summaryrefslogtreecommitdiffstats
path: root/src/core/dynamic-user.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Drop support for nscdZbigniew Jędrzejewski-Szmek2024-06-281-19/+5
| | | | | | | | | | | | | nscd is known to be racy [1] and it was already deprecated and later dropped in Fedora a while back [1,2]. We don't need to support obsolete stuff in systemd, and the cache in systemd-resolved provides a better solution anyway. We announced the plan to drop nscd in d44934f3785ad9ca4aab757beb80a9b11ba4bc04. [1] https://fedoraproject.org/wiki/Changes/DeprecateNSCD [2] https://fedoraproject.org/wiki/Changes/RemoveNSCD The option is kept as a stub without any effect to make the transition easier.
* core: silence gcc warning about unitialized variableZbigniew Jędrzejewski-Szmek2024-04-071-1/+3
| | | | | | | | | | | | | | | | | | | | | | | When compiled with -O2, the compiler is not happy about dynamic_user_pop() and would warn about the output variables not being set. It does have a point: we were doing a cast from ssize_t to int, and theoretically there could be wraparound. So let's add an explicit check that the cast to int is fine. [540/2509] Compiling C object src/core/libsystemd-core-256.so.p/dynamic-user.c.o ../src/core/dynamic-user.c: In function ‘dynamic_user_close.isra’: ../src/core/dynamic-user.c:580:9: warning: ‘uid’ may be used uninitialized [-Wmaybe-uninitialized] 580 | unlink_uid_lock(lock_fd, uid, d->name); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../src/core/dynamic-user.c:560:15: note: ‘uid’ was declared here 560 | uid_t uid; | ^~~ ../src/core/dynamic-user.c: In function ‘dynamic_user_realize’: ../src/core/dynamic-user.c:476:29: warning: ‘new_uid’ may be used uninitialized [-Wmaybe-uninitialized] 476 | num = new_uid; | ~~~~^~~~~~~~~ ../src/core/dynamic-user.c:398:23: note: ‘new_uid’ was declared here 398 | uid_t new_uid; | ^~~~~~~
* core/dynamic-user: trivial modernizationMike Yuan2024-03-221-12/+4
|
* extract-word: modernize extract_many_wordsMike Yuan2024-03-031-1/+1
|
* user-util: add get{pw,gr}{uid,gid,name}_malloc() helpersLennart Poettering2024-01-221-17/+12
| | | | | | | | | | | | | | | | | | | These are wrappers around getpwuid_r() and friends, and will allocate the right-sized buffer for this call. We so far had multiple implementations of a buffer allocation loop around getpwuid_r() and friends, and they all suck in some way. Let's clean this up and add a common implementation, and use it everywhere. Also, be more careful with error numbers, in particular systematically turn ENOENT into ENOSRCH (the former is what is returned if /etc/passwd is absent, which we want to consider identical to user not existing, which is ENOSRCH). We so far did this at some invocations, but not all. There are some invocations of getpwuid() left in the codebase. We really should fix those too, and have a single unified implementation of the logic, but those are not as trivial to convert, so left for another time.
* src/basic: rename uid-alloc-range.[ch] to uid-classification.[ch]Zbigniew Jędrzejewski-Szmek2024-01-091-1/+1
| | | | | | | | | We had both uid-range.h and uid-alloc-range.h. The latter now contains helpers like {uid,gid}_is_{system,dynamic,container}(), uid_for_system_journal(), so the existing name is outdated. I think the uid-range.[ch] should stay separate because it has a bunch of helpers for parsing and printing of uid ranges. So let's rename as in $subject to better reflect the contents of the file and make the two sets of files harder to confuse.
* exec-invoke: don't double-close FDs on errorLuca Boccassi2023-10-281-0/+11
| | | | | | | | | | When a late error occurs in sd-executor, the cleanup-on-close of the context structs happen, but at that time all FDs might have already been closed via close_all_fds(), so a double-close happens. This can be seen when DynamicUser is enabled, with a non-existing WorkingDirectory. Invalidate the FDs in the context structs if close_all_fds succeeds.
* fd-uitl: rename PIPE_EBADF → EBADF_PAIR, and add EBADF_TRIPLETLennart Poettering2023-10-261-1/+1
| | | | | | | | We use it for more than just pipe() arrays. For example also for socketpair(). Hence let's give it a generic name. Also add EBADF_TRIPLET to mirror this for things like stdin/stdout/stderr arrays, which we use a bunch of times.
* io-util: split out "struct iovec" related calls into their own .c/.h filesLennart Poettering2023-10-201-1/+1
| | | | | | | | | This is preparation for #28891, which adds a bunch more helpers around "struct iovec", at which point this really deserves its own .c/.h file. The idea is that we sooner or later can consider "struct iovec" as an entirely generic mechanism to reference some binary blob, and is the go-to type for this purpose whenever we need one.
* serialize: add new helper deserialize_fd()Lennart Poettering2023-10-181-9/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently, when we deserialize an fd we do a lot of manual work. Add a common helper that makes this more robust and uniform. Note that this sometimes changes behaviour slightly, but in ways that shouldn't really matter: if we fail to deserialize an fd correctly we'll unset (i.e. set to -EBADF) the fd in the deserialized data structure. Previously, we'd leave the old value in place. This should not change effective result (as in either case we'll be in a bad state afterwards, just once we mix old/invalidated state with new state, while now we'll reset the state explicitly to invalidated state on failure). In particular as deserialization starts from an empty structure generally, hence the old value should be unset anyway. Another slight change is that if we fail to deserialize some object half way, and we already have taken out one fd from the serialized fdset we'll now just close it instead of returning it to/leaving it in the fdset. Given that such "orphaned" fds are blanket closed after deserialization finishes this also shouldn't change behaviour IRL. Also, the idle_pipe was previously incorrectly serialized: we'd serialize invalidated fds, which would fail, but because parsing errors on this were ignored on the deserializatin noone noticed. This is fixed.
* core: add systemd-executor binaryLuca Boccassi2023-10-121-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we spawn services by forking a child process, doing a bunch of work, and then exec'ing the service executable. There are some advantages to this approach: - quick: we immediately have access to all the enourmous amount of state simply by virtue of sharing the memory with the parent - easy to refactor and add features - part of the same binary, will never be out of sync There are however significant drawbacks: - doing work after fork and before exec is against glibc's supported case for several APIs we call - copy-on-write trap: anytime any memory is touched in either parent or child, a copy of that page will be triggered - memory footprint of the child process will be memory footprint of PID1, but using the cgroup memory limits of the unit The last issue is especially problematic on resource constrained systems where hard memory caps are enforced and swap is not allowed. As soon as PID1 is under load, with no page out due to no swap, and a service with a low MemoryMax= tries to start, hilarity ensues. Add a new systemd-executor binary, that is able to receive all the required state via memfd, deserialize it, prepare the appropriate data structures and call exec_child. Use posix_spawn which uses CLONE_VM + CLONE_VFORK, to ensure there is no copy-on-write (same address space will be used, and parent process will be frozen, until exec). The sd-executor binary is pinned by FD on startup, so that we can guarantee there will be no incompatibilities during upgrades.
* core: ensure execute/spawn functions can work without manager objectLuca Boccassi2023-10-121-26/+45
| | | | | When switching to serialization later, the Manager object will not be serialized, move parameters around instead
* tree-wide: use parse_fd()David Tardon2023-05-051-2/+2
|
* core: Move DynamicCreds into ExecRuntimeDaan De Meyer2023-03-271-18/+33
| | | | | This is just another piece of runtime data so let's store it in ExecRuntime alongside the other runtime data.
* dynamic-user: Revert back to using POSIX locksDaan De Meyer2023-03-131-8/+8
| | | | | | unposix locks are shared between child and parent after fork() which is precisely what we don't want in this case so revert back to POSIX locks which are not shared between parent and child.
* lock-util: Add CLEANUP_UNPOSIX_UNLOCK()Daan De Meyer2023-03-101-22/+14
| | | | | Also migrate the logic in dynamic-user.c to use the new cleanup macro.
* tree-wide: replace IOVEC_INIT with IOVEC_MAKEYu Watanabe2023-03-061-4/+4
| | | | | | | | We use gnu11 to build, hence we can use structured initializer with casting, and it is not necessary to use different patterns on initialization and assignment. Addresses https://github.com/systemd/systemd/pull/26560#discussion_r1118875447.
* tree-wide: use -EBADF moreYu Watanabe2022-12-201-4/+4
|
* tree-wide: introduce PIPE_EBADF macroYu Watanabe2022-12-201-1/+1
|
* tree-wide: use -EBADF also in pipe initializersZbigniew Jędrzejewski-Szmek2022-12-191-1/+1
| | | | In some places, initialization is dropped when unnecesary.
* tree-wide: use -EBADF for fd initializationZbigniew Jędrzejewski-Szmek2022-12-191-6/+6
| | | | | | | | | | | | | | | | -1 was used everywhere, but -EBADF or -EBADFD started being used in various places. Let's make things consistent in the new style. Note that there are two candidates: EBADF 9 Bad file descriptor EBADFD 77 File descriptor in bad state Since we're initializating the fd, we're just assigning a value that means "no fd yet", so it's just a bad file descriptor, and the first errno fits better. If instead we had a valid file descriptor that became invalid because of some operation or state change, the other errno would fit better. In some places, initialization is dropped if unnecessary.
* various: indentationZbigniew Jędrzejewski-Szmek2022-06-091-8/+9
|
* shared: split out UID allocation range stuff from user-record.hLennart Poettering2021-11-131-1/+1
| | | | | | | | user-record.[ch] are about the UserRecord JSON stuff, and the UID allocation range stuff (i.e. login.defs handling) is a very different thing, and complex enough on its own, let's give it its own c/h files. No code changes, just some splitting out of code.
* Drop the text argument from assert_not_reached()Zbigniew Jędrzejewski-Szmek2021-08-031-1/+1
| | | | | | | | | | | | | | | | | In general we almost never hit those asserts in production code, so users see them very rarely, if ever. But either way, we just need something that users can pass to the developers. We have quite a few of those asserts, and some have fairly nice messages, but many are like "WTF?" or "???" or "unexpected something". The error that is printed includes the file location, and function name. In almost all functions there's at most one assert, so the function name alone is enough to identify the failure for a developer. So we don't get much extra from the message, and we might just as well drop them. Dropping them makes our code a tiny bit smaller, and most importantly, improves development experience by making it easy to insert such an assert in the code without thinking how to phrase the argument.
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* Move {uid,gid}_is_*() from basic to sharedZbigniew Jędrzejewski-Szmek2020-09-251-0/+1
| | | | | Those are functions that express policy, and nothing in basic/ uses (or should use) them.
* tree-wide: define iterator inside of the macroZbigniew Jędrzejewski-Szmek2020-09-081-4/+2
|
* user-util: rework how we validate user namesLennart Poettering2020-04-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | This reworks the user validation infrastructure. There are now two modes. In regular mode we are strict and test against a strict set of valid chars. And in "relaxed" mode we just filter out some really obvious, dangerous stuff. i.e. strict is whitelisting what is OK, but "relaxed" is blacklisting what is really not OK. The idea is that we use strict mode whenver we allocate a new user (i.e. in sysusers.d or homed), while "relaxed" mode is when we process users registered elsewhere, (i.e. userdb, logind, …) The requirements on user name validity vary wildly. SSSD thinks its fine to embedd "@" for example, while the suggested NAME_REGEX field on Debian does not even allow uppercase chars… This effectively liberaralizes a lot what we expect from usernames. The code that warns about questionnable user names is now optional and only used at places such as unit file parsing, so that it doesn't show up on every userdb query, but only when processing configuration files that know better. Fixes: #15149 #15090
* core: call dynamic_user_acquire() only when 'group' is non-nullYu Watanabe2020-02-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | When unit is reloaded, and the reloaded unit has bad-setting, then unit_patch_contexts() is not called and exec_context::user and group may not be configured. A minimum reproducer for the case is: - step 1. $ sudo systemctl edit --full hoge.service [Service] oneshot ExecStart=sleep 1h - step 2. $ sudo systemctl start hoge.service - step 3. $ sudo systemctl edit --full hoge.service [Service] Type=oneshot ExecStart=@bindir@/sleep 1h DynamicUser=yes Then pid1 crashed. Fixes #14733.
* core: make return parameter of dynamic_user_lookup_name() optionalLennart Poettering2020-01-151-3/+3
|
* tree-wide: drop pwd.h and grp.h when user-util.h is includedYu Watanabe2019-11-031-2/+0
|
* Create src/shared/unit-file.[ch] for unit-file related opsZbigniew Jędrzejewski-Szmek2019-07-191-0/+1
| | | | | So far we put such functinos in install.[ch], but that is tied too closely to enable/disable. Let's start moving things to a place with a better name.
* tree-wide: make use of errno_or_else() everywhereLennart Poettering2019-07-111-1/+1
|
* headers: remove unneeded includes from util.hZbigniew Jędrzejewski-Szmek2019-03-271-0/+3
| | | | | This means we need to include many more headers in various files that simply included util.h before, but it seems cleaner to do it this way.
* Detect file truncation earlier in a few placesTopi Miettinen2019-02-021-1/+1
| | | | | Users of read_one_line_file() for APIVFS entries are ignored as they are assumed to never get truncated.
* tree-wide: use c99 static for array size declarationsZbigniew Jędrzejewski-Szmek2019-01-041-1/+1
| | | | | | | | | | | | | | | | https://hamberg.no/erlend/posts/2013-02-18-static-array-indices.html This only works with clang, unfortunately gcc doesn't seem to implement the check (tested with gcc-8.2.1-5.fc29.x86_64). Simulated error: [2/3] Compiling C object 'systemd-nspawn@exe/src_nspawn_nspawn.c.o'. ../src/nspawn/nspawn.c:3179:45: warning: array argument is too small; contains 15 elements, callee requires at least 16 [-Warray-bounds] candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key); ^ ~~~~~~~~ ../src/basic/siphash24.h:24:64: note: callee declares array parameter as static here uint64_t siphash24(const void *in, size_t inlen, const uint8_t k[static 16]); ^~~~~~~~~~~~
* core: flush nscd's caches whenever we allocate/release a dynamic userLennart Poettering2018-12-151-0/+13
| | | | | | This should make dynamic users and nscd work together better. Fixes: #10740
* core: fix typo in commentZbigniew Jędrzejewski-Szmek2018-12-111-1/+1
|
* core: rework serializationLennart Poettering2018-10-261-3/+4
| | | | | | | | | | | | | | | | | Let's be more careful with what we serialize: let's ensure we never serialize strings that are longer than LONG_LINE_MAX, so that we know we can read them back with read_line(…, LONG_LINE_MAX, …) safely. In order to implement this all serialization functions are move to serialize.[ch], and internally will do line size checks. We'd rather skip a serialization line (with a loud warning) than write an overly long line out. Of course, this is just a second level protection, after all the data we serialize shouldn't be this long in the first place. While we are at it also clean up logging: while serializing make sure to always log about errors immediately. Also, (void)ify all calls we don't expect errors in (or catch errors as part of the general fflush_and_check() at the end.
* dynamic-user: drop unnecessary initializationYu Watanabe2018-08-291-1/+1
|
* dynamic-user: fix potential segfaultYu Watanabe2018-08-271-3/+5
|
* tree-wide: use DEFINE_TRIVIAL_REF_UNREF_FUNC() macro or friends where applicableYu Watanabe2018-08-271-10/+2
|
* socket-util: Introduce send_one_fd_iov() and receive_one_fd_iov()Filipe Brandenburger2018-08-021-53/+4
| | | | | | | | | | These take a struct iovec to send data together with the passed FD. The receive function returns the FD through an output argument. In case data is received, but no FD is passed, the receive function will set the output argument to -1 explicitly. Update code in dynamic-user to use the new helpers.
* core: fix gid when DynamicUser=yes with static User=Yu Watanabe2018-07-261-0/+10
| | | | | | | | | | When DynamicUser=yes and static User= are set, and the user has different uid and gid, then as the storage socket for the dynamic user does not contains gid, we need to obtain gid. Follow-up for 9ec655cbbd7505ef465e0444da0622e46099ce42. Fixes #9702.
* tree-wide: drop MSG_NOSIGNAL flag from recvmsg() invocationsLennart Poettering2018-06-201-1/+1
| | | | | | | | MSG_NOSIGNAL is only defined for sendmsg(), not for recvmsg(), hence let's drop it's use, in particular as it appears to create problems on older kernels. See: https://lists.freedesktop.org/archives/systemd-devel/2018-June/040869.html
* tree-wide: remove Lennart's copyright linesLennart Poettering2018-06-141-3/+0
| | | | | | | | | | | These lines are generally out-of-date, incomplete and unnecessary. With SPDX and git repository much more accurate and fine grained information about licensing and authorship is available, hence let's drop the per-file copyright notice. Of course, removing copyright lines of others is problematic, hence this commit only removes my own lines and leaves all others untouched. It might be nicer if sooner or later those could go away too, making git the only and accurate source of authorship information.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* core: undo the dependency inversion between unit.h and all unit typesFelipe Sateler2018-05-151-0/+1
|
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* macro: introduce new TAKE_FD() macroLennart Poettering2018-03-221-4/+1
| | | | | | | This is similar to TAKE_PTR() but operates on file descriptors, and thus assigns -1 to the fd parameter after returning it. Removes 60 lines from our codebase. Pretty good too I think.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 03:41:55 +0100