X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fcore%2Fload-fragment.c;h=2ee4616a1c4686a5c75a61dbacf7e84420240ee5;hp=f4a268c1ef0d58a178a6f6c86fb0e01f7c5d71f8;hb=5f8640fb628cb034981e02d741fd9ddf26fdf38d;hpb=47c0980d37a6255e411747572a00638bca35be5a diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c index f4a268c1e..2ee4616a1 100644 --- a/src/core/load-fragment.c +++ b/src/core/load-fragment.c @@ -34,8 +34,11 @@ #include #include -#include +#ifdef HAVE_SECCOMP +#include +#endif +#include "sd-messages.h" #include "unit.h" #include "strv.h" #include "conf-parser.h" @@ -46,23 +49,30 @@ #include "missing.h" #include "unit-name.h" #include "unit-printf.h" -#include "dbus-common.h" #include "utf8.h" #include "path-util.h" -#include "syscall-list.h" #include "env-util.h" #include "cgroup.h" +#include "bus-util.h" +#include "bus-error.h" +#include "errno-list.h" -#ifndef HAVE_SYSV_COMPAT -int config_parse_warn_compat(const char *unit, - const char *filename, - unsigned line, - const char *section, - const char *lvalue, - int ltype, - const char *rvalue, - void *data, - void *userdata) { +#ifdef HAVE_SECCOMP +#include "seccomp-util.h" +#endif + +#if !defined(HAVE_SYSV_COMPAT) || !defined(HAVE_SECCOMP) +int config_parse_warn_compat( + const char *unit, + const char *filename, + unsigned line, + const char *section, + unsigned section_line, + const char *lvalue, + int ltype, + const char *rvalue, + void *data, + void *userdata) { log_syntax(unit, LOG_DEBUG, filename, line, EINVAL, "Support for option %s= has been disabled at compile time and is ignored", @@ -75,6 +85,7 @@ int config_parse_unit_deps(const char* unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -99,9 +110,12 @@ int config_parse_unit_deps(const char* unit, if (!t) return log_oom(); - k = unit_name_printf(u, t); - if (!k) - return log_oom(); + r = unit_name_printf(u, t, &k); + if (r < 0) { + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve specifiers, ignoring: %s", strerror(-r)); + continue; + } r = unit_add_dependency_by_name(u, d, k, NULL, true); if (r < 0) @@ -116,6 +130,7 @@ int config_parse_unit_string_printf(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -124,18 +139,19 @@ int config_parse_unit_string_printf(const char *unit, Unit *u = userdata; _cleanup_free_ char *k = NULL; + int r; assert(filename); assert(lvalue); assert(rvalue); assert(u); - k = unit_full_printf(u, rvalue); - if (!k) - log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Failed to resolve unit specifiers on %s. Ignoring.", rvalue); + r = unit_full_printf(u, rvalue, &k); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve unit specifiers on %s, ignoring: %s", rvalue, strerror(-r)); - return config_parse_string(unit, filename, line, section, lvalue, ltype, + return config_parse_string(unit, filename, line, section, section_line, lvalue, ltype, k ? k : rvalue, data, userdata); } @@ -143,6 +159,7 @@ int config_parse_unit_strv_printf(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -151,18 +168,19 @@ int config_parse_unit_strv_printf(const char *unit, Unit *u = userdata; _cleanup_free_ char *k = NULL; + int r; assert(filename); assert(lvalue); assert(rvalue); assert(u); - k = unit_full_printf(u, rvalue); - if (!k) - log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Failed to resolve unit specifiers on %s. Ignoring.", rvalue); + r = unit_full_printf(u, rvalue, &k); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve unit specifiers on %s, ignoring: %s", rvalue, strerror(-r)); - return config_parse_strv(unit, filename, line, section, lvalue, ltype, + return config_parse_strv(unit, filename, line, section, section_line, lvalue, ltype, k ? k : rvalue, data, userdata); } @@ -170,6 +188,7 @@ int config_parse_unit_path_printf(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -178,18 +197,19 @@ int config_parse_unit_path_printf(const char *unit, Unit *u = userdata; _cleanup_free_ char *k = NULL; + int r; assert(filename); assert(lvalue); assert(rvalue); assert(u); - k = unit_full_printf(u, rvalue); - if (!k) - log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Failed to resolve unit specifiers on %s. Ignoring.", rvalue); + r = unit_full_printf(u, rvalue, &k); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve unit specifiers on %s, ignoring: %s", rvalue, strerror(-r)); - return config_parse_path(unit, filename, line, section, lvalue, ltype, + return config_parse_path(unit, filename, line, section, section_line, lvalue, ltype, k ? k : rvalue, data, userdata); } @@ -197,6 +217,7 @@ int config_parse_socket_listen(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -205,6 +226,7 @@ int config_parse_socket_listen(const char *unit, SocketPort *p, *tail; Socket *s; + int r; assert(filename); assert(lvalue); @@ -226,32 +248,31 @@ int config_parse_socket_listen(const char *unit, if (ltype != SOCKET_SOCKET) { p->type = ltype; - p->path = unit_full_printf(UNIT(s), rvalue); - if (!p->path) { + r = unit_full_printf(UNIT(s), rvalue, &p->path); + if (r < 0) { p->path = strdup(rvalue); if (!p->path) { free(p); return log_oom(); } else - log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Failed to resolve unit specifiers on %s. Ignoring.", rvalue); + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve unit specifiers on %s, ignoring: %s", rvalue, strerror(-r)); } path_kill_slashes(p->path); } else if (streq(lvalue, "ListenNetlink")) { _cleanup_free_ char *k = NULL; - int r; p->type = SOCKET_SOCKET; - k = unit_full_printf(UNIT(s), rvalue); - if (!k) - log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Failed to resolve unit specifiers on %s. Ignoring.", rvalue); + r = unit_full_printf(UNIT(s), rvalue, &k); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve unit specifiers on %s, ignoring: %s", rvalue, strerror(-r)); r = socket_address_parse_netlink(&p->address, k ? k : rvalue); if (r < 0) { - log_syntax(unit, LOG_ERR, filename, line, EINVAL, + log_syntax(unit, LOG_ERR, filename, line, -r, "Failed to parse address value, ignoring: %s", rvalue); free(p); return 0; @@ -259,17 +280,16 @@ int config_parse_socket_listen(const char *unit, } else { _cleanup_free_ char *k = NULL; - int r; p->type = SOCKET_SOCKET; - k = unit_full_printf(UNIT(s), rvalue); - if (!k) - log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Failed to resolve unit specifiers on %s. Ignoring.", rvalue); + r = unit_full_printf(UNIT(s), rvalue, &k); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve unit specifiers on %s, ignoring: %s", rvalue, strerror(-r)); r = socket_address_parse(&p->address, k ? k : rvalue); if (r < 0) { - log_syntax(unit, LOG_ERR, filename, line, EINVAL, + log_syntax(unit, LOG_ERR, filename, line, -r, "Failed to parse address value, ignoring: %s", rvalue); free(p); return 0; @@ -293,12 +313,13 @@ int config_parse_socket_listen(const char *unit, } p->fd = -1; + p->socket = s; if (s->ports) { - LIST_FIND_TAIL(SocketPort, port, s->ports, tail); - LIST_INSERT_AFTER(SocketPort, port, s->ports, tail, p); + LIST_FIND_TAIL(port, s->ports, tail); + LIST_INSERT_AFTER(port, s->ports, tail, p); } else - LIST_PREPEND(SocketPort, port, s->ports, p); + LIST_PREPEND(port, s->ports, p); return 0; } @@ -307,6 +328,7 @@ int config_parse_socket_bind(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -345,6 +367,7 @@ int config_parse_exec_nice(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -382,6 +405,7 @@ int config_parse_exec_oom_score_adjust(const char* unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -419,6 +443,7 @@ int config_parse_exec(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -590,6 +615,7 @@ int config_parse_socket_bindtodevice(const char* unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -624,6 +650,7 @@ int config_parse_exec_io_class(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -655,6 +682,7 @@ int config_parse_exec_io_priority(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -686,6 +714,7 @@ int config_parse_exec_cpu_sched_policy(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -720,6 +749,7 @@ int config_parse_exec_cpu_sched_prio(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -761,6 +791,7 @@ int config_parse_exec_cpu_affinity(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -818,6 +849,7 @@ int config_parse_exec_capabilities(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -850,6 +882,7 @@ int config_parse_exec_secure_bits(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -899,6 +932,7 @@ int config_parse_bounding_set(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -958,6 +992,7 @@ int config_parse_limit(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1002,6 +1037,7 @@ int config_parse_sysv_priority(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1028,41 +1064,13 @@ int config_parse_sysv_priority(const char *unit, } #endif -int config_parse_fsck_passno(const char *unit, - const char *filename, - unsigned line, - const char *section, - const char *lvalue, - int ltype, - const char *rvalue, - void *data, - void *userdata) { - - int *passno = data; - int i, r; - - assert(filename); - assert(lvalue); - assert(rvalue); - assert(data); - - r = safe_atoi(rvalue, &i); - if (r || i < 0) { - log_syntax(unit, LOG_ERR, filename, line, -r, - "Failed to parse fsck pass number, ignoring: %s", rvalue); - return 0; - } - - *passno = (int) i; - return 0; -} - DEFINE_CONFIG_PARSE_ENUM(config_parse_kill_mode, kill_mode, KillMode, "Failed to parse kill mode"); int config_parse_kill_signal(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1092,6 +1100,7 @@ int config_parse_exec_mount_flags(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1134,10 +1143,60 @@ int config_parse_exec_mount_flags(const char *unit, return 0; } +int config_parse_exec_selinux_context( + const char *unit, + const char *filename, + unsigned line, + const char *section, + unsigned section_line, + const char *lvalue, + int ltype, + const char *rvalue, + void *data, + void *userdata) { + + ExecContext *c = data; + Unit *u = userdata; + bool ignore; + char *k; + int r; + + assert(filename); + assert(lvalue); + assert(rvalue); + assert(data); + + if (isempty(rvalue)) { + free(c->selinux_context); + c->selinux_context = NULL; + c->selinux_context_ignore = false; + return 0; + } + + if (rvalue[0] == '-') { + ignore = true; + rvalue++; + } else + ignore = false; + + r = unit_name_printf(u, rvalue, &k); + if (r < 0) { + log_syntax(unit, LOG_ERR, filename, line, -r, "Failed to resolve specifiers, ignoring: %s", strerror(-r)); + return 0; + } + + free(c->selinux_context); + c->selinux_context = k; + c->selinux_context_ignore = ignore; + + return 0; +} + int config_parse_timer(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1198,7 +1257,7 @@ int config_parse_timer(const char *unit, v->value = u; v->calendar_spec = c; - LIST_PREPEND(TimerValue, value, t->values, v); + LIST_PREPEND(value, t->values, v); return 0; } @@ -1208,6 +1267,7 @@ int config_parse_trigger_unit( const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1230,11 +1290,12 @@ int config_parse_trigger_unit( return 0; } - p = unit_name_printf(u, rvalue); - if (!p) - return log_oom(); + r = unit_name_printf(u, rvalue, &p); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve specifiers, ignoring: %s", strerror(-r)); - type = unit_name_to_type(p); + type = unit_name_to_type(p ?: rvalue); if (type < 0) { log_syntax(unit, LOG_ERR, filename, line, EINVAL, "Unit type not valid, ignoring: %s", rvalue); @@ -1247,10 +1308,10 @@ int config_parse_trigger_unit( return 0; } - r = unit_add_two_dependencies_by_name(u, UNIT_BEFORE, UNIT_TRIGGERS, p, NULL, true); + r = unit_add_two_dependencies_by_name(u, UNIT_BEFORE, UNIT_TRIGGERS, p ?: rvalue, NULL, true); if (r < 0) { log_syntax(unit, LOG_ERR, filename, line, -r, - "Failed to add trigger on %s, ignoring: %s", p, strerror(-r)); + "Failed to add trigger on %s, ignoring: %s", p ?: rvalue, strerror(-r)); return 0; } @@ -1261,6 +1322,7 @@ int config_parse_path_spec(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1271,6 +1333,7 @@ int config_parse_path_spec(const char *unit, PathSpec *s; PathType b; _cleanup_free_ char *k = NULL; + int r; assert(filename); assert(lvalue); @@ -1290,13 +1353,13 @@ int config_parse_path_spec(const char *unit, return 0; } - k = unit_full_printf(UNIT(p), rvalue); - if (!k) { + r = unit_full_printf(UNIT(p), rvalue, &k); + if (r < 0) { k = strdup(rvalue); if (!k) return log_oom(); else - log_syntax(unit, LOG_ERR, filename, line, EINVAL, + log_syntax(unit, LOG_ERR, filename, line, -r, "Failed to resolve unit specifiers on %s. Ignoring.", rvalue); } @@ -1311,12 +1374,13 @@ int config_parse_path_spec(const char *unit, if (!s) return log_oom(); + s->unit = UNIT(p); s->path = path_kill_slashes(k); k = NULL; s->type = b; s->inotify_fd = -1; - LIST_PREPEND(PathSpec, spec, p->specs, s); + LIST_PREPEND(spec, p->specs, s); return 0; } @@ -1325,15 +1389,16 @@ int config_parse_socket_service(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata) { + _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL; Socket *s = data; int r; - DBusError error; Unit *x; _cleanup_free_ char *p = NULL; @@ -1342,24 +1407,20 @@ int config_parse_socket_service(const char *unit, assert(rvalue); assert(data); - dbus_error_init(&error); - - p = unit_name_printf(UNIT(s), rvalue); - if (!p) - return log_oom(); + r = unit_name_printf(UNIT(s), rvalue, &p); + if (r < 0) { + log_syntax(unit, LOG_ERR, filename, line, -r, "Failed to resolve specifiers, ignoring: %s", rvalue); + return 0; + } if (!endswith(p, ".service")) { - log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Unit must be of type service, ignoring: %s", rvalue); + log_syntax(unit, LOG_ERR, filename, line, EINVAL, "Unit must be of type service, ignoring: %s", rvalue); return 0; } r = manager_load_unit(UNIT(s)->manager, p, NULL, &error, &x); if (r < 0) { - log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Failed to load unit %s, ignoring: %s", - rvalue, bus_error(&error, r)); - dbus_error_free(&error); + log_syntax(unit, LOG_ERR, filename, line, r, "Failed to load unit %s, ignoring: %s", rvalue, bus_error_message(&error, r)); return 0; } @@ -1372,6 +1433,7 @@ int config_parse_service_sockets(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1395,23 +1457,24 @@ int config_parse_service_sockets(const char *unit, if (!t) return log_oom(); - k = unit_name_printf(UNIT(s), t); - if (!k) - return log_oom(); + r = unit_name_printf(UNIT(s), t, &k); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve specifiers, ignoring: %s", strerror(-r)); - if (!endswith(k, ".socket")) { + if (!endswith(k ?: t, ".socket")) { log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Unit must be of type socket, ignoring: %s", k); + "Unit must be of type socket, ignoring: %s", k ?: t); continue; } - r = unit_add_two_dependencies_by_name(UNIT(s), UNIT_WANTS, UNIT_AFTER, k, NULL, true); + r = unit_add_two_dependencies_by_name(UNIT(s), UNIT_WANTS, UNIT_AFTER, k ?: t, NULL, true); if (r < 0) log_syntax(unit, LOG_ERR, filename, line, -r, "Failed to add dependency on %s, ignoring: %s", - k, strerror(-r)); + k ?: t, strerror(-r)); - r = unit_add_dependency_by_name(UNIT(s), UNIT_TRIGGERED_BY, k, NULL, true); + r = unit_add_dependency_by_name(UNIT(s), UNIT_TRIGGERED_BY, k ?: t, NULL, true); if (r < 0) return r; } @@ -1423,6 +1486,7 @@ int config_parse_service_timeout(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1437,7 +1501,7 @@ int config_parse_service_timeout(const char *unit, assert(rvalue); assert(s); - r = config_parse_sec(unit, filename, line, section, lvalue, ltype, + r = config_parse_sec(unit, filename, line, section, section_line, lvalue, ltype, rvalue, data, userdata); if (r < 0) return r; @@ -1451,10 +1515,56 @@ int config_parse_service_timeout(const char *unit, return 0; } +int config_parse_busname_service( + const char *unit, + const char *filename, + unsigned line, + const char *section, + unsigned section_line, + const char *lvalue, + int ltype, + const char *rvalue, + void *data, + void *userdata) { + + _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL; + BusName *n = data; + int r; + Unit *x; + _cleanup_free_ char *p = NULL; + + assert(filename); + assert(lvalue); + assert(rvalue); + assert(data); + + r = unit_name_printf(UNIT(n), rvalue, &p); + if (r < 0) { + log_syntax(unit, LOG_ERR, filename, line, -r, "Failed to resolve specifiers, ignoring: %s", rvalue); + return 0; + } + + if (!endswith(p, ".service")) { + log_syntax(unit, LOG_ERR, filename, line, EINVAL, "Unit must be of type service, ignoring: %s", rvalue); + return 0; + } + + r = manager_load_unit(UNIT(n)->manager, p, NULL, &error, &x); + if (r < 0) { + log_syntax(unit, LOG_ERR, filename, line, r, "Failed to load unit %s, ignoring: %s", rvalue, bus_error_message(&error, r)); + return 0; + } + + unit_ref_set(&n->service, x); + + return 0; +} + int config_parse_unit_env_file(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1463,7 +1573,8 @@ int config_parse_unit_env_file(const char *unit, char ***env = data; Unit *u = userdata; - _cleanup_free_ char *s = NULL; + _cleanup_free_ char *n = NULL; + const char *s; int r; assert(filename); @@ -1478,10 +1589,12 @@ int config_parse_unit_env_file(const char *unit, return 0; } - s = unit_full_printf(u, rvalue); - if (!s) - return log_oom(); + r = unit_full_printf(u, rvalue, &n); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, r, + "Failed to resolve specifiers, ignoring: %s", rvalue); + s = n ?: rvalue; if (!path_is_absolute(s[0] == '-' ? s + 1 : s)) { log_syntax(unit, LOG_ERR, filename, line, EINVAL, "Path '%s' is not absolute, ignoring.", s); @@ -1499,6 +1612,7 @@ int config_parse_environ(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1509,6 +1623,7 @@ int config_parse_environ(const char *unit, char*** env = data, *w, *state; size_t l; _cleanup_free_ char *k = NULL; + int r; assert(filename); assert(lvalue); @@ -1522,11 +1637,15 @@ int config_parse_environ(const char *unit, return 0; } - if (u) - k = unit_full_printf(u, rvalue); - else - k = strdup(rvalue); + if (u) { + r = unit_full_printf(u, rvalue, &k); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve specifiers, ignoring: %s", rvalue); + } + if (!k) + k = strdup(rvalue); if (!k) return log_oom(); @@ -1559,6 +1678,7 @@ int config_parse_ip_tos(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1587,6 +1707,7 @@ int config_parse_unit_condition_path(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1598,6 +1719,7 @@ int config_parse_unit_condition_path(const char *unit, bool trigger, negate; Condition *c; _cleanup_free_ char *p = NULL; + int r; assert(filename); assert(lvalue); @@ -1619,9 +1741,15 @@ int config_parse_unit_condition_path(const char *unit, if (negate) rvalue++; - p = unit_full_printf(u, rvalue); - if (!p) - return log_oom(); + r = unit_full_printf(u, rvalue, &p); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve specifiers, ignoring: %s", rvalue); + if (!p) { + p = strdup(rvalue); + if (!p) + return log_oom(); + } if (!path_is_absolute(p)) { log_syntax(unit, LOG_ERR, filename, line, EINVAL, @@ -1633,7 +1761,7 @@ int config_parse_unit_condition_path(const char *unit, if (!c) return log_oom(); - LIST_PREPEND(Condition, conditions, u->conditions, c); + LIST_PREPEND(conditions, u->conditions, c); return 0; } @@ -1641,6 +1769,7 @@ int config_parse_unit_condition_string(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1652,6 +1781,7 @@ int config_parse_unit_condition_string(const char *unit, bool trigger, negate; Condition *c; _cleanup_free_ char *s = NULL; + int r; assert(filename); assert(lvalue); @@ -1673,15 +1803,21 @@ int config_parse_unit_condition_string(const char *unit, if (negate) rvalue++; - s = unit_full_printf(u, rvalue); - if (!s) - return log_oom(); + r = unit_full_printf(u, rvalue, &s); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, + "Failed to resolve specifiers, ignoring: %s", rvalue); + if (!s) { + s = strdup(rvalue); + if (!s) + return log_oom(); + } c = condition_new(cond, s, trigger, negate); if (!c) return log_oom(); - LIST_PREPEND(Condition, conditions, u->conditions, c); + LIST_PREPEND(conditions, u->conditions, c); return 0; } @@ -1689,6 +1825,7 @@ int config_parse_unit_condition_null(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1735,48 +1872,65 @@ int config_parse_unit_condition_null(const char *unit, if (!c) return log_oom(); - LIST_PREPEND(Condition, conditions, u->conditions, c); + LIST_PREPEND(conditions, u->conditions, c); return 0; } DEFINE_CONFIG_PARSE_ENUM(config_parse_notify_access, notify_access, NotifyAccess, "Failed to parse notify access specifier"); DEFINE_CONFIG_PARSE_ENUM(config_parse_start_limit_action, start_limit_action, StartLimitAction, "Failed to parse start limit action specifier"); -int config_parse_unit_requires_mounts_for(const char *unit, - const char *filename, - unsigned line, - const char *section, - const char *lvalue, - int ltype, - const char *rvalue, - void *data, - void *userdata) { +int config_parse_unit_requires_mounts_for( + const char *unit, + const char *filename, + unsigned line, + const char *section, + unsigned section_line, + const char *lvalue, + int ltype, + const char *rvalue, + void *data, + void *userdata) { Unit *u = userdata; - int r; - bool empty_before; + char *state; + size_t l; + char *w; assert(filename); assert(lvalue); assert(rvalue); assert(data); - empty_before = !u->requires_mounts_for; + FOREACH_WORD_QUOTED(w, l, rvalue, state) { + int r; + _cleanup_free_ char *n; - r = config_parse_path_strv(unit, filename, line, section, lvalue, ltype, - rvalue, data, userdata); + n = strndup(w, l); + if (!n) + return log_oom(); - /* Make it easy to find units with requires_mounts set */ - if (empty_before && u->requires_mounts_for) - LIST_PREPEND(Unit, has_requires_mounts_for, u->manager->has_requires_mounts_for, u); + if (!utf8_is_valid(n)) { + log_syntax(unit, LOG_ERR, filename, line, EINVAL, + "Path is not UTF-8 clean, ignoring assignment: %s", rvalue); + continue; + } - return r; + r = unit_require_mounts_for(u, n); + if (r < 0) { + log_syntax(unit, LOG_ERR, filename, line, r, + "Failed to add required mount for, ignoring: %s", rvalue); + continue; + } + } + + return 0; } int config_parse_documentation(const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1799,7 +1953,7 @@ int config_parse_documentation(const char *unit, return 0; } - r = config_parse_unit_strv_printf(unit, filename, line, section, lvalue, ltype, + r = config_parse_unit_strv_printf(unit, filename, line, section, section_line, lvalue, ltype, rvalue, data, userdata); if (r < 0) return r; @@ -1814,37 +1968,38 @@ int config_parse_documentation(const char *unit, free(*a); } } - *b = NULL; + if (b) + *b = NULL; return r; } -static void syscall_set(uint32_t *p, int nr) { - nr = SYSCALL_TO_INDEX(nr); - p[nr >> 4] |= 1 << (nr & 31); -} - -static void syscall_unset(uint32_t *p, int nr) { - nr = SYSCALL_TO_INDEX(nr); - p[nr >> 4] &= ~(1 << (nr & 31)); -} +#ifdef HAVE_SECCOMP +int config_parse_syscall_filter( + const char *unit, + const char *filename, + unsigned line, + const char *section, + unsigned section_line, + const char *lvalue, + int ltype, + const char *rvalue, + void *data, + void *userdata) { -int config_parse_syscall_filter(const char *unit, - const char *filename, - unsigned line, - const char *section, - const char *lvalue, - int ltype, - const char *rvalue, - void *data, - void *userdata) { + static const char default_syscalls[] = + "execve\0" + "exit\0" + "exit_group\0" + "rt_sigreturn\0" + "sigreturn\0"; ExecContext *c = data; Unit *u = userdata; bool invert = false; - char *w; + char *w, *state; size_t l; - char *state; + int r; assert(filename); assert(lvalue); @@ -1853,8 +2008,9 @@ int config_parse_syscall_filter(const char *unit, if (isempty(rvalue)) { /* Empty assignment resets the list */ - free(c->syscall_filter); + set_free(c->syscall_filter); c->syscall_filter = NULL; + c->syscall_whitelist = false; return 0; } @@ -1864,44 +2020,61 @@ int config_parse_syscall_filter(const char *unit, } if (!c->syscall_filter) { - size_t n; - - n = (syscall_max() + 31) >> 4; - c->syscall_filter = new(uint32_t, n); + c->syscall_filter = set_new(trivial_hash_func, trivial_compare_func); if (!c->syscall_filter) return log_oom(); - memset(c->syscall_filter, invert ? 0xFF : 0, n * sizeof(uint32_t)); + if (invert) + /* Allow everything but the ones listed */ + c->syscall_whitelist = false; + else { + const char *i; - /* Add these by default */ - syscall_set(c->syscall_filter, __NR_execve); - syscall_set(c->syscall_filter, __NR_rt_sigreturn); -#ifdef __NR_sigreturn - syscall_set(c->syscall_filter, __NR_sigreturn); -#endif - syscall_set(c->syscall_filter, __NR_exit_group); - syscall_set(c->syscall_filter, __NR_exit); + /* Allow nothing but the ones listed */ + c->syscall_whitelist = true; + + /* Accept default syscalls if we are on a whitelist */ + NULSTR_FOREACH(i, default_syscalls) { + int id; + + id = seccomp_syscall_resolve_name(i); + if (id < 0) + continue; + + r = set_put(c->syscall_filter, INT_TO_PTR(id + 1)); + if (r == -EEXIST) + continue; + if (r < 0) + return log_oom(); + } + } } FOREACH_WORD_QUOTED(w, l, rvalue, state) { - int id; _cleanup_free_ char *t = NULL; + int id; t = strndup(w, l); if (!t) return log_oom(); - id = syscall_from_name(t); + id = seccomp_syscall_resolve_name(t); if (id < 0) { - log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Failed to parse syscall, ignoring: %s", t); + log_syntax(unit, LOG_ERR, filename, line, EINVAL, "Failed to parse system call, ignoring: %s", t); continue; } - if (invert) - syscall_unset(c->syscall_filter, id); - else - syscall_set(c->syscall_filter, id); + /* If we previously wanted to forbid a syscall and now + * we want to allow it, then remove it from the list + */ + if (!invert == c->syscall_whitelist) { + r = set_put(c->syscall_filter, INT_TO_PTR(id + 1)); + if (r == -EEXIST) + continue; + if (r < 0) + return log_oom(); + } else + set_remove(c->syscall_filter, INT_TO_PTR(id + 1)); } c->no_new_privileges = true; @@ -1909,11 +2082,99 @@ int config_parse_syscall_filter(const char *unit, return 0; } +int config_parse_syscall_archs( + const char *unit, + const char *filename, + unsigned line, + const char *section, + unsigned section_line, + const char *lvalue, + int ltype, + const char *rvalue, + void *data, + void *userdata) { + + Set **archs = data; + char *w, *state; + size_t l; + int r; + + if (isempty(rvalue)) { + set_free(*archs); + *archs = NULL; + return 0; + } + + r = set_ensure_allocated(archs, trivial_hash_func, trivial_compare_func); + if (r < 0) + return log_oom(); + + FOREACH_WORD_QUOTED(w, l, rvalue, state) { + _cleanup_free_ char *t = NULL; + uint32_t a; + + t = strndup(w, l); + if (!t) + return log_oom(); + + r = seccomp_arch_from_string(t, &a); + if (r < 0) { + log_syntax(unit, LOG_ERR, filename, line, EINVAL, "Failed to parse system call architecture, ignoring: %s", t); + continue; + } + + r = set_put(*archs, UINT32_TO_PTR(a + 1)); + if (r == -EEXIST) + continue; + if (r < 0) + return log_oom(); + } + + return 0; +} + +int config_parse_syscall_errno( + const char *unit, + const char *filename, + unsigned line, + const char *section, + unsigned section_line, + const char *lvalue, + int ltype, + const char *rvalue, + void *data, + void *userdata) { + + ExecContext *c = data; + int e; + + assert(filename); + assert(lvalue); + assert(rvalue); + + if (isempty(rvalue)) { + /* Empty assignment resets to KILL */ + c->syscall_errno = 0; + return 0; + } + + e = errno_from_name(rvalue); + if (e < 0) { + log_syntax(unit, LOG_ERR, filename, line, EINVAL, "Failed to parse error number, ignoring: %s", rvalue); + return 0; + } + + c->syscall_errno = e; + return 0; +} +#endif + int config_parse_unit_slice( const char *unit, const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1929,21 +2190,26 @@ int config_parse_unit_slice( assert(rvalue); assert(u); - k = unit_name_printf(u, rvalue); - if (!k) - log_syntax(unit, LOG_ERR, filename, line, EINVAL, + r = unit_name_printf(u, rvalue, &k); + if (r < 0) + log_syntax(unit, LOG_ERR, filename, line, -r, "Failed to resolve unit specifiers on %s. Ignoring.", rvalue); + if (!k) { + k = strdup(rvalue); + if (!k) + return log_oom(); + } - r = manager_load_unit(u->manager, k ? k : rvalue, NULL, NULL, &slice); + r = manager_load_unit(u->manager, k, NULL, NULL, &slice); if (r < 0) { log_syntax(unit, LOG_ERR, filename, line, -r, - "Failed to load slice unit %s. Ignoring.", k ? k : rvalue); + "Failed to load slice unit %s. Ignoring.", k); return 0; } if (slice->type != UNIT_SLICE) { log_syntax(unit, LOG_ERR, filename, line, EINVAL, - "Slice unit %s is not a slice. Ignoring.", k ? k : rvalue); + "Slice unit %s is not a slice. Ignoring.", k); return 0; } @@ -1958,6 +2224,7 @@ int config_parse_cpu_shares( const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -1993,6 +2260,7 @@ int config_parse_memory_limit( const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -2000,14 +2268,11 @@ int config_parse_memory_limit( void *userdata) { CGroupContext *c = data; - uint64_t *limit; off_t bytes; int r; - limit = streq(lvalue, "MemoryLimit") ? &c->memory_limit : &c->memory_soft_limit; - if (isempty(rvalue)) { - *limit = (uint64_t) -1; + c->memory_limit = (uint64_t) -1; return 0; } @@ -2020,7 +2285,7 @@ int config_parse_memory_limit( return 0; } - *limit = (uint64_t) bytes; + c->memory_limit = (uint64_t) bytes; return 0; } @@ -2029,6 +2294,7 @@ int config_parse_device_allow( const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -2079,7 +2345,7 @@ int config_parse_device_allow( a->w = !!strchr(m, 'w'); a->m = !!strchr(m, 'm'); - LIST_PREPEND(CGroupDeviceAllow, device_allow, c->device_allow, a); + LIST_PREPEND(device_allow, c->device_allow, a); return 0; } @@ -2088,6 +2354,7 @@ int config_parse_blockio_weight( const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -2124,6 +2391,7 @@ int config_parse_blockio_device_weight( const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -2185,7 +2453,7 @@ int config_parse_blockio_device_weight( w->weight = lu; - LIST_PREPEND(CGroupBlockIODeviceWeight, device_weights, c->blockio_device_weights, w); + LIST_PREPEND(device_weights, c->blockio_device_weights, w); return 0; } @@ -2194,6 +2462,7 @@ int config_parse_blockio_bandwidth( const char *filename, unsigned line, const char *section, + unsigned section_line, const char *lvalue, int ltype, const char *rvalue, @@ -2261,11 +2530,42 @@ int config_parse_blockio_bandwidth( b->bandwidth = (uint64_t) bytes; b->read = read; - LIST_PREPEND(CGroupBlockIODeviceBandwidth, device_bandwidths, c->blockio_device_bandwidths, b); + LIST_PREPEND(device_bandwidths, c->blockio_device_bandwidths, b); return 0; } +DEFINE_CONFIG_PARSE_ENUM(config_parse_job_mode, job_mode, JobMode, "Failed to parse job mode"); + +int config_parse_job_mode_isolate( + const char *unit, + const char *filename, + unsigned line, + const char *section, + unsigned section_line, + const char *lvalue, + int ltype, + const char *rvalue, + void *data, + void *userdata) { + + JobMode *m = data; + int r; + + assert(filename); + assert(lvalue); + assert(rvalue); + + r = parse_boolean(rvalue); + if (r < 0) { + log_syntax(unit, LOG_ERR, filename, line, EINVAL, "Failed to parse boolean, ignoring: %s", rvalue); + return 0; + } + + *m = r ? JOB_ISOLATE : JOB_REPLACE; + return 0; +} + #define FOLLOW_MAX 8 static int open_follow(char **filename, FILE **_f, Set *names, char **_final) { @@ -2293,9 +2593,9 @@ static int open_follow(char **filename, FILE **_f, Set *names, char **_final) { /* Add the file name we are currently looking at to * the names of this unit, but only if it is a valid * unit name. */ - name = path_get_file_name(*filename); + name = basename(*filename); - if (unit_name_is_valid(name, true)) { + if (unit_name_is_valid(name, TEMPLATE_VALID)) { id = set_get(names, name); if (!id) { @@ -2384,9 +2684,10 @@ static int merge_by_names(Unit **u, Set *names, const char *id) { static int load_from_path(Unit *u, const char *path) { int r; - Set *symlink_names; - FILE *f = NULL; - char *filename = NULL, *id = NULL; + _cleanup_set_free_free_ Set *symlink_names = NULL; + _cleanup_fclose_ FILE *f = NULL; + _cleanup_free_ char *filename = NULL; + char *id = NULL; Unit *merged; struct stat st; @@ -2400,10 +2701,8 @@ static int load_from_path(Unit *u, const char *path) { if (path_is_absolute(path)) { filename = strdup(path); - if (!filename) { - r = -ENOMEM; - goto finish; - } + if (!filename) + return -ENOMEM; r = open_follow(&filename, &f, symlink_names, &id); if (r < 0) { @@ -2411,7 +2710,7 @@ static int load_from_path(Unit *u, const char *path) { filename = NULL; if (r != -ENOENT) - goto finish; + return r; } } else { @@ -2423,10 +2722,8 @@ static int load_from_path(Unit *u, const char *path) { * follow all symlinks and add their name to our unit * name set while doing so */ filename = path_make_absolute(path, *p); - if (!filename) { - r = -ENOMEM; - goto finish; - } + if (!filename) + return -ENOMEM; if (u->manager->unit_path_cache && !set_get(u->manager->unit_path_cache, filename)) @@ -2439,7 +2736,7 @@ static int load_from_path(Unit *u, const char *path) { filename = NULL; if (r != -ENOENT) - goto finish; + return r; /* Empty the symlink names for the next run */ set_clear_free(symlink_names); @@ -2450,27 +2747,22 @@ static int load_from_path(Unit *u, const char *path) { } } - if (!filename) { + if (!filename) /* Hmm, no suitable file found? */ - r = 0; - goto finish; - } + return 0; merged = u; r = merge_by_names(&merged, symlink_names, id); if (r < 0) - goto finish; + return r; if (merged != u) { u->load_state = UNIT_MERGED; - r = 0; - goto finish; + return 0; } - if (fstat(fileno(f), &st) < 0) { - r = -errno; - goto finish; - } + if (fstat(fileno(f), &st) < 0) + return -errno; if (null_or_empty(&st)) u->load_state = UNIT_MASKED; @@ -2482,7 +2774,7 @@ static int load_from_path(Unit *u, const char *path) { config_item_perf_lookup, (void*) load_fragment_gperf_lookup, false, true, u); if (r < 0) - goto finish; + return r; } free(u->fragment_path); @@ -2498,16 +2790,7 @@ static int load_from_path(Unit *u, const char *path) { u->source_mtime = 0; } - r = 0; - -finish: - set_free_free(symlink_names); - free(filename); - - if (f) - fclose(f); - - return r; + return 0; } int unit_load_fragment(Unit *u) { @@ -2559,31 +2842,28 @@ int unit_load_fragment(Unit *u) { /* Look for a template */ if (u->load_state == UNIT_STUB && u->instance) { - char *k; + _cleanup_free_ char *k; k = unit_name_template(u->id); if (!k) return -ENOMEM; r = load_from_path(u, k); - free(k); - if (r < 0) return r; if (u->load_state == UNIT_STUB) SET_FOREACH(t, u->names, i) { + _cleanup_free_ char *z = NULL; if (t == u->id) continue; - k = unit_name_template(t); - if (!k) + z = unit_name_template(t); + if (!z) return -ENOMEM; - r = load_from_path(u, k); - free(k); - + r = load_from_path(u, z); if (r < 0) return r; @@ -2600,6 +2880,9 @@ void unit_dump_config_items(FILE *f) { const ConfigParserCallback callback; const char *rvalue; } table[] = { +#if !defined(HAVE_SYSV_COMPAT) || !defined(HAVE_SECCOMP) + { config_parse_warn_compat, "NOTSUPPORTED" }, +#endif { config_parse_int, "INTEGER" }, { config_parse_unsigned, "UNSIGNED" }, { config_parse_bytes_size, "SIZE" }, @@ -2631,8 +2914,6 @@ void unit_dump_config_items(FILE *f) { { config_parse_service_restart, "SERVICERESTART" }, #ifdef HAVE_SYSV_COMPAT { config_parse_sysv_priority, "SYSVPRIORITY" }, -#else - { config_parse_warn_compat, "NOTSUPPORTED" }, #endif { config_parse_kill_mode, "KILLMODE" }, { config_parse_kill_signal, "SIGNAL" }, @@ -2659,9 +2940,11 @@ void unit_dump_config_items(FILE *f) { { config_parse_start_limit_action, "ACTION" }, { config_parse_set_status, "STATUS" }, { config_parse_service_sockets, "SOCKETS" }, - { config_parse_fsck_passno, "PASSNO" }, { config_parse_environ, "ENVIRON" }, - { config_parse_syscall_filter, "SYSCALL" }, +#ifdef HAVE_SECCOMP + { config_parse_syscall_filter, "SYSCALLS" }, + { config_parse_syscall_errno, "ERRNO" }, +#endif { config_parse_cpu_shares, "SHARES" }, { config_parse_memory_limit, "LIMIT" }, { config_parse_device_allow, "DEVICE" },