15175033720

Committed 21 May 2025 10:22PM UTC coverage: 72.079% (+0.03%) from 72.047%

Build # 15175033720

Build Type

push

github

Committed by

web-flow

Commit Message

Several minor follow-ups for #33995 (#37558)

Coverage Stats

3 of 3 new or added lines in 1 file covered. (100.0%)

34302 existing lines in 652 files now uncovered.

299232 of 415142 relevant lines covered (72.08%)

700018.81 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/src/ssh-generator/ssh-generator.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <unistd.h>

#include "alloc-util.h"
#include "creds-util.h"
#include "errno-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "generator.h"
#include "install.h"
#include "log.h"
#include "missing_socket.h"
#include "parse-util.h"
#include "path-util.h"
#include "proc-cmdline.h"
#include "socket-netlink.h"
#include "socket-util.h"
#include "special.h"
#include "string-util.h"
#include "strv.h"
#include "virt.h"

/* A small generator binding potentially five or more SSH sockets:
 *
 *     1. Listen on AF_VSOCK port 22 if we run in a VM with AF_VSOCK enabled
 *     2. Listen on AF_UNIX socket /run/host/unix-export/ssh if we run in a container with /run/host/ support
 *     3. Listen on AF_UNIX socket /run/ssh-unix-local/socket (always)
 *     4. Listen on any socket specified via kernel command line option systemd.ssh_listen=
 *     5. Similar, but from system credential ssh.listen
 *
 * The first two provide a nice way for hosts to connect to containers and VMs they invoke via the usual SSH
 * logic, but without waiting for networking or suchlike. The third allows the same for local clients. */

static const char *arg_dest = NULL;
static bool arg_auto = true;
static char **arg_listen_extra = NULL;

static int parse_proc_cmdline_item(const char *key, const char *value, void *data) {
        int r;

        assert(key);

        if (proc_cmdline_key_streq(key, "systemd.ssh_auto")) {
                r = value ? parse_boolean(value) : 1;
                if (r < 0)
                        log_warning_errno(r, "Failed to parse systemd.ssh_auto switch \"%s\", ignoring: %m", value);
                else
                        arg_auto = r;

        } else if (proc_cmdline_key_streq(key, "systemd.ssh_listen")) {

                if (proc_cmdline_value_missing(key, value))
                        return 0;

                SocketAddress sa;
                r = socket_address_parse(&sa, value);
                if (r < 0)
                        log_warning_errno(r, "Failed to parse systemd.ssh_listen= expression, ignoring: %s", value);
                else {
                        _cleanup_free_ char *s = NULL;
                        r = socket_address_print(&sa, &s);
                        if (r < 0)
                                return log_error_errno(r, "Failed to format socket address: %m");

                        if (strv_consume(&arg_listen_extra, TAKE_PTR(s)) < 0)
                                return log_oom();
                }
        }

        return 0;
}

static int make_sshd_template_unit(
                const char *dest,
                const char *template,
                const char *sshd_binary,
                const char *found_sshd_template_service,
                char **generated_sshd_template_unit) {

        int r;

        assert(dest);
        assert(template);
        assert(sshd_binary);
        assert(generated_sshd_template_unit);

        /* If the system has a suitable template already, symlink it to the name we want to reuse it */
        if (found_sshd_template_service)
                return generator_add_symlink(
                                dest,
                                template,
                                /* dep_type= */ NULL,
                                found_sshd_template_service);

        if (!*generated_sshd_template_unit) {
                _cleanup_fclose_ FILE *f = NULL;

                r = generator_open_unit_file_full(
                                dest,
                                /* source= */ NULL,
                                "sshd-generated@.service", /* Give this generated unit a generic name, since we want to use it for both AF_UNIX and AF_VSOCK */
                                &f,
                                generated_sshd_template_unit,
                                /* ret_temp_path= */ NULL);
                if (r < 0)
                        return r;

                fprintf(f,
                        "[Unit]\n"
                        "Description=OpenSSH Per-Connection Server Daemon\n"
                        "Documentation=man:systemd-ssh-generator(8) man:sshd(8)\n"
                        "[Service]\n"
                        "ExecStart=-%s -i -o \"AuthorizedKeysFile ${CREDENTIALS_DIRECTORY}/ssh.ephemeral-authorized_keys-all .ssh/authorized_keys\"\n"
                        "StandardInput=socket\n"
                        "ImportCredential=ssh.ephemeral-authorized_keys-all",
                        sshd_binary);

                r = fflush_and_check(f);
                if (r < 0)
                        return log_error_errno(r, "Failed to write sshd template: %m");
        }

        return generator_add_symlink(
                        dest,
                        template,
                        /* dep_type= */ NULL,
                        *generated_sshd_template_unit);
}

static int write_socket_unit(
                const char *dest,
                const char *unit,
                const char *listen_stream,
                const char *comment,
                bool with_ssh_access_target_dependency) {

        int r;

        assert(dest);
        assert(unit);
        assert(listen_stream);
        assert(comment);

        _cleanup_fclose_ FILE *f = NULL;
        r = generator_open_unit_file(
                        dest,
                        /* source= */ NULL,
                        unit,
                        &f);
        if (r < 0)
                return r;

        fprintf(f,
                "[Unit]\n"
                "Description=OpenSSH Server Socket (systemd-ssh-generator, %s)\n"
                "Documentation=man:systemd-ssh-generator(8)\n",
                comment);

        /* When this is a remotely accessible socket let's mark this with a milestone: ssh-access.target */
        if (with_ssh_access_target_dependency)
                fputs("Wants=ssh-access.target\n"
                      "Before=ssh-access.target\n",
                      f);

        fprintf(f,
                "\n[Socket]\n"
                "ListenStream=%s\n"
                "Accept=yes\n"
                "PollLimitIntervalSec=30s\n"
                "PollLimitBurst=50\n",
                listen_stream);

        r = fflush_and_check(f);
        if (r < 0)
                return log_error_errno(r, "Failed to write %s SSH socket unit: %m", comment);

        r = generator_add_symlink(
                        dest,
                        SPECIAL_SOCKETS_TARGET,
                        "wants",
                        unit);
        if (r < 0)
                return r;

        return 0;
}

static int add_vsock_socket(
                const char *dest,
                const char *sshd_binary,
                const char *found_sshd_template_unit,
                char **generated_sshd_template_unit) {

        int r;

        assert(dest);
        assert(generated_sshd_template_unit);

        Virtualization v = detect_virtualization();
        if (v < 0)
                return log_error_errno(v, "Failed to detect if we run in a VM: %m");
        if (!VIRTUALIZATION_IS_VM(v)) {
                /* NB: if we are running in a container inside a VM, then we'll *not* do AF_VSOCK stuff */
                log_debug("Not running in a VM, not listening on AF_VSOCK.");
                return 0;
        }

        _cleanup_close_ int vsock_fd = socket(AF_VSOCK, SOCK_STREAM|SOCK_CLOEXEC, 0);
        if (vsock_fd < 0) {
                if (ERRNO_IS_NOT_SUPPORTED(errno)) {
                        log_debug("Not creating AF_VSOCK ssh listener, since AF_VSOCK is not available.");
                        return 0;
                }

                return log_error_errno(errno, "Unable to test if AF_VSOCK is available: %m");
        }

        vsock_fd = safe_close(vsock_fd);

        /* Determine the local CID so that we can log it to help users to connect to this VM */
        unsigned local_cid;
        r = vsock_get_local_cid(&local_cid);
        if (r < 0) {
                if (ERRNO_IS_DEVICE_ABSENT(r)) {
                        log_debug("Not creating AF_VSOCK ssh listener, since /dev/vsock is not available (even though AF_VSOCK is).");
                        return 0;
                }

                return log_error_errno(r, "Failed to query local AF_VSOCK CID: %m");
        }

        r = make_sshd_template_unit(
                        dest,
                        "sshd-vsock@.service",
                        sshd_binary,
                        found_sshd_template_unit,
                        generated_sshd_template_unit);
        if (r < 0)
                return r;

        r = write_socket_unit(
                        dest,
                        "sshd-vsock.socket",
                        "vsock::22",
                        "AF_VSOCK",
                        /* with_ssh_access_target_dependency= */ true);
        if (r < 0)
                return r;

        log_debug("Binding SSH to AF_VSOCK vsock::22.\n"
                  "→ connect via 'ssh vsock/%u' from host", local_cid);
        return 0;
}

static int add_local_unix_socket(
                const char *dest,
                const char *sshd_binary,
                const char *found_sshd_template_unit,
                char **generated_sshd_template_unit) {

        int r;

        assert(dest);
        assert(sshd_binary);
        assert(generated_sshd_template_unit);

        r = make_sshd_template_unit(
                        dest,
                        "sshd-unix-local@.service",
                        sshd_binary,
                        found_sshd_template_unit,
                        generated_sshd_template_unit);
        if (r < 0)
                return r;

        r = write_socket_unit(
                        dest,
                        "sshd-unix-local.socket",
                        "/run/ssh-unix-local/socket",
                        "AF_UNIX Local",
                        /* with_ssh_access_target_dependency= */ false);
        if (r < 0)
                return r;

        log_debug("Binding SSH to AF_UNIX socket /run/ssh-unix-local/socket.\n"
                  "→ connect via 'ssh .host' locally");
        return 0;
}

static int add_export_unix_socket(
                const char *dest,
                const char *sshd_binary,
                const char *found_sshd_template_unit,
                char **generated_sshd_template_unit) {

        int r;

        assert(dest);
        assert(sshd_binary);
        assert(generated_sshd_template_unit);

        Virtualization v = detect_container();
        if (v < 0)
                return log_error_errno(v, "Failed to detect if we run in a container: %m");
        if (v == VIRTUALIZATION_NONE) {
                log_debug("Not running in container, not listening on /run/host/unix-export/ssh");
                return 0;
        }

        if (access("/run/host/unix-export/", W_OK) < 0) {
                if (errno == ENOENT) {
                        log_debug("Container manager does not provide /run/host/unix-export/ mount, not binding AF_UNIX socket there.");
                        return 0;
                }
                if (errno == EROFS || ERRNO_IS_PRIVILEGE(errno)) {
                        log_debug("Container manager does not provide write access to /run/host/unix-export/, not binding AF_UNIX socket there.");
                        return 0;
                }

                return log_error_errno(errno, "Unable to check if /run/host/unix-export exists: %m");
        }

        r = make_sshd_template_unit(
                        dest,
                        "sshd-unix-export@.service",
                        sshd_binary,
                        found_sshd_template_unit,
                        generated_sshd_template_unit);
        if (r < 0)
                return r;

        r = write_socket_unit(
                        dest,
                        "sshd-unix-export.socket",
                        "/run/host/unix-export/ssh",
                        "AF_UNIX Export",
                        /* with_ssh_access_target_dependency= */ true);
        if (r < 0)
                return r;

        log_debug("Binding SSH to AF_UNIX socket /run/host/unix-export/ssh\n"
                  "→ connect via 'ssh unix/run/systemd/nspawn/unix-export/\?\?\?/ssh' from host");

        return 0;
}

static int add_extra_sockets(
                const char *dest,
                const char *sshd_binary,
                const char *found_sshd_template_unit,
                char **generated_sshd_template_unit) {

        unsigned n = 1;
        int r;

        assert(dest);
        assert(sshd_binary);
        assert(generated_sshd_template_unit);

        if (strv_isempty(arg_listen_extra))
                return 0;

        STRV_FOREACH(i, arg_listen_extra) {
                _cleanup_free_ char *service = NULL, *socket = NULL;

                if (n > 1) {
                        if (asprintf(&service, "sshd-extra-%u@.service", n) < 0)
                                return log_oom();

                        if (asprintf(&socket, "sshd-extra-%u.socket", n) < 0)
                                return log_oom();
                }

                r = make_sshd_template_unit(
                                dest,
                                service ?: "sshd-extra@.service",
                                sshd_binary,
                                found_sshd_template_unit,
                                generated_sshd_template_unit);
                if (r < 0)
                        return r;

                r = write_socket_unit(
                                dest,
                                socket ?: "sshd-extra.socket",
                                *i,
                                *i,
                                /* with_ssh_access_target_dependency= */ true);
                if (r < 0)
                        return r;

                log_debug("Binding SSH to socket %s.", *i);
                n++;
        }

        return 0;
}

static int parse_credentials(void) {
        _cleanup_free_ char *b = NULL;
        size_t sz = 0;
        int r;

        r = read_credential_with_decryption("ssh.listen", (void**) &b, &sz);
        if (r <= 0)
                return r;

        _cleanup_fclose_ FILE *f = NULL;
        f = fmemopen_unlocked(b, sz, "r");
        if (!f)
                return log_oom();

        for (;;) {
                _cleanup_free_ char *item = NULL;

                r = read_stripped_line(f, LINE_MAX, &item);
                if (r == 0)
                        break;
                if (r < 0) {
                        log_error_errno(r, "Failed to parse credential 'ssh.listen': %m");
                        break;
                }

                if (startswith(item, "#"))
                        continue;

                SocketAddress sa;
                r = socket_address_parse(&sa, item);
                if (r < 0) {
                        log_warning_errno(r, "Failed to parse systemd.ssh_listen= expression, ignoring: %s", item);
                        continue;
                }

                _cleanup_free_ char *s = NULL;
                r = socket_address_print(&sa, &s);
                if (r < 0)
                        return log_error_errno(r, "Failed to format socket address: %m");

                if (strv_consume(&arg_listen_extra, TAKE_PTR(s)) < 0)
                        return log_oom();
        }

        return 0;
}

static int run(const char *dest, const char *dest_early, const char *dest_late) {
        int r;

        assert_se(arg_dest = dest);

        r = proc_cmdline_parse(parse_proc_cmdline_item, /* userdata= */ NULL, /* flags= */ 0);
        if (r < 0)
                log_warning_errno(r, "Failed to parse kernel command line, ignoring: %m");

        (void) parse_credentials();

        strv_sort_uniq(arg_listen_extra);

        if (!arg_auto && strv_isempty(arg_listen_extra)) {
                log_debug("Disabling SSH generator logic, because as it has been turned off explicitly.");
                return 0;
        }

        _cleanup_free_ char *sshd_binary = NULL;
        r = find_executable("sshd", &sshd_binary);
        if (r == -ENOENT) {
                log_debug("Disabling SSH generator logic, since sshd is not installed.");
                return 0;
        }
        if (r < 0)
                return log_error_errno(r, "Failed to determine if sshd is installed: %m");

        _cleanup_(lookup_paths_done) LookupPaths lp = {};
        r = lookup_paths_init_or_warn(&lp, RUNTIME_SCOPE_SYSTEM, LOOKUP_PATHS_EXCLUDE_GENERATED, /* root_dir= */ NULL);
        if (r < 0)
                return r;

        _cleanup_free_ char *found_sshd_template_unit = NULL;
        r = unit_file_exists_full(RUNTIME_SCOPE_SYSTEM, &lp, "sshd@.service", &found_sshd_template_unit);
        if (r < 0)
                return log_error_errno(r, "Unable to detect if sshd@.service exists: %m");

        _cleanup_free_ char *generated_sshd_template_unit = NULL;
        RET_GATHER(r, add_extra_sockets(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit));

        if (arg_auto) {
                RET_GATHER(r, add_vsock_socket(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit));
                RET_GATHER(r, add_local_unix_socket(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit));
                RET_GATHER(r, add_export_unix_socket(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit));
        }

        return r;
}

DEFINE_MAIN_GENERATOR_FUNCTION(run);

1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3	#include <unistd.h>
4
5	#include "alloc-util.h"
6	#include "creds-util.h"
7	#include "errno-util.h"
8	#include "fd-util.h"
9	#include "fileio.h"
10	#include "generator.h"
11	#include "install.h"
12	#include "log.h"
13	#include "missing_socket.h"
14	#include "parse-util.h"
15	#include "path-util.h"
16	#include "proc-cmdline.h"
17	#include "socket-netlink.h"
18	#include "socket-util.h"
19	#include "special.h"
20	#include "string-util.h"
21	#include "strv.h"
22	#include "virt.h"
23
24	/* A small generator binding potentially five or more SSH sockets:
25	*
26	* 1. Listen on AF_VSOCK port 22 if we run in a VM with AF_VSOCK enabled
27	* 2. Listen on AF_UNIX socket /run/host/unix-export/ssh if we run in a container with /run/host/ support
28	* 3. Listen on AF_UNIX socket /run/ssh-unix-local/socket (always)
29	* 4. Listen on any socket specified via kernel command line option systemd.ssh_listen=
30	* 5. Similar, but from system credential ssh.listen
31	*
32	* The first two provide a nice way for hosts to connect to containers and VMs they invoke via the usual SSH
33	* logic, but without waiting for networking or suchlike. The third allows the same for local clients. */
34
35	static const char *arg_dest = NULL;
36	static bool arg_auto = true;
37	static char **arg_listen_extra = NULL;
38
UNCOV 39	static int parse_proc_cmdline_item(const char key, const char value, void *data) {	×
UNCOV 40	int r;	×
41
42	assert(key);	×
43
44	if (proc_cmdline_key_streq(key, "systemd.ssh_auto")) {	×
UNCOV 45	r = value ? parse_boolean(value) : 1;	×
46	if (r < 0)	×
47	log_warning_errno(r, "Failed to parse systemd.ssh_auto switch \"%s\", ignoring: %m", value);	×
48	else
49	arg_auto = r;	×
50
51	} else if (proc_cmdline_key_streq(key, "systemd.ssh_listen")) {	×
52
53	if (proc_cmdline_value_missing(key, value))	×
UNCOV 54	return 0;	×
55
56	SocketAddress sa;	×
UNCOV 57	r = socket_address_parse(&sa, value);	×
58	if (r < 0)	×
59	log_warning_errno(r, "Failed to parse systemd.ssh_listen= expression, ignoring: %s", value);	×
60	else {
61	_cleanup_free_ char *s = NULL;	×
UNCOV 62	r = socket_address_print(&sa, &s);	×
63	if (r < 0)	×
64	return log_error_errno(r, "Failed to format socket address: %m");	×
65
66	if (strv_consume(&arg_listen_extra, TAKE_PTR(s)) < 0)	×
UNCOV 67	return log_oom();	×
68	}
69	}
70
71	return 0;
72	}
73
UNCOV 74	static int make_sshd_template_unit(	×
75	const char *dest,
76	const char *template,
77	const char *sshd_binary,
78	const char *found_sshd_template_service,
79	char **generated_sshd_template_unit) {
80
UNCOV 81	int r;	×
82
83	assert(dest);	×
UNCOV 84	assert(template);	×
85	assert(sshd_binary);	×
86	assert(generated_sshd_template_unit);	×
87
88	/* If the system has a suitable template already, symlink it to the name we want to reuse it */
UNCOV 89	if (found_sshd_template_service)	×
UNCOV 90	return generator_add_symlink(	×
91	dest,
92	template,
93	/* dep_type= */ NULL,
94	found_sshd_template_service);
95
UNCOV 96	if (!*generated_sshd_template_unit) {	×
UNCOV 97	_cleanup_fclose_ FILE *f = NULL;	×
98
99	r = generator_open_unit_file_full(	×
100	dest,
101	/* source= */ NULL,
102	"sshd-generated@.service", /* Give this generated unit a generic name, since we want to use it for both AF_UNIX and AF_VSOCK */
103	&f,
104	generated_sshd_template_unit,
105	/* ret_temp_path= */ NULL);
UNCOV 106	if (r < 0)	×
107	return r;
108
UNCOV 109	fprintf(f,	×
110	"[Unit]\n"
111	"Description=OpenSSH Per-Connection Server Daemon\n"
112	"Documentation=man:systemd-ssh-generator(8) man:sshd(8)\n"
113	"[Service]\n"
114	"ExecStart=-%s -i -o \"AuthorizedKeysFile ${CREDENTIALS_DIRECTORY}/ssh.ephemeral-authorized_keys-all .ssh/authorized_keys\"\n"
115	"StandardInput=socket\n"
116	"ImportCredential=ssh.ephemeral-authorized_keys-all",
117	sshd_binary);
118
UNCOV 119	r = fflush_and_check(f);	×
UNCOV 120	if (r < 0)	×
121	return log_error_errno(r, "Failed to write sshd template: %m");	×
122	}
123
UNCOV 124	return generator_add_symlink(	×
125	dest,
126	template,
127	/* dep_type= */ NULL,
128	*generated_sshd_template_unit);
129	}
130
UNCOV 131	static int write_socket_unit(	×
132	const char *dest,
133	const char *unit,
134	const char *listen_stream,
135	const char *comment,
136	bool with_ssh_access_target_dependency) {
137
UNCOV 138	int r;	×
139
140	assert(dest);	×
UNCOV 141	assert(unit);	×
142	assert(listen_stream);	×
143	assert(comment);	×
144
145	_cleanup_fclose_ FILE *f = NULL;	×
UNCOV 146	r = generator_open_unit_file(	×
147	dest,
148	/* source= */ NULL,
149	unit,
150	&f);
UNCOV 151	if (r < 0)	×
152	return r;
153
UNCOV 154	fprintf(f,	×
155	"[Unit]\n"
156	"Description=OpenSSH Server Socket (systemd-ssh-generator, %s)\n"
157	"Documentation=man:systemd-ssh-generator(8)\n",
158	comment);
159
160	/* When this is a remotely accessible socket let's mark this with a milestone: ssh-access.target */
UNCOV 161	if (with_ssh_access_target_dependency)	×
UNCOV 162	fputs("Wants=ssh-access.target\n"	×
163	"Before=ssh-access.target\n",
164	f);
165
UNCOV 166	fprintf(f,	×
167	"\n[Socket]\n"
168	"ListenStream=%s\n"
169	"Accept=yes\n"
170	"PollLimitIntervalSec=30s\n"
171	"PollLimitBurst=50\n",
172	listen_stream);
173
UNCOV 174	r = fflush_and_check(f);	×
UNCOV 175	if (r < 0)	×
176	return log_error_errno(r, "Failed to write %s SSH socket unit: %m", comment);	×
177
178	r = generator_add_symlink(	×
179	dest,
180	SPECIAL_SOCKETS_TARGET,
181	"wants",
182	unit);
UNCOV 183	if (r < 0)	×
UNCOV 184	return r;	×
185
186	return 0;
187	}
188
UNCOV 189	static int add_vsock_socket(	×
190	const char *dest,
191	const char *sshd_binary,
192	const char *found_sshd_template_unit,
193	char **generated_sshd_template_unit) {
194
UNCOV 195	int r;	×
196
197	assert(dest);	×
UNCOV 198	assert(generated_sshd_template_unit);	×
199
200	Virtualization v = detect_virtualization();	×
UNCOV 201	if (v < 0)	×
202	return log_error_errno(v, "Failed to detect if we run in a VM: %m");	×
203	if (!VIRTUALIZATION_IS_VM(v)) {	×
204	/* NB: if we are running in a container inside a VM, then we'll not do AF_VSOCK stuff */
205	log_debug("Not running in a VM, not listening on AF_VSOCK.");	×
UNCOV 206	return 0;	×
207	}
208
UNCOV 209	_cleanup_close_ int vsock_fd = socket(AF_VSOCK, SOCK_STREAM\|SOCK_CLOEXEC, 0);	×
UNCOV 210	if (vsock_fd < 0) {	×
211	if (ERRNO_IS_NOT_SUPPORTED(errno)) {	×
212	log_debug("Not creating AF_VSOCK ssh listener, since AF_VSOCK is not available.");	×
213	return 0;	×
214	}
215
UNCOV 216	return log_error_errno(errno, "Unable to test if AF_VSOCK is available: %m");	×
217	}
218
UNCOV 219	vsock_fd = safe_close(vsock_fd);	×
220
221	/* Determine the local CID so that we can log it to help users to connect to this VM */
UNCOV 222	unsigned local_cid;	×
UNCOV 223	r = vsock_get_local_cid(&local_cid);	×
224	if (r < 0) {	×
225	if (ERRNO_IS_DEVICE_ABSENT(r)) {	×
226	log_debug("Not creating AF_VSOCK ssh listener, since /dev/vsock is not available (even though AF_VSOCK is).");	×
227	return 0;	×
228	}
229
UNCOV 230	return log_error_errno(r, "Failed to query local AF_VSOCK CID: %m");	×
231	}
232
UNCOV 233	r = make_sshd_template_unit(	×
234	dest,
235	"sshd-vsock@.service",
236	sshd_binary,
237	found_sshd_template_unit,
238	generated_sshd_template_unit);
UNCOV 239	if (r < 0)	×
240	return r;
241
UNCOV 242	r = write_socket_unit(	×
243	dest,
244	"sshd-vsock.socket",
245	"vsock::22",
246	"AF_VSOCK",
247	/* with_ssh_access_target_dependency= */ true);
UNCOV 248	if (r < 0)	×
249	return r;
250
UNCOV 251	log_debug("Binding SSH to AF_VSOCK vsock::22.\n"	×
252	"→ connect via 'ssh vsock/%u' from host", local_cid);
253	return 0;
254	}
255
UNCOV 256	static int add_local_unix_socket(	×
257	const char *dest,
258	const char *sshd_binary,
259	const char *found_sshd_template_unit,
260	char **generated_sshd_template_unit) {
261
UNCOV 262	int r;	×
263
264	assert(dest);	×
UNCOV 265	assert(sshd_binary);	×
266	assert(generated_sshd_template_unit);	×
267
268	r = make_sshd_template_unit(	×
269	dest,
270	"sshd-unix-local@.service",
271	sshd_binary,
272	found_sshd_template_unit,
273	generated_sshd_template_unit);
UNCOV 274	if (r < 0)	×
275	return r;
276
UNCOV 277	r = write_socket_unit(	×
278	dest,
279	"sshd-unix-local.socket",
280	"/run/ssh-unix-local/socket",
281	"AF_UNIX Local",
282	/* with_ssh_access_target_dependency= */ false);
UNCOV 283	if (r < 0)	×
284	return r;
285
UNCOV 286	log_debug("Binding SSH to AF_UNIX socket /run/ssh-unix-local/socket.\n"	×
287	"→ connect via 'ssh .host' locally");
288	return 0;
289	}
290
UNCOV 291	static int add_export_unix_socket(	×
292	const char *dest,
293	const char *sshd_binary,
294	const char *found_sshd_template_unit,
295	char **generated_sshd_template_unit) {
296
UNCOV 297	int r;	×
298
299	assert(dest);	×
UNCOV 300	assert(sshd_binary);	×
301	assert(generated_sshd_template_unit);	×
302
303	Virtualization v = detect_container();	×
UNCOV 304	if (v < 0)	×
305	return log_error_errno(v, "Failed to detect if we run in a container: %m");	×
306	if (v == VIRTUALIZATION_NONE) {	×
307	log_debug("Not running in container, not listening on /run/host/unix-export/ssh");	×
308	return 0;	×
309	}
310
UNCOV 311	if (access("/run/host/unix-export/", W_OK) < 0) {	×
UNCOV 312	if (errno == ENOENT) {	×
313	log_debug("Container manager does not provide /run/host/unix-export/ mount, not binding AF_UNIX socket there.");	×
314	return 0;	×
315	}
316	if (errno == EROFS \|\| ERRNO_IS_PRIVILEGE(errno)) {	×
UNCOV 317	log_debug("Container manager does not provide write access to /run/host/unix-export/, not binding AF_UNIX socket there.");	×
318	return 0;	×
319	}
320
UNCOV 321	return log_error_errno(errno, "Unable to check if /run/host/unix-export exists: %m");	×
322	}
323
UNCOV 324	r = make_sshd_template_unit(	×
325	dest,
326	"sshd-unix-export@.service",
327	sshd_binary,
328	found_sshd_template_unit,
329	generated_sshd_template_unit);
UNCOV 330	if (r < 0)	×
331	return r;
332
UNCOV 333	r = write_socket_unit(	×
334	dest,
335	"sshd-unix-export.socket",
336	"/run/host/unix-export/ssh",
337	"AF_UNIX Export",
338	/* with_ssh_access_target_dependency= */ true);
UNCOV 339	if (r < 0)	×
340	return r;
341
UNCOV 342	log_debug("Binding SSH to AF_UNIX socket /run/host/unix-export/ssh\n"	×
343	"→ connect via 'ssh unix/run/systemd/nspawn/unix-export/\?\?\?/ssh' from host");
344
345	return 0;
346	}
347
UNCOV 348	static int add_extra_sockets(	×
349	const char *dest,
350	const char *sshd_binary,
351	const char *found_sshd_template_unit,
352	char **generated_sshd_template_unit) {
353
UNCOV 354	unsigned n = 1;	×
UNCOV 355	int r;	×
356
357	assert(dest);	×
UNCOV 358	assert(sshd_binary);	×
359	assert(generated_sshd_template_unit);	×
360
361	if (strv_isempty(arg_listen_extra))	×
362	return 0;
363
UNCOV 364	STRV_FOREACH(i, arg_listen_extra) {	×
UNCOV 365	_cleanup_free_ char service = NULL, socket = NULL;	×
366
367	if (n > 1) {	×
UNCOV 368	if (asprintf(&service, "sshd-extra-%u@.service", n) < 0)	×
369	return log_oom();	×
370
371	if (asprintf(&socket, "sshd-extra-%u.socket", n) < 0)	×
UNCOV 372	return log_oom();	×
373	}
374
UNCOV 375	r = make_sshd_template_unit(	×
376	dest,
377	service ?: "sshd-extra@.service",	×
378	sshd_binary,
379	found_sshd_template_unit,
380	generated_sshd_template_unit);
UNCOV 381	if (r < 0)	×
382	return r;
383
UNCOV 384	r = write_socket_unit(	×
385	dest,
386	socket ?: "sshd-extra.socket",	×
387	*i,
388	*i,
389	/* with_ssh_access_target_dependency= */ true);
UNCOV 390	if (r < 0)	×
391	return r;
392
UNCOV 393	log_debug("Binding SSH to socket %s.", *i);	×
UNCOV 394	n++;	×
395	}
396
397	return 0;
398	}
399
UNCOV 400	static int parse_credentials(void) {	×
UNCOV 401	_cleanup_free_ char *b = NULL;	×
402	size_t sz = 0;	×
403	int r;	×
404
405	r = read_credential_with_decryption("ssh.listen", (void**) &b, &sz);	×
UNCOV 406	if (r <= 0)	×
407	return r;
408
UNCOV 409	_cleanup_fclose_ FILE *f = NULL;	×
UNCOV 410	f = fmemopen_unlocked(b, sz, "r");	×
411	if (!f)	×
412	return log_oom();	×
413
414	for (;;) {	×
UNCOV 415	_cleanup_free_ char *item = NULL;	×
416
417	r = read_stripped_line(f, LINE_MAX, &item);	×
UNCOV 418	if (r == 0)	×
419	break;
420	if (r < 0) {	×
UNCOV 421	log_error_errno(r, "Failed to parse credential 'ssh.listen': %m");	×
422	break;
423	}
424
UNCOV 425	if (startswith(item, "#"))	×
UNCOV 426	continue;	×
427
428	SocketAddress sa;	×
UNCOV 429	r = socket_address_parse(&sa, item);	×
430	if (r < 0) {	×
431	log_warning_errno(r, "Failed to parse systemd.ssh_listen= expression, ignoring: %s", item);	×
432	continue;	×
433	}
434
UNCOV 435	_cleanup_free_ char *s = NULL;	×
UNCOV 436	r = socket_address_print(&sa, &s);	×
437	if (r < 0)	×
438	return log_error_errno(r, "Failed to format socket address: %m");	×
439
440	if (strv_consume(&arg_listen_extra, TAKE_PTR(s)) < 0)	×
UNCOV 441	return log_oom();	×
442	}
443
UNCOV 444	return 0;	×
445	}
446
UNCOV 447	static int run(const char dest, const char dest_early, const char *dest_late) {	×
UNCOV 448	int r;	×
449
450	assert_se(arg_dest = dest);	×
451
452	r = proc_cmdline_parse(parse_proc_cmdline_item, /* userdata= / NULL, / flags= */ 0);	×
UNCOV 453	if (r < 0)	×
454	log_warning_errno(r, "Failed to parse kernel command line, ignoring: %m");	×
455
456	(void) parse_credentials();	×
457
458	strv_sort_uniq(arg_listen_extra);	×
459
460	if (!arg_auto && strv_isempty(arg_listen_extra)) {	×
UNCOV 461	log_debug("Disabling SSH generator logic, because as it has been turned off explicitly.");	×
462	return 0;	×
463	}
464
UNCOV 465	_cleanup_free_ char *sshd_binary = NULL;	×
UNCOV 466	r = find_executable("sshd", &sshd_binary);	×
467	if (r == -ENOENT) {	×
468	log_debug("Disabling SSH generator logic, since sshd is not installed.");	×
469	return 0;	×
470	}
471	if (r < 0)	×
UNCOV 472	return log_error_errno(r, "Failed to determine if sshd is installed: %m");	×
473
474	_cleanup_(lookup_paths_done) LookupPaths lp = {};	×
UNCOV 475	r = lookup_paths_init_or_warn(&lp, RUNTIME_SCOPE_SYSTEM, LOOKUP_PATHS_EXCLUDE_GENERATED, /* root_dir= */ NULL);	×
476	if (r < 0)	×
477	return r;
478
UNCOV 479	_cleanup_free_ char *found_sshd_template_unit = NULL;	×
UNCOV 480	r = unit_file_exists_full(RUNTIME_SCOPE_SYSTEM, &lp, "sshd@.service", &found_sshd_template_unit);	×
481	if (r < 0)	×
482	return log_error_errno(r, "Unable to detect if sshd@.service exists: %m");	×
483
484	_cleanup_free_ char *generated_sshd_template_unit = NULL;	×
UNCOV 485	RET_GATHER(r, add_extra_sockets(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit));	×
486
487	if (arg_auto) {	×
UNCOV 488	RET_GATHER(r, add_vsock_socket(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit));	×
489	RET_GATHER(r, add_local_unix_socket(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit));	×
490	RET_GATHER(r, add_export_unix_socket(dest, sshd_binary, found_sshd_template_unit, &generated_sshd_template_unit));	×
491	}
492
UNCOV 493	return r;	×
494	}
495
UNCOV 496	DEFINE_MAIN_GENERATOR_FUNCTION(run);	×

systemd / systemd / 15175033720

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous