picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

resolved, networkd: don't resolve the user if not root 

If a daemon is not started as root, most likely it also can't create its
directory and let's not try to resolve the user in that case either.

Create /run/systemd/netif/lldp with tmpfiles.d like other netif directories.

This is also very helpful for preparing a RootImage for the daemons as NSS crud
is not needed.
This commit is contained in:
Topi Miettinen 2019-12-06 16:36:58 +02:00
parent 36f43076b9
commit 07317d6e34
No known key found for this signature in database
GPG Key ID: 87E1A51C590B0577
3 changed files with 33 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
src/network/networkd.c
View File

@ -19,9 +19,6 @@
static int run(int argc, char *argv[]) {
_cleanup_(notify_on_cleanup) const char *notify_message = NULL;
_cleanup_(manager_freep) Manager *m = NULL;
const char *user = "systemd-network";
uid_t uid;
gid_t gid;
int r;
log_setup_service();
@ -31,20 +28,24 @@ static int run(int argc, char *argv[]) {
if (argc != 1)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "This program takes no arguments.");
r = get_user_creds(&user, &uid, &gid, NULL, NULL, 0);
if (r < 0)
return log_error_errno(r, "Cannot resolve user name %s: %m", user);
/* Create runtime directory. This is not necessary when networkd is
* started with "RuntimeDirectory=systemd/netif", or after
* systemd-tmpfiles-setup.service. */
r = mkdir_safe_label("/run/systemd/netif", 0755, uid, gid, MKDIR_WARN_MODE);
if (r < 0)
log_warning_errno(r, "Could not create runtime directory: %m");
/* Drop privileges, but only if we have been started as root. If we are not running as root we assume all
* privileges are already dropped. */
* privileges are already dropped and we can't create our runtime directory. */
if (geteuid() == 0) {
const char *user = "systemd-network";
uid_t uid;
gid_t gid;
r = get_user_creds(&user, &uid, &gid, NULL, NULL, 0);
if (r < 0)
return log_error_errno(r, "Cannot resolve user name %s: %m", user);
/* Create runtime directory. This is not necessary when networkd is
* started with "RuntimeDirectory=systemd/netif", or after
* systemd-tmpfiles-setup.service. */
r = mkdir_safe_label("/run/systemd/netif", 0755, uid, gid, MKDIR_WARN_MODE);
if (r < 0)
log_warning_errno(r, "Could not create runtime directory: %m");
r = drop_privileges(uid, gid,
(1ULL << CAP_NET_ADMIN) |
(1ULL << CAP_NET_BIND_SERVICE) |
@ -57,15 +58,15 @@ static int run(int argc, char *argv[]) {
/* Always create the directories people can create inotify watches in.
* It is necessary to create the following subdirectories after drop_privileges()
* to support old kernels not supporting AmbientCapabilities=. */
r = mkdir_safe_label("/run/systemd/netif/links", 0755, uid, gid, MKDIR_WARN_MODE);
r = mkdir_safe_label("/run/systemd/netif/links", 0755, UID_INVALID, GID_INVALID, MKDIR_WARN_MODE);
if (r < 0)
log_warning_errno(r, "Could not create runtime directory 'links': %m");
r = mkdir_safe_label("/run/systemd/netif/leases", 0755, uid, gid, MKDIR_WARN_MODE);
r = mkdir_safe_label("/run/systemd/netif/leases", 0755, UID_INVALID, GID_INVALID, MKDIR_WARN_MODE);
if (r < 0)
log_warning_errno(r, "Could not create runtime directory 'leases': %m");
r = mkdir_safe_label("/run/systemd/netif/lldp", 0755, uid, gid, MKDIR_WARN_MODE);
r = mkdir_safe_label("/run/systemd/netif/lldp", 0755, UID_INVALID, GID_INVALID, MKDIR_WARN_MODE);
if (r < 0)
log_warning_errno(r, "Could not create runtime directory 'lldp': %m");

26
src/resolve/resolved.c
View File

@ -21,9 +21,6 @@
static int run(int argc, char *argv[]) {
_cleanup_(notify_on_cleanup) const char *notify_stop = NULL;
_cleanup_(manager_freep) Manager *m = NULL;
const char *user = "systemd-resolve";
uid_t uid;
gid_t gid;
int r;
log_setup_service();
@ -37,18 +34,21 @@ static int run(int argc, char *argv[]) {
if (r < 0)
return log_error_errno(r, "SELinux setup failed: %m");
r = get_user_creds(&user, &uid, &gid, NULL, NULL, 0);
if (r < 0)
return log_error_errno(r, "Cannot resolve user name %s: %m", user);
/* Always create the directory where resolv.conf will live */
r = mkdir_safe_label("/run/systemd/resolve", 0755, uid, gid, MKDIR_WARN_MODE);
if (r < 0)
return log_error_errno(r, "Could not create runtime directory: %m");
/* Drop privileges, but only if we have been started as root. If we are not running as root we assume most
* privileges are already dropped. */
* privileges are already dropped and we can't create our directory. */
if (getuid() == 0) {
const char *user = "systemd-resolve";
uid_t uid;
gid_t gid;
r = get_user_creds(&user, &uid, &gid, NULL, NULL, 0);
if (r < 0)
return log_error_errno(r, "Cannot resolve user name %s: %m", user);
/* As we're root, we can create the directory where resolv.conf will live */
r = mkdir_safe_label("/run/systemd/resolve", 0755, uid, gid, MKDIR_WARN_MODE);
if (r < 0)
return log_error_errno(r, "Could not create runtime directory: %m");
/* Drop privileges, but keep three caps. Note that we drop those too, later on (see below) */
r = drop_privileges(uid, gid,

1
tmpfiles.d/systemd.conf.m4
View File

@ -22,6 +22,7 @@ m4_ifdef(`ENABLE_NETWORKD',
d /run/systemd/netif 0755 systemd-network systemd-network -
d /run/systemd/netif/links 0755 systemd-network systemd-network -
d /run/systemd/netif/leases 0755 systemd-network systemd-network -
d /run/systemd/netif/lldp 0755 systemd-network systemd-network -
)m4_dnl
d /run/log 0755 root root -