/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <errno.h>

#include <fcntl.h>

#include <poll.h>

#include <sys/file.h>

#include <sys/mman.h>

#include <sys/personality.h>

#include <sys/prctl.h>

#include <sys/shm.h>

#include <sys/types.h>

#include <sys/un.h>

#include <unistd.h>

#include <utmpx.h>

#include <linux/fs.h> /* Must be included after <sys/mount.h> */

#include "sd-messages.h"

#include "af-list.h"

#include "alloc-util.h"

#include "async.h"

#include "cap-list.h"

#include "capability-util.h"

#include "cgroup-setup.h"

#include "constants.h"

#include "cpu-set-util.h"

#include "dev-setup.h"

#include "env-file.h"

#include "env-util.h"

#include "errno-list.h"

#include "escape.h"

#include "exec-credential.h"

#include "execute.h"

#include "execute-serialize.h"

#include "exit-status.h"

#include "fd-util.h"

#include "fileio.h"

#include "format-util.h"

#include "glob-util.h"

#include "hexdecoct.h"

#include "ioprio-util.h"

#include "lock-util.h"

#include "log.h"

#include "macro.h"

#include "manager.h"

#include "manager-dump.h"

#include "memory-util.h"

#include "missing_fs.h"

#include "missing_prctl.h"

#include "mkdir-label.h"

#include "namespace.h"

#include "parse-util.h"

#include "path-util.h"

#include "process-util.h"

#include "rlimit-util.h"

#include "rm-rf.h"

#include "seccomp-util.h"

#include "securebits-util.h"

#include "selinux-util.h"

#include "serialize.h"

#include "sort-util.h"

#include "special.h"

#include "stat-util.h"

#include "string-table.h"

#include "string-util.h"

#include "strv.h"

#include "syslog-util.h"

#include "terminal-util.h"

#include "tmpfile-util.h"

#include "umask-util.h"

#include "unit-serialize.h"

#include "user-util.h"

#include "utmp-wtmp.h"

static bool is_terminal_input(ExecInput i) {

return IN_SET(i,

EXEC_INPUT_TTY,

EXEC_INPUT_TTY_FORCE,

EXEC_INPUT_TTY_FAIL);

}

static bool is_terminal_output(ExecOutput o) {

return IN_SET(o,

EXEC_OUTPUT_TTY,

EXEC_OUTPUT_KMSG_AND_CONSOLE,

EXEC_OUTPUT_JOURNAL_AND_CONSOLE);

}

const char *exec_context_tty_path(const ExecContext *context) {

assert(context);

if (context->stdio_as_fds)

return NULL;

if (context->tty_path)

return context->tty_path;

return "/dev/console";

}

static void exec_context_determine_tty_size(

const ExecContext *context,

const char *tty_path,

unsigned *ret_rows,

unsigned *ret_cols) {

unsigned rows, cols;

assert(context);

assert(ret_rows);

assert(ret_cols);

if (!tty_path)

tty_path = exec_context_tty_path(context);

rows = context->tty_rows;

cols = context->tty_cols;

if (tty_path && (rows == UINT_MAX || cols == UINT_MAX))

(void) proc_cmdline_tty_size(

tty_path,

rows == UINT_MAX ? &rows : NULL,

cols == UINT_MAX ? &cols : NULL);

*ret_rows = rows;

*ret_cols = cols;

}

int exec_context_apply_tty_size(

const ExecContext *context,

int tty_fd,

const char *tty_path) {

unsigned rows, cols;

exec_context_determine_tty_size(context, tty_path, &rows, &cols);

return terminal_set_size_fd(tty_fd, tty_path, rows, cols);

}

void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {

_cleanup_close_ int _fd = -EBADF, lock_fd = -EBADF;

int fd;

assert(context);

const char *path = exec_context_tty_path(context);

if (p && p->stdin_fd >= 0 && isatty(p->stdin_fd))

fd = p->stdin_fd;

else if (path && (context->tty_path || is_terminal_input(context->std_input) ||

is_terminal_output(context->std_output) || is_terminal_output(context->std_error))) {

fd = _fd = open_terminal(path, O_RDWR|O_NOCTTY|O_CLOEXEC|O_NONBLOCK);

if (fd < 0)

return (void) log_debug_errno(fd, "Failed to open terminal '%s', ignoring: %m", path);

} else

return; /* nothing to do */

/* Take a synchronization lock for the duration of the setup that we do here.

* systemd-vconsole-setup.service also takes the lock to avoid being interrupted. We open a new fd

* that will be closed automatically, and operate on it for convenience. */

lock_fd = lock_dev_console();

if (lock_fd < 0)

return (void) log_debug_errno(lock_fd,

"Failed to lock /dev/console: %m");

if (context->tty_vhangup)

(void) terminal_vhangup_fd(fd);

if (context->tty_reset)

(void) reset_terminal_fd(fd, /* switch_to_text= */ true);

(void) exec_context_apply_tty_size(context, fd, path);

if (context->tty_vt_disallocate && path)

(void) vt_disallocate(path);

}

bool exec_needs_network_namespace(const ExecContext *context) {

assert(context);

return context->private_network || context->network_namespace_path;

}

static bool exec_needs_ephemeral(const ExecContext *context) {

return (context->root_image || context->root_directory) && context->root_ephemeral;

}

bool exec_needs_ipc_namespace(const ExecContext *context) {

assert(context);

return context->private_ipc || context->ipc_namespace_path;

}

bool exec_needs_mount_namespace(

const ExecContext *context,

const ExecParameters *params,

const ExecRuntime *runtime) {

assert(context);

if (context->root_image)

return true;

if (!strv_isempty(context->read_write_paths) ||

!strv_isempty(context->read_only_paths) ||

!strv_isempty(context->inaccessible_paths) ||

!strv_isempty(context->exec_paths) ||

!strv_isempty(context->no_exec_paths))

return true;

if (context->n_bind_mounts > 0)

return true;

if (context->n_temporary_filesystems > 0)

return true;

if (context->n_mount_images > 0)

return true;

if (context->n_extension_images > 0)

return true;

if (!strv_isempty(context->extension_directories))

return true;

if (!IN_SET(context->mount_propagation_flag, 0, MS_SHARED))

return true;

if (context->private_tmp && runtime && runtime->shared && (runtime->shared->tmp_dir || runtime->shared->var_tmp_dir))

return true;

if (context->private_devices ||

context->private_mounts > 0 ||

(context->private_mounts < 0 && exec_needs_network_namespace(context)) ||

context->protect_system != PROTECT_SYSTEM_NO ||

context->protect_home != PROTECT_HOME_NO ||

context->protect_kernel_tunables ||

context->protect_kernel_modules ||

context->protect_kernel_logs ||

context->protect_control_groups ||

context->protect_proc != PROTECT_PROC_DEFAULT ||

context->proc_subset != PROC_SUBSET_ALL ||

exec_needs_ipc_namespace(context))

return true;

if (context->root_directory) {

if (exec_context_get_effective_mount_apivfs(context))

return true;

for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {

if (params && !params->prefix[t])

continue;

if (context->directories[t].n_items > 0)

return true;

}

}

if (context->dynamic_user &&

(context->directories[EXEC_DIRECTORY_STATE].n_items > 0 ||

context->directories[EXEC_DIRECTORY_CACHE].n_items > 0 ||

context->directories[EXEC_DIRECTORY_LOGS].n_items > 0))

return true;

if (context->log_namespace)

return true;

return false;

}

bool exec_directory_is_private(const ExecContext *context, ExecDirectoryType type) {

assert(context);

if (!context->dynamic_user)

return false;

if (type == EXEC_DIRECTORY_CONFIGURATION)

return false;

if (type == EXEC_DIRECTORY_RUNTIME && context->runtime_directory_preserve_mode == EXEC_PRESERVE_NO)

return false;

return true;

}

int exec_params_get_cgroup_path(

const ExecParameters *params,

const CGroupContext *c,

char **ret) {

const char *subgroup = NULL;

char *p;

assert(params);

assert(ret);

if (!params->cgroup_path)

return -EINVAL;

/* If we are called for a unit where cgroup delegation is on, and the payload created its own populated

* subcgroup (which we expect it to do, after all it asked for delegation), then we cannot place the control

* processes started after the main unit's process in the unit's main cgroup because it is now an inner one,

* and inner cgroups may not contain processes. Hence, if delegation is on, and this is a control process,

* let's use ".control" as subcgroup instead. Note that we do so only for ExecStartPost=, ExecReload=,

* ExecStop=, ExecStopPost=, i.e. for the commands where the main process is already forked. For ExecStartPre=

* this is not necessary, the cgroup is still empty. We distinguish these cases with the EXEC_CONTROL_CGROUP

* flag, which is only passed for the former statements, not for the latter. */

if (FLAGS_SET(params->flags, EXEC_CGROUP_DELEGATE) && (FLAGS_SET(params->flags, EXEC_CONTROL_CGROUP) || c->delegate_subgroup)) {

if (FLAGS_SET(params->flags, EXEC_IS_CONTROL))

subgroup = ".control";

else

subgroup = c->delegate_subgroup;

}

if (subgroup)

p = path_join(params->cgroup_path, subgroup);

else

p = strdup(params->cgroup_path);

if (!p)

return -ENOMEM;

*ret = p;

return !!subgroup;

}

bool exec_context_get_cpu_affinity_from_numa(const ExecContext *c) {

assert(c);

return c->cpu_affinity_from_numa;

}

static void log_command_line(Unit *unit, const char *msg, const char *executable, char **argv) {

assert(unit);

assert(msg);

assert(executable);

if (!DEBUG_LOGGING)

return;

_cleanup_free_ char *cmdline = quote_command_line(argv, SHELL_ESCAPE_EMPTY);

log_unit_struct(unit, LOG_DEBUG,

"EXECUTABLE=%s", executable,

LOG_UNIT_MESSAGE(unit, "%s: %s", msg, strnull(cmdline)),

LOG_UNIT_INVOCATION_ID(unit));

}

static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***l);

int exec_spawn(Unit *unit,

ExecCommand *command,

const ExecContext *context,

ExecParameters *params,

ExecRuntime *runtime,

const CGroupContext *cgroup_context,

pid_t *ret) {

char serialization_fd_number[DECIMAL_STR_MAX(int) + 1];

_cleanup_free_ char *subcgroup_path = NULL, *log_level = NULL, *executor_path = NULL;

_cleanup_fdset_free_ FDSet *fdset = NULL;

_cleanup_fclose_ FILE *f = NULL;

pid_t pid;

int r;

assert(unit);

assert(unit->manager);

assert(unit->manager->executor_fd >= 0);

assert(command);

assert(context);

assert(ret);

assert(params);

assert(params->fds || (params->n_socket_fds + params->n_storage_fds <= 0));

assert(!params->files_env); /* We fill this field, ensure it comes NULL-initialized to us */

LOG_CONTEXT_PUSH_UNIT(unit);

r = exec_context_load_environment(unit, context, &params->files_env);

if (r < 0)

return log_unit_error_errno(unit, r, "Failed to load environment files: %m");

/* Fork with up-to-date SELinux label database, so the child inherits the up-to-date db

and, until the next SELinux policy changes, we save further reloads in future children. */

mac_selinux_maybe_reload();

/* We won't know the real executable path until we create the mount namespace in the child, but we

want to log from the parent, so we use the possibly inaccurate path here. */

log_command_line(unit, "About to execute", command->path, command->argv);

if (params->cgroup_path) {

r = exec_params_get_cgroup_path(params, cgroup_context, &subcgroup_path);

if (r < 0)

return log_unit_error_errno(unit, r, "Failed to acquire subcgroup path: %m");

if (r > 0) {

/* If there's a subcgroup, then let's create it here now (the main cgroup was already

* realized by the unit logic) */

r = cg_create(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path);

if (r < 0)

return log_unit_error_errno(unit, r, "Failed to create subcgroup '%s': %m", subcgroup_path);

}

}

/* In order to avoid copy-on-write traps and OOM-kills when pid1's memory.current is above the

* child's memory.max, serialize all the state needed to start the unit, and pass it to the

* systemd-executor binary. clone() with CLONE_VM + CLONE_VFORK will pause the parent until the exec

* and ensure all memory is shared. The child immediately execs the new binary so the delay should

* be minimal. Once glibc provides a clone3 wrapper we can switch to that, and clone directly in the

* target cgroup. */

r = open_serialization_file("sd-executor-state", &f);

if (r < 0)

return log_unit_error_errno(unit, r, "Failed to open serialization stream: %m");

fdset = fdset_new();

if (!fdset)

return log_oom();

r = exec_serialize_invocation(f, fdset, context, command, params, runtime, cgroup_context);

if (r < 0)

return log_unit_error_errno(unit, r, "Failed to serialize parameters: %m");

if (fseeko(f, 0, SEEK_SET) < 0)

return log_unit_error_errno(unit, errno, "Failed to reseek on serialization stream: %m");

r = fd_cloexec(fileno(f), false);

if (r < 0)

return log_unit_error_errno(unit, r, "Failed to set O_CLOEXEC on serialization fd: %m");

r = fdset_cloexec(fdset, false);

if (r < 0)

return log_unit_error_errno(unit, r, "Failed to set O_CLOEXEC on serialized fds: %m");

r = log_level_to_string_alloc(log_get_max_level(), &log_level);

if (r < 0)

return log_unit_error_errno(unit, r, "Failed to convert log level to string: %m");

r = fd_get_path(unit->manager->executor_fd, &executor_path);

if (r < 0)

return log_unit_error_errno(unit, r, "Failed to get executor path from fd: %m");

xsprintf(serialization_fd_number, "%i", fileno(f));

/* The executor binary is pinned, to avoid compatibility problems during upgrades. */

r = posix_spawn_wrapper(

FORMAT_PROC_FD_PATH(unit->manager->executor_fd),

STRV_MAKE(executor_path,

"--deserialize", serialization_fd_number,

"--log-level", log_level,

"--log-target", log_target_to_string(manager_get_executor_log_target(unit->manager))),

environ,

&pid);

if (r < 0)

return log_unit_error_errno(unit, r, "Failed to spawn executor: %m");

log_unit_debug(unit, "Forked %s as "PID_FMT, command->path, pid);

/* We add the new process to the cgroup both in the child (so that we can be sure that no user code is ever

* executed outside of the cgroup) and in the parent (so that we can be sure that when we kill the cgroup the

* process will be killed too). */

if (subcgroup_path)

(void) cg_attach(SYSTEMD_CGROUP_CONTROLLER, subcgroup_path, pid);

exec_status_start(&command->exec_status, pid);

*ret = pid;

return 0;

}

void exec_context_init(ExecContext *c) {

assert(c);

/* When initializing a bool member to 'true', make sure to serialize in execute-serialize.c using

* serialize_bool() instead of serialize_bool_elide(). */

*c = (ExecContext) {

.umask = 0022,

.ioprio = IOPRIO_DEFAULT_CLASS_AND_PRIO,

.cpu_sched_policy = SCHED_OTHER,

.syslog_priority = LOG_DAEMON|LOG_INFO,

.syslog_level_prefix = true,

.ignore_sigpipe = true,

.timer_slack_nsec = NSEC_INFINITY,

.personality = PERSONALITY_INVALID,

.timeout_clean_usec = USEC_INFINITY,

.capability_bounding_set = CAP_MASK_UNSET,

.restrict_namespaces = NAMESPACE_FLAGS_INITIAL,

.log_level_max = -1,

#if HAVE_SECCOMP

.syscall_errno = SECCOMP_ERROR_NUMBER_KILL,

#endif

.tty_rows = UINT_MAX,

.tty_cols = UINT_MAX,

.private_mounts = -1,

.memory_ksm = -1,

.set_login_environment = -1,

};

FOREACH_ARRAY(d, c->directories, _EXEC_DIRECTORY_TYPE_MAX)

d->mode = 0755;

numa_policy_reset(&c->numa_policy);

assert_cc(NAMESPACE_FLAGS_INITIAL != NAMESPACE_FLAGS_ALL);

}

void exec_context_done(ExecContext *c) {

assert(c);

c->environment = strv_free(c->environment);

c->environment_files = strv_free(c->environment_files);

c->pass_environment = strv_free(c->pass_environment);

c->unset_environment = strv_free(c->unset_environment);

rlimit_free_all(c->rlimit);

for (size_t l = 0; l < 3; l++) {

c->stdio_fdname[l] = mfree(c->stdio_fdname[l]);

c->stdio_file[l] = mfree(c->stdio_file[l]);

}

c->working_directory = mfree(c->working_directory);

c->root_directory = mfree(c->root_directory);

c->root_image = mfree(c->root_image);

c->root_image_options = mount_options_free_all(c->root_image_options);

c->root_hash = mfree(c->root_hash);

c->root_hash_size = 0;

c->root_hash_path = mfree(c->root_hash_path);

c->root_hash_sig = mfree(c->root_hash_sig);

c->root_hash_sig_size = 0;

c->root_hash_sig_path = mfree(c->root_hash_sig_path);

c->root_verity = mfree(c->root_verity);

c->extension_images = mount_image_free_many(c->extension_images, &c->n_extension_images);

c->extension_directories = strv_free(c->extension_directories);

c->tty_path = mfree(c->tty_path);

c->syslog_identifier = mfree(c->syslog_identifier);

c->user = mfree(c->user);

c->group = mfree(c->group);

c->supplementary_groups = strv_free(c->supplementary_groups);

c->pam_name = mfree(c->pam_name);

c->read_only_paths = strv_free(c->read_only_paths);

c->read_write_paths = strv_free(c->read_write_paths);

c->inaccessible_paths = strv_free(c->inaccessible_paths);

c->exec_paths = strv_free(c->exec_paths);

c->no_exec_paths = strv_free(c->no_exec_paths);

c->exec_search_path = strv_free(c->exec_search_path);

bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);

c->bind_mounts = NULL;

c->n_bind_mounts = 0;

temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);

c->temporary_filesystems = NULL;

c->n_temporary_filesystems = 0;

c->mount_images = mount_image_free_many(c->mount_images, &c->n_mount_images);

cpu_set_reset(&c->cpu_set);

numa_policy_reset(&c->numa_policy);

c->utmp_id = mfree(c->utmp_id);

c->selinux_context = mfree(c->selinux_context);

c->apparmor_profile = mfree(c->apparmor_profile);

c->smack_process_label = mfree(c->smack_process_label);

c->restrict_filesystems = set_free_free(c->restrict_filesystems);

c->syscall_filter = hashmap_free(c->syscall_filter);

c->syscall_archs = set_free(c->syscall_archs);

c->address_families = set_free(c->address_families);

FOREACH_ARRAY(d, c->directories, _EXEC_DIRECTORY_TYPE_MAX)

exec_directory_done(d);

c->log_level_max = -1;

exec_context_free_log_extra_fields(c);

c->log_filter_allowed_patterns = set_free_free(c->log_filter_allowed_patterns);

c->log_filter_denied_patterns = set_free_free(c->log_filter_denied_patterns);

c->log_ratelimit_interval_usec = 0;

c->log_ratelimit_burst = 0;

c->stdin_data = mfree(c->stdin_data);

c->stdin_data_size = 0;

c->network_namespace_path = mfree(c->network_namespace_path);

c->ipc_namespace_path = mfree(c->ipc_namespace_path);

c->log_namespace = mfree(c->log_namespace);

c->load_credentials = hashmap_free(c->load_credentials);

c->set_credentials = hashmap_free(c->set_credentials);

c->import_credentials = set_free_free(c->import_credentials);

c->root_image_policy = image_policy_free(c->root_image_policy);

c->mount_image_policy = image_policy_free(c->mount_image_policy);

c->extension_image_policy = image_policy_free(c->extension_image_policy);

}

int exec_context_destroy_runtime_directory(const ExecContext *c, const char *runtime_prefix) {

assert(c);

if (!runtime_prefix)

return 0;

FOREACH_ARRAY(i, c->directories[EXEC_DIRECTORY_RUNTIME].items, c->directories[EXEC_DIRECTORY_RUNTIME].n_items) {

_cleanup_free_ char *p = NULL;

if (exec_directory_is_private(c, EXEC_DIRECTORY_RUNTIME))

p = path_join(runtime_prefix, "private", i->path);

else

p = path_join(runtime_prefix, i->path);

if (!p)

return -ENOMEM;

/* We execute this synchronously, since we need to be sure this is gone when we start the

* service next. */

(void) rm_rf(p, REMOVE_ROOT);

STRV_FOREACH(symlink, i->symlinks) {

_cleanup_free_ char *symlink_abs = NULL;

if (exec_directory_is_private(c, EXEC_DIRECTORY_RUNTIME))

symlink_abs = path_join(runtime_prefix, "private", *symlink);

else

symlink_abs = path_join(runtime_prefix, *symlink);

if (!symlink_abs)

return -ENOMEM;

(void) unlink(symlink_abs);

}

}

return 0;

}

int exec_context_destroy_mount_ns_dir(Unit *u) {

_cleanup_free_ char *p = NULL;

if (!u || !MANAGER_IS_SYSTEM(u->manager))

return 0;

p = path_join("/run/systemd/propagate/", u->id);

if (!p)

return -ENOMEM;

/* This is only filled transiently (see mount_in_namespace()), should be empty or even non-existent*/

if (rmdir(p) < 0 && errno != ENOENT)

log_unit_debug_errno(u, errno, "Unable to remove propagation dir '%s', ignoring: %m", p);

return 0;

}

void exec_command_done(ExecCommand *c) {

assert(c);

c->path = mfree(c->path);

c->argv = strv_free(c->argv);

}

void exec_command_done_array(ExecCommand *c, size_t n) {

FOREACH_ARRAY(i, c, n)

exec_command_done(i);

}

ExecCommand* exec_command_free_list(ExecCommand *c) {

ExecCommand *i;

while ((i = LIST_POP(command, c))) {

exec_command_done(i);

free(i);

}

return NULL;

}

void exec_command_free_array(ExecCommand **c, size_t n) {

FOREACH_ARRAY(i, c, n)

*i = exec_command_free_list(*i);

}

void exec_command_reset_status_array(ExecCommand *c, size_t n) {

FOREACH_ARRAY(i, c, n)

exec_status_reset(&i->exec_status);

}

void exec_command_reset_status_list_array(ExecCommand **c, size_t n) {

FOREACH_ARRAY(i, c, n)

LIST_FOREACH(command, z, *i)

exec_status_reset(&z->exec_status);

}

typedef struct InvalidEnvInfo {

const Unit *unit;

const char *path;

} InvalidEnvInfo;

static void invalid_env(const char *p, void *userdata) {

InvalidEnvInfo *info = userdata;

log_unit_error(info->unit, "Ignoring invalid environment assignment '%s': %s", p, info->path);

}

const char* exec_context_fdname(const ExecContext *c, int fd_index) {

assert(c);

switch (fd_index) {

case STDIN_FILENO:

if (c->std_input != EXEC_INPUT_NAMED_FD)

return NULL;

return c->stdio_fdname[STDIN_FILENO] ?: "stdin";

case STDOUT_FILENO:

if (c->std_output != EXEC_OUTPUT_NAMED_FD)

return NULL;

return c->stdio_fdname[STDOUT_FILENO] ?: "stdout";

case STDERR_FILENO:

if (c->std_error != EXEC_OUTPUT_NAMED_FD)

return NULL;

return c->stdio_fdname[STDERR_FILENO] ?: "stderr";

default:

return NULL;

}

}

static int exec_context_load_environment(const Unit *unit, const ExecContext *c, char ***ret) {

_cleanup_strv_free_ char **v = NULL;

int r;

assert(c);

assert(ret);

STRV_FOREACH(i, c->environment_files) {

_cleanup_globfree_ glob_t pglob = {};

bool ignore = false;

char *fn = *i;

if (fn[0] == '-') {

ignore = true;

fn++;

}

if (!path_is_absolute(fn)) {

if (ignore)

continue;

return -EINVAL;

}

/* Filename supports globbing, take all matching files */

r = safe_glob(fn, 0, &pglob);

if (r < 0) {

if (ignore)

continue;

return r;

}

/* When we don't match anything, -ENOENT should be returned */

assert(pglob.gl_pathc > 0);

FOREACH_ARRAY(path, pglob.gl_pathv, pglob.gl_pathc) {

_cleanup_strv_free_ char **p = NULL;

r = load_env_file(NULL, *path, &p);

if (r < 0) {

if (ignore)

continue;

return r;

}

/* Log invalid environment variables with filename */

if (p) {

InvalidEnvInfo info = {

.unit = unit,

.path = *path,

};

p = strv_env_clean_with_callback(p, invalid_env, &info);

}

if (!v)

v = TAKE_PTR(p);

else {

char **m = strv_env_merge(v, p);

if (!m)

return -ENOMEM;

strv_free_and_replace(v, m);

}

}

}

*ret = TAKE_PTR(v);

return 0;

}

static bool tty_may_match_dev_console(const char *tty) {

_cleanup_free_ char *resolved = NULL;

if (!tty)

return true;

tty = skip_dev_prefix(tty);

/* trivial identity? */

if (streq(tty, "console"))

return true;

if (resolve_dev_console(&resolved) < 0)

return true; /* if we could not resolve, assume it may */

/* "tty0" means the active VC, so it may be the same sometimes */

return path_equal(resolved, tty) || (streq(resolved, "tty0") && tty_is_vc(tty));

}

static bool exec_context_may_touch_tty(const ExecContext *ec) {

assert(ec);

return ec->tty_reset ||

ec->tty_vhangup ||

ec->tty_vt_disallocate ||

is_terminal_input(ec->std_input) ||

is_terminal_output(ec->std_output) ||

is_terminal_output(ec->std_error);

}

bool exec_context_may_touch_console(const ExecContext *ec) {

return exec_context_may_touch_tty(ec) &&

tty_may_match_dev_console(exec_context_tty_path(ec));

}

static void strv_fprintf(FILE *f, char **l) {

assert(f);

STRV_FOREACH(g, l)

fprintf(f, " %s", *g);

}

static void strv_dump(FILE* f, const char *prefix, const char *name, char **strv) {

assert(f);

assert(prefix);

assert(name);

if (!strv_isempty(strv)) {

fprintf(f, "%s%s:", prefix, name);

strv_fprintf(f, strv);

fputs("\n", f);

}

}

void exec_params_dump(const ExecParameters *p, FILE* f, const char *prefix) {

assert(p);

assert(f);

prefix = strempty(prefix);

fprintf(f,

"%sRuntimeScope: %s\n"

"%sExecFlags: %u\n"

"%sSELinuxContextNetwork: %s\n"

"%sCgroupSupportedMask: %u\n"

"%sCgroupPath: %s\n"

"%sCrededentialsDirectory: %s\n"

"%sEncryptedCredentialsDirectory: %s\n"

"%sConfirmSpawn: %s\n"

"%sShallConfirmSpawn: %s\n"

"%sWatchdogUSec: " USEC_FMT "\n"

"%sNotifySocket: %s\n"

"%sFallbackSmackProcessLabel: %s\n",

prefix, runtime_scope_to_string(p->runtime_scope),

prefix, p->flags,

prefix, yes_no(p->selinux_context_net),

prefix, p->cgroup_supported,

prefix, p->cgroup_path,

prefix, strempty(p->received_credentials_directory),

prefix, strempty(p->received_encrypted_credentials_directory),

prefix, strempty(p->confirm_spawn),

prefix, yes_no(p->shall_confirm_spawn),

prefix, p->watchdog_usec,

prefix, strempty(p->notify_socket),

prefix, strempty(p->fallback_smack_process_label));

strv_dump(f, prefix, "FdNames", p->fd_names);

strv_dump(f, prefix, "Environment", p->environment);

strv_dump(f, prefix, "Prefix", p->prefix);

LIST_FOREACH(open_files, file, p->open_files)

fprintf(f, "%sOpenFile: %s %s", prefix, file->path, open_file_flags_to_string(file->flags));

strv_dump(f, prefix, "FilesEnv", p->files_env);

}

void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {

int r;

assert(c);

assert(f);

prefix = strempty(prefix);

fprintf(f,

"%sUMask: %04o\n"

"%sWorkingDirectory: %s\n"

"%sRootDirectory: %s\n"

"%sRootEphemeral: %s\n"

"%sNonBlocking: %s\n"

"%sPrivateTmp: %s\n"

"%sPrivateDevices: %s\n"

"%sProtectKernelTunables: %s\n"

"%sProtectKernelModules: %s\n"

"%sProtectKernelLogs: %s\n"

"%sProtectClock: %s\n"

"%sProtectControlGroups: %s\n"

"%sPrivateNetwork: %s\n"

"%sPrivateUsers: %s\n"

"%sProtectHome: %s\n"

"%sProtectSystem: %s\n"

"%sMountAPIVFS: %s\n"

"%sIgnoreSIGPIPE: %s\n"

"%sMemoryDenyWriteExecute: %s\n"

"%sRestrictRealtime: %s\n"

"%sRestrictSUIDSGID: %s\n"

"%sKeyringMode: %s\n"

"%sProtectHostname: %s\n"

"%sProtectProc: %s\n"

"%sProcSubset: %s\n",

prefix, c->umask,

prefix, empty_to_root(c->working_directory),

prefix, empty_to_root(c->root_directory),

prefix, yes_no(c->root_ephemeral),

prefix, yes_no(c->non_blocking),

prefix, yes_no(c->private_tmp),

prefix, yes_no(c->private_devices),

prefix, yes_no(c->protect_kernel_tunables),

prefix, yes_no(c->protect_kernel_modules),

prefix, yes_no(c->protect_kernel_logs),

prefix, yes_no(c->protect_clock),

prefix, yes_no(c->protect_control_groups),

prefix, yes_no(c->private_network),

prefix, yes_no(c->private_users),

prefix, protect_home_to_string(c->protect_home),

prefix, protect_system_to_string(c->protect_system),

prefix, yes_no(exec_context_get_effective_mount_apivfs(c)),

prefix, yes_no(c->ignore_sigpipe),

prefix, yes_no(c->memory_deny_write_execute),

prefix, yes_no(c->restrict_realtime),

prefix, yes_no(c->restrict_suid_sgid),

prefix, exec_keyring_mode_to_string(c->keyring_mode),

prefix, yes_no(c->protect_hostname),

prefix, protect_proc_to_string(c->protect_proc),

prefix, proc_subset_to_string(c->proc_subset));

if (c->set_login_environment >= 0)

fprintf(f, "%sSetLoginEnvironment: %s\n", prefix, yes_no(c->set_login_environment > 0));

if (c->root_image)

fprintf(f, "%sRootImage: %s\n", prefix, c->root_image);

if (c->root_image_options) {

fprintf(f, "%sRootImageOptions:", prefix);

LIST_FOREACH(mount_options, o, c->root_image_options)

if (!isempty(o->options))

fprintf(f, " %s:%s",

partition_designator_to_string(o->partition_designator),

o->options);

fprintf(f, "\n");

}

if (c->root_hash) {

_cleanup_free_ char *encoded = NULL;

encoded = hexmem(c->root_hash, c->root_hash_size);

if (encoded)

fprintf(f, "%sRootHash: %s\n", prefix, encoded);

}

if (c->root_hash_path)

fprintf(f, "%sRootHash: %s\n", prefix, c->root_hash_path);

if (c->root_hash_sig) {

_cleanup_free_ char *encoded = NULL;

ssize_t len;

len = base64mem(c->root_hash_sig, c->root_hash_sig_size, &encoded);

if (len)

fprintf(f, "%sRootHashSignature: base64:%s\n", prefix, encoded);

}

if (c->root_hash_sig_path)

fprintf(f, "%sRootHashSignature: %s\n", prefix, c->root_hash_sig_path);