SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #14589 from keszybz/sysctl-downgrade-messages

Browse Source 
sysctl: add glob patterns to set network settings more flexibly
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
2020-02-04 00:04:28 +01:00
committed by GitHub
parent 5e9c08f377 5d4fc0e665
commit 2f1fc899ce
7 changed files with 265 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/sysctl-util.c
+17 -11
View File
@@ -9,6 +9,7 @@
#include "fileio.h"
#include "log.h"
#include "macro.h"
#include "path-util.h"
#include "string-util.h"
#include "sysctl-util.h"
@@ -16,22 +17,27 @@ char *sysctl_normalize(char *s) {
char *n;
n = strpbrk(s, "/.");
/* If the first separator is a slash, the path is
* assumed to be normalized and slashes remain slashes
* and dots remains dots. */
if (!n || *n == '/')
return s;
/* Otherwise, dots become slashes and slashes become
* dots. Fun. */
while (n) {
if (*n == '.')
*n = '/';
else
*n = '.';
if (n && *n == '.')
/* Dots become slashes and slashes become dots. Fun. */
do {
if (*n == '.')
*n = '/';
else
*n = '.';
n = strpbrk(n + 1, "/.");
}
n = strpbrk(n + 1, "/.");
} while (n);
path_simplify(s, true);
/* Kill the leading slash, but keep the first character of the string in the same place. */
if (*s == '/' && *(s+1))
memmove(s, s+1, strlen(s));
return s;
}
src/shared/sysctl-util.h
+1 -1
View File
@@ -6,7 +6,7 @@
#include "macro.h"
#include "stdio-util.h"
#include "util.h"
#include "string-util.h"
char *sysctl_normalize(char *s);
int sysctl_read(const char *property, char **value);
src/sysctl/sysctl.c
+138 -72
View File
@@ -14,6 +14,7 @@
#include "errno-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "glob-util.h"
#include "hashmap.h"
#include "log.h"
#include "main-func.h"
@@ -49,63 +50,6 @@ static Option *option_free(Option *o) {
DEFINE_TRIVIAL_CLEANUP_FUNC(Option*, option_free);
DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(option_hash_ops, char, string_hash_func, string_compare_func, Option, option_free);
static Option *option_new(
const char *key,
const char *value,
bool ignore_failure) {
_cleanup_(option_freep) Option *o = NULL;
assert(key);
assert(value);
o = new(Option, 1);
if (!o)
return NULL;
*o = (Option) {
.key = strdup(key),
.value = strdup(value),
.ignore_failure = ignore_failure,
};
if (!o->key || !o->value)
return NULL;
return TAKE_PTR(o);
}
static int apply_all(OrderedHashmap *sysctl_options) {
Option *option;
Iterator i;
int r = 0;
ORDERED_HASHMAP_FOREACH(option, sysctl_options, i) {
int k;
k = sysctl_write(option->key, option->value);
if (k < 0) {
/* If the sysctl is not available in the kernel or we are running with reduced
* privileges and cannot write it, then log about the issue, and proceed without
* failing. (EROFS is treated as a permission problem here, since that's how
* container managers usually protected their sysctls.) In all other cases log an
* error and make the tool fail. */
if (option->ignore_failure || k == -EROFS || ERRNO_IS_PRIVILEGE(k))
log_debug_errno(k, "Couldn't write '%s' to '%s', ignoring: %m", option->value, option->key);
else if (k == -ENOENT)
log_info_errno(k, "Couldn't write '%s' to '%s', ignoring: %m", option->value, option->key);
else {
log_error_errno(k, "Couldn't write '%s' to '%s': %m", option->value, option->key);
if (r == 0)
r = k;
}
}
}
return r;
}
static bool test_prefix(const char *p) {
char **i;
@@ -118,6 +62,7 @@ static bool test_prefix(const char *p) {
t = path_startswith(*i, "/proc/sys/");
if (!t)
t = *i;
if (path_startswith(p, t))
return true;
}
@@ -125,6 +70,117 @@ static bool test_prefix(const char *p) {
return false;
}
static Option *option_new(
const char *key,
const char *value,
bool ignore_failure) {
_cleanup_(option_freep) Option *o = NULL;
assert(key);
o = new(Option, 1);
if (!o)
return NULL;
*o = (Option) {
.key = strdup(key),
.value = value ? strdup(value) : NULL,
.ignore_failure = ignore_failure,
};
if (!o->key)
return NULL;
if (value && !o->value)
return NULL;
return TAKE_PTR(o);
}
static int sysctl_write_or_warn(const char *key, const char *value, bool ignore_failure) {
int r;
r = sysctl_write(key, value);
if (r < 0) {
/* If the sysctl is not available in the kernel or we are running with reduced privileges and
* cannot write it, then log about the issue, and proceed without failing. (EROFS is treated
* as a permission problem here, since that's how container managers usually protected their
* sysctls.) In all other cases log an error and make the tool fail. */
if (ignore_failure || r == -EROFS || ERRNO_IS_PRIVILEGE(r))
log_debug_errno(r, "Couldn't write '%s' to '%s', ignoring: %m", value, key);
else if (r == -ENOENT)
log_info_errno(r, "Couldn't write '%s' to '%s', ignoring: %m", value, key);
else
return log_error_errno(r, "Couldn't write '%s' to '%s': %m", value, key);
}
return 0;
}
static int apply_all(OrderedHashmap *sysctl_options) {
Option *option;
Iterator i;
int r = 0;
ORDERED_HASHMAP_FOREACH(option, sysctl_options, i) {
int k;
/* Ignore "negative match" options, they are there only to exclude stuff from globs. */
if (!option->value)
continue;
if (string_is_glob(option->key)) {
_cleanup_strv_free_ char **paths = NULL;
_cleanup_free_ char *pattern = NULL;
char **s;
pattern = path_join("/proc/sys", option->key);
if (!pattern)
return log_oom();
k = glob_extend(&paths, pattern);
if (k < 0) {
if (option->ignore_failure || ERRNO_IS_PRIVILEGE(r))
log_debug_errno(k, "Failed to resolve glob '%s', ignoring: %m",
option->key);
else {
log_error_errno(k, "Couldn't resolve glob '%s': %m",
option->key);
if (r == 0)
r = k;
}
} else if (strv_isempty(paths))
log_debug("No match for glob: %s", option->key);
STRV_FOREACH(s, paths) {
const char *key;
assert_se(key = path_startswith(*s, "/proc/sys"));
if (!test_prefix(key))
continue;
if (ordered_hashmap_contains(sysctl_options, key)) {
log_info("Not setting %s (explicit setting exists).", key);
continue;
}
k = sysctl_write_or_warn(key, option->value, option->ignore_failure);
if (r == 0)
r = k;
}
} else {
k = sysctl_write_or_warn(option->key, option->value, option->ignore_failure);
if (r == 0)
r = k;
}
}
return r;
}
static int parse_file(OrderedHashmap **sysctl_options, const char *path, bool ignore_enoent) {
_cleanup_fclose_ FILE *f = NULL;
unsigned c = 0;
@@ -144,7 +200,7 @@ static int parse_file(OrderedHashmap **sysctl_options, const char *path, bool ig
for (;;) {
_cleanup_(option_freep) Option *new_option = NULL;
_cleanup_free_ char *l = NULL;
bool ignore_failure;
bool ignore_failure = false;
Option *existing;
char *p, *value;
int k;
@@ -165,25 +221,35 @@ static int parse_file(OrderedHashmap **sysctl_options, const char *path, bool ig
continue;
value = strchr(p, '=');
if (!value) {
log_syntax(NULL, LOG_WARNING, path, c, 0, "Line is not an assignment, ignoring: %s", p);
if (r == 0)
r = -EINVAL;
continue;
if (value) {
if (p[0] == '-') {
ignore_failure = true;
p++;
}
*value = 0;
value++;
value = strstrip(value);
} else {
if (p[0] == '-')
/* We have a "negative match" option. Let's continue with value==NULL. */
p++;
else {
log_syntax(NULL, LOG_WARNING, path, c, 0,
"Line is not an assignment, ignoring: %s", p);
if (r == 0)
r = -EINVAL;
continue;
}
}
*value = 0;
value++;
p = strstrip(p);
ignore_failure = p[0] == '-';
if (ignore_failure)
p++;
p = sysctl_normalize(p);
value = strstrip(value);
if (!test_prefix(p))
/* We can't filter out globs at this point, we'll need to do that later. */
if (!string_is_glob(p) &&
!test_prefix(p))
continue;
if (ordered_hashmap_ensure_allocated(sysctl_options, &option_hash_ops) < 0)
src/test/meson.build
+4
View File
@@ -325,6 +325,10 @@ tests += [
[],
[]],
[['src/test/test-sysctl-util.c'],
[],
[]],
[['src/test/test-user-util.c'],
[],
[]],
src/test/test-sysctl-util.c
+44
View File
@@ -0,0 +1,44 @@
/* SPDX-License-Identifier: LGPL-2.1+ */
#include "strv.h"
#include "sysctl-util.h"
#include "tests.h"
static const char* cases[] = {
"a.b.c", "a/b/c",
"a/b/c", "a/b/c",
"a/b.c/d", "a/b.c/d",
"a.b/c.d", "a/b.c/d",
"net.ipv4.conf.enp3s0/200.forwarding", "net/ipv4/conf/enp3s0.200/forwarding",
"net/ipv4/conf/enp3s0.200/forwarding", "net/ipv4/conf/enp3s0.200/forwarding",
"a...b...c", "a/b/c",
"a///b///c", "a/b/c",
".a...b...c", "a/b/c",
"/a///b///c", "a/b/c",
NULL,
};
static void test_sysctl_normalize(void) {
log_info("/* %s */", __func__);
const char **s, **expected;
STRV_FOREACH_PAIR(s, expected, cases) {
_cleanup_free_ char *t;
assert_se(t = strdup(*s));
assert_se(sysctl_normalize(t) == t);
log_info("\"%s\" → \"%s\", expected \"%s\"", *s, t, *expected);
assert_se(streq(t, *expected));
}
}
int main(int argc, char *argv[]) {
test_setup_logging(LOG_INFO);
test_sysctl_normalize();
return 0;
}