, to get the
 339                  * right access mode. So we fall through */
 340
 341         case EXEC_OUTPUT_NULL:
 342                 return open_null_as(O_WRONLY, STDOUT_FILENO);
 343
 344         case EXEC_OUTPUT_TTY:
 345                 if (is_terminal_input(i))
 346                         return dup2(STDIN_FILENO, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 347
 348                 /* We don't reset the terminal if this is just about output */
 349                 return open_terminal_as(tty_path(context), O_WRONLY, STDOUT_FILENO);
 350
 351         case EXEC_OUTPUT_SYSLOG:
 352         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 353         case EXEC_OUTPUT_KMSG:
 354         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 355         case EXEC_OUTPUT_JOURNAL:
 356         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 357                 return connect_logger_as(context, o, ident, STDOUT_FILENO);
 358
 359         case EXEC_OUTPUT_SOCKET:
 360                 assert(socket_fd >= 0);
 361                 return dup2(socket_fd, STDOUT_FILENO) < 0 ? -errno : STDOUT_FILENO;
 362
 363         default:
 364                 assert_not_reached("Unknown output type");
 365         }
 366 }
 367
 368 static int setup_error(const ExecContext *context, int socket_fd, const char *ident, bool apply_tty_stdin) {
 369         ExecOutput o, e;
 370         ExecInput i;
 371
 372         assert(context);
 373         assert(ident);
 374
 375         i = fixup_input(context->std_input, socket_fd, apply_tty_stdin);
 376         o = fixup_output(context->std_output, socket_fd);
 377         e = fixup_output(context->std_error, socket_fd);
 378
 379         /* This expects the input and output are already set up */
 380
 381         /* Don't change the stderr file descriptor if we inherit all
 382          * the way and are not on a tty */
 383         if (e == EXEC_OUTPUT_INHERIT &&
 384             o == EXEC_OUTPUT_INHERIT &&
 385             i == EXEC_INPUT_NULL &&
 386             !is_terminal_input(context->std_input) &&
 387             getppid () != 1)
 388                 return STDERR_FILENO;
 389
 390         /* Duplicate from stdout if possible */
 391         if (e == o || e == EXEC_OUTPUT_INHERIT)
 392                 return dup2(STDOUT_FILENO, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 393
 394         switch (e) {
 395
 396         case EXEC_OUTPUT_NULL:
 397                 return open_null_as(O_WRONLY, STDERR_FILENO);
 398
 399         case EXEC_OUTPUT_TTY:
 400                 if (is_terminal_input(i))
 401                         return dup2(STDIN_FILENO, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 402
 403                 /* We don't reset the terminal if this is just about output */
 404                 return open_terminal_as(tty_path(context), O_WRONLY, STDERR_FILENO);
 405
 406         case EXEC_OUTPUT_SYSLOG:
 407         case EXEC_OUTPUT_SYSLOG_AND_CONSOLE:
 408         case EXEC_OUTPUT_KMSG:
 409         case EXEC_OUTPUT_KMSG_AND_CONSOLE:
 410         case EXEC_OUTPUT_JOURNAL:
 411         case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
 412                 return connect_logger_as(context, e, ident, STDERR_FILENO);
 413
 414         case EXEC_OUTPUT_SOCKET:
 415                 assert(socket_fd >= 0);
 416                 return dup2(socket_fd, STDERR_FILENO) < 0 ? -errno : STDERR_FILENO;
 417
 418         default:
 419                 assert_not_reached("Unknown error type");
 420         }
 421 }
 422
 423 static int chown_terminal(int fd, uid_t uid) {
 424         struct stat st;
 425
 426         assert(fd >= 0);
 427
 428         /* This might fail. What matters are the results. */
 429         (void) fchown(fd, uid, -1);
 430         (void) fchmod(fd, TTY_MODE);
 431
 432         if (fstat(fd, &st) < 0)
 433                 return -errno;
 434
 435         if (st.st_uid != uid || (st.st_mode & 0777) != TTY_MODE)
 436                 return -EPERM;
 437
 438         return 0;
 439 }
 440
 441 static int setup_confirm_stdio(const ExecContext *context,
 442                                int *_saved_stdin,
 443                                int *_saved_stdout) {
 444         int fd = -1, saved_stdin, saved_stdout = -1, r;
 445
 446         assert(context);
 447         assert(_saved_stdin);
 448         assert(_saved_stdout);
 449
 450         /* This returns positive EXIT_xxx return values instead of
 451          * negative errno style values! */
 452
 453         if ((saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3)) < 0)
 454                 return EXIT_STDIN;
 455
 456         if ((saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3)) < 0) {
 457                 r = EXIT_STDOUT;
 458                 goto fail;
 459         }
 460
 461         if ((fd = acquire_terminal(
 462                              tty_path(context),
 463                              context->std_input == EXEC_INPUT_TTY_FAIL,
 464                              context->std_input == EXEC_INPUT_TTY_FORCE,
 465                              false)) < 0) {
 466                 r = EXIT_STDIN;
 467                 goto fail;
 468         }
 469
 470         if (chown_terminal(fd, getuid()) < 0) {
 471                 r = EXIT_STDIN;
 472                 goto fail;
 473         }
 474
 475         if (dup2(fd, STDIN_FILENO) < 0) {
 476                 r = EXIT_STDIN;
 477                 goto fail;
 478         }
 479
 480         if (dup2(fd, STDOUT_FILENO) < 0) {
 481                 r = EXIT_STDOUT;
 482                 goto fail;
 483         }
 484
 485         if (fd >= 2)
 486                 close_nointr_nofail(fd);
 487
 488         *_saved_stdin = saved_stdin;
 489         *_saved_stdout = saved_stdout;
 490
 491         return 0;
 492
 493 fail:
 494         if (saved_stdout >= 0)
 495                 close_nointr_nofail(saved_stdout);
 496
 497         if (saved_stdin >= 0)
 498                 close_nointr_nofail(saved_stdin);
 499
 500         if (fd >= 0)
 501                 close_nointr_nofail(fd);
 502
 503         return r;
 504 }
 505
 506 static int restore_confirm_stdio(const ExecContext *context,
 507                                  int *saved_stdin,
 508                                  int *saved_stdout,
 509                                  bool *keep_stdin,
 510                                  bool *keep_stdout) {
 511
 512         assert(context);
 513         assert(saved_stdin);
 514         assert(*saved_stdin >= 0);
 515         assert(saved_stdout);
 516         assert(*saved_stdout >= 0);
 517
 518         /* This returns positive EXIT_xxx return values instead of
 519          * negative errno style values! */
 520
 521         if (is_terminal_input(context->std_input)) {
 522
 523                 /* The service wants terminal input. */
 524
 525                 *keep_stdin = true;
 526                 *keep_stdout =
 527                         context->std_output == EXEC_OUTPUT_INHERIT ||
 528                         context->std_output == EXEC_OUTPUT_TTY;
 529
 530         } else {
 531                 /* If the service doesn't want a controlling terminal,
 532                  * then we need to get rid entirely of what we have
 533                  * already. */
 534
 535                 if (release_terminal() < 0)
 536                         return EXIT_STDIN;
 537
 538                 if (dup2(*saved_stdin, STDIN_FILENO) < 0)
 539                         return EXIT_STDIN;
 540
 541                 if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
 542                         return EXIT_STDOUT;
 543
 544                 *keep_stdout = *keep_stdin = false;
 545         }
 546
 547         return 0;
 548 }
 549
 550 static int enforce_groups(const ExecContext *context, const char *username, gid_t gid) {
 551         bool keep_groups = false;
 552         int r;
 553
 554         assert(context);
 555
 556         /* Lookup and set GID and supplementary group list. Here too
 557          * we avoid NSS lookups for gid=0. */
 558
 559         if (context->group || username) {
 560
 561                 if (context->group) {
 562                         const char *g = context->group;
 563
 564                         if ((r = get_group_creds(&g, &gid)) < 0)
 565                                 return r;
 566                 }
 567
 568                 /* First step, initialize groups from /etc/groups */
 569                 if (username && gid != 0) {
 570                         if (initgroups(username, gid) < 0)
 571                                 return -errno;
 572
 573                         keep_groups = true;
 574                 }
 575
 576                 /* Second step, set our gids */
 577                 if (setresgid(gid, gid, gid) < 0)
 578                         return -errno;
 579         }
 580
 581         if (context->supplementary_groups) {
 582                 int ngroups_max, k;
 583                 gid_t *gids;
 584                 char **i;
 585
 586                 /* Final step, initialize any manually set supplementary groups */
 587                 assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 588
 589                 if (!(gids = new(gid_t, ngroups_max)))
 590                         return -ENOMEM;
 591
 592                 if (keep_groups) {
 593                         if ((k = getgroups(ngroups_max, gids)) < 0) {
 594                                 free(gids);
 595                                 return -errno;
 596                         }
 597                 } else
 598                         k = 0;
 599
 600                 STRV_FOREACH(i, context->supplementary_groups) {
 601                         const char *g;
 602
 603                         if (k >= ngroups_max) {
 604                                 free(gids);
 605                                 return -E2BIG;
 606                         }
 607
 608                         g = *i;
 609                         r = get_group_creds(&g, gids+k);
 610                         if (r < 0) {
 611                                 free(gids);
 612                                 return r;
 613                         }
 614
 615                         k++;
 616                 }
 617
 618                 if (setgroups(k, gids) < 0) {
 619                         free(gids);
 620                         return -errno;
 621                 }
 622
 623                 free(gids);
 624         }
 625
 626         return 0;
 627 }
 628
 629 static int enforce_user(const ExecContext *context, uid_t uid) {
 630         int r;
 631         assert(context);
 632
 633         /* Sets (but doesn't lookup) the uid and make sure we keep the
 634          * capabilities while doing so. */
 635
 636         if (context->capabilities) {
 637                 cap_t d;
 638                 static const cap_value_t bits[] = {
 639                         CAP_SETUID,   /* Necessary so that we can run setresuid() below */
 640                         CAP_SETPCAP   /* Necessary so that we can set PR_SET_SECUREBITS later on */
 641                 };
 642
 643                 /* First step: If we need to keep capabilities but
 644                  * drop privileges we need to make sure we keep our
 645                  * caps, whiel we drop privileges. */
 646                 if (uid != 0) {
 647                         int sb = context->secure_bits|SECURE_KEEP_CAPS;
 648
 649                         if (prctl(PR_GET_SECUREBITS) != sb)
 650                                 if (prctl(PR_SET_SECUREBITS, sb) < 0)
 651                                         return -errno;
 652                 }
 653
 654                 /* Second step: set the capabilities. This will reduce
 655                  * the capabilities to the minimum we need. */
 656
 657                 if (!(d = cap_dup(context->capabilities)))
 658                         return -errno;
 659
 660                 if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
 661                     cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
 662                         r = -errno;
 663                         cap_free(d);
 664                         return r;
 665                 }
 666
 667                 if (cap_set_proc(d) < 0) {
 668                         r = -errno;
 669                         cap_free(d);
 670                         return r;
 671                 }
 672
 673                 cap_free(d);
 674         }
 675
 676         /* Third step: actually set the uids */
 677         if (setresuid(uid, uid, uid) < 0)
 678                 return -errno;
 679
 680         /* At this point we should have all necessary capabilities but
 681            are otherwise a normal user. However, the caps might got
 682            corrupted due to the setresuid() so we need clean them up
 683            later. This is done outside of this call. */
 684
 685         return 0;
 686 }
 687
 688 #ifdef HAVE_PAM
 689
 690 static int null_conv(
 691                 int num_msg,
 692                 const struct pam_message **msg,
 693                 struct pam_response **resp,
 694                 void *appdata_ptr) {
 695
 696         /* We don't support conversations */
 697
 698         return PAM_CONV_ERR;
 699 }
 700
 701 static int setup_pam(
 702                 const char *name,
 703                 const char *user,
 704                 const char *tty,
 705                 char ***pam_env,
 706                 int fds[], unsigned n_fds) {
 707
 708         static const struct pam_conv conv = {
 709                 .conv = null_conv,
 710                 .appdata_ptr = NULL
 711         };
 712
 713         pam_handle_t *handle = NULL;
 714         sigset_t ss, old_ss;
 715         int pam_code = PAM_SUCCESS;
 716         int err;
 717         char **e = NULL;
 718         bool close_session = false;
 719         pid_t pam_pid = 0, parent_pid;
 720
 721         assert(name);
 722         assert(user);
 723         assert(pam_env);
 724
 725         /* We set up PAM in the parent process, then fork. The child
 726          * will then stay around until killed via PR_GET_PDEATHSIG or
 727          * systemd via the cgroup logic. It will then remove the PAM
 728          * session again. The parent process will exec() the actual
 729          * daemon. We do things this way to ensure that the main PID
 730          * of the daemon is the one we initially fork()ed. */
 731
 732         if ((pam_code = pam_start(name, user, &conv, &handle)) != PAM_SUCCESS) {
 733                 handle = NULL;
 734                 goto fail;
 735         }
 736
 737         if (tty)
 738                 if ((pam_code = pam_set_item(handle, PAM_TTY, tty)) != PAM_SUCCESS)
 739                         goto fail;
 740
 741         if ((pam_code = pam_acct_mgmt(handle, PAM_SILENT)) != PAM_SUCCESS)
 742                 goto fail;
 743
 744         if ((pam_code = pam_open_session(handle, PAM_SILENT)) != PAM_SUCCESS)
 745                 goto fail;
 746
 747         close_session = true;
 748
 749         if ((!(e = pam_getenvlist(handle)))) {
 750                 pam_code = PAM_BUF_ERR;
 751                 goto fail;
 752         }
 753
 754         /* Block SIGTERM, so that we know that it won't get lost in
 755          * the child */
 756         if (sigemptyset(&ss) < 0 ||
 757             sigaddset(&ss, SIGTERM) < 0 ||
 758             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
 759                 goto fail;
 760
 761         parent_pid = getpid();
 762
 763         if ((pam_pid = fork()) < 0)
 764                 goto fail;
 765
 766         if (pam_pid == 0) {
 767                 int sig;
 768                 int r = EXIT_PAM;
 769
 770                 /* The child's job is to reset the PAM session on
 771                  * termination */
 772
 773                 /* This string must fit in 10 chars (i.e. the length
 774                  * of "/sbin/init"), to look pretty in /bin/ps */
 775                 rename_process("(sd-pam)");
 776
 777                 /* Make sure we don't keep open the passed fds in this
 778                 child. We assume that otherwise only those fds are
 779                 open here that have been opened by PAM. */
 780                 close_many(fds, n_fds);
 781
 782                 /* Wait until our parent died. This will most likely
 783                  * not work since the kernel does not allow
 784                  * unprivileged parents kill their privileged children
 785                  * this way. We rely on the control groups kill logic
 786                  * to do the rest for us. */
 787                 if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0)
 788                         goto child_finish;
 789
 790                 /* Check if our parent process might already have
 791                  * died? */
 792                 if (getppid() == parent_pid) {
 793                         for (;;) {
 794                                 if (sigwait(&ss, &sig) < 0) {
 795                                         if (errno == EINTR)
 796                                                 continue;
 797
 798                                         goto child_finish;
 799                                 }
 800
 801                                 assert(sig == SIGTERM);
 802                                 break;
 803                         }
 804                 }
 805
 806                 /* If our parent died we'll end the session */
 807                 if (getppid() != parent_pid)
 808                         if ((pam_code = pam_close_session(handle, PAM_DATA_SILENT)) != PAM_SUCCESS)
 809                                 goto child_finish;
 810
 811                 r = 0;
 812
 813         child_finish:
 814                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 815                 _exit(r);
 816         }
 817
 818         /* If the child was forked off successfully it will do all the
 819          * cleanups, so forget about the handle here. */
 820         handle = NULL;
 821
 822         /* Unblock SIGTERM again in the parent */
 823         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
 824                 goto fail;
 825
 826         /* We close the log explicitly here, since the PAM modules
 827          * might have opened it, but we don't want this fd around. */
 828         closelog();
 829
 830         *pam_env = e;
 831         e = NULL;
 832
 833         return 0;
 834
 835 fail:
 836         if (pam_code != PAM_SUCCESS)
 837                 err = -EPERM;  /* PAM errors do not map to errno */
 838         else
 839                 err = -errno;
 840
 841         if (handle) {
 842                 if (close_session)
 843                         pam_code = pam_close_session(handle, PAM_DATA_SILENT);
 844
 845                 pam_end(handle, pam_code | PAM_DATA_SILENT);
 846         }
 847
 848         strv_free(e);
 849
 850         closelog();
 851
 852         if (pam_pid > 1) {
 853                 kill(pam_pid, SIGTERM);
 854                 kill(pam_pid, SIGCONT);
 855         }
 856
 857         return err;
 858 }
 859 #endif
 860
 861 static int do_capability_bounding_set_drop(uint64_t drop) {
 862         unsigned long i;
 863         cap_t old_cap = NULL, new_cap = NULL;
 864         cap_flag_value_t fv;
 865         int r;
 866
 867         /* If we are run as PID 1 we will lack CAP_SETPCAP by default
 868          * in the effective set (yes, the kernel drops that when
 869          * executing init!), so get it back temporarily so that we can
 870          * call PR_CAPBSET_DROP. */
 871
 872         old_cap = cap_get_proc();
 873         if (!old_cap)
 874                 return -errno;
 875
 876         if (cap_get_flag(old_cap, CAP_SETPCAP, CAP_EFFECTIVE, &fv) < 0) {
 877                 r = -errno;
 878                 goto finish;
 879         }
 880
 881         if (fv != CAP_SET) {
 882                 static const cap_value_t v = CAP_SETPCAP;
 883
 884                 new_cap = cap_dup(old_cap);
 885                 if (!new_cap) {
 886                         r = -errno;
 887                         goto finish;
 888                 }
 889
 890                 if (cap_set_flag(new_cap, CAP_EFFECTIVE, 1, &v, CAP_SET) < 0) {
 891                         r = -errno;
 892                         goto finish;
 893                 }
 894
 895                 if (cap_set_proc(new_cap) < 0) {
 896                         r = -errno;
 897                         goto finish;
 898                 }
 899         }
 900
 901         for (i = 0; i <= cap_last_cap(); i++)
 902                 if (drop & ((uint64_t) 1ULL << (uint64_t) i)) {
 903                         if (prctl(PR_CAPBSET_DROP, i) < 0) {
 904                                 r = -errno;
 905                                 goto finish;
 906                         }
 907                 }
 908
 909         r = 0;
 910
 911 finish:
 912         if (new_cap)
 913                 cap_free(new_cap);
 914
 915         if (old_cap) {
 916                 cap_set_proc(old_cap);
 917                 cap_free(old_cap);
 918         }
 919
 920         return r;
 921 }
 922
 923 static void rename_process_from_path(const char *path) {
 924         char process_name[11];
 925         const char *p;
 926         size_t l;
 927
 928         /* This resulting string must fit in 10 chars (i.e. the length
 929          * of "/sbin/init") to look pretty in /bin/ps */
 930
 931         p = file_name_from_path(path);
 932         if (isempty(p)) {
 933                 rename_process("(...)");
 934                 return;
 935         }
 936
 937         l = strlen(p);
 938         if (l > 8) {
 939                 /* The end of the process name is usually more
 940                  * interesting, since the first bit might just be
 941                  * "systemd-" */
 942                 p = p + l - 8;
 943                 l = 8;
 944         }
 945
 946         process_name[0] = '(';
 947         memcpy(process_name+1, p, l);
 948         process_name[1+l] = ')';
 949         process_name[1+l+1] = 0;
 950
 951         rename_process(process_name);
 952 }
 953
 954 int exec_spawn(ExecCommand *command,
 955                char **argv,
 956                const ExecContext *context,
 957                int fds[], unsigned n_fds,
 958                char **environment,
 959                bool apply_permissions,
 960                bool apply_chroot,
 961                bool apply_tty_stdin,
 962                bool confirm_spawn,
 963                CGroupBonding *cgroup_bondings,
 964                CGroupAttribute *cgroup_attributes,
 965                pid_t *ret) {
 966
 967         pid_t pid;
 968         int r;
 969         char *line;
 970         int socket_fd;
 971         char **files_env = NULL;
 972
 973         assert(command);
 974         assert(context);
 975         assert(ret);
 976         assert(fds || n_fds <= 0);
 977
 978         if (context->std_input == EXEC_INPUT_SOCKET ||
 979             context->std_output == EXEC_OUTPUT_SOCKET ||
 980             context->std_error == EXEC_OUTPUT_SOCKET) {
 981
 982                 if (n_fds != 1)
 983                         return -EINVAL;
 984
 985                 socket_fd = fds[0];
 986
 987                 fds = NULL;
 988                 n_fds = 0;
 989         } else
 990                 socket_fd = -1;
 991
 992         if ((r = exec_context_load_environment(context, &files_env)) < 0) {
 993                 log_error("Failed to load environment files: %s", strerror(-r));
 994                 return r;
 995         }
 996
 997         if (!argv)
 998                 argv = command->argv;
 999
1000         if (!(line = exec_command_line(argv))) {
1001                 r = -ENOMEM;
1002                 goto fail_parent;
1003         }
1004
1005         log_debug("About to execute: %s", line);
1006         free(line);
1007
1008         r = cgroup_bonding_realize_list(cgroup_bondings);
1009         if (r < 0)
1010                 goto fail_parent;
1011
1012         cgroup_attribute_apply_list(cgroup_attributes, cgroup_bondings);
1013
1014         if ((pid = fork()) < 0) {
1015                 r = -errno;
1016                 goto fail_parent;
1017         }
1018
1019         if (pid == 0) {
1020                 int i, err;
1021                 sigset_t ss;
1022                 const char *username = NULL, *home = NULL;
1023                 uid_t uid = (uid_t) -1;
1024                 gid_t gid = (gid_t) -1;
1025                 char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
1026                 unsigned n_env = 0;
1027                 int saved_stdout = -1, saved_stdin = -1;
1028                 bool keep_stdout = false, keep_stdin = false, set_access = false;
1029
1030                 /* child */
1031
1032                 rename_process_from_path(command->path);
1033
1034                 /* We reset exactly these signals, since they are the
1035                  * only ones we set to SIG_IGN in the main daemon. All
1036                  * others we leave untouched because we set them to
1037                  * SIG_DFL or a valid handler initially, both of which
1038                  * will be demoted to SIG_DFL. */
1039                 default_signals(SIGNALS_CRASH_HANDLER,
1040                                 SIGNALS_IGNORE, -1);
1041
1042                 if (context->ignore_sigpipe)
1043                         ignore_signals(SIGPIPE, -1);
1044
1045                 assert_se(sigemptyset(&ss) == 0);
1046                 if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
1047                         err = -errno;
1048                         r = EXIT_SIGNAL_MASK;
1049                         goto fail_child;
1050                 }
1051
1052                 /* Close sockets very early to make sure we don't
1053                  * block init reexecution because it cannot bind its
1054                  * sockets */
1055                 log_forget_fds();
1056                 err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
1057                                            socket_fd >= 0 ? 1 : n_fds);
1058                 if (err < 0) {
1059                         r = EXIT_FDS;
1060                         goto fail_child;
1061                 }
1062
1063                 if (!context->same_pgrp)
1064                         if (setsid() < 0) {
1065                                 err = -errno;
1066                                 r = EXIT_SETSID;
1067                                 goto fail_child;
1068                         }
1069
1070                 if (context->tcpwrap_name) {
1071                         if (socket_fd >= 0)
1072                                 if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
1073                                         err = -EACCES;
1074                                         r = EXIT_TCPWRAP;
1075                                         goto fail_child;
1076                                 }
1077
1078                         for (i = 0; i < (int) n_fds; i++) {
1079                                 if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
1080                                         err = -EACCES;
1081                                         r = EXIT_TCPWRAP;
1082                                         goto fail_child;
1083                                 }
1084                         }
1085                 }
1086
1087                 exec_context_tty_reset(context);
1088
1089                 /* We skip the confirmation step if we shall not apply the TTY */
1090                 if (confirm_spawn &&
1091                     (!is_terminal_input(context->std_input) || apply_tty_stdin)) {
1092                         char response;
1093
1094                         /* Set up terminal for the question */
1095                         if ((r = setup_confirm_stdio(context,
1096                                                      &saved_stdin, &saved_stdout))) {
1097                                 err = -errno;
1098                                 goto fail_child;
1099                         }
1100
1101                         /* Now ask the question. */
1102                         if (!(line = exec_command_line(argv))) {
1103                                 err = -ENOMEM;
1104                                 r = EXIT_MEMORY;
1105                                 goto fail_child;
1106                         }
1107
1108                         r = ask(&response, "yns", "Execute %s? [Yes, No, Skip] ", line);
1109                         free(line);
1110
1111                         if (r < 0 || response == 'n') {
1112                                 err = -ECANCELED;
1113                                 r = EXIT_CONFIRM;
1114                                 goto fail_child;
1115                         } else if (response == 's') {
1116                                 err = r = 0;
1117                                 goto fail_child;
1118                         }
1119
1120                         /* Release terminal for the question */
1121                         if ((r = restore_confirm_stdio(context,
1122                                                        &saved_stdin, &saved_stdout,
1123                                                        &keep_stdin, &keep_stdout))) {
1124                                 err = -errno;
1125                                 goto fail_child;
1126                         }
1127                 }
1128
1129                 /* If a socket is connected to STDIN/STDOUT/STDERR, we
1130                  * must sure to drop O_NONBLOCK */
1131                 if (socket_fd >= 0)
1132                         fd_nonblock(socket_fd, false);
1133
1134                 if (!keep_stdin) {
1135                         err = setup_input(context, socket_fd, apply_tty_stdin);
1136                         if (err < 0) {
1137                                 r = EXIT_STDIN;
1138                                 goto fail_child;
1139                         }
1140                 }
1141
1142                 if (!keep_stdout) {
1143                         err = setup_output(context, socket_fd, file_name_from_path(command->path), apply_tty_stdin);
1144                         if (err < 0) {
1145                                 r = EXIT_STDOUT;
1146                                 goto fail_child;
1147                         }
1148                 }
1149
1150                 err = setup_error(context, socket_fd, file_name_from_path(command->path), apply_tty_stdin);
1151                 if (err < 0) {
1152                         r = EXIT_STDERR;
1153                         goto fail_child;
1154                 }
1155
1156                 if (cgroup_bondings) {
1157                         err = cgroup_bonding_install_list(cgroup_bondings, 0);
1158                         if (err < 0) {
1159                                 r = EXIT_CGROUP;
1160                                 goto fail_child;
1161                         }
1162                 }
1163
1164                 if (context->oom_score_adjust_set) {
1165                         char t[16];
1166
1167                         snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
1168                         char_array_0(t);
1169
1170                         if (write_one_line_file("/proc/self/oom_score_adj", t) < 0) {
1171                                 /* Compatibility with Linux <= 2.6.35 */
1172
1173                                 int adj;
1174
1175                                 adj = (context->oom_score_adjust * -OOM_DISABLE) / OOM_SCORE_ADJ_MAX;
1176                                 adj = CLAMP(adj, OOM_DISABLE, OOM_ADJUST_MAX);
1177
1178                                 snprintf(t, sizeof(t), "%i", adj);
1179                                 char_array_0(t);
1180
1181                                 if (write_one_line_file("/proc/self/oom_adj", t) < 0
1182                                     && errno != EACCES) {
1183                                         err = -errno;
1184                                         r = EXIT_OOM_ADJUST;
1185                                         goto fail_child;
1186                                 }
1187                         }
1188                 }
1189
1190                 if (context->nice_set)
1191                         if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
1192                                 err = -errno;
1193                                 r = EXIT_NICE;
1194                                 goto fail_child;
1195                         }
1196
1197                 if (context->cpu_sched_set) {
1198                         struct sched_param param;
1199
1200                         zero(param);
1201                         param.sched_priority = context->cpu_sched_priority;
1202
1203                         if (sched_setscheduler(0, context->cpu_sched_policy |
1204                                                (context->cpu_sched_reset_on_fork ? SCHED_RESET_ON_FORK : 0), &param) < 0) {
1205                                 err = -errno;
1206                                 r = EXIT_SETSCHEDULER;
1207                                 goto fail_child;
1208                         }
1209                 }
1210
1211                 if (context->cpuset)
1212                         if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
1213                                 err = -errno;
1214                                 r = EXIT_CPUAFFINITY;
1215                                 goto fail_child;
1216                         }
1217
1218                 if (context->ioprio_set)
1219                         if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
1220                                 err = -errno;
1221                                 r = EXIT_IOPRIO;
1222                                 goto fail_child;
1223                         }
1224
1225                 if (context->timer_slack_nsec_set)
1226                         if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
1227                                 err = -errno;
1228                                 r = EXIT_TIMERSLACK;
1229                                 goto fail_child;
1230                         }
1231
1232                 if (context->utmp_id)
1233                         utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
1234
1235                 if (context->user) {
1236                         username = context->user;
1237                         err = get_user_creds(&username, &uid, &gid, &home);
1238                         if (err < 0) {
1239                                 r = EXIT_USER;
1240                                 goto fail_child;
1241                         }
1242
1243                         if (is_terminal_input(context->std_input)) {
1244                                 err = chown_terminal(STDIN_FILENO, uid);
1245                                 if (err < 0) {
1246                                         r = EXIT_STDIN;
1247                                         goto fail_child;
1248                                 }
1249                         }
1250
1251                         if (cgroup_bondings && context->control_group_modify) {
1252                                 err = cgroup_bonding_set_group_access_list(cgroup_bondings, 0755, uid, gid);
1253                                 if (err >= 0)
1254                                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, 0644, uid, gid, context->control_group_persistent);
1255                                 if (err < 0) {
1256                                         r = EXIT_CGROUP;
1257                                         goto fail_child;
1258                                 }
1259
1260                                 set_access = true;
1261                         }
1262                 }
1263
1264                 if (cgroup_bondings && !set_access && context->control_group_persistent >= 0)  {
1265                         err = cgroup_bonding_set_task_access_list(cgroup_bondings, (mode_t) -1, (uid_t) -1, (uid_t) -1, context->control_group_persistent);
1266                         if (err < 0) {
1267                                 r = EXIT_CGROUP;
1268                                 goto fail_child;
1269                         }
1270                 }
1271
1272                 if (apply_permissions) {
1273                         err = enforce_groups(context, username, gid);
1274                         if (err < 0) {
1275                                 r = EXIT_GROUP;
1276                                 goto fail_child;
1277                         }
1278                 }
1279
1280                 umask(context->umask);
1281
1282 #ifdef HAVE_PAM
1283                 if (context->pam_name && username) {
1284                         err = setup_pam(context->pam_name, username, context->tty_path, &pam_env, fds, n_fds);
1285                         if (err < 0) {
1286                                 r = EXIT_PAM;
1287                                 goto fail_child;
1288                         }
1289                 }
1290 #endif
1291                 if (context->private_network) {
1292                         if (unshare(CLONE_NEWNET) < 0) {
1293                                 err = -errno;
1294                                 r = EXIT_NETWORK;
1295                                 goto fail_child;
1296                         }
1297
1298                         loopback_setup();
1299                 }
1300
1301                 if (strv_length(context->read_write_dirs) > 0 ||
1302                     strv_length(context->read_only_dirs) > 0 ||
1303                     strv_length(context->inaccessible_dirs) > 0 ||
1304                     context->mount_flags != MS_SHARED ||
1305                     context->private_tmp) {
1306                         err = setup_namespace(context->read_write_dirs,
1307                                               context->read_only_dirs,
1308                                               context->inaccessible_dirs,
1309                                               context->private_tmp,
1310                                               context->mount_flags);
1311                         if (err < 0) {
1312                                 r = EXIT_NAMESPACE;
1313                                 goto fail_child;
1314                         }
1315                 }
1316
1317                 if (apply_chroot) {
1318                         if (context->root_directory)
1319                                 if (chroot(context->root_directory) < 0) {
1320                                         err = -errno;
1321                                         r = EXIT_CHROOT;
1322                                         goto fail_child;
1323                                 }
1324
1325                         if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
1326                                 err = -errno;
1327                                 r = EXIT_CHDIR;
1328                                 goto fail_child;
1329                         }
1330                 } else {
1331
1332                         char *d;
1333
1334                         if (asprintf(&d, "%s/%s",
1335                                      context->root_directory ? context->root_directory : "",
1336                                      context->working_directory ? context->working_directory : "") < 0) {
1337                                 err = -ENOMEM;
1338                                 r = EXIT_MEMORY;
1339                                 goto fail_child;
1340                         }
1341
1342                         if (chdir(d) < 0) {
1343                                 err = -errno;
1344                                 free(d);
1345                                 r = EXIT_CHDIR;
1346                                 goto fail_child;
1347                         }
1348
1349                         free(d);
1350                 }
1351
1352                 /* We repeat the fd closing here, to make sure that
1353                  * nothing is leaked from the PAM modules */
1354                 err = close_all_fds(fds, n_fds);
1355                 if (err >= 0)
1356                         err = shift_fds(fds, n_fds);
1357                 if (err >= 0)
1358                         err = flags_fds(fds, n_fds, context->non_blocking);
1359                 if (err < 0) {
1360                         r = EXIT_FDS;
1361                         goto fail_child;
1362                 }
1363
1364                 if (apply_permissions) {
1365
1366                         for (i = 0; i < RLIMIT_NLIMITS; i++) {
1367                                 if (!context->rlimit[i])
1368                                         continue;
1369
1370                                 if (setrlimit(i, context->rlimit[i]) < 0) {
1371                                         err = -errno;
1372                                         r = EXIT_LIMITS;
1373                                         goto fail_child;
1374                                 }
1375                         }
1376
1377                         if (context->capability_bounding_set_drop) {
1378                                 err = do_capability_bounding_set_drop(context->capability_bounding_set_drop);
1379                                 if (err < 0) {
1380                                         r = EXIT_CAPABILITIES;
1381                                         goto fail_child;
1382                                 }
1383                         }
1384
1385                         if (context->user) {
1386                                 err = enforce_user(context, uid);
1387                                 if (err < 0) {
1388                                         r = EXIT_USER;
1389                                         goto fail_child;
1390                                 }
1391                         }
1392
1393                         /* PR_GET_SECUREBITS is not privileged, while
1394                          * PR_SET_SECUREBITS is. So to suppress
1395                          * potential EPERMs we'll try not to call
1396                          * PR_SET_SECUREBITS unless necessary. */
1397                         if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
1398                                 if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
1399                                         err = -errno;
1400                                         r = EXIT_SECUREBITS;
1401                                         goto fail_child;
1402                                 }
1403
1404                         if (context->capabilities)
1405                                 if (cap_set_proc(context->capabilities) < 0) {
1406                                         err = -errno;
1407                                         r = EXIT_CAPABILITIES;
1408                                         goto fail_child;
1409                                 }
1410                 }
1411
1412                 if (!(our_env = new0(char*, 7))) {
1413                         err = -ENOMEM;
1414                         r = EXIT_MEMORY;
1415                         goto fail_child;
1416                 }
1417
1418                 if (n_fds > 0)
1419                         if (asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
1420                             asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0) {
1421                                 err = -ENOMEM;
1422                                 r = EXIT_MEMORY;
1423                                 goto fail_child;
1424                         }
1425
1426                 if (home)
1427                         if (asprintf(our_env + n_env++, "HOME=%s", home) < 0) {
1428                                 err = -ENOMEM;
1429                                 r = EXIT_MEMORY;
1430                                 goto fail_child;
1431                         }
1432
1433                 if (username)
1434                         if (asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
1435                             asprintf(our_env + n_env++, "USER=%s", username) < 0) {
1436                                 err = -ENOMEM;
1437                                 r = EXIT_MEMORY;
1438                                 goto fail_child;
1439                         }
1440
1441                 if (is_terminal_input(context->std_input) ||
1442                     context->std_output == EXEC_OUTPUT_TTY ||
1443                     context->std_error == EXEC_OUTPUT_TTY)
1444                         if (!(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))) {
1445                                 err = -ENOMEM;
1446                                 r = EXIT_MEMORY;
1447                                 goto fail_child;
1448                         }
1449
1450                 assert(n_env <= 7);
1451
1452                 if (!(final_env = strv_env_merge(
1453                                       5,
1454                                       environment,
1455                                       our_env,
1456                                       context->environment,
1457                                       files_env,
1458                                       pam_env,
1459                                       NULL))) {
1460                         err = -ENOMEM;
1461                         r = EXIT_MEMORY;
1462                         goto fail_child;
1463                 }
1464
1465                 if (!(final_argv = replace_env_argv(argv, final_env))) {
1466                         err = -ENOMEM;
1467                         r = EXIT_MEMORY;
1468                         goto fail_child;
1469                 }
1470
1471                 final_env = strv_env_clean(final_env);
1472
1473                 execve(command->path, final_argv, final_env);
1474                 err = -errno;
1475                 r = EXIT_EXEC;
1476
1477         fail_child:
1478                 if (r != 0) {
1479                         log_open();
1480                         log_warning("Failed at step %s spawning %s: %s",
1481                                     exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
1482                                     command->path, strerror(-err));
1483                 }
1484
1485                 strv_free(our_env);
1486                 strv_free(final_env);
1487                 strv_free(pam_env);
1488                 strv_free(files_env);
1489                 strv_free(final_argv);
1490
1491                 if (saved_stdin >= 0)
1492                         close_nointr_nofail(saved_stdin);
1493
1494                 if (saved_stdout >= 0)
1495                         close_nointr_nofail(saved_stdout);
1496
1497                 _exit(r);
1498         }
1499
1500         strv_free(files_env);
1501
1502         /* We add the new process to the cgroup both in the child (so
1503          * that we can be sure that no user code is ever executed
1504          * outside of the cgroup) and in the parent (so that we can be
1505          * sure that when we kill the cgroup the process will be
1506          * killed too). */
1507         if (cgroup_bondings)
1508                 cgroup_bonding_install_list(cgroup_bondings, pid);
1509
1510         log_debug("Forked %s as %lu", command->path, (unsigned long) pid);
1511
1512         exec_status_start(&command->exec_status, pid);
1513
1514         *ret = pid;
1515         return 0;
1516
1517 fail_parent:
1518         strv_free(files_env);
1519
1520         return r;
1521 }
1522
1523 void exec_context_init(ExecContext *c) {
1524         assert(c);
1525
1526         c->umask = 0022;
1527         c->ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 0);
1528         c->cpu_sched_policy = SCHED_OTHER;
1529         c->syslog_priority = LOG_DAEMON|LOG_INFO;
1530         c->syslog_level_prefix = true;
1531         c->mount_flags = MS_SHARED;
1532         c->kill_signal = SIGTERM;
1533         c->send_sigkill = true;
1534         c->control_group_persistent = -1;
1535         c->ignore_sigpipe = true;
1536 }
1537
1538 void exec_context_done(ExecContext *c) {
1539         unsigned l;
1540
1541         assert(c);
1542
1543         strv_free(c->environment);
1544         c->environment = NULL;
1545
1546         strv_free(c->environment_files);
1547         c->environment_files = NULL;
1548
1549         for (l = 0; l < ELEMENTSOF(c->rlimit); l++) {
1550                 free(c->rlimit[l]);
1551                 c->rlimit[l] = NULL;
1552         }
1553
1554         free(c->working_directory);
1555         c->working_directory = NULL;
1556         free(c->root_directory);
1557         c->root_directory = NULL;
1558
1559         free(c->tty_path);
1560         c->tty_path = NULL;
1561
1562         free(c->tcpwrap_name);
1563         c->tcpwrap_name = NULL;
1564
1565         free(c->syslog_identifier);
1566         c->syslog_identifier = NULL;
1567
1568         free(c->user);
1569         c->user = NULL;
1570
1571         free(c->group);
1572         c->group = NULL;
1573
1574         strv_free(c->supplementary_groups);
1575         c->supplementary_groups = NULL;
1576
1577         free(c->pam_name);
1578         c->pam_name = NULL;
1579
1580         if (c->capabilities) {
1581                 cap_free(c->capabilities);
1582                 c->capabilities = NULL;
1583         }
1584
1585         strv_free(c->read_only_dirs);
1586         c->read_only_dirs = NULL;
1587
1588         strv_free(c->read_write_dirs);
1589         c->read_write_dirs = NULL;
1590
1591         strv_free(c->inaccessible_dirs);
1592         c->inaccessible_dirs = NULL;
1593
1594         if (c->cpuset)
1595                 CPU_FREE(c->cpuset);
1596
1597         free(c->utmp_id);
1598         c->utmp_id = NULL;
1599 }
1600
1601 void exec_command_done(ExecCommand *c) {
1602         assert(c);
1603
1604         free(c->path);
1605         c->path = NULL;
1606
1607         strv_free(c->argv);
1608         c->argv = NULL;
1609 }
1610
1611 void exec_command_done_array(ExecCommand *c, unsigned n) {
1612         unsigned i;
1613
1614         for (i = 0; i < n; i++)
1615                 exec_command_done(c+i);
1616 }
1617
1618 void exec_command_free_list(ExecCommand *c) {
1619         ExecCommand *i;
1620
1621         while ((i = c)) {
1622                 LIST_REMOVE(ExecCommand, command, c, i);
1623                 exec_command_done(i);
1624                 free(i);
1625         }
1626 }
1627
1628 void exec_command_free_array(ExecCommand **c, unsigned n) {
1629         unsigned i;
1630
1631         for (i = 0; i < n; i++) {
1632                 exec_command_free_list(c[i]);
1633                 c[i] = NULL;
1634         }
1635 }
1636
1637 int exec_context_load_environment(const ExecContext *c, char ***l) {
1638         char **i, **r = NULL;
1639
1640         assert(c);
1641         assert(l);
1642
1643         STRV_FOREACH(i, c->environment_files) {
1644                 char *fn;
1645                 int k;
1646                 bool ignore = false;
1647                 char **p;
1648
1649                 fn = *i;
1650
1651                 if (fn[0] == '-') {
1652                         ignore = true;
1653                         fn ++;
1654                 }
1655
1656                 if (!path_is_absolute(fn)) {
1657
1658                         if (ignore)
1659                                 continue;
1660
1661                         strv_free(r);
1662                         return -EINVAL;
1663                 }
1664
1665                 if ((k = load_env_file(fn, &p)) < 0) {
1666
1667                         if (ignore)
1668                                 continue;
1669
1670                         strv_free(r);
1671                         return k;
1672                 }
1673
1674                 if (r == NULL)
1675                         r = p;
1676                 else {
1677                         char **m;
1678
1679                         m = strv_env_merge(2, r, p);
1680                         strv_free(r);
1681                         strv_free(p);
1682
1683                         if (!m)
1684                                 return -ENOMEM;
1685
1686                         r = m;
1687                 }
1688         }
1689
1690         *l = r;
1691
1692         return 0;
1693 }
1694
1695 static void strv_fprintf(FILE *f, char **l) {
1696         char **g;
1697
1698         assert(f);
1699
1700         STRV_FOREACH(g, l)
1701                 fprintf(f, " %s", *g);
1702 }
1703
1704 void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
1705         char ** e;
1706         unsigned i;
1707
1708         assert(c);
1709         assert(f);
1710
1711         if (!prefix)
1712                 prefix = "";
1713
1714         fprintf(f,
1715                 "%sUMask: %04o\n"
1716                 "%sWorkingDirectory: %s\n"
1717                 "%sRootDirectory: %s\n"
1718                 "%sNonBlocking: %s\n"
1719                 "%sPrivateTmp: %s\n"
1720                 "%sControlGroupModify: %s\n"
1721                 "%sControlGroupPersistent: %s\n"
1722                 "%sPrivateNetwork: %s\n",
1723                 prefix, c->umask,
1724                 prefix, c->working_directory ? c->working_directory : "/",
1725                 prefix, c->root_directory ? c->root_directory : "/",
1726                 prefix, yes_no(c->non_blocking),
1727                 prefix, yes_no(c->private_tmp),
1728                 prefix, yes_no(c->control_group_modify),
1729                 prefix, yes_no(c->control_group_persistent),
1730                 prefix, yes_no(c->private_network));
1731
1732         STRV_FOREACH(e, c->environment)
1733                 fprintf(f, "%sEnvironment: %s\n", prefix, *e);
1734
1735         STRV_FOREACH(e, c->environment_files)
1736                 fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
1737
1738         if (c->tcpwrap_name)
1739                 fprintf(f,
1740                         "%sTCPWrapName: %s\n",
1741                         prefix, c->tcpwrap_name);
1742
1743         if (c->nice_set)
1744                 fprintf(f,
1745                         "%sNice: %i\n",
1746                         prefix, c->nice);
1747
1748         if (c->oom_score_adjust_set)
1749                 fprintf(f,
1750                         "%sOOMScoreAdjust: %i\n",
1751                         prefix, c->oom_score_adjust);
1752
1753         for (i = 0; i < RLIM_NLIMITS; i++)
1754                 if (c->rlimit[i])
1755                         fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
1756
1757         if (c->ioprio_set)
1758                 fprintf(f,
1759                         "%sIOSchedulingClass: %s\n"
1760                         "%sIOPriority: %i\n",
1761                         prefix, ioprio_class_to_string(IOPRIO_PRIO_CLASS(c->ioprio)),
1762                         prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
1763
1764         if (c->cpu_sched_set)
1765                 fprintf(f,
1766                         "%sCPUSchedulingPolicy: %s\n"
1767                         "%sCPUSchedulingPriority: %i\n"
1768                         "%sCPUSchedulingResetOnFork: %s\n",
1769                         prefix, sched_policy_to_string(c->cpu_sched_policy),
1770                         prefix, c->cpu_sched_priority,
1771                         prefix, yes_no(c->cpu_sched_reset_on_fork));
1772
1773         if (c->cpuset) {
1774                 fprintf(f, "%sCPUAffinity:", prefix);
1775                 for (i = 0; i < c->cpuset_ncpus; i++)
1776                         if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
1777                                 fprintf(f, " %i", i);
1778                 fputs("\n", f);
1779         }
1780
1781         if (c->timer_slack_nsec_set)
1782                 fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, c->timer_slack_nsec);
1783
1784         fprintf(f,
1785                 "%sStandardInput: %s\n"
1786                 "%sStandardOutput: %s\n"
1787                 "%sStandardError: %s\n",
1788                 prefix, exec_input_to_string(c->std_input),
1789                 prefix, exec_output_to_string(c->std_output),
1790                 prefix, exec_output_to_string(c->std_error));
1791
1792         if (c->tty_path)
1793                 fprintf(f,
1794                         "%sTTYPath: %s\n"
1795                         "%sTTYReset: %s\n"
1796                         "%sTTYVHangup: %s\n"
1797                         "%sTTYVTDisallocate: %s\n",
1798                         prefix, c->tty_path,
1799                         prefix, yes_no(c->tty_reset),
1800                         prefix, yes_no(c->tty_vhangup),
1801                         prefix, yes_no(c->tty_vt_disallocate));
1802
1803         if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
1804             c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
1805             c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
1806             c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE)
1807                 fprintf(f,
1808                         "%sSyslogFacility: %s\n"
1809                         "%sSyslogLevel: %s\n",
1810                         prefix, log_facility_unshifted_to_string(c->syslog_priority >> 3),
1811                         prefix, log_level_to_string(LOG_PRI(c->syslog_priority)));
1812
1813         if (c->capabilities) {
1814                 char *t;
1815                 if ((t = cap_to_text(c->capabilities, NULL))) {
1816                         fprintf(f, "%sCapabilities: %s\n",
1817                                 prefix, t);
1818                         cap_free(t);
1819                 }
1820         }
1821
1822         if (c->secure_bits)
1823                 fprintf(f, "%sSecure Bits:%s%s%s%s%s%s\n",
1824                         prefix,
1825                         (c->secure_bits & SECURE_KEEP_CAPS) ? " keep-caps" : "",
1826                         (c->secure_bits & SECURE_KEEP_CAPS_LOCKED) ? " keep-caps-locked" : "",
1827                         (c->secure_bits & SECURE_NO_SETUID_FIXUP) ? " no-setuid-fixup" : "",
1828                         (c->secure_bits & SECURE_NO_SETUID_FIXUP_LOCKED) ? " no-setuid-fixup-locked" : "",
1829                         (c->secure_bits & SECURE_NOROOT) ? " noroot" : "",
1830                         (c->secure_bits & SECURE_NOROOT_LOCKED) ? "noroot-locked" : "");
1831
1832         if (c->capability_bounding_set_drop) {
1833                 unsigned long l;
1834                 fprintf(f, "%sCapabilityBoundingSet:", prefix);
1835
1836                 for (l = 0; l <= cap_last_cap(); l++)
1837                         if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
1838                                 char *t;
1839
1840                                 if ((t = cap_to_name(l))) {
1841                                         fprintf(f, " %s", t);
1842                                         cap_free(t);
1843                                 }
1844                         }
1845
1846                 fputs("\n", f);
1847         }
1848
1849         if (c->user)
1850                 fprintf(f, "%sUser: %s\n", prefix, c->user);
1851         if (c->group)
1852                 fprintf(f, "%sGroup: %s\n", prefix, c->group);
1853
1854         if (strv_length(c->supplementary_groups) > 0) {
1855                 fprintf(f, "%sSupplementaryGroups:", prefix);
1856                 strv_fprintf(f, c->supplementary_groups);
1857                 fputs("\n", f);
1858         }
1859
1860         if (c->pam_name)
1861                 fprintf(f, "%sPAMName: %s\n", prefix, c->pam_name);
1862
1863         if (strv_length(c->read_write_dirs) > 0) {
1864                 fprintf(f, "%sReadWriteDirs:", prefix);
1865                 strv_fprintf(f, c->read_write_dirs);
1866                 fputs("\n", f);
1867         }
1868
1869         if (strv_length(c->read_only_dirs) > 0) {
1870                 fprintf(f, "%sReadOnlyDirs:", prefix);
1871                 strv_fprintf(f, c->read_only_dirs);
1872                 fputs("\n", f);
1873         }
1874
1875         if (strv_length(c->inaccessible_dirs) > 0) {
1876                 fprintf(f, "%sInaccessibleDirs:", prefix);
1877                 strv_fprintf(f, c->inaccessible_dirs);
1878                 fputs("\n", f);
1879         }
1880
1881         fprintf(f,
1882                 "%sKillMode: %s\n"
1883                 "%sKillSignal: SIG%s\n"
1884                 "%sSendSIGKILL: %s\n"
1885                 "%sIgnoreSIGPIPE: %s\n",
1886                 prefix, kill_mode_to_string(c->kill_mode),
1887                 prefix, signal_to_string(c->kill_signal),
1888                 prefix, yes_no(c->send_sigkill),
1889                 prefix, yes_no(c->ignore_sigpipe));
1890
1891         if (c->utmp_id)
1892                 fprintf(f,
1893                         "%sUtmpIdentifier: %s\n",
1894                         prefix, c->utmp_id);
1895 }
1896
1897 void exec_status_start(ExecStatus *s, pid_t pid) {
1898         assert(s);
1899
1900         zero(*s);
1901         s->pid = pid;
1902         dual_timestamp_get(&s->start_timestamp);
1903 }
1904
1905 void exec_status_exit(ExecStatus *s, ExecContext *context, pid_t pid, int code, int status) {
1906         assert(s);
1907
1908         if (s->pid && s->pid != pid)
1909                 zero(*s);
1910
1911         s->pid = pid;
1912         dual_timestamp_get(&s->exit_timestamp);
1913
1914         s->code = code;
1915         s->status = status;
1916
1917         if (context) {
1918                 if (context->utmp_id)
1919                         utmp_put_dead_process(context->utmp_id, pid, code, status);
1920
1921                 exec_context_tty_reset(context);
1922         }
1923 }
1924
1925 void exec_status_dump(ExecStatus *s, FILE *f, const char *prefix) {
1926         char buf[FORMAT_TIMESTAMP_MAX];
1927
1928         assert(s);
1929         assert(f);
1930
1931         if (!prefix)
1932                 prefix = "";
1933
1934         if (s->pid <= 0)
1935                 return;
1936
1937         fprintf(f,
1938                 "%sPID: %lu\n",
1939                 prefix, (unsigned long) s->pid);
1940
1941         if (s->start_timestamp.realtime > 0)
1942                 fprintf(f,
1943                         "%sStart Timestamp: %s\n",
1944                         prefix, format_timestamp(buf, sizeof(buf), s->start_timestamp.realtime));
1945
1946         if (s->exit_timestamp.realtime > 0)
1947                 fprintf(f,
1948                         "%sExit Timestamp: %s\n"
1949                         "%sExit Code: %s\n"
1950                         "%sExit Status: %i\n",
1951                         prefix, format_timestamp(buf, sizeof(buf), s->exit_timestamp.realtime),
1952                         prefix, sigchld_code_to_string(s->code),
1953                         prefix, s->status);
1954 }
1955
1956 char *exec_command_line(char **argv) {
1957         size_t k;
1958         char *n, *p, **a;
1959         bool first = true;
1960
1961         assert(argv);
1962
1963         k = 1;
1964         STRV_FOREACH(a, argv)
1965                 k += strlen(*a)+3;
1966
1967         if (!(n = new(char, k)))
1968                 return NULL;
1969
1970         p = n;
1971         STRV_FOREACH(a, argv) {
1972
1973                 if (!first)
1974                         *(p++) = ' ';
1975                 else
1976                         first = false;
1977
1978                 if (strpbrk(*a, WHITESPACE)) {
1979                         *(p++) = '\'';
1980                         p = stpcpy(p, *a);
1981                         *(p++) = '\'';
1982                 } else
1983                         p = stpcpy(p, *a);
1984
1985         }
1986
1987         *p = 0;
1988
1989         /* FIXME: this doesn't really handle arguments that have
1990          * spaces and ticks in them */
1991
1992         return n;
1993 }
1994
1995 void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
1996         char *p2;
1997         const char *prefix2;
1998
1999         char *cmd;
2000
2001         assert(c);
2002         assert(f);
2003
2004         if (!prefix)
2005                 prefix = "";
2006         p2 = strappend(prefix, "\t");
2007         prefix2 = p2 ? p2 : prefix;
2008
2009         cmd = exec_command_line(c->argv);
2010
2011         fprintf(f,
2012                 "%sCommand Line: %s\n",
2013                 prefix, cmd ? cmd : strerror(ENOMEM));
2014
2015         free(cmd);
2016
2017         exec_status_dump(&c->exec_status, f, prefix2);
2018
2019         free(p2);
2020 }
2021
2022 void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
2023         assert(f);
2024
2025         if (!prefix)
2026                 prefix = "";
2027
2028         LIST_FOREACH(command, c, c)
2029                 exec_command_dump(c, f, prefix);
2030 }
2031
2032 void exec_command_append_list(ExecCommand **l, ExecCommand *e) {
2033         ExecCommand *end;
2034
2035         assert(l);
2036         assert(e);
2037
2038         if (*l) {
2039                 /* It's kind of important, that we keep the order here */
2040                 LIST_FIND_TAIL(ExecCommand, command, *l, end);
2041                 LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
2042         } else
2043               *l = e;
2044 }
2045
2046 int exec_command_set(ExecCommand *c, const char *path, ...) {
2047         va_list ap;
2048         char **l, *p;
2049
2050         assert(c);
2051         assert(path);
2052
2053         va_start(ap, path);
2054         l = strv_new_ap(path, ap);
2055         va_end(ap);
2056
2057         if (!l)
2058                 return -ENOMEM;
2059
2060         if (!(p = strdup(path))) {
2061                 strv_free(l);
2062                 return -ENOMEM;
2063         }
2064
2065         free(c->path);
2066         c->path = p;
2067
2068         strv_free(c->argv);
2069         c->argv = l;
2070
2071         return 0;
2072 }
2073
2074 static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
2075         [EXEC_INPUT_NULL] = "null",
2076         [EXEC_INPUT_TTY] = "tty",
2077         [EXEC_INPUT_TTY_FORCE] = "tty-force",
2078         [EXEC_INPUT_TTY_FAIL] = "tty-fail",
2079         [EXEC_INPUT_SOCKET] = "socket"
2080 };
2081
2082 DEFINE_STRING_TABLE_LOOKUP(exec_input, ExecInput);
2083
2084 static const char* const exec_output_table[_EXEC_OUTPUT_MAX] = {
2085         [EXEC_OUTPUT_INHERIT] = "inherit",
2086         [EXEC_OUTPUT_NULL] = "null",
2087         [EXEC_OUTPUT_TTY] = "tty",
2088         [EXEC_OUTPUT_SYSLOG] = "syslog",
2089         [EXEC_OUTPUT_SYSLOG_AND_CONSOLE] = "syslog+console",
2090         [EXEC_OUTPUT_KMSG] = "kmsg",
2091         [EXEC_OUTPUT_KMSG_AND_CONSOLE] = "kmsg+console",
2092         [EXEC_OUTPUT_JOURNAL] = "journal",
2093         [EXEC_OUTPUT_JOURNAL_AND_CONSOLE] = "journal+console",
2094         [EXEC_OUTPUT_SOCKET] = "socket"
2095 };
2096
2097 DEFINE_STRING_TABLE_LOOKUP(exec_output, ExecOutput);
2098
2099 static const char* const kill_mode_table[_KILL_MODE_MAX] = {
2100         [KILL_CONTROL_GROUP] = "control-group",
2101         [KILL_PROCESS] = "process",
2102         [KILL_NONE] = "none"
2103 };
2104
2105 DEFINE_STRING_TABLE_LOOKUP(kill_mode, KillMode);
2106
2107 static const char* const kill_who_table[_KILL_WHO_MAX] = {
2108         [KILL_MAIN] = "main",
2109         [KILL_CONTROL] = "control",
2110         [KILL_ALL] = "all"
2111 };
2112
2113 DEFINE_STRING_TABLE_LOOKUP(kill_who, KillWho);