Merge pull request #6672 from yuwata/drop-priv

use !! prefix in networkd and timesyncd

man/systemd-timesyncd.service.xml

@@ -88,7 +88,7 @@
 
     <variablelist>
       <varlistentry>
-        <term><filename>/var/lib/systemd/clock</filename></term>
+        <term><filename>/var/lib/systemd/timesync/clock</filename></term>
 
         <listitem>
           <para>This file contains the timestamp of the last successful

src/network/networkd.c

@@ -70,13 +70,17 @@ int main(int argc, char *argv[]) {
         if (r < 0)
                 log_warning_errno(r, "Could not create runtime directory 'lldp': %m");
 
-        r = drop_privileges(uid, gid,
+        /* Drop privileges, but only if we have been started as root. If we are not running as root we assume all
-                            (1ULL << CAP_NET_ADMIN) |
+         * privileges are already dropped. */
-                            (1ULL << CAP_NET_BIND_SERVICE) |
+        if (geteuid() == 0) {
-                            (1ULL << CAP_NET_BROADCAST) |
+                r = drop_privileges(uid, gid,
-                            (1ULL << CAP_NET_RAW));
+                                    (1ULL << CAP_NET_ADMIN) |
-        if (r < 0)
+                                    (1ULL << CAP_NET_BIND_SERVICE) |
-                goto out;
+                                    (1ULL << CAP_NET_BROADCAST) |
+                                    (1ULL << CAP_NET_RAW));
+                if (r < 0)
+                        goto out;
+        }
 
         assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
 

src/timesync/timesyncd-manager.c

@@ -373,7 +373,7 @@ static int manager_adjust_clock(Manager *m, double offset, int leap_sec) {
                 return -errno;
 
         /* If touch fails, there isn't much we can do. Maybe it'll work next time. */
-        (void) touch("/var/lib/systemd/clock");
+        (void) touch("/var/lib/systemd/timesync/clock");
 
         m->drift_ppm = tmx.freq / 65536;
 

src/timesync/timesyncd.c

@@ -24,6 +24,7 @@
 #include "clock-util.h"
 #include "fd-util.h"
 #include "fs-util.h"
+#include "mkdir.h"
 #include "network-util.h"
 #include "process-util.h"
 #include "signal-util.h"
@@ -44,7 +45,7 @@ static int load_clock_timestamp(uid_t uid, gid_t gid) {
          * systems lacking a battery backed RTC. We also will adjust
          * the time to at least the build time of systemd. */
 
-        fd = open("/var/lib/systemd/clock", O_RDWR|O_CLOEXEC, 0644);
+        fd = open("/var/lib/systemd/timesync/clock", O_RDWR|O_CLOEXEC, 0644);
         if (fd >= 0) {
                 struct stat st;
                 usec_t stamp;
@@ -57,14 +58,24 @@ static int load_clock_timestamp(uid_t uid, gid_t gid) {
                                 min = stamp;
                 }
 
-                /* Try to fix the access mode, so that we can still
+                if (geteuid() == 0) {
-                   touch the file after dropping priviliges */
+                        /* Try to fix the access mode, so that we can still
-                (void) fchmod(fd, 0644);
+                           touch the file after dropping priviliges */
-                (void) fchown(fd, uid, gid);
+                        r = fchmod(fd, 0644);
+                        if (r < 0)
+                                return log_error_errno(errno, "Failed to change file access mode: %m");
+                        r = fchown(fd, uid, gid);
+                                return log_error_errno(errno, "Failed to change file owner: %m");
+                }
+
+        } else {
+                r = mkdir_safe_label("/var/lib/systemd/timesync", 0755, uid, gid);
+                if (r < 0)
+                        return log_error_errno(r, "Failed to create state directory: %m");
 
-        } else
                 /* create stamp file with the compiled-in date */
-                (void) touch_file("/var/lib/systemd/clock", true, min, uid, gid, 0644);
+                (void) touch_file("/var/lib/systemd/timesync/clock", false, min, uid, gid, 0644);
+        }
 
         ct = now(CLOCK_REALTIME);
         if (ct < min) {
@@ -111,9 +122,13 @@ int main(int argc, char *argv[]) {
         if (r < 0)
                 goto finish;
 
-        r = drop_privileges(uid, gid, (1ULL << CAP_SYS_TIME));
+        /* Drop privileges, but only if we have been started as root. If we are not running as root we assume all
-        if (r < 0)
+         * privileges are already dropped. */
-                goto finish;
+        if (geteuid() == 0) {
+                r = drop_privileges(uid, gid, (1ULL << CAP_SYS_TIME));
+                if (r < 0)
+                        goto finish;
+        }
 
         assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
 
@@ -158,7 +173,7 @@ int main(int argc, char *argv[]) {
 
         /* if we got an authoritative time, store it in the file system */
         if (m->sync)
-                (void) touch("/var/lib/systemd/clock");
+                (void) touch("/var/lib/systemd/timesync/clock");
 
         sd_event_get_exit_code(m->event, &r);
 

test/networkd-test.py

@@ -752,7 +752,7 @@ DNS=192.168.5.1
 EOF
 
 # run networkd as in systemd-networkd.service
-exec $(systemctl cat systemd-networkd.service | sed -n '/^ExecStart=/ { s/^.*=//; p}')
+exec $(systemctl cat systemd-networkd.service | sed -n '/^ExecStart=/ { s/^.*=//; s/^[@+-]//; s/^!*//; p}')
 ''' % {'ifr': self.if_router, 'ifc': self.iface, 'addr6': ipv6 and 'Address=2600::1/64' or '',
        'dhopts': dhcpserver_opts or ''})
 

test/test-functions

@@ -426,7 +426,7 @@ install_execs() {
     systemduserunitdir=$(pkg-config --variable=systemduserunitdir systemd)
     egrep -ho '^Exec[^ ]*=[^ ]+' $initdir/{$systemdsystemunitdir,$systemduserunitdir}/*.service \
          | while read i; do
-         i=${i##Exec*=}; i=${i##-}
+         i=${i##Exec*=}; i=${i##[@+\!-]}; i=${i##\!}
          # some {rc,halt}.local scripts and programs are okay to not exist, the rest should
          inst $i || [ "${i%.local}" != "$i" ] || [ "${i%systemd-update-done}" != "$i" ]
      done

units/systemd-networkd.service.in

@@ -20,9 +20,11 @@ Wants=network.target
 Type=notify
 Restart=on-failure
 RestartSec=0
-ExecStart=@rootlibexecdir@/systemd-networkd
+ExecStart=!!@rootlibexecdir@/systemd-networkd
 WatchdogSec=3min
-CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
+User=systemd-network
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
 ProtectSystem=strict
 ProtectHome=yes
 ProtectControlGroups=yes
@@ -32,7 +34,8 @@ RestrictRealtime=yes
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET
 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
 SystemCallArchitectures=native
-ReadWritePaths=/run/systemd
+RuntimeDirectory=systemd/netif
+RuntimeDirectoryPreserve=yes
 
 [Install]
 WantedBy=multi-user.target

units/systemd-timesyncd.service.in

@@ -11,8 +11,8 @@ Documentation=man:systemd-timesyncd.service(8)
 ConditionCapability=CAP_SYS_TIME
 ConditionVirtualization=!container
 DefaultDependencies=no
-RequiresMountsFor=/var/lib/systemd/clock
+RequiresMountsFor=/var/lib/systemd/timesync/clock
-After=systemd-remount-fs.service systemd-tmpfiles-setup.service systemd-sysusers.service
+After=systemd-remount-fs.service systemd-sysusers.service
 Before=time-sync.target sysinit.target shutdown.target
 Conflicts=shutdown.target
 Wants=time-sync.target
@@ -21,9 +21,11 @@ Wants=time-sync.target
 Type=notify
 Restart=always
 RestartSec=0
-ExecStart=@rootlibexecdir@/systemd-timesyncd
+ExecStart=!!@rootlibexecdir@/systemd-timesyncd
 WatchdogSec=3min
-CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
+User=systemd-timesync
+CapabilityBoundingSet=CAP_SYS_TIME
+AmbientCapabilities=CAP_SYS_TIME
 PrivateTmp=yes
 PrivateDevices=yes
 ProtectSystem=strict
@@ -37,7 +39,7 @@ RestrictNamespaces=yes
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
 SystemCallArchitectures=native
-ReadWritePaths=/var/lib/systemd
+StateDirectory=systemd/timesync
 
 [Install]
 WantedBy=sysinit.target