[systemd-devel] [PATCH] Prevent crash due to infinite .include loop

[Timothée Ravier]

Hi,

A friend of mine found that with the current configuration system, it is
possible for a unit to include itself thus creating an infinite loop.

This is illustrated by the following example (do not try this at home!):

# cd /etc/systemd/system/
# echo ".include foo.service" > foo.service
# systemctl start foo.service

If I understand correctly, this triggers an infinite loop in the code
parsing configuration files.

This is the simplest case (a unit trying to include itself). There are
other cases that could lead to ".include" loops when multiple files are
involved for example.

I see two ways to fix this problem for good:

* Limit the include depth arbitrarily and fail when reached;
* Remember which files systemd has already parsed and skip those if
found in a ".include" directive.

I'm including a patch that fix the simplest case.

I tested this patch with the 198 release on Arch Linux x86_64.

The patch is based on commit ad88e75.

Cheers,

Timothée Ravier

--

shared: prevent simple ".include " loop in units

Add a check in the configuration parser to prevent units from triggering
infinite loops by recursively including themselves using a ".include"
directive.
---
 src/shared/conf-parser.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/shared/conf-parser.c b/src/shared/conf-parser.c
index b09e90a..f558855 100644
--- a/src/shared/conf-parser.c
+++ b/src/shared/conf-parser.c
@@ -185,6 +185,11 @@ static int parse_line(
                 if (!fn)
                         return -ENOMEM;

+		if (!strcmp(filename, fn)) {
+			log_error("[%s:%u] Recursive .include directive. A unit should not
include itself.", filename, line);
+			return -EBADMSG;
+		}
+
                 r = config_parse(fn, NULL, sections, lookup, table,
relaxed, userdata);
                 free(fn);

-- 
1.8.1.5