src/tmpfiles/tmpfiles.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2010 Lennart Poettering, Kay Sievers
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <unistd.h>
  23 #include <fcntl.h>
  24 #include <errno.h>
  25 #include <string.h>
  26 #include <sys/stat.h>
  27 #include <limits.h>
  28 #include <dirent.h>
  29 #include <grp.h>
  30 #include <pwd.h>
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <stddef.h>
  34 #include <getopt.h>
  35 #include <stdbool.h>
  36 #include <time.h>
  37 #include <sys/types.h>
  38 #include <sys/param.h>
  39 #include <glob.h>
  40 #include <fnmatch.h>
  41 #include <sys/capability.h>
  42
  43 #include "log.h"
  44 #include "util.h"
  45 #include "macro.h"
  46 #include "missing.h"
  47 #include "mkdir.h"
  48 #include "path-util.h"
  49 #include "strv.h"
  50 #include "label.h"
  51 #include "set.h"
  52 #include "conf-files.h"
  53 #include "capability.h"
  54 #include "specifier.h"
  55 #include "build.h"
  56 #include "copy.h"
  57
  58 /* This reads all files listed in /etc/tmpfiles.d/?*.conf and creates
  59  * them in the file system. This is intended to be used to create
  60  * properly owned directories beneath /tmp, /var/tmp, /run, which are
  61  * volatile and hence need to be recreated on bootup. */
  62
  63 typedef enum ItemType {
  64         /* These ones take file names */
  65         CREATE_FILE = 'f',
  66         TRUNCATE_FILE = 'F',
  67         CREATE_DIRECTORY = 'd',
  68         TRUNCATE_DIRECTORY = 'D',
  69         CREATE_FIFO = 'p',
  70         CREATE_SYMLINK = 'L',
  71         CREATE_CHAR_DEVICE = 'c',
  72         CREATE_BLOCK_DEVICE = 'b',
  73         COPY_FILES = 'C',
  74
  75         /* These ones take globs */
  76         WRITE_FILE = 'w',
  77         IGNORE_PATH = 'x',
  78         IGNORE_DIRECTORY_PATH = 'X',
  79         REMOVE_PATH = 'r',
  80         RECURSIVE_REMOVE_PATH = 'R',
  81         ADJUST_MODE = 'm', /* legacy, 'z' is identical to this */
  82         RELABEL_PATH = 'z',
  83         RECURSIVE_RELABEL_PATH = 'Z',
  84 } ItemType;
  85
  86 typedef struct Item {
  87         ItemType type;
  88
  89         char *path;
  90         char *argument;
  91         uid_t uid;
  92         gid_t gid;
  93         mode_t mode;
  94         usec_t age;
  95
  96         dev_t major_minor;
  97
  98         bool uid_set:1;
  99         bool gid_set:1;
 100         bool mode_set:1;
 101         bool age_set:1;
 102         bool mask_perms:1;
 103
 104         bool keep_first_level:1;
 105
 106         bool force:1;
 107
 108         bool done:1;
 109 } Item;
 110
 111 static bool arg_create = false;
 112 static bool arg_clean = false;
 113 static bool arg_remove = false;
 114 static bool arg_boot = false;
 115
 116 static char **arg_include_prefixes = NULL;
 117 static char **arg_exclude_prefixes = NULL;
 118 static char *arg_root = NULL;
 119
 120 static const char conf_file_dirs[] =
 121         "/etc/tmpfiles.d\0"
 122         "/run/tmpfiles.d\0"
 123         "/usr/local/lib/tmpfiles.d\0"
 124         "/usr/lib/tmpfiles.d\0"
 125 #ifdef HAVE_SPLIT_USR
 126         "/lib/tmpfiles.d\0"
 127 #endif
 128         ;
 129
 130 #define MAX_DEPTH 256
 131
 132 static Hashmap *items = NULL, *globs = NULL;
 133 static Set *unix_sockets = NULL;
 134
 135 static bool needs_glob(ItemType t) {
 136         return IN_SET(t,
 137                       WRITE_FILE,
 138                       IGNORE_PATH,
 139                       IGNORE_DIRECTORY_PATH,
 140                       REMOVE_PATH,
 141                       RECURSIVE_REMOVE_PATH,
 142                       ADJUST_MODE,
 143                       RELABEL_PATH,
 144                       RECURSIVE_RELABEL_PATH);
 145 }
 146
 147 static struct Item* find_glob(Hashmap *h, const char *match) {
 148         Item *j;
 149         Iterator i;
 150
 151         HASHMAP_FOREACH(j, h, i)
 152                 if (fnmatch(j->path, match, FNM_PATHNAME|FNM_PERIOD) == 0)
 153                         return j;
 154
 155         return NULL;
 156 }
 157
 158 static void load_unix_sockets(void) {
 159         _cleanup_fclose_ FILE *f = NULL;
 160         char line[LINE_MAX];
 161
 162         if (unix_sockets)
 163                 return;
 164
 165         /* We maintain a cache of the sockets we found in
 166          * /proc/net/unix to speed things up a little. */
 167
 168         unix_sockets = set_new(string_hash_func, string_compare_func);
 169         if (!unix_sockets)
 170                 return;
 171
 172         f = fopen("/proc/net/unix", "re");
 173         if (!f)
 174                 return;
 175
 176         /* Skip header */
 177         if (!fgets(line, sizeof(line), f))
 178                 goto fail;
 179
 180         for (;;) {
 181                 char *p, *s;
 182                 int k;
 183
 184                 if (!fgets(line, sizeof(line), f))
 185                         break;
 186
 187                 truncate_nl(line);
 188
 189                 p = strchr(line, ':');
 190                 if (!p)
 191                         continue;
 192
 193                 if (strlen(p) < 37)
 194                         continue;
 195
 196                 p += 37;
 197                 p += strspn(p, WHITESPACE);
 198                 p += strcspn(p, WHITESPACE); /* skip one more word */
 199                 p += strspn(p, WHITESPACE);
 200
 201                 if (*p != '/')
 202                         continue;
 203
 204                 s = strdup(p);
 205                 if (!s)
 206                         goto fail;
 207
 208                 path_kill_slashes(s);
 209
 210                 k = set_consume(unix_sockets, s);
 211                 if (k < 0 && k != -EEXIST)
 212                         goto fail;
 213         }
 214
 215         return;
 216
 217 fail:
 218         set_free_free(unix_sockets);
 219         unix_sockets = NULL;
 220 }
 221
 222 static bool unix_socket_alive(const char *fn) {
 223         assert(fn);
 224
 225         load_unix_sockets();
 226
 227         if (unix_sockets)
 228                 return !!set_get(unix_sockets, (char*) fn);
 229
 230         /* We don't know, so assume yes */
 231         return true;
 232 }
 233
 234 static int dir_is_mount_point(DIR *d, const char *subdir) {
 235
 236         union file_handle_union h = {
 237                 .handle.handle_bytes = MAX_HANDLE_SZ
 238         };
 239
 240         int mount_id_parent, mount_id;
 241         int r_p, r;
 242
 243         r_p = name_to_handle_at(dirfd(d), ".", &h.handle, &mount_id_parent, 0);
 244         if (r_p < 0)
 245                 r_p = -errno;
 246
 247         h.handle.handle_bytes = MAX_HANDLE_SZ;
 248         r = name_to_handle_at(dirfd(d), subdir, &h.handle, &mount_id, 0);
 249         if (r < 0)
 250                 r = -errno;
 251
 252         /* got no handle; make no assumptions, return error */
 253         if (r_p < 0 && r < 0)
 254                 return r_p;
 255
 256         /* got both handles; if they differ, it is a mount point */
 257         if (r_p >= 0 && r >= 0)
 258                 return mount_id_parent != mount_id;
 259
 260         /* got only one handle; assume different mount points if one
 261          * of both queries was not supported by the filesystem */
 262         if (r_p == -ENOSYS || r_p == -ENOTSUP || r == -ENOSYS || r == -ENOTSUP)
 263                 return true;
 264
 265         /* return error */
 266         if (r_p < 0)
 267                 return r_p;
 268         return r;
 269 }
 270
 271 static int dir_cleanup(
 272                 Item *i,
 273                 const char *p,
 274                 DIR *d,
 275                 const struct stat *ds,
 276                 usec_t cutoff,
 277                 dev_t rootdev,
 278                 bool mountpoint,
 279                 int maxdepth,
 280                 bool keep_this_level) {
 281
 282         struct dirent *dent;
 283         struct timespec times[2];
 284         bool deleted = false;
 285         int r = 0;
 286
 287         while ((dent = readdir(d))) {
 288                 struct stat s;
 289                 usec_t age;
 290                 _cleanup_free_ char *sub_path = NULL;
 291
 292                 if (streq(dent->d_name, ".") ||
 293                     streq(dent->d_name, ".."))
 294                         continue;
 295
 296                 if (fstatat(dirfd(d), dent->d_name, &s, AT_SYMLINK_NOFOLLOW) < 0) {
 297                         if (errno == ENOENT)
 298                                 continue;
 299
 300                         /* FUSE, NFS mounts, SELinux might return EACCES */
 301                         if (errno == EACCES)
 302                                 log_debug("stat(%s/%s) failed: %m", p, dent->d_name);
 303                         else
 304                                 log_error("stat(%s/%s) failed: %m", p, dent->d_name);
 305                         r = -errno;
 306                         continue;
 307                 }
 308
 309                 /* Stay on the same filesystem */
 310                 if (s.st_dev != rootdev)
 311                         continue;
 312
 313                 /* Try to detect bind mounts of the same filesystem instance; they
 314                  * do not differ in device major/minors. This type of query is not
 315                  * supported on all kernels or filesystem types though. */
 316                 if (S_ISDIR(s.st_mode) && dir_is_mount_point(d, dent->d_name) > 0)
 317                         continue;
 318
 319                 /* Do not delete read-only files owned by root */
 320                 if (s.st_uid == 0 && !(s.st_mode & S_IWUSR))
 321                         continue;
 322
 323                 sub_path = strjoin(p, "/", dent->d_name, NULL);
 324                 if (!sub_path) {
 325                         r = log_oom();
 326                         goto finish;
 327                 }
 328
 329                 /* Is there an item configured for this path? */
 330                 if (hashmap_get(items, sub_path))
 331                         continue;
 332
 333                 if (find_glob(globs, sub_path))
 334                         continue;
 335
 336                 if (S_ISDIR(s.st_mode)) {
 337
 338                         if (mountpoint &&
 339                             streq(dent->d_name, "lost+found") &&
 340                             s.st_uid == 0)
 341                                 continue;
 342
 343                         if (maxdepth <= 0)
 344                                 log_warning("Reached max depth on %s.", sub_path);
 345                         else {
 346                                 _cleanup_closedir_ DIR *sub_dir;
 347                                 int q;
 348
 349                                 sub_dir = xopendirat(dirfd(d), dent->d_name, O_NOFOLLOW|O_NOATIME);
 350                                 if (!sub_dir) {
 351                                         if (errno != ENOENT) {
 352                                                 log_error("opendir(%s/%s) failed: %m", p, dent->d_name);
 353                                                 r = -errno;
 354                                         }
 355
 356                                         continue;
 357                                 }
 358
 359                                 q = dir_cleanup(i, sub_path, sub_dir, &s, cutoff, rootdev, false, maxdepth-1, false);
 360                                 if (q < 0)
 361                                         r = q;
 362                         }
 363
 364                         /* Note: if you are wondering why we don't
 365                          * support the sticky bit for excluding
 366                          * directories from cleaning like we do it for
 367                          * other file system objects: well, the sticky
 368                          * bit already has a meaning for directories,
 369                          * so we don't want to overload that. */
 370
 371                         if (keep_this_level)
 372                                 continue;
 373
 374                         /* Ignore ctime, we change it when deleting */
 375                         age = MAX(timespec_load(&s.st_mtim),
 376                                   timespec_load(&s.st_atim));
 377                         if (age >= cutoff)
 378                                 continue;
 379
 380                         if (i->type != IGNORE_DIRECTORY_PATH || !streq(dent->d_name, p)) {
 381                                 log_debug("rmdir '%s'", sub_path);
 382
 383                                 if (unlinkat(dirfd(d), dent->d_name, AT_REMOVEDIR) < 0) {
 384                                         if (errno != ENOENT && errno != ENOTEMPTY) {
 385                                                 log_error("rmdir(%s): %m", sub_path);
 386                                                 r = -errno;
 387                                         }
 388                                 }
 389                         }
 390
 391                 } else {
 392                         /* Skip files for which the sticky bit is
 393                          * set. These are semantics we define, and are
 394                          * unknown elsewhere. See XDG_RUNTIME_DIR
 395                          * specification for details. */
 396                         if (s.st_mode & S_ISVTX)
 397                                 continue;
 398
 399                         if (mountpoint && S_ISREG(s.st_mode)) {
 400                                 if (streq(dent->d_name, ".journal") &&
 401                                     s.st_uid == 0)
 402                                         continue;
 403
 404                                 if (streq(dent->d_name, "aquota.user") ||
 405                                     streq(dent->d_name, "aquota.group"))
 406                                         continue;
 407                         }
 408
 409                         /* Ignore sockets that are listed in /proc/net/unix */
 410                         if (S_ISSOCK(s.st_mode) && unix_socket_alive(sub_path))
 411                                 continue;
 412
 413                         /* Ignore device nodes */
 414                         if (S_ISCHR(s.st_mode) || S_ISBLK(s.st_mode))
 415                                 continue;
 416
 417                         /* Keep files on this level around if this is
 418                          * requested */
 419                         if (keep_this_level)
 420                                 continue;
 421
 422                         age = MAX3(timespec_load(&s.st_mtim),
 423                                    timespec_load(&s.st_atim),
 424                                    timespec_load(&s.st_ctim));
 425
 426                         if (age >= cutoff)
 427                                 continue;
 428
 429                         log_debug("unlink '%s'", sub_path);
 430
 431                         if (unlinkat(dirfd(d), dent->d_name, 0) < 0) {
 432                                 if (errno != ENOENT) {
 433                                         log_error("unlink(%s): %m", sub_path);
 434                                         r = -errno;
 435                                 }
 436                         }
 437
 438                         deleted = true;
 439                 }
 440         }
 441
 442 finish:
 443         if (deleted) {
 444                 /* Restore original directory timestamps */
 445                 times[0] = ds->st_atim;
 446                 times[1] = ds->st_mtim;
 447
 448                 if (futimens(dirfd(d), times) < 0)
 449                         log_error("utimensat(%s): %m", p);
 450         }
 451
 452         return r;
 453 }
 454
 455 static int item_set_perms(Item *i, const char *path) {
 456         assert(i);
 457         assert(path);
 458
 459         /* not using i->path directly because it may be a glob */
 460         if (i->mode_set) {
 461                 mode_t m = i->mode;
 462
 463                 if (i->mask_perms) {
 464                         struct stat st;
 465
 466                         if (stat(path, &st) >= 0) {
 467                                 if (!(st.st_mode & 0111))
 468                                         m &= ~0111;
 469                                 if (!(st.st_mode & 0222))
 470                                         m &= ~0222;
 471                                 if (!(st.st_mode & 0444))
 472                                         m &= ~0444;
 473                                 if (!S_ISDIR(st.st_mode))
 474                                         m &= ~07000; /* remove sticky/sgid/suid bit, unless directory */
 475                         }
 476                 }
 477
 478                 if (chmod(path, m) < 0) {
 479                         log_error("chmod(%s) failed: %m", path);
 480                         return -errno;
 481                 }
 482         }
 483
 484         if (i->uid_set || i->gid_set)
 485                 if (chown(path,
 486                           i->uid_set ? i->uid : (uid_t) -1,
 487                           i->gid_set ? i->gid : (gid_t) -1) < 0) {
 488
 489                         log_error("chown(%s) failed: %m", path);
 490                         return -errno;
 491                 }
 492
 493         return label_fix(path, false, false);
 494 }
 495
 496 static int write_one_file(Item *i, const char *path) {
 497         _cleanup_close_ int fd = -1;
 498         int flags, r = 0;
 499         struct stat st;
 500
 501         assert(i);
 502         assert(path);
 503
 504         flags = i->type == CREATE_FILE ? O_CREAT|O_APPEND|O_NOFOLLOW :
 505                 i->type == TRUNCATE_FILE ? O_CREAT|O_TRUNC|O_NOFOLLOW : 0;
 506
 507         RUN_WITH_UMASK(0000) {
 508                 label_context_set(path, S_IFREG);
 509                 fd = open(path, flags|O_NDELAY|O_CLOEXEC|O_WRONLY|O_NOCTTY, i->mode);
 510                 label_context_clear();
 511         }
 512
 513         if (fd < 0) {
 514                 if (i->type == WRITE_FILE && errno == ENOENT)
 515                         return 0;
 516
 517                 log_error("Failed to create file %s: %m", path);
 518                 return -errno;
 519         }
 520
 521         if (i->argument) {
 522                 _cleanup_free_ char *unescaped;
 523                 ssize_t n;
 524                 size_t l;
 525
 526                 unescaped = cunescape(i->argument);
 527                 if (!unescaped)
 528                         return log_oom();
 529
 530                 l = strlen(unescaped);
 531                 n = write(fd, unescaped, l);
 532
 533                 if (n < 0 || (size_t) n < l) {
 534                         log_error("Failed to write file %s: %s", path, n < 0 ? strerror(-n) : "Short write");
 535                         return n < 0 ? n : -EIO;
 536                 }
 537         }
 538
 539         fd = safe_close(fd);
 540
 541         if (stat(path, &st) < 0) {
 542                 log_error("stat(%s) failed: %m", path);
 543                 return -errno;
 544         }
 545
 546         if (!S_ISREG(st.st_mode)) {
 547                 log_error("%s is not a file.", path);
 548                 return -EEXIST;
 549         }
 550
 551         r = item_set_perms(i, path);
 552         if (r < 0)
 553                 return r;
 554
 555         return 0;
 556 }
 557
 558 static int item_set_perms_children(Item *i, const char *path) {
 559         _cleanup_closedir_ DIR *d;
 560         int r = 0;
 561
 562         assert(i);
 563         assert(path);
 564
 565         /* This returns the first error we run into, but nevertheless
 566          * tries to go on */
 567
 568         d = opendir(path);
 569         if (!d)
 570                 return errno == ENOENT || errno == ENOTDIR ? 0 : -errno;
 571
 572         for (;;) {
 573                 _cleanup_free_ char *p = NULL;
 574                 struct dirent *de;
 575                 int q;
 576
 577                 errno = 0;
 578                 de = readdir(d);
 579                 if (!de) {
 580                         if (errno != 0 && r == 0)
 581                                 r = -errno;
 582
 583                         break;
 584                 }
 585
 586                 if (streq(de->d_name, ".") || streq(de->d_name, ".."))
 587                         continue;
 588
 589                 p = strjoin(path, "/", de->d_name, NULL);
 590                 if (!p)
 591                         return -ENOMEM;
 592
 593                 q = item_set_perms(i, p);
 594                 if (q < 0 && q != -ENOENT && r == 0)
 595                         r = q;
 596
 597                 if (IN_SET(de->d_type, DT_UNKNOWN, DT_DIR)) {
 598                         q = item_set_perms_children(i, p);
 599                         if (q < 0 && r == 0)
 600                                 r = q;
 601                 }
 602         }
 603
 604         return r;
 605 }
 606
 607 static int item_set_perms_recursive(Item *i, const char *path) {
 608         int r, q;
 609
 610         assert(i);
 611         assert(path);
 612
 613         r = item_set_perms(i, path);
 614         if (r < 0)
 615                 return r;
 616
 617         q = item_set_perms_children(i, path);
 618         if (q < 0 && r == 0)
 619                 r = q;
 620
 621         return r;
 622 }
 623
 624 static int glob_item(Item *i, int (*action)(Item *, const char *)) {
 625         _cleanup_globfree_ glob_t g = {};
 626         int r = 0, k;
 627         char **fn;
 628
 629         errno = 0;
 630         k = glob(i->path, GLOB_NOSORT|GLOB_BRACE, NULL, &g);
 631         if (k != 0 && k != GLOB_NOMATCH) {
 632                 if (errno == 0)
 633                         errno = EIO;
 634
 635                 log_error("glob(%s) failed: %m", i->path);
 636                 return -errno;
 637         }
 638
 639         STRV_FOREACH(fn, g.gl_pathv) {
 640                 k = action(i, *fn);
 641                 if (k < 0 && r == 0)
 642                         r = k;
 643         }
 644
 645         return r;
 646 }
 647
 648 static int create_item(Item *i) {
 649         struct stat st;
 650         int r = 0;
 651
 652         assert(i);
 653
 654         switch (i->type) {
 655
 656         case IGNORE_PATH:
 657         case IGNORE_DIRECTORY_PATH:
 658         case REMOVE_PATH:
 659         case RECURSIVE_REMOVE_PATH:
 660                 return 0;
 661
 662         case CREATE_FILE:
 663         case TRUNCATE_FILE:
 664                 r = write_one_file(i, i->path);
 665                 if (r < 0)
 666                         return r;
 667                 break;
 668
 669         case COPY_FILES:
 670                 r = copy_tree(i->argument, i->path, false);
 671                 if (r < 0) {
 672                         struct stat a, b;
 673
 674                         if (r != -EEXIST) {
 675                                 log_error("Failed to copy files to %s: %s", i->path, strerror(-r));
 676                                 return -r;
 677                         }
 678
 679                         if (stat(i->argument, &a) < 0) {
 680                                 log_error("stat(%s) failed: %m", i->argument);
 681                                 return -errno;
 682                         }
 683
 684                         if (stat(i->path, &b) < 0) {
 685                                 log_error("stat(%s) failed: %m", i->path);
 686                                 return -errno;
 687                         }
 688
 689                         if ((a.st_mode ^ b.st_mode) & S_IFMT) {
 690                                 log_debug("Can't copy to %s, file exists already and is of different type", i->path);
 691                                 return 0;
 692                         }
 693                 }
 694
 695                 r = item_set_perms(i, i->path);
 696                 if (r < 0)
 697                         return r;
 698
 699                 break;
 700
 701         case WRITE_FILE:
 702                 r = glob_item(i, write_one_file);
 703                 if (r < 0)
 704                         return r;
 705
 706                 break;
 707
 708         case TRUNCATE_DIRECTORY:
 709         case CREATE_DIRECTORY:
 710
 711                 RUN_WITH_UMASK(0000) {
 712                         mkdir_parents_label(i->path, 0755);
 713                         r = mkdir_label(i->path, i->mode);
 714                 }
 715
 716                 if (r < 0) {
 717                         if (r != -EEXIST) {
 718                                 log_error("Failed to create directory %s: %s", i->path, strerror(-r));
 719                                 return r;
 720                         }
 721
 722                         if (stat(i->path, &st) < 0) {
 723                                 log_error("stat(%s) failed: %m", i->path);
 724                                 return -errno;
 725                         }
 726
 727                         if (!S_ISDIR(st.st_mode)) {
 728                                 log_debug("%s already exists and is not a directory.", i->path);
 729                                 return 0;
 730                         }
 731                 }
 732
 733                 r = item_set_perms(i, i->path);
 734                 if (r < 0)
 735                         return r;
 736
 737                 break;
 738
 739         case CREATE_FIFO:
 740
 741                 RUN_WITH_UMASK(0000) {
 742                         label_context_set(i->path, S_IFIFO);
 743                         r = mkfifo(i->path, i->mode);
 744                         label_context_clear();
 745                 }
 746
 747                 if (r < 0) {
 748                         if (errno != EEXIST) {
 749                                 log_error("Failed to create fifo %s: %m", i->path);
 750                                 return -errno;
 751                         }
 752
 753                         if (stat(i->path, &st) < 0) {
 754                                 log_error("stat(%s) failed: %m", i->path);
 755                                 return -errno;
 756                         }
 757
 758                         if (!S_ISFIFO(st.st_mode)) {
 759
 760                                 if (i->force) {
 761
 762                                         RUN_WITH_UMASK(0000) {
 763                                                 label_context_set(i->path, S_IFIFO);
 764                                                 r = mkfifo_atomic(i->path, i->mode);
 765                                                 label_context_clear();
 766                                         }
 767
 768                                         if (r < 0) {
 769                                                 log_error("Failed to create fifo %s: %s", i->path, strerror(-r));
 770                                                 return r;
 771                                         }
 772                                 } else {
 773                                         log_debug("%s is not a fifo.", i->path);
 774                                         return 0;
 775                                 }
 776                         }
 777                 }
 778
 779                 r = item_set_perms(i, i->path);
 780                 if (r < 0)
 781                         return r;
 782
 783                 break;
 784
 785         case CREATE_SYMLINK:
 786
 787                 label_context_set(i->path, S_IFLNK);
 788                 r = symlink(i->argument, i->path);
 789                 label_context_clear();
 790
 791                 if (r < 0) {
 792                         _cleanup_free_ char *x = NULL;
 793
 794                         if (errno != EEXIST) {
 795                                 log_error("symlink(%s, %s) failed: %m", i->argument, i->path);
 796                                 return -errno;
 797                         }
 798
 799                         r = readlink_malloc(i->path, &x);
 800                         if (r < 0 || !streq(i->argument, x)) {
 801
 802                                 if (i->force) {
 803                                         label_context_set(i->path, S_IFLNK);
 804                                         r = symlink_atomic(i->argument, i->path);
 805                                         label_context_clear();
 806
 807                                         if (r < 0) {
 808                                                 log_error("symlink(%s, %s) failed: %s", i->argument, i->path, strerror(-r));
 809                                                 return r;
 810                                         }
 811                                 } else {
 812                                         log_debug("%s is not a symlink or does not point to the correct path.", i->path);
 813                                         return 0;
 814                                 }
 815                         }
 816                 }
 817
 818                 break;
 819
 820         case CREATE_BLOCK_DEVICE:
 821         case CREATE_CHAR_DEVICE: {
 822                 mode_t file_type;
 823
 824                 if (have_effective_cap(CAP_MKNOD) == 0) {
 825                         /* In a container we lack CAP_MKNOD. We
 826                         shouldn't attempt to create the device node in
 827                         that case to avoid noise, and we don't support
 828                         virtualized devices in containers anyway. */
 829
 830                         log_debug("We lack CAP_MKNOD, skipping creation of device node %s.", i->path);
 831                         return 0;
 832                 }
 833
 834                 file_type = i->type == CREATE_BLOCK_DEVICE ? S_IFBLK : S_IFCHR;
 835
 836                 RUN_WITH_UMASK(0000) {
 837                         label_context_set(i->path, file_type);
 838                         r = mknod(i->path, i->mode | file_type, i->major_minor);
 839                         label_context_clear();
 840                 }
 841
 842                 if (r < 0) {
 843                         if (errno == EPERM) {
 844                                 log_debug("We lack permissions, possibly because of cgroup configuration; "
 845                                           "skipping creation of device node %s.", i->path);
 846                                 return 0;
 847                         }
 848
 849                         if (errno != EEXIST) {
 850                                 log_error("Failed to create device node %s: %m", i->path);
 851                                 return -errno;
 852                         }
 853
 854                         if (stat(i->path, &st) < 0) {
 855                                 log_error("stat(%s) failed: %m", i->path);
 856                                 return -errno;
 857                         }
 858
 859                         if ((st.st_mode & S_IFMT) != file_type) {
 860
 861                                 if (i->force) {
 862
 863                                         RUN_WITH_UMASK(0000) {
 864                                                 label_context_set(i->path, file_type);
 865                                                 r = mknod_atomic(i->path, i->mode | file_type, i->major_minor);
 866                                                 label_context_clear();
 867                                         }
 868
 869                                         if (r < 0) {
 870                                                 log_error("Failed to create device node %s: %s", i->path, strerror(-r));
 871                                                 return r;
 872                                         }
 873                                 } else {
 874                                         log_debug("%s is not a device node.", i->path);
 875                                         return 0;
 876                                 }
 877                         }
 878                 }
 879
 880                 r = item_set_perms(i, i->path);
 881                 if (r < 0)
 882                         return r;
 883
 884                 break;
 885         }
 886
 887         case ADJUST_MODE:
 888         case RELABEL_PATH:
 889
 890                 r = glob_item(i, item_set_perms);
 891                 if (r < 0)
 892                         return r;
 893                 break;
 894
 895         case RECURSIVE_RELABEL_PATH:
 896
 897                 r = glob_item(i, item_set_perms_recursive);
 898                 if (r < 0)
 899                         return r;
 900
 901                 break;
 902         }
 903
 904         log_debug("%s created successfully.", i->path);
 905
 906         return 0;
 907 }
 908
 909 static int remove_item_instance(Item *i, const char *instance) {
 910         int r;
 911
 912         assert(i);
 913
 914         switch (i->type) {
 915
 916         case CREATE_FILE:
 917         case TRUNCATE_FILE:
 918         case CREATE_DIRECTORY:
 919         case CREATE_FIFO:
 920         case CREATE_SYMLINK:
 921         case CREATE_BLOCK_DEVICE:
 922         case CREATE_CHAR_DEVICE:
 923         case IGNORE_PATH:
 924         case IGNORE_DIRECTORY_PATH:
 925         case ADJUST_MODE:
 926         case RELABEL_PATH:
 927         case RECURSIVE_RELABEL_PATH:
 928         case WRITE_FILE:
 929         case COPY_FILES:
 930                 break;
 931
 932         case REMOVE_PATH:
 933                 if (remove(instance) < 0 && errno != ENOENT) {
 934                         log_error("remove(%s): %m", instance);
 935                         return -errno;
 936                 }
 937
 938                 break;
 939
 940         case TRUNCATE_DIRECTORY:
 941         case RECURSIVE_REMOVE_PATH:
 942                 /* FIXME: we probably should use dir_cleanup() here
 943                  * instead of rm_rf() so that 'x' is honoured. */
 944                 r = rm_rf_dangerous(instance, false, i->type == RECURSIVE_REMOVE_PATH, false);
 945                 if (r < 0 && r != -ENOENT) {
 946                         log_error("rm_rf(%s): %s", instance, strerror(-r));
 947                         return r;
 948                 }
 949
 950                 break;
 951         }
 952
 953         return 0;
 954 }
 955
 956 static int remove_item(Item *i) {
 957         int r = 0;
 958
 959         assert(i);
 960
 961         switch (i->type) {
 962
 963         case CREATE_FILE:
 964         case TRUNCATE_FILE:
 965         case CREATE_DIRECTORY:
 966         case CREATE_FIFO:
 967         case CREATE_SYMLINK:
 968         case CREATE_CHAR_DEVICE:
 969         case CREATE_BLOCK_DEVICE:
 970         case IGNORE_PATH:
 971         case IGNORE_DIRECTORY_PATH:
 972         case ADJUST_MODE:
 973         case RELABEL_PATH:
 974         case RECURSIVE_RELABEL_PATH:
 975         case WRITE_FILE:
 976         case COPY_FILES:
 977                 break;
 978
 979         case REMOVE_PATH:
 980         case TRUNCATE_DIRECTORY:
 981         case RECURSIVE_REMOVE_PATH:
 982                 r = glob_item(i, remove_item_instance);
 983                 break;
 984         }
 985
 986         return r;
 987 }
 988
 989 static int clean_item_instance(Item *i, const char* instance) {
 990         _cleanup_closedir_ DIR *d = NULL;
 991         struct stat s, ps;
 992         bool mountpoint;
 993         int r;
 994         usec_t cutoff, n;
 995
 996         assert(i);
 997
 998         if (!i->age_set)
 999                 return 0;
1000
1001         n = now(CLOCK_REALTIME);
1002         if (n < i->age)
1003                 return 0;
1004
1005         cutoff = n - i->age;
1006
1007         d = opendir(instance);
1008         if (!d) {
1009                 if (errno == ENOENT || errno == ENOTDIR)
1010                         return 0;
1011
1012                 log_error("Failed to open directory %s: %m", i->path);
1013                 return -errno;
1014         }
1015
1016         if (fstat(dirfd(d), &s) < 0) {
1017                 log_error("stat(%s) failed: %m", i->path);
1018                 return -errno;
1019         }
1020
1021         if (!S_ISDIR(s.st_mode)) {
1022                 log_error("%s is not a directory.", i->path);
1023                 return -ENOTDIR;
1024         }
1025
1026         if (fstatat(dirfd(d), "..", &ps, AT_SYMLINK_NOFOLLOW) != 0) {
1027                 log_error("stat(%s/..) failed: %m", i->path);
1028                 return -errno;
1029         }
1030
1031         mountpoint = s.st_dev != ps.st_dev ||
1032                      (s.st_dev == ps.st_dev && s.st_ino == ps.st_ino);
1033
1034         r = dir_cleanup(i, instance, d, &s, cutoff, s.st_dev, mountpoint,
1035                         MAX_DEPTH, i->keep_first_level);
1036         return r;
1037 }
1038
1039 static int clean_item(Item *i) {
1040         int r = 0;
1041
1042         assert(i);
1043
1044         switch (i->type) {
1045         case CREATE_DIRECTORY:
1046         case TRUNCATE_DIRECTORY:
1047         case IGNORE_PATH:
1048         case COPY_FILES:
1049                 clean_item_instance(i, i->path);
1050                 break;
1051         case IGNORE_DIRECTORY_PATH:
1052                 r = glob_item(i, clean_item_instance);
1053                 break;
1054         default:
1055                 break;
1056         }
1057
1058         return r;
1059 }
1060
1061 static int process_item(Item *i) {
1062         int r, q, p;
1063         char prefix[PATH_MAX];
1064
1065         assert(i);
1066
1067         if (i->done)
1068                 return 0;
1069
1070         i->done = true;
1071
1072         PATH_FOREACH_PREFIX(prefix, i->path) {
1073                 Item *j;
1074
1075                 j = hashmap_get(items, prefix);
1076                 if (j)
1077                         process_item(j);
1078         }
1079
1080         r = arg_create ? create_item(i) : 0;
1081         q = arg_remove ? remove_item(i) : 0;
1082         p = arg_clean ? clean_item(i) : 0;
1083
1084         if (r < 0)
1085                 return r;
1086
1087         if (q < 0)
1088                 return q;
1089
1090         return p;
1091 }
1092
1093 static void item_free(Item *i) {
1094
1095         if (!i)
1096                 return;
1097
1098         free(i->path);
1099         free(i->argument);
1100         free(i);
1101 }
1102
1103 DEFINE_TRIVIAL_CLEANUP_FUNC(Item*, item_free);
1104
1105 static bool item_equal(Item *a, Item *b) {
1106         assert(a);
1107         assert(b);
1108
1109         if (!streq_ptr(a->path, b->path))
1110                 return false;
1111
1112         if (a->type != b->type)
1113                 return false;
1114
1115         if (a->uid_set != b->uid_set ||
1116             (a->uid_set && a->uid != b->uid))
1117             return false;
1118
1119         if (a->gid_set != b->gid_set ||
1120             (a->gid_set && a->gid != b->gid))
1121             return false;
1122
1123         if (a->mode_set != b->mode_set ||
1124             (a->mode_set && a->mode != b->mode))
1125             return false;
1126
1127         if (a->age_set != b->age_set ||
1128             (a->age_set && a->age != b->age))
1129             return false;
1130
1131         if ((a->type == CREATE_FILE ||
1132              a->type == TRUNCATE_FILE ||
1133              a->type == WRITE_FILE ||
1134              a->type == CREATE_SYMLINK ||
1135              a->type == COPY_FILES) &&
1136             !streq_ptr(a->argument, b->argument))
1137                 return false;
1138
1139         if ((a->type == CREATE_CHAR_DEVICE ||
1140              a->type == CREATE_BLOCK_DEVICE) &&
1141             a->major_minor != b->major_minor)
1142                 return false;
1143
1144         return true;
1145 }
1146
1147 static bool should_include_path(const char *path) {
1148         char **prefix;
1149
1150         STRV_FOREACH(prefix, arg_exclude_prefixes)
1151                 if (path_startswith(path, *prefix))
1152                         return false;
1153
1154         STRV_FOREACH(prefix, arg_include_prefixes)
1155                 if (path_startswith(path, *prefix))
1156                         return true;
1157
1158         /* no matches, so we should include this path only if we
1159          * have no whitelist at all */
1160         return strv_length(arg_include_prefixes) == 0;
1161 }
1162
1163 static int parse_line(const char *fname, unsigned line, const char *buffer) {
1164
1165         static const Specifier specifier_table[] = {
1166                 { 'm', specifier_machine_id, NULL },
1167                 { 'b', specifier_boot_id, NULL },
1168                 { 'H', specifier_host_name, NULL },
1169                 { 'v', specifier_kernel_release, NULL },
1170                 {}
1171         };
1172
1173         _cleanup_free_ char *action = NULL, *mode = NULL, *user = NULL, *group = NULL, *age = NULL, *path = NULL;
1174         _cleanup_(item_freep) Item *i = NULL;
1175         Item *existing;
1176         char type;
1177         Hashmap *h;
1178         int r, n = -1;
1179
1180         assert(fname);
1181         assert(line >= 1);
1182         assert(buffer);
1183
1184         r = sscanf(buffer,
1185                    "%ms %ms %ms %ms %ms %ms %n",
1186                    &action,
1187                    &path,
1188                    &mode,
1189                    &user,
1190                    &group,
1191                    &age,
1192                    &n);
1193         if (r < 2) {
1194                 log_error("[%s:%u] Syntax error.", fname, line);
1195                 return -EIO;
1196         }
1197
1198         if (isempty(action)) {
1199                 log_error("[%s:%u] Command too short '%s'.", fname, line, action);
1200                 return -EINVAL;
1201         }
1202
1203         if (strlen(action) > 1 && !in_charset(action+1, "!+")) {
1204                 log_error("[%s:%u] Unknown modifiers in command '%s'", fname, line, action);
1205                 return -EINVAL;
1206         }
1207
1208         if (strchr(action+1, '!') && !arg_boot)
1209                 return 0;
1210
1211         type = action[0];
1212
1213         i = new0(Item, 1);
1214         if (!i)
1215                 return log_oom();
1216
1217         i->force = !!strchr(action+1, '+');
1218
1219         r = specifier_printf(path, specifier_table, NULL, &i->path);
1220         if (r < 0) {
1221                 log_error("[%s:%u] Failed to replace specifiers: %s", fname, line, path);
1222                 return r;
1223         }
1224
1225         if (n >= 0)  {
1226                 n += strspn(buffer+n, WHITESPACE);
1227                 if (buffer[n] != 0 && (buffer[n] != '-' || buffer[n+1] != 0)) {
1228                         i->argument = unquote(buffer+n, "\"");
1229                         if (!i->argument)
1230                                 return log_oom();
1231                 }
1232         }
1233
1234         switch (type) {
1235
1236         case CREATE_FILE:
1237         case TRUNCATE_FILE:
1238         case CREATE_DIRECTORY:
1239         case TRUNCATE_DIRECTORY:
1240         case CREATE_FIFO:
1241         case IGNORE_PATH:
1242         case IGNORE_DIRECTORY_PATH:
1243         case REMOVE_PATH:
1244         case RECURSIVE_REMOVE_PATH:
1245         case ADJUST_MODE:
1246         case RELABEL_PATH:
1247         case RECURSIVE_RELABEL_PATH:
1248                 break;
1249
1250         case CREATE_SYMLINK:
1251                 if (!i->argument) {
1252                         i->argument = strappend("/usr/share/factory", i->path);
1253                         if (!i->argument)
1254                                 return log_oom();
1255                 }
1256                 break;
1257
1258         case WRITE_FILE:
1259                 if (!i->argument) {
1260                         log_error("[%s:%u] Write file requires argument.", fname, line);
1261                         return -EBADMSG;
1262                 }
1263                 break;
1264
1265         case COPY_FILES:
1266                 if (!i->argument) {
1267                         i->argument = strappend("/usr/share/factory", i->path);
1268                         if (!i->argument)
1269                                 return log_oom();
1270                 }
1271
1272                 if (!path_is_absolute(i->argument)) {
1273                         log_error("[%s:%u] Source path is not absolute.", fname, line);
1274                         return -EBADMSG;
1275                 }
1276
1277                 path_kill_slashes(i->argument);
1278                 break;
1279
1280         case CREATE_CHAR_DEVICE:
1281         case CREATE_BLOCK_DEVICE: {
1282                 unsigned major, minor;
1283
1284                 if (!i->argument) {
1285                         log_error("[%s:%u] Device file requires argument.", fname, line);
1286                         return -EBADMSG;
1287                 }
1288
1289                 if (sscanf(i->argument, "%u:%u", &major, &minor) != 2) {
1290                         log_error("[%s:%u] Can't parse device file major/minor '%s'.", fname, line, i->argument);
1291                         return -EBADMSG;
1292                 }
1293
1294                 i->major_minor = makedev(major, minor);
1295                 break;
1296         }
1297
1298         default:
1299                 log_error("[%s:%u] Unknown command type '%c'.", fname, line, type);
1300                 return -EBADMSG;
1301         }
1302
1303         i->type = type;
1304
1305         if (!path_is_absolute(i->path)) {
1306                 log_error("[%s:%u] Path '%s' not absolute.", fname, line, i->path);
1307                 return -EBADMSG;
1308         }
1309
1310         path_kill_slashes(i->path);
1311
1312         if (!should_include_path(i->path))
1313                 return 0;
1314
1315         if (arg_root) {
1316                 char *p;
1317
1318                 p = strappend(arg_root, i->path);
1319                 if (!p)
1320                         return log_oom();
1321
1322                 free(i->path);
1323                 i->path = p;
1324         }
1325
1326         if (user && !streq(user, "-")) {
1327                 const char *u = user;
1328
1329                 r = get_user_creds(&u, &i->uid, NULL, NULL, NULL);
1330                 if (r < 0) {
1331                         log_error("[%s:%u] Unknown user '%s'.", fname, line, user);
1332                         return r;
1333                 }
1334
1335                 i->uid_set = true;
1336         }
1337
1338         if (group && !streq(group, "-")) {
1339                 const char *g = group;
1340
1341                 r = get_group_creds(&g, &i->gid);
1342                 if (r < 0) {
1343                         log_error("[%s:%u] Unknown group '%s'.", fname, line, group);
1344                         return r;
1345                 }
1346
1347                 i->gid_set = true;
1348         }
1349
1350         if (mode && !streq(mode, "-")) {
1351                 const char *mm = mode;
1352                 unsigned m;
1353
1354                 if (*mm == '~') {
1355                         i->mask_perms = true;
1356                         mm++;
1357                 }
1358
1359                 if (sscanf(mm, "%o", &m) != 1) {
1360                         log_error("[%s:%u] Invalid mode '%s'.", fname, line, mode);
1361                         return -ENOENT;
1362                 }
1363
1364                 i->mode = m;
1365                 i->mode_set = true;
1366         } else
1367                 i->mode =
1368                         i->type == CREATE_DIRECTORY ||
1369                         i->type == TRUNCATE_DIRECTORY ? 0755 : 0644;
1370
1371         if (age && !streq(age, "-")) {
1372                 const char *a = age;
1373
1374                 if (*a == '~') {
1375                         i->keep_first_level = true;
1376                         a++;
1377                 }
1378
1379                 if (parse_sec(a, &i->age) < 0) {
1380                         log_error("[%s:%u] Invalid age '%s'.", fname, line, age);
1381                         return -EBADMSG;
1382                 }
1383
1384                 i->age_set = true;
1385         }
1386
1387         h = needs_glob(i->type) ? globs : items;
1388
1389         existing = hashmap_get(h, i->path);
1390         if (existing) {
1391
1392                 /* Two identical items are fine */
1393                 if (!item_equal(existing, i))
1394                         log_warning("Two or more conflicting lines for %s configured, ignoring.", i->path);
1395
1396                 return 0;
1397         }
1398
1399         r = hashmap_put(h, i->path, i);
1400         if (r < 0) {
1401                 log_error("Failed to insert item %s: %s", i->path, strerror(-r));
1402                 return r;
1403         }
1404
1405         i = NULL; /* avoid cleanup */
1406
1407         return 0;
1408 }
1409
1410 static void help(void) {
1411         printf("%s [OPTIONS...] [CONFIGURATION FILE...]\n\n"
1412                "Creates, deletes and cleans up volatile and temporary files and directories.\n\n"
1413                "  -h --help                 Show this help\n"
1414                "     --version              Show package version\n"
1415                "     --create               Create marked files/directories\n"
1416                "     --clean                Clean up marked directories\n"
1417                "     --remove               Remove marked files/directories\n"
1418                "     --boot                 Execute actions only safe at boot\n"
1419                "     --prefix=PATH          Only apply rules that apply to paths with the specified prefix\n"
1420                "     --exclude-prefix=PATH  Ignore rules that apply to paths with the specified prefix\n"
1421                "     --root=PATH            Operate on an alternate filesystem root\n",
1422                program_invocation_short_name);
1423 }
1424
1425 static int parse_argv(int argc, char *argv[]) {
1426
1427         enum {
1428                 ARG_VERSION = 0x100,
1429                 ARG_CREATE,
1430                 ARG_CLEAN,
1431                 ARG_REMOVE,
1432                 ARG_BOOT,
1433                 ARG_PREFIX,
1434                 ARG_EXCLUDE_PREFIX,
1435                 ARG_ROOT,
1436         };
1437
1438         static const struct option options[] = {
1439                 { "help",           no_argument,         NULL, 'h'                },
1440                 { "version",        no_argument,         NULL, ARG_VERSION        },
1441                 { "create",         no_argument,         NULL, ARG_CREATE         },
1442                 { "clean",          no_argument,         NULL, ARG_CLEAN          },
1443                 { "remove",         no_argument,         NULL, ARG_REMOVE         },
1444                 { "boot",           no_argument,         NULL, ARG_BOOT           },
1445                 { "prefix",         required_argument,   NULL, ARG_PREFIX         },
1446                 { "exclude-prefix", required_argument,   NULL, ARG_EXCLUDE_PREFIX },
1447                 { "root",           required_argument,   NULL, ARG_ROOT           },
1448                 {}
1449         };
1450
1451         int c;
1452
1453         assert(argc >= 0);
1454         assert(argv);
1455
1456         while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0)
1457
1458                 switch (c) {
1459
1460                 case 'h':
1461                         help();
1462                         return 0;
1463
1464                 case ARG_VERSION:
1465                         puts(PACKAGE_STRING);
1466                         puts(SYSTEMD_FEATURES);
1467                         return 0;
1468
1469                 case ARG_CREATE:
1470                         arg_create = true;
1471                         break;
1472
1473                 case ARG_CLEAN:
1474                         arg_clean = true;
1475                         break;
1476
1477                 case ARG_REMOVE:
1478                         arg_remove = true;
1479                         break;
1480
1481                 case ARG_BOOT:
1482                         arg_boot = true;
1483                         break;
1484
1485                 case ARG_PREFIX:
1486                         if (strv_push(&arg_include_prefixes, optarg) < 0)
1487                                 return log_oom();
1488                         break;
1489
1490                 case ARG_EXCLUDE_PREFIX:
1491                         if (strv_push(&arg_exclude_prefixes, optarg) < 0)
1492                                 return log_oom();
1493                         break;
1494
1495                 case ARG_ROOT:
1496                         free(arg_root);
1497                         arg_root = path_make_absolute_cwd(optarg);
1498                         if (!arg_root)
1499                                 return log_oom();
1500
1501                         path_kill_slashes(arg_root);
1502                         break;
1503
1504                 case '?':
1505                         return -EINVAL;
1506
1507                 default:
1508                         assert_not_reached("Unhandled option");
1509                 }
1510
1511         if (!arg_clean && !arg_create && !arg_remove) {
1512                 log_error("You need to specify at least one of --clean, --create or --remove.");
1513                 return -EINVAL;
1514         }
1515
1516         return 1;
1517 }
1518
1519 static int read_config_file(const char *fn, bool ignore_enoent) {
1520         _cleanup_fclose_ FILE *f = NULL;
1521         char line[LINE_MAX];
1522         Iterator iterator;
1523         unsigned v = 0;
1524         Item *i;
1525         int r;
1526
1527         assert(fn);
1528
1529         r = search_and_fopen_nulstr(fn, "re", arg_root, conf_file_dirs, &f);
1530         if (r < 0) {
1531                 if (ignore_enoent && r == -ENOENT)
1532                         return 0;
1533
1534                 log_error("Failed to open '%s', ignoring: %s", fn, strerror(-r));
1535                 return r;
1536         }
1537
1538         FOREACH_LINE(line, f, break) {
1539                 char *l;
1540                 int k;
1541
1542                 v++;
1543
1544                 l = strstrip(line);
1545                 if (*l == '#' || *l == 0)
1546                         continue;
1547
1548                 k = parse_line(fn, v, l);
1549                 if (k < 0 && r == 0)
1550                         r = k;
1551         }
1552
1553         /* we have to determine age parameter for each entry of type X */
1554         HASHMAP_FOREACH(i, globs, iterator) {
1555                 Iterator iter;
1556                 Item *j, *candidate_item = NULL;
1557
1558                 if (i->type != IGNORE_DIRECTORY_PATH)
1559                         continue;
1560
1561                 HASHMAP_FOREACH(j, items, iter) {
1562                         if (j->type != CREATE_DIRECTORY && j->type != TRUNCATE_DIRECTORY)
1563                                 continue;
1564
1565                         if (path_equal(j->path, i->path)) {
1566                                 candidate_item = j;
1567                                 break;
1568                         }
1569
1570                         if ((!candidate_item && path_startswith(i->path, j->path)) ||
1571                             (candidate_item && path_startswith(j->path, candidate_item->path) && (fnmatch(i->path, j->path, FNM_PATHNAME | FNM_PERIOD) == 0)))
1572                                 candidate_item = j;
1573                 }
1574
1575                 if (candidate_item) {
1576                         i->age = candidate_item->age;
1577                         i->age_set = true;
1578                 }
1579         }
1580
1581         if (ferror(f)) {
1582                 log_error("Failed to read from file %s: %m", fn);
1583                 if (r == 0)
1584                         r = -EIO;
1585         }
1586
1587         return r;
1588 }
1589
1590 int main(int argc, char *argv[]) {
1591         int r, k;
1592         Item *i;
1593         Iterator iterator;
1594
1595         r = parse_argv(argc, argv);
1596         if (r <= 0)
1597                 goto finish;
1598
1599         log_set_target(LOG_TARGET_AUTO);
1600         log_parse_environment();
1601         log_open();
1602
1603         umask(0022);
1604
1605         label_init(NULL);
1606
1607         items = hashmap_new(string_hash_func, string_compare_func);
1608         globs = hashmap_new(string_hash_func, string_compare_func);
1609
1610         if (!items || !globs) {
1611                 r = log_oom();
1612                 goto finish;
1613         }
1614
1615         r = 0;
1616
1617         if (optind < argc) {
1618                 int j;
1619
1620                 for (j = optind; j < argc; j++) {
1621                         k = read_config_file(argv[j], false);
1622                         if (k < 0 && r == 0)
1623                                 r = k;
1624                 }
1625
1626         } else {
1627                 _cleanup_strv_free_ char **files = NULL;
1628                 char **f;
1629
1630                 r = conf_files_list_nulstr(&files, ".conf", arg_root, conf_file_dirs);
1631                 if (r < 0) {
1632                         log_error("Failed to enumerate tmpfiles.d files: %s", strerror(-r));
1633                         goto finish;
1634                 }
1635
1636                 STRV_FOREACH(f, files) {
1637                         k = read_config_file(*f, true);
1638                         if (k < 0 && r == 0)
1639                                 r = k;
1640                 }
1641         }
1642
1643         HASHMAP_FOREACH(i, globs, iterator)
1644                 process_item(i);
1645
1646         HASHMAP_FOREACH(i, items, iterator)
1647                 process_item(i);
1648
1649 finish:
1650         while ((i = hashmap_steal_first(items)))
1651                 item_free(i);
1652
1653         while ((i = hashmap_steal_first(globs)))
1654                 item_free(i);
1655
1656         hashmap_free(items);
1657         hashmap_free(globs);
1658
1659         free(arg_include_prefixes);
1660         free(arg_exclude_prefixes);
1661         free(arg_root);
1662
1663         set_free_free(unix_sockets);
1664
1665         label_finish();
1666
1667         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
1668 }