core: chown() StateDirectory= and friends recursively when starting a service

This is particularly useful when used in conjunction with DynamicUser=1,
where the UID might change for every invocation, but is useful in other
cases too, for example, when these directories are shared between
systems where the UID assignments differ slightly.

diff --git a/src/core/chown-recursive.c b/src/core/chown-recursive.c
new file mode 100644 (file)
index 0000000..2a3a070
--- /dev/null
+++ b/src/core/chown-recursive.c
@@ -0,0 +1,152 @@
+/***
+  This file is part of systemd.
+
+  Copyright 2017 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include "user-util.h"
+#include "macro.h"
+#include "fd-util.h"
+#include "dirent-util.h"
+#include "chown-recursive.h"
+
+static int chown_one(int fd, const char *name, const struct stat *st, uid_t uid, gid_t gid) {
+        int r;
+
+        assert(fd >= 0);
+        assert(st);
+
+        if ((!uid_is_valid(uid) || st->st_uid == uid) &&
+            (!gid_is_valid(gid) || st->st_gid == gid))
+                return 0;
+
+        if (name)
+                r = fchownat(fd, name, uid, gid, AT_SYMLINK_NOFOLLOW);
+        else
+                r = fchown(fd, uid, gid);
+        if (r < 0)
+                return -errno;
+
+        /* The linux kernel alters the mode in some cases of chown(). Let's undo this. */
+        if (name) {
+                if (!S_ISLNK(st->st_mode))
+                        r = fchmodat(fd, name, st->st_mode, 0);
+                else /* There's currently no AT_SYMLINK_NOFOLLOW for fchmodat() */
+                        r = 0;
+        } else
+                r = fchmod(fd, st->st_mode);
+        if (r < 0)
+                return -errno;
+
+        return 1;
+}
+
+static int chown_recursive_internal(int fd, const struct stat *st, uid_t uid, gid_t gid) {
+        bool changed = false;
+        int r;
+
+        assert(fd >= 0);
+        assert(st);
+
+        if (S_ISDIR(st->st_mode)) {
+                _cleanup_closedir_ DIR *d = NULL;
+                struct dirent *de;
+
+                d = fdopendir(fd);
+                if (!d) {
+                        r = -errno;
+                        goto finish;
+                }
+                fd = -1;
+
+                FOREACH_DIRENT_ALL(de, d, r = -errno; goto finish) {
+                        struct stat fst;
+
+                        if (dot_or_dot_dot(de->d_name))
+                                continue;
+
+                        if (fstatat(dirfd(d), de->d_name, &fst, AT_SYMLINK_NOFOLLOW) < 0) {
+                                r = -errno;
+                                goto finish;
+                        }
+
+                        if (S_ISDIR(fst.st_mode)) {
+                                int subdir_fd;
+
+                                subdir_fd = openat(dirfd(d), de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME);
+                                if (subdir_fd < 0) {
+                                        r = -errno;
+                                        goto finish;
+                                }
+
+                                r = chown_recursive_internal(subdir_fd, &fst, uid, gid);
+                                if (r < 0)
+                                        goto finish;
+                                if (r > 0)
+                                        changed = true;
+                        } else {
+                                r = chown_one(dirfd(d), de->d_name, &fst, uid, gid);
+                                if (r < 0)
+                                        goto finish;
+                                if (r > 0)
+                                        changed = true;
+                        }
+                }
+
+                r = chown_one(dirfd(d), NULL, st, uid, gid);
+        } else
+                r = chown_one(fd, NULL, st, uid, gid);
+        if (r < 0)
+                goto finish;
+
+        r = r > 0 || changed;
+
+finish:
+        safe_close(fd);
+        return r;
+}
+
+int path_chown_recursive(const char *path, uid_t uid, gid_t gid) {
+        _cleanup_close_ int fd = -1;
+        struct stat st;
+        int r;
+
+        fd = open(path, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME);
+        if (fd < 0)
+                return -errno;
+
+        if (!uid_is_valid(uid) && !gid_is_valid(gid))
+                return 0; /* nothing to do */
+
+        if (fstat(fd, &st) < 0)
+                return -errno;
+
+        /* Let's take a shortcut: if the top-level directory is properly owned, we don't descend into the whole tree,
+         * under the assumption that all is OK anyway. */
+
+        if ((!uid_is_valid(uid) || st.st_uid == uid) &&
+            (!gid_is_valid(gid) || st.st_gid == gid))
+                return 0;
+
+        r = chown_recursive_internal(fd, &st, uid, gid);
+        fd = -1; /* we donated the fd to the call, regardless if it succeeded or failed */
+
+        return r;
+}

diff --git a/src/core/chown-recursive.h b/src/core/chown-recursive.h
new file mode 100644 (file)
index 0000000..6531698
--- /dev/null
+++ b/src/core/chown-recursive.h
@@ -0,0 +1,24 @@
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2017 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <sys/types.h>
+
+int path_chown_recursive(const char *path, uid_t uid, gid_t gid);

diff --git a/src/core/execute.c b/src/core/execute.c
index cd4b9f8..ce0ae7d 100644 (file)
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -64,6 +64,7 @@
 #include "barrier.h"
 #include "cap-list.h"
 #include "capability-util.h"
+#include "chown-recursive.h"
 #include "def.h"
 #include "env-util.h"
 #include "errno-list.h"
@@ -76,6 +77,7 @@
 #include "glob-util.h"
 #include "io-util.h"
 #include "ioprio.h"
+#include "label.h"
 #include "log.h"
 #include "macro.h"
 #include "missing.h"
@@ -1934,16 +1936,23 @@ static int setup_exec_directory(
                 if (r < 0)
                         goto fail;
 
-                r = mkdir_p_label(p, context->directories[type].mode);
-                if (r < 0)
+                r = mkdir_label(p, context->directories[type].mode);
+                if (r < 0 && r != -EEXIST)
+                        goto fail;
+
+                /* First lock down the access mode */
+                if (chmod(p, context->directories[type].mode) < 0) {
+                        r = -errno;
                         goto fail;
+                }
 
                 /* Don't change the owner of the configuration directory, as in the common case it is not written to by
                  * a service, and shall not be writable. */
                 if (type == EXEC_DIRECTORY_CONFIGURATION)
                         continue;
 
-                r = chmod_and_chown(p, context->directories[type].mode, uid, gid);
+                /* Then, change the ownership of the whole tree, if necessary */
+                r = path_chown_recursive(p, uid, gid);
                 if (r < 0)
                         goto fail;
         }
@@ -1952,7 +1961,6 @@ static int setup_exec_directory(
 
 fail:
         *exit_status = exit_status_table[type];
-
         return r;
 }
 

diff --git a/src/core/meson.build b/src/core/meson.build
index ac600be..4355f9c 100644 (file)
--- a/src/core/meson.build
+++ b/src/core/meson.build
@@ -7,6 +7,8 @@ libcore_la_sources = '''
         bpf-firewall.h
         cgroup.c
         cgroup.h
+        chown-recursive.c
+        chown-recursive.h
         dbus-automount.c
         dbus-automount.h
         dbus-cgroup.c