#include <errno.h>

#include <fcntl.h>

#include <poll.h>

#include <sys/eventfd.h>

#include <sys/ioctl.h>

#include <sys/mman.h>

#include <sys/mount.h>

#include <sys/personality.h>

#include <sys/prctl.h>

#include <sys/shm.h>

#include <sys/types.h>

#include <sys/un.h>

#include <unistd.h>

#include <utmpx.h>

#if HAVE_PAM

#include <security/pam_appl.h>

#if HAVE_SELINUX

#include <selinux/selinux.h>

#if HAVE_SECCOMP

#include <seccomp.h>

#if HAVE_APPARMOR

#include <sys/apparmor.h>

#include "sd-messages.h"

#include "acl-util.h"

#include "af-list.h"

#include "alloc-util.h"

#if HAVE_APPARMOR

#include "apparmor-util.h"

#include "async.h"

#include "barrier.h"

#include "bpf-lsm.h"

#include "cap-list.h"

#include "capability-util.h"

#include "cgroup-setup.h"

#include "chase-symlinks.h"

#include "chown-recursive.h"

#include "cpu-set-util.h"

#include "creds-util.h"

#include "data-fd-util.h"

#include "def.h"

#include "env-file.h"

#include "env-util.h"

#include "errno-list.h"

#include "escape.h"

#include "execute.h"

#include "exit-status.h"

#include "fd-util.h"

#include "fileio.h"

#include "format-util.h"

#include "glob-util.h"

#include "hexdecoct.h"

#include "io-util.h"

#include "ioprio-util.h"

#include "label.h"

#include "log.h"

#include "macro.h"

#include "manager.h"

#include "manager-dump.h"

#include "memory-util.h"

#include "missing_fs.h"

#include "missing_ioprio.h"

#include "mkdir-label.h"

#include "mount-util.h"

#include "mountpoint-util.h"

#include "namespace.h"

#include "parse-util.h"

#include "path-util.h"

#include "process-util.h"

#include "random-util.h"

#include "recurse-dir.h"

#include "rlimit-util.h"

#include "rm-rf.h"

#if HAVE_SECCOMP

#include "seccomp-util.h"

#include "securebits-util.h"

#include "selinux-util.h"

#include "signal-util.h"

#include "smack-util.h"

#include "socket-util.h"

#include "special.h"

#include "stat-util.h"

#include "string-table.h"

#include "string-util.h"

#include "strv.h"

#include "syslog-util.h"

#include "terminal-util.h"

#include "tmpfile-util.h"

#include "umask-util.h"

#include "unit-serialize.h"

#include "user-util.h"

#include "utmp-wtmp.h"

#define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)

#define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)

#define SNDBUF_SIZE (8*1024*1024)

static int shift_fds(int fds[], size_t n_fds) {

if (n_fds <= 0)

return 0;

/* Modifies the fds array! (sorts it) */

assert(fds);

for (int start = 0;;) {

int restart_from = -1;

for (int i = start; i < (int) n_fds; i++) {

int nfd;

/* Already at right index? */

if (fds[i] == i+3)

continue;

nfd = fcntl(fds[i], F_DUPFD, i + 3);

if (nfd < 0)

return -errno;

safe_close(fds[i]);

fds[i] = nfd;

/* Hmm, the fd we wanted isn't free? Then

if (nfd != i+3 && restart_from < 0)

restart_from = i;

}

if (restart_from < 0)

break;

start = restart_from;

}

return 0;

}

static int flags_fds(const int fds[], size_t n_socket_fds, size_t n_storage_fds, bool nonblock) {

size_t n_fds;

int r;

n_fds = n_socket_fds + n_storage_fds;

if (n_fds <= 0)

return 0;

assert(fds);

/* Drops/Sets O_NONBLOCK and FD_CLOEXEC from the file flags.

for (size_t i = 0; i < n_fds; i++) {

if (i < n_socket_fds) {

r = fd_nonblock(fds[i], nonblock);

if (r < 0)

return r;

}

/* We unconditionally drop FD_CLOEXEC from the fds,

r = fd_cloexec(fds[i], false);

if (r < 0)

return r;

}

return 0;

}

static const char *exec_context_tty_path(const ExecContext *context) {

assert(context);

if (context->stdio_as_fds)

return NULL;

if (context->tty_path)

return context->tty_path;

return "/dev/console";

}

static void exec_context_tty_reset(const ExecContext *context, const ExecParameters *p) {

const char *path;

assert(context);

path = exec_context_tty_path(context);

if (context->tty_vhangup) {

if (p && p->stdin_fd >= 0)

(void) terminal_vhangup_fd(p->stdin_fd);

else if (path)

(void) terminal_vhangup(path);

}

if (context->tty_reset) {

if (p && p->stdin_fd >= 0)

(void) reset_terminal_fd(p->stdin_fd, true);

else if (path)

(void) reset_terminal(path);

}

if (p && p->stdin_fd >= 0)

(void) terminal_set_size_fd(p->stdin_fd, path, context->tty_rows, context->tty_cols);

if (context->tty_vt_disallocate && path)

(void) vt_disallocate(path);

}

static bool is_terminal_input(ExecInput i) {

return IN_SET(i,

EXEC_INPUT_TTY,

EXEC_INPUT_TTY_FORCE,

EXEC_INPUT_TTY_FAIL);

}

static bool is_terminal_output(ExecOutput o) {

return IN_SET(o,

EXEC_OUTPUT_TTY,

EXEC_OUTPUT_KMSG_AND_CONSOLE,

EXEC_OUTPUT_JOURNAL_AND_CONSOLE);

}

static bool is_kmsg_output(ExecOutput o) {

return IN_SET(o,

EXEC_OUTPUT_KMSG,

EXEC_OUTPUT_KMSG_AND_CONSOLE);

}

static bool exec_context_needs_term(const ExecContext *c) {

assert(c);

/* Return true if the execution context suggests we should set $TERM to something useful. */

if (is_terminal_input(c->std_input))

return true;

if (is_terminal_output(c->std_output))

return true;

if (is_terminal_output(c->std_error))

return true;

return !!c->tty_path;

}

static int open_null_as(int flags, int nfd) {

int fd;

assert(nfd >= 0);

fd = open("/dev/null", flags|O_NOCTTY);

if (fd < 0)

return -errno;

return move_fd(fd, nfd, false);

}

static int connect_journal_socket(

gid_t gid) {

union sockaddr_union sa;

socklen_t sa_len;

uid_t olduid = UID_INVALID;

gid_t oldgid = GID_INVALID;

const char *j;

int r;

j = log_namespace ?

strjoina("/run/systemd/journal.", log_namespace, "/stdout") :

"/run/systemd/journal/stdout";

r = sockaddr_un_set_path(&sa.un, j);

if (r < 0)

return r;

sa_len = r;

if (gid_is_valid(gid)) {

oldgid = getgid();

if (setegid(gid) < 0)

return -errno;

}

if (uid_is_valid(uid)) {

olduid = getuid();

if (seteuid(uid) < 0) {

r = -errno;

goto restore_gid;

}

}

r = RET_NERRNO(connect(fd, &sa.sa, sa_len));

/* If we fail to restore the uid or gid, things will likely

if (uid_is_valid(uid))

(void) seteuid(olduid);

restore_gid:

if (gid_is_valid(gid))

(void) setegid(oldgid);

return r;

}

static int connect_logger_as(

gid_t gid) {

_cleanup_close_ int fd = -1;

int r;

assert(context);

assert(params);

assert(output < _EXEC_OUTPUT_MAX);

assert(ident);

assert(nfd >= 0);

fd = socket(AF_UNIX, SOCK_STREAM, 0);

if (fd < 0)

return -errno;

r = connect_journal_socket(fd, context->log_namespace, uid, gid);

if (r < 0)

return r;

if (shutdown(fd, SHUT_RD) < 0)

return -errno;

(void) fd_inc_sndbuf(fd, SNDBUF_SIZE);

if (dprintf(fd,

"%s\n"

"%s\n"

"%i\n"

"%i\n"

"%i\n"

"%i\n"

"%i\n",

context->syslog_identifier ?: ident,

params->flags & EXEC_PASS_LOG_UNIT ? unit->id : "",

context->syslog_priority,

!!context->syslog_level_prefix,

false,

is_kmsg_output(output),

is_terminal_output(output)) < 0)

return -errno;

return move_fd(TAKE_FD(fd), nfd, false);

}

static int open_terminal_as(const char *path, int flags, int nfd) {

int fd;

assert(path);

assert(nfd >= 0);

fd = open_terminal(path, flags | O_NOCTTY);

if (fd < 0)

return fd;

return move_fd(fd, nfd, false);

}

static int acquire_path(const char *path, int flags, mode_t mode) {

union sockaddr_union sa;

socklen_t sa_len;

_cleanup_close_ int fd = -1;

int r;

assert(path);

if (IN_SET(flags & O_ACCMODE, O_WRONLY, O_RDWR))

flags |= O_CREAT;

fd = open(path, flags|O_NOCTTY, mode);

if (fd >= 0)

return TAKE_FD(fd);

if (errno != ENXIO) /* ENXIO is returned when we try to open() an AF_UNIX file system socket on Linux */

return -errno;

/* So, it appears the specified path could be an AF_UNIX socket. Let's see if we can connect to it. */

r = sockaddr_un_set_path(&sa.un, path);

if (r < 0)

return r == -EINVAL ? -ENXIO : r;

sa_len = r;

fd = socket(AF_UNIX, SOCK_STREAM, 0);

if (fd < 0)

return -errno;

if (connect(fd, &sa.sa, sa_len) < 0)

return errno == EINVAL ? -ENXIO : -errno; /* Propagate initial error if we get EINVAL, i.e. we have

if ((flags & O_ACCMODE) == O_RDONLY)

r = shutdown(fd, SHUT_WR);

else if ((flags & O_ACCMODE) == O_WRONLY)

r = shutdown(fd, SHUT_RD);

else

r = 0;

if (r < 0)

return -errno;

return TAKE_FD(fd);

}

static int fixup_input(

const ExecContext *context,

int socket_fd,

bool apply_tty_stdin) {

ExecInput std_input;

assert(context);

std_input = context->std_input;

if (is_terminal_input(std_input) && !apply_tty_stdin)

return EXEC_INPUT_NULL;

if (std_input == EXEC_INPUT_SOCKET && socket_fd < 0)

return EXEC_INPUT_NULL;

if (std_input == EXEC_INPUT_DATA && context->stdin_data_size == 0)

return EXEC_INPUT_NULL;

return std_input;

}

static int fixup_output(ExecOutput output, int socket_fd) {

if (output == EXEC_OUTPUT_SOCKET && socket_fd < 0)

return EXEC_OUTPUT_INHERIT;

return output;

}

static int setup_input(

const int named_iofds[static 3]) {

ExecInput i;

int r;

assert(context);

assert(params);

assert(named_iofds);

if (params->stdin_fd >= 0) {

if (dup2(params->stdin_fd, STDIN_FILENO) < 0)

return -errno;

/* Try to make this the controlling tty, if it is a tty, and reset it */

if (isatty(STDIN_FILENO)) {

(void) ioctl(STDIN_FILENO, TIOCSCTTY, context->std_input == EXEC_INPUT_TTY_FORCE);

(void) reset_terminal_fd(STDIN_FILENO, true);

(void) terminal_set_size_fd(STDIN_FILENO, NULL, context->tty_rows, context->tty_cols);

}

return STDIN_FILENO;

}

i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);

switch (i) {

case EXEC_INPUT_NULL:

return open_null_as(O_RDONLY, STDIN_FILENO);

case EXEC_INPUT_TTY:

case EXEC_INPUT_TTY_FORCE:

case EXEC_INPUT_TTY_FAIL: {

int fd;

fd = acquire_terminal(exec_context_tty_path(context),

i == EXEC_INPUT_TTY_FAIL ? ACQUIRE_TERMINAL_TRY :

i == EXEC_INPUT_TTY_FORCE ? ACQUIRE_TERMINAL_FORCE :

ACQUIRE_TERMINAL_WAIT,

USEC_INFINITY);

if (fd < 0)

return fd;

r = terminal_set_size_fd(fd, exec_context_tty_path(context), context->tty_rows, context->tty_cols);

if (r < 0)

return r;

return move_fd(fd, STDIN_FILENO, false);

}

case EXEC_INPUT_SOCKET:

assert(socket_fd >= 0);

return RET_NERRNO(dup2(socket_fd, STDIN_FILENO));

case EXEC_INPUT_NAMED_FD:

assert(named_iofds[STDIN_FILENO] >= 0);

(void) fd_nonblock(named_iofds[STDIN_FILENO], false);

return RET_NERRNO(dup2(named_iofds[STDIN_FILENO], STDIN_FILENO));

case EXEC_INPUT_DATA: {

int fd;

fd = acquire_data_fd(context->stdin_data, context->stdin_data_size, 0);

if (fd < 0)

return fd;

return move_fd(fd, STDIN_FILENO, false);

}

case EXEC_INPUT_FILE: {

bool rw;

int fd;

assert(context->stdio_file[STDIN_FILENO]);

rw = (context->std_output == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDOUT_FILENO])) ||

(context->std_error == EXEC_OUTPUT_FILE && streq_ptr(context->stdio_file[STDIN_FILENO], context->stdio_file[STDERR_FILENO]));

fd = acquire_path(context->stdio_file[STDIN_FILENO], rw ? O_RDWR : O_RDONLY, 0666 & ~context->umask);

if (fd < 0)

return fd;

return move_fd(fd, STDIN_FILENO, false);

}

default:

assert_not_reached();

}

}

static bool can_inherit_stderr_from_stdout(

const ExecContext *context,

ExecOutput o,

ExecOutput e) {

assert(context);

/* Returns true, if given the specified STDERR and STDOUT output we can directly dup() the stdout fd to the

if (e == EXEC_OUTPUT_INHERIT)

return true;

if (e != o)

return false;

if (e == EXEC_OUTPUT_NAMED_FD)

return streq_ptr(context->stdio_fdname[STDOUT_FILENO], context->stdio_fdname[STDERR_FILENO]);

if (IN_SET(e, EXEC_OUTPUT_FILE, EXEC_OUTPUT_FILE_APPEND, EXEC_OUTPUT_FILE_TRUNCATE))

return streq_ptr(context->stdio_file[STDOUT_FILENO], context->stdio_file[STDERR_FILENO]);

return true;

}

static int setup_output(

ino_t *journal_stream_ino) {

ExecOutput o;

ExecInput i;

int r;

assert(unit);

assert(context);

assert(params);

assert(ident);

assert(journal_stream_dev);

assert(journal_stream_ino);

if (fileno == STDOUT_FILENO && params->stdout_fd >= 0) {

if (dup2(params->stdout_fd, STDOUT_FILENO) < 0)

return -errno;

return STDOUT_FILENO;

}

if (fileno == STDERR_FILENO && params->stderr_fd >= 0) {

if (dup2(params->stderr_fd, STDERR_FILENO) < 0)

return -errno;

return STDERR_FILENO;

}

i = fixup_input(context, socket_fd, params->flags & EXEC_APPLY_TTY_STDIN);

o = fixup_output(context->std_output, socket_fd);

if (fileno == STDERR_FILENO) {

ExecOutput e;

e = fixup_output(context->std_error, socket_fd);

/* This expects the input and output are already set up */

/* Don't change the stderr file descriptor if we inherit all

if (e == EXEC_OUTPUT_INHERIT &&

o == EXEC_OUTPUT_INHERIT &&

i == EXEC_INPUT_NULL &&

!is_terminal_input(context->std_input) &&

getppid() != 1)

return fileno;

/* Duplicate from stdout if possible */

if (can_inherit_stderr_from_stdout(context, o, e))

return RET_NERRNO(dup2(STDOUT_FILENO, fileno));

o = e;

} else if (o == EXEC_OUTPUT_INHERIT) {

/* If input got downgraded, inherit the original value */

if (i == EXEC_INPUT_NULL && is_terminal_input(context->std_input))

return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);

/* If the input is connected to anything that's not a /dev/null or a data fd, inherit that... */

if (!IN_SET(i, EXEC_INPUT_NULL, EXEC_INPUT_DATA))

return RET_NERRNO(dup2(STDIN_FILENO, fileno));

/* If we are not started from PID 1 we just inherit STDOUT from our parent process. */

if (getppid() != 1)

return fileno;

/* We need to open /dev/null here anew, to get the right access mode. */

return open_null_as(O_WRONLY, fileno);

}

switch (o) {

case EXEC_OUTPUT_NULL:

return open_null_as(O_WRONLY, fileno);

case EXEC_OUTPUT_TTY:

if (is_terminal_input(i))

return RET_NERRNO(dup2(STDIN_FILENO, fileno));

/* We don't reset the terminal if this is just about output */

return open_terminal_as(exec_context_tty_path(context), O_WRONLY, fileno);

case EXEC_OUTPUT_KMSG:

case EXEC_OUTPUT_KMSG_AND_CONSOLE:

case EXEC_OUTPUT_JOURNAL:

case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:

r = connect_logger_as(unit, context, params, o, ident, fileno, uid, gid);

if (r < 0) {

log_unit_warning_errno(unit, r, "Failed to connect %s to the journal socket, ignoring: %m",

fileno == STDOUT_FILENO ? "stdout" : "stderr");

r = open_null_as(O_WRONLY, fileno);

} else {

struct stat st;

/* If we connected this fd to the journal via a stream, patch the device/inode into the passed

if (fstat(fileno, &st) >= 0 &&

(*journal_stream_ino == 0 || fileno == STDERR_FILENO)) {

*journal_stream_dev = st.st_dev;

*journal_stream_ino = st.st_ino;

}

}

return r;

case EXEC_OUTPUT_SOCKET:

assert(socket_fd >= 0);

return RET_NERRNO(dup2(socket_fd, fileno));

case EXEC_OUTPUT_NAMED_FD:

assert(named_iofds[fileno] >= 0);

(void) fd_nonblock(named_iofds[fileno], false);

return RET_NERRNO(dup2(named_iofds[fileno], fileno));

case EXEC_OUTPUT_FILE:

case EXEC_OUTPUT_FILE_APPEND:

case EXEC_OUTPUT_FILE_TRUNCATE: {

bool rw;

int fd, flags;

assert(context->stdio_file[fileno]);

rw = context->std_input == EXEC_INPUT_FILE &&

streq_ptr(context->stdio_file[fileno], context->stdio_file[STDIN_FILENO]);

if (rw)

return RET_NERRNO(dup2(STDIN_FILENO, fileno));

flags = O_WRONLY;

if (o == EXEC_OUTPUT_FILE_APPEND)

flags |= O_APPEND;

else if (o == EXEC_OUTPUT_FILE_TRUNCATE)

flags |= O_TRUNC;

fd = acquire_path(context->stdio_file[fileno], flags, 0666 & ~context->umask);

if (fd < 0)

return fd;

return move_fd(fd, fileno, 0);

}

default:

assert_not_reached();

}

}

static int chown_terminal(int fd, uid_t uid) {

int r;

assert(fd >= 0);

/* Before we chown/chmod the TTY, let's ensure this is actually a tty */

if (isatty(fd) < 1) {

if (IN_SET(errno, EINVAL, ENOTTY))

return 0; /* not a tty */

return -errno;

}

/* This might fail. What matters are the results. */

r = fchmod_and_chown(fd, TTY_MODE, uid, GID_INVALID);

if (r < 0)

return r;

return 1;

}

static int setup_confirm_stdio(

int *ret_saved_stdout) {

_cleanup_close_ int fd = -1, saved_stdin = -1, saved_stdout = -1;

int r;

assert(ret_saved_stdin);

assert(ret_saved_stdout);

saved_stdin = fcntl(STDIN_FILENO, F_DUPFD, 3);

if (saved_stdin < 0)

return -errno;

saved_stdout = fcntl(STDOUT_FILENO, F_DUPFD, 3);

if (saved_stdout < 0)

return -errno;

fd = acquire_terminal(vc, ACQUIRE_TERMINAL_WAIT, DEFAULT_CONFIRM_USEC);

if (fd < 0)

return fd;

r = chown_terminal(fd, getuid());

if (r < 0)

return r;

r = reset_terminal_fd(fd, true);

if (r < 0)

return r;

r = terminal_set_size_fd(fd, vc, context->tty_rows, context->tty_cols);

if (r < 0)

return r;

r = rearrange_stdio(fd, fd, STDERR_FILENO); /* Invalidates 'fd' also on failure */

TAKE_FD(fd);

if (r < 0)

return r;

*ret_saved_stdin = TAKE_FD(saved_stdin);

*ret_saved_stdout = TAKE_FD(saved_stdout);

return 0;

}

static void write_confirm_error_fd(int err, int fd, const Unit *u) {

assert(err < 0);

if (err == -ETIMEDOUT)

dprintf(fd, "Confirmation question timed out for %s, assuming positive response.\n", u->id);

else {

errno = -err;

dprintf(fd, "Couldn't ask confirmation for %s: %m, assuming positive response.\n", u->id);

}

}

static void write_confirm_error(int err, const char *vc, const Unit *u) {

_cleanup_close_ int fd = -1;

assert(vc);

fd = open_terminal(vc, O_WRONLY|O_NOCTTY|O_CLOEXEC);

if (fd < 0)

return;

write_confirm_error_fd(err, fd, u);

}

static int restore_confirm_stdio(int *saved_stdin, int *saved_stdout) {

int r = 0;

assert(saved_stdin);

assert(saved_stdout);

release_terminal();

if (*saved_stdin >= 0)

if (dup2(*saved_stdin, STDIN_FILENO) < 0)

r = -errno;

if (*saved_stdout >= 0)

if (dup2(*saved_stdout, STDOUT_FILENO) < 0)

r = -errno;

*saved_stdin = safe_close(*saved_stdin);

*saved_stdout = safe_close(*saved_stdout);

return r;

}

enum {

CONFIRM_PRETEND_FAILURE = -1,

CONFIRM_PRETEND_SUCCESS = 0,

CONFIRM_EXECUTE = 1,

};

static int ask_for_confirmation(const ExecContext *context, const char *vc, Unit *u, const char *cmdline) {

int saved_stdout = -1, saved_stdin = -1, r;

_cleanup_free_ char *e = NULL;

char c;

/* For any internal errors, assume a positive response. */

r = setup_confirm_stdio(context, vc, &saved_stdin, &saved_stdout);

if (r < 0) {

write_confirm_error(r, vc, u);

return CONFIRM_EXECUTE;

}

/* confirm_spawn might have been disabled while we were sleeping. */

if (manager_is_confirm_spawn_disabled(u->manager)) {

r = 1;

goto restore_stdio;

}

e = ellipsize(cmdline, 60, 100);

if (!e) {

log_oom();

r = CONFIRM_EXECUTE;

goto restore_stdio;

}

for (;;) {

r = ask_char(&c, "yfshiDjcn", "Execute %s? [y, f, s – h for help] ", e);

if (r < 0) {

write_confirm_error_fd(r, STDOUT_FILENO, u);

r = CONFIRM_EXECUTE;

goto restore_stdio;

}

switch (c) {

case 'c':

printf("Resuming normal execution.\n");

manager_disable_confirm_spawn();

r = 1;

break;

case 'D':

unit_dump(u, stdout, " ");

continue; /* ask again */

case 'f':

printf("Failing execution.\n");

r = CONFIRM_PRETEND_FAILURE;

break;

case 'h':

printf(" c - continue, proceed without asking anymore\n"

" D - dump, show the state of the unit\n"

" f - fail, don't execute the command and pretend it failed\n"

" h - help\n"

" i - info, show a short summary of the unit\n"

" j - jobs, show jobs that are in progress\n"

" s - skip, don't execute the command and pretend it succeeded\n"

" y - yes, execute the command\n");

continue; /* ask again */

case 'i':

printf(" Description: %s\n"

" Unit: %s\n"

" Command: %s\n",

u->id, u->description, cmdline);

continue; /* ask again */

case 'j':

manager_dump_jobs(u->manager, stdout, " ");

continue; /* ask again */

case 'n':

/* 'n' was removed in favor of 'f'. */

printf("Didn't understand 'n', did you mean 'f'?\n");

continue; /* ask again */

case 's':

printf("Skipping execution.\n");

r = CONFIRM_PRETEND_SUCCESS;

break;

case 'y':

r = CONFIRM_EXECUTE;

break;

default:

assert_not_reached();

}

break;

}

restore_stdio:

restore_confirm_stdio(&saved_stdin, &saved_stdout);

return r;

}

static int get_fixed_user(const ExecContext *c, const char **user,

uid_t *uid, gid_t *gid,

const char **home, const char **shell) {

int r;

const char *name;

assert(c);

if (!c->user)

return 0;

/* Note that we don't set $HOME or $SHELL if they are not particularly enlightening anyway

name = c->user;

r = get_user_creds(&name, uid, gid, home, shell, USER_CREDS_CLEAN);

if (r < 0)

return r;

*user = name;

return 0;

}

static int get_fixed_group(const ExecContext *c, const char **group, gid_t *gid) {

int r;

const char *name;

assert(c);

if (!c->group)

return 0;

name = c->group;

r = get_group_creds(&name, gid, 0);

if (r < 0)

return r;

*group = name;

return 0;

}

static int get_supplementary_groups(const ExecContext *c, const char *user,

const char *group, gid_t gid,

gid_t **supplementary_gids, int *ngids) {

int r, k = 0;

int ngroups_max;

bool keep_groups = false;