chiark / gitweb /
libudev: add missing hunks
[elogind.git] / src / udev / udev-rules.c
index 8a85eae717339a5a46eb9f901dbc949d1c7dd560..e8387d793a451ab6a9ab6dd7343ccd31d374a732 100644 (file)
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2003-2010 Kay Sievers <kay.sievers@vrfy.org>
- * Copyright (C) 2008 Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+ * Copyright (C) 2003-2012 Kay Sievers <kay@vrfy.org>
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
 #include <time.h>
 
 #include "udev.h"
+#include "path-util.h"
+#include "conf-files.h"
+#include "strbuf.h"
+#include "strv.h"
+#include "util.h"
 
 #define PREALLOC_TOKEN          2048
-#define PREALLOC_STRBUF         32 * 1024
-#define PREALLOC_TRIE           256
 
 struct uid_gid {
         unsigned int name_off;
@@ -44,20 +46,15 @@ struct uid_gid {
         };
 };
 
-struct trie_node {
-        /* this node's first child */
-        unsigned int child_idx;
-        /* the next child of our parent node's child list */
-        unsigned int next_child_idx;
-        /* this node's last child (shortcut for append) */
-        unsigned int last_child_idx;
-        unsigned int value_off;
-        unsigned short value_len;
-        unsigned char key;
-};
+static const char* const rules_dirs[] = {
+        "/etc/udev/rules.d",
+        "/run/udev/rules.d",
+        UDEVLIBEXECDIR "/rules.d",
+        NULL};
 
 struct udev_rules {
         struct udev *udev;
+        usec_t dirs_ts_usec;
         int resolve_names;
 
         /* every key in the rules file becomes a token */
@@ -65,16 +62,8 @@ struct udev_rules {
         unsigned int token_cur;
         unsigned int token_max;
 
-        /* all key strings are copied to a single string buffer */
-        char *buf;
-        size_t buf_cur;
-        size_t buf_max;
-        unsigned int buf_count;
-
-        /* during rule parsing, strings are indexed to find duplicates */
-        struct trie_node *trie_nodes;
-        unsigned int trie_nodes_cur;
-        unsigned int trie_nodes_max;
+        /* all key strings are copied and de-duplicated in a single continuous string buffer */
+        struct strbuf *strbuf;
 
         /* during rule parsing, uid/gid lookup results are cached */
         struct uid_gid *uids;
@@ -85,7 +74,15 @@ struct udev_rules {
         unsigned int gids_max;
 };
 
-/* KEY=="", KEY!="", KEY+="", KEY="", KEY:="" */
+static char *rules_str(struct udev_rules *rules, unsigned int off) {
+        return rules->strbuf->buf + off;
+}
+
+static unsigned int rules_add_string(struct udev_rules *rules, const char *s) {
+        return strbuf_add_string(rules->strbuf, s, strlen(s));
+}
+
+/* KEY=="", KEY!="", KEY+="", KEY-="", KEY="", KEY:="" */
 enum operation_type {
         OP_UNSET,
 
@@ -94,6 +91,7 @@ enum operation_type {
         OP_MATCH_MAX,
 
         OP_ADD,
+        OP_REMOVE,
         OP_ASSIGN,
         OP_ASSIGN_FINAL,
 };
@@ -140,7 +138,6 @@ enum token_type {
         TK_M_PARENTS_MAX,
 
         TK_M_TEST,                      /* val, mode_t */
-        TK_M_EVENT_TIMEOUT,             /* int */
         TK_M_PROGRAM,                   /* val */
         TK_M_IMPORT_FILE,               /* val */
         TK_M_IMPORT_PROG,               /* val */
@@ -162,13 +159,15 @@ enum token_type {
         TK_A_OWNER_ID,                  /* uid_t */
         TK_A_GROUP_ID,                  /* gid_t */
         TK_A_MODE_ID,                   /* mode_t */
+        TK_A_TAG,                       /* val */
         TK_A_STATIC_NODE,               /* val */
+        TK_A_SECLABEL,                  /* val, attr */
         TK_A_ENV,                       /* val, attr */
-        TK_A_TAG,                       /* val */
         TK_A_NAME,                      /* val */
         TK_A_DEVLINK,                   /* val */
         TK_A_ATTR,                      /* val, attr */
-        TK_A_RUN,                       /* val, bool */
+        TK_A_RUN_BUILTIN,               /* val, bool */
+        TK_A_RUN_PROGRAM,               /* val, bool */
         TK_A_GOTO,                      /* size_t */
 
         TK_END,
@@ -197,13 +196,11 @@ struct token {
                         unsigned int value_off;
                         union {
                                 unsigned int attr_off;
-                                int devlink_unique;
                                 unsigned int rule_goto;
                                 mode_t  mode;
                                 uid_t uid;
                                 gid_t gid;
                                 int devlink_prio;
-                                int event_timeout;
                                 int watch;
                                 enum udev_builtin_cmd builtin_cmd;
                         };
@@ -219,9 +216,8 @@ struct rule_tmp {
         unsigned int token_cur;
 };
 
-#ifdef ENABLE_DEBUG
-static const char *operation_str(enum operation_type type)
-{
+#ifdef DEBUG
+static const char *operation_str(enum operation_type type) {
         static const char *operation_strs[] = {
                 [OP_UNSET] =            "UNSET",
                 [OP_MATCH] =            "match",
@@ -229,6 +225,7 @@ static const char *operation_str(enum operation_type type)
                 [OP_MATCH_MAX] =        "MATCH_MAX",
 
                 [OP_ADD] =              "add",
+                [OP_REMOVE] =           "remove",
                 [OP_ASSIGN] =           "assign",
                 [OP_ASSIGN_FINAL] =     "assign-final",
 }        ;
@@ -236,8 +233,7 @@ static const char *operation_str(enum operation_type type)
         return operation_strs[type];
 }
 
-static const char *string_glob_str(enum string_glob_type type)
-{
+static const char *string_glob_str(enum string_glob_type type) {
         static const char *string_glob_strs[] = {
                 [GL_UNSET] =            "UNSET",
                 [GL_PLAIN] =            "plain",
@@ -250,8 +246,7 @@ static const char *string_glob_str(enum string_glob_type type)
         return string_glob_strs[type];
 }
 
-static const char *token_str(enum token_type type)
-{
+static const char *token_str(enum token_type type) {
         static const char *token_strs[] = {
                 [TK_UNSET] =                    "UNSET",
                 [TK_RULE] =                     "RULE",
@@ -277,7 +272,6 @@ static const char *token_str(enum token_type type)
                 [TK_M_PARENTS_MAX] =            "M PARENTS_MAX",
 
                 [TK_M_TEST] =                   "M TEST",
-                [TK_M_EVENT_TIMEOUT] =          "M EVENT_TIMEOUT",
                 [TK_M_PROGRAM] =                "M PROGRAM",
                 [TK_M_IMPORT_FILE] =            "M IMPORT_FILE",
                 [TK_M_IMPORT_PROG] =            "M IMPORT_PROG",
@@ -299,13 +293,15 @@ static const char *token_str(enum token_type type)
                 [TK_A_OWNER_ID] =               "A OWNER_ID",
                 [TK_A_GROUP_ID] =               "A GROUP_ID",
                 [TK_A_STATIC_NODE] =            "A STATIC_NODE",
+                [TK_A_SECLABEL] =               "A SECLABEL",
                 [TK_A_MODE_ID] =                "A MODE_ID",
                 [TK_A_ENV] =                    "A ENV",
                 [TK_A_TAG] =                    "A ENV",
                 [TK_A_NAME] =                   "A NAME",
                 [TK_A_DEVLINK] =                "A DEVLINK",
                 [TK_A_ATTR] =                   "A ATTR",
-                [TK_A_RUN] =                    "A RUN",
+                [TK_A_RUN_BUILTIN] =            "A RUN_BUILTIN",
+                [TK_A_RUN_PROGRAM] =            "A RUN_PROGRAM",
                 [TK_A_GOTO] =                   "A GOTO",
 
                 [TK_END] =                      "END",
@@ -314,12 +310,11 @@ static const char *token_str(enum token_type type)
         return token_strs[type];
 }
 
-static void dump_token(struct udev_rules *rules, struct token *token)
-{
+static void dump_token(struct udev_rules *rules, struct token *token) {
         enum token_type type = token->type;
         enum operation_type op = token->key.op;
         enum string_glob_type glob = token->key.glob;
-        const char *value = &rules->buf[token->key.value_off];
+        const char *value = str(rules, token->key.value_off);
         const char *attr = &rules->buf[token->key.attr_off];
 
         switch (type) {
@@ -329,10 +324,10 @@ static void dump_token(struct udev_rules *rules, struct token *token)
                         const char *tk_ptr = (char *)token;
                         unsigned int idx = (tk_ptr - tks_ptr) / sizeof(struct token);
 
-                        dbg(rules->udev, "* RULE %s:%u, token: %u, count: %u, label: '%s'\n",
-                            &rules->buf[token->rule.filename_off], token->rule.filename_line,
-                            idx, token->rule.token_count,
-                            &rules->buf[token->rule.label_off]);
+                        log_debug("* RULE %s:%u, token: %u, count: %u, label: '%s'",
+                                  &rules->buf[token->rule.filename_off], token->rule.filename_line,
+                                  idx, token->rule.token_count,
+                                  &rules->buf[token->rule.label_off]);
                         break;
                 }
         case TK_M_ACTION:
@@ -359,206 +354,88 @@ static void dump_token(struct udev_rules *rules, struct token *token)
         case TK_A_OWNER:
         case TK_A_GROUP:
         case TK_A_MODE:
-        case TK_A_RUN:
-                dbg(rules->udev, "%s %s '%s'(%s)\n",
-                    token_str(type), operation_str(op), value, string_glob_str(glob));
+        case TK_A_RUN_BUILTIN:
+        case TK_A_RUN_PROGRAM:
+                log_debug("%s %s '%s'(%s)",
+                          token_str(type), operation_str(op), value, string_glob_str(glob));
                 break;
         case TK_M_IMPORT_BUILTIN:
-                dbg(rules->udev, "%s %i '%s'\n", token_str(type), token->key.builtin_cmd, value);
+                log_debug("%s %i '%s'", token_str(type), token->key.builtin_cmd, value);
                 break;
         case TK_M_ATTR:
         case TK_M_ATTRS:
         case TK_M_ENV:
         case TK_A_ATTR:
         case TK_A_ENV:
-                dbg(rules->udev, "%s %s '%s' '%s'(%s)\n",
-                    token_str(type), operation_str(op), attr, value, string_glob_str(glob));
+                log_debug("%s %s '%s' '%s'(%s)",
+                          token_str(type), operation_str(op), attr, value, string_glob_str(glob));
                 break;
         case TK_M_TAG:
         case TK_A_TAG:
-                dbg(rules->udev, "%s %s '%s'\n", token_str(type), operation_str(op), value);
+                log_debug("%s %s '%s'", token_str(type), operation_str(op), value);
                 break;
         case TK_A_STRING_ESCAPE_NONE:
         case TK_A_STRING_ESCAPE_REPLACE:
         case TK_A_DB_PERSIST:
-                dbg(rules->udev, "%s\n", token_str(type));
+                log_debug("%s", token_str(type));
                 break;
         case TK_M_TEST:
-                dbg(rules->udev, "%s %s '%s'(%s) %#o\n",
-                    token_str(type), operation_str(op), value, string_glob_str(glob), token->key.mode);
+                log_debug("%s %s '%s'(%s) %#o",
+                          token_str(type), operation_str(op), value, string_glob_str(glob), token->key.mode);
                 break;
         case TK_A_INOTIFY_WATCH:
-                dbg(rules->udev, "%s %u\n", token_str(type), token->key.watch);
+                log_debug("%s %u", token_str(type), token->key.watch);
                 break;
         case TK_A_DEVLINK_PRIO:
-                dbg(rules->udev, "%s %u\n", token_str(type), token->key.devlink_prio);
+                log_debug("%s %u", token_str(type), token->key.devlink_prio);
                 break;
         case TK_A_OWNER_ID:
-                dbg(rules->udev, "%s %s %u\n", token_str(type), operation_str(op), token->key.uid);
+                log_debug("%s %s %u", token_str(type), operation_str(op), token->key.uid);
                 break;
         case TK_A_GROUP_ID:
-                dbg(rules->udev, "%s %s %u\n", token_str(type), operation_str(op), token->key.gid);
+                log_debug("%s %s %u", token_str(type), operation_str(op), token->key.gid);
                 break;
         case TK_A_MODE_ID:
-                dbg(rules->udev, "%s %s %#o\n", token_str(type), operation_str(op), token->key.mode);
+                log_debug("%s %s %#o", token_str(type), operation_str(op), token->key.mode);
                 break;
         case TK_A_STATIC_NODE:
-                dbg(rules->udev, "%s '%s'\n", token_str(type), value);
+                log_debug("%s '%s'", token_str(type), value);
                 break;
-        case TK_M_EVENT_TIMEOUT:
-                dbg(rules->udev, "%s %u\n", token_str(type), token->key.event_timeout);
+        case TK_A_SECLABEL:
+                log_debug("%s %s '%s' '%s'", token_str(type), operation_str(op), attr, value);
                 break;
         case TK_A_GOTO:
-                dbg(rules->udev, "%s '%s' %u\n", token_str(type), value, token->key.rule_goto);
+                log_debug("%s '%s' %u", token_str(type), value, token->key.rule_goto);
                 break;
         case TK_END:
-                dbg(rules->udev, "* %s\n", token_str(type));
+                log_debug("* %s", token_str(type));
                 break;
         case TK_M_PARENTS_MIN:
         case TK_M_PARENTS_MAX:
         case TK_M_MAX:
         case TK_UNSET:
-                dbg(rules->udev, "unknown type %u\n", type);
+                log_debug("unknown type %u", type);
                 break;
         }
 }
 
-static void dump_rules(struct udev_rules *rules)
-{
+static void dump_rules(struct udev_rules *rules) {
         unsigned int i;
 
-        dbg(rules->udev, "dumping %u (%zu bytes) tokens, %u (%zu bytes) strings\n",
-            rules->token_cur,
-            rules->token_cur * sizeof(struct token),
-            rules->buf_count,
-            rules->buf_cur);
-        for(i = 0; i < rules->token_cur; i++)
+        log_debug("dumping %u (%zu bytes) tokens, %u (%zu bytes) strings",
+                  rules->token_cur,
+                  rules->token_cur * sizeof(struct token),
+                  rules->buf_count,
+                  rules->buf_cur);
+        for (i = 0; i < rules->token_cur; i++)
                 dump_token(rules, &rules->tokens[i]);
 }
 #else
-static inline const char *operation_str(enum operation_type type) { return NULL; }
-static inline const char *token_str(enum token_type type) { return NULL; }
 static inline void dump_token(struct udev_rules *rules, struct token *token) {}
 static inline void dump_rules(struct udev_rules *rules) {}
-#endif /* ENABLE_DEBUG */
-
-static int add_new_string(struct udev_rules *rules, const char *str, size_t bytes)
-{
-        int off;
+#endif /* DEBUG */
 
-        /* grow buffer if needed */
-        if (rules->buf_cur + bytes+1 >= rules->buf_max) {
-                char *buf;
-                unsigned int add;
-
-                /* double the buffer size */
-                add = rules->buf_max;
-                if (add < bytes * 8)
-                        add = bytes * 8;
-
-                buf = realloc(rules->buf, rules->buf_max + add);
-                if (buf == NULL)
-                        return -1;
-                dbg(rules->udev, "extend buffer from %zu to %zu\n", rules->buf_max, rules->buf_max + add);
-                rules->buf = buf;
-                rules->buf_max += add;
-        }
-        off = rules->buf_cur;
-        memcpy(&rules->buf[rules->buf_cur], str, bytes);
-        rules->buf_cur += bytes;
-        rules->buf_count++;
-        return off;
-}
-
-static int add_string(struct udev_rules *rules, const char *str)
-{
-        unsigned int node_idx;
-        struct trie_node *new_node;
-        unsigned int new_node_idx;
-        unsigned char key;
-        unsigned short len;
-        unsigned int depth;
-        unsigned int off;
-        struct trie_node *parent;
-
-        /* walk trie, start from last character of str to find matching tails */
-        len = strlen(str);
-        key = str[len-1];
-        node_idx = 0;
-        for (depth = 0; depth <= len; depth++) {
-                struct trie_node *node;
-                unsigned int child_idx;
-
-                node = &rules->trie_nodes[node_idx];
-                off = node->value_off + node->value_len - len;
-
-                /* match against current node */
-                if (depth == len || (node->value_len >= len && memcmp(&rules->buf[off], str, len) == 0))
-                        return off;
-
-                /* lookup child node */
-                key = str[len - 1 - depth];
-                child_idx = node->child_idx;
-                while (child_idx > 0) {
-                        struct trie_node *child;
-
-                        child = &rules->trie_nodes[child_idx];
-                        if (child->key == key)
-                                break;
-                        child_idx = child->next_child_idx;
-                }
-                if (child_idx == 0)
-                        break;
-                node_idx = child_idx;
-        }
-
-        /* string not found, add it */
-        off = add_new_string(rules, str, len + 1);
-
-        /* grow trie nodes if needed */
-        if (rules->trie_nodes_cur >= rules->trie_nodes_max) {
-                struct trie_node *nodes;
-                unsigned int add;
-
-                /* double the buffer size */
-                add = rules->trie_nodes_max;
-                if (add < 8)
-                        add = 8;
-
-                nodes = realloc(rules->trie_nodes, (rules->trie_nodes_max + add) * sizeof(struct trie_node));
-                if (nodes == NULL)
-                        return -1;
-                dbg(rules->udev, "extend trie nodes from %u to %u\n",
-                    rules->trie_nodes_max, rules->trie_nodes_max + add);
-                rules->trie_nodes = nodes;
-                rules->trie_nodes_max += add;
-        }
-
-        /* get a new node */
-        new_node_idx = rules->trie_nodes_cur;
-        rules->trie_nodes_cur++;
-        new_node = &rules->trie_nodes[new_node_idx];
-        memset(new_node, 0x00, sizeof(struct trie_node));
-        new_node->value_off = off;
-        new_node->value_len = len;
-        new_node->key = key;
-
-        /* join the parent's child list */
-        parent = &rules->trie_nodes[node_idx];
-        if (parent->child_idx == 0) {
-                parent->child_idx = new_node_idx;
-        } else {
-                struct trie_node *last_child;
-
-                last_child = &rules->trie_nodes[parent->last_child_idx];
-                last_child->next_child_idx = new_node_idx;
-        }
-        parent->last_child_idx = new_node_idx;
-        return off;
-}
-
-static int add_token(struct udev_rules *rules, struct token *token)
-{
+static int add_token(struct udev_rules *rules, struct token *token) {
         /* grow buffer if needed */
         if (rules->token_cur+1 >= rules->token_max) {
                 struct token *tokens;
@@ -572,7 +449,6 @@ static int add_token(struct udev_rules *rules, struct token *token)
                 tokens = realloc(rules->tokens, (rules->token_max + add ) * sizeof(struct token));
                 if (tokens == NULL)
                         return -1;
-                dbg(rules->udev, "extend tokens from %u to %u\n", rules->token_max, rules->token_max + add);
                 rules->tokens = tokens;
                 rules->token_max += add;
         }
@@ -581,22 +457,27 @@ static int add_token(struct udev_rules *rules, struct token *token)
         return 0;
 }
 
-static uid_t add_uid(struct udev_rules *rules, const char *owner)
-{
+static uid_t add_uid(struct udev_rules *rules, const char *owner) {
         unsigned int i;
-        uid_t uid;
+        uid_t uid = 0;
         unsigned int off;
+        int r;
 
         /* lookup, if we know it already */
         for (i = 0; i < rules->uids_cur; i++) {
                 off = rules->uids[i].name_off;
-                if (strcmp(&rules->buf[off], owner) == 0) {
+                if (streq(rules_str(rules, off), owner)) {
                         uid = rules->uids[i].uid;
-                        dbg(rules->udev, "return existing %u for '%s'\n", uid, owner);
                         return uid;
                 }
         }
-        uid = util_lookup_user(rules->udev, owner);
+        r = get_user_creds(&owner, &uid, NULL, NULL, NULL);
+        if (r < 0) {
+                if (r == -ENOENT || r == -ESRCH)
+                        log_error("specified user '%s' unknown", owner);
+                else
+                        log_error_errno(r, "error resolving user '%s': %m", owner);
+        }
 
         /* grow buffer if needed */
         if (rules->uids_cur+1 >= rules->uids_max) {
@@ -611,12 +492,11 @@ static uid_t add_uid(struct udev_rules *rules, const char *owner)
                 uids = realloc(rules->uids, (rules->uids_max + add ) * sizeof(struct uid_gid));
                 if (uids == NULL)
                         return uid;
-                dbg(rules->udev, "extend uids from %u to %u\n", rules->uids_max, rules->uids_max + add);
                 rules->uids = uids;
                 rules->uids_max += add;
         }
         rules->uids[rules->uids_cur].uid = uid;
-        off = add_string(rules, owner);
+        off = rules_add_string(rules, owner);
         if (off <= 0)
                 return uid;
         rules->uids[rules->uids_cur].name_off = off;
@@ -624,22 +504,27 @@ static uid_t add_uid(struct udev_rules *rules, const char *owner)
         return uid;
 }
 
-static gid_t add_gid(struct udev_rules *rules, const char *group)
-{
+static gid_t add_gid(struct udev_rules *rules, const char *group) {
         unsigned int i;
-        gid_t gid;
+        gid_t gid = 0;
         unsigned int off;
+        int r;
 
         /* lookup, if we know it already */
         for (i = 0; i < rules->gids_cur; i++) {
                 off = rules->gids[i].name_off;
-                if (strcmp(&rules->buf[off], group) == 0) {
+                if (streq(rules_str(rules, off), group)) {
                         gid = rules->gids[i].gid;
-                        dbg(rules->udev, "return existing %u for '%s'\n", gid, group);
                         return gid;
                 }
         }
-        gid = util_lookup_group(rules->udev, group);
+        r = get_group_creds(&group, &gid);
+        if (r < 0) {
+                if (r == -ENOENT || r == -ESRCH)
+                        log_error("specified group '%s' unknown", group);
+                else
+                        log_error_errno(r, "error resolving group '%s': %m", group);
+        }
 
         /* grow buffer if needed */
         if (rules->gids_cur+1 >= rules->gids_max) {
@@ -654,12 +539,11 @@ static gid_t add_gid(struct udev_rules *rules, const char *group)
                 gids = realloc(rules->gids, (rules->gids_max + add ) * sizeof(struct uid_gid));
                 if (gids == NULL)
                         return gid;
-                dbg(rules->udev, "extend gids from %u to %u\n", rules->gids_max, rules->gids_max + add);
                 rules->gids = gids;
                 rules->gids_max += add;
         }
         rules->gids[rules->gids_cur].gid = gid;
-        off = add_string(rules, group);
+        off = rules_add_string(rules, group);
         if (off <= 0)
                 return gid;
         rules->gids[rules->gids_cur].name_off = off;
@@ -667,9 +551,7 @@ static gid_t add_gid(struct udev_rules *rules, const char *group)
         return gid;
 }
 
-static int import_property_from_string(struct udev_device *dev, char *line)
-{
-        struct udev *udev = udev_device_get_udev(dev);
+static int import_property_from_string(struct udev_device *dev, char *line) {
         char *key;
         char *val;
         size_t len;
@@ -716,40 +598,23 @@ static int import_property_from_string(struct udev_device *dev, char *line)
         /* unquote */
         if (val[0] == '"' || val[0] == '\'') {
                 if (val[len-1] != val[0]) {
-                        info(udev, "inconsistent quoting: '%s', skip\n", line);
+                        log_debug("inconsistent quoting: '%s', skip", line);
                         return -1;
                 }
                 val[len-1] = '\0';
                 val++;
         }
 
-        dbg(udev, "adding '%s'='%s'\n", key, val);
-
-        /* handle device, renamed by external tool, returning new path */
-        if (strcmp(key, "DEVPATH") == 0) {
-                char syspath[UTIL_PATH_SIZE];
-
-                info(udev, "updating devpath from '%s' to '%s'\n",
-                     udev_device_get_devpath(dev), val);
-                util_strscpyl(syspath, sizeof(syspath), udev_get_sys_path(udev), val, NULL);
-                udev_device_set_syspath(dev, syspath);
-        } else {
-                struct udev_list_entry *entry;
+        udev_device_add_property(dev, key, val);
 
-                entry = udev_device_add_property(dev, key, val);
-                /* store in db, skip private keys */
-                if (key[0] != '.')
-                        udev_list_entry_set_num(entry, true);
-        }
         return 0;
 }
 
-static int import_file_into_properties(struct udev_device *dev, const char *filename)
-{
+static int import_file_into_properties(struct udev_device *dev, const char *filename) {
         FILE *f;
         char line[UTIL_LINE_SIZE];
 
-        f = fopen(filename, "r");
+        f = fopen(filename, "re");
         if (f == NULL)
                 return -1;
         while (fgets(line, sizeof(line), f) != NULL)
@@ -758,8 +623,10 @@ static int import_file_into_properties(struct udev_device *dev, const char *file
         return 0;
 }
 
-static int import_program_into_properties(struct udev_event *event, const char *program, const sigset_t *sigmask)
-{
+static int import_program_into_properties(struct udev_event *event,
+                                          usec_t timeout_usec,
+                                          usec_t timeout_warn_usec,
+                                          const char *program, const sigset_t *sigmask) {
         struct udev_device *dev = event->dev;
         char **envp;
         char result[UTIL_LINE_SIZE];
@@ -767,7 +634,7 @@ static int import_program_into_properties(struct udev_event *event, const char *
         int err;
 
         envp = udev_device_get_properties_envp(dev);
-        err = udev_event_spawn(event, program, envp, sigmask, result, sizeof(result));
+        err = udev_event_spawn(event, timeout_usec, timeout_warn_usec, program, envp, sigmask, result, sizeof(result));
         if (err < 0)
                 return err;
 
@@ -786,9 +653,7 @@ static int import_program_into_properties(struct udev_event *event, const char *
         return 0;
 }
 
-static int import_parent_into_properties(struct udev_device *dev, const char *filter)
-{
-        struct udev *udev = udev_device_get_udev(dev);
+static int import_parent_into_properties(struct udev_device *dev, const char *filter) {
         struct udev_device *dev_parent;
         struct udev_list_entry *list_entry;
 
@@ -796,28 +661,19 @@ static int import_parent_into_properties(struct udev_device *dev, const char *fi
         if (dev_parent == NULL)
                 return -1;
 
-        dbg(udev, "found parent '%s', get the node name\n", udev_device_get_syspath(dev_parent));
         udev_list_entry_foreach(list_entry, udev_device_get_properties_list_entry(dev_parent)) {
                 const char *key = udev_list_entry_get_name(list_entry);
                 const char *val = udev_list_entry_get_value(list_entry);
 
                 if (fnmatch(filter, key, 0) == 0) {
-                        struct udev_list_entry *entry;
-
-                        dbg(udev, "import key '%s=%s'\n", key, val);
-                        entry = udev_device_add_property(dev, key, val);
-                        /* store in db, skip private keys */
-                        if (key[0] != '.')
-                                udev_list_entry_set_num(entry, true);
+                        udev_device_add_property(dev, key, val);
                 }
         }
         return 0;
 }
 
 #define WAIT_LOOP_PER_SECOND                50
-static int wait_for_file(struct udev_device *dev, const char *file, int timeout)
-{
-        struct udev *udev = udev_device_get_udev(dev);
+static int wait_for_file(struct udev_device *dev, const char *file, int timeout) {
         char filepath[UTIL_PATH_SIZE];
         char devicepath[UTIL_PATH_SIZE];
         struct stat stats;
@@ -826,35 +682,32 @@ static int wait_for_file(struct udev_device *dev, const char *file, int timeout)
         /* a relative path is a device attribute */
         devicepath[0] = '\0';
         if (file[0] != '/') {
-                util_strscpyl(devicepath, sizeof(devicepath),
-                              udev_get_sys_path(udev), udev_device_get_devpath(dev), NULL);
-                util_strscpyl(filepath, sizeof(filepath), devicepath, "/", file, NULL);
+                strscpyl(devicepath, sizeof(devicepath), udev_device_get_syspath(dev), NULL);
+                strscpyl(filepath, sizeof(filepath), devicepath, "/", file, NULL);
                 file = filepath;
         }
 
-        dbg(udev, "will wait %i sec for '%s'\n", timeout, file);
         while (--loop) {
                 const struct timespec duration = { 0, 1000 * 1000 * 1000 / WAIT_LOOP_PER_SECOND };
 
                 /* lookup file */
                 if (stat(file, &stats) == 0) {
-                        info(udev, "file '%s' appeared after %i loops\n", file, (timeout * WAIT_LOOP_PER_SECOND) - loop-1);
+                        log_debug("file '%s' appeared after %i loops", file, (timeout * WAIT_LOOP_PER_SECOND) - loop-1);
                         return 0;
                 }
                 /* make sure, the device did not disappear in the meantime */
                 if (devicepath[0] != '\0' && stat(devicepath, &stats) != 0) {
-                        info(udev, "device disappeared while waiting for '%s'\n", file);
+                        log_debug("device disappeared while waiting for '%s'", file);
                         return -2;
                 }
-                info(udev, "wait for '%s' for %i mseconds\n", file, 1000 / WAIT_LOOP_PER_SECOND);
+                log_debug("wait for '%s' for %i mseconds", file, 1000 / WAIT_LOOP_PER_SECOND);
                 nanosleep(&duration, NULL);
         }
-        info(udev, "waiting for '%s' failed\n", file);
+        log_debug("waiting for '%s' failed", file);
         return -1;
 }
 
-static int attr_subst_subdir(char *attr, size_t len)
-{
+static int attr_subst_subdir(char *attr, size_t len) {
         bool found = false;
 
         if (strstr(attr, "/*/")) {
@@ -863,7 +716,7 @@ static int attr_subst_subdir(char *attr, size_t len)
                 const char *tail;
                 DIR *dir;
 
-                util_strscpy(dirname, sizeof(dirname), attr);
+                strscpy(dirname, sizeof(dirname), attr);
                 pos = strstr(dirname, "/*/");
                 if (pos == NULL)
                         return -1;
@@ -878,7 +731,7 @@ static int attr_subst_subdir(char *attr, size_t len)
 
                                 if (dent->d_name[0] == '.')
                                         continue;
-                                util_strscpyl(attr, len, dirname, "/", dent->d_name, tail, NULL);
+                                strscpyl(attr, len, dirname, "/", dent->d_name, tail, NULL);
                                 if (stat(attr, &stats) == 0) {
                                         found = true;
                                         break;
@@ -891,8 +744,7 @@ static int attr_subst_subdir(char *attr, size_t len)
         return found;
 }
 
-static int get_key(struct udev *udev, char **line, char **key, enum operation_type *op, char **value)
-{
+static int get_key(struct udev *udev, char **line, char **key, enum operation_type *op, char **value) {
         char *linepos;
         char *temp;
 
@@ -917,7 +769,7 @@ static int get_key(struct udev *udev, char **line, char **key, enum operation_ty
                         break;
                 if (linepos[0] == '=')
                         break;
-                if ((linepos[0] == '+') || (linepos[0] == '!') || (linepos[0] == ':'))
+                if ((linepos[0] == '+') || (linepos[0] == '-') || (linepos[0] == '!') || (linepos[0] == ':'))
                         if (linepos[1] == '=')
                                 break;
         }
@@ -941,6 +793,9 @@ static int get_key(struct udev *udev, char **line, char **key, enum operation_ty
         } else if (linepos[0] == '+' && linepos[1] == '=') {
                 *op = OP_ADD;
                 linepos += 2;
+        } else if (linepos[0] == '-' && linepos[1] == '=') {
+                *op = OP_REMOVE;
+                linepos += 2;
         } else if (linepos[0] == '=') {
                 *op = OP_ASSIGN;
                 linepos++;
@@ -972,7 +827,6 @@ static int get_key(struct udev *udev, char **line, char **key, enum operation_ty
                 return -1;
         temp[0] = '\0';
         temp++;
-        dbg(udev, "%s '%s'-'%s'\n", operation_str(*op), *key, *value);
 
         /* move line to next key */
         *line = temp;
@@ -980,8 +834,7 @@ static int get_key(struct udev *udev, char **line, char **key, enum operation_ty
 }
 
 /* extract possible KEY{attr} */
-static char *get_key_attribute(struct udev *udev, char *str)
-{
+static const char *get_key_attribute(struct udev *udev, char *str) {
         char *pos;
         char *attr;
 
@@ -990,11 +843,10 @@ static char *get_key_attribute(struct udev *udev, char *str)
                 attr++;
                 pos = strchr(attr, '}');
                 if (pos == NULL) {
-                        err(udev, "missing closing brace for format\n");
+                        log_error("missing closing brace for format");
                         return NULL;
                 }
                 pos[0] = '\0';
-                dbg(udev, "attribute='%s'\n", attr);
                 return attr;
         }
         return NULL;
@@ -1002,12 +854,11 @@ static char *get_key_attribute(struct udev *udev, char *str)
 
 static int rule_add_key(struct rule_tmp *rule_tmp, enum token_type type,
                         enum operation_type op,
-                        const char *value, const void *data)
-{
+                        const char *value, const void *data) {
         struct token *token = &rule_tmp->token[rule_tmp->token_cur];
         const char *attr = NULL;
 
-        memset(token, 0x00, sizeof(struct token));
+        memzero(token, sizeof(struct token));
 
         switch (type) {
         case TK_M_ACTION:
@@ -1032,14 +883,16 @@ static int rule_add_key(struct rule_tmp *rule_tmp, enum token_type type,
         case TK_A_OWNER:
         case TK_A_GROUP:
         case TK_A_MODE:
+        case TK_A_DEVLINK:
         case TK_A_NAME:
         case TK_A_GOTO:
         case TK_M_TAG:
         case TK_A_TAG:
-                token->key.value_off = add_string(rule_tmp->rules, value);
+        case TK_A_STATIC_NODE:
+                token->key.value_off = rules_add_string(rule_tmp->rules, value);
                 break;
         case TK_M_IMPORT_BUILTIN:
-                token->key.value_off = add_string(rule_tmp->rules, value);
+                token->key.value_off = rules_add_string(rule_tmp->rules, value);
                 token->key.builtin_cmd = *(enum udev_builtin_cmd *)data;
                 break;
         case TK_M_ENV:
@@ -1047,16 +900,13 @@ static int rule_add_key(struct rule_tmp *rule_tmp, enum token_type type,
         case TK_M_ATTRS:
         case TK_A_ATTR:
         case TK_A_ENV:
+        case TK_A_SECLABEL:
                 attr = data;
-                token->key.value_off = add_string(rule_tmp->rules, value);
-                token->key.attr_off = add_string(rule_tmp->rules, attr);
-                break;
-        case TK_A_DEVLINK:
-                token->key.value_off = add_string(rule_tmp->rules, value);
-                token->key.devlink_unique = *(int *)data;
+                token->key.value_off = rules_add_string(rule_tmp->rules, value);
+                token->key.attr_off = rules_add_string(rule_tmp->rules, attr);
                 break;
         case TK_M_TEST:
-                token->key.value_off = add_string(rule_tmp->rules, value);
+                token->key.value_off = rules_add_string(rule_tmp->rules, value);
                 if (data != NULL)
                         token->key.mode = *(mode_t *)data;
                 break;
@@ -1064,8 +914,10 @@ static int rule_add_key(struct rule_tmp *rule_tmp, enum token_type type,
         case TK_A_STRING_ESCAPE_REPLACE:
         case TK_A_DB_PERSIST:
                 break;
-        case TK_A_RUN:
-                token->key.value_off = add_string(rule_tmp->rules, value);
+        case TK_A_RUN_BUILTIN:
+        case TK_A_RUN_PROGRAM:
+                token->key.builtin_cmd = *(enum udev_builtin_cmd *)data;
+                token->key.value_off = rules_add_string(rule_tmp->rules, value);
                 break;
         case TK_A_INOTIFY_WATCH:
         case TK_A_DEVLINK_PRIO:
@@ -1080,19 +932,13 @@ static int rule_add_key(struct rule_tmp *rule_tmp, enum token_type type,
         case TK_A_MODE_ID:
                 token->key.mode = *(mode_t *)data;
                 break;
-        case TK_A_STATIC_NODE:
-                token->key.value_off = add_string(rule_tmp->rules, value);
-                break;
-        case TK_M_EVENT_TIMEOUT:
-                token->key.event_timeout = *(int *)data;
-                break;
         case TK_RULE:
         case TK_M_PARENTS_MIN:
         case TK_M_PARENTS_MAX:
         case TK_M_MAX:
         case TK_END:
         case TK_UNSET:
-                err(rule_tmp->rules->udev, "wrong type %u\n", type);
+                log_error("wrong type %u", type);
                 return -1;
         }
 
@@ -1103,13 +949,13 @@ static int rule_add_key(struct rule_tmp *rule_tmp, enum token_type type,
                 int has_glob;
 
                 has_split = (strchr(value, '|') != NULL);
-                has_glob = (strchr(value, '*') != NULL || strchr(value, '?') != NULL || strchr(value, '[') != NULL);
+                has_glob = string_is_glob(value);
                 if (has_split && has_glob) {
                         glob = GL_SPLIT_GLOB;
                 } else if (has_split) {
                         glob = GL_SPLIT;
                 } else if (has_glob) {
-                        if (strcmp(value, "?*") == 0)
+                        if (streq(value, "?*"))
                                 glob = GL_SOMETHING;
                         else
                                 glob = GL_GLOB;
@@ -1130,7 +976,7 @@ static int rule_add_key(struct rule_tmp *rule_tmp, enum token_type type,
         }
 
         if (attr != NULL) {
-                /* check if property/attribut name has substitution chars */
+                /* check if property/attribute name has substitution chars */
                 if (attr[0] == '[')
                         token->key.attrsubst = SB_SUBSYS;
                 else if (strchr(attr, '%') != NULL || strchr(attr, '$') != NULL)
@@ -1142,15 +988,14 @@ static int rule_add_key(struct rule_tmp *rule_tmp, enum token_type type,
         token->key.type = type;
         token->key.op = op;
         rule_tmp->token_cur++;
-        if (rule_tmp->token_cur >= ARRAY_SIZE(rule_tmp->token)) {
-                err(rule_tmp->rules->udev, "temporary rule array too small\n");
+        if (rule_tmp->token_cur >= ELEMENTSOF(rule_tmp->token)) {
+                log_error("temporary rule array too small");
                 return -1;
         }
         return 0;
 }
 
-static int sort_token(struct udev_rules *rules, struct rule_tmp *rule_tmp)
-{
+static int sort_token(struct udev_rules *rules, struct rule_tmp *rule_tmp) {
         unsigned int i;
         unsigned int start = 0;
         unsigned int end = rule_tmp->token_cur;
@@ -1185,16 +1030,17 @@ static int sort_token(struct udev_rules *rules, struct rule_tmp *rule_tmp)
 }
 
 static int add_rule(struct udev_rules *rules, char *line,
-                    const char *filename, unsigned int filename_off, unsigned int lineno)
-{
+                    const char *filename, unsigned int filename_off, unsigned int lineno) {
         char *linepos;
-        char *attr;
-        struct rule_tmp rule_tmp;
+        const char *attr;
+        struct rule_tmp rule_tmp = {
+                .rules = rules,
+                .rule.type = TK_RULE,
+        };
 
-        memset(&rule_tmp, 0x00, sizeof(struct rule_tmp));
-        rule_tmp.rules = rules;
-        rule_tmp.rule.type = TK_RULE;
-        rule_tmp.rule.rule.filename_off = filename_off;
+        /* the offset in the rule is limited to unsigned short */
+        if (filename_off < USHRT_MAX)
+                rule_tmp.rule.rule.filename_off = filename_off;
         rule_tmp.rule.rule.filename_line = lineno;
 
         linepos = line;
@@ -1203,47 +1049,66 @@ static int add_rule(struct udev_rules *rules, char *line,
                 char *value;
                 enum operation_type op;
 
-                if (get_key(rules->udev, &linepos, &key, &op, &value) != 0)
+                if (get_key(rules->udev, &linepos, &key, &op, &value) != 0) {
+                        /* Avoid erroring on trailing whitespace. This is probably rare
+                         * so save the work for the error case instead of always trying
+                         * to strip the trailing whitespace with strstrip(). */
+                        while (isblank(*linepos))
+                                linepos++;
+
+                        /* If we aren't at the end of the line, this is a parsing error.
+                         * Make a best effort to describe where the problem is. */
+                        if (!strchr(NEWLINE, *linepos)) {
+                                char buf[2] = {*linepos};
+                                _cleanup_free_ char *tmp;
+
+                                tmp = cescape(buf);
+                                log_error("invalid key/value pair in file %s on line %u, starting at character %tu ('%s')",
+                                          filename, lineno, linepos - line + 1, tmp);
+                                if (*linepos == '#')
+                                        log_error("hint: comments can only start at beginning of line");
+                        }
                         break;
+                }
 
-                if (strcmp(key, "ACTION") == 0) {
+                if (streq(key, "ACTION")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid ACTION operation\n");
+                                log_error("invalid ACTION operation");
                                 goto invalid;
                         }
                         rule_add_key(&rule_tmp, TK_M_ACTION, op, value, NULL);
                         continue;
                 }
 
-                if (strcmp(key, "DEVPATH") == 0) {
+                if (streq(key, "DEVPATH")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid DEVPATH operation\n");
+                                log_error("invalid DEVPATH operation");
                                 goto invalid;
                         }
                         rule_add_key(&rule_tmp, TK_M_DEVPATH, op, value, NULL);
                         continue;
                 }
 
-                if (strcmp(key, "KERNEL") == 0) {
+                if (streq(key, "KERNEL")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid KERNEL operation\n");
+                                log_error("invalid KERNEL operation");
                                 goto invalid;
                         }
                         rule_add_key(&rule_tmp, TK_M_KERNEL, op, value, NULL);
                         continue;
                 }
 
-                if (strcmp(key, "SUBSYSTEM") == 0) {
+                if (streq(key, "SUBSYSTEM")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid SUBSYSTEM operation\n");
+                                log_error("invalid SUBSYSTEM operation");
                                 goto invalid;
                         }
                         /* bus, class, subsystem events should all be the same */
-                        if (strcmp(value, "subsystem") == 0 ||
-                            strcmp(value, "bus") == 0 ||
-                            strcmp(value, "class") == 0) {
-                                if (strcmp(value, "bus") == 0 || strcmp(value, "class") == 0)
-                                        err(rules->udev, "'%s' must be specified as 'subsystem' \n"
+                        if (streq(value, "subsystem") ||
+                            streq(value, "bus") ||
+                            streq(value, "class")) {
+                                if (streq(value, "bus") || streq(value, "class"))
+                                        log_error("'%s' must be specified as 'subsystem' "
                                             "please fix it in %s:%u", value, filename, lineno);
                                 rule_add_key(&rule_tmp, TK_M_SUBSYSTEM, op, "subsystem|class|bus", NULL);
                         } else
@@ -1251,19 +1116,23 @@ static int add_rule(struct udev_rules *rules, char *line,
                         continue;
                 }
 
-                if (strcmp(key, "DRIVER") == 0) {
+                if (streq(key, "DRIVER")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid DRIVER operation\n");
+                                log_error("invalid DRIVER operation");
                                 goto invalid;
                         }
                         rule_add_key(&rule_tmp, TK_M_DRIVER, op, value, NULL);
                         continue;
                 }
 
-                if (strncmp(key, "ATTR{", sizeof("ATTR{")-1) == 0) {
-                        attr = get_key_attribute(rules->udev, key + sizeof("ATTR")-1);
+                if (startswith(key, "ATTR{")) {
+                        attr = get_key_attribute(rules->udev, key + strlen("ATTR"));
                         if (attr == NULL) {
-                                err(rules->udev, "error parsing ATTR attribute\n");
+                                log_error("error parsing ATTR attribute");
+                                goto invalid;
+                        }
+                        if (op == OP_REMOVE) {
+                                log_error("invalid ATTR operation");
                                 goto invalid;
                         }
                         if (op < OP_MATCH_MAX) {
@@ -1274,66 +1143,85 @@ static int add_rule(struct udev_rules *rules, char *line,
                         continue;
                 }
 
-                if (strcmp(key, "KERNELS") == 0) {
+                if (startswith(key, "SECLABEL{")) {
+                        attr = get_key_attribute(rules->udev, key + strlen("SECLABEL"));
+                        if (!attr) {
+                                log_error("error parsing SECLABEL attribute");
+                                goto invalid;
+                        }
+                        if (op == OP_REMOVE) {
+                                log_error("invalid SECLABEL operation");
+                                goto invalid;
+                        }
+
+                        rule_add_key(&rule_tmp, TK_A_SECLABEL, op, value, attr);
+                        continue;
+                }
+
+                if (streq(key, "KERNELS")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid KERNELS operation\n");
+                                log_error("invalid KERNELS operation");
                                 goto invalid;
                         }
                         rule_add_key(&rule_tmp, TK_M_KERNELS, op, value, NULL);
                         continue;
                 }
 
-                if (strcmp(key, "SUBSYSTEMS") == 0) {
+                if (streq(key, "SUBSYSTEMS")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid SUBSYSTEMS operation\n");
+                                log_error("invalid SUBSYSTEMS operation");
                                 goto invalid;
                         }
                         rule_add_key(&rule_tmp, TK_M_SUBSYSTEMS, op, value, NULL);
                         continue;
                 }
 
-                if (strcmp(key, "DRIVERS") == 0) {
+                if (streq(key, "DRIVERS")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid DRIVERS operation\n");
+                                log_error("invalid DRIVERS operation");
                                 goto invalid;
                         }
                         rule_add_key(&rule_tmp, TK_M_DRIVERS, op, value, NULL);
                         continue;
                 }
 
-                if (strncmp(key, "ATTRS{", sizeof("ATTRS{")-1) == 0) {
+                if (startswith(key, "ATTRS{")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid ATTRS operation\n");
+                                log_error("invalid ATTRS operation");
                                 goto invalid;
                         }
-                        attr = get_key_attribute(rules->udev, key + sizeof("ATTRS")-1);
+                        attr = get_key_attribute(rules->udev, key + strlen("ATTRS"));
                         if (attr == NULL) {
-                                err(rules->udev, "error parsing ATTRS attribute\n");
+                                log_error("error parsing ATTRS attribute");
                                 goto invalid;
                         }
-                        if (strncmp(attr, "device/", 7) == 0)
-                                err(rules->udev, "the 'device' link may not be available in a future kernel, "
+                        if (startswith(attr, "device/"))
+                                log_error("the 'device' link may not be available in a future kernel, "
                                     "please fix it in %s:%u", filename, lineno);
                         else if (strstr(attr, "../") != NULL)
-                                err(rules->udev, "do not reference parent sysfs directories directly, "
+                                log_error("do not reference parent sysfs directories directly, "
                                     "it may break with a future kernel, please fix it in %s:%u", filename, lineno);
                         rule_add_key(&rule_tmp, TK_M_ATTRS, op, value, attr);
                         continue;
                 }
 
-                if (strcmp(key, "TAGS") == 0) {
+                if (streq(key, "TAGS")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid TAGS operation\n");
+                                log_error("invalid TAGS operation");
                                 goto invalid;
                         }
                         rule_add_key(&rule_tmp, TK_M_TAGS, op, value, NULL);
                         continue;
                 }
 
-                if (strncmp(key, "ENV{", sizeof("ENV{")-1) == 0) {
-                        attr = get_key_attribute(rules->udev, key + sizeof("ENV")-1);
+                if (startswith(key, "ENV{")) {
+                        attr = get_key_attribute(rules->udev, key + strlen("ENV"));
                         if (attr == NULL) {
-                                err(rules->udev, "error parsing ENV attribute\n");
+                                log_error("error parsing ENV attribute");
+                                goto invalid;
+                        }
+                        if (op == OP_REMOVE) {
+                                log_error("invalid ENV operation");
                                 goto invalid;
                         }
                         if (op < OP_MATCH_MAX) {
@@ -1355,18 +1243,19 @@ static int add_rule(struct udev_rules *rules, char *line,
                                 };
                                 unsigned int i;
 
-                                for (i = 0; i < ARRAY_SIZE(blacklist); i++)
-                                        if (strcmp(attr, blacklist[i]) == 0) {
-                                                err(rules->udev, "invalid ENV attribute, '%s' can not be set %s:%u\n", attr, filename, lineno);
+                                for (i = 0; i < ELEMENTSOF(blacklist); i++) {
+                                        if (!streq(attr, blacklist[i]))
                                                 continue;
-                                        }
+                                        log_error("invalid ENV attribute, '%s' can not be set %s:%u", attr, filename, lineno);
+                                        goto invalid;
+                                }
                                 if (rule_add_key(&rule_tmp, TK_A_ENV, op, value, attr) != 0)
                                         goto invalid;
                         }
                         continue;
                 }
 
-                if (strcmp(key, "TAG") == 0) {
+                if (streq(key, "TAG")) {
                         if (op < OP_MATCH_MAX)
                                 rule_add_key(&rule_tmp, TK_M_TAG, op, value, NULL);
                         else
@@ -1374,73 +1263,76 @@ static int add_rule(struct udev_rules *rules, char *line,
                         continue;
                 }
 
-                if (strcmp(key, "PROGRAM") == 0) {
+                if (streq(key, "PROGRAM")) {
+                        if (op == OP_REMOVE) {
+                                log_error("invalid PROGRAM operation");
+                                goto invalid;
+                        }
                         rule_add_key(&rule_tmp, TK_M_PROGRAM, op, value, NULL);
                         continue;
                 }
 
-                if (strcmp(key, "RESULT") == 0) {
+                if (streq(key, "RESULT")) {
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid RESULT operation\n");
+                                log_error("invalid RESULT operation");
                                 goto invalid;
                         }
                         rule_add_key(&rule_tmp, TK_M_RESULT, op, value, NULL);
                         continue;
                 }
 
-                if (strncmp(key, "IMPORT", sizeof("IMPORT")-1) == 0) {
-                        attr = get_key_attribute(rules->udev, key + sizeof("IMPORT")-1);
+                if (startswith(key, "IMPORT")) {
+                        attr = get_key_attribute(rules->udev, key + strlen("IMPORT"));
                         if (attr == NULL) {
-                                err(rules->udev, "IMPORT{} type missing, ignoring IMPORT %s:%u\n", filename, lineno);
+                                log_error("IMPORT{} type missing, ignoring IMPORT %s:%u", filename, lineno);
                                 continue;
                         }
-                        if (strstr(attr, "program")) {
+                        if (op == OP_REMOVE) {
+                                log_error("invalid IMPORT operation");
+                                goto invalid;
+                        }
+                        if (streq(attr, "program")) {
                                 /* find known built-in command */
                                 if (value[0] != '/') {
                                         enum udev_builtin_cmd cmd;
 
                                         cmd = udev_builtin_lookup(value);
                                         if (cmd < UDEV_BUILTIN_MAX) {
-                                                info(rules->udev, "IMPORT found builtin '%s', replacing %s:%u\n",
-                                                     value, filename, lineno);
+                                                log_debug("IMPORT found builtin '%s', replacing %s:%u",
+                                                          value, filename, lineno);
                                                 rule_add_key(&rule_tmp, TK_M_IMPORT_BUILTIN, op, value, &cmd);
                                                 continue;
                                         }
                                 }
-                                dbg(rules->udev, "IMPORT will be executed\n");
                                 rule_add_key(&rule_tmp, TK_M_IMPORT_PROG, op, value, NULL);
-                        } else if (strstr(attr, "builtin")) {
+                        } else if (streq(attr, "builtin")) {
                                 enum udev_builtin_cmd cmd = udev_builtin_lookup(value);
 
-                                dbg(rules->udev, "IMPORT execute builtin\n");
                                 if (cmd < UDEV_BUILTIN_MAX)
                                         rule_add_key(&rule_tmp, TK_M_IMPORT_BUILTIN, op, value, &cmd);
                                 else
-                                        err(rules->udev, "IMPORT{builtin}: '%s' unknown %s:%u\n", value, filename, lineno);
-                        } else if (strstr(attr, "file")) {
-                                dbg(rules->udev, "IMPORT will be included as file\n");
+                                        log_error("IMPORT{builtin}: '%s' unknown %s:%u", value, filename, lineno);
+                        } else if (streq(attr, "file")) {
                                 rule_add_key(&rule_tmp, TK_M_IMPORT_FILE, op, value, NULL);
-                        } else if (strstr(attr, "db")) {
-                                dbg(rules->udev, "IMPORT will include db values\n");
+                        } else if (streq(attr, "db")) {
                                 rule_add_key(&rule_tmp, TK_M_IMPORT_DB, op, value, NULL);
-                        } else if (strstr(attr, "cmdline")) {
-                                dbg(rules->udev, "IMPORT will include db values\n");
+                        } else if (streq(attr, "cmdline")) {
                                 rule_add_key(&rule_tmp, TK_M_IMPORT_CMDLINE, op, value, NULL);
-                        } else if (strstr(attr, "parent")) {
-                                dbg(rules->udev, "IMPORT will include the parent values\n");
+                        } else if (streq(attr, "parent")) {
                                 rule_add_key(&rule_tmp, TK_M_IMPORT_PARENT, op, value, NULL);
-                        }
+                        } else
+                                log_error("IMPORT{} unknown type, ignoring IMPORT %s:%u", filename, lineno);
                         continue;
                 }
 
-                if (strncmp(key, "TEST", sizeof("TEST")-1) == 0) {
+                if (startswith(key, "TEST")) {
                         mode_t mode = 0;
 
                         if (op > OP_MATCH_MAX) {
-                                err(rules->udev, "invalid TEST operation\n");
+                                log_error("invalid TEST operation");
                                 goto invalid;
                         }
-                        attr = get_key_attribute(rules->udev, key + sizeof("TEST")-1);
+                        attr = get_key_attribute(rules->udev, key + strlen("TEST"));
                         if (attr != NULL) {
                                 mode = strtol(attr, NULL, 8);
                                 rule_add_key(&rule_tmp, TK_M_TEST, op, value, &mode);
@@ -1450,41 +1342,76 @@ static int add_rule(struct udev_rules *rules, char *line,
                         continue;
                 }
 
-                if (strcmp(key, "RUN") == 0) {
-                        if (strncmp(value, "socket:", 7) == 0)
-                                err(rules->udev, "RUN+=\"socket:...\" support will be removed from a future udev release. "
-                                    "Please remove it from: %s:%u and use libudev to subscribe to events.\n", filename, lineno);
-                        rule_add_key(&rule_tmp, TK_A_RUN, op, value, NULL);
+                if (startswith(key, "RUN")) {
+                        attr = get_key_attribute(rules->udev, key + strlen("RUN"));
+                        if (attr == NULL)
+                                attr = "program";
+                        if (op == OP_REMOVE) {
+                                log_error("invalid RUN operation");
+                                goto invalid;
+                        }
+
+                        if (streq(attr, "builtin")) {
+                                enum udev_builtin_cmd cmd = udev_builtin_lookup(value);
+
+                                if (cmd < UDEV_BUILTIN_MAX)
+                                        rule_add_key(&rule_tmp, TK_A_RUN_BUILTIN, op, value, &cmd);
+                                else
+                                        log_error("RUN{builtin}: '%s' unknown %s:%u", value, filename, lineno);
+                        } else if (streq(attr, "program")) {
+                                enum udev_builtin_cmd cmd = UDEV_BUILTIN_MAX;
+
+                                rule_add_key(&rule_tmp, TK_A_RUN_PROGRAM, op, value, &cmd);
+                        } else {
+                                log_error("RUN{} unknown type, ignoring RUN %s:%u", filename, lineno);
+                        }
+
                         continue;
                 }
 
-                if (strcmp(key, "WAIT_FOR") == 0 || strcmp(key, "WAIT_FOR_SYSFS") == 0) {
+                if (streq(key, "WAIT_FOR") || streq(key, "WAIT_FOR_SYSFS")) {
+                        if (op == OP_REMOVE) {
+                                log_error("invalid WAIT_FOR/WAIT_FOR_SYSFS operation");
+                                goto invalid;
+                        }
                         rule_add_key(&rule_tmp, TK_M_WAITFOR, 0, value, NULL);
                         continue;
                 }
 
-                if (strcmp(key, "LABEL") == 0) {
-                        rule_tmp.rule.rule.label_off = add_string(rules, value);
+                if (streq(key, "LABEL")) {
+                        if (op == OP_REMOVE) {
+                                log_error("invalid LABEL operation");
+                                goto invalid;
+                        }
+                        rule_tmp.rule.rule.label_off = rules_add_string(rules, value);
                         continue;
                 }
 
-                if (strcmp(key, "GOTO") == 0) {
+                if (streq(key, "GOTO")) {
+                        if (op == OP_REMOVE) {
+                                log_error("invalid GOTO operation");
+                                goto invalid;
+                        }
                         rule_add_key(&rule_tmp, TK_A_GOTO, 0, value, NULL);
                         continue;
                 }
 
-                if (strncmp(key, "NAME", sizeof("NAME")-1) == 0) {
+                if (startswith(key, "NAME")) {
+                        if (op == OP_REMOVE) {
+                                log_error("invalid NAME operation");
+                                goto invalid;
+                        }
                         if (op < OP_MATCH_MAX) {
                                 rule_add_key(&rule_tmp, TK_M_NAME, op, value, NULL);
                         } else {
-                                if (strcmp(value, "%k") == 0) {
-                                        err(rules->udev, "NAME=\"%%k\" is ignored, because it breaks kernel supplied names, "
+                                if (streq(value, "%k")) {
+                                        log_error("NAME=\"%%k\" is ignored, because it breaks kernel supplied names, "
                                             "please remove it from %s:%u\n", filename, lineno);
                                         continue;
                                 }
                                 if (value[0] == '\0') {
-                                        info(rules->udev, "NAME=\"\" is ignored, because udev will not delete any device nodes, "
-                                             "please remove it from %s:%u\n", filename, lineno);
+                                        log_debug("NAME=\"\" is ignored, because udev will not delete any device nodes, "
+                                                  "please remove it from %s:%u\n", filename, lineno);
                                         continue;
                                 }
                                 rule_add_key(&rule_tmp, TK_A_NAME, op, value, NULL);
@@ -1493,25 +1420,28 @@ static int add_rule(struct udev_rules *rules, char *line,
                         continue;
                 }
 
-                if (strncmp(key, "SYMLINK", sizeof("SYMLINK")-1) == 0) {
-                        if (op < OP_MATCH_MAX) {
-                                rule_add_key(&rule_tmp, TK_M_DEVLINK, op, value, NULL);
-                        } else {
-                                int flag = 0;
-
-                                attr = get_key_attribute(rules->udev, key + sizeof("SYMLINK")-1);
-                                if (attr != NULL && strstr(attr, "unique") != NULL)
-                                        flag = 1;
-                                rule_add_key(&rule_tmp, TK_A_DEVLINK, op, value, &flag);
+                if (streq(key, "SYMLINK")) {
+                        if (op == OP_REMOVE) {
+                                log_error("invalid SYMLINK operation");
+                                goto invalid;
                         }
+                        if (op < OP_MATCH_MAX)
+                                rule_add_key(&rule_tmp, TK_M_DEVLINK, op, value, NULL);
+                        else
+                                rule_add_key(&rule_tmp, TK_A_DEVLINK, op, value, NULL);
                         rule_tmp.rule.rule.can_set_name = true;
                         continue;
                 }
 
-                if (strcmp(key, "OWNER") == 0) {
+                if (streq(key, "OWNER")) {
                         uid_t uid;
                         char *endptr;
 
+                        if (op == OP_REMOVE) {
+                                log_error("invalid OWNER operation");
+                                goto invalid;
+                        }
+
                         uid = strtoul(value, &endptr, 10);
                         if (endptr[0] == '\0') {
                                 rule_add_key(&rule_tmp, TK_A_OWNER_ID, op, NULL, &uid);
@@ -1525,10 +1455,15 @@ static int add_rule(struct udev_rules *rules, char *line,
                         continue;
                 }
 
-                if (strcmp(key, "GROUP") == 0) {
+                if (streq(key, "GROUP")) {
                         gid_t gid;
                         char *endptr;
 
+                        if (op == OP_REMOVE) {
+                                log_error("invalid GROUP operation");
+                                goto invalid;
+                        }
+
                         gid = strtoul(value, &endptr, 10);
                         if (endptr[0] == '\0') {
                                 rule_add_key(&rule_tmp, TK_A_GROUP_ID, op, NULL, &gid);
@@ -1542,10 +1477,15 @@ static int add_rule(struct udev_rules *rules, char *line,
                         continue;
                 }
 
-                if (strcmp(key, "MODE") == 0) {
+                if (streq(key, "MODE")) {
                         mode_t mode;
                         char *endptr;
 
+                        if (op == OP_REMOVE) {
+                                log_error("invalid MODE operation");
+                                goto invalid;
+                        }
+
                         mode = strtol(value, &endptr, 8);
                         if (endptr[0] == '\0')
                                 rule_add_key(&rule_tmp, TK_A_MODE_ID, op, NULL, &mode);
@@ -1555,31 +1495,27 @@ static int add_rule(struct udev_rules *rules, char *line,
                         continue;
                 }
 
-                if (strcmp(key, "OPTIONS") == 0) {
+                if (streq(key, "OPTIONS")) {
                         const char *pos;
 
+                        if (op == OP_REMOVE) {
+                                log_error("invalid OPTIONS operation");
+                                goto invalid;
+                        }
+
                         pos = strstr(value, "link_priority=");
                         if (pos != NULL) {
                                 int prio = atoi(&pos[strlen("link_priority=")]);
 
                                 rule_add_key(&rule_tmp, TK_A_DEVLINK_PRIO, op, NULL, &prio);
-                                dbg(rules->udev, "link priority=%i\n", prio);
-                        }
-
-                        pos = strstr(value, "event_timeout=");
-                        if (pos != NULL) {
-                                int tout = atoi(&pos[strlen("event_timeout=")]);
-
-                                rule_add_key(&rule_tmp, TK_M_EVENT_TIMEOUT, op, NULL, &tout);
-                                dbg(rules->udev, "event timeout=%i\n", tout);
                         }
 
                         pos = strstr(value, "string_escape=");
                         if (pos != NULL) {
                                 pos = &pos[strlen("string_escape=")];
-                                if (strncmp(pos, "none", strlen("none")) == 0)
+                                if (startswith(pos, "none"))
                                         rule_add_key(&rule_tmp, TK_A_STRING_ESCAPE_NONE, op, NULL, NULL);
-                                else if (strncmp(pos, "replace", strlen("replace")) == 0)
+                                else if (startswith(pos, "replace"))
                                         rule_add_key(&rule_tmp, TK_A_STRING_ESCAPE_REPLACE, op, NULL, NULL);
                         }
 
@@ -1592,14 +1528,12 @@ static int add_rule(struct udev_rules *rules, char *line,
                                 const int off = 0;
 
                                 rule_add_key(&rule_tmp, TK_A_INOTIFY_WATCH, op, NULL, &off);
-                                dbg(rules->udev, "inotify watch of device disabled\n");
                         } else {
                                 pos = strstr(value, "watch");
                                 if (pos != NULL) {
                                         const int on = 1;
 
                                         rule_add_key(&rule_tmp, TK_A_INOTIFY_WATCH, op, NULL, &on);
-                                        dbg(rules->udev, "inotify watch of device requested\n");
                                 }
                         }
 
@@ -1612,7 +1546,7 @@ static int add_rule(struct udev_rules *rules, char *line,
                         continue;
                 }
 
-                err(rules->udev, "unknown key '%s' in %s:%u\n", key, filename, lineno);
+                log_error("unknown key '%s' in %s:%u", key, filename, lineno);
                 goto invalid;
         }
 
@@ -1627,25 +1561,34 @@ static int add_rule(struct udev_rules *rules, char *line,
 
         return 0;
 invalid:
-        err(rules->udev, "invalid rule '%s:%u'\n", filename, lineno);
+        log_error("invalid rule '%s:%u'", filename, lineno);
         return -1;
 }
 
-static int parse_file(struct udev_rules *rules, const char *filename, unsigned short filename_off)
-{
-        FILE *f;
+static int parse_file(struct udev_rules *rules, const char *filename) {
+        _cleanup_fclose_ FILE *f = NULL;
         unsigned int first_token;
+        unsigned int filename_off;
         char line[UTIL_LINE_SIZE];
         int line_nr = 0;
         unsigned int i;
 
-        info(rules->udev, "reading '%s' as rules file\n", filename);
+        f = fopen(filename, "re");
+        if (!f) {
+                if (errno == ENOENT)
+                        return 0;
+                else
+                        return -errno;
+        }
 
-        f = fopen(filename, "r");
-        if (f == NULL)
-                return -1;
+        if (null_or_empty_fd(fileno(f))) {
+                log_debug("Skipping empty file: %s", filename);
+                return 0;
+        } else
+                log_debug("Reading rules file: %s", filename);
 
         first_token = rules->token_cur;
+        filename_off = rules_add_string(rules, filename);
 
         while (fgets(line, sizeof(line), f) != NULL) {
                 char *key;
@@ -1676,17 +1619,16 @@ static int parse_file(struct udev_rules *rules, const char *filename, unsigned s
                 }
 
                 if (len+1 >= sizeof(line)) {
-                        err(rules->udev, "line too long '%s':%u, ignored\n", filename, line_nr);
+                        log_error("line too long '%s':%u, ignored", filename, line_nr);
                         continue;
                 }
                 add_rule(rules, key, filename, filename_off, line_nr);
         }
-        fclose(f);
 
         /* link GOTOs to LABEL rules in this file to be able to fast-forward */
         for (i = first_token+1; i < rules->token_cur; i++) {
                 if (rules->tokens[i].type == TK_A_GOTO) {
-                        char *label = &rules->buf[rules->tokens[i].key.value_off];
+                        char *label = rules_str(rules, rules->tokens[i].key.value_off);
                         unsigned int j;
 
                         for (j = i+1; j < rules->token_cur; j++) {
@@ -1694,68 +1636,26 @@ static int parse_file(struct udev_rules *rules, const char *filename, unsigned s
                                         continue;
                                 if (rules->tokens[j].rule.label_off == 0)
                                         continue;
-                                if (strcmp(label, &rules->buf[rules->tokens[j].rule.label_off]) != 0)
+                                if (!streq(label, rules_str(rules, rules->tokens[j].rule.label_off)))
                                         continue;
                                 rules->tokens[i].key.rule_goto = j;
                                 break;
                         }
                         if (rules->tokens[i].key.rule_goto == 0)
-                                err(rules->udev, "GOTO '%s' has no matching label in: '%s'\n", label, filename);
+                                log_error("GOTO '%s' has no matching label in: '%s'", label, filename);
                 }
         }
         return 0;
 }
 
-static int add_matching_files(struct udev *udev, struct udev_list *file_list, const char *dirname, const char *suffix)
-{
-        DIR *dir;
-        struct dirent *dent;
-        char filename[UTIL_PATH_SIZE];
-
-        dbg(udev, "open directory '%s'\n", dirname);
-        dir = opendir(dirname);
-        if (dir == NULL) {
-                info(udev, "unable to open '%s': %m\n", dirname);
-                return -1;
-        }
-
-        for (dent = readdir(dir); dent != NULL; dent = readdir(dir)) {
-                if (dent->d_name[0] == '.')
-                        continue;
-
-                /* look for file matching with specified suffix */
-                if (suffix != NULL) {
-                        const char *ext;
-
-                        ext = strrchr(dent->d_name, '.');
-                        if (ext == NULL)
-                                continue;
-                        if (strcmp(ext, suffix) != 0)
-                                continue;
-                }
-                util_strscpyl(filename, sizeof(filename), dirname, "/", dent->d_name, NULL);
-                dbg(udev, "put file '%s' into list\n", filename);
-                /*
-                 * the basename is the key, the filename the value
-                 * identical basenames from different directories override each other
-                 * entries are sorted after basename
-                 */
-                udev_list_entry_add(file_list, dent->d_name, filename);
-        }
-
-        closedir(dir);
-        return 0;
-}
-
-struct udev_rules *udev_rules_new(struct udev *udev, int resolve_names)
-{
+struct udev_rules *udev_rules_new(struct udev *udev, int resolve_names) {
         struct udev_rules *rules;
         struct udev_list file_list;
-        struct udev_list_entry *file_loop;
         struct token end_token;
-        char **s;
+        char **files, **f;
+        int r;
 
-        rules = calloc(1, sizeof(struct udev_rules));
+        rules = new0(struct udev_rules, 1);
         if (rules == NULL)
                 return NULL;
         rules->udev = udev;
@@ -1764,107 +1664,45 @@ struct udev_rules *udev_rules_new(struct udev *udev, int resolve_names)
 
         /* init token array and string buffer */
         rules->tokens = malloc(PREALLOC_TOKEN * sizeof(struct token));
-        if (rules->tokens == NULL) {
-                free(rules);
-                return NULL;
-        }
+        if (rules->tokens == NULL)
+                return udev_rules_unref(rules);
         rules->token_max = PREALLOC_TOKEN;
 
-        rules->buf = malloc(PREALLOC_STRBUF);
-        if (rules->buf == NULL) {
-                free(rules->tokens);
-                free(rules);
-                return NULL;
-        }
-        rules->buf_max = PREALLOC_STRBUF;
-        /* offset 0 is always '\0' */
-        rules->buf[0] = '\0';
-        rules->buf_cur = 1;
-        dbg(udev, "prealloc %zu bytes tokens (%u * %zu bytes), %zu bytes buffer\n",
-            rules->token_max * sizeof(struct token), rules->token_max, sizeof(struct token), rules->buf_max);
-
-        rules->trie_nodes = malloc(PREALLOC_TRIE * sizeof(struct trie_node));
-        if (rules->trie_nodes == NULL) {
-                free(rules->buf);
-                free(rules->tokens);
-                free(rules);
-                return NULL;
-        }
-        rules->trie_nodes_max = PREALLOC_TRIE;
-        /* offset 0 is the trie root, with an empty string */
-        memset(rules->trie_nodes, 0x00, sizeof(struct trie_node));
-        rules->trie_nodes_cur = 1;
-
-        for (udev_get_rules_path(udev, &s, NULL); *s != NULL; s++)
-                add_matching_files(udev, &file_list, *s, ".rules");
-
-        /* add all filenames to the string buffer */
-        udev_list_entry_foreach(file_loop, udev_list_get_entry(&file_list)) {
-                const char *filename = udev_list_entry_get_value(file_loop);
-                unsigned int filename_off;
-
-                filename_off = add_string(rules, filename);
-                /* the offset in the rule is limited to unsigned short */
-                if (filename_off < USHRT_MAX)
-                        udev_list_entry_set_num(file_loop, filename_off);
-        }
+        rules->strbuf = strbuf_new();
+        if (!rules->strbuf)
+                return udev_rules_unref(rules);
 
-        /* parse all rules files */
-        udev_list_entry_foreach(file_loop, udev_list_get_entry(&file_list)) {
-                const char *filename = udev_list_entry_get_value(file_loop);
-                unsigned int filename_off = udev_list_entry_get_num(file_loop);
-                struct stat st;
+        udev_rules_check_timestamp(rules);
 
-                if (stat(filename, &st) != 0) {
-                        err(udev, "can not find '%s': %m\n", filename);
-                        continue;
-                }
-                if (S_ISREG(st.st_mode) && st.st_size <= 0) {
-                        info(udev, "ignore empty '%s'\n", filename);
-                        continue;
-                }
-                if (S_ISCHR(st.st_mode)) {
-                        info(udev, "ignore masked '%s'\n", filename);
-                        continue;
-                }
-                parse_file(rules, filename, filename_off);
+        r = conf_files_list_strv(&files, ".rules", NULL, rules_dirs);
+        if (r < 0) {
+                log_error_errno(r, "failed to enumerate rules files: %m");
+                return udev_rules_unref(rules);
         }
-        udev_list_cleanup(&file_list);
 
-        memset(&end_token, 0x00, sizeof(struct token));
-        end_token.type = TK_END;
-        add_token(rules, &end_token);
+        /*
+         * The offset value in the rules strct is limited; add all
+         * rules file names to the beginning of the string buffer.
+         */
+        STRV_FOREACH(f, files)
+                rules_add_string(rules, *f);
 
-        /* shrink allocated token and string buffer */
-        if (rules->token_cur < rules->token_max) {
-                struct token *tokens;
+        STRV_FOREACH(f, files)
+                parse_file(rules, *f);
 
-                tokens = realloc(rules->tokens, rules->token_cur * sizeof(struct token));
-                if (tokens != NULL || rules->token_cur == 0) {
-                        rules->tokens = tokens;
-                        rules->token_max = rules->token_cur;
-                }
-        }
-        if (rules->buf_cur < rules->buf_max) {
-                char *buf;
+        strv_free(files);
 
-                buf = realloc(rules->buf, rules->buf_cur);
-                if (buf != NULL || rules->buf_cur == 0) {
-                        rules->buf = buf;
-                        rules->buf_max = rules->buf_cur;
-                }
-        }
-        info(udev, "rules use %zu bytes tokens (%u * %zu bytes), %zu bytes buffer\n",
-             rules->token_max * sizeof(struct token), rules->token_max, sizeof(struct token), rules->buf_max);
-        info(udev, "temporary index used %zu bytes (%u * %zu bytes)\n",
-             rules->trie_nodes_cur * sizeof(struct trie_node),
-             rules->trie_nodes_cur, sizeof(struct trie_node));
-
-        /* cleanup trie */
-        free(rules->trie_nodes);
-        rules->trie_nodes = NULL;
-        rules->trie_nodes_cur = 0;
-        rules->trie_nodes_max = 0;
+        memzero(&end_token, sizeof(struct token));
+        end_token.type = TK_END;
+        add_token(rules, &end_token);
+        log_debug("rules contain %zu bytes tokens (%u * %zu bytes), %zu bytes strings",
+                  rules->token_max * sizeof(struct token), rules->token_max, sizeof(struct token), rules->strbuf->len);
+
+        /* cleanup temporary strbuf data */
+        log_debug("%zu strings (%zu bytes), %zu de-duplicated (%zu bytes), %zu trie nodes used",
+                  rules->strbuf->in_count, rules->strbuf->in_len,
+                  rules->strbuf->dedup_count, rules->strbuf->dedup_len, rules->strbuf->nodes_count);
+        strbuf_complete(rules->strbuf);
 
         /* cleanup uid/gid cache */
         free(rules->uids);
@@ -1880,22 +1718,26 @@ struct udev_rules *udev_rules_new(struct udev *udev, int resolve_names)
         return rules;
 }
 
-struct udev_rules *udev_rules_unref(struct udev_rules *rules)
-{
+struct udev_rules *udev_rules_unref(struct udev_rules *rules) {
         if (rules == NULL)
                 return NULL;
         free(rules->tokens);
-        free(rules->buf);
-        free(rules->trie_nodes);
+        strbuf_cleanup(rules->strbuf);
         free(rules->uids);
         free(rules->gids);
         free(rules);
         return NULL;
 }
 
-static int match_key(struct udev_rules *rules, struct token *token, const char *val)
-{
-        char *key_value = &rules->buf[token->key.value_off];
+bool udev_rules_check_timestamp(struct udev_rules *rules) {
+        if (!rules)
+                return false;
+
+        return paths_check_timestamp(rules_dirs, &rules->dirs_ts_usec, true);
+}
+
+static int match_key(struct udev_rules *rules, struct token *token, const char *val) {
+        char *key_value = rules_str(rules, token->key.value_off);
         char *pos;
         bool match = false;
 
@@ -1904,33 +1746,33 @@ static int match_key(struct udev_rules *rules, struct token *token, const char *
 
         switch (token->key.glob) {
         case GL_PLAIN:
-                match = (strcmp(key_value, val) == 0);
+                match = (streq(key_value, val));
                 break;
         case GL_GLOB:
                 match = (fnmatch(key_value, val, 0) == 0);
                 break;
         case GL_SPLIT:
                 {
-                        const char *split;
+                        const char *s;
                         size_t len;
 
-                        split = &rules->buf[token->key.value_off];
+                        s = rules_str(rules, token->key.value_off);
                         len = strlen(val);
                         for (;;) {
                                 const char *next;
 
-                                next = strchr(split, '|');
+                                next = strchr(s, '|');
                                 if (next != NULL) {
-                                        size_t matchlen = (size_t)(next - split);
+                                        size_t matchlen = (size_t)(next - s);
 
-                                        match = (matchlen == len && strncmp(split, val, matchlen) == 0);
+                                        match = (matchlen == len && strneq(s, val, matchlen));
                                         if (match)
                                                 break;
                                 } else {
-                                        match = (strcmp(split, val) == 0);
+                                        match = (streq(s, val));
                                         break;
                                 }
-                                split = &next[1];
+                                s = &next[1];
                         }
                         break;
                 }
@@ -1938,7 +1780,7 @@ static int match_key(struct udev_rules *rules, struct token *token, const char *
                 {
                         char value[UTIL_PATH_SIZE];
 
-                        util_strscpy(value, sizeof(value), &rules->buf[token->key.value_off]);
+                        strscpy(value, sizeof(value), rules_str(rules, token->key.value_off));
                         key_value = value;
                         while (key_value != NULL) {
                                 pos = strchr(key_value, '|');
@@ -1946,7 +1788,6 @@ static int match_key(struct udev_rules *rules, struct token *token, const char *
                                         pos[0] = '\0';
                                         pos = &pos[1];
                                 }
-                                dbg(rules->udev, "match %s '%s' <-> '%s'\n", token_str(token->type), key_value, val);
                                 match = (fnmatch(key_value, val, 0) == 0);
                                 if (match)
                                         break;
@@ -1961,27 +1802,21 @@ static int match_key(struct udev_rules *rules, struct token *token, const char *
                 return -1;
         }
 
-        if (match && (token->key.op == OP_MATCH)) {
-                dbg(rules->udev, "%s is true (matching value)\n", token_str(token->type));
+        if (match && (token->key.op == OP_MATCH))
                 return 0;
-        }
-        if (!match && (token->key.op == OP_NOMATCH)) {
-                dbg(rules->udev, "%s is true (non-matching value)\n", token_str(token->type));
+        if (!match && (token->key.op == OP_NOMATCH))
                 return 0;
-        }
-        dbg(rules->udev, "%s is not true\n", token_str(token->type));
         return -1;
 }
 
-static int match_attr(struct udev_rules *rules, struct udev_device *dev, struct udev_event *event, struct token *cur)
-{
+static int match_attr(struct udev_rules *rules, struct udev_device *dev, struct udev_event *event, struct token *cur) {
         const char *name;
         char nbuf[UTIL_NAME_SIZE];
         const char *value;
         char vbuf[UTIL_NAME_SIZE];
         size_t len;
 
-        name = &rules->buf[cur->key.attr_off];
+        name = rules_str(rules, cur->key.attr_off);
         switch (cur->key.attrsubst) {
         case SB_FORMAT:
                 udev_event_apply_format(event, name, nbuf, sizeof(nbuf));
@@ -2007,16 +1842,15 @@ static int match_attr(struct udev_rules *rules, struct udev_device *dev, struct
                 const char *key_value;
                 size_t klen;
 
-                key_value = &rules->buf[cur->key.value_off];
+                key_value = rules_str(rules, cur->key.value_off);
                 klen = strlen(key_value);
                 if (klen > 0 && !isspace(key_value[klen-1])) {
                         if (value != vbuf) {
-                                util_strscpy(vbuf, sizeof(vbuf), value);
+                                strscpy(vbuf, sizeof(vbuf), value);
                                 value = vbuf;
                         }
                         while (len > 0 && isspace(vbuf[--len]))
                                 vbuf[len] = '\0';
-                        dbg(rules->udev, "removed trailing whitespace from '%s'\n", value);
                 }
         }
 
@@ -2029,8 +1863,12 @@ enum escape_type {
         ESCAPE_REPLACE,
 };
 
-int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event, const sigset_t *sigmask)
-{
+int udev_rules_apply_to_event(struct udev_rules *rules,
+                              struct udev_event *event,
+                              usec_t timeout_usec,
+                              usec_t timeout_warn_usec,
+                              struct udev_list *properties_list,
+                              const sigset_t *sigmask) {
         struct token *cur;
         struct token *rule;
         enum escape_type esc = ESCAPE_UNSET;
@@ -2039,7 +1877,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
         if (rules->tokens == NULL)
                 return -1;
 
-        can_set_name = ((strcmp(udev_device_get_action(event->dev), "remove") != 0) &&
+        can_set_name = ((!streq(udev_device_get_action(event->dev), "remove")) &&
                         (major(udev_device_get_devnum(event->dev)) > 0 ||
                          udev_device_get_ifindex(event->dev) > 0));
 
@@ -2070,14 +1908,13 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                 goto nomatch;
                         break;
                 case TK_M_DEVLINK: {
-                        size_t devlen = strlen(udev_get_dev_path(event->udev))+1;
                         struct udev_list_entry *list_entry;
                         bool match = false;
 
                         udev_list_entry_foreach(list_entry, udev_device_get_devlinks_list_entry(event->dev)) {
                                 const char *devlink;
 
-                                devlink =  &udev_list_entry_get_name(list_entry)[devlen];
+                                devlink =  udev_list_entry_get_name(list_entry) + strlen("/dev/");
                                 if (match_key(rules, cur, devlink) == 0) {
                                         match = true;
                                         break;
@@ -2092,14 +1929,23 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                 goto nomatch;
                         break;
                 case TK_M_ENV: {
-                        const char *key_name = &rules->buf[cur->key.attr_off];
+                        const char *key_name = rules_str(rules, cur->key.attr_off);
                         const char *value;
 
                         value = udev_device_get_property_value(event->dev, key_name);
-                        if (value == NULL) {
-                                dbg(event->udev, "ENV{%s} is not set, treat as empty\n", key_name);
-                                value = "";
+
+                        /* check global properties */
+                        if (!value && properties_list) {
+                                struct udev_list_entry *list_entry;
+
+                                list_entry = udev_list_get_entry(properties_list);
+                                list_entry = udev_list_entry_get_by_name(list_entry, key_name);
+                                if (list_entry != NULL)
+                                        value = udev_list_entry_get_value(list_entry);
                         }
+
+                        if (!value)
+                                value = "";
                         if (match_key(rules, cur, value))
                                 goto nomatch;
                         break;
@@ -2109,7 +1955,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                         bool match = false;
 
                         udev_list_entry_foreach(list_entry, udev_device_get_tags_list_entry(event->dev)) {
-                                if (strcmp(&rules->buf[cur->key.value_off], udev_list_entry_get_name(list_entry)) == 0) {
+                                if (streq(rules_str(rules, cur->key.value_off), udev_list_entry_get_name(list_entry))) {
                                         match = true;
                                         break;
                                 }
@@ -2130,7 +1976,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                         char filename[UTIL_PATH_SIZE];
                         int found;
 
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], filename, sizeof(filename));
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), filename, sizeof(filename));
                         found = (wait_for_file(event->dev, filename, 10) == 0);
                         if (!found && (cur->key.op != OP_NOMATCH))
                                 goto nomatch;
@@ -2157,7 +2003,6 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                         for (;;) {
                                 struct token *key;
 
-                                dbg(event->udev, "parent: '%s'\n", udev_device_get_syspath(event->dev_parent));
                                 /* loop over sequence of parent match keys */
                                 for (key = cur; key < next; key++ ) {
                                         dump_token(rules, key);
@@ -2179,7 +2024,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                                         goto try_parent;
                                                 break;
                                         case TK_M_TAGS: {
-                                                bool match = udev_device_has_tag(event->dev_parent, &rules->buf[cur->key.value_off]);
+                                                bool match = udev_device_has_tag(event->dev_parent, rules_str(rules, cur->key.value_off));
 
                                                 if (match && key->key.op == OP_NOMATCH)
                                                         goto try_parent;
@@ -2190,9 +2035,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                         default:
                                                 goto nomatch;
                                         }
-                                        dbg(event->udev, "parent key matched\n");
                                 }
-                                dbg(event->udev, "all parent keys matched\n");
                                 break;
 
                         try_parent:
@@ -2209,50 +2052,42 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                         struct stat statbuf;
                         int match;
 
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], filename, sizeof(filename));
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), filename, sizeof(filename));
                         if (util_resolve_subsys_kernel(event->udev, filename, filename, sizeof(filename), 0) != 0) {
                                 if (filename[0] != '/') {
                                         char tmp[UTIL_PATH_SIZE];
 
-                                        util_strscpy(tmp, sizeof(tmp), filename);
-                                        util_strscpyl(filename, sizeof(filename),
+                                        strscpy(tmp, sizeof(tmp), filename);
+                                        strscpyl(filename, sizeof(filename),
                                                       udev_device_get_syspath(event->dev), "/", tmp, NULL);
                                 }
                         }
                         attr_subst_subdir(filename, sizeof(filename));
 
                         match = (stat(filename, &statbuf) == 0);
-                        dbg(event->udev, "'%s' %s", filename, match ? "exists\n" : "does not exist\n");
-                        if (match && cur->key.mode > 0) {
+                        if (match && cur->key.mode > 0)
                                 match = ((statbuf.st_mode & cur->key.mode) > 0);
-                                dbg(event->udev, "'%s' has mode=%#o and %s %#o\n", filename, statbuf.st_mode,
-                                    match ? "matches" : "does not match", cur->key.mode);
-                        }
                         if (match && cur->key.op == OP_NOMATCH)
                                 goto nomatch;
                         if (!match && cur->key.op == OP_MATCH)
                                 goto nomatch;
                         break;
                 }
-                case TK_M_EVENT_TIMEOUT:
-                        info(event->udev, "OPTIONS event_timeout=%u\n", cur->key.event_timeout);
-                        event->timeout_usec = cur->key.event_timeout * 1000 * 1000;
-                        break;
                 case TK_M_PROGRAM: {
                         char program[UTIL_PATH_SIZE];
                         char **envp;
-                        char result[UTIL_PATH_SIZE];
+                        char result[UTIL_LINE_SIZE];
 
                         free(event->program_result);
                         event->program_result = NULL;
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], program, sizeof(program));
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), program, sizeof(program));
                         envp = udev_device_get_properties_envp(event->dev);
-                        info(event->udev, "PROGRAM '%s' %s:%u\n",
-                             program,
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
+                        log_debug("PROGRAM '%s' %s:%u",
+                                  program,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
 
-                        if (udev_event_spawn(event, program, envp, sigmask, result, sizeof(result)) < 0) {
+                        if (udev_event_spawn(event, timeout_usec, timeout_warn_usec, program, envp, sigmask, result, sizeof(result)) < 0) {
                                 if (cur->key.op != OP_NOMATCH)
                                         goto nomatch;
                         } else {
@@ -2262,10 +2097,9 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                 if (esc == ESCAPE_UNSET || esc == ESCAPE_REPLACE) {
                                         count = util_replace_chars(result, UDEV_ALLOWED_CHARS_INPUT);
                                         if (count > 0)
-                                                info(event->udev, "%i character(s) replaced\n" , count);
+                                                log_debug("%i character(s) replaced" , count);
                                 }
                                 event->program_result = strdup(result);
-                                dbg(event->udev, "storing result '%s'\n", event->program_result);
                                 if (cur->key.op == OP_NOMATCH)
                                         goto nomatch;
                         }
@@ -2274,7 +2108,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                 case TK_M_IMPORT_FILE: {
                         char import[UTIL_PATH_SIZE];
 
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], import, sizeof(import));
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), import, sizeof(import));
                         if (import_file_into_properties(event->dev, import) != 0)
                                 if (cur->key.op != OP_NOMATCH)
                                         goto nomatch;
@@ -2283,13 +2117,13 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                 case TK_M_IMPORT_PROG: {
                         char import[UTIL_PATH_SIZE];
 
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], import, sizeof(import));
-                        info(event->udev, "IMPORT '%s' %s:%u\n",
-                             import,
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), import, sizeof(import));
+                        log_debug("IMPORT '%s' %s:%u",
+                                  import,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
 
-                        if (import_program_into_properties(event, import, sigmask) != 0)
+                        if (import_program_into_properties(event, timeout_usec, timeout_warn_usec, import, sigmask) != 0)
                                 if (cur->key.op != OP_NOMATCH)
                                         goto nomatch;
                         break;
@@ -2300,10 +2134,10 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                         if (udev_builtin_run_once(cur->key.builtin_cmd)) {
                                 /* check if we ran already */
                                 if (event->builtin_run & (1 << cur->key.builtin_cmd)) {
-                                        info(event->udev, "IMPORT builtin skip '%s' %s:%u\n",
-                                             udev_builtin_name(cur->key.builtin_cmd),
-                                             &rules->buf[rule->rule.filename_off],
-                                             rule->rule.filename_line);
+                                        log_debug("IMPORT builtin skip '%s' %s:%u",
+                                                  udev_builtin_name(cur->key.builtin_cmd),
+                                                  rules_str(rules, rule->rule.filename_off),
+                                                  rule->rule.filename_line);
                                         /* return the result from earlier run */
                                         if (event->builtin_ret & (1 << cur->key.builtin_cmd))
                                         if (cur->key.op != OP_NOMATCH)
@@ -2314,16 +2148,16 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                 event->builtin_run |= (1 << cur->key.builtin_cmd);
                         }
 
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], command, sizeof(command));
-                        info(event->udev, "IMPORT builtin '%s' %s:%u\n",
-                             udev_builtin_name(cur->key.builtin_cmd),
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), command, sizeof(command));
+                        log_debug("IMPORT builtin '%s' %s:%u",
+                                  udev_builtin_name(cur->key.builtin_cmd),
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
 
                         if (udev_builtin_run(event->dev, cur->key.builtin_cmd, command, false) != 0) {
                                 /* remember failure */
-                                info(rules->udev, "IMPORT builtin '%s' returned non-zero\n",
-                                     udev_builtin_name(cur->key.builtin_cmd));
+                                log_debug("IMPORT builtin '%s' returned non-zero",
+                                          udev_builtin_name(cur->key.builtin_cmd));
                                 event->builtin_ret |= (1 << cur->key.builtin_cmd);
                                 if (cur->key.op != OP_NOMATCH)
                                         goto nomatch;
@@ -2331,16 +2165,13 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                         break;
                 }
                 case TK_M_IMPORT_DB: {
-                        const char *key = &rules->buf[cur->key.value_off];
+                        const char *key = rules_str(rules, cur->key.value_off);
                         const char *value;
 
                         value = udev_device_get_property_value(event->dev_db, key);
-                        if (value != NULL) {
-                                struct udev_list_entry *entry;
-
-                                entry = udev_device_add_property(event->dev, key, value);
-                                udev_list_entry_set_num(entry, true);
-                        } else {
+                        if (value != NULL)
+                                udev_device_add_property(event->dev, key, value);
+                        else {
                                 if (cur->key.op != OP_NOMATCH)
                                         goto nomatch;
                         }
@@ -2350,23 +2181,20 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                         FILE *f;
                         bool imported = false;
 
-                        f = fopen("/proc/cmdline", "r");
+                        f = fopen("/proc/cmdline", "re");
                         if (f != NULL) {
                                 char cmdline[4096];
 
                                 if (fgets(cmdline, sizeof(cmdline), f) != NULL) {
-                                        const char *key = &rules->buf[cur->key.value_off];
+                                        const char *key = rules_str(rules, cur->key.value_off);
                                         char *pos;
 
                                         pos = strstr(cmdline, key);
                                         if (pos != NULL) {
-                                                struct udev_list_entry *entry;
-
                                                 pos += strlen(key);
                                                 if (pos[0] == '\0' || isspace(pos[0])) {
                                                         /* we import simple flags as 'FLAG=1' */
-                                                        entry = udev_device_add_property(event->dev, key, "1");
-                                                        udev_list_entry_set_num(entry, true);
+                                                        udev_device_add_property(event->dev, key, "1");
                                                         imported = true;
                                                 } else if (pos[0] == '=') {
                                                         const char *value;
@@ -2376,8 +2204,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                                         while (pos[0] != '\0' && !isspace(pos[0]))
                                                                 pos++;
                                                         pos[0] = '\0';
-                                                        entry = udev_device_add_property(event->dev, key, value);
-                                                        udev_list_entry_set_num(entry, true);
+                                                        udev_device_add_property(event->dev, key, value);
                                                         imported = true;
                                                 }
                                         }
@@ -2391,7 +2218,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                 case TK_M_IMPORT_PARENT: {
                         char import[UTIL_PATH_SIZE];
 
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], import, sizeof(import));
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), import, sizeof(import));
                         if (import_parent_into_properties(event->dev, import) != 0)
                                 if (cur->key.op != OP_NOMATCH)
                                         goto nomatch;
@@ -2422,32 +2249,54 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                         break;
                 case TK_A_OWNER: {
                         char owner[UTIL_NAME_SIZE];
+                        const char *ow = owner;
+                        int r;
 
                         if (event->owner_final)
                                 break;
                         if (cur->key.op == OP_ASSIGN_FINAL)
                                 event->owner_final = true;
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], owner, sizeof(owner));
-                        event->uid = util_lookup_user(event->udev, owner);
-                        info(event->udev, "OWNER %u %s:%u\n",
-                             event->uid,
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), owner, sizeof(owner));
+                        event->owner_set = true;
+                        r = get_user_creds(&ow, &event->uid, NULL, NULL, NULL);
+                        if (r < 0) {
+                                if (r == -ENOENT || r == -ESRCH)
+                                        log_error("specified user '%s' unknown", owner);
+                                else
+                                        log_error_errno(r, "error resolving user '%s': %m", owner);
+
+                                event->uid = 0;
+                        }
+                        log_debug("OWNER %u %s:%u",
+                                  event->uid,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
                         break;
                 }
                 case TK_A_GROUP: {
                         char group[UTIL_NAME_SIZE];
+                        const char *gr = group;
+                        int r;
 
                         if (event->group_final)
                                 break;
                         if (cur->key.op == OP_ASSIGN_FINAL)
                                 event->group_final = true;
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], group, sizeof(group));
-                        event->gid = util_lookup_group(event->udev, group);
-                        info(event->udev, "GROUP %u %s:%u\n",
-                             event->gid,
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), group, sizeof(group));
+                        event->group_set = true;
+                        r = get_group_creds(&gr, &event->gid);
+                        if (r < 0) {
+                                if (r == -ENOENT || r == -ESRCH)
+                                        log_error("specified group '%s' unknown", group);
+                                else
+                                        log_error_errno(r, "error resolving group '%s': %m", group);
+
+                                event->gid = 0;
+                        }
+                        log_debug("GROUP %u %s:%u",
+                                  event->gid,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
                         break;
                 }
                 case TK_A_MODE: {
@@ -2457,20 +2306,20 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
 
                         if (event->mode_final)
                                 break;
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], mode_str, sizeof(mode_str));
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), mode_str, sizeof(mode_str));
                         mode = strtol(mode_str, &endptr, 8);
                         if (endptr[0] != '\0') {
-                                err(event->udev, "ignoring invalid mode '%s'\n", mode_str);
+                                log_error("ignoring invalid mode '%s'", mode_str);
                                 break;
                         }
                         if (cur->key.op == OP_ASSIGN_FINAL)
                                 event->mode_final = true;
                         event->mode_set = true;
                         event->mode = mode;
-                        info(event->udev, "MODE %#o %s:%u\n",
-                             event->mode,
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
+                        log_debug("MODE %#o %s:%u",
+                                  event->mode,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
                         break;
                 }
                 case TK_A_OWNER_ID:
@@ -2478,22 +2327,24 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                 break;
                         if (cur->key.op == OP_ASSIGN_FINAL)
                                 event->owner_final = true;
+                        event->owner_set = true;
                         event->uid = cur->key.uid;
-                        info(event->udev, "OWNER %u %s:%u\n",
-                             event->uid,
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
+                        log_debug("OWNER %u %s:%u",
+                                  event->uid,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
                         break;
                 case TK_A_GROUP_ID:
                         if (event->group_final)
                                 break;
                         if (cur->key.op == OP_ASSIGN_FINAL)
                                 event->group_final = true;
+                        event->group_set = true;
                         event->gid = cur->key.gid;
-                        info(event->udev, "GROUP %u %s:%u\n",
-                             event->gid,
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
+                        log_debug("GROUP %u %s:%u",
+                                  event->gid,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
                         break;
                 case TK_A_MODE_ID:
                         if (event->mode_final)
@@ -2502,34 +2353,57 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                 event->mode_final = true;
                         event->mode_set = true;
                         event->mode = cur->key.mode;
-                        info(event->udev, "MODE %#o %s:%u\n",
-                             event->mode,
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
+                        log_debug("MODE %#o %s:%u",
+                                  event->mode,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
                         break;
+                case TK_A_SECLABEL: {
+                        const char *name, *label;
+
+                        name = rules_str(rules, cur->key.attr_off);
+                        label = rules_str(rules, cur->key.value_off);
+                        if (cur->key.op == OP_ASSIGN || cur->key.op == OP_ASSIGN_FINAL)
+                                udev_list_cleanup(&event->seclabel_list);
+                        udev_list_entry_add(&event->seclabel_list, name, label);
+                        log_debug("SECLABEL{%s}='%s' %s:%u",
+                                  name, label,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
+                        break;
+                }
                 case TK_A_ENV: {
-                        const char *name = &rules->buf[cur->key.attr_off];
-                        char *value = &rules->buf[cur->key.value_off];
-
-                        if (value[0] != '\0') {
-                                char temp_value[UTIL_NAME_SIZE];
-                                struct udev_list_entry *entry;
-
-                                udev_event_apply_format(event, value, temp_value, sizeof(temp_value));
-                                entry = udev_device_add_property(event->dev, name, temp_value);
-                                /* store in db, skip private keys */
-                                if (name[0] != '.')
-                                        udev_list_entry_set_num(entry, true);
-                        } else {
+                        const char *name = rules_str(rules, cur->key.attr_off);
+                        char *value = rules_str(rules, cur->key.value_off);
+                        char value_new[UTIL_NAME_SIZE];
+                        const char *value_old = NULL;
+
+                        if (value[0] == '\0') {
+                                if (cur->key.op == OP_ADD)
+                                        break;
                                 udev_device_add_property(event->dev, name, NULL);
+                                break;
                         }
+
+                        if (cur->key.op == OP_ADD)
+                                value_old = udev_device_get_property_value(event->dev, name);
+                        if (value_old) {
+                                char temp[UTIL_NAME_SIZE];
+
+                                /* append value separated by space */
+                                udev_event_apply_format(event, value, temp, sizeof(temp));
+                                strscpyl(value_new, sizeof(value_new), value_old, " ", temp, NULL);
+                        } else
+                                udev_event_apply_format(event, value, value_new, sizeof(value_new));
+
+                        udev_device_add_property(event->dev, name, value_new);
                         break;
                 }
                 case TK_A_TAG: {
                         char tag[UTIL_PATH_SIZE];
                         const char *p;
 
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], tag, sizeof(tag));
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), tag, sizeof(tag));
                         if (cur->key.op == OP_ASSIGN || cur->key.op == OP_ASSIGN_FINAL)
                                 udev_device_cleanup_tags_list(event->dev);
                         for (p = tag; *p != '\0'; p++) {
@@ -2538,14 +2412,17 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                     (*p >= '0' && *p <= '9') ||
                                     *p == '-' || *p == '_')
                                         continue;
-                                err(event->udev, "ignoring invalid tag name '%s'\n", tag);
+                                log_error("ignoring invalid tag name '%s'", tag);
                                 break;
                         }
-                        udev_device_add_tag(event->dev, tag);
+                        if (cur->key.op == OP_REMOVE)
+                                udev_device_remove_tag(event->dev, tag);
+                        else
+                                udev_device_add_tag(event->dev, tag);
                         break;
                 }
                 case TK_A_NAME: {
-                        const char *name  = &rules->buf[cur->key.value_off];
+                        const char *name  = rules_str(rules, cur->key.value_off);
 
                         char name_str[UTIL_PATH_SIZE];
                         int count;
@@ -2558,24 +2435,21 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                         if (esc == ESCAPE_UNSET || esc == ESCAPE_REPLACE) {
                                 count = util_replace_chars(name_str, "/");
                                 if (count > 0)
-                                        info(event->udev, "%i character(s) replaced\n", count);
+                                        log_debug("%i character(s) replaced", count);
                         }
-                        if (major(udev_device_get_devnum(event->dev))) {
-                                size_t devlen = strlen(udev_get_dev_path(event->udev))+1;
-
-                                if (strcmp(name_str, &udev_device_get_devnode(event->dev)[devlen]) != 0) {
-                                        err(event->udev, "NAME=\"%s\" ignored, kernel device nodes "
-                                            "can not be renamed; please fix it in %s:%u\n", name,
-                                            &rules->buf[rule->rule.filename_off], rule->rule.filename_line);
-                                        break;
-                                }
+                        if (major(udev_device_get_devnum(event->dev)) &&
+                            (!streq(name_str, udev_device_get_devnode(event->dev) + strlen("/dev/")))) {
+                                log_error("NAME=\"%s\" ignored, kernel device nodes "
+                                    "can not be renamed; please fix it in %s:%u\n", name,
+                                    rules_str(rules, rule->rule.filename_off), rule->rule.filename_line);
+                                break;
                         }
                         free(event->name);
                         event->name = strdup(name_str);
-                        info(event->udev, "NAME '%s' %s:%u\n",
-                             event->name,
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
+                        log_debug("NAME '%s' %s:%u",
+                                  event->name,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
                         break;
                 }
                 case TK_A_DEVLINK: {
@@ -2594,69 +2468,72 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                                 udev_device_cleanup_devlinks_list(event->dev);
 
                         /* allow  multiple symlinks separated by spaces */
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], temp, sizeof(temp));
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), temp, sizeof(temp));
                         if (esc == ESCAPE_UNSET)
                                 count = util_replace_chars(temp, "/ ");
                         else if (esc == ESCAPE_REPLACE)
                                 count = util_replace_chars(temp, "/");
                         if (count > 0)
-                                info(event->udev, "%i character(s) replaced\n" , count);
-                        dbg(event->udev, "rule applied, added symlink(s) '%s'\n", temp);
+                                log_debug("%i character(s) replaced" , count);
                         pos = temp;
                         while (isspace(pos[0]))
                                 pos++;
                         next = strchr(pos, ' ');
                         while (next != NULL) {
                                 next[0] = '\0';
-                                info(event->udev, "LINK '%s' %s:%u\n", pos,
-                                     &rules->buf[rule->rule.filename_off], rule->rule.filename_line);
-                                util_strscpyl(filename, sizeof(filename), udev_get_dev_path(event->udev), "/", pos, NULL);
-                                udev_device_add_devlink(event->dev, filename, cur->key.devlink_unique);
+                                log_debug("LINK '%s' %s:%u", pos,
+                                          rules_str(rules, rule->rule.filename_off), rule->rule.filename_line);
+                                strscpyl(filename, sizeof(filename), "/dev/", pos, NULL);
+                                udev_device_add_devlink(event->dev, filename);
                                 while (isspace(next[1]))
                                         next++;
                                 pos = &next[1];
                                 next = strchr(pos, ' ');
                         }
                         if (pos[0] != '\0') {
-                                info(event->udev, "LINK '%s' %s:%u\n", pos,
-                                     &rules->buf[rule->rule.filename_off], rule->rule.filename_line);
-                                util_strscpyl(filename, sizeof(filename), udev_get_dev_path(event->udev), "/", pos, NULL);
-                                udev_device_add_devlink(event->dev, filename, cur->key.devlink_unique);
+                                log_debug("LINK '%s' %s:%u", pos,
+                                          rules_str(rules, rule->rule.filename_off), rule->rule.filename_line);
+                                strscpyl(filename, sizeof(filename), "/dev/", pos, NULL);
+                                udev_device_add_devlink(event->dev, filename);
                         }
                         break;
                 }
                 case TK_A_ATTR: {
-                        const char *key_name = &rules->buf[cur->key.attr_off];
+                        const char *key_name = rules_str(rules, cur->key.attr_off);
                         char attr[UTIL_PATH_SIZE];
                         char value[UTIL_NAME_SIZE];
                         FILE *f;
 
                         if (util_resolve_subsys_kernel(event->udev, key_name, attr, sizeof(attr), 0) != 0)
-                                util_strscpyl(attr, sizeof(attr), udev_device_get_syspath(event->dev), "/", key_name, NULL);
+                                strscpyl(attr, sizeof(attr), udev_device_get_syspath(event->dev), "/", key_name, NULL);
                         attr_subst_subdir(attr, sizeof(attr));
 
-                        udev_event_apply_format(event, &rules->buf[cur->key.value_off], value, sizeof(value));
-                        info(event->udev, "ATTR '%s' writing '%s' %s:%u\n", attr, value,
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
-                        f = fopen(attr, "w");
+                        udev_event_apply_format(event, rules_str(rules, cur->key.value_off), value, sizeof(value));
+                        log_debug("ATTR '%s' writing '%s' %s:%u", attr, value,
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
+                        f = fopen(attr, "we");
                         if (f != NULL) {
                                 if (fprintf(f, "%s", value) <= 0)
-                                        err(event->udev, "error writing ATTR{%s}: %m\n", attr);
+                                        log_error_errno(errno, "error writing ATTR{%s}: %m", attr);
                                 fclose(f);
                         } else {
-                                err(event->udev, "error opening ATTR{%s} for writing: %m\n", attr);
+                                log_error_errno(errno, "error opening ATTR{%s} for writing: %m", attr);
                         }
                         break;
                 }
-                case TK_A_RUN: {
+                case TK_A_RUN_BUILTIN:
+                case TK_A_RUN_PROGRAM: {
+                        struct udev_list_entry *entry;
+
                         if (cur->key.op == OP_ASSIGN || cur->key.op == OP_ASSIGN_FINAL)
                                 udev_list_cleanup(&event->run_list);
-                        info(event->udev, "RUN '%s' %s:%u\n",
-                             &rules->buf[cur->key.value_off],
-                             &rules->buf[rule->rule.filename_off],
-                             rule->rule.filename_line);
-                        udev_list_entry_add(&event->run_list, &rules->buf[cur->key.value_off], NULL);
+                        log_debug("RUN '%s' %s:%u",
+                                  rules_str(rules, cur->key.value_off),
+                                  rules_str(rules, rule->rule.filename_off),
+                                  rule->rule.filename_line);
+                        entry = udev_list_entry_add(&event->run_list, rules_str(rules, cur->key.value_off), NULL);
+                        udev_list_entry_set_num(entry, cur->key.builtin_cmd);
                         break;
                 }
                 case TK_A_GOTO:
@@ -2671,7 +2548,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
                 case TK_M_PARENTS_MAX:
                 case TK_M_MAX:
                 case TK_UNSET:
-                        err(rules->udev, "wrong type %u\n", cur->type);
+                        log_error("wrong type %u", cur->type);
                         goto nomatch;
                 }
 
@@ -2680,21 +2557,23 @@ int udev_rules_apply_to_event(struct udev_rules *rules, struct udev_event *event
         nomatch:
                 /* fast-forward to next rule */
                 cur = rule + rule->rule.token_count;
-                dbg(rules->udev, "forward to rule: %u\n",
-                                 (unsigned int) (cur - rules->tokens));
         }
 }
 
-void udev_rules_apply_static_dev_perms(struct udev_rules *rules)
-{
+int udev_rules_apply_static_dev_perms(struct udev_rules *rules) {
         struct token *cur;
         struct token *rule;
         uid_t uid = 0;
         gid_t gid = 0;
         mode_t mode = 0;
+        _cleanup_strv_free_ char **tags = NULL;
+        char **t;
+        FILE *f = NULL;
+        _cleanup_free_ char *path = NULL;
+        int r = 0;
 
         if (rules->tokens == NULL)
-                return;
+                return 0;
 
         cur = &rules->tokens[0];
         rule = cur;
@@ -2711,6 +2590,8 @@ void udev_rules_apply_static_dev_perms(struct udev_rules *rules)
                         uid = 0;
                         gid = 0;
                         mode = 0;
+                        strv_free(tags);
+                        tags = NULL;
                         break;
                 case TK_A_OWNER_ID:
                         uid = cur->key.uid;
@@ -2720,20 +2601,56 @@ void udev_rules_apply_static_dev_perms(struct udev_rules *rules)
                         break;
                 case TK_A_MODE_ID:
                         mode = cur->key.mode;
+                        break;
+                case TK_A_TAG:
+                        r = strv_extend(&tags, rules_str(rules, cur->key.value_off));
+                        if (r < 0)
+                                goto finish;
+
                         break;
                 case TK_A_STATIC_NODE: {
-                        char filename[UTIL_PATH_SIZE];
+                        char device_node[UTIL_PATH_SIZE];
+                        char tags_dir[UTIL_PATH_SIZE];
+                        char tag_symlink[UTIL_PATH_SIZE];
                         struct stat stats;
 
                         /* we assure, that the permissions tokens are sorted before the static token */
-                        if (mode == 0 && uid == 0 && gid == 0)
-                                goto next;
-                        util_strscpyl(filename, sizeof(filename), udev_get_dev_path(rules->udev), "/",
-                                      &rules->buf[cur->key.value_off], NULL);
-                        if (stat(filename, &stats) != 0)
+
+                        if (mode == 0 && uid == 0 && gid == 0 && tags == NULL)
                                 goto next;
+
+                        strscpyl(device_node, sizeof(device_node), "/dev/", rules_str(rules, cur->key.value_off), NULL);
+                        if (stat(device_node, &stats) != 0)
+                                break;
                         if (!S_ISBLK(stats.st_mode) && !S_ISCHR(stats.st_mode))
-                                goto next;
+                                break;
+
+                        /* export the tags to a directory as symlinks, allowing otherwise dead nodes to be tagged */
+                        if (tags) {
+                                STRV_FOREACH(t, tags) {
+                                        _cleanup_free_ char *unescaped_filename = NULL;
+
+                                        strscpyl(tags_dir, sizeof(tags_dir), "/run/udev/static_node-tags/", *t, "/", NULL);
+                                        r = mkdir_p(tags_dir, 0755);
+                                        if (r < 0)
+                                                return log_error_errno(r, "failed to create %s: %m", tags_dir);
+
+                                        unescaped_filename = xescape(rules_str(rules, cur->key.value_off), "/.");
+
+                                        strscpyl(tag_symlink, sizeof(tag_symlink), tags_dir, unescaped_filename, NULL);
+                                        r = symlink(device_node, tag_symlink);
+                                        if (r < 0 && errno != EEXIST)
+                                                return log_error_errno(errno, "failed to create symlink %s -> %s: %m",
+                                                                       tag_symlink, device_node);
+                                        else
+                                                r = 0;
+                                }
+                        }
+
+                        /* don't touch the permissions if only the tags were set */
+                        if (mode == 0 && uid == 0 && gid == 0)
+                                break;
+
                         if (mode == 0) {
                                 if (gid > 0)
                                         mode = 0660;
@@ -2741,20 +2658,28 @@ void udev_rules_apply_static_dev_perms(struct udev_rules *rules)
                                         mode = 0600;
                         }
                         if (mode != (stats.st_mode & 01777)) {
-                                chmod(filename, mode);
-                                info(rules->udev, "chmod '%s' %#o\n", filename, mode);
+                                r = chmod(device_node, mode);
+                                if (r < 0) {
+                                        log_error("failed to chmod '%s' %#o", device_node, mode);
+                                        return -errno;
+                                } else
+                                        log_debug("chmod '%s' %#o", device_node, mode);
                         }
 
                         if ((uid != 0 && uid != stats.st_uid) || (gid != 0 && gid != stats.st_gid)) {
-                                chown(filename, uid, gid);
-                                info(rules->udev, "chown '%s' %u %u\n", filename, uid, gid);
+                                r = chown(device_node, uid, gid);
+                                if (r < 0) {
+                                        log_error("failed to chown '%s' %u %u ", device_node, uid, gid);
+                                        return -errno;
+                                } else
+                                        log_debug("chown '%s' %u %u", device_node, uid, gid);
                         }
 
-                        utimensat(AT_FDCWD, filename, NULL, 0);
+                        utimensat(AT_FDCWD, device_node, NULL, 0);
                         break;
                 }
                 case TK_END:
-                        return;
+                        goto finish;
                 }
 
                 cur++;
@@ -2764,4 +2689,18 @@ next:
                 cur = rule + rule->rule.token_count;
                 continue;
         }
+
+finish:
+        if (f) {
+                fflush(f);
+                fchmod(fileno(f), 0644);
+                if (ferror(f) || rename(path, "/run/udev/static_node-tags") < 0) {
+                        r = -errno;
+                        unlink("/run/udev/static_node-tags");
+                        unlink(path);
+                }
+                fclose(f);
+        }
+
+        return r;
 }