#include <sys/signalfd.h>
#include <unistd.h>
#include <fcntl.h>
+#include <sys/acl.h>
+#include <acl/libacl.h>
#include "hashmap.h"
-#include "journal-private.h"
+#include "journal-file.h"
#include "sd-daemon.h"
#include "socket-util.h"
+#include "acl-util.h"
typedef struct Server {
int syslog_fd;
int epoll_fd;
int signal_fd;
+ JournalFile *runtime_journal;
JournalFile *system_journal;
Hashmap *user_journals;
} Server;
+static void fix_perms(JournalFile *f, uid_t uid) {
+ acl_t acl;
+ acl_entry_t entry;
+ acl_permset_t permset;
+ int r;
+
+ assert(f);
+
+ r = fchmod_and_fchown(f->fd, 0640, 0, 0);
+ if (r < 0)
+ log_warning("Failed to fix access mode/rights on %s, ignoring: %s", f->path, strerror(-r));
+
+ if (uid <= 0)
+ return;
+
+ acl = acl_get_fd(f->fd);
+ if (!acl) {
+ log_warning("Failed to read ACL on %s, ignoring: %m", f->path);
+ return;
+ }
+
+ r = acl_find_uid(acl, uid, &entry);
+ if (r <= 0) {
+
+ if (acl_create_entry(&acl, &entry) < 0 ||
+ acl_set_tag_type(entry, ACL_USER) < 0 ||
+ acl_set_qualifier(entry, &uid) < 0) {
+ log_warning("Failed to patch ACL on %s, ignoring: %m", f->path);
+ goto finish;
+ }
+ }
+
+ if (acl_get_permset(entry, &permset) < 0 ||
+ acl_add_perm(permset, ACL_READ) < 0 ||
+ acl_calc_mask(&acl) < 0) {
+ log_warning("Failed to patch ACL on %s, ignoring: %m", f->path);
+ goto finish;
+ }
+
+ if (acl_set_fd(f->fd, acl) < 0)
+ log_warning("Failed to set ACL on %s, ignoring: %m", f->path);
+
+finish:
+ acl_free(acl);
+}
+
+static JournalFile* find_journal(Server *s, uid_t uid) {
+ char *p;
+ int r;
+ JournalFile *f;
+
+ assert(s);
+
+ /* We split up user logs only on /var, not on /run */
+ if (!s->system_journal)
+ return s->runtime_journal;
+
+ if (uid <= 0)
+ return s->system_journal;
+
+ f = hashmap_get(s->user_journals, UINT32_TO_PTR(uid));
+ if (f)
+ return f;
+
+ if (asprintf(&p, "/var/log/journal/%lu.journal", (unsigned long) uid) < 0)
+ return s->system_journal;
+
+ r = journal_file_open(p, O_RDWR|O_CREAT, 0640, &f);
+ free(p);
+
+ if (r < 0)
+ return s->system_journal;
+
+ fix_perms(f, uid);
+
+ r = hashmap_put(s->user_journals, UINT32_TO_PTR(uid), f);
+ if (r < 0) {
+ journal_file_close(f);
+ return s->system_journal;
+ }
+
+ return f;
+}
+
static void process_message(Server *s, const char *buf, struct ucred *ucred, struct timeval *tv) {
char *message = NULL, *pid = NULL, *uid = NULL, *gid = NULL,
*source_time = NULL, *boot_id = NULL, *machine_id = NULL,
*audit_session = NULL, *audit_loginuid = NULL,
*syslog_priority = NULL, *syslog_facility = NULL,
*exe = NULL;
- dual_timestamp ts;
struct iovec iovec[15];
unsigned n = 0;
char idbuf[33];
int r;
char *t;
int priority = LOG_USER | LOG_INFO;
-
- dual_timestamp_get(&ts);
+ uid_t loginuid = 0;
+ JournalFile *f;
parse_syslog_priority((char**) &buf, &priority);
skip_syslog_date((char**) &buf);
if (ucred) {
uint32_t session;
- uid_t loginuid;
if (asprintf(&pid, "PID=%lu", (unsigned long) ucred->pid) >= 0)
IOVEC_SET_STRING(iovec[n++], pid);
IOVEC_SET_STRING(iovec[n++], source_time);
}
+ /* Note that strictly speaking storing the boot id here is
+ * redundant since the entry includes this in-line
+ * anyway. However, we need this indexed, too. */
r = sd_id128_get_boot(&id);
if (r >= 0)
if (asprintf(&boot_id, "BOOT_ID=%s", sd_id128_to_string(id, idbuf)) >= 0)
free(t);
}
- r = journal_file_append_entry(s->system_journal, &ts, iovec, n, NULL, NULL);
- if (r < 0)
- log_error("Failed to write entry: %s", strerror(-r));
+ f = find_journal(s, loginuid);
+ if (!f)
+ log_warning("Dropping message, as we can't find a place to store the data.");
+ else {
+ r = journal_file_append_entry(f, NULL, iovec, n, NULL, NULL);
+ if (r < 0)
+ log_error("Failed to write entry, ignoring: %s", strerror(-r));
+ }
free(message);
free(pid);
log_debug("Received SIG%s", signal_to_string(sfsi.ssi_signo));
return 0;
- } else {
+ }
+
+ if (ev->data.fd == s->syslog_fd) {
for (;;) {
char buf[LINE_MAX+1];
struct msghdr msghdr;
process_message(s, strstrip(buf), ucred, tv);
}
+
+ return 1;
}
- return 1;
+ log_error("Unknown event.");
+ return 0;
}
-
-static int open_system_journal(JournalFile **f) {
+static int system_journal_open(Server *s) {
int r;
+ char *fn;
+ sd_id128_t machine;
+ char ids[33];
- r = journal_file_open(NULL, "/var/log/journal/system.journal", O_RDWR|O_CREAT, 0644, f);
- if (r == -ENOENT) {
- mkdir_p("/run/log/journal", 0755);
+ r = sd_id128_get_machine(&machine);
+ if (r < 0)
+ return r;
- r = journal_file_open(NULL, "/run/log/journal/system.journal", O_RDWR|O_CREAT, 0644, f);
+ /* First try to create the machine path, but not the prefix */
+ fn = join("/var/log/journal/", sd_id128_to_string(machine, ids), NULL);
+ if (!fn)
+ return -ENOMEM;
+ (void) mkdir(fn, 0755);
+ free(fn);
+
+ /* The create the system journal file */
+ fn = join("/var/log/journal/", ids, "/system.journal", NULL);
+ if (!fn)
+ return -ENOMEM;
+
+ r = journal_file_open(fn, O_RDWR|O_CREAT, 0640, &s->system_journal);
+ free(fn);
+
+ if (r >= 0)
+ fix_perms(s->system_journal, 0);
+ else if (r == -ENOENT) {
+
+ /* /var didn't work, so try /run, but this time we
+ * create the prefix too */
+ fn = join("/run/log/journal/", ids, NULL);
+ if (!fn)
+ return -ENOMEM;
+ (void) mkdir_p(fn, 0755);
+ free(fn);
+
+ /* Then create the runtime journal file */
+ fn = join("/run/log/journal/", ids, "/system.journal", NULL);
+ if (!fn)
+ return -ENOMEM;
+ r = journal_file_open(fn, O_RDWR|O_CREAT, 0640, &s->runtime_journal);
+ free(fn);
+
+ if (r >= 0)
+ fix_perms(s->runtime_journal, 0);
}
- return r;
+ if (r < 0 && r != -ENOENT) {
+ log_error("Failed to open journal: %s", strerror(-r));
+ return r;
+ }
+
+ return 0;
}
static int server_init(Server *s) {
return -ENOMEM;
}
- r = open_system_journal(&s->system_journal);
- if (r < 0) {
- log_error("Failed to open journal: %s", strerror(-r));
+ r = system_journal_open(s);
+ if (r < 0)
return r;
- }
assert_se(sigemptyset(&mask) == 0);
sigset_add_many(&mask, SIGINT, SIGTERM, -1);
if (s->system_journal)
journal_file_close(s->system_journal);
+ if (s->runtime_journal)
+ journal_file_close(s->runtime_journal);
+
while ((f = hashmap_steal_first(s->user_journals)))
journal_file_close(f);
return EXIT_FAILURE;
}
- log_set_target(LOG_TARGET_AUTO);
+ log_set_target(LOG_TARGET_CONSOLE);
log_parse_environment();
log_open();
~ianmdlvl / elogind.git / blobdiff