From d35fbf6bdf4377f3a15b084ff812b3ee272e5347 Mon Sep 17 00:00:00 2001

From: Daniel Mack <zonque@gmail.com>

Date: Sat, 23 Aug 2014 16:02:21 +0200

Subject: [PATCH] exec: move code executed after fork into exec_child()

This factors out one conditional branch that has grown way too big, and

makes the code more readable by using return statements rather than jump

labels.

---

 src/core/execute.c | 911 +++++++++++++++++++++++++++--------------------------

 1 file changed, 458 insertions(+), 453 deletions(-)

diff --git a/src/core/execute.c b/src/core/execute.c

index e683fa5e16..0a5914759f 100644

--- a/src/core/execute.c

+++ b/src/core/execute.c

@@ -1223,561 +1223,566 @@ static int build_environment(

         return 0;

 }

-int exec_spawn(ExecCommand *command,

-               const ExecContext *context,

-               const ExecParameters *exec_params,

-               ExecRuntime *runtime,

-               pid_t *ret) {

-

-        _cleanup_strv_free_ char **files_env = NULL;

-        int *fds = NULL; unsigned n_fds = 0;

-        int socket_fd;

-        char *line, **argv;

-        pid_t pid;

-        int r;

+static int exec_child(ExecCommand *command,

+                      const ExecContext *context,

+                      const ExecParameters *params,

+                      ExecRuntime *runtime,

+                      char **argv,

+                      int socket_fd,

+                      int *fds, unsigned n_fds,

+                      char **files_env,

+                      int *error) {

+

+        _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;

+        const char *username = NULL, *home = NULL, *shell = NULL;

+        unsigned n_dont_close = 0;

+        int dont_close[n_fds + 3];

+        uid_t uid = (uid_t) -1;

+        gid_t gid = (gid_t) -1;

+        int i, err;

         assert(command);

         assert(context);

-        assert(ret);

-        assert(exec_params);

-        assert(exec_params->fds || exec_params->n_fds <= 0);

+        assert(params);

+        assert(error);

-        if (context->std_input == EXEC_INPUT_SOCKET ||

-            context->std_output == EXEC_OUTPUT_SOCKET ||

-            context->std_error == EXEC_OUTPUT_SOCKET) {

+        rename_process_from_path(command->path);

-                if (exec_params->n_fds != 1)

-                        return -EINVAL;

+        /* We reset exactly these signals, since they are the

+         * only ones we set to SIG_IGN in the main daemon. All

+         * others we leave untouched because we set them to

+         * SIG_DFL or a valid handler initially, both of which

+         * will be demoted to SIG_DFL. */

+        default_signals(SIGNALS_CRASH_HANDLER,

+                        SIGNALS_IGNORE, -1);

-                socket_fd = exec_params->fds[0];

-        } else {

-                socket_fd = -1;

-                fds = exec_params->fds;

-                n_fds = exec_params->n_fds;

+        if (context->ignore_sigpipe)

+                ignore_signals(SIGPIPE, -1);

+

+        err = reset_signal_mask();

+        if (err < 0) {

+                *error = EXIT_SIGNAL_MASK;

+                return err;

         }

-        r = exec_context_load_environment(context, &files_env);

-        if (r < 0) {

-                log_struct_unit(LOG_ERR,

-                           exec_params->unit_id,

-                           "MESSAGE=Failed to load environment files: %s", strerror(-r),

-                           "ERRNO=%d", -r,

-                           NULL);

-                return r;

+        if (params->idle_pipe)

+                do_idle_pipe_dance(params->idle_pipe);

+

+        /* Close sockets very early to make sure we don't

+         * block init reexecution because it cannot bind its

+         * sockets */

+        log_forget_fds();

+

+        if (socket_fd >= 0)

+                dont_close[n_dont_close++] = socket_fd;

+        if (n_fds > 0) {

+                memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);

+                n_dont_close += n_fds;

+        }

+        if (runtime) {

+                if (runtime->netns_storage_socket[0] >= 0)

+                        dont_close[n_dont_close++] = runtime->netns_storage_socket[0];

+                if (runtime->netns_storage_socket[1] >= 0)

+                        dont_close[n_dont_close++] = runtime->netns_storage_socket[1];

         }

-        argv = exec_params->argv ?: command->argv;

+        err = close_all_fds(dont_close, n_dont_close);

+        if (err < 0) {

+                *error = EXIT_FDS;

+                return err;

+        }

-        line = exec_command_line(argv);

-        if (!line)

-                return log_oom();

+        if (!context->same_pgrp)

+                if (setsid() < 0) {

+                        *error = EXIT_SETSID;

+                        return -errno;

+                }

-        log_struct_unit(LOG_DEBUG,

-                        exec_params->unit_id,

-                        "EXECUTABLE=%s", command->path,

-                        "MESSAGE=About to execute: %s", line,

-                        NULL);

-        free(line);

+        exec_context_tty_reset(context);

+

+        if (params->confirm_spawn) {

+                char response;

+

+                err = ask_for_confirmation(&response, argv);

+                if (err == -ETIMEDOUT)

+                        write_confirm_message("Confirmation question timed out, assuming positive response.\n");

+                else if (err < 0)

+                        write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));

+                else if (response == 's') {

+                        write_confirm_message("Skipping execution.\n");

+                        *error = EXIT_CONFIRM;

+                        return -ECANCELED;

+                } else if (response == 'n') {

+                        write_confirm_message("Failing execution.\n");

+                        *error = 0;

+                        return 0;

+                }

+        }

-        pid = fork();

-        if (pid < 0)

-                return -errno;

+        /* If a socket is connected to STDIN/STDOUT/STDERR, we

+         * must sure to drop O_NONBLOCK */

+        if (socket_fd >= 0)

+                fd_nonblock(socket_fd, false);

-        if (pid == 0) {

-                _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;

-                const char *username = NULL, *home = NULL, *shell = NULL;

-                unsigned n_dont_close = 0;

-                int dont_close[n_fds + 3];

-                uid_t uid = (uid_t) -1;

-                gid_t gid = (gid_t) -1;

-                int i, err;

-

-                /* child */

-

-                rename_process_from_path(command->path);

-

-                /* We reset exactly these signals, since they are the

-                 * only ones we set to SIG_IGN in the main daemon. All

-                 * others we leave untouched because we set them to

-                 * SIG_DFL or a valid handler initially, both of which

-                 * will be demoted to SIG_DFL. */

-                default_signals(SIGNALS_CRASH_HANDLER,

-                                SIGNALS_IGNORE, -1);

-

-                if (context->ignore_sigpipe)

-                        ignore_signals(SIGPIPE, -1);

-

-                err = reset_signal_mask();

+        err = setup_input(context, socket_fd, params->apply_tty_stdin);

+        if (err < 0) {

+                *error = EXIT_STDIN;

+                return err;

+        }

+

+        err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin);

+        if (err < 0) {

+                *error = EXIT_STDOUT;

+                return err;

+        }

+

+        err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin);

+        if (err < 0) {

+                *error = EXIT_STDERR;

+                return err;

+        }

+

+        if (params->cgroup_path) {

+                err = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0);

                 if (err < 0) {

-                        r = EXIT_SIGNAL_MASK;

-                        goto fail_child;

+                        *error = EXIT_CGROUP;

+                        return err;

                 }

+        }

-                if (exec_params->idle_pipe)

-                        do_idle_pipe_dance(exec_params->idle_pipe);

+        if (context->oom_score_adjust_set) {

+                char t[16];

-                /* Close sockets very early to make sure we don't

-                 * block init reexecution because it cannot bind its

-                 * sockets */

-                log_forget_fds();

+                snprintf(t, sizeof(t), "%i", context->oom_score_adjust);

+                char_array_0(t);

-                if (socket_fd >= 0)

-                        dont_close[n_dont_close++] = socket_fd;

-                if (n_fds > 0) {

-                        memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);

-                        n_dont_close += n_fds;

-                }

-                if (runtime) {

-                        if (runtime->netns_storage_socket[0] >= 0)

-                                dont_close[n_dont_close++] = runtime->netns_storage_socket[0];

-                        if (runtime->netns_storage_socket[1] >= 0)

-                                dont_close[n_dont_close++] = runtime->netns_storage_socket[1];

+                if (write_string_file("/proc/self/oom_score_adj", t) < 0) {

+                        *error = EXIT_OOM_ADJUST;

+                        return -errno;

                 }

+        }

-                err = close_all_fds(dont_close, n_dont_close);

-                if (err < 0) {

-                        r = EXIT_FDS;

-                        goto fail_child;

+        if (context->nice_set)

+                if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {

+                        *error = EXIT_NICE;

+                        return -errno;

                 }

-                if (!context->same_pgrp)

-                        if (setsid() < 0) {

-                                err = -errno;

-                                r = EXIT_SETSID;

-                                goto fail_child;

-                        }

+        if (context->cpu_sched_set) {

+                struct sched_param param = {

+                        .sched_priority = context->cpu_sched_priority,

+                };

-                exec_context_tty_reset(context);

+                err = sched_setscheduler(0,

+                                         context->cpu_sched_policy |

+                                         (context->cpu_sched_reset_on_fork ?

+                                          SCHED_RESET_ON_FORK : 0),

+                                         ¶m;;

+                if (err < 0) {

+                        *error = EXIT_SETSCHEDULER;

+                        return -errno;

+                }

+        }

-                if (exec_params->confirm_spawn) {

-                        char response;

-

-                        err = ask_for_confirmation(&response, argv);

-                        if (err == -ETIMEDOUT)

-                                write_confirm_message("Confirmation question timed out, assuming positive response.\n");

-                        else if (err < 0)

-                                write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));

-                        else if (response == 's') {

-                                write_confirm_message("Skipping execution.\n");

-                                err = -ECANCELED;

-                                r = EXIT_CONFIRM;

-                                goto fail_child;

-                        } else if (response == 'n') {

-                                write_confirm_message("Failing execution.\n");

-                                err = r = 0;

-                                goto fail_child;

-                        }

+        if (context->cpuset)

+                if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {

+                        *error = EXIT_CPUAFFINITY;

+                        return -errno;

                 }

-                /* If a socket is connected to STDIN/STDOUT/STDERR, we

-                 * must sure to drop O_NONBLOCK */

-                if (socket_fd >= 0)

-                        fd_nonblock(socket_fd, false);

+        if (context->ioprio_set)

+                if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {

+                        *error = EXIT_IOPRIO;

+                        return -errno;

+                }

-                err = setup_input(context, socket_fd, exec_params->apply_tty_stdin);

-                if (err < 0) {

-                        r = EXIT_STDIN;

-                        goto fail_child;

+        if (context->timer_slack_nsec != NSEC_INFINITY)

+                if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {

+                        *error = EXIT_TIMERSLACK;

+                        return -errno;

                 }

-                err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), exec_params->unit_id, exec_params->apply_tty_stdin);

-                if (err < 0) {

-                        r = EXIT_STDOUT;

-                        goto fail_child;

+        if (context->personality != 0xffffffffUL)

+                if (personality(context->personality) < 0) {

+                        *error = EXIT_PERSONALITY;

+                        return -errno;

                 }

-                err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), exec_params->unit_id, exec_params->apply_tty_stdin);

+        if (context->utmp_id)

+                utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);

+

+        if (context->user) {

+                username = context->user;

+                err = get_user_creds(&username, &uid, &gid, &home, &shell);

                 if (err < 0) {

-                        r = EXIT_STDERR;

-                        goto fail_child;

+                        *error = EXIT_USER;

+                        return err;

                 }

-                if (exec_params->cgroup_path) {

-                        err = cg_attach_everywhere(exec_params->cgroup_supported, exec_params->cgroup_path, 0);

+                if (is_terminal_input(context->std_input)) {

+                        err = chown_terminal(STDIN_FILENO, uid);

                         if (err < 0) {

-                                r = EXIT_CGROUP;

-                                goto fail_child;

+                                *error = EXIT_STDIN;

+                                return err;

                         }

                 }

+        }

-                if (context->oom_score_adjust_set) {

-                        char t[16];

+#ifdef HAVE_PAM

+        if (params->cgroup_path && context->user && context->pam_name) {

+                err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);

+                if (err < 0) {

+                        *error = EXIT_CGROUP;

+                        return err;

+                }

-                        snprintf(t, sizeof(t), "%i", context->oom_score_adjust);

-                        char_array_0(t);

-                        if (write_string_file("/proc/self/oom_score_adj", t) < 0) {

-                                err = -errno;

-                                r = EXIT_OOM_ADJUST;

-                                goto fail_child;

-                        }

+                err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);

+                if (err < 0) {

+                        *error = EXIT_CGROUP;

+                        return err;

                 }

+        }

+#endif

-                if (context->nice_set)

-                        if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {

-                                err = -errno;

-                                r = EXIT_NICE;

-                                goto fail_child;

-                        }

+        if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {

+                char **rt;

-                if (context->cpu_sched_set) {

-                        struct sched_param param = {

-                                .sched_priority = context->cpu_sched_priority,

-                        };

+                STRV_FOREACH(rt, context->runtime_directory) {

+                        _cleanup_free_ char *p;

-                        r = sched_setscheduler(0,

-                                               context->cpu_sched_policy |

-                                               (context->cpu_sched_reset_on_fork ?

-                                                SCHED_RESET_ON_FORK : 0),

-                                               ¶m;;

-                        if (r < 0) {

-                                err = -errno;

-                                r = EXIT_SETSCHEDULER;

-                                goto fail_child;

+                        p = strjoin(params->runtime_prefix, "/", *rt, NULL);

+                        if (!p) {

+                                *error = EXIT_RUNTIME_DIRECTORY;

+                                return -ENOMEM;

                         }

-                }

-                if (context->cpuset)

-                        if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {

-                                err = -errno;

-                                r = EXIT_CPUAFFINITY;

-                                goto fail_child;

+                        err = mkdir_safe(p, context->runtime_directory_mode, uid, gid);

+                        if (err < 0) {

+                                *error = EXIT_RUNTIME_DIRECTORY;

+                                return err;

                         }

+                }

+        }

-                if (context->ioprio_set)

-                        if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {

-                                err = -errno;

-                                r = EXIT_IOPRIO;

-                                goto fail_child;

-                        }

+        if (params->apply_permissions) {

+                err = enforce_groups(context, username, gid);

+                if (err < 0) {

+                        *error = EXIT_GROUP;

+                        return err;

+                }

+        }

-                if (context->timer_slack_nsec != NSEC_INFINITY)

-                        if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {

-                                err = -errno;

-                                r = EXIT_TIMERSLACK;

-                                goto fail_child;

-                        }

+        umask(context->umask);

-                if (context->personality != 0xffffffffUL)

-                        if (personality(context->personality) < 0) {

-                                err = -errno;

-                                r = EXIT_PERSONALITY;

-                                goto fail_child;

-                        }

+#ifdef HAVE_PAM

+        if (params->apply_permissions && context->pam_name && username) {

+                err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);

+                if (err < 0) {

+                        *error = EXIT_PAM;

+                        return err;

+                }

+        }

+#endif

-                if (context->utmp_id)

-                        utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);

+        if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {

+                err = setup_netns(runtime->netns_storage_socket);

+                if (err < 0) {

+                        *error = EXIT_NETWORK;

+                        return err;

+                }

+        }

-                if (context->user) {

-                        username = context->user;

-                        err = get_user_creds(&username, &uid, &gid, &home, &shell);

-                        if (err < 0) {

-                                r = EXIT_USER;

-                                goto fail_child;

-                        }

+        if (!strv_isempty(context->read_write_dirs) ||

+            !strv_isempty(context->read_only_dirs) ||

+            !strv_isempty(context->inaccessible_dirs) ||

+            context->mount_flags != 0 ||

+            (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||

+            context->private_devices ||

+            context->protect_system != PROTECT_SYSTEM_NO ||

+            context->protect_home != PROTECT_HOME_NO) {

+

+                char *tmp = NULL, *var = NULL;

+

+                /* The runtime struct only contains the parent

+                 * of the private /tmp, which is

+                 * non-accessible to world users. Inside of it

+                 * there's a /tmp that is sticky, and that's

+                 * the one we want to use here. */

+

+                if (context->private_tmp && runtime) {

+                        if (runtime->tmp_dir)

+                                tmp = strappenda(runtime->tmp_dir, "/tmp");

+                        if (runtime->var_tmp_dir)

+                                var = strappenda(runtime->var_tmp_dir, "/tmp");

+                }

-                        if (is_terminal_input(context->std_input)) {

-                                err = chown_terminal(STDIN_FILENO, uid);

-                                if (err < 0) {

-                                        r = EXIT_STDIN;

-                                        goto fail_child;

-                                }

-                        }

+                err = setup_namespace(

+                                context->read_write_dirs,

+                                context->read_only_dirs,

+                                context->inaccessible_dirs,

+                                tmp,

+                                var,

+                                context->private_devices,

+                                context->protect_home,

+                                context->protect_system,

+                                context->mount_flags);

+                if (err < 0) {

+                        *error = EXIT_NAMESPACE;

+                        return err;

                 }

+        }

-#ifdef HAVE_PAM

-                if (exec_params->cgroup_path && context->user && context->pam_name) {

-                        err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, exec_params->cgroup_path, 0644, uid, gid);

-                        if (err < 0) {

-                                r = EXIT_CGROUP;

-                                goto fail_child;

+        if (params->apply_chroot) {

+                if (context->root_directory)

+                        if (chroot(context->root_directory) < 0) {

+                                *error = EXIT_CHROOT;

+                                return -errno;

                         }

+                if (chdir(context->working_directory ? context->working_directory : "/") < 0) {

+                        *error = EXIT_CHDIR;

+                        return -errno;

+                }

+        } else {

+                _cleanup_free_ char *d = NULL;

-                        err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, exec_params->cgroup_path, 0755, uid, gid);

-                        if (err < 0) {

-                                r = EXIT_CGROUP;

-                                goto fail_child;

-                        }

+                if (asprintf(&d, "%s/%s",

+                             context->root_directory ? context->root_directory : "",

+                             context->working_directory ? context->working_directory : "") < 0) {

+                        *error = EXIT_MEMORY;

+                        return -ENOMEM;

                 }

-#endif

-                if (!strv_isempty(context->runtime_directory) && exec_params->runtime_prefix) {

-                        char **rt;

+                if (chdir(d) < 0) {

+                        *error = EXIT_CHDIR;

+                        return -errno;

+                }

+        }

-                        STRV_FOREACH(rt, context->runtime_directory) {

-                                _cleanup_free_ char *p;

+        /* We repeat the fd closing here, to make sure that

+         * nothing is leaked from the PAM modules. Note that

+         * we are more aggressive this time since socket_fd

+         * and the netns fds we don#t need anymore. */

+        err = close_all_fds(fds, n_fds);

+        if (err >= 0)

+                err = shift_fds(fds, n_fds);

+        if (err >= 0)

+                err = flags_fds(fds, n_fds, context->non_blocking);

+        if (err < 0) {

+                *error = EXIT_FDS;

+                return err;

+        }

-                                p = strjoin(exec_params->runtime_prefix, "/", *rt, NULL);

-                                if (!p) {

-                                        r = EXIT_RUNTIME_DIRECTORY;

-                                        err = -ENOMEM;

-                                        goto fail_child;

-                                }

+        if (params->apply_permissions) {

-                                err = mkdir_safe(p, context->runtime_directory_mode, uid, gid);

-                                if (err < 0) {

-                                        r = EXIT_RUNTIME_DIRECTORY;

-                                        goto fail_child;

-                                }

+                for (i = 0; i < _RLIMIT_MAX; i++) {

+                        if (!context->rlimit[i])

+                                continue;

+

+                        if (setrlimit_closest(i, context->rlimit[i]) < 0) {

+                                *error = EXIT_LIMITS;

+                                return -errno;

                         }

                 }

-                if (exec_params->apply_permissions) {

-                        err = enforce_groups(context, username, gid);

+                if (context->capability_bounding_set_drop) {

+                        err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);

                         if (err < 0) {

-                                r = EXIT_GROUP;

-                                goto fail_child;

+                                *error = EXIT_CAPABILITIES;

+                                return err;

                         }

                 }

-                umask(context->umask);

-

-#ifdef HAVE_PAM

-                if (exec_params->apply_permissions && context->pam_name && username) {

-                        err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);

+                if (context->user) {

+                        err = enforce_user(context, uid);

                         if (err < 0) {

-                                r = EXIT_PAM;

-                                goto fail_child;

+                                *error = EXIT_USER;

+                                return err;

                         }

                 }

-#endif

-                if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {

-                        err = setup_netns(runtime->netns_storage_socket);

-                        if (err < 0) {

-                                r = EXIT_NETWORK;

-                                goto fail_child;

+

+                /* PR_GET_SECUREBITS is not privileged, while

+                 * PR_SET_SECUREBITS is. So to suppress

+                 * potential EPERMs we'll try not to call

+                 * PR_SET_SECUREBITS unless necessary. */

+                if (prctl(PR_GET_SECUREBITS) != context->secure_bits)

+                        if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {

+                                *error = EXIT_SECUREBITS;

+                                return -errno;

+                        }

+

+                if (context->capabilities)

+                        if (cap_set_proc(context->capabilities) < 0) {

+                                *error = EXIT_CAPABILITIES;

+                                return -errno;

                         }

-                }

-                if (!strv_isempty(context->read_write_dirs) ||

-                    !strv_isempty(context->read_only_dirs) ||

-                    !strv_isempty(context->inaccessible_dirs) ||

-                    context->mount_flags != 0 ||

-                    (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||

-                    context->private_devices ||

-                    context->protect_system != PROTECT_SYSTEM_NO ||

-                    context->protect_home != PROTECT_HOME_NO) {

-

-                        char *tmp = NULL, *var = NULL;

-

-                        /* The runtime struct only contains the parent

-                         * of the private /tmp, which is

-                         * non-accessible to world users. Inside of it

-                         * there's a /tmp that is sticky, and that's

-                         * the one we want to use here. */

-

-                        if (context->private_tmp && runtime) {

-                                if (runtime->tmp_dir)

-                                        tmp = strappenda(runtime->tmp_dir, "/tmp");

-                                if (runtime->var_tmp_dir)

-                                        var = strappenda(runtime->var_tmp_dir, "/tmp");

+                if (context->no_new_privileges)

+                        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {

+                                *error = EXIT_NO_NEW_PRIVILEGES;

+                                return -errno;

                         }

-                        err = setup_namespace(

-                                        context->read_write_dirs,

-                                        context->read_only_dirs,

-                                        context->inaccessible_dirs,

-                                        tmp,

-                                        var,

-                                        context->private_devices,

-                                        context->protect_home,

-                                        context->protect_system,

-                                        context->mount_flags);

+#ifdef HAVE_SECCOMP

+                if (context->address_families_whitelist ||

+                    !set_isempty(context->address_families)) {

+                        err = apply_address_families(context);

                         if (err < 0) {

-                                r = EXIT_NAMESPACE;

-                                goto fail_child;

+                                *error = EXIT_ADDRESS_FAMILIES;

+                                return err;

                         }

                 }

-                if (exec_params->apply_chroot) {

-                        if (context->root_directory)

-                                if (chroot(context->root_directory) < 0) {

-                                        err = -errno;

-                                        r = EXIT_CHROOT;

-                                        goto fail_child;

-                                }

-

-                        if (chdir(context->working_directory ? context->working_directory : "/") < 0) {

-                                err = -errno;

-                                r = EXIT_CHDIR;

-                                goto fail_child;

-                        }

-                } else {

-                        _cleanup_free_ char *d = NULL;

-

-                        if (asprintf(&d, "%s/%s",

-                                     context->root_directory ? context->root_directory : "",

-                                     context->working_directory ? context->working_directory : "") < 0) {

-                                err = -ENOMEM;

-                                r = EXIT_MEMORY;

-                                goto fail_child;

+                if (context->syscall_whitelist ||

+                    !set_isempty(context->syscall_filter) ||

+                    !set_isempty(context->syscall_archs)) {

+                        err = apply_seccomp(context);

+                        if (err < 0) {

+                                *error = EXIT_SECCOMP;

+                                return err;

                         }

+                }

+#endif

-                        if (chdir(d) < 0) {

-                                err = -errno;

-                                r = EXIT_CHDIR;

-                                goto fail_child;

+#ifdef HAVE_SELINUX

+                if (context->selinux_context && use_selinux()) {

+                        err = setexeccon(context->selinux_context);

+                        if (err < 0 && !context->selinux_context_ignore) {

+                                *error = EXIT_SELINUX_CONTEXT;

+                                return err;

                         }

                 }

+#endif

-                /* We repeat the fd closing here, to make sure that

-                 * nothing is leaked from the PAM modules. Note that

-                 * we are more aggressive this time since socket_fd

-                 * and the netns fds we don#t need anymore. */

-                err = close_all_fds(fds, n_fds);

-                if (err >= 0)

-                        err = shift_fds(fds, n_fds);

-                if (err >= 0)

-                        err = flags_fds(fds, n_fds, context->non_blocking);

-                if (err < 0) {

-                        r = EXIT_FDS;

-                        goto fail_child;

+#ifdef HAVE_APPARMOR

+                if (context->apparmor_profile && use_apparmor()) {

+                        err = aa_change_onexec(context->apparmor_profile);

+                        if (err < 0 && !context->apparmor_profile_ignore) {

+                                *error = EXIT_APPARMOR_PROFILE;

+                                return err;

+                        }

                 }

+#endif

+        }

-                if (exec_params->apply_permissions) {

+        err = build_environment(context, n_fds, params->watchdog_usec, home, username, shell, &our_env);

+        if (err < 0) {

+                *error = EXIT_MEMORY;

+                return err;

+        }

-                        for (i = 0; i < _RLIMIT_MAX; i++) {

-                                if (!context->rlimit[i])

-                                        continue;

+        final_env = strv_env_merge(5,

+                                   params->environment,

+                                   our_env,

+                                   context->environment,

+                                   files_env,

+                                   pam_env,

+                                   NULL);

+        if (!final_env) {

+                *error = EXIT_MEMORY;

+                return -ENOMEM;

+        }

-                                if (setrlimit_closest(i, context->rlimit[i]) < 0) {

-                                        err = -errno;

-                                        r = EXIT_LIMITS;

-                                        goto fail_child;

-                                }

-                        }

+        final_argv = replace_env_argv(argv, final_env);

+        if (!final_argv) {

+                *error = EXIT_MEMORY;

+                return -ENOMEM;

+        }

-                        if (context->capability_bounding_set_drop) {

-                                err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);

-                                if (err < 0) {

-                                        r = EXIT_CAPABILITIES;

-                                        goto fail_child;

-                                }

-                        }

+        final_env = strv_env_clean(final_env);

-                        if (context->user) {

-                                err = enforce_user(context, uid);

-                                if (err < 0) {

-                                        r = EXIT_USER;

-                                        goto fail_child;

-                                }

-                        }

+        if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {

+                _cleanup_free_ char *line;

-                        /* PR_GET_SECUREBITS is not privileged, while

-                         * PR_SET_SECUREBITS is. So to suppress

-                         * potential EPERMs we'll try not to call

-                         * PR_SET_SECUREBITS unless necessary. */

-                        if (prctl(PR_GET_SECUREBITS) != context->secure_bits)

-                                if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {

-                                        err = -errno;

-                                        r = EXIT_SECUREBITS;

-                                        goto fail_child;

-                                }

+                line = exec_command_line(final_argv);

+                if (line) {

+                        log_open();

+                        log_struct_unit(LOG_DEBUG,

+                                        params->unit_id,

+                                        "EXECUTABLE=%s", command->path,

+                                        "MESSAGE=Executing: %s", line,

+                                        NULL);

+                        log_close();

+                }

+        }

+        execve(command->path, final_argv, final_env);

+        *error = EXIT_EXEC;

+        return -errno;

+}

-                        if (context->capabilities)

-                                if (cap_set_proc(context->capabilities) < 0) {

-                                        err = -errno;

-                                        r = EXIT_CAPABILITIES;

-                                        goto fail_child;

-                                }

+int exec_spawn(ExecCommand *command,

+               const ExecContext *context,

+               const ExecParameters *params,

+               ExecRuntime *runtime,

+               pid_t *ret) {

-                        if (context->no_new_privileges)