#include <sys/mount.h>

#include <sys/prctl.h>

#if HAVE_SECCOMP

#include <seccomp.h>

#include "af-list.h"

#include "alloc-util.h"

#include "bus-get-properties.h"

#include "cap-list.h"

#include "capability-util.h"

#include "cpu-set-util.h"

#include "creds-util.h"

#include "dbus-execute.h"

#include "dbus-util.h"

#include "env-util.h"

#include "errno-list.h"

#include "escape.h"

#include "execute.h"

#include "fd-util.h"

#include "fileio.h"

#include "hexdecoct.h"

#include "io-util.h"

#include "ioprio-util.h"

#include "journal-file.h"

#include "missing_ioprio.h"

#include "mountpoint-util.h"

#include "namespace.h"

#include "parse-util.h"

#include "path-util.h"

#include "process-util.h"

#include "rlimit-util.h"

#if HAVE_SECCOMP

#include "seccomp-util.h"

#include "securebits-util.h"

#include "specifier.h"

#include "stat-util.h"

#include "strv.h"

#include "syslog-util.h"

#include "unit-printf.h"

#include "user-util.h"

#include "utf8.h"

BUS_DEFINE_PROPERTY_GET_ENUM(bus_property_get_exec_output, exec_output, ExecOutput);

static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_input, exec_input, ExecInput);

static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_utmp_mode, exec_utmp_mode, ExecUtmpMode);

static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_preserve_mode, exec_preserve_mode, ExecPreserveMode);

static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_exec_keyring_mode, exec_keyring_mode, ExecKeyringMode);

static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_protect_proc, protect_proc, ProtectProc);

static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_proc_subset, proc_subset, ProcSubset);

static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_protect_home, protect_home, ProtectHome);

static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_protect_system, protect_system, ProtectSystem);

static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_personality, personality, unsigned long);

static BUS_DEFINE_PROPERTY_GET(property_get_ioprio, "i", ExecContext, exec_context_get_effective_ioprio);

static BUS_DEFINE_PROPERTY_GET(property_get_mount_apivfs, "b", ExecContext, exec_context_get_effective_mount_apivfs);

static BUS_DEFINE_PROPERTY_GET2(property_get_ioprio_class, "i", ExecContext, exec_context_get_effective_ioprio, ioprio_prio_class);

static BUS_DEFINE_PROPERTY_GET2(property_get_ioprio_priority, "i", ExecContext, exec_context_get_effective_ioprio, ioprio_prio_data);

static BUS_DEFINE_PROPERTY_GET_GLOBAL(property_get_empty_string, "s", NULL);

static BUS_DEFINE_PROPERTY_GET_REF(property_get_syslog_level, "i", int, LOG_PRI);

static BUS_DEFINE_PROPERTY_GET_REF(property_get_syslog_facility, "i", int, LOG_FAC);

static BUS_DEFINE_PROPERTY_GET(property_get_cpu_affinity_from_numa, "b", ExecContext, exec_context_get_cpu_affinity_from_numa);

static int property_get_environment_files(

sd_bus_error *error) {

ExecContext *c = userdata;

int r;

assert(bus);

assert(reply);

assert(c);

r = sd_bus_message_open_container(reply, 'a', "(sb)");

if (r < 0)

return r;

STRV_FOREACH(j, c->environment_files) {

const char *fn = *j;

r = sd_bus_message_append(reply, "(sb)", fn[0] == '-' ? fn + 1 : fn, fn[0] == '-');

if (r < 0)

return r;

}

return sd_bus_message_close_container(reply);

}

static int property_get_oom_score_adjust(

sd_bus_error *error) {

ExecContext *c = userdata;

int r, n;

assert(bus);

assert(reply);

assert(c);

if (c->oom_score_adjust_set)

n = c->oom_score_adjust;

else {

n = 0;

r = get_oom_score_adjust(&n);

if (r < 0)

log_debug_errno(r, "Failed to read /proc/self/oom_score_adj, ignoring: %m");

}

return sd_bus_message_append(reply, "i", n);

}

static int property_get_coredump_filter(

sd_bus_error *error) {

ExecContext *c = userdata;

uint64_t n;

int r;

assert(bus);

assert(reply);

assert(c);

if (c->coredump_filter_set)

n = c->coredump_filter;

else {

_cleanup_free_ char *t = NULL;

n = COREDUMP_FILTER_MASK_DEFAULT;

r = read_one_line_file("/proc/self/coredump_filter", &t);

if (r < 0)

log_debug_errno(r, "Failed to read /proc/self/coredump_filter, ignoring: %m");

else {

r = safe_atoux64(t, &n);

if (r < 0)

log_debug_errno(r, "Failed to parse \"%s\" from /proc/self/coredump_filter, ignoring: %m", t);

}

}

return sd_bus_message_append(reply, "t", n);

}

static int property_get_nice(

sd_bus_error *error) {

ExecContext *c = userdata;

int32_t n;

assert(bus);

assert(reply);

assert(c);

if (c->nice_set)

n = c->nice;

else {

errno = 0;

n = getpriority(PRIO_PROCESS, 0);

if (errno > 0)

n = 0;

}

return sd_bus_message_append(reply, "i", n);

}

static int property_get_cpu_sched_policy(

sd_bus_error *error) {

ExecContext *c = userdata;

int32_t n;

assert(bus);

assert(reply);

assert(c);

if (c->cpu_sched_set)

n = c->cpu_sched_policy;

else {

n = sched_getscheduler(0);

if (n < 0)

n = SCHED_OTHER;

}

return sd_bus_message_append(reply, "i", n);

}

static int property_get_cpu_sched_priority(

sd_bus_error *error) {

ExecContext *c = userdata;

int32_t n;

assert(bus);

assert(reply);

assert(c);

if (c->cpu_sched_set)

n = c->cpu_sched_priority;

else {

struct sched_param p = {};

if (sched_getparam(0, &p) >= 0)

n = p.sched_priority;

else

n = 0;

}

return sd_bus_message_append(reply, "i", n);

}

static int property_get_cpu_affinity(

sd_bus_error *error) {

ExecContext *c = userdata;

_cleanup_(cpu_set_reset) CPUSet s = {};

_cleanup_free_ uint8_t *array = NULL;

size_t allocated;

assert(bus);

assert(reply);

assert(c);

if (c->cpu_affinity_from_numa) {

int r;

r = numa_to_cpu_set(&c->numa_policy, &s);

if (r < 0)

return r;

}

(void) cpu_set_to_dbus(c->cpu_affinity_from_numa ? &s : &c->cpu_set, &array, &allocated);

return sd_bus_message_append_array(reply, 'y', array, allocated);

}

static int property_get_numa_mask(

sd_bus_error *error) {

ExecContext *c = userdata;

_cleanup_free_ uint8_t *array = NULL;

size_t allocated;

assert(bus);

assert(reply);

assert(c);

(void) cpu_set_to_dbus(&c->numa_policy.nodes, &array, &allocated);

return sd_bus_message_append_array(reply, 'y', array, allocated);

}

static int property_get_numa_policy(

sd_bus_error *error) {

ExecContext *c = userdata;

int32_t policy;

assert(bus);

assert(reply);

assert(c);

policy = numa_policy_get_type(&c->numa_policy);

return sd_bus_message_append_basic(reply, 'i', &policy);

}

static int property_get_timer_slack_nsec(

sd_bus_error *error) {

ExecContext *c = userdata;

uint64_t u;

assert(bus);

assert(reply);

assert(c);

if (c->timer_slack_nsec != NSEC_INFINITY)

u = (uint64_t) c->timer_slack_nsec;

else

u = (uint64_t) prctl(PR_GET_TIMERSLACK);

return sd_bus_message_append(reply, "t", u);

}

static int property_get_syscall_filter(

sd_bus_error *error) {

ExecContext *c = userdata;

_cleanup_strv_free_ char **l = NULL;

int r;

#if HAVE_SECCOMP

void *id, *val;

assert(bus);

assert(reply);

assert(c);

r = sd_bus_message_open_container(reply, 'r', "bas");

if (r < 0)

return r;

r = sd_bus_message_append(reply, "b", c->syscall_allow_list);

if (r < 0)

return r;

#if HAVE_SECCOMP

HASHMAP_FOREACH_KEY(val, id, c->syscall_filter) {

_cleanup_free_ char *name = NULL;

const char *e = NULL;

char *s;

int num = PTR_TO_INT(val);

name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);

if (!name)

continue;

if (num >= 0) {

e = seccomp_errno_or_action_to_string(num);

if (e) {

s = strjoin(name, ":", e);

if (!s)

return -ENOMEM;

} else {

r = asprintf(&s, "%s:%d", name, num);

if (r < 0)

return -ENOMEM;

}

} else

s = TAKE_PTR(name);

r = strv_consume(&l, s);

if (r < 0)

return r;

}

strv_sort(l);

r = sd_bus_message_append_strv(reply, l);

if (r < 0)

return r;

return sd_bus_message_close_container(reply);

}

static int property_get_syscall_log(

sd_bus_error *error) {

ExecContext *c = userdata;

_cleanup_strv_free_ char **l = NULL;

int r;

#if HAVE_SECCOMP

void *id, *val;

assert(bus);

assert(reply);

assert(c);

r = sd_bus_message_open_container(reply, 'r', "bas");

if (r < 0)

return r;

r = sd_bus_message_append(reply, "b", c->syscall_log_allow_list);

if (r < 0)

return r;

#if HAVE_SECCOMP

HASHMAP_FOREACH_KEY(val, id, c->syscall_log) {

char *name = NULL;

name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);

if (!name)

continue;

r = strv_consume(&l, name);

if (r < 0)

return r;

}

strv_sort(l);

r = sd_bus_message_append_strv(reply, l);

if (r < 0)

return r;

return sd_bus_message_close_container(reply);

}

static int property_get_syscall_archs(

sd_bus_error *error) {

ExecContext *c = userdata;

_cleanup_strv_free_ char **l = NULL;

int r;

#if HAVE_SECCOMP

void *id;

assert(bus);

assert(reply);

assert(c);

#if HAVE_SECCOMP

SET_FOREACH(id, c->syscall_archs) {

const char *name;

name = seccomp_arch_to_string(PTR_TO_UINT32(id) - 1);

if (!name)

continue;

r = strv_extend(&l, name);

if (r < 0)

return -ENOMEM;

}

strv_sort(l);

r = sd_bus_message_append_strv(reply, l);

if (r < 0)

return r;

return 0;

}

static int property_get_selinux_context(

sd_bus_error *error) {

ExecContext *c = userdata;

assert(bus);

assert(reply);

assert(c);

return sd_bus_message_append(reply, "(bs)", c->selinux_context_ignore, c->selinux_context);

}

static int property_get_apparmor_profile(

sd_bus_error *error) {

ExecContext *c = userdata;

assert(bus);

assert(reply);

assert(c);

return sd_bus_message_append(reply, "(bs)", c->apparmor_profile_ignore, c->apparmor_profile);

}

static int property_get_smack_process_label(

sd_bus_error *error) {

ExecContext *c = userdata;

assert(bus);

assert(reply);

assert(c);

return sd_bus_message_append(reply, "(bs)", c->smack_process_label_ignore, c->smack_process_label);

}

static int property_get_address_families(

sd_bus_error *error) {

ExecContext *c = userdata;

_cleanup_strv_free_ char **l = NULL;

void *af;

int r;

assert(bus);

assert(reply);

assert(c);

r = sd_bus_message_open_container(reply, 'r', "bas");

if (r < 0)

return r;

r = sd_bus_message_append(reply, "b", c->address_families_allow_list);

if (r < 0)

return r;

SET_FOREACH(af, c->address_families) {

const char *name;

name = af_to_name(PTR_TO_INT(af));

if (!name)

continue;

r = strv_extend(&l, name);

if (r < 0)

return -ENOMEM;

}

strv_sort(l);

r = sd_bus_message_append_strv(reply, l);

if (r < 0)

return r;

return sd_bus_message_close_container(reply);

}

static int property_get_working_directory(

sd_bus_error *error) {

ExecContext *c = userdata;

const char *wd;

assert(bus);

assert(reply);

assert(c);

if (c->working_directory_home)

wd = "~";

else

wd = c->working_directory;

if (c->working_directory_missing_ok)

wd = strjoina("!", wd);

return sd_bus_message_append(reply, "s", wd);

}

static int property_get_stdio_fdname(

sd_bus_error *error) {

ExecContext *c = userdata;

int fileno;

assert(bus);

assert(c);

assert(property);

assert(reply);

if (streq(property, "StandardInputFileDescriptorName"))

fileno = STDIN_FILENO;

else if (streq(property, "StandardOutputFileDescriptorName"))

fileno = STDOUT_FILENO;

else {

assert(streq(property, "StandardErrorFileDescriptorName"));

fileno = STDERR_FILENO;

}

return sd_bus_message_append(reply, "s", exec_context_fdname(c, fileno));

}

static int property_get_input_data(

sd_bus_error *error) {

ExecContext *c = userdata;

assert(bus);

assert(c);

assert(property);

assert(reply);

return sd_bus_message_append_array(reply, 'y', c->stdin_data, c->stdin_data_size);

}

static int property_get_restrict_filesystems(

sd_bus_error *error) {

ExecContext *c = userdata;

_cleanup_free_ char **l = NULL;

int r;

assert(bus);

assert(reply);

assert(c);

r = sd_bus_message_open_container(reply, 'r', "bas");

if (r < 0)

return r;

r = sd_bus_message_append(reply, "b", c->restrict_filesystems_allow_list);

if (r < 0)

return r;

#if HAVE_LIBBPF

l = set_get_strv(c->restrict_filesystems);

if (!l)

return -ENOMEM;

strv_sort(l);

r = sd_bus_message_append_strv(reply, l);

if (r < 0)

return r;

return sd_bus_message_close_container(reply);

}

static int property_get_bind_paths(

sd_bus_error *error) {

ExecContext *c = userdata;

bool ro;

int r;

assert(bus);

assert(c);

assert(property);

assert(reply);

ro = strstr(property, "ReadOnly");

r = sd_bus_message_open_container(reply, 'a', "(ssbt)");

if (r < 0)

return r;

for (size_t i = 0; i < c->n_bind_mounts; i++) {

if (ro != c->bind_mounts[i].read_only)

continue;

r = sd_bus_message_append(

reply, "(ssbt)",

c->bind_mounts[i].source,

c->bind_mounts[i].destination,

c->bind_mounts[i].ignore_enoent,

c->bind_mounts[i].recursive ? (uint64_t) MS_REC : (uint64_t) 0);

if (r < 0)

return r;

}

return sd_bus_message_close_container(reply);

}

static int property_get_temporary_filesystems(

sd_bus_error *error) {

ExecContext *c = userdata;

int r;

assert(bus);

assert(c);

assert(property);

assert(reply);

r = sd_bus_message_open_container(reply, 'a', "(ss)");

if (r < 0)

return r;

for (unsigned i = 0; i < c->n_temporary_filesystems; i++) {

TemporaryFileSystem *t = c->temporary_filesystems + i;

r = sd_bus_message_append(

reply, "(ss)",

t->path,

t->options);

if (r < 0)

return r;

}

return sd_bus_message_close_container(reply);

}

static int property_get_log_extra_fields(

sd_bus_error *error) {

ExecContext *c = userdata;

int r;

assert(bus);

assert(c);

assert(property);

assert(reply);

r = sd_bus_message_open_container(reply, 'a', "ay");

if (r < 0)

return r;

for (size_t i = 0; i < c->n_log_extra_fields; i++) {

r = sd_bus_message_append_array(reply, 'y', c->log_extra_fields[i].iov_base, c->log_extra_fields[i].iov_len);

if (r < 0)

return r;

}

return sd_bus_message_close_container(reply);

}

static int property_get_set_credential(

sd_bus_error *error) {

ExecContext *c = userdata;

ExecSetCredential *sc;

int r;

assert(bus);

assert(c);

assert(property);

assert(reply);

r = sd_bus_message_open_container(reply, 'a', "(say)");

if (r < 0)

return r;

HASHMAP_FOREACH(sc, c->set_credentials) {

if (sc->encrypted != streq(property, "SetCredentialEncrypted"))

continue;

r = sd_bus_message_open_container(reply, 'r', "say");

if (r < 0)

return r;

r = sd_bus_message_append(reply, "s", sc->id);

if (r < 0)

return r;

r = sd_bus_message_append_array(reply, 'y', sc->data, sc->size);

if (r < 0)

return r;

r = sd_bus_message_close_container(reply);

if (r < 0)

return r;

}

return sd_bus_message_close_container(reply);

}

static int property_get_load_credential(

sd_bus_error *error) {

ExecContext *c = userdata;

ExecLoadCredential *lc;

int r;

assert(bus);

assert(c);

assert(property);

assert(reply);

r = sd_bus_message_open_container(reply, 'a', "(ss)");

if (r < 0)

return r;

HASHMAP_FOREACH(lc, c->load_credentials) {

if (lc->encrypted != streq(property, "LoadCredentialEncrypted"))

continue;

r = sd_bus_message_append(reply, "(ss)", lc->id, lc->path);

if (r < 0)

return r;

}

return sd_bus_message_close_container(reply);

}

static int property_get_root_hash(

sd_bus_error *error) {

ExecContext *c = userdata;

assert(bus);

assert(c);

assert(property);

assert(reply);

return sd_bus_message_append_array(reply, 'y', c->root_hash, c->root_hash_size);

}

static int property_get_root_hash_sig(

sd_bus_error *error) {

ExecContext *c = userdata;

assert(bus);

assert(c);

assert(property);

assert(reply);

return sd_bus_message_append_array(reply, 'y', c->root_hash_sig, c->root_hash_sig_size);

}

static int property_get_root_image_options(

sd_bus_error *error) {

ExecContext *c = userdata;

int r;

assert(bus);

assert(c);

assert(property);

assert(reply);

r = sd_bus_message_open_container(reply, 'a', "(ss)");

if (r < 0)

return r;

LIST_FOREACH(mount_options, m, c->root_image_options) {

r = sd_bus_message_append(reply, "(ss)",

partition_designator_to_string(m->partition_designator),

m->options);

if (r < 0)

return r;

}

return sd_bus_message_close_container(reply);

}

static int property_get_mount_images(

sd_bus_error *error) {

ExecContext *c = userdata;

int r;

assert(bus);

assert(c);

assert(property);

assert(reply);