From c61f302d3c35c2ed2fbc89acd4eff323531fecbf Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Sun, 27 Aug 2017 01:40:47 +0900 Subject: [PATCH 1/4] units: make use of !! ExecStart= prefix in systemd-networkd.service Let's make use of !! to run networkd with ambient capabilities on systems supporting them. --- src/network/networkd.c | 18 +++++++++++------- units/systemd-networkd.service.in | 9 ++++++--- 2 files changed, 17 insertions(+), 10 deletions(-) diff --git a/src/network/networkd.c b/src/network/networkd.c index fe60f1ed14..8efd160aaa 100644 --- a/src/network/networkd.c +++ b/src/network/networkd.c @@ -70,13 +70,17 @@ int main(int argc, char *argv[]) { if (r < 0) log_warning_errno(r, "Could not create runtime directory 'lldp': %m"); - r = drop_privileges(uid, gid, - (1ULL << CAP_NET_ADMIN) | - (1ULL << CAP_NET_BIND_SERVICE) | - (1ULL << CAP_NET_BROADCAST) | - (1ULL << CAP_NET_RAW)); - if (r < 0) - goto out; + /* Drop privileges, but only if we have been started as root. If we are not running as root we assume all + * privileges are already dropped. */ + if (geteuid() == 0) { + r = drop_privileges(uid, gid, + (1ULL << CAP_NET_ADMIN) | + (1ULL << CAP_NET_BIND_SERVICE) | + (1ULL << CAP_NET_BROADCAST) | + (1ULL << CAP_NET_RAW)); + if (r < 0) + goto out; + } assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0); diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 218e5c4d3f..3f0ad77b7d 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -20,9 +20,11 @@ Wants=network.target Type=notify Restart=on-failure RestartSec=0 -ExecStart=@rootlibexecdir@/systemd-networkd +ExecStart=!!@rootlibexecdir@/systemd-networkd WatchdogSec=3min -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER +User=systemd-network +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes @@ -32,7 +34,8 @@ RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native -ReadWritePaths=/run/systemd +RuntimeDirectory=systemd/netif +RuntimeDirectoryPreserve=yes [Install] WantedBy=multi-user.target From 87a85e25a2ebcc1e519249d0513e34bb20ceed49 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Thu, 10 Aug 2017 16:07:08 +0900 Subject: [PATCH 2/4] units: make use of !! ExecStart= prefix in systemd-timesyncd.service Let's make use of !! to run timesyncd with ambient capabilities on systems supporting them. --- src/timesync/timesyncd.c | 10 +++++++--- units/systemd-timesyncd.service.in | 8 +++++--- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c index 86c14020b4..31e84b1aed 100644 --- a/src/timesync/timesyncd.c +++ b/src/timesync/timesyncd.c @@ -111,9 +111,13 @@ int main(int argc, char *argv[]) { if (r < 0) goto finish; - r = drop_privileges(uid, gid, (1ULL << CAP_SYS_TIME)); - if (r < 0) - goto finish; + /* Drop privileges, but only if we have been started as root. If we are not running as root we assume all + * privileges are already dropped. */ + if (geteuid() == 0) { + r = drop_privileges(uid, gid, (1ULL << CAP_SYS_TIME)); + if (r < 0) + goto finish; + } assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0); diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 8d328bb80a..e25d86d655 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -12,7 +12,7 @@ ConditionCapability=CAP_SYS_TIME ConditionVirtualization=!container DefaultDependencies=no RequiresMountsFor=/var/lib/systemd/clock -After=systemd-remount-fs.service systemd-tmpfiles-setup.service systemd-sysusers.service +After=systemd-remount-fs.service systemd-sysusers.service Before=time-sync.target sysinit.target shutdown.target Conflicts=shutdown.target Wants=time-sync.target @@ -21,9 +21,11 @@ Wants=time-sync.target Type=notify Restart=always RestartSec=0 -ExecStart=@rootlibexecdir@/systemd-timesyncd +ExecStart=!!@rootlibexecdir@/systemd-timesyncd WatchdogSec=3min -CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER +User=systemd-timesync +CapabilityBoundingSet=CAP_SYS_TIME +AmbientCapabilities=CAP_SYS_TIME PrivateTmp=yes PrivateDevices=yes ProtectSystem=strict From 53d133ea1bb4c4ed44c4b6aae42f1feb33d9cb78 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 30 Aug 2017 15:59:57 +0900 Subject: [PATCH 3/4] timesync: move stamp file to /var/lib/systemd/timesync/clock --- man/systemd-timesyncd.service.xml | 2 +- src/timesync/timesyncd-manager.c | 2 +- src/timesync/timesyncd.c | 27 +++++++++++++++++++-------- units/systemd-timesyncd.service.in | 4 ++-- 4 files changed, 23 insertions(+), 12 deletions(-) diff --git a/man/systemd-timesyncd.service.xml b/man/systemd-timesyncd.service.xml index 3edcaf1b4e..7860c0d4e4 100644 --- a/man/systemd-timesyncd.service.xml +++ b/man/systemd-timesyncd.service.xml @@ -88,7 +88,7 @@ - /var/lib/systemd/clock + /var/lib/systemd/timesync/clock This file contains the timestamp of the last successful diff --git a/src/timesync/timesyncd-manager.c b/src/timesync/timesyncd-manager.c index 4458f98ebf..eacb10f1c0 100644 --- a/src/timesync/timesyncd-manager.c +++ b/src/timesync/timesyncd-manager.c @@ -373,7 +373,7 @@ static int manager_adjust_clock(Manager *m, double offset, int leap_sec) { return -errno; /* If touch fails, there isn't much we can do. Maybe it'll work next time. */ - (void) touch("/var/lib/systemd/clock"); + (void) touch("/var/lib/systemd/timesync/clock"); m->drift_ppm = tmx.freq / 65536; diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c index 31e84b1aed..6b802c607c 100644 --- a/src/timesync/timesyncd.c +++ b/src/timesync/timesyncd.c @@ -24,6 +24,7 @@ #include "clock-util.h" #include "fd-util.h" #include "fs-util.h" +#include "mkdir.h" #include "network-util.h" #include "process-util.h" #include "signal-util.h" @@ -44,7 +45,7 @@ static int load_clock_timestamp(uid_t uid, gid_t gid) { * systems lacking a battery backed RTC. We also will adjust * the time to at least the build time of systemd. */ - fd = open("/var/lib/systemd/clock", O_RDWR|O_CLOEXEC, 0644); + fd = open("/var/lib/systemd/timesync/clock", O_RDWR|O_CLOEXEC, 0644); if (fd >= 0) { struct stat st; usec_t stamp; @@ -57,14 +58,24 @@ static int load_clock_timestamp(uid_t uid, gid_t gid) { min = stamp; } - /* Try to fix the access mode, so that we can still - touch the file after dropping priviliges */ - (void) fchmod(fd, 0644); - (void) fchown(fd, uid, gid); + if (geteuid() == 0) { + /* Try to fix the access mode, so that we can still + touch the file after dropping priviliges */ + r = fchmod(fd, 0644); + if (r < 0) + return log_error_errno(errno, "Failed to change file access mode: %m"); + r = fchown(fd, uid, gid); + return log_error_errno(errno, "Failed to change file owner: %m"); + } + + } else { + r = mkdir_safe_label("/var/lib/systemd/timesync", 0755, uid, gid); + if (r < 0) + return log_error_errno(r, "Failed to create state directory: %m"); - } else /* create stamp file with the compiled-in date */ - (void) touch_file("/var/lib/systemd/clock", true, min, uid, gid, 0644); + (void) touch_file("/var/lib/systemd/timesync/clock", false, min, uid, gid, 0644); + } ct = now(CLOCK_REALTIME); if (ct < min) { @@ -162,7 +173,7 @@ int main(int argc, char *argv[]) { /* if we got an authoritative time, store it in the file system */ if (m->sync) - (void) touch("/var/lib/systemd/clock"); + (void) touch("/var/lib/systemd/timesync/clock"); sd_event_get_exit_code(m->event, &r); diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index e25d86d655..14557a5661 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -11,7 +11,7 @@ Documentation=man:systemd-timesyncd.service(8) ConditionCapability=CAP_SYS_TIME ConditionVirtualization=!container DefaultDependencies=no -RequiresMountsFor=/var/lib/systemd/clock +RequiresMountsFor=/var/lib/systemd/timesync/clock After=systemd-remount-fs.service systemd-sysusers.service Before=time-sync.target sysinit.target shutdown.target Conflicts=shutdown.target @@ -39,7 +39,7 @@ RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native -ReadWritePaths=/var/lib/systemd +StateDirectory=systemd/timesync [Install] WantedBy=sysinit.target From 5ed0dcf4d552271115d96d8d22b1a25494b85277 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Sun, 27 Aug 2017 01:48:23 +0900 Subject: [PATCH 4/4] test: drop Exec* prefixes to obtain paths of executables --- test/networkd-test.py | 2 +- test/test-functions | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/test/networkd-test.py b/test/networkd-test.py index 9bf7ee0019..5760ca5137 100755 --- a/test/networkd-test.py +++ b/test/networkd-test.py @@ -752,7 +752,7 @@ DNS=192.168.5.1 EOF # run networkd as in systemd-networkd.service -exec $(systemctl cat systemd-networkd.service | sed -n '/^ExecStart=/ { s/^.*=//; p}') +exec $(systemctl cat systemd-networkd.service | sed -n '/^ExecStart=/ { s/^.*=//; s/^[@+-]//; s/^!*//; p}') ''' % {'ifr': self.if_router, 'ifc': self.iface, 'addr6': ipv6 and 'Address=2600::1/64' or '', 'dhopts': dhcpserver_opts or ''}) diff --git a/test/test-functions b/test/test-functions index 67fe5e19b8..745c0a9abe 100644 --- a/test/test-functions +++ b/test/test-functions @@ -426,7 +426,7 @@ install_execs() { systemduserunitdir=$(pkg-config --variable=systemduserunitdir systemd) egrep -ho '^Exec[^ ]*=[^ ]+' $initdir/{$systemdsystemunitdir,$systemduserunitdir}/*.service \ | while read i; do - i=${i##Exec*=}; i=${i##-} + i=${i##Exec*=}; i=${i##[@+\!-]}; i=${i##\!} # some {rc,halt}.local scripts and programs are okay to not exist, the rest should inst $i || [ "${i%.local}" != "$i" ] || [ "${i%systemd-update-done}" != "$i" ] done