system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-07-08 20:15:55 +00:00
Code Issues Projects Releases Wiki Activity

run: add --expand-environment=no to disable server-side envvar expansion

Browse Source 
This uses StartExecEx to get the equivalent of ExecStart=:. StartExecEx was
added in b3d593673c, so this will not work with
older systemds.

A hint is emitted if we get an error indicating lack of support. PID1 returns
SD_BUS_ERROR_PROPERTY_READ_ONLY, but I'm checking for
SD_BUS_ERROR_UNKNOWN_PROPERTY too for safety.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek 2023-04-02 23:17:58 +02:00
parent b58026bddc
commit f872ddd182
2 changed files with 123 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
man/systemd-run.xml
View File

@ -92,6 +92,11 @@
Consider using the <option>exec</option> service type (i.e. <option>--property=Type=exec</option>) to Consider using the <option>exec</option> service type (i.e. <option>--property=Type=exec</option>) to
ensure that <command>systemd-run</command> returns successfully only if the specified command line has ensure that <command>systemd-run</command> returns successfully only if the specified command line has
been successfully started.</para> been successfully started.</para>
<para>After <command>systemd-run</command> passes the command to the service manager, the manager
performs variable expansion. This means that dollar characters (<literal>$</literal>) which should not be
expanded need to be escaped as <literal>$$</literal>. Expansion can also be disabled using
<varname>--expand-environment=no</varname>.</para>
</refsect1> </refsect1>
<refsect1> <refsect1>
@ -169,6 +174,24 @@
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry>
<term><option>--expand-environment=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Expand environment variables in command arguments. If enabled (the default), the
service manager that spawns the actual command will expand variables specified as
<literal>${<replaceable>VARIABLE</replaceable>}</literal> in the same way as in commands specied via
<varname>ExecStart=</varname> in units. Note that this is similar to, but not the same as variable
expansion in
<citerefentry project='man-pages'><refentrytitle>bash</refentrytitle><manvolnum>1</manvolnum></citerefentry>
and other shells.</para>
<para>See
<citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for a description of variable expansion. Disabling variable expansion is useful if the specified
command includes or may include a <literal>$</literal> sign.</para>
</listitem>
</varlistentry>
<varlistentry> <varlistentry>
<term><option>-r</option></term> <term><option>-r</option></term>
<term><option>--remain-after-exit</option></term> <term><option>--remain-after-exit</option></term>
@ -533,7 +556,8 @@ There is a screen on:
<programlisting>$ systemd-run --user --wait true <programlisting>$ systemd-run --user --wait true
$ systemd-run --user --wait -p SuccessExitStatus=11 bash -c 'exit 11' $ systemd-run --user --wait -p SuccessExitStatus=11 bash -c 'exit 11'
$ systemd-run --user --wait -p SuccessExitStatus=SIGUSR1 bash -c 'kill -SIGUSR1 $$$$'</programlisting> $ systemd-run --user --wait -p SuccessExitStatus=SIGUSR1 --expand-environment=no \
bash -c 'kill -SIGUSR1 $$'</programlisting>
<para>Those three invocations will succeed, i.e. terminate with an exit code of 0.</para> <para>Those three invocations will succeed, i.e. terminate with an exit code of 0.</para>
</example> </example>

149
src/run/run.c
View File

@ -45,6 +45,7 @@ static const char *arg_unit = NULL;
static const char *arg_description = NULL; static const char *arg_description = NULL;
static const char *arg_slice = NULL; static const char *arg_slice = NULL;
static bool arg_slice_inherit = false; static bool arg_slice_inherit = false;
static bool arg_expand_environment = true;
static bool arg_send_sighup = false; static bool arg_send_sighup = false;
static BusTransport arg_transport = BUS_TRANSPORT_LOCAL; static BusTransport arg_transport = BUS_TRANSPORT_LOCAL;
static const char *arg_host = NULL; static const char *arg_host = NULL;
@ -102,6 +103,8 @@ static int help(void) {
" --description=TEXT Description for unit\n" " --description=TEXT Description for unit\n"
" --slice=SLICE Run in the specified slice\n" " --slice=SLICE Run in the specified slice\n"
" --slice-inherit Inherit the slice\n" " --slice-inherit Inherit the slice\n"
" --expand-environment=BOOL Control server-side expansion of environment\n"
" variables\n"
" --no-block Do not wait until operation finished\n" " --no-block Do not wait until operation finished\n"
" -r --remain-after-exit Leave service around until explicitly stopped\n" " -r --remain-after-exit Leave service around until explicitly stopped\n"
" --wait Wait until service stopped again\n" " --wait Wait until service stopped again\n"
@ -168,6 +171,7 @@ static int parse_argv(int argc, char *argv[]) {
ARG_DESCRIPTION, ARG_DESCRIPTION,
ARG_SLICE, ARG_SLICE,
ARG_SLICE_INHERIT, ARG_SLICE_INHERIT,
ARG_EXPAND_ENVIRONMENT,
ARG_SEND_SIGHUP, ARG_SEND_SIGHUP,
ARG_SERVICE_TYPE, ARG_SERVICE_TYPE,
ARG_EXEC_USER, ARG_EXEC_USER,
@ -192,47 +196,48 @@ static int parse_argv(int argc, char *argv[]) {
}; };
static const struct option options[] = { static const struct option options[] = {
{ "help", no_argument, NULL, 'h' }, { "help", no_argument, NULL, 'h' },
{ "version", no_argument, NULL, ARG_VERSION }, { "version", no_argument, NULL, ARG_VERSION },
{ "user", no_argument, NULL, ARG_USER }, { "user", no_argument, NULL, ARG_USER },
{ "system", no_argument, NULL, ARG_SYSTEM }, { "system", no_argument, NULL, ARG_SYSTEM },
{ "scope", no_argument, NULL, ARG_SCOPE }, { "scope", no_argument, NULL, ARG_SCOPE },
{ "unit", required_argument, NULL, 'u' }, { "unit", required_argument, NULL, 'u' },
{ "description", required_argument, NULL, ARG_DESCRIPTION }, { "description", required_argument, NULL, ARG_DESCRIPTION },
{ "slice", required_argument, NULL, ARG_SLICE }, { "slice", required_argument, NULL, ARG_SLICE },
{ "slice-inherit", no_argument, NULL, ARG_SLICE_INHERIT }, { "slice-inherit", no_argument, NULL, ARG_SLICE_INHERIT },
{ "remain-after-exit", no_argument, NULL, 'r' }, { "remain-after-exit", no_argument, NULL, 'r' },
{ "send-sighup", no_argument, NULL, ARG_SEND_SIGHUP }, { "expand-environment", required_argument, NULL, ARG_EXPAND_ENVIRONMENT },
{ "host", required_argument, NULL, 'H' }, { "send-sighup", no_argument, NULL, ARG_SEND_SIGHUP },
{ "machine", required_argument, NULL, 'M' }, { "host", required_argument, NULL, 'H' },
{ "service-type", required_argument, NULL, ARG_SERVICE_TYPE }, { "machine", required_argument, NULL, 'M' },
{ "wait", no_argument, NULL, ARG_WAIT }, { "service-type", required_argument, NULL, ARG_SERVICE_TYPE },
{ "uid", required_argument, NULL, ARG_EXEC_USER }, { "wait", no_argument, NULL, ARG_WAIT },
{ "gid", required_argument, NULL, ARG_EXEC_GROUP }, { "uid", required_argument, NULL, ARG_EXEC_USER },
{ "nice", required_argument, NULL, ARG_NICE }, { "gid", required_argument, NULL, ARG_EXEC_GROUP },
{ "setenv", required_argument, NULL, 'E' }, { "nice", required_argument, NULL, ARG_NICE },
{ "property", required_argument, NULL, 'p' }, { "setenv", required_argument, NULL, 'E' },
{ "tty", no_argument, NULL, 't' }, /* deprecated alias */ { "property", required_argument, NULL, 'p' },
{ "pty", no_argument, NULL, 't' }, { "tty", no_argument, NULL, 't' }, /* deprecated alias */
{ "pipe", no_argument, NULL, 'P' }, { "pty", no_argument, NULL, 't' },
{ "quiet", no_argument, NULL, 'q' }, { "pipe", no_argument, NULL, 'P' },
{ "on-active", required_argument, NULL, ARG_ON_ACTIVE }, { "quiet", no_argument, NULL, 'q' },
{ "on-boot", required_argument, NULL, ARG_ON_BOOT }, { "on-active", required_argument, NULL, ARG_ON_ACTIVE },
{ "on-startup", required_argument, NULL, ARG_ON_STARTUP }, { "on-boot", required_argument, NULL, ARG_ON_BOOT },
{ "on-unit-active", required_argument, NULL, ARG_ON_UNIT_ACTIVE }, { "on-startup", required_argument, NULL, ARG_ON_STARTUP },
{ "on-unit-inactive", required_argument, NULL, ARG_ON_UNIT_INACTIVE }, { "on-unit-active", required_argument, NULL, ARG_ON_UNIT_ACTIVE },
{ "on-calendar", required_argument, NULL, ARG_ON_CALENDAR }, { "on-unit-inactive", required_argument, NULL, ARG_ON_UNIT_INACTIVE },
{ "on-timezone-change",no_argument, NULL, ARG_ON_TIMEZONE_CHANGE}, { "on-calendar", required_argument, NULL, ARG_ON_CALENDAR },
{ "on-clock-change", no_argument, NULL, ARG_ON_CLOCK_CHANGE }, { "on-timezone-change", no_argument, NULL, ARG_ON_TIMEZONE_CHANGE },
{ "timer-property", required_argument, NULL, ARG_TIMER_PROPERTY }, { "on-clock-change", no_argument, NULL, ARG_ON_CLOCK_CHANGE },
{ "path-property", required_argument, NULL, ARG_PATH_PROPERTY }, { "timer-property", required_argument, NULL, ARG_TIMER_PROPERTY },
{ "socket-property", required_argument, NULL, ARG_SOCKET_PROPERTY }, { "path-property", required_argument, NULL, ARG_PATH_PROPERTY },
{ "no-block", no_argument, NULL, ARG_NO_BLOCK }, { "socket-property", required_argument, NULL, ARG_SOCKET_PROPERTY },
{ "no-ask-password", no_argument, NULL, ARG_NO_ASK_PASSWORD }, { "no-block", no_argument, NULL, ARG_NO_BLOCK },
{ "collect", no_argument, NULL, 'G' }, { "no-ask-password", no_argument, NULL, ARG_NO_ASK_PASSWORD },
{ "working-directory", required_argument, NULL, ARG_WORKING_DIRECTORY }, { "collect", no_argument, NULL, 'G' },
{ "same-dir", no_argument, NULL, 'd' }, { "working-directory", required_argument, NULL, ARG_WORKING_DIRECTORY },
{ "shell", no_argument, NULL, 'S' }, { "same-dir", no_argument, NULL, 'd' },
{ "shell", no_argument, NULL, 'S' },
{}, {},
}; };
@ -284,6 +289,12 @@ static int parse_argv(int argc, char *argv[]) {
arg_slice_inherit = true; arg_slice_inherit = true;
break; break;
case ARG_EXPAND_ENVIRONMENT:
r = parse_boolean_argument("--expand-environment=", optarg, &arg_expand_environment);
if (r < 0)
return r;
break;
case ARG_SEND_SIGHUP: case ARG_SEND_SIGHUP:
arg_send_sighup = true; arg_send_sighup = true;
break; break;
@ -716,6 +727,11 @@ static int transient_service_set_properties(sd_bus_message *m, const char *pty_p
bool send_term = false; bool send_term = false;
int r; int r;
/* We disable environment expansion on the server side via ExecStartEx=:.
* ExecStartEx was added relatively recently (v243), and some bugs were fixed only later.
* So use that feature only if required. It will fail with older systemds. */
bool use_ex_prop = !arg_expand_environment;
assert(m); assert(m);
r = transient_unit_set_properties(m, UNIT_SERVICE, arg_property); r = transient_unit_set_properties(m, UNIT_SERVICE, arg_property);
@ -847,19 +863,23 @@ static int transient_service_set_properties(sd_bus_message *m, const char *pty_p
if (r < 0) if (r < 0)
return bus_log_create_error(r); return bus_log_create_error(r);
r = sd_bus_message_append(m, "s", "ExecStart"); r = sd_bus_message_append(m, "s",
use_ex_prop ? "ExecStartEx" : "ExecStart");
if (r < 0) if (r < 0)
return bus_log_create_error(r); return bus_log_create_error(r);
r = sd_bus_message_open_container(m, 'v', "a(sasb)"); r = sd_bus_message_open_container(m, 'v',
use_ex_prop ? "a(sasas)" : "a(sasb)");
if (r < 0) if (r < 0)
return bus_log_create_error(r); return bus_log_create_error(r);
r = sd_bus_message_open_container(m, 'a', "(sasb)"); r = sd_bus_message_open_container(m, 'a',
use_ex_prop ? "(sasas)" : "(sasb)");
if (r < 0) if (r < 0)
return bus_log_create_error(r); return bus_log_create_error(r);
r = sd_bus_message_open_container(m, 'r', "sasb"); r = sd_bus_message_open_container(m, 'r',
use_ex_prop ? "sasas" : "sasb");
if (r < 0) if (r < 0)
return bus_log_create_error(r); return bus_log_create_error(r);
@ -871,7 +891,12 @@ static int transient_service_set_properties(sd_bus_message *m, const char *pty_p
if (r < 0) if (r < 0)
return bus_log_create_error(r); return bus_log_create_error(r);
r = sd_bus_message_append(m, "b", false); if (use_ex_prop)
r = sd_bus_message_append_strv(
m,
STRV_MAKE(arg_expand_environment ? NULL : "no-env-expand"));
else
r = sd_bus_message_append(m, "b", false);
if (r < 0) if (r < 0)
return bus_log_create_error(r); return bus_log_create_error(r);
@ -1157,6 +1182,29 @@ static int make_transient_service_unit(
return 0; return 0;
} }
static int bus_call_with_hint(
sd_bus *bus,
sd_bus_message *message,
const char *name,
sd_bus_message **reply) {
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
int r;
r = sd_bus_call(bus, message, 0, &error, reply);
if (r < 0) {
log_error_errno(r, "Failed to start transient %s unit: %s", name, bus_error_message(&error, r));
if (!arg_expand_environment &&
sd_bus_error_has_names(&error,
SD_BUS_ERROR_UNKNOWN_PROPERTY,
SD_BUS_ERROR_PROPERTY_READ_ONLY))
log_notice_errno(r, "Hint: --expand-environment=no is not supported by old systemd");
}
return r;
}
static int start_transient_service(sd_bus *bus) { static int start_transient_service(sd_bus *bus) {
_cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL, *reply = NULL; _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL, *reply = NULL;
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL; _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
@ -1244,9 +1292,9 @@ static int start_transient_service(sd_bus *bus) {
polkit_agent_open_if_enabled(arg_transport, arg_ask_password); polkit_agent_open_if_enabled(arg_transport, arg_ask_password);
r = sd_bus_call(bus, m, 0, &error, &reply); r = bus_call_with_hint(bus, m, "service", &reply);
if (r < 0) if (r < 0)
return log_error_errno(r, "Failed to start transient service unit: %s", bus_error_message(&error, r)); return r;
if (w) { if (w) {
const char *object; const char *object;
@ -1659,7 +1707,6 @@ static int make_transient_trigger_unit(
} }
static int start_transient_trigger(sd_bus *bus, const char *suffix) { static int start_transient_trigger(sd_bus *bus, const char *suffix) {
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
_cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL, *reply = NULL; _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL, *reply = NULL;
_cleanup_(bus_wait_for_jobs_freep) BusWaitForJobs *w = NULL; _cleanup_(bus_wait_for_jobs_freep) BusWaitForJobs *w = NULL;
_cleanup_free_ char *trigger = NULL, *service = NULL; _cleanup_free_ char *trigger = NULL, *service = NULL;
@ -1727,9 +1774,9 @@ static int start_transient_trigger(sd_bus *bus, const char *suffix) {
polkit_agent_open_if_enabled(arg_transport, arg_ask_password); polkit_agent_open_if_enabled(arg_transport, arg_ask_password);
r = sd_bus_call(bus, m, 0, &error, &reply); r = bus_call_with_hint(bus, m, suffix + 1, &reply);
if (r < 0) if (r < 0)
return log_error_errno(r, "Failed to start transient %s unit: %s", suffix + 1, bus_error_message(&error, r)); return r;
r = sd_bus_message_read(reply, "o", &object); r = sd_bus_message_read(reply, "o", &object);
if (r < 0) if (r < 0)