#include <errno.h>

#include <fcntl.h>

#include <fnmatch.h>

#include <getopt.h>

#include <limits.h>

#include <linux/fs.h>

#include <stdbool.h>

#include <stddef.h>

#include <stdlib.h>

#include <sys/file.h>

#include <sys/xattr.h>

#include <sysexits.h>

#include <time.h>

#include <unistd.h>

#include "sd-path.h"

#include "acl-util.h"

#include "alloc-util.h"

#include "btrfs-util.h"

#include "capability-util.h"

#include "chase-symlinks.h"

#include "chattr-util.h"

#include "conf-files.h"

#include "copy.h"

#include "def.h"

#include "dirent-util.h"

#include "dissect-image.h"

#include "env-util.h"

#include "escape.h"

#include "fd-util.h"

#include "fileio.h"

#include "format-util.h"

#include "fs-util.h"

#include "glob-util.h"

#include "io-util.h"

#include "label.h"

#include "log.h"

#include "macro.h"

#include "main-func.h"

#include "missing_stat.h"

#include "missing_syscall.h"

#include "mkdir-label.h"

#include "mount-util.h"

#include "mountpoint-util.h"

#include "offline-passwd.h"

#include "pager.h"

#include "parse-argument.h"

#include "parse-util.h"

#include "path-lookup.h"

#include "path-util.h"

#include "pretty-print.h"

#include "rlimit-util.h"

#include "rm-rf.h"

#include "selinux-util.h"

#include "set.h"

#include "sort-util.h"

#include "specifier.h"

#include "stat-util.h"

#include "stdio-util.h"

#include "string-table.h"

#include "string-util.h"

#include "strv.h"

#include "terminal-util.h"

#include "umask-util.h"

#include "user-util.h"

typedef enum OperationMask {

} OperationMask;

typedef enum ItemType {

} ItemType;

typedef enum AgeBy {

} AgeBy;

typedef struct Item {

} Item;

typedef struct ItemArray {

} ItemArray;

typedef enum DirectoryType {

} DirectoryType;

static bool arg_cat_config = false;

static bool arg_user = false;

static OperationMask arg_operation = 0;

static bool arg_boot = false;

static PagerFlags arg_pager_flags = 0;

static char **arg_include_prefixes = NULL;

static char **arg_exclude_prefixes = NULL;

static char *arg_root = NULL;

static char *arg_image = NULL;

static char *arg_replace = NULL;

#define MAX_DEPTH 256

static OrderedHashmap *items = NULL, *globs = NULL;

static Set *unix_sockets = NULL;

STATIC_DESTRUCTOR_REGISTER(items, ordered_hashmap_freep);

STATIC_DESTRUCTOR_REGISTER(globs, ordered_hashmap_freep);

STATIC_DESTRUCTOR_REGISTER(unix_sockets, set_freep);

STATIC_DESTRUCTOR_REGISTER(arg_include_prefixes, freep);

STATIC_DESTRUCTOR_REGISTER(arg_exclude_prefixes, freep);

STATIC_DESTRUCTOR_REGISTER(arg_root, freep);

STATIC_DESTRUCTOR_REGISTER(arg_image, freep);

static int specifier_machine_id_safe(char specifier, const void *data, const char *root, const void *userdata, char **ret);

static int specifier_directory(char specifier, const void *data, const char *root, const void *userdata, char **ret);

static int specifier_machine_id_safe(char specifier, const void *data, const char *root, const void *userdata, char **ret) {

int r;

/* If /etc/machine_id is missing or empty (e.g. in a chroot environment) return a recognizable error

r = specifier_machine_id(specifier, data, root, userdata, ret);

if (IN_SET(r, -ENOENT, -ENOMEDIUM))

return -ENXIO;

return r;

}

static int specifier_directory(char specifier, const void *data, const char *root, const void *userdata, char **ret) {

struct table_entry {

uint64_t type;

const char *suffix;

};

static const struct table_entry paths_system[] = {

[DIRECTORY_RUNTIME] = { SD_PATH_SYSTEM_RUNTIME },

[DIRECTORY_STATE] = { SD_PATH_SYSTEM_STATE_PRIVATE },

[DIRECTORY_CACHE] = { SD_PATH_SYSTEM_STATE_CACHE },

[DIRECTORY_LOGS] = { SD_PATH_SYSTEM_STATE_LOGS },

};

static const struct table_entry paths_user[] = {

[DIRECTORY_RUNTIME] = { SD_PATH_USER_RUNTIME },

[DIRECTORY_STATE] = { SD_PATH_USER_CONFIGURATION },

[DIRECTORY_CACHE] = { SD_PATH_USER_STATE_CACHE },

[DIRECTORY_LOGS] = { SD_PATH_USER_CONFIGURATION, "log" },

};

const struct table_entry *paths;

_cleanup_free_ char *p = NULL;

unsigned i;

int r;

assert_cc(ELEMENTSOF(paths_system) == ELEMENTSOF(paths_user));

paths = arg_user ? paths_user : paths_system;

i = PTR_TO_UINT(data);

assert(i < ELEMENTSOF(paths_system));

r = sd_path_lookup(paths[i].type, paths[i].suffix, &p);

if (r < 0)

return r;

if (arg_root) {

_cleanup_free_ char *j = NULL;

j = path_join(arg_root, p);

if (!j)

return -ENOMEM;

*ret = TAKE_PTR(j);

} else

*ret = TAKE_PTR(p);

return 0;

}

static int log_unresolvable_specifier(const char *filename, unsigned line) {

static bool notified = false;

/* In system mode, this is called when /etc is not fully initialized (e.g.

log_syntax(NULL,

notified ? LOG_DEBUG : LOG_NOTICE,

filename, line, 0,

"Failed to resolve specifier: %s, skipping",

arg_user ? "Required $XDG_... variable not defined" : "uninitialized /etc detected");

if (!notified)

log_notice("All rules containing unresolvable specifiers will be skipped.");

notified = true;

return 0;

}

static int user_config_paths(char*** ret) {

_cleanup_strv_free_ char **config_dirs = NULL, **data_dirs = NULL;

_cleanup_free_ char *persistent_config = NULL, *runtime_config = NULL, *data_home = NULL;

_cleanup_strv_free_ char **res = NULL;

int r;

r = xdg_user_dirs(&config_dirs, &data_dirs);

if (r < 0)

return r;

r = xdg_user_config_dir(&persistent_config, "/user-tmpfiles.d");

if (r < 0 && r != -ENXIO)

return r;

r = xdg_user_runtime_dir(&runtime_config, "/user-tmpfiles.d");

if (r < 0 && r != -ENXIO)

return r;

r = xdg_user_data_dir(&data_home, "/user-tmpfiles.d");

if (r < 0 && r != -ENXIO)

return r;

r = strv_extend_strv_concat(&res, config_dirs, "/user-tmpfiles.d");

if (r < 0)

return r;

r = strv_extend(&res, persistent_config);

if (r < 0)

return r;

r = strv_extend(&res, runtime_config);

if (r < 0)

return r;

r = strv_extend(&res, data_home);

if (r < 0)

return r;

r = strv_extend_strv_concat(&res, data_dirs, "/user-tmpfiles.d");

if (r < 0)

return r;

r = path_strv_make_absolute_cwd(res);

if (r < 0)

return r;

*ret = TAKE_PTR(res);

return 0;

}

static bool needs_glob(ItemType t) {

return IN_SET(t,

WRITE_FILE,

IGNORE_PATH,

IGNORE_DIRECTORY_PATH,

REMOVE_PATH,

RECURSIVE_REMOVE_PATH,

EMPTY_DIRECTORY,

ADJUST_MODE,

RELABEL_PATH,

RECURSIVE_RELABEL_PATH,

SET_XATTR,

RECURSIVE_SET_XATTR,

SET_ACL,

RECURSIVE_SET_ACL,

SET_ATTRIBUTE,

RECURSIVE_SET_ATTRIBUTE);

}

static bool takes_ownership(ItemType t) {

return IN_SET(t,

CREATE_FILE,

TRUNCATE_FILE,

CREATE_DIRECTORY,

EMPTY_DIRECTORY,

TRUNCATE_DIRECTORY,

CREATE_SUBVOLUME,

CREATE_SUBVOLUME_INHERIT_QUOTA,

CREATE_SUBVOLUME_NEW_QUOTA,

CREATE_FIFO,

CREATE_SYMLINK,

CREATE_CHAR_DEVICE,

CREATE_BLOCK_DEVICE,

COPY_FILES,

WRITE_FILE,

IGNORE_PATH,

IGNORE_DIRECTORY_PATH,

REMOVE_PATH,

RECURSIVE_REMOVE_PATH);

}

static struct Item* find_glob(OrderedHashmap *h, const char *match) {

ItemArray *j;

ORDERED_HASHMAP_FOREACH(j, h) {

size_t n;

for (n = 0; n < j->n_items; n++) {

Item *item = j->items + n;

if (fnmatch(item->path, match, FNM_PATHNAME|FNM_PERIOD) == 0)

return item;

}

}

return NULL;

}

static int load_unix_sockets(void) {

_cleanup_set_free_ Set *sockets = NULL;

_cleanup_fclose_ FILE *f = NULL;

int r;

if (unix_sockets)

return 0;

/* We maintain a cache of the sockets we found in /proc/net/unix to speed things up a little. */

f = fopen("/proc/net/unix", "re");

if (!f)

return log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno,

"Failed to open /proc/net/unix, ignoring: %m");

/* Skip header */

r = read_line(f, LONG_LINE_MAX, NULL);

if (r < 0)

return log_warning_errno(r, "Failed to skip /proc/net/unix header line: %m");

if (r == 0)

return log_warning_errno(SYNTHETIC_ERRNO(EIO), "Premature end of file reading /proc/net/unix.");

for (;;) {

_cleanup_free_ char *line = NULL;

char *p;

r = read_line(f, LONG_LINE_MAX, &line);

if (r < 0)

return log_warning_errno(r, "Failed to read /proc/net/unix line, ignoring: %m");

if (r == 0) /* EOF */

break;

p = strchr(line, ':');

if (!p)

continue;

if (strlen(p) < 37)

continue;

p += 37;

p += strspn(p, WHITESPACE);

p += strcspn(p, WHITESPACE); /* skip one more word */

p += strspn(p, WHITESPACE);

if (!path_is_absolute(p))

continue;

r = set_put_strdup_full(&sockets, &path_hash_ops_free, p);

if (r < 0)

return log_warning_errno(r, "Failed to add AF_UNIX socket to set, ignoring: %m");

}

unix_sockets = TAKE_PTR(sockets);

return 1;

}

static bool unix_socket_alive(const char *fn) {

assert(fn);

if (load_unix_sockets() < 0)

return true; /* We don't know, so assume yes */

return set_contains(unix_sockets, fn);

}

static DIR* xopendirat_nomod(int dirfd, const char *path) {

DIR *dir;

dir = xopendirat(dirfd, path, O_NOFOLLOW|O_NOATIME);

if (dir)

return dir;

log_debug_errno(errno, "Cannot open %sdirectory \"%s\": %m", dirfd == AT_FDCWD ? "" : "sub", path);

if (errno != EPERM)

return NULL;

dir = xopendirat(dirfd, path, O_NOFOLLOW);

if (!dir)

log_debug_errno(errno, "Cannot open %sdirectory \"%s\": %m", dirfd == AT_FDCWD ? "" : "sub", path);

return dir;

}

static DIR* opendir_nomod(const char *path) {

return xopendirat_nomod(AT_FDCWD, path);

}

static inline nsec_t load_statx_timestamp_nsec(const struct statx_timestamp *ts) {

assert(ts);

if (ts->tv_sec < 0)

return NSEC_INFINITY;

if ((nsec_t) ts->tv_sec >= (UINT64_MAX - ts->tv_nsec) / NSEC_PER_SEC)

return NSEC_INFINITY;

return ts->tv_sec * NSEC_PER_SEC + ts->tv_nsec;

}

static bool needs_cleanup(

bool is_dir) {

if (FLAGS_SET(age_by, AGE_BY_MTIME) && mtime != NSEC_INFINITY && mtime >= cutoff) {

/* Follows spelling in stat(1). */

log_debug("%s \"%s\": modify time %s is too new.",

is_dir ? "Directory" : "File",

sub_path,

FORMAT_TIMESTAMP_STYLE(mtime / NSEC_PER_USEC, TIMESTAMP_US));

return false;

}

if (FLAGS_SET(age_by, AGE_BY_ATIME) && atime != NSEC_INFINITY && atime >= cutoff) {

log_debug("%s \"%s\": access time %s is too new.",

is_dir ? "Directory" : "File",

sub_path,

FORMAT_TIMESTAMP_STYLE(atime / NSEC_PER_USEC, TIMESTAMP_US));

return false;

}

/*

if (FLAGS_SET(age_by, AGE_BY_CTIME) && ctime != NSEC_INFINITY && ctime >= cutoff) {

log_debug("%s \"%s\": change time %s is too new.",

is_dir ? "Directory" : "File",

sub_path,

FORMAT_TIMESTAMP_STYLE(ctime / NSEC_PER_USEC, TIMESTAMP_US));

return false;

}

if (FLAGS_SET(age_by, AGE_BY_BTIME) && btime != NSEC_INFINITY && btime >= cutoff) {

log_debug("%s \"%s\": birth time %s is too new.",

is_dir ? "Directory" : "File",

sub_path,

FORMAT_TIMESTAMP_STYLE(btime / NSEC_PER_USEC, TIMESTAMP_US));

return false;

}

return true;

}

static int dir_cleanup(

AgeBy age_by_dir) {

bool deleted = false;

int r = 0;

FOREACH_DIRENT_ALL(de, d, break) {

_cleanup_free_ char *sub_path = NULL;

nsec_t atime_nsec, mtime_nsec, ctime_nsec, btime_nsec;

if (dot_or_dot_dot(de->d_name))

continue;

/* If statx() is supported, use it. It's preferable over fstatat() since it tells us

STRUCT_STATX_DEFINE(sx);

r = statx_fallback(

dirfd(d), de->d_name,

AT_SYMLINK_NOFOLLOW|AT_NO_AUTOMOUNT,

STATX_TYPE|STATX_MODE|STATX_UID|STATX_ATIME|STATX_MTIME|STATX_CTIME|STATX_BTIME,

&sx);

if (r == -ENOENT)

continue;

if (r < 0) {

/* FUSE, NFS mounts, SELinux might return EACCES */

r = log_full_errno(errno == EACCES ? LOG_DEBUG : LOG_ERR, errno,

"statx(%s/%s) failed: %m", p, de->d_name);

continue;

}

if (FLAGS_SET(sx.stx_attributes_mask, STATX_ATTR_MOUNT_ROOT)) {

/* Yay, we have the mount point API, use it */

if (FLAGS_SET(sx.stx_attributes, STATX_ATTR_MOUNT_ROOT)) {

log_debug("Ignoring \"%s/%s\": different mount points.", p, de->d_name);

continue;

}

} else {

/* So we might have statx() but the STATX_ATTR_MOUNT_ROOT flag is not supported, fall

if (sx.stx_dev_major != rootdev_major ||

sx.stx_dev_minor != rootdev_minor) {

log_debug("Ignoring \"%s/%s\": different filesystem.", p, de->d_name);

continue;

}

/* Try to detect bind mounts of the same filesystem instance; they do not differ in device

if (S_ISDIR(sx.stx_mode)) {

int q;

q = fd_is_mount_point(dirfd(d), de->d_name, 0);

if (q < 0)

log_debug_errno(q, "Failed to determine whether \"%s/%s\" is a mount point, ignoring: %m", p, de->d_name);

else if (q > 0) {

log_debug("Ignoring \"%s/%s\": different mount of the same filesystem.", p, de->d_name);

continue;

}

}

}

atime_nsec = FLAGS_SET(sx.stx_mask, STATX_ATIME) ? load_statx_timestamp_nsec(&sx.stx_atime) : 0;

mtime_nsec = FLAGS_SET(sx.stx_mask, STATX_MTIME) ? load_statx_timestamp_nsec(&sx.stx_mtime) : 0;

ctime_nsec = FLAGS_SET(sx.stx_mask, STATX_CTIME) ? load_statx_timestamp_nsec(&sx.stx_ctime) : 0;

btime_nsec = FLAGS_SET(sx.stx_mask, STATX_BTIME) ? load_statx_timestamp_nsec(&sx.stx_btime) : 0;

sub_path = path_join(p, de->d_name);

if (!sub_path) {

r = log_oom();

goto finish;

}

/* Is there an item configured for this path? */

if (ordered_hashmap_get(items, sub_path)) {

log_debug("Ignoring \"%s\": a separate entry exists.", sub_path);

continue;

}

if (find_glob(globs, sub_path)) {

log_debug("Ignoring \"%s\": a separate glob exists.", sub_path);

continue;

}

if (S_ISDIR(sx.stx_mode)) {

_cleanup_closedir_ DIR *sub_dir = NULL;

if (mountpoint &&

streq(de->d_name, "lost+found") &&

sx.stx_uid == 0) {

log_debug("Ignoring directory \"%s\".", sub_path);

continue;

}

if (maxdepth <= 0)

log_warning("Reached max depth on \"%s\".", sub_path);

else {

int q;

sub_dir = xopendirat_nomod(dirfd(d), de->d_name);

if (!sub_dir) {

if (errno != ENOENT)

r = log_warning_errno(errno, "Opening directory \"%s\" failed, ignoring: %m", sub_path);

continue;

}

if (flock(dirfd(sub_dir), LOCK_EX|LOCK_NB) < 0) {

log_debug_errno(errno, "Couldn't acquire shared BSD lock on directory \"%s\", skipping: %m", p);

continue;

}

q = dir_cleanup(i,

sub_path, sub_dir,

atime_nsec, mtime_nsec, cutoff_nsec,

rootdev_major, rootdev_minor,

false, maxdepth-1, false,

age_by_file, age_by_dir);

if (q < 0)

r = q;

}

/* Note: if you are wondering why we don't support the sticky bit for excluding

if (keep_this_level) {

log_debug("Keeping directory \"%s\".", sub_path);

continue;

}

/*

if (!needs_cleanup(atime_nsec, btime_nsec, ctime_nsec, mtime_nsec,

cutoff_nsec, sub_path, age_by_dir, true))

continue;

log_debug("Removing directory \"%s\".", sub_path);

if (unlinkat(dirfd(d), de->d_name, AT_REMOVEDIR) < 0)

if (!IN_SET(errno, ENOENT, ENOTEMPTY))

r = log_warning_errno(errno, "Failed to remove directory \"%s\", ignoring: %m", sub_path);

} else {

/* Skip files for which the sticky bit is set. These are semantics we define, and are

if (sx.stx_mode & S_ISVTX) {

log_debug("Skipping \"%s\": sticky bit set.", sub_path);

continue;

}

if (mountpoint &&

S_ISREG(sx.stx_mode) &&

sx.stx_uid == 0 &&

STR_IN_SET(de->d_name,

".journal",

"aquota.user",

"aquota.group")) {

log_debug("Skipping \"%s\".", sub_path);

continue;

}

/* Ignore sockets that are listed in /proc/net/unix */

if (S_ISSOCK(sx.stx_mode) && unix_socket_alive(sub_path)) {

log_debug("Skipping \"%s\": live socket.", sub_path);

continue;

}

/* Ignore device nodes */

if (S_ISCHR(sx.stx_mode) || S_ISBLK(sx.stx_mode)) {

log_debug("Skipping \"%s\": a device.", sub_path);

continue;

}

/* Keep files on this level around if this is requested */

if (keep_this_level) {

log_debug("Keeping \"%s\".", sub_path);

continue;

}

if (!needs_cleanup(atime_nsec, btime_nsec, ctime_nsec, mtime_nsec,

cutoff_nsec, sub_path, age_by_file, false))

continue;

log_debug("Removing \"%s\".", sub_path);

if (unlinkat(dirfd(d), de->d_name, 0) < 0)

if (errno != ENOENT)

r = log_warning_errno(errno, "Failed to remove \"%s\", ignoring: %m", sub_path);

deleted = true;

}

}

finish:

if (deleted) {

struct timespec ts[2];

log_debug("Restoring access and modification time on \"%s\": %s, %s",

p,

FORMAT_TIMESTAMP_STYLE(self_atime_nsec / NSEC_PER_USEC, TIMESTAMP_US),

FORMAT_TIMESTAMP_STYLE(self_mtime_nsec / NSEC_PER_USEC, TIMESTAMP_US));

timespec_store_nsec(ts + 0, self_atime_nsec);

timespec_store_nsec(ts + 1, self_mtime_nsec);

/* Restore original directory timestamps */

if (futimens(dirfd(d), ts) < 0)

log_warning_errno(errno, "Failed to revert timestamps of '%s', ignoring: %m", p);

}

return r;

}

static bool dangerous_hardlinks(void) {

_cleanup_free_ char *value = NULL;

static int cached = -1;

int r;

/* Check whether the fs.protected_hardlinks sysctl is on. If we can't determine it we assume its off, as that's

if (cached >= 0)

return cached;

r = read_one_line_file("/proc/sys/fs/protected_hardlinks", &value);

if (r < 0) {

log_debug_errno(r, "Failed to read fs.protected_hardlinks sysctl: %m");

return true;

}

r = parse_boolean(value);

if (r < 0) {

log_debug_errno(r, "Failed to parse fs.protected_hardlinks sysctl: %m");

return true;

}

cached = r == 0;

return cached;

}

static bool hardlink_vulnerable(const struct stat *st) {

assert(st);

return !S_ISDIR(st->st_mode) && st->st_nlink > 1 && dangerous_hardlinks();

}

static mode_t process_mask_perms(mode_t mode, mode_t current) {

if ((current & 0111) == 0)

mode &= ~0111;

if ((current & 0222) == 0)

mode &= ~0222;

if ((current & 0444) == 0)

mode &= ~0444;

if (!S_ISDIR(current))

mode &= ~07000; /* remove sticky/sgid/suid bit, unless directory */

return mode;

}

static int fd_set_perms(Item *i, int fd, const char *path, const struct stat *st) {

struct stat stbuf;

mode_t new_mode;

bool do_chown;

int r;

assert(i);

assert(fd >= 0);

assert(path);

if (!i->mode_set && !i->uid_set && !i->gid_set)

goto shortcut;

if (!st) {

if (fstat(fd, &stbuf) < 0)

return log_error_errno(errno, "fstat(%s) failed: %m", path);

st = &stbuf;

}

if (hardlink_vulnerable(st))

return log_error_errno(SYNTHETIC_ERRNO(EPERM),

"Refusing to set permissions on hardlinked file %s while the fs.protected_hardlinks sysctl is turned off.",

path);

/* Do we need a chown()? */

do_chown =

(i->uid_set && i->uid != st->st_uid) ||

(i->gid_set && i->gid != st->st_gid);

/* Calculate the mode to apply */

new_mode = i->mode_set ? (i->mask_perms ?

process_mask_perms(i->mode, st->st_mode) :

i->mode) :

(st->st_mode & 07777);

if (i->mode_set && do_chown) {

/* Before we issue the chmod() let's reduce the access mode to the common bits of the old and

if (S_ISLNK(st->st_mode))

log_debug("Skipping temporary mode fix for symlink %s.", path);

else {

mode_t m = new_mode & st->st_mode; /* Mask new mode by old mode */

if (((m ^ st->st_mode) & 07777) == 0)

log_debug("\"%s\" matches temporary mode %o already.", path, m);

else {

log_debug("Temporarily changing \"%s\" to mode %o.", path, m);

r = fchmod_opath(fd, m);

if (r < 0)

return log_error_errno(r, "fchmod() of %s failed: %m", path);

}

}

}

if (do_chown) {

log_debug("Changing \"%s\" to owner "UID_FMT":"GID_FMT,

path,

i->uid_set ? i->uid : UID_INVALID,

i->gid_set ? i->gid : GID_INVALID);

if (fchownat(fd,

"",

i->uid_set ? i->uid : UID_INVALID,

i->gid_set ? i->gid : GID_INVALID,

AT_EMPTY_PATH) < 0)

return log_error_errno(errno, "fchownat() of %s failed: %m", path);

}

/* Now, apply the final mode. We do this in two cases: when the user set a mode explicitly, or after a

if (i->mode_set || do_chown) {

if (S_ISLNK(st->st_mode))

log_debug("Skipping mode fix for symlink %s.", path);

else {

/* Check if the chmod() is unnecessary. Note that if we did a chown() before we always

if (!do_chown && ((new_mode ^ st->st_mode) & 07777) == 0)

log_debug("\"%s\" matches mode %o already.", path, new_mode);

else {

log_debug("Changing \"%s\" to mode %o.", path, new_mode);

r = fchmod_opath(fd, new_mode);

if (r < 0)

return log_error_errno(r, "fchmod() of %s failed: %m", path);

}

}

}

shortcut:

return label_fix(path, 0);

}

static int path_open_parent_safe(const char *path) {

_cleanup_free_ char *dn = NULL;

int r, fd;

if (path_equal(path, "/") || !path_is_normalized(path))

return log_error_errno(SYNTHETIC_ERRNO(EINVAL),

"Failed to open parent of '%s': invalid path.",

path);

dn = dirname_malloc(path);

if (!dn)

return log_oom();

r = chase_symlinks(dn, arg_root, CHASE_SAFE|CHASE_WARN, NULL, &fd);

if (r < 0 && r != -ENOLINK)

return log_error_errno(r, "Failed to validate path %s: %m", path);

return r < 0 ? r : fd;

}

static int path_open_safe(const char *path) {

int r, fd;

/* path_open_safe() returns a file descriptor opened with O_PATH after

assert(path);

if (!path_is_normalized(path))

return log_error_errno(SYNTHETIC_ERRNO(EINVAL),

"Failed to open invalid path '%s'.",

path);

r = chase_symlinks(path, arg_root, CHASE_SAFE|CHASE_WARN|CHASE_NOFOLLOW, NULL, &fd);

if (r < 0 && r != -ENOLINK)

return log_error_errno(r, "Failed to validate path %s: %m", path);

return r < 0 ? r : fd;

}

static int path_set_perms(Item *i, const char *path) {

_cleanup_close_ int fd = -1;

assert(i);

assert(path);

fd = path_open_safe(path);

if (fd < 0)

return fd;

return fd_set_perms(i, fd, path, NULL);

}

static int parse_xattrs_from_arg(Item *i) {

const char *p;

int r;

assert(i);

assert(i->argument);

p = i->argument;

for (;;) {

_cleanup_free_ char *name = NULL, *value = NULL, *xattr = NULL;

r = extract_first_word(&p, &xattr, NULL, EXTRACT_UNQUOTE|EXTRACT_CUNESCAPE);

if (r < 0)

log_warning_errno(r, "Failed to parse extended attribute '%s', ignoring: %m", p);

if (r <= 0)

break;