From a1164ae3805646048d4712f5a9e2de16b6faf6fa Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 28 Sep 2017 19:13:44 +0200 Subject: [PATCH] core: chown() StateDirectory= and friends recursively when starting a service This is particularly useful when used in conjunction with DynamicUser=1, where the UID might change for every invocation, but is useful in other cases too, for example, when these directories are shared between systems where the UID assignments differ slightly. --- src/core/chown-recursive.c | 152 +++++++++++++++++++++++++++++++++++++++++++++ src/core/chown-recursive.h | 24 +++++++ src/core/execute.c | 16 +++-- src/core/meson.build | 2 + 4 files changed, 190 insertions(+), 4 deletions(-) create mode 100644 src/core/chown-recursive.c create mode 100644 src/core/chown-recursive.h diff --git a/src/core/chown-recursive.c b/src/core/chown-recursive.c new file mode 100644 index 0000000..2a3a070 --- /dev/null +++ b/src/core/chown-recursive.c @@ -0,0 +1,152 @@ +/*** + This file is part of systemd. + + Copyright 2017 Lennart Poettering + + systemd is free software; you can redistribute it and/or modify it + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or + (at your option) any later version. + + systemd is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with systemd; If not, see . +***/ + +#include +#include +#include + +#include "user-util.h" +#include "macro.h" +#include "fd-util.h" +#include "dirent-util.h" +#include "chown-recursive.h" + +static int chown_one(int fd, const char *name, const struct stat *st, uid_t uid, gid_t gid) { + int r; + + assert(fd >= 0); + assert(st); + + if ((!uid_is_valid(uid) || st->st_uid == uid) && + (!gid_is_valid(gid) || st->st_gid == gid)) + return 0; + + if (name) + r = fchownat(fd, name, uid, gid, AT_SYMLINK_NOFOLLOW); + else + r = fchown(fd, uid, gid); + if (r < 0) + return -errno; + + /* The linux kernel alters the mode in some cases of chown(). Let's undo this. */ + if (name) { + if (!S_ISLNK(st->st_mode)) + r = fchmodat(fd, name, st->st_mode, 0); + else /* There's currently no AT_SYMLINK_NOFOLLOW for fchmodat() */ + r = 0; + } else + r = fchmod(fd, st->st_mode); + if (r < 0) + return -errno; + + return 1; +} + +static int chown_recursive_internal(int fd, const struct stat *st, uid_t uid, gid_t gid) { + bool changed = false; + int r; + + assert(fd >= 0); + assert(st); + + if (S_ISDIR(st->st_mode)) { + _cleanup_closedir_ DIR *d = NULL; + struct dirent *de; + + d = fdopendir(fd); + if (!d) { + r = -errno; + goto finish; + } + fd = -1; + + FOREACH_DIRENT_ALL(de, d, r = -errno; goto finish) { + struct stat fst; + + if (dot_or_dot_dot(de->d_name)) + continue; + + if (fstatat(dirfd(d), de->d_name, &fst, AT_SYMLINK_NOFOLLOW) < 0) { + r = -errno; + goto finish; + } + + if (S_ISDIR(fst.st_mode)) { + int subdir_fd; + + subdir_fd = openat(dirfd(d), de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME); + if (subdir_fd < 0) { + r = -errno; + goto finish; + } + + r = chown_recursive_internal(subdir_fd, &fst, uid, gid); + if (r < 0) + goto finish; + if (r > 0) + changed = true; + } else { + r = chown_one(dirfd(d), de->d_name, &fst, uid, gid); + if (r < 0) + goto finish; + if (r > 0) + changed = true; + } + } + + r = chown_one(dirfd(d), NULL, st, uid, gid); + } else + r = chown_one(fd, NULL, st, uid, gid); + if (r < 0) + goto finish; + + r = r > 0 || changed; + +finish: + safe_close(fd); + return r; +} + +int path_chown_recursive(const char *path, uid_t uid, gid_t gid) { + _cleanup_close_ int fd = -1; + struct stat st; + int r; + + fd = open(path, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME); + if (fd < 0) + return -errno; + + if (!uid_is_valid(uid) && !gid_is_valid(gid)) + return 0; /* nothing to do */ + + if (fstat(fd, &st) < 0) + return -errno; + + /* Let's take a shortcut: if the top-level directory is properly owned, we don't descend into the whole tree, + * under the assumption that all is OK anyway. */ + + if ((!uid_is_valid(uid) || st.st_uid == uid) && + (!gid_is_valid(gid) || st.st_gid == gid)) + return 0; + + r = chown_recursive_internal(fd, &st, uid, gid); + fd = -1; /* we donated the fd to the call, regardless if it succeeded or failed */ + + return r; +} diff --git a/src/core/chown-recursive.h b/src/core/chown-recursive.h new file mode 100644 index 0000000..6531698 --- /dev/null +++ b/src/core/chown-recursive.h @@ -0,0 +1,24 @@ +#pragma once + +/*** + This file is part of systemd. + + Copyright 2017 Lennart Poettering + + systemd is free software; you can redistribute it and/or modify it + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or + (at your option) any later version. + + systemd is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with systemd; If not, see . +***/ + +#include + +int path_chown_recursive(const char *path, uid_t uid, gid_t gid); diff --git a/src/core/execute.c b/src/core/execute.c index cd4b9f8..ce0ae7d 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -64,6 +64,7 @@ #include "barrier.h" #include "cap-list.h" #include "capability-util.h" +#include "chown-recursive.h" #include "def.h" #include "env-util.h" #include "errno-list.h" @@ -76,6 +77,7 @@ #include "glob-util.h" #include "io-util.h" #include "ioprio.h" +#include "label.h" #include "log.h" #include "macro.h" #include "missing.h" @@ -1934,16 +1936,23 @@ static int setup_exec_directory( if (r < 0) goto fail; - r = mkdir_p_label(p, context->directories[type].mode); - if (r < 0) + r = mkdir_label(p, context->directories[type].mode); + if (r < 0 && r != -EEXIST) + goto fail; + + /* First lock down the access mode */ + if (chmod(p, context->directories[type].mode) < 0) { + r = -errno; goto fail; + } /* Don't change the owner of the configuration directory, as in the common case it is not written to by * a service, and shall not be writable. */ if (type == EXEC_DIRECTORY_CONFIGURATION) continue; - r = chmod_and_chown(p, context->directories[type].mode, uid, gid); + /* Then, change the ownership of the whole tree, if necessary */ + r = path_chown_recursive(p, uid, gid); if (r < 0) goto fail; } @@ -1952,7 +1961,6 @@ static int setup_exec_directory( fail: *exit_status = exit_status_table[type]; - return r; } diff --git a/src/core/meson.build b/src/core/meson.build index ac600be..4355f9c 100644 --- a/src/core/meson.build +++ b/src/core/meson.build @@ -7,6 +7,8 @@ libcore_la_sources = ''' bpf-firewall.h cgroup.c cgroup.h + chown-recursive.c + chown-recursive.h dbus-automount.c dbus-automount.h dbus-cgroup.c -- 2.7.4