diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index c777fa75de..33486203a6 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -201,3 +201,25 @@ can be found under various directories such as `factory/`, `modprobe.d/`, `netwo `tools/`, `coccinelle/`, `.github/`, `.semaphore/`, `.mkosi/` host various utilities and scripts that are used by maintainers and developers. They are not shipped or installed. + +# Service Manager Overview + +The Service Manager takes configuration in the form of unit files, credentials, +kernel command line options and D-Bus commands, and based on those manages the +system and spawns other processes. It runs in system mode as PID1, and in user +mode with one instance per user session. + +When starting a unit requires forking a new process, configuration for the new +process will be serialized and passed over to the new process, created via a +posix_spawn() call. This is done in order to avoid excessive processing after +a fork() but before an exec(), which is against glibc's best practices and can +also result in a copy-on-write trap. The new process will start as the +`systemd-executor` binary, which will deserialize the configuration and apply +all the options (sandboxing, namespacing, cgroup, etc.) before exec'ing the +configured executable. + +``` + ┌──────┐posix_spawn() ┌───────────┐execve() ┌────────┐ + │ PID1 ├─────────────►│sd-executor├────────►│program │ + └──────┘ (memfd) └───────────┘ └────────┘ +``` diff --git a/meson.build b/meson.build index 1517065db6..5b6b928276 100644 --- a/meson.build +++ b/meson.build @@ -225,6 +225,7 @@ conf.set_quoted('SYSCONF_DIR', sysconfdir) conf.set_quoted('SYSCTL_DIR', sysctldir) conf.set_quoted('SYSTEMCTL_BINARY_PATH', bindir / 'systemctl') conf.set_quoted('SYSTEMD_BINARY_PATH', libexecdir / 'systemd') +conf.set_quoted('SYSTEMD_EXECUTOR_BINARY_PATH', libexecdir / 'systemd-executor') conf.set_quoted('SYSTEMD_CATALOG_DIR', catalogdir) conf.set_quoted('SYSTEMD_CGROUPS_AGENT_PATH', libexecdir / 'systemd-cgroups-agent') conf.set_quoted('SYSTEMD_CRYPTSETUP_PATH', bindir / 'systemd-cryptsetup') diff --git a/src/basic/cgroup-util.h b/src/basic/cgroup-util.h index 625816d9cf..80ea7e7ffa 100644 --- a/src/basic/cgroup-util.h +++ b/src/basic/cgroup-util.h @@ -36,7 +36,7 @@ typedef enum CGroupController { CGROUP_CONTROLLER_BPF_SOCKET_BIND, CGROUP_CONTROLLER_BPF_RESTRICT_NETWORK_INTERFACES, /* The BPF hook implementing RestrictFileSystems= is not defined here. - * It's applied as late as possible in exec_child() so we don't block + * It's applied as late as possible in exec_invoke() so we don't block * our own unit setup code. */ _CGROUP_CONTROLLER_MAX, diff --git a/src/basic/env-util.c b/src/basic/env-util.c index 44772f778d..d3bf73385f 100644 --- a/src/basic/env-util.c +++ b/src/basic/env-util.c @@ -1074,3 +1074,22 @@ int getenv_steal_erase(const char *name, char **ret) { return 1; } + +int set_full_environment(char **env) { + int r; + + clearenv(); + + STRV_FOREACH(e, env) { + _cleanup_free_ char *k = NULL, *v = NULL; + + r = split_pair(*e, "=", &k, &v); + if (r < 0) + return r; + + if (setenv(k, v, /* overwrite= */ true) < 0) + return -errno; + } + + return 0; +} diff --git a/src/basic/env-util.h b/src/basic/env-util.h index ec3ac199ef..f7fb1e9082 100644 --- a/src/basic/env-util.h +++ b/src/basic/env-util.h @@ -77,3 +77,5 @@ int setenv_systemd_exec_pid(bool update_only); int getenv_path_list(const char *name, char ***ret_paths); int getenv_steal_erase(const char *name, char **ret); + +int set_full_environment(char **env); diff --git a/src/basic/process-util.c b/src/basic/process-util.c index 4928379bd7..d0ffb2d614 100644 --- a/src/basic/process-util.c +++ b/src/basic/process-util.c @@ -5,6 +5,7 @@ #include #include #include +#include #include #include #include @@ -1732,6 +1733,51 @@ int make_reaper_process(bool b) { return 0; } +int posix_spawn_wrapper(const char *path, char *const *argv, char *const *envp, pid_t *ret_pid) { + posix_spawnattr_t attr; + sigset_t mask; + pid_t pid; + int r; + + /* Forks and invokes 'path' with 'argv' and 'envp' using CLONE_VM and CLONE_VFORK, which means the + * caller will be blocked until the child either exits or exec's. The memory of the child will be + * fully shared with the memory of the parent, so that there are no copy-on-write or memory.max + * issues. */ + + assert(path); + assert(argv); + assert(ret_pid); + + assert_se(sigfillset(&mask) >= 0); + + r = posix_spawnattr_init(&attr); + if (r != 0) + return -r; /* These functions return a positive errno on failure */ + r = posix_spawnattr_setflags(&attr, POSIX_SPAWN_SETSIGMASK); + if (r != 0) + goto fail; + r = posix_spawnattr_setflags(&attr, POSIX_SPAWN_SETSIGDEF); /* Set all signals to SIG_DFL */ + if (r != 0) + goto fail; + r = posix_spawnattr_setsigmask(&attr, &mask); + if (r != 0) + goto fail; + + r = posix_spawn(&pid, path, NULL, &attr, argv, envp); + if (r != 0) + goto fail; + + *ret_pid = pid; + + posix_spawnattr_destroy(&attr); + return 0; + +fail: + assert(r > 0); + posix_spawnattr_destroy(&attr); + return -r; +} + static const char *const sigchld_code_table[] = { [CLD_EXITED] = "exited", [CLD_KILLED] = "killed", diff --git a/src/basic/process-util.h b/src/basic/process-util.h index 8f87fdc2ae..0d50e797e5 100644 --- a/src/basic/process-util.h +++ b/src/basic/process-util.h @@ -210,3 +210,5 @@ int get_process_threads(pid_t pid); int is_reaper_process(void); int make_reaper_process(bool b); + +int posix_spawn_wrapper(const char *path, char *const *argv, char *const *envp, pid_t *ret_pid); diff --git a/src/core/bpf-lsm.c b/src/core/bpf-lsm.c index 22200bd939..216fc341c1 100644 --- a/src/core/bpf-lsm.c +++ b/src/core/bpf-lsm.c @@ -154,18 +154,14 @@ int lsm_bpf_setup(Manager *m) { return 0; } -int lsm_bpf_unit_restrict_filesystems(Unit *u, const Set *filesystems, bool allow_list) { +int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list) { uint32_t dummy_value = 1, zero = 0; const char *fs; const statfs_f_type_t *magic; int r; assert(filesystems); - assert(u); - - if (!u->manager->restrict_fs) - return log_unit_error_errno(u, SYNTHETIC_ERRNO(EINVAL), - "bpf-lsm: BPF LSM object is not installed, has setup failed?"); + assert(outer_map_fd >= 0); int inner_map_fd = compat_bpf_map_create( BPF_MAP_TYPE_HASH, @@ -175,39 +171,35 @@ int lsm_bpf_unit_restrict_filesystems(Unit *u, const Set *filesystems, bool allo 128U, /* Should be enough for all filesystem types */ NULL); if (inner_map_fd < 0) - return log_unit_error_errno(u, errno, "bpf-lsm: Failed to create inner BPF map: %m"); + return log_error_errno(errno, "bpf-lsm: Failed to create inner BPF map: %m"); - int outer_map_fd = sym_bpf_map__fd(u->manager->restrict_fs->maps.cgroup_hash); - if (outer_map_fd < 0) - return log_unit_error_errno(u, errno, "bpf-lsm: Failed to get BPF map fd: %m"); - - if (sym_bpf_map_update_elem(outer_map_fd, &u->cgroup_id, &inner_map_fd, BPF_ANY) != 0) - return log_unit_error_errno(u, errno, "bpf-lsm: Error populating BPF map: %m"); + if (sym_bpf_map_update_elem(outer_map_fd, &cgroup_id, &inner_map_fd, BPF_ANY) != 0) + return log_error_errno(errno, "bpf-lsm: Error populating BPF map: %m"); uint32_t allow = allow_list; /* Use key 0 to store whether this is an allow list or a deny list */ if (sym_bpf_map_update_elem(inner_map_fd, &zero, &allow, BPF_ANY) != 0) - return log_unit_error_errno(u, errno, "bpf-lsm: Error initializing map: %m"); + return log_error_errno(errno, "bpf-lsm: Error initializing map: %m"); SET_FOREACH(fs, filesystems) { r = fs_type_from_string(fs, &magic); if (r < 0) { - log_unit_warning(u, "bpf-lsm: Invalid filesystem name '%s', ignoring.", fs); + log_warning("bpf-lsm: Invalid filesystem name '%s', ignoring.", fs); continue; } - log_unit_debug(u, "bpf-lsm: Restricting filesystem access to '%s'", fs); + log_debug("bpf-lsm: Restricting filesystem access to '%s'", fs); for (int i = 0; i < FILESYSTEM_MAGIC_MAX; i++) { if (magic[i] == 0) break; if (sym_bpf_map_update_elem(inner_map_fd, &magic[i], &dummy_value, BPF_ANY) != 0) { - r = log_unit_error_errno(u, errno, "bpf-lsm: Failed to update BPF map: %m"); + r = log_error_errno(errno, "bpf-lsm: Failed to update BPF map: %m"); - if (sym_bpf_map_delete_elem(outer_map_fd, &u->cgroup_id) != 0) - log_unit_debug_errno(u, errno, "bpf-lsm: Failed to delete cgroup entry from BPF map: %m"); + if (sym_bpf_map_delete_elem(outer_map_fd, &cgroup_id) != 0) + log_debug_errno(errno, "bpf-lsm: Failed to delete cgroup entry from BPF map: %m"); return r; } @@ -263,8 +255,8 @@ int lsm_bpf_setup(Manager *m) { return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm: Failed to set up LSM BPF: %m"); } -int lsm_bpf_unit_restrict_filesystems(Unit *u, const Set *filesystems, const bool allow_list) { - return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm: Failed to restrict filesystems using LSM BPF: %m"); +int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, const bool allow_list) { + return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm: Failed to restrict filesystems using LSM BPF: %m"); } int lsm_bpf_cleanup(const Unit *u) { diff --git a/src/core/bpf-lsm.h b/src/core/bpf-lsm.h index dff581279d..a6eda193fe 100644 --- a/src/core/bpf-lsm.h +++ b/src/core/bpf-lsm.h @@ -16,7 +16,7 @@ typedef struct restrict_fs_bpf restrict_fs_bpf; bool lsm_bpf_supported(bool initialize); int lsm_bpf_setup(Manager *m); -int lsm_bpf_unit_restrict_filesystems(Unit *u, const Set *filesystems, bool allow_list); +int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list); int lsm_bpf_cleanup(const Unit *u); int lsm_bpf_map_restrict_fs_fd(Unit *u); void lsm_bpf_destroy(struct restrict_fs_bpf *prog); diff --git a/src/core/cgroup.c b/src/core/cgroup.c index 47bab04f42..e217eab7ee 100644 --- a/src/core/cgroup.c +++ b/src/core/cgroup.c @@ -143,7 +143,14 @@ static void cgroup_compat_warn(void) { void cgroup_context_init(CGroupContext *c) { assert(c); - /* Initialize everything to the kernel defaults. */ + /* Initialize everything to the kernel defaults. When initializing a bool member to 'true', make + * sure to serialize in execute-serialize.c using serialize_bool() instead of + * serialize_bool_elide(), as sd-executor will initialize here to 'true', but serialize_bool_elide() + * skips serialization if the value is 'false' (as that's the common default), so if the value at + * runtime is zero it would be lost after deserialization. Same when initializing uint64_t and other + * values, update/add a conditional serialization check. This is to minimize the amount of + * serialized data that is sent to the sd-executor, so that there is less work to do on the default + * cases. */ *c = (CGroupContext) { .cpu_weight = CGROUP_WEIGHT_INVALID, @@ -724,6 +731,23 @@ int cgroup_context_add_device_allow(CGroupContext *c, const char *dev, const cha return 0; } +int cgroup_context_add_or_update_device_allow(CGroupContext *c, const char *dev, const char *mode) { + assert(c); + assert(dev); + assert(isempty(mode) || in_charset(mode, "rwm")); + + LIST_FOREACH(device_allow, b, c->device_allow) + if (path_equal(b->path, dev)) { + b->r = isempty(mode) || strchr(mode, 'r'); + b->w = isempty(mode) || strchr(mode, 'w'); + b->m = isempty(mode) || strchr(mode, 'm'); + + return 0; + } + + return cgroup_context_add_device_allow(c, dev, mode); +} + int cgroup_context_add_bpf_foreign_program(CGroupContext *c, uint32_t attach_type, const char *bpffs_path) { CGroupBPFForeignProgram *p; _cleanup_free_ char *d = NULL; diff --git a/src/core/cgroup.h b/src/core/cgroup.h index 072c92f011..80d353fac6 100644 --- a/src/core/cgroup.h +++ b/src/core/cgroup.h @@ -279,6 +279,7 @@ static inline bool cgroup_context_want_memory_pressure(const CGroupContext *c) { } int cgroup_context_add_device_allow(CGroupContext *c, const char *dev, const char *mode); +int cgroup_context_add_or_update_device_allow(CGroupContext *c, const char *dev, const char *mode); int cgroup_context_add_bpf_foreign_program(CGroupContext *c, uint32_t attach_type, const char *path); void unit_modify_nft_set(Unit *u, bool add); diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c index d38e8a6aeb..820b43ee1f 100644 --- a/src/core/dbus-cgroup.c +++ b/src/core/dbus-cgroup.c @@ -1820,31 +1820,9 @@ int bus_cgroup_set_property( return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "DeviceAllow= requires combination of rwm flags"); if (!UNIT_WRITE_FLAGS_NOOP(flags)) { - CGroupDeviceAllow *a = NULL; - - LIST_FOREACH(device_allow, b, c->device_allow) - if (path_equal(b->path, path)) { - a = b; - break; - } - - if (!a) { - a = new0(CGroupDeviceAllow, 1); - if (!a) - return -ENOMEM; - - a->path = strdup(path); - if (!a->path) { - free(a); - return -ENOMEM; - } - - LIST_PREPEND(device_allow, c->device_allow, a); - } - - a->r = strchr(rwm, 'r'); - a->w = strchr(rwm, 'w'); - a->m = strchr(rwm, 'm'); + r = cgroup_context_add_or_update_device_allow(c, path, rwm); + if (r < 0) + return r; } n++; diff --git a/src/core/dynamic-user.c b/src/core/dynamic-user.c index e99a6694f6..dc349afecf 100644 --- a/src/core/dynamic-user.c +++ b/src/core/dynamic-user.c @@ -26,9 +26,9 @@ /* Takes a value generated randomly or by hashing and turns it into a UID in the right range */ #define UID_CLAMP_INTO_RANGE(rnd) (((uid_t) (rnd) % (DYNAMIC_UID_MAX - DYNAMIC_UID_MIN + 1)) + DYNAMIC_UID_MIN) -DEFINE_PRIVATE_TRIVIAL_REF_FUNC(DynamicUser, dynamic_user); +DEFINE_TRIVIAL_REF_FUNC(DynamicUser, dynamic_user); -static DynamicUser* dynamic_user_free(DynamicUser *d) { +DynamicUser* dynamic_user_free(DynamicUser *d) { if (!d) return NULL; @@ -43,13 +43,15 @@ static int dynamic_user_add(Manager *m, const char *name, int storage_socket[sta DynamicUser *d; int r; - assert(m); + assert(m || ret); assert(name); assert(storage_socket); - r = hashmap_ensure_allocated(&m->dynamic_users, &string_hash_ops); - if (r < 0) - return r; + if (m) { /* Might be called in sd-executor with no manager object */ + r = hashmap_ensure_allocated(&m->dynamic_users, &string_hash_ops); + if (r < 0) + return r; + } d = malloc0(offsetof(DynamicUser, name) + strlen(name) + 1); if (!d) @@ -60,10 +62,12 @@ static int dynamic_user_add(Manager *m, const char *name, int storage_socket[sta d->storage_socket[0] = storage_socket[0]; d->storage_socket[1] = storage_socket[1]; - r = hashmap_put(m->dynamic_users, d->name, d); - if (r < 0) { - free(d); - return r; + if (m) { /* Might be called in sd-executor with no manager object */ + r = hashmap_put(m->dynamic_users, d->name, d); + if (r < 0) { + free(d); + return r; + } } d->manager = m; @@ -603,37 +607,49 @@ static DynamicUser* dynamic_user_destroy(DynamicUser *d) { return dynamic_user_free(d); } -int dynamic_user_serialize(Manager *m, FILE *f, FDSet *fds) { - DynamicUser *d; +int dynamic_user_serialize_one(DynamicUser *d, const char *key, FILE *f, FDSet *fds) { + int copy0, copy1; - assert(m); + assert(key); assert(f); assert(fds); - /* Dump the dynamic user database into the manager serialization, to deal with daemon reloads. */ + if (!d) + return 0; - HASHMAP_FOREACH(d, m->dynamic_users) { - int copy0, copy1; + if (d->storage_socket[0] < 0 || d->storage_socket[1] < 0) + return 0; - copy0 = fdset_put_dup(fds, d->storage_socket[0]); - if (copy0 < 0) - return log_error_errno(copy0, "Failed to add dynamic user storage fd to serialization: %m"); + copy0 = fdset_put_dup(fds, d->storage_socket[0]); + if (copy0 < 0) + return log_error_errno(copy0, "Failed to add dynamic user storage fd to serialization: %m"); - copy1 = fdset_put_dup(fds, d->storage_socket[1]); - if (copy1 < 0) - return log_error_errno(copy1, "Failed to add dynamic user storage fd to serialization: %m"); + copy1 = fdset_put_dup(fds, d->storage_socket[1]); + if (copy1 < 0) + return log_error_errno(copy1, "Failed to add dynamic user storage fd to serialization: %m"); - (void) serialize_item_format(f, "dynamic-user", "%s %i %i", d->name, copy0, copy1); - } + (void) serialize_item_format(f, key, "%s %i %i", d->name, copy0, copy1); return 0; } -void dynamic_user_deserialize_one(Manager *m, const char *value, FDSet *fds) { +int dynamic_user_serialize(Manager *m, FILE *f, FDSet *fds) { + DynamicUser *d; + + assert(m); + + /* Dump the dynamic user database into the manager serialization, to deal with daemon reloads. */ + + HASHMAP_FOREACH(d, m->dynamic_users) + (void) dynamic_user_serialize_one(d, "dynamic-user", f, fds); + + return 0; +} + +void dynamic_user_deserialize_one(Manager *m, const char *value, FDSet *fds, DynamicUser **ret) { _cleanup_free_ char *name = NULL, *s0 = NULL, *s1 = NULL; int r, fd0, fd1; - assert(m); assert(value); assert(fds); @@ -655,7 +671,7 @@ void dynamic_user_deserialize_one(Manager *m, const char *value, FDSet *fds) { return; } - r = dynamic_user_add(m, name, (int[]) { fd0, fd1 }, NULL); + r = dynamic_user_add(m, name, (int[]) { fd0, fd1 }, ret); if (r < 0) { log_debug_errno(r, "Failed to add dynamic user: %m"); return; @@ -663,6 +679,9 @@ void dynamic_user_deserialize_one(Manager *m, const char *value, FDSet *fds) { (void) fdset_remove(fds, fd0); (void) fdset_remove(fds, fd1); + + if (ret) /* If the caller uses it directly, increment the refcount */ + (*ret)->n_ref++; } void dynamic_user_vacuum(Manager *m, bool close_user) { @@ -831,3 +850,12 @@ DynamicCreds* dynamic_creds_destroy(DynamicCreds *creds) { return mfree(creds); } + +void dynamic_creds_done(DynamicCreds *creds) { + if (!creds) + return; + + if (creds->group != creds->user) + dynamic_user_free(creds->group); + creds->group = creds->user = dynamic_user_free(creds->user); +} diff --git a/src/core/dynamic-user.h b/src/core/dynamic-user.h index 6539d17571..e86ee02796 100644 --- a/src/core/dynamic-user.h +++ b/src/core/dynamic-user.h @@ -26,7 +26,9 @@ struct DynamicUser { }; int dynamic_user_serialize(Manager *m, FILE *f, FDSet *fds); -void dynamic_user_deserialize_one(Manager *m, const char *value, FDSet *fds); +int dynamic_user_serialize_one(DynamicUser *d, const char *key, FILE *f, FDSet *fds); +void dynamic_user_deserialize_one(Manager *m, const char *value, FDSet *fds, DynamicUser **ret); +DynamicUser* dynamic_user_free(DynamicUser *d); void dynamic_user_vacuum(Manager *m, bool close_user); int dynamic_user_current(DynamicUser *d, uid_t *ret); @@ -38,6 +40,9 @@ int dynamic_creds_realize(DynamicCreds *creds, char **suggested_paths, uid_t *ui DynamicCreds *dynamic_creds_unref(DynamicCreds *creds); DynamicCreds *dynamic_creds_destroy(DynamicCreds *creds); +void dynamic_creds_done(DynamicCreds *creds); DEFINE_TRIVIAL_CLEANUP_FUNC(DynamicCreds*, dynamic_creds_unref); DEFINE_TRIVIAL_CLEANUP_FUNC(DynamicCreds*, dynamic_creds_destroy); + +DynamicUser *dynamic_user_ref(DynamicUser *user); diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c new file mode 100644 index 0000000000..ea39e0aff1 --- /dev/null +++ b/src/core/exec-invoke.c @@ -0,0 +1,5082 @@ +/* SPDX-License-Identifier: LGPL-2.1-or-later */ + +#include +#include +#include +#include + +#if HAVE_PAM +#include +#include +#endif + +#if HAVE_APPARMOR +#include +#endif + +#include "sd-messages.h" + +#if HAVE_APPARMOR +#include "apparmor-util.h" +#endif +#include "argv-util.h" +#include "barrier.h" +#include "bpf-dlopen.h" +#include "bpf-lsm.h" +#include "btrfs-util.h" +#include "capability-util.h" +#include "cgroup-setup.h" +#include "chase.h" +#include "chattr-util.h" +#include "chown-recursive.h" +#include "copy.h" +#include "data-fd-util.h" +#include "env-util.h" +#include "escape.h" +#include "exec-credential.h" +#include "exec-invoke.h" +#include "execute.h" +#include "exit-status.h" +#include "fd-util.h" +#include "hexdecoct.h" +#include "io-util.h" +#include "missing_ioprio.h" +#include "missing_prctl.h" +#include "missing_securebits.h" +#include "missing_syscall.h" +#include "mkdir-label.h" +#include "proc-cmdline.h" +#include "process-util.h" +#include "psi-util.h" +#include "rlimit-util.h" +#include "seccomp-util.h" +#include "selinux-util.h" +#include "signal-util.h" +#include "smack-util.h" +#include "socket-util.h" +#include "string-table.h" +#include "strv.h" +#include "terminal-util.h" +#include "utmp-wtmp.h" + +#define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC) +#define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC) + +#define SNDBUF_SIZE (8*1024*1024) + +static int shift_fds(int fds[], size_t n_fds) { + if (n_fds <= 0) + return 0; + + /* Modifies the fds array! (sorts it) */ + + assert(fds); + + for (int start = 0;;) { + int restart_from = -1; + + for (int i = start; i < (int) n_fds; i++) { + int nfd; + + /* Already at right index? */ + if (fds[i] == i+3) + continue; + + nfd = fcntl(fds[i], F_DUPFD, i + 3); + if (nfd < 0) + return -errno; + + safe_close(fds[i]); + fds[i] = nfd; + + /* Hmm, the fd we wanted isn't free? Then + * let's remember that and try again from here */ + if (nfd != i+3 && restart_from < 0) + restart_from = i; + } + + if (restart_from < 0) + break; + + start = restart_from; + } + + return 0; +} + +static int flags_fds( + const int fds[], + size_t n_socket_fds, + size_t n_fds, + bool nonblock) { + + int r; + + if (n_fds <= 0) + return 0; + + assert(fds); + + /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags. + * O_NONBLOCK only applies to socket activation though. */ + + for (size_t i = 0; i < n_fds; i++) { + + if (i < n_socket_fds) { + r = fd_nonblock(fds[i], nonblock); + if (r < 0) + return r; + } + + /* We unconditionally drop FD_CLOEXEC from the fds, + * since after all we want to pass these fds to our + * children */ + + r = fd_cloexec(fds[i], false); + if (r < 0) + return r; + } + + return 0; +} + +static bool is_terminal_input(ExecInput i) { + return IN_SET(i, + EXEC_INPUT_TTY, + EXEC_INPUT_TTY_FORCE, + EXEC_INPUT_TTY_FAIL); +} + +static bool is_terminal_output(ExecOutput o) { + return IN_SET(o, + EXEC_OUTPUT_TTY, + EXEC_OUTPUT_KMSG_AND_CONSOLE, + EXEC_OUTPUT_JOURNAL_AND_CONSOLE); +} + +static bool is_kmsg_output(ExecOutput o) { + return IN_SET(o, + EXEC_OUTPUT_KMSG, + EXEC_OUTPUT_KMSG_AND_CONSOLE); +} + +static bool exec_context_needs_term(const ExecContext *c) { + assert(c); + + /* Return true if the execution context suggests we should set $TERM to something useful. */ + + if (is_terminal_input(c->std_input)) + return true; + + if (is_terminal_output(c->std_output)) + return true; + + if (is_terminal_output(c->std_error)) + return true; + + return !!c->tty_path; +} + +static int open_null_as(int flags, int nfd) { + int fd; + + assert(nfd >= 0); + + fd = open("/dev/null", flags|O_NOCTTY); + if (fd < 0) + return -errno; + + return move_fd(fd, nfd, false); +} + +static int connect_journal_socket( + int fd, + const char *log_namespace, + uid_t uid, + gid_t gid) { + + uid_t olduid = UID_INVALID; + gid_t oldgid = GID_INVALID; + const char *j; + int r; + + j = log_namespace ? + strjoina("/run/systemd/journal.", log_namespace, "/stdout") : + "/run/systemd/journal/stdout"; + + if (gid_is_valid(gid)) { + oldgid = getgid(); + + if (setegid(gid) < 0) + return -errno; + } + + if (uid_is_valid(uid)) { + olduid = getuid(); + + if (seteuid(uid) < 0) { + r = -errno; + goto restore_gid; + } + } + + r = connect_unix_path(fd, AT_FDCWD, j); + + /* If we fail to restore the uid or gid, things will likely fail later on. This should only happen if + an LSM interferes. */ + + if (uid_is_valid(uid)) + (void) seteuid(olduid); + + restore_gid: + if (gid_is_valid(gid)) + (void) setegid(oldgid); + + return r; +} + +static int connect_logger_as( + const ExecContext *context, + const ExecParameters *params, + ExecOutput output, + const char *ident, + int nfd, + uid_t uid, + gid_t gid) { + + _cleanup_close_ int fd = -EBADF; + int r; + + assert(context); + assert(params); + assert(output < _EXEC_OUTPUT_MAX); + assert(ident); + assert(nfd >= 0); + + fd = socket(AF_UNIX, SOCK_STREAM, 0); + if (fd < 0) + return -errno; + + r = connect_journal_socket(fd, context->log_namespace, uid, gid); + if (r < 0) + return r; + + if (shutdown(fd, SHUT_RD) < 0) + return -errno; + + (void) fd_inc_sndbuf(fd, SNDBUF_SIZE); + + if (dprintf(fd, + "%s\n" + "%s\n" + "%i\n" + "%i\n" + "%i\n" + "%i\n" + "%i\n", + context->syslog_identifier ?: ident, + params->flags & EXEC_PASS_LOG_UNIT ? params->unit_id : "", + context->syslog_priority, + !!context->syslog_level_prefix, + false, + is_kmsg_output(output), + is_terminal_output(output)) < 0) + return -errno; + + return move_fd(TAKE_FD(fd), nfd, false); +} + +static int open_terminal_as(const char *path, int flags, int nfd) { + int fd; + + assert(path); + assert(nfd >= 0); + + fd = open_terminal(path, flags | O_NOCTTY); + if (fd < 0) + return fd; + + return move_fd(fd, nfd, false); +} + +static int acquire_path(const char *path, int flags, mode_t mode) { + _cleanup_close_ int fd = -EBADF; + int r; + + assert(path); + + if (IN_SET(flags & O_ACCMODE, O_WRONLY, O_RDWR)) + flags |= O_CREAT; + + fd = open(path, flags|O_NOCTTY, mode); + if (fd >= 0) + return TAKE_FD(fd); + + if (errno != ENXIO) /* ENXIO is returned when we try to open() an AF_UNIX file system socket on Linux */ + return -errno; + + /* So, it appears the specified path could be an AF_UNIX socket. Let's see if we can connect to it. */ + + fd = socket(AF_UNIX, SOCK_STREAM, 0); + if (fd < 0) + return -errno; + + r = connect_unix_path(fd, AT_FDCWD, path); + if (IN_SET(r, -ENOTSOCK, -EINVAL)) + /* Propagate initial error if we get ENOTSOCK or EINVAL, i.e. we have indication that this + * wasn't an AF_UNIX socket after all */ + return -ENXIO; + if (r < 0) + return r; + + if ((flags & O_ACCMODE) == O_RDONLY) + r = shutdown(fd, SHUT_WR); + else if ((flags & O_ACCMODE) == O_WRONLY) + r = shutdown(fd, SHUT_RD); + else + r = 0; + if (r < 0) + return -errno; + + return TAKE_FD(fd); +} + +static int fixup_input( + const ExecContext *context, + int socket_fd, + bool apply_tty_stdin) { + + ExecInput std_input; + + assert(context); + + std_input = context->std_input; + + if (is_terminal_input(std_input) && !apply_tty_stdin) + return EXEC_INPUT_NULL; + + if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0) + return EXEC_INPUT_NULL; + + if (std_input == EXEC_INPUT_DATA && context->stdin_data_size == 0) + return EXEC_INPUT_NULL; + + return std_input; +} + +static int fixup_output(ExecOutput output, int socket_fd) { + + if (output == EXEC_OUTPUT_SOCKET && socket_fd < 0) + return EXEC_OUTPUT_INHERIT; + + return output; +} + +static int setup_input( + const ExecContext *context, + const ExecParameters *params, + int socket_fd, + const int named_iofds[static 3]) { + + ExecInput i; + int r; + + assert(context); + assert(params); + assert(named_iofds); + + if (params->stdin_fd >= 0) { + if (dup2(params->stdin_fd, STDIN_FILENO) < 0) + return -errno; + + /* Try to make this the controlling tty, if it is a tty, and reset it */ + if (isatty(STDIN_FILENO)) { + unsigned rows = context->tty_rows, cols = context->tty_cols; + + (void) exec_context_tty_size(context, &rows, &cols); + (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE); + (void) reset_terminal_fd(STDIN_FILENO, true); + (void) terminal_set_size_fd(STDIN_FILENO, NULL, rows, cols); + } + + return STDIN_FILENO; + } + + i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN); + + switch (i) { + + case EXEC_INPUT_NULL: + return open_null_as(O_RDONLY, STDIN_FILENO); + + case EXEC_INPUT_TTY: + case EXEC_INPUT_TTY_FORCE: + case EXEC_INPUT_TTY_FAIL: { + unsigned rows, cols; + int fd; + + fd = acquire_terminal(exec_context_tty_path(context), + i == EXEC_INPUT_TTY_FAIL ? ACQUIRE_TERMINAL_TRY : + i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE : + ACQUIRE_TERMINAL_WAIT, + USEC_INFINITY); + if (fd < 0) + return fd; + + r = exec_context_tty_size(context, &rows, &cols); + if (r < 0) + return r; + + r = terminal_set_size_fd(fd, exec_context_tty_path(context), rows, cols); + if (r < 0) + return r; + + return move_fd(fd, STDIN_FILENO, false); + } + + case EXEC_INPUT_SOCKET: + assert(socket_fd >= 0); + + return RET_NERRNO(dup2(socket_fd, STDIN_FILENO)); + + case EXEC_INPUT_NAMED_FD: + assert(named_iofds[STDIN_FILENO] >= 0); + + (void) fd_nonblock(named_iofds[STDIN_FILENO], false); + return RET_NERRNO(dup2(named_iofds[STDIN_FILENO], STDIN_FILENO)); + + case EXEC_INPUT_DATA: { + int fd; + + fd = acquire_data_fd(context->stdin_data, context->stdin_data_size, 0); + if (fd < 0) + return fd; + + return move_fd(fd, STDIN_FILENO, false); + } + + case EXEC_INPUT_FILE: { + bool rw; + int fd; + + assert(context->stdio_file[STDIN_FILENO]); + + rw = (context->std_output == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDOUT_FILENO])) || + (context->std_error == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDERR_FILENO])); + + fd = acquire_path(context->stdio_file[STDIN_FILENO], rw ? O_RDWR : O_RDONLY, 0666 & ~context->umask); + if (fd < 0) + return fd; + + return move_fd(fd, STDIN_FILENO, false); + } + + default: + assert_not_reached(); + } +} + +static bool can_inherit_stderr_from_stdout( + const ExecContext *context, + ExecOutput o, + ExecOutput e) { + + assert(context); + + /* Returns true, if given the specified STDERR and STDOUT output we can directly dup() the stdout fd to the + * stderr fd */ + + if (e == EXEC_OUTPUT_INHERIT) + return true; + if (e != o) + return false; + + if (e == EXEC_OUTPUT_NAMED_FD) + return streq_ptr(context->stdio_fdname[STDOUT_FILENO], context->stdio_fdname[STDERR_FILENO]); + + if (IN_SET(e, EXEC_OUTPUT_FILE, EXEC_OUTPUT_FILE_APPEND, EXEC_OUTPUT_FILE_TRUNCATE)) + return streq_ptr(context->stdio_file[STDOUT_FILENO], context->stdio_file[STDERR_FILENO]); + + return true; +} + +static int setup_output( + const ExecContext *context, + const ExecParameters *params, + int fileno, + int socket_fd, + const int named_iofds[static 3], + const char *ident, + uid_t uid, + gid_t gid, + dev_t *journal_stream_dev, + ino_t *journal_stream_ino) { + + ExecOutput o; + ExecInput i; + int r; + + assert(context); + assert(params); + assert(ident); + assert(journal_stream_dev); + assert(journal_stream_ino); + + if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) { + + if (dup2(params->stdout_fd, STDOUT_FILENO) < 0) + return -errno; + + return STDOUT_FILENO; + } + + if (fileno == STDERR_FILENO && params->stderr_fd >= 0) { + if (dup2(params->stderr_fd, STDERR_FILENO) < 0) + return -errno; + + return STDERR_FILENO; + } + + i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN); + o = fixup_output(context->std_output, socket_fd); + + if (fileno == STDERR_FILENO) { + ExecOutput e; + e = fixup_output(context->std_error, socket_fd); + + /* This expects the input and output are already set up */ + + /* Don't change the stderr file descriptor if we inherit all + * the way and are not on a tty */ + if (e == EXEC_OUTPUT_INHERIT && + o == EXEC_OUTPUT_INHERIT && + i == EXEC_INPUT_NULL && + !is_terminal_input(context->std_input) && + getppid() != 1) + return fileno; + + /* Duplicate from stdout if possible */ + if (can_inherit_stderr_from_stdout(context, o, e)) + return RET_NERRNO(dup2(STDOUT_FILENO, fileno)); + + o = e; + + } else if (o == EXEC_OUTPUT_INHERIT) { + /* If input got downgraded, inherit the original value */ + if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input)) + return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno); + + /* If the input is connected to anything that's not a /dev/null or a data fd, inherit that... */ + if (!IN_SET(i, EXEC_INPUT_NULL, EXEC_INPUT_DATA)) + return RET_NERRNO(dup2(STDIN_FILENO, fileno)); + + /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */ + if (getppid() != 1) + return fileno; + + /* We need to open /dev/null here anew, to get the right access mode. */ + return open_null_as(O_WRONLY, fileno); + } + + switch (o) { + + case EXEC_OUTPUT_NULL: + return open_null_as(O_WRONLY, fileno); + + case EXEC_OUTPUT_TTY: + if (is_terminal_input(i)) + return RET_NERRNO(dup2(STDIN_FILENO, fileno)); + + /* We don't reset the terminal if this is just about output */ + return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno); + + case EXEC_OUTPUT_KMSG: + case EXEC_OUTPUT_KMSG_AND_CONSOLE: + case EXEC_OUTPUT_JOURNAL: + case EXEC_OUTPUT_JOURNAL_AND_CONSOLE: + r = connect_logger_as(context, params, o, ident, fileno, uid, gid); + if (r < 0) { + log_exec_warning_errno(context, + params, + r, + "Failed to connect %s to the journal socket, ignoring: %m", + fileno == STDOUT_FILENO ? "stdout" : "stderr"); + r = open_null_as(O_WRONLY, fileno); + } else { + struct stat st; + + /* If we connected this fd to the journal via a stream, patch the device/inode into the passed + * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits + * services to detect whether they are connected to the journal or not. + * + * If both stdout and stderr are connected to a stream then let's make sure to store the data + * about STDERR as that's usually the best way to do logging. */ + + if (fstat(fileno, &st) >= 0 && + (*journal_stream_ino == 0 || fileno == STDERR_FILENO)) { + *journal_stream_dev = st.st_dev; + *journal_stream_ino = st.st_ino; + } + } + return r; + + case EXEC_OUTPUT_SOCKET: + assert(socket_fd >= 0); + + return RET_NERRNO(dup2(socket_fd, fileno)); + + case EXEC_OUTPUT_NAMED_FD: + assert(named_iofds[fileno] >= 0); + + (void) fd_nonblock(named_iofds[fileno], false); + return RET_NERRNO(dup2(named_iofds[fileno], fileno)); + + case EXEC_OUTPUT_FILE: + case EXEC_OUTPUT_FILE_APPEND: + case EXEC_OUTPUT_FILE_TRUNCATE: { + bool rw; + int fd, flags; + + assert(context->stdio_file[fileno]); + + rw = context->std_input == EXEC_INPUT_FILE && + streq_ptr(context->stdio_file[fileno], context->stdio_file[STDIN_FILENO]); + + if (rw) + return RET_NERRNO(dup2(STDIN_FILENO, fileno)); + + flags = O_WRONLY; + if (o == EXEC_OUTPUT_FILE_APPEND) + flags |= O_APPEND; + else if (o == EXEC_OUTPUT_FILE_TRUNCATE) + flags |= O_TRUNC; + + fd = acquire_path(context->stdio_file[fileno], flags, 0666 & ~context->umask); + if (fd < 0) + return fd; + + return move_fd(fd, fileno, 0); + } + + default: + assert_not_reached(); + } +} + +static int chown_terminal(int fd, uid_t uid) { + int r; + + assert(fd >= 0); + + /* Before we chown/chmod the TTY, let's ensure this is actually a tty */ + if (isatty(fd) < 1) { + if (IN_SET(errno, EINVAL, ENOTTY)) + return 0; /* not a tty */ + + return -errno; + } + + /* This might fail. What matters are the results. */ + r = fchmod_and_chown(fd, TTY_MODE, uid, GID_INVALID); + if (r < 0) + return r; + + return 1; +} + +static int setup_confirm_stdio( + const ExecContext *context, + const char *vc, + int *ret_saved_stdin, + int *ret_saved_stdout) { + + _cleanup_close_ int fd = -EBADF, saved_stdin = -EBADF, saved_stdout = -EBADF; + unsigned rows, cols; + int r; + + assert(ret_saved_stdin); + assert(ret_saved_stdout); + + saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3); + if (saved_stdin < 0) + return -errno; + + saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3); + if (saved_stdout < 0) + return -errno; + + fd = acquire_terminal(vc, ACQUIRE_TERMINAL_WAIT, DEFAULT_CONFIRM_USEC); + if (fd < 0) + return fd; + + r = chown_terminal(fd, getuid()); + if (r < 0) + return r; + + r = reset_terminal_fd(fd, true); + if (r < 0) + return r; + + r = exec_context_tty_size(context, &rows, &cols); + if (r < 0) + return r; + + r = terminal_set_size_fd(fd, vc, rows, cols); + if (r < 0) + return r; + + r = rearrange_stdio(fd, fd, STDERR_FILENO); /* Invalidates 'fd' also on failure */ + TAKE_FD(fd); + if (r < 0) + return r; + + *ret_saved_stdin = TAKE_FD(saved_stdin); + *ret_saved_stdout = TAKE_FD(saved_stdout); + return 0; +} + +static void write_confirm_error_fd(int err, int fd, const char *unit_id) { + assert(err < 0); + assert(unit_id); + + if (err == -ETIMEDOUT) + dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", unit_id); + else { + errno = -err; + dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", unit_id); + } +} + +static void write_confirm_error(int err, const char *vc, const char *unit_id) { + _cleanup_close_ int fd = -EBADF; + + assert(vc); + + fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC); + if (fd < 0) + return; + + write_confirm_error_fd(err, fd, unit_id); +} + +static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) { + int r = 0; + + assert(saved_stdin); + assert(saved_stdout); + + release_terminal(); + + if (*saved_stdin >= 0) + if (dup2(*saved_stdin, STDIN_FILENO) < 0) + r = -errno; + + if (*saved_stdout >= 0) + if (dup2(*saved_stdout, STDOUT_FILENO) < 0) + r = -errno; + + *saved_stdin = safe_close(*saved_stdin); + *saved_stdout = safe_close(*saved_stdout); + + return r; +} + +enum { + CONFIRM_PRETEND_FAILURE = -1, + CONFIRM_PRETEND_SUCCESS = 0, + CONFIRM_EXECUTE = 1, +}; + +static bool confirm_spawn_disabled(void) { + return access("/run/systemd/confirm_spawn_disabled", F_OK) >= 0; +} + +static int ask_for_confirmation(const ExecContext *context, const ExecParameters *params, const char *cmdline) { + int saved_stdout = -1, saved_stdin = -1, r; + _cleanup_free_ char *e = NULL; + char c; + + assert(context); + assert(params); + + /* For any internal errors, assume a positive response. */ + r = setup_confirm_stdio(context, params->confirm_spawn, &saved_stdin, &saved_stdout); + if (r < 0) { + write_confirm_error(r, params->confirm_spawn, params->unit_id); + return CONFIRM_EXECUTE; + } + + /* confirm_spawn might have been disabled while we were sleeping. */ + if (!params->confirm_spawn || confirm_spawn_disabled()) { + r = 1; + goto restore_stdio; + } + + e = ellipsize(cmdline, 60, 100); + if (!e) { + log_oom(); + r = CONFIRM_EXECUTE; + goto restore_stdio; + } + + for (;;) { + r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e); + if (r < 0) { + write_confirm_error_fd(r, STDOUT_FILENO, params->unit_id); + r = CONFIRM_EXECUTE; + goto restore_stdio; + } + + switch (c) { + case 'c': + printf("Resuming normal execution.\n"); + manager_disable_confirm_spawn(); + r = 1; + break; + case 'D': + printf(" Unit: %s\n", + params->unit_id); + exec_context_dump(context, stdout, " "); + exec_params_dump(params, stdout, " "); + continue; /* ask again */ + case 'f': + printf("Failing execution.\n"); + r = CONFIRM_PRETEND_FAILURE; + break; + case 'h': + printf(" c - continue, proceed without asking anymore\n" + " D - dump, show the state of the unit\n" + " f - fail, don't execute the command and pretend it failed\n" + " h - help\n" + " i - info, show a short summary of the unit\n" + " j - jobs, show jobs that are in progress\n" + " s - skip, don't execute the command and pretend it succeeded\n" + " y - yes, execute the command\n"); + continue; /* ask again */ + case 'i': + printf(" Unit: %s\n" + " Command: %s\n", + params->unit_id, cmdline); + continue; /* ask again */ + case 'j': + if (sigqueue(getppid(), + SIGRTMIN+18, + (const union sigval) { .sival_int = MANAGER_SIGNAL_COMMAND_DUMP_JOBS }) < 0) + return -errno; + + continue; /* ask again */ + case 'n': + /* 'n' was removed in favor of 'f'. */ + printf("Didn't understand 'n', did you mean 'f'?\n"); + continue; /* ask again */ + case 's': + printf("Skipping execution.\n"); + r = CONFIRM_PRETEND_SUCCESS; + break; + case 'y': + r = CONFIRM_EXECUTE; + break; + default: + assert_not_reached(); + } + break; + } + +restore_stdio: + restore_confirm_stdio(&saved_stdin, &saved_stdout); + return r; +} + +static int get_fixed_user( + const char *username, + const char **ret_user, + uid_t *ret_uid, + gid_t *ret_gid, + const char **ret_home, + const char **ret_shell) { + + int r; + + assert(username); + assert(ret_user); + + /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway + * (i.e. are "/" or "/bin/nologin"). */ + + r = get_user_creds(&username, ret_uid, ret_gid, ret_home, ret_shell, USER_CREDS_CLEAN); + if (r < 0) + return r; + + *ret_user = username; + return 0; +} + +static int get_fixed_group( + const char *groupname, + const char **ret_group, + gid_t *ret_gid) { + + int r; + + assert(groupname); + assert(ret_group); + + r = get_group_creds(&groupname, ret_gid, /* flags = */ 0); + if (r < 0) + return r; + + *ret_group = groupname; + return 0; +} + +static int get_supplementary_groups(const ExecContext *c, const char *user, + const char *group, gid_t gid, + gid_t **supplementary_gids, int *ngids) { + int r, k = 0; + int ngroups_max; + bool keep_groups = false; + gid_t *groups = NULL; + _cleanup_free_ gid_t *l_gids = NULL; + + assert(c); + + /* + * If user is given, then lookup GID and supplementary groups list. + * We avoid NSS lookups for gid=0. Also we have to initialize groups + * here and as early as possible so we keep the list of supplementary + * groups of the caller. + */ + if (user && gid_is_valid(gid) && gid != 0) { + /* First step, initialize groups from /etc/groups */ + if (initgroups(user, gid) < 0) + return -errno; + + keep_groups = true; + } + + if (strv_isempty(c->supplementary_groups)) + return 0; + + /* + * If SupplementaryGroups= was passed then NGROUPS_MAX has to + * be positive, otherwise fail. + */ + errno = 0; + ngroups_max = (int) sysconf(_SC_NGROUPS_MAX); + if (ngroups_max <= 0) + return errno_or_else(EOPNOTSUPP); + + l_gids = new(gid_t, ngroups_max); + if (!l_gids) + return -ENOMEM; + + if (keep_groups) { + /* + * Lookup the list of groups that the user belongs to, we + * avoid NSS lookups here too for gid=0. + */ + k = ngroups_max; + if (getgrouplist(user, gid, l_gids, &k) < 0) + return -EINVAL; + } else + k = 0; + + STRV_FOREACH(i, c->supplementary_groups) { + const char *g; + + if (k >= ngroups_max) + return -E2BIG; + + g = *i; + r = get_group_creds(&g, l_gids+k, 0); + if (r < 0) + return r; + + k++; + } + + /* + * Sets ngids to zero to drop all supplementary groups, happens + * when we are under root and SupplementaryGroups= is empty. + */ + if (k == 0) { + *ngids = 0; + return 0; + } + + /* Otherwise get the final list of supplementary groups */ + groups = memdup(l_gids, sizeof(gid_t) * k); + if (!groups) + return -ENOMEM; + + *supplementary_gids = groups; + *ngids = k; + + groups = NULL; + + return 0; +} + +static int enforce_groups(gid_t gid, const gid_t *supplementary_gids, int ngids) { + int r; + + /* Handle SupplementaryGroups= if it is not empty */ + if (ngids > 0) { + r = maybe_setgroups(ngids, supplementary_gids); + if (r < 0) + return r; + } + + if (gid_is_valid(gid)) { + /* Then set our gids */ + if (setresgid(gid, gid, gid) < 0) + return -errno; + } + + return 0; +} + +static int set_securebits(unsigned bits, unsigned mask) { + unsigned applied; + int current; + + current = prctl(PR_GET_SECUREBITS); + if (current < 0) + return -errno; + + /* Clear all securebits defined in mask and set bits */ + applied = ((unsigned) current & ~mask) | bits; + if ((unsigned) current == applied) + return 0; + + if (prctl(PR_SET_SECUREBITS, applied) < 0) + return -errno; + + return 1; +} + +static int enforce_user( + const ExecContext *context, + uid_t uid, + uint64_t capability_ambient_set) { + assert(context); + int r; + + if (!uid_is_valid(uid)) + return 0; + + /* Sets (but doesn't look up) the UIS and makes sure we keep the capabilities while doing so. For + * setting secure bits the capability CAP_SETPCAP is required, so we also need keep-caps in this + * case. */ + + if ((capability_ambient_set != 0 || context->secure_bits != 0) && uid != 0) { + + /* First step: If we need to keep capabilities but drop privileges we need to make sure we + * keep our caps, while we drop privileges. Add KEEP_CAPS to the securebits */ + r = set_securebits(1U << SECURE_KEEP_CAPS, 0); + if (r < 0) + return r; + } + + /* Second step: actually set the uids */ + if (setresuid(uid, uid, uid) < 0) + return -errno; + + /* At this point we should have all necessary capabilities but are otherwise a normal user. However, + * the caps might got corrupted due to the setresuid() so we need clean them up later. This is done + * outside of this call. */ + return 0; +} + +#if HAVE_PAM + +static int null_conv( + int num_msg, + const struct pam_message **msg, + struct pam_response **resp, + void *appdata_ptr) { + + /* We don't support conversations */ + + return PAM_CONV_ERR; +} + +#endif + +static int setup_pam( + const char *name, + const char *user, + uid_t uid, + gid_t gid, + const char *tty, + char ***env, /* updated on success */ + const int fds[], size_t n_fds) { + +#if HAVE_PAM + + static const struct pam_conv conv = { + .conv = null_conv, + .appdata_ptr = NULL + }; + + _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL; + _cleanup_strv_free_ char **e = NULL; + pam_handle_t *handle = NULL; + sigset_t old_ss; + int pam_code = PAM_SUCCESS, r; + bool close_session = false; + pid_t pam_pid = 0, parent_pid; + int flags = 0; + + assert(name); + assert(user); + assert(env); + + /* We set up PAM in the parent process, then fork. The child + * will then stay around until killed via PR_GET_PDEATHSIG or + * systemd via the cgroup logic. It will then remove the PAM + * session again. The parent process will exec() the actual + * daemon. We do things this way to ensure that the main PID + * of the daemon is the one we initially fork()ed. */ + + r = barrier_create(&barrier); + if (r < 0) + goto fail; + + if (log_get_max_level() < LOG_DEBUG) + flags |= PAM_SILENT; + + pam_code = pam_start(name, user, &conv, &handle); + if (pam_code != PAM_SUCCESS) { + handle = NULL; + goto fail; + } + + if (!tty) { + _cleanup_free_ char *q = NULL; + + /* Hmm, so no TTY was explicitly passed, but an fd passed to us directly might be a TTY. Let's figure + * out if that's the case, and read the TTY off it. */ + + if (getttyname_malloc(STDIN_FILENO, &q) >= 0) + tty = strjoina("/dev/", q); + } + + if (tty) { + pam_code = pam_set_item(handle, PAM_TTY, tty); + if (pam_code != PAM_SUCCESS) + goto fail; + } + + STRV_FOREACH(nv, *env) { + pam_code = pam_putenv(handle, *nv); + if (pam_code != PAM_SUCCESS) + goto fail; + } + + pam_code = pam_acct_mgmt(handle, flags); + if (pam_code != PAM_SUCCESS) + goto fail; + + pam_code = pam_setcred(handle, PAM_ESTABLISH_CRED | flags); + if (pam_code != PAM_SUCCESS) + log_debug("pam_setcred() failed, ignoring: %s", pam_strerror(handle, pam_code)); + + pam_code = pam_open_session(handle, flags); + if (pam_code != PAM_SUCCESS) + goto fail; + + close_session = true; + + e = pam_getenvlist(handle); + if (!e) { + pam_code = PAM_BUF_ERR; + goto fail; + } + + /* Block SIGTERM, so that we know that it won't get lost in the child */ + + assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0); + + parent_pid = getpid_cached(); + + r = safe_fork("(sd-pam)", 0, &pam_pid); + if (r < 0) + goto fail; + if (r == 0) { + int sig, ret = EXIT_PAM; + + /* The child's job is to reset the PAM session on termination */ + barrier_set_role(&barrier, BARRIER_CHILD); + + /* Make sure we don't keep open the passed fds in this child. We assume that otherwise only + * those fds are open here that have been opened by PAM. */ + (void) close_many(fds, n_fds); + + /* Drop privileges - we don't need any to pam_close_session and this will make + * PR_SET_PDEATHSIG work in most cases. If this fails, ignore the error - but expect sd-pam + * threads to fail to exit normally */ + + r = maybe_setgroups(0, NULL); + if (r < 0) + log_warning_errno(r, "Failed to setgroups() in sd-pam: %m"); + if (setresgid(gid, gid, gid) < 0) + log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m"); + if (setresuid(uid, uid, uid) < 0) + log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m"); + + (void) ignore_signals(SIGPIPE); + + /* Wait until our parent died. This will only work if the above setresuid() succeeds, + * otherwise the kernel will not allow unprivileged parents kill their privileged children + * this way. We rely on the control groups kill logic to do the rest for us. */ + if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0) + goto child_finish; + + /* Tell the parent that our setup is done. This is especially important regarding dropping + * privileges. Otherwise, unit setup might race against our setresuid(2) call. + * + * If the parent aborted, we'll detect this below, hence ignore return failure here. */ + (void) barrier_place(&barrier); + + /* Check if our parent process might already have died? */ + if (getppid() == parent_pid) { + sigset_t ss; + + assert_se(sigemptyset(&ss) >= 0); + assert_se(sigaddset(&ss, SIGTERM) >= 0); + + for (;;) { + if (sigwait(&ss, &sig) < 0) { + if (errno == EINTR) + continue; + + goto child_finish; + } + + assert(sig == SIGTERM); + break; + } + } + + pam_code = pam_setcred(handle, PAM_DELETE_CRED | flags); + if (pam_code != PAM_SUCCESS) + goto child_finish; + + /* If our parent died we'll end the session */ + if (getppid() != parent_pid) { + pam_code = pam_close_session(handle, flags); + if (pam_code != PAM_SUCCESS) + goto child_finish; + } + + ret = 0; + + child_finish: + /* NB: pam_end() when called in child processes should set PAM_DATA_SILENT to let the module + * know about this. See pam_end(3) */ + (void) pam_end(handle, pam_code | flags | PAM_DATA_SILENT); + _exit(ret); + } + + barrier_set_role(&barrier, BARRIER_PARENT); + + /* If the child was forked off successfully it will do all the cleanups, so forget about the handle + * here. */ + handle = NULL; + + /* Unblock SIGTERM again in the parent */ + assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0); + + /* We close the log explicitly here, since the PAM modules might have opened it, but we don't want + * this fd around. */ + closelog(); + + /* Synchronously wait for the child to initialize. We don't care for errors as we cannot + * recover. However, warn loudly if it happens. */ + if (!barrier_place_and_sync(&barrier)) + log_error("PAM initialization failed"); + + return strv_free_and_replace(*env, e); + +fail: + if (pam_code != PAM_SUCCESS) { + log_error("PAM failed: %s", pam_strerror(handle, pam_code)); + r = -EPERM; /* PAM errors do not map to errno */ + } else + log_error_errno(r, "PAM failed: %m"); + + if (handle) { + if (close_session) + pam_code = pam_close_session(handle, flags); + + (void) pam_end(handle, pam_code | flags); + } + + closelog(); + return r; +#else + return 0; +#endif +} + +static void rename_process_from_path(const char *path) { + _cleanup_free_ char *buf = NULL; + const char *p; + + assert(path); + + /* This resulting string must fit in 10 chars (i.e. the length of "/sbin/init") to look pretty in + * /bin/ps */ + + if (path_extract_filename(path, &buf) < 0) { + rename_process("(...)"); + return; + } + + size_t l = strlen(buf); + if (l > 8) { + /* The end of the process name is usually more interesting, since the first bit might just be + * "systemd-" */ + p = buf + l - 8; + l = 8; + } else + p = buf; + + char process_name[11]; + process_name[0] = '('; + memcpy(process_name+1, p, l); + process_name[1+l] = ')'; + process_name[1+l+1] = 0; + + rename_process(process_name); +} + +static bool context_has_address_families(const ExecContext *c) { + assert(c); + + return c->address_families_allow_list || + !set_isempty(c->address_families); +} + +static bool context_has_syscall_filters(const ExecContext *c) { + assert(c); + + return c->syscall_allow_list || + !hashmap_isempty(c->syscall_filter); +} + +static bool context_has_syscall_logs(const ExecContext *c) { + assert(c); + + return c->syscall_log_allow_list || + !hashmap_isempty(c->syscall_log); +} + +static bool context_has_no_new_privileges(const ExecContext *c) { + assert(c); + + if (c->no_new_privileges) + return true; + + if (have_effective_cap(CAP_SYS_ADMIN) > 0) /* if we are privileged, we don't need NNP */ + return false; + + /* We need NNP if we have any form of seccomp and are unprivileged */ + return c->lock_personality || + c->memory_deny_write_execute || + c->private_devices || + c->protect_clock || + c->protect_hostname || + c->protect_kernel_tunables || + c->protect_kernel_modules || + c->protect_kernel_logs || + context_has_address_families(c) || + exec_context_restrict_namespaces_set(c) || + c->restrict_realtime || + c->restrict_suid_sgid || + !set_isempty(c->syscall_archs) || + context_has_syscall_filters(c) || + context_has_syscall_logs(c); +} + +#if HAVE_SECCOMP + +static bool skip_seccomp_unavailable(const ExecContext *c, const ExecParameters *p, const char* msg) { + + if (is_seccomp_available()) + return false; + + log_exec_debug(c, p, "SECCOMP features not detected in the kernel, skipping %s", msg); + return true; +} + +static int apply_syscall_filter(const ExecContext *c, const ExecParameters *p, bool needs_ambient_hack) { + uint32_t negative_action, default_action, action; + int r; + + assert(c); + assert(p); + + if (!context_has_syscall_filters(c)) + return 0; + + if (skip_seccomp_unavailable(c, p, "SystemCallFilter=")) + return 0; + + negative_action = c->syscall_errno == SECCOMP_ERROR_NUMBER_KILL ? scmp_act_kill_process() : SCMP_ACT_ERRNO(c->syscall_errno); + + if (c->syscall_allow_list) { + default_action = negative_action; + action = SCMP_ACT_ALLOW; + } else { + default_action = SCMP_ACT_ALLOW; + action = negative_action; + } + + if (needs_ambient_hack) { + r = seccomp_filter_set_add(c->syscall_filter, c->syscall_allow_list, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID); + if (r < 0) + return r; + } + + return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false); +} + +static int apply_syscall_log(const ExecContext *c, const ExecParameters *p) { +#ifdef SCMP_ACT_LOG + uint32_t default_action, action; +#endif + + assert(c); + assert(p); + + if (!context_has_syscall_logs(c)) + return 0; + +#ifdef SCMP_ACT_LOG + if (skip_seccomp_unavailable(c, p, "SystemCallLog=")) + return 0; + + if (c->syscall_log_allow_list) { + /* Log nothing but the ones listed */ + default_action = SCMP_ACT_ALLOW; + action = SCMP_ACT_LOG; + } else { + /* Log everything but the ones listed */ + default_action = SCMP_ACT_LOG; + action = SCMP_ACT_ALLOW; + } + + return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_log, action, false); +#else + /* old libseccomp */ + log_exec_debug(c, p, "SECCOMP feature SCMP_ACT_LOG not available, skipping SystemCallLog="); + return 0; +#endif +} + +static int apply_syscall_archs(const ExecContext *c, const ExecParameters *p) { + assert(c); + assert(p); + + if (set_isempty(c->syscall_archs)) + return 0; + + if (skip_seccomp_unavailable(c, p, "SystemCallArchitectures=")) + return 0; + + return seccomp_restrict_archs(c->syscall_archs); +} + +static int apply_address_families(const ExecContext *c, const ExecParameters *p) { + assert(c); + assert(p); + + if (!context_has_address_families(c)) + return 0; + + if (skip_seccomp_unavailable(c, p, "RestrictAddressFamilies=")) + return 0; + + return seccomp_restrict_address_families(c->address_families, c->address_families_allow_list); +} + +static int apply_memory_deny_write_execute(const ExecContext *c, const ExecParameters *p) { + int r; + + assert(c); + assert(p); + + if (!c->memory_deny_write_execute) + return 0; + + /* use prctl() if kernel supports it (6.3) */ + r = prctl(PR_SET_MDWE, PR_MDWE_REFUSE_EXEC_GAIN, 0, 0, 0); + if (r == 0) { + log_exec_debug(c, p, "Enabled MemoryDenyWriteExecute= with PR_SET_MDWE"); + return 0; + } + if (r < 0 && errno != EINVAL) + return log_exec_debug_errno(c, + p, + errno, + "Failed to enable MemoryDenyWriteExecute= with PR_SET_MDWE: %m"); + /* else use seccomp */ + log_exec_debug(c, p, "Kernel doesn't support PR_SET_MDWE: falling back to seccomp"); + + if (skip_seccomp_unavailable(c, p, "MemoryDenyWriteExecute=")) + return 0; + + return seccomp_memory_deny_write_execute(); +} + +static int apply_restrict_realtime(const ExecContext *c, const ExecParameters *p) { + assert(c); + assert(p); + + if (!c->restrict_realtime) + return 0; + + if (skip_seccomp_unavailable(c, p, "RestrictRealtime=")) + return 0; + + return seccomp_restrict_realtime(); +} + +static int apply_restrict_suid_sgid(const ExecContext *c, const ExecParameters *p) { + assert(c); + assert(p); + + if (!c->restrict_suid_sgid) + return 0; + + if (skip_seccomp_unavailable(c, p, "RestrictSUIDSGID=")) + return 0; + + return seccomp_restrict_suid_sgid(); +} + +static int apply_protect_sysctl(const ExecContext *c, const ExecParameters *p) { + assert(c); + assert(p); + + /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but + * let's protect even those systems where this is left on in the kernel. */ + + if (!c->protect_kernel_tunables) + return 0; + + if (skip_seccomp_unavailable(c, p, "ProtectKernelTunables=")) + return 0; + + return seccomp_protect_sysctl(); +} + +static int apply_protect_kernel_modules(const ExecContext *c, const ExecParameters *p) { + assert(c); + assert(p); + + /* Turn off module syscalls on ProtectKernelModules=yes */ + + if (!c->protect_kernel_modules) + return 0; + + if (skip_seccomp_unavailable(c, p, "ProtectKernelModules=")) + return 0; + + return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM), false); +} + +static int apply_protect_kernel_logs(const ExecContext *c, const ExecParameters *p) { + assert(c); + assert(p); + + if (!c->protect_kernel_logs) + return 0; + + if (skip_seccomp_unavailable(c, p, "ProtectKernelLogs=")) + return 0; + + return seccomp_protect_syslog(); +} + +static int apply_protect_clock(const ExecContext *c, const ExecParameters *p) { + assert(c); + assert(p); + + if (!c->protect_clock) + return 0; + + if (skip_seccomp_unavailable(c, p, "ProtectClock=")) + return 0; + + return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK, SCMP_ACT_ERRNO(EPERM), false); +} + +static int apply_private_devices(const ExecContext *c, const ExecParameters *p) { + assert(c); + assert(p); + + /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */ + + if (!c->private_devices) + return 0; + + if (skip_seccomp_unavailable(c, p, "PrivateDevices=")) + return 0; + + return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM), false); +} + +static int apply_restrict_namespaces(const ExecContext *c, const ExecParameters *p) { + assert(c); + assert(p); + + if (!exec_context_restrict_namespaces_set(c)) + return 0; + + if (skip_seccomp_unavailable(c, p, "RestrictNamespaces=")) + return 0; + + return seccomp_restrict_namespaces(c->restrict_namespaces); +} + +static int apply_lock_personality(const ExecContext *c, const ExecParameters *p) { + unsigned long personality; + int r; + + assert(c); + assert(p); + + if (!c->lock_personality) + return 0; + + if (skip_seccomp_unavailable(c, p, "LockPersonality=")) + return 0; + + personality = c->personality; + + /* If personality is not specified, use either PER_LINUX or PER_LINUX32 depending on what is currently set. */ + if (personality == PERSONALITY_INVALID) { + + r = opinionated_personality(&personality); + if (r < 0) + return r; + } + + return seccomp_lock_personality(personality); +} + +#endif + +#if HAVE_LIBBPF +static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters *p) { + int r; + + assert(c); + assert(p); + + if (!exec_context_restrict_filesystems_set(c)) + return 0; + + if (p->bpf_outer_map_fd < 0) { + /* LSM BPF is unsupported or lsm_bpf_setup failed */ + log_exec_debug(c, p, "LSM BPF not supported, skipping RestrictFileSystems="); + return 0; + } + + /* We are in a new binary, so dl-open again */ + r = dlopen_bpf(); + if (r < 0) + return r; + + return lsm_bpf_restrict_filesystems(c->restrict_filesystems, p->cgroup_id, p->bpf_outer_map_fd, c->restrict_filesystems_allow_list); +} +#endif + +static int apply_protect_hostname(const ExecContext *c, const ExecParameters *p, int *ret_exit_status) { + assert(c); + assert(p); + + if (!c->protect_hostname) + return 0; + + if (ns_type_supported(NAMESPACE_UTS)) { + if (unshare(CLONE_NEWUTS) < 0) { + if (!ERRNO_IS_NOT_SUPPORTED(errno) && !ERRNO_IS_PRIVILEGE(errno)) { + *ret_exit_status = EXIT_NAMESPACE; + return log_exec_error_errno(c, + p, + errno, + "Failed to set up UTS namespacing: %m"); + } + + log_exec_warning(c, + p, + "ProtectHostname=yes is configured, but UTS namespace setup is " + "prohibited (container manager?), ignoring namespace setup."); + } + } else + log_exec_warning(c, + p, + "ProtectHostname=yes is configured, but the kernel does not " + "support UTS namespaces, ignoring namespace setup."); + +#if HAVE_SECCOMP + int r; + + if (skip_seccomp_unavailable(c, p, "ProtectHostname=")) + return 0; + + r = seccomp_protect_hostname(); + if (r < 0) { + *ret_exit_status = EXIT_SECCOMP; + return log_exec_error_errno(c, p, r, "Failed to apply hostname restrictions: %m"); + } +#endif + + return 0; +} + +static void do_idle_pipe_dance(int idle_pipe[static 4]) { + assert(idle_pipe); + + idle_pipe[1] = safe_close(idle_pipe[1]); + idle_pipe[2] = safe_close(idle_pipe[2]); + + if (idle_pipe[0] >= 0) { + int r; + + r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC); + + if (idle_pipe[3] >= 0 && r == 0 /* timeout */) { + ssize_t n; + + /* Signal systemd that we are bored and want to continue. */ + n = write(idle_pipe[3], "x", 1); + if (n > 0) + /* Wait for systemd to react to the signal above. */ + (void) fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC); + } + + idle_pipe[0] = safe_close(idle_pipe[0]); + + } + + idle_pipe[3] = safe_close(idle_pipe[3]); +} + +static const char *exec_directory_env_name_to_string(ExecDirectoryType t); + +/* And this table also maps ExecDirectoryType, to the environment variable we pass the selected directory to + * the service payload in. */ +static const char* const exec_directory_env_name_table[_EXEC_DIRECTORY_TYPE_MAX] = { + [EXEC_DIRECTORY_RUNTIME] = "RUNTIME_DIRECTORY", + [EXEC_DIRECTORY_STATE] = "STATE_DIRECTORY", + [EXEC_DIRECTORY_CACHE] = "CACHE_DIRECTORY", + [EXEC_DIRECTORY_LOGS] = "LOGS_DIRECTORY", + [EXEC_DIRECTORY_CONFIGURATION] = "CONFIGURATION_DIRECTORY", +}; + +DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(exec_directory_env_name, ExecDirectoryType); + +static int build_environment( + const ExecContext *c, + const ExecParameters *p, + const CGroupContext *cgroup_context, + size_t n_fds, + char **fdnames, + const char *home, + const char *username, + const char *shell, + dev_t journal_stream_dev, + ino_t journal_stream_ino, + const char *memory_pressure_path, + char ***ret) { + + _cleanup_strv_free_ char **our_env = NULL; + size_t n_env = 0; + char *x; + int r; + + assert(c); + assert(p); + assert(ret); + +#define N_ENV_VARS 19 + our_env = new0(char*, N_ENV_VARS + _EXEC_DIRECTORY_TYPE_MAX); + if (!our_env) + return -ENOMEM; + + if (n_fds > 0) { + _cleanup_free_ char *joined = NULL; + + if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid_cached()) < 0) + return -ENOMEM; + our_env[n_env++] = x; + + if (asprintf(&x, "LISTEN_FDS=%zu", n_fds) < 0) + return -ENOMEM; + our_env[n_env++] = x; + + joined = strv_join(fdnames, ":"); + if (!joined) + return -ENOMEM; + + x = strjoin("LISTEN_FDNAMES=", joined); + if (!x) + return -ENOMEM; + our_env[n_env++] = x; + } + + if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) { + if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid_cached()) < 0) + return -ENOMEM; + our_env[n_env++] = x; + + if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0) + return -ENOMEM; + our_env[n_env++] = x; + } + + /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use blocking + * Varlink calls back to us for look up dynamic users in PID 1. Break the deadlock between D-Bus and + * PID 1 by disabling use of PID1' NSS interface for looking up dynamic users. */ + if (p->flags & EXEC_NSS_DYNAMIC_BYPASS) { + x = strdup("SYSTEMD_NSS_DYNAMIC_BYPASS=1"); + if (!x) + return -ENOMEM; + our_env[n_env++] = x; + } + + /* We query "root" if this is a system unit and User= is not specified. $USER is always set. $HOME + * could cause problem for e.g. getty, since login doesn't override $HOME, and $LOGNAME and $SHELL don't + * really make much sense since we're not logged in. Hence we conditionalize the three based on + * SetLoginEnvironment= switch. */ + if (!c->user && !c->dynamic_user && p->runtime_scope == RUNTIME_SCOPE_SYSTEM) { + r = get_fixed_user("root", &username, NULL, NULL, &home, &shell); + if (r < 0) + return log_exec_debug_errno(c, + p, + r, + "Failed to determine user credentials for root: %m"); + } + + bool set_user_login_env = c->set_login_environment >= 0 ? c->set_login_environment : (c->user || c->dynamic_user); + + if (username) { + x = strjoin("USER=", username); + if (!x) + return -ENOMEM; + our_env[n_env++] = x; + + if (set_user_login_env) { + x = strjoin("LOGNAME=", username); + if (!x) + return -ENOMEM; + our_env[n_env++] = x; + } + } + + if (home && set_user_login_env) { + x = strjoin("HOME=", home); + if (!x) + return -ENOMEM; + + path_simplify(x + 5); + our_env[n_env++] = x; + } + + if (shell && set_user_login_env) { + x = strjoin("SHELL=", shell); + if (!x) + return -ENOMEM; + + path_simplify(x + 6); + our_env[n_env++] = x; + } + + if (!sd_id128_is_null(p->invocation_id)) { + assert(p->invocation_id_string); + + x = strjoin("INVOCATION_ID=", p->invocation_id_string); + if (!x) + return -ENOMEM; + + our_env[n_env++] = x; + } + + if (exec_context_needs_term(c)) { + _cleanup_free_ char *cmdline = NULL; + const char *tty_path, *term = NULL; + + tty_path = exec_context_tty_path(c); + + /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try + * to inherit the $TERM set for PID 1. This is useful for containers so that the $TERM the + * container manager passes to PID 1 ends up all the way in the console login shown. */ + + if (path_equal_ptr(tty_path, "/dev/console") && getppid() == 1) + term = getenv("TERM"); + else if (tty_path && in_charset(skip_dev_prefix(tty_path), ALPHANUMERICAL)) { + _cleanup_free_ char *key = NULL; + + key = strjoin("systemd.tty.term.", skip_dev_prefix(tty_path)); + if (!key) + return -ENOMEM; + + r = proc_cmdline_get_key(key, 0, &cmdline); + if (r < 0) + log_exec_debug_errno(c, + p, + r, + "Failed to read %s from kernel cmdline, ignoring: %m", + key); + else if (r > 0) + term = cmdline; + } + + if (!term) + term = default_term_for_tty(tty_path); + + x = strjoin("TERM=", term); + if (!x) + return -ENOMEM; + our_env[n_env++] = x; + } + + if (journal_stream_dev != 0 && journal_stream_ino != 0) { + if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0) + return -ENOMEM; + + our_env[n_env++] = x; + } + + if (c->log_namespace) { + x = strjoin("LOG_NAMESPACE=", c->log_namespace); + if (!x) + return -ENOMEM; + + our_env[n_env++] = x; + } + + for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) { + _cleanup_free_ char *joined = NULL; + const char *n; + + if (!p->prefix[t]) + continue; + + if (c->directories[t].n_items == 0) + continue; + + n = exec_directory_env_name_to_string(t); + if (!n) + continue; + + for (size_t i = 0; i < c->directories[t].n_items; i++) { + _cleanup_free_ char *prefixed = NULL; + + prefixed = path_join(p->prefix[t], c->directories[t].items[i].path); + if (!prefixed) + return -ENOMEM; + + if (!strextend_with_separator(&joined, ":", prefixed)) + return -ENOMEM; + } + + x = strjoin(n, "=", joined); + if (!x) + return -ENOMEM; + + our_env[n_env++] = x; + } + + _cleanup_free_ char *creds_dir = NULL; + r = exec_context_get_credential_directory(c, p, p->unit_id, &creds_dir); + if (r < 0) + return r; + if (r > 0) { + x = strjoin("CREDENTIALS_DIRECTORY=", creds_dir); + if (!x) + return -ENOMEM; + + our_env[n_env++] = x; + } + + if (asprintf(&x, "SYSTEMD_EXEC_PID=" PID_FMT, getpid_cached()) < 0) + return -ENOMEM; + + our_env[n_env++] = x; + + if (memory_pressure_path) { + x = strjoin("MEMORY_PRESSURE_WATCH=", memory_pressure_path); + if (!x) + return -ENOMEM; + + our_env[n_env++] = x; + + if (cgroup_context && !path_equal(memory_pressure_path, "/dev/null")) { + _cleanup_free_ char *b = NULL, *e = NULL; + + if (asprintf(&b, "%s " USEC_FMT " " USEC_FMT, + MEMORY_PRESSURE_DEFAULT_TYPE, + cgroup_context->memory_pressure_threshold_usec == USEC_INFINITY ? MEMORY_PRESSURE_DEFAULT_THRESHOLD_USEC : + CLAMP(cgroup_context->memory_pressure_threshold_usec, 1U, MEMORY_PRESSURE_DEFAULT_WINDOW_USEC), + MEMORY_PRESSURE_DEFAULT_WINDOW_USEC) < 0) + return -ENOMEM; + + if (base64mem(b, strlen(b) + 1, &e) < 0) + return -ENOMEM; + + x = strjoin("MEMORY_PRESSURE_WRITE=", e); + if (!x) + return -ENOMEM; + + our_env[n_env++] = x; + } + } + + assert(n_env < N_ENV_VARS + _EXEC_DIRECTORY_TYPE_MAX); +#undef N_ENV_VARS + + *ret = TAKE_PTR(our_env); + + return 0; +} + +static int build_pass_environment(const ExecContext *c, char ***ret) { + _cleanup_strv_free_ char **pass_env = NULL; + size_t n_env = 0; + + STRV_FOREACH(i, c->pass_environment) { + _cleanup_free_ char *x = NULL; + char *v; + + v = getenv(*i); + if (!v) + continue; + x = strjoin(*i, "=", v); + if (!x) + return -ENOMEM; + + if (!GREEDY_REALLOC(pass_env, n_env + 2)) + return -ENOMEM; + + pass_env[n_env++] = TAKE_PTR(x); + pass_env[n_env] = NULL; + } + + *ret = TAKE_PTR(pass_env); + + return 0; +} + +static int setup_private_users(uid_t ouid, gid_t ogid, uid_t uid, gid_t gid) { + _cleanup_free_ char *uid_map = NULL, *gid_map = NULL; + _cleanup_close_pair_ int errno_pipe[2] = PIPE_EBADF; + _cleanup_close_ int unshare_ready_fd = -EBADF; + _cleanup_(sigkill_waitp) pid_t pid = 0; + uint64_t c = 1; + ssize_t n; + int r; + + /* Set up a user namespace and map the original UID/GID (IDs from before any user or group changes, i.e. + * the IDs from the user or system manager(s)) to itself, the selected UID/GID to itself, and everything else to + * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which + * we however lack after opening the user namespace. To work around this we fork() a temporary child process, + * which waits for the parent to create the new user namespace while staying in the original namespace. The + * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and + * continues execution normally. + * For unprivileged users (i.e. without capabilities), the root to root mapping is excluded. As such, it + * does not need CAP_SETUID to write the single line mapping to itself. */ + + /* Can only set up multiple mappings with CAP_SETUID. */ + if (have_effective_cap(CAP_SETUID) > 0 && uid != ouid && uid_is_valid(uid)) + r = asprintf(&uid_map, + UID_FMT " " UID_FMT " 1\n" /* Map $OUID → $OUID */ + UID_FMT " " UID_FMT " 1\n", /* Map $UID → $UID */ + ouid, ouid, uid, uid); + else + r = asprintf(&uid_map, + UID_FMT " " UID_FMT " 1\n", /* Map $OUID → $OUID */ + ouid, ouid); + + if (r < 0) + return -ENOMEM; + + /* Can only set up multiple mappings with CAP_SETGID. */ + if (have_effective_cap(CAP_SETGID) > 0 && gid != ogid && gid_is_valid(gid)) + r = asprintf(&gid_map, + GID_FMT " " GID_FMT " 1\n" /* Map $OGID → $OGID */ + GID_FMT " " GID_FMT " 1\n", /* Map $GID → $GID */ + ogid, ogid, gid, gid); + else + r = asprintf(&gid_map, + GID_FMT " " GID_FMT " 1\n", /* Map $OGID -> $OGID */ + ogid, ogid); + + if (r < 0) + return -ENOMEM; + + /* Create a communication channel so that the parent can tell the child when it finished creating the user + * namespace. */ + unshare_ready_fd = eventfd(0, EFD_CLOEXEC); + if (unshare_ready_fd < 0) + return -errno; + + /* Create a communication channel so that the child can tell the parent a proper error code in case it + * failed. */ + if (pipe2(errno_pipe, O_CLOEXEC) < 0) + return -errno; + + r = safe_fork("(sd-userns)", FORK_RESET_SIGNALS|FORK_DEATHSIG, &pid); + if (r < 0) + return r; + if (r == 0) { + _cleanup_close_ int fd = -EBADF; + const char *a; + pid_t ppid; + + /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from + * here, after the parent opened its own user namespace. */ + + ppid = getppid(); + errno_pipe[0] = safe_close(errno_pipe[0]); + + /* Wait until the parent unshared the user namespace */ + if (read(unshare_ready_fd, &c, sizeof(c)) < 0) { + r = -errno; + goto child_fail; + } + + /* Disable the setgroups() system call in the child user namespace, for good. */ + a = procfs_file_alloca(ppid, "setgroups"); + fd = open(a, O_WRONLY|O_CLOEXEC); + if (fd < 0) { + if (errno != ENOENT) { + r = -errno; + goto child_fail; + } + + /* If the file is missing the kernel is too old, let's continue anyway. */ + } else { + if (write(fd, "deny\n", 5) < 0) { + r = -errno; + goto child_fail; + } + + fd = safe_close(fd); + } + + /* First write the GID map */ + a = procfs_file_alloca(ppid, "gid_map"); + fd = open(a, O_WRONLY|O_CLOEXEC); + if (fd < 0) { + r = -errno; + goto child_fail; + } + if (write(fd, gid_map, strlen(gid_map)) < 0) { + r = -errno; + goto child_fail; + } + fd = safe_close(fd); + + /* The write the UID map */ + a = procfs_file_alloca(ppid, "uid_map"); + fd = open(a, O_WRONLY|O_CLOEXEC); + if (fd < 0) { + r = -errno; + goto child_fail; + } + if (write(fd, uid_map, strlen(uid_map)) < 0) { + r = -errno; + goto child_fail; + } + + _exit(EXIT_SUCCESS); + + child_fail: + (void) write(errno_pipe[1], &r, sizeof(r)); + _exit(EXIT_FAILURE); + } + + errno_pipe[1] = safe_close(errno_pipe[1]); + + if (unshare(CLONE_NEWUSER) < 0) + return -errno; + + /* Let the child know that the namespace is ready now */ + if (write(unshare_ready_fd, &c, sizeof(c)) < 0) + return -errno; + + /* Try to read an error code from the child */ + n = read(errno_pipe[0], &r, sizeof(r)); + if (n < 0) + return -errno; + if (n == sizeof(r)) { /* an error code was sent to us */ + if (r < 0) + return r; + return -EIO; + } + if (n != 0) /* on success we should have read 0 bytes */ + return -EIO; + + r = wait_for_terminate_and_check("(sd-userns)", TAKE_PID(pid), 0); + if (r < 0) + return r; + if (r != EXIT_SUCCESS) /* If something strange happened with the child, let's consider this fatal, too */ + return -EIO; + + return 0; +} + +static int create_many_symlinks(const char *root, const char *source, char **symlinks) { + _cleanup_free_ char *src_abs = NULL; + int r; + + assert(source); + + src_abs = path_join(root, source); + if (!src_abs) + return -ENOMEM; + + STRV_FOREACH(dst, symlinks) { + _cleanup_free_ char *dst_abs = NULL; + + dst_abs = path_join(root, *dst); + if (!dst_abs) + return -ENOMEM; + + r = mkdir_parents_label(dst_abs, 0755); + if (r < 0) + return r; + + r = symlink_idempotent(src_abs, dst_abs, true); + if (r < 0) + return r; + } + + return 0; +} + +static int setup_exec_directory( + const ExecContext *context, + const ExecParameters *params, + uid_t uid, + gid_t gid, + ExecDirectoryType type, + bool needs_mount_namespace, + int *exit_status) { + + static const int exit_status_table[_EXEC_DIRECTORY_TYPE_MAX] = { + [EXEC_DIRECTORY_RUNTIME] = EXIT_RUNTIME_DIRECTORY, + [EXEC_DIRECTORY_STATE] = EXIT_STATE_DIRECTORY, + [EXEC_DIRECTORY_CACHE] = EXIT_CACHE_DIRECTORY, + [EXEC_DIRECTORY_LOGS] = EXIT_LOGS_DIRECTORY, + [EXEC_DIRECTORY_CONFIGURATION] = EXIT_CONFIGURATION_DIRECTORY, + }; + int r; + + assert(context); + assert(params); + assert(type >= 0 && type < _EXEC_DIRECTORY_TYPE_MAX); + assert(exit_status); + + if (!params->prefix[type]) + return 0; + + if (params->flags & EXEC_CHOWN_DIRECTORIES) { + if (!uid_is_valid(uid)) + uid = 0; + if (!gid_is_valid(gid)) + gid = 0; + } + + for (size_t i = 0; i < context->directories[type].n_items; i++) { + _cleanup_free_ char *p = NULL, *pp = NULL; + + p = path_join(params->prefix[type], context->directories[type].items[i].path); + if (!p) { + r = -ENOMEM; + goto fail; + } + + r = mkdir_parents_label(p, 0755); + if (r < 0) + goto fail; + + if (IN_SET(type, EXEC_DIRECTORY_STATE, EXEC_DIRECTORY_LOGS) && params->runtime_scope == RUNTIME_SCOPE_USER) { + + /* If we are in user mode, and a configuration directory exists but a state directory + * doesn't exist, then we likely are upgrading from an older systemd version that + * didn't know the more recent addition to the xdg-basedir spec: the $XDG_STATE_HOME + * directory. In older systemd versions EXEC_DIRECTORY_STATE was aliased to + * EXEC_DIRECTORY_CONFIGURATION, with the advent of $XDG_STATE_HOME is is now + * separated. If a service has both dirs configured but only the configuration dir + * exists and the state dir does not, we assume we are looking at an update + * situation. Hence, create a compatibility symlink, so that all expectations are + * met. + * + * (We also do something similar with the log directory, which still doesn't exist in + * the xdg basedir spec. We'll make it a subdir of the state dir.) */ + + /* this assumes the state dir is always created before the configuration dir */ + assert_cc(EXEC_DIRECTORY_STATE < EXEC_DIRECTORY_LOGS); + assert_cc(EXEC_DIRECTORY_LOGS < EXEC_DIRECTORY_CONFIGURATION); + + r = laccess(p, F_OK); + if (r == -ENOENT) { + _cleanup_free_ char *q = NULL; + + /* OK, we know that the state dir does not exist. Let's see if the dir exists + * under the configuration hierarchy. */ + + if (type == EXEC_DIRECTORY_STATE) + q = path_join(params->prefix[EXEC_DIRECTORY_CONFIGURATION], context->directories[type].items[i].path); + else if (type == EXEC_DIRECTORY_LOGS) + q = path_join(params->prefix[EXEC_DIRECTORY_CONFIGURATION], "log", context->directories[type].items[i].path); + else + assert_not_reached(); + if (!q) { + r = -ENOMEM; + goto fail; + } + + r = laccess(q, F_OK); + if (r >= 0) { + /* It does exist! This hence looks like an update. Symlink the + * configuration directory into the state directory. */ + + r = symlink_idempotent(q, p, /* make_relative= */ true); + if (r < 0) + goto fail; + + log_exec_notice(context, params, "Unit state directory %s missing but matching configuration directory %s exists, assuming update from systemd 253 or older, creating compatibility symlink.", p, q); + continue; + } else if (r != -ENOENT) + log_exec_warning_errno(context, params, r, "Unable to detect whether unit configuration directory '%s' exists, assuming not: %m", q); + + } else if (r < 0) + log_exec_warning_errno(context, params, r, "Unable to detect whether unit state directory '%s' is missing, assuming it is: %m", p); + } + + if (exec_directory_is_private(context, type)) { + /* So, here's one extra complication when dealing with DynamicUser=1 units. In that + * case we want to avoid leaving a directory around fully accessible that is owned by + * a dynamic user whose UID is later on reused. To lock this down we use the same + * trick used by container managers to prohibit host users to get access to files of + * the same UID in containers: we place everything inside a directory that has an + * access mode of 0700 and is owned root:root, so that it acts as security boundary + * for unprivileged host code. We then use fs namespacing to make this directory + * permeable for the service itself. + * + * Specifically: for a service which wants a special directory "foo/" we first create + * a directory "private/" with access mode 0700 owned by root:root. Then we place + * "foo" inside of that directory (i.e. "private/foo/"), and make "foo" a symlink to + * "private/foo". This way, privileged host users can access "foo/" as usual, but + * unprivileged host users can't look into it. Inside of the namespace of the unit + * "private/" is replaced by a more liberally accessible tmpfs, into which the host's + * "private/foo/" is mounted under the same name, thus disabling the access boundary + * for the service and making sure it only gets access to the dirs it needs but no + * others. Tricky? Yes, absolutely, but it works! + * + * Note that we don't do this for EXEC_DIRECTORY_CONFIGURATION as that's assumed not + * to be owned by the service itself. + * + * Also, note that we don't do this for EXEC_DIRECTORY_RUNTIME as that's often used + * for sharing files or sockets with other services. */ + + pp = path_join(params->prefix[type], "private"); + if (!pp) { + r = -ENOMEM; + goto fail; + } + + /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */ + r = mkdir_safe_label(pp, 0700, 0, 0, MKDIR_WARN_MODE); + if (r < 0) + goto fail; + + if (!path_extend(&pp, context->directories[type].items[i].path)) { + r = -ENOMEM; + goto fail; + } + + /* Create all directories between the configured directory and this private root, and mark them 0755 */ + r = mkdir_parents_label(pp, 0755); + if (r < 0) + goto fail; + + if (is_dir(p, false) > 0 && + (laccess(pp, F_OK) == -ENOENT)) { + + /* Hmm, the private directory doesn't exist yet, but the normal one exists? If so, move + * it over. Most likely the service has been upgraded from one that didn't use + * DynamicUser=1, to one that does. */ + + log_exec_info(context, + params, + "Found pre-existing public %s= directory %s, migrating to %s.\n" + "Apparently, service previously had DynamicUser= turned off, and has now turned it on.", + exec_directory_type_to_string(type), p, pp); + + r = RET_NERRNO(rename(p, pp)); + if (r < 0) + goto fail; + } else { + /* Otherwise, create the actual directory for the service */ + + r = mkdir_label(pp, context->directories[type].mode); + if (r < 0 && r != -EEXIST) + goto fail; + } + + if (!context->directories[type].items[i].only_create) { + /* And link it up from the original place. + * Notes + * 1) If a mount namespace is going to be used, then this symlink remains on + * the host, and a new one for the child namespace will be created later. + * 2) It is not necessary to create this symlink when one of its parent + * directories is specified and already created. E.g. + * StateDirectory=foo foo/bar + * In that case, the inode points to pp and p for "foo/bar" are the same: + * pp = "/var/lib/private/foo/bar" + * p = "/var/lib/foo/bar" + * and, /var/lib/foo is a symlink to /var/lib/private/foo. So, not only + * we do not need to create the symlink, but we cannot create the symlink. + * See issue #24783. */ + r = symlink_idempotent(pp, p, true); + if (r < 0) + goto fail; + } + + } else { + _cleanup_free_ char *target = NULL; + + if (type != EXEC_DIRECTORY_CONFIGURATION && + readlink_and_make_absolute(p, &target) >= 0) { + _cleanup_free_ char *q = NULL, *q_resolved = NULL, *target_resolved = NULL; + + /* This already exists and is a symlink? Interesting. Maybe it's one created + * by DynamicUser=1 (see above)? + * + * We do this for all directory types except for ConfigurationDirectory=, + * since they all support the private/ symlink logic at least in some + * configurations, see above. */ + + r = chase(target, NULL, 0, &target_resolved, NULL); + if (r < 0) + goto fail; + + q = path_join(params->prefix[type], "private", context->directories[type].items[i].path); + if (!q) { + r = -ENOMEM; + goto fail; + } + + /* /var/lib or friends may be symlinks. So, let's chase them also. */ + r = chase(q, NULL, CHASE_NONEXISTENT, &q_resolved, NULL); + if (r < 0) + goto fail; + + if (path_equal(q_resolved, target_resolved)) { + + /* Hmm, apparently DynamicUser= was once turned on for this service, + * but is no longer. Let's move the directory back up. */ + + log_exec_info(context, + params, + "Found pre-existing private %s= directory %s, migrating to %s.\n" + "Apparently, service previously had DynamicUser= turned on, and has now turned it off.", + exec_directory_type_to_string(type), q, p); + + r = RET_NERRNO(unlink(p)); + if (r < 0) + goto fail; + + r = RET_NERRNO(rename(q, p)); + if (r < 0) + goto fail; + } + } + + r = mkdir_label(p, context->directories[type].mode); + if (r < 0) { + if (r != -EEXIST) + goto fail; + + if (type == EXEC_DIRECTORY_CONFIGURATION) { + struct stat st; + + /* Don't change the owner/access mode of the configuration directory, + * as in the common case it is not written to by a service, and shall + * not be writable. */ + + r = RET_NERRNO(stat(p, &st)); + if (r < 0) + goto fail; + + /* Still complain if the access mode doesn't match */ + if (((st.st_mode ^ context->directories[type].mode) & 07777) != 0) + log_exec_warning(context, + params, + "%s \'%s\' already exists but the mode is different. " + "(File system: %o %sMode: %o)", + exec_directory_type_to_string(type), context->directories[type].items[i].path, + st.st_mode & 07777, exec_directory_type_to_string(type), context->directories[type].mode & 07777); + + continue; + } + } + } + + /* Lock down the access mode (we use chmod_and_chown() to make this idempotent. We don't + * specify UID/GID here, so that path_chown_recursive() can optimize things depending on the + * current UID/GID ownership.) */ + r = chmod_and_chown(pp ?: p, context->directories[type].mode, UID_INVALID, GID_INVALID); + if (r < 0) + goto fail; + + /* Skip the rest (which deals with ownership) in user mode, since ownership changes are not + * available to user code anyway */ + if (params->runtime_scope != RUNTIME_SCOPE_SYSTEM) + continue; + + /* Then, change the ownership of the whole tree, if necessary. When dynamic users are used we + * drop the suid/sgid bits, since we really don't want SUID/SGID files for dynamic UID/GID + * assignments to exist. */ + r = path_chown_recursive(pp ?: p, uid, gid, context->dynamic_user ? 01777 : 07777, AT_SYMLINK_FOLLOW); + if (r < 0) + goto fail; + } + + /* If we are not going to run in a namespace, set up the symlinks - otherwise + * they are set up later, to allow configuring empty var/run/etc. */ + if (!needs_mount_namespace) + for (size_t i = 0; i < context->directories[type].n_items; i++) { + r = create_many_symlinks(params->prefix[type], + context->directories[type].items[i].path, + context->directories[type].items[i].symlinks); + if (r < 0) + goto fail; + } + + return 0; + +fail: + *exit_status = exit_status_table[type]; + return r; +} + +#if ENABLE_SMACK +static int setup_smack( + const ExecParameters *params, + const ExecContext *context, + int executable_fd) { + int r; + + assert(params); + assert(executable_fd >= 0); + + if (context->smack_process_label) { + r = mac_smack_apply_pid(0, context->smack_process_label); + if (r < 0) + return r; + } else if (params->fallback_smack_process_label) { + _cleanup_free_ char *exec_label = NULL; + + r = mac_smack_read_fd(executable_fd, SMACK_ATTR_EXEC, &exec_label); + if (r < 0 && !ERRNO_IS_XATTR_ABSENT(r)) + return r; + + r = mac_smack_apply_pid(0, exec_label ?: params->fallback_smack_process_label); + if (r < 0) + return r; + } + + return 0; +} +#endif + +static int compile_bind_mounts( + const ExecContext *context, + const ExecParameters *params, + BindMount **ret_bind_mounts, + size_t *ret_n_bind_mounts, + char ***ret_empty_directories) { + + _cleanup_strv_free_ char **empty_directories = NULL; + BindMount *bind_mounts = NULL; + size_t n, h = 0; + int r; + + assert(context); + assert(params); + assert(ret_bind_mounts); + assert(ret_n_bind_mounts); + assert(ret_empty_directories); + + CLEANUP_ARRAY(bind_mounts, h, bind_mount_free_many); + + n = context->n_bind_mounts; + for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) { + if (!params->prefix[t]) + continue; + + for (size_t i = 0; i < context->directories[t].n_items; i++) + n += !context->directories[t].items[i].only_create; + } + + if (n <= 0) { + *ret_bind_mounts = NULL; + *ret_n_bind_mounts = 0; + *ret_empty_directories = NULL; + return 0; + } + + bind_mounts = new(BindMount, n); + if (!bind_mounts) + return -ENOMEM; + + for (size_t i = 0; i < context->n_bind_mounts; i++) { + BindMount *item = context->bind_mounts + i; + _cleanup_free_ char *s = NULL, *d = NULL; + + s = strdup(item->source); + if (!s) + return -ENOMEM; + + d = strdup(item->destination); + if (!d) + return -ENOMEM; + + bind_mounts[h++] = (BindMount) { + .source = TAKE_PTR(s), + .destination = TAKE_PTR(d), + .read_only = item->read_only, + .recursive = item->recursive, + .ignore_enoent = item->ignore_enoent, + }; + } + + for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) { + if (!params->prefix[t]) + continue; + + if (context->directories[t].n_items == 0) + continue; + + if (exec_directory_is_private(context, t) && + !exec_context_with_rootfs(context)) { + char *private_root; + + /* So this is for a dynamic user, and we need to make sure the process can access its own + * directory. For that we overmount the usually inaccessible "private" subdirectory with a + * tmpfs that makes it accessible and is empty except for the submounts we do this for. */ + + private_root = path_join(params->prefix[t], "private"); + if (!private_root) + return -ENOMEM; + + r = strv_consume(&empty_directories, private_root); + if (r < 0) + return r; + } + + for (size_t i = 0; i < context->directories[t].n_items; i++) { + _cleanup_free_ char *s = NULL, *d = NULL; + + /* When one of the parent directories is in the list, we cannot create the symlink + * for the child directory. See also the comments in setup_exec_directory(). */ + if (context->directories[t].items[i].only_create) + continue; + + if (exec_directory_is_private(context, t)) + s = path_join(params->prefix[t], "private", context->directories[t].items[i].path); + else + s = path_join(params->prefix[t], context->directories[t].items[i].path); + if (!s) + return -ENOMEM; + + if (exec_directory_is_private(context, t) && + exec_context_with_rootfs(context)) + /* When RootDirectory= or RootImage= are set, then the symbolic link to the private + * directory is not created on the root directory. So, let's bind-mount the directory + * on the 'non-private' place. */ + d = path_join(params->prefix[t], context->directories[t].items[i].path); + else + d = strdup(s); + if (!d) + return -ENOMEM; + + bind_mounts[h++] = (BindMount) { + .source = TAKE_PTR(s), + .destination = TAKE_PTR(d), + .read_only = false, + .nosuid = context->dynamic_user, /* don't allow suid/sgid when DynamicUser= is on */ + .recursive = true, + .ignore_enoent = false, + }; + } + } + + assert(h == n); + + *ret_bind_mounts = TAKE_PTR(bind_mounts); + *ret_n_bind_mounts = n; + *ret_empty_directories = TAKE_PTR(empty_directories); + + return (int) n; +} + +/* ret_symlinks will contain a list of pairs src:dest that describes + * the symlinks to create later on. For example, the symlinks needed + * to safely give private directories to DynamicUser=1 users. */ +static int compile_symlinks( + const ExecContext *context, + const ExecParameters *params, + bool setup_os_release_symlink, + char ***ret_symlinks) { + + _cleanup_strv_free_ char **symlinks = NULL; + int r; + + assert(context); + assert(params); + assert(ret_symlinks); + + for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) { + for (size_t i = 0; i < context->directories[dt].n_items; i++) { + _cleanup_free_ char *private_path = NULL, *path = NULL; + + STRV_FOREACH(symlink, context->directories[dt].items[i].symlinks) { + _cleanup_free_ char *src_abs = NULL, *dst_abs = NULL; + + src_abs = path_join(params->prefix[dt], context->directories[dt].items[i].path); + dst_abs = path_join(params->prefix[dt], *symlink); + if (!src_abs || !dst_abs) + return -ENOMEM; + + r = strv_consume_pair(&symlinks, TAKE_PTR(src_abs), TAKE_PTR(dst_abs)); + if (r < 0) + return r; + } + + if (!exec_directory_is_private(context, dt) || + exec_context_with_rootfs(context) || + context->directories[dt].items[i].only_create) + continue; + + private_path = path_join(params->prefix[dt], "private", context->directories[dt].items[i].path); + if (!private_path) + return -ENOMEM; + + path = path_join(params->prefix[dt], context->directories[dt].items[i].path); + if (!path) + return -ENOMEM; + + r = strv_consume_pair(&symlinks, TAKE_PTR(private_path), TAKE_PTR(path)); + if (r < 0) + return r; + } + } + + /* We make the host's os-release available via a symlink, so that we can copy it atomically + * and readers will never get a half-written version. Note that, while the paths specified here are + * absolute, when they are processed in namespace.c they will be made relative automatically, i.e.: + * 'os-release -> .os-release-stage/os-release' is what will be created. */ + if (setup_os_release_symlink) { + r = strv_extend(&symlinks, "/run/host/.os-release-stage/os-release"); + if (r < 0) + return r; + + r = strv_extend(&symlinks, "/run/host/os-release"); + if (r < 0) + return r; + } + + *ret_symlinks = TAKE_PTR(symlinks); + + return 0; +} + +static bool insist_on_sandboxing( + const ExecContext *context, + const char *root_dir, + const char *root_image, + const BindMount *bind_mounts, + size_t n_bind_mounts) { + + assert(context); + assert(n_bind_mounts == 0 || bind_mounts); + + /* Checks whether we need to insist on fs namespacing. i.e. whether we have settings configured that + * would alter the view on the file system beyond making things read-only or invisible, i.e. would + * rearrange stuff in a way we cannot ignore gracefully. */ + + if (context->n_temporary_filesystems > 0) + return true; + + if (root_dir || root_image) + return true; + + if (context->n_mount_images > 0) + return true; + + if (context->dynamic_user) + return true; + + if (context->n_extension_images > 0 || !strv_isempty(context->extension_directories)) + return true; + + /* If there are any bind mounts set that don't map back onto themselves, fs namespacing becomes + * essential. */ + for (size_t i = 0; i < n_bind_mounts; i++) + if (!path_equal(bind_mounts[i].source, bind_mounts[i].destination)) + return true; + + if (context->log_namespace) + return true; + + return false; +} + +static int setup_ephemeral(const ExecContext *context, ExecRuntime *runtime) { + _cleanup_close_ int fd = -EBADF; + int r; + + if (!runtime || !runtime->ephemeral_copy) + return 0; + + r = posix_lock(runtime->ephemeral_storage_socket[0], LOCK_EX); + if (r < 0) + return log_debug_errno(r, "Failed to lock ephemeral storage socket: %m"); + + CLEANUP_POSIX_UNLOCK(runtime->ephemeral_storage_socket[0]); + + fd = receive_one_fd(runtime->ephemeral_storage_socket[0], MSG_PEEK|MSG_DONTWAIT); + if (fd >= 0) + /* We got an fd! That means ephemeral has already been set up, so nothing to do here. */ + return 0; + + if (fd != -EAGAIN) + return log_debug_errno(fd, "Failed to receive file descriptor queued on ephemeral storage socket: %m"); + + log_debug("Making ephemeral snapshot of %s to %s", + context->root_image ?: context->root_directory, runtime->ephemeral_copy); + + if (context->root_image) + fd = copy_file(context->root_image, runtime->ephemeral_copy, O_EXCL, 0600, + COPY_LOCK_BSD|COPY_REFLINK|COPY_CRTIME); + else + fd = btrfs_subvol_snapshot_at(AT_FDCWD, context->root_directory, + AT_FDCWD, runtime->ephemeral_copy, + BTRFS_SNAPSHOT_FALLBACK_COPY | + BTRFS_SNAPSHOT_FALLBACK_DIRECTORY | + BTRFS_SNAPSHOT_RECURSIVE | + BTRFS_SNAPSHOT_LOCK_BSD); + if (fd < 0) + return log_debug_errno(fd, "Failed to snapshot %s to %s: %m", + context->root_image ?: context->root_directory, runtime->ephemeral_copy); + + if (context->root_image) { + /* A root image might be subject to lots of random writes so let's try to disable COW on it + * which tends to not perform well in combination with lots of random writes. + * + * Note: btrfs actually isn't impressed by us setting the flag after making the reflink'ed + * copy, but we at least want to make the intention clear. + */ + r = chattr_fd(fd, FS_NOCOW_FL, FS_NOCOW_FL, NULL); + if (r < 0) + log_debug_errno(fd, "Failed to disable copy-on-write for %s, ignoring: %m", runtime->ephemeral_copy); + } + + r = send_one_fd(runtime->ephemeral_storage_socket[1], fd, MSG_DONTWAIT); + if (r < 0) + return log_debug_errno(r, "Failed to queue file descriptor on ephemeral storage socket: %m"); + + return 1; +} + +static int verity_settings_prepare( + VeritySettings *verity, + const char *root_image, + const void *root_hash, + size_t root_hash_size, + const char *root_hash_path, + const void *root_hash_sig, + size_t root_hash_sig_size, + const char *root_hash_sig_path, + const char *verity_data_path) { + + int r; + + assert(verity); + + if (root_hash) { + void *d; + + d = memdup(root_hash, root_hash_size); + if (!d) + return -ENOMEM; + + free_and_replace(verity->root_hash, d); + verity->root_hash_size = root_hash_size; + verity->designator = PARTITION_ROOT; + } + + if (root_hash_sig) { + void *d; + + d = memdup(root_hash_sig, root_hash_sig_size); + if (!d) + return -ENOMEM; + + free_and_replace(verity->root_hash_sig, d); + verity->root_hash_sig_size = root_hash_sig_size; + verity->designator = PARTITION_ROOT; + } + + if (verity_data_path) { + r = free_and_strdup(&verity->data_path, verity_data_path); + if (r < 0) + return r; + } + + r = verity_settings_load( + verity, + root_image, + root_hash_path, + root_hash_sig_path); + if (r < 0) + return log_debug_errno(r, "Failed to load root hash: %m"); + + return 0; +} + +static int apply_mount_namespace( + ExecCommandFlags command_flags, + const ExecContext *context, + const ExecParameters *params, + ExecRuntime *runtime, + const char *memory_pressure_path, + char **error_path) { + + _cleanup_(verity_settings_done) VeritySettings verity = VERITY_SETTINGS_DEFAULT; + _cleanup_strv_free_ char **empty_directories = NULL, **symlinks = NULL, + **read_write_paths_cleanup = NULL; + _cleanup_free_ char *creds_path = NULL, *incoming_dir = NULL, *propagate_dir = NULL, + *extension_dir = NULL, *host_os_release_stage = NULL; + const char *root_dir = NULL, *root_image = NULL, *tmp_dir = NULL, *var_tmp_dir = NULL; + char **read_write_paths; + bool needs_sandboxing, setup_os_release_symlink; + BindMount *bind_mounts = NULL; + size_t n_bind_mounts = 0; + int r; + + assert(context); + + CLEANUP_ARRAY(bind_mounts, n_bind_mounts, bind_mount_free_many); + + if (params->flags & EXEC_APPLY_CHROOT) { + r = setup_ephemeral(context, runtime); + if (r < 0) + return r; + + if (context->root_image) + root_image = (runtime ? runtime->ephemeral_copy : NULL) ?: context->root_image; + else + root_dir = (runtime ? runtime->ephemeral_copy : NULL) ?: context->root_directory; + } + + r = compile_bind_mounts(context, params, &bind_mounts, &n_bind_mounts, &empty_directories); + if (r < 0) + return r; + + /* We need to make the pressure path writable even if /sys/fs/cgroups is made read-only, as the + * service will need to write to it in order to start the notifications. */ + if (context->protect_control_groups && memory_pressure_path && !streq(memory_pressure_path, "/dev/null")) { + read_write_paths_cleanup = strv_copy(context->read_write_paths); + if (!read_write_paths_cleanup) + return -ENOMEM; + + r = strv_extend(&read_write_paths_cleanup, memory_pressure_path); + if (r < 0) + return r; + + read_write_paths = read_write_paths_cleanup; + } else + read_write_paths = context->read_write_paths; + + needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command_flags & EXEC_COMMAND_FULLY_PRIVILEGED); + if (needs_sandboxing) { + /* The runtime struct only contains the parent of the private /tmp, which is non-accessible + * to world users. Inside of it there's a /tmp that is sticky, and that's the one we want to + * use here. This does not apply when we are using /run/systemd/empty as fallback. */ + + if (context->private_tmp && runtime && runtime->shared) { + if (streq_ptr(runtime->shared->tmp_dir, RUN_SYSTEMD_EMPTY)) + tmp_dir = runtime->shared->tmp_dir; + else if (runtime->shared->tmp_dir) + tmp_dir = strjoina(runtime->shared->tmp_dir, "/tmp"); + + if (streq_ptr(runtime->shared->var_tmp_dir, RUN_SYSTEMD_EMPTY)) + var_tmp_dir = runtime->shared->var_tmp_dir; + else if (runtime->shared->var_tmp_dir) + var_tmp_dir = strjoina(runtime->shared->var_tmp_dir, "/tmp"); + } + } + + /* Symlinks (exec dirs, os-release) are set up after other mounts, before they are made read-only. */ + setup_os_release_symlink = needs_sandboxing && exec_context_get_effective_mount_apivfs(context) && (root_dir || root_image); + r = compile_symlinks(context, params, setup_os_release_symlink, &symlinks); + if (r < 0) + return r; + + if (context->mount_propagation_flag == MS_SHARED) + log_exec_debug(context, + params, + "shared mount propagation hidden by other fs namespacing unit settings: ignoring"); + + if (FLAGS_SET(params->flags, EXEC_WRITE_CREDENTIALS)) { + r = exec_context_get_credential_directory(context, params, params->unit_id, &creds_path); + if (r < 0) + return r; + } + + if (params->runtime_scope == RUNTIME_SCOPE_SYSTEM) { + propagate_dir = path_join("/run/systemd/propagate/", params->unit_id); + if (!propagate_dir) + return -ENOMEM; + + incoming_dir = strdup("/run/systemd/incoming"); + if (!incoming_dir) + return -ENOMEM; + + extension_dir = strdup("/run/systemd/unit-extensions"); + if (!extension_dir) + return -ENOMEM; + + /* If running under a different root filesystem, propagate the host's os-release. We make a + * copy rather than just bind mounting it, so that it can be updated on soft-reboot. */ + if (setup_os_release_symlink) { + host_os_release_stage = strdup("/run/systemd/propagate/.os-release-stage"); + if (!host_os_release_stage) + return -ENOMEM; + } + } else { + assert(params->runtime_scope == RUNTIME_SCOPE_USER); + + if (asprintf(&extension_dir, "/run/user/" UID_FMT "/systemd/unit-extensions", geteuid()) < 0) + return -ENOMEM; + + if (setup_os_release_symlink) { + if (asprintf(&host_os_release_stage, + "/run/user/" UID_FMT "/systemd/propagate/.os-release-stage", + geteuid()) < 0) + return -ENOMEM; + } + } + + if (root_image) { + r = verity_settings_prepare( + &verity, + root_image, + context->root_hash, context->root_hash_size, context->root_hash_path, + context->root_hash_sig, context->root_hash_sig_size, context->root_hash_sig_path, + context->root_verity); + if (r < 0) + return r; + } + + NamespaceParameters parameters = { + .runtime_scope = params->runtime_scope, + + .root_directory = root_dir, + .root_image = root_image, + .root_image_options = context->root_image_options, + .root_image_policy = context->root_image_policy ?: &image_policy_service, + + .read_write_paths = read_write_paths, + .read_only_paths = needs_sandboxing ? context->read_only_paths : NULL, + .inaccessible_paths = needs_sandboxing ? context->inaccessible_paths : NULL, + + .exec_paths = needs_sandboxing ? context->exec_paths : NULL, + .no_exec_paths = needs_sandboxing ? context->no_exec_paths : NULL, + + .empty_directories = empty_directories, + .symlinks = symlinks, + + .bind_mounts = bind_mounts, + .n_bind_mounts = n_bind_mounts, + + .temporary_filesystems = context->temporary_filesystems, + .n_temporary_filesystems = context->n_temporary_filesystems, + + .mount_images = context->mount_images, + .n_mount_images = context->n_mount_images, + .mount_image_policy = context->mount_image_policy ?: &image_policy_service, + + .tmp_dir = tmp_dir, + .var_tmp_dir = var_tmp_dir, + + .creds_path = creds_path, + .log_namespace = context->log_namespace, + .mount_propagation_flag = context->mount_propagation_flag, + + .verity = &verity, + + .extension_images = context->extension_images, + .n_extension_images = context->n_extension_images, + .extension_image_policy = context->extension_image_policy ?: &image_policy_sysext, + .extension_directories = context->extension_directories, + + .propagate_dir = propagate_dir, + .incoming_dir = incoming_dir, + .extension_dir = extension_dir, + .notify_socket = root_dir || root_image ? params->notify_socket : NULL, + .host_os_release_stage = host_os_release_stage, + + /* If DynamicUser=no and RootDirectory= is set then lets pass a relaxed sandbox info, + * otherwise enforce it, don't ignore protected paths and fail if we are enable to apply the + * sandbox inside the mount namespace. */ + .ignore_protect_paths = !needs_sandboxing && !context->dynamic_user && root_dir, + + .protect_control_groups = needs_sandboxing && context->protect_control_groups, + .protect_kernel_tunables = needs_sandboxing && context->protect_kernel_tunables, + .protect_kernel_modules = needs_sandboxing && context->protect_kernel_modules, + .protect_kernel_logs = needs_sandboxing && context->protect_kernel_logs, + .protect_hostname = needs_sandboxing && context->protect_hostname, + + .private_dev = needs_sandboxing && context->private_devices, + .private_network = needs_sandboxing && exec_needs_network_namespace(context), + .private_ipc = needs_sandboxing && exec_needs_ipc_namespace(context), + + .mount_apivfs = needs_sandboxing && exec_context_get_effective_mount_apivfs(context), + + /* If NNP is on, we can turn on MS_NOSUID, since it won't have any effect anymore. */ + .mount_nosuid = needs_sandboxing && context->no_new_privileges && !mac_selinux_use(), + + .protect_home = needs_sandboxing && context->protect_home, + .protect_system = needs_sandboxing && context->protect_system, + .protect_proc = needs_sandboxing && context->protect_proc, + .proc_subset = needs_sandboxing && context->proc_subset, + }; + + r = setup_namespace(¶meters, error_path); + /* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports + * that with a special, recognizable error ENOANO. In this case, silently proceed, but only if exclusively + * sandboxing options were used, i.e. nothing such as RootDirectory= or BindMount= that would result in a + * completely different execution environment. */ + if (r == -ENOANO) { + if (insist_on_sandboxing( + context, + root_dir, root_image, + bind_mounts, + n_bind_mounts)) + return log_exec_debug_errno(context, + params, + SYNTHETIC_ERRNO(EOPNOTSUPP), + "Failed to set up namespace, and refusing to continue since " + "the selected namespacing options alter mount environment non-trivially.\n" + "Bind mounts: %zu, temporary filesystems: %zu, root directory: %s, root image: %s, dynamic user: %s", + n_bind_mounts, + context->n_temporary_filesystems, + yes_no(root_dir), + yes_no(root_image), + yes_no(context->dynamic_user)); + + log_exec_debug(context, params, "Failed to set up namespace, assuming containerized execution and ignoring."); + return 0; + } + + return r; +} + +static int apply_working_directory( + const ExecContext *context, + const ExecParameters *params, + ExecRuntime *runtime, + const char *home, + int *exit_status) { + + const char *d, *wd; + + assert(context); + assert(exit_status); + + if (context->working_directory_home) { + + if (!home) { + *exit_status = EXIT_CHDIR; + return -ENXIO; + } + + wd = home; + + } else + wd = empty_to_root(context->working_directory); + + if (params->flags & EXEC_APPLY_CHROOT) + d = wd; + else + d = prefix_roota((runtime ? runtime->ephemeral_copy : NULL) ?: context->root_directory, wd); + + if (chdir(d) < 0 && !context->working_directory_missing_ok) { + *exit_status = EXIT_CHDIR; + return -errno; + } + + return 0; +} + +static int apply_root_directory( + const ExecContext *context, + const ExecParameters *params, + ExecRuntime *runtime, + const bool needs_mount_ns, + int *exit_status) { + + assert(context); + assert(exit_status); + + if (params->flags & EXEC_APPLY_CHROOT) + if (!needs_mount_ns && context->root_directory) + if (chroot((runtime ? runtime->ephemeral_copy : NULL) ?: context->root_directory) < 0) { + *exit_status = EXIT_CHROOT; + return -errno; + } + + return 0; +} + +static int setup_keyring( + const ExecContext *context, + const ExecParameters *p, + uid_t uid, gid_t gid) { + + key_serial_t keyring; + int r = 0; + uid_t saved_uid; + gid_t saved_gid; + + assert(context); + assert(p); + + /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that + * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond + * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be + * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in + * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where + * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */ + + if (context->keyring_mode == EXEC_KEYRING_INHERIT) + return 0; + + /* Acquiring a reference to the user keyring is nasty. We briefly change identity in order to get things set up + * properly by the kernel. If we don't do that then we can't create it atomically, and that sucks for parallel + * execution. This mimics what pam_keyinit does, too. Setting up session keyring, to be owned by the right user + * & group is just as nasty as acquiring a reference to the user keyring. */ + + saved_uid = getuid(); + saved_gid = getgid(); + + if (gid_is_valid(gid) && gid != saved_gid) { + if (setregid(gid, -1) < 0) + return log_exec_error_errno(context, + p, + errno, + "Failed to change GID for user keyring: %m"); + } + + if (uid_is_valid(uid) && uid != saved_uid) { + if (setreuid(uid, -1) < 0) { + r = log_exec_error_errno(context, + p, + errno, + "Failed to change UID for user keyring: %m"); + goto out; + } + } + + keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0); + if (keyring == -1) { + if (errno == ENOSYS) + log_exec_debug_errno(context, + p, + errno, + "Kernel keyring not supported, ignoring."); + else if (ERRNO_IS_PRIVILEGE(errno)) + log_exec_debug_errno(context, + p, + errno, + "Kernel keyring access prohibited, ignoring."); + else if (errno == EDQUOT) + log_exec_debug_errno(context, + p, + errno, + "Out of kernel keyrings to allocate, ignoring."); + else + r = log_exec_error_errno(context, + p, + errno, + "Setting up kernel keyring failed: %m"); + + goto out; + } + + /* When requested link the user keyring into the session keyring. */ + if (context->keyring_mode == EXEC_KEYRING_SHARED) { + + if (keyctl(KEYCTL_LINK, + KEY_SPEC_USER_KEYRING, + KEY_SPEC_SESSION_KEYRING, 0, 0) < 0) { + r = log_exec_error_errno(context, + p, + errno, + "Failed to link user keyring into session keyring: %m"); + goto out; + } + } + + /* Restore uid/gid back */ + if (uid_is_valid(uid) && uid != saved_uid) { + if (setreuid(saved_uid, -1) < 0) { + r = log_exec_error_errno(context, + p, + errno, + "Failed to change UID back for user keyring: %m"); + goto out; + } + } + + if (gid_is_valid(gid) && gid != saved_gid) { + if (setregid(saved_gid, -1) < 0) + return log_exec_error_errno(context, + p, + errno, + "Failed to change GID back for user keyring: %m"); + } + + /* Populate they keyring with the invocation ID by default, as original saved_uid. */ + if (!sd_id128_is_null(p->invocation_id)) { + key_serial_t key; + + key = add_key("user", + "invocation_id", + &p->invocation_id, + sizeof(p->invocation_id), + KEY_SPEC_SESSION_KEYRING); + if (key == -1) + log_exec_debug_errno(context, + p, + errno, + "Failed to add invocation ID to keyring, ignoring: %m"); + else { + if (keyctl(KEYCTL_SETPERM, key, + KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH| + KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0) + r = log_exec_error_errno(context, + p, + errno, + "Failed to restrict invocation ID permission: %m"); + } + } + +out: + /* Revert back uid & gid for the last time, and exit */ + /* no extra logging, as only the first already reported error matters */ + if (getuid() != saved_uid) + (void) setreuid(saved_uid, -1); + + if (getgid() != saved_gid) + (void) setregid(saved_gid, -1); + + return r; +} + +static void append_socket_pair(int *array, size_t *n, const int pair[static 2]) { + assert(array); + assert(n); + assert(pair); + + if (pair[0] >= 0) + array[(*n)++] = pair[0]; + if (pair[1] >= 0) + array[(*n)++] = pair[1]; +} + +static int close_remaining_fds( + const ExecParameters *params, + const ExecRuntime *runtime, + int socket_fd, + const int *fds, size_t n_fds) { + + size_t n_dont_close = 0; + int dont_close[n_fds + 14]; + + assert(params); + + if (params->stdin_fd >= 0) + dont_close[n_dont_close++] = params->stdin_fd; + if (params->stdout_fd >= 0) + dont_close[n_dont_close++] = params->stdout_fd; + if (params->stderr_fd >= 0) + dont_close[n_dont_close++] = params->stderr_fd; + + if (socket_fd >= 0) + dont_close[n_dont_close++] = socket_fd; + if (n_fds > 0) { + memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds); + n_dont_close += n_fds; + } + + if (runtime) + append_socket_pair(dont_close, &n_dont_close, runtime->ephemeral_storage_socket); + + if (runtime && runtime->shared) { + append_socket_pair(dont_close, &n_dont_close, runtime->shared->netns_storage_socket); + append_socket_pair(dont_close, &n_dont_close, runtime->shared->ipcns_storage_socket); + } + + if (runtime && runtime->dynamic_creds) { + if (runtime->dynamic_creds->user) + append_socket_pair(dont_close, &n_dont_close, runtime->dynamic_creds->user->storage_socket); + if (runtime->dynamic_creds->group) + append_socket_pair(dont_close, &n_dont_close, runtime->dynamic_creds->group->storage_socket); + } + + if (params->user_lookup_fd >= 0) + dont_close[n_dont_close++] = params->user_lookup_fd; + + return close_all_fds(dont_close, n_dont_close); +} + +static int send_user_lookup( + const char *unit_id, + int user_lookup_fd, + uid_t uid, + gid_t gid) { + + assert(unit_id); + + /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID + * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was + * specified. */ + + if (user_lookup_fd < 0) + return 0; + + if (!uid_is_valid(uid) && !gid_is_valid(gid)) + return 0; + + if (writev(user_lookup_fd, + (struct iovec[]) { + IOVEC_MAKE(&uid, sizeof(uid)), + IOVEC_MAKE(&gid, sizeof(gid)), + IOVEC_MAKE_STRING(unit_id) }, 3) < 0) + return -errno; + + return 0; +} + +static int acquire_home(const ExecContext *c, uid_t uid, const char** home, char **buf) { + int r; + + assert(c); + assert(home); + assert(buf); + + /* If WorkingDirectory=~ is set, try to acquire a usable home directory. */ + + if (*home) + return 0; + + if (!c->working_directory_home) + return 0; + + r = get_home_dir(buf); + if (r < 0) + return r; + + *home = *buf; + return 1; +} + +static int compile_suggested_paths(const ExecContext *c, const ExecParameters *p, char ***ret) { + _cleanup_strv_free_ char ** list = NULL; + int r; + + assert(c); + assert(p); + assert(ret); + + assert(c->dynamic_user); + + /* Compile a list of paths that it might make sense to read the owning UID from to use as initial candidate for + * dynamic UID allocation, in order to save us from doing costly recursive chown()s of the special + * directories. */ + + for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) { + if (t == EXEC_DIRECTORY_CONFIGURATION) + continue; + + if (!p->prefix[t]) + continue; + + for (size_t i = 0; i < c->directories[t].n_items; i++) { + char *e; + + if (exec_directory_is_private(c, t)) + e = path_join(p->prefix[t], "private", c->directories[t].items[i].path); + else + e = path_join(p->prefix[t], c->directories[t].items[i].path); + if (!e) + return -ENOMEM; + + r = strv_consume(&list, e); + if (r < 0) + return r; + } + } + + *ret = TAKE_PTR(list); + + return 0; +} + +static int exec_context_cpu_affinity_from_numa(const ExecContext *c, CPUSet *ret) { + _cleanup_(cpu_set_reset) CPUSet s = {}; + int r; + + assert(c); + assert(ret); + + if (!c->numa_policy.nodes.set) { + log_debug("Can't derive CPU affinity mask from NUMA mask because NUMA mask is not set, ignoring"); + return 0; + } + + r = numa_to_cpu_set(&c->numa_policy, &s); + if (r < 0) + return r; + + cpu_set_reset(ret); + + return cpu_set_add_all(ret, &s); +} + +static int add_shifted_fd(int *fds, size_t fds_size, size_t *n_fds, int fd, int *ret_fd) { + int r; + + assert(fds); + assert(n_fds); + assert(*n_fds < fds_size); + assert(ret_fd); + + if (fd < 0) { + *ret_fd = -EBADF; + return 0; + } + + if (fd < 3 + (int) *n_fds) { + /* Let's move the fd up, so that it's outside of the fd range we will use to store + * the fds we pass to the process (or which are closed only during execve). */ + + r = fcntl(fd, F_DUPFD_CLOEXEC, 3 + (int) *n_fds); + if (r < 0) + return -errno; + + close_and_replace(fd, r); + } + + *ret_fd = fds[*n_fds] = fd; + (*n_fds) ++; + return 1; +} + +static int connect_unix_harder(const ExecContext *c, const ExecParameters *p, const OpenFile *of, int ofd) { + union sockaddr_union addr = { + .un.sun_family = AF_UNIX, + }; + socklen_t sa_len; + static const int socket_types[] = { SOCK_DGRAM, SOCK_STREAM, SOCK_SEQPACKET }; + int r; + + assert(c); + assert(p); + assert(of); + assert(ofd >= 0); + + r = sockaddr_un_set_path(&addr.un, FORMAT_PROC_FD_PATH(ofd)); + if (r < 0) + return log_exec_error_errno(c, p, r, "Failed to set sockaddr for %s: %m", of->path); + + sa_len = r; + + for (size_t i = 0; i < ELEMENTSOF(socket_types); i++) { + _cleanup_close_ int fd = -EBADF; + + fd = socket(AF_UNIX, socket_types[i] | SOCK_CLOEXEC, 0); + if (fd < 0) + return log_exec_error_errno(c, + p, + errno, + "Failed to create socket for %s: %m", + of->path); + + r = RET_NERRNO(connect(fd, &addr.sa, sa_len)); + if (r == -EPROTOTYPE) + continue; + if (r < 0) + return log_exec_error_errno(c, + p, + r, + "Failed to connect socket for %s: %m", + of->path); + + return TAKE_FD(fd); + } + + return log_exec_error_errno(c, + p, + SYNTHETIC_ERRNO(EPROTOTYPE), "Failed to connect socket for \"%s\".", + of->path); +} + +static int get_open_file_fd(const ExecContext *c, const ExecParameters *p, const OpenFile *of) { + struct stat st; + _cleanup_close_ int fd = -EBADF, ofd = -EBADF; + + assert(c); + assert(p); + assert(of); + + ofd = open(of->path, O_PATH | O_CLOEXEC); + if (ofd < 0) + return log_exec_error_errno(c, p, errno, "Could not open \"%s\": %m", of->path); + + if (fstat(ofd, &st) < 0) + return log_exec_error_errno(c, p, errno, "Failed to stat %s: %m", of->path); + + if (S_ISSOCK(st.st_mode)) { + fd = connect_unix_harder(c, p, of, ofd); + if (fd < 0) + return fd; + + if (FLAGS_SET(of->flags, OPENFILE_READ_ONLY) && shutdown(fd, SHUT_WR) < 0) + return log_exec_error_errno(c, p, errno, "Failed to shutdown send for socket %s: %m", + of->path); + + log_exec_debug(c, p, "socket %s opened (fd=%d)", of->path, fd); + } else { + int flags = FLAGS_SET(of->flags, OPENFILE_READ_ONLY) ? O_RDONLY : O_RDWR; + if (FLAGS_SET(of->flags, OPENFILE_APPEND)) + flags |= O_APPEND; + else if (FLAGS_SET(of->flags, OPENFILE_TRUNCATE)) + flags |= O_TRUNC; + + fd = fd_reopen(ofd, flags | O_CLOEXEC); + if (fd < 0) + return log_exec_error_errno(c, p, fd, "Failed to open file %s: %m", of->path); + + log_exec_debug(c, p, "file %s opened (fd=%d)", of->path, fd); + } + + return TAKE_FD(fd); +} + +static int collect_open_file_fds( + const ExecContext *c, + const ExecParameters *p, + int **fds, + char ***fdnames, + size_t *n_fds) { + int r; + + assert(c); + assert(p); + assert(fds); + assert(fdnames); + assert(n_fds); + + LIST_FOREACH(open_files, of, p->open_files) { + _cleanup_close_ int fd = -EBADF; + + fd = get_open_file_fd(c, p, of); + if (fd < 0) { + if (FLAGS_SET(of->flags, OPENFILE_GRACEFUL)) { + log_exec_debug_errno(c, p, fd, "Failed to get OpenFile= file descriptor for %s, ignoring: %m", of->path); + continue; + } + + return fd; + } + + if (!GREEDY_REALLOC(*fds, *n_fds + 1)) + return -ENOMEM; + + r = strv_extend(fdnames, of->fdname); + if (r < 0) + return r; + + (*fds)[*n_fds] = TAKE_FD(fd); + + (*n_fds)++; + } + + return 0; +} + +static void log_command_line( + const ExecContext *context, + const ExecParameters *params, + const char *msg, + const char *executable, + char **argv) { + + assert(context); + assert(params); + assert(msg); + assert(executable); + + if (!DEBUG_LOGGING) + return; + + _cleanup_free_ char *cmdline = quote_command_line(argv, SHELL_ESCAPE_EMPTY); + + log_exec_struct(context, params, LOG_DEBUG, + "EXECUTABLE=%s", executable, + LOG_EXEC_MESSAGE(params, "%s: %s", msg, strnull(cmdline)), + LOG_EXEC_INVOCATION_ID(params)); +} + +static bool exec_context_need_unprivileged_private_users( + const ExecContext *context, + const ExecParameters *params) { + + assert(context); + assert(params); + + /* These options require PrivateUsers= when used in user units, as we need to be in a user namespace + * to have permission to enable them when not running as root. If we have effective CAP_SYS_ADMIN + * (system manager) then we have privileges and don't need this. */ + if (params->runtime_scope != RUNTIME_SCOPE_USER) + return false; + + return context->private_users || + context->private_tmp || + context->private_devices || + context->private_network || + context->network_namespace_path || + context->private_ipc || + context->ipc_namespace_path || + context->private_mounts > 0 || + context->mount_apivfs || + context->n_bind_mounts > 0 || + context->n_temporary_filesystems > 0 || + context->root_directory || + !strv_isempty(context->extension_directories) || + context->protect_system != PROTECT_SYSTEM_NO || + context->protect_home != PROTECT_HOME_NO || + context->protect_kernel_tunables || + context->protect_kernel_modules || + context->protect_kernel_logs || + context->protect_control_groups || + context->protect_clock || + context->protect_hostname || + !strv_isempty(context->read_write_paths) || + !strv_isempty(context->read_only_paths) || + !strv_isempty(context->inaccessible_paths) || + !strv_isempty(context->exec_paths) || + !strv_isempty(context->no_exec_paths); +} + +static bool exec_context_shall_confirm_spawn(const ExecContext *context) { + assert(context); + + if (confirm_spawn_disabled()) + return false; + + /* For some reasons units remaining in the same process group + * as PID 1 fail to acquire the console even if it's not used + * by any process. So skip the confirmation question for them. */ + return !context->same_pgrp; +} + +static int exec_context_named_iofds( + const ExecContext *c, + const ExecParameters *p, + int named_iofds[static 3]) { + + size_t targets; + const char* stdio_fdname[3]; + size_t n_fds; + + assert(c); + assert(p); + assert(named_iofds); + + targets = (c->std_input == EXEC_INPUT_NAMED_FD) + + (c->std_output == EXEC_OUTPUT_NAMED_FD) + + (c->std_error == EXEC_OUTPUT_NAMED_FD); + + for (size_t i = 0; i < 3; i++) + stdio_fdname[i] = exec_context_fdname(c, i); + + n_fds = p->n_storage_fds + p->n_socket_fds; + + for (size_t i = 0; i < n_fds && targets > 0; i++) + if (named_iofds[STDIN_FILENO] < 0 && + c->std_input == EXEC_INPUT_NAMED_FD && + stdio_fdname[STDIN_FILENO] && + streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) { + + named_iofds[STDIN_FILENO] = p->fds[i]; + targets--; + + } else if (named_iofds[STDOUT_FILENO] < 0 && + c->std_output == EXEC_OUTPUT_NAMED_FD && + stdio_fdname[STDOUT_FILENO] && + streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) { + + named_iofds[STDOUT_FILENO] = p->fds[i]; + targets--; + + } else if (named_iofds[STDERR_FILENO] < 0 && + c->std_error == EXEC_OUTPUT_NAMED_FD && + stdio_fdname[STDERR_FILENO] && + streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) { + + named_iofds[STDERR_FILENO] = p->fds[i]; + targets--; + } + + return targets == 0 ? 0 : -ENOENT; +} + +int exec_invoke( + const ExecCommand *command, + const ExecContext *context, + ExecParameters *params, + ExecRuntime *runtime, + const CGroupContext *cgroup_context, + int *exit_status) { + + _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **joined_exec_search_path = NULL, **accum_env = NULL, **replaced_argv = NULL; + int r, ngids = 0, exec_fd; + _cleanup_free_ gid_t *supplementary_gids = NULL; + const char *username = NULL, *groupname = NULL; + _cleanup_free_ char *home_buffer = NULL, *memory_pressure_path = NULL; + const char *home = NULL, *shell = NULL; + char **final_argv = NULL; + dev_t journal_stream_dev = 0; + ino_t journal_stream_ino = 0; + bool userns_set_up = false; + bool needs_sandboxing, /* Do we need to set up full sandboxing? (i.e. all namespacing, all MAC stuff, caps, yadda yadda */ + needs_setuid, /* Do we need to do the actual setresuid()/setresgid() calls? */ + needs_mount_namespace, /* Do we need to set up a mount namespace for this kernel? */ + needs_ambient_hack; /* Do we need to apply the ambient capabilities hack? */ +#if HAVE_SELINUX + _cleanup_free_ char *mac_selinux_context_net = NULL; + bool use_selinux = false; +#endif +#if ENABLE_SMACK + bool use_smack = false; +#endif +#if HAVE_APPARMOR + bool use_apparmor = false; +#endif + uid_t saved_uid = getuid(); + gid_t saved_gid = getgid(); + uid_t uid = UID_INVALID; + gid_t gid = GID_INVALID; + size_t n_fds, /* fds to pass to the child */ + n_keep_fds; /* total number of fds not to close */ + int secure_bits; + _cleanup_free_ gid_t *gids_after_pam = NULL; + int ngids_after_pam = 0; + _cleanup_free_ int *fds = NULL; + _cleanup_strv_free_ char **fdnames = NULL; + + int socket_fd = -EBADF, named_iofds[3] = { -EBADF, -EBADF, -EBADF }, *params_fds = NULL; + size_t n_storage_fds = 0, n_socket_fds = 0; + + assert(command); + assert(context); + assert(params); + assert(exit_status); + + /* Explicitly test for CVE-2021-4034 inspired invocations */ + assert(command->path); + assert(!strv_isempty(command->argv)); + + LOG_CONTEXT_PUSH_EXEC(context, params); + + if (context->std_input == EXEC_INPUT_SOCKET || + context->std_output == EXEC_OUTPUT_SOCKET || + context->std_error == EXEC_OUTPUT_SOCKET) { + + if (params->n_socket_fds > 1) + return log_exec_error_errno(context, params, SYNTHETIC_ERRNO(EINVAL), "Got more than one socket."); + + if (params->n_socket_fds == 0) + return log_exec_error_errno(context, params, SYNTHETIC_ERRNO(EINVAL), "Got no socket."); + + socket_fd = params->fds[0]; + } else { + params_fds = params->fds; + n_socket_fds = params->n_socket_fds; + n_storage_fds = params->n_storage_fds; + } + n_fds = n_socket_fds + n_storage_fds; + + r = exec_context_named_iofds(context, params, named_iofds); + if (r < 0) + return log_exec_error_errno(context, params, r, "Failed to load a named file descriptor: %m"); + + rename_process_from_path(command->path); + + /* We reset exactly these signals, since they are the only ones we set to SIG_IGN in the main + * daemon. All others we leave untouched because we set them to SIG_DFL or a valid handler initially, + * both of which will be demoted to SIG_DFL. */ + (void) default_signals(SIGNALS_CRASH_HANDLER, + SIGNALS_IGNORE); + + if (context->ignore_sigpipe) + (void) ignore_signals(SIGPIPE); + + r = reset_signal_mask(); + if (r < 0) { + *exit_status = EXIT_SIGNAL_MASK; + return log_exec_error_errno(context, params, r, "Failed to set process signal mask: %m"); + } + + if (params->idle_pipe) + do_idle_pipe_dance(params->idle_pipe); + + /* Close fds we don't need very early to make sure we don't block init reexecution because it cannot bind its + * sockets. Among the fds we close are the logging fds, and we want to keep them closed, so that we don't have + * any fds open we don't really want open during the transition. In order to make logging work, we switch the + * log subsystem into open_when_needed mode, so that it reopens the logs on every single log call. */ + + log_forget_fds(); + log_set_open_when_needed(true); + log_settle_target(); + if (context->log_level_max >= 0) + log_set_max_level(context->log_level_max); + + /* In case anything used libc syslog(), close this here, too */ + closelog(); + + fds = newdup(int, params_fds, n_fds); + if (!fds) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + + fdnames = strv_copy((char**) params->fd_names); + if (!fdnames) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + + r = collect_open_file_fds(context, params, &fds, &fdnames, &n_fds); + if (r < 0) { + *exit_status = EXIT_FDS; + return log_exec_error_errno(context, params, r, "Failed to get OpenFile= file descriptors: %m"); + } + + int keep_fds[n_fds + 3]; + memcpy_safe(keep_fds, fds, n_fds * sizeof(int)); + n_keep_fds = n_fds; + + r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, params->exec_fd, &exec_fd); + if (r < 0) { + *exit_status = EXIT_FDS; + return log_exec_error_errno(context, params, r, "Failed to shift fd and set FD_CLOEXEC: %m"); + } + +#if HAVE_LIBBPF + if (params->bpf_outer_map_fd >= 0) { + r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, params->bpf_outer_map_fd, (int *)¶ms->bpf_outer_map_fd); + if (r < 0) { + *exit_status = EXIT_FDS; + return log_exec_error_errno(context, params, r, "Failed to shift fd and set FD_CLOEXEC: %m"); + } + } +#endif + + r = close_remaining_fds(params, runtime, socket_fd, keep_fds, n_keep_fds); + if (r < 0) { + *exit_status = EXIT_FDS; + return log_exec_error_errno(context, params, r, "Failed to close unwanted file descriptors: %m"); + } + + if (!context->same_pgrp && + setsid() < 0) { + *exit_status = EXIT_SETSID; + return log_exec_error_errno(context, params, errno, "Failed to create new process session: %m"); + } + + exec_context_tty_reset(context, params); + + if (params->shall_confirm_spawn && exec_context_shall_confirm_spawn(context)) { + _cleanup_free_ char *cmdline = NULL; + + cmdline = quote_command_line(command->argv, SHELL_ESCAPE_EMPTY); + if (!cmdline) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + + r = ask_for_confirmation(context, params, cmdline); + if (r != CONFIRM_EXECUTE) { + if (r == CONFIRM_PRETEND_SUCCESS) { + *exit_status = EXIT_SUCCESS; + return 0; + } + + *exit_status = EXIT_CONFIRM; + return log_exec_error_errno(context, params, SYNTHETIC_ERRNO(ECANCELED), + "Execution cancelled by the user"); + } + } + + /* We are about to invoke NSS and PAM modules. Let's tell them what we are doing here, maybe they care. This is + * used by nss-resolve to disable itself when we are about to start systemd-resolved, to avoid deadlocks. Note + * that these env vars do not survive the execve(), which means they really only apply to the PAM and NSS + * invocations themselves. Also note that while we'll only invoke NSS modules involved in user management they + * might internally call into other NSS modules that are involved in hostname resolution, we never know. */ + if (setenv("SYSTEMD_ACTIVATION_UNIT", params->unit_id, true) != 0 || + setenv("SYSTEMD_ACTIVATION_SCOPE", runtime_scope_to_string(params->runtime_scope), true) != 0) { + *exit_status = EXIT_MEMORY; + return log_exec_error_errno(context, params, errno, "Failed to update environment: %m"); + } + + if (context->dynamic_user && runtime && runtime->dynamic_creds) { + _cleanup_strv_free_ char **suggested_paths = NULL; + + /* On top of that, make sure we bypass our own NSS module nss-systemd comprehensively for any NSS + * checks, if DynamicUser=1 is used, as we shouldn't create a feedback loop with ourselves here. */ + if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) { + *exit_status = EXIT_USER; + return log_exec_error_errno(context, params, errno, "Failed to update environment: %m"); + } + + r = compile_suggested_paths(context, params, &suggested_paths); + if (r < 0) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + + r = dynamic_creds_realize(runtime->dynamic_creds, suggested_paths, &uid, &gid); + if (r < 0) { + *exit_status = EXIT_USER; + if (r == -EILSEQ) + return log_exec_error_errno(context, params, SYNTHETIC_ERRNO(EOPNOTSUPP), + "Failed to update dynamic user credentials: User or group with specified name already exists."); + return log_exec_error_errno(context, params, r, "Failed to update dynamic user credentials: %m"); + } + + if (!uid_is_valid(uid)) { + *exit_status = EXIT_USER; + return log_exec_error_errno(context, params, SYNTHETIC_ERRNO(ESRCH), "UID validation failed for \""UID_FMT"\"", uid); + } + + if (!gid_is_valid(gid)) { + *exit_status = EXIT_USER; + return log_exec_error_errno(context, params, SYNTHETIC_ERRNO(ESRCH), "GID validation failed for \""GID_FMT"\"", gid); + } + + if (runtime->dynamic_creds->user) + username = runtime->dynamic_creds->user->name; + + } else { + if (context->user) { + r = get_fixed_user(context->user, &username, &uid, &gid, &home, &shell); + if (r < 0) { + *exit_status = EXIT_USER; + return log_exec_error_errno(context, params, r, "Failed to determine user credentials: %m"); + } + } + + if (context->group) { + r = get_fixed_group(context->group, &groupname, &gid); + if (r < 0) { + *exit_status = EXIT_GROUP; + return log_exec_error_errno(context, params, r, "Failed to determine group credentials: %m"); + } + } + } + + /* Initialize user supplementary groups and get SupplementaryGroups= ones */ + r = get_supplementary_groups(context, username, groupname, gid, + &supplementary_gids, &ngids); + if (r < 0) { + *exit_status = EXIT_GROUP; + return log_exec_error_errno(context, params, r, "Failed to determine supplementary groups: %m"); + } + + r = send_user_lookup(params->unit_id, params->user_lookup_fd, uid, gid); + if (r < 0) { + *exit_status = EXIT_USER; + return log_exec_error_errno(context, params, r, "Failed to send user credentials to PID1: %m"); + } + + params->user_lookup_fd = safe_close(params->user_lookup_fd); + + r = acquire_home(context, uid, &home, &home_buffer); + if (r < 0) { + *exit_status = EXIT_CHDIR; + return log_exec_error_errno(context, params, r, "Failed to determine $HOME for user: %m"); + } + + /* If a socket is connected to STDIN/STDOUT/STDERR, we must drop O_NONBLOCK */ + if (socket_fd >= 0) + (void) fd_nonblock(socket_fd, false); + + /* Journald will try to look-up our cgroup in order to populate _SYSTEMD_CGROUP and _SYSTEMD_UNIT fields. + * Hence we need to migrate to the target cgroup from init.scope before connecting to journald */ + if (params->cgroup_path) { + _cleanup_free_ char *p = NULL; + + r = exec_params_get_cgroup_path(params, cgroup_context, &p); + if (r < 0) { + *exit_status = EXIT_CGROUP; + return log_exec_error_errno(context, params, r, "Failed to acquire cgroup path: %m"); + } + + r = cg_attach_everywhere(params->cgroup_supported, p, 0, NULL, NULL); + if (r == -EUCLEAN) { + *exit_status = EXIT_CGROUP; + return log_exec_error_errno(context, params, r, "Failed to attach process to cgroup %s " + "because the cgroup or one of its parents or " + "siblings is in the threaded mode: %m", p); + } + if (r < 0) { + *exit_status = EXIT_CGROUP; + return log_exec_error_errno(context, params, r, "Failed to attach to cgroup %s: %m", p); + } + } + + if (context->network_namespace_path && runtime && runtime->shared && runtime->shared->netns_storage_socket[0] >= 0) { + r = open_shareable_ns_path(runtime->shared->netns_storage_socket, context->network_namespace_path, CLONE_NEWNET); + if (r < 0) { + *exit_status = EXIT_NETWORK; + return log_exec_error_errno(context, params, r, "Failed to open network namespace path %s: %m", context->network_namespace_path); + } + } + + if (context->ipc_namespace_path && runtime && runtime->shared && runtime->shared->ipcns_storage_socket[0] >= 0) { + r = open_shareable_ns_path(runtime->shared->ipcns_storage_socket, context->ipc_namespace_path, CLONE_NEWIPC); + if (r < 0) { + *exit_status = EXIT_NAMESPACE; + return log_exec_error_errno(context, params, r, "Failed to open IPC namespace path %s: %m", context->ipc_namespace_path); + } + } + + r = setup_input(context, params, socket_fd, named_iofds); + if (r < 0) { + *exit_status = EXIT_STDIN; + return log_exec_error_errno(context, params, r, "Failed to set up standard input: %m"); + } + + r = setup_output(context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino); + if (r < 0) { + *exit_status = EXIT_STDOUT; + return log_exec_error_errno(context, params, r, "Failed to set up standard output: %m"); + } + + r = setup_output(context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino); + if (r < 0) { + *exit_status = EXIT_STDERR; + return log_exec_error_errno(context, params, r, "Failed to set up standard error output: %m"); + } + + if (context->oom_score_adjust_set) { + /* When we can't make this change due to EPERM, then let's silently skip over it. User + * namespaces prohibit write access to this file, and we shouldn't trip up over that. */ + r = set_oom_score_adjust(context->oom_score_adjust); + if (ERRNO_IS_NEG_PRIVILEGE(r)) + log_exec_debug_errno(context, params, r, + "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m"); + else if (r < 0) { + *exit_status = EXIT_OOM_ADJUST; + return log_exec_error_errno(context, params, r, "Failed to adjust OOM setting: %m"); + } + } + + if (context->coredump_filter_set) { + r = set_coredump_filter(context->coredump_filter); + if (ERRNO_IS_NEG_PRIVILEGE(r)) + log_exec_debug_errno(context, params, r, "Failed to adjust coredump_filter, ignoring: %m"); + else if (r < 0) { + *exit_status = EXIT_LIMITS; + return log_exec_error_errno(context, params, r, "Failed to adjust coredump_filter: %m"); + } + } + + if (context->nice_set) { + r = setpriority_closest(context->nice); + if (r < 0) { + *exit_status = EXIT_NICE; + return log_exec_error_errno(context, params, r, "Failed to set up process scheduling priority (nice level): %m"); + } + } + + if (context->cpu_sched_set) { + struct sched_param param = { + .sched_priority = context->cpu_sched_priority, + }; + + r = sched_setscheduler(0, + context->cpu_sched_policy | + (context->cpu_sched_reset_on_fork ? + SCHED_RESET_ON_FORK : 0), + ¶m); + if (r < 0) { + *exit_status = EXIT_SETSCHEDULER; + return log_exec_error_errno(context, params, errno, "Failed to set up CPU scheduling: %m"); + } + } + + if (context->cpu_affinity_from_numa || context->cpu_set.set) { + _cleanup_(cpu_set_reset) CPUSet converted_cpu_set = {}; + const CPUSet *cpu_set; + + if (context->cpu_affinity_from_numa) { + r = exec_context_cpu_affinity_from_numa(context, &converted_cpu_set); + if (r < 0) { + *exit_status = EXIT_CPUAFFINITY; + return log_exec_error_errno(context, params, r, "Failed to derive CPU affinity mask from NUMA mask: %m"); + } + + cpu_set = &converted_cpu_set; + } else + cpu_set = &context->cpu_set; + + if (sched_setaffinity(0, cpu_set->allocated, cpu_set->set) < 0) { + *exit_status = EXIT_CPUAFFINITY; + return log_exec_error_errno(context, params, errno, "Failed to set up CPU affinity: %m"); + } + } + + if (mpol_is_valid(numa_policy_get_type(&context->numa_policy))) { + r = apply_numa_policy(&context->numa_policy); + if (ERRNO_IS_NEG_NOT_SUPPORTED(r)) + log_exec_debug_errno(context, params, r, "NUMA support not available, ignoring."); + else if (r < 0) { + *exit_status = EXIT_NUMA_POLICY; + return log_exec_error_errno(context, params, r, "Failed to set NUMA memory policy: %m"); + } + } + + if (context->ioprio_set) + if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) { + *exit_status = EXIT_IOPRIO; + return log_exec_error_errno(context, params, errno, "Failed to set up IO scheduling priority: %m"); + } + + if (context->timer_slack_nsec != NSEC_INFINITY) + if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) { + *exit_status = EXIT_TIMERSLACK; + return log_exec_error_errno(context, params, errno, "Failed to set up timer slack: %m"); + } + + if (context->personality != PERSONALITY_INVALID) { + r = safe_personality(context->personality); + if (r < 0) { + *exit_status = EXIT_PERSONALITY; + return log_exec_error_errno(context, params, r, "Failed to set up execution domain (personality): %m"); + } + } + + if (context->utmp_id) { + const char *line = context->tty_path ? + (path_startswith(context->tty_path, "/dev/") ?: context->tty_path) : + NULL; + utmp_put_init_process(context->utmp_id, getpid_cached(), getsid(0), + line, + context->utmp_mode == EXEC_UTMP_INIT ? INIT_PROCESS : + context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS : + USER_PROCESS, + username); + } + + if (uid_is_valid(uid)) { + r = chown_terminal(STDIN_FILENO, uid); + if (r < 0) { + *exit_status = EXIT_STDIN; + return log_exec_error_errno(context, params, r, "Failed to change ownership of terminal: %m"); + } + } + + if (params->cgroup_path) { + /* If delegation is enabled we'll pass ownership of the cgroup to the user of the new process. On cgroup v1 + * this is only about systemd's own hierarchy, i.e. not the controller hierarchies, simply because that's not + * safe. On cgroup v2 there's only one hierarchy anyway, and delegation is safe there, hence in that case only + * touch a single hierarchy too. */ + + if (params->flags & EXEC_CGROUP_DELEGATE) { + _cleanup_free_ char *p = NULL; + + r = cg_set_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, uid, gid); + if (r < 0) { + *exit_status = EXIT_CGROUP; + return log_exec_error_errno(context, params, r, "Failed to adjust control group access: %m"); + } + + r = exec_params_get_cgroup_path(params, cgroup_context, &p); + if (r < 0) { + *exit_status = EXIT_CGROUP; + return log_exec_error_errno(context, params, r, "Failed to acquire cgroup path: %m"); + } + if (r > 0) { + r = cg_set_access_recursive(SYSTEMD_CGROUP_CONTROLLER, p, uid, gid); + if (r < 0) { + *exit_status = EXIT_CGROUP; + return log_exec_error_errno(context, params, r, "Failed to adjust control subgroup access: %m"); + } + } + } + + if (cgroup_context && cg_unified() > 0 && is_pressure_supported() > 0) { + if (cgroup_context_want_memory_pressure(cgroup_context)) { + r = cg_get_path("memory", params->cgroup_path, "memory.pressure", &memory_pressure_path); + if (r < 0) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + + r = chmod_and_chown(memory_pressure_path, 0644, uid, gid); + if (r < 0) { + log_exec_full_errno(context, params, r == -ENOENT || ERRNO_IS_PRIVILEGE(r) ? LOG_DEBUG : LOG_WARNING, r, + "Failed to adjust ownership of '%s', ignoring: %m", memory_pressure_path); + memory_pressure_path = mfree(memory_pressure_path); + } + } else if (cgroup_context->memory_pressure_watch == CGROUP_PRESSURE_WATCH_OFF) { + memory_pressure_path = strdup("/dev/null"); /* /dev/null is explicit indicator for turning of memory pressure watch */ + if (!memory_pressure_path) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + } + } + } + + needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime); + + for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) { + r = setup_exec_directory(context, params, uid, gid, dt, needs_mount_namespace, exit_status); + if (r < 0) + return log_exec_error_errno(context, params, r, "Failed to set up special execution directory in %s: %m", params->prefix[dt]); + } + + if (FLAGS_SET(params->flags, EXEC_WRITE_CREDENTIALS)) { + r = exec_setup_credentials(context, params, params->unit_id, uid, gid); + if (r < 0) { + *exit_status = EXIT_CREDENTIALS; + return log_exec_error_errno(context, params, r, "Failed to set up credentials: %m"); + } + } + + r = build_environment( + context, + params, + cgroup_context, + n_fds, + fdnames, + home, + username, + shell, + journal_stream_dev, + journal_stream_ino, + memory_pressure_path, + &our_env); + if (r < 0) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + + r = build_pass_environment(context, &pass_env); + if (r < 0) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + + /* The $PATH variable is set to the default path in params->environment. However, this is overridden + * if user-specified fields have $PATH set. The intention is to also override $PATH if the unit does + * not specify PATH but the unit has ExecSearchPath. */ + if (!strv_isempty(context->exec_search_path)) { + _cleanup_free_ char *joined = NULL; + + joined = strv_join(context->exec_search_path, ":"); + if (!joined) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + + r = strv_env_assign(&joined_exec_search_path, "PATH", joined); + if (r < 0) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + } + + accum_env = strv_env_merge(params->environment, + our_env, + joined_exec_search_path, + pass_env, + context->environment, + params->files_env); + if (!accum_env) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + accum_env = strv_env_clean(accum_env); + + (void) umask(context->umask); + + r = setup_keyring(context, params, uid, gid); + if (r < 0) { + *exit_status = EXIT_KEYRING; + return log_exec_error_errno(context, params, r, "Failed to set up kernel keyring: %m"); + } + + /* We need sandboxing if the caller asked us to apply it and the command isn't explicitly excepted + * from it. */ + needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED); + + /* We need the ambient capability hack, if the caller asked us to apply it and the command is marked + * for it, and the kernel doesn't actually support ambient caps. */ + needs_ambient_hack = (params->flags & EXEC_APPLY_SANDBOXING) && (command->flags & EXEC_COMMAND_AMBIENT_MAGIC) && !ambient_capabilities_supported(); + + /* We need setresuid() if the caller asked us to apply sandboxing and the command isn't explicitly + * excepted from either whole sandboxing or just setresuid() itself, and the ambient hack is not + * desired. */ + if (needs_ambient_hack) + needs_setuid = false; + else + needs_setuid = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & (EXEC_COMMAND_FULLY_PRIVILEGED|EXEC_COMMAND_NO_SETUID)); + + uint64_t capability_ambient_set = context->capability_ambient_set; + + if (needs_sandboxing) { + /* MAC enablement checks need to be done before a new mount ns is created, as they rely on + * /sys being present. The actual MAC context application will happen later, as late as + * possible, to avoid impacting our own code paths. */ + +#if HAVE_SELINUX + use_selinux = mac_selinux_use(); +#endif +#if ENABLE_SMACK + use_smack = mac_smack_use(); +#endif +#if HAVE_APPARMOR + use_apparmor = mac_apparmor_use(); +#endif + } + + if (needs_sandboxing) { + int which_failed; + + /* Let's set the resource limits before we call into PAM, so that pam_limits wins over what + * is set here. (See below.) */ + + r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed); + if (r < 0) { + *exit_status = EXIT_LIMITS; + return log_exec_error_errno(context, params, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed)); + } + } + + if (needs_setuid && context->pam_name && username) { + /* Let's call into PAM after we set up our own idea of resource limits to that pam_limits + * wins here. (See above.) */ + + /* All fds passed in the fds array will be closed in the pam child process. */ + r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds); + if (r < 0) { + *exit_status = EXIT_PAM; + return log_exec_error_errno(context, params, r, "Failed to set up PAM session: %m"); + } + + if (ambient_capabilities_supported()) { + uint64_t ambient_after_pam; + + /* PAM modules might have set some ambient caps. Query them here and merge them into + * the caps we want to set in the end, so that we don't end up unsetting them. */ + r = capability_get_ambient(&ambient_after_pam); + if (r < 0) { + *exit_status = EXIT_CAPABILITIES; + return log_exec_error_errno(context, params, r, "Failed to query ambient caps: %m"); + } + + capability_ambient_set |= ambient_after_pam; + } + + ngids_after_pam = getgroups_alloc(&gids_after_pam); + if (ngids_after_pam < 0) { + *exit_status = EXIT_MEMORY; + return log_exec_error_errno(context, params, ngids_after_pam, "Failed to obtain groups after setting up PAM: %m"); + } + } + + if (needs_sandboxing && exec_context_need_unprivileged_private_users(context, params)) { + /* If we're unprivileged, set up the user namespace first to enable use of the other namespaces. + * Users with CAP_SYS_ADMIN can set up user namespaces last because they will be able to + * set up the all of the other namespaces (i.e. network, mount, UTS) without a user namespace. */ + + r = setup_private_users(saved_uid, saved_gid, uid, gid); + /* If it was requested explicitly and we can't set it up, fail early. Otherwise, continue and let + * the actual requested operations fail (or silently continue). */ + if (r < 0 && context->private_users) { + *exit_status = EXIT_USER; + return log_exec_error_errno(context, params, r, "Failed to set up user namespacing for unprivileged user: %m"); + } + if (r < 0) + log_exec_info_errno(context, params, r, "Failed to set up user namespacing for unprivileged user, ignoring: %m"); + else + userns_set_up = true; + } + + if (exec_needs_network_namespace(context) && runtime && runtime->shared && runtime->shared->netns_storage_socket[0] >= 0) { + + /* Try to enable network namespacing if network namespacing is available and we have + * CAP_NET_ADMIN. We need CAP_NET_ADMIN to be able to configure the loopback device in the + * new network namespace. And if we don't have that, then we could only create a network + * namespace without the ability to set up "lo". Hence gracefully skip things then. */ + if (ns_type_supported(NAMESPACE_NET) && have_effective_cap(CAP_NET_ADMIN) > 0) { + r = setup_shareable_ns(runtime->shared->netns_storage_socket, CLONE_NEWNET); + if (ERRNO_IS_NEG_PRIVILEGE(r)) + log_exec_notice_errno(context, params, r, + "PrivateNetwork=yes is configured, but network namespace setup not permitted, proceeding without: %m"); + else if (r < 0) { + *exit_status = EXIT_NETWORK; + return log_exec_error_errno(context, params, r, "Failed to set up network namespacing: %m"); + } + } else if (context->network_namespace_path) { + *exit_status = EXIT_NETWORK; + return log_exec_error_errno(context, params, SYNTHETIC_ERRNO(EOPNOTSUPP), + "NetworkNamespacePath= is not supported, refusing."); + } else + log_exec_notice(context, params, "PrivateNetwork=yes is configured, but the kernel does not support or we lack privileges for network namespace, proceeding without."); + } + + if (exec_needs_ipc_namespace(context) && runtime && runtime->shared && runtime->shared->ipcns_storage_socket[0] >= 0) { + + if (ns_type_supported(NAMESPACE_IPC)) { + r = setup_shareable_ns(runtime->shared->ipcns_storage_socket, CLONE_NEWIPC); + if (r == -EPERM) + log_exec_warning_errno(context, params, r, + "PrivateIPC=yes is configured, but IPC namespace setup failed, ignoring: %m"); + else if (r < 0) { + *exit_status = EXIT_NAMESPACE; + return log_exec_error_errno(context, params, r, "Failed to set up IPC namespacing: %m"); + } + } else if (context->ipc_namespace_path) { + *exit_status = EXIT_NAMESPACE; + return log_exec_error_errno(context, params, SYNTHETIC_ERRNO(EOPNOTSUPP), + "IPCNamespacePath= is not supported, refusing."); + } else + log_exec_warning(context, params, "PrivateIPC=yes is configured, but the kernel does not support IPC namespaces, ignoring."); + } + + if (needs_mount_namespace) { + _cleanup_free_ char *error_path = NULL; + + r = apply_mount_namespace(command->flags, context, params, runtime, memory_pressure_path, &error_path); + if (r < 0) { + *exit_status = EXIT_NAMESPACE; + return log_exec_error_errno(context, params, r, "Failed to set up mount namespacing%s%s: %m", + error_path ? ": " : "", strempty(error_path)); + } + } + + if (needs_sandboxing) { + r = apply_protect_hostname(context, params, exit_status); + if (r < 0) + return r; + } + + if (context->memory_ksm >= 0) + if (prctl(PR_SET_MEMORY_MERGE, context->memory_ksm) < 0) { + if (ERRNO_IS_NOT_SUPPORTED(errno)) + log_exec_debug_errno(context, + params, + errno, + "KSM support not available, ignoring."); + else { + *exit_status = EXIT_KSM; + return log_exec_error_errno(context, params, errno, "Failed to set KSM: %m"); + } + } + + /* Drop groups as early as possible. + * This needs to be done after PrivateDevices=y setup as device nodes should be owned by the host's root. + * For non-root in a userns, devices will be owned by the user/group before the group change, and nobody. */ + if (needs_setuid) { + _cleanup_free_ gid_t *gids_to_enforce = NULL; + int ngids_to_enforce = 0; + + ngids_to_enforce = merge_gid_lists(supplementary_gids, + ngids, + gids_after_pam, + ngids_after_pam, + &gids_to_enforce); + if (ngids_to_enforce < 0) { + *exit_status = EXIT_MEMORY; + return log_exec_error_errno(context, params, + ngids_to_enforce, + "Failed to merge group lists. Group membership might be incorrect: %m"); + } + + r = enforce_groups(gid, gids_to_enforce, ngids_to_enforce); + if (r < 0) { + *exit_status = EXIT_GROUP; + return log_exec_error_errno(context, params, r, "Changing group credentials failed: %m"); + } + } + + /* If the user namespace was not set up above, try to do it now. + * It's preferred to set up the user namespace later (after all other namespaces) so as not to be + * restricted by rules pertaining to combining user namespaces with other namespaces (e.g. in the + * case of mount namespaces being less privileged when the mount point list is copied from a + * different user namespace). */ + + if (needs_sandboxing && context->private_users && !userns_set_up) { + r = setup_private_users(saved_uid, saved_gid, uid, gid); + if (r < 0) { + *exit_status = EXIT_USER; + return log_exec_error_errno(context, params, r, "Failed to set up user namespacing: %m"); + } + } + + /* Now that the mount namespace has been set up and privileges adjusted, let's look for the thing we + * shall execute. */ + + _cleanup_free_ char *executable = NULL; + _cleanup_close_ int executable_fd = -EBADF; + r = find_executable_full(command->path, /* root= */ NULL, context->exec_search_path, false, &executable, &executable_fd); + if (r < 0) { + if (r != -ENOMEM && (command->flags & EXEC_COMMAND_IGNORE_FAILURE)) { + log_exec_struct_errno(context, params, LOG_INFO, r, + "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR, + LOG_EXEC_INVOCATION_ID(params), + LOG_EXEC_MESSAGE(params, + "Executable %s missing, skipping: %m", + command->path), + "EXECUTABLE=%s", command->path); + *exit_status = EXIT_SUCCESS; + return 0; + } + + *exit_status = EXIT_EXEC; + return log_exec_struct_errno(context, params, LOG_INFO, r, + "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR, + LOG_EXEC_INVOCATION_ID(params), + LOG_EXEC_MESSAGE(params, + "Failed to locate executable %s: %m", + command->path), + "EXECUTABLE=%s", command->path); + } + + r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, executable_fd, &executable_fd); + if (r < 0) { + *exit_status = EXIT_FDS; + return log_exec_error_errno(context, params, r, "Failed to shift fd and set FD_CLOEXEC: %m"); + } + +#if HAVE_SELINUX + if (needs_sandboxing && use_selinux && params->selinux_context_net) { + int fd = -EBADF; + + if (socket_fd >= 0) + fd = socket_fd; + else if (params->n_socket_fds == 1) + /* If stdin is not connected to a socket but we are triggered by exactly one socket unit then we + * use context from that fd to compute the label. */ + fd = params->fds[0]; + + if (fd >= 0) { + r = mac_selinux_get_child_mls_label(fd, executable, context->selinux_context, &mac_selinux_context_net); + if (r < 0) { + if (!context->selinux_context_ignore) { + *exit_status = EXIT_SELINUX_CONTEXT; + return log_exec_error_errno(context, + params, + r, + "Failed to determine SELinux context: %m"); + } + log_exec_debug_errno(context, + params, + r, + "Failed to determine SELinux context, ignoring: %m"); + } + } + } +#endif + + /* We repeat the fd closing here, to make sure that nothing is leaked from the PAM modules. Note that + * we are more aggressive this time, since we don't need socket_fd and the netns and ipcns fds any + * more. We do keep exec_fd however, if we have it, since we need to keep it open until the final + * execve(). */ + + r = close_all_fds(keep_fds, n_keep_fds); + if (r >= 0) + r = shift_fds(fds, n_fds); + if (r >= 0) + r = flags_fds(fds, n_socket_fds, n_fds, context->non_blocking); + if (r < 0) { + *exit_status = EXIT_FDS; + return log_exec_error_errno(context, params, r, "Failed to adjust passed file descriptors: %m"); + } + + /* At this point, the fds we want to pass to the program are all ready and set up, with O_CLOEXEC turned off + * and at the right fd numbers. The are no other fds open, with one exception: the exec_fd if it is defined, + * and it has O_CLOEXEC set, after all we want it to be closed by the execve(), so that our parent knows we + * came this far. */ + + secure_bits = context->secure_bits; + + if (needs_sandboxing) { + uint64_t bset; + + /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. + * (Note this is placed after the general resource limit initialization, see above, in order + * to take precedence.) */ + if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) { + if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) { + *exit_status = EXIT_LIMITS; + return log_exec_error_errno(context, params, errno, "Failed to adjust RLIMIT_RTPRIO resource limit: %m"); + } + } + +#if ENABLE_SMACK + /* LSM Smack needs the capability CAP_MAC_ADMIN to change the current execution security context of the + * process. This is the latest place before dropping capabilities. Other MAC context are set later. */ + if (use_smack && context->smack_process_label) { + r = setup_smack(params, context, executable_fd); + if (r < 0 && !context->smack_process_label_ignore) { + *exit_status = EXIT_SMACK_PROCESS_LABEL; + return log_exec_error_errno(context, params, r, "Failed to set SMACK process label: %m"); + } + } +#endif + + bset = context->capability_bounding_set; + /* If the ambient caps hack is enabled (which means the kernel can't do them, and the user asked for + * our magic fallback), then let's add some extra caps, so that the service can drop privs of its own, + * instead of us doing that */ + if (needs_ambient_hack) + bset |= (UINT64_C(1) << CAP_SETPCAP) | + (UINT64_C(1) << CAP_SETUID) | + (UINT64_C(1) << CAP_SETGID); + + if (!cap_test_all(bset)) { + r = capability_bounding_set_drop(bset, /* right_now= */ false); + if (r < 0) { + *exit_status = EXIT_CAPABILITIES; + return log_exec_error_errno(context, params, r, "Failed to drop capabilities: %m"); + } + } + + /* Ambient capabilities are cleared during setresuid() (in enforce_user()) even with + * keep-caps set. + * + * To be able to raise the ambient capabilities after setresuid() they have to be added to + * the inherited set and keep caps has to be set (done in enforce_user()). After setresuid() + * the ambient capabilities can be raised as they are present in the permitted and + * inhertiable set. However it is possible that someone wants to set ambient capabilities + * without changing the user, so we also set the ambient capabilities here. + * + * The requested ambient capabilities are raised in the inheritable set if the second + * argument is true. */ + if (!needs_ambient_hack) { + r = capability_ambient_set_apply(capability_ambient_set, /* also_inherit= */ true); + if (r < 0) { + *exit_status = EXIT_CAPABILITIES; + return log_exec_error_errno(context, params, r, "Failed to apply ambient capabilities (before UID change): %m"); + } + } + } + + /* chroot to root directory first, before we lose the ability to chroot */ + r = apply_root_directory(context, params, runtime, needs_mount_namespace, exit_status); + if (r < 0) + return log_exec_error_errno(context, params, r, "Chrooting to the requested root directory failed: %m"); + + if (needs_setuid) { + if (uid_is_valid(uid)) { + r = enforce_user(context, uid, capability_ambient_set); + if (r < 0) { + *exit_status = EXIT_USER; + return log_exec_error_errno(context, params, r, "Failed to change UID to " UID_FMT ": %m", uid); + } + + if (!needs_ambient_hack && capability_ambient_set != 0) { + + /* Raise the ambient capabilities after user change. */ + r = capability_ambient_set_apply(capability_ambient_set, /* also_inherit= */ false); + if (r < 0) { + *exit_status = EXIT_CAPABILITIES; + return log_exec_error_errno(context, params, r, "Failed to apply ambient capabilities (after UID change): %m"); + } + } + } + } + + /* Apply working directory here, because the working directory might be on NFS and only the user running + * this service might have the correct privilege to change to the working directory */ + r = apply_working_directory(context, params, runtime, home, exit_status); + if (r < 0) + return log_exec_error_errno(context, params, r, "Changing to the requested working directory failed: %m"); + + if (needs_sandboxing) { + /* Apply other MAC contexts late, but before seccomp syscall filtering, as those should really be last to + * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires + * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls + * are restricted. */ + +#if HAVE_SELINUX + if (use_selinux) { + char *exec_context = mac_selinux_context_net ?: context->selinux_context; + + if (exec_context) { + r = setexeccon(exec_context); + if (r < 0) { + if (!context->selinux_context_ignore) { + *exit_status = EXIT_SELINUX_CONTEXT; + return log_exec_error_errno(context, params, r, "Failed to change SELinux context to %s: %m", exec_context); + } + log_exec_debug_errno(context, + params, + r, + "Failed to change SELinux context to %s, ignoring: %m", + exec_context); + } + } + } +#endif + +#if HAVE_APPARMOR + if (use_apparmor && context->apparmor_profile) { + r = aa_change_onexec(context->apparmor_profile); + if (r < 0 && !context->apparmor_profile_ignore) { + *exit_status = EXIT_APPARMOR_PROFILE; + return log_exec_error_errno(context, + params, + errno, + "Failed to prepare AppArmor profile change to %s: %m", + context->apparmor_profile); + } + } +#endif + + /* PR_GET_SECUREBITS is not privileged, while PR_SET_SECUREBITS is. So to suppress potential + * EPERMs we'll try not to call PR_SET_SECUREBITS unless necessary. Setting securebits + * requires CAP_SETPCAP. */ + if (prctl(PR_GET_SECUREBITS) != secure_bits) { + /* CAP_SETPCAP is required to set securebits. This capability is raised into the + * effective set here. + * + * The effective set is overwritten during execve() with the following values: + * + * - ambient set (for non-root processes) + * + * - (inheritable | bounding) set for root processes) + * + * Hence there is no security impact to raise it in the effective set before execve + */ + r = capability_gain_cap_setpcap(/* return_caps= */ NULL); + if (r < 0) { + *exit_status = EXIT_CAPABILITIES; + return log_exec_error_errno(context, params, r, "Failed to gain CAP_SETPCAP for setting secure bits"); + } + if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) { + *exit_status = EXIT_SECUREBITS; + return log_exec_error_errno(context, params, errno, "Failed to set process secure bits: %m"); + } + } + + if (context_has_no_new_privileges(context)) + if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) { + *exit_status = EXIT_NO_NEW_PRIVILEGES; + return log_exec_error_errno(context, params, errno, "Failed to disable new privileges: %m"); + } + +#if HAVE_SECCOMP + r = apply_address_families(context, params); + if (r < 0) { + *exit_status = EXIT_ADDRESS_FAMILIES; + return log_exec_error_errno(context, params, r, "Failed to restrict address families: %m"); + } + + r = apply_memory_deny_write_execute(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to disable writing to executable memory: %m"); + } + + r = apply_restrict_realtime(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to apply realtime restrictions: %m"); + } + + r = apply_restrict_suid_sgid(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to apply SUID/SGID restrictions: %m"); + } + + r = apply_restrict_namespaces(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to apply namespace restrictions: %m"); + } + + r = apply_protect_sysctl(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to apply sysctl restrictions: %m"); + } + + r = apply_protect_kernel_modules(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to apply module loading restrictions: %m"); + } + + r = apply_protect_kernel_logs(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to apply kernel log restrictions: %m"); + } + + r = apply_protect_clock(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to apply clock restrictions: %m"); + } + + r = apply_private_devices(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to set up private devices: %m"); + } + + r = apply_syscall_archs(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to apply syscall architecture restrictions: %m"); + } + + r = apply_lock_personality(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to lock personalities: %m"); + } + + r = apply_syscall_log(context, params); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to apply system call log filters: %m"); + } + + /* This really should remain the last step before the execve(), to make sure our own code is unaffected + * by the filter as little as possible. */ + r = apply_syscall_filter(context, params, needs_ambient_hack); + if (r < 0) { + *exit_status = EXIT_SECCOMP; + return log_exec_error_errno(context, params, r, "Failed to apply system call filters: %m"); + } +#endif + +#if HAVE_LIBBPF + r = apply_restrict_filesystems(context, params); + if (r < 0) { + *exit_status = EXIT_BPF; + return log_exec_error_errno(context, params, r, "Failed to restrict filesystems: %m"); + } +#endif + + } + + if (!strv_isempty(context->unset_environment)) { + char **ee = NULL; + + ee = strv_env_delete(accum_env, 1, context->unset_environment); + if (!ee) { + *exit_status = EXIT_MEMORY; + return log_oom(); + } + + strv_free_and_replace(accum_env, ee); + } + + if (!FLAGS_SET(command->flags, EXEC_COMMAND_NO_ENV_EXPAND)) { + _cleanup_strv_free_ char **unset_variables = NULL, **bad_variables = NULL; + + r = replace_env_argv(command->argv, accum_env, &replaced_argv, &unset_variables, &bad_variables); + if (r < 0) { + *exit_status = EXIT_MEMORY; + return log_exec_error_errno(context, + params, + r, + "Failed to replace environment variables: %m"); + } + final_argv = replaced_argv; + + if (!strv_isempty(unset_variables)) { + _cleanup_free_ char *ju = strv_join(unset_variables, ", "); + log_exec_warning(context, + params, + "Referenced but unset environment variable evaluates to an empty string: %s", + strna(ju)); + } + + if (!strv_isempty(bad_variables)) { + _cleanup_free_ char *jb = strv_join(bad_variables, ", "); + log_exec_warning(context, + params, + "Invalid environment variable name evaluates to an empty string: %s", + strna(jb)); + } + } else + final_argv = command->argv; + + log_command_line(context, params, "Executing", executable, final_argv); + + if (exec_fd >= 0) { + uint8_t hot = 1; + + /* We have finished with all our initializations. Let's now let the manager know that. From this point + * on, if the manager sees POLLHUP on the exec_fd, then execve() was successful. */ + + if (write(exec_fd, &hot, sizeof(hot)) < 0) { + *exit_status = EXIT_EXEC; + return log_exec_error_errno(context, params, errno, "Failed to enable exec_fd: %m"); + } + } + + r = fexecve_or_execve(executable_fd, executable, final_argv, accum_env); + + if (exec_fd >= 0) { + uint8_t hot = 0; + + /* The execve() failed. This means the exec_fd is still open. Which means we need to tell the manager + * that POLLHUP on it no longer means execve() succeeded. */ + + if (write(exec_fd, &hot, sizeof(hot)) < 0) { + *exit_status = EXIT_EXEC; + return log_exec_error_errno(context, params, errno, "Failed to disable exec_fd: %m"); + } + } + + *exit_status = EXIT_EXEC; + return log_exec_error_errno(context, params, r, "Failed to execute %s: %m", executable); +} diff --git a/src/core/exec-invoke.h b/src/core/exec-invoke.h new file mode 100644 index 0000000000..a8a3ac6e56 --- /dev/null +++ b/src/core/exec-invoke.h @@ -0,0 +1,16 @@ +/* SPDX-License-Identifier: LGPL-2.1-or-later */ +#pragma once + +typedef struct ExecCommand ExecCommand; +typedef struct ExecContext ExecContext; +typedef struct ExecParameters ExecParameters; +typedef struct ExecRuntime ExecRuntime; +typedef struct CGroupContext CGroupContext; + +int exec_invoke( + const ExecCommand *command, + const ExecContext *context, + ExecParameters *params, + ExecRuntime *runtime, + const CGroupContext *cgroup_context, + int *exit_status); diff --git a/src/core/execute-serialize.c b/src/core/execute-serialize.c new file mode 100644 index 0000000000..0d9204fc14 --- /dev/null +++ b/src/core/execute-serialize.c @@ -0,0 +1,4084 @@ +/* SPDX-License-Identifier: LGPL-2.1-or-later */ + +#include "af-list.h" +#include "capability-util.h" +#include "cgroup-setup.h" +#include "escape.h" +#include "exec-credential.h" +#include "execute-serialize.h" +#include "hexdecoct.h" +#include "fd-util.h" +#include "fileio.h" +#include "in-addr-prefix-util.h" +#include "parse-helpers.h" +#include "parse-util.h" +#include "percent-util.h" +#include "process-util.h" +#include "rlimit-util.h" +#include "serialize.h" +#include "string-util.h" +#include "strv.h" + +static int exec_cgroup_context_serialize(const CGroupContext *c, FILE *f) { + _cleanup_free_ char *disable_controllers_str = NULL, *delegate_controllers_str = NULL, + *cpuset_cpus = NULL, *cpuset_mems = NULL, *startup_cpuset_cpus = NULL, + *startup_cpuset_mems = NULL; + char *iface; + struct in_addr_prefix *iaai; + int r; + + assert(f); + + if (!c) + return 0; + + r = serialize_bool_elide(f, "exec-cgroup-context-cpu-accounting", c->cpu_accounting); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-io-accounting", c->io_accounting); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-block-io-accounting", c->blockio_accounting); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-memory-accounting", c->memory_accounting); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-tasks-accounting", c->tasks_accounting); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-ip-accounting", c->ip_accounting); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-memory-oom-group", c->memory_oom_group); + if (r < 0) + return r; + + if (c->cpu_weight != CGROUP_WEIGHT_INVALID) { + r = serialize_item_format(f, "exec-cgroup-context-cpu-weight", "%" PRIu64, c->cpu_weight); + if (r < 0) + return r; + } + + if (c->startup_cpu_weight != CGROUP_WEIGHT_INVALID) { + r = serialize_item_format(f, "exec-cgroup-context-startup-cpu-weight", "%" PRIu64, c->startup_cpu_weight); + if (r < 0) + return r; + } + + if (c->cpu_shares != CGROUP_CPU_SHARES_INVALID) { + r = serialize_item_format(f, "exec-cgroup-context-cpu-shares", "%" PRIu64, c->cpu_shares); + if (r < 0) + return r; + } + + if (c->startup_cpu_shares != CGROUP_CPU_SHARES_INVALID) { + r = serialize_item_format(f, "exec-cgroup-context-startup-cpu-shares", "%" PRIu64, c->startup_cpu_shares); + if (r < 0) + return r; + } + + if (c->cpu_quota_per_sec_usec != USEC_INFINITY) { + r = serialize_usec(f, "exec-cgroup-context-cpu-quota-per-sec-usec", c->cpu_quota_per_sec_usec); + if (r < 0) + return r; + } + + if (c->cpu_quota_period_usec != USEC_INFINITY) { + r = serialize_usec(f, "exec-cgroup-context-cpu-quota-period-usec", c->cpu_quota_period_usec); + if (r < 0) + return r; + } + + cpuset_cpus = cpu_set_to_range_string(&c->cpuset_cpus); + if (!cpuset_cpus) + return log_oom_debug(); + + r = serialize_item(f, "exec-cgroup-context-allowed-cpus", cpuset_cpus); + if (r < 0) + return r; + + startup_cpuset_cpus = cpu_set_to_range_string(&c->startup_cpuset_cpus); + if (!startup_cpuset_cpus) + return log_oom_debug(); + + r = serialize_item(f, "exec-cgroup-context-startup-allowed-cpus", startup_cpuset_cpus); + if (r < 0) + return r; + + cpuset_mems = cpu_set_to_range_string(&c->cpuset_mems); + if (!cpuset_mems) + return log_oom_debug(); + + r = serialize_item(f, "exec-cgroup-context-allowed-memory-nodes", cpuset_mems); + if (r < 0) + return r; + + startup_cpuset_mems = cpu_set_to_range_string(&c->startup_cpuset_mems); + if (!startup_cpuset_mems) + return log_oom_debug(); + + r = serialize_item(f, "exec-cgroup-context-startup-allowed-memory-nodes", startup_cpuset_mems); + if (r < 0) + return r; + + if (c->io_weight != CGROUP_WEIGHT_INVALID) { + r = serialize_item_format(f, "exec-cgroup-context-io-weight", "%" PRIu64, c->io_weight); + if (r < 0) + return r; + } + + if (c->startup_io_weight != CGROUP_WEIGHT_INVALID) { + r = serialize_item_format(f, "exec-cgroup-context-startup-io-weight", "%" PRIu64, c->startup_io_weight); + if (r < 0) + return r; + } + + if (c->blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID) { + r = serialize_item_format(f, "exec-cgroup-context-block-io-weight", "%" PRIu64, c->blockio_weight); + if (r < 0) + return r; + } + + if (c->startup_blockio_weight != CGROUP_BLKIO_WEIGHT_INVALID) { + r = serialize_item_format(f, "exec-cgroup-context-startup-block-io-weight", "%" PRIu64, c->startup_blockio_weight); + if (r < 0) + return r; + } + + if (c->default_memory_min > 0) { + r = serialize_item_format(f, "exec-cgroup-context-default-memory-min", "%" PRIu64, c->default_memory_min); + if (r < 0) + return r; + } + + if (c->default_memory_low > 0) { + r = serialize_item_format(f, "exec-cgroup-context-default-memory-low", "%" PRIu64, c->default_memory_low); + if (r < 0) + return r; + } + + if (c->memory_min > 0) { + r = serialize_item_format(f, "exec-cgroup-context-memory-min", "%" PRIu64, c->memory_min); + if (r < 0) + return r; + } + + if (c->memory_low > 0) { + r = serialize_item_format(f, "exec-cgroup-context-memory-low", "%" PRIu64, c->memory_low); + if (r < 0) + return r; + } + + if (c->startup_memory_low > 0) { + r = serialize_item_format(f, "exec-cgroup-context-startup-memory-low", "%" PRIu64, c->startup_memory_low); + if (r < 0) + return r; + } + + if (c->memory_high != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-memory-high", "%" PRIu64, c->memory_high); + if (r < 0) + return r; + } + + if (c->startup_memory_high != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-startup-memory-high", "%" PRIu64, c->startup_memory_high); + if (r < 0) + return r; + } + + if (c->memory_max != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-memory-max", "%" PRIu64, c->memory_max); + if (r < 0) + return r; + } + + if (c->startup_memory_max != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-startup-memory-max", "%" PRIu64, c->startup_memory_max); + if (r < 0) + return r; + } + + if (c->memory_swap_max != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-memory-swap-max", "%" PRIu64, c->memory_swap_max); + if (r < 0) + return r; + } + + if (c->startup_memory_swap_max != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-startup-memory-swap-max", "%" PRIu64, c->startup_memory_swap_max); + if (r < 0) + return r; + } + + if (c->memory_zswap_max != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-memory-zswap-max", "%" PRIu64, c->memory_zswap_max); + if (r < 0) + return r; + } + + if (c->startup_memory_zswap_max != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-startup-memory-zswap-max", "%" PRIu64, c->startup_memory_zswap_max); + if (r < 0) + return r; + } + + if (c->memory_limit != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-memory-limit", "%" PRIu64, c->memory_limit); + if (r < 0) + return r; + } + + if (c->tasks_max.value != UINT64_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-tasks-max-value", "%" PRIu64, c->tasks_max.value); + if (r < 0) + return r; + } + + if (c->tasks_max.scale > 0) { + r = serialize_item_format(f, "exec-cgroup-context-tasks-max-scale", "%" PRIu64, c->tasks_max.scale); + if (r < 0) + return r; + } + + r = serialize_bool_elide(f, "exec-cgroup-context-default-memory-min-set", c->default_memory_min_set); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-default-memory-low-set", c->default_memory_low_set); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-default-startup-memory-low-set", c->default_startup_memory_low_set); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-memory-min-set", c->memory_min_set); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-memory-low-set", c->memory_low_set); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-startup-memory-low-set", c->startup_memory_low_set); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-startup-memory-high-set", c->startup_memory_high_set); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-startup-memory-max-set", c->startup_memory_max_set); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-startup-memory-swap-max-set", c->startup_memory_swap_max_set); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-startup-memory-zswap-max-set", c->startup_memory_zswap_max_set); + if (r < 0) + return r; + + r = serialize_item(f, "exec-cgroup-context-device-policy", cgroup_device_policy_to_string(c->device_policy)); + if (r < 0) + return r; + + r = cg_mask_to_string(c->disable_controllers, &disable_controllers_str); + if (r < 0) + return r; + + r = serialize_item(f, "exec-cgroup-context-disable-controllers", disable_controllers_str); + if (r < 0) + return r; + + r = cg_mask_to_string(c->delegate_controllers, &delegate_controllers_str); + if (r < 0) + return r; + + r = serialize_item(f, "exec-cgroup-context-delegate-controllers", delegate_controllers_str); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-delegate", c->delegate); + if (r < 0) + return r; + + r = serialize_item(f, "exec-cgroup-context-managed-oom-swap", managed_oom_mode_to_string(c->moom_swap)); + if (r < 0) + return r; + + r = serialize_item(f, "exec-cgroup-context-managed-oom-memory-pressure", managed_oom_mode_to_string(c->moom_mem_pressure)); + if (r < 0) + return r; + + r = serialize_item_format(f, "exec-cgroup-context-managed-oom-memory-pressure-limit", "%" PRIu32, c->moom_mem_pressure_limit); + if (r < 0) + return r; + + r = serialize_item(f, "exec-cgroup-context-managed-oom-preference", managed_oom_preference_to_string(c->moom_preference)); + if (r < 0) + return r; + + r = serialize_item(f, "exec-cgroup-context-memory-pressure-watch", cgroup_pressure_watch_to_string(c->memory_pressure_watch)); + if (r < 0) + return r; + + r = serialize_item(f, "exec-cgroup-context-delegate-subgroup", c->delegate_subgroup); + if (r < 0) + return r; + + if (c->memory_pressure_threshold_usec != USEC_INFINITY) { + r = serialize_usec(f, "exec-cgroup-context-memory-pressure-threshold-usec", c->memory_pressure_threshold_usec); + if (r < 0) + return r; + } + + LIST_FOREACH(device_allow, a, c->device_allow) { + r = serialize_item_format(f, "exec-cgroup-context-device-allow", "%s %s%s%s", + a->path, + a->r ? "r" : "", a->w ? "w" : "", a->m ? "m" : ""); + if (r < 0) + return r; + } + + LIST_FOREACH(device_weights, iw, c->io_device_weights) { + r = serialize_item_format(f, "exec-cgroup-context-io-device-weight", "%s %" PRIu64, + iw->path, + iw->weight); + if (r < 0) + return r; + } + + LIST_FOREACH(device_latencies, l, c->io_device_latencies) { + r = serialize_item_format(f, "exec-cgroup-context-io-device-latency-target-usec", "%s " USEC_FMT, + l->path, + l->target_usec); + if (r < 0) + return r; + } + + LIST_FOREACH(device_limits, il, c->io_device_limits) + for (CGroupIOLimitType type = 0; type < _CGROUP_IO_LIMIT_TYPE_MAX; type++) { + _cleanup_free_ char *key = NULL; + + if (il->limits[type] == cgroup_io_limit_defaults[type]) + continue; + + key = strjoin("exec-cgroup-context-io-device-limit-", + cgroup_io_limit_type_to_string(type)); + if (!key) + return -ENOMEM; + + r = serialize_item_format(f, key, "%s %" PRIu64, il->path, il->limits[type]); + if (r < 0) + return r; + } + + LIST_FOREACH(device_weights, w, c->blockio_device_weights) { + r = serialize_item_format(f, "exec-cgroup-context-blockio-device-weight", "%s %" PRIu64, + w->path, + w->weight); + if (r < 0) + return r; + } + + LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths) { + if (b->rbps != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-blockio-read-bandwidth", "%s %" PRIu64, + b->path, + b->rbps); + if (r < 0) + return r; + } + if (b->wbps != CGROUP_LIMIT_MAX) { + r = serialize_item_format(f, "exec-cgroup-context-blockio-write-bandwidth", "%s %" PRIu64, + b->path, + b->wbps); + if (r < 0) + return r; + } + } + + SET_FOREACH(iaai, c->ip_address_allow) { + r = serialize_item(f, + "exec-cgroup-context-ip-address-allow", + IN_ADDR_PREFIX_TO_STRING(iaai->family, &iaai->address, iaai->prefixlen)); + if (r < 0) + return r; + } + SET_FOREACH(iaai, c->ip_address_deny) { + r = serialize_item(f, + "exec-cgroup-context-ip-address-deny", + IN_ADDR_PREFIX_TO_STRING(iaai->family, &iaai->address, iaai->prefixlen)); + if (r < 0) + return r; + } + + r = serialize_bool_elide(f, "exec-cgroup-context-ip-address-allow-reduced", c->ip_address_allow_reduced); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-cgroup-context-ip-address-deny-reduced", c->ip_address_deny_reduced); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-cgroup-context-ip-ingress-filter-path=", c->ip_filters_ingress); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-cgroup-context-ip-egress-filter-path=", c->ip_filters_egress); + if (r < 0) + return r; + + LIST_FOREACH(programs, p, c->bpf_foreign_programs) { + r = serialize_item_format(f, "exec-cgroup-context-bpf-program", "%" PRIu32 " %s", + p->attach_type, + p->bpffs_path); + if (r < 0) + return r; + } + + LIST_FOREACH(socket_bind_items, bi, c->socket_bind_allow) { + fprintf(f, "exec-cgroup-context-socket-bind-allow="); + cgroup_context_dump_socket_bind_item(bi, f); + fputc('\n', f); + } + + LIST_FOREACH(socket_bind_items, bi, c->socket_bind_deny) { + fprintf(f, "exec-cgroup-context-socket-bind-deny="); + cgroup_context_dump_socket_bind_item(bi, f); + fputc('\n', f); + } + + SET_FOREACH(iface, c->restrict_network_interfaces) { + r = serialize_item(f, "exec-cgroup-context-restrict-network-interfaces", iface); + if (r < 0) + return r; + } + + r = serialize_bool_elide( + f, + "exec-cgroup-context-restrict-network-interfaces-is-allow-list", + c->restrict_network_interfaces_is_allow_list); + if (r < 0) + return r; + + fputc('\n', f); /* End marker */ + + return 0; +} + +static int exec_cgroup_context_deserialize(CGroupContext *c, FILE *f) { + int r; + + assert(f); + + if (!c) + return 0; + + for (;;) { + _cleanup_free_ char *l = NULL; + const char *val; + + r = deserialize_read_line(f, &l); + if (r < 0) + return r; + if (r == 0) /* eof or end marker */ + break; + + if ((val = startswith(l, "exec-cgroup-context-cpu-accounting="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->cpu_accounting = r; + } else if ((val = startswith(l, "exec-cgroup-context-io-accounting="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->io_accounting = r; + } else if ((val = startswith(l, "exec-cgroup-context-block-io-accounting="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->blockio_accounting = r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-accounting="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->memory_accounting = r; + } else if ((val = startswith(l, "exec-cgroup-context-tasks-accounting="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->tasks_accounting = r; + } else if ((val = startswith(l, "exec-cgroup-context-ip-accounting="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->ip_accounting = r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-oom-group="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->memory_oom_group = r; + } else if ((val = startswith(l, "exec-cgroup-context-cpu-weight="))) { + r = safe_atou64(val, &c->cpu_weight); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-cpu-weight="))) { + r = safe_atou64(val, &c->startup_cpu_weight); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-cpu-shares="))) { + r = safe_atou64(val, &c->cpu_shares); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-cpu-shares="))) { + r = safe_atou64(val, &c->startup_cpu_shares); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-cpu-quota-per-sec-usec="))) { + r = deserialize_usec(val, &c->cpu_quota_per_sec_usec); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-cpu-quota-period-usec="))) { + r = deserialize_usec(val, &c->cpu_quota_period_usec); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-allowed-cpus="))) { + if (c->cpuset_cpus.set) + return -EINVAL; /* duplicated */ + + r = parse_cpu_set_full( + val, + &c->cpuset_cpus, + /* warn= */ false, + /* unit= */ NULL, + /* filename= */ NULL, + /* line= */ 0, + /* lvalue= */ NULL); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-allowed-cpus="))) { + if (c->startup_cpuset_cpus.set) + return -EINVAL; /* duplicated */ + + r = parse_cpu_set_full( + val, + &c->startup_cpuset_cpus, + /* warn= */ false, + /* unit= */ NULL, + /* filename= */ NULL, + /* line= */ 0, + /* lvalue= */ NULL); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-allowed-memory-nodes="))) { + if (c->cpuset_mems.set) + return -EINVAL; /* duplicated */ + + r = parse_cpu_set_full( + val, + &c->cpuset_mems, + /* warn= */ false, + /* unit= */ NULL, + /* filename= */ NULL, + /* line= */ 0, + /* lvalue= */ NULL); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-allowed-memory-nodes="))) { + if (c->startup_cpuset_mems.set) + return -EINVAL; /* duplicated */ + + r = parse_cpu_set_full( + val, + &c->startup_cpuset_mems, + /* warn= */ false, + /* unit= */ NULL, + /* filename= */ NULL, + /* line= */ 0, + /* lvalue= */ NULL); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-io-weight="))) { + r = safe_atou64(val, &c->io_weight); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-io-weight="))) { + r = safe_atou64(val, &c->startup_io_weight); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-block-io-weight="))) { + r = safe_atou64(val, &c->blockio_weight); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-block-io-weight="))) { + r = safe_atou64(val, &c->startup_blockio_weight); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-default-memory-min="))) { + r = safe_atou64(val, &c->default_memory_min); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-default-memory-low="))) { + r = safe_atou64(val, &c->default_memory_low); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-min="))) { + r = safe_atou64(val, &c->memory_min); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-low="))) { + r = safe_atou64(val, &c->memory_low); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-memory-low="))) { + r = safe_atou64(val, &c->startup_memory_low); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-high="))) { + r = safe_atou64(val, &c->memory_high); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-memory-high="))) { + r = safe_atou64(val, &c->startup_memory_high); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-max="))) { + r = safe_atou64(val, &c->memory_max); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-memory-max="))) { + r = safe_atou64(val, &c->startup_memory_max); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-swap-max="))) { + r = safe_atou64(val, &c->memory_swap_max); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-memory-swap-max="))) { + r = safe_atou64(val, &c->startup_memory_swap_max); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-zswap-max="))) { + r = safe_atou64(val, &c->memory_zswap_max); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-memory-zswap-max="))) { + r = safe_atou64(val, &c->startup_memory_zswap_max); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-limit="))) { + r = safe_atou64(val, &c->memory_limit); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-tasks-max-value="))) { + r = safe_atou64(val, &c->tasks_max.value); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-tasks-max-scale="))) { + r = safe_atou64(val, &c->tasks_max.scale); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-default-memory-min-set="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->default_memory_min_set = r; + } else if ((val = startswith(l, "exec-cgroup-context-default-memory-low-set="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->default_memory_low_set = r; + } else if ((val = startswith(l, "exec-cgroup-context-default-startup-memory-low-set="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->default_startup_memory_low_set = r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-min-set="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->memory_min_set = r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-low-set="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->memory_low_set = r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-memory-low-set="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->startup_memory_low_set = r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-memory-high-set="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->startup_memory_high_set = r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-memory-max-set="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->startup_memory_max_set = r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-memory-swap-max-set="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->startup_memory_swap_max_set = r; + } else if ((val = startswith(l, "exec-cgroup-context-startup-memory-zswap-max-set="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->startup_memory_zswap_max_set = r; + } else if ((val = startswith(l, "exec-cgroup-context-device-policy="))) { + c->device_policy = cgroup_device_policy_from_string(val); + if (c->device_policy < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-cgroup-context-disable-controllers="))) { + r = cg_mask_from_string(val, &c->disable_controllers); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-delegate-controllers="))) { + r = cg_mask_from_string(val, &c->delegate_controllers); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-delegate="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->delegate = r; + } else if ((val = startswith(l, "exec-cgroup-context-managed-oom-swap="))) { + c->moom_swap = managed_oom_mode_from_string(val); + if (c->moom_swap < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-cgroup-context-managed-oom-memory-pressure="))) { + c->moom_mem_pressure = managed_oom_mode_from_string(val); + if (c->moom_mem_pressure < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-cgroup-context-managed-oom-memory-pressure-limit="))) { + r = safe_atou32(val, &c->moom_mem_pressure_limit); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-managed-oom-preference="))) { + c->moom_preference = managed_oom_preference_from_string(val); + if (c->moom_preference < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-cgroup-context-memory-pressure-watch="))) { + c->memory_pressure_watch = cgroup_pressure_watch_from_string(val); + if (c->memory_pressure_watch < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-cgroup-context-delegate-subgroup="))) { + r = free_and_strdup(&c->delegate_subgroup, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-memory-pressure-threshold-usec="))) { + r = deserialize_usec(val, &c->memory_pressure_threshold_usec); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-device-allow="))) { + _cleanup_free_ char *path = NULL, *rwm = NULL; + + r = extract_many_words(&val, " ", 0, &path, &rwm, NULL); + if (r < 0) + return r; + if (r == 0) + return -EINVAL; + if (!isempty(rwm) && !in_charset(rwm, "rwm")) + return -EINVAL; + + r = cgroup_context_add_or_update_device_allow(c, path, rwm); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-io-device-weight="))) { + _cleanup_free_ char *path = NULL, *weight = NULL; + CGroupIODeviceWeight *a = NULL; + + r = extract_many_words(&val, " ", 0, &path, &weight, NULL); + if (r < 0) + return r; + if (r != 2) + return -EINVAL; + + LIST_FOREACH(device_weights, b, c->io_device_weights) + if (path_equal(b->path, path)) { + a = b; + break; + } + + if (!a) { + a = new0(CGroupIODeviceWeight, 1); + if (!a) + return log_oom_debug(); + + a->path = TAKE_PTR(path); + + LIST_PREPEND(device_weights, c->io_device_weights, a); + } + + r = safe_atou64(weight, &a->weight); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-io-device-latency-target-usec="))) { + _cleanup_free_ char *path = NULL, *target = NULL; + CGroupIODeviceLatency *a = NULL; + + r = extract_many_words(&val, " ", 0, &path, &target, NULL); + if (r < 0) + return r; + if (r != 2) + return -EINVAL; + + LIST_FOREACH(device_latencies, b, c->io_device_latencies) + if (path_equal(b->path, path)) { + a = b; + break; + } + + if (!a) { + a = new0(CGroupIODeviceLatency, 1); + if (!a) + return log_oom_debug(); + + a->path = TAKE_PTR(path); + + LIST_PREPEND(device_latencies, c->io_device_latencies, a); + } + + r = deserialize_usec(target, &a->target_usec); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-io-device-limit-"))) { + _cleanup_free_ char *type = NULL, *path = NULL, *limits = NULL; + CGroupIODeviceLimit *limit = NULL; + CGroupIOLimitType t; + + r = extract_many_words(&val, "= ", 0, &type, &path, &limits, NULL); + if (r < 0) + return r; + if (r != 3) + return -EINVAL; + + t = cgroup_io_limit_type_from_string(type); + if (t < 0) + return t; + + LIST_FOREACH(device_limits, i, c->io_device_limits) + if (path_equal(path, i->path)) { + limit = i; + break; + } + + if (!limit) { + limit = new0(CGroupIODeviceLimit, 1); + if (!limit) + return log_oom_debug(); + + limit->path = TAKE_PTR(path); + for (CGroupIOLimitType i = 0; i < _CGROUP_IO_LIMIT_TYPE_MAX; i++) + limit->limits[i] = cgroup_io_limit_defaults[i]; + + LIST_PREPEND(device_limits, c->io_device_limits, limit); + } + + r = safe_atou64(limits, &limit->limits[t]); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-block-io-device-weight="))) { + _cleanup_free_ char *path = NULL, *weight = NULL; + CGroupBlockIODeviceWeight *a = NULL; + + r = extract_many_words(&val, " ", 0, &path, &weight, NULL); + if (r < 0) + return r; + if (r != 2) + return -EINVAL; + + a = new0(CGroupBlockIODeviceWeight, 1); + if (!a) + return log_oom_debug(); + + a->path = TAKE_PTR(path); + + LIST_PREPEND(device_weights, c->blockio_device_weights, a); + + r = safe_atou64(weight, &a->weight); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-block-io-read-bandwidth="))) { + _cleanup_free_ char *path = NULL, *bw = NULL; + CGroupBlockIODeviceBandwidth *a = NULL; + + r = extract_many_words(&val, " ", 0, &path, &bw, NULL); + if (r < 0) + return r; + if (r != 2) + return -EINVAL; + + LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths) + if (path_equal(b->path, path)) { + a = b; + break; + } + + if (!a) { + a = new0(CGroupBlockIODeviceBandwidth, 1); + if (!a) + return log_oom_debug(); + + a->path = TAKE_PTR(path); + a->wbps = CGROUP_LIMIT_MAX; + + LIST_PREPEND(device_bandwidths, c->blockio_device_bandwidths, a); + } + + r = safe_atou64(bw, &a->rbps); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-block-io-write-bandwidth="))) { + _cleanup_free_ char *path = NULL, *bw = NULL; + CGroupBlockIODeviceBandwidth *a = NULL; + + r = extract_many_words(&val, " ", 0, &path, &bw, NULL); + if (r < 0) + return r; + if (r != 2) + return -EINVAL; + + LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths) + if (path_equal(b->path, path)) { + a = b; + break; + } + + if (!a) { + a = new0(CGroupBlockIODeviceBandwidth, 1); + if (!a) + return log_oom_debug(); + + a->path = TAKE_PTR(path); + a->rbps = CGROUP_LIMIT_MAX; + + LIST_PREPEND(device_bandwidths, c->blockio_device_bandwidths, a); + } + + r = safe_atou64(bw, &a->wbps); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-ip-address-allow="))) { + struct in_addr_prefix a; + + r = in_addr_prefix_from_string_auto(val, &a.family, &a.address, &a.prefixlen); + if (r < 0) + return r; + + r = in_addr_prefix_add(&c->ip_address_allow, &a); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-ip-address-deny="))) { + struct in_addr_prefix a; + + r = in_addr_prefix_from_string_auto(val, &a.family, &a.address, &a.prefixlen); + if (r < 0) + return r; + + r = in_addr_prefix_add(&c->ip_address_deny, &a); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-ip-address-allow-reduced="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->ip_address_allow_reduced = r; + } else if ((val = startswith(l, "exec-cgroup-context-ip-address-deny-reduced="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->ip_address_deny_reduced = r; + } else if ((val = startswith(l, "exec-cgroup-context-ip-ingress-filter-path="))) { + r = deserialize_strv(&c->ip_filters_ingress, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-ip-egress-filter-path="))) { + r = deserialize_strv(&c->ip_filters_egress, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-bpf-program="))) { + _cleanup_free_ char *type = NULL, *path = NULL; + uint32_t t; + + r = extract_many_words(&val, " ", 0, &type, &path, NULL); + if (r < 0) + return r; + if (r != 2) + return -EINVAL; + + r = safe_atou32(type, &t); + if (r < 0) + return r; + + r = cgroup_context_add_bpf_foreign_program(c, t, path); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-socket-bind-allow="))) { + CGroupSocketBindItem *item; + uint16_t nr_ports, port_min; + int af, ip_protocol; + + r = parse_socket_bind_item(val, &af, &ip_protocol, &nr_ports, &port_min); + if (r < 0) + return r; + + item = new(CGroupSocketBindItem, 1); + if (!item) + return log_oom_debug(); + *item = (CGroupSocketBindItem) { + .address_family = af, + .ip_protocol = ip_protocol, + .nr_ports = nr_ports, + .port_min = port_min, + }; + + LIST_PREPEND(socket_bind_items, c->socket_bind_allow, item); + } else if ((val = startswith(l, "exec-cgroup-context-socket-bind-deny="))) { + CGroupSocketBindItem *item; + uint16_t nr_ports, port_min; + int af, ip_protocol; + + r = parse_socket_bind_item(val, &af, &ip_protocol, &nr_ports, &port_min); + if (r < 0) + return r; + + item = new(CGroupSocketBindItem, 1); + if (!item) + return log_oom_debug(); + *item = (CGroupSocketBindItem) { + .address_family = af, + .ip_protocol = ip_protocol, + .nr_ports = nr_ports, + .port_min = port_min, + }; + + LIST_PREPEND(socket_bind_items, c->socket_bind_deny, item); + } else if ((val = startswith(l, "exec-cgroup-context-restrict-network-interfaces="))) { + r = set_ensure_allocated(&c->restrict_network_interfaces, &string_hash_ops); + if (r < 0) + return r; + + r = set_put_strdup(&c->restrict_network_interfaces, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-cgroup-context-restrict-network-interfaces-is-allow-list="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->restrict_network_interfaces_is_allow_list = r; + } else + log_warning("Failed to parse serialized line, ignorning: %s", l); + } + + return 0; +} + +static int exec_runtime_serialize(const ExecRuntime *rt, FILE *f, FDSet *fds) { + int r; + + assert(f); + assert(fds); + + if (!rt) { + fputc('\n', f); /* End marker */ + return 0; + } + + if (rt->shared) { + r = serialize_item(f, "exec-runtime-id", rt->shared->id); + if (r < 0) + return r; + + r = serialize_item(f, "exec-runtime-tmp-dir", rt->shared->tmp_dir); + if (r < 0) + return r; + + r = serialize_item(f, "exec-runtime-var-tmp-dir", rt->shared->var_tmp_dir); + if (r < 0) + return r; + + if (rt->shared->netns_storage_socket[0] >= 0 && rt->shared->netns_storage_socket[1] >= 0) { + int a, b; + + a = fdset_put_dup(fds, rt->shared->netns_storage_socket[0]); + if (a < 0) + return a; + + b = fdset_put_dup(fds, rt->shared->netns_storage_socket[1]); + if (b < 0) + return b; + + r = serialize_item_format(f, "exec-runtime-netns-storage-socket", "%d %d", a, b); + if (r < 0) + return r; + } + + if (rt->shared->ipcns_storage_socket[0] >= 0 && rt->shared->ipcns_storage_socket[1] >= 0) { + int a, b; + + a = fdset_put_dup(fds, rt->shared->ipcns_storage_socket[0]); + if (a < 0) + return a; + + b = fdset_put_dup(fds, rt->shared->ipcns_storage_socket[1]); + if (b < 0) + return b; + + r = serialize_item_format(f, "exec-runtime-ipcns-storage-socket", "%d %d", a, b); + if (r < 0) + return r; + } + } + + if (rt->dynamic_creds) { + r = dynamic_user_serialize_one(rt->dynamic_creds->user, "exec-runtime-dynamic-creds-user", f, fds); + if (r < 0) + return r; + } + + if (rt->dynamic_creds && rt->dynamic_creds->group && rt->dynamic_creds->group == rt->dynamic_creds->user) { + r = serialize_bool(f, "exec-runtime-dynamic-creds-group-copy", true); + if (r < 0) + return r; + } else if (rt->dynamic_creds) { + r = dynamic_user_serialize_one(rt->dynamic_creds->group, "exec-runtime-dynamic-creds-group", f, fds); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-runtime-ephemeral-copy", rt->ephemeral_copy); + if (r < 0) + return r; + + if (rt->ephemeral_storage_socket[0] >= 0 && rt->ephemeral_storage_socket[1] >= 0) { + int a, b; + + a = fdset_put_dup(fds, rt->ephemeral_storage_socket[0]); + if (a < 0) + return a; + + b = fdset_put_dup(fds, rt->ephemeral_storage_socket[1]); + if (b < 0) + return b; + + r = serialize_item_format(f, "exec-runtime-ephemeral-storage-socket", "%d %d", a, b); + if (r < 0) + return r; + } + + fputc('\n', f); /* End marker */ + + return 0; +} + +static int exec_runtime_deserialize(ExecRuntime *rt, FILE *f, FDSet *fds) { + int r; + + assert(rt); + assert(rt->shared); + assert(rt->dynamic_creds); + assert(f); + assert(fds); + + for (;;) { + _cleanup_free_ char *l = NULL; + const char *val; + + r = deserialize_read_line(f, &l); + if (r < 0) + return r; + if (r == 0) /* eof or end marker */ + break; + + if ((val = startswith(l, "exec-runtime-id="))) { + r = free_and_strdup(&rt->shared->id, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-runtime-tmp-dir="))) { + r = free_and_strdup(&rt->shared->tmp_dir, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-runtime-var-tmp-dir="))) { + r = free_and_strdup(&rt->shared->var_tmp_dir, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-runtime-netns-storage-socket="))) { + for (size_t i = 0; i < 2; ++i) { + _cleanup_free_ char *w = NULL; + int fd; + + r = extract_first_word(&val, &w, WHITESPACE, 0); + if (r < 0) + return r; + if (r == 0) + break; + + if ((fd = parse_fd(w)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, w); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + rt->shared->netns_storage_socket[i] = fd; + } + } + } else if ((val = startswith(l, "exec-runtime-ipcns-storage-socket="))) { + for (size_t i = 0; i < 2; ++i) { + _cleanup_free_ char *w = NULL; + int fd; + + r = extract_first_word(&val, &w, WHITESPACE, 0); + if (r < 0) + return r; + if (r == 0) + break; + + if ((fd = parse_fd(w)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, w); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + rt->shared->ipcns_storage_socket[i] = fd; + } + } + } else if ((val = startswith(l, "exec-runtime-dynamic-creds-user="))) + dynamic_user_deserialize_one(/* m= */ NULL, val, fds, &rt->dynamic_creds->user); + else if ((val = startswith(l, "exec-runtime-dynamic-creds-group="))) + dynamic_user_deserialize_one(/* m= */ NULL, val, fds, &rt->dynamic_creds->group); + else if ((val = startswith(l, "exec-runtime-dynamic-creds-group-copy="))) { + r = parse_boolean(val); + if (r < 0) + return r; + if (!r) + continue; /* Nothing to do */ + + if (!rt->dynamic_creds->user) + return -EINVAL; + + rt->dynamic_creds->group = dynamic_user_ref(rt->dynamic_creds->user); + } else if ((val = startswith(l, "exec-runtime-ephemeral-copy="))) { + r = free_and_strdup(&rt->ephemeral_copy, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-runtime-ephemeral-storage-socket="))) { + for (size_t i = 0; i < 2; ++i) { + _cleanup_free_ char *w = NULL; + int fd; + + r = extract_first_word(&val, &w, WHITESPACE, 0); + if (r < 0) + return r; + if (r == 0) + break; + + if ((fd = parse_fd(w)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, w); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + rt->ephemeral_storage_socket[i] = fd; + } + } + } else + log_warning("Failed to parse serialized line, ignorning: %s", l); + } + + return 0; +} + +static int exec_parameters_serialize(const ExecParameters *p, FILE *f, FDSet *fds) { + int r; + + assert(f); + assert(fds); + + if (!p) + return 0; + + r = serialize_item(f, "exec-parameters-runtime-scope", runtime_scope_to_string(p->runtime_scope)); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-parameters-environment", p->environment); + if (r < 0) + return r; + + if (p->n_socket_fds) { + r = serialize_item_format(f, "exec-parameters-n-socket-fds", "%zu", p->n_socket_fds); + if (r < 0) + return r; + } + + if (p->n_storage_fds) { + r = serialize_item_format(f, "exec-parameters-n-storage-fds", "%zu", p->n_storage_fds); + if (r < 0) + return r; + } + + if (p->n_socket_fds + p->n_storage_fds > 0) { + _cleanup_free_ char *serialized_fds = NULL; + + if (!p->fds) + return -EINVAL; + + for (size_t i = 0; i < p->n_socket_fds + p->n_storage_fds; ++i) { + int copy = -EBADF; + + if (p->fds[i] >= 0) { + copy = fdset_put_dup(fds, p->fds[i]); + if (copy < 0) + return copy; + } + + r = strextendf(&serialized_fds, "%d ", copy); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-parameters-fds", serialized_fds); + if (r < 0) + return r; + } + + r = serialize_strv(f, "exec-parameters-fd-names", p->fd_names); + if (r < 0) + return r; + + if (p->flags != 0) { + r = serialize_item_format(f, "exec-parameters-flags", "%u", (unsigned) p->flags); + if (r < 0) + return r; + } + + r = serialize_bool_elide(f, "exec-parameters-selinux-context-net", p->selinux_context_net); + if (r < 0) + return r; + + if (p->cgroup_supported != 0) { + r = serialize_item_format(f, "exec-parameters-cgroup-supported", "%u", (unsigned) p->cgroup_supported); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-parameters-cgroup-path", p->cgroup_path); + if (r < 0) + return r; + + r = serialize_item_format(f, "exec-parameters-cgroup-id", "%" PRIu64, p->cgroup_id); + if (r < 0) + return r; + + for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) { + _cleanup_free_ char *key = NULL; + + key = strjoin("exec-parameters-prefix-directories-", exec_directory_type_to_string(dt)); + if (!key) + return log_oom_debug(); + + /* Always serialize, even an empty prefix, as this is a fixed array and we always expect + * to have all elements (unless fuzzing is happening, hence the NULL check). */ + r = serialize_item(f, key, strempty(p->prefix ? p->prefix[dt] : NULL)); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-parameters-received-credentials-directory", p->received_credentials_directory); + if (r < 0) + return r; + + r = serialize_item(f, "exec-parameters-received-encrypted-credentials-directory", p->received_encrypted_credentials_directory); + if (r < 0) + return r; + + r = serialize_item(f, "exec-parameters-confirm-spawn", p->confirm_spawn); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-parameters-shall-confirm-spawn", p->shall_confirm_spawn); + if (r < 0) + return r; + + if (p->watchdog_usec > 0) { + r = serialize_usec(f, "exec-parameters-watchdog-usec", p->watchdog_usec); + if (r < 0) + return r; + } + + if (p->idle_pipe) { + _cleanup_free_ char *serialized_fds = NULL; + + for (size_t i = 0; i < 4; ++i) { + int copy = -EBADF; + + if (p->idle_pipe[i] >= 0) { + copy = fdset_put_dup(fds, p->idle_pipe[i]); + if (copy < 0) + return copy; + } + + r = strextendf(&serialized_fds, "%d ", copy); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-parameters-idle-pipe", serialized_fds); + if (r < 0) + return r; + } + + if (p->stdin_fd >= 0) { + r = serialize_fd(f, fds, "exec-parameters-stdin-fd", p->stdin_fd); + if (r < 0) + return r; + } + + if (p->stdout_fd >= 0) { + r = serialize_fd(f, fds, "exec-parameters-stdout-fd", p->stdout_fd); + if (r < 0) + return r; + } + + if (p->stderr_fd >= 0) { + r = serialize_fd(f, fds, "exec-parameters-stderr-fd", p->stderr_fd); + if (r < 0) + return r; + } + + if (p->exec_fd >= 0) { + r = serialize_fd(f, fds, "exec-parameters-exec-fd", p->exec_fd); + if (r < 0) + return r; + } + + if (p->bpf_outer_map_fd >= 0) { + r = serialize_fd(f, fds, "exec-parameters-bpf-outer-map-fd", p->bpf_outer_map_fd); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-parameters-notify-socket", p->notify_socket); + if (r < 0) + return r; + + LIST_FOREACH(open_files, file, p->open_files) { + _cleanup_free_ char *ofs = NULL; + + r = open_file_to_string(file, &ofs); + if (r < 0) + return r; + + r = serialize_item(f, "exec-parameters-open-file", ofs); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-parameters-fallback-smack-process-label", p->fallback_smack_process_label); + if (r < 0) + return r; + + if (p->user_lookup_fd >= 0) { + r = serialize_fd(f, fds, "exec-parameters-user-lookup-fd", p->user_lookup_fd); + if (r < 0) + return r; + } + + r = serialize_strv(f, "exec-parameters-files-env", p->files_env); + if (r < 0) + return r; + + r = serialize_item(f, "exec-parameters-unit-id", p->unit_id); + if (r < 0) + return r; + + r = serialize_item(f, "exec-parameters-invocation-id-string", p->invocation_id_string); + if (r < 0) + return r; + + fputc('\n', f); /* End marker */ + + return 0; +} + +static int exec_parameters_deserialize(ExecParameters *p, FILE *f, FDSet *fds) { + int r, nr_open; + + assert(p); + assert(f); + assert(fds); + + nr_open = read_nr_open(); + if (nr_open < 3) + nr_open = HIGH_RLIMIT_NOFILE; + assert(nr_open > 0); /* For compilers/static analyzers */ + + for (;;) { + _cleanup_free_ char *l = NULL; + const char *val; + + r = deserialize_read_line(f, &l); + if (r < 0) + return r; + if (r == 0) /* eof or end marker */ + break; + + if ((val = startswith(l, "exec-parameters-runtime-scope="))) { + p->runtime_scope = runtime_scope_from_string(val); + if (p->runtime_scope < 0) + return p->runtime_scope; + } else if ((val = startswith(l, "exec-parameters-environment="))) { + r = deserialize_strv(&p->environment, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-n-socket-fds="))) { + if (p->fds) + return -EINVAL; /* Already received */ + + r = safe_atozu(val, &p->n_socket_fds); + if (r < 0) + return r; + + if (p->n_socket_fds > (size_t) nr_open) + return -EINVAL; /* too many, someone is playing games with us */ + } else if ((val = startswith(l, "exec-parameters-n-storage-fds="))) { + if (p->fds) + return -EINVAL; /* Already received */ + + r = safe_atozu(val, &p->n_storage_fds); + if (r < 0) + return r; + + if (p->n_storage_fds > (size_t) nr_open) + return -EINVAL; /* too many, someone is playing games with us */ + } else if ((val = startswith(l, "exec-parameters-fds="))) { + if (p->n_socket_fds + p->n_storage_fds == 0) + return log_warning_errno( + SYNTHETIC_ERRNO(EINVAL), + "Got exec-parameters-fds= without " + "prior exec-parameters-n-socket-fds= or exec-parameters-n-storage-fds="); + if (p->n_socket_fds + p->n_storage_fds > (size_t) nr_open) + return -EINVAL; /* too many, someone is playing games with us */ + + if (p->fds) + return -EINVAL; /* duplicated */ + + p->fds = new(int, p->n_socket_fds + p->n_storage_fds); + if (!p->fds) + return log_oom_debug(); + + /* Ensure we don't leave any FD uninitialized on error, it makes the fuzzer sad */ + for (size_t i = 0; i < p->n_socket_fds + p->n_storage_fds; ++i) + p->fds[i] = -EBADF; + + for (size_t i = 0; i < p->n_socket_fds + p->n_storage_fds; ++i) { + _cleanup_free_ char *w = NULL; + int fd; + + r = extract_first_word(&val, &w, WHITESPACE, 0); + if (r < 0) + return r; + if (r == 0) + break; + + if ((fd = parse_fd(w)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, w); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + p->fds[i] = fd; + } + } + } else if ((val = startswith(l, "exec-parameters-fd-names="))) { + r = deserialize_strv(&p->fd_names, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-flags="))) { + unsigned flags; + + r = safe_atou(val, &flags); + if (r < 0) + return r; + p->flags = flags; + } else if ((val = startswith(l, "exec-parameters-selinux-context-net="))) { + r = parse_boolean(val); + if (r < 0) + return r; + + p->selinux_context_net = r; + } else if ((val = startswith(l, "exec-parameters-cgroup-supported="))) { + unsigned cgroup_supported; + + r = safe_atou(val, &cgroup_supported); + if (r < 0) + return r; + p->cgroup_supported = cgroup_supported; + } else if ((val = startswith(l, "exec-parameters-cgroup-path="))) { + r = free_and_strdup(&p->cgroup_path, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-cgroup-id="))) { + r = safe_atou64(val, &p->cgroup_id); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-prefix-directories-"))) { + _cleanup_free_ char *type = NULL, *prefix = NULL; + ExecDirectoryType dt; + + r = extract_many_words(&val, "= ", 0, &type, &prefix, NULL); + if (r < 0) + return r; + if (r == 0) + return -EINVAL; + + dt = exec_directory_type_from_string(type); + if (dt < 0) + return -EINVAL; + + if (!p->prefix) { + p->prefix = new0(char*, _EXEC_DIRECTORY_TYPE_MAX+1); + if (!p->prefix) + return log_oom_debug(); + } + + if (isempty(prefix)) + p->prefix[dt] = mfree(p->prefix[dt]); + else + free_and_replace(p->prefix[dt], prefix); + } else if ((val = startswith(l, "exec-parameters-received-credentials-directory="))) { + r = free_and_strdup(&p->received_credentials_directory, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-received-encrypted-credentials-directory="))) { + r = free_and_strdup(&p->received_encrypted_credentials_directory, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-confirm-spawn="))) { + r = free_and_strdup(&p->confirm_spawn, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-shall-confirm-spawn="))) { + r = parse_boolean(val); + if (r < 0) + return r; + + p->shall_confirm_spawn = r; + } else if ((val = startswith(l, "exec-parameters-watchdog-usec="))) { + r = deserialize_usec(val, &p->watchdog_usec); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-idle-pipe="))) { + if (p->idle_pipe) + return -EINVAL; /* duplicated */ + + p->idle_pipe = new(int, 4); + if (!p->idle_pipe) + return log_oom_debug(); + + p->idle_pipe[0] = p->idle_pipe[1] = p->idle_pipe[2] = p->idle_pipe[3] = -EBADF; + + for (size_t i = 0; i < 4; ++i) { + _cleanup_free_ char *w = NULL; + int fd; + + r = extract_first_word(&val, &w, WHITESPACE, 0); + if (r < 0) + return r; + if (r == 0) + break; + + if ((fd = parse_fd(w)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, w); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + p->idle_pipe[i] = fd; + } + } + } else if ((val = startswith(l, "exec-parameters-stdin-fd="))) { + int fd; + + if ((fd = parse_fd(val)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, val); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + p->stdin_fd = fd; + } + } else if ((val = startswith(l, "exec-parameters-stdout-fd="))) { + int fd; + + if ((fd = parse_fd(val)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, val); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + p->stdout_fd = fd; + } + } else if ((val = startswith(l, "exec-parameters-stderr-fd="))) { + int fd; + + if ((fd = parse_fd(val)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, val); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + p->stderr_fd = fd; + } + } else if ((val = startswith(l, "exec-parameters-exec-fd="))) { + int fd; + + if ((fd = parse_fd(val)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, val); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + /* This is special and relies on close-on-exec semantics, make sure it's + * there */ + r = fd_cloexec(fd, true); + if (r < 0) + return r; + + p->exec_fd = fd; + } + } else if ((val = startswith(l, "exec-parameters-bpf-outer-map-fd="))) { + int fd; + + if ((fd = parse_fd(val)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, val); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + p->bpf_outer_map_fd = fd; + } + } else if ((val = startswith(l, "exec-parameters-notify-socket="))) { + r = free_and_strdup(&p->notify_socket, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-open-file="))) { + OpenFile *of = NULL; + + r = open_file_parse(val, &of); + if (r < 0) + return r; + + LIST_APPEND(open_files, p->open_files, of); + } else if ((val = startswith(l, "exec-parameters-fallback-smack-process-label="))) { + r = free_and_strdup(&p->fallback_smack_process_label, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-user-lookup-fd="))) { + int fd; + + if ((fd = parse_fd(val)) < 0 || !fdset_contains(fds, fd)) + log_debug("Failed to parse %s value: %s, ignoring.", l, val); + else { + r = fdset_remove(fds, fd); + if (r < 0) { + log_debug_errno(r, "Failed to remove %s value=%d from fdset, ignoring: %m", l, fd); + continue; + } + + p->user_lookup_fd = fd; + } + } else if ((val = startswith(l, "exec-parameters-files-env="))) { + r = deserialize_strv(&p->files_env, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-unit-id="))) { + r = free_and_strdup(&p->unit_id, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-parameters-invocation-id-string="))) { + if (strlen(val) > SD_ID128_STRING_MAX - 1) + return -EINVAL; + + r = sd_id128_from_string(val, &p->invocation_id); + if (r < 0) + return r; + + sd_id128_to_string(p->invocation_id, p->invocation_id_string); + } else + log_warning("Failed to parse serialized line, ignorning: %s", l); + } + + /* Bail out if we got exec-parameters-n-{socket/storage}-fds= but no corresponding + * exec-parameters-fds= */ + if (p->n_socket_fds + p->n_storage_fds > 0 && !p->fds) + return -EINVAL; + + return 0; +} + +static int serialize_std_out_err(const ExecContext *c, FILE *f, int fileno) { + char *key, *value; + const char *type; + + assert(c); + assert(f); + assert(IN_SET(fileno, STDOUT_FILENO, STDERR_FILENO)); + + type = fileno == STDOUT_FILENO ? "output" : "error"; + + switch (fileno == STDOUT_FILENO ? c->std_output : c->std_error) { + case EXEC_OUTPUT_NAMED_FD: + key = strjoina("exec-context-std-", type, "-fd-name"); + value = c->stdio_fdname[fileno]; + + break; + + case EXEC_OUTPUT_FILE: + key = strjoina("exec-context-std-", type, "-file"); + value = c->stdio_file[fileno]; + + break; + + case EXEC_OUTPUT_FILE_APPEND: + key = strjoina("exec-context-std-", type, "-file-append"); + value = c->stdio_file[fileno]; + + break; + + case EXEC_OUTPUT_FILE_TRUNCATE: + key = strjoina("exec-context-std-", type, "-file-truncate"); + value = c->stdio_file[fileno]; + + break; + + default: + return 0; + } + + return serialize_item(f, key, value); +} + +static int exec_context_serialize(const ExecContext *c, FILE *f) { + int r; + + assert(f); + + if (!c) + return 0; + + r = serialize_strv(f, "exec-context-environment", c->environment); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-context-environment-files", c->environment_files); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-context-pass-environment", c->pass_environment); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-context-unset-environment", c->unset_environment); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-working-directory", c->working_directory); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-root-directory", c->root_directory); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-root-image", c->root_image); + if (r < 0) + return r; + + if (c->root_image_options) { + _cleanup_free_ char *options = NULL; + + LIST_FOREACH(mount_options, o, c->root_image_options) { + if (isempty(o->options)) + continue; + + _cleanup_free_ char *escaped = NULL; + escaped = shell_escape(o->options, ":"); + if (!escaped) + return log_oom_debug(); + + if (!strextend(&options, + " ", + partition_designator_to_string(o->partition_designator), + ":", + escaped)) + return log_oom_debug(); + } + + r = serialize_item(f, "exec-context-root-image-options", options); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-context-root-verity", c->root_verity); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-root-hash-path", c->root_hash_path); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-root-hash-sig-path", c->root_hash_sig_path); + if (r < 0) + return r; + + r = serialize_item_hexmem(f, "exec-context-root-hash", c->root_hash, c->root_hash_size); + if (r < 0) + return r; + + r = serialize_item_base64mem(f, "exec-context-root-hash-sig", c->root_hash_sig, c->root_hash_sig_size); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-root-ephemeral", c->root_ephemeral); + if (r < 0) + return r; + + r = serialize_item_format(f, "exec-context-umask", "%04o", c->umask); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-non-blocking", c->non_blocking); + if (r < 0) + return r; + + r = serialize_item_tristate(f, "exec-context-private-mounts", c->private_mounts); + if (r < 0) + return r; + + r = serialize_item_tristate(f, "exec-context-memory-ksm", c->memory_ksm); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-private-tmp", c->private_tmp); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-private-devices", c->private_devices); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-protect-kernel-tunables", c->protect_kernel_tunables); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-protect-kernel-modules", c->protect_kernel_modules); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-protect-kernel-logs", c->protect_kernel_logs); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-protect-clock", c->protect_clock); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-protect-control-groups", c->protect_control_groups); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-private-network", c->private_network); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-private-users", c->private_users); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-private-ipc", c->private_ipc); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-remove-ipc", c->remove_ipc); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-protect-home", protect_home_to_string(c->protect_home)); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-protect-system", protect_system_to_string(c->protect_system)); + if (r < 0) + return r; + + if (c->mount_apivfs_set) { + r = serialize_bool(f, "exec-context-mount-api-vfs", c->mount_apivfs); + if (r < 0) + return r; + } + + r = serialize_bool_elide(f, "exec-context-same-pgrp", c->same_pgrp); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-cpu-sched-reset-on-fork", c->cpu_sched_reset_on_fork); + if (r < 0) + return r; + + r = serialize_bool(f, "exec-context-ignore-sigpipe", c->ignore_sigpipe); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-memory-deny-write-execute", c->memory_deny_write_execute); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-restrict-realtime", c->restrict_realtime); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-restrict-suid-sgid", c->restrict_suid_sgid); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-keyring-mode", exec_keyring_mode_to_string(c->keyring_mode)); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-protect-hostname", c->protect_hostname); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-protect-proc", protect_proc_to_string(c->protect_proc)); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-proc-subset", proc_subset_to_string(c->proc_subset)); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-runtime-directory-preserve-mode", exec_preserve_mode_to_string(c->runtime_directory_preserve_mode)); + if (r < 0) + return r; + + for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) { + _cleanup_free_ char *key = NULL, *value = NULL; + + key = strjoin("exec-context-directories-", exec_directory_type_to_string(dt)); + if (!key) + return log_oom_debug(); + + if (asprintf(&value, "%04o", c->directories[dt].mode) < 0) + return log_oom_debug(); + + for (size_t i = 0; i < c->directories[dt].n_items; i++) { + _cleanup_free_ char *path_escaped = NULL; + + path_escaped = shell_escape(c->directories[dt].items[i].path, ":"); + if (!path_escaped) + return log_oom_debug(); + + if (!strextend(&value, " ", path_escaped)) + return log_oom_debug(); + + if (!strextend(&value, ":", yes_no(c->directories[dt].items[i].only_create))) + return log_oom_debug(); + + STRV_FOREACH(d, c->directories[dt].items[i].symlinks) { + _cleanup_free_ char *link_escaped = NULL; + + link_escaped = shell_escape(*d, ":"); + if (!link_escaped) + return log_oom_debug(); + + if (!strextend(&value, ":", link_escaped)) + return log_oom_debug(); + } + } + + r = serialize_item(f, key, value); + if (r < 0) + return r; + } + + r = serialize_usec(f, "exec-context-timeout-clean-usec", c->timeout_clean_usec); + if (r < 0) + return r; + + if (c->nice_set) { + r = serialize_item_format(f, "exec-context-nice", "%i", c->nice); + if (r < 0) + return r; + } + + r = serialize_bool_elide(f, "exec-context-working-directory-missing-ok", c->working_directory_missing_ok); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-working-directory-home", c->working_directory_home); + if (r < 0) + return r; + + if (c->oom_score_adjust_set) { + r = serialize_item_format(f, "exec-context-oom-score-adjust", "%i", c->oom_score_adjust); + if (r < 0) + return r; + } + + if (c->coredump_filter_set) { + r = serialize_item_format(f, "exec-context-coredump-filter", "%"PRIx64, c->coredump_filter); + if (r < 0) + return r; + } + + for (unsigned i = 0; i < RLIM_NLIMITS; i++) { + _cleanup_free_ char *key = NULL, *limit = NULL; + + if (!c->rlimit[i]) + continue; + + key = strjoin("exec-context-limit-", rlimit_to_string(i)); + if (!key) + return log_oom_debug(); + + r = rlimit_format(c->rlimit[i], &limit); + if (r < 0) + return r; + + r = serialize_item(f, key, limit); + if (r < 0) + return r; + } + + if (c->ioprio_set) { + r = serialize_item_format(f, "exec-context-ioprio", "%d", c->ioprio); + if (r < 0) + return r; + } + + if (c->cpu_sched_set) { + _cleanup_free_ char *policy_str = NULL; + + r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-cpu-scheduling-policy", policy_str); + if (r < 0) + return r; + + r = serialize_item_format(f, "exec-context-cpu-scheduling-priority", "%i", c->cpu_sched_priority); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-cpu-scheduling-reset-on-fork", c->cpu_sched_reset_on_fork); + if (r < 0) + return r; + } + + if (c->cpu_set.set) { + _cleanup_free_ char *affinity = NULL; + + affinity = cpu_set_to_range_string(&c->cpu_set); + if (!affinity) + return log_oom_debug(); + + r = serialize_item(f, "exec-context-cpu-affinity", affinity); + if (r < 0) + return r; + } + + if (mpol_is_valid(numa_policy_get_type(&c->numa_policy))) { + _cleanup_free_ char *nodes = NULL; + + nodes = cpu_set_to_range_string(&c->numa_policy.nodes); + if (!nodes) + return log_oom_debug(); + + if (nodes) { + r = serialize_item(f, "exec-context-numa-mask", nodes); + if (r < 0) + return r; + } + + r = serialize_item_format(f, "exec-context-numa-policy", "%d", c->numa_policy.type); + if (r < 0) + return r; + } + + r = serialize_bool_elide(f, "exec-context-cpu-affinity-from-numa", c->cpu_affinity_from_numa); + if (r < 0) + return r; + + if (c->timer_slack_nsec != NSEC_INFINITY) { + r = serialize_item_format(f, "exec-context-timer-slack-nsec", NSEC_FMT, c->timer_slack_nsec); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-context-std-input", exec_input_to_string(c->std_input)); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-std-output", exec_output_to_string(c->std_output)); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-std-error", exec_output_to_string(c->std_error)); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-stdio-as-fds", c->stdio_as_fds); + if (r < 0) + return r; + + switch (c->std_input) { + case EXEC_INPUT_NAMED_FD: + r = serialize_item(f, "exec-context-std-input-fd-name", c->stdio_fdname[STDIN_FILENO]); + if (r < 0) + return r; + break; + + case EXEC_INPUT_FILE: + r = serialize_item(f, "exec-context-std-input-file", c->stdio_file[STDIN_FILENO]); + if (r < 0) + return r; + break; + + default: + break; + } + + r = serialize_std_out_err(c, f, STDOUT_FILENO); + if (r < 0) + return r; + + r = serialize_std_out_err(c, f, STDERR_FILENO); + if (r < 0) + return r; + + r = serialize_item_base64mem(f, "exec-context-stdin-data", c->stdin_data, c->stdin_data_size); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-tty-path", c->tty_path); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-tty-reset", c->tty_reset); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-tty-vhangup", c->tty_vhangup); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-tty-vt-disallocate", c->tty_vt_disallocate); + if (r < 0) + return r; + + r = serialize_item_format(f, "exec-context-tty-rows", "%u", c->tty_rows); + if (r < 0) + return r; + + r = serialize_item_format(f, "exec-context-tty-columns", "%u", c->tty_cols); + if (r < 0) + return r; + + r = serialize_item_format(f, "exec-context-syslog-priority", "%i", c->syslog_priority); + if (r < 0) + return r; + + r = serialize_bool(f, "exec-context-syslog-level-prefix", c->syslog_level_prefix); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-syslog-identifier", c->syslog_identifier); + if (r < 0) + return r; + + r = serialize_item_format(f, "exec-context-log-level-max", "%d", c->log_level_max); + if (r < 0) + return r; + + if (c->log_ratelimit_interval_usec > 0) { + r = serialize_usec(f, "exec-context-log-ratelimit-interval-usec", c->log_ratelimit_interval_usec); + if (r < 0) + return r; + } + + if (c->log_ratelimit_burst > 0) { + r = serialize_item_format(f, "exec-context-log-ratelimit-burst", "%u", c->log_ratelimit_burst); + if (r < 0) + return r; + } + + r = serialize_string_set(f, "exec-context-log-filter-allowed-patterns", c->log_filter_allowed_patterns); + if (r < 0) + return r; + + r = serialize_string_set(f, "exec-context-log-filter-denied-patterns", c->log_filter_denied_patterns); + if (r < 0) + return r; + + for (size_t j = 0; j < c->n_log_extra_fields; j++) { + r = serialize_item(f, "exec-context-log-extra-fields", c->log_extra_fields[j].iov_base); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-context-log-namespace", c->log_namespace); + if (r < 0) + return r; + + if (c->secure_bits != 0) { + r = serialize_item_format(f, "exec-context-secure-bits", "%d", c->secure_bits); + if (r < 0) + return r; + } + + if (c->capability_bounding_set != CAP_MASK_UNSET) { + r = serialize_item_format(f, "exec-context-capability-bounding-set", "%" PRIu64, c->capability_bounding_set); + if (r < 0) + return r; + } + + if (c->capability_ambient_set != 0) { + r = serialize_item_format(f, "exec-context-capability-ambient-set", "%" PRIu64, c->capability_ambient_set); + if (r < 0) + return r; + } + + if (c->user) { + r = serialize_item(f, "exec-context-user", c->user); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-context-group", c->group); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-dynamic-user", c->dynamic_user); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-context-supplementary-groups", c->supplementary_groups); + if (r < 0) + return r; + + r = serialize_item_tristate(f, "exec-context-set-login-environment", c->set_login_environment); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-pam-name", c->pam_name); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-context-read-write-paths", c->read_write_paths); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-context-read-only-paths", c->read_only_paths); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-context-inaccessible-paths", c->inaccessible_paths); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-context-exec-paths", c->exec_paths); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-context-no-exec-paths", c->no_exec_paths); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-context-exec-search-path", c->exec_search_path); + if (r < 0) + return r; + + r = serialize_item_format(f, "exec-context-mount-propagation-flag", "%lu", c->mount_propagation_flag); + if (r < 0) + return r; + + for (size_t i = 0; i < c->n_bind_mounts; i++) { + _cleanup_free_ char *src_escaped = NULL, *dst_escaped = NULL; + + src_escaped = shell_escape(c->bind_mounts[i].source, ":"); + if (!src_escaped) + return log_oom_debug(); + + dst_escaped = shell_escape(c->bind_mounts[i].destination, ":"); + if (!dst_escaped) + return log_oom_debug(); + + r = serialize_item_format(f, + c->bind_mounts[i].read_only ? "exec-context-bind-read-only-path" : "exec-context-bind-path", + "%s%s:%s:%s", + c->bind_mounts[i].ignore_enoent ? "-" : "", + src_escaped, + dst_escaped, + c->bind_mounts[i].recursive ? "rbind" : "norbind"); + if (r < 0) + return r; + } + + for (size_t i = 0; i < c->n_temporary_filesystems; i++) { + const TemporaryFileSystem *t = c->temporary_filesystems + i; + _cleanup_free_ char *escaped = NULL; + + if (!isempty(t->options)) { + escaped = shell_escape(t->options, ":"); + if (!escaped) + return log_oom_debug(); + } + + r = serialize_item_format(f, "exec-context-temporary-filesystems", "%s%s%s", + t->path, + isempty(escaped) ? "" : ":", + strempty(escaped)); + if (r < 0) + return r; + } + + r = serialize_item(f, "exec-context-utmp-id", c->utmp_id); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-utmp-mode", exec_utmp_mode_to_string(c->utmp_mode)); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-no-new-privileges", c->no_new_privileges); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-selinux-context-ignore", c->selinux_context_ignore); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-apparmor-profile-ignore", c->apparmor_profile_ignore); + if (r < 0) + return r; + + r = serialize_bool_elide(f, "exec-context-smack-process-label-ignore", c->smack_process_label_ignore); + if (r < 0) + return r; + + if (c->selinux_context) { + r = serialize_item_format(f, "exec-context-selinux-context", + "%s%s", + c->selinux_context_ignore ? "-" : "", + c->selinux_context); + if (r < 0) + return r; + } + + if (c->apparmor_profile) { + r = serialize_item_format(f, "exec-context-apparmor-profile", + "%s%s", + c->apparmor_profile_ignore ? "-" : "", + c->apparmor_profile); + if (r < 0) + return r; + } + + if (c->smack_process_label) { + r = serialize_item_format(f, "exec-context-smack-process-label", + "%s%s", + c->smack_process_label_ignore ? "-" : "", + c->smack_process_label); + if (r < 0) + return r; + } + + if (c->personality != PERSONALITY_INVALID) { + r = serialize_item(f, "exec-context-personality", personality_to_string(c->personality)); + if (r < 0) + return r; + } + + r = serialize_bool_elide(f, "exec-context-lock-personality", c->lock_personality); + if (r < 0) + return r; + +#if HAVE_SECCOMP + if (!hashmap_isempty(c->syscall_filter)) { + void *errno_num, *id; + HASHMAP_FOREACH_KEY(errno_num, id, c->syscall_filter) { + r = serialize_item_format(f, "exec-context-syscall-filter", "%d %d", PTR_TO_INT(id) - 1, PTR_TO_INT(errno_num)); + if (r < 0) + return r; + } + } + + if (!set_isempty(c->syscall_archs)) { + void *id; + SET_FOREACH(id, c->syscall_archs) { + r = serialize_item_format(f, "exec-context-syscall-archs", "%u", PTR_TO_UINT(id) - 1); + if (r < 0) + return r; + } + } + + if (c->syscall_errno > 0) { + r = serialize_item_format(f, "exec-context-syscall-errno", "%d", c->syscall_errno); + if (r < 0) + return r; + } + + r = serialize_bool_elide(f, "exec-context-syscall-allow-list", c->syscall_allow_list); + if (r < 0) + return r; + + if (!hashmap_isempty(c->syscall_log)) { + void *errno_num, *id; + HASHMAP_FOREACH_KEY(errno_num, id, c->syscall_log) { + r = serialize_item_format(f, "exec-context-syscall-log", "%d %d", PTR_TO_INT(id) - 1, PTR_TO_INT(errno_num)); + if (r < 0) + return r; + } + } + + r = serialize_bool_elide(f, "exec-context-syscall-log-allow-list", c->syscall_log_allow_list); + if (r < 0) + return r; +#endif + + if (c->restrict_namespaces != NAMESPACE_FLAGS_INITIAL) { + r = serialize_item_format(f, "exec-context-restrict-namespaces", "%lu", c->restrict_namespaces); + if (r < 0) + return r; + } + +#if HAVE_LIBBPF + if (exec_context_restrict_filesystems_set(c)) { + char *fs; + SET_FOREACH(fs, c->restrict_filesystems) { + r = serialize_item(f, "exec-context-restrict-filesystems", fs); + if (r < 0) + return r; + } + } + + r = serialize_bool_elide(f, "exec-context-restrict-filesystems-allow-list", c->restrict_filesystems_allow_list); + if (r < 0) + return r; +#endif + + if (!set_isempty(c->address_families)) { + void *afp; + + SET_FOREACH(afp, c->address_families) { + int af = PTR_TO_INT(afp); + + if (af <= 0 || af >= af_max()) + continue; + + r = serialize_item_format(f, "exec-context-address-families", "%d", af); + if (r < 0) + return r; + } + } + + r = serialize_bool_elide(f, "exec-context-address-families-allow-list", c->address_families_allow_list); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-network-namespace-path", c->network_namespace_path); + if (r < 0) + return r; + + r = serialize_item(f, "exec-context-ipc-namespace-path", c->ipc_namespace_path); + if (r < 0) + return r; + + for (size_t i = 0; i < c->n_mount_images; i++) { + _cleanup_free_ char *s = NULL, *source_escaped = NULL, *dest_escaped = NULL; + + source_escaped = shell_escape(c->mount_images[i].source, " "); + if (!source_escaped) + return log_oom_debug(); + + dest_escaped = shell_escape(c->mount_images[i].destination, " "); + if (!dest_escaped) + return log_oom_debug(); + + s = strjoin(c->mount_images[i].ignore_enoent ? "-" : "", + source_escaped, + " ", + dest_escaped); + if (!s) + return log_oom_debug(); + + LIST_FOREACH(mount_options, o, c->mount_images[i].mount_options) { + _cleanup_free_ char *escaped = NULL; + + if (isempty(o->options)) + continue; + + escaped = shell_escape(o->options, ":"); + if (!escaped) + return log_oom_debug(); + + if (!strextend(&s, + " ", + partition_designator_to_string(o->partition_designator), + ":", + escaped)) + return log_oom_debug(); + } + + r = serialize_item(f, "exec-context-mount-image", s); + if (r < 0) + return r; + } + + for (size_t i = 0; i < c->n_extension_images; i++) { + _cleanup_free_ char *s = NULL, *source_escaped = NULL; + + source_escaped = shell_escape(c->extension_images[i].source, ":"); + if (!source_escaped) + return log_oom_debug(); + + s = strjoin(c->extension_images[i].ignore_enoent ? "-" : "", + source_escaped); + if (!s) + return log_oom_debug(); + + LIST_FOREACH(mount_options, o, c->extension_images[i].mount_options) { + _cleanup_free_ char *escaped = NULL; + + if (isempty(o->options)) + continue; + + escaped = shell_escape(o->options, ":"); + if (!escaped) + return log_oom_debug(); + + if (!strextend(&s, + " ", + partition_designator_to_string(o->partition_designator), + ":", + escaped)) + return log_oom_debug(); + } + + r = serialize_item(f, "exec-context-extension-image", s); + if (r < 0) + return r; + } + + r = serialize_strv(f, "exec-context-extension-directories", c->extension_directories); + if (r < 0) + return r; + + ExecSetCredential *sc; + HASHMAP_FOREACH(sc, c->set_credentials) { + _cleanup_free_ char *data = NULL; + + if (base64mem(sc->data, sc->size, &data) < 0) + return log_oom_debug(); + + r = serialize_item_format(f, "exec-context-set-credentials", "%s %s %s", sc->id, yes_no(sc->encrypted), data); + if (r < 0) + return r; + } + + ExecLoadCredential *lc; + HASHMAP_FOREACH(lc, c->load_credentials) { + r = serialize_item_format(f, "exec-context-load-credentials", "%s %s %s", lc->id, yes_no(lc->encrypted), lc->path); + if (r < 0) + return r; + } + + if (!set_isempty(c->import_credentials)) { + char *ic; + SET_FOREACH(ic, c->import_credentials) { + r = serialize_item(f, "exec-context-import-credentials", ic); + if (r < 0) + return r; + } + } + + r = serialize_image_policy(f, "exec-context-root-image-policy", c->root_image_policy); + if (r < 0) + return r; + + r = serialize_image_policy(f, "exec-context-mount-image-policy", c->mount_image_policy); + if (r < 0) + return r; + + r = serialize_image_policy(f, "exec-context-extension-image-policy", c->extension_image_policy); + if (r < 0) + return r; + + fputc('\n', f); /* End marker */ + + return 0; +} + +static int exec_context_deserialize(ExecContext *c, FILE *f) { + int r; + + assert(f); + + if (!c) + return 0; + + for (;;) { + _cleanup_free_ char *l = NULL; + const char *val; + + r = deserialize_read_line(f, &l); + if (r < 0) + return r; + if (r == 0) /* eof or end marker */ + break; + + if ((val = startswith(l, "exec-context-environment="))) { + r = deserialize_strv(&c->environment, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-environment-files="))) { + r = deserialize_strv(&c->environment_files, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-pass-environment="))) { + r = deserialize_strv(&c->pass_environment, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-unset-environment="))) { + r = deserialize_strv(&c->unset_environment, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-working-directory="))) { + r = free_and_strdup(&c->working_directory, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-root-directory="))) { + r = free_and_strdup(&c->root_directory, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-root-image="))) { + r = free_and_strdup(&c->root_image, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-root-image-options="))) { + for (;;) { + _cleanup_free_ char *word = NULL, *mount_options = NULL, *partition = NULL; + PartitionDesignator partition_designator; + MountOptions *o = NULL; + const char *p; + + r = extract_first_word(&val, &word, NULL, 0); + if (r < 0) + return r; + if (r == 0) + break; + + p = word; + r = extract_many_words(&p, ":", EXTRACT_CUNESCAPE|EXTRACT_UNESCAPE_SEPARATORS, &partition, &mount_options, NULL); + if (r < 0) + return r; + if (r == 0) + continue; + + partition_designator = partition_designator_from_string(partition); + if (partition_designator < 0) + return -EINVAL; + + o = new(MountOptions, 1); + if (!o) + return log_oom_debug(); + *o = (MountOptions) { + .partition_designator = partition_designator, + .options = TAKE_PTR(mount_options), + }; + LIST_APPEND(mount_options, c->root_image_options, o); + } + } else if ((val = startswith(l, "exec-context-root-verity="))) { + r = free_and_strdup(&c->root_verity, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-root-hash-path="))) { + r = free_and_strdup(&c->root_hash_path, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-root-hash-sig-path="))) { + r = free_and_strdup(&c->root_hash_sig_path, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-root-hash="))) { + c->root_hash = mfree(c->root_hash); + r = unhexmem(val, strlen(val), &c->root_hash, &c->root_hash_size); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-root-hash-sig="))) { + c->root_hash_sig = mfree(c->root_hash_sig); + r= unbase64mem(val, strlen(val), &c->root_hash_sig, &c->root_hash_sig_size); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-root-ephemeral="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->root_ephemeral = r; + } else if ((val = startswith(l, "exec-context-umask="))) { + r = parse_mode(val, &c->umask); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-private-non-blocking="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->non_blocking = r; + } else if ((val = startswith(l, "exec-context-private-mounts="))) { + r = safe_atoi(val, &c->private_mounts); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-memory-ksm="))) { + r = safe_atoi(val, &c->memory_ksm); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-private-tmp="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->private_tmp = r; + } else if ((val = startswith(l, "exec-context-private-devices="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->private_devices = r; + } else if ((val = startswith(l, "exec-context-protect-kernel-tunables="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->protect_kernel_tunables = r; + } else if ((val = startswith(l, "exec-context-protect-kernel-modules="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->protect_kernel_modules = r; + } else if ((val = startswith(l, "exec-context-protect-kernel-logs="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->protect_kernel_logs = r; + } else if ((val = startswith(l, "exec-context-protect-clock="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->protect_clock = r; + } else if ((val = startswith(l, "exec-context-protect-control-groups="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->protect_control_groups = r; + } else if ((val = startswith(l, "exec-context-private-network="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->private_network = r; + } else if ((val = startswith(l, "exec-context-private-users="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->private_users = r; + } else if ((val = startswith(l, "exec-context-private-ipc="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->private_ipc = r; + } else if ((val = startswith(l, "exec-context-remove-ipc="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->remove_ipc = r; + } else if ((val = startswith(l, "exec-context-protect-home="))) { + c->protect_home = protect_home_from_string(val); + if (c->protect_home < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-context-protect-system="))) { + c->protect_system = protect_system_from_string(val); + if (c->protect_system < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-context-mount-api-vfs="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->mount_apivfs = r; + c->mount_apivfs_set = true; + } else if ((val = startswith(l, "exec-context-same-pgrp="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->same_pgrp = r; + } else if ((val = startswith(l, "exec-context-cpu-sched-reset-on-fork="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->cpu_sched_reset_on_fork = r; + } else if ((val = startswith(l, "exec-context-non-blocking="))) { + r = parse_boolean(val); + if (r < 0) + return r; + r = c->non_blocking; + } else if ((val = startswith(l, "exec-context-ignore-sigpipe="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->ignore_sigpipe = r; + } else if ((val = startswith(l, "exec-context-memory-deny-write-execute="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->memory_deny_write_execute = r; + } else if ((val = startswith(l, "exec-context-restrict-realtime="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->restrict_realtime = r; + } else if ((val = startswith(l, "exec-context-restrict-suid-sgid="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->restrict_suid_sgid = r; + } else if ((val = startswith(l, "exec-context-keyring-mode="))) { + c->keyring_mode = exec_keyring_mode_from_string(val); + if (c->keyring_mode < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-context-protect-hostname="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->protect_hostname = r; + } else if ((val = startswith(l, "exec-context-protect-proc="))) { + c->protect_proc = protect_proc_from_string(val); + if (c->protect_proc < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-context-proc-subset="))) { + c->proc_subset = proc_subset_from_string(val); + if (c->proc_subset < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-context-runtime-directory-preserve-mode="))) { + c->runtime_directory_preserve_mode = exec_preserve_mode_from_string(val); + if (c->runtime_directory_preserve_mode < 0) + return -EINVAL; + } else if ((val = startswith(l, "exec-context-directories-"))) { + _cleanup_free_ char *type = NULL, *mode = NULL; + ExecDirectoryType dt; + + r = extract_many_words(&val, "= ", 0, &type, &mode, NULL); + if (r < 0) + return r; + if (r == 0 || !mode) + return -EINVAL; + + dt = exec_directory_type_from_string(type); + if (dt < 0) + return -EINVAL; + + r = parse_mode(mode, &c->directories[dt].mode); + if (r < 0) + return r; + + for (;;) { + _cleanup_free_ char *tuple = NULL, *path = NULL, *only_create = NULL; + const char *p; + + r = extract_first_word(&val, &tuple, WHITESPACE, EXTRACT_RETAIN_ESCAPE); + if (r < 0) + return r; + if (r == 0) + break; + + p = tuple; + r = extract_many_words(&p, ":", EXTRACT_UNESCAPE_SEPARATORS, &path, &only_create, NULL); + if (r < 0) + return r; + if (r < 2) + continue; + + r = exec_directory_add(&c->directories[dt], path, NULL); + if (r < 0) + return r; + + r = parse_boolean(only_create); + if (r < 0) + return r; + c->directories[dt].items[c->directories[dt].n_items - 1].only_create = r; + + if (isempty(p)) + continue; + + for (;;) { + _cleanup_free_ char *link = NULL; + + r = extract_first_word(&p, &link, ":", EXTRACT_UNESCAPE_SEPARATORS); + if (r < 0) + return r; + if (r == 0) + break; + + r = strv_consume(&c->directories[dt].items[c->directories[dt].n_items - 1].symlinks, TAKE_PTR(link)); + if (r < 0) + return r; + } + } + } else if ((val = startswith(l, "exec-context-timeout-clean-usec="))) { + r = deserialize_usec(val, &c->timeout_clean_usec); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-nice="))) { + r = safe_atoi(val, &c->nice); + if (r < 0) + return r; + c->nice_set = true; + } else if ((val = startswith(l, "exec-context-working-directory-missing-ok="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->working_directory_missing_ok = r; + } else if ((val = startswith(l, "exec-context-working-directory-home="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->working_directory_home = r; + } else if ((val = startswith(l, "exec-context-oom-score-adjust="))) { + r = safe_atoi(val, &c->oom_score_adjust); + if (r < 0) + return r; + c->oom_score_adjust_set = true; + } else if ((val = startswith(l, "exec-context-coredump-filter="))) { + r = safe_atoux64(val, &c->coredump_filter); + if (r < 0) + return r; + c->coredump_filter_set = true; + } else if ((val = startswith(l, "exec-context-limit-"))) { + _cleanup_free_ struct rlimit *rlimit = NULL; + _cleanup_free_ char *limit = NULL; + int type; + + r = extract_first_word(&val, &limit, "=", 0); + if (r < 0) + return r; + if (r == 0 || !val) + return -EINVAL; + + type = rlimit_from_string(limit); + if (type < 0) + return -EINVAL; + + if (!c->rlimit[type]) { + rlimit = new0(struct rlimit, 1); + if (!rlimit) + return log_oom_debug(); + + r = rlimit_parse(type, val, rlimit); + if (r < 0) + return r; + + c->rlimit[type] = TAKE_PTR(rlimit); + } else { + r = rlimit_parse(type, val, c->rlimit[type]); + if (r < 0) + return r; + } + } else if ((val = startswith(l, "exec-context-ioprio="))) { + r = safe_atoi(val, &c->ioprio); + if (r < 0) + return r; + c->ioprio_set = true; + } else if ((val = startswith(l, "exec-context-cpu-scheduling-policy="))) { + r = sched_policy_from_string(val); + if (r < 0) + return r; + c->cpu_sched_set = true; + } else if ((val = startswith(l, "exec-context-cpu-scheduling-priority="))) { + r = safe_atoi(val, &c->cpu_sched_priority); + if (r < 0) + return r; + c->cpu_sched_set = true; + } else if ((val = startswith(l, "exec-context-cpu-scheduling-reset-on-fork="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->cpu_sched_reset_on_fork = r; + c->cpu_sched_set = true; + } else if ((val = startswith(l, "exec-context-cpu-affinity="))) { + if (c->cpu_set.set) + return -EINVAL; /* duplicated */ + + r = parse_cpu_set(val, &c->cpu_set); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-numa-mask="))) { + if (c->numa_policy.nodes.set) + return -EINVAL; /* duplicated */ + + r = parse_cpu_set(val, &c->numa_policy.nodes); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-numa-policy="))) { + r = safe_atoi(val, &c->numa_policy.type); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-cpu-affinity-from-numa="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->cpu_affinity_from_numa = r; + } else if ((val = startswith(l, "exec-context-timer-slack-nsec="))) { + r = deserialize_usec(val, (usec_t *)&c->timer_slack_nsec); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-std-input="))) { + c->std_input = exec_input_from_string(val); + if (c->std_input < 0) + return c->std_input; + } else if ((val = startswith(l, "exec-context-std-output="))) { + c->std_output = exec_output_from_string(val); + if (c->std_output < 0) + return c->std_output; + } else if ((val = startswith(l, "exec-context-std-error="))) { + c->std_error = exec_output_from_string(val); + if (c->std_error < 0) + return c->std_error; + } else if ((val = startswith(l, "exec-context-stdio-as-fds="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->stdio_as_fds = r; + } else if ((val = startswith(l, "exec-context-std-input-fd-name="))) { + r = free_and_strdup(&c->stdio_fdname[STDIN_FILENO], val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-std-output-fd-name="))) { + r = free_and_strdup(&c->stdio_fdname[STDOUT_FILENO], val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-std-error-fd-name="))) { + r = free_and_strdup(&c->stdio_fdname[STDERR_FILENO], val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-std-input-file="))) { + r = free_and_strdup(&c->stdio_file[STDIN_FILENO], val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-std-output-file="))) { + r = free_and_strdup(&c->stdio_file[STDOUT_FILENO], val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-std-output-file-append="))) { + r = free_and_strdup(&c->stdio_file[STDOUT_FILENO], val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-std-output-file-truncate="))) { + r = free_and_strdup(&c->stdio_file[STDOUT_FILENO], val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-std-error-file="))) { + r = free_and_strdup(&c->stdio_file[STDERR_FILENO], val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-std-error-file-append="))) { + r = free_and_strdup(&c->stdio_file[STDERR_FILENO], val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-std-error-file-truncate="))) { + r = free_and_strdup(&c->stdio_file[STDERR_FILENO], val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-stdin-data="))) { + if (c->stdin_data) + return -EINVAL; /* duplicated */ + + r = unbase64mem(val, strlen(val), &c->stdin_data, &c->stdin_data_size); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-tty-path="))) { + r = free_and_strdup(&c->tty_path, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-tty-reset="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->tty_reset = r; + } else if ((val = startswith(l, "exec-context-tty-vhangup="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->tty_vhangup = r; + } else if ((val = startswith(l, "exec-context-tty-vt-disallocate="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->tty_vt_disallocate = r; + } else if ((val = startswith(l, "exec-context-tty-rows="))) { + r = safe_atou(val, &c->tty_rows); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-tty-columns="))) { + r = safe_atou(val, &c->tty_cols); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-syslog-priority="))) { + r = safe_atoi(val, &c->syslog_priority); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-syslog-level-prefix="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->syslog_level_prefix = r; + } else if ((val = startswith(l, "exec-context-syslog-identifier="))) { + r = free_and_strdup(&c->syslog_identifier, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-log-level-max="))) { + r = safe_atoi(val, &c->log_level_max); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-log-ratelimit-interval-usec="))) { + r = deserialize_usec(val, &c->log_ratelimit_interval_usec); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-log-ratelimit-burst="))) { + r = safe_atou(val, &c->log_ratelimit_burst); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-log-filter-allowed-patterns="))) { + r = set_put_strdup(&c->log_filter_allowed_patterns, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-log-filter-denied-patterns="))) { + r = set_put_strdup(&c->log_filter_denied_patterns, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-log-extra-fields="))) { + if (!GREEDY_REALLOC(c->log_extra_fields, c->n_log_extra_fields + 1)) + return log_oom_debug(); + + c->log_extra_fields[c->n_log_extra_fields++].iov_base = strdup(val); + if (!c->log_extra_fields[c->n_log_extra_fields-1].iov_base) + return log_oom_debug(); + } else if ((val = startswith(l, "exec-context-log-namespace="))) { + r = free_and_strdup(&c->log_namespace, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-secure-bits="))) { + r = safe_atoi(val, &c->secure_bits); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-capability-bounding-set="))) { + r = safe_atou64(val, &c->capability_bounding_set); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-capability-ambient-set="))) { + r = safe_atou64(val, &c->capability_ambient_set); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-user="))) { + r = free_and_strdup(&c->user, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-group="))) { + r = free_and_strdup(&c->group, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-dynamic-user="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->dynamic_user = r; + } else if ((val = startswith(l, "exec-context-supplementary-groups="))) { + r = deserialize_strv(&c->supplementary_groups, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-set-login-environment="))) { + r = safe_atoi(val, &c->set_login_environment); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-pam-name="))) { + r = free_and_strdup(&c->pam_name, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-read-write-paths="))) { + r = deserialize_strv(&c->read_write_paths, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-read-only-paths="))) { + r = deserialize_strv(&c->read_only_paths, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-inaccessible-paths="))) { + r = deserialize_strv(&c->inaccessible_paths, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-exec-paths="))) { + r = deserialize_strv(&c->exec_paths, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-no-exec-paths="))) { + r = deserialize_strv(&c->no_exec_paths, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-exec-search-path="))) { + r = deserialize_strv(&c->exec_search_path, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-mount-propagation-flag="))) { + r = safe_atolu(val, &c->mount_propagation_flag); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-bind-read-only-path="))) { + _cleanup_free_ char *source = NULL, *destination = NULL; + bool rbind = true, ignore_enoent = false; + char *s = NULL, *d = NULL; + + r = extract_first_word(&val, + &source, + ":" WHITESPACE, + EXTRACT_UNQUOTE|EXTRACT_DONT_COALESCE_SEPARATORS|EXTRACT_UNESCAPE_SEPARATORS); + if (r < 0) + return r; + if (r == 0) + return -EINVAL; + + s = source; + if (s[0] == '-') { + ignore_enoent = true; + s++; + } + + if (val && val[-1] == ':') { + r = extract_first_word(&val, + &destination, + ":" WHITESPACE, + EXTRACT_UNQUOTE|EXTRACT_DONT_COALESCE_SEPARATORS|EXTRACT_UNESCAPE_SEPARATORS); + if (r < 0) + return r; + if (r == 0) + continue; + + d = destination; + + if (val && val[-1] == ':') { + _cleanup_free_ char *options = NULL; + + r = extract_first_word(&val, &options, NULL, EXTRACT_UNQUOTE); + if (r < 0) + return -r; + + if (isempty(options) || streq(options, "rbind")) + rbind = true; + else if (streq(options, "norbind")) + rbind = false; + else + continue; + } + } else + d = s; + + r = bind_mount_add(&c->bind_mounts, &c->n_bind_mounts, + &(BindMount) { + .source = s, + .destination = d, + .read_only = true, + .recursive = rbind, + .ignore_enoent = ignore_enoent, + }); + if (r < 0) + return log_oom_debug(); + } else if ((val = startswith(l, "exec-context-bind-path="))) { + _cleanup_free_ char *source = NULL, *destination = NULL; + bool rbind = true, ignore_enoent = false; + char *s = NULL, *d = NULL; + + r = extract_first_word(&val, + &source, + ":" WHITESPACE, + EXTRACT_UNQUOTE|EXTRACT_DONT_COALESCE_SEPARATORS|EXTRACT_UNESCAPE_SEPARATORS); + if (r < 0) + return r; + if (r == 0) + return -EINVAL; + + s = source; + if (s[0] == '-') { + ignore_enoent = true; + s++; + } + + if (val && val[-1] == ':') { + r = extract_first_word(&val, + &destination, + ":" WHITESPACE, + EXTRACT_UNQUOTE|EXTRACT_DONT_COALESCE_SEPARATORS|EXTRACT_UNESCAPE_SEPARATORS); + if (r < 0) + return r; + if (r == 0) + continue; + + d = destination; + + if (val && val[-1] == ':') { + _cleanup_free_ char *options = NULL; + + r = extract_first_word(&val, &options, NULL, EXTRACT_UNQUOTE); + if (r < 0) + return -r; + + if (isempty(options) || streq(options, "rbind")) + rbind = true; + else if (streq(options, "norbind")) + rbind = false; + else + continue; + } + } else + d = s; + + r = bind_mount_add(&c->bind_mounts, &c->n_bind_mounts, + &(BindMount) { + .source = s, + .destination = d, + .read_only = false, + .recursive = rbind, + .ignore_enoent = ignore_enoent, + }); + if (r < 0) + return log_oom_debug(); + } else if ((val = startswith(l, "exec-context-temporary-filesystems="))) { + _cleanup_free_ char *path = NULL, *options = NULL; + + r = extract_many_words(&val, ":", EXTRACT_CUNESCAPE|EXTRACT_UNESCAPE_SEPARATORS, &path, &options, NULL); + if (r < 0) + return r; + if (r < 1) + continue; + + r = temporary_filesystem_add(&c->temporary_filesystems, &c->n_temporary_filesystems, path, options); + if (r < 0) + return log_oom_debug(); + } else if ((val = startswith(l, "exec-context-utmp-id="))) { + r = free_and_strdup(&c->utmp_id, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-utmp-mode="))) { + c->utmp_mode = exec_utmp_mode_from_string(val); + if (c->utmp_mode < 0) + return c->utmp_mode; + } else if ((val = startswith(l, "exec-context-no-new-privileges="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->no_new_privileges = r; + } else if ((val = startswith(l, "exec-context-selinux-context-ignore="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->selinux_context_ignore = r; + } else if ((val = startswith(l, "exec-context-apparmor-profile-ignore="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->apparmor_profile_ignore = r; + } else if ((val = startswith(l, "exec-context-smack-process-label-ignore="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->smack_process_label_ignore = r; + } else if ((val = startswith(l, "exec-context-selinux-context="))) { + if (val[0] == '-') { + c->selinux_context_ignore = true; + val++; + } + + r = free_and_strdup(&c->selinux_context, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-apparmor-profile="))) { + if (val[0] == '-') { + c->apparmor_profile_ignore = true; + val++; + } + + r = free_and_strdup(&c->apparmor_profile, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-smack-process-label="))) { + if (val[0] == '-') { + c->smack_process_label_ignore = true; + val++; + } + + r = free_and_strdup(&c->smack_process_label, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-personality="))) + c->personality = personality_from_string(val); + else if ((val = startswith(l, "exec-context-lock-personality="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->lock_personality = r; +#if HAVE_SECCOMP + } else if ((val = startswith(l, "exec-context-syscall-filter="))) { + _cleanup_free_ char *s_id = NULL, *s_errno_num = NULL; + int id, errno_num; + + r = extract_many_words(&val, NULL, 0, &s_id, &s_errno_num, NULL); + if (r < 0) + return r; + if (r != 2) + continue; + + r = safe_atoi(s_id, &id); + if (r < 0) + return r; + + r = safe_atoi(s_errno_num, &errno_num); + if (r < 0) + return r; + + r = hashmap_ensure_put(&c->syscall_filter, NULL, INT_TO_PTR(id + 1), INT_TO_PTR(errno_num)); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-syscall-archs="))) { + unsigned int id; + + r = safe_atou(val, &id); + if (r < 0) + return r; + + r = set_ensure_put(&c->syscall_archs, NULL, UINT_TO_PTR(id + 1)); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-syscall-errno="))) { + r = safe_atoi(val, &c->syscall_errno); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-syscall-allow-list="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->syscall_allow_list = r; + } else if ((val = startswith(l, "exec-context-syscall-log="))) { + _cleanup_free_ char *s_id = NULL, *s_errno_num = NULL; + int id, errno_num; + + r = extract_many_words(&val, " ", 0, &s_id, &s_errno_num, NULL); + if (r < 0) + return r; + if (r != 2) + continue; + + r = safe_atoi(s_id, &id); + if (r < 0) + return r; + + r = safe_atoi(s_errno_num, &errno_num); + if (r < 0) + return r; + + r = hashmap_ensure_put(&c->syscall_log, NULL, INT_TO_PTR(id + 1), INT_TO_PTR(errno_num)); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-syscall-log-allow-list="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->syscall_log_allow_list = r; +#endif + } else if ((val = startswith(l, "exec-context-restrict-namespaces="))) { + r = safe_atolu(val, &c->restrict_namespaces); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-restrict-filesystems="))) { + r = set_ensure_allocated(&c->restrict_filesystems, &string_hash_ops); + if (r < 0) + return r; + + r = set_put_strdup(&c->restrict_filesystems, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-restrict-filesystems-allow-list="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->restrict_filesystems_allow_list = r; + } else if ((val = startswith(l, "exec-context-address-families="))) { + int af; + + r = safe_atoi(val, &af); + if (r < 0) + return r; + + r = set_ensure_put(&c->address_families, NULL, INT_TO_PTR(af)); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-address-families-allow-list="))) { + r = parse_boolean(val); + if (r < 0) + return r; + c->address_families_allow_list = r; + } else if ((val = startswith(l, "exec-context-network-namespace-path="))) { + r = free_and_strdup(&c->network_namespace_path, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-ipc-namespace-path="))) { + r = free_and_strdup(&c->ipc_namespace_path, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-mount-image="))) { + _cleanup_(mount_options_free_allp) MountOptions *options = NULL; + _cleanup_free_ char *source = NULL, *destination = NULL; + bool permissive = false; + char *s; + + r = extract_many_words(&val, + NULL, + EXTRACT_UNQUOTE|EXTRACT_CUNESCAPE|EXTRACT_UNESCAPE_SEPARATORS, + &source, + &destination, + NULL); + if (r < 0) + return r; + if (r == 0) + return -EINVAL; + + s = source; + if (s[0] == '-') { + permissive = true; + s++; + } + + if (isempty(destination)) + continue; + + for (;;) { + _cleanup_free_ char *tuple = NULL, *partition = NULL, *opts = NULL; + PartitionDesignator partition_designator; + MountOptions *o = NULL; + const char *p; + + r = extract_first_word(&val, &tuple, NULL, EXTRACT_UNQUOTE|EXTRACT_RETAIN_ESCAPE); + if (r < 0) + return r; + if (r == 0) + break; + + p = tuple; + r = extract_many_words(&p, + ":", + EXTRACT_CUNESCAPE|EXTRACT_UNESCAPE_SEPARATORS, + &partition, + &opts, + NULL); + if (r < 0) + return r; + if (r == 0) + continue; + if (r == 1) { + o = new(MountOptions, 1); + if (!o) + return log_oom_debug(); + *o = (MountOptions) { + .partition_designator = PARTITION_ROOT, + .options = TAKE_PTR(partition), + }; + LIST_APPEND(mount_options, options, o); + + continue; + } + + partition_designator = partition_designator_from_string(partition); + if (partition_designator < 0) + continue; + + o = new(MountOptions, 1); + if (!o) + return log_oom_debug(); + *o = (MountOptions) { + .partition_designator = partition_designator, + .options = TAKE_PTR(opts), + }; + LIST_APPEND(mount_options, options, o); + } + + r = mount_image_add(&c->mount_images, &c->n_mount_images, + &(MountImage) { + .source = s, + .destination = destination, + .mount_options = options, + .ignore_enoent = permissive, + .type = MOUNT_IMAGE_DISCRETE, + }); + if (r < 0) + return log_oom_debug(); + } else if ((val = startswith(l, "exec-context-extension-image="))) { + _cleanup_(mount_options_free_allp) MountOptions *options = NULL; + _cleanup_free_ char *source = NULL; + bool permissive = false; + char *s; + + r = extract_first_word(&val, + &source, + NULL, + EXTRACT_UNQUOTE|EXTRACT_CUNESCAPE|EXTRACT_UNESCAPE_SEPARATORS); + if (r < 0) + return r; + if (r == 0) + return -EINVAL; + + s = source; + if (s[0] == '-') { + permissive = true; + s++; + } + + for (;;) { + _cleanup_free_ char *tuple = NULL, *partition = NULL, *opts = NULL; + PartitionDesignator partition_designator; + MountOptions *o = NULL; + const char *p; + + r = extract_first_word(&val, &tuple, NULL, EXTRACT_UNQUOTE|EXTRACT_RETAIN_ESCAPE); + if (r < 0) + return r; + if (r == 0) + break; + + p = tuple; + r = extract_many_words(&p, + ":", + EXTRACT_CUNESCAPE|EXTRACT_UNESCAPE_SEPARATORS, + &partition, + &opts, + NULL); + if (r < 0) + return r; + if (r == 0) + continue; + if (r == 1) { + o = new(MountOptions, 1); + if (!o) + return log_oom_debug(); + *o = (MountOptions) { + .partition_designator = PARTITION_ROOT, + .options = TAKE_PTR(partition), + }; + LIST_APPEND(mount_options, options, o); + + continue; + } + + partition_designator = partition_designator_from_string(partition); + if (partition_designator < 0) + continue; + + o = new(MountOptions, 1); + if (!o) + return log_oom_debug(); + *o = (MountOptions) { + .partition_designator = partition_designator, + .options = TAKE_PTR(opts), + }; + LIST_APPEND(mount_options, options, o); + } + + r = mount_image_add(&c->extension_images, &c->n_extension_images, + &(MountImage) { + .source = s, + .mount_options = options, + .ignore_enoent = permissive, + .type = MOUNT_IMAGE_EXTENSION, + }); + if (r < 0) + return log_oom_debug(); + } else if ((val = startswith(l, "exec-context-extension-directories="))) { + r = deserialize_strv(&c->extension_directories, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-set-credentials="))) { + _cleanup_(exec_set_credential_freep) ExecSetCredential *sc = NULL; + _cleanup_free_ char *id = NULL, *encrypted = NULL, *data = NULL; + + r = extract_many_words(&val, " ", 0, &id, &encrypted, &data, NULL); + if (r < 0) + return r; + if (r != 3) + return -EINVAL; + + r = parse_boolean(encrypted); + if (r < 0) + return r; + + sc = new(ExecSetCredential, 1); + if (!sc) + return -ENOMEM; + + *sc = (ExecSetCredential) { + .id = TAKE_PTR(id), + .encrypted = r, + }; + + r = unbase64mem(data, strlen(data), &sc->data, &sc->size); + if (r < 0) + return r; + + r = hashmap_ensure_put(&c->set_credentials, &exec_set_credential_hash_ops, sc->id, sc); + if (r < 0) + return r; + + TAKE_PTR(sc); + } else if ((val = startswith(l, "exec-context-load-credentials="))) { + _cleanup_(exec_load_credential_freep) ExecLoadCredential *lc = NULL; + _cleanup_free_ char *id = NULL, *encrypted = NULL, *path = NULL; + + r = extract_many_words(&val, " ", 0, &id, &encrypted, &path, NULL); + if (r < 0) + return r; + if (r != 3) + return -EINVAL; + + r = parse_boolean(encrypted); + if (r < 0) + return r; + + lc = new(ExecLoadCredential, 1); + if (!lc) + return -ENOMEM; + + *lc = (ExecLoadCredential) { + .id = TAKE_PTR(id), + .path = TAKE_PTR(path), + .encrypted = r, + }; + + r = hashmap_ensure_put(&c->load_credentials, &exec_load_credential_hash_ops, lc->id, lc); + if (r < 0) + return r; + + TAKE_PTR(lc); + } else if ((val = startswith(l, "exec-context-import-credentials="))) { + r = set_ensure_allocated(&c->import_credentials, &string_hash_ops); + if (r < 0) + return r; + + r = set_put_strdup(&c->import_credentials, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-root-image-policy="))) { + if (c->root_image_policy) + return -EINVAL; /* duplicated */ + + r = image_policy_from_string(val, &c->root_image_policy); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-mount-image-policy="))) { + if (c->mount_image_policy) + return -EINVAL; /* duplicated */ + + r = image_policy_from_string(val, &c->mount_image_policy); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-context-extension-image-policy="))) { + if (c->extension_image_policy) + return -EINVAL; /* duplicated */ + + r = image_policy_from_string(val, &c->extension_image_policy); + if (r < 0) + return r; + } else + log_warning("Failed to parse serialized line, ignoring: %s", l); + } + + return 0; +} + +static int exec_command_serialize(const ExecCommand *c, FILE *f) { + int r; + + assert(c); + assert(f); + + r = serialize_item(f, "exec-command-path", c->path); + if (r < 0) + return r; + + r = serialize_strv(f, "exec-command-argv", c->argv); + if (r < 0) + return r; + + r = serialize_item_format(f, "exec-command-flags", "%d", (int) c->flags); + if (r < 0) + return r; + + fputc('\n', f); /* End marker */ + + return 0; +} + +static int exec_command_deserialize(ExecCommand *c, FILE *f) { + int r; + + assert(c); + assert(f); + + for (;;) { + _cleanup_free_ char *l = NULL; + const char *val; + + r = deserialize_read_line(f, &l); + if (r < 0) + return r; + if (r == 0) /* eof or end marker */ + break; + + if ((val = startswith(l, "exec-command-path="))) { + r = free_and_strdup(&c->path, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-command-argv="))) { + r = deserialize_strv(&c->argv, val); + if (r < 0) + return r; + } else if ((val = startswith(l, "exec-command-flags="))) { + r = safe_atoi(val, &c->flags); + if (r < 0) + return r; + } else + log_warning("Failed to parse serialized line, ignorning: %s", l); + + } + + return 0; +} + +int exec_serialize_invocation( + FILE *f, + FDSet *fds, + const ExecContext *ctx, + const ExecCommand *cmd, + const ExecParameters *p, + const ExecRuntime *rt, + const CGroupContext *cg) { + + int r; + + assert(f); + assert(fds); + + r = exec_context_serialize(ctx, f); + if (r < 0) + return log_debug_errno(r, "Failed to serialize context: %m"); + + r = exec_command_serialize(cmd, f); + if (r < 0) + return log_debug_errno(r, "Failed to serialize command: %m"); + + r = exec_parameters_serialize(p, f, fds); + if (r < 0) + return log_debug_errno(r, "Failed to serialize parameters: %m"); + + r = exec_runtime_serialize(rt, f, fds); + if (r < 0) + return log_debug_errno(r, "Failed to serialize runtime: %m"); + + r = exec_cgroup_context_serialize(cg, f); + if (r < 0) + return log_debug_errno(r, "Failed to serialize cgroup context: %m"); + + return 0; +} + +int exec_deserialize_invocation( + FILE *f, + FDSet *fds, + ExecContext *ctx, + ExecCommand *cmd, + ExecParameters *p, + ExecRuntime *rt, + CGroupContext *cg) { + + int r; + + assert(f); + assert(fds); + + r = exec_context_deserialize(ctx, f); + if (r < 0) + return log_debug_errno(r, "Failed to deserialize context: %m"); + + r = exec_command_deserialize(cmd, f); + if (r < 0) + return log_debug_errno(r, "Failed to deserialize command: %m"); + + r = exec_parameters_deserialize(p, f, fds); + if (r < 0) + return log_debug_errno(r, "Failed to deserialize parameters: %m"); + + r = exec_runtime_deserialize(rt, f, fds); + if (r < 0) + return log_debug_errno(r, "Failed to deserialize runtime: %m"); + + r = exec_cgroup_context_deserialize(cg, f); + if (r < 0) + return log_debug_errno(r, "Failed to deserialize cgroup context: %m"); + + return 0; +} diff --git a/src/core/execute-serialize.h b/src/core/execute-serialize.h new file mode 100644 index 0000000000..89c8e09edb --- /dev/null +++ b/src/core/execute-serialize.h @@ -0,0 +1,23 @@ +/* SPDX-License-Identifier: LGPL-2.1-or-later */ +#pragma once + +#include "execute.h" + +/* These functions serialize/deserialize for invocation purposes (i.e.: serialized object is passed to a + * child process) rather than to save state across reload/reexec. */ + +int exec_serialize_invocation(FILE *f, + FDSet *fds, + const ExecContext *ctx, + const ExecCommand *cmd, + const ExecParameters *p, + const ExecRuntime *rt, + const CGroupContext *cg); + +int exec_deserialize_invocation(FILE *f, + FDSet *fds, + ExecContext *ctx, + ExecCommand *cmd, + ExecParameters *p, + ExecRuntime *rt, + CGroupContext *cg); diff --git a/src/core/execute.c b/src/core/execute.c index ffbe0832f4..e4e4008cc8 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -3,9 +3,7 @@ #include #include #include -#include #include -#include #include #include #include @@ -17,51 +15,29 @@ #include /* Must be included after */ -#if HAVE_PAM -#include -#endif - -#if HAVE_SELINUX -#include -#endif - -#if HAVE_APPARMOR -#include -#endif - #include "sd-messages.h" #include "af-list.h" #include "alloc-util.h" -#if HAVE_APPARMOR -#include "apparmor-util.h" -#endif -#include "argv-util.h" #include "async.h" -#include "barrier.h" -#include "bpf-lsm.h" -#include "btrfs-util.h" #include "cap-list.h" #include "capability-util.h" -#include "chattr-util.h" #include "cgroup-setup.h" -#include "chase.h" -#include "chown-recursive.h" #include "constants.h" #include "cpu-set-util.h" -#include "data-fd-util.h" #include "env-file.h" #include "env-util.h" #include "errno-list.h" #include "escape.h" #include "exec-credential.h" #include "execute.h" +#include "execute-serialize.h" #include "exit-status.h" #include "fd-util.h" +#include "fileio.h" #include "format-util.h" #include "glob-util.h" #include "hexdecoct.h" -#include "io-util.h" #include "ioprio-util.h" #include "lock-util.h" #include "log.h" @@ -70,23 +46,18 @@ #include "manager-dump.h" #include "memory-util.h" #include "missing_fs.h" -#include "missing_ioprio.h" #include "missing_prctl.h" #include "mkdir-label.h" #include "namespace.h" #include "parse-util.h" #include "path-util.h" -#include "proc-cmdline.h" #include "process-util.h" -#include "psi-util.h" #include "rlimit-util.h" #include "rm-rf.h" #include "seccomp-util.h" #include "securebits-util.h" #include "selinux-util.h" -#include "signal-util.h" -#include "smack-util.h" -#include "socket-util.h" +#include "serialize.h" #include "sort-util.h" #include "special.h" #include "stat-util.h" @@ -101,88 +72,7 @@ #include "user-util.h" #include "utmp-wtmp.h" -#define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC) -#define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC) - -#define SNDBUF_SIZE (8*1024*1024) - -static int shift_fds(int fds[], size_t n_fds) { - if (n_fds <= 0) - return 0; - - /* Modifies the fds array! (sorts it) */ - - assert(fds); - - for (int start = 0;;) { - int restart_from = -1; - - for (int i = start; i < (int) n_fds; i++) { - int nfd; - - /* Already at right index? */ - if (fds[i] == i+3) - continue; - - nfd = fcntl(fds[i], F_DUPFD, i + 3); - if (nfd < 0) - return -errno; - - safe_close(fds[i]); - fds[i] = nfd; - - /* Hmm, the fd we wanted isn't free? Then - * let's remember that and try again from here */ - if (nfd != i+3 && restart_from < 0) - restart_from = i; - } - - if (restart_from < 0) - break; - - start = restart_from; - } - - return 0; -} - -static int flags_fds( - const int fds[], - size_t n_socket_fds, - size_t n_fds, - bool nonblock) { - - int r; - - if (n_fds <= 0) - return 0; - - assert(fds); - - /* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags. - * O_NONBLOCK only applies to socket activation though. */ - - for (size_t i = 0; i < n_fds; i++) { - - if (i < n_socket_fds) { - r = fd_nonblock(fds[i], nonblock); - if (r < 0) - return r; - } - - /* We unconditionally drop FD_CLOEXEC from the fds, - * since after all we want to pass these fds to our - * children */ - - r = fd_cloexec(fds[i], false); - if (r < 0) - return r; - } - - return 0; -} - -static const char *exec_context_tty_path(const ExecContext *context) { +const char *exec_context_tty_path(const ExecContext *context) { assert(context); if (context->stdio_as_fds) @@ -194,7 +84,7 @@ static const char *exec_context_tty_path(const ExecContext *context) { return "/dev/console"; } -static int exec_context_tty_size(const ExecContext *context, unsigned *ret_rows, unsigned *ret_cols) { +int exec_context_tty_size(const ExecContext *context, unsigned *ret_rows, unsigned *ret_cols) { unsigned rows, cols; const char *tty; @@ -215,7 +105,7 @@ static int exec_context_tty_size(const ExecContext *context, unsigned *ret_rows, return 0; } -static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) { +void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) { _cleanup_close_ int fd = -EBADF; const char *path = exec_context_tty_path(ASSERT_PTR(context)); @@ -270,1872 +160,6 @@ static bool is_terminal_output(ExecOutput o) { EXEC_OUTPUT_JOURNAL_AND_CONSOLE); } -static bool is_kmsg_output(ExecOutput o) { - return IN_SET(o, - EXEC_OUTPUT_KMSG, - EXEC_OUTPUT_KMSG_AND_CONSOLE); -} - -static bool exec_context_needs_term(const ExecContext *c) { - assert(c); - - /* Return true if the execution context suggests we should set $TERM to something useful. */ - - if (is_terminal_input(c->std_input)) - return true; - - if (is_terminal_output(c->std_output)) - return true; - - if (is_terminal_output(c->std_error)) - return true; - - return !!c->tty_path; -} - -static int open_null_as(int flags, int nfd) { - int fd; - - assert(nfd >= 0); - - fd = open("/dev/null", flags|O_NOCTTY); - if (fd < 0) - return -errno; - - return move_fd(fd, nfd, false); -} - -static int connect_journal_socket( - int fd, - const char *log_namespace, - uid_t uid, - gid_t gid) { - - uid_t olduid = UID_INVALID; - gid_t oldgid = GID_INVALID; - const char *j; - int r; - - j = log_namespace ? - strjoina("/run/systemd/journal.", log_namespace, "/stdout") : - "/run/systemd/journal/stdout"; - - if (gid_is_valid(gid)) { - oldgid = getgid(); - - if (setegid(gid) < 0) - return -errno; - } - - if (uid_is_valid(uid)) { - olduid = getuid(); - - if (seteuid(uid) < 0) { - r = -errno; - goto restore_gid; - } - } - - r = connect_unix_path(fd, AT_FDCWD, j); - - /* If we fail to restore the uid or gid, things will likely fail later on. This should only happen if - an LSM interferes. */ - - if (uid_is_valid(uid)) - (void) seteuid(olduid); - - restore_gid: - if (gid_is_valid(gid)) - (void) setegid(oldgid); - - return r; -} - -static int connect_logger_as( - const Unit *unit, - const ExecContext *context, - const ExecParameters *params, - ExecOutput output, - const char *ident, - int nfd, - uid_t uid, - gid_t gid) { - - _cleanup_close_ int fd = -EBADF; - int r; - - assert(context); - assert(params); - assert(output < _EXEC_OUTPUT_MAX); - assert(ident); - assert(nfd >= 0); - - fd = socket(AF_UNIX, SOCK_STREAM, 0); - if (fd < 0) - return -errno; - - r = connect_journal_socket(fd, context->log_namespace, uid, gid); - if (r < 0) - return r; - - if (shutdown(fd, SHUT_RD) < 0) - return -errno; - - (void) fd_inc_sndbuf(fd, SNDBUF_SIZE); - - if (dprintf(fd, - "%s\n" - "%s\n" - "%i\n" - "%i\n" - "%i\n" - "%i\n" - "%i\n", - context->syslog_identifier ?: ident, - params->flags & EXEC_PASS_LOG_UNIT ? unit->id : "", - context->syslog_priority, - !!context->syslog_level_prefix, - false, - is_kmsg_output(output), - is_terminal_output(output)) < 0) - return -errno; - - return move_fd(TAKE_FD(fd), nfd, false); -} - -static int open_terminal_as(const char *path, int flags, int nfd) { - int fd; - - assert(path); - assert(nfd >= 0); - - fd = open_terminal(path, flags | O_NOCTTY); - if (fd < 0) - return fd; - - return move_fd(fd, nfd, false); -} - -static int acquire_path(const char *path, int flags, mode_t mode) { - _cleanup_close_ int fd = -EBADF; - int r; - - assert(path); - - if (IN_SET(flags & O_ACCMODE, O_WRONLY, O_RDWR)) - flags |= O_CREAT; - - fd = open(path, flags|O_NOCTTY, mode); - if (fd >= 0) - return TAKE_FD(fd); - - if (errno != ENXIO) /* ENXIO is returned when we try to open() an AF_UNIX file system socket on Linux */ - return -errno; - - /* So, it appears the specified path could be an AF_UNIX socket. Let's see if we can connect to it. */ - - fd = socket(AF_UNIX, SOCK_STREAM, 0); - if (fd < 0) - return -errno; - - r = connect_unix_path(fd, AT_FDCWD, path); - if (IN_SET(r, -ENOTSOCK, -EINVAL)) - /* Propagate initial error if we get ENOTSOCK or EINVAL, i.e. we have indication that this - * wasn't an AF_UNIX socket after all */ - return -ENXIO; - if (r < 0) - return r; - - if ((flags & O_ACCMODE) == O_RDONLY) - r = shutdown(fd, SHUT_WR); - else if ((flags & O_ACCMODE) == O_WRONLY) - r = shutdown(fd, SHUT_RD); - else - r = 0; - if (r < 0) - return -errno; - - return TAKE_FD(fd); -} - -static int fixup_input( - const ExecContext *context, - int socket_fd, - bool apply_tty_stdin) { - - ExecInput std_input; - - assert(context); - - std_input = context->std_input; - - if (is_terminal_input(std_input) && !apply_tty_stdin) - return EXEC_INPUT_NULL; - - if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0) - return EXEC_INPUT_NULL; - - if (std_input == EXEC_INPUT_DATA && context->stdin_data_size == 0) - return EXEC_INPUT_NULL; - - return std_input; -} - -static int fixup_output(ExecOutput output, int socket_fd) { - - if (output == EXEC_OUTPUT_SOCKET && socket_fd < 0) - return EXEC_OUTPUT_INHERIT; - - return output; -} - -static int setup_input( - const ExecContext *context, - const ExecParameters *params, - int socket_fd, - const int named_iofds[static 3]) { - - ExecInput i; - int r; - - assert(context); - assert(params); - assert(named_iofds); - - if (params->stdin_fd >= 0) { - if (dup2(params->stdin_fd, STDIN_FILENO) < 0) - return -errno; - - /* Try to make this the controlling tty, if it is a tty, and reset it */ - if (isatty(STDIN_FILENO)) { - unsigned rows = context->tty_rows, cols = context->tty_cols; - - (void) exec_context_tty_size(context, &rows, &cols); - (void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE); - (void) reset_terminal_fd(STDIN_FILENO, true); - (void) terminal_set_size_fd(STDIN_FILENO, NULL, rows, cols); - } - - return STDIN_FILENO; - } - - i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN); - - switch (i) { - - case EXEC_INPUT_NULL: - return open_null_as(O_RDONLY, STDIN_FILENO); - - case EXEC_INPUT_TTY: - case EXEC_INPUT_TTY_FORCE: - case EXEC_INPUT_TTY_FAIL: { - unsigned rows, cols; - int fd; - - fd = acquire_terminal(exec_context_tty_path(context), - i == EXEC_INPUT_TTY_FAIL ? ACQUIRE_TERMINAL_TRY : - i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE : - ACQUIRE_TERMINAL_WAIT, - USEC_INFINITY); - if (fd < 0) - return fd; - - r = exec_context_tty_size(context, &rows, &cols); - if (r < 0) - return r; - - r = terminal_set_size_fd(fd, exec_context_tty_path(context), rows, cols); - if (r < 0) - return r; - - return move_fd(fd, STDIN_FILENO, false); - } - - case EXEC_INPUT_SOCKET: - assert(socket_fd >= 0); - - return RET_NERRNO(dup2(socket_fd, STDIN_FILENO)); - - case EXEC_INPUT_NAMED_FD: - assert(named_iofds[STDIN_FILENO] >= 0); - - (void) fd_nonblock(named_iofds[STDIN_FILENO], false); - return RET_NERRNO(dup2(named_iofds[STDIN_FILENO], STDIN_FILENO)); - - case EXEC_INPUT_DATA: { - int fd; - - fd = acquire_data_fd(context->stdin_data, context->stdin_data_size, 0); - if (fd < 0) - return fd; - - return move_fd(fd, STDIN_FILENO, false); - } - - case EXEC_INPUT_FILE: { - bool rw; - int fd; - - assert(context->stdio_file[STDIN_FILENO]); - - rw = (context->std_output == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDOUT_FILENO])) || - (context->std_error == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDERR_FILENO])); - - fd = acquire_path(context->stdio_file[STDIN_FILENO], rw ? O_RDWR : O_RDONLY, 0666 & ~context->umask); - if (fd < 0) - return fd; - - return move_fd(fd, STDIN_FILENO, false); - } - - default: - assert_not_reached(); - } -} - -static bool can_inherit_stderr_from_stdout( - const ExecContext *context, - ExecOutput o, - ExecOutput e) { - - assert(context); - - /* Returns true, if given the specified STDERR and STDOUT output we can directly dup() the stdout fd to the - * stderr fd */ - - if (e == EXEC_OUTPUT_INHERIT) - return true; - if (e != o) - return false; - - if (e == EXEC_OUTPUT_NAMED_FD) - return streq_ptr(context->stdio_fdname[STDOUT_FILENO], context->stdio_fdname[STDERR_FILENO]); - - if (IN_SET(e, EXEC_OUTPUT_FILE, EXEC_OUTPUT_FILE_APPEND, EXEC_OUTPUT_FILE_TRUNCATE)) - return streq_ptr(context->stdio_file[STDOUT_FILENO], context->stdio_file[STDERR_FILENO]); - - return true; -} - -static int setup_output( - const Unit *unit, - const ExecContext *context, - const ExecParameters *params, - int fileno, - int socket_fd, - const int named_iofds[static 3], - const char *ident, - uid_t uid, - gid_t gid, - dev_t *journal_stream_dev, - ino_t *journal_stream_ino) { - - ExecOutput o; - ExecInput i; - int r; - - assert(unit); - assert(context); - assert(params); - assert(ident); - assert(journal_stream_dev); - assert(journal_stream_ino); - - if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) { - - if (dup2(params->stdout_fd, STDOUT_FILENO) < 0) - return -errno; - - return STDOUT_FILENO; - } - - if (fileno == STDERR_FILENO && params->stderr_fd >= 0) { - if (dup2(params->stderr_fd, STDERR_FILENO) < 0) - return -errno; - - return STDERR_FILENO; - } - - i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN); - o = fixup_output(context->std_output, socket_fd); - - if (fileno == STDERR_FILENO) { - ExecOutput e; - e = fixup_output(context->std_error, socket_fd); - - /* This expects the input and output are already set up */ - - /* Don't change the stderr file descriptor if we inherit all - * the way and are not on a tty */ - if (e == EXEC_OUTPUT_INHERIT && - o == EXEC_OUTPUT_INHERIT && - i == EXEC_INPUT_NULL && - !is_terminal_input(context->std_input) && - getppid() != 1) - return fileno; - - /* Duplicate from stdout if possible */ - if (can_inherit_stderr_from_stdout(context, o, e)) - return RET_NERRNO(dup2(STDOUT_FILENO, fileno)); - - o = e; - - } else if (o == EXEC_OUTPUT_INHERIT) { - /* If input got downgraded, inherit the original value */ - if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input)) - return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno); - - /* If the input is connected to anything that's not a /dev/null or a data fd, inherit that... */ - if (!IN_SET(i, EXEC_INPUT_NULL, EXEC_INPUT_DATA)) - return RET_NERRNO(dup2(STDIN_FILENO, fileno)); - - /* If we are not started from PID 1 we just inherit STDOUT from our parent process. */ - if (getppid() != 1) - return fileno; - - /* We need to open /dev/null here anew, to get the right access mode. */ - return open_null_as(O_WRONLY, fileno); - } - - switch (o) { - - case EXEC_OUTPUT_NULL: - return open_null_as(O_WRONLY, fileno); - - case EXEC_OUTPUT_TTY: - if (is_terminal_input(i)) - return RET_NERRNO(dup2(STDIN_FILENO, fileno)); - - /* We don't reset the terminal if this is just about output */ - return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno); - - case EXEC_OUTPUT_KMSG: - case EXEC_OUTPUT_KMSG_AND_CONSOLE: - case EXEC_OUTPUT_JOURNAL: - case EXEC_OUTPUT_JOURNAL_AND_CONSOLE: - r = connect_logger_as(unit, context, params, o, ident, fileno, uid, gid); - if (r < 0) { - log_unit_warning_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m", - fileno == STDOUT_FILENO ? "stdout" : "stderr"); - r = open_null_as(O_WRONLY, fileno); - } else { - struct stat st; - - /* If we connected this fd to the journal via a stream, patch the device/inode into the passed - * parameters, but only then. This is useful so that we can set $JOURNAL_STREAM that permits - * services to detect whether they are connected to the journal or not. - * - * If both stdout and stderr are connected to a stream then let's make sure to store the data - * about STDERR as that's usually the best way to do logging. */ - - if (fstat(fileno, &st) >= 0 && - (*journal_stream_ino == 0 || fileno == STDERR_FILENO)) { - *journal_stream_dev = st.st_dev; - *journal_stream_ino = st.st_ino; - } - } - return r; - - case EXEC_OUTPUT_SOCKET: - assert(socket_fd >= 0); - - return RET_NERRNO(dup2(socket_fd, fileno)); - - case EXEC_OUTPUT_NAMED_FD: - assert(named_iofds[fileno] >= 0); - - (void) fd_nonblock(named_iofds[fileno], false); - return RET_NERRNO(dup2(named_iofds[fileno], fileno)); - - case EXEC_OUTPUT_FILE: - case EXEC_OUTPUT_FILE_APPEND: - case EXEC_OUTPUT_FILE_TRUNCATE: { - bool rw; - int fd, flags; - - assert(context->stdio_file[fileno]); - - rw = context->std_input == EXEC_INPUT_FILE && - streq_ptr(context->stdio_file[fileno], context->stdio_file[STDIN_FILENO]); - - if (rw) - return RET_NERRNO(dup2(STDIN_FILENO, fileno)); - - flags = O_WRONLY; - if (o == EXEC_OUTPUT_FILE_APPEND) - flags |= O_APPEND; - else if (o == EXEC_OUTPUT_FILE_TRUNCATE) - flags |= O_TRUNC; - - fd = acquire_path(context->stdio_file[fileno], flags, 0666 & ~context->umask); - if (fd < 0) - return fd; - - return move_fd(fd, fileno, 0); - } - - default: - assert_not_reached(); - } -} - -static int chown_terminal(int fd, uid_t uid) { - int r; - - assert(fd >= 0); - - /* Before we chown/chmod the TTY, let's ensure this is actually a tty */ - if (isatty(fd) < 1) { - if (IN_SET(errno, EINVAL, ENOTTY)) - return 0; /* not a tty */ - - return -errno; - } - - /* This might fail. What matters are the results. */ - r = fchmod_and_chown(fd, TTY_MODE, uid, GID_INVALID); - if (r < 0) - return r; - - return 1; -} - -static int setup_confirm_stdio( - const ExecContext *context, - const char *vc, - int *ret_saved_stdin, - int *ret_saved_stdout) { - - _cleanup_close_ int fd = -EBADF, saved_stdin = -EBADF, saved_stdout = -EBADF; - unsigned rows, cols; - int r; - - assert(ret_saved_stdin); - assert(ret_saved_stdout); - - saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3); - if (saved_stdin < 0) - return -errno; - - saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3); - if (saved_stdout < 0) - return -errno; - - fd = acquire_terminal(vc, ACQUIRE_TERMINAL_WAIT, DEFAULT_CONFIRM_USEC); - if (fd < 0) - return fd; - - r = chown_terminal(fd, getuid()); - if (r < 0) - return r; - - r = reset_terminal_fd(fd, true); - if (r < 0) - return r; - - r = exec_context_tty_size(context, &rows, &cols); - if (r < 0) - return r; - - r = terminal_set_size_fd(fd, vc, rows, cols); - if (r < 0) - return r; - - r = rearrange_stdio(fd, fd, STDERR_FILENO); /* Invalidates 'fd' also on failure */ - TAKE_FD(fd); - if (r < 0) - return r; - - *ret_saved_stdin = TAKE_FD(saved_stdin); - *ret_saved_stdout = TAKE_FD(saved_stdout); - return 0; -} - -static void write_confirm_error_fd(int err, int fd, const Unit *u) { - assert(err < 0); - - if (err == -ETIMEDOUT) - dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id); - else { - errno = -err; - dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id); - } -} - -static void write_confirm_error(int err, const char *vc, const Unit *u) { - _cleanup_close_ int fd = -EBADF; - - assert(vc); - - fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC); - if (fd < 0) - return; - - write_confirm_error_fd(err, fd, u); -} - -static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) { - int r = 0; - - assert(saved_stdin); - assert(saved_stdout); - - release_terminal(); - - if (*saved_stdin >= 0) - if (dup2(*saved_stdin, STDIN_FILENO) < 0) - r = -errno; - - if (*saved_stdout >= 0) - if (dup2(*saved_stdout, STDOUT_FILENO) < 0) - r = -errno; - - *saved_stdin = safe_close(*saved_stdin); - *saved_stdout = safe_close(*saved_stdout); - - return r; -} - -enum { - CONFIRM_PRETEND_FAILURE = -1, - CONFIRM_PRETEND_SUCCESS = 0, - CONFIRM_EXECUTE = 1, -}; - -static int ask_for_confirmation(const ExecContext *context, const char *vc, Unit *u, const char *cmdline) { - int saved_stdout = -1, saved_stdin = -1, r; - _cleanup_free_ char *e = NULL; - char c; - - /* For any internal errors, assume a positive response. */ - r = setup_confirm_stdio(context, vc, &saved_stdin, &saved_stdout); - if (r < 0) { - write_confirm_error(r, vc, u); - return CONFIRM_EXECUTE; - } - - /* confirm_spawn might have been disabled while we were sleeping. */ - if (manager_is_confirm_spawn_disabled(u->manager)) { - r = 1; - goto restore_stdio; - } - - e = ellipsize(cmdline, 60, 100); - if (!e) { - log_oom(); - r = CONFIRM_EXECUTE; - goto restore_stdio; - } - - for (;;) { - r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e); - if (r < 0) { - write_confirm_error_fd(r, STDOUT_FILENO, u); - r = CONFIRM_EXECUTE; - goto restore_stdio; - } - - switch (c) { - case 'c': - printf("Resuming normal execution.\n"); - manager_disable_confirm_spawn(); - r = 1; - break; - case 'D': - unit_dump(u, stdout, " "); - continue; /* ask again */ - case 'f': - printf("Failing execution.\n"); - r = CONFIRM_PRETEND_FAILURE; - break; - case 'h': - printf(" c - continue, proceed without asking anymore\n" - " D - dump, show the state of the unit\n" - " f - fail, don't execute the command and pretend it failed\n" - " h - help\n" - " i - info, show a short summary of the unit\n" - " j - jobs, show jobs that are in progress\n" - " s - skip, don't execute the command and pretend it succeeded\n" - " y - yes, execute the command\n"); - continue; /* ask again */ - case 'i': - printf(" Description: %s\n" - " Unit: %s\n" - " Command: %s\n", - u->id, u->description, cmdline); - continue; /* ask again */ - case 'j': - manager_dump_jobs(u->manager, stdout, /* patterns= */ NULL, " "); - continue; /* ask again */ - case 'n': - /* 'n' was removed in favor of 'f'. */ - printf("Didn't understand 'n', did you mean 'f'?\n"); - continue; /* ask again */ - case 's': - printf("Skipping execution.\n"); - r = CONFIRM_PRETEND_SUCCESS; - break; - case 'y': - r = CONFIRM_EXECUTE; - break; - default: - assert_not_reached(); - } - break; - } - -restore_stdio: - restore_confirm_stdio(&saved_stdin, &saved_stdout); - return r; -} - -static int get_fixed_user( - const char *username, - const char **ret_user, - uid_t *ret_uid, - gid_t *ret_gid, - const char **ret_home, - const char **ret_shell) { - - int r; - - assert(username); - assert(ret_user); - - /* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway - * (i.e. are "/" or "/bin/nologin"). */ - - r = get_user_creds(&username, ret_uid, ret_gid, ret_home, ret_shell, USER_CREDS_CLEAN); - if (r < 0) - return r; - - *ret_user = username; - return 0; -} - -static int get_fixed_group( - const char *groupname, - const char **ret_group, - gid_t *ret_gid) { - - int r; - - assert(groupname); - assert(ret_group); - - r = get_group_creds(&groupname, ret_gid, /* flags = */ 0); - if (r < 0) - return r; - - *ret_group = groupname; - return 0; -} - -static int get_supplementary_groups(const ExecContext *c, const char *user, - const char *group, gid_t gid, - gid_t **supplementary_gids, int *ngids) { - int r, k = 0; - int ngroups_max; - bool keep_groups = false; - gid_t *groups = NULL; - _cleanup_free_ gid_t *l_gids = NULL; - - assert(c); - - /* - * If user is given, then lookup GID and supplementary groups list. - * We avoid NSS lookups for gid=0. Also we have to initialize groups - * here and as early as possible so we keep the list of supplementary - * groups of the caller. - */ - if (user && gid_is_valid(gid) && gid != 0) { - /* First step, initialize groups from /etc/groups */ - if (initgroups(user, gid) < 0) - return -errno; - - keep_groups = true; - } - - if (strv_isempty(c->supplementary_groups)) - return 0; - - /* - * If SupplementaryGroups= was passed then NGROUPS_MAX has to - * be positive, otherwise fail. - */ - errno = 0; - ngroups_max = (int) sysconf(_SC_NGROUPS_MAX); - if (ngroups_max <= 0) - return errno_or_else(EOPNOTSUPP); - - l_gids = new(gid_t, ngroups_max); - if (!l_gids) - return -ENOMEM; - - if (keep_groups) { - /* - * Lookup the list of groups that the user belongs to, we - * avoid NSS lookups here too for gid=0. - */ - k = ngroups_max; - if (getgrouplist(user, gid, l_gids, &k) < 0) - return -EINVAL; - } else - k = 0; - - STRV_FOREACH(i, c->supplementary_groups) { - const char *g; - - if (k >= ngroups_max) - return -E2BIG; - - g = *i; - r = get_group_creds(&g, l_gids+k, 0); - if (r < 0) - return r; - - k++; - } - - /* - * Sets ngids to zero to drop all supplementary groups, happens - * when we are under root and SupplementaryGroups= is empty. - */ - if (k == 0) { - *ngids = 0; - return 0; - } - - /* Otherwise get the final list of supplementary groups */ - groups = memdup(l_gids, sizeof(gid_t) * k); - if (!groups) - return -ENOMEM; - - *supplementary_gids = groups; - *ngids = k; - - groups = NULL; - - return 0; -} - -static int enforce_groups(gid_t gid, const gid_t *supplementary_gids, int ngids) { - int r; - - /* Handle SupplementaryGroups= if it is not empty */ - if (ngids > 0) { - r = maybe_setgroups(ngids, supplementary_gids); - if (r < 0) - return r; - } - - if (gid_is_valid(gid)) { - /* Then set our gids */ - if (setresgid(gid, gid, gid) < 0) - return -errno; - } - - return 0; -} - -static int set_securebits(unsigned bits, unsigned mask) { - unsigned applied; - int current; - - current = prctl(PR_GET_SECUREBITS); - if (current < 0) - return -errno; - - /* Clear all securebits defined in mask and set bits */ - applied = ((unsigned) current & ~mask) | bits; - if ((unsigned) current == applied) - return 0; - - if (prctl(PR_SET_SECUREBITS, applied) < 0) - return -errno; - - return 1; -} - -static int enforce_user( - const ExecContext *context, - uid_t uid, - uint64_t capability_ambient_set) { - assert(context); - int r; - - if (!uid_is_valid(uid)) - return 0; - - /* Sets (but doesn't look up) the UIS and makes sure we keep the capabilities while doing so. For - * setting secure bits the capability CAP_SETPCAP is required, so we also need keep-caps in this - * case. */ - - if ((capability_ambient_set != 0 || context->secure_bits != 0) && uid != 0) { - - /* First step: If we need to keep capabilities but drop privileges we need to make sure we - * keep our caps, while we drop privileges. Add KEEP_CAPS to the securebits */ - r = set_securebits(1U << SECURE_KEEP_CAPS, 0); - if (r < 0) - return r; - } - - /* Second step: actually set the uids */ - if (setresuid(uid, uid, uid) < 0) - return -errno; - - /* At this point we should have all necessary capabilities but are otherwise a normal user. However, - * the caps might got corrupted due to the setresuid() so we need clean them up later. This is done - * outside of this call. */ - return 0; -} - -#if HAVE_PAM - -static int null_conv( - int num_msg, - const struct pam_message **msg, - struct pam_response **resp, - void *appdata_ptr) { - - /* We don't support conversations */ - - return PAM_CONV_ERR; -} - -#endif - -static int setup_pam( - const char *name, - const char *user, - uid_t uid, - gid_t gid, - const char *tty, - char ***env, /* updated on success */ - const int fds[], size_t n_fds) { - -#if HAVE_PAM - - static const struct pam_conv conv = { - .conv = null_conv, - .appdata_ptr = NULL - }; - - _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL; - _cleanup_strv_free_ char **e = NULL; - pam_handle_t *handle = NULL; - sigset_t old_ss; - int pam_code = PAM_SUCCESS, r; - bool close_session = false; - pid_t pam_pid = 0, parent_pid; - int flags = 0; - - assert(name); - assert(user); - assert(env); - - /* We set up PAM in the parent process, then fork. The child - * will then stay around until killed via PR_GET_PDEATHSIG or - * systemd via the cgroup logic. It will then remove the PAM - * session again. The parent process will exec() the actual - * daemon. We do things this way to ensure that the main PID - * of the daemon is the one we initially fork()ed. */ - - r = barrier_create(&barrier); - if (r < 0) - goto fail; - - if (log_get_max_level() < LOG_DEBUG) - flags |= PAM_SILENT; - - pam_code = pam_start(name, user, &conv, &handle); - if (pam_code != PAM_SUCCESS) { - handle = NULL; - goto fail; - } - - if (!tty) { - _cleanup_free_ char *q = NULL; - - /* Hmm, so no TTY was explicitly passed, but an fd passed to us directly might be a TTY. Let's figure - * out if that's the case, and read the TTY off it. */ - - if (getttyname_malloc(STDIN_FILENO, &q) >= 0) - tty = strjoina("/dev/", q); - } - - if (tty) { - pam_code = pam_set_item(handle, PAM_TTY, tty); - if (pam_code != PAM_SUCCESS) - goto fail; - } - - STRV_FOREACH(nv, *env) { - pam_code = pam_putenv(handle, *nv); - if (pam_code != PAM_SUCCESS) - goto fail; - } - - pam_code = pam_acct_mgmt(handle, flags); - if (pam_code != PAM_SUCCESS) - goto fail; - - pam_code = pam_setcred(handle, PAM_ESTABLISH_CRED | flags); - if (pam_code != PAM_SUCCESS) - log_debug("pam_setcred() failed, ignoring: %s", pam_strerror(handle, pam_code)); - - pam_code = pam_open_session(handle, flags); - if (pam_code != PAM_SUCCESS) - goto fail; - - close_session = true; - - e = pam_getenvlist(handle); - if (!e) { - pam_code = PAM_BUF_ERR; - goto fail; - } - - /* Block SIGTERM, so that we know that it won't get lost in the child */ - - assert_se(sigprocmask_many(SIG_BLOCK, &old_ss, SIGTERM, -1) >= 0); - - parent_pid = getpid_cached(); - - r = safe_fork("(sd-pam)", 0, &pam_pid); - if (r < 0) - goto fail; - if (r == 0) { - int sig, ret = EXIT_PAM; - - /* The child's job is to reset the PAM session on termination */ - barrier_set_role(&barrier, BARRIER_CHILD); - - /* Make sure we don't keep open the passed fds in this child. We assume that otherwise only - * those fds are open here that have been opened by PAM. */ - (void) close_many(fds, n_fds); - - /* Drop privileges - we don't need any to pam_close_session and this will make - * PR_SET_PDEATHSIG work in most cases. If this fails, ignore the error - but expect sd-pam - * threads to fail to exit normally */ - - r = maybe_setgroups(0, NULL); - if (r < 0) - log_warning_errno(r, "Failed to setgroups() in sd-pam: %m"); - if (setresgid(gid, gid, gid) < 0) - log_warning_errno(errno, "Failed to setresgid() in sd-pam: %m"); - if (setresuid(uid, uid, uid) < 0) - log_warning_errno(errno, "Failed to setresuid() in sd-pam: %m"); - - (void) ignore_signals(SIGPIPE); - - /* Wait until our parent died. This will only work if the above setresuid() succeeds, - * otherwise the kernel will not allow unprivileged parents kill their privileged children - * this way. We rely on the control groups kill logic to do the rest for us. */ - if (prctl(PR_SET_PDEATHSIG, SIGTERM) < 0) - goto child_finish; - - /* Tell the parent that our setup is done. This is especially important regarding dropping - * privileges. Otherwise, unit setup might race against our setresuid(2) call. - * - * If the parent aborted, we'll detect this below, hence ignore return failure here. */ - (void) barrier_place(&barrier); - - /* Check if our parent process might already have died? */ - if (getppid() == parent_pid) { - sigset_t ss; - - assert_se(sigemptyset(&ss) >= 0); - assert_se(sigaddset(&ss, SIGTERM) >= 0); - - for (;;) { - if (sigwait(&ss, &sig) < 0) { - if (errno == EINTR) - continue; - - goto child_finish; - } - - assert(sig == SIGTERM); - break; - } - } - - pam_code = pam_setcred(handle, PAM_DELETE_CRED | flags); - if (pam_code != PAM_SUCCESS) - goto child_finish; - - /* If our parent died we'll end the session */ - if (getppid() != parent_pid) { - pam_code = pam_close_session(handle, flags); - if (pam_code != PAM_SUCCESS) - goto child_finish; - } - - ret = 0; - - child_finish: - /* NB: pam_end() when called in child processes should set PAM_DATA_SILENT to let the module - * know about this. See pam_end(3) */ - (void) pam_end(handle, pam_code | flags | PAM_DATA_SILENT); - _exit(ret); - } - - barrier_set_role(&barrier, BARRIER_PARENT); - - /* If the child was forked off successfully it will do all the cleanups, so forget about the handle - * here. */ - handle = NULL; - - /* Unblock SIGTERM again in the parent */ - assert_se(sigprocmask(SIG_SETMASK, &old_ss, NULL) >= 0); - - /* We close the log explicitly here, since the PAM modules might have opened it, but we don't want - * this fd around. */ - closelog(); - - /* Synchronously wait for the child to initialize. We don't care for errors as we cannot - * recover. However, warn loudly if it happens. */ - if (!barrier_place_and_sync(&barrier)) - log_error("PAM initialization failed"); - - return strv_free_and_replace(*env, e); - -fail: - if (pam_code != PAM_SUCCESS) { - log_error("PAM failed: %s", pam_strerror(handle, pam_code)); - r = -EPERM; /* PAM errors do not map to errno */ - } else - log_error_errno(r, "PAM failed: %m"); - - if (handle) { - if (close_session) - pam_code = pam_close_session(handle, flags); - - (void) pam_end(handle, pam_code | flags); - } - - closelog(); - return r; -#else - return 0; -#endif -} - -static void rename_process_from_path(const char *path) { - _cleanup_free_ char *buf = NULL; - const char *p; - - assert(path); - - /* This resulting string must fit in 10 chars (i.e. the length of "/sbin/init") to look pretty in - * /bin/ps */ - - if (path_extract_filename(path, &buf) < 0) { - rename_process("(...)"); - return; - } - - size_t l = strlen(buf); - if (l > 8) { - /* The end of the process name is usually more interesting, since the first bit might just be - * "systemd-" */ - p = buf + l - 8; - l = 8; - } else - p = buf; - - char process_name[11]; - process_name[0] = '('; - memcpy(process_name+1, p, l); - process_name[1+l] = ')'; - process_name[1+l+1] = 0; - - rename_process(process_name); -} - -static bool context_has_address_families(const ExecContext *c) { - assert(c); - - return c->address_families_allow_list || - !set_isempty(c->address_families); -} - -static bool context_has_syscall_filters(const ExecContext *c) { - assert(c); - - return c->syscall_allow_list || - !hashmap_isempty(c->syscall_filter); -} - -static bool context_has_syscall_logs(const ExecContext *c) { - assert(c); - - return c->syscall_log_allow_list || - !hashmap_isempty(c->syscall_log); -} - -static bool context_has_no_new_privileges(const ExecContext *c) { - assert(c); - - if (c->no_new_privileges) - return true; - - if (have_effective_cap(CAP_SYS_ADMIN) > 0) /* if we are privileged, we don't need NNP */ - return false; - - /* We need NNP if we have any form of seccomp and are unprivileged */ - return c->lock_personality || - c->memory_deny_write_execute || - c->private_devices || - c->protect_clock || - c->protect_hostname || - c->protect_kernel_tunables || - c->protect_kernel_modules || - c->protect_kernel_logs || - context_has_address_families(c) || - exec_context_restrict_namespaces_set(c) || - c->restrict_realtime || - c->restrict_suid_sgid || - !set_isempty(c->syscall_archs) || - context_has_syscall_filters(c) || - context_has_syscall_logs(c); -} - -#if HAVE_SECCOMP - -static bool skip_seccomp_unavailable(const Unit* u, const char* msg) { - - if (is_seccomp_available()) - return false; - - log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg); - return true; -} - -static int apply_syscall_filter(const Unit* u, const ExecContext *c, bool needs_ambient_hack) { - uint32_t negative_action, default_action, action; - int r; - - assert(u); - assert(c); - - if (!context_has_syscall_filters(c)) - return 0; - - if (skip_seccomp_unavailable(u, "SystemCallFilter=")) - return 0; - - negative_action = c->syscall_errno == SECCOMP_ERROR_NUMBER_KILL ? scmp_act_kill_process() : SCMP_ACT_ERRNO(c->syscall_errno); - - if (c->syscall_allow_list) { - default_action = negative_action; - action = SCMP_ACT_ALLOW; - } else { - default_action = SCMP_ACT_ALLOW; - action = negative_action; - } - - if (needs_ambient_hack) { - r = seccomp_filter_set_add(c->syscall_filter, c->syscall_allow_list, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID); - if (r < 0) - return r; - } - - return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_filter, action, false); -} - -static int apply_syscall_log(const Unit* u, const ExecContext *c) { -#ifdef SCMP_ACT_LOG - uint32_t default_action, action; -#endif - - assert(u); - assert(c); - - if (!context_has_syscall_logs(c)) - return 0; - -#ifdef SCMP_ACT_LOG - if (skip_seccomp_unavailable(u, "SystemCallLog=")) - return 0; - - if (c->syscall_log_allow_list) { - /* Log nothing but the ones listed */ - default_action = SCMP_ACT_ALLOW; - action = SCMP_ACT_LOG; - } else { - /* Log everything but the ones listed */ - default_action = SCMP_ACT_LOG; - action = SCMP_ACT_ALLOW; - } - - return seccomp_load_syscall_filter_set_raw(default_action, c->syscall_log, action, false); -#else - /* old libseccomp */ - log_unit_debug(u, "SECCOMP feature SCMP_ACT_LOG not available, skipping SystemCallLog="); - return 0; -#endif -} - -static int apply_syscall_archs(const Unit *u, const ExecContext *c) { - assert(u); - assert(c); - - if (set_isempty(c->syscall_archs)) - return 0; - - if (skip_seccomp_unavailable(u, "SystemCallArchitectures=")) - return 0; - - return seccomp_restrict_archs(c->syscall_archs); -} - -static int apply_address_families(const Unit* u, const ExecContext *c) { - assert(u); - assert(c); - - if (!context_has_address_families(c)) - return 0; - - if (skip_seccomp_unavailable(u, "RestrictAddressFamilies=")) - return 0; - - return seccomp_restrict_address_families(c->address_families, c->address_families_allow_list); -} - -static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) { - int r; - - assert(u); - assert(c); - - if (!c->memory_deny_write_execute) - return 0; - - /* use prctl() if kernel supports it (6.3) */ - r = prctl(PR_SET_MDWE, PR_MDWE_REFUSE_EXEC_GAIN, 0, 0, 0); - if (r == 0) { - log_unit_debug(u, "Enabled MemoryDenyWriteExecute= with PR_SET_MDWE"); - return 0; - } - if (r < 0 && errno != EINVAL) - return log_unit_debug_errno(u, errno, "Failed to enable MemoryDenyWriteExecute= with PR_SET_MDWE: %m"); - /* else use seccomp */ - log_unit_debug(u, "Kernel doesn't support PR_SET_MDWE: falling back to seccomp"); - - if (skip_seccomp_unavailable(u, "MemoryDenyWriteExecute=")) - return 0; - - return seccomp_memory_deny_write_execute(); -} - -static int apply_restrict_realtime(const Unit* u, const ExecContext *c) { - assert(u); - assert(c); - - if (!c->restrict_realtime) - return 0; - - if (skip_seccomp_unavailable(u, "RestrictRealtime=")) - return 0; - - return seccomp_restrict_realtime(); -} - -static int apply_restrict_suid_sgid(const Unit* u, const ExecContext *c) { - assert(u); - assert(c); - - if (!c->restrict_suid_sgid) - return 0; - - if (skip_seccomp_unavailable(u, "RestrictSUIDSGID=")) - return 0; - - return seccomp_restrict_suid_sgid(); -} - -static int apply_protect_sysctl(const Unit *u, const ExecContext *c) { - assert(u); - assert(c); - - /* Turn off the legacy sysctl() system call. Many distributions turn this off while building the kernel, but - * let's protect even those systems where this is left on in the kernel. */ - - if (!c->protect_kernel_tunables) - return 0; - - if (skip_seccomp_unavailable(u, "ProtectKernelTunables=")) - return 0; - - return seccomp_protect_sysctl(); -} - -static int apply_protect_kernel_modules(const Unit *u, const ExecContext *c) { - assert(u); - assert(c); - - /* Turn off module syscalls on ProtectKernelModules=yes */ - - if (!c->protect_kernel_modules) - return 0; - - if (skip_seccomp_unavailable(u, "ProtectKernelModules=")) - return 0; - - return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_MODULE, SCMP_ACT_ERRNO(EPERM), false); -} - -static int apply_protect_kernel_logs(const Unit *u, const ExecContext *c) { - assert(u); - assert(c); - - if (!c->protect_kernel_logs) - return 0; - - if (skip_seccomp_unavailable(u, "ProtectKernelLogs=")) - return 0; - - return seccomp_protect_syslog(); -} - -static int apply_protect_clock(const Unit *u, const ExecContext *c) { - assert(u); - assert(c); - - if (!c->protect_clock) - return 0; - - if (skip_seccomp_unavailable(u, "ProtectClock=")) - return 0; - - return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_CLOCK, SCMP_ACT_ERRNO(EPERM), false); -} - -static int apply_private_devices(const Unit *u, const ExecContext *c) { - assert(u); - assert(c); - - /* If PrivateDevices= is set, also turn off iopl and all @raw-io syscalls. */ - - if (!c->private_devices) - return 0; - - if (skip_seccomp_unavailable(u, "PrivateDevices=")) - return 0; - - return seccomp_load_syscall_filter_set(SCMP_ACT_ALLOW, syscall_filter_sets + SYSCALL_FILTER_SET_RAW_IO, SCMP_ACT_ERRNO(EPERM), false); -} - -static int apply_restrict_namespaces(const Unit *u, const ExecContext *c) { - assert(u); - assert(c); - - if (!exec_context_restrict_namespaces_set(c)) - return 0; - - if (skip_seccomp_unavailable(u, "RestrictNamespaces=")) - return 0; - - return seccomp_restrict_namespaces(c->restrict_namespaces); -} - -static int apply_lock_personality(const Unit* u, const ExecContext *c) { - unsigned long personality; - int r; - - assert(u); - assert(c); - - if (!c->lock_personality) - return 0; - - if (skip_seccomp_unavailable(u, "LockPersonality=")) - return 0; - - personality = c->personality; - - /* If personality is not specified, use either PER_LINUX or PER_LINUX32 depending on what is currently set. */ - if (personality == PERSONALITY_INVALID) { - - r = opinionated_personality(&personality); - if (r < 0) - return r; - } - - return seccomp_lock_personality(personality); -} - -#endif - -#if HAVE_LIBBPF -static int apply_restrict_filesystems(Unit *u, const ExecContext *c) { - assert(u); - assert(c); - - if (!exec_context_restrict_filesystems_set(c)) - return 0; - - if (!u->manager->restrict_fs) { - /* LSM BPF is unsupported or lsm_bpf_setup failed */ - log_unit_debug(u, "LSM BPF not supported, skipping RestrictFileSystems="); - return 0; - } - - return lsm_bpf_unit_restrict_filesystems(u, c->restrict_filesystems, c->restrict_filesystems_allow_list); -} -#endif - -static int apply_protect_hostname(const Unit *u, const ExecContext *c, int *ret_exit_status) { - assert(u); - assert(c); - - if (!c->protect_hostname) - return 0; - - if (ns_type_supported(NAMESPACE_UTS)) { - if (unshare(CLONE_NEWUTS) < 0) { - if (!ERRNO_IS_NOT_SUPPORTED(errno) && !ERRNO_IS_PRIVILEGE(errno)) { - *ret_exit_status = EXIT_NAMESPACE; - return log_unit_error_errno(u, errno, "Failed to set up UTS namespacing: %m"); - } - - log_unit_warning(u, "ProtectHostname=yes is configured, but UTS namespace setup is prohibited (container manager?), ignoring namespace setup."); - } - } else - log_unit_warning(u, "ProtectHostname=yes is configured, but the kernel does not support UTS namespaces, ignoring namespace setup."); - -#if HAVE_SECCOMP - int r; - - if (skip_seccomp_unavailable(u, "ProtectHostname=")) - return 0; - - r = seccomp_protect_hostname(); - if (r < 0) { - *ret_exit_status = EXIT_SECCOMP; - return log_unit_error_errno(u, r, "Failed to apply hostname restrictions: %m"); - } -#endif - - return 0; -} - -static void do_idle_pipe_dance(int idle_pipe[static 4]) { - assert(idle_pipe); - - idle_pipe[1] = safe_close(idle_pipe[1]); - idle_pipe[2] = safe_close(idle_pipe[2]); - - if (idle_pipe[0] >= 0) { - int r; - - r = fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT_USEC); - - if (idle_pipe[3] >= 0 && r == 0 /* timeout */) { - ssize_t n; - - /* Signal systemd that we are bored and want to continue. */ - n = write(idle_pipe[3], "x", 1); - if (n > 0) - /* Wait for systemd to react to the signal above. */ - (void) fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC); - } - - idle_pipe[0] = safe_close(idle_pipe[0]); - - } - - idle_pipe[3] = safe_close(idle_pipe[3]); -} - -static const char *exec_directory_env_name_to_string(ExecDirectoryType t); - -static int build_environment( - const Unit *u, - const ExecContext *c, - const ExecParameters *p, - const CGroupContext *cgroup_context, - size_t n_fds, - char **fdnames, - const char *home, - const char *username, - const char *shell, - dev_t journal_stream_dev, - ino_t journal_stream_ino, - const char *memory_pressure_path, - char ***ret) { - - _cleanup_strv_free_ char **our_env = NULL; - size_t n_env = 0; - char *x; - int r; - - assert(u); - assert(c); - assert(p); - assert(ret); - -#define N_ENV_VARS 19 - our_env = new0(char*, N_ENV_VARS + _EXEC_DIRECTORY_TYPE_MAX); - if (!our_env) - return -ENOMEM; - - if (n_fds > 0) { - _cleanup_free_ char *joined = NULL; - - if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid_cached()) < 0) - return -ENOMEM; - our_env[n_env++] = x; - - if (asprintf(&x, "LISTEN_FDS=%zu", n_fds) < 0) - return -ENOMEM; - our_env[n_env++] = x; - - joined = strv_join(fdnames, ":"); - if (!joined) - return -ENOMEM; - - x = strjoin("LISTEN_FDNAMES=", joined); - if (!x) - return -ENOMEM; - our_env[n_env++] = x; - } - - if ((p->flags & EXEC_SET_WATCHDOG) && p->watchdog_usec > 0) { - if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid_cached()) < 0) - return -ENOMEM; - our_env[n_env++] = x; - - if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, p->watchdog_usec) < 0) - return -ENOMEM; - our_env[n_env++] = x; - } - - /* If this is D-Bus, tell the nss-systemd module, since it relies on being able to use blocking - * Varlink calls back to us for look up dynamic users in PID 1. Break the deadlock between D-Bus and - * PID 1 by disabling use of PID1' NSS interface for looking up dynamic users. */ - if (p->flags & EXEC_NSS_DYNAMIC_BYPASS) { - x = strdup("SYSTEMD_NSS_DYNAMIC_BYPASS=1"); - if (!x) - return -ENOMEM; - our_env[n_env++] = x; - } - - /* We query "root" if this is a system unit and User= is not specified. $USER is always set. $HOME - * could cause problem for e.g. getty, since login doesn't override $HOME, and $LOGNAME and $SHELL don't - * really make much sense since we're not logged in. Hence we conditionalize the three based on - * SetLoginEnvironment= switch. */ - if (!c->user && !c->dynamic_user && p->runtime_scope == RUNTIME_SCOPE_SYSTEM) { - r = get_fixed_user("root", &username, NULL, NULL, &home, &shell); - if (r < 0) - return log_unit_error_errno(u, r, "Failed to determine user credentials for root: %m"); - } - - bool set_user_login_env = c->set_login_environment >= 0 ? c->set_login_environment : (c->user || c->dynamic_user); - - if (username) { - x = strjoin("USER=", username); - if (!x) - return -ENOMEM; - our_env[n_env++] = x; - - if (set_user_login_env) { - x = strjoin("LOGNAME=", username); - if (!x) - return -ENOMEM; - our_env[n_env++] = x; - } - } - - if (home && set_user_login_env) { - x = strjoin("HOME=", home); - if (!x) - return -ENOMEM; - - path_simplify(x + 5); - our_env[n_env++] = x; - } - - if (shell && set_user_login_env) { - x = strjoin("SHELL=", shell); - if (!x) - return -ENOMEM; - - path_simplify(x + 6); - our_env[n_env++] = x; - } - - if (!sd_id128_is_null(u->invocation_id)) { - if (asprintf(&x, "INVOCATION_ID=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(u->invocation_id)) < 0) - return -ENOMEM; - - our_env[n_env++] = x; - } - - if (exec_context_needs_term(c)) { - _cleanup_free_ char *cmdline = NULL; - const char *tty_path, *term = NULL; - - tty_path = exec_context_tty_path(c); - - /* If we are forked off PID 1 and we are supposed to operate on /dev/console, then let's try - * to inherit the $TERM set for PID 1. This is useful for containers so that the $TERM the - * container manager passes to PID 1 ends up all the way in the console login shown. */ - - if (path_equal_ptr(tty_path, "/dev/console") && getppid() == 1) - term = getenv("TERM"); - else if (tty_path && in_charset(skip_dev_prefix(tty_path), ALPHANUMERICAL)) { - _cleanup_free_ char *key = NULL; - - key = strjoin("systemd.tty.term.", skip_dev_prefix(tty_path)); - if (!key) - return -ENOMEM; - - r = proc_cmdline_get_key(key, 0, &cmdline); - if (r < 0) - log_debug_errno(r, "Failed to read %s from kernel cmdline, ignoring: %m", key); - else if (r > 0) - term = cmdline; - } - - if (!term) - term = default_term_for_tty(tty_path); - - x = strjoin("TERM=", term); - if (!x) - return -ENOMEM; - our_env[n_env++] = x; - } - - if (journal_stream_dev != 0 && journal_stream_ino != 0) { - if (asprintf(&x, "JOURNAL_STREAM=" DEV_FMT ":" INO_FMT, journal_stream_dev, journal_stream_ino) < 0) - return -ENOMEM; - - our_env[n_env++] = x; - } - - if (c->log_namespace) { - x = strjoin("LOG_NAMESPACE=", c->log_namespace); - if (!x) - return -ENOMEM; - - our_env[n_env++] = x; - } - - for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) { - _cleanup_free_ char *joined = NULL; - const char *n; - - if (!p->prefix[t]) - continue; - - if (c->directories[t].n_items == 0) - continue; - - n = exec_directory_env_name_to_string(t); - if (!n) - continue; - - for (size_t i = 0; i < c->directories[t].n_items; i++) { - _cleanup_free_ char *prefixed = NULL; - - prefixed = path_join(p->prefix[t], c->directories[t].items[i].path); - if (!prefixed) - return -ENOMEM; - - if (!strextend_with_separator(&joined, ":", prefixed)) - return -ENOMEM; - } - - x = strjoin(n, "=", joined); - if (!x) - return -ENOMEM; - - our_env[n_env++] = x; - } - - _cleanup_free_ char *creds_dir = NULL; - r = exec_context_get_credential_directory(c, p, u->id, &creds_dir); - if (r < 0) - return r; - if (r > 0) { - x = strjoin("CREDENTIALS_DIRECTORY=", creds_dir); - if (!x) - return -ENOMEM; - - our_env[n_env++] = x; - } - - if (asprintf(&x, "SYSTEMD_EXEC_PID=" PID_FMT, getpid_cached()) < 0) - return -ENOMEM; - - our_env[n_env++] = x; - - if (memory_pressure_path) { - x = strjoin("MEMORY_PRESSURE_WATCH=", memory_pressure_path); - if (!x) - return -ENOMEM; - - our_env[n_env++] = x; - - if (cgroup_context && !path_equal(memory_pressure_path, "/dev/null")) { - _cleanup_free_ char *b = NULL, *e = NULL; - - if (asprintf(&b, "%s " USEC_FMT " " USEC_FMT, - MEMORY_PRESSURE_DEFAULT_TYPE, - cgroup_context->memory_pressure_threshold_usec == USEC_INFINITY ? MEMORY_PRESSURE_DEFAULT_THRESHOLD_USEC : - CLAMP(cgroup_context->memory_pressure_threshold_usec, 1U, MEMORY_PRESSURE_DEFAULT_WINDOW_USEC), - MEMORY_PRESSURE_DEFAULT_WINDOW_USEC) < 0) - return -ENOMEM; - - if (base64mem(b, strlen(b) + 1, &e) < 0) - return -ENOMEM; - - x = strjoin("MEMORY_PRESSURE_WRITE=", e); - if (!x) - return -ENOMEM; - - our_env[n_env++] = x; - } - } - - assert(n_env < N_ENV_VARS + _EXEC_DIRECTORY_TYPE_MAX); -#undef N_ENV_VARS - - *ret = TAKE_PTR(our_env); - - return 0; -} - -static int build_pass_environment(const ExecContext *c, char ***ret) { - _cleanup_strv_free_ char **pass_env = NULL; - size_t n_env = 0; - - STRV_FOREACH(i, c->pass_environment) { - _cleanup_free_ char *x = NULL; - char *v; - - v = getenv(*i); - if (!v) - continue; - x = strjoin(*i, "=", v); - if (!x) - return -ENOMEM; - - if (!GREEDY_REALLOC(pass_env, n_env + 2)) - return -ENOMEM; - - pass_env[n_env++] = TAKE_PTR(x); - pass_env[n_env] = NULL; - } - - *ret = TAKE_PTR(pass_env); - - return 0; -} - bool exec_needs_network_namespace(const ExecContext *context) { assert(context); @@ -2146,7 +170,7 @@ static bool exec_needs_ephemeral(const ExecContext *context) { return (context->root_image || context->root_directory) && context->root_ephemeral; } -static bool exec_needs_ipc_namespace(const ExecContext *context) { +bool exec_needs_ipc_namespace(const ExecContext *context) { assert(context); return context->private_ipc || context->ipc_namespace_path; @@ -2229,166 +253,7 @@ bool exec_needs_mount_namespace( return false; } -static int setup_private_users(uid_t ouid, gid_t ogid, uid_t uid, gid_t gid) { - _cleanup_free_ char *uid_map = NULL, *gid_map = NULL; - _cleanup_close_pair_ int errno_pipe[2] = PIPE_EBADF; - _cleanup_close_ int unshare_ready_fd = -EBADF; - _cleanup_(sigkill_waitp) pid_t pid = 0; - uint64_t c = 1; - ssize_t n; - int r; - - /* Set up a user namespace and map the original UID/GID (IDs from before any user or group changes, i.e. - * the IDs from the user or system manager(s)) to itself, the selected UID/GID to itself, and everything else to - * nobody. In order to be able to write this mapping we need CAP_SETUID in the original user namespace, which - * we however lack after opening the user namespace. To work around this we fork() a temporary child process, - * which waits for the parent to create the new user namespace while staying in the original namespace. The - * child then writes the UID mapping, under full privileges. The parent waits for the child to finish and - * continues execution normally. - * For unprivileged users (i.e. without capabilities), the root to root mapping is excluded. As such, it - * does not need CAP_SETUID to write the single line mapping to itself. */ - - /* Can only set up multiple mappings with CAP_SETUID. */ - if (have_effective_cap(CAP_SETUID) > 0 && uid != ouid && uid_is_valid(uid)) - r = asprintf(&uid_map, - UID_FMT " " UID_FMT " 1\n" /* Map $OUID → $OUID */ - UID_FMT " " UID_FMT " 1\n", /* Map $UID → $UID */ - ouid, ouid, uid, uid); - else - r = asprintf(&uid_map, - UID_FMT " " UID_FMT " 1\n", /* Map $OUID → $OUID */ - ouid, ouid); - - if (r < 0) - return -ENOMEM; - - /* Can only set up multiple mappings with CAP_SETGID. */ - if (have_effective_cap(CAP_SETGID) > 0 && gid != ogid && gid_is_valid(gid)) - r = asprintf(&gid_map, - GID_FMT " " GID_FMT " 1\n" /* Map $OGID → $OGID */ - GID_FMT " " GID_FMT " 1\n", /* Map $GID → $GID */ - ogid, ogid, gid, gid); - else - r = asprintf(&gid_map, - GID_FMT " " GID_FMT " 1\n", /* Map $OGID -> $OGID */ - ogid, ogid); - - if (r < 0) - return -ENOMEM; - - /* Create a communication channel so that the parent can tell the child when it finished creating the user - * namespace. */ - unshare_ready_fd = eventfd(0, EFD_CLOEXEC); - if (unshare_ready_fd < 0) - return -errno; - - /* Create a communication channel so that the child can tell the parent a proper error code in case it - * failed. */ - if (pipe2(errno_pipe, O_CLOEXEC) < 0) - return -errno; - - r = safe_fork("(sd-userns)", FORK_RESET_SIGNALS|FORK_DEATHSIG, &pid); - if (r < 0) - return r; - if (r == 0) { - _cleanup_close_ int fd = -EBADF; - const char *a; - pid_t ppid; - - /* Child process, running in the original user namespace. Let's update the parent's UID/GID map from - * here, after the parent opened its own user namespace. */ - - ppid = getppid(); - errno_pipe[0] = safe_close(errno_pipe[0]); - - /* Wait until the parent unshared the user namespace */ - if (read(unshare_ready_fd, &c, sizeof(c)) < 0) { - r = -errno; - goto child_fail; - } - - /* Disable the setgroups() system call in the child user namespace, for good. */ - a = procfs_file_alloca(ppid, "setgroups"); - fd = open(a, O_WRONLY|O_CLOEXEC); - if (fd < 0) { - if (errno != ENOENT) { - r = -errno; - goto child_fail; - } - - /* If the file is missing the kernel is too old, let's continue anyway. */ - } else { - if (write(fd, "deny\n", 5) < 0) { - r = -errno; - goto child_fail; - } - - fd = safe_close(fd); - } - - /* First write the GID map */ - a = procfs_file_alloca(ppid, "gid_map"); - fd = open(a, O_WRONLY|O_CLOEXEC); - if (fd < 0) { - r = -errno; - goto child_fail; - } - if (write(fd, gid_map, strlen(gid_map)) < 0) { - r = -errno; - goto child_fail; - } - fd = safe_close(fd); - - /* The write the UID map */ - a = procfs_file_alloca(ppid, "uid_map"); - fd = open(a, O_WRONLY|O_CLOEXEC); - if (fd < 0) { - r = -errno; - goto child_fail; - } - if (write(fd, uid_map, strlen(uid_map)) < 0) { - r = -errno; - goto child_fail; - } - - _exit(EXIT_SUCCESS); - - child_fail: - (void) write(errno_pipe[1], &r, sizeof(r)); - _exit(EXIT_FAILURE); - } - - errno_pipe[1] = safe_close(errno_pipe[1]); - - if (unshare(CLONE_NEWUSER) < 0) - return -errno; - - /* Let the child know that the namespace is ready now */ - if (write(unshare_ready_fd, &c, sizeof(c)) < 0) - return -errno; - - /* Try to read an error code from the child */ - n = read(errno_pipe[0], &r, sizeof(r)); - if (n < 0) - return -errno; - if (n == sizeof(r)) { /* an error code was sent to us */ - if (r < 0) - return r; - return -EIO; - } - if (n != 0) /* on success we should have read 0 bytes */ - return -EIO; - - r = wait_for_terminate_and_check("(sd-userns)", TAKE_PID(pid), 0); - if (r < 0) - return r; - if (r != EXIT_SUCCESS) /* If something strange happened with the child, let's consider this fatal, too */ - return -EIO; - - return 0; -} - -static bool exec_directory_is_private(const ExecContext *context, ExecDirectoryType type) { +bool exec_directory_is_private(const ExecContext *context, ExecDirectoryType type) { assert(context); if (!context->dynamic_user) @@ -2403,1281 +268,7 @@ static bool exec_directory_is_private(const ExecContext *context, ExecDirectoryT return true; } -static int create_many_symlinks(const char *root, const char *source, char **symlinks) { - _cleanup_free_ char *src_abs = NULL; - int r; - - assert(source); - - src_abs = path_join(root, source); - if (!src_abs) - return -ENOMEM; - - STRV_FOREACH(dst, symlinks) { - _cleanup_free_ char *dst_abs = NULL; - - dst_abs = path_join(root, *dst); - if (!dst_abs) - return -ENOMEM; - - r = mkdir_parents_label(dst_abs, 0755); - if (r < 0) - return r; - - r = symlink_idempotent(src_abs, dst_abs, true); - if (r < 0) - return r; - } - - return 0; -} - -static int setup_exec_directory( - Unit *u, - const ExecContext *context, - const ExecParameters *params, - uid_t uid, - gid_t gid, - ExecDirectoryType type, - bool needs_mount_namespace, - int *exit_status) { - - static const int exit_status_table[_EXEC_DIRECTORY_TYPE_MAX] = { - [EXEC_DIRECTORY_RUNTIME] = EXIT_RUNTIME_DIRECTORY, - [EXEC_DIRECTORY_STATE] = EXIT_STATE_DIRECTORY, - [EXEC_DIRECTORY_CACHE] = EXIT_CACHE_DIRECTORY, - [EXEC_DIRECTORY_LOGS] = EXIT_LOGS_DIRECTORY, - [EXEC_DIRECTORY_CONFIGURATION] = EXIT_CONFIGURATION_DIRECTORY, - }; - int r; - - assert(context); - assert(params); - assert(type >= 0 && type < _EXEC_DIRECTORY_TYPE_MAX); - assert(exit_status); - - if (!params->prefix[type]) - return 0; - - if (params->flags & EXEC_CHOWN_DIRECTORIES) { - if (!uid_is_valid(uid)) - uid = 0; - if (!gid_is_valid(gid)) - gid = 0; - } - - for (size_t i = 0; i < context->directories[type].n_items; i++) { - _cleanup_free_ char *p = NULL, *pp = NULL; - - p = path_join(params->prefix[type], context->directories[type].items[i].path); - if (!p) { - r = -ENOMEM; - goto fail; - } - - r = mkdir_parents_label(p, 0755); - if (r < 0) - goto fail; - - if (IN_SET(type, EXEC_DIRECTORY_STATE, EXEC_DIRECTORY_LOGS) && params->runtime_scope == RUNTIME_SCOPE_USER) { - - /* If we are in user mode, and a configuration directory exists but a state directory - * doesn't exist, then we likely are upgrading from an older systemd version that - * didn't know the more recent addition to the xdg-basedir spec: the $XDG_STATE_HOME - * directory. In older systemd versions EXEC_DIRECTORY_STATE was aliased to - * EXEC_DIRECTORY_CONFIGURATION, with the advent of $XDG_STATE_HOME is is now - * separated. If a service has both dirs configured but only the configuration dir - * exists and the state dir does not, we assume we are looking at an update - * situation. Hence, create a compatibility symlink, so that all expectations are - * met. - * - * (We also do something similar with the log directory, which still doesn't exist in - * the xdg basedir spec. We'll make it a subdir of the state dir.) */ - - /* this assumes the state dir is always created before the configuration dir */ - assert_cc(EXEC_DIRECTORY_STATE < EXEC_DIRECTORY_LOGS); - assert_cc(EXEC_DIRECTORY_LOGS < EXEC_DIRECTORY_CONFIGURATION); - - r = laccess(p, F_OK); - if (r == -ENOENT) { - _cleanup_free_ char *q = NULL; - - /* OK, we know that the state dir does not exist. Let's see if the dir exists - * under the configuration hierarchy. */ - - if (type == EXEC_DIRECTORY_STATE) - q = path_join(params->prefix[EXEC_DIRECTORY_CONFIGURATION], context->directories[type].items[i].path); - else if (type == EXEC_DIRECTORY_LOGS) - q = path_join(params->prefix[EXEC_DIRECTORY_CONFIGURATION], "log", context->directories[type].items[i].path); - else - assert_not_reached(); - if (!q) { - r = -ENOMEM; - goto fail; - } - - r = laccess(q, F_OK); - if (r >= 0) { - /* It does exist! This hence looks like an update. Symlink the - * configuration directory into the state directory. */ - - r = symlink_idempotent(q, p, /* make_relative= */ true); - if (r < 0) - goto fail; - - log_unit_notice(u, "Unit state directory %s missing but matching configuration directory %s exists, assuming update from systemd 253 or older, creating compatibility symlink.", p, q); - continue; - } else if (r != -ENOENT) - log_unit_warning_errno(u, r, "Unable to detect whether unit configuration directory '%s' exists, assuming not: %m", q); - - } else if (r < 0) - log_unit_warning_errno(u, r, "Unable to detect whether unit state directory '%s' is missing, assuming it is: %m", p); - } - - if (exec_directory_is_private(context, type)) { - /* So, here's one extra complication when dealing with DynamicUser=1 units. In that - * case we want to avoid leaving a directory around fully accessible that is owned by - * a dynamic user whose UID is later on reused. To lock this down we use the same - * trick used by container managers to prohibit host users to get access to files of - * the same UID in containers: we place everything inside a directory that has an - * access mode of 0700 and is owned root:root, so that it acts as security boundary - * for unprivileged host code. We then use fs namespacing to make this directory - * permeable for the service itself. - * - * Specifically: for a service which wants a special directory "foo/" we first create - * a directory "private/" with access mode 0700 owned by root:root. Then we place - * "foo" inside of that directory (i.e. "private/foo/"), and make "foo" a symlink to - * "private/foo". This way, privileged host users can access "foo/" as usual, but - * unprivileged host users can't look into it. Inside of the namespace of the unit - * "private/" is replaced by a more liberally accessible tmpfs, into which the host's - * "private/foo/" is mounted under the same name, thus disabling the access boundary - * for the service and making sure it only gets access to the dirs it needs but no - * others. Tricky? Yes, absolutely, but it works! - * - * Note that we don't do this for EXEC_DIRECTORY_CONFIGURATION as that's assumed not - * to be owned by the service itself. - * - * Also, note that we don't do this for EXEC_DIRECTORY_RUNTIME as that's often used - * for sharing files or sockets with other services. */ - - pp = path_join(params->prefix[type], "private"); - if (!pp) { - r = -ENOMEM; - goto fail; - } - - /* First set up private root if it doesn't exist yet, with access mode 0700 and owned by root:root */ - r = mkdir_safe_label(pp, 0700, 0, 0, MKDIR_WARN_MODE); - if (r < 0) - goto fail; - - if (!path_extend(&pp, context->directories[type].items[i].path)) { - r = -ENOMEM; - goto fail; - } - - /* Create all directories between the configured directory and this private root, and mark them 0755 */ - r = mkdir_parents_label(pp, 0755); - if (r < 0) - goto fail; - - if (is_dir(p, false) > 0 && - (laccess(pp, F_OK) == -ENOENT)) { - - /* Hmm, the private directory doesn't exist yet, but the normal one exists? If so, move - * it over. Most likely the service has been upgraded from one that didn't use - * DynamicUser=1, to one that does. */ - - log_unit_info(u, "Found pre-existing public %s= directory %s, migrating to %s.\n" - "Apparently, service previously had DynamicUser= turned off, and has now turned it on.", - exec_directory_type_to_string(type), p, pp); - - r = RET_NERRNO(rename(p, pp)); - if (r < 0) - goto fail; - } else { - /* Otherwise, create the actual directory for the service */ - - r = mkdir_label(pp, context->directories[type].mode); - if (r < 0 && r != -EEXIST) - goto fail; - } - - if (!context->directories[type].items[i].only_create) { - /* And link it up from the original place. - * Notes - * 1) If a mount namespace is going to be used, then this symlink remains on - * the host, and a new one for the child namespace will be created later. - * 2) It is not necessary to create this symlink when one of its parent - * directories is specified and already created. E.g. - * StateDirectory=foo foo/bar - * In that case, the inode points to pp and p for "foo/bar" are the same: - * pp = "/var/lib/private/foo/bar" - * p = "/var/lib/foo/bar" - * and, /var/lib/foo is a symlink to /var/lib/private/foo. So, not only - * we do not need to create the symlink, but we cannot create the symlink. - * See issue #24783. */ - r = symlink_idempotent(pp, p, true); - if (r < 0) - goto fail; - } - - } else { - _cleanup_free_ char *target = NULL; - - if (type != EXEC_DIRECTORY_CONFIGURATION && - readlink_and_make_absolute(p, &target) >= 0) { - _cleanup_free_ char *q = NULL, *q_resolved = NULL, *target_resolved = NULL; - - /* This already exists and is a symlink? Interesting. Maybe it's one created - * by DynamicUser=1 (see above)? - * - * We do this for all directory types except for ConfigurationDirectory=, - * since they all support the private/ symlink logic at least in some - * configurations, see above. */ - - r = chase(target, NULL, 0, &target_resolved, NULL); - if (r < 0) - goto fail; - - q = path_join(params->prefix[type], "private", context->directories[type].items[i].path); - if (!q) { - r = -ENOMEM; - goto fail; - } - - /* /var/lib or friends may be symlinks. So, let's chase them also. */ - r = chase(q, NULL, CHASE_NONEXISTENT, &q_resolved, NULL); - if (r < 0) - goto fail; - - if (path_equal(q_resolved, target_resolved)) { - - /* Hmm, apparently DynamicUser= was once turned on for this service, - * but is no longer. Let's move the directory back up. */ - - log_unit_info(u, "Found pre-existing private %s= directory %s, migrating to %s.\n" - "Apparently, service previously had DynamicUser= turned on, and has now turned it off.", - exec_directory_type_to_string(type), q, p); - - r = RET_NERRNO(unlink(p)); - if (r < 0) - goto fail; - - r = RET_NERRNO(rename(q, p)); - if (r < 0) - goto fail; - } - } - - r = mkdir_label(p, context->directories[type].mode); - if (r < 0) { - if (r != -EEXIST) - goto fail; - - if (type == EXEC_DIRECTORY_CONFIGURATION) { - struct stat st; - - /* Don't change the owner/access mode of the configuration directory, - * as in the common case it is not written to by a service, and shall - * not be writable. */ - - r = RET_NERRNO(stat(p, &st)); - if (r < 0) - goto fail; - - /* Still complain if the access mode doesn't match */ - if (((st.st_mode ^ context->directories[type].mode) & 07777) != 0) - log_unit_warning(u, "%s \'%s\' already exists but the mode is different. " - "(File system: %o %sMode: %o)", - exec_directory_type_to_string(type), context->directories[type].items[i].path, - st.st_mode & 07777, exec_directory_type_to_string(type), context->directories[type].mode & 07777); - - continue; - } - } - } - - /* Lock down the access mode (we use chmod_and_chown() to make this idempotent. We don't - * specify UID/GID here, so that path_chown_recursive() can optimize things depending on the - * current UID/GID ownership.) */ - r = chmod_and_chown(pp ?: p, context->directories[type].mode, UID_INVALID, GID_INVALID); - if (r < 0) - goto fail; - - /* Skip the rest (which deals with ownership) in user mode, since ownership changes are not - * available to user code anyway */ - if (params->runtime_scope != RUNTIME_SCOPE_SYSTEM) - continue; - - /* Then, change the ownership of the whole tree, if necessary. When dynamic users are used we - * drop the suid/sgid bits, since we really don't want SUID/SGID files for dynamic UID/GID - * assignments to exist. */ - r = path_chown_recursive(pp ?: p, uid, gid, context->dynamic_user ? 01777 : 07777, AT_SYMLINK_FOLLOW); - if (r < 0) - goto fail; - } - - /* If we are not going to run in a namespace, set up the symlinks - otherwise - * they are set up later, to allow configuring empty var/run/etc. */ - if (!needs_mount_namespace) - for (size_t i = 0; i < context->directories[type].n_items; i++) { - r = create_many_symlinks(params->prefix[type], - context->directories[type].items[i].path, - context->directories[type].items[i].symlinks); - if (r < 0) - goto fail; - } - - return 0; - -fail: - *exit_status = exit_status_table[type]; - return r; -} - -#if ENABLE_SMACK -static int setup_smack( - const Manager *manager, - const ExecContext *context, - int executable_fd) { - int r; - - assert(context); - assert(executable_fd >= 0); - - if (context->smack_process_label) { - r = mac_smack_apply_pid(0, context->smack_process_label); - if (r < 0) - return r; - } else if (manager->defaults.smack_process_label) { - _cleanup_free_ char *exec_label = NULL; - - r = mac_smack_read_fd(executable_fd, SMACK_ATTR_EXEC, &exec_label); - if (r < 0 && !ERRNO_IS_XATTR_ABSENT(r)) - return r; - - r = mac_smack_apply_pid(0, exec_label ?: manager->defaults.smack_process_label); - if (r < 0) - return r; - } - - return 0; -} -#endif - -static int compile_bind_mounts( - const ExecContext *context, - const ExecParameters *params, - BindMount **ret_bind_mounts, - size_t *ret_n_bind_mounts, - char ***ret_empty_directories) { - - _cleanup_strv_free_ char **empty_directories = NULL; - BindMount *bind_mounts = NULL; - size_t n, h = 0; - int r; - - assert(context); - assert(params); - assert(ret_bind_mounts); - assert(ret_n_bind_mounts); - assert(ret_empty_directories); - - CLEANUP_ARRAY(bind_mounts, h, bind_mount_free_many); - - n = context->n_bind_mounts; - for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) { - if (!params->prefix[t]) - continue; - - for (size_t i = 0; i < context->directories[t].n_items; i++) - n += !context->directories[t].items[i].only_create; - } - - if (n <= 0) { - *ret_bind_mounts = NULL; - *ret_n_bind_mounts = 0; - *ret_empty_directories = NULL; - return 0; - } - - bind_mounts = new(BindMount, n); - if (!bind_mounts) - return -ENOMEM; - - for (size_t i = 0; i < context->n_bind_mounts; i++) { - BindMount *item = context->bind_mounts + i; - _cleanup_free_ char *s = NULL, *d = NULL; - - s = strdup(item->source); - if (!s) - return -ENOMEM; - - d = strdup(item->destination); - if (!d) - return -ENOMEM; - - bind_mounts[h++] = (BindMount) { - .source = TAKE_PTR(s), - .destination = TAKE_PTR(d), - .read_only = item->read_only, - .recursive = item->recursive, - .ignore_enoent = item->ignore_enoent, - }; - } - - for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) { - if (!params->prefix[t]) - continue; - - if (context->directories[t].n_items == 0) - continue; - - if (exec_directory_is_private(context, t) && - !exec_context_with_rootfs(context)) { - char *private_root; - - /* So this is for a dynamic user, and we need to make sure the process can access its own - * directory. For that we overmount the usually inaccessible "private" subdirectory with a - * tmpfs that makes it accessible and is empty except for the submounts we do this for. */ - - private_root = path_join(params->prefix[t], "private"); - if (!private_root) - return -ENOMEM; - - r = strv_consume(&empty_directories, private_root); - if (r < 0) - return r; - } - - for (size_t i = 0; i < context->directories[t].n_items; i++) { - _cleanup_free_ char *s = NULL, *d = NULL; - - /* When one of the parent directories is in the list, we cannot create the symlink - * for the child directory. See also the comments in setup_exec_directory(). */ - if (context->directories[t].items[i].only_create) - continue; - - if (exec_directory_is_private(context, t)) - s = path_join(params->prefix[t], "private", context->directories[t].items[i].path); - else - s = path_join(params->prefix[t], context->directories[t].items[i].path); - if (!s) - return -ENOMEM; - - if (exec_directory_is_private(context, t) && - exec_context_with_rootfs(context)) - /* When RootDirectory= or RootImage= are set, then the symbolic link to the private - * directory is not created on the root directory. So, let's bind-mount the directory - * on the 'non-private' place. */ - d = path_join(params->prefix[t], context->directories[t].items[i].path); - else - d = strdup(s); - if (!d) - return -ENOMEM; - - bind_mounts[h++] = (BindMount) { - .source = TAKE_PTR(s), - .destination = TAKE_PTR(d), - .read_only = false, - .nosuid = context->dynamic_user, /* don't allow suid/sgid when DynamicUser= is on */ - .recursive = true, - .ignore_enoent = false, - }; - } - } - - assert(h == n); - - *ret_bind_mounts = TAKE_PTR(bind_mounts); - *ret_n_bind_mounts = n; - *ret_empty_directories = TAKE_PTR(empty_directories); - - return (int) n; -} - -/* ret_symlinks will contain a list of pairs src:dest that describes - * the symlinks to create later on. For example, the symlinks needed - * to safely give private directories to DynamicUser=1 users. */ -static int compile_symlinks( - const ExecContext *context, - const ExecParameters *params, - bool setup_os_release_symlink, - char ***ret_symlinks) { - - _cleanup_strv_free_ char **symlinks = NULL; - int r; - - assert(context); - assert(params); - assert(ret_symlinks); - - for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) { - for (size_t i = 0; i < context->directories[dt].n_items; i++) { - _cleanup_free_ char *private_path = NULL, *path = NULL; - - STRV_FOREACH(symlink, context->directories[dt].items[i].symlinks) { - _cleanup_free_ char *src_abs = NULL, *dst_abs = NULL; - - src_abs = path_join(params->prefix[dt], context->directories[dt].items[i].path); - dst_abs = path_join(params->prefix[dt], *symlink); - if (!src_abs || !dst_abs) - return -ENOMEM; - - r = strv_consume_pair(&symlinks, TAKE_PTR(src_abs), TAKE_PTR(dst_abs)); - if (r < 0) - return r; - } - - if (!exec_directory_is_private(context, dt) || - exec_context_with_rootfs(context) || - context->directories[dt].items[i].only_create) - continue; - - private_path = path_join(params->prefix[dt], "private", context->directories[dt].items[i].path); - if (!private_path) - return -ENOMEM; - - path = path_join(params->prefix[dt], context->directories[dt].items[i].path); - if (!path) - return -ENOMEM; - - r = strv_consume_pair(&symlinks, TAKE_PTR(private_path), TAKE_PTR(path)); - if (r < 0) - return r; - } - } - - /* We make the host's os-release available via a symlink, so that we can copy it atomically - * and readers will never get a half-written version. Note that, while the paths specified here are - * absolute, when they are processed in namespace.c they will be made relative automatically, i.e.: - * 'os-release -> .os-release-stage/os-release' is what will be created. */ - if (setup_os_release_symlink) { - r = strv_extend(&symlinks, "/run/host/.os-release-stage/os-release"); - if (r < 0) - return r; - - r = strv_extend(&symlinks, "/run/host/os-release"); - if (r < 0) - return r; - } - - *ret_symlinks = TAKE_PTR(symlinks); - - return 0; -} - -static bool insist_on_sandboxing( - const ExecContext *context, - const char *root_dir, - const char *root_image, - const BindMount *bind_mounts, - size_t n_bind_mounts) { - - assert(context); - assert(n_bind_mounts == 0 || bind_mounts); - - /* Checks whether we need to insist on fs namespacing. i.e. whether we have settings configured that - * would alter the view on the file system beyond making things read-only or invisible, i.e. would - * rearrange stuff in a way we cannot ignore gracefully. */ - - if (context->n_temporary_filesystems > 0) - return true; - - if (root_dir || root_image) - return true; - - if (context->n_mount_images > 0) - return true; - - if (context->dynamic_user) - return true; - - if (context->n_extension_images > 0 || !strv_isempty(context->extension_directories)) - return true; - - /* If there are any bind mounts set that don't map back onto themselves, fs namespacing becomes - * essential. */ - for (size_t i = 0; i < n_bind_mounts; i++) - if (!path_equal(bind_mounts[i].source, bind_mounts[i].destination)) - return true; - - if (context->log_namespace) - return true; - - return false; -} - -static int setup_ephemeral(const ExecContext *context, ExecRuntime *runtime) { - _cleanup_close_ int fd = -EBADF; - int r; - - if (!runtime || !runtime->ephemeral_copy) - return 0; - - r = posix_lock(runtime->ephemeral_storage_socket[0], LOCK_EX); - if (r < 0) - return log_debug_errno(r, "Failed to lock ephemeral storage socket: %m"); - - CLEANUP_POSIX_UNLOCK(runtime->ephemeral_storage_socket[0]); - - fd = receive_one_fd(runtime->ephemeral_storage_socket[0], MSG_PEEK|MSG_DONTWAIT); - if (fd >= 0) - /* We got an fd! That means ephemeral has already been set up, so nothing to do here. */ - return 0; - - if (fd != -EAGAIN) - return log_debug_errno(fd, "Failed to receive file descriptor queued on ephemeral storage socket: %m"); - - log_debug("Making ephemeral snapshot of %s to %s", - context->root_image ?: context->root_directory, runtime->ephemeral_copy); - - if (context->root_image) - fd = copy_file(context->root_image, runtime->ephemeral_copy, O_EXCL, 0600, - COPY_LOCK_BSD|COPY_REFLINK|COPY_CRTIME); - else - fd = btrfs_subvol_snapshot_at(AT_FDCWD, context->root_directory, - AT_FDCWD, runtime->ephemeral_copy, - BTRFS_SNAPSHOT_FALLBACK_COPY | - BTRFS_SNAPSHOT_FALLBACK_DIRECTORY | - BTRFS_SNAPSHOT_RECURSIVE | - BTRFS_SNAPSHOT_LOCK_BSD); - if (fd < 0) - return log_debug_errno(fd, "Failed to snapshot %s to %s: %m", - context->root_image ?: context->root_directory, runtime->ephemeral_copy); - - if (context->root_image) { - /* A root image might be subject to lots of random writes so let's try to disable COW on it - * which tends to not perform well in combination with lots of random writes. - * - * Note: btrfs actually isn't impressed by us setting the flag after making the reflink'ed - * copy, but we at least want to make the intention clear. - */ - r = chattr_fd(fd, FS_NOCOW_FL, FS_NOCOW_FL, NULL); - if (r < 0) - log_debug_errno(fd, "Failed to disable copy-on-write for %s, ignoring: %m", runtime->ephemeral_copy); - } - - r = send_one_fd(runtime->ephemeral_storage_socket[1], fd, MSG_DONTWAIT); - if (r < 0) - return log_debug_errno(r, "Failed to queue file descriptor on ephemeral storage socket: %m"); - - return 1; -} - -static int verity_settings_prepare( - VeritySettings *verity, - const char *root_image, - const void *root_hash, - size_t root_hash_size, - const char *root_hash_path, - const void *root_hash_sig, - size_t root_hash_sig_size, - const char *root_hash_sig_path, - const char *verity_data_path) { - - int r; - - assert(verity); - - if (root_hash) { - void *d; - - d = memdup(root_hash, root_hash_size); - if (!d) - return -ENOMEM; - - free_and_replace(verity->root_hash, d); - verity->root_hash_size = root_hash_size; - verity->designator = PARTITION_ROOT; - } - - if (root_hash_sig) { - void *d; - - d = memdup(root_hash_sig, root_hash_sig_size); - if (!d) - return -ENOMEM; - - free_and_replace(verity->root_hash_sig, d); - verity->root_hash_sig_size = root_hash_sig_size; - verity->designator = PARTITION_ROOT; - } - - if (verity_data_path) { - r = free_and_strdup(&verity->data_path, verity_data_path); - if (r < 0) - return r; - } - - r = verity_settings_load( - verity, - root_image, - root_hash_path, - root_hash_sig_path); - if (r < 0) - return log_debug_errno(r, "Failed to load root hash: %m"); - - return 0; -} - -static int apply_mount_namespace( - const Unit *u, - ExecCommandFlags command_flags, - const ExecContext *context, - const ExecParameters *params, - ExecRuntime *runtime, - const char *memory_pressure_path, - char **error_path) { - - _cleanup_(verity_settings_done) VeritySettings verity = VERITY_SETTINGS_DEFAULT; - _cleanup_strv_free_ char **empty_directories = NULL, **symlinks = NULL, - **read_write_paths_cleanup = NULL; - _cleanup_free_ char *creds_path = NULL, *incoming_dir = NULL, *propagate_dir = NULL, - *extension_dir = NULL, *host_os_release_stage = NULL; - const char *root_dir = NULL, *root_image = NULL, *tmp_dir = NULL, *var_tmp_dir = NULL; - char **read_write_paths; - bool needs_sandboxing, setup_os_release_symlink; - BindMount *bind_mounts = NULL; - size_t n_bind_mounts = 0; - int r; - - assert(context); - - CLEANUP_ARRAY(bind_mounts, n_bind_mounts, bind_mount_free_many); - - if (params->flags & EXEC_APPLY_CHROOT) { - r = setup_ephemeral(context, runtime); - if (r < 0) - return r; - - if (context->root_image) - root_image = (runtime ? runtime->ephemeral_copy : NULL) ?: context->root_image; - else - root_dir = (runtime ? runtime->ephemeral_copy : NULL) ?: context->root_directory; - } - - r = compile_bind_mounts(context, params, &bind_mounts, &n_bind_mounts, &empty_directories); - if (r < 0) - return r; - - /* We need to make the pressure path writable even if /sys/fs/cgroups is made read-only, as the - * service will need to write to it in order to start the notifications. */ - if (context->protect_control_groups && memory_pressure_path && !streq(memory_pressure_path, "/dev/null")) { - read_write_paths_cleanup = strv_copy(context->read_write_paths); - if (!read_write_paths_cleanup) - return -ENOMEM; - - r = strv_extend(&read_write_paths_cleanup, memory_pressure_path); - if (r < 0) - return r; - - read_write_paths = read_write_paths_cleanup; - } else - read_write_paths = context->read_write_paths; - - needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command_flags & EXEC_COMMAND_FULLY_PRIVILEGED); - if (needs_sandboxing) { - /* The runtime struct only contains the parent of the private /tmp, which is non-accessible - * to world users. Inside of it there's a /tmp that is sticky, and that's the one we want to - * use here. This does not apply when we are using /run/systemd/empty as fallback. */ - - if (context->private_tmp && runtime && runtime->shared) { - if (streq_ptr(runtime->shared->tmp_dir, RUN_SYSTEMD_EMPTY)) - tmp_dir = runtime->shared->tmp_dir; - else if (runtime->shared->tmp_dir) - tmp_dir = strjoina(runtime->shared->tmp_dir, "/tmp"); - - if (streq_ptr(runtime->shared->var_tmp_dir, RUN_SYSTEMD_EMPTY)) - var_tmp_dir = runtime->shared->var_tmp_dir; - else if (runtime->shared->var_tmp_dir) - var_tmp_dir = strjoina(runtime->shared->var_tmp_dir, "/tmp"); - } - } - - /* Symlinks (exec dirs, os-release) are set up after other mounts, before they are made read-only. */ - setup_os_release_symlink = needs_sandboxing && exec_context_get_effective_mount_apivfs(context) && (root_dir || root_image); - r = compile_symlinks(context, params, setup_os_release_symlink, &symlinks); - if (r < 0) - return r; - - if (context->mount_propagation_flag == MS_SHARED) - log_unit_debug(u, "shared mount propagation hidden by other fs namespacing unit settings: ignoring"); - - if (FLAGS_SET(params->flags, EXEC_WRITE_CREDENTIALS)) { - r = exec_context_get_credential_directory(context, params, u->id, &creds_path); - if (r < 0) - return r; - } - - if (params->runtime_scope == RUNTIME_SCOPE_SYSTEM) { - propagate_dir = path_join("/run/systemd/propagate/", u->id); - if (!propagate_dir) - return -ENOMEM; - - incoming_dir = strdup("/run/systemd/incoming"); - if (!incoming_dir) - return -ENOMEM; - - extension_dir = strdup("/run/systemd/unit-extensions"); - if (!extension_dir) - return -ENOMEM; - - /* If running under a different root filesystem, propagate the host's os-release. We make a - * copy rather than just bind mounting it, so that it can be updated on soft-reboot. */ - if (setup_os_release_symlink) { - host_os_release_stage = strdup("/run/systemd/propagate/.os-release-stage"); - if (!host_os_release_stage) - return -ENOMEM; - } - } else { - assert(params->runtime_scope == RUNTIME_SCOPE_USER); - - if (asprintf(&extension_dir, "/run/user/" UID_FMT "/systemd/unit-extensions", geteuid()) < 0) - return -ENOMEM; - - if (setup_os_release_symlink) { - if (asprintf(&host_os_release_stage, - "/run/user/" UID_FMT "/systemd/propagate/.os-release-stage", - geteuid()) < 0) - return -ENOMEM; - } - } - - if (root_image) { - r = verity_settings_prepare( - &verity, - root_image, - context->root_hash, context->root_hash_size, context->root_hash_path, - context->root_hash_sig, context->root_hash_sig_size, context->root_hash_sig_path, - context->root_verity); - if (r < 0) - return r; - } - - NamespaceParameters parameters = { - .runtime_scope = params->runtime_scope, - - .root_directory = root_dir, - .root_image = root_image, - .root_image_options = context->root_image_options, - .root_image_policy = context->root_image_policy ?: &image_policy_service, - - .read_write_paths = read_write_paths, - .read_only_paths = needs_sandboxing ? context->read_only_paths : NULL, - .inaccessible_paths = needs_sandboxing ? context->inaccessible_paths : NULL, - - .exec_paths = needs_sandboxing ? context->exec_paths : NULL, - .no_exec_paths = needs_sandboxing ? context->no_exec_paths : NULL, - - .empty_directories = empty_directories, - .symlinks = symlinks, - - .bind_mounts = bind_mounts, - .n_bind_mounts = n_bind_mounts, - - .temporary_filesystems = context->temporary_filesystems, - .n_temporary_filesystems = context->n_temporary_filesystems, - - .mount_images = context->mount_images, - .n_mount_images = context->n_mount_images, - .mount_image_policy = context->mount_image_policy ?: &image_policy_service, - - .tmp_dir = tmp_dir, - .var_tmp_dir = var_tmp_dir, - - .creds_path = creds_path, - .log_namespace = context->log_namespace, - .mount_propagation_flag = context->mount_propagation_flag, - - .verity = &verity, - - .extension_images = context->extension_images, - .n_extension_images = context->n_extension_images, - .extension_image_policy = context->extension_image_policy ?: &image_policy_sysext, - .extension_directories = context->extension_directories, - - .propagate_dir = propagate_dir, - .incoming_dir = incoming_dir, - .extension_dir = extension_dir, - .notify_socket = root_dir || root_image ? params->notify_socket : NULL, - .host_os_release_stage = host_os_release_stage, - - /* If DynamicUser=no and RootDirectory= is set then lets pass a relaxed sandbox info, - * otherwise enforce it, don't ignore protected paths and fail if we are enable to apply the - * sandbox inside the mount namespace. */ - .ignore_protect_paths = !needs_sandboxing && !context->dynamic_user && root_dir, - - .protect_control_groups = needs_sandboxing && context->protect_control_groups, - .protect_kernel_tunables = needs_sandboxing && context->protect_kernel_tunables, - .protect_kernel_modules = needs_sandboxing && context->protect_kernel_modules, - .protect_kernel_logs = needs_sandboxing && context->protect_kernel_logs, - .protect_hostname = needs_sandboxing && context->protect_hostname, - - .private_dev = needs_sandboxing && context->private_devices, - .private_network = needs_sandboxing && exec_needs_network_namespace(context), - .private_ipc = needs_sandboxing && exec_needs_ipc_namespace(context), - - .mount_apivfs = needs_sandboxing && exec_context_get_effective_mount_apivfs(context), - - /* If NNP is on, we can turn on MS_NOSUID, since it won't have any effect anymore. */ - .mount_nosuid = needs_sandboxing && context->no_new_privileges && !mac_selinux_use(), - - .protect_home = needs_sandboxing && context->protect_home, - .protect_system = needs_sandboxing && context->protect_system, - .protect_proc = needs_sandboxing && context->protect_proc, - .proc_subset = needs_sandboxing && context->proc_subset, - }; - - r = setup_namespace(¶meters, error_path); - /* If we couldn't set up the namespace this is probably due to a missing capability. setup_namespace() reports - * that with a special, recognizable error ENOANO. In this case, silently proceed, but only if exclusively - * sandboxing options were used, i.e. nothing such as RootDirectory= or BindMount= that would result in a - * completely different execution environment. */ - if (r == -ENOANO) { - if (insist_on_sandboxing( - context, - root_dir, root_image, - bind_mounts, - n_bind_mounts)) - return log_unit_debug_errno(u, - SYNTHETIC_ERRNO(EOPNOTSUPP), - "Failed to set up namespace, and refusing to continue since " - "the selected namespacing options alter mount environment non-trivially.\n" - "Bind mounts: %zu, temporary filesystems: %zu, root directory: %s, root image: %s, dynamic user: %s", - n_bind_mounts, - context->n_temporary_filesystems, - yes_no(root_dir), - yes_no(root_image), - yes_no(context->dynamic_user)); - - log_unit_debug(u, "Failed to set up namespace, assuming containerized execution and ignoring."); - return 0; - } - - return r; -} - -static int apply_working_directory( - const ExecContext *context, - const ExecParameters *params, - ExecRuntime *runtime, - const char *home, - int *exit_status) { - - const char *d, *wd; - - assert(context); - assert(exit_status); - - if (context->working_directory_home) { - - if (!home) { - *exit_status = EXIT_CHDIR; - return -ENXIO; - } - - wd = home; - - } else - wd = empty_to_root(context->working_directory); - - if (params->flags & EXEC_APPLY_CHROOT) - d = wd; - else - d = prefix_roota((runtime ? runtime->ephemeral_copy : NULL) ?: context->root_directory, wd); - - if (chdir(d) < 0 && !context->working_directory_missing_ok) { - *exit_status = EXIT_CHDIR; - return -errno; - } - - return 0; -} - -static int apply_root_directory( - const ExecContext *context, - const ExecParameters *params, - ExecRuntime *runtime, - const bool needs_mount_ns, - int *exit_status) { - - assert(context); - assert(exit_status); - - if (params->flags & EXEC_APPLY_CHROOT) - if (!needs_mount_ns && context->root_directory) - if (chroot((runtime ? runtime->ephemeral_copy : NULL) ?: context->root_directory) < 0) { - *exit_status = EXIT_CHROOT; - return -errno; - } - - return 0; -} - -static int setup_keyring( - const Unit *u, - const ExecContext *context, - const ExecParameters *p, - uid_t uid, gid_t gid) { - - key_serial_t keyring; - int r = 0; - uid_t saved_uid; - gid_t saved_gid; - - assert(u); - assert(context); - assert(p); - - /* Let's set up a new per-service "session" kernel keyring for each system service. This has the benefit that - * each service runs with its own keyring shared among all processes of the service, but with no hook-up beyond - * that scope, and in particular no link to the per-UID keyring. If we don't do this the keyring will be - * automatically created on-demand and then linked to the per-UID keyring, by the kernel. The kernel's built-in - * on-demand behaviour is very appropriate for login users, but probably not so much for system services, where - * UIDs are not necessarily specific to a service but reused (at least in the case of UID 0). */ - - if (context->keyring_mode == EXEC_KEYRING_INHERIT) - return 0; - - /* Acquiring a reference to the user keyring is nasty. We briefly change identity in order to get things set up - * properly by the kernel. If we don't do that then we can't create it atomically, and that sucks for parallel - * execution. This mimics what pam_keyinit does, too. Setting up session keyring, to be owned by the right user - * & group is just as nasty as acquiring a reference to the user keyring. */ - - saved_uid = getuid(); - saved_gid = getgid(); - - if (gid_is_valid(gid) && gid != saved_gid) { - if (setregid(gid, -1) < 0) - return log_unit_error_errno(u, errno, "Failed to change GID for user keyring: %m"); - } - - if (uid_is_valid(uid) && uid != saved_uid) { - if (setreuid(uid, -1) < 0) { - r = log_unit_error_errno(u, errno, "Failed to change UID for user keyring: %m"); - goto out; - } - } - - keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0); - if (keyring == -1) { - if (errno == ENOSYS) - log_unit_debug_errno(u, errno, "Kernel keyring not supported, ignoring."); - else if (ERRNO_IS_PRIVILEGE(errno)) - log_unit_debug_errno(u, errno, "Kernel keyring access prohibited, ignoring."); - else if (errno == EDQUOT) - log_unit_debug_errno(u, errno, "Out of kernel keyrings to allocate, ignoring."); - else - r = log_unit_error_errno(u, errno, "Setting up kernel keyring failed: %m"); - - goto out; - } - - /* When requested link the user keyring into the session keyring. */ - if (context->keyring_mode == EXEC_KEYRING_SHARED) { - - if (keyctl(KEYCTL_LINK, - KEY_SPEC_USER_KEYRING, - KEY_SPEC_SESSION_KEYRING, 0, 0) < 0) { - r = log_unit_error_errno(u, errno, "Failed to link user keyring into session keyring: %m"); - goto out; - } - } - - /* Restore uid/gid back */ - if (uid_is_valid(uid) && uid != saved_uid) { - if (setreuid(saved_uid, -1) < 0) { - r = log_unit_error_errno(u, errno, "Failed to change UID back for user keyring: %m"); - goto out; - } - } - - if (gid_is_valid(gid) && gid != saved_gid) { - if (setregid(saved_gid, -1) < 0) - return log_unit_error_errno(u, errno, "Failed to change GID back for user keyring: %m"); - } - - /* Populate they keyring with the invocation ID by default, as original saved_uid. */ - if (!sd_id128_is_null(u->invocation_id)) { - key_serial_t key; - - key = add_key("user", "invocation_id", &u->invocation_id, sizeof(u->invocation_id), KEY_SPEC_SESSION_KEYRING); - if (key == -1) - log_unit_debug_errno(u, errno, "Failed to add invocation ID to keyring, ignoring: %m"); - else { - if (keyctl(KEYCTL_SETPERM, key, - KEY_POS_VIEW|KEY_POS_READ|KEY_POS_SEARCH| - KEY_USR_VIEW|KEY_USR_READ|KEY_USR_SEARCH, 0, 0) < 0) - r = log_unit_error_errno(u, errno, "Failed to restrict invocation ID permission: %m"); - } - } - -out: - /* Revert back uid & gid for the last time, and exit */ - /* no extra logging, as only the first already reported error matters */ - if (getuid() != saved_uid) - (void) setreuid(saved_uid, -1); - - if (getgid() != saved_gid) - (void) setregid(saved_gid, -1); - - return r; -} - -static void append_socket_pair(int *array, size_t *n, const int pair[static 2]) { - assert(array); - assert(n); - assert(pair); - - if (pair[0] >= 0) - array[(*n)++] = pair[0]; - if (pair[1] >= 0) - array[(*n)++] = pair[1]; -} - -static int close_remaining_fds( - const ExecParameters *params, - const ExecRuntime *runtime, - int user_lookup_fd, - int socket_fd, - const int *fds, size_t n_fds) { - - size_t n_dont_close = 0; - int dont_close[n_fds + 14]; - - assert(params); - - if (params->stdin_fd >= 0) - dont_close[n_dont_close++] = params->stdin_fd; - if (params->stdout_fd >= 0) - dont_close[n_dont_close++] = params->stdout_fd; - if (params->stderr_fd >= 0) - dont_close[n_dont_close++] = params->stderr_fd; - - if (socket_fd >= 0) - dont_close[n_dont_close++] = socket_fd; - if (n_fds > 0) { - memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds); - n_dont_close += n_fds; - } - - if (runtime) - append_socket_pair(dont_close, &n_dont_close, runtime->ephemeral_storage_socket); - - if (runtime && runtime->shared) { - append_socket_pair(dont_close, &n_dont_close, runtime->shared->netns_storage_socket); - append_socket_pair(dont_close, &n_dont_close, runtime->shared->ipcns_storage_socket); - } - - if (runtime && runtime->dynamic_creds) { - if (runtime->dynamic_creds->user) - append_socket_pair(dont_close, &n_dont_close, runtime->dynamic_creds->user->storage_socket); - if (runtime->dynamic_creds->group) - append_socket_pair(dont_close, &n_dont_close, runtime->dynamic_creds->group->storage_socket); - } - - if (user_lookup_fd >= 0) - dont_close[n_dont_close++] = user_lookup_fd; - - return close_all_fds(dont_close, n_dont_close); -} - -static int send_user_lookup( - Unit *unit, - int user_lookup_fd, - uid_t uid, - gid_t gid) { - - assert(unit); - - /* Send the resolved UID/GID to PID 1 after we learnt it. We send a single datagram, containing the UID/GID - * data as well as the unit name. Note that we suppress sending this if no user/group to resolve was - * specified. */ - - if (user_lookup_fd < 0) - return 0; - - if (!uid_is_valid(uid) && !gid_is_valid(gid)) - return 0; - - if (writev(user_lookup_fd, - (struct iovec[]) { - IOVEC_MAKE(&uid, sizeof(uid)), - IOVEC_MAKE(&gid, sizeof(gid)), - IOVEC_MAKE_STRING(unit->id) }, 3) < 0) - return -errno; - - return 0; -} - -static int acquire_home(const ExecContext *c, uid_t uid, const char** home, char **buf) { - int r; - - assert(c); - assert(home); - assert(buf); - - /* If WorkingDirectory=~ is set, try to acquire a usable home directory. */ - - if (*home) - return 0; - - if (!c->working_directory_home) - return 0; - - r = get_home_dir(buf); - if (r < 0) - return r; - - *home = *buf; - return 1; -} - -static int compile_suggested_paths(const ExecContext *c, const ExecParameters *p, char ***ret) { - _cleanup_strv_free_ char ** list = NULL; - int r; - - assert(c); - assert(p); - assert(ret); - - assert(c->dynamic_user); - - /* Compile a list of paths that it might make sense to read the owning UID from to use as initial candidate for - * dynamic UID allocation, in order to save us from doing costly recursive chown()s of the special - * directories. */ - - for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) { - if (t == EXEC_DIRECTORY_CONFIGURATION) - continue; - - if (!p->prefix[t]) - continue; - - for (size_t i = 0; i < c->directories[t].n_items; i++) { - char *e; - - if (exec_directory_is_private(c, t)) - e = path_join(p->prefix[t], "private", c->directories[t].items[i].path); - else - e = path_join(p->prefix[t], c->directories[t].items[i].path); - if (!e) - return -ENOMEM; - - r = strv_consume(&list, e); - if (r < 0) - return r; - } - } - - *ret = TAKE_PTR(list); - - return 0; -} - -static int exec_parameters_get_cgroup_path( +int exec_params_get_cgroup_path( const ExecParameters *params, const CGroupContext *c, char **ret) { @@ -3718,181 +309,12 @@ static int exec_parameters_get_cgroup_path( return !!subgroup; } -static int exec_context_cpu_affinity_from_numa(const ExecContext *c, CPUSet *ret) { - _cleanup_(cpu_set_reset) CPUSet s = {}; - int r; - - assert(c); - assert(ret); - - if (!c->numa_policy.nodes.set) { - log_debug("Can't derive CPU affinity mask from NUMA mask because NUMA mask is not set, ignoring"); - return 0; - } - - r = numa_to_cpu_set(&c->numa_policy, &s); - if (r < 0) - return r; - - cpu_set_reset(ret); - - return cpu_set_add_all(ret, &s); -} - bool exec_context_get_cpu_affinity_from_numa(const ExecContext *c) { assert(c); return c->cpu_affinity_from_numa; } -static int add_shifted_fd(int *fds, size_t fds_size, size_t *n_fds, int fd, int *ret_fd) { - int r; - - assert(fds); - assert(n_fds); - assert(*n_fds < fds_size); - assert(ret_fd); - - if (fd < 0) { - *ret_fd = -EBADF; - return 0; - } - - if (fd < 3 + (int) *n_fds) { - /* Let's move the fd up, so that it's outside of the fd range we will use to store - * the fds we pass to the process (or which are closed only during execve). */ - - r = fcntl(fd, F_DUPFD_CLOEXEC, 3 + (int) *n_fds); - if (r < 0) - return -errno; - - close_and_replace(fd, r); - } - - *ret_fd = fds[*n_fds] = fd; - (*n_fds) ++; - return 1; -} - -static int connect_unix_harder(Unit *u, const OpenFile *of, int ofd) { - union sockaddr_union addr = { - .un.sun_family = AF_UNIX, - }; - socklen_t sa_len; - static const int socket_types[] = { SOCK_DGRAM, SOCK_STREAM, SOCK_SEQPACKET }; - int r; - - assert(u); - assert(of); - assert(ofd >= 0); - - r = sockaddr_un_set_path(&addr.un, FORMAT_PROC_FD_PATH(ofd)); - if (r < 0) - return log_unit_error_errno(u, r, "Failed to set sockaddr for %s: %m", of->path); - - sa_len = r; - - for (size_t i = 0; i < ELEMENTSOF(socket_types); i++) { - _cleanup_close_ int fd = -EBADF; - - fd = socket(AF_UNIX, socket_types[i] | SOCK_CLOEXEC, 0); - if (fd < 0) - return log_unit_error_errno(u, errno, "Failed to create socket for %s: %m", of->path); - - r = RET_NERRNO(connect(fd, &addr.sa, sa_len)); - if (r == -EPROTOTYPE) - continue; - if (r < 0) - return log_unit_error_errno(u, r, "Failed to connect socket for %s: %m", of->path); - - return TAKE_FD(fd); - } - - return log_unit_error_errno(u, SYNTHETIC_ERRNO(EPROTOTYPE), "Failed to connect socket for \"%s\".", of->path); -} - -static int get_open_file_fd(Unit *u, const OpenFile *of) { - struct stat st; - _cleanup_close_ int fd = -EBADF, ofd = -EBADF; - - assert(u); - assert(of); - - ofd = open(of->path, O_PATH | O_CLOEXEC); - if (ofd < 0) - return log_unit_error_errno(u, errno, "Could not open \"%s\": %m", of->path); - - if (fstat(ofd, &st) < 0) - return log_unit_error_errno(u, errno, "Failed to stat %s: %m", of->path); - - if (S_ISSOCK(st.st_mode)) { - fd = connect_unix_harder(u, of, ofd); - if (fd < 0) - return fd; - - if (FLAGS_SET(of->flags, OPENFILE_READ_ONLY) && shutdown(fd, SHUT_WR) < 0) - return log_unit_error_errno(u, errno, "Failed to shutdown send for socket %s: %m", - of->path); - - log_unit_debug(u, "socket %s opened (fd=%d)", of->path, fd); - } else { - int flags = FLAGS_SET(of->flags, OPENFILE_READ_ONLY) ? O_RDONLY : O_RDWR; - if (FLAGS_SET(of->flags, OPENFILE_APPEND)) - flags |= O_APPEND; - else if (FLAGS_SET(of->flags, OPENFILE_TRUNCATE)) - flags |= O_TRUNC; - - fd = fd_reopen(ofd, flags | O_CLOEXEC); - if (fd < 0) - return log_unit_error_errno(u, fd, "Failed to open file %s: %m", of->path); - - log_unit_debug(u, "file %s opened (fd=%d)", of->path, fd); - } - - return TAKE_FD(fd); -} - -static int collect_open_file_fds( - Unit *u, - OpenFile* open_files, - int **fds, - char ***fdnames, - size_t *n_fds) { - int r; - - assert(u); - assert(fds); - assert(fdnames); - assert(n_fds); - - LIST_FOREACH(open_files, of, open_files) { - _cleanup_close_ int fd = -EBADF; - - fd = get_open_file_fd(u, of); - if (fd < 0) { - if (FLAGS_SET(of->flags, OPENFILE_GRACEFUL)) { - log_unit_debug_errno(u, fd, "Failed to get OpenFile= file descriptor for %s, ignoring: %m", of->path); - continue; - } - - return fd; - } - - if (!GREEDY_REALLOC(*fds, *n_fds + 1)) - return -ENOMEM; - - r = strv_extend(fdnames, of->fdname); - if (r < 0) - return r; - - (*fds)[*n_fds] = TAKE_FD(fd); - - (*n_fds)++; - } - - return 0; -} - static void log_command_line(Unit *unit, const char *msg, const char *executable, char **argv) { assert(unit); assert(msg); @@ -3909,1281 +331,36 @@ static void log_command_line(Unit *unit, const char *msg, const char *executable LOG_UNIT_INVOCATION_ID(unit)); } -static bool exec_context_need_unprivileged_private_users( - const ExecContext *context, - const ExecParameters *params) { - - assert(context); - assert(params); - - /* These options require PrivateUsers= when used in user units, as we need to be in a user namespace - * to have permission to enable them when not running as root. If we have effective CAP_SYS_ADMIN - * (system manager) then we have privileges and don't need this. */ - if (params->runtime_scope != RUNTIME_SCOPE_USER) - return false; - - return context->private_users || - context->private_tmp || - context->private_devices || - context->private_network || - context->network_namespace_path || - context->private_ipc || - context->ipc_namespace_path || - context->private_mounts > 0 || - context->mount_apivfs || - context->n_bind_mounts > 0 || - context->n_temporary_filesystems > 0 || - context->root_directory || - !strv_isempty(context->extension_directories) || - context->protect_system != PROTECT_SYSTEM_NO || - context->protect_home != PROTECT_HOME_NO || - context->protect_kernel_tunables || - context->protect_kernel_modules || - context->protect_kernel_logs || - context->protect_control_groups || - context->protect_clock || - context->protect_hostname || - !strv_isempty(context->read_write_paths) || - !strv_isempty(context->read_only_paths) || - !strv_isempty(context->inaccessible_paths) || - !strv_isempty(context->exec_paths) || - !strv_isempty(context->no_exec_paths); -} - -static int exec_child( - Unit *unit, - const ExecCommand *command, - const ExecContext *context, - const ExecParameters *params, - ExecRuntime *runtime, - const CGroupContext *cgroup_context, - int socket_fd, - const int named_iofds[static 3], - int *params_fds, - size_t n_socket_fds, - size_t n_storage_fds, - char **files_env, - int user_lookup_fd, - int *exit_status) { - - _cleanup_strv_free_ char **our_env = NULL, **pass_env = NULL, **joined_exec_search_path = NULL, **accum_env = NULL, **replaced_argv = NULL; - int r, ngids = 0, exec_fd; - _cleanup_free_ gid_t *supplementary_gids = NULL; - const char *username = NULL, *groupname = NULL; - _cleanup_free_ char *home_buffer = NULL, *memory_pressure_path = NULL; - const char *home = NULL, *shell = NULL; - char **final_argv = NULL; - dev_t journal_stream_dev = 0; - ino_t journal_stream_ino = 0; - bool userns_set_up = false; - bool needs_sandboxing, /* Do we need to set up full sandboxing? (i.e. all namespacing, all MAC stuff, caps, yadda yadda */ - needs_setuid, /* Do we need to do the actual setresuid()/setresgid() calls? */ - needs_mount_namespace, /* Do we need to set up a mount namespace for this kernel? */ - needs_ambient_hack; /* Do we need to apply the ambient capabilities hack? */ -#if HAVE_SELINUX - _cleanup_free_ char *mac_selinux_context_net = NULL; - bool use_selinux = false; -#endif -#if ENABLE_SMACK - bool use_smack = false; -#endif -#if HAVE_APPARMOR - bool use_apparmor = false; -#endif - uid_t saved_uid = getuid(); - gid_t saved_gid = getgid(); - uid_t uid = UID_INVALID; - gid_t gid = GID_INVALID; - size_t n_fds = n_socket_fds + n_storage_fds, /* fds to pass to the child */ - n_keep_fds; /* total number of fds not to close */ - int secure_bits; - _cleanup_free_ gid_t *gids_after_pam = NULL; - int ngids_after_pam = 0; - _cleanup_free_ int *fds = NULL; - _cleanup_strv_free_ char **fdnames = NULL; - - assert(unit); - assert(command); - assert(context); - assert(params); - assert(exit_status); - - /* Explicitly test for CVE-2021-4034 inspired invocations */ - assert(command->path); - assert(!strv_isempty(command->argv)); - - rename_process_from_path(command->path); - - /* We reset exactly these signals, since they are the only ones we set to SIG_IGN in the main - * daemon. All others we leave untouched because we set them to SIG_DFL or a valid handler initially, - * both of which will be demoted to SIG_DFL. */ - (void) default_signals(SIGNALS_CRASH_HANDLER, - SIGNALS_IGNORE); - - if (context->ignore_sigpipe) - (void) ignore_signals(SIGPIPE); - - r = reset_signal_mask(); - if (r < 0) { - *exit_status = EXIT_SIGNAL_MASK; - return log_unit_error_errno(unit, r, "Failed to set process signal mask: %m"); - } - - if (params->idle_pipe) - do_idle_pipe_dance(params->idle_pipe); - - /* Close fds we don't need very early to make sure we don't block init reexecution because it cannot bind its - * sockets. Among the fds we close are the logging fds, and we want to keep them closed, so that we don't have - * any fds open we don't really want open during the transition. In order to make logging work, we switch the - * log subsystem into open_when_needed mode, so that it reopens the logs on every single log call. */ - - log_forget_fds(); - log_set_open_when_needed(true); - log_settle_target(); - if (context->log_level_max >= 0) - log_set_max_level(context->log_level_max); - - /* In case anything used libc syslog(), close this here, too */ - closelog(); - - fds = newdup(int, params_fds, n_fds); - if (!fds) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - - fdnames = strv_copy((char**) params->fd_names); - if (!fdnames) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - - r = collect_open_file_fds(unit, params->open_files, &fds, &fdnames, &n_fds); - if (r < 0) { - *exit_status = EXIT_FDS; - return log_unit_error_errno(unit, r, "Failed to get OpenFile= file descriptors: %m"); - } - - int keep_fds[n_fds + 3]; - memcpy_safe(keep_fds, fds, n_fds * sizeof(int)); - n_keep_fds = n_fds; - - r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, params->exec_fd, &exec_fd); - if (r < 0) { - *exit_status = EXIT_FDS; - return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m"); - } - -#if HAVE_LIBBPF - if (unit->manager->restrict_fs) { - int bpf_map_fd = lsm_bpf_map_restrict_fs_fd(unit); - if (bpf_map_fd < 0) { - *exit_status = EXIT_FDS; - return log_unit_error_errno(unit, bpf_map_fd, "Failed to get restrict filesystems BPF map fd: %m"); - } - - r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, bpf_map_fd, &bpf_map_fd); - if (r < 0) { - *exit_status = EXIT_FDS; - return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m"); - } - } -#endif - - r = close_remaining_fds(params, runtime, user_lookup_fd, socket_fd, keep_fds, n_keep_fds); - if (r < 0) { - *exit_status = EXIT_FDS; - return log_unit_error_errno(unit, r, "Failed to close unwanted file descriptors: %m"); - } - - if (!context->same_pgrp && - setsid() < 0) { - *exit_status = EXIT_SETSID; - return log_unit_error_errno(unit, errno, "Failed to create new process session: %m"); - } - - exec_context_tty_reset(context, params); - - if (unit_shall_confirm_spawn(unit)) { - _cleanup_free_ char *cmdline = NULL; - - cmdline = quote_command_line(command->argv, SHELL_ESCAPE_EMPTY); - if (!cmdline) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - - r = ask_for_confirmation(context, params->confirm_spawn, unit, cmdline); - if (r != CONFIRM_EXECUTE) { - if (r == CONFIRM_PRETEND_SUCCESS) { - *exit_status = EXIT_SUCCESS; - return 0; - } - - *exit_status = EXIT_CONFIRM; - return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ECANCELED), - "Execution cancelled by the user"); - } - } - - /* We are about to invoke NSS and PAM modules. Let's tell them what we are doing here, maybe they care. This is - * used by nss-resolve to disable itself when we are about to start systemd-resolved, to avoid deadlocks. Note - * that these env vars do not survive the execve(), which means they really only apply to the PAM and NSS - * invocations themselves. Also note that while we'll only invoke NSS modules involved in user management they - * might internally call into other NSS modules that are involved in hostname resolution, we never know. */ - if (setenv("SYSTEMD_ACTIVATION_UNIT", unit->id, true) != 0 || - setenv("SYSTEMD_ACTIVATION_SCOPE", runtime_scope_to_string(params->runtime_scope), true) != 0) { - *exit_status = EXIT_MEMORY; - return log_unit_error_errno(unit, errno, "Failed to update environment: %m"); - } - - if (context->dynamic_user && runtime && runtime->dynamic_creds) { - _cleanup_strv_free_ char **suggested_paths = NULL; - - /* On top of that, make sure we bypass our own NSS module nss-systemd comprehensively for any NSS - * checks, if DynamicUser=1 is used, as we shouldn't create a feedback loop with ourselves here. */ - if (putenv((char*) "SYSTEMD_NSS_DYNAMIC_BYPASS=1") != 0) { - *exit_status = EXIT_USER; - return log_unit_error_errno(unit, errno, "Failed to update environment: %m"); - } - - r = compile_suggested_paths(context, params, &suggested_paths); - if (r < 0) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - - r = dynamic_creds_realize(runtime->dynamic_creds, suggested_paths, &uid, &gid); - if (r < 0) { - *exit_status = EXIT_USER; - if (r == -EILSEQ) - return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP), - "Failed to update dynamic user credentials: User or group with specified name already exists."); - return log_unit_error_errno(unit, r, "Failed to update dynamic user credentials: %m"); - } - - if (!uid_is_valid(uid)) { - *exit_status = EXIT_USER; - return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ESRCH), "UID validation failed for \""UID_FMT"\"", uid); - } - - if (!gid_is_valid(gid)) { - *exit_status = EXIT_USER; - return log_unit_error_errno(unit, SYNTHETIC_ERRNO(ESRCH), "GID validation failed for \""GID_FMT"\"", gid); - } - - if (runtime->dynamic_creds->user) - username = runtime->dynamic_creds->user->name; - - } else { - if (context->user) { - r = get_fixed_user(context->user, &username, &uid, &gid, &home, &shell); - if (r < 0) { - *exit_status = EXIT_USER; - return log_unit_error_errno(unit, r, "Failed to determine user credentials: %m"); - } - } - - if (context->group) { - r = get_fixed_group(context->group, &groupname, &gid); - if (r < 0) { - *exit_status = EXIT_GROUP; - return log_unit_error_errno(unit, r, "Failed to determine group credentials: %m"); - } - } - } - - /* Initialize user supplementary groups and get SupplementaryGroups= ones */ - r = get_supplementary_groups(context, username, groupname, gid, - &supplementary_gids, &ngids); - if (r < 0) { - *exit_status = EXIT_GROUP; - return log_unit_error_errno(unit, r, "Failed to determine supplementary groups: %m"); - } - - r = send_user_lookup(unit, user_lookup_fd, uid, gid); - if (r < 0) { - *exit_status = EXIT_USER; - return log_unit_error_errno(unit, r, "Failed to send user credentials to PID1: %m"); - } - - user_lookup_fd = safe_close(user_lookup_fd); - - r = acquire_home(context, uid, &home, &home_buffer); - if (r < 0) { - *exit_status = EXIT_CHDIR; - return log_unit_error_errno(unit, r, "Failed to determine $HOME for user: %m"); - } - - /* If a socket is connected to STDIN/STDOUT/STDERR, we must drop O_NONBLOCK */ - if (socket_fd >= 0) - (void) fd_nonblock(socket_fd, false); - - /* Journald will try to look-up our cgroup in order to populate _SYSTEMD_CGROUP and _SYSTEMD_UNIT fields. - * Hence we need to migrate to the target cgroup from init.scope before connecting to journald */ - if (params->cgroup_path) { - _cleanup_free_ char *p = NULL; - - r = exec_parameters_get_cgroup_path(params, cgroup_context, &p); - if (r < 0) { - *exit_status = EXIT_CGROUP; - return log_unit_error_errno(unit, r, "Failed to acquire cgroup path: %m"); - } - - r = cg_attach_everywhere(params->cgroup_supported, p, 0, NULL, NULL); - if (r == -EUCLEAN) { - *exit_status = EXIT_CGROUP; - return log_unit_error_errno(unit, r, "Failed to attach process to cgroup %s " - "because the cgroup or one of its parents or " - "siblings is in the threaded mode: %m", p); - } - if (r < 0) { - *exit_status = EXIT_CGROUP; - return log_unit_error_errno(unit, r, "Failed to attach to cgroup %s: %m", p); - } - } - - if (context->network_namespace_path && runtime && runtime->shared && runtime->shared->netns_storage_socket[0] >= 0) { - r = open_shareable_ns_path(runtime->shared->netns_storage_socket, context->network_namespace_path, CLONE_NEWNET); - if (r < 0) { - *exit_status = EXIT_NETWORK; - return log_unit_error_errno(unit, r, "Failed to open network namespace path %s: %m", context->network_namespace_path); - } - } - - if (context->ipc_namespace_path && runtime && runtime->shared && runtime->shared->ipcns_storage_socket[0] >= 0) { - r = open_shareable_ns_path(runtime->shared->ipcns_storage_socket, context->ipc_namespace_path, CLONE_NEWIPC); - if (r < 0) { - *exit_status = EXIT_NAMESPACE; - return log_unit_error_errno(unit, r, "Failed to open IPC namespace path %s: %m", context->ipc_namespace_path); - } - } - - r = setup_input(context, params, socket_fd, named_iofds); - if (r < 0) { - *exit_status = EXIT_STDIN; - return log_unit_error_errno(unit, r, "Failed to set up standard input: %m"); - } - - r = setup_output(unit, context, params, STDOUT_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino); - if (r < 0) { - *exit_status = EXIT_STDOUT; - return log_unit_error_errno(unit, r, "Failed to set up standard output: %m"); - } - - r = setup_output(unit, context, params, STDERR_FILENO, socket_fd, named_iofds, basename(command->path), uid, gid, &journal_stream_dev, &journal_stream_ino); - if (r < 0) { - *exit_status = EXIT_STDERR; - return log_unit_error_errno(unit, r, "Failed to set up standard error output: %m"); - } - - if (context->oom_score_adjust_set) { - /* When we can't make this change due to EPERM, then let's silently skip over it. User - * namespaces prohibit write access to this file, and we shouldn't trip up over that. */ - r = set_oom_score_adjust(context->oom_score_adjust); - if (ERRNO_IS_NEG_PRIVILEGE(r)) - log_unit_debug_errno(unit, r, - "Failed to adjust OOM setting, assuming containerized execution, ignoring: %m"); - else if (r < 0) { - *exit_status = EXIT_OOM_ADJUST; - return log_unit_error_errno(unit, r, "Failed to adjust OOM setting: %m"); - } - } - - if (context->coredump_filter_set) { - r = set_coredump_filter(context->coredump_filter); - if (ERRNO_IS_NEG_PRIVILEGE(r)) - log_unit_debug_errno(unit, r, "Failed to adjust coredump_filter, ignoring: %m"); - else if (r < 0) { - *exit_status = EXIT_LIMITS; - return log_unit_error_errno(unit, r, "Failed to adjust coredump_filter: %m"); - } - } - - if (context->nice_set) { - r = setpriority_closest(context->nice); - if (r < 0) { - *exit_status = EXIT_NICE; - return log_unit_error_errno(unit, r, "Failed to set up process scheduling priority (nice level): %m"); - } - } - - if (context->cpu_sched_set) { - struct sched_param param = { - .sched_priority = context->cpu_sched_priority, - }; - - r = sched_setscheduler(0, - context->cpu_sched_policy | - (context->cpu_sched_reset_on_fork ? - SCHED_RESET_ON_FORK : 0), - ¶m); - if (r < 0) { - *exit_status = EXIT_SETSCHEDULER; - return log_unit_error_errno(unit, errno, "Failed to set up CPU scheduling: %m"); - } - } - - if (context->cpu_affinity_from_numa || context->cpu_set.set) { - _cleanup_(cpu_set_reset) CPUSet converted_cpu_set = {}; - const CPUSet *cpu_set; - - if (context->cpu_affinity_from_numa) { - r = exec_context_cpu_affinity_from_numa(context, &converted_cpu_set); - if (r < 0) { - *exit_status = EXIT_CPUAFFINITY; - return log_unit_error_errno(unit, r, "Failed to derive CPU affinity mask from NUMA mask: %m"); - } - - cpu_set = &converted_cpu_set; - } else - cpu_set = &context->cpu_set; - - if (sched_setaffinity(0, cpu_set->allocated, cpu_set->set) < 0) { - *exit_status = EXIT_CPUAFFINITY; - return log_unit_error_errno(unit, errno, "Failed to set up CPU affinity: %m"); - } - } - - if (mpol_is_valid(numa_policy_get_type(&context->numa_policy))) { - r = apply_numa_policy(&context->numa_policy); - if (ERRNO_IS_NEG_NOT_SUPPORTED(r)) - log_unit_debug_errno(unit, r, "NUMA support not available, ignoring."); - else if (r < 0) { - *exit_status = EXIT_NUMA_POLICY; - return log_unit_error_errno(unit, r, "Failed to set NUMA memory policy: %m"); - } - } - - if (context->ioprio_set) - if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) { - *exit_status = EXIT_IOPRIO; - return log_unit_error_errno(unit, errno, "Failed to set up IO scheduling priority: %m"); - } - - if (context->timer_slack_nsec != NSEC_INFINITY) - if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) { - *exit_status = EXIT_TIMERSLACK; - return log_unit_error_errno(unit, errno, "Failed to set up timer slack: %m"); - } - - if (context->personality != PERSONALITY_INVALID) { - r = safe_personality(context->personality); - if (r < 0) { - *exit_status = EXIT_PERSONALITY; - return log_unit_error_errno(unit, r, "Failed to set up execution domain (personality): %m"); - } - } - - if (context->utmp_id) { - const char *line = context->tty_path ? - (path_startswith(context->tty_path, "/dev/") ?: context->tty_path) : - NULL; - utmp_put_init_process(context->utmp_id, getpid_cached(), getsid(0), - line, - context->utmp_mode == EXEC_UTMP_INIT ? INIT_PROCESS : - context->utmp_mode == EXEC_UTMP_LOGIN ? LOGIN_PROCESS : - USER_PROCESS, - username); - } - - if (uid_is_valid(uid)) { - r = chown_terminal(STDIN_FILENO, uid); - if (r < 0) { - *exit_status = EXIT_STDIN; - return log_unit_error_errno(unit, r, "Failed to change ownership of terminal: %m"); - } - } - - if (params->cgroup_path) { - /* If delegation is enabled we'll pass ownership of the cgroup to the user of the new process. On cgroup v1 - * this is only about systemd's own hierarchy, i.e. not the controller hierarchies, simply because that's not - * safe. On cgroup v2 there's only one hierarchy anyway, and delegation is safe there, hence in that case only - * touch a single hierarchy too. */ - - if (params->flags & EXEC_CGROUP_DELEGATE) { - _cleanup_free_ char *p = NULL; - - r = cg_set_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, uid, gid); - if (r < 0) { - *exit_status = EXIT_CGROUP; - return log_unit_error_errno(unit, r, "Failed to adjust control group access: %m"); - } - - r = exec_parameters_get_cgroup_path(params, cgroup_context, &p); - if (r < 0) { - *exit_status = EXIT_CGROUP; - return log_unit_error_errno(unit, r, "Failed to acquire cgroup path: %m"); - } - if (r > 0) { - r = cg_set_access_recursive(SYSTEMD_CGROUP_CONTROLLER, p, uid, gid); - if (r < 0) { - *exit_status = EXIT_CGROUP; - return log_unit_error_errno(unit, r, "Failed to adjust control subgroup access: %m"); - } - } - } - - if (cgroup_context && cg_unified() > 0 && is_pressure_supported() > 0) { - if (cgroup_context_want_memory_pressure(cgroup_context)) { - r = cg_get_path("memory", params->cgroup_path, "memory.pressure", &memory_pressure_path); - if (r < 0) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - - r = chmod_and_chown(memory_pressure_path, 0644, uid, gid); - if (r < 0) { - log_unit_full_errno(unit, r == -ENOENT || ERRNO_IS_PRIVILEGE(r) ? LOG_DEBUG : LOG_WARNING, r, - "Failed to adjust ownership of '%s', ignoring: %m", memory_pressure_path); - memory_pressure_path = mfree(memory_pressure_path); - } - } else if (cgroup_context->memory_pressure_watch == CGROUP_PRESSURE_WATCH_OFF) { - memory_pressure_path = strdup("/dev/null"); /* /dev/null is explicit indicator for turning of memory pressure watch */ - if (!memory_pressure_path) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - } - } - } - - needs_mount_namespace = exec_needs_mount_namespace(context, params, runtime); - - for (ExecDirectoryType dt = 0; dt < _EXEC_DIRECTORY_TYPE_MAX; dt++) { - r = setup_exec_directory(unit, context, params, uid, gid, dt, needs_mount_namespace, exit_status); - if (r < 0) - return log_unit_error_errno(unit, r, "Failed to set up special execution directory in %s: %m", params->prefix[dt]); - } - - if (FLAGS_SET(params->flags, EXEC_WRITE_CREDENTIALS)) { - r = exec_setup_credentials(context, params, unit->id, uid, gid); - if (r < 0) { - *exit_status = EXIT_CREDENTIALS; - return log_unit_error_errno(unit, r, "Failed to set up credentials: %m"); - } - } - - r = build_environment( - unit, - context, - params, - cgroup_context, - n_fds, - fdnames, - home, - username, - shell, - journal_stream_dev, - journal_stream_ino, - memory_pressure_path, - &our_env); - if (r < 0) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - - r = build_pass_environment(context, &pass_env); - if (r < 0) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - - /* The $PATH variable is set to the default path in params->environment. However, this is overridden - * if user-specified fields have $PATH set. The intention is to also override $PATH if the unit does - * not specify PATH but the unit has ExecSearchPath. */ - if (!strv_isempty(context->exec_search_path)) { - _cleanup_free_ char *joined = NULL; - - joined = strv_join(context->exec_search_path, ":"); - if (!joined) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - - r = strv_env_assign(&joined_exec_search_path, "PATH", joined); - if (r < 0) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - } - - accum_env = strv_env_merge(params->environment, - our_env, - joined_exec_search_path, - pass_env, - context->environment, - files_env); - if (!accum_env) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - accum_env = strv_env_clean(accum_env); - - (void) umask(context->umask); - - r = setup_keyring(unit, context, params, uid, gid); - if (r < 0) { - *exit_status = EXIT_KEYRING; - return log_unit_error_errno(unit, r, "Failed to set up kernel keyring: %m"); - } - - /* We need sandboxing if the caller asked us to apply it and the command isn't explicitly excepted - * from it. */ - needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED); - - /* We need the ambient capability hack, if the caller asked us to apply it and the command is marked - * for it, and the kernel doesn't actually support ambient caps. */ - needs_ambient_hack = (params->flags & EXEC_APPLY_SANDBOXING) && (command->flags & EXEC_COMMAND_AMBIENT_MAGIC) && !ambient_capabilities_supported(); - - /* We need setresuid() if the caller asked us to apply sandboxing and the command isn't explicitly - * excepted from either whole sandboxing or just setresuid() itself, and the ambient hack is not - * desired. */ - if (needs_ambient_hack) - needs_setuid = false; - else - needs_setuid = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & (EXEC_COMMAND_FULLY_PRIVILEGED|EXEC_COMMAND_NO_SETUID)); - - uint64_t capability_ambient_set = context->capability_ambient_set; - - if (needs_sandboxing) { - /* MAC enablement checks need to be done before a new mount ns is created, as they rely on - * /sys being present. The actual MAC context application will happen later, as late as - * possible, to avoid impacting our own code paths. */ - -#if HAVE_SELINUX - use_selinux = mac_selinux_use(); -#endif -#if ENABLE_SMACK - use_smack = mac_smack_use(); -#endif -#if HAVE_APPARMOR - use_apparmor = mac_apparmor_use(); -#endif - } - - if (needs_sandboxing) { - int which_failed; - - /* Let's set the resource limits before we call into PAM, so that pam_limits wins over what - * is set here. (See below.) */ - - r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed); - if (r < 0) { - *exit_status = EXIT_LIMITS; - return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed)); - } - } - - if (needs_setuid && context->pam_name && username) { - /* Let's call into PAM after we set up our own idea of resource limits to that pam_limits - * wins here. (See above.) */ - - /* All fds passed in the fds array will be closed in the pam child process. */ - r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds); - if (r < 0) { - *exit_status = EXIT_PAM; - return log_unit_error_errno(unit, r, "Failed to set up PAM session: %m"); - } - - if (ambient_capabilities_supported()) { - uint64_t ambient_after_pam; - - /* PAM modules might have set some ambient caps. Query them here and merge them into - * the caps we want to set in the end, so that we don't end up unsetting them. */ - r = capability_get_ambient(&ambient_after_pam); - if (r < 0) { - *exit_status = EXIT_CAPABILITIES; - return log_unit_error_errno(unit, r, "Failed to query ambient caps: %m"); - } - - capability_ambient_set |= ambient_after_pam; - } - - ngids_after_pam = getgroups_alloc(&gids_after_pam); - if (ngids_after_pam < 0) { - *exit_status = EXIT_MEMORY; - return log_unit_error_errno(unit, ngids_after_pam, "Failed to obtain groups after setting up PAM: %m"); - } - } - - if (needs_sandboxing && exec_context_need_unprivileged_private_users(context, params)) { - /* If we're unprivileged, set up the user namespace first to enable use of the other namespaces. - * Users with CAP_SYS_ADMIN can set up user namespaces last because they will be able to - * set up the all of the other namespaces (i.e. network, mount, UTS) without a user namespace. */ - - r = setup_private_users(saved_uid, saved_gid, uid, gid); - /* If it was requested explicitly and we can't set it up, fail early. Otherwise, continue and let - * the actual requested operations fail (or silently continue). */ - if (r < 0 && context->private_users) { - *exit_status = EXIT_USER; - return log_unit_error_errno(unit, r, "Failed to set up user namespacing for unprivileged user: %m"); - } - if (r < 0) - log_unit_info_errno(unit, r, "Failed to set up user namespacing for unprivileged user, ignoring: %m"); - else - userns_set_up = true; - } - - if (exec_needs_network_namespace(context) && runtime && runtime->shared && runtime->shared->netns_storage_socket[0] >= 0) { - - /* Try to enable network namespacing if network namespacing is available and we have - * CAP_NET_ADMIN. We need CAP_NET_ADMIN to be able to configure the loopback device in the - * new network namespace. And if we don't have that, then we could only create a network - * namespace without the ability to set up "lo". Hence gracefully skip things then. */ - if (ns_type_supported(NAMESPACE_NET) && have_effective_cap(CAP_NET_ADMIN) > 0) { - r = setup_shareable_ns(runtime->shared->netns_storage_socket, CLONE_NEWNET); - if (ERRNO_IS_NEG_PRIVILEGE(r)) - log_unit_notice_errno(unit, r, - "PrivateNetwork=yes is configured, but network namespace setup not permitted, proceeding without: %m"); - else if (r < 0) { - *exit_status = EXIT_NETWORK; - return log_unit_error_errno(unit, r, "Failed to set up network namespacing: %m"); - } - } else if (context->network_namespace_path) { - *exit_status = EXIT_NETWORK; - return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP), - "NetworkNamespacePath= is not supported, refusing."); - } else - log_unit_notice(unit, "PrivateNetwork=yes is configured, but the kernel does not support or we lack privileges for network namespace, proceeding without."); - } - - if (exec_needs_ipc_namespace(context) && runtime && runtime->shared && runtime->shared->ipcns_storage_socket[0] >= 0) { - - if (ns_type_supported(NAMESPACE_IPC)) { - r = setup_shareable_ns(runtime->shared->ipcns_storage_socket, CLONE_NEWIPC); - if (r == -EPERM) - log_unit_warning_errno(unit, r, - "PrivateIPC=yes is configured, but IPC namespace setup failed, ignoring: %m"); - else if (r < 0) { - *exit_status = EXIT_NAMESPACE; - return log_unit_error_errno(unit, r, "Failed to set up IPC namespacing: %m"); - } - } else if (context->ipc_namespace_path) { - *exit_status = EXIT_NAMESPACE; - return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EOPNOTSUPP), - "IPCNamespacePath= is not supported, refusing."); - } else - log_unit_warning(unit, "PrivateIPC=yes is configured, but the kernel does not support IPC namespaces, ignoring."); - } - - if (needs_mount_namespace) { - _cleanup_free_ char *error_path = NULL; - - r = apply_mount_namespace(unit, command->flags, context, params, runtime, memory_pressure_path, &error_path); - if (r < 0) { - *exit_status = EXIT_NAMESPACE; - return log_unit_error_errno(unit, r, "Failed to set up mount namespacing%s%s: %m", - error_path ? ": " : "", strempty(error_path)); - } - } - - if (needs_sandboxing) { - r = apply_protect_hostname(unit, context, exit_status); - if (r < 0) - return r; - } - - if (context->memory_ksm >= 0) - if (prctl(PR_SET_MEMORY_MERGE, context->memory_ksm) < 0) { - if (ERRNO_IS_NOT_SUPPORTED(errno)) - log_unit_debug_errno(unit, errno, "KSM support not available, ignoring."); - else { - *exit_status = EXIT_KSM; - return log_unit_error_errno(unit, errno, "Failed to set KSM: %m"); - } - } - - /* Drop groups as early as possible. - * This needs to be done after PrivateDevices=y setup as device nodes should be owned by the host's root. - * For non-root in a userns, devices will be owned by the user/group before the group change, and nobody. */ - if (needs_setuid) { - _cleanup_free_ gid_t *gids_to_enforce = NULL; - int ngids_to_enforce = 0; - - ngids_to_enforce = merge_gid_lists(supplementary_gids, - ngids, - gids_after_pam, - ngids_after_pam, - &gids_to_enforce); - if (ngids_to_enforce < 0) { - *exit_status = EXIT_MEMORY; - return log_unit_error_errno(unit, - ngids_to_enforce, - "Failed to merge group lists. Group membership might be incorrect: %m"); - } - - r = enforce_groups(gid, gids_to_enforce, ngids_to_enforce); - if (r < 0) { - *exit_status = EXIT_GROUP; - return log_unit_error_errno(unit, r, "Changing group credentials failed: %m"); - } - } - - /* If the user namespace was not set up above, try to do it now. - * It's preferred to set up the user namespace later (after all other namespaces) so as not to be - * restricted by rules pertaining to combining user namespaces with other namespaces (e.g. in the - * case of mount namespaces being less privileged when the mount point list is copied from a - * different user namespace). */ - - if (needs_sandboxing && context->private_users && !userns_set_up) { - r = setup_private_users(saved_uid, saved_gid, uid, gid); - if (r < 0) { - *exit_status = EXIT_USER; - return log_unit_error_errno(unit, r, "Failed to set up user namespacing: %m"); - } - } - - /* Now that the mount namespace has been set up and privileges adjusted, let's look for the thing we - * shall execute. */ - - _cleanup_free_ char *executable = NULL; - _cleanup_close_ int executable_fd = -EBADF; - r = find_executable_full(command->path, /* root= */ NULL, context->exec_search_path, false, &executable, &executable_fd); - if (r < 0) { - if (r != -ENOMEM && (command->flags & EXEC_COMMAND_IGNORE_FAILURE)) { - log_unit_struct_errno(unit, LOG_INFO, r, - "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR, - LOG_UNIT_INVOCATION_ID(unit), - LOG_UNIT_MESSAGE(unit, "Executable %s missing, skipping: %m", - command->path), - "EXECUTABLE=%s", command->path); - *exit_status = EXIT_SUCCESS; - return 0; - } - - *exit_status = EXIT_EXEC; - return log_unit_struct_errno(unit, LOG_INFO, r, - "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR, - LOG_UNIT_INVOCATION_ID(unit), - LOG_UNIT_MESSAGE(unit, "Failed to locate executable %s: %m", - command->path), - "EXECUTABLE=%s", command->path); - } - - r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, executable_fd, &executable_fd); - if (r < 0) { - *exit_status = EXIT_FDS; - return log_unit_error_errno(unit, r, "Failed to shift fd and set FD_CLOEXEC: %m"); - } - -#if HAVE_SELINUX - if (needs_sandboxing && use_selinux && params->selinux_context_net) { - int fd = -EBADF; - - if (socket_fd >= 0) - fd = socket_fd; - else if (params->n_socket_fds == 1) - /* If stdin is not connected to a socket but we are triggered by exactly one socket unit then we - * use context from that fd to compute the label. */ - fd = params->fds[0]; - - if (fd >= 0) { - r = mac_selinux_get_child_mls_label(fd, executable, context->selinux_context, &mac_selinux_context_net); - if (r < 0) { - if (!context->selinux_context_ignore) { - *exit_status = EXIT_SELINUX_CONTEXT; - return log_unit_error_errno(unit, r, "Failed to determine SELinux context: %m"); - } - log_unit_debug_errno(unit, r, "Failed to determine SELinux context, ignoring: %m"); - } - } - } -#endif - - /* We repeat the fd closing here, to make sure that nothing is leaked from the PAM modules. Note that - * we are more aggressive this time, since we don't need socket_fd and the netns and ipcns fds any - * more. We do keep exec_fd however, if we have it, since we need to keep it open until the final - * execve(). */ - - r = close_all_fds(keep_fds, n_keep_fds); - if (r >= 0) - r = shift_fds(fds, n_fds); - if (r >= 0) - r = flags_fds(fds, n_socket_fds, n_fds, context->non_blocking); - if (r < 0) { - *exit_status = EXIT_FDS; - return log_unit_error_errno(unit, r, "Failed to adjust passed file descriptors: %m"); - } - - /* At this point, the fds we want to pass to the program are all ready and set up, with O_CLOEXEC turned off - * and at the right fd numbers. The are no other fds open, with one exception: the exec_fd if it is defined, - * and it has O_CLOEXEC set, after all we want it to be closed by the execve(), so that our parent knows we - * came this far. */ - - secure_bits = context->secure_bits; - - if (needs_sandboxing) { - uint64_t bset; - - /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. - * (Note this is placed after the general resource limit initialization, see above, in order - * to take precedence.) */ - if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) { - if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) { - *exit_status = EXIT_LIMITS; - return log_unit_error_errno(unit, errno, "Failed to adjust RLIMIT_RTPRIO resource limit: %m"); - } - } - -#if ENABLE_SMACK - /* LSM Smack needs the capability CAP_MAC_ADMIN to change the current execution security context of the - * process. This is the latest place before dropping capabilities. Other MAC context are set later. */ - if (use_smack) { - r = setup_smack(unit->manager, context, executable_fd); - if (r < 0 && !context->smack_process_label_ignore) { - *exit_status = EXIT_SMACK_PROCESS_LABEL; - return log_unit_error_errno(unit, r, "Failed to set SMACK process label: %m"); - } - } -#endif - - bset = context->capability_bounding_set; - /* If the ambient caps hack is enabled (which means the kernel can't do them, and the user asked for - * our magic fallback), then let's add some extra caps, so that the service can drop privs of its own, - * instead of us doing that */ - if (needs_ambient_hack) - bset |= (UINT64_C(1) << CAP_SETPCAP) | - (UINT64_C(1) << CAP_SETUID) | - (UINT64_C(1) << CAP_SETGID); - - if (!cap_test_all(bset)) { - r = capability_bounding_set_drop(bset, /* right_now= */ false); - if (r < 0) { - *exit_status = EXIT_CAPABILITIES; - return log_unit_error_errno(unit, r, "Failed to drop capabilities: %m"); - } - } - - /* Ambient capabilities are cleared during setresuid() (in enforce_user()) even with - * keep-caps set. - * - * To be able to raise the ambient capabilities after setresuid() they have to be added to - * the inherited set and keep caps has to be set (done in enforce_user()). After setresuid() - * the ambient capabilities can be raised as they are present in the permitted and - * inhertiable set. However it is possible that someone wants to set ambient capabilities - * without changing the user, so we also set the ambient capabilities here. - * - * The requested ambient capabilities are raised in the inheritable set if the second - * argument is true. */ - if (!needs_ambient_hack) { - r = capability_ambient_set_apply(capability_ambient_set, /* also_inherit= */ true); - if (r < 0) { - *exit_status = EXIT_CAPABILITIES; - return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (before UID change): %m"); - } - } - } - - /* chroot to root directory first, before we lose the ability to chroot */ - r = apply_root_directory(context, params, runtime, needs_mount_namespace, exit_status); - if (r < 0) - return log_unit_error_errno(unit, r, "Chrooting to the requested root directory failed: %m"); - - if (needs_setuid) { - if (uid_is_valid(uid)) { - r = enforce_user(context, uid, capability_ambient_set); - if (r < 0) { - *exit_status = EXIT_USER; - return log_unit_error_errno(unit, r, "Failed to change UID to " UID_FMT ": %m", uid); - } - - if (!needs_ambient_hack && capability_ambient_set != 0) { - - /* Raise the ambient capabilities after user change. */ - r = capability_ambient_set_apply(capability_ambient_set, /* also_inherit= */ false); - if (r < 0) { - *exit_status = EXIT_CAPABILITIES; - return log_unit_error_errno(unit, r, "Failed to apply ambient capabilities (after UID change): %m"); - } - } - } - } - - /* Apply working directory here, because the working directory might be on NFS and only the user running - * this service might have the correct privilege to change to the working directory */ - r = apply_working_directory(context, params, runtime, home, exit_status); - if (r < 0) - return log_unit_error_errno(unit, r, "Changing to the requested working directory failed: %m"); - - if (needs_sandboxing) { - /* Apply other MAC contexts late, but before seccomp syscall filtering, as those should really be last to - * influence our own codepaths as little as possible. Moreover, applying MAC contexts usually requires - * syscalls that are subject to seccomp filtering, hence should probably be applied before the syscalls - * are restricted. */ - -#if HAVE_SELINUX - if (use_selinux) { - char *exec_context = mac_selinux_context_net ?: context->selinux_context; - - if (exec_context) { - r = setexeccon(exec_context); - if (r < 0) { - if (!context->selinux_context_ignore) { - *exit_status = EXIT_SELINUX_CONTEXT; - return log_unit_error_errno(unit, r, "Failed to change SELinux context to %s: %m", exec_context); - } - log_unit_debug_errno(unit, r, "Failed to change SELinux context to %s, ignoring: %m", exec_context); - } - } - } -#endif - -#if HAVE_APPARMOR - if (use_apparmor && context->apparmor_profile) { - r = aa_change_onexec(context->apparmor_profile); - if (r < 0 && !context->apparmor_profile_ignore) { - *exit_status = EXIT_APPARMOR_PROFILE; - return log_unit_error_errno(unit, errno, "Failed to prepare AppArmor profile change to %s: %m", context->apparmor_profile); - } - } -#endif - - /* PR_GET_SECUREBITS is not privileged, while PR_SET_SECUREBITS is. So to suppress potential - * EPERMs we'll try not to call PR_SET_SECUREBITS unless necessary. Setting securebits - * requires CAP_SETPCAP. */ - if (prctl(PR_GET_SECUREBITS) != secure_bits) { - /* CAP_SETPCAP is required to set securebits. This capability is raised into the - * effective set here. - * - * The effective set is overwritten during execve() with the following values: - * - * - ambient set (for non-root processes) - * - * - (inheritable | bounding) set for root processes) - * - * Hence there is no security impact to raise it in the effective set before execve - */ - r = capability_gain_cap_setpcap(/* return_caps= */ NULL); - if (r < 0) { - *exit_status = EXIT_CAPABILITIES; - return log_unit_error_errno(unit, r, "Failed to gain CAP_SETPCAP for setting secure bits"); - } - if (prctl(PR_SET_SECUREBITS, secure_bits) < 0) { - *exit_status = EXIT_SECUREBITS; - return log_unit_error_errno(unit, errno, "Failed to set process secure bits: %m"); - } - } - - if (context_has_no_new_privileges(context)) - if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) { - *exit_status = EXIT_NO_NEW_PRIVILEGES; - return log_unit_error_errno(unit, errno, "Failed to disable new privileges: %m"); - } - -#if HAVE_SECCOMP - r = apply_address_families(unit, context); - if (r < 0) { - *exit_status = EXIT_ADDRESS_FAMILIES; - return log_unit_error_errno(unit, r, "Failed to restrict address families: %m"); - } - - r = apply_memory_deny_write_execute(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to disable writing to executable memory: %m"); - } - - r = apply_restrict_realtime(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to apply realtime restrictions: %m"); - } - - r = apply_restrict_suid_sgid(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to apply SUID/SGID restrictions: %m"); - } - - r = apply_restrict_namespaces(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to apply namespace restrictions: %m"); - } - - r = apply_protect_sysctl(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to apply sysctl restrictions: %m"); - } - - r = apply_protect_kernel_modules(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to apply module loading restrictions: %m"); - } - - r = apply_protect_kernel_logs(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to apply kernel log restrictions: %m"); - } - - r = apply_protect_clock(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to apply clock restrictions: %m"); - } - - r = apply_private_devices(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to set up private devices: %m"); - } - - r = apply_syscall_archs(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to apply syscall architecture restrictions: %m"); - } - - r = apply_lock_personality(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to lock personalities: %m"); - } - - r = apply_syscall_log(unit, context); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to apply system call log filters: %m"); - } - - /* This really should remain the last step before the execve(), to make sure our own code is unaffected - * by the filter as little as possible. */ - r = apply_syscall_filter(unit, context, needs_ambient_hack); - if (r < 0) { - *exit_status = EXIT_SECCOMP; - return log_unit_error_errno(unit, r, "Failed to apply system call filters: %m"); - } -#endif - -#if HAVE_LIBBPF - r = apply_restrict_filesystems(unit, context); - if (r < 0) { - *exit_status = EXIT_BPF; - return log_unit_error_errno(unit, r, "Failed to restrict filesystems: %m"); - } -#endif - - } - - if (!strv_isempty(context->unset_environment)) { - char **ee = NULL; - - ee = strv_env_delete(accum_env, 1, context->unset_environment); - if (!ee) { - *exit_status = EXIT_MEMORY; - return log_oom(); - } - - strv_free_and_replace(accum_env, ee); - } - - if (!FLAGS_SET(command->flags, EXEC_COMMAND_NO_ENV_EXPAND)) { - _cleanup_strv_free_ char **unset_variables = NULL, **bad_variables = NULL; - - r = replace_env_argv(command->argv, accum_env, &replaced_argv, &unset_variables, &bad_variables); - if (r < 0) { - *exit_status = EXIT_MEMORY; - return log_unit_error_errno(unit, r, "Failed to replace environment variables: %m"); - } - final_argv = replaced_argv; - - if (!strv_isempty(unset_variables)) { - _cleanup_free_ char *ju = strv_join(unset_variables, ", "); - log_unit_warning(unit, "Referenced but unset environment variable evaluates to an empty string: %s", strna(ju)); - } - - if (!strv_isempty(bad_variables)) { - _cleanup_free_ char *jb = strv_join(bad_variables, ", "); - log_unit_warning(unit, "Invalid environment variable name evaluates to an empty string: %s", strna(jb));; - } - } else - final_argv = command->argv; - - log_command_line(unit, "Executing", executable, final_argv); - - if (exec_fd >= 0) { - uint8_t hot = 1; - - /* We have finished with all our initializations. Let's now let the manager know that. From this point - * on, if the manager sees POLLHUP on the exec_fd, then execve() was successful. */ - - if (write(exec_fd, &hot, sizeof(hot)) < 0) { - *exit_status = EXIT_EXEC; - return log_unit_error_errno(unit, errno, "Failed to enable exec_fd: %m"); - } - } - - r = fexecve_or_execve(executable_fd, executable, final_argv, accum_env); - - if (exec_fd >= 0) { - uint8_t hot = 0; - - /* The execve() failed. This means the exec_fd is still open. Which means we need to tell the manager - * that POLLHUP on it no longer means execve() succeeded. */ - - if (write(exec_fd, &hot, sizeof(hot)) < 0) { - *exit_status = EXIT_EXEC; - return log_unit_error_errno(unit, errno, "Failed to disable exec_fd: %m"); - } - } - - *exit_status = EXIT_EXEC; - return log_unit_error_errno(unit, r, "Failed to execute %s: %m", executable); -} - static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l); -static int exec_context_named_iofds(const ExecContext *c, const ExecParameters *p, int named_iofds[static 3]); int exec_spawn(Unit *unit, ExecCommand *command, const ExecContext *context, - const ExecParameters *params, + ExecParameters *params, ExecRuntime *runtime, const CGroupContext *cgroup_context, pid_t *ret) { - int socket_fd, r, named_iofds[3] = { -1, -1, -1 }, *fds = NULL; - _cleanup_free_ char *subcgroup_path = NULL; - _cleanup_strv_free_ char **files_env = NULL; - size_t n_storage_fds = 0, n_socket_fds = 0; + char serialization_fd_number[DECIMAL_STR_MAX(int) + 1]; + _cleanup_free_ char *subcgroup_path = NULL, *log_level = NULL, *executor_path = NULL; + _cleanup_fdset_free_ FDSet *fdset = NULL; + _cleanup_fclose_ FILE *f = NULL; pid_t pid; + int r; assert(unit); + assert(unit->manager); + assert(unit->manager->executor_fd >= 0); assert(command); assert(context); assert(ret); assert(params); assert(params->fds || (params->n_socket_fds + params->n_storage_fds <= 0)); + assert(!params->files_env); /* We fill this field, ensure it comes NULL-initialized to us */ LOG_CONTEXT_PUSH_UNIT(unit); - if (context->std_input == EXEC_INPUT_SOCKET || - context->std_output == EXEC_OUTPUT_SOCKET || - context->std_error == EXEC_OUTPUT_SOCKET) { - - if (params->n_socket_fds > 1) - return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EINVAL), "Got more than one socket."); - - if (params->n_socket_fds == 0) - return log_unit_error_errno(unit, SYNTHETIC_ERRNO(EINVAL), "Got no socket."); - - socket_fd = params->fds[0]; - } else { - socket_fd = -EBADF; - fds = params->fds; - n_socket_fds = params->n_socket_fds; - n_storage_fds = params->n_storage_fds; - } - - r = exec_context_named_iofds(context, params, named_iofds); - if (r < 0) - return log_unit_error_errno(unit, r, "Failed to load a named file descriptor: %m"); - - r = exec_context_load_environment(unit, context, &files_env); + r = exec_context_load_environment(unit, context, ¶ms->files_env); if (r < 0) return log_unit_error_errno(unit, r, "Failed to load environment files: %m"); @@ -5196,7 +373,7 @@ int exec_spawn(Unit *unit, log_command_line(unit, "About to execute", command->path, command->argv); if (params->cgroup_path) { - r = exec_parameters_get_cgroup_path(params, cgroup_context, &subcgroup_path); + r = exec_params_get_cgroup_path(params, cgroup_context, &subcgroup_path); if (r < 0) return log_unit_error_errno(unit, r, "Failed to acquire subcgroup path: %m"); if (r > 0) { @@ -5209,43 +386,56 @@ int exec_spawn(Unit *unit, } } - pid = fork(); - if (pid < 0) - return log_unit_error_errno(unit, errno, "Failed to fork: %m"); + /* In order to avoid copy-on-write traps and OOM-kills when pid1's memory.current is above the + * child's memory.max, serialize all the state needed to start the unit, and pass it to the + * systemd-executor binary. clone() with CLONE_VM + CLONE_VFORK will pause the parent until the exec + * and ensure all memory is shared. The child immediately execs the new binary so the delay should + * be minimal. Once glibc provides a clone3 wrapper we can switch to that, and clone directly in the + * target cgroup. */ - if (pid == 0) { - int exit_status; + r = open_serialization_file("sd-executor-state", &f); + if (r < 0) + return log_unit_error_errno(unit, r, "Failed to open serialization stream: %m"); - r = exec_child(unit, - command, - context, - params, - runtime, - cgroup_context, - socket_fd, - named_iofds, - fds, - n_socket_fds, - n_storage_fds, - files_env, - unit->manager->user_lookup_fds[1], - &exit_status); + fdset = fdset_new(); + if (!fdset) + return log_oom(); - if (r < 0) { - const char *status = ASSERT_PTR( - exit_status_to_string(exit_status, EXIT_STATUS_LIBC | EXIT_STATUS_SYSTEMD)); + r = exec_serialize_invocation(f, fdset, context, command, params, runtime, cgroup_context); + if (r < 0) + return log_unit_error_errno(unit, r, "Failed to serialize parameters: %m"); - log_unit_struct_errno(unit, LOG_ERR, r, - "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR, - LOG_UNIT_INVOCATION_ID(unit), - LOG_UNIT_MESSAGE(unit, "Failed at step %s spawning %s: %m", - status, command->path), - "EXECUTABLE=%s", command->path); - } else - assert(exit_status == EXIT_SUCCESS); + if (fseeko(f, 0, SEEK_SET) == (off_t) -1) + return log_unit_error_errno(unit, errno, "Failed to reseek on serialization stream: %m"); - _exit(exit_status); - } + r = fd_cloexec(fileno(f), false); + if (r < 0) + return log_unit_error_errno(unit, r, "Failed to set O_CLOEXEC on serialization fd: %m"); + + r = fdset_cloexec(fdset, false); + if (r < 0) + return log_unit_error_errno(unit, r, "Failed to set O_CLOEXEC on serialized fds: %m"); + + r = log_level_to_string_alloc(log_get_max_level(), &log_level); + if (r < 0) + return log_unit_error_errno(unit, r, "Failed to convert log level to string: %m"); + + r = fd_get_path(unit->manager->executor_fd, &executor_path); + if (r < 0) + return log_unit_error_errno(unit, r, "Failed to get executor path from fd: %m"); + + xsprintf(serialization_fd_number, "%i", fileno(f)); + + /* The executor binary is pinned, to avoid compatibility problems during upgrades. */ + r = posix_spawn_wrapper(FORMAT_PROC_FD_PATH(unit->manager->executor_fd), + STRV_MAKE(executor_path, + "--deserialize", serialization_fd_number, + "--log-level", log_level, + "--log-target", log_target_to_string(manager_get_executor_log_target(unit->manager))), + environ, + &pid); + if (r < 0) + return log_unit_error_errno(unit, r, "Failed to spawn executor: %m"); log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid); @@ -5264,6 +454,9 @@ int exec_spawn(Unit *unit, void exec_context_init(ExecContext *c) { assert(c); + /* When initializing a bool member to 'true', make sure to serialize in execute-serialize.c using + * serialize_bool() instead of serialize_bool_elide(). */ + *c = (ExecContext) { .umask = 0022, .ioprio = IOPRIO_DEFAULT_CLASS_AND_PRIO, @@ -5444,7 +637,7 @@ int exec_context_destroy_mount_ns_dir(Unit *u) { return 0; } -static void exec_command_done(ExecCommand *c) { +void exec_command_done(ExecCommand *c) { assert(c); c->path = mfree(c->path); @@ -5522,57 +715,6 @@ const char* exec_context_fdname(const ExecContext *c, int fd_index) { } } -static int exec_context_named_iofds( - const ExecContext *c, - const ExecParameters *p, - int named_iofds[static 3]) { - - size_t targets; - const char* stdio_fdname[3]; - size_t n_fds; - - assert(c); - assert(p); - assert(named_iofds); - - targets = (c->std_input == EXEC_INPUT_NAMED_FD) + - (c->std_output == EXEC_OUTPUT_NAMED_FD) + - (c->std_error == EXEC_OUTPUT_NAMED_FD); - - for (size_t i = 0; i < 3; i++) - stdio_fdname[i] = exec_context_fdname(c, i); - - n_fds = p->n_storage_fds + p->n_socket_fds; - - for (size_t i = 0; i < n_fds && targets > 0; i++) - if (named_iofds[STDIN_FILENO] < 0 && - c->std_input == EXEC_INPUT_NAMED_FD && - stdio_fdname[STDIN_FILENO] && - streq(p->fd_names[i], stdio_fdname[STDIN_FILENO])) { - - named_iofds[STDIN_FILENO] = p->fds[i]; - targets--; - - } else if (named_iofds[STDOUT_FILENO] < 0 && - c->std_output == EXEC_OUTPUT_NAMED_FD && - stdio_fdname[STDOUT_FILENO] && - streq(p->fd_names[i], stdio_fdname[STDOUT_FILENO])) { - - named_iofds[STDOUT_FILENO] = p->fds[i]; - targets--; - - } else if (named_iofds[STDERR_FILENO] < 0 && - c->std_error == EXEC_OUTPUT_NAMED_FD && - stdio_fdname[STDERR_FILENO] && - streq(p->fd_names[i], stdio_fdname[STDERR_FILENO])) { - - named_iofds[STDERR_FILENO] = p->fds[i]; - targets--; - } - - return targets == 0 ? 0 : -ENOENT; -} - static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***ret) { _cleanup_strv_free_ char **v = NULL; int r; @@ -5699,6 +841,48 @@ static void strv_dump(FILE* f, const char *prefix, const char *name, char **strv } } +void exec_params_dump(const ExecParameters *p, FILE* f, const char *prefix) { + assert(p); + assert(f); + + prefix = strempty(prefix); + + fprintf(f, + "%sRuntimeScope: %s\n" + "%sExecFlags: %u\n" + "%sSELinuxContextNetwork: %s\n" + "%sCgroupSupportedMask: %u\n" + "%sCgroupPath: %s\n" + "%sCrededentialsDirectory: %s\n" + "%sEncryptedCredentialsDirectory: %s\n" + "%sConfirmSpawn: %s\n" + "%sShallConfirmSpawn: %s\n" + "%sWatchdogUSec: " USEC_FMT "\n" + "%sNotifySocket: %s\n" + "%sFallbackSmackProcessLabel: %s\n", + prefix, runtime_scope_to_string(p->runtime_scope), + prefix, p->flags, + prefix, yes_no(p->selinux_context_net), + prefix, p->cgroup_supported, + prefix, p->cgroup_path, + prefix, strempty(p->received_credentials_directory), + prefix, strempty(p->received_encrypted_credentials_directory), + prefix, strempty(p->confirm_spawn), + prefix, yes_no(p->shall_confirm_spawn), + prefix, p->watchdog_usec, + prefix, strempty(p->notify_socket), + prefix, strempty(p->fallback_smack_process_label)); + + strv_dump(f, prefix, "FdNames", p->fd_names); + strv_dump(f, prefix, "Environment", p->environment); + strv_dump(f, prefix, "Prefix", p->prefix); + + LIST_FOREACH(open_files, file, p->open_files) + fprintf(f, "%sOpenFile: %s %s", prefix, file->path, open_file_flags_to_string(file->flags)); + + strv_dump(f, prefix, "FilesEnv", p->files_env); +} + void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) { int r; @@ -6518,9 +1702,9 @@ static char *destroy_tree(char *path) { return mfree(path); } -static ExecSharedRuntime* exec_shared_runtime_free(ExecSharedRuntime *rt) { +void exec_shared_runtime_done(ExecSharedRuntime *rt) { if (!rt) - return NULL; + return; if (rt->manager) (void) hashmap_remove(rt->manager->exec_shared_runtime_by_id, rt->id); @@ -6530,6 +1714,11 @@ static ExecSharedRuntime* exec_shared_runtime_free(ExecSharedRuntime *rt) { rt->var_tmp_dir = mfree(rt->var_tmp_dir); safe_close_pair(rt->netns_storage_socket); safe_close_pair(rt->ipcns_storage_socket); +} + +static ExecSharedRuntime* exec_shared_runtime_free(ExecSharedRuntime *rt) { + exec_shared_runtime_done(rt); + return mfree(rt); } @@ -6769,7 +1958,7 @@ int exec_shared_runtime_serialize(const Manager *m, FILE *f, FDSet *fds) { int exec_shared_runtime_deserialize_compat(Unit *u, const char *key, const char *value, FDSet *fds) { _cleanup_(exec_shared_runtime_freep) ExecSharedRuntime *rt_create = NULL; - ExecSharedRuntime *rt; + ExecSharedRuntime *rt = NULL; int r; /* This is for the migration from old (v237 or earlier) deserialization text. @@ -6788,10 +1977,12 @@ int exec_shared_runtime_deserialize_compat(Unit *u, const char *key, const char return 0; } - if (hashmap_ensure_allocated(&u->manager->exec_shared_runtime_by_id, &string_hash_ops) < 0) - return log_oom(); + if (u->manager) { + if (hashmap_ensure_allocated(&u->manager->exec_shared_runtime_by_id, &string_hash_ops) < 0) + return log_oom(); - rt = hashmap_get(u->manager->exec_shared_runtime_by_id, u->id); + rt = hashmap_get(u->manager->exec_shared_runtime_by_id, u->id); + } if (!rt) { if (exec_shared_runtime_allocate(&rt_create, u->id) < 0) return log_oom(); @@ -6833,7 +2024,7 @@ int exec_shared_runtime_deserialize_compat(Unit *u, const char *key, const char return 0; /* If the object is newly created, then put it to the hashmap which manages ExecSharedRuntime objects. */ - if (rt_create) { + if (rt_create && u->manager) { r = hashmap_put(u->manager->exec_shared_runtime_by_id, rt_create->id, rt_create); if (r < 0) { log_unit_debug_errno(u, r, "Failed to put runtime parameter to manager's storage: %m"); @@ -7053,14 +2244,59 @@ ExecRuntime* exec_runtime_destroy(ExecRuntime *rt) { return exec_runtime_free(rt); } +void exec_runtime_clear(ExecRuntime *rt) { + if (!rt) + return; + + safe_close_pair(rt->ephemeral_storage_socket); + rt->ephemeral_copy = mfree(rt->ephemeral_copy); +} + void exec_params_clear(ExecParameters *p) { if (!p) return; p->environment = strv_free(p->environment); p->fd_names = strv_free(p->fd_names); + p->files_env = strv_free(p->files_env); p->fds = mfree(p->fds); p->exec_fd = safe_close(p->exec_fd); + p->user_lookup_fd = -EBADF; + p->bpf_outer_map_fd = -EBADF; + p->unit_id = mfree(p->unit_id); + p->invocation_id = SD_ID128_NULL; + p->invocation_id_string[0] = '\0'; + p->confirm_spawn = mfree(p->confirm_spawn); +} + +void exec_params_serialized_done(ExecParameters *p) { + if (!p) + return; + + for (size_t i = 0; p->fds && i < p->n_socket_fds + p->n_storage_fds; i++) + p->fds[i] = safe_close(p->fds[i]); + + p->cgroup_path = mfree(p->cgroup_path); + + p->prefix = strv_free(p->prefix); + p->received_credentials_directory = mfree(p->received_credentials_directory); + p->received_encrypted_credentials_directory = mfree(p->received_encrypted_credentials_directory); + + for (size_t i = 0; p->idle_pipe && i < 4; i++) + p->idle_pipe[i] = safe_close(p->idle_pipe[i]); + p->idle_pipe = mfree(p->idle_pipe); + + p->stdin_fd = safe_close(p->stdin_fd); + p->stdout_fd = safe_close(p->stdout_fd); + p->stderr_fd = safe_close(p->stderr_fd); + + p->notify_socket = mfree(p->notify_socket); + + open_file_free_many(&p->open_files); + + p->fallback_smack_process_label = mfree(p->fallback_smack_process_label); + + exec_params_clear(p); } void exec_directory_done(ExecDirectory *d) { @@ -7253,18 +2489,6 @@ static const char* const exec_resource_type_table[_EXEC_DIRECTORY_TYPE_MAX] = { DEFINE_STRING_TABLE_LOOKUP(exec_resource_type, ExecDirectoryType); -/* And this table also maps ExecDirectoryType, to the environment variable we pass the selected directory to - * the service payload in. */ -static const char* const exec_directory_env_name_table[_EXEC_DIRECTORY_TYPE_MAX] = { - [EXEC_DIRECTORY_RUNTIME] = "RUNTIME_DIRECTORY", - [EXEC_DIRECTORY_STATE] = "STATE_DIRECTORY", - [EXEC_DIRECTORY_CACHE] = "CACHE_DIRECTORY", - [EXEC_DIRECTORY_LOGS] = "LOGS_DIRECTORY", - [EXEC_DIRECTORY_CONFIGURATION] = "CONFIGURATION_DIRECTORY", -}; - -DEFINE_PRIVATE_STRING_TABLE_LOOKUP_TO_STRING(exec_directory_env_name, ExecDirectoryType); - static const char* const exec_keyring_mode_table[_EXEC_KEYRING_MODE_MAX] = { [EXEC_KEYRING_INHERIT] = "inherit", [EXEC_KEYRING_PRIVATE] = "private", diff --git a/src/core/execute.h b/src/core/execute.h index a68ea37d83..81e9684870 100644 --- a/src/core/execute.h +++ b/src/core/execute.h @@ -100,7 +100,7 @@ struct ExecStatus { struct ExecCommand { char *path; char **argv; - ExecStatus exec_status; + ExecStatus exec_status; /* Note that this is not serialized to sd-executor */ ExecCommandFlags flags; LIST_FIELDS(ExecCommand, command); /* useful for chaining commands */ }; @@ -420,13 +420,15 @@ struct ExecParameters { bool selinux_context_net:1; CGroupMask cgroup_supported; - const char *cgroup_path; + char *cgroup_path; + uint64_t cgroup_id; char **prefix; - const char *received_credentials_directory; - const char *received_encrypted_credentials_directory; + char *received_credentials_directory; + char *received_encrypted_credentials_directory; - const char *confirm_spawn; + char *confirm_spawn; + bool shall_confirm_spawn; usec_t watchdog_usec; @@ -439,22 +441,45 @@ struct ExecParameters { /* An fd that is closed by the execve(), and thus will result in EOF when the execve() is done */ int exec_fd; - const char *notify_socket; + char *notify_socket; LIST_HEAD(OpenFile, open_files); + + char *fallback_smack_process_label; + + char **files_env; + int user_lookup_fd; + int bpf_outer_map_fd; + + /* Used for logging in the executor functions */ + char *unit_id; + sd_id128_t invocation_id; + char invocation_id_string[SD_ID128_STRING_MAX]; }; +#define EXEC_PARAMETERS_INIT(_flags) \ + (ExecParameters) { \ + .flags = (_flags), \ + .stdin_fd = -EBADF, \ + .stdout_fd = -EBADF, \ + .stderr_fd = -EBADF, \ + .exec_fd = -EBADF, \ + .bpf_outer_map_fd = -EBADF, \ + .user_lookup_fd = -EBADF, \ + }; + #include "unit.h" #include "dynamic-user.h" int exec_spawn(Unit *unit, ExecCommand *command, const ExecContext *context, - const ExecParameters *exec_params, + ExecParameters *exec_params, ExecRuntime *runtime, const CGroupContext *cgroup_context, pid_t *ret); +void exec_command_done(ExecCommand *c); void exec_command_done_array(ExecCommand *c, size_t n); ExecCommand* exec_command_free_list(ExecCommand *c); void exec_command_free_array(ExecCommand **c, size_t n); @@ -487,6 +512,10 @@ void exec_context_revert_tty(ExecContext *c); int exec_context_get_clean_directories(ExecContext *c, char **prefix, ExecCleanMask mask, char ***ret); int exec_context_get_clean_mask(ExecContext *c, ExecCleanMask *ret); +const char *exec_context_tty_path(const ExecContext *context); +int exec_context_tty_size(const ExecContext *context, unsigned *ret_rows, unsigned *ret_cols); +void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p); + void exec_status_start(ExecStatus *s, pid_t pid); void exec_status_exit(ExecStatus *s, const ExecContext *context, pid_t pid, int code, int status); void exec_status_dump(const ExecStatus *s, FILE *f, const char *prefix); @@ -500,20 +529,26 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(ExecSharedRuntime*, exec_shared_runtime_unref); int exec_shared_runtime_serialize(const Manager *m, FILE *f, FDSet *fds); int exec_shared_runtime_deserialize_compat(Unit *u, const char *key, const char *value, FDSet *fds); int exec_shared_runtime_deserialize_one(Manager *m, const char *value, FDSet *fds); +void exec_shared_runtime_done(ExecSharedRuntime *rt); void exec_shared_runtime_vacuum(Manager *m); int exec_runtime_make(const Unit *unit, const ExecContext *context, ExecSharedRuntime *shared, DynamicCreds *creds, ExecRuntime **ret); ExecRuntime* exec_runtime_free(ExecRuntime *rt); DEFINE_TRIVIAL_CLEANUP_FUNC(ExecRuntime*, exec_runtime_free); ExecRuntime* exec_runtime_destroy(ExecRuntime *rt); +void exec_runtime_clear(ExecRuntime *rt); +int exec_params_get_cgroup_path(const ExecParameters *params, const CGroupContext *c, char **ret); void exec_params_clear(ExecParameters *p); +void exec_params_dump(const ExecParameters *p, FILE* f, const char *prefix); +void exec_params_serialized_done(ExecParameters *p); bool exec_context_get_cpu_affinity_from_numa(const ExecContext *c); void exec_directory_done(ExecDirectory *d); int exec_directory_add(ExecDirectory *d, const char *path, const char *symlink); void exec_directory_sort(ExecDirectory *d); +bool exec_directory_is_private(const ExecContext *context, ExecDirectoryType type); ExecCleanMask exec_clean_mask_from_string(const char *s); @@ -543,3 +578,104 @@ ExecDirectoryType exec_resource_type_from_string(const char *s) _pure_; bool exec_needs_mount_namespace(const ExecContext *context, const ExecParameters *params, const ExecRuntime *runtime); bool exec_needs_network_namespace(const ExecContext *context); +bool exec_needs_ipc_namespace(const ExecContext *context); + +/* These logging macros do the same logging as those in unit.h, but using ExecContext and ExecParameters + * instead of the unit object, so that it can be used in the sd-executor context (where the unit object is + * not available). */ + +#define LOG_EXEC_ID_FIELD(ep) \ + ((ep)->runtime_scope == RUNTIME_SCOPE_USER ? "USER_UNIT=" : "UNIT=") +#define LOG_EXEC_ID_FIELD_FORMAT(ep) \ + ((ep)->runtime_scope == RUNTIME_SCOPE_USER ? "USER_UNIT=%s" : "UNIT=%s") +#define LOG_EXEC_INVOCATION_ID_FIELD(ep) \ + ((ep)->runtime_scope == RUNTIME_SCOPE_USER ? "USER_INVOCATION_ID=" : "INVOCATION_ID=") +#define LOG_EXEC_INVOCATION_ID_FIELD_FORMAT(ep) \ + ((ep)->runtime_scope == RUNTIME_SCOPE_USER ? "USER_INVOCATION_ID=%s" : "INVOCATION_ID=%s") + +#define log_exec_full_errno_zerook(ec, ep, level, error, ...) \ + ({ \ + const ExecContext *_c = (ec); \ + const ExecParameters *_p = (ep); \ + const int _l = (level); \ + bool _do_log = !(log_get_max_level() < LOG_PRI(_l) || \ + !(_c->log_level_max < 0 || \ + _c->log_level_max >= LOG_PRI(_l))); \ + LOG_CONTEXT_PUSH_IOV(_c->log_extra_fields, \ + _c->n_log_extra_fields); \ + !_do_log ? -ERRNO_VALUE(error) : \ + log_object_internal(_l, error, PROJECT_FILE, \ + __LINE__, __func__, \ + LOG_EXEC_ID_FIELD(_p), \ + _p->unit_id, \ + LOG_EXEC_INVOCATION_ID_FIELD(_p), \ + _p->invocation_id_string, ##__VA_ARGS__); \ + }) + +#define log_exec_full_errno(ec, ep, level, error, ...) \ + ({ \ + int _error = (error); \ + ASSERT_NON_ZERO(_error); \ + log_exec_full_errno_zerook(ec, ep, level, _error, ##__VA_ARGS__); \ + }) + +#define log_exec_full(ec, ep, level, ...) (void) log_exec_full_errno_zerook(ec, ep, level, 0, __VA_ARGS__) + +#define log_exec_debug(ec, ep, ...) log_exec_full(ec, ep, LOG_DEBUG, __VA_ARGS__) +#define log_exec_info(ec, ep, ...) log_exec_full(ec, ep, LOG_INFO, __VA_ARGS__) +#define log_exec_notice(ec, ep, ...) log_exec_full(ec, ep, LOG_NOTICE, __VA_ARGS__) +#define log_exec_warning(ec, ep, ...) log_exec_full(ec, ep, LOG_WARNING, __VA_ARGS__) +#define log_exec_error(ec, ep, ...) log_exec_full(ec, ep, LOG_ERR, __VA_ARGS__) + +#define log_exec_debug_errno(ec, ep, error, ...) log_exec_full_errno(ec, ep, LOG_DEBUG, error, __VA_ARGS__) +#define log_exec_info_errno(ec, ep, error, ...) log_exec_full_errno(ec, ep, LOG_INFO, error, __VA_ARGS__) +#define log_exec_notice_errno(ec, ep, error, ...) log_exec_full_errno(ec, ep, LOG_NOTICE, error, __VA_ARGS__) +#define log_exec_warning_errno(ec, ep, error, ...) log_exec_full_errno(ec, ep, LOG_WARNING, error, __VA_ARGS__) +#define log_exec_error_errno(ec, ep, error, ...) log_exec_full_errno(ec, ep, LOG_ERR, error, __VA_ARGS__) + +#define log_exec_struct_errno(ec, ep, level, error, ...) \ + ({ \ + const ExecContext *_c = (ec); \ + const ExecParameters *_p = (ep); \ + const int _l = (level); \ + bool _do_log = !(_c->log_level_max < 0 || \ + _c->log_level_max >= LOG_PRI(_l)); \ + LOG_CONTEXT_PUSH_IOV(_c->log_extra_fields, \ + _c->n_log_extra_fields); \ + _do_log ? \ + log_struct_errno(_l, error, __VA_ARGS__, LOG_EXEC_ID_FIELD_FORMAT(_p), _p->unit_id) : \ + -ERRNO_VALUE(error); \ + }) + +#define log_exec_struct(ec, ep, level, ...) log_exec_struct_errno(ec, ep, level, 0, __VA_ARGS__) + +#define log_exec_struct_iovec_errno(ec, ep, level, error, iovec, n_iovec) \ + ({ \ + const ExecContext *_c = (ec); \ + const ExecParameters *_p = (ep); \ + const int _l = (level); \ + bool _do_log = !(_c->log_level_max < 0 || \ + _c->log_level_max >= LOG_PRI(_l)); \ + LOG_CONTEXT_PUSH_IOV(_c->log_extra_fields, \ + _c->n_log_extra_fields); \ + _do_log ? \ + log_struct_iovec_errno(_l, error, iovec, n_iovec) : \ + -ERRNO_VALUE(error); \ + }) + +#define log_exec_struct_iovec(ec, ep, level, iovec, n_iovec) log_exec_struct_iovec_errno(ec, ep, level, 0, iovec, n_iovec) + +/* Like LOG_MESSAGE(), but with the unit name prefixed. */ +#define LOG_EXEC_MESSAGE(ep, fmt, ...) LOG_MESSAGE("%s: " fmt, (ep)->unit_id, ##__VA_ARGS__) +#define LOG_EXEC_ID(ep) LOG_EXEC_ID_FIELD_FORMAT(ep), (ep)->unit_id +#define LOG_EXEC_INVOCATION_ID(ep) LOG_EXEC_INVOCATION_ID_FIELD_FORMAT(ep), (ep)->invocation_id_string + +#define _LOG_CONTEXT_PUSH_EXEC(ec, ep, p, c) \ + const ExecContext *c = (ec); \ + const ExecParameters *p = (ep); \ + LOG_CONTEXT_PUSH_KEY_VALUE(LOG_EXEC_ID_FIELD(p), p->unit_id); \ + LOG_CONTEXT_PUSH_KEY_VALUE(LOG_EXEC_INVOCATION_ID_FIELD(p), p->invocation_id_string); \ + LOG_CONTEXT_PUSH_IOV(c->log_extra_fields, c->n_log_extra_fields) + +#define LOG_CONTEXT_PUSH_EXEC(ec, ep) \ + _LOG_CONTEXT_PUSH_EXEC(ec, ep, UNIQ_T(p, UNIQ), UNIQ_T(c, UNIQ)) diff --git a/src/core/executor.c b/src/core/executor.c new file mode 100644 index 0000000000..93ebad4b03 --- /dev/null +++ b/src/core/executor.c @@ -0,0 +1,252 @@ +/* SPDX-License-Identifier: LGPL-2.1-or-later */ + +#include +#include + +#include "sd-messages.h" + +#include "alloc-util.h" +#include "build.h" +#include "exec-invoke.h" +#include "execute-serialize.h" +#include "execute.h" +#include "exit-status.h" +#include "fdset.h" +#include "fd-util.h" +#include "fileio.h" +#include "getopt-defs.h" +#include "parse-util.h" +#include "pretty-print.h" +#include "static-destruct.h" + +static FILE* arg_serialization = NULL; + +STATIC_DESTRUCTOR_REGISTER(arg_serialization, fclosep); + +static int help(void) { + _cleanup_free_ char *link = NULL; + int r; + + r = terminal_urlify_man("systemd", "1", &link); + if (r < 0) + return log_oom(); + + printf("%s [OPTIONS...]\n\n" + "%sSandbox and execute processes.%s\n\n" + " -h --help Show this help and exit\n" + " --version Print version string and exit\n" + " --log-target=TARGET Set log target (console, journal,\n" + " journal-or-kmsg,\n" + " kmsg, null)\n" + " --log-level=LEVEL Set log level (debug, info, notice,\n" + " warning, err, crit,\n" + " alert, emerg)\n" + " --log-color=BOOL Highlight important messages\n" + " --log-location=BOOL Include code location in messages\n" + " --log-time=BOOL Prefix messages with current time\n" + " --deserialize=FD Deserialize process config from FD\n" + "\nSee the %s for details.\n", + program_invocation_short_name, + ansi_highlight(), + ansi_normal(), + link); + + return 0; +} + +static int parse_argv(int argc, char *argv[]) { + enum { + COMMON_GETOPT_ARGS, + ARG_VERSION, + ARG_DESERIALIZE, + }; + + static const struct option options[] = { + { "log-level", required_argument, NULL, ARG_LOG_LEVEL }, + { "log-target", required_argument, NULL, ARG_LOG_TARGET }, + { "log-color", required_argument, NULL, ARG_LOG_COLOR }, + { "log-location", required_argument, NULL, ARG_LOG_LOCATION }, + { "log-time", required_argument, NULL, ARG_LOG_TIME }, + { "help", no_argument, NULL, 'h' }, + { "version", no_argument, NULL, ARG_VERSION }, + { "deserialize", required_argument, NULL, ARG_DESERIALIZE }, + {} + }; + + int c, r; + + assert(argc >= 0); + assert(argv); + + while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0) + switch (c) { + case 'h': + return help(); + + case ARG_VERSION: + return version(); + + case ARG_LOG_LEVEL: + r = log_set_max_level_from_string(optarg); + if (r < 0) + return log_error_errno(r, "Failed to parse log level \"%s\": %m", optarg); + + break; + + case ARG_LOG_TARGET: + r = log_set_target_from_string(optarg); + if (r < 0) + return log_error_errno(r, "Failed to parse log target \"%s\": %m", optarg); + + break; + + case ARG_LOG_COLOR: + r = log_show_color_from_string(optarg); + if (r < 0) + return log_error_errno( + r, + "Failed to parse log color setting \"%s\": %m", + optarg); + + break; + + case ARG_LOG_LOCATION: + r = log_show_location_from_string(optarg); + if (r < 0) + return log_error_errno( + r, + "Failed to parse log location setting \"%s\": %m", + optarg); + + break; + + case ARG_LOG_TIME: + r = log_show_time_from_string(optarg); + if (r < 0) + return log_error_errno( + r, + "Failed to parse log time setting \"%s\": %m", + optarg); + + break; + + case ARG_DESERIALIZE: { + FILE *f; + int fd; + + fd = parse_fd(optarg); + if (fd < 0) + return log_error_errno( + fd, + "Failed to parse serialization fd \"%s\": %m", + optarg); + + r = fd_cloexec(fd, /* cloexec= */ true); + if (r < 0) + return log_error_errno( + r, + "Failed to set serialization fd \"%s\" to close-on-exec: %m", + optarg); + + f = fdopen(fd, "r"); + if (!f) + return log_error_errno(errno, "Failed to open serialization fd %d: %m", fd); + + safe_fclose(arg_serialization); + arg_serialization = f; + + break; + } + + case '?': + return -EINVAL; + + default: + assert_not_reached(); + } + + if (!arg_serialization) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), + "No serialization fd specified."); + + return 1 /* work to do */; +} + +int main(int argc, char *argv[]) { + _cleanup_fdset_free_ FDSet *fdset = NULL; + int exit_status = EXIT_SUCCESS, r; + _cleanup_(cgroup_context_done) CGroupContext cgroup_context = {}; + _cleanup_(exec_context_done) ExecContext context = {}; + _cleanup_(exec_command_done) ExecCommand command = {}; + _cleanup_(exec_params_serialized_done) ExecParameters params = EXEC_PARAMETERS_INIT(/* flags= */ 0); + _cleanup_(exec_shared_runtime_done) ExecSharedRuntime shared = { + .netns_storage_socket = PIPE_EBADF, + .ipcns_storage_socket = PIPE_EBADF, + }; + _cleanup_(dynamic_creds_done) DynamicCreds dynamic_creds = {}; + _cleanup_(exec_runtime_clear) ExecRuntime runtime = { + .ephemeral_storage_socket = PIPE_EBADF, + .shared = &shared, + .dynamic_creds = &dynamic_creds, + }; + + exec_context_init(&context); + cgroup_context_init(&cgroup_context); + + /* We might be starting the journal itself, we'll be told by the caller what to do */ + log_set_always_reopen_console(true); + log_set_prohibit_ipc(true); + log_setup(); + + r = fdset_new_fill(/* filter_cloexec= */ 0, &fdset); + if (r < 0) + return log_error_errno(r, "Failed to create fd set: %m"); + + r = parse_argv(argc, argv); + if (r <= 0) + return r; + + /* Now try again if we were told it's fine to use a different target */ + if (log_get_target() != LOG_TARGET_KMSG) { + log_set_prohibit_ipc(false); + log_open(); + } + + r = fdset_remove(fdset, fileno(arg_serialization)); + if (r < 0) + return log_error_errno(r, "Failed to remove serialization fd from fd set: %m"); + + r = exec_deserialize_invocation(arg_serialization, + fdset, + &context, + &command, + ¶ms, + &runtime, + &cgroup_context); + if (r < 0) + return log_error_errno(r, "Failed to deserialize: %m"); + + arg_serialization = safe_fclose(arg_serialization); + fdset = fdset_free(fdset); + + r = exec_invoke(&command, + &context, + ¶ms, + &runtime, + &cgroup_context, + &exit_status); + if (r < 0) { + const char *status = ASSERT_PTR( + exit_status_to_string(exit_status, EXIT_STATUS_LIBC | EXIT_STATUS_SYSTEMD)); + + log_exec_struct_errno(&context, ¶ms, LOG_ERR, r, + "MESSAGE_ID=" SD_MESSAGE_SPAWN_FAILED_STR, + LOG_EXEC_INVOCATION_ID(¶ms), + LOG_EXEC_MESSAGE(¶ms, "Failed at step %s spawning %s: %m", + status, command.path), + "EXECUTABLE=%s", command.path); + } else + assert(exit_status == EXIT_SUCCESS); /* When 'skip' is chosen in the confirm spawn prompt */ + + return exit_status; +} diff --git a/src/core/fuzz-manager-serialize.c b/src/core/fuzz-manager-serialize.c index cbc89f5737..0e4bfa4484 100644 --- a/src/core/fuzz-manager-serialize.c +++ b/src/core/fuzz-manager-serialize.c @@ -24,7 +24,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { log_set_target(LOG_TARGET_NULL); } - assert_se(manager_new(RUNTIME_SCOPE_SYSTEM, MANAGER_TEST_RUN_MINIMAL, &m) >= 0); + assert_se(manager_new(RUNTIME_SCOPE_SYSTEM, MANAGER_TEST_RUN_MINIMAL|MANAGER_TEST_DONT_OPEN_EXECUTOR, &m) >= 0); /* Set log overrides as well to make it harder for a serialization file * to switch log levels/targets during fuzzing */ manager_override_log_level(m, log_get_max_level()); diff --git a/src/core/fuzz-unit-file.c b/src/core/fuzz-unit-file.c index a11d6b53b5..7b738062b5 100644 --- a/src/core/fuzz-unit-file.c +++ b/src/core/fuzz-unit-file.c @@ -65,7 +65,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (!getenv("SYSTEMD_LOG_LEVEL")) log_set_max_level(LOG_CRIT); - assert_se(manager_new(RUNTIME_SCOPE_SYSTEM, MANAGER_TEST_RUN_MINIMAL, &m) >= 0); + assert_se(manager_new(RUNTIME_SCOPE_SYSTEM, MANAGER_TEST_RUN_MINIMAL|MANAGER_TEST_DONT_OPEN_EXECUTOR, &m) >= 0); name = strjoina("a.", unit_type_to_string(t)); assert_se(unit_new_for_name(m, unit_vtable[t]->object_size, name, &u) >= 0); diff --git a/src/core/manager-serialize.c b/src/core/manager-serialize.c index 4127bcf1ac..04393cf11d 100644 --- a/src/core/manager-serialize.c +++ b/src/core/manager-serialize.c @@ -18,21 +18,9 @@ #include "varlink-internal.h" int manager_open_serialization(Manager *m, FILE **ret_f) { - _cleanup_close_ int fd = -EBADF; - FILE *f; - assert(ret_f); - fd = open_serialization_fd("systemd-state"); - if (fd < 0) - return fd; - - f = take_fdopen(&fd, "w+"); - if (!f) - return -errno; - - *ret_f = f; - return 0; + return open_serialization_file("systemd-state", ret_f); } static bool manager_timestamp_shall_serialize(ManagerTimestamp t) { @@ -195,7 +183,7 @@ int manager_serialize( if (u->id != t) continue; - r = unit_serialize(u, f, fds, switching_root); + r = unit_serialize_state(u, f, fds, switching_root); if (r < 0) return r; } @@ -222,7 +210,7 @@ static int manager_deserialize_one_unit(Manager *m, const char *name, FILE *f, F return log_notice_errno(r, "Failed to load unit \"%s\", skipping deserialization: %m", name); } - r = unit_deserialize(u, f, fds); + r = unit_deserialize_state(u, f, fds); if (r < 0) { if (r == -ENOMEM) return r; @@ -251,7 +239,7 @@ static int manager_deserialize_units(Manager *m, FILE *f, FDSet *fds) { if (r == -ENOMEM) return r; if (r < 0) { - r = unit_deserialize_skip(f); + r = unit_deserialize_state_skip(f); if (r < 0) return r; } @@ -507,7 +495,7 @@ int manager_deserialize(Manager *m, FILE *f, FDSet *fds) { } } else if ((val = startswith(l, "dynamic-user="))) - dynamic_user_deserialize_one(m, val, fds); + dynamic_user_deserialize_one(m, val, fds, NULL); else if ((val = startswith(l, "destroy-ipc-uid="))) manager_deserialize_uid_refs_one(m, val); else if ((val = startswith(l, "destroy-ipc-gid="))) diff --git a/src/core/manager.c b/src/core/manager.c index 9af6fd4184..9307a13a79 100644 --- a/src/core/manager.c +++ b/src/core/manager.c @@ -144,6 +144,15 @@ static usec_t manager_watch_jobs_next_time(Manager *m) { return usec_add(now(CLOCK_MONOTONIC), timeout); } +static bool manager_is_confirm_spawn_disabled(Manager *m) { + assert(m); + + if (!m->confirm_spawn) + return true; + + return access("/run/systemd/confirm_spawn_disabled", F_OK) >= 0; +} + static void manager_watch_jobs_in_progress(Manager *m) { usec_t next; int r; @@ -912,6 +921,8 @@ int manager_new(RuntimeScope runtime_scope, ManagerTestRunFlags test_run_flags, .interval = 10 * USEC_PER_MINUTE, .burst = 10, }, + + .executor_fd = -EBADF, }; unit_defaults_init(&m->defaults, runtime_scope); @@ -1030,6 +1041,42 @@ int manager_new(RuntimeScope runtime_scope, ManagerTestRunFlags test_run_flags, if (r < 0 && r != -EEXIST) return r; + + m->executor_fd = open(SYSTEMD_EXECUTOR_BINARY_PATH, O_CLOEXEC|O_PATH); + if (m->executor_fd < 0) + return log_warning_errno(errno, + "Failed to open executor binary '%s': %m", + SYSTEMD_EXECUTOR_BINARY_PATH); + } else if (!FLAGS_SET(test_run_flags, MANAGER_TEST_DONT_OPEN_EXECUTOR)) { + _cleanup_free_ char *self_exe = NULL, *executor_path = NULL; + _cleanup_close_ int self_dir_fd = -EBADF; + int level = LOG_DEBUG; + + /* Prefer sd-executor from the same directory as the test, e.g.: when running unit tests from the + * build directory. Fallback to working directory and then the installation path. */ + r = readlink_and_make_absolute("/proc/self/exe", &self_exe); + if (r < 0) + return r; + + self_dir_fd = open_parent(self_exe, O_CLOEXEC|O_DIRECTORY, 0); + if (self_dir_fd < 0) + return -errno; + + m->executor_fd = openat(self_dir_fd, "systemd-executor", O_CLOEXEC|O_PATH); + if (m->executor_fd < 0 && errno == ENOENT) + m->executor_fd = openat(AT_FDCWD, "systemd-executor", O_CLOEXEC|O_PATH); + if (m->executor_fd < 0 && errno == ENOENT) { + m->executor_fd = open(SYSTEMD_EXECUTOR_BINARY_PATH, O_CLOEXEC|O_PATH); + level = LOG_WARNING; /* Tests should normally use local builds */ + } + if (m->executor_fd < 0) + return -errno; + + r = fd_get_path(m->executor_fd, &executor_path); + if (r < 0) + return r; + + log_full(level, "Using systemd-executor binary from '%s'", executor_path); } /* Note that we do not set up the notify fd here. We do that after deserialization, @@ -1692,6 +1739,8 @@ Manager* manager_free(Manager *m) { lsm_bpf_destroy(m->restrict_fs); #endif + safe_close(m->executor_fd); + return mfree(m); } @@ -4430,13 +4479,6 @@ void manager_disable_confirm_spawn(void) { (void) touch("/run/systemd/confirm_spawn_disabled"); } -bool manager_is_confirm_spawn_disabled(Manager *m) { - if (!m->confirm_spawn) - return true; - - return access("/run/systemd/confirm_spawn_disabled", F_OK) >= 0; -} - static bool manager_should_show_status(Manager *m, StatusType type) { assert(m); @@ -4954,6 +4996,17 @@ void unit_defaults_done(UnitDefaults *defaults) { rlimit_free_all(defaults->rlimit); } +LogTarget manager_get_executor_log_target(Manager *m) { + assert(m); + + /* If journald is not available tell sd-executor to go to kmsg, as it might be starting journald */ + + if (manager_journal_is_running(m)) + return log_get_target(); + + return LOG_TARGET_KMSG; +} + static const char *const manager_state_table[_MANAGER_STATE_MAX] = { [MANAGER_INITIALIZING] = "initializing", [MANAGER_STARTING] = "starting", diff --git a/src/core/manager.h b/src/core/manager.h index 4fa54bb3c1..6321a353a5 100644 --- a/src/core/manager.h +++ b/src/core/manager.h @@ -145,6 +145,7 @@ typedef enum ManagerTestRunFlags { MANAGER_TEST_RUN_ENV_GENERATORS = 1 << 2, /* also run env generators */ MANAGER_TEST_RUN_GENERATORS = 1 << 3, /* also run unit generators */ MANAGER_TEST_RUN_IGNORE_DEPENDENCIES = 1 << 4, /* run while ignoring dependencies */ + MANAGER_TEST_DONT_OPEN_EXECUTOR = 1 << 5, /* avoid trying to load sd-executor */ MANAGER_TEST_FULL = MANAGER_TEST_RUN_BASIC | MANAGER_TEST_RUN_ENV_GENERATORS | MANAGER_TEST_RUN_GENERATORS, } ManagerTestRunFlags; @@ -496,6 +497,10 @@ struct Manager { /* For NFTSet= */ FirewallContext *fw_ctx; + + /* Pin the systemd-executor binary, so that it never changes until re-exec, ensuring we don't have + * serialization/deserialization compatibility issues during upgrades. */ + int executor_fd; }; static inline usec_t manager_default_timeout_abort_usec(Manager *m) { @@ -616,7 +621,6 @@ const char *manager_state_to_string(ManagerState m) _const_; ManagerState manager_state_from_string(const char *s) _pure_; const char *manager_get_confirm_spawn(Manager *m); -bool manager_is_confirm_spawn_disabled(Manager *m); void manager_disable_confirm_spawn(void); const char *manager_timestamp_to_string(ManagerTimestamp m) _const_; @@ -629,6 +633,8 @@ void manager_override_watchdog(Manager *m, WatchdogType t, usec_t timeout); int manager_set_watchdog_pretimeout_governor(Manager *m, const char *governor); int manager_override_watchdog_pretimeout_governor(Manager *m, const char *governor); +LogTarget manager_get_executor_log_target(Manager *m); + const char* oom_policy_to_string(OOMPolicy i) _const_; OOMPolicy oom_policy_from_string(const char *s) _pure_; diff --git a/src/core/meson.build b/src/core/meson.build index e5b92ce4d9..44af28a3f3 100644 --- a/src/core/meson.build +++ b/src/core/meson.build @@ -36,6 +36,7 @@ libcore_sources = files( 'emergency-action.c', 'exec-credential.c', 'execute.c', + 'execute-serialize.c', 'generator-setup.c', 'ima-setup.c', 'import-creds.c', @@ -143,6 +144,11 @@ systemd_sources = files( 'crash-handler.c', ) +systemd_executor_sources = files( + 'executor.c', + 'exec-invoke.c', +) + executables += [ libexec_template + { 'name' : 'systemd', @@ -155,6 +161,22 @@ executables += [ ], 'dependencies' : libseccomp, }, + libexec_template + { + 'name' : 'systemd-executor', + 'public' : true, + 'sources' : systemd_executor_sources, + 'include_directories' : core_includes, + 'link_with' : [ + libcore, + libshared, + ], + 'dependencies' : [ + libapparmor, + libpam, + libseccomp, + libselinux, + ], + }, fuzz_template + { 'sources' : files('fuzz-unit-file.c'), 'link_with' : [ diff --git a/src/core/mount.c b/src/core/mount.c index 6424c56ed3..fe04b3d74c 100644 --- a/src/core/mount.c +++ b/src/core/mount.c @@ -889,13 +889,8 @@ static void mount_dump(Unit *u, FILE *f, const char *prefix) { static int mount_spawn(Mount *m, ExecCommand *c, PidRef *ret_pid) { - _cleanup_(exec_params_clear) ExecParameters exec_params = { - .flags = EXEC_APPLY_SANDBOXING|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN, - .stdin_fd = -EBADF, - .stdout_fd = -EBADF, - .stderr_fd = -EBADF, - .exec_fd = -EBADF, - }; + _cleanup_(exec_params_clear) ExecParameters exec_params = EXEC_PARAMETERS_INIT( + EXEC_APPLY_SANDBOXING|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN); _cleanup_(pidref_done) PidRef pidref = PIDREF_NULL; pid_t pid; int r; diff --git a/src/core/service.c b/src/core/service.c index 73a678b0cc..b4bd343bc9 100644 --- a/src/core/service.c +++ b/src/core/service.c @@ -1602,13 +1602,7 @@ static int service_spawn_internal( ExecFlags flags, PidRef *ret_pid) { - _cleanup_(exec_params_clear) ExecParameters exec_params = { - .flags = flags, - .stdin_fd = -EBADF, - .stdout_fd = -EBADF, - .stderr_fd = -EBADF, - .exec_fd = -EBADF, - }; + _cleanup_(exec_params_clear) ExecParameters exec_params = EXEC_PARAMETERS_INIT(flags); _cleanup_(sd_event_source_unrefp) sd_event_source *exec_fd_source = NULL; _cleanup_strv_free_ char **final_env = NULL, **our_env = NULL; _cleanup_(pidref_done) PidRef pidref = PIDREF_NULL; diff --git a/src/core/socket.c b/src/core/socket.c index 1bbcadc3ba..dff4bc42d7 100644 --- a/src/core/socket.c +++ b/src/core/socket.c @@ -1913,13 +1913,8 @@ static int socket_coldplug(Unit *u) { static int socket_spawn(Socket *s, ExecCommand *c, PidRef *ret_pid) { - _cleanup_(exec_params_clear) ExecParameters exec_params = { - .flags = EXEC_APPLY_SANDBOXING|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN, - .stdin_fd = -EBADF, - .stdout_fd = -EBADF, - .stderr_fd = -EBADF, - .exec_fd = -EBADF, - }; + _cleanup_(exec_params_clear) ExecParameters exec_params = EXEC_PARAMETERS_INIT( + EXEC_APPLY_SANDBOXING|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN); _cleanup_(pidref_done) PidRef pidref = PIDREF_NULL; pid_t pid; int r; diff --git a/src/core/swap.c b/src/core/swap.c index 008c5bbc24..d0bce8c44b 100644 --- a/src/core/swap.c +++ b/src/core/swap.c @@ -632,13 +632,8 @@ static void swap_dump(Unit *u, FILE *f, const char *prefix) { static int swap_spawn(Swap *s, ExecCommand *c, PidRef *ret_pid) { - _cleanup_(exec_params_clear) ExecParameters exec_params = { - .flags = EXEC_APPLY_SANDBOXING|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN, - .stdin_fd = -EBADF, - .stdout_fd = -EBADF, - .stderr_fd = -EBADF, - .exec_fd = -EBADF, - }; + _cleanup_(exec_params_clear) ExecParameters exec_params = EXEC_PARAMETERS_INIT( + EXEC_APPLY_SANDBOXING|EXEC_APPLY_CHROOT|EXEC_APPLY_TTY_STDIN); _cleanup_(pidref_done) PidRef pidref = PIDREF_NULL; pid_t pid; int r; diff --git a/src/core/unit-serialize.c b/src/core/unit-serialize.c index 2851002615..cd7f2ee86b 100644 --- a/src/core/unit-serialize.c +++ b/src/core/unit-serialize.c @@ -90,7 +90,7 @@ static const char *const io_accounting_metric_field_last[_CGROUP_IO_ACCOUNTING_M [CGROUP_IO_WRITE_OPERATIONS] = "io-accounting-write-operations-last", }; -int unit_serialize(Unit *u, FILE *f, FDSet *fds, bool switching_root) { +int unit_serialize_state(Unit *u, FILE *f, FDSet *fds, bool switching_root) { int r; assert(u); @@ -264,7 +264,7 @@ static int unit_deserialize_job(Unit *u, FILE *f) { _deserialize_matched; \ }) -int unit_deserialize(Unit *u, FILE *f, FDSet *fds) { +int unit_deserialize_state(Unit *u, FILE *f, FDSet *fds) { int r; assert(u); @@ -552,7 +552,7 @@ int unit_deserialize(Unit *u, FILE *f, FDSet *fds) { return 0; } -int unit_deserialize_skip(FILE *f) { +int unit_deserialize_state_skip(FILE *f) { int r; assert(f); diff --git a/src/core/unit-serialize.h b/src/core/unit-serialize.h index 599d883dec..ab8a8e3be9 100644 --- a/src/core/unit-serialize.h +++ b/src/core/unit-serialize.h @@ -6,8 +6,11 @@ #include "unit.h" #include "fdset.h" -int unit_serialize(Unit *u, FILE *f, FDSet *fds, bool serialize_jobs); -int unit_deserialize(Unit *u, FILE *f, FDSet *fds); -int unit_deserialize_skip(FILE *f); +/* These functions serialize state for our own usage, i.e.: across a reload/reexec, rather than for being + * passed to a child process. */ + +int unit_serialize_state(Unit *u, FILE *f, FDSet *fds, bool serialize_jobs); +int unit_deserialize_state(Unit *u, FILE *f, FDSet *fds); +int unit_deserialize_state_skip(FILE *f); void unit_dump(Unit *u, FILE *f, const char *prefix); diff --git a/src/core/unit.c b/src/core/unit.c index 5623e94921..aa809843f7 100644 --- a/src/core/unit.c +++ b/src/core/unit.c @@ -1854,18 +1854,6 @@ int unit_test_start_limit(Unit *u) { return -ECANCELED; } -bool unit_shall_confirm_spawn(Unit *u) { - assert(u); - - if (manager_is_confirm_spawn_disabled(u->manager)) - return false; - - /* For some reasons units remaining in the same process group - * as PID 1 fail to acquire the console even if it's not used - * by any process. So skip the confirmation question for them. */ - return !unit_get_exec_context(u)->same_pgrp; -} - static bool unit_verify_deps(Unit *u) { Unit *other; @@ -5369,6 +5357,7 @@ int unit_acquire_invocation_id(Unit *u) { } int unit_set_exec_params(Unit *u, ExecParameters *p) { + const char *confirm_spawn; int r; assert(u); @@ -5381,7 +5370,13 @@ int unit_set_exec_params(Unit *u, ExecParameters *p) { p->runtime_scope = u->manager->runtime_scope; - p->confirm_spawn = manager_get_confirm_spawn(u->manager); + confirm_spawn = manager_get_confirm_spawn(u->manager); + if (confirm_spawn) { + p->confirm_spawn = strdup(confirm_spawn); + if (!p->confirm_spawn) + return -ENOMEM; + } + p->cgroup_supported = u->manager->cgroup_supported; p->prefix = u->manager->prefix; SET_FLAG(p->flags, EXEC_PASS_LOG_UNIT|EXEC_CHOWN_DIRECTORIES, MANAGER_IS_SYSTEM(u->manager)); @@ -5393,6 +5388,27 @@ int unit_set_exec_params(Unit *u, ExecParameters *p) { p->received_credentials_directory = u->manager->received_credentials_directory; p->received_encrypted_credentials_directory = u->manager->received_encrypted_credentials_directory; + p->shall_confirm_spawn = !!u->manager->confirm_spawn; + + p->fallback_smack_process_label = u->manager->defaults.smack_process_label; + + if (u->manager->restrict_fs && p->bpf_outer_map_fd < 0) { + int fd = lsm_bpf_map_restrict_fs_fd(u); + if (fd < 0) + return fd; + + p->bpf_outer_map_fd = fd; + } + + p->user_lookup_fd = u->manager->user_lookup_fds[1]; + + p->cgroup_id = u->cgroup_id; + p->invocation_id = u->invocation_id; + sd_id128_to_string(p->invocation_id, p->invocation_id_string); + p->unit_id = strdup(u->id); + if (!p->unit_id) + return -ENOMEM; + return 0; } diff --git a/src/core/unit.h b/src/core/unit.h index 434981755a..b5d7eb5f26 100644 --- a/src/core/unit.h +++ b/src/core/unit.h @@ -1024,8 +1024,6 @@ void unit_notify_user_lookup(Unit *u, uid_t uid, gid_t gid); int unit_set_invocation_id(Unit *u, sd_id128_t id); int unit_acquire_invocation_id(Unit *u); -bool unit_shall_confirm_spawn(Unit *u); - int unit_set_exec_params(Unit *s, ExecParameters *p); int unit_fork_helper_process(Unit *u, const char *name, PidRef *ret); diff --git a/src/shared/serialize.c b/src/shared/serialize.c index 2ffc524f15..edb232e2ee 100644 --- a/src/shared/serialize.c +++ b/src/shared/serialize.c @@ -7,6 +7,7 @@ #include "escape.h" #include "fd-util.h" #include "fileio.h" +#include "hexdecoct.h" #include "memfd-util.h" #include "missing_mman.h" #include "missing_syscall.h" @@ -173,6 +174,93 @@ int serialize_pidref(FILE *f, FDSet *fds, const char *key, PidRef *pidref) { return serialize_item_format(f, key, "@%i", copy); } +int serialize_item_hexmem(FILE *f, const char *key, const void *p, size_t l) { + _cleanup_free_ char *encoded = NULL; + int r; + + assert(f); + assert(key); + assert(p || l == 0); + + if (l == 0) + return 0; + + encoded = hexmem(p, l); + if (!encoded) + return log_oom_debug(); + + r = serialize_item(f, key, encoded); + if (r < 0) + return r; + + return 1; +} + +int serialize_item_base64mem(FILE *f, const char *key, const void *p, size_t l) { + _cleanup_free_ char *encoded = NULL; + ssize_t len; + int r; + + assert(f); + assert(key); + assert(p || l == 0); + + if (l == 0) + return 0; + + len = base64mem(p, l, &encoded); + if (len <= 0) + return log_oom_debug(); + + r = serialize_item(f, key, encoded); + if (r < 0) + return r; + + return 1; +} + +int serialize_string_set(FILE *f, const char *key, Set *s) { + const char *e; + int r; + + assert(f); + assert(key); + + if (set_isempty(s)) + return 0; + + /* Serialize as individual items, as each element might contain separators and escapes */ + + SET_FOREACH(e, s) { + r = serialize_item(f, key, e); + if (r < 0) + return r; + } + + return 1; +} + +int serialize_image_policy(FILE *f, const char *key, const ImagePolicy *p) { + _cleanup_free_ char *policy = NULL; + int r; + + assert(f); + assert(key); + + if (!p) + return 0; + + r = image_policy_to_string(p, /* simplify= */ false, &policy); + if (r < 0) + return r; + + r = serialize_item(f, key, policy); + if (r < 0) + return r; + + return 1; +} + int deserialize_read_line(FILE *f, char **ret) { _cleanup_free_ char *line = NULL; int r; @@ -333,3 +421,22 @@ int open_serialization_fd(const char *ident) { return fd; } + +int open_serialization_file(const char *ident, FILE **ret) { + _cleanup_fclose_ FILE *f = NULL; + _cleanup_close_ int fd; + + assert(ret); + + fd = open_serialization_fd(ident); + if (fd < 0) + return fd; + + f = take_fdopen(&fd, "w+"); + if (!f) + return -errno; + + *ret = TAKE_PTR(f); + + return 0; +} diff --git a/src/shared/serialize.h b/src/shared/serialize.h index 9463d1127c..5122c42793 100644 --- a/src/shared/serialize.h +++ b/src/shared/serialize.h @@ -4,19 +4,25 @@ #include #include "fdset.h" +#include "image-policy.h" #include "macro.h" #include "pidref.h" +#include "set.h" #include "string-util.h" #include "time-util.h" int serialize_item(FILE *f, const char *key, const char *value); int serialize_item_escaped(FILE *f, const char *key, const char *value); int serialize_item_format(FILE *f, const char *key, const char *value, ...) _printf_(3,4); +int serialize_item_hexmem(FILE *f, const char *key, const void *p, size_t l); +int serialize_item_base64mem(FILE *f, const char *key, const void *p, size_t l); int serialize_fd(FILE *f, FDSet *fds, const char *key, int fd); int serialize_usec(FILE *f, const char *key, usec_t usec); int serialize_dual_timestamp(FILE *f, const char *key, const dual_timestamp *t); int serialize_strv(FILE *f, const char *key, char **l); int serialize_pidref(FILE *f, FDSet *fds, const char *key, PidRef *pidref); +int serialize_string_set(FILE *f, const char *key, Set *s); +int serialize_image_policy(FILE *f, const char *key, const ImagePolicy *p); static inline int serialize_bool(FILE *f, const char *key, bool b) { return serialize_item(f, key, yes_no(b)); @@ -25,6 +31,10 @@ static inline int serialize_bool_elide(FILE *f, const char *key, bool b) { return b ? serialize_item(f, key, yes_no(b)) : 0; } +static inline int serialize_item_tristate(FILE *f, const char *key, int value) { + return value >= 0 ? serialize_item_format(f, key, "%i", value) : 0; +} + int deserialize_read_line(FILE *f, char **ret); int deserialize_usec(const char *value, usec_t *timestamp); @@ -34,3 +44,4 @@ int deserialize_strv(char ***l, const char *value); int deserialize_pidref(FDSet *fds, const char *value, PidRef *ret); int open_serialization_fd(const char *ident); +int open_serialization_file(const char *ident, FILE **ret); diff --git a/src/test/test-fd-util.c b/src/test/test-fd-util.c index 20d412f5c6..67ec3e59f1 100644 --- a/src/test/test-fd-util.c +++ b/src/test/test-fd-util.c @@ -100,6 +100,17 @@ TEST(open_serialization_fd) { assert_se(write(fd, "test\n", 5) == 5); } +TEST(open_serialization_file) { + _cleanup_fclose_ FILE *f = NULL; + int r; + + r = open_serialization_file("test", &f); + assert_se(r >= 0); + assert_se(f); + + assert_se(fwrite("test\n", 1, 5, f) == 5); +} + TEST(fd_move_above_stdio) { int original_stdin, new_fd; diff --git a/src/test/test-serialize.c b/src/test/test-serialize.c index 36052b6485..9229e3f5c7 100644 --- a/src/test/test-serialize.c +++ b/src/test/test-serialize.c @@ -190,6 +190,72 @@ TEST(serialize_environment) { assert_se(strv_equal(env, env2)); } +TEST(serialize_item_hexmem) { + _cleanup_(unlink_tempfilep) char fn[] = "/tmp/test-serialize.XXXXXX"; + _cleanup_fclose_ FILE *f = NULL; + + assert_se(fmkostemp_safe(fn, "r+", &f) == 0); + log_info("/* %s (%s) */", __func__, fn); + + assert_se(serialize_item_hexmem(f, "a", NULL, 0) == 0); + assert_se(serialize_item_hexmem(f, "a", (uint8_t []){0xff, 0xff, 0xff}, sizeof(uint8_t) * 3) == 1); + + rewind(f); + + _cleanup_free_ char *line = NULL; + assert_se(read_line(f, LONG_LINE_MAX, &line) > 0); + assert_se(streq(line, "a=ffffff")); + +} + +TEST(serialize_item_base64mem) { + _cleanup_(unlink_tempfilep) char fn[] = "/tmp/test-serialize.XXXXXX"; + _cleanup_fclose_ FILE *f = NULL; + + assert_se(fmkostemp_safe(fn, "r+", &f) == 0); + log_info("/* %s (%s) */", __func__, fn); + + assert_se(serialize_item_base64mem(f, "a", NULL, 0) == 0); + assert_se(serialize_item_base64mem(f, "a", (uint8_t []){0xff, 0xff, 0xff}, sizeof(uint8_t) * 3) == 1); + + rewind(f); + + _cleanup_free_ char *line = NULL; + assert_se(read_line(f, LONG_LINE_MAX, &line) > 0); + assert_se(streq(line, "a=////")); +} + +TEST(serialize_string_set) { + _cleanup_(unlink_tempfilep) char fn[] = "/tmp/test-serialize.XXXXXX"; + _cleanup_fclose_ FILE *f = NULL; + _cleanup_set_free_free_ Set *s = NULL; + _cleanup_free_ char *line1 = NULL, *line2 = NULL; + char *p, *q; + + assert_se(fmkostemp_safe(fn, "r+", &f) == 0); + log_info("/* %s (%s) */", __func__, fn); + + assert_se(set_ensure_allocated(&s, &string_hash_ops) >= 0); + + assert_se(serialize_string_set(f, "a", s) == 0); + + assert_se(set_put_strsplit(s, "abc def,ghi jkl", ",", 0) >= 0); + + assert_se(serialize_string_set(f, "a", s) == 1); + + rewind(f); + + assert_se(read_line(f, LONG_LINE_MAX, &line1) > 0); + assert_se((p = startswith(line1, "a="))); + + assert_se(read_line(f, LONG_LINE_MAX, &line2) > 0); + assert_se((q = startswith(line2, "a="))); + + assert_se(!streq(p, q)); + assert_se(STR_IN_SET(p, "abc def", "ghi jkl")); + assert_se(STR_IN_SET(q, "abc def", "ghi jkl")); +} + static int intro(void) { memset(long_string, 'x', sizeof(long_string)-1); char_array_0(long_string); diff --git a/test/testsuite-04.units/logs-filtering.service b/test/testsuite-04.units/logs-filtering.service index 06210868fd..6e2af9a2a1 100644 --- a/test/testsuite-04.units/logs-filtering.service +++ b/test/testsuite-04.units/logs-filtering.service @@ -2,5 +2,5 @@ Description=Log filtering unit [Service] -ExecStart=sh -c 'while true; do echo "Logging from the service, and ~more~"; sleep .25; done' +ExecStart=sh -c 'while true; do echo "Logging from the service, and ~more~ foo bar"; sleep .25; done' SyslogLevel=notice diff --git a/test/units/testsuite-04.LogFilterPatterns.sh b/test/units/testsuite-04.LogFilterPatterns.sh index 3f889d1294..41cf8a1fa1 100755 --- a/test/units/testsuite-04.LogFilterPatterns.sh +++ b/test/units/testsuite-04.LogFilterPatterns.sh @@ -78,6 +78,10 @@ if is_xattr_supported; then add_logs_filtering_override "logs-filtering.service" "10-allow-with-escape-char" "\\\\x7emore~" [[ -n $(run_service_and_fetch_logs "logs-filtering.service") ]] + add_logs_filtering_override "logs-filtering.service" "11-reset" "" + add_logs_filtering_override "logs-filtering.service" "12-allow-with-spaces" "foo bar" + [[ -n $(run_service_and_fetch_logs "logs-filtering.service") ]] + add_logs_filtering_override "delegated-cgroup-filtering.service" "00-allow-all" ".*" [[ -n $(run_service_and_fetch_logs "delegated-cgroup-filtering.service") ]] diff --git a/test/units/testsuite-55.sh b/test/units/testsuite-55.sh index c6258dead6..ffa9af2f6a 100755 --- a/test/units/testsuite-55.sh +++ b/test/units/testsuite-55.sh @@ -68,6 +68,12 @@ if systemctl is-active systemd-oomd.service; then systemctl restart systemd-oomd.service fi +# Ensure that we can start services even with a very low hard memory cap without oom-kills, but skip under +# sanitizers as they balloon memory usage. +if ! [[ -v ASAN_OPTIONS || -v UBSAN_OPTIONS ]]; then + systemd-run -t -p MemoryMax=10M -p MemorySwapMax=0 -p MemoryZSwapMax=0 /bin/true +fi + systemctl start testsuite-55-testchill.service systemctl start testsuite-55-testbloat.service