Commit 8c6db833 authored by Lennart Poettering's avatar Lennart Poettering

pam: implement systemd PAM module and generelize cgroup API for that a bit

parent 96551bae
systemd.pc
test-cgroup
.libs/
systemd-notify
test-daemon
systemd-install
......
......@@ -23,6 +23,8 @@ dbussessionservicedir=@dbussessionservicedir@
dbussystemservicedir=@dbussystemservicedir@
dbusinterfacedir=@dbusinterfacedir@
udevrulesdir=@udevrulesdir@
pamlibdir=@pamlibdir@
pkgconfigdatadir=$(datadir)/pkgconfig
# Our own, non-special dirs
pkgsysconfdir=$(sysconfdir)/systemd
......@@ -45,6 +47,7 @@ AM_CPPFLAGS = \
-DCGROUP_AGENT_PATH=\"$(rootlibexecdir)/systemd-cgroups-agent\" \
-DSYSTEMD_BINARY_PATH=\"$(rootbindir)/systemd\" \
-DSYSTEMCTL_BINARY_PATH=\"$(rootbindir)/systemctl\" \
-DRUNTIME_DIR=\"$(localstatedir)/run\" \
-I $(top_srcdir)/src
rootbin_PROGRAMS = \
......@@ -70,7 +73,13 @@ noinst_PROGRAMS = \
test-job-type \
test-ns \
test-loopback \
test-daemon
test-daemon \
test-cgroup
if HAVE_PAM
pamlib_LTLIBRARIES = \
pam_systemd.la
endif
dist_dbuspolicy_DATA = \
src/org.freedesktop.systemd1.conf
......@@ -158,7 +167,8 @@ EXTRA_DIST = \
units/session/exit.service.in \
LICENSE \
README \
DISTRO_PORTING
DISTRO_PORTING \
src/systemd.pc.in
if TARGET_FEDORA
dist_systemunit_DATA += \
......@@ -201,6 +211,9 @@ dist_doc_DATA = \
src/sd-daemon.h \
src/sd-daemon.c
pkgconfigdata_DATA = \
systemd.pc
noinst_LTLIBRARIES = \
libsystemd-basic.la \
libsystemd-core.la
......@@ -262,7 +275,8 @@ libsystemd_core_la_SOURCES = \
src/unit-name.c \
src/fdset.c \
src/namespace.c \
src/tcpwrap.c
src/tcpwrap.c \
src/cgroup-util.c
libsystemd_core_la_CFLAGS = \
$(AM_CFLAGS) \
......@@ -356,6 +370,18 @@ test_daemon_SOURCES = \
test_daemon_LDADD = \
libsystemd-basic.la
test_cgroup_SOURCES = \
src/test-cgroup.c \
src/cgroup-util.c
test_cgroup_CFLAGS = \
$(AM_CFLAGS) \
$(CGROUP_CFLAGS)
test_cgroup_LDADD = \
libsystemd-basic.la \
$(CGROUP_LIBS)
systemd_logger_SOURCES = \
src/logger.c \
src/sd-daemon.c \
......@@ -442,12 +468,41 @@ systemadm_LDADD = \
$(DBUSGLIB_LIBS) \
$(GTK_LIBS)
pam_systemd_la_SOURCES = \
src/pam-module.c \
src/cgroup-util.c \
src/sd-daemon.c
pam_systemd_la_CFLAGS = \
$(AM_CFLAGS) \
$(CGROUP_CFLAGS) \
-fvisibility=hidden
pam_systemd_la_LDFLAGS = \
-module \
-export-dynamic \
-avoid-version \
-shared \
-export-symbols-regex '^pam_sm_.*'
pam_systemd_la_LIBADD = \
libsystemd-basic.la \
$(PAM_LIBS) \
$(CGROUP_LIBS)
SED_PROCESS = \
$(AM_V_GEN)$(MKDIR_P) $(dir $@) && \
$(SED) -e 's,@rootlibexecdir\@,$(rootlibexecdir),g' \
-e 's,@SPECIAL_SYSLOG_SERVICE\@,$(SPECIAL_SYSLOG_SERVICE),g' \
-e 's,@SPECIAL_DBUS_SERVICE\@,$(SPECIAL_DBUS_SERVICE),g' \
-e 's,@SYSTEMCTL\@,$(rootbindir)/systemctl,g' \
-e 's,@pkgsysconfdir\@,$(pkgsysconfdir),g' \
-e 's,@pkgdatadir\@,$(pkgdatadir),g' \
-e 's,@systemunitdir\@,$(systemunitdir),g' \
-e 's,@PACKAGE_VERSION\@,$(PACKAGE_VERSION),g' \
-e 's,@PACKAGE_NAME\@,$(PACKAGE_NAME),g' \
-e 's,@PACKAGE_URL\@,$(PACKAGE_URL),g' \
-e 's,@prefix\@,$(prefix),g' \
< $< > $@
units/%: units/%.in Makefile
......@@ -456,6 +511,9 @@ units/%: units/%.in Makefile
man/%: man/%.in Makefile
$(SED_PROCESS)
%.pc: %.pc.in Makefile
$(SED_PROCESS)
M4_PROCESS_SYSTEM = \
$(AM_V_GEN)$(MKDIR_P) $(dir $@) && \
$(M4) -P $(M4_DISTRO_FLAG) -DFOR_SYSTEM=1 < $< > $@
......@@ -639,4 +697,5 @@ DISTCHECK_CONFIGURE_FLAGS = \
--with-dbussystemservicedir=$$dc_install_base/$(dbussystemservicedir) \
--with-dbusinterfacedir=$$dc_install_base/$(dbusinterfacedir) \
--with-udevrulesdir=$$dc_install_base/$(udevrulesdir) \
--with-pamlibdir=$$dc_install_base/$(pamlibdir) \
--with-rootdir=$$dc_install_base/$(rootdir)
......@@ -352,7 +352,12 @@ AC_ARG_WITH([dbusinterfacedir],
AC_ARG_WITH([udevrulesdir],
AS_HELP_STRING([--with-udevrulesdir=DIR], [Diectory for udev rules]),
[],
[with_udevrulesdir=/lib/udev/rules.d])
[with_udevrulesdir=`pkg-config --variable=udevdir udev`/rules.d])
AC_ARG_WITH([pamlibdir],
AS_HELP_STRING([--with-pamlibdir=DIR], [Diectory for PAM modules]),
[],
[with_pamlibdir=/lib/`$CC -print-multi-os-directory`/security])
AC_ARG_WITH([rootdir],
AS_HELP_STRING([--with-rootdir=DIR], [Root directory for files necessary for boot]),
......@@ -364,6 +369,7 @@ AC_SUBST([dbussessionservicedir], [$with_dbussessionservicedir])
AC_SUBST([dbussystemservicedir], [$with_dbussystemservicedir])
AC_SUBST([dbusinterfacedir], [$with_dbusinterfacedir])
AC_SUBST([udevrulesdir], [$with_udevrulesdir])
AC_SUBST([pamlibdir], [$with_pamlibdir])
AC_SUBST([rootdir], [$with_rootdir])
AC_CONFIG_FILES([Makefile])
......@@ -383,6 +389,7 @@ echo "
prefix: ${prefix}
root dir: ${with_rootdir}
udev rules dir: ${with_udevrulesdir}
pam modules dir: ${with_pamlibdir}
dbus policy dir: ${with_dbuspolicydir}
dbus session dir: ${with_dbussessionservicedir}
dbus system dir: ${with_dbussystemservicedir}
......
* calendar time support in timer
* calendar time support in timer, iCalendar semantics for the timer stuff (RFC2445)
* complete dbus exposure
* make conf parser work more like .desktop parsers
* implicitly import "defaults" settings file into all types
* service startup should be delayed if the matching socket is being started
* add #ifdefs for non-redhat builds in sysv parser
* add #ifdefs for non-sysv builds
* bootchart hookup
* reinvestigate random seed, hwclock
* "disabled" load state?
* %m in printf() instead of strerror();
* gc: don't reap broken services
* iCalendar semantics for the timer stuff (RFC2445)
* ability to kill services? i.e. in contrast to stopping them, go directly
into killing mode?
......@@ -47,10 +35,6 @@
* follow property change dbus spec
* make systemd bus activatable (?)
* pam module
* selinux
External:
......@@ -68,3 +52,5 @@ Regularly:
* check for strerror(r) instead of strerror(-r)
* Use PR_SET_PROCTITLE_AREA if it becomes available in the kernel
* %m in printf() instead of strerror();
/*-*- Mode: C; c-basic-offset: 8 -*-*/
/***
This file is part of systemd.
Copyright 2010 Lennart Poettering
systemd is free software; you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
systemd is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License
along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/
#include <errno.h>
#include <unistd.h>
#include <signal.h>
#include <string.h>
#include <stdlib.h>
#include <libcgroup.h>
#include "cgroup-util.h"
#include "log.h"
#include "set.h"
#include "macro.h"
#include "util.h"
int cg_translate_error(int error, int _errno) {
switch (error) {
case ECGROUPNOTCOMPILED:
case ECGROUPNOTMOUNTED:
case ECGROUPNOTEXIST:
case ECGROUPNOTCREATED:
return -ENOENT;
case ECGINVAL:
return -EINVAL;
case ECGROUPNOTALLOWED:
return -EPERM;
case ECGOTHER:
return -_errno;
}
return -EIO;
}
static struct cgroup* cg_new(const char *controller, const char *path) {
struct cgroup *cgroup;
assert(path);
assert(controller);
if (!(cgroup = cgroup_new_cgroup(path)))
return NULL;
if (!cgroup_add_controller(cgroup, controller)) {
cgroup_free(&cgroup);
return NULL;
}
return cgroup;
}
int cg_kill(const char *controller, const char *path, int sig, bool ignore_self) {
bool killed = false, done = false;
Set *s;
pid_t my_pid;
int r, ret = 0;
assert(controller);
assert(path);
assert(sig >= 0);
/* This goes through the tasks list and kills them all. This
* is repeated until no further processes are added to the
* tasks list, to properly handle forking processes */
if (!(s = set_new(trivial_hash_func, trivial_compare_func)))
return -ENOMEM;
my_pid = getpid();
do {
void *iterator = NULL;
pid_t pid = 0;
done = true;
r = cgroup_get_task_begin(path, controller, &iterator, &pid);
while (r == 0) {
if (pid == my_pid && ignore_self)
goto next;
if (set_get(s, INT_TO_PTR(pid)) == INT_TO_PTR(pid))
goto next;
/* If we haven't killed this process yet, kill
* it */
if (kill(pid, sig) < 0 && errno != ESRCH) {
if (ret == 0)
ret = -errno;
}
killed = true;
done = false;
if ((r = set_put(s, INT_TO_PTR(pid))) < 0)
goto loop_exit;
next:
r = cgroup_get_task_next(&iterator, &pid);
}
if (r == 0 || r == ECGEOF)
r = 0;
else if (r == ECGOTHER && errno == ENOENT)
r = -ESRCH;
else
r = cg_translate_error(r, errno);
loop_exit:
assert_se(cgroup_get_task_end(&iterator) == 0);
/* To avoid racing against processes which fork
* quicker than we can kill them we repeat this until
* no new pids need to be killed. */
} while (!done && r >= 0);
set_free(s);
if (ret < 0)
return ret;
if (r < 0)
return r;
return !!killed;
}
int cg_kill_recursive(const char *controller, const char *path, int sig, bool ignore_self) {
struct cgroup_file_info info;
int level = 0, r, ret = 0;
void *iterator = NULL;
bool killed = false;
assert(path);
assert(controller);
assert(sig >= 0);
zero(info);
r = cgroup_walk_tree_begin(controller, path, 0, &iterator, &info, &level);
while (r == 0) {
int k;
char *p;
if (info.type != CGROUP_FILE_TYPE_DIR)
goto next;
if (asprintf(&p, "%s/%s", path, info.path) < 0) {
ret = -ENOMEM;
break;
}
k = cg_kill(controller, p, sig, ignore_self);
free(p);
if (k < 0) {
if (ret == 0)
ret = k;
} else if (k > 0)
killed = true;
next:
r = cgroup_walk_tree_next(0, &iterator, &info, level);
}
if (ret == 0) {
if (r == 0 || r == ECGEOF)
ret = !!killed;
else if (r == ECGOTHER && errno == ENOENT)
ret = -ESRCH;
else
ret = cg_translate_error(r, errno);
}
assert_se(cgroup_walk_tree_end(&iterator) == 0);
return ret;
}
int cg_kill_recursive_and_wait(const char *controller, const char *path) {
unsigned i;
assert(path);
assert(controller);
/* This safely kills all processes; first it sends a SIGTERM,
* then checks 8 times after 50ms whether the group is
* now empty, and finally kills everything that is left with
* SIGKILL */
for (i = 0; i < 10; i++) {
int sig, r;
if (i <= 0)
sig = SIGTERM;
else if (i >= 9)
sig = SIGKILL;
else
sig = 0;
if ((r = cg_kill_recursive(controller, path, sig, true)) <= 0)
return r;
usleep(50 * USEC_PER_MSEC);
}
return 0;
}
int cg_migrate(const char *controller, const char *from, const char *to, bool ignore_self) {
bool migrated = false, done = false;
struct cgroup *dest;
int r, ret = 0;
pid_t my_pid;
assert(controller);
assert(from);
assert(to);
if (!(dest = cg_new(controller, to)))
return -ENOMEM;
my_pid = getpid();
do {
void *iterator = NULL;
pid_t pid = 0;
done = true;
r = cgroup_get_task_begin(from, controller, &iterator, &pid);
while (r == 0) {
if (pid == my_pid && ignore_self)
goto next;
if ((r = cgroup_attach_task_pid(dest, pid)) != 0) {
if (ret == 0)
r = cg_translate_error(r, errno);
}
migrated = true;
done = false;
next:
r = cgroup_get_task_next(&iterator, &pid);
}
if (r == 0 || r == ECGEOF)
r = 0;
else if (r == ECGOTHER && errno == ENOENT)
r = -ESRCH;
else
r = cg_translate_error(r, errno);
assert_se(cgroup_get_task_end(&iterator) == 0);
} while (!done && r >= 0);
cgroup_free(&dest);
if (ret < 0)
return ret;
if (r < 0)
return r;
return !!migrated;
}
int cg_migrate_recursive(const char *controller, const char *from, const char *to, bool ignore_self) {
struct cgroup_file_info info;
int level = 0, r, ret = 0;
void *iterator = NULL;
bool migrated = false;
assert(controller);
assert(from);
assert(to);
zero(info);
r = cgroup_walk_tree_begin(controller, from, 0, &iterator, &info, &level);
while (r == 0) {
int k;
char *p;
if (info.type != CGROUP_FILE_TYPE_DIR)
goto next;
if (asprintf(&p, "%s/%s", from, info.path) < 0) {
ret = -ENOMEM;
break;
}
k = cg_migrate(controller, p, to, ignore_self);
free(p);
if (k < 0) {
if (ret == 0)
ret = k;
} else if (k > 0)
migrated = true;
next:
r = cgroup_walk_tree_next(0, &iterator, &info, level);
}
if (ret == 0) {
if (r == 0 || r == ECGEOF)
r = !!migrated;
else if (r == ECGOTHER && errno == ENOENT)
r = -ESRCH;
else
r = cg_translate_error(r, errno);
}
assert_se(cgroup_walk_tree_end(&iterator) == 0);
return ret;
}
int cg_get_path(const char *controller, const char *path, const char *suffix, char **fs) {
char *mp;
int r;
assert(controller);
assert(path);
if ((r = cgroup_get_subsys_mount_point(controller, &mp)) != 0)
return cg_translate_error(r, errno);
if (suffix)
r = asprintf(fs, "%s/%s/%s", mp, path, suffix);
else
r = asprintf(fs, "%s/%s", mp, path);
free(mp);
return r < 0 ? -ENOMEM : 0;
}
int cg_trim(const char *controller, const char *path, bool delete_root) {
char *fs;
int r;
assert(controller);
assert(path);
if ((r = cg_get_path(controller, path, NULL, &fs)) < 0)
return r;
r = rm_rf(fs, true, delete_root);
free(fs);
return r;
}
int cg_delete(const char *controller, const char *path) {
struct cgroup *cg;
int r;
assert(controller);
assert(path);
if (!(cg = cg_new(controller, path)))
return -ENOMEM;
if ((r = cgroup_delete_cgroup_ext(cg, CGFLAG_DELETE_RECURSIVE|CGFLAG_DELETE_IGNORE_MIGRATION)) != 0) {
r = cg_translate_error(r, errno);
goto finish;
}
r = 0;
finish:
cgroup_free(&cg);
return r;
}
int cg_create(const char *controller, const char *path) {
struct cgroup *cg;
int r;
assert(controller);
assert(path);
if (!(cg = cg_new(controller, path)))
return -ENOMEM;
if ((r = cgroup_create_cgroup(cg, 1)) != 0) {
r = cg_translate_error(r, errno);
goto finish;
}
r = 0;