Merge pull request #7695 from yuwata/transient-socket

DBus-API: implement transient socket unit

src/shared/ask-password-api.c

@@ -656,7 +656,7 @@ int ask_password_agent(
                                 goto finish;
                         }
 
-                        if (strv_length(l) <= 0) {
+                        if (strv_isempty(l)) {
                                 l = strv_free(l);
                                 log_debug("Invalid packet");
                                 continue;

src/shared/bus-unit-util.h

@@ -20,10 +20,10 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-#include "sd-bus.h"
-
-#include "output-mode.h"
 #include "install.h"
+#include "output-mode.h"
+#include "sd-bus.h"
+#include "unit-def.h"
 
 typedef struct UnitInfo {
         const char *machine;
@@ -41,8 +41,8 @@ typedef struct UnitInfo {
 
 int bus_parse_unit_info(sd_bus_message *message, UnitInfo *u);
 
-int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignment);
-int bus_append_unit_property_assignment_many(sd_bus_message *m, char **l);
+int bus_append_unit_property_assignment(sd_bus_message *m, UnitType t, const char *assignment);
+int bus_append_unit_property_assignment_many(sd_bus_message *m, UnitType t, char **l);
 
 typedef struct BusWaitForJobs BusWaitForJobs;
 

src/shared/seccomp-util.c

@@ -950,6 +950,65 @@ int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* set, u
         return 0;
 }
 
+int seccomp_parse_syscall_filter_internal(
+                bool invert,
+                const char *name,
+                int errno_num,
+                Hashmap *filter,
+                bool whitelist,
+                bool warn,
+                const char *unit,
+                const char *filename,
+                unsigned line) {
+
+        int r;
+
+        assert(name);
+        assert(filter);
+
+        if (name[0] == '@') {
+                const SyscallFilterSet *set;
+                const char *i;
+
+                set = syscall_filter_set_find(name);
+                if (!set) {
+                        if (warn) {
+                                log_syntax(unit, LOG_WARNING, filename, line, 0, "Unknown system call group, ignoring: %s", name);
+                                return 0;
+                        } else
+                                return -EINVAL;
+                }
+
+                NULSTR_FOREACH(i, set->value) {
+                        r = seccomp_parse_syscall_filter_internal(invert, i, errno_num, filter, whitelist, warn, unit, filename, line);
+                        if (r < 0)
+                                return r;
+                }
+        } else {
+                int id;
+
+                id = seccomp_syscall_resolve_name(name);
+                if (id == __NR_SCMP_ERROR) {
+                        if (warn) {
+                                log_syntax(unit, LOG_WARNING, filename, line, 0, "Failed to parse system call, ignoring: %s", name);
+                                return 0;
+                        } else
+                                return -EINVAL;
+                }
+
+                /* If we previously wanted to forbid a syscall and now
+                 * we want to allow it, then remove it from the list. */
+                if (!invert == whitelist) {
+                        r = hashmap_put(filter, INT_TO_PTR(id + 1), INT_TO_PTR(errno_num));
+                        if (r < 0)
+                                return warn ? log_oom() : -ENOMEM;
+                } else
+                        (void) hashmap_remove(filter, INT_TO_PTR(id + 1));
+        }
+
+        return 0;
+}
+
 int seccomp_restrict_namespaces(unsigned long retain) {
         uint32_t arch;
         int r;

src/shared/seccomp-util.h

@@ -81,6 +81,24 @@ int seccomp_add_syscall_filter_item(scmp_filter_ctx *ctx, const char *name, uint
 int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilterSet *set, uint32_t action);
 int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* set, uint32_t action);
 
+int seccomp_parse_syscall_filter_internal(
+                bool invert, const char *name, int errno_num, Hashmap *filter, bool whitelist,
+                bool warn, const char *unit, const char *filename, unsigned line);
+
+static inline int seccomp_parse_syscall_filter_and_warn(
+                bool invert, const char *name, int errno_num, Hashmap *filter, bool whitelist,
+                const char *unit, const char *filename, unsigned line) {
+        assert(unit);
+        assert(filename);
+
+        return seccomp_parse_syscall_filter_internal(invert, name, errno_num, filter, whitelist, true, unit, filename, line);
+}
+
+static inline int seccomp_parse_syscall_filter(
+                bool invert, const char *name, int errno_num, Hashmap *filter, bool whitelist) {
+        return seccomp_parse_syscall_filter_internal(invert, name, errno_num, filter, whitelist, false, NULL, NULL, 0);
+}
+
 int seccomp_restrict_archs(Set *archs);
 int seccomp_restrict_namespaces(unsigned long retain);
 int seccomp_protect_sysctl(void);