#include <getopt.h>

#include "sd-bus.h"

#include "ask-password-api.h"

#include "bus-common-errors.h"

#include "bus-error.h"

#include "bus-locator.h"

#include "cgroup-util.h"

#include "dns-domain.h"

#include "env-util.h"

#include "fd-util.h"

#include "fileio.h"

#include "format-table.h"

#include "fs-util.h"

#include "glyph-util.h"

#include "home-util.h"

#include "homectl-fido2.h"

#include "homectl-pkcs11.h"

#include "homectl-recovery-key.h"

#include "libfido2-util.h"

#include "locale-util.h"

#include "main-func.h"

#include "memory-util.h"

#include "pager.h"

#include "parse-argument.h"

#include "parse-util.h"

#include "path-util.h"

#include "percent-util.h"

#include "pkcs11-util.h"

#include "pretty-print.h"

#include "process-util.h"

#include "pwquality-util.h"

#include "rlimit-util.h"

#include "spawn-polkit-agent.h"

#include "terminal-util.h"

#include "uid-alloc-range.h"

#include "user-record-pwquality.h"

#include "user-record-show.h"

#include "user-record-util.h"

#include "user-record.h"

#include "user-util.h"

#include "verbs.h"

static PagerFlags arg_pager_flags = 0;

static bool arg_legend = true;

static bool arg_ask_password = true;

static BusTransport arg_transport = BUS_TRANSPORT_LOCAL;

static const char *arg_host = NULL;

static const char *arg_identity = NULL;

static JsonVariant *arg_identity_extra = NULL;

static JsonVariant *arg_identity_extra_privileged = NULL;

static JsonVariant *arg_identity_extra_this_machine = NULL;

static JsonVariant *arg_identity_extra_rlimits = NULL;

static char **arg_identity_filter = NULL; /* this one is also applied to 'privileged' and 'thisMachine' subobjects */

static char **arg_identity_filter_rlimits = NULL;

static uint64_t arg_disk_size = UINT64_MAX;

static uint64_t arg_disk_size_relative = UINT64_MAX;

static char **arg_pkcs11_token_uri = NULL;

static char **arg_fido2_device = NULL;

static Fido2EnrollFlags arg_fido2_lock_with = FIDO2ENROLL_PIN | FIDO2ENROLL_UP;

static bool arg_recovery_key = false;

static JsonFormatFlags arg_json_format_flags = JSON_FORMAT_OFF;

static bool arg_and_resize = false;

static bool arg_and_change_password = false;

static enum {

EXPORT_FORMAT_FULL, /* export the full record */

EXPORT_FORMAT_STRIPPED, /* strip "state" + "binding", but leave signature in place */

EXPORT_FORMAT_MINIMAL, /* also strip signature */

} arg_export_format = EXPORT_FORMAT_FULL;

STATIC_DESTRUCTOR_REGISTER(arg_identity_extra, json_variant_unrefp);

STATIC_DESTRUCTOR_REGISTER(arg_identity_extra_this_machine, json_variant_unrefp);

STATIC_DESTRUCTOR_REGISTER(arg_identity_extra_privileged, json_variant_unrefp);

STATIC_DESTRUCTOR_REGISTER(arg_identity_extra_rlimits, json_variant_unrefp);

STATIC_DESTRUCTOR_REGISTER(arg_identity_filter, strv_freep);

STATIC_DESTRUCTOR_REGISTER(arg_identity_filter_rlimits, strv_freep);

STATIC_DESTRUCTOR_REGISTER(arg_pkcs11_token_uri, strv_freep);

STATIC_DESTRUCTOR_REGISTER(arg_fido2_device, strv_freep);

static const BusLocator *bus_mgr;

static bool identity_properties_specified(void) {

return

arg_identity ||

!json_variant_is_blank_object(arg_identity_extra) ||

!json_variant_is_blank_object(arg_identity_extra_privileged) ||

!json_variant_is_blank_object(arg_identity_extra_this_machine) ||

!json_variant_is_blank_object(arg_identity_extra_rlimits) ||

!strv_isempty(arg_identity_filter) ||

!strv_isempty(arg_identity_filter_rlimits) ||

!strv_isempty(arg_pkcs11_token_uri) ||

!strv_isempty(arg_fido2_device);

}

static int acquire_bus(sd_bus **bus) {

int r;

assert(bus);

if (*bus)

return 0;

r = bus_connect_transport(arg_transport, arg_host, false, bus);

if (r < 0)

return bus_log_connect_error(r, arg_transport);

(void) sd_bus_set_allow_interactive_authorization(*bus, arg_ask_password);

return 0;

}

static int list_homes(int argc, char *argv[], void *userdata) {

_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;

_cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;

_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;

_cleanup_(table_unrefp) Table *table = NULL;

int r;

r = acquire_bus(&bus);

if (r < 0)

return r;

r = bus_call_method(bus, bus_mgr, "ListHomes", &error, &reply, NULL);

if (r < 0)

return log_error_errno(r, "Failed to list homes: %s", bus_error_message(&error, r));

table = table_new("name", "uid", "gid", "state", "realname", "home", "shell");

if (!table)

return log_oom();

r = sd_bus_message_enter_container(reply, 'a', "(susussso)");

if (r < 0)

return bus_log_parse_error(r);

for (;;) {

const char *name, *state, *realname, *home, *shell, *color;

TableCell *cell;

uint32_t uid, gid;

r = sd_bus_message_read(reply, "(susussso)", &name, &uid, &state, &gid, &realname, &home, &shell, NULL);

if (r < 0)

return bus_log_parse_error(r);

if (r == 0)

break;

r = table_add_many(table,

TABLE_STRING, name,

TABLE_UID, uid,

TABLE_GID, gid);

if (r < 0)

return table_log_add_error(r);

r = table_add_cell(table, &cell, TABLE_STRING, state);

if (r < 0)

return table_log_add_error(r);

color = user_record_state_color(state);

if (color)

(void) table_set_color(table, cell, color);

r = table_add_many(table,

TABLE_STRING, strna(empty_to_null(realname)),

TABLE_STRING, home,

TABLE_STRING, strna(empty_to_null(shell)));

if (r < 0)

return table_log_add_error(r);

}

r = sd_bus_message_exit_container(reply);

if (r < 0)

return bus_log_parse_error(r);

if (table_get_rows(table) > 1 || !FLAGS_SET(arg_json_format_flags, JSON_FORMAT_OFF)) {

r = table_set_sort(table, (size_t) 0);

if (r < 0)

return table_log_sort_error(r);

r = table_print_with_pager(table, arg_json_format_flags, arg_pager_flags, arg_legend);

if (r < 0)

return r;

}

if (arg_legend && (arg_json_format_flags & JSON_FORMAT_OFF)) {

if (table_get_rows(table) > 1)

printf("\n%zu home areas listed.\n", table_get_rows(table) - 1);

else

printf("No home areas.\n");

}

return 0;

}

static int acquire_existing_password(

AskPasswordFlags flags) {

_cleanup_(strv_free_erasep) char **password = NULL;

_cleanup_(erase_and_freep) char *envpw = NULL;

_cleanup_free_ char *question = NULL;

int r;

assert(user_name);

assert(hr);

r = getenv_steal_erase("PASSWORD", &envpw);

if (r < 0)

return log_error_errno(r, "Failed to acquire password from environment: %m");

if (r > 0) {

/* People really shouldn't use environment variables for passing passwords. We support this

r = user_record_set_password(hr, STRV_MAKE(envpw), true);

if (r < 0)

return log_error_errno(r, "Failed to store password: %m");

return 1;

}

/* If this is not our own user, then don't use the password cache */

if (is_this_me(user_name) <= 0)

SET_FLAG(flags, ASK_PASSWORD_ACCEPT_CACHED|ASK_PASSWORD_PUSH_CACHE, false);

if (asprintf(&question, emphasize_current ?

"Please enter current password for user %s:" :

"Please enter password for user %s:",

user_name) < 0)

return log_oom();

r = ask_password_auto(question,

/* icon= */ "user-home",

NULL,

/* key_name= */ "home-password",

/* credential_name= */ "home.password",

USEC_INFINITY,

flags,

&password);

if (r == -EUNATCH) { /* EUNATCH is returned if no password was found and asking interactively was

log_debug_errno(r, "No passwords acquired.");

return 0;

}

if (r < 0)

return log_error_errno(r, "Failed to acquire password: %m");

r = user_record_set_password(hr, password, true);

if (r < 0)

return log_error_errno(r, "Failed to store password: %m");

return 1;

}

static int acquire_recovery_key(

const char *user_name,

UserRecord *hr,

AskPasswordFlags flags) {

_cleanup_(strv_free_erasep) char **recovery_key = NULL;

_cleanup_(erase_and_freep) char *envpw = NULL;

_cleanup_free_ char *question = NULL;

int r;

assert(user_name);

assert(hr);

r = getenv_steal_erase("PASSWORD", &envpw);

if (r < 0)

return log_error_errno(r, "Failed to acquire password from environment: %m");

if (r > 0) {

/* People really shouldn't use environment variables for passing secrets. We support this

r = user_record_set_password(hr, STRV_MAKE(envpw), true); /* recovery keys are stored in the record exactly like regular passwords! */

if (r < 0)

return log_error_errno(r, "Failed to store recovery key: %m");

return 1;

}

/* If this is not our own user, then don't use the password cache */

if (is_this_me(user_name) <= 0)

SET_FLAG(flags, ASK_PASSWORD_ACCEPT_CACHED|ASK_PASSWORD_PUSH_CACHE, false);

if (asprintf(&question, "Please enter recovery key for user %s:", user_name) < 0)

return log_oom();

r = ask_password_auto(question,

/* icon= */ "user-home",

NULL,

/* key_name= */ "home-recovery-key",

/* credential_name= */ "home.recovery-key",

USEC_INFINITY,

flags,

&recovery_key);

if (r == -EUNATCH) { /* EUNATCH is returned if no recovery key was found and asking interactively was

log_debug_errno(r, "No recovery keys acquired.");

return 0;

}

if (r < 0)

return log_error_errno(r, "Failed to acquire recovery keys: %m");

r = user_record_set_password(hr, recovery_key, true);

if (r < 0)

return log_error_errno(r, "Failed to store recovery keys: %m");

return 1;

}

static int acquire_token_pin(

const char *user_name,

UserRecord *hr,

AskPasswordFlags flags) {

_cleanup_(strv_free_erasep) char **pin = NULL;

_cleanup_(erase_and_freep) char *envpin = NULL;

_cleanup_free_ char *question = NULL;

int r;

assert(user_name);

assert(hr);

r = getenv_steal_erase("PIN", &envpin);

if (r < 0)

return log_error_errno(r, "Failed to acquire PIN from environment: %m");

if (r > 0) {

r = user_record_set_token_pin(hr, STRV_MAKE(envpin), false);

if (r < 0)

return log_error_errno(r, "Failed to store token PIN: %m");

return 1;

}

/* If this is not our own user, then don't use the password cache */

if (is_this_me(user_name) <= 0)

SET_FLAG(flags, ASK_PASSWORD_ACCEPT_CACHED|ASK_PASSWORD_PUSH_CACHE, false);

if (asprintf(&question, "Please enter security token PIN for user %s:", user_name) < 0)

return log_oom();

r = ask_password_auto(

question,

/* icon= */ "user-home",

NULL,

/* key_name= */ "token-pin",

/* credential_name= */ "home.token-pin",

USEC_INFINITY,

flags,

&pin);

if (r == -EUNATCH) { /* EUNATCH is returned if no PIN was found and asking interactively was disabled

log_debug_errno(r, "No security token PINs acquired.");

return 0;

}

if (r < 0)

return log_error_errno(r, "Failed to acquire security token PIN: %m");

r = user_record_set_token_pin(hr, pin, false);

if (r < 0)

return log_error_errno(r, "Failed to store security token PIN: %m");

return 1;

}

static int handle_generic_user_record_error(

bool emphasize_current_password) {

int r;

assert(user_name);

assert(hr);

if (sd_bus_error_has_name(error, BUS_ERROR_HOME_ABSENT))

return log_error_errno(SYNTHETIC_ERRNO(EREMOTE),

"Home of user %s is currently absent, please plug in the necessary storage device or backing file system.", user_name);

else if (sd_bus_error_has_name(error, BUS_ERROR_AUTHENTICATION_LIMIT_HIT))

return log_error_errno(SYNTHETIC_ERRNO(ETOOMANYREFS),

"Too frequent login attempts for user %s, try again later.", user_name);

else if (sd_bus_error_has_name(error, BUS_ERROR_BAD_PASSWORD)) {

if (!strv_isempty(hr->password))

log_notice("Password incorrect or not sufficient, please try again.");

/* Don't consume cache entries or credentials here, we already tried that unsuccessfully. But

r = acquire_existing_password(

user_name,

hr,

emphasize_current_password,

ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);

if (r < 0)

return r;

} else if (sd_bus_error_has_name(error, BUS_ERROR_BAD_RECOVERY_KEY)) {

if (!strv_isempty(hr->password))

log_notice("Recovery key incorrect or not sufficient, please try again.");

/* Don't consume cache entries or credentials here, we already tried that unsuccessfully. But

r = acquire_recovery_key(

user_name,

hr,

ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);

if (r < 0)

return r;

} else if (sd_bus_error_has_name(error, BUS_ERROR_BAD_PASSWORD_AND_NO_TOKEN)) {

if (strv_isempty(hr->password))

log_notice("Security token not inserted, please enter password.");

else

log_notice("Password incorrect or not sufficient, and configured security token not inserted, please try again.");

r = acquire_existing_password(

user_name,

hr,

emphasize_current_password,

ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);

if (r < 0)

return r;

} else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_PIN_NEEDED)) {

/* First time the PIN is requested, let's accept cached data, and allow using credential store */

r = acquire_token_pin(

user_name,

hr,

ASK_PASSWORD_ACCEPT_CACHED | ASK_PASSWORD_PUSH_CACHE);

if (r < 0)

return r;

} else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_PROTECTED_AUTHENTICATION_PATH_NEEDED)) {

log_notice("%s%sPlease authenticate physically on security token.",

emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "",

emoji_enabled() ? " " : "");

r = user_record_set_pkcs11_protected_authentication_path_permitted(hr, true);

if (r < 0)

return log_error_errno(r, "Failed to set PKCS#11 protected authentication path permitted flag: %m");

} else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_USER_PRESENCE_NEEDED)) {

log_notice("%s%sPlease confirm presence on security token.",

emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "",

emoji_enabled() ? " " : "");

r = user_record_set_fido2_user_presence_permitted(hr, true);

if (r < 0)

return log_error_errno(r, "Failed to set FIDO2 user presence permitted flag: %m");

} else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_USER_VERIFICATION_NEEDED)) {

log_notice("%s%sPlease verify user on security token.",

emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "",

emoji_enabled() ? " " : "");

r = user_record_set_fido2_user_verification_permitted(hr, true);

if (r < 0)

return log_error_errno(r, "Failed to set FIDO2 user verification permitted flag: %m");

} else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_PIN_LOCKED))

return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Security token PIN is locked, please unlock it first. (Hint: Removal and re-insertion might suffice.)");

else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_BAD_PIN)) {

log_notice("Security token PIN incorrect, please try again.");

/* If the previous PIN was wrong don't accept cached info anymore, but add to cache. Also, don't use the credential data */

r = acquire_token_pin(

user_name,

hr,

ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);

if (r < 0)

return r;

} else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_BAD_PIN_FEW_TRIES_LEFT)) {

log_notice("Security token PIN incorrect, please try again (only a few tries left!).");

r = acquire_token_pin(

user_name,

hr,

ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);

if (r < 0)

return r;

} else if (sd_bus_error_has_name(error, BUS_ERROR_TOKEN_BAD_PIN_ONE_TRY_LEFT)) {

log_notice("Security token PIN incorrect, please try again (only one try left!).");

r = acquire_token_pin(

user_name,

hr,

ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_NO_CREDENTIAL);

if (r < 0)

return r;

} else

return log_error_errno(ret, "Operation on home %s failed: %s", user_name, bus_error_message(error, ret));

return 0;

}

static int acquire_passed_secrets(const char *user_name, UserRecord **ret) {

_cleanup_(user_record_unrefp) UserRecord *secret = NULL;

int r;

assert(ret);

/* Generates an initial secret objects that contains passwords supplied via $PASSWORD, the password

secret = user_record_new();

if (!secret)

return log_oom();

r = acquire_existing_password(

user_name,

secret,

/* emphasize_current_password = */ false,

ASK_PASSWORD_ACCEPT_CACHED | ASK_PASSWORD_NO_TTY | ASK_PASSWORD_NO_AGENT);

if (r < 0)

return r;

r = acquire_token_pin(

user_name,

secret,

ASK_PASSWORD_ACCEPT_CACHED | ASK_PASSWORD_NO_TTY | ASK_PASSWORD_NO_AGENT);

if (r < 0)

return r;

r = acquire_recovery_key(

user_name,

secret,

ASK_PASSWORD_ACCEPT_CACHED | ASK_PASSWORD_NO_TTY | ASK_PASSWORD_NO_AGENT);

if (r < 0)

return r;

*ret = TAKE_PTR(secret);

return 0;

}

static int activate_home(int argc, char *argv[], void *userdata) {

_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;

int r, ret = 0;

r = acquire_bus(&bus);

if (r < 0)

return r;

STRV_FOREACH(i, strv_skip(argv, 1)) {

_cleanup_(user_record_unrefp) UserRecord *secret = NULL;

r = acquire_passed_secrets(*i, &secret);

if (r < 0)

return r;

for (;;) {

_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;

_cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;

r = bus_message_new_method_call(bus, &m, bus_mgr, "ActivateHome");

if (r < 0)

return bus_log_create_error(r);

r = sd_bus_message_append(m, "s", *i);

if (r < 0)

return bus_log_create_error(r);

r = bus_message_append_secret(m, secret);

if (r < 0)

return bus_log_create_error(r);

r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);

if (r < 0) {

r = handle_generic_user_record_error(*i, secret, &error, r, /* emphasize_current_password= */ false);

if (r < 0) {

if (ret == 0)

ret = r;

break;

}

} else

break;

}

}

return ret;

}

static int deactivate_home(int argc, char *argv[], void *userdata) {

_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;

int r, ret = 0;

r = acquire_bus(&bus);

if (r < 0)

return r;

STRV_FOREACH(i, strv_skip(argv, 1)) {

_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;

_cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;

r = bus_message_new_method_call(bus, &m, bus_mgr, "DeactivateHome");

if (r < 0)

return bus_log_create_error(r);

r = sd_bus_message_append(m, "s", *i);

if (r < 0)

return bus_log_create_error(r);

r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);

if (r < 0) {

log_error_errno(r, "Failed to deactivate user home: %s", bus_error_message(&error, r));

if (ret == 0)

ret = r;

}

}

return ret;

}

static void dump_home_record(UserRecord *hr) {

int r;

assert(hr);

if (hr->incomplete) {

fflush(stdout);

log_warning("Warning: lacking rights to acquire privileged fields of user record of '%s', output incomplete.", hr->user_name);

}

if (arg_json_format_flags & JSON_FORMAT_OFF)

user_record_show(hr, true);

else {

_cleanup_(user_record_unrefp) UserRecord *stripped = NULL;

if (arg_export_format == EXPORT_FORMAT_STRIPPED)

r = user_record_clone(hr, USER_RECORD_EXTRACT_EMBEDDED|USER_RECORD_PERMISSIVE, &stripped);

else if (arg_export_format == EXPORT_FORMAT_MINIMAL)

r = user_record_clone(hr, USER_RECORD_EXTRACT_SIGNABLE|USER_RECORD_PERMISSIVE, &stripped);

else

r = 0;

if (r < 0)

log_warning_errno(r, "Failed to strip user record, ignoring: %m");

if (stripped)

hr = stripped;

json_variant_dump(hr->json, arg_json_format_flags, stdout, NULL);

}

}

static char **mangle_user_list(char **list, char ***ret_allocated) {

_cleanup_free_ char *myself = NULL;

char **l;

if (!strv_isempty(list)) {

*ret_allocated = NULL;

return list;

}

myself = getusername_malloc();

if (!myself)

return NULL;

l = new(char*, 2);

if (!l)

return NULL;

l[0] = TAKE_PTR(myself);

l[1] = NULL;

*ret_allocated = l;

return l;

}

static int inspect_home(int argc, char *argv[], void *userdata) {

_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;

_cleanup_(strv_freep) char **mangled_list = NULL;

int r, ret = 0;

char **items;

pager_open(arg_pager_flags);

r = acquire_bus(&bus);

if (r < 0)

return r;

items = mangle_user_list(strv_skip(argv, 1), &mangled_list);

if (!items)

return log_oom();

STRV_FOREACH(i, items) {

_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;

_cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;

_cleanup_(json_variant_unrefp) JsonVariant *v = NULL;

_cleanup_(user_record_unrefp) UserRecord *hr = NULL;

const char *json;

int incomplete;

uid_t uid;

r = parse_uid(*i, &uid);

if (r < 0) {

if (!valid_user_group_name(*i, 0)) {

log_error("Invalid user name '%s'.", *i);

if (ret == 0)

ret = -EINVAL;

continue;

}

r = bus_call_method(bus, bus_mgr, "GetUserRecordByName", &error, &reply, "s", *i);

} else

r = bus_call_method(bus, bus_mgr, "GetUserRecordByUID", &error, &reply, "u", (uint32_t) uid);

if (r < 0) {

log_error_errno(r, "Failed to inspect home: %s", bus_error_message(&error, r));

if (ret == 0)

ret = r;

continue;

}

r = sd_bus_message_read(reply, "sbo", &json, &incomplete, NULL);

if (r < 0) {

bus_log_parse_error(r);

if (ret == 0)

ret = r;

continue;

}

r = json_parse(json, JSON_PARSE_SENSITIVE, &v, NULL, NULL);

if (r < 0) {

log_error_errno(r, "Failed to parse JSON identity: %m");

if (ret == 0)

ret = r;

continue;

}

hr = user_record_new();

if (!hr)

return log_oom();

r = user_record_load(hr, v, USER_RECORD_LOAD_REFUSE_SECRET|USER_RECORD_LOG|USER_RECORD_PERMISSIVE);

if (r < 0) {

if (ret == 0)

ret = r;

continue;

}

hr->incomplete = incomplete;

dump_home_record(hr);

}

return ret;

}

static int authenticate_home(int argc, char *argv[], void *userdata) {

_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;

_cleanup_(strv_freep) char **mangled_list = NULL;

int r, ret = 0;

char **items;

items = mangle_user_list(strv_skip(argv, 1), &mangled_list);

if (!items)

return log_oom();

r = acquire_bus(&bus);

if (r < 0)

return r;

(void) polkit_agent_open_if_enabled(arg_transport, arg_ask_password);

STRV_FOREACH(i, items) {

_cleanup_(user_record_unrefp) UserRecord *secret = NULL;

r = acquire_passed_secrets(*i, &secret);

if (r < 0)

return r;

for (;;) {

_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;

_cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;

r = bus_message_new_method_call(bus, &m, bus_mgr, "AuthenticateHome");

if (r < 0)

return bus_log_create_error(r);

r = sd_bus_message_append(m, "s", *i);

if (r < 0)

return bus_log_create_error(r);

r = bus_message_append_secret(m, secret);

if (r < 0)

return bus_log_create_error(r);

r = sd_bus_call(bus, m, HOME_SLOW_BUS_CALL_TIMEOUT_USEC, &error, NULL);

if (r < 0) {

r = handle_generic_user_record_error(*i, secret, &error, r, false);

if (r < 0) {

if (ret == 0)

ret = r;

break;

}

} else

break;

}

}

return ret;

}

static int update_last_change(JsonVariant **v, bool with_password, bool override) {

JsonVariant *c;

usec_t n;

int r;

assert(v);

n = now(CLOCK_REALTIME);

c = json_variant_by_key(*v, "lastChangeUSec");

if (c) {

uint64_t u;

if (!override)

goto update_password;

if (!json_variant_is_unsigned(c))

return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "lastChangeUSec field is not an unsigned integer, refusing.");

u = json_variant_unsigned(c);

if (u >= n)

return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "lastChangeUSec is from the future, can't update.");

}

r = json_variant_set_field_unsigned(v, "lastChangeUSec", n);

if (r < 0)

return log_error_errno(r, "Failed to update lastChangeUSec: %m");

update_password:

if (!with_password)

return 0;

c = json_variant_by_key(*v, "lastPasswordChangeUSec");

if (c) {

uint64_t u;

if (!override)

return 0;

if (!json_variant_is_unsigned(c))

return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "lastPasswordChangeUSec field is not an unsigned integer, refusing.");

u = json_variant_unsigned(c);

if (u >= n)

return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "lastPasswordChangeUSec is from the future, can't update.");

}

r = json_variant_set_field_unsigned(v, "lastPasswordChangeUSec", n);

if (r < 0)

return log_error_errno(r, "Failed to update lastPasswordChangeUSec: %m");

return 1;

}

static int apply_identity_changes(JsonVariant **_v) {

_cleanup_(json_variant_unrefp) JsonVariant *v = NULL;

int r;

assert(_v);

v = json_variant_ref(*_v);

r = json_variant_filter(&v, arg_identity_filter);

if (r < 0)

return log_error_errno(r, "Failed to filter identity: %m");

r = json_variant_merge(&v, arg_identity_extra);

if (r < 0)

return log_error_errno(r, "Failed to merge identities: %m");

if (arg_identity_extra_this_machine || !strv_isempty(arg_identity_filter)) {

_cleanup_(json_variant_unrefp) JsonVariant *per_machine = NULL, *mmid = NULL;

sd_id128_t mid;

r = sd_id128_get_machine(&mid);

if (r < 0)

return log_error_errno(r, "Failed to acquire machine ID: %m");

r = json_variant_new_string(&mmid, SD_ID128_TO_STRING(mid));

if (r < 0)

return log_error_errno(r, "Failed to allocate matchMachineId object: %m");

per_machine = json_variant_ref(json_variant_by_key(v, "perMachine"));

if (per_machine) {

_cleanup_(json_variant_unrefp) JsonVariant *npm = NULL, *add = NULL;

_cleanup_free_ JsonVariant **array = NULL;

JsonVariant *z;

size_t i = 0;

if (!json_variant_is_array(per_machine))

return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "perMachine field is not an array, refusing.");

array = new(JsonVariant*, json_variant_elements(per_machine) + 1);

if (!array)

return log_oom();

JSON_VARIANT_ARRAY_FOREACH(z, per_machine) {

JsonVariant *u;

if (!json_variant_is_object(z))

return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "perMachine entry is not an object, refusing.");

array[i++] = z;

u = json_variant_by_key(z, "matchMachineId");

if (!u)

continue;

if (!json_variant_equal(u, mmid))

continue;

r = json_variant_merge(&add, z);

if (r < 0)

return log_error_errno(r, "Failed to merge perMachine entry: %m");

i--;

}

r = json_variant_filter(&add, arg_identity_filter);

if (r < 0)

return log_error_errno(r, "Failed to filter perMachine: %m");

r = json_variant_merge(&add, arg_identity_extra_this_machine);

if (r < 0)

return log_error_errno(r, "Failed to merge in perMachine fields: %m");

if (arg_identity_filter_rlimits || arg_identity_extra_rlimits) {

_cleanup_(json_variant_unrefp) JsonVariant *rlv = NULL;

rlv = json_variant_ref(json_variant_by_key(add, "resourceLimits"));

r = json_variant_filter(&rlv, arg_identity_filter_rlimits);

if (r < 0)

return log_error_errno(r, "Failed to filter resource limits: %m");

r = json_variant_merge(&rlv, arg_identity_extra_rlimits);

if (r < 0)

return log_error_errno(r, "Failed to set resource limits: %m");

if (json_variant_is_blank_object(rlv)) {

r = json_variant_filter(&add, STRV_MAKE("resourceLimits"));

if (r < 0)

return log_error_errno(r, "Failed to drop resource limits field from identity: %m");

} else {

r = json_variant_set_field(&add, "resourceLimits", rlv);

if (r < 0)

return log_error_errno(r, "Failed to update resource limits of identity: %m");

}

}

if (!json_variant_is_blank_object(add)) {

r = json_variant_set_field(&add, "matchMachineId", mmid);

if (r < 0)

return log_error_errno(r, "Failed to set matchMachineId field: %m");

array[i++] = add;

}

r = json_variant_new_array(&npm, array, i);

if (r < 0)

return log_error_errno(r, "Failed to allocate new perMachine array: %m");

json_variant_unref(per_machine);

per_machine = TAKE_PTR(npm);

} else {

_cleanup_(json_variant_unrefp) JsonVariant *item = json_variant_ref(arg_identity_extra_this_machine);

if (arg_identity_extra_rlimits) {

r = json_variant_set_field(&item, "resourceLimits", arg_identity_extra_rlimits);

if (r < 0)

return log_error_errno(r, "Failed to update resource limits of identity: %m");