[systemd-commits] 6 commits - fixme src/path.c src/service.c src/socket.c src/socket.h src/socket-util.c src/socket-util.h src/timer.c src/unit.c units/var-lock.mount units/var-run.mount
Lennart Poettering
lennart at kemper.freedesktop.org
Fri Jul 16 10:42:37 PDT 2010
fixme | 6 +
src/path.c | 15 +++
src/service.c | 8 ++
src/socket-util.c | 4 +
src/socket-util.h | 1
src/socket.c | 193 +++++++++++++++++++++++++++++++++++++++------------
src/socket.h | 3
src/timer.c | 15 +++
src/unit.c | 18 +++-
units/var-lock.mount | 1
units/var-run.mount | 1
11 files changed, 213 insertions(+), 52 deletions(-)
New commits:
commit b15bdda87046f5e46080fd84fda878cba2da0fc8
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Jul 16 19:42:27 2010 +0200
socket: prepare for proper selinux labelling of sockets
diff --git a/src/socket-util.c b/src/socket-util.c
index e6e3784..442abfe 100644
--- a/src/socket-util.c
+++ b/src/socket-util.c
@@ -305,6 +305,7 @@ int socket_address_listen(
bool free_bind,
mode_t directory_mode,
mode_t socket_mode,
+ /* FIXME SELINUX: pass SELinux context object here */
int *ret) {
int r, fd, one;
@@ -314,6 +315,9 @@ int socket_address_listen(
if ((r = socket_address_verify(a)) < 0)
return r;
+ /* FIXME SELINUX: The socket() here should be done with the
+ * right SELinux context set */
+
if ((fd = socket(socket_address_family(a), a->type | SOCK_NONBLOCK | SOCK_CLOEXEC, 0)) < 0)
return -errno;
diff --git a/src/socket-util.h b/src/socket-util.h
index ae311ea..68c579b 100644
--- a/src/socket-util.h
+++ b/src/socket-util.h
@@ -71,6 +71,7 @@ int socket_address_listen(
bool free_bind,
mode_t directory_mode,
mode_t socket_mode,
+ /* FIXME SELINUX: pass SELinux context object here */
int *ret);
bool socket_address_is(const SocketAddress *a, const char *s, int type);
diff --git a/src/socket.c b/src/socket.c
index 78fc049..257a4e9 100644
--- a/src/socket.c
+++ b/src/socket.c
@@ -129,6 +129,42 @@ static void socket_done(Unit *u) {
}
}
+static int socket_instantiate_service(Socket *s) {
+ char *prefix, *name;
+ int r;
+ Unit *u;
+
+ assert(s);
+
+ /* This fills in s->service if it isn't filled in yet. For
+ * Accept=yes sockets we create the next connection service
+ * here. For Accept=no this is mostly a NOP since the service
+ * is figured out at load time anyway. */
+
+ if (s->service)
+ return 0;
+
+ assert(s->accept);
+
+ if (!(prefix = unit_name_to_prefix(s->meta.id)))
+ return -ENOMEM;
+
+ r = asprintf(&name, "%s@%u.service", prefix, s->n_accepted);
+ free(prefix);
+
+ if (r < 0)
+ return -ENOMEM;
+
+ r = manager_load_unit(s->meta.manager, name, NULL, NULL, &u);
+ free(name);
+
+ if (r < 0)
+ return r;
+
+ s->service = SERVICE(u);
+ return 0;
+}
+
static bool have_non_accept_socket(Socket *s) {
SocketPort *p;
@@ -460,8 +496,7 @@ static int instance_from_socket(int fd, unsigned nr, char **instance) {
b = ntohl(remote.in.sin_addr.s_addr);
if (asprintf(&r,
- "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
- nr,
+ "%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
a >> 24, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF,
ntohs(local.in.sin_port),
b >> 24, (b >> 16) & 0xFF, (b >> 8) & 0xFF, b & 0xFF,
@@ -483,8 +518,7 @@ static int instance_from_socket(int fd, unsigned nr, char **instance) {
*b = remote.in6.sin6_addr.s6_addr+12;
if (asprintf(&r,
- "%u-%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
- nr,
+ "%u.%u.%u.%u:%u-%u.%u.%u.%u:%u",
a[0], a[1], a[2], a[3],
ntohs(local.in6.sin6_port),
b[0], b[1], b[2], b[3],
@@ -494,8 +528,7 @@ static int instance_from_socket(int fd, unsigned nr, char **instance) {
char a[INET6_ADDRSTRLEN], b[INET6_ADDRSTRLEN];
if (asprintf(&r,
- "%u-%s:%u-%s:%u",
- nr,
+ "%s:%u-%s:%u",
inet_ntop(AF_INET6, &local.in6.sin6_addr, a, sizeof(a)),
ntohs(local.in6.sin6_port),
inet_ntop(AF_INET6, &remote.in6.sin6_addr, b, sizeof(b)),
@@ -600,7 +633,7 @@ static void socket_apply_socket_options(Socket *s, int fd) {
}
}
-static void socket_apply_pipe_options(Socket *s, int fd) {
+static void socket_apply_fifo_options(Socket *s, int fd) {
assert(s);
assert(fd >= 0);
@@ -609,12 +642,90 @@ static void socket_apply_pipe_options(Socket *s, int fd) {
log_warning("F_SETPIPE_SZ: %m");
}
+static int fifo_address_create(
+ const char *path,
+ mode_t directory_mode,
+ mode_t socket_mode,
+ /* FIXME SELINUX: pass SELinux context object here */
+ int *_fd) {
+
+ int fd = -1, r;
+ struct stat st;
+ mode_t old_mask;
+
+ assert(path);
+ assert(_fd);
+
+ mkdir_parents(path, directory_mode);
+
+ /* FIXME SELINUX: The mkfifo here should be done with
+ * the right SELinux context set */
+
+ /* Enforce the right access mode for the fifo */
+ old_mask = umask(~ socket_mode);
+
+ /* Include the original umask in our mask */
+ umask(~socket_mode | old_mask);
+
+ r = mkfifo(path, socket_mode);
+ umask(old_mask);
+
+ if (r < 0) {
+ r = -errno;
+ goto fail;
+ }
+
+ if ((fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW)) < 0) {
+ r = -errno;
+ goto fail;
+ }
+
+ if (fstat(fd, &st) < 0) {
+ r = -errno;
+ goto fail;
+ }
+
+ if (!S_ISFIFO(st.st_mode) ||
+ st.st_mode != (socket_mode & ~old_mask) ||
+ st.st_uid != getuid() ||
+ st.st_gid != getgid()) {
+
+ r = -EEXIST;
+ goto fail;
+ }
+
+ *_fd = fd;
+ return 0;
+
+fail:
+ if (fd >= 0)
+ close_nointr_nofail(fd);
+
+ return r;
+}
+
static int socket_open_fds(Socket *s) {
SocketPort *p;
int r;
assert(s);
+ /* FIXME SELINUX: Somewhere here we must set the the SELinux
+ context for the created sockets and FIFOs. To figure out
+ the executable name for this, use
+ socket_instantiate_service() and then access the executable
+ path name via
+ s->service->exec_command[SERVICE_EXEC_START]->path. Example:
+
+ if ((r = socket_instantiate_service(s)) < 0)
+ return r;
+
+ log_debug("Socket unit %s will spawn service unit %s with executable path %s.",
+ s->meta.id,
+ s->service->meta.id,
+ s->service->exec_command[SERVICE_EXEC_START]->path);
+ */
+
LIST_FOREACH(port, p, s->ports) {
if (p->fd >= 0)
@@ -630,41 +741,26 @@ static int socket_open_fds(Socket *s) {
s->free_bind,
s->directory_mode,
s->socket_mode,
+ /* FIXME SELINUX: Pass the SELinux context object here */
&p->fd)) < 0)
goto rollback;
socket_apply_socket_options(s, p->fd);
- } else {
- struct stat st;
- assert(p->type == SOCKET_FIFO);
-
- mkdir_parents(p->path, s->directory_mode);
-
- if (mkfifo(p->path, s->socket_mode) < 0 && errno != EEXIST) {
- r = -errno;
- goto rollback;
- }
-
- if ((p->fd = open(p->path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW)) < 0) {
- r = -errno;
- goto rollback;
- }
+ } else if (p->type == SOCKET_FIFO) {
- if (fstat(p->fd, &st) < 0) {
- r = -errno;
+ if ((r = fifo_address_create(
+ p->path,
+ s->directory_mode,
+ s->socket_mode,
+ /* FIXME SELINUX: Pass the SELinux context object here */
+ &p->fd)) < 0)
goto rollback;
- }
- /* FIXME verify user, access mode */
+ socket_apply_fifo_options(s, p->fd);
- if (!S_ISFIFO(st.st_mode)) {
- r = -EEXIST;
- goto rollback;
- }
-
- socket_apply_pipe_options(s, p->fd);
- }
+ } else
+ assert_not_reached("Unknown port type");
}
return 0;
@@ -1059,8 +1155,8 @@ static void socket_enter_running(Socket *s, int cfd) {
socket_set_state(s, SOCKET_RUNNING);
} else {
- Unit *u;
char *prefix, *instance = NULL, *name;
+ Service *service;
if (s->n_connections >= s->max_connections) {
log_warning("Too many incoming connections (%u)", s->n_connections);
@@ -1068,7 +1164,10 @@ static void socket_enter_running(Socket *s, int cfd) {
return;
}
- if ((r = instance_from_socket(cfd, s->n_accepted++, &instance)) < 0)
+ if ((r = socket_instantiate_service(s)) < 0)
+ goto fail;
+
+ if ((r = instance_from_socket(cfd, s->n_accepted, &instance)) < 0)
goto fail;
if (!(prefix = unit_name_to_prefix(s->meta.id))) {
@@ -1086,20 +1185,25 @@ static void socket_enter_running(Socket *s, int cfd) {
goto fail;
}
- r = manager_load_unit(s->meta.manager, name, NULL, NULL, &u);
- free(name);
-
- if (r < 0)
+ if ((r = unit_add_name(UNIT(s->service), name)) < 0) {
+ free(name);
goto fail;
+ }
+
+ service = s->service;
+ s->service = NULL;
+ s->n_accepted ++;
- if ((r = service_set_socket_fd(SERVICE(u), cfd, s)) < 0)
+ unit_choose_id(UNIT(service), name);
+ free(name);
+
+ if ((r = service_set_socket_fd(service, cfd, s)) < 0)
goto fail;
cfd = -1;
-
s->n_connections ++;
- if ((r = manager_add_job(u->meta.manager, JOB_START, u, JOB_REPLACE, true, &error, NULL)) < 0)
+ if ((r = manager_add_job(s->meta.manager, JOB_START, UNIT(service), JOB_REPLACE, true, &error, NULL)) < 0)
goto fail;
}
diff --git a/src/socket.h b/src/socket.h
index 8f3cd76..88ebf26 100644
--- a/src/socket.h
+++ b/src/socket.h
@@ -84,6 +84,9 @@ struct Socket {
ExecCommand* exec_command[_SOCKET_EXEC_COMMAND_MAX];
ExecContext exec_context;
+ /* For Accept=no sockets refers to the one service we'll
+ activate. For Accept=yes sockets is either NULL, or filled
+ when the next service we spawn. */
Service *service;
SocketState state, deserialized_state;
commit 0009d2a63339af1ee9b6f18ab6cf42d68d089148
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Jul 16 19:41:50 2010 +0200
socket: don't allow mixing of accepting and non-accepting sockets in the same unit
diff --git a/src/socket.c b/src/socket.c
index 4a9c939..78fc049 100644
--- a/src/socket.c
+++ b/src/socket.c
@@ -160,6 +160,11 @@ static int socket_verify(Socket *s) {
return -EINVAL;
}
+ if (s->accept && have_non_accept_socket(s)) {
+ log_error("%s configured for accepting sockets, but sockets are non-accepting. Refusing.", s->meta.id);
+ return -EINVAL;
+ }
+
if (s->accept && s->max_connections <= 0) {
log_error("%s's MaxConnection setting too small. Refusing.", s->meta.id);
return -EINVAL;
commit cac6f7c87207b5079c1ae5c551869667bad4cfb8
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Jul 16 19:41:11 2010 +0200
service: refuse to start services that are configured for per-connection instantiation to start without a socket
diff --git a/fixme b/fixme
index a3c9950..b4f82a3 100644
--- a/fixme
+++ b/fixme
@@ -65,6 +65,10 @@
* debian deadlock when partition auf noauto is.
+* maintenance units müssen vergessen werden
+
+* maintenance muss dokumentiert werden
+
External:
* patch /etc/init.d/functions with:
diff --git a/src/service.c b/src/service.c
index 646749e..1bfab50 100644
--- a/src/service.c
+++ b/src/service.c
@@ -1896,6 +1896,14 @@ static int service_start(Unit *u) {
return -ECANCELED;
}
+ if ((s->exec_context.std_input == EXEC_INPUT_SOCKET ||
+ s->exec_context.std_output == EXEC_OUTPUT_SOCKET ||
+ s->exec_context.std_error == EXEC_OUTPUT_SOCKET) &&
+ s->socket_fd < 0) {
+ log_warning("%s can only be started with a per-connection socket.", u->meta.id);
+ return -EINVAL;
+ }
+
s->failure = false;
s->main_pid_known = false;
s->allow_restart = true;
commit 276c3e78ceae3727c797820ba80c762acc727f4e
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Jul 16 19:40:24 2010 +0200
unit: allow units to have more than one instance id
diff --git a/src/unit.c b/src/unit.c
index 0c92756..f8be8b2 100644
--- a/src/unit.c
+++ b/src/unit.c
@@ -84,7 +84,7 @@ bool unit_has_name(Unit *u, const char *name) {
int unit_add_name(Unit *u, const char *text) {
UnitType t;
- char *s = NULL, *i = NULL;
+ char *s, *i = NULL;
int r;
assert(u);
@@ -119,7 +119,9 @@ int unit_add_name(Unit *u, const char *text) {
if (i && unit_vtable[t]->no_instances)
goto fail;
- if (u->meta.type != _UNIT_TYPE_INVALID && !streq_ptr(u->meta.instance, i)) {
+ /* Ensure that this unit is either instanced or not instanced,
+ * but not both. */
+ if (u->meta.type != _UNIT_TYPE_INVALID && !u->meta.instance != !i) {
r = -EINVAL;
goto fail;
}
@@ -171,7 +173,8 @@ fail:
}
int unit_choose_id(Unit *u, const char *name) {
- char *s, *t = NULL;
+ char *s, *t = NULL, *i;
+ int r;
assert(u);
assert(name);
@@ -194,7 +197,14 @@ int unit_choose_id(Unit *u, const char *name) {
if (!s)
return -ENOENT;
+ if ((r = unit_name_to_instance(s, &i)) < 0)
+ return r;
+
u->meta.id = s;
+
+ free(u->meta.instance);
+ u->meta.instance = i;
+
unit_add_to_dbus_queue(u);
return 0;
@@ -460,7 +470,7 @@ int unit_merge(Unit *u, Unit *other) {
if (u->meta.type != other->meta.type)
return -EINVAL;
- if (!streq_ptr(u->meta.instance, other->meta.instance))
+ if (!u->meta.instance != !other->meta.instance)
return -EINVAL;
if (other->meta.load_state != UNIT_STUB &&
commit bb4f237c651623ca2b523fb3ac14268fac9bb487
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Jul 16 18:58:52 2010 +0200
units: fix default mode of /var/run and /var/lock
diff --git a/units/var-lock.mount b/units/var-lock.mount
index a7668da..17c4f52 100644
--- a/units/var-lock.mount
+++ b/units/var-lock.mount
@@ -13,6 +13,7 @@ Before=local-fs.target
What=tmpfs
Where=/var/lock
Type=tmpfs
+Options=mode=775,gid=lock
[Install]
WantedBy=local-fs.target
diff --git a/units/var-run.mount b/units/var-run.mount
index c082507..90dfe0e 100644
--- a/units/var-run.mount
+++ b/units/var-run.mount
@@ -13,6 +13,7 @@ Before=local-fs.target
What=tmpfs
Where=/var/run
Type=tmpfs
+Options=mode=755
[Install]
WantedBy=local-fs.target
commit 6c155fe3d0634f636e76188b378da174ba02ef52
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Jul 16 18:57:21 2010 +0200
path,timer: order units after sysinit by default
diff --git a/fixme b/fixme
index c98ffec..a3c9950 100644
--- a/fixme
+++ b/fixme
@@ -47,8 +47,6 @@
* default.target must be %ghosted...
-* systemd.path muss irgendwie nen sinvolles Defaultdependencies=True kriegen, genaus timer usw.
-
* In command lines, support both "$FOO" and $FOO
* systemd-install disable should recursively kill all symlinks
diff --git a/src/path.c b/src/path.c
index 2ae6e56..a9fa377 100644
--- a/src/path.c
+++ b/src/path.c
@@ -101,6 +101,18 @@ static int path_verify(Path *p) {
return 0;
}
+static int path_add_default_dependencies(Path *p) {
+ int r;
+
+ assert(p);
+
+ if (p->meta.manager->running_as == MANAGER_SYSTEM)
+ if ((r = unit_add_two_dependencies_by_name(UNIT(p), UNIT_AFTER, UNIT_REQUIRES, SPECIAL_SYSINIT_TARGET, NULL, true)) < 0)
+ return r;
+
+ return unit_add_two_dependencies_by_name(UNIT(p), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true);
+}
+
static int path_load(Unit *u) {
Path *p = PATH(u);
int r;
@@ -123,9 +135,8 @@ static int path_load(Unit *u) {
if ((r = path_add_mount_links(p)) < 0)
return r;
- /* Path units shouldn't stay around on shutdown */
if (p->meta.default_dependencies)
- if ((r = unit_add_two_dependencies_by_name(u, UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true)) < 0)
+ if ((r = path_add_default_dependencies(p)) < 0)
return r;
}
diff --git a/src/timer.c b/src/timer.c
index 0d4ed27..1580478 100644
--- a/src/timer.c
+++ b/src/timer.c
@@ -73,6 +73,18 @@ static int timer_verify(Timer *t) {
return 0;
}
+static int timer_add_default_dependencies(Timer *t) {
+ int r;
+
+ assert(t);
+
+ if (t->meta.manager->running_as == MANAGER_SYSTEM)
+ if ((r = unit_add_two_dependencies_by_name(UNIT(t), UNIT_AFTER, UNIT_REQUIRES, SPECIAL_SYSINIT_TARGET, NULL, true)) < 0)
+ return r;
+
+ return unit_add_two_dependencies_by_name(UNIT(t), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true);
+}
+
static int timer_load(Unit *u) {
Timer *t = TIMER(u);
int r;
@@ -92,9 +104,8 @@ static int timer_load(Unit *u) {
if ((r = unit_add_dependency(u, UNIT_BEFORE, t->unit, true)) < 0)
return r;
- /* Timers shouldn't stay around on shutdown */
if (t->meta.default_dependencies)
- if ((r = unit_add_two_dependencies_by_name(u, UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true)) < 0)
+ if ((r = timer_add_default_dependencies(t)) < 0)
return r;
}
More information about the systemd-commits
mailing list