From 4de33e7f3238a6fe616e61139ab87e221572e5e5 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 5 Mar 2014 18:57:21 +0100 Subject: [PATCH] systemd-run: make sure --nice=, --uid=, --gid=, --setenv= also work in --scope mode --- man/systemd-run.xml | 12 ++------ src/run/run.c | 74 +++++++++++++++++++++++++++++++++++++++++++-- src/shared/strv.c | 15 +++++++++ src/shared/strv.h | 1 + 4 files changed, 90 insertions(+), 12 deletions(-) diff --git a/man/systemd-run.xml b/man/systemd-run.xml index 81d41dcc7..8bb587cf7 100644 --- a/man/systemd-run.xml +++ b/man/systemd-run.xml @@ -182,9 +182,7 @@ along with systemd; If not, see . Runs the service process under the UNIX user and group. Also see User= and Group= in - systemd.exec5. This - option has no effect in conjunction with - . + systemd.exec5. @@ -193,9 +191,7 @@ along with systemd; If not, see . Runs the service process with the specified nice level. Also see Nice= in - systemd.exec5. This - option has no effect in conjunction with - . + systemd.exec5. @@ -205,9 +201,7 @@ along with systemd; If not, see . Runs the service process with the specified environment variables set. Also see Environment= in - systemd.exec5. This - option has no effect in conjunction with - . + systemd.exec5. diff --git a/src/run/run.c b/src/run/run.c index e71ca7dc3..c6d3aabbd 100644 --- a/src/run/run.c +++ b/src/run/run.c @@ -27,6 +27,7 @@ #include "strv.h" #include "build.h" #include "unit-name.h" +#include "env-util.h" #include "path-util.h" #include "bus-error.h" @@ -231,8 +232,8 @@ static int parse_argv(int argc, char *argv[]) { return -EINVAL; } - if (arg_scope && (arg_remain_after_exit || arg_service_type || arg_exec_user || arg_exec_group || arg_nice_set || arg_environment)) { - log_error("--remain-after-exit, --service-type=, --user=, --group=, --nice= and --setenv= are not supported in --scope mode."); + if (arg_scope && (arg_remain_after_exit || arg_service_type)) { + log_error("--remain-after-exit and --service-type= are not supported in --scope mode."); return -EINVAL; } @@ -461,6 +462,7 @@ static int start_transient_scope( _cleanup_bus_message_unref_ sd_bus_message *m = NULL; _cleanup_free_ char *name = NULL; + _cleanup_strv_free_ char **env = NULL, **user_env = NULL; int r; assert(bus); @@ -484,7 +486,73 @@ static int start_transient_scope( if (r < 0) return r; - execvp(argv[0], argv); + if (arg_nice_set) { + if (setpriority(PRIO_PROCESS, 0, arg_nice) < 0) { + log_error("Failed to set nice level: %m"); + return -errno; + } + } + + if (arg_exec_group) { + gid_t gid; + + r = get_group_creds(&arg_exec_group, &gid); + if (r < 0) { + log_error("Failed to resolve group %s: %s", arg_exec_group, strerror(-r)); + return r; + } + + if (setresgid(gid, gid, gid) < 0) { + log_error("Failed to change GID to " GID_FMT ": %m", gid); + return -errno; + } + } + + if (arg_exec_user) { + const char *home, *shell; + uid_t uid; + gid_t gid; + + r = get_user_creds(&arg_exec_user, &uid, &gid, &home, &shell); + if (r < 0) { + log_error("Failed to resolve user %s: %s", arg_exec_user, strerror(-r)); + return r; + } + + r = strv_extendf(&user_env, "HOME=%s", home); + if (r < 0) + return log_oom(); + + r = strv_extendf(&user_env, "SHELL=%s", shell); + if (r < 0) + return log_oom(); + + r = strv_extendf(&user_env, "USER=%s", arg_exec_user); + if (r < 0) + return log_oom(); + + r = strv_extendf(&user_env, "LOGNAME=%s", arg_exec_user); + if (r < 0) + return log_oom(); + + if (!arg_exec_group) { + if (setresgid(gid, gid, gid) < 0) { + log_error("Failed to change GID to " GID_FMT ": %m", gid); + return -errno; + } + } + + if (setresuid(uid, uid, uid) < 0) { + log_error("Failed to change UID to " UID_FMT ": %m", uid); + return -errno; + } + } + + env = strv_env_merge(3, environ, user_env, arg_environment); + if (!env) + return log_oom(); + + execvpe(argv[0], argv, env); log_error("Failed to execute: %m"); return -errno; } diff --git a/src/shared/strv.c b/src/shared/strv.c index 67706dc38..1ef0b26a2 100644 --- a/src/shared/strv.c +++ b/src/shared/strv.c @@ -527,3 +527,18 @@ void strv_print(char **l) { STRV_FOREACH(s, l) puts(*s); } + +int strv_extendf(char ***l, const char *format, ...) { + va_list ap; + char *x; + int r; + + va_start(ap, format); + r = vasprintf(&x, format, ap); + va_end(ap); + + if (r < 0) + return -ENOMEM; + + return strv_consume(l, x); +} diff --git a/src/shared/strv.h b/src/shared/strv.h index 618951c5e..2dc2bc6c4 100644 --- a/src/shared/strv.h +++ b/src/shared/strv.h @@ -39,6 +39,7 @@ unsigned strv_length(char * const *l) _pure_; int strv_extend_strv(char ***a, char **b); int strv_extend_strv_concat(char ***a, char **b, const char *suffix); int strv_extend(char ***l, const char *value); +int strv_extendf(char ***l, const char *format, ...); int strv_push(char ***l, char *value); int strv_consume(char ***l, char *value); -- 2.30.2