X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=service%2Finstance.c;h=75fd91ff079076928b85fae1665b79bef3c60a3f;hb=e2ed964f963b782de74110efe13529d855e71ea4;hp=f5b61fa42c626bde52c11d80455235b9d47a44b1;hpb=91da63d3d3fd680c805dd1a1b78df5b8731a8173;p=oweals%2Fprocd.git diff --git a/service/instance.c b/service/instance.c index f5b61fa..75fd91f 100644 --- a/service/instance.c +++ b/service/instance.c @@ -12,17 +12,22 @@ * GNU General Public License for more details. */ +#define _GNU_SOURCE #include #include #include #include +#include #include #include #include +#include #include #include #include #include +#define SYSLOG_NAMES +#include #include @@ -31,6 +36,7 @@ #include "service.h" #include "instance.h" +#define UJAIL_BIN_PATH "/sbin/ujail" enum { INSTANCE_ATTR_COMMAND, @@ -45,11 +51,20 @@ enum { INSTANCE_ATTR_WATCH, INSTANCE_ATTR_ERROR, INSTANCE_ATTR_USER, + INSTANCE_ATTR_GROUP, INSTANCE_ATTR_STDOUT, INSTANCE_ATTR_STDERR, + INSTANCE_ATTR_NO_NEW_PRIVS, INSTANCE_ATTR_JAIL, INSTANCE_ATTR_TRACE, INSTANCE_ATTR_SECCOMP, + INSTANCE_ATTR_PIDFILE, + INSTANCE_ATTR_RELOADSIG, + INSTANCE_ATTR_TERMTIMEOUT, + INSTANCE_ATTR_FACILITY, + INSTANCE_ATTR_EXTROOT, + INSTANCE_ATTR_OVERLAYDIR, + INSTANCE_ATTR_TMPOVERLAYSIZE, __INSTANCE_ATTR_MAX }; @@ -66,32 +81,51 @@ static const struct blobmsg_policy instance_attr[__INSTANCE_ATTR_MAX] = { [INSTANCE_ATTR_WATCH] = { "watch", BLOBMSG_TYPE_ARRAY }, [INSTANCE_ATTR_ERROR] = { "error", BLOBMSG_TYPE_ARRAY }, [INSTANCE_ATTR_USER] = { "user", BLOBMSG_TYPE_STRING }, + [INSTANCE_ATTR_GROUP] = { "group", BLOBMSG_TYPE_STRING }, [INSTANCE_ATTR_STDOUT] = { "stdout", BLOBMSG_TYPE_BOOL }, [INSTANCE_ATTR_STDERR] = { "stderr", BLOBMSG_TYPE_BOOL }, + [INSTANCE_ATTR_NO_NEW_PRIVS] = { "no_new_privs", BLOBMSG_TYPE_BOOL }, [INSTANCE_ATTR_JAIL] = { "jail", BLOBMSG_TYPE_TABLE }, [INSTANCE_ATTR_TRACE] = { "trace", BLOBMSG_TYPE_BOOL }, [INSTANCE_ATTR_SECCOMP] = { "seccomp", BLOBMSG_TYPE_STRING }, + [INSTANCE_ATTR_PIDFILE] = { "pidfile", BLOBMSG_TYPE_STRING }, + [INSTANCE_ATTR_RELOADSIG] = { "reload_signal", BLOBMSG_TYPE_INT32 }, + [INSTANCE_ATTR_TERMTIMEOUT] = { "term_timeout", BLOBMSG_TYPE_INT32 }, + [INSTANCE_ATTR_FACILITY] = { "facility", BLOBMSG_TYPE_STRING }, + [INSTANCE_ATTR_EXTROOT] = { "extroot", BLOBMSG_TYPE_STRING }, + [INSTANCE_ATTR_OVERLAYDIR] = { "overlaydir", BLOBMSG_TYPE_STRING }, + [INSTANCE_ATTR_TMPOVERLAYSIZE] = { "tmpoverlaysize", BLOBMSG_TYPE_STRING }, }; enum { JAIL_ATTR_NAME, - JAIL_ATTR_ROOT, + JAIL_ATTR_HOSTNAME, JAIL_ATTR_PROCFS, JAIL_ATTR_SYSFS, JAIL_ATTR_UBUS, JAIL_ATTR_LOG, + JAIL_ATTR_RONLY, JAIL_ATTR_MOUNT, + JAIL_ATTR_NETNS, + JAIL_ATTR_USERNS, + JAIL_ATTR_CGROUPSNS, + JAIL_ATTR_REQUIREJAIL, __JAIL_ATTR_MAX, }; static const struct blobmsg_policy jail_attr[__JAIL_ATTR_MAX] = { [JAIL_ATTR_NAME] = { "name", BLOBMSG_TYPE_STRING }, - [JAIL_ATTR_ROOT] = { "root", BLOBMSG_TYPE_STRING }, + [JAIL_ATTR_HOSTNAME] = { "hostname", BLOBMSG_TYPE_STRING }, [JAIL_ATTR_PROCFS] = { "procfs", BLOBMSG_TYPE_BOOL }, [JAIL_ATTR_SYSFS] = { "sysfs", BLOBMSG_TYPE_BOOL }, [JAIL_ATTR_UBUS] = { "ubus", BLOBMSG_TYPE_BOOL }, [JAIL_ATTR_LOG] = { "log", BLOBMSG_TYPE_BOOL }, + [JAIL_ATTR_RONLY] = { "ronly", BLOBMSG_TYPE_BOOL }, [JAIL_ATTR_MOUNT] = { "mount", BLOBMSG_TYPE_TABLE }, + [JAIL_ATTR_NETNS] = { "netns", BLOBMSG_TYPE_BOOL }, + [JAIL_ATTR_USERNS] = { "userns", BLOBMSG_TYPE_BOOL }, + [JAIL_ATTR_CGROUPSNS] = { "cgroupsns", BLOBMSG_TYPE_BOOL }, + [JAIL_ATTR_REQUIREJAIL] = { "requirejail", BLOBMSG_TYPE_BOOL }, }; struct instance_netdev { @@ -116,25 +150,37 @@ static const struct rlimit_name rlimit_names[] = { { "data", RLIMIT_DATA }, { "fsize", RLIMIT_FSIZE }, { "memlock", RLIMIT_MEMLOCK }, - { "msgqueue", RLIMIT_MSGQUEUE }, - { "nice", RLIMIT_NICE }, { "nofile", RLIMIT_NOFILE }, { "nproc", RLIMIT_NPROC }, { "rss", RLIMIT_RSS }, + { "stack", RLIMIT_STACK }, +#ifdef linux + { "nice", RLIMIT_NICE }, { "rtprio", RLIMIT_RTPRIO }, + { "msgqueue", RLIMIT_MSGQUEUE }, { "sigpending", RLIMIT_SIGPENDING }, - { "stack", RLIMIT_STACK }, +#endif { NULL, 0 } }; -static char trace[] = "/sbin/utrace"; - static void closefd(int fd) { if (fd > STDERR_FILENO) close(fd); } +/* convert a string into numeric syslog facility or return -1 if no match found */ +static int +syslog_facility_str_to_int(const char *facility) +{ + CODE *p = facilitynames; + + while (p->c_name && strcasecmp(p->c_name, facility)) + p++; + + return p->c_val; +} + static void instance_limits(const char *limit, const char *value) { @@ -174,16 +220,16 @@ jail_run(struct service_instance *in, char **argv) struct jail *jail = &in->jail; int argc = 0; - argv[argc++] = "/sbin/ujail"; + argv[argc++] = UJAIL_BIN_PATH; if (jail->name) { argv[argc++] = "-n"; argv[argc++] = jail->name; } - if (jail->root) { - argv[argc++] = "-P"; - argv[argc++] = jail->root; + if (jail->hostname) { + argv[argc++] = "-h"; + argv[argc++] = jail->hostname; } if (in->seccomp) { @@ -191,6 +237,19 @@ jail_run(struct service_instance *in, char **argv) argv[argc++] = in->seccomp; } + if (in->user) { + argv[argc++] = "-U"; + argv[argc++] = in->user; + } + + if (in->group) { + argv[argc++] = "-G"; + argv[argc++] = in->group; + } + + if (in->no_new_privs) + argv[argc++] = "-c"; + if (jail->procfs) argv[argc++] = "-p"; @@ -203,6 +262,36 @@ jail_run(struct service_instance *in, char **argv) if (jail->log) argv[argc++] = "-l"; + if (jail->ronly) + argv[argc++] = "-o"; + + if (jail->netns) + argv[argc++] = "-N"; + + if (jail->userns) + argv[argc++] = "-f"; + + if (jail->cgroupsns) + argv[argc++] = "-F"; + + if (in->extroot) { + argv[argc++] = "-R"; + argv[argc++] = in->extroot; + } + + if (in->overlaydir) { + argv[argc++] = "-O"; + argv[argc++] = in->overlaydir; + } + + if (in->tmpoverlaysize) { + argv[argc++] = "-T"; + argv[argc++] = in->tmpoverlaysize; + } + + if (in->require_jail) + argv[argc++] = "-E"; + blobmsg_list_for_each(&jail->mount, var) { const char *type = blobmsg_data(var->data); @@ -218,6 +307,43 @@ jail_run(struct service_instance *in, char **argv) return argc; } +static int +instance_removepid(struct service_instance *in) { + if (!in->pidfile) + return 0; + if (unlink(in->pidfile)) { + ERROR("Failed to remove pidfile: %s: %m\n", in->pidfile); + return 1; + } + return 0; +} + +static int +instance_writepid(struct service_instance *in) +{ + FILE *_pidfile; + + if (!in->pidfile) { + return 0; + } + _pidfile = fopen(in->pidfile, "w"); + if (_pidfile == NULL) { + ERROR("failed to open pidfile for writing: %s: %m", in->pidfile); + return 1; + } + if (fprintf(_pidfile, "%d\n", in->proc.pid) < 0) { + ERROR("failed to write pidfile: %s: %m", in->pidfile); + fclose(_pidfile); + return 2; + } + if (fclose(_pidfile)) { + ERROR("failed to close pidfile: %s: %m", in->pidfile); + return 3; + } + + return 0; +} + static void instance_run(struct service_instance *in, int _stdout, int _stderr) { @@ -226,6 +352,8 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) char **argv; int argc = 1; /* NULL terminated */ int rem, _stdin; + bool seccomp = !in->trace && !in->has_jail && in->seccomp; + bool setlbf = _stdout >= 0; if (in->nice) setpriority(PRIO_PROCESS, 0, in->nice); @@ -236,25 +364,37 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) blobmsg_list_for_each(&in->env, var) setenv(blobmsg_name(var->data), blobmsg_data(var->data), 1); - if (!in->trace && !in->has_jail && in->seccomp) { + if (seccomp) setenv("SECCOMP_FILE", in->seccomp, 1); - setenv("LD_PRELOAD", "/lib/libpreload-seccomp.so", 1); - } + + if (setlbf) + setenv("LD_PRELOAD", "/lib/libsetlbf.so", 1); blobmsg_list_for_each(&in->limits, var) instance_limits(blobmsg_name(var->data), blobmsg_data(var->data)); - if (in->trace) + if (in->trace || seccomp) argc += 1; argv = alloca(sizeof(char *) * (argc + in->jail.argc)); argc = 0; +#ifdef SECCOMP_SUPPORT if (in->trace) - argv[argc++] = trace; + argv[argc++] = "/sbin/utrace"; + else if (seccomp) + argv[argc++] = "/sbin/seccomp-trace"; +#else + if (in->trace || seccomp) + ULOG_WARN("Seccomp support for %s::%s not available\n", in->srv->name, in->name); +#endif - if (in->has_jail) + if (in->has_jail) { argc = jail_run(in, argv); + if (argc != in->jail.argc) + ULOG_WARN("expected %i jail params, used %i for %s::%s\n", + in->jail.argc, argc, in->srv->name, in->name); + } blobmsg_for_each_attr(cur, in->command, rem) argv[argc++] = blobmsg_data(cur); @@ -282,16 +422,39 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) closefd(_stderr); } - if (in->uid || in->gid) { - if (setuid(in->uid) || setgid(in->gid)) { - ERROR("failed to set uid:%d, gid:%d\n", in->uid, in->gid); - exit(127); - } + if (!in->has_jail && in->user && in->pw_gid && initgroups(in->user, in->pw_gid)) { + ERROR("failed to initgroups() for user %s: %m\n", in->user); + exit(127); + } + if (!in->has_jail && in->gr_gid && setgid(in->gr_gid)) { + ERROR("failed to set group id %d: %m\n", in->gr_gid); + exit(127); + } + if (!in->has_jail && in->uid && setuid(in->uid)) { + ERROR("failed to set user id %d: %m\n", in->uid); + exit(127); } + execvp(argv[0], argv); exit(127); } +static void +instance_free_stdio(struct service_instance *in) +{ + if (in->_stdout.fd.fd > -1) { + ustream_free(&in->_stdout.stream); + close(in->_stdout.fd.fd); + in->_stdout.fd.fd = -1; + } + + if (in->_stderr.fd.fd > -1) { + ustream_free(&in->_stderr.stream); + close(in->_stderr.fd.fd); + in->_stderr.fd.fd = -1; + } +} + void instance_start(struct service_instance *in) { @@ -304,25 +467,34 @@ instance_start(struct service_instance *in) return; } - if (in->proc.pending) + if (!in->command) { + LOG("Not starting instance %s::%s, command not set\n", in->srv->name, in->name); return; + } + if (in->proc.pending) { + if (in->halt) + in->restart = true; + return; + } + + instance_free_stdio(in); if (in->_stdout.fd.fd > -2) { if (pipe(opipe)) { - ULOG_WARN("pipe() failed: %d (%s)\n", errno, strerror(errno)); + ULOG_WARN("pipe() failed: %m\n"); opipe[0] = opipe[1] = -1; } } if (in->_stderr.fd.fd > -2) { if (pipe(epipe)) { - ULOG_WARN("pipe() failed: %d (%s)\n", errno, strerror(errno)); + ULOG_WARN("pipe() failed: %m\n"); epipe[0] = epipe[1] = -1; } } in->restart = false; - in->halt = !in->respawn; + in->halt = false; if (!in->valid) return; @@ -339,19 +511,22 @@ instance_start(struct service_instance *in) return; } - DEBUG(2, "Started instance %s::%s\n", in->srv->name, in->name); + DEBUG(2, "Started instance %s::%s[%d]\n", in->srv->name, in->name, pid); in->proc.pid = pid; + instance_writepid(in); clock_gettime(CLOCK_MONOTONIC, &in->start); uloop_process_add(&in->proc); if (opipe[0] > -1) { ustream_fd_init(&in->_stdout, opipe[0]); closefd(opipe[1]); + fcntl(opipe[0], F_SETFD, FD_CLOEXEC); } if (epipe[0] > -1) { ustream_fd_init(&in->_stderr, epipe[0]); closefd(epipe[1]); + fcntl(epipe[0], F_SETFD, FD_CLOEXEC); } service_event("instance.start", in->srv->name, in->name); @@ -363,27 +538,29 @@ instance_stdio(struct ustream *s, int prio, struct service_instance *in) char *newline, *str, *arg0, ident[32]; int len; + arg0 = basename(blobmsg_data(blobmsg_data(in->command))); + snprintf(ident, sizeof(ident), "%s[%d]", arg0, in->proc.pid); + ulog_open(ULOG_SYSLOG, in->syslog_facility, ident); + do { - str = ustream_get_read_buf(s, NULL); + str = ustream_get_read_buf(s, &len); if (!str) break; - newline = strchr(str, '\n'); - if (!newline) + newline = memchr(str, '\n', len); + if (!newline && (s->r.buffer_len != len)) break; - *newline = 0; - len = newline + 1 - str; - - arg0 = basename(blobmsg_data(blobmsg_data(in->command))); - snprintf(ident, sizeof(ident), "%s[%d]", arg0, in->proc.pid); - - ulog_open(ULOG_SYSLOG, LOG_DAEMON, ident); + if (newline) { + *newline = 0; + len = newline + 1 - str; + } ulog(prio, "%s\n", str); - ulog_open(ULOG_SYSLOG, LOG_DAEMON, "procd"); ustream_consume(s, len); } while (1); + + ulog_open(ULOG_SYSLOG, LOG_DAEMON, "procd"); } static void @@ -407,10 +584,42 @@ instance_timeout(struct uloop_timeout *t) in = container_of(t, struct service_instance, timeout); - if (!in->halt && (in->restart || in->respawn)) + if (in->halt) { + LOG("Instance %s::%s pid %d not stopped on SIGTERM, sending SIGKILL instead\n", + in->srv->name, in->name, in->proc.pid); + kill(in->proc.pid, SIGKILL); + } else if (in->restart || in->respawn) instance_start(in); } +static void +instance_delete(struct service_instance *in) +{ + struct service *s = in->srv; + + avl_delete(&s->instances.avl, &in->node.avl); + instance_free(in); + service_stopped(s); +} + +static int +instance_exit_code(int ret) +{ + if (WIFEXITED(ret)) { + return WEXITSTATUS(ret); + } + + if (WIFSIGNALED(ret)) { + return SIGNALLED_OFFSET + WTERMSIG(ret); + } + + if (WIFSTOPPED(ret)) { + return WSTOPSIG(ret); + } + + return 1; +} + static void instance_exit(struct uloop_process *p, int ret) { @@ -424,12 +633,17 @@ instance_exit(struct uloop_process *p, int ret) runtime = tp.tv_sec - in->start.tv_sec; DEBUG(2, "Instance %s::%s exit with error code %d after %ld seconds\n", in->srv->name, in->name, ret, runtime); - if (upgrade_running) - return; + in->exit_code = instance_exit_code(ret); uloop_timeout_cancel(&in->timeout); + service_event("instance.stop", in->srv->name, in->name); + if (in->halt) { - /* no action */ + instance_removepid(in); + if (in->restart) + instance_start(in); + else + instance_delete(in); } else if (in->restart) { instance_start(in); } else if (in->respawn) { @@ -442,21 +656,26 @@ instance_exit(struct uloop_process *p, int ret) in->srv->name, in->name, in->respawn_count, runtime); in->restart = in->respawn = 0; in->halt = 1; + service_event("instance.fail", in->srv->name, in->name); } else { + service_event("instance.respawn", in->srv->name, in->name); uloop_timeout_set(&in->timeout, in->respawn_timeout * 1000); } } - service_event("instance.stop", in->srv->name, in->name); } void -instance_stop(struct service_instance *in) +instance_stop(struct service_instance *in, bool halt) { - if (!in->proc.pending) + if (!in->proc.pending) { + if (halt) + instance_delete(in); return; - in->halt = true; + } + in->halt = halt; in->restart = in->respawn = false; kill(in->proc.pid, SIGTERM); + uloop_timeout_set(&in->timeout, in->term_timeout * 1000); } static void @@ -464,9 +683,21 @@ instance_restart(struct service_instance *in) { if (!in->proc.pending) return; - in->halt = false; + + if (in->reload_signal) { + kill(in->proc.pid, in->reload_signal); + return; + } + + in->halt = true; in->restart = true; kill(in->proc.pid, SIGTERM); + uloop_timeout_set(&in->timeout, in->term_timeout * 1000); +} + +static bool string_changed(const char *a, const char *b) +{ + return !((!a && !b) || (a && b && !strcmp(a, b))); } static bool @@ -481,9 +712,6 @@ instance_config_changed(struct service_instance *in, struct service_instance *in if (!blobmsg_list_equal(&in->env, &in_new->env)) return true; - if (!blobmsg_list_equal(&in->data, &in_new->data)) - return true; - if (!blobmsg_list_equal(&in->netdev, &in_new->netdev)) return true; @@ -493,10 +721,34 @@ instance_config_changed(struct service_instance *in, struct service_instance *in if (in->nice != in_new->nice) return true; + if (in->syslog_facility != in_new->syslog_facility) + return true; + + if (string_changed(in->user, in_new->user)) + return true; + + if (string_changed(in->group, in_new->group)) + return true; + if (in->uid != in_new->uid) return true; - if (in->gid != in_new->gid) + if (in->pw_gid != in_new->pw_gid) + return true; + + if (string_changed(in->pidfile, in_new->pidfile)) + return true; + + if (in->respawn_retry != in_new->respawn_retry) + return true; + if (in->respawn_threshold != in_new->respawn_threshold) + return true; + if (in->respawn_timeout != in_new->respawn_timeout) + return true; + + if ((!in->seccomp && in_new->seccomp) || + (in->seccomp && !in_new->seccomp) || + (in->seccomp && in_new->seccomp && strcmp(in->seccomp, in_new->seccomp))) return true; if (!blobmsg_list_equal(&in->limits, &in_new->limits)) @@ -603,22 +855,22 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr) { struct blob_attr *tb[__JAIL_ATTR_MAX]; struct jail *jail = &in->jail; - struct stat s; - - if (stat("/sbin/ujail", &s)) - return 0; blobmsg_parse(jail_attr, __JAIL_ATTR_MAX, tb, blobmsg_data(attr), blobmsg_data_len(attr)); jail->argc = 2; + if (tb[JAIL_ATTR_REQUIREJAIL]) { + in->require_jail = true; + jail->argc++; + } if (tb[JAIL_ATTR_NAME]) { - jail->name = blobmsg_get_string(tb[JAIL_ATTR_NAME]); + jail->name = strdup(blobmsg_get_string(tb[JAIL_ATTR_NAME])); jail->argc += 2; } - if (tb[JAIL_ATTR_ROOT]) { - jail->root = blobmsg_get_string(tb[JAIL_ATTR_ROOT]); + if (tb[JAIL_ATTR_HOSTNAME]) { + jail->hostname = strdup(blobmsg_get_string(tb[JAIL_ATTR_HOSTNAME])); jail->argc += 2; } if (tb[JAIL_ATTR_PROCFS]) { @@ -637,6 +889,23 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr) jail->log = blobmsg_get_bool(tb[JAIL_ATTR_LOG]); jail->argc++; } + if (tb[JAIL_ATTR_RONLY]) { + jail->ronly = blobmsg_get_bool(tb[JAIL_ATTR_RONLY]); + jail->argc++; + } + if (tb[JAIL_ATTR_NETNS]) { + jail->netns = blobmsg_get_bool(tb[JAIL_ATTR_NETNS]); + jail->argc++; + } + if (tb[JAIL_ATTR_USERNS]) { + jail->userns = blobmsg_get_bool(tb[JAIL_ATTR_USERNS]); + jail->argc++; + } + if (tb[JAIL_ATTR_CGROUPSNS]) { + jail->cgroupsns = blobmsg_get_bool(tb[JAIL_ATTR_CGROUPSNS]); + jail->argc++; + } + if (tb[JAIL_ATTR_MOUNT]) { struct blob_attr *cur; int rem; @@ -648,36 +917,68 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr) if (in->seccomp) jail->argc += 2; - return 1; + if (in->user) + jail->argc += 2; + + if (in->group) + jail->argc += 2; + + if (in->extroot) + jail->argc += 2; + + if (in->overlaydir) + jail->argc += 2; + + if (in->tmpoverlaysize) + jail->argc += 2; + + if (in->no_new_privs) + jail->argc++; + + return true; } static bool -instance_config_parse(struct service_instance *in) +instance_config_parse_command(struct service_instance *in, struct blob_attr **tb) { - struct blob_attr *tb[__INSTANCE_ATTR_MAX]; struct blob_attr *cur, *cur2; - int argc = 0; + bool ret = false; int rem; - blobmsg_parse(instance_attr, __INSTANCE_ATTR_MAX, tb, - blobmsg_data(in->config), blobmsg_data_len(in->config)); - cur = tb[INSTANCE_ATTR_COMMAND]; - if (!cur) - return false; + if (!cur) { + in->command = NULL; + return true; + } if (!blobmsg_check_attr_list(cur, BLOBMSG_TYPE_STRING)) return false; blobmsg_for_each_attr(cur2, cur, rem) { - argc++; + ret = true; break; } - if (!argc) - return false; in->command = cur; + return ret; +} +static bool +instance_config_parse(struct service_instance *in) +{ + struct blob_attr *tb[__INSTANCE_ATTR_MAX]; + struct blob_attr *cur, *cur2; + struct stat s; + int rem, r; + + blobmsg_parse(instance_attr, __INSTANCE_ATTR_MAX, tb, + blobmsg_data(in->config), blobmsg_data_len(in->config)); + + if (!instance_config_parse_command(in, tb)) + return false; + + if (tb[INSTANCE_ATTR_TERMTIMEOUT]) + in->term_timeout = blobmsg_get_u32(tb[INSTANCE_ATTR_TERMTIMEOUT]); if (tb[INSTANCE_ATTR_RESPAWN]) { int i = 0; uint32_t vals[3] = { 3600, 5, 5}; @@ -715,28 +1016,67 @@ instance_config_parse(struct service_instance *in) } if (tb[INSTANCE_ATTR_USER]) { - struct passwd *p = getpwnam(blobmsg_get_string(tb[INSTANCE_ATTR_USER])); + const char *user = blobmsg_get_string(tb[INSTANCE_ATTR_USER]); + struct passwd *p = getpwnam(user); if (p) { + in->user = strdup(user); in->uid = p->pw_uid; - in->gid = p->pw_gid; + in->gr_gid = in->pw_gid = p->pw_gid; + } + } + + if (tb[INSTANCE_ATTR_GROUP]) { + const char *group = blobmsg_get_string(tb[INSTANCE_ATTR_GROUP]); + struct group *p = getgrnam(group); + if (p) { + in->group = strdup(group); + in->gr_gid = p->gr_gid; } } if (tb[INSTANCE_ATTR_TRACE]) in->trace = blobmsg_get_bool(tb[INSTANCE_ATTR_TRACE]); - if (!in->trace && tb[INSTANCE_ATTR_SECCOMP]) { - char *seccomp = blobmsg_get_string(tb[INSTANCE_ATTR_SECCOMP]); - struct stat s; + if (tb[INSTANCE_ATTR_NO_NEW_PRIVS]) + in->no_new_privs = blobmsg_get_bool(tb[INSTANCE_ATTR_NO_NEW_PRIVS]); - if (stat(seccomp, &s)) - ERROR("%s: not starting seccomp as %s is missing\n", in->name, seccomp); - else - in->seccomp = seccomp; + if (!in->trace && tb[INSTANCE_ATTR_SECCOMP]) + in->seccomp = strdup(blobmsg_get_string(tb[INSTANCE_ATTR_SECCOMP])); + + if (tb[INSTANCE_ATTR_EXTROOT]) + in->extroot = strdup(blobmsg_get_string(tb[INSTANCE_ATTR_EXTROOT])); + + if (tb[INSTANCE_ATTR_OVERLAYDIR]) + in->overlaydir = strdup(blobmsg_get_string(tb[INSTANCE_ATTR_OVERLAYDIR])); + + if (tb[INSTANCE_ATTR_TMPOVERLAYSIZE]) + in->tmpoverlaysize = strdup(blobmsg_get_string(tb[INSTANCE_ATTR_TMPOVERLAYSIZE])); + + if (tb[INSTANCE_ATTR_PIDFILE]) { + char *pidfile = blobmsg_get_string(tb[INSTANCE_ATTR_PIDFILE]); + if (pidfile) + in->pidfile = strdup(pidfile); } + + if (tb[INSTANCE_ATTR_RELOADSIG]) + in->reload_signal = blobmsg_get_u32(tb[INSTANCE_ATTR_RELOADSIG]); + if (!in->trace && tb[INSTANCE_ATTR_JAIL]) in->has_jail = instance_jail_parse(in, tb[INSTANCE_ATTR_JAIL]); + if (in->has_jail) { + r = stat(UJAIL_BIN_PATH, &s); + if (r < 0) { + if (in->require_jail) { + ERROR("Cannot jail service %s::%s. %s: %m (%d)\n", + in->srv->name, in->name, UJAIL_BIN_PATH, r); + return false; + } + DEBUG(2, "unable to find %s: %m (%d)\n", UJAIL_BIN_PATH, r); + in->has_jail = false; + } + } + if (tb[INSTANCE_ATTR_STDOUT] && blobmsg_get_bool(tb[INSTANCE_ATTR_STDOUT])) in->_stdout.fd.fd = -1; @@ -760,6 +1100,15 @@ instance_config_parse(struct service_instance *in) if (!instance_fill_array(&in->errors, tb[INSTANCE_ATTR_ERROR], NULL, true)) return false; + if (tb[INSTANCE_ATTR_FACILITY]) { + int facility = syslog_facility_str_to_int(blobmsg_get_string(tb[INSTANCE_ATTR_FACILITY])); + if (facility != -1) { + in->syslog_facility = facility; + DEBUG(3, "setting facility '%s'\n", blobmsg_get_string(tb[INSTANCE_ATTR_FACILITY])); + } else + DEBUG(3, "unknown syslog facility '%s' given, using default (LOG_DAEMON)\n", blobmsg_get_string(tb[INSTANCE_ATTR_FACILITY])); + } + return true; } @@ -775,6 +1124,20 @@ instance_config_cleanup(struct service_instance *in) blobmsg_list_free(&in->jail.mount); } +static void +instance_config_move_strdup(char **dst, char *src) +{ + if (*dst) { + free(*dst); + *dst = NULL; + } + + if (!src) + return; + + *dst = strdup(src); +} + static void instance_config_move(struct service_instance *in, struct service_instance *in_src) { @@ -788,54 +1151,62 @@ instance_config_move(struct service_instance *in, struct service_instance *in_sr blobmsg_list_move(&in->jail.mount, &in_src->jail.mount); in->trigger = in_src->trigger; in->command = in_src->command; + in->respawn = in_src->respawn; + in->respawn_retry = in_src->respawn_retry; + in->respawn_threshold = in_src->respawn_threshold; + in->respawn_timeout = in_src->respawn_timeout; in->name = in_src->name; + in->trace = in_src->trace; in->node.avl.key = in_src->node.avl.key; + in->syslog_facility = in_src->syslog_facility; + + instance_config_move_strdup(&in->pidfile, in_src->pidfile); + instance_config_move_strdup(&in->seccomp, in_src->seccomp); + instance_config_move_strdup(&in->jail.name, in_src->jail.name); + instance_config_move_strdup(&in->jail.hostname, in_src->jail.hostname); free(in->config); in->config = in_src->config; in_src->config = NULL; } -bool +void instance_update(struct service_instance *in, struct service_instance *in_new) { bool changed = instance_config_changed(in, in_new); bool running = in->proc.pending; + bool stopping = in->halt; - if (!changed && running) - return false; - - if (!running) { - if (changed) - instance_config_move(in, in_new); + if (!running || stopping) { + instance_config_move(in, in_new); instance_start(in); } else { - instance_restart(in); + if (changed) + instance_restart(in); instance_config_move(in, in_new); /* restart happens in the child callback handler */ } - return true; } void instance_free(struct service_instance *in) { - if (in->_stdout.fd.fd > -1) { - ustream_free(&in->_stdout.stream); - close(in->_stdout.fd.fd); - } - - if (in->_stderr.fd.fd > -1) { - ustream_free(&in->_stderr.stream); - close(in->_stderr.fd.fd); - } - + instance_free_stdio(in); uloop_process_delete(&in->proc); uloop_timeout_cancel(&in->timeout); trigger_del(in); watch_del(in); instance_config_cleanup(in); free(in->config); + free(in->user); + free(in->group); + free(in->extroot); + free(in->overlaydir); + free(in->tmpoverlaysize); + free(in->jail.name); + free(in->jail.hostname); + free(in->seccomp); + free(in->pidfile); free(in); } @@ -848,6 +1219,10 @@ instance_init(struct service_instance *in, struct service *s, struct blob_attr * in->config = config; in->timeout.cb = instance_timeout; in->proc.cb = instance_exit; + in->term_timeout = 5; + in->syslog_facility = LOG_DAEMON; + in->exit_code = 0; + in->require_jail = false; in->_stdout.fd.fd = -2; in->_stdout.stream.string_data = true; @@ -871,11 +1246,18 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose) { void *i; + if (!in->valid) + return; + i = blobmsg_open_table(b, in->name); blobmsg_add_u8(b, "running", in->proc.pending); if (in->proc.pending) blobmsg_add_u32(b, "pid", in->proc.pid); - blobmsg_add_blob(b, in->command); + if (in->command) + blobmsg_add_blob(b, in->command); + blobmsg_add_u32(b, "term_timeout", in->term_timeout); + if (!in->proc.pending) + blobmsg_add_u32(b, "exit_code", in->exit_code); if (!avl_is_empty(&in->errors.avl)) { struct blobmsg_list_node *var; @@ -909,10 +1291,13 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose) blobmsg_close_table(b, e); } + if (in->reload_signal) + blobmsg_add_u32(b, "reload_signal", in->reload_signal); + if (in->respawn) { void *r = blobmsg_open_table(b, "respawn"); - blobmsg_add_u32(b, "timeout", in->respawn_timeout); blobmsg_add_u32(b, "threshold", in->respawn_threshold); + blobmsg_add_u32(b, "timeout", in->respawn_timeout); blobmsg_add_u32(b, "retry", in->respawn_retry); blobmsg_close_table(b, r); } @@ -920,19 +1305,36 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose) if (in->trace) blobmsg_add_u8(b, "trace", true); + if (in->no_new_privs) + blobmsg_add_u8(b, "no_new_privs", true); + if (in->seccomp) blobmsg_add_string(b, "seccomp", in->seccomp); + if (in->pidfile) + blobmsg_add_string(b, "pidfile", in->pidfile); + + if (in->user) + blobmsg_add_string(b, "user", in->user); + + if (in->group) + blobmsg_add_string(b, "group", in->group); + if (in->has_jail) { void *r = blobmsg_open_table(b, "jail"); if (in->jail.name) blobmsg_add_string(b, "name", in->jail.name); - if (in->jail.root) - blobmsg_add_string(b, "root", in->jail.root); + if (in->jail.hostname) + blobmsg_add_string(b, "hostname", in->jail.hostname); + blobmsg_add_u8(b, "procfs", in->jail.procfs); blobmsg_add_u8(b, "sysfs", in->jail.sysfs); blobmsg_add_u8(b, "ubus", in->jail.ubus); blobmsg_add_u8(b, "log", in->jail.log); + blobmsg_add_u8(b, "ronly", in->jail.ronly); + blobmsg_add_u8(b, "netns", in->jail.netns); + blobmsg_add_u8(b, "userns", in->jail.userns); + blobmsg_add_u8(b, "cgroupsns", in->jail.cgroupsns); blobmsg_close_table(b, r); if (!avl_is_empty(&in->jail.mount.avl)) { struct blobmsg_list_node *var; @@ -943,6 +1345,13 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose) } } + if (in->extroot) + blobmsg_add_string(b, "extroot", in->extroot); + if (in->overlaydir) + blobmsg_add_string(b, "overlaydir", in->overlaydir); + if (in->tmpoverlaysize) + blobmsg_add_string(b, "tmpoverlaysize", in->tmpoverlaysize); + if (verbose && in->trigger) blobmsg_add_blob(b, in->trigger);