From c31ad024034c97ab8343810822541407aa91b73b Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 6 Oct 2017 16:03:33 +0900 Subject: [PATCH 1/4] mkdir: introduce follow_symlink flag to mkdir_safe{,_label}() --- src/basic/mkdir-label.c | 4 ++-- src/basic/mkdir.c | 20 +++++++++++++++++--- src/basic/mkdir.h | 6 +++--- src/core/execute.c | 2 +- src/login/logind-dbus.c | 4 ++-- src/login/logind-inhibit.c | 4 ++-- src/login/logind-seat.c | 2 +- src/login/logind-session.c | 4 ++-- src/login/logind-user.c | 4 ++-- src/machine/machine.c | 2 +- src/network/networkd.c | 8 ++++---- src/nspawn/nspawn-setuid.c | 2 +- src/resolve/resolved.c | 2 +- src/test/test-fs-util.c | 2 +- src/timesync/timesyncd.c | 2 +- 15 files changed, 41 insertions(+), 27 deletions(-) diff --git a/src/basic/mkdir-label.c b/src/basic/mkdir-label.c index aa6878cdf0..731269c81c 100644 --- a/src/basic/mkdir-label.c +++ b/src/basic/mkdir-label.c @@ -25,8 +25,8 @@ #include "label.h" #include "mkdir.h" -int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid) { - return mkdir_safe_internal(path, mode, uid, gid, mkdir_label); +int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid, bool follow_symlink) { + return mkdir_safe_internal(path, mode, uid, gid, follow_symlink, mkdir_label); } int mkdir_parents_label(const char *path, mode_t mode) { diff --git a/src/basic/mkdir.c b/src/basic/mkdir.c index 7db09fc6a1..fb3a9430ba 100644 --- a/src/basic/mkdir.c +++ b/src/basic/mkdir.c @@ -22,6 +22,7 @@ #include #include +#include "alloc-util.h" #include "fs-util.h" #include "macro.h" #include "mkdir.h" @@ -29,7 +30,7 @@ #include "stat-util.h" #include "user-util.h" -int mkdir_safe_internal(const char *path, mode_t mode, uid_t uid, gid_t gid, mkdir_func_t _mkdir) { +int mkdir_safe_internal(const char *path, mode_t mode, uid_t uid, gid_t gid, bool follow_symlink, mkdir_func_t _mkdir) { struct stat st; int r; @@ -42,6 +43,19 @@ int mkdir_safe_internal(const char *path, mode_t mode, uid_t uid, gid_t gid, mkd if (lstat(path, &st) < 0) return -errno; + if (follow_symlink && S_ISLNK(st.st_mode)) { + _cleanup_free_ char *p = NULL; + + r = chase_symlinks(path, NULL, CHASE_NONEXISTENT, &p); + if (r < 0) + return r; + if (r == 0) + return mkdir_safe_internal(p, mode, uid, gid, false, _mkdir); + + if (lstat(p, &st) < 0) + return -errno; + } + if ((st.st_mode & 0007) > (mode & 0007) || (st.st_mode & 0070) > (mode & 0070) || (st.st_mode & 0700) > (mode & 0700) || @@ -53,8 +67,8 @@ int mkdir_safe_internal(const char *path, mode_t mode, uid_t uid, gid_t gid, mkd return 0; } -int mkdir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid) { - return mkdir_safe_internal(path, mode, uid, gid, mkdir); +int mkdir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid, bool follow_symlink) { + return mkdir_safe_internal(path, mode, uid, gid, follow_symlink, mkdir); } int mkdir_parents_internal(const char *prefix, const char *path, mode_t mode, mkdir_func_t _mkdir) { diff --git a/src/basic/mkdir.h b/src/basic/mkdir.h index d564a3547f..4e12b5e165 100644 --- a/src/basic/mkdir.h +++ b/src/basic/mkdir.h @@ -22,17 +22,17 @@ #include -int mkdir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid); +int mkdir_safe(const char *path, mode_t mode, uid_t uid, gid_t gid, bool follow_symlink); int mkdir_parents(const char *path, mode_t mode); int mkdir_p(const char *path, mode_t mode); /* mandatory access control(MAC) versions */ -int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid); +int mkdir_safe_label(const char *path, mode_t mode, uid_t uid, gid_t gid, bool follow_symlink); int mkdir_parents_label(const char *path, mode_t mode); int mkdir_p_label(const char *path, mode_t mode); /* internally used */ typedef int (*mkdir_func_t)(const char *pathname, mode_t mode); -int mkdir_safe_internal(const char *path, mode_t mode, uid_t uid, gid_t gid, mkdir_func_t _mkdir); +int mkdir_safe_internal(const char *path, mode_t mode, uid_t uid, gid_t gid, bool follow_symlink, mkdir_func_t _mkdir); int mkdir_parents_internal(const char *prefix, const char *path, mode_t mode, mkdir_func_t _mkdir); int mkdir_p_internal(const char *prefix, const char *path, mode_t mode, mkdir_func_t _mkdir); diff --git a/src/core/execute.c b/src/core/execute.c index c4dfac96d9..3aeb21f999 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -1974,7 +1974,7 @@ static int setup_exec_directory( } /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */ - r = mkdir_safe_label(private_root, 0700, 0, 0); + r = mkdir_safe_label(private_root, 0700, 0, 0, false); if (r < 0) goto fail; diff --git a/src/login/logind-dbus.c b/src/login/logind-dbus.c index 2342375f20..f62a02c4d1 100644 --- a/src/login/logind-dbus.c +++ b/src/login/logind-dbus.c @@ -1170,7 +1170,7 @@ static int method_set_user_linger(sd_bus_message *message, void *userdata, sd_bu mkdir_p_label("/var/lib/systemd", 0755); - r = mkdir_safe_label("/var/lib/systemd/linger", 0755, 0, 0); + r = mkdir_safe_label("/var/lib/systemd/linger", 0755, 0, 0, false); if (r < 0) return r; @@ -1904,7 +1904,7 @@ static int update_schedule_file(Manager *m) { assert(m); - r = mkdir_safe_label("/run/systemd/shutdown", 0755, 0, 0); + r = mkdir_safe_label("/run/systemd/shutdown", 0755, 0, 0, false); if (r < 0) return log_error_errno(r, "Failed to create shutdown subdirectory: %m"); diff --git a/src/login/logind-inhibit.c b/src/login/logind-inhibit.c index 1e6f383738..c1a319b87d 100644 --- a/src/login/logind-inhibit.c +++ b/src/login/logind-inhibit.c @@ -86,7 +86,7 @@ int inhibitor_save(Inhibitor *i) { assert(i); - r = mkdir_safe_label("/run/systemd/inhibit", 0755, 0, 0); + r = mkdir_safe_label("/run/systemd/inhibit", 0755, 0, 0, false); if (r < 0) goto fail; @@ -290,7 +290,7 @@ int inhibitor_create_fifo(Inhibitor *i) { /* Create FIFO */ if (!i->fifo_path) { - r = mkdir_safe_label("/run/systemd/inhibit", 0755, 0, 0); + r = mkdir_safe_label("/run/systemd/inhibit", 0755, 0, 0, false); if (r < 0) return r; diff --git a/src/login/logind-seat.c b/src/login/logind-seat.c index 64a622307e..133863ea1c 100644 --- a/src/login/logind-seat.c +++ b/src/login/logind-seat.c @@ -93,7 +93,7 @@ int seat_save(Seat *s) { if (!s->started) return 0; - r = mkdir_safe_label("/run/systemd/seats", 0755, 0, 0); + r = mkdir_safe_label("/run/systemd/seats", 0755, 0, 0, false); if (r < 0) goto fail; diff --git a/src/login/logind-session.c b/src/login/logind-session.c index 736f7d9fc1..730acd2978 100644 --- a/src/login/logind-session.c +++ b/src/login/logind-session.c @@ -179,7 +179,7 @@ int session_save(Session *s) { if (!s->started) return 0; - r = mkdir_safe_label("/run/systemd/sessions", 0755, 0, 0); + r = mkdir_safe_label("/run/systemd/sessions", 0755, 0, 0, false); if (r < 0) goto fail; @@ -948,7 +948,7 @@ int session_create_fifo(Session *s) { /* Create FIFO */ if (!s->fifo_path) { - r = mkdir_safe_label("/run/systemd/sessions", 0755, 0, 0); + r = mkdir_safe_label("/run/systemd/sessions", 0755, 0, 0, false); if (r < 0) return r; diff --git a/src/login/logind-user.c b/src/login/logind-user.c index 068bc455b5..dcf367e22d 100644 --- a/src/login/logind-user.c +++ b/src/login/logind-user.c @@ -141,7 +141,7 @@ static int user_save_internal(User *u) { assert(u); assert(u->state_file); - r = mkdir_safe_label("/run/systemd/users", 0755, 0, 0); + r = mkdir_safe_label("/run/systemd/users", 0755, 0, 0, false); if (r < 0) goto fail; @@ -334,7 +334,7 @@ static int user_mkdir_runtime_path(User *u) { assert(u); - r = mkdir_safe_label("/run/user", 0755, 0, 0); + r = mkdir_safe_label("/run/user", 0755, 0, 0, false); if (r < 0) return log_error_errno(r, "Failed to create /run/user: %m"); diff --git a/src/machine/machine.c b/src/machine/machine.c index 399e41f870..eb96126156 100644 --- a/src/machine/machine.c +++ b/src/machine/machine.c @@ -128,7 +128,7 @@ int machine_save(Machine *m) { if (!m->started) return 0; - r = mkdir_safe_label("/run/systemd/machines", 0755, 0, 0); + r = mkdir_safe_label("/run/systemd/machines", 0755, 0, 0, false); if (r < 0) goto fail; diff --git a/src/network/networkd.c b/src/network/networkd.c index d5ba6893e3..da2fe44bdd 100644 --- a/src/network/networkd.c +++ b/src/network/networkd.c @@ -54,19 +54,19 @@ int main(int argc, char *argv[]) { /* Always create the directories people can create inotify * watches in. */ - r = mkdir_safe_label("/run/systemd/netif", 0755, uid, gid); + r = mkdir_safe_label("/run/systemd/netif", 0755, uid, gid, false); if (r < 0) log_warning_errno(r, "Could not create runtime directory: %m"); - r = mkdir_safe_label("/run/systemd/netif/links", 0755, uid, gid); + r = mkdir_safe_label("/run/systemd/netif/links", 0755, uid, gid, false); if (r < 0) log_warning_errno(r, "Could not create runtime directory 'links': %m"); - r = mkdir_safe_label("/run/systemd/netif/leases", 0755, uid, gid); + r = mkdir_safe_label("/run/systemd/netif/leases", 0755, uid, gid, false); if (r < 0) log_warning_errno(r, "Could not create runtime directory 'leases': %m"); - r = mkdir_safe_label("/run/systemd/netif/lldp", 0755, uid, gid); + r = mkdir_safe_label("/run/systemd/netif/lldp", 0755, uid, gid, false); if (r < 0) log_warning_errno(r, "Could not create runtime directory 'lldp': %m"); diff --git a/src/nspawn/nspawn-setuid.c b/src/nspawn/nspawn-setuid.c index b8e8e091c8..db0710785e 100644 --- a/src/nspawn/nspawn-setuid.c +++ b/src/nspawn/nspawn-setuid.c @@ -244,7 +244,7 @@ int change_uid_gid(const char *user, char **_home) { if (r < 0) return log_error_errno(r, "Failed to make home root directory: %m"); - r = mkdir_safe(home, 0755, uid, gid); + r = mkdir_safe(home, 0755, uid, gid, false); if (r < 0 && r != -EEXIST) return log_error_errno(r, "Failed to make home directory: %m"); diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c index 2eb7bfd030..d6f916bbda 100644 --- a/src/resolve/resolved.c +++ b/src/resolve/resolved.c @@ -61,7 +61,7 @@ int main(int argc, char *argv[]) { } /* Always create the directory where resolv.conf will live */ - r = mkdir_safe_label("/run/systemd/resolve", 0755, uid, gid); + r = mkdir_safe_label("/run/systemd/resolve", 0755, uid, gid, false); if (r < 0) { log_error_errno(r, "Could not create runtime directory: %m"); goto finish; diff --git a/src/test/test-fs-util.c b/src/test/test-fs-util.c index 9e964a8bbb..873a7fdd6c 100644 --- a/src/test/test-fs-util.c +++ b/src/test/test-fs-util.c @@ -221,7 +221,7 @@ static void test_readlink_and_make_absolute(void) { char name_alias[] = "/tmp/test-readlink_and_make_absolute-alias"; char *r = NULL; - assert_se(mkdir_safe(tempdir, 0755, getuid(), getgid()) >= 0); + assert_se(mkdir_safe(tempdir, 0755, getuid(), getgid(), false) >= 0); assert_se(touch(name) >= 0); assert_se(symlink(name, name_alias) >= 0); diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c index 6b802c607c..d895aa8cc1 100644 --- a/src/timesync/timesyncd.c +++ b/src/timesync/timesyncd.c @@ -69,7 +69,7 @@ static int load_clock_timestamp(uid_t uid, gid_t gid) { } } else { - r = mkdir_safe_label("/var/lib/systemd/timesync", 0755, uid, gid); + r = mkdir_safe_label("/var/lib/systemd/timesync", 0755, uid, gid, false); if (r < 0) return log_error_errno(r, "Failed to create state directory: %m"); From 48d3e88c18258d423c3953372ec4a2e638ab0422 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 6 Oct 2017 16:05:20 +0900 Subject: [PATCH 2/4] timesyncd: enable DynamicUser= --- src/timesync/timesyncd.c | 2 +- units/systemd-timesyncd.service.in | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c index d895aa8cc1..c026ef79a4 100644 --- a/src/timesync/timesyncd.c +++ b/src/timesync/timesyncd.c @@ -69,7 +69,7 @@ static int load_clock_timestamp(uid_t uid, gid_t gid) { } } else { - r = mkdir_safe_label("/var/lib/systemd/timesync", 0755, uid, gid, false); + r = mkdir_safe_label("/var/lib/systemd/timesync", 0755, uid, gid, true); if (r < 0) return log_error_errno(r, "Failed to create state directory: %m"); diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 8d3f46cf5e..ed4bc8e552 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -23,11 +23,10 @@ RestartSec=0 ExecStart=!!@rootlibexecdir@/systemd-timesyncd WatchdogSec=3min User=systemd-timesync +DynamicUser=yes CapabilityBoundingSet=CAP_SYS_TIME AmbientCapabilities=CAP_SYS_TIME -PrivateTmp=yes PrivateDevices=yes -ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes From 941afc4b902af21b0675e9e5d417c2ee6b202f30 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 6 Oct 2017 16:06:21 +0900 Subject: [PATCH 3/4] unit: enable DynamicUser= for journal-upload --- units/systemd-journal-upload.service.in | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index 98a4b2bb7a..b666ef3568 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -14,11 +14,10 @@ After=network-online.target [Service] ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state User=systemd-journal-upload +DynamicUser=yes SupplementaryGroups=systemd-journal WatchdogSec=3min -PrivateTmp=yes PrivateDevices=yes -ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes From 4240cb02fda90ba11dfc0114201e42691132c6a9 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Thu, 5 Oct 2017 10:21:50 +0900 Subject: [PATCH 4/4] sysusers: do not create unneeded users --- sysusers.d/systemd-remote.conf.m4 | 3 --- sysusers.d/systemd.conf.m4 | 3 --- 2 files changed, 6 deletions(-) diff --git a/sysusers.d/systemd-remote.conf.m4 b/sysusers.d/systemd-remote.conf.m4 index 83b362643f..988917672b 100644 --- a/sysusers.d/systemd-remote.conf.m4 +++ b/sysusers.d/systemd-remote.conf.m4 @@ -8,6 +8,3 @@ m4_ifdef(`HAVE_MICROHTTPD', u systemd-journal-remote - "systemd Journal Remote" )m4_dnl -m4_ifdef(`HAVE_LIBCURL', -u systemd-journal-upload - "systemd Journal Upload" -)m4_dnl diff --git a/sysusers.d/systemd.conf.m4 b/sysusers.d/systemd.conf.m4 index ef5a3cb619..82e23ca5a8 100644 --- a/sysusers.d/systemd.conf.m4 +++ b/sysusers.d/systemd.conf.m4 @@ -12,9 +12,6 @@ u systemd-network - "systemd Network Management" m4_ifdef(`ENABLE_RESOLVE', u systemd-resolve - "systemd Resolver" )m4_dnl -m4_ifdef(`ENABLE_TIMESYNCD', -u systemd-timesync - "systemd Time Synchronization" -)m4_dnl m4_ifdef(`ENABLE_COREDUMP', u systemd-coredump - "systemd Core Dumper" )m4_dnl