chiark / gitweb /
selinux: use setcon() instead of reexec to apply selinux policy
[elogind.git] / src / main.c
index 6d1fd7d55d834f5dca74e38e4416c1f26948f535..40d03ca792bff5ead95587a219d040f299e063bc 100644 (file)
@@ -51,6 +51,7 @@
 #include "label.h"
 #include "build.h"
 #include "strv.h"
+#include "def.h"
 
 static enum {
         ACTION_RUN,
@@ -168,7 +169,7 @@ _noreturn_ static void crash(int sig) {
                         _exit(1);
                 }
 
-                log_info("Successfully spawned crash shall as pid %lu.", (unsigned long) pid);
+                log_info("Successfully spawned crash shell as pid %lu.", (unsigned long) pid);
         }
 
         log_info("Freezing execution.");
@@ -202,7 +203,7 @@ static int console_setup(bool do_reset) {
                 return -tty_fd;
         }
 
-        if ((r = reset_terminal(tty_fd)) < 0)
+        if ((r = reset_terminal_fd(tty_fd)) < 0)
                 log_error("Failed to reset /dev/console: %s", strerror(-r));
 
         close_nointr_nofail(tty_fd);
@@ -226,6 +227,7 @@ static int parse_proc_cmdline_word(const char *word) {
 
         static const char * const rlmap[] = {
                 "emergency", SPECIAL_EMERGENCY_TARGET,
+                "-b",        SPECIAL_EMERGENCY_TARGET,
                 "single",    SPECIAL_RESCUE_TARGET,
                 "-s",        SPECIAL_RESCUE_TARGET,
                 "s",         SPECIAL_RESCUE_TARGET,
@@ -371,6 +373,7 @@ static int config_parse_level(
                 unsigned line,
                 const char *section,
                 const char *lvalue,
+                int ltype,
                 const char *rvalue,
                 void *data,
                 void *userdata) {
@@ -388,6 +391,7 @@ static int config_parse_target(
                 unsigned line,
                 const char *section,
                 const char *lvalue,
+                int ltype,
                 const char *rvalue,
                 void *data,
                 void *userdata) {
@@ -405,6 +409,7 @@ static int config_parse_color(
                 unsigned line,
                 const char *section,
                 const char *lvalue,
+                int ltype,
                 const char *rvalue,
                 void *data,
                 void *userdata) {
@@ -422,6 +427,7 @@ static int config_parse_location(
                 unsigned line,
                 const char *section,
                 const char *lvalue,
+                int ltype,
                 const char *rvalue,
                 void *data,
                 void *userdata) {
@@ -439,6 +445,7 @@ static int config_parse_cpu_affinity(
                 unsigned line,
                 const char *section,
                 const char *lvalue,
+                int ltype,
                 const char *rvalue,
                 void *data,
                 void *userdata) {
@@ -492,24 +499,24 @@ static DEFINE_CONFIG_PARSE_ENUM(config_parse_output, exec_output, ExecOutput, "F
 static int parse_config_file(void) {
 
         const ConfigItem items[] = {
-                { "LogLevel",              config_parse_level,        NULL,                     "Manager" },
-                { "LogTarget",             config_parse_target,       NULL,                     "Manager" },
-                { "LogColor",              config_parse_color,        NULL,                     "Manager" },
-                { "LogLocation",           config_parse_location,     NULL,                     "Manager" },
-                { "DumpCore",              config_parse_bool,         &arg_dump_core,           "Manager" },
-                { "CrashShell",            config_parse_bool,         &arg_crash_shell,         "Manager" },
-                { "ShowStatus",            config_parse_bool,         &arg_show_status,         "Manager" },
+                { "LogLevel",              config_parse_level,        0, NULL,                     "Manager" },
+                { "LogTarget",             config_parse_target,       0, NULL,                     "Manager" },
+                { "LogColor",              config_parse_color,        0, NULL,                     "Manager" },
+                { "LogLocation",           config_parse_location,     0, NULL,                     "Manager" },
+                { "DumpCore",              config_parse_bool,         0, &arg_dump_core,           "Manager" },
+                { "CrashShell",            config_parse_bool,         0, &arg_crash_shell,         "Manager" },
+                { "ShowStatus",            config_parse_bool,         0, &arg_show_status,         "Manager" },
 #ifdef HAVE_SYSV_COMPAT
-                { "SysVConsole",           config_parse_bool,         &arg_sysv_console,        "Manager" },
+                { "SysVConsole",           config_parse_bool,         0, &arg_sysv_console,        "Manager" },
 #endif
-                { "CrashChVT",             config_parse_int,          &arg_crash_chvt,          "Manager" },
-                { "CPUAffinity",           config_parse_cpu_affinity, NULL,                     "Manager" },
-                { "MountAuto",             config_parse_bool,         &arg_mount_auto,          "Manager" },
-                { "SwapAuto",              config_parse_bool,         &arg_swap_auto,           "Manager" },
-                { "DefaultControllers",    config_parse_strv,         &arg_default_controllers, "Manager" },
-                { "DefaultStandardOutput", config_parse_output,       &arg_default_std_output,  "Manager" },
-                { "DefaultStandardError",  config_parse_output,       &arg_default_std_error,   "Manager" },
-                { NULL, NULL, NULL, NULL }
+                { "CrashChVT",             config_parse_int,          0, &arg_crash_chvt,          "Manager" },
+                { "CPUAffinity",           config_parse_cpu_affinity, 0, NULL,                     "Manager" },
+                { "MountAuto",             config_parse_bool,         0, &arg_mount_auto,          "Manager" },
+                { "SwapAuto",              config_parse_bool,         0, &arg_swap_auto,           "Manager" },
+                { "DefaultControllers",    config_parse_strv,         0, &arg_default_controllers, "Manager" },
+                { "DefaultStandardOutput", config_parse_output,       0, &arg_default_std_output,  "Manager" },
+                { "DefaultStandardError",  config_parse_output,       0, &arg_default_std_error,   "Manager" },
+                { NULL, NULL, 0, NULL, NULL }
         };
 
         static const char * const sections[] = {
@@ -544,6 +551,11 @@ static int parse_proc_cmdline(void) {
         int r;
         size_t l;
 
+        /* Don't read /proc/cmdline if we are in a container, since
+         * that is only relevant for the host system */
+        if (detect_container(NULL) > 0)
+                return 0;
+
         if ((r = read_one_line_file("/proc/cmdline", &line)) < 0) {
                 log_warning("Failed to read /proc/cmdline, ignoring: %s", strerror(-r));
                 return 0;
@@ -624,7 +636,10 @@ static int parse_argv(int argc, char *argv[]) {
         assert(argc >= 1);
         assert(argv);
 
-        while ((c = getopt_long(argc, argv, "hD", options, NULL)) >= 0)
+        if (getpid() == 1)
+                opterr = 0;
+
+        while ((c = getopt_long(argc, argv, "hDbsz:", options, NULL)) >= 0)
 
                 switch (c) {
 
@@ -800,23 +815,48 @@ static int parse_argv(int argc, char *argv[]) {
                         log_set_max_level(LOG_DEBUG);
                         break;
 
-                case '?':
-                        return -EINVAL;
+                case 'b':
+                case 's':
+                case 'z':
+                        /* Just to eat away the sysvinit kernel
+                         * cmdline args without getopt() error
+                         * messages that we'll parse in
+                         * parse_proc_cmdline_word() or ignore. */
 
+                case '?':
                 default:
-                        log_error("Unknown option code %c", c);
-                        return -EINVAL;
+                        if (getpid() != 1) {
+                                log_error("Unknown option code %c", c);
+                                return -EINVAL;
+                        }
+
+                        break;
                 }
 
-        /* PID 1 will get the kernel arguments as parameters, which we
-         * ignore and unconditionally read from
-         * /proc/cmdline. However, we need to ignore those arguments
-         * here. */
-        if (arg_running_as != MANAGER_SYSTEM && optind < argc) {
+        if (optind < argc && getpid() != 1) {
+                /* Hmm, when we aren't run as init system
+                 * let's complain about excess arguments */
+
                 log_error("Excess arguments.");
                 return -EINVAL;
         }
 
+        if (detect_container(NULL) > 0) {
+                char **a;
+
+                /* All /proc/cmdline arguments the kernel didn't
+                 * understand it passed to us. We're not really
+                 * interested in that usually since /proc/cmdline is
+                 * more interesting and complete. With one exception:
+                 * if we are run in a container /proc/cmdline is not
+                 * relevant for the container, hence we rely on argv[]
+                 * instead. */
+
+                for (a = argv; a < argv + argc; a++)
+                        if ((r = parse_proc_cmdline_word(*a)) < 0)
+                                return r;
+        }
+
         return 0;
 }
 
@@ -858,6 +898,9 @@ static int prepare_reexecute(Manager *m, FILE **_f, FDSet **_fds) {
         assert(_f);
         assert(_fds);
 
+        /* Make sure nothing is really destructed when we shut down */
+        m->n_reloading ++;
+
         if ((r = manager_open_serialization(m, &f)) < 0) {
                 log_error("Failed to create serialization file: %s", strerror(-r));
                 goto fail;
@@ -945,21 +988,43 @@ static void test_usr(void) {
 
         /* Check that /usr is not a separate fs */
 
-        if (dir_is_empty("/usr") > 0)
-                log_warning("/usr appears to be on a different file system than /. This is not supported anymore. "
-                            "Some things will probably break (sometimes even silently) in mysterious ways. "
-                            "Consult http://freedesktop.org/wiki/Software/systemd/separate-usr-is-broken for more information.");
+        if (dir_is_empty("/usr") <= 0)
+                return;
+
+        log_warning("/usr appears to be on its own filesytem and is not already mounted. This is not a supported setup. "
+                    "Some things will probably break (sometimes even silently) in mysterious ways. "
+                    "Consult http://freedesktop.org/wiki/Software/systemd/separate-usr-is-broken for more information.");
+}
+
+static void test_cgroups(void) {
+
+        if (access("/proc/cgroups", F_OK) >= 0)
+                return;
+
+        log_warning("CONFIG_CGROUPS was not set when your kernel was compiled. "
+                    "Systems without control groups are not supported. "
+                    "We will now sleep for 10s, and then continue boot-up. "
+                    "Expect breakage and please do not file bugs. "
+                    "Instead fix your kernel and enable CONFIG_CGROUPS." );
+
+        sleep(10);
 }
 
 int main(int argc, char *argv[]) {
         Manager *m = NULL;
         int r, retval = EXIT_FAILURE;
+        usec_t before_startup, after_startup;
+        char timespan[FORMAT_TIMESPAN_MAX];
         FDSet *fds = NULL;
         bool reexecute = false;
         const char *shutdown_verb = NULL;
         dual_timestamp initrd_timestamp = { 0ULL, 0ULL };
         char systemd[] = "systemd";
+        bool is_reexec = false;
+        int j;
+        bool loaded_policy = false;
 
+#ifdef HAVE_SYSV_COMPAT
         if (getpid() != 1 && strstr(program_invocation_short_name, "init")) {
                 /* This is compatibility support for SysV, where
                  * calling init as a user is identical to telinit. */
@@ -969,6 +1034,17 @@ int main(int argc, char *argv[]) {
                 log_error("Failed to exec " SYSTEMCTL_BINARY_PATH ": %m");
                 return 1;
         }
+#endif
+
+        /* Determine if this is a reexecution or normal bootup. We do
+         * the full command line parsing much later, so let's just
+         * have a quick peek here. */
+
+        for (j = 1; j < argc; j++)
+                if (streq(argv[j], "--deserialize")) {
+                        break;
+                        is_reexec = true;
+                }
 
         /* If we get started via the /sbin/init symlink then we are
            called 'init'. After a subsequent reexecution we are then
@@ -977,6 +1053,8 @@ int main(int argc, char *argv[]) {
 
         program_invocation_short_name = systemd;
         prctl(PR_SET_NAME, systemd);
+        saved_argv = argv;
+        saved_argc = argc;
 
         log_show_color(isatty(STDERR_FILENO) > 0);
         log_show_location(false);
@@ -984,18 +1062,32 @@ int main(int argc, char *argv[]) {
 
         if (getpid() == 1) {
                 arg_running_as = MANAGER_SYSTEM;
-                log_set_target(LOG_TARGET_SYSLOG_OR_KMSG);
+                log_set_target(detect_container(NULL) > 0 ? LOG_TARGET_CONSOLE : LOG_TARGET_SYSLOG_OR_KMSG);
 
-                /* This might actually not return, but cause a
-                 * reexecution */
-                if (selinux_setup(argv) < 0)
-                        goto finish;
+                if (!is_reexec)
+                        if (selinux_setup(&loaded_policy) < 0)
+                                goto finish;
+
+                log_open();
 
                 if (label_init() < 0)
                         goto finish;
+
+                if (!is_reexec)
+                        if (hwclock_is_localtime() > 0) {
+                                int min;
+
+                                r = hwclock_apply_localtime_delta(&min);
+                                if (r < 0)
+                                        log_error("Failed to apply local time delta, ignoring: %s", strerror(-r));
+                                else
+                                        log_info("RTC configured in localtime, applying delta of %i minutes to system time.", min);
+                        }
+
         } else {
                 arg_running_as = MANAGER_USER;
-                log_set_target(LOG_TARGET_CONSOLE);
+                log_set_target(LOG_TARGET_AUTO);
+                log_open();
         }
 
         if (set_default_unit(SPECIAL_DEFAULT_TARGET) < 0)
@@ -1004,7 +1096,7 @@ int main(int argc, char *argv[]) {
         /* Mount /proc, /sys and friends, so that /proc/cmdline and
          * /proc/$PID/fd is available. */
         if (geteuid() == 0 && !getenv("SYSTEMD_SKIP_API_MOUNTS"))
-                if (mount_setup() < 0)
+                if (mount_setup(loaded_policy) < 0)
                         goto finish;
 
         /* Reset all signal handlers. */
@@ -1037,11 +1129,6 @@ int main(int argc, char *argv[]) {
                 goto finish;
         }
 
-        /* If Plymouth is being run make sure we show the status, so
-         * that there's something nice to see when people press Esc */
-        if (access("/dev/.systemd/plymouth", F_OK) >= 0)
-                arg_show_status = true;
-
         if (arg_action == ACTION_HELP) {
                 retval = help();
                 goto finish;
@@ -1056,6 +1143,9 @@ int main(int argc, char *argv[]) {
 
         assert_se(arg_action == ACTION_RUN || arg_action == ACTION_TEST);
 
+        /* Close logging fds, in order not to confuse fdset below */
+        log_close();
+
         /* Remember open file descriptors for later deserialization */
         if (serialization) {
                 if ((r = fdset_new_fill(&fds)) < 0) {
@@ -1081,6 +1171,9 @@ int main(int argc, char *argv[]) {
                  * kernel that don't really make sense for us. */
                 unsetenv("HOME");
                 unsetenv("TERM");
+
+                /* All other variables are left as is, so that clients
+                 * can still read them via /proc/1/environ */
         }
 
         /* Move out of the way, so that we won't block unmounts */
@@ -1100,7 +1193,7 @@ int main(int argc, char *argv[]) {
         /* Reset the console, but only if this is really init and we
          * are freshly booted */
         if (arg_running_as == MANAGER_SYSTEM && arg_action == ACTION_RUN) {
-                console_setup(getpid() == 1 && !serialization);
+                console_setup(getpid() == 1 && !is_reexec);
                 make_null_stdio();
         }
 
@@ -1115,10 +1208,10 @@ int main(int argc, char *argv[]) {
         log_full(arg_running_as == MANAGER_SYSTEM ? LOG_INFO : LOG_DEBUG,
                  PACKAGE_STRING " running in %s mode. (" SYSTEMD_FEATURES "; " DISTRIBUTION ")", manager_running_as_to_string(arg_running_as));
 
-        if (arg_running_as == MANAGER_SYSTEM && !serialization) {
+        if (arg_running_as == MANAGER_SYSTEM && !is_reexec) {
                 locale_setup();
 
-                if (arg_show_status)
+                if (arg_show_status || plymouth_running())
                         status_welcome();
 
                 kmod_setup();
@@ -1128,6 +1221,7 @@ int main(int argc, char *argv[]) {
 
                 test_mtab();
                 test_usr();
+                test_cgroups();
         }
 
         if ((r = manager_new(arg_running_as, &m)) < 0) {
@@ -1151,6 +1245,8 @@ int main(int argc, char *argv[]) {
         if (arg_default_controllers)
                 manager_set_default_controllers(m, arg_default_controllers);
 
+        before_startup = now(CLOCK_MONOTONIC);
+
         if ((r = manager_startup(m, serialization, fds)) < 0)
                 log_error("Failed to fully start up daemon: %s", strerror(-r));
 
@@ -1218,6 +1314,10 @@ int main(int argc, char *argv[]) {
                 }
         }
 
+        after_startup = now(CLOCK_MONOTONIC);
+        log_debug("Loaded units and determined initial transaction in %s.",
+                  format_timespan(timespan, sizeof(timespan), after_startup - before_startup));
+
         for (;;) {
                 if ((r = manager_loop(m)) < 0) {
                         log_error("Failed to run mainloop: %s", strerror(-r));