audit: improve the audit messages we generate

[elogind.git] / src / core / manager.c

diff --git a/src/core/manager.c b/src/core/manager.c
index 859631d3f6c6f2c1cb5da56f0a41d78ebbbdf564..ef1e3eac5fba78e20d3f5127b3bb4c3098689e5d 100644 (file)
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -1189,15 +1189,11 @@ int manager_add_job(Manager *m, JobType type, Unit *unit, JobMode mode, bool ove
         assert(unit);
         assert(mode < _JOB_MODE_MAX);
 
-        if (mode == JOB_ISOLATE && type != JOB_START) {
-                sd_bus_error_setf(e, SD_BUS_ERROR_INVALID_ARGS, "Isolate is only valid for start.");
-                return -EINVAL;
-        }
+        if (mode == JOB_ISOLATE && type != JOB_START)
+                return sd_bus_error_setf(e, SD_BUS_ERROR_INVALID_ARGS, "Isolate is only valid for start.");
 
-        if (mode == JOB_ISOLATE && !unit->allow_isolate) {
-                sd_bus_error_setf(e, BUS_ERROR_NO_ISOLATION, "Operation refused, unit may not be isolated.");
-                return -EPERM;
-        }
+        if (mode == JOB_ISOLATE && !unit->allow_isolate)
+                return sd_bus_error_setf(e, BUS_ERROR_NO_ISOLATION, "Operation refused, unit may not be isolated.");
 
         log_debug_unit(unit->id,
                        "Trying to enqueue job %s/%s/%s", unit->id,
@@ -2070,6 +2066,7 @@ void manager_send_unit_audit(Manager *m, Unit *u, int type, bool success) {
 
 #ifdef HAVE_AUDIT
         _cleanup_free_ char *p = NULL;
+        const char *msg;
         int audit_fd;
 
         audit_fd = get_audit_fd();
@@ -2089,17 +2086,18 @@ void manager_send_unit_audit(Manager *m, Unit *u, int type, bool success) {
 
         p = unit_name_to_prefix_and_instance(u->id);
         if (!p) {
-                log_error_unit(u->id,
-                               "Failed to allocate unit name for audit message: %s", strerror(ENOMEM));
+                log_oom();
                 return;
         }
 
-        if (audit_log_user_comm_message(audit_fd, type, "", p, NULL, NULL, NULL, success) < 0) {
-                if (errno == EPERM) {
+        msg = strappenda("unit=", p);
+
+        if (audit_log_user_comm_message(audit_fd, type, msg, "systemd", NULL, NULL, NULL, success) < 0) {
+                if (errno == EPERM)
                         /* We aren't allowed to send audit messages?
                          * Then let's not retry again. */
                         close_audit_fd();
-                } else
+                else
                         log_warning("Failed to send audit message: %m");
         }
 #endif
@@ -2584,45 +2582,13 @@ bool manager_unit_inactive_or_pending(Manager *m, const char *name) {
         return unit_inactive_or_pending(u);
 }
 
-void manager_check_finished(Manager *m) {
+static void manager_notify_finished(Manager *m) {
         char userspace[FORMAT_TIMESPAN_MAX], initrd[FORMAT_TIMESPAN_MAX], kernel[FORMAT_TIMESPAN_MAX], sum[FORMAT_TIMESPAN_MAX];
         usec_t firmware_usec, loader_usec, kernel_usec, initrd_usec, userspace_usec, total_usec;
-        Unit *u = NULL;
-        Iterator i;
-
-        assert(m);
-
-        if (m->n_running_jobs == 0)
-                m->jobs_in_progress_event_source = sd_event_source_unref(m->jobs_in_progress_event_source);
-
-        if (hashmap_size(m->jobs) > 0) {
-
-                if (m->jobs_in_progress_event_source)
-                        sd_event_source_set_time(m->jobs_in_progress_event_source, now(CLOCK_MONOTONIC) + JOBS_IN_PROGRESS_WAIT_USEC);
-
-                return;
-        }
 
-        manager_flip_auto_status(m, false);
-
-        /* Notify Type=idle units that we are done now */
-        m->idle_pipe_event_source = sd_event_source_unref(m->idle_pipe_event_source);
-        manager_close_idle_pipe(m);
-
-        /* Turn off confirm spawn now */
-        m->confirm_spawn = false;
-
-        /* No need to update ask password status when we're going non-interactive */
-        manager_close_ask_password(m);
-
-        /* This is no longer the first boot */
-        manager_set_first_boot(m, false);
-
-        if (dual_timestamp_is_set(&m->finish_timestamp))
+        if (m->test_run)
                 return;
 
-        dual_timestamp_get(&m->finish_timestamp);
-
         if (m->running_as == SYSTEMD_SYSTEM && detect_container(NULL) <= 0) {
 
                 /* Note that m->kernel_usec.monotonic is always at 0,
@@ -2677,10 +2643,6 @@ void manager_check_finished(Manager *m) {
                            NULL);
         }
 
-        SET_FOREACH(u, m->startup_units, i)
-                if (u->cgroup_path)
-                        cgroup_context_apply(unit_get_cgroup_context(u), unit_get_cgroup_mask(u), u->cgroup_path, manager_state(m));
-
         bus_manager_send_finished(m, firmware_usec, loader_usec, kernel_usec, initrd_usec, userspace_usec, total_usec);
 
         sd_notifyf(false,
@@ -2689,6 +2651,50 @@ void manager_check_finished(Manager *m) {
                    format_timespan(sum, sizeof(sum), total_usec, USEC_PER_MSEC));
 }
 
+void manager_check_finished(Manager *m) {
+        Unit *u = NULL;
+        Iterator i;
+
+        assert(m);
+
+        if (m->n_running_jobs == 0)
+                m->jobs_in_progress_event_source = sd_event_source_unref(m->jobs_in_progress_event_source);
+
+        if (hashmap_size(m->jobs) > 0) {
+
+                if (m->jobs_in_progress_event_source)
+                        sd_event_source_set_time(m->jobs_in_progress_event_source, now(CLOCK_MONOTONIC) + JOBS_IN_PROGRESS_WAIT_USEC);
+
+                return;
+        }
+
+        manager_flip_auto_status(m, false);
+
+        /* Notify Type=idle units that we are done now */
+        m->idle_pipe_event_source = sd_event_source_unref(m->idle_pipe_event_source);
+        manager_close_idle_pipe(m);
+
+        /* Turn off confirm spawn now */
+        m->confirm_spawn = false;
+
+        /* No need to update ask password status when we're going non-interactive */
+        manager_close_ask_password(m);
+
+        /* This is no longer the first boot */
+        manager_set_first_boot(m, false);
+
+        if (dual_timestamp_is_set(&m->finish_timestamp))
+                return;
+
+        dual_timestamp_get(&m->finish_timestamp);
+
+        manager_notify_finished(m);
+
+        SET_FOREACH(u, m->startup_units, i)
+                if (u->cgroup_path)
+                        cgroup_context_apply(unit_get_cgroup_context(u), unit_get_cgroup_mask(u), u->cgroup_path, manager_state(m));
+}
+
 static int create_generator_dir(Manager *m, char **generator, const char *name) {
         char *p;
         int r;
@@ -2944,7 +2950,7 @@ static bool manager_get_show_status(Manager *m, StatusType type) {
                 return false;
 
         /* If we cannot find out the status properly, just proceed. */
-        if (manager_check_ask_password(m) > 0)
+        if (type != STATUS_TYPE_EMERGENCY && manager_check_ask_password(m) > 0)
                 return false;
 
         if (m->show_status > 0)